[Mon Nov 10 21:04:54.108979 2025] [:error] [pid 31030:tid 31097] [client 45.153.34.41:52400] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aRHi9jdQpWeECLLAfnZUHwAAAFU"]
[Mon Nov 10 21:50:51.833587 2025] [:error] [pid 31031:tid 31114] [client 45.153.34.41:37836] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aRHtu3I8L5KZTd8nCaaPkQAAAIs"]
[Tue Nov 11 09:24:26.743282 2025] [:error] [pid 53449:tid 53471] [client 112.204.109.62:60659] [client 112.204.109.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.204.109.62, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRKQStpz08j5NoUSzp-qXQAAAVE"]
[Tue Nov 11 09:24:26.751015 2025] [:error] [pid 53449:tid 53471] [client 112.204.109.62:60659] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Nov 12 02:32:13.890786 2025] [:error] [pid 40833:tid 40864] [client 136.158.24.230:11196] [client 136.158.24.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.24.230, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aROBLWTefCfEPkRt3xno_AAAANQ"]
[Wed Nov 12 02:32:13.895512 2025] [:error] [pid 40833:tid 40864] [client 136.158.24.230:11196] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Nov 12 13:25:04.610553 2025] [:error] [pid 60097:tid 60162] [client 3.70.129.70:60562] [client 3.70.129.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aRQaMMdT5oio_TbWpi8gSwAAAMk"]
[Wed Nov 12 13:34:52.267578 2025] [:error] [pid 60097:tid 60164] [client 195.178.110.159:33086] [client 195.178.110.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aRQcfMdT5oio_TbWpi8kSQAAAMs"]
[Wed Nov 12 14:16:11.794509 2025] [:error] [pid 60095:tid 60119] [client 195.178.110.159:36428] [client 195.178.110.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aRQmK3lw2elroagFF1rwTwAAAFQ"]
[Wed Nov 12 19:42:12.427469 2025] [:error] [pid 12744:tid 12770] [client 177.136.227.147:37028] [client 177.136.227.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aRRylJ1cp_ouUvkFj0VoZwAAARY"]
[Wed Nov 12 19:42:14.191801 2025] [:error] [pid 23737:tid 23770] [client 177.136.227.147:37036] [client 177.136.227.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "aRRylhQUsVVfOZWgW_W2NwAAAZU"]
[Wed Nov 12 19:42:16.199840 2025] [:error] [pid 12744:tid 12759] [client 177.136.227.147:37040] [client 177.136.227.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/env/.env"] [unique_id "aRRymJ1cp_ouUvkFj0VocQAAAQs"]
[Wed Nov 12 22:08:18.021387 2025] [:error] [pid 60096:tid 60134] [client 177.200.33.122:55138] [client 177.200.33.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.200.33.122, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRSU0jmzkhCvvk8DXOzImAAAAIg"]
[Wed Nov 12 22:08:18.027069 2025] [:error] [pid 60096:tid 60134] [client 177.200.33.122:55138] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Nov 12 22:12:34.187985 2025] [:error] [pid 60095:tid 60108] [client 117.213.162.155:64134] [client 117.213.162.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.213.162.155, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRSV0nlw2elroagFF1pWzwAAAEk"]
[Wed Nov 12 22:12:34.192830 2025] [:error] [pid 60095:tid 60108] [client 117.213.162.155:64134] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Nov 13 17:55:43.852728 2025] [:error] [pid 44245:tid 44267] [client 150.241.107.255:56437] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRWrH4k7r-HKZdqw-dXPPgAAAVA"]
[Thu Nov 13 17:55:44.400646 2025] [:error] [pid 62216:tid 62270] [client 150.241.107.255:56650] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRWrIOpyFB9M2aVQhwM0nAAAABc"]
[Thu Nov 13 17:55:44.950751 2025] [:error] [pid 44354:tid 44369] [client 150.241.107.255:56861] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrIHqKopQhy3G4s3l0hgAAAYo"]
[Thu Nov 13 18:17:35.157872 2025] [:error] [pid 62215:tid 62220] [client 126.209.53.84:53798] [client 126.209.53.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.53.84, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRWwP0vClof1c6XaOBW0bAAAAME"]
[Thu Nov 13 18:17:35.163027 2025] [:error] [pid 62215:tid 62220] [client 126.209.53.84:53798] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Nov 13 22:51:45.472226 2025] [:error] [pid 19872:tid 19882] [client 45.138.16.29:60917] [client 45.138.16.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/postnews.php"] [unique_id "aRXwgcusrN1b6ZJ_vbso9gAAAEU"]
[Thu Nov 13 22:51:45.998276 2025] [:error] [pid 5086:tid 5095] [client 45.138.16.29:61095] [client 45.138.16.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/postnews.php"] [unique_id "aRXwgR_dsYLFCHw574jBpAAAAQY"]
[Thu Nov 13 22:51:46.527775 2025] [:error] [pid 5086:tid 5102] [client 45.138.16.29:61350] [client 45.138.16.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "aRXwgh_dsYLFCHw574jBqQAAAQ0"]
[Fri Nov 14 02:41:27.922197 2025] [:error] [pid 56496:tid 56546] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Nov 14 02:41:28.285235 2025] [:error] [pid 56496:tid 56529] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Fri Nov 14 02:41:28.644692 2025] [:error] [pid 56496:tid 56552] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Nov 14 02:41:28.891221 2025] [:error] [pid 56496:tid 56533] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Nov 14 02:41:29.114909 2025] [:error] [pid 56496:tid 56530] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Nov 14 02:41:29.380648 2025] [:error] [pid 56496:tid 56536] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Nov 14 02:41:30.847013 2025] [:error] [pid 56496:tid 56536] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/meta.php
[Fri Nov 14 02:41:31.087942 2025] [:error] [pid 56496:tid 56550] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Fri Nov 14 02:41:31.481637 2025] [:error] [pid 56496:tid 56551] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri Nov 14 02:41:31.873437 2025] [:error] [pid 56496:tid 56535] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Nov 14 02:41:32.217402 2025] [:error] [pid 56496:tid 56548] [client 40.122.173.152:43758] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Fri Nov 14 02:41:32.476940 2025] [:error] [pid 56496:tid 56532] [client 40.122.173.152:43758] [client 40.122.173.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRYmXOh2ME7eucGJGGLYuQAAAAQ"]
[Fri Nov 14 02:41:33.558089 2025] [:error] [pid 56586:tid 56605] [client 40.122.173.152:52652] [client 40.122.173.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRYmXa7eYD3G9deYMP5gewAAAY4"]
[Fri Nov 14 02:41:34.464338 2025] [:error] [pid 49246:tid 49270] [client 40.122.173.152:59257] [client 40.122.173.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRYmXt-hdG_ZJBT6alMFRwAAAFQ"]
[Fri Nov 14 02:41:35.024251 2025] [:error] [pid 56495:tid 56519] [client 40.122.173.152:57862] [client 40.122.173.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRYmX1wO8wZZL5WJceXfQgAAANQ"]
[Fri Nov 14 05:47:38.372392 2025] [:error] [pid 47154:tid 47166] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/saiga.php
[Fri Nov 14 05:47:38.571050 2025] [:error] [pid 47154:tid 47183] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Nov 14 05:47:38.764173 2025] [:error] [pid 47154:tid 47169] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/tesTxcg.php
[Fri Nov 14 05:47:38.954896 2025] [:error] [pid 47154:tid 47161] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Nov 14 05:47:39.145063 2025] [:error] [pid 47154:tid 47160] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Nov 14 05:47:39.338251 2025] [:error] [pid 47154:tid 47168] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Nov 14 05:47:39.542675 2025] [:error] [pid 47154:tid 47176] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/shell_e866vaqd.php
[Fri Nov 14 05:47:39.734099 2025] [:error] [pid 47154:tid 47182] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Nov 14 05:47:39.927248 2025] [:error] [pid 47154:tid 47173] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settin.zip.php
[Fri Nov 14 05:47:40.119626 2025] [:error] [pid 47154:tid 47172] [client 172.202.1.208:58952] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-comments-post.php
[Fri Nov 14 05:47:40.503493 2025] [:error] [pid 47154:tid 47180] [client 172.202.1.208:58952] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aRZR_EijA13A3g3ATrJoFQAAABU"]
[Fri Nov 14 05:47:41.287827 2025] [:error] [pid 47156:tid 47217] [client 172.202.1.208:62549] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aRZR_djrQX_P-kC7M_7pBAAAAIM"]
[Fri Nov 14 05:47:41.805327 2025] [:error] [pid 47630:tid 47643] [client 172.202.1.208:62488] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aRZR_cxXXNBfWgpfVJ4ikAAAAQs"]
[Fri Nov 14 05:47:42.853066 2025] [:error] [pid 47242:tid 47247] [client 172.202.1.208:62478] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aRZR_lPNnvrux3OMagyAzgAAAMI"]
[Fri Nov 14 05:47:43.973499 2025] [:error] [pid 47156:tid 47233] [client 172.202.1.208:62573] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/storage.php"] [unique_id "aRZR_9jrQX_P-kC7M_7pEAAAAJM"]
[Fri Nov 14 05:47:45.002709 2025] [:error] [pid 47156:tid 47221] [client 172.202.1.208:62556] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/storage.php"] [unique_id "aRZSAdjrQX_P-kC7M_7pGAAAAIc"]
[Fri Nov 14 05:47:45.907092 2025] [:error] [pid 47630:tid 47635] [client 172.202.1.208:62555] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/storage.php"] [unique_id "aRZSAcxXXNBfWgpfVJ4iqQAAAQM"]
[Fri Nov 14 05:47:46.748669 2025] [:error] [pid 47630:tid 47639] [client 172.202.1.208:62493] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/storage.php"] [unique_id "aRZSAsxXXNBfWgpfVJ4isgAAAQc"]
[Fri Nov 14 05:47:47.686777 2025] [:error] [pid 47156:tid 47218] [client 172.202.1.208:62494] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aRZSA9jrQX_P-kC7M_7pJQAAAIQ"]
[Fri Nov 14 05:47:48.501663 2025] [:error] [pid 47630:tid 47649] [client 172.202.1.208:62586] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aRZSBMxXXNBfWgpfVJ4iugAAARE"]
[Fri Nov 14 05:47:49.466476 2025] [:error] [pid 47242:tid 47265] [client 172.202.1.208:62565] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aRZSBVPNnvrux3OMagyA2AAAANQ"]
[Fri Nov 14 05:47:50.071485 2025] [:error] [pid 47630:tid 47641] [client 172.202.1.208:62480] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aRZSBsxXXNBfWgpfVJ4iwQAAAQk"]
[Fri Nov 14 05:47:51.232933 2025] [:error] [pid 47630:tid 47644] [client 172.202.1.208:62479] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aRZSB8xXXNBfWgpfVJ4ixAAAAQw"]
[Fri Nov 14 05:47:52.210003 2025] [:error] [pid 47630:tid 47632] [client 172.202.1.208:62483] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aRZSCMxXXNBfWgpfVJ4iyAAAAQA"]
[Fri Nov 14 05:47:52.719738 2025] [:error] [pid 47242:tid 47254] [client 172.202.1.208:62587] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aRZSCFPNnvrux3OMagyA4AAAAMk"]
[Fri Nov 14 05:47:53.397966 2025] [:error] [pid 47630:tid 47645] [client 172.202.1.208:62522] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aRZSCcxXXNBfWgpfVJ4izwAAAQ0"]
[Fri Nov 14 05:47:54.527664 2025] [:error] [pid 47155:tid 47198] [client 172.202.1.208:62591] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phi2.php"] [unique_id "aRZSCpipxRXMZJH8hmjuPAAAAEw"]
[Fri Nov 14 05:47:57.374342 2025] [:error] [pid 47242:tid 47267] [client 172.202.1.208:62558] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phi2.php"] [unique_id "aRZSDVPNnvrux3OMagyA9wAAANY"]
[Fri Nov 14 05:47:58.312130 2025] [:error] [pid 47242:tid 47255] [client 172.202.1.208:58946] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phi2.php"] [unique_id "aRZSDlPNnvrux3OMagyA_AAAAMo"]
[Fri Nov 14 05:47:59.067834 2025] [:error] [pid 47242:tid 47256] [client 172.202.1.208:62486] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phi2.php"] [unique_id "aRZSD1PNnvrux3OMagyA_QAAAMs"]
[Fri Nov 14 05:47:59.639895 2025] [:error] [pid 47242:tid 47246] [client 172.202.1.208:58974] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24(3).php"] [unique_id "aRZSD1PNnvrux3OMagyA_wAAAME"]
[Fri Nov 14 05:48:00.786358 2025] [:error] [pid 47630:tid 47645] [client 172.202.1.208:62564] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24(3).php"] [unique_id "aRZSEMxXXNBfWgpfVJ4i6gAAAQ0"]
[Fri Nov 14 05:48:02.213996 2025] [:error] [pid 47630:tid 47639] [client 172.202.1.208:62510] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24(3).php"] [unique_id "aRZSEsxXXNBfWgpfVJ4i8AAAAQc"]
[Fri Nov 14 05:48:03.119513 2025] [:error] [pid 47155:tid 47188] [client 172.202.1.208:58969] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24(3).php"] [unique_id "aRZSE5ipxRXMZJH8hmjuUAAAAEI"]
[Fri Nov 14 05:48:03.664627 2025] [:error] [pid 47155:tid 47210] [client 172.202.1.208:58944] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aRZSE5ipxRXMZJH8hmjuUgAAAFg"]
[Fri Nov 14 05:48:04.514729 2025] [:error] [pid 47155:tid 47199] [client 172.202.1.208:62492] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aRZSFJipxRXMZJH8hmjuUwAAAE0"]
[Fri Nov 14 05:48:05.156644 2025] [:error] [pid 47154:tid 47178] [client 172.202.1.208:62538] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aRZSFUijA13A3g3ATrJoZAAAABM"]
[Fri Nov 14 05:48:06.426818 2025] [:error] [pid 47154:tid 47176] [client 172.202.1.208:58963] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aRZSFkijA13A3g3ATrJoZwAAABE"]
[Fri Nov 14 05:48:07.791334 2025] [:error] [pid 47155:tid 47197] [client 172.202.1.208:62575] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_72ad28.php"] [unique_id "aRZSF5ipxRXMZJH8hmjuYQAAAEs"]
[Fri Nov 14 05:48:08.969482 2025] [:error] [pid 47630:tid 47638] [client 172.202.1.208:62571] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_72ad28.php"] [unique_id "aRZSGMxXXNBfWgpfVJ4jDQAAAQY"]
[Fri Nov 14 05:48:09.544593 2025] [:error] [pid 47630:tid 47647] [client 172.202.1.208:62576] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_72ad28.php"] [unique_id "aRZSGcxXXNBfWgpfVJ4jEgAAAQ8"]
[Fri Nov 14 05:48:10.230899 2025] [:error] [pid 47242:tid 47253] [client 172.202.1.208:58963] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_72ad28.php"] [unique_id "aRZSGlPNnvrux3OMagyBFAAAAMg"]
[Fri Nov 14 05:48:10.787212 2025] [:error] [pid 47156:tid 47221] [client 172.202.1.208:62521] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flex.php"] [unique_id "aRZSGtjrQX_P-kC7M_7pqwAAAIc"]
[Fri Nov 14 05:48:12.076109 2025] [:error] [pid 47154:tid 47174] [client 172.202.1.208:58955] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flex.php"] [unique_id "aRZSHEijA13A3g3ATrJoaQAAAA8"]
[Fri Nov 14 05:48:12.750933 2025] [:error] [pid 47630:tid 47652] [client 172.202.1.208:58926] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flex.php"] [unique_id "aRZSHMxXXNBfWgpfVJ4jJQAAARQ"]
[Fri Nov 14 05:48:14.049785 2025] [:error] [pid 47242:tid 47251] [client 172.202.1.208:58887] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flex.php"] [unique_id "aRZSHlPNnvrux3OMagyBLQAAAMY"]
[Fri Nov 14 05:48:15.045393 2025] [:error] [pid 47630:tid 47642] [client 172.202.1.208:58959] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aRZSH8xXXNBfWgpfVJ4jTgAAAQo"]
[Fri Nov 14 05:48:16.005065 2025] [:error] [pid 47156:tid 47231] [client 172.202.1.208:58967] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aRZSINjrQX_P-kC7M_7pvAAAAJE"]
[Fri Nov 14 05:48:16.683099 2025] [:error] [pid 47155:tid 47207] [client 172.202.1.208:62578] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aRZSIJipxRXMZJH8hmjucgAAAFU"]
[Fri Nov 14 05:48:17.431134 2025] [:error] [pid 47156:tid 47219] [client 172.202.1.208:62467] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aRZSIdjrQX_P-kC7M_7pwQAAAIU"]
[Fri Nov 14 05:48:18.250722 2025] [:error] [pid 47630:tid 47647] [client 172.202.1.208:62470] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRZSIsxXXNBfWgpfVJ4jWwAAAQ8"]
[Fri Nov 14 05:48:18.718661 2025] [:error] [pid 47156:tid 47218] [client 172.202.1.208:58908] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRZSItjrQX_P-kC7M_7pxAAAAIQ"]
[Fri Nov 14 05:48:19.775472 2025] [:error] [pid 47630:tid 47636] [client 172.202.1.208:58894] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRZSI8xXXNBfWgpfVJ4jYQAAAQQ"]
[Fri Nov 14 05:48:20.314440 2025] [:error] [pid 47630:tid 47638] [client 172.202.1.208:62485] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aRZSJMxXXNBfWgpfVJ4jYwAAAQY"]
[Fri Nov 14 05:48:20.896417 2025] [:error] [pid 47154:tid 47177] [client 172.202.1.208:62498] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell_079vbgeg.php"] [unique_id "aRZSJEijA13A3g3ATrJogQAAABI"]
[Fri Nov 14 05:48:21.330437 2025] [:error] [pid 47155:tid 47200] [client 172.202.1.208:62466] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell_079vbgeg.php"] [unique_id "aRZSJZipxRXMZJH8hmjugAAAAE4"]
[Fri Nov 14 05:48:21.801802 2025] [:error] [pid 47154:tid 47183] [client 172.202.1.208:62546] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell_079vbgeg.php"] [unique_id "aRZSJUijA13A3g3ATrJogwAAABg"]
[Fri Nov 14 05:48:22.637904 2025] [:error] [pid 47630:tid 47651] [client 172.202.1.208:62553] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell_079vbgeg.php"] [unique_id "aRZSJsxXXNBfWgpfVJ4jbAAAARM"]
[Fri Nov 14 05:48:23.197926 2025] [:error] [pid 47630:tid 47638] [client 172.202.1.208:62560] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aRZSJ8xXXNBfWgpfVJ4jbgAAAQY"]
[Fri Nov 14 05:48:23.698626 2025] [:error] [pid 47242:tid 47245] [client 172.202.1.208:62566] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aRZSJ1PNnvrux3OMagyBbAAAAMA"]
[Fri Nov 14 05:48:24.680887 2025] [:error] [pid 47630:tid 47651] [client 172.202.1.208:62580] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aRZSKMxXXNBfWgpfVJ4jeAAAARM"]
[Fri Nov 14 05:48:25.443204 2025] [:error] [pid 47242:tid 47256] [client 172.202.1.208:62513] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aRZSKVPNnvrux3OMagyBcQAAAMs"]
[Fri Nov 14 05:48:26.245937 2025] [:error] [pid 47242:tid 47257] [client 172.202.1.208:62491] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seznec.net.php"] [unique_id "aRZSKlPNnvrux3OMagyBeAAAAMw"]
[Fri Nov 14 05:48:27.207453 2025] [:error] [pid 47155:tid 47205] [client 172.202.1.208:58972] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seznec.net.php"] [unique_id "aRZSK5ipxRXMZJH8hmjuiQAAAFM"]
[Fri Nov 14 05:48:27.980648 2025] [:error] [pid 47630:tid 47633] [client 172.202.1.208:62514] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seznec.net.php"] [unique_id "aRZSK8xXXNBfWgpfVJ4jjQAAAQE"]
[Fri Nov 14 05:48:28.834435 2025] [:error] [pid 47154:tid 47160] [client 172.202.1.208:62520] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seznec.net.php"] [unique_id "aRZSLEijA13A3g3ATrJojQAAAAE"]
[Fri Nov 14 05:48:29.498586 2025] [:error] [pid 47242:tid 47267] [client 172.202.1.208:62481] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aRZSLVPNnvrux3OMagyBggAAANY"]
[Fri Nov 14 05:48:29.994652 2025] [:error] [pid 47630:tid 47655] [client 172.202.1.208:62501] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aRZSLcxXXNBfWgpfVJ4jjwAAARc"]
[Fri Nov 14 05:48:30.704370 2025] [:error] [pid 47630:tid 47650] [client 172.202.1.208:62472] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aRZSLsxXXNBfWgpfVJ4jlAAAARI"]
[Fri Nov 14 05:48:31.378238 2025] [:error] [pid 47156:tid 47236] [client 172.202.1.208:62523] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aRZSL9jrQX_P-kC7M_7p0wAAAJU"]
[Fri Nov 14 05:48:32.196507 2025] [:error] [pid 47242:tid 47268] [client 172.202.1.208:58975] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iotav1.php"] [unique_id "aRZSMFPNnvrux3OMagyBigAAANc"]
[Fri Nov 14 05:48:32.905250 2025] [:error] [pid 47242:tid 47266] [client 172.202.1.208:62584] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iotav1.php"] [unique_id "aRZSMFPNnvrux3OMagyBjgAAANU"]
[Fri Nov 14 05:48:33.688450 2025] [:error] [pid 47242:tid 47256] [client 172.202.1.208:62547] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iotav1.php"] [unique_id "aRZSMVPNnvrux3OMagyBkQAAAMs"]
[Fri Nov 14 05:48:34.776583 2025] [:error] [pid 47156:tid 47234] [client 172.202.1.208:58985] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iotav1.php"] [unique_id "aRZSMtjrQX_P-kC7M_7p1gAAAJQ"]
[Fri Nov 14 05:48:35.541597 2025] [:error] [pid 47154:tid 47169] [client 172.202.1.208:58890] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z555.php"] [unique_id "aRZSM0ijA13A3g3ATrJopwAAAAo"]
[Fri Nov 14 05:48:36.272468 2025] [:error] [pid 47156:tid 47224] [client 172.202.1.208:62550] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z555.php"] [unique_id "aRZSNNjrQX_P-kC7M_7p2AAAAIo"]
[Fri Nov 14 05:48:37.024257 2025] [:error] [pid 47242:tid 47263] [client 172.202.1.208:62507] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z555.php"] [unique_id "aRZSNVPNnvrux3OMagyBmwAAANI"]
[Fri Nov 14 05:48:38.060670 2025] [:error] [pid 47156:tid 47215] [client 172.202.1.208:62477] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z555.php"] [unique_id "aRZSNtjrQX_P-kC7M_7p4QAAAIE"]
[Fri Nov 14 05:48:39.401785 2025] [:error] [pid 47155:tid 47188] [client 172.202.1.208:62553] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content.php"] [unique_id "aRZSN5ipxRXMZJH8hmjukwAAAEI"]
[Fri Nov 14 05:48:40.162973 2025] [:error] [pid 47630:tid 47641] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Fri Nov 14 05:48:40.376942 2025] [:error] [pid 47630:tid 47639] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Nov 14 05:48:40.573679 2025] [:error] [pid 47630:tid 47640] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri Nov 14 05:48:40.770386 2025] [:error] [pid 47630:tid 47654] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/iota3.php
[Fri Nov 14 05:48:41.139811 2025] [:error] [pid 47630:tid 47655] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Nov 14 05:48:41.328756 2025] [:error] [pid 47630:tid 47648] [client 172.202.1.208:62537] [client 172.202.1.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.202.1.208, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRZSOcxXXNBfWgpfVJ4jsAAAARA"]
[Fri Nov 14 05:48:41.334020 2025] [:error] [pid 47630:tid 47648] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Nov 14 05:48:41.528414 2025] [:error] [pid 47630:tid 47647] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/kappa1.php
[Fri Nov 14 05:48:41.826379 2025] [:error] [pid 47630:tid 47643] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Fri Nov 14 05:48:42.284808 2025] [:error] [pid 47630:tid 47633] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Fri Nov 14 05:48:42.503708 2025] [:error] [pid 47630:tid 47635] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Nov 14 05:48:42.714879 2025] [:error] [pid 47630:tid 47632] [client 172.202.1.208:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Nov 14 05:48:42.904450 2025] [:error] [pid 47630:tid 47641] [client 172.202.1.208:62537] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aRZSOsxXXNBfWgpfVJ4juwAAAQk"]
[Fri Nov 14 05:48:43.682906 2025] [:error] [pid 47155:tid 47198] [client 172.202.1.208:62527] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aRZSO5ipxRXMZJH8hmjunwAAAEw"]
[Fri Nov 14 05:48:45.075715 2025] [:error] [pid 47156:tid 47224] [client 172.202.1.208:58981] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aRZSPdjrQX_P-kC7M_7p8gAAAIo"]
[Fri Nov 14 05:48:46.108691 2025] [:error] [pid 47156:tid 47230] [client 172.202.1.208:58948] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aRZSPtjrQX_P-kC7M_7p9gAAAJA"]
[Fri Nov 14 05:48:46.923167 2025] [:error] [pid 47242:tid 47261] [client 172.202.1.208:58914] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aRZSPlPNnvrux3OMagyBswAAANA"]
[Fri Nov 14 05:48:47.345833 2025] [:error] [pid 47155:tid 47205] [client 172.202.1.208:62588] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aRZSP5ipxRXMZJH8hmjuqAAAAFM"]
[Fri Nov 14 05:48:47.811620 2025] [:error] [pid 47155:tid 47193] [client 172.202.1.208:62509] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aRZSP5ipxRXMZJH8hmjuqQAAAEc"]
[Fri Nov 14 05:48:48.382513 2025] [:error] [pid 47242:tid 47262] [client 172.202.1.208:62524] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aRZSQFPNnvrux3OMagyBuwAAANE"]
[Fri Nov 14 05:48:49.125544 2025] [:error] [pid 47156:tid 47231] [client 172.202.1.208:62506] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gamma4.php"] [unique_id "aRZSQdjrQX_P-kC7M_7p-gAAAJE"]
[Fri Nov 14 05:48:49.716468 2025] [:error] [pid 47242:tid 47258] [client 172.202.1.208:62583] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gamma4.php"] [unique_id "aRZSQVPNnvrux3OMagyBxgAAAM0"]
[Fri Nov 14 05:48:50.276200 2025] [:error] [pid 47156:tid 47234] [client 172.202.1.208:57442] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gamma4.php"] [unique_id "aRZSQtjrQX_P-kC7M_7p_AAAAJQ"]
[Fri Nov 14 05:48:50.802373 2025] [:error] [pid 47154:tid 47165] [client 172.202.1.208:62489] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gamma4.php"] [unique_id "aRZSQkijA13A3g3ATrJoxwAAAAY"]
[Fri Nov 14 05:48:51.265390 2025] [:error] [pid 47155:tid 47192] [client 172.202.1.208:58968] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/omega4.php"] [unique_id "aRZSQ5ipxRXMZJH8hmjusgAAAEY"]
[Fri Nov 14 05:48:52.056660 2025] [:error] [pid 47155:tid 47210] [client 172.202.1.208:62525] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/omega4.php"] [unique_id "aRZSRJipxRXMZJH8hmjutwAAAFg"]
[Fri Nov 14 05:48:52.635762 2025] [:error] [pid 47630:tid 47638] [client 172.202.1.208:58957] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/omega4.php"] [unique_id "aRZSRMxXXNBfWgpfVJ4jzgAAAQY"]
[Fri Nov 14 05:48:53.055647 2025] [:error] [pid 47630:tid 47652] [client 172.202.1.208:62542] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/omega4.php"] [unique_id "aRZSRcxXXNBfWgpfVJ4j0AAAARQ"]
[Fri Nov 14 05:48:53.919573 2025] [:error] [pid 47156:tid 47215] [client 172.202.1.208:62475] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/wp-conflg.php"] [unique_id "aRZSRdjrQX_P-kC7M_7qAgAAAIE"]
[Fri Nov 14 05:48:54.712012 2025] [:error] [pid 47154:tid 47181] [client 172.202.1.208:58906] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/wp-conflg.php"] [unique_id "aRZSRkijA13A3g3ATrJoywAAABY"]
[Fri Nov 14 05:48:55.893200 2025] [:error] [pid 47242:tid 47245] [client 172.202.1.208:62568] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/wp-conflg.php"] [unique_id "aRZSR1PNnvrux3OMagyB2wAAAMA"]
[Fri Nov 14 05:48:56.329608 2025] [:error] [pid 47630:tid 47641] [client 172.202.1.208:58971] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/wp-conflg.php"] [unique_id "aRZSSMxXXNBfWgpfVJ4j2wAAAQk"]
[Fri Nov 14 05:48:57.130621 2025] [:error] [pid 47156:tid 47223] [client 172.202.1.208:62469] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_syndicate_cajs86ik4t.php"] [unique_id "aRZSSdjrQX_P-kC7M_7qBgAAAIk"]
[Fri Nov 14 05:48:57.986614 2025] [:error] [pid 47154:tid 47182] [client 172.202.1.208:62484] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_syndicate_cajs86ik4t.php"] [unique_id "aRZSSUijA13A3g3ATrJo1AAAABc"]
[Fri Nov 14 05:49:01.167658 2025] [:error] [pid 47242:tid 47251] [client 172.202.1.208:62490] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_syndicate_cajs86ik4t.php"] [unique_id "aRZSTVPNnvrux3OMagyB5QAAAMY"]
[Fri Nov 14 05:49:01.716875 2025] [:error] [pid 47154:tid 47163] [client 172.202.1.208:62477] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_syndicate_cajs86ik4t.php"] [unique_id "aRZSTUijA13A3g3ATrJo2gAAAAQ"]
[Fri Nov 14 05:49:02.801612 2025] [:error] [pid 47156:tid 47222] [client 172.202.1.208:58973] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aRZSTtjrQX_P-kC7M_7qEAAAAIg"]
[Fri Nov 14 05:49:03.510612 2025] [:error] [pid 47155:tid 47198] [client 172.202.1.208:57380] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aRZST5ipxRXMZJH8hmjuzgAAAEw"]
[Fri Nov 14 05:49:04.615349 2025] [:error] [pid 47630:tid 47632] [client 172.202.1.208:58960] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aRZSUMxXXNBfWgpfVJ4j7gAAAQA"]
[Fri Nov 14 05:49:05.560083 2025] [:error] [pid 47156:tid 47217] [client 172.202.1.208:58931] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aRZSUdjrQX_P-kC7M_7qFQAAAIM"]
[Fri Nov 14 05:49:06.383259 2025] [:error] [pid 47156:tid 47234] [client 172.202.1.208:58899] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/betacustom.php"] [unique_id "aRZSUtjrQX_P-kC7M_7qFwAAAJQ"]
[Fri Nov 14 05:49:07.273054 2025] [:error] [pid 47630:tid 47648] [client 172.202.1.208:62503] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/betacustom.php"] [unique_id "aRZSU8xXXNBfWgpfVJ4j8gAAARA"]
[Fri Nov 14 05:49:07.878513 2025] [:error] [pid 47155:tid 47200] [client 172.202.1.208:62499] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/betacustom.php"] [unique_id "aRZSU5ipxRXMZJH8hmju0QAAAE4"]
[Fri Nov 14 05:49:08.785605 2025] [:error] [pid 47630:tid 47653] [client 172.202.1.208:58951] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/betacustom.php"] [unique_id "aRZSVMxXXNBfWgpfVJ4j9gAAARU"]
[Fri Nov 14 05:49:09.323416 2025] [:error] [pid 47156:tid 47215] [client 172.202.1.208:58935] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aRZSVdjrQX_P-kC7M_7qIAAAAIE"]
[Fri Nov 14 05:49:09.781637 2025] [:error] [pid 47156:tid 47223] [client 172.202.1.208:57418] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aRZSVdjrQX_P-kC7M_7qIQAAAIk"]
[Fri Nov 14 05:49:10.535373 2025] [:error] [pid 47630:tid 47650] [client 172.202.1.208:62534] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aRZSVsxXXNBfWgpfVJ4j_QAAARI"]
[Fri Nov 14 05:49:11.344714 2025] [:error] [pid 47155:tid 47189] [client 172.202.1.208:62516] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aRZSV5ipxRXMZJH8hmju2QAAAEM"]
[Fri Nov 14 05:49:11.953104 2025] [:error] [pid 47154:tid 47172] [client 172.202.1.208:58919] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/delta2.php"] [unique_id "aRZSV0ijA13A3g3ATrJo6AAAAA0"]
[Fri Nov 14 05:49:12.573541 2025] [:error] [pid 47630:tid 47639] [client 172.202.1.208:57409] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/delta2.php"] [unique_id "aRZSWMxXXNBfWgpfVJ4kBAAAAQc"]
[Fri Nov 14 05:49:13.088783 2025] [:error] [pid 47156:tid 47219] [client 172.202.1.208:58949] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/delta2.php"] [unique_id "aRZSWdjrQX_P-kC7M_7qKwAAAIU"]
[Fri Nov 14 05:49:13.759657 2025] [:error] [pid 47155:tid 47196] [client 172.202.1.208:59005] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/delta2.php"] [unique_id "aRZSWZipxRXMZJH8hmju2wAAAEo"]
[Fri Nov 14 05:49:14.594494 2025] [:error] [pid 47155:tid 47200] [client 172.202.1.208:62471] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRZSWpipxRXMZJH8hmju3gAAAE4"]
[Fri Nov 14 05:49:15.504909 2025] [:error] [pid 47154:tid 47179] [client 172.202.1.208:57450] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRZSW0ijA13A3g3ATrJo8QAAABQ"]
[Fri Nov 14 05:49:16.236045 2025] [:error] [pid 47630:tid 47652] [client 172.202.1.208:58880] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRZSXMxXXNBfWgpfVJ4kDQAAARQ"]
[Fri Nov 14 05:49:16.801656 2025] [:error] [pid 47154:tid 47164] [client 172.202.1.208:62563] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRZSXEijA13A3g3ATrJo9QAAAAU"]
[Fri Nov 14 05:49:17.527582 2025] [:error] [pid 47154:tid 47171] [client 172.202.1.208:62567] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aRZSXUijA13A3g3ATrJo9wAAAAw"]
[Fri Nov 14 05:49:18.071139 2025] [:error] [pid 47242:tid 47266] [client 172.202.1.208:62505] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aRZSXlPNnvrux3OMagyB-QAAANU"]
[Fri Nov 14 05:49:18.932773 2025] [:error] [pid 47156:tid 47228] [client 172.202.1.208:58962] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aRZSXtjrQX_P-kC7M_7qOQAAAI4"]
[Fri Nov 14 05:49:19.765082 2025] [:error] [pid 47630:tid 47654] [client 172.202.1.208:58983] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aRZSX8xXXNBfWgpfVJ4kHAAAARY"]
[Fri Nov 14 05:49:20.314485 2025] [:error] [pid 47630:tid 47648] [client 172.202.1.208:62496] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aRZSYMxXXNBfWgpfVJ4kIgAAARA"]
[Fri Nov 14 05:49:21.307115 2025] [:error] [pid 47154:tid 47170] [client 172.202.1.208:58988] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aRZSYUijA13A3g3ATrJo_QAAAAs"]
[Fri Nov 14 05:49:22.039013 2025] [:error] [pid 47154:tid 47175] [client 172.202.1.208:58964] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aRZSYkijA13A3g3ATrJo_gAAABA"]
[Fri Nov 14 05:49:22.944790 2025] [:error] [pid 47154:tid 47171] [client 172.202.1.208:62464] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aRZSYkijA13A3g3ATrJpAAAAAAw"]
[Fri Nov 14 05:49:23.697027 2025] [:error] [pid 47156:tid 47237] [client 172.202.1.208:58941] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeta2.php"] [unique_id "aRZSY9jrQX_P-kC7M_7qPAAAAJY"]
[Fri Nov 14 05:49:24.541735 2025] [:error] [pid 47155:tid 47202] [client 172.202.1.208:58989] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeta2.php"] [unique_id "aRZSZJipxRXMZJH8hmju4wAAAFA"]
[Fri Nov 14 05:49:25.200407 2025] [:error] [pid 47242:tid 47263] [client 172.202.1.208:57456] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeta2.php"] [unique_id "aRZSZVPNnvrux3OMagyCDAAAANI"]
[Fri Nov 14 05:49:26.025637 2025] [:error] [pid 47242:tid 47261] [client 172.202.1.208:62589] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeta2.php"] [unique_id "aRZSZlPNnvrux3OMagyCEQAAANA"]
[Fri Nov 14 05:49:27.017765 2025] [:error] [pid 47154:tid 47170] [client 172.202.1.208:57441] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRZSZ0ijA13A3g3ATrJpBgAAAAs"]
[Fri Nov 14 05:49:28.347209 2025] [:error] [pid 47242:tid 47256] [client 172.202.1.208:62465] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRZSaFPNnvrux3OMagyCFQAAAMs"]
[Fri Nov 14 05:49:30.508056 2025] [:error] [pid 47630:tid 47649] [client 172.202.1.208:57432] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRZSasxXXNBfWgpfVJ4kMQAAARE"]
[Fri Nov 14 05:49:32.822064 2025] [:error] [pid 47155:tid 47195] [client 172.202.1.208:58912] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRZSbJipxRXMZJH8hmju6gAAAEk"]
[Fri Nov 14 05:49:34.093537 2025] [:error] [pid 47242:tid 47267] [client 172.202.1.208:58956] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10235.php"] [unique_id "aRZSblPNnvrux3OMagyCIAAAANY"]
[Fri Nov 14 05:49:35.202720 2025] [:error] [pid 47154:tid 47162] [client 172.202.1.208:57430] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10235.php"] [unique_id "aRZSb0ijA13A3g3ATrJpGwAAAAM"]
[Fri Nov 14 05:49:36.284335 2025] [:error] [pid 47155:tid 47208] [client 172.202.1.208:57424] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10235.php"] [unique_id "aRZScJipxRXMZJH8hmju8AAAAFY"]
[Fri Nov 14 05:49:37.227350 2025] [:error] [pid 47155:tid 47186] [client 172.202.1.208:58938] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10235.php"] [unique_id "aRZScZipxRXMZJH8hmju8QAAAEA"]
[Fri Nov 14 05:49:38.217352 2025] [:error] [pid 47242:tid 47252] [client 172.202.1.208:58958] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aRZSclPNnvrux3OMagyCMQAAAMc"]
[Fri Nov 14 05:49:39.198846 2025] [:error] [pid 47156:tid 47223] [client 172.202.1.208:62495] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aRZSc9jrQX_P-kC7M_7qaQAAAIk"]
[Fri Nov 14 05:49:39.945390 2025] [:error] [pid 47242:tid 47261] [client 172.202.1.208:62473] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aRZSc1PNnvrux3OMagyCPAAAANA"]
[Fri Nov 14 05:49:40.734066 2025] [:error] [pid 47155:tid 47201] [client 172.202.1.208:58991] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aRZSdJipxRXMZJH8hmju9wAAAE8"]
[Fri Nov 14 05:49:41.437418 2025] [:error] [pid 47242:tid 47268] [client 172.202.1.208:62543] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scn.php"] [unique_id "aRZSdVPNnvrux3OMagyCQwAAANc"]
[Fri Nov 14 05:49:42.275716 2025] [:error] [pid 47630:tid 47654] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/scn.php
[Fri Nov 14 05:49:42.478380 2025] [:error] [pid 47630:tid 47653] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/gammav1.php
[Fri Nov 14 05:49:42.676432 2025] [:error] [pid 47630:tid 47652] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Fri Nov 14 05:49:42.873727 2025] [:error] [pid 47630:tid 47633] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Fri Nov 14 05:49:43.068671 2025] [:error] [pid 47630:tid 47649] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Fri Nov 14 05:49:43.263531 2025] [:error] [pid 47630:tid 47648] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Nov 14 05:49:43.566715 2025] [:error] [pid 47630:tid 47651] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha4.php
[Fri Nov 14 05:49:43.938957 2025] [:error] [pid 47630:tid 47647] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/testsend_1761006201.php
[Fri Nov 14 05:49:44.145692 2025] [:error] [pid 47630:tid 47654] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Fri Nov 14 05:49:44.345138 2025] [:error] [pid 47630:tid 47653] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/oxo_test.php
[Fri Nov 14 05:49:44.542131 2025] [:error] [pid 47630:tid 47650] [client 172.202.1.208:62557] File does not exist: /usr/local/apache/htdocs/suspended-page/theta1.php
[Fri Nov 14 05:49:44.737485 2025] [:error] [pid 47630:tid 47640] [client 172.202.1.208:62557] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thetav2.php"] [unique_id "aRZSeMxXXNBfWgpfVJ4kdgAAAQg"]
[Fri Nov 14 05:49:45.433341 2025] [:error] [pid 47630:tid 47647] [client 172.202.1.208:58954] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thetav2.php"] [unique_id "aRZSecxXXNBfWgpfVJ4keQAAAQ8"]
[Fri Nov 14 05:49:46.137450 2025] [:error] [pid 47630:tid 47635] [client 172.202.1.208:58994] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thetav2.php"] [unique_id "aRZSesxXXNBfWgpfVJ4kewAAAQM"]
[Fri Nov 14 05:49:46.798020 2025] [:error] [pid 47154:tid 47179] [client 172.202.1.208:56391] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thetav2.php"] [unique_id "aRZSekijA13A3g3ATrJpMgAAABQ"]
[Fri Nov 14 05:49:47.753268 2025] [:error] [pid 47242:tid 47249] [client 172.202.1.208:57421] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zetacustom.php"] [unique_id "aRZSe1PNnvrux3OMagyCTAAAAMQ"]
[Fri Nov 14 05:49:49.415693 2025] [:error] [pid 47155:tid 47209] [client 172.202.1.208:57451] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zetacustom.php"] [unique_id "aRZSfZipxRXMZJH8hmjvAQAAAFc"]
[Fri Nov 14 05:49:50.599797 2025] [:error] [pid 47242:tid 47248] [client 172.202.1.208:58907] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zetacustom.php"] [unique_id "aRZSflPNnvrux3OMagyCUQAAAMM"]
[Fri Nov 14 05:49:51.399002 2025] [:error] [pid 47154:tid 47167] [client 172.202.1.208:62504] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zetacustom.php"] [unique_id "aRZSf0ijA13A3g3ATrJpNAAAAAg"]
[Fri Nov 14 05:49:52.456756 2025] [:error] [pid 47156:tid 47221] [client 172.202.1.208:58925] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/etav1.php"] [unique_id "aRZSgNjrQX_P-kC7M_7qewAAAIc"]
[Fri Nov 14 05:49:53.246649 2025] [:error] [pid 47156:tid 47216] [client 172.202.1.208:62582] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/etav1.php"] [unique_id "aRZSgdjrQX_P-kC7M_7qfQAAAII"]
[Fri Nov 14 05:49:54.353619 2025] [:error] [pid 47242:tid 47262] [client 172.202.1.208:57399] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/etav1.php"] [unique_id "aRZSglPNnvrux3OMagyCWAAAANE"]
[Fri Nov 14 05:49:55.351671 2025] [:error] [pid 47155:tid 47202] [client 172.202.1.208:58886] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/etav1.php"] [unique_id "aRZSg5ipxRXMZJH8hmjvCgAAAFA"]
[Fri Nov 14 05:49:56.783635 2025] [:error] [pid 47155:tid 47187] [client 172.202.1.208:62508] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aRZShJipxRXMZJH8hmjvCwAAAEE"]
[Fri Nov 14 05:49:57.607523 2025] [:error] [pid 47155:tid 47195] [client 172.202.1.208:62487] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aRZShZipxRXMZJH8hmjvEAAAAEk"]
[Fri Nov 14 05:49:58.299683 2025] [:error] [pid 47154:tid 47162] [client 172.202.1.208:58970] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aRZShkijA13A3g3ATrJpPQAAAAM"]
[Fri Nov 14 05:49:59.118902 2025] [:error] [pid 47242:tid 47255] [client 172.202.1.208:62519] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aRZSh1PNnvrux3OMagyCZQAAAMo"]
[Fri Nov 14 05:49:59.781462 2025] [:error] [pid 47630:tid 47636] [client 172.202.1.208:58987] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aRZSh8xXXNBfWgpfVJ4kmwAAAQQ"]
[Fri Nov 14 05:50:00.340811 2025] [:error] [pid 47630:tid 47646] [client 172.202.1.208:62530] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aRZSiMxXXNBfWgpfVJ4koAAAAQ4"]
[Fri Nov 14 05:50:00.914515 2025] [:error] [pid 47154:tid 47169] [client 172.202.1.208:62544] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aRZSiEijA13A3g3ATrJpPgAAAAo"]
[Fri Nov 14 05:50:01.600619 2025] [:error] [pid 47630:tid 47643] [client 172.202.1.208:62518] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aRZSicxXXNBfWgpfVJ4kowAAAQs"]
[Fri Nov 14 05:50:02.553403 2025] [:error] [pid 47242:tid 47255] [client 172.202.1.208:57372] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site.php"] [unique_id "aRZSilPNnvrux3OMagyCagAAAMo"]
[Fri Nov 14 05:50:03.455459 2025] [:error] [pid 47154:tid 47175] [client 172.202.1.208:62529] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site.php"] [unique_id "aRZSi0ijA13A3g3ATrJpQQAAABA"]
[Fri Nov 14 05:50:04.889229 2025] [:error] [pid 47630:tid 47647] [client 172.202.1.208:62476] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site.php"] [unique_id "aRZSjMxXXNBfWgpfVJ4krQAAAQ8"]
[Fri Nov 14 05:50:06.045338 2025] [:error] [pid 47242:tid 47247] [client 172.202.1.208:62532] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site.php"] [unique_id "aRZSjlPNnvrux3OMagyCcQAAAMI"]
[Fri Nov 14 05:50:07.022186 2025] [:error] [pid 47242:tid 47248] [client 172.202.1.208:58978] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aRZSj1PNnvrux3OMagyCdAAAAMM"]
[Fri Nov 14 05:50:07.934890 2025] [:error] [pid 47155:tid 47205] [client 172.202.1.208:58905] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aRZSj5ipxRXMZJH8hmjvHgAAAFM"]
[Fri Nov 14 05:50:09.050108 2025] [:error] [pid 47630:tid 47653] [client 172.202.1.208:58913] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aRZSkcxXXNBfWgpfVJ4ksgAAARU"]
[Fri Nov 14 05:50:09.851866 2025] [:error] [pid 47155:tid 47199] [client 172.202.1.208:62577] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aRZSkZipxRXMZJH8hmjvIgAAAE0"]
[Fri Nov 14 05:50:10.461067 2025] [:error] [pid 47155:tid 47208] [client 172.202.1.208:59003] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_d3f3a4.php"] [unique_id "aRZSkpipxRXMZJH8hmjvJAAAAFY"]
[Fri Nov 14 05:50:11.193624 2025] [:error] [pid 47630:tid 47637] [client 172.202.1.208:57412] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_d3f3a4.php"] [unique_id "aRZSk8xXXNBfWgpfVJ4kvgAAAQU"]
[Fri Nov 14 05:50:12.313467 2025] [:error] [pid 47154:tid 47162] [client 172.202.1.208:57420] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_d3f3a4.php"] [unique_id "aRZSlEijA13A3g3ATrJpVQAAAAM"]
[Fri Nov 14 05:50:13.101165 2025] [:error] [pid 47630:tid 47633] [client 172.202.1.208:58976] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_d3f3a4.php"] [unique_id "aRZSlcxXXNBfWgpfVJ4kwgAAAQE"]
[Fri Nov 14 05:50:14.235483 2025] [:error] [pid 47156:tid 47220] [client 172.202.1.208:58993] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma-3c8074.php"] [unique_id "aRZSltjrQX_P-kC7M_7qlQAAAIY"]
[Fri Nov 14 05:50:15.219056 2025] [:error] [pid 47630:tid 47650] [client 172.202.1.208:57454] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma-3c8074.php"] [unique_id "aRZSl8xXXNBfWgpfVJ4kyQAAARI"]
[Fri Nov 14 05:50:15.655517 2025] [:error] [pid 47155:tid 47187] [client 172.202.1.208:58965] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma-3c8074.php"] [unique_id "aRZSl5ipxRXMZJH8hmjvKwAAAEE"]
[Fri Nov 14 05:50:16.788407 2025] [:error] [pid 47156:tid 47231] [client 172.202.1.208:58998] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma-3c8074.php"] [unique_id "aRZSmNjrQX_P-kC7M_7qmQAAAJE"]
[Fri Nov 14 05:50:17.738391 2025] [:error] [pid 47156:tid 47233] [client 172.202.1.208:62570] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lambda4.php"] [unique_id "aRZSmdjrQX_P-kC7M_7qmwAAAJM"]
[Fri Nov 14 05:50:18.537970 2025] [:error] [pid 47154:tid 47166] [client 172.202.1.208:57434] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lambda4.php"] [unique_id "aRZSmkijA13A3g3ATrJpYAAAAAc"]
[Fri Nov 14 05:50:19.192773 2025] [:error] [pid 47156:tid 47225] [client 172.202.1.208:58920] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lambda4.php"] [unique_id "aRZSm9jrQX_P-kC7M_7qnAAAAIs"]
[Fri Nov 14 05:50:20.185426 2025] [:error] [pid 47156:tid 47227] [client 172.202.1.208:57414] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lambda4.php"] [unique_id "aRZSnNjrQX_P-kC7M_7qnwAAAI0"]
[Fri Nov 14 05:50:20.972918 2025] [:error] [pid 47630:tid 47633] [client 172.202.1.208:56393] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aRZSnMxXXNBfWgpfVJ4k2wAAAQE"]
[Fri Nov 14 05:50:22.133829 2025] [:error] [pid 47155:tid 47186] [client 172.202.1.208:58979] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aRZSnpipxRXMZJH8hmjvNAAAAEA"]
[Fri Nov 14 05:50:22.908157 2025] [:error] [pid 47154:tid 47164] [client 172.202.1.208:58895] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aRZSnkijA13A3g3ATrJpaAAAAAU"]
[Fri Nov 14 05:50:24.088637 2025] [:error] [pid 47242:tid 47260] [client 172.202.1.208:58943] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aRZSoFPNnvrux3OMagyCjAAAAM8"]
[Fri Nov 14 05:50:24.794433 2025] [:error] [pid 47630:tid 47637] [client 172.202.1.208:57458] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aRZSoMxXXNBfWgpfVJ4k4AAAAQU"]
[Fri Nov 14 05:50:25.532743 2025] [:error] [pid 47156:tid 47231] [client 172.202.1.208:57433] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aRZSodjrQX_P-kC7M_7qpgAAAJE"]
[Fri Nov 14 05:50:27.178317 2025] [:error] [pid 47154:tid 47173] [client 172.202.1.208:58966] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aRZSo0ijA13A3g3ATrJpbAAAAA4"]
[Fri Nov 14 05:50:28.236153 2025] [:error] [pid 47630:tid 47649] [client 172.202.1.208:58996] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aRZSpMxXXNBfWgpfVJ4k5wAAARE"]
[Fri Nov 14 05:50:28.895411 2025] [:error] [pid 47155:tid 47200] [client 172.202.1.208:57423] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRZSpJipxRXMZJH8hmjvQgAAAE4"]
[Fri Nov 14 05:50:29.544790 2025] [:error] [pid 47630:tid 47638] [client 172.202.1.208:58997] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRZSpcxXXNBfWgpfVJ4k7AAAAQY"]
[Fri Nov 14 05:50:30.357184 2025] [:error] [pid 47242:tid 47256] [client 172.202.1.208:57390] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRZSplPNnvrux3OMagyCkwAAAMs"]
[Fri Nov 14 05:50:31.382774 2025] [:error] [pid 47154:tid 47170] [client 172.202.1.208:58953] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRZSp0ijA13A3g3ATrJpcwAAAAs"]
[Fri Nov 14 05:50:32.196607 2025] [:error] [pid 47154:tid 47162] [client 172.202.1.208:57416] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z451.php"] [unique_id "aRZSqEijA13A3g3ATrJpdgAAAAM"]
[Fri Nov 14 05:50:33.678655 2025] [:error] [pid 47155:tid 47187] [client 172.202.1.208:57425] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z451.php"] [unique_id "aRZSqZipxRXMZJH8hmjvSwAAAEE"]
[Fri Nov 14 05:50:34.532736 2025] [:error] [pid 47155:tid 47196] [client 172.202.1.208:23701] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z451.php"] [unique_id "aRZSqpipxRXMZJH8hmjvUAAAAEo"]
[Fri Nov 14 05:50:35.859414 2025] [:error] [pid 47154:tid 47175] [client 172.202.1.208:62590] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z451.php"] [unique_id "aRZSq0ijA13A3g3ATrJpfAAAABA"]
[Fri Nov 14 05:50:37.124457 2025] [:error] [pid 47242:tid 47261] [client 172.202.1.208:62533] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vdconnect-8t3r5cwj.php"] [unique_id "aRZSrVPNnvrux3OMagyCowAAANA"]
[Fri Nov 14 05:50:38.056778 2025] [:error] [pid 47630:tid 47646] [client 172.202.1.208:58950] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vdconnect-8t3r5cwj.php"] [unique_id "aRZSrsxXXNBfWgpfVJ4k9QAAAQ4"]
[Fri Nov 14 05:50:38.937874 2025] [:error] [pid 47242:tid 47267] [client 172.202.1.208:62551] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vdconnect-8t3r5cwj.php"] [unique_id "aRZSrlPNnvrux3OMagyCpgAAANY"]
[Fri Nov 14 05:50:40.769242 2025] [:error] [pid 47630:tid 47640] [client 172.202.1.208:56393] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vdconnect-8t3r5cwj.php"] [unique_id "aRZSsMxXXNBfWgpfVJ4k_gAAAQg"]
[Fri Nov 14 05:50:43.122299 2025] [:error] [pid 47154:tid 47174] [client 172.202.1.208:57449] [client 172.202.1.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zetamod.php"] [unique_id "aRZSs0ijA13A3g3ATrJphAAAAA8"]
[Fri Nov 14 05:50:44.806383 2025] [:error] [pid 47156:tid 47223] [client 172.202.1.208:56384] File does not exist: /usr/local/apache/htdocs/suspended-page/zetamod.php
[Fri Nov 14 05:50:44.998790 2025] [:error] [pid 47156:tid 47239] [client 172.202.1.208:56384] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Nov 14 15:24:44.963216 2025] [:error] [pid 16709:tid 16725] [client 45.130.83.241:29817] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Nov 14 15:24:45.908689 2025] [:error] [pid 16709:tid 16733] [client 45.130.83.241:29817] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Nov 14 15:24:46.357477 2025] [:error] [pid 16709:tid 16713] [client 45.130.83.241:29817] [client 45.130.83.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aRbZPqNdzfVNC4oipLUWRQAAAUI"]
[Fri Nov 14 15:24:47.301106 2025] [:error] [pid 16573:tid 16599] [client 63.135.161.121:42651] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Nov 14 15:24:47.746971 2025] [:error] [pid 16573:tid 16585] [client 63.135.161.121:42651] [client 63.135.161.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aRbZPyPGexfUk9FDoEJlmgAAAEc"]
[Fri Nov 14 15:24:48.718872 2025] [:error] [pid 16709:tid 16730] [client 173.239.211.53:39201] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Nov 14 15:24:49.620911 2025] [:error] [pid 16709:tid 16719] [client 173.239.211.53:39201] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Nov 14 15:24:50.077480 2025] [:error] [pid 16709:tid 16712] [client 173.239.211.53:39201] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Nov 14 15:24:50.554564 2025] [:error] [pid 16709:tid 16731] [client 173.239.211.53:39201] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Nov 14 15:24:51.448737 2025] [:error] [pid 16709:tid 16714] [client 173.239.211.53:39201] [client 173.239.211.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aRbZQ6NdzfVNC4oipLUWYQAAAUM"]
[Fri Nov 14 15:24:52.388172 2025] [:error] [pid 16709:tid 16727] [client 63.135.161.119:44885] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Nov 14 15:24:52.850722 2025] [:error] [pid 16709:tid 16732] [client 63.135.161.119:44885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Nov 14 15:24:53.303062 2025] [:error] [pid 16709:tid 16712] [client 63.135.161.119:44885] [client 63.135.161.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aRbZRaNdzfVNC4oipLUWZwAAAUE"]
[Fri Nov 14 15:24:54.225756 2025] [:error] [pid 16575:tid 16645] [client 173.239.211.45:48339] [client 173.239.211.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aRbZRu6qT670YxigvbBSiwAAAMs"]
[Fri Nov 14 15:24:55.130821 2025] [:error] [pid 16574:tid 16631] [client 173.239.211.45:59787] [client 173.239.211.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aRbZR_6XQqe4NqaoE9IEHAAAAJg"]
[Fri Nov 14 15:24:56.522351 2025] [:error] [pid 16709:tid 16721] [client 45.130.83.246:32031] [client 45.130.83.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aRbZSKNdzfVNC4oipLUWbQAAAUo"]
[Fri Nov 14 15:24:57.943270 2025] [:error] [pid 16573:tid 16599] [client 45.130.83.239:57973] [client 45.130.83.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aRbZSSPGexfUk9FDoEJloQAAAFU"]
[Fri Nov 14 15:24:59.866866 2025] [:error] [pid 16573:tid 16588] [client 45.130.83.246:60233] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Nov 14 15:25:01.447403 2025] [:error] [pid 16573:tid 16602] [client 45.130.83.246:60233] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Nov 14 15:25:01.925264 2025] [:error] [pid 16573:tid 16578] [client 45.130.83.246:60233] [client 45.130.83.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aRbZTSPGexfUk9FDoEJlqwAAAEA"]
[Fri Nov 14 15:25:02.874998 2025] [:error] [pid 16575:tid 16644] [client 63.135.161.121:46327] [client 63.135.161.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aRbZTu6qT670YxigvbBSlgAAAMo"]
[Fri Nov 14 15:25:04.338034 2025] [:error] [pid 16709:tid 16723] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Fri Nov 14 15:25:04.812323 2025] [:error] [pid 16709:tid 16732] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Fri Nov 14 15:25:05.283373 2025] [:error] [pid 16709:tid 16730] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Nov 14 15:25:05.757020 2025] [:error] [pid 16709:tid 16734] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Nov 14 15:25:06.211603 2025] [:error] [pid 16709:tid 16714] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Fri Nov 14 15:25:06.682757 2025] [:error] [pid 16709:tid 16726] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Fri Nov 14 15:25:07.150003 2025] [:error] [pid 16709:tid 16711] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Fri Nov 14 15:25:07.612976 2025] [:error] [pid 16709:tid 16729] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Nov 14 15:25:08.077750 2025] [:error] [pid 16709:tid 16719] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Fri Nov 14 15:25:08.606402 2025] [:error] [pid 16709:tid 16730] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Nov 14 15:25:09.178300 2025] [:error] [pid 16709:tid 16720] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Fri Nov 14 15:25:09.730409 2025] [:error] [pid 16709:tid 16714] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Nov 14 15:25:10.185807 2025] [:error] [pid 16709:tid 16718] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Nov 14 15:25:10.643389 2025] [:error] [pid 16709:tid 16726] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Fri Nov 14 15:25:11.107527 2025] [:error] [pid 16709:tid 16727] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Fri Nov 14 15:25:11.559709 2025] [:error] [pid 16709:tid 16724] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Nov 14 15:25:12.065041 2025] [:error] [pid 16709:tid 16719] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Fri Nov 14 15:25:12.516247 2025] [:error] [pid 16709:tid 16732] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Nov 14 15:25:12.974358 2025] [:error] [pid 16709:tid 16714] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Fri Nov 14 15:25:13.428496 2025] [:error] [pid 16709:tid 16733] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Nov 14 15:25:13.900743 2025] [:error] [pid 16709:tid 16717] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Fri Nov 14 15:25:14.363098 2025] [:error] [pid 16709:tid 16726] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Nov 14 15:25:14.853217 2025] [:error] [pid 16709:tid 16724] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Fri Nov 14 15:25:15.307619 2025] [:error] [pid 16709:tid 16720] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Nov 14 15:25:15.781336 2025] [:error] [pid 16709:tid 16722] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Nov 14 15:25:16.240325 2025] [:error] [pid 16709:tid 16717] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Fri Nov 14 15:25:16.695418 2025] [:error] [pid 16709:tid 16735] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Nov 14 15:25:17.175284 2025] [:error] [pid 16709:tid 16719] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Fri Nov 14 15:25:17.639058 2025] [:error] [pid 16709:tid 16731] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Fri Nov 14 15:25:18.106311 2025] [:error] [pid 16709:tid 16723] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Fri Nov 14 15:25:18.581654 2025] [:error] [pid 16709:tid 16713] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Fri Nov 14 15:25:19.041601 2025] [:error] [pid 16709:tid 16715] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Fri Nov 14 15:25:19.529618 2025] [:error] [pid 16709:tid 16729] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Nov 14 15:25:19.975798 2025] [:error] [pid 16709:tid 16728] [client 63.135.161.113:64435] [client 63.135.161.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.113, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aRbZX6NdzfVNC4oipLUWvQAAAVE"]
[Fri Nov 14 15:25:19.980060 2025] [:error] [pid 16709:tid 16728] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Nov 14 15:25:20.899625 2025] [:error] [pid 16709:tid 16730] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Fri Nov 14 15:25:21.369023 2025] [:error] [pid 16709:tid 16716] [client 63.135.161.113:64435] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Fri Nov 14 15:25:21.839903 2025] [:error] [pid 16709:tid 16715] [client 63.135.161.113:64435] [client 63.135.161.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aRbZYaNdzfVNC4oipLUWxQAAAUQ"]
[Fri Nov 14 15:25:22.734371 2025] [:error] [pid 16575:tid 16644] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Fri Nov 14 15:25:23.176417 2025] [:error] [pid 16575:tid 16652] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Fri Nov 14 15:25:24.125639 2025] [:error] [pid 16575:tid 16648] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Fri Nov 14 15:25:24.573303 2025] [:error] [pid 16575:tid 16636] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Fri Nov 14 15:25:25.038332 2025] [:error] [pid 16575:tid 16642] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Fri Nov 14 15:25:25.492686 2025] [:error] [pid 16575:tid 16653] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Fri Nov 14 15:25:25.977361 2025] [:error] [pid 16575:tid 16635] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Fri Nov 14 15:25:26.429218 2025] [:error] [pid 16575:tid 16655] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Fri Nov 14 15:25:26.899350 2025] [:error] [pid 16575:tid 16651] [client 173.239.211.41:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Fri Nov 14 15:25:27.895358 2025] [:error] [pid 16575:tid 16654] [client 173.239.211.41:39317] [client 173.239.211.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aRbZZ-6qT670YxigvbBS6gAAANQ"]
[Fri Nov 14 15:25:28.811075 2025] [:error] [pid 16709:tid 16713] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Fri Nov 14 15:25:29.259172 2025] [:error] [pid 16709:tid 16714] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Fri Nov 14 15:25:31.598471 2025] [:error] [pid 16709:tid 16729] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Fri Nov 14 15:25:32.053921 2025] [:error] [pid 16709:tid 16715] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Fri Nov 14 15:25:32.506382 2025] [:error] [pid 16709:tid 16727] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Fri Nov 14 15:25:32.951452 2025] [:error] [pid 16709:tid 16731] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Fri Nov 14 15:25:33.436662 2025] [:error] [pid 16709:tid 16712] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Fri Nov 14 15:25:34.882238 2025] [:error] [pid 16709:tid 16726] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Fri Nov 14 15:25:35.352083 2025] [:error] [pid 16709:tid 16730] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Fri Nov 14 15:25:35.807635 2025] [:error] [pid 16709:tid 16718] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Fri Nov 14 15:25:36.283663 2025] [:error] [pid 16709:tid 16720] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Fri Nov 14 15:25:36.775204 2025] [:error] [pid 16709:tid 16715] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Fri Nov 14 15:25:37.232422 2025] [:error] [pid 16709:tid 16727] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Fri Nov 14 15:25:37.692499 2025] [:error] [pid 16709:tid 16724] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Fri Nov 14 15:25:38.575614 2025] [:error] [pid 16709:tid 16722] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Fri Nov 14 15:25:39.047024 2025] [:error] [pid 16709:tid 16717] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Fri Nov 14 15:25:40.000454 2025] [:error] [pid 16709:tid 16715] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Fri Nov 14 15:25:40.444204 2025] [:error] [pid 16709:tid 16723] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Fri Nov 14 15:25:40.908686 2025] [:error] [pid 16709:tid 16721] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Fri Nov 14 15:25:41.359764 2025] [:error] [pid 16709:tid 16735] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Fri Nov 14 15:25:41.805968 2025] [:error] [pid 16709:tid 16727] [client 173.239.211.45:40899] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Fri Nov 14 15:25:42.243246 2025] [:error] [pid 16709:tid 16724] [client 173.239.211.45:40899] [client 173.239.211.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/lx.php"] [unique_id "aRbZdqNdzfVNC4oipLUXAgAAAU0"]
[Fri Nov 14 15:25:44.039701 2025] [:error] [pid 16709:tid 16734] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Fri Nov 14 15:25:44.522148 2025] [:error] [pid 16709:tid 16730] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Fri Nov 14 15:25:45.050335 2025] [:error] [pid 16709:tid 16715] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Fri Nov 14 15:25:45.513137 2025] [:error] [pid 16709:tid 16723] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Fri Nov 14 15:25:46.002072 2025] [:error] [pid 16709:tid 16724] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Fri Nov 14 15:25:46.446725 2025] [:error] [pid 16709:tid 16732] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Fri Nov 14 15:25:46.926685 2025] [:error] [pid 16709:tid 16714] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Fri Nov 14 15:25:47.372140 2025] [:error] [pid 16709:tid 16712] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Fri Nov 14 15:25:47.828005 2025] [:error] [pid 16709:tid 16728] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Fri Nov 14 15:25:48.271379 2025] [:error] [pid 16709:tid 16731] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Fri Nov 14 15:25:48.734423 2025] [:error] [pid 16709:tid 16722] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Nov 14 15:25:49.201473 2025] [:error] [pid 16709:tid 16729] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Fri Nov 14 15:25:49.642419 2025] [:error] [pid 16709:tid 16716] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Fri Nov 14 15:25:50.105041 2025] [:error] [pid 16709:tid 16726] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Fri Nov 14 15:25:50.590507 2025] [:error] [pid 16709:tid 16713] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Fri Nov 14 15:25:51.054185 2025] [:error] [pid 16709:tid 16734] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Fri Nov 14 15:25:51.536107 2025] [:error] [pid 16709:tid 16730] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Fri Nov 14 15:25:51.978367 2025] [:error] [pid 16709:tid 16720] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Fri Nov 14 15:25:52.458998 2025] [:error] [pid 16709:tid 16715] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Fri Nov 14 15:25:53.002612 2025] [:error] [pid 16709:tid 16733] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Fri Nov 14 15:25:53.461232 2025] [:error] [pid 16709:tid 16723] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Fri Nov 14 15:25:54.427879 2025] [:error] [pid 16709:tid 16723] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Nov 14 15:25:54.881749 2025] [:error] [pid 16709:tid 16725] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Fri Nov 14 15:25:55.362251 2025] [:error] [pid 16709:tid 16712] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Fri Nov 14 15:25:55.828865 2025] [:error] [pid 16709:tid 16722] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Fri Nov 14 15:25:56.304627 2025] [:error] [pid 16709:tid 16729] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Nov 14 15:25:56.759243 2025] [:error] [pid 16709:tid 16726] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Fri Nov 14 15:25:57.234241 2025] [:error] [pid 16709:tid 16734] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Nov 14 15:25:57.683673 2025] [:error] [pid 16709:tid 16715] [client 173.239.211.35:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Fri Nov 14 15:26:08.061460 2025] [:error] [pid 16709:tid 16724] [client 173.239.211.35:28433] [client 173.239.211.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aRbZkKNdzfVNC4oipLUXWwAAAU0"]
[Fri Nov 14 15:26:09.677959 2025] [:error] [pid 16671:tid 16678] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Fri Nov 14 15:26:15.182976 2025] [:error] [pid 16671:tid 16691] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Fri Nov 14 15:26:15.639411 2025] [:error] [pid 16671:tid 16682] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Fri Nov 14 15:26:16.083395 2025] [:error] [pid 16671:tid 16680] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Fri Nov 14 15:26:17.415627 2025] [:error] [pid 16671:tid 16696] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Fri Nov 14 15:26:20.244559 2025] [:error] [pid 16671:tid 16680] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Fri Nov 14 15:26:20.693879 2025] [:error] [pid 16671:tid 16693] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Fri Nov 14 15:26:21.136820 2025] [:error] [pid 16671:tid 16699] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Nov 14 15:26:21.579526 2025] [:error] [pid 16671:tid 16700] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Fri Nov 14 15:26:22.036667 2025] [:error] [pid 16671:tid 16679] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Fri Nov 14 15:26:22.480592 2025] [:error] [pid 16671:tid 16687] [client 173.239.211.40:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Fri Nov 14 15:26:23.418078 2025] [:error] [pid 16671:tid 16682] [client 173.239.211.40:54017] [client 173.239.211.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aRbZnzsoHwEAmeIzZXAamgAAAQU"]
[Fri Nov 14 15:26:24.306876 2025] [:error] [pid 16671:tid 16686] [client 173.239.211.45:34509] [client 173.239.211.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.239.211.45, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRbZoDsoHwEAmeIzZXAamwAAAQk"]
[Fri Nov 14 15:26:24.311988 2025] [:error] [pid 16671:tid 16686] [client 173.239.211.45:34509] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Nov 14 15:26:24.756902 2025] [:error] [pid 16671:tid 16697] [client 173.239.211.45:34509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Fri Nov 14 15:26:25.670363 2025] [:error] [pid 16671:tid 16678] [client 173.239.211.45:34509] [client 173.239.211.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aRbZoTsoHwEAmeIzZXAangAAAQE"]
[Fri Nov 14 15:26:28.244763 2025] [:error] [pid 16709:tid 16711] [client 173.239.211.39:22447] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Fri Nov 14 15:26:30.589276 2025] [:error] [pid 16709:tid 16717] [client 173.239.211.39:22447] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Nov 14 15:26:31.543961 2025] [:error] [pid 16709:tid 16723] [client 173.239.211.39:22447] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Nov 14 15:26:31.989011 2025] [:error] [pid 16709:tid 16718] [client 173.239.211.39:22447] [client 173.239.211.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aRbZp6NdzfVNC4oipLUXkwAAAUc"]
[Fri Nov 14 15:26:32.892349 2025] [:error] [pid 16671:tid 16685] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Fri Nov 14 15:26:33.334179 2025] [:error] [pid 16671:tid 16689] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Fri Nov 14 15:26:33.781537 2025] [:error] [pid 16671:tid 16691] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Fri Nov 14 15:26:35.646322 2025] [:error] [pid 16671:tid 16684] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Fri Nov 14 15:26:36.105713 2025] [:error] [pid 16671:tid 16681] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Nov 14 15:26:36.568255 2025] [:error] [pid 16671:tid 16686] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Nov 14 15:26:37.048564 2025] [:error] [pid 16671:tid 16695] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Fri Nov 14 15:26:38.847881 2025] [:error] [pid 16671:tid 16691] [client 173.239.211.36:49983] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Nov 14 15:26:39.740784 2025] [:error] [pid 16671:tid 16681] [client 173.239.211.36:49983] [client 173.239.211.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aRbZrzsoHwEAmeIzZXAawgAAAQQ"]
[Fri Nov 14 15:26:40.636999 2025] [:error] [pid 16709:tid 16733] [client 45.130.83.242:21559] [client 45.130.83.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aRbZsKNdzfVNC4oipLUXpwAAAVY"]
[Fri Nov 14 15:26:41.547960 2025] [:error] [pid 16671:tid 16697] [client 45.130.83.238:63395] [client 45.130.83.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aRbZsTsoHwEAmeIzZXAaxQAAARQ"]
[Fri Nov 14 15:26:42.434634 2025] [:error] [pid 16574:tid 16623] [client 173.239.211.38:46331] [client 173.239.211.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aRbZsv6XQqe4NqaoE9IEqAAAAJA"]
[Fri Nov 14 15:26:43.313618 2025] [:error] [pid 16709:tid 16721] [client 173.239.211.52:44069] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Fri Nov 14 15:26:43.757191 2025] [:error] [pid 16709:tid 16714] [client 173.239.211.52:44069] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Fri Nov 14 15:26:44.660262 2025] [:error] [pid 16709:tid 16724] [client 173.239.211.52:44069] [client 173.239.211.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.52, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aRbZtKNdzfVNC4oipLUXrwAAAU0"]
[Fri Nov 14 15:26:47.354428 2025] [:error] [pid 16709:tid 16728] [client 173.239.211.52:44069] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Nov 14 15:26:48.273595 2025] [:error] [pid 16709:tid 16726] [client 173.239.211.52:44069] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Nov 14 15:26:50.949661 2025] [:error] [pid 16709:tid 16728] [client 173.239.211.52:44069] [client 173.239.211.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aRbZuqNdzfVNC4oipLUXyQAAAVE"]
[Fri Nov 14 15:26:51.859125 2025] [:error] [pid 16574:tid 16616] [client 45.130.83.242:22415] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Fri Nov 14 15:26:53.255479 2025] [:error] [pid 16574:tid 16626] [client 45.130.83.242:22415] [client 45.130.83.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.242, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aRbZvf6XQqe4NqaoE9IEwgAAAJM"]
[Fri Nov 14 15:26:53.726113 2025] [:error] [pid 16574:tid 16609] [client 45.130.83.242:22415] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Fri Nov 14 15:26:54.638729 2025] [:error] [pid 16574:tid 16607] [client 45.130.83.242:22415] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Nov 14 15:26:55.098622 2025] [:error] [pid 16574:tid 16627] [client 45.130.83.242:22415] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Fri Nov 14 15:26:56.002871 2025] [:error] [pid 16574:tid 16631] [client 45.130.83.242:22415] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Nov 14 15:26:56.474383 2025] [:error] [pid 16574:tid 16621] [client 45.130.83.242:22415] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Nov 14 15:26:56.924826 2025] [:error] [pid 16574:tid 16628] [client 45.130.83.242:22415] [client 45.130.83.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aRbZwP6XQqe4NqaoE9IE1QAAAJU"]
[Fri Nov 14 15:26:57.848882 2025] [:error] [pid 16709:tid 16730] [client 63.135.161.116:43273] [client 63.135.161.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aRbZwaNdzfVNC4oipLUX0gAAAVM"]
[Fri Nov 14 15:26:58.804867 2025] [:error] [pid 16575:tid 16641] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Fri Nov 14 15:26:59.266398 2025] [:error] [pid 16575:tid 16642] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Fri Nov 14 15:26:59.717772 2025] [:error] [pid 16575:tid 16657] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Nov 14 15:27:00.275309 2025] [:error] [pid 16575:tid 16637] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Nov 14 15:27:01.407259 2025] [:error] [pid 16575:tid 16648] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Fri Nov 14 15:27:03.373492 2025] [:error] [pid 16575:tid 16636] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/zmFM.php
[Fri Nov 14 15:27:07.557711 2025] [:error] [pid 16575:tid 16654] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Fri Nov 14 15:27:08.010331 2025] [:error] [pid 16575:tid 16656] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Nov 14 15:27:08.510705 2025] [:error] [pid 16575:tid 16645] [client 63.135.161.113:32831] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Fri Nov 14 15:27:09.434308 2025] [:error] [pid 16575:tid 16636] [client 63.135.161.113:32831] [client 63.135.161.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aRbZze6qT670YxigvbBTbgAAAMI"]
[Fri Nov 14 15:27:13.275471 2025] [:error] [pid 16574:tid 16628] [client 63.135.161.122:61253] [client 63.135.161.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bak.php"] [unique_id "aRbZ0f6XQqe4NqaoE9IE7QAAAJU"]
[Fri Nov 14 15:27:14.175638 2025] [:error] [pid 16574:tid 16607] [client 173.239.211.47:39219] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Nov 14 15:27:14.614754 2025] [:error] [pid 16574:tid 16613] [client 173.239.211.47:39219] [client 173.239.211.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aRbZ0v6XQqe4NqaoE9IE8AAAAIY"]
[Fri Nov 14 15:27:16.404540 2025] [:error] [pid 16573:tid 16583] [client 173.239.211.43:22379] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Fri Nov 14 15:27:17.294805 2025] [:error] [pid 16573:tid 16579] [client 173.239.211.43:22379] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Nov 14 15:27:17.739535 2025] [:error] [pid 16573:tid 16591] [client 173.239.211.43:22379] [client 173.239.211.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aRbZ1SPGexfUk9FDoEJmSAAAAE0"]
[Fri Nov 14 15:27:18.675429 2025] [:error] [pid 16671:tid 16686] [client 45.130.83.241:27193] [client 45.130.83.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aRbZ1jsoHwEAmeIzZXAa8AAAAQk"]
[Fri Nov 14 15:27:19.580929 2025] [:error] [pid 16574:tid 16615] [client 173.239.211.50:43557] [client 173.239.211.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.50, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aRbZ1_6XQqe4NqaoE9IE-AAAAIg"]
[Fri Nov 14 15:27:20.041407 2025] [:error] [pid 16574:tid 16614] [client 173.239.211.50:43557] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Fri Nov 14 15:27:20.938053 2025] [:error] [pid 16574:tid 16619] [client 173.239.211.50:43557] [client 173.239.211.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/themes.php"] [unique_id "aRbZ2P6XQqe4NqaoE9IE_QAAAIw"]
[Fri Nov 14 15:27:21.833162 2025] [:error] [pid 16574:tid 16628] [client 63.135.161.119:48893] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Nov 14 15:27:22.764503 2025] [:error] [pid 16574:tid 16613] [client 63.135.161.119:48893] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Fri Nov 14 15:27:26.044841 2025] [:error] [pid 16574:tid 16618] [client 63.135.161.119:48893] [client 63.135.161.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aRbZ3v6XQqe4NqaoE9IFCwAAAIs"]
[Fri Nov 14 15:27:26.984620 2025] [:error] [pid 16709:tid 16713] [client 173.239.211.50:28275] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Nov 14 15:27:28.377793 2025] [:error] [pid 16709:tid 16721] [client 173.239.211.50:28275] [client 173.239.211.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aRbZ4KNdzfVNC4oipLUYAwAAAUo"]
[Fri Nov 14 15:27:29.741691 2025] [:error] [pid 16709:tid 16712] [client 173.239.211.50:20635] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Fri Nov 14 15:27:30.189912 2025] [:error] [pid 16709:tid 16724] [client 173.239.211.50:20635] [client 173.239.211.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aRbZ4qNdzfVNC4oipLUYCwAAAU0"]
[Fri Nov 14 15:27:32.013825 2025] [:error] [pid 16574:tid 16623] [client 173.239.211.55:39701] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Fri Nov 14 15:27:32.464774 2025] [:error] [pid 16574:tid 16620] [client 173.239.211.55:39701] [client 173.239.211.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.55, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aRbZ5P6XQqe4NqaoE9IFEwAAAI0"]
[Fri Nov 14 15:27:33.802238 2025] [:error] [pid 16574:tid 16613] [client 173.239.211.55:39701] [client 173.239.211.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aRbZ5f6XQqe4NqaoE9IFHQAAAIY"]
[Fri Nov 14 15:27:34.723227 2025] [:error] [pid 16573:tid 16599] [client 63.135.161.115:25669] [client 63.135.161.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aRbZ5iPGexfUk9FDoEJmVQAAAFU"]
[Fri Nov 14 15:27:37.035890 2025] [:error] [pid 16573:tid 16589] [client 173.239.211.46:56119] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Fri Nov 14 15:27:38.403264 2025] [:error] [pid 16573:tid 16593] [client 173.239.211.46:56119] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Fri Nov 14 15:27:39.308365 2025] [:error] [pid 16573:tid 16601] [client 173.239.211.46:56119] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Nov 14 15:27:39.796580 2025] [:error] [pid 16573:tid 16595] [client 173.239.211.46:56119] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Fri Nov 14 15:27:40.752275 2025] [:error] [pid 16573:tid 16585] [client 173.239.211.46:56119] [client 173.239.211.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aRbZ7CPGexfUk9FDoEJmbAAAAEc"]
[Fri Nov 14 15:27:42.672398 2025] [:error] [pid 16709:tid 16727] [client 173.239.211.48:21145] [client 173.239.211.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aRbZ7qNdzfVNC4oipLUYMAAAAVA"]
[Fri Nov 14 15:27:43.626979 2025] [:error] [pid 16671:tid 16678] [client 63.135.161.129:30785] [client 63.135.161.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aRbZ7zsoHwEAmeIzZXAbNgAAAQE"]
[Fri Nov 14 15:27:44.533779 2025] [:error] [pid 16671:tid 16682] [client 173.239.211.55:28759] [client 173.239.211.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aRbZ8DsoHwEAmeIzZXAbNwAAAQU"]
[Fri Nov 14 15:27:45.457079 2025] [:error] [pid 16709:tid 16729] [client 45.130.83.240:21313] [client 45.130.83.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aRbZ8aNdzfVNC4oipLUYNQAAAVI"]
[Fri Nov 14 15:27:48.240042 2025] [:error] [pid 16671:tid 16680] [client 173.239.211.47:40043] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Fri Nov 14 15:27:48.689498 2025] [:error] [pid 16671:tid 16691] [client 173.239.211.47:40043] [client 173.239.211.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aRbZ9DsoHwEAmeIzZXAbSAAAAQ4"]
[Fri Nov 14 15:27:50.071532 2025] [:error] [pid 16573:tid 16597] [client 45.130.83.240:42607] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Nov 14 15:27:50.526570 2025] [:error] [pid 16573:tid 16593] [client 45.130.83.240:42607] File does not exist: /usr/local/apache/htdocs/suspended-page/rcc.php
[Fri Nov 14 15:27:50.977854 2025] [:error] [pid 16573:tid 16596] [client 45.130.83.240:42607] [client 45.130.83.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aRbZ9iPGexfUk9FDoEJmewAAAFI"]
[Fri Nov 14 15:27:51.933869 2025] [:error] [pid 16574:tid 16625] [client 173.239.211.48:31417] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Nov 14 15:27:52.378264 2025] [:error] [pid 16574:tid 16615] [client 173.239.211.48:31417] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Fri Nov 14 15:27:52.842020 2025] [:error] [pid 16574:tid 16623] [client 173.239.211.48:31417] [client 173.239.211.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aRbZ-P6XQqe4NqaoE9IFOwAAAJA"]
[Fri Nov 14 15:27:53.782312 2025] [:error] [pid 16671:tid 16683] [client 173.239.211.47:55787] File does not exist: /usr/local/apache/htdocs/suspended-page/history.php
[Fri Nov 14 15:27:54.247745 2025] [:error] [pid 16671:tid 16685] [client 173.239.211.47:55787] [client 173.239.211.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aRbZ-jsoHwEAmeIzZXAbTgAAAQg"]
[Fri Nov 14 15:27:56.690884 2025] [:error] [pid 16671:tid 16680] [client 45.130.83.246:29287] [client 45.130.83.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aRbZ_DsoHwEAmeIzZXAbVwAAAQM"]
[Fri Nov 14 15:27:57.611858 2025] [:error] [pid 16575:tid 16642] [client 45.130.83.244:58669] [client 45.130.83.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aRbZ_e6qT670YxigvbBTtAAAAMg"]
[Fri Nov 14 15:27:59.070719 2025] [:error] [pid 16575:tid 16655] [client 45.130.83.246:58627] [client 45.130.83.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aRbZ_-6qT670YxigvbBTugAAANU"]
[Fri Nov 14 15:27:59.965996 2025] [:error] [pid 16574:tid 16631] [client 173.239.211.38:28373] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Nov 14 15:28:00.894540 2025] [:error] [pid 16574:tid 16614] [client 173.239.211.38:28373] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Nov 14 15:28:01.391848 2025] [:error] [pid 16574:tid 16622] [client 173.239.211.38:28373] [client 173.239.211.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.38, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aRbaAf6XQqe4NqaoE9IFRgAAAI8"]
[Fri Nov 14 15:28:02.376589 2025] [:error] [pid 16574:tid 16619] [client 173.239.211.38:28373] [client 173.239.211.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aRbaAv6XQqe4NqaoE9IFSAAAAIw"]
[Fri Nov 14 15:28:03.362079 2025] [:error] [pid 16573:tid 16592] [client 173.239.211.53:27259] [client 173.239.211.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aRbaAyPGexfUk9FDoEJmkAAAAE4"]
[Fri Nov 14 15:28:04.276309 2025] [:error] [pid 16671:tid 16688] [client 45.130.83.240:56567] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Fri Nov 14 15:28:04.752602 2025] [:error] [pid 16671:tid 16697] [client 45.130.83.240:56567] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Nov 14 15:28:06.604860 2025] [:error] [pid 16671:tid 16689] [client 45.130.83.240:56567] File does not exist: /usr/local/apache/htdocs/suspended-page/login.php
[Fri Nov 14 15:28:08.016484 2025] [:error] [pid 16671:tid 16691] [client 45.130.83.240:56567] [client 45.130.83.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.240, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aRbaCDsoHwEAmeIzZXAbcAAAAQ4"]
[Fri Nov 14 15:28:08.483840 2025] [:error] [pid 16671:tid 16685] [client 45.130.83.240:56567] [client 45.130.83.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aRbaCDsoHwEAmeIzZXAbcwAAAQg"]
[Fri Nov 14 15:28:09.396408 2025] [:error] [pid 16574:tid 16629] [client 63.135.161.119:39599] [client 63.135.161.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aRbaCf6XQqe4NqaoE9IFUgAAAJY"]
[Fri Nov 14 15:28:10.305083 2025] [:error] [pid 16671:tid 16687] [client 63.135.161.122:49213] [client 63.135.161.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aRbaCjsoHwEAmeIzZXAbdAAAAQo"]
[Fri Nov 14 15:28:12.685635 2025] [:error] [pid 16575:tid 16639] [client 63.135.161.121:59641] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Fri Nov 14 15:28:13.136892 2025] [:error] [pid 16575:tid 16650] [client 63.135.161.121:59641] [client 63.135.161.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aRbaDe6qT670YxigvbBT0gAAANA"]
[Fri Nov 14 15:28:14.520192 2025] [:error] [pid 16573:tid 16582] [client 173.239.211.35:27833] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Fri Nov 14 15:28:16.821662 2025] [:error] [pid 16573:tid 16584] [client 173.239.211.35:27833] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Nov 14 15:28:18.200392 2025] [:error] [pid 16573:tid 16597] [client 173.239.211.35:27833] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Fri Nov 14 15:28:18.654370 2025] [:error] [pid 16573:tid 16587] [client 173.239.211.35:27833] [client 173.239.211.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aRbaEiPGexfUk9FDoEJmsQAAAEk"]
[Fri Nov 14 15:28:20.033797 2025] [:error] [pid 16574:tid 16626] [client 45.130.83.241:28591] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Fri Nov 14 15:28:20.931495 2025] [:error] [pid 16574:tid 16630] [client 45.130.83.241:28591] [client 45.130.83.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aRbaFP6XQqe4NqaoE9IFZwAAAJc"]
[Fri Nov 14 15:28:22.297324 2025] [:error] [pid 16574:tid 16609] [client 63.135.161.114:40805] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Nov 14 15:28:23.680373 2025] [:error] [pid 16574:tid 16624] [client 63.135.161.114:40805] [client 63.135.161.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aRbaF_6XQqe4NqaoE9IFcAAAAJE"]
[Fri Nov 14 15:28:25.042451 2025] [:error] [pid 16671:tid 16700] [client 173.239.211.40:25567] [client 173.239.211.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aRbaGTsoHwEAmeIzZXAbmAAAARc"]
[Fri Nov 14 15:28:26.452349 2025] [:error] [pid 16574:tid 16613] [client 63.135.161.117:37495] [client 63.135.161.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aRbaGv6XQqe4NqaoE9IFdgAAAIY"]
[Fri Nov 14 15:28:27.819657 2025] [:error] [pid 16671:tid 16698] [client 63.135.161.119:57583] [client 63.135.161.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aRbaGzsoHwEAmeIzZXAbngAAARU"]
[Fri Nov 14 15:28:29.184528 2025] [:error] [pid 16671:tid 16677] [client 173.239.211.52:43551] [client 173.239.211.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aRbaHTsoHwEAmeIzZXAboQAAAQA"]
[Fri Nov 14 15:28:32.027203 2025] [:error] [pid 16574:tid 16619] [client 173.239.211.47:62923] [client 173.239.211.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aRbaIP6XQqe4NqaoE9IFgQAAAIw"]
[Fri Nov 14 15:28:33.375280 2025] [:error] [pid 16709:tid 16734] [client 173.239.211.51:28967] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Nov 14 15:28:34.272431 2025] [:error] [pid 16709:tid 16720] [client 173.239.211.51:28967] [client 173.239.211.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aRbaIqNdzfVNC4oipLUYmgAAAUk"]
[Fri Nov 14 15:28:35.623518 2025] [:error] [pid 16709:tid 16715] [client 63.135.161.113:64159] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Fri Nov 14 15:28:36.108996 2025] [:error] [pid 16709:tid 16725] [client 63.135.161.113:64159] File does not exist: /usr/local/apache/htdocs/suspended-page/conf_upload.php
[Fri Nov 14 15:28:36.571600 2025] [:error] [pid 16709:tid 16734] [client 63.135.161.113:64159] [client 63.135.161.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aRbaJKNdzfVNC4oipLUYpAAAAVc"]
[Fri Nov 14 15:28:38.460110 2025] [:error] [pid 16575:tid 16650] [client 173.239.211.38:65439] [client 173.239.211.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aRbaJu6qT670YxigvbBT_AAAANA"]
[Fri Nov 14 15:28:39.363250 2025] [:error] [pid 16573:tid 16588] [client 173.239.211.40:63063] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Fri Nov 14 15:28:40.273586 2025] [:error] [pid 16573:tid 16590] [client 173.239.211.40:63063] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Fri Nov 14 15:28:41.163796 2025] [:error] [pid 16573:tid 16579] [client 173.239.211.40:63063] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Nov 14 15:28:41.613969 2025] [:error] [pid 16573:tid 16580] [client 173.239.211.40:63063] [client 173.239.211.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aRbaKSPGexfUk9FDoEJm4gAAAEI"]
[Fri Nov 14 15:28:42.995203 2025] [:error] [pid 16574:tid 16609] [client 173.239.211.40:30739] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Nov 14 15:28:45.057149 2025] [:error] [pid 16574:tid 16617] [client 173.239.211.40:30739] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Fri Nov 14 15:28:45.546914 2025] [:error] [pid 16574:tid 16616] [client 173.239.211.40:30739] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Fri Nov 14 15:28:46.885967 2025] [:error] [pid 16574:tid 16622] [client 173.239.211.40:30739] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Fri Nov 14 15:28:47.399146 2025] [:error] [pid 16574:tid 16607] [client 173.239.211.40:30739] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Fri Nov 14 15:28:49.280319 2025] [:error] [pid 16574:tid 16612] [client 173.239.211.40:30739] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Fri Nov 14 15:28:49.727385 2025] [:error] [pid 16574:tid 16623] [client 173.239.211.40:30739] [client 173.239.211.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aRbaMf6XQqe4NqaoE9IFsAAAAJA"]
[Fri Nov 14 15:28:50.653933 2025] [:error] [pid 16575:tid 16637] [client 173.239.211.42:50199] [client 173.239.211.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aRbaMu6qT670YxigvbBUGwAAAMM"]
[Fri Nov 14 15:28:51.612715 2025] [:error] [pid 16574:tid 16611] [client 63.135.161.116:39595] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Nov 14 15:28:52.076694 2025] [:error] [pid 16574:tid 16627] [client 63.135.161.116:39595] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Nov 14 15:28:52.537244 2025] [:error] [pid 16574:tid 16612] [client 63.135.161.116:39595] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Nov 14 15:28:53.006869 2025] [:error] [pid 16574:tid 16616] [client 63.135.161.116:39595] [client 63.135.161.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aRbaNf6XQqe4NqaoE9IFvQAAAIk"]
[Fri Nov 14 15:28:53.914998 2025] [:error] [pid 16574:tid 16621] [client 173.239.211.40:50051] [client 173.239.211.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aRbaNf6XQqe4NqaoE9IFvwAAAI4"]
[Fri Nov 14 15:28:54.860153 2025] [:error] [pid 16574:tid 16610] [client 173.239.211.39:46855] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Nov 14 15:28:55.313762 2025] [:error] [pid 16574:tid 16627] [client 173.239.211.39:46855] [client 173.239.211.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aRbaN_6XQqe4NqaoE9IFxAAAAJQ"]
[Fri Nov 14 15:28:56.215348 2025] [:error] [pid 16573:tid 16578] [client 173.239.211.47:21921] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Fri Nov 14 15:28:56.663054 2025] [:error] [pid 16573:tid 16590] [client 173.239.211.47:21921] File does not exist: /usr/local/apache/htdocs/suspended-page/sck.php
[Fri Nov 14 15:28:57.147750 2025] [:error] [pid 16573:tid 16602] [client 173.239.211.47:21921] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Fri Nov 14 15:28:58.093701 2025] [:error] [pid 16573:tid 16592] [client 173.239.211.47:21921] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Fri Nov 14 15:28:58.535676 2025] [:error] [pid 16573:tid 16598] [client 173.239.211.47:21921] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Nov 14 15:28:58.975057 2025] [:error] [pid 16573:tid 16583] [client 173.239.211.47:21921] [client 173.239.211.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aRbaOiPGexfUk9FDoEJnEAAAAEU"]
[Fri Nov 14 15:29:00.358805 2025] [:error] [pid 16575:tid 16654] [client 173.239.211.36:35665] [client 173.239.211.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.36, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aRbaPO6qT670YxigvbBUJgAAANQ"]
[Fri Nov 14 15:29:00.844270 2025] [:error] [pid 16575:tid 16643] [client 173.239.211.36:35665] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Fri Nov 14 15:29:01.325735 2025] [:error] [pid 16575:tid 16638] [client 173.239.211.36:35665] [client 173.239.211.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aRbaPe6qT670YxigvbBUKgAAAMQ"]
[Fri Nov 14 15:29:02.308959 2025] [:error] [pid 16574:tid 16617] [client 63.135.161.121:28153] [client 63.135.161.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aRbaPv6XQqe4NqaoE9IFzAAAAIo"]
[Fri Nov 14 15:29:03.704692 2025] [:error] [pid 16575:tid 16640] [client 173.239.211.35:46027] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Nov 14 15:29:04.157472 2025] [:error] [pid 16575:tid 16634] [client 173.239.211.35:46027] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Fri Nov 14 15:29:04.646663 2025] [:error] [pid 16575:tid 16648] [client 173.239.211.35:46027] [client 173.239.211.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aRbaQO6qT670YxigvbBUNQAAAM4"]
[Fri Nov 14 15:29:05.546244 2025] [:error] [pid 16574:tid 16610] [client 173.239.211.51:35063] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Fri Nov 14 15:29:06.000151 2025] [:error] [pid 16574:tid 16616] [client 173.239.211.51:35063] [client 173.239.211.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aRbaQf6XQqe4NqaoE9IF0AAAAIk"]
[Fri Nov 14 15:29:07.339633 2025] [:error] [pid 16709:tid 16718] [client 173.239.211.52:21683] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Nov 14 15:29:07.873126 2025] [:error] [pid 16709:tid 16733] [client 173.239.211.52:21683] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Fri Nov 14 15:29:08.363487 2025] [:error] [pid 16709:tid 16714] [client 173.239.211.52:21683] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/cloud.php
[Fri Nov 14 15:29:10.679931 2025] [:error] [pid 16709:tid 16717] [client 173.239.211.52:21683] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Fri Nov 14 15:29:11.156337 2025] [:error] [pid 16709:tid 16735] [client 173.239.211.52:21683] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/class_api.php
[Fri Nov 14 15:29:12.096774 2025] [:error] [pid 16709:tid 16718] [client 173.239.211.52:21683] [client 173.239.211.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aRbaSKNdzfVNC4oipLUY4AAAAUc"]
[Fri Nov 14 15:29:12.988724 2025] [:error] [pid 16573:tid 16580] [client 173.239.211.41:57699] File does not exist: /usr/local/apache/htdocs/suspended-page/base.php
[Fri Nov 14 15:29:13.871065 2025] [:error] [pid 16573:tid 16587] [client 173.239.211.41:57699] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Fri Nov 14 15:29:14.319161 2025] [:error] [pid 16573:tid 16586] [client 173.239.211.41:57699] [client 173.239.211.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aRbaSiPGexfUk9FDoEJnJQAAAEg"]
[Fri Nov 14 15:29:16.832151 2025] [:error] [pid 16574:tid 16620] [client 173.239.211.46:41553] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Nov 14 15:29:17.295408 2025] [:error] [pid 16574:tid 16616] [client 173.239.211.46:41553] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Nov 14 15:29:17.758123 2025] [:error] [pid 16574:tid 16612] [client 173.239.211.46:41553] [client 173.239.211.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.46, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aRbaTf6XQqe4NqaoE9IF3QAAAIU"]
[Fri Nov 14 15:29:17.761782 2025] [:error] [pid 16574:tid 16612] [client 173.239.211.46:41553] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Fri Nov 14 15:29:19.751114 2025] [:error] [pid 16574:tid 16631] [client 173.239.211.46:41553] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Fri Nov 14 15:29:20.194122 2025] [:error] [pid 16574:tid 16610] [client 173.239.211.46:41553] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Nov 14 15:29:21.097035 2025] [:error] [pid 16574:tid 16609] [client 173.239.211.46:41553] [client 173.239.211.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mah.php"] [unique_id "aRbaUf6XQqe4NqaoE9IF6QAAAII"]
[Fri Nov 14 15:29:22.069636 2025] [:error] [pid 16575:tid 16657] [client 173.239.211.52:61755] [client 173.239.211.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.52, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aRbaUu6qT670YxigvbBUSQAAANc"]
[Fri Nov 14 15:29:22.513590 2025] [:error] [pid 16575:tid 16640] [client 173.239.211.52:61755] [client 173.239.211.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aRbaUu6qT670YxigvbBUSwAAAMY"]
[Fri Nov 14 15:29:26.230174 2025] [:error] [pid 16709:tid 16720] [client 63.135.161.121:48463] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Fri Nov 14 15:29:27.602073 2025] [:error] [pid 16709:tid 16713] [client 63.135.161.121:48463] [client 63.135.161.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aRbaV6NdzfVNC4oipLUY-QAAAUI"]
[Fri Nov 14 15:29:28.521722 2025] [:error] [pid 16671:tid 16691] [client 173.239.211.49:24099] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Nov 14 15:29:29.447655 2025] [:error] [pid 16671:tid 16688] [client 173.239.211.49:24099] [client 173.239.211.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aRbaWTsoHwEAmeIzZXAb8QAAAQs"]
[Fri Nov 14 15:29:30.893699 2025] [:error] [pid 16575:tid 16644] [client 63.135.161.119:24415] [client 63.135.161.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.119, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aRbaWu6qT670YxigvbBUVQAAAMo"]
[Fri Nov 14 15:29:32.261416 2025] [:error] [pid 16575:tid 16658] [client 63.135.161.119:24415] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Fri Nov 14 15:29:32.716052 2025] [:error] [pid 16575:tid 16649] [client 63.135.161.119:24415] File does not exist: /usr/local/apache/htdocs/suspended-page/bulk.php
[Fri Nov 14 15:29:33.171203 2025] [:error] [pid 16575:tid 16646] [client 63.135.161.119:24415] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Fri Nov 14 15:29:34.656350 2025] [:error] [pid 16575:tid 16635] [client 63.135.161.119:24415] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logout.php
[Fri Nov 14 15:29:35.132399 2025] [:error] [pid 16575:tid 16654] [client 63.135.161.119:24415] [client 63.135.161.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aRbaX-6qT670YxigvbBUawAAANQ"]
[Fri Nov 14 15:29:36.563527 2025] [:error] [pid 16671:tid 16688] [client 173.239.211.49:39575] [client 173.239.211.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/packed.php"] [unique_id "aRbaYDsoHwEAmeIzZXAb_QAAAQs"]
[Fri Nov 14 15:29:37.501732 2025] [:error] [pid 16709:tid 16711] [client 173.239.211.55:33357] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Nov 14 15:29:37.964381 2025] [:error] [pid 16709:tid 16731] [client 173.239.211.55:33357] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Fri Nov 14 15:29:39.360237 2025] [:error] [pid 16709:tid 16727] [client 173.239.211.55:33357] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Fri Nov 14 15:29:39.860460 2025] [:error] [pid 16709:tid 16724] [client 173.239.211.55:33357] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-simple.php
[Fri Nov 14 15:29:41.215646 2025] [:error] [pid 16709:tid 16716] [client 173.239.211.55:33357] [client 173.239.211.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aRbaZaNdzfVNC4oipLUZEwAAAUU"]
[Fri Nov 14 15:29:42.614233 2025] [:error] [pid 16671:tid 16690] [client 173.239.211.53:55465] [client 173.239.211.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aRbaZjsoHwEAmeIzZXAcAwAAAQ0"]
[Fri Nov 14 15:29:44.011518 2025] [:error] [pid 16574:tid 16611] [client 63.135.161.117:47499] [client 63.135.161.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aRbaaP6XQqe4NqaoE9IGAgAAAIQ"]
[Fri Nov 14 15:29:44.961472 2025] [:error] [pid 16671:tid 16695] [client 45.130.83.239:20751] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Fri Nov 14 15:29:46.794311 2025] [:error] [pid 16671:tid 16679] [client 45.130.83.239:20751] [client 45.130.83.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.239, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aRbaajsoHwEAmeIzZXAcDgAAAQI"]
[Fri Nov 14 15:29:47.250041 2025] [:error] [pid 16671:tid 16698] [client 45.130.83.239:20751] [client 45.130.83.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aRbaazsoHwEAmeIzZXAcEAAAARU"]
[Fri Nov 14 15:30:04.366537 2025] [autoindex:error] [pid 16709:tid 16731] [client 173.239.211.38:46453] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 14 20:07:49.679458 2025] [:error] [pid 16574:tid 16630] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri Nov 14 20:07:49.892042 2025] [:error] [pid 16574:tid 16619] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php
[Fri Nov 14 20:07:50.390710 2025] [:error] [pid 16574:tid 16621] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Nov 14 20:07:50.861263 2025] [:error] [pid 16574:tid 16618] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Fri Nov 14 20:07:51.109596 2025] [:error] [pid 16574:tid 16614] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Nov 14 20:07:51.324844 2025] [:error] [pid 16574:tid 16608] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Nov 14 20:07:51.536367 2025] [:error] [pid 16574:tid 16609] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Nov 14 20:07:51.766246 2025] [:error] [pid 16574:tid 16631] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Nov 14 20:07:51.976817 2025] [:error] [pid 16574:tid 16612] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Nov 14 20:07:52.303537 2025] [:error] [pid 16574:tid 16626] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Nov 14 20:07:52.667800 2025] [:error] [pid 16574:tid 16615] [client 4.205.170.231:43185] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Nov 14 20:07:52.878520 2025] [:error] [pid 16574:tid 16616] [client 4.205.170.231:43185] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aRcbmP6XQqe4NqaoE9JTYwAAAIk"]
[Fri Nov 14 20:07:53.293497 2025] [:error] [pid 16671:tid 16688] [client 4.205.170.231:29009] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aRcbmTsoHwEAmeIzZXB5EQAAAQs"]
[Fri Nov 14 20:07:53.738589 2025] [:error] [pid 1170:tid 1179] [client 4.205.170.231:17430] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aRcbmQ5pkvzCDzzjItRtkgAAAAc"]
[Fri Nov 14 20:07:54.166071 2025] [:error] [pid 16575:tid 16638] [client 4.205.170.231:45141] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aRcbmu6qT670YxigvbCkaAAAAMQ"]
[Sat Nov 15 03:41:53.652641 2025] [:error] [pid 44437:tid 44475] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/neshe.php
[Sat Nov 15 03:41:53.862798 2025] [:error] [pid 44437:tid 44472] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Sat Nov 15 03:41:54.073813 2025] [:error] [pid 44437:tid 44489] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sat Nov 15 03:41:54.286861 2025] [:error] [pid 44437:tid 44478] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/file52.php
[Sat Nov 15 03:41:54.504546 2025] [:error] [pid 44437:tid 44493] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sat Nov 15 03:41:54.714789 2025] [:error] [pid 44437:tid 44474] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/image.php
[Sat Nov 15 03:41:54.936515 2025] [:error] [pid 44437:tid 44473] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/redi.php
[Sat Nov 15 03:41:55.152968 2025] [:error] [pid 44437:tid 44490] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Sat Nov 15 03:41:55.365740 2025] [:error] [pid 44437:tid 44485] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Nov 15 03:41:55.578817 2025] [:error] [pid 44437:tid 44480] [client 4.204.56.174:16333] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Sat Nov 15 03:41:55.786306 2025] [:error] [pid 44437:tid 44495] [client 4.204.56.174:16333] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aReGA-rO1g9UNCoZp04TUgAAAFg"]
[Sat Nov 15 03:41:56.243779 2025] [:error] [pid 44527:tid 44556] [client 4.204.56.174:16267] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aReGBDZn1ZaBElIfEGIENAAAANg"]
[Sat Nov 15 03:41:56.690248 2025] [:error] [pid 44436:tid 44454] [client 4.204.56.174:16338] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aReGBDUs0t-jxzSR5ShARQAAAAo"]
[Sat Nov 15 03:41:57.106539 2025] [:error] [pid 44438:tid 44511] [client 4.204.56.174:16273] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aReGBQUQm6jCuPWgJllf8gAAAI0"]
[Sat Nov 15 03:41:57.530149 2025] [:error] [pid 44437:tid 44476] [client 4.204.56.174:16364] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aReGBerO1g9UNCoZp04TVQAAAEU"]
[Sat Nov 15 03:41:57.961292 2025] [:error] [pid 44438:tid 44509] [client 4.204.56.174:16321] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aReGBQUQm6jCuPWgJllf9QAAAIs"]
[Sat Nov 15 03:41:58.376680 2025] [:error] [pid 44527:tid 44554] [client 4.204.56.174:16337] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aReGBjZn1ZaBElIfEGIEOgAAANY"]
[Sat Nov 15 03:41:58.790072 2025] [:error] [pid 44438:tid 44504] [client 4.204.56.174:16262] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aReGBgUQm6jCuPWgJllf-AAAAIY"]
[Sat Nov 15 03:41:59.210387 2025] [:error] [pid 44438:tid 44500] [client 4.204.56.174:16358] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php/mail.php"] [unique_id "aReGBwUQm6jCuPWgJllf-gAAAII"]
[Sat Nov 15 03:41:59.639985 2025] [:error] [pid 44438:tid 44516] [client 4.204.56.174:16260] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php/mail.php"] [unique_id "aReGBwUQm6jCuPWgJllf_QAAAJI"]
[Sat Nov 15 03:42:00.053488 2025] [:error] [pid 44437:tid 44485] [client 4.204.56.174:16344] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php/mail.php"] [unique_id "aReGCOrO1g9UNCoZp04TWgAAAE4"]
[Sat Nov 15 03:42:00.487497 2025] [:error] [pid 44438:tid 44512] [client 4.204.56.174:16264] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php/mail.php"] [unique_id "aReGCAUQm6jCuPWgJllf_wAAAI4"]
[Sat Nov 15 03:42:00.908048 2025] [:error] [pid 44527:tid 44532] [client 4.204.56.174:16259] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aReGCDZn1ZaBElIfEGIEPwAAAMA"]
[Sat Nov 15 03:42:01.360690 2025] [:error] [pid 44438:tid 44508] [client 4.204.56.174:16366] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aReGCQUQm6jCuPWgJllgAAAAAIo"]
[Sat Nov 15 03:42:01.776374 2025] [:error] [pid 44438:tid 44502] [client 4.204.56.174:16353] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aReGCQUQm6jCuPWgJllgAQAAAIQ"]
[Sat Nov 15 03:42:02.197002 2025] [:error] [pid 44438:tid 44503] [client 4.204.56.174:16383] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aReGCgUQm6jCuPWgJllgAwAAAIU"]
[Sat Nov 15 03:42:02.626729 2025] [:error] [pid 44527:tid 44539] [client 4.204.56.174:16199] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aReGCjZn1ZaBElIfEGIERwAAAMc"]
[Sat Nov 15 03:42:03.040252 2025] [:error] [pid 44437:tid 44482] [client 4.204.56.174:16342] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aReGC-rO1g9UNCoZp04TXwAAAEs"]
[Sat Nov 15 03:42:03.456256 2025] [:error] [pid 44527:tid 44556] [client 4.204.56.174:16381] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aReGCzZn1ZaBElIfEGIESgAAANg"]
[Sat Nov 15 03:42:03.875898 2025] [:error] [pid 44527:tid 44553] [client 4.204.56.174:16270] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aReGCzZn1ZaBElIfEGIETgAAANU"]
[Sat Nov 15 03:42:04.297655 2025] [:error] [pid 44438:tid 44516] [client 4.204.56.174:16365] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko-litespeed.php"] [unique_id "aReGDAUQm6jCuPWgJllgBgAAAJI"]
[Sat Nov 15 03:42:04.757874 2025] [:error] [pid 44527:tid 44537] [client 4.204.56.174:16349] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko-litespeed.php"] [unique_id "aReGDDZn1ZaBElIfEGIEUwAAAMU"]
[Sat Nov 15 03:42:05.181013 2025] [:error] [pid 44438:tid 44510] [client 4.204.56.174:16350] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko-litespeed.php"] [unique_id "aReGDQUQm6jCuPWgJllgCwAAAIw"]
[Sat Nov 15 03:42:05.622666 2025] [:error] [pid 44437:tid 44472] [client 4.204.56.174:16269] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko-litespeed.php"] [unique_id "aReGDerO1g9UNCoZp04TZwAAAEE"]
[Sat Nov 15 03:42:06.039835 2025] [:error] [pid 44527:tid 44553] [client 4.204.56.174:16324] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aReGDjZn1ZaBElIfEGIEYgAAANU"]
[Sat Nov 15 03:42:06.468999 2025] [:error] [pid 44436:tid 44460] [client 4.204.56.174:16301] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aReGDjUs0t-jxzSR5ShAZwAAABA"]
[Sat Nov 15 03:42:06.882681 2025] [:error] [pid 44436:tid 44450] [client 4.204.56.174:16336] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aReGDjUs0t-jxzSR5ShAbAAAAAY"]
[Sat Nov 15 03:42:07.296648 2025] [:error] [pid 44527:tid 44556] [client 4.204.56.174:16370] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aReGDzZn1ZaBElIfEGIEbAAAANg"]
[Sat Nov 15 03:42:07.711798 2025] [:error] [pid 44438:tid 44518] [client 4.204.56.174:16343] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en0.php"] [unique_id "aReGDwUQm6jCuPWgJllgDgAAAJQ"]
[Sat Nov 15 03:42:08.135308 2025] [:error] [pid 44436:tid 44455] [client 4.204.56.174:16373] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en0.php"] [unique_id "aReGEDUs0t-jxzSR5ShAdgAAAAs"]
[Sat Nov 15 03:42:08.611818 2025] [:error] [pid 44436:tid 44448] [client 4.204.56.174:16341] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en0.php"] [unique_id "aReGEDUs0t-jxzSR5ShAeAAAAAQ"]
[Sat Nov 15 03:42:09.056252 2025] [:error] [pid 44436:tid 44460] [client 4.204.56.174:16276] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en0.php"] [unique_id "aReGETUs0t-jxzSR5ShAegAAABA"]
[Sat Nov 15 03:42:09.471019 2025] [:error] [pid 44436:tid 44463] [client 4.204.56.174:16380] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aReGETUs0t-jxzSR5ShAfgAAABM"]
[Sat Nov 15 03:42:09.916419 2025] [:error] [pid 44527:tid 44539] [client 4.204.56.174:16352] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aReGETZn1ZaBElIfEGIEcQAAAMc"]
[Sat Nov 15 03:42:10.368510 2025] [:error] [pid 44436:tid 44450] [client 4.204.56.174:16282] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aReGEjUs0t-jxzSR5ShAgAAAAAY"]
[Sat Nov 15 03:42:10.790138 2025] [:error] [pid 44436:tid 44449] [client 4.204.56.174:16332] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aReGEjUs0t-jxzSR5ShAhQAAAAU"]
[Sat Nov 15 03:42:11.206816 2025] [:error] [pid 44436:tid 44447] [client 4.204.56.174:16345] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfile.php"] [unique_id "aReGEzUs0t-jxzSR5ShAhwAAAAM"]
[Sat Nov 15 03:42:11.633145 2025] [:error] [pid 44527:tid 44533] [client 4.204.56.174:16268] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfile.php"] [unique_id "aReGEzZn1ZaBElIfEGIEeAAAAME"]
[Sat Nov 15 03:42:12.080647 2025] [:error] [pid 44436:tid 44444] [client 4.204.56.174:16347] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfile.php"] [unique_id "aReGFDUs0t-jxzSR5ShAigAAAAA"]
[Sat Nov 15 03:42:12.498827 2025] [:error] [pid 44437:tid 44495] [client 4.204.56.174:16275] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfile.php"] [unique_id "aReGFOrO1g9UNCoZp04TegAAAFg"]
[Sat Nov 15 03:42:12.950105 2025] [:error] [pid 44438:tid 44505] [client 4.204.56.174:16363] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aReGFAUQm6jCuPWgJllgGgAAAIc"]
[Sat Nov 15 03:42:13.396805 2025] [:error] [pid 44436:tid 44446] [client 4.204.56.174:16304] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aReGFTUs0t-jxzSR5ShAjgAAAAI"]
[Sat Nov 15 03:42:13.829524 2025] [:error] [pid 44527:tid 44535] [client 4.204.56.174:16357] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aReGFTZn1ZaBElIfEGIEgwAAAMM"]
[Sat Nov 15 03:42:14.267686 2025] [:error] [pid 44436:tid 44449] [client 4.204.56.174:16314] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aReGFjUs0t-jxzSR5ShAkQAAAAU"]
[Sat Nov 15 03:42:14.681830 2025] [:error] [pid 44437:tid 44475] [client 4.204.56.174:16274] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aReGFurO1g9UNCoZp04TfwAAAEQ"]
[Sat Nov 15 03:42:15.118324 2025] [:error] [pid 44438:tid 44499] [client 4.204.56.174:16215] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aReGFwUQm6jCuPWgJllgHgAAAIE"]
[Sat Nov 15 03:42:15.531488 2025] [:error] [pid 44438:tid 44522] [client 4.204.56.174:16371] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aReGFwUQm6jCuPWgJllgIAAAAJg"]
[Sat Nov 15 03:42:15.995590 2025] [:error] [pid 44437:tid 44472] [client 4.204.56.174:16354] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aReGF-rO1g9UNCoZp04TgAAAAEE"]
[Sat Nov 15 03:42:16.411593 2025] [:error] [pid 44437:tid 44485] [client 4.204.56.174:16368] [client 4.204.56.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aReGGOrO1g9UNCoZp04TggAAAE4"]
[Sat Nov 15 03:42:16.879615 2025] [:error] [pid 44438:tid 44509] [client 4.204.56.174:16265] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGGAUQm6jCuPWgJllgKQAAAIs"]
[Sat Nov 15 03:42:17.334785 2025] [:error] [pid 44438:tid 44505] [client 4.204.56.174:16355] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGGQUQm6jCuPWgJllgLgAAAIc"]
[Sat Nov 15 03:42:17.773834 2025] [:error] [pid 44527:tid 44542] [client 4.204.56.174:16295] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGGTZn1ZaBElIfEGIEjAAAAMo"]
[Sat Nov 15 03:42:18.213712 2025] [:error] [pid 44527:tid 44545] [client 4.204.56.174:16340] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGGjZn1ZaBElIfEGIEjQAAAM0"]
[Sat Nov 15 03:42:18.644453 2025] [:error] [pid 44437:tid 44492] [client 4.204.56.174:16272] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aReGGurO1g9UNCoZp04ThgAAAFU"]
[Sat Nov 15 03:42:19.062885 2025] [:error] [pid 44438:tid 44509] [client 4.204.56.174:16325] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aReGGwUQm6jCuPWgJllgMwAAAIs"]
[Sat Nov 15 03:42:19.475985 2025] [:error] [pid 44438:tid 44505] [client 4.204.56.174:16377] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aReGGwUQm6jCuPWgJllgNQAAAIc"]
[Sat Nov 15 03:42:19.988667 2025] [:error] [pid 44437:tid 44472] [client 4.204.56.174:16261] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aReGG-rO1g9UNCoZp04TiAAAAEE"]
[Sat Nov 15 03:42:20.422323 2025] [:error] [pid 44438:tid 44512] [client 4.204.56.174:16266] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellalfa.php"] [unique_id "aReGHAUQm6jCuPWgJllgOQAAAI4"]
[Sat Nov 15 03:42:20.869461 2025] [:error] [pid 44527:tid 44536] [client 4.204.56.174:16379] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellalfa.php"] [unique_id "aReGHDZn1ZaBElIfEGIElAAAAMQ"]
[Sat Nov 15 03:42:21.307750 2025] [:error] [pid 44527:tid 44540] [client 4.204.56.174:16348] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellalfa.php"] [unique_id "aReGHTZn1ZaBElIfEGIElgAAAMg"]
[Sat Nov 15 03:42:21.735840 2025] [:error] [pid 44438:tid 44499] [client 4.204.56.174:16313] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellalfa.php"] [unique_id "aReGHQUQm6jCuPWgJllgPgAAAIE"]
[Sat Nov 15 03:42:22.150281 2025] [:error] [pid 44437:tid 44471] [client 4.204.56.174:16323] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aReGHurO1g9UNCoZp04TkQAAAEA"]
[Sat Nov 15 03:42:22.587987 2025] [:error] [pid 44436:tid 44465] [client 4.204.56.174:16222] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aReGHjUs0t-jxzSR5ShAnwAAABU"]
[Sat Nov 15 03:42:23.002138 2025] [:error] [pid 44437:tid 44479] [client 4.204.56.174:16220] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aReGH-rO1g9UNCoZp04TlQAAAEg"]
[Sat Nov 15 03:42:23.419587 2025] [:error] [pid 44437:tid 44472] [client 4.204.56.174:16374] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aReGH-rO1g9UNCoZp04TlwAAAEE"]
[Sat Nov 15 03:42:23.845813 2025] [:error] [pid 44437:tid 44490] [client 4.204.56.174:16290] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGH-rO1g9UNCoZp04TmQAAAFM"]
[Sat Nov 15 03:42:24.266495 2025] [:error] [pid 44527:tid 44545] [client 4.204.56.174:16197] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGIDZn1ZaBElIfEGIEngAAAM0"]
[Sat Nov 15 03:42:24.684702 2025] [:error] [pid 44436:tid 44448] [client 4.204.56.174:16130] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGIDUs0t-jxzSR5ShAogAAAAQ"]
[Sat Nov 15 03:42:25.160535 2025] [:error] [pid 44436:tid 44453] [client 4.204.56.174:16193] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGITUs0t-jxzSR5ShAowAAAAk"]
[Sat Nov 15 03:42:25.588451 2025] [:error] [pid 44436:tid 44463] [client 4.204.56.174:16289] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGITUs0t-jxzSR5ShApQAAABM"]
[Sat Nov 15 03:42:26.118337 2025] [:error] [pid 44436:tid 44446] [client 4.204.56.174:16198] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGIjUs0t-jxzSR5ShAqQAAAAI"]
[Sat Nov 15 03:42:26.547964 2025] [:error] [pid 44436:tid 44445] [client 4.204.56.174:16296] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGIjUs0t-jxzSR5ShAqwAAAAE"]
[Sat Nov 15 03:42:26.997684 2025] [:error] [pid 44438:tid 44506] [client 4.204.56.174:16210] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGIgUQm6jCuPWgJllgRwAAAIg"]
[Sat Nov 15 03:42:27.421694 2025] [:error] [pid 44437:tid 44476] [client 4.204.56.174:16376] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aReGI-rO1g9UNCoZp04TpwAAAEU"]
[Sat Nov 15 03:42:27.844722 2025] [:error] [pid 44438:tid 44521] [client 4.204.56.174:16280] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aReGIwUQm6jCuPWgJllgSQAAAJc"]
[Sat Nov 15 03:42:28.262931 2025] [:error] [pid 44438:tid 44500] [client 4.204.56.174:16195] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aReGJAUQm6jCuPWgJllgSwAAAII"]
[Sat Nov 15 03:42:28.676188 2025] [:error] [pid 44437:tid 44472] [client 4.204.56.174:16212] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aReGJOrO1g9UNCoZp04TrAAAAEE"]
[Sat Nov 15 03:42:29.091647 2025] [:error] [pid 44438:tid 44504] [client 4.204.56.174:16214] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aReGJQUQm6jCuPWgJllgTQAAAIY"]
[Sat Nov 15 03:42:29.507583 2025] [:error] [pid 44527:tid 44553] [client 4.204.56.174:16362] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aReGJTZn1ZaBElIfEGIEqAAAANU"]
[Sat Nov 15 03:42:29.926210 2025] [:error] [pid 44437:tid 44493] [client 4.204.56.174:16375] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aReGJerO1g9UNCoZp04TsAAAAFY"]
[Sat Nov 15 03:42:30.340409 2025] [:error] [pid 44527:tid 44544] [client 4.204.56.174:16285] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aReGJjZn1ZaBElIfEGIEqgAAAMw"]
[Sat Nov 15 03:42:30.762796 2025] [:error] [pid 44437:tid 44479] [client 4.204.56.174:16317] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGJurO1g9UNCoZp04TswAAAEg"]
[Sat Nov 15 03:42:31.181470 2025] [:error] [pid 44438:tid 44521] [client 4.204.56.174:16299] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGJwUQm6jCuPWgJllgUgAAAJc"]
[Sat Nov 15 03:42:31.596220 2025] [:error] [pid 44527:tid 44550] [client 4.204.56.174:16291] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGJzZn1ZaBElIfEGIErAAAANI"]
[Sat Nov 15 03:42:32.019968 2025] [:error] [pid 44527:tid 44546] [client 4.204.56.174:16293] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aReGKDZn1ZaBElIfEGIErQAAAM4"]
[Sat Nov 15 03:42:32.434496 2025] [:error] [pid 44436:tid 44446] [client 4.204.56.174:16256] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aReGKDUs0t-jxzSR5ShAsQAAAAI"]
[Sat Nov 15 03:42:32.857287 2025] [:error] [pid 44437:tid 44480] [client 4.204.56.174:16329] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aReGKOrO1g9UNCoZp04TtwAAAEk"]
[Sat Nov 15 03:42:33.274140 2025] [:error] [pid 44437:tid 44475] [client 4.204.56.174:16330] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aReGKerO1g9UNCoZp04TuAAAAEQ"]
[Sat Nov 15 03:42:33.723915 2025] [:error] [pid 44437:tid 44487] [client 4.204.56.174:16308] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aReGKerO1g9UNCoZp04TuwAAAFA"]
[Sat Nov 15 03:42:34.147342 2025] [:error] [pid 44437:tid 44485] [client 4.204.56.174:16303] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aReGKurO1g9UNCoZp04TvQAAAE4"]
[Sat Nov 15 03:42:34.753816 2025] [:error] [pid 44436:tid 44462] [client 4.204.56.174:16297] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aReGKjUs0t-jxzSR5ShAuAAAABI"]
[Sat Nov 15 03:42:35.306044 2025] [:error] [pid 44527:tid 44544] [client 4.204.56.174:16261] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aReGKzZn1ZaBElIfEGIEswAAAMw"]
[Sat Nov 15 03:42:35.796233 2025] [:error] [pid 44527:tid 44550] [client 4.204.56.174:16158] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aReGKzZn1ZaBElIfEGIEtQAAANI"]
[Sat Nov 15 03:42:36.246639 2025] [:error] [pid 44527:tid 44545] [client 4.204.56.174:16298] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGLDZn1ZaBElIfEGIEtwAAAM0"]
[Sat Nov 15 03:42:36.684771 2025] [:error] [pid 44438:tid 44513] [client 4.204.56.174:16326] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGLAUQm6jCuPWgJllgXgAAAI8"]
[Sat Nov 15 03:42:37.100795 2025] [:error] [pid 44527:tid 44532] [client 4.204.56.174:16288] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGLTZn1ZaBElIfEGIEvAAAAMA"]
[Sat Nov 15 03:42:37.539402 2025] [:error] [pid 44436:tid 44457] [client 4.204.56.174:16378] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGLTUs0t-jxzSR5ShAvgAAAA0"]
[Sat Nov 15 03:42:37.966305 2025] [:error] [pid 44436:tid 44451] [client 4.204.56.174:16316] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGLTUs0t-jxzSR5ShAvwAAAAc"]
[Sat Nov 15 03:42:38.387420 2025] [:error] [pid 44527:tid 44533] [client 4.204.56.174:16236] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGLjZn1ZaBElIfEGIEvgAAAME"]
[Sat Nov 15 03:42:38.803601 2025] [:error] [pid 44437:tid 44482] [client 4.204.56.174:16242] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGLurO1g9UNCoZp04TvgAAAEs"]
[Sat Nov 15 03:42:39.230333 2025] [:error] [pid 44438:tid 44510] [client 4.204.56.174:16305] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGLwUQm6jCuPWgJllgZAAAAIw"]
[Sat Nov 15 03:42:39.648254 2025] [:error] [pid 44437:tid 44472] [client 4.204.56.174:16219] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aReGL-rO1g9UNCoZp04TwAAAAEE"]
[Sat Nov 15 03:42:40.104775 2025] [:error] [pid 44437:tid 44489] [client 4.204.56.174:16311] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aReGMOrO1g9UNCoZp04TwQAAAFI"]
[Sat Nov 15 03:42:40.517764 2025] [:error] [pid 44527:tid 44555] [client 4.204.56.174:16302] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aReGMDZn1ZaBElIfEGIEwwAAANc"]
[Sat Nov 15 03:42:40.937281 2025] [:error] [pid 44437:tid 44481] [client 4.204.56.174:16229] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aReGMOrO1g9UNCoZp04TwwAAAEo"]
[Sat Nov 15 03:42:41.362066 2025] [:error] [pid 44527:tid 44534] [client 4.204.56.174:16194] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aReGMTZn1ZaBElIfEGIExwAAAMI"]
[Sat Nov 15 03:42:41.785398 2025] [:error] [pid 44527:tid 44551] [client 4.204.56.174:16224] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aReGMTZn1ZaBElIfEGIEyAAAANM"]
[Sat Nov 15 03:42:42.218785 2025] [:error] [pid 44527:tid 44549] [client 4.204.56.174:16228] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aReGMjZn1ZaBElIfEGIEywAAANE"]
[Sat Nov 15 03:42:42.660066 2025] [:error] [pid 44527:tid 44538] [client 4.204.56.174:16309] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aReGMjZn1ZaBElIfEGIEzAAAAMY"]
[Sat Nov 15 03:42:43.084956 2025] [:error] [pid 44437:tid 44483] [client 4.204.56.174:16142] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aReGM-rO1g9UNCoZp04TxQAAAEw"]
[Sat Nov 15 03:42:43.508250 2025] [:error] [pid 44527:tid 44537] [client 4.204.56.174:16314] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aReGMzZn1ZaBElIfEGIEzwAAAMU"]
[Sat Nov 15 03:42:43.942337 2025] [:error] [pid 44527:tid 44539] [client 4.204.56.174:16080] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aReGMzZn1ZaBElIfEGIE0AAAAMc"]
[Sat Nov 15 03:42:44.362005 2025] [:error] [pid 44438:tid 44499] [client 4.204.56.174:16238] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aReGNAUQm6jCuPWgJllgaQAAAIE"]
[Sat Nov 15 03:42:44.774520 2025] [:error] [pid 44438:tid 44505] [client 4.204.56.174:16209] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aReGNAUQm6jCuPWgJllgagAAAIc"]
[Sat Nov 15 03:42:45.199171 2025] [:error] [pid 44438:tid 44519] [client 4.204.56.174:16255] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aReGNQUQm6jCuPWgJllgawAAAJU"]
[Sat Nov 15 03:42:45.631479 2025] [:error] [pid 44436:tid 44460] [client 4.204.56.174:16133] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aReGNTUs0t-jxzSR5ShAyQAAABA"]
[Sat Nov 15 03:42:46.117705 2025] [:error] [pid 44437:tid 44490] [client 4.204.56.174:16369] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aReGNurO1g9UNCoZp04TygAAAFM"]
[Sat Nov 15 03:42:46.531341 2025] [:error] [pid 44437:tid 44495] [client 4.204.56.174:16245] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aReGNurO1g9UNCoZp04TywAAAFg"]
[Sat Nov 15 03:42:46.946329 2025] [:error] [pid 44437:tid 44491] [client 4.204.56.174:16206] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aReGNurO1g9UNCoZp04TzAAAAFQ"]
[Sat Nov 15 03:42:47.361639 2025] [:error] [pid 44436:tid 44452] [client 4.204.56.174:16339] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aReGNzUs0t-jxzSR5ShAywAAAAg"]
[Sat Nov 15 03:42:47.775472 2025] [:error] [pid 44436:tid 44462] [client 4.204.56.174:16322] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aReGNzUs0t-jxzSR5ShAzgAAABI"]
[Sat Nov 15 03:42:48.198559 2025] [:error] [pid 44436:tid 44455] [client 4.204.56.174:16141] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGODUs0t-jxzSR5ShAzwAAAAs"]
[Sat Nov 15 03:42:48.638213 2025] [:error] [pid 44527:tid 44555] [client 4.204.56.174:16263] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGODZn1ZaBElIfEGIE1gAAANc"]
[Sat Nov 15 03:42:49.163713 2025] [:error] [pid 44527:tid 44532] [client 4.204.56.174:16359] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGOTZn1ZaBElIfEGIE2QAAAMA"]
[Sat Nov 15 03:42:49.593444 2025] [:error] [pid 44436:tid 44450] [client 4.204.56.174:16233] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aReGOTUs0t-jxzSR5ShA0AAAAAY"]
[Sat Nov 15 03:42:50.007998 2025] [:error] [pid 44438:tid 44505] [client 4.204.56.174:16155] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aReGOgUQm6jCuPWgJllgdQAAAIc"]
[Sat Nov 15 03:42:50.425380 2025] [:error] [pid 44438:tid 44506] [client 4.204.56.174:16360] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aReGOgUQm6jCuPWgJllgdwAAAIg"]
[Sat Nov 15 03:42:50.839978 2025] [:error] [pid 44527:tid 44533] [client 4.204.56.174:16300] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aReGOjZn1ZaBElIfEGIE3AAAAME"]
[Sat Nov 15 03:42:51.513200 2025] [:error] [pid 44527:tid 44544] [client 4.204.56.174:16217] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aReGOzZn1ZaBElIfEGIE3wAAAMw"]
[Sat Nov 15 03:42:52.008500 2025] [:error] [pid 44527:tid 44550] [client 4.204.56.174:16196] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGPDZn1ZaBElIfEGIE4AAAANI"]
[Sat Nov 15 03:42:52.479120 2025] [:error] [pid 44436:tid 44464] [client 4.204.56.174:16211] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGPDUs0t-jxzSR5ShA1wAAABQ"]
[Sat Nov 15 03:42:52.951102 2025] [:error] [pid 44436:tid 44461] [client 4.204.56.174:16328] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGPDUs0t-jxzSR5ShA2QAAABE"]
[Sat Nov 15 03:42:53.438210 2025] [:error] [pid 44527:tid 44549] [client 4.204.56.174:16136] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aReGPTZn1ZaBElIfEGIE5AAAANE"]
[Sat Nov 15 03:42:53.892365 2025] [:error] [pid 44438:tid 44520] [client 4.204.56.174:16258] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aReGPQUQm6jCuPWgJllgfAAAAJY"]
[Sat Nov 15 03:42:54.312362 2025] [:error] [pid 44438:tid 44508] [client 4.204.56.174:16287] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aReGPgUQm6jCuPWgJllgfgAAAIo"]
[Sat Nov 15 03:42:54.733402 2025] [:error] [pid 44438:tid 44510] [client 4.204.56.174:16143] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aReGPgUQm6jCuPWgJllgggAAAIw"]
[Sat Nov 15 03:42:55.164508 2025] [:error] [pid 44436:tid 44453] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Nov 15 03:42:55.376280 2025] [:error] [pid 44436:tid 44467] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Sat Nov 15 03:42:55.587403 2025] [:error] [pid 44436:tid 44465] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/mpxct.php
[Sat Nov 15 03:42:55.797710 2025] [:error] [pid 44436:tid 44452] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Nov 15 03:42:56.008563 2025] [:error] [pid 44436:tid 44463] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Sat Nov 15 03:42:56.275700 2025] [:error] [pid 44436:tid 44461] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sat Nov 15 03:42:56.494288 2025] [:error] [pid 44436:tid 44466] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Sat Nov 15 03:42:56.710251 2025] [:error] [pid 44436:tid 44454] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sat Nov 15 03:42:56.920276 2025] [:error] [pid 44436:tid 44445] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sat Nov 15 03:42:58.235860 2025] [:error] [pid 44436:tid 44445] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/cfile.php
[Sat Nov 15 03:42:58.462809 2025] [:error] [pid 44436:tid 44461] [client 4.204.56.174:16205] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Sat Nov 15 03:42:58.671657 2025] [:error] [pid 44436:tid 44456] [client 4.204.56.174:16205] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aReGQjUs0t-jxzSR5ShA9AAAAAw"]
[Sat Nov 15 03:42:59.148814 2025] [:error] [pid 44437:tid 44478] [client 4.204.56.174:16279] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aReGQ-rO1g9UNCoZp04T2gAAAEc"]
[Sat Nov 15 03:42:59.614030 2025] [:error] [pid 44438:tid 44502] [client 4.204.56.174:16361] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aReGQwUQm6jCuPWgJllglQAAAIQ"]
[Sat Nov 15 03:43:00.076931 2025] [:error] [pid 44527:tid 44535] [client 4.204.56.174:16103] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aReGRDZn1ZaBElIfEGIE_AAAAMM"]
[Sat Nov 15 03:43:00.524463 2025] [:error] [pid 44438:tid 44508] [client 4.204.56.174:16153] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owl.php"] [unique_id "aReGRAUQm6jCuPWgJllglwAAAIo"]
[Sat Nov 15 03:43:00.991925 2025] [:error] [pid 44438:tid 44519] [client 4.204.56.174:16237] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owl.php"] [unique_id "aReGRAUQm6jCuPWgJllgmQAAAJU"]
[Sat Nov 15 03:43:01.511426 2025] [:error] [pid 44437:tid 44490] [client 4.204.56.174:16356] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owl.php"] [unique_id "aReGRerO1g9UNCoZp04T6wAAAFM"]
[Sat Nov 15 03:43:01.940124 2025] [:error] [pid 44527:tid 44555] [client 4.204.56.174:16312] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owl.php"] [unique_id "aReGRTZn1ZaBElIfEGIFAAAAANc"]
[Sat Nov 15 03:43:02.361041 2025] [:error] [pid 44436:tid 44453] [client 4.204.56.174:16283] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aReGRjUs0t-jxzSR5ShA9gAAAAk"]
[Sat Nov 15 03:43:02.803585 2025] [:error] [pid 44438:tid 44513] [client 4.204.56.174:16346] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aReGRgUQm6jCuPWgJllgoQAAAI8"]
[Sat Nov 15 03:43:03.297160 2025] [:error] [pid 44437:tid 44486] [client 4.204.56.174:16150] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aReGR-rO1g9UNCoZp04T7QAAAE8"]
[Sat Nov 15 03:43:03.738763 2025] [:error] [pid 44438:tid 44502] [client 4.204.56.174:16367] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aReGRwUQm6jCuPWgJllgogAAAIQ"]
[Sat Nov 15 03:43:04.219363 2025] [:error] [pid 44438:tid 44510] [client 4.204.56.174:16218] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aReGSAUQm6jCuPWgJllgowAAAIw"]
[Sat Nov 15 03:43:04.647536 2025] [:error] [pid 44437:tid 44473] [client 4.204.56.174:16240] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aReGSOrO1g9UNCoZp04T8QAAAEI"]
[Sat Nov 15 03:43:05.126426 2025] [:error] [pid 44527:tid 44546] [client 4.204.56.174:16142] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aReGSTZn1ZaBElIfEGIFBwAAAM4"]
[Sat Nov 15 03:43:05.612060 2025] [:error] [pid 44527:tid 44539] [client 4.204.56.174:16140] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aReGSTZn1ZaBElIfEGIFCAAAAMc"]
[Sat Nov 15 03:43:06.037517 2025] [:error] [pid 44438:tid 44512] [client 4.204.56.174:16254] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a3.php"] [unique_id "aReGSgUQm6jCuPWgJllgpgAAAI4"]
[Sat Nov 15 03:43:06.576267 2025] [:error] [pid 44438:tid 44513] [client 4.204.56.174:16339] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a3.php"] [unique_id "aReGSgUQm6jCuPWgJllgqAAAAI8"]
[Sat Nov 15 03:43:07.068049 2025] [:error] [pid 44438:tid 44521] [client 4.204.56.174:16294] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a3.php"] [unique_id "aReGSwUQm6jCuPWgJllgqQAAAJc"]
[Sat Nov 15 03:43:07.831373 2025] [:error] [pid 44437:tid 44484] [client 4.204.56.174:16271] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a3.php"] [unique_id "aReGS-rO1g9UNCoZp04T-wAAAE0"]
[Sat Nov 15 03:43:08.319475 2025] [:error] [pid 44436:tid 44464] [client 4.204.56.174:16149] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aReGTDUs0t-jxzSR5ShBAgAAABQ"]
[Sat Nov 15 03:43:08.733619 2025] [:error] [pid 44437:tid 44478] [client 4.204.56.174:16132] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aReGTOrO1g9UNCoZp04T_AAAAEc"]
[Sat Nov 15 03:43:09.176679 2025] [:error] [pid 44437:tid 44495] [client 4.204.56.174:16204] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aReGTerO1g9UNCoZp04T_gAAAFg"]
[Sat Nov 15 03:43:09.603378 2025] [:error] [pid 44527:tid 44546] [client 4.204.56.174:16234] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aReGTTZn1ZaBElIfEGIFGgAAAM4"]
[Sat Nov 15 03:43:10.299596 2025] [:error] [pid 44437:tid 44491] [client 4.204.56.174:16208] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aReGTurO1g9UNCoZp04UAwAAAFQ"]
[Sat Nov 15 03:43:10.734392 2025] [:error] [pid 44436:tid 44452] [client 4.204.56.174:16076] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aReGTjUs0t-jxzSR5ShBBQAAAAg"]
[Sat Nov 15 03:43:11.148145 2025] [:error] [pid 44437:tid 44488] [client 4.204.56.174:16202] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aReGT-rO1g9UNCoZp04UBQAAAFE"]
[Sat Nov 15 03:43:11.672443 2025] [:error] [pid 44438:tid 44503] [client 4.204.56.174:16223] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aReGTwUQm6jCuPWgJllgrwAAAIU"]
[Sat Nov 15 03:43:12.115257 2025] [:error] [pid 44437:tid 44475] [client 4.204.56.174:16185] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGUOrO1g9UNCoZp04UBwAAAEQ"]
[Sat Nov 15 03:43:12.528847 2025] [:error] [pid 44437:tid 44491] [client 4.204.56.174:16131] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGUOrO1g9UNCoZp04UCgAAAFQ"]
[Sat Nov 15 03:43:12.952388 2025] [:error] [pid 44438:tid 44519] [client 4.204.56.174:16181] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGUAUQm6jCuPWgJllgsgAAAJU"]
[Sat Nov 15 03:43:13.442938 2025] [:error] [pid 44527:tid 44544] [client 4.204.56.174:16190] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aReGUTZn1ZaBElIfEGIFIAAAAMw"]
[Sat Nov 15 03:43:13.926616 2025] [:error] [pid 44527:tid 44549] [client 4.204.56.174:16278] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aReGUTZn1ZaBElIfEGIFIgAAANE"]
[Sat Nov 15 03:43:14.436105 2025] [:error] [pid 44527:tid 44548] [client 4.204.56.174:16281] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aReGUjZn1ZaBElIfEGIFJQAAANA"]
[Sat Nov 15 03:43:14.873358 2025] [:error] [pid 44436:tid 44456] [client 4.204.56.174:16250] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aReGUjUs0t-jxzSR5ShBEAAAAAw"]
[Sat Nov 15 03:43:15.286938 2025] [:error] [pid 44436:tid 44458] [client 4.204.56.174:16172] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aReGUzUs0t-jxzSR5ShBEQAAAA4"]
[Sat Nov 15 03:43:15.701176 2025] [:error] [pid 44527:tid 44538] [client 4.204.56.174:16192] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aReGUzZn1ZaBElIfEGIFJgAAAMY"]
[Sat Nov 15 03:43:16.120675 2025] [:error] [pid 44438:tid 44517] [client 4.204.56.174:16207] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aReGVAUQm6jCuPWgJllguAAAAJM"]
[Sat Nov 15 03:43:16.548103 2025] [:error] [pid 44436:tid 44451] [client 4.204.56.174:16306] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aReGVDUs0t-jxzSR5ShBFQAAAAc"]
[Sat Nov 15 03:43:16.962770 2025] [:error] [pid 44527:tid 44541] [client 4.204.56.174:16331] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aReGVDZn1ZaBElIfEGIFKQAAAMk"]
[Sat Nov 15 03:43:17.454376 2025] [:error] [pid 44527:tid 44549] [client 4.204.56.174:16226] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aReGVTZn1ZaBElIfEGIFLAAAANE"]
[Sat Nov 15 03:43:17.880384 2025] [:error] [pid 44527:tid 44548] [client 4.204.56.174:16135] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aReGVTZn1ZaBElIfEGIFMAAAANA"]
[Sat Nov 15 03:43:18.307373 2025] [:error] [pid 44436:tid 44464] [client 4.204.56.174:16147] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aReGVjUs0t-jxzSR5ShBGQAAABQ"]
[Sat Nov 15 03:43:18.745257 2025] [:error] [pid 44527:tid 44535] [client 4.204.56.174:16231] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aReGVjZn1ZaBElIfEGIFNQAAAMM"]
[Sat Nov 15 03:43:19.199479 2025] [:error] [pid 44436:tid 44450] [client 4.204.56.174:16070] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aReGVzUs0t-jxzSR5ShBHgAAAAY"]
[Sat Nov 15 03:43:19.619659 2025] [:error] [pid 44436:tid 44457] [client 4.204.56.174:16257] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aReGVzUs0t-jxzSR5ShBIQAAAA0"]
[Sat Nov 15 03:43:20.062136 2025] [:error] [pid 44437:tid 44488] [client 4.204.56.174:16146] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aReGWOrO1g9UNCoZp04UFQAAAFE"]
[Sat Nov 15 03:43:20.493370 2025] [:error] [pid 44436:tid 44448] [client 4.204.56.174:16292] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aReGWDUs0t-jxzSR5ShBJAAAAAQ"]
[Sat Nov 15 03:43:20.912799 2025] [:error] [pid 44527:tid 44535] [client 4.204.56.174:16167] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aReGWDZn1ZaBElIfEGIFPgAAAMM"]
[Sat Nov 15 03:43:21.374601 2025] [:error] [pid 44527:tid 44547] [client 4.204.56.174:16226] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aReGWTZn1ZaBElIfEGIFQgAAAM8"]
[Sat Nov 15 03:43:21.801386 2025] [:error] [pid 44436:tid 44458] [client 4.204.56.174:16251] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aReGWTUs0t-jxzSR5ShBKwAAAA4"]
[Sat Nov 15 03:43:22.249538 2025] [:error] [pid 44527:tid 44540] [client 4.204.56.174:16230] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aReGWjZn1ZaBElIfEGIFRgAAAMg"]
[Sat Nov 15 03:43:22.689251 2025] [:error] [pid 44438:tid 44503] [client 4.204.56.174:16213] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aghbvr.php"] [unique_id "aReGWgUQm6jCuPWgJllgwgAAAIU"]
[Sat Nov 15 03:43:23.114905 2025] [:error] [pid 44527:tid 44553] [client 4.204.56.174:16154] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aghbvr.php"] [unique_id "aReGWzZn1ZaBElIfEGIFSAAAANU"]
[Sat Nov 15 03:43:23.534411 2025] [:error] [pid 44527:tid 44544] [client 4.204.56.174:16230] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aghbvr.php"] [unique_id "aReGWzZn1ZaBElIfEGIFSQAAAMw"]
[Sat Nov 15 03:43:23.956127 2025] [:error] [pid 44438:tid 44506] [client 4.204.56.174:16318] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aghbvr.php"] [unique_id "aReGWwUQm6jCuPWgJllgyAAAAIg"]
[Sat Nov 15 03:43:24.383812 2025] [:error] [pid 44437:tid 44481] [client 4.204.56.174:16225] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGXOrO1g9UNCoZp04UIwAAAEo"]
[Sat Nov 15 03:43:24.806922 2025] [:error] [pid 44438:tid 44501] [client 4.204.56.174:16106] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGXAUQm6jCuPWgJllgywAAAIM"]
[Sat Nov 15 03:43:25.222402 2025] [:error] [pid 44527:tid 44537] [client 4.204.56.174:16188] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGXTZn1ZaBElIfEGIFTgAAAMU"]
[Sat Nov 15 03:43:25.642288 2025] [:error] [pid 44438:tid 44518] [client 4.204.56.174:16139] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miso.php"] [unique_id "aReGXQUQm6jCuPWgJllgzQAAAJQ"]
[Sat Nov 15 03:43:26.060261 2025] [:error] [pid 44436:tid 44450] [client 4.204.56.174:16244] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aReGXjUs0t-jxzSR5ShBNAAAAAY"]
[Sat Nov 15 03:43:26.497564 2025] [:error] [pid 44437:tid 44482] [client 4.204.56.174:16310] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aReGXurO1g9UNCoZp04UJQAAAEs"]
[Sat Nov 15 03:43:26.910830 2025] [:error] [pid 44527:tid 44548] [client 4.204.56.174:16138] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aReGXjZn1ZaBElIfEGIFWgAAANA"]
[Sat Nov 15 03:43:27.324233 2025] [:error] [pid 44436:tid 44455] [client 4.204.56.174:16137] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aReGXzUs0t-jxzSR5ShBNwAAAAs"]
[Sat Nov 15 03:43:27.741635 2025] [:error] [pid 44438:tid 44517] [client 4.204.56.174:16232] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fex.php"] [unique_id "aReGXwUQm6jCuPWgJllg0AAAAJM"]
[Sat Nov 15 03:43:28.156063 2025] [:error] [pid 44437:tid 44494] [client 4.204.56.174:16066] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fex.php"] [unique_id "aReGYOrO1g9UNCoZp04ULAAAAFc"]
[Sat Nov 15 03:43:28.597664 2025] [:error] [pid 44437:tid 44488] [client 4.204.56.174:16128] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fex.php"] [unique_id "aReGYOrO1g9UNCoZp04ULgAAAFE"]
[Sat Nov 15 03:43:29.018101 2025] [:error] [pid 44437:tid 44490] [client 4.204.56.174:16087] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fex.php"] [unique_id "aReGYerO1g9UNCoZp04ULwAAAFM"]
[Sat Nov 15 03:43:29.466350 2025] [:error] [pid 44436:tid 44454] [client 4.204.56.174:16102] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doti.php"] [unique_id "aReGYTUs0t-jxzSR5ShBPgAAAAo"]
[Sat Nov 15 03:43:29.879814 2025] [:error] [pid 44436:tid 44457] [client 4.204.56.174:16227] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doti.php"] [unique_id "aReGYTUs0t-jxzSR5ShBQAAAAA0"]
[Sat Nov 15 03:43:30.293958 2025] [:error] [pid 44527:tid 44544] [client 4.204.56.174:16286] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doti.php"] [unique_id "aReGYjZn1ZaBElIfEGIFYgAAAMw"]
[Sat Nov 15 03:43:30.707242 2025] [:error] [pid 44527:tid 44552] [client 4.204.56.174:16307] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doti.php"] [unique_id "aReGYjZn1ZaBElIfEGIFZAAAANQ"]
[Sat Nov 15 03:43:31.129799 2025] [:error] [pid 44527:tid 44545] [client 4.204.56.174:16284] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aReGYzZn1ZaBElIfEGIFZwAAAM0"]
[Sat Nov 15 03:43:31.546442 2025] [:error] [pid 44437:tid 44471] [client 4.204.56.174:16277] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aReGY-rO1g9UNCoZp04UMwAAAEA"]
[Sat Nov 15 03:43:31.979889 2025] [:error] [pid 44436:tid 44445] [client 4.204.56.174:16110] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aReGYzUs0t-jxzSR5ShBRAAAAAE"]
[Sat Nov 15 03:43:32.397184 2025] [:error] [pid 44436:tid 44463] [client 4.204.56.174:16077] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aReGZDUs0t-jxzSR5ShBRgAAABM"]
[Sat Nov 15 03:43:32.811411 2025] [:error] [pid 44438:tid 44499] [client 4.204.56.174:16183] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aReGZAUQm6jCuPWgJllg2gAAAIE"]
[Sat Nov 15 03:43:33.228416 2025] [:error] [pid 44527:tid 44541] [client 4.204.56.174:16169] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aReGZTZn1ZaBElIfEGIFawAAAMk"]
[Sat Nov 15 03:43:33.673733 2025] [:error] [pid 44436:tid 44468] [client 4.204.56.174:16200] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aReGZTUs0t-jxzSR5ShBSwAAABg"]
[Sat Nov 15 03:43:34.140220 2025] [:error] [pid 44437:tid 44481] [client 4.204.56.174:16165] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aReGZurO1g9UNCoZp04UNgAAAEo"]
[Sat Nov 15 03:43:34.604879 2025] [:error] [pid 44437:tid 44479] [client 4.204.56.174:16382] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aReGZurO1g9UNCoZp04UNwAAAEg"]
[Sat Nov 15 03:43:35.032170 2025] [:error] [pid 44438:tid 44500] [client 4.204.56.174:16235] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aReGZwUQm6jCuPWgJllg3gAAAII"]
[Sat Nov 15 03:43:35.445698 2025] [:error] [pid 44438:tid 44507] [client 4.204.56.174:16127] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aReGZwUQm6jCuPWgJllg3wAAAIk"]
[Sat Nov 15 03:43:35.858965 2025] [:error] [pid 44436:tid 44452] [client 4.204.56.174:16157] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aReGZzUs0t-jxzSR5ShBUwAAAAg"]
[Sat Nov 15 03:43:36.281449 2025] [:error] [pid 44438:tid 44520] [client 4.204.56.174:16160] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aReGaAUQm6jCuPWgJllg4AAAAJY"]
[Sat Nov 15 03:43:36.699417 2025] [:error] [pid 44527:tid 44536] [client 4.204.56.174:16152] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aReGaDZn1ZaBElIfEGIFdQAAAMQ"]
[Sat Nov 15 03:43:37.122925 2025] [:error] [pid 44437:tid 44478] [client 4.204.56.174:16166] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aReGaerO1g9UNCoZp04UPQAAAEc"]
[Sat Nov 15 03:43:37.540919 2025] [:error] [pid 44437:tid 44487] [client 4.204.56.174:16064] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aReGaerO1g9UNCoZp04UPgAAAFA"]
[Sat Nov 15 03:43:37.992046 2025] [:error] [pid 44436:tid 44454] [client 4.204.56.174:16252] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aReGaTUs0t-jxzSR5ShBWQAAAAo"]
[Sat Nov 15 03:43:38.430944 2025] [:error] [pid 44527:tid 44548] [client 4.204.56.174:16239] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aReGajZn1ZaBElIfEGIFfAAAANA"]
[Sat Nov 15 03:43:38.862700 2025] [:error] [pid 44438:tid 44513] [client 4.204.56.174:16216] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aReGagUQm6jCuPWgJllg5QAAAI8"]
[Sat Nov 15 03:43:39.283696 2025] [:error] [pid 44437:tid 44489] [client 4.204.56.174:16151] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aReGa-rO1g9UNCoZp04URAAAAFI"]
[Sat Nov 15 03:43:39.727743 2025] [:error] [pid 44438:tid 44519] [client 4.204.56.174:16134] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aReGawUQm6jCuPWgJllg6gAAAJU"]
[Sat Nov 15 03:43:40.171749 2025] [:error] [pid 44436:tid 44445] [client 4.204.56.174:16162] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aReGbDUs0t-jxzSR5ShBXgAAAAE"]
[Sat Nov 15 03:43:56.593584 2025] [:error] [pid 10386:tid 10405] [client 4.204.56.174:16177] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aReGfNh9QLimDNE-fblbWwAAAAc"]
[Sat Nov 15 03:43:57.016480 2025] [:error] [pid 10387:tid 10428] [client 4.204.56.174:16065] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aReGfRdNOLyrhC55hYO6JAAAAEE"]
[Sat Nov 15 03:43:57.441803 2025] [:error] [pid 10489:tid 10496] [client 4.204.56.174:16221] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aReGfVckOpF1_1u6OZy_2QAAAMI"]
[Sat Nov 15 03:43:57.860232 2025] [:error] [pid 10388:tid 10454] [client 4.204.56.174:16082] [client 4.204.56.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aReGfc5Taslk19icHk5BcAAAAIA"]
[Sat Nov 15 03:43:58.308052 2025] [:error] [pid 10387:tid 10427] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php.php
[Sat Nov 15 03:43:58.551302 2025] [:error] [pid 10387:tid 10430] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Sat Nov 15 03:43:58.762301 2025] [:error] [pid 10387:tid 10433] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Nov 15 03:43:58.982568 2025] [:error] [pid 10387:tid 10435] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Nov 15 03:43:59.193613 2025] [:error] [pid 10387:tid 10436] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Sat Nov 15 03:43:59.405149 2025] [:error] [pid 10387:tid 10438] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/blox.php
[Sat Nov 15 03:43:59.619908 2025] [:error] [pid 10387:tid 10439] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sat Nov 15 03:43:59.835915 2025] [:error] [pid 10387:tid 10440] [client 4.204.56.174:16335] File does not exist: /usr/local/apache/htdocs/suspended-page/gool.php
[Sat Nov 15 06:11:04.003406 2025] [:error] [pid 37318:tid 37379] [client 54.168.208.137:48692] [client 54.168.208.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aReo-OgM1rHoEAqoQDc1JgAAARE"]
[Sat Nov 15 12:09:28.256713 2025] [:error] [pid 20313:tid 20321] [client 138.197.23.42:54278] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRf8-BI9DXIgPadBLUZSSAAAAsU"]
[Sat Nov 15 12:09:28.679393 2025] [:error] [pid 27997:tid 28003] [client 138.197.23.42:52397] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRf8-Npja_6cDxKbxFmOewAAAMQ"]
[Sat Nov 15 12:09:29.096122 2025] [:error] [pid 22765:tid 22778] [client 138.197.23.42:52696] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRf8-abrQzjuZmPIWDafVQAAAog"]
[Sat Nov 15 12:09:29.526862 2025] [:error] [pid 27997:tid 28008] [client 138.197.23.42:52997] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRf8-dpja_6cDxKbxFmOhQAAAMk"]
[Sat Nov 15 12:09:29.949156 2025] [:error] [pid 22613:tid 22639] [client 138.197.23.42:60347] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRf8-SoyR3cDsIRGPRl8uAAAAhg"]
[Sat Nov 15 17:29:06.263163 2025] [:error] [pid 27997:tid 28007] [client 20.2.83.141:59313] [client 20.2.83.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aRhH4tpja_6cDxKbxFnL0QAAAMg"], referer: binance.com
[Sat Nov 15 19:12:08.237437 2025] [:error] [pid 19959:tid 19966] [client 3.110.53.171:60274] [client 3.110.53.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aRhgCMjejiTUP1-IawPiUQAAAYA"]
[Sat Nov 15 19:26:15.686170 2025] [:error] [pid 19959:tid 19971] [client 13.250.182.6:50840] [client 13.250.182.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aRhjV8jejiTUP1-IawPkWAAAAYU"]
[Sat Nov 15 19:46:12.042846 2025] [:error] [pid 22765:tid 22786] [client 13.37.250.113:51798] [client 13.37.250.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aRhoBKbrQzjuZmPIWDb5agAAApA"]
[Sat Nov 15 20:00:28.123167 2025] [:error] [pid 19959:tid 19976] [client 3.39.239.130:37276] [client 3.39.239.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aRhrXMjejiTUP1-IawPpogAAAYo"]
[Sat Nov 15 20:16:40.793868 2025] [:error] [pid 20654:tid 20680] [client 45.138.16.215:59541] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/postnews.php"] [unique_id "aRhvKHcS7eC8vO76_ycGqAAAA5c"]
[Sat Nov 15 20:16:41.349374 2025] [:error] [pid 20654:tid 20658] [client 45.138.16.215:59646] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/postnews.php"] [unique_id "aRhvKXcS7eC8vO76_ycGqwAAA4E"]
[Sat Nov 15 20:16:41.910876 2025] [:error] [pid 19961:tid 20006] [client 45.138.16.215:59753] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "aRhvKTar7Si-84EApVSEagAAAc0"]
[Sun Nov 16 00:08:22.183348 2025] [:error] [pid 20346:tid 20363] [client 136.113.70.3:45840] [client 136.113.70.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aRildp7hsydZdIoVTlt0egAAAw4"]
[Sun Nov 16 06:27:11.500292 2025] [:error] [pid 52563:tid 52582] [client 180.251.182.201:15317] [client 180.251.182.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.251.182.201, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRj-P8-l3ey-hVJ5AusBSAAAANA"]
[Sun Nov 16 06:27:11.505620 2025] [:error] [pid 52563:tid 52582] [client 180.251.182.201:15317] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Nov 17 03:22:59.086762 2025] [:error] [pid 55656:tid 55692] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Mon Nov 17 03:22:59.212421 2025] [:error] [pid 55656:tid 55688] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Mon Nov 17 03:22:59.330737 2025] [:error] [pid 55656:tid 55708] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/efsd.php
[Mon Nov 17 03:22:59.448806 2025] [:error] [pid 55656:tid 55691] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/13ede.php
[Mon Nov 17 03:22:59.600193 2025] [:error] [pid 55656:tid 55706] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Mon Nov 17 03:22:59.732221 2025] [:error] [pid 55656:tid 55686] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/xvent.php
[Mon Nov 17 03:22:59.851093 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Mon Nov 17 03:22:59.975993 2025] [:error] [pid 55656:tid 55702] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Mon Nov 17 03:23:00.127500 2025] [:error] [pid 55656:tid 55693] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/444.php
[Mon Nov 17 03:23:00.323363 2025] [:error] [pid 55656:tid 55689] [client 74.176.64.167:65421] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Mon Nov 17 03:23:00.444721 2025] [:error] [pid 55656:tid 55696] [client 74.176.64.167:65421] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRoklKZDObyEN97tsHB8PgAAAIo"]
[Mon Nov 17 03:23:00.867246 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:65412] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRoklA3NjAS-v6ul5QCcLgAAAM8"]
[Mon Nov 17 03:23:01.151403 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:65420] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRoklYZk0eT801XQsauoJQAAAEQ"]
[Mon Nov 17 03:23:01.807489 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:38855] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRoklSGT_hu1vaVuRSSZAwAAAAc"]
[Mon Nov 17 03:23:02.091110 2025] [:error] [pid 55745:tid 55759] [client 74.176.64.167:65496] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aRokloZk0eT801XQsauoNwAAAEw"]
[Mon Nov 17 03:23:02.439260 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:65417] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aRokloZk0eT801XQsauoPgAAAFE"]
[Mon Nov 17 03:23:02.732974 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:65504] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aRoklg3NjAS-v6ul5QCcMAAAAMo"]
[Mon Nov 17 03:23:03.099876 2025] [:error] [pid 55657:tid 55728] [client 74.176.64.167:65487] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aRoklx2pywrNN427_XRoEAAAAc8"]
[Mon Nov 17 03:23:03.458171 2025] [:error] [pid 55745:tid 55759] [client 74.176.64.167:65519] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aRokl4Zk0eT801XQsauoTgAAAEw"]
[Mon Nov 17 03:23:03.801610 2025] [:error] [pid 65480:tid 333] [client 74.176.64.167:65525] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aRoklw3NjAS-v6ul5QCcMQAAAMs"]
[Mon Nov 17 03:23:04.045701 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:65520] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aRokmCGT_hu1vaVuRSSZDgAAAAw"]
[Mon Nov 17 03:23:04.379480 2025] [:error] [pid 65480:tid 341] [client 74.176.64.167:65493] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aRokmA3NjAS-v6ul5QCcMwAAANA"]
[Mon Nov 17 03:23:04.838364 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:65490] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aRokmA3NjAS-v6ul5QCcNAAAAM0"]
[Mon Nov 17 03:23:05.148309 2025] [:error] [pid 55655:tid 55663] [client 74.176.64.167:65436] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aRokmSGT_hu1vaVuRSSZFAAAAAQ"]
[Mon Nov 17 03:23:05.471004 2025] [:error] [pid 65480:tid 335] [client 74.176.64.167:65479] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aRokmQ3NjAS-v6ul5QCcNwAAAMw"]
[Mon Nov 17 03:23:05.893897 2025] [:error] [pid 55745:tid 55755] [client 74.176.64.167:65472] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aRokmYZk0eT801XQsauoYAAAAEg"]
[Mon Nov 17 03:23:06.196029 2025] [:error] [pid 55656:tid 55714] [client 74.176.64.167:65430] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aRokmqZDObyEN97tsHB8XgAAAJU"]
[Mon Nov 17 03:23:06.512730 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:65492] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aRokmg3NjAS-v6ul5QCcOQAAANQ"]
[Mon Nov 17 03:23:06.936178 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:65509] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aRokmg3NjAS-v6ul5QCcOwAAAMM"]
[Mon Nov 17 03:23:07.392884 2025] [:error] [pid 55745:tid 55765] [client 74.176.64.167:65446] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aRokm4Zk0eT801XQsauoZAAAAFI"]
[Mon Nov 17 03:23:07.711400 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:65443] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aRokmw3NjAS-v6ul5QCcPAAAANE"]
[Mon Nov 17 03:23:08.043591 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:65524] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aRoknCGT_hu1vaVuRSSZHwAAAAc"]
[Mon Nov 17 03:23:08.468667 2025] [:error] [pid 65480:tid 348] [client 74.176.64.167:65413] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aRoknA3NjAS-v6ul5QCcPgAAANY"]
[Mon Nov 17 03:23:09.262617 2025] [:error] [pid 55656:tid 55711] [client 74.176.64.167:65507] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aRoknaZDObyEN97tsHB8YgAAAJQ"]
[Mon Nov 17 03:23:09.758010 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:65460] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aRoknYZk0eT801XQsauoaQAAAFc"]
[Mon Nov 17 03:23:10.290783 2025] [:error] [pid 55745:tid 55750] [client 74.176.64.167:65415] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aRoknoZk0eT801XQsauobAAAAEM"]
[Mon Nov 17 03:23:10.710329 2025] [:error] [pid 55656:tid 55686] [client 74.176.64.167:65437] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aRoknqZDObyEN97tsHB8YwAAAIA"]
[Mon Nov 17 03:23:11.228451 2025] [:error] [pid 65480:tid 350] [client 74.176.64.167:65508] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aRoknw3NjAS-v6ul5QCcQgAAANg"]
[Mon Nov 17 03:23:11.774351 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:65439] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aRokn4Zk0eT801XQsauobwAAAEQ"]
[Mon Nov 17 03:23:12.071584 2025] [:error] [pid 55657:tid 55736] [client 74.176.64.167:65495] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aRokoB2pywrNN427_XRoHgAAAdc"]
[Mon Nov 17 03:23:12.449796 2025] [:error] [pid 55656:tid 55695] [client 74.176.64.167:38880] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aRokoKZDObyEN97tsHB8ZgAAAIk"]
[Mon Nov 17 03:23:12.761767 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:65431] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aRokoCGT_hu1vaVuRSSZJQAAAA4"]
[Mon Nov 17 03:23:13.098129 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:65426] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aRokoQ3NjAS-v6ul5QCcSQAAANU"]
[Mon Nov 17 03:23:13.472559 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:65518] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aRokoSGT_hu1vaVuRSSZJwAAAAE"]
[Mon Nov 17 03:23:13.902302 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:65488] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aRokoSGT_hu1vaVuRSSZKAAAAAc"]
[Mon Nov 17 03:23:14.325462 2025] [:error] [pid 55745:tid 55758] [client 74.176.64.167:65444] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aRokooZk0eT801XQsauofgAAAEs"]
[Mon Nov 17 03:23:14.611302 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:65497] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aRokog3NjAS-v6ul5QCcWQAAAMI"]
[Mon Nov 17 03:23:14.976465 2025] [:error] [pid 55655:tid 55670] [client 74.176.64.167:65477] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aRokoiGT_hu1vaVuRSSZKQAAAAs"]
[Mon Nov 17 03:23:15.469185 2025] [:error] [pid 55657:tid 55728] [client 74.176.64.167:65478] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aRokox2pywrNN427_XRoIAAAAc8"]
[Mon Nov 17 03:23:15.761369 2025] [:error] [pid 65480:tid 350] [client 74.176.64.167:65468] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aRokow3NjAS-v6ul5QCcYQAAANg"]
[Mon Nov 17 03:23:16.118828 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:65516] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aRokpA3NjAS-v6ul5QCcYgAAAM0"]
[Mon Nov 17 03:23:16.440462 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:65506] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aRokpIZk0eT801XQsauohwAAAFE"]
[Mon Nov 17 03:23:16.751450 2025] [:error] [pid 55655:tid 55679] [client 74.176.64.167:65499] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aRokpCGT_hu1vaVuRSSZKwAAABQ"]
[Mon Nov 17 03:23:17.018771 2025] [:error] [pid 55655:tid 55680] [client 74.176.64.167:65520] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ut.php"] [unique_id "aRokpSGT_hu1vaVuRSSZLAAAABU"]
[Mon Nov 17 03:23:17.310193 2025] [:error] [pid 55657:tid 55732] [client 74.176.64.167:38879] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aRokpR2pywrNN427_XRoIwAAAdM"]
[Mon Nov 17 03:23:17.763118 2025] [:error] [pid 55657:tid 55724] [client 74.176.64.167:38853] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aRokpR2pywrNN427_XRoJAAAAcs"]
[Mon Nov 17 03:23:18.357462 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:65434] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aRokpoZk0eT801XQsauojAAAAFc"]
[Mon Nov 17 03:23:18.633366 2025] [:error] [pid 55655:tid 55664] [client 74.176.64.167:38872] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aRokpiGT_hu1vaVuRSSZLgAAAAU"]
[Mon Nov 17 03:23:18.896656 2025] [:error] [pid 55657:tid 55725] [client 74.176.64.167:65512] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aRokph2pywrNN427_XRoJQAAAcw"]
[Mon Nov 17 03:23:19.268386 2025] [:error] [pid 65480:tid 325] [client 74.176.64.167:65428] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aRokpw3NjAS-v6ul5QCcbAAAAMU"]
[Mon Nov 17 03:23:19.819009 2025] [:error] [pid 55656:tid 55706] [client 74.176.64.167:38885] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aRokp6ZDObyEN97tsHB8bwAAAJE"]
[Mon Nov 17 03:23:20.177243 2025] [:error] [pid 55656:tid 55693] [client 74.176.64.167:38888] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aRokqKZDObyEN97tsHB8cAAAAIc"]
[Mon Nov 17 03:23:20.524947 2025] [:error] [pid 55657:tid 55737] [client 74.176.64.167:38909] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "aRokqB2pywrNN427_XRoJwAAAdg"]
[Mon Nov 17 03:23:20.841682 2025] [:error] [pid 55656:tid 55692] [client 74.176.64.167:38873] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "aRokqKZDObyEN97tsHB8cQAAAIY"]
[Mon Nov 17 03:23:21.496989 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:65438] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "aRokqSGT_hu1vaVuRSSZMQAAAA4"]
[Mon Nov 17 03:23:21.897621 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:65513] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "aRokqQ3NjAS-v6ul5QCccQAAAMY"]
[Mon Nov 17 03:23:22.212901 2025] [:error] [pid 55656:tid 55690] [client 74.176.64.167:38884] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aRokqqZDObyEN97tsHB8dAAAAIQ"]
[Mon Nov 17 03:23:22.539073 2025] [:error] [pid 55656:tid 55688] [client 74.176.64.167:65502] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aRokqqZDObyEN97tsHB8dgAAAII"]
[Mon Nov 17 03:23:22.981388 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:65414] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aRokqiGT_hu1vaVuRSSZMgAAAAw"]
[Mon Nov 17 03:23:23.377879 2025] [:error] [pid 65480:tid 343] [client 74.176.64.167:65445] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aRokqw3NjAS-v6ul5QCccgAAANI"]
[Mon Nov 17 03:23:23.685315 2025] [:error] [pid 55656:tid 55706] [client 74.176.64.167:65419] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aRokq6ZDObyEN97tsHB8fAAAAJE"]
[Mon Nov 17 03:23:24.163393 2025] [:error] [pid 55657:tid 55731] [client 74.176.64.167:65483] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aRokrB2pywrNN427_XRoLgAAAdI"]
[Mon Nov 17 03:23:24.564635 2025] [:error] [pid 55655:tid 55665] [client 74.176.64.167:65491] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aRokrCGT_hu1vaVuRSSZNwAAAAY"]
[Mon Nov 17 03:23:24.873494 2025] [:error] [pid 55656:tid 55692] [client 74.176.64.167:65511] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aRokrKZDObyEN97tsHB8fQAAAIY"]
[Mon Nov 17 03:23:25.153964 2025] [:error] [pid 65480:tid 344] [client 74.176.64.167:65435] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aRokrQ3NjAS-v6ul5QCcdAAAANM"]
[Mon Nov 17 03:23:25.577494 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:65498] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aRokrQ3NjAS-v6ul5QCcdQAAAMM"]
[Mon Nov 17 03:23:25.873951 2025] [:error] [pid 65480:tid 338] [client 74.176.64.167:65427] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aRokrQ3NjAS-v6ul5QCcdgAAAM4"]
[Mon Nov 17 03:23:26.159048 2025] [:error] [pid 55655:tid 55659] [client 74.176.64.167:65517] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aRokriGT_hu1vaVuRSSZOQAAAAA"]
[Mon Nov 17 03:23:26.442445 2025] [:error] [pid 55655:tid 55670] [client 74.176.64.167:65501] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aRokriGT_hu1vaVuRSSZOgAAAAs"]
[Mon Nov 17 03:23:26.721367 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:38810] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aRokrqZDObyEN97tsHB8ggAAAIw"]
[Mon Nov 17 03:23:27.149437 2025] [:error] [pid 55655:tid 55681] [client 74.176.64.167:65486] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aRokryGT_hu1vaVuRSSZPAAAABY"]
[Mon Nov 17 03:23:27.428610 2025] [:error] [pid 55745:tid 55754] [client 74.176.64.167:65426] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aRokr4Zk0eT801XQsauolQAAAEc"]
[Mon Nov 17 03:23:27.735410 2025] [:error] [pid 55656:tid 55711] [client 74.176.64.167:65408] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aRokr6ZDObyEN97tsHB8hAAAAJQ"]
[Mon Nov 17 03:23:28.104000 2025] [:error] [pid 65480:tid 349] [client 74.176.64.167:38892] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aRoksA3NjAS-v6ul5QCcfwAAANc"]
[Mon Nov 17 03:23:28.474844 2025] [:error] [pid 55655:tid 55680] [client 74.176.64.167:38856] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aRoksCGT_hu1vaVuRSSZPgAAABU"]
[Mon Nov 17 03:23:28.748003 2025] [:error] [pid 55655:tid 55677] [client 74.176.64.167:65467] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aRoksCGT_hu1vaVuRSSZPwAAABI"]
[Mon Nov 17 03:23:29.041591 2025] [:error] [pid 55657:tid 55727] [client 74.176.64.167:65475] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aRoksR2pywrNN427_XRoMwAAAc4"]
[Mon Nov 17 03:23:29.297346 2025] [:error] [pid 55657:tid 55712] [client 74.176.64.167:38817] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aRoksR2pywrNN427_XRoNAAAAcQ"]
[Mon Nov 17 03:23:29.560828 2025] [:error] [pid 55655:tid 55672] [client 74.176.64.167:65455] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aRoksSGT_hu1vaVuRSSZQQAAAA0"]
[Mon Nov 17 03:23:29.997949 2025] [:error] [pid 65480:tid 329] [client 74.176.64.167:65456] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aRoksQ3NjAS-v6ul5QCcgQAAAMg"]
[Mon Nov 17 03:23:30.364398 2025] [:error] [pid 55655:tid 55678] [client 74.176.64.167:38870] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aRoksiGT_hu1vaVuRSSZQwAAABM"]
[Mon Nov 17 03:23:30.759068 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:65476] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aRoksg3NjAS-v6ul5QCchAAAAMM"]
[Mon Nov 17 03:23:31.124216 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:65423] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aRoksw3NjAS-v6ul5QCchQAAAM0"]
[Mon Nov 17 03:23:31.483187 2025] [:error] [pid 55655:tid 55670] [client 74.176.64.167:65459] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aRoksyGT_hu1vaVuRSSZRgAAAAs"]
[Mon Nov 17 03:23:31.800720 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:65433] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aRoksw3NjAS-v6ul5QCchgAAAMI"]
[Mon Nov 17 03:23:32.075522 2025] [:error] [pid 55655:tid 55662] [client 74.176.64.167:65410] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aRoktCGT_hu1vaVuRSSZSQAAAAM"]
[Mon Nov 17 03:23:32.421847 2025] [:error] [pid 55655:tid 55677] [client 74.176.64.167:38857] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aRoktCGT_hu1vaVuRSSZTAAAABI"]
[Mon Nov 17 03:23:32.720412 2025] [:error] [pid 55656:tid 55687] [client 74.176.64.167:38853] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aRoktKZDObyEN97tsHB8hwAAAIE"]
[Mon Nov 17 03:23:33.265201 2025] [:error] [pid 55745:tid 55758] [client 74.176.64.167:38869] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aRoktYZk0eT801XQsauonAAAAEs"]
[Mon Nov 17 03:23:33.698585 2025] [:error] [pid 65480:tid 349] [client 74.176.64.167:65454] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aRoktQ3NjAS-v6ul5QCciwAAANc"]
[Mon Nov 17 03:23:34.040168 2025] [:error] [pid 55655:tid 55675] [client 74.176.64.167:38849] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aRoktiGT_hu1vaVuRSSZUAAAABA"]
[Mon Nov 17 03:23:34.406275 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:65462] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aRoktiGT_hu1vaVuRSSZUQAAAA4"]
[Mon Nov 17 03:23:34.682909 2025] [:error] [pid 55655:tid 55678] [client 74.176.64.167:38908] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aRoktiGT_hu1vaVuRSSZUgAAABM"]
[Mon Nov 17 03:23:34.992483 2025] [:error] [pid 55655:tid 55663] [client 74.176.64.167:38813] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aRoktiGT_hu1vaVuRSSZUwAAAAQ"]
[Mon Nov 17 03:23:35.317127 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:65458] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aRokt4Zk0eT801XQsauooAAAAFc"]
[Mon Nov 17 03:23:35.593232 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:65505] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aRoktw3NjAS-v6ul5QCckAAAAMI"]
[Mon Nov 17 03:23:35.864297 2025] [:error] [pid 55655:tid 55662] [client 74.176.64.167:38911] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aRoktyGT_hu1vaVuRSSZVQAAAAM"]
[Mon Nov 17 03:23:36.098003 2025] [:error] [pid 55657:tid 55703] [client 74.176.64.167:38793] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aRokuB2pywrNN427_XRoNgAAAcA"]
[Mon Nov 17 03:23:36.372965 2025] [:error] [pid 55656:tid 55708] [client 74.176.64.167:65429] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aRokuKZDObyEN97tsHB8iAAAAJI"]
[Mon Nov 17 03:23:36.749500 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:38874] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aRokuA3NjAS-v6ul5QCckwAAAM8"]
[Mon Nov 17 03:23:37.189840 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:38881] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRokuQ3NjAS-v6ul5QCclQAAAMQ"]
[Mon Nov 17 03:23:37.501837 2025] [:error] [pid 55655:tid 55675] [client 74.176.64.167:38882] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRokuSGT_hu1vaVuRSSZWAAAABA"]
[Mon Nov 17 03:23:37.917957 2025] [:error] [pid 65480:tid 320] [client 74.176.64.167:65424] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRokuQ3NjAS-v6ul5QCclwAAAMA"]
[Mon Nov 17 03:23:38.191884 2025] [:error] [pid 55656:tid 55711] [client 74.176.64.167:38863] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aRokuqZDObyEN97tsHB8igAAAJQ"]
[Mon Nov 17 03:23:38.452452 2025] [:error] [pid 65480:tid 330] [client 74.176.64.167:38895] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aRokug3NjAS-v6ul5QCcmAAAAMk"]
[Mon Nov 17 03:23:38.741518 2025] [:error] [pid 55656:tid 55710] [client 74.176.64.167:65422] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aRokuqZDObyEN97tsHB8jQAAAJM"]
[Mon Nov 17 03:23:39.051252 2025] [:error] [pid 65480:tid 343] [client 74.176.64.167:38830] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aRokuw3NjAS-v6ul5QCcmwAAANI"]
[Mon Nov 17 03:23:39.506668 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:38876] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aRokuw3NjAS-v6ul5QCcnQAAAM0"]
[Mon Nov 17 03:23:39.789728 2025] [:error] [pid 55657:tid 55725] [client 74.176.64.167:65521] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aRokux2pywrNN427_XRoOAAAAcw"]
[Mon Nov 17 03:23:40.128523 2025] [:error] [pid 55657:tid 55719] [client 74.176.64.167:38786] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aRokvB2pywrNN427_XRoOgAAAcg"]
[Mon Nov 17 03:23:42.467651 2025] [:error] [pid 65480:tid 335] [client 74.176.64.167:38770] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aRokvg3NjAS-v6ul5QCcogAAAMw"]
[Mon Nov 17 03:23:43.392175 2025] [:error] [pid 55655:tid 55674] [client 74.176.64.167:38801] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aRokvyGT_hu1vaVuRSSZXQAAAA8"]
[Mon Nov 17 03:23:43.842124 2025] [:error] [pid 65480:tid 329] [client 74.176.64.167:65465] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aRokvw3NjAS-v6ul5QCcpwAAAMg"]
[Mon Nov 17 03:23:44.326123 2025] [:error] [pid 55745:tid 55747] [client 74.176.64.167:38839] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aRokwIZk0eT801XQsauopQAAAEA"]
[Mon Nov 17 03:23:44.632395 2025] [:error] [pid 55656:tid 55694] [client 74.176.64.167:38899] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aRokwKZDObyEN97tsHB8kAAAAIg"]
[Mon Nov 17 03:23:45.014984 2025] [:error] [pid 55656:tid 55704] [client 74.176.64.167:65515] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aRokwaZDObyEN97tsHB8kgAAAJA"]
[Mon Nov 17 03:23:45.325919 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:65482] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRokwaZDObyEN97tsHB8lAAAAIw"]
[Mon Nov 17 03:23:45.687895 2025] [:error] [pid 55656:tid 55708] [client 74.176.64.167:65464] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRokwaZDObyEN97tsHB8lgAAAJI"]
[Mon Nov 17 03:23:46.008855 2025] [:error] [pid 55745:tid 55769] [client 74.176.64.167:65471] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRokwoZk0eT801XQsauoqAAAAFY"]
[Mon Nov 17 03:23:46.303925 2025] [:error] [pid 55657:tid 55719] [client 74.176.64.167:65503] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRokwh2pywrNN427_XRoRwAAAcg"]
[Mon Nov 17 03:23:46.590411 2025] [:error] [pid 55657:tid 55715] [client 74.176.64.167:65500] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aRokwh2pywrNN427_XRoSAAAAcY"]
[Mon Nov 17 03:23:46.893219 2025] [:error] [pid 55745:tid 55760] [client 74.176.64.167:65451] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aRokwoZk0eT801XQsauoqwAAAE0"]
[Mon Nov 17 03:23:47.179247 2025] [:error] [pid 55656:tid 55696] [client 74.176.64.167:38852] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aRokw6ZDObyEN97tsHB8mAAAAIo"]
[Mon Nov 17 03:23:47.426165 2025] [:error] [pid 55656:tid 55716] [client 74.176.64.167:38860] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aRokw6ZDObyEN97tsHB8mgAAAJY"]
[Mon Nov 17 03:23:47.728699 2025] [:error] [pid 55656:tid 55697] [client 74.176.64.167:38883] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aRokw6ZDObyEN97tsHB8nAAAAIs"]
[Mon Nov 17 03:23:48.063171 2025] [:error] [pid 55656:tid 55692] [client 74.176.64.167:38789] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aRokxKZDObyEN97tsHB8ngAAAIY"]
[Mon Nov 17 03:23:48.358677 2025] [:error] [pid 65480:tid 341] [client 74.176.64.167:38815] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aRokxA3NjAS-v6ul5QCcqQAAANA"]
[Mon Nov 17 03:23:48.598694 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:65485] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aRokxIZk0eT801XQsauorgAAAFE"]
[Mon Nov 17 03:23:49.035161 2025] [:error] [pid 55656:tid 55691] [client 74.176.64.167:65441] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRokxaZDObyEN97tsHB8oAAAAIU"]
[Mon Nov 17 03:23:49.364497 2025] [:error] [pid 55656:tid 55702] [client 74.176.64.167:65461] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRokxaZDObyEN97tsHB8ogAAAI8"]
[Mon Nov 17 03:23:49.714279 2025] [:error] [pid 55656:tid 55704] [client 74.176.64.167:38791] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRokxaZDObyEN97tsHB8owAAAJA"]
[Mon Nov 17 03:23:50.002864 2025] [:error] [pid 55745:tid 55765] [client 74.176.64.167:38894] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aRokxoZk0eT801XQsauosAAAAFI"]
[Mon Nov 17 03:23:50.279004 2025] [:error] [pid 55655:tid 55678] [client 74.176.64.167:38797] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aRokxiGT_hu1vaVuRSSZZAAAABM"]
[Mon Nov 17 03:23:50.528271 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:65447] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aRokxg3NjAS-v6ul5QCcqgAAANU"]
[Mon Nov 17 03:23:50.792564 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:38848] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aRokxh2pywrNN427_XRoTQAAAdA"]
[Mon Nov 17 03:23:51.040396 2025] [:error] [pid 55745:tid 55763] [client 74.176.64.167:38887] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aRokx4Zk0eT801XQsauosgAAAFA"]
[Mon Nov 17 03:23:51.356458 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:38814] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aRokx4Zk0eT801XQsauoswAAAEQ"]
[Mon Nov 17 03:23:51.708768 2025] [:error] [pid 55657:tid 55725] [client 74.176.64.167:65523] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aRokxx2pywrNN427_XRoTgAAAcw"]
[Mon Nov 17 03:23:52.121877 2025] [:error] [pid 55657:tid 55719] [client 74.176.64.167:38846] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aRokyB2pywrNN427_XRoUAAAAcg"]
[Mon Nov 17 03:23:52.413682 2025] [:error] [pid 55657:tid 55737] [client 74.176.64.167:65418] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aRokyB2pywrNN427_XRoUQAAAdg"]
[Mon Nov 17 03:23:52.678287 2025] [:error] [pid 55656:tid 55710] [client 74.176.64.167:65432] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aRokyKZDObyEN97tsHB8pQAAAJM"]
[Mon Nov 17 03:23:52.985886 2025] [:error] [pid 55655:tid 55668] [client 74.176.64.167:38824] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aRokyCGT_hu1vaVuRSSZdQAAAAk"]
[Mon Nov 17 03:23:53.502032 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:65450] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aRokyQ3NjAS-v6ul5QCctgAAAMo"]
[Mon Nov 17 03:23:53.782409 2025] [:error] [pid 55657:tid 55727] [client 74.176.64.167:38903] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aRokyR2pywrNN427_XRoUwAAAc4"]
[Mon Nov 17 03:23:54.088619 2025] [:error] [pid 55657:tid 55715] [client 74.176.64.167:65411] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aRokyh2pywrNN427_XRoVAAAAcY"]
[Mon Nov 17 03:23:54.479677 2025] [:error] [pid 55745:tid 55752] [client 74.176.64.167:38851] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aRokyoZk0eT801XQsauoxgAAAEU"]
[Mon Nov 17 03:23:54.896355 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:38758] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aRokyg3NjAS-v6ul5QCcvgAAAMQ"]
[Mon Nov 17 03:23:55.192731 2025] [:error] [pid 55655:tid 55659] [client 74.176.64.167:65484] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aRokyyGT_hu1vaVuRSSZjgAAAAA"]
[Mon Nov 17 03:23:55.478129 2025] [:error] [pid 55657:tid 55709] [client 74.176.64.167:65457] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aRokyx2pywrNN427_XRoVwAAAcM"]
[Mon Nov 17 03:23:55.966116 2025] [:error] [pid 55657:tid 55732] [client 74.176.64.167:38812] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aRokyx2pywrNN427_XRoWAAAAdM"]
[Mon Nov 17 03:23:56.252474 2025] [:error] [pid 55657:tid 55730] [client 74.176.64.167:38898] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aRokzB2pywrNN427_XRoWgAAAdE"]
[Mon Nov 17 03:23:56.533659 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:65527] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aRokzCGT_hu1vaVuRSSZkgAAAAc"]
[Mon Nov 17 03:23:56.935836 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:38859] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aRokzKZDObyEN97tsHB8qAAAAIw"]
[Mon Nov 17 03:23:57.297629 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:65494] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aRokzQ3NjAS-v6ul5QCcwwAAANQ"]
[Mon Nov 17 03:23:57.718297 2025] [:error] [pid 55657:tid 55719] [client 74.176.64.167:38808] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aRokzR2pywrNN427_XRoXQAAAcg"]
[Mon Nov 17 03:23:58.017359 2025] [:error] [pid 55656:tid 55701] [client 74.176.64.167:38792] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aRokzqZDObyEN97tsHB8qgAAAI4"]
[Mon Nov 17 03:23:58.434008 2025] [:error] [pid 55657:tid 55715] [client 74.176.64.167:38905] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aRokzh2pywrNN427_XRoXgAAAcY"]
[Mon Nov 17 03:23:58.732120 2025] [:error] [pid 55656:tid 55687] [client 74.176.64.167:38896] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aRokzqZDObyEN97tsHB8rAAAAIE"]
[Mon Nov 17 03:23:59.245048 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:65409] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aRokzyGT_hu1vaVuRSSZlQAAAA4"]
[Mon Nov 17 03:23:59.632694 2025] [:error] [pid 55657:tid 55726] [client 74.176.64.167:65442] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aRokzx2pywrNN427_XRoYQAAAc0"]
[Mon Nov 17 03:23:59.935423 2025] [:error] [pid 55656:tid 55699] [client 74.176.64.167:65466] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aRokz6ZDObyEN97tsHB8rgAAAI0"]
[Mon Nov 17 03:24:00.480907 2025] [:error] [pid 55745:tid 55767] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Mon Nov 17 03:24:00.600360 2025] [:error] [pid 55745:tid 55756] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Mon Nov 17 03:24:00.727652 2025] [:error] [pid 55745:tid 55753] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Mon Nov 17 03:24:00.848388 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/efile.php
[Mon Nov 17 03:24:01.024480 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/afile.php
[Mon Nov 17 03:24:01.142947 2025] [:error] [pid 55745:tid 55754] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Nov 17 03:24:01.304591 2025] [:error] [pid 55745:tid 55757] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Nov 17 03:24:01.422623 2025] [:error] [pid 55745:tid 55752] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/enclas.php
[Mon Nov 17 03:24:01.540124 2025] [:error] [pid 55745:tid 55769] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Nov 17 03:24:01.797699 2025] [:error] [pid 55745:tid 55748] [client 74.176.64.167:38802] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Nov 17 03:24:01.916238 2025] [:error] [pid 55745:tid 55758] [client 74.176.64.167:38802] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aRok0YZk0eT801XQsauo6QAAAEs"]
[Mon Nov 17 03:24:02.508371 2025] [:error] [pid 55655:tid 55669] [client 74.176.64.167:38902] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aRok0iGT_hu1vaVuRSSZmAAAAAo"]
[Mon Nov 17 03:24:02.879326 2025] [:error] [pid 55655:tid 55676] [client 74.176.64.167:38730] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aRok0iGT_hu1vaVuRSSZmQAAABE"]
[Mon Nov 17 03:24:03.142477 2025] [:error] [pid 55745:tid 55756] [client 74.176.64.167:65526] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aRok04Zk0eT801XQsauo7QAAAEk"]
[Mon Nov 17 03:24:03.582655 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:65416] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRok0yGT_hu1vaVuRSSZnAAAAAw"]
[Mon Nov 17 03:24:03.944572 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:38852] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRok0yGT_hu1vaVuRSSZngAAAAE"]
[Mon Nov 17 03:24:04.291173 2025] [:error] [pid 55655:tid 55674] [client 74.176.64.167:38806] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRok1CGT_hu1vaVuRSSZoAAAAA8"]
[Mon Nov 17 03:24:04.695309 2025] [:error] [pid 55655:tid 55682] [client 74.176.64.167:38761] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRok1CGT_hu1vaVuRSSZpAAAABc"]
[Mon Nov 17 03:24:05.110739 2025] [:error] [pid 55657:tid 55730] [client 74.176.64.167:38809] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aRok1R2pywrNN427_XRoYgAAAdE"]
[Mon Nov 17 03:24:05.370624 2025] [:error] [pid 55745:tid 55763] [client 74.176.64.167:38865] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aRok1YZk0eT801XQsauo7wAAAFA"]
[Mon Nov 17 03:24:05.661371 2025] [:error] [pid 65480:tid 335] [client 74.176.64.167:38800] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aRok1Q3NjAS-v6ul5QCc0gAAAMw"]
[Mon Nov 17 03:24:05.957841 2025] [:error] [pid 55657:tid 55735] [client 74.176.64.167:38850] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aRok1R2pywrNN427_XRoYwAAAdY"]
[Mon Nov 17 03:24:06.279374 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:38726] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aRok1g3NjAS-v6ul5QCc1QAAAMM"]
[Mon Nov 17 03:24:06.600092 2025] [:error] [pid 55745:tid 55748] [client 74.176.64.167:38910] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aRok1oZk0eT801XQsauo8wAAAEE"]
[Mon Nov 17 03:24:06.891985 2025] [:error] [pid 65480:tid 329] [client 74.176.64.167:38854] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aRok1g3NjAS-v6ul5QCc2AAAAMg"]
[Mon Nov 17 03:24:07.316026 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:38834] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aRok1w3NjAS-v6ul5QCc2QAAANE"]
[Mon Nov 17 03:24:07.638436 2025] [:error] [pid 55745:tid 55761] [client 74.176.64.167:38864] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aRok14Zk0eT801XQsauo9QAAAE4"]
[Mon Nov 17 03:24:07.974304 2025] [:error] [pid 55655:tid 55669] [client 74.176.64.167:38727] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aRok1yGT_hu1vaVuRSSZqQAAAAo"]
[Mon Nov 17 03:24:08.364178 2025] [:error] [pid 55656:tid 55693] [client 74.176.64.167:38858] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aRok2KZDObyEN97tsHB8uQAAAIc"]
[Mon Nov 17 03:24:08.736762 2025] [:error] [pid 55655:tid 55659] [client 74.176.64.167:38787] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aRok2CGT_hu1vaVuRSSZqwAAAAA"]
[Mon Nov 17 03:24:09.102998 2025] [:error] [pid 55657:tid 55737] [client 74.176.64.167:38901] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aRok2R2pywrNN427_XRoagAAAdg"]
[Mon Nov 17 03:24:09.515310 2025] [:error] [pid 55656:tid 55690] [client 74.176.64.167:38794] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aRok2aZDObyEN97tsHB8vAAAAIQ"]
[Mon Nov 17 03:24:09.860205 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:38875] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aRok2YZk0eT801XQsauo-QAAAFc"]
[Mon Nov 17 03:24:10.174019 2025] [:error] [pid 55657:tid 55703] [client 74.176.64.167:38890] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aRok2h2pywrNN427_XRobQAAAcA"]
[Mon Nov 17 03:24:10.506749 2025] [:error] [pid 55745:tid 55771] [client 74.176.64.167:38656] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zde.php"] [unique_id "aRok2oZk0eT801XQsauo_AAAAFg"]
[Mon Nov 17 03:24:10.769277 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:38904] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zde.php"] [unique_id "aRok2oZk0eT801XQsauo_gAAAFE"]
[Mon Nov 17 03:24:11.245525 2025] [:error] [pid 55745:tid 55757] [client 74.176.64.167:65463] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zde.php"] [unique_id "aRok24Zk0eT801XQsauo_wAAAEo"]
[Mon Nov 17 03:24:11.632532 2025] [:error] [pid 55656:tid 55698] [client 74.176.64.167:65449] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zde.php"] [unique_id "aRok26ZDObyEN97tsHB8wAAAAIw"]
[Mon Nov 17 03:24:12.390791 2025] [:error] [pid 55656:tid 55686] [client 74.176.64.167:65481] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aRok3KZDObyEN97tsHB8wwAAAIA"]
[Mon Nov 17 03:24:12.797364 2025] [:error] [pid 55655:tid 55667] [client 74.176.64.167:38866] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aRok3CGT_hu1vaVuRSSZrQAAAAg"]
[Mon Nov 17 03:24:13.185651 2025] [:error] [pid 55745:tid 55762] [client 74.176.64.167:65514] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aRok3YZk0eT801XQsaupAwAAAE8"]
[Mon Nov 17 03:24:13.585258 2025] [:error] [pid 55745:tid 55765] [client 74.176.64.167:38841] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aRok3YZk0eT801XQsaupBAAAAFI"]
[Mon Nov 17 03:24:13.948114 2025] [:error] [pid 65480:tid 345] [client 74.176.64.167:65473] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aRok3Q3NjAS-v6ul5QCc5gAAANQ"]
[Mon Nov 17 03:24:14.344198 2025] [:error] [pid 55745:tid 55750] [client 74.176.64.167:38862] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aRok3oZk0eT801XQsaupBwAAAEM"]
[Mon Nov 17 03:24:14.676021 2025] [:error] [pid 55657:tid 55736] [client 74.176.64.167:65480] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aRok3h2pywrNN427_XRobwAAAdc"]
[Mon Nov 17 03:24:15.178160 2025] [:error] [pid 55657:tid 55735] [client 74.176.64.167:38804] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aRok3x2pywrNN427_XRocAAAAdY"]
[Mon Nov 17 03:24:15.457482 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:38784] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aRok3w3NjAS-v6ul5QCc6AAAAMM"]
[Mon Nov 17 03:24:15.839261 2025] [:error] [pid 55657:tid 55737] [client 74.176.64.167:65425] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aRok3x2pywrNN427_XRocwAAAdg"]
[Mon Nov 17 03:24:16.491624 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:65522] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aRok4CGT_hu1vaVuRSSZsgAAAA4"]
[Mon Nov 17 03:24:16.909440 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:38805] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aRok4IZk0eT801XQsaupCgAAAEQ"]
[Mon Nov 17 03:24:17.184768 2025] [:error] [pid 55656:tid 55708] [client 74.176.64.167:38826] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "aRok4aZDObyEN97tsHB8zgAAAJI"]
[Mon Nov 17 03:24:17.597184 2025] [:error] [pid 55657:tid 55728] [client 74.176.64.167:65426] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "aRok4R2pywrNN427_XRodQAAAc8"]
[Mon Nov 17 03:24:17.967711 2025] [:error] [pid 55656:tid 55711] [client 74.176.64.167:38790] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "aRok4aZDObyEN97tsHB80QAAAJQ"]
[Mon Nov 17 03:24:18.318998 2025] [:error] [pid 55657:tid 55703] [client 74.176.64.167:38833] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "aRok4h2pywrNN427_XRodgAAAcA"]
[Mon Nov 17 03:24:18.634212 2025] [:error] [pid 55657:tid 55733] [client 74.176.64.167:38839] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "aRok4h2pywrNN427_XRoeAAAAdQ"]
[Mon Nov 17 03:24:18.940144 2025] [:error] [pid 55655:tid 55668] [client 74.176.64.167:38835] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "aRok4iGT_hu1vaVuRSSZtwAAAAk"]
[Mon Nov 17 03:24:19.375325 2025] [:error] [pid 55656:tid 55697] [client 74.176.64.167:65515] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "aRok46ZDObyEN97tsHB81QAAAIs"]
[Mon Nov 17 03:24:19.678420 2025] [:error] [pid 55655:tid 55675] [client 74.176.64.167:38776] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "aRok4yGT_hu1vaVuRSSZugAAABA"]
[Mon Nov 17 03:24:20.001677 2025] [:error] [pid 55657:tid 55709] [client 74.176.64.167:38733] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRok5B2pywrNN427_XRoegAAAcM"]
[Mon Nov 17 03:24:20.422688 2025] [:error] [pid 55656:tid 55706] [client 74.176.64.167:65471] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRok5KZDObyEN97tsHB82QAAAJE"]
[Mon Nov 17 03:24:20.793802 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:38803] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRok5CGT_hu1vaVuRSSZvgAAAAw"]
[Mon Nov 17 03:24:21.104884 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:38821] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aRok5SGT_hu1vaVuRSSZwAAAAA4"]
[Mon Nov 17 03:24:21.415207 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:38837] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aRok5SGT_hu1vaVuRSSZwQAAAAE"]
[Mon Nov 17 03:24:21.706741 2025] [:error] [pid 55657:tid 55730] [client 74.176.64.167:38732] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aRok5R2pywrNN427_XRofQAAAdE"]
[Mon Nov 17 03:24:22.034980 2025] [:error] [pid 55655:tid 55680] [client 74.176.64.167:38836] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aRok5iGT_hu1vaVuRSSZwgAAABU"]
[Mon Nov 17 03:24:22.480449 2025] [:error] [pid 55657:tid 55720] [client 74.176.64.167:38868] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aRok5h2pywrNN427_XRofwAAAck"]
[Mon Nov 17 03:24:22.763356 2025] [:error] [pid 55655:tid 55666] [client 74.176.64.167:38751] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aRok5iGT_hu1vaVuRSSZxAAAAAc"]
[Mon Nov 17 03:24:23.375748 2025] [:error] [pid 55745:tid 55760] [client 74.176.64.167:38893] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aRok54Zk0eT801XQsaupDQAAAE0"]
[Mon Nov 17 03:24:23.958677 2025] [:error] [pid 55745:tid 55766] [client 74.176.64.167:38788] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aRok54Zk0eT801XQsaupDwAAAFM"]
[Mon Nov 17 03:24:24.235626 2025] [:error] [pid 55657:tid 55722] [client 74.176.64.167:38723] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aRok6B2pywrNN427_XRogwAAAco"]
[Mon Nov 17 03:24:24.633297 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:38795] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aRok6A3NjAS-v6ul5QCc8AAAANE"]
[Mon Nov 17 03:24:25.015640 2025] [:error] [pid 65480:tid 348] [client 74.176.64.167:65469] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aRok6Q3NjAS-v6ul5QCc8gAAANY"]
[Mon Nov 17 03:24:25.335736 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:38811] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aRok6SGT_hu1vaVuRSSZzQAAAAE"]
[Mon Nov 17 03:24:25.673170 2025] [:error] [pid 55657:tid 55736] [client 74.176.64.167:38891] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aRok6R2pywrNN427_XRoiAAAAdc"]
[Mon Nov 17 03:24:25.980216 2025] [:error] [pid 65480:tid 339] [client 74.176.64.167:38746] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aRok6Q3NjAS-v6ul5QCc9AAAAM8"]
[Mon Nov 17 03:24:26.297537 2025] [:error] [pid 55657:tid 55724] [client 74.176.64.167:38897] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aRok6h2pywrNN427_XRoiQAAAcs"]
[Mon Nov 17 03:24:27.013514 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:38886] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aRok64Zk0eT801XQsaupEgAAAEQ"]
[Mon Nov 17 03:24:27.313233 2025] [:error] [pid 55745:tid 55756] [client 74.176.64.167:38842] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aRok64Zk0eT801XQsaupEwAAAEk"]
[Mon Nov 17 03:24:27.629268 2025] [:error] [pid 55655:tid 55659] [client 74.176.64.167:65453] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aRok6yGT_hu1vaVuRSSZ3QAAAAA"]
[Mon Nov 17 03:24:27.870591 2025] [:error] [pid 55655:tid 55683] [client 74.176.64.167:38907] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aRok6yGT_hu1vaVuRSSZ4AAAABg"]
[Mon Nov 17 03:24:28.350314 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:38832] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aRok7A3NjAS-v6ul5QCc_QAAAMI"]
[Mon Nov 17 03:24:28.753947 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:38779] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aRok7A3NjAS-v6ul5QCc_gAAAM0"]
[Mon Nov 17 03:24:29.050498 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:38742] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRok7Q3NjAS-v6ul5QCc_wAAAMM"]
[Mon Nov 17 03:24:29.368043 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:38743] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRok7SGT_hu1vaVuRSSZ7wAAAAw"]
[Mon Nov 17 03:24:29.775502 2025] [:error] [pid 65480:tid 333] [client 74.176.64.167:38877] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRok7Q3NjAS-v6ul5QCdAQAAAMs"]
[Mon Nov 17 03:24:30.046899 2025] [:error] [pid 55745:tid 55768] [client 74.176.64.167:38774] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRok7oZk0eT801XQsaupFgAAAFU"]
[Mon Nov 17 03:24:30.464609 2025] [:error] [pid 55655:tid 55682] [client 74.176.64.167:38843] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "aRok7iGT_hu1vaVuRSSZ8wAAABc"]
[Mon Nov 17 03:24:31.001343 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:38745] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "aRok7w3NjAS-v6ul5QCdBgAAAMY"]
[Mon Nov 17 03:24:31.297886 2025] [:error] [pid 65480:tid 320] [client 74.176.64.167:65510] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "aRok7w3NjAS-v6ul5QCdCQAAAMA"]
[Mon Nov 17 03:24:31.576456 2025] [:error] [pid 65480:tid 329] [client 74.176.64.167:65474] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "aRok7w3NjAS-v6ul5QCdDAAAAMg"]
[Mon Nov 17 03:24:31.867134 2025] [:error] [pid 55655:tid 55663] [client 74.176.64.167:38816] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "aRok7yGT_hu1vaVuRSSZ_AAAAAQ"]
[Mon Nov 17 03:24:32.157559 2025] [:error] [pid 55656:tid 55688] [client 74.176.64.167:65514] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "aRok8KZDObyEN97tsHB86QAAAII"]
[Mon Nov 17 03:24:32.437402 2025] [:error] [pid 55657:tid 55705] [client 74.176.64.167:38729] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "aRok8B2pywrNN427_XRokAAAAcE"]
[Mon Nov 17 03:24:32.704489 2025] [:error] [pid 55656:tid 55691] [client 74.176.64.167:38781] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "aRok8KZDObyEN97tsHB86gAAAIU"]
[Mon Nov 17 03:24:32.982036 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:38735] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aRok8B2pywrNN427_XRokQAAAdA"]
[Mon Nov 17 03:24:33.267774 2025] [:error] [pid 55655:tid 55683] [client 74.176.64.167:38722] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aRok8SGT_hu1vaVuRSSaAgAAABg"]
[Mon Nov 17 03:24:33.614914 2025] [:error] [pid 55745:tid 55761] [client 74.176.64.167:38698] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aRok8YZk0eT801XQsaupGwAAAE4"]
[Mon Nov 17 03:24:34.011095 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:38740] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aRok8oZk0eT801XQsaupHgAAAEQ"]
[Mon Nov 17 03:24:34.350971 2025] [:error] [pid 55745:tid 55764] [client 74.176.64.167:38822] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aRok8oZk0eT801XQsaupIwAAAFE"]
[Mon Nov 17 03:24:34.705926 2025] [:error] [pid 55657:tid 55722] [client 74.176.64.167:38771] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aRok8h2pywrNN427_XRokwAAAco"]
[Mon Nov 17 03:24:35.129735 2025] [:error] [pid 65480:tid 328] [client 74.176.64.167:38820] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aRok8w3NjAS-v6ul5QCdEwAAAMc"]
[Mon Nov 17 03:24:35.498382 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:38689] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aRok8w3NjAS-v6ul5QCdFQAAAMI"]
[Mon Nov 17 03:24:35.844443 2025] [:error] [pid 65480:tid 341] [client 74.176.64.167:38906] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRok8w3NjAS-v6ul5QCdFwAAANA"]
[Mon Nov 17 03:24:36.195425 2025] [:error] [pid 55657:tid 55712] [client 74.176.64.167:38900] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRok9B2pywrNN427_XRolwAAAcQ"]
[Mon Nov 17 03:24:36.538689 2025] [:error] [pid 65480:tid 326] [client 74.176.64.167:38721] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRok9A3NjAS-v6ul5QCdGwAAAMY"]
[Mon Nov 17 03:24:36.837355 2025] [:error] [pid 65480:tid 349] [client 74.176.64.167:38889] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aRok9A3NjAS-v6ul5QCdHAAAANc"]
[Mon Nov 17 03:24:37.202209 2025] [:error] [pid 55656:tid 55710] [client 74.176.64.167:38782] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "aRok9aZDObyEN97tsHB9AQAAAJM"]
[Mon Nov 17 03:24:37.518564 2025] [:error] [pid 55657:tid 55732] [client 74.176.64.167:38734] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "aRok9R2pywrNN427_XRomQAAAdM"]
[Mon Nov 17 03:24:37.782514 2025] [:error] [pid 65480:tid 325] [client 74.176.64.167:38720] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "aRok9Q3NjAS-v6ul5QCdIwAAAMU"]
[Mon Nov 17 03:24:38.092565 2025] [:error] [pid 55657:tid 55725] [client 74.176.64.167:38695] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "aRok9h2pywrNN427_XRomwAAAcw"]
[Mon Nov 17 03:24:38.351518 2025] [:error] [pid 55657:tid 55719] [client 74.176.64.167:38665] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aRok9h2pywrNN427_XRongAAAcg"]
[Mon Nov 17 03:24:38.719400 2025] [:error] [pid 55655:tid 55670] [client 74.176.64.167:38658] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aRok9iGT_hu1vaVuRSSaJQAAAAs"]
[Mon Nov 17 03:24:39.062428 2025] [:error] [pid 55657:tid 55720] [client 74.176.64.167:38702] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aRok9x2pywrNN427_XRooAAAAck"]
[Mon Nov 17 03:24:39.378441 2025] [:error] [pid 55657:tid 55729] [client 74.176.64.167:38847] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aRok9x2pywrNN427_XRoogAAAdA"]
[Mon Nov 17 03:24:39.649852 2025] [:error] [pid 55657:tid 55722] [client 74.176.64.167:38747] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aRok9x2pywrNN427_XRopAAAAco"]
[Mon Nov 17 03:24:39.930963 2025] [:error] [pid 65480:tid 322] [client 74.176.64.167:38754] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aRok9w3NjAS-v6ul5QCdJQAAAMI"]
[Mon Nov 17 03:24:40.313876 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:38755] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aRok-A3NjAS-v6ul5QCdJwAAANU"]
[Mon Nov 17 03:24:40.593208 2025] [:error] [pid 65480:tid 348] [client 74.176.64.167:38867] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aRok-A3NjAS-v6ul5QCdKQAAANY"]
[Mon Nov 17 03:24:40.904858 2025] [:error] [pid 55656:tid 55689] [client 74.176.64.167:38751] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aRok-KZDObyEN97tsHB9BQAAAIM"]
[Mon Nov 17 03:24:41.187323 2025] [:error] [pid 55656:tid 55718] [client 74.176.64.167:38660] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aRok-aZDObyEN97tsHB9BgAAAJc"]
[Mon Nov 17 03:24:41.436643 2025] [:error] [pid 55745:tid 55769] [client 74.176.64.167:38675] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aRok-YZk0eT801XQsaupSwAAAFY"]
[Mon Nov 17 03:24:41.754129 2025] [:error] [pid 65480:tid 343] [client 74.176.64.167:38670] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aRok-Q3NjAS-v6ul5QCdLwAAANI"]
[Mon Nov 17 03:24:42.180857 2025] [:error] [pid 65480:tid 344] [client 74.176.64.167:65470] [client 74.176.64.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aRok-g3NjAS-v6ul5QCdMAAAANM"]
[Mon Nov 17 03:24:42.504568 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:38829] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aRok-g3NjAS-v6ul5QCdMgAAANU"]
[Mon Nov 17 03:24:42.836898 2025] [:error] [pid 55745:tid 55758] [client 74.176.64.167:38894] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aRok-oZk0eT801XQsaupTgAAAEs"]
[Mon Nov 17 03:24:43.114200 2025] [:error] [pid 55745:tid 55770] [client 74.176.64.167:38799] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aRok-4Zk0eT801XQsaupUAAAAFc"]
[Mon Nov 17 03:24:43.579362 2025] [:error] [pid 55655:tid 55671] [client 74.176.64.167:38685] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aRok-yGT_hu1vaVuRSSaKwAAAAw"]
[Mon Nov 17 03:24:43.907613 2025] [:error] [pid 55656:tid 55699] [client 74.176.64.167:38724] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aRok-6ZDObyEN97tsHB9CgAAAI0"]
[Mon Nov 17 03:24:44.235618 2025] [:error] [pid 55655:tid 55665] [client 74.176.64.167:38738] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aRok_CGT_hu1vaVuRSSaLAAAAAY"]
[Mon Nov 17 03:24:44.506239 2025] [:error] [pid 55745:tid 55771] [client 74.176.64.167:38662] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aRok_IZk0eT801XQsaupVAAAAFg"]
[Mon Nov 17 03:24:44.771901 2025] [:error] [pid 55655:tid 55668] [client 74.176.64.167:38694] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRok_CGT_hu1vaVuRSSaLwAAAAk"]
[Mon Nov 17 03:24:45.127041 2025] [:error] [pid 55745:tid 55763] [client 74.176.64.167:38844] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRok_YZk0eT801XQsaupVQAAAFA"]
[Mon Nov 17 03:24:45.441077 2025] [:error] [pid 55657:tid 55735] [client 74.176.64.167:38600] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRok_R2pywrNN427_XRopgAAAdY"]
[Mon Nov 17 03:24:45.747075 2025] [:error] [pid 55655:tid 55661] [client 74.176.64.167:38706] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aRok_SGT_hu1vaVuRSSaMgAAAAI"]
[Mon Nov 17 03:24:46.273048 2025] [:error] [pid 55745:tid 55760] [client 74.176.64.167:38827] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aRok_oZk0eT801XQsaupWgAAAE0"]
[Mon Nov 17 03:24:46.642665 2025] [:error] [pid 55656:tid 55686] [client 74.176.64.167:38838] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aRok_qZDObyEN97tsHB9DwAAAIA"]
[Mon Nov 17 03:24:46.922558 2025] [:error] [pid 55655:tid 55681] [client 74.176.64.167:38828] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aRok_iGT_hu1vaVuRSSaNwAAABY"]
[Mon Nov 17 03:24:47.317545 2025] [:error] [pid 55745:tid 55751] [client 74.176.64.167:38657] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aRok_4Zk0eT801XQsaupXgAAAEQ"]
[Mon Nov 17 03:24:47.784103 2025] [:error] [pid 55745:tid 55747] [client 74.176.64.167:38798] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aRok_4Zk0eT801XQsaupYAAAAEA"]
[Mon Nov 17 03:24:48.160574 2025] [:error] [pid 55656:tid 55721] [client 74.176.64.167:38819] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aRolAKZDObyEN97tsHB9EQAAAJg"]
[Mon Nov 17 03:24:48.671027 2025] [:error] [pid 55655:tid 55678] [client 74.176.64.167:38725] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aRolACGT_hu1vaVuRSSaOgAAABM"]
[Mon Nov 17 03:24:49.382502 2025] [:error] [pid 55657:tid 55717] [client 74.176.64.167:38684] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aRolAR2pywrNN427_XRoqAAAAcc"]
[Mon Nov 17 03:24:49.798263 2025] [:error] [pid 55745:tid 55769] [client 74.176.64.167:65452] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aRolAYZk0eT801XQsaupagAAAFY"]
[Mon Nov 17 03:24:50.099333 2025] [:error] [pid 65480:tid 336] [client 74.176.64.167:38700] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aRolAg3NjAS-v6ul5QCdPAAAAM0"]
[Mon Nov 17 03:24:50.618596 2025] [:error] [pid 65480:tid 324] [client 74.176.64.167:38673] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aRolAg3NjAS-v6ul5QCdSwAAAMQ"]
[Mon Nov 17 03:24:51.287917 2025] [:error] [pid 65480:tid 325] [client 74.176.64.167:38714] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aRolAw3NjAS-v6ul5QCdXAAAAMU"]
[Mon Nov 17 03:24:51.635887 2025] [:error] [pid 55655:tid 55675] [client 74.176.64.167:38741] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aRolAyGT_hu1vaVuRSSaQAAAABA"]
[Mon Nov 17 03:24:52.186214 2025] [:error] [pid 55656:tid 55688] [client 74.176.64.167:38831] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aRolBKZDObyEN97tsHB9GAAAAII"]
[Mon Nov 17 03:24:52.641770 2025] [:error] [pid 65480:tid 342] [client 74.176.64.167:38818] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aRolBA3NjAS-v6ul5QCdXwAAANE"]
[Mon Nov 17 03:24:52.914858 2025] [:error] [pid 65480:tid 349] [client 74.176.64.167:38661] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aRolBA3NjAS-v6ul5QCdYQAAANc"]
[Mon Nov 17 03:24:53.457374 2025] [:error] [pid 65480:tid 344] [client 74.176.64.167:38780] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avaa.php"] [unique_id "aRolBQ3NjAS-v6ul5QCdYwAAANM"]
[Mon Nov 17 03:24:54.251063 2025] [:error] [pid 65480:tid 346] [client 74.176.64.167:38712] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avaa.php"] [unique_id "aRolBg3NjAS-v6ul5QCdZQAAANU"]
[Mon Nov 17 03:24:54.844956 2025] [:error] [pid 65480:tid 321] [client 74.176.64.167:38785] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avaa.php"] [unique_id "aRolBg3NjAS-v6ul5QCdZwAAAME"]
[Mon Nov 17 03:24:55.096644 2025] [:error] [pid 55655:tid 55665] [client 74.176.64.167:38710] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avaa.php"] [unique_id "aRolByGT_hu1vaVuRSSaRQAAAAY"]
[Mon Nov 17 03:24:55.434953 2025] [:error] [pid 55655:tid 55660] [client 74.176.64.167:38679] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aRolByGT_hu1vaVuRSSaSQAAAAE"]
[Mon Nov 17 03:24:55.867163 2025] [:error] [pid 65480:tid 323] [client 74.176.64.167:38669] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aRolBw3NjAS-v6ul5QCdagAAAMM"]
[Mon Nov 17 03:24:56.436118 2025] [:error] [pid 55745:tid 55768] [client 74.176.64.167:38766] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aRolCIZk0eT801XQsaupggAAAFU"]
[Mon Nov 17 03:24:57.057091 2025] [:error] [pid 55745:tid 55766] [client 74.176.64.167:38845] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aRolCYZk0eT801XQsaupiAAAAFM"]
[Mon Nov 17 03:24:57.510969 2025] [:error] [pid 55655:tid 55673] [client 74.176.64.167:38699] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aRolCSGT_hu1vaVuRSSaUQAAAA4"]
[Mon Nov 17 03:24:58.018343 2025] [:error] [pid 55745:tid 55763] [client 74.176.64.167:38807] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aRolCoZk0eT801XQsaupkQAAAFA"]
[Mon Nov 17 03:24:58.891937 2025] [:error] [pid 55656:tid 55687] [client 74.176.64.167:38709] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aRolCqZDObyEN97tsHB9HQAAAIE"]
[Mon Nov 17 03:24:59.732815 2025] [:error] [pid 55657:tid 55720] [client 74.176.64.167:38705] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aRolCx2pywrNN427_XRosQAAAck"]
[Mon Nov 17 03:25:00.699090 2025] [:error] [pid 65480:tid 332] [client 74.176.64.167:38750] [client 74.176.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aRolDA3NjAS-v6ul5QCdkQAAAMo"]
[Mon Nov 17 03:25:01.385918 2025] [:error] [pid 55656:tid 55697] [client 74.176.64.167:38753] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Mon Nov 17 03:25:01.513516 2025] [:error] [pid 55656:tid 55711] [client 74.176.64.167:38753] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Mon Nov 17 03:25:01.632130 2025] [:error] [pid 55656:tid 55704] [client 74.176.64.167:38753] File does not exist: /usr/local/apache/htdocs/suspended-page/i1.php
[Mon Nov 17 03:25:01.752376 2025] [:error] [pid 55656:tid 55714] [client 74.176.64.167:38753] File does not exist: /usr/local/apache/htdocs/suspended-page/thai.php
[Mon Nov 17 04:05:28.251813 2025] [:error] [pid 59789:tid 59826] [client 93.141.223.45:53672] [client 93.141.223.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.141.223.45, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aRouiOR6V8BPUsc_OOvGYgAAABc"]
[Mon Nov 17 04:05:28.261441 2025] [:error] [pid 59789:tid 59826] [client 93.141.223.45:53672] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Nov 17 05:47:09.871494 2025] [:error] [pid 39537:tid 39543] [client 34.244.175.134:53370] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.tmp"] [unique_id "aRpGXYZRrh1pcrdcLB_iaAAAAMM"]
[Mon Nov 17 05:47:09.892039 2025] [:error] [pid 39537:tid 39547] [client 34.244.175.134:53466] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aRpGXYZRrh1pcrdcLB_iaQAAAMc"]
[Mon Nov 17 05:47:09.904374 2025] [:error] [pid 39449:tid 39472] [client 34.244.175.134:53474] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.orig"] [unique_id "aRpGXaUCymTA3MDfzLOSYwAAABI"]
[Mon Nov 17 05:47:09.919221 2025] [:error] [pid 39537:tid 39553] [client 34.244.175.134:53386] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aRpGXYZRrh1pcrdcLB_iagAAAM0"]
[Mon Nov 17 05:47:09.930569 2025] [:error] [pid 39451:tid 39524] [client 34.244.175.134:53490] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aRpGXefgkqXTS0SO3fBtfQAAAJA"]
[Mon Nov 17 05:47:09.934592 2025] [:error] [pid 39537:tid 39563] [client 34.244.175.134:53494] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev"] [unique_id "aRpGXYZRrh1pcrdcLB_iawAAANc"]
[Mon Nov 17 05:47:09.945155 2025] [:error] [pid 39537:tid 39545] [client 34.244.175.134:53482] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aRpGXYZRrh1pcrdcLB_ibAAAAMU"]
[Mon Nov 17 05:47:09.959688 2025] [:error] [pid 39449:tid 39462] [client 34.244.175.134:53410] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.swp"] [unique_id "aRpGXaUCymTA3MDfzLOSZAAAAAg"]
[Mon Nov 17 05:47:09.977055 2025] [:error] [pid 40548:tid 40570] [client 34.244.175.134:53434] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "aRpGXQM_PykfYnxh-j-xzQAAARQ"]
[Mon Nov 17 05:47:09.977321 2025] [:error] [pid 39537:tid 39552] [client 34.244.175.134:53374] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.prod"] [unique_id "aRpGXYZRrh1pcrdcLB_ibQAAAMw"]
[Mon Nov 17 05:47:09.978956 2025] [:error] [pid 39537:tid 39562] [client 34.244.175.134:53422] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aRpGXYZRrh1pcrdcLB_ibgAAANY"]
[Mon Nov 17 05:47:09.979050 2025] [:error] [pid 39537:tid 39554] [client 34.244.175.134:53400] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env~"] [unique_id "aRpGXYZRrh1pcrdcLB_ibwAAAM4"]
[Mon Nov 17 05:47:09.983939 2025] [:error] [pid 39537:tid 39556] [client 34.244.175.134:53510] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.sample"] [unique_id "aRpGXYZRrh1pcrdcLB_icAAAANA"]
[Mon Nov 17 05:47:10.015690 2025] [:error] [pid 39537:tid 39550] [client 34.244.175.134:53450] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aRpGXoZRrh1pcrdcLB_icQAAAMo"]
[Mon Nov 17 05:47:10.028225 2025] [:error] [pid 39450:tid 39487] [client 34.244.175.134:53534] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aRpGXuoZqPB4_7vNEDSY0wAAAEY"]
[Mon Nov 17 05:47:10.039463 2025] [:error] [pid 39537:tid 39544] [client 34.244.175.134:53518] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aRpGXoZRrh1pcrdcLB_icgAAAMQ"]
[Mon Nov 17 05:47:10.070398 2025] [:error] [pid 40548:tid 40573] [client 34.244.175.134:53550] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dist"] [unique_id "aRpGXgM_PykfYnxh-j-xzgAAARc"]
[Mon Nov 17 05:47:10.088858 2025] [:error] [pid 39537:tid 39560] [client 34.244.175.134:53506] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aRpGXoZRrh1pcrdcLB_icwAAANQ"]
[Mon Nov 17 05:47:18.584392 2025] [:error] [pid 39450:tid 39499] [client 34.244.175.134:49458] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.old"] [unique_id "aRpGZuoZqPB4_7vNEDSY4gAAAFI"]
[Mon Nov 17 05:47:18.611791 2025] [:error] [pid 39449:tid 39473] [client 34.244.175.134:49462] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env"] [unique_id "aRpGZqUCymTA3MDfzLOSbQAAABM"]
[Mon Nov 17 05:47:18.695972 2025] [:error] [pid 39450:tid 39498] [client 34.244.175.134:49444] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.bak"] [unique_id "aRpGZuoZqPB4_7vNEDSY4wAAAFE"]
[Mon Nov 17 05:47:18.722497 2025] [:error] [pid 39451:tid 39520] [client 34.244.175.134:49478] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.save"] [unique_id "aRpGZufgkqXTS0SO3fBtjQAAAIw"]
[Mon Nov 17 05:47:33.517130 2025] [:error] [pid 39537:tid 39560] [client 34.244.175.134:56950] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aRpGdYZRrh1pcrdcLB_ioAAAANQ"]
[Mon Nov 17 05:47:33.530308 2025] [:error] [pid 40548:tid 40566] [client 34.244.175.134:56928] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "aRpGdQM_PykfYnxh-j-x8QAAARA"]
[Mon Nov 17 05:47:33.534644 2025] [:error] [pid 39537:tid 39544] [client 34.244.175.134:56906] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.save"] [unique_id "aRpGdYZRrh1pcrdcLB_ioQAAAMQ"]
[Mon Nov 17 05:47:33.580973 2025] [:error] [pid 39537:tid 39555] [client 34.244.175.134:56914] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.save"] [unique_id "aRpGdYZRrh1pcrdcLB_iogAAAM8"]
[Mon Nov 17 05:47:33.592456 2025] [:error] [pid 40548:tid 40553] [client 34.244.175.134:56938] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.bak"] [unique_id "aRpGdQM_PykfYnxh-j-x8gAAAQM"]
[Mon Nov 17 05:47:33.593262 2025] [:error] [pid 39450:tid 39503] [client 34.244.175.134:56988] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env"] [unique_id "aRpGdeoZqPB4_7vNEDSY8QAAAFY"]
[Mon Nov 17 05:47:33.615822 2025] [:error] [pid 39537:tid 39551] [client 34.244.175.134:56968] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.bak"] [unique_id "aRpGdYZRrh1pcrdcLB_iowAAAMs"]
[Mon Nov 17 05:47:33.619132 2025] [:error] [pid 40548:tid 40565] [client 34.244.175.134:57028] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.old"] [unique_id "aRpGdQM_PykfYnxh-j-x8wAAAQ8"]
[Mon Nov 17 05:47:33.632008 2025] [:error] [pid 39451:tid 39516] [client 34.244.175.134:57014] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "aRpGdefgkqXTS0SO3fBtnQAAAIg"]
[Mon Nov 17 05:47:33.632832 2025] [:error] [pid 40548:tid 40550] [client 34.244.175.134:56996] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.save"] [unique_id "aRpGdQM_PykfYnxh-j-x9AAAAQA"]
[Mon Nov 17 05:47:33.639091 2025] [:error] [pid 39451:tid 39528] [client 34.244.175.134:56984] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.old"] [unique_id "aRpGdefgkqXTS0SO3fBtngAAAJQ"]
[Mon Nov 17 05:47:33.654282 2025] [:error] [pid 39537:tid 39563] [client 34.244.175.134:56962] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.old"] [unique_id "aRpGdYZRrh1pcrdcLB_ipAAAANc"]
[Mon Nov 17 05:47:33.654474 2025] [:error] [pid 40548:tid 40556] [client 34.244.175.134:57004] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.bak"] [unique_id "aRpGdQM_PykfYnxh-j-x9QAAAQY"]
[Mon Nov 17 05:47:33.670779 2025] [:error] [pid 39451:tid 39520] [client 34.244.175.134:57084] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env.save"] [unique_id "aRpGdefgkqXTS0SO3fBtnwAAAIw"]
[Mon Nov 17 05:47:33.690222 2025] [:error] [pid 39451:tid 39513] [client 34.244.175.134:57094] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.env.bak"] [unique_id "aRpGdefgkqXTS0SO3fBtoAAAAIU"]
[Mon Nov 17 05:47:33.698027 2025] [:error] [pid 40548:tid 40571] [client 34.244.175.134:57044] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.env"] [unique_id "aRpGdQM_PykfYnxh-j-x9gAAARU"]
[Mon Nov 17 05:47:33.738365 2025] [:error] [pid 39450:tid 39504] [client 34.244.175.134:57070] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env.bak"] [unique_id "aRpGdeoZqPB4_7vNEDSY8wAAAFc"]
[Mon Nov 17 05:47:33.742404 2025] [:error] [pid 39451:tid 39508] [client 34.244.175.134:57098] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/includes/.env"] [unique_id "aRpGdefgkqXTS0SO3fBtoQAAAIA"]
[Mon Nov 17 05:47:33.742654 2025] [:error] [pid 39537:tid 39559] [client 34.244.175.134:57110] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.env.old"] [unique_id "aRpGdYZRrh1pcrdcLB_ipQAAANM"]
[Mon Nov 17 05:47:33.755042 2025] [:error] [pid 39450:tid 39482] [client 34.244.175.134:57080] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.env.save"] [unique_id "aRpGdeoZqPB4_7vNEDSY9QAAAEE"]
[Mon Nov 17 05:47:33.758538 2025] [:error] [pid 39451:tid 39512] [client 34.244.175.134:57096] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.old"] [unique_id "aRpGdefgkqXTS0SO3fBtogAAAIQ"]
[Mon Nov 17 05:47:33.772196 2025] [:error] [pid 39451:tid 39517] [client 34.244.175.134:57104] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env.old"] [unique_id "aRpGdefgkqXTS0SO3fBtowAAAIk"]
[Mon Nov 17 05:47:33.783975 2025] [:error] [pid 40548:tid 40572] [client 34.244.175.134:57050] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.bak"] [unique_id "aRpGdQM_PykfYnxh-j-x9wAAARY"]
[Mon Nov 17 05:47:33.801379 2025] [:error] [pid 40548:tid 40567] [client 34.244.175.134:57040] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.save"] [unique_id "aRpGdQM_PykfYnxh-j-x-AAAARE"]
[Mon Nov 17 05:47:33.827373 2025] [:error] [pid 39450:tid 39494] [client 34.244.175.134:57054] [client 34.244.175.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env"] [unique_id "aRpGdeoZqPB4_7vNEDSY9wAAAE0"]
[Mon Nov 17 06:38:46.972133 2025] [:error] [pid 39451:tid 39516] [client 65.0.117.67:58546] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aRpSdufgkqXTS0SO3fB9CgAAAIg"]
[Mon Nov 17 06:38:48.018820 2025] [:error] [pid 39451:tid 39522] [client 65.0.117.67:58556] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.dev"] [unique_id "aRpSeOfgkqXTS0SO3fB9CwAAAI4"]
[Mon Nov 17 06:38:48.081891 2025] [:error] [pid 39537:tid 39546] [client 65.0.117.67:58592] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.test"] [unique_id "aRpSeIZRrh1pcrdcLB_9FQAAAMY"]
[Mon Nov 17 06:38:48.082786 2025] [:error] [pid 39537:tid 39561] [client 65.0.117.67:58572] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.prod"] [unique_id "aRpSeIZRrh1pcrdcLB_9FgAAANU"]
[Mon Nov 17 06:38:48.088538 2025] [:error] [pid 39537:tid 39542] [client 65.0.117.67:58580] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.development"] [unique_id "aRpSeIZRrh1pcrdcLB_9FwAAAMI"]
[Mon Nov 17 06:38:48.096115 2025] [:error] [pid 39451:tid 39523] [client 65.0.117.67:58550] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.local"] [unique_id "aRpSeOfgkqXTS0SO3fB9DAAAAI8"]
[Mon Nov 17 06:38:48.175447 2025] [:error] [pid 39537:tid 39553] [client 65.0.117.67:58632] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.old"] [unique_id "aRpSeIZRrh1pcrdcLB_9GAAAAM0"]
[Mon Nov 17 06:38:48.176356 2025] [:error] [pid 39537:tid 39559] [client 65.0.117.67:58646] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.bak"] [unique_id "aRpSeIZRrh1pcrdcLB_9GQAAANM"]
[Mon Nov 17 06:38:48.192797 2025] [:error] [pid 39451:tid 39515] [client 65.0.117.67:58656] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.save"] [unique_id "aRpSeOfgkqXTS0SO3fB9DQAAAIc"]
[Mon Nov 17 06:38:48.207630 2025] [:error] [pid 40548:tid 40565] [client 65.0.117.67:58590] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.backup"] [unique_id "aRpSeAM_PykfYnxh-j_GyQAAAQ8"]
[Mon Nov 17 06:38:48.237358 2025] [:error] [pid 39537:tid 39555] [client 65.0.117.67:58606] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.production"] [unique_id "aRpSeIZRrh1pcrdcLB_9GgAAAM8"]
[Mon Nov 17 06:38:48.240284 2025] [:error] [pid 39537:tid 39543] [client 65.0.117.67:58622] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env~"] [unique_id "aRpSeIZRrh1pcrdcLB_9GwAAAMM"]
[Mon Nov 17 06:38:48.255043 2025] [:error] [pid 39450:tid 39500] [client 65.0.117.67:58568] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.staging"] [unique_id "aRpSeOoZqPB4_7vNEDSoXgAAAFM"]
[Mon Nov 17 06:38:48.295804 2025] [:error] [pid 39537:tid 39540] [client 65.0.117.67:58638] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.sample"] [unique_id "aRpSeIZRrh1pcrdcLB_9HAAAAMA"]
[Mon Nov 17 06:38:48.417760 2025] [:error] [pid 39451:tid 39521] [client 65.0.117.67:58648] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.orig"] [unique_id "aRpSeOfgkqXTS0SO3fB9DwAAAI0"]
[Mon Nov 17 06:38:48.582152 2025] [:error] [pid 39450:tid 39502] [client 65.0.117.67:36480] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.swp"] [unique_id "aRpSeOoZqPB4_7vNEDSoYgAAAFU"]
[Mon Nov 17 06:38:49.592830 2025] [:error] [pid 40548:tid 40574] [client 65.0.117.67:36506] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.tmp"] [unique_id "aRpSeQM_PykfYnxh-j_GywAAARg"]
[Mon Nov 17 06:38:49.613290 2025] [:error] [pid 39449:tid 39461] [client 65.0.117.67:36490] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.dist"] [unique_id "aRpSeaUCymTA3MDfzLOjGwAAAAc"]
[Mon Nov 17 06:38:49.616295 2025] [:error] [pid 39449:tid 39475] [client 65.0.117.67:36508] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env"] [unique_id "aRpSeaUCymTA3MDfzLOjHAAAABU"]
[Mon Nov 17 06:38:51.560650 2025] [:error] [pid 39449:tid 39466] [client 65.0.117.67:36530] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env"] [unique_id "aRpSe6UCymTA3MDfzLOjIgAAAAw"]
[Mon Nov 17 06:38:51.578472 2025] [:error] [pid 39450:tid 39492] [client 65.0.117.67:36518] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.bak"] [unique_id "aRpSe-oZqPB4_7vNEDSoaQAAAEs"]
[Mon Nov 17 06:38:51.623403 2025] [:error] [pid 39450:tid 39498] [client 65.0.117.67:36538] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.old"] [unique_id "aRpSe-oZqPB4_7vNEDSoagAAAFE"]
[Mon Nov 17 06:38:51.676019 2025] [:error] [pid 39450:tid 39487] [client 65.0.117.67:36542] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.save"] [unique_id "aRpSe-oZqPB4_7vNEDSoawAAAEY"]
[Mon Nov 17 06:38:51.702849 2025] [:error] [pid 40548:tid 40555] [client 65.0.117.67:36552] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.old"] [unique_id "aRpSewM_PykfYnxh-j_GzQAAAQU"]
[Mon Nov 17 06:38:51.771509 2025] [:error] [pid 39537:tid 39555] [client 65.0.117.67:36556] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env"] [unique_id "aRpSe4ZRrh1pcrdcLB_9JAAAAM8"]
[Mon Nov 17 06:38:51.819224 2025] [:error] [pid 40548:tid 40571] [client 65.0.117.67:36558] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.save"] [unique_id "aRpSewM_PykfYnxh-j_GzgAAARU"]
[Mon Nov 17 06:38:51.906128 2025] [:error] [pid 40548:tid 40558] [client 65.0.117.67:36568] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.bak"] [unique_id "aRpSewM_PykfYnxh-j_G0AAAAQg"]
[Mon Nov 17 06:38:54.511374 2025] [:error] [pid 40548:tid 40554] [client 65.0.117.67:36572] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env.bak"] [unique_id "aRpSfgM_PykfYnxh-j_G1gAAAQQ"]
[Mon Nov 17 06:38:54.532677 2025] [:error] [pid 39449:tid 39472] [client 65.0.117.67:36574] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env.save"] [unique_id "aRpSfqUCymTA3MDfzLOjLAAAABI"]
[Mon Nov 17 06:38:54.559420 2025] [:error] [pid 39450:tid 39499] [client 65.0.117.67:36582] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env.old"] [unique_id "aRpSfuoZqPB4_7vNEDSocQAAAFI"]
[Mon Nov 17 06:38:54.561365 2025] [:error] [pid 39537:tid 39545] [client 65.0.117.67:36578] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env"] [unique_id "aRpSfoZRrh1pcrdcLB_9KAAAAMU"]
[Mon Nov 17 06:38:54.585177 2025] [:error] [pid 39537:tid 39557] [client 65.0.117.67:36584] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env.bak"] [unique_id "aRpSfoZRrh1pcrdcLB_9KQAAANE"]
[Mon Nov 17 06:38:54.615681 2025] [:error] [pid 39451:tid 39529] [client 65.0.117.67:36588] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.env.old"] [unique_id "aRpSfufgkqXTS0SO3fB9EwAAAJU"]
[Mon Nov 17 06:38:54.762109 2025] [:error] [pid 39537:tid 39553] [client 65.0.117.67:36670] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.env"] [unique_id "aRpSfoZRrh1pcrdcLB_9KgAAAM0"]
[Mon Nov 17 06:38:55.379420 2025] [:error] [pid 39449:tid 39460] [client 65.0.117.67:36592] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.env.bak"] [unique_id "aRpSf6UCymTA3MDfzLOjLgAAAAY"]
[Mon Nov 17 06:38:55.398697 2025] [:error] [pid 39537:tid 39544] [client 65.0.117.67:36608] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env.old"] [unique_id "aRpSf4ZRrh1pcrdcLB_9KwAAAMQ"]
[Mon Nov 17 06:38:55.432998 2025] [:error] [pid 39537:tid 39542] [client 65.0.117.67:36622] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.env.save"] [unique_id "aRpSf4ZRrh1pcrdcLB_9LAAAAMI"]
[Mon Nov 17 06:38:55.436293 2025] [:error] [pid 39449:tid 39464] [client 65.0.117.67:36652] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env.save"] [unique_id "aRpSf6UCymTA3MDfzLOjLwAAAAo"]
[Mon Nov 17 06:38:55.442082 2025] [:error] [pid 39537:tid 39561] [client 65.0.117.67:36634] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env.save"] [unique_id "aRpSf4ZRrh1pcrdcLB_9LQAAANU"]
[Mon Nov 17 06:38:55.488785 2025] [:error] [pid 39450:tid 39495] [client 65.0.117.67:36638] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env.old"] [unique_id "aRpSf-oZqPB4_7vNEDSocgAAAE4"]
[Mon Nov 17 06:38:55.503782 2025] [:error] [pid 39537:tid 39551] [client 65.0.117.67:36682] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env.bak"] [unique_id "aRpSf4ZRrh1pcrdcLB_9LgAAAMs"]
[Mon Nov 17 06:38:55.594229 2025] [:error] [pid 39537:tid 39564] [client 65.0.117.67:36666] [client 65.0.117.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env"] [unique_id "aRpSf4ZRrh1pcrdcLB_9LwAAANg"]
[Mon Nov 17 22:52:36.217819 2025] [:error] [pid 39451:tid 39516] [client 54.250.33.2:35588] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aRs2tOfgkqXTS0SO3fA2KQAAAIg"]
[Mon Nov 17 22:52:42.076375 2025] [:error] [pid 39451:tid 39531] [client 54.250.33.2:33980] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aRs2uufgkqXTS0SO3fA2LAAAAJc"]
[Mon Nov 17 22:52:42.126850 2025] [:error] [pid 15888:tid 15913] [client 54.250.33.2:33990] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "aRs2ugjAdDTBm4W3qW1KmwAAAdY"]
[Mon Nov 17 22:52:42.210473 2025] [:error] [pid 39451:tid 39517] [client 54.250.33.2:34002] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aRs2uufgkqXTS0SO3fA2LQAAAIk"]
[Mon Nov 17 22:52:42.216319 2025] [:error] [pid 39451:tid 39524] [client 54.250.33.2:34014] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aRs2uufgkqXTS0SO3fA2LgAAAJA"]
[Mon Nov 17 22:52:42.237786 2025] [:error] [pid 39451:tid 39513] [client 54.250.33.2:34028] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev"] [unique_id "aRs2uufgkqXTS0SO3fA2LwAAAIU"]
[Mon Nov 17 22:52:42.257999 2025] [:error] [pid 65302:tid 65322] [client 54.250.33.2:34032] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.prod"] [unique_id "aRs2ugPMSx2v85r8y7wbTwAAAVI"]
[Mon Nov 17 22:52:42.260643 2025] [:error] [pid 32753:tid 32780] [client 54.250.33.2:34036] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aRs2uk6YNqI5vkht922tsQAAA9g"]
[Mon Nov 17 22:52:42.268378 2025] [:error] [pid 32753:tid 32769] [client 54.250.33.2:34046] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aRs2uk6YNqI5vkht922tsgAAA80"]
[Mon Nov 17 22:52:42.406118 2025] [:error] [pid 15888:tid 15899] [client 54.250.33.2:34056] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env~"] [unique_id "aRs2ugjAdDTBm4W3qW1KnQAAAcg"]
[Mon Nov 17 22:52:42.445848 2025] [:error] [pid 39451:tid 39519] [client 54.250.33.2:34070] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.sample"] [unique_id "aRs2uufgkqXTS0SO3fA2MAAAAIs"]
[Mon Nov 17 22:52:42.515586 2025] [:error] [pid 30801:tid 30812] [client 54.250.33.2:34082] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aRs2ujbGAU49DhMTBD4GLwAAAkk"]
[Mon Nov 17 22:52:42.524211 2025] [:error] [pid 39451:tid 39514] [client 54.250.33.2:34086] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aRs2uufgkqXTS0SO3fA2MQAAAIY"]
[Mon Nov 17 22:52:56.124454 2025] [:error] [pid 15888:tid 15894] [client 54.250.33.2:57934] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.swp"] [unique_id "aRs2yAjAdDTBm4W3qW1KoAAAAcM"]
[Mon Nov 17 22:52:56.168353 2025] [:error] [pid 15888:tid 15901] [client 54.250.33.2:57950] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aRs2yAjAdDTBm4W3qW1KoQAAAco"]
[Mon Nov 17 22:52:56.226971 2025] [:error] [pid 15888:tid 15903] [client 54.250.33.2:57958] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.orig"] [unique_id "aRs2yAjAdDTBm4W3qW1KowAAAcw"]
[Mon Nov 17 22:53:07.248544 2025] [:error] [pid 32753:tid 32767] [client 54.250.33.2:39454] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.tmp"] [unique_id "aRs2006YNqI5vkht922t1wAAA8s"]
[Mon Nov 17 22:53:18.869060 2025] [:error] [pid 20913:tid 20931] [client 54.250.33.2:56294] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env"] [unique_id "aRs23ukafGNeN3nY1bd00AAAA1A"]
[Mon Nov 17 22:53:18.968925 2025] [:error] [pid 20913:tid 20925] [client 54.250.33.2:56300] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dist"] [unique_id "aRs23ukafGNeN3nY1bd00QAAA0o"]
[Mon Nov 17 22:53:19.399255 2025] [:error] [pid 39537:tid 39542] [client 54.250.33.2:56324] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.save"] [unique_id "aRs234ZRrh1pcrdcLB_SFgAAAMI"]
[Mon Nov 17 22:53:19.401315 2025] [:error] [pid 39537:tid 39541] [client 54.250.33.2:56302] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "aRs234ZRrh1pcrdcLB_SFwAAAME"]
[Mon Nov 17 22:53:19.408184 2025] [:error] [pid 39449:tid 39464] [client 54.250.33.2:56328] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.old"] [unique_id "aRs236UCymTA3MDfzLN8bAAAAAo"]
[Mon Nov 17 22:53:19.441395 2025] [:error] [pid 30801:tid 30822] [client 54.250.33.2:56316] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.bak"] [unique_id "aRs23zbGAU49DhMTBD4GPQAAAlM"]
[Mon Nov 17 22:53:19.653598 2025] [:error] [pid 30801:tid 30819] [client 54.250.33.2:47766] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.save"] [unique_id "aRs23zbGAU49DhMTBD4GPgAAAlA"]
[Mon Nov 17 22:53:21.438983 2025] [:error] [pid 39449:tid 39466] [client 54.250.33.2:47782] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.old"] [unique_id "aRs24aUCymTA3MDfzLN8cgAAAAw"]
[Mon Nov 17 22:53:21.446219 2025] [:error] [pid 32753:tid 32770] [client 54.250.33.2:47786] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.bak"] [unique_id "aRs24U6YNqI5vkht922t7wAAA84"]
[Mon Nov 17 22:53:23.489608 2025] [:error] [pid 20913:tid 20935] [client 54.250.33.2:47792] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.old"] [unique_id "aRs24-kafGNeN3nY1bd00gAAA1Q"]
[Mon Nov 17 22:53:23.513206 2025] [:error] [pid 32753:tid 32758] [client 54.250.33.2:47796] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "aRs2406YNqI5vkht922t8wAAA8I"]
[Mon Nov 17 22:53:23.569927 2025] [:error] [pid 39449:tid 39478] [client 54.250.33.2:47814] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.save"] [unique_id "aRs246UCymTA3MDfzLN8dAAAABg"]
[Mon Nov 17 22:53:23.581134 2025] [:error] [pid 20913:tid 20922] [client 54.250.33.2:47828] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.bak"] [unique_id "aRs24-kafGNeN3nY1bd01AAAA0c"]
[Mon Nov 17 22:53:23.601288 2025] [:error] [pid 39449:tid 39475] [client 54.250.33.2:47858] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.old"] [unique_id "aRs246UCymTA3MDfzLN8dQAAABU"]
[Mon Nov 17 22:53:23.625203 2025] [:error] [pid 31419:tid 31436] [client 54.250.33.2:47868] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.save"] [unique_id "aRs24wHQ5Sbp7elmDZiz9AAAAo8"]
[Mon Nov 17 22:53:23.626478 2025] [:error] [pid 20913:tid 20924] [client 54.250.33.2:47806] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.save"] [unique_id "aRs24-kafGNeN3nY1bd01QAAA0k"]
[Mon Nov 17 22:53:23.674282 2025] [:error] [pid 39449:tid 39465] [client 54.250.33.2:47894] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env"] [unique_id "aRs246UCymTA3MDfzLN8dgAAAAs"]
[Mon Nov 17 22:53:23.696523 2025] [:error] [pid 39449:tid 39473] [client 54.250.33.2:47882] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.old"] [unique_id "aRs246UCymTA3MDfzLN8dwAAABM"]
[Mon Nov 17 22:53:23.726337 2025] [:error] [pid 39449:tid 39458] [client 54.250.33.2:47908] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.bak"] [unique_id "aRs246UCymTA3MDfzLN8eAAAAAQ"]
[Mon Nov 17 22:53:23.730025 2025] [:error] [pid 39537:tid 39554] [client 54.250.33.2:47842] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aRs244ZRrh1pcrdcLB_SGQAAAM4"]
[Mon Nov 17 22:53:23.808905 2025] [:error] [pid 39449:tid 39474] [client 54.250.33.2:47920] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.bak"] [unique_id "aRs246UCymTA3MDfzLN8eQAAABQ"]
[Mon Nov 17 22:53:23.903438 2025] [:error] [pid 39449:tid 39461] [client 54.250.33.2:47914] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env"] [unique_id "aRs246UCymTA3MDfzLN8egAAAAc"]
[Mon Nov 17 22:53:23.948817 2025] [:error] [pid 20913:tid 20915] [client 54.250.33.2:47932] [client 54.250.33.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env.save"] [unique_id "aRs24-kafGNeN3nY1bd01gAAA0A"]
[Mon Nov 17 23:29:11.408255 2025] [:error] [pid 39449:tid 39457] [client 18.141.212.219:41330] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aRs_R6UCymTA3MDfzLODzwAAAAM"]
[Mon Nov 17 23:29:11.428992 2025] [:error] [pid 39451:tid 39526] [client 18.141.212.219:41354] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.dev"] [unique_id "aRs_R-fgkqXTS0SO3fA6XAAAAJI"]
[Mon Nov 17 23:29:11.528358 2025] [:error] [pid 40548:tid 40556] [client 18.141.212.219:41334] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.local"] [unique_id "aRs_RwM_PykfYnxh-j-FgwAAAQY"]
[Mon Nov 17 23:29:11.545920 2025] [:error] [pid 32753:tid 32766] [client 18.141.212.219:41358] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.staging"] [unique_id "aRs_R06YNqI5vkht9223dwAAA8o"]
[Mon Nov 17 23:29:12.159988 2025] [:error] [pid 30801:tid 30806] [client 18.141.212.219:41338] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.prod"] [unique_id "aRs_SDbGAU49DhMTBD4LMAAAAkM"]
[Mon Nov 17 23:29:13.618723 2025] [:error] [pid 39451:tid 39521] [client 18.141.212.219:41364] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.test"] [unique_id "aRs_SefgkqXTS0SO3fA6XgAAAI0"]
[Mon Nov 17 23:29:13.651432 2025] [:error] [pid 30801:tid 30824] [client 18.141.212.219:41400] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.sample"] [unique_id "aRs_STbGAU49DhMTBD4LMQAAAlU"]
[Mon Nov 17 23:29:13.657956 2025] [:error] [pid 30801:tid 30815] [client 18.141.212.219:41382] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env~"] [unique_id "aRs_STbGAU49DhMTBD4LMgAAAkw"]
[Mon Nov 17 23:29:13.658678 2025] [:error] [pid 39449:tid 39465] [client 18.141.212.219:41376] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.backup"] [unique_id "aRs_SaUCymTA3MDfzLOD0AAAAAs"]
[Mon Nov 17 23:29:13.681194 2025] [:error] [pid 30801:tid 30813] [client 18.141.212.219:41384] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.production"] [unique_id "aRs_STbGAU49DhMTBD4LMwAAAko"]
[Mon Nov 17 23:29:13.690757 2025] [:error] [pid 30801:tid 30807] [client 18.141.212.219:41404] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.bak"] [unique_id "aRs_STbGAU49DhMTBD4LNAAAAkQ"]
[Mon Nov 17 23:29:13.703195 2025] [:error] [pid 39451:tid 39510] [client 18.141.212.219:41434] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.old"] [unique_id "aRs_SefgkqXTS0SO3fA6XwAAAII"]
[Mon Nov 17 23:29:13.708745 2025] [:error] [pid 30801:tid 30820] [client 18.141.212.219:41418] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.development"] [unique_id "aRs_STbGAU49DhMTBD4LNQAAAlE"]
[Mon Nov 17 23:29:15.582826 2025] [:error] [pid 39537:tid 39546] [client 18.141.212.219:41450] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.orig"] [unique_id "aRs_S4ZRrh1pcrdcLB_XwwAAAMY"]
[Mon Nov 17 23:29:15.655821 2025] [:error] [pid 30801:tid 30817] [client 18.141.212.219:41458] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.save"] [unique_id "aRs_SzbGAU49DhMTBD4LNwAAAk4"]
[Mon Nov 17 23:29:15.683545 2025] [:error] [pid 65302:tid 65327] [client 18.141.212.219:41462] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.swp"] [unique_id "aRs_SwPMSx2v85r8y7wgrAAAAVc"]
[Mon Nov 17 23:29:15.698433 2025] [:error] [pid 20913:tid 20934] [client 18.141.212.219:41468] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.tmp"] [unique_id "aRs_S-kafGNeN3nY1bd69QAAA1M"]
[Mon Nov 17 23:29:22.503293 2025] [:error] [pid 30801:tid 30813] [client 18.141.212.219:40748] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.save"] [unique_id "aRs_UjbGAU49DhMTBD4LRAAAAko"]
[Mon Nov 17 23:29:22.505607 2025] [:error] [pid 30801:tid 30807] [client 18.141.212.219:40812] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.old"] [unique_id "aRs_UjbGAU49DhMTBD4LRQAAAkQ"]
[Mon Nov 17 23:29:22.536498 2025] [:error] [pid 39537:tid 39555] [client 18.141.212.219:40760] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.old"] [unique_id "aRs_UoZRrh1pcrdcLB_XxgAAAM8"]
[Mon Nov 17 23:29:22.539850 2025] [:error] [pid 30801:tid 30818] [client 18.141.212.219:40776] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.dist"] [unique_id "aRs_UjbGAU49DhMTBD4LRgAAAk8"]
[Mon Nov 17 23:29:22.549047 2025] [:error] [pid 30801:tid 30810] [client 18.141.212.219:40786] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env"] [unique_id "aRs_UjbGAU49DhMTBD4LRwAAAkc"]
[Mon Nov 17 23:29:22.551723 2025] [:error] [pid 30801:tid 30825] [client 18.141.212.219:40822] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.bak"] [unique_id "aRs_UjbGAU49DhMTBD4LSAAAAlY"]
[Mon Nov 17 23:29:22.565129 2025] [:error] [pid 30801:tid 30812] [client 18.141.212.219:40802] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env"] [unique_id "aRs_UjbGAU49DhMTBD4LSQAAAkk"]
[Mon Nov 17 23:29:22.574946 2025] [:error] [pid 30801:tid 30814] [client 18.141.212.219:40838] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.bak"] [unique_id "aRs_UjbGAU49DhMTBD4LSwAAAks"]
[Mon Nov 17 23:29:22.575160 2025] [:error] [pid 30801:tid 30804] [client 18.141.212.219:40844] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env"] [unique_id "aRs_UjbGAU49DhMTBD4LTAAAAkE"]
[Mon Nov 17 23:29:22.581674 2025] [:error] [pid 30801:tid 30820] [client 18.141.212.219:40766] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.save"] [unique_id "aRs_UjbGAU49DhMTBD4LTQAAAlE"]
[Mon Nov 17 23:29:22.600465 2025] [:error] [pid 40548:tid 40573] [client 18.141.212.219:40798] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env.save"] [unique_id "aRs_UgM_PykfYnxh-j-FhAAAARc"]
[Mon Nov 17 23:29:26.851525 2025] [:error] [pid 39537:tid 39564] [client 18.141.212.219:40848] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env.bak"] [unique_id "aRs_VoZRrh1pcrdcLB_XyAAAANg"]
[Mon Nov 17 23:29:26.903476 2025] [:error] [pid 31419:tid 31438] [client 18.141.212.219:40870] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env.old"] [unique_id "aRs_VgHQ5Sbp7elmDZi6WwAAApE"]
[Mon Nov 17 23:29:26.916055 2025] [:error] [pid 31419:tid 31435] [client 18.141.212.219:40860] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env.save"] [unique_id "aRs_VgHQ5Sbp7elmDZi6XAAAAo4"]
[Mon Nov 17 23:29:26.926094 2025] [:error] [pid 39451:tid 39521] [client 18.141.212.219:40874] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env.old"] [unique_id "aRs_VufgkqXTS0SO3fA6agAAAI0"]
[Mon Nov 17 23:29:26.934976 2025] [:error] [pid 40548:tid 40555] [client 18.141.212.219:40882] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env"] [unique_id "aRs_VgM_PykfYnxh-j-FiQAAAQU"]
[Mon Nov 17 23:29:26.941592 2025] [:error] [pid 39537:tid 39553] [client 18.141.212.219:40898] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env"] [unique_id "aRs_VoZRrh1pcrdcLB_XyQAAAM0"]
[Mon Nov 17 23:29:27.000816 2025] [:error] [pid 65302:tid 65319] [client 18.141.212.219:40918] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env.old"] [unique_id "aRs_VwPMSx2v85r8y7wgsQAAAU8"]
[Mon Nov 17 23:29:27.041231 2025] [:error] [pid 31419:tid 31426] [client 18.141.212.219:40948] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env.save"] [unique_id "aRs_VwHQ5Sbp7elmDZi6XgAAAoU"]
[Mon Nov 17 23:29:27.057364 2025] [:error] [pid 39451:tid 39510] [client 18.141.212.219:40930] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/src/.env.bak"] [unique_id "aRs_V-fgkqXTS0SO3fA6awAAAII"]
[Mon Nov 17 23:29:27.067902 2025] [:error] [pid 65302:tid 65320] [client 18.141.212.219:40912] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.env"] [unique_id "aRs_VwPMSx2v85r8y7wgsgAAAVA"]
[Mon Nov 17 23:29:27.085872 2025] [:error] [pid 65302:tid 65315] [client 18.141.212.219:40938] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.env.bak"] [unique_id "aRs_VwPMSx2v85r8y7wgswAAAUs"]
[Mon Nov 17 23:29:27.179122 2025] [:error] [pid 31419:tid 31431] [client 18.141.212.219:40966] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.env.save"] [unique_id "aRs_VwHQ5Sbp7elmDZi6XwAAAoo"]
[Mon Nov 17 23:29:27.256834 2025] [:error] [pid 15888:tid 15891] [client 18.141.212.219:40958] [client 18.141.212.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/config/.env.bak"] [unique_id "aRs_VwjAdDTBm4W3qW1PYwAAAcA"]
[Tue Nov 18 07:18:57.812936 2025] [:error] [pid 9935:tid 9954] [client 3.248.189.144:55652] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.prod"] [unique_id "aRutYQWOMXsrZFRF6sjfNAAAAZE"]
[Tue Nov 18 07:18:57.823167 2025] [:error] [pid 61392:tid 61445] [client 3.248.189.144:55680] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.local"] [unique_id "aRutYXSmvb496zZxueLgvAAAAFA"]
[Tue Nov 18 07:18:57.841501 2025] [:error] [pid 61393:tid 61468] [client 3.248.189.144:55660] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.staging"] [unique_id "aRutYWH9XjlbVPv9gQUu4wAAAIw"]
[Tue Nov 18 07:18:57.846084 2025] [:error] [pid 29195:tid 29218] [client 3.248.189.144:55666] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.dev"] [unique_id "aRutYRMeonxy_4yeOTVMBAAAARU"]
[Tue Nov 18 07:18:57.868604 2025] [:error] [pid 61393:tid 61460] [client 3.248.189.144:55650] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aRutYWH9XjlbVPv9gQUu5AAAAIQ"]
[Tue Nov 18 07:18:57.964178 2025] [:error] [pid 42804:tid 42809] [client 3.248.189.144:55698] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.development"] [unique_id "aRutYfpXARlE6tIuBnlo4AAAAUM"]
[Tue Nov 18 07:18:58.675689 2025] [:error] [pid 61391:tid 61402] [client 3.248.189.144:55706] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.backup"] [unique_id "aRutYowXIKmhlnkP3-dvqgAAAAI"]
[Tue Nov 18 07:18:58.705037 2025] [:error] [pid 61391:tid 61424] [client 3.248.189.144:55734] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env~"] [unique_id "aRutYowXIKmhlnkP3-dvqwAAABg"]
[Tue Nov 18 07:18:58.710379 2025] [:error] [pid 42804:tid 42822] [client 3.248.189.144:55688] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.production"] [unique_id "aRutYvpXARlE6tIuBnlo4gAAAVA"]
[Tue Nov 18 07:18:58.715844 2025] [:error] [pid 9935:tid 9948] [client 3.248.189.144:55752] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.bak"] [unique_id "aRutYgWOMXsrZFRF6sjfNgAAAYs"]
[Tue Nov 18 07:18:58.962155 2025] [:error] [pid 42804:tid 42821] [client 3.248.189.144:55748] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.old"] [unique_id "aRutYvpXARlE6tIuBnlo4wAAAU8"]
[Tue Nov 18 07:18:58.992048 2025] [:error] [pid 42804:tid 42813] [client 3.248.189.144:55722] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.test"] [unique_id "aRutYvpXARlE6tIuBnlo5AAAAUc"]
[Tue Nov 18 07:18:59.007261 2025] [:error] [pid 42804:tid 42820] [client 3.248.189.144:55714] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.sample"] [unique_id "aRutY_pXARlE6tIuBnlo5QAAAU4"]
[Tue Nov 18 07:19:12.974061 2025] [:error] [pid 61392:tid 61449] [client 15.188.47.247:46028] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aRutcHSmvb496zZxueLg4QAAAFQ"]
[Tue Nov 18 07:19:12.974071 2025] [:error] [pid 9935:tid 9947] [client 15.188.47.247:46054] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aRutcAWOMXsrZFRF6sjfRQAAAYo"]
[Tue Nov 18 07:19:12.986864 2025] [:error] [pid 9935:tid 9953] [client 15.188.47.247:46034] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev"] [unique_id "aRutcAWOMXsrZFRF6sjfRgAAAZA"]
[Tue Nov 18 07:19:12.987288 2025] [:error] [pid 61392:tid 61451] [client 15.188.47.247:46038] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aRutcHSmvb496zZxueLg4gAAAFY"]
[Tue Nov 18 07:19:13.012973 2025] [:error] [pid 61391:tid 61414] [client 15.188.47.247:46078] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aRutcYwXIKmhlnkP3-dvsgAAAA4"]
[Tue Nov 18 07:19:13.887375 2025] [:error] [pid 61391:tid 61423] [client 15.188.47.247:46068] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.prod"] [unique_id "aRutcYwXIKmhlnkP3-dvswAAABc"]
[Tue Nov 18 07:19:14.010057 2025] [:error] [pid 42804:tid 42826] [client 15.188.47.247:46082] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aRutcvpXARlE6tIuBnlo7QAAAVQ"]
[Tue Nov 18 07:19:20.717888 2025] [:error] [pid 9935:tid 9942] [client 15.188.47.247:37688] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "aRuteAWOMXsrZFRF6sjfUAAAAYU"]
[Tue Nov 18 07:19:20.965920 2025] [:error] [pid 9935:tid 9953] [client 15.188.47.247:37728] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aRuteAWOMXsrZFRF6sjfUQAAAZA"]
[Tue Nov 18 07:19:20.996900 2025] [:error] [pid 9935:tid 9941] [client 15.188.47.247:37738] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.orig"] [unique_id "aRuteAWOMXsrZFRF6sjfUgAAAYQ"]
[Tue Nov 18 07:19:20.997922 2025] [:error] [pid 9935:tid 9949] [client 15.188.47.247:37700] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aRuteAWOMXsrZFRF6sjfUwAAAYw"]
[Tue Nov 18 07:19:21.012166 2025] [:error] [pid 9935:tid 9947] [client 15.188.47.247:37694] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aRuteQWOMXsrZFRF6sjfVAAAAYo"]
[Tue Nov 18 07:19:21.038297 2025] [:error] [pid 9935:tid 9946] [client 15.188.47.247:37698] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.sample"] [unique_id "aRuteQWOMXsrZFRF6sjfVQAAAYk"]
[Tue Nov 18 07:19:21.052340 2025] [:error] [pid 9935:tid 9950] [client 15.188.47.247:37702] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env~"] [unique_id "aRuteQWOMXsrZFRF6sjfVgAAAY0"]
[Tue Nov 18 07:19:21.053701 2025] [:error] [pid 9935:tid 9952] [client 15.188.47.247:37714] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aRuteQWOMXsrZFRF6sjfVwAAAY8"]
[Tue Nov 18 07:19:21.335919 2025] [:error] [pid 61393:tid 61458] [client 15.188.47.247:37742] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.swp"] [unique_id "aRuteWH9XjlbVPv9gQUvDwAAAII"]
[Tue Nov 18 07:19:23.466896 2025] [:error] [pid 61391:tid 61424] [client 15.188.47.247:37816] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dist"] [unique_id "aRute4wXIKmhlnkP3-dvtQAAABg"]
[Tue Nov 18 07:19:23.503122 2025] [:error] [pid 61392:tid 61429] [client 15.188.47.247:37784] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.save"] [unique_id "aRute3Smvb496zZxueLg5QAAAEA"]
[Tue Nov 18 07:19:23.522478 2025] [:error] [pid 61393:tid 61477] [client 15.188.47.247:37780] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "aRute2H9XjlbVPv9gQUvEgAAAJU"]
[Tue Nov 18 07:19:23.531014 2025] [:error] [pid 61393:tid 61463] [client 15.188.47.247:37812] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.old"] [unique_id "aRute2H9XjlbVPv9gQUvEwAAAIc"]
[Tue Nov 18 07:19:23.561178 2025] [:error] [pid 61391:tid 61417] [client 15.188.47.247:37826] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.old"] [unique_id "aRute4wXIKmhlnkP3-dvtwAAABE"]
[Tue Nov 18 07:19:23.567368 2025] [:error] [pid 61392:tid 61434] [client 15.188.47.247:37828] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.bak"] [unique_id "aRute3Smvb496zZxueLg5gAAAEU"]
[Tue Nov 18 07:19:23.568824 2025] [:error] [pid 61391:tid 61405] [client 15.188.47.247:37800] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.save"] [unique_id "aRute4wXIKmhlnkP3-dvuAAAAAU"]
[Tue Nov 18 07:19:23.569898 2025] [:error] [pid 61392:tid 61452] [client 15.188.47.247:37760] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.tmp"] [unique_id "aRute3Smvb496zZxueLg5wAAAFc"]
[Tue Nov 18 07:19:23.578831 2025] [:error] [pid 61392:tid 61443] [client 15.188.47.247:37834] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.bak"] [unique_id "aRute3Smvb496zZxueLg6AAAAE4"]
[Tue Nov 18 07:19:23.591764 2025] [:error] [pid 42804:tid 42816] [client 15.188.47.247:37758] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.save"] [unique_id "aRute_pXARlE6tIuBnlo8QAAAUo"]
[Tue Nov 18 07:19:23.617940 2025] [:error] [pid 61392:tid 61453] [client 15.188.47.247:37754] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env"] [unique_id "aRute3Smvb496zZxueLg6QAAAFg"]
[Tue Nov 18 07:19:23.661462 2025] [:error] [pid 61391:tid 61402] [client 15.188.47.247:37770] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "aRute4wXIKmhlnkP3-dvuQAAAAI"]
[Tue Nov 18 07:19:25.308129 2025] [:error] [pid 29195:tid 29203] [client 15.188.47.247:37858] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.save"] [unique_id "aRutfRMeonxy_4yeOTVMEwAAAQY"]
[Tue Nov 18 07:19:25.401889 2025] [:error] [pid 29195:tid 29200] [client 15.188.47.247:37842] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.bak"] [unique_id "aRutfRMeonxy_4yeOTVMFAAAAQM"]
[Tue Nov 18 07:19:25.465236 2025] [:error] [pid 29195:tid 29220] [client 15.188.47.247:37862] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.old"] [unique_id "aRutfRMeonxy_4yeOTVMFQAAARc"]
[Tue Nov 18 07:19:25.465426 2025] [:error] [pid 61392:tid 61449] [client 15.188.47.247:37852] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aRutfXSmvb496zZxueLg7QAAAFQ"]
[Tue Nov 18 07:19:25.501479 2025] [:error] [pid 61392:tid 61451] [client 15.188.47.247:37846] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.old"] [unique_id "aRutfXSmvb496zZxueLg7wAAAFY"]
[Tue Nov 18 07:19:25.628258 2025] [:error] [pid 61482:tid 61500] [client 15.188.47.247:37868] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env"] [unique_id "aRutfftNHsWZClVWav5gJwAAAM0"]
[Tue Nov 18 07:19:25.660892 2025] [:error] [pid 61482:tid 61494] [client 15.188.47.247:37880] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.bak"] [unique_id "aRutfftNHsWZClVWav5gKAAAAMc"]
[Tue Nov 18 07:19:25.698353 2025] [:error] [pid 61392:tid 61433] [client 15.188.47.247:37886] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.save"] [unique_id "aRutfXSmvb496zZxueLg8AAAAEQ"]
[Tue Nov 18 07:19:25.739367 2025] [:error] [pid 61393:tid 61469] [client 15.188.47.247:37870] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env"] [unique_id "aRutfWH9XjlbVPv9gQUvFAAAAI0"]
[Tue Nov 18 07:19:25.739448 2025] [:error] [pid 42804:tid 42823] [client 15.188.47.247:37884] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.bak"] [unique_id "aRutffpXARlE6tIuBnlo8gAAAVE"]
[Tue Nov 18 07:19:25.750027 2025] [:error] [pid 61393:tid 61457] [client 15.188.47.247:37896] [client 15.188.47.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/.env.old"] [unique_id "aRutfWH9XjlbVPv9gQUvFQAAAIE"]
[Tue Nov 18 07:19:45.668630 2025] [:error] [pid 9935:tid 9938] [client 3.248.189.144:36460] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.save"] [unique_id "aRutkQWOMXsrZFRF6sjfewAAAYE"]
[Tue Nov 18 07:19:45.734323 2025] [:error] [pid 29195:tid 29211] [client 3.248.189.144:36456] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.orig"] [unique_id "aRutkRMeonxy_4yeOTVMOQAAAQ4"]
[Tue Nov 18 07:19:45.752088 2025] [:error] [pid 61392:tid 61450] [client 3.248.189.144:36474] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.swp"] [unique_id "aRutkXSmvb496zZxueLhDAAAAFU"]
[Tue Nov 18 07:20:00.815986 2025] [:error] [pid 29195:tid 29209] [client 3.248.189.144:50230] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.tmp"] [unique_id "aRutoBMeonxy_4yeOTVMRAAAAQw"]
[Tue Nov 18 07:20:00.820641 2025] [:error] [pid 42804:tid 42822] [client 3.248.189.144:50252] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.dist"] [unique_id "aRutoPpXARlE6tIuBnlpIgAAAVA"]
[Tue Nov 18 07:20:00.840319 2025] [:error] [pid 61392:tid 61437] [client 3.248.189.144:50276] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.old"] [unique_id "aRutoHSmvb496zZxueLhEQAAAEg"]
[Tue Nov 18 07:20:00.842034 2025] [:error] [pid 61393:tid 61459] [client 3.248.189.144:50278] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.save"] [unique_id "aRutoGH9XjlbVPv9gQUvMgAAAIM"]
[Tue Nov 18 07:20:00.842333 2025] [:error] [pid 61392:tid 61430] [client 3.248.189.144:50244] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.save"] [unique_id "aRutoHSmvb496zZxueLhEgAAAEE"]
[Tue Nov 18 07:20:00.845880 2025] [:error] [pid 61392:tid 61447] [client 3.248.189.144:50268] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env"] [unique_id "aRutoHSmvb496zZxueLhEwAAAFI"]
[Tue Nov 18 07:20:00.856440 2025] [:error] [pid 42804:tid 42816] [client 3.248.189.144:50300] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.env.bak"] [unique_id "aRutoPpXARlE6tIuBnlpIwAAAUo"]
[Tue Nov 18 07:20:00.857181 2025] [:error] [pid 61392:tid 61446] [client 3.248.189.144:50288] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env"] [unique_id "aRutoHSmvb496zZxueLhFAAAAFE"]
[Tue Nov 18 07:20:00.866863 2025] [:error] [pid 61482:tid 61503] [client 3.248.189.144:50306] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.bak"] [unique_id "aRutoPtNHsWZClVWav5gTAAAANA"]
[Tue Nov 18 07:20:01.075856 2025] [:error] [pid 61392:tid 61442] [client 3.248.189.144:50326] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.env.old"] [unique_id "aRutoXSmvb496zZxueLhFQAAAE0"]
[Tue Nov 18 07:20:01.112502 2025] [:error] [pid 61482:tid 61497] [client 3.248.189.144:50314] [client 3.248.189.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.env"] [unique_id "aRutoftNHsWZClVWav5gTQAAAMo"]
[Tue Nov 18 21:37:31.931987 2025] [:error] [pid 3500:tid 3517] [client 45.134.79.103:62226] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRx2m_CbRC7k2D7mjbST1wAAAc8"]
[Tue Nov 18 21:37:32.583012 2025] [:error] [pid 44560:tid 44588] [client 45.134.79.103:54470] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aRx2nAnbP7etF3q5-5vJBwAAANE"]
[Tue Nov 18 21:37:33.256144 2025] [:error] [pid 3500:tid 3513] [client 45.134.79.103:59250] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRx2nfCbRC7k2D7mjbST-QAAAcs"]
[Wed Nov 19 07:30:40.395321 2025] [:error] [pid 6554:tid 6565] [client 18.191.165.250:56959] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR0BoN8rvPWLafJFqmVXCAAAAAY"]
[Wed Nov 19 07:30:40.787797 2025] [:error] [pid 6556:tid 6630] [client 18.191.165.250:57090] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR0BoJuL7hhgrmdM1mt7WAAAAIw"]
[Wed Nov 19 07:30:41.186229 2025] [:error] [pid 6556:tid 6639] [client 18.191.165.250:57199] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR0BoZuL7hhgrmdM1mt7YgAAAJU"]
[Wed Nov 19 07:30:41.579397 2025] [:error] [pid 6555:tid 6611] [client 18.191.165.250:57289] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR0BoUbVJm8eMsGMTCON_AAAAFQ"]
[Wed Nov 19 07:30:41.971007 2025] [:error] [pid 6556:tid 6627] [client 18.191.165.250:57377] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR0BoZuL7hhgrmdM1mt7dgAAAIk"]
[Wed Nov 19 07:37:23.182426 2025] [:error] [pid 26664:tid 26675] [client 34.48.35.91:55440] [client 34.48.35.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aR0DM4pWc1yoj2P7MeAVLAAAAUg"]
[Wed Nov 19 16:26:58.580831 2025] [:error] [pid 12673:tid 12706] [client 103.124.104.216:58830] [client 103.124.104.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR1_Usab1F0fb062dH031gAAAgI"], referer: https://www.google.com
[Wed Nov 19 16:41:16.239788 2025] [:error] [pid 12673:tid 12711] [client 223.185.133.171:32434] [client 223.185.133.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.133.171, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aR2CrMab1F0fb062dH06owAAAgc"]
[Wed Nov 19 16:41:16.244994 2025] [:error] [pid 12673:tid 12711] [client 223.185.133.171:32434] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Nov 19 20:35:58.620424 2025] [:error] [pid 6919:tid 6946] [client 104.196.176.201:54702] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aR25rkYFdN1s_9xJVUmBkAAAARg"]
[Thu Nov 20 00:29:18.242493 2025] [:error] [pid 50223:tid 50343] [client 51.83.25.79:40832] [client 51.83.25.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aR3wXj4iSUKl66cdvvbEiAAAAEg"]
[Thu Nov 20 01:05:01.146375 2025] [:error] [pid 45115:tid 45120] [client 34.30.35.2:59216] [client 34.30.35.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aR34vQGi_fIGlZjI1V4wfAAAAMM"]
[Thu Nov 20 12:10:23.004359 2025] [:error] [pid 55343:tid 55403] [client 98.81.111.26:64252] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6Ur1WlO3EnyVMV7w5lQgAAAIQ"]
[Thu Nov 20 12:10:23.430262 2025] [:error] [pid 34405:tid 34426] [client 98.81.111.26:59882] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJZAAAARM"]
[Thu Nov 20 12:10:23.874922 2025] [:error] [pid 34405:tid 34412] [client 98.81.111.26:57588] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJegAAAQU"]
[Thu Nov 20 12:10:24.293326 2025] [:error] [pid 34405:tid 34415] [client 98.81.111.26:49772] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6UsDFpvu8oRK7ATfvJhAAAAQg"]
[Thu Nov 20 12:10:24.703607 2025] [:error] [pid 34405:tid 34417] [client 98.81.111.26:56916] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6UsDFpvu8oRK7ATfvJjQAAAQo"]
[Thu Nov 20 12:15:53.205384 2025] [:error] [pid 55430:tid 55445] [client 98.81.111.26:49983] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6V-fPZXaIMEU4pE7umMwAAAMw"]
[Thu Nov 20 12:15:53.614783 2025] [:error] [pid 55343:tid 55421] [client 98.81.111.26:52065] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6V-VWlO3EnyVMV7w5o6wAAAJY"]
[Thu Nov 20 12:15:54.022945 2025] [:error] [pid 804:tid 838] [client 98.81.111.26:54031] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6V-vaRHpUlPL9O0Lk5XAAAAY4"]
[Thu Nov 20 12:15:54.428002 2025] [:error] [pid 804:tid 848] [client 98.81.111.26:57541] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6V-vaRHpUlPL9O0Lk5cQAAAZg"]
[Thu Nov 20 12:15:54.834452 2025] [:error] [pid 55430:tid 55448] [client 98.81.111.26:60581] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aR6V-vPZXaIMEU4pE7umSgAAAM8"]
[Thu Nov 20 12:40:53.773176 2025] [:error] [pid 804:tid 824] [client 117.215.175.158:50549] [client 117.215.175.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.215.175.158, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aR6b1faRHpUlPL9O0Lk-tAAAAYg"]
[Thu Nov 20 12:40:53.778127 2025] [:error] [pid 804:tid 824] [client 117.215.175.158:50549] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Nov 20 13:56:16.874720 2025] [:error] [pid 40636:tid 40654] [client 172.104.173.187:50417] [client 172.104.173.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aR6tgAK8BWUoW3xq0HDf4AAAA44"]
[Thu Nov 20 16:14:47.522694 2025] [:error] [pid 34405:tid 34425] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/neshe.php
[Thu Nov 20 16:14:47.787925 2025] [:error] [pid 34405:tid 34412] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/shell1.php
[Thu Nov 20 16:14:48.054599 2025] [:error] [pid 34405:tid 34407] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/sec.php
[Thu Nov 20 16:14:48.609634 2025] [:error] [pid 34405:tid 34427] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/filesss.php
[Thu Nov 20 16:14:48.874739 2025] [:error] [pid 34405:tid 34417] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/ea.php
[Thu Nov 20 16:14:49.162158 2025] [:error] [pid 34405:tid 34415] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/gi.php
[Thu Nov 20 16:14:50.033791 2025] [:error] [pid 34405:tid 34426] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Thu Nov 20 16:14:50.302080 2025] [:error] [pid 34405:tid 34421] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Thu Nov 20 16:14:50.594183 2025] [:error] [pid 34405:tid 34420] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Thu Nov 20 16:14:51.285636 2025] [:error] [pid 34405:tid 34416] [client 20.251.221.145:9225] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Thu Nov 20 16:14:51.546873 2025] [:error] [pid 34405:tid 34423] [client 20.251.221.145:9225] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aR7N-zFpvu8oRK7ATfv7UwAAARA"]
[Thu Nov 20 16:14:52.650903 2025] [:error] [pid 55342:tid 55380] [client 20.251.221.145:9604] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aR7N_Lg6x32Tvk7fIG-9GAAAAEg"]
[Thu Nov 20 16:14:53.517245 2025] [:error] [pid 40445:tid 40497] [client 20.251.221.145:12109] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aR7N_VH-MuFcoWRjXpYuGwAAAlY"]
[Thu Nov 20 16:14:54.823646 2025] [:error] [pid 40415:tid 40440] [client 20.251.221.145:11316] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aR7N_qhjIyLSv09svwOEowAAAdY"]
[Thu Nov 20 16:14:56.353723 2025] [:error] [pid 55342:tid 55374] [client 20.251.221.145:9273] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aR7OALg6x32Tvk7fIG-9IgAAAEI"]
[Thu Nov 20 16:14:57.972148 2025] [:error] [pid 40415:tid 40435] [client 20.251.221.145:11293] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aR7OAahjIyLSv09svwOEqAAAAdE"]
[Thu Nov 20 16:14:58.977713 2025] [:error] [pid 55343:tid 55406] [client 20.251.221.145:10481] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aR7OAlWlO3EnyVMV7w6XMgAAAIc"]
[Thu Nov 20 16:15:00.160765 2025] [:error] [pid 40415:tid 40429] [client 20.251.221.145:17463] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aR7OBKhjIyLSv09svwOErgAAAcs"]
[Thu Nov 20 16:15:01.691639 2025] [:error] [pid 40508:tid 40531] [client 20.251.221.145:12147] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aR7OBaxXNVCMW_ksxPtw5wAAApU"]
[Thu Nov 20 16:15:04.144557 2025] [:error] [pid 55340:tid 55355] [client 20.251.221.145:11264] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aR7OCPOxD-NeMydTybCB6wAAAAo"]
[Thu Nov 20 16:15:05.259292 2025] [:error] [pid 40445:tid 40488] [client 20.251.221.145:5075] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aR7OCVH-MuFcoWRjXpYuJAAAAk0"]
[Thu Nov 20 16:15:07.108126 2025] [:error] [pid 40508:tid 40516] [client 20.251.221.145:17424] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aR7OC6xXNVCMW_ksxPtw6QAAAoY"]
[Thu Nov 20 16:15:08.210118 2025] [:error] [pid 55340:tid 55360] [client 20.251.221.145:9249] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aR7ODPOxD-NeMydTybCB7AAAAA8"]
[Thu Nov 20 16:15:09.654254 2025] [:error] [pid 40445:tid 40481] [client 20.251.221.145:12548] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aR7ODVH-MuFcoWRjXpYuKwAAAkY"]
[Thu Nov 20 16:15:10.560453 2025] [:error] [pid 40508:tid 40510] [client 20.251.221.145:17449] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aR7ODqxXNVCMW_ksxPtw7wAAAoA"]
[Thu Nov 20 16:15:11.802142 2025] [:error] [pid 55342:tid 55385] [client 20.251.221.145:5072] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aR7OD7g6x32Tvk7fIG-9MwAAAE0"]
[Thu Nov 20 16:15:12.970842 2025] [:error] [pid 55342:tid 55386] [client 20.251.221.145:9293] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aR7OELg6x32Tvk7fIG-9NAAAAE4"]
[Thu Nov 20 16:15:14.097055 2025] [:error] [pid 40445:tid 40480] [client 20.251.221.145:12571] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aR7OElH-MuFcoWRjXpYuMAAAAkU"]
[Thu Nov 20 16:15:15.560995 2025] [:error] [pid 34405:tid 34407] [client 20.251.221.145:9301] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aR7OEzFpvu8oRK7ATfv7ZgAAAQA"]
[Thu Nov 20 16:15:16.785713 2025] [:error] [pid 40636:tid 40655] [client 20.251.221.145:12572] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aR7OFAK8BWUoW3xq0HDz1QAAA48"]
[Thu Nov 20 16:15:17.694788 2025] [:error] [pid 40445:tid 40499] [client 20.251.221.145:9229] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aR7OFVH-MuFcoWRjXpYuMgAAAlg"]
[Thu Nov 20 16:15:19.146070 2025] [:error] [pid 40445:tid 40494] [client 20.251.221.145:17434] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aR7OF1H-MuFcoWRjXpYuMwAAAlM"]
[Thu Nov 20 16:15:20.677560 2025] [:error] [pid 55343:tid 55412] [client 20.251.221.145:9375] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aR7OGFWlO3EnyVMV7w6XOQAAAI0"]
[Thu Nov 20 16:15:21.894775 2025] [:error] [pid 55430:tid 55441] [client 20.251.221.145:11607] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aR7OGfPZXaIMEU4pE7vlFwAAAMg"]
[Thu Nov 20 16:15:22.666101 2025] [:error] [pid 34405:tid 34419] [client 20.251.221.145:9243] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aR7OGjFpvu8oRK7ATfv7bQAAAQw"]
[Thu Nov 20 16:15:24.254845 2025] [:error] [pid 40537:tid 40547] [client 20.251.221.145:9354] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aR7OHKKlsL5kxTa3c1zJtgAAAsY"]
[Thu Nov 20 16:15:25.003052 2025] [:error] [pid 40445:tid 40483] [client 20.251.221.145:9285] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aR7OHVH-MuFcoWRjXpYuOQAAAkg"]
[Thu Nov 20 16:15:26.224282 2025] [:error] [pid 40508:tid 40527] [client 20.251.221.145:11639] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aR7OHqxXNVCMW_ksxPtw_QAAApE"]
[Thu Nov 20 16:15:28.344692 2025] [:error] [pid 55430:tid 55455] [client 20.251.221.145:17491] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aR7OIPPZXaIMEU4pE7vlGQAAANY"]
[Thu Nov 20 16:15:29.157733 2025] [:error] [pid 34405:tid 34428] [client 20.251.221.145:17726] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aR7OITFpvu8oRK7ATfv7dQAAARU"]
[Thu Nov 20 16:15:30.407630 2025] [:error] [pid 40445:tid 40492] [client 20.251.221.145:17683] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aR7OIlH-MuFcoWRjXpYuOgAAAlE"]
[Thu Nov 20 16:15:32.114156 2025] [:error] [pid 34405:tid 34427] [client 20.251.221.145:10680] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aR7OJDFpvu8oRK7ATfv7dwAAARQ"]
[Thu Nov 20 16:15:33.288503 2025] [:error] [pid 40508:tid 40512] [client 20.251.221.145:9712] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aR7OJaxXNVCMW_ksxPtxBAAAAoI"]
[Thu Nov 20 16:15:35.957007 2025] [:error] [pid 40445:tid 40494] [client 20.251.221.145:9901] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aR7OJ1H-MuFcoWRjXpYuQAAAAlM"]
[Thu Nov 20 16:15:37.775732 2025] [:error] [pid 40537:tid 40548] [client 20.251.221.145:17741] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aR7OKaKlsL5kxTa3c1zJxwAAAsc"]
[Thu Nov 20 16:15:40.759459 2025] [:error] [pid 34405:tid 34424] [client 20.251.221.145:9971] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aR7OLDFpvu8oRK7ATfv7hwAAARE"]
[Thu Nov 20 16:15:42.164314 2025] [:error] [pid 55343:tid 55399] [client 20.251.221.145:11891] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aR7OLlWlO3EnyVMV7w6XTQAAAIA"]
[Thu Nov 20 16:15:44.086721 2025] [:error] [pid 55343:tid 55407] [client 20.251.221.145:17480] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aR7OMFWlO3EnyVMV7w6XUAAAAIg"]
[Thu Nov 20 16:15:45.647663 2025] [:error] [pid 40508:tid 40529] [client 20.251.221.145:11784] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aR7OMaxXNVCMW_ksxPtxJgAAApM"]
[Thu Nov 20 16:15:46.712081 2025] [:error] [pid 40636:tid 40648] [client 20.251.221.145:11860] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aR7OMgK8BWUoW3xq0HDz7AAAA4g"]
[Thu Nov 20 16:15:48.033516 2025] [:error] [pid 55343:tid 55414] [client 20.251.221.145:11779] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zde.php"] [unique_id "aR7ONFWlO3EnyVMV7w6XUgAAAI8"]
[Thu Nov 20 16:15:49.394323 2025] [:error] [pid 40445:tid 40481] [client 20.251.221.145:13125] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zde.php"] [unique_id "aR7ONVH-MuFcoWRjXpYuRQAAAkY"]
[Thu Nov 20 16:15:50.893473 2025] [:error] [pid 40636:tid 40662] [client 20.251.221.145:13126] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zde.php"] [unique_id "aR7ONgK8BWUoW3xq0HDz7QAAA5Y"]
[Thu Nov 20 16:15:52.699908 2025] [:error] [pid 40415:tid 40427] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/zde.php
[Thu Nov 20 16:15:52.965793 2025] [:error] [pid 40415:tid 40438] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/ifm.php
[Thu Nov 20 16:15:53.230588 2025] [:error] [pid 40415:tid 40439] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/redi.php
[Thu Nov 20 16:15:53.498155 2025] [:error] [pid 40415:tid 40434] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/fns.php
[Thu Nov 20 16:15:53.768367 2025] [:error] [pid 40415:tid 40422] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/pent.php
[Thu Nov 20 16:15:55.341049 2025] [:error] [pid 40415:tid 40422] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/wsx.php
[Thu Nov 20 16:15:55.605667 2025] [:error] [pid 40415:tid 40420] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/r79.php
[Thu Nov 20 16:15:55.880307 2025] [:error] [pid 40415:tid 40432] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/mpxct.php
[Thu Nov 20 16:15:56.144536 2025] [:error] [pid 40415:tid 40425] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/x3.php
[Thu Nov 20 16:15:57.494194 2025] [:error] [pid 40415:tid 40425] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/wan.php
[Thu Nov 20 16:15:57.797349 2025] [:error] [pid 40415:tid 40436] [client 20.251.221.145:9856] File does not exist: /usr/local/apache/htdocs/suspended-page/iov.php
[Thu Nov 20 16:15:58.066352 2025] [:error] [pid 40415:tid 40431] [client 20.251.221.145:9856] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aR7OPqhjIyLSv09svwOE3gAAAc0"]
[Thu Nov 20 16:15:59.747173 2025] [:error] [pid 34405:tid 34431] [client 20.251.221.145:11046] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aR7OPzFpvu8oRK7ATfv7jgAAARg"]
[Thu Nov 20 16:16:01.866430 2025] [:error] [pid 40537:tid 40556] [client 20.251.221.145:13912] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aR7OQaKlsL5kxTa3c1zJzAAAAs8"]
[Thu Nov 20 16:16:04.673811 2025] [:error] [pid 40445:tid 40494] [client 20.251.221.145:11354] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aR7ORFH-MuFcoWRjXpYuTgAAAlM"]
[Thu Nov 20 16:16:05.461005 2025] [:error] [pid 55343:tid 55402] [client 20.251.221.145:11344] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aR7ORVWlO3EnyVMV7w6XYwAAAIM"]
[Thu Nov 20 16:16:07.062714 2025] [:error] [pid 55342:tid 55385] [client 20.251.221.145:13161] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aR7OR7g6x32Tvk7fIG-9TgAAAE0"]
[Thu Nov 20 16:16:09.101025 2025] [:error] [pid 55342:tid 55390] [client 20.251.221.145:18046] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aR7OSbg6x32Tvk7fIG-9UAAAAFI"]
[Thu Nov 20 16:16:10.149828 2025] [:error] [pid 40415:tid 40420] [client 20.251.221.145:18015] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asgtt.php"] [unique_id "aR7OSqhjIyLSv09svwOE4wAAAcI"]
[Thu Nov 20 16:16:11.184027 2025] [:error] [pid 40508:tid 40521] [client 20.251.221.145:14131] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aR7OS6xXNVCMW_ksxPtxRQAAAos"]
[Thu Nov 20 16:16:12.855956 2025] [:error] [pid 40445:tid 40492] [client 20.251.221.145:18034] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aR7OTFH-MuFcoWRjXpYuVwAAAlE"]
[Thu Nov 20 16:16:14.193776 2025] [:error] [pid 40445:tid 40480] [client 20.251.221.145:11534] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aR7OTlH-MuFcoWRjXpYuWQAAAkU"]
[Thu Nov 20 16:16:15.530943 2025] [:error] [pid 55342:tid 55381] [client 20.251.221.145:17986] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aR7OT7g6x32Tvk7fIG-9WAAAAEk"]
[Thu Nov 20 16:16:16.748929 2025] [:error] [pid 40636:tid 40642] [client 20.251.221.145:12079] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wok.php"] [unique_id "aR7OUAK8BWUoW3xq0HDz_QAAA4I"]
[Thu Nov 20 16:16:17.611110 2025] [:error] [pid 55340:tid 55359] [client 20.251.221.145:13923] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wok.php"] [unique_id "aR7OUfOxD-NeMydTybCCKwAAAA4"]
[Thu Nov 20 16:16:18.477353 2025] [:error] [pid 40537:tid 40551] [client 20.251.221.145:12047] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wok.php"] [unique_id "aR7OUqKlsL5kxTa3c1zJ4AAAAso"]
[Thu Nov 20 16:16:19.887952 2025] [:error] [pid 40508:tid 40529] [client 20.251.221.145:14123] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wok.php"] [unique_id "aR7OU6xXNVCMW_ksxPtxVQAAApM"]
[Thu Nov 20 16:16:20.901870 2025] [:error] [pid 55340:tid 55369] [client 20.251.221.145:11009] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alexus.php"] [unique_id "aR7OVPOxD-NeMydTybCCMAAAABg"]
[Thu Nov 20 16:16:22.359292 2025] [:error] [pid 40537:tid 40544] [client 20.251.221.145:12040] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alexus.php"] [unique_id "aR7OVqKlsL5kxTa3c1zJ4gAAAsM"]
[Thu Nov 20 16:16:23.797827 2025] [:error] [pid 55342:tid 55382] [client 20.251.221.145:14086] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alexus.php"] [unique_id "aR7OV7g6x32Tvk7fIG-9WwAAAEo"]
[Thu Nov 20 16:16:25.699072 2025] [:error] [pid 34405:tid 34407] [client 20.251.221.145:14173] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alexus.php"] [unique_id "aR7OWTFpvu8oRK7ATfv7lQAAAQA"]
[Thu Nov 20 16:16:27.019495 2025] [:error] [pid 40445:tid 40478] [client 20.251.221.145:14104] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadis.php"] [unique_id "aR7OW1H-MuFcoWRjXpYuXwAAAkM"]
[Thu Nov 20 16:16:28.567187 2025] [:error] [pid 40636:tid 40660] [client 20.251.221.145:12061] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadis.php"] [unique_id "aR7OXAK8BWUoW3xq0HD0DAAAA5Q"]
[Thu Nov 20 16:16:30.042011 2025] [:error] [pid 40445:tid 40475] [client 20.251.221.145:10216] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadis.php"] [unique_id "aR7OXlH-MuFcoWRjXpYuZAAAAkA"]
[Thu Nov 20 16:16:31.094249 2025] [:error] [pid 40415:tid 40433] [client 20.251.221.145:12845] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadis.php"] [unique_id "aR7OX6hjIyLSv09svwOE9wAAAc8"]
[Thu Nov 20 16:16:32.905055 2025] [:error] [pid 55340:tid 55363] [client 20.251.221.145:18353] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aR7OYPOxD-NeMydTybCCNwAAABI"]
[Thu Nov 20 16:16:33.875335 2025] [:error] [pid 55430:tid 55443] [client 20.251.221.145:13591] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aR7OYfPZXaIMEU4pE7vlPAAAAMo"]
[Thu Nov 20 16:16:35.039731 2025] [:error] [pid 40508:tid 40532] [client 20.251.221.145:12387] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aR7OY6xXNVCMW_ksxPtxawAAApY"]
[Thu Nov 20 16:16:36.356065 2025] [:error] [pid 40508:tid 40531] [client 20.251.221.145:13694] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admir.php"] [unique_id "aR7OZKxXNVCMW_ksxPtxcAAAApU"]
[Thu Nov 20 16:16:37.806388 2025] [:error] [pid 34405:tid 34415] [client 20.251.221.145:13693] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aR7OZTFpvu8oRK7ATfv7ngAAAQg"]
[Thu Nov 20 16:16:39.996806 2025] [:error] [pid 55342:tid 55379] [client 20.251.221.145:18310] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aR7OZ7g6x32Tvk7fIG-9bAAAAEc"]
[Thu Nov 20 16:16:41.928608 2025] [:error] [pid 55343:tid 55418] [client 20.251.221.145:18328] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aR7OaVWlO3EnyVMV7w6XhgAAAJM"]
[Thu Nov 20 16:16:42.868890 2025] [:error] [pid 55343:tid 55412] [client 20.251.221.145:5031] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "aR7OalWlO3EnyVMV7w6XiAAAAI0"]
[Thu Nov 20 16:16:44.313366 2025] [:error] [pid 34405:tid 34429] [client 20.251.221.145:14367] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aR7ObDFpvu8oRK7ATfv7oQAAARY"]
[Thu Nov 20 16:16:44.942280 2025] [:error] [pid 40636:tid 40656] [client 20.251.221.145:14433] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aR7ObAK8BWUoW3xq0HD0KQAAA5A"]
[Thu Nov 20 16:16:46.570552 2025] [:error] [pid 40508:tid 40530] [client 20.251.221.145:18402] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aR7ObqxXNVCMW_ksxPtxeAAAApQ"]
[Thu Nov 20 16:16:48.523309 2025] [:error] [pid 34405:tid 34411] [client 20.251.221.145:13347] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aR7OcDFpvu8oRK7ATfv7ogAAAQQ"]
[Thu Nov 20 16:16:50.565950 2025] [:error] [pid 40445:tid 40494] [client 20.251.221.145:14420] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0.php"] [unique_id "aR7OclH-MuFcoWRjXpYueQAAAlM"]
[Thu Nov 20 16:16:52.032996 2025] [:error] [pid 34405:tid 34407] [client 20.251.221.145:9448] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0.php"] [unique_id "aR7OdDFpvu8oRK7ATfv7pAAAAQA"]
[Thu Nov 20 16:16:53.660256 2025] [:error] [pid 40508:tid 40520] [client 20.251.221.145:18427] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0.php"] [unique_id "aR7OdaxXNVCMW_ksxPtxgQAAAoo"]
[Thu Nov 20 16:16:54.860633 2025] [:error] [pid 34405:tid 34425] [client 20.251.221.145:14404] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0.php"] [unique_id "aR7OdjFpvu8oRK7ATfv7pQAAARI"]
[Thu Nov 20 16:16:56.092726 2025] [:error] [pid 55430:tid 55454] [client 20.251.221.145:13391] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsr2.php"] [unique_id "aR7OePPZXaIMEU4pE7vlRAAAANU"]
[Thu Nov 20 16:16:57.189378 2025] [:error] [pid 55430:tid 55448] [client 20.251.221.145:13352] File does not exist: /usr/local/apache/htdocs/suspended-page/wsr2.php
[Thu Nov 20 16:16:57.881517 2025] [:error] [pid 55430:tid 55453] [client 20.251.221.145:13352] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv.php
[Thu Nov 20 16:16:58.147348 2025] [:error] [pid 55430:tid 55434] [client 20.251.221.145:13352] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php.php
[Thu Nov 20 16:16:58.960539 2025] [:error] [pid 55430:tid 55439] [client 20.251.221.145:13352] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Thu Nov 20 16:16:59.226568 2025] [:error] [pid 55430:tid 55445] [client 20.251.221.145:13352] File does not exist: /usr/local/apache/htdocs/suspended-page/siln.php
[Thu Nov 20 16:16:59.490607 2025] [:error] [pid 55430:tid 55444] [client 20.251.221.145:13352] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Thu Nov 20 16:16:59.750379 2025] [:error] [pid 55430:tid 55441] [client 20.251.221.145:13352] [client 20.251.221.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aR7Oe_PZXaIMEU4pE7vlUQAAAMg"]
[Thu Nov 20 16:17:01.076482 2025] [:error] [pid 40636:tid 40647] [client 20.251.221.145:15503] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Thu Nov 20 16:17:01.360260 2025] [:error] [pid 40636:tid 40663] [client 20.251.221.145:15503] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Nov 20 16:17:01.764505 2025] [:error] [pid 40636:tid 40662] [client 20.251.221.145:15503] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Nov 20 16:17:02.365485 2025] [:error] [pid 40636:tid 40652] [client 20.251.221.145:15503] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Nov 20 16:17:02.641263 2025] [:error] [pid 40636:tid 40651] [client 20.251.221.145:15503] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Nov 20 16:17:02.910785 2025] [:error] [pid 40636:tid 40643] [client 20.251.221.145:15503] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aR7OfgK8BWUoW3xq0HD0PQAAA4M"]
[Thu Nov 20 16:17:03.896487 2025] [:error] [pid 55340:tid 55368] [client 20.251.221.145:12900] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aR7Of_OxD-NeMydTybCCRQAAABc"]
[Thu Nov 20 16:17:05.310415 2025] [:error] [pid 40445:tid 40483] [client 20.251.221.145:15860] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aR7OgVH-MuFcoWRjXpYufQAAAkg"]
[Thu Nov 20 16:17:06.770142 2025] [:error] [pid 55340:tid 55348] [client 20.251.221.145:15935] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aR7OgvOxD-NeMydTybCCRgAAAAM"]
[Thu Nov 20 16:17:07.954668 2025] [:error] [pid 55430:tid 55454] [client 20.251.221.145:16141] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aR7Og_PZXaIMEU4pE7vlUgAAANU"]
[Thu Nov 20 16:17:10.176816 2025] [:error] [pid 40508:tid 40515] [client 20.251.221.145:18861] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aR7OhqxXNVCMW_ksxPtxjAAAAoU"]
[Thu Nov 20 16:17:12.543465 2025] [:error] [pid 40508:tid 40533] [client 20.251.221.145:15861] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aR7OiKxXNVCMW_ksxPtxjgAAApc"]
[Thu Nov 20 16:17:16.044055 2025] [:error] [pid 34405:tid 34410] [client 20.251.221.145:15755] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aR7OjDFpvu8oRK7ATfv7qwAAAQM"]
[Thu Nov 20 16:17:17.606370 2025] [:error] [pid 34405:tid 34415] [client 20.251.221.145:15754] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aR7OjTFpvu8oRK7ATfv7rQAAAQg"]
[Thu Nov 20 16:17:20.095661 2025] [:error] [pid 40508:tid 40524] [client 20.251.221.145:15870] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aR7OkKxXNVCMW_ksxPtxlwAAAo4"]
[Thu Nov 20 16:17:21.707318 2025] [:error] [pid 34405:tid 34414] [client 20.251.221.145:14782] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aR7OkTFpvu8oRK7ATfv7tAAAAQc"]
[Thu Nov 20 16:17:23.184129 2025] [:error] [pid 34405:tid 34428] [client 20.251.221.145:12890] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aR7OkzFpvu8oRK7ATfv7tQAAARU"]
[Thu Nov 20 16:17:24.748391 2025] [:error] [pid 55342:tid 55380] [client 20.251.221.145:12622] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aR7OlLg6x32Tvk7fIG-9jAAAAEg"]
[Thu Nov 20 16:17:26.306382 2025] [:error] [pid 40445:tid 40478] [client 20.251.221.145:10144] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aR7OllH-MuFcoWRjXpYuiAAAAkM"]
[Thu Nov 20 16:17:27.284078 2025] [:error] [pid 40415:tid 40441] [client 20.251.221.145:14726] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aR7Ol6hjIyLSv09svwOFEgAAAdc"]
[Thu Nov 20 16:17:28.817883 2025] [:error] [pid 40636:tid 40649] [client 20.251.221.145:10128] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aR7OmAK8BWUoW3xq0HD0QAAAA4k"]
[Thu Nov 20 16:17:31.158617 2025] [:error] [pid 40537:tid 40548] [client 20.251.221.145:14743] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aR7Om6KlsL5kxTa3c1zJ_QAAAsc"]
[Thu Nov 20 16:17:32.084532 2025] [:error] [pid 40508:tid 40518] [client 20.251.221.145:10163] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aR7OnKxXNVCMW_ksxPtxoAAAAog"]
[Thu Nov 20 16:17:35.206841 2025] [:error] [pid 40508:tid 40517] [client 20.251.221.145:16508] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aR7On6xXNVCMW_ksxPtxqQAAAoc"]
[Thu Nov 20 16:17:37.172896 2025] [:error] [pid 40415:tid 40440] [client 20.251.221.145:14746] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aR7OoahjIyLSv09svwOFFAAAAdY"]
[Thu Nov 20 16:17:38.334017 2025] [:error] [pid 40445:tid 40491] [client 20.251.221.145:16200] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aR7OolH-MuFcoWRjXpYujQAAAlA"]
[Thu Nov 20 16:17:39.408296 2025] [:error] [pid 40445:tid 40487] [client 20.251.221.145:10113] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aR7Oo1H-MuFcoWRjXpYujwAAAkw"]
[Thu Nov 20 16:17:40.830589 2025] [:error] [pid 40445:tid 40499] [client 20.251.221.145:10152] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aR7OpFH-MuFcoWRjXpYukwAAAlg"]
[Thu Nov 20 16:17:41.968727 2025] [:error] [pid 40445:tid 40479] [client 20.251.221.145:15877] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aR7OpVH-MuFcoWRjXpYumQAAAkQ"]
[Thu Nov 20 16:17:43.261739 2025] [:error] [pid 55343:tid 55414] [client 20.251.221.145:15092] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aR7Op1WlO3EnyVMV7w6XmAAAAI8"]
[Thu Nov 20 16:17:44.425325 2025] [:error] [pid 34405:tid 34423] [client 20.251.221.145:14759] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aR7OqDFpvu8oRK7ATfv7uQAAARA"]
[Thu Nov 20 16:17:45.535413 2025] [:error] [pid 55340:tid 55347] [client 20.251.221.145:14784] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aR7OqfOxD-NeMydTybCCUwAAAAI"]
[Thu Nov 20 16:17:46.602282 2025] [:error] [pid 34405:tid 34431] [client 20.251.221.145:16206] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fileas.php"] [unique_id "aR7OqjFpvu8oRK7ATfv7ugAAARg"]
[Thu Nov 20 16:17:47.816068 2025] [:error] [pid 55342:tid 55382] [client 20.251.221.145:15103] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7Oq7g6x32Tvk7fIG-9qgAAAEo"]
[Thu Nov 20 16:17:49.078177 2025] [:error] [pid 55340:tid 55346] [client 20.251.221.145:4222] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7OrfOxD-NeMydTybCCXAAAAAE"]
[Thu Nov 20 16:17:51.090086 2025] [:error] [pid 55340:tid 55345] [client 20.251.221.145:15101] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7Or_OxD-NeMydTybCCYAAAAAA"]
[Thu Nov 20 16:17:51.929611 2025] [:error] [pid 40508:tid 40532] [client 20.251.221.145:4200] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7Or6xXNVCMW_ksxPtxtwAAApY"]
[Thu Nov 20 16:17:52.959334 2025] [:error] [pid 55340:tid 55348] [client 20.251.221.145:10155] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7OsPOxD-NeMydTybCCZAAAAAM"]
[Thu Nov 20 16:17:54.185443 2025] [:error] [pid 55430:tid 55433] [client 20.251.221.145:4171] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7OsvPZXaIMEU4pE7vlaQAAAMA"]
[Thu Nov 20 16:17:55.702777 2025] [:error] [pid 55340:tid 55346] [client 20.251.221.145:10123] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7Os_OxD-NeMydTybCCcQAAAAE"]
[Thu Nov 20 16:17:56.588162 2025] [:error] [pid 55430:tid 55437] [client 20.251.221.145:10138] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7OtPPZXaIMEU4pE7vlbwAAAMQ"]
[Thu Nov 20 16:17:57.751109 2025] [:error] [pid 40537:tid 40554] [client 20.251.221.145:16490] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aR7OtaKlsL5kxTa3c1zKEQAAAs0"]
[Thu Nov 20 16:17:58.951950 2025] [:error] [pid 40537:tid 40559] [client 20.251.221.145:16404] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aR7OtqKlsL5kxTa3c1zKEgAAAtI"]
[Thu Nov 20 16:18:00.463776 2025] [:error] [pid 55342:tid 55390] [client 20.251.221.145:16215] [client 20.251.221.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aR7OuLg6x32Tvk7fIG-9swAAAFI"]
[Thu Nov 20 16:18:02.875509 2025] [:error] [pid 40445:tid 40481] [client 20.251.221.145:15350] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Thu Nov 20 16:18:03.139709 2025] [:error] [pid 40445:tid 40492] [client 20.251.221.145:15350] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Nov 20 19:44:21.271332 2025] [:error] [pid 40445:tid 40498] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Nov 20 19:44:21.650303 2025] [:error] [pid 40445:tid 40492] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Thu Nov 20 19:44:21.825051 2025] [:error] [pid 40445:tid 40483] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Nov 20 19:44:21.994917 2025] [:error] [pid 40445:tid 40493] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Nov 20 19:44:22.167112 2025] [:error] [pid 40445:tid 40476] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Nov 20 19:44:22.317722 2025] [:error] [pid 40445:tid 40482] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Nov 20 19:44:22.469819 2025] [:error] [pid 40445:tid 40495] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Thu Nov 20 19:44:22.642610 2025] [:error] [pid 40445:tid 40477] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Nov 20 19:44:22.793886 2025] [:error] [pid 40445:tid 40496] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Nov 20 19:44:22.957184 2025] [:error] [pid 40445:tid 40499] [client 4.217.160.29:1703] File does not exist: /usr/local/apache/htdocs/suspended-page/astab.php
[Thu Nov 20 19:44:23.126124 2025] [:error] [pid 40445:tid 40478] [client 4.217.160.29:1703] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aR7_F1H-MuFcoWRjXpZpwgAAAkM"]
[Thu Nov 20 19:44:24.828194 2025] [:error] [pid 40445:tid 40476] [client 4.217.160.29:1675] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aR7_GFH-MuFcoWRjXpZpygAAAkE"]
[Thu Nov 20 19:44:39.638444 2025] [:error] [pid 55430:tid 55449] [client 4.217.160.29:1690] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aR7_J_PZXaIMEU4pE7sKnAAAANA"]
[Thu Nov 20 19:44:41.615910 2025] [:error] [pid 55343:tid 55423] [client 4.217.160.29:1688] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aR7_KVWlO3EnyVMV7w67oQAAAJg"]
[Thu Nov 20 19:44:44.656736 2025] [:error] [pid 40415:tid 40435] [client 4.217.160.29:1407] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aR7_LKhjIyLSv09svwO1PgAAAdE"]
[Thu Nov 20 19:44:45.228938 2025] [:error] [pid 55340:tid 55350] [client 4.217.160.29:1354] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aR7_LfOxD-NeMydTybCo7gAAAAU"]
[Thu Nov 20 19:44:47.340771 2025] [:error] [pid 40415:tid 40437] [client 4.217.160.29:1392] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless2.php"] [unique_id "aR7_L6hjIyLSv09svwO1PwAAAdM"]
[Thu Nov 20 19:44:49.081848 2025] [:error] [pid 55342:tid 55395] [client 4.217.160.29:1363] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless2.php"] [unique_id "aR7_Mbg6x32Tvk7fIG_pvwAAAFc"]
[Thu Nov 20 19:44:50.008190 2025] [:error] [pid 40415:tid 40436] [client 4.217.160.29:1709] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless2.php"] [unique_id "aR7_MqhjIyLSv09svwO1SgAAAdI"]
[Thu Nov 20 19:44:56.275234 2025] [:error] [pid 55343:tid 55418] [client 4.217.160.29:1710] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless2.php"] [unique_id "aR7_OFWlO3EnyVMV7w67tAAAAJM"]
[Thu Nov 20 19:44:58.012096 2025] [:error] [pid 40636:tid 40642] [client 4.217.160.29:1697] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aR7_OgK8BWUoW3xq0HAXhgAAA4I"]
[Thu Nov 20 19:45:00.065347 2025] [:error] [pid 40445:tid 40475] [client 4.217.160.29:1346] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aR7_PFH-MuFcoWRjXpZqEQAAAkA"]
[Thu Nov 20 19:45:03.089336 2025] [:error] [pid 40445:tid 40486] [client 4.217.160.29:64657] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aR7_P1H-MuFcoWRjXpZqFQAAAks"]
[Thu Nov 20 19:45:06.560401 2025] [:error] [pid 40537:tid 40546] [client 4.217.160.29:1682] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aR7_QqKlsL5kxTa3c1zs4gAAAsU"]
[Thu Nov 20 19:45:08.018536 2025] [:error] [pid 55343:tid 55403] [client 4.217.160.29:1377] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aR7_RFWlO3EnyVMV7w67vgAAAIQ"]
[Thu Nov 20 19:45:08.899375 2025] [:error] [pid 34405:tid 34428] [client 4.217.160.29:1711] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aR7_RDFpvu8oRK7ATfslXAAAARU"]
[Thu Nov 20 19:45:09.717174 2025] [:error] [pid 40445:tid 40495] [client 4.217.160.29:1367] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aR7_RVH-MuFcoWRjXpZqKgAAAlQ"]
[Thu Nov 20 19:45:10.630131 2025] [:error] [pid 40445:tid 40485] [client 4.217.160.29:1700] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aR7_RlH-MuFcoWRjXpZqMgAAAko"]
[Thu Nov 20 19:45:11.440237 2025] [:error] [pid 40445:tid 40494] [client 4.217.160.29:1357] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7_R1H-MuFcoWRjXpZqNAAAAlM"]
[Thu Nov 20 19:45:13.062277 2025] [:error] [pid 55343:tid 55412] [client 4.217.160.29:1374] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7_SVWlO3EnyVMV7w67wQAAAI0"]
[Thu Nov 20 19:45:15.273413 2025] [:error] [pid 55342:tid 55383] [client 4.217.160.29:1672] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7_S7g6x32Tvk7fIG_pzgAAAEs"]
[Thu Nov 20 19:45:20.724081 2025] [:error] [pid 40415:tid 40419] [client 4.217.160.29:1394] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aR7_UKhjIyLSv09svwO1aQAAAcE"]
[Thu Nov 20 19:45:23.230466 2025] [:error] [pid 55343:tid 55413] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Nov 20 19:45:23.380791 2025] [:error] [pid 55343:tid 55412] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/cool.php
[Thu Nov 20 19:45:23.538323 2025] [:error] [pid 55343:tid 55402] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Nov 20 19:45:23.689117 2025] [:error] [pid 55343:tid 55410] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/dejavu.php
[Thu Nov 20 19:45:23.862172 2025] [:error] [pid 55343:tid 55404] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/faq.php
[Thu Nov 20 19:45:24.117632 2025] [:error] [pid 55343:tid 55406] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Thu Nov 20 19:45:24.471474 2025] [:error] [pid 55343:tid 55415] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Nov 20 19:45:24.622078 2025] [:error] [pid 55343:tid 55423] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/file17.php
[Thu Nov 20 19:45:24.772822 2025] [:error] [pid 55343:tid 55407] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Nov 20 19:45:25.094223 2025] [:error] [pid 55343:tid 55422] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Thu Nov 20 19:45:25.281356 2025] [:error] [pid 55343:tid 55401] [client 4.217.160.29:1664] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Nov 20 19:45:25.428904 2025] [:error] [pid 55343:tid 55413] [client 4.217.160.29:1664] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aR7_VVWlO3EnyVMV7w674gAAAI4"]
[Thu Nov 20 19:45:29.190146 2025] [:error] [pid 55342:tid 55374] [client 4.217.160.29:1686] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aR7_Wbg6x32Tvk7fIG_p5QAAAEI"]
[Thu Nov 20 19:45:31.742624 2025] [:error] [pid 40508:tid 40532] [client 4.217.160.29:1795] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aR7_W6xXNVCMW_ksxPu-SQAAApY"]
[Thu Nov 20 19:45:35.936611 2025] [:error] [pid 40415:tid 40438] [client 4.217.160.29:1825] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aR7_X6hjIyLSv09svwO1hwAAAdQ"]
[Thu Nov 20 19:45:37.757603 2025] [:error] [pid 34405:tid 34428] [client 4.217.160.29:1373] [client 4.217.160.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aR7_YTFpvu8oRK7ATfslfgAAARU"]
[Thu Nov 20 19:45:42.261928 2025] [:error] [pid 40508:tid 40513] [client 4.217.160.29:64650] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "aR7_ZqxXNVCMW_ksxPu-WQAAAoM"]
[Thu Nov 20 19:45:45.359122 2025] [:error] [pid 55340:tid 55359] [client 4.217.160.29:1720] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "aR7_afOxD-NeMydTybCpGgAAAA4"]
[Thu Nov 20 19:45:47.120762 2025] [:error] [pid 40415:tid 40423] [client 4.217.160.29:1715] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "aR7_a6hjIyLSv09svwO1jQAAAcU"]
[Thu Nov 20 19:45:51.453777 2025] [:error] [pid 40537:tid 40565] [client 4.217.160.29:64673] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aR7_b6KlsL5kxTa3c1ztBwAAAtg"]
[Thu Nov 20 19:45:52.443416 2025] [:error] [pid 55342:tid 55385] [client 4.217.160.29:1667] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aR7_cLg6x32Tvk7fIG_qBwAAAE0"]
[Thu Nov 20 19:45:54.596232 2025] [:error] [pid 40508:tid 40516] [client 4.217.160.29:1794] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aR7_cqxXNVCMW_ksxPu-YgAAAoY"]
[Thu Nov 20 19:45:58.385137 2025] [:error] [pid 55430:tid 55445] [client 4.217.160.29:1706] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aR7_dvPZXaIMEU4pE7sK6gAAAMw"]
[Thu Nov 20 19:45:59.199865 2025] [:error] [pid 55342:tid 55392] [client 4.217.160.29:1382] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/golden.php"] [unique_id "aR7_d7g6x32Tvk7fIG_qEQAAAFQ"]
[Thu Nov 20 19:46:02.530679 2025] [:error] [pid 40636:tid 40660] [client 4.217.160.29:1386] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/golden.php"] [unique_id "aR7_egK8BWUoW3xq0HAXxgAAA5Q"]
[Thu Nov 20 19:46:04.898856 2025] [:error] [pid 40636:tid 40664] [client 4.217.160.29:1389] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/golden.php"] [unique_id "aR7_fAK8BWUoW3xq0HAXyQAAA5g"]
[Thu Nov 20 19:46:08.086504 2025] [:error] [pid 40636:tid 40644] [client 4.217.160.29:61461] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/golden.php"] [unique_id "aR7_gAK8BWUoW3xq0HAXzgAAA4Q"]
[Thu Nov 20 19:46:12.951695 2025] [:error] [pid 55430:tid 55446] [client 4.217.160.29:1668] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aR7_hPPZXaIMEU4pE7sK_QAAAM0"]
[Thu Nov 20 19:46:13.965896 2025] [:error] [pid 55343:tid 55409] [client 4.217.160.29:1369] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aR7_hVWlO3EnyVMV7w68FwAAAIo"]
[Thu Nov 20 19:46:15.605766 2025] [:error] [pid 55343:tid 55405] [client 4.217.160.29:1358] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aR7_h1WlO3EnyVMV7w68HQAAAIY"]
[Thu Nov 20 19:46:17.373097 2025] [:error] [pid 34405:tid 34427] [client 4.217.160.29:64643] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aR7_iTFpvu8oRK7ATfslowAAARQ"]
[Thu Nov 20 19:46:18.279598 2025] [:error] [pid 34405:tid 34422] [client 4.217.160.29:1691] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aR7_ijFpvu8oRK7ATfslpAAAAQ8"]
[Thu Nov 20 19:46:19.331960 2025] [:error] [pid 55342:tid 55388] [client 4.217.160.29:1364] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aR7_i7g6x32Tvk7fIG_qGgAAAFA"]
[Thu Nov 20 19:46:21.306725 2025] [:error] [pid 55340:tid 55367] [client 4.217.160.29:64653] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aR7_jfOxD-NeMydTybCpPAAAABY"]
[Thu Nov 20 19:46:24.537327 2025] [:error] [pid 40508:tid 40515] [client 4.217.160.29:61444] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aR7_kKxXNVCMW_ksxPu-bQAAAoU"]
[Thu Nov 20 19:46:27.154098 2025] [:error] [pid 40537:tid 40547] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Nov 20 19:46:27.700249 2025] [:error] [pid 40537:tid 40545] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Thu Nov 20 19:46:27.873880 2025] [:error] [pid 40537:tid 40546] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Nov 20 19:46:28.027021 2025] [:error] [pid 40537:tid 40565] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Nov 20 19:46:28.198607 2025] [:error] [pid 40537:tid 40558] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Thu Nov 20 19:46:28.356460 2025] [:error] [pid 40537:tid 40544] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Thu Nov 20 19:46:28.624795 2025] [:error] [pid 40537:tid 40553] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Thu Nov 20 19:46:28.775201 2025] [:error] [pid 40537:tid 40541] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/ot.php
[Thu Nov 20 19:46:28.925684 2025] [:error] [pid 40537:tid 40557] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php
[Thu Nov 20 19:46:29.075952 2025] [:error] [pid 40537:tid 40562] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/pepe.php
[Thu Nov 20 19:46:29.229135 2025] [:error] [pid 40537:tid 40552] [client 4.217.160.29:1344] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Thu Nov 20 19:46:29.377049 2025] [:error] [pid 40537:tid 40551] [client 4.217.160.29:1344] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aR7_laKlsL5kxTa3c1ztOgAAAso"]
[Thu Nov 20 19:46:32.235362 2025] [:error] [pid 55342:tid 55396] [client 4.217.160.29:1684] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aR7_mLg6x32Tvk7fIG_qIwAAAFg"]
[Thu Nov 20 19:46:34.259418 2025] [:error] [pid 40508:tid 40530] [client 4.217.160.29:1368] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aR7_mqxXNVCMW_ksxPu-egAAApQ"]
[Thu Nov 20 19:46:38.552742 2025] [:error] [pid 40636:tid 40653] [client 4.217.160.29:1724] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aR7_ngK8BWUoW3xq0HAX6wAAA40"]
[Thu Nov 20 19:46:39.471250 2025] [:error] [pid 55340:tid 55353] [client 4.217.160.29:1398] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aR7_n_OxD-NeMydTybCpQQAAAAg"]
[Thu Nov 20 19:46:40.249680 2025] [:error] [pid 34405:tid 34429] [client 4.217.160.29:1698] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aR7_oDFpvu8oRK7ATfslrAAAARY"]
[Thu Nov 20 19:46:41.189811 2025] [:error] [pid 40636:tid 40645] [client 4.217.160.29:1680] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aR7_oQK8BWUoW3xq0HAX8gAAA4U"]
[Thu Nov 20 19:46:42.396093 2025] [:error] [pid 55430:tid 55434] [client 4.217.160.29:64651] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aR7_ovPZXaIMEU4pE7sLCwAAAME"]
[Thu Nov 20 19:46:43.782306 2025] [:error] [pid 40445:tid 40497] [client 4.217.160.29:1722] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7_o1H-MuFcoWRjXpZq5AAAAlY"]
[Thu Nov 20 19:46:45.442480 2025] [:error] [pid 55342:tid 55377] [client 4.217.160.29:1793] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7_pbg6x32Tvk7fIG_qLgAAAEU"]
[Thu Nov 20 19:46:46.650281 2025] [:error] [pid 40445:tid 40488] [client 4.217.160.29:1719] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7_plH-MuFcoWRjXpZq8AAAAk0"]
[Thu Nov 20 19:46:48.180964 2025] [:error] [pid 55342:tid 55378] [client 4.217.160.29:1402] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aR7_qLg6x32Tvk7fIG_qMwAAAEY"]
[Thu Nov 20 19:46:50.550640 2025] [:error] [pid 40445:tid 40479] [client 4.217.160.29:1702] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aR7_qlH-MuFcoWRjXpZq-gAAAkQ"]
[Thu Nov 20 19:46:52.302206 2025] [:error] [pid 55430:tid 55447] [client 4.217.160.29:1721] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aR7_rPPZXaIMEU4pE7sLEgAAAM4"]
[Thu Nov 20 19:46:52.859425 2025] [:error] [pid 40636:tid 40641] [client 4.217.160.29:1388] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aR7_rAK8BWUoW3xq0HAYEwAAA4E"]
[Thu Nov 20 19:46:58.222166 2025] [:error] [pid 40636:tid 40662] [client 4.217.160.29:1400] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aR7_sgK8BWUoW3xq0HAYIQAAA5Y"]
[Thu Nov 20 19:47:01.745064 2025] [:error] [pid 40508:tid 40532] [client 4.217.160.29:1399] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "aR7_taxXNVCMW_ksxPu-zwAAApY"]
[Thu Nov 20 19:47:04.207330 2025] [:error] [pid 55430:tid 55434] [client 4.217.160.29:61454] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "aR7_uPPZXaIMEU4pE7sLMQAAAME"]
[Thu Nov 20 19:47:06.003906 2025] [:error] [pid 40537:tid 40553] [client 4.217.160.29:64695] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "aR7_uqKlsL5kxTa3c1zteAAAAsw"]
[Thu Nov 20 19:47:07.444364 2025] [:error] [pid 40537:tid 40557] [client 4.217.160.29:1370] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "aR7_u6KlsL5kxTa3c1ztegAAAtA"]
[Thu Nov 20 19:47:08.383039 2025] [:error] [pid 40636:tid 40654] [client 4.217.160.29:1678] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logiin.php"] [unique_id "aR7_vAK8BWUoW3xq0HAYQAAAA44"]
[Thu Nov 20 19:47:11.103784 2025] [:error] [pid 55343:tid 55415] [client 4.217.160.29:1396] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logiin.php"] [unique_id "aR7_v1WlO3EnyVMV7w68XAAAAJA"]
[Thu Nov 20 19:47:12.553839 2025] [:error] [pid 40445:tid 40486] [client 4.217.160.29:1669] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logiin.php"] [unique_id "aR7_wFH-MuFcoWRjXpZrGQAAAks"]
[Thu Nov 20 19:47:13.661230 2025] [:error] [pid 55340:tid 55366] [client 4.217.160.29:1714] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logiin.php"] [unique_id "aR7_wfOxD-NeMydTybCpZgAAABU"]
[Thu Nov 20 19:47:15.048635 2025] [:error] [pid 40508:tid 40513] [client 4.217.160.29:61450] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aR7_w6xXNVCMW_ksxPu-4AAAAoM"]
[Thu Nov 20 19:47:16.886725 2025] [:error] [pid 40537:tid 40559] [client 4.217.160.29:1727] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aR7_xKKlsL5kxTa3c1ztlwAAAtI"]
[Thu Nov 20 19:47:18.464097 2025] [:error] [pid 40445:tid 40496] [client 4.217.160.29:61495] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aR7_xlH-MuFcoWRjXpZrIQAAAlU"]
[Thu Nov 20 19:47:20.272462 2025] [:error] [pid 40415:tid 40435] [client 4.217.160.29:61462] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aR7_yKhjIyLSv09svwO2BQAAAdE"]
[Thu Nov 20 19:47:21.353035 2025] [:error] [pid 55340:tid 55355] [client 4.217.160.29:64671] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aR7_yfOxD-NeMydTybCpaQAAAAo"]
[Thu Nov 20 19:47:25.642304 2025] [:error] [pid 55340:tid 55348] [client 4.217.160.29:64658] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aR7_zfOxD-NeMydTybCpcAAAAAM"]
[Thu Nov 20 19:47:26.736517 2025] [:error] [pid 40445:tid 40484] [client 4.217.160.29:1670] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aR7_zlH-MuFcoWRjXpZrMAAAAkk"]
[Thu Nov 20 19:47:28.873097 2025] [:error] [pid 55340:tid 55346] [client 4.217.160.29:1701] [client 4.217.160.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aR7_0POxD-NeMydTybCpdQAAAAE"]
[Thu Nov 20 19:47:31.168717 2025] [:error] [pid 55340:tid 55366] [client 4.217.160.29:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Nov 20 19:47:31.528013 2025] [:error] [pid 55340:tid 55355] [client 4.217.160.29:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/xl.php
[Thu Nov 20 19:47:31.679789 2025] [:error] [pid 55340:tid 55352] [client 4.217.160.29:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Fri Nov 21 00:01:54.621706 2025] [:error] [pid 55342:tid 55376] [client 213.21.239.4:40496] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aR87crg6x32Tvk7fIG8e0AAAAEQ"]
[Fri Nov 21 06:59:16.471491 2025] [:error] [pid 17882:tid 17890] [client 201.75.187.195:11769] [client 201.75.187.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.75.187.195, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aR-dRIwFFssEn348h94XNwAAAUY"]
[Fri Nov 21 06:59:16.479274 2025] [:error] [pid 17882:tid 17890] [client 201.75.187.195:11769] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Nov 21 14:00:54.156704 2025] [:error] [pid 17882:tid 17897] [client 145.239.10.137:42495] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php, referer: http://aoswa.com.au/natural.php
[Fri Nov 21 14:22:05.957805 2025] [:error] [pid 46194:tid 46204] [client 213.21.239.4:53350] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSAFDZDRPrSqclDqoQEMbgAAAYc"]
[Fri Nov 21 15:01:57.515564 2025] [:error] [pid 25431:tid 25492] [client 213.21.239.4:40346] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aSAOZcklhXxmoIExII0IHQAAAIU"]
[Fri Nov 21 15:21:19.444563 2025] [:error] [pid 25554:tid 25568] [client 213.21.239.4:45588] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAS7x-NtB-9AzFZrk4qiwAAAQo"]
[Fri Nov 21 15:50:19.438532 2025] [:error] [pid 25554:tid 25565] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Nov 21 15:50:19.880679 2025] [:error] [pid 25554:tid 25574] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Nov 21 15:50:20.376826 2025] [:error] [pid 25554:tid 25567] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Nov 21 15:50:20.804012 2025] [:error] [pid 25554:tid 25571] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Nov 21 15:50:21.232180 2025] [:error] [pid 25554:tid 25580] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Nov 21 15:50:21.663268 2025] [:error] [pid 25554:tid 25564] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Nov 21 15:50:22.097387 2025] [:error] [pid 25554:tid 25568] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Nov 21 15:50:22.523930 2025] [:error] [pid 25554:tid 25561] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Nov 21 15:50:23.375975 2025] [:error] [pid 25554:tid 25571] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Nov 21 15:50:24.234375 2025] [:error] [pid 25554:tid 25564] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Nov 21 15:50:24.659599 2025] [:error] [pid 25554:tid 25568] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Nov 21 15:50:25.100688 2025] [:error] [pid 25554:tid 25574] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Nov 21 15:50:25.563738 2025] [:error] [pid 25554:tid 25569] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Nov 21 15:50:25.988483 2025] [:error] [pid 25554:tid 25570] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Nov 21 15:50:26.416541 2025] [:error] [pid 25554:tid 25582] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Nov 21 15:50:26.855803 2025] [:error] [pid 25554:tid 25571] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Nov 21 15:50:27.284567 2025] [:error] [pid 25554:tid 25577] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Nov 21 15:50:27.732701 2025] [:error] [pid 25554:tid 25577] [client 172.98.32.85:62273] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Nov 21 15:50:34.434582 2025] [:error] [pid 25430:tid 25474] [client 45.132.227.54:30071] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSAZyqpnWJcWt_4foXkz4AAAAE4"]
[Fri Nov 21 15:50:36.623299 2025] [:error] [pid 25430:tid 25460] [client 172.98.32.99:23091] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSAZzKpnWJcWt_4foXkz9gAAAEA"]
[Fri Nov 21 15:50:38.840073 2025] [:error] [pid 25521:tid 25528] [client 45.132.227.62:49101] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Nov 21 15:50:40.138897 2025] [:error] [pid 25521:tid 25526] [client 45.132.227.62:49101] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSAZ0PhXnBMilDddn3XXxAAAAMM"]
[Fri Nov 21 15:50:41.856907 2025] [:error] [pid 25431:tid 25503] [client 172.98.32.87:55821] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Nov 21 15:50:42.280830 2025] [:error] [pid 25431:tid 25505] [client 172.98.32.87:55821] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSAZ0sklhXxmoIExII0gnAAAAJI"]
[Fri Nov 21 15:50:43.578319 2025] [:error] [pid 46939:tid 46956] [client 136.144.42.75:52971] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Nov 21 15:50:45.815026 2025] [:error] [pid 46939:tid 46948] [client 136.144.42.75:52971] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSAZ1e0OmVoxD4VZ_Zla7AAAAUY"]
[Fri Nov 21 15:50:47.099821 2025] [:error] [pid 25429:tid 25437] [client 45.132.227.56:59665] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSAZ1z4rZbRSr7vu-NOXJAAAAAQ"]
[Fri Nov 21 15:50:47.953188 2025] [:error] [pid 25554:tid 25579] [client 172.98.32.80:43485] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSAZ1x-NtB-9AzFZrk5BUwAAARU"]
[Fri Nov 21 15:50:48.888389 2025] [:error] [pid 25554:tid 25563] [client 172.98.32.85:57749] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSAZ2B-NtB-9AzFZrk5BWgAAAQU"]
[Fri Nov 21 15:50:49.745052 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.88:60003] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSAZ2T4rZbRSr7vu-NOXOQAAABg"]
[Fri Nov 21 15:50:50.598436 2025] [:error] [pid 25430:tid 25483] [client 172.98.32.76:28857] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSAZ2qpnWJcWt_4foXk0XQAAAFc"]
[Fri Nov 21 15:50:51.888587 2025] [:error] [pid 25430:tid 25479] [client 45.132.227.63:26117] [client 45.132.227.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSAZ26pnWJcWt_4foXk0aQAAAFM"]
[Fri Nov 21 15:50:52.743893 2025] [:error] [pid 25521:tid 25534] [client 136.144.42.74:40163] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Nov 21 15:50:53.593365 2025] [:error] [pid 25521:tid 25524] [client 136.144.42.74:40163] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aSAZ3fhXnBMilDddn3XYAQAAAME"]
[Fri Nov 21 15:50:55.403821 2025] [:error] [pid 25429:tid 25452] [client 136.144.42.78:28437] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSAZ3z4rZbRSr7vu-NOXcgAAABM"]
[Fri Nov 21 15:50:56.725355 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.85:35035] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSAZ4MklhXxmoIExII0hHQAAAIM"]
[Fri Nov 21 15:50:58.583072 2025] [:error] [pid 25431:tid 25504] [client 45.132.227.65:29605] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Nov 21 15:50:59.033121 2025] [:error] [pid 25431:tid 25498] [client 45.132.227.65:29605] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSAZ48klhXxmoIExII0hKQAAAIs"]
[Fri Nov 21 15:50:59.904384 2025] [:error] [pid 25554:tid 25579] [client 45.132.227.57:29419] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Nov 21 15:51:01.197526 2025] [:error] [pid 25554:tid 25570] [client 45.132.227.57:29419] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Nov 21 15:51:02.489286 2025] [:error] [pid 25554:tid 25572] [client 45.132.227.57:29419] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSAZ5h-NtB-9AzFZrk5BugAAAQ4"]
[Fri Nov 21 15:51:03.385442 2025] [:error] [pid 46939:tid 46950] [client 172.98.32.89:44761] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Fri Nov 21 15:51:03.807311 2025] [:error] [pid 46939:tid 46959] [client 172.98.32.89:44761] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSAZ5-0OmVoxD4VZ_ZlbOAAAAVE"]
[Fri Nov 21 15:51:04.674559 2025] [:error] [pid 25554:tid 25579] [client 172.98.32.99:47257] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Nov 21 15:51:05.531233 2025] [:error] [pid 25554:tid 25558] [client 172.98.32.99:47257] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSAZ6R-NtB-9AzFZrk5BygAAAQA"]
[Fri Nov 21 15:51:06.821960 2025] [:error] [pid 25554:tid 25574] [client 172.98.32.86:30629] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSAZ6h-NtB-9AzFZrk5B2AAAARA"]
[Fri Nov 21 15:51:08.181189 2025] [:error] [pid 25521:tid 25541] [client 172.98.32.83:21951] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Fri Nov 21 15:51:08.605336 2025] [:error] [pid 25521:tid 25536] [client 172.98.32.83:21951] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Nov 21 15:51:09.454052 2025] [:error] [pid 25521:tid 25537] [client 172.98.32.83:21951] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSAZ7fhXnBMilDddn3XYPgAAAM4"]
[Fri Nov 21 15:51:10.733379 2025] [:error] [pid 25430:tid 25479] [client 172.98.32.79:36807] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSAZ7qpnWJcWt_4foXk09AAAAFM"]
[Fri Nov 21 15:51:12.035298 2025] [:error] [pid 25429:tid 25456] [client 172.98.32.88:42215] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSAZ8D4rZbRSr7vu-NOX4QAAABc"]
[Fri Nov 21 15:51:12.890626 2025] [:error] [pid 25554:tid 25582] [client 172.98.32.82:30871] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSAZ8B-NtB-9AzFZrk5CBwAAARg"]
[Fri Nov 21 15:51:13.771367 2025] [:error] [pid 25521:tid 25547] [client 45.132.227.59:62839] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSAZ8fhXnBMilDddn3XYWgAAANg"]
[Fri Nov 21 15:51:15.522815 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.93:43383] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Nov 21 15:51:15.951752 2025] [:error] [pid 25521:tid 25544] [client 172.98.32.93:43383] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSAZ8_hXnBMilDddn3XYcwAAANU"]
[Fri Nov 21 15:51:16.799175 2025] [:error] [pid 25554:tid 25581] [client 136.144.42.73:34555] [client 136.144.42.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSAZ9B-NtB-9AzFZrk5CJwAAARc"]
[Fri Nov 21 15:51:17.647612 2025] [:error] [pid 46939:tid 46951] [client 45.132.227.54:46949] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSAZ9e0OmVoxD4VZ_ZlbqQAAAUk"]
[Fri Nov 21 15:51:19.368111 2025] [:error] [pid 46939:tid 46954] [client 45.132.227.63:58373] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Nov 21 15:51:20.224644 2025] [:error] [pid 46939:tid 46945] [client 45.132.227.63:58373] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Nov 21 15:51:21.937893 2025] [:error] [pid 46939:tid 46957] [client 45.132.227.63:58373] [client 45.132.227.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSAZ-e0OmVoxD4VZ_Zlb5AAAAU8"]
[Fri Nov 21 15:51:24.112105 2025] [:error] [pid 25430:tid 25480] [client 45.132.227.66:58061] [client 45.132.227.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.227.66, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSAZ_KpnWJcWt_4foXk1QQAAAFQ"]
[Fri Nov 21 15:51:24.544422 2025] [:error] [pid 25430:tid 25477] [client 45.132.227.66:58061] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Nov 21 15:51:26.711293 2025] [:error] [pid 25430:tid 25464] [client 45.132.227.66:58061] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Nov 21 15:51:27.145365 2025] [:error] [pid 25430:tid 25471] [client 45.132.227.66:58061] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Nov 21 15:51:29.299409 2025] [:error] [pid 25430:tid 25468] [client 45.132.227.66:58061] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSAaAapnWJcWt_4foXk1fQAAAEg"]
[Fri Nov 21 15:51:30.604525 2025] [:error] [pid 25429:tid 25455] [client 45.132.227.54:64953] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Fri Nov 21 15:51:31.032666 2025] [:error] [pid 25429:tid 25444] [client 45.132.227.54:64953] [client 45.132.227.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.227.54, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSAaAz4rZbRSr7vu-NOYjAAAAAs"]
[Fri Nov 21 15:51:31.911335 2025] [:error] [pid 25429:tid 25451] [client 45.132.227.54:64953] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSAaAz4rZbRSr7vu-NOYkAAAABI"]
[Fri Nov 21 15:51:34.529275 2025] [:error] [pid 25429:tid 25441] [client 172.98.32.81:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Nov 21 15:51:35.398154 2025] [:error] [pid 25429:tid 25448] [client 172.98.32.81:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Fri Nov 21 15:51:36.251264 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.81:25163] [client 172.98.32.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSAaCD4rZbRSr7vu-NOYpgAAABg"]
[Fri Nov 21 15:51:37.101217 2025] [:error] [pid 25430:tid 25462] [client 45.132.227.54:39189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Nov 21 15:51:38.378108 2025] [:error] [pid 25430:tid 25463] [client 45.132.227.54:39189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Fri Nov 21 15:51:40.523984 2025] [:error] [pid 25430:tid 25464] [client 45.132.227.54:39189] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Fri Nov 21 15:51:41.397393 2025] [:error] [pid 25430:tid 25462] [client 45.132.227.54:39189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Nov 21 15:51:41.841101 2025] [:error] [pid 25430:tid 25477] [client 45.132.227.54:39189] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSAaDapnWJcWt_4foXk1zgAAAFE"]
[Fri Nov 21 15:51:42.704426 2025] [:error] [pid 25430:tid 25469] [client 45.132.227.63:60103] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Nov 21 15:51:43.139827 2025] [:error] [pid 25430:tid 25460] [client 45.132.227.63:60103] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Nov 21 15:51:43.571209 2025] [:error] [pid 25430:tid 25477] [client 45.132.227.63:60103] [client 45.132.227.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSAaD6pnWJcWt_4foXk13AAAAFE"]
[Fri Nov 21 15:51:44.887224 2025] [:error] [pid 25431:tid 25507] [client 172.98.32.86:35819] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Nov 21 15:51:45.743388 2025] [:error] [pid 25431:tid 25501] [client 172.98.32.86:35819] [client 172.98.32.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.86, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSAaEcklhXxmoIExII0i4gAAAI4"]
[Fri Nov 21 15:51:46.175945 2025] [:error] [pid 25431:tid 25506] [client 172.98.32.86:35819] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSAaEsklhXxmoIExII0i5QAAAJM"]
[Fri Nov 21 15:51:51.353659 2025] [:error] [pid 25430:tid 25462] [client 136.144.42.78:24923] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Fri Nov 21 15:51:53.997211 2025] [:error] [pid 25430:tid 25470] [client 136.144.42.78:24923] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Nov 21 15:51:54.441162 2025] [:error] [pid 25430:tid 25467] [client 136.144.42.78:24923] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSAaGqpnWJcWt_4foXk2NAAAAEc"]
[Fri Nov 21 15:51:55.304898 2025] [:error] [pid 25430:tid 25483] [client 136.144.42.78:48681] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Nov 21 15:51:56.614127 2025] [:error] [pid 25430:tid 25461] [client 136.144.42.78:48681] [client 136.144.42.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.42.78, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSAaHKpnWJcWt_4foXk2QwAAAEE"]
[Fri Nov 21 15:51:57.053931 2025] [:error] [pid 25430:tid 25466] [client 136.144.42.78:48681] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Nov 21 15:51:57.484121 2025] [:error] [pid 25430:tid 25462] [client 136.144.42.78:48681] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Fri Nov 21 15:51:57.925532 2025] [:error] [pid 25430:tid 25479] [client 136.144.42.78:48681] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Fri Nov 21 15:51:58.374066 2025] [:error] [pid 25430:tid 25476] [client 136.144.42.78:48681] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSAaHqpnWJcWt_4foXk2UQAAAFA"]
[Fri Nov 21 15:51:59.224083 2025] [:error] [pid 46939:tid 46963] [client 45.132.227.55:27249] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Nov 21 15:51:59.651109 2025] [:error] [pid 46939:tid 46942] [client 45.132.227.55:27249] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSAaH-0OmVoxD4VZ_ZldmwAAAUA"]
[Fri Nov 21 15:52:00.970329 2025] [:error] [pid 25429:tid 25456] [client 45.132.227.61:46717] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Nov 21 15:52:01.403893 2025] [:error] [pid 25429:tid 25454] [client 45.132.227.61:46717] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSAaIT4rZbRSr7vu-NOZXgAAABU"]
[Fri Nov 21 15:52:03.130711 2025] [:error] [pid 25431:tid 25497] [client 45.132.227.54:54297] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Fri Nov 21 15:52:03.557731 2025] [:error] [pid 25431:tid 25508] [client 45.132.227.54:54297] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSAaI8klhXxmoIExII0jQAAAAJU"]
[Fri Nov 21 15:52:04.457539 2025] [:error] [pid 25521:tid 25528] [client 136.144.42.78:39463] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSAaJPhXnBMilDddn3XZ_gAAAMU"]
[Fri Nov 21 15:52:05.315351 2025] [:error] [pid 25430:tid 25473] [client 172.98.32.99:64585] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Nov 21 15:52:05.743559 2025] [:error] [pid 25430:tid 25469] [client 172.98.32.99:64585] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Fri Nov 21 15:52:07.509789 2025] [:error] [pid 25430:tid 25469] [client 172.98.32.99:64585] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSAaJ6pnWJcWt_4foXk2ggAAAEk"]
[Fri Nov 21 15:52:08.846122 2025] [:error] [pid 25430:tid 25479] [client 45.132.227.57:22403] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSAaKKpnWJcWt_4foXk2jQAAAFM"]
[Fri Nov 21 15:52:10.985472 2025] [:error] [pid 25430:tid 25472] [client 136.144.42.74:44455] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSAaKqpnWJcWt_4foXk2nQAAAEw"]
[Fri Nov 21 15:52:11.856237 2025] [:error] [pid 46939:tid 46954] [client 172.98.32.81:47001] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Fri Nov 21 15:52:12.723263 2025] [:error] [pid 46939:tid 46961] [client 172.98.32.81:47001] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Nov 21 15:52:13.164410 2025] [:error] [pid 46939:tid 46943] [client 172.98.32.81:47001] [client 172.98.32.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSAaLe0OmVoxD4VZ_Zld_QAAAUE"]
[Fri Nov 21 15:52:14.046795 2025] [:error] [pid 25430:tid 25480] [client 45.132.227.67:43983] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Nov 21 15:52:14.909093 2025] [:error] [pid 25430:tid 25477] [client 45.132.227.67:43983] [client 45.132.227.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSAaLqpnWJcWt_4foXk2vQAAAFE"]
[Fri Nov 21 15:52:17.085519 2025] [:error] [pid 25554:tid 25570] [client 45.132.227.68:44137] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSAaMR-NtB-9AzFZrk5EZwAAAQw"]
[Fri Nov 21 15:52:18.384781 2025] [:error] [pid 46939:tid 46947] [client 136.144.42.77:38743] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Nov 21 15:52:19.707517 2025] [:error] [pid 46939:tid 46962] [client 136.144.42.77:38743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Fri Nov 21 15:52:20.578765 2025] [:error] [pid 46939:tid 46963] [client 136.144.42.77:38743] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Nov 21 15:52:21.012811 2025] [:error] [pid 46939:tid 46954] [client 136.144.42.77:38743] [client 136.144.42.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSAaNe0OmVoxD4VZ_ZleQgAAAUw"]
[Fri Nov 21 15:52:21.896802 2025] [:error] [pid 25521:tid 25532] [client 45.132.227.59:40589] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSAaNfhXnBMilDddn3XalgAAAMk"]
[Fri Nov 21 15:52:22.767451 2025] [:error] [pid 25431:tid 25509] [client 45.132.227.54:25191] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSAaNsklhXxmoIExII0jtAAAAJY"]
[Fri Nov 21 15:52:23.690393 2025] [:error] [pid 25431:tid 25494] [client 45.132.227.61:63019] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSAaN8klhXxmoIExII0jvgAAAIc"]
[Fri Nov 21 15:52:24.550561 2025] [:error] [pid 46939:tid 46946] [client 45.132.227.60:22001] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Fri Nov 21 15:52:24.980334 2025] [:error] [pid 46939:tid 46949] [client 45.132.227.60:22001] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSAaOO0OmVoxD4VZ_ZleYwAAAUc"]
[Fri Nov 21 15:52:25.845226 2025] [:error] [pid 25521:tid 25545] [client 172.98.32.100:21177] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSAaOfhXnBMilDddn3XavQAAANY"]
[Fri Nov 21 15:52:26.722344 2025] [:error] [pid 25521:tid 25523] [client 172.98.32.85:40573] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Fri Nov 21 15:52:27.618630 2025] [:error] [pid 25521:tid 25526] [client 172.98.32.85:40573] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSAaO_hXnBMilDddn3Xa0AAAAMM"]
[Fri Nov 21 15:52:28.484139 2025] [:error] [pid 25431:tid 25487] [client 172.98.32.87:34309] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSAaPMklhXxmoIExII0kAgAAAIA"]
[Fri Nov 21 15:52:29.402379 2025] [:error] [pid 25429:tid 25448] [client 45.132.227.61:33639] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSAaPT4rZbRSr7vu-NOaAwAAAA8"]
[Fri Nov 21 15:52:31.814400 2025] [:error] [pid 25521:tid 25541] [client 172.98.32.89:26859] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSAaP_hXnBMilDddn3Xa6wAAANI"]
[Fri Nov 21 15:52:33.121627 2025] [:error] [pid 25429:tid 25448] [client 172.98.32.85:47849] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSAaQT4rZbRSr7vu-NOaFAAAAA8"]
[Fri Nov 21 15:52:34.929411 2025] [:error] [pid 25430:tid 25472] [client 45.132.227.57:48845] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSAaQqpnWJcWt_4foXk3awAAAEw"]
[Fri Nov 21 15:52:35.826111 2025] [:error] [pid 25429:tid 25442] [client 172.98.32.91:64761] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Nov 21 15:52:38.397271 2025] [:error] [pid 25429:tid 25435] [client 172.98.32.91:64761] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Fri Nov 21 15:52:38.829039 2025] [:error] [pid 25429:tid 25446] [client 172.98.32.91:64761] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSAaRj4rZbRSr7vu-NOaTAAAAA0"]
[Fri Nov 21 15:52:40.213227 2025] [:error] [pid 25429:tid 25441] [client 172.98.32.95:58103] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Fri Nov 21 15:52:40.656464 2025] [:error] [pid 25429:tid 25444] [client 172.98.32.95:58103] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Nov 21 15:52:42.948422 2025] [:error] [pid 25429:tid 25455] [client 172.98.32.95:58103] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSAaSj4rZbRSr7vu-NOahQAAABY"]
[Fri Nov 21 15:52:45.138398 2025] [:error] [pid 46939:tid 46959] [client 172.98.32.82:48741] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSAaTe0OmVoxD4VZ_ZlfFAAAAVE"]
[Fri Nov 21 15:52:46.033395 2025] [:error] [pid 25429:tid 25457] [client 45.132.227.66:26225] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSAaTj4rZbRSr7vu-NOamgAAABg"]
[Fri Nov 21 15:52:48.672270 2025] [:error] [pid 25431:tid 25501] [client 172.98.32.76:40337] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSAaUMklhXxmoIExII0kwwAAAI4"]
[Fri Nov 21 15:52:50.508951 2025] [:error] [pid 25554:tid 25565] [client 45.132.227.53:32223] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Fri Nov 21 15:52:50.946890 2025] [:error] [pid 25554:tid 25579] [client 45.132.227.53:32223] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Fri Nov 21 15:52:51.412752 2025] [:error] [pid 25554:tid 25573] [client 45.132.227.53:32223] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Fri Nov 21 15:52:51.846767 2025] [:error] [pid 25554:tid 25563] [client 45.132.227.53:32223] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Fri Nov 21 15:52:54.088138 2025] [:error] [pid 25554:tid 25581] [client 45.132.227.53:32223] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSAaVh-NtB-9AzFZrk5FvAAAARc"]
[Fri Nov 21 15:52:54.963510 2025] [:error] [pid 25554:tid 25558] [client 45.132.227.64:50015] [client 45.132.227.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSAaVh-NtB-9AzFZrk5FyAAAAQA"]
[Fri Nov 21 15:52:55.879506 2025] [:error] [pid 25430:tid 25462] [client 45.132.227.56:20049] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSAaV6pnWJcWt_4foXk32QAAAEI"]
[Fri Nov 21 15:52:56.754033 2025] [:error] [pid 25521:tid 25532] [client 172.98.32.94:54823] [client 172.98.32.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSAaWPhXnBMilDddn3XbtAAAAMk"]
[Fri Nov 21 15:52:57.653315 2025] [:error] [pid 25429:tid 25434] [client 172.98.32.91:38371] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSAaWT4rZbRSr7vu-NOa3gAAAAE"]
[Fri Nov 21 15:52:58.512409 2025] [:error] [pid 25554:tid 25559] [client 45.132.227.62:65131] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSAaWh-NtB-9AzFZrk5F6AAAAQE"]
[Fri Nov 21 15:53:01.149234 2025] [:error] [pid 25521:tid 25525] [client 45.132.227.60:36003] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSAaXfhXnBMilDddn3Xb1QAAAMI"]
[Fri Nov 21 15:53:02.014861 2025] [:error] [pid 46939:tid 46943] [client 172.98.32.86:25403] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSAaXu0OmVoxD4VZ_ZlfdAAAAUE"]
[Fri Nov 21 15:53:02.897315 2025] [:error] [pid 25430:tid 25484] [client 45.132.227.64:54977] [client 45.132.227.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSAaXqpnWJcWt_4foXk3_QAAAFg"]
[Fri Nov 21 15:53:03.772512 2025] [:error] [pid 25521:tid 25525] [client 172.98.32.83:61931] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSAaX_hXnBMilDddn3Xb4QAAAMI"]
[Fri Nov 21 15:53:05.555767 2025] [:error] [pid 46939:tid 46964] [client 172.98.32.94:49191] [client 172.98.32.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSAaYe0OmVoxD4VZ_ZlfmQAAAVY"]
[Fri Nov 21 15:53:06.867859 2025] [:error] [pid 25554:tid 25562] [client 172.98.32.96:24839] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSAaYh-NtB-9AzFZrk5GQwAAAQQ"]
[Fri Nov 21 15:53:07.741711 2025] [:error] [pid 25521:tid 25525] [client 172.98.32.84:29209] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Nov 21 15:53:08.650627 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.84:29209] [client 172.98.32.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSAaZPhXnBMilDddn3Xb8wAAAMQ"]
[Fri Nov 21 15:53:10.440381 2025] [:error] [pid 25429:tid 25435] [client 172.98.32.88:27551] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSAaZj4rZbRSr7vu-NObNQAAAAI"]
[Fri Nov 21 15:53:12.227391 2025] [:error] [pid 46939:tid 46945] [client 45.132.227.65:50239] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Nov 21 15:53:12.664896 2025] [:error] [pid 46939:tid 46949] [client 45.132.227.65:50239] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSAaaO0OmVoxD4VZ_Zlf3gAAAUc"]
[Fri Nov 21 15:53:13.959945 2025] [:error] [pid 25554:tid 25566] [client 45.132.227.62:27287] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Fri Nov 21 15:53:14.405789 2025] [:error] [pid 25554:tid 25568] [client 45.132.227.62:27287] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Fri Nov 21 15:53:14.844722 2025] [:error] [pid 25554:tid 25581] [client 45.132.227.62:27287] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Fri Nov 21 15:53:15.294608 2025] [:error] [pid 25554:tid 25558] [client 45.132.227.62:27287] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSAaax-NtB-9AzFZrk5GfwAAAQA"]
[Fri Nov 21 15:53:16.183117 2025] [:error] [pid 46939:tid 46957] [client 136.144.42.69:61709] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Nov 21 15:53:16.612350 2025] [:error] [pid 46939:tid 46944] [client 136.144.42.69:61709] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSAabO0OmVoxD4VZ_ZlgBgAAAUI"]
[Fri Nov 21 15:53:18.408512 2025] [:error] [pid 25429:tid 25434] [client 172.98.32.77:51865] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Nov 21 15:53:18.867008 2025] [:error] [pid 25429:tid 25433] [client 172.98.32.77:51865] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Nov 21 15:53:19.305707 2025] [:error] [pid 25429:tid 25443] [client 172.98.32.77:51865] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Fri Nov 21 15:53:22.890598 2025] [:error] [pid 25429:tid 25445] [client 172.98.32.77:51865] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Nov 21 15:53:23.322111 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.77:51865] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Fri Nov 21 15:53:24.221614 2025] [:error] [pid 25429:tid 25453] [client 172.98.32.77:51865] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Fri Nov 21 15:53:25.610700 2025] [:error] [pid 25429:tid 25447] [client 172.98.32.77:51865] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Nov 21 15:53:26.052424 2025] [:error] [pid 25429:tid 25433] [client 172.98.32.77:51865] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSAadj4rZbRSr7vu-NObvwAAAAA"]
[Fri Nov 21 15:53:26.941545 2025] [:error] [pid 25431:tid 25504] [client 45.132.227.65:25963] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSAadsklhXxmoIExII0l2QAAAJE"]
[Fri Nov 21 15:53:27.849723 2025] [:error] [pid 25429:tid 25444] [client 172.98.32.96:42209] [client 172.98.32.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.96, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSAadz4rZbRSr7vu-NObyAAAAAs"]
[Fri Nov 21 15:53:27.855163 2025] [:error] [pid 25429:tid 25444] [client 172.98.32.96:42209] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Nov 21 15:53:28.316808 2025] [:error] [pid 25429:tid 25445] [client 172.98.32.96:42209] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Fri Nov 21 15:53:28.743732 2025] [:error] [pid 25429:tid 25437] [client 172.98.32.96:42209] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSAaeD4rZbRSr7vu-NObzAAAAAQ"]
[Fri Nov 21 15:53:30.045557 2025] [:error] [pid 25554:tid 25559] [client 172.98.32.76:36407] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Nov 21 15:53:30.479506 2025] [:error] [pid 25554:tid 25568] [client 172.98.32.76:36407] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSAaeh-NtB-9AzFZrk5HBAAAAQo"]
[Fri Nov 21 15:53:31.369464 2025] [:error] [pid 25521:tid 25539] [client 172.98.32.85:61377] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSAae_hXnBMilDddn3XcoQAAANA"]
[Fri Nov 21 15:53:34.004620 2025] [:error] [pid 46939:tid 46962] [client 172.98.32.92:53329] [client 172.98.32.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSAafu0OmVoxD4VZ_ZlgmgAAAVQ"]
[Fri Nov 21 15:53:34.869905 2025] [:error] [pid 25521:tid 25528] [client 172.98.32.83:50799] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/fm.php"] [unique_id "aSAafvhXnBMilDddn3XcuAAAAMU"]
[Fri Nov 21 15:53:37.049121 2025] [:error] [pid 25429:tid 25436] [client 172.98.32.96:59233] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Fri Nov 21 15:53:37.953723 2025] [:error] [pid 25429:tid 25452] [client 172.98.32.96:59233] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSAagT4rZbRSr7vu-NOb-QAAABM"]
[Fri Nov 21 15:53:39.766446 2025] [:error] [pid 25429:tid 25443] [client 136.144.42.70:29893] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Fri Nov 21 15:53:40.636064 2025] [:error] [pid 25429:tid 25451] [client 136.144.42.70:29893] [client 136.144.42.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSAahD4rZbRSr7vu-NOcHQAAABI"]
[Fri Nov 21 15:53:41.557278 2025] [:error] [pid 25431:tid 25508] [client 45.132.227.56:58349] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSAahcklhXxmoIExII0mUQAAAJU"]
[Fri Nov 21 15:53:42.864825 2025] [:error] [pid 25431:tid 25503] [client 172.98.32.80:39449] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Fri Nov 21 15:53:43.297065 2025] [:error] [pid 25431:tid 25502] [client 172.98.32.80:39449] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSAah8klhXxmoIExII0maAAAAI8"]
[Fri Nov 21 15:53:44.196424 2025] [:error] [pid 25521:tid 25544] [client 136.144.42.78:55695] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSAaiPhXnBMilDddn3Xc6QAAANU"]
[Fri Nov 21 15:53:45.962451 2025] [:error] [pid 25430:tid 25480] [client 136.144.42.79:56681] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Fri Nov 21 15:53:46.399429 2025] [:error] [pid 25430:tid 25484] [client 136.144.42.79:56681] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Fri Nov 21 15:53:47.283311 2025] [:error] [pid 25430:tid 25478] [client 136.144.42.79:56681] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Fri Nov 21 15:53:48.147654 2025] [:error] [pid 25430:tid 25472] [client 136.144.42.79:56681] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSAajKpnWJcWt_4foXk5BgAAAEw"]
[Fri Nov 21 15:53:49.049468 2025] [:error] [pid 25521:tid 25528] [client 172.98.32.85:34327] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSAajfhXnBMilDddn3XdDAAAAMU"]
[Fri Nov 21 15:53:51.346130 2025] [:error] [pid 25429:tid 25446] [client 45.132.227.55:42049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Nov 21 15:53:51.789762 2025] [:error] [pid 25429:tid 25457] [client 45.132.227.55:42049] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSAajz4rZbRSr7vu-NOcYQAAABg"]
[Fri Nov 21 15:53:52.695581 2025] [:error] [pid 46939:tid 46954] [client 172.98.32.80:43087] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSAakO0OmVoxD4VZ_ZlhDAAAAUw"]
[Fri Nov 21 15:53:53.641369 2025] [:error] [pid 46939:tid 46951] [client 45.132.227.52:61331] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSAake0OmVoxD4VZ_ZlhIAAAAUk"]
[Fri Nov 21 15:53:56.397644 2025] [:error] [pid 25429:tid 25443] [client 172.98.32.78:26251] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Fri Nov 21 15:53:56.853486 2025] [:error] [pid 25429:tid 25441] [client 172.98.32.78:26251] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSAalD4rZbRSr7vu-NOcfgAAAAg"]
[Fri Nov 21 15:53:58.181339 2025] [:error] [pid 25521:tid 25542] [client 172.98.32.98:26477] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSAalvhXnBMilDddn3XdOgAAANM"]
[Fri Nov 21 15:53:59.111113 2025] [:error] [pid 46939:tid 46948] [client 45.132.227.57:50077] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Nov 21 15:53:59.544478 2025] [:error] [pid 46939:tid 46965] [client 45.132.227.57:50077] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Fri Nov 21 15:54:00.437994 2025] [:error] [pid 46939:tid 46950] [client 45.132.227.57:50077] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Fri Nov 21 15:54:02.209748 2025] [:error] [pid 46939:tid 46943] [client 45.132.227.57:50077] [client 45.132.227.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.227.57, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aSAamu0OmVoxD4VZ_ZlhiQAAAUE"]
[Fri Nov 21 15:54:03.089880 2025] [:error] [pid 46939:tid 46966] [client 45.132.227.57:50077] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Fri Nov 21 15:54:03.541236 2025] [:error] [pid 46939:tid 46962] [client 45.132.227.57:50077] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Fri Nov 21 15:54:04.260672 2025] [:error] [pid 46939:tid 46962] [client 45.132.227.57:50077] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Fri Nov 21 15:54:05.123566 2025] [:error] [pid 46939:tid 46963] [client 45.132.227.57:50077] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSAane0OmVoxD4VZ_ZlhrQAAAVU"]
[Fri Nov 21 15:54:06.003817 2025] [:error] [pid 25431:tid 25497] [client 172.98.32.93:57427] [client 172.98.32.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.93, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSAansklhXxmoIExII0nNwAAAIo"]
[Fri Nov 21 15:54:07.372604 2025] [:error] [pid 25431:tid 25506] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Nov 21 15:54:07.810525 2025] [:error] [pid 25431:tid 25511] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Fri Nov 21 15:54:08.683600 2025] [:error] [pid 25431:tid 25492] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Fri Nov 21 15:54:09.566500 2025] [:error] [pid 25431:tid 25510] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Nov 21 15:54:10.866041 2025] [:error] [pid 25431:tid 25500] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Fri Nov 21 15:54:14.051514 2025] [:error] [pid 25431:tid 25509] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Nov 21 15:54:14.489928 2025] [:error] [pid 25431:tid 25503] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Fri Nov 21 15:54:16.742364 2025] [:error] [pid 25431:tid 25487] [client 172.98.32.93:57427] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Nov 21 15:54:17.649359 2025] [:error] [pid 25431:tid 25504] [client 172.98.32.93:57427] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSAaqcklhXxmoIExII0nvAAAAJE"]
[Fri Nov 21 15:54:19.423073 2025] [:error] [pid 25431:tid 25504] [client 45.132.227.52:48317] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Fri Nov 21 15:54:19.851388 2025] [:error] [pid 25431:tid 25498] [client 45.132.227.52:48317] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSAaq8klhXxmoIExII0n0wAAAIs"]
[Fri Nov 21 15:54:21.219055 2025] [:error] [pid 46939:tid 46965] [client 136.144.42.69:57241] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Fri Nov 21 15:54:21.648052 2025] [:error] [pid 46939:tid 46945] [client 136.144.42.69:57241] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSAare0OmVoxD4VZ_ZliOwAAAUM"]
[Fri Nov 21 15:54:23.429098 2025] [:error] [pid 25431:tid 25511] [client 172.98.32.95:35421] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Fri Nov 21 15:54:24.340994 2025] [:error] [pid 25431:tid 25503] [client 172.98.32.95:35421] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Fri Nov 21 15:54:25.238046 2025] [:error] [pid 25431:tid 25492] [client 172.98.32.95:35421] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Fri Nov 21 15:54:25.711567 2025] [:error] [pid 25431:tid 25510] [client 172.98.32.95:35421] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Fri Nov 21 15:54:26.578927 2025] [:error] [pid 25431:tid 25502] [client 172.98.32.95:35421] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSAassklhXxmoIExII0oDwAAAI8"]
[Fri Nov 21 15:54:27.514975 2025] [:error] [pid 25554:tid 25568] [client 136.144.42.74:40733] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Fri Nov 21 15:54:27.946855 2025] [:error] [pid 25554:tid 25576] [client 136.144.42.74:40733] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Fri Nov 21 15:54:28.375951 2025] [:error] [pid 25554:tid 25570] [client 136.144.42.74:40733] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSAatB-NtB-9AzFZrk5ItwAAAQw"]
[Fri Nov 21 15:54:29.728754 2025] [:error] [pid 25430:tid 25462] [client 172.98.32.99:52083] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSAatapnWJcWt_4foXk58wAAAEI"]
[Fri Nov 21 15:54:31.040267 2025] [:error] [pid 46939:tid 46950] [client 45.132.227.52:31263] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Nov 21 15:54:32.358163 2025] [:error] [pid 46939:tid 46957] [client 45.132.227.52:31263] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Fri Nov 21 15:54:32.790763 2025] [:error] [pid 46939:tid 46963] [client 45.132.227.52:31263] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Fri Nov 21 15:54:33.246154 2025] [:error] [pid 46939:tid 46965] [client 45.132.227.52:31263] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSAaue0OmVoxD4VZ_Zli2QAAAVc"]
[Fri Nov 21 15:54:34.141362 2025] [:error] [pid 46939:tid 46950] [client 172.98.32.79:21979] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSAauu0OmVoxD4VZ_Zli4QAAAUg"]
[Fri Nov 21 15:54:37.282475 2025] [:error] [pid 46939:tid 46962] [client 172.98.32.80:47533] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Fri Nov 21 15:54:38.214776 2025] [:error] [pid 46939:tid 46946] [client 172.98.32.80:47533] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSAavu0OmVoxD4VZ_ZljCQAAAUQ"]
[Fri Nov 21 15:54:39.511724 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.93:51385] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tiny.php"] [unique_id "aSAav8klhXxmoIExII0oYwAAAIM"]
[Fri Nov 21 15:54:40.812970 2025] [:error] [pid 25521:tid 25523] [client 172.98.32.93:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Nov 21 15:54:41.246765 2025] [:error] [pid 25521:tid 25536] [client 172.98.32.93:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Fri Nov 21 15:54:41.687322 2025] [:error] [pid 25521:tid 25546] [client 172.98.32.93:24913] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSAawfhXnBMilDddn3XeSgAAANc"]
[Fri Nov 21 15:54:43.006472 2025] [:error] [pid 25430:tid 25463] [client 45.132.227.57:56297] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Fri Nov 21 15:54:43.444070 2025] [:error] [pid 25430:tid 25472] [client 45.132.227.57:56297] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Fri Nov 21 15:54:44.311708 2025] [:error] [pid 25430:tid 25470] [client 45.132.227.57:56297] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Nov 21 15:54:45.635270 2025] [:error] [pid 25430:tid 25460] [client 45.132.227.57:56297] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSAaxapnWJcWt_4foXk6dAAAAEA"]
[Fri Nov 21 15:54:46.544524 2025] [:error] [pid 25430:tid 25472] [client 45.132.227.57:54351] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Fri Nov 21 15:54:47.859287 2025] [:error] [pid 25430:tid 25480] [client 45.132.227.57:54351] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSAax6pnWJcWt_4foXk6ggAAAFQ"]
[Fri Nov 21 15:54:49.173767 2025] [:error] [pid 25554:tid 25579] [client 172.98.32.90:26771] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Fri Nov 21 15:54:50.501308 2025] [:error] [pid 25554:tid 25565] [client 172.98.32.90:26771] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Fri Nov 21 15:54:50.937499 2025] [:error] [pid 25554:tid 25567] [client 172.98.32.90:26771] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Nov 21 15:54:51.841778 2025] [:error] [pid 25554:tid 25570] [client 172.98.32.90:26771] [client 172.98.32.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.90, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSAayx-NtB-9AzFZrk5JXQAAAQw"]
[Fri Nov 21 15:54:54.032690 2025] [:error] [pid 25554:tid 25568] [client 172.98.32.90:26771] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSAazh-NtB-9AzFZrk5JcQAAAQo"]
[Fri Nov 21 15:54:54.931344 2025] [:error] [pid 25521:tid 25523] [client 172.98.32.96:45295] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Fri Nov 21 15:54:55.378239 2025] [:error] [pid 25521:tid 25532] [client 172.98.32.96:45295] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSAaz_hXnBMilDddn3XegQAAAMk"]
[Fri Nov 21 15:54:56.248954 2025] [:error] [pid 25554:tid 25567] [client 172.98.32.92:24877] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Fri Nov 21 15:54:57.113387 2025] [:error] [pid 25554:tid 25581] [client 172.98.32.92:24877] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Fri Nov 21 15:54:57.996645 2025] [:error] [pid 25554:tid 25559] [client 172.98.32.92:24877] [client 172.98.32.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSAa0R-NtB-9AzFZrk5JiwAAAQE"]
[Fri Nov 21 15:54:59.296864 2025] [:error] [pid 46939:tid 46952] [client 172.98.32.76:65391] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Fri Nov 21 15:54:59.736907 2025] [:error] [pid 46939:tid 46954] [client 172.98.32.76:65391] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Fri Nov 21 15:55:00.672013 2025] [:error] [pid 46939:tid 46964] [client 172.98.32.76:65391] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSAa1O0OmVoxD4VZ_ZlkCAAAAVY"]
[Fri Nov 21 15:55:02.009693 2025] [:error] [pid 25429:tid 25441] [client 45.132.227.67:50523] [client 45.132.227.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSAa1j4rZbRSr7vu-NOeHwAAAAg"]
[Fri Nov 21 15:55:02.878151 2025] [:error] [pid 25431:tid 25511] [client 45.132.227.53:41285] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Fri Nov 21 15:55:03.325460 2025] [:error] [pid 25431:tid 25488] [client 45.132.227.53:41285] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Fri Nov 21 15:55:04.196506 2025] [:error] [pid 25431:tid 25496] [client 45.132.227.53:41285] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSAa2MklhXxmoIExII0o_wAAAIk"]
[Fri Nov 21 15:55:05.061937 2025] [:error] [pid 25521:tid 25532] [client 172.98.32.77:57719] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Fri Nov 21 15:55:05.932705 2025] [:error] [pid 25521:tid 25543] [client 172.98.32.77:57719] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Fri Nov 21 15:55:06.364162 2025] [:error] [pid 25521:tid 25544] [client 172.98.32.77:57719] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSAa2vhXnBMilDddn3XetgAAANU"]
[Fri Nov 21 15:55:07.683508 2025] [:error] [pid 46939:tid 46964] [client 172.98.32.100:31943] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSAa2-0OmVoxD4VZ_ZlkSwAAAVY"]
[Fri Nov 21 15:55:08.565331 2025] [:error] [pid 25521:tid 25544] [client 172.98.32.87:57541] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSAa3PhXnBMilDddn3XewwAAANU"]
[Fri Nov 21 15:55:09.434433 2025] [:error] [pid 25431:tid 25495] [client 172.98.32.100:42465] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSAa3cklhXxmoIExII0pLAAAAIg"]
[Fri Nov 21 15:55:10.310329 2025] [:error] [pid 25429:tid 25436] [client 45.132.227.59:42003] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSAa3j4rZbRSr7vu-NOeUgAAAAM"]
[Fri Nov 21 15:55:11.239562 2025] [:error] [pid 25429:tid 25435] [client 172.98.32.77:22007] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSAa3z4rZbRSr7vu-NOeVQAAAAI"]
[Fri Nov 21 15:55:12.136628 2025] [:error] [pid 46939:tid 46960] [client 172.98.32.91:32797] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSAa4O0OmVoxD4VZ_ZlkdwAAAVI"]
[Fri Nov 21 15:55:13.924988 2025] [:error] [pid 25521:tid 25531] [client 45.132.227.60:23201] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSAa4fhXnBMilDddn3Xe3gAAAMg"]
[Fri Nov 21 15:55:14.793447 2025] [:error] [pid 25521:tid 25531] [client 45.132.227.65:53367] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSAa4vhXnBMilDddn3Xe6wAAAMg"]
[Fri Nov 21 15:55:15.657107 2025] [:error] [pid 46939:tid 46965] [client 45.132.227.62:51231] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSAa4-0OmVoxD4VZ_ZlklwAAAVc"]
[Fri Nov 21 15:55:16.960165 2025] [:error] [pid 46939:tid 46955] [client 172.98.32.90:39521] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSAa5O0OmVoxD4VZ_ZlkqwAAAU0"]
[Fri Nov 21 15:55:18.774645 2025] [:error] [pid 25554:tid 25569] [client 45.132.227.65:32387] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSAa5h-NtB-9AzFZrk5KFwAAAQs"]
[Fri Nov 21 15:55:19.676151 2025] [:error] [pid 25521:tid 25544] [client 172.98.32.78:47463] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Fri Nov 21 15:55:21.460387 2025] [:error] [pid 25521:tid 25524] [client 172.98.32.78:47463] [client 172.98.32.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.78, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSAa6fhXnBMilDddn3XfGQAAAME"]
[Fri Nov 21 15:55:24.122741 2025] [:error] [pid 25521:tid 25540] [client 172.98.32.78:47463] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSAa7PhXnBMilDddn3XfQAAAANE"]
[Fri Nov 21 15:55:25.032666 2025] [:error] [pid 25429:tid 25455] [client 136.144.42.74:39121] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSAa7T4rZbRSr7vu-NOepQAAABY"]
[Fri Nov 21 15:55:27.262836 2025] [:error] [pid 25431:tid 25491] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Fri Nov 21 15:55:27.709030 2025] [:error] [pid 25431:tid 25500] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Fri Nov 21 15:55:29.647408 2025] [:error] [pid 25431:tid 25504] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Fri Nov 21 15:55:30.133930 2025] [:error] [pid 25431:tid 25502] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Fri Nov 21 15:55:31.898788 2025] [:error] [pid 25431:tid 25505] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Fri Nov 21 15:55:32.336923 2025] [:error] [pid 25431:tid 25499] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Fri Nov 21 15:55:32.782232 2025] [:error] [pid 25431:tid 25496] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Fri Nov 21 15:55:33.231265 2025] [:error] [pid 25431:tid 25487] [client 45.132.227.56:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Fri Nov 21 15:55:33.671630 2025] [:error] [pid 25431:tid 25503] [client 45.132.227.56:56015] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSAa9cklhXxmoIExII0pzgAAAJA"]
[Fri Nov 21 15:55:34.888427 2025] [:error] [pid 25554:tid 25581] [client 172.98.32.78:20635] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSAa9h-NtB-9AzFZrk5KbwAAARc"]
[Fri Nov 21 15:55:35.957872 2025] [:error] [pid 25521:tid 25526] [client 172.98.32.87:54395] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSAa9_hXnBMilDddn3XfdAAAAMM"]
[Fri Nov 21 15:55:39.200408 2025] [:error] [pid 25429:tid 25435] [client 45.132.227.57:32039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Fri Nov 21 15:55:39.641871 2025] [:error] [pid 25429:tid 25444] [client 45.132.227.57:32039] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Fri Nov 21 15:55:40.524331 2025] [:error] [pid 25429:tid 25445] [client 45.132.227.57:32039] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Fri Nov 21 15:55:41.380654 2025] [:error] [pid 25429:tid 25440] [client 45.132.227.57:32039] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSAa_T4rZbRSr7vu-NOfDwAAAAc"]
[Fri Nov 21 15:55:42.401024 2025] [:error] [pid 25429:tid 25437] [client 172.98.32.93:40001] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSAa_j4rZbRSr7vu-NOfGgAAAAQ"]
[Fri Nov 21 15:55:43.301146 2025] [:error] [pid 25430:tid 25484] [client 172.98.32.76:51803] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSAa_6pnWJcWt_4foXk7ogAAAFg"]
[Fri Nov 21 15:55:46.015322 2025] [:error] [pid 46939:tid 46944] [client 172.98.32.84:45537] [client 172.98.32.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSAbAu0OmVoxD4VZ_ZllrgAAAUI"]
[Fri Nov 21 15:55:47.380281 2025] [:error] [pid 25554:tid 25562] [client 172.98.32.76:45537] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSAbAx-NtB-9AzFZrk5K9gAAAQQ"]
[Fri Nov 21 15:55:49.209674 2025] [:error] [pid 25429:tid 25446] [client 172.98.32.83:42599] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSAbBT4rZbRSr7vu-NOfTAAAAA0"]
[Fri Nov 21 15:55:55.133314 2025] [:error] [pid 25554:tid 25577] [client 136.144.42.74:60677] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSAbCx-NtB-9AzFZrk5LWQAAARM"]
[Fri Nov 21 15:55:56.093164 2025] [:error] [pid 25430:tid 25473] [client 172.98.32.92:53557] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Fri Nov 21 15:55:56.970182 2025] [:error] [pid 25430:tid 25468] [client 172.98.32.92:53557] [client 172.98.32.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSAbDKpnWJcWt_4foXk8CQAAAEg"]
[Fri Nov 21 15:55:58.748847 2025] [:error] [pid 25521:tid 25547] [client 136.144.42.72:60045] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Fri Nov 21 15:56:00.120916 2025] [:error] [pid 25521:tid 25525] [client 136.144.42.72:60045] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Nov 21 15:56:00.582230 2025] [:error] [pid 25521:tid 25528] [client 136.144.42.72:60045] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSAbEPhXnBMilDddn3XgVgAAAMU"]
[Fri Nov 21 15:56:02.492747 2025] [:error] [pid 25554:tid 25581] [client 45.132.227.53:26725] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSAbEh-NtB-9AzFZrk5LnAAAARc"]
[Fri Nov 21 15:56:06.461246 2025] [:error] [pid 25430:tid 25480] [client 136.144.42.78:50079] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSAbFqpnWJcWt_4foXk8QgAAAFQ"]
[Fri Nov 21 15:56:09.594202 2025] [:error] [pid 25521:tid 25539] [client 172.98.32.86:54105] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSAbGfhXnBMilDddn3XgtAAAANA"]
[Fri Nov 21 15:56:10.949478 2025] [:error] [pid 25430:tid 25468] [client 172.98.32.88:37407] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Fri Nov 21 15:56:11.405354 2025] [:error] [pid 25430:tid 25484] [client 172.98.32.88:37407] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSAbG6pnWJcWt_4foXk8dwAAAFg"]
[Fri Nov 21 15:56:12.317350 2025] [:error] [pid 25431:tid 25508] [client 172.98.32.83:29657] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSAbHMklhXxmoIExII0rRAAAAJU"]
[Fri Nov 21 15:56:15.468691 2025] [:error] [pid 25554:tid 25561] [client 172.98.32.85:53727] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSAbHx-NtB-9AzFZrk5L8AAAAQM"]
[Fri Nov 21 15:56:16.337150 2025] [:error] [pid 25521:tid 25540] [client 172.98.32.81:38841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Fri Nov 21 15:56:18.134632 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.81:38841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Fri Nov 21 15:56:18.579685 2025] [:error] [pid 25521:tid 25536] [client 172.98.32.81:38841] [client 172.98.32.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSAbIvhXnBMilDddn3XhCAAAAM0"]
[Fri Nov 21 15:56:20.502177 2025] [:error] [pid 25429:tid 25434] [client 172.98.32.93:47377] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Fri Nov 21 15:56:21.447291 2025] [:error] [pid 25429:tid 25442] [client 172.98.32.93:47377] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSAbJT4rZbRSr7vu-NOgBgAAAAk"]
[Fri Nov 21 15:56:22.356616 2025] [:error] [pid 25554:tid 25561] [client 45.132.227.62:30377] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSAbJh-NtB-9AzFZrk5MKgAAAQM"]
[Fri Nov 21 15:56:24.149108 2025] [:error] [pid 46939:tid 46963] [client 45.132.227.65:46429] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSAbKO0OmVoxD4VZ_ZlmwQAAAVU"]
[Fri Nov 21 15:56:26.350413 2025] [:error] [pid 25431:tid 25508] [client 45.132.227.54:36799] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSAbKsklhXxmoIExII0rsAAAAJU"]
[Fri Nov 21 15:56:27.232334 2025] [:error] [pid 25431:tid 25509] [client 45.132.227.53:39455] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSAbK8klhXxmoIExII0ruQAAAJY"]
[Fri Nov 21 15:56:28.578562 2025] [:error] [pid 25431:tid 25491] [client 45.132.227.55:62161] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Fri Nov 21 15:56:30.918502 2025] [:error] [pid 25431:tid 25501] [client 45.132.227.55:62161] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSAbLsklhXxmoIExII0r2wAAAI4"]
[Fri Nov 21 15:56:32.850043 2025] [:error] [pid 46939:tid 46953] [client 172.98.32.88:52495] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSAbMO0OmVoxD4VZ_ZlnDQAAAUs"]
[Fri Nov 21 15:56:33.891901 2025] [:error] [pid 25554:tid 25576] [client 172.98.32.78:46217] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSAbMR-NtB-9AzFZrk5MkAAAARI"]
[Fri Nov 21 15:56:35.308703 2025] [:error] [pid 25431:tid 25487] [client 172.98.32.87:60099] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Fri Nov 21 15:56:35.785334 2025] [:error] [pid 25431:tid 25507] [client 172.98.32.87:60099] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSAbM8klhXxmoIExII0sBQAAAJQ"]
[Fri Nov 21 15:56:37.146425 2025] [:error] [pid 25521:tid 25528] [client 172.98.32.96:40955] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSAbNfhXnBMilDddn3XhcQAAAMU"]
[Fri Nov 21 15:56:40.319476 2025] [:error] [pid 25431:tid 25491] [client 136.144.42.80:41761] [client 136.144.42.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSAbOMklhXxmoIExII0sLwAAAIQ"]
[Fri Nov 21 15:56:41.609892 2025] [:error] [pid 25554:tid 25575] [client 172.98.32.76:41637] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Fri Nov 21 15:56:42.036871 2025] [:error] [pid 25554:tid 25566] [client 172.98.32.76:41637] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSAbOh-NtB-9AzFZrk5M1QAAAQg"]
[Fri Nov 21 15:56:44.010930 2025] [:error] [pid 25429:tid 25442] [client 45.132.227.58:39247] [client 45.132.227.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSAbPD4rZbRSr7vu-NOgdwAAAAk"]
[Fri Nov 21 15:56:45.296032 2025] [:error] [pid 25430:tid 25479] [client 45.132.227.65:26241] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSAbPapnWJcWt_4foXk9mQAAAFM"]
[Fri Nov 21 15:56:46.590108 2025] [:error] [pid 46939:tid 46954] [client 45.132.227.62:35699] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSAbPu0OmVoxD4VZ_ZlnYQAAAUw"]
[Fri Nov 21 15:56:47.450299 2025] [:error] [pid 25430:tid 25469] [client 136.144.42.74:40807] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSAbP6pnWJcWt_4foXk9qQAAAEk"]
[Fri Nov 21 15:56:49.996419 2025] [:error] [pid 25554:tid 25577] [client 45.132.227.59:46549] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSAbQR-NtB-9AzFZrk5NIQAAARM"]
[Fri Nov 21 15:56:54.750512 2025] [:error] [pid 25430:tid 25472] [client 45.132.227.62:57267] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSAbRqpnWJcWt_4foXk97wAAAEw"]
[Fri Nov 21 15:56:57.081405 2025] [:error] [pid 25521:tid 25535] [client 45.132.227.56:41697] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSAbSfhXnBMilDddn3Xh9wAAAMw"]
[Fri Nov 21 15:56:58.964209 2025] [:error] [pid 25430:tid 25472] [client 136.144.42.75:51285] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Fri Nov 21 15:56:59.447248 2025] [:error] [pid 25430:tid 25475] [client 136.144.42.75:51285] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSAbS6pnWJcWt_4foXk-GAAAAE8"]
[Fri Nov 21 15:57:01.729506 2025] [:error] [pid 25430:tid 25461] [client 172.98.32.98:33199] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSAbTapnWJcWt_4foXk-KwAAAEE"]
[Fri Nov 21 15:57:02.630968 2025] [:error] [pid 25429:tid 25437] [client 172.98.32.77:58311] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Fri Nov 21 15:57:05.370459 2025] [:error] [pid 25429:tid 25455] [client 172.98.32.77:58311] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSAbUT4rZbRSr7vu-NOhFgAAABY"]
[Fri Nov 21 15:57:06.744282 2025] [:error] [pid 25554:tid 25566] [client 45.132.227.62:56337] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSAbUh-NtB-9AzFZrk5NigAAAQg"]
[Fri Nov 21 15:57:08.080235 2025] [:error] [pid 25429:tid 25435] [client 45.132.227.68:53357] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSAbVD4rZbRSr7vu-NOhKgAAAAI"]
[Fri Nov 21 15:57:09.954050 2025] [:error] [pid 25429:tid 25451] [client 136.144.42.73:61683] [client 136.144.42.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSAbVT4rZbRSr7vu-NOhQQAAABI"]
[Fri Nov 21 15:57:14.514614 2025] [:error] [pid 46939:tid 46955] [client 172.98.32.82:51669] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSAbWu0OmVoxD4VZ_ZloPwAAAU0"]
[Fri Nov 21 15:57:15.387318 2025] [:error] [pid 25521:tid 25529] [client 172.98.32.93:62813] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSAbW_hXnBMilDddn3XidgAAAMY"]
[Fri Nov 21 15:57:18.956525 2025] [:error] [pid 25430:tid 25472] [client 172.98.32.80:46307] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSAbXqpnWJcWt_4foXk-xwAAAEw"]
[Fri Nov 21 15:57:19.838909 2025] [:error] [pid 25431:tid 25501] [client 45.132.227.60:63001] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSAbX8klhXxmoIExII0tpwAAAI4"]
[Fri Nov 21 15:57:21.583376 2025] [:error] [pid 25431:tid 25504] [client 172.98.32.89:23455] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSAbYcklhXxmoIExII0ttQAAAJE"]
[Fri Nov 21 15:57:22.490777 2025] [:error] [pid 46939:tid 46946] [client 45.132.227.63:56389] [client 45.132.227.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSAbYu0OmVoxD4VZ_ZlokgAAAUQ"]
[Fri Nov 21 15:57:23.359374 2025] [:error] [pid 25429:tid 25454] [client 136.144.42.75:44415] [client 136.144.42.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.42.75, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSAbYz4rZbRSr7vu-NOhswAAABU"]
[Fri Nov 21 15:57:23.364217 2025] [:error] [pid 25429:tid 25454] [client 136.144.42.75:44415] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Fri Nov 21 15:57:23.797537 2025] [:error] [pid 25429:tid 25435] [client 136.144.42.75:44415] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSAbYz4rZbRSr7vu-NOhugAAAAI"]
[Fri Nov 21 15:57:26.491473 2025] [:error] [pid 25429:tid 25450] [client 45.132.227.60:62785] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Nov 21 15:57:26.918069 2025] [:error] [pid 25429:tid 25454] [client 45.132.227.60:62785] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSAbZj4rZbRSr7vu-NOh1gAAABU"]
[Fri Nov 21 15:57:27.881752 2025] [:error] [pid 25429:tid 25434] [client 136.144.42.78:58233] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aSAbZz4rZbRSr7vu-NOh4QAAAAE"]
[Fri Nov 21 15:57:28.845368 2025] [:error] [pid 46939:tid 46946] [client 172.98.32.100:39987] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Fri Nov 21 15:57:32.009467 2025] [:error] [pid 46939:tid 46966] [client 172.98.32.100:39987] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSAbbO0OmVoxD4VZ_ZlpAwAAAVg"]
[Fri Nov 21 15:57:32.868863 2025] [:error] [pid 25554:tid 25582] [client 172.98.32.78:28767] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSAbbB-NtB-9AzFZrk5ORgAAARg"]
[Fri Nov 21 15:57:34.604066 2025] [:error] [pid 25429:tid 25444] [client 45.132.227.65:48247] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSAbbj4rZbRSr7vu-NOiGgAAAAs"]
[Fri Nov 21 15:57:35.567846 2025] [:error] [pid 25430:tid 25476] [client 172.98.32.89:24103] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSAbb6pnWJcWt_4foXk_KAAAAFA"]
[Fri Nov 21 15:57:36.481021 2025] [:error] [pid 25429:tid 25438] [client 136.144.42.78:58063] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Fri Nov 21 15:57:36.931484 2025] [:error] [pid 25429:tid 25439] [client 136.144.42.78:58063] [client 136.144.42.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.42.78, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSAbcD4rZbRSr7vu-NOiLQAAAAY"]
[Fri Nov 21 15:57:37.815337 2025] [:error] [pid 25429:tid 25433] [client 136.144.42.78:58063] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSAbcT4rZbRSr7vu-NOiOQAAAAA"]
[Fri Nov 21 15:57:40.459618 2025] [:error] [pid 25430:tid 25463] [client 45.132.227.62:40207] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSAbdKpnWJcWt_4foXk_TQAAAEM"]
[Fri Nov 21 15:57:41.405469 2025] [:error] [pid 46939:tid 46965] [client 172.98.32.83:56815] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Fri Nov 21 15:57:41.837096 2025] [:error] [pid 46939:tid 46961] [client 172.98.32.83:56815] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSAbde0OmVoxD4VZ_ZlpSQAAAVM"]
[Fri Nov 21 15:57:42.701291 2025] [:error] [pid 25431:tid 25498] [client 172.98.32.76:38519] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSAbdsklhXxmoIExII0udQAAAIs"]
[Fri Nov 21 15:57:43.687981 2025] [:error] [pid 25521:tid 25547] [client 45.132.227.64:60973] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Fri Nov 21 15:57:45.042127 2025] [:error] [pid 25521:tid 25535] [client 45.132.227.64:60973] [client 45.132.227.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSAbefhXnBMilDddn3XjMwAAAMw"]
[Fri Nov 21 15:57:46.852312 2025] [:error] [pid 25431:tid 25511] [client 45.132.227.65:20803] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSAbesklhXxmoIExII0umQAAAJg"]
[Fri Nov 21 15:57:47.893109 2025] [:error] [pid 25429:tid 25435] [client 172.98.32.79:29769] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Fri Nov 21 15:57:48.783975 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.79:29769] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Nov 21 15:57:49.678658 2025] [:error] [pid 25429:tid 25433] [client 172.98.32.79:29769] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSAbfT4rZbRSr7vu-NOipwAAAAA"]
[Fri Nov 21 15:57:50.601318 2025] [:error] [pid 25430:tid 25481] [client 45.132.227.61:64425] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSAbfqpnWJcWt_4foXk_iwAAAFU"]
[Fri Nov 21 15:57:52.060245 2025] [:error] [pid 25430:tid 25463] [client 172.98.32.86:29813] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aSAbgKpnWJcWt_4foXk_mgAAAEM"]
[Fri Nov 21 15:57:52.949687 2025] [:error] [pid 25554:tid 25573] [client 172.98.32.83:37153] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Fri Nov 21 15:57:55.728469 2025] [:error] [pid 25554:tid 25568] [client 172.98.32.83:37153] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSAbgx-NtB-9AzFZrk5O_QAAAQo"]
[Fri Nov 21 15:57:57.489400 2025] [:error] [pid 25429:tid 25450] [client 45.132.227.52:21773] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||www.aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aSAbhT4rZbRSr7vu-NOi1gAAABE"]
[Fri Nov 21 15:57:57.938308 2025] [:error] [pid 25429:tid 25446] [client 45.132.227.52:21773] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSAbhT4rZbRSr7vu-NOi2QAAAA0"]
[Fri Nov 21 15:57:59.727819 2025] [:error] [pid 25429:tid 25440] [client 136.144.42.74:58725] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSAbhz4rZbRSr7vu-NOi5wAAAAc"]
[Fri Nov 21 15:58:00.587974 2025] [:error] [pid 46939:tid 46964] [client 172.98.32.85:31281] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSAbiO0OmVoxD4VZ_Zlp0QAAAVY"]
[Fri Nov 21 15:58:02.394646 2025] [:error] [pid 25430:tid 25475] [client 136.144.42.80:30125] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Fri Nov 21 15:58:04.177680 2025] [:error] [pid 25430:tid 25482] [client 136.144.42.80:30125] [client 136.144.42.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSAbjKpnWJcWt_4foXk_8AAAAFY"]
[Fri Nov 21 15:58:05.992375 2025] [:error] [pid 25430:tid 25483] [client 136.144.42.69:39417] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSAbjapnWJcWt_4foXk_-wAAAFc"]
[Fri Nov 21 15:58:07.280622 2025] [:error] [pid 46939:tid 46950] [client 172.98.32.84:31245] [client 172.98.32.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSAbj-0OmVoxD4VZ_ZlqAAAAAUg"]
[Fri Nov 21 15:58:08.160645 2025] [:error] [pid 46939:tid 46954] [client 172.98.32.96:44919] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Fri Nov 21 15:58:10.455367 2025] [:error] [pid 46939:tid 46944] [client 172.98.32.96:44919] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSAbku0OmVoxD4VZ_ZlqJQAAAUI"]
[Fri Nov 21 15:58:11.769951 2025] [:error] [pid 25430:tid 25470] [client 136.144.42.79:32703] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aSAbk6pnWJcWt_4foXlANAAAAEo"]
[Fri Nov 21 15:58:12.661017 2025] [:error] [pid 25430:tid 25481] [client 172.98.32.96:38503] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Nov 21 15:58:13.097567 2025] [:error] [pid 25430:tid 25483] [client 172.98.32.96:38503] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSAblapnWJcWt_4foXlARAAAAFc"]
[Fri Nov 21 15:58:14.029020 2025] [:error] [pid 25431:tid 25502] [client 172.98.32.80:56755] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSAblsklhXxmoIExII0vnAAAAI8"]
[Fri Nov 21 15:58:15.802413 2025] [:error] [pid 46939:tid 46950] [client 172.98.32.77:63933] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSAbl-0OmVoxD4VZ_ZlqUgAAAUg"]
[Fri Nov 21 15:58:18.092269 2025] [:error] [pid 25521:tid 25535] [client 172.98.32.89:61937] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Fri Nov 21 15:58:18.520315 2025] [:error] [pid 25521:tid 25541] [client 172.98.32.89:61937] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSAbmvhXnBMilDddn3XkEAAAANI"]
[Fri Nov 21 15:58:19.372623 2025] [:error] [pid 25431:tid 25495] [client 45.132.227.55:51029] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSAbm8klhXxmoIExII0vwQAAAIg"]
[Fri Nov 21 15:58:22.441295 2025] [:error] [pid 25429:tid 25453] [client 45.132.227.58:59153] [client 45.132.227.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSAbnj4rZbRSr7vu-NOj0QAAABQ"]
[Fri Nov 21 15:58:25.612882 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.95:45893] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSAboT4rZbRSr7vu-NOj9wAAABg"]
[Fri Nov 21 15:58:26.516329 2025] [:error] [pid 25554:tid 25570] [client 172.98.32.78:45225] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Fri Nov 21 15:58:27.861353 2025] [:error] [pid 25554:tid 25569] [client 172.98.32.78:45225] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSAbox-NtB-9AzFZrk5PugAAAQs"]
[Fri Nov 21 15:58:28.711674 2025] [:error] [pid 46939:tid 46957] [client 172.98.32.92:50229] [client 172.98.32.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSAbpO0OmVoxD4VZ_Zlq1gAAAU8"]
[Fri Nov 21 15:58:30.046856 2025] [:error] [pid 25430:tid 25470] [client 172.98.32.82:55959] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSAbpqpnWJcWt_4foXlAmgAAAEo"]
[Fri Nov 21 15:58:30.911748 2025] [:error] [pid 25521:tid 25535] [client 172.98.32.82:27815] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Fri Nov 21 15:58:31.808822 2025] [:error] [pid 25521:tid 25546] [client 172.98.32.82:27815] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSAbp_hXnBMilDddn3XkWAAAANc"]
[Fri Nov 21 15:58:32.710839 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.91:52643] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Fri Nov 21 15:58:33.620912 2025] [:error] [pid 25429:tid 25442] [client 172.98.32.91:52643] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSAbqT4rZbRSr7vu-NOkWgAAAAk"]
[Fri Nov 21 15:58:34.542310 2025] [:error] [pid 25431:tid 25511] [client 172.98.32.90:48615] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSAbqsklhXxmoIExII0wGwAAAJg"]
[Fri Nov 21 15:58:35.880417 2025] [:error] [pid 25521:tid 25547] [client 172.98.32.95:22691] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSAbq_hXnBMilDddn3XkdAAAANg"]
[Fri Nov 21 15:58:36.787632 2025] [:error] [pid 25521:tid 25537] [client 45.132.227.61:62661] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSAbrPhXnBMilDddn3XkfQAAAM4"]
[Fri Nov 21 15:58:38.630412 2025] [:error] [pid 25430:tid 25469] [client 136.144.42.70:60241] [client 136.144.42.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSAbrqpnWJcWt_4foXlA2AAAAEk"]
[Fri Nov 21 15:58:39.980630 2025] [:error] [pid 25431:tid 25501] [client 172.98.32.88:65041] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSAbr8klhXxmoIExII0wagAAAI4"]
[Fri Nov 21 15:58:40.877830 2025] [:error] [pid 25431:tid 25508] [client 172.98.32.81:50951] [client 172.98.32.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSAbsMklhXxmoIExII0wfAAAAJU"]
[Fri Nov 21 15:58:41.735326 2025] [:error] [pid 25521:tid 25541] [client 136.144.42.77:24559] [client 136.144.42.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSAbsfhXnBMilDddn3XkkQAAANI"]
[Fri Nov 21 15:58:44.640829 2025] [:error] [pid 25521:tid 25526] [client 45.132.227.68:22991] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSAbtPhXnBMilDddn3XkrgAAAMM"]
[Fri Nov 21 15:58:46.471365 2025] [:error] [pid 25429:tid 25456] [client 45.132.227.64:60803] [client 45.132.227.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSAbtj4rZbRSr7vu-NOlKwAAABc"]
[Fri Nov 21 15:58:47.867596 2025] [:error] [pid 25429:tid 25456] [client 172.98.32.96:32565] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSAbtz4rZbRSr7vu-NOlPAAAABc"]
[Fri Nov 21 15:58:49.200407 2025] [:error] [pid 25554:tid 25558] [client 136.144.42.69:22985] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSAbuR-NtB-9AzFZrk5QWAAAAQA"]
[Fri Nov 21 15:58:50.985503 2025] [:error] [pid 25430:tid 25465] [client 172.98.32.79:34773] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Fri Nov 21 15:58:52.857168 2025] [:error] [pid 25430:tid 25476] [client 172.98.32.79:34773] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSAbvKpnWJcWt_4foXlBQQAAAFA"]
[Fri Nov 21 15:58:53.762723 2025] [:error] [pid 46939:tid 46965] [client 172.98.32.93:63359] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSAbve0OmVoxD4VZ_ZlrmQAAAVc"]
[Fri Nov 21 15:58:55.146618 2025] [:error] [pid 46939:tid 46956] [client 45.132.227.53:56357] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Fri Nov 21 15:58:55.570902 2025] [:error] [pid 46939:tid 46958] [client 45.132.227.53:56357] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSAbv-0OmVoxD4VZ_ZlrpgAAAVA"]
[Fri Nov 21 15:58:58.230368 2025] [:error] [pid 25521:tid 25540] [client 45.132.227.59:39431] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSAbwvhXnBMilDddn3XlBwAAANE"]
[Fri Nov 21 15:58:59.543968 2025] [:error] [pid 25430:tid 25466] [client 172.98.32.85:42667] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Fri Nov 21 15:58:59.985607 2025] [:error] [pid 25430:tid 25468] [client 172.98.32.85:42667] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSAbw6pnWJcWt_4foXlBZAAAAEg"]
[Fri Nov 21 15:59:01.701459 2025] [:error] [pid 25429:tid 25449] [client 172.98.32.90:32103] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSAbxT4rZbRSr7vu-NOlpQAAABA"]
[Fri Nov 21 15:59:02.653027 2025] [:error] [pid 25430:tid 25484] [client 172.98.32.93:37261] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Nov 21 15:59:03.104737 2025] [:error] [pid 25430:tid 25482] [client 172.98.32.93:37261] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSAbx6pnWJcWt_4foXlBbAAAAFY"]
[Fri Nov 21 15:59:04.397643 2025] [:error] [pid 25431:tid 25504] [client 172.98.32.80:37163] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSAbyMklhXxmoIExII0xTQAAAJE"]
[Fri Nov 21 15:59:06.689090 2025] [:error] [pid 46939:tid 46946] [client 172.98.32.98:42049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Fri Nov 21 15:59:07.133459 2025] [:error] [pid 46939:tid 46945] [client 172.98.32.98:42049] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSAby-0OmVoxD4VZ_ZlsNwAAAUM"]
[Fri Nov 21 15:59:09.325490 2025] [:error] [pid 25430:tid 25470] [client 172.98.32.89:58749] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSAbzapnWJcWt_4foXlBkAAAAEo"]
[Fri Nov 21 15:59:10.207411 2025] [:error] [pid 25430:tid 25466] [client 136.144.42.78:52273] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Fri Nov 21 15:59:10.653564 2025] [:error] [pid 25430:tid 25468] [client 136.144.42.78:52273] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSAbzqpnWJcWt_4foXlBmAAAAEg"]
[Fri Nov 21 15:59:11.588481 2025] [:error] [pid 46939:tid 46944] [client 136.144.42.78:36111] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSAbz-0OmVoxD4VZ_ZlsbgAAAUI"]
[Fri Nov 21 15:59:12.532455 2025] [:error] [pid 25554:tid 25577] [client 172.98.32.90:28757] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Fri Nov 21 15:59:13.399673 2025] [:error] [pid 25554:tid 25571] [client 172.98.32.90:28757] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSAb0R-NtB-9AzFZrk5Q-wAAAQ0"]
[Fri Nov 21 15:59:14.252861 2025] [:error] [pid 25554:tid 25558] [client 172.98.32.94:63167] [client 172.98.32.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSAb0h-NtB-9AzFZrk5RAQAAAQA"]
[Fri Nov 21 15:59:17.930682 2025] [:error] [pid 46939:tid 46952] [client 172.98.32.82:27169] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSAb1e0OmVoxD4VZ_ZlspgAAAUo"]
[Fri Nov 21 15:59:18.786632 2025] [:error] [pid 25521:tid 25529] [client 136.144.42.72:50061] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSAb1vhXnBMilDddn3XliQAAAMY"]
[Fri Nov 21 15:59:20.090774 2025] [:error] [pid 25554:tid 25567] [client 45.132.227.62:27861] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aSAb2B-NtB-9AzFZrk5RMAAAAQk"]
[Fri Nov 21 15:59:20.957520 2025] [:error] [pid 46939:tid 46953] [client 172.98.32.95:22537] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSAb2O0OmVoxD4VZ_ZlsxwAAAUs"]
[Fri Nov 21 15:59:21.828056 2025] [:error] [pid 25431:tid 25504] [client 136.144.42.72:47733] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSAb2cklhXxmoIExII0xrgAAAJE"]
[Fri Nov 21 15:59:22.718068 2025] [:error] [pid 25521:tid 25535] [client 172.98.32.96:29645] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aSAb2vhXnBMilDddn3XlqQAAAMw"]
[Fri Nov 21 15:59:26.594727 2025] [:error] [pid 46939:tid 46946] [client 45.132.227.58:42549] [client 45.132.227.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSAb3u0OmVoxD4VZ_ZltAwAAAUQ"]
[Fri Nov 21 15:59:27.499253 2025] [:error] [pid 25554:tid 25559] [client 136.144.42.80:49909] [client 136.144.42.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aSAb3x-NtB-9AzFZrk5RbgAAAQE"]
[Fri Nov 21 15:59:28.815587 2025] [:error] [pid 25554:tid 25559] [client 45.132.227.62:58523] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Fri Nov 21 15:59:29.276395 2025] [:error] [pid 25554:tid 25563] [client 45.132.227.62:58523] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSAb4R-NtB-9AzFZrk5RhgAAAQU"]
[Fri Nov 21 15:59:30.127331 2025] [:error] [pid 25429:tid 25436] [client 45.132.227.62:41755] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSAb4j4rZbRSr7vu-NOmRAAAAAM"]
[Fri Nov 21 15:59:32.026399 2025] [:error] [pid 25521:tid 25532] [client 45.132.227.66:38921] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aSAb5PhXnBMilDddn3Xl9QAAAMk"]
[Fri Nov 21 15:59:32.913915 2025] [:error] [pid 46939:tid 46964] [client 45.132.227.56:62699] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSAb5O0OmVoxD4VZ_ZltQQAAAVY"]
[Fri Nov 21 15:59:36.948106 2025] [:error] [pid 46939:tid 46953] [client 45.132.227.53:64837] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aSAb6O0OmVoxD4VZ_ZltegAAAUs"]
[Fri Nov 21 15:59:37.865495 2025] [:error] [pid 46939:tid 46949] [client 45.132.227.61:51917] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSAb6e0OmVoxD4VZ_ZltgQAAAUc"]
[Fri Nov 21 15:59:39.632238 2025] [:error] [pid 25521:tid 25528] [client 172.98.32.89:40041] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aSAb6_hXnBMilDddn3XmLAAAAMU"]
[Fri Nov 21 15:59:41.077398 2025] [:error] [pid 25431:tid 25503] [client 136.144.42.69:33301] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSAb7cklhXxmoIExII0yEgAAAJA"]
[Fri Nov 21 15:59:42.388163 2025] [:error] [pid 46939:tid 46950] [client 172.98.32.82:24379] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aSAb7u0OmVoxD4VZ_ZltrwAAAUg"]
[Fri Nov 21 15:59:43.328383 2025] [:error] [pid 25554:tid 25563] [client 45.132.227.56:36295] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSAb7x-NtB-9AzFZrk5R9AAAAQU"]
[Fri Nov 21 15:59:44.225520 2025] [:error] [pid 25430:tid 25460] [client 172.98.32.85:29739] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSAb8KpnWJcWt_4foXlCOwAAAEA"]
[Fri Nov 21 15:59:46.480671 2025] [:error] [pid 25429:tid 25441] [client 136.144.42.79:24313] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSAb8j4rZbRSr7vu-NOmiwAAAAg"]
[Fri Nov 21 15:59:47.379291 2025] [:error] [pid 25521:tid 25537] [client 45.132.227.66:26591] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Fri Nov 21 15:59:47.810462 2025] [:error] [pid 25521:tid 25540] [client 45.132.227.66:26591] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSAb8_hXnBMilDddn3XmegAAANE"]
[Fri Nov 21 15:59:49.629737 2025] [:error] [pid 25429:tid 25443] [client 172.98.32.88:33169] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Fri Nov 21 15:59:50.057883 2025] [:error] [pid 25429:tid 25454] [client 172.98.32.88:33169] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSAb9j4rZbRSr7vu-NOmoAAAABU"]
[Fri Nov 21 15:59:51.959519 2025] [:error] [pid 46939:tid 46947] [client 136.144.42.77:30891] [client 136.144.42.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSAb9-0OmVoxD4VZ_ZluCAAAAUU"]
[Fri Nov 21 15:59:53.383918 2025] [:error] [pid 25431:tid 25497] [client 172.98.32.85:24653] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSAb-cklhXxmoIExII0yWAAAAIo"]
[Fri Nov 21 15:59:56.515292 2025] [:error] [pid 25431:tid 25506] [client 45.132.227.56:35955] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Fri Nov 21 15:59:58.322216 2025] [:error] [pid 25431:tid 25493] [client 45.132.227.56:35955] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aSAb_sklhXxmoIExII0yjAAAAIY"]
[Fri Nov 21 15:59:59.751582 2025] [:error] [pid 25431:tid 25489] [client 172.98.32.93:21737] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSAb_8klhXxmoIExII0ymAAAAII"]
[Fri Nov 21 16:00:01.602350 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.97:25163] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aSAcAT4rZbRSr7vu-NOm6gAAAAY"]
[Fri Nov 21 16:00:02.587395 2025] [:error] [pid 25431:tid 25509] [client 172.98.32.87:59857] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aSAcAsklhXxmoIExII0yrQAAAJY"]
[Fri Nov 21 16:00:03.526820 2025] [:error] [pid 25554:tid 25572] [client 136.144.42.70:65115] [client 136.144.42.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aSAcAx-NtB-9AzFZrk5ScQAAAQ4"]
[Fri Nov 21 16:00:58.283167 2025] [:error] [pid 46939:tid 46952] [client 213.21.239.4:58456] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAcOu0OmVoxD4VZ_ZlxSAAAAUo"]
[Fri Nov 21 18:45:42.636360 2025] [:error] [pid 25429:tid 25436] [client 104.28.208.82:10764] [client 104.28.208.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.208.82, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSBC1j4rZbRSr7vu-NPblQAAAAM"]
[Fri Nov 21 18:45:42.640260 2025] [:error] [pid 25429:tid 25436] [client 104.28.208.82:10764] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Nov 21 23:18:08.632010 2025] [:error] [pid 39979:tid 39991] [client 159.203.163.116:38720] [client 159.203.163.116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSCCsMBTn4w4bKlE6arDkAAAAYk"]
[Sat Nov 22 02:55:25.664118 2025] [:error] [pid 49643:tid 49933] [client 122.162.147.64:3596] [client 122.162.147.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.162.147.64, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSC1nZwUojIRHhF_fj-nWwAAAM0"]
[Sat Nov 22 02:55:25.667428 2025] [:error] [pid 49643:tid 49933] [client 122.162.147.64:3596] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Nov 22 03:53:17.028126 2025] [:error] [pid 53479:tid 53555] [client 103.167.150.158:56559] [client 103.167.150.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aSDDLW6cicFF3Aas-oQ8JAAAAJM"]
[Sat Nov 22 06:56:42.643591 2025] [:error] [pid 25856:tid 25871] [client 212.116.231.26:49024] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSDuKhsTP0wy94zKUvHnOgAAAQ0"]
[Sat Nov 22 06:56:43.478148 2025] [:error] [pid 53478:tid 53522] [client 212.116.231.26:49478] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSDuKwhUYdXBbQswAdRABAAAAE0"]
[Sat Nov 22 06:56:44.289742 2025] [:error] [pid 25856:tid 25874] [client 212.116.231.26:49954] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSDuLBsTP0wy94zKUvHnVgAAARA"]
[Sat Nov 22 06:56:45.124798 2025] [:error] [pid 25856:tid 25875] [client 212.116.231.26:50386] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSDuLRsTP0wy94zKUvHnYgAAARE"]
[Sat Nov 22 06:56:45.939340 2025] [:error] [pid 53566:tid 53586] [client 212.116.231.26:50806] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSDuLcbSHDBkRbwMbd5nhAAAANI"]
[Sat Nov 22 06:56:46.752903 2025] [:error] [pid 9547:tid 9571] [client 212.116.231.26:51224] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuLtClOR5qk7DoMeGlpgAAAVI"]
[Sat Nov 22 06:56:47.595911 2025] [:error] [pid 53477:tid 53481] [client 212.116.231.26:51602] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuL37Lu30Ku9O40aIHAAAAAAA"]
[Sat Nov 22 06:56:48.413169 2025] [:error] [pid 25856:tid 25864] [client 212.116.231.26:52078] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuMBsTP0wy94zKUvHnqwAAAQY"]
[Sat Nov 22 06:56:49.225787 2025] [:error] [pid 53477:tid 53488] [client 212.116.231.26:52560] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuMX7Lu30Ku9O40aIHEQAAAAc"]
[Sat Nov 22 06:56:50.041636 2025] [:error] [pid 53479:tid 53554] [client 212.116.231.26:45854] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuMm6cicFF3Aas-oShvwAAAJI"]
[Sat Nov 22 07:14:31.831237 2025] [:error] [pid 25856:tid 25878] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Nov 22 07:14:31.945256 2025] [:error] [pid 25856:tid 25870] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Nov 22 07:14:32.095337 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Nov 22 07:14:32.250280 2025] [:error] [pid 25856:tid 25879] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Nov 22 07:14:32.395013 2025] [:error] [pid 25856:tid 25867] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Nov 22 07:14:32.494972 2025] [:error] [pid 25856:tid 25864] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Nov 22 07:14:32.624790 2025] [:error] [pid 25856:tid 25865] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Nov 22 07:14:33.631429 2025] [:error] [pid 25856:tid 25865] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Nov 22 07:14:33.846373 2025] [:error] [pid 25856:tid 25880] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Nov 22 07:14:34.124810 2025] [:error] [pid 25856:tid 25876] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Nov 22 07:14:34.249582 2025] [:error] [pid 25856:tid 25881] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Nov 22 07:14:34.365611 2025] [:error] [pid 25856:tid 25872] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Nov 22 07:14:34.499842 2025] [:error] [pid 25856:tid 25882] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Nov 22 07:14:34.711059 2025] [:error] [pid 25856:tid 25875] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Nov 22 07:14:34.837670 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Nov 22 07:14:34.939336 2025] [:error] [pid 25856:tid 25878] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Nov 22 07:14:35.070067 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Nov 22 07:14:35.162365 2025] [:error] [pid 25856:tid 25867] [client 194.5.82.124:41475] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Nov 22 07:14:36.913307 2025] [:error] [pid 25856:tid 25862] [client 194.5.82.124:41475] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSDyXBsTP0wy94zKUvHupwAAAQQ"]
[Sat Nov 22 07:14:37.552357 2025] [:error] [pid 53478:tid 53531] [client 194.5.82.116:22661] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSDyXQhUYdXBbQswAdRFnQAAAFY"]
[Sat Nov 22 10:10:11.036236 2025] [:error] [pid 53478:tid 53522] [client 139.59.37.180:62646] [client 139.59.37.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/"] [unique_id "aSEbgwhUYdXBbQswAdR6PwAAAE0"], referer: binance.com
[Sat Nov 22 10:10:18.869629 2025] [:error] [pid 53477:tid 53493] [client 139.59.37.180:50583] [client 139.59.37.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/images/"] [unique_id "aSEbin7Lu30Ku9O40aI-QQAAAAw"], referer: binance.com
[Sat Nov 22 10:10:26.059012 2025] [:error] [pid 9547:tid 9553] [client 139.59.37.180:56591] [client 139.59.37.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files/"] [unique_id "aSEbktClOR5qk7DoMeEGfAAAAUA"], referer: binance.com
[Sat Nov 22 16:05:51.803426 2025] [:error] [pid 9547:tid 9566] [client 20.234.11.210:29642] [client 20.234.11.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSFu39ClOR5qk7DoMeF7dwAAAU0"]
[Sat Nov 22 16:05:52.761221 2025] [:error] [pid 53479:tid 53549] [client 20.234.11.210:28835] [client 20.234.11.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSFu4G6cicFF3Aas-oRYDAAAAI0"]
[Sat Nov 22 16:05:54.742483 2025] [:error] [pid 53479:tid 53557] [client 20.234.11.210:29693] [client 20.234.11.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSFu4m6cicFF3Aas-oRYDQAAAJU"]
[Sat Nov 22 16:05:56.800303 2025] [:error] [pid 53478:tid 53520] [client 20.234.11.210:29636] [client 20.234.11.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSFu5AhUYdXBbQswAdTNzwAAAEs"]
[Sat Nov 22 23:43:02.918166 2025] [:error] [pid 53478:tid 53528] [client 167.71.203.246:51379] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Nov 23 00:50:14.383427 2025] [:error] [pid 39719:tid 39784] [client 210.1.106.6:18715] [client 210.1.106.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.1.106.6, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSHpxhmP4k0tY5Yex-W4OQAAAQg"]
[Sun Nov 23 00:50:14.390861 2025] [:error] [pid 39719:tid 39784] [client 210.1.106.6:18715] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Nov 23 01:35:42.544776 2025] [:error] [pid 39713:tid 39725] [client 216.126.225.91:37814] [client 216.126.225.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSH0bkUgrb325CIAjPqZrgAAAAQ"]
[Sun Nov 23 03:26:25.335825 2025] [:error] [pid 39719:tid 39782] [client 129.212.231.54:52202] [client 129.212.231.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.212.231.54, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSIOYRmP4k0tY5Yex-X0AAAAAQY"]
[Sun Nov 23 03:26:25.339424 2025] [:error] [pid 39719:tid 39782] [client 129.212.231.54:52202] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Nov 23 03:26:26.342089 2025] [:error] [pid 39719:tid 39793] [client 129.212.231.54:52202] [client 129.212.231.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aSIOYhmP4k0tY5Yex-X0GAAAARE"]
[Sun Nov 23 03:26:26.516591 2025] [:error] [pid 39719:tid 39782] [client 129.212.231.54:51537] [client 129.212.231.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aSIOYhmP4k0tY5Yex-X0GQAAAQY"]
[Sun Nov 23 03:26:26.691265 2025] [:error] [pid 39718:tid 39762] [client 129.212.231.54:55610] [client 129.212.231.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aSIOYgQ3B_uDoeItNmOTCgAAAE0"]
[Sun Nov 23 03:26:26.865872 2025] [:error] [pid 39719:tid 39776] [client 129.212.231.54:60425] [client 129.212.231.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aSIOYhmP4k0tY5Yex-X0HgAAAQA"]
[Sun Nov 23 03:26:27.040425 2025] [:error] [pid 39718:tid 39754] [client 129.212.231.54:64758] [client 129.212.231.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aSIOYwQ3B_uDoeItNmOTCwAAAEU"]
[Sun Nov 23 03:26:27.217331 2025] [:error] [pid 39713:tid 39735] [client 129.212.231.54:52474] [client 129.212.231.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aSIOY0Ugrb325CIAjPrDswAAAA4"]
[Sun Nov 23 03:39:46.351531 2025] [:error] [pid 39719:tid 39799] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.fr/
[Sun Nov 23 03:39:46.543338 2025] [:error] [pid 39719:tid 39784] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.co.uk/
[Sun Nov 23 03:39:46.741809 2025] [:error] [pid 39719:tid 39787] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://duckduckgo.com/
[Sun Nov 23 03:39:46.932354 2025] [:error] [pid 39719:tid 39779] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.com/
[Sun Nov 23 03:39:47.128138 2025] [:error] [pid 39719:tid 39785] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.yahoo.com/
[Sun Nov 23 03:39:47.341833 2025] [:error] [pid 39719:tid 39778] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.google.fr/
[Sun Nov 23 03:39:47.794027 2025] [:error] [pid 39719:tid 39788] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.fr/
[Sun Nov 23 03:39:47.986024 2025] [:error] [pid 39719:tid 39791] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php, referer: https://www.google.de/
[Sun Nov 23 03:39:48.944719 2025] [:error] [pid 39719:tid 39790] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.co.uk/
[Sun Nov 23 03:39:49.134235 2025] [:error] [pid 39719:tid 39789] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.com/
[Sun Nov 23 03:39:49.324754 2025] [:error] [pid 39719:tid 39795] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.google.de/
[Sun Nov 23 03:39:49.516758 2025] [:error] [pid 39719:tid 39777] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.bing.com/
[Sun Nov 23 03:39:49.707347 2025] [:error] [pid 39719:tid 39794] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.bing.com/
[Sun Nov 23 03:39:50.263452 2025] [:error] [pid 39719:tid 39793] [client 52.173.190.232:7381] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php, referer: https://www.google.co.uk/
[Sun Nov 23 03:39:50.449601 2025] [:error] [pid 39719:tid 39780] [client 52.173.190.232:7381] [client 52.173.190.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSIRhhmP4k0tY5Yex-X4PwAAAQQ"], referer: https://www.google.de/
[Sun Nov 23 03:39:51.228985 2025] [:error] [pid 39713:tid 39739] [client 52.173.190.232:7243] [client 52.173.190.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSIRh0Ugrb325CIAjPrHFAAAABI"], referer: https://duckduckgo.com/
[Sun Nov 23 03:39:52.401865 2025] [:error] [pid 8816:tid 8898] [client 52.173.190.232:1779] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php, referer: https://www.yahoo.com/
[Sun Nov 23 03:39:52.860396 2025] [:error] [pid 8816:tid 8888] [client 52.173.190.232:1779] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wso112233.php, referer: https://www.google.de/
[Sun Nov 23 03:39:54.068299 2025] [:error] [pid 8816:tid 8895] [client 52.173.190.232:1779] [client 52.173.190.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aSIRipb4RIAN-_BXnHmjVAAAAIo"], referer: https://www.google.com/
[Sun Nov 23 03:39:55.708686 2025] [:error] [pid 39718:tid 39754] [client 52.173.190.232:7198] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php, referer: https://www.google.de/
[Sun Nov 23 03:39:56.588822 2025] [:error] [pid 39718:tid 39749] [client 52.173.190.232:7198] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/shell20211028.php, referer: https://www.yahoo.com/
[Sun Nov 23 03:39:57.602495 2025] [:error] [pid 39718:tid 39773] [client 52.173.190.232:7198] [client 52.173.190.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aSIRjQQ3B_uDoeItNmOWzQAAAFg"], referer: https://www.google.com/
[Sun Nov 23 03:39:59.071789 2025] [:error] [pid 39719:tid 39790] [client 52.173.190.232:2330] File does not exist: /usr/local/apache/htdocs/suspended-page/bala.php, referer: https://www.yahoo.com/
[Sun Nov 23 03:39:59.933889 2025] [:error] [pid 39719:tid 39789] [client 52.173.190.232:2330] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/bala.php, referer: https://www.google.fr/
[Sun Nov 23 03:40:00.909019 2025] [:error] [pid 39719:tid 39797] [client 52.173.190.232:2330] [client 52.173.190.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bala.php"] [unique_id "aSIRkBmP4k0tY5Yex-X4UAAAARU"], referer: https://www.yahoo.com/
[Sun Nov 23 03:40:02.599491 2025] [:error] [pid 39718:tid 39757] [client 52.173.190.232:2344] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php, referer: https://www.bing.com/
[Sun Nov 23 03:40:02.987082 2025] [:error] [pid 39718:tid 39756] [client 52.173.190.232:2344] [client 52.173.190.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aSIRkgQ3B_uDoeItNmOW5AAAAEc"], referer: https://www.yahoo.com/
[Sun Nov 23 03:40:04.981808 2025] [:error] [pid 39942:tid 40005] [client 52.173.190.232:5427] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php, referer: https://duckduckgo.com/
[Sun Nov 23 03:40:05.945249 2025] [:error] [pid 39942:tid 40015] [client 52.173.190.232:5427] [client 52.173.190.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/repeater.php"] [unique_id "aSIRlaNupsOsQf9D2gyUGgAAAVQ"], referer: https://www.google.com/
[Sun Nov 23 03:40:07.557521 2025] [:error] [pid 8816:tid 8906] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php, referer: https://duckduckgo.com/
[Sun Nov 23 03:40:07.749344 2025] [:error] [pid 8816:tid 8908] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php, referer: https://www.google.co.uk/
[Sun Nov 23 03:40:08.530339 2025] [:error] [pid 8816:tid 8896] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php, referer: https://duckduckgo.com/
[Sun Nov 23 03:40:08.722430 2025] [:error] [pid 8816:tid 8898] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php, referer: https://www.bing.com/
[Sun Nov 23 03:40:09.102484 2025] [:error] [pid 8816:tid 8902] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php, referer: https://www.google.com/
[Sun Nov 23 03:40:09.314138 2025] [:error] [pid 8816:tid 8890] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php, referer: https://www.google.fr/
[Sun Nov 23 03:40:09.504054 2025] [:error] [pid 8816:tid 8894] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php, referer: https://www.google.co.uk/
[Sun Nov 23 03:40:10.445879 2025] [:error] [pid 8816:tid 8904] [client 52.173.190.232:3681] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.de/
[Sun Nov 23 03:40:13.123442 2025] [:error] [pid 8816:tid 8895] [client 52.173.190.232:3681] [client 52.173.190.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.173.190.232, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSIRnZb4RIAN-_BXnHmjigAAAIo"], referer: https://duckduckgo.com/
[Sun Nov 23 05:44:09.321646 2025] [:error] [pid 38740:tid 38817] [client 141.98.10.115:59050] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-confiq.php
[Sun Nov 23 05:44:17.478407 2025] [:error] [pid 38740:tid 38805] [client 141.98.10.115:61172] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-confiq.php
[Sun Nov 23 13:00:16.651520 2025] [:error] [pid 38740:tid 38805] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/siln.php
[Sun Nov 23 13:00:16.679464 2025] [:error] [pid 38740:tid 38817] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/xpow0b.php
[Sun Nov 23 13:00:16.699955 2025] [:error] [pid 38740:tid 38818] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/xpobv.php
[Sun Nov 23 13:00:16.715512 2025] [:error] [pid 38740:tid 38803] [client 68.218.21.123:37381] [client 68.218.21.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.218.21.123, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSKU4A13QPZSi6O8umUkAAAAAIc"]
[Sun Nov 23 13:00:16.719171 2025] [:error] [pid 38740:tid 38803] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Nov 23 13:00:16.739423 2025] [:error] [pid 38740:tid 38820] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/xmailer.php
[Sun Nov 23 13:00:16.759540 2025] [:error] [pid 38740:tid 38813] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Nov 23 13:00:16.782102 2025] [:error] [pid 38740:tid 38811] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Sun Nov 23 13:00:16.801414 2025] [:error] [pid 38740:tid 38797] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Nov 23 13:00:16.817089 2025] [:error] [pid 38740:tid 38815] [client 68.218.21.123:37381] [client 68.218.21.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.218.21.123, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSKU4A13QPZSi6O8umUkBQAAAJM"]
[Sun Nov 23 13:00:16.823768 2025] [:error] [pid 38740:tid 38815] [client 68.218.21.123:37381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Nov 23 13:00:16.839304 2025] [:error] [pid 38740:tid 38799] [client 68.218.21.123:37381] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testo.php"] [unique_id "aSKU4A13QPZSi6O8umUkBwAAAIM"]
[Sun Nov 23 13:00:16.872317 2025] [:error] [pid 38738:tid 38762] [client 68.218.21.123:59916] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testo.php"] [unique_id "aSKU4Aytc6TL9XavPmNxiwAAABQ"]
[Sun Nov 23 13:00:16.905022 2025] [:error] [pid 44652:tid 44717] [client 68.218.21.123:59919] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testo.php"] [unique_id "aSKU4NiQFwsyXQDhwyBM4QAAAQs"]
[Sun Nov 23 13:00:16.934878 2025] [:error] [pid 38824:tid 38846] [client 68.218.21.123:60025] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testo.php"] [unique_id "aSKU4E8WZjXLvbHTHPdPpgAAANM"]
[Sun Nov 23 13:00:16.965749 2025] [:error] [pid 44652:tid 44718] [client 68.218.21.123:58042] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aSKU4NiQFwsyXQDhwyBM4gAAAQw"]
[Sun Nov 23 13:00:16.997421 2025] [:error] [pid 38824:tid 38841] [client 68.218.21.123:58029] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aSKU4E8WZjXLvbHTHPdPpwAAAM4"]
[Sun Nov 23 13:00:17.029234 2025] [:error] [pid 44652:tid 44714] [client 68.218.21.123:59942] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aSKU4diQFwsyXQDhwyBM4wAAAQg"]
[Sun Nov 23 13:00:17.072227 2025] [:error] [pid 38824:tid 38838] [client 68.218.21.123:58040] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPqAAAAMs"]
[Sun Nov 23 13:00:17.101763 2025] [:error] [pid 38824:tid 38844] [client 68.218.21.123:59917] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPqQAAANE"]
[Sun Nov 23 13:00:17.130119 2025] [:error] [pid 38738:tid 38757] [client 68.218.21.123:58026] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSKU4Qytc6TL9XavPmNxjAAAAA8"]
[Sun Nov 23 13:00:17.161991 2025] [:error] [pid 38740:tid 38810] [client 68.218.21.123:59964] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSKU4Q13QPZSi6O8umUkCAAAAI4"]
[Sun Nov 23 13:00:17.199895 2025] [:error] [pid 38824:tid 38851] [client 68.218.21.123:59984] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPqgAAANg"]
[Sun Nov 23 13:00:17.261334 2025] [:error] [pid 38740:tid 38800] [client 68.218.21.123:60019] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aSKU4Q13QPZSi6O8umUkCQAAAIQ"]
[Sun Nov 23 13:00:17.309636 2025] [:error] [pid 38738:tid 38766] [client 68.218.21.123:60000] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aSKU4Qytc6TL9XavPmNxjQAAABg"]
[Sun Nov 23 13:00:17.347220 2025] [:error] [pid 38824:tid 38836] [client 68.218.21.123:37796] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPqwAAAMk"]
[Sun Nov 23 13:00:17.376306 2025] [:error] [pid 44652:tid 44713] [client 68.218.21.123:59998] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aSKU4diQFwsyXQDhwyBM5QAAAQc"]
[Sun Nov 23 13:00:17.405199 2025] [:error] [pid 44652:tid 44711] [client 68.218.21.123:37377] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aSKU4diQFwsyXQDhwyBM5wAAAQU"]
[Sun Nov 23 13:00:17.437461 2025] [:error] [pid 38824:tid 38845] [client 68.218.21.123:59943] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPrAAAANI"]
[Sun Nov 23 13:00:17.488845 2025] [:error] [pid 38824:tid 38835] [client 68.218.21.123:37763] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPrQAAAMg"]
[Sun Nov 23 13:00:17.516964 2025] [:error] [pid 44652:tid 44710] [client 68.218.21.123:37782] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aSKU4diQFwsyXQDhwyBM6AAAAQQ"]
[Sun Nov 23 13:00:17.547489 2025] [:error] [pid 38738:tid 38754] [client 68.218.21.123:58008] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzw9t.php"] [unique_id "aSKU4Qytc6TL9XavPmNxjgAAAAw"]
[Sun Nov 23 13:00:17.597971 2025] [:error] [pid 44652:tid 44725] [client 68.218.21.123:60017] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzw9t.php"] [unique_id "aSKU4diQFwsyXQDhwyBM6QAAARM"]
[Sun Nov 23 13:00:17.628058 2025] [:error] [pid 38824:tid 38839] [client 68.218.21.123:37804] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzw9t.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPrgAAAMw"]
[Sun Nov 23 13:00:17.661525 2025] [:error] [pid 38738:tid 38763] [client 68.218.21.123:58004] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzw9t.php"] [unique_id "aSKU4Qytc6TL9XavPmNxjwAAABU"]
[Sun Nov 23 13:00:17.694132 2025] [:error] [pid 38740:tid 38809] [client 68.218.21.123:37380] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzgf5.php"] [unique_id "aSKU4Q13QPZSi6O8umUkCgAAAI0"]
[Sun Nov 23 13:00:17.725265 2025] [:error] [pid 38738:tid 38759] [client 68.218.21.123:59993] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzgf5.php"] [unique_id "aSKU4Qytc6TL9XavPmNxkAAAABE"]
[Sun Nov 23 13:00:17.754871 2025] [:error] [pid 38824:tid 38842] [client 68.218.21.123:37789] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzgf5.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPrwAAAM8"]
[Sun Nov 23 13:00:17.787291 2025] [:error] [pid 38738:tid 38748] [client 68.218.21.123:58044] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saxzgf5.php"] [unique_id "aSKU4Qytc6TL9XavPmNxkQAAAAY"]
[Sun Nov 23 13:00:17.815835 2025] [:error] [pid 38824:tid 38837] [client 68.218.21.123:58045] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPsAAAAMo"]
[Sun Nov 23 13:00:17.844119 2025] [:error] [pid 44652:tid 44715] [client 68.218.21.123:59920] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU4diQFwsyXQDhwyBM6gAAAQk"]
[Sun Nov 23 13:00:17.874874 2025] [:error] [pid 38738:tid 38755] [client 68.218.21.123:59922] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU4Qytc6TL9XavPmNxkgAAAA0"]
[Sun Nov 23 13:00:17.908955 2025] [:error] [pid 38824:tid 38830] [client 68.218.21.123:37810] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU4U8WZjXLvbHTHPdPsQAAAMM"]
[Sun Nov 23 13:00:17.942560 2025] [:error] [pid 38738:tid 38756] [client 68.218.21.123:59951] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/psh.php"] [unique_id "aSKU4Qytc6TL9XavPmNxkwAAAA4"]
[Sun Nov 23 13:00:17.970970 2025] [:error] [pid 38739:tid 38781] [client 68.218.21.123:60030] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/psh.php"] [unique_id "aSKU4QdvEgJm2n2cDmq_pQAAAEw"]
[Sun Nov 23 13:00:18.011196 2025] [:error] [pid 38738:tid 38746] [client 68.218.21.123:59934] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/psh.php"] [unique_id "aSKU4gytc6TL9XavPmNxlAAAAAQ"]
[Sun Nov 23 13:00:18.039374 2025] [:error] [pid 38739:tid 38782] [client 68.218.21.123:59955] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/psh.php"] [unique_id "aSKU4gdvEgJm2n2cDmq_pgAAAE0"]
[Sun Nov 23 13:00:18.074700 2025] [:error] [pid 44652:tid 44708] [client 68.218.21.123:59941] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aSKU4tiQFwsyXQDhwyBM6wAAAQI"]
[Sun Nov 23 13:00:18.106838 2025] [:error] [pid 38738:tid 38745] [client 68.218.21.123:59946] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aSKU4gytc6TL9XavPmNxlgAAAAM"]
[Sun Nov 23 13:00:18.137719 2025] [:error] [pid 38738:tid 38744] [client 68.218.21.123:60005] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aSKU4gytc6TL9XavPmNxlwAAAAI"]
[Sun Nov 23 13:00:18.166477 2025] [:error] [pid 38740:tid 38798] [client 68.218.21.123:60018] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aSKU4g13QPZSi6O8umUkCwAAAII"]
[Sun Nov 23 13:00:18.202496 2025] [:error] [pid 38738:tid 38742] [client 68.218.21.123:37811] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/product.php"] [unique_id "aSKU4gytc6TL9XavPmNxmAAAAAA"]
[Sun Nov 23 13:00:18.234980 2025] [:error] [pid 38738:tid 38749] [client 68.218.21.123:37760] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/product.php"] [unique_id "aSKU4gytc6TL9XavPmNxmQAAAAc"]
[Sun Nov 23 13:00:18.264536 2025] [:error] [pid 38738:tid 38758] [client 68.218.21.123:60013] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/product.php"] [unique_id "aSKU4gytc6TL9XavPmNxmgAAABA"]
[Sun Nov 23 13:00:18.306642 2025] [:error] [pid 38740:tid 38802] [client 68.218.21.123:59937] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/product.php"] [unique_id "aSKU4g13QPZSi6O8umUkDAAAAIY"]
[Sun Nov 23 13:00:18.348699 2025] [:error] [pid 38740:tid 38816] [client 68.218.21.123:37797] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klwc.php"] [unique_id "aSKU4g13QPZSi6O8umUkDQAAAJQ"]
[Sun Nov 23 13:00:18.381719 2025] [:error] [pid 38740:tid 38796] [client 68.218.21.123:37383] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klwc.php"] [unique_id "aSKU4g13QPZSi6O8umUkDgAAAIA"]
[Sun Nov 23 13:00:18.412151 2025] [:error] [pid 38740:tid 38806] [client 68.218.21.123:58040] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klwc.php"] [unique_id "aSKU4g13QPZSi6O8umUkDwAAAIo"]
[Sun Nov 23 13:00:18.444738 2025] [:error] [pid 38739:tid 38793] [client 68.218.21.123:59921] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klwc.php"] [unique_id "aSKU4gdvEgJm2n2cDmq_pwAAAFg"]
[Sun Nov 23 13:00:18.473391 2025] [:error] [pid 38740:tid 38808] [client 68.218.21.123:58010] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klbnm.php"] [unique_id "aSKU4g13QPZSi6O8umUkEAAAAIw"]
[Sun Nov 23 13:00:18.506807 2025] [:error] [pid 44652:tid 44719] [client 68.218.21.123:59924] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klbnm.php"] [unique_id "aSKU4tiQFwsyXQDhwyBM7AAAAQ0"]
[Sun Nov 23 13:00:18.540622 2025] [:error] [pid 38740:tid 38807] [client 68.218.21.123:37765] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klbnm.php"] [unique_id "aSKU4g13QPZSi6O8umUkEQAAAIs"]
[Sun Nov 23 13:00:18.594025 2025] [:error] [pid 38824:tid 38850] [client 68.218.21.123:59954] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/klbnm.php"] [unique_id "aSKU4k8WZjXLvbHTHPdPsgAAANc"]
[Sun Nov 23 13:00:18.678648 2025] [:error] [pid 38738:tid 38765] [client 68.218.21.123:37761] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aSKU4gytc6TL9XavPmNxmwAAABc"]
[Sun Nov 23 13:00:18.733191 2025] [:error] [pid 38738:tid 38743] [client 68.218.21.123:59998] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aSKU4gytc6TL9XavPmNxnAAAAAE"]
[Sun Nov 23 13:00:18.773498 2025] [:error] [pid 38740:tid 38819] [client 68.218.21.123:59943] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aSKU4g13QPZSi6O8umUkEgAAAJc"]
[Sun Nov 23 13:00:18.804911 2025] [:error] [pid 38738:tid 38752] [client 68.218.21.123:59962] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aSKU4gytc6TL9XavPmNxnQAAAAo"]
[Sun Nov 23 13:00:18.837320 2025] [:error] [pid 38739:tid 38792] [client 68.218.21.123:58019] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSKU4gdvEgJm2n2cDmq_qAAAAFc"]
[Sun Nov 23 13:00:18.866276 2025] [:error] [pid 44652:tid 44716] [client 68.218.21.123:37802] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSKU4tiQFwsyXQDhwyBM7QAAAQo"]
[Sun Nov 23 13:00:18.905219 2025] [:error] [pid 38739:tid 38774] [client 68.218.21.123:59966] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSKU4gdvEgJm2n2cDmq_qQAAAEU"]
[Sun Nov 23 13:00:18.943402 2025] [:error] [pid 38739:tid 38788] [client 68.218.21.123:59939] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSKU4gdvEgJm2n2cDmq_qgAAAFM"]
[Sun Nov 23 13:00:18.977681 2025] [:error] [pid 38739:tid 38778] [client 68.218.21.123:37806] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aSKU4gdvEgJm2n2cDmq_qwAAAEk"]
[Sun Nov 23 13:00:19.009079 2025] [:error] [pid 38739:tid 38771] [client 68.218.21.123:37809] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aSKU4wdvEgJm2n2cDmq_rAAAAEI"]
[Sun Nov 23 13:00:19.037319 2025] [:error] [pid 38739:tid 38789] [client 68.218.21.123:59996] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aSKU4wdvEgJm2n2cDmq_rQAAAFQ"]
[Sun Nov 23 13:00:19.068294 2025] [:error] [pid 38824:tid 38832] [client 68.218.21.123:59975] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aSKU408WZjXLvbHTHPdPtAAAAMU"]
[Sun Nov 23 13:00:19.096197 2025] [:error] [pid 38824:tid 38829] [client 68.218.21.123:59952] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ad.php"] [unique_id "aSKU408WZjXLvbHTHPdPtQAAAMI"]
[Sun Nov 23 13:00:19.124163 2025] [:error] [pid 38824:tid 38833] [client 68.218.21.123:37795] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ad.php"] [unique_id "aSKU408WZjXLvbHTHPdPtgAAAMY"]
[Sun Nov 23 13:00:19.155647 2025] [:error] [pid 38738:tid 38757] [client 68.218.21.123:59965] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ad.php"] [unique_id "aSKU4wytc6TL9XavPmNxnwAAAA8"]
[Sun Nov 23 13:00:19.198369 2025] [:error] [pid 38740:tid 38817] [client 68.218.21.123:59914] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ad.php"] [unique_id "aSKU4w13QPZSi6O8umUkFAAAAJU"]
[Sun Nov 23 13:00:19.237984 2025] [:error] [pid 38740:tid 38818] [client 68.218.21.123:60004] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSKU4w13QPZSi6O8umUkFQAAAJY"]
[Sun Nov 23 13:00:19.300169 2025] [:error] [pid 38824:tid 38831] [client 68.218.21.123:60030] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSKU408WZjXLvbHTHPdPtwAAAMQ"]
[Sun Nov 23 13:00:19.335849 2025] [:error] [pid 38824:tid 38827] [client 68.218.21.123:57988] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSKU408WZjXLvbHTHPdPuAAAAMA"]
[Sun Nov 23 13:00:19.368046 2025] [:error] [pid 44652:tid 44707] [client 68.218.21.123:57218] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSKU49iQFwsyXQDhwyBM7gAAAQE"]
[Sun Nov 23 13:00:19.396398 2025] [:error] [pid 38824:tid 38847] [client 68.218.21.123:58028] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU408WZjXLvbHTHPdPuQAAANQ"]
[Sun Nov 23 13:00:19.427414 2025] [:error] [pid 38824:tid 38846] [client 68.218.21.123:59947] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU408WZjXLvbHTHPdPugAAANM"]
[Sun Nov 23 13:00:19.457215 2025] [:error] [pid 38740:tid 38803] [client 68.218.21.123:57228] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU4w13QPZSi6O8umUkFgAAAIc"]
[Sun Nov 23 13:00:19.487633 2025] [:error] [pid 38824:tid 38838] [client 68.218.21.123:37783] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU408WZjXLvbHTHPdPuwAAAMs"]
[Sun Nov 23 13:00:19.528287 2025] [:error] [pid 38824:tid 38844] [client 68.218.21.123:37395] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU408WZjXLvbHTHPdPvAAAANE"]
[Sun Nov 23 13:00:19.557243 2025] [:error] [pid 38824:tid 38851] [client 68.218.21.123:60001] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU408WZjXLvbHTHPdPvQAAANg"]
[Sun Nov 23 13:00:19.588335 2025] [:error] [pid 44652:tid 44724] [client 68.218.21.123:60024] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU49iQFwsyXQDhwyBM8AAAARI"]
[Sun Nov 23 13:00:19.618226 2025] [:error] [pid 38824:tid 38836] [client 68.218.21.123:37776] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU408WZjXLvbHTHPdPvgAAAMk"]
[Sun Nov 23 13:00:19.648632 2025] [:error] [pid 38824:tid 38845] [client 68.218.21.123:59983] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU408WZjXLvbHTHPdPvwAAANI"]
[Sun Nov 23 13:00:19.687982 2025] [:error] [pid 38740:tid 38820] [client 68.218.21.123:61454] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU4w13QPZSi6O8umUkFwAAAJg"]
[Sun Nov 23 13:00:19.719482 2025] [:error] [pid 38824:tid 38835] [client 68.218.21.123:37386] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU408WZjXLvbHTHPdPwAAAAMg"]
[Sun Nov 23 13:00:19.763488 2025] [:error] [pid 38740:tid 38813] [client 68.218.21.123:37778] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU4w13QPZSi6O8umUkGAAAAJE"]
[Sun Nov 23 13:00:19.794279 2025] [:error] [pid 38740:tid 38811] [client 68.218.21.123:37767] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSKU4w13QPZSi6O8umUkGQAAAI8"]
[Sun Nov 23 13:00:19.824881 2025] [:error] [pid 38739:tid 38790] [client 68.218.21.123:57301] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSKU4wdvEgJm2n2cDmq_rwAAAFU"]
[Sun Nov 23 13:00:19.855358 2025] [:error] [pid 38739:tid 38784] [client 68.218.21.123:37798] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSKU4wdvEgJm2n2cDmq_sAAAAE8"]
[Sun Nov 23 13:00:19.894207 2025] [:error] [pid 38739:tid 38780] [client 68.218.21.123:37382] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSKU4wdvEgJm2n2cDmq_sQAAAEs"]
[Sun Nov 23 13:00:19.927200 2025] [:error] [pid 38739:tid 38779] [client 68.218.21.123:37784] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSKU4wdvEgJm2n2cDmq_sgAAAEo"]
[Sun Nov 23 13:00:19.954568 2025] [:error] [pid 38824:tid 38839] [client 68.218.21.123:37430] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSKU408WZjXLvbHTHPdPwQAAAMw"]
[Sun Nov 23 13:00:19.983483 2025] [:error] [pid 44652:tid 44727] [client 68.218.21.123:59990] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSKU49iQFwsyXQDhwyBM8QAAARU"]
[Sun Nov 23 13:00:20.013702 2025] [:error] [pid 38740:tid 38815] [client 68.218.21.123:58023] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSKU5A13QPZSi6O8umUkGgAAAJM"]
[Sun Nov 23 13:00:20.047688 2025] [:error] [pid 38740:tid 38799] [client 68.218.21.123:58011] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSKU5A13QPZSi6O8umUkGwAAAIM"]
[Sun Nov 23 13:00:20.095506 2025] [:error] [pid 38740:tid 38814] [client 68.218.21.123:37404] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSKU5A13QPZSi6O8umUkHAAAAJI"]
[Sun Nov 23 13:00:20.220758 2025] [:error] [pid 44652:tid 44722] [client 68.218.21.123:37805] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSKU5NiQFwsyXQDhwyBM8gAAARA"]
[Sun Nov 23 13:00:20.274595 2025] [:error] [pid 44652:tid 44709] [client 68.218.21.123:37764] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSKU5NiQFwsyXQDhwyBM8wAAAQM"]
[Sun Nov 23 13:00:20.303974 2025] [:error] [pid 44652:tid 44726] [client 68.218.21.123:37399] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5NiQFwsyXQDhwyBM9AAAARQ"]
[Sun Nov 23 13:00:20.334325 2025] [:error] [pid 38739:tid 38791] [client 68.218.21.123:59971] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_tAAAAFY"]
[Sun Nov 23 13:00:20.368971 2025] [:error] [pid 38739:tid 38776] [client 68.218.21.123:37809] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_tQAAAEc"]
[Sun Nov 23 13:00:20.399493 2025] [:error] [pid 38739:tid 38787] [client 68.218.21.123:37385] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_tgAAAFI"]
[Sun Nov 23 13:00:20.431692 2025] [:error] [pid 44652:tid 44723] [client 68.218.21.123:59975] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU5NiQFwsyXQDhwyBM9QAAARE"]
[Sun Nov 23 13:00:20.462663 2025] [:error] [pid 38739:tid 38775] [client 68.218.21.123:58031] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_uAAAAEY"]
[Sun Nov 23 13:00:20.494514 2025] [:error] [pid 38739:tid 38782] [client 68.218.21.123:37808] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_uQAAAE0"]
[Sun Nov 23 13:00:20.525297 2025] [:error] [pid 44652:tid 44728] [client 68.218.21.123:57996] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSKU5NiQFwsyXQDhwyBM9gAAARY"]
[Sun Nov 23 13:00:20.557126 2025] [:error] [pid 38738:tid 38747] [client 68.218.21.123:59974] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aSKU5Aytc6TL9XavPmNxoQAAAAU"]
[Sun Nov 23 13:00:20.600104 2025] [:error] [pid 38738:tid 38754] [client 68.218.21.123:58015] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aSKU5Aytc6TL9XavPmNxogAAAAw"]
[Sun Nov 23 13:00:20.628904 2025] [:error] [pid 38739:tid 38773] [client 68.218.21.123:60004] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_ugAAAEQ"]
[Sun Nov 23 13:00:20.667471 2025] [:error] [pid 38739:tid 38793] [client 68.218.21.123:57995] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_vAAAAFg"]
[Sun Nov 23 13:00:20.698395 2025] [:error] [pid 38738:tid 38763] [client 68.218.21.123:58047] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "aSKU5Aytc6TL9XavPmNxowAAABU"]
[Sun Nov 23 13:00:20.736406 2025] [:error] [pid 44652:tid 44717] [client 68.218.21.123:58039] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "aSKU5NiQFwsyXQDhwyBM9wAAAQs"]
[Sun Nov 23 13:00:20.772023 2025] [:error] [pid 44652:tid 44718] [client 68.218.21.123:37771] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "aSKU5NiQFwsyXQDhwyBM-AAAAQw"]
[Sun Nov 23 13:00:20.802158 2025] [:error] [pid 38738:tid 38760] [client 68.218.21.123:37762] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "aSKU5Aytc6TL9XavPmNxpAAAABI"]
[Sun Nov 23 13:00:20.838463 2025] [:error] [pid 38738:tid 38759] [client 68.218.21.123:58032] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSKU5Aytc6TL9XavPmNxpQAAABE"]
[Sun Nov 23 13:00:20.905128 2025] [:error] [pid 38738:tid 38748] [client 68.218.21.123:58016] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSKU5Aytc6TL9XavPmNxpgAAAAY"]
[Sun Nov 23 13:00:20.934924 2025] [:error] [pid 38738:tid 38755] [client 68.218.21.123:60028] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSKU5Aytc6TL9XavPmNxpwAAAA0"]
[Sun Nov 23 13:00:20.966200 2025] [:error] [pid 38739:tid 38792] [client 68.218.21.123:37797] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSKU5AdvEgJm2n2cDmq_vQAAAFc"]
[Sun Nov 23 13:00:20.994117 2025] [:error] [pid 38738:tid 38756] [client 68.218.21.123:57342] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSKU5Aytc6TL9XavPmNxqAAAAA4"]
[Sun Nov 23 13:00:21.024111 2025] [:error] [pid 44652:tid 44720] [client 68.218.21.123:58030] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSKU5diQFwsyXQDhwyBM-QAAAQ4"]
[Sun Nov 23 13:00:21.059064 2025] [:error] [pid 44652:tid 44712] [client 68.218.21.123:58010] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSKU5diQFwsyXQDhwyBM-gAAAQY"]
[Sun Nov 23 13:00:21.099396 2025] [:error] [pid 38740:tid 38800] [client 68.218.21.123:60006] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSKU5Q13QPZSi6O8umUkHQAAAIQ"]
[Sun Nov 23 13:00:21.163338 2025] [:error] [pid 38740:tid 38809] [client 68.218.21.123:37798] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5Q13QPZSi6O8umUkHgAAAI0"]
[Sun Nov 23 13:00:21.192343 2025] [:error] [pid 38739:tid 38774] [client 68.218.21.123:61459] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5QdvEgJm2n2cDmq_vwAAAEU"]
[Sun Nov 23 13:00:21.219498 2025] [:error] [pid 44652:tid 44713] [client 68.218.21.123:57274] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5diQFwsyXQDhwyBM-wAAAQc"]
[Sun Nov 23 13:00:21.250104 2025] [:error] [pid 44652:tid 44729] [client 68.218.21.123:61463] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5diQFwsyXQDhwyBM_AAAARc"]
[Sun Nov 23 13:00:21.283163 2025] [:error] [pid 38738:tid 38746] [client 68.218.21.123:59923] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aSKU5Qytc6TL9XavPmNxqQAAAAQ"]
[Sun Nov 23 13:00:21.351331 2025] [:error] [pid 44652:tid 44711] [client 68.218.21.123:37790] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aSKU5diQFwsyXQDhwyBM_QAAAQU"]
[Sun Nov 23 13:00:21.384270 2025] [:error] [pid 44652:tid 44710] [client 68.218.21.123:59908] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aSKU5diQFwsyXQDhwyBM_gAAAQQ"]
[Sun Nov 23 13:00:21.413656 2025] [:error] [pid 44652:tid 44725] [client 68.218.21.123:60007] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aSKU5diQFwsyXQDhwyBM_wAAARM"]
[Sun Nov 23 13:00:21.446214 2025] [:error] [pid 38738:tid 38745] [client 68.218.21.123:59972] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php/qa.php"] [unique_id "aSKU5Qytc6TL9XavPmNxqgAAAAM"]
[Sun Nov 23 13:00:21.476402 2025] [:error] [pid 38738:tid 38744] [client 68.218.21.123:58034] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php/qa.php"] [unique_id "aSKU5Qytc6TL9XavPmNxqwAAAAI"]
[Sun Nov 23 13:00:21.507180 2025] [:error] [pid 38824:tid 38837] [client 68.218.21.123:59939] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php/qa.php"] [unique_id "aSKU5U8WZjXLvbHTHPdPwwAAAMo"]
[Sun Nov 23 13:00:21.536381 2025] [:error] [pid 38824:tid 38830] [client 68.218.21.123:58004] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php/qa.php"] [unique_id "aSKU5U8WZjXLvbHTHPdPxAAAAMM"]
[Sun Nov 23 13:00:21.580645 2025] [:error] [pid 44652:tid 44715] [client 68.218.21.123:37799] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/edaewni/index.php"] [unique_id "aSKU5diQFwsyXQDhwyBNAAAAAQk"]
[Sun Nov 23 13:00:21.614565 2025] [:error] [pid 38824:tid 38850] [client 68.218.21.123:37130] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/edaewni/index.php"] [unique_id "aSKU5U8WZjXLvbHTHPdPxQAAANc"]
[Sun Nov 23 13:00:21.642796 2025] [:error] [pid 38740:tid 38798] [client 68.218.21.123:58003] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/edaewni/index.php"] [unique_id "aSKU5Q13QPZSi6O8umUkHwAAAII"]
[Sun Nov 23 13:00:21.673177 2025] [:error] [pid 44652:tid 44721] [client 68.218.21.123:61458] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/edaewni/index.php"] [unique_id "aSKU5diQFwsyXQDhwyBNAQAAAQ8"]
[Sun Nov 23 13:00:21.708189 2025] [:error] [pid 38740:tid 38802] [client 68.218.21.123:37148] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU5Q13QPZSi6O8umUkIAAAAIY"]
[Sun Nov 23 13:00:21.738200 2025] [:error] [pid 44652:tid 44708] [client 68.218.21.123:60012] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU5diQFwsyXQDhwyBNAgAAAQI"]
[Sun Nov 23 13:00:21.818500 2025] [:error] [pid 44652:tid 44714] [client 68.218.21.123:59947] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU5diQFwsyXQDhwyBNAwAAAQg"]
[Sun Nov 23 13:00:21.848521 2025] [:error] [pid 44652:tid 44719] [client 68.218.21.123:59911] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSKU5diQFwsyXQDhwyBNBAAAAQ0"]
[Sun Nov 23 13:00:21.879215 2025] [:error] [pid 38740:tid 38796] [client 68.218.21.123:37814] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/index.php"] [unique_id "aSKU5Q13QPZSi6O8umUkIQAAAIA"]
[Sun Nov 23 13:00:21.911327 2025] [:error] [pid 38738:tid 38750] [client 68.218.21.123:37801] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/index.php"] [unique_id "aSKU5Qytc6TL9XavPmNxrAAAAAg"]
[Sun Nov 23 13:00:21.975998 2025] [:error] [pid 38738:tid 38742] [client 68.218.21.123:37407] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/index.php"] [unique_id "aSKU5Qytc6TL9XavPmNxrQAAAAA"]
[Sun Nov 23 13:00:22.006565 2025] [:error] [pid 44652:tid 44716] [client 68.218.21.123:37426] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/index.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNBQAAAQo"]
[Sun Nov 23 13:00:22.037433 2025] [:error] [pid 44652:tid 44707] [client 68.218.21.123:37437] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxo.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNBgAAAQE"]
[Sun Nov 23 13:00:22.066894 2025] [:error] [pid 44652:tid 44724] [client 68.218.21.123:57241] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxo.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNBwAAARI"]
[Sun Nov 23 13:00:22.097267 2025] [:error] [pid 44652:tid 44730] [client 68.218.21.123:37403] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxo.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNCAAAARg"]
[Sun Nov 23 13:00:22.130334 2025] [:error] [pid 38740:tid 38806] [client 68.218.21.123:59915] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxo.php"] [unique_id "aSKU5g13QPZSi6O8umUkIgAAAIo"]
[Sun Nov 23 13:00:22.159639 2025] [:error] [pid 44652:tid 44706] [client 68.218.21.123:37780] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNCQAAAQA"]
[Sun Nov 23 13:00:22.194425 2025] [:error] [pid 44652:tid 44727] [client 68.218.21.123:59931] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNCgAAARU"]
[Sun Nov 23 13:00:22.233238 2025] [:error] [pid 44652:tid 44722] [client 68.218.21.123:37432] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNCwAAARA"]
[Sun Nov 23 13:00:22.278103 2025] [:error] [pid 44652:tid 44709] [client 68.218.21.123:57992] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNDAAAAQM"]
[Sun Nov 23 13:00:22.307831 2025] [:error] [pid 44652:tid 44726] [client 68.218.21.123:59938] [client 68.218.21.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNDQAAARQ"]
[Sun Nov 23 13:00:22.358196 2025] [:error] [pid 44652:tid 44728] [client 68.218.21.123:57993] [client 68.218.21.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNDgAAARY"]
[Sun Nov 23 13:00:22.391682 2025] [:error] [pid 38824:tid 38832] [client 68.218.21.123:37141] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aSKU5k8WZjXLvbHTHPdPxwAAAMU"]
[Sun Nov 23 13:00:22.424451 2025] [:error] [pid 44652:tid 44720] [client 68.218.21.123:61452] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNDwAAAQ4"]
[Sun Nov 23 13:00:22.461884 2025] [:error] [pid 38824:tid 38833] [client 68.218.21.123:59981] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aSKU5k8WZjXLvbHTHPdPyAAAAMY"]
[Sun Nov 23 13:00:22.490612 2025] [:error] [pid 38824:tid 38831] [client 68.218.21.123:60020] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5k8WZjXLvbHTHPdPyQAAAMQ"]
[Sun Nov 23 13:00:22.520885 2025] [:error] [pid 38824:tid 38827] [client 68.218.21.123:59999] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5k8WZjXLvbHTHPdPygAAAMA"]
[Sun Nov 23 13:00:22.556954 2025] [:error] [pid 38824:tid 38834] [client 68.218.21.123:37148] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5k8WZjXLvbHTHPdPywAAAMc"]
[Sun Nov 23 13:00:22.587855 2025] [:error] [pid 38824:tid 38847] [client 68.218.21.123:59979] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSKU5k8WZjXLvbHTHPdPzAAAANQ"]
[Sun Nov 23 13:00:22.626065 2025] [:error] [pid 38824:tid 38846] [client 68.218.21.123:37392] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5k8WZjXLvbHTHPdPzQAAANM"]
[Sun Nov 23 13:00:22.660627 2025] [:error] [pid 44652:tid 44712] [client 68.218.21.123:59992] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNEAAAAQY"]
[Sun Nov 23 13:00:22.689267 2025] [:error] [pid 38738:tid 38749] [client 68.218.21.123:58021] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5gytc6TL9XavPmNxrgAAAAc"]
[Sun Nov 23 13:00:22.724375 2025] [:error] [pid 38738:tid 38758] [client 68.218.21.123:55034] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSKU5gytc6TL9XavPmNxrwAAABA"]
[Sun Nov 23 13:00:22.755103 2025] [:error] [pid 38738:tid 38761] [client 68.218.21.123:59982] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yy.php"] [unique_id "aSKU5gytc6TL9XavPmNxsAAAABM"]
[Sun Nov 23 13:00:22.792599 2025] [:error] [pid 38740:tid 38807] [client 68.218.21.123:58020] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yy.php"] [unique_id "aSKU5g13QPZSi6O8umUkJAAAAIs"]
[Sun Nov 23 13:00:22.836539 2025] [:error] [pid 44652:tid 44713] [client 68.218.21.123:60015] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yy.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNEQAAAQc"]
[Sun Nov 23 13:00:22.879746 2025] [:error] [pid 44652:tid 44729] [client 68.218.21.123:37780] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yy.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNEgAAARc"]
[Sun Nov 23 13:00:22.931358 2025] [:error] [pid 44652:tid 44710] [client 68.218.21.123:57278] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/index.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNEwAAAQQ"]
[Sun Nov 23 13:00:22.966064 2025] [:error] [pid 44652:tid 44725] [client 68.218.21.123:59925] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/index.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNFAAAARM"]
[Sun Nov 23 13:00:22.997961 2025] [:error] [pid 44652:tid 44715] [client 68.218.21.123:37394] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/index.php"] [unique_id "aSKU5tiQFwsyXQDhwyBNFQAAAQk"]
[Sun Nov 23 13:00:23.025991 2025] [:error] [pid 44652:tid 44721] [client 68.218.21.123:60023] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/index.php"] [unique_id "aSKU59iQFwsyXQDhwyBNFgAAAQ8"]
[Sun Nov 23 13:00:23.058870 2025] [:error] [pid 44652:tid 44708] [client 68.218.21.123:59938] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/LA.php"] [unique_id "aSKU59iQFwsyXQDhwyBNFwAAAQI"]
[Sun Nov 23 13:00:23.098299 2025] [:error] [pid 44652:tid 44719] [client 68.218.21.123:57317] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/LA.php"] [unique_id "aSKU59iQFwsyXQDhwyBNGQAAAQ0"]
[Sun Nov 23 13:00:23.132097 2025] [:error] [pid 44652:tid 44716] [client 68.218.21.123:37779] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/LA.php"] [unique_id "aSKU59iQFwsyXQDhwyBNGgAAAQo"]
[Sun Nov 23 13:00:23.162644 2025] [:error] [pid 44652:tid 44707] [client 68.218.21.123:57307] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/well-known/acme-challenge/LA.php"] [unique_id "aSKU59iQFwsyXQDhwyBNGwAAAQE"]
[Sun Nov 23 13:00:23.191226 2025] [:error] [pid 44652:tid 44724] [client 68.218.21.123:37397] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSKU59iQFwsyXQDhwyBNHAAAARI"]
[Sun Nov 23 13:00:23.219393 2025] [:error] [pid 44652:tid 44730] [client 68.218.21.123:57294] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSKU59iQFwsyXQDhwyBNHQAAARg"]
[Sun Nov 23 13:00:23.256797 2025] [:error] [pid 44652:tid 44706] [client 68.218.21.123:37821] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSKU59iQFwsyXQDhwyBNHgAAAQA"]
[Sun Nov 23 13:00:23.290727 2025] [:error] [pid 38740:tid 38812] [client 68.218.21.123:57234] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSKU5w13QPZSi6O8umUkJgAAAJA"]
[Sun Nov 23 13:00:23.322644 2025] [:error] [pid 38740:tid 38805] [client 68.218.21.123:59944] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSKU5w13QPZSi6O8umUkJwAAAIk"]
[Sun Nov 23 13:00:23.368613 2025] [:error] [pid 38738:tid 38765] [client 68.218.21.123:57315] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSKU5wytc6TL9XavPmNxsQAAABc"]
[Sun Nov 23 13:00:23.423630 2025] [:error] [pid 38738:tid 38743] [client 68.218.21.123:57282] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSKU5wytc6TL9XavPmNxsgAAAAE"]
[Sun Nov 23 13:00:23.495988 2025] [:error] [pid 44652:tid 44727] [client 68.218.21.123:37409] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSKU59iQFwsyXQDhwyBNHwAAARU"]
[Sun Nov 23 13:00:23.524213 2025] [:error] [pid 38739:tid 38777] [client 68.218.21.123:57280] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSKU5wdvEgJm2n2cDmq_wQAAAEg"]
[Sun Nov 23 13:00:23.552112 2025] [:error] [pid 44652:tid 44722] [client 68.218.21.123:57302] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSKU59iQFwsyXQDhwyBNIQAAARA"]
[Sun Nov 23 13:00:23.580943 2025] [:error] [pid 38739:tid 38772] [client 68.218.21.123:37378] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSKU5wdvEgJm2n2cDmq_wgAAAEM"]
[Sun Nov 23 13:00:23.619626 2025] [:error] [pid 38738:tid 38752] [client 68.218.21.123:58030] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSKU5wytc6TL9XavPmNxswAAAAo"]
[Sun Nov 23 13:00:23.702996 2025] [:error] [pid 38740:tid 38811] [client 68.218.21.123:37396] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSKU5w13QPZSi6O8umUkKwAAAI8"]
[Sun Nov 23 13:00:23.734515 2025] [:error] [pid 38740:tid 38797] [client 68.218.21.123:37820] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSKU5w13QPZSi6O8umUkLAAAAIE"]
[Sun Nov 23 13:00:23.766052 2025] [:error] [pid 38738:tid 38757] [client 68.218.21.123:54989] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSKU5wytc6TL9XavPmNxtAAAAA8"]
[Sun Nov 23 13:00:23.796390 2025] [:error] [pid 38739:tid 38784] [client 68.218.21.123:60023] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSKU5wdvEgJm2n2cDmq_wwAAAE8"]
[Sun Nov 23 13:00:23.827354 2025] [:error] [pid 38739:tid 38780] [client 68.218.21.123:57269] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aSKU5wdvEgJm2n2cDmq_xAAAAEs"]
[Sun Nov 23 13:00:23.861890 2025] [:error] [pid 44652:tid 44723] [client 68.218.21.123:58038] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aSKU59iQFwsyXQDhwyBNJAAAARE"]
[Sun Nov 23 13:00:23.893795 2025] [:error] [pid 38740:tid 38801] [client 68.218.21.123:58025] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aSKU5w13QPZSi6O8umUkLgAAAIU"]
[Sun Nov 23 13:00:23.924224 2025] [:error] [pid 38740:tid 38815] [client 68.218.21.123:57307] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aSKU5w13QPZSi6O8umUkLwAAAJM"]
[Sun Nov 23 13:00:23.958060 2025] [:error] [pid 38740:tid 38799] [client 68.218.21.123:37422] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSKU5w13QPZSi6O8umUkMAAAAIM"]
[Sun Nov 23 13:00:23.995327 2025] [:error] [pid 38740:tid 38814] [client 68.218.21.123:58000] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSKU5w13QPZSi6O8umUkMQAAAJI"]
[Sun Nov 23 13:00:24.032205 2025] [:error] [pid 38740:tid 38804] [client 68.218.21.123:61475] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSKU6A13QPZSi6O8umUkMgAAAIg"]
[Sun Nov 23 13:00:24.064582 2025] [:error] [pid 38740:tid 38810] [client 68.218.21.123:59918] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSKU6A13QPZSi6O8umUkMwAAAI4"]
[Sun Nov 23 13:00:24.095150 2025] [:error] [pid 38738:tid 38762] [client 68.218.21.123:37786] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSKU6Aytc6TL9XavPmNxtQAAABQ"]
[Sun Nov 23 13:00:24.124881 2025] [:error] [pid 38738:tid 38766] [client 68.218.21.123:58007] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSKU6Aytc6TL9XavPmNxtgAAABg"]
[Sun Nov 23 13:00:24.153161 2025] [:error] [pid 38740:tid 38809] [client 68.218.21.123:58006] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSKU6A13QPZSi6O8umUkNQAAAI0"]
[Sun Nov 23 13:00:24.181283 2025] [:error] [pid 38739:tid 38779] [client 68.218.21.123:37770] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSKU6AdvEgJm2n2cDmq_xgAAAEo"]
[Sun Nov 23 13:00:24.211670 2025] [:error] [pid 38738:tid 38747] [client 68.218.21.123:37423] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aSKU6Aytc6TL9XavPmNxtwAAAAU"]
[Sun Nov 23 13:00:24.240359 2025] [:error] [pid 38739:tid 38776] [client 68.218.21.123:54990] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aSKU6AdvEgJm2n2cDmq_xwAAAEc"]
[Sun Nov 23 13:00:24.273123 2025] [:error] [pid 38740:tid 38798] [client 68.218.21.123:59969] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aSKU6A13QPZSi6O8umUkNgAAAII"]
[Sun Nov 23 13:00:24.304440 2025] [:error] [pid 38739:tid 38787] [client 68.218.21.123:37787] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aSKU6AdvEgJm2n2cDmq_yAAAAFI"]
[Sun Nov 23 13:00:24.339299 2025] [:error] [pid 38739:tid 38782] [client 68.218.21.123:37777] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSKU6AdvEgJm2n2cDmq_yQAAAE0"]
[Sun Nov 23 13:00:24.368846 2025] [:error] [pid 38739:tid 38773] [client 68.218.21.123:58012] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSKU6AdvEgJm2n2cDmq_ygAAAEQ"]
[Sun Nov 23 13:00:24.449769 2025] [:error] [pid 38740:tid 38802] [client 68.218.21.123:57303] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSKU6A13QPZSi6O8umUkNwAAAIY"]
[Sun Nov 23 13:00:24.479617 2025] [:error] [pid 38739:tid 38769] [client 68.218.21.123:57998] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSKU6AdvEgJm2n2cDmq_ywAAAEA"]
[Sun Nov 23 13:00:24.510543 2025] [:error] [pid 38739:tid 38783] [client 68.218.21.123:59938] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSKU6AdvEgJm2n2cDmq_zAAAAE4"]
[Sun Nov 23 13:00:24.540849 2025] [:error] [pid 38738:tid 38754] [client 68.218.21.123:58038] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSKU6Aytc6TL9XavPmNxuAAAAAw"]
[Sun Nov 23 13:00:24.572744 2025] [:error] [pid 44652:tid 44717] [client 68.218.21.123:61442] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSKU6NiQFwsyXQDhwyBNJQAAAQs"]
[Sun Nov 23 13:00:24.604787 2025] [:error] [pid 38740:tid 38807] [client 68.218.21.123:61484] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSKU6A13QPZSi6O8umUkOAAAAIs"]
[Sun Nov 23 13:00:24.634422 2025] [:error] [pid 44652:tid 44718] [client 68.218.21.123:37422] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU6NiQFwsyXQDhwyBNJgAAAQw"]
[Sun Nov 23 13:00:24.666456 2025] [:error] [pid 38740:tid 38808] [client 68.218.21.123:61455] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU6A13QPZSi6O8umUkOQAAAIw"]
[Sun Nov 23 13:00:24.695247 2025] [:error] [pid 38740:tid 38812] [client 68.218.21.123:57220] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU6A13QPZSi6O8umUkOgAAAJA"]
[Sun Nov 23 13:00:24.725631 2025] [:error] [pid 38738:tid 38763] [client 68.218.21.123:59910] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSKU6Aytc6TL9XavPmNxuQAAABU"]
[Sun Nov 23 13:00:24.754024 2025] [:error] [pid 38738:tid 38760] [client 68.218.21.123:37436] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aSKU6Aytc6TL9XavPmNxugAAABI"]
[Sun Nov 23 13:00:24.784330 2025] [:error] [pid 38738:tid 38748] [client 68.218.21.123:59970] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aSKU6Aytc6TL9XavPmNxuwAAAAY"]
[Sun Nov 23 13:00:24.813987 2025] [:error] [pid 38738:tid 38755] [client 68.218.21.123:58006] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aSKU6Aytc6TL9XavPmNxvAAAAA0"]
[Sun Nov 23 13:00:24.851667 2025] [:error] [pid 38738:tid 38756] [client 68.218.21.123:58013] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aSKU6Aytc6TL9XavPmNxvQAAAA4"]
[Sun Nov 23 13:00:24.884885 2025] [:error] [pid 38738:tid 38746] [client 68.218.21.123:60014] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qing.php"] [unique_id "aSKU6Aytc6TL9XavPmNxvgAAAAQ"]
[Sun Nov 23 13:00:24.916733 2025] [:error] [pid 38738:tid 38745] [client 68.218.21.123:58040] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qing.php"] [unique_id "aSKU6Aytc6TL9XavPmNxvwAAAAM"]
[Sun Nov 23 13:00:24.944381 2025] [:error] [pid 38738:tid 38744] [client 68.218.21.123:58010] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qing.php"] [unique_id "aSKU6Aytc6TL9XavPmNxwAAAAAI"]
[Sun Nov 23 13:00:24.973888 2025] [:error] [pid 38738:tid 38764] [client 68.218.21.123:37439] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qing.php"] [unique_id "aSKU6Aytc6TL9XavPmNxwQAAABY"]
[Sun Nov 23 13:00:25.006430 2025] [:error] [pid 38738:tid 38750] [client 68.218.21.123:59959] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSKU6Qytc6TL9XavPmNxwgAAAAg"]
[Sun Nov 23 13:00:25.046987 2025] [:error] [pid 38740:tid 38805] [client 68.218.21.123:59995] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSKU6Q13QPZSi6O8umUkPAAAAIk"]
[Sun Nov 23 13:00:25.080529 2025] [:error] [pid 44652:tid 44720] [client 68.218.21.123:59956] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSKU6diQFwsyXQDhwyBNJwAAAQ4"]
[Sun Nov 23 13:00:25.108626 2025] [:error] [pid 38740:tid 38817] [client 68.218.21.123:37377] [client 68.218.21.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSKU6Q13QPZSi6O8umUkPQAAAJU"]
[Sun Nov 23 16:34:59.672448 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Nov 23 16:35:02.678170 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Nov 23 16:35:02.787844 2025] [:error] [pid 38824:tid 38844] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Nov 23 16:35:02.897347 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Nov 23 16:35:03.056426 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Nov 23 16:35:03.252286 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Nov 23 16:35:03.385914 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Nov 23 16:35:03.491614 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Nov 23 16:35:03.713612 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Nov 23 16:35:03.958705 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Nov 23 16:35:04.056773 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Nov 23 16:35:04.162846 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Nov 23 16:35:04.273991 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Nov 23 16:35:04.373412 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Nov 23 16:35:04.585237 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Nov 23 16:35:04.740044 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Nov 23 16:35:04.911912 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Nov 23 16:35:05.011062 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.13:41557] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Nov 23 16:35:06.630656 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.13:41557] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSLHOk8WZjXLvbHTHPeNbAAAANM"]
[Sun Nov 23 16:35:07.328790 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.77:57139] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSLHOw13QPZSi6O8umVpXQAAAI0"]
[Sun Nov 23 16:35:08.020236 2025] [:error] [pid 38739:tid 38769] [client 140.99.1.18:34639] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Nov 23 16:35:08.355326 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.18:34639] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSLHPAdvEgJm2n2cDmr_3wAAAEI"]
[Sun Nov 23 16:35:09.823140 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.76:21881] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Nov 23 16:35:09.954584 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.76:21881] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSLHPdiQFwsyXQDhwyCHtgAAARI"]
[Sun Nov 23 16:35:10.271377 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.26:50045] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Nov 23 16:35:10.926568 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.26:50045] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSLHPgdvEgJm2n2cDmoAJAAAAEw"]
[Sun Nov 23 16:35:11.268509 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.7:50433] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSLHPwytc6TL9XavPmPOXgAAAA8"]
[Sun Nov 23 16:35:11.471802 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.65:58175] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSLHPwytc6TL9XavPmPOawAAAAA"]
[Sun Nov 23 16:35:11.677197 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.52:21099] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSLHP9iQFwsyXQDhwyCH3AAAAQY"]
[Sun Nov 23 16:35:11.977297 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.20:63229] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSLHPw13QPZSi6O8umVp1gAAAJM"]
[Sun Nov 23 16:35:12.201646 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.43:60487] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSLHQA13QPZSi6O8umVp3QAAAIc"]
[Sun Nov 23 16:35:12.501303 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.71:29435] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSLHQNiQFwsyXQDhwyCH8AAAARc"]
[Sun Nov 23 16:35:12.872794 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.9:21389] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Nov 23 16:35:13.121339 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.9:21389] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aSLHQQytc6TL9XavPmPOiwAAAAI"]
[Sun Nov 23 16:35:13.614403 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.67:58449] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSLHQQytc6TL9XavPmPOmwAAAAc"]
[Sun Nov 23 16:35:13.970291 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.47:59965] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSLHQU8WZjXLvbHTHPeOEwAAAMk"]
[Sun Nov 23 16:35:14.233583 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.37:35739] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Nov 23 16:35:14.371376 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.37:35739] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSLHQgdvEgJm2n2cDmoAbwAAAEw"]
[Sun Nov 23 16:35:14.592863 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.28:32873] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Nov 23 16:35:14.933633 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.28:32873] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Nov 23 16:35:15.283973 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.28:32873] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSLHQ08WZjXLvbHTHPeOPAAAAMQ"]
[Sun Nov 23 16:35:15.568199 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.33:24745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Nov 23 16:35:15.718289 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.33:24745] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSLHQwytc6TL9XavPmPO4wAAAAw"]
[Sun Nov 23 16:35:15.910534 2025] [:error] [pid 38740:tid 38814] [client 140.99.1.65:44591] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Nov 23 16:35:16.110197 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.65:44591] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSLHRA13QPZSi6O8umVqdQAAAJA"]
[Sun Nov 23 16:35:16.537036 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.74:50895] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSLHRAdvEgJm2n2cDmoAkAAAAEg"]
[Sun Nov 23 16:35:16.875004 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.17:20181] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Nov 23 16:35:17.013950 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.17:20181] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Nov 23 16:35:17.220175 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.17:20181] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSLHRQ13QPZSi6O8umVqpgAAAJM"]
[Sun Nov 23 16:35:17.986378 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.50:32433] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSLHRQdvEgJm2n2cDmoAogAAAEI"]
[Sun Nov 23 16:35:18.268570 2025] [:error] [pid 38824:tid 38851] [client 140.99.1.38:44733] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSLHRk8WZjXLvbHTHPeOfAAAANg"]
[Sun Nov 23 16:35:18.507974 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.49:42131] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSLHRtiQFwsyXQDhwyCIiQAAAQg"]
[Sun Nov 23 16:35:18.737246 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.16:34841] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSLHRgdvEgJm2n2cDmoAvgAAAEs"]
[Sun Nov 23 16:35:19.188901 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.31:43303] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Nov 23 16:35:19.290564 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.31:43303] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSLHRwdvEgJm2n2cDmoA0gAAAEg"]
[Sun Nov 23 16:35:19.473007 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.5:60791] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSLHR08WZjXLvbHTHPeOpAAAANI"]
[Sun Nov 23 16:35:19.794325 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.38:62849] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSLHR9iQFwsyXQDhwyCIrQAAARM"]
[Sun Nov 23 16:35:20.316864 2025] [:error] [pid 38824:tid 38844] [client 140.99.1.28:59367] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Nov 23 16:35:20.618315 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.28:59367] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Nov 23 16:35:21.003153 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.28:59367] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSLHSU8WZjXLvbHTHPeOwwAAANQ"]
[Sun Nov 23 16:35:21.546762 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.26:27691] [client 140.99.1.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.26, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSLHSQdvEgJm2n2cDmoBCwAAAE8"]
[Sun Nov 23 16:35:21.669398 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.26:27691] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Nov 23 16:35:22.177474 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.26:27691] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Nov 23 16:35:22.284853 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.26:27691] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Nov 23 16:35:22.772273 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.26:27691] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSLHSgdvEgJm2n2cDmoBJwAAAEM"]
[Sun Nov 23 16:35:23.071425 2025] [:error] [pid 38739:tid 38769] [client 140.99.1.24:49015] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Nov 23 16:35:23.169151 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.24:49015] [client 140.99.1.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.24, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSLHSwdvEgJm2n2cDmoBNAAAAEM"]
[Sun Nov 23 16:35:23.384263 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.24:49015] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSLHSwdvEgJm2n2cDmoBOgAAAEg"]
[Sun Nov 23 16:35:24.009622 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.50:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Nov 23 16:35:28.522277 2025] [:error] [pid 44652:tid 44707] [client 140.99.1.50:54017] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Nov 23 16:35:28.726147 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.50:54017] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSLHUNiQFwsyXQDhwyCJaAAAAQo"]
[Sun Nov 23 16:35:28.945023 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.18:46357] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Nov 23 16:35:29.395265 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.18:46357] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Nov 23 16:35:29.808963 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.18:46357] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Nov 23 16:35:30.022079 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.18:46357] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Nov 23 16:35:30.136397 2025] [:error] [pid 38740:tid 38814] [client 140.99.1.18:46357] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSLHUg13QPZSi6O8umVsiwAAAJI"]
[Sun Nov 23 16:35:30.358405 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.38:22277] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Nov 23 16:35:30.540606 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.38:22277] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Nov 23 16:35:30.759317 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.38:22277] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSLHUtiQFwsyXQDhwyCJigAAARg"]
[Sun Nov 23 16:35:31.067377 2025] [:error] [pid 38824:tid 38835] [client 140.99.1.50:61587] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Nov 23 16:35:31.418976 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.50:61587] [client 140.99.1.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.50, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSLHU08WZjXLvbHTHPeQHgAAANA"]
[Sun Nov 23 16:35:31.565483 2025] [:error] [pid 38824:tid 38851] [client 140.99.1.50:61587] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSLHU08WZjXLvbHTHPeQJAAAANg"]
[Sun Nov 23 16:35:32.959498 2025] [:error] [pid 44652:tid 44728] [client 140.99.1.2:60751] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Nov 23 16:35:33.661134 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.2:60751] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Nov 23 16:35:33.775188 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.2:60751] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSLHVdiQFwsyXQDhwyCKBgAAAQ8"]
[Sun Nov 23 16:35:34.036851 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.16:62753] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Nov 23 16:35:34.355739 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.16:62753] [client 140.99.1.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.16, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSLHVk8WZjXLvbHTHPeQZgAAAMY"]
[Sun Nov 23 16:35:34.477786 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.16:62753] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Nov 23 16:35:34.690142 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.16:62753] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Nov 23 16:35:34.852813 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.16:62753] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Nov 23 16:35:34.957144 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.16:62753] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSLHVk8WZjXLvbHTHPeQewAAANQ"]
[Sun Nov 23 16:35:35.196441 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.9:31325] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Nov 23 16:35:35.291666 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.9:31325] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSLHVw13QPZSi6O8umVtBAAAAIM"]
[Sun Nov 23 16:35:35.617912 2025] [:error] [pid 44652:tid 44709] [client 140.99.1.24:36721] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Nov 23 16:35:35.850359 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.24:36721] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSLHV9iQFwsyXQDhwyCKPQAAAQI"]
[Sun Nov 23 16:35:36.319734 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.67:65261] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Nov 23 16:35:36.422627 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.67:65261] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSLHWA13QPZSi6O8umVtLQAAAIU"]
[Sun Nov 23 16:35:36.684646 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.18:63097] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSLHWNiQFwsyXQDhwyCKUwAAARI"]
[Sun Nov 23 16:35:36.938915 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.37:33099] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Nov 23 16:35:37.037247 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.37:33099] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Nov 23 16:35:37.761153 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.37:33099] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSLHWdiQFwsyXQDhwyCKcwAAAQI"]
[Sun Nov 23 16:35:38.076356 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.53:26769] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSLHWgdvEgJm2n2cDmoCmgAAAFE"]
[Sun Nov 23 16:35:38.607406 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.38:24929] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSLHWk8WZjXLvbHTHPeQ6gAAAMc"]
[Sun Nov 23 16:35:38.794852 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.49:38835] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Nov 23 16:35:39.131073 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.49:38835] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Nov 23 16:35:39.267182 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.49:38835] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSLHWwytc6TL9XavPmPSRgAAAAE"]
[Sun Nov 23 16:35:39.466279 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.42:64485] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Nov 23 16:35:39.730920 2025] [:error] [pid 38740:tid 38802] [client 140.99.1.42:64485] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSLHWw13QPZSi6O8umVtvwAAAIY"]
[Sun Nov 23 16:35:40.289410 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.6:35099] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSLHXAdvEgJm2n2cDmoC1QAAAFE"]
[Sun Nov 23 16:35:40.643676 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.7:25303] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Nov 23 16:35:40.980213 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.7:25303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Nov 23 16:35:41.219420 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.7:25303] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Nov 23 16:35:41.328664 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.7:25303] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSLHXQytc6TL9XavPmPSnAAAABY"]
[Sun Nov 23 16:35:41.576391 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.13:28939] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSLHXQ13QPZSi6O8umVuFAAAAJc"]
[Sun Nov 23 16:35:41.776329 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.47:28069] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSLHXU8WZjXLvbHTHPeRKAAAAMo"]
[Sun Nov 23 16:35:42.041861 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.9:27965] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSLHXg13QPZSi6O8umVuKgAAAJA"]
[Sun Nov 23 16:35:42.380642 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.67:39927] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Nov 23 16:35:42.471509 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.67:39927] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSLHXk8WZjXLvbHTHPeROQAAAMc"]
[Sun Nov 23 16:35:42.678516 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.49:44047] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSLHXgytc6TL9XavPmPSzwAAABA"]
[Sun Nov 23 16:35:42.911125 2025] [:error] [pid 44652:tid 44706] [client 140.99.1.20:36739] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Nov 23 16:35:43.197417 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.20:36739] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSLHX9iQFwsyXQDhwyCK_gAAARA"]
[Sun Nov 23 16:35:43.453164 2025] [:error] [pid 38738:tid 38755] [client 140.99.1.67:51203] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSLHXwytc6TL9XavPmPS7gAAAA0"]
[Sun Nov 23 16:35:43.646564 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.13:51971] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSLHXwdvEgJm2n2cDmoDHwAAAEY"]
[Sun Nov 23 16:35:43.863333 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.7:44629] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSLHXwdvEgJm2n2cDmoDJAAAAEs"]
[Sun Nov 23 16:35:44.226506 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.32:54855] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSLHYNiQFwsyXQDhwyCLEwAAARI"]
[Sun Nov 23 16:35:44.758316 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.5:27409] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSLHYE8WZjXLvbHTHPeRbAAAAMo"]
[Sun Nov 23 16:35:44.972749 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.3:44349] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Nov 23 16:35:45.441646 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.3:44349] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Nov 23 16:35:45.570099 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.3:44349] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSLHYU8WZjXLvbHTHPeRegAAANY"]
[Sun Nov 23 16:35:45.919739 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.6:62703] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Nov 23 16:35:46.024390 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.6:62703] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Nov 23 16:35:46.598054 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.6:62703] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSLHYgytc6TL9XavPmPTVwAAAAU"]
[Sun Nov 23 16:35:47.164342 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.50:53407] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSLHYw13QPZSi6O8umVuxwAAAI8"]
[Sun Nov 23 16:35:47.400368 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.31:23421] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSLHY9iQFwsyXQDhwyCLTgAAAQY"]
[Sun Nov 23 16:35:48.095877 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.43:51165] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSLHZAdvEgJm2n2cDmoD0wAAAEU"]
[Sun Nov 23 16:35:48.626137 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.8:38065] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Nov 23 16:35:48.745037 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.8:38065] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Nov 23 16:35:48.844867 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.8:38065] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Nov 23 16:35:48.981339 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.8:38065] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Nov 23 16:35:49.634369 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.8:38065] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSLHZU8WZjXLvbHTHPeR4wAAAMs"]
[Sun Nov 23 16:35:49.827351 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.6:34245] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSLHZQytc6TL9XavPmPTkwAAABg"]
[Sun Nov 23 16:35:50.047148 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.7:53683] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSLHZgdvEgJm2n2cDmoEAgAAAEU"]
[Sun Nov 23 16:35:50.291404 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.68:28113] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSLHZk8WZjXLvbHTHPeR_gAAANY"]
[Sun Nov 23 16:35:50.490359 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.69:44793] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSLHZgytc6TL9XavPmPTowAAAAw"]
[Sun Nov 23 16:35:50.806609 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.42:44651] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSLHZgytc6TL9XavPmPTqwAAABY"]
[Sun Nov 23 16:35:51.135158 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.68:27137] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSLHZ08WZjXLvbHTHPeSHAAAAMM"]
[Sun Nov 23 16:35:51.334080 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.73:53517] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSLHZw13QPZSi6O8umVvWQAAAIM"]
[Sun Nov 23 16:35:51.671045 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.67:48037] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSLHZ9iQFwsyXQDhwyCLwQAAAQk"]
[Sun Nov 23 16:35:51.950065 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.31:27775] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSLHZwdvEgJm2n2cDmoEKAAAAFI"]
[Sun Nov 23 16:35:52.393388 2025] [:error] [pid 44652:tid 44709] [client 140.99.1.76:46111] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSLHaNiQFwsyXQDhwyCL4AAAAQM"]
[Sun Nov 23 16:35:52.746436 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.50:32701] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSLHaNiQFwsyXQDhwyCL7wAAAQk"]
[Sun Nov 23 16:35:52.955017 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.70:53093] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Nov 23 16:35:53.250969 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.70:53093] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSLHaQdvEgJm2n2cDmoESwAAAEI"]
[Sun Nov 23 16:35:53.738966 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.62:34477] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSLHaQ13QPZSi6O8umVvkwAAAJQ"]
[Sun Nov 23 16:35:54.262654 2025] [:error] [pid 38739:tid 38785] [client 140.99.1.47:22507] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Nov 23 16:35:54.397369 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.47:22507] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSLHagdvEgJm2n2cDmoEaAAAAFI"]
[Sun Nov 23 16:35:54.695878 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.69:39337] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Nov 23 16:35:54.834752 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.69:39337] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Nov 23 16:35:54.965316 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.69:39337] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Nov 23 16:35:55.179630 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.69:39337] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSLHawytc6TL9XavPmPUIQAAAAQ"]
[Sun Nov 23 16:35:55.459344 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.49:44079] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Nov 23 16:35:55.559498 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.49:44079] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSLHawdvEgJm2n2cDmoEhgAAAEg"]
[Sun Nov 23 16:35:56.380102 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.5:56939] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Nov 23 16:35:56.478996 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.5:56939] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Nov 23 16:35:56.580309 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.5:56939] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Nov 23 16:35:57.231125 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.5:56939] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Nov 23 16:35:57.347756 2025] [:error] [pid 44652:tid 44706] [client 140.99.1.5:56939] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Nov 23 16:35:57.600856 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.5:56939] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Nov 23 16:35:57.935665 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.5:56939] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Nov 23 16:35:58.147168 2025] [:error] [pid 44652:tid 44728] [client 140.99.1.5:56939] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSLHbtiQFwsyXQDhwyCMngAAARY"]
[Sun Nov 23 16:35:58.477200 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.77:57153] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSLHbg13QPZSi6O8umVv9wAAAIA"]
[Sun Nov 23 16:35:58.709382 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.9:59365] [client 140.99.1.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.9, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSLHbk8WZjXLvbHTHPeTOwAAANY"]
[Sun Nov 23 16:35:58.712824 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.9:59365] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Nov 23 16:35:58.812282 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.9:59365] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Nov 23 16:35:58.908389 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.9:59365] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSLHbk8WZjXLvbHTHPeTRAAAAM0"]
[Sun Nov 23 16:35:59.339508 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.71:41917] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Nov 23 16:35:59.447436 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.71:41917] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSLHbw13QPZSi6O8umVwDgAAAIw"]
[Sun Nov 23 16:35:59.642405 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.67:22659] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSLHb08WZjXLvbHTHPeTVgAAAMc"]
[Sun Nov 23 16:36:00.548269 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.38:60783] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSLHcAdvEgJm2n2cDmoE6QAAAEM"]
[Sun Nov 23 16:36:01.267606 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.70:35993] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/fm.php"] [unique_id "aSLHcdiQFwsyXQDhwyCM8wAAAQU"]
[Sun Nov 23 16:36:01.778457 2025] [:error] [pid 44652:tid 44723] [client 140.99.1.5:31785] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Nov 23 16:36:02.014426 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.5:31785] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSLHctiQFwsyXQDhwyCNDgAAAQ4"]
[Sun Nov 23 16:36:02.486739 2025] [:error] [pid 38739:tid 38782] [client 140.99.1.3:59945] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Nov 23 16:36:02.747254 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.3:59945] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSLHcgdvEgJm2n2cDmoFGwAAAFU"]
[Sun Nov 23 16:36:02.938260 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.43:35217] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSLHcg13QPZSi6O8umVwYgAAAJQ"]
[Sun Nov 23 16:36:03.356267 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.53:25989] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Nov 23 16:36:03.452661 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.53:25989] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSLHcwdvEgJm2n2cDmoFMAAAAEs"]
[Sun Nov 23 16:36:03.638327 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.39:48965] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSLHcw13QPZSi6O8umVwcwAAAI0"]
[Sun Nov 23 16:36:04.134698 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.67:24037] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Nov 23 16:36:04.236956 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.67:24037] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Nov 23 16:36:04.457500 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.67:24037] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Nov 23 16:36:04.867259 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.67:24037] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSLHdA13QPZSi6O8umVwlwAAAII"]
[Sun Nov 23 16:36:05.095316 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.8:65079] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSLHdQdvEgJm2n2cDmoFXwAAAEc"]
[Sun Nov 23 16:36:05.772685 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.63:42279] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Nov 23 16:36:05.893460 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.63:42279] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSLHddiQFwsyXQDhwyCNbAAAAQo"]
[Sun Nov 23 16:36:06.141585 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.72:42133] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSLHdgdvEgJm2n2cDmoFgQAAAE8"]
[Sun Nov 23 16:36:06.472493 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.15:62203] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSLHdgytc6TL9XavPmPViwAAAAQ"]
[Sun Nov 23 16:36:07.295015 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.69:37591] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sun Nov 23 16:36:07.397104 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.69:37591] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSLHdwdvEgJm2n2cDmoFsAAAAEo"]
[Sun Nov 23 16:36:07.715292 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.27:51935] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSLHd9iQFwsyXQDhwyCNkgAAARA"]
[Sun Nov 23 16:36:07.956119 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.43:31687] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Nov 23 16:36:08.074466 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.43:31687] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Nov 23 16:36:08.305513 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.43:31687] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Nov 23 16:36:09.004384 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.43:31687] [client 140.99.1.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.43, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aSLHeU8WZjXLvbHTHPeUtgAAAMw"]
[Sun Nov 23 16:36:09.274382 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.43:31687] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Nov 23 16:36:09.381063 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.43:31687] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Nov 23 16:36:09.512684 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.43:31687] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Nov 23 16:36:09.795386 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.43:31687] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSLHeU8WZjXLvbHTHPeU1AAAAMM"]
[Sun Nov 23 16:36:09.994031 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.75:45475] [client 140.99.1.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.75, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSLHeQ13QPZSi6O8umVxSQAAAJg"]
[Sun Nov 23 16:36:10.438620 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Nov 23 16:36:10.570420 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Nov 23 16:36:10.798088 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sun Nov 23 16:36:11.007052 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Nov 23 16:36:11.437706 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Nov 23 16:36:12.226767 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Nov 23 16:36:12.351834 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sun Nov 23 16:36:12.956738 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.75:45475] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Nov 23 16:36:13.243286 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.75:45475] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSLHfQ13QPZSi6O8umVxoQAAAJE"]
[Sun Nov 23 16:36:13.654628 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.16:47167] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Nov 23 16:36:13.747155 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.16:47167] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSLHfQ13QPZSi6O8umVxsAAAAIs"]
[Sun Nov 23 16:36:14.058009 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.5:32373] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Nov 23 16:36:14.169249 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.5:32373] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSLHfgytc6TL9XavPmPWkgAAAAM"]
[Sun Nov 23 16:36:14.626647 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.67:59291] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sun Nov 23 16:36:14.884251 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.67:59291] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Nov 23 16:36:15.159604 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.67:59291] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Nov 23 16:36:15.278559 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.67:59291] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sun Nov 23 16:36:15.492302 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.67:59291] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSLHfwytc6TL9XavPmPW0AAAAA8"]
[Sun Nov 23 16:36:15.732341 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.43:31797] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sun Nov 23 16:36:15.915613 2025] [:error] [pid 38738:tid 38755] [client 140.99.1.43:31797] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Nov 23 16:36:16.067332 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.43:31797] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSLHgAytc6TL9XavPmPW5wAAABU"]
[Sun Nov 23 16:36:16.420341 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.50:60167] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSLHgA13QPZSi6O8umVx7gAAAI8"]
[Sun Nov 23 16:36:16.700680 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.75:39183] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Nov 23 16:36:17.057990 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.75:39183] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Nov 23 16:36:17.159949 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.75:39183] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Nov 23 16:36:17.257996 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.75:39183] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSLHgQdvEgJm2n2cDmoHSwAAAEw"]
[Sun Nov 23 16:36:17.457299 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.43:42817] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSLHgdiQFwsyXQDhwyCOkwAAAQI"]
[Sun Nov 23 16:36:18.353271 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.9:58627] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sun Nov 23 16:36:18.605232 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.9:58627] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSLHgtiQFwsyXQDhwyCOtwAAARc"]
[Sun Nov 23 16:36:18.980002 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.73:41017] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tiny.php"] [unique_id "aSLHggytc6TL9XavPmPXGwAAAA4"]
[Sun Nov 23 16:36:19.305979 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.27:48305] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Nov 23 16:36:19.403355 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.27:48305] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Nov 23 16:36:19.549009 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.27:48305] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSLHgwytc6TL9XavPmPXMwAAABY"]
[Sun Nov 23 16:36:20.029085 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.53:56451] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Nov 23 16:36:20.153651 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.53:56451] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sun Nov 23 16:36:20.371603 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.53:56451] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Nov 23 16:36:20.739295 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.53:56451] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSLHhAdvEgJm2n2cDmoHwgAAAEk"]
[Sun Nov 23 16:36:21.078426 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.48:42581] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Nov 23 16:36:21.431361 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.48:42581] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSLHhQytc6TL9XavPmPXbQAAAAA"]
[Sun Nov 23 16:36:21.814733 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.15:24419] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sun Nov 23 16:36:22.155381 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.15:24419] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sun Nov 23 16:36:22.305399 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.15:24419] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Nov 23 16:36:22.531231 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.15:24419] [client 140.99.1.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.15, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSLHhgytc6TL9XavPmPXnQAAAAs"]
[Sun Nov 23 16:36:23.084800 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.15:24419] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSLHhwytc6TL9XavPmPXsAAAAAY"]
[Sun Nov 23 16:36:23.270339 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.77:59097] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sun Nov 23 16:36:23.406856 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.77:59097] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSLHh9iQFwsyXQDhwyCPFgAAAQc"]
[Sun Nov 23 16:36:23.758949 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.75:53777] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Nov 23 16:36:24.004697 2025] [:error] [pid 38739:tid 38773] [client 140.99.1.75:53777] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Nov 23 16:36:24.212881 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.75:53777] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSLHiAdvEgJm2n2cDmoIKgAAAE8"]
[Sun Nov 23 16:36:24.673636 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.28:45705] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Nov 23 16:36:24.800946 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.28:45705] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Nov 23 16:36:24.990927 2025] [:error] [pid 38738:tid 38752] [client 140.99.1.28:45705] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSLHiAytc6TL9XavPmPX6wAAAAo"]
[Sun Nov 23 16:36:25.327286 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.48:37199] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSLHiQytc6TL9XavPmPX9wAAABA"]
[Sun Nov 23 16:36:25.547701 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.75:48351] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sun Nov 23 16:36:25.646319 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.75:48351] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Nov 23 16:36:25.953361 2025] [:error] [pid 38824:tid 38835] [client 140.99.1.75:48351] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSLHiU8WZjXLvbHTHPeWsgAAAMg"]
[Sun Nov 23 16:36:26.212335 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.27:45377] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sun Nov 23 16:36:26.421115 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.27:45377] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sun Nov 23 16:36:26.526675 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.27:45377] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSLHigytc6TL9XavPmPYFQAAABU"]
[Sun Nov 23 16:36:26.897428 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.78:60515] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSLHigytc6TL9XavPmPYIwAAABU"]
[Sun Nov 23 16:36:27.096452 2025] [:error] [pid 44652:tid 44709] [client 140.99.1.14:40941] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSLHi9iQFwsyXQDhwyCPZgAAAQM"]
[Sun Nov 23 16:36:27.343034 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.32:36279] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSLHi9iQFwsyXQDhwyCPcQAAAQg"]
[Sun Nov 23 16:36:27.529283 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.3:27107] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSLHi08WZjXLvbHTHPeW2AAAANA"]
[Sun Nov 23 16:36:27.736280 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.38:60917] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSLHi08WZjXLvbHTHPeW2QAAAMU"]
[Sun Nov 23 16:36:27.958423 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.7:53517] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSLHiwdvEgJm2n2cDmoIwAAAAFY"]
[Sun Nov 23 16:36:28.363326 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.16:33215] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSLHjAytc6TL9XavPmPYaAAAAAA"]
[Sun Nov 23 16:36:28.678367 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.28:45785] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSLHjE8WZjXLvbHTHPeW5QAAAMs"]
[Sun Nov 23 16:36:28.927389 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.63:36469] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSLHjA13QPZSi6O8umVziwAAAI0"]
[Sun Nov 23 16:36:29.286465 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.44:41077] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSLHjdiQFwsyXQDhwyCPoQAAAQo"]
[Sun Nov 23 16:36:29.797594 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.18:22243] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSLHjQ13QPZSi6O8umVznwAAAJA"]
[Sun Nov 23 16:36:29.998013 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.37:25313] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Nov 23 16:36:30.539267 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.37:25313] [client 140.99.1.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.37, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSLHjk8WZjXLvbHTHPeXFAAAAMo"]
[Sun Nov 23 16:36:31.340753 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.37:25313] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSLHj08WZjXLvbHTHPeXLwAAAM4"]
[Sun Nov 23 16:36:31.524355 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.53:56547] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSLHj08WZjXLvbHTHPeXOAAAAM0"]
[Sun Nov 23 16:36:32.316619 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Nov 23 16:36:32.485419 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sun Nov 23 16:36:32.928931 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Nov 23 16:36:33.059403 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sun Nov 23 16:36:33.507362 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sun Nov 23 16:36:33.625513 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Nov 23 16:36:33.790917 2025] [:error] [pid 38738:tid 38750] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sun Nov 23 16:36:33.896158 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.15:49533] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sun Nov 23 16:36:34.008356 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.15:49533] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSLHkgytc6TL9XavPmPZMwAAAA4"]
[Sun Nov 23 16:36:34.216820 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.65:62661] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSLHktiQFwsyXQDhwyCQBgAAARU"]
[Sun Nov 23 16:36:39.581396 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.5:60737] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSLHl9iQFwsyXQDhwyCQtgAAARQ"]
[Sun Nov 23 16:36:44.977299 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.52:52555] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sun Nov 23 16:36:45.184043 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.52:52555] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Nov 23 16:36:45.456137 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.52:52555] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Nov 23 16:36:46.029738 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.52:52555] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSLHngdvEgJm2n2cDmoK5gAAAE4"]
[Sun Nov 23 16:36:46.224333 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.47:30755] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSLHng13QPZSi6O8umV1dgAAAIc"]
[Sun Nov 23 16:36:46.470484 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.38:54803] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSLHng13QPZSi6O8umV1egAAAJM"]
[Sun Nov 23 16:36:47.264479 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.24:49673] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSLHnwytc6TL9XavPmPa1wAAABY"]
[Sun Nov 23 16:36:47.664455 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.77:64699] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSLHn9iQFwsyXQDhwyCRiQAAARA"]
[Sun Nov 23 16:36:48.156979 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.10:34173] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSLHoA13QPZSi6O8umV1lwAAAIs"]
[Sun Nov 23 16:36:49.651616 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.9:41943] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSLHoQytc6TL9XavPmPbNAAAABg"]
[Sun Nov 23 16:36:49.846049 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.28:36245] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sun Nov 23 16:36:50.260005 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.28:36245] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSLHotiQFwsyXQDhwyCR_AAAARI"]
[Sun Nov 23 16:36:50.673824 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.43:58747] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Nov 23 16:36:51.010664 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.43:58747] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Nov 23 16:36:51.197313 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.43:58747] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSLHo9iQFwsyXQDhwyCSGwAAAQk"]
[Sun Nov 23 16:36:51.700278 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.17:41211] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSLHow13QPZSi6O8umV17wAAAI8"]
[Sun Nov 23 16:36:52.391285 2025] [:error] [pid 38739:tid 38792] [client 140.99.1.74:37667] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSLHpAdvEgJm2n2cDmoLgAAAAFc"]
[Sun Nov 23 16:36:53.321387 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.53:48939] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSLHpQytc6TL9XavPmPbmQAAAA4"]
[Sun Nov 23 16:36:53.761488 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.30:53693] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Nov 23 16:36:53.858959 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.30:53693] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSLHpQdvEgJm2n2cDmoLqAAAAEc"]
[Sun Nov 23 16:36:54.061916 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.72:33845] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSLHpgytc6TL9XavPmPbqQAAAAQ"]
[Sun Nov 23 16:36:55.043465 2025] [:error] [pid 44652:tid 44723] [client 140.99.1.24:56961] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSLHp9iQFwsyXQDhwyCSkQAAARE"]
[Sun Nov 23 16:36:55.242176 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.72:22617] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Nov 23 16:36:55.635670 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.72:22617] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Nov 23 16:36:55.837370 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.72:22617] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSLHpw13QPZSi6O8umV2QQAAAJc"]
[Sun Nov 23 16:36:56.432451 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.67:39665] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Nov 23 16:36:56.663045 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.67:39665] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSLHqNiQFwsyXQDhwyCSxwAAAQ4"]
[Sun Nov 23 16:36:57.032308 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.18:63663] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSLHqQytc6TL9XavPmPb5gAAABI"]
[Sun Nov 23 16:36:57.490276 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.37:65233] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSLHqdiQFwsyXQDhwyCS2QAAAQo"]
[Sun Nov 23 16:36:58.064690 2025] [:error] [pid 38738:tid 38755] [client 140.99.1.78:52415] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSLHqgytc6TL9XavPmPcEQAAAA0"]
[Sun Nov 23 16:36:58.246100 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.38:60405] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSLHqk8WZjXLvbHTHPeZ0wAAAMQ"]
[Sun Nov 23 16:36:58.619378 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.62:61611] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sun Nov 23 16:36:59.198353 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.62:61611] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSLHqwdvEgJm2n2cDmoMRwAAAE4"]
[Sun Nov 23 16:36:59.616736 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.78:37617] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSLHq9iQFwsyXQDhwyCTDwAAAQg"]
[Sun Nov 23 16:36:59.842671 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.43:58309] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSLHqwytc6TL9XavPmPcSAAAAAY"]
[Sun Nov 23 16:37:00.308880 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.30:48859] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Nov 23 16:37:00.420098 2025] [:error] [pid 38738:tid 38755] [client 140.99.1.30:48859] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSLHrAytc6TL9XavPmPcUgAAAA0"]
[Sun Nov 23 16:37:00.893973 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.11:63875] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSLHrNiQFwsyXQDhwyCTNwAAARI"]
[Sun Nov 23 16:37:04.982315 2025] [:error] [pid 38739:tid 38785] [client 140.99.1.3:27221] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSLHsAdvEgJm2n2cDmoM-AAAAFA"]
[Sun Nov 23 16:37:05.303385 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.49:40129] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sun Nov 23 16:37:05.434358 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.49:40129] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSLHsU8WZjXLvbHTHPeaXAAAAMQ"]
[Sun Nov 23 16:37:05.904032 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.15:34199] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSLHsQ13QPZSi6O8umV3OAAAAIs"]
[Sun Nov 23 16:37:06.290115 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.49:50307] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSLHsgdvEgJm2n2cDmoNJAAAAEE"]
[Sun Nov 23 16:37:06.683570 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.16:24519] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSLHsk8WZjXLvbHTHPeafAAAAMc"]
[Sun Nov 23 16:37:06.920323 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.10:27935] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSLHsk8WZjXLvbHTHPeahQAAANA"]
[Sun Nov 23 16:37:07.113392 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.20:49453] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSLHsw13QPZSi6O8umV3TAAAAIM"]
[Sun Nov 23 16:37:08.223238 2025] [:error] [pid 38738:tid 38759] [client 140.99.1.14:48833] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSLHtAytc6TL9XavPmPdPAAAABE"]
[Sun Nov 23 16:37:08.731059 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.20:45531] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSLHtA13QPZSi6O8umV3dwAAAIs"]
[Sun Nov 23 16:37:13.008201 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.38:39133] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Nov 23 16:37:13.117929 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.38:39133] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSLHuQ13QPZSi6O8umV31wAAAJg"]
[Sun Nov 23 16:37:14.245013 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.31:36795] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSLHuk8WZjXLvbHTHPebPAAAAMU"]
[Sun Nov 23 16:37:14.497008 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.6:57813] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Sun Nov 23 16:37:15.285441 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.6:57813] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSLHuw13QPZSi6O8umV4BgAAAJQ"]
[Sun Nov 23 16:37:15.675338 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.38:51851] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSLHu08WZjXLvbHTHPebXAAAAM4"]
[Sun Nov 23 16:37:16.076172 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.15:51959] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSLHvE8WZjXLvbHTHPebZwAAAMw"]
[Sun Nov 23 16:37:16.632103 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.31:22395] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSLHvE8WZjXLvbHTHPebeAAAANU"]
[Sun Nov 23 16:37:17.758667 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.43:31843] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSLHvU8WZjXLvbHTHPeblwAAANM"]
[Sun Nov 23 16:37:17.956917 2025] [:error] [pid 44652:tid 44723] [client 140.99.1.49:48911] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSLHvdiQFwsyXQDhwyCVMQAAARE"]
[Sun Nov 23 16:37:18.524433 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.2:40693] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSLHvtiQFwsyXQDhwyCVRQAAAQw"]
[Sun Nov 23 16:37:18.836575 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.67:24415] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSLHvtiQFwsyXQDhwyCVSgAAAQg"]
[Sun Nov 23 16:37:19.495680 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.11:49713] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSLHvwdvEgJm2n2cDmoOqgAAAEY"]
[Sun Nov 23 16:37:19.695210 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.49:52961] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSLHvwytc6TL9XavPmPedQAAAAE"]
[Sun Nov 23 16:37:19.898043 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.10:23575] [client 140.99.1.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.10, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSLHvwdvEgJm2n2cDmoOswAAAFY"]
[Sun Nov 23 16:37:19.907316 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.10:23575] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Nov 23 16:37:20.013168 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.10:23575] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSLHwAdvEgJm2n2cDmoOtwAAAEI"]
[Sun Nov 23 16:37:20.445030 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.37:61213] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Nov 23 16:37:20.564640 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.37:61213] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSLHwA13QPZSi6O8umV4wQAAAIc"]
[Sun Nov 23 16:37:20.750160 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.63:39111] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aSLHwAdvEgJm2n2cDmoOxQAAAEI"]
[Sun Nov 23 16:37:20.954132 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.73:53811] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Sun Nov 23 16:37:21.882114 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.73:53811] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSLHwdiQFwsyXQDhwyCVjgAAAQo"]
[Sun Nov 23 16:37:22.177489 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.24:24915] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSLHwk8WZjXLvbHTHPecCQAAAMQ"]
[Sun Nov 23 16:37:22.590924 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.48:32619] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSLHwgdvEgJm2n2cDmoO-AAAAEU"]
[Sun Nov 23 16:37:22.783566 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.27:39905] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSLHwg13QPZSi6O8umV5HQAAAIw"]
[Sun Nov 23 16:37:23.040757 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.53:58753] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sun Nov 23 16:37:23.594358 2025] [:error] [pid 38824:tid 38835] [client 140.99.1.53:58753] [client 140.99.1.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.53, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSLHw08WZjXLvbHTHPecLgAAAMg"]
[Sun Nov 23 16:37:23.813989 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.53:58753] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSLHw08WZjXLvbHTHPecNQAAANM"]
[Sun Nov 23 16:37:24.572696 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.74:31681] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSLHxE8WZjXLvbHTHPecQwAAAMc"]
[Sun Nov 23 16:37:24.857179 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.65:30961] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Nov 23 16:37:24.956302 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.65:30961] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSLHxAdvEgJm2n2cDmoPKgAAAEo"]
[Sun Nov 23 16:37:25.144436 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.11:30797] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSLHxQdvEgJm2n2cDmoPMAAAAFY"]
[Sun Nov 23 16:37:25.339600 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.38:27955] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sun Nov 23 16:37:25.637296 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.38:27955] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSLHxdiQFwsyXQDhwyCV5gAAARg"]
[Sun Nov 23 16:37:26.138958 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.78:31411] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSLHxtiQFwsyXQDhwyCV8gAAAQ4"]
[Sun Nov 23 16:37:26.387233 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.13:57717] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sun Nov 23 16:37:26.577805 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.13:57717] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Nov 23 16:37:26.786769 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.13:57717] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSLHxk8WZjXLvbHTHPecZAAAANA"]
[Sun Nov 23 16:37:27.531837 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.14:40523] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSLHxwytc6TL9XavPmPfZwAAAAI"]
[Sun Nov 23 16:37:35.220924 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.39:46015] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aSLHz08WZjXLvbHTHPedCgAAAME"]
[Sun Nov 23 16:37:35.485668 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.24:25401] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Sun Nov 23 16:37:36.146511 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.24:25401] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSLH0E8WZjXLvbHTHPedJgAAAMI"]
[Sun Nov 23 16:37:36.687376 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.76:51477] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||www.aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aSLH0Aytc6TL9XavPmPghAAAAAs"]
[Sun Nov 23 16:37:36.815496 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.76:51477] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSLH0Aytc6TL9XavPmPgiAAAABg"]
[Sun Nov 23 16:37:37.386383 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.48:64031] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSLH0Qytc6TL9XavPmPglwAAABI"]
[Sun Nov 23 16:37:37.585322 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.26:43437] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSLH0U8WZjXLvbHTHPedOgAAANQ"]
[Sun Nov 23 16:37:38.567064 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.75:41147] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun Nov 23 16:37:39.062292 2025] [:error] [pid 14602:tid 14627] [client 140.99.1.75:41147] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSLH0x-I77jdD81pU-l86gAAAUY"]
[Sun Nov 23 16:37:39.564965 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.26:24145] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSLH09iQFwsyXQDhwyCXEQAAAQI"]
[Sun Nov 23 16:37:39.861892 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.13:34997] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSLH09iQFwsyXQDhwyCXHAAAARg"]
[Sun Nov 23 16:37:40.185526 2025] [:error] [pid 14602:tid 14632] [client 140.99.1.33:51183] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sun Nov 23 16:37:40.695332 2025] [:error] [pid 14602:tid 14624] [client 140.99.1.33:51183] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSLH1B-I77jdD81pU-l9EgAAAUM"]
[Sun Nov 23 16:37:41.179288 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.63:39501] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aSLH1Q13QPZSi6O8umV7vAAAAIA"]
[Sun Nov 23 16:37:41.371619 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.38:62641] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Nov 23 16:37:41.476365 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.38:62641] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSLH1diQFwsyXQDhwyCXQAAAARM"]
[Sun Nov 23 16:37:41.812259 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.43:41645] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSLH1Qytc6TL9XavPmPhGAAAABQ"]
[Sun Nov 23 16:37:42.273756 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.62:47767] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSLH1gytc6TL9XavPmPhJwAAAAI"]
[Sun Nov 23 16:37:42.586020 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.2:22411] [client 140.99.1.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/upload/bilder/cong.php"] [unique_id "aSLH1g13QPZSi6O8umV71wAAAI0"]
[Sun Nov 23 16:37:43.139983 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.3:22351] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Sun Nov 23 16:37:43.292033 2025] [:error] [pid 14602:tid 14622] [client 140.99.1.3:22351] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSLH1x-I77jdD81pU-l9TgAAAUE"]
[Sun Nov 23 16:37:43.511355 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.43:46705] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSLH1wytc6TL9XavPmPhWAAAAAs"]
[Sun Nov 23 16:37:44.394370 2025] [:error] [pid 14602:tid 14644] [client 140.99.1.26:60003] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSLH2B-I77jdD81pU-l9cAAAAVc"]
[Sun Nov 23 16:37:44.905275 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.38:54209] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSLH2A13QPZSi6O8umV8AAAAAIs"]
[Sun Nov 23 16:37:45.192908 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.31:31975] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Sun Nov 23 16:37:45.602221 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.31:31975] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSLH2Qytc6TL9XavPmPhhAAAAAY"]
[Sun Nov 23 16:37:45.885330 2025] [:error] [pid 14602:tid 14638] [client 140.99.1.18:50621] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSLH2R-I77jdD81pU-l9oAAAAVE"]
[Sun Nov 23 16:37:46.211910 2025] [:error] [pid 14602:tid 14624] [client 140.99.1.18:27067] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSLH2h-I77jdD81pU-l9sgAAAUM"]
[Sun Nov 23 16:37:46.443686 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.68:26025] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sun Nov 23 16:37:46.742171 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.68:26025] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSLH2gdvEgJm2n2cDmoQqAAAAEs"]
[Sun Nov 23 16:37:46.979478 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.73:34571] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Sun Nov 23 16:37:51.887143 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.73:34571] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSLH3w13QPZSi6O8umV8YgAAAI8"]
[Sun Nov 23 16:37:52.088144 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.10:36441] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSLH4NiQFwsyXQDhwyCX6AAAAQg"]
[Sun Nov 23 16:37:52.773233 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.18:34395] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSLH4AdvEgJm2n2cDmoRLwAAAE4"]
[Sun Nov 23 16:37:52.960745 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.75:41045] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSLH4A13QPZSi6O8umV8cwAAAIU"]
[Sun Nov 23 16:37:53.436917 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.8:61003] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSLH4Qytc6TL9XavPmPh9gAAABY"]
[Sun Nov 23 16:37:53.772393 2025] [:error] [pid 14602:tid 14637] [client 140.99.1.33:62231] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSLH4R-I77jdD81pU-l-oQAAAVA"]
[Sun Nov 23 16:37:54.074574 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.76:46277] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSLH4gdvEgJm2n2cDmoRSwAAAEI"]
[Sun Nov 23 16:37:54.282982 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.70:32679] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSLH4g13QPZSi6O8umV8lwAAAJA"]
[Sun Nov 23 16:37:54.884984 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.28:38063] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSLH4gytc6TL9XavPmPiEAAAAAY"]
[Sun Nov 23 16:37:55.470990 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.73:21371] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSLH4wytc6TL9XavPmPiIgAAABQ"]
[Sun Nov 23 16:37:55.865348 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.47:62057] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSLH4w13QPZSi6O8umV8qwAAAIk"]
[Sun Nov 23 16:37:56.289228 2025] [:error] [pid 14602:tid 14626] [client 140.99.1.37:41539] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSLH5B-I77jdD81pU-l-3wAAAUU"]
[Sun Nov 23 16:37:56.720911 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.15:38809] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sun Nov 23 16:37:57.256288 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.15:38809] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSLH5Qytc6TL9XavPmPiPwAAABA"]
[Sun Nov 23 16:37:57.454387 2025] [:error] [pid 14602:tid 14634] [client 140.99.1.49:29747] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSLH5R-I77jdD81pU-l-8wAAAU0"]
[Sun Nov 23 16:37:57.774406 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.65:22769] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sun Nov 23 16:37:57.870384 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.65:22769] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSLH5Qytc6TL9XavPmPiRQAAABM"]
[Sun Nov 23 16:37:58.544015 2025] [:error] [pid 14602:tid 14634] [client 140.99.1.63:46265] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSLH5h-I77jdD81pU-l_EwAAAU0"]
[Sun Nov 23 16:37:58.892354 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.30:37721] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Sun Nov 23 16:37:58.999357 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.30:37721] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSLH5tiQFwsyXQDhwyCYWAAAAQY"]
[Sun Nov 23 16:37:59.453488 2025] [:error] [pid 14602:tid 14636] [client 140.99.1.71:20057] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSLH5x-I77jdD81pU-l_KgAAAU8"]
[Sun Nov 23 16:37:59.687318 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.28:49711] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Nov 23 16:37:59.794472 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.28:49711] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSLH59iQFwsyXQDhwyCYYgAAAQY"]
[Sun Nov 23 16:38:00.182300 2025] [:error] [pid 38739:tid 38769] [client 140.99.1.48:22389] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSLH6AdvEgJm2n2cDmoR4wAAAEA"]
[Sun Nov 23 16:38:00.922882 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.38:40369] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sun Nov 23 16:38:01.021503 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.38:40369] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSLH6Qytc6TL9XavPmPidwAAAAc"]
[Sun Nov 23 16:38:01.540926 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.31:28395] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSLH6Q13QPZSi6O8umV9RgAAAIk"]
[Sun Nov 23 16:38:01.784367 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.44:20775] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sun Nov 23 16:38:01.894352 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.44:20775] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSLH6Qytc6TL9XavPmPijgAAAAc"]
[Sun Nov 23 16:38:02.080937 2025] [:error] [pid 14602:tid 14631] [client 140.99.1.10:29357] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSLH6h-I77jdD81pU-l_ZQAAAUo"]
[Sun Nov 23 16:38:02.306644 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.11:26315] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sun Nov 23 16:38:02.665394 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.11:26315] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSLH6g13QPZSi6O8umV9WQAAAIs"]
[Sun Nov 23 16:38:02.852454 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.76:22089] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSLH6gytc6TL9XavPmPinQAAAAE"]
[Sun Nov 23 16:38:03.596182 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.15:37791] [client 140.99.1.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fm.php%20"] [unique_id "aSLH69iQFwsyXQDhwyCYrQAAARA"]
[Sun Nov 23 16:38:04.213348 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.2:27063] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSLH7E8WZjXLvbHTHPefVAAAAMQ"]
[Sun Nov 23 16:38:04.424392 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.2:30439] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSLH7AdvEgJm2n2cDmoSLgAAAFY"]
[Sun Nov 23 16:38:04.800155 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.20:55677] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aSLH7NiQFwsyXQDhwyCYwgAAAQY"]
[Sun Nov 23 16:38:05.007051 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.71:60841] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSLH7diQFwsyXQDhwyCYxQAAAQg"]
[Sun Nov 23 16:38:05.271216 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.76:37789] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSLH7QdvEgJm2n2cDmoSOgAAAFg"]
[Sun Nov 23 16:38:05.457197 2025] [:error] [pid 38740:tid 38802] [client 140.99.1.76:55423] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aSLH7Q13QPZSi6O8umV9jAAAAIY"]
[Sun Nov 23 16:38:06.301139 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.73:43795] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSLH7gytc6TL9XavPmPi3AAAABU"]
[Sun Nov 23 16:38:06.529013 2025] [:error] [pid 14602:tid 14642] [client 140.99.1.13:32513] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aSLH7h-I77jdD81pU-l_tgAAAVU"]
[Sun Nov 23 16:38:06.982840 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.20:54165] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Sun Nov 23 16:38:07.159389 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.20:54165] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSLH79iQFwsyXQDhwyCY5AAAAQc"]
[Sun Nov 23 16:38:07.414823 2025] [:error] [pid 14602:tid 14621] [client 140.99.1.49:61185] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSLH7x-I77jdD81pU-l_yQAAAUA"]
[Sun Nov 23 16:38:07.861321 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.13:62367] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aSLH7x-I77jdD81pU-l_3gAAAVY"]
[Sun Nov 23 16:38:08.123816 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.37:64129] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSLH8NiQFwsyXQDhwyCY6QAAARc"]
[Sun Nov 23 16:38:18.900178 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.28:62055] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aSLH-g13QPZSi6O8umV-aAAAAIs"]
[Sun Nov 23 16:38:19.083373 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.47:61053] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSLH-9iQFwsyXQDhwyCZjQAAARc"]
[Sun Nov 23 16:38:19.979002 2025] [:error] [pid 14602:tid 14642] [client 140.99.1.10:29961] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aSLH-x-I77jdD81pU-mBIQAAAVU"]
[Sun Nov 23 16:38:20.310166 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.14:64741] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSLH_E8WZjXLvbHTHPegRgAAAM8"]
[Sun Nov 23 16:38:20.726930 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.2:41707] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aSLH_Aytc6TL9XavPmPjyQAAABM"]
[Sun Nov 23 16:38:20.930636 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.10:57129] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSLH_E8WZjXLvbHTHPegSwAAANM"]
[Sun Nov 23 16:38:21.179137 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.74:41965] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSLH_diQFwsyXQDhwyCZpAAAARg"]
[Sun Nov 23 16:38:22.070030 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.11:22887] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSLH_g13QPZSi6O8umV-zgAAAJc"]
[Sun Nov 23 16:38:22.265810 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.5:58515] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Sun Nov 23 16:38:22.362195 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.5:58515] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSLH_g13QPZSi6O8umV-2wAAAIc"]
[Sun Nov 23 16:38:22.879380 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.20:28259] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Sun Nov 23 16:38:22.978081 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.20:28259] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSLH_gytc6TL9XavPmPj-gAAABA"]
[Sun Nov 23 16:38:23.286248 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.27:39109] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSLH_08WZjXLvbHTHPegcQAAANI"]
[Sun Nov 23 16:38:23.605275 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.70:20115] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSLH_wytc6TL9XavPmPkBAAAABg"]
[Sun Nov 23 16:38:29.637618 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.30:32703] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun Nov 23 16:38:30.075177 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.30:32703] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aSLIBg13QPZSi6O8umV_ogAAAJM"]
[Sun Nov 23 16:38:30.589893 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.50:46463] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSLIBgytc6TL9XavPmPkXQAAABQ"]
[Sun Nov 23 16:38:31.169294 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.15:44981] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aSLIBwytc6TL9XavPmPkZwAAAAQ"]
[Sun Nov 23 16:38:31.438360 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.42:50841] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aSLIBwdvEgJm2n2cDmoTuAAAAE4"]
[Sun Nov 23 16:38:31.623719 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.74:37213] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aSLIBw13QPZSi6O8umV_yAAAAIQ"]
[Sun Nov 23 16:38:58.471429 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.70:64443] [client 140.99.1.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentyfive/"] [unique_id "aSLIItiQFwsyXQDhwyCcdgAAAQc"]
[Sun Nov 23 16:39:00.872400 2025] [:error] [pid 14602:tid 14644] [client 140.99.1.13:46887] [client 140.99.1.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/wp-admin/includes/"] [unique_id "aSLIJB-I77jdD81pU-mEBQAAAVc"]
[Sun Nov 23 16:39:01.985694 2025] [:error] [pid 38738:tid 38755] [client 140.99.1.18:27785] [client 140.99.1.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/"] [unique_id "aSLIJQytc6TL9XavPmPmjQAAAA0"]
[Sun Nov 23 16:41:15.768947 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Nov 23 16:41:15.864864 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Nov 23 16:41:15.986944 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Nov 23 16:41:16.092938 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Nov 23 16:41:16.255275 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Nov 23 16:41:16.774969 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Nov 23 16:41:16.870269 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Nov 23 16:41:16.968444 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Nov 23 16:41:17.176430 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Nov 23 16:41:17.895933 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Nov 23 16:41:18.017168 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Nov 23 16:41:18.115143 2025] [:error] [pid 38824:tid 38851] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Nov 23 16:41:18.219955 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Nov 23 16:41:18.491395 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Nov 23 16:41:18.716622 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Nov 23 16:41:18.865225 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Nov 23 16:41:18.980085 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Nov 23 16:41:19.078240 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.69:39131] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Nov 23 16:41:21.165038 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.69:39131] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSLIsU8WZjXLvbHTHPesiAAAAM4"]
[Sun Nov 23 16:41:22.137151 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.73:27209] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSLIsgytc6TL9XavPmPxSQAAAAY"]
[Sun Nov 23 16:41:22.761206 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.38:62735] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Nov 23 16:41:23.126273 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.38:62735] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSLIsw13QPZSi6O8umWNIgAAAIE"]
[Sun Nov 23 16:41:23.566398 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.69:37677] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Nov 23 16:41:23.739247 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.69:37677] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSLIs9iQFwsyXQDhwyCmHAAAAQs"]
[Sun Nov 23 16:41:24.234854 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.48:60827] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Nov 23 16:41:24.989666 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.48:60827] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSLItNiQFwsyXQDhwyCmSQAAAQc"]
[Sun Nov 23 16:41:25.330802 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.26:27405] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSLItdiQFwsyXQDhwyCmWQAAARc"]
[Sun Nov 23 16:41:25.548652 2025] [:error] [pid 14602:tid 14629] [client 140.99.1.50:54459] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSLItR-I77jdD81pU-mQUwAAAUg"]
[Sun Nov 23 16:41:25.879846 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.8:49947] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSLItQdvEgJm2n2cDmohPAAAAEw"]
[Sun Nov 23 16:41:26.254976 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.18:25891] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSLItgytc6TL9XavPmPxngAAAAs"]
[Sun Nov 23 16:41:26.630328 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.13:54997] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSLIth-I77jdD81pU-mQfAAAAVQ"]
[Sun Nov 23 16:41:27.041347 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.71:31305] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSLIt08WZjXLvbHTHPes6gAAANQ"]
[Sun Nov 23 16:41:27.533685 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.46:40147] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Nov 23 16:41:27.750608 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.46:40147] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aSLIt9iQFwsyXQDhwyCmjQAAAQw"]
[Sun Nov 23 16:41:28.281473 2025] [:error] [pid 38738:tid 38750] [client 140.99.1.9:53707] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSLIuAytc6TL9XavPmPx1AAAAAg"]
[Sun Nov 23 16:41:29.005282 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.68:32215] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSLIuQ13QPZSi6O8umWNlwAAAIE"]
[Sun Nov 23 16:41:29.280255 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.11:21703] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Nov 23 16:41:29.388446 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.11:21703] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSLIuQdvEgJm2n2cDmohfwAAAFg"]
[Sun Nov 23 16:41:29.697944 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.2:40509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Nov 23 16:41:30.255495 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.2:40509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Nov 23 16:41:31.150423 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.2:40509] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSLIuwdvEgJm2n2cDmohrwAAAEo"]
[Sun Nov 23 16:41:31.358693 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.10:30345] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Nov 23 16:41:31.461079 2025] [:error] [pid 16066:tid 16086] [client 140.99.1.10:30345] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSLIu_q-c47Q5mW5E9FhdwAAAZE"]
[Sun Nov 23 16:41:31.926751 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.72:58707] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Nov 23 16:41:32.182035 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.72:58707] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSLIvA13QPZSi6O8umWN0QAAAIw"]
[Sun Nov 23 16:41:32.465224 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.18:29371] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSLIvNiQFwsyXQDhwyCm5wAAAQg"]
[Sun Nov 23 16:41:32.919137 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.75:33977] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Nov 23 16:41:33.032460 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.75:33977] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Nov 23 16:41:33.348508 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.75:33977] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSLIvU8WZjXLvbHTHPetewAAAMk"]
[Sun Nov 23 16:41:33.766074 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.75:49623] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSLIvQ13QPZSi6O8umWN_wAAAIk"]
[Sun Nov 23 16:41:34.171495 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.44:42829] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSLIvg13QPZSi6O8umWOGwAAAIk"]
[Sun Nov 23 16:41:34.492320 2025] [:error] [pid 14602:tid 14629] [client 140.99.1.16:31611] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSLIvh-I77jdD81pU-mRLgAAAUg"]
[Sun Nov 23 16:41:34.712288 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.76:51053] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSLIvgytc6TL9XavPmPydgAAABU"]
[Sun Nov 23 16:41:35.625308 2025] [:error] [pid 44652:tid 44723] [client 140.99.1.69:58299] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Nov 23 16:41:35.785046 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.69:58299] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSLIv9iQFwsyXQDhwyCnMwAAAQs"]
[Sun Nov 23 16:41:36.020337 2025] [:error] [pid 38739:tid 38792] [client 140.99.1.65:36801] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSLIwAdvEgJm2n2cDmoh_wAAAFc"]
[Sun Nov 23 16:41:36.960496 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.37:28869] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSLIwNiQFwsyXQDhwyCnRAAAAQ0"]
[Sun Nov 23 16:41:38.486152 2025] [:error] [pid 16066:tid 16070] [client 140.99.1.42:41201] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Nov 23 16:41:38.699834 2025] [:error] [pid 16066:tid 16078] [client 140.99.1.42:41201] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Nov 23 16:41:39.195992 2025] [:error] [pid 16066:tid 16071] [client 140.99.1.42:41201] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSLIw_q-c47Q5mW5E9FiIgAAAYI"]
[Sun Nov 23 16:41:39.906345 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.31:34531] [client 140.99.1.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.31, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSLIw_q-c47Q5mW5E9FiNQAAAYU"]
[Sun Nov 23 16:41:40.020644 2025] [:error] [pid 16066:tid 16084] [client 140.99.1.31:34531] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Nov 23 16:41:40.776191 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.31:34531] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Nov 23 16:41:40.931561 2025] [:error] [pid 16066:tid 16093] [client 140.99.1.31:34531] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Nov 23 16:41:41.665338 2025] [:error] [pid 16066:tid 16079] [client 140.99.1.31:34531] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSLIxfq-c47Q5mW5E9FiWAAAAYo"]
[Sun Nov 23 16:41:42.146318 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.18:56157] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Nov 23 16:41:42.279333 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.18:56157] [client 140.99.1.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.18, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSLIxk8WZjXLvbHTHPeuOgAAANI"]
[Sun Nov 23 16:41:42.545082 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.18:56157] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSLIxk8WZjXLvbHTHPeuQAAAAME"]
[Sun Nov 23 16:41:43.557453 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.67:29877] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Nov 23 16:41:43.865307 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.67:29877] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Nov 23 16:41:44.252461 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.67:29877] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSLIyAdvEgJm2n2cDmoihAAAAEY"]
[Sun Nov 23 16:41:44.451110 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.3:38361] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Nov 23 16:41:45.111882 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.3:38361] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Nov 23 16:41:45.400083 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.3:38361] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Nov 23 16:41:45.604100 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.3:38361] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Nov 23 16:41:46.012340 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.3:38361] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSLIyk8WZjXLvbHTHPeuhQAAAMc"]
[Sun Nov 23 16:41:46.306112 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.20:38121] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Nov 23 16:41:46.538222 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.20:38121] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Nov 23 16:41:46.740604 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.20:38121] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSLIygytc6TL9XavPmPzbAAAAAE"]
[Sun Nov 23 16:41:47.124931 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.15:60741] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Nov 23 16:41:47.368381 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.15:60741] [client 140.99.1.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.15, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSLIy9iQFwsyXQDhwyCnzwAAAQw"]
[Sun Nov 23 16:41:47.474606 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.15:60741] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSLIy9iQFwsyXQDhwyCn1QAAAQk"]
[Sun Nov 23 16:41:50.444149 2025] [:error] [pid 38738:tid 38759] [client 140.99.1.46:26457] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Nov 23 16:41:51.297635 2025] [:error] [pid 38738:tid 38750] [client 140.99.1.46:26457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Nov 23 16:41:51.424992 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.46:26457] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSLIzwytc6TL9XavPmPz1wAAABQ"]
[Sun Nov 23 16:41:51.621028 2025] [:error] [pid 16066:tid 16076] [client 140.99.1.20:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Nov 23 16:41:52.128924 2025] [:error] [pid 16066:tid 16078] [client 140.99.1.20:22799] [client 140.99.1.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.20, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSLI0Pq-c47Q5mW5E9FjUAAAAYk"]
[Sun Nov 23 16:41:52.278869 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.20:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Nov 23 16:41:52.391707 2025] [:error] [pid 16066:tid 16083] [client 140.99.1.20:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Nov 23 16:41:52.512344 2025] [:error] [pid 16066:tid 16089] [client 140.99.1.20:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Nov 23 16:41:52.683122 2025] [:error] [pid 16066:tid 16084] [client 140.99.1.20:22799] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSLI0Pq-c47Q5mW5E9FjYAAAAY8"]
[Sun Nov 23 16:41:53.086091 2025] [:error] [pid 16066:tid 16081] [client 140.99.1.10:24181] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Nov 23 16:41:53.223162 2025] [:error] [pid 16066:tid 16083] [client 140.99.1.10:24181] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSLI0fq-c47Q5mW5E9FjbwAAAY4"]
[Sun Nov 23 16:41:53.574290 2025] [:error] [pid 16066:tid 16075] [client 140.99.1.76:27681] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Nov 23 16:41:53.671749 2025] [:error] [pid 16066:tid 16078] [client 140.99.1.76:27681] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSLI0fq-c47Q5mW5E9FjhAAAAYk"]
[Sun Nov 23 16:41:54.262746 2025] [:error] [pid 16066:tid 16086] [client 140.99.1.74:47171] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Nov 23 16:41:54.449061 2025] [:error] [pid 16066:tid 16079] [client 140.99.1.74:47171] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSLI0vq-c47Q5mW5E9FjoAAAAYo"]
[Sun Nov 23 16:41:54.661957 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.3:42115] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSLI0g13QPZSi6O8umWP0wAAAJQ"]
[Sun Nov 23 16:41:54.851706 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.75:45295] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Nov 23 16:41:55.017116 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.75:45295] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Nov 23 16:41:55.664112 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.75:45295] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSLI008WZjXLvbHTHPevaAAAAMU"]
[Sun Nov 23 16:41:55.988933 2025] [:error] [pid 16066:tid 16075] [client 140.99.1.77:45569] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSLI0_q-c47Q5mW5E9FjxgAAAYY"]
[Sun Nov 23 16:41:56.756911 2025] [:error] [pid 14602:tid 14635] [client 140.99.1.37:61633] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSLI1B-I77jdD81pU-mSywAAAU4"]
[Sun Nov 23 16:41:57.026792 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.46:26347] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Nov 23 16:41:57.237898 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.46:26347] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Nov 23 16:41:57.350990 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.46:26347] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSLI1QdvEgJm2n2cDmojrgAAAEg"]
[Sun Nov 23 16:41:57.618585 2025] [:error] [pid 44652:tid 44728] [client 140.99.1.50:50947] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Nov 23 16:41:57.870484 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.50:50947] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSLI1diQFwsyXQDhwyCokwAAARQ"]
[Sun Nov 23 16:41:58.490025 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.11:57207] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSLI1tiQFwsyXQDhwyCorgAAAQU"]
[Sun Nov 23 16:42:02.212504 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.39:34351] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Nov 23 16:42:02.536738 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.39:34351] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Nov 23 16:42:02.793194 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.39:34351] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Nov 23 16:42:02.924982 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.39:34351] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSLI2k8WZjXLvbHTHPewAwAAANU"]
[Sun Nov 23 16:42:03.118132 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.14:51081] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSLI2w13QPZSi6O8umWQsgAAAI0"]
[Sun Nov 23 16:42:03.375171 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.3:56051] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSLI2wdvEgJm2n2cDmokKAAAAFU"]
[Sun Nov 23 16:42:03.598143 2025] [:error] [pid 16066:tid 16086] [client 140.99.1.75:61427] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSLI2_q-c47Q5mW5E9FkpgAAAZE"]
[Sun Nov 23 16:42:04.834773 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.11:58315] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Nov 23 16:42:04.989210 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.11:58315] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSLI3AdvEgJm2n2cDmokZwAAAEs"]
[Sun Nov 23 16:42:05.254857 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.75:28095] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSLI3Q13QPZSi6O8umWQ7QAAAJg"]
[Sun Nov 23 16:42:05.494483 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.47:36253] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Nov 23 16:42:05.744292 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.47:36253] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSLI3Q13QPZSi6O8umWRAwAAAIc"]
[Sun Nov 23 16:42:06.525320 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.68:41363] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSLI3gytc6TL9XavPmP1EgAAAAA"]
[Sun Nov 23 16:42:06.891983 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.20:28905] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSLI3gytc6TL9XavPmP1GgAAABc"]
[Sun Nov 23 16:42:07.127024 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.65:48793] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSLI3w13QPZSi6O8umWRNAAAAIk"]
[Sun Nov 23 16:42:45.493662 2025] [:error] [pid 38740:tid 38802] [client 140.99.1.17:23583] [client 140.99.1.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/limit/"] [unique_id "aSLJBQ13QPZSi6O8umWU_QAAAIY"]
[Sun Nov 23 16:43:02.165893 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.48:24719] [client 140.99.1.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/jquery.filer/uploads/"] [unique_id "aSLJFgdvEgJm2n2cDmopSAAAAEs"]
[Sun Nov 23 16:43:02.496267 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.11:55717] [client 140.99.1.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/"] [unique_id "aSLJFg13QPZSi6O8umWWuwAAAJg"]
[Sun Nov 23 18:04:35.247342 2025] [:error] [pid 44652:tid 44730] [client 176.65.132.18:60870] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSLcM9iQFwsyXQDhwyDtNAAAARg"]
[Sun Nov 23 19:25:52.609764 2025] [:error] [pid 38740:tid 38819] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.fr/
[Sun Nov 23 19:25:53.420962 2025] [:error] [pid 38740:tid 38808] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.yahoo.com/
[Sun Nov 23 19:25:54.494745 2025] [:error] [pid 38740:tid 38808] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://duckduckgo.com/
[Sun Nov 23 19:25:54.706200 2025] [:error] [pid 38740:tid 38813] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.yahoo.com/
[Sun Nov 23 19:25:54.924318 2025] [:error] [pid 38740:tid 38801] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.bing.com/
[Sun Nov 23 19:25:55.136605 2025] [:error] [pid 38740:tid 38818] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://duckduckgo.com/
[Sun Nov 23 19:25:55.634097 2025] [:error] [pid 38740:tid 38799] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.de/
[Sun Nov 23 19:25:55.875751 2025] [:error] [pid 38740:tid 38809] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php, referer: https://www.bing.com/
[Sun Nov 23 19:25:56.114947 2025] [:error] [pid 38740:tid 38796] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.bing.com/
[Sun Nov 23 19:25:56.329105 2025] [:error] [pid 38740:tid 38803] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.fr/
[Sun Nov 23 19:25:56.578603 2025] [:error] [pid 38740:tid 38812] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.google.de/
[Sun Nov 23 19:25:56.937432 2025] [:error] [pid 38740:tid 38806] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.de/
[Sun Nov 23 19:25:57.265448 2025] [:error] [pid 38740:tid 38810] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.co.uk/
[Sun Nov 23 19:25:57.693038 2025] [:error] [pid 38740:tid 38817] [client 128.24.86.41:55955] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php, referer: https://www.google.co.uk/
[Sun Nov 23 19:25:57.902417 2025] [:error] [pid 38740:tid 38816] [client 128.24.86.41:55955] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSLvRQ13QPZSi6O8umXjNQAAAJQ"], referer: https://www.google.fr/
[Sun Nov 23 19:25:58.516425 2025] [:error] [pid 38824:tid 38837] [client 128.24.86.41:56015] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSLvRk8WZjXLvbHTHPfzYQAAAMo"], referer: https://www.google.de/
[Sun Nov 23 19:25:59.887338 2025] [:error] [pid 14602:tid 14635] [client 128.24.86.41:56021] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php, referer: https://www.google.de/
[Sun Nov 23 19:26:00.323276 2025] [:error] [pid 14602:tid 14640] [client 128.24.86.41:56021] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wso112233.php, referer: https://duckduckgo.com/
[Sun Nov 23 19:26:01.619861 2025] [:error] [pid 14602:tid 14641] [client 128.24.86.41:56021] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aSLvSR-I77jdD81pU-ncsgAAAVQ"], referer: https://www.google.de/
[Sun Nov 23 19:26:02.772243 2025] [:error] [pid 14602:tid 14633] [client 128.24.86.41:55981] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php, referer: https://www.google.com/
[Sun Nov 23 19:26:03.273282 2025] [:error] [pid 14602:tid 14645] [client 128.24.86.41:55981] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/shell20211028.php, referer: https://www.google.com/
[Sun Nov 23 19:26:04.304804 2025] [:error] [pid 14602:tid 14629] [client 128.24.86.41:55981] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aSLvTB-I77jdD81pU-ncvwAAAUg"], referer: https://www.google.co.uk/
[Sun Nov 23 19:26:05.831345 2025] [:error] [pid 16066:tid 16079] [client 128.24.86.41:55936] File does not exist: /usr/local/apache/htdocs/suspended-page/bala.php, referer: https://www.yahoo.com/
[Sun Nov 23 19:26:06.368974 2025] [:error] [pid 16066:tid 16081] [client 128.24.86.41:55936] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/bala.php, referer: https://www.google.co.uk/
[Sun Nov 23 19:26:07.434660 2025] [:error] [pid 16066:tid 16080] [client 128.24.86.41:55936] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bala.php"] [unique_id "aSLvT_q-c47Q5mW5E9G2VAAAAYs"], referer: https://www.google.de/
[Sun Nov 23 19:26:09.821000 2025] [:error] [pid 38738:tid 38761] [client 128.24.86.41:56041] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php, referer: https://www.google.co.uk/
[Sun Nov 23 19:26:10.258945 2025] [:error] [pid 38738:tid 38759] [client 128.24.86.41:56041] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aSLvUgytc6TL9XavPmNBrAAAABE"], referer: https://www.google.fr/
[Sun Nov 23 19:26:11.397666 2025] [:error] [pid 44652:tid 44722] [client 128.24.86.41:56002] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php, referer: https://www.google.com/
[Sun Nov 23 19:26:12.462623 2025] [:error] [pid 44652:tid 44710] [client 128.24.86.41:56002] [client 128.24.86.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/repeater.php"] [unique_id "aSLvVNiQFwsyXQDhwyAFKwAAAQQ"], referer: https://duckduckgo.com/
[Sun Nov 23 19:26:13.484088 2025] [:error] [pid 44652:tid 44713] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php, referer: https://www.google.co.uk/
[Sun Nov 23 19:26:14.828979 2025] [:error] [pid 44652:tid 44713] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php, referer: https://www.google.fr/
[Sun Nov 23 19:26:15.962706 2025] [:error] [pid 44652:tid 44714] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php, referer: https://www.bing.com/
[Sun Nov 23 19:26:16.176473 2025] [:error] [pid 44652:tid 44720] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php, referer: https://www.bing.com/
[Sun Nov 23 19:26:18.221621 2025] [:error] [pid 44652:tid 44711] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php, referer: https://www.bing.com/
[Sun Nov 23 19:26:18.433945 2025] [:error] [pid 44652:tid 44726] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php, referer: https://duckduckgo.com/
[Sun Nov 23 19:26:18.647455 2025] [:error] [pid 44652:tid 44715] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php, referer: https://www.google.fr/
[Sun Nov 23 19:26:25.128399 2025] [:error] [pid 44652:tid 44727] [client 128.24.86.41:56036] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.de/
[Sun Nov 23 19:26:28.748393 2025] [:error] [pid 44652:tid 44726] [client 128.24.86.41:56036] [client 128.24.86.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 128.24.86.41, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSLvZNiQFwsyXQDhwyAFTAAAARQ"], referer: https://www.bing.com/
[Mon Nov 24 00:37:02.404842 2025] [:error] [pid 1454:tid 1521] [client 49.205.240.214:18107] [client 49.205.240.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.205.240.214, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSM4Lreh4NH3skJ5n4RkkQAAAMk"]
[Mon Nov 24 00:37:02.411950 2025] [:error] [pid 1454:tid 1521] [client 49.205.240.214:18107] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Nov 24 01:23:41.937718 2025] [:error] [pid 8337:tid 8339] [client 167.71.203.246:60226] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Mon Nov 24 02:20:27.968471 2025] [:error] [pid 8337:tid 8342] [client 176.65.132.18:42002] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSNQa-Smps4S2j95D5iTZAAAAAM"]
[Mon Nov 24 03:23:28.196991 2025] [:error] [pid 1454:tid 1527] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Mon Nov 24 03:23:28.451560 2025] [:error] [pid 1454:tid 1530] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Mon Nov 24 03:23:28.705794 2025] [:error] [pid 1454:tid 1524] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/c4.php
[Mon Nov 24 03:23:29.126327 2025] [:error] [pid 1454:tid 1518] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Mon Nov 24 03:23:29.698723 2025] [:error] [pid 1454:tid 1516] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/wsx.php
[Mon Nov 24 03:23:29.952173 2025] [:error] [pid 1454:tid 1515] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/b4.php
[Mon Nov 24 03:23:30.235125 2025] [:error] [pid 1454:tid 1517] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/xenium4.php
[Mon Nov 24 03:23:30.488833 2025] [:error] [pid 1454:tid 1534] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/xpw.php
[Mon Nov 24 03:23:30.774497 2025] [:error] [pid 1454:tid 1536] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/ww2.php
[Mon Nov 24 03:23:31.029197 2025] [:error] [pid 1454:tid 1529] [client 20.234.3.87:35977] File does not exist: /usr/local/apache/htdocs/suspended-page/ww3.php
[Mon Nov 24 03:23:31.371223 2025] [:error] [pid 1454:tid 1522] [client 20.234.3.87:35977] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSNfM7eh4NH3skJ5n4SWKQAAAMo"]
[Mon Nov 24 03:23:33.425747 2025] [:error] [pid 8337:tid 8361] [client 20.234.3.87:17179] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSNfNeSmps4S2j95D5ivfwAAABY"]
[Mon Nov 24 03:23:36.589108 2025] [:error] [pid 1589:tid 1601] [client 20.234.3.87:49491] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSNfOII2fvripjU0EauhlAAAAUo"]
[Mon Nov 24 03:23:38.206412 2025] [:error] [pid 1454:tid 1515] [client 20.234.3.87:34774] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSNfOreh4NH3skJ5n4SWMgAAAMM"]
[Mon Nov 24 03:23:47.669522 2025] [:error] [pid 1589:tid 1612] [client 20.234.3.87:49517] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aSNfQ4I2fvripjU0EauhtwAAAVU"]
[Mon Nov 24 03:23:51.312638 2025] [:error] [pid 8337:tid 8357] [client 20.234.3.87:49482] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aSNfR-Smps4S2j95D5ivjQAAABI"]
[Mon Nov 24 03:24:00.397785 2025] [:error] [pid 8337:tid 8343] [client 20.234.3.87:35401] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aSNfUOSmps4S2j95D5ivlgAAAAQ"]
[Mon Nov 24 03:24:08.570487 2025] [:error] [pid 1452:tid 1460] [client 20.234.3.87:38265] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aSNfWBKZkEEyVNVXr_niawAAAEM"]
[Mon Nov 24 03:24:10.966798 2025] [:error] [pid 1589:tid 1603] [client 20.234.3.87:34807] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aSNfWoI2fvripjU0EauhxgAAAUw"]
[Mon Nov 24 03:24:12.843161 2025] [:error] [pid 8337:tid 8340] [client 20.234.3.87:16417] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aSNfXOSmps4S2j95D5ivswAAAAE"]
[Mon Nov 24 03:24:19.461142 2025] [:error] [pid 1589:tid 1608] [client 20.234.3.87:38245] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aSNfY4I2fvripjU0Eauh1AAAAVE"]
[Mon Nov 24 03:24:25.289965 2025] [:error] [pid 8337:tid 8363] [client 20.234.3.87:34755] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disaos.php"] [unique_id "aSNfaeSmps4S2j95D5iv2gAAABg"]
[Mon Nov 24 03:24:40.870321 2025] [:error] [pid 1454:tid 1517] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Mon Nov 24 03:24:41.346979 2025] [:error] [pid 1454:tid 1527] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/ww4.php
[Mon Nov 24 03:24:41.902119 2025] [:error] [pid 1454:tid 1533] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Mon Nov 24 03:24:42.156885 2025] [:error] [pid 1454:tid 1529] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Mon Nov 24 03:24:42.429081 2025] [:error] [pid 1454:tid 1520] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/nx1.php
[Mon Nov 24 03:24:42.699368 2025] [:error] [pid 1454:tid 1524] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/ii.php
[Mon Nov 24 03:24:42.956880 2025] [:error] [pid 1454:tid 1528] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/kr.php
[Mon Nov 24 03:24:43.211816 2025] [:error] [pid 1454:tid 1521] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/18299.php
[Mon Nov 24 03:24:43.482394 2025] [:error] [pid 1454:tid 1523] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Mon Nov 24 03:24:43.739393 2025] [:error] [pid 1454:tid 1514] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/acxx.php
[Mon Nov 24 03:24:44.008079 2025] [:error] [pid 1454:tid 1530] [client 20.234.3.87:35414] File does not exist: /usr/local/apache/htdocs/suspended-page/chati.php
[Mon Nov 24 03:24:45.371206 2025] [:error] [pid 1454:tid 1530] [client 20.234.3.87:35414] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSNffbeh4NH3skJ5n4SW4QAAANI"]
[Mon Nov 24 03:24:51.668642 2025] [:error] [pid 1454:tid 1535] [client 20.234.3.87:38269] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSNfg7eh4NH3skJ5n4SW5QAAANc"]
[Mon Nov 24 03:24:54.323968 2025] [:error] [pid 1453:tid 1504] [client 20.234.3.87:34808] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSNfhhUBCt7LU0bO_GBwAQAAAJM"]
[Mon Nov 24 03:24:56.971925 2025] [:error] [pid 8337:tid 8355] [client 20.234.3.87:33417] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSNfiOSmps4S2j95D5iwUQAAABA"]
[Mon Nov 24 03:24:59.134262 2025] [:error] [pid 8337:tid 8341] [client 20.234.3.87:45529] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSNfi-Smps4S2j95D5iwVgAAAAI"]
[Mon Nov 24 03:25:16.326787 2025] [:error] [pid 1589:tid 1603] [client 20.234.3.87:34769] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSNfnII2fvripjU0EauiEAAAAUw"]
[Mon Nov 24 03:25:18.194132 2025] [:error] [pid 1589:tid 1600] [client 20.234.3.87:33451] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSNfnoI2fvripjU0EauiFAAAAUk"]
[Mon Nov 24 03:25:20.007915 2025] [:error] [pid 8337:tid 8343] [client 20.234.3.87:38228] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSNfoOSmps4S2j95D5iwbQAAAAQ"]
[Mon Nov 24 03:25:21.961954 2025] [:error] [pid 1589:tid 1606] [client 20.234.3.87:35418] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSNfoYI2fvripjU0EauiFgAAAU8"]
[Mon Nov 24 03:25:24.759687 2025] [:error] [pid 1453:tid 1488] [client 20.234.3.87:34776] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSNfpBUBCt7LU0bO_GBwIwAAAIQ"]
[Mon Nov 24 03:25:27.657458 2025] [:error] [pid 8337:tid 8347] [client 20.234.3.87:33425] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSNfp-Smps4S2j95D5iwkwAAAAg"]
[Mon Nov 24 03:25:33.046634 2025] [:error] [pid 8337:tid 8350] [client 20.234.3.87:35407] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSNfreSmps4S2j95D5iwywAAAAs"]
[Mon Nov 24 03:25:36.372602 2025] [:error] [pid 1452:tid 1459] [client 20.234.3.87:45535] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSNfsBKZkEEyVNVXr_niuAAAAEI"]
[Mon Nov 24 03:25:38.816761 2025] [:error] [pid 8337:tid 8363] [client 20.234.3.87:38221] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aSNfsuSmps4S2j95D5iw6wAAABg"]
[Mon Nov 24 03:25:40.422037 2025] [:error] [pid 1589:tid 1613] [client 20.234.3.87:45563] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aSNftII2fvripjU0EauiSQAAAVY"]
[Mon Nov 24 03:25:42.032112 2025] [:error] [pid 1454:tid 1532] [client 20.234.3.87:35441] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aSNftreh4NH3skJ5n4SXYgAAANQ"]
[Mon Nov 24 03:25:45.763042 2025] [:error] [pid 1452:tid 1467] [client 20.234.3.87:35419] File does not exist: /usr/local/apache/htdocs/suspended-page/size.php
[Mon Nov 24 03:25:46.016206 2025] [:error] [pid 1452:tid 1468] [client 20.234.3.87:35419] File does not exist: /usr/local/apache/htdocs/suspended-page/rsjlrria.php
[Mon Nov 24 03:25:46.352082 2025] [:error] [pid 1452:tid 1472] [client 20.234.3.87:35419] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSNfuhKZkEEyVNVXr_niwgAAAE8"]
[Mon Nov 24 03:25:49.362715 2025] [:error] [pid 8337:tid 8360] [client 20.234.3.87:45477] File does not exist: /usr/local/apache/htdocs/suspended-page/gec.php
[Mon Nov 24 03:25:49.881188 2025] [:error] [pid 8337:tid 8354] [client 20.234.3.87:45477] File does not exist: /usr/local/apache/htdocs/suspended-page/nfu.php
[Mon Nov 24 03:25:50.391302 2025] [:error] [pid 8337:tid 8351] [client 20.234.3.87:45477] File does not exist: /usr/local/apache/htdocs/suspended-page/xl8.php
[Mon Nov 24 03:25:50.652703 2025] [:error] [pid 8337:tid 8353] [client 20.234.3.87:45477] File does not exist: /usr/local/apache/htdocs/suspended-page/xl6.php
[Mon Nov 24 03:25:50.908616 2025] [:error] [pid 8337:tid 8340] [client 20.234.3.87:45477] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon Nov 24 03:25:51.163973 2025] [:error] [pid 8337:tid 8363] [client 20.234.3.87:45477] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-706.php
[Mon Nov 24 03:25:51.420903 2025] [:error] [pid 8337:tid 8360] [client 20.234.3.87:45477] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Mon Nov 24 03:25:51.710001 2025] [:error] [pid 8337:tid 8344] [client 20.234.3.87:45477] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSNfv-Smps4S2j95D5ixBQAAAAU"]
[Mon Nov 24 03:25:53.216463 2025] [:error] [pid 1453:tid 1501] [client 20.234.3.87:33450] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSNfwRUBCt7LU0bO_GBwoQAAAJA"]
[Mon Nov 24 03:25:56.413190 2025] [:error] [pid 1452:tid 1468] [client 20.234.3.87:38251] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSNfxBKZkEEyVNVXr_niywAAAEs"]
[Mon Nov 24 03:26:03.926638 2025] [:error] [pid 8337:tid 8361] [client 20.234.3.87:33465] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSNfy-Smps4S2j95D5ixGAAAABY"]
[Mon Nov 24 03:26:09.294067 2025] [:error] [pid 1454:tid 1528] [client 20.234.3.87:33455] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/as.php"] [unique_id "aSNf0beh4NH3skJ5n4SXdQAAANA"]
[Mon Nov 24 03:26:12.122373 2025] [:error] [pid 1452:tid 1468] [client 20.234.3.87:34752] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/as.php"] [unique_id "aSNf1BKZkEEyVNVXr_ni_gAAAEs"]
[Mon Nov 24 03:26:17.054213 2025] [:error] [pid 1453:tid 1498] [client 20.234.3.87:45523] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/as.php"] [unique_id "aSNf2RUBCt7LU0bO_GBwtQAAAI0"]
[Mon Nov 24 03:26:21.458063 2025] [:error] [pid 1589:tid 1604] [client 20.234.3.87:34789] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSNf3YI2fvripjU0EauibAAAAU0"]
[Mon Nov 24 03:26:41.334742 2025] [:error] [pid 8337:tid 8347] [client 20.234.3.87:35399] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e56.php"] [unique_id "aSNf8eSmps4S2j95D5ixOAAAAAg"]
[Mon Nov 24 03:26:42.819802 2025] [:error] [pid 8337:tid 8359] [client 20.234.3.87:38223] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e56.php"] [unique_id "aSNf8uSmps4S2j95D5ixOgAAABQ"]
[Mon Nov 24 03:26:45.015489 2025] [:error] [pid 1452:tid 1473] [client 20.234.3.87:33408] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e56.php"] [unique_id "aSNf9RKZkEEyVNVXr_njBgAAAFA"]
[Mon Nov 24 03:26:46.601656 2025] [:error] [pid 8337:tid 8347] [client 20.234.3.87:35443] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e56.php"] [unique_id "aSNf9uSmps4S2j95D5ixQwAAAAg"]
[Mon Nov 24 03:26:48.324334 2025] [:error] [pid 8337:tid 8360] [client 20.234.3.87:35427] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-x.php"] [unique_id "aSNf-OSmps4S2j95D5ixSAAAABU"]
[Mon Nov 24 03:26:50.827486 2025] [:error] [pid 1589:tid 1610] [client 20.234.3.87:38238] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-x.php"] [unique_id "aSNf-oI2fvripjU0EauiiwAAAVM"]
[Mon Nov 24 03:26:52.471648 2025] [:error] [pid 1454:tid 1517] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-x.php
[Mon Nov 24 03:26:53.821363 2025] [:error] [pid 1454:tid 1517] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Mon Nov 24 03:26:54.267682 2025] [:error] [pid 1454:tid 1513] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Mon Nov 24 03:26:54.521670 2025] [:error] [pid 1454:tid 1535] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/20.php
[Mon Nov 24 03:26:54.776618 2025] [:error] [pid 1454:tid 1527] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Nov 24 03:26:55.033208 2025] [:error] [pid 1454:tid 1516] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Mon Nov 24 03:26:55.297527 2025] [:error] [pid 1454:tid 1523] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Mon Nov 24 03:26:55.808471 2025] [:error] [pid 1454:tid 1531] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Nov 24 03:26:56.067527 2025] [:error] [pid 1454:tid 1528] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Mon Nov 24 03:26:56.348668 2025] [:error] [pid 1454:tid 1514] [client 20.234.3.87:45559] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Mon Nov 24 03:26:56.600163 2025] [:error] [pid 1454:tid 1512] [client 20.234.3.87:45559] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSNgALeh4NH3skJ5n4SXlQAAAMA"]
[Mon Nov 24 03:27:04.659231 2025] [:error] [pid 8337:tid 8354] [client 20.234.3.87:38260] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSNgCOSmps4S2j95D5ixSwAAAA8"]
[Mon Nov 24 03:27:07.178885 2025] [:error] [pid 1589:tid 1606] [client 20.234.3.87:35448] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSNgC4I2fvripjU0EauipQAAAU8"]
[Mon Nov 24 03:27:30.764427 2025] [:error] [pid 1452:tid 1469] [client 20.234.3.87:34790] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSNgIhKZkEEyVNVXr_njHAAAAEw"]
[Mon Nov 24 03:27:37.251290 2025] [:error] [pid 8337:tid 8343] [client 20.234.3.87:45504] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSNgKeSmps4S2j95D5ixawAAAAQ"]
[Mon Nov 24 03:27:40.961237 2025] [:error] [pid 1452:tid 1470] [client 20.234.3.87:35416] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSNgLBKZkEEyVNVXr_njIQAAAE0"]
[Mon Nov 24 03:27:41.781540 2025] [:error] [pid 8337:tid 8345] [client 20.234.3.87:34779] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSNgLeSmps4S2j95D5ixcQAAAAY"]
[Mon Nov 24 03:27:44.767130 2025] [:error] [pid 1589:tid 1603] [client 20.234.3.87:45508] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aSNgMII2fvripjU0EauixgAAAUw"]
[Mon Nov 24 03:28:08.023734 2025] [:error] [pid 1453:tid 1505] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Mon Nov 24 03:28:08.283678 2025] [:error] [pid 1453:tid 1488] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Mon Nov 24 03:28:08.540955 2025] [:error] [pid 1453:tid 1490] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Mon Nov 24 03:28:08.827818 2025] [:error] [pid 1453:tid 1509] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Mon Nov 24 03:28:09.102254 2025] [:error] [pid 1453:tid 1492] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/ee.php
[Mon Nov 24 03:28:09.366134 2025] [:error] [pid 1453:tid 1487] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Mon Nov 24 03:28:09.622946 2025] [:error] [pid 1453:tid 1493] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Mon Nov 24 03:28:09.894519 2025] [:error] [pid 1453:tid 1495] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Mon Nov 24 03:28:10.359271 2025] [:error] [pid 1453:tid 1502] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Mon Nov 24 03:28:10.970411 2025] [:error] [pid 1453:tid 1501] [client 20.234.3.87:45549] File does not exist: /usr/local/apache/htdocs/suspended-page/02.php
[Mon Nov 24 03:28:11.429339 2025] [:error] [pid 1453:tid 1504] [client 20.234.3.87:45549] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSNgSxUBCt7LU0bO_GBw_wAAAJM"]
[Mon Nov 24 03:28:12.080095 2025] [:error] [pid 8337:tid 8341] [client 20.234.3.87:33442] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSNgTOSmps4S2j95D5ixlQAAAAI"]
[Mon Nov 24 03:28:15.863987 2025] [:error] [pid 1452:tid 1467] [client 20.234.3.87:38208] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSNgTxKZkEEyVNVXr_njKwAAAEo"]
[Mon Nov 24 03:28:30.053802 2025] [:error] [pid 1452:tid 1464] [client 20.234.3.87:45532] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aSNgXhKZkEEyVNVXr_njPAAAAEc"]
[Mon Nov 24 03:28:37.446730 2025] [:error] [pid 1453:tid 1500] [client 20.234.3.87:33439] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aSNgZRUBCt7LU0bO_GBxEwAAAI8"]
[Mon Nov 24 03:28:40.937512 2025] [:error] [pid 1454:tid 1524] [client 20.234.3.87:35398] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aSNgaLeh4NH3skJ5n4SX1QAAAMw"]
[Mon Nov 24 03:28:48.263210 2025] [:error] [pid 1452:tid 1466] [client 20.234.3.87:17157] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSNgcBKZkEEyVNVXr_njSQAAAEk"]
[Mon Nov 24 03:28:51.051830 2025] [:error] [pid 1452:tid 1478] [client 20.234.3.87:35428] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSNgcxKZkEEyVNVXr_njTAAAAFU"]
[Mon Nov 24 03:28:52.777248 2025] [:error] [pid 1453:tid 1493] [client 20.234.3.87:45516] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSNgdBUBCt7LU0bO_GBxHAAAAIk"]
[Mon Nov 24 03:28:54.172905 2025] [:error] [pid 1452:tid 1458] [client 20.234.3.87:34772] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSNgdhKZkEEyVNVXr_njTgAAAEE"]
[Mon Nov 24 03:29:02.076350 2025] [:error] [pid 8337:tid 8341] [client 20.234.3.87:35418] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSNgfuSmps4S2j95D5ixzwAAAAI"]
[Mon Nov 24 03:29:03.349006 2025] [:error] [pid 1589:tid 1614] [client 20.234.3.87:38261] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSNgf4I2fvripjU0EaujBAAAAVc"]
[Mon Nov 24 03:29:04.774854 2025] [:error] [pid 1589:tid 1594] [client 20.234.3.87:33447] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSNggII2fvripjU0EaujBwAAAUM"]
[Mon Nov 24 03:29:06.470681 2025] [:error] [pid 1452:tid 1460] [client 20.234.3.87:38230] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSNgghKZkEEyVNVXr_njXAAAAEM"]
[Mon Nov 24 03:29:10.651399 2025] [:error] [pid 1452:tid 1479] [client 20.234.3.87:34792] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Nov 24 03:29:10.911685 2025] [:error] [pid 1452:tid 1459] [client 20.234.3.87:34792] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Nov 24 03:29:11.193213 2025] [:error] [pid 1452:tid 1469] [client 20.234.3.87:34792] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSNghxKZkEEyVNVXr_njZQAAAEw"]
[Mon Nov 24 03:29:14.139905 2025] [:error] [pid 1452:tid 1480] [client 20.234.3.87:45556] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSNgihKZkEEyVNVXr_njaQAAAFc"]
[Mon Nov 24 03:29:16.371107 2025] [:error] [pid 8337:tid 8339] [client 20.234.3.87:38245] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSNgjOSmps4S2j95D5ix2QAAAAA"]
[Mon Nov 24 03:29:17.649032 2025] [:error] [pid 8337:tid 8350] [client 20.234.3.87:33466] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSNgjeSmps4S2j95D5ix3AAAAAs"]
[Mon Nov 24 03:29:20.548869 2025] [:error] [pid 1453:tid 1486] [client 20.234.3.87:35447] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSNgkBUBCt7LU0bO_GBxJwAAAII"]
[Mon Nov 24 03:29:25.276703 2025] [:error] [pid 8337:tid 8356] [client 20.234.3.87:33422] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSNgleSmps4S2j95D5ix4wAAABE"]
[Mon Nov 24 03:29:28.648314 2025] [:error] [pid 8337:tid 8339] [client 20.234.3.87:35421] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSNgmOSmps4S2j95D5ix5gAAAAA"]
[Mon Nov 24 03:29:35.520382 2025] [:error] [pid 8337:tid 8342] [client 20.234.3.87:35430] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSNgn-Smps4S2j95D5ix9wAAAAM"]
[Mon Nov 24 03:29:37.969532 2025] [:error] [pid 1454:tid 1516] [client 20.234.3.87:33451] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSNgobeh4NH3skJ5n4SX9wAAAMQ"]
[Mon Nov 24 03:29:40.398289 2025] [:error] [pid 8337:tid 8351] [client 20.234.3.87:16802] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSNgpOSmps4S2j95D5iyCQAAAAw"]
[Mon Nov 24 03:29:43.805283 2025] [:error] [pid 1452:tid 1479] [client 20.234.3.87:35429] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aSNgpxKZkEEyVNVXr_njggAAAFY"]
[Mon Nov 24 03:29:48.057354 2025] [:error] [pid 1452:tid 1471] [client 20.234.3.87:35444] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aSNgrBKZkEEyVNVXr_njiQAAAE4"]
[Mon Nov 24 03:29:50.133153 2025] [:error] [pid 1453:tid 1504] [client 20.234.3.87:16803] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aSNgrhUBCt7LU0bO_GBxRQAAAJM"]
[Mon Nov 24 03:29:53.667041 2025] [:error] [pid 8337:tid 8345] [client 20.234.3.87:38209] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aSNgseSmps4S2j95D5iyDgAAAAY"]
[Mon Nov 24 03:30:05.956037 2025] [:error] [pid 1452:tid 1467] [client 20.234.3.87:38214] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aSNgvRKZkEEyVNVXr_njpwAAAEo"]
[Mon Nov 24 03:30:08.267429 2025] [:error] [pid 8337:tid 8360] [client 20.234.3.87:38256] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aSNgwOSmps4S2j95D5iyIwAAABU"]
[Mon Nov 24 03:30:11.353679 2025] [:error] [pid 8337:tid 8345] [client 20.234.3.87:45551] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aSNgw-Smps4S2j95D5iyKAAAAAY"]
[Mon Nov 24 03:30:35.047181 2025] [:error] [pid 1589:tid 1615] [client 20.234.3.87:33446] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSNg24I2fvripjU0EaujfwAAAVg"]
[Mon Nov 24 03:30:38.801070 2025] [:error] [pid 1453:tid 1495] [client 20.234.3.87:38228] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aSNg3hUBCt7LU0bO_GByFgAAAIo"]
[Mon Nov 24 03:30:47.269103 2025] [:error] [pid 1454:tid 1536] [client 20.234.3.87:45537] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aSNg57eh4NH3skJ5n4SYVAAAANg"]
[Mon Nov 24 03:30:51.389083 2025] [:error] [pid 1452:tid 1460] [client 20.234.3.87:33409] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSNg6xKZkEEyVNVXr_nj8AAAAEM"]
[Mon Nov 24 03:30:59.357159 2025] [:error] [pid 8337:tid 8359] [client 20.234.3.87:38220] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSNg8-Smps4S2j95D5iyewAAABQ"]
[Mon Nov 24 03:31:04.858657 2025] [:error] [pid 1452:tid 1461] [client 20.234.3.87:35436] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSNg-BKZkEEyVNVXr_nj9wAAAEQ"]
[Mon Nov 24 03:31:13.234542 2025] [:error] [pid 1452:tid 1470] [client 20.234.3.87:45531] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSNhARKZkEEyVNVXr_nj_gAAAE0"]
[Mon Nov 24 03:31:16.639382 2025] [:error] [pid 1452:tid 1480] [client 20.234.3.87:45536] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSNhBBKZkEEyVNVXr_nkAgAAAFc"]
[Mon Nov 24 03:31:18.974795 2025] [:error] [pid 1452:tid 1479] [client 20.234.3.87:38215] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSNhBhKZkEEyVNVXr_nkAwAAAFY"]
[Mon Nov 24 03:31:31.734937 2025] [:error] [pid 8337:tid 8340] [client 20.234.3.87:35432] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSNhE-Smps4S2j95D5iyowAAAAE"]
[Mon Nov 24 03:31:37.448264 2025] [:error] [pid 1589:tid 1613] [client 20.234.3.87:45565] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Mon Nov 24 03:31:37.821059 2025] [:error] [pid 1589:tid 1608] [client 20.234.3.87:45565] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSNhGYI2fvripjU0EaujvAAAAVE"]
[Mon Nov 24 03:31:41.250165 2025] [:error] [pid 8337:tid 8353] [client 20.234.3.87:35441] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSNhHeSmps4S2j95D5iyuwAAAA4"]
[Mon Nov 24 03:31:42.750955 2025] [:error] [pid 1452:tid 1457] [client 20.234.3.87:16816] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSNhHhKZkEEyVNVXr_nkEgAAAEA"]
[Mon Nov 24 03:32:00.091806 2025] [:error] [pid 1454:tid 1534] [client 20.234.3.87:35420] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSNhMLeh4NH3skJ5n4SYigAAANY"]
[Mon Nov 24 03:32:01.557950 2025] [:error] [pid 1453:tid 1504] [client 20.234.3.87:45527] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSNhMRUBCt7LU0bO_GBySAAAAJM"]
[Mon Nov 24 03:32:03.116209 2025] [:error] [pid 1452:tid 1465] [client 20.234.3.87:33412] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSNhMxKZkEEyVNVXr_nkJwAAAEg"]
[Mon Nov 24 03:32:05.711527 2025] [:error] [pid 1452:tid 1479] [client 20.234.3.87:35394] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSNhNRKZkEEyVNVXr_nkLAAAAFY"]
[Mon Nov 24 03:32:13.631863 2025] [:error] [pid 1454:tid 1513] [client 20.234.3.87:45539] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSNhPbeh4NH3skJ5n4SYkQAAAME"]
[Mon Nov 24 03:32:15.749623 2025] [:error] [pid 1589:tid 1596] [client 20.234.3.87:45529] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSNhP4I2fvripjU0Eauj4gAAAUU"]
[Mon Nov 24 03:32:16.943518 2025] [:error] [pid 1454:tid 1530] [client 20.234.3.87:38238] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSNhQLeh4NH3skJ5n4SYlwAAANI"]
[Mon Nov 24 03:32:19.917584 2025] [:error] [pid 8337:tid 8355] [client 20.234.3.87:38211] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSNhQ-Smps4S2j95D5iy7AAAABA"]
[Mon Nov 24 03:32:23.123336 2025] [:error] [pid 1454:tid 1519] [client 20.234.3.87:16824] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSNhR7eh4NH3skJ5n4SYmwAAAMc"]
[Mon Nov 24 03:32:25.922060 2025] [:error] [pid 1452:tid 1459] [client 20.234.3.87:35403] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSNhSRKZkEEyVNVXr_nkMwAAAEI"]
[Mon Nov 24 03:32:31.499209 2025] [:error] [pid 1453:tid 1495] [client 20.234.3.87:33442] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSNhTxUBCt7LU0bO_GByWwAAAIo"]
[Mon Nov 24 03:32:33.385138 2025] [:error] [pid 1589:tid 1614] [client 20.234.3.87:33438] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSNhUYI2fvripjU0EaukEQAAAVc"]
[Mon Nov 24 03:32:38.607409 2025] [:error] [pid 1454:tid 1514] [client 20.234.3.87:35446] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSNhVreh4NH3skJ5n4SYsQAAAMI"]
[Mon Nov 24 03:32:40.509119 2025] [:error] [pid 8337:tid 8358] [client 20.234.3.87:35443] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSNhWOSmps4S2j95D5izPgAAABM"]
[Mon Nov 24 03:32:42.575558 2025] [:error] [pid 8337:tid 8351] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Nov 24 03:32:42.852984 2025] [:error] [pid 8337:tid 8339] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/goat1.php
[Mon Nov 24 03:32:43.107105 2025] [:error] [pid 8337:tid 8350] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Nov 24 03:32:43.365268 2025] [:error] [pid 8337:tid 8348] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Mon Nov 24 03:32:44.834304 2025] [:error] [pid 8337:tid 8348] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Mon Nov 24 03:32:45.233563 2025] [:error] [pid 8337:tid 8342] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Mon Nov 24 03:32:46.624312 2025] [:error] [pid 8337:tid 8342] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Mon Nov 24 03:32:46.880274 2025] [:error] [pid 8337:tid 8344] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Mon Nov 24 03:32:47.149441 2025] [:error] [pid 8337:tid 8362] [client 20.234.3.87:16827] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Mon Nov 24 03:32:47.405059 2025] [:error] [pid 8337:tid 8348] [client 20.234.3.87:16827] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSNhX-Smps4S2j95D5izUwAAAAk"]
[Mon Nov 24 03:32:49.633015 2025] [:error] [pid 8337:tid 8363] [client 20.234.3.87:33458] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aSNhYeSmps4S2j95D5izVgAAABg"]
[Mon Nov 24 03:32:52.304070 2025] [:error] [pid 1454:tid 1535] [client 20.234.3.87:45567] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aSNhZLeh4NH3skJ5n4SYtQAAANc"]
[Mon Nov 24 03:32:58.597254 2025] [:error] [pid 1452:tid 1460] [client 20.234.3.87:45517] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aSNhahKZkEEyVNVXr_nkZwAAAEM"]
[Mon Nov 24 03:33:00.751784 2025] [:error] [pid 1452:tid 1461] [client 20.234.3.87:38208] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aSNhbBKZkEEyVNVXr_nkbAAAAEQ"]
[Mon Nov 24 03:33:03.346289 2025] [:error] [pid 8337:tid 8346] [client 20.234.3.87:38213] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aSNhb-Smps4S2j95D5izYgAAAAc"]
[Mon Nov 24 03:33:14.326986 2025] [:error] [pid 1452:tid 1468] [client 20.234.3.87:38243] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSNhehKZkEEyVNVXr_nkhwAAAEs"]
[Mon Nov 24 03:33:20.313674 2025] [:error] [pid 8337:tid 8339] [client 20.234.3.87:35399] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSNhgOSmps4S2j95D5izeAAAAAA"]
[Mon Nov 24 03:33:25.692611 2025] [:error] [pid 1454:tid 1531] [client 20.234.3.87:35453] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSNhhbeh4NH3skJ5n4SYyQAAANM"]
[Mon Nov 24 03:33:29.310614 2025] [:error] [pid 1454:tid 1513] [client 20.234.3.87:45504] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSNhibeh4NH3skJ5n4SYzgAAAME"]
[Mon Nov 24 03:33:31.005345 2025] [:error] [pid 8337:tid 8354] [client 20.234.3.87:16819] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSNhi-Smps4S2j95D5iz1QAAAA8"]
[Mon Nov 24 03:33:34.585618 2025] [:error] [pid 1454:tid 1521] [client 20.234.3.87:35425] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSNhjreh4NH3skJ5n4SY0QAAAMk"]
[Mon Nov 24 03:33:37.425569 2025] [:error] [pid 1454:tid 1515] [client 20.234.3.87:45558] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSNhkbeh4NH3skJ5n4SY0wAAAMM"]
[Mon Nov 24 03:33:42.186313 2025] [:error] [pid 8337:tid 8363] [client 20.234.3.87:16817] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aSNhluSmps4S2j95D5iz6wAAABg"]
[Mon Nov 24 03:33:44.992922 2025] [:error] [pid 1453:tid 1508] [client 20.234.3.87:45507] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aSNhmBUBCt7LU0bO_GByxgAAAJc"]
[Mon Nov 24 03:33:55.966574 2025] [:error] [pid 1453:tid 1501] [client 20.234.3.87:33428] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Nov 24 03:33:56.227311 2025] [:error] [pid 1453:tid 1496] [client 20.234.3.87:33428] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Mon Nov 24 03:33:56.991694 2025] [:error] [pid 1453:tid 1486] [client 20.234.3.87:33428] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSNhpBUBCt7LU0bO_GBy0QAAAII"]
[Mon Nov 24 03:34:24.836564 2025] [:error] [pid 1589:tid 1601] [client 20.234.3.87:35421] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSNhwII2fvripjU0Eauk5QAAAUo"]
[Mon Nov 24 03:34:27.982043 2025] [:error] [pid 8337:tid 8346] [client 20.234.3.87:16784] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSNhw-Smps4S2j95D5i0YQAAAAc"]
[Mon Nov 24 03:34:30.315993 2025] [:error] [pid 1454:tid 1532] [client 20.234.3.87:45552] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSNhxreh4NH3skJ5n4SZPwAAANQ"]
[Mon Nov 24 03:34:44.271203 2025] [:error] [pid 1452:tid 1465] [client 20.234.3.87:16793] [client 20.234.3.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSNh1BKZkEEyVNVXr_nlRAAAAEg"]
[Mon Nov 24 03:34:48.610260 2025] [:error] [pid 1589:tid 1594] [client 20.234.3.87:33448] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSNh2II2fvripjU0EaulCwAAAUM"]
[Mon Nov 24 03:34:55.482502 2025] [:error] [pid 1589:tid 1596] [client 20.234.3.87:35990] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSNh34I2fvripjU0EaulGAAAAUU"]
[Mon Nov 24 03:35:04.924925 2025] [:error] [pid 1589:tid 1595] [client 20.234.3.87:36635] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aSNh6II2fvripjU0EaulQAAAAUQ"]
[Mon Nov 24 03:35:22.493082 2025] [:error] [pid 1454:tid 1534] [client 20.234.3.87:36624] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aSNh-reh4NH3skJ5n4SZnwAAANY"]
[Mon Nov 24 03:35:30.879523 2025] [:error] [pid 1453:tid 1501] [client 20.234.3.87:34766] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aSNiAhUBCt7LU0bO_GBzWAAAAJA"]
[Mon Nov 24 03:35:57.091232 2025] [:error] [pid 1453:tid 1491] [client 20.234.3.87:35429] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSNiHRUBCt7LU0bO_GBzuAAAAIc"]
[Mon Nov 24 03:36:04.841439 2025] [:error] [pid 1454:tid 1517] [client 20.234.3.87:38155] [client 20.234.3.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSNiJLeh4NH3skJ5n4SaEwAAAMU"]
[Mon Nov 24 04:07:22.412403 2025] [:error] [pid 59957:tid 59981] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.com/
[Mon Nov 24 04:07:22.639958 2025] [:error] [pid 59957:tid 59982] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.de/
[Mon Nov 24 04:07:22.896947 2025] [:error] [pid 59957:tid 59980] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.co.uk/
[Mon Nov 24 04:07:23.145027 2025] [:error] [pid 59957:tid 59964] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.bing.com/
[Mon Nov 24 04:07:23.382097 2025] [:error] [pid 59957:tid 59975] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.google.com/
[Mon Nov 24 04:07:23.600769 2025] [:error] [pid 59957:tid 59983] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.google.co.uk/
[Mon Nov 24 04:07:24.041751 2025] [:error] [pid 59957:tid 59969] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://duckduckgo.com/
[Mon Nov 24 04:07:24.277239 2025] [:error] [pid 59957:tid 59962] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php, referer: https://www.bing.com/
[Mon Nov 24 04:07:24.520593 2025] [:error] [pid 59957:tid 59986] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.com/
[Mon Nov 24 04:07:24.755910 2025] [:error] [pid 59957:tid 59979] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.de/
[Mon Nov 24 04:07:25.037388 2025] [:error] [pid 59957:tid 59974] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.google.com/
[Mon Nov 24 04:07:25.254411 2025] [:error] [pid 59957:tid 59972] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.de/
[Mon Nov 24 04:07:25.466779 2025] [:error] [pid 59957:tid 59967] [client 172.176.160.115:4729] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.yahoo.com/
[Mon Nov 24 04:07:38.903890 2025] [autoindex:error] [pid 59957:tid 59985] [client 172.176.160.115:4729] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Nov 24 08:14:42.325068 2025] [:error] [pid 48601:tid 48657] [client 103.65.237.124:56987] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aSOjcoMM4MaVTk74-AYlRQAAAgA"]
[Mon Nov 24 08:14:42.654687 2025] [:error] [pid 48688:tid 48704] [client 103.65.237.124:61448] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aSOjchm2q1FkzLam7A0R3wAAAkw"]
[Mon Nov 24 12:00:18.298742 2025] [:error] [pid 48601:tid 48677] [client 213.21.239.4:45090] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/application/.git/config"] [unique_id "aSPYUoMM4MaVTk74-AZ0zAAAAhQ"]
[Mon Nov 24 12:00:18.307777 2025] [:error] [pid 48599:tid 48606] [client 213.21.239.4:45084] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/dev/.git/config"] [unique_id "aSPYUpzvu6PDJiRKE3LwvwAAAYM"]
[Mon Nov 24 12:00:18.307914 2025] [:error] [pid 16549:tid 16560] [client 213.21.239.4:45088] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backup/.git/config"] [unique_id "aSPYUqeWW19A99PUw_cLpAAAAUg"]
[Mon Nov 24 12:00:18.310607 2025] [:error] [pid 9630:tid 9640] [client 213.21.239.4:45130] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.git/config"] [unique_id "aSPYUirSgUgPGkizt2qbUgAAAEg"]
[Mon Nov 24 12:00:18.314678 2025] [:error] [pid 9630:tid 9655] [client 213.21.239.4:45160] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/developer/.git/config"] [unique_id "aSPYUirSgUgPGkizt2qbUwAAAFc"]
[Mon Nov 24 12:00:18.323172 2025] [:error] [pid 49900:tid 49917] [client 213.21.239.4:45144] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/css../.git/config"] [unique_id "aSPYUjCyPLrvg06aornIggAAAA8"]
[Mon Nov 24 12:00:18.326207 2025] [:error] [pid 9630:tid 9634] [client 213.21.239.4:45188] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.git/config"] [unique_id "aSPYUirSgUgPGkizt2qbVQAAAEI"]
[Mon Nov 24 12:00:18.327256 2025] [:error] [pid 49900:tid 49918] [client 213.21.239.4:45176] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.git/config"] [unique_id "aSPYUjCyPLrvg06aornIhAAAABA"]
[Mon Nov 24 12:00:18.331479 2025] [:error] [pid 16516:tid 16526] [client 213.21.239.4:45212] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/content../.git/config"] [unique_id "aSPYUvqZbniwaNwL8Xm5qwAAAQc"]
[Mon Nov 24 12:00:18.331608 2025] [:error] [pid 16549:tid 16572] [client 213.21.239.4:45204] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/database/.git/config"] [unique_id "aSPYUqeWW19A99PUw_cLpQAAAVM"]
[Mon Nov 24 12:00:18.332138 2025] [:error] [pid 16549:tid 16567] [client 213.21.239.4:45218] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/common/.git/config"] [unique_id "aSPYUqeWW19A99PUw_cLpgAAAU8"]
[Mon Nov 24 12:00:18.332513 2025] [:error] [pid 49900:tid 49903] [client 213.21.239.4:45142] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets../.git/config"] [unique_id "aSPYUjCyPLrvg06aornIhQAAAAE"]
[Mon Nov 24 12:00:18.557102 2025] [:error] [pid 16516:tid 16521] [client 213.21.239.4:45232] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.git/config;"] [unique_id "aSPYUvqZbniwaNwL8Xm5rwAAAQI"]
[Mon Nov 24 12:00:18.561787 2025] [:error] [pid 16516:tid 16533] [client 213.21.239.4:45256] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.git/config"] [unique_id "aSPYUvqZbniwaNwL8Xm5sAAAAQ4"]
[Mon Nov 24 12:00:18.570348 2025] [:error] [pid 49900:tid 49907] [client 213.21.239.4:45264] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.git/%0Aconfig"] [unique_id "aSPYUjCyPLrvg06aornIhwAAAAU"]
[Mon Nov 24 12:00:18.570565 2025] [:error] [pid 48688:tid 48704] [client 213.21.239.4:45240] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa../.git/config"] [unique_id "aSPYUhm2q1FkzLam7A1mVwAAAkw"]
[Mon Nov 24 12:00:18.573015 2025] [:error] [pid 16441:tid 16463] [client 213.21.239.4:45278] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/..;/.git/config"] [unique_id "aSPYUoq_bc5MOa9HflnFXQAAAJM"]
[Mon Nov 24 12:00:18.573964 2025] [:error] [pid 9630:tid 9656] [client 213.21.239.4:45280] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/;/.git/config"] [unique_id "aSPYUirSgUgPGkizt2qbWgAAAFg"]
[Mon Nov 24 12:00:18.575200 2025] [:error] [pid 48600:tid 48640] [client 213.21.239.4:45296] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/static../.git/config"] [unique_id "aSPYUvtOzSUAQvWVjBdPFwAAAco"]
[Mon Nov 24 12:00:18.578094 2025] [:error] [pid 48688:tid 48702] [client 213.21.239.4:45324] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.git/config;.."] [unique_id "aSPYUhm2q1FkzLam7A1mWAAAAko"]
[Mon Nov 24 12:00:21.465962 2025] [:error] [pid 48601:tid 48665] [client 213.21.239.4:39518] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au../.git/config"] [unique_id "aSPYVYMM4MaVTk74-AZ00QAAAgg"]
[Mon Nov 24 12:00:21.468479 2025] [:error] [pid 48599:tid 48618] [client 213.21.239.4:39528] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/..;/.git/config"] [unique_id "aSPYVZzvu6PDJiRKE3LwxQAAAY8"]
[Mon Nov 24 12:00:21.473174 2025] [:error] [pid 48601:tid 48675] [client 213.21.239.4:39560] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSPYVYMM4MaVTk74-AZ00gAAAhI"]
[Mon Nov 24 12:00:21.473363 2025] [:error] [pid 48688:tid 48693] [client 213.21.239.4:39538] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/static../.git/config"] [unique_id "aSPYVRm2q1FkzLam7A1mYQAAAkE"]
[Mon Nov 24 12:00:21.473967 2025] [:error] [pid 16549:tid 16575] [client 213.21.239.4:39550] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSPYVaeWW19A99PUw_cLsQAAAVY"]
[Mon Nov 24 12:00:21.474071 2025] [:error] [pid 48599:tid 48615] [client 213.21.239.4:39566] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;"] [unique_id "aSPYVZzvu6PDJiRKE3LwxgAAAYw"]
[Mon Nov 24 12:00:21.480587 2025] [:error] [pid 48601:tid 48679] [client 213.21.239.4:39586] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/config;"] [unique_id "aSPYVYMM4MaVTk74-AZ00wAAAhY"]
[Mon Nov 24 12:00:21.481150 2025] [:error] [pid 16549:tid 16569] [client 213.21.239.4:39568] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;.."] [unique_id "aSPYVaeWW19A99PUw_cLsgAAAVE"]
[Mon Nov 24 12:00:21.485251 2025] [:error] [pid 16549:tid 16561] [client 213.21.239.4:39608] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/config;.."] [unique_id "aSPYVaeWW19A99PUw_cLswAAAUk"]
[Mon Nov 24 12:00:21.485477 2025] [:error] [pid 9630:tid 9654] [client 213.21.239.4:39612] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/config"] [unique_id "aSPYVSrSgUgPGkizt2qbYQAAAFY"]
[Mon Nov 24 12:00:21.486142 2025] [:error] [pid 48601:tid 48659] [client 213.21.239.4:39576] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/;/.git/config"] [unique_id "aSPYVYMM4MaVTk74-AZ01AAAAgI"]
[Mon Nov 24 12:00:21.486176 2025] [:error] [pid 48599:tid 48612] [client 213.21.239.4:39570] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/config"] [unique_id "aSPYVZzvu6PDJiRKE3LwxwAAAYk"]
[Mon Nov 24 12:00:21.486501 2025] [:error] [pid 48601:tid 48672] [client 213.21.239.4:39592] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/%0Aconfig"] [unique_id "aSPYVYMM4MaVTk74-AZ01QAAAg8"]
[Mon Nov 24 12:00:26.069848 2025] [:error] [pid 16516:tid 16531] [client 213.21.239.4:39720] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/;/.git/config"] [unique_id "aSPYWvqZbniwaNwL8Xm5tgAAAQw"]
[Mon Nov 24 12:00:26.070820 2025] [:error] [pid 16441:tid 16448] [client 213.21.239.4:39728] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/config;.."] [unique_id "aSPYWoq_bc5MOa9HflnFeAAAAIQ"]
[Mon Nov 24 12:00:26.079544 2025] [:error] [pid 48688:tid 48712] [client 213.21.239.4:39808] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/config;"] [unique_id "aSPYWhm2q1FkzLam7A1mZgAAAlQ"]
[Mon Nov 24 12:00:26.081499 2025] [:error] [pid 48599:tid 48620] [client 213.21.239.4:39706] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/new/.git/config"] [unique_id "aSPYWpzvu6PDJiRKE3LwygAAAZE"]
[Mon Nov 24 12:00:26.081680 2025] [:error] [pid 16516:tid 16543] [client 213.21.239.4:39804] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/config"] [unique_id "aSPYWvqZbniwaNwL8Xm5twAAARg"]
[Mon Nov 24 12:00:26.085115 2025] [:error] [pid 16516:tid 16519] [client 213.21.239.4:39764] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au../.git/config"] [unique_id "aSPYWvqZbniwaNwL8Xm5uAAAAQA"]
[Mon Nov 24 12:00:26.086129 2025] [:error] [pid 16516:tid 16537] [client 213.21.239.4:39766] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/..;/.git/config"] [unique_id "aSPYWvqZbniwaNwL8Xm5uQAAARI"]
[Mon Nov 24 12:00:26.088418 2025] [:error] [pid 48600:tid 48630] [client 213.21.239.4:39760] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.git/%0Aconfig"] [unique_id "aSPYWvtOzSUAQvWVjBdPHQAAAcA"]
[Mon Nov 24 12:00:26.092373 2025] [:error] [pid 16441:tid 16459] [client 213.21.239.4:39732] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/prod/.git/config"] [unique_id "aSPYWoq_bc5MOa9HflnFegAAAI8"]
[Mon Nov 24 12:00:26.095415 2025] [:error] [pid 48688:tid 48697] [client 213.21.239.4:39788] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/qa/.git/config"] [unique_id "aSPYWhm2q1FkzLam7A1mZwAAAkU"]
[Mon Nov 24 12:00:26.095431 2025] [:error] [pid 48688:tid 48713] [client 213.21.239.4:39778] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.git/config"] [unique_id "aSPYWhm2q1FkzLam7A1maAAAAlU"]
[Mon Nov 24 12:00:26.338131 2025] [:error] [pid 16441:tid 16460] [client 213.21.239.4:39630] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/lib../.git/config"] [unique_id "aSPYWoq_bc5MOa9HflnFfAAAAJA"]
[Mon Nov 24 12:00:26.342159 2025] [:error] [pid 16441:tid 16452] [client 213.21.239.4:39636] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/live/.git/config"] [unique_id "aSPYWoq_bc5MOa9HflnFfQAAAIg"]
[Mon Nov 24 12:00:26.342938 2025] [:error] [pid 16441:tid 16457] [client 213.21.239.4:39648] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/m/.git/config"] [unique_id "aSPYWoq_bc5MOa9HflnFfgAAAI0"]
[Mon Nov 24 12:00:26.343029 2025] [:error] [pid 16516:tid 16528] [client 213.21.239.4:39666] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/images../.git/config"] [unique_id "aSPYWvqZbniwaNwL8Xm5uwAAAQk"]
[Mon Nov 24 12:00:26.343656 2025] [:error] [pid 16441:tid 16445] [client 213.21.239.4:39686] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/js../.git/config"] [unique_id "aSPYWoq_bc5MOa9HflnFfwAAAIE"]
[Mon Nov 24 12:00:26.347235 2025] [:error] [pid 16441:tid 16464] [client 213.21.239.4:39692] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/config"] [unique_id "aSPYWoq_bc5MOa9HflnFgAAAAJQ"]
[Mon Nov 24 12:00:26.350529 2025] [:error] [pid 16516:tid 16526] [client 213.21.239.4:39674] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/img../.git/config"] [unique_id "aSPYWvqZbniwaNwL8Xm5vAAAAQc"]
[Mon Nov 24 12:00:26.363486 2025] [:error] [pid 48688:tid 48703] [client 213.21.239.4:39642] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/message-api/.git/config"] [unique_id "aSPYWhm2q1FkzLam7A1maQAAAks"]
[Mon Nov 24 12:00:26.364344 2025] [:error] [pid 16516:tid 16533] [client 213.21.239.4:39652] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/git/.git/config"] [unique_id "aSPYWvqZbniwaNwL8Xm5vQAAAQ4"]
[Mon Nov 24 12:00:29.528670 2025] [:error] [pid 9630:tid 9651] [client 213.21.239.4:39856] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/../config"] [unique_id "aSPYXSrSgUgPGkizt2qbgAAAAFM"]
[Mon Nov 24 12:00:29.529286 2025] [:error] [pid 16441:tid 16467] [client 213.21.239.4:39838] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/static../.git/config"] [unique_id "aSPYXYq_bc5MOa9HflnFmwAAAJc"]
[Mon Nov 24 12:00:29.529499 2025] [:error] [pid 16516:tid 16530] [client 213.21.239.4:39822] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;"] [unique_id "aSPYXfqZbniwaNwL8Xm5vwAAAQs"]
[Mon Nov 24 12:00:29.530119 2025] [:error] [pid 16441:tid 16449] [client 213.21.239.4:39858] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.git;/config"] [unique_id "aSPYXYq_bc5MOa9HflnFnAAAAIU"]
[Mon Nov 24 12:00:29.532737 2025] [:error] [pid 16441:tid 16448] [client 213.21.239.4:39874] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config"] [unique_id "aSPYXYq_bc5MOa9HflnFnQAAAIQ"]
[Mon Nov 24 12:00:29.532737 2025] [:error] [pid 48688:tid 48715] [client 213.21.239.4:39878] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/config"] [unique_id "aSPYXRm2q1FkzLam7A1mbAAAAlc"]
[Mon Nov 24 12:00:29.535254 2025] [:error] [pid 48601:tid 48676] [client 213.21.239.4:39886] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSPYXYMM4MaVTk74-AZ01wAAAhM"]
[Mon Nov 24 12:00:29.535751 2025] [:error] [pid 48599:tid 48607] [client 213.21.239.4:39898] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.git/config"] [unique_id "aSPYXZzvu6PDJiRKE3Lw0gAAAYQ"]
[Mon Nov 24 12:00:29.537591 2025] [:error] [pid 16441:tid 16459] [client 213.21.239.4:39890] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static../.git/config"] [unique_id "aSPYXYq_bc5MOa9HflnFngAAAI8"]
[Mon Nov 24 12:00:29.540449 2025] [:error] [pid 16593:tid 16602] [client 213.21.239.4:39934] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSPYXRVGznHBJI2LKpQPeQAAAoc"]
[Mon Nov 24 12:00:29.540654 2025] [:error] [pid 16593:tid 16603] [client 213.21.239.4:39914] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/staging/.git/config"] [unique_id "aSPYXRVGznHBJI2LKpQPegAAAog"]
[Mon Nov 24 12:00:29.543923 2025] [:error] [pid 16441:tid 16454] [client 213.21.239.4:39920] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/config"] [unique_id "aSPYXYq_bc5MOa9HflnFnwAAAIo"]
[Mon Nov 24 12:00:29.545600 2025] [:error] [pid 48600:tid 48651] [client 213.21.239.4:39852] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;.."] [unique_id "aSPYXftOzSUAQvWVjBdPHwAAAdU"]
[Mon Nov 24 12:00:29.547071 2025] [:error] [pid 16441:tid 16460] [client 213.21.239.4:39938] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/web/.git/config"] [unique_id "aSPYXYq_bc5MOa9HflnFoAAAAJA"]
[Mon Nov 24 12:00:29.548192 2025] [:error] [pid 48599:tid 48613] [client 213.21.239.4:39930] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static../.git/config"] [unique_id "aSPYXZzvu6PDJiRKE3Lw0wAAAYo"]
[Mon Nov 24 12:00:29.549016 2025] [:error] [pid 48601:tid 48677] [client 213.21.239.4:39944] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-content/.git/config"] [unique_id "aSPYXYMM4MaVTk74-AZ02AAAAhQ"]
[Mon Nov 24 12:00:29.552587 2025] [:error] [pid 48601:tid 48657] [client 213.21.239.4:39976] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/.git/config"] [unique_id "aSPYXYMM4MaVTk74-AZ02QAAAgA"]
[Mon Nov 24 12:00:29.553263 2025] [:error] [pid 49900:tid 49919] [client 213.21.239.4:39952] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/.git/config"] [unique_id "aSPYXTCyPLrvg06aornIwQAAABE"]
[Mon Nov 24 12:00:29.554040 2025] [:error] [pid 16441:tid 16466] [client 213.21.239.4:39968] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/uat/.git/config"] [unique_id "aSPYXYq_bc5MOa9HflnFoQAAAJY"]
[Mon Nov 24 12:00:31.608407 2025] [:error] [pid 49900:tid 49914] [client 213.21.239.4:43664] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.git;/config"] [unique_id "aSPYXzCyPLrvg06aornI0AAAAAw"]
[Mon Nov 24 12:00:31.609029 2025] [:error] [pid 9630:tid 9654] [client 213.21.239.4:43668] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config"] [unique_id "aSPYXyrSgUgPGkizt2qbiQAAAFY"]
[Mon Nov 24 12:00:31.611642 2025] [:error] [pid 49900:tid 49903] [client 213.21.239.4:43654] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/../config"] [unique_id "aSPYXzCyPLrvg06aornI0QAAAAE"]
[Mon Nov 24 15:02:23.281848 2025] [:error] [pid 48600:tid 48652] [client 45.3.43.207:31635] [client 45.3.43.207] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aSQC__tOzSUAQvWVjBdmlQAAAdY"]
[Mon Nov 24 15:02:25.315711 2025] [:error] [pid 16516:tid 16534] [client 209.50.187.6:39995] [client 209.50.187.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aSQDAfqZbniwaNwL8XnRhQAAAQ8"]
[Mon Nov 24 15:02:26.136071 2025] [:error] [pid 16516:tid 16529] [client 65.111.4.11:20017] [client 65.111.4.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db"] [unique_id "aSQDAvqZbniwaNwL8XnRiAAAAQo"]
[Mon Nov 24 21:15:46.949796 2025] [:error] [pid 48599:tid 48625] [client 4.233.64.129:39119] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Mon Nov 24 21:15:47.235497 2025] [:error] [pid 48599:tid 48625] [client 4.233.64.129:39119] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Nov 24 21:15:47.480623 2025] [:error] [pid 48599:tid 48605] [client 4.233.64.129:39119] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Mon Nov 24 21:15:48.045814 2025] [:error] [pid 48599:tid 48609] [client 4.233.64.129:39119] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Mon Nov 24 21:15:48.287111 2025] [:error] [pid 48599:tid 48608] [client 4.233.64.129:39119] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Mon Nov 24 21:15:48.589970 2025] [:error] [pid 48599:tid 48618] [client 4.233.64.129:39119] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Mon Nov 24 21:15:48.833025 2025] [:error] [pid 48599:tid 48627] [client 4.233.64.129:39119] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSRahJzvu6PDJiRKE3JLOQAAAZg"]
[Mon Nov 24 21:15:51.188209 2025] [:error] [pid 49900:tid 49904] [client 4.233.64.129:39745] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Mon Nov 24 21:15:52.969047 2025] [:error] [pid 49900:tid 49920] [client 4.233.64.129:39745] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSRaiDCyPLrvg06aorlCygAAABI"]
[Mon Nov 24 21:15:53.911278 2025] [:error] [pid 16441:tid 16448] [client 4.233.64.129:39137] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSRaiYq_bc5MOa9HflmJsAAAAIQ"]
[Mon Nov 24 21:15:56.662415 2025] [:error] [pid 16516:tid 16534] [client 4.233.64.129:39132] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSRajPqZbniwaNwL8XkIEwAAAQ8"]
[Mon Nov 24 21:15:59.366653 2025] [:error] [pid 48599:tid 48611] [client 4.233.64.129:39775] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSRaj5zvu6PDJiRKE3JLPAAAAYg"]
[Mon Nov 24 21:16:00.990451 2025] [:error] [pid 48600:tid 48650] [client 4.233.64.129:39160] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aSRakPtOzSUAQvWVjBedSAAAAdQ"]
[Mon Nov 24 21:16:03.398599 2025] [:error] [pid 48601:tid 48667] [client 4.233.64.129:39115] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aSRak4MM4MaVTk74-AbgWwAAAgo"]
[Mon Nov 24 21:16:07.158603 2025] [:error] [pid 16441:tid 16457] [client 4.233.64.129:39782] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aSRal4q_bc5MOa9HflmJuwAAAI0"]
[Mon Nov 24 21:16:08.349714 2025] [:error] [pid 48600:tid 48653] [client 4.233.64.129:39766] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aSRamPtOzSUAQvWVjBedSQAAAdc"]
[Mon Nov 24 21:16:10.277820 2025] [:error] [pid 48601:tid 48677] [client 4.233.64.129:39156] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSRamoMM4MaVTk74-AbgZwAAAhQ"]
[Mon Nov 24 21:16:13.030171 2025] [:error] [pid 16549:tid 16553] [client 4.233.64.129:39165] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSRanaeWW19A99PUw_djLQAAAUE"]
[Mon Nov 24 21:16:14.811022 2025] [:error] [pid 49900:tid 49904] [client 4.233.64.129:39769] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSRanjCyPLrvg06aorlC1AAAAAI"]
[Mon Nov 24 21:16:15.760258 2025] [:error] [pid 48601:tid 48679] [client 4.233.64.129:39145] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSRan4MM4MaVTk74-AbgbgAAAhY"]
[Mon Nov 24 21:16:17.180917 2025] [:error] [pid 48599:tid 48621] [client 4.233.64.129:39748] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "aSRaoZzvu6PDJiRKE3JLPQAAAZI"]
[Mon Nov 24 21:16:18.480094 2025] [:error] [pid 16593:tid 16614] [client 4.233.64.129:39759] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "aSRaohVGznHBJI2LKpRnrQAAApM"]
[Mon Nov 24 21:16:21.283365 2025] [:error] [pid 48601:tid 48670] [client 4.233.64.129:39787] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "aSRapYMM4MaVTk74-AbgcwAAAg0"]
[Mon Nov 24 21:16:23.164404 2025] [:error] [pid 9630:tid 9650] [client 4.233.64.129:39781] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "aSRapyrSgUgPGkizt2ovJAAAAFI"]
[Mon Nov 24 21:16:25.062730 2025] [:error] [pid 48601:tid 48658] [client 4.233.64.129:39112] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSRaqYMM4MaVTk74-AbgeAAAAgE"]
[Mon Nov 24 21:16:26.048716 2025] [:error] [pid 9630:tid 9644] [client 4.233.64.129:39136] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSRaqirSgUgPGkizt2ovJwAAAEw"]
[Mon Nov 24 21:16:28.242375 2025] [:error] [pid 48601:tid 48672] [client 4.233.64.129:39149] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSRarIMM4MaVTk74-AbgfgAAAg8"]
[Mon Nov 24 21:16:29.997418 2025] [:error] [pid 48688:tid 48700] [client 4.233.64.129:39758] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSRarRm2q1FkzLam7A3JqgAAAkg"]
[Mon Nov 24 21:16:32.718964 2025] [:error] [pid 48600:tid 48630] [client 4.233.64.129:39122] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSRasPtOzSUAQvWVjBedVwAAAcA"]
[Mon Nov 24 21:16:34.536134 2025] [:error] [pid 16441:tid 16458] [client 4.233.64.129:39694] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSRasoq_bc5MOa9HflmJ0QAAAI4"]
[Mon Nov 24 21:16:35.942937 2025] [:error] [pid 49900:tid 49925] [client 4.233.64.129:39140] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSRaszCyPLrvg06aorlC3gAAABc"]
[Mon Nov 24 21:16:36.836761 2025] [:error] [pid 16441:tid 16450] [client 4.233.64.129:39776] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSRatIq_bc5MOa9HflmJ1gAAAIY"]
[Mon Nov 24 21:16:37.640260 2025] [:error] [pid 48601:tid 48676] [client 4.233.64.129:39784] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSRatYMM4MaVTk74-AbghgAAAhM"]
[Mon Nov 24 21:16:38.609053 2025] [:error] [pid 16441:tid 16449] [client 4.233.64.129:39735] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/0.php"] [unique_id "aSRatoq_bc5MOa9HflmJ2QAAAIU"]
[Mon Nov 24 21:16:40.090133 2025] [:error] [pid 16441:tid 16466] [client 4.233.64.129:39131] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSRauIq_bc5MOa9HflmJ2gAAAJY"]
[Mon Nov 24 21:16:41.893013 2025] [:error] [pid 48600:tid 48649] [client 4.233.64.129:39744] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSRauftOzSUAQvWVjBedXAAAAdM"]
[Mon Nov 24 21:16:43.972475 2025] [:error] [pid 16593:tid 16595] [client 4.233.64.129:39144] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSRauxVGznHBJI2LKpRnvAAAAoA"]
[Mon Nov 24 21:16:47.951489 2025] [:error] [pid 16549:tid 16552] [client 4.233.64.129:39116] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSRav6eWW19A99PUw_djNAAAAUA"]
[Mon Nov 24 21:16:48.915723 2025] [:error] [pid 48600:tid 48635] [client 4.233.64.129:39108] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSRawPtOzSUAQvWVjBedXQAAAcU"]
[Mon Nov 24 21:16:51.268701 2025] [:error] [pid 48599:tid 48618] [client 4.233.64.129:39768] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSRaw5zvu6PDJiRKE3JLVwAAAY8"]
[Mon Nov 24 21:16:53.165575 2025] [:error] [pid 16593:tid 16600] [client 4.233.64.129:39164] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Mon Nov 24 21:16:53.406596 2025] [:error] [pid 16593:tid 16611] [client 4.233.64.129:39164] File does not exist: /usr/local/apache/htdocs/suspended-page/i1.php
[Mon Nov 24 21:16:53.663136 2025] [:error] [pid 16593:tid 16604] [client 4.233.64.129:39164] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Mon Nov 24 21:16:54.407991 2025] [:error] [pid 16593:tid 16607] [client 4.233.64.129:39164] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Mon Nov 24 21:16:54.652428 2025] [:error] [pid 16593:tid 16612] [client 4.233.64.129:39164] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Mon Nov 24 21:16:55.133565 2025] [:error] [pid 16593:tid 16616] [client 4.233.64.129:39164] File does not exist: /usr/local/apache/htdocs/suspended-page/17.php
[Mon Nov 24 21:16:55.377322 2025] [:error] [pid 16593:tid 16596] [client 4.233.64.129:39164] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Mon Nov 24 21:16:55.865358 2025] [:error] [pid 16593:tid 16597] [client 4.233.64.129:39164] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSRaxxVGznHBJI2LKpRnygAAAoI"]
[Mon Nov 24 21:16:57.215701 2025] [:error] [pid 16441:tid 16467] [client 4.233.64.129:39771] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSRayYq_bc5MOa9HflmJ4QAAAJc"]
[Mon Nov 24 21:16:58.119771 2025] [:error] [pid 16441:tid 16448] [client 4.233.64.129:39780] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSRayoq_bc5MOa9HflmJ4wAAAIQ"]
[Mon Nov 24 21:16:59.361783 2025] [:error] [pid 16549:tid 16553] [client 4.233.64.129:39153] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSRay6eWW19A99PUw_djOAAAAUE"]
[Mon Nov 24 21:17:01.021597 2025] [:error] [pid 48601:tid 48680] [client 4.233.64.129:39120] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSRazYMM4MaVTk74-AbgngAAAhc"]
[Mon Nov 24 21:17:02.663938 2025] [:error] [pid 16549:tid 16572] [client 4.233.64.129:39143] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aSRazqeWW19A99PUw_djOgAAAVM"]
[Mon Nov 24 21:17:03.807789 2025] [:error] [pid 16516:tid 16538] [client 4.233.64.129:39757] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aSRaz_qZbniwaNwL8XkIMAAAARM"]
[Mon Nov 24 21:17:04.918303 2025] [:error] [pid 16593:tid 16619] [client 4.233.64.129:39104] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aSRa0BVGznHBJI2LKpRn0AAAApg"]
[Mon Nov 24 21:17:06.698808 2025] [:error] [pid 9630:tid 9648] [client 4.233.64.129:39138] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSRa0irSgUgPGkizt2ovQQAAAFA"]
[Mon Nov 24 21:17:10.050063 2025] [:error] [pid 16549:tid 16557] [client 4.233.64.129:39682] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSRa1qeWW19A99PUw_djQwAAAUU"]
[Mon Nov 24 21:17:10.982525 2025] [:error] [pid 9630:tid 9654] [client 4.233.64.129:39148] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSRa1irSgUgPGkizt2ovRgAAAFY"]
[Mon Nov 24 21:17:12.488768 2025] [:error] [pid 48599:tid 48608] [client 4.233.64.129:39752] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSRa2Jzvu6PDJiRKE3JLawAAAYU"]
[Mon Nov 24 21:17:13.725778 2025] [:error] [pid 48600:tid 48630] [client 4.233.64.129:39754] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aSRa2ftOzSUAQvWVjBedZAAAAcA"]
[Mon Nov 24 21:17:17.635466 2025] [:error] [pid 16549:tid 16568] [client 4.233.64.129:39763] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aSRa3aeWW19A99PUw_djRQAAAVA"]
[Mon Nov 24 21:17:19.127439 2025] [:error] [pid 48600:tid 48636] [client 4.233.64.129:39696] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aSRa3_tOzSUAQvWVjBedZQAAAcY"]
[Mon Nov 24 21:17:20.626886 2025] [:error] [pid 16549:tid 16561] [client 4.233.64.129:39783] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aSRa4KeWW19A99PUw_djRgAAAUk"]
[Mon Nov 24 21:17:21.634711 2025] [:error] [pid 9630:tid 9653] [client 4.233.64.129:39749] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSRa4SrSgUgPGkizt2ovVgAAAFU"]
[Mon Nov 24 21:17:22.488830 2025] [:error] [pid 16441:tid 16450] [client 4.233.64.129:39765] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSRa4oq_bc5MOa9HflmJ9gAAAIY"]
[Mon Nov 24 21:17:24.331080 2025] [:error] [pid 48600:tid 48633] [client 4.233.64.129:39790] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSRa5PtOzSUAQvWVjBedaQAAAcM"]
[Mon Nov 24 21:17:24.979900 2025] [:error] [pid 16441:tid 16466] [client 4.233.64.129:39723] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSRa5Iq_bc5MOa9HflmJ_AAAAJY"]
[Mon Nov 24 21:17:26.731741 2025] [:error] [pid 48688:tid 48701] [client 4.233.64.129:39805] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yu.php"] [unique_id "aSRa5hm2q1FkzLam7A3JuAAAAkk"]
[Mon Nov 24 21:17:28.628616 2025] [:error] [pid 49900:tid 49906] [client 4.233.64.129:39747] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yu.php"] [unique_id "aSRa6DCyPLrvg06aorlDAAAAAAQ"]
[Mon Nov 24 21:17:29.850648 2025] [:error] [pid 48688:tid 48695] [client 4.233.64.129:39774] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yu.php"] [unique_id "aSRa6Rm2q1FkzLam7A3JuwAAAkM"]
[Mon Nov 24 21:17:31.460178 2025] [:error] [pid 48599:tid 48613] [client 4.233.64.129:39736] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yu.php"] [unique_id "aSRa65zvu6PDJiRKE3JLeAAAAYo"]
[Mon Nov 24 21:17:33.029593 2025] [:error] [pid 48601:tid 48668] [client 4.233.64.129:39773] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/Marvins.php"] [unique_id "aSRa7YMM4MaVTk74-AbgvAAAAgs"]
[Mon Nov 24 21:17:34.289358 2025] [:error] [pid 48599:tid 48626] [client 4.233.64.129:39124] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/Marvins.php"] [unique_id "aSRa7pzvu6PDJiRKE3JLegAAAZc"]
[Mon Nov 24 21:17:35.477836 2025] [:error] [pid 16441:tid 16453] [client 4.233.64.129:39760] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/Marvins.php"] [unique_id "aSRa74q_bc5MOa9HflmKBgAAAIk"]
[Mon Nov 24 21:17:36.627395 2025] [:error] [pid 16549:tid 16565] [client 4.233.64.129:39777] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/Marvins.php"] [unique_id "aSRa8KeWW19A99PUw_djWgAAAU0"]
[Mon Nov 24 21:17:38.307951 2025] [:error] [pid 49900:tid 49917] [client 4.233.64.129:39141] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSRa8jCyPLrvg06aorlDCwAAAA8"]
[Mon Nov 24 21:17:39.491000 2025] [:error] [pid 9630:tid 9648] [client 4.233.64.129:39778] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSRa8yrSgUgPGkizt2ovcAAAAFA"]
[Mon Nov 24 21:17:40.389001 2025] [:error] [pid 16441:tid 16446] [client 4.233.64.129:39686] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSRa9Iq_bc5MOa9HflmKCAAAAII"]
[Mon Nov 24 21:17:41.079753 2025] [:error] [pid 16593:tid 16601] [client 4.233.64.129:39135] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSRa9RVGznHBJI2LKpRn3wAAAoY"]
[Mon Nov 24 21:17:42.402528 2025] [:error] [pid 16441:tid 16455] [client 4.233.64.129:39154] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/124.php"] [unique_id "aSRa9oq_bc5MOa9HflmKCgAAAIs"]
[Mon Nov 24 21:17:43.442291 2025] [:error] [pid 48688:tid 48694] [client 4.233.64.129:39126] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/124.php"] [unique_id "aSRa9xm2q1FkzLam7A3JwgAAAkI"]
[Mon Nov 24 21:17:44.616344 2025] [:error] [pid 9630:tid 9634] [client 4.233.64.129:39731] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/124.php"] [unique_id "aSRa-CrSgUgPGkizt2ovcQAAAEI"]
[Mon Nov 24 21:17:45.317279 2025] [:error] [pid 16593:tid 16598] [client 4.233.64.129:39121] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/124.php"] [unique_id "aSRa-RVGznHBJI2LKpRn4AAAAoM"]
[Mon Nov 24 21:17:46.168224 2025] [:error] [pid 16549:tid 16575] [client 4.233.64.129:39792] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSRa-qeWW19A99PUw_djbQAAAVY"]
[Mon Nov 24 21:17:46.981956 2025] [:error] [pid 16516:tid 16529] [client 4.233.64.129:39801] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSRa-vqZbniwaNwL8XkISgAAAQo"]
[Mon Nov 24 21:17:48.111537 2025] [:error] [pid 16441:tid 16464] [client 4.233.64.129:39693] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSRa_Iq_bc5MOa9HflmKEAAAAJQ"]
[Mon Nov 24 21:17:48.867992 2025] [:error] [pid 48601:tid 48676] [client 4.233.64.129:39151] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSRa_IMM4MaVTk74-AbgxAAAAhM"]
[Mon Nov 24 21:17:50.265827 2025] [:error] [pid 48601:tid 48658] [client 4.233.64.129:39690] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/q.php"] [unique_id "aSRa_oMM4MaVTk74-AbgxQAAAgE"]
[Mon Nov 24 21:17:51.120691 2025] [:error] [pid 48601:tid 48669] [client 4.233.64.129:39719] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/q.php"] [unique_id "aSRa_4MM4MaVTk74-AbgxwAAAgw"]
[Mon Nov 24 21:17:51.911949 2025] [:error] [pid 48600:tid 48633] [client 4.233.64.129:39713] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/q.php"] [unique_id "aSRa__tOzSUAQvWVjBediAAAAcM"]
[Mon Nov 24 21:17:52.689674 2025] [:error] [pid 16441:tid 16462] [client 4.233.64.129:39756] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/q.php"] [unique_id "aSRbAIq_bc5MOa9HflmKHgAAAJI"]
[Mon Nov 24 21:17:53.642195 2025] [:error] [pid 9630:tid 9646] [client 4.233.64.129:39755] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aSRbASrSgUgPGkizt2oveQAAAE4"]
[Mon Nov 24 21:17:54.284828 2025] [:error] [pid 9630:tid 9633] [client 4.233.64.129:39796] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aSRbAirSgUgPGkizt2ovegAAAEE"]
[Mon Nov 24 21:17:54.881813 2025] [:error] [pid 9630:tid 9651] [client 4.233.64.129:39681] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aSRbAirSgUgPGkizt2ovewAAAFM"]
[Mon Nov 24 21:17:55.460012 2025] [:error] [pid 48601:tid 48681] [client 4.233.64.129:39791] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php
[Mon Nov 24 21:17:55.969946 2025] [:error] [pid 48601:tid 48661] [client 4.233.64.129:39791] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Mon Nov 24 21:17:56.458485 2025] [:error] [pid 48601:tid 48657] [client 4.233.64.129:39791] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Mon Nov 24 21:17:56.979320 2025] [:error] [pid 48601:tid 48665] [client 4.233.64.129:39791] File does not exist: /usr/local/apache/htdocs/suspended-page/sk.php
[Mon Nov 24 21:17:57.222419 2025] [:error] [pid 48601:tid 48677] [client 4.233.64.129:39791] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-crom.php
[Mon Nov 24 21:17:57.468660 2025] [:error] [pid 48601:tid 48663] [client 4.233.64.129:39791] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Mon Nov 24 21:17:57.968547 2025] [:error] [pid 48601:tid 48660] [client 4.233.64.129:39791] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Mon Nov 24 21:17:58.204273 2025] [:error] [pid 48601:tid 48659] [client 4.233.64.129:39791] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aSRbBoMM4MaVTk74-Abg1QAAAgI"]
[Mon Nov 24 21:17:58.719821 2025] [:error] [pid 16441:tid 16448] [client 4.233.64.129:39753] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aSRbBoq_bc5MOa9HflmKJQAAAIQ"]
[Mon Nov 24 21:17:59.242719 2025] [:error] [pid 9630:tid 9643] [client 4.233.64.129:39733] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aSRbByrSgUgPGkizt2oviwAAAEs"]
[Mon Nov 24 21:18:00.135718 2025] [:error] [pid 48688:tid 48716] [client 4.233.64.129:39721] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aSRbCBm2q1FkzLam7A3JygAAAlg"]
[Mon Nov 24 21:18:00.719333 2025] [:error] [pid 16516:tid 16521] [client 4.233.64.129:39105] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSRbCPqZbniwaNwL8XkIWQAAAQI"]
[Mon Nov 24 21:18:01.311411 2025] [:error] [pid 49900:tid 49912] [client 4.233.64.129:39158] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSRbCTCyPLrvg06aorlDGwAAAAo"]
[Mon Nov 24 21:18:01.973385 2025] [:error] [pid 16441:tid 16447] [client 4.233.64.129:63170] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSRbCYq_bc5MOa9HflmKLAAAAIM"]
[Mon Nov 24 21:18:02.541718 2025] [:error] [pid 48601:tid 48672] [client 4.233.64.129:39117] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSRbCoMM4MaVTk74-Abg2QAAAg8"]
[Mon Nov 24 21:18:03.045695 2025] [:error] [pid 48601:tid 48681] [client 4.233.64.129:39809] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbC4MM4MaVTk74-Abg2gAAAhg"]
[Mon Nov 24 21:18:03.628071 2025] [:error] [pid 48601:tid 48661] [client 4.233.64.129:39746] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbC4MM4MaVTk74-Abg3AAAAgQ"]
[Mon Nov 24 21:18:04.282747 2025] [:error] [pid 49900:tid 49923] [client 4.233.64.129:39142] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbDDCyPLrvg06aorlDHAAAABU"]
[Mon Nov 24 21:18:04.810715 2025] [:error] [pid 16441:tid 16444] [client 4.233.64.129:39147] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbDIq_bc5MOa9HflmKLgAAAIA"]
[Mon Nov 24 21:18:05.306293 2025] [:error] [pid 16441:tid 16457] [client 4.233.64.129:39764] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSRbDYq_bc5MOa9HflmKMAAAAI0"]
[Mon Nov 24 21:18:05.797074 2025] [:error] [pid 16549:tid 16558] [client 4.233.64.129:39118] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSRbDaeWW19A99PUw_djdgAAAUY"]
[Mon Nov 24 21:18:06.322624 2025] [:error] [pid 16549:tid 16572] [client 4.233.64.129:39129] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSRbDqeWW19A99PUw_djeAAAAVM"]
[Mon Nov 24 21:18:06.833632 2025] [:error] [pid 48601:tid 48673] [client 4.233.64.129:39785] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aSRbDoMM4MaVTk74-Abg3QAAAhA"]
[Mon Nov 24 21:18:07.397310 2025] [:error] [pid 48688:tid 48712] [client 4.233.64.129:39152] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aSRbDxm2q1FkzLam7A3JzwAAAlQ"]
[Mon Nov 24 21:18:07.907096 2025] [:error] [pid 48601:tid 48671] [client 4.233.64.129:39163] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aSRbD4MM4MaVTk74-Abg3gAAAg4"]
[Mon Nov 24 21:18:08.468804 2025] [:error] [pid 48599:tid 48617] [client 4.233.64.129:39750] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aSRbEJzvu6PDJiRKE3JLjAAAAY4"]
[Mon Nov 24 21:18:08.966808 2025] [:error] [pid 9630:tid 9632] [client 4.233.64.129:39157] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aSRbECrSgUgPGkizt2ovjwAAAEA"]
[Mon Nov 24 21:18:09.665344 2025] [:error] [pid 16441:tid 16453] [client 4.233.64.129:39166] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSRbEYq_bc5MOa9HflmKMgAAAIk"]
[Mon Nov 24 21:18:10.273635 2025] [:error] [pid 48600:tid 48645] [client 4.233.64.129:39161] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSRbEvtOzSUAQvWVjBedjgAAAc8"]
[Mon Nov 24 21:18:10.829929 2025] [:error] [pid 16549:tid 16556] [client 4.233.64.129:39159] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSRbEqeWW19A99PUw_djewAAAUQ"]
[Mon Nov 24 21:18:11.379729 2025] [:error] [pid 49900:tid 49921] [client 4.233.64.129:39703] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSRbEzCyPLrvg06aorlDHwAAABM"]
[Mon Nov 24 21:18:11.967808 2025] [:error] [pid 48601:tid 48657] [client 4.233.64.129:39824] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aSRbE4MM4MaVTk74-Abg3wAAAgA"]
[Mon Nov 24 21:18:12.508044 2025] [:error] [pid 16441:tid 16455] [client 4.233.64.129:39127] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aSRbFIq_bc5MOa9HflmKOAAAAIs"]
[Mon Nov 24 21:18:13.030053 2025] [:error] [pid 16593:tid 16606] [client 4.233.64.129:39146] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aSRbFRVGznHBJI2LKpRn8gAAAos"]
[Mon Nov 24 21:18:13.559597 2025] [:error] [pid 16593:tid 16607] [client 4.233.64.129:39133] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aSRbFRVGznHBJI2LKpRn8wAAAow"]
[Mon Nov 24 21:18:14.068753 2025] [:error] [pid 16441:tid 16466] [client 4.233.64.129:39751] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aSRbFoq_bc5MOa9HflmKOwAAAJY"]
[Mon Nov 24 21:18:14.567308 2025] [:error] [pid 16593:tid 16612] [client 4.233.64.129:39788] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aSRbFhVGznHBJI2LKpRn9AAAApE"]
[Mon Nov 24 21:18:15.114198 2025] [:error] [pid 9630:tid 9648] [client 4.233.64.129:39762] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aSRbFyrSgUgPGkizt2ovmAAAAFA"]
[Mon Nov 24 21:18:15.599404 2025] [:error] [pid 49900:tid 49917] [client 4.233.64.129:39772] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aSRbFzCyPLrvg06aorlDIQAAAA8"]
[Mon Nov 24 21:18:16.202532 2025] [:error] [pid 49900:tid 49920] [client 4.233.64.129:63189] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSRbGDCyPLrvg06aorlDIgAAABI"]
[Mon Nov 24 21:18:16.815479 2025] [:error] [pid 9630:tid 9639] [client 4.233.64.129:39716] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSRbGCrSgUgPGkizt2ovmwAAAEc"]
[Mon Nov 24 21:18:17.384459 2025] [:error] [pid 16441:tid 16448] [client 4.233.64.129:39795] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSRbGYq_bc5MOa9HflmKQQAAAIQ"]
[Mon Nov 24 21:18:17.885939 2025] [:error] [pid 16441:tid 16453] [client 4.233.64.129:39741] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSRbGYq_bc5MOa9HflmKQgAAAIk"]
[Mon Nov 24 21:18:18.455208 2025] [:error] [pid 16441:tid 16446] [client 4.233.64.129:39856] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSRbGoq_bc5MOa9HflmKRQAAAII"]
[Mon Nov 24 21:18:18.954406 2025] [:error] [pid 16593:tid 16596] [client 4.233.64.129:39793] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ll.php"] [unique_id "aSRbGhVGznHBJI2LKpRn9wAAAoE"]
[Mon Nov 24 21:18:19.491829 2025] [:error] [pid 9630:tid 9646] [client 4.233.64.129:39684] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ll.php"] [unique_id "aSRbGyrSgUgPGkizt2ovoAAAAE4"]
[Mon Nov 24 21:18:20.034634 2025] [:error] [pid 48600:tid 48638] [client 4.233.64.129:39109] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ll.php"] [unique_id "aSRbHPtOzSUAQvWVjBedoAAAAcg"]
[Mon Nov 24 21:18:20.568984 2025] [:error] [pid 16593:tid 16618] [client 4.233.64.129:39833] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ll.php"] [unique_id "aSRbHBVGznHBJI2LKpRn-wAAApc"]
[Mon Nov 24 21:18:21.081891 2025] [:error] [pid 16549:tid 16577] [client 4.233.64.129:39155] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSRbHaeWW19A99PUw_djhwAAAVg"]
[Mon Nov 24 21:18:21.607125 2025] [:error] [pid 48600:tid 48642] [client 4.233.64.129:39770] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSRbHftOzSUAQvWVjBedogAAAcw"]
[Mon Nov 24 21:18:22.107748 2025] [:error] [pid 16441:tid 16461] [client 4.233.64.129:39707] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSRbHoq_bc5MOa9HflmKSQAAAJE"]
[Mon Nov 24 21:18:22.679671 2025] [:error] [pid 16593:tid 16608] [client 4.233.64.129:39820] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSRbHhVGznHBJI2LKpRn_wAAAo0"]
[Mon Nov 24 21:18:23.203817 2025] [:error] [pid 16441:tid 16448] [client 4.233.64.129:39871] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSRbH4q_bc5MOa9HflmKUAAAAIQ"]
[Mon Nov 24 21:18:23.699772 2025] [:error] [pid 16441:tid 16451] [client 4.233.64.129:39695] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSRbH4q_bc5MOa9HflmKVwAAAIc"]
[Mon Nov 24 21:18:24.184616 2025] [:error] [pid 16516:tid 16536] [client 4.233.64.129:39797] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSRbIPqZbniwaNwL8XkIYwAAARE"]
[Mon Nov 24 21:18:24.760780 2025] [:error] [pid 16441:tid 16444] [client 4.233.64.129:39130] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSRbIIq_bc5MOa9HflmKYwAAAIA"]
[Mon Nov 24 21:18:25.399100 2025] [:error] [pid 16441:tid 16453] [client 4.233.64.129:39761] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSRbIYq_bc5MOa9HflmKZwAAAIk"]
[Mon Nov 24 21:18:25.909148 2025] [:error] [pid 16593:tid 16600] [client 4.233.64.129:39803] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wi.php"] [unique_id "aSRbIRVGznHBJI2LKpRoFgAAAoU"]
[Mon Nov 24 21:18:26.384453 2025] [:error] [pid 9630:tid 9656] [client 4.233.64.129:39704] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wi.php"] [unique_id "aSRbIirSgUgPGkizt2ovqwAAAFg"]
[Mon Nov 24 21:18:26.889664 2025] [:error] [pid 48599:tid 48624] [client 4.233.64.129:39691] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wi.php"] [unique_id "aSRbIpzvu6PDJiRKE3JLkwAAAZU"]
[Mon Nov 24 21:18:27.395373 2025] [:error] [pid 48599:tid 48619] [client 4.233.64.129:39806] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wi.php"] [unique_id "aSRbI5zvu6PDJiRKE3JLlgAAAZA"]
[Mon Nov 24 21:18:27.919701 2025] [:error] [pid 48688:tid 48707] [client 4.233.64.129:39706] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mms.php"] [unique_id "aSRbIxm2q1FkzLam7A3J1wAAAk8"]
[Mon Nov 24 21:18:28.406489 2025] [:error] [pid 48601:tid 48666] [client 4.233.64.129:39684] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mms.php"] [unique_id "aSRbJIMM4MaVTk74-Abg6gAAAgk"]
[Mon Nov 24 21:18:28.922606 2025] [:error] [pid 16441:tid 16455] [client 4.233.64.129:39802] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mms.php"] [unique_id "aSRbJIq_bc5MOa9HflmKaQAAAIs"]
[Mon Nov 24 21:18:29.493023 2025] [:error] [pid 48601:tid 48681] [client 4.233.64.129:39687] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mms.php"] [unique_id "aSRbJYMM4MaVTk74-Abg6wAAAhg"]
[Mon Nov 24 21:18:30.007274 2025] [:error] [pid 16549:tid 16558] [client 4.233.64.129:39830] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSRbJqeWW19A99PUw_djjwAAAUY"]
[Mon Nov 24 21:18:30.613232 2025] [:error] [pid 48599:tid 48606] [client 4.233.64.129:39709] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSRbJpzvu6PDJiRKE3JLmwAAAYM"]
[Mon Nov 24 21:18:31.157028 2025] [:error] [pid 49900:tid 49908] [client 4.233.64.129:39113] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSRbJzCyPLrvg06aorlDLwAAAAY"]
[Mon Nov 24 21:18:31.677840 2025] [:error] [pid 16516:tid 16534] [client 4.233.64.129:39712] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSRbJ_qZbniwaNwL8XkIZQAAAQ8"]
[Mon Nov 24 21:18:32.302963 2025] [:error] [pid 16549:tid 16564] [client 4.233.64.129:39114] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSRbKKeWW19A99PUw_djkAAAAUw"]
[Mon Nov 24 21:18:32.880311 2025] [:error] [pid 48688:tid 48699] [client 4.233.64.129:39861] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aSRbKBm2q1FkzLam7A3J2gAAAkc"]
[Mon Nov 24 21:18:33.511308 2025] [:error] [pid 49900:tid 49924] [client 4.233.64.129:39740] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aSRbKTCyPLrvg06aorlDMQAAABY"]
[Mon Nov 24 21:18:34.052793 2025] [:error] [pid 16516:tid 16533] [client 4.233.64.129:39789] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aSRbKvqZbniwaNwL8XkIaAAAAQ4"]
[Mon Nov 24 21:18:34.602326 2025] [:error] [pid 16441:tid 16445] [client 4.233.64.129:39855] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aSRbKoq_bc5MOa9HflmKbQAAAIE"]
[Mon Nov 24 21:18:35.127987 2025] [:error] [pid 48688:tid 48694] [client 4.233.64.129:39106] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aSRbKxm2q1FkzLam7A3J3QAAAkI"]
[Mon Nov 24 21:18:35.677369 2025] [:error] [pid 16441:tid 16448] [client 4.233.64.129:39683] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aSRbK4q_bc5MOa9HflmKcAAAAIQ"]
[Mon Nov 24 21:18:36.150826 2025] [:error] [pid 16516:tid 16522] [client 4.233.64.129:39811] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aSRbLPqZbniwaNwL8XkIagAAAQM"]
[Mon Nov 24 21:18:36.703227 2025] [:error] [pid 9630:tid 9648] [client 4.233.64.129:39794] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aSRbLCrSgUgPGkizt2ovtQAAAFA"]
[Mon Nov 24 21:18:37.204674 2025] [:error] [pid 48688:tid 48701] [client 4.233.64.129:39689] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSRbLRm2q1FkzLam7A3J4gAAAkk"]
[Mon Nov 24 21:18:37.736370 2025] [:error] [pid 9630:tid 9637] [client 4.233.64.129:39767] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSRbLSrSgUgPGkizt2ovtgAAAEU"]
[Mon Nov 24 21:18:38.290628 2025] [:error] [pid 16549:tid 16553] [client 4.233.64.129:63225] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSRbLqeWW19A99PUw_djkgAAAUE"]
[Mon Nov 24 21:18:38.811971 2025] [:error] [pid 49900:tid 49925] [client 4.233.64.129:39700] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSRbLjCyPLrvg06aorlDNAAAABc"]
[Mon Nov 24 21:18:39.367430 2025] [:error] [pid 48599:tid 48605] [client 4.233.64.129:39779] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbL5zvu6PDJiRKE3JLowAAAYI"]
[Mon Nov 24 21:18:39.867154 2025] [:error] [pid 16441:tid 16452] [client 4.233.64.129:39800] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbL4q_bc5MOa9HflmKcQAAAIg"]
[Mon Nov 24 21:18:40.396878 2025] [:error] [pid 48688:tid 48696] [client 4.233.64.129:39714] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbMBm2q1FkzLam7A3J5gAAAkQ"]
[Mon Nov 24 21:18:40.901615 2025] [:error] [pid 48599:tid 48617] [client 4.233.64.129:39799] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSRbMJzvu6PDJiRKE3JLpQAAAY4"]
[Mon Nov 24 21:18:41.445511 2025] [:error] [pid 48688:tid 48697] [client 4.233.64.129:39727] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSRbMRm2q1FkzLam7A3J5wAAAkU"]
[Mon Nov 24 21:18:41.959921 2025] [:error] [pid 48601:tid 48665] [client 4.233.64.129:39717] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/po.php"] [unique_id "aSRbMYMM4MaVTk74-Abg7wAAAgg"]
[Mon Nov 24 21:18:42.488763 2025] [:error] [pid 48601:tid 48677] [client 4.233.64.129:39737] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/po.php"] [unique_id "aSRbMoMM4MaVTk74-Abg8QAAAhQ"]
[Mon Nov 24 21:18:43.019459 2025] [:error] [pid 48600:tid 48641] [client 4.233.64.129:39688] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/po.php"] [unique_id "aSRbM_tOzSUAQvWVjBedswAAAcs"]
[Mon Nov 24 21:18:43.525011 2025] [:error] [pid 48600:tid 48649] [client 4.233.64.129:39728] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/po.php"] [unique_id "aSRbM_tOzSUAQvWVjBedtAAAAdM"]
[Mon Nov 24 21:18:44.027616 2025] [:error] [pid 48688:tid 48694] [client 4.233.64.129:39826] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zews.php"] [unique_id "aSRbNBm2q1FkzLam7A3J6gAAAkI"]
[Mon Nov 24 21:18:44.538814 2025] [:error] [pid 49900:tid 49912] [client 4.233.64.129:39853] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zews.php"] [unique_id "aSRbNDCyPLrvg06aorlDOQAAAAo"]
[Mon Nov 24 21:18:45.042781 2025] [:error] [pid 16549:tid 16561] [client 4.233.64.129:39125] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zews.php"] [unique_id "aSRbNaeWW19A99PUw_djkwAAAUk"]
[Mon Nov 24 21:18:45.600071 2025] [:error] [pid 16441:tid 16455] [client 4.233.64.129:39111] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zews.php"] [unique_id "aSRbNYq_bc5MOa9HflmKdwAAAIs"]
[Mon Nov 24 21:18:46.124090 2025] [:error] [pid 16593:tid 16614] [client 4.233.64.129:39162] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSRbNhVGznHBJI2LKpRoGQAAApM"]
[Mon Nov 24 21:18:46.637647 2025] [:error] [pid 49900:tid 49906] [client 4.233.64.129:39697] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSRbNjCyPLrvg06aorlDOwAAAAQ"]
[Mon Nov 24 21:18:47.148122 2025] [:error] [pid 16516:tid 16519] [client 4.233.64.129:39837] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSRbN_qZbniwaNwL8XkIdQAAAQA"]
[Mon Nov 24 21:18:47.702627 2025] [:error] [pid 48601:tid 48663] [client 4.233.64.129:39842] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSRbN4MM4MaVTk74-Abg8gAAAgY"]
[Mon Nov 24 21:18:48.216511 2025] [:error] [pid 9630:tid 9633] [client 4.233.64.129:39708] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usage-file.php"] [unique_id "aSRbOCrSgUgPGkizt2ovxQAAAEE"]
[Mon Nov 24 21:18:48.752497 2025] [:error] [pid 49900:tid 49917] [client 4.233.64.129:39734] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usage-file.php"] [unique_id "aSRbODCyPLrvg06aorlDPQAAAA8"]
[Mon Nov 24 21:18:49.292693 2025] [:error] [pid 48688:tid 48702] [client 4.233.64.129:39813] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usage-file.php"] [unique_id "aSRbORm2q1FkzLam7A3J9wAAAko"]
[Mon Nov 24 21:18:49.831484 2025] [:error] [pid 16441:tid 16464] [client 4.233.64.129:39823] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usage-file.php"] [unique_id "aSRbOYq_bc5MOa9HflmKnwAAAJQ"]
[Mon Nov 24 21:18:50.374341 2025] [:error] [pid 48599:tid 48617] [client 4.233.64.129:39798] [client 4.233.64.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/js/wp-config.php"] [unique_id "aSRbOpzvu6PDJiRKE3JLvAAAAY4"]
[Mon Nov 24 21:18:50.866775 2025] [:error] [pid 16441:tid 16446] [client 4.233.64.129:39150] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Js.php"] [unique_id "aSRbOoq_bc5MOa9HflmKoAAAAII"]
[Mon Nov 24 21:18:51.429018 2025] [:error] [pid 16593:tid 16618] [client 4.233.64.129:39722] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Js.php"] [unique_id "aSRbOxVGznHBJI2LKpRoGgAAApc"]
[Mon Nov 24 21:18:51.930016 2025] [:error] [pid 16441:tid 16449] [client 4.233.64.129:39865] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Js.php"] [unique_id "aSRbO4q_bc5MOa9HflmKoQAAAIU"]
[Mon Nov 24 21:18:52.445335 2025] [:error] [pid 48688:tid 48694] [client 4.233.64.129:39732] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Js.php"] [unique_id "aSRbPBm2q1FkzLam7A3J_AAAAkI"]
[Mon Nov 24 21:18:52.946019 2025] [:error] [pid 16441:tid 16459] [client 4.233.64.129:39711] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aSRbPIq_bc5MOa9HflmKpAAAAI8"]
[Mon Nov 24 21:18:53.441509 2025] [:error] [pid 48601:tid 48659] [client 4.233.64.129:39702] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aSRbPYMM4MaVTk74-Abg9AAAAgI"]
[Mon Nov 24 21:18:53.962453 2025] [:error] [pid 48688:tid 48695] [client 4.233.64.129:39812] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aSRbPRm2q1FkzLam7A3J_wAAAkM"]
[Mon Nov 24 21:18:54.493749 2025] [:error] [pid 48688:tid 48708] [client 4.233.64.129:63185] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aSRbPhm2q1FkzLam7A3KAAAAAlA"]
[Mon Nov 24 21:18:54.981828 2025] [:error] [pid 16441:tid 16452] [client 4.233.64.129:39840] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSRbPoq_bc5MOa9HflmKqgAAAIg"]
[Mon Nov 24 21:18:55.479441 2025] [:error] [pid 16593:tid 16609] [client 4.233.64.129:39850] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSRbPxVGznHBJI2LKpRoHQAAAo4"]
[Mon Nov 24 21:18:55.984885 2025] [:error] [pid 16549:tid 16557] [client 4.233.64.129:39822] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSRbP6eWW19A99PUw_djlgAAAUU"]
[Mon Nov 24 21:18:56.485059 2025] [:error] [pid 16549:tid 16560] [client 4.233.64.129:39128] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSRbQKeWW19A99PUw_djmAAAAUg"]
[Mon Nov 24 21:18:56.989621 2025] [:error] [pid 48600:tid 48637] [client 4.233.64.129:39821] [client 4.233.64.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aSRbQPtOzSUAQvWVjBedtwAAAcc"]
[Mon Nov 24 21:18:57.499813 2025] [:error] [pid 48601:tid 48658] [client 4.233.64.129:39705] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Mon Nov 24 21:18:57.745016 2025] [:error] [pid 48601:tid 48676] [client 4.233.64.129:39705] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Mon Nov 24 21:18:57.998671 2025] [:error] [pid 48601:tid 48666] [client 4.233.64.129:39705] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Mon Nov 24 21:45:40.303653 2025] [:error] [pid 16593:tid 16595] [client 193.32.126.212:56517] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSRhhBVGznHBJI2LKpRsDwAAAoA"]
[Mon Nov 24 21:45:40.795575 2025] [:error] [pid 48688:tid 48712] [client 193.32.126.212:56945] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSRhhBm2q1FkzLam7A3P5QAAAlQ"]
[Mon Nov 24 21:45:41.288466 2025] [:error] [pid 9630:tid 9642] [client 193.32.126.212:57296] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aSRhhSrSgUgPGkizt2o4RAAAAEo"]
[Mon Nov 24 22:30:21.406326 2025] [:error] [pid 48599:tid 48605] [client 180.190.209.28:9615] [client 180.190.209.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.190.209.28, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRr_Zzvu6PDJiRKE3JZBwAAAYI"]
[Mon Nov 24 22:30:21.414940 2025] [:error] [pid 48599:tid 48605] [client 180.190.209.28:9615] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Nov 25 03:18:21.355021 2025] [:error] [pid 48601:tid 48667] [client 45.89.242.56:64499] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Nov 25 03:18:22.258441 2025] [:error] [pid 48601:tid 48663] [client 45.89.242.56:64499] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Nov 25 03:18:22.716192 2025] [:error] [pid 48601:tid 48658] [client 45.89.242.56:64499] [client 45.89.242.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSSvfoMM4MaVTk74-AYnUQAAAgE"]
[Tue Nov 25 03:18:23.694665 2025] [:error] [pid 49900:tid 49918] [client 185.192.69.243:39525] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Nov 25 03:18:24.808973 2025] [:error] [pid 49900:tid 49923] [client 185.192.69.243:39525] [client 185.192.69.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSSvgDCyPLrvg06aormQswAAABU"]
[Tue Nov 25 03:18:25.807048 2025] [:error] [pid 9630:tid 9645] [client 185.192.69.253:24681] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Nov 25 03:18:27.311321 2025] [:error] [pid 9630:tid 9636] [client 185.192.69.253:24681] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Nov 25 03:18:27.783347 2025] [:error] [pid 9630:tid 9643] [client 185.192.69.253:24681] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Nov 25 03:18:28.234831 2025] [:error] [pid 9630:tid 9633] [client 185.192.69.253:24681] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Nov 25 03:18:29.667527 2025] [:error] [pid 9630:tid 9654] [client 185.192.69.253:24681] [client 185.192.69.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSSvhSrSgUgPGkizt2qJUgAAAFY"]
[Tue Nov 25 03:18:30.580202 2025] [:error] [pid 49900:tid 49915] [client 185.192.69.238:38201] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Nov 25 03:18:31.013469 2025] [:error] [pid 49900:tid 49910] [client 185.192.69.238:38201] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Nov 25 03:18:31.444422 2025] [:error] [pid 49900:tid 49921] [client 185.192.69.238:38201] [client 185.192.69.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSSvhzCyPLrvg06aormQuAAAABM"]
[Tue Nov 25 03:18:34.625275 2025] [:error] [pid 48599:tid 48617] [client 185.192.69.218:20881] [client 185.192.69.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSSvipzvu6PDJiRKE3KIkwAAAY4"]
[Tue Nov 25 03:18:35.559529 2025] [:error] [pid 48688:tid 48709] [client 185.192.69.240:52739] [client 185.192.69.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSSvixm2q1FkzLam7A0KXQAAAlE"]
[Tue Nov 25 03:18:36.925336 2025] [:error] [pid 48600:tid 48639] [client 185.192.69.217:47207] [client 185.192.69.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSSvjPtOzSUAQvWVjBfO4QAAAck"]
[Tue Nov 25 03:18:38.687330 2025] [:error] [pid 16441:tid 16463] [client 185.192.69.219:50737] [client 185.192.69.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSSvjoq_bc5MOa9Hfln_7wAAAJM"]
[Tue Nov 25 03:18:40.491635 2025] [:error] [pid 16593:tid 16602] [client 185.192.69.225:40211] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Nov 25 03:18:42.497123 2025] [:error] [pid 16593:tid 16604] [client 185.192.69.225:40211] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Nov 25 03:18:42.956374 2025] [:error] [pid 16593:tid 16600] [client 185.192.69.225:40211] [client 185.192.69.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSSvkhVGznHBJI2LKpSeZAAAAoU"]
[Tue Nov 25 03:18:44.095331 2025] [:error] [pid 16441:tid 16445] [client 185.192.69.223:23671] [client 185.192.69.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSSvlIq_bc5MOa9Hfln_8gAAAIE"]
[Tue Nov 25 03:18:45.457314 2025] [:error] [pid 16441:tid 16461] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Tue Nov 25 03:18:46.499075 2025] [:error] [pid 16441:tid 16446] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Tue Nov 25 03:18:51.039844 2025] [:error] [pid 16441:tid 16459] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Nov 25 03:18:51.493066 2025] [:error] [pid 16441:tid 16449] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Nov 25 03:18:51.982009 2025] [:error] [pid 16441:tid 16452] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Tue Nov 25 03:18:52.424321 2025] [:error] [pid 16441:tid 16462] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Tue Nov 25 03:18:52.879043 2025] [:error] [pid 16441:tid 16454] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Tue Nov 25 03:18:53.339956 2025] [:error] [pid 16441:tid 16451] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Nov 25 03:18:53.789230 2025] [:error] [pid 16441:tid 16453] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Tue Nov 25 03:18:54.719863 2025] [:error] [pid 16441:tid 16466] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Nov 25 03:18:55.186149 2025] [:error] [pid 16441:tid 16458] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Tue Nov 25 03:18:55.641287 2025] [:error] [pid 16441:tid 16444] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Nov 25 03:18:56.089671 2025] [:error] [pid 16441:tid 16463] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Nov 25 03:18:56.546321 2025] [:error] [pid 16441:tid 16468] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Tue Nov 25 03:18:57.468411 2025] [:error] [pid 16441:tid 16450] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Tue Nov 25 03:18:57.913147 2025] [:error] [pid 16441:tid 16447] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Nov 25 03:18:58.376181 2025] [:error] [pid 16441:tid 16467] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Tue Nov 25 03:18:58.834163 2025] [:error] [pid 16441:tid 16457] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue Nov 25 03:18:59.330214 2025] [:error] [pid 16441:tid 16445] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Tue Nov 25 03:18:59.804008 2025] [:error] [pid 16441:tid 16460] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue Nov 25 03:19:00.302368 2025] [:error] [pid 16441:tid 16455] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Tue Nov 25 03:19:00.856073 2025] [:error] [pid 16441:tid 16464] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Nov 25 03:19:01.304673 2025] [:error] [pid 16441:tid 16446] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Nov 25 03:19:01.796057 2025] [:error] [pid 16441:tid 16459] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Nov 25 03:19:02.293047 2025] [:error] [pid 16441:tid 16449] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Tue Nov 25 03:19:03.668039 2025] [:error] [pid 16441:tid 16452] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Nov 25 03:19:04.772047 2025] [:error] [pid 16441:tid 16454] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Nov 25 03:19:05.230173 2025] [:error] [pid 16441:tid 16466] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Tue Nov 25 03:19:05.682833 2025] [:error] [pid 16441:tid 16458] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Tue Nov 25 03:19:06.295101 2025] [:error] [pid 16441:tid 16444] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Nov 25 03:19:06.755938 2025] [:error] [pid 16441:tid 16463] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Tue Nov 25 03:19:07.200475 2025] [:error] [pid 16441:tid 16465] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Tue Nov 25 03:19:07.752211 2025] [:error] [pid 16441:tid 16448] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Nov 25 03:19:08.199837 2025] [:error] [pid 16441:tid 16468] [client 185.192.69.212:45255] [client 185.192.69.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.69.212, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSSvrIq_bc5MOa9HflkAGAAAAJg"]
[Tue Nov 25 03:19:08.203510 2025] [:error] [pid 16441:tid 16468] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Nov 25 03:19:09.056426 2025] [:error] [pid 16441:tid 16447] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Tue Nov 25 03:19:09.516616 2025] [:error] [pid 16441:tid 16467] [client 185.192.69.212:45255] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue Nov 25 03:19:09.995878 2025] [:error] [pid 16441:tid 16457] [client 185.192.69.212:45255] [client 185.192.69.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aSSvrYq_bc5MOa9HflkAHAAAAI0"]
[Tue Nov 25 03:19:10.903837 2025] [:error] [pid 49900:tid 49906] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Tue Nov 25 03:19:11.328018 2025] [:error] [pid 49900:tid 49925] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Nov 25 03:19:12.228432 2025] [:error] [pid 49900:tid 49902] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Tue Nov 25 03:19:12.655064 2025] [:error] [pid 49900:tid 49913] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Tue Nov 25 03:19:13.114325 2025] [:error] [pid 49900:tid 49919] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Tue Nov 25 03:19:13.574645 2025] [:error] [pid 49900:tid 49918] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue Nov 25 03:19:14.026200 2025] [:error] [pid 49900:tid 49923] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Tue Nov 25 03:19:14.491534 2025] [:error] [pid 49900:tid 49909] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Tue Nov 25 03:19:14.928196 2025] [:error] [pid 49900:tid 49924] [client 45.89.242.53:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Tue Nov 25 03:19:15.854337 2025] [:error] [pid 49900:tid 49911] [client 45.89.242.53:60163] [client 45.89.242.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aSSvszCyPLrvg06aormQ5wAAAAk"]
[Tue Nov 25 03:19:16.804455 2025] [:error] [pid 49900:tid 49905] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Tue Nov 25 03:19:17.992145 2025] [:error] [pid 49900:tid 49912] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Tue Nov 25 03:19:21.825911 2025] [:error] [pid 49900:tid 49903] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Nov 25 03:19:22.328138 2025] [:error] [pid 49900:tid 49913] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Tue Nov 25 03:19:22.783207 2025] [:error] [pid 49900:tid 49914] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Tue Nov 25 03:19:23.349069 2025] [:error] [pid 49900:tid 49918] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Tue Nov 25 03:19:23.812445 2025] [:error] [pid 49900:tid 49923] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Tue Nov 25 03:19:26.078162 2025] [:error] [pid 49900:tid 49924] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Tue Nov 25 03:19:26.506920 2025] [:error] [pid 49900:tid 49911] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Tue Nov 25 03:19:26.964013 2025] [:error] [pid 49900:tid 49910] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Tue Nov 25 03:19:27.400563 2025] [:error] [pid 49900:tid 49905] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Tue Nov 25 03:19:27.848431 2025] [:error] [pid 49900:tid 49916] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Tue Nov 25 03:19:28.316446 2025] [:error] [pid 49900:tid 49926] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Tue Nov 25 03:19:28.797834 2025] [:error] [pid 49900:tid 49920] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Tue Nov 25 03:19:30.193820 2025] [:error] [pid 49900:tid 49908] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Tue Nov 25 03:19:31.048148 2025] [:error] [pid 49900:tid 49907] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Tue Nov 25 03:19:31.928845 2025] [:error] [pid 49900:tid 49917] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Tue Nov 25 03:19:32.383489 2025] [:error] [pid 49900:tid 49925] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Tue Nov 25 03:19:32.836590 2025] [:error] [pid 49900:tid 49903] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Tue Nov 25 03:19:33.744721 2025] [:error] [pid 49900:tid 49913] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Nov 25 03:19:34.200108 2025] [:error] [pid 49900:tid 49914] [client 45.89.242.58:44875] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Tue Nov 25 03:19:34.677561 2025] [:error] [pid 49900:tid 49919] [client 45.89.242.58:44875] [client 45.89.242.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/lx.php"] [unique_id "aSSvxjCyPLrvg06aormRCAAAABE"]
[Tue Nov 25 03:19:36.534189 2025] [:error] [pid 16441:tid 16451] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Tue Nov 25 03:19:36.971351 2025] [:error] [pid 16441:tid 16453] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Tue Nov 25 03:19:37.431228 2025] [:error] [pid 16441:tid 16466] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Tue Nov 25 03:19:38.203067 2025] [:error] [pid 16441:tid 16466] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Tue Nov 25 03:19:38.648936 2025] [:error] [pid 16441:tid 16468] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Tue Nov 25 03:19:39.108789 2025] [:error] [pid 16441:tid 16465] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Tue Nov 25 03:19:39.571813 2025] [:error] [pid 16441:tid 16467] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Tue Nov 25 03:19:40.028380 2025] [:error] [pid 16441:tid 16457] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Tue Nov 25 03:19:40.473446 2025] [:error] [pid 16441:tid 16460] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Tue Nov 25 03:19:40.939350 2025] [:error] [pid 16441:tid 16456] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Tue Nov 25 03:19:41.395184 2025] [:error] [pid 16441:tid 16464] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Nov 25 03:19:41.892205 2025] [:error] [pid 16441:tid 16446] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Tue Nov 25 03:19:42.783811 2025] [:error] [pid 16441:tid 16454] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Tue Nov 25 03:19:43.248422 2025] [:error] [pid 16441:tid 16459] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Tue Nov 25 03:19:45.446977 2025] [:error] [pid 16441:tid 16449] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Tue Nov 25 03:19:45.894537 2025] [:error] [pid 16441:tid 16458] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Tue Nov 25 03:19:46.352515 2025] [:error] [pid 16441:tid 16466] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Tue Nov 25 03:19:47.259191 2025] [:error] [pid 16441:tid 16444] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Tue Nov 25 03:19:47.717213 2025] [:error] [pid 16441:tid 16463] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Tue Nov 25 03:19:48.173435 2025] [:error] [pid 16441:tid 16448] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Tue Nov 25 03:19:49.073051 2025] [:error] [pid 16441:tid 16468] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Tue Nov 25 03:19:49.799333 2025] [:error] [pid 16441:tid 16450] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Nov 25 03:19:50.729925 2025] [:error] [pid 16441:tid 16465] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Tue Nov 25 03:19:51.165636 2025] [:error] [pid 16441:tid 16447] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Tue Nov 25 03:19:51.645787 2025] [:error] [pid 16441:tid 16457] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Tue Nov 25 03:19:52.142591 2025] [:error] [pid 16441:tid 16445] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Nov 25 03:19:52.575908 2025] [:error] [pid 16441:tid 16460] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Tue Nov 25 03:19:53.035748 2025] [:error] [pid 16441:tid 16456] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Nov 25 03:19:53.916865 2025] [:error] [pid 16441:tid 16461] [client 185.192.69.224:48593] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Tue Nov 25 03:20:06.802095 2025] [:error] [pid 16441:tid 16449] [client 185.192.69.224:48593] [client 185.192.69.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aSSv5oq_bc5MOa9HflkAdQAAAIU"]
[Tue Nov 25 03:20:09.793248 2025] [:error] [pid 49900:tid 49921] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Tue Nov 25 03:20:16.463788 2025] [:error] [pid 49900:tid 49918] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Tue Nov 25 03:20:16.974680 2025] [:error] [pid 49900:tid 49923] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Tue Nov 25 03:20:17.429146 2025] [:error] [pid 49900:tid 49902] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Tue Nov 25 03:20:19.317696 2025] [:error] [pid 49900:tid 49911] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Tue Nov 25 03:20:22.600671 2025] [:error] [pid 49900:tid 49926] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Tue Nov 25 03:20:23.160715 2025] [:error] [pid 49900:tid 49912] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Tue Nov 25 03:20:23.623455 2025] [:error] [pid 49900:tid 49907] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Nov 25 03:20:24.073601 2025] [:error] [pid 49900:tid 49917] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Nov 25 03:20:24.256263 2025] [:error] [pid 9630:tid 9645] [client 85.237.194.161:41127] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Nov 25 03:20:24.553077 2025] [:error] [pid 49900:tid 49913] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Tue Nov 25 03:20:25.480931 2025] [:error] [pid 49900:tid 49914] [client 45.89.242.52:53457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Tue Nov 25 03:20:25.482808 2025] [:error] [pid 9630:tid 9652] [client 85.237.194.161:41127] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Nov 25 03:20:26.183338 2025] [:error] [pid 9630:tid 9635] [client 85.237.194.161:41127] [client 85.237.194.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSSv-irSgUgPGkizt2qJnQAAAEM"]
[Tue Nov 25 03:20:26.376881 2025] [:error] [pid 49900:tid 49918] [client 45.89.242.52:53457] [client 45.89.242.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSSv-jCyPLrvg06aormRQQAAABA"]
[Tue Nov 25 03:20:27.288071 2025] [:error] [pid 16549:tid 16569] [client 185.192.69.242:42995] [client 185.192.69.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.192.69.242, incrementing ddos counter"] [hostname "www.aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSv-6eWW19A99PUw_eY4AAAAVE"]
[Tue Nov 25 03:20:27.291210 2025] [:error] [pid 16549:tid 16569] [client 185.192.69.242:42995] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Nov 25 03:20:27.566416 2025] [:error] [pid 16516:tid 16530] [client 181.215.65.88:45833] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Nov 25 03:20:27.751733 2025] [:error] [pid 16549:tid 16576] [client 185.192.69.242:42995] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Nov 25 03:20:28.281513 2025] [:error] [pid 16516:tid 16540] [client 181.215.65.88:45833] [client 181.215.65.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSSv_PqZbniwaNwL8Xk9RQAAARU"]
[Tue Nov 25 03:20:29.567049 2025] [:error] [pid 9630:tid 9655] [client 104.234.32.27:59893] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Nov 25 03:20:29.945670 2025] [:error] [pid 16549:tid 16557] [client 185.192.69.242:42995] [client 185.192.69.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSSv_aeWW19A99PUw_eY5QAAAUU"]
[Tue Nov 25 03:20:30.966824 2025] [:error] [pid 9630:tid 9643] [client 104.234.32.27:59893] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Nov 25 03:20:31.680396 2025] [:error] [pid 9630:tid 9632] [client 104.234.32.27:59893] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Nov 25 03:20:32.499280 2025] [:error] [pid 16441:tid 16467] [client 185.192.69.249:46873] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Tue Nov 25 03:20:34.777921 2025] [:error] [pid 9630:tid 9650] [client 104.234.32.27:59893] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Nov 25 03:20:37.352756 2025] [:error] [pid 16441:tid 16456] [client 185.192.69.249:46873] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Nov 25 11:19:40.852073 2025] [:error] [pid 14078:tid 14139] [client 54.173.250.15:37520] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSUgTNVXYbb0ii_rVoKsfQAAAII"]
[Tue Nov 25 13:27:52.509206 2025] [:error] [pid 28836:tid 28957] [client 3.22.171.195:57294] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aSU-WJwNRsoxcLQGkTdpfAAAAsI"]
[Tue Nov 25 13:27:53.296172 2025] [:error] [pid 14168:tid 14193] [client 3.22.171.195:57296] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aSU-WfR-ZDU0QEgAIIsJgQAAANY"]
[Tue Nov 25 13:27:54.085660 2025] [:error] [pid 14077:tid 14120] [client 3.22.171.195:53716] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev"] [unique_id "aSU-WhG9n7UHEkwDTyjrQgAAAEo"]
[Tue Nov 25 13:27:54.877045 2025] [:error] [pid 28842:tid 29018] [client 3.22.171.195:53726] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.prod"] [unique_id "aSU-WtNmoaPf6T4-6C0bEQAAA1E"]
[Tue Nov 25 13:27:55.667250 2025] [:error] [pid 28740:tid 28813] [client 3.22.171.195:53728] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aSU-W1ppQCoYxWW6V0UbZQAAAlY"]
[Tue Nov 25 13:27:56.455582 2025] [:error] [pid 14077:tid 14111] [client 3.22.171.195:53732] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aSU-XBG9n7UHEkwDTyjrRwAAAEE"]
[Tue Nov 25 13:27:57.240381 2025] [:error] [pid 14688:tid 14693] [client 3.22.171.195:53742] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aSU-XW9vYrBoEsiDnixlIQAAAQM"]
[Tue Nov 25 13:27:58.027412 2025] [:error] [pid 28842:tid 29020] [client 3.22.171.195:53748] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "aSU-XtNmoaPf6T4-6C0bFAAAA1I"]
[Tue Nov 25 13:27:58.817414 2025] [:error] [pid 28740:tid 28797] [client 3.22.171.195:53750] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aSU-XlppQCoYxWW6V0UbagAAAkY"]
[Tue Nov 25 13:27:59.603620 2025] [:error] [pid 28739:tid 28781] [client 3.22.171.195:53758] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env~"] [unique_id "aSU-XxxGpKmlkG4FexQpagAAAhM"]
[Tue Nov 25 13:28:00.389315 2025] [:error] [pid 28836:tid 28961] [client 3.22.171.195:53762] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.sample"] [unique_id "aSU-YJwNRsoxcLQGkTdphgAAAsY"]
[Tue Nov 25 13:28:01.173700 2025] [:error] [pid 14168:tid 14189] [client 3.22.171.195:53770] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aSU-YfR-ZDU0QEgAIIsJhwAAANI"]
[Tue Nov 25 13:28:01.960356 2025] [:error] [pid 14076:tid 14089] [client 3.22.171.195:53774] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aSU-YXsB4Gz6Qw-pvBupqAAAAAg"]
[Tue Nov 25 13:28:02.747363 2025] [:error] [pid 14168:tid 14187] [client 3.22.171.195:53786] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aSU-YvR-ZDU0QEgAIIsJiwAAANA"]
[Tue Nov 25 13:28:03.531861 2025] [:error] [pid 14077:tid 14131] [client 3.22.171.195:53792] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.orig"] [unique_id "aSU-YxG9n7UHEkwDTyjrSwAAAFU"]
[Tue Nov 25 13:28:04.315152 2025] [:error] [pid 28842:tid 28997] [client 3.22.171.195:60096] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.swp"] [unique_id "aSU-ZNNmoaPf6T4-6C0bHQAAA0c"]
[Tue Nov 25 13:28:05.128279 2025] [:error] [pid 14688:tid 14701] [client 3.22.171.195:60098] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.tmp"] [unique_id "aSU-ZW9vYrBoEsiDnixlLwAAAQs"]
[Tue Nov 25 13:28:05.931515 2025] [:error] [pid 14078:tid 14137] [client 3.22.171.195:60114] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dist"] [unique_id "aSU-ZdVXYbb0ii_rVoLckgAAAIA"]
[Tue Nov 25 13:28:06.747372 2025] [:error] [pid 28739:tid 28777] [client 3.22.171.195:60118] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env"] [unique_id "aSU-ZhxGpKmlkG4FexQpbwAAAg8"]
[Tue Nov 25 13:28:07.546933 2025] [:error] [pid 28836:tid 28960] [client 3.22.171.195:60134] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.save"] [unique_id "aSU-Z5wNRsoxcLQGkTdpjgAAAsU"]
[Tue Nov 25 13:28:08.347371 2025] [:error] [pid 28740:tid 28796] [client 3.22.171.195:60146] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.bak"] [unique_id "aSU-aFppQCoYxWW6V0UbdAAAAkU"]
[Tue Nov 25 13:28:09.137321 2025] [:error] [pid 28836:tid 29011] [client 3.22.171.195:60154] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env.old"] [unique_id "aSU-aZwNRsoxcLQGkTdplAAAAtU"]
[Tue Nov 25 13:28:09.937838 2025] [:error] [pid 14076:tid 14091] [client 3.22.171.195:60170] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "aSU-aXsB4Gz6Qw-pvBupwgAAAAo"]
[Tue Nov 25 13:28:10.723117 2025] [:error] [pid 28836:tid 28961] [client 3.22.171.195:60176] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.save"] [unique_id "aSU-apwNRsoxcLQGkTdpmwAAAsY"]
[Tue Nov 25 13:28:11.507733 2025] [:error] [pid 14168:tid 14177] [client 3.22.171.195:60188] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.bak"] [unique_id "aSU-a_R-ZDU0QEgAIIsJogAAAMY"]
[Tue Nov 25 13:28:12.292404 2025] [:error] [pid 14168:tid 14183] [client 3.22.171.195:60204] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env.old"] [unique_id "aSU-bPR-ZDU0QEgAIIsJpAAAAMw"]
[Tue Nov 25 13:28:13.076217 2025] [:error] [pid 28842:tid 28992] [client 3.22.171.195:60206] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "aSU-bdNmoaPf6T4-6C0bLwAAA0I"]
[Tue Nov 25 13:28:13.863347 2025] [:error] [pid 28609:tid 28627] [client 3.22.171.195:60214] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.save"] [unique_id "aSU-bSGGdT-nZJVs3x1wCQAAAYk"]
[Tue Nov 25 13:28:14.647729 2025] [:error] [pid 14168:tid 14194] [client 3.22.171.195:38670] [client 3.22.171.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env.bak"] [unique_id "aSU-bvR-ZDU0QEgAIIsJpwAAANc"]
[Tue Nov 25 13:36:04.957331 2025] [:error] [pid 28842:tid 28999] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/acxx.php
[Tue Nov 25 13:36:05.213639 2025] [:error] [pid 28842:tid 29002] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Tue Nov 25 13:36:05.467247 2025] [:error] [pid 28842:tid 29003] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Tue Nov 25 13:36:05.720951 2025] [:error] [pid 28842:tid 28992] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/c4.php
[Tue Nov 25 13:36:05.977063 2025] [:error] [pid 28842:tid 29004] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/wsx.php
[Tue Nov 25 13:36:06.232400 2025] [:error] [pid 28842:tid 29005] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/b4.php
[Tue Nov 25 13:36:06.488130 2025] [:error] [pid 28842:tid 28997] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/xenium4.php
[Tue Nov 25 13:36:06.742400 2025] [:error] [pid 28842:tid 29023] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/xpw.php
[Tue Nov 25 13:36:06.997297 2025] [:error] [pid 28842:tid 28993] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/ww2.php
[Tue Nov 25 13:36:07.252776 2025] [:error] [pid 28842:tid 29017] [client 40.69.66.178:5109] File does not exist: /usr/local/apache/htdocs/suspended-page/ww3.php
[Tue Nov 25 13:36:07.502451 2025] [:error] [pid 28842:tid 29026] [client 40.69.66.178:5109] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSVAR9NmoaPf6T4-6C0eDwAAA1g"]
[Tue Nov 25 13:36:08.002700 2025] [:error] [pid 14688:tid 14691] [client 40.69.66.178:5346] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSVASG9vYrBoEsiDnixnlQAAAQE"]
[Tue Nov 25 13:36:08.503598 2025] [:error] [pid 28739:tid 28785] [client 40.69.66.178:9832] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSVASBxGpKmlkG4FexQrlQAAAhc"]
[Tue Nov 25 13:36:09.004824 2025] [:error] [pid 28739:tid 28765] [client 40.69.66.178:13698] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aSVASRxGpKmlkG4FexQrmAAAAgM"]
[Tue Nov 25 13:36:09.505735 2025] [:error] [pid 14076:tid 14089] [client 40.69.66.178:5374] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aSVASXsB4Gz6Qw-pvBuubgAAAAg"]
[Tue Nov 25 13:36:10.008587 2025] [:error] [pid 28842:tid 29022] [client 40.69.66.178:14155] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aSVAStNmoaPf6T4-6C0eFwAAA1Q"]
[Tue Nov 25 13:36:10.509060 2025] [:error] [pid 28739:tid 28781] [client 40.69.66.178:10157] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aSVAShxGpKmlkG4FexQrngAAAhM"]
[Tue Nov 25 13:36:11.009691 2025] [:error] [pid 14688:tid 14713] [client 40.69.66.178:11719] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aSVAS29vYrBoEsiDnixnmQAAARc"]
[Tue Nov 25 13:36:11.511322 2025] [:error] [pid 14076:tid 14105] [client 40.69.66.178:11771] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aSVAS3sB4Gz6Qw-pvBuudgAAABg"]
[Tue Nov 25 13:36:12.013283 2025] [:error] [pid 28609:tid 28635] [client 40.69.66.178:13413] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aSVATCGGdT-nZJVs3x1yiAAAAZE"]
[Tue Nov 25 13:36:12.512572 2025] [:error] [pid 14077:tid 14127] [client 40.69.66.178:10180] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aSVATBG9n7UHEkwDTyjtmwAAAFE"]
[Tue Nov 25 13:36:13.013631 2025] [:error] [pid 14168:tid 14176] [client 40.69.66.178:16091] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aSVATfR-ZDU0QEgAIIsNEgAAAMU"]
[Tue Nov 25 13:36:13.518976 2025] [:error] [pid 14076:tid 14084] [client 40.69.66.178:9819] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aSVATXsB4Gz6Qw-pvBuuewAAAAM"]
[Tue Nov 25 13:36:14.018497 2025] [:error] [pid 14077:tid 14131] [client 40.69.66.178:2783] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aSVAThG9n7UHEkwDTyjtnAAAAFU"]
[Tue Nov 25 13:36:14.519966 2025] [:error] [pid 14076:tid 14090] [client 40.69.66.178:14184] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aSVATnsB4Gz6Qw-pvBuufQAAAAk"]
[Tue Nov 25 13:36:15.019582 2025] [:error] [pid 14168:tid 14187] [client 40.69.66.178:13083] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aSVAT_R-ZDU0QEgAIIsNIwAAANA"]
[Tue Nov 25 13:36:15.520924 2025] [:error] [pid 14077:tid 14119] [client 40.69.66.178:9167] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disaos.php"] [unique_id "aSVATxG9n7UHEkwDTyjtnwAAAEk"]
[Tue Nov 25 13:36:16.023520 2025] [:error] [pid 14688:tid 14713] [client 40.69.66.178:10894] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disaos.php"] [unique_id "aSVAUG9vYrBoEsiDnixnogAAARc"]
[Tue Nov 25 13:36:16.524835 2025] [:error] [pid 28842:tid 28998] [client 40.69.66.178:10180] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disaos.php"] [unique_id "aSVAUNNmoaPf6T4-6C0eJgAAA0g"]
[Tue Nov 25 13:36:17.025884 2025] [:error] [pid 28739:tid 28765] [client 40.69.66.178:13421] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disaos.php"] [unique_id "aSVAURxGpKmlkG4FexQrqwAAAgM"]
[Tue Nov 25 13:36:17.528189 2025] [:error] [pid 28836:tid 29008] [client 40.69.66.178:1492] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aSVAUZwNRsoxcLQGkTdr0QAAAtI"]
[Tue Nov 25 13:36:18.030818 2025] [:error] [pid 14078:tid 14155] [client 40.69.66.178:13745] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aSVAUtVXYbb0ii_rVoLfkAAAAJI"]
[Tue Nov 25 13:36:18.535842 2025] [:error] [pid 14076:tid 14103] [client 40.69.66.178:3946] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aSVAUnsB4Gz6Qw-pvBuuhgAAABY"]
[Tue Nov 25 13:36:19.036958 2025] [:error] [pid 14078:tid 14144] [client 40.69.66.178:9807] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aSVAU9VXYbb0ii_rVoLfkgAAAIc"]
[Tue Nov 25 13:36:19.541989 2025] [:error] [pid 14168:tid 14185] [client 40.69.66.178:4413] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSVAU_R-ZDU0QEgAIIsNLQAAAM4"]
[Tue Nov 25 13:36:20.042250 2025] [:error] [pid 14078:tid 14151] [client 40.69.66.178:15255] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSVAVNVXYbb0ii_rVoLfnQAAAI4"]
[Tue Nov 25 13:36:20.543371 2025] [:error] [pid 14168:tid 14173] [client 40.69.66.178:16122] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSVAVPR-ZDU0QEgAIIsNNAAAAMI"]
[Tue Nov 25 13:36:21.046497 2025] [:error] [pid 14168:tid 14193] [client 40.69.66.178:10126] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSVAVfR-ZDU0QEgAIIsNOgAAANY"]
[Tue Nov 25 13:36:21.547110 2025] [:error] [pid 28740:tid 28815] [client 40.69.66.178:15234] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aSVAVVppQCoYxWW6V0UdpgAAAlg"]
[Tue Nov 25 13:36:22.046307 2025] [:error] [pid 14688:tid 14705] [client 40.69.66.178:3910] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aSVAVm9vYrBoEsiDnixnpQAAAQ8"]
[Tue Nov 25 13:36:22.546685 2025] [:error] [pid 28609:tid 28639] [client 40.69.66.178:10219] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aSVAViGGdT-nZJVs3x1yoAAAAZU"]
[Tue Nov 25 13:36:23.047380 2025] [:error] [pid 28836:tid 29012] [client 40.69.66.178:10407] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aSVAV5wNRsoxcLQGkTdr2AAAAtY"]
[Tue Nov 25 13:36:23.547304 2025] [:error] [pid 14077:tid 14110] [client 40.69.66.178:5356] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSVAVxG9n7UHEkwDTyjtsQAAAEA"]
[Tue Nov 25 13:36:24.047341 2025] [:error] [pid 14076:tid 14091] [client 40.69.66.178:2510] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSVAWHsB4Gz6Qw-pvBuukQAAAAo"]
[Tue Nov 25 13:36:24.547213 2025] [:error] [pid 28842:tid 28991] [client 40.69.66.178:10407] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSVAWNNmoaPf6T4-6C0ePwAAA0E"]
[Tue Nov 25 13:36:25.046594 2025] [:error] [pid 14077:tid 14117] [client 40.69.66.178:13743] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSVAWRG9n7UHEkwDTyjttAAAAEc"]
[Tue Nov 25 13:36:25.547564 2025] [:error] [pid 28836:tid 29008] [client 40.69.66.178:5582] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aSVAWZwNRsoxcLQGkTdr9gAAAtI"]
[Tue Nov 25 13:36:26.048813 2025] [:error] [pid 14688:tid 14711] [client 40.69.66.178:2711] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aSVAWm9vYrBoEsiDnixnqQAAARU"]
[Tue Nov 25 13:36:26.547873 2025] [:error] [pid 14078:tid 14148] [client 40.69.66.178:10761] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aSVAWtVXYbb0ii_rVoLfqgAAAIs"]
[Tue Nov 25 13:36:27.048248 2025] [:error] [pid 28842:tid 28992] [client 40.69.66.178:13481] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aSVAW9NmoaPf6T4-6C0eaAAAA0I"]
[Tue Nov 25 13:36:27.547300 2025] [:error] [pid 14077:tid 14131] [client 40.69.66.178:13494] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii.php"] [unique_id "aSVAWxG9n7UHEkwDTyjtuQAAAFU"]
[Tue Nov 25 13:36:28.048063 2025] [:error] [pid 14688:tid 14691] [client 40.69.66.178:3923] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii.php"] [unique_id "aSVAXG9vYrBoEsiDnixnqwAAAQE"]
[Tue Nov 25 13:36:28.550539 2025] [:error] [pid 28842:tid 28995] [client 40.69.66.178:10812] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii.php"] [unique_id "aSVAXNNmoaPf6T4-6C0ebQAAA0U"]
[Tue Nov 25 13:36:29.052896 2025] [:error] [pid 28836:tid 29008] [client 40.69.66.178:1222] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii.php"] [unique_id "aSVAXZwNRsoxcLQGkTdsCgAAAtI"]
[Tue Nov 25 13:36:29.559376 2025] [:error] [pid 14076:tid 14098] [client 40.69.66.178:2695] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kr.php"] [unique_id "aSVAXXsB4Gz6Qw-pvBuvNgAAABE"]
[Tue Nov 25 13:36:30.059659 2025] [:error] [pid 28609:tid 28622] [client 40.69.66.178:3573] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kr.php"] [unique_id "aSVAXiGGdT-nZJVs3x1yqgAAAYQ"]
[Tue Nov 25 13:36:30.570660 2025] [:error] [pid 14078:tid 14139] [client 40.69.66.178:9646] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kr.php"] [unique_id "aSVAXtVXYbb0ii_rVoLfsgAAAII"]
[Tue Nov 25 13:36:31.074806 2025] [:error] [pid 14078:tid 14161] [client 40.69.66.178:7489] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kr.php"] [unique_id "aSVAX9VXYbb0ii_rVoLftAAAAJg"]
[Tue Nov 25 13:36:31.576745 2025] [:error] [pid 28739:tid 28772] [client 40.69.66.178:3426] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/18299.php"] [unique_id "aSVAXxxGpKmlkG4FexQrvwAAAgo"]
[Tue Nov 25 13:36:32.086744 2025] [:error] [pid 14076:tid 14103] [client 40.69.66.178:13478] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/18299.php"] [unique_id "aSVAYHsB4Gz6Qw-pvBuvQwAAABY"]
[Tue Nov 25 13:36:32.588608 2025] [:error] [pid 14078:tid 14141] [client 40.69.66.178:13503] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/18299.php"] [unique_id "aSVAYNVXYbb0ii_rVoLfuAAAAIQ"]
[Tue Nov 25 13:36:33.087437 2025] [:error] [pid 28739:tid 28774] [client 40.69.66.178:3529] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/18299.php"] [unique_id "aSVAYRxGpKmlkG4FexQrwAAAAgw"]
[Tue Nov 25 13:36:33.587312 2025] [:error] [pid 14078:tid 14148] [client 40.69.66.178:1819] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aSVAYdVXYbb0ii_rVoLfuQAAAIs"]
[Tue Nov 25 13:36:34.089437 2025] [:error] [pid 14077:tid 14113] [client 40.69.66.178:11816] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aSVAYhG9n7UHEkwDTyjtwQAAAEM"]
[Tue Nov 25 13:36:34.591793 2025] [:error] [pid 28842:tid 28992] [client 40.69.66.178:16776] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aSVAYtNmoaPf6T4-6C0egwAAA0I"]
[Tue Nov 25 13:36:35.093660 2025] [:error] [pid 14078:tid 14154] [client 40.69.66.178:7492] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aSVAY9VXYbb0ii_rVoLfwQAAAJE"]
[Tue Nov 25 13:36:35.595924 2025] [:error] [pid 28842:tid 29001] [client 40.69.66.178:10899] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "aSVAY9NmoaPf6T4-6C0eiQAAA0s"]
[Tue Nov 25 13:36:36.097782 2025] [:error] [pid 14168:tid 14189] [client 40.69.66.178:16113] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "aSVAZPR-ZDU0QEgAIIsNYgAAANI"]
[Tue Nov 25 13:36:36.598393 2025] [:error] [pid 14168:tid 14174] [client 40.69.66.178:10590] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "aSVAZPR-ZDU0QEgAIIsNZAAAAMM"]
[Tue Nov 25 13:36:37.099128 2025] [:error] [pid 14168:tid 14180] [client 40.69.66.178:11843] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "aSVAZfR-ZDU0QEgAIIsNZwAAAMk"]
[Tue Nov 25 13:36:37.599798 2025] [:error] [pid 14168:tid 14176] [client 40.69.66.178:13451] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSVAZfR-ZDU0QEgAIIsNaQAAAMU"]
[Tue Nov 25 13:36:38.100028 2025] [:error] [pid 28739:tid 28767] [client 40.69.66.178:16817] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSVAZhxGpKmlkG4FexQrxgAAAgU"]
[Tue Nov 25 13:36:38.600540 2025] [:error] [pid 28836:tid 29013] [client 40.69.66.178:1279] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSVAZpwNRsoxcLQGkTdsGAAAAtc"]
[Tue Nov 25 13:36:39.102262 2025] [:error] [pid 28842:tid 29020] [client 40.69.66.178:10908] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content-over.php"] [unique_id "aSVAZ9NmoaPf6T4-6C0ekgAAA1I"]
[Tue Nov 25 13:36:39.608922 2025] [:error] [pid 28836:tid 28968] [client 40.69.66.178:16790] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSVAZ5wNRsoxcLQGkTdsGQAAAs0"]
[Tue Nov 25 13:36:40.107904 2025] [:error] [pid 28842:tid 29002] [client 40.69.66.178:2708] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSVAaNNmoaPf6T4-6C0elgAAA0w"]
[Tue Nov 25 13:36:40.611532 2025] [:error] [pid 14168:tid 14181] [client 40.69.66.178:11780] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSVAaPR-ZDU0QEgAIIsNcgAAAMo"]
[Tue Nov 25 13:36:41.114504 2025] [:error] [pid 14078:tid 14138] [client 40.69.66.178:3451] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aSVAadVXYbb0ii_rVoLfygAAAIE"]
[Tue Nov 25 13:36:41.619985 2025] [:error] [pid 28740:tid 28808] [client 40.69.66.178:2694] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSVAaVppQCoYxWW6V0Ud2AAAAlE"]
[Tue Nov 25 13:36:42.125103 2025] [:error] [pid 28836:tid 29007] [client 40.69.66.178:10622] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSVAapwNRsoxcLQGkTdsHgAAAtE"]
[Tue Nov 25 13:36:42.631931 2025] [:error] [pid 14078:tid 14159] [client 40.69.66.178:4587] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSVAatVXYbb0ii_rVoLfzgAAAJY"]
[Tue Nov 25 13:36:43.131746 2025] [:error] [pid 28842:tid 28993] [client 40.69.66.178:10778] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/naxc.php"] [unique_id "aSVAa9NmoaPf6T4-6C0enAAAA0M"]
[Tue Nov 25 13:36:43.635458 2025] [:error] [pid 14168:tid 14179] [client 40.69.66.178:11886] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSVAa_R-ZDU0QEgAIIsNeQAAAMg"]
[Tue Nov 25 13:36:44.136914 2025] [:error] [pid 14688:tid 14704] [client 40.69.66.178:2699] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSVAbG9vYrBoEsiDnixnuQAAAQ4"]
[Tue Nov 25 13:36:44.637751 2025] [:error] [pid 28836:tid 28965] [client 40.69.66.178:2700] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSVAbJwNRsoxcLQGkTdsJQAAAso"]
[Tue Nov 25 13:36:45.138793 2025] [:error] [pid 14076:tid 14091] [client 40.69.66.178:1797] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSVAbXsB4Gz6Qw-pvBuvTwAAAAo"]
[Tue Nov 25 13:36:45.639316 2025] [:error] [pid 28842:tid 29026] [client 40.69.66.178:2700] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aSVAbdNmoaPf6T4-6C0eoQAAA1g"]
[Tue Nov 25 13:36:46.140367 2025] [:error] [pid 14077:tid 14117] [client 40.69.66.178:3583] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aSVAbhG9n7UHEkwDTyjtyAAAAEc"]
[Tue Nov 25 13:36:46.639530 2025] [:error] [pid 28739:tid 28786] [client 40.69.66.178:7516] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aSVAbhxGpKmlkG4FexQr1AAAAhg"]
[Tue Nov 25 13:36:47.142236 2025] [:error] [pid 28836:tid 28957] [client 40.69.66.178:11892] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aSVAb5wNRsoxcLQGkTdsLQAAAsI"]
[Tue Nov 25 13:36:47.640320 2025] [:error] [pid 28836:tid 29014] [client 40.69.66.178:10784] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rsjlrria.php"] [unique_id "aSVAb5wNRsoxcLQGkTdsMAAAAtg"]
[Tue Nov 25 13:36:48.140395 2025] [:error] [pid 28609:tid 28622] [client 40.69.66.178:5581] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rsjlrria.php"] [unique_id "aSVAcCGGdT-nZJVs3x1ywQAAAYQ"]
[Tue Nov 25 13:36:48.642287 2025] [:error] [pid 28739:tid 28764] [client 40.69.66.178:5629] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rsjlrria.php"] [unique_id "aSVAcBxGpKmlkG4FexQr2QAAAgI"]
[Tue Nov 25 13:36:49.145259 2025] [:error] [pid 28739:tid 28781] [client 40.69.66.178:1244] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rsjlrria.php"] [unique_id "aSVAcRxGpKmlkG4FexQr2wAAAhM"]
[Tue Nov 25 13:36:49.647963 2025] [:error] [pid 14076:tid 14102] [client 40.69.66.178:16111] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSVAcXsB4Gz6Qw-pvBuvYgAAABU"]
[Tue Nov 25 13:36:50.149187 2025] [:error] [pid 28842:tid 29023] [client 40.69.66.178:13715] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gec.php"] [unique_id "aSVActNmoaPf6T4-6C0eqgAAA1U"]
[Tue Nov 25 13:36:50.647983 2025] [:error] [pid 28842:tid 29026] [client 40.69.66.178:5322] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gec.php"] [unique_id "aSVActNmoaPf6T4-6C0erwAAA1g"]
[Tue Nov 25 13:36:51.146864 2025] [:error] [pid 14078:tid 14154] [client 40.69.66.178:4577] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gec.php"] [unique_id "aSVAc9VXYbb0ii_rVoLf2wAAAJE"]
[Tue Nov 25 13:36:51.647013 2025] [:error] [pid 14688:tid 14703] [client 40.69.66.178:10937] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/gec.php"] [unique_id "aSVAc29vYrBoEsiDnixnyAAAAQ0"]
[Tue Nov 25 13:36:52.147818 2025] [:error] [pid 28836:tid 28963] [client 40.69.66.178:2311] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/gec.php"] [unique_id "aSVAdJwNRsoxcLQGkTdsRAAAAsg"]
[Tue Nov 25 13:36:52.648920 2025] [:error] [pid 28609:tid 28634] [client 40.69.66.178:1225] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/gec.php"] [unique_id "aSVAdCGGdT-nZJVs3x1yyQAAAZA"]
[Tue Nov 25 13:36:53.150080 2025] [:error] [pid 28740:tid 28798] [client 40.69.66.178:2691] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/gec.php"] [unique_id "aSVAdVppQCoYxWW6V0Ud6gAAAkc"]
[Tue Nov 25 13:36:53.650245 2025] [:error] [pid 14076:tid 14083] [client 40.69.66.178:4592] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfu.php"] [unique_id "aSVAdXsB4Gz6Qw-pvBuvbAAAAAI"]
[Tue Nov 25 13:36:54.150560 2025] [:error] [pid 28740:tid 28793] [client 40.69.66.178:10880] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfu.php"] [unique_id "aSVAdlppQCoYxWW6V0Ud7gAAAkI"]
[Tue Nov 25 13:36:54.651189 2025] [:error] [pid 14076:tid 14091] [client 40.69.66.178:8940] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfu.php"] [unique_id "aSVAdnsB4Gz6Qw-pvBuvdAAAAAo"]
[Tue Nov 25 13:36:55.151447 2025] [:error] [pid 14077:tid 14124] [client 40.69.66.178:3929] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nfu.php"] [unique_id "aSVAdxG9n7UHEkwDTyjt1QAAAE4"]
[Tue Nov 25 13:36:55.651719 2025] [:error] [pid 14168:tid 14186] [client 40.69.66.178:3921] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/nfu.php"] [unique_id "aSVAd_R-ZDU0QEgAIIsNiAAAAM8"]
[Tue Nov 25 13:36:56.152205 2025] [:error] [pid 14688:tid 14693] [client 40.69.66.178:9852] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/nfu.php"] [unique_id "aSVAeG9vYrBoEsiDnixn0AAAAQM"]
[Tue Nov 25 13:36:56.653388 2025] [:error] [pid 14076:tid 14090] [client 40.69.66.178:16123] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/nfu.php"] [unique_id "aSVAeHsB4Gz6Qw-pvBuvfAAAAAk"]
[Tue Nov 25 13:36:57.153315 2025] [:error] [pid 28609:tid 28639] [client 40.69.66.178:5584] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/nfu.php"] [unique_id "aSVAeSGGdT-nZJVs3x1y1wAAAZU"]
[Tue Nov 25 13:36:57.654244 2025] [:error] [pid 28842:tid 29022] [client 40.69.66.178:2553] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl8.php"] [unique_id "aSVAedNmoaPf6T4-6C0e0QAAA1Q"]
[Tue Nov 25 13:36:58.155795 2025] [:error] [pid 28740:tid 28807] [client 40.69.66.178:10153] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl8.php"] [unique_id "aSVAelppQCoYxWW6V0Ud9gAAAlA"]
[Tue Nov 25 13:36:58.655602 2025] [:error] [pid 14688:tid 14695] [client 40.69.66.178:5816] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl8.php"] [unique_id "aSVAem9vYrBoEsiDnixn0gAAAQU"]
[Tue Nov 25 13:36:59.155174 2025] [:error] [pid 28739:tid 28769] [client 40.69.66.178:5361] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl8.php"] [unique_id "aSVAexxGpKmlkG4FexQr4gAAAgc"]
[Tue Nov 25 13:36:59.659408 2025] [:error] [pid 14168:tid 14193] [client 40.69.66.178:10333] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aSVAe_R-ZDU0QEgAIIsNjwAAANY"]
[Tue Nov 25 13:37:00.159046 2025] [:error] [pid 14076:tid 14100] [client 40.69.66.178:2367] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aSVAfHsB4Gz6Qw-pvBuviQAAABM"]
[Tue Nov 25 13:37:00.661706 2025] [:error] [pid 14077:tid 14112] [client 40.69.66.178:13744] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aSVAfBG9n7UHEkwDTyjt4QAAAEI"]
[Tue Nov 25 13:37:01.160971 2025] [:error] [pid 28842:tid 29017] [client 40.69.66.178:2518] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aSVAfdNmoaPf6T4-6C0e2gAAA1A"]
[Tue Nov 25 13:37:01.660657 2025] [:error] [pid 28740:tid 28815] [client 40.69.66.178:10182] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aSVAfVppQCoYxWW6V0Ud_QAAAlg"]
[Tue Nov 25 13:37:02.161523 2025] [:error] [pid 14076:tid 14085] [client 40.69.66.178:15411] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aSVAfnsB4Gz6Qw-pvBuvlgAAAAQ"]
[Tue Nov 25 13:37:02.663614 2025] [:error] [pid 14168:tid 14179] [client 40.69.66.178:6414] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aSVAfvR-ZDU0QEgAIIsNmwAAAMg"]
[Tue Nov 25 13:37:03.165241 2025] [:error] [pid 14168:tid 14189] [client 40.69.66.178:4600] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aSVAf_R-ZDU0QEgAIIsNoAAAANI"]
[Tue Nov 25 13:37:03.665513 2025] [:error] [pid 14076:tid 14100] [client 40.69.66.178:2743] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-706.php"] [unique_id "aSVAf3sB4Gz6Qw-pvBuvmwAAABM"]
[Tue Nov 25 13:37:04.165246 2025] [:error] [pid 28739:tid 28770] [client 40.69.66.178:5576] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-706.php"] [unique_id "aSVAgBxGpKmlkG4FexQr7wAAAgg"]
[Tue Nov 25 13:37:04.667667 2025] [:error] [pid 28740:tid 28814] [client 40.69.66.178:16070] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-706.php"] [unique_id "aSVAgFppQCoYxWW6V0UeAwAAAlc"]
[Tue Nov 25 13:37:05.168260 2025] [:error] [pid 28740:tid 28800] [client 40.69.66.178:13429] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-706.php"] [unique_id "aSVAgVppQCoYxWW6V0UeBAAAAkk"]
[Tue Nov 25 13:37:05.670773 2025] [:error] [pid 14168:tid 14192] [client 40.69.66.178:10807] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aSVAgfR-ZDU0QEgAIIsNsAAAANU"]
[Tue Nov 25 13:37:06.172416 2025] [:error] [pid 28740:tid 28812] [client 40.69.66.178:3130] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aSVAglppQCoYxWW6V0UeBgAAAlU"]
[Tue Nov 25 13:37:06.672361 2025] [:error] [pid 14688:tid 14692] [client 40.69.66.178:13429] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aSVAgm9vYrBoEsiDnixn3wAAAQI"]
[Tue Nov 25 13:37:07.178868 2025] [:error] [pid 14076:tid 14093] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Nov 25 13:37:07.432882 2025] [:error] [pid 14076:tid 14101] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Nov 25 13:37:08.196840 2025] [:error] [pid 14076:tid 14082] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/e56.php
[Tue Nov 25 13:37:08.452234 2025] [:error] [pid 14076:tid 14105] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-x.php
[Tue Nov 25 13:37:08.706440 2025] [:error] [pid 14076:tid 14083] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Nov 25 13:37:08.960127 2025] [:error] [pid 14076:tid 14104] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Tue Nov 25 13:37:09.217366 2025] [:error] [pid 14076:tid 14090] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/20.php
[Tue Nov 25 13:37:09.470272 2025] [:error] [pid 14076:tid 14093] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Nov 25 13:37:09.723074 2025] [:error] [pid 14076:tid 14095] [client 40.69.66.178:3940] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Tue Nov 25 13:37:09.972515 2025] [:error] [pid 14076:tid 14096] [client 40.69.66.178:3940] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aSVAhXsB4Gz6Qw-pvBuvswAAAA8"]
[Tue Nov 25 13:37:10.472089 2025] [:error] [pid 14076:tid 14084] [client 40.69.66.178:11871] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aSVAhnsB4Gz6Qw-pvBuvtQAAAAM"]
[Tue Nov 25 13:37:10.972889 2025] [:error] [pid 28609:tid 28628] [client 40.69.66.178:3940] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aSVAhiGGdT-nZJVs3x1y9AAAAYo"]
[Tue Nov 25 13:37:11.472709 2025] [:error] [pid 14077:tid 14123] [client 40.69.66.178:2693] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aSVAhxG9n7UHEkwDTyjt6AAAAE0"]
[Tue Nov 25 13:37:11.972596 2025] [:error] [pid 14078:tid 14138] [client 40.69.66.178:9550] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/css.php"] [unique_id "aSVAh9VXYbb0ii_rVoLgAAAAAIE"]
[Tue Nov 25 13:37:12.473613 2025] [:error] [pid 14688:tid 14709] [client 40.69.66.178:10745] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/css.php"] [unique_id "aSVAiG9vYrBoEsiDnixn4wAAARM"]
[Tue Nov 25 13:37:12.986303 2025] [:error] [pid 28842:tid 29023] [client 40.69.66.178:10902] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/css.php"] [unique_id "aSVAiNNmoaPf6T4-6C0e8AAAA1U"]
[Tue Nov 25 13:37:13.486806 2025] [:error] [pid 14688:tid 14701] [client 40.69.66.178:7319] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/css.php"] [unique_id "aSVAiW9vYrBoEsiDnixn5AAAAQs"]
[Tue Nov 25 13:37:13.988182 2025] [:error] [pid 28609:tid 28626] [client 40.69.66.178:11901] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSVAiSGGdT-nZJVs3x1y_QAAAYg"]
[Tue Nov 25 13:37:14.497056 2025] [:error] [pid 14168:tid 14186] [client 40.69.66.178:6409] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSVAivR-ZDU0QEgAIIsNvgAAAM8"]
[Tue Nov 25 13:37:14.995443 2025] [:error] [pid 14168:tid 14193] [client 40.69.66.178:11674] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSVAivR-ZDU0QEgAIIsNvwAAANY"]
[Tue Nov 25 13:37:15.498713 2025] [:error] [pid 14077:tid 14120] [client 40.69.66.178:4592] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSVAixG9n7UHEkwDTyjt7gAAAEo"]
[Tue Nov 25 13:37:16.000098 2025] [:error] [pid 28609:tid 28628] [client 40.69.66.178:11699] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "aSVAiyGGdT-nZJVs3x1zAgAAAYo"]
[Tue Nov 25 13:37:16.500580 2025] [:error] [pid 28836:tid 28956] [client 40.69.66.178:6454] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "aSVAjJwNRsoxcLQGkTdsXgAAAsE"]
[Tue Nov 25 13:37:17.001094 2025] [:error] [pid 14168:tid 14177] [client 40.69.66.178:13329] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "aSVAjPR-ZDU0QEgAIIsNwgAAAMY"]
[Tue Nov 25 13:37:17.502873 2025] [:error] [pid 28842:tid 28994] [client 40.69.66.178:7305] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "aSVAjdNmoaPf6T4-6C0e-QAAA0Q"]
[Tue Nov 25 13:37:18.003296 2025] [:error] [pid 14168:tid 14183] [client 40.69.66.178:16696] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aSVAjvR-ZDU0QEgAIIsNxAAAAMw"]
[Tue Nov 25 13:37:18.504342 2025] [:error] [pid 14076:tid 14089] [client 40.69.66.178:11654] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aSVAjnsB4Gz6Qw-pvBuvwwAAAAg"]
[Tue Nov 25 13:37:19.006302 2025] [:error] [pid 28842:tid 28992] [client 40.69.66.178:6689] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aSVAj9NmoaPf6T4-6C0e-wAAA0I"]
[Tue Nov 25 13:37:19.507488 2025] [:error] [pid 28609:tid 28638] [client 40.69.66.178:4311] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aSVAjyGGdT-nZJVs3x1zBwAAAZQ"]
[Tue Nov 25 13:37:20.009389 2025] [:error] [pid 28836:tid 28955] [client 40.69.66.178:16691] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSVAkJwNRsoxcLQGkTdsYgAAAsA"]
[Tue Nov 25 13:37:20.511308 2025] [:error] [pid 14078:tid 14154] [client 40.69.66.178:12264] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSVAkNVXYbb0ii_rVoLgCQAAAJE"]
[Tue Nov 25 13:37:21.010920 2025] [:error] [pid 14688:tid 14699] [client 40.69.66.178:4612] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSVAkW9vYrBoEsiDnixn-AAAAQk"]
[Tue Nov 25 13:37:21.511847 2025] [:error] [pid 28842:tid 29003] [client 40.69.66.178:6430] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSVAkdNmoaPf6T4-6C0e_gAAA00"]
[Tue Nov 25 13:37:22.012657 2025] [:error] [pid 14078:tid 14139] [client 40.69.66.178:6412] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSVAktVXYbb0ii_rVoLgDQAAAII"]
[Tue Nov 25 13:37:22.514909 2025] [:error] [pid 28842:tid 29022] [client 40.69.66.178:4636] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSVAktNmoaPf6T4-6C0fAAAAA1Q"]
[Tue Nov 25 13:37:23.015406 2025] [:error] [pid 14688:tid 14702] [client 40.69.66.178:13421] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSVAk29vYrBoEsiDnixn_QAAAQw"]
[Tue Nov 25 13:37:23.516260 2025] [:error] [pid 14076:tid 14102] [client 40.69.66.178:9996] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aSVAk3sB4Gz6Qw-pvBuvzgAAABU"]
[Tue Nov 25 13:37:24.023439 2025] [:error] [pid 14076:tid 14097] [client 40.69.66.178:16651] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSVAlHsB4Gz6Qw-pvBuv0AAAABA"]
[Tue Nov 25 13:37:24.524806 2025] [:error] [pid 14688:tid 14700] [client 40.69.66.178:9304] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSVAlG9vYrBoEsiDnixn_wAAAQo"]
[Tue Nov 25 13:37:25.026798 2025] [:error] [pid 14076:tid 14081] [client 40.69.66.178:11665] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSVAlXsB4Gz6Qw-pvBuv1gAAAAA"]
[Tue Nov 25 13:37:25.531398 2025] [:error] [pid 28836:tid 28961] [client 40.69.66.178:9291] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aSVAlZwNRsoxcLQGkTdsaAAAAsY"]
[Tue Nov 25 13:37:26.032514 2025] [:error] [pid 28740:tid 28804] [client 40.69.66.178:13356] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aSVAllppQCoYxWW6V0UeIwAAAk0"]
[Tue Nov 25 13:37:26.538068 2025] [:error] [pid 14076:tid 14095] [client 40.69.66.178:6679] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aSVAlnsB4Gz6Qw-pvBuv2QAAAA4"]
[Tue Nov 25 13:37:27.041084 2025] [:error] [pid 14077:tid 14127] [client 40.69.66.178:16645] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aSVAlxG9n7UHEkwDTyjuDgAAAFE"]
[Tue Nov 25 13:37:27.545884 2025] [:error] [pid 28739:tid 28784] [client 40.69.66.178:10540] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aSVAlxxGpKmlkG4FexQsCQAAAhY"]
[Tue Nov 25 13:37:28.048261 2025] [:error] [pid 14168:tid 14193] [client 40.69.66.178:6663] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aSVAmPR-ZDU0QEgAIIsN2gAAANY"]
[Tue Nov 25 13:37:28.550016 2025] [:error] [pid 14076:tid 14089] [client 40.69.66.178:10506] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aSVAmHsB4Gz6Qw-pvBuv4QAAAAg"]
[Tue Nov 25 13:37:29.053276 2025] [:error] [pid 14688:tid 14691] [client 40.69.66.178:6709] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aSVAmW9vYrBoEsiDnixoBAAAAQE"]
[Tue Nov 25 13:37:29.555682 2025] [:error] [pid 14078:tid 14141] [client 40.69.66.178:4299] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aSVAmdVXYbb0ii_rVoLgKQAAAIQ"]
[Tue Nov 25 13:37:30.056543 2025] [:error] [pid 28609:tid 28627] [client 40.69.66.178:3851] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aSVAmiGGdT-nZJVs3x1zHQAAAYk"]
[Tue Nov 25 13:37:30.557735 2025] [:error] [pid 28609:tid 28642] [client 40.69.66.178:4803] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aSVAmiGGdT-nZJVs3x1zIAAAAZg"]
[Tue Nov 25 13:37:31.059335 2025] [:error] [pid 28842:tid 28994] [client 40.69.66.178:4820] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aSVAm9NmoaPf6T4-6C0fFAAAA0Q"]
[Tue Nov 25 13:37:31.567908 2025] [:error] [pid 14077:tid 14117] [client 40.69.66.178:4851] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aSVAmxG9n7UHEkwDTyjuFQAAAEc"]
[Tue Nov 25 13:37:32.069302 2025] [:error] [pid 28836:tid 29010] [client 40.69.66.178:3879] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aSVAnJwNRsoxcLQGkTdscgAAAtQ"]
[Tue Nov 25 13:37:32.572448 2025] [:error] [pid 14076:tid 14098] [client 40.69.66.178:6826] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aSVAnHsB4Gz6Qw-pvBuv8gAAABE"]
[Tue Nov 25 13:37:33.076521 2025] [:error] [pid 28739:tid 28777] [client 40.69.66.178:6825] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aSVAnRxGpKmlkG4FexQsDwAAAg8"]
[Tue Nov 25 13:37:33.577118 2025] [:error] [pid 28739:tid 28766] [client 40.69.66.178:11156] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aSVAnRxGpKmlkG4FexQsEgAAAgQ"]
[Tue Nov 25 13:37:34.078654 2025] [:error] [pid 14077:tid 14113] [client 40.69.66.178:4859] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSVAnhG9n7UHEkwDTyjuHQAAAEM"]
[Tue Nov 25 13:37:34.580088 2025] [:error] [pid 28836:tid 28964] [client 40.69.66.178:1885] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSVAnpwNRsoxcLQGkTdsegAAAsk"]
[Tue Nov 25 13:37:35.080309 2025] [:error] [pid 14168:tid 14176] [client 40.69.66.178:7576] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSVAn_R-ZDU0QEgAIIsN8AAAAMU"]
[Tue Nov 25 13:37:35.581118 2025] [:error] [pid 28740:tid 28798] [client 40.69.66.178:1394] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aSVAn1ppQCoYxWW6V0UeKAAAAkc"]
[Tue Nov 25 13:37:36.081914 2025] [:error] [pid 28740:tid 28799] [client 40.69.66.178:3655] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSVAoFppQCoYxWW6V0UeKgAAAkg"]
[Tue Nov 25 13:37:36.584720 2025] [:error] [pid 14168:tid 14193] [client 40.69.66.178:1387] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSVAoPR-ZDU0QEgAIIsN8wAAANY"]
[Tue Nov 25 13:37:37.086629 2025] [:error] [pid 28740:tid 28807] [client 40.69.66.178:5040] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSVAoVppQCoYxWW6V0UeLAAAAlA"]
[Tue Nov 25 13:37:37.587351 2025] [:error] [pid 14076:tid 14081] [client 40.69.66.178:6793] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aSVAoXsB4Gz6Qw-pvBuwAQAAAAA"]
[Tue Nov 25 13:37:38.091880 2025] [:error] [pid 14168:tid 14195] [client 40.69.66.178:3668] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aSVAovR-ZDU0QEgAIIsN9QAAANg"]
[Tue Nov 25 13:37:38.591955 2025] [:error] [pid 28609:tid 28637] [client 40.69.66.178:1862] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aSVAoiGGdT-nZJVs3x1zJAAAAZM"]
[Tue Nov 25 13:37:39.092442 2025] [:error] [pid 28740:tid 28791] [client 40.69.66.178:1212] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aSVAo1ppQCoYxWW6V0UeLwAAAkA"]
[Tue Nov 25 13:37:39.594610 2025] [:error] [pid 14688:tid 14710] [client 40.69.66.178:9971] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aSVAo29vYrBoEsiDnixoEQAAARQ"]
[Tue Nov 25 13:37:40.094642 2025] [:error] [pid 14168:tid 14191] [client 40.69.66.178:6084] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSVApPR-ZDU0QEgAIIsN-gAAANQ"]
[Tue Nov 25 13:37:40.598346 2025] [:error] [pid 28739:tid 28771] [client 40.69.66.178:5009] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSVApBxGpKmlkG4FexQsGAAAAgk"]
[Tue Nov 25 13:37:41.100382 2025] [:error] [pid 14078:tid 14139] [client 40.69.66.178:13267] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSVApdVXYbb0ii_rVoLgQAAAAII"]
[Tue Nov 25 13:37:41.602465 2025] [:error] [pid 28836:tid 29009] [client 40.69.66.178:9941] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "aSVApZwNRsoxcLQGkTdsgAAAAtM"]
[Tue Nov 25 13:37:42.104345 2025] [:error] [pid 28609:tid 28623] [client 40.69.66.178:11348] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aSVApiGGdT-nZJVs3x1zKQAAAYU"]
[Tue Nov 25 13:37:42.605824 2025] [:error] [pid 14077:tid 14130] [client 40.69.66.178:10041] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aSVAphG9n7UHEkwDTyjuOwAAAFQ"]
[Tue Nov 25 13:37:43.106745 2025] [:error] [pid 28842:tid 29003] [client 40.69.66.178:5014] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aSVAp9NmoaPf6T4-6C0fIgAAA00"]
[Tue Nov 25 13:37:43.609290 2025] [:error] [pid 14168:tid 14189] [client 40.69.66.178:7569] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aSVAp_R-ZDU0QEgAIIsOAQAAANI"]
[Tue Nov 25 13:37:44.116793 2025] [:error] [pid 14168:tid 14178] [client 40.69.66.178:3890] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aSVAqPR-ZDU0QEgAIIsOBQAAAMc"]
[Tue Nov 25 13:37:44.618180 2025] [:error] [pid 14078:tid 14161] [client 40.69.66.178:6797] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aSVAqNVXYbb0ii_rVoLgRgAAAJg"]
[Tue Nov 25 13:37:45.121189 2025] [:error] [pid 14078:tid 14156] [client 40.69.66.178:4858] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aSVAqdVXYbb0ii_rVoLgSgAAAJM"]
[Tue Nov 25 13:37:45.622606 2025] [:error] [pid 14168:tid 14177] [client 40.69.66.178:6099] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aSVAqfR-ZDU0QEgAIIsOCAAAAMY"]
[Tue Nov 25 13:37:46.122479 2025] [:error] [pid 28842:tid 28995] [client 40.69.66.178:6095] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSVAqtNmoaPf6T4-6C0fKQAAA0U"]
[Tue Nov 25 13:37:46.624212 2025] [:error] [pid 28836:tid 29014] [client 40.69.66.178:9297] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSVAqpwNRsoxcLQGkTdshgAAAtg"]
[Tue Nov 25 13:37:47.124515 2025] [:error] [pid 14076:tid 14089] [client 40.69.66.178:13260] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSVAq3sB4Gz6Qw-pvBuwCwAAAAg"]
[Tue Nov 25 13:37:47.626265 2025] [:error] [pid 28836:tid 28956] [client 40.69.66.178:4859] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSVAq5wNRsoxcLQGkTdsigAAAsE"]
[Tue Nov 25 13:37:48.129614 2025] [:error] [pid 14688:tid 14710] [client 40.69.66.178:1883] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aSVArG9vYrBoEsiDnixoHAAAARQ"]
[Tue Nov 25 13:37:48.631788 2025] [:error] [pid 14078:tid 14138] [client 40.69.66.178:1176] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aSVArNVXYbb0ii_rVoLgWgAAAIE"]
[Tue Nov 25 13:37:49.132353 2025] [:error] [pid 14078:tid 14151] [client 40.69.66.178:14142] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aSVArdVXYbb0ii_rVoLgXQAAAI4"]
[Tue Nov 25 13:37:49.634308 2025] [:error] [pid 28740:tid 28810] [client 40.69.66.178:1882] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aSVArVppQCoYxWW6V0UePgAAAlM"]
[Tue Nov 25 13:37:50.133338 2025] [:error] [pid 14076:tid 14086] [client 40.69.66.178:5051] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSVArnsB4Gz6Qw-pvBuwEgAAAAU"]
[Tue Nov 25 13:37:50.633371 2025] [:error] [pid 28740:tid 28811] [client 40.69.66.178:2078] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSVArlppQCoYxWW6V0UePwAAAlQ"]
[Tue Nov 25 13:37:51.136306 2025] [:error] [pid 14168:tid 14185] [client 40.69.66.178:9985] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSVAr_R-ZDU0QEgAIIsOGQAAAM4"]
[Tue Nov 25 13:37:51.635227 2025] [:error] [pid 28836:tid 28968] [client 40.69.66.178:13265] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSVAr5wNRsoxcLQGkTdsjAAAAs0"]
[Tue Nov 25 13:37:52.134676 2025] [:error] [pid 14078:tid 14154] [client 40.69.66.178:6829] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aSVAsNVXYbb0ii_rVoLgdgAAAJE"]
[Tue Nov 25 13:37:52.641269 2025] [:error] [pid 14076:tid 14094] [client 40.69.66.178:14138] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aSVAsHsB4Gz6Qw-pvBuwGgAAAA0"]
[Tue Nov 25 13:37:53.141840 2025] [:error] [pid 28609:tid 28633] [client 40.69.66.178:2048] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aSVAsSGGdT-nZJVs3x1zMQAAAY8"]
[Tue Nov 25 13:37:53.642437 2025] [:error] [pid 14168:tid 14173] [client 40.69.66.178:7578] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aSVAsfR-ZDU0QEgAIIsOIAAAAMI"]
[Tue Nov 25 13:37:54.142028 2025] [:error] [pid 14076:tid 14081] [client 40.69.66.178:14123] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSVAsnsB4Gz6Qw-pvBuwHgAAAAA"]
[Tue Nov 25 13:37:54.640777 2025] [:error] [pid 14168:tid 14178] [client 40.69.66.178:13265] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSVAsvR-ZDU0QEgAIIsOIwAAAMc"]
[Tue Nov 25 13:37:55.138884 2025] [:error] [pid 14168:tid 14177] [client 40.69.66.178:6140] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSVAs_R-ZDU0QEgAIIsOJAAAAMY"]
[Tue Nov 25 13:37:55.639465 2025] [:error] [pid 28609:tid 28634] [client 40.69.66.178:5637] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSVAsyGGdT-nZJVs3x1zNgAAAZA"]
[Tue Nov 25 13:37:56.139862 2025] [:error] [pid 14076:tid 14083] [client 40.69.66.178:5638] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSVAtHsB4Gz6Qw-pvBuwIQAAAAI"]
[Tue Nov 25 13:37:56.643721 2025] [:error] [pid 28739:tid 28783] [client 40.69.66.178:5682] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSVAtBxGpKmlkG4FexQsMwAAAhU"]
[Tue Nov 25 13:37:57.154276 2025] [:error] [pid 28739:tid 28786] [client 40.69.66.178:7294] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSVAtRxGpKmlkG4FexQsNgAAAhg"]
[Tue Nov 25 13:37:57.655057 2025] [:error] [pid 28740:tid 28814] [client 40.69.66.178:5673] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSVAtVppQCoYxWW6V0UeRgAAAlc"]
[Tue Nov 25 13:37:58.159314 2025] [:error] [pid 28740:tid 28806] [client 40.69.66.178:4875] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAtlppQCoYxWW6V0UeSAAAAk8"]
[Tue Nov 25 13:37:58.658859 2025] [:error] [pid 28740:tid 28807] [client 40.69.66.178:2094] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAtlppQCoYxWW6V0UeSgAAAlA"]
[Tue Nov 25 13:37:59.159020 2025] [:error] [pid 14078:tid 14154] [client 40.69.66.178:2072] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAt9VXYbb0ii_rVoLgewAAAJE"]
[Tue Nov 25 13:37:59.658751 2025] [:error] [pid 14076:tid 14088] [client 40.69.66.178:12679] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAt3sB4Gz6Qw-pvBuwJwAAAAc"]
[Tue Nov 25 13:38:00.161808 2025] [:error] [pid 14076:tid 14105] [client 40.69.66.178:12673] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAuHsB4Gz6Qw-pvBuwKAAAABg"]
[Tue Nov 25 13:38:00.661984 2025] [:error] [pid 28842:tid 28990] [client 40.69.66.178:16919] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAuNNmoaPf6T4-6C0fOAAAA0A"]
[Tue Nov 25 13:38:01.163695 2025] [:error] [pid 14077:tid 14124] [client 40.69.66.178:6987] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAuRG9n7UHEkwDTyjuYQAAAE4"]
[Tue Nov 25 13:38:01.666307 2025] [:error] [pid 28609:tid 28624] [client 40.69.66.178:4882] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSVAuSGGdT-nZJVs3x1zPQAAAYY"]
[Tue Nov 25 13:38:02.167095 2025] [:error] [pid 28609:tid 28626] [client 40.69.66.178:11238] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSVAuiGGdT-nZJVs3x1zPwAAAYg"]
[Tue Nov 25 13:38:02.668061 2025] [:error] [pid 14688:tid 14693] [client 40.69.66.178:11425] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aSVAum9vYrBoEsiDnixoMwAAAQM"]
[Tue Nov 25 13:38:03.168097 2025] [:error] [pid 14076:tid 14087] [client 40.69.66.178:11225] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aSVAu3sB4Gz6Qw-pvBuwLgAAAAY"]
[Tue Nov 25 13:38:03.666558 2025] [:error] [pid 28842:tid 28992] [client 40.69.66.178:11458] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aSVAu9NmoaPf6T4-6C0fPAAAA0I"]
[Tue Nov 25 13:38:04.165983 2025] [:error] [pid 28842:tid 29005] [client 40.69.66.178:7832] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSVAvNNmoaPf6T4-6C0fPQAAA08"]
[Tue Nov 25 13:38:04.669437 2025] [:error] [pid 14168:tid 14182] [client 40.69.66.178:9901] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSVAvPR-ZDU0QEgAIIsOQgAAAMs"]
[Tue Nov 25 13:38:05.170499 2025] [:error] [pid 28836:tid 28957] [client 40.69.66.178:6245] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSVAvZwNRsoxcLQGkTdsjgAAAsI"]
[Tue Nov 25 13:38:05.675066 2025] [:error] [pid 14077:tid 14119] [client 40.69.66.178:7973] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSVAvRG9n7UHEkwDTyjuZQAAAEk"]
[Tue Nov 25 13:38:06.174675 2025] [:error] [pid 14078:tid 14154] [client 40.69.66.178:7845] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSVAvtVXYbb0ii_rVoLghAAAAJE"]
[Tue Nov 25 13:38:06.674899 2025] [:error] [pid 28740:tid 28801] [client 40.69.66.178:3831] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSVAvlppQCoYxWW6V0UeUAAAAko"]
[Tue Nov 25 13:38:07.174464 2025] [:error] [pid 14078:tid 14151] [client 40.69.66.178:11408] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSVAv9VXYbb0ii_rVoLghQAAAI4"]
[Tue Nov 25 13:38:07.675245 2025] [:error] [pid 28739:tid 28784] [client 40.69.66.178:7028] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSVAvxxGpKmlkG4FexQsPwAAAhY"]
[Tue Nov 25 13:38:08.176987 2025] [:error] [pid 14078:tid 14157] [client 40.69.66.178:9863] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aSVAwNVXYbb0ii_rVoLghgAAAJQ"]
[Tue Nov 25 13:38:08.678233 2025] [:error] [pid 14168:tid 14181] [client 40.69.66.178:12200] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aSVAwPR-ZDU0QEgAIIsORgAAAMo"]
[Tue Nov 25 13:38:09.183648 2025] [:error] [pid 28740:tid 28797] [client 40.69.66.178:16946] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Nov 25 13:38:09.437035 2025] [:error] [pid 28740:tid 28804] [client 40.69.66.178:16946] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Tue Nov 25 13:38:09.692215 2025] [:error] [pid 28740:tid 28807] [client 40.69.66.178:16946] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Nov 25 13:38:10.451344 2025] [:error] [pid 28740:tid 28802] [client 40.69.66.178:16946] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSVAwlppQCoYxWW6V0UeWAAAAks"]
[Tue Nov 25 13:38:11.211203 2025] [:error] [pid 14077:tid 14125] [client 40.69.66.178:7012] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Nov 25 13:38:11.467917 2025] [:error] [pid 14077:tid 14124] [client 40.69.66.178:7012] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Nov 25 13:38:11.976166 2025] [:error] [pid 14077:tid 14133] [client 40.69.66.178:7012] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Tue Nov 25 13:38:12.227090 2025] [:error] [pid 14077:tid 14128] [client 40.69.66.178:7012] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSVAxBG9n7UHEkwDTyjucgAAAFI"]
[Tue Nov 25 13:38:12.984026 2025] [:error] [pid 28740:tid 28801] [client 40.69.66.178:8494] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSVAxFppQCoYxWW6V0UeXAAAAko"]
[Tue Nov 25 13:38:13.484437 2025] [:error] [pid 28740:tid 28796] [client 40.69.66.178:11501] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSVAxVppQCoYxWW6V0UeXQAAAkU"]
[Tue Nov 25 13:38:13.985326 2025] [:error] [pid 14077:tid 14125] [client 40.69.66.178:15672] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSVAxRG9n7UHEkwDTyjufQAAAE8"]
[Tue Nov 25 13:38:14.489309 2025] [:error] [pid 28836:tid 29014] [client 40.69.66.178:11504] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSVAxpwNRsoxcLQGkTdsqQAAAtg"]
[Tue Nov 25 13:38:14.990679 2025] [:error] [pid 14078:tid 14137] [client 40.69.66.178:3794] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSVAxtVXYbb0ii_rVoLgmwAAAIA"]
[Tue Nov 25 13:38:15.491942 2025] [:error] [pid 14688:tid 14695] [client 40.69.66.178:7943] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSVAx29vYrBoEsiDnixoQgAAAQU"]
[Tue Nov 25 13:38:15.999444 2025] [:error] [pid 14076:tid 14082] [client 40.69.66.178:1459] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSVAx3sB4Gz6Qw-pvBuwTAAAAAE"]
[Tue Nov 25 13:38:16.500989 2025] [:error] [pid 28740:tid 28806] [client 40.69.66.178:7150] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSVAyFppQCoYxWW6V0UeZgAAAk8"]
[Tue Nov 25 13:38:17.002667 2025] [:error] [pid 14688:tid 14714] [client 40.69.66.178:11461] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSVAyW9vYrBoEsiDnixoRAAAARg"]
[Tue Nov 25 13:38:17.504496 2025] [:error] [pid 14076:tid 14089] [client 40.69.66.178:14384] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSVAyXsB4Gz6Qw-pvBuwUQAAAAg"]
[Tue Nov 25 13:38:18.004601 2025] [:error] [pid 14168:tid 14182] [client 40.69.66.178:9894] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSVAyvR-ZDU0QEgAIIsOVwAAAMs"]
[Tue Nov 25 13:38:18.504318 2025] [:error] [pid 14078:tid 14160] [client 40.69.66.178:11536] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aSVAytVXYbb0ii_rVoLgqAAAAJc"]
[Tue Nov 25 13:38:19.006239 2025] [:error] [pid 28836:tid 28962] [client 40.69.66.178:7964] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSVAy5wNRsoxcLQGkTdsqwAAAsc"]
[Tue Nov 25 13:38:19.506374 2025] [:error] [pid 14076:tid 14103] [client 40.69.66.178:7936] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSVAy3sB4Gz6Qw-pvBuwWAAAABY"]
[Tue Nov 25 13:38:20.007037 2025] [:error] [pid 14077:tid 14117] [client 40.69.66.178:8406] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSVAzBG9n7UHEkwDTyjujwAAAEc"]
[Tue Nov 25 13:38:20.508360 2025] [:error] [pid 14077:tid 14116] [client 40.69.66.178:7148] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSVAzBG9n7UHEkwDTyjukAAAAEY"]
[Tue Nov 25 13:38:21.009078 2025] [:error] [pid 28836:tid 29006] [client 40.69.66.178:8388] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSVAzZwNRsoxcLQGkTdsrwAAAtA"]
[Tue Nov 25 13:38:21.508772 2025] [:error] [pid 14688:tid 14711] [client 40.69.66.178:7119] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSVAzW9vYrBoEsiDnixoTwAAARU"]
[Tue Nov 25 13:38:22.008993 2025] [:error] [pid 28739:tid 28784] [client 40.69.66.178:3811] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSVAzhxGpKmlkG4FexQsbwAAAhY"]
[Tue Nov 25 13:38:22.509533 2025] [:error] [pid 14168:tid 14180] [client 40.69.66.178:9873] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSVAzvR-ZDU0QEgAIIsOWgAAAMk"]
[Tue Nov 25 13:38:23.010575 2025] [:error] [pid 14168:tid 14195] [client 40.69.66.178:11494] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSVAz_R-ZDU0QEgAIIsOXQAAANg"]
[Tue Nov 25 13:38:23.510699 2025] [:error] [pid 14078:tid 14160] [client 40.69.66.178:8432] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSVAz9VXYbb0ii_rVoLgswAAAJc"]
[Tue Nov 25 13:38:24.011623 2025] [:error] [pid 14078:tid 14155] [client 40.69.66.178:15649] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSVA0NVXYbb0ii_rVoLgtgAAAJI"]
[Tue Nov 25 13:38:24.511455 2025] [:error] [pid 14688:tid 14699] [client 40.69.66.178:8459] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aSVA0G9vYrBoEsiDnixoVgAAAQk"]
[Tue Nov 25 13:38:25.011715 2025] [:error] [pid 28842:tid 28997] [client 40.69.66.178:5950] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSVA0dNmoaPf6T4-6C0fdwAAA0c"]
[Tue Nov 25 13:38:25.512562 2025] [:error] [pid 14078:tid 14149] [client 40.69.66.178:7987] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSVA0dVXYbb0ii_rVoLgugAAAIw"]
[Tue Nov 25 13:38:26.013012 2025] [:error] [pid 14168:tid 14184] [client 40.69.66.178:13927] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSVA0vR-ZDU0QEgAIIsOZgAAAM0"]
[Tue Nov 25 13:38:26.512308 2025] [:error] [pid 14078:tid 14151] [client 40.69.66.178:8402] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSVA0tVXYbb0ii_rVoLgvQAAAI4"]
[Tue Nov 25 13:38:27.012312 2025] [:error] [pid 14168:tid 14171] [client 40.69.66.178:11540] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aSVA0_R-ZDU0QEgAIIsObQAAAMA"]
[Tue Nov 25 13:38:27.512611 2025] [:error] [pid 14076:tid 14096] [client 40.69.66.178:8545] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aSVA03sB4Gz6Qw-pvBuwagAAAA8"]
[Tue Nov 25 13:38:28.013507 2025] [:error] [pid 14076:tid 14090] [client 40.69.66.178:11583] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aSVA1HsB4Gz6Qw-pvBuwbwAAAAk"]
[Tue Nov 25 13:38:28.514443 2025] [:error] [pid 14077:tid 14112] [client 40.69.66.178:11530] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aSVA1BG9n7UHEkwDTyjukgAAAEI"]
[Tue Nov 25 13:38:29.015410 2025] [:error] [pid 28740:tid 28802] [client 40.69.66.178:7989] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aSVA1VppQCoYxWW6V0UecgAAAks"]
[Tue Nov 25 13:38:29.515510 2025] [:error] [pid 28842:tid 28994] [client 40.69.66.178:7957] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aSVA1dNmoaPf6T4-6C0fegAAA0Q"]
[Tue Nov 25 13:38:30.015114 2025] [:error] [pid 28609:tid 28633] [client 40.69.66.178:7809] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aSVA1iGGdT-nZJVs3x1zTwAAAY8"]
[Tue Nov 25 13:38:30.517996 2025] [:error] [pid 28609:tid 28623] [client 40.69.66.178:7997] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aSVA1iGGdT-nZJVs3x1zUAAAAYU"]
[Tue Nov 25 13:38:31.021912 2025] [:error] [pid 14077:tid 14132] [client 40.69.66.178:7162] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aSVA1xG9n7UHEkwDTyjulwAAAFY"]
[Tue Nov 25 13:38:31.523001 2025] [:error] [pid 14076:tid 14092] [client 40.69.66.178:8411] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aSVA13sB4Gz6Qw-pvBuwdQAAAAs"]
[Tue Nov 25 13:38:32.023843 2025] [:error] [pid 28609:tid 28627] [client 40.69.66.178:8439] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aSVA2CGGdT-nZJVs3x1zUQAAAYk"]
[Tue Nov 25 13:38:32.523735 2025] [:error] [pid 28842:tid 29026] [client 40.69.66.178:5949] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aSVA2NNmoaPf6T4-6C0fgwAAA1g"]
[Tue Nov 25 13:38:33.023723 2025] [:error] [pid 28740:tid 28801] [client 40.69.66.178:15672] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aSVA2VppQCoYxWW6V0UedgAAAko"]
[Tue Nov 25 13:38:33.525654 2025] [:error] [pid 14168:tid 14181] [client 40.69.66.178:7135] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aSVA2fR-ZDU0QEgAIIsOeAAAAMo"]
[Tue Nov 25 13:38:34.026103 2025] [:error] [pid 14688:tid 14706] [client 40.69.66.178:14370] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aSVA2m9vYrBoEsiDnixoXQAAARA"]
[Tue Nov 25 13:38:34.524498 2025] [:error] [pid 14076:tid 14101] [client 40.69.66.178:8445] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aSVA2nsB4Gz6Qw-pvBuwdwAAABQ"]
[Tue Nov 25 13:38:35.023656 2025] [:error] [pid 14688:tid 14691] [client 40.69.66.178:5923] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aSVA229vYrBoEsiDnixoXgAAAQE"]
[Tue Nov 25 13:38:35.524002 2025] [:error] [pid 14078:tid 14140] [client 40.69.66.178:15642] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aSVA29VXYbb0ii_rVoLgxwAAAIM"]
[Tue Nov 25 13:38:36.023758 2025] [:error] [pid 14078:tid 14156] [client 40.69.66.178:7131] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aSVA3NVXYbb0ii_rVoLgyQAAAJM"]
[Tue Nov 25 13:38:36.523294 2025] [:error] [pid 28740:tid 28798] [client 40.69.66.178:13930] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aSVA3FppQCoYxWW6V0UeeAAAAkc"]
[Tue Nov 25 13:38:37.023988 2025] [:error] [pid 28740:tid 28814] [client 40.69.66.178:5737] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aSVA3VppQCoYxWW6V0UeeQAAAlc"]
[Tue Nov 25 13:38:37.528169 2025] [:error] [pid 28842:tid 28992] [client 40.69.66.178:7107] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aSVA3dNmoaPf6T4-6C0figAAA0I"]
[Tue Nov 25 13:38:38.027564 2025] [:error] [pid 14168:tid 14172] [client 40.69.66.178:16941] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aSVA3vR-ZDU0QEgAIIsOmAAAAME"]
[Tue Nov 25 13:38:38.536173 2025] [:error] [pid 14688:tid 14705] [client 40.69.66.178:8408] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aSVA3m9vYrBoEsiDnixoYAAAAQ8"]
[Tue Nov 25 13:38:39.068360 2025] [:error] [pid 28609:tid 28636] [client 40.69.66.178:6464] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSVA3yGGdT-nZJVs3x1zWQAAAZI"]
[Tue Nov 25 13:38:39.583758 2025] [:error] [pid 28842:tid 29018] [client 40.69.66.178:13924] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aSVA39NmoaPf6T4-6C0fkQAAA1E"]
[Tue Nov 25 13:38:40.084149 2025] [:error] [pid 14688:tid 14704] [client 40.69.66.178:13933] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aSVA4G9vYrBoEsiDnixoYgAAAQ4"]
[Tue Nov 25 13:38:40.583380 2025] [:error] [pid 14077:tid 14117] [client 40.69.66.178:5934] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aSVA4BG9n7UHEkwDTyjuqAAAAEc"]
[Tue Nov 25 13:38:41.094661 2025] [:error] [pid 28740:tid 28807] [client 40.69.66.178:13922] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aSVA4VppQCoYxWW6V0UeewAAAlA"]
[Tue Nov 25 13:38:41.597468 2025] [:error] [pid 14688:tid 14706] [client 40.69.66.178:8384] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aSVA4W9vYrBoEsiDnixoagAAARA"]
[Tue Nov 25 13:38:42.097150 2025] [:error] [pid 14076:tid 14095] [client 40.69.66.178:5921] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aSVA4nsB4Gz6Qw-pvBuwfgAAAA4"]
[Tue Nov 25 13:38:42.596743 2025] [:error] [pid 28842:tid 29017] [client 40.69.66.178:9247] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSVA4tNmoaPf6T4-6C0fkwAAA1A"]
[Tue Nov 25 13:38:43.096816 2025] [:error] [pid 14168:tid 14190] [client 40.69.66.178:15656] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSVA4_R-ZDU0QEgAIIsOqAAAANM"]
[Tue Nov 25 13:38:43.597885 2025] [:error] [pid 14076:tid 14089] [client 40.69.66.178:8468] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSVA43sB4Gz6Qw-pvBuwfwAAAAg"]
[Tue Nov 25 13:38:44.097989 2025] [:error] [pid 28842:tid 29002] [client 40.69.66.178:8168] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSVA5NNmoaPf6T4-6C0flAAAA0w"]
[Tue Nov 25 13:38:44.598248 2025] [:error] [pid 28740:tid 28811] [client 40.69.66.178:9517] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSVA5FppQCoYxWW6V0UegAAAAlQ"]
[Tue Nov 25 13:38:45.098049 2025] [:error] [pid 14076:tid 14101] [client 40.69.66.178:5716] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSVA5XsB4Gz6Qw-pvBuwggAAABQ"]
[Tue Nov 25 13:38:45.597427 2025] [:error] [pid 14076:tid 14102] [client 40.69.66.178:13889] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSVA5XsB4Gz6Qw-pvBuwgwAAABU"]
[Tue Nov 25 13:38:46.097168 2025] [:error] [pid 28836:tid 28965] [client 40.69.66.178:9509] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aSVA5pwNRsoxcLQGkTdtEgAAAso"]
[Tue Nov 25 13:38:46.596818 2025] [:error] [pid 28739:tid 28774] [client 40.69.66.178:9271] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aSVA5hxGpKmlkG4FexQsmAAAAgw"]
[Tue Nov 25 13:38:47.098163 2025] [:error] [pid 14078:tid 14152] [client 40.69.66.178:8867] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aSVA59VXYbb0ii_rVoLg3AAAAI8"]
[Tue Nov 25 13:38:47.599123 2025] [:error] [pid 28836:tid 29013] [client 40.69.66.178:7131] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aSVA55wNRsoxcLQGkTdtFQAAAtc"]
[Tue Nov 25 13:38:48.099152 2025] [:error] [pid 28609:tid 28628] [client 40.69.66.178:8171] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aSVA6CGGdT-nZJVs3x1zXgAAAYo"]
[Tue Nov 25 13:38:48.600161 2025] [:error] [pid 28739:tid 28766] [client 40.69.66.178:5929] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSVA6BxGpKmlkG4FexQsmgAAAgQ"]
[Tue Nov 25 13:38:49.101528 2025] [:error] [pid 14076:tid 14096] [client 40.69.66.178:8878] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSVA6XsB4Gz6Qw-pvBuwiAAAAA8"]
[Tue Nov 25 13:38:49.602438 2025] [:error] [pid 14076:tid 14100] [client 40.69.66.178:5755] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSVA6XsB4Gz6Qw-pvBuwigAAABM"]
[Tue Nov 25 13:38:50.102628 2025] [:error] [pid 28842:tid 28996] [client 40.69.66.178:12521] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSVA6tNmoaPf6T4-6C0fmwAAA0Y"]
[Tue Nov 25 13:38:50.603938 2025] [:error] [pid 14076:tid 14093] [client 40.69.66.178:15166] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSVA6nsB4Gz6Qw-pvBuwjQAAAAw"]
[Tue Nov 25 13:38:51.102967 2025] [:error] [pid 28739:tid 28773] [client 40.69.66.178:11557] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSVA6xxGpKmlkG4FexQsnAAAAgs"]
[Tue Nov 25 13:38:51.602130 2025] [:error] [pid 28842:tid 28995] [client 40.69.66.178:8864] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSVA69NmoaPf6T4-6C0fngAAA0U"]
[Tue Nov 25 13:38:52.103488 2025] [:error] [pid 28740:tid 28810] [client 40.69.66.178:2119] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSVA7FppQCoYxWW6V0UeggAAAlM"]
[Tue Nov 25 13:38:52.605357 2025] [:error] [pid 28836:tid 28967] [client 40.69.66.178:6465] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSVA7JwNRsoxcLQGkTdtHQAAAsw"]
[Tue Nov 25 13:38:53.105152 2025] [:error] [pid 14078:tid 14138] [client 40.69.66.178:15402] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSVA7dVXYbb0ii_rVoLg4AAAAIE"]
[Tue Nov 25 13:38:53.605925 2025] [:error] [pid 14168:tid 14178] [client 40.69.66.178:9480] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSVA7fR-ZDU0QEgAIIsOuQAAAMc"]
[Tue Nov 25 13:38:54.105129 2025] [:error] [pid 14076:tid 14095] [client 40.69.66.178:2144] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSVA7nsB4Gz6Qw-pvBuwnAAAAA4"]
[Tue Nov 25 13:38:54.604080 2025] [:error] [pid 28842:tid 28999] [client 40.69.66.178:8837] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVA7tNmoaPf6T4-6C0foQAAA0k"]
[Tue Nov 25 13:38:55.103789 2025] [:error] [pid 28609:tid 28629] [client 40.69.66.178:14066] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVA7yGGdT-nZJVs3x1zYQAAAYs"]
[Tue Nov 25 13:38:55.602977 2025] [:error] [pid 28609:tid 28620] [client 40.69.66.178:13193] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVA7yGGdT-nZJVs3x1zYgAAAYI"]
[Tue Nov 25 13:38:56.103132 2025] [:error] [pid 28740:tid 28805] [client 40.69.66.178:1686] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVA8FppQCoYxWW6V0UehQAAAk4"]
[Tue Nov 25 13:38:56.604768 2025] [:error] [pid 14077:tid 14110] [client 40.69.66.178:15161] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSVA8BG9n7UHEkwDTyjuuAAAAEA"]
[Tue Nov 25 13:38:57.105006 2025] [:error] [pid 14077:tid 14133] [client 40.69.66.178:12538] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSVA8RG9n7UHEkwDTyjuugAAAFc"]
[Tue Nov 25 13:38:57.605458 2025] [:error] [pid 28739:tid 28782] [client 40.69.66.178:2609] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSVA8RxGpKmlkG4FexQsogAAAhQ"]
[Tue Nov 25 13:38:58.107912 2025] [:error] [pid 14168:tid 14177] [client 40.69.66.178:2152] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSVA8vR-ZDU0QEgAIIsOxAAAAMY"]
[Tue Nov 25 13:38:58.608095 2025] [:error] [pid 14077:tid 14126] [client 40.69.66.178:10048] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVA8hG9n7UHEkwDTyjuwgAAAFA"]
[Tue Nov 25 13:38:59.106998 2025] [:error] [pid 14078:tid 14153] [client 40.69.66.178:11905] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVA89VXYbb0ii_rVoLg5gAAAJA"]
[Tue Nov 25 13:38:59.605619 2025] [:error] [pid 28836:tid 28966] [client 40.69.66.178:12663] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVA85wNRsoxcLQGkTdtJAAAAss"]
[Tue Nov 25 13:39:00.106218 2025] [:error] [pid 28842:tid 28997] [client 40.69.66.178:9140] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVA9NNmoaPf6T4-6C0fpAAAA0c"]
[Tue Nov 25 13:39:00.607006 2025] [:error] [pid 14078:tid 14155] [client 40.69.66.178:9090] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSVA9NVXYbb0ii_rVoLg6QAAAJI"]
[Tue Nov 25 13:39:01.108311 2025] [:error] [pid 28609:tid 28638] [client 40.69.66.178:9739] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSVA9SGGdT-nZJVs3x1zawAAAZQ"]
[Tue Nov 25 13:39:01.608450 2025] [:error] [pid 14076:tid 14101] [client 40.69.66.178:2354] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSVA9XsB4Gz6Qw-pvBuwqAAAABQ"]
[Tue Nov 25 13:39:02.109500 2025] [:error] [pid 14688:tid 14705] [client 40.69.66.178:12862] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSVA9m9vYrBoEsiDnixopwAAAQ8"]
[Tue Nov 25 13:39:02.609967 2025] [:error] [pid 28836:tid 29009] [client 40.69.66.178:12656] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aSVA9pwNRsoxcLQGkTdtJgAAAtM"]
[Tue Nov 25 13:39:03.109652 2025] [:error] [pid 14688:tid 14696] [client 40.69.66.178:12854] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aSVA929vYrBoEsiDnixoqgAAAQY"]
[Tue Nov 25 13:39:03.612470 2025] [:error] [pid 14168:tid 14177] [client 40.69.66.178:10444] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aSVA9_R-ZDU0QEgAIIsO0AAAAMY"]
[Tue Nov 25 13:39:04.113217 2025] [:error] [pid 14168:tid 14181] [client 40.69.66.178:9778] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aSVA-PR-ZDU0QEgAIIsO0QAAAMo"]
[Tue Nov 25 13:39:04.614738 2025] [:error] [pid 28842:tid 28996] [client 40.69.66.178:2337] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aSVA-NNmoaPf6T4-6C0fqgAAA0Y"]
[Tue Nov 25 13:39:05.115217 2025] [:error] [pid 14168:tid 14174] [client 40.69.66.178:12461] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aSVA-fR-ZDU0QEgAIIsO1QAAAMM"]
[Tue Nov 25 13:39:05.616181 2025] [:error] [pid 28836:tid 28957] [client 40.69.66.178:1699] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aSVA-ZwNRsoxcLQGkTdtKQAAAsI"]
[Tue Nov 25 13:39:06.117492 2025] [:error] [pid 14688:tid 14690] [client 40.69.66.178:14581] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aSVA-m9vYrBoEsiDnixosgAAAQA"]
[Tue Nov 25 13:39:06.619213 2025] [:error] [pid 14077:tid 14118] [client 40.69.66.178:12423] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSVA-hG9n7UHEkwDTyju0AAAAEg"]
[Tue Nov 25 13:39:07.119820 2025] [:error] [pid 14078:tid 14159] [client 40.69.66.178:5213] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSVA-9VXYbb0ii_rVoLg9AAAAJY"]
[Tue Nov 25 13:39:07.687886 2025] [:error] [pid 14076:tid 14104] [client 40.69.66.178:13628] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSVA-3sB4Gz6Qw-pvBuwswAAABc"]
[Tue Nov 25 13:39:08.188047 2025] [:error] [pid 14168:tid 14175] [client 40.69.66.178:9852] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSVA_PR-ZDU0QEgAIIsO3QAAAMQ"]
[Tue Nov 25 13:39:08.690230 2025] [:error] [pid 28740:tid 28813] [client 40.69.66.178:13600] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSVA_FppQCoYxWW6V0UeqQAAAlY"]
[Tue Nov 25 13:39:09.190424 2025] [:error] [pid 14078:tid 14158] [client 40.69.66.178:13595] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSVA_dVXYbb0ii_rVoLg_AAAAJU"]
[Tue Nov 25 13:39:09.689500 2025] [:error] [pid 14077:tid 14120] [client 40.69.66.178:12804] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSVA_RG9n7UHEkwDTyju7AAAAEo"]
[Tue Nov 25 13:39:10.192141 2025] [:error] [pid 28739:tid 28767] [client 40.69.66.178:5242] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSVA_hxGpKmlkG4FexQswgAAAgU"]
[Tue Nov 25 15:33:04.019323 2025] [:error] [pid 14078:tid 14160] [client 138.197.11.41:50719] [client 138.197.11.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.11.41, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSVbsNVXYbb0ii_rVoICvgAAAJc"]
[Tue Nov 25 15:33:04.025377 2025] [:error] [pid 14078:tid 14160] [client 138.197.11.41:50719] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Nov 25 18:53:07.661381 2025] [:error] [pid 28842:tid 28998] [client 138.199.60.187:45242] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Nov 25 18:53:07.788446 2025] [:error] [pid 28842:tid 29022] [client 138.199.60.187:45242] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWKk9NmoaPf6T4-6C2DmgAAA1Q"]
[Tue Nov 25 18:53:08.041408 2025] [:error] [pid 14076:tid 14092] [client 138.199.60.187:51070] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWKlHsB4Gz6Qw-pvBsKJAAAAAs"]
[Tue Nov 25 18:53:08.555421 2025] [:error] [pid 14076:tid 14087] [client 138.199.60.187:51454] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWKlHsB4Gz6Qw-pvBsKKwAAAAY"]
[Tue Nov 25 18:53:08.830403 2025] [:error] [pid 2987:tid 2994] [client 138.199.60.187:51606] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWKlM-djEt-pTzPxnyT8wAAAUU"]
[Tue Nov 25 18:53:09.086925 2025] [:error] [pid 14077:tid 14126] [client 138.199.60.187:51700] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWKlRG9n7UHEkwDTyh-IQAAAFA"]
[Tue Nov 25 18:53:12.044873 2025] [:error] [pid 28609:tid 28628] [client 138.199.60.187:52340] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aSWKmCGGdT-nZJVs3x248gAAAYo"]
[Tue Nov 25 18:53:12.307194 2025] [:error] [pid 28609:tid 28634] [client 138.199.60.187:53166] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aSWKmCGGdT-nZJVs3x249wAAAZA"]
[Tue Nov 25 18:53:12.566857 2025] [:error] [pid 14078:tid 14140] [client 138.199.60.187:53330] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aSWKmNVXYbb0ii_rVoI37gAAAIM"]
[Tue Nov 25 18:53:12.838312 2025] [:error] [pid 28836:tid 28969] [client 138.199.60.187:53530] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aSWKmJwNRsoxcLQGkTe3kgAAAs4"]
[Tue Nov 25 18:53:13.340073 2025] [:error] [pid 14077:tid 14113] [client 138.199.60.187:53834] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aSWKmRG9n7UHEkwDTyh-TgAAAEM"]
[Tue Nov 25 21:00:08.102072 2025] [:error] [pid 14168:tid 14179] [client 20.249.10.99:29696] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Tue Nov 25 21:00:08.257248 2025] [:error] [pid 14168:tid 14185] [client 20.249.10.99:29696] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Nov 25 21:00:08.876462 2025] [:error] [pid 14168:tid 14188] [client 20.249.10.99:29696] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Nov 25 21:00:09.031761 2025] [:error] [pid 14168:tid 14192] [client 20.249.10.99:29696] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Tue Nov 25 21:00:09.188868 2025] [:error] [pid 14168:tid 14179] [client 20.249.10.99:29696] File does not exist: /usr/local/apache/htdocs/suspended-page/mpvloi.php
[Tue Nov 25 21:00:09.336339 2025] [:error] [pid 14168:tid 14185] [client 20.249.10.99:29696] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/0.php"] [unique_id "aSWoWfR-ZDU0QEgAIIuAnAAAAM4"]
[Tue Nov 25 21:00:09.662857 2025] [:error] [pid 14076:tid 14096] [client 20.249.10.99:29727] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Nov 25 21:00:10.203498 2025] [:error] [pid 14076:tid 14096] [client 20.249.10.99:29727] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Tue Nov 25 21:00:10.352308 2025] [:error] [pid 14076:tid 14095] [client 20.249.10.99:29727] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/cs.php"] [unique_id "aSWoWnsB4Gz6Qw-pvBswrQAAAA4"]
[Tue Nov 25 21:00:10.667634 2025] [:error] [pid 14168:tid 14190] [client 20.249.10.99:29755] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wikindex.php"] [unique_id "aSWoWvR-ZDU0QEgAIIuAoAAAANM"]
[Tue Nov 25 21:00:10.964054 2025] [:error] [pid 14077:tid 14110] [client 20.249.10.99:29737] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wikindex.php"] [unique_id "aSWoWhG9n7UHEkwDTyi9UwAAAEA"]
[Tue Nov 25 21:00:11.296186 2025] [:error] [pid 14076:tid 14097] [client 20.249.10.99:29704] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wikindex.php"] [unique_id "aSWoW3sB4Gz6Qw-pvBswtAAAABA"]
[Tue Nov 25 21:00:11.624147 2025] [:error] [pid 14076:tid 14103] [client 20.249.10.99:29734] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aSWoW3sB4Gz6Qw-pvBswtwAAABY"]
[Tue Nov 25 21:00:11.955826 2025] [:error] [pid 14076:tid 14093] [client 20.249.10.99:29772] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aSWoW3sB4Gz6Qw-pvBswuAAAAAw"]
[Tue Nov 25 21:00:12.261831 2025] [:error] [pid 28836:tid 29008] [client 20.249.10.99:29776] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aSWoXJwNRsoxcLQGkTfb0wAAAtI"]
[Tue Nov 25 21:00:12.566675 2025] [:error] [pid 14077:tid 14113] [client 20.249.10.99:29713] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aSWoXBG9n7UHEkwDTyi9WwAAAEM"]
[Tue Nov 25 21:00:12.868462 2025] [:error] [pid 14077:tid 14130] [client 20.249.10.99:29769] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/kses.php"] [unique_id "aSWoXBG9n7UHEkwDTyi9XQAAAFQ"]
[Tue Nov 25 21:00:13.170327 2025] [:error] [pid 14077:tid 14117] [client 20.249.10.99:29702] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jagoan.php"] [unique_id "aSWoXRG9n7UHEkwDTyi9YQAAAEc"]
[Tue Nov 25 21:00:13.486918 2025] [:error] [pid 28609:tid 28636] [client 20.249.10.99:29742] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jagoan.php"] [unique_id "aSWoXSGGdT-nZJVs3x3dWAAAAZI"]
[Tue Nov 25 21:00:13.845925 2025] [:error] [pid 28836:tid 28965] [client 20.249.10.99:29731] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jagoan.php"] [unique_id "aSWoXZwNRsoxcLQGkTfb1QAAAso"]
[Tue Nov 25 21:00:14.186860 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:29717] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jagoan.php"] [unique_id "aSWoXpwNRsoxcLQGkTfb1wAAAsY"]
[Tue Nov 25 21:00:14.557452 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:29745] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/g3.php"] [unique_id "aSWoXtVXYbb0ii_rVoJmVwAAAIo"]
[Tue Nov 25 21:00:14.856943 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:29744] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/g3.php"] [unique_id "aSWoXiGGdT-nZJVs3x3dWgAAAYw"]
[Tue Nov 25 21:00:15.161408 2025] [:error] [pid 43981:tid 43986] [client 20.249.10.99:29722] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/g3.php"] [unique_id "aSWoXwgZn97m_qh_RaFZuAAAAwM"]
[Tue Nov 25 21:00:15.468181 2025] [:error] [pid 14078:tid 14145] [client 20.249.10.99:29746] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/g3.php"] [unique_id "aSWoX9VXYbb0ii_rVoJmWgAAAIg"]
[Tue Nov 25 21:00:15.790415 2025] [:error] [pid 28739:tid 28764] [client 20.249.10.99:29705] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/zaza.php"] [unique_id "aSWoXxxGpKmlkG4FexSWhAAAAgI"]
[Tue Nov 25 21:00:16.098863 2025] [:error] [pid 14076:tid 14089] [client 20.249.10.99:29712] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/zaza.php"] [unique_id "aSWoYHsB4Gz6Qw-pvBswwQAAAAg"]
[Tue Nov 25 21:00:16.413479 2025] [:error] [pid 28609:tid 28634] [client 20.249.10.99:29778] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/zaza.php"] [unique_id "aSWoYCGGdT-nZJVs3x3dXwAAAZA"]
[Tue Nov 25 21:00:16.711461 2025] [:error] [pid 14168:tid 14188] [client 20.249.10.99:29701] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/zaza.php"] [unique_id "aSWoYPR-ZDU0QEgAIIuAuAAAANE"]
[Tue Nov 25 21:00:17.036112 2025] [:error] [pid 14076:tid 14103] [client 20.249.10.99:29699] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWoYXsB4Gz6Qw-pvBswxAAAABY"]
[Tue Nov 25 21:00:17.379099 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:29709] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWoYdVXYbb0ii_rVoJmXAAAAJg"]
[Tue Nov 25 21:00:17.710857 2025] [:error] [pid 14078:tid 14155] [client 20.249.10.99:29753] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWoYdVXYbb0ii_rVoJmXwAAAJI"]
[Tue Nov 25 21:00:18.046822 2025] [:error] [pid 28609:tid 28640] [client 20.249.10.99:29771] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSWoYiGGdT-nZJVs3x3dYQAAAZY"]
[Tue Nov 25 21:00:18.368616 2025] [:error] [pid 28739:tid 28775] [client 20.249.10.99:29738] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aSWoYhxGpKmlkG4FexSWigAAAg0"]
[Tue Nov 25 21:00:18.684876 2025] [:error] [pid 14076:tid 14081] [client 20.249.10.99:29708] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aSWoYnsB4Gz6Qw-pvBsw0AAAAAA"]
[Tue Nov 25 21:00:18.982853 2025] [:error] [pid 28836:tid 28958] [client 20.249.10.99:29765] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aSWoYpwNRsoxcLQGkTfb2gAAAsM"]
[Tue Nov 25 21:00:19.332270 2025] [:error] [pid 14076:tid 14093] [client 20.249.10.99:29762] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aSWoY3sB4Gz6Qw-pvBsw2AAAAAw"]
[Tue Nov 25 21:00:19.645166 2025] [:error] [pid 28836:tid 28959] [client 20.249.10.99:29718] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aSWoY5wNRsoxcLQGkTfb3AAAAsQ"]
[Tue Nov 25 21:00:19.947704 2025] [:error] [pid 28739:tid 28771] [client 20.249.10.99:29724] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aSWoYxxGpKmlkG4FexSWjQAAAgk"]
[Tue Nov 25 21:00:20.289481 2025] [:error] [pid 14078:tid 14156] [client 20.249.10.99:29806] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aSWoZNVXYbb0ii_rVoJmaQAAAJM"]
[Tue Nov 25 21:00:20.595104 2025] [:error] [pid 43843:tid 43869] [client 20.249.10.99:29723] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aSWoZBhx4v3NUNdMKDPp1gAAAdg"]
[Tue Nov 25 21:00:20.907892 2025] [:error] [pid 28739:tid 28763] [client 20.249.10.99:29766] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cok.php"] [unique_id "aSWoZBxGpKmlkG4FexSWkwAAAgE"]
[Tue Nov 25 21:00:21.215043 2025] [:error] [pid 14076:tid 14095] [client 20.249.10.99:29756] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cok.php"] [unique_id "aSWoZXsB4Gz6Qw-pvBsw7AAAAA4"]
[Tue Nov 25 21:00:21.517931 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:29732] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cok.php"] [unique_id "aSWoZdVXYbb0ii_rVoJmbgAAAIk"]
[Tue Nov 25 21:00:21.821535 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:29752] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cok.php"] [unique_id "aSWoZRG9n7UHEkwDTyi9agAAAE0"]
[Tue Nov 25 21:00:22.141008 2025] [:error] [pid 14077:tid 14110] [client 20.249.10.99:30661] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hob.php"] [unique_id "aSWoZhG9n7UHEkwDTyi9bAAAAEA"]
[Tue Nov 25 21:00:22.443776 2025] [:error] [pid 14078:tid 14149] [client 20.249.10.99:30680] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hob.php"] [unique_id "aSWoZtVXYbb0ii_rVoJmcgAAAIw"]
[Tue Nov 25 21:00:22.794451 2025] [:error] [pid 28739:tid 28771] [client 20.249.10.99:29729] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hob.php"] [unique_id "aSWoZhxGpKmlkG4FexSWmgAAAgk"]
[Tue Nov 25 21:00:23.093807 2025] [:error] [pid 14078:tid 14159] [client 20.249.10.99:29726] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hob.php"] [unique_id "aSWoZ9VXYbb0ii_rVoJmdQAAAJY"]
[Tue Nov 25 21:00:23.392304 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:29781] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kal.php"] [unique_id "aSWoZ3sB4Gz6Qw-pvBsw7wAAAAQ"]
[Tue Nov 25 21:00:23.701833 2025] [:error] [pid 28739:tid 28768] [client 20.249.10.99:29818] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kal.php"] [unique_id "aSWoZxxGpKmlkG4FexSWoQAAAgY"]
[Tue Nov 25 21:00:24.027407 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:29790] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kal.php"] [unique_id "aSWoaBG9n7UHEkwDTyi9cQAAAFI"]
[Tue Nov 25 21:00:24.324637 2025] [:error] [pid 28609:tid 28638] [client 20.249.10.99:29758] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kal.php"] [unique_id "aSWoaCGGdT-nZJVs3x3dbwAAAZQ"]
[Tue Nov 25 21:00:24.648990 2025] [:error] [pid 43843:tid 43852] [client 20.249.10.99:29736] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aSWoaBhx4v3NUNdMKDPp2gAAAcc"]
[Tue Nov 25 21:00:24.965334 2025] [:error] [pid 28609:tid 28637] [client 20.249.10.99:29783] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aSWoaCGGdT-nZJVs3x3dcgAAAZM"]
[Tue Nov 25 21:00:25.262233 2025] [:error] [pid 43843:tid 43847] [client 20.249.10.99:29761] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aSWoaRhx4v3NUNdMKDPp2wAAAcI"]
[Tue Nov 25 21:00:25.552565 2025] [:error] [pid 28609:tid 28626] [client 20.249.10.99:29803] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aSWoaSGGdT-nZJVs3x3ddQAAAYg"]
[Tue Nov 25 21:00:25.846344 2025] [:error] [pid 28739:tid 28773] [client 20.249.10.99:29735] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aSWoaRxGpKmlkG4FexSWsAAAAgs"]
[Tue Nov 25 21:00:26.141371 2025] [:error] [pid 28609:tid 28631] [client 20.249.10.99:29768] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aSWoaiGGdT-nZJVs3x3ddgAAAY0"]
[Tue Nov 25 21:00:26.435341 2025] [:error] [pid 43981:tid 43994] [client 20.249.10.99:29721] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aSWoaggZn97m_qh_RaFZ3QAAAws"]
[Tue Nov 25 21:00:26.728030 2025] [:error] [pid 43981:tid 44007] [client 20.249.10.99:29749] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aSWoaggZn97m_qh_RaFZ3gAAAxg"]
[Tue Nov 25 21:00:27.026223 2025] [:error] [pid 43843:tid 43868] [client 20.249.10.99:29797] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1w.php"] [unique_id "aSWoaxhx4v3NUNdMKDPp3QAAAdc"]
[Tue Nov 25 21:00:27.323081 2025] [:error] [pid 28739:tid 28782] [client 20.249.10.99:29714] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1w.php"] [unique_id "aSWoaxxGpKmlkG4FexSWtQAAAhQ"]
[Tue Nov 25 21:00:27.618751 2025] [:error] [pid 2987:tid 3013] [client 20.249.10.99:29792] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1w.php"] [unique_id "aSWoa8-djEt-pTzPxny9ogAAAVg"]
[Tue Nov 25 21:00:27.917089 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:29787] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1w.php"] [unique_id "aSWoayGGdT-nZJVs3x3djgAAAZc"]
[Tue Nov 25 21:00:28.212666 2025] [:error] [pid 43981:tid 43996] [client 20.249.10.99:29743] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aSWobAgZn97m_qh_RaFZ4wAAAw0"]
[Tue Nov 25 21:00:28.510399 2025] [:error] [pid 28609:tid 28636] [client 20.249.10.99:29793] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aSWobCGGdT-nZJVs3x3dkwAAAZI"]
[Tue Nov 25 21:00:28.807079 2025] [:error] [pid 43981:tid 43999] [client 20.249.10.99:29748] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aSWobAgZn97m_qh_RaFZ5AAAAxA"]
[Tue Nov 25 21:00:29.099885 2025] [:error] [pid 2987:tid 2989] [client 20.249.10.99:30656] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aSWobc-djEt-pTzPxny9sAAAAUA"]
[Tue Nov 25 21:00:29.394651 2025] [:error] [pid 2987:tid 3008] [client 20.249.10.99:29716] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cafe.php"] [unique_id "aSWobc-djEt-pTzPxny9sQAAAVM"]
[Tue Nov 25 21:00:29.699250 2025] [:error] [pid 2987:tid 3006] [client 20.249.10.99:29698] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cafe.php"] [unique_id "aSWobc-djEt-pTzPxny9sgAAAVE"]
[Tue Nov 25 21:00:30.015200 2025] [:error] [pid 28739:tid 28786] [client 20.249.10.99:30665] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cafe.php"] [unique_id "aSWobhxGpKmlkG4FexSWuAAAAhg"]
[Tue Nov 25 21:00:30.316484 2025] [:error] [pid 28609:tid 28622] [client 20.249.10.99:29779] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cafe.php"] [unique_id "aSWobiGGdT-nZJVs3x3dmQAAAYQ"]
[Tue Nov 25 21:00:30.609695 2025] [:error] [pid 43981:tid 44002] [client 20.249.10.99:29784] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww2.php"] [unique_id "aSWobggZn97m_qh_RaFZ5wAAAxM"]
[Tue Nov 25 21:00:30.902601 2025] [:error] [pid 43981:tid 43998] [client 20.249.10.99:29703] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww2.php"] [unique_id "aSWobggZn97m_qh_RaFZ6AAAAw8"]
[Tue Nov 25 21:00:31.270431 2025] [:error] [pid 43843:tid 43869] [client 20.249.10.99:29807] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww2.php"] [unique_id "aSWobxhx4v3NUNdMKDPp4gAAAdg"]
[Tue Nov 25 21:00:31.596435 2025] [:error] [pid 28836:tid 28986] [client 20.249.10.99:29805] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww2.php"] [unique_id "aSWob5wNRsoxcLQGkTfcAwAAAs8"]
[Tue Nov 25 21:00:31.896191 2025] [:error] [pid 43981:tid 43991] [client 20.249.10.99:29821] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aSWobwgZn97m_qh_RaFZ6QAAAwg"]
[Tue Nov 25 21:00:32.202101 2025] [:error] [pid 43843:tid 43860] [client 20.249.10.99:29715] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aSWocBhx4v3NUNdMKDPp5AAAAc8"]
[Tue Nov 25 21:00:32.503329 2025] [:error] [pid 43981:tid 44000] [client 20.249.10.99:29773] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aSWocAgZn97m_qh_RaFZ7AAAAxE"]
[Tue Nov 25 21:00:32.798481 2025] [:error] [pid 14078:tid 14142] [client 20.249.10.99:29775] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aSWocNVXYbb0ii_rVoJmhQAAAIU"]
[Tue Nov 25 21:00:33.090439 2025] [:error] [pid 14078:tid 14152] [client 20.249.10.99:29780] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSWocdVXYbb0ii_rVoJmhgAAAI8"]
[Tue Nov 25 21:00:33.400308 2025] [:error] [pid 14076:tid 14091] [client 20.249.10.99:30671] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSWocXsB4Gz6Qw-pvBsw-QAAAAo"]
[Tue Nov 25 21:00:33.698532 2025] [:error] [pid 28836:tid 28957] [client 20.249.10.99:29814] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSWocZwNRsoxcLQGkTfcCAAAAsI"]
[Tue Nov 25 21:00:34.014692 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:29788] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww4.php"] [unique_id "aSWocpwNRsoxcLQGkTfcCQAAAsY"]
[Tue Nov 25 21:00:34.319861 2025] [:error] [pid 14077:tid 14133] [client 20.249.10.99:29725] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSWochG9n7UHEkwDTyi9eQAAAFc"]
[Tue Nov 25 21:00:34.615188 2025] [:error] [pid 28739:tid 28773] [client 20.249.10.99:29719] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSWochxGpKmlkG4FexSWygAAAgs"]
[Tue Nov 25 21:00:34.914749 2025] [:error] [pid 43843:tid 43850] [client 20.249.10.99:30694] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSWochhx4v3NUNdMKDPp5wAAAcU"]
[Tue Nov 25 21:00:35.213705 2025] [:error] [pid 43981:tid 43988] [client 20.249.10.99:29791] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSWocwgZn97m_qh_RaFZ7wAAAwU"]
[Tue Nov 25 21:00:35.515186 2025] [:error] [pid 14076:tid 14105] [client 20.249.10.99:29747] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSWoc3sB4Gz6Qw-pvBsw-wAAABg"]
[Tue Nov 25 21:00:35.808188 2025] [:error] [pid 28739:tid 28769] [client 20.249.10.99:29757] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSWocxxGpKmlkG4FexSWzwAAAgc"]
[Tue Nov 25 21:00:36.098135 2025] [:error] [pid 28739:tid 28762] [client 20.249.10.99:30705] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSWodBxGpKmlkG4FexSW0QAAAgA"]
[Tue Nov 25 21:00:36.391435 2025] [:error] [pid 14076:tid 14104] [client 20.249.10.99:30600] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aSWodHsB4Gz6Qw-pvBsw_QAAABc"]
[Tue Nov 25 21:00:36.689728 2025] [:error] [pid 14078:tid 14141] [client 20.249.10.99:30682] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWodNVXYbb0ii_rVoJmigAAAIQ"]
[Tue Nov 25 21:00:36.989837 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:30657] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWodNVXYbb0ii_rVoJmjQAAAIo"]
[Tue Nov 25 21:00:37.341580 2025] [:error] [pid 43981:tid 44004] [client 20.249.10.99:29786] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWodQgZn97m_qh_RaFZ8gAAAxU"]
[Tue Nov 25 21:00:37.647443 2025] [:error] [pid 28609:tid 28620] [client 20.249.10.99:30697] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWodSGGdT-nZJVs3x3dogAAAYI"]
[Tue Nov 25 21:00:37.951521 2025] [:error] [pid 14076:tid 14101] [client 20.249.10.99:29720] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aSWodXsB4Gz6Qw-pvBsxBAAAABQ"]
[Tue Nov 25 21:00:38.378038 2025] [:error] [pid 28739:tid 28770] [client 20.249.10.99:30690] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aSWodhxGpKmlkG4FexSW1wAAAgg"]
[Tue Nov 25 21:00:38.727511 2025] [:error] [pid 28739:tid 28773] [client 20.249.10.99:29801] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aSWodhxGpKmlkG4FexSW2gAAAgs"]
[Tue Nov 25 21:00:39.050106 2025] [:error] [pid 28609:tid 28623] [client 20.249.10.99:29733] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aSWodyGGdT-nZJVs3x3dpAAAAYU"]
[Tue Nov 25 21:00:39.346627 2025] [:error] [pid 14077:tid 14130] [client 20.249.10.99:30687] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aSWodxG9n7UHEkwDTyi9gAAAAFQ"]
[Tue Nov 25 21:00:39.639511 2025] [:error] [pid 43843:tid 43854] [client 20.249.10.99:29798] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aSWodxhx4v3NUNdMKDPp7QAAAck"]
[Tue Nov 25 21:00:39.932468 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:29777] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aSWodxG9n7UHEkwDTyi9hQAAAE0"]
[Tue Nov 25 21:00:40.229557 2025] [:error] [pid 14077:tid 14134] [client 20.249.10.99:29764] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aSWoeBG9n7UHEkwDTyi9hwAAAFg"]
[Tue Nov 25 21:00:40.521245 2025] [:error] [pid 14168:tid 14174] [client 20.249.10.99:29823] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSWoePR-ZDU0QEgAIIuA0gAAAMM"]
[Tue Nov 25 21:00:40.810335 2025] [:error] [pid 14078:tid 14159] [client 20.249.10.99:29808] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSWoeNVXYbb0ii_rVoJmkAAAAJY"]
[Tue Nov 25 21:00:41.114966 2025] [:error] [pid 14077:tid 14125] [client 20.249.10.99:29741] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSWoeRG9n7UHEkwDTyi9iwAAAE8"]
[Tue Nov 25 21:00:41.412169 2025] [:error] [pid 28609:tid 28618] [client 20.249.10.99:29760] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSWoeSGGdT-nZJVs3x3dqAAAAYA"]
[Tue Nov 25 21:00:41.714958 2025] [:error] [pid 28609:tid 28637] [client 20.249.10.99:29767] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aSWoeSGGdT-nZJVs3x3dqgAAAZM"]
[Tue Nov 25 21:00:42.017945 2025] [:error] [pid 28609:tid 28640] [client 20.249.10.99:29800] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aSWoeiGGdT-nZJVs3x3dqwAAAZY"]
[Tue Nov 25 21:00:42.313602 2025] [:error] [pid 28609:tid 28625] [client 20.249.10.99:29782] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aSWoeiGGdT-nZJVs3x3drAAAAYc"]
[Tue Nov 25 21:00:42.612887 2025] [:error] [pid 14077:tid 14129] [client 20.249.10.99:29707] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aSWoehG9n7UHEkwDTyi9jwAAAFM"]
[Tue Nov 25 21:00:42.905851 2025] [:error] [pid 28609:tid 28628] [client 20.249.10.99:29817] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWoeiGGdT-nZJVs3x3drgAAAYo"]
[Tue Nov 25 21:00:43.199326 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:30683] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWoeyGGdT-nZJVs3x3dsAAAAZc"]
[Tue Nov 25 21:00:43.504498 2025] [:error] [pid 14078:tid 14160] [client 20.249.10.99:29763] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWoe9VXYbb0ii_rVoJmkwAAAJc"]
[Tue Nov 25 21:00:43.802326 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:30594] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aSWoe9VXYbb0ii_rVoJmlAAAAIY"]
[Tue Nov 25 21:00:44.094955 2025] [:error] [pid 28739:tid 28772] [client 20.249.10.99:29813] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWofBxGpKmlkG4FexSW5gAAAgo"]
[Tue Nov 25 21:00:44.392663 2025] [:error] [pid 43981:tid 44007] [client 20.249.10.99:30666] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWofAgZn97m_qh_RaFZ-QAAAxg"]
[Tue Nov 25 21:00:44.699517 2025] [:error] [pid 14076:tid 14103] [client 20.249.10.99:30660] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWofHsB4Gz6Qw-pvBsxDgAAABY"]
[Tue Nov 25 21:00:45.002595 2025] [:error] [pid 14076:tid 14087] [client 20.249.10.99:29784] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSWofXsB4Gz6Qw-pvBsxEQAAAAY"]
[Tue Nov 25 21:00:45.295060 2025] [:error] [pid 28739:tid 28764] [client 20.249.10.99:29710] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWofRxGpKmlkG4FexSW6AAAAgI"]
[Tue Nov 25 21:00:45.591025 2025] [:error] [pid 28739:tid 28780] [client 20.249.10.99:29822] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWofRxGpKmlkG4FexSW6gAAAhI"]
[Tue Nov 25 21:00:45.887351 2025] [:error] [pid 43843:tid 43860] [client 20.249.10.99:29697] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWofRhx4v3NUNdMKDPp7wAAAc8"]
[Tue Nov 25 21:00:46.192140 2025] [:error] [pid 43981:tid 43997] [client 20.249.10.99:29751] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSWofggZn97m_qh_RaFZ_QAAAw4"]
[Tue Nov 25 21:00:46.488619 2025] [:error] [pid 2987:tid 3005] [client 20.249.10.99:30685] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWofs-djEt-pTzPxny9xQAAAVA"]
[Tue Nov 25 21:00:46.783541 2025] [:error] [pid 14168:tid 14176] [client 20.249.10.99:30706] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWofvR-ZDU0QEgAIIuA5AAAAMU"]
[Tue Nov 25 21:00:47.086334 2025] [:error] [pid 28836:tid 28967] [client 20.249.10.99:30670] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWof5wNRsoxcLQGkTfcHAAAAsw"]
[Tue Nov 25 21:00:47.385098 2025] [:error] [pid 43843:tid 43850] [client 20.249.10.99:29799] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSWofxhx4v3NUNdMKDPp8gAAAcU"]
[Tue Nov 25 21:00:47.689689 2025] [:error] [pid 28609:tid 28626] [client 20.249.10.99:29812] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aSWofyGGdT-nZJVs3x3dvAAAAYg"]
[Tue Nov 25 21:00:47.989517 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:29789] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aSWof9VXYbb0ii_rVoJmpAAAAIE"]
[Tue Nov 25 21:00:48.288779 2025] [:error] [pid 43843:tid 43856] [client 20.249.10.99:30700] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aSWogBhx4v3NUNdMKDPp9AAAAcs"]
[Tue Nov 25 21:00:48.586231 2025] [:error] [pid 14076:tid 14098] [client 20.249.10.99:30669] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aSWogHsB4Gz6Qw-pvBsxGQAAABE"]
[Tue Nov 25 21:00:48.884693 2025] [:error] [pid 28836:tid 28968] [client 20.249.10.99:29706] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSWogJwNRsoxcLQGkTfcHwAAAs0"]
[Tue Nov 25 21:00:49.179928 2025] [:error] [pid 28739:tid 28765] [client 20.249.10.99:30701] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSWogRxGpKmlkG4FexSW8wAAAgM"]
[Tue Nov 25 21:00:49.476139 2025] [:error] [pid 28739:tid 28763] [client 20.249.10.99:29816] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSWogRxGpKmlkG4FexSW9QAAAgE"]
[Tue Nov 25 21:00:49.783393 2025] [:error] [pid 43981:tid 43999] [client 20.249.10.99:30697] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aSWogQgZn97m_qh_RaFaAgAAAxA"]
[Tue Nov 25 21:00:50.088531 2025] [:error] [pid 43843:tid 43846] [client 20.249.10.99:29819] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSWoghhx4v3NUNdMKDPp-AAAAcE"]
[Tue Nov 25 21:00:50.391344 2025] [:error] [pid 28739:tid 28786] [client 20.249.10.99:30704] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSWoghxGpKmlkG4FexSW-QAAAhg"]
[Tue Nov 25 21:00:50.690668 2025] [:error] [pid 14077:tid 14121] [client 20.249.10.99:30622] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSWoghG9n7UHEkwDTyi9kwAAAEs"]
[Tue Nov 25 21:00:51.013022 2025] [:error] [pid 43981:tid 43992] [client 20.249.10.99:30677] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aSWogwgZn97m_qh_RaFaAwAAAwk"]
[Tue Nov 25 21:00:51.309317 2025] [:error] [pid 28609:tid 28637] [client 20.249.10.99:29811] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSWogyGGdT-nZJVs3x3dxQAAAZM"]
[Tue Nov 25 21:00:51.614432 2025] [:error] [pid 28836:tid 29014] [client 20.249.10.99:29804] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSWog5wNRsoxcLQGkTfcIAAAAtg"]
[Tue Nov 25 21:00:51.909598 2025] [:error] [pid 28609:tid 28631] [client 20.249.10.99:30658] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSWogyGGdT-nZJVs3x3dxwAAAY0"]
[Tue Nov 25 21:00:52.210599 2025] [:error] [pid 43843:tid 43855] [client 20.249.10.99:29796] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSWohBhx4v3NUNdMKDPp-QAAAco"]
[Tue Nov 25 21:00:52.509504 2025] [:error] [pid 28609:tid 28628] [client 20.249.10.99:29785] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "aSWohCGGdT-nZJVs3x3dyQAAAYo"]
[Tue Nov 25 21:00:52.816934 2025] [:error] [pid 14078:tid 14155] [client 20.249.10.99:30618] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "aSWohNVXYbb0ii_rVoJmsAAAAJI"]
[Tue Nov 25 21:00:53.110501 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:30715] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "aSWohdVXYbb0ii_rVoJmsgAAAIY"]
[Tue Nov 25 21:00:53.405589 2025] [:error] [pid 14078:tid 14160] [client 20.249.10.99:30688] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "aSWohdVXYbb0ii_rVoJmtQAAAJc"]
[Tue Nov 25 21:00:53.719872 2025] [:error] [pid 28609:tid 28632] [client 20.249.10.99:30629] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aSWohSGGdT-nZJVs3x3dzAAAAY4"]
[Tue Nov 25 21:00:54.020954 2025] [:error] [pid 28609:tid 28637] [client 20.249.10.99:29810] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aSWohiGGdT-nZJVs3x3d0AAAAZM"]
[Tue Nov 25 21:00:54.327270 2025] [:error] [pid 14076:tid 14099] [client 20.249.10.99:29740] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aSWohnsB4Gz6Qw-pvBsxHgAAABI"]
[Tue Nov 25 21:00:54.633254 2025] [:error] [pid 2987:tid 3009] [client 20.249.10.99:30645] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aSWohs-djEt-pTzPxny9zwAAAVQ"]
[Tue Nov 25 21:00:54.929444 2025] [:error] [pid 28739:tid 28778] [client 20.249.10.99:30691] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aSWohhxGpKmlkG4FexSXBQAAAhA"]
[Tue Nov 25 21:00:55.228736 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:30708] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aSWohxG9n7UHEkwDTyi9mAAAAEI"]
[Tue Nov 25 21:00:55.524964 2025] [:error] [pid 14078:tid 14149] [client 20.249.10.99:30659] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aSWoh9VXYbb0ii_rVoJmuAAAAIw"]
[Tue Nov 25 21:00:55.817929 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:30651] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aSWohxxGpKmlkG4FexSXCQAAAgQ"]
[Tue Nov 25 21:00:56.113011 2025] [:error] [pid 28739:tid 28785] [client 20.249.10.99:30614] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWoiBxGpKmlkG4FexSXDAAAAhc"]
[Tue Nov 25 21:00:56.406950 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:29802] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWoiCGGdT-nZJVs3x3d1wAAAYM"]
[Tue Nov 25 21:00:56.703093 2025] [:error] [pid 14168:tid 14174] [client 20.249.10.99:30707] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWoiPR-ZDU0QEgAIIuA7AAAAMM"]
[Tue Nov 25 21:00:56.999134 2025] [:error] [pid 2987:tid 2993] [client 20.249.10.99:30672] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWoiM-djEt-pTzPxny90gAAAUQ"]
[Tue Nov 25 21:00:57.299034 2025] [:error] [pid 14168:tid 14193] [client 20.249.10.99:30696] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aSWoifR-ZDU0QEgAIIuA7QAAANY"]
[Tue Nov 25 21:00:57.595882 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:29794] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aSWoiSGGdT-nZJVs3x3d2wAAAZE"]
[Tue Nov 25 21:00:57.890682 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:29795] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aSWoidVXYbb0ii_rVoJmvAAAAIE"]
[Tue Nov 25 21:00:58.208451 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:30664] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aSWoipwNRsoxcLQGkTfcJQAAAtY"]
[Tue Nov 25 21:00:58.515721 2025] [:error] [pid 28609:tid 28634] [client 20.249.10.99:30679] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSWoiiGGdT-nZJVs3x3d4QAAAZA"]
[Tue Nov 25 21:00:58.811881 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:30635] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSWoiiGGdT-nZJVs3x3d4gAAAZc"]
[Tue Nov 25 21:00:59.149371 2025] [:error] [pid 43843:tid 43860] [client 20.249.10.99:30693] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSWoixhx4v3NUNdMKDPqAQAAAc8"]
[Tue Nov 25 21:00:59.442561 2025] [:error] [pid 43843:tid 43856] [client 20.249.10.99:30667] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aSWoixhx4v3NUNdMKDPqBAAAAcs"]
[Tue Nov 25 21:00:59.739839 2025] [:error] [pid 43843:tid 43859] [client 20.249.10.99:30596] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSWoixhx4v3NUNdMKDPqBQAAAc4"]
[Tue Nov 25 21:01:00.034824 2025] [:error] [pid 28836:tid 29007] [client 20.249.10.99:30678] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/termps.php"] [unique_id "aSWojJwNRsoxcLQGkTfcJwAAAtE"]
[Tue Nov 25 21:01:00.331584 2025] [:error] [pid 2987:tid 3008] [client 20.249.10.99:29739] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/termps.php"] [unique_id "aSWojM-djEt-pTzPxny92QAAAVM"]
[Tue Nov 25 21:01:00.653420 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:30684] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/termps.php"] [unique_id "aSWojCGGdT-nZJVs3x3d5QAAAYw"]
[Tue Nov 25 21:01:00.950984 2025] [:error] [pid 14077:tid 14122] [client 20.249.10.99:29750] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/termps.php"] [unique_id "aSWojBG9n7UHEkwDTyi9mwAAAEw"]
[Tue Nov 25 21:01:01.254393 2025] [:error] [pid 43843:tid 43866] [client 20.249.10.99:30662] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aSWojRhx4v3NUNdMKDPqCQAAAdU"]
[Tue Nov 25 21:01:01.549611 2025] [:error] [pid 14077:tid 14127] [client 20.249.10.99:30552] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aSWojRG9n7UHEkwDTyi9nQAAAFE"]
[Tue Nov 25 21:01:01.849310 2025] [:error] [pid 14076:tid 14105] [client 20.249.10.99:29754] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aSWojXsB4Gz6Qw-pvBsxIgAAABg"]
[Tue Nov 25 21:01:02.148953 2025] [:error] [pid 14077:tid 14124] [client 20.249.10.99:29774] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aSWojhG9n7UHEkwDTyi9oAAAAE4"]
[Tue Nov 25 21:01:02.656875 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:30719] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWojhG9n7UHEkwDTyi9ogAAAFI"]
[Tue Nov 25 21:01:02.952369 2025] [:error] [pid 28836:tid 28968] [client 20.249.10.99:30598] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWojpwNRsoxcLQGkTfcLwAAAs0"]
[Tue Nov 25 21:01:03.250701 2025] [:error] [pid 28836:tid 29011] [client 20.249.10.99:30668] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWoj5wNRsoxcLQGkTfcMQAAAtU"]
[Tue Nov 25 21:01:03.549564 2025] [:error] [pid 14168:tid 14190] [client 20.249.10.99:30593] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSWoj_R-ZDU0QEgAIIuA9AAAANM"]
[Tue Nov 25 21:01:03.847222 2025] [:error] [pid 28739:tid 28777] [client 20.249.10.99:30703] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aSWojxxGpKmlkG4FexSXHgAAAg8"]
[Tue Nov 25 21:01:04.142422 2025] [:error] [pid 28739:tid 28786] [client 20.249.10.99:30643] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aSWokBxGpKmlkG4FexSXIAAAAhg"]
[Tue Nov 25 21:01:04.439979 2025] [:error] [pid 2987:tid 2990] [client 20.249.10.99:30674] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aSWokM-djEt-pTzPxny93QAAAUE"]
[Tue Nov 25 21:01:04.739693 2025] [:error] [pid 14168:tid 14184] [client 20.249.10.99:30633] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aSWokPR-ZDU0QEgAIIuA-AAAAM0"]
[Tue Nov 25 21:01:05.043133 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:30595] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSWokXsB4Gz6Qw-pvBsxJwAAAAQ"]
[Tue Nov 25 21:01:05.342256 2025] [:error] [pid 14077:tid 14114] [client 20.249.10.99:30702] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSWokRG9n7UHEkwDTyi9pwAAAEQ"]
[Tue Nov 25 21:01:05.638809 2025] [:error] [pid 14077:tid 14129] [client 20.249.10.99:30630] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSWokRG9n7UHEkwDTyi9qAAAAFM"]
[Tue Nov 25 21:01:05.934087 2025] [:error] [pid 28609:tid 28642] [client 20.249.10.99:30698] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aSWokSGGdT-nZJVs3x3d8gAAAZg"]
[Tue Nov 25 21:01:06.228937 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:30716] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWoktVXYbb0ii_rVoJmzQAAAIM"]
[Tue Nov 25 21:01:06.523286 2025] [:error] [pid 28836:tid 28960] [client 20.249.10.99:30689] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWokpwNRsoxcLQGkTfcNwAAAsU"]
[Tue Nov 25 21:01:06.818672 2025] [:error] [pid 14076:tid 14084] [client 20.249.10.99:30620] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWoknsB4Gz6Qw-pvBsxKAAAAAM"]
[Tue Nov 25 21:01:07.114500 2025] [:error] [pid 14076:tid 14092] [client 20.249.10.99:30605] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWok3sB4Gz6Qw-pvBsxKQAAAAs"]
[Tue Nov 25 21:01:07.408267 2025] [:error] [pid 14076:tid 14097] [client 20.249.10.99:30648] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSWok3sB4Gz6Qw-pvBsxKgAAABA"]
[Tue Nov 25 21:01:07.709749 2025] [:error] [pid 14077:tid 14131] [client 20.249.10.99:30710] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSWokxG9n7UHEkwDTyi9qQAAAFU"]
[Tue Nov 25 21:01:08.009777 2025] [:error] [pid 14076:tid 14081] [client 20.249.10.99:30673] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSWolHsB4Gz6Qw-pvBsxLAAAAAA"]
[Tue Nov 25 21:01:08.308451 2025] [:error] [pid 14076:tid 14102] [client 20.249.10.99:30709] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aSWolHsB4Gz6Qw-pvBsxLQAAABU"]
[Tue Nov 25 21:01:08.601432 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:30654] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSWolNVXYbb0ii_rVoJm0gAAAIk"]
[Tue Nov 25 21:01:08.894213 2025] [:error] [pid 14078:tid 14139] [client 20.249.10.99:30611] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSWolNVXYbb0ii_rVoJm0wAAAII"]
[Tue Nov 25 21:01:09.189709 2025] [:error] [pid 14076:tid 14093] [client 20.249.10.99:30613] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSWolXsB4Gz6Qw-pvBsxLgAAAAw"]
[Tue Nov 25 21:01:09.486511 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:30550] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/product.php"] [unique_id "aSWolc-djEt-pTzPxny94QAAAUg"]
[Tue Nov 25 21:01:09.779734 2025] [:error] [pid 14168:tid 14183] [client 20.249.10.99:29700] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/function.php"] [unique_id "aSWolfR-ZDU0QEgAIIuBAgAAAMw"]
[Tue Nov 25 21:01:10.224330 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Nov 25 21:01:10.373812 2025] [:error] [pid 28739:tid 28782] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Nov 25 21:01:10.526991 2025] [:error] [pid 28739:tid 28768] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Nov 25 21:01:10.829596 2025] [:error] [pid 28739:tid 28783] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Nov 25 21:01:10.977867 2025] [:error] [pid 28739:tid 28773] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Nov 25 21:01:11.297566 2025] [:error] [pid 28739:tid 28779] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Nov 25 21:01:11.447437 2025] [:error] [pid 28739:tid 28776] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue Nov 25 21:01:11.596804 2025] [:error] [pid 28739:tid 28762] [client 20.249.10.99:30641] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Nov 25 21:01:11.742447 2025] [:error] [pid 28739:tid 28778] [client 20.249.10.99:30641] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWolxxGpKmlkG4FexSXOgAAAhA"]
[Tue Nov 25 21:01:12.047559 2025] [:error] [pid 14168:tid 14178] [client 20.249.10.99:29770] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWomPR-ZDU0QEgAIIuBBQAAAMc"]
[Tue Nov 25 21:01:12.344426 2025] [:error] [pid 14168:tid 14184] [client 20.249.10.99:30692] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWomPR-ZDU0QEgAIIuBBwAAAM0"]
[Tue Nov 25 21:01:12.637437 2025] [:error] [pid 14078:tid 14145] [client 20.249.10.99:30644] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWomNVXYbb0ii_rVoJm2wAAAIg"]
[Tue Nov 25 21:01:12.935068 2025] [:error] [pid 43981:tid 43990] [client 20.249.10.99:30699] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSWomAgZn97m_qh_RaFaFAAAAwc"]
[Tue Nov 25 21:01:13.239792 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:29711] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSWomdVXYbb0ii_rVoJm3QAAAIE"]
[Tue Nov 25 21:01:13.553301 2025] [:error] [pid 43843:tid 43862] [client 20.249.10.99:30639] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSWomRhx4v3NUNdMKDPqEQAAAdE"]
[Tue Nov 25 21:01:13.848950 2025] [:error] [pid 28836:tid 29009] [client 20.249.10.99:30625] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aSWomZwNRsoxcLQGkTfcOwAAAtM"]
[Tue Nov 25 21:01:14.149062 2025] [:error] [pid 14168:tid 14179] [client 20.249.10.99:30717] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWomvR-ZDU0QEgAIIuBCgAAAMg"]
[Tue Nov 25 21:01:14.452194 2025] [:error] [pid 14168:tid 14195] [client 20.249.10.99:30612] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWomvR-ZDU0QEgAIIuBDQAAANg"]
[Tue Nov 25 21:01:14.745101 2025] [:error] [pid 43981:tid 44006] [client 20.249.10.99:30711] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWomggZn97m_qh_RaFaGQAAAxc"]
[Tue Nov 25 21:01:15.041168 2025] [:error] [pid 28836:tid 29008] [client 20.249.10.99:30601] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aSWom5wNRsoxcLQGkTfcPAAAAtI"]
[Tue Nov 25 21:01:15.334759 2025] [:error] [pid 14076:tid 14105] [client 20.249.10.99:30609] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSWom3sB4Gz6Qw-pvBsxMAAAABg"]
[Tue Nov 25 21:01:15.629583 2025] [:error] [pid 28609:tid 28628] [client 20.249.10.99:30602] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSWomyGGdT-nZJVs3x3eBAAAAYo"]
[Tue Nov 25 21:01:15.924123 2025] [:error] [pid 14078:tid 14150] [client 20.249.10.99:30606] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSWom9VXYbb0ii_rVoJm3gAAAI0"]
[Tue Nov 25 21:01:16.226548 2025] [:error] [pid 28739:tid 28765] [client 20.249.10.99:30534] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSWonBxGpKmlkG4FexSXQQAAAgM"]
[Tue Nov 25 21:01:16.521700 2025] [:error] [pid 14077:tid 14133] [client 20.249.10.99:30617] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aSWonBG9n7UHEkwDTyi9rAAAAFc"]
[Tue Nov 25 21:01:16.816762 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:30647] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aSWonCGGdT-nZJVs3x3eBQAAAYw"]
[Tue Nov 25 21:01:17.111091 2025] [:error] [pid 43981:tid 43984] [client 20.249.10.99:30634] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aSWonQgZn97m_qh_RaFaHQAAAwE"]
[Tue Nov 25 21:01:17.401413 2025] [:error] [pid 43843:tid 43857] [client 20.249.10.99:30599] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aSWonRhx4v3NUNdMKDPqFQAAAcw"]
[Tue Nov 25 21:01:17.699372 2025] [:error] [pid 43981:tid 43999] [client 20.249.10.99:30713] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSWonQgZn97m_qh_RaFaHwAAAxA"]
[Tue Nov 25 21:01:17.992001 2025] [:error] [pid 43843:tid 43860] [client 20.249.10.99:30718] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSWonRhx4v3NUNdMKDPqFgAAAc8"]
[Tue Nov 25 21:01:18.283260 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:30636] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSWonhxGpKmlkG4FexSXRQAAAgQ"]
[Tue Nov 25 21:01:18.578780 2025] [:error] [pid 28836:tid 29010] [client 20.249.10.99:30530] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSWonpwNRsoxcLQGkTfcPwAAAtQ"]
[Tue Nov 25 21:01:18.881339 2025] [:error] [pid 28609:tid 28626] [client 20.249.10.99:30605] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aSWoniGGdT-nZJVs3x3eBgAAAYg"]
[Tue Nov 25 21:01:19.185933 2025] [:error] [pid 28609:tid 28633] [client 20.249.10.99:30646] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aSWonyGGdT-nZJVs3x3eBwAAAY8"]
[Tue Nov 25 21:01:19.504446 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:30615] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aSWonxG9n7UHEkwDTyi9sQAAAEI"]
[Tue Nov 25 21:01:19.802902 2025] [:error] [pid 28836:tid 28965] [client 20.249.10.99:30472] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aSWon5wNRsoxcLQGkTfcQAAAAso"]
[Tue Nov 25 21:01:20.101097 2025] [:error] [pid 14076:tid 14082] [client 20.249.10.99:30686] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSWooHsB4Gz6Qw-pvBsxMwAAAAE"]
[Tue Nov 25 21:01:20.407736 2025] [:error] [pid 43981:tid 43987] [client 20.249.10.99:30637] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSWooAgZn97m_qh_RaFaIAAAAwQ"]
[Tue Nov 25 21:01:20.707638 2025] [:error] [pid 28836:tid 28956] [client 20.249.10.99:30561] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSWooJwNRsoxcLQGkTfcQgAAAsE"]
[Tue Nov 25 21:01:21.007372 2025] [:error] [pid 43843:tid 43852] [client 20.249.10.99:30712] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSWooRhx4v3NUNdMKDPqGgAAAcc"]
[Tue Nov 25 21:01:21.304388 2025] [:error] [pid 28609:tid 28627] [client 20.249.10.99:30608] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWooSGGdT-nZJVs3x3eCgAAAYk"]
[Tue Nov 25 21:01:21.602021 2025] [:error] [pid 28609:tid 28619] [client 20.249.10.99:30503] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWooSGGdT-nZJVs3x3eCwAAAYE"]
[Tue Nov 25 21:01:21.899356 2025] [:error] [pid 43981:tid 43998] [client 20.249.10.99:30569] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWooQgZn97m_qh_RaFaIwAAAw8"]
[Tue Nov 25 21:01:22.196733 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:30695] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWoohG9n7UHEkwDTyi9tQAAAE0"]
[Tue Nov 25 21:01:22.504863 2025] [:error] [pid 2987:tid 3005] [client 20.249.10.99:30541] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSWoos-djEt-pTzPxny96QAAAVA"]
[Tue Nov 25 21:01:22.807934 2025] [:error] [pid 2987:tid 3011] [client 20.249.10.99:30548] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSWoos-djEt-pTzPxny96gAAAVY"]
[Tue Nov 25 21:01:23.104254 2025] [:error] [pid 43981:tid 43997] [client 20.249.10.99:30554] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSWoowgZn97m_qh_RaFaJAAAAw4"]
[Tue Nov 25 21:01:23.405643 2025] [:error] [pid 28609:tid 28623] [client 20.249.10.99:30628] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSWooyGGdT-nZJVs3x3eEQAAAYU"]
[Tue Nov 25 21:01:23.704480 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:30473] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWooyGGdT-nZJVs3x3eEgAAAZE"]
[Tue Nov 25 21:01:24.001206 2025] [:error] [pid 14077:tid 14125] [client 20.249.10.99:30592] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWopBG9n7UHEkwDTyi9uwAAAE8"]
[Tue Nov 25 21:01:24.317068 2025] [:error] [pid 2987:tid 3008] [client 20.249.10.99:30681] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWopM-djEt-pTzPxny97gAAAVM"]
[Tue Nov 25 21:01:24.614708 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:30549] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSWopNVXYbb0ii_rVoJm4gAAAIM"]
[Tue Nov 25 21:01:24.904362 2025] [:error] [pid 14077:tid 14121] [client 20.249.10.99:30587] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWopBG9n7UHEkwDTyi9vAAAAEs"]
[Tue Nov 25 21:01:25.197724 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:30604] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWopSGGdT-nZJVs3x3eFAAAAYw"]
[Tue Nov 25 21:01:25.503599 2025] [:error] [pid 28836:tid 28969] [client 20.249.10.99:30623] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWopZwNRsoxcLQGkTfcRgAAAs4"]
[Tue Nov 25 21:01:25.804417 2025] [:error] [pid 14168:tid 14181] [client 20.249.10.99:30624] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSWopfR-ZDU0QEgAIIuBDwAAAMo"]
[Tue Nov 25 21:01:26.104919 2025] [:error] [pid 14168:tid 14173] [client 20.249.10.99:29820] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWopvR-ZDU0QEgAIIuBEAAAAMI"]
[Tue Nov 25 21:01:26.401151 2025] [:error] [pid 14078:tid 14145] [client 20.249.10.99:30642] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWoptVXYbb0ii_rVoJm4wAAAIg"]
[Tue Nov 25 21:01:26.699211 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:29730] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWopiGGdT-nZJVs3x3eFgAAAYM"]
[Tue Nov 25 21:01:26.997196 2025] [:error] [pid 28739:tid 28778] [client 20.249.10.99:30512] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSWophxGpKmlkG4FexSXSQAAAhA"]
[Tue Nov 25 21:01:27.305620 2025] [:error] [pid 28836:tid 28955] [client 20.249.10.99:30640] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSWop5wNRsoxcLQGkTfcRwAAAsA"]
[Tue Nov 25 21:01:27.601326 2025] [:error] [pid 28609:tid 28633] [client 20.249.10.99:30663] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSWopyGGdT-nZJVs3x3eGAAAAY8"]
[Tue Nov 25 21:01:27.896295 2025] [:error] [pid 2987:tid 3006] [client 20.249.10.99:30626] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSWop8-djEt-pTzPxny98AAAAVE"]
[Tue Nov 25 21:01:28.205974 2025] [:error] [pid 14168:tid 14186] [client 20.249.10.99:30523] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSWoqPR-ZDU0QEgAIIuBEgAAAM8"]
[Tue Nov 25 21:01:28.500974 2025] [:error] [pid 28739:tid 28771] [client 20.249.10.99:30467] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSWoqBxGpKmlkG4FexSXTAAAAgk"]
[Tue Nov 25 21:01:28.806149 2025] [:error] [pid 43981:tid 43991] [client 20.249.10.99:30528] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSWoqAgZn97m_qh_RaFaKgAAAwg"]
[Tue Nov 25 21:01:29.101144 2025] [:error] [pid 14168:tid 14188] [client 20.249.10.99:30627] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSWoqfR-ZDU0QEgAIIuBEwAAANE"]
[Tue Nov 25 21:01:29.399162 2025] [:error] [pid 28739:tid 28774] [client 20.249.10.99:30638] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSWoqRxGpKmlkG4FexSXTwAAAgw"]
[Tue Nov 25 21:01:29.695424 2025] [:error] [pid 14076:tid 14101] [client 20.249.10.99:30547] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSWoqXsB4Gz6Qw-pvBsxOgAAABQ"]
[Tue Nov 25 21:01:30.000283 2025] [:error] [pid 14076:tid 14096] [client 20.249.10.99:30585] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSWoqXsB4Gz6Qw-pvBsxOwAAAA8"]
[Tue Nov 25 21:01:30.307337 2025] [:error] [pid 14076:tid 14098] [client 20.249.10.99:30631] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSWoqnsB4Gz6Qw-pvBsxPAAAABE"]
[Tue Nov 25 21:01:30.618789 2025] [:error] [pid 14078:tid 14150] [client 20.249.10.99:29728] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aSWoqtVXYbb0ii_rVoJm5gAAAI0"]
[Tue Nov 25 21:01:30.916725 2025] [:error] [pid 14076:tid 14082] [client 20.249.10.99:30603] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aSWoqnsB4Gz6Qw-pvBsxQAAAAAE"]
[Tue Nov 25 21:01:31.212496 2025] [:error] [pid 14168:tid 14192] [client 20.249.10.99:30548] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aSWoq_R-ZDU0QEgAIIuBFgAAANU"]
[Tue Nov 25 21:01:31.508699 2025] [:error] [pid 28836:tid 28968] [client 20.249.10.99:30621] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aSWoq5wNRsoxcLQGkTfcSAAAAs0"]
[Tue Nov 25 21:01:31.835804 2025] [:error] [pid 14168:tid 14183] [client 20.249.10.99:30538] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aSWoq_R-ZDU0QEgAIIuBFwAAAMw"]
[Tue Nov 25 21:01:32.133179 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:30655] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSWorHsB4Gz6Qw-pvBsxQwAAAAI"]
[Tue Nov 25 21:01:32.429438 2025] [:error] [pid 28739:tid 28775] [client 20.249.10.99:30557] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSWorBxGpKmlkG4FexSXUwAAAg0"]
[Tue Nov 25 21:01:32.767410 2025] [:error] [pid 14076:tid 14095] [client 20.249.10.99:30470] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSWorHsB4Gz6Qw-pvBsxRAAAAA4"]
[Tue Nov 25 21:01:33.102116 2025] [:error] [pid 28836:tid 29008] [client 20.249.10.99:30483] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSWorZwNRsoxcLQGkTfcSQAAAtI"]
[Tue Nov 25 21:01:33.397717 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:30575] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWordVXYbb0ii_rVoJm6gAAAIY"]
[Tue Nov 25 21:01:33.719106 2025] [:error] [pid 2987:tid 2992] [client 20.249.10.99:30535] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWorc-djEt-pTzPxny99QAAAUM"]
[Tue Nov 25 21:01:34.061232 2025] [:error] [pid 2987:tid 3011] [client 20.249.10.99:30536] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWors-djEt-pTzPxny99wAAAVY"]
[Tue Nov 25 21:01:34.374825 2025] [:error] [pid 28739:tid 28786] [client 20.249.10.99:30545] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSWorhxGpKmlkG4FexSXVgAAAhg"]
[Tue Nov 25 21:01:34.681770 2025] [:error] [pid 28739:tid 28763] [client 20.249.10.99:30555] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSWorhxGpKmlkG4FexSXVwAAAgE"]
[Tue Nov 25 21:01:34.980108 2025] [:error] [pid 43843:tid 43855] [client 20.249.10.99:30562] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSWorhhx4v3NUNdMKDPqJgAAAco"]
[Tue Nov 25 21:01:35.379178 2025] [:error] [pid 43843:tid 43862] [client 20.249.10.99:30401] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSWorxhx4v3NUNdMKDPqKgAAAdE"]
[Tue Nov 25 21:01:35.681464 2025] [:error] [pid 43843:tid 43860] [client 20.249.10.99:30676] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSWorxhx4v3NUNdMKDPqKwAAAc8"]
[Tue Nov 25 21:01:35.990689 2025] [:error] [pid 43843:tid 43861] [client 20.249.10.99:30586] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSWorxhx4v3NUNdMKDPqLQAAAdA"]
[Tue Nov 25 21:01:36.328219 2025] [:error] [pid 14077:tid 14117] [client 20.249.10.99:30563] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSWosBG9n7UHEkwDTyi9vgAAAEc"]
[Tue Nov 25 21:01:36.630096 2025] [:error] [pid 2987:tid 3007] [client 20.249.10.99:30650] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSWosM-djEt-pTzPxny9-QAAAVI"]
[Tue Nov 25 21:01:36.950845 2025] [:error] [pid 43981:tid 44007] [client 20.249.10.99:30567] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSWosAgZn97m_qh_RaFaLgAAAxg"]
[Tue Nov 25 21:01:37.248430 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:30559] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aSWosZwNRsoxcLQGkTfcTgAAAsY"]
[Tue Nov 25 21:01:37.544515 2025] [:error] [pid 14168:tid 14187] [client 20.249.10.99:30480] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aSWosfR-ZDU0QEgAIIuBGQAAANA"]
[Tue Nov 25 21:01:37.839971 2025] [:error] [pid 14168:tid 14175] [client 20.249.10.99:30546] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aSWosfR-ZDU0QEgAIIuBGgAAAMQ"]
[Tue Nov 25 21:01:38.146259 2025] [:error] [pid 28836:tid 28966] [client 20.249.10.99:30532] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aSWospwNRsoxcLQGkTfcUgAAAss"]
[Tue Nov 25 21:01:38.465064 2025] [:error] [pid 43981:tid 43983] [client 20.249.10.99:30582] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSWosggZn97m_qh_RaFaMQAAAwA"]
[Tue Nov 25 21:01:38.763390 2025] [:error] [pid 14077:tid 14134] [client 20.249.10.99:30607] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSWoshG9n7UHEkwDTyi9vwAAAFg"]
[Tue Nov 25 21:01:39.064429 2025] [:error] [pid 43843:tid 43856] [client 20.249.10.99:30553] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSWosxhx4v3NUNdMKDPqMgAAAcs"]
[Tue Nov 25 21:01:39.360446 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:30490] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSWos9VXYbb0ii_rVoJm7gAAAIM"]
[Tue Nov 25 21:01:39.667435 2025] [:error] [pid 14168:tid 14184] [client 20.249.10.99:30583] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aSWos_R-ZDU0QEgAIIuBHQAAAM0"]
[Tue Nov 25 21:01:39.960061 2025] [:error] [pid 28609:tid 28629] [client 20.249.10.99:30591] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aSWosyGGdT-nZJVs3x3eHgAAAYs"]
[Tue Nov 25 21:01:40.282262 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:30522] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aSWotNVXYbb0ii_rVoJm7wAAAJg"]
[Tue Nov 25 21:01:40.595083 2025] [:error] [pid 14078:tid 14157] [client 20.249.10.99:30652] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/article.php"] [unique_id "aSWotNVXYbb0ii_rVoJm8AAAAJQ"]
[Tue Nov 25 21:01:40.921322 2025] [:error] [pid 14077:tid 14114] [client 20.249.10.99:30714] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWotBG9n7UHEkwDTyi9wgAAAEQ"]
[Tue Nov 25 21:01:41.248675 2025] [:error] [pid 14077:tid 14119] [client 20.249.10.99:30539] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWotRG9n7UHEkwDTyi9wwAAAEk"]
[Tue Nov 25 21:01:41.591414 2025] [:error] [pid 14077:tid 14130] [client 20.249.10.99:30544] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWotRG9n7UHEkwDTyi9xAAAAFQ"]
[Tue Nov 25 21:01:41.929190 2025] [:error] [pid 28836:tid 29011] [client 20.249.10.99:30632] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSWotZwNRsoxcLQGkTfcXwAAAtU"]
[Tue Nov 25 21:01:42.250516 2025] [:error] [pid 14168:tid 14185] [client 20.249.10.99:30616] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSWotvR-ZDU0QEgAIIuBKwAAAM4"]
[Tue Nov 25 21:01:42.563796 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:29809] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSWotnsB4Gz6Qw-pvBsxSgAAAAQ"]
[Tue Nov 25 21:01:42.895721 2025] [:error] [pid 14077:tid 14132] [client 20.249.10.99:30482] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSWothG9n7UHEkwDTyi9yAAAAFY"]
[Tue Nov 25 21:01:43.206308 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:30564] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSWotxxGpKmlkG4FexSXZwAAAgQ"]
[Tue Nov 25 21:01:43.548384 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:30466] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWotxG9n7UHEkwDTyi9yQAAAE0"]
[Tue Nov 25 21:01:43.855745 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:30543] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWotyGGdT-nZJVs3x3eKwAAAZc"]
[Tue Nov 25 21:01:44.165511 2025] [:error] [pid 2987:tid 2995] [client 20.249.10.99:30533] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWouM-djEt-pTzPxny9_AAAAUY"]
[Tue Nov 25 21:01:44.475209 2025] [:error] [pid 14168:tid 14182] [client 20.249.10.99:30589] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSWouPR-ZDU0QEgAIIuBLwAAAMs"]
[Tue Nov 25 21:01:44.849056 2025] [:error] [pid 14077:tid 14133] [client 20.249.10.99:30540] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aSWouBG9n7UHEkwDTyi9zAAAAFc"]
[Tue Nov 25 21:01:45.166419 2025] [:error] [pid 28609:tid 28628] [client 20.249.10.99:30428] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aSWouSGGdT-nZJVs3x3eLAAAAYo"]
[Tue Nov 25 21:01:45.466639 2025] [:error] [pid 14076:tid 14081] [client 20.249.10.99:30474] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aSWouXsB4Gz6Qw-pvBsxTQAAAAA"]
[Tue Nov 25 21:01:45.785981 2025] [:error] [pid 43981:tid 43986] [client 20.249.10.99:30551] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aSWouQgZn97m_qh_RaFaPgAAAwM"]
[Tue Nov 25 21:01:46.107832 2025] [:error] [pid 43843:tid 43845] [client 20.249.10.99:30509] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aSWouhhx4v3NUNdMKDPqOAAAAcA"]
[Tue Nov 25 21:01:46.415000 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:30529] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aSWoutVXYbb0ii_rVoJm-AAAAIk"]
[Tue Nov 25 21:01:46.734458 2025] [:error] [pid 43981:tid 43989] [client 20.249.10.99:30591] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aSWouggZn97m_qh_RaFaPwAAAwY"]
[Tue Nov 25 21:01:47.061926 2025] [:error] [pid 14168:tid 14195] [client 20.249.10.99:29815] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aSWou_R-ZDU0QEgAIIuBMwAAANg"]
[Tue Nov 25 21:01:47.361351 2025] [:error] [pid 28739:tid 28765] [client 20.249.10.99:30521] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aSWouxxGpKmlkG4FexSXbgAAAgM"]
[Tue Nov 25 21:01:47.674705 2025] [:error] [pid 14078:tid 14151] [client 20.249.10.99:30470] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aSWou9VXYbb0ii_rVoJnAQAAAI4"]
[Tue Nov 25 21:01:47.987893 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:30508] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aSWou9VXYbb0ii_rVoJnAwAAAIM"]
[Tue Nov 25 21:01:48.304210 2025] [:error] [pid 14168:tid 14185] [client 20.249.10.99:30506] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aSWovPR-ZDU0QEgAIIuBNgAAAM4"]
[Tue Nov 25 21:01:48.628203 2025] [:error] [pid 43981:tid 43993] [client 20.249.10.99:30576] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aSWovAgZn97m_qh_RaFaQgAAAwo"]
[Tue Nov 25 21:01:48.996475 2025] [:error] [pid 28609:tid 28628] [client 20.249.10.99:30649] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aSWovCGGdT-nZJVs3x3eOgAAAYo"]
[Tue Nov 25 21:01:49.422968 2025] [:error] [pid 14077:tid 14113] [client 20.249.10.99:30572] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aSWovRG9n7UHEkwDTyi91QAAAEM"]
[Tue Nov 25 21:01:50.127368 2025] [:error] [pid 14076:tid 14101] [client 20.249.10.99:30565] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aSWovnsB4Gz6Qw-pvBsxUAAAABQ"]
[Tue Nov 25 21:01:50.476426 2025] [:error] [pid 14076:tid 14105] [client 20.249.10.99:30574] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aSWovnsB4Gz6Qw-pvBsxUQAAABg"]
[Tue Nov 25 21:01:55.259027 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:30511] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aSWow9VXYbb0ii_rVoJnEQAAAIM"]
[Tue Nov 25 21:01:55.751198 2025] [:error] [pid 14078:tid 14145] [client 20.249.10.99:30542] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aSWow9VXYbb0ii_rVoJnEgAAAIg"]
[Tue Nov 25 21:01:56.167007 2025] [:error] [pid 43843:tid 43863] [client 20.249.10.99:30497] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aSWoxBhx4v3NUNdMKDPqQgAAAdI"]
[Tue Nov 25 21:01:56.523048 2025] [:error] [pid 14078:tid 14153] [client 20.249.10.99:30478] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aSWoxNVXYbb0ii_rVoJnFAAAAJA"]
[Tue Nov 25 21:01:56.971490 2025] [:error] [pid 14076:tid 14097] [client 20.249.10.99:30336] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSWoxHsB4Gz6Qw-pvBsxVgAAABA"]
[Tue Nov 25 21:01:57.301797 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:30413] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSWoxXsB4Gz6Qw-pvBsxVwAAAAI"]
[Tue Nov 25 21:01:57.636243 2025] [:error] [pid 14078:tid 14139] [client 20.249.10.99:30675] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSWoxdVXYbb0ii_rVoJnGAAAAII"]
[Tue Nov 25 21:01:57.978445 2025] [:error] [pid 14078:tid 14158] [client 20.249.10.99:30464] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSWoxdVXYbb0ii_rVoJnGgAAAJU"]
[Tue Nov 25 21:01:58.311093 2025] [:error] [pid 28739:tid 28770] [client 20.249.10.99:30484] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWoxhxGpKmlkG4FexSXeQAAAgg"]
[Tue Nov 25 21:01:58.641337 2025] [:error] [pid 28739:tid 28765] [client 20.249.10.99:30494] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWoxhxGpKmlkG4FexSXegAAAgM"]
[Tue Nov 25 21:01:59.036376 2025] [:error] [pid 14078:tid 14148] [client 20.249.10.99:30556] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWox9VXYbb0ii_rVoJnGwAAAIs"]
[Tue Nov 25 21:01:59.368881 2025] [:error] [pid 28739:tid 28771] [client 20.249.10.99:30469] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSWoxxxGpKmlkG4FexSXfQAAAgk"]
[Tue Nov 25 21:01:59.672083 2025] [:error] [pid 14076:tid 14092] [client 20.249.10.99:30579] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aSWox3sB4Gz6Qw-pvBsxWwAAAAs"]
[Tue Nov 25 21:02:00.063755 2025] [:error] [pid 28836:tid 28958] [client 20.249.10.99:30405] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aSWoyJwNRsoxcLQGkTfccAAAAsM"]
[Tue Nov 25 21:02:00.561951 2025] [:error] [pid 28739:tid 28764] [client 20.249.10.99:30619] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aSWoyBxGpKmlkG4FexSXgQAAAgI"]
[Tue Nov 25 21:02:00.917488 2025] [:error] [pid 28609:tid 28622] [client 20.249.10.99:30475] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aSWoyCGGdT-nZJVs3x3eSwAAAYQ"]
[Tue Nov 25 21:02:01.257861 2025] [:error] [pid 43981:tid 44006] [client 20.249.10.99:30502] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aSWoyQgZn97m_qh_RaFaTAAAAxc"]
[Tue Nov 25 21:02:01.622995 2025] [:error] [pid 28836:tid 29011] [client 20.249.10.99:30505] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aSWoyZwNRsoxcLQGkTfccgAAAtU"]
[Tue Nov 25 21:02:01.956393 2025] [:error] [pid 43981:tid 43997] [client 20.249.10.99:30584] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aSWoyQgZn97m_qh_RaFaTQAAAw4"]
[Tue Nov 25 21:02:02.289437 2025] [:error] [pid 28836:tid 28986] [client 20.249.10.99:30653] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aSWoypwNRsoxcLQGkTfcdQAAAs8"]
[Tue Nov 25 21:02:02.629469 2025] [:error] [pid 43843:tid 43856] [client 20.249.10.99:30411] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSWoyhhx4v3NUNdMKDPqRwAAAcs"]
[Tue Nov 25 21:02:02.998576 2025] [:error] [pid 14078:tid 14154] [client 20.249.10.99:30513] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aSWoytVXYbb0ii_rVoJnHwAAAJE"]
[Tue Nov 25 21:02:03.351648 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:30404] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aSWoy9VXYbb0ii_rVoJnIAAAAIo"]
[Tue Nov 25 21:02:03.684432 2025] [:error] [pid 2987:tid 3005] [client 20.249.10.99:30488] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aSWoy8-djEt-pTzPxny-FQAAAVA"]
[Tue Nov 25 21:02:04.064053 2025] [:error] [pid 14076:tid 14086] [client 20.249.10.99:30578] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSWozHsB4Gz6Qw-pvBsxYgAAAAU"]
[Tue Nov 25 21:02:04.438920 2025] [:error] [pid 43843:tid 43846] [client 20.249.10.99:30439] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSWozBhx4v3NUNdMKDPqSAAAAcE"]
[Tue Nov 25 21:02:04.769237 2025] [:error] [pid 14076:tid 14101] [client 20.249.10.99:30573] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSWozHsB4Gz6Qw-pvBsxYwAAABQ"]
[Tue Nov 25 21:02:05.207915 2025] [:error] [pid 14078:tid 14148] [client 20.249.10.99:30422] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSWozdVXYbb0ii_rVoJnJgAAAIs"]
[Tue Nov 25 21:02:05.545863 2025] [:error] [pid 43843:tid 43866] [client 20.249.10.99:30507] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSWozRhx4v3NUNdMKDPqSQAAAdU"]
[Tue Nov 25 21:02:05.891006 2025] [:error] [pid 14076:tid 14096] [client 20.249.10.99:30417] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSWozXsB4Gz6Qw-pvBsxZQAAAA8"]
[Tue Nov 25 21:02:06.247978 2025] [:error] [pid 14078:tid 14156] [client 20.249.10.99:30479] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSWoztVXYbb0ii_rVoJnKAAAAJM"]
[Tue Nov 25 21:02:06.634186 2025] [:error] [pid 14078:tid 14145] [client 20.249.10.99:30560] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSWoztVXYbb0ii_rVoJnKQAAAIg"]
[Tue Nov 25 21:02:07.087388 2025] [:error] [pid 2987:tid 3008] [client 20.249.10.99:30477] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSWoz8-djEt-pTzPxny-GQAAAVM"]
[Tue Nov 25 21:02:07.437710 2025] [:error] [pid 14168:tid 14178] [client 20.249.10.99:30431] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSWoz_R-ZDU0QEgAIIuBagAAAMc"]
[Tue Nov 25 21:02:07.810666 2025] [:error] [pid 28836:tid 29009] [client 20.249.10.99:30588] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSWoz5wNRsoxcLQGkTfcgAAAAtM"]
[Tue Nov 25 21:02:08.204523 2025] [:error] [pid 43843:tid 43863] [client 20.249.10.99:30352] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSWo0Bhx4v3NUNdMKDPqTAAAAdI"]
[Tue Nov 25 21:02:08.683844 2025] [:error] [pid 14168:tid 14173] [client 20.249.10.99:30571] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aSWo0PR-ZDU0QEgAIIuBcgAAAMI"]
[Tue Nov 25 21:02:09.054195 2025] [:error] [pid 2987:tid 2994] [client 20.249.10.99:30468] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSWo0c-djEt-pTzPxny-HAAAAUU"]
[Tue Nov 25 21:02:09.558629 2025] [:error] [pid 14077:tid 14124] [client 20.249.10.99:30516] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSWo0RG9n7UHEkwDTyi93wAAAE4"]
[Tue Nov 25 21:02:10.162728 2025] [:error] [pid 14168:tid 14185] [client 20.249.10.99:30599] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSWo0vR-ZDU0QEgAIIuBdgAAAM4"]
[Tue Nov 25 21:02:10.494359 2025] [:error] [pid 2987:tid 3009] [client 20.249.10.99:30496] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSWo0s-djEt-pTzPxny-HwAAAVQ"]
[Tue Nov 25 21:02:11.056791 2025] [:error] [pid 14077:tid 14134] [client 20.249.10.99:30409] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSWo0xG9n7UHEkwDTyi94AAAAFg"]
[Tue Nov 25 21:02:11.470189 2025] [:error] [pid 43843:tid 43861] [client 20.249.10.99:30486] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSWo0xhx4v3NUNdMKDPqUQAAAdA"]
[Tue Nov 25 21:02:12.211204 2025] [:error] [pid 2987:tid 2990] [client 20.249.10.99:30493] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aSWo1M-djEt-pTzPxny-LQAAAUE"]
[Tue Nov 25 21:02:12.622676 2025] [:error] [pid 14076:tid 14090] [client 20.249.10.99:30407] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSWo1HsB4Gz6Qw-pvBsxgwAAAAk"]
[Tue Nov 25 21:02:13.098374 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:30492] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Tue Nov 25 21:02:13.247270 2025] [:error] [pid 28609:tid 28625] [client 20.249.10.99:30492] File does not exist: /usr/local/apache/htdocs/suspended-page/qqq.php
[Tue Nov 25 21:02:13.644119 2025] [:error] [pid 28609:tid 28631] [client 20.249.10.99:30492] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSWo1SGGdT-nZJVs3x3eVgAAAY0"]
[Tue Nov 25 21:02:14.425349 2025] [:error] [pid 28739:tid 28767] [client 20.249.10.99:30481] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Nov 25 21:02:15.192025 2025] [:error] [pid 28739:tid 28764] [client 20.249.10.99:30481] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSWo1xxGpKmlkG4FexSXmQAAAgI"]
[Tue Nov 25 21:02:15.565368 2025] [:error] [pid 28609:tid 28633] [client 20.249.10.99:30568] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSWo1yGGdT-nZJVs3x3eWgAAAY8"]
[Tue Nov 25 21:02:16.176022 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:30402] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSWo2NVXYbb0ii_rVoJnPAAAAIY"]
[Tue Nov 25 21:02:16.495337 2025] [:error] [pid 14078:tid 14159] [client 20.249.10.99:30400] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSWo2NVXYbb0ii_rVoJnPgAAAJY"]
[Tue Nov 25 21:02:16.917607 2025] [:error] [pid 14077:tid 14119] [client 20.249.10.99:30580] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWo2BG9n7UHEkwDTyi94gAAAEk"]
[Tue Nov 25 21:02:17.431203 2025] [:error] [pid 14078:tid 14148] [client 20.249.10.99:30431] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWo2dVXYbb0ii_rVoJnPwAAAIs"]
[Tue Nov 25 21:02:18.107117 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:30443] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWo2tVXYbb0ii_rVoJnQwAAAIM"]
[Tue Nov 25 21:02:18.872327 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:30566] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSWo2tVXYbb0ii_rVoJnRQAAAJg"]
[Tue Nov 25 21:02:19.585783 2025] [:error] [pid 28836:tid 29013] [client 20.249.10.99:30524] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSWo25wNRsoxcLQGkTfchQAAAtc"]
[Tue Nov 25 21:02:20.430435 2025] [:error] [pid 43981:tid 43992] [client 20.249.10.99:30406] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aSWo3AgZn97m_qh_RaFaWwAAAwk"]
[Tue Nov 25 21:02:20.949920 2025] [:error] [pid 14078:tid 14158] [client 20.249.10.99:30476] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aSWo3NVXYbb0ii_rVoJnSAAAAJU"]
[Tue Nov 25 21:02:21.346604 2025] [:error] [pid 14168:tid 14194] [client 20.249.10.99:30420] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aSWo3fR-ZDU0QEgAIIuBggAAANc"]
[Tue Nov 25 21:02:22.203104 2025] [:error] [pid 14076:tid 14084] [client 20.249.10.99:30610] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aSWo3nsB4Gz6Qw-pvBsxiAAAAAM"]
[Tue Nov 25 21:02:22.736405 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:30418] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWo3iGGdT-nZJVs3x3eYwAAAYM"]
[Tue Nov 25 21:02:23.298134 2025] [:error] [pid 28739:tid 28769] [client 20.249.10.99:30461] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWo3xxGpKmlkG4FexSXnwAAAgc"]
[Tue Nov 25 21:02:23.762537 2025] [:error] [pid 28739:tid 28779] [client 20.249.10.99:30514] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWo3xxGpKmlkG4FexSXoAAAAhE"]
[Tue Nov 25 21:02:24.154493 2025] [:error] [pid 14078:tid 14144] [client 20.249.10.99:30426] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSWo4NVXYbb0ii_rVoJnTwAAAIc"]
[Tue Nov 25 21:02:24.486012 2025] [:error] [pid 28739:tid 28772] [client 20.249.10.99:29759] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWo4BxGpKmlkG4FexSXogAAAgo"]
[Tue Nov 25 21:02:24.970624 2025] [:error] [pid 14168:tid 14181] [client 20.249.10.99:30577] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWo4PR-ZDU0QEgAIIuBhgAAAMo"]
[Tue Nov 25 21:02:25.376264 2025] [:error] [pid 14077:tid 14115] [client 20.249.10.99:30438] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWo4RG9n7UHEkwDTyi98AAAAEU"]
[Tue Nov 25 21:02:25.763692 2025] [:error] [pid 43981:tid 44001] [client 20.249.10.99:30515] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSWo4QgZn97m_qh_RaFaXgAAAxI"]
[Tue Nov 25 21:02:26.114835 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:30465] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSWo4s-djEt-pTzPxny-TwAAAUg"]
[Tue Nov 25 21:02:26.569702 2025] [:error] [pid 14076:tid 14094] [client 20.249.10.99:30537] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSWo4nsB4Gz6Qw-pvBsxkQAAAA0"]
[Tue Nov 25 21:02:27.008145 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:30581] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSWo43sB4Gz6Qw-pvBsxkgAAAAI"]
[Tue Nov 25 21:02:27.333323 2025] [:error] [pid 28836:tid 29007] [client 20.249.10.99:30412] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aSWo45wNRsoxcLQGkTfclQAAAtE"]
[Tue Nov 25 21:02:27.656799 2025] [:error] [pid 14168:tid 14189] [client 20.249.10.99:30526] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aSWo4_R-ZDU0QEgAIIuBjgAAANI"]
[Tue Nov 25 21:02:28.035098 2025] [:error] [pid 28836:tid 28969] [client 20.249.10.99:30504] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aSWo5JwNRsoxcLQGkTfclgAAAs4"]
[Tue Nov 25 21:02:28.367327 2025] [:error] [pid 14077:tid 14114] [client 20.249.10.99:30590] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aSWo5BG9n7UHEkwDTyi99AAAAEQ"]
[Tue Nov 25 21:02:28.768272 2025] [:error] [pid 14077:tid 14130] [client 20.249.10.99:30570] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aSWo5BG9n7UHEkwDTyi99gAAAFQ"]
[Tue Nov 25 21:02:29.101677 2025] [:error] [pid 43981:tid 43994] [client 20.249.10.99:30495] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSWo5QgZn97m_qh_RaFaYAAAAws"]
[Tue Nov 25 21:02:29.419930 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:30527] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSWo5Rhx4v3NUNdMKDPqYwAAAcQ"]
[Tue Nov 25 21:02:29.725151 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:30384] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSWo5RG9n7UHEkwDTyi9-AAAAEI"]
[Tue Nov 25 21:02:30.091662 2025] [:error] [pid 43843:tid 43866] [client 20.249.10.99:30498] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSWo5hhx4v3NUNdMKDPqZQAAAdU"]
[Tue Nov 25 21:02:30.443367 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:30448] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSWo5tVXYbb0ii_rVoJnWAAAAIE"]
[Tue Nov 25 21:02:30.847462 2025] [:error] [pid 14078:tid 14145] [client 20.249.10.99:30500] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSWo5tVXYbb0ii_rVoJnWQAAAIg"]
[Tue Nov 25 21:02:31.255051 2025] [:error] [pid 14168:tid 14194] [client 20.249.10.99:30415] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSWo5_R-ZDU0QEgAIIuBkgAAANc"]
[Tue Nov 25 21:02:31.637998 2025] [:error] [pid 14078:tid 14141] [client 20.249.10.99:30442] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSWo59VXYbb0ii_rVoJnWwAAAIQ"]
[Tue Nov 25 21:02:32.073223 2025] [:error] [pid 14076:tid 14089] [client 20.249.10.99:30433] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aSWo6HsB4Gz6Qw-pvBsxnAAAAAg"]
[Tue Nov 25 21:02:32.582422 2025] [:error] [pid 14078:tid 14137] [client 20.249.10.99:30357] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aSWo6NVXYbb0ii_rVoJnXQAAAIA"]
[Tue Nov 25 21:02:32.952065 2025] [:error] [pid 28836:tid 28959] [client 20.249.10.99:30351] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aSWo6JwNRsoxcLQGkTfcmQAAAsQ"]
[Tue Nov 25 21:02:33.664152 2025] [:error] [pid 14168:tid 14177] [client 20.249.10.99:30460] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aSWo6fR-ZDU0QEgAIIuBlQAAAMY"]
[Tue Nov 25 21:02:34.007312 2025] [:error] [pid 43981:tid 43997] [client 20.249.10.99:30485] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSWo6ggZn97m_qh_RaFaZgAAAw4"]
[Tue Nov 25 21:02:34.370460 2025] [:error] [pid 2987:tid 3013] [client 20.249.10.99:30525] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSWo6s-djEt-pTzPxny-UgAAAVg"]
[Tue Nov 25 21:02:34.746398 2025] [:error] [pid 43981:tid 43983] [client 20.249.10.99:30273] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSWo6ggZn97m_qh_RaFaZwAAAwA"]
[Tue Nov 25 21:02:35.103195 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:30558] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSWo63sB4Gz6Qw-pvBsxnwAAAAI"]
[Tue Nov 25 21:02:35.612271 2025] [:error] [pid 14168:tid 14186] [client 20.249.10.99:30453] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWo6_R-ZDU0QEgAIIuBlwAAAM8"]
[Tue Nov 25 21:02:35.918090 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:30517] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWo65wNRsoxcLQGkTfcmwAAAsY"]
[Tue Nov 25 21:02:36.396029 2025] [:error] [pid 43981:tid 43984] [client 20.249.10.99:30429] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWo7AgZn97m_qh_RaFaagAAAwE"]
[Tue Nov 25 21:02:36.827712 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:30447] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSWo7Bhx4v3NUNdMKDPqawAAAcQ"]
[Tue Nov 25 21:02:37.174085 2025] [:error] [pid 14076:tid 14104] [client 20.249.10.99:30491] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSWo7XsB4Gz6Qw-pvBsxoAAAABc"]
[Tue Nov 25 21:02:37.585052 2025] [:error] [pid 43981:tid 43987] [client 20.249.10.99:30487] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSWo7QgZn97m_qh_RaFabAAAAwQ"]
[Tue Nov 25 21:02:38.094352 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:30450] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSWo7hG9n7UHEkwDTyi9_QAAAFI"]
[Tue Nov 25 21:02:38.501316 2025] [:error] [pid 14168:tid 14188] [client 20.249.10.99:30277] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSWo7vR-ZDU0QEgAIIuBmwAAANE"]
[Tue Nov 25 21:02:38.870853 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:30457] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSWo7iGGdT-nZJVs3x3efQAAAYM"]
[Tue Nov 25 21:02:39.341896 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:30444] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSWo78-djEt-pTzPxny-WQAAAUg"]
[Tue Nov 25 21:02:39.736373 2025] [:error] [pid 43981:tid 43989] [client 20.249.10.99:30397] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bge.php"] [unique_id "aSWo7wgZn97m_qh_RaFacAAAAwY"]
[Tue Nov 25 21:02:40.176794 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:30353] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bge.php"] [unique_id "aSWo8CGGdT-nZJVs3x3efgAAAZE"]
[Tue Nov 25 21:02:40.523561 2025] [:error] [pid 14077:tid 14110] [client 20.249.10.99:30440] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bge.php"] [unique_id "aSWo8BG9n7UHEkwDTyi-AwAAAEA"]
[Tue Nov 25 21:02:41.024119 2025] [:error] [pid 28609:tid 28629] [client 20.249.10.99:30471] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bge.php"] [unique_id "aSWo8SGGdT-nZJVs3x3eggAAAYs"]
[Tue Nov 25 21:02:41.446914 2025] [:error] [pid 28836:tid 28968] [client 20.249.10.99:30518] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ifm.php"] [unique_id "aSWo8ZwNRsoxcLQGkTfcnQAAAs0"]
[Tue Nov 25 21:02:41.793817 2025] [:error] [pid 2987:tid 3012] [client 20.249.10.99:30510] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ifm.php"] [unique_id "aSWo8c-djEt-pTzPxny-WwAAAVc"]
[Tue Nov 25 21:02:42.209831 2025] [:error] [pid 28836:tid 28957] [client 20.249.10.99:30348] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ifm.php"] [unique_id "aSWo8pwNRsoxcLQGkTfcngAAAsI"]
[Tue Nov 25 21:02:42.656019 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:30369] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ifm.php"] [unique_id "aSWo8tVXYbb0ii_rVoJnZwAAAIo"]
[Tue Nov 25 21:02:43.029718 2025] [:error] [pid 28739:tid 28763] [client 20.249.10.99:30338] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww5.php"] [unique_id "aSWo8xxGpKmlkG4FexSXsAAAAgE"]
[Tue Nov 25 21:02:43.442146 2025] [:error] [pid 2987:tid 3011] [client 20.249.10.99:30520] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww5.php"] [unique_id "aSWo88-djEt-pTzPxny-XAAAAVY"]
[Tue Nov 25 21:02:43.870382 2025] [:error] [pid 43981:tid 44002] [client 20.249.10.99:30408] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww5.php"] [unique_id "aSWo8wgZn97m_qh_RaFadAAAAxM"]
[Tue Nov 25 21:02:44.194495 2025] [:error] [pid 14077:tid 14131] [client 20.249.10.99:30410] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww5.php"] [unique_id "aSWo9BG9n7UHEkwDTyi-BwAAAFU"]
[Tue Nov 25 21:02:44.721266 2025] [:error] [pid 28609:tid 28619] [client 20.249.10.99:30531] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aSWo9CGGdT-nZJVs3x3ehAAAAYE"]
[Tue Nov 25 21:02:45.127003 2025] [:error] [pid 14168:tid 14184] [client 20.249.10.99:30437] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aSWo9fR-ZDU0QEgAIIuBngAAAM0"]
[Tue Nov 25 21:02:45.482120 2025] [:error] [pid 14076:tid 14082] [client 20.249.10.99:30356] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aSWo9XsB4Gz6Qw-pvBsxqAAAAAE"]
[Tue Nov 25 21:02:45.867667 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:30370] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aSWo9XsB4Gz6Qw-pvBsxqQAAAAQ"]
[Tue Nov 25 21:02:46.198975 2025] [:error] [pid 28609:tid 28642] [client 20.249.10.99:30350] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kairolin.php"] [unique_id "aSWo9iGGdT-nZJVs3x3ehwAAAZg"]
[Tue Nov 25 21:02:46.531224 2025] [:error] [pid 14078:tid 14158] [client 20.249.10.99:30499] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kairolin.php"] [unique_id "aSWo9tVXYbb0ii_rVoJnbgAAAJU"]
[Tue Nov 25 21:02:46.919271 2025] [:error] [pid 43981:tid 43998] [client 20.249.10.99:30396] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kairolin.php"] [unique_id "aSWo9ggZn97m_qh_RaFadwAAAw8"]
[Tue Nov 25 21:02:47.247200 2025] [:error] [pid 43981:tid 43995] [client 20.249.10.99:30519] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kairolin.php"] [unique_id "aSWo9wgZn97m_qh_RaFaeAAAAww"]
[Tue Nov 25 21:02:47.635706 2025] [:error] [pid 28739:tid 28779] [client 20.249.10.99:30364] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aSWo9xxGpKmlkG4FexSXtAAAAhE"]
[Tue Nov 25 21:02:47.969529 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:30409] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aSWo99VXYbb0ii_rVoJncQAAAIM"]
[Tue Nov 25 21:02:48.291343 2025] [:error] [pid 14077:tid 14121] [client 20.249.10.99:30434] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aSWo-BG9n7UHEkwDTyi-DwAAAEs"]
[Tue Nov 25 21:02:48.635639 2025] [:error] [pid 28836:tid 29007] [client 20.249.10.99:30445] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aSWo-JwNRsoxcLQGkTfcogAAAtE"]
[Tue Nov 25 22:46:32.114834 2025] [:error] [pid 14168:tid 14177] [client 54.173.250.15:33076] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aSXBSPR-ZDU0QEgAIIufPwAAAMY"]
[Tue Nov 25 22:47:43.980340 2025] [:error] [pid 2987:tid 2991] [client 20.36.171.210:40092] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSXBj8-djEt-pTzPxnzf5QAAAUI"]
[Tue Nov 25 22:47:52.817472 2025] [:error] [pid 14078:tid 14137] [client 20.36.171.210:40064] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSXBmNVXYbb0ii_rVoKgWgAAAIA"]
[Tue Nov 25 22:47:56.040798 2025] [:error] [pid 28836:tid 28960] [client 20.36.171.210:40158] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSXBnJwNRsoxcLQGkTf8jAAAAsU"]
[Tue Nov 25 22:47:58.535678 2025] [:error] [pid 28609:tid 28622] [client 20.36.171.210:40143] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSXBniGGdT-nZJVs3x0DzgAAAYQ"]
[Tue Nov 25 22:48:08.267902 2025] [:error] [pid 14078:tid 14155] [client 20.36.171.210:40174] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Nov 25 22:48:10.330508 2025] [:error] [pid 14078:tid 14156] [client 20.36.171.210:40174] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSXBqtVXYbb0ii_rVoKgggAAAJM"]
[Tue Nov 25 22:48:18.179164 2025] [:error] [pid 28739:tid 28770] [client 20.36.171.210:40129] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aSXBshxGpKmlkG4FexTFswAAAgg"]
[Tue Nov 25 22:48:22.521132 2025] [:error] [pid 28609:tid 28628] [client 20.36.171.210:40068] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aSXBtiGGdT-nZJVs3x0D7QAAAYo"]
[Tue Nov 25 22:48:30.686093 2025] [:error] [pid 14168:tid 14184] [client 20.36.171.210:40154] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/plugins.php"] [unique_id "aSXBvvR-ZDU0QEgAIIuf1gAAAM0"]
[Tue Nov 25 22:48:32.746318 2025] [:error] [pid 28739:tid 28777] [client 20.36.171.210:40144] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/plugins.php"] [unique_id "aSXBwBxGpKmlkG4FexTFwQAAAg8"]
[Tue Nov 25 22:48:36.160565 2025] [:error] [pid 14076:tid 14093] [client 20.36.171.210:40149] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/plugins.php"] [unique_id "aSXBxHsB4Gz6Qw-pvBtZ5AAAAAw"]
[Tue Nov 25 22:48:38.812037 2025] [:error] [pid 28609:tid 28621] [client 20.36.171.210:40172] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/plugins.php"] [unique_id "aSXBxiGGdT-nZJVs3x0EGAAAAYM"]
[Tue Nov 25 22:48:41.643074 2025] [:error] [pid 14168:tid 14184] [client 20.36.171.210:40170] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSXByfR-ZDU0QEgAIIuf5AAAAM0"]
[Tue Nov 25 22:48:43.591924 2025] [:error] [pid 14078:tid 14139] [client 20.36.171.210:40181] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSXBy9VXYbb0ii_rVoKgowAAAII"]
[Tue Nov 25 22:48:45.879857 2025] [:error] [pid 28609:tid 28641] [client 20.36.171.210:40150] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSXBzSGGdT-nZJVs3x0EHgAAAZc"]
[Tue Nov 25 22:48:48.443783 2025] [:error] [pid 14168:tid 14194] [client 20.36.171.210:40166] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSXB0PR-ZDU0QEgAIIuf6AAAANc"]
[Tue Nov 25 22:48:51.565948 2025] [:error] [pid 2987:tid 3004] [client 20.36.171.210:40081] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/index.php"] [unique_id "aSXB08-djEt-pTzPxnzgHAAAAU8"]
[Tue Nov 25 22:48:53.311301 2025] [:error] [pid 28609:tid 28638] [client 20.36.171.210:40134] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/index.php"] [unique_id "aSXB1SGGdT-nZJVs3x0EJQAAAZQ"]
[Tue Nov 25 22:48:54.909460 2025] [:error] [pid 28836:tid 28963] [client 20.36.171.210:40160] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/index.php"] [unique_id "aSXB1pwNRsoxcLQGkTf8qAAAAsg"]
[Tue Nov 25 22:48:56.070219 2025] [:error] [pid 14076:tid 14082] [client 20.36.171.210:40075] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/index.php"] [unique_id "aSXB2HsB4Gz6Qw-pvBtZ8gAAAAE"]
[Tue Nov 25 22:48:56.838159 2025] [:error] [pid 28836:tid 28986] [client 20.36.171.210:40153] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/admin.php"] [unique_id "aSXB2JwNRsoxcLQGkTf8qwAAAs8"]
[Tue Nov 25 22:48:59.965073 2025] [:error] [pid 14078:tid 14145] [client 20.36.171.210:40084] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSXB29VXYbb0ii_rVoKgzQAAAIg"]
[Tue Nov 25 22:49:06.426120 2025] [:error] [pid 14077:tid 14121] [client 20.36.171.210:40167] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSXB4hG9n7UHEkwDTyjhrgAAAEs"]
[Tue Nov 25 22:49:07.768005 2025] [:error] [pid 14168:tid 14192] [client 20.36.171.210:40085] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSXB4_R-ZDU0QEgAIIuf9gAAANU"]
[Tue Nov 25 22:49:09.907354 2025] [:error] [pid 28609:tid 28627] [client 20.36.171.210:61289] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aSXB5SGGdT-nZJVs3x0ELAAAAYk"]
[Tue Nov 25 22:49:13.493428 2025] [:error] [pid 28609:tid 28621] [client 20.36.171.210:40178] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php/wp-content/plugins/google-seo-rank/index.php"] [unique_id "aSXB6SGGdT-nZJVs3x0ENQAAAYM"]
[Tue Nov 25 23:44:50.728003 2025] [:error] [pid 14076:tid 14097] [client 139.59.30.253:64680] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aSXO8nsB4Gz6Qw-pvBtqcgAAABA"], referer: binance.com
[Wed Nov 26 07:37:30.992631 2025] [:error] [pid 34742:tid 34770] [client 85.203.23.107:30973] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "aSY9upSuLNwpQF_jzAfy1QAAAFY"]
[Wed Nov 26 07:37:32.443007 2025] [:error] [pid 34744:tid 34804] [client 85.203.23.57:52829] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "aSY9vEtgOvVbhyALkTSb-gAAAYE"]
[Wed Nov 26 07:37:32.725058 2025] [:error] [pid 34830:tid 34838] [client 85.203.23.72:23009] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "aSY9vEukvkWgWN6jCR1TvQAAAAY"]
[Wed Nov 26 07:37:32.984788 2025] [:error] [pid 34743:tid 34784] [client 85.203.23.107:38461] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/5PJcpMFsD8B.php"] [unique_id "aSY9vAvyX7Q5oU7_mBxKfgAAAUg"]
[Wed Nov 26 07:37:33.321969 2025] [:error] [pid 34744:tid 34827] [client 85.203.23.80:35225] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/image/5PJcpMFsD8B.php"] [unique_id "aSY9vUtgOvVbhyALkTSb_QAAAZg"]
[Wed Nov 26 07:37:35.895168 2025] [:error] [pid 34743:tid 34799] [client 85.203.23.86:31441] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/export.php"] [unique_id "aSY9vwvyX7Q5oU7_mBxKhgAAAVc"]
[Wed Nov 26 07:37:37.167565 2025] [:error] [pid 34830:tid 34838] [client 85.203.23.63:59479] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/network_xo.php"] [unique_id "aSY9wUukvkWgWN6jCR1TxAAAAAY"]
[Wed Nov 26 07:37:37.981701 2025] [:error] [pid 34744:tid 34821] [client 85.203.23.58:50295] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aSY9wUtgOvVbhyALkTScBwAAAZI"]
[Wed Nov 26 07:37:38.267920 2025] [:error] [pid 34744:tid 34827] [client 85.203.23.71:49755] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aSY9wktgOvVbhyALkTScCAAAAZg"]
[Wed Nov 26 07:37:38.602781 2025] [:error] [pid 34830:tid 34850] [client 85.203.23.100:56555] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/"] [unique_id "aSY9wkukvkWgWN6jCR1TxQAAABI"]
[Wed Nov 26 07:37:39.017598 2025] [:error] [pid 35540:tid 35546] [client 85.203.23.102:47925] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aSY9w8GrIq2A6SZSnkLyCwAAAIA"]
[Wed Nov 26 07:37:39.214656 2025] [:error] [pid 35540:tid 35565] [client 85.203.23.86:41083] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope_normal.php"] [unique_id "aSY9w8GrIq2A6SZSnkLyDAAAAJM"]
[Wed Nov 26 07:37:39.535346 2025] [:error] [pid 34744:tid 34809] [client 85.203.23.104:37539] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/makeasmtp.php"] [unique_id "aSY9w0tgOvVbhyALkTScDQAAAYY"]
[Wed Nov 26 07:37:39.778696 2025] [:error] [pid 34744:tid 34806] [client 85.203.23.73:38413] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wpr-addons/forms/b1ack.php"] [unique_id "aSY9w0tgOvVbhyALkTScDgAAAYM"]
[Wed Nov 26 07:37:40.056501 2025] [:error] [pid 34743:tid 34792] [client 85.203.23.65:35205] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/222.php"] [unique_id "aSY9xAvyX7Q5oU7_mBxKjQAAAVA"]
[Wed Nov 26 07:37:40.264173 2025] [:error] [pid 34744:tid 34826] [client 85.203.23.55:37605] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/phpad/as.php"] [unique_id "aSY9xEtgOvVbhyALkTScDwAAAZc"]
[Wed Nov 26 07:37:40.489293 2025] [:error] [pid 35540:tid 35562] [client 85.203.23.90:62393] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/updates.php"] [unique_id "aSY9xMGrIq2A6SZSnkLyDwAAAJA"]
[Wed Nov 26 07:37:42.148809 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.57:46345] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSY9xktgOvVbhyALkTScFwAAAZY"]
[Wed Nov 26 07:37:42.342832 2025] [:error] [pid 34742:tid 34769] [client 85.203.23.107:20763] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/form.php"] [unique_id "aSY9xpSuLNwpQF_jzAfy4wAAAFU"]
[Wed Nov 26 07:37:42.589966 2025] [:error] [pid 35540:tid 35547] [client 85.203.23.76:33395] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-json/wp/v2/posts"] [unique_id "aSY9xsGrIq2A6SZSnkLyFgAAAIE"]
[Wed Nov 26 07:37:43.032999 2025] [:error] [pid 34744:tid 34822] [client 85.203.23.93:24821] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-parsidate/includes/admin/acf-fields-adyrui.php"] [unique_id "aSY9x0tgOvVbhyALkTScGgAAAZM"]
[Wed Nov 26 07:37:43.221682 2025] [:error] [pid 34742:tid 34765] [client 85.203.23.94:58963] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/asasx.php"] [unique_id "aSY9x5SuLNwpQF_jzAfy5wAAAFE"]
[Wed Nov 26 07:37:43.444657 2025] [:error] [pid 34743:tid 34787] [client 85.203.23.76:60725] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aback.php"] [unique_id "aSY9xwvyX7Q5oU7_mBxKmQAAAUs"]
[Wed Nov 26 07:37:43.638866 2025] [:error] [pid 34743:tid 34788] [client 85.203.23.105:26347] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aSY9xwvyX7Q5oU7_mBxKmgAAAUw"]
[Wed Nov 26 07:37:44.259822 2025] [:error] [pid 34742:tid 34760] [client 85.203.23.74:45265] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/ad.php"] [unique_id "aSY9yJSuLNwpQF_jzAfy6AAAAEw"]
[Wed Nov 26 07:37:44.567965 2025] [:error] [pid 34742:tid 34751] [client 85.203.23.65:32189] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/moderation.php"] [unique_id "aSY9yJSuLNwpQF_jzAfy6QAAAEM"]
[Wed Nov 26 07:37:44.792447 2025] [:error] [pid 34830:tid 34838] [client 85.203.23.96:27789] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aSY9yEukvkWgWN6jCR1T1AAAAAY"]
[Wed Nov 26 07:37:50.208371 2025] [:error] [pid 34744:tid 34809] [client 85.203.23.75:31879] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aSY9zktgOvVbhyALkTScJQAAAYY"]
[Wed Nov 26 07:37:55.654541 2025] [:error] [pid 34742:tid 34748] [client 85.203.23.105:20195] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aSY905SuLNwpQF_jzAfy9gAAAEA"]
[Wed Nov 26 07:37:55.870790 2025] [:error] [pid 35540:tid 35560] [client 85.203.23.63:44271] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aSY908GrIq2A6SZSnkLyKgAAAI4"]
[Wed Nov 26 07:37:56.172804 2025] [:error] [pid 34742:tid 34757] [client 85.203.23.83:34447] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "aSY91JSuLNwpQF_jzAfy9wAAAEk"]
[Wed Nov 26 07:37:58.066380 2025] [:error] [pid 35540:tid 35555] [client 85.203.23.99:56489] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/leaf.php"] [unique_id "aSY91sGrIq2A6SZSnkLyMAAAAIk"]
[Wed Nov 26 07:38:03.407353 2025] [:error] [pid 34743:tid 34799] [client 85.203.23.96:36035] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aSY92wvyX7Q5oU7_mBxKvAAAAVc"]
[Wed Nov 26 07:38:08.629386 2025] [:error] [pid 34742:tid 34765] [client 85.203.23.102:20765] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/mainhosting/default.php"] [unique_id "aSY94JSuLNwpQF_jzAfzBwAAAFE"]
[Wed Nov 26 07:38:08.838747 2025] [:error] [pid 34830:tid 34850] [client 85.203.23.68:35323] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/about.php"] [unique_id "aSY94EukvkWgWN6jCR1T9QAAABI"]
[Wed Nov 26 07:38:09.048958 2025] [:error] [pid 34744:tid 34810] [client 85.203.23.90:50443] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aSY94UtgOvVbhyALkTScSAAAAYc"]
[Wed Nov 26 07:38:09.333389 2025] [:error] [pid 34742:tid 34754] [client 85.203.23.83:48731] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aSY94ZSuLNwpQF_jzAfzCAAAAEY"]
[Wed Nov 26 07:38:09.883006 2025] [:error] [pid 34830:tid 34856] [client 85.203.23.107:48805] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aSY94UukvkWgWN6jCR1T-AAAABg"]
[Wed Nov 26 07:38:10.260061 2025] [:error] [pid 34744:tid 34824] [client 85.203.23.95:36423] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aSY94ktgOvVbhyALkTScSQAAAZU"]
[Wed Nov 26 07:38:15.520380 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.93:21239] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aSY955SuLNwpQF_jzAfzDAAAAFQ"]
[Wed Nov 26 07:38:15.702128 2025] [:error] [pid 34830:tid 34852] [client 85.203.23.77:26513] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aSY950ukvkWgWN6jCR1UAAAAABQ"]
[Wed Nov 26 07:38:16.084597 2025] [:error] [pid 34830:tid 34832] [client 85.203.23.73:64599] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aSY96EukvkWgWN6jCR1UAgAAAAA"]
[Wed Nov 26 07:38:16.300341 2025] [:error] [pid 35540:tid 35563] [client 85.203.23.55:63993] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xml.php"] [unique_id "aSY96MGrIq2A6SZSnkLyVQAAAJE"]
[Wed Nov 26 07:38:16.485451 2025] [:error] [pid 34742:tid 34752] [client 85.203.23.55:21393] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aSY96JSuLNwpQF_jzAfzDgAAAEQ"]
[Wed Nov 26 07:38:18.286165 2025] [:error] [pid 34744:tid 34811] [client 85.203.23.63:34483] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/images/class-config.php"] [unique_id "aSY96ktgOvVbhyALkTScWAAAAYg"]
[Wed Nov 26 07:38:18.492677 2025] [:error] [pid 34744:tid 34809] [client 85.203.23.76:55653] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aSY96ktgOvVbhyALkTScWgAAAYY"]
[Wed Nov 26 07:38:25.256795 2025] [:error] [pid 34744:tid 34818] [client 85.203.23.72:45741] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aSY98UtgOvVbhyALkTScZwAAAY8"]
[Wed Nov 26 07:38:25.644507 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.72:53397] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/back.php"] [unique_id "aSY98ZSuLNwpQF_jzAfzFAAAAFQ"]
[Wed Nov 26 07:38:25.837757 2025] [:error] [pid 34830:tid 34842] [client 85.203.23.85:23503] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSY98UukvkWgWN6jCR1UDQAAAAo"]
[Wed Nov 26 07:38:26.028629 2025] [:error] [pid 34830:tid 34856] [client 85.203.23.101:65241] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSY98kukvkWgWN6jCR1UDgAAABg"]
[Wed Nov 26 07:38:26.267464 2025] [:error] [pid 34743:tid 34800] [client 85.203.23.74:55849] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aSY98gvyX7Q5oU7_mBxK1QAAAVg"]
[Wed Nov 26 07:38:31.497259 2025] [:error] [pid 34830:tid 34833] [client 85.203.23.96:21505] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSY990ukvkWgWN6jCR1UFAAAAAE"]
[Wed Nov 26 07:38:31.754151 2025] [:error] [pid 34744:tid 34804] [client 85.203.23.61:35621] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/up.php"] [unique_id "aSY990tgOvVbhyALkTSccAAAAYE"]
[Wed Nov 26 07:38:37.020257 2025] [:error] [pid 34744:tid 34806] [client 85.203.23.90:22081] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aSY9_UtgOvVbhyALkTScdAAAAYM"]
[Wed Nov 26 07:38:37.398971 2025] [:error] [pid 34744:tid 34814] [client 85.203.23.90:60333] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-l0gin.php"] [unique_id "aSY9_UtgOvVbhyALkTScdwAAAYs"]
[Wed Nov 26 07:38:37.650298 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.60:46691] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aSY9_ZSuLNwpQF_jzAfzIAAAAFQ"]
[Wed Nov 26 07:38:42.946516 2025] [:error] [pid 34744:tid 34810] [client 85.203.23.66:44857] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aSY-AktgOvVbhyALkTScnQAAAYc"]
[Wed Nov 26 07:38:43.159129 2025] [:error] [pid 34744:tid 34805] [client 85.203.23.95:59901] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "aSY-A0tgOvVbhyALkTScnwAAAYI"]
[Wed Nov 26 07:38:43.345621 2025] [:error] [pid 34743:tid 34796] [client 85.203.23.74:60339] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aSY-AwvyX7Q5oU7_mBxK6AAAAVQ"]
[Wed Nov 26 07:38:48.591431 2025] [:error] [pid 34830:tid 34848] [client 85.203.23.99:60275] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aSY-CEukvkWgWN6jCR1ULwAAABA"]
[Wed Nov 26 07:38:48.837798 2025] [:error] [pid 34742:tid 34753] [client 85.203.23.94:30337] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aSY-CJSuLNwpQF_jzAfzLgAAAEU"]
[Wed Nov 26 07:38:49.045756 2025] [:error] [pid 34743:tid 34793] [client 85.203.23.100:27019] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/autoload_classmap/function.php"] [unique_id "aSY-CQvyX7Q5oU7_mBxK8QAAAVE"]
[Wed Nov 26 07:38:49.359546 2025] [:error] [pid 34742:tid 34759] [client 85.203.23.104:47513] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/"] [unique_id "aSY-CZSuLNwpQF_jzAfzMAAAAEs"]
[Wed Nov 26 07:38:50.049395 2025] [:error] [pid 34742:tid 34750] [client 85.203.23.90:33741] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aSY-CpSuLNwpQF_jzAfzMQAAAEI"]
[Wed Nov 26 07:38:51.242856 2025] [:error] [pid 35540:tid 35563] [client 85.203.23.65:32837] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aSY-C8GrIq2A6SZSnkLydwAAAJE"]
[Wed Nov 26 07:38:51.463134 2025] [:error] [pid 34830:tid 34839] [client 85.203.23.54:20091] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aSY-C0ukvkWgWN6jCR1UPAAAAAc"]
[Wed Nov 26 07:38:51.657195 2025] [:error] [pid 35540:tid 35549] [client 85.203.23.61:43647] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aSY-C8GrIq2A6SZSnkLyeQAAAIM"]
[Wed Nov 26 07:38:51.909424 2025] [:error] [pid 34830:tid 34844] [client 85.203.23.85:57423] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aSY-C0ukvkWgWN6jCR1UPwAAAAw"]
[Wed Nov 26 07:38:52.209414 2025] [:error] [pid 35540:tid 35569] [client 85.203.23.83:48353] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aSY-DMGrIq2A6SZSnkLyewAAAJc"]
[Wed Nov 26 07:38:52.701600 2025] [:error] [pid 34830:tid 34841] [client 85.203.23.66:21287] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/nf_tracking.php"] [unique_id "aSY-DEukvkWgWN6jCR1UQAAAAAk"]
[Wed Nov 26 07:38:53.396026 2025] [:error] [pid 34742:tid 34764] [client 85.203.23.106:57553] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aSY-DZSuLNwpQF_jzAfzNQAAAFA"]
[Wed Nov 26 07:39:08.887703 2025] [:error] [pid 35540:tid 35559] [client 85.203.23.80:20733] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/natural.php"] [unique_id "aSY-HMGrIq2A6SZSnkLykwAAAI0"]
[Wed Nov 26 07:39:09.244069 2025] [:error] [pid 34742:tid 34760] [client 85.203.23.73:48151] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aSY-HZSuLNwpQF_jzAfzRQAAAEw"]
[Wed Nov 26 07:39:09.435952 2025] [:error] [pid 34744:tid 34816] [client 85.203.23.107:59767] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aSY-HUtgOvVbhyALkTSc3wAAAY0"]
[Wed Nov 26 07:39:09.726998 2025] [:error] [pid 34830:tid 34832] [client 85.203.23.57:64415] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "aSY-HUukvkWgWN6jCR1UVAAAAAA"]
[Wed Nov 26 07:39:10.743606 2025] [:error] [pid 34744:tid 34823] [client 85.203.23.61:32491] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSY-HktgOvVbhyALkTSc4AAAAZQ"]
[Wed Nov 26 07:39:11.692970 2025] [:error] [pid 35540:tid 35564] [client 85.203.23.92:25161] [client 85.203.23.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSY-H8GrIq2A6SZSnkLymgAAAJI"]
[Wed Nov 26 07:39:12.352809 2025] [:error] [pid 35540:tid 35549] [client 85.203.23.61:23849] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/"] [unique_id "aSY-IMGrIq2A6SZSnkLyngAAAIM"]
[Wed Nov 26 07:39:22.605193 2025] [:error] [pid 34830:tid 34840] [client 85.203.23.63:59559] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aSY-KkukvkWgWN6jCR1UZgAAAAg"]
[Wed Nov 26 07:39:22.819754 2025] [:error] [pid 34744:tid 34812] [client 85.203.23.106:39411] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aSY-KktgOvVbhyALkTSc_wAAAYk"]
[Wed Nov 26 07:39:23.153368 2025] [:error] [pid 35540:tid 35558] [client 85.203.23.63:27107] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/function.php"] [unique_id "aSY-K8GrIq2A6SZSnkLyuQAAAIw"]
[Wed Nov 26 07:39:23.542567 2025] [:error] [pid 35540:tid 35546] [client 85.203.23.54:47013] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aSY-K8GrIq2A6SZSnkLyvAAAAIA"]
[Wed Nov 26 07:39:29.574531 2025] [:error] [pid 34744:tid 34827] [client 85.203.23.55:37815] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/fast.php"] [unique_id "aSY-MUtgOvVbhyALkTSdEwAAAZg"]
[Wed Nov 26 07:39:30.223672 2025] [:error] [pid 34742:tid 34771] [client 85.203.23.57:41563] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aSY-MpSuLNwpQF_jzAfzSgAAAFc"]
[Wed Nov 26 07:39:35.464170 2025] [:error] [pid 35540:tid 35548] [client 85.203.23.84:48145] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/"] [unique_id "aSY-N8GrIq2A6SZSnkLyzQAAAII"]
[Wed Nov 26 07:39:35.674072 2025] [:error] [pid 34830:tid 34832] [client 85.203.23.99:45839] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aSY-N0ukvkWgWN6jCR1UcQAAAAA"]
[Wed Nov 26 07:39:41.067358 2025] [:error] [pid 34830:tid 34846] [client 85.203.23.100:51705] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php7"] [unique_id "aSY-PUukvkWgWN6jCR1UdgAAAA4"]
[Wed Nov 26 07:39:41.305947 2025] [:error] [pid 35540:tid 35554] [client 85.203.23.54:50493] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aSY-PcGrIq2A6SZSnkLy4QAAAIg"]
[Wed Nov 26 07:39:41.729409 2025] [:error] [pid 35540:tid 35556] [client 85.203.23.73:56151] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/function/function.php"] [unique_id "aSY-PcGrIq2A6SZSnkLy4wAAAIo"]
[Wed Nov 26 07:39:41.942016 2025] [:error] [pid 34743:tid 34784] [client 85.203.23.99:58541] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/"] [unique_id "aSY-PQvyX7Q5oU7_mBxLVgAAAUg"]
[Wed Nov 26 07:39:42.711323 2025] [:error] [pid 34830:tid 34835] [client 85.203.23.71:37151] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aSY-PkukvkWgWN6jCR1UeAAAAAM"]
[Wed Nov 26 07:39:43.160879 2025] [:error] [pid 34743:tid 34797] [client 85.203.23.95:64715] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aSY-PwvyX7Q5oU7_mBxLWgAAAVU"]
[Wed Nov 26 07:39:44.047724 2025] [:error] [pid 34744:tid 34806] [client 85.203.23.100:60207] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/"] [unique_id "aSY-QEtgOvVbhyALkTSdLwAAAYM"]
[Wed Nov 26 07:39:44.252327 2025] [:error] [pid 34743:tid 34796] [client 85.203.23.90:27867] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSY-QAvyX7Q5oU7_mBxLXgAAAVQ"]
[Wed Nov 26 07:39:44.506998 2025] [:error] [pid 35540:tid 35547] [client 85.203.23.88:36829] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-"] [unique_id "aSY-QMGrIq2A6SZSnkLy5QAAAIE"]
[Wed Nov 26 07:39:44.788478 2025] [:error] [pid 35540:tid 35569] [client 85.203.23.75:51857] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-error.php"] [unique_id "aSY-QMGrIq2A6SZSnkLy5gAAAJc"]
[Wed Nov 26 07:39:45.048223 2025] [:error] [pid 34743:tid 34785] [client 85.203.23.59:23335] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aSY-QQvyX7Q5oU7_mBxLYAAAAUk"]
[Wed Nov 26 07:39:45.430559 2025] [:error] [pid 34830:tid 34832] [client 85.203.23.67:30745] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aSY-QUukvkWgWN6jCR1UewAAAAA"]
[Wed Nov 26 07:39:45.767403 2025] [:error] [pid 35540:tid 35553] [client 85.203.23.65:41721] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/"] [unique_id "aSY-QcGrIq2A6SZSnkLy6wAAAIc"]
[Wed Nov 26 07:39:45.989093 2025] [:error] [pid 34743:tid 34777] [client 85.203.23.89:59129] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aSY-QQvyX7Q5oU7_mBxLYQAAAUE"]
[Wed Nov 26 07:39:46.512070 2025] [:error] [pid 34742:tid 34751] [client 85.203.23.65:27149] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aSY-QpSuLNwpQF_jzAfzVAAAAEM"]
[Wed Nov 26 07:39:51.718383 2025] [:error] [pid 35540:tid 35570] [client 85.203.23.61:26079] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/"] [unique_id "aSY-R8GrIq2A6SZSnkLy9QAAAJg"]
[Wed Nov 26 07:39:51.917025 2025] [:error] [pid 34744:tid 34823] [client 85.203.23.74:42405] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aSY-R0tgOvVbhyALkTSdOwAAAZQ"]
[Wed Nov 26 07:39:52.138452 2025] [:error] [pid 34830:tid 34833] [client 85.203.23.86:48047] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "aSY-SEukvkWgWN6jCR1UgAAAAAE"]
[Wed Nov 26 07:39:52.524655 2025] [:error] [pid 34743:tid 34798] [client 85.203.23.105:62457] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/load.php"] [unique_id "aSY-SAvyX7Q5oU7_mBxLZQAAAVY"]
[Wed Nov 26 07:39:52.954840 2025] [:error] [pid 34743:tid 34794] [client 85.203.23.83:64587] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/edit.php"] [unique_id "aSY-SAvyX7Q5oU7_mBxLZgAAAVI"]
[Wed Nov 26 07:39:53.671482 2025] [:error] [pid 34742:tid 34753] [client 85.203.23.65:55045] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aSY-SZSuLNwpQF_jzAfzWQAAAEU"]
[Wed Nov 26 07:39:53.948287 2025] [:error] [pid 34742:tid 34764] [client 85.203.23.59:21539] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aSY-SZSuLNwpQF_jzAfzWgAAAFA"]
[Wed Nov 26 07:39:54.200576 2025] [:error] [pid 34744:tid 34815] [client 85.203.23.85:38297] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aSY-SktgOvVbhyALkTSdPgAAAYw"]
[Wed Nov 26 07:39:59.711802 2025] [:error] [pid 35540:tid 35550] [client 85.203.23.84:33749] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aSY-T8GrIq2A6SZSnkLy-AAAAIQ"]
[Wed Nov 26 07:40:05.078991 2025] [:error] [pid 34830:tid 34841] [client 85.203.23.67:54255] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentyfifteen/shell3.php"] [unique_id "aSY-VUukvkWgWN6jCR1UjAAAAAk"]
[Wed Nov 26 07:40:05.453099 2025] [:error] [pid 35540:tid 35566] [client 85.203.23.91:30753] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aSY-VcGrIq2A6SZSnkLy_wAAAJQ"]
[Wed Nov 26 07:40:05.689461 2025] [:error] [pid 34744:tid 34812] [client 85.203.23.95:53527] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aSY-VUtgOvVbhyALkTSdRQAAAYk"]
[Wed Nov 26 07:40:05.915224 2025] [:error] [pid 35540:tid 35565] [client 85.203.23.68:50043] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSY-VcGrIq2A6SZSnkLzAgAAAJM"]
[Wed Nov 26 07:40:06.162623 2025] [:error] [pid 34830:tid 34842] [client 85.203.23.89:51963] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aSY-VkukvkWgWN6jCR1UkQAAAAo"]
[Wed Nov 26 07:40:06.388397 2025] [:error] [pid 34830:tid 34837] [client 85.203.23.90:45317] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aSY-VkukvkWgWN6jCR1UkgAAAAU"]
[Wed Nov 26 07:40:06.754968 2025] [:error] [pid 34830:tid 34840] [client 85.203.23.61:27119] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/upload/"] [unique_id "aSY-VkukvkWgWN6jCR1UkwAAAAg"]
[Wed Nov 26 07:40:12.118672 2025] [:error] [pid 34744:tid 34820] [client 85.203.23.80:63117] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aSY-XEtgOvVbhyALkTSdWAAAAZE"]
[Wed Nov 26 07:40:12.566085 2025] [:error] [pid 35540:tid 35548] [client 85.203.23.106:50893] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/"] [unique_id "aSY-XMGrIq2A6SZSnkLzFQAAAII"]
[Wed Nov 26 07:40:12.832289 2025] [:error] [pid 34744:tid 34803] [client 85.203.23.54:28155] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSY-XEtgOvVbhyALkTSdWQAAAYA"]
[Wed Nov 26 07:40:18.058918 2025] [:error] [pid 34744:tid 34803] [client 85.203.23.90:47303] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/revslider/includes/external/page/"] [unique_id "aSY-YktgOvVbhyALkTSdYQAAAYA"]
[Wed Nov 26 07:40:18.410166 2025] [:error] [pid 35540:tid 35557] [client 85.203.23.75:40979] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/"] [unique_id "aSY-YsGrIq2A6SZSnkLzIQAAAIs"]
[Wed Nov 26 07:40:18.753029 2025] [:error] [pid 35540:tid 35563] [client 85.203.23.104:23029] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aSY-YsGrIq2A6SZSnkLzIwAAAJE"]
[Wed Nov 26 07:40:19.589517 2025] [:error] [pid 34744:tid 34805] [client 85.203.23.68:34795] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aSY-Y0tgOvVbhyALkTSdYwAAAYI"]
[Wed Nov 26 07:40:20.167239 2025] [:error] [pid 34744:tid 34823] [client 85.203.23.68:44135] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aSY-ZEtgOvVbhyALkTSdZwAAAZQ"]
[Wed Nov 26 07:40:20.495874 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.100:61861] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/"] [unique_id "aSY-ZEtgOvVbhyALkTSdaAAAAZY"]
[Wed Nov 26 07:40:25.703641 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.106:40389] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aSY-aZSuLNwpQF_jzAfzggAAAFQ"]
[Wed Nov 26 07:40:36.196683 2025] [:error] [pid 34743:tid 34794] [client 85.203.23.72:63167] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aSY-dAvyX7Q5oU7_mBxLugAAAVI"]
[Wed Nov 26 07:40:39.596675 2025] [:error] [pid 34744:tid 34804] [client 85.203.23.67:39803] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/"] [unique_id "aSY-d0tgOvVbhyALkTSdjgAAAYE"]
[Wed Nov 26 07:40:46.250895 2025] [:error] [pid 34744:tid 34812] [client 85.203.23.54:58591] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aSY-fktgOvVbhyALkTSdmwAAAYk"]
[Wed Nov 26 07:40:46.623747 2025] [:error] [pid 34742:tid 34767] [client 85.203.23.91:36873] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/"] [unique_id "aSY-fpSuLNwpQF_jzAfzkAAAAFM"]
[Wed Nov 26 07:40:46.825386 2025] [:error] [pid 34743:tid 34780] [client 85.203.23.60:47087] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/css/"] [unique_id "aSY-fgvyX7Q5oU7_mBxLxgAAAUQ"]
[Wed Nov 26 07:40:47.194597 2025] [:error] [pid 34743:tid 34788] [client 85.203.23.61:26003] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aSY-fwvyX7Q5oU7_mBxLxwAAAUw"]
[Wed Nov 26 07:40:47.478439 2025] [:error] [pid 34743:tid 34785] [client 85.203.23.68:40453] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/admin-header.php"] [unique_id "aSY-fwvyX7Q5oU7_mBxLyAAAAUk"]
[Wed Nov 26 07:40:53.197150 2025] [:error] [pid 34830:tid 34842] [client 85.203.23.91:60353] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-conflg/function.php"] [unique_id "aSY-hUukvkWgWN6jCR1U0QAAAAo"]
[Wed Nov 26 07:40:54.106010 2025] [:error] [pid 34830:tid 34839] [client 85.203.23.74:54675] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aSY-hkukvkWgWN6jCR1U0gAAAAc"]
[Wed Nov 26 07:41:10.136673 2025] [:error] [pid 34744:tid 34812] [client 85.203.23.88:49437] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/"] [unique_id "aSY-lktgOvVbhyALkTSduAAAAYk"]
[Wed Nov 26 07:41:10.416299 2025] [:error] [pid 34830:tid 34842] [client 85.203.23.58:41487] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin/"] [unique_id "aSY-lkukvkWgWN6jCR1U6QAAAAo"]
[Wed Nov 26 07:41:15.721071 2025] [:error] [pid 34744:tid 34824] [client 85.203.23.102:57855] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aSY-m0tgOvVbhyALkTSdxgAAAZU"]
[Wed Nov 26 07:41:15.931985 2025] [:error] [pid 34744:tid 34822] [client 85.203.23.59:29823] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aSY-m0tgOvVbhyALkTSdyAAAAZM"]
[Wed Nov 26 07:41:16.665364 2025] [:error] [pid 34744:tid 34827] [client 85.203.23.102:32599] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aSY-nEtgOvVbhyALkTSdygAAAZg"]
[Wed Nov 26 07:41:17.280909 2025] [:error] [pid 34742:tid 34757] [client 85.203.23.72:61435] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aSY-nZSuLNwpQF_jzAfztQAAAEk"]
[Wed Nov 26 07:41:17.535696 2025] [:error] [pid 34742:tid 34767] [client 85.203.23.77:53907] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aSY-nZSuLNwpQF_jzAfztgAAAFM"]
[Wed Nov 26 07:41:19.000021 2025] [:error] [pid 34744:tid 34820] [client 85.203.23.95:56081] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/"] [unique_id "aSY-nktgOvVbhyALkTSdzwAAAZE"]
[Wed Nov 26 07:41:19.351100 2025] [:error] [pid 34744:tid 34816] [client 85.203.23.67:49097] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aSY-n0tgOvVbhyALkTSd0AAAAY0"]
[Wed Nov 26 07:41:25.480663 2025] [:error] [pid 35540:tid 35546] [client 85.203.23.99:37057] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aSY-pcGrIq2A6SZSnkLz1QAAAIA"]
[Wed Nov 26 07:41:30.767403 2025] [:error] [pid 34830:tid 34855] [client 85.203.23.76:58667] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/fm.php/sts.php"] [unique_id "aSY-qkukvkWgWN6jCR1VDQAAABc"]
[Wed Nov 26 07:41:36.068938 2025] [:error] [pid 34744:tid 34817] [client 85.203.23.80:25891] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/"] [unique_id "aSY-sEtgOvVbhyALkTSd4gAAAY4"]
[Wed Nov 26 07:41:46.462827 2025] [:error] [pid 34744:tid 34823] [client 85.203.23.57:34833] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/"] [unique_id "aSY-uktgOvVbhyALkTSd8gAAAZQ"]
[Wed Nov 26 07:41:46.741758 2025] [:error] [pid 34744:tid 34814] [client 85.203.23.61:24529] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aSY-uktgOvVbhyALkTSd9AAAAYs"]
[Wed Nov 26 07:41:46.946278 2025] [:error] [pid 34744:tid 34821] [client 85.203.23.96:47105] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSY-uktgOvVbhyALkTSd9gAAAZI"]
[Wed Nov 26 07:41:47.506655 2025] [:error] [pid 34744:tid 34822] [client 85.203.23.76:46881] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aSY-u0tgOvVbhyALkTSd-AAAAZM"]
[Wed Nov 26 07:41:47.878502 2025] [:error] [pid 35540:tid 35553] [client 85.203.23.61:53967] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin-wolf.php"] [unique_id "aSY-u8GrIq2A6SZSnkLz5QAAAIc"]
[Wed Nov 26 07:41:48.064504 2025] [:error] [pid 34830:tid 34832] [client 85.203.23.106:35577] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aSY-vEukvkWgWN6jCR1VFQAAAAA"]
[Wed Nov 26 07:41:49.388507 2025] [:error] [pid 34744:tid 34826] [client 85.203.23.84:55967] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aSY-vUtgOvVbhyALkTSd_AAAAZc"]
[Wed Nov 26 07:41:54.696764 2025] [:error] [pid 35540:tid 35564] [client 85.203.23.90:44773] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/acxx.php"] [unique_id "aSY-wsGrIq2A6SZSnkLz7QAAAJI"]
[Wed Nov 26 07:41:54.936371 2025] [:error] [pid 34744:tid 34812] [client 85.203.23.67:24917] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/news-portal/error.php"] [unique_id "aSY-wktgOvVbhyALkTSeAQAAAYk"]
[Wed Nov 26 07:41:56.312767 2025] [:error] [pid 34830:tid 34854] [client 85.203.23.84:31067] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aSY-xEukvkWgWN6jCR1VIgAAABY"]
[Wed Nov 26 07:41:56.715684 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.63:35679] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/"] [unique_id "aSY-xEtgOvVbhyALkTSeBgAAAZY"]
[Wed Nov 26 07:41:57.036362 2025] [:error] [pid 34744:tid 34813] [client 85.203.23.102:64189] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aSY-xUtgOvVbhyALkTSeCAAAAYo"]
[Wed Nov 26 07:41:57.814494 2025] [:error] [pid 34830:tid 34850] [client 85.203.23.89:34123] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "aSY-xUukvkWgWN6jCR1VJAAAABI"]
[Wed Nov 26 07:41:58.217384 2025] [:error] [pid 34743:tid 34787] [client 85.203.23.90:20099] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/nav.php"] [unique_id "aSY-xgvyX7Q5oU7_mBxMCQAAAUs"]
[Wed Nov 26 07:41:58.708822 2025] [:error] [pid 34744:tid 34814] [client 85.203.23.57:46403] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aSY-xktgOvVbhyALkTSeCwAAAYs"]
[Wed Nov 26 07:41:59.238838 2025] [:error] [pid 34742:tid 34766] [client 85.203.23.106:48383] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/"] [unique_id "aSY-x5SuLNwpQF_jzAfz1gAAAFI"]
[Wed Nov 26 07:41:59.635998 2025] [:error] [pid 34743:tid 34779] [client 85.203.23.78:63139] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aSY-xwvyX7Q5oU7_mBxMDAAAAUM"]
[Wed Nov 26 07:41:59.970887 2025] [:error] [pid 34743:tid 34791] [client 85.203.23.75:30147] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/archives/"] [unique_id "aSY-xwvyX7Q5oU7_mBxMDgAAAU8"]
[Wed Nov 26 07:42:00.308803 2025] [:error] [pid 34743:tid 34788] [client 85.203.23.105:57349] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/"] [unique_id "aSY-yAvyX7Q5oU7_mBxMEAAAAUw"]
[Wed Nov 26 07:42:00.516308 2025] [:error] [pid 35540:tid 35562] [client 85.203.23.72:28371] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aSY-yMGrIq2A6SZSnkLz8QAAAJA"]
[Wed Nov 26 07:42:00.849021 2025] [:error] [pid 34743:tid 34777] [client 85.203.23.63:45499] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content.php"] [unique_id "aSY-yAvyX7Q5oU7_mBxMEgAAAUE"]
[Wed Nov 26 07:42:01.089179 2025] [:error] [pid 34744:tid 34827] [client 85.203.23.63:29001] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSY-yUtgOvVbhyALkTSeDgAAAZg"]
[Wed Nov 26 07:42:06.366973 2025] [:error] [pid 34744:tid 34804] [client 85.203.23.66:54491] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aSY-zktgOvVbhyALkTSeGgAAAYE"]
[Wed Nov 26 07:42:06.646106 2025] [:error] [pid 34743:tid 34797] [client 85.203.23.99:30475] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-signup.php"] [unique_id "aSY-zgvyX7Q5oU7_mBxMGQAAAVU"]
[Wed Nov 26 07:42:07.040715 2025] [:error] [pid 34742:tid 34759] [client 85.203.23.84:47041] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/"] [unique_id "aSY-z5SuLNwpQF_jzAfz2AAAAEs"]
[Wed Nov 26 07:42:07.437321 2025] [:error] [pid 35540:tid 35551] [client 85.203.23.95:31687] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/about.php"] [unique_id "aSY-z8GrIq2A6SZSnkLz9wAAAIU"]
[Wed Nov 26 07:42:13.262567 2025] [:error] [pid 34743:tid 34789] [client 85.203.23.100:34083] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/m.php"] [unique_id "aSY-1QvyX7Q5oU7_mBxMIgAAAU0"]
[Wed Nov 26 07:42:13.601690 2025] [:error] [pid 34742:tid 34764] [client 85.203.23.107:33597] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aSY-1ZSuLNwpQF_jzAfz4AAAAFA"]
[Wed Nov 26 07:42:13.797724 2025] [:error] [pid 34742:tid 34766] [client 85.203.23.75:49415] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aSY-1ZSuLNwpQF_jzAfz4QAAAFI"]
[Wed Nov 26 07:42:14.295283 2025] [:error] [pid 34744:tid 34826] [client 85.203.23.94:42271] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aSY-1ktgOvVbhyALkTSeHwAAAZc"]
[Wed Nov 26 07:42:14.694440 2025] [:error] [pid 34830:tid 34847] [client 85.203.23.107:46335] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSY-1kukvkWgWN6jCR1VNwAAAA8"]
[Wed Nov 26 07:42:15.093656 2025] [:error] [pid 34744:tid 34821] [client 85.203.23.77:42565] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/"] [unique_id "aSY-10tgOvVbhyALkTSeIAAAAZI"]
[Wed Nov 26 07:42:15.322364 2025] [:error] [pid 34744:tid 34822] [client 85.203.23.73:27049] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aSY-10tgOvVbhyALkTSeIgAAAZM"]
[Wed Nov 26 07:42:20.678359 2025] [:error] [pid 34742:tid 34756] [client 85.203.23.89:36505] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/"] [unique_id "aSY-3JSuLNwpQF_jzAfz5wAAAEg"]
[Wed Nov 26 07:42:20.873950 2025] [:error] [pid 34830:tid 34837] [client 85.203.23.94:23869] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/themes/"] [unique_id "aSY-3EukvkWgWN6jCR1VPAAAAAU"]
[Wed Nov 26 07:42:21.147645 2025] [:error] [pid 34743:tid 34797] [client 85.203.23.100:52075] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/wp-good.php"] [unique_id "aSY-3QvyX7Q5oU7_mBxMKQAAAVU"]
[Wed Nov 26 07:42:21.352032 2025] [:error] [pid 34830:tid 34838] [client 85.203.23.93:35445] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/"] [unique_id "aSY-3UukvkWgWN6jCR1VPQAAAAY"]
[Wed Nov 26 07:42:21.699993 2025] [:error] [pid 34830:tid 34833] [client 85.203.23.106:54495] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/"] [unique_id "aSY-3UukvkWgWN6jCR1VPgAAAAE"]
[Wed Nov 26 07:42:26.993414 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.54:50379] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "aSY-4pSuLNwpQF_jzAf0AgAAAFQ"]
[Wed Nov 26 07:42:27.638499 2025] [:error] [pid 34744:tid 34811] [client 85.203.23.75:58323] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hello.php"] [unique_id "aSY-40tgOvVbhyALkTSeRwAAAYg"]
[Wed Nov 26 07:42:28.114487 2025] [:error] [pid 34830:tid 34835] [client 85.203.23.97:51945] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/bk/"] [unique_id "aSY-5EukvkWgWN6jCR1VSAAAAAM"]
[Wed Nov 26 07:42:28.546226 2025] [:error] [pid 34743:tid 34778] [client 85.203.23.93:41901] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSY-5AvyX7Q5oU7_mBxMMQAAAUI"]
[Wed Nov 26 07:42:30.049997 2025] [:error] [pid 34744:tid 34817] [client 85.203.23.86:62947] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSY-5ktgOvVbhyALkTSeUQAAAY4"]
[Wed Nov 26 07:42:30.456324 2025] [:error] [pid 34743:tid 34793] [client 85.203.23.97:31461] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aSY-5gvyX7Q5oU7_mBxMNAAAAVE"]
[Wed Nov 26 07:42:31.168181 2025] [:error] [pid 35540:tid 35560] [client 85.203.23.96:33357] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aSY-58GrIq2A6SZSnkL0EwAAAI4"]
[Wed Nov 26 07:42:37.321755 2025] [:error] [pid 34744:tid 34820] [client 85.203.23.55:50915] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aSY-7UtgOvVbhyALkTSeWgAAAZE"]
[Wed Nov 26 07:42:37.668107 2025] [:error] [pid 34830:tid 34854] [client 85.203.23.105:34045] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/admin.php"] [unique_id "aSY-7UukvkWgWN6jCR1VVgAAABY"]
[Wed Nov 26 07:42:37.975666 2025] [:error] [pid 34830:tid 34850] [client 85.203.23.63:53431] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSY-7UukvkWgWN6jCR1VVwAAABI"]
[Wed Nov 26 07:42:38.387453 2025] [:error] [pid 35540:tid 35563] [client 85.203.23.86:63921] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSY-7sGrIq2A6SZSnkL0HgAAAJE"]
[Wed Nov 26 07:42:38.617037 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.65:42923] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/chosen/function.php"] [unique_id "aSY-7ktgOvVbhyALkTSeXAAAAZY"]
[Wed Nov 26 07:42:39.711821 2025] [:error] [pid 34744:tid 34808] [client 85.203.23.102:24267] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "aSY-70tgOvVbhyALkTSeXQAAAYU"]
[Wed Nov 26 07:42:39.908713 2025] [:error] [pid 35540:tid 35568] [client 85.203.23.96:53061] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "aSY-78GrIq2A6SZSnkL0HwAAAJY"]
[Wed Nov 26 07:42:40.125186 2025] [:error] [pid 34743:tid 34792] [client 85.203.23.92:61957] [client 85.203.23.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aSY-8AvyX7Q5oU7_mBxMQAAAAVA"]
[Wed Nov 26 07:42:40.412280 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.76:62181] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "aSY-8JSuLNwpQF_jzAf0EAAAAFQ"]
[Wed Nov 26 07:42:40.653667 2025] [:error] [pid 34744:tid 34821] [client 85.203.23.91:42525] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "aSY-8EtgOvVbhyALkTSeYQAAAZI"]
[Wed Nov 26 07:42:46.203109 2025] [:error] [pid 34830:tid 34851] [client 85.203.23.74:41963] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aSY-9kukvkWgWN6jCR1VXQAAABM"]
[Wed Nov 26 07:42:51.431082 2025] [:error] [pid 34830:tid 34842] [client 85.203.23.76:36411] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aSY--0ukvkWgWN6jCR1VZwAAAAo"]
[Wed Nov 26 07:42:51.656408 2025] [:error] [pid 34744:tid 34814] [client 85.203.23.58:59145] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSY--0tgOvVbhyALkTSecQAAAYs"]
[Wed Nov 26 07:42:52.076168 2025] [:error] [pid 35540:tid 35548] [client 85.203.23.71:46441] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "aSY-_MGrIq2A6SZSnkL0KQAAAII"]
[Wed Nov 26 07:42:52.296278 2025] [:error] [pid 34742:tid 34754] [client 85.203.23.86:58847] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/"] [unique_id "aSY-_JSuLNwpQF_jzAf0GQAAAEY"]
[Wed Nov 26 07:42:52.488247 2025] [:error] [pid 34744:tid 34807] [client 85.203.23.99:32283] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aSY-_EtgOvVbhyALkTSedQAAAYQ"]
[Wed Nov 26 07:42:52.675070 2025] [:error] [pid 34742:tid 34760] [client 85.203.23.58:24427] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSY-_JSuLNwpQF_jzAf0GgAAAEw"]
[Wed Nov 26 07:42:52.945059 2025] [:error] [pid 34742:tid 34771] [client 85.203.23.89:61125] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/privacy-tools.min.php"] [unique_id "aSY-_JSuLNwpQF_jzAf0GwAAAFc"]
[Wed Nov 26 07:42:53.212240 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.95:39023] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aSY-_UtgOvVbhyALkTSedwAAAZY"]
[Wed Nov 26 07:42:58.451314 2025] [:error] [pid 34743:tid 34793] [client 85.203.23.77:50893] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aSY_AgvyX7Q5oU7_mBxMTgAAAVE"]
[Wed Nov 26 07:42:58.709194 2025] [:error] [pid 34830:tid 34852] [client 85.203.23.107:53901] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSY_AkukvkWgWN6jCR1VaQAAABQ"]
[Wed Nov 26 07:43:04.744145 2025] [:error] [pid 34742:tid 34762] [client 85.203.23.61:29827] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/function.php"] [unique_id "aSY_CJSuLNwpQF_jzAf0HwAAAE4"]
[Wed Nov 26 07:43:10.161929 2025] [:error] [pid 34744:tid 34809] [client 85.203.23.71:58997] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-header.php"] [unique_id "aSY_DktgOvVbhyALkTSekQAAAYY"]
[Wed Nov 26 07:43:15.459383 2025] [:error] [pid 34830:tid 34843] [client 85.203.23.89:20395] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSY_E0ukvkWgWN6jCR1VfQAAAAs"]
[Wed Nov 26 07:43:15.673831 2025] [:error] [pid 35540:tid 35549] [client 85.203.23.84:41377] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-author-name/"] [unique_id "aSY_E8GrIq2A6SZSnkL0QwAAAIM"]
[Wed Nov 26 07:43:15.903694 2025] [:error] [pid 34830:tid 34836] [client 85.203.23.99:42649] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aSY_E0ukvkWgWN6jCR1VfgAAAAQ"]
[Wed Nov 26 07:43:16.105964 2025] [:error] [pid 35540:tid 35553] [client 85.203.23.84:20333] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/"] [unique_id "aSY_FMGrIq2A6SZSnkL0RAAAAIc"]
[Wed Nov 26 07:43:16.348694 2025] [:error] [pid 34742:tid 34760] [client 85.203.23.59:21299] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/admin-ajax.php"] [unique_id "aSY_FJSuLNwpQF_jzAf0LQAAAEw"]
[Wed Nov 26 07:43:16.571969 2025] [:error] [pid 34830:tid 34841] [client 85.203.23.72:33395] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "aSY_FEukvkWgWN6jCR1VgAAAAAk"]
[Wed Nov 26 07:43:16.921869 2025] [:error] [pid 34743:tid 34790] [client 85.203.23.97:47767] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/about.php"] [unique_id "aSY_FAvyX7Q5oU7_mBxMXgAAAU4"]
[Wed Nov 26 07:43:17.151763 2025] [:error] [pid 34744:tid 34815] [client 85.203.23.84:38573] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/buy.php"] [unique_id "aSY_FUtgOvVbhyALkTSelAAAAYw"]
[Wed Nov 26 07:43:17.364413 2025] [:error] [pid 34743:tid 34779] [client 85.203.23.68:49517] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aSY_FQvyX7Q5oU7_mBxMXwAAAUM"]
[Wed Nov 26 07:43:17.609872 2025] [:error] [pid 34744:tid 34817] [client 85.203.23.61:31347] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "aSY_FUtgOvVbhyALkTSelQAAAY4"]
[Wed Nov 26 07:43:22.886698 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.58:51731] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/chosen.php"] [unique_id "aSY_GktgOvVbhyALkTSepAAAAZY"]
[Wed Nov 26 07:43:23.641427 2025] [:error] [pid 34743:tid 34793] [client 85.203.23.104:51601] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/"] [unique_id "aSY_GwvyX7Q5oU7_mBxMZgAAAVE"]
[Wed Nov 26 07:43:29.331120 2025] [:error] [pid 35540:tid 35562] [client 85.203.23.74:51795] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSY_IcGrIq2A6SZSnkL0UwAAAJA"]
[Wed Nov 26 07:43:44.906859 2025] [:error] [pid 34744:tid 34811] [client 85.203.23.72:23967] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/about.php"] [unique_id "aSY_MEtgOvVbhyALkTSe2AAAAYg"]
[Wed Nov 26 07:43:45.541131 2025] [:error] [pid 34744:tid 34818] [client 85.203.23.77:23737] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aSY_MUtgOvVbhyALkTSe3AAAAY8"]
[Wed Nov 26 07:43:45.741479 2025] [:error] [pid 34742:tid 34758] [client 85.203.23.74:54767] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aSY_MZSuLNwpQF_jzAf0PQAAAEo"]
[Wed Nov 26 07:43:46.068048 2025] [:error] [pid 35540:tid 35557] [client 85.203.23.88:53879] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aSY_MsGrIq2A6SZSnkL0bgAAAIs"]
[Wed Nov 26 07:43:46.278234 2025] [:error] [pid 34742:tid 34759] [client 85.203.23.65:32333] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "aSY_MpSuLNwpQF_jzAf0PgAAAEs"]
[Wed Nov 26 07:43:46.517989 2025] [:error] [pid 35540:tid 35551] [client 85.203.23.88:21185] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "aSY_MsGrIq2A6SZSnkL0cQAAAIU"]
[Wed Nov 26 07:43:46.899743 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.59:41925] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aSY_MpSuLNwpQF_jzAf0QQAAAFQ"]
[Wed Nov 26 07:43:57.297434 2025] [:error] [pid 35540:tid 35565] [client 85.203.23.92:38593] [client 85.203.23.92] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "aSY_PcGrIq2A6SZSnkL0gwAAAJM"]
[Wed Nov 26 07:43:57.810925 2025] [:error] [pid 34744:tid 34818] [client 85.203.23.57:44933] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/chosen.php"] [unique_id "aSY_PUtgOvVbhyALkTSfGQAAAY8"]
[Wed Nov 26 07:44:03.205298 2025] [:error] [pid 34743:tid 34799] [client 85.203.23.59:63643] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/chosen.php"] [unique_id "aSY_QwvyX7Q5oU7_mBxMywAAAVc"]
[Wed Nov 26 07:44:08.418500 2025] [:error] [pid 34744:tid 34817] [client 85.203.23.97:41187] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Utility/about.php"] [unique_id "aSY_SEtgOvVbhyALkTSfigAAAY4"]
[Wed Nov 26 07:44:08.612279 2025] [:error] [pid 34744:tid 34827] [client 85.203.23.88:20251] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aSY_SEtgOvVbhyALkTSfjAAAAZg"]
[Wed Nov 26 07:44:08.842515 2025] [:error] [pid 34743:tid 34780] [client 85.203.23.90:41207] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aSY_SAvyX7Q5oU7_mBxM7AAAAUQ"]
[Wed Nov 26 07:44:09.054277 2025] [:error] [pid 34743:tid 34793] [client 85.203.23.77:50625] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/classwithtostring.php"] [unique_id "aSY_SQvyX7Q5oU7_mBxM7gAAAVE"]
[Wed Nov 26 07:44:09.520499 2025] [:error] [pid 35540:tid 35560] [client 85.203.23.63:30965] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aSY_ScGrIq2A6SZSnkL05AAAAI4"]
[Wed Nov 26 07:44:09.751052 2025] [:error] [pid 34830:tid 34847] [client 85.203.23.99:50675] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/"] [unique_id "aSY_SUukvkWgWN6jCR1WLQAAAA8"]
[Wed Nov 26 07:44:10.460887 2025] [:error] [pid 34743:tid 34790] [client 85.203.23.63:63977] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/option-old.php"] [unique_id "aSY_SgvyX7Q5oU7_mBxM9gAAAU4"]
[Wed Nov 26 07:44:10.787504 2025] [:error] [pid 35540:tid 35569] [client 85.203.23.54:57319] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aSY_SsGrIq2A6SZSnkL08wAAAJc"]
[Wed Nov 26 07:44:16.370164 2025] [:error] [pid 34743:tid 34779] [client 85.203.23.97:40281] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/modern/about.php"] [unique_id "aSY_UAvyX7Q5oU7_mBxNEQAAAUM"]
[Wed Nov 26 07:44:17.057685 2025] [:error] [pid 34830:tid 34844] [client 85.203.23.93:51595] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "aSY_UUukvkWgWN6jCR1WYAAAAAw"]
[Wed Nov 26 07:44:17.281161 2025] [:error] [pid 34744:tid 34818] [client 85.203.23.72:48775] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/woh.php"] [unique_id "aSY_UUtgOvVbhyALkTSfqQAAAY8"]
[Wed Nov 26 07:44:17.688099 2025] [:error] [pid 34742:tid 34770] [client 85.203.23.77:33623] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/navigation/"] [unique_id "aSY_UZSuLNwpQF_jzAf0kgAAAFY"]
[Wed Nov 26 07:44:22.943832 2025] [:error] [pid 34742:tid 34772] [client 85.203.23.68:22449] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/shelp.php"] [unique_id "aSY_VpSuLNwpQF_jzAf0lgAAAFg"]
[Wed Nov 26 07:44:23.138382 2025] [:error] [pid 34830:tid 34838] [client 85.203.23.74:38849] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSY_V0ukvkWgWN6jCR1WaAAAAAY"]
[Wed Nov 26 07:44:23.395219 2025] [:error] [pid 35540:tid 35552] [client 85.203.23.80:45139] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "aSY_V8GrIq2A6SZSnkL1KgAAAIY"]
[Wed Nov 26 07:44:28.662725 2025] [:error] [pid 34743:tid 34796] [client 85.203.23.63:35915] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-conflg.php"] [unique_id "aSY_XAvyX7Q5oU7_mBxNHgAAAVQ"]
[Wed Nov 26 07:44:28.962923 2025] [:error] [pid 34743:tid 34791] [client 85.203.23.72:44317] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aSY_XAvyX7Q5oU7_mBxNHwAAAU8"]
[Wed Nov 26 07:44:29.213334 2025] [:error] [pid 34830:tid 34839] [client 85.203.23.58:62957] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/namespaced/Core/about.php"] [unique_id "aSY_XUukvkWgWN6jCR1WbQAAAAc"]
[Wed Nov 26 07:44:29.525988 2025] [:error] [pid 34830:tid 34853] [client 85.203.23.78:41613] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aSY_XUukvkWgWN6jCR1WbgAAABU"]
[Wed Nov 26 07:44:30.052264 2025] [:error] [pid 34742:tid 34751] [client 85.203.23.84:28189] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/chosen.php"] [unique_id "aSY_XpSuLNwpQF_jzAf0oAAAAEM"]
[Wed Nov 26 07:44:35.429755 2025] [:error] [pid 35540:tid 35546] [client 85.203.23.88:49381] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "aSY_Y8GrIq2A6SZSnkL1MwAAAIA"]
[Wed Nov 26 07:44:35.628941 2025] [:error] [pid 34743:tid 34781] [client 85.203.23.66:51861] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/themes.php"] [unique_id "aSY_YwvyX7Q5oU7_mBxNJQAAAUU"]
[Wed Nov 26 07:44:46.563216 2025] [:error] [pid 35540:tid 35566] [client 85.203.23.91:31719] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/chosen.php"] [unique_id "aSY_bsGrIq2A6SZSnkL1PQAAAJQ"]
[Wed Nov 26 07:44:46.913062 2025] [:error] [pid 34744:tid 34810] [client 85.203.23.91:31143] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/"] [unique_id "aSY_bktgOvVbhyALkTSgDQAAAYc"]
[Wed Nov 26 07:44:47.225937 2025] [:error] [pid 34744:tid 34804] [client 85.203.23.99:62525] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-content.php"] [unique_id "aSY_b0tgOvVbhyALkTSgEAAAAYE"]
[Wed Nov 26 07:44:52.570316 2025] [:error] [pid 34743:tid 34796] [client 85.203.23.55:64055] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aSY_dAvyX7Q5oU7_mBxNNwAAAVQ"]
[Wed Nov 26 07:44:52.761407 2025] [:error] [pid 34743:tid 34799] [client 85.203.23.92:42733] [client 85.203.23.92] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aSY_dAvyX7Q5oU7_mBxNOAAAAVc"]
[Wed Nov 26 07:44:53.105328 2025] [:error] [pid 35540:tid 35565] [client 85.203.23.71:58031] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/"] [unique_id "aSY_dcGrIq2A6SZSnkL1TwAAAJM"]
[Wed Nov 26 07:44:59.682086 2025] [:error] [pid 34742:tid 34761] [client 85.203.23.107:33187] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/image/about.php"] [unique_id "aSY_e5SuLNwpQF_jzAf0uQAAAE0"]
[Wed Nov 26 07:45:00.018422 2025] [:error] [pid 34743:tid 34797] [client 85.203.23.63:24015] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/chosen.php"] [unique_id "aSY_fAvyX7Q5oU7_mBxNQQAAAVU"]
[Wed Nov 26 07:45:00.260703 2025] [:error] [pid 35540:tid 35565] [client 85.203.23.90:31879] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/details/about.php"] [unique_id "aSY_fMGrIq2A6SZSnkL1WwAAAJM"]
[Wed Nov 26 07:45:00.783072 2025] [:error] [pid 34830:tid 34843] [client 85.203.23.85:64093] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aSY_fEukvkWgWN6jCR1WmwAAAAs"]
[Wed Nov 26 07:45:00.987933 2025] [:error] [pid 35540:tid 35567] [client 85.203.23.65:60385] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aSY_fMGrIq2A6SZSnkL1XgAAAJU"]
[Wed Nov 26 07:45:01.196586 2025] [:error] [pid 35540:tid 35557] [client 85.203.23.78:24745] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/column/"] [unique_id "aSY_fcGrIq2A6SZSnkL1YAAAAIs"]
[Wed Nov 26 07:45:01.703733 2025] [:error] [pid 34830:tid 34856] [client 85.203.23.80:35517] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/more/about.php"] [unique_id "aSY_fUukvkWgWN6jCR1WnAAAABg"]
[Wed Nov 26 07:45:02.099559 2025] [:error] [pid 34742:tid 34769] [client 85.203.23.84:60761] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-json-ajax-session.php"] [unique_id "aSY_fpSuLNwpQF_jzAf0vwAAAFU"]
[Wed Nov 26 07:45:02.976057 2025] [:error] [pid 34743:tid 34784] [client 85.203.23.107:26721] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "aSY_fgvyX7Q5oU7_mBxNRAAAAUg"]
[Wed Nov 26 07:45:03.199193 2025] [:error] [pid 35540:tid 35547] [client 85.203.23.61:52093] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/autoload_classmap.php"] [unique_id "aSY_f8GrIq2A6SZSnkL1YwAAAIE"]
[Wed Nov 26 07:45:03.461468 2025] [:error] [pid 34743:tid 34793] [client 85.203.23.59:39503] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/search/"] [unique_id "aSY_fwvyX7Q5oU7_mBxNRgAAAVE"]
[Wed Nov 26 07:45:03.710461 2025] [:error] [pid 34743:tid 34800] [client 85.203.23.85:45043] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-template/"] [unique_id "aSY_fwvyX7Q5oU7_mBxNSAAAAVg"]
[Wed Nov 26 07:45:04.060671 2025] [:error] [pid 35540:tid 35549] [client 85.203.23.102:56861] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/phpad/acp.php"] [unique_id "aSY_gMGrIq2A6SZSnkL1ZgAAAIM"]
[Wed Nov 26 07:45:04.313690 2025] [:error] [pid 34830:tid 34835] [client 85.203.23.89:21003] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aSY_gEukvkWgWN6jCR1WngAAAAM"]
[Wed Nov 26 07:45:04.565928 2025] [:error] [pid 34744:tid 34821] [client 85.203.23.84:23579] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/site-title/about.php"] [unique_id "aSY_gEtgOvVbhyALkTSgPgAAAZI"]
[Wed Nov 26 07:45:04.821319 2025] [:error] [pid 34830:tid 34852] [client 85.203.23.101:40623] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aSY_gEukvkWgWN6jCR1WnwAAABQ"]
[Wed Nov 26 07:45:10.975200 2025] [:error] [pid 34743:tid 34787] [client 85.203.23.85:59021] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aSY_hgvyX7Q5oU7_mBxNTgAAAUs"]
[Wed Nov 26 07:45:12.818365 2025] [:error] [pid 34743:tid 34788] [client 85.203.23.89:37929] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/site-tagline/"] [unique_id "aSY_iAvyX7Q5oU7_mBxNUQAAAUw"]
[Wed Nov 26 07:45:18.167788 2025] [:error] [pid 34743:tid 34780] [client 85.203.23.84:55573] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentythree/"] [unique_id "aSY_jgvyX7Q5oU7_mBxNYwAAAUQ"]
[Wed Nov 26 07:45:18.745008 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.68:59625] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aSY_jktgOvVbhyALkTSgcgAAAZY"]
[Wed Nov 26 07:45:19.171700 2025] [:error] [pid 34742:tid 34756] [client 85.203.23.54:52917] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "aSY_j5SuLNwpQF_jzAf07AAAAEg"]
[Wed Nov 26 07:45:19.458473 2025] [:error] [pid 34744:tid 34808] [client 85.203.23.77:26635] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/wp-conflg.php"] [unique_id "aSY_j0tgOvVbhyALkTSgdQAAAYU"]
[Wed Nov 26 07:45:19.737682 2025] [:error] [pid 34744:tid 34813] [client 85.203.23.85:20317] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/update/function.php"] [unique_id "aSY_j0tgOvVbhyALkTSgdgAAAYo"]
[Wed Nov 26 07:45:20.270026 2025] [:error] [pid 34830:tid 34840] [client 85.203.23.73:56801] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/akismet/_inc/img/about.php"] [unique_id "aSY_kEukvkWgWN6jCR1WvAAAAAg"]
[Wed Nov 26 07:45:21.291868 2025] [:error] [pid 34830:tid 34852] [client 85.203.23.77:55317] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/spacer/about.php"] [unique_id "aSY_kUukvkWgWN6jCR1WwAAAABQ"]
[Wed Nov 26 07:45:21.713424 2025] [:error] [pid 34742:tid 34761] [client 85.203.23.57:24275] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aSY_kZSuLNwpQF_jzAf08AAAAE0"]
[Wed Nov 26 07:45:21.946321 2025] [:error] [pid 34742:tid 34771] [client 85.203.23.91:65201] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSY_kZSuLNwpQF_jzAf08QAAAFc"]
[Wed Nov 26 07:45:22.131970 2025] [:error] [pid 34744:tid 34811] [client 85.203.23.54:32201] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/comments-pagination/"] [unique_id "aSY_kktgOvVbhyALkTSgewAAAYg"]
[Wed Nov 26 07:45:27.436096 2025] [:error] [pid 34742:tid 34760] [client 85.203.23.88:55667] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/database.php"] [unique_id "aSY_l5SuLNwpQF_jzAf09wAAAEw"]
[Wed Nov 26 07:45:27.838793 2025] [:error] [pid 34742:tid 34761] [client 85.203.23.78:41505] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-trackback.php"] [unique_id "aSY_l5SuLNwpQF_jzAf0-AAAAE0"]
[Wed Nov 26 07:45:28.069790 2025] [:error] [pid 34744:tid 34808] [client 85.203.23.73:51899] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/elish.php"] [unique_id "aSY_mEtgOvVbhyALkTSgggAAAYU"]
[Wed Nov 26 07:45:28.289489 2025] [:error] [pid 35540:tid 35568] [client 85.203.23.71:57873] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/enum.php"] [unique_id "aSY_mMGrIq2A6SZSnkL1eQAAAJY"]
[Wed Nov 26 07:45:28.477390 2025] [:error] [pid 35540:tid 35547] [client 85.203.23.91:30207] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aSY_mMGrIq2A6SZSnkL1egAAAIE"]
[Wed Nov 26 07:45:28.670266 2025] [:error] [pid 34742:tid 34771] [client 85.203.23.72:23591] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/autoload_classmap.php"] [unique_id "aSY_mJSuLNwpQF_jzAf0-wAAAFc"]
[Wed Nov 26 07:45:28.876691 2025] [:error] [pid 34830:tid 34843] [client 85.203.23.74:33935] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/query/"] [unique_id "aSY_mEukvkWgWN6jCR1WwwAAAAs"]
[Wed Nov 26 07:45:29.065690 2025] [:error] [pid 34830:tid 34856] [client 85.203.23.59:31847] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/wp-admin.php"] [unique_id "aSY_mUukvkWgWN6jCR1WxQAAABg"]
[Wed Nov 26 07:45:29.311784 2025] [:error] [pid 34743:tid 34799] [client 85.203.23.83:27131] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/popularfx/template-parts/"] [unique_id "aSY_mQvyX7Q5oU7_mBxNdwAAAVc"]
[Wed Nov 26 07:45:29.517104 2025] [:error] [pid 34742:tid 34758] [client 85.203.23.66:37237] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/about-cong.php"] [unique_id "aSY_mZSuLNwpQF_jzAf0_QAAAEo"]
[Wed Nov 26 07:45:29.924895 2025] [:error] [pid 35540:tid 35561] [client 85.203.23.101:48309] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/development/"] [unique_id "aSY_mcGrIq2A6SZSnkL1fAAAAI8"]
[Wed Nov 26 07:45:30.154868 2025] [:error] [pid 34742:tid 34765] [client 85.203.23.57:64937] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/Iitespeed-cache/157.php"] [unique_id "aSY_mpSuLNwpQF_jzAf1AAAAAFE"]
[Wed Nov 26 07:45:30.587679 2025] [:error] [pid 34744:tid 34803] [client 85.203.23.94:34749] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp.php"] [unique_id "aSY_mktgOvVbhyALkTSghwAAAYA"]
[Wed Nov 26 07:45:40.792664 2025] [:error] [pid 35540:tid 35553] [client 85.203.23.76:57237] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aSY_pMGrIq2A6SZSnkL1kQAAAIc"]
[Wed Nov 26 07:45:42.234869 2025] [:error] [pid 34742:tid 34757] [client 85.203.23.95:47181] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSY_ppSuLNwpQF_jzAf1BwAAAEk"]
[Wed Nov 26 07:45:47.670315 2025] [:error] [pid 35540:tid 35548] [client 85.203.23.67:65103] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSY_q8GrIq2A6SZSnkL1ogAAAII"]
[Wed Nov 26 07:45:58.350766 2025] [:error] [pid 35540:tid 35569] [client 85.203.23.63:22423] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "aSY_tsGrIq2A6SZSnkL1rwAAAJc"]
[Wed Nov 26 07:45:58.540723 2025] [:error] [pid 35540:tid 35568] [client 85.203.23.74:56467] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/images/autoload_classmap.php"] [unique_id "aSY_tsGrIq2A6SZSnkL1sAAAAJY"]
[Wed Nov 26 07:45:58.737969 2025] [:error] [pid 35540:tid 35562] [client 85.203.23.83:45033] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/sama.php"] [unique_id "aSY_tsGrIq2A6SZSnkL1sQAAAJA"]
[Wed Nov 26 07:46:04.281709 2025] [:error] [pid 34744:tid 34818] [client 85.203.23.99:42543] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/"] [unique_id "aSY_vEtgOvVbhyALkTSg5AAAAY8"]
[Wed Nov 26 07:46:11.109668 2025] [:error] [pid 34742:tid 34749] [client 85.203.23.75:40751] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/"] [unique_id "aSY_w5SuLNwpQF_jzAf1JQAAAEE"]
[Wed Nov 26 07:46:12.090565 2025] [:error] [pid 34830:tid 34855] [client 85.203.23.105:54825] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/"] [unique_id "aSY_xEukvkWgWN6jCR1W9gAAABc"]
[Wed Nov 26 07:46:12.419810 2025] [:error] [pid 35540:tid 35555] [client 85.203.23.65:37861] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/plex1.php"] [unique_id "aSY_xMGrIq2A6SZSnkL1xgAAAIk"]
[Wed Nov 26 07:46:12.804096 2025] [:error] [pid 35540:tid 35549] [client 85.203.23.66:34543] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/mlex.php"] [unique_id "aSY_xMGrIq2A6SZSnkL1xwAAAIM"]
[Wed Nov 26 07:46:13.007262 2025] [:error] [pid 34742:tid 34767] [client 85.203.23.71:35697] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSY_xZSuLNwpQF_jzAf1KQAAAFM"]
[Wed Nov 26 07:46:14.351057 2025] [:error] [pid 34744:tid 34806] [client 85.203.23.86:45675] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSY_xktgOvVbhyALkTShFAAAAYM"]
[Wed Nov 26 07:46:14.556283 2025] [:error] [pid 35540:tid 35550] [client 85.203.23.96:49287] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/Noname6.php"] [unique_id "aSY_xsGrIq2A6SZSnkL12gAAAIQ"]
[Wed Nov 26 07:46:14.817141 2025] [:error] [pid 34744:tid 34824] [client 85.203.23.68:25451] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/configYFW/about.php"] [unique_id "aSY_xktgOvVbhyALkTShFgAAAZU"]
[Wed Nov 26 07:46:15.261778 2025] [:error] [pid 34743:tid 34786] [client 85.203.23.80:50277] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/about.php"] [unique_id "aSY_xwvyX7Q5oU7_mBxN6gAAAUo"]
[Wed Nov 26 07:46:15.479374 2025] [:error] [pid 34743:tid 34794] [client 85.203.23.60:33555] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Transport/about.php"] [unique_id "aSY_xwvyX7Q5oU7_mBxN7QAAAVI"]
[Wed Nov 26 07:46:16.225504 2025] [:error] [pid 35540:tid 35563] [client 85.203.23.95:47527] [client 85.203.23.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/about.php"] [unique_id "aSY_yMGrIq2A6SZSnkL16AAAAJE"]
[Wed Nov 26 07:46:16.576498 2025] [:error] [pid 34744:tid 34805] [client 85.203.23.59:22681] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/page-list-item/about.php"] [unique_id "aSY_yEtgOvVbhyALkTShGQAAAYI"]
[Wed Nov 26 07:46:16.881071 2025] [:error] [pid 34743:tid 34790] [client 85.203.23.76:50455] [client 85.203.23.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-navigation-link/admin.php"] [unique_id "aSY_yAvyX7Q5oU7_mBxN8QAAAU4"]
[Wed Nov 26 07:46:17.291489 2025] [:error] [pid 34743:tid 34778] [client 85.203.23.104:52657] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-site/about.php"] [unique_id "aSY_yQvyX7Q5oU7_mBxN8wAAAUI"]
[Wed Nov 26 07:46:17.502811 2025] [:error] [pid 34830:tid 34855] [client 85.203.23.74:33715] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wordpress-seo/src/user-profiles-additions/about.php"] [unique_id "aSY_yUukvkWgWN6jCR1XBwAAABc"]
[Wed Nov 26 07:46:17.731272 2025] [:error] [pid 35540:tid 35570] [client 85.203.23.80:49541] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/script-modules/about.php"] [unique_id "aSY_ycGrIq2A6SZSnkL16wAAAJg"]
[Wed Nov 26 07:46:17.983759 2025] [:error] [pid 35540:tid 35550] [client 85.203.23.67:34989] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSY_ycGrIq2A6SZSnkL17QAAAIQ"]
[Wed Nov 26 07:46:19.844150 2025] [:error] [pid 35540:tid 35551] [client 85.203.23.68:49191] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/tag-cloud/about.php"] [unique_id "aSY_y8GrIq2A6SZSnkL1-AAAAIU"]
[Wed Nov 26 07:46:20.032450 2025] [:error] [pid 34744:tid 34819] [client 85.203.23.86:48083] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/acxx.php"] [unique_id "aSY_zEtgOvVbhyALkTShIQAAAZA"]
[Wed Nov 26 07:46:20.275675 2025] [:error] [pid 34742:tid 34755] [client 85.203.23.107:43399] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/newuser.php"] [unique_id "aSY_zJSuLNwpQF_jzAf1OQAAAEc"]
[Wed Nov 26 07:46:20.477493 2025] [:error] [pid 34744:tid 34807] [client 85.203.23.104:32379] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Exception/"] [unique_id "aSY_zEtgOvVbhyALkTShIwAAAYQ"]
[Wed Nov 26 07:46:25.750389 2025] [:error] [pid 35540:tid 35547] [client 85.203.23.100:35865] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/ty.php"] [unique_id "aSY_0cGrIq2A6SZSnkL2CAAAAIE"]
[Wed Nov 26 07:46:26.486463 2025] [:error] [pid 35540:tid 35568] [client 85.203.23.91:46353] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/file/"] [unique_id "aSY_0sGrIq2A6SZSnkL2CgAAAJY"]
[Wed Nov 26 07:46:26.696658 2025] [:error] [pid 34742:tid 34761] [client 85.203.23.58:61259] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-date/"] [unique_id "aSY_0pSuLNwpQF_jzAf1PQAAAE0"]
[Wed Nov 26 07:46:26.958955 2025] [:error] [pid 35540:tid 35558] [client 85.203.23.59:44823] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aSY_0sGrIq2A6SZSnkL2DQAAAIw"]
[Wed Nov 26 07:46:27.415952 2025] [:error] [pid 35540:tid 35567] [client 85.203.23.78:65283] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/form/"] [unique_id "aSY_08GrIq2A6SZSnkL2DgAAAJU"]
[Wed Nov 26 07:46:27.912453 2025] [:error] [pid 34744:tid 34815] [client 85.203.23.104:44903] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/chosen.php"] [unique_id "aSY_00tgOvVbhyALkTShSAAAAYw"]
[Wed Nov 26 07:46:28.300637 2025] [:error] [pid 34743:tid 34794] [client 85.203.23.91:58427] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSY_1AvyX7Q5oU7_mBxOCQAAAVI"]
[Wed Nov 26 07:46:28.489821 2025] [:error] [pid 34744:tid 34808] [client 85.203.23.90:52869] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSY_1EtgOvVbhyALkTShSgAAAYU"]
[Wed Nov 26 07:46:28.714402 2025] [:error] [pid 34744:tid 34810] [client 85.203.23.75:34395] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfive/styles/blocks/"] [unique_id "aSY_1EtgOvVbhyALkTShSwAAAYc"]
[Wed Nov 26 07:46:28.903424 2025] [:error] [pid 34744:tid 34811] [client 85.203.23.67:61357] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentythree/assets/fonts/ibm-plex-mono/"] [unique_id "aSY_1EtgOvVbhyALkTShTAAAAYg"]
[Wed Nov 26 07:46:29.717254 2025] [:error] [pid 34744:tid 34814] [client 85.203.23.73:49403] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Auth/admin.php"] [unique_id "aSY_1UtgOvVbhyALkTShUQAAAYs"]
[Wed Nov 26 07:46:29.995724 2025] [:error] [pid 34743:tid 34789] [client 85.203.23.61:39133] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/filester/assets/css/cc.php"] [unique_id "aSY_1QvyX7Q5oU7_mBxODQAAAU0"]
[Wed Nov 26 07:46:35.512170 2025] [:error] [pid 34742:tid 34766] [client 85.203.23.65:49157] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/modern/includes/setup/config-setup.php"] [unique_id "aSY_25SuLNwpQF_jzAf1RQAAAFI"]
[Wed Nov 26 07:46:38.621924 2025] [:error] [pid 35540:tid 35569] [client 85.203.23.92:31887] [client 85.203.23.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Utility/admin.php"] [unique_id "aSY_3sGrIq2A6SZSnkL2HgAAAJc"]
[Wed Nov 26 07:46:38.937414 2025] [:error] [pid 34830:tid 34843] [client 85.203.23.86:34567] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/22x.php"] [unique_id "aSY_3kukvkWgWN6jCR1XZAAAAAs"]
[Wed Nov 26 07:46:45.228529 2025] [:error] [pid 34744:tid 34811] [client 85.203.23.85:53349] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/files/admin.php"] [unique_id "aSY_5UtgOvVbhyALkTShcQAAAYg"]
[Wed Nov 26 07:46:45.534719 2025] [:error] [pid 34744:tid 34815] [client 85.203.23.55:52961] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "aSY_5UtgOvVbhyALkTShdAAAAYw"]
[Wed Nov 26 07:46:45.742326 2025] [:error] [pid 34743:tid 34796] [client 85.203.23.54:34613] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/plupload/"] [unique_id "aSY_5QvyX7Q5oU7_mBxOLwAAAVQ"]
[Wed Nov 26 07:46:45.996743 2025] [:error] [pid 35540:tid 35565] [client 85.203.23.71:56443] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/1.php"] [unique_id "aSY_5cGrIq2A6SZSnkL2KgAAAJM"]
[Wed Nov 26 07:46:46.379421 2025] [:error] [pid 34743:tid 34783] [client 85.203.23.107:23823] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/cei-Biz/1.php"] [unique_id "aSY_5gvyX7Q5oU7_mBxOMQAAAUc"]
[Wed Nov 26 07:46:46.884473 2025] [:error] [pid 35540:tid 35564] [client 85.203.23.75:63443] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/plugins/"] [unique_id "aSY_5sGrIq2A6SZSnkL2LQAAAJI"]
[Wed Nov 26 07:46:47.089222 2025] [:error] [pid 34744:tid 34808] [client 85.203.23.93:20135] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/Mencintai.php"] [unique_id "aSY_50tgOvVbhyALkTShdgAAAYU"]
[Wed Nov 26 07:46:52.412879 2025] [:error] [pid 34742:tid 34759] [client 85.203.23.58:47465] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bbn.php"] [unique_id "aSY_7JSuLNwpQF_jzAf1UAAAAEs"]
[Wed Nov 26 07:46:53.083294 2025] [:error] [pid 34830:tid 34833] [client 85.203.23.92:33925] [client 85.203.23.92] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwenty/1.php"] [unique_id "aSY_7UukvkWgWN6jCR1XhwAAAAE"]
[Wed Nov 26 07:46:53.449023 2025] [:error] [pid 34743:tid 34783] [client 85.203.23.80:43845] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/easy-bootstrap-shortcode-pro/1.php"] [unique_id "aSY_7QvyX7Q5oU7_mBxONQAAAUc"]
[Wed Nov 26 07:46:54.038084 2025] [:error] [pid 35540:tid 35567] [client 85.203.23.102:39525] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/really-simple-captcha/tmp/1.php"] [unique_id "aSY_7sGrIq2A6SZSnkL2MAAAAJU"]
[Wed Nov 26 07:46:54.325247 2025] [:error] [pid 34742:tid 34752] [client 85.203.23.92:48429] [client 85.203.23.92] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/w3-total-cache/inc/1.php"] [unique_id "aSY_7pSuLNwpQF_jzAf1UgAAAEQ"]
[Wed Nov 26 07:46:54.688844 2025] [:error] [pid 34742:tid 34764] [client 85.203.23.68:46035] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/htdocs/shell.php"] [unique_id "aSY_7pSuLNwpQF_jzAf1UwAAAFA"]
[Wed Nov 26 07:46:55.136485 2025] [:error] [pid 34743:tid 34782] [client 85.203.23.59:49791] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/public/admin.php"] [unique_id "aSY_7wvyX7Q5oU7_mBxOOgAAAUY"]
[Wed Nov 26 07:46:55.401715 2025] [:error] [pid 34830:tid 34832] [client 85.203.23.75:51135] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/web/shell.php"] [unique_id "aSY_70ukvkWgWN6jCR1XjgAAAAA"]
[Wed Nov 26 07:46:55.667494 2025] [:error] [pid 35540:tid 35548] [client 85.203.23.102:37143] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugin.php"] [unique_id "aSY_78GrIq2A6SZSnkL2MgAAAII"]
[Wed Nov 26 07:47:01.753535 2025] [:error] [pid 34743:tid 34776] [client 85.203.23.86:38347] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/public_html/admin.php"] [unique_id "aSY_9QvyX7Q5oU7_mBxOSgAAAUA"]
[Wed Nov 26 07:47:02.240093 2025] [:error] [pid 34744:tid 34808] [client 85.203.23.57:55795] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/semplice4/assets/js/admin.php"] [unique_id "aSY_9ktgOvVbhyALkTShiQAAAYU"]
[Wed Nov 26 07:47:02.482340 2025] [:error] [pid 35540:tid 35558] [client 85.203.23.67:32381] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/Divi/et-pagebuilder/about.php"] [unique_id "aSY_9sGrIq2A6SZSnkL2OQAAAIw"]
[Wed Nov 26 07:47:02.678883 2025] [:error] [pid 34830:tid 34841] [client 85.203.23.100:25819] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-file-manager/lib/sounds/admin.php"] [unique_id "aSY_9kukvkWgWN6jCR1XmQAAAAk"]
[Wed Nov 26 07:47:08.101707 2025] [:error] [pid 35540:tid 35562] [client 85.203.23.99:39809] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/img/portfolio/about.php"] [unique_id "aSY__MGrIq2A6SZSnkL2PgAAAJA"]
[Wed Nov 26 07:47:08.467855 2025] [:error] [pid 34830:tid 34836] [client 85.203.23.80:34525] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/img/single/about.php"] [unique_id "aSY__EukvkWgWN6jCR1XqwAAAAQ"]
[Wed Nov 26 07:47:08.937153 2025] [:error] [pid 34744:tid 34817] [client 85.203.23.73:52599] [client 85.203.23.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/img/full/admin.php"] [unique_id "aSY__EtgOvVbhyALkTShlwAAAY4"]
[Wed Nov 26 07:47:09.172716 2025] [:error] [pid 34743:tid 34795] [client 85.203.23.61:58747] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-file-manager/classes/admin.php"] [unique_id "aSY__QvyX7Q5oU7_mBxOUwAAAVM"]
[Wed Nov 26 07:47:09.362631 2025] [:error] [pid 34744:tid 34809] [client 85.203.23.83:29947] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-install.php"] [unique_id "aSY__UtgOvVbhyALkTShmAAAAYY"]
[Wed Nov 26 07:47:09.885145 2025] [:error] [pid 34744:tid 34821] [client 85.203.23.93:63283] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/405.php"] [unique_id "aSY__UtgOvVbhyALkTShmwAAAZI"]
[Wed Nov 26 07:47:10.090872 2025] [:error] [pid 35540:tid 35550] [client 85.203.23.75:49077] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/sql.php"] [unique_id "aSY__sGrIq2A6SZSnkL2PwAAAIQ"]
[Wed Nov 26 07:47:10.281593 2025] [:error] [pid 34830:tid 34835] [client 85.203.23.94:34323] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/service.php"] [unique_id "aSY__kukvkWgWN6jCR1XsQAAAAM"]
[Wed Nov 26 07:47:10.531441 2025] [:error] [pid 34744:tid 34815] [client 85.203.23.66:54383] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/nux.php"] [unique_id "aSY__ktgOvVbhyALkTShnQAAAYw"]
[Wed Nov 26 07:47:20.881425 2025] [:error] [pid 35540:tid 35548] [client 85.203.23.88:46131] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/sss.php"] [unique_id "aSZACMGrIq2A6SZSnkL2TQAAAII"]
[Wed Nov 26 07:47:22.002810 2025] [:error] [pid 34744:tid 34825] [client 85.203.23.78:64481] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugin/advanced-custom-fields/acf.php"] [unique_id "aSZACktgOvVbhyALkTShrAAAAZY"]
[Wed Nov 26 07:47:22.826112 2025] [:error] [pid 34742:tid 34754] [client 85.203.23.71:57311] [client 85.203.23.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/buy.php"] [unique_id "aSZACpSuLNwpQF_jzAf1ZwAAAEY"]
[Wed Nov 26 07:47:24.673856 2025] [:error] [pid 34743:tid 34786] [client 85.203.23.96:36517] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/edit.php"] [unique_id "aSZADAvyX7Q5oU7_mBxOYgAAAUo"]
[Wed Nov 26 07:47:24.931626 2025] [:error] [pid 34830:tid 34853] [client 85.203.23.88:23215] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugin/pngoptimazie.php"] [unique_id "aSZADEukvkWgWN6jCR1X0gAAABU"]
[Wed Nov 26 07:47:25.217342 2025] [:error] [pid 34743:tid 34780] [client 85.203.23.65:39781] [client 85.203.23.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/database.php"] [unique_id "aSZADQvyX7Q5oU7_mBxOYwAAAUQ"]
[Wed Nov 26 07:47:25.459012 2025] [:error] [pid 34744:tid 34809] [client 85.203.23.101:58517] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/obfuscate.php"] [unique_id "aSZADUtgOvVbhyALkTShrgAAAYY"]
[Wed Nov 26 07:47:30.652751 2025] [:error] [pid 34743:tid 34780] [client 85.203.23.74:42889] [client 85.203.23.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/chosen.php"] [unique_id "aSZAEgvyX7Q5oU7_mBxOdgAAAUQ"]
[Wed Nov 26 07:47:30.879464 2025] [:error] [pid 34744:tid 34807] [client 85.203.23.106:60967] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/maxwin88/inc/metabox/extend-metabox/lock.php"] [unique_id "aSZAEktgOvVbhyALkTShuQAAAYQ"]
[Wed Nov 26 07:47:36.149879 2025] [:error] [pid 35540:tid 35550] [client 85.203.23.63:49689] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/wp-conflg.php"] [unique_id "aSZAGMGrIq2A6SZSnkL2YQAAAIQ"]
[Wed Nov 26 07:47:36.374064 2025] [:error] [pid 34743:tid 34791] [client 85.203.23.66:46359] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/mediaelement/renderers/about.php"] [unique_id "aSZAGAvyX7Q5oU7_mBxOfwAAAU8"]
[Wed Nov 26 07:47:36.588328 2025] [:error] [pid 34830:tid 34852] [client 85.203.23.77:56973] [client 85.203.23.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aSZAGEukvkWgWN6jCR1X9QAAABQ"]
[Wed Nov 26 07:47:36.824438 2025] [:error] [pid 35540:tid 35554] [client 85.203.23.75:39301] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/src/Decode/ahax.php"] [unique_id "aSZAGMGrIq2A6SZSnkL2ZQAAAIg"]
[Wed Nov 26 07:47:37.033999 2025] [:error] [pid 34830:tid 34837] [client 85.203.23.67:48095] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/connects.php"] [unique_id "aSZAGUukvkWgWN6jCR1X9wAAAAU"]
[Wed Nov 26 07:47:38.837881 2025] [:error] [pid 34744:tid 34824] [client 85.203.23.57:62579] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/alfa.php"] [unique_id "aSZAGktgOvVbhyALkTShxAAAAZU"]
[Wed Nov 26 07:47:50.049973 2025] [:error] [pid 34744:tid 34807] [client 85.203.23.59:56027] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/images/images/images/images/images/images/images/images/images/images/images/images/Contacts.php"] [unique_id "aSZAJktgOvVbhyALkTSh1wAAAYQ"]
[Wed Nov 26 07:47:50.271877 2025] [:error] [pid 34744:tid 34815] [client 85.203.23.61:57675] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/tag-cloud.php"] [unique_id "aSZAJktgOvVbhyALkTSh2AAAAYw"]
[Wed Nov 26 07:47:55.696133 2025] [:error] [pid 34743:tid 34783] [client 85.203.23.101:60043] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/class-json.php"] [unique_id "aSZAKwvyX7Q5oU7_mBxOkgAAAUc"]
[Wed Nov 26 07:48:01.471522 2025] [:error] [pid 34744:tid 34804] [client 85.203.23.88:46581] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/images/images/images/images/images/images/images/images/images/images/images/images/Contacts.php"] [unique_id "aSZAMUtgOvVbhyALkTSh_AAAAYE"]
[Wed Nov 26 07:48:01.834734 2025] [:error] [pid 34744:tid 34817] [client 85.203.23.96:23827] [client 85.203.23.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/lib-view/code-snippet/lock.php"] [unique_id "aSZAMUtgOvVbhyALkTSh_gAAAY4"]
[Wed Nov 26 07:48:03.399793 2025] [:error] [pid 34743:tid 34780] [client 85.203.23.88:36247] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/navigation/lock.php"] [unique_id "aSZAMwvyX7Q5oU7_mBxOnAAAAUQ"]
[Wed Nov 26 07:48:03.845050 2025] [:error] [pid 34743:tid 34786] [client 85.203.23.106:29869] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/quadmenu/assets/frontend/icons/fontawesome/css/lock.php"] [unique_id "aSZAMwvyX7Q5oU7_mBxOngAAAUo"]
[Wed Nov 26 07:48:09.258627 2025] [:error] [pid 34742:tid 34765] [client 85.203.23.84:51433] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/ngg/modules/photocrati-nextgen_basic_imagebrowser/static/lock.php"] [unique_id "aSZAOZSuLNwpQF_jzAf1oQAAAFE"]
[Wed Nov 26 07:48:09.527195 2025] [:error] [pid 35540:tid 35561] [client 85.203.23.85:58505] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-image-editor-gd-pic.php"] [unique_id "aSZAOcGrIq2A6SZSnkL2vwAAAI8"]
[Wed Nov 26 07:48:09.812122 2025] [:error] [pid 34830:tid 34848] [client 85.203.23.107:55905] [client 85.203.23.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/connects.php"] [unique_id "aSZAOUukvkWgWN6jCR1YKQAAABA"]
[Wed Nov 26 07:48:11.556305 2025] [:error] [pid 34744:tid 34816] [client 85.203.23.88:62693] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/options-privacy-part.php"] [unique_id "aSZAO0tgOvVbhyALkTSiHgAAAY0"]
[Wed Nov 26 07:48:11.935033 2025] [:error] [pid 34830:tid 34839] [client 85.203.23.72:28501] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/link-template-variable.php"] [unique_id "aSZAO0ukvkWgWN6jCR1YLgAAAAc"]
[Wed Nov 26 07:48:12.587037 2025] [:error] [pid 34744:tid 34811] [client 85.203.23.83:53357] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyone/assets/sass/05-blocks/latest-comments/poisontalk.php"] [unique_id "aSZAPEtgOvVbhyALkTSiHwAAAYg"]
[Wed Nov 26 07:48:13.351101 2025] [:error] [pid 35540:tid 35565] [client 85.203.23.80:32847] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wpfilemangersobject/"] [unique_id "aSZAPcGrIq2A6SZSnkL2ygAAAJM"]
[Wed Nov 26 07:48:13.584804 2025] [:error] [pid 34830:tid 34855] [client 85.203.23.63:47977] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/media-text-double.php"] [unique_id "aSZAPUukvkWgWN6jCR1YMQAAABc"]
[Wed Nov 26 07:48:14.211899 2025] [:error] [pid 34830:tid 34844] [client 85.203.23.100:53409] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/class-walker-category-checklist-hashing.php"] [unique_id "aSZAPkukvkWgWN6jCR1YNAAAAAw"]
[Wed Nov 26 07:48:14.817744 2025] [:error] [pid 34743:tid 34781] [client 85.203.23.78:62571] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/link-manager-first.php"] [unique_id "aSZAPgvyX7Q5oU7_mBxOqgAAAUU"]
[Wed Nov 26 07:48:15.179131 2025] [:error] [pid 34743:tid 34776] [client 85.203.23.78:39701] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aSZAPwvyX7Q5oU7_mBxOqwAAAUA"]
[Wed Nov 26 07:48:15.421894 2025] [:error] [pid 34743:tid 34792] [client 85.203.23.61:51143] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aSZAPwvyX7Q5oU7_mBxOrAAAAVA"]
[Wed Nov 26 07:48:15.868441 2025] [:error] [pid 34742:tid 34749] [client 85.203.23.61:34833] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xax.php"] [unique_id "aSZAP5SuLNwpQF_jzAf1qQAAAEE"]
[Wed Nov 26 07:48:16.092686 2025] [:error] [pid 34742:tid 34768] [client 85.203.23.80:36629] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/nodeinfo/theme.php"] [unique_id "aSZAQJSuLNwpQF_jzAf1rAAAAFQ"]
[Wed Nov 26 07:48:16.480042 2025] [:error] [pid 35540:tid 35551] [client 85.203.23.90:49005] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/mainhosting/past.php"] [unique_id "aSZAQMGrIq2A6SZSnkL20wAAAIU"]
[Wed Nov 26 07:48:16.748204 2025] [:error] [pid 34742:tid 34754] [client 85.203.23.93:61911] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/load.php"] [unique_id "aSZAQJSuLNwpQF_jzAf1rgAAAEY"]
[Wed Nov 26 07:48:18.719370 2025] [:error] [pid 35540:tid 35559] [client 85.203.23.72:31857] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aSZAQsGrIq2A6SZSnkL23QAAAI0"]
[Wed Nov 26 07:48:19.337700 2025] [:error] [pid 34743:tid 34784] [client 85.203.23.63:21577] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/library/SimplePie/Net/"] [unique_id "aSZAQwvyX7Q5oU7_mBxOsQAAAUg"]
[Wed Nov 26 13:39:00.687711 2025] [:error] [pid 34743:tid 34790] [client 145.239.10.137:39632] File does not exist: /usr/local/apache/htdocs/suspended-page/up2.php, referer: http://aoswa.com.au/up2.php
[Wed Nov 26 13:46:38.431852 2025] [:error] [pid 34743:tid 34797] [client 139.59.30.253:64494] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/"] [unique_id "aSaUPgvyX7Q5oU7_mBycBQAAAVU"], referer: binance.com
[Wed Nov 26 13:46:44.006166 2025] [:error] [pid 34742:tid 34755] [client 139.59.30.253:64003] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/images/"] [unique_id "aSaURJSuLNwpQF_jzAdCjAAAAEc"], referer: binance.com
[Wed Nov 26 13:46:48.400240 2025] [:error] [pid 10383:tid 10401] [client 139.59.30.253:62940] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files/"] [unique_id "aSaUSK0RJ-zjhOVjD8_R8QAAAc8"], referer: binance.com
[Wed Nov 26 14:44:51.815139 2025] [:error] [pid 34830:tid 34838] [client 216.126.239.203:58004] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSah40ukvkWgWN6jCR2zewAAAAY"]
[Thu Nov 27 00:44:33.351251 2025] [:error] [pid 8184:tid 8242] [client 103.77.107.57:64231] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aScucb-M2IHkRYVrcbN35AAAAEY"]
[Thu Nov 27 05:01:24.790762 2025] [:error] [pid 6201:tid 6225] [client 213.21.239.4:44432] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/developer/.git/config"] [unique_id "aSdqpDkSJeRkIQGTjzwkSQAAABQ"]
[Thu Nov 27 05:01:24.791039 2025] [:error] [pid 6202:tid 6254] [client 213.21.239.4:44436] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/database/.git/config"] [unique_id "aSdqpNJa7NTP0XPyZ6lo5wAAAFU"]
[Thu Nov 27 05:01:24.793344 2025] [:error] [pid 6203:tid 6273] [client 213.21.239.4:44622] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.git/config"] [unique_id "aSdqpMbdRL7aKyrgqyzI2gAAAI0"]
[Thu Nov 27 05:01:24.794234 2025] [:error] [pid 6290:tid 6306] [client 213.21.239.4:44646] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.git/config;"] [unique_id "aSdqpIqL4zye-zKr6suZhQAAAMw"]
[Thu Nov 27 05:01:24.802457 2025] [:error] [pid 6203:tid 6262] [client 213.21.239.4:44434] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/assets../.git/config"] [unique_id "aSdqpMbdRL7aKyrgqyzI3AAAAII"]
[Thu Nov 27 05:01:24.802933 2025] [:error] [pid 21017:tid 21080] [client 213.21.239.4:44468] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.git/config"] [unique_id "aSdqpKZA663ub03MMQuHQQAAARU"]
[Thu Nov 27 05:01:24.805138 2025] [:error] [pid 6203:tid 6263] [client 213.21.239.4:44610] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/;/.git/config"] [unique_id "aSdqpMbdRL7aKyrgqyzI3QAAAIM"]
[Thu Nov 27 05:01:24.807238 2025] [:error] [pid 6201:tid 6210] [client 213.21.239.4:44534] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.git/config"] [unique_id "aSdqpDkSJeRkIQGTjzwkSgAAAAU"]
[Thu Nov 27 05:01:24.807493 2025] [:error] [pid 21017:tid 21073] [client 213.21.239.4:44532] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/application/.git/config"] [unique_id "aSdqpKZA663ub03MMQuHQgAAAQ4"]
[Thu Nov 27 05:01:24.811053 2025] [:error] [pid 6290:tid 6302] [client 213.21.239.4:44588] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/common/.git/config"] [unique_id "aSdqpIqL4zye-zKr6suZhgAAAMg"]
[Thu Nov 27 05:01:24.813535 2025] [:error] [pid 6202:tid 6238] [client 213.21.239.4:44452] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/css../.git/config"] [unique_id "aSdqpNJa7NTP0XPyZ6lo6AAAAEU"]
[Thu Nov 27 05:01:24.814084 2025] [:error] [pid 6203:tid 6264] [client 213.21.239.4:44562] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/backup/.git/config"] [unique_id "aSdqpMbdRL7aKyrgqyzI3gAAAIQ"]
[Thu Nov 27 05:01:24.817225 2025] [:error] [pid 6290:tid 6317] [client 213.21.239.4:44516] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.git/config"] [unique_id "aSdqpIqL4zye-zKr6suZhwAAANc"]
[Thu Nov 27 05:01:24.817891 2025] [:error] [pid 6203:tid 6283] [client 213.21.239.4:44624] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/static../.git/config"] [unique_id "aSdqpMbdRL7aKyrgqyzI3wAAAJc"]
[Thu Nov 27 05:01:24.818291 2025] [:error] [pid 6201:tid 6224] [client 213.21.239.4:44602] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.git/config;.."] [unique_id "aSdqpDkSJeRkIQGTjzwkTAAAABM"]
[Thu Nov 27 05:01:24.820223 2025] [:error] [pid 6201:tid 6223] [client 213.21.239.4:44420] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/..;/.git/config"] [unique_id "aSdqpDkSJeRkIQGTjzwkTQAAABI"]
[Thu Nov 27 05:01:24.824781 2025] [:error] [pid 6290:tid 6307] [client 213.21.239.4:44518] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.git/%0Aconfig"] [unique_id "aSdqpIqL4zye-zKr6suZiAAAAM0"]
[Thu Nov 27 05:01:24.826390 2025] [:error] [pid 6290:tid 6295] [client 213.21.239.4:44560] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/dev/.git/config"] [unique_id "aSdqpIqL4zye-zKr6suZiQAAAME"]
[Thu Nov 27 05:01:24.827345 2025] [:error] [pid 6201:tid 6227] [client 213.21.239.4:44484] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/content../.git/config"] [unique_id "aSdqpDkSJeRkIQGTjzwkTgAAABY"]
[Thu Nov 27 05:01:24.830174 2025] [:error] [pid 6201:tid 6220] [client 213.21.239.4:44486] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa../.git/config"] [unique_id "aSdqpDkSJeRkIQGTjzwkTwAAAA8"]
[Thu Nov 27 05:01:27.156461 2025] [:error] [pid 21017:tid 21070] [client 213.21.239.4:44694] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/;/.git/config"] [unique_id "aSdqp6ZA663ub03MMQuHUAAAAQs"]
[Thu Nov 27 05:01:27.157509 2025] [:error] [pid 21017:tid 21077] [client 213.21.239.4:44730] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/lib../.git/config"] [unique_id "aSdqp6ZA663ub03MMQuHUQAAARI"]
[Thu Nov 27 05:01:27.158956 2025] [:error] [pid 21017:tid 21062] [client 213.21.239.4:44752] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aSdqp6ZA663ub03MMQuHUgAAAQM"]
[Thu Nov 27 05:01:27.162415 2025] [:error] [pid 21017:tid 21059] [client 213.21.239.4:44794] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.git/config;"] [unique_id "aSdqp6ZA663ub03MMQuHUwAAAQA"]
[Thu Nov 27 05:01:27.163846 2025] [:error] [pid 6203:tid 6273] [client 213.21.239.4:44826] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/;/.git/config"] [unique_id "aSdqp8bdRL7aKyrgqyzI5wAAAI0"]
[Thu Nov 27 05:01:27.164136 2025] [:error] [pid 6203:tid 6279] [client 213.21.239.4:44702] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/git/.git/config"] [unique_id "aSdqp8bdRL7aKyrgqyzI6AAAAJM"]
[Thu Nov 27 05:01:27.168306 2025] [:error] [pid 6203:tid 6260] [client 213.21.239.4:44686] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/img../.git/config"] [unique_id "aSdqp8bdRL7aKyrgqyzI6QAAAIA"]
[Thu Nov 27 05:01:27.168437 2025] [:error] [pid 6203:tid 6281] [client 213.21.239.4:44722] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/js../.git/config"] [unique_id "aSdqp8bdRL7aKyrgqyzI6gAAAJU"]
[Thu Nov 27 05:01:27.168878 2025] [:error] [pid 6203:tid 6269] [client 213.21.239.4:44792] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.git/config"] [unique_id "aSdqp8bdRL7aKyrgqyzI6wAAAIk"]
[Thu Nov 27 05:01:27.172930 2025] [:error] [pid 6202:tid 6234] [client 213.21.239.4:44764] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.git/%0Aconfig"] [unique_id "aSdqp9Ja7NTP0XPyZ6lo8AAAAEE"]
[Thu Nov 27 05:01:27.176454 2025] [:error] [pid 6201:tid 6207] [client 213.21.239.4:44660] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/..;/.git/config"] [unique_id "aSdqpzkSJeRkIQGTjzwkWAAAAAI"]
[Thu Nov 27 05:01:27.181406 2025] [:error] [pid 6290:tid 6303] [client 213.21.239.4:44762] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/m/.git/config"] [unique_id "aSdqp4qL4zye-zKr6suZlgAAAMk"]
[Thu Nov 27 05:01:27.181792 2025] [:error] [pid 6202:tid 6237] [client 213.21.239.4:44772] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au../.git/config"] [unique_id "aSdqp9Ja7NTP0XPyZ6lo8QAAAEQ"]
[Thu Nov 27 05:01:27.182220 2025] [:error] [pid 6202:tid 6242] [client 213.21.239.4:44774] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSdqp9Ja7NTP0XPyZ6lo8gAAAEk"]
[Thu Nov 27 05:01:27.182415 2025] [:error] [pid 6290:tid 6295] [client 213.21.239.4:44674] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config;"] [unique_id "aSdqp4qL4zye-zKr6suZlwAAAME"]
[Thu Nov 27 05:01:27.183431 2025] [:error] [pid 21017:tid 21074] [client 213.21.239.4:44710] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/images../.git/config"] [unique_id "aSdqp6ZA663ub03MMQuHVAAAAQ8"]
[Thu Nov 27 05:01:27.185083 2025] [:error] [pid 6290:tid 6297] [client 213.21.239.4:44806] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.git/config;.."] [unique_id "aSdqp4qL4zye-zKr6suZmAAAAMM"]
[Thu Nov 27 05:01:27.185984 2025] [:error] [pid 21017:tid 21072] [client 213.21.239.4:44846] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config;.."] [unique_id "aSdqp6ZA663ub03MMQuHVQAAAQ0"]
[Thu Nov 27 05:01:27.189367 2025] [:error] [pid 6290:tid 6311] [client 213.21.239.4:44856] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/message-api/.git/config"] [unique_id "aSdqp4qL4zye-zKr6suZmQAAANE"]
[Thu Nov 27 05:01:27.194275 2025] [:error] [pid 21017:tid 21075] [client 213.21.239.4:44838] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/static../.git/config"] [unique_id "aSdqp6ZA663ub03MMQuHVgAAARA"]
[Thu Nov 27 05:01:27.195836 2025] [:error] [pid 6290:tid 6318] [client 213.21.239.4:44742] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/live/.git/config"] [unique_id "aSdqp4qL4zye-zKr6suZmgAAANg"]
[Thu Nov 27 05:01:27.196193 2025] [:error] [pid 6203:tid 6263] [client 213.21.239.4:44782] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/..;/.git/config"] [unique_id "aSdqp8bdRL7aKyrgqyzI7QAAAIM"]
[Thu Nov 27 05:01:30.143004 2025] [:error] [pid 6203:tid 6268] [client 213.21.239.4:44930] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/..;/.git/config"] [unique_id "aSdqqsbdRL7aKyrgqyzI9wAAAIg"]
[Thu Nov 27 05:01:30.144286 2025] [:error] [pid 21017:tid 21069] [client 213.21.239.4:44974] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/..;/.git/config"] [unique_id "aSdqqqZA663ub03MMQuHagAAAQo"]
[Thu Nov 27 05:01:30.145839 2025] [:error] [pid 6201:tid 6213] [client 213.21.239.4:44918] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www../.git/config"] [unique_id "aSdqqjkSJeRkIQGTjzwkZAAAAAg"]
[Thu Nov 27 05:01:30.151100 2025] [:error] [pid 6290:tid 6313] [client 213.21.239.4:44862] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.git/config;.."] [unique_id "aSdqqoqL4zye-zKr6suZrgAAANM"]
[Thu Nov 27 05:01:30.153931 2025] [:error] [pid 21017:tid 21067] [client 213.21.239.4:44960] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/;/.git/config"] [unique_id "aSdqqqZA663ub03MMQuHawAAAQg"]
[Thu Nov 27 05:01:30.158769 2025] [:error] [pid 21017:tid 21064] [client 213.21.239.4:45026] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.git/config"] [unique_id "aSdqqqZA663ub03MMQuHbgAAAQU"]
[Thu Nov 27 05:01:30.160363 2025] [:error] [pid 21017:tid 21078] [client 213.21.239.4:44906] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/qa/.git/config"] [unique_id "aSdqqqZA663ub03MMQuHbwAAARM"]
[Thu Nov 27 05:01:30.162973 2025] [:error] [pid 6290:tid 6312] [client 213.21.239.4:45056] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.git/config;"] [unique_id "aSdqqoqL4zye-zKr6suZsAAAANI"]
[Thu Nov 27 05:01:30.163197 2025] [:error] [pid 21017:tid 21073] [client 213.21.239.4:45000] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/prod/.git/config"] [unique_id "aSdqqqZA663ub03MMQuHcAAAAQ4"]
[Thu Nov 27 05:01:30.165819 2025] [:error] [pid 21017:tid 21080] [client 213.21.239.4:45040] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.git/config"] [unique_id "aSdqqqZA663ub03MMQuHcQAAARU"]
[Thu Nov 27 05:01:30.167497 2025] [:error] [pid 6290:tid 6304] [client 213.21.239.4:45016] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.git/config;.."] [unique_id "aSdqqoqL4zye-zKr6suZsQAAAMo"]
[Thu Nov 27 05:01:30.171602 2025] [:error] [pid 6290:tid 6306] [client 213.21.239.4:45042] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/www/.git;/config"] [unique_id "aSdqqoqL4zye-zKr6suZsgAAAMw"]
[Thu Nov 27 05:01:30.175422 2025] [:error] [pid 6203:tid 6265] [client 213.21.239.4:45044] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au../.git/config"] [unique_id "aSdqqsbdRL7aKyrgqyzI-AAAAIU"]
[Thu Nov 27 05:01:30.175722 2025] [:error] [pid 6290:tid 6317] [client 213.21.239.4:44898] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.git/%0Aconfig"] [unique_id "aSdqqoqL4zye-zKr6suZswAAANc"]
[Thu Nov 27 05:01:30.176619 2025] [:error] [pid 6290:tid 6296] [client 213.21.239.4:44874] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/www/config"] [unique_id "aSdqqoqL4zye-zKr6suZtAAAAMI"]
[Thu Nov 27 05:01:30.176956 2025] [:error] [pid 6201:tid 6228] [client 213.21.239.4:45074] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.git/config"] [unique_id "aSdqqjkSJeRkIQGTjzwkZQAAABc"]
[Thu Nov 27 05:01:30.177053 2025] [:error] [pid 6203:tid 6284] [client 213.21.239.4:44984] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/new/.git/config"] [unique_id "aSdqqsbdRL7aKyrgqyzI-QAAAJg"]
[Thu Nov 27 05:01:30.178958 2025] [:error] [pid 6203:tid 6264] [client 213.21.239.4:45050] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/;/.git/config"] [unique_id "aSdqqsbdRL7aKyrgqyzI-gAAAIQ"]
[Thu Nov 27 05:01:30.180832 2025] [:error] [pid 6201:tid 6216] [client 213.21.239.4:44946] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.git/config;"] [unique_id "aSdqqjkSJeRkIQGTjzwkZgAAAAs"]
[Thu Nov 27 05:01:30.182677 2025] [:error] [pid 6203:tid 6276] [client 213.21.239.4:45080] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/static../.git/config"] [unique_id "aSdqqsbdRL7aKyrgqyzI-wAAAJA"]
[Thu Nov 27 05:01:30.183567 2025] [:error] [pid 6201:tid 6214] [client 213.21.239.4:45086] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.git/%0Aconfig"] [unique_id "aSdqqjkSJeRkIQGTjzwkZwAAAAk"]
[Thu Nov 27 05:01:32.201196 2025] [:error] [pid 21017:tid 21067] [client 213.21.239.4:54470] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/www/.git;/config"] [unique_id "aSdqrKZA663ub03MMQuHewAAAQg"]
[Thu Nov 27 05:01:32.224304 2025] [:error] [pid 6290:tid 6305] [client 213.21.239.4:54474] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/www/config"] [unique_id "aSdqrIqL4zye-zKr6suZuwAAAMs"]
[Thu Nov 27 05:01:33.140248 2025] [:error] [pid 6201:tid 6226] [client 213.21.239.4:54512] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-content/.git/config"] [unique_id "aSdqrTkSJeRkIQGTjzwkbAAAABU"]
[Thu Nov 27 05:01:33.140274 2025] [:error] [pid 6201:tid 6221] [client 213.21.239.4:54492] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/.git/config"] [unique_id "aSdqrTkSJeRkIQGTjzwkawAAABA"]
[Thu Nov 27 05:01:33.147621 2025] [:error] [pid 6201:tid 6205] [client 213.21.239.4:54522] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/uat/.git/config"] [unique_id "aSdqrTkSJeRkIQGTjzwkbQAAAAA"]
[Thu Nov 27 05:01:33.147621 2025] [:error] [pid 6201:tid 6219] [client 213.21.239.4:54520] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/.git/config"] [unique_id "aSdqrTkSJeRkIQGTjzwkbgAAAA4"]
[Thu Nov 27 05:01:33.156763 2025] [:error] [pid 6290:tid 6317] [client 213.21.239.4:54536] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/static../.git/config"] [unique_id "aSdqrYqL4zye-zKr6suZvQAAANc"]
[Thu Nov 27 05:01:33.156837 2025] [:error] [pid 6201:tid 6209] [client 213.21.239.4:54500] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/static../.git/config"] [unique_id "aSdqrTkSJeRkIQGTjzwkbwAAAAQ"]
[Thu Nov 27 05:01:33.158419 2025] [:error] [pid 6201:tid 6206] [client 213.21.239.4:54478] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/staging/.git/config"] [unique_id "aSdqrTkSJeRkIQGTjzwkcAAAAAE"]
[Thu Nov 27 05:01:33.159510 2025] [:error] [pid 6290:tid 6306] [client 213.21.239.4:54534] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/web/.git/config"] [unique_id "aSdqrYqL4zye-zKr6suZvgAAAMw"]
[Thu Nov 27 06:03:12.656955 2025] [:error] [pid 6201:tid 6211] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Nov 27 06:03:12.803499 2025] [:error] [pid 6201:tid 6229] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Nov 27 06:03:12.923842 2025] [:error] [pid 6201:tid 6228] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Nov 27 06:03:13.064472 2025] [:error] [pid 6201:tid 6223] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Nov 27 06:03:13.234834 2025] [:error] [pid 6201:tid 6214] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Nov 27 06:03:13.357505 2025] [:error] [pid 6201:tid 6205] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Nov 27 06:03:13.474926 2025] [:error] [pid 6201:tid 6225] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Nov 27 06:03:13.609644 2025] [:error] [pid 6201:tid 6222] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Nov 27 06:03:13.892205 2025] [:error] [pid 6201:tid 6215] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Nov 27 06:03:14.188566 2025] [:error] [pid 6201:tid 6224] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Nov 27 06:03:14.321903 2025] [:error] [pid 6201:tid 6226] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Nov 27 06:03:14.453813 2025] [:error] [pid 6201:tid 6221] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Nov 27 06:03:14.558815 2025] [:error] [pid 6201:tid 6218] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Nov 27 06:03:14.681968 2025] [:error] [pid 6201:tid 6210] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Nov 27 06:03:14.836223 2025] [:error] [pid 6201:tid 6217] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Nov 27 06:03:14.953172 2025] [:error] [pid 6201:tid 6213] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Nov 27 06:03:15.128088 2025] [:error] [pid 6201:tid 6208] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Nov 27 06:03:15.230327 2025] [:error] [pid 6201:tid 6209] [client 194.5.82.59:46817] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Nov 27 06:03:20.018732 2025] [:error] [pid 6201:tid 6207] [client 194.5.82.59:46817] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSd5KDkSJeRkIQGTjzw1cQAAAAI"]
[Thu Nov 27 06:03:20.722227 2025] [:error] [pid 6203:tid 6264] [client 194.5.82.82:63309] [client 194.5.82.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSd5KMbdRL7aKyrgqyzdYgAAAIQ"]
[Thu Nov 27 06:03:21.494208 2025] [:error] [pid 6203:tid 6282] [client 194.5.82.54:33263] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Nov 27 06:03:21.916674 2025] [:error] [pid 6203:tid 6276] [client 194.5.82.54:33263] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSd5KcbdRL7aKyrgqyzdagAAAJA"]
[Thu Nov 27 06:03:22.501163 2025] [:error] [pid 6202:tid 6250] [client 194.5.82.70:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Nov 27 06:03:22.711928 2025] [:error] [pid 6202:tid 6246] [client 194.5.82.70:53037] [client 194.5.82.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSd5KtJa7NTP0XPyZ6l6rgAAAE0"]
[Thu Nov 27 06:03:23.218446 2025] [:error] [pid 6203:tid 6283] [client 194.5.82.168:63119] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Nov 27 06:03:24.231814 2025] [:error] [pid 6203:tid 6281] [client 194.5.82.168:63119] [client 194.5.82.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSd5LMbdRL7aKyrgqyzdcwAAAJU"]
[Thu Nov 27 06:03:24.781558 2025] [:error] [pid 6203:tid 6272] [client 194.5.82.55:28443] [client 194.5.82.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSd5LMbdRL7aKyrgqyzddQAAAIw"]
[Thu Nov 27 06:03:25.047770 2025] [:error] [pid 21017:tid 21072] [client 194.5.82.99:44661] [client 194.5.82.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSd5LaZA663ub03MMQumyAAAAQ0"]
[Thu Nov 27 06:03:25.389241 2025] [:error] [pid 6290:tid 6295] [client 194.5.82.72:25593] [client 194.5.82.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSd5LYqL4zye-zKr6suwEAAAAME"]
[Thu Nov 27 06:03:25.710897 2025] [:error] [pid 6203:tid 6274] [client 194.5.82.57:49251] [client 194.5.82.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSd5LcbdRL7aKyrgqyzdeAAAAI4"]
[Thu Nov 27 06:03:25.988611 2025] [:error] [pid 6290:tid 6318] [client 194.5.82.87:22551] [client 194.5.82.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSd5LYqL4zye-zKr6suwEwAAANg"]
[Thu Nov 27 06:03:26.518391 2025] [:error] [pid 6290:tid 6314] [client 194.5.82.91:41259] [client 194.5.82.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSd5LoqL4zye-zKr6suwFQAAANQ"]
[Thu Nov 27 06:03:26.789633 2025] [:error] [pid 6201:tid 6215] [client 194.5.82.168:50797] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Nov 27 06:03:27.088383 2025] [:error] [pid 6201:tid 6220] [client 194.5.82.168:50797] [client 194.5.82.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aSd5LzkSJeRkIQGTjzw1eAAAAA8"]
[Thu Nov 27 06:03:27.694405 2025] [:error] [pid 6203:tid 6262] [client 194.5.82.60:30531] [client 194.5.82.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSd5L8bdRL7aKyrgqyzdfQAAAII"]
[Thu Nov 27 06:03:28.136042 2025] [:error] [pid 6202:tid 6249] [client 194.5.82.67:41531] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSd5MNJa7NTP0XPyZ6l6sAAAAFA"]
[Thu Nov 27 06:03:28.404465 2025] [:error] [pid 6290:tid 6313] [client 194.5.82.71:47105] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Nov 27 06:03:28.804033 2025] [:error] [pid 6290:tid 6313] [client 194.5.82.71:47105] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSd5MIqL4zye-zKr6suwFwAAANM"]
[Thu Nov 27 06:03:29.021401 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.98:58471] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Nov 27 06:03:29.637166 2025] [:error] [pid 21017:tid 21069] [client 194.5.82.98:58471] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Nov 27 06:03:29.986712 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.98:58471] [client 194.5.82.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSd5MaZA663ub03MMQum0wAAAQA"]
[Thu Nov 27 06:03:30.226386 2025] [:error] [pid 6201:tid 6227] [client 194.5.82.89:30129] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Nov 27 06:03:30.373622 2025] [:error] [pid 6201:tid 6212] [client 194.5.82.89:30129] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSd5MjkSJeRkIQGTjzw1fQAAAAc"]
[Thu Nov 27 06:03:30.702538 2025] [:error] [pid 6203:tid 6275] [client 194.5.82.98:48659] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Nov 27 06:03:31.033417 2025] [:error] [pid 6203:tid 6280] [client 194.5.82.98:48659] [client 194.5.82.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSd5M8bdRL7aKyrgqyzdgwAAAJQ"]
[Thu Nov 27 06:03:31.468917 2025] [:error] [pid 21017:tid 21072] [client 194.5.82.96:27911] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSd5M6ZA663ub03MMQum1gAAAQ0"]
[Thu Nov 27 06:03:31.805984 2025] [:error] [pid 6202:tid 6256] [client 194.5.82.89:31507] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Nov 27 06:03:31.964773 2025] [:error] [pid 6202:tid 6240] [client 194.5.82.89:31507] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Nov 27 06:03:32.273668 2025] [:error] [pid 6202:tid 6243] [client 194.5.82.89:31507] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSd5NNJa7NTP0XPyZ6l6uAAAAEo"]
[Thu Nov 27 06:03:32.608180 2025] [:error] [pid 6290:tid 6298] [client 194.5.82.85:37021] [client 194.5.82.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSd5NIqL4zye-zKr6suwHAAAAMQ"]
[Thu Nov 27 06:03:33.103905 2025] [:error] [pid 21017:tid 21070] [client 194.5.82.68:23349] [client 194.5.82.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSd5NaZA663ub03MMQum2QAAAQs"]
[Thu Nov 27 06:03:33.357188 2025] [:error] [pid 6203:tid 6260] [client 194.5.82.102:34113] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSd5NcbdRL7aKyrgqyzdhwAAAIA"]
[Thu Nov 27 06:03:33.581864 2025] [:error] [pid 6202:tid 6238] [client 194.5.82.71:28943] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSd5NdJa7NTP0XPyZ6l6uQAAAEU"]
[Thu Nov 27 06:03:34.035898 2025] [:error] [pid 6202:tid 6246] [client 194.5.82.103:54875] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Nov 27 06:03:34.170603 2025] [:error] [pid 6202:tid 6253] [client 194.5.82.103:54875] [client 194.5.82.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSd5NtJa7NTP0XPyZ6l6vQAAAFQ"]
[Thu Nov 27 06:03:34.521705 2025] [:error] [pid 6203:tid 6276] [client 194.5.82.68:54087] [client 194.5.82.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSd5NsbdRL7aKyrgqyzdiAAAAJA"]
[Thu Nov 27 06:03:34.793688 2025] [:error] [pid 6290:tid 6300] [client 194.5.82.68:36177] [client 194.5.82.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSd5NoqL4zye-zKr6suwHwAAAMY"]
[Thu Nov 27 06:03:35.427229 2025] [:error] [pid 21017:tid 21083] [client 194.5.82.103:34963] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Nov 27 06:03:35.959787 2025] [:error] [pid 21017:tid 21082] [client 194.5.82.103:34963] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Nov 27 06:03:36.522143 2025] [:error] [pid 21017:tid 21061] [client 194.5.82.103:34963] [client 194.5.82.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSd5OKZA663ub03MMQum6AAAAQI"]
[Thu Nov 27 06:03:37.303222 2025] [:error] [pid 6290:tid 6307] [client 194.5.82.64:61225] [client 194.5.82.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.64, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSd5OYqL4zye-zKr6suwJAAAAM0"]
[Thu Nov 27 06:03:37.442842 2025] [:error] [pid 6290:tid 6299] [client 194.5.82.64:61225] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Nov 27 06:03:38.109822 2025] [:error] [pid 6290:tid 6298] [client 194.5.82.64:61225] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Nov 27 06:03:38.214070 2025] [:error] [pid 6290:tid 6306] [client 194.5.82.64:61225] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Nov 27 06:03:38.874183 2025] [:error] [pid 6290:tid 6314] [client 194.5.82.64:61225] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSd5OoqL4zye-zKr6suwMQAAANQ"]
[Thu Nov 27 06:03:39.467516 2025] [:error] [pid 6202:tid 6255] [client 194.5.82.64:20535] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Nov 27 06:03:39.571728 2025] [:error] [pid 6202:tid 6248] [client 194.5.82.64:20535] [client 194.5.82.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.64, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSd5O9Ja7NTP0XPyZ6l6wQAAAE8"]
[Thu Nov 27 06:03:39.829472 2025] [:error] [pid 6202:tid 6241] [client 194.5.82.64:20535] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSd5O9Ja7NTP0XPyZ6l6wwAAAEg"]
[Thu Nov 27 06:03:40.630176 2025] [:error] [pid 6202:tid 6238] [client 194.5.82.64:60019] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Nov 27 06:03:40.894297 2025] [:error] [pid 6202:tid 6239] [client 194.5.82.64:60019] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Nov 27 06:03:41.140299 2025] [:error] [pid 6202:tid 6245] [client 194.5.82.64:60019] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSd5PdJa7NTP0XPyZ6l6zAAAAEw"]
[Thu Nov 27 06:03:41.420817 2025] [:error] [pid 6202:tid 6246] [client 194.5.82.88:59479] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Nov 27 06:03:41.845540 2025] [:error] [pid 6202:tid 6251] [client 194.5.82.88:59479] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Nov 27 06:03:42.280212 2025] [:error] [pid 6202:tid 6252] [client 194.5.82.88:59479] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Nov 27 06:03:42.539914 2025] [:error] [pid 6202:tid 6235] [client 194.5.82.88:59479] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Nov 27 06:03:42.682029 2025] [:error] [pid 6202:tid 6255] [client 194.5.82.88:59479] [client 194.5.82.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSd5PtJa7NTP0XPyZ6l61gAAAFY"]
[Thu Nov 27 06:03:42.963885 2025] [:error] [pid 6203:tid 6281] [client 194.5.82.89:38411] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Nov 27 06:03:43.223894 2025] [:error] [pid 6203:tid 6275] [client 194.5.82.89:38411] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Nov 27 06:03:43.357646 2025] [:error] [pid 6203:tid 6280] [client 194.5.82.89:38411] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSd5P8bdRL7aKyrgqyzdkQAAAJQ"]
[Thu Nov 27 06:03:43.726638 2025] [:error] [pid 21017:tid 21061] [client 194.5.82.99:49519] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Nov 27 06:03:44.010641 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.99:49519] [client 194.5.82.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.99, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSd5QKZA663ub03MMQum8wAAARU"]
[Thu Nov 27 06:03:44.201037 2025] [:error] [pid 21017:tid 21068] [client 194.5.82.99:49519] [client 194.5.82.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSd5QKZA663ub03MMQum9AAAAQk"]
[Thu Nov 27 06:03:45.817034 2025] [:error] [pid 6203:tid 6271] [client 194.5.82.96:62591] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Nov 27 06:03:46.628579 2025] [:error] [pid 6203:tid 6272] [client 194.5.82.96:62591] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Nov 27 06:03:46.780652 2025] [:error] [pid 6203:tid 6274] [client 194.5.82.96:62591] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSd5QsbdRL7aKyrgqyzdpgAAAI4"]
[Thu Nov 27 06:03:47.002267 2025] [:error] [pid 6290:tid 6309] [client 194.5.82.93:65455] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Nov 27 06:03:47.398830 2025] [:error] [pid 6290:tid 6295] [client 194.5.82.93:65455] [client 194.5.82.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.93, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSd5Q4qL4zye-zKr6suwOQAAAME"]
[Thu Nov 27 06:03:47.538954 2025] [:error] [pid 6290:tid 6318] [client 194.5.82.93:65455] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Nov 27 06:03:47.698060 2025] [:error] [pid 6290:tid 6303] [client 194.5.82.93:65455] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Nov 27 06:03:47.843598 2025] [:error] [pid 6290:tid 6310] [client 194.5.82.93:65455] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Nov 27 06:03:47.987071 2025] [:error] [pid 6290:tid 6300] [client 194.5.82.93:65455] [client 194.5.82.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSd5Q4qL4zye-zKr6suwPQAAAMY"]
[Thu Nov 27 06:03:48.194258 2025] [:error] [pid 6290:tid 6312] [client 194.5.82.86:21029] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Nov 27 06:03:48.323826 2025] [:error] [pid 6290:tid 6301] [client 194.5.82.86:21029] [client 194.5.82.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSd5RIqL4zye-zKr6suwPwAAAMc"]
[Thu Nov 27 06:03:48.940328 2025] [:error] [pid 6203:tid 6278] [client 194.5.82.93:32887] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Nov 27 06:03:49.052332 2025] [:error] [pid 6203:tid 6283] [client 194.5.82.93:32887] [client 194.5.82.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSd5RcbdRL7aKyrgqyzdqwAAAJc"]
[Thu Nov 27 06:03:49.656288 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.67:24695] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Nov 27 06:03:49.805879 2025] [:error] [pid 21017:tid 21079] [client 194.5.82.67:24695] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSd5RaZA663ub03MMQum_QAAARQ"]
[Thu Nov 27 06:03:50.120274 2025] [:error] [pid 6203:tid 6262] [client 194.5.82.104:60037] [client 194.5.82.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSd5RsbdRL7aKyrgqyzdrQAAAII"]
[Thu Nov 27 06:03:50.358334 2025] [:error] [pid 6202:tid 6242] [client 194.5.82.69:36549] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Nov 27 06:03:50.526965 2025] [:error] [pid 6202:tid 6243] [client 194.5.82.69:36549] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Nov 27 06:03:51.088409 2025] [:error] [pid 6202:tid 6239] [client 194.5.82.69:36549] [client 194.5.82.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSd5R9Ja7NTP0XPyZ6l63AAAAEY"]
[Thu Nov 27 06:03:51.535874 2025] [:error] [pid 21017:tid 21082] [client 194.5.82.95:22939] [client 194.5.82.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSd5R6ZA663ub03MMQunAgAAARc"]
[Thu Nov 27 06:03:52.180688 2025] [:error] [pid 21017:tid 21064] [client 194.5.82.73:20493] [client 194.5.82.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSd5SKZA663ub03MMQunCQAAAQU"]
[Thu Nov 27 06:03:52.478601 2025] [:error] [pid 21017:tid 21081] [client 194.5.82.90:34567] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Nov 27 06:03:52.717378 2025] [:error] [pid 21017:tid 21079] [client 194.5.82.90:34567] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Nov 27 06:03:52.874076 2025] [:error] [pid 21017:tid 21072] [client 194.5.82.90:34567] [client 194.5.82.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSd5SKZA663ub03MMQunDQAAAQ0"]
[Thu Nov 27 06:03:53.196292 2025] [:error] [pid 6201:tid 6207] [client 194.5.82.67:55621] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Nov 27 06:03:53.442637 2025] [:error] [pid 6201:tid 6213] [client 194.5.82.67:55621] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSd5STkSJeRkIQGTjzw1lQAAAAg"]
[Thu Nov 27 06:03:54.236825 2025] [:error] [pid 21017:tid 21061] [client 194.5.82.103:26753] [client 194.5.82.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSd5SqZA663ub03MMQunEwAAAQI"]
[Thu Nov 27 06:03:54.807141 2025] [:error] [pid 6202:tid 6234] [client 194.5.82.102:50717] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Nov 27 06:03:55.193874 2025] [:error] [pid 6202:tid 6252] [client 194.5.82.102:50717] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Nov 27 06:03:55.539825 2025] [:error] [pid 6202:tid 6235] [client 194.5.82.102:50717] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Nov 27 06:03:55.649826 2025] [:error] [pid 6202:tid 6255] [client 194.5.82.102:50717] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSd5S9Ja7NTP0XPyZ6l65gAAAFY"]
[Thu Nov 27 06:03:55.882779 2025] [:error] [pid 6201:tid 6209] [client 194.5.82.88:56345] [client 194.5.82.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSd5SzkSJeRkIQGTjzw1mQAAAAQ"]
[Thu Nov 27 06:03:56.187622 2025] [:error] [pid 21017:tid 21064] [client 194.5.82.99:64543] [client 194.5.82.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSd5TKZA663ub03MMQunFwAAAQU"]
[Thu Nov 27 06:03:56.415920 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.62:24171] [client 194.5.82.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSd5TKZA663ub03MMQunGQAAAQA"]
[Thu Nov 27 06:03:56.622618 2025] [:error] [pid 6201:tid 6210] [client 194.5.82.91:65037] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Nov 27 06:03:56.731241 2025] [:error] [pid 6201:tid 6223] [client 194.5.82.91:65037] [client 194.5.82.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSd5TDkSJeRkIQGTjzw1nAAAABI"]
[Thu Nov 27 06:03:56.924502 2025] [:error] [pid 6203:tid 6260] [client 194.5.82.95:28241] [client 194.5.82.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSd5TMbdRL7aKyrgqyzduQAAAIA"]
[Thu Nov 27 06:03:57.239835 2025] [:error] [pid 6203:tid 6273] [client 194.5.82.60:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Nov 27 06:03:57.537212 2025] [:error] [pid 6203:tid 6281] [client 194.5.82.60:26985] [client 194.5.82.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSd5TcbdRL7aKyrgqyzdvAAAAJU"]
[Thu Nov 27 06:03:57.903342 2025] [:error] [pid 21017:tid 21066] [client 194.5.82.78:45427] [client 194.5.82.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSd5TaZA663ub03MMQunGwAAAQc"]
[Thu Nov 27 06:03:58.229934 2025] [:error] [pid 21017:tid 21069] [client 194.5.82.78:30585] [client 194.5.82.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSd5TqZA663ub03MMQunHAAAAQo"]
[Thu Nov 27 06:03:58.488406 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.61:57533] [client 194.5.82.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSd5TqZA663ub03MMQunHQAAARU"]
[Thu Nov 27 06:03:58.880294 2025] [:error] [pid 6201:tid 6207] [client 194.5.82.103:29819] [client 194.5.82.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSd5TjkSJeRkIQGTjzw1nwAAAAI"]
[Thu Nov 27 06:03:59.435108 2025] [:error] [pid 6203:tid 6277] [client 194.5.82.65:28763] [client 194.5.82.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSd5T8bdRL7aKyrgqyzdvwAAAJE"]
[Thu Nov 27 06:03:59.677568 2025] [:error] [pid 6201:tid 6213] [client 194.5.82.61:20125] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Nov 27 06:04:00.229643 2025] [:error] [pid 6201:tid 6225] [client 194.5.82.61:20125] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Nov 27 06:04:00.362860 2025] [:error] [pid 6201:tid 6209] [client 194.5.82.61:20125] [client 194.5.82.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSd5UDkSJeRkIQGTjzw1pQAAAAQ"]
[Thu Nov 27 06:04:00.790389 2025] [:error] [pid 21017:tid 21064] [client 194.5.82.101:57097] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Nov 27 06:04:01.214329 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.101:57097] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Nov 27 06:04:01.866777 2025] [:error] [pid 21017:tid 21076] [client 194.5.82.101:57097] [client 194.5.82.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSd5UaZA663ub03MMQunKgAAARE"]
[Thu Nov 27 06:04:02.540466 2025] [:error] [pid 6290:tid 6304] [client 194.5.82.66:45883] [client 194.5.82.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSd5UoqL4zye-zKr6suwTAAAAMo"]
[Thu Nov 27 06:04:02.819380 2025] [:error] [pid 6203:tid 6261] [client 194.5.82.64:43939] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSd5UsbdRL7aKyrgqyzdxAAAAIE"]
[Thu Nov 27 06:04:03.743589 2025] [:error] [pid 21017:tid 21077] [client 194.5.82.97:51137] [client 194.5.82.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSd5U6ZA663ub03MMQunMQAAARI"]
[Thu Nov 27 06:04:04.254158 2025] [:error] [pid 6201:tid 6214] [client 194.5.82.168:34435] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Nov 27 06:04:04.393936 2025] [:error] [pid 6201:tid 6222] [client 194.5.82.168:34435] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Nov 27 06:04:04.507410 2025] [:error] [pid 6201:tid 6221] [client 194.5.82.168:34435] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Nov 27 06:04:04.674604 2025] [:error] [pid 6201:tid 6207] [client 194.5.82.168:34435] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Nov 27 06:04:05.637684 2025] [:error] [pid 6201:tid 6225] [client 194.5.82.168:34435] [client 194.5.82.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSd5VTkSJeRkIQGTjzw1swAAABQ"]
[Thu Nov 27 06:04:05.875947 2025] [:error] [pid 21017:tid 21079] [client 194.5.82.87:32095] [client 194.5.82.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSd5VaZA663ub03MMQunNQAAARQ"]
[Thu Nov 27 06:04:06.105982 2025] [:error] [pid 6203:tid 6262] [client 194.5.82.72:20895] [client 194.5.82.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSd5VsbdRL7aKyrgqyzdyQAAAII"]
[Thu Nov 27 06:04:06.387852 2025] [:error] [pid 6201:tid 6228] [client 194.5.82.104:64531] [client 194.5.82.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSd5VjkSJeRkIQGTjzw1tgAAABc"]
[Thu Nov 27 06:04:06.708432 2025] [:error] [pid 6202:tid 6251] [client 194.5.82.96:51333] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSd5VtJa7NTP0XPyZ6l67gAAAFI"]
[Thu Nov 27 06:04:08.124755 2025] [:error] [pid 6203:tid 6266] [client 194.5.82.104:20739] [client 194.5.82.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSd5WMbdRL7aKyrgqyzdzAAAAIY"]
[Thu Nov 27 06:04:08.543683 2025] [:error] [pid 6203:tid 6277] [client 194.5.82.167:35559] [client 194.5.82.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSd5WMbdRL7aKyrgqyzdzgAAAJE"]
[Thu Nov 27 06:04:08.882929 2025] [:error] [pid 21017:tid 21082] [client 194.5.82.78:52295] [client 194.5.82.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSd5WKZA663ub03MMQunQQAAARc"]
[Thu Nov 27 06:04:09.100444 2025] [:error] [pid 21017:tid 21070] [client 194.5.82.61:32273] [client 194.5.82.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSd5WaZA663ub03MMQunQgAAAQs"]
[Thu Nov 27 06:04:09.414538 2025] [:error] [pid 6290:tid 6296] [client 194.5.82.59:49857] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSd5WYqL4zye-zKr6suwUQAAAMI"]
[Thu Nov 27 06:04:09.950262 2025] [:error] [pid 6202:tid 6241] [client 194.5.82.61:54497] [client 194.5.82.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSd5WdJa7NTP0XPyZ6l68gAAAEg"]
[Thu Nov 27 06:04:10.396716 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.167:35669] [client 194.5.82.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSd5WqZA663ub03MMQunRwAAAQA"]
[Thu Nov 27 06:04:10.704465 2025] [:error] [pid 21017:tid 21067] [client 194.5.82.67:52961] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Nov 27 06:04:10.960226 2025] [:error] [pid 21017:tid 21063] [client 194.5.82.67:52961] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSd5WqZA663ub03MMQunTQAAAQQ"]
[Thu Nov 27 06:04:11.537122 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.58:42759] [client 194.5.82.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSd5W6ZA663ub03MMQunUAAAAQw"]
[Thu Nov 27 06:04:12.108101 2025] [:error] [pid 21017:tid 21079] [client 194.5.82.76:37981] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Nov 27 06:04:12.529414 2025] [:error] [pid 21017:tid 21064] [client 194.5.82.76:37981] [client 194.5.82.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSd5XKZA663ub03MMQunVQAAAQU"]
[Thu Nov 27 06:04:13.124723 2025] [:error] [pid 21017:tid 21081] [client 194.5.82.96:51853] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Nov 27 06:04:13.304146 2025] [:error] [pid 21017:tid 21069] [client 194.5.82.96:51853] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Nov 27 06:04:13.420801 2025] [:error] [pid 21017:tid 21066] [client 194.5.82.96:51853] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Nov 27 06:04:13.554728 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.96:51853] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSd5XaZA663ub03MMQunWgAAAQA"]
[Thu Nov 27 06:04:13.767560 2025] [:error] [pid 6201:tid 6213] [client 194.5.82.72:57227] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Nov 27 06:04:13.975637 2025] [:error] [pid 6201:tid 6216] [client 194.5.82.72:57227] [client 194.5.82.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSd5XTkSJeRkIQGTjzw1vgAAAAs"]
[Thu Nov 27 06:04:14.445664 2025] [:error] [pid 6202:tid 6240] [client 194.5.82.102:42183] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Nov 27 06:04:14.597304 2025] [:error] [pid 6202:tid 6250] [client 194.5.82.102:42183] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Nov 27 06:04:14.838950 2025] [:error] [pid 6202:tid 6239] [client 194.5.82.102:42183] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Nov 27 06:04:15.620057 2025] [:error] [pid 6202:tid 6234] [client 194.5.82.102:42183] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Nov 27 06:04:16.021200 2025] [:error] [pid 6202:tid 6251] [client 194.5.82.102:42183] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Nov 27 06:04:16.262469 2025] [:error] [pid 6202:tid 6252] [client 194.5.82.102:42183] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Nov 27 06:04:17.004633 2025] [:error] [pid 6202:tid 6248] [client 194.5.82.102:42183] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Nov 27 06:04:17.157579 2025] [:error] [pid 6202:tid 6254] [client 194.5.82.102:42183] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSd5YdJa7NTP0XPyZ6l7BgAAAFU"]
[Thu Nov 27 06:04:18.917068 2025] [:error] [pid 21017:tid 21072] [client 194.5.82.88:21095] [client 194.5.82.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSd5YqZA663ub03MMQunYQAAAQ0"]
[Thu Nov 27 06:04:19.104337 2025] [:error] [pid 6203:tid 6277] [client 194.5.82.70:21979] [client 194.5.82.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.70, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aSd5Y8bdRL7aKyrgqyzd1gAAAJE"]
[Thu Nov 27 06:04:19.108128 2025] [:error] [pid 6203:tid 6277] [client 194.5.82.70:21979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Nov 27 06:04:19.234160 2025] [:error] [pid 6203:tid 6264] [client 194.5.82.70:21979] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Nov 27 06:04:19.380391 2025] [:error] [pid 6203:tid 6283] [client 194.5.82.70:21979] [client 194.5.82.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSd5Y8bdRL7aKyrgqyzd2QAAAJc"]
[Thu Nov 27 06:04:19.987791 2025] [:error] [pid 6201:tid 6224] [client 194.5.82.88:29159] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Nov 27 06:04:20.174057 2025] [:error] [pid 6201:tid 6218] [client 194.5.82.88:29159] [client 194.5.82.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSd5ZDkSJeRkIQGTjzw1xAAAAA0"]
[Thu Nov 27 06:04:20.381365 2025] [:error] [pid 6201:tid 6214] [client 194.5.82.66:41777] [client 194.5.82.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSd5ZDkSJeRkIQGTjzw1xQAAAAk"]
[Thu Nov 27 06:04:21.151777 2025] [:error] [pid 6201:tid 6208] [client 194.5.82.70:33735] [client 194.5.82.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSd5ZTkSJeRkIQGTjzw1zAAAAAM"]
[Thu Nov 27 06:04:21.387350 2025] [:error] [pid 6203:tid 6265] [client 194.5.82.86:38669] [client 194.5.82.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/fm.php"] [unique_id "aSd5ZcbdRL7aKyrgqyzd3gAAAIU"]
[Thu Nov 27 06:04:23.074256 2025] [:error] [pid 6201:tid 6223] [client 194.5.82.56:50535] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Nov 27 06:04:23.396449 2025] [:error] [pid 6201:tid 6215] [client 194.5.82.56:50535] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSd5ZzkSJeRkIQGTjzw11QAAAAo"]
[Thu Nov 27 06:04:23.955662 2025] [:error] [pid 21017:tid 21077] [client 194.5.82.78:54511] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Nov 27 06:04:24.263390 2025] [:error] [pid 21017:tid 21068] [client 194.5.82.78:54511] [client 194.5.82.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSd5aKZA663ub03MMQunbAAAAQk"]
[Thu Nov 27 06:04:24.513099 2025] [:error] [pid 6203:tid 6283] [client 194.5.82.83:26587] [client 194.5.82.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSd5aMbdRL7aKyrgqyzd5QAAAJc"]
[Thu Nov 27 06:04:24.902006 2025] [:error] [pid 6202:tid 6243] [client 194.5.82.62:61889] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Nov 27 06:04:25.015232 2025] [:error] [pid 6202:tid 6257] [client 194.5.82.62:61889] [client 194.5.82.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSd5adJa7NTP0XPyZ6l7CQAAAFg"]
[Thu Nov 27 06:04:25.367693 2025] [:error] [pid 6202:tid 6240] [client 194.5.82.77:20095] [client 194.5.82.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSd5adJa7NTP0XPyZ6l7CgAAAEc"]
[Thu Nov 27 06:04:25.865269 2025] [:error] [pid 6203:tid 6280] [client 194.5.82.74:53729] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Nov 27 06:04:26.029645 2025] [:error] [pid 6203:tid 6265] [client 194.5.82.74:53729] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Nov 27 06:04:26.423159 2025] [:error] [pid 6203:tid 6282] [client 194.5.82.74:53729] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Nov 27 06:04:26.641089 2025] [:error] [pid 6203:tid 6281] [client 194.5.82.74:53729] [client 194.5.82.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSd5asbdRL7aKyrgqyzd8AAAAJU"]
[Thu Nov 27 06:04:26.853379 2025] [:error] [pid 6201:tid 6208] [client 194.5.82.81:33881] [client 194.5.82.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSd5ajkSJeRkIQGTjzw12wAAAAM"]
[Thu Nov 27 06:04:27.432786 2025] [:error] [pid 6201:tid 6215] [client 194.5.82.64:25755] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Nov 27 06:04:27.532410 2025] [:error] [pid 6201:tid 6224] [client 194.5.82.64:25755] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSd5azkSJeRkIQGTjzw14AAAABM"]
[Thu Nov 27 06:04:29.285632 2025] [:error] [pid 21017:tid 21073] [client 194.5.82.73:25365] [client 194.5.82.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSd5baZA663ub03MMQuncgAAAQ4"]
[Thu Nov 27 06:04:31.265341 2025] [:error] [pid 6202:tid 6253] [client 194.5.82.66:48605] [client 194.5.82.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSd5b9Ja7NTP0XPyZ6l7DwAAAFQ"]
[Thu Nov 27 06:04:32.162351 2025] [:error] [pid 21017:tid 21067] [client 194.5.82.79:22539] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Nov 27 06:04:32.295922 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.79:22539] [client 194.5.82.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSd5cKZA663ub03MMQunfAAAAQw"]
[Thu Nov 27 06:04:32.905971 2025] [:error] [pid 6203:tid 6270] [client 194.5.82.54:27091] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSd5cMbdRL7aKyrgqyzd9wAAAIo"]
[Thu Nov 27 06:04:33.206291 2025] [:error] [pid 6202:tid 6255] [client 194.5.82.103:28071] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Nov 27 06:04:33.320046 2025] [:error] [pid 6202:tid 6241] [client 194.5.82.103:28071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Nov 27 06:04:33.575381 2025] [:error] [pid 6202:tid 6243] [client 194.5.82.103:28071] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Nov 27 06:04:34.176891 2025] [:error] [pid 6202:tid 6233] [client 194.5.82.103:28071] [client 194.5.82.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.103, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aSd5ctJa7NTP0XPyZ6l7GQAAAEA"]
[Thu Nov 27 06:04:34.469532 2025] [:error] [pid 6202:tid 6245] [client 194.5.82.103:28071] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Nov 27 06:04:34.596402 2025] [:error] [pid 6202:tid 6244] [client 194.5.82.103:28071] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Nov 27 06:04:34.714156 2025] [:error] [pid 6202:tid 6237] [client 194.5.82.103:28071] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Nov 27 06:04:34.993408 2025] [:error] [pid 6202:tid 6234] [client 194.5.82.103:28071] [client 194.5.82.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSd5ctJa7NTP0XPyZ6l7IAAAAEE"]
[Thu Nov 27 06:04:36.326807 2025] [:error] [pid 21017:tid 21064] [client 194.5.82.79:25743] [client 194.5.82.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.79, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSd5dKZA663ub03MMQunhQAAAQU"]
[Thu Nov 27 06:04:36.739230 2025] [:error] [pid 21017:tid 21067] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Nov 27 06:04:36.856684 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Nov 27 06:04:37.135306 2025] [:error] [pid 21017:tid 21081] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Nov 27 06:04:37.457167 2025] [:error] [pid 21017:tid 21079] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Nov 27 06:04:37.988415 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Nov 27 06:04:39.061855 2025] [:error] [pid 21017:tid 21073] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Nov 27 06:04:39.172485 2025] [:error] [pid 21017:tid 21061] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Nov 27 06:04:39.896792 2025] [:error] [pid 21017:tid 21075] [client 194.5.82.79:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Nov 27 06:04:40.296019 2025] [:error] [pid 21017:tid 21081] [client 194.5.82.79:25743] [client 194.5.82.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSd5eKZA663ub03MMQunogAAARY"]
[Thu Nov 27 06:04:40.926173 2025] [:error] [pid 6290:tid 6312] [client 194.5.82.60:33567] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Nov 27 06:04:41.041913 2025] [:error] [pid 6290:tid 6309] [client 194.5.82.60:33567] [client 194.5.82.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSd5eYqL4zye-zKr6suwcAAAAM8"]
[Thu Nov 27 06:04:41.638436 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.74:27973] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Nov 27 06:04:41.742362 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.74:27973] [client 194.5.82.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSd5eaZA663ub03MMQunpgAAARU"]
[Thu Nov 27 06:04:43.703952 2025] [:error] [pid 6202:tid 6249] [client 194.5.82.83:49585] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Nov 27 06:04:43.976160 2025] [:error] [pid 6202:tid 6257] [client 194.5.82.83:49585] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Nov 27 06:04:44.310823 2025] [:error] [pid 6202:tid 6240] [client 194.5.82.83:49585] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Nov 27 06:04:44.428308 2025] [:error] [pid 6202:tid 6250] [client 194.5.82.83:49585] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Thu Nov 27 06:04:44.711200 2025] [:error] [pid 6202:tid 6239] [client 194.5.82.83:49585] [client 194.5.82.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSd5fNJa7NTP0XPyZ6l7LQAAAEY"]
[Thu Nov 27 06:04:46.090410 2025] [:error] [pid 6290:tid 6296] [client 194.5.82.89:33469] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Nov 27 06:04:46.294244 2025] [:error] [pid 6290:tid 6310] [client 194.5.82.89:33469] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Nov 27 06:04:47.807747 2025] [:error] [pid 6290:tid 6310] [client 194.5.82.89:33469] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSd5f4qL4zye-zKr6suweAAAANA"]
[Thu Nov 27 06:04:48.170323 2025] [:error] [pid 6290:tid 6300] [client 194.5.82.82:57501] [client 194.5.82.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSd5gIqL4zye-zKr6suwewAAAMY"]
[Thu Nov 27 06:04:49.838141 2025] [:error] [pid 6202:tid 6253] [client 194.5.82.90:32263] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Nov 27 06:04:50.350961 2025] [:error] [pid 6202:tid 6252] [client 194.5.82.90:32263] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Thu Nov 27 06:04:50.567522 2025] [:error] [pid 6202:tid 6246] [client 194.5.82.90:32263] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Nov 27 06:04:50.814757 2025] [:error] [pid 6202:tid 6256] [client 194.5.82.90:32263] [client 194.5.82.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSd5gtJa7NTP0XPyZ6l7NQAAAFc"]
[Thu Nov 27 06:04:51.026994 2025] [:error] [pid 6290:tid 6309] [client 194.5.82.69:60061] [client 194.5.82.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSd5g4qL4zye-zKr6suwgAAAAM8"]
[Thu Nov 27 06:04:52.180370 2025] [:error] [pid 6203:tid 6280] [client 194.5.82.59:20517] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Nov 27 06:04:52.448794 2025] [:error] [pid 6203:tid 6282] [client 194.5.82.59:20517] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSd5hMbdRL7aKyrgqyzeBQAAAJY"]
[Thu Nov 27 06:04:54.057857 2025] [:error] [pid 6202:tid 6248] [client 194.5.82.90:30217] [client 194.5.82.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tiny.php"] [unique_id "aSd5htJa7NTP0XPyZ6l7NwAAAE8"]
[Thu Nov 27 06:04:54.426488 2025] [:error] [pid 6201:tid 6229] [client 194.5.82.71:35745] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Nov 27 06:04:54.542247 2025] [:error] [pid 6201:tid 6216] [client 194.5.82.71:35745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Nov 27 06:04:54.739708 2025] [:error] [pid 6201:tid 6228] [client 194.5.82.71:35745] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSd5hjkSJeRkIQGTjzw19AAAABc"]
[Thu Nov 27 06:04:55.244714 2025] [:error] [pid 21017:tid 21070] [client 194.5.82.81:56849] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Nov 27 06:04:55.398585 2025] [:error] [pid 21017:tid 21076] [client 194.5.82.81:56849] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Thu Nov 27 06:04:55.722295 2025] [:error] [pid 21017:tid 21066] [client 194.5.82.81:56849] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Nov 27 06:04:56.163737 2025] [:error] [pid 21017:tid 21073] [client 194.5.82.81:56849] [client 194.5.82.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSd5iKZA663ub03MMQunuAAAAQ4"]
[Thu Nov 27 06:04:56.405335 2025] [:error] [pid 6202:tid 6247] [client 194.5.82.76:33159] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Thu Nov 27 06:04:56.825410 2025] [:error] [pid 6202:tid 6243] [client 194.5.82.76:33159] [client 194.5.82.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSd5iNJa7NTP0XPyZ6l7OwAAAEo"]
[Thu Nov 27 06:04:57.326468 2025] [:error] [pid 6201:tid 6214] [client 194.5.82.55:51391] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Thu Nov 27 06:04:57.794729 2025] [:error] [pid 6201:tid 6205] [client 194.5.82.55:51391] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Thu Nov 27 06:04:57.899255 2025] [:error] [pid 6201:tid 6211] [client 194.5.82.55:51391] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Thu Nov 27 06:04:58.200888 2025] [:error] [pid 6201:tid 6218] [client 194.5.82.55:51391] [client 194.5.82.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.55, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSd5ijkSJeRkIQGTjzw1_wAAAA0"]
[Thu Nov 27 06:04:59.180402 2025] [:error] [pid 6201:tid 6228] [client 194.5.82.55:51391] [client 194.5.82.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSd5izkSJeRkIQGTjzw2BwAAABc"]
[Thu Nov 27 06:04:59.396882 2025] [:error] [pid 6202:tid 6238] [client 194.5.82.98:26193] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Thu Nov 27 06:04:59.515714 2025] [:error] [pid 6202:tid 6240] [client 194.5.82.98:26193] [client 194.5.82.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSd5i9Ja7NTP0XPyZ6l7PQAAAEc"]
[Thu Nov 27 06:04:59.739434 2025] [:error] [pid 21017:tid 21077] [client 194.5.82.93:34523] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Thu Nov 27 06:05:00.066796 2025] [:error] [pid 21017:tid 21064] [client 194.5.82.93:34523] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Nov 27 06:05:00.357194 2025] [:error] [pid 21017:tid 21067] [client 194.5.82.93:34523] [client 194.5.82.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSd5jKZA663ub03MMQunvgAAAQg"]
[Thu Nov 27 06:05:01.010175 2025] [:error] [pid 6203:tid 6279] [client 194.5.82.79:62427] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Thu Nov 27 06:05:01.158612 2025] [:error] [pid 6203:tid 6277] [client 194.5.82.79:62427] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Nov 27 06:05:01.487910 2025] [:error] [pid 6203:tid 6284] [client 194.5.82.79:62427] [client 194.5.82.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSd5jcbdRL7aKyrgqyzeDQAAAJg"]
[Thu Nov 27 06:05:02.196865 2025] [:error] [pid 6202:tid 6239] [client 194.5.82.68:63009] [client 194.5.82.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSd5jtJa7NTP0XPyZ6l7PwAAAEY"]
[Thu Nov 27 06:05:02.611381 2025] [:error] [pid 6290:tid 6305] [client 194.5.82.89:61087] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Thu Nov 27 06:05:02.710769 2025] [:error] [pid 6290:tid 6306] [client 194.5.82.89:61087] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Thu Nov 27 06:05:02.994281 2025] [:error] [pid 6290:tid 6311] [client 194.5.82.89:61087] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSd5joqL4zye-zKr6suwjwAAANE"]
[Thu Nov 27 06:05:04.461054 2025] [:error] [pid 6201:tid 6214] [client 194.5.82.67:55117] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Thu Nov 27 06:05:04.734139 2025] [:error] [pid 6201:tid 6225] [client 194.5.82.67:55117] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Thu Nov 27 06:05:04.858190 2025] [:error] [pid 6201:tid 6205] [client 194.5.82.67:55117] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSd5kDkSJeRkIQGTjzw2DgAAAAA"]
[Thu Nov 27 06:05:06.373036 2025] [:error] [pid 6202:tid 6236] [client 194.5.82.62:57817] [client 194.5.82.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSd5ktJa7NTP0XPyZ6l7RAAAAEM"]
[Thu Nov 27 06:05:06.643792 2025] [:error] [pid 21017:tid 21068] [client 194.5.82.56:31111] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSd5kqZA663ub03MMQunwAAAAQk"]
[Thu Nov 27 06:05:06.850857 2025] [:error] [pid 6290:tid 6308] [client 194.5.82.67:45269] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSd5koqL4zye-zKr6suwkQAAAM4"]
[Thu Nov 27 06:05:07.139877 2025] [:error] [pid 21017:tid 21070] [client 194.5.82.74:44773] [client 194.5.82.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSd5k6ZA663ub03MMQunwgAAAQs"]
[Thu Nov 27 06:05:07.416368 2025] [:error] [pid 6202:tid 6246] [client 194.5.82.66:27853] [client 194.5.82.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSd5k9Ja7NTP0XPyZ6l7RQAAAE0"]
[Thu Nov 27 06:05:09.224415 2025] [:error] [pid 6203:tid 6280] [client 194.5.82.104:54487] [client 194.5.82.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSd5lcbdRL7aKyrgqyzeEgAAAJQ"]
[Thu Nov 27 06:05:09.819284 2025] [:error] [pid 6290:tid 6296] [client 194.5.82.96:35627] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSd5lYqL4zye-zKr6suwlwAAAMI"]
[Thu Nov 27 06:05:10.151270 2025] [:error] [pid 21017:tid 21069] [client 194.5.82.93:28721] [client 194.5.82.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSd5lqZA663ub03MMQunwwAAAQo"]
[Thu Nov 27 06:05:10.396351 2025] [:error] [pid 6202:tid 6248] [client 194.5.82.74:41611] [client 194.5.82.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSd5ltJa7NTP0XPyZ6l7RgAAAE8"]
[Thu Nov 27 06:05:10.835703 2025] [:error] [pid 21017:tid 21073] [client 194.5.82.92:36057] [client 194.5.82.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSd5lqZA663ub03MMQunxgAAAQ4"]
[Thu Nov 27 06:05:11.343402 2025] [:error] [pid 6202:tid 6251] [client 194.5.82.99:35789] [client 194.5.82.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSd5l9Ja7NTP0XPyZ6l7SQAAAFI"]
[Thu Nov 27 06:05:11.687505 2025] [:error] [pid 21017:tid 21081] [client 194.5.82.98:57483] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Thu Nov 27 06:05:12.299060 2025] [:error] [pid 21017:tid 21074] [client 194.5.82.98:57483] [client 194.5.82.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.98, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSd5mKZA663ub03MMQunywAAAQ8"]
[Thu Nov 27 06:05:13.389412 2025] [:error] [pid 21017:tid 21079] [client 194.5.82.98:57483] [client 194.5.82.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSd5maZA663ub03MMQun0gAAARQ"]
[Thu Nov 27 06:05:13.692522 2025] [:error] [pid 6290:tid 6316] [client 194.5.82.85:35167] [client 194.5.82.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSd5mYqL4zye-zKr6suwmgAAANY"]
[Thu Nov 27 06:05:14.378676 2025] [:error] [pid 6202:tid 6250] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Nov 27 06:05:14.572233 2025] [:error] [pid 6202:tid 6233] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Thu Nov 27 06:05:15.380839 2025] [:error] [pid 6202:tid 6253] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Thu Nov 27 06:05:15.507760 2025] [:error] [pid 6202:tid 6236] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Thu Nov 27 06:05:16.183041 2025] [:error] [pid 6202:tid 6235] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Thu Nov 27 06:05:16.315610 2025] [:error] [pid 6202:tid 6255] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Thu Nov 27 06:05:16.486459 2025] [:error] [pid 6202:tid 6248] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Nov 27 06:05:16.665432 2025] [:error] [pid 6202:tid 6254] [client 194.5.82.93:44669] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Thu Nov 27 06:05:17.066013 2025] [:error] [pid 6202:tid 6247] [client 194.5.82.93:44669] [client 194.5.82.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSd5ndJa7NTP0XPyZ6l7XQAAAE4"]
[Thu Nov 27 06:05:17.410135 2025] [:error] [pid 6290:tid 6297] [client 194.5.82.58:37015] [client 194.5.82.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSd5nYqL4zye-zKr6suwngAAAMM"]
[Thu Nov 27 06:05:17.640775 2025] [:error] [pid 6202:tid 6249] [client 194.5.82.96:62703] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSd5ndJa7NTP0XPyZ6l7XgAAAFA"]
[Thu Nov 27 06:05:18.026259 2025] [:error] [pid 6203:tid 6284] [client 194.5.82.82:43521] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Thu Nov 27 06:05:18.209075 2025] [:error] [pid 6203:tid 6264] [client 194.5.82.82:43521] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Thu Nov 27 06:05:18.518188 2025] [:error] [pid 6203:tid 6283] [client 194.5.82.82:43521] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Thu Nov 27 06:05:18.750754 2025] [:error] [pid 6203:tid 6271] [client 194.5.82.82:43521] [client 194.5.82.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSd5nsbdRL7aKyrgqyzeHQAAAIs"]
[Thu Nov 27 06:05:18.999859 2025] [:error] [pid 6290:tid 6317] [client 194.5.82.54:51165] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSd5noqL4zye-zKr6suwoQAAANc"]
[Thu Nov 27 06:05:19.337642 2025] [:error] [pid 6290:tid 6298] [client 194.5.82.59:60563] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSd5n4qL4zye-zKr6suwogAAAMQ"]
[Thu Nov 27 06:05:20.191383 2025] [:error] [pid 6290:tid 6303] [client 194.5.82.97:26289] [client 194.5.82.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSd5oIqL4zye-zKr6suwqAAAAMk"]
[Thu Nov 27 06:05:20.524786 2025] [:error] [pid 6202:tid 6238] [client 194.5.82.73:47115] [client 194.5.82.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSd5oNJa7NTP0XPyZ6l7YAAAAEU"]
[Thu Nov 27 06:05:21.206201 2025] [:error] [pid 21017:tid 21077] [client 194.5.82.78:57727] [client 194.5.82.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSd5oaZA663ub03MMQun2gAAARI"]
[Thu Nov 27 06:05:22.899667 2025] [:error] [pid 6201:tid 6215] [client 194.5.82.100:64767] [client 194.5.82.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSd5ojkSJeRkIQGTjzw2KQAAAAo"]
[Thu Nov 27 06:05:23.252074 2025] [:error] [pid 21017:tid 21067] [client 194.5.82.66:30931] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Thu Nov 27 06:05:23.505362 2025] [:error] [pid 21017:tid 21062] [client 194.5.82.66:30931] [client 194.5.82.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSd5o6ZA663ub03MMQun3wAAAQM"]
[Thu Nov 27 06:05:24.045519 2025] [:error] [pid 21017:tid 21076] [client 194.5.82.89:51041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Thu Nov 27 06:05:24.458929 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.89:51041] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Nov 27 06:05:24.596427 2025] [:error] [pid 21017:tid 21069] [client 194.5.82.89:51041] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSd5pKZA663ub03MMQun6QAAAQo"]
[Thu Nov 27 06:05:25.209603 2025] [:error] [pid 6203:tid 6262] [client 194.5.82.104:51973] [client 194.5.82.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSd5pcbdRL7aKyrgqyzeJAAAAII"]
[Thu Nov 27 06:05:26.087719 2025] [:error] [pid 21017:tid 21074] [client 194.5.82.81:63911] [client 194.5.82.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSd5pqZA663ub03MMQun7gAAAQ8"]
[Thu Nov 27 06:05:27.068267 2025] [:error] [pid 21017:tid 21082] [client 194.5.82.77:47129] [client 194.5.82.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSd5p6ZA663ub03MMQun9AAAARc"]
[Thu Nov 27 06:05:27.469182 2025] [:error] [pid 6290:tid 6300] [client 194.5.82.168:39081] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Nov 27 06:05:27.601651 2025] [:error] [pid 6290:tid 6304] [client 194.5.82.168:39081] [client 194.5.82.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSd5p4qL4zye-zKr6suwsQAAAMo"]
[Thu Nov 27 06:05:27.879309 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.63:37909] [client 194.5.82.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSd5p6ZA663ub03MMQun9wAAARU"]
[Thu Nov 27 06:05:28.748298 2025] [:error] [pid 6201:tid 6209] [client 194.5.82.83:52129] [client 194.5.82.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSd5qDkSJeRkIQGTjzw2LwAAAAQ"]
[Thu Nov 27 06:05:29.085232 2025] [:error] [pid 6202:tid 6250] [client 194.5.82.81:64155] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Nov 27 06:05:29.636831 2025] [:error] [pid 6202:tid 6245] [client 194.5.82.81:64155] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Thu Nov 27 06:05:31.027288 2025] [:error] [pid 6202:tid 6245] [client 194.5.82.81:64155] [client 194.5.82.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSd5q9Ja7NTP0XPyZ6l7ZgAAAEw"]
[Thu Nov 27 06:05:31.761683 2025] [:error] [pid 6290:tid 6318] [client 194.5.82.62:21151] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Thu Nov 27 06:05:31.966341 2025] [:error] [pid 6290:tid 6303] [client 194.5.82.62:21151] [client 194.5.82.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSd5q4qL4zye-zKr6suwtwAAAMk"]
[Thu Nov 27 06:05:32.247274 2025] [:error] [pid 6202:tid 6256] [client 194.5.82.103:40195] [client 194.5.82.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSd5rNJa7NTP0XPyZ6l7ZwAAAFc"]
[Thu Nov 27 06:05:32.730665 2025] [:error] [pid 21017:tid 21060] [client 194.5.82.84:24017] [client 194.5.82.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSd5rKZA663ub03MMQun_AAAAQE"]
[Thu Nov 27 06:05:33.408884 2025] [:error] [pid 6202:tid 6241] [client 194.5.82.87:33847] [client 194.5.82.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSd5rdJa7NTP0XPyZ6l7bgAAAEg"]
[Thu Nov 27 06:05:33.616274 2025] [:error] [pid 21017:tid 21068] [client 194.5.82.88:31983] [client 194.5.82.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSd5raZA663ub03MMQun_QAAAQk"]
[Thu Nov 27 06:05:34.226134 2025] [:error] [pid 6290:tid 6314] [client 194.5.82.63:41113] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Thu Nov 27 06:05:34.820226 2025] [:error] [pid 6290:tid 6312] [client 194.5.82.63:41113] [client 194.5.82.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSd5roqL4zye-zKr6suwvwAAANI"]
[Thu Nov 27 06:05:35.507630 2025] [:error] [pid 6202:tid 6243] [client 194.5.82.68:33473] [client 194.5.82.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSd5r9Ja7NTP0XPyZ6l7cgAAAEo"]
[Thu Nov 27 06:05:35.765934 2025] [:error] [pid 21017:tid 21083] [client 194.5.82.87:39101] [client 194.5.82.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSd5r6ZA663ub03MMQuoAQAAARg"]
[Thu Nov 27 06:05:36.154914 2025] [:error] [pid 6203:tid 6280] [client 194.5.82.90:48061] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Nov 27 06:05:36.320686 2025] [:error] [pid 6203:tid 6265] [client 194.5.82.90:48061] [client 194.5.82.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSd5sMbdRL7aKyrgqyzeMwAAAIU"]
[Thu Nov 27 06:05:36.675833 2025] [:error] [pid 6202:tid 6240] [client 194.5.82.86:23789] [client 194.5.82.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSd5sNJa7NTP0XPyZ6l7dAAAAEc"]
[Thu Nov 27 06:05:37.556126 2025] [:error] [pid 6203:tid 6266] [client 194.5.82.67:33063] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSd5scbdRL7aKyrgqyzeOQAAAIY"]
[Thu Nov 27 06:05:38.003400 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.95:38351] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Thu Nov 27 06:05:38.103834 2025] [:error] [pid 21017:tid 21065] [client 194.5.82.95:38351] [client 194.5.82.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSd5sqZA663ub03MMQuoBgAAAQY"]
[Thu Nov 27 06:05:38.660818 2025] [:error] [pid 6203:tid 6283] [client 194.5.82.92:43685] [client 194.5.82.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSd5ssbdRL7aKyrgqyzePQAAAJc"]
[Thu Nov 27 06:05:39.095795 2025] [:error] [pid 21017:tid 21081] [client 194.5.82.64:45681] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSd5s6ZA663ub03MMQuoCQAAARY"]
[Thu Nov 27 06:05:39.425680 2025] [:error] [pid 6290:tid 6317] [client 194.5.82.62:40485] [client 194.5.82.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSd5s4qL4zye-zKr6suwwgAAANc"]
[Thu Nov 27 06:05:39.687030 2025] [:error] [pid 6203:tid 6261] [client 194.5.82.85:42261] [client 194.5.82.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSd5s8bdRL7aKyrgqyzeQQAAAIE"]
[Thu Nov 27 06:05:40.003986 2025] [:error] [pid 21017:tid 21072] [client 194.5.82.87:29763] [client 194.5.82.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSd5tKZA663ub03MMQuoCgAAAQ0"]
[Thu Nov 27 06:05:41.138442 2025] [:error] [pid 21017:tid 21076] [client 194.5.82.60:52591] [client 194.5.82.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSd5taZA663ub03MMQuoEQAAARE"]
[Thu Nov 27 06:05:41.798739 2025] [:error] [pid 6201:tid 6216] [client 194.5.82.102:38179] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSd5tTkSJeRkIQGTjzw2NQAAAAs"]
[Thu Nov 27 06:05:42.338164 2025] [:error] [pid 21017:tid 21078] [client 194.5.82.94:36643] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Nov 27 06:05:42.489875 2025] [:error] [pid 21017:tid 21065] [client 194.5.82.94:36643] [client 194.5.82.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSd5tqZA663ub03MMQuoGAAAAQY"]
[Thu Nov 27 06:05:43.109430 2025] [:error] [pid 21017:tid 21061] [client 194.5.82.102:62135] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSd5t6ZA663ub03MMQuoHAAAAQI"]
[Thu Nov 27 06:05:43.312670 2025] [:error] [pid 21017:tid 21062] [client 194.5.82.96:42097] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Nov 27 06:05:44.073612 2025] [:error] [pid 21017:tid 21066] [client 194.5.82.96:42097] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSd5uKZA663ub03MMQuoIwAAAQc"]
[Thu Nov 27 06:05:44.433771 2025] [:error] [pid 21017:tid 21069] [client 194.5.82.102:62797] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSd5uKZA663ub03MMQuoJQAAAQo"]
[Thu Nov 27 06:05:44.824448 2025] [:error] [pid 6202:tid 6234] [client 194.5.82.104:57061] [client 194.5.82.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSd5uNJa7NTP0XPyZ6l7dgAAAEE"]
[Thu Nov 27 06:05:45.414679 2025] [:error] [pid 6290:tid 6297] [client 194.5.82.84:50023] [client 194.5.82.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSd5uYqL4zye-zKr6suw2AAAAMM"]
[Thu Nov 27 06:05:46.945398 2025] [:error] [pid 6290:tid 6301] [client 194.5.82.93:61545] [client 194.5.82.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSd5uoqL4zye-zKr6suw4wAAAMc"]
[Thu Nov 27 06:05:47.340845 2025] [:error] [pid 6202:tid 6244] [client 194.5.82.71:39283] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSd5u9Ja7NTP0XPyZ6l7eAAAAEs"]
[Thu Nov 27 06:05:48.150737 2025] [:error] [pid 6202:tid 6251] [client 194.5.82.65:59415] [client 194.5.82.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSd5vNJa7NTP0XPyZ6l7fQAAAFI"]
[Thu Nov 27 06:05:48.436025 2025] [:error] [pid 6202:tid 6257] [client 194.5.82.99:40183] [client 194.5.82.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSd5vNJa7NTP0XPyZ6l7fgAAAFg"]
[Thu Nov 27 06:05:48.872638 2025] [:error] [pid 6202:tid 6233] [client 194.5.82.73:54799] [client 194.5.82.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSd5vNJa7NTP0XPyZ6l7gQAAAEA"]
[Thu Nov 27 06:05:49.161987 2025] [:error] [pid 6202:tid 6252] [client 194.5.82.61:34341] [client 194.5.82.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSd5vdJa7NTP0XPyZ6l7ggAAAFM"]
[Thu Nov 27 06:05:49.494936 2025] [:error] [pid 6201:tid 6208] [client 194.5.82.56:21995] [client 194.5.82.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.56, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSd5vTkSJeRkIQGTjzw2NwAAAAM"]
[Thu Nov 27 06:05:49.499150 2025] [:error] [pid 6201:tid 6208] [client 194.5.82.56:21995] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Thu Nov 27 06:05:49.628386 2025] [:error] [pid 6201:tid 6227] [client 194.5.82.56:21995] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSd5vTkSJeRkIQGTjzw2OAAAABY"]
[Thu Nov 27 06:05:50.127416 2025] [:error] [pid 6290:tid 6309] [client 194.5.82.54:42653] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Nov 27 06:05:50.269363 2025] [:error] [pid 6290:tid 6300] [client 194.5.82.54:42653] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSd5voqL4zye-zKr6suw7AAAAMY"]
[Thu Nov 27 06:05:50.459625 2025] [:error] [pid 6201:tid 6225] [client 194.5.82.91:27459] [client 194.5.82.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aSd5vjkSJeRkIQGTjzw2OgAAABQ"]
[Thu Nov 27 06:05:50.683065 2025] [:error] [pid 6203:tid 6261] [client 194.5.82.67:58455] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Thu Nov 27 06:05:51.682372 2025] [:error] [pid 6203:tid 6280] [client 194.5.82.67:58455] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSd5v8bdRL7aKyrgqyzeVQAAAJQ"]
[Thu Nov 27 06:05:51.897865 2025] [:error] [pid 6202:tid 6234] [client 194.5.82.103:25951] [client 194.5.82.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSd5v9Ja7NTP0XPyZ6l7hgAAAEE"]
[Thu Nov 27 06:05:52.430999 2025] [:error] [pid 21017:tid 21074] [client 194.5.82.71:25521] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSd5wKZA663ub03MMQuoKwAAAQ8"]
[Thu Nov 27 06:05:52.848730 2025] [:error] [pid 6202:tid 6251] [client 194.5.82.85:57379] [client 194.5.82.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSd5wNJa7NTP0XPyZ6l7iQAAAFI"]
[Thu Nov 27 06:05:53.140120 2025] [:error] [pid 6290:tid 6296] [client 194.5.82.102:56413] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Thu Nov 27 06:05:53.278428 2025] [:error] [pid 6290:tid 6316] [client 194.5.82.102:56413] [client 194.5.82.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.102, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSd5wYqL4zye-zKr6suw7wAAANY"]
[Thu Nov 27 06:05:53.550495 2025] [:error] [pid 6290:tid 6298] [client 194.5.82.102:56413] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSd5wYqL4zye-zKr6suw8gAAAMQ"]
[Thu Nov 27 06:05:54.389891 2025] [:error] [pid 6202:tid 6248] [client 194.5.82.100:45445] [client 194.5.82.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSd5wtJa7NTP0XPyZ6l7kgAAAE8"]
[Thu Nov 27 06:05:54.664977 2025] [:error] [pid 6201:tid 6205] [client 194.5.82.67:63757] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Nov 27 06:05:54.830822 2025] [:error] [pid 6201:tid 6211] [client 194.5.82.67:63757] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSd5wjkSJeRkIQGTjzw2PAAAAAY"]
[Thu Nov 27 06:05:55.041347 2025] [:error] [pid 21017:tid 21061] [client 194.5.82.55:43721] [client 194.5.82.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSd5w6ZA663ub03MMQuoLQAAAQI"]
[Thu Nov 27 06:05:55.252392 2025] [:error] [pid 21017:tid 21060] [client 194.5.82.56:44829] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Thu Nov 27 06:05:55.691678 2025] [:error] [pid 21017:tid 21082] [client 194.5.82.56:44829] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSd5w6ZA663ub03MMQuoMgAAARc"]
[Thu Nov 27 06:05:56.183460 2025] [:error] [pid 21017:tid 21069] [client 194.5.82.78:63405] [client 194.5.82.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSd5xKZA663ub03MMQuoNQAAAQo"]
[Thu Nov 27 06:05:56.397658 2025] [:error] [pid 6202:tid 6241] [client 194.5.82.65:64961] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Nov 27 06:05:56.647827 2025] [:error] [pid 6202:tid 6235] [client 194.5.82.65:64961] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Nov 27 06:05:56.898873 2025] [:error] [pid 6202:tid 6249] [client 194.5.82.65:64961] [client 194.5.82.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSd5xNJa7NTP0XPyZ6l7mgAAAFA"]
[Thu Nov 27 06:05:57.093628 2025] [:error] [pid 6201:tid 6207] [client 194.5.82.63:21735] [client 194.5.82.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSd5xTkSJeRkIQGTjzw2PwAAAAI"]
[Thu Nov 27 06:05:57.449829 2025] [:error] [pid 6290:tid 6299] [client 194.5.82.168:62123] [client 194.5.82.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aSd5xYqL4zye-zKr6suw9QAAAMU"]
[Thu Nov 27 06:05:57.819127 2025] [:error] [pid 6201:tid 6210] [client 194.5.82.86:59983] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Thu Nov 27 06:05:59.932505 2025] [:error] [pid 6201:tid 6223] [client 194.5.82.86:59983] [client 194.5.82.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSd5xzkSJeRkIQGTjzw2RwAAABI"]
[Thu Nov 27 06:06:00.459145 2025] [:error] [pid 21017:tid 21077] [client 194.5.82.59:39299] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||www.aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aSd5yKZA663ub03MMQuoOQAAARI"]
[Thu Nov 27 06:06:00.854168 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.59:39299] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSd5yKZA663ub03MMQuoOgAAAQw"]
[Thu Nov 27 06:06:01.606186 2025] [:error] [pid 21017:tid 21081] [client 194.5.82.81:57679] [client 194.5.82.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSd5yaZA663ub03MMQuoPQAAARY"]
[Thu Nov 27 06:06:01.814053 2025] [:error] [pid 6203:tid 6268] [client 194.5.82.85:47389] [client 194.5.82.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSd5ycbdRL7aKyrgqyzeYAAAAIg"]
[Thu Nov 27 06:06:02.362457 2025] [:error] [pid 6203:tid 6278] [client 194.5.82.81:42117] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Nov 27 06:06:02.863294 2025] [:error] [pid 6203:tid 6263] [client 194.5.82.81:42117] [client 194.5.82.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSd5ysbdRL7aKyrgqyzeaAAAAIM"]
[Thu Nov 27 06:06:03.323282 2025] [:error] [pid 6201:tid 6215] [client 194.5.82.92:39095] [client 194.5.82.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSd5yzkSJeRkIQGTjzw2SgAAAAo"]
[Thu Nov 27 06:06:03.733882 2025] [:error] [pid 6290:tid 6318] [client 194.5.82.55:53085] [client 194.5.82.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSd5y4qL4zye-zKr6suw-gAAANg"]
[Thu Nov 27 06:06:03.929993 2025] [:error] [pid 6202:tid 6248] [client 194.5.82.72:35415] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Thu Nov 27 06:06:04.733485 2025] [:error] [pid 6202:tid 6244] [client 194.5.82.72:35415] [client 194.5.82.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSd5zNJa7NTP0XPyZ6l7pAAAAEs"]
[Thu Nov 27 06:06:05.194049 2025] [:error] [pid 6290:tid 6308] [client 194.5.82.76:63425] [client 194.5.82.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aSd5zYqL4zye-zKr6suw_AAAAM4"]
[Thu Nov 27 06:06:05.554427 2025] [:error] [pid 6290:tid 6310] [client 194.5.82.80:56653] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Nov 27 06:06:05.666057 2025] [:error] [pid 6290:tid 6312] [client 194.5.82.80:56653] [client 194.5.82.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSd5zYqL4zye-zKr6suw_gAAANI"]
[Thu Nov 27 06:06:05.883112 2025] [:error] [pid 21017:tid 21062] [client 194.5.82.69:27341] [client 194.5.82.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSd5zaZA663ub03MMQuoPwAAAQM"]
[Thu Nov 27 06:06:06.416644 2025] [:error] [pid 6202:tid 6237] [client 194.5.82.61:55999] [client 194.5.82.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSd5ztJa7NTP0XPyZ6l7pwAAAEQ"]
[Thu Nov 27 06:06:07.082766 2025] [:error] [pid 6202:tid 6243] [client 194.5.82.77:21381] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Thu Nov 27 06:06:07.203176 2025] [:error] [pid 6202:tid 6250] [client 194.5.82.77:21381] [client 194.5.82.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSd5z9Ja7NTP0XPyZ6l7rAAAAFE"]
[Thu Nov 27 06:06:07.564028 2025] [:error] [pid 6202:tid 6240] [client 194.5.82.79:22229] [client 194.5.82.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSd5z9Ja7NTP0XPyZ6l7rQAAAEc"]
[Thu Nov 27 06:06:08.576634 2025] [:error] [pid 6202:tid 6234] [client 194.5.82.86:65035] [client 194.5.82.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSd50NJa7NTP0XPyZ6l7tQAAAEE"]
[Thu Nov 27 06:06:09.232472 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.90:20061] [client 194.5.82.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSd50aZA663ub03MMQuoQgAAAQA"]
[Thu Nov 27 06:06:09.493383 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.56:60723] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Thu Nov 27 06:06:09.830527 2025] [:error] [pid 21017:tid 21083] [client 194.5.82.56:60723] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSd50aZA663ub03MMQuoRgAAARg"]
[Thu Nov 27 06:06:10.083566 2025] [:error] [pid 21017:tid 21063] [client 194.5.82.62:60491] [client 194.5.82.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSd50qZA663ub03MMQuoSAAAAQQ"]
[Thu Nov 27 06:06:11.803784 2025] [:error] [pid 6202:tid 6244] [client 194.5.82.54:49693] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSd509Ja7NTP0XPyZ6l7uAAAAEs"]
[Thu Nov 27 06:06:12.040740 2025] [:error] [pid 6290:tid 6307] [client 194.5.82.83:24119] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Thu Nov 27 06:06:12.295026 2025] [:error] [pid 6290:tid 6295] [client 194.5.82.83:24119] [client 194.5.82.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSd51IqL4zye-zKr6suxCAAAAME"]
[Thu Nov 27 06:06:12.602167 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.66:49329] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Thu Nov 27 06:06:12.892625 2025] [:error] [pid 21017:tid 21074] [client 194.5.82.66:49329] [client 194.5.82.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSd51KZA663ub03MMQuoTQAAAQ8"]
[Thu Nov 27 06:06:13.170659 2025] [:error] [pid 6203:tid 6284] [client 194.5.82.80:61655] [client 194.5.82.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSd51cbdRL7aKyrgqyzecwAAAJg"]
[Thu Nov 27 06:06:13.598633 2025] [:error] [pid 6202:tid 6235] [client 194.5.82.96:36137] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSd51dJa7NTP0XPyZ6l7ugAAAEI"]
[Thu Nov 27 06:06:13.940038 2025] [:error] [pid 21017:tid 21072] [client 194.5.82.71:63875] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSd51aZA663ub03MMQuoTwAAAQ0"]
[Thu Nov 27 06:06:14.481683 2025] [:error] [pid 6203:tid 6282] [client 194.5.82.79:59123] [client 194.5.82.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSd51sbdRL7aKyrgqyzeeAAAAJY"]
[Thu Nov 27 06:06:14.948104 2025] [:error] [pid 6203:tid 6265] [client 194.5.82.81:35333] [client 194.5.82.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSd51sbdRL7aKyrgqyzeewAAAIU"]
[Thu Nov 27 06:06:15.169393 2025] [:error] [pid 6203:tid 6273] [client 194.5.82.56:58025] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSd518bdRL7aKyrgqyzefAAAAI0"]
[Thu Nov 27 06:06:15.453073 2025] [:error] [pid 6201:tid 6211] [client 194.5.82.58:25097] [client 194.5.82.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSd51zkSJeRkIQGTjzw2TAAAAAY"]
[Thu Nov 27 06:06:16.138452 2025] [:error] [pid 6202:tid 6254] [client 194.5.82.63:60503] [client 194.5.82.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSd52NJa7NTP0XPyZ6l7vgAAAFU"]
[Thu Nov 27 06:06:16.667340 2025] [:error] [pid 6202:tid 6242] [client 194.5.82.59:27411] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSd52NJa7NTP0XPyZ6l7wQAAAEk"]
[Thu Nov 27 06:06:17.217944 2025] [:error] [pid 21017:tid 21083] [client 194.5.82.59:56055] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSd52aZA663ub03MMQuoVQAAARg"]
[Thu Nov 27 06:06:17.620667 2025] [:error] [pid 6202:tid 6246] [client 194.5.82.64:48235] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSd52dJa7NTP0XPyZ6l7wwAAAE0"]
[Thu Nov 27 06:06:19.766299 2025] [:error] [pid 6290:tid 6309] [client 194.5.82.59:61885] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Thu Nov 27 06:06:20.362656 2025] [:error] [pid 6290:tid 6307] [client 194.5.82.59:61885] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSd53IqL4zye-zKr6suxFgAAAM0"]
[Thu Nov 27 06:06:20.605299 2025] [:error] [pid 6201:tid 6207] [client 194.5.82.80:57379] [client 194.5.82.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSd53DkSJeRkIQGTjzw2TgAAAAI"]
[Thu Nov 27 06:06:21.191756 2025] [:error] [pid 6202:tid 6244] [client 194.5.82.167:26577] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Thu Nov 27 06:06:21.296129 2025] [:error] [pid 6202:tid 6256] [client 194.5.82.167:26577] [client 194.5.82.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSd53dJa7NTP0XPyZ6l7yQAAAFc"]
[Thu Nov 27 06:06:22.070324 2025] [:error] [pid 6201:tid 6229] [client 194.5.82.86:30037] [client 194.5.82.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSd53jkSJeRkIQGTjzw2VQAAABg"]
[Thu Nov 27 06:06:22.581639 2025] [:error] [pid 21017:tid 21062] [client 194.5.82.86:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Thu Nov 27 06:06:22.728118 2025] [:error] [pid 21017:tid 21079] [client 194.5.82.86:62675] [client 194.5.82.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSd53qZA663ub03MMQuoXgAAARQ"]
[Thu Nov 27 06:06:23.162845 2025] [:error] [pid 6202:tid 6249] [client 194.5.82.102:33117] [client 194.5.82.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSd539Ja7NTP0XPyZ6l7zAAAAFA"]
[Thu Nov 27 06:06:23.446687 2025] [:error] [pid 21017:tid 21070] [client 194.5.82.97:41945] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Thu Nov 27 06:06:23.614357 2025] [:error] [pid 21017:tid 21071] [client 194.5.82.97:41945] [client 194.5.82.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSd536ZA663ub03MMQuoYwAAAQw"]
[Thu Nov 27 06:06:23.977282 2025] [:error] [pid 6201:tid 6215] [client 194.5.82.83:24557] [client 194.5.82.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSd53zkSJeRkIQGTjzw2VwAAAAo"]
[Thu Nov 27 06:06:26.022305 2025] [:error] [pid 6203:tid 6270] [client 194.5.82.59:33647] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Thu Nov 27 06:06:26.134663 2025] [:error] [pid 6203:tid 6273] [client 194.5.82.59:33647] [client 194.5.82.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSd54sbdRL7aKyrgqyzekAAAAI0"]
[Thu Nov 27 06:06:26.713973 2025] [:error] [pid 21017:tid 21068] [client 194.5.82.62:61609] [client 194.5.82.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSd54qZA663ub03MMQuoaQAAAQk"]
[Thu Nov 27 06:06:27.007349 2025] [:error] [pid 6290:tid 6312] [client 194.5.82.88:27761] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Thu Nov 27 06:06:27.122060 2025] [:error] [pid 6290:tid 6308] [client 194.5.82.88:27761] [client 194.5.82.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSd544qL4zye-zKr6suxHQAAAM4"]
[Thu Nov 27 06:06:27.405525 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.60:24257] [client 194.5.82.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSd546ZA663ub03MMQuoawAAAQA"]
[Thu Nov 27 06:06:27.759007 2025] [:error] [pid 6290:tid 6313] [client 194.5.82.54:20075] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Thu Nov 27 06:06:27.985472 2025] [:error] [pid 6290:tid 6315] [client 194.5.82.54:20075] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSd544qL4zye-zKr6suxIQAAANU"]
[Thu Nov 27 06:06:28.222664 2025] [:error] [pid 6290:tid 6302] [client 194.5.82.63:65319] [client 194.5.82.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSd55IqL4zye-zKr6suxIgAAAMg"]
[Thu Nov 27 06:06:31.357540 2025] [:error] [pid 6290:tid 6310] [client 194.5.82.60:57071] [client 194.5.82.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSd554qL4zye-zKr6suxKwAAANA"]
[Thu Nov 27 06:06:31.641031 2025] [:error] [pid 6290:tid 6312] [client 194.5.82.56:58403] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSd554qL4zye-zKr6suxLAAAANI"]
[Thu Nov 27 06:06:32.183562 2025] [:error] [pid 21017:tid 21063] [client 194.5.82.71:46811] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aSd56KZA663ub03MMQuocwAAAQQ"]
[Thu Nov 27 06:06:33.580896 2025] [:error] [pid 21017:tid 21080] [client 194.5.82.71:45911] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSd56aZA663ub03MMQuofQAAARU"]
[Thu Nov 27 06:06:33.828957 2025] [:error] [pid 6290:tid 6314] [client 194.5.82.54:44737] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSd56YqL4zye-zKr6suxMgAAANQ"]
[Thu Nov 27 06:06:35.181158 2025] [:error] [pid 21017:tid 21063] [client 194.5.82.168:49815] [client 194.5.82.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aSd566ZA663ub03MMQuohgAAAQQ"]
[Thu Nov 27 06:06:36.068306 2025] [:error] [pid 21017:tid 21059] [client 194.5.82.88:57493] [client 194.5.82.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSd57KZA663ub03MMQuojgAAAQA"]
[Thu Nov 27 06:06:37.370796 2025] [:error] [pid 6203:tid 6263] [client 194.5.82.96:43815] [client 194.5.82.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aSd57cbdRL7aKyrgqyzeoQAAAIM"]
[Thu Nov 27 06:06:37.733024 2025] [:error] [pid 6203:tid 6276] [client 194.5.82.101:30891] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Thu Nov 27 06:06:37.843593 2025] [:error] [pid 6203:tid 6269] [client 194.5.82.101:30891] [client 194.5.82.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSd57cbdRL7aKyrgqyzepgAAAIk"]
[Thu Nov 27 06:06:38.148696 2025] [:error] [pid 21017:tid 21082] [client 194.5.82.89:50137] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSd57qZA663ub03MMQuooAAAARc"]
[Thu Nov 27 06:06:38.660325 2025] [:error] [pid 6290:tid 6308] [client 194.5.82.87:61617] [client 194.5.82.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aSd57oqL4zye-zKr6suxPQAAAM4"]
[Thu Nov 27 06:06:38.988791 2025] [:error] [pid 6202:tid 6245] [client 194.5.82.56:31369] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSd57tJa7NTP0XPyZ6l73gAAAEw"]
[Thu Nov 27 06:06:40.251824 2025] [:error] [pid 6290:tid 6301] [client 194.5.82.56:20549] [client 194.5.82.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aSd58IqL4zye-zKr6suxRwAAAMc"]
[Thu Nov 27 06:06:40.471975 2025] [:error] [pid 6202:tid 6236] [client 194.5.82.80:60103] [client 194.5.82.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSd58NJa7NTP0XPyZ6l74AAAAEM"]
[Thu Nov 27 06:06:41.141948 2025] [:error] [pid 6290:tid 6299] [client 194.5.82.92:33015] [client 194.5.82.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aSd58YqL4zye-zKr6suxSwAAAMU"]
[Thu Nov 27 06:06:41.467437 2025] [:error] [pid 6290:tid 6298] [client 194.5.82.70:54219] [client 194.5.82.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSd58YqL4zye-zKr6suxTQAAAMQ"]
[Thu Nov 27 06:06:41.788996 2025] [:error] [pid 6290:tid 6315] [client 194.5.82.69:26985] [client 194.5.82.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aSd58YqL4zye-zKr6suxUAAAANU"]
[Thu Nov 27 06:06:41.996901 2025] [:error] [pid 6290:tid 6313] [client 194.5.82.64:61039] [client 194.5.82.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSd58YqL4zye-zKr6suxUQAAANM"]
[Thu Nov 27 06:06:42.259925 2025] [:error] [pid 21017:tid 21077] [client 194.5.82.67:34899] [client 194.5.82.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSd58qZA663ub03MMQuovAAAARI"]
[Thu Nov 27 06:06:42.867990 2025] [:error] [pid 21017:tid 21072] [client 194.5.82.54:26501] [client 194.5.82.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSd58qZA663ub03MMQuowwAAAQ0"]
[Thu Nov 27 06:06:44.567830 2025] [:error] [pid 6203:tid 6277] [client 194.5.82.95:62133] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Thu Nov 27 06:06:44.687912 2025] [:error] [pid 6203:tid 6268] [client 194.5.82.95:62133] [client 194.5.82.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSd59MbdRL7aKyrgqyzexQAAAIg"]
[Thu Nov 27 06:06:45.160366 2025] [:error] [pid 6203:tid 6263] [client 194.5.82.92:27107] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Thu Nov 27 06:06:45.304390 2025] [:error] [pid 6203:tid 6265] [client 194.5.82.92:27107] [client 194.5.82.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSd59cbdRL7aKyrgqyzeyQAAAIU"]
[Thu Nov 27 06:06:45.546545 2025] [:error] [pid 6201:tid 6219] [client 194.5.82.89:25027] [client 194.5.82.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSd59TkSJeRkIQGTjzw2zgAAAA4"]
[Thu Nov 27 06:06:45.902822 2025] [:error] [pid 6290:tid 6306] [client 194.5.82.76:63761] [client 194.5.82.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSd59YqL4zye-zKr6suxWwAAAMw"]
[Thu Nov 27 06:06:46.791143 2025] [:error] [pid 6203:tid 6267] [client 194.5.82.80:24105] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Nov 27 06:06:47.291236 2025] [:error] [pid 6203:tid 6283] [client 194.5.82.80:24105] [client 194.5.82.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aSd598bdRL7aKyrgqyze1AAAAJc"]
[Thu Nov 27 06:06:47.797919 2025] [:error] [pid 6290:tid 6298] [client 194.5.82.69:47379] [client 194.5.82.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSd594qL4zye-zKr6suxXgAAAMQ"]
[Thu Nov 27 06:06:48.255515 2025] [:error] [pid 6202:tid 6254] [client 194.5.82.168:64917] [client 194.5.82.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aSd5-NJa7NTP0XPyZ6l76gAAAFU"]
[Thu Nov 27 06:06:48.551222 2025] [:error] [pid 6203:tid 6275] [client 194.5.82.92:47999] [client 194.5.82.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aSd5-MbdRL7aKyrgqyze1QAAAI8"]
[Thu Nov 27 06:06:48.887594 2025] [:error] [pid 6201:tid 6216] [client 194.5.82.60:37983] [client 194.5.82.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aSd5-DkSJeRkIQGTjzw21gAAAAs"]
[Thu Nov 27 13:37:22.028266 2025] [:error] [pid 4242:tid 4259] [client 104.28.244.14:61961] [client 104.28.244.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.244.14, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSfjkkupcyBxJ375CGGobgAAAQ0"]
[Thu Nov 27 13:37:22.033443 2025] [:error] [pid 4242:tid 4259] [client 104.28.244.14:61961] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Nov 27 23:24:56.438230 2025] [:error] [pid 5536:tid 5542] [client 34.73.139.208:60473] [client 34.73.139.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.139.208, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aShtSPUSQSfgGHTatIVDSgAAAcQ"]
[Thu Nov 27 23:24:56.442225 2025] [:error] [pid 5536:tid 5542] [client 34.73.139.208:60473] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Nov 27 23:24:58.879624 2025] [:error] [pid 5536:tid 5556] [client 34.73.139.208:60473] [client 34.73.139.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aShtSvUSQSfgGHTatIVDXQAAAdI"]
[Thu Nov 27 23:24:59.350516 2025] [:error] [pid 5536:tid 5552] [client 34.73.139.208:64356] [client 34.73.139.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aShtS_USQSfgGHTatIVDYgAAAc4"]
[Thu Nov 27 23:24:59.837798 2025] [:error] [pid 5447:tid 5455] [client 34.73.139.208:61394] [client 34.73.139.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aShtS-IZYIJeFQV4nEg4yAAAAUY"]
[Thu Nov 27 23:25:00.262990 2025] [:error] [pid 5536:tid 5546] [client 34.73.139.208:61791] [client 34.73.139.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aShtTPUSQSfgGHTatIVDZwAAAcg"]
[Thu Nov 27 23:25:00.762962 2025] [:error] [pid 5536:tid 5542] [client 34.73.139.208:61368] [client 34.73.139.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aShtTPUSQSfgGHTatIVDawAAAcQ"]
[Thu Nov 27 23:25:01.196285 2025] [:error] [pid 5477:tid 5501] [client 34.73.139.208:51495] [client 34.73.139.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aShtTRE-eNdvARcbXET01QAAABQ"]
[Fri Nov 28 02:34:23.819176 2025] [:error] [pid 3880:tid 3896] [client 84.54.33.138:56932] [client 84.54.33.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/home"] [unique_id "aSiZrxLsHNAClWGu1G6b7QAAAUw"]
[Fri Nov 28 02:34:24.367315 2025] [:error] [pid 3882:tid 3946] [client 84.54.33.138:64345] [client 84.54.33.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/home"] [unique_id "aSiZsOBkYoz3-AxCad_brgAAAcg"]
[Fri Nov 28 02:34:24.913433 2025] [:error] [pid 4383:tid 4393] [client 84.54.33.138:61986] [client 84.54.33.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/home"] [unique_id "aSiZsMz_GFZW1PUriwn1YwAAAEg"]
[Fri Nov 28 02:34:25.470168 2025] [:error] [pid 7472:tid 7477] [client 84.54.33.138:61847] [client 84.54.33.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/home"] [unique_id "aSiZsWPYCWD0Ofu1ZZ7HfwAAAIM"]
[Fri Nov 28 02:34:26.006990 2025] [:error] [pid 3881:tid 3911] [client 84.54.33.138:61912] [client 84.54.33.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/home"] [unique_id "aSiZshcpoSIeot8NFmRy-AAAAAA"]
[Fri Nov 28 04:35:09.432864 2025] [:error] [pid 47665:tid 47689] [client 34.26.148.126:61128] [client 34.26.148.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.148.126, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSi1_eKdGkl8FDVPT-DMlAAAANU"]
[Fri Nov 28 04:35:09.436304 2025] [:error] [pid 47665:tid 47689] [client 34.26.148.126:61128] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Nov 28 04:35:12.048404 2025] [:error] [pid 47665:tid 47688] [client 34.26.148.126:61128] [client 34.26.148.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aSi2AOKdGkl8FDVPT-DMoAAAANQ"]
[Fri Nov 28 04:35:12.548091 2025] [:error] [pid 13757:tid 13782] [client 34.26.148.126:59695] [client 34.26.148.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aSi2ALGFOJUZiUffA2ykjwAAARc"]
[Fri Nov 28 04:35:12.969988 2025] [:error] [pid 13757:tid 13777] [client 34.26.148.126:50982] [client 34.26.148.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aSi2ALGFOJUZiUffA2ykkQAAARI"]
[Fri Nov 28 04:35:13.445691 2025] [:error] [pid 47579:tid 47637] [client 34.26.148.126:61351] [client 34.26.148.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aSi2AbZNya7jtKtX3EG3WAAAAFg"]
[Fri Nov 28 04:35:13.870099 2025] [:error] [pid 47580:tid 47658] [client 34.26.148.126:54639] [client 34.26.148.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aSi2AXOiIFZHC-2Itw0R2QAAAJY"]
[Fri Nov 28 04:35:14.316831 2025] [:error] [pid 47665:tid 47690] [client 34.26.148.126:59696] [client 34.26.148.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aSi2AuKdGkl8FDVPT-DMoQAAANY"]
[Fri Nov 28 05:26:20.672361 2025] [autoindex:error] [pid 13757:tid 13759] [client 4.205.169.148:47103] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Fri Nov 28 05:26:20.926854 2025] [:error] [pid 13757:tid 13777] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/xa.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:21.378167 2025] [:error] [pid 13757:tid 13763] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.de/
[Fri Nov 28 05:26:21.589269 2025] [:error] [pid 13757:tid 13761] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://www.yahoo.com/
[Fri Nov 28 05:26:21.850815 2025] [:error] [pid 13757:tid 13760] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:22.060931 2025] [:error] [pid 13757:tid 13776] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.com/
[Fri Nov 28 05:26:22.587973 2025] [:error] [pid 13757:tid 13770] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.de/
[Fri Nov 28 05:26:22.818190 2025] [:error] [pid 13757:tid 13773] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.com/
[Fri Nov 28 05:26:24.075891 2025] [:error] [pid 13757:tid 13762] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.com/
[Fri Nov 28 05:26:24.314562 2025] [:error] [pid 13757:tid 13770] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:24.591625 2025] [:error] [pid 13757:tid 13768] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php, referer: https://www.google.com/
[Fri Nov 28 05:26:24.851624 2025] [:error] [pid 13757:tid 13777] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:25.064883 2025] [:error] [pid 13757:tid 13773] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php, referer: https://www.google.com/
[Fri Nov 28 05:26:25.466201 2025] [:error] [pid 13757:tid 13771] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:26.609239 2025] [:error] [pid 13757:tid 13760] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.yahoo.com/
[Fri Nov 28 05:26:27.041632 2025] [:error] [pid 13757:tid 13772] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:27.253736 2025] [:error] [pid 13757:tid 13775] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:27.550476 2025] [:error] [pid 13757:tid 13759] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/dex.php, referer: https://www.google.fr/
[Fri Nov 28 05:26:28.032366 2025] [:error] [pid 13757:tid 13763] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php, referer: https://www.google.co.uk/
[Fri Nov 28 05:26:28.242855 2025] [:error] [pid 13757:tid 13782] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.google.fr/
[Fri Nov 28 05:26:28.455113 2025] [:error] [pid 13757:tid 13783] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.google.fr/
[Fri Nov 28 05:26:28.672756 2025] [:error] [pid 13757:tid 13776] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:29.555791 2025] [:error] [pid 13757:tid 13779] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php, referer: https://www.google.com/
[Fri Nov 28 05:26:29.986843 2025] [:error] [pid 13757:tid 13763] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/gelay.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:30.241770 2025] [:error] [pid 13757:tid 13761] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php, referer: https://www.google.fr/
[Fri Nov 28 05:26:30.461572 2025] [:error] [pid 13757:tid 13765] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:31.105062 2025] [:error] [pid 13757:tid 13780] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.fr/
[Fri Nov 28 05:26:31.315155 2025] [:error] [pid 13757:tid 13777] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php, referer: https://www.google.fr/
[Fri Nov 28 05:26:31.998326 2025] [:error] [pid 13757:tid 13762] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:32.227339 2025] [:error] [pid 13757:tid 13764] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/index.bak.php, referer: https://www.google.co.uk/
[Fri Nov 28 05:26:32.694239 2025] [:error] [pid 13757:tid 13763] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.com/
[Fri Nov 28 05:26:32.913911 2025] [:error] [pid 13757:tid 13775] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:33.124651 2025] [:error] [pid 13757:tid 13770] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://www.google.co.uk/
[Fri Nov 28 05:26:33.375197 2025] [:error] [pid 13757:tid 13782] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.de/
[Fri Nov 28 05:26:33.602060 2025] [:error] [pid 13757:tid 13783] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:33.813641 2025] [:error] [pid 13757:tid 13776] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.google.fr/
[Fri Nov 28 05:26:34.555716 2025] [:error] [pid 13757:tid 13759] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:35.181831 2025] [:error] [pid 13757:tid 13782] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.de/
[Fri Nov 28 05:26:35.394948 2025] [:error] [pid 13757:tid 13778] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php, referer: https://www.google.de/
[Fri Nov 28 05:26:35.981850 2025] [:error] [pid 13757:tid 13766] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php, referer: https://www.yahoo.com/
[Fri Nov 28 05:26:36.206909 2025] [:error] [pid 13757:tid 13764] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php, referer: https://www.google.co.uk/
[Fri Nov 28 05:26:36.421657 2025] [:error] [pid 13757:tid 13759] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:36.662907 2025] [:error] [pid 13757:tid 13762] [client 4.205.169.148:47103] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php, referer: https://www.google.de/
[Fri Nov 28 05:26:36.873628 2025] [:error] [pid 13757:tid 13782] [client 4.205.169.148:47103] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSjCDLGFOJUZiUffA2y6qAAAARc"], referer: https://www.google.co.uk/
[Fri Nov 28 05:26:40.571734 2025] [:error] [pid 13757:tid 13782] [client 4.205.169.148:47043] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php, referer: https://www.bing.com/
[Fri Nov 28 05:26:47.768483 2025] [:error] [pid 13757:tid 13782] [client 4.205.169.148:47043] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:26:48.340416 2025] [:error] [pid 13757:tid 13759] [client 4.205.169.148:47043] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-comments.php, referer: https://www.google.co.uk/
[Fri Nov 28 05:26:48.589357 2025] [:error] [pid 13757:tid 13765] [client 4.205.169.148:47043] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php, referer: https://www.yahoo.com/
[Fri Nov 28 05:26:56.421091 2025] [:error] [pid 13757:tid 13763] [client 4.205.169.148:47043] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.de/
[Fri Nov 28 05:26:57.284544 2025] [:error] [pid 13757:tid 13780] [client 4.205.169.148:47043] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSjCIbGFOJUZiUffA2y7NAAAARU"], referer: https://duckduckgo.com/
[Fri Nov 28 05:26:59.196867 2025] [:error] [pid 47580:tid 47641] [client 4.205.169.148:47068] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "aSjCI3OiIFZHC-2Itw0jqwAAAIU"], referer: https://www.google.de/
[Fri Nov 28 05:27:00.897067 2025] [:error] [pid 47578:tid 47597] [client 4.205.169.148:47059] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSjCJNJl1B6Qt4RLuWjozQAAAA8"], referer: https://www.google.de/
[Fri Nov 28 05:27:02.760182 2025] [:error] [pid 47579:tid 47615] [client 4.205.169.148:47041] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aSjCJrZNya7jtKtX3EHGpgAAAEY"], referer: https://www.bing.com/
[Fri Nov 28 05:27:04.888406 2025] [:error] [pid 13757:tid 13770] [client 4.205.169.148:46995] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aSjCKLGFOJUZiUffA2y7QwAAAQs"], referer: https://www.bing.com/
[Fri Nov 28 05:27:06.265128 2025] [:error] [pid 13757:tid 13776] [client 4.205.169.148:47088] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSjCKrGFOJUZiUffA2y7TAAAARE"], referer: https://duckduckgo.com/
[Fri Nov 28 05:27:08.291341 2025] [:error] [pid 13757:tid 13759] [client 4.205.169.148:47042] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSjCLLGFOJUZiUffA2y7VQAAAQA"], referer: https://duckduckgo.com/
[Fri Nov 28 05:27:09.288790 2025] [:error] [pid 47580:tid 47650] [client 4.205.169.148:46987] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSjCLXOiIFZHC-2Itw0jugAAAI4"], referer: https://www.google.com/
[Fri Nov 28 05:27:12.697412 2025] [:error] [pid 47578:tid 47605] [client 4.205.169.148:47073] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSjCMNJl1B6Qt4RLuWjo5wAAABc"], referer: https://www.yahoo.com/
[Fri Nov 28 05:27:15.466796 2025] [:error] [pid 13757:tid 13774] [client 4.205.169.148:47085] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSjCM7GFOJUZiUffA2y7YgAAAQ8"], referer: https://duckduckgo.com/
[Fri Nov 28 05:27:17.833656 2025] [:error] [pid 47578:tid 47595] [client 4.205.169.148:47028] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "aSjCNdJl1B6Qt4RLuWjo8wAAAA0"], referer: https://www.google.com/
[Fri Nov 28 05:27:20.319206 2025] [:error] [pid 13757:tid 13779] [client 4.205.169.148:47058] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSjCOLGFOJUZiUffA2y7bQAAARQ"], referer: https://www.google.de/
[Fri Nov 28 05:27:21.464453 2025] [:error] [pid 47579:tid 47610] [client 4.205.169.148:47093] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSjCObZNya7jtKtX3EHGvgAAAEE"], referer: https://www.google.fr/
[Fri Nov 28 05:27:27.859541 2025] [:error] [pid 47580:tid 47654] [client 4.205.169.148:47075] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSjCP3OiIFZHC-2Itw0j3AAAAJI"], referer: https://www.google.fr/
[Fri Nov 28 05:27:29.330481 2025] [:error] [pid 13757:tid 13773] [client 4.205.169.148:47095] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSjCQbGFOJUZiUffA2y7egAAAQ4"], referer: https://www.google.de/
[Fri Nov 28 05:27:31.436053 2025] [:error] [pid 47578:tid 47585] [client 4.205.169.148:47098] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/index.php"] [unique_id "aSjCQ9Jl1B6Qt4RLuWjpBgAAAAM"], referer: https://www.bing.com/
[Fri Nov 28 05:27:32.622268 2025] [:error] [pid 47579:tid 47615] [client 4.205.169.148:47086] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSjCRLZNya7jtKtX3EHGygAAAEY"], referer: https://www.google.de/
[Fri Nov 28 05:27:34.314165 2025] [:error] [pid 47580:tid 47653] [client 4.205.169.148:47029] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSjCRnOiIFZHC-2Itw0j6AAAAJE"], referer: https://www.yahoo.com/
[Fri Nov 28 05:27:36.205483 2025] [:error] [pid 47580:tid 47633] [client 4.205.169.148:47066] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/jcrop.php"] [unique_id "aSjCSHOiIFZHC-2Itw0j7QAAAIE"], referer: https://www.google.de/
[Fri Nov 28 05:27:39.225308 2025] [:error] [pid 47665:tid 47687] [client 4.205.169.148:47084] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSjCS-KdGkl8FDVPT-DfUwAAANM"], referer: https://www.google.com/
[Fri Nov 28 05:27:40.310243 2025] [:error] [pid 47578:tid 47600] [client 4.205.169.148:47054] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSjCTNJl1B6Qt4RLuWjpEgAAABI"], referer: https://www.bing.com/
[Fri Nov 28 05:27:42.240679 2025] [:error] [pid 47665:tid 47678] [client 4.205.169.148:47063] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSjCTuKdGkl8FDVPT-DfVQAAAMo"], referer: https://www.yahoo.com/
[Fri Nov 28 05:27:43.715341 2025] [:error] [pid 47579:tid 47610] [client 4.205.169.148:46989] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSjCT7ZNya7jtKtX3EHG2AAAAEE"], referer: https://www.google.com/
[Fri Nov 28 05:27:44.520723 2025] [:error] [pid 13757:tid 13769] [client 4.205.169.148:47067] [client 4.205.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSjCULGFOJUZiUffA2y7lgAAAQo"], referer: https://www.bing.com/
[Fri Nov 28 05:27:45.080609 2025] [:error] [pid 47580:tid 47650] [client 4.205.169.148:47004] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php, referer: https://www.google.de/
[Fri Nov 28 05:27:45.295228 2025] [:error] [pid 47580:tid 47635] [client 4.205.169.148:47004] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php, referer: https://duckduckgo.com/
[Fri Nov 28 05:27:45.679516 2025] [:error] [pid 47580:tid 47659] [client 4.205.169.148:47004] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php, referer: https://www.google.com/
[Fri Nov 28 05:27:45.903687 2025] [:error] [pid 47580:tid 47652] [client 4.205.169.148:47004] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.yahoo.com/
[Fri Nov 28 05:27:46.114635 2025] [:error] [pid 47580:tid 47644] [client 4.205.169.148:47004] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.yahoo.com/
[Fri Nov 28 07:43:59.980561 2025] [:error] [pid 29396:tid 29431] [client 103.4.123.23:52492] [client 103.4.123.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSjiPw0Yvy-yE-oKQzQoqwAAAAA"]
[Fri Nov 28 07:44:00.112849 2025] [:error] [pid 29484:tid 29489] [client 103.4.123.23:60755] [client 103.4.123.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSjiQBaDa95QrZb9SFo1HwAAAIM"]
[Fri Nov 28 07:44:01.280440 2025] [:error] [pid 29397:tid 29467] [client 103.4.123.23:55325] [client 103.4.123.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSjiQVcpYcp09L_NT3bu1AAAAEk"]
[Fri Nov 28 07:44:06.434059 2025] [:error] [pid 29396:tid 29434] [client 103.4.123.23:64400] [client 103.4.123.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSjiRg0Yvy-yE-oKQzQorgAAAAM"]
[Fri Nov 28 16:58:05.846762 2025] [:error] [pid 37392:tid 37400] [client 129.212.237.19:57515] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sat Nov 29 00:05:38.248595 2025] [:error] [pid 38347:tid 38401] [client 103.167.150.158:55961] [client 103.167.150.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aSnIUl4FzQmoUx27MAm4qQAAAFg"]
[Sat Nov 29 01:23:53.834266 2025] [:error] [pid 9751:tid 9765] [client 143.198.21.6:59926] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSnaqaqNNTs_lWy2XeHnigAAAcw"]
[Sat Nov 29 01:23:54.940348 2025] [:error] [pid 9751:tid 9770] [client 143.198.21.6:45064] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSnaqqqNNTs_lWy2XeHnjQAAAdE"]
[Sat Nov 29 01:30:43.444225 2025] [:error] [pid 9654:tid 9658] [client 143.198.21.6:33540] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSncQ3wlAlfevRIdjr-rJgAAAEA"]
[Sat Nov 29 01:30:44.291615 2025] [:error] [pid 9654:tid 9676] [client 143.198.21.6:47868] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSncRHwlAlfevRIdjr-rKQAAAFI"]
[Sat Nov 29 01:32:31.755460 2025] [autoindex:error] [pid 9656:tid 9730] [client 172.161.70.172:12164] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sat Nov 29 01:32:32.021200 2025] [:error] [pid 9656:tid 9716] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/xa.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:33.226009 2025] [:error] [pid 9656:tid 9717] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.de/
[Sat Nov 29 01:32:34.134381 2025] [:error] [pid 9656:tid 9732] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:34.373748 2025] [:error] [pid 9656:tid 9720] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.fr/
[Sat Nov 29 01:32:34.616147 2025] [:error] [pid 9656:tid 9728] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:32:34.857566 2025] [:error] [pid 9656:tid 9714] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:35.468215 2025] [:error] [pid 9656:tid 9723] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:32:36.473976 2025] [:error] [pid 9656:tid 9719] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.fr/
[Sat Nov 29 01:32:36.714971 2025] [:error] [pid 9656:tid 9713] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://www.bing.com/
[Sat Nov 29 01:32:36.974246 2025] [:error] [pid 9656:tid 9712] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php, referer: https://www.bing.com/
[Sat Nov 29 01:32:37.242110 2025] [:error] [pid 9656:tid 9726] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:37.482559 2025] [:error] [pid 9656:tid 9730] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php, referer: https://www.bing.com/
[Sat Nov 29 01:32:37.760910 2025] [:error] [pid 9656:tid 9716] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:32:39.030496 2025] [:error] [pid 9656:tid 9735] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:32:39.539721 2025] [:error] [pid 9656:tid 9722] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:39.821231 2025] [:error] [pid 9656:tid 9732] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:32:40.111954 2025] [:error] [pid 9656:tid 9720] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/dex.php, referer: https://www.google.fr/
[Sat Nov 29 01:32:40.594490 2025] [:error] [pid 9656:tid 9718] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:40.841468 2025] [:error] [pid 9656:tid 9724] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:32:41.082619 2025] [:error] [pid 9656:tid 9728] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:41.509596 2025] [:error] [pid 9656:tid 9714] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:32:42.453636 2025] [:error] [pid 9656:tid 9729] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:32:42.724782 2025] [:error] [pid 9656:tid 9733] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/gelay.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:42.966406 2025] [:error] [pid 9656:tid 9715] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php, referer: https://www.google.de/
[Sat Nov 29 01:32:43.505905 2025] [:error] [pid 9656:tid 9719] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:32:43.769860 2025] [:error] [pid 9656:tid 9721] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:32:44.010286 2025] [:error] [pid 9656:tid 9713] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php, referer: https://www.google.de/
[Sat Nov 29 01:32:44.839208 2025] [:error] [pid 9656:tid 9730] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php, referer: https://www.google.de/
[Sat Nov 29 01:32:45.080845 2025] [:error] [pid 9656:tid 9716] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/index.bak.php, referer: https://www.google.com/
[Sat Nov 29 01:32:45.571797 2025] [:error] [pid 9656:tid 9717] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.de/
[Sat Nov 29 01:32:45.826018 2025] [:error] [pid 9656:tid 9736] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:32:46.092796 2025] [:error] [pid 9656:tid 9735] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://www.google.fr/
[Sat Nov 29 01:32:46.378831 2025] [:error] [pid 9656:tid 9727] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.bing.com/
[Sat Nov 29 01:32:46.658667 2025] [:error] [pid 9656:tid 9732] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php, referer: https://www.google.fr/
[Sat Nov 29 01:32:46.901858 2025] [:error] [pid 9656:tid 9720] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.bing.com/
[Sat Nov 29 01:32:47.387853 2025] [:error] [pid 9656:tid 9724] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.google.fr/
[Sat Nov 29 01:32:47.627439 2025] [:error] [pid 9656:tid 9728] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:32:47.911235 2025] [:error] [pid 9656:tid 9714] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:32:48.977321 2025] [:error] [pid 9656:tid 9734] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:32:49.218692 2025] [:error] [pid 9656:tid 9729] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php, referer: https://www.google.de/
[Sat Nov 29 01:32:49.458522 2025] [:error] [pid 9656:tid 9733] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:32:49.698173 2025] [:error] [pid 9656:tid 9715] [client 172.161.70.172:12164] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php, referer: https://www.google.de/
[Sat Nov 29 01:32:49.936764 2025] [:error] [pid 9656:tid 9719] [client 172.161.70.172:12164] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSncwY_4AfnhtHpInunRfwAAAIc"], referer: https://www.google.de/
[Sat Nov 29 01:32:51.678621 2025] [:error] [pid 9654:tid 9681] [client 172.161.70.172:12256] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php, referer: https://www.google.com/
[Sat Nov 29 01:33:00.504379 2025] [:error] [pid 9654:tid 9674] [client 172.161.70.172:12256] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php, referer: https://www.yahoo.com/
[Sat Nov 29 01:33:00.965739 2025] [:error] [pid 9654:tid 9665] [client 172.161.70.172:12256] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-comments.php, referer: https://www.google.com/
[Sat Nov 29 01:33:01.251968 2025] [:error] [pid 9654:tid 9661] [client 172.161.70.172:12256] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php, referer: https://www.google.fr/
[Sat Nov 29 01:33:09.029901 2025] [:error] [pid 9654:tid 9675] [client 172.161.70.172:12256] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://duckduckgo.com/
[Sat Nov 29 01:33:10.863676 2025] [:error] [pid 9654:tid 9679] [client 172.161.70.172:12256] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSnc1nwlAlfevRIdjr-sKwAAAFU"], referer: https://www.yahoo.com/
[Sat Nov 29 01:33:13.150823 2025] [:error] [pid 9654:tid 9672] [client 172.161.70.172:12243] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "aSnc2XwlAlfevRIdjr-sLwAAAE4"], referer: https://www.google.com/
[Sat Nov 29 01:33:15.520926 2025] [:error] [pid 9655:tid 9700] [client 172.161.70.172:12162] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSnc2006gYqtNcz_Y88mIwAAAA8"], referer: https://duckduckgo.com/
[Sat Nov 29 01:33:17.839970 2025] [:error] [pid 9655:tid 9699] [client 172.161.70.172:12163] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aSnc3U06gYqtNcz_Y88mJwAAAA4"], referer: https://duckduckgo.com/
[Sat Nov 29 01:33:22.102427 2025] [:error] [pid 9654:tid 9664] [client 172.161.70.172:12272] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aSnc4nwlAlfevRIdjr-sNwAAAEY"], referer: https://www.google.com/
[Sat Nov 29 01:33:23.445833 2025] [:error] [pid 9654:tid 9670] [client 172.161.70.172:12239] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSnc43wlAlfevRIdjr-sOgAAAEw"], referer: https://www.google.fr/
[Sat Nov 29 01:33:26.629373 2025] [:error] [pid 9751:tid 9754] [client 172.161.70.172:12247] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSnc5qqNNTs_lWy2XeHregAAAcE"], referer: https://www.google.com/
[Sat Nov 29 01:33:28.352680 2025] [:error] [pid 9656:tid 9725] [client 172.161.70.172:12172] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSnc6I_4AfnhtHpInunRqAAAAI0"], referer: https://www.google.co.uk/
[Sat Nov 29 01:33:30.886533 2025] [:error] [pid 9751:tid 9773] [client 172.161.70.172:12249] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSnc6qqNNTs_lWy2XeHrgwAAAdQ"], referer: https://www.google.fr/
[Sat Nov 29 01:33:34.050988 2025] [:error] [pid 9655:tid 9701] [client 172.161.70.172:12235] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSnc7k06gYqtNcz_Y88mNQAAABA"], referer: https://duckduckgo.com/
[Sat Nov 29 01:33:38.180376 2025] [:error] [pid 9656:tid 9719] [client 172.161.70.172:12246] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "aSnc8o_4AfnhtHpInunRtgAAAIc"], referer: https://www.google.co.uk/
[Sat Nov 29 01:33:41.640477 2025] [:error] [pid 9655:tid 9700] [client 172.161.70.172:12178] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSnc9U06gYqtNcz_Y88mOwAAAA8"], referer: https://duckduckgo.com/
[Sat Nov 29 01:33:43.273511 2025] [:error] [pid 9654:tid 9670] [client 172.161.70.172:12276] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSnc93wlAlfevRIdjr-sTQAAAEw"], referer: https://www.yahoo.com/
[Sat Nov 29 01:33:54.011843 2025] [:error] [pid 9655:tid 9702] [client 172.161.70.172:12194] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSndAk06gYqtNcz_Y88mTQAAABE"], referer: https://duckduckgo.com/
[Sat Nov 29 01:33:58.936462 2025] [:error] [pid 9656:tid 9724] [client 172.161.70.172:12270] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSndBo_4AfnhtHpInunRyAAAAIw"], referer: https://www.google.fr/
[Sat Nov 29 01:34:27.621621 2025] [:error] [pid 9654:tid 9676] [client 172.161.70.172:12269] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/index.php"] [unique_id "aSndI3wlAlfevRIdjr-skgAAAFI"], referer: https://duckduckgo.com/
[Sat Nov 29 01:34:28.568282 2025] [:error] [pid 9654:tid 9682] [client 172.161.70.172:12232] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSndJHwlAlfevRIdjr-slgAAAFg"], referer: https://www.bing.com/
[Sat Nov 29 01:34:31.161317 2025] [:error] [pid 9656:tid 9727] [client 172.161.70.172:12271] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSndJ4_4AfnhtHpInunR9AAAAI8"], referer: https://www.google.de/
[Sat Nov 29 01:34:36.191456 2025] [:error] [pid 9655:tid 9692] [client 172.161.70.172:12177] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/jcrop.php"] [unique_id "aSndLE06gYqtNcz_Y88mdAAAAAc"], referer: https://www.google.fr/
[Sat Nov 29 01:34:41.420108 2025] [:error] [pid 9655:tid 9700] [client 172.161.70.172:12275] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSndMU06gYqtNcz_Y88mfwAAAA8"], referer: https://www.google.co.uk/
[Sat Nov 29 01:34:43.944505 2025] [:error] [pid 57438:tid 57456] [client 172.161.70.172:12286] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSndM6ANc56NCdbFpjv3UwAAANA"], referer: https://www.bing.com/
[Sat Nov 29 01:34:46.441849 2025] [:error] [pid 9751:tid 9767] [client 172.161.70.172:12268] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSndNqqNNTs_lWy2XeHr5AAAAc4"], referer: https://duckduckgo.com/
[Sat Nov 29 01:34:51.701324 2025] [:error] [pid 9751:tid 9765] [client 172.161.70.172:12236] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSndO6qNNTs_lWy2XeHr8AAAAcw"], referer: https://duckduckgo.com/
[Sat Nov 29 01:34:56.227665 2025] [:error] [pid 9654:tid 9660] [client 172.161.70.172:12160] [client 172.161.70.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSndQHwlAlfevRIdjr-s0wAAAEI"], referer: https://www.google.de/
[Sat Nov 29 01:34:57.731688 2025] [:error] [pid 57438:tid 57454] [client 172.161.70.172:12251] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:34:57.977928 2025] [:error] [pid 57438:tid 57463] [client 172.161.70.172:12251] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:34:58.804895 2025] [:error] [pid 57438:tid 57460] [client 172.161.70.172:12251] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php, referer: https://www.google.fr/
[Sat Nov 29 01:34:59.075450 2025] [:error] [pid 57438:tid 57441] [client 172.161.70.172:12251] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.google.co.uk/
[Sat Nov 29 01:34:59.352844 2025] [:error] [pid 57438:tid 57449] [client 172.161.70.172:12251] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.com/
[Sat Nov 29 01:57:00.127906 2025] [:error] [pid 57438:tid 57460] [client 160.25.72.93:55042] [client 160.25.72.93] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aSnibKANc56NCdbFpjv-XAAAANQ"]
[Sat Nov 29 06:01:58.473505 2025] [:error] [pid 53818:tid 53865] [client 152.56.5.167:57980] [client 152.56.5.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.56.5.167, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSob1pY2lVKaQoKCJULIVwAAAFA"]
[Sat Nov 29 06:01:58.481472 2025] [:error] [pid 53818:tid 53865] [client 152.56.5.167:57980] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Nov 29 06:03:35.381083 2025] [:error] [pid 53818:tid 53853] [client 217.146.83.115:46416] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Nov 29 06:03:35.637645 2025] [:error] [pid 53818:tid 53850] [client 217.146.83.115:46416] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSocN5Y2lVKaQoKCJULJ1gAAAEE"]
[Sat Nov 29 06:03:36.148010 2025] [:error] [pid 19562:tid 19568] [client 217.146.83.115:46952] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSocOF4oDK0S9prYl7losAAAAQQ"]
[Sat Nov 29 06:03:36.660687 2025] [:error] [pid 22939:tid 22951] [client 217.146.83.115:47320] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSocONRbdh0p_UmbHuCIPgAAAYo"]
[Sat Nov 29 06:03:37.174324 2025] [:error] [pid 53906:tid 53929] [client 217.146.83.115:57970] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSocOZaQHRVpydtRoVcK7AAAANU"]
[Sat Nov 29 06:03:37.690429 2025] [:error] [pid 19562:tid 19566] [client 217.146.83.115:58280] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aSocOV4oDK0S9prYl7lo3wAAAQI"]
[Sat Nov 29 06:03:38.202165 2025] [:error] [pid 53906:tid 53930] [client 217.146.83.115:58638] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSocOpaQHRVpydtRoVcK-gAAANY"]
[Sat Nov 29 06:03:38.713206 2025] [:error] [pid 22280:tid 22291] [client 217.146.83.115:58960] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSocOpFKJ7cA_ndzTYs0eQAAAUk"]
[Sat Nov 29 06:03:39.225071 2025] [:error] [pid 19562:tid 19571] [client 217.146.83.115:59318] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSocO14oDK0S9prYl7lpFAAAAQc"]
[Sat Nov 29 06:03:39.738246 2025] [:error] [pid 53819:tid 53885] [client 217.146.83.115:59798] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSocO7rEG0migocqTWfAcgAAAIk"]
[Sat Nov 29 06:03:40.252502 2025] [:error] [pid 53817:tid 53825] [client 217.146.83.115:60180] [client 217.146.83.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSocPBUtaHwNb4_nTTSxVQAAAAQ"]
[Sat Nov 29 06:17:25.852804 2025] [:error] [pid 22939:tid 22942] [client 216.126.227.144:57537] File does not exist: /usr/local/apache/htdocs/suspended-page/kickstart.php
[Sat Nov 29 12:07:42.898900 2025] [:error] [pid 62619:tid 62633] [client 45.153.34.41:56076] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aSpxjtk7ZYKT63FfVSUS4QAAAUw"]
[Sat Nov 29 15:00:52.598227 2025] [:error] [pid 32136:tid 32148] [client 207.154.216.0:64277] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSqaJMSj_WSVQM1psKpY0QAAAQo"]
[Sat Nov 29 15:00:53.709083 2025] [:error] [pid 16610:tid 16623] [client 207.154.216.0:61139] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSqaJQTu2dLzNk_QISre5wAAAYs"]
[Sat Nov 29 15:00:54.216702 2025] [:error] [pid 25341:tid 25363] [client 207.154.216.0:62301] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSqaJvWK8JdN03Mg7dz7YQAAAdI"]
[Sat Nov 29 15:00:54.709780 2025] [:error] [pid 20828:tid 20902] [client 207.154.216.0:52205] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSqaJuqW2f0jLRABAORfZwAAAJE"]
[Sat Nov 29 15:00:55.229884 2025] [:error] [pid 16610:tid 16620] [client 207.154.216.0:59589] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSqaJwTu2dLzNk_QISrfBgAAAYg"]
[Sat Nov 29 15:14:20.100501 2025] [:error] [pid 20826:tid 20842] [client 213.21.239.4:50752] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/developer/.svn/wc.db"] [unique_id "aSqdTPABfBqk70vKX9SFPAAAAAw"]
[Sat Nov 29 15:14:20.100892 2025] [:error] [pid 62619:tid 62645] [client 213.21.239.4:50796] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/a/.svn/wc.db"] [unique_id "aSqdTNk7ZYKT63FfVSU2xwAAAVg"]
[Sat Nov 29 15:14:20.101346 2025] [:error] [pid 20827:tid 20882] [client 213.21.239.4:50846] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.svn/wc.db"] [unique_id "aSqdTIR9B7FcLfh1rSFuGQAAAFg"]
[Sat Nov 29 15:14:20.101628 2025] [:error] [pid 20827:tid 20867] [client 213.21.239.4:50870] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/beta/.svn/wc.db"] [unique_id "aSqdTIR9B7FcLfh1rSFuGgAAAEk"]
[Sat Nov 29 15:14:20.103362 2025] [:error] [pid 62619:tid 62641] [client 213.21.239.4:50910] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/css../.svn/wc.db"] [unique_id "aSqdTNk7ZYKT63FfVSU2yAAAAVQ"]
[Sat Nov 29 15:14:20.106075 2025] [:error] [pid 25341:tid 25365] [client 213.21.239.4:50838] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/common/.svn/wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz8zAAAAdQ"]
[Sat Nov 29 15:14:20.108480 2025] [:error] [pid 16610:tid 16630] [client 213.21.239.4:50878] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/demo/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrgjwAAAZI"]
[Sat Nov 29 15:14:20.108481 2025] [:error] [pid 16610:tid 16623] [client 213.21.239.4:50836] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/amphtml/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrgjgAAAYs"]
[Sat Nov 29 15:14:20.111350 2025] [:error] [pid 16610:tid 16633] [client 213.21.239.4:50898] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backup/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrgkAAAAZU"]
[Sat Nov 29 15:14:20.113704 2025] [:error] [pid 25341:tid 25360] [client 213.21.239.4:50900] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa../wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz8zQAAAc8"]
[Sat Nov 29 15:14:20.115604 2025] [:error] [pid 16610:tid 16612] [client 213.21.239.4:50736] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/application/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrgkQAAAYA"]
[Sat Nov 29 15:14:20.115762 2025] [:error] [pid 16610:tid 16619] [client 213.21.239.4:50782] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/cms/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrgkgAAAYc"]
[Sat Nov 29 15:14:20.117640 2025] [:error] [pid 16610:tid 16629] [client 213.21.239.4:50802] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aomanalyzer/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrgkwAAAZE"]
[Sat Nov 29 15:14:20.118242 2025] [:error] [pid 25341:tid 25351] [client 213.21.239.4:50874] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz8zgAAAcY"]
[Sat Nov 29 15:14:20.119100 2025] [:error] [pid 16610:tid 16636] [client 213.21.239.4:50816] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/content../.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrglAAAAZg"]
[Sat Nov 29 15:14:20.121967 2025] [:error] [pid 25341:tid 25346] [client 213.21.239.4:50860] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets../.svn/wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz8zwAAAcE"]
[Sat Nov 29 15:14:20.122270 2025] [:error] [pid 25341:tid 25354] [client 213.21.239.4:50750] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/dev/.svn/wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz80AAAAck"]
[Sat Nov 29 15:14:20.123365 2025] [:error] [pid 25341:tid 25368] [client 213.21.239.4:50882] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/data/.svn/wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz80QAAAdc"]
[Sat Nov 29 15:14:20.127444 2025] [:error] [pid 25341:tid 25357] [client 213.21.239.4:50746] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.svn/wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz80gAAAcw"]
[Sat Nov 29 15:14:20.129111 2025] [:error] [pid 16610:tid 16615] [client 213.21.239.4:50748] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/blog/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrglQAAAYM"]
[Sat Nov 29 15:14:20.131974 2025] [:error] [pid 16610:tid 16613] [client 213.21.239.4:50916] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/build/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrglgAAAYE"]
[Sat Nov 29 15:14:20.133301 2025] [:error] [pid 25341:tid 25353] [client 213.21.239.4:50820] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/database/.svn/wc.db"] [unique_id "aSqdTPWK8JdN03Mg7dz80wAAAcg"]
[Sat Nov 29 15:14:20.133867 2025] [:error] [pid 20826:tid 20840] [client 213.21.239.4:50890] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/AWSconf.svn/wc.db"] [unique_id "aSqdTPABfBqk70vKX9SFPQAAAAo"]
[Sat Nov 29 15:14:20.134123 2025] [:error] [pid 20915:tid 20925] [client 213.21.239.4:50810] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/blog/wp-content/themes/.svn/wc.db"] [unique_id "aSqdTFOOtKw1QZ3TPES1CwAAAMg"]
[Sat Nov 29 15:14:20.702775 2025] [:error] [pid 16610:tid 16635] [client 213.21.239.4:50884] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.svn/wc.db"] [unique_id "aSqdTATu2dLzNk_QISrglwAAAZc"]
[Sat Nov 29 15:14:23.116192 2025] [:error] [pid 32136:tid 32154] [client 207.154.216.0:56499] [client 207.154.216.0] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-json/"] [unique_id "aSqdT8Sj_WSVQM1psKpauQAAARA"]
[Sat Nov 29 15:14:23.210188 2025] [:error] [pid 25341:tid 25363] [client 213.21.239.4:54654] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db"] [unique_id "aSqdT_WK8JdN03Mg7dz85QAAAdI"]
[Sat Nov 29 15:14:23.210739 2025] [:error] [pid 62619:tid 62621] [client 213.21.239.4:54666] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/static../.svn/wc.db"] [unique_id "aSqdT9k7ZYKT63FfVSU22AAAAUA"]
[Sat Nov 29 15:14:23.213379 2025] [:error] [pid 62619:tid 62637] [client 213.21.239.4:54620] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.svn/%0Awc.db"] [unique_id "aSqdT9k7ZYKT63FfVSU22QAAAVA"]
[Sat Nov 29 15:14:23.216427 2025] [:error] [pid 16610:tid 16615] [client 213.21.239.4:54690] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/dot.svn/wc.db"] [unique_id "aSqdTwTu2dLzNk_QISrgpgAAAYM"]
[Sat Nov 29 15:14:23.218062 2025] [:error] [pid 20828:tid 20904] [client 213.21.239.4:54670] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db;"] [unique_id "aSqdT-qW2f0jLRABAORgygAAAJM"]
[Sat Nov 29 15:14:23.218557 2025] [:error] [pid 20828:tid 20908] [client 213.21.239.4:54758] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/static../.svn/wc.db"] [unique_id "aSqdT-qW2f0jLRABAORgywAAAJY"]
[Sat Nov 29 15:14:23.220942 2025] [:error] [pid 20828:tid 20886] [client 213.21.239.4:54644] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/..;/.svn/wc.db"] [unique_id "aSqdT-qW2f0jLRABAORgzAAAAIE"]
[Sat Nov 29 15:14:23.228018 2025] [:error] [pid 20827:tid 20881] [client 213.21.239.4:54726] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/;/.svn/wc.db"] [unique_id "aSqdT4R9B7FcLfh1rSFuLgAAAFc"]
[Sat Nov 29 15:14:23.229977 2025] [:error] [pid 20828:tid 20894] [client 213.21.239.4:54630] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa../.svn/wc.db"] [unique_id "aSqdT-qW2f0jLRABAORgzQAAAIk"]
[Sat Nov 29 15:14:23.233641 2025] [:error] [pid 20826:tid 20831] [client 213.21.239.4:54764] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.svn/wc.db;.."] [unique_id "aSqdT_ABfBqk70vKX9SFQwAAAAE"]
[Sat Nov 29 15:14:23.234491 2025] [:error] [pid 20826:tid 20839] [client 213.21.239.4:54760] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/flock/.svn/wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFRAAAAAk"]
[Sat Nov 29 15:14:23.236068 2025] [:error] [pid 20826:tid 20841] [client 213.21.239.4:54742] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.svn/wc.db;"] [unique_id "aSqdT_ABfBqk70vKX9SFRgAAAAs"]
[Sat Nov 29 15:14:23.238833 2025] [:error] [pid 20826:tid 20845] [client 213.21.239.4:54638] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au../wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFRwAAAA8"]
[Sat Nov 29 15:14:23.240346 2025] [:error] [pid 20826:tid 20832] [client 213.21.239.4:54684] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/.svn/wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFSAAAAAI"]
[Sat Nov 29 15:14:23.241693 2025] [:error] [pid 20826:tid 20842] [client 213.21.239.4:54704] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/events../.svn/wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFSwAAAAw"]
[Sat Nov 29 15:14:23.242152 2025] [:error] [pid 20826:tid 20830] [client 213.21.239.4:54712] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn;/wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFSQAAAAA"]
[Sat Nov 29 15:14:23.242181 2025] [:error] [pid 20826:tid 20854] [client 213.21.239.4:54680] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFSgAAABg"]
[Sat Nov 29 15:14:23.244129 2025] [:error] [pid 20827:tid 20862] [client 213.21.239.4:54796] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/..;/.svn/wc.db"] [unique_id "aSqdT4R9B7FcLfh1rSFuLwAAAEQ"]
[Sat Nov 29 15:14:23.247153 2025] [:error] [pid 20826:tid 20840] [client 213.21.239.4:54774] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa/.svn;/wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFTAAAAAo"]
[Sat Nov 29 15:14:23.248306 2025] [:error] [pid 20826:tid 20853] [client 213.21.239.4:54808] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa/;/.svn/wc.db"] [unique_id "aSqdT_ABfBqk70vKX9SFTQAAABc"]
[Sat Nov 29 15:14:23.250023 2025] [:error] [pid 20826:tid 20834] [client 213.21.239.4:54786] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db;.."] [unique_id "aSqdT_ABfBqk70vKX9SFTgAAAAQ"]
[Sat Nov 29 15:14:23.251288 2025] [:error] [pid 25341:tid 25355] [client 213.21.239.4:54788] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au../.svn/wc.db"] [unique_id "aSqdT_WK8JdN03Mg7dz86AAAAco"]
[Sat Nov 29 15:14:23.252664 2025] [:error] [pid 32136:tid 32144] [client 213.21.239.4:54824] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/%0Awc.db"] [unique_id "aSqdT8Sj_WSVQM1psKpavQAAAQY"]
[Sat Nov 29 15:14:23.259469 2025] [:error] [pid 32136:tid 32149] [client 213.21.239.4:54790] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa/wc.db"] [unique_id "aSqdT8Sj_WSVQM1psKpavwAAAQs"]
[Sat Nov 29 15:14:24.223739 2025] [:error] [pid 32136:tid 32142] [client 213.21.239.4:54828] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/%0Awc.db"] [unique_id "aSqdUMSj_WSVQM1psKpaxgAAAQQ"]
[Sat Nov 29 15:14:26.209059 2025] [:error] [pid 20828:tid 20906] [client 213.21.239.4:54832] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/images../.svn/wc.db"] [unique_id "aSqdUuqW2f0jLRABAORg1wAAAJQ"]
[Sat Nov 29 15:14:26.209332 2025] [:error] [pid 32136:tid 32147] [client 213.21.239.4:54838] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/svn/.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpaygAAAQk"]
[Sat Nov 29 15:14:26.210989 2025] [:error] [pid 20915:tid 20930] [client 213.21.239.4:54920] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/live/.svn/wc.db"] [unique_id "aSqdUlOOtKw1QZ3TPES1FQAAAM0"]
[Sat Nov 29 15:14:26.212223 2025] [:error] [pid 25341:tid 25367] [client 213.21.239.4:54924] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/__MACOSX/.svn/wc.db"] [unique_id "aSqdUvWK8JdN03Mg7dz86QAAAdY"]
[Sat Nov 29 15:14:26.214604 2025] [:error] [pid 32136:tid 32146] [client 213.21.239.4:54906] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/prod.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpaywAAAQg"]
[Sat Nov 29 15:14:26.214804 2025] [:error] [pid 25341:tid 25355] [client 213.21.239.4:55010] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/js../.svn/wc.db"] [unique_id "aSqdUvWK8JdN03Mg7dz86gAAAco"]
[Sat Nov 29 15:14:26.215608 2025] [:error] [pid 20915:tid 20927] [client 213.21.239.4:54862] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/qa/.svn/wc.db"] [unique_id "aSqdUlOOtKw1QZ3TPES1FgAAAMo"]
[Sat Nov 29 15:14:26.218234 2025] [:error] [pid 32136:tid 32141] [client 213.21.239.4:54848] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/img../.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpazAAAAQM"]
[Sat Nov 29 15:14:26.218941 2025] [:error] [pid 20915:tid 20938] [client 213.21.239.4:54876] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db;"] [unique_id "aSqdUlOOtKw1QZ3TPES1FwAAANU"]
[Sat Nov 29 15:14:26.219404 2025] [:error] [pid 25341:tid 25361] [client 213.21.239.4:54952] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/message-api/.svn/wc.db"] [unique_id "aSqdUvWK8JdN03Mg7dz86wAAAdA"]
[Sat Nov 29 15:14:26.221948 2025] [:error] [pid 25341:tid 25360] [client 213.21.239.4:54884] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db"] [unique_id "aSqdUvWK8JdN03Mg7dz87AAAAc8"]
[Sat Nov 29 15:14:26.222149 2025] [:error] [pid 32136:tid 32143] [client 213.21.239.4:54980] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpazQAAAQU"]
[Sat Nov 29 15:14:26.223179 2025] [:error] [pid 32136:tid 32158] [client 213.21.239.4:54992] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/prod/.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpazgAAARQ"]
[Sat Nov 29 15:14:26.227603 2025] [:error] [pid 25341:tid 25368] [client 213.21.239.4:55048] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.svn/wc.db"] [unique_id "aSqdUvWK8JdN03Mg7dz87QAAAdc"]
[Sat Nov 29 15:14:26.227823 2025] [:error] [pid 32136:tid 32155] [client 213.21.239.4:54892] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/old-cuburn/.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpazwAAARE"]
[Sat Nov 29 15:14:26.228039 2025] [:error] [pid 32136:tid 32151] [client 213.21.239.4:55022] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db;.."] [unique_id "aSqdUsSj_WSVQM1psKpa0AAAAQ0"]
[Sat Nov 29 15:14:26.230695 2025] [:error] [pid 25341:tid 25352] [client 213.21.239.4:54998] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/lib../.svn/wc.db"] [unique_id "aSqdUvWK8JdN03Mg7dz87gAAAcc"]
[Sat Nov 29 15:14:26.232742 2025] [:error] [pid 32136:tid 32160] [client 213.21.239.4:54938] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/media../.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpa0QAAARY"]
[Sat Nov 29 15:14:26.233071 2025] [:error] [pid 25341:tid 25354] [client 213.21.239.4:54966] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/m/.svn/wc.db"] [unique_id "aSqdUvWK8JdN03Mg7dz87wAAAck"]
[Sat Nov 29 15:14:26.235054 2025] [:error] [pid 32136:tid 32153] [client 213.21.239.4:54994] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/new/.svn/wc.db"] [unique_id "aSqdUsSj_WSVQM1psKpa0gAAAQ8"]
[Sat Nov 29 15:14:26.239311 2025] [:error] [pid 20915:tid 20935] [client 213.21.239.4:55004] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.svn/wc.db"] [unique_id "aSqdUlOOtKw1QZ3TPES1GgAAANI"]
[Sat Nov 29 15:14:26.239770 2025] [:error] [pid 20915:tid 20939] [client 213.21.239.4:55024] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/.svn;/wc.db"] [unique_id "aSqdUlOOtKw1QZ3TPES1GQAAANY"]
[Sat Nov 29 15:14:27.210736 2025] [:error] [pid 32136:tid 32141] [client 213.21.239.4:55060] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au../wc.db"] [unique_id "aSqdU8Sj_WSVQM1psKpa1AAAAQM"]
[Sat Nov 29 15:14:27.220594 2025] [:error] [pid 32136:tid 32143] [client 213.21.239.4:55072] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/wc.db"] [unique_id "aSqdU8Sj_WSVQM1psKpa1QAAAQU"]
[Sat Nov 29 15:14:29.204269 2025] [:error] [pid 32136:tid 32150] [client 213.21.239.4:55086] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/%0Awc.db"] [unique_id "aSqdVcSj_WSVQM1psKpa2gAAAQw"]
[Sat Nov 29 15:14:29.205072 2025] [:error] [pid 32136:tid 32142] [client 213.21.239.4:55080] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/wc.db"] [unique_id "aSqdVcSj_WSVQM1psKpa2QAAAQQ"]
[Sat Nov 29 15:14:29.206285 2025] [:error] [pid 32136:tid 32140] [client 213.21.239.4:55110] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db"] [unique_id "aSqdVcSj_WSVQM1psKpa2wAAAQI"]
[Sat Nov 29 15:14:29.206810 2025] [:error] [pid 32136:tid 32148] [client 213.21.239.4:55144] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/..;/.svn/wc.db"] [unique_id "aSqdVcSj_WSVQM1psKpa3AAAAQo"]
[Sat Nov 29 15:14:29.209421 2025] [:error] [pid 62619:tid 62635] [client 213.21.239.4:55198] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/s3/.svn/wc.db"] [unique_id "aSqdVdk7ZYKT63FfVSU23QAAAU4"]
[Sat Nov 29 15:14:29.210251 2025] [:error] [pid 62619:tid 62639] [client 213.21.239.4:55118] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db;"] [unique_id "aSqdVdk7ZYKT63FfVSU23gAAAVI"]
[Sat Nov 29 15:14:29.211028 2025] [:error] [pid 62619:tid 62632] [client 213.21.239.4:55192] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/repository/.svn/wc.db"] [unique_id "aSqdVdk7ZYKT63FfVSU23wAAAUs"]
[Sat Nov 29 15:14:29.213216 2025] [:error] [pid 32136:tid 32154] [client 213.21.239.4:55140] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au../.svn/wc.db"] [unique_id "aSqdVcSj_WSVQM1psKpa3QAAARA"]
[Sat Nov 29 15:14:29.215036 2025] [:error] [pid 62619:tid 62645] [client 213.21.239.4:55136] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/%0Awc.db"] [unique_id "aSqdVdk7ZYKT63FfVSU24AAAAVg"]
[Sat Nov 29 15:14:29.217563 2025] [:error] [pid 62619:tid 62631] [client 213.21.239.4:55228] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db;.."] [unique_id "aSqdVdk7ZYKT63FfVSU24QAAAUo"]
[Sat Nov 29 15:14:29.220327 2025] [:error] [pid 62619:tid 62628] [client 213.21.239.4:55184] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/repos/.svn/wc.db"] [unique_id "aSqdVdk7ZYKT63FfVSU24gAAAUc"]
[Sat Nov 29 15:14:29.220957 2025] [:error] [pid 62619:tid 62621] [client 213.21.239.4:55152] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db;"] [unique_id "aSqdVdk7ZYKT63FfVSU24wAAAUA"]
[Sat Nov 29 15:14:29.221714 2025] [:error] [pid 32136:tid 32159] [client 213.21.239.4:55154] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db;.."] [unique_id "aSqdVcSj_WSVQM1psKpa3gAAARU"]
[Sat Nov 29 15:14:29.223200 2025] [:error] [pid 25341:tid 25369] [client 213.21.239.4:55156] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.svn/wc.db"] [unique_id "aSqdVfWK8JdN03Mg7dz88AAAAdg"]
[Sat Nov 29 15:14:29.225747 2025] [:error] [pid 20827:tid 20868] [client 213.21.239.4:55174] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/;/.svn/wc.db"] [unique_id "aSqdVYR9B7FcLfh1rSFuMAAAAEo"]
[Sat Nov 29 15:14:29.227588 2025] [:error] [pid 62619:tid 62634] [client 213.21.239.4:55096] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.svn/wc.db"] [unique_id "aSqdVdk7ZYKT63FfVSU25AAAAU0"]
[Sat Nov 29 15:14:29.228403 2025] [:error] [pid 32136:tid 32144] [client 213.21.239.4:55236] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.svn/wc.db"] [unique_id "aSqdVcSj_WSVQM1psKpa3wAAAQY"]
[Sat Nov 29 15:14:29.231029 2025] [:error] [pid 16610:tid 16627] [client 213.21.239.4:55214] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/samples/.svn/wc.db"] [unique_id "aSqdVQTu2dLzNk_QISrgrAAAAY8"]
[Sat Nov 29 15:14:29.231623 2025] [:error] [pid 32136:tid 32149] [client 213.21.239.4:55120] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/.svn;/wc.db"] [unique_id "aSqdVcSj_WSVQM1psKpa4AAAAQs"]
[Sat Nov 29 15:14:29.231843 2025] [:error] [pid 20827:tid 20859] [client 213.21.239.4:55238] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db"] [unique_id "aSqdVYR9B7FcLfh1rSFuMQAAAEE"]
[Sat Nov 29 15:14:29.233211 2025] [core:error] [pid 20915:tid 20940] [client 213.21.239.4:55248] AH10244: invalid URI path (/../wc.db)
[Sat Nov 29 15:14:29.236234 2025] [:error] [pid 62619:tid 62622] [client 213.21.239.4:55182] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/static../.svn/wc.db"] [unique_id "aSqdVdk7ZYKT63FfVSU25gAAAUE"]
[Sat Nov 29 15:14:29.237995 2025] [:error] [pid 62619:tid 62637] [client 213.21.239.4:55164] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/aoswa.com.au/.svn;/wc.db"] [unique_id "aSqdVdk7ZYKT63FfVSU25QAAAVA"]
[Sat Nov 29 15:14:30.215772 2025] [:error] [pid 62619:tid 62645] [client 213.21.239.4:55256] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static../.svn/wc.db"] [unique_id "aSqdVtk7ZYKT63FfVSU26AAAAVg"]
[Sat Nov 29 15:14:30.216819 2025] [:error] [pid 32136:tid 32145] [client 213.21.239.4:55252] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/shop/.svn/wc.db"] [unique_id "aSqdVsSj_WSVQM1psKpa4QAAAQc"]
[Sat Nov 29 15:14:32.200952 2025] [:error] [pid 32136:tid 32156] [client 213.21.239.4:52132] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/site/.svn/wc.db"] [unique_id "aSqdWMSj_WSVQM1psKpa4wAAARI"]
[Sat Nov 29 15:14:32.202257 2025] [:error] [pid 32136:tid 32138] [client 213.21.239.4:52172] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/.svn/wc.db"] [unique_id "aSqdWMSj_WSVQM1psKpa5AAAAQA"]
[Sat Nov 29 15:14:32.203742 2025] [:error] [pid 20828:tid 20893] [client 213.21.239.4:52192] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wiki/.svn/wc.db"] [unique_id "aSqdWOqW2f0jLRABAORg2QAAAIg"]
[Sat Nov 29 15:14:32.206368 2025] [:error] [pid 25341:tid 25355] [client 213.21.239.4:52140] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/staging/.svn/wc.db"] [unique_id "aSqdWPWK8JdN03Mg7dz88QAAAco"]
[Sat Nov 29 15:14:32.207697 2025] [:error] [pid 32136:tid 32147] [client 213.21.239.4:52164] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/vendor/.svn/wc.db"] [unique_id "aSqdWMSj_WSVQM1psKpa5QAAAQk"]
[Sat Nov 29 15:14:32.210927 2025] [:error] [pid 32136:tid 32152] [client 213.21.239.4:52142] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/store/.svn/wc.db"] [unique_id "aSqdWMSj_WSVQM1psKpa5gAAAQ4"]
[Sat Nov 29 15:14:32.212116 2025] [:error] [pid 20828:tid 20909] [client 213.21.239.4:52116] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static../.svn/wc.db"] [unique_id "aSqdWOqW2f0jLRABAORg2gAAAJc"]
[Sat Nov 29 15:14:32.212452 2025] [:error] [pid 62619:tid 62634] [client 213.21.239.4:52204] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-content/.svn/wc.db"] [unique_id "aSqdWNk7ZYKT63FfVSU26gAAAU0"]
[Sat Nov 29 15:14:32.212773 2025] [:error] [pid 32136:tid 32157] [client 213.21.239.4:52138] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static/.svn/wc.db"] [unique_id "aSqdWMSj_WSVQM1psKpa5wAAARM"]
[Sat Nov 29 15:14:32.214658 2025] [:error] [pid 62619:tid 62622] [client 213.21.239.4:52154] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/uat/.svn/wc.db"] [unique_id "aSqdWNk7ZYKT63FfVSU26wAAAUE"]
[Sat Nov 29 15:14:32.215058 2025] [:error] [pid 20828:tid 20910] [client 213.21.239.4:52182] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/web/.svn/wc.db"] [unique_id "aSqdWOqW2f0jLRABAORg2wAAAJg"]
[Sat Nov 29 15:14:32.218316 2025] [:error] [pid 25341:tid 25361] [client 213.21.239.4:52184] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/.svn/wc.db"] [unique_id "aSqdWPWK8JdN03Mg7dz88gAAAdA"]
[Sat Nov 29 15:14:32.221257 2025] [:error] [pid 25341:tid 25360] [client 213.21.239.4:52210] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/.svn/wc.db"] [unique_id "aSqdWPWK8JdN03Mg7dz88wAAAc8"]
[Sat Nov 29 17:32:51.550449 2025] [:error] [pid 62619:tid 62643] [client 143.198.21.6:57876] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSq9w9k7ZYKT63FfVSVTXQAAAVY"]
[Sat Nov 29 17:32:54.037112 2025] [:error] [pid 16610:tid 16632] [client 143.198.21.6:52392] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSq9xgTu2dLzNk_QISrzqQAAAZQ"]
[Sat Nov 29 20:40:02.645491 2025] [:error] [pid 20828:tid 20908] [client 143.198.21.6:59516] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSrpouqW2f0jLRABAOSaiQAAAJY"]
[Sat Nov 29 20:40:04.736594 2025] [:error] [pid 20915:tid 20925] [client 143.198.21.6:50450] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSrppFOOtKw1QZ3TPET3RAAAAMg"]
[Sat Nov 29 20:40:16.637881 2025] [:error] [pid 20915:tid 20941] [client 35.93.92.11:53578] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aSrpsFOOtKw1QZ3TPET3bQAAANg"]
[Sat Nov 29 20:40:17.370959 2025] [:error] [pid 20915:tid 20938] [client 35.93.92.11:53586] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aSrpsVOOtKw1QZ3TPET3bwAAANU"]
[Sat Nov 29 20:40:18.096447 2025] [:error] [pid 20915:tid 20927] [client 35.93.92.11:53602] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.local"] [unique_id "aSrpslOOtKw1QZ3TPET3dAAAAMo"]
[Sat Nov 29 20:40:18.820718 2025] [:error] [pid 16610:tid 16633] [client 35.93.92.11:53606] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.production"] [unique_id "aSrpsgTu2dLzNk_QISoYlgAAAZU"]
[Sat Nov 29 20:40:19.557079 2025] [:error] [pid 20826:tid 20844] [client 35.93.92.11:53616] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.development"] [unique_id "aSrps_ABfBqk70vKX9TQVgAAAA4"]
[Sat Nov 29 20:40:20.286248 2025] [:error] [pid 20828:tid 20888] [client 35.93.92.11:53628] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.bak"] [unique_id "aSrptOqW2f0jLRABAOSangAAAIM"]
[Sat Nov 29 20:40:21.015147 2025] [:error] [pid 20826:tid 20833] [client 35.93.92.11:53630] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.example"] [unique_id "aSrptfABfBqk70vKX9TQWgAAAAM"]
[Sat Nov 29 20:40:28.371989 2025] [:error] [pid 20826:tid 20835] [client 35.93.92.11:47754] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/config.ini"] [unique_id "aSrpvPABfBqk70vKX9TQbgAAAAU"]
[Sat Nov 29 20:40:29.100224 2025] [:error] [pid 62619:tid 62622] [client 35.93.92.11:47760] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Nov 29 20:40:30.584655 2025] [:error] [pid 20826:tid 20848] [client 35.93.92.11:47770] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/settings"] [unique_id "aSrpvvABfBqk70vKX9TQcgAAABI"]
[Sat Nov 29 20:40:31.317480 2025] [:error] [pid 62619:tid 62637] [client 35.93.92.11:47784] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/settings.json"] [unique_id "aSrpv9k7ZYKT63FfVSV3-AAAAVA"]
[Sat Nov 29 20:40:32.052747 2025] [:error] [pid 20827:tid 20862] [client 35.93.92.11:47790] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/app.config.js"] [unique_id "aSrpwIR9B7FcLfh1rSGhcwAAAEQ"]
[Sat Nov 29 20:40:32.783478 2025] [:error] [pid 20915:tid 20936] [client 35.93.92.11:47794] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/phpinfo.php"] [unique_id "aSrpwFOOtKw1QZ3TPET3jAAAANM"]
[Sat Nov 29 20:40:33.513154 2025] [:error] [pid 20826:tid 20839] [client 35.93.92.11:47808] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aSrpwfABfBqk70vKX9TQeQAAAAk"]
[Sat Nov 29 20:40:34.239612 2025] [:error] [pid 20826:tid 20837] [client 35.93.92.11:42040] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/phpversion.php"] [unique_id "aSrpwvABfBqk70vKX9TQfQAAAAc"]
[Sat Nov 29 20:40:34.965809 2025] [:error] [pid 16610:tid 16613] [client 35.93.92.11:42042] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/test.php"] [unique_id "aSrpwgTu2dLzNk_QISoYsgAAAYE"]
[Sat Nov 29 20:40:35.698709 2025] [:error] [pid 16610:tid 16634] [client 35.93.92.11:42058] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin"] [unique_id "aSrpwwTu2dLzNk_QISoYtAAAAZY"]
[Sat Nov 29 20:40:36.430353 2025] [:error] [pid 20826:tid 20846] [client 35.93.92.11:42072] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aSrpxPABfBqk70vKX9TQgwAAABA"]
[Sat Nov 29 20:40:37.159517 2025] [:error] [pid 20915:tid 20941] [client 35.93.92.11:42084] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-config.php"] [unique_id "aSrpxVOOtKw1QZ3TPET3kwAAANg"]
[Sat Nov 29 20:40:37.894526 2025] [:error] [pid 20915:tid 20926] [client 35.93.92.11:42092] [client 35.93.92.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/composer.json"] [unique_id "aSrpxVOOtKw1QZ3TPET3lgAAAMk"]
[Sat Nov 29 20:40:38.621383 2025] [:error] [pid 32136:tid 32141] [client 35.93.92.11:42106] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.aws/config"] [unique_id "aSrpxsSj_WSVQM1psKqvHAAAAQM"]
[Sat Nov 29 20:40:39.358735 2025] [:error] [pid 16610:tid 16630] [client 35.93.92.11:42118] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.aws/credentials"] [unique_id "aSrpxwTu2dLzNk_QISoYugAAAZI"]
[Sat Nov 29 20:40:40.097194 2025] [:error] [pid 16610:tid 16629] [client 35.93.92.11:42130] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aws/config"] [unique_id "aSrpyATu2dLzNk_QISoYvAAAAZE"]
[Sat Nov 29 20:40:40.830693 2025] [:error] [pid 62619:tid 62634] [client 35.93.92.11:42138] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aws/credentials"] [unique_id "aSrpyNk7ZYKT63FfVSV3-gAAAU0"]
[Sat Nov 29 20:40:41.563010 2025] [:error] [pid 62619:tid 62645] [client 35.93.92.11:42152] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aws.json"] [unique_id "aSrpydk7ZYKT63FfVSV3_gAAAVg"]
[Sat Nov 29 20:40:42.289532 2025] [:error] [pid 20915:tid 20935] [client 35.93.92.11:42164] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/credentials"] [unique_id "aSrpylOOtKw1QZ3TPET3ogAAANI"]
[Sat Nov 29 20:40:43.026255 2025] [:error] [pid 20915:tid 20926] [client 35.93.92.11:42176] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/secrets.json"] [unique_id "aSrpy1OOtKw1QZ3TPET3pQAAAMk"]
[Sat Nov 29 20:40:43.757876 2025] [:error] [pid 62619:tid 62631] [client 35.93.92.11:42180] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/keys.js"] [unique_id "aSrpy9k7ZYKT63FfVSV4AgAAAUo"]
[Sat Nov 29 20:40:44.489297 2025] [:error] [pid 20826:tid 20845] [client 35.93.92.11:43216] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aws-keys.js"] [unique_id "aSrpzPABfBqk70vKX9TQnAAAAA8"]
[Sat Nov 29 20:40:45.221347 2025] [:error] [pid 32136:tid 32155] [client 35.93.92.11:43218] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mailgun"] [unique_id "aSrpzcSj_WSVQM1psKqvIwAAARE"]
[Sat Nov 29 20:40:45.958442 2025] [:error] [pid 20828:tid 20901] [client 35.93.92.11:43220] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mailgun.json"] [unique_id "aSrpzeqW2f0jLRABAOSarQAAAJA"]
[Sat Nov 29 20:40:46.691618 2025] [:error] [pid 32136:tid 32160] [client 35.93.92.11:43234] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mailgun/config"] [unique_id "aSrpzsSj_WSVQM1psKqvKAAAARY"]
[Sat Nov 29 20:40:47.420083 2025] [:error] [pid 20828:tid 20897] [client 35.93.92.11:43238] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mailgun.php"] [unique_id "aSrpz-qW2f0jLRABAOSasQAAAIw"]
[Sat Nov 29 20:40:48.147545 2025] [:error] [pid 37490:tid 37493] [client 35.93.92.11:43244] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sendgrid"] [unique_id "aSrp0JjG6OUSCUo6XZ1HXgAAAgE"]
[Sat Nov 29 20:40:48.881717 2025] [:error] [pid 20915:tid 20925] [client 35.93.92.11:43250] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sendgrid.json"] [unique_id "aSrp0FOOtKw1QZ3TPET3tgAAAMg"]
[Sat Nov 29 20:40:49.619477 2025] [:error] [pid 16610:tid 16625] [client 35.93.92.11:43254] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sendgrid/config"] [unique_id "aSrp0QTu2dLzNk_QISoYywAAAY0"]
[Sat Nov 29 20:40:50.350454 2025] [:error] [pid 25341:tid 25359] [client 35.93.92.11:43260] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sendgrid.php"] [unique_id "aSrp0vWK8JdN03Mg7dxV9gAAAc4"]
[Sat Nov 29 20:40:51.086488 2025] [:error] [pid 37490:tid 37510] [client 35.93.92.11:43272] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sendgrid.env"] [unique_id "aSrp05jG6OUSCUo6XZ1HYwAAAhI"]
[Sat Nov 29 20:40:51.836664 2025] [:error] [pid 20826:tid 20853] [client 35.93.92.11:43274] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brevo"] [unique_id "aSrp0_ABfBqk70vKX9TQsQAAABc"]
[Sat Nov 29 20:40:52.574740 2025] [:error] [pid 37490:tid 37503] [client 35.93.92.11:43284] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brevo.json"] [unique_id "aSrp1JjG6OUSCUo6XZ1HaQAAAgs"]
[Sat Nov 29 20:40:53.316400 2025] [:error] [pid 20826:tid 20844] [client 35.93.92.11:43292] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brevo/config"] [unique_id "aSrp1fABfBqk70vKX9TQtQAAAA4"]
[Sat Nov 29 20:40:54.050880 2025] [:error] [pid 20915:tid 20927] [client 35.93.92.11:43298] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brevo.php"] [unique_id "aSrp1lOOtKw1QZ3TPET3vwAAAMo"]
[Sat Nov 29 20:40:54.784465 2025] [:error] [pid 32136:tid 32159] [client 35.93.92.11:34612] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/php"] [unique_id "aSrp1sSj_WSVQM1psKqvNQAAARU"]
[Sat Nov 29 20:40:55.514705 2025] [:error] [pid 32136:tid 32154] [client 35.93.92.11:34614] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info"] [unique_id "aSrp18Sj_WSVQM1psKqvNgAAARA"]
[Sat Nov 29 20:40:56.244821 2025] [:error] [pid 32136:tid 32151] [client 35.93.92.11:34622] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/phpinfo"] [unique_id "aSrp2MSj_WSVQM1psKqvNwAAAQ0"]
[Sat Nov 29 20:40:56.975740 2025] [:error] [pid 32136:tid 32138] [client 35.93.92.11:34630] [client 35.93.92.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aSrp2MSj_WSVQM1psKqvOAAAAQA"]
[Sat Nov 29 21:57:47.920161 2025] [:error] [pid 20827:tid 20881] [client 45.153.34.41:55268] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aSr724R9B7FcLfh1rSGu2QAAAFc"]
[Sat Nov 29 22:42:25.628046 2025] [:error] [pid 16610:tid 16627] [client 143.198.21.6:54980] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSsGUQTu2dLzNk_QISou7wAAAY8"]
[Sat Nov 29 22:42:27.096968 2025] [:error] [pid 20827:tid 20859] [client 143.198.21.6:58266] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSsGU4R9B7FcLfh1rSG2JwAAAEE"]
[Sun Nov 30 01:11:05.450349 2025] [:error] [pid 58730:tid 58790] [client 34.211.111.168:40636] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aSspKaDQq6rwusUXQKjYvAAAABg"]
[Sun Nov 30 01:11:06.183145 2025] [:error] [pid 42162:tid 42190] [client 34.211.111.168:40646] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aSspKtePpz4Ije-_EjrrVAAAAJc"]
[Sun Nov 30 01:11:06.924771 2025] [:error] [pid 42162:tid 42177] [client 34.211.111.168:40656] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aSspKtePpz4Ije-_EjrrVgAAAIo"]
[Sun Nov 30 01:11:07.659114 2025] [:error] [pid 42164:tid 42227] [client 34.211.111.168:47370] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aSspK9ip8Nhatsq7KxzWoAAAAQU"]
[Sun Nov 30 01:11:08.390102 2025] [:error] [pid 42162:tid 42178] [client 34.211.111.168:47386] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aSspLNePpz4Ije-_EjrrXQAAAIs"]
[Sun Nov 30 01:11:09.122692 2025] [:error] [pid 42162:tid 42188] [client 34.211.111.168:47392] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aSspLdePpz4Ije-_EjrrbAAAAJU"]
[Sun Nov 30 01:11:09.861111 2025] [:error] [pid 58730:tid 58777] [client 34.211.111.168:47398] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.example"] [unique_id "aSspLaDQq6rwusUXQKjYyAAAAAw"]
[Sun Nov 30 01:11:17.235053 2025] [:error] [pid 58730:tid 58788] [client 34.211.111.168:47484] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/config.ini"] [unique_id "aSspNaDQq6rwusUXQKjY5AAAABY"]
[Sun Nov 30 01:11:17.978460 2025] [:error] [pid 42252:tid 42260] [client 34.211.111.168:52668] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Nov 30 01:11:19.455260 2025] [:error] [pid 42252:tid 42257] [client 34.211.111.168:52692] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/settings"] [unique_id "aSspN7weMxCk051n8_-w9wAAAUM"]
[Sun Nov 30 01:11:20.193677 2025] [:error] [pid 58730:tid 58770] [client 34.211.111.168:52700] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/settings.json"] [unique_id "aSspOKDQq6rwusUXQKjY9wAAAAU"]
[Sun Nov 30 01:11:20.926791 2025] [:error] [pid 29714:tid 29725] [client 34.211.111.168:52706] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app.config.js"] [unique_id "aSspOL76_KNwefuiUY9sFgAAAEk"]
[Sun Nov 30 01:11:21.658653 2025] [:error] [pid 58730:tid 58768] [client 34.211.111.168:52712] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php"] [unique_id "aSspOaDQq6rwusUXQKjZAgAAAAM"]
[Sun Nov 30 01:11:22.389217 2025] [:error] [pid 42252:tid 42259] [client 34.211.111.168:52716] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aSspOrweMxCk051n8_-w_AAAAUU"]
[Sun Nov 30 01:11:23.119082 2025] [:error] [pid 42162:tid 42184] [client 34.211.111.168:52726] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpversion.php"] [unique_id "aSspO9ePpz4Ije-_EjrrjQAAAJE"]
[Sun Nov 30 01:11:23.855177 2025] [:error] [pid 42162:tid 42177] [client 34.211.111.168:52738] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aSspO9ePpz4Ije-_EjrrjwAAAIo"]
[Sun Nov 30 01:11:24.584932 2025] [:error] [pid 29714:tid 29718] [client 34.211.111.168:52752] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin"] [unique_id "aSspPL76_KNwefuiUY9sIQAAAEI"]
[Sun Nov 30 01:11:25.309869 2025] [:error] [pid 29714:tid 29729] [client 34.211.111.168:52754] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aSspPb76_KNwefuiUY9sJQAAAE0"]
[Sun Nov 30 01:11:26.038781 2025] [:error] [pid 42162:tid 42190] [client 34.211.111.168:52758] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-config.php"] [unique_id "aSspPtePpz4Ije-_EjrrkgAAAJc"]
[Sun Nov 30 01:11:26.770610 2025] [:error] [pid 42162:tid 42181] [client 34.211.111.168:52774] [client 34.211.111.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/composer.json"] [unique_id "aSspPtePpz4Ije-_EjrrlgAAAI4"]
[Sun Nov 30 01:11:27.511838 2025] [:error] [pid 42164:tid 42244] [client 34.211.111.168:52790] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.aws/config"] [unique_id "aSspP9ip8Nhatsq7KxzWwQAAARY"]
[Sun Nov 30 01:11:28.241267 2025] [:error] [pid 42163:tid 42208] [client 34.211.111.168:34916] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.aws/credentials"] [unique_id "aSspQJnaEs-eGc51wg2MvgAAAM0"]
[Sun Nov 30 01:11:28.964999 2025] [:error] [pid 42252:tid 42274] [client 34.211.111.168:34926] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aws/config"] [unique_id "aSspQLweMxCk051n8_-xDAAAAVQ"]
[Sun Nov 30 01:11:29.695593 2025] [:error] [pid 42163:tid 42198] [client 34.211.111.168:34928] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aws/credentials"] [unique_id "aSspQZnaEs-eGc51wg2MwgAAAMM"]
[Sun Nov 30 01:11:30.421003 2025] [:error] [pid 42162:tid 42181] [client 34.211.111.168:34930] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aws.json"] [unique_id "aSspQtePpz4Ije-_EjrrowAAAI4"]
[Sun Nov 30 01:11:31.147813 2025] [:error] [pid 42164:tid 42224] [client 34.211.111.168:34944] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/credentials"] [unique_id "aSspQ9ip8Nhatsq7KxzWywAAAQI"]
[Sun Nov 30 01:11:31.878887 2025] [:error] [pid 42252:tid 42269] [client 34.211.111.168:34946] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/secrets.json"] [unique_id "aSspQ7weMxCk051n8_-xGQAAAU8"]
[Sun Nov 30 01:11:32.614844 2025] [:error] [pid 42164:tid 42234] [client 34.211.111.168:34958] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/keys.js"] [unique_id "aSspRNip8Nhatsq7KxzW0gAAAQw"]
[Sun Nov 30 01:11:33.347434 2025] [:error] [pid 42162:tid 42182] [client 34.211.111.168:34966] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aws-keys.js"] [unique_id "aSspRdePpz4Ije-_EjrrpgAAAI8"]
[Sun Nov 30 01:11:34.090134 2025] [:error] [pid 42252:tid 42261] [client 34.211.111.168:34978] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mailgun"] [unique_id "aSspRrweMxCk051n8_-xIAAAAUc"]
[Sun Nov 30 01:11:34.822710 2025] [:error] [pid 58730:tid 58778] [client 34.211.111.168:34980] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mailgun.json"] [unique_id "aSspRqDQq6rwusUXQKjZKgAAAA0"]
[Sun Nov 30 01:11:35.554796 2025] [:error] [pid 42252:tid 42273] [client 34.211.111.168:34994] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mailgun/config"] [unique_id "aSspR7weMxCk051n8_-xIgAAAVM"]
[Sun Nov 30 01:11:36.288405 2025] [:error] [pid 42163:tid 42200] [client 34.211.111.168:35004] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mailgun.php"] [unique_id "aSspSJnaEs-eGc51wg2MzQAAAMU"]
[Sun Nov 30 01:11:37.020013 2025] [:error] [pid 42163:tid 42216] [client 34.211.111.168:35006] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sendgrid"] [unique_id "aSspSZnaEs-eGc51wg2MzwAAANU"]
[Sun Nov 30 01:11:37.752261 2025] [:error] [pid 29714:tid 29738] [client 34.211.111.168:35696] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sendgrid.json"] [unique_id "aSspSb76_KNwefuiUY9sNgAAAFY"]
[Sun Nov 30 01:11:38.475855 2025] [:error] [pid 58730:tid 58773] [client 34.211.111.168:35712] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sendgrid/config"] [unique_id "aSspSqDQq6rwusUXQKjZMQAAAAg"]
[Sun Nov 30 01:11:39.205424 2025] [:error] [pid 42252:tid 42274] [client 34.211.111.168:35716] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sendgrid.php"] [unique_id "aSspS7weMxCk051n8_-xJgAAAVQ"]
[Sun Nov 30 01:11:39.937137 2025] [:error] [pid 42164:tid 42227] [client 34.211.111.168:35728] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sendgrid.env"] [unique_id "aSspS9ip8Nhatsq7KxzW2AAAAQU"]
[Sun Nov 30 01:11:40.661956 2025] [:error] [pid 58730:tid 58786] [client 34.211.111.168:35734] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brevo"] [unique_id "aSspTKDQq6rwusUXQKjZOgAAABQ"]
[Sun Nov 30 01:11:41.391483 2025] [:error] [pid 58730:tid 58775] [client 34.211.111.168:35736] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brevo.json"] [unique_id "aSspTaDQq6rwusUXQKjZQgAAAAo"]
[Sun Nov 30 01:11:42.124086 2025] [:error] [pid 42162:tid 42170] [client 34.211.111.168:35750] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brevo/config"] [unique_id "aSspTtePpz4Ije-_EjrrqwAAAIM"]
[Sun Nov 30 01:11:42.853242 2025] [:error] [pid 42162:tid 42173] [client 34.211.111.168:35752] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brevo.php"] [unique_id "aSspTtePpz4Ije-_EjrrrAAAAIY"]
[Sun Nov 30 01:11:43.584748 2025] [:error] [pid 42164:tid 42223] [client 34.211.111.168:35766] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php"] [unique_id "aSspT9ip8Nhatsq7KxzW3QAAAQE"]
[Sun Nov 30 01:11:44.317294 2025] [:error] [pid 58730:tid 58766] [client 34.211.111.168:35780] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info"] [unique_id "aSspUKDQq6rwusUXQKjZVgAAAAE"]
[Sun Nov 30 01:11:45.058238 2025] [:error] [pid 42252:tid 42256] [client 34.211.111.168:35796] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo"] [unique_id "aSspUbweMxCk051n8_-xMQAAAUI"]
[Sun Nov 30 01:11:45.784218 2025] [:error] [pid 42252:tid 42273] [client 34.211.111.168:35802] [client 34.211.111.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aSspUbweMxCk051n8_-xMwAAAVM"]
[Sun Nov 30 02:45:37.340293 2025] [:error] [pid 58730:tid 58767] [client 93.123.109.7:55894] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aSs_UaDQq6rwusUXQKjskAAAAAI"]
[Sun Nov 30 03:37:28.447583 2025] [:error] [pid 42162:tid 42170] [client 93.123.109.7:35722] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aStLeNePpz4Ije-_EjoIEgAAAIM"]
[Sun Nov 30 03:47:55.908807 2025] [:error] [pid 3598:tid 3709] [client 213.204.244.110:35040] [client 213.204.244.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.204.244.110, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aStN63Wd-S6hLNjY_b4RagAAAEg"]
[Sun Nov 30 03:47:55.914179 2025] [:error] [pid 3598:tid 3709] [client 213.204.244.110:35040] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Nov 30 04:03:12.395127 2025] [:error] [pid 6994:tid 7011] [client 143.198.21.6:45780] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aStRgHHT5RlJRaQcChW-6gAAAM8"]
[Sun Nov 30 04:03:14.587693 2025] [:error] [pid 6906:tid 6976] [client 143.198.21.6:52342] [client 143.198.21.6] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aStRgqIKvUa3opAJwtB6zAAAAIs"]
[Sun Nov 30 04:10:26.950169 2025] [:error] [pid 44997:tid 45030] [client 43.207.184.118:59676] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aStTMkEh8Lr-TH1KlcnMugAAARg"]
[Sun Nov 30 04:10:26.950384 2025] [:error] [pid 44997:tid 45025] [client 43.207.184.118:59680] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.remote"] [unique_id "aStTMkEh8Lr-TH1KlcnMuwAAARM"]
[Sun Nov 30 04:10:26.950438 2025] [:error] [pid 44997:tid 45029] [client 43.207.184.118:59678] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aStTMkEh8Lr-TH1KlcnMvAAAARc"]
[Sun Nov 30 04:10:27.159427 2025] [:error] [pid 44997:tid 45010] [client 43.207.184.118:59682] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aStTM0Eh8Lr-TH1KlcnMvgAAAQQ"]
[Sun Nov 30 04:10:27.160332 2025] [:error] [pid 44844:tid 44920] [client 43.207.184.118:59686] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aStTMxkTTwUoGl70YUDbhwAAAIU"]
[Sun Nov 30 04:10:27.160844 2025] [:error] [pid 44997:tid 45023] [client 43.207.184.118:59688] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "aStTM0Eh8Lr-TH1KlcnMvwAAARE"]
[Sun Nov 30 04:10:27.161058 2025] [:error] [pid 44844:tid 44918] [client 43.207.184.118:59684] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aStTMxkTTwUoGl70YUDbiAAAAIM"]
[Sun Nov 30 04:10:27.630212 2025] [:error] [pid 44999:tid 45046] [client 43.207.184.118:59748] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.example"] [unique_id "aStTMy9uSNEe69uZ9WRlmwAAAU0"]
[Sun Nov 30 04:10:27.630504 2025] [:error] [pid 44997:tid 45009] [client 43.207.184.118:59730] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aStTM0Eh8Lr-TH1KlcnMwgAAAQM"]
[Sun Nov 30 04:10:28.467468 2025] [:error] [pid 44999:tid 45039] [client 43.207.184.118:59814] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.sample"] [unique_id "aStTNC9uSNEe69uZ9WRlngAAAUY"]
[Sun Nov 30 04:10:29.054920 2025] [:error] [pid 44997:tid 45018] [client 43.207.184.118:59888] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aStTNUEh8Lr-TH1KlcnMwwAAAQw"]
[Sun Nov 30 04:10:29.381172 2025] [:error] [pid 44844:tid 44923] [client 43.207.184.118:60010] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aStTNRkTTwUoGl70YUDbjAAAAIg"]
[Sun Nov 30 04:10:29.802247 2025] [:error] [pid 44997:tid 45022] [client 43.207.184.118:60082] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/vendor/.env"] [unique_id "aStTNUEh8Lr-TH1KlcnMxgAAARA"]
[Sun Nov 30 04:10:29.987436 2025] [:error] [pid 44999:tid 45048] [client 43.207.184.118:60290] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/lib/.env"] [unique_id "aStTNS9uSNEe69uZ9WRloAAAAU8"]
[Sun Nov 30 04:10:30.604092 2025] [:error] [pid 44842:tid 44875] [client 43.207.184.118:60490] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/lab/.env"] [unique_id "aStTNqFM4fJabGrvKRWMJQAAABg"]
[Sun Nov 30 04:10:30.812189 2025] [:error] [pid 44997:tid 45008] [client 43.207.184.118:60612] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/cronlab/.env"] [unique_id "aStTNkEh8Lr-TH1KlcnMyQAAAQI"]
[Sun Nov 30 04:10:30.988757 2025] [:error] [pid 44997:tid 45030] [client 43.207.184.118:60764] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/cron/.env"] [unique_id "aStTNkEh8Lr-TH1KlcnMygAAARg"]
[Sun Nov 30 04:10:31.161002 2025] [:error] [pid 44997:tid 45016] [client 43.207.184.118:60940] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/.env"] [unique_id "aStTN0Eh8Lr-TH1KlcnMywAAAQo"]
[Sun Nov 30 04:10:31.702437 2025] [:error] [pid 44844:tid 44930] [client 43.207.184.118:33002] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/app/.env"] [unique_id "aStTNxkTTwUoGl70YUDbjgAAAI8"]
[Sun Nov 30 04:10:31.798446 2025] [:error] [pid 44999:tid 45040] [client 43.207.184.118:33302] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/Datavase/.env"] [unique_id "aStTNy9uSNEe69uZ9WRlpwAAAUc"]
[Sun Nov 30 04:10:32.083205 2025] [:error] [pid 44951:tid 44975] [client 43.207.184.118:33444] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/database/.env"] [unique_id "aStTOP9n-K61ohCFHy7BIwAAANY"]
[Sun Nov 30 04:10:34.059913 2025] [:error] [pid 44844:tid 44918] [client 43.207.184.118:34718] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aStTOhkTTwUoGl70YUDbkgAAAIM"]
[Sun Nov 30 04:10:34.654347 2025] [:error] [pid 44842:tid 44853] [client 43.207.184.118:34802] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.env"] [unique_id "aStTOqFM4fJabGrvKRWMKQAAAAI"]
[Sun Nov 30 04:10:35.250363 2025] [:error] [pid 44997:tid 45019] [client 43.207.184.118:35036] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "aStTO0Eh8Lr-TH1KlcnMzgAAAQ0"]
[Sun Nov 30 04:10:35.414398 2025] [:error] [pid 44997:tid 45012] [client 43.207.184.118:35038] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/apps/.env"] [unique_id "aStTO0Eh8Lr-TH1KlcnMzwAAAQY"]
[Sun Nov 30 04:10:36.130925 2025] [:error] [pid 44951:tid 44970] [client 43.207.184.118:35176] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sitemaps/.env"] [unique_id "aStTPP9n-K61ohCFHy7BLAAAANE"]
[Sun Nov 30 04:10:36.130987 2025] [:error] [pid 44997:tid 45029] [client 43.207.184.118:35174] [client 43.207.184.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/uploads/.env"] [unique_id "aStTPEEh8Lr-TH1KlcnM0QAAARc"]
[Mon Dec 01 00:49:14.310470 2025] [autoindex:error] [pid 25124:tid 25154] [client 4.241.178.142:26019] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 01 00:49:14.531092 2025] [:error] [pid 25124:tid 25177] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/xa.php, referer: https://www.google.co.uk/
[Mon Dec 01 00:49:14.765423 2025] [:error] [pid 25124:tid 25171] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.fr/
[Mon Dec 01 00:49:15.095379 2025] [:error] [pid 25124:tid 25162] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://www.google.com/
[Mon Dec 01 00:49:15.668503 2025] [:error] [pid 25124:tid 25158] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.de/
[Mon Dec 01 00:49:15.785848 2025] [:error] [pid 25124:tid 25165] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.fr/
[Mon Dec 01 00:49:15.918306 2025] [:error] [pid 25124:tid 25166] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:16.039468 2025] [:error] [pid 25124:tid 25159] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.yahoo.com/
[Mon Dec 01 00:49:16.400992 2025] [:error] [pid 25124:tid 25170] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.de/
[Mon Dec 01 00:49:16.526860 2025] [:error] [pid 25124:tid 25154] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://www.google.de/
[Mon Dec 01 00:49:16.645163 2025] [:error] [pid 25124:tid 25168] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php, referer: https://www.google.co.uk/
[Mon Dec 01 00:49:16.888169 2025] [:error] [pid 25124:tid 25171] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php, referer: https://www.yahoo.com/
[Mon Dec 01 00:49:17.009911 2025] [:error] [pid 25124:tid 25164] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php, referer: https://www.google.co.uk/
[Mon Dec 01 00:49:17.127292 2025] [:error] [pid 25124:tid 25162] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php, referer: https://www.yahoo.com/
[Mon Dec 01 00:49:18.826240 2025] [:error] [pid 25124:tid 25167] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.com/
[Mon Dec 01 00:49:19.300075 2025] [:error] [pid 25124:tid 25166] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:19.419404 2025] [:error] [pid 25124:tid 25156] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:19.538751 2025] [:error] [pid 25124:tid 25175] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/dex.php, referer: https://www.google.co.uk/
[Mon Dec 01 00:49:19.660031 2025] [:error] [pid 25124:tid 25157] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php, referer: https://www.google.fr/
[Mon Dec 01 00:49:19.789531 2025] [:error] [pid 25124:tid 25169] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:19.939547 2025] [:error] [pid 25124:tid 25172] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:20.058774 2025] [:error] [pid 25124:tid 25170] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.de/
[Mon Dec 01 00:49:20.487119 2025] [:error] [pid 25124:tid 25177] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php, referer: https://www.google.com/
[Mon Dec 01 00:49:20.606714 2025] [:error] [pid 25124:tid 25171] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/gelay.php, referer: https://www.google.com/
[Mon Dec 01 00:49:20.820899 2025] [:error] [pid 25124:tid 25162] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php, referer: https://www.google.com/
[Mon Dec 01 00:49:20.938962 2025] [:error] [pid 25124:tid 25176] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php, referer: https://www.google.fr/
[Mon Dec 01 00:49:21.056069 2025] [:error] [pid 25124:tid 25161] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://duckduckgo.com/
[Mon Dec 01 00:49:21.173084 2025] [:error] [pid 25124:tid 25167] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:22.121966 2025] [:error] [pid 25124:tid 25169] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php, referer: https://www.google.de/
[Mon Dec 01 00:49:22.238862 2025] [:error] [pid 25124:tid 25172] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/index.bak.php, referer: https://www.google.de/
[Mon Dec 01 00:49:22.473809 2025] [:error] [pid 25124:tid 25153] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:22.615388 2025] [:error] [pid 25124:tid 25154] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php, referer: https://www.google.com/
[Mon Dec 01 00:49:22.792366 2025] [:error] [pid 25124:tid 25177] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://www.google.co.uk/
[Mon Dec 01 00:49:22.910830 2025] [:error] [pid 25124:tid 25168] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.de/
[Mon Dec 01 00:49:23.158058 2025] [:error] [pid 25124:tid 25164] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php, referer: https://www.google.com/
[Mon Dec 01 00:49:23.277785 2025] [:error] [pid 25124:tid 25171] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://duckduckgo.com/
[Mon Dec 01 00:49:23.662669 2025] [:error] [pid 25124:tid 25162] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:23.829734 2025] [:error] [pid 25124:tid 25161] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.de/
[Mon Dec 01 00:49:23.950134 2025] [:error] [pid 25124:tid 25174] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php, referer: https://www.yahoo.com/
[Mon Dec 01 00:49:24.183310 2025] [:error] [pid 25124:tid 25155] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php, referer: https://www.google.co.uk/
[Mon Dec 01 00:49:24.302777 2025] [:error] [pid 25124:tid 25160] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php, referer: https://www.google.de/
[Mon Dec 01 00:49:24.423062 2025] [:error] [pid 25124:tid 25159] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php, referer: https://www.bing.com/
[Mon Dec 01 00:49:24.669507 2025] [:error] [pid 25124:tid 25169] [client 4.241.178.142:26019] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php, referer: https://www.google.de/
[Mon Dec 01 00:49:24.794201 2025] [:error] [pid 25124:tid 25172] [client 4.241.178.142:26019] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSx1lFl826mNLYSD9-2xCQAAAFM"], referer: https://www.google.com/
[Mon Dec 01 00:49:25.500955 2025] [:error] [pid 32611:tid 32622] [client 4.241.178.142:26013] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php, referer: https://www.google.co.uk/
[Mon Dec 01 00:49:29.159449 2025] [:error] [pid 32611:tid 32616] [client 4.241.178.142:26013] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php, referer: https://www.google.com/
[Mon Dec 01 00:49:29.276678 2025] [:error] [pid 32611:tid 32621] [client 4.241.178.142:26013] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-comments.php, referer: https://www.google.fr/
[Mon Dec 01 00:49:29.512152 2025] [:error] [pid 32611:tid 32615] [client 4.241.178.142:26013] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php, referer: https://www.yahoo.com/
[Mon Dec 01 00:49:33.701723 2025] [:error] [pid 32611:tid 32622] [client 4.241.178.142:26013] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.com/
[Mon Dec 01 00:49:34.057646 2025] [:error] [pid 32611:tid 32615] [client 4.241.178.142:26013] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSx1nq_aT7PlMcEPLmkMdwAAAAI"], referer: https://www.google.fr/
[Mon Dec 01 00:49:34.664069 2025] [:error] [pid 32520:tid 32526] [client 4.241.178.142:26026] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "aSx1nvvbCMB_T-u6uxk5LAAAA4E"], referer: https://www.google.fr/
[Mon Dec 01 00:49:35.955504 2025] [:error] [pid 32611:tid 32627] [client 4.241.178.142:26031] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSx1n6_aT7PlMcEPLmkMigAAAA4"], referer: https://www.google.fr/
[Mon Dec 01 00:49:37.979326 2025] [:error] [pid 32521:tid 32560] [client 4.241.178.142:26040] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aSx1oT-OXioBrWvHoPqntQAAAwg"], referer: https://www.google.co.uk/
[Mon Dec 01 00:49:38.484283 2025] [:error] [pid 32611:tid 32624] [client 4.241.178.142:26036] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aSx1oq_aT7PlMcEPLmkMnQAAAAs"], referer: https://duckduckgo.com/
[Mon Dec 01 00:49:41.185416 2025] [:error] [pid 32521:tid 32572] [client 4.241.178.142:26003] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSx1pT-OXioBrWvHoPqnvAAAAxQ"], referer: https://www.bing.com/
[Mon Dec 01 00:49:43.431226 2025] [:error] [pid 32521:tid 32558] [client 4.241.178.142:26063] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSx1pz-OXioBrWvHoPqnygAAAwY"], referer: https://www.google.co.uk/
[Mon Dec 01 00:49:44.033926 2025] [:error] [pid 32520:tid 32538] [client 4.241.178.142:26053] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSx1qPvbCMB_T-u6uxk5TgAAA40"], referer: https://www.google.fr/
[Mon Dec 01 00:49:44.589875 2025] [:error] [pid 32522:tid 32586] [client 4.241.178.142:26032] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSx1qCY5g6U7AgYu2cKirwAAAMc"], referer: https://duckduckgo.com/
[Mon Dec 01 00:49:44.880994 2025] [:error] [pid 32522:tid 32584] [client 4.241.178.142:26033] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSx1qCY5g6U7AgYu2cKisgAAAMU"], referer: https://www.yahoo.com/
[Mon Dec 01 00:49:45.857207 2025] [:error] [pid 25124:tid 25155] [client 4.241.178.142:26050] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "aSx1qVl826mNLYSD9-2xPQAAAEI"], referer: https://duckduckgo.com/
[Mon Dec 01 00:49:46.433985 2025] [:error] [pid 32521:tid 32574] [client 4.241.178.142:26059] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSx1qj-OXioBrWvHoPqn0AAAAxY"], referer: https://www.google.de/
[Mon Dec 01 00:49:48.286445 2025] [:error] [pid 32520:tid 32535] [client 4.241.178.142:25985] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSx1rPvbCMB_T-u6uxk5YAAAA4o"], referer: https://www.google.fr/
[Mon Dec 01 00:49:52.498513 2025] [:error] [pid 32522:tid 32580] [client 4.241.178.142:25793] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSx1sCY5g6U7AgYu2cKi9wAAAME"], referer: https://www.google.com/
[Mon Dec 01 00:49:53.058186 2025] [:error] [pid 32520:tid 32538] [client 4.241.178.142:26049] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSx1sfvbCMB_T-u6uxk5fAAAA40"], referer: https://www.bing.com/
[Mon Dec 01 00:49:53.977220 2025] [:error] [pid 32520:tid 32534] [client 4.241.178.142:26067] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/index.php"] [unique_id "aSx1sfvbCMB_T-u6uxk5ggAAA4k"], referer: https://www.bing.com/
[Mon Dec 01 00:49:55.060356 2025] [:error] [pid 32521:tid 32568] [client 4.241.178.142:26038] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSx1sz-OXioBrWvHoPqn8AAAAxA"], referer: https://www.google.fr/
[Mon Dec 01 00:49:56.282488 2025] [:error] [pid 32521:tid 32567] [client 4.241.178.142:25799] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSx1tD-OXioBrWvHoPqn-QAAAw8"], referer: https://www.google.fr/
[Mon Dec 01 00:49:56.920637 2025] [:error] [pid 32522:tid 32587] [client 4.241.178.142:26004] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/jcrop.php"] [unique_id "aSx1tCY5g6U7AgYu2cKjBwAAAMg"], referer: https://duckduckgo.com/
[Mon Dec 01 00:49:59.286232 2025] [:error] [pid 32522:tid 32600] [client 4.241.178.142:26017] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSx1tyY5g6U7AgYu2cKjJgAAANU"], referer: https://www.google.co.uk/
[Mon Dec 01 00:50:00.132658 2025] [:error] [pid 25124:tid 25160] [client 4.241.178.142:26068] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSx1uFl826mNLYSD9-2xaAAAAEc"], referer: https://www.google.fr/
[Mon Dec 01 00:50:00.759437 2025] [:error] [pid 32520:tid 32548] [client 4.241.178.142:26035] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSx1uPvbCMB_T-u6uxk5oQAAA5c"], referer: https://www.google.com/
[Mon Dec 01 00:50:01.163399 2025] [:error] [pid 32611:tid 32626] [client 4.241.178.142:25994] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSx1ua_aT7PlMcEPLmkMxgAAAA0"], referer: https://www.bing.com/
[Mon Dec 01 00:50:01.664673 2025] [:error] [pid 32521:tid 32558] [client 4.241.178.142:26037] [client 4.241.178.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSx1uT-OXioBrWvHoPqoCgAAAwY"], referer: https://www.google.com/
[Mon Dec 01 00:50:01.932630 2025] [:error] [pid 32522:tid 32588] [client 4.241.178.142:26047] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php, referer: https://www.bing.com/
[Mon Dec 01 00:50:02.051072 2025] [:error] [pid 32522:tid 32602] [client 4.241.178.142:26047] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php, referer: https://duckduckgo.com/
[Mon Dec 01 00:50:02.186227 2025] [:error] [pid 32522:tid 32587] [client 4.241.178.142:26047] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php, referer: https://www.google.fr/
[Mon Dec 01 00:50:02.339936 2025] [:error] [pid 32522:tid 32601] [client 4.241.178.142:26047] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.bing.com/
[Mon Dec 01 00:50:02.560252 2025] [:error] [pid 32522:tid 32599] [client 4.241.178.142:26047] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.de/
[Mon Dec 01 02:37:19.128784 2025] [:error] [pid 32522:tid 32587] [client 103.65.237.153:53783] [client 103.65.237.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aSyO3yY5g6U7AgYu2cLDLgAAAMg"]
[Mon Dec 01 02:37:19.386760 2025] [:error] [pid 32520:tid 32544] [client 103.65.237.153:53807] [client 103.65.237.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aSyO3_vbCMB_T-u6uxlbVAAAA5M"]
[Mon Dec 01 04:18:27.848171 2025] [:error] [pid 38740:tid 38786] [client 49.145.237.52:9715] [client 49.145.237.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.237.52, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aSymk3hJ8D5KZ4hRdTUjWAAAAE0"]
[Mon Dec 01 04:18:27.852898 2025] [:error] [pid 38740:tid 38786] [client 49.145.237.52:9715] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Dec 01 20:00:28.442615 2025] [:error] [pid 3343:tid 3348] [client 48.210.70.5:20428] [client 48.210.70.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aS2DXLLh6htIpruGDDnTKAAAAAM"]
[Mon Dec 01 20:00:28.926067 2025] [:error] [pid 3247:tid 3280] [client 48.210.70.5:50380] [client 48.210.70.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aS2DXCMO2n3Q0MZfETI4CAAAAMQ"]
[Mon Dec 01 20:00:29.407184 2025] [:error] [pid 3246:tid 3271] [client 48.210.70.5:20375] [client 48.210.70.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aS2DXVkT8fezoNl7qjeCawAAAFY"]
[Mon Dec 01 20:00:29.914370 2025] [:error] [pid 3247:tid 3281] [client 48.210.70.5:50398] [client 48.210.70.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aS2DXSMO2n3Q0MZfETI4DQAAAMU"]
[Tue Dec 02 00:13:23.622966 2025] [:error] [pid 18735:tid 18771] [client 213.21.239.4:60062] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/build/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M6wAAAQc"]
[Tue Dec 02 00:13:23.623337 2025] [:error] [pid 18735:tid 18772] [client 213.21.239.4:60144] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/database/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M7AAAAQg"]
[Tue Dec 02 00:13:23.652162 2025] [:error] [pid 18735:tid 18780] [client 213.21.239.4:60246] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/a/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M7QAAARA"]
[Tue Dec 02 00:13:23.654783 2025] [:error] [pid 18735:tid 18775] [client 213.21.239.4:60092] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/cms/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M7gAAAQs"]
[Tue Dec 02 00:13:23.655079 2025] [:error] [pid 18797:tid 18811] [client 213.21.239.4:60094] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/demo/.svn/wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5JAAAAYw"]
[Tue Dec 02 00:13:23.655883 2025] [:error] [pid 18797:tid 18799] [client 213.21.239.4:60276] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/backup/.svn/wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5JQAAAYA"]
[Tue Dec 02 00:13:23.655951 2025] [:error] [pid 18735:tid 18773] [client 213.21.239.4:60286] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/common/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M7wAAAQk"]
[Tue Dec 02 00:13:23.656897 2025] [:error] [pid 18735:tid 18788] [client 213.21.239.4:60186] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/blog/wp-content/themes/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M8AAAARg"]
[Tue Dec 02 00:13:23.657684 2025] [:error] [pid 18735:tid 18787] [client 213.21.239.4:60172] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/content../.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M8QAAARc"]
[Tue Dec 02 00:13:23.657800 2025] [:error] [pid 18797:tid 18815] [client 213.21.239.4:60238] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/amphtml/.svn/wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5JwAAAZA"]
[Tue Dec 02 00:13:23.659110 2025] [:error] [pid 18797:tid 18822] [client 213.21.239.4:60078] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/aoswa../wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5JgAAAZc"]
[Tue Dec 02 00:13:23.660430 2025] [:error] [pid 18797:tid 18814] [client 213.21.239.4:60212] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/css../.svn/wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5KAAAAY8"]
[Tue Dec 02 00:13:23.661108 2025] [:error] [pid 18797:tid 18810] [client 213.21.239.4:60298] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/application/.svn/wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5KQAAAYs"]
[Tue Dec 02 00:13:23.661425 2025] [:error] [pid 18797:tid 18812] [client 213.21.239.4:60118] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/blog/.svn/wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5KgAAAY0"]
[Tue Dec 02 00:13:23.661448 2025] [:error] [pid 18735:tid 18778] [client 213.21.239.4:60184] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/api/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M8gAAAQ4"]
[Tue Dec 02 00:13:23.661860 2025] [:error] [pid 18734:tid 18748] [client 213.21.239.4:60066] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aomanalyzer/.svn/wc.db"] [unique_id "aS2-oxDodp5NNlEyq_Db0AAAAEs"]
[Tue Dec 02 00:13:23.662429 2025] [:error] [pid 18734:tid 18750] [client 213.21.239.4:60096] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/beta/.svn/wc.db"] [unique_id "aS2-oxDodp5NNlEyq_Db0QAAAE0"]
[Tue Dec 02 00:13:23.662620 2025] [:error] [pid 18734:tid 18741] [client 213.21.239.4:60104] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/data/.svn/wc.db"] [unique_id "aS2-oxDodp5NNlEyq_Db0gAAAEQ"]
[Tue Dec 02 00:13:23.663524 2025] [:error] [pid 18734:tid 18744] [client 213.21.239.4:60102] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/developer/.svn/wc.db"] [unique_id "aS2-oxDodp5NNlEyq_Db0wAAAEc"]
[Tue Dec 02 00:13:23.664584 2025] [:error] [pid 18826:tid 18830] [client 213.21.239.4:60260] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/wc.db"] [unique_id "aS2-o844B8ytyS-T2IiF_wAAAII"]
[Tue Dec 02 00:13:23.666375 2025] [:error] [pid 18735:tid 18765] [client 213.21.239.4:60128] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/dev/.svn/wc.db"] [unique_id "aS2-oyObBdpXdl5ZEt_M8wAAAQE"]
[Tue Dec 02 00:13:23.669783 2025] [:error] [pid 18826:tid 18829] [client 213.21.239.4:60256] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/AWSconf.svn/wc.db"] [unique_id "aS2-o844B8ytyS-T2IiGAAAAAIE"]
[Tue Dec 02 00:13:23.678399 2025] [:error] [pid 18826:tid 18852] [client 213.21.239.4:60160] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/app/.svn/wc.db"] [unique_id "aS2-o844B8ytyS-T2IiGAQAAAJg"]
[Tue Dec 02 00:13:23.678835 2025] [:error] [pid 18797:tid 18821] [client 213.21.239.4:60226] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/assets../.svn/wc.db"] [unique_id "aS2-o3wDQfILaZGBrIw5KwAAAZY"]
[Tue Dec 02 00:13:23.680235 2025] [:error] [pid 18734:tid 18746] [client 213.21.239.4:60134] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/admin/.svn/wc.db"] [unique_id "aS2-oxDodp5NNlEyq_Db1AAAAEk"]
[Tue Dec 02 00:13:26.388739 2025] [:error] [pid 18826:tid 18850] [client 213.21.239.4:60388] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.svn/wc.db"] [unique_id "aS2-ps44B8ytyS-T2IiGAwAAAJY"]
[Tue Dec 02 00:13:26.389017 2025] [:error] [pid 18797:tid 18810] [client 213.21.239.4:60428] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/;/.svn/wc.db"] [unique_id "aS2-pnwDQfILaZGBrIw5MgAAAYs"]
[Tue Dec 02 00:13:26.389371 2025] [:error] [pid 18826:tid 18842] [client 213.21.239.4:60424] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.svn/wc.db"] [unique_id "aS2-ps44B8ytyS-T2IiGBAAAAI4"]
[Tue Dec 02 00:13:26.390386 2025] [:error] [pid 18797:tid 18812] [client 213.21.239.4:60450] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.svn/%0Awc.db"] [unique_id "aS2-pnwDQfILaZGBrIw5MwAAAY0"]
[Tue Dec 02 00:13:26.392039 2025] [:error] [pid 18797:tid 18823] [client 213.21.239.4:60494] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/flock/.svn/wc.db"] [unique_id "aS2-pnwDQfILaZGBrIw5NAAAAZg"]
[Tue Dec 02 00:13:26.395895 2025] [:error] [pid 18797:tid 18821] [client 213.21.239.4:60330] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa../.svn/wc.db"] [unique_id "aS2-pnwDQfILaZGBrIw5NQAAAZY"]
[Tue Dec 02 00:13:26.398454 2025] [:error] [pid 18797:tid 18817] [client 213.21.239.4:60416] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/..;/.svn/wc.db"] [unique_id "aS2-pnwDQfILaZGBrIw5NgAAAZI"]
[Tue Dec 02 00:13:26.399011 2025] [:error] [pid 18826:tid 18834] [client 213.21.239.4:60310] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/events../.svn/wc.db"] [unique_id "aS2-ps44B8ytyS-T2IiGBQAAAIY"]
[Tue Dec 02 00:13:26.402039 2025] [:error] [pid 18734:tid 18753] [client 213.21.239.4:60456] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.svn;/wc.db"] [unique_id "aS2-phDodp5NNlEyq_Db2QAAAFA"]
[Tue Dec 02 00:13:26.402134 2025] [:error] [pid 18797:tid 18802] [client 213.21.239.4:60370] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/..;/.svn/wc.db"] [unique_id "aS2-pnwDQfILaZGBrIw5NwAAAYM"]
[Tue Dec 02 00:13:26.402988 2025] [:error] [pid 18797:tid 18801] [client 213.21.239.4:60372] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.svn/%0Awc.db"] [unique_id "aS2-pnwDQfILaZGBrIw5OAAAAYI"]
[Tue Dec 02 00:13:26.403089 2025] [:error] [pid 18734:tid 18737] [client 213.21.239.4:60356] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/aoswa/wc.db"] [unique_id "aS2-phDodp5NNlEyq_Db2gAAAEA"]
[Tue Dec 02 00:13:26.405020 2025] [:error] [pid 18734:tid 18740] [client 213.21.239.4:60486] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/;/.svn/wc.db"] [unique_id "aS2-phDodp5NNlEyq_Db2wAAAEM"]
[Tue Dec 02 00:13:26.405394 2025] [:error] [pid 18797:tid 18804] [client 213.21.239.4:60410] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.svn/wc.db;"] [unique_id "aS2-pnwDQfILaZGBrIw5OQAAAYU"]
[Tue Dec 02 00:13:26.406017 2025] [:error] [pid 18734:tid 18748] [client 213.21.239.4:60438] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/static../.svn/wc.db"] [unique_id "aS2-phDodp5NNlEyq_Db3AAAAEs"]
[Tue Dec 02 00:13:26.409024 2025] [:error] [pid 18826:tid 18839] [client 213.21.239.4:60496] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/static../.svn/wc.db"] [unique_id "aS2-ps44B8ytyS-T2IiGBgAAAIs"]
[Tue Dec 02 00:13:26.411470 2025] [:error] [pid 18826:tid 18845] [client 213.21.239.4:60350] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.svn/wc.db;.."] [unique_id "aS2-ps44B8ytyS-T2IiGCAAAAJE"]
[Tue Dec 02 00:13:26.413294 2025] [:error] [pid 18826:tid 18843] [client 213.21.239.4:60314] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au../wc.db"] [unique_id "aS2-ps44B8ytyS-T2IiGBwAAAI8"]
[Tue Dec 02 00:13:26.413447 2025] [:error] [pid 18734:tid 18751] [client 213.21.239.4:60342] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au../.svn/wc.db"] [unique_id "aS2-phDodp5NNlEyq_Db3QAAAE4"]
[Tue Dec 02 00:13:26.415664 2025] [:error] [pid 18734:tid 18750] [client 213.21.239.4:60470] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.svn/%0Awc.db"] [unique_id "aS2-phDodp5NNlEyq_Db3gAAAE0"]
[Tue Dec 02 00:13:26.417008 2025] [:error] [pid 18734:tid 18741] [client 213.21.239.4:60436] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.svn/wc.db;"] [unique_id "aS2-phDodp5NNlEyq_Db3wAAAEQ"]
[Tue Dec 02 00:13:26.419957 2025] [:error] [pid 18826:tid 18832] [client 213.21.239.4:60400] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/.svn;/wc.db"] [unique_id "aS2-ps44B8ytyS-T2IiGCQAAAIQ"]
[Tue Dec 02 00:13:26.420489 2025] [:error] [pid 18735:tid 18769] [client 213.21.239.4:60522] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/www.aoswa.com.au/wc.db"] [unique_id "aS2-piObBdpXdl5ZEt_M-QAAAQU"]
[Tue Dec 02 00:13:26.421023 2025] [:error] [pid 18826:tid 18847] [client 213.21.239.4:60510] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/dot.svn/wc.db"] [unique_id "aS2-ps44B8ytyS-T2IiGCgAAAJM"]
[Tue Dec 02 00:13:26.421515 2025] [:error] [pid 18826:tid 18851] [client 213.21.239.4:60440] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa/.svn/wc.db;.."] [unique_id "aS2-ps44B8ytyS-T2IiGCwAAAJc"]
[Tue Dec 02 00:13:29.397413 2025] [:error] [pid 18735:tid 18768] [client 213.21.239.4:60560] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/old-cuburn/.svn/wc.db"] [unique_id "aS2-qSObBdpXdl5ZEt_NAwAAAQQ"]
[Tue Dec 02 00:13:29.402733 2025] [:error] [pid 18826:tid 18836] [client 213.21.239.4:60526] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/__MACOSX/.svn/wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGFgAAAIg"]
[Tue Dec 02 00:13:29.404129 2025] [:error] [pid 18826:tid 18828] [client 213.21.239.4:60574] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/prod/.svn/wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGFwAAAIA"]
[Tue Dec 02 00:13:29.404451 2025] [:error] [pid 18797:tid 18823] [client 213.21.239.4:60538] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/media../.svn/wc.db"] [unique_id "aS2-qXwDQfILaZGBrIw5PQAAAZg"]
[Tue Dec 02 00:13:29.408717 2025] [:error] [pid 18826:tid 18833] [client 213.21.239.4:60602] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au../wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGGAAAAIU"]
[Tue Dec 02 00:13:29.409762 2025] [:error] [pid 18797:tid 18821] [client 213.21.239.4:60578] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/public/.svn/wc.db"] [unique_id "aS2-qXwDQfILaZGBrIw5PgAAAZY"]
[Tue Dec 02 00:13:29.416369 2025] [:error] [pid 18826:tid 18840] [client 213.21.239.4:60550] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/new/.svn/wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGGQAAAIw"]
[Tue Dec 02 00:13:29.417231 2025] [:error] [pid 18797:tid 18802] [client 213.21.239.4:60590] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/qa/.svn/wc.db"] [unique_id "aS2-qXwDQfILaZGBrIw5QAAAAYM"]
[Tue Dec 02 00:13:29.417231 2025] [:error] [pid 18797:tid 18817] [client 213.21.239.4:60546] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/m/.svn/wc.db"] [unique_id "aS2-qXwDQfILaZGBrIw5PwAAAZI"]
[Tue Dec 02 00:13:29.422810 2025] [:error] [pid 18735:tid 18783] [client 213.21.239.4:60618] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/prod.svn/wc.db"] [unique_id "aS2-qSObBdpXdl5ZEt_NBAAAARM"]
[Tue Dec 02 00:13:29.424802 2025] [:error] [pid 18797:tid 18801] [client 213.21.239.4:60616] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/message-api/.svn/wc.db"] [unique_id "aS2-qXwDQfILaZGBrIw5QQAAAYI"]
[Tue Dec 02 00:13:29.430302 2025] [:error] [pid 18734:tid 18739] [client 213.21.239.4:60630] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/img../.svn/wc.db"] [unique_id "aS2-qRDodp5NNlEyq_Db5AAAAEI"]
[Tue Dec 02 00:13:29.433647 2025] [:error] [pid 18797:tid 18804] [client 213.21.239.4:60608] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/wc.db"] [unique_id "aS2-qXwDQfILaZGBrIw5QgAAAYU"]
[Tue Dec 02 00:13:29.440973 2025] [:error] [pid 18734:tid 18754] [client 213.21.239.4:60640] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/images../.svn/wc.db"] [unique_id "aS2-qRDodp5NNlEyq_Db5QAAAFE"]
[Tue Dec 02 00:13:29.441704 2025] [:error] [pid 18826:tid 18831] [client 213.21.239.4:60660] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/lib../.svn/wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGGgAAAIM"]
[Tue Dec 02 00:13:29.442325 2025] [:error] [pid 18735:tid 18767] [client 213.21.239.4:60698] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.svn/wc.db;.."] [unique_id "aS2-qSObBdpXdl5ZEt_NBQAAAQM"]
[Tue Dec 02 00:13:29.442877 2025] [:error] [pid 18826:tid 18846] [client 213.21.239.4:60644] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/js../.svn/wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGGwAAAJI"]
[Tue Dec 02 00:13:29.447650 2025] [:error] [pid 18734:tid 18744] [client 213.21.239.4:60720] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/;/.svn/wc.db"] [unique_id "aS2-qRDodp5NNlEyq_Db5gAAAEc"]
[Tue Dec 02 00:13:29.448505 2025] [:error] [pid 18826:tid 18848] [client 213.21.239.4:60650] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/live/.svn/wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGHAAAAJQ"]
[Tue Dec 02 00:13:29.451281 2025] [:error] [pid 18734:tid 18743] [client 213.21.239.4:60662] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/..;/.svn/wc.db"] [unique_id "aS2-qRDodp5NNlEyq_Db6AAAAEY"]
[Tue Dec 02 00:13:29.451727 2025] [:error] [pid 18826:tid 18852] [client 213.21.239.4:60678] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.svn/wc.db"] [unique_id "aS2-qc44B8ytyS-T2IiGHQAAAJg"]
[Tue Dec 02 00:13:29.455625 2025] [:error] [pid 18734:tid 18746] [client 213.21.239.4:60694] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.svn/wc.db;"] [unique_id "aS2-qRDodp5NNlEyq_Db5wAAAEk"]
[Tue Dec 02 00:13:29.466273 2025] [:error] [pid 18735:tid 18776] [client 213.21.239.4:60744] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/svn/.svn/wc.db"] [unique_id "aS2-qSObBdpXdl5ZEt_NBwAAAQw"]
[Tue Dec 02 00:13:29.468321 2025] [:error] [pid 18734:tid 18749] [client 213.21.239.4:60706] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/.svn;/wc.db"] [unique_id "aS2-qRDodp5NNlEyq_Db6QAAAEw"]
[Tue Dec 02 00:13:32.391206 2025] [:error] [pid 18797:tid 18805] [client 213.21.239.4:36562] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/repos/.svn/wc.db"] [unique_id "aS2-rHwDQfILaZGBrIw5SAAAAYY"]
[Tue Dec 02 00:13:32.391445 2025] [:error] [pid 18797:tid 18803] [client 213.21.239.4:36564] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/s3/.svn/wc.db"] [unique_id "aS2-rHwDQfILaZGBrIw5SQAAAYQ"]
[Tue Dec 02 00:13:32.393683 2025] [:error] [pid 18735:tid 18765] [client 213.21.239.4:36638] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db"] [unique_id "aS2-rCObBdpXdl5ZEt_NEQAAAQE"]
[Tue Dec 02 00:13:32.394655 2025] [:error] [pid 18797:tid 18818] [client 213.21.239.4:36658] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db;.."] [unique_id "aS2-rHwDQfILaZGBrIw5SgAAAZM"]
[Tue Dec 02 00:13:32.402197 2025] [:error] [pid 18734:tid 18741] [client 213.21.239.4:36594] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/samples/.svn/wc.db"] [unique_id "aS2-rBDodp5NNlEyq_Db8AAAAEQ"]
[Tue Dec 02 00:13:32.403244 2025] [:error] [pid 18797:tid 18823] [client 213.21.239.4:36596] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.svn/wc.db;"] [unique_id "aS2-rHwDQfILaZGBrIw5SwAAAZg"]
[Tue Dec 02 00:13:32.405607 2025] [:error] [pid 18797:tid 18802] [client 213.21.239.4:36580] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/static../.svn/wc.db"] [unique_id "aS2-rHwDQfILaZGBrIw5TAAAAYM"]
[Tue Dec 02 00:13:32.405961 2025] [:error] [pid 18826:tid 18843] [client 213.21.239.4:36624] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au../.svn/wc.db"] [unique_id "aS2-rM44B8ytyS-T2IiGJQAAAI8"]
[Tue Dec 02 00:13:32.406224 2025] [:error] [pid 18797:tid 18808] [client 213.21.239.4:36534] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.svn/%0Awc.db"] [unique_id "aS2-rHwDQfILaZGBrIw5TQAAAYk"]
[Tue Dec 02 00:13:32.409255 2025] [:error] [pid 18826:tid 18848] [client 213.21.239.4:36724] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.svn/%0Awc.db"] [unique_id "aS2-rM44B8ytyS-T2IiGJgAAAJQ"]
[Tue Dec 02 00:13:32.410186 2025] [:error] [pid 18735:tid 18788] [client 213.21.239.4:36670] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/shop/.svn/wc.db"] [unique_id "aS2-rCObBdpXdl5ZEt_NEgAAARg"]
[Tue Dec 02 00:13:32.410643 2025] [:error] [pid 18826:tid 18851] [client 213.21.239.4:36694] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www../.svn/wc.db"] [unique_id "aS2-rM44B8ytyS-T2IiGJwAAAJc"]
[Tue Dec 02 00:13:32.410936 2025] [:error] [pid 18735:tid 18779] [client 213.21.239.4:36688] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/static../.svn/wc.db"] [unique_id "aS2-rCObBdpXdl5ZEt_NEwAAAQ8"]
[Tue Dec 02 00:13:32.412409 2025] [:error] [pid 18797:tid 18817] [client 213.21.239.4:36548] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/repository/.svn/wc.db"] [unique_id "aS2-rHwDQfILaZGBrIw5TgAAAZI"]
[Tue Dec 02 00:13:32.413253 2025] [:error] [pid 18735:tid 18766] [client 213.21.239.4:36582] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/..;/.svn/wc.db"] [unique_id "aS2-rCObBdpXdl5ZEt_NFAAAAQI"]
[Tue Dec 02 00:13:32.414744 2025] [:error] [pid 18797:tid 18821] [client 213.21.239.4:36628] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/..;/.svn/wc.db"] [unique_id "aS2-rHwDQfILaZGBrIw5TwAAAZY"]
[Tue Dec 02 00:13:32.417868 2025] [:error] [pid 18734:tid 18757] [client 213.21.239.4:36610] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/www../wc.db"] [unique_id "aS2-rBDodp5NNlEyq_Db8QAAAFQ"]
[Tue Dec 02 00:13:32.419248 2025] [:error] [pid 18735:tid 18777] [client 213.21.239.4:36588] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.svn/wc.db"] [unique_id "aS2-rCObBdpXdl5ZEt_NFQAAAQ0"]
[Tue Dec 02 00:13:32.420427 2025] [:error] [pid 18735:tid 18778] [client 213.21.239.4:36642] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.svn/wc.db;"] [unique_id "aS2-rCObBdpXdl5ZEt_NFgAAAQ4"]
[Tue Dec 02 00:13:32.421207 2025] [:error] [pid 18797:tid 18801] [client 213.21.239.4:36742] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/www/.svn;/wc.db"] [unique_id "aS2-rHwDQfILaZGBrIw5UAAAAYI"]
[Tue Dec 02 00:13:32.422336 2025] [:error] [pid 18734:tid 18756] [client 213.21.239.4:36682] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/.svn;/wc.db"] [unique_id "aS2-rBDodp5NNlEyq_Db8gAAAFM"]
[Tue Dec 02 00:13:32.424027 2025] [:error] [pid 18826:tid 18846] [client 213.21.239.4:36748] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/aoswa.com.au/;/.svn/wc.db"] [unique_id "aS2-rM44B8ytyS-T2IiGKAAAAJI"]
[Tue Dec 02 00:13:32.424082 2025] [:error] [pid 18826:tid 18838] [client 213.21.239.4:36728] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/;/.svn/wc.db"] [unique_id "aS2-rM44B8ytyS-T2IiGKQAAAIo"]
[Tue Dec 02 00:13:32.428047 2025] [:error] [pid 18826:tid 18850] [client 213.21.239.4:36762] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/www/.svn/wc.db;.."] [unique_id "aS2-rM44B8ytyS-T2IiGKgAAAJY"]
[Tue Dec 02 00:13:32.430468 2025] [:error] [pid 18826:tid 18852] [client 213.21.239.4:36710] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.aoswa.com.au|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aoswa.com.au"] [uri "/www/wc.db"] [unique_id "aS2-rM44B8ytyS-T2IiGKwAAAJg"]
[Tue Dec 02 00:13:35.385283 2025] [:error] [pid 18797:tid 18817] [client 213.21.239.4:36782] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/staging/.svn/wc.db"] [unique_id "aS2-r3wDQfILaZGBrIw5VQAAAZI"]
[Tue Dec 02 00:13:35.392781 2025] [:error] [pid 18734:tid 18738] [client 213.21.239.4:36774] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/site/.svn/wc.db"] [unique_id "aS2-rxDodp5NNlEyq_Db-QAAAEE"]
[Tue Dec 02 00:13:35.393119 2025] [:error] [pid 18734:tid 18740] [client 213.21.239.4:36842] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/web/.svn/wc.db"] [unique_id "aS2-rxDodp5NNlEyq_Db-gAAAEM"]
[Tue Dec 02 00:13:35.393831 2025] [:error] [pid 18734:tid 18737] [client 213.21.239.4:36872] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/.svn/wc.db"] [unique_id "aS2-rxDodp5NNlEyq_Db-wAAAEA"]
[Tue Dec 02 00:13:35.395452 2025] [:error] [pid 18797:tid 18821] [client 213.21.239.4:36810] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/uat/.svn/wc.db"] [unique_id "aS2-r3wDQfILaZGBrIw5VgAAAZY"]
[Tue Dec 02 00:13:35.396629 2025] [:error] [pid 18734:tid 18750] [client 213.21.239.4:36844] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wiki/.svn/wc.db"] [unique_id "aS2-rxDodp5NNlEyq_Db_AAAAE0"]
[Tue Dec 02 00:13:35.396963 2025] [:error] [pid 18734:tid 18751] [client 213.21.239.4:36834] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/vendor/.svn/wc.db"] [unique_id "aS2-rxDodp5NNlEyq_Db_QAAAE4"]
[Tue Dec 02 00:13:35.405350 2025] [:error] [pid 18826:tid 18833] [client 213.21.239.4:36864] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/.svn/wc.db"] [unique_id "aS2-r844B8ytyS-T2IiGNAAAAIU"]
[Tue Dec 02 00:13:35.405806 2025] [:error] [pid 18797:tid 18801] [client 213.21.239.4:36854] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-content/.svn/wc.db"] [unique_id "aS2-r3wDQfILaZGBrIw5VwAAAYI"]
[Tue Dec 02 00:13:35.407107 2025] [:error] [pid 18734:tid 18757] [client 213.21.239.4:36826] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/static../.svn/wc.db"] [unique_id "aS2-rxDodp5NNlEyq_Db_gAAAFQ"]
[Tue Dec 02 00:13:35.408051 2025] [:error] [pid 18734:tid 18741] [client 213.21.239.4:36792] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/static/.svn/wc.db"] [unique_id "aS2-rxDodp5NNlEyq_Db_wAAAEQ"]
[Tue Dec 02 00:13:35.408890 2025] [:error] [pid 18826:tid 18834] [client 213.21.239.4:36862] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/.svn/wc.db"] [unique_id "aS2-r844B8ytyS-T2IiGNQAAAIY"]
[Tue Dec 02 00:13:35.411096 2025] [:error] [pid 18826:tid 18831] [client 213.21.239.4:36796] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/store/.svn/wc.db"] [unique_id "aS2-r844B8ytyS-T2IiGNgAAAIM"]
[Tue Dec 02 01:19:26.050215 2025] [:error] [pid 18826:tid 18851] [client 45.176.233.102:61576] [client 45.176.233.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.176.233.102, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aS3OHs44B8ytyS-T2IikpAAAAJc"]
[Tue Dec 02 01:19:26.055343 2025] [:error] [pid 18826:tid 18851] [client 45.176.233.102:61576] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 02 01:19:48.771582 2025] [:error] [pid 18797:tid 18799] [client 45.77.243.31:43190] [client 45.77.243.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.77.243.31, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aS3ONHwDQfILaZGBrIxT5QAAAYA"]
[Tue Dec 02 01:19:48.901185 2025] [:error] [pid 18797:tid 18799] [client 45.77.243.31:43190] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 02 12:58:55.904749 2025] [:error] [pid 3649:tid 3719] [client 145.239.10.137:48221] File does not exist: /usr/local/apache/htdocs/suspended-page/zc.php, referer: http://aoswa.com.au/zc.php
[Tue Dec 02 12:58:55.960399 2025] [:error] [pid 3760:tid 3780] [client 145.239.10.137:46989] File does not exist: /usr/local/apache/htdocs/suspended-page/zt2.php, referer: http://aoswa.com.au/zt2.php
[Tue Dec 02 15:10:53.534507 2025] [:error] [pid 5272:tid 5298] [client 145.239.10.137:58623] File does not exist: /usr/local/apache/htdocs/suspended-page/resp.php, referer: http://aoswa.com.au/resp.php
[Tue Dec 02 15:59:24.453276 2025] [:error] [pid 48650:tid 48656] [client 62.60.131.162:54544] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aS6cXIQuWSn3xrJsXbksgAAAAcE"]
[Tue Dec 02 17:20:26.384179 2025] [:error] [pid 3760:tid 3771] [client 8.215.18.158:52786] [client 8.215.18.158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aS6vWljLYEjdWVcKgVVFAgAAAMk"]
[Tue Dec 02 17:20:38.751748 2025] [:error] [pid 3760:tid 3779] [client 8.215.18.158:53108] [client 8.215.18.158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aS6vZljLYEjdWVcKgVVFAwAAANE"]
[Tue Dec 02 22:47:19.552608 2025] [:error] [pid 48650:tid 48658] [client 49.36.186.179:61765] [client 49.36.186.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.186.179, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aS7794QuWSn3xrJsXbngZgAAAcM"]
[Tue Dec 02 22:47:19.557621 2025] [:error] [pid 48650:tid 48658] [client 49.36.186.179:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 03 02:45:40.268141 2025] [:error] [pid 47068:tid 47113] [client 34.60.101.31:53024] [client 34.60.101.31] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aS8z1CDFatpzeF4tcYW0PAAAAE0"]
[Wed Dec 03 02:46:19.943706 2025] [:error] [pid 47158:tid 47181] [client 34.121.215.53:50124] [client 34.121.215.53] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aS8z-13-jeg4VwJRw7FIjwAAANU"]
[Wed Dec 03 08:08:31.388848 2025] [:error] [pid 22013:tid 22037] [client 54.169.5.143:37476] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Wed Dec 03 08:08:31.791043 2025] [:error] [pid 24019:tid 24033] [client 54.169.5.143:37560] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Dec 03 08:08:32.192182 2025] [:error] [pid 24019:tid 24027] [client 54.169.5.143:37618] File does not exist: /usr/local/apache/htdocs/suspended-page/php_info.php
[Wed Dec 03 08:08:32.999049 2025] [:error] [pid 21970:tid 21980] [client 54.169.5.143:37738] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Wed Dec 03 08:08:33.402470 2025] [:error] [pid 22014:tid 22065] [client 54.169.5.143:37786] File does not exist: /usr/local/apache/htdocs/suspended-page/info1.php
[Wed Dec 03 08:08:33.800462 2025] [:error] [pid 24019:tid 24040] [client 54.169.5.143:37842] File does not exist: /usr/local/apache/htdocs/suspended-page/info2.php
[Wed Dec 03 08:08:34.200567 2025] [:error] [pid 22013:tid 22037] [client 54.169.5.143:37890] File does not exist: /usr/local/apache/htdocs/suspended-page/info3.php
[Wed Dec 03 08:08:34.598390 2025] [:error] [pid 22014:tid 22070] [client 54.169.5.143:37946] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Wed Dec 03 08:08:34.994413 2025] [:error] [pid 21970:tid 22000] [client 54.169.5.143:37998] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Wed Dec 03 08:08:35.391889 2025] [:error] [pid 24019:tid 24021] [client 54.169.5.143:38044] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Wed Dec 03 08:08:35.785701 2025] [:error] [pid 21970:tid 21999] [client 54.169.5.143:38106] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpversion.php"] [unique_id "aS9_g2YwAeqEfyJIWdRyxgAAABc"]
[Wed Dec 03 08:08:36.177194 2025] [:error] [pid 24019:tid 24023] [client 54.169.5.143:38150] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php_version.php"] [unique_id "aS9_hJkVRhF9Pu1FX0Pg_gAAAIE"]
[Wed Dec 03 08:08:36.571265 2025] [:error] [pid 24019:tid 24029] [client 54.169.5.143:38222] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/serverinfo.php"] [unique_id "aS9_hJkVRhF9Pu1FX0PhAAAAAIc"]
[Wed Dec 03 08:08:36.964252 2025] [:error] [pid 22014:tid 22046] [client 54.169.5.143:38282] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/server.php"] [unique_id "aS9_hAgpXEQej7y9Y6b-bQAAAQA"]
[Wed Dec 03 08:08:37.357864 2025] [:error] [pid 24019:tid 24026] [client 54.169.5.143:38340] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/debug.php"] [unique_id "aS9_hZkVRhF9Pu1FX0PhCAAAAIQ"]
[Wed Dec 03 08:08:37.752716 2025] [:error] [pid 22013:tid 22019] [client 54.169.5.143:38410] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/diagnostic.php"] [unique_id "aS9_hYpUogO0aqsrpMVx0gAAAMA"]
[Wed Dec 03 08:08:38.146604 2025] [:error] [pid 21970:tid 21980] [client 54.169.5.143:38468] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phptest.php"] [unique_id "aS9_hmYwAeqEfyJIWdRyzQAAAAQ"]
[Wed Dec 03 08:08:38.540411 2025] [:error] [pid 21970:tid 21994] [client 54.169.5.143:38526] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aS9_hmYwAeqEfyJIWdRyzwAAABI"]
[Wed Dec 03 08:08:38.939882 2025] [:error] [pid 22013:tid 22020] [client 54.169.5.143:38598] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/probe.php"] [unique_id "aS9_hopUogO0aqsrpMVx1QAAAME"]
[Wed Dec 03 08:08:39.337861 2025] [:error] [pid 22083:tid 22089] [client 54.169.5.143:38652] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/_profiler/phpinfo"] [unique_id "aS9_h_icvKZCy0M9-zyr1QAAAEQ"]
[Wed Dec 03 08:08:39.732742 2025] [:error] [pid 21970:tid 21973] [client 54.169.5.143:38718] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aS9_h2YwAeqEfyJIWdRy1AAAAAA"]
[Wed Dec 03 08:08:40.125559 2025] [:error] [pid 22013:tid 22031] [client 54.169.5.143:38798] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aS9_iIpUogO0aqsrpMVx1gAAAMw"]
[Wed Dec 03 08:08:40.519942 2025] [:error] [pid 22014:tid 22061] [client 54.169.5.143:38854] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "aS9_iAgpXEQej7y9Y6b-cAAAAQ8"]
[Wed Dec 03 08:08:40.911410 2025] [:error] [pid 21970:tid 21998] [client 54.169.5.143:38926] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aS9_iGYwAeqEfyJIWdRy2AAAABY"]
[Wed Dec 03 08:08:41.306221 2025] [:error] [pid 22083:tid 22087] [client 54.169.5.143:38990] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aS9_ificvKZCy0M9-zyr2QAAAEI"]
[Wed Dec 03 08:08:41.700515 2025] [:error] [pid 22083:tid 22098] [client 54.169.5.143:39052] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info_php.php"] [unique_id "aS9_ificvKZCy0M9-zyr2wAAAE0"]
[Wed Dec 03 08:08:42.097624 2025] [:error] [pid 21970:tid 21993] [client 54.169.5.143:39108] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php-info.php"] [unique_id "aS9_imYwAeqEfyJIWdRy5AAAABE"]
[Wed Dec 03 08:08:42.492261 2025] [:error] [pid 22014:tid 22067] [client 54.169.5.143:39178] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/infophp.php"] [unique_id "aS9_iggpXEQej7y9Y6b-dgAAARU"]
[Wed Dec 03 08:08:42.884206 2025] [:error] [pid 22013:tid 22031] [client 54.169.5.143:39240] [client 54.169.5.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testphp.php"] [unique_id "aS9_iopUogO0aqsrpMVx-gAAAMw"]
[Wed Dec 03 08:08:43.278144 2025] [:error] [pid 24019:tid 24025] [client 54.169.5.143:39304] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aS9_i5kVRhF9Pu1FX0PhNwAAAIM"]
[Wed Dec 03 08:08:43.673173 2025] [:error] [pid 21970:tid 21995] [client 54.169.5.143:39382] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aS9_i2YwAeqEfyJIWdRy6wAAABM"]
[Wed Dec 03 08:08:44.067638 2025] [:error] [pid 24019:tid 24026] [client 54.169.5.143:39448] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aS9_jJkVRhF9Pu1FX0PhPgAAAIQ"]
[Wed Dec 03 08:08:44.464453 2025] [:error] [pid 24019:tid 24024] [client 54.169.5.143:39502] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.remote"] [unique_id "aS9_jJkVRhF9Pu1FX0PhPwAAAII"]
[Wed Dec 03 08:08:44.858341 2025] [:error] [pid 21970:tid 21979] [client 54.169.5.143:39576] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aS9_jGYwAeqEfyJIWdRy7wAAAAM"]
[Wed Dec 03 08:08:45.255950 2025] [:error] [pid 21970:tid 21974] [client 54.169.5.143:39638] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aS9_jWYwAeqEfyJIWdRy8AAAAAE"]
[Wed Dec 03 08:08:45.648778 2025] [:error] [pid 22013:tid 22021] [client 54.169.5.143:39710] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aS9_jYpUogO0aqsrpMVyBgAAAMI"]
[Wed Dec 03 08:08:46.041801 2025] [:error] [pid 21970:tid 21989] [client 54.169.5.143:39804] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "aS9_jmYwAeqEfyJIWdRy8QAAAA0"]
[Wed Dec 03 08:08:46.442013 2025] [:error] [pid 22083:tid 22104] [client 54.169.5.143:39904] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aS9_jvicvKZCy0M9-zyr6gAAAFM"]
[Wed Dec 03 08:08:46.839947 2025] [:error] [pid 22083:tid 22085] [client 54.169.5.143:40004] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.sample"] [unique_id "aS9_jvicvKZCy0M9-zyr6wAAAEA"]
[Wed Dec 03 08:08:47.235333 2025] [:error] [pid 21970:tid 21995] [client 54.169.5.143:40092] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aS9_j2YwAeqEfyJIWdRy8wAAABM"]
[Wed Dec 03 08:08:47.631536 2025] [:error] [pid 22014:tid 22063] [client 54.169.5.143:40180] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aS9_jwgpXEQej7y9Y6b-ewAAARE"]
[Wed Dec 03 08:08:48.023586 2025] [:error] [pid 22014:tid 22058] [client 54.169.5.143:40272] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aS9_kAgpXEQej7y9Y6b-fQAAAQw"]
[Wed Dec 03 08:08:48.416423 2025] [:error] [pid 22013:tid 22035] [client 54.169.5.143:40370] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.1"] [unique_id "aS9_kIpUogO0aqsrpMVyCQAAANA"]
[Wed Dec 03 08:08:48.811410 2025] [:error] [pid 22083:tid 22098] [client 54.169.5.143:40410] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.2"] [unique_id "aS9_kPicvKZCy0M9-zyr8gAAAE0"]
[Wed Dec 03 08:08:49.204780 2025] [:error] [pid 24019:tid 24031] [client 54.169.5.143:40462] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.prod.local"] [unique_id "aS9_kZkVRhF9Pu1FX0PhSQAAAIk"]
[Wed Dec 03 08:08:49.598264 2025] [:error] [pid 24019:tid 24025] [client 54.169.5.143:40530] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev.local"] [unique_id "aS9_kZkVRhF9Pu1FX0PhTAAAAIM"]
[Wed Dec 03 08:08:49.993668 2025] [:error] [pid 22014:tid 22047] [client 54.169.5.143:40586] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/vendor/.env"] [unique_id "aS9_kQgpXEQej7y9Y6b-ggAAAQE"]
[Wed Dec 03 08:08:50.389414 2025] [:error] [pid 24019:tid 24043] [client 54.169.5.143:40638] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/lib/.env"] [unique_id "aS9_kpkVRhF9Pu1FX0PhTwAAAJU"]
[Wed Dec 03 08:08:50.786763 2025] [:error] [pid 22013:tid 22027] [client 54.169.5.143:40684] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/lab/.env"] [unique_id "aS9_kopUogO0aqsrpMVyDAAAAMg"]
[Wed Dec 03 08:08:51.184544 2025] [:error] [pid 24019:tid 24034] [client 54.169.5.143:40740] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/cronlab/.env"] [unique_id "aS9_k5kVRhF9Pu1FX0PhUQAAAIw"]
[Wed Dec 03 08:08:51.580310 2025] [:error] [pid 22083:tid 22106] [client 54.169.5.143:40790] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/cron/.env"] [unique_id "aS9_k_icvKZCy0M9-zyr-AAAAFU"]
[Wed Dec 03 08:08:51.972847 2025] [:error] [pid 22083:tid 22109] [client 54.169.5.143:40850] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/.env"] [unique_id "aS9_k_icvKZCy0M9-zyr-wAAAFg"]
[Wed Dec 03 08:08:52.367843 2025] [:error] [pid 21970:tid 21978] [client 54.169.5.143:40892] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/app/.env"] [unique_id "aS9_lGYwAeqEfyJIWdRy-AAAAAI"]
[Wed Dec 03 08:08:52.759764 2025] [:error] [pid 24019:tid 24040] [client 54.169.5.143:40952] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/Datavase/.env"] [unique_id "aS9_lJkVRhF9Pu1FX0PhWAAAAJI"]
[Wed Dec 03 08:08:53.156810 2025] [:error] [pid 21970:tid 21991] [client 54.169.5.143:41010] [client 54.169.5.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/database/.env"] [unique_id "aS9_lWYwAeqEfyJIWdRy-wAAAA8"]
[Thu Dec 04 11:59:17.043175 2025] [:error] [pid 63382:tid 63473] [client 143.110.180.207:61485] [client 143.110.180.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/images/"] [unique_id "aTEHFUvJv09BlzBS6SSLFwAAAoQ"], referer: binance.com
[Thu Dec 04 11:59:27.176848 2025] [:error] [pid 63381:tid 63454] [client 143.110.180.207:65194] [client 143.110.180.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files/"] [unique_id "aTEHH-idz_S5muoRMEy9UAAAAks"], referer: binance.com
[Thu Dec 04 23:21:38.500496 2025] [:error] [pid 63383:tid 63425] [client 45.61.135.235:50520] [client 45.61.135.235] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aoswa.com.au"] [uri "/wp-json/wp/v2/users"] [unique_id "aTGnAlJYyG_QEWdAPIXUwgAAAsg"]
[Fri Dec 05 01:25:11.922290 2025] [:error] [pid 4492:tid 4562] [client 4.241.249.211:12305] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php, referer: https://duckduckgo.com/
[Fri Dec 05 01:25:12.107735 2025] [:error] [pid 4492:tid 4570] [client 4.241.249.211:12305] [client 4.241.249.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.241.249.211, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTHD-KktiJtKB3zqv33gDwAAARY"], referer: https://www.google.de/
[Fri Dec 05 01:25:12.112030 2025] [:error] [pid 4492:tid 4570] [client 4.241.249.211:12305] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php, referer: https://www.google.de/
[Fri Dec 05 01:25:53.815778 2025] [:error] [pid 4490:tid 4509] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.bing.com/
[Fri Dec 05 01:25:54.234297 2025] [:error] [pid 4490:tid 4507] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php, referer: https://www.google.co.uk/
[Fri Dec 05 01:25:54.610130 2025] [:error] [pid 4490:tid 4515] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.fr/
[Fri Dec 05 01:25:54.774439 2025] [:error] [pid 4490:tid 4510] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://duckduckgo.com/
[Fri Dec 05 01:25:54.994412 2025] [:error] [pid 4490:tid 4505] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://duckduckgo.com/
[Fri Dec 05 01:25:55.306191 2025] [:error] [pid 4490:tid 4516] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.bing.com/
[Fri Dec 05 01:25:56.159820 2025] [:error] [pid 4490:tid 4497] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php, referer: https://www.google.com/
[Fri Dec 05 01:25:56.320602 2025] [:error] [pid 4490:tid 4500] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.yahoo.com/
[Fri Dec 05 01:25:56.513719 2025] [:error] [pid 4490:tid 4506] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://duckduckgo.com/
[Fri Dec 05 01:25:56.900325 2025] [:error] [pid 4490:tid 4495] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php, referer: https://www.google.fr/
[Fri Dec 05 01:25:57.255899 2025] [:error] [pid 4490:tid 4499] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.google.de/
[Fri Dec 05 01:25:58.107668 2025] [:error] [pid 4490:tid 4515] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php, referer: https://www.bing.com/
[Fri Dec 05 01:25:58.433678 2025] [:error] [pid 4490:tid 4516] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php, referer: https://www.google.de/
[Fri Dec 05 01:25:59.204222 2025] [:error] [pid 4490:tid 4500] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.com/
[Fri Dec 05 01:25:59.784946 2025] [:error] [pid 4490:tid 4501] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://www.bing.com/
[Fri Dec 05 01:26:00.098670 2025] [:error] [pid 4490:tid 4503] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php, referer: https://www.bing.com/
[Fri Dec 05 01:26:00.922304 2025] [:error] [pid 4490:tid 4497] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.google.fr/
[Fri Dec 05 01:26:01.298114 2025] [:error] [pid 4490:tid 4510] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php, referer: https://www.yahoo.com/
[Fri Dec 05 01:26:01.459361 2025] [:error] [pid 4490:tid 4517] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php, referer: https://duckduckgo.com/
[Fri Dec 05 01:26:01.919197 2025] [:error] [pid 4490:tid 4518] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php, referer: https://www.google.fr/
[Fri Dec 05 01:26:02.278727 2025] [:error] [pid 4490:tid 4512] [client 4.241.249.211:60192] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.yahoo.com/
[Fri Dec 05 03:32:50.049239 2025] [:error] [pid 31301:tid 31382] [client 4.241.250.56:6146] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php, referer: https://www.google.com/
[Fri Dec 05 03:32:50.311870 2025] [:error] [pid 31301:tid 31358] [client 4.241.250.56:6146] [client 4.241.250.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.241.250.56, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTHh4jA-xZRmMrZ05jbGSgAAAIA"], referer: https://duckduckgo.com/
[Fri Dec 05 03:32:50.317673 2025] [:error] [pid 31301:tid 31358] [client 4.241.250.56:6146] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php, referer: https://duckduckgo.com/
[Fri Dec 05 03:32:50.625485 2025] [:error] [pid 31301:tid 31363] [client 4.241.250.56:6146] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.fr/
[Fri Dec 05 03:32:50.803158 2025] [:error] [pid 31301:tid 31366] [client 4.241.250.56:6146] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php, referer: https://www.yahoo.com/
[Fri Dec 05 03:32:51.014645 2025] [:error] [pid 31301:tid 31371] [client 4.241.250.56:6146] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.com/
[Fri Dec 05 03:32:52.516755 2025] [:error] [pid 31301:tid 31376] [client 4.241.250.56:6146] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.yahoo.com/
[Fri Dec 05 03:32:54.265239 2025] [:error] [pid 31301:tid 31376] [client 4.241.250.56:6146] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.fr/
[Fri Dec 05 03:32:57.311208 2025] [:error] [pid 31568:tid 31604] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.google.co.uk/
[Fri Dec 05 03:32:57.765097 2025] [:error] [pid 31568:tid 31608] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php, referer: https://www.google.de/
[Fri Dec 05 03:32:57.908147 2025] [:error] [pid 31568:tid 31609] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.google.com/
[Fri Dec 05 03:32:59.013303 2025] [:error] [pid 31568:tid 31612] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.google.com/
[Fri Dec 05 03:32:59.168201 2025] [:error] [pid 31568:tid 31614] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php, referer: https://www.bing.com/
[Fri Dec 05 03:32:59.408261 2025] [:error] [pid 31568:tid 31615] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://duckduckgo.com/
[Fri Dec 05 03:33:00.895507 2025] [:error] [pid 31568:tid 31619] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php, referer: https://www.google.com/
[Fri Dec 05 03:33:01.028298 2025] [:error] [pid 31568:tid 31620] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php, referer: https://www.google.co.uk/
[Fri Dec 05 03:33:01.284571 2025] [:error] [pid 31568:tid 31622] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.fr/
[Fri Dec 05 03:33:02.663644 2025] [:error] [pid 31568:tid 31625] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://www.google.fr/
[Fri Dec 05 03:33:02.844592 2025] [:error] [pid 31568:tid 31626] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php, referer: https://www.google.fr/
[Fri Dec 05 03:33:03.136967 2025] [:error] [pid 31568:tid 31628] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.google.de/
[Fri Dec 05 03:33:03.552830 2025] [:error] [pid 31568:tid 31608] [client 4.241.250.56:6161] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php, referer: https://www.google.co.uk/
[Fri Dec 05 03:33:06.626028 2025] [:error] [pid 31789:tid 31818] [client 4.241.250.56:6150] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php, referer: https://www.google.com/
[Fri Dec 05 03:33:06.799138 2025] [:error] [pid 31789:tid 31819] [client 4.241.250.56:6150] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php, referer: https://duckduckgo.com/
[Fri Dec 05 03:33:06.969132 2025] [:error] [pid 31789:tid 31820] [client 4.241.250.56:6150] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.google.co.uk/
[Fri Dec 05 03:33:16.558704 2025] [:error] [pid 32062:tid 32163] [client 4.241.250.56:6887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php, referer: https://www.google.co.uk/
[Fri Dec 05 03:33:22.936213 2025] [:error] [pid 32062:tid 32140] [client 4.241.250.56:6887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php, referer: https://www.google.fr/
[Fri Dec 05 03:33:23.084372 2025] [:error] [pid 32062:tid 32147] [client 4.241.250.56:6887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.co.uk/
[Fri Dec 05 03:33:23.366167 2025] [:error] [pid 32062:tid 32152] [client 4.241.250.56:6887] [client 4.241.250.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aTHiA6QcfZC81cCttgBEDAAAAAw"], referer: https://www.bing.com/
[Fri Dec 05 05:24:05.178421 2025] [:error] [pid 53838:tid 53892] [client 45.61.135.235:52379] [client 45.61.135.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aTH79Z8M7CH_vMhLrzLstwAAAFc"]
[Fri Dec 05 05:24:17.569865 2025] [:error] [pid 53838:tid 53877] [client 45.61.135.235:54333] [client 45.61.135.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aTH8AZ8M7CH_vMhLrzLs0wAAAEg"]
[Fri Dec 05 07:51:01.743530 2025] [:error] [pid 53839:tid 53899] [client 44.195.1.216:53152] [client 44.195.1.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/"] [unique_id "aTIeZaQOuERg_RN7bn-1RQAAAIM"]
[Fri Dec 05 07:51:02.769221 2025] [:error] [pid 53839:tid 53911] [client 44.195.1.216:53158] [client 44.195.1.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aTIeZqQOuERg_RN7bn-1SQAAAI8"]
[Fri Dec 05 08:45:10.347895 2025] [:error] [pid 35173:tid 35184] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Dec 05 08:45:10.909707 2025] [:error] [pid 35173:tid 35194] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Dec 05 08:45:11.191464 2025] [:error] [pid 35173:tid 35187] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Fri Dec 05 08:45:11.468738 2025] [:error] [pid 35173:tid 35177] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/php_info.php
[Fri Dec 05 08:45:11.745601 2025] [:error] [pid 35173:tid 35198] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Fri Dec 05 08:45:12.026622 2025] [:error] [pid 35173:tid 35192] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Fri Dec 05 08:45:12.871868 2025] [:error] [pid 35173:tid 35197] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Fri Dec 05 08:45:13.149645 2025] [:error] [pid 35173:tid 35175] [client 45.86.202.189:55063] File does not exist: /usr/local/apache/htdocs/suspended-page/php_version.php
[Fri Dec 05 08:45:13.700187 2025] [:error] [pid 35173:tid 35200] [client 45.86.202.189:55063] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aTIrGTLwYloPE6LF3uAuEAAAAVg"]
[Fri Dec 05 08:45:34.256750 2025] [:error] [pid 35173:tid 35188] [client 45.86.202.162:33219] [client 45.86.202.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aTIrLjLwYloPE6LF3uAuYgAAAUw"]
[Fri Dec 05 08:45:34.826395 2025] [:error] [pid 53923:tid 53949] [client 45.86.202.189:54147] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aTIrLrl8ebZN0VCAVXBVGgAAANg"]
[Fri Dec 05 09:30:24.889779 2025] [:error] [pid 53837:tid 53855] [client 176.65.132.18:38166] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aTI1sDbsUyTxys8OiMJ2zQAAAA0"]
[Fri Dec 05 12:54:40.796261 2025] [:error] [pid 53923:tid 53936] [client 35.88.185.125:50504] [client 35.88.185.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/"] [unique_id "aTJlkLl8ebZN0VCAVXDWZAAAAMs"]
[Fri Dec 05 12:54:41.708386 2025] [:error] [pid 53923:tid 53937] [client 35.88.185.125:50506] [client 35.88.185.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aTJlkbl8ebZN0VCAVXDWZgAAAMw"]
[Fri Dec 05 16:31:54.971917 2025] [:error] [pid 53837:tid 53861] [client 49.145.201.111:60479] [client 49.145.201.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.201.111, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aTKYejbsUyTxys8OiMLulwAAABM"]
[Fri Dec 05 16:31:54.977357 2025] [:error] [pid 53837:tid 53861] [client 49.145.201.111:60479] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Dec 05 21:33:16.219854 2025] [:error] [pid 35962:tid 35979] [client 100.31.185.252:44636] [client 100.31.185.252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/"] [unique_id "aTLfHJ-hnYjbYINfh7HPtQAAAE8"]
[Fri Dec 05 21:33:17.039158 2025] [:error] [pid 35962:tid 35976] [client 100.31.185.252:44642] [client 100.31.185.252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aTLfHZ-hnYjbYINfh7HPuAAAAEw"]
[Fri Dec 05 22:52:58.918909 2025] [:error] [pid 32416:tid 32426] [client 78.84.169.238:26264] [client 78.84.169.238] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aTLxytw2m4oeKabXf6-FlwAAAYg"]
[Sat Dec 06 08:21:07.065827 2025] [autoindex:error] [pid 35591:tid 35611] [client 194.5.82.141:37795] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 06 08:21:13.468331 2025] [:error] [pid 35591:tid 35595] [client 194.5.82.141:37795] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager"] [unique_id "aTN2-Ybmw-7bFvTxc9OtJwAAAQI"]
[Sat Dec 06 17:01:06.757644 2025] [:error] [pid 1727:tid 1745] [client 4.247.149.190:51066] [client 4.247.149.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/network.php"] [unique_id "aTPw0sD83luYT37-ZaXvlAAAAlA"]
[Sat Dec 06 17:01:07.083681 2025] [:error] [pid 35622:tid 35663] [client 4.247.149.190:51009] [client 4.247.149.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aTPw0yOSP_9DVLgFwI6m3gAAAYw"]
[Sat Dec 06 17:01:07.504427 2025] [:error] [pid 61216:tid 61262] [client 4.247.149.190:22584] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Sat Dec 06 17:01:07.654833 2025] [:error] [pid 61216:tid 61249] [client 4.247.149.190:22584] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sat Dec 06 17:01:07.805859 2025] [:error] [pid 61216:tid 61261] [client 4.247.149.190:22584] File does not exist: /usr/local/apache/htdocs/suspended-page/adds.php
[Sat Dec 06 17:01:07.953622 2025] [:error] [pid 61216:tid 61269] [client 4.247.149.190:22584] [client 4.247.149.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aTPw0zHlXXVdP5ewviX4qwAAAFc"]
[Sat Dec 06 17:01:08.308962 2025] [:error] [pid 1838:tid 1855] [client 4.247.149.190:49498] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 06 17:01:08.465874 2025] [:error] [pid 1838:tid 1870] [client 4.247.149.190:49498] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Dec 06 17:01:08.616370 2025] [:error] [pid 1838:tid 1851] [client 4.247.149.190:49498] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Sat Dec 06 17:01:08.917491 2025] [:error] [pid 1838:tid 1861] [client 4.247.149.190:49498] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTPw1C5zgnu67Yo7vrbbrAAAAo8"]
[Sat Dec 06 17:01:09.342844 2025] [:error] [pid 52809:tid 52819] [client 4.247.149.190:43195] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTPw1erRwgsmpIJQ2qZcCgAAAgg"]
[Sat Dec 06 17:01:09.758907 2025] [:error] [pid 35591:tid 35603] [client 4.247.149.190:51056] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTPw1Ybmw-7bFvTxc9P73AAAAQo"]
[Sat Dec 06 17:01:10.169344 2025] [:error] [pid 48399:tid 48424] [client 4.247.149.190:22547] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTPw1ujNPOrIshd8EwejKQAAAdc"]
[Sat Dec 06 17:01:10.821299 2025] [:error] [pid 1727:tid 1734] [client 4.247.149.190:10049] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aTPw1sD83luYT37-ZaXvmgAAAkU"]
[Sat Dec 06 17:01:11.184638 2025] [:error] [pid 48399:tid 48410] [client 4.247.149.190:40887] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aTPw1-jNPOrIshd8EwejLAAAAck"]
[Sat Dec 06 17:01:11.552220 2025] [:error] [pid 48399:tid 48413] [client 4.247.149.190:41813] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aTPw1-jNPOrIshd8EwejLgAAAcw"]
[Sat Dec 06 17:01:12.003259 2025] [:error] [pid 1727:tid 1731] [client 4.247.149.190:22565] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aTPw2MD83luYT37-ZaXvngAAAkI"]
[Sat Dec 06 17:01:12.350269 2025] [:error] [pid 35591:tid 35599] [client 4.247.149.190:39386] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTPw2Ibmw-7bFvTxc9P73QAAAQY"]
[Sat Dec 06 17:01:12.788039 2025] [:error] [pid 1727:tid 1746] [client 4.247.149.190:39369] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTPw2MD83luYT37-ZaXvoAAAAlE"]
[Sat Dec 06 17:01:13.189247 2025] [:error] [pid 1838:tid 1853] [client 4.247.149.190:39374] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTPw2S5zgnu67Yo7vrbbuQAAAoc"]
[Sat Dec 06 17:01:13.682672 2025] [:error] [pid 1727:tid 1738] [client 4.247.149.190:43151] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTPw2cD83luYT37-ZaXvogAAAkk"]
[Sat Dec 06 17:01:14.131663 2025] [:error] [pid 1727:tid 1732] [client 4.247.149.190:43172] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aTPw2sD83luYT37-ZaXvpAAAAkM"]
[Sat Dec 06 17:01:14.622748 2025] [:error] [pid 1727:tid 1730] [client 4.247.149.190:37203] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aTPw2sD83luYT37-ZaXvpQAAAkE"]
[Sat Dec 06 17:01:15.061248 2025] [:error] [pid 35622:tid 35661] [client 4.247.149.190:41797] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aTPw2yOSP_9DVLgFwI6m4gAAAYo"]
[Sat Dec 06 17:01:15.442541 2025] [:error] [pid 35622:tid 35659] [client 4.247.149.190:10083] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aTPw2yOSP_9DVLgFwI6m5QAAAYg"]
[Sat Dec 06 17:01:15.875179 2025] [:error] [pid 61217:tid 61287] [client 4.247.149.190:41799] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aTPw21dSKQYfLI3fYo5r-gAAAI4"]
[Sat Dec 06 17:01:16.367122 2025] [:error] [pid 1727:tid 1743] [client 4.247.149.190:43180] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aTPw3MD83luYT37-ZaXvpwAAAk4"]
[Sat Dec 06 17:01:16.701639 2025] [:error] [pid 61217:tid 61294] [client 4.247.149.190:39417] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aTPw3FdSKQYfLI3fYo5r-wAAAJU"]
[Sat Dec 06 17:01:17.213442 2025] [:error] [pid 48399:tid 48425] [client 4.247.149.190:10062] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aTPw3ejNPOrIshd8EwejMQAAAdg"]
[Sat Dec 06 17:01:17.587813 2025] [:error] [pid 61303:tid 61322] [client 4.247.149.190:22545] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTPw3dwK_fe00OH7zy509AAAAM8"]
[Sat Dec 06 17:01:18.103318 2025] [:error] [pid 61215:tid 61222] [client 4.247.149.190:40837] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTPw3uOOZ8nTCBYuI-wvrwAAAAM"]
[Sat Dec 06 17:01:18.580285 2025] [:error] [pid 61217:tid 61295] [client 4.247.149.190:32436] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTPw3ldSKQYfLI3fYo5sAQAAAJY"]
[Sat Dec 06 17:01:19.027268 2025] [:error] [pid 1727:tid 1730] [client 4.247.149.190:40516] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTPw38D83luYT37-ZaXvqgAAAkE"]
[Sat Dec 06 17:01:19.434922 2025] [:error] [pid 61303:tid 61314] [client 4.247.149.190:37226] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aTPw39wK_fe00OH7zy509wAAAMg"]
[Sat Dec 06 17:01:19.896849 2025] [:error] [pid 61217:tid 61274] [client 4.247.149.190:32421] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aTPw31dSKQYfLI3fYo5sBgAAAIE"]
[Sat Dec 06 17:01:20.257454 2025] [:error] [pid 1727:tid 1742] [client 4.247.149.190:10061] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aTPw4MD83luYT37-ZaXvrwAAAk0"]
[Sat Dec 06 17:01:20.662630 2025] [:error] [pid 1838:tid 1864] [client 4.247.149.190:10056] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aTPw4C5zgnu67Yo7vrbbxQAAApI"]
[Sat Dec 06 17:01:21.058169 2025] [:error] [pid 61215:tid 61238] [client 4.247.149.190:39410] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTPw4eOOZ8nTCBYuI-wvtAAAABM"]
[Sat Dec 06 17:01:21.388791 2025] [:error] [pid 61215:tid 61229] [client 4.247.149.190:42829] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTPw4eOOZ8nTCBYuI-wvtQAAAAo"]
[Sat Dec 06 17:01:21.884437 2025] [:error] [pid 61215:tid 61234] [client 4.247.149.190:43196] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTPw4eOOZ8nTCBYuI-wvtgAAAA8"]
[Sat Dec 06 17:01:22.468057 2025] [:error] [pid 48399:tid 48401] [client 4.247.149.190:27158] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTPw4ujNPOrIshd8EwejNAAAAcA"]
[Sat Dec 06 17:01:22.843344 2025] [:error] [pid 35622:tid 35653] [client 4.247.149.190:42836] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTPw4iOSP_9DVLgFwI6m6gAAAYI"]
[Sat Dec 06 17:01:23.307997 2025] [:error] [pid 48399:tid 48411] [client 4.247.149.190:40891] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTPw4-jNPOrIshd8EwejNQAAAco"]
[Sat Dec 06 17:01:23.823270 2025] [:error] [pid 48399:tid 48415] [client 4.247.149.190:39385] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTPw4-jNPOrIshd8EwejNgAAAc4"]
[Sat Dec 06 17:01:24.227879 2025] [:error] [pid 61215:tid 61233] [client 4.247.149.190:27162] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTPw5OOOZ8nTCBYuI-wvvQAAAA4"]
[Sat Dec 06 17:01:24.993695 2025] [:error] [pid 48399:tid 48414] [client 4.247.149.190:39382] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aTPw5OjNPOrIshd8EwejOAAAAc0"]
[Sat Dec 06 17:01:25.320172 2025] [:error] [pid 52809:tid 52817] [client 4.247.149.190:42871] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aTPw5erRwgsmpIJQ2qZcDgAAAgY"]
[Sat Dec 06 17:01:25.697405 2025] [:error] [pid 1838:tid 1865] [client 4.247.149.190:27168] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aTPw5S5zgnu67Yo7vrbbygAAApM"]
[Sat Dec 06 17:01:26.176400 2025] [:error] [pid 61216:tid 61255] [client 4.247.149.190:32435] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aTPw5jHlXXVdP5ewviX4tAAAAEk"]
[Sat Dec 06 17:01:26.650293 2025] [:error] [pid 61216:tid 61249] [client 4.247.149.190:40574] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPw5jHlXXVdP5ewviX4tgAAAEM"]
[Sat Dec 06 17:01:27.223793 2025] [:error] [pid 35622:tid 35658] [client 4.247.149.190:32441] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPw5yOSP_9DVLgFwI6m7AAAAYc"]
[Sat Dec 06 17:01:27.650310 2025] [:error] [pid 35591:tid 35597] [client 4.247.149.190:37221] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPw54bmw-7bFvTxc9P76QAAAQQ"]
[Sat Dec 06 17:01:28.268488 2025] [:error] [pid 52809:tid 52830] [client 4.247.149.190:40557] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPw6OrRwgsmpIJQ2qZcFwAAAhM"]
[Sat Dec 06 17:01:28.699162 2025] [:error] [pid 52809:tid 52835] [client 4.247.149.190:40838] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTPw6OrRwgsmpIJQ2qZcGQAAAhg"]
[Sat Dec 06 17:01:29.205431 2025] [:error] [pid 61215:tid 61228] [client 4.247.149.190:37217] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTPw6eOOZ8nTCBYuI-wvwwAAAAk"]
[Sat Dec 06 17:01:29.679744 2025] [:error] [pid 52809:tid 52811] [client 4.247.149.190:46464] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTPw6erRwgsmpIJQ2qZcGgAAAgA"]
[Sat Dec 06 17:01:30.275317 2025] [:error] [pid 61216:tid 61258] [client 4.247.149.190:22559] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTPw6jHlXXVdP5ewviX4uwAAAEw"]
[Sat Dec 06 17:01:30.697138 2025] [:error] [pid 1838:tid 1855] [client 4.247.149.190:32395] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTPw6i5zgnu67Yo7vrbbzgAAAok"]
[Sat Dec 06 17:01:31.189491 2025] [:error] [pid 61303:tid 61310] [client 4.247.149.190:22542] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTPw69wK_fe00OH7zy51AgAAAMQ"]
[Sat Dec 06 17:01:31.589658 2025] [:error] [pid 52809:tid 52817] [client 4.247.149.190:45520] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTPw6-rRwgsmpIJQ2qZcHgAAAgY"]
[Sat Dec 06 17:01:32.062849 2025] [:error] [pid 35591:tid 35614] [client 4.247.149.190:40847] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTPw7Ibmw-7bFvTxc9P77gAAARU"]
[Sat Dec 06 17:01:32.432177 2025] [:error] [pid 1727:tid 1735] [client 4.247.149.190:39423] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aTPw7MD83luYT37-ZaXvvwAAAkY"]
[Sat Dec 06 17:01:33.006248 2025] [:error] [pid 61216:tid 61264] [client 4.247.149.190:40563] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aTPw7THlXXVdP5ewviX4wAAAAFI"]
[Sat Dec 06 17:01:33.998180 2025] [:error] [pid 35622:tid 35665] [client 4.247.149.190:22552] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aTPw7SOSP_9DVLgFwI6m7QAAAY4"]
[Sat Dec 06 17:01:34.598246 2025] [:error] [pid 61303:tid 61319] [client 4.247.149.190:51011] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aTPw7twK_fe00OH7zy51BQAAAM0"]
[Sat Dec 06 17:01:34.969708 2025] [:error] [pid 48399:tid 48403] [client 4.247.149.190:43140] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTPw7ujNPOrIshd8EwejRAAAAcI"]
[Sat Dec 06 17:01:35.458722 2025] [:error] [pid 61216:tid 61250] [client 4.247.149.190:22528] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTPw7zHlXXVdP5ewviX4wwAAAEQ"]
[Sat Dec 06 17:01:35.865744 2025] [:error] [pid 35622:tid 35661] [client 4.247.149.190:22572] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTPw7yOSP_9DVLgFwI6m8AAAAYo"]
[Sat Dec 06 17:01:36.231292 2025] [:error] [pid 52809:tid 52835] [client 4.247.149.190:22570] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTPw8OrRwgsmpIJQ2qZcIwAAAhg"]
[Sat Dec 06 17:01:36.581089 2025] [:error] [pid 35591:tid 35600] [client 4.247.149.190:51010] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/text.php"] [unique_id "aTPw8Ibmw-7bFvTxc9P79AAAAQc"]
[Sat Dec 06 17:01:37.120740 2025] [:error] [pid 35622:tid 35660] [client 4.247.149.190:46480] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/text.php"] [unique_id "aTPw8SOSP_9DVLgFwI6m8gAAAYk"]
[Sat Dec 06 17:01:37.510832 2025] [:error] [pid 1727:tid 1751] [client 4.247.149.190:27330] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/text.php"] [unique_id "aTPw8cD83luYT37-ZaXvxgAAAlY"]
[Sat Dec 06 17:01:37.845385 2025] [:error] [pid 1727:tid 1753] [client 4.247.149.190:39414] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/text.php"] [unique_id "aTPw8cD83luYT37-ZaXvyAAAAlg"]
[Sat Dec 06 17:01:38.312018 2025] [:error] [pid 61303:tid 61331] [client 4.247.149.190:10092] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPw8twK_fe00OH7zy51CgAAANg"]
[Sat Dec 06 17:01:38.649017 2025] [:error] [pid 1727:tid 1738] [client 4.247.149.190:10059] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPw8sD83luYT37-ZaXvyQAAAkk"]
[Sat Dec 06 17:01:39.029986 2025] [:error] [pid 61303:tid 61309] [client 4.247.149.190:10077] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPw89wK_fe00OH7zy51CwAAAMM"]
[Sat Dec 06 17:01:39.490343 2025] [:error] [pid 61303:tid 61315] [client 4.247.149.190:27359] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPw89wK_fe00OH7zy51DAAAAMk"]
[Sat Dec 06 17:01:39.974712 2025] [:error] [pid 1727:tid 1730] [client 4.247.149.190:42680] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTPw88D83luYT37-ZaXvygAAAkE"]
[Sat Dec 06 17:01:40.289970 2025] [:error] [pid 1727:tid 1742] [client 4.247.149.190:42456] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTPw9MD83luYT37-ZaXvzAAAAk0"]
[Sat Dec 06 17:01:40.773717 2025] [:error] [pid 48399:tid 48414] [client 4.247.149.190:48709] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTPw9OjNPOrIshd8EwejRwAAAc0"]
[Sat Dec 06 17:01:41.187838 2025] [:error] [pid 1727:tid 1741] [client 4.247.149.190:40891] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTPw9cD83luYT37-ZaXv0AAAAkw"]
[Sat Dec 06 17:01:41.511782 2025] [:error] [pid 61216:tid 61247] [client 4.247.149.190:49517] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aTPw9THlXXVdP5ewviX4ygAAAEE"]
[Sat Dec 06 17:01:41.858217 2025] [:error] [pid 61217:tid 61275] [client 4.247.149.190:59760] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aTPw9VdSKQYfLI3fYo5sIQAAAII"]
[Sat Dec 06 17:01:42.178234 2025] [:error] [pid 1727:tid 1746] [client 4.247.149.190:42670] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aTPw9sD83luYT37-ZaXv1AAAAlE"]
[Sat Dec 06 17:01:42.520630 2025] [:error] [pid 52809:tid 52833] [client 4.247.149.190:49475] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aTPw9urRwgsmpIJQ2qZcJAAAAhY"]
[Sat Dec 06 17:01:43.148599 2025] [:error] [pid 61215:tid 61220] [client 4.247.149.190:42871] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aTPw9-OOZ8nTCBYuI-wvygAAAAE"]
[Sat Dec 06 17:01:43.664539 2025] [:error] [pid 35622:tid 35675] [client 4.247.149.190:59739] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aTPw9yOSP_9DVLgFwI6m9gAAAZg"]
[Sat Dec 06 17:01:44.108605 2025] [:error] [pid 48399:tid 48410] [client 4.247.149.190:50958] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aTPw-OjNPOrIshd8EwejSQAAAck"]
[Sat Dec 06 17:01:44.716617 2025] [:error] [pid 61216:tid 61265] [client 4.247.149.190:41167] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aTPw-DHlXXVdP5ewviX4zgAAAFM"]
[Sat Dec 06 17:01:45.175265 2025] [:error] [pid 61303:tid 61318] [client 4.247.149.190:20591] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTPw-dwK_fe00OH7zy51DQAAAMw"]
[Sat Dec 06 17:01:45.623526 2025] [:error] [pid 61215:tid 61238] [client 4.247.149.190:20579] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTPw-eOOZ8nTCBYuI-wvzgAAABM"]
[Sat Dec 06 17:01:48.202531 2025] [:error] [pid 52809:tid 52828] [client 4.247.149.190:41176] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTPw_OrRwgsmpIJQ2qZcJQAAAhE"]
[Sat Dec 06 17:01:48.847723 2025] [:error] [pid 61215:tid 61231] [client 4.247.149.190:41278] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTPw_OOOZ8nTCBYuI-wv1QAAAAw"]
[Sat Dec 06 17:01:49.351944 2025] [:error] [pid 52809:tid 52819] [client 4.247.149.190:41461] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTPw_erRwgsmpIJQ2qZcJwAAAgg"]
[Sat Dec 06 17:01:49.688486 2025] [:error] [pid 35622:tid 35666] [client 4.247.149.190:38220] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTPw_SOSP_9DVLgFwI6m-QAAAY8"]
[Sat Dec 06 17:01:50.196540 2025] [:error] [pid 61217:tid 61284] [client 4.247.149.190:38251] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTPw_ldSKQYfLI3fYo5sJQAAAIs"]
[Sat Dec 06 17:01:50.933770 2025] [:error] [pid 61216:tid 61257] [client 4.247.149.190:33110] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTPw_jHlXXVdP5ewviX41QAAAEs"]
[Sat Dec 06 17:01:51.322758 2025] [:error] [pid 61303:tid 61326] [client 4.247.149.190:59707] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aTPw_9wK_fe00OH7zy51EgAAANM"]
[Sat Dec 06 17:01:51.867574 2025] [:error] [pid 35591:tid 35602] [client 4.247.149.190:42158] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aTPw_4bmw-7bFvTxc9P8CAAAAQk"]
[Sat Dec 06 17:01:52.360140 2025] [:error] [pid 1838:tid 1855] [client 4.247.149.190:49459] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aTPxAC5zgnu67Yo7vrbb2gAAAok"]
[Sat Dec 06 17:01:52.865487 2025] [:error] [pid 1727:tid 1732] [client 4.247.149.190:10210] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aTPxAMD83luYT37-ZaXv8AAAAkM"]
[Sat Dec 06 17:01:53.281403 2025] [:error] [pid 61216:tid 61254] [client 4.247.149.190:17642] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTPxATHlXXVdP5ewviX41wAAAEg"]
[Sat Dec 06 17:01:53.869216 2025] [:error] [pid 52809:tid 52820] [client 4.247.149.190:42697] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTPxAerRwgsmpIJQ2qZcMQAAAgk"]
[Sat Dec 06 17:01:54.462532 2025] [:error] [pid 48399:tid 48406] [client 4.247.149.190:26281] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTPxAujNPOrIshd8EwejUAAAAcU"]
[Sat Dec 06 17:01:54.919989 2025] [:error] [pid 1727:tid 1729] [client 4.247.149.190:9987] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTPxAsD83luYT37-ZaXv8QAAAkA"]
[Sat Dec 06 17:01:55.364519 2025] [:error] [pid 61303:tid 61321] [client 4.247.149.190:43220] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/css_compare.php"] [unique_id "aTPxA9wK_fe00OH7zy51FAAAAM4"]
[Sat Dec 06 17:01:55.721563 2025] [:error] [pid 61303:tid 61329] [client 4.247.149.190:17631] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/css_compare.php"] [unique_id "aTPxA9wK_fe00OH7zy51FQAAANY"]
[Sat Dec 06 17:01:56.044165 2025] [:error] [pid 1838:tid 1859] [client 4.247.149.190:32860] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/css_compare.php"] [unique_id "aTPxBC5zgnu67Yo7vrbb4AAAAo0"]
[Sat Dec 06 17:01:56.416350 2025] [:error] [pid 1838:tid 1868] [client 4.247.149.190:10000] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/css_compare.php"] [unique_id "aTPxBC5zgnu67Yo7vrbb4QAAApY"]
[Sat Dec 06 17:01:56.776613 2025] [:error] [pid 35622:tid 35673] [client 4.247.149.190:52933] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTPxBCOSP_9DVLgFwI6m_wAAAZY"]
[Sat Dec 06 17:01:57.136330 2025] [:error] [pid 1727:tid 1747] [client 4.247.149.190:43221] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTPxBcD83luYT37-ZaXv8wAAAlI"]
[Sat Dec 06 17:01:57.671160 2025] [:error] [pid 1727:tid 1742] [client 4.247.149.190:42717] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTPxBcD83luYT37-ZaXv9AAAAk0"]
[Sat Dec 06 17:01:58.156731 2025] [:error] [pid 1838:tid 1865] [client 4.247.149.190:17653] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTPxBi5zgnu67Yo7vrbb5AAAApM"]
[Sat Dec 06 17:01:58.524013 2025] [:error] [pid 52809:tid 52817] [client 4.247.149.190:52971] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aTPxBurRwgsmpIJQ2qZcOQAAAgY"]
[Sat Dec 06 17:01:59.022737 2025] [:error] [pid 1838:tid 1847] [client 4.247.149.190:17606] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aTPxBy5zgnu67Yo7vrbb5wAAAoE"]
[Sat Dec 06 17:01:59.472745 2025] [:error] [pid 35591:tid 35612] [client 4.247.149.190:52965] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aTPxB4bmw-7bFvTxc9P8DQAAARM"]
[Sat Dec 06 17:01:59.855045 2025] [:error] [pid 1727:tid 1740] [client 4.247.149.190:17636] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aTPxB8D83luYT37-ZaXv9wAAAks"]
[Sat Dec 06 17:02:00.147862 2025] [:error] [pid 61216:tid 61261] [client 4.247.149.190:22841] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/duck.php"] [unique_id "aTPxCDHlXXVdP5ewviX43wAAAE8"]
[Sat Dec 06 17:02:00.615584 2025] [:error] [pid 35591:tid 35594] [client 4.247.149.190:43204] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/duck.php"] [unique_id "aTPxCIbmw-7bFvTxc9P8DgAAAQE"]
[Sat Dec 06 17:02:01.008195 2025] [:error] [pid 61217:tid 61290] [client 4.247.149.190:15718] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/duck.php"] [unique_id "aTPxCVdSKQYfLI3fYo5sKgAAAJE"]
[Sat Dec 06 17:02:01.332235 2025] [:error] [pid 61217:tid 61296] [client 4.247.149.190:32881] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/duck.php"] [unique_id "aTPxCVdSKQYfLI3fYo5sKwAAAJc"]
[Sat Dec 06 17:02:01.825900 2025] [:error] [pid 1838:tid 1860] [client 4.247.149.190:43249] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTPxCS5zgnu67Yo7vrbb8AAAAo4"]
[Sat Dec 06 17:02:02.137400 2025] [:error] [pid 61303:tid 61309] [client 4.247.149.190:32886] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTPxCtwK_fe00OH7zy51GwAAAMM"]
[Sat Dec 06 17:02:02.613990 2025] [:error] [pid 61215:tid 61235] [client 4.247.149.190:27905] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTPxCuOOZ8nTCBYuI-wv3gAAABA"]
[Sat Dec 06 17:02:02.991631 2025] [:error] [pid 1838:tid 1848] [client 4.247.149.190:26254] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTPxCi5zgnu67Yo7vrbb8wAAAoI"]
[Sat Dec 06 17:02:03.328834 2025] [:error] [pid 61303:tid 61327] [client 4.247.149.190:22795] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aTPxC9wK_fe00OH7zy51HAAAANQ"]
[Sat Dec 06 17:02:03.983112 2025] [:error] [pid 61215:tid 61220] [client 4.247.149.190:27937] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aTPxC-OOZ8nTCBYuI-wv4AAAAAE"]
[Sat Dec 06 17:02:04.369960 2025] [:error] [pid 48399:tid 48423] [client 4.247.149.190:15680] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aTPxDOjNPOrIshd8EwejXQAAAdY"]
[Sat Dec 06 17:02:04.895269 2025] [:error] [pid 61303:tid 61314] [client 4.247.149.190:15709] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aTPxDNwK_fe00OH7zy51HgAAAMg"]
[Sat Dec 06 17:02:05.252650 2025] [:error] [pid 1727:tid 1744] [client 4.247.149.190:52935] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxDcD83luYT37-ZaXv-wAAAk8"]
[Sat Dec 06 17:02:05.671303 2025] [:error] [pid 61217:tid 61278] [client 4.247.149.190:32841] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxDVdSKQYfLI3fYo5sLQAAAIU"]
[Sat Dec 06 17:02:06.070424 2025] [:error] [pid 61217:tid 61288] [client 4.247.149.190:32879] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxDldSKQYfLI3fYo5sLwAAAI8"]
[Sat Dec 06 17:02:06.649894 2025] [:error] [pid 61303:tid 61326] [client 4.247.149.190:15689] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxDtwK_fe00OH7zy51HwAAANM"]
[Sat Dec 06 17:02:07.155130 2025] [:error] [pid 35591:tid 35614] [client 4.247.149.190:52987] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aTPxD4bmw-7bFvTxc9P8FgAAARU"]
[Sat Dec 06 17:02:07.629706 2025] [:error] [pid 61303:tid 61306] [client 4.247.149.190:43212] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aTPxD9wK_fe00OH7zy51IQAAAMA"]
[Sat Dec 06 17:02:08.307976 2025] [:error] [pid 52809:tid 52835] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Dec 06 17:02:08.455004 2025] [:error] [pid 52809:tid 52811] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/siteheads.php
[Sat Dec 06 17:02:08.602692 2025] [:error] [pid 52809:tid 52827] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Dec 06 17:02:08.753753 2025] [:error] [pid 52809:tid 52815] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Dec 06 17:02:09.047505 2025] [:error] [pid 52809:tid 52828] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Dec 06 17:02:09.193984 2025] [:error] [pid 52809:tid 52825] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Sat Dec 06 17:02:09.659078 2025] [:error] [pid 52809:tid 52819] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/rss.php
[Sat Dec 06 17:02:09.805120 2025] [:error] [pid 52809:tid 52817] [client 4.247.149.190:27942] File does not exist: /usr/local/apache/htdocs/suspended-page/pekok.php
[Sat Dec 06 17:02:09.971665 2025] [:error] [pid 52809:tid 52829] [client 4.247.149.190:27942] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aTPxEerRwgsmpIJQ2qZcXQAAAhI"]
[Sat Dec 06 17:02:10.367068 2025] [:error] [pid 61303:tid 61309] [client 4.247.149.190:32838] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aTPxEtwK_fe00OH7zy51KgAAAMM"]
[Sat Dec 06 17:02:10.729364 2025] [:error] [pid 1838:tid 1866] [client 4.247.149.190:22792] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aTPxEi5zgnu67Yo7vrbb_wAAApQ"]
[Sat Dec 06 17:02:11.084839 2025] [:error] [pid 1838:tid 1863] [client 4.247.149.190:17621] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aTPxEy5zgnu67Yo7vrbcAgAAApE"]
[Sat Dec 06 17:02:11.402201 2025] [:error] [pid 1838:tid 1864] [client 4.247.149.190:26283] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aTPxEy5zgnu67Yo7vrbcBAAAApI"]
[Sat Dec 06 17:02:11.718840 2025] [:error] [pid 35591:tid 35605] [client 4.247.149.190:52988] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aTPxE4bmw-7bFvTxc9P8GQAAAQw"]
[Sat Dec 06 17:02:12.046931 2025] [:error] [pid 61303:tid 61310] [client 4.247.149.190:17806] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aTPxFNwK_fe00OH7zy51LQAAAMQ"]
[Sat Dec 06 17:02:12.404718 2025] [:error] [pid 1838:tid 1868] [client 4.247.149.190:27940] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aTPxFC5zgnu67Yo7vrbcBwAAApY"]
[Sat Dec 06 17:02:12.743744 2025] [:error] [pid 52809:tid 52811] [client 4.247.149.190:52953] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aTPxFOrRwgsmpIJQ2qZcYAAAAgA"]
[Sat Dec 06 17:02:13.123310 2025] [:error] [pid 61217:tid 61282] [client 4.247.149.190:27907] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aTPxFVdSKQYfLI3fYo5sNQAAAIk"]
[Sat Dec 06 17:02:13.484530 2025] [:error] [pid 1838:tid 1852] [client 4.247.149.190:27928] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aTPxFS5zgnu67Yo7vrbcCgAAAoY"]
[Sat Dec 06 17:02:13.896490 2025] [:error] [pid 61215:tid 61242] [client 4.247.149.190:22835] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aTPxFeOOZ8nTCBYuI-wv5wAAABc"]
[Sat Dec 06 17:02:14.228858 2025] [:error] [pid 1727:tid 1747] [client 4.247.149.190:17809] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/categories.php"] [unique_id "aTPxFsD83luYT37-ZaXwAQAAAlI"]
[Sat Dec 06 17:02:14.610923 2025] [:error] [pid 61216:tid 61264] [client 4.247.149.190:26275] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/categories.php"] [unique_id "aTPxFjHlXXVdP5ewviX44gAAAFI"]
[Sat Dec 06 17:02:15.007885 2025] [:error] [pid 1838:tid 1870] [client 4.247.149.190:17628] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/categories.php"] [unique_id "aTPxFy5zgnu67Yo7vrbcEQAAApg"]
[Sat Dec 06 17:02:15.310662 2025] [:error] [pid 61303:tid 61326] [client 4.247.149.190:17603] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/categories.php"] [unique_id "aTPxF9wK_fe00OH7zy51MgAAANM"]
[Sat Dec 06 17:02:15.816173 2025] [:error] [pid 1838:tid 1850] [client 4.247.149.190:22788] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aTPxFy5zgnu67Yo7vrbcFwAAAoQ"]
[Sat Dec 06 17:02:16.150736 2025] [:error] [pid 61216:tid 61270] [client 4.247.149.190:26240] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aTPxGDHlXXVdP5ewviX45QAAAFg"]
[Sat Dec 06 17:02:16.629292 2025] [:error] [pid 1838:tid 1868] [client 4.247.149.190:27950] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aTPxGC5zgnu67Yo7vrbcGQAAApY"]
[Sat Dec 06 17:02:16.987223 2025] [:error] [pid 61215:tid 61241] [client 4.247.149.190:32847] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aTPxGOOOZ8nTCBYuI-wv6wAAABY"]
[Sat Dec 06 17:02:17.311806 2025] [:error] [pid 1838:tid 1865] [client 4.247.149.190:15734] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/refund.php"] [unique_id "aTPxGS5zgnu67Yo7vrbcHAAAApM"]
[Sat Dec 06 17:02:17.689300 2025] [:error] [pid 1838:tid 1858] [client 4.247.149.190:22831] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/refund.php"] [unique_id "aTPxGS5zgnu67Yo7vrbcHQAAAow"]
[Sat Dec 06 17:02:18.008488 2025] [:error] [pid 61303:tid 61311] [client 4.247.149.190:22819] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/refund.php"] [unique_id "aTPxGtwK_fe00OH7zy51NAAAAMU"]
[Sat Dec 06 17:02:18.308151 2025] [:error] [pid 1838:tid 1857] [client 4.247.149.190:15694] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/refund.php"] [unique_id "aTPxGi5zgnu67Yo7vrbcIAAAAos"]
[Sat Dec 06 17:02:18.718525 2025] [:error] [pid 61217:tid 61278] [client 4.247.149.190:22816] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aTPxGldSKQYfLI3fYo5sPAAAAIU"]
[Sat Dec 06 17:02:19.203001 2025] [:error] [pid 1838:tid 1854] [client 4.247.149.190:26249] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aTPxGy5zgnu67Yo7vrbcIwAAAog"]
[Sat Dec 06 17:02:19.737403 2025] [:error] [pid 1838:tid 1860] [client 4.247.149.190:22793] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aTPxGy5zgnu67Yo7vrbcJQAAAo4"]
[Sat Dec 06 17:02:20.150866 2025] [:error] [pid 1727:tid 1735] [client 4.247.149.190:26250] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aTPxHMD83luYT37-ZaXwBAAAAkY"]
[Sat Dec 06 17:02:20.512640 2025] [:error] [pid 61303:tid 61312] [client 4.247.149.190:22824] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wishlist.php"] [unique_id "aTPxHNwK_fe00OH7zy51NgAAAMY"]
[Sat Dec 06 17:02:20.905524 2025] [:error] [pid 61217:tid 61286] [client 4.247.149.190:15695] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wishlist.php"] [unique_id "aTPxHFdSKQYfLI3fYo5sPwAAAI0"]
[Sat Dec 06 17:02:21.411479 2025] [:error] [pid 35591:tid 35595] [client 4.247.149.190:26251] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wishlist.php"] [unique_id "aTPxHYbmw-7bFvTxc9P8GgAAAQI"]
[Sat Dec 06 17:02:21.903748 2025] [:error] [pid 52809:tid 52824] [client 4.247.149.190:15684] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wishlist.php"] [unique_id "aTPxHerRwgsmpIJQ2qZcZQAAAg0"]
[Sat Dec 06 17:02:22.240382 2025] [:error] [pid 35622:tid 35661] [client 4.247.149.190:52981] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/results.php"] [unique_id "aTPxHiOSP_9DVLgFwI6nCgAAAYo"]
[Sat Dec 06 17:02:22.709113 2025] [:error] [pid 35591:tid 35606] [client 4.247.149.190:26284] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/results.php"] [unique_id "aTPxHobmw-7bFvTxc9P8HQAAAQ0"]
[Sat Dec 06 17:02:23.030310 2025] [:error] [pid 35591:tid 35609] [client 4.247.149.190:26295] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/results.php"] [unique_id "aTPxH4bmw-7bFvTxc9P8HgAAARA"]
[Sat Dec 06 17:02:23.364422 2025] [:error] [pid 48399:tid 48410] [client 4.247.149.190:9249] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/results.php"] [unique_id "aTPxH-jNPOrIshd8EwejZAAAAck"]
[Sat Dec 06 17:02:23.752109 2025] [:error] [pid 1727:tid 1737] [client 4.247.149.190:42699] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxH8D83luYT37-ZaXwBgAAAkg"]
[Sat Dec 06 17:02:24.079626 2025] [:error] [pid 1727:tid 1746] [client 4.247.149.190:52985] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxIMD83luYT37-ZaXwBwAAAlE"]
[Sat Dec 06 17:02:24.396413 2025] [:error] [pid 1727:tid 1751] [client 4.247.149.190:43238] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxIMD83luYT37-ZaXwCAAAAlY"]
[Sat Dec 06 17:02:24.855894 2025] [:error] [pid 35622:tid 35659] [client 4.247.149.190:52970] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aTPxICOSP_9DVLgFwI6nDAAAAYg"]
[Sat Dec 06 17:02:25.352745 2025] [:error] [pid 1727:tid 1752] [client 4.247.149.190:15742] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTPxIcD83luYT37-ZaXwCgAAAlc"]
[Sat Dec 06 17:02:25.652620 2025] [:error] [pid 1727:tid 1744] [client 4.247.149.190:32857] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTPxIcD83luYT37-ZaXwCwAAAk8"]
[Sat Dec 06 17:02:26.037693 2025] [:error] [pid 35591:tid 35604] [client 4.247.149.190:52941] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTPxIobmw-7bFvTxc9P8IQAAAQs"]
[Sat Dec 06 17:02:26.625429 2025] [:error] [pid 61215:tid 61225] [client 4.247.149.190:43225] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTPxIuOOZ8nTCBYuI-wv8wAAAAY"]
[Sat Dec 06 17:02:26.939743 2025] [:error] [pid 61216:tid 61247] [client 4.247.149.190:43251] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aTPxIjHlXXVdP5ewviX48gAAAEE"]
[Sat Dec 06 17:02:27.248988 2025] [:error] [pid 35591:tid 35615] [client 4.247.149.190:52936] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aTPxI4bmw-7bFvTxc9P8IwAAARY"]
[Sat Dec 06 17:02:27.587494 2025] [:error] [pid 61303:tid 61313] [client 4.247.149.190:22822] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aTPxI9wK_fe00OH7zy51OAAAAMc"]
[Sat Dec 06 17:02:27.915653 2025] [:error] [pid 35591:tid 35596] [client 4.247.149.190:43234] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aTPxI4bmw-7bFvTxc9P8JAAAAQM"]
[Sat Dec 06 17:02:28.244735 2025] [:error] [pid 48399:tid 48417] [client 4.247.149.190:27904] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aTPxJOjNPOrIshd8EwejZwAAAdA"]
[Sat Dec 06 17:02:28.595358 2025] [:error] [pid 48399:tid 48406] [client 4.247.149.190:22843] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aTPxJOjNPOrIshd8EwejaQAAAcU"]
[Sat Dec 06 17:02:28.890991 2025] [:error] [pid 48399:tid 48403] [client 4.247.149.190:17604] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aTPxJOjNPOrIshd8EwejawAAAcI"]
[Sat Dec 06 17:02:29.247654 2025] [:error] [pid 48399:tid 48405] [client 4.247.149.190:17827] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aTPxJejNPOrIshd8EwejbAAAAcQ"]
[Sat Dec 06 17:02:29.589720 2025] [:error] [pid 48399:tid 48411] [client 4.247.149.190:43254] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aTPxJejNPOrIshd8EwejbwAAAco"]
[Sat Dec 06 17:02:29.916219 2025] [:error] [pid 48399:tid 48424] [client 4.247.149.190:9234] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aTPxJejNPOrIshd8EwejcgAAAdc"]
[Sat Dec 06 17:02:30.220503 2025] [:error] [pid 35591:tid 35594] [client 4.247.149.190:22528] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aTPxJobmw-7bFvTxc9P8KAAAAQE"]
[Sat Dec 06 17:02:30.655898 2025] [:error] [pid 1838:tid 1865] [client 4.247.149.190:26266] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aTPxJi5zgnu67Yo7vrbcLAAAApM"]
[Sat Dec 06 17:02:30.972475 2025] [:error] [pid 35591:tid 35605] [client 4.247.149.190:27946] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aTPxJobmw-7bFvTxc9P8KQAAAQw"]
[Sat Dec 06 17:02:31.293605 2025] [:error] [pid 35591:tid 35600] [client 4.247.149.190:15725] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aTPxJ4bmw-7bFvTxc9P8KgAAAQc"]
[Sat Dec 06 17:02:31.649150 2025] [:error] [pid 52809:tid 52815] [client 4.247.149.190:43232] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aTPxJ-rRwgsmpIJQ2qZcagAAAgQ"]
[Sat Dec 06 17:02:31.934315 2025] [:error] [pid 61303:tid 61329] [client 4.247.149.190:43228] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aTPxJ9wK_fe00OH7zy51OwAAANY"]
[Sat Dec 06 17:02:32.295956 2025] [:error] [pid 35622:tid 35674] [client 4.247.149.190:17832] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTPxKCOSP_9DVLgFwI6nEgAAAZc"]
[Sat Dec 06 17:02:32.667171 2025] [:error] [pid 52809:tid 52830] [client 4.247.149.190:52976] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTPxKOrRwgsmpIJQ2qZcawAAAhM"]
[Sat Dec 06 17:02:32.972785 2025] [:error] [pid 52809:tid 52833] [client 4.247.149.190:22823] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTPxKOrRwgsmpIJQ2qZcbAAAAhY"]
[Sat Dec 06 17:02:33.294982 2025] [:error] [pid 35622:tid 35665] [client 4.247.149.190:10000] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTPxKSOSP_9DVLgFwI6nFQAAAY4"]
[Sat Dec 06 17:02:33.703935 2025] [:error] [pid 61217:tid 61286] [client 4.247.149.190:10136] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTPxKVdSKQYfLI3fYo5sTAAAAI0"]
[Sat Dec 06 17:02:33.999254 2025] [:error] [pid 1727:tid 1738] [client 4.247.149.190:15741] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTPxKcD83luYT37-ZaXwFgAAAkk"]
[Sat Dec 06 17:02:34.337082 2025] [:error] [pid 52809:tid 52831] [client 4.247.149.190:52986] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTPxKurRwgsmpIJQ2qZcbwAAAhQ"]
[Sat Dec 06 17:02:34.704187 2025] [:error] [pid 1727:tid 1732] [client 4.247.149.190:43207] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTPxKsD83luYT37-ZaXwGQAAAkM"]
[Sat Dec 06 17:02:35.071370 2025] [:error] [pid 1727:tid 1753] [client 4.247.149.190:9242] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTPxK8D83luYT37-ZaXwGwAAAlg"]
[Sat Dec 06 17:02:35.379707 2025] [:error] [pid 1727:tid 1747] [client 4.247.149.190:43205] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTPxK8D83luYT37-ZaXwHQAAAlI"]
[Sat Dec 06 17:02:35.758079 2025] [:error] [pid 35622:tid 35657] [client 4.247.149.190:17793] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTPxKyOSP_9DVLgFwI6nGwAAAYY"]
[Sat Dec 06 17:02:36.111000 2025] [:error] [pid 1727:tid 1735] [client 4.247.149.190:52942] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTPxLMD83luYT37-ZaXwHgAAAkY"]
[Sat Dec 06 17:02:36.419145 2025] [:error] [pid 1838:tid 1853] [client 4.247.149.190:52955] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTPxLC5zgnu67Yo7vrbcLwAAAoc"]
[Sat Dec 06 17:02:36.949098 2025] [:error] [pid 35591:tid 35598] [client 4.247.149.190:15743] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTPxLIbmw-7bFvTxc9P8LQAAAQU"]
[Sat Dec 06 17:02:37.257795 2025] [:error] [pid 1727:tid 1746] [client 4.247.149.190:15722] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTPxLcD83luYT37-ZaXwIgAAAlE"]
[Sat Dec 06 17:02:37.591893 2025] [:error] [pid 61217:tid 61294] [client 4.247.149.190:26303] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTPxLVdSKQYfLI3fYo5sTgAAAJU"]
[Sat Dec 06 17:02:37.970792 2025] [:error] [pid 52809:tid 52834] [client 4.247.149.190:22799] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTPxLerRwgsmpIJQ2qZccQAAAhc"]
[Sat Dec 06 17:02:38.302068 2025] [:error] [pid 61217:tid 61284] [client 4.247.149.190:27933] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTPxLldSKQYfLI3fYo5sTwAAAIs"]
[Sat Dec 06 17:02:38.641262 2025] [:error] [pid 61217:tid 61282] [client 4.247.149.190:22817] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTPxLldSKQYfLI3fYo5sUQAAAIk"]
[Sat Dec 06 17:02:39.006341 2025] [:error] [pid 61303:tid 61331] [client 4.247.149.190:9257] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTPxL9wK_fe00OH7zy51PgAAANg"]
[Sat Dec 06 17:02:39.368474 2025] [:error] [pid 61217:tid 61281] [client 4.247.149.190:9279] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTPxL1dSKQYfLI3fYo5sUgAAAIg"]
[Sat Dec 06 17:02:39.713157 2025] [:error] [pid 61217:tid 61289] [client 4.247.149.190:26300] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTPxL1dSKQYfLI3fYo5sUwAAAJA"]
[Sat Dec 06 17:02:40.069893 2025] [:error] [pid 52809:tid 52819] [client 4.247.149.190:42753] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTPxMOrRwgsmpIJQ2qZchQAAAgg"]
[Sat Dec 06 17:02:40.381509 2025] [:error] [pid 48399:tid 48424] [client 4.247.149.190:41737] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTPxMOjNPOrIshd8EwejdwAAAdc"]
[Sat Dec 06 17:02:40.673373 2025] [:error] [pid 61215:tid 61239] [client 4.247.149.190:39619] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aTPxMOOOZ8nTCBYuI-wv9AAAABQ"]
[Sat Dec 06 17:02:41.053243 2025] [:error] [pid 61216:tid 61262] [client 4.247.149.190:40278] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aTPxMTHlXXVdP5ewviX49AAAAFA"]
[Sat Dec 06 17:02:41.395861 2025] [:error] [pid 61303:tid 61322] [client 4.247.149.190:45212] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aTPxMdwK_fe00OH7zy51RgAAAM8"]
[Sat Dec 06 17:02:41.712059 2025] [:error] [pid 52809:tid 52812] [client 4.247.149.190:50029] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aTPxMerRwgsmpIJQ2qZcigAAAgE"]
[Sat Dec 06 17:02:42.085631 2025] [:error] [pid 61215:tid 61221] [client 4.247.149.190:42789] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aTPxMuOOZ8nTCBYuI-wv9QAAAAI"]
[Sat Dec 06 17:02:42.391957 2025] [:error] [pid 61215:tid 61226] [client 4.247.149.190:45182] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aTPxMuOOZ8nTCBYuI-wv9gAAAAc"]
[Sat Dec 06 17:02:42.695607 2025] [:error] [pid 35591:tid 35612] [client 4.247.149.190:9778] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aTPxMobmw-7bFvTxc9P8MgAAARM"]
[Sat Dec 06 17:02:43.022455 2025] [:error] [pid 61216:tid 61259] [client 4.247.149.190:43502] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aTPxMzHlXXVdP5ewviX49wAAAE0"]
[Sat Dec 06 17:02:43.398389 2025] [:error] [pid 1838:tid 1857] [client 4.247.149.190:49988] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aTPxMy5zgnu67Yo7vrbcQQAAAos"]
[Sat Dec 06 17:02:43.916719 2025] [:error] [pid 61216:tid 61269] [client 4.247.149.190:45211] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aTPxMzHlXXVdP5ewviX4-AAAAFc"]
[Sat Dec 06 17:02:44.295792 2025] [:error] [pid 48399:tid 48418] [client 4.247.149.190:39735] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aTPxNOjNPOrIshd8EwejgAAAAdE"]
[Sat Dec 06 17:02:44.686701 2025] [:error] [pid 61217:tid 61274] [client 4.247.149.190:45163] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aTPxNFdSKQYfLI3fYo5sVwAAAIE"]
[Sat Dec 06 17:02:45.074163 2025] [:error] [pid 61303:tid 61328] [client 4.247.149.190:45224] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPxNdwK_fe00OH7zy51SQAAANU"]
[Sat Dec 06 17:02:45.378785 2025] [:error] [pid 61216:tid 61248] [client 4.247.149.190:42407] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPxNTHlXXVdP5ewviX4-gAAAEI"]
[Sat Dec 06 17:02:45.718479 2025] [:error] [pid 61215:tid 61220] [client 4.247.149.190:45240] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPxNeOOZ8nTCBYuI-wv_wAAAAE"]
[Sat Dec 06 17:02:46.033957 2025] [:error] [pid 61216:tid 61246] [client 4.247.149.190:45234] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTPxNjHlXXVdP5ewviX4_AAAAEA"]
[Sat Dec 06 17:02:46.351925 2025] [:error] [pid 1838:tid 1867] [client 4.247.149.190:42368] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTPxNi5zgnu67Yo7vrbcQwAAApU"]
[Sat Dec 06 17:02:46.700948 2025] [:error] [pid 1838:tid 1860] [client 4.247.149.190:42768] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTPxNi5zgnu67Yo7vrbcRAAAAo4"]
[Sat Dec 06 17:02:47.058521 2025] [:error] [pid 61216:tid 61257] [client 4.247.149.190:42394] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTPxNzHlXXVdP5ewviX4_wAAAEs"]
[Sat Dec 06 17:02:47.357991 2025] [:error] [pid 52809:tid 52831] [client 4.247.149.190:45213] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTPxN-rRwgsmpIJQ2qZckQAAAhQ"]
[Sat Dec 06 17:02:47.773884 2025] [:error] [pid 52809:tid 52832] [client 4.247.149.190:39681] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPxN-rRwgsmpIJQ2qZckgAAAhU"]
[Sat Dec 06 17:02:48.224140 2025] [:error] [pid 52809:tid 52814] [client 4.247.149.190:45180] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPxOOrRwgsmpIJQ2qZckwAAAgM"]
[Sat Dec 06 17:02:48.631610 2025] [:error] [pid 1838:tid 1863] [client 4.247.149.190:9740] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPxOC5zgnu67Yo7vrbcRgAAApE"]
[Sat Dec 06 17:02:49.261022 2025] [:error] [pid 1838:tid 1852] [client 4.247.149.190:42421] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTPxOS5zgnu67Yo7vrbcSQAAAoY"]
[Sat Dec 06 17:02:49.577105 2025] [:error] [pid 61303:tid 61329] [client 4.247.149.190:41514] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aTPxOdwK_fe00OH7zy51TAAAANY"]
[Sat Dec 06 17:02:49.941976 2025] [:error] [pid 1838:tid 1853] [client 4.247.149.190:39729] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aTPxOS5zgnu67Yo7vrbcTQAAAoc"]
[Sat Dec 06 17:02:50.471969 2025] [:error] [pid 1838:tid 1868] [client 4.247.149.190:39708] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aTPxOi5zgnu67Yo7vrbcUAAAApY"]
[Sat Dec 06 17:02:50.868671 2025] [:error] [pid 1838:tid 1869] [client 4.247.149.190:39437] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aTPxOi5zgnu67Yo7vrbcUgAAApc"]
[Sat Dec 06 17:02:51.226622 2025] [:error] [pid 61216:tid 61266] [client 4.247.149.190:9746] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aTPxOzHlXXVdP5ewviX5AwAAAFQ"]
[Sat Dec 06 17:02:51.624703 2025] [:error] [pid 61216:tid 61262] [client 4.247.149.190:39701] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aTPxOzHlXXVdP5ewviX5BQAAAFA"]
[Sat Dec 06 17:02:52.059494 2025] [:error] [pid 61216:tid 61269] [client 4.247.149.190:39738] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aTPxPDHlXXVdP5ewviX5CAAAAFc"]
[Sat Dec 06 17:02:52.410785 2025] [:error] [pid 1838:tid 1851] [client 4.247.149.190:43481] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aTPxPC5zgnu67Yo7vrbcVAAAAoU"]
[Sat Dec 06 17:02:52.741567 2025] [:error] [pid 61217:tid 61284] [client 4.247.149.190:9242] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aTPxPFdSKQYfLI3fYo5sXQAAAIs"]
[Sat Dec 06 17:02:53.157289 2025] [:error] [pid 1727:tid 1730] [client 4.247.149.190:39710] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aTPxPcD83luYT37-ZaXwNQAAAkE"]
[Sat Dec 06 17:02:53.507403 2025] [:error] [pid 61216:tid 61264] [client 4.247.149.190:50473] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aTPxPTHlXXVdP5ewviX5DAAAAFI"]
[Sat Dec 06 17:02:53.965396 2025] [:error] [pid 1838:tid 1849] [client 4.247.149.190:9547] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aTPxPS5zgnu67Yo7vrbcVQAAAoM"]
[Sat Dec 06 17:02:54.337856 2025] [:error] [pid 61303:tid 61311] [client 4.247.149.190:50476] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTPxPtwK_fe00OH7zy51TwAAAMU"]
[Sat Dec 06 17:02:54.850509 2025] [:error] [pid 61303:tid 61331] [client 4.247.149.190:9561] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTPxPtwK_fe00OH7zy51UAAAANg"]
[Sat Dec 06 17:02:55.184590 2025] [:error] [pid 61216:tid 61263] [client 4.247.149.190:25906] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTPxPzHlXXVdP5ewviX5DwAAAFE"]
[Sat Dec 06 17:02:55.511507 2025] [:error] [pid 61217:tid 61281] [client 4.247.149.190:39454] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTPxP1dSKQYfLI3fYo5sYQAAAIg"]
[Sat Dec 06 17:02:55.829918 2025] [:error] [pid 1838:tid 1848] [client 4.247.149.190:39462] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTPxPy5zgnu67Yo7vrbcVwAAAoI"]
[Sat Dec 06 17:02:56.305695 2025] [:error] [pid 35591:tid 35606] [client 4.247.149.190:15484] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTPxQIbmw-7bFvTxc9P8NgAAAQ0"]
[Sat Dec 06 17:02:56.676582 2025] [:error] [pid 1838:tid 1861] [client 4.247.149.190:9553] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTPxQC5zgnu67Yo7vrbcWAAAAo8"]
[Sat Dec 06 17:02:57.420739 2025] [:error] [pid 61303:tid 61310] [client 4.247.149.190:9960] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTPxQdwK_fe00OH7zy51UgAAAMQ"]
[Sat Dec 06 17:02:57.750695 2025] [:error] [pid 1838:tid 1863] [client 4.247.149.190:15477] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTPxQS5zgnu67Yo7vrbcaAAAApE"]
[Sat Dec 06 17:02:58.242335 2025] [:error] [pid 1838:tid 1864] [client 4.247.149.190:30665] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTPxQi5zgnu67Yo7vrbceAAAApI"]
[Sat Dec 06 17:02:58.714977 2025] [:error] [pid 1838:tid 1867] [client 4.247.149.190:15444] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTPxQi5zgnu67Yo7vrbciAAAApU"]
[Sat Dec 06 17:02:59.376510 2025] [:error] [pid 52809:tid 52815] [client 4.247.149.190:40118] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTPxQ-rRwgsmpIJQ2qZcmQAAAgQ"]
[Sat Dec 06 17:03:00.036715 2025] [:error] [pid 61215:tid 61232] [client 4.247.149.190:9544] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTPxROOOZ8nTCBYuI-wwDwAAAA0"]
[Sat Dec 06 17:03:00.486255 2025] [:error] [pid 35622:tid 35661] [client 4.247.149.190:25914] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTPxRCOSP_9DVLgFwI6nOAAAAYo"]
[Sat Dec 06 17:03:01.069015 2025] [:error] [pid 35622:tid 35657] [client 4.247.149.190:15461] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTPxRSOSP_9DVLgFwI6nOgAAAYY"]
[Sat Dec 06 17:03:01.479098 2025] [:error] [pid 61217:tid 61278] [client 4.247.149.190:45536] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTPxRVdSKQYfLI3fYo5sbAAAAIU"]
[Sat Dec 06 17:03:01.906999 2025] [:error] [pid 61215:tid 61227] [client 4.247.149.190:9978] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTPxReOOZ8nTCBYuI-wwFAAAAAg"]
[Sat Dec 06 17:03:02.334017 2025] [:error] [pid 61216:tid 61261] [client 4.247.149.190:30717] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTPxRjHlXXVdP5ewviX5KgAAAE8"]
[Sat Dec 06 17:03:02.650380 2025] [:error] [pid 48399:tid 48411] [client 4.247.149.190:42235] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTPxRujNPOrIshd8EwejhwAAAco"]
[Sat Dec 06 17:03:03.191294 2025] [:error] [pid 61217:tid 61284] [client 4.247.149.190:46458] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTPxR1dSKQYfLI3fYo5sbgAAAIs"]
[Sat Dec 06 17:03:03.518187 2025] [:error] [pid 61217:tid 61295] [client 4.247.149.190:9567] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTPxR1dSKQYfLI3fYo5sbwAAAJY"]
[Sat Dec 06 17:03:04.132241 2025] [:error] [pid 52809:tid 52834] [client 4.247.149.190:30718] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTPxSOrRwgsmpIJQ2qZcoAAAAhc"]
[Sat Dec 06 17:03:04.566980 2025] [:error] [pid 48399:tid 48412] [client 4.247.149.190:30663] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTPxSOjNPOrIshd8EwejiAAAAcs"]
[Sat Dec 06 17:03:05.037117 2025] [:error] [pid 61217:tid 61283] [client 4.247.149.190:9957] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTPxSVdSKQYfLI3fYo5scAAAAIo"]
[Sat Dec 06 17:03:05.956645 2025] [:error] [pid 1727:tid 1751] [client 4.247.149.190:40090] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aTPxScD83luYT37-ZaXwUQAAAlY"]
[Sat Dec 06 17:03:06.564301 2025] [:error] [pid 48399:tid 48420] [client 4.247.149.190:9862] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aTPxSujNPOrIshd8EwejigAAAdM"]
[Sat Dec 06 17:03:07.382464 2025] [:error] [pid 48399:tid 48418] [client 4.247.149.190:40122] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aTPxS-jNPOrIshd8EwejjAAAAdE"]
[Sat Dec 06 17:03:07.860817 2025] [:error] [pid 48399:tid 48404] [client 4.247.149.190:9906] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aTPxS-jNPOrIshd8EwejjQAAAcM"]
[Sat Dec 06 17:03:08.280886 2025] [:error] [pid 61303:tid 61319] [client 4.247.149.190:45549] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/el.php"] [unique_id "aTPxTNwK_fe00OH7zy51XQAAAM0"]
[Sat Dec 06 17:03:08.614011 2025] [:error] [pid 52809:tid 52829] [client 4.247.149.190:30673] [client 4.247.149.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/el.php"] [unique_id "aTPxTOrRwgsmpIJQ2qZcpQAAAhI"]
[Sat Dec 06 17:03:09.173242 2025] [:error] [pid 61215:tid 61236] [client 4.247.149.190:9951] File does not exist: /usr/local/apache/htdocs/suspended-page/el.php
[Sat Dec 06 17:03:09.330004 2025] [:error] [pid 61215:tid 61222] [client 4.247.149.190:9951] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Dec 06 17:03:09.482692 2025] [:error] [pid 61215:tid 61235] [client 4.247.149.190:9951] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Sat Dec 06 17:03:09.634707 2025] [:error] [pid 61215:tid 61237] [client 4.247.149.190:9951] File does not exist: /usr/local/apache/htdocs/suspended-page/conflg.php
[Sat Dec 06 17:03:09.911154 2025] [:error] [pid 61215:tid 61224] [client 4.247.149.190:9951] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Dec 06 19:26:45.999268 2025] [:error] [pid 48399:tid 48408] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/shoha.php
[Sat Dec 06 19:26:47.097235 2025] [:error] [pid 48399:tid 48403] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/bkxzo.php
[Sat Dec 06 19:26:47.249419 2025] [:error] [pid 48399:tid 48419] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o2.php
[Sat Dec 06 19:26:47.399853 2025] [:error] [pid 48399:tid 48416] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/777.php
[Sat Dec 06 19:26:47.555051 2025] [:error] [pid 48399:tid 48421] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sat Dec 06 19:26:47.704693 2025] [:error] [pid 48399:tid 48410] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Sat Dec 06 19:26:47.855473 2025] [:error] [pid 48399:tid 48409] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Sat Dec 06 19:26:48.031123 2025] [:error] [pid 48399:tid 48418] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sat Dec 06 19:26:48.181414 2025] [:error] [pid 48399:tid 48415] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/efile.php
[Sat Dec 06 19:26:48.347402 2025] [:error] [pid 48399:tid 48425] [client 4.218.14.204:1164] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Dec 06 19:26:49.068610 2025] [:error] [pid 48399:tid 48404] [client 4.218.14.204:1164] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTQS-ejNPOrIshd8Ewe1XwAAAcM"]
[Sat Dec 06 19:26:51.683426 2025] [:error] [pid 61217:tid 61292] [client 4.218.14.204:38421] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTQS-1dSKQYfLI3fYo5-egAAAJM"]
[Sat Dec 06 19:26:52.698088 2025] [:error] [pid 35591:tid 35613] [client 4.218.14.204:1158] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTQS_Ibmw-7bFvTxc9MREwAAARQ"]
[Sat Dec 06 19:26:53.614345 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:48268] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTQS_THlXXVdP5ewviUW7QAAAEA"]
[Sat Dec 06 19:26:54.779032 2025] [:error] [pid 61217:tid 61289] [client 4.218.14.204:45258] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTQS_ldSKQYfLI3fYo5-fgAAAJA"]
[Sat Dec 06 19:26:55.569960 2025] [:error] [pid 61215:tid 61231] [client 4.218.14.204:45524] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTQS_-OOZ8nTCBYuI-xEFgAAAAw"]
[Sat Dec 06 19:26:56.541230 2025] [:error] [pid 61216:tid 61255] [client 4.218.14.204:38420] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTQTADHlXXVdP5ewviUW7wAAAEk"]
[Sat Dec 06 19:26:58.360766 2025] [:error] [pid 61216:tid 61263] [client 4.218.14.204:45292] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTQTAjHlXXVdP5ewviUW8QAAAFE"]
[Sat Dec 06 19:27:00.356949 2025] [:error] [pid 1727:tid 1747] [client 4.218.14.204:38753] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTQTBMD83luYT37-ZaUEtQAAAlI"]
[Sat Dec 06 19:27:02.677079 2025] [:error] [pid 61216:tid 61249] [client 4.218.14.204:48239] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTQTBjHlXXVdP5ewviUW9AAAAEM"]
[Sat Dec 06 19:27:05.157320 2025] [:error] [pid 1838:tid 1860] [client 4.218.14.204:50514] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTQTCS5zgnu67Yo7vrYDHgAAAo4"]
[Sat Dec 06 19:27:07.930790 2025] [:error] [pid 52809:tid 52834] [client 4.218.14.204:40519] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTQTC-rRwgsmpIJQ2qZ0KAAAAhc"]
[Sat Dec 06 19:27:09.977287 2025] [:error] [pid 61303:tid 61318] [client 4.218.14.204:1219] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aTQTDdwK_fe00OH7zy6PXAAAAMw"]
[Sat Dec 06 19:27:10.839225 2025] [:error] [pid 52809:tid 52833] [client 4.218.14.204:40563] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aTQTDurRwgsmpIJQ2qZ0KQAAAhY"]
[Sat Dec 06 19:27:12.937158 2025] [:error] [pid 61215:tid 61221] [client 4.218.14.204:37366] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aTQTEOOOZ8nTCBYuI-xEHQAAAAI"]
[Sat Dec 06 19:27:15.152444 2025] [:error] [pid 35591:tid 35602] [client 4.218.14.204:37358] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aTQTE4bmw-7bFvTxc9MRGAAAAQk"]
[Sat Dec 06 19:27:16.555637 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:1218] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aTQTFC5zgnu67Yo7vrYDMgAAAoI"]
[Sat Dec 06 19:27:18.711456 2025] [:error] [pid 61215:tid 61236] [client 4.218.14.204:1231] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aTQTFuOOZ8nTCBYuI-xEHwAAABE"]
[Sat Dec 06 19:27:20.714335 2025] [:error] [pid 61303:tid 61324] [client 4.218.14.204:1257] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aTQTGNwK_fe00OH7zy6PYgAAANE"]
[Sat Dec 06 19:27:23.712423 2025] [:error] [pid 35622:tid 35659] [client 4.218.14.204:37350] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aTQTGyOSP_9DVLgFwI66HAAAAYg"]
[Sat Dec 06 19:27:25.776714 2025] [:error] [pid 61303:tid 61321] [client 4.218.14.204:1107] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/luxe.php"] [unique_id "aTQTHdwK_fe00OH7zy6PYwAAAM4"]
[Sat Dec 06 19:27:29.772265 2025] [:error] [pid 61216:tid 61263] [client 4.218.14.204:37321] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/luxe.php"] [unique_id "aTQTITHlXXVdP5ewviUW_gAAAFE"]
[Sat Dec 06 19:27:30.271586 2025] [:error] [pid 48399:tid 48406] [client 4.218.14.204:39487] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/luxe.php"] [unique_id "aTQTIujNPOrIshd8Ewe1bAAAAcU"]
[Sat Dec 06 19:27:31.575220 2025] [:error] [pid 1727:tid 1751] [client 4.218.14.204:1313] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/luxe.php"] [unique_id "aTQTI8D83luYT37-ZaUExAAAAlY"]
[Sat Dec 06 19:27:33.333372 2025] [:error] [pid 61215:tid 61237] [client 4.218.14.204:39482] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aTQTJeOOZ8nTCBYuI-xEJgAAABI"]
[Sat Dec 06 19:27:35.955145 2025] [:error] [pid 48399:tid 48419] [client 4.218.14.204:50669] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aTQTJ-jNPOrIshd8Ewe1cAAAAdI"]
[Sat Dec 06 19:27:37.808985 2025] [:error] [pid 61216:tid 61247] [client 4.218.14.204:1299] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aTQTKTHlXXVdP5ewviUXAQAAAEE"]
[Sat Dec 06 19:27:39.005455 2025] [:error] [pid 61215:tid 61231] [client 4.218.14.204:39425] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aTQTK-OOZ8nTCBYuI-xEKwAAAAw"]
[Sat Dec 06 19:27:40.190125 2025] [:error] [pid 61215:tid 61237] [client 4.218.14.204:35976] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTQTLOOOZ8nTCBYuI-xELAAAABI"]
[Sat Dec 06 19:27:41.247507 2025] [:error] [pid 48399:tid 48410] [client 4.218.14.204:37363] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTQTLejNPOrIshd8Ewe1cwAAAck"]
[Sat Dec 06 19:27:42.991858 2025] [:error] [pid 61303:tid 61308] [client 4.218.14.204:1316] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTQTLtwK_fe00OH7zy6PcAAAAMI"]
[Sat Dec 06 19:27:43.785769 2025] [:error] [pid 1838:tid 1863] [client 4.218.14.204:1332] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTQTLy5zgnu67Yo7vrYDWAAAApE"]
[Sat Dec 06 19:27:45.912584 2025] [:error] [pid 61217:tid 61275] [client 4.218.14.204:1284] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aTQTMVdSKQYfLI3fYo5-jgAAAII"]
[Sat Dec 06 19:27:48.590514 2025] [:error] [pid 61216:tid 61266] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Sat Dec 06 19:27:48.741093 2025] [:error] [pid 61216:tid 61247] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sat Dec 06 19:27:48.936293 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Dec 06 19:27:49.088150 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Sat Dec 06 19:27:49.782025 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/o.php
[Sat Dec 06 19:27:50.496595 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 06 19:27:50.848104 2025] [:error] [pid 61216:tid 61255] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Sat Dec 06 19:27:51.006091 2025] [:error] [pid 61216:tid 61249] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Dec 06 19:27:52.918756 2025] [:error] [pid 61216:tid 61251] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 06 19:27:53.069237 2025] [:error] [pid 61216:tid 61260] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 06 19:27:53.232441 2025] [:error] [pid 61216:tid 61269] [client 4.218.14.204:1282] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sat Dec 06 19:27:53.428754 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:1282] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aTQTOTHlXXVdP5ewviUXLgAAAEs"]
[Sat Dec 06 19:27:54.804293 2025] [:error] [pid 48399:tid 48401] [client 4.218.14.204:1125] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aTQTOujNPOrIshd8Ewe1gQAAAcA"]
[Sat Dec 06 19:27:56.057813 2025] [:error] [pid 35622:tid 35671] [client 4.218.14.204:48994] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aTQTPCOSP_9DVLgFwI66LQAAAZQ"]
[Sat Dec 06 19:27:57.997759 2025] [:error] [pid 48399:tid 48413] [client 4.218.14.204:1307] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aTQTPejNPOrIshd8Ewe1hQAAAcw"]
[Sat Dec 06 19:27:59.187063 2025] [:error] [pid 35591:tid 35612] [client 4.218.14.204:48701] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTQTP4bmw-7bFvTxc9MRMQAAARM"]
[Sat Dec 06 19:28:02.279925 2025] [:error] [pid 61303:tid 61315] [client 4.218.14.204:48650] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTQTQtwK_fe00OH7zy6PfAAAAMk"]
[Sat Dec 06 19:28:04.236653 2025] [:error] [pid 52809:tid 52829] [client 4.218.14.204:36027] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTQTROrRwgsmpIJQ2qZ0RAAAAhI"]
[Sat Dec 06 19:28:04.637157 2025] [:error] [pid 1727:tid 1737] [client 4.218.14.204:50746] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTQTRMD83luYT37-ZaUE0QAAAkg"]
[Sat Dec 06 19:28:05.356096 2025] [:error] [pid 61303:tid 61326] [client 4.218.14.204:1539] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aTQTRdwK_fe00OH7zy6PgAAAANM"]
[Sat Dec 06 19:28:07.114086 2025] [:error] [pid 61303:tid 61308] [client 4.218.14.204:50706] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aTQTR9wK_fe00OH7zy6PggAAAMI"]
[Sat Dec 06 19:28:08.664458 2025] [:error] [pid 61215:tid 61222] [client 4.218.14.204:1293] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aTQTSOOOZ8nTCBYuI-xEOgAAAAM"]
[Sat Dec 06 19:28:11.680693 2025] [:error] [pid 35591:tid 35614] [client 4.218.14.204:50698] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aTQTS4bmw-7bFvTxc9MROwAAARU"]
[Sat Dec 06 19:28:13.103349 2025] [:error] [pid 35622:tid 35674] [client 4.218.14.204:35983] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-is.php"] [unique_id "aTQTTSOSP_9DVLgFwI66MwAAAZc"]
[Sat Dec 06 19:28:14.198178 2025] [:error] [pid 1727:tid 1738] [client 4.218.14.204:1625] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-is.php"] [unique_id "aTQTTsD83luYT37-ZaUE3AAAAkk"]
[Sat Dec 06 19:28:14.917739 2025] [:error] [pid 1727:tid 1740] [client 4.218.14.204:49021] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-is.php"] [unique_id "aTQTTsD83luYT37-ZaUE3QAAAks"]
[Sat Dec 06 19:28:15.355861 2025] [:error] [pid 35591:tid 35608] [client 4.218.14.204:37322] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-is.php"] [unique_id "aTQTT4bmw-7bFvTxc9MRPgAAAQ8"]
[Sat Dec 06 19:28:17.984855 2025] [:error] [pid 1838:tid 1860] [client 4.218.14.204:1104] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aTQTUS5zgnu67Yo7vrYDkgAAAo4"]
[Sat Dec 06 19:28:19.428873 2025] [:error] [pid 35591:tid 35605] [client 4.218.14.204:50681] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aTQTU4bmw-7bFvTxc9MRQgAAAQw"]
[Sat Dec 06 19:28:21.257348 2025] [:error] [pid 48399:tid 48405] [client 4.218.14.204:47572] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aTQTVejNPOrIshd8Ewe1kAAAAcQ"]
[Sat Dec 06 19:28:23.295496 2025] [:error] [pid 1838:tid 1870] [client 4.218.14.204:1130] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aTQTVy5zgnu67Yo7vrYDmwAAApg"]
[Sat Dec 06 19:28:26.400839 2025] [:error] [pid 61303:tid 61308] [client 4.218.14.204:46302] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTQTWtwK_fe00OH7zy6PiwAAAMI"]
[Sat Dec 06 19:28:27.467275 2025] [:error] [pid 48399:tid 48404] [client 4.218.14.204:50625] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTQTW-jNPOrIshd8Ewe1lQAAAcM"]
[Sat Dec 06 19:28:28.838152 2025] [:error] [pid 61215:tid 61234] [client 4.218.14.204:41139] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTQTXOOOZ8nTCBYuI-xETgAAAA8"]
[Sat Dec 06 19:28:29.955358 2025] [:error] [pid 1838:tid 1850] [client 4.218.14.204:46335] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTQTXS5zgnu67Yo7vrYDpgAAAoQ"]
[Sat Dec 06 19:28:31.450906 2025] [:error] [pid 1727:tid 1743] [client 4.218.14.204:48223] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTQTX8D83luYT37-ZaUE9QAAAk4"]
[Sat Dec 06 19:28:33.668789 2025] [:error] [pid 61303:tid 61306] [client 4.218.14.204:49243] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTQTYdwK_fe00OH7zy6PkgAAAMA"]
[Sat Dec 06 19:28:34.898202 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:38729] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTQTYjHlXXVdP5ewviUXbwAAAEA"]
[Sat Dec 06 19:28:36.477211 2025] [:error] [pid 1838:tid 1868] [client 4.218.14.204:49557] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTQTZC5zgnu67Yo7vrYDtAAAApY"]
[Sat Dec 06 19:28:38.309442 2025] [:error] [pid 61216:tid 61266] [client 4.218.14.204:44076] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aTQTZjHlXXVdP5ewviUXdwAAAFQ"]
[Sat Dec 06 19:28:39.725166 2025] [:error] [pid 1838:tid 1867] [client 4.218.14.204:38044] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aTQTZy5zgnu67Yo7vrYDvgAAApU"]
[Sat Dec 06 19:28:40.766765 2025] [:error] [pid 1838:tid 1847] [client 4.218.14.204:38033] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aTQTaC5zgnu67Yo7vrYDxgAAAoE"]
[Sat Dec 06 19:28:41.835326 2025] [:error] [pid 35591:tid 35600] [client 4.218.14.204:46533] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aTQTaYbmw-7bFvTxc9MRTAAAAQc"]
[Sat Dec 06 19:28:42.427252 2025] [:error] [pid 61303:tid 61328] [client 4.218.14.204:48790] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTQTatwK_fe00OH7zy6PoAAAANU"]
[Sat Dec 06 19:28:44.078489 2025] [:error] [pid 1727:tid 1750] [client 4.218.14.204:1707] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTQTbMD83luYT37-ZaUFBwAAAlU"]
[Sat Dec 06 19:28:45.160398 2025] [:error] [pid 35591:tid 35615] [client 4.218.14.204:38804] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTQTbYbmw-7bFvTxc9MRTwAAARY"]
[Sat Dec 06 19:28:46.812487 2025] [:error] [pid 35622:tid 35657] [client 4.218.14.204:45574] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTQTbiOSP_9DVLgFwI66QAAAAYY"]
[Sat Dec 06 19:28:48.909004 2025] [:error] [pid 61217:tid 61289] [client 4.218.14.204:38019] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aTQTcFdSKQYfLI3fYo5_HgAAAJA"]
[Sat Dec 06 19:28:50.934469 2025] [:error] [pid 1838:tid 1855] [client 4.218.14.204:48777] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aTQTci5zgnu67Yo7vrYDzgAAAok"]
[Sat Dec 06 19:28:52.267768 2025] [:error] [pid 52809:tid 52835] [client 4.218.14.204:47638] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aTQTdOrRwgsmpIJQ2qZ0sgAAAhg"]
[Sat Dec 06 19:28:54.485325 2025] [:error] [pid 61217:tid 61286] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/asas.php
[Sat Dec 06 19:28:54.696020 2025] [:error] [pid 61217:tid 61280] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sat Dec 06 19:28:54.845752 2025] [:error] [pid 61217:tid 61284] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 06 19:28:55.175267 2025] [:error] [pid 61217:tid 61273] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/file15.php
[Sat Dec 06 19:28:56.066712 2025] [:error] [pid 61217:tid 61296] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/an7.php
[Sat Dec 06 19:28:56.905437 2025] [:error] [pid 61217:tid 61283] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sat Dec 06 19:28:57.306222 2025] [:error] [pid 61217:tid 61277] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/n.php
[Sat Dec 06 19:28:57.456783 2025] [:error] [pid 61217:tid 61276] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/mds.php
[Sat Dec 06 19:28:58.191496 2025] [:error] [pid 61217:tid 61290] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/admir.php
[Sat Dec 06 19:28:58.883243 2025] [:error] [pid 61217:tid 61286] [client 4.218.14.204:46537] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Dec 06 19:28:59.100078 2025] [:error] [pid 61217:tid 61292] [client 4.218.14.204:46537] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aTQTe1dSKQYfLI3fYo5_NAAAAJM"]
[Sat Dec 06 19:28:59.611974 2025] [:error] [pid 35622:tid 35673] [client 4.218.14.204:1394] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aTQTeyOSP_9DVLgFwI66SgAAAZY"]
[Sat Dec 06 19:29:00.251205 2025] [:error] [pid 1727:tid 1747] [client 4.218.14.204:1720] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aTQTfMD83luYT37-ZaUFDAAAAlI"]
[Sat Dec 06 19:29:01.220415 2025] [:error] [pid 35622:tid 35671] [client 4.218.14.204:1702] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aTQTfSOSP_9DVLgFwI66SwAAAZQ"]
[Sat Dec 06 19:29:03.750853 2025] [:error] [pid 1727:tid 1751] [client 4.218.14.204:1365] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aTQTf8D83luYT37-ZaUFEAAAAlY"]
[Sat Dec 06 19:29:04.921427 2025] [:error] [pid 1727:tid 1752] [client 4.218.14.204:1481] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aTQTgMD83luYT37-ZaUFEwAAAlc"]
[Sat Dec 06 19:29:06.474668 2025] [:error] [pid 1727:tid 1740] [client 4.218.14.204:47676] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aTQTgsD83luYT37-ZaUFFAAAAks"]
[Sat Dec 06 19:29:07.278546 2025] [:error] [pid 61217:tid 61293] [client 4.218.14.204:1523] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aTQTg1dSKQYfLI3fYo5_NQAAAJQ"]
[Sat Dec 06 19:29:07.954057 2025] [:error] [pid 61215:tid 61227] [client 4.218.14.204:1521] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aTQTg-OOZ8nTCBYuI-xExgAAAAg"]
[Sat Dec 06 19:29:09.049047 2025] [:error] [pid 48399:tid 48419] [client 4.218.14.204:41206] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aTQThejNPOrIshd8Ewe1qgAAAdI"]
[Sat Dec 06 19:29:10.217299 2025] [:error] [pid 61215:tid 61232] [client 4.218.14.204:41202] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aTQThuOOZ8nTCBYuI-xEyQAAAA0"]
[Sat Dec 06 19:29:11.763040 2025] [:error] [pid 48399:tid 48417] [client 4.218.14.204:1693] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aTQTh-jNPOrIshd8Ewe1sQAAAdA"]
[Sat Dec 06 19:29:12.593243 2025] [:error] [pid 52809:tid 52812] [client 4.218.14.204:46576] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTQTiOrRwgsmpIJQ2qZ0yAAAAgE"]
[Sat Dec 06 19:29:13.126033 2025] [:error] [pid 61303:tid 61310] [client 4.218.14.204:41157] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTQTidwK_fe00OH7zy6PwgAAAMQ"]
[Sat Dec 06 19:29:13.796029 2025] [:error] [pid 61303:tid 61316] [client 4.218.14.204:48768] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTQTidwK_fe00OH7zy6PwwAAAMo"]
[Sat Dec 06 19:29:14.951091 2025] [:error] [pid 35622:tid 35661] [client 4.218.14.204:1708] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTQTiiOSP_9DVLgFwI66VgAAAYo"]
[Sat Dec 06 19:29:15.477145 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:1688] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTQTiy5zgnu67Yo7vrYD7AAAApI"]
[Sat Dec 06 19:29:15.919855 2025] [:error] [pid 61216:tid 61254] [client 4.218.14.204:1388] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTQTizHlXXVdP5ewviUXxgAAAEg"]
[Sat Dec 06 19:29:16.519523 2025] [:error] [pid 35622:tid 35660] [client 4.218.14.204:46552] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTQTjCOSP_9DVLgFwI66WAAAAYk"]
[Sat Dec 06 19:29:16.864508 2025] [:error] [pid 35622:tid 35659] [client 4.218.14.204:48792] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTQTjCOSP_9DVLgFwI66WQAAAYg"]
[Sat Dec 06 19:29:17.249151 2025] [:error] [pid 35622:tid 35654] [client 4.218.14.204:1699] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aTQTjSOSP_9DVLgFwI66WgAAAYM"]
[Sat Dec 06 19:29:17.858755 2025] [:error] [pid 1838:tid 1851] [client 4.218.14.204:1492] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aTQTjS5zgnu67Yo7vrYD9AAAAoU"]
[Sat Dec 06 19:29:18.271935 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:47649] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aTQTjjHlXXVdP5ewviUXxwAAAEs"]
[Sat Dec 06 19:29:19.427314 2025] [:error] [pid 1838:tid 1847] [client 4.218.14.204:47628] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aTQTjy5zgnu67Yo7vrYD9wAAAoE"]
[Sat Dec 06 19:29:20.019735 2025] [:error] [pid 52809:tid 52833] [client 4.218.14.204:1346] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTQTkOrRwgsmpIJQ2qZ0ywAAAhY"]
[Sat Dec 06 19:29:20.426114 2025] [:error] [pid 61215:tid 61227] [client 4.218.14.204:46534] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTQTkOOOZ8nTCBYuI-xEzwAAAAg"]
[Sat Dec 06 19:29:20.922371 2025] [:error] [pid 61216:tid 61262] [client 4.218.14.204:47635] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTQTkDHlXXVdP5ewviUXzAAAAFA"]
[Sat Dec 06 19:29:21.800269 2025] [:error] [pid 1727:tid 1733] [client 4.218.14.204:46553] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTQTkcD83luYT37-ZaUFHgAAAkQ"]
[Sat Dec 06 19:29:22.577251 2025] [:error] [pid 1838:tid 1856] [client 4.218.14.204:47641] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aTQTki5zgnu67Yo7vrYD_wAAAoo"]
[Sat Dec 06 19:29:23.014307 2025] [:error] [pid 61215:tid 61230] [client 4.218.14.204:1358] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aTQTk-OOZ8nTCBYuI-xE3AAAAAs"]
[Sat Dec 06 19:29:23.636893 2025] [:error] [pid 61303:tid 61306] [client 4.218.14.204:41191] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aTQTk9wK_fe00OH7zy6PzQAAAMA"]
[Sat Dec 06 19:29:24.295101 2025] [:error] [pid 61216:tid 61260] [client 4.218.14.204:1535] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aTQTlDHlXXVdP5ewviUX0gAAAE4"]
[Sat Dec 06 19:29:25.204495 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:39663] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aTQTlTHlXXVdP5ewviUX1AAAAEA"]
[Sat Dec 06 19:29:26.136431 2025] [:error] [pid 1727:tid 1730] [client 4.218.14.204:48799] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aTQTlsD83luYT37-ZaUFKAAAAkE"]
[Sat Dec 06 19:29:27.258894 2025] [:error] [pid 35591:tid 35596] [client 4.218.14.204:1359] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aTQTl4bmw-7bFvTxc9MRXQAAAQM"]
[Sat Dec 06 19:29:27.920577 2025] [:error] [pid 61303:tid 61322] [client 4.218.14.204:1384] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aTQTl9wK_fe00OH7zy6PzgAAAM8"]
[Sat Dec 06 19:29:28.980764 2025] [:error] [pid 48399:tid 48421] [client 4.218.14.204:38831] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-x7.php"] [unique_id "aTQTmOjNPOrIshd8Ewe10QAAAdQ"]
[Sat Dec 06 19:29:31.254928 2025] [:error] [pid 61215:tid 61234] [client 4.218.14.204:46585] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-x7.php"] [unique_id "aTQTm-OOZ8nTCBYuI-xE4AAAAA8"]
[Sat Dec 06 19:29:31.683300 2025] [:error] [pid 61303:tid 61310] [client 4.218.14.204:47655] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-x7.php"] [unique_id "aTQTm9wK_fe00OH7zy6P0AAAAMQ"]
[Sat Dec 06 19:29:32.509707 2025] [:error] [pid 35622:tid 35657] [client 4.218.14.204:41209] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-x7.php"] [unique_id "aTQTnCOSP_9DVLgFwI66ZAAAAYY"]
[Sat Dec 06 19:29:34.001045 2025] [:error] [pid 61303:tid 61319] [client 4.218.14.204:1347] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTQTntwK_fe00OH7zy6P2AAAAM0"]
[Sat Dec 06 19:29:35.540651 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:41171] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTQTny5zgnu67Yo7vrYEDgAAApI"]
[Sat Dec 06 19:29:36.049842 2025] [:error] [pid 48399:tid 48401] [client 4.218.14.204:37566] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTQToOjNPOrIshd8Ewe11wAAAcA"]
[Sat Dec 06 19:29:36.986349 2025] [:error] [pid 61303:tid 61314] [client 4.218.14.204:47644] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTQToNwK_fe00OH7zy6P3QAAAMg"]
[Sat Dec 06 19:29:37.498725 2025] [:error] [pid 1838:tid 1849] [client 4.218.14.204:37867] [client 4.218.14.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aTQToS5zgnu67Yo7vrYEEAAAAoM"]
[Sat Dec 06 19:29:37.910289 2025] [:error] [pid 48399:tid 48407] [client 4.218.14.204:41166] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aTQToejNPOrIshd8Ewe12AAAAcY"]
[Sat Dec 06 19:29:39.782957 2025] [:error] [pid 48399:tid 48412] [client 4.218.14.204:43711] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aTQTo-jNPOrIshd8Ewe13AAAAcs"]
[Sat Dec 06 19:29:41.561858 2025] [:error] [pid 1838:tid 1870] [client 4.218.14.204:38340] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aTQTpS5zgnu67Yo7vrYEHgAAApg"]
[Sat Dec 06 19:29:42.960798 2025] [:error] [pid 1727:tid 1751] [client 4.218.14.204:36898] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aTQTpsD83luYT37-ZaUFNgAAAlY"]
[Sat Dec 06 19:29:44.044368 2025] [:error] [pid 61216:tid 61266] [client 4.218.14.204:43658] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.phphttps://robertatimothy.com/wp-content/packed.php"] [unique_id "aTQTqDHlXXVdP5ewviUX5gAAAFQ"]
[Sat Dec 06 19:29:44.892074 2025] [:error] [pid 52809:tid 52827] [client 4.218.14.204:43673] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.phphttps://robertatimothy.com/wp-content/packed.php"] [unique_id "aTQTqOrRwgsmpIJQ2qZ02QAAAhA"]
[Sat Dec 06 19:29:45.576746 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:49201] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.phphttps://robertatimothy.com/wp-content/packed.php"] [unique_id "aTQTqS5zgnu67Yo7vrYEKQAAAoI"]
[Sat Dec 06 19:29:46.209126 2025] [:error] [pid 61215:tid 61238] [client 4.218.14.204:46397] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.phphttps://robertatimothy.com/wp-content/packed.php"] [unique_id "aTQTquOOZ8nTCBYuI-xE4wAAABM"]
[Sat Dec 06 19:29:46.822131 2025] [:error] [pid 61303:tid 61311] [client 4.218.14.204:1991] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AxAo.php"] [unique_id "aTQTqtwK_fe00OH7zy6P4AAAAMU"]
[Sat Dec 06 19:29:47.355357 2025] [:error] [pid 61303:tid 61312] [client 4.218.14.204:47956] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AxAo.php"] [unique_id "aTQTq9wK_fe00OH7zy6P4QAAAMY"]
[Sat Dec 06 19:29:48.118045 2025] [:error] [pid 61216:tid 61247] [client 4.218.14.204:2007] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AxAo.php"] [unique_id "aTQTrDHlXXVdP5ewviUX6QAAAEE"]
[Sat Dec 06 19:29:48.499417 2025] [:error] [pid 61216:tid 61254] [client 4.218.14.204:2028] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AxAo.php"] [unique_id "aTQTrDHlXXVdP5ewviUX6wAAAEg"]
[Sat Dec 06 19:29:48.856219 2025] [:error] [pid 48399:tid 48409] [client 4.218.14.204:1990] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aTQTrOjNPOrIshd8Ewe14AAAAcg"]
[Sat Dec 06 19:29:49.260632 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:2019] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aTQTrTHlXXVdP5ewviUX7QAAAEs"]
[Sat Dec 06 19:29:49.607085 2025] [:error] [pid 48399:tid 48417] [client 4.218.14.204:46342] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aTQTrejNPOrIshd8Ewe14QAAAdA"]
[Sat Dec 06 19:29:50.691097 2025] [:error] [pid 61216:tid 61263] [client 4.218.14.204:46367] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aTQTrjHlXXVdP5ewviUX8QAAAFE"]
[Sat Dec 06 19:29:51.708270 2025] [:error] [pid 61216:tid 61258] [client 4.218.14.204:48030] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc.php"] [unique_id "aTQTrzHlXXVdP5ewviUX8wAAAEw"]
[Sat Dec 06 19:29:52.545962 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:34054] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc.php"] [unique_id "aTQTsDHlXXVdP5ewviUX9wAAAEA"]
[Sat Dec 06 19:29:53.337229 2025] [:error] [pid 1727:tid 1746] [client 4.218.14.204:2038] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc.php"] [unique_id "aTQTscD83luYT37-ZaUFQwAAAlE"]
[Sat Dec 06 19:29:54.535631 2025] [:error] [pid 61217:tid 61289] [client 4.218.14.204:41724] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc.php"] [unique_id "aTQTsldSKQYfLI3fYo5_XQAAAJA"]
[Sat Dec 06 19:29:55.120618 2025] [:error] [pid 35622:tid 35673] [client 4.218.14.204:43215] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aTQTsyOSP_9DVLgFwI66agAAAZY"]
[Sat Dec 06 19:29:56.128648 2025] [:error] [pid 61217:tid 61294] [client 4.218.14.204:34057] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aTQTtFdSKQYfLI3fYo5_XwAAAJU"]
[Sat Dec 06 19:29:56.901179 2025] [:error] [pid 35622:tid 35653] [client 4.218.14.204:43210] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aTQTtCOSP_9DVLgFwI66bgAAAYI"]
[Sat Dec 06 19:29:57.584278 2025] [:error] [pid 1727:tid 1735] [client 4.218.14.204:41691] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aTQTtcD83luYT37-ZaUFSgAAAkY"]
[Sat Dec 06 19:29:58.261342 2025] [:error] [pid 52809:tid 52830] [client 4.218.14.204:43259] File does not exist: /usr/local/apache/htdocs/suspended-page/hook.php
[Sat Dec 06 19:29:58.408363 2025] [:error] [pid 52809:tid 52817] [client 4.218.14.204:43259] [client 4.218.14.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aTQTturRwgsmpIJQ2qZ03QAAAgY"]
[Sat Dec 06 19:29:59.086493 2025] [:error] [pid 61217:tid 61275] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Sat Dec 06 19:29:59.242116 2025] [:error] [pid 61217:tid 61282] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Sat Dec 06 19:29:59.391208 2025] [:error] [pid 61217:tid 61290] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Sat Dec 06 19:29:59.540736 2025] [:error] [pid 61217:tid 61286] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Dec 06 19:30:00.985148 2025] [:error] [pid 61217:tid 61286] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sat Dec 06 19:30:01.136508 2025] [:error] [pid 61217:tid 61293] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/wb.php
[Sat Dec 06 19:30:01.308950 2025] [:error] [pid 61217:tid 61288] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Sat Dec 06 19:30:01.458822 2025] [:error] [pid 61217:tid 61295] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sat Dec 06 19:30:01.646612 2025] [:error] [pid 61217:tid 61289] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Sat Dec 06 19:30:01.796276 2025] [:error] [pid 61217:tid 61294] [client 4.218.14.204:34080] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Sat Dec 06 19:30:02.108209 2025] [:error] [pid 61217:tid 61296] [client 4.218.14.204:34080] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/card.php"] [unique_id "aTQTuldSKQYfLI3fYo5_cwAAAJc"]
[Sat Dec 06 19:30:02.581471 2025] [:error] [pid 35622:tid 35669] [client 4.218.14.204:41710] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/card.php"] [unique_id "aTQTuiOSP_9DVLgFwI66cwAAAZI"]
[Sat Dec 06 19:30:03.271068 2025] [:error] [pid 52809:tid 52822] [client 4.218.14.204:2015] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/card.php"] [unique_id "aTQTu-rRwgsmpIJQ2qZ05wAAAgs"]
[Sat Dec 06 19:30:03.649294 2025] [:error] [pid 61215:tid 61220] [client 4.218.14.204:48053] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/card.php"] [unique_id "aTQTu-OOZ8nTCBYuI-xE9AAAAAE"]
[Sat Dec 06 19:30:04.104625 2025] [:error] [pid 1838:tid 1860] [client 4.218.14.204:41699] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aTQTvC5zgnu67Yo7vrYENQAAAo4"]
[Sat Dec 06 19:30:04.658896 2025] [:error] [pid 61303:tid 61322] [client 4.218.14.204:41693] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aTQTvNwK_fe00OH7zy6P7gAAAM8"]
[Sat Dec 06 19:30:05.248365 2025] [:error] [pid 61216:tid 61249] [client 4.218.14.204:46110] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aTQTvTHlXXVdP5ewviUYDQAAAEM"]
[Sat Dec 06 19:30:05.933298 2025] [:error] [pid 1838:tid 1859] [client 4.218.14.204:48031] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aTQTvS5zgnu67Yo7vrYESAAAAo0"]
[Sat Dec 06 19:30:06.334703 2025] [:error] [pid 35591:tid 35613] [client 4.218.14.204:1985] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mnkalo.php"] [unique_id "aTQTvobmw-7bFvTxc9MRbwAAARQ"]
[Sat Dec 06 19:30:06.716277 2025] [:error] [pid 61217:tid 61278] [client 4.218.14.204:34083] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mnkalo.php"] [unique_id "aTQTvldSKQYfLI3fYo5_hgAAAIU"]
[Sat Dec 06 19:30:07.218458 2025] [:error] [pid 52809:tid 52834] [client 4.218.14.204:43224] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mnkalo.php"] [unique_id "aTQTv-rRwgsmpIJQ2qZ06QAAAhc"]
[Sat Dec 06 19:30:08.364487 2025] [:error] [pid 52809:tid 52812] [client 4.218.14.204:46108] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mnkalo.php"] [unique_id "aTQTwOrRwgsmpIJQ2qZ06gAAAgE"]
[Sat Dec 06 19:30:08.732133 2025] [:error] [pid 52809:tid 52830] [client 4.218.14.204:40153] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aTQTwOrRwgsmpIJQ2qZ07AAAAhM"]
[Sat Dec 06 19:30:09.361179 2025] [:error] [pid 1838:tid 1867] [client 4.218.14.204:48023] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aTQTwS5zgnu67Yo7vrYEUAAAApU"]
[Sat Dec 06 19:30:09.751301 2025] [:error] [pid 35622:tid 35671] [client 4.218.14.204:34076] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aTQTwSOSP_9DVLgFwI66dgAAAZQ"]
[Sat Dec 06 19:30:10.314700 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:39409] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aTQTwi5zgnu67Yo7vrYEUQAAApI"]
[Sat Dec 06 19:30:10.672740 2025] [:error] [pid 1838:tid 1856] [client 4.218.14.204:46131] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "aTQTwi5zgnu67Yo7vrYEUgAAAoo"]
[Sat Dec 06 19:30:11.500835 2025] [:error] [pid 61303:tid 61310] [client 4.218.14.204:48055] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "aTQTw9wK_fe00OH7zy6P8AAAAMQ"]
[Sat Dec 06 19:30:12.503404 2025] [:error] [pid 1838:tid 1854] [client 4.218.14.204:39396] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "aTQTxC5zgnu67Yo7vrYEWwAAAog"]
[Sat Dec 06 19:30:13.523869 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:43232] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "aTQTxS5zgnu67Yo7vrYEYgAAApI"]
[Sat Dec 06 19:30:14.588689 2025] [:error] [pid 1838:tid 1849] [client 4.218.14.204:48005] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mws.php"] [unique_id "aTQTxi5zgnu67Yo7vrYEZwAAAoM"]
[Sat Dec 06 19:30:16.032242 2025] [:error] [pid 1838:tid 1852] [client 4.218.14.204:39401] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mws.php"] [unique_id "aTQTyC5zgnu67Yo7vrYEaQAAAoY"]
[Sat Dec 06 19:30:16.947582 2025] [:error] [pid 48399:tid 48413] [client 4.218.14.204:50368] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mws.php"] [unique_id "aTQTyOjNPOrIshd8Ewe2AwAAAcw"]
[Sat Dec 06 19:30:17.708512 2025] [:error] [pid 61303:tid 61319] [client 4.218.14.204:39361] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mws.php"] [unique_id "aTQTydwK_fe00OH7zy6P9gAAAM0"]
[Sat Dec 06 19:30:19.519103 2025] [:error] [pid 1838:tid 1850] [client 4.218.14.204:34050] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aTQTyy5zgnu67Yo7vrYEbgAAAoQ"]
[Sat Dec 06 19:30:21.074424 2025] [:error] [pid 1838:tid 1855] [client 4.218.14.204:39630] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aTQTzS5zgnu67Yo7vrYEcQAAAok"]
[Sat Dec 06 19:30:22.849606 2025] [:error] [pid 1838:tid 1868] [client 4.218.14.204:39400] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aTQTzi5zgnu67Yo7vrYEegAAApY"]
[Sat Dec 06 19:30:23.853424 2025] [:error] [pid 1838:tid 1849] [client 4.218.14.204:1846] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aTQTzy5zgnu67Yo7vrYEfwAAAoM"]
[Sat Dec 06 19:30:24.500940 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:46096] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aTQT0DHlXXVdP5ewviUYTQAAAEs"]
[Sat Dec 06 19:30:24.998270 2025] [:error] [pid 1838:tid 1861] [client 4.218.14.204:39640] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aTQT0C5zgnu67Yo7vrYEhwAAAo8"]
[Sat Dec 06 19:30:25.415966 2025] [:error] [pid 61303:tid 61322] [client 4.218.14.204:36815] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aTQT0dwK_fe00OH7zy6P_gAAAM8"]
[Sat Dec 06 19:30:26.253875 2025] [:error] [pid 1838:tid 1855] [client 4.218.14.204:45360] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aTQT0i5zgnu67Yo7vrYEjwAAAok"]
[Sat Dec 06 19:30:26.877418 2025] [:error] [pid 61216:tid 61263] [client 4.218.14.204:45319] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the1me.php"] [unique_id "aTQT0jHlXXVdP5ewviUYTwAAAFE"]
[Sat Dec 06 19:30:30.002425 2025] [:error] [pid 1838:tid 1865] [client 4.218.14.204:45359] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the1me.php"] [unique_id "aTQT1i5zgnu67Yo7vrYElQAAApM"]
[Sat Dec 06 19:30:31.797951 2025] [:error] [pid 1838:tid 1867] [client 4.218.14.204:50421] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the1me.php"] [unique_id "aTQT1y5zgnu67Yo7vrYEmAAAApU"]
[Sat Dec 06 19:30:33.880527 2025] [:error] [pid 1727:tid 1733] [client 4.218.14.204:41635] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the1me.php"] [unique_id "aTQT2cD83luYT37-ZaUFagAAAkQ"]
[Sat Dec 06 19:30:35.187657 2025] [:error] [pid 35591:tid 35613] [client 4.218.14.204:36803] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aTQT24bmw-7bFvTxc9MRkwAAARQ"]
[Sat Dec 06 19:30:36.730263 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:36830] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aTQT3C5zgnu67Yo7vrYEnAAAApI"]
[Sat Dec 06 19:30:37.238381 2025] [:error] [pid 35591:tid 35596] [client 4.218.14.204:42836] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aTQT3Ybmw-7bFvTxc9MRlgAAAQM"]
[Sat Dec 06 19:30:39.895325 2025] [:error] [pid 61215:tid 61232] [client 4.218.14.204:45347] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aTQT3-OOZ8nTCBYuI-xFAwAAAA0"]
[Sat Dec 06 19:30:43.145296 2025] [:error] [pid 35622:tid 35668] [client 4.218.14.204:44139] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aTQT4yOSP_9DVLgFwI66ewAAAZE"]
[Sat Dec 06 19:30:44.920068 2025] [:error] [pid 1838:tid 1851] [client 4.218.14.204:37062] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aTQT5C5zgnu67Yo7vrYEtgAAAoU"]
[Sat Dec 06 19:30:45.674228 2025] [:error] [pid 61217:tid 61283] [client 4.218.14.204:44084] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aTQT5VdSKQYfLI3fYo5_mQAAAIo"]
[Sat Dec 06 19:30:47.393228 2025] [:error] [pid 61217:tid 61291] [client 4.218.14.204:47576] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aTQT51dSKQYfLI3fYo5_mwAAAJI"]
[Sat Dec 06 19:30:48.605201 2025] [:error] [pid 1838:tid 1865] [client 4.218.14.204:44135] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTQT6C5zgnu67Yo7vrYEwQAAApM"]
[Sat Dec 06 19:30:50.547417 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:44035] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTQT6i5zgnu67Yo7vrYEzwAAAoI"]
[Sat Dec 06 19:30:51.380228 2025] [:error] [pid 1838:tid 1870] [client 4.218.14.204:44134] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTQT6y5zgnu67Yo7vrYE2QAAApg"]
[Sat Dec 06 19:30:52.874061 2025] [:error] [pid 1838:tid 1858] [client 4.218.14.204:44136] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTQT7C5zgnu67Yo7vrYE5QAAAow"]
[Sat Dec 06 19:30:54.332944 2025] [:error] [pid 52809:tid 52835] [client 4.218.14.204:37115] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTQT7urRwgsmpIJQ2qZ1AAAAAhg"]
[Sat Dec 06 19:30:56.159253 2025] [:error] [pid 61216:tid 61249] [client 4.218.14.204:37063] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTQT8DHlXXVdP5ewviUYWAAAAEM"]
[Sat Dec 06 19:30:57.249739 2025] [:error] [pid 61303:tid 61313] [client 4.218.14.204:49993] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTQT8dwK_fe00OH7zy6QFAAAAMc"]
[Sat Dec 06 19:30:58.835129 2025] [:error] [pid 48399:tid 48422] [client 4.218.14.204:49987] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTQT8ujNPOrIshd8Ewe2CgAAAdU"]
[Sat Dec 06 19:30:59.862788 2025] [:error] [pid 1838:tid 1862] [client 4.218.14.204:1419] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTQT8y5zgnu67Yo7vrYE7wAAApA"]
[Sat Dec 06 19:31:00.424246 2025] [:error] [pid 35622:tid 35673] [client 4.218.14.204:50011] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTQT9COSP_9DVLgFwI66hAAAAZY"]
[Sat Dec 06 19:31:01.397649 2025] [:error] [pid 1838:tid 1870] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Sat Dec 06 19:31:01.774771 2025] [:error] [pid 1838:tid 1861] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/hk.php
[Sat Dec 06 19:31:01.949970 2025] [:error] [pid 1838:tid 1854] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Sat Dec 06 19:31:02.103761 2025] [:error] [pid 1838:tid 1850] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-gr.php
[Sat Dec 06 19:31:02.488345 2025] [:error] [pid 1838:tid 1868] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/owl.php
[Sat Dec 06 19:31:02.666631 2025] [:error] [pid 1838:tid 1869] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/mo.php
[Sat Dec 06 19:31:02.818925 2025] [:error] [pid 1838:tid 1849] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Sat Dec 06 19:31:02.987792 2025] [:error] [pid 1838:tid 1866] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sat Dec 06 19:31:03.141398 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/444.php
[Sat Dec 06 19:31:03.294907 2025] [:error] [pid 1838:tid 1865] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-903.php
[Sat Dec 06 19:31:03.449979 2025] [:error] [pid 1838:tid 1857] [client 4.218.14.204:1454] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sat Dec 06 19:31:03.596766 2025] [:error] [pid 1838:tid 1858] [client 4.218.14.204:1454] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nij.php"] [unique_id "aTQT9y5zgnu67Yo7vrYFBQAAAow"]
[Sat Dec 06 19:31:04.441235 2025] [:error] [pid 61303:tid 61321] [client 4.218.14.204:38457] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nij.php"] [unique_id "aTQT-NwK_fe00OH7zy6QGQAAAM4"]
[Sat Dec 06 19:31:05.060090 2025] [:error] [pid 52809:tid 52824] [client 4.218.14.204:45517] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nij.php"] [unique_id "aTQT-erRwgsmpIJQ2qZ1CwAAAg0"]
[Sat Dec 06 19:31:05.950238 2025] [:error] [pid 61216:tid 61265] [client 4.218.14.204:45522] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nij.php"] [unique_id "aTQT-THlXXVdP5ewviUYZgAAAFM"]
[Sat Dec 06 19:31:06.478072 2025] [:error] [pid 35622:tid 35660] [client 4.218.14.204:42134] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTQT-iOSP_9DVLgFwI66iwAAAYk"]
[Sat Dec 06 19:31:07.109869 2025] [:error] [pid 52809:tid 52820] [client 4.218.14.204:49573] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTQT--rRwgsmpIJQ2qZ1EgAAAgk"]
[Sat Dec 06 19:31:07.688460 2025] [:error] [pid 61216:tid 61254] [client 4.218.14.204:1165] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTQT-zHlXXVdP5ewviUYZwAAAEg"]
[Sat Dec 06 19:31:10.147471 2025] [:error] [pid 35622:tid 35656] [client 4.218.14.204:50568] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTQT_iOSP_9DVLgFwI66kgAAAYU"]
[Sat Dec 06 19:31:11.822090 2025] [:error] [pid 61217:tid 61274] [client 4.218.14.204:48301] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTQT_1dSKQYfLI3fYo5_qAAAAIE"]
[Sat Dec 06 19:31:13.576941 2025] [:error] [pid 35622:tid 35660] [client 4.218.14.204:45249] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTQUASOSP_9DVLgFwI66mQAAAYk"]
[Sat Dec 06 19:31:14.508667 2025] [:error] [pid 48399:tid 48421] [client 4.218.14.204:49549] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTQUAujNPOrIshd8Ewe2GQAAAdQ"]
[Sat Dec 06 19:31:15.104148 2025] [:error] [pid 1838:tid 1856] [client 4.218.14.204:48272] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTQUAy5zgnu67Yo7vrYFJQAAAoo"]
[Sat Dec 06 19:31:16.400102 2025] [:error] [pid 61217:tid 61273] [client 4.218.14.204:41693] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTQUBFdSKQYfLI3fYo5_sAAAAIA"]
[Sat Dec 06 19:31:17.425170 2025] [:error] [pid 61303:tid 61321] [client 4.218.14.204:45283] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTQUBdwK_fe00OH7zy6QJQAAAM4"]
[Sat Dec 06 19:31:19.352161 2025] [:error] [pid 61215:tid 61234] [client 4.218.14.204:40469] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTQUB-OOZ8nTCBYuI-xFMQAAAA8"]
[Sat Dec 06 19:31:21.292335 2025] [:error] [pid 52809:tid 52822] [client 4.218.14.204:49217] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTQUCerRwgsmpIJQ2qZ1HwAAAgs"]
[Sat Dec 06 19:31:22.273216 2025] [:error] [pid 1727:tid 1731] [client 4.218.14.204:50606] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tox.php"] [unique_id "aTQUCsD83luYT37-ZaUFewAAAkI"]
[Sat Dec 06 19:31:23.051484 2025] [:error] [pid 48399:tid 48403] [client 4.218.14.204:46050] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tox.php"] [unique_id "aTQUC-jNPOrIshd8Ewe2MAAAAcI"]
[Sat Dec 06 19:31:24.741104 2025] [:error] [pid 61215:tid 61220] [client 4.218.14.204:46078] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tox.php"] [unique_id "aTQUDOOOZ8nTCBYuI-xFOQAAAAE"]
[Sat Dec 06 19:31:26.251457 2025] [:error] [pid 61215:tid 61227] [client 4.218.14.204:46027] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tox.php"] [unique_id "aTQUDuOOZ8nTCBYuI-xFPAAAAAg"]
[Sat Dec 06 19:31:27.405370 2025] [:error] [pid 52809:tid 52825] [client 4.218.14.204:50610] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lo.php"] [unique_id "aTQUD-rRwgsmpIJQ2qZ1LAAAAg4"]
[Sat Dec 06 19:31:29.274298 2025] [:error] [pid 61217:tid 61288] [client 4.218.14.204:46029] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lo.php"] [unique_id "aTQUEVdSKQYfLI3fYo5_uAAAAI8"]
[Sat Dec 06 19:31:30.967166 2025] [:error] [pid 52809:tid 52819] [client 4.218.14.204:50561] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lo.php"] [unique_id "aTQUEurRwgsmpIJQ2qZ1MgAAAgg"]
[Sat Dec 06 19:31:33.257219 2025] [:error] [pid 61303:tid 61314] [client 4.218.14.204:45266] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lo.php"] [unique_id "aTQUFdwK_fe00OH7zy6QMAAAAMg"]
[Sat Dec 06 19:31:33.809186 2025] [:error] [pid 61216:tid 61251] [client 4.218.14.204:50575] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aTQUFTHlXXVdP5ewviUYgwAAAEU"]
[Sat Dec 06 19:31:34.996447 2025] [:error] [pid 1838:tid 1854] [client 4.218.14.204:50619] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aTQUFi5zgnu67Yo7vrYFSAAAAog"]
[Sat Dec 06 19:31:36.088149 2025] [:error] [pid 61215:tid 61222] [client 4.218.14.204:49221] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aTQUGOOOZ8nTCBYuI-xFRQAAAAM"]
[Sat Dec 06 19:31:37.701592 2025] [:error] [pid 35591:tid 35606] [client 4.218.14.204:46026] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aTQUGYbmw-7bFvTxc9MRyQAAAQ0"]
[Sat Dec 06 19:31:38.673098 2025] [:error] [pid 48399:tid 48423] [client 4.218.14.204:46031] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aTQUGujNPOrIshd8Ewe2MwAAAdY"]
[Sat Dec 06 19:31:40.298812 2025] [:error] [pid 52809:tid 52815] [client 4.218.14.204:50600] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aTQUHOrRwgsmpIJQ2qZ1OgAAAgQ"]
[Sat Dec 06 19:31:41.204047 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:48193] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aTQUHS5zgnu67Yo7vrYFaAAAAoI"]
[Sat Dec 06 19:31:41.592479 2025] [:error] [pid 52809:tid 52833] [client 4.218.14.204:38777] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aTQUHerRwgsmpIJQ2qZ1QwAAAhY"]
[Sat Dec 06 19:31:42.623595 2025] [:error] [pid 61217:tid 61275] [client 4.218.14.204:46062] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aTQUHldSKQYfLI3fYo5_wgAAAII"]
[Sat Dec 06 19:31:43.350891 2025] [:error] [pid 35591:tid 35602] [client 4.218.14.204:46074] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aTQUH4bmw-7bFvTxc9MR0wAAAQk"]
[Sat Dec 06 19:31:44.519147 2025] [:error] [pid 61215:tid 61219] [client 4.218.14.204:46037] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aTQUIOOOZ8nTCBYuI-xFTAAAAAA"]
[Sat Dec 06 19:31:45.792143 2025] [:error] [pid 1838:tid 1866] [client 4.218.14.204:49225] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aTQUIS5zgnu67Yo7vrYFcwAAApQ"]
[Sat Dec 06 19:31:46.951404 2025] [:error] [pid 61215:tid 61242] [client 4.218.14.204:49234] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTQUIuOOZ8nTCBYuI-xFVAAAABc"]
[Sat Dec 06 19:31:48.212200 2025] [:error] [pid 61215:tid 61235] [client 4.218.14.204:49261] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTQUJOOOZ8nTCBYuI-xFVQAAABA"]
[Sat Dec 06 19:31:48.780405 2025] [:error] [pid 61217:tid 61296] [client 4.218.14.204:49276] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTQUJFdSKQYfLI3fYo5_xgAAAJc"]
[Sat Dec 06 19:31:49.296036 2025] [:error] [pid 1727:tid 1753] [client 4.218.14.204:46071] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTQUJcD83luYT37-ZaUFiwAAAlg"]
[Sat Dec 06 19:31:50.257613 2025] [:error] [pid 35622:tid 35674] [client 4.218.14.204:48218] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTQUJiOSP_9DVLgFwI66sAAAAZc"]
[Sat Dec 06 19:31:51.995188 2025] [:error] [pid 61216:tid 61256] [client 4.218.14.204:38781] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTQUJzHlXXVdP5ewviUYkgAAAEo"]
[Sat Dec 06 19:31:52.920425 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:43165] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTQUKDHlXXVdP5ewviUYlwAAAEs"]
[Sat Dec 06 19:31:54.376031 2025] [:error] [pid 35622:tid 35662] [client 4.218.14.204:50592] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTQUKiOSP_9DVLgFwI66tQAAAYs"]
[Sat Dec 06 19:31:55.616219 2025] [:error] [pid 48399:tid 48412] [client 4.218.14.204:46075] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aTQUK-jNPOrIshd8Ewe2OgAAAcs"]
[Sat Dec 06 19:31:56.775212 2025] [:error] [pid 52809:tid 52834] [client 4.218.14.204:40486] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aTQULOrRwgsmpIJQ2qZ1TwAAAhc"]
[Sat Dec 06 19:31:57.582051 2025] [:error] [pid 61215:tid 61224] [client 4.218.14.204:43156] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aTQULeOOZ8nTCBYuI-xFVgAAAAU"]
[Sat Dec 06 19:32:00.885190 2025] [:error] [pid 1838:tid 1856] [client 4.218.14.204:41117] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aTQUMC5zgnu67Yo7vrYFpgAAAoo"]
[Sat Dec 06 19:32:02.324313 2025] [:error] [pid 1838:tid 1861] [client 4.218.14.204:46046] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtt.php"] [unique_id "aTQUMi5zgnu67Yo7vrYFqgAAAo8"]
[Sat Dec 06 19:32:03.848535 2025] [:error] [pid 61216:tid 61268] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/xtt.php
[Sat Dec 06 19:32:04.157247 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/noe.php
[Sat Dec 06 19:32:04.315913 2025] [:error] [pid 61216:tid 61261] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Dec 06 19:32:04.465627 2025] [:error] [pid 61216:tid 61270] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/shellalfa.php
[Sat Dec 06 19:32:04.641973 2025] [:error] [pid 61216:tid 61266] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/te.php
[Sat Dec 06 19:32:04.794306 2025] [:error] [pid 61216:tid 61251] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Sat Dec 06 19:32:04.972968 2025] [:error] [pid 61216:tid 61250] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Dec 06 19:32:05.125169 2025] [:error] [pid 61216:tid 61255] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/cccc.php
[Sat Dec 06 19:32:05.290024 2025] [:error] [pid 61216:tid 61258] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Sat Dec 06 19:32:05.439855 2025] [:error] [pid 61216:tid 61265] [client 4.218.14.204:48233] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sat Dec 06 19:32:05.589513 2025] [:error] [pid 61216:tid 61247] [client 4.218.14.204:48233] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aTQUNTHlXXVdP5ewviUYqAAAAEE"]
[Sat Dec 06 19:32:07.214877 2025] [:error] [pid 1838:tid 1846] [client 4.218.14.204:43162] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aTQUNy5zgnu67Yo7vrYFuwAAAoA"]
[Sat Dec 06 19:32:09.593198 2025] [:error] [pid 48399:tid 48413] [client 4.218.14.204:46024] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aTQUOejNPOrIshd8Ewe2PAAAAcw"]
[Sat Dec 06 19:32:10.567968 2025] [:error] [pid 61215:tid 61241] [client 4.218.14.204:49266] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "aTQUOuOOZ8nTCBYuI-xFYQAAABY"]
[Sat Dec 06 19:32:11.245852 2025] [:error] [pid 61215:tid 61228] [client 4.218.14.204:41114] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTQUO-OOZ8nTCBYuI-xFYwAAAAk"]
[Sat Dec 06 19:32:12.272011 2025] [:error] [pid 1838:tid 1865] [client 4.218.14.204:1870] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTQUPC5zgnu67Yo7vrYFyAAAApM"]
[Sat Dec 06 19:32:12.932601 2025] [:error] [pid 61216:tid 61252] [client 4.218.14.204:49226] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTQUPDHlXXVdP5ewviUYqQAAAEY"]
[Sat Dec 06 19:32:14.143389 2025] [:error] [pid 61215:tid 61243] [client 4.218.14.204:43177] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTQUPuOOZ8nTCBYuI-xFZAAAABg"]
[Sat Dec 06 19:32:15.859682 2025] [:error] [pid 61215:tid 61234] [client 4.218.14.204:48239] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTQUP-OOZ8nTCBYuI-xFZgAAAA8"]
[Sat Dec 06 19:32:17.318876 2025] [:error] [pid 61215:tid 61242] [client 4.218.14.204:45766] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTQUQeOOZ8nTCBYuI-xFbAAAABc"]
[Sat Dec 06 19:32:18.540129 2025] [:error] [pid 61216:tid 61269] [client 4.218.14.204:1866] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTQUQjHlXXVdP5ewviUYswAAAFc"]
[Sat Dec 06 19:32:18.948867 2025] [:error] [pid 61216:tid 61267] [client 4.218.14.204:1886] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTQUQjHlXXVdP5ewviUYtAAAAFU"]
[Sat Dec 06 19:32:19.303933 2025] [:error] [pid 61303:tid 61328] [client 4.218.14.204:1284] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aTQUQ9wK_fe00OH7zy6QaAAAANU"]
[Sat Dec 06 19:32:19.830343 2025] [:error] [pid 35622:tid 35663] [client 4.218.14.204:1774] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aTQUQyOSP_9DVLgFwI66ygAAAYw"]
[Sat Dec 06 19:32:20.293897 2025] [:error] [pid 35622:tid 35669] [client 4.218.14.204:45764] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aTQURCOSP_9DVLgFwI66zAAAAZI"]
[Sat Dec 06 19:32:21.084260 2025] [:error] [pid 61216:tid 61265] [client 4.218.14.204:1302] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aTQURTHlXXVdP5ewviUYuwAAAFM"]
[Sat Dec 06 19:32:21.909709 2025] [:error] [pid 61215:tid 61240] [client 4.218.14.204:1611] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelap.php"] [unique_id "aTQUReOOZ8nTCBYuI-xFcQAAABU"]
[Sat Dec 06 19:32:22.561109 2025] [:error] [pid 61215:tid 61228] [client 4.218.14.204:1537] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelap.php"] [unique_id "aTQURuOOZ8nTCBYuI-xFcwAAAAk"]
[Sat Dec 06 19:32:24.071809 2025] [:error] [pid 61216:tid 61248] [client 4.218.14.204:50737] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelap.php"] [unique_id "aTQUSDHlXXVdP5ewviUYvwAAAEI"]
[Sat Dec 06 19:32:25.387378 2025] [:error] [pid 61303:tid 61331] [client 4.218.14.204:50742] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelap.php"] [unique_id "aTQUSdwK_fe00OH7zy6QbQAAANg"]
[Sat Dec 06 19:32:26.433797 2025] [:error] [pid 1838:tid 1855] [client 4.218.14.204:50740] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aTQUSi5zgnu67Yo7vrYF4QAAAok"]
[Sat Dec 06 19:32:27.094774 2025] [:error] [pid 1838:tid 1856] [client 4.218.14.204:35982] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aTQUSy5zgnu67Yo7vrYF5gAAAoo"]
[Sat Dec 06 19:32:28.186445 2025] [:error] [pid 61303:tid 61324] [client 4.218.14.204:1621] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aTQUTNwK_fe00OH7zy6QcQAAANE"]
[Sat Dec 06 19:32:29.615054 2025] [:error] [pid 52809:tid 52813] [client 4.218.14.204:1624] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aTQUTerRwgsmpIJQ2qZ1XgAAAgI"]
[Sat Dec 06 19:32:30.863910 2025] [:error] [pid 1838:tid 1865] [client 4.218.14.204:39437] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aTQUTi5zgnu67Yo7vrYF7QAAApM"]
[Sat Dec 06 19:32:31.772236 2025] [:error] [pid 61217:tid 61276] [client 4.218.14.204:48644] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aTQUT1dSKQYfLI3fYo5_3QAAAIM"]
[Sat Dec 06 19:32:32.493030 2025] [:error] [pid 1838:tid 1867] [client 4.218.14.204:48702] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aTQUUC5zgnu67Yo7vrYF8AAAApU"]
[Sat Dec 06 19:32:32.889950 2025] [:error] [pid 61215:tid 61238] [client 4.218.14.204:48973] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aTQUUOOOZ8nTCBYuI-xFgQAAABM"]
[Sat Dec 06 19:32:33.314667 2025] [:error] [pid 61217:tid 61282] [client 4.218.14.204:39469] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aTQUUVdSKQYfLI3fYo5_4QAAAIk"]
[Sat Dec 06 19:32:33.763443 2025] [:error] [pid 61215:tid 61242] [client 4.218.14.204:49018] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aTQUUeOOZ8nTCBYuI-xFggAAABc"]
[Sat Dec 06 19:32:34.702732 2025] [:error] [pid 61216:tid 61261] [client 4.218.14.204:49008] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aTQUUjHlXXVdP5ewviUY1wAAAE8"]
[Sat Dec 06 19:32:36.121146 2025] [:error] [pid 1838:tid 1855] [client 4.218.14.204:46303] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aTQUVC5zgnu67Yo7vrYF_gAAAok"]
[Sat Dec 06 19:32:37.819832 2025] [:error] [pid 1838:tid 1862] [client 4.218.14.204:39483] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aTQUVS5zgnu67Yo7vrYGBAAAApA"]
[Sat Dec 06 19:32:39.275250 2025] [:error] [pid 61303:tid 61314] [client 4.218.14.204:50658] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aTQUV9wK_fe00OH7zy6QfwAAAMg"]
[Sat Dec 06 19:32:39.883436 2025] [:error] [pid 61216:tid 61270] [client 4.218.14.204:1132] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aTQUVzHlXXVdP5ewviUY3QAAAFg"]
[Sat Dec 06 19:32:40.321247 2025] [:error] [pid 1838:tid 1855] [client 4.218.14.204:1227] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aTQUWC5zgnu67Yo7vrYGEQAAAok"]
[Sat Dec 06 19:32:41.122269 2025] [:error] [pid 48399:tid 48412] [client 4.218.14.204:50654] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTQUWejNPOrIshd8Ewe2SAAAAcs"]
[Sat Dec 06 19:32:41.915325 2025] [:error] [pid 35591:tid 35608] [client 4.218.14.204:46285] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTQUWYbmw-7bFvTxc9MR7wAAAQ8"]
[Sat Dec 06 19:32:43.204876 2025] [:error] [pid 35622:tid 35670] [client 4.218.14.204:50534] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTQUWyOSP_9DVLgFwI663gAAAZM"]
[Sat Dec 06 19:32:43.985966 2025] [:error] [pid 35591:tid 35615] [client 4.218.14.204:1113] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTQUW4bmw-7bFvTxc9MR8gAAARY"]
[Sat Dec 06 19:32:44.602096 2025] [:error] [pid 35591:tid 35596] [client 4.218.14.204:50634] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTQUXIbmw-7bFvTxc9MR8wAAAQM"]
[Sat Dec 06 19:32:45.503022 2025] [:error] [pid 61216:tid 61250] [client 4.218.14.204:40512] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTQUXTHlXXVdP5ewviUY4QAAAEQ"]
[Sat Dec 06 19:32:46.090933 2025] [:error] [pid 61215:tid 61243] [client 4.218.14.204:46272] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTQUXuOOZ8nTCBYuI-xFkAAAABg"]
[Sat Dec 06 19:32:46.717097 2025] [:error] [pid 61217:tid 61292] [client 4.218.14.204:39434] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTQUXldSKQYfLI3fYo5_8wAAAJM"]
[Sat Dec 06 19:32:47.406795 2025] [:error] [pid 35591:tid 35593] [client 4.218.14.204:46294] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTQUX4bmw-7bFvTxc9MR-wAAAQA"]
[Sat Dec 06 19:32:48.054723 2025] [:error] [pid 35591:tid 35614] [client 4.218.14.204:46334] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTQUYIbmw-7bFvTxc9MR_QAAARU"]
[Sat Dec 06 19:32:48.505194 2025] [:error] [pid 35622:tid 35664] [client 4.218.14.204:1144] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTQUYCOSP_9DVLgFwI665QAAAY0"]
[Sat Dec 06 19:32:48.988344 2025] [:error] [pid 1838:tid 1861] [client 4.218.14.204:1091] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTQUYC5zgnu67Yo7vrYGFAAAAo8"]
[Sat Dec 06 19:32:49.334794 2025] [:error] [pid 61216:tid 61249] [client 4.218.14.204:1134] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTQUYTHlXXVdP5ewviUY6AAAAEM"]
[Sat Dec 06 19:32:49.924581 2025] [:error] [pid 35622:tid 35657] [client 4.218.14.204:40568] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTQUYSOSP_9DVLgFwI667AAAAYY"]
[Sat Dec 06 19:32:51.341829 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:46289] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTQUYy5zgnu67Yo7vrYGGgAAApI"]
[Sat Dec 06 19:32:52.512826 2025] [:error] [pid 61303:tid 61318] [client 4.218.14.204:46296] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTQUZNwK_fe00OH7zy6QjQAAAMw"]
[Sat Dec 06 19:32:53.312732 2025] [:error] [pid 35622:tid 35663] [client 4.218.14.204:1233] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/static/sallu.php"] [unique_id "aTQUZSOSP_9DVLgFwI669AAAAYw"]
[Sat Dec 06 19:32:54.163339 2025] [:error] [pid 1838:tid 1862] [client 4.218.14.204:50638] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/static/sallu.php"] [unique_id "aTQUZi5zgnu67Yo7vrYGIQAAApA"]
[Sat Dec 06 19:32:54.773851 2025] [:error] [pid 52809:tid 52828] [client 4.218.14.204:40529] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/static/sallu.php"] [unique_id "aTQUZurRwgsmpIJQ2qZ1aQAAAhE"]
[Sat Dec 06 19:32:55.796437 2025] [:error] [pid 1838:tid 1849] [client 4.218.14.204:1245] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/static/sallu.php"] [unique_id "aTQUZy5zgnu67Yo7vrYGKwAAAoM"]
[Sat Dec 06 19:32:56.581246 2025] [:error] [pid 61303:tid 61321] [client 4.218.14.204:1105] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTQUaNwK_fe00OH7zy6QkQAAAM4"]
[Sat Dec 06 19:32:57.216588 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:46310] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTQUaS5zgnu67Yo7vrYGLgAAApI"]
[Sat Dec 06 19:32:57.713409 2025] [:error] [pid 52809:tid 52830] [client 4.218.14.204:1226] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTQUaerRwgsmpIJQ2qZ1awAAAhM"]
[Sat Dec 06 19:32:58.139506 2025] [:error] [pid 61216:tid 61258] [client 4.218.14.204:40547] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTQUajHlXXVdP5ewviUZAwAAAEw"]
[Sat Dec 06 19:32:59.100485 2025] [:error] [pid 61217:tid 61275] [client 4.218.14.204:40536] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTQUa1dSKQYfLI3fYo5__QAAAII"]
[Sat Dec 06 19:33:00.359759 2025] [:error] [pid 52809:tid 52814] [client 4.218.14.204:46276] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTQUbOrRwgsmpIJQ2qZ1bQAAAgM"]
[Sat Dec 06 19:33:01.308857 2025] [:error] [pid 1838:tid 1870] [client 4.218.14.204:38016] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTQUbS5zgnu67Yo7vrYGNAAAApg"]
[Sat Dec 06 19:33:02.272384 2025] [:error] [pid 61215:tid 61221] [client 4.218.14.204:50531] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTQUbuOOZ8nTCBYuI-xFmAAAAAI"]
[Sat Dec 06 19:33:03.969486 2025] [:error] [pid 61216:tid 61268] [client 4.218.14.204:38078] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aTQUbzHlXXVdP5ewviUZCAAAAFY"]
[Sat Dec 06 19:33:04.917915 2025] [:error] [pid 1727:tid 1744] [client 4.218.14.204:46302] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aTQUcMD83luYT37-ZaUFtQAAAk8"]
[Sat Dec 06 19:33:05.462923 2025] [:error] [pid 1838:tid 1870] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Dec 06 19:33:05.615427 2025] [:error] [pid 1838:tid 1850] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/33.php
[Sat Dec 06 19:33:05.768819 2025] [:error] [pid 1838:tid 1854] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/wcas.php
[Sat Dec 06 19:33:06.739205 2025] [:error] [pid 1838:tid 1851] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sat Dec 06 19:33:06.888985 2025] [:error] [pid 1838:tid 1847] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sat Dec 06 19:33:07.049458 2025] [:error] [pid 1838:tid 1862] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Dec 06 19:33:07.200257 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/lol.php
[Sat Dec 06 19:33:07.350686 2025] [:error] [pid 1838:tid 1860] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/fileas.php
[Sat Dec 06 19:33:07.514768 2025] [:error] [pid 1838:tid 1855] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sat Dec 06 19:33:07.666922 2025] [:error] [pid 1838:tid 1868] [client 4.218.14.204:40566] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv2.php
[Sat Dec 06 19:33:07.818862 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:40566] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aTQUcy5zgnu67Yo7vrYGTAAAAoI"]
[Sat Dec 06 19:33:08.294112 2025] [:error] [pid 48399:tid 48403] [client 4.218.14.204:46328] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aTQUdOjNPOrIshd8Ewe2TwAAAcI"]
[Sat Dec 06 19:33:08.857949 2025] [:error] [pid 61215:tid 61230] [client 4.218.14.204:40539] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aTQUdOOOZ8nTCBYuI-xFqQAAAAs"]
[Sat Dec 06 19:33:10.867033 2025] [:error] [pid 52809:tid 52832] [client 4.218.14.204:46274] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aTQUdurRwgsmpIJQ2qZ1dAAAAhU"]
[Sat Dec 06 19:33:11.457171 2025] [:error] [pid 61215:tid 61227] [client 4.218.14.204:50643] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aTQUd-OOZ8nTCBYuI-xFswAAAAg"]
[Sat Dec 06 19:33:12.737581 2025] [:error] [pid 61215:tid 61231] [client 4.218.14.204:38815] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aTQUeOOOZ8nTCBYuI-xFtgAAAAw"]
[Sat Dec 06 19:33:13.436421 2025] [:error] [pid 52809:tid 52835] [client 4.218.14.204:46326] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aTQUeerRwgsmpIJQ2qZ1dgAAAhg"]
[Sat Dec 06 19:33:14.502012 2025] [:error] [pid 48399:tid 48407] [client 4.218.14.204:48664] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aTQUeujNPOrIshd8Ewe2VQAAAcY"]
[Sat Dec 06 19:33:14.962670 2025] [:error] [pid 1727:tid 1730] [client 4.218.14.204:38051] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aTQUesD83luYT37-ZaUFvwAAAkE"]
[Sat Dec 06 19:33:15.896463 2025] [:error] [pid 1727:tid 1741] [client 4.218.14.204:50626] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aTQUe8D83luYT37-ZaUFwgAAAkw"]
[Sat Dec 06 19:33:16.303140 2025] [:error] [pid 1727:tid 1740] [client 4.218.14.204:50516] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aTQUfMD83luYT37-ZaUFxQAAAks"]
[Sat Dec 06 19:33:16.915777 2025] [:error] [pid 52809:tid 52825] [client 4.218.14.204:40552] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aTQUfOrRwgsmpIJQ2qZ1fQAAAg4"]
[Sat Dec 06 19:33:18.041797 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:38821] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTQUfjHlXXVdP5ewviUZGAAAAEs"]
[Sat Dec 06 19:33:19.295958 2025] [:error] [pid 1838:tid 1858] [client 4.218.14.204:38820] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTQUfy5zgnu67Yo7vrYGUwAAAow"]
[Sat Dec 06 19:33:19.908392 2025] [:error] [pid 61215:tid 61238] [client 4.218.14.204:40573] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTQUf-OOZ8nTCBYuI-xFuwAAABM"]
[Sat Dec 06 19:33:20.347639 2025] [:error] [pid 1838:tid 1866] [client 4.218.14.204:48963] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTQUgC5zgnu67Yo7vrYGVQAAApQ"]
[Sat Dec 06 19:33:21.417895 2025] [:error] [pid 1727:tid 1751] [client 4.218.14.204:1216] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aTQUgcD83luYT37-ZaUFygAAAlY"]
[Sat Dec 06 19:33:22.817874 2025] [:error] [pid 48399:tid 48403] [client 4.218.14.204:50630] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aTQUgujNPOrIshd8Ewe2XQAAAcI"]
[Sat Dec 06 19:33:23.858127 2025] [:error] [pid 52809:tid 52820] [client 4.218.14.204:48982] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aTQUg-rRwgsmpIJQ2qZ1ggAAAgk"]
[Sat Dec 06 19:33:24.598721 2025] [:error] [pid 52809:tid 52815] [client 4.218.14.204:50628] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aTQUhOrRwgsmpIJQ2qZ1hgAAAgQ"]
[Sat Dec 06 19:33:26.305421 2025] [:error] [pid 48399:tid 48402] [client 4.218.14.204:1619] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aTQUhujNPOrIshd8Ewe2YQAAAcE"]
[Sat Dec 06 19:33:27.344278 2025] [:error] [pid 35591:tid 35615] [client 4.218.14.204:50736] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aTQUh4bmw-7bFvTxc9MSDAAAARY"]
[Sat Dec 06 19:33:29.084180 2025] [:error] [pid 35591:tid 35610] [client 4.218.14.204:49228] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aTQUiYbmw-7bFvTxc9MSDwAAARE"]
[Sat Dec 06 19:33:30.057044 2025] [:error] [pid 52809:tid 52827] [client 4.218.14.204:46020] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aTQUiurRwgsmpIJQ2qZ1kQAAAhA"]
[Sat Dec 06 19:33:31.618177 2025] [:error] [pid 35591:tid 35605] [client 4.218.14.204:40481] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aTQUi4bmw-7bFvTxc9MSEQAAAQw"]
[Sat Dec 06 19:33:35.505984 2025] [:error] [pid 61217:tid 61292] [client 4.218.14.204:37969] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aTQUj1dSKQYfLI3fYo6AEAAAAJM"]
[Sat Dec 06 19:33:35.849607 2025] [:error] [pid 1838:tid 1866] [client 4.218.14.204:38011] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aTQUjy5zgnu67Yo7vrYGbgAAApQ"]
[Sat Dec 06 19:33:37.163818 2025] [:error] [pid 52809:tid 52833] [client 4.218.14.204:37997] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aTQUkerRwgsmpIJQ2qZ1lwAAAhY"]
[Sat Dec 06 19:33:38.012641 2025] [:error] [pid 61216:tid 61259] [client 4.218.14.204:47571] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTQUkjHlXXVdP5ewviUZLgAAAE0"]
[Sat Dec 06 19:33:39.421455 2025] [:error] [pid 1727:tid 1753] [client 4.218.14.204:47604] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTQUk8D83luYT37-ZaUFzwAAAlg"]
[Sat Dec 06 19:33:39.868556 2025] [:error] [pid 61216:tid 61260] [client 4.218.14.204:36828] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTQUkzHlXXVdP5ewviUZLwAAAE4"]
[Sat Dec 06 19:33:41.143817 2025] [:error] [pid 61303:tid 61307] [client 4.218.14.204:48768] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTQUldwK_fe00OH7zy6QsgAAAME"]
[Sat Dec 06 19:33:42.141142 2025] [:error] [pid 61303:tid 61308] [client 4.218.14.204:48806] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aTQUltwK_fe00OH7zy6QtQAAAMI"]
[Sat Dec 06 19:33:42.806849 2025] [:error] [pid 61303:tid 61316] [client 4.218.14.204:44095] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aTQUltwK_fe00OH7zy6QuAAAAMo"]
[Sat Dec 06 19:33:44.279502 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:44097] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aTQUmDHlXXVdP5ewviUZOQAAAEs"]
[Sat Dec 06 19:33:45.162096 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:37953] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aTQUmS5zgnu67Yo7vrYGdgAAAoI"]
[Sat Dec 06 19:33:45.976118 2025] [:error] [pid 61216:tid 61256] [client 4.218.14.204:47554] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aTQUmTHlXXVdP5ewviUZQQAAAEo"]
[Sat Dec 06 19:33:47.141360 2025] [:error] [pid 61216:tid 61267] [client 4.218.14.204:48811] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aTQUmzHlXXVdP5ewviUZRAAAAFU"]
[Sat Dec 06 19:33:48.643343 2025] [:error] [pid 61303:tid 61307] [client 4.218.14.204:36836] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aTQUnNwK_fe00OH7zy6QyQAAAME"]
[Sat Dec 06 19:33:49.674293 2025] [:error] [pid 61216:tid 61252] [client 4.218.14.204:48821] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aTQUnTHlXXVdP5ewviUZSQAAAEY"]
[Sat Dec 06 19:33:50.223830 2025] [:error] [pid 61215:tid 61228] [client 4.218.14.204:42877] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aTQUnuOOZ8nTCBYuI-xFzwAAAAk"]
[Sat Dec 06 19:33:51.128704 2025] [:error] [pid 61215:tid 61243] [client 4.218.14.204:44144] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aTQUn-OOZ8nTCBYuI-xF0QAAABg"]
[Sat Dec 06 19:33:51.899220 2025] [:error] [pid 61303:tid 61321] [client 4.218.14.204:48813] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aTQUn9wK_fe00OH7zy6QzwAAAM4"]
[Sat Dec 06 19:33:52.537108 2025] [:error] [pid 35622:tid 35671] [client 4.218.14.204:42844] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aTQUoCOSP_9DVLgFwI67DQAAAZQ"]
[Sat Dec 06 19:33:53.194688 2025] [:error] [pid 35622:tid 35652] [client 4.218.14.204:36853] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aTQUoSOSP_9DVLgFwI67EAAAAYE"]
[Sat Dec 06 19:33:54.489440 2025] [:error] [pid 61303:tid 61314] [client 4.218.14.204:36842] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aTQUotwK_fe00OH7zy6Q0wAAAMg"]
[Sat Dec 06 19:33:55.971880 2025] [:error] [pid 35622:tid 35668] [client 4.218.14.204:37955] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aTQUoyOSP_9DVLgFwI67EQAAAZE"]
[Sat Dec 06 19:33:57.809227 2025] [:error] [pid 48399:tid 48415] [client 4.218.14.204:49990] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aTQUpejNPOrIshd8Ewe2eQAAAc4"]
[Sat Dec 06 19:33:58.921271 2025] [:error] [pid 61216:tid 61261] [client 4.218.14.204:36837] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abt.php"] [unique_id "aTQUpjHlXXVdP5ewviUZXQAAAE8"]
[Sat Dec 06 19:33:59.627935 2025] [:error] [pid 35591:tid 35609] [client 4.218.14.204:42831] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abt.php"] [unique_id "aTQUp4bmw-7bFvTxc9MSIQAAARA"]
[Sat Dec 06 19:34:00.803373 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:44154] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abt.php"] [unique_id "aTQUqDHlXXVdP5ewviUZYQAAAEs"]
[Sat Dec 06 19:34:01.435980 2025] [:error] [pid 61216:tid 61262] [client 4.218.14.204:38010] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abt.php"] [unique_id "aTQUqTHlXXVdP5ewviUZYwAAAFA"]
[Sat Dec 06 19:34:02.763597 2025] [:error] [pid 35622:tid 35663] [client 4.218.14.204:47656] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aTQUqiOSP_9DVLgFwI67FAAAAYw"]
[Sat Dec 06 19:34:04.572014 2025] [:error] [pid 61216:tid 61246] [client 4.218.14.204:36804] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aTQUrDHlXXVdP5ewviUZagAAAEA"]
[Sat Dec 06 19:34:05.420904 2025] [:error] [pid 61217:tid 61280] [client 4.218.14.204:38014] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aTQUrVdSKQYfLI3fYo6AGAAAAIc"]
[Sat Dec 06 19:34:06.878272 2025] [:error] [pid 61216:tid 61259] [client 4.218.14.204:36819] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aTQUrjHlXXVdP5ewviUZdAAAAE0"]
[Sat Dec 06 19:34:08.229234 2025] [:error] [pid 61303:tid 61330] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Sat Dec 06 19:34:08.382604 2025] [:error] [pid 61303:tid 61307] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sat Dec 06 19:34:08.532327 2025] [:error] [pid 61303:tid 61323] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Dec 06 19:34:08.684000 2025] [:error] [pid 61303:tid 61329] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/nope.php
[Sat Dec 06 19:34:08.866435 2025] [:error] [pid 61303:tid 61313] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/js.php
[Sat Dec 06 19:34:09.181597 2025] [:error] [pid 61303:tid 61310] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Sat Dec 06 19:34:09.488052 2025] [:error] [pid 61303:tid 61306] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sat Dec 06 19:34:09.817995 2025] [:error] [pid 61303:tid 61316] [client 4.218.14.204:42821] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Sat Dec 06 19:34:09.964490 2025] [:error] [pid 61303:tid 61321] [client 4.218.14.204:42821] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTQUsdwK_fe00OH7zy6Q4QAAAM4"]
[Sat Dec 06 19:34:11.595202 2025] [:error] [pid 61217:tid 61277] [client 4.218.14.204:44086] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTQUs1dSKQYfLI3fYo6AHAAAAIQ"]
[Sat Dec 06 19:34:12.974445 2025] [:error] [pid 1838:tid 1856] [client 4.218.14.204:44040] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTQUtC5zgnu67Yo7vrYGlQAAAoo"]
[Sat Dec 06 19:34:13.706451 2025] [:error] [pid 1727:tid 1731] [client 4.218.14.204:50027] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTQUtcD83luYT37-ZaUF1wAAAkI"]
[Sat Dec 06 19:34:15.496486 2025] [:error] [pid 48399:tid 48414] [client 4.218.14.204:36847] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sko.php"] [unique_id "aTQUt-jNPOrIshd8Ewe2jQAAAc0"]
[Sat Dec 06 19:34:17.174841 2025] [:error] [pid 61216:tid 61262] [client 4.218.14.204:48805] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sko.php"] [unique_id "aTQUuTHlXXVdP5ewviUZiAAAAFA"]
[Sat Dec 06 19:34:18.142290 2025] [:error] [pid 61303:tid 61314] [client 4.218.14.204:36822] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sko.php"] [unique_id "aTQUutwK_fe00OH7zy6Q5wAAAMg"]
[Sat Dec 06 19:34:18.881514 2025] [:error] [pid 61216:tid 61263] [client 4.218.14.204:37980] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sko.php"] [unique_id "aTQUujHlXXVdP5ewviUZjAAAAFE"]
[Sat Dec 06 19:34:19.381600 2025] [:error] [pid 1727:tid 1735] [client 4.218.14.204:37983] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTQUu8D83luYT37-ZaUF3gAAAkY"]
[Sat Dec 06 19:34:21.016035 2025] [:error] [pid 61303:tid 61308] [client 4.218.14.204:36800] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTQUvdwK_fe00OH7zy6Q8AAAAMI"]
[Sat Dec 06 19:34:21.896536 2025] [:error] [pid 1727:tid 1738] [client 4.218.14.204:44062] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTQUvcD83luYT37-ZaUF4AAAAkk"]
[Sat Dec 06 19:34:22.422545 2025] [:error] [pid 1727:tid 1747] [client 4.218.14.204:42853] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aTQUvsD83luYT37-ZaUF4gAAAlI"]
[Sat Dec 06 19:34:23.624786 2025] [:error] [pid 1838:tid 1862] [client 4.218.14.204:44120] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aTQUvy5zgnu67Yo7vrYGqwAAApA"]
[Sat Dec 06 19:34:24.038127 2025] [:error] [pid 61303:tid 61323] [client 4.218.14.204:36829] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aTQUwNwK_fe00OH7zy6Q_QAAANA"]
[Sat Dec 06 19:34:24.583020 2025] [:error] [pid 1838:tid 1860] [client 4.218.14.204:44055] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aTQUwC5zgnu67Yo7vrYGrQAAAo4"]
[Sat Dec 06 19:34:24.948430 2025] [:error] [pid 61303:tid 61319] [client 4.218.14.204:46274] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aTQUwNwK_fe00OH7zy6RAQAAAM0"]
[Sat Dec 06 19:34:25.270019 2025] [:error] [pid 35622:tid 35673] [client 4.218.14.204:47639] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aTQUwSOSP_9DVLgFwI67HAAAAZY"]
[Sat Dec 06 19:34:26.220349 2025] [:error] [pid 35622:tid 35670] [client 4.218.14.204:42866] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aTQUwiOSP_9DVLgFwI67IAAAAZM"]
[Sat Dec 06 19:34:27.496806 2025] [:error] [pid 52809:tid 52835] [client 4.218.14.204:48769] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aTQUw-rRwgsmpIJQ2qZ1pgAAAhg"]
[Sat Dec 06 19:34:27.975731 2025] [:error] [pid 35622:tid 35654] [client 4.218.14.204:42842] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aTQUwyOSP_9DVLgFwI67KgAAAYM"]
[Sat Dec 06 19:34:28.554677 2025] [:error] [pid 52809:tid 52830] [client 4.218.14.204:42850] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aTQUxOrRwgsmpIJQ2qZ1qQAAAhM"]
[Sat Dec 06 19:34:28.925102 2025] [:error] [pid 52809:tid 52826] [client 4.218.14.204:42864] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aTQUxOrRwgsmpIJQ2qZ1rAAAAg8"]
[Sat Dec 06 19:34:29.473609 2025] [:error] [pid 35622:tid 35656] [client 4.218.14.204:42871] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aTQUxSOSP_9DVLgFwI67LAAAAYU"]
[Sat Dec 06 19:34:30.065657 2025] [:error] [pid 52809:tid 52815] [client 4.218.14.204:42827] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aTQUxurRwgsmpIJQ2qZ1sQAAAgQ"]
[Sat Dec 06 19:34:31.218095 2025] [:error] [pid 52809:tid 52831] [client 4.218.14.204:48778] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTQUx-rRwgsmpIJQ2qZ1tQAAAhQ"]
[Sat Dec 06 19:34:32.352024 2025] [:error] [pid 1838:tid 1863] [client 4.218.14.204:48831] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTQUyC5zgnu67Yo7vrYGtAAAApE"]
[Sat Dec 06 19:34:32.843669 2025] [:error] [pid 1727:tid 1750] [client 4.218.14.204:37094] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTQUyMD83luYT37-ZaUF7QAAAlU"]
[Sat Dec 06 19:34:33.317874 2025] [:error] [pid 52809:tid 52832] [client 4.218.14.204:44133] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTQUyerRwgsmpIJQ2qZ1uQAAAhU"]
[Sat Dec 06 19:34:33.809927 2025] [:error] [pid 61215:tid 61224] [client 4.218.14.204:36848] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aTQUyeOOZ8nTCBYuI-xF2wAAAAU"]
[Sat Dec 06 19:34:34.272832 2025] [:error] [pid 61217:tid 61286] [client 4.218.14.204:36812] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aTQUyldSKQYfLI3fYo6AIAAAAI0"]
[Sat Dec 06 19:34:35.426738 2025] [:error] [pid 1727:tid 1740] [client 4.218.14.204:36836] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aTQUy8D83luYT37-ZaUF9AAAAks"]
[Sat Dec 06 19:34:36.468618 2025] [:error] [pid 61303:tid 61310] [client 4.218.14.204:42851] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aTQUzNwK_fe00OH7zy6RDAAAAMQ"]
[Sat Dec 06 19:34:37.763210 2025] [:error] [pid 61303:tid 61326] [client 4.218.14.204:39412] [client 4.218.14.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aTQUzdwK_fe00OH7zy6RDgAAANM"]
[Sat Dec 06 19:34:38.554947 2025] [:error] [pid 61303:tid 61309] [client 4.218.14.204:39410] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "aTQUztwK_fe00OH7zy6REAAAAMM"]
[Sat Dec 06 19:34:39.007978 2025] [:error] [pid 48399:tid 48404] [client 4.218.14.204:47663] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "aTQUz-jNPOrIshd8Ewe2lwAAAcM"]
[Sat Dec 06 19:34:39.745482 2025] [:error] [pid 35591:tid 35597] [client 4.218.14.204:50404] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "aTQUz4bmw-7bFvTxc9MSIwAAAQQ"]
[Sat Dec 06 19:34:40.225743 2025] [:error] [pid 35591:tid 35608] [client 4.218.14.204:50397] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "aTQU0Ibmw-7bFvTxc9MSJAAAAQ8"]
[Sat Dec 06 19:34:41.611334 2025] [:error] [pid 35591:tid 35616] [client 4.218.14.204:39405] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftp.php"] [unique_id "aTQU0Ybmw-7bFvTxc9MSKAAAARc"]
[Sat Dec 06 19:34:42.648365 2025] [:error] [pid 35622:tid 35653] [client 4.218.14.204:39669] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftp.php"] [unique_id "aTQU0iOSP_9DVLgFwI67NgAAAYI"]
[Sat Dec 06 19:34:43.264328 2025] [:error] [pid 35622:tid 35651] [client 4.218.14.204:47622] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftp.php"] [unique_id "aTQU0yOSP_9DVLgFwI67NwAAAYA"]
[Sat Dec 06 19:34:43.976333 2025] [:error] [pid 35622:tid 35671] [client 4.218.14.204:39386] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftp.php"] [unique_id "aTQU0yOSP_9DVLgFwI67OQAAAZQ"]
[Sat Dec 06 19:34:44.507580 2025] [:error] [pid 35622:tid 35659] [client 4.218.14.204:50396] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTQU1COSP_9DVLgFwI67OwAAAYg"]
[Sat Dec 06 19:34:45.185323 2025] [:error] [pid 1838:tid 1859] [client 4.218.14.204:40161] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTQU1S5zgnu67Yo7vrYGuwAAAo0"]
[Sat Dec 06 19:34:46.120179 2025] [:error] [pid 61303:tid 61313] [client 4.218.14.204:1803] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTQU1twK_fe00OH7zy6RFwAAAMc"]
[Sat Dec 06 19:34:46.859497 2025] [:error] [pid 35622:tid 35669] [client 4.218.14.204:1802] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTQU1iOSP_9DVLgFwI67PgAAAZI"]
[Sat Dec 06 19:34:47.308982 2025] [:error] [pid 48399:tid 48413] [client 4.218.14.204:50419] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTQU1-jNPOrIshd8Ewe2oAAAAcw"]
[Sat Dec 06 19:34:48.070813 2025] [:error] [pid 61215:tid 61233] [client 4.218.14.204:1832] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTQU2OOOZ8nTCBYuI-xF5gAAAA4"]
[Sat Dec 06 19:34:49.605176 2025] [:error] [pid 61303:tid 61314] [client 4.218.14.204:41631] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTQU2dwK_fe00OH7zy6RHgAAAMg"]
[Sat Dec 06 19:34:51.108716 2025] [:error] [pid 61303:tid 61323] [client 4.218.14.204:45324] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTQU29wK_fe00OH7zy6RIwAAANA"]
[Sat Dec 06 19:34:52.264473 2025] [:error] [pid 1838:tid 1867] [client 4.218.14.204:34064] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "aTQU3C5zgnu67Yo7vrYGyAAAApU"]
[Sat Dec 06 19:34:53.127371 2025] [:error] [pid 1838:tid 1868] [client 4.218.14.204:34061] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "aTQU3S5zgnu67Yo7vrYGzgAAApY"]
[Sat Dec 06 19:34:54.032061 2025] [:error] [pid 1838:tid 1856] [client 4.218.14.204:2030] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "aTQU3i5zgnu67Yo7vrYG1QAAAoo"]
[Sat Dec 06 19:34:54.602364 2025] [:error] [pid 61216:tid 61267] [client 4.218.14.204:46120] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "aTQU3jHlXXVdP5ewviUZqwAAAFU"]
[Sat Dec 06 19:34:55.600256 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:40128] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aTQU3y5zgnu67Yo7vrYG2gAAApI"]
[Sat Dec 06 19:34:57.147654 2025] [:error] [pid 1727:tid 1753] [client 4.218.14.204:40163] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aTQU4cD83luYT37-ZaUF_gAAAlg"]
[Sat Dec 06 19:34:58.404504 2025] [:error] [pid 1727:tid 1732] [client 4.218.14.204:41727] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aTQU4sD83luYT37-ZaUF_wAAAkM"]
[Sat Dec 06 19:34:59.816937 2025] [:error] [pid 1838:tid 1851] [client 4.218.14.204:45340] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aTQU4y5zgnu67Yo7vrYG4AAAAoU"]
[Sat Dec 06 19:35:00.630617 2025] [:error] [pid 61303:tid 61327] [client 4.218.14.204:41679] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTQU5NwK_fe00OH7zy6RNAAAANQ"]
[Sat Dec 06 19:35:01.692353 2025] [:error] [pid 35622:tid 35662] [client 4.218.14.204:46375] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTQU5SOSP_9DVLgFwI67TwAAAYs"]
[Sat Dec 06 19:35:02.735499 2025] [:error] [pid 61303:tid 61306] [client 4.218.14.204:48042] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTQU5twK_fe00OH7zy6RPQAAAMA"]
[Sat Dec 06 19:35:04.086647 2025] [:error] [pid 61303:tid 61324] [client 4.218.14.204:48040] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTQU6NwK_fe00OH7zy6RRAAAANE"]
[Sat Dec 06 19:35:05.404808 2025] [:error] [pid 61216:tid 61253] [client 4.218.14.204:41613] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aTQU6THlXXVdP5ewviUZtwAAAEc"]
[Sat Dec 06 19:35:06.343264 2025] [:error] [pid 48399:tid 48408] [client 4.218.14.204:46094] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aTQU6ujNPOrIshd8Ewe2xQAAAcc"]
[Sat Dec 06 19:35:06.749465 2025] [:error] [pid 48399:tid 48403] [client 4.218.14.204:46085] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aTQU6ujNPOrIshd8Ewe2xgAAAcI"]
[Sat Dec 06 19:35:07.225824 2025] [:error] [pid 48399:tid 48401] [client 4.218.14.204:46092] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aTQU6-jNPOrIshd8Ewe2xwAAAcA"]
[Sat Dec 06 19:35:07.968428 2025] [:error] [pid 61215:tid 61239] [client 4.218.14.204:41709] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test2.php"] [unique_id "aTQU6-OOZ8nTCBYuI-xF8AAAABQ"]
[Sat Dec 06 19:35:08.461862 2025] [:error] [pid 48399:tid 48410] [client 4.218.14.204:46359] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test2.php"] [unique_id "aTQU7OjNPOrIshd8Ewe2ygAAAck"]
[Sat Dec 06 19:35:09.104292 2025] [:error] [pid 1727:tid 1750] [client 4.218.14.204:46376] File does not exist: /usr/local/apache/htdocs/suspended-page/test2.php
[Sat Dec 06 19:35:09.436878 2025] [:error] [pid 1727:tid 1752] [client 4.218.14.204:46376] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sat Dec 06 19:35:09.589685 2025] [:error] [pid 1727:tid 1729] [client 4.218.14.204:46376] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 06 19:35:09.770296 2025] [:error] [pid 1727:tid 1748] [client 4.218.14.204:46376] [client 4.218.14.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aTQU7cD83luYT37-ZaUGDwAAAlM"]
[Sat Dec 06 19:35:10.623753 2025] [:error] [pid 61216:tid 61251] [client 4.218.14.204:41628] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Sat Dec 06 19:35:10.798751 2025] [:error] [pid 61216:tid 61258] [client 4.218.14.204:41628] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Dec 06 19:35:10.959519 2025] [:error] [pid 61216:tid 61268] [client 4.218.14.204:41628] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sat Dec 06 19:35:11.109721 2025] [:error] [pid 61216:tid 61250] [client 4.218.14.204:41628] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Dec 06 19:35:11.288437 2025] [:error] [pid 61216:tid 61264] [client 4.218.14.204:41628] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp.php
[Sat Dec 06 19:35:11.437885 2025] [:error] [pid 61216:tid 61266] [client 4.218.14.204:41628] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 06 19:35:11.590513 2025] [:error] [pid 61216:tid 61262] [client 4.218.14.204:41628] [client 4.218.14.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aTQU7zHlXXVdP5ewviUZxQAAAFA"]
[Sat Dec 06 19:35:11.892135 2025] [:error] [pid 1838:tid 1851] [client 4.218.14.204:46141] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Dec 06 19:35:12.163315 2025] [:error] [pid 1838:tid 1862] [client 4.218.14.204:46141] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aTQU8C5zgnu67Yo7vrYHAQAAApA"]
[Sat Dec 06 19:35:12.754485 2025] [:error] [pid 1838:tid 1857] [client 4.218.14.204:46129] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aTQU8C5zgnu67Yo7vrYHBAAAAos"]
[Sat Dec 06 19:35:14.293033 2025] [:error] [pid 1727:tid 1740] [client 4.218.14.204:41623] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aTQU8sD83luYT37-ZaUGEQAAAks"]
[Sat Dec 06 19:35:15.525841 2025] [:error] [pid 61216:tid 61247] [client 4.218.14.204:41614] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aTQU8zHlXXVdP5ewviUZxwAAAEE"]
[Sat Dec 06 19:35:17.574737 2025] [:error] [pid 1727:tid 1731] [client 4.218.14.204:46082] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aTQU9cD83luYT37-ZaUGFAAAAkI"]
[Sat Dec 06 19:35:18.665773 2025] [:error] [pid 61215:tid 61225] [client 4.218.14.204:46133] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aTQU9uOOZ8nTCBYuI-xF9AAAAAY"]
[Sat Dec 06 19:35:19.568876 2025] [:error] [pid 1727:tid 1733] [client 4.218.14.204:46364] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aTQU98D83luYT37-ZaUGFgAAAkQ"]
[Sat Dec 06 19:35:20.695988 2025] [:error] [pid 35622:tid 35657] [client 4.218.14.204:46135] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aTQU-COSP_9DVLgFwI67XgAAAYY"]
[Sat Dec 06 19:35:21.522348 2025] [:error] [pid 35622:tid 35655] [client 4.218.14.204:41689] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aTQU-SOSP_9DVLgFwI67YAAAAYQ"]
[Sat Dec 06 19:35:22.031880 2025] [:error] [pid 48399:tid 48415] [client 4.218.14.204:37627] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aTQU-ujNPOrIshd8Ewe20AAAAc4"]
[Sat Dec 06 19:35:22.884478 2025] [:error] [pid 1838:tid 1868] [client 4.218.14.204:2014] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aTQU-i5zgnu67Yo7vrYHFwAAApY"]
[Sat Dec 06 19:35:23.404688 2025] [:error] [pid 1838:tid 1857] [client 4.218.14.204:1678] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ouh.php"] [unique_id "aTQU-y5zgnu67Yo7vrYHGQAAAos"]
[Sat Dec 06 19:35:24.290799 2025] [:error] [pid 1838:tid 1848] [client 4.218.14.204:46369] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aTQU_C5zgnu67Yo7vrYHGgAAAoI"]
[Sat Dec 06 19:35:25.088614 2025] [:error] [pid 1838:tid 1847] [client 4.218.14.204:48018] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aTQU_S5zgnu67Yo7vrYHGwAAAoE"]
[Sat Dec 06 19:35:25.640719 2025] [:error] [pid 1838:tid 1867] [client 4.218.14.204:46107] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aTQU_S5zgnu67Yo7vrYHHgAAApU"]
[Sat Dec 06 19:35:26.973113 2025] [:error] [pid 1727:tid 1741] [client 4.218.14.204:41664] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tgrs.php"] [unique_id "aTQU_sD83luYT37-ZaUGJwAAAkw"]
[Sat Dec 06 19:35:28.344321 2025] [:error] [pid 61303:tid 61327] [client 4.218.14.204:39412] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aTQVANwK_fe00OH7zy6RWQAAANQ"]
[Sat Dec 06 19:35:28.937111 2025] [:error] [pid 48399:tid 48404] [client 4.218.14.204:48042] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aTQVAOjNPOrIshd8Ewe20wAAAcM"]
[Sat Dec 06 19:35:29.819914 2025] [:error] [pid 35591:tid 35594] [client 4.218.14.204:2017] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aTQVAYbmw-7bFvTxc9MSWwAAAQE"]
[Sat Dec 06 19:35:30.397894 2025] [:error] [pid 35591:tid 35597] [client 4.218.14.204:1710] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aTQVAobmw-7bFvTxc9MSXQAAAQQ"]
[Sat Dec 06 19:35:31.219328 2025] [:error] [pid 1838:tid 1864] [client 4.218.14.204:37630] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTQVAy5zgnu67Yo7vrYHJQAAApI"]
[Sat Dec 06 19:35:31.935438 2025] [:error] [pid 1838:tid 1849] [client 4.218.14.204:41641] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTQVAy5zgnu67Yo7vrYHJwAAAoM"]
[Sat Dec 06 19:35:33.094599 2025] [:error] [pid 35591:tid 35616] [client 4.218.14.204:46090] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTQVBYbmw-7bFvTxc9MSYgAAARc"]
[Sat Dec 06 19:35:33.841743 2025] [:error] [pid 35622:tid 35657] [client 4.218.14.204:45514] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTQVBSOSP_9DVLgFwI67aQAAAYY"]
[Sat Dec 06 19:35:34.890466 2025] [:error] [pid 35591:tid 35615] [client 4.218.14.204:46352] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aTQVBobmw-7bFvTxc9MSZgAAARY"]
[Sat Dec 06 19:35:35.699617 2025] [:error] [pid 35591:tid 35611] [client 4.218.14.204:41665] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aTQVB4bmw-7bFvTxc9MSbQAAARI"]
[Sat Dec 06 19:35:38.427820 2025] [:error] [pid 61216:tid 61257] [client 4.218.14.204:1699] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aTQVCjHlXXVdP5ewviUZ0QAAAEs"]
[Sat Dec 06 19:35:39.407602 2025] [:error] [pid 1727:tid 1734] [client 4.218.14.204:37592] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aTQVC8D83luYT37-ZaUGMwAAAkU"]
[Sat Dec 06 19:35:40.227433 2025] [:error] [pid 1727:tid 1739] [client 4.218.14.204:41644] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aTQVDMD83luYT37-ZaUGNQAAAko"]
[Sat Dec 06 19:35:40.813491 2025] [:error] [pid 35591:tid 35608] [client 4.218.14.204:1709] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aTQVDIbmw-7bFvTxc9MSbwAAAQ8"]
[Sat Dec 06 19:35:41.662123 2025] [:error] [pid 1838:tid 1859] [client 4.218.14.204:48007] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aTQVDS5zgnu67Yo7vrYHLAAAAo0"]
[Sat Dec 06 19:35:42.558140 2025] [:error] [pid 61216:tid 61247] [client 4.218.14.204:45567] [client 4.218.14.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aTQVDjHlXXVdP5ewviUZ0gAAAEE"]
[Sat Dec 06 19:47:51.069066 2025] [:error] [pid 1838:tid 1869] [client 216.24.210.19:48613] [client 216.24.210.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.19, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aTQX5y5zgnu67Yo7vrYK6wAAApc"]
[Sat Dec 06 19:47:51.072364 2025] [:error] [pid 1838:tid 1869] [client 216.24.210.19:48613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Dec 06 23:19:28.670848 2025] [:error] [pid 1838:tid 1858] [client 145.239.10.137:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: http://aoswa.com.au/new.php
[Sat Dec 06 23:19:28.676509 2025] [:error] [pid 1838:tid 1860] [client 145.239.10.137:45729] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php, referer: http://aoswa.com.au/new4.php
[Sun Dec 07 05:11:01.563209 2025] [:error] [pid 34195:tid 34210] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 07 05:11:02.033703 2025] [:error] [pid 34195:tid 34216] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 07 05:11:02.461883 2025] [:error] [pid 34195:tid 34200] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 07 05:11:02.979970 2025] [:error] [pid 34195:tid 34203] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 07 05:11:03.424012 2025] [:error] [pid 34195:tid 34198] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 07 05:11:03.852648 2025] [:error] [pid 34195:tid 34214] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 07 05:11:04.297299 2025] [:error] [pid 34195:tid 34222] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 07 05:11:04.721439 2025] [:error] [pid 34195:tid 34221] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 07 05:11:05.616637 2025] [:error] [pid 34195:tid 34221] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 07 05:11:06.461501 2025] [:error] [pid 34195:tid 34211] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 07 05:11:06.891492 2025] [:error] [pid 34195:tid 34216] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 07 05:11:07.322675 2025] [:error] [pid 34195:tid 34202] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 07 05:11:07.792201 2025] [:error] [pid 34195:tid 34218] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 07 05:11:08.220802 2025] [:error] [pid 34195:tid 34201] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 07 05:11:08.651469 2025] [:error] [pid 34195:tid 34217] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 07 05:11:09.084310 2025] [:error] [pid 34195:tid 34222] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 07 05:11:09.598426 2025] [:error] [pid 34195:tid 34199] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 07 05:11:10.050067 2025] [:error] [pid 34195:tid 34208] [client 45.146.55.19:60909] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 07 05:11:16.244339 2025] [:error] [pid 34195:tid 34205] [client 45.146.55.19:60909] [client 45.146.55.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aTSb9BrSxOOdwv3vX3xabgAAAMc"]
[Sun Dec 07 05:11:18.388037 2025] [:error] [pid 13234:tid 13245] [client 45.146.55.21:20719] [client 45.146.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aTSb9u6_dquQqQ60IZ-eYQAAAYQ"]
[Sun Dec 07 05:11:20.590291 2025] [:error] [pid 34109:tid 34153] [client 45.146.55.12:25185] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 07 05:11:21.968907 2025] [:error] [pid 34109:tid 34160] [client 45.146.55.12:25185] [client 45.146.55.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aTSb-YjE_vucgM_xD4T4_gAAAFQ"]
[Sun Dec 07 05:11:24.719627 2025] [:error] [pid 34110:tid 34186] [client 45.146.55.18:44573] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Dec 07 05:11:25.140609 2025] [:error] [pid 34110:tid 34173] [client 45.146.55.18:44573] [client 45.146.55.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aTSb_QndtmtsHiXHBO2ZGwAAAIY"]
[Sun Dec 07 05:11:26.472341 2025] [:error] [pid 34195:tid 34212] [client 45.146.55.61:49459] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Dec 07 05:11:28.737296 2025] [:error] [pid 34195:tid 34212] [client 45.146.55.61:49459] [client 45.146.55.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aTScABrSxOOdwv3vX3xa7AAAAM4"]
[Sun Dec 07 05:11:30.030396 2025] [:error] [pid 7089:tid 7100] [client 45.146.55.17:33339] [client 45.146.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aTScAoJPZ-pZM-y51NHptgAAAQk"]
[Sun Dec 07 05:11:30.889869 2025] [:error] [pid 7089:tid 7115] [client 45.146.55.26:59785] [client 45.146.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aTScAoJPZ-pZM-y51NHpzAAAARg"]
[Sun Dec 07 05:11:31.730684 2025] [:error] [pid 34195:tid 34214] [client 45.146.55.62:42661] [client 45.146.55.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aTScAxrSxOOdwv3vX3xbCgAAANA"]
[Sun Dec 07 05:11:32.575766 2025] [:error] [pid 34110:tid 34179] [client 45.146.55.26:43505] [client 45.146.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aTScBAndtmtsHiXHBO2ZYgAAAIw"]
[Sun Dec 07 05:11:33.421714 2025] [:error] [pid 34108:tid 34115] [client 45.146.55.38:25991] [client 45.146.55.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aTScBaLvdvAppF-gXosq0gAAAAI"]
[Sun Dec 07 05:11:34.733453 2025] [:error] [pid 34108:tid 34123] [client 45.146.55.34:47251] [client 45.146.55.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aTScBqLvdvAppF-gXosq7QAAAAo"]
[Sun Dec 07 05:11:35.580793 2025] [:error] [pid 34110:tid 34174] [client 45.146.55.55:37321] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Dec 07 05:11:36.466278 2025] [:error] [pid 34110:tid 34185] [client 45.146.55.55:37321] [client 45.146.55.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aTScCAndtmtsHiXHBO2ZdQAAAJI"]
[Sun Dec 07 05:11:38.204498 2025] [:error] [pid 34109:tid 34159] [client 45.146.55.48:39285] [client 45.146.55.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aTScCojE_vucgM_xD4T5rgAAAFM"]
[Sun Dec 07 05:11:39.494375 2025] [:error] [pid 7089:tid 7097] [client 45.146.55.25:63237] [client 45.146.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aTScC4JPZ-pZM-y51NHqcAAAAQY"]
[Sun Dec 07 05:11:40.347655 2025] [:error] [pid 13234:tid 13251] [client 45.146.55.59:42439] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Dec 07 05:11:40.769491 2025] [:error] [pid 13234:tid 13241] [client 45.146.55.59:42439] [client 45.146.55.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aTScDO6_dquQqQ60IZ-gIQAAAYE"]
[Sun Dec 07 05:11:41.618172 2025] [:error] [pid 34195:tid 34217] [client 45.146.55.36:60427] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Dec 07 05:11:42.905490 2025] [:error] [pid 34195:tid 34215] [client 45.146.55.36:60427] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Dec 07 05:11:44.232491 2025] [:error] [pid 34195:tid 34221] [client 45.146.55.36:60427] [client 45.146.55.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aTScEBrSxOOdwv3vX3xbgwAAANc"]
[Sun Dec 07 05:11:45.079837 2025] [:error] [pid 34109:tid 34149] [client 45.146.55.62:64877] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Dec 07 05:11:45.521927 2025] [:error] [pid 34109:tid 34163] [client 45.146.55.62:64877] [client 45.146.55.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aTScEYjE_vucgM_xD4T5-AAAAFc"]
[Sun Dec 07 05:11:46.367778 2025] [:error] [pid 34109:tid 34143] [client 45.146.55.20:44053] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Dec 07 05:11:47.222306 2025] [:error] [pid 34109:tid 34156] [client 45.146.55.20:44053] [client 45.146.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aTScE4jE_vucgM_xD4T6BQAAAFA"]
[Sun Dec 07 05:11:48.497414 2025] [:error] [pid 34109:tid 34160] [client 45.146.55.47:63851] [client 45.146.55.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aTScFIjE_vucgM_xD4T6FwAAAFQ"]
[Sun Dec 07 05:51:14.875611 2025] [:error] [pid 13234:tid 13263] [client 136.144.43.241:29649] [client 136.144.43.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.43.241, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aTSlUu6_dquQqQ60IZ-94QAAAZY"]
[Sun Dec 07 05:51:14.879659 2025] [:error] [pid 13234:tid 13263] [client 136.144.43.241:29649] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Dec 07 06:28:09.391133 2025] [:error] [pid 34110:tid 34187] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sun Dec 07 06:28:09.691882 2025] [:error] [pid 34110:tid 34172] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sun Dec 07 06:28:10.300411 2025] [:error] [pid 34110:tid 34188] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Dec 07 06:28:10.602841 2025] [:error] [pid 34110:tid 34181] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Sun Dec 07 06:28:10.903947 2025] [:error] [pid 34110:tid 34176] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/php_info.php
[Sun Dec 07 06:28:11.208355 2025] [:error] [pid 34110:tid 34179] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sun Dec 07 06:28:11.513221 2025] [:error] [pid 34110:tid 34174] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Sun Dec 07 06:28:12.416718 2025] [:error] [pid 34110:tid 34180] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Sun Dec 07 06:28:12.718200 2025] [:error] [pid 34110:tid 34169] [client 45.86.202.195:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/php_version.php
[Sun Dec 07 06:28:13.317917 2025] [:error] [pid 34110:tid 34190] [client 45.86.202.195:39247] [client 45.86.202.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aTSt_QndtmtsHiXHBO27VAAAAJc"]
[Sun Dec 07 06:28:13.920951 2025] [:error] [pid 13234:tid 13248] [client 45.86.202.172:42639] [client 45.86.202.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.example"] [unique_id "aTSt_e6_dquQqQ60IZ_LcwAAAYc"]
[Sun Dec 07 06:28:14.518052 2025] [:error] [pid 34195:tid 34203] [client 45.86.202.179:60383] [client 45.86.202.179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aTSt_hrSxOOdwv3vX3x82QAAAMU"]
[Sun Dec 07 06:28:15.121355 2025] [:error] [pid 34195:tid 34222] [client 45.86.202.172:20645] [client 45.86.202.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aTSt_xrSxOOdwv3vX3x83QAAANg"]
[Sun Dec 07 06:28:15.727341 2025] [:error] [pid 34195:tid 34198] [client 45.86.202.163:32429] [client 45.86.202.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aTSt_xrSxOOdwv3vX3x84AAAAMA"]
[Sun Dec 07 11:12:48.631773 2025] [:error] [pid 25694:tid 25720] [client 4.233.91.203:59669] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Sun Dec 07 11:12:54.064696 2025] [:error] [pid 25600:tid 25621] [client 4.233.91.203:50117] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Sun Dec 07 11:13:00.218841 2025] [:error] [pid 25600:tid 25619] [client 4.233.91.203:49361] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Sun Dec 07 11:13:42.690836 2025] [:error] [pid 25601:tid 25647] [client 4.233.91.203:62431] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Sun Dec 07 12:50:42.438603 2025] [:error] [pid 25602:tid 25685] [client 85.209.135.111:39518] [client 85.209.135.111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aTUHohMayYLriq9gRde8FwAAANc"]
[Sun Dec 07 13:38:27.055199 2025] [:error] [pid 36068:tid 36086] [client 85.209.135.111:40066] [client 85.209.135.111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aTUS01GuxqM4ZYob8lPEZQAAABA"]
[Sun Dec 07 13:51:00.633964 2025] [:error] [pid 25694:tid 25713] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php, referer: https://www.google.fr/
[Sun Dec 07 13:51:00.760421 2025] [:error] [pid 25694:tid 25700] [client 4.189.120.86:38661] [client 4.189.120.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.120.86, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTUVxEf7996cewJ5N28CXwAAAQQ"], referer: https://www.bing.com/
[Sun Dec 07 13:51:00.764636 2025] [:error] [pid 25694:tid 25700] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php, referer: https://www.bing.com/
[Sun Dec 07 13:51:01.030480 2025] [:error] [pid 25694:tid 25703] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:01.147866 2025] [:error] [pid 25694:tid 25717] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:01.267496 2025] [:error] [pid 25694:tid 25710] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.com/
[Sun Dec 07 13:51:01.396771 2025] [:error] [pid 25694:tid 25702] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.com/
[Sun Dec 07 13:51:01.639653 2025] [:error] [pid 25694:tid 25719] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:01.757094 2025] [:error] [pid 25694:tid 25704] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.google.de/
[Sun Dec 07 13:51:01.874039 2025] [:error] [pid 25694:tid 25701] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://www.yahoo.com/
[Sun Dec 07 13:51:01.990955 2025] [:error] [pid 25694:tid 25716] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php, referer: https://www.google.de/
[Sun Dec 07 13:51:02.226403 2025] [:error] [pid 25694:tid 25707] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.yahoo.com/
[Sun Dec 07 13:51:02.464197 2025] [:error] [pid 25694:tid 25706] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:02.581665 2025] [:error] [pid 25694:tid 25708] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:02.699241 2025] [:error] [pid 25694:tid 25697] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:02.818247 2025] [:error] [pid 25694:tid 25698] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.yahoo.com/
[Sun Dec 07 13:51:02.937329 2025] [:error] [pid 25694:tid 25705] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.de/
[Sun Dec 07 13:51:03.054802 2025] [:error] [pid 25694:tid 25696] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.yahoo.com/
[Sun Dec 07 13:51:03.172722 2025] [:error] [pid 25694:tid 25713] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.bing.com/
[Sun Dec 07 13:51:03.408151 2025] [:error] [pid 25694:tid 25703] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:03.526444 2025] [:error] [pid 25694:tid 25717] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:03.644780 2025] [:error] [pid 25694:tid 25710] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:03.781546 2025] [:error] [pid 25694:tid 25702] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.google.fr/
[Sun Dec 07 13:51:03.901369 2025] [:error] [pid 25694:tid 25719] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:04.272150 2025] [:error] [pid 25694:tid 25699] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:04.389051 2025] [:error] [pid 25694:tid 25707] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.bing.com/
[Sun Dec 07 13:51:04.627388 2025] [:error] [pid 25694:tid 25715] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:04.870679 2025] [:error] [pid 25694:tid 25698] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php, referer: https://www.google.co.uk/
[Sun Dec 07 13:51:05.226661 2025] [:error] [pid 25694:tid 25713] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:05.344456 2025] [:error] [pid 25694:tid 25700] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php, referer: https://www.bing.com/
[Sun Dec 07 13:51:05.580698 2025] [:error] [pid 25694:tid 25703] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php, referer: https://www.google.de/
[Sun Dec 07 13:51:05.821218 2025] [:error] [pid 25694:tid 25710] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.fr/
[Sun Dec 07 13:51:05.938798 2025] [:error] [pid 25694:tid 25702] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:06.058618 2025] [:error] [pid 25694:tid 25720] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.google.fr/
[Sun Dec 07 13:51:06.449435 2025] [:error] [pid 25694:tid 25716] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:06.818829 2025] [:error] [pid 25694:tid 25707] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:07.679141 2025] [:error] [pid 25694:tid 25705] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php, referer: https://www.bing.com/
[Sun Dec 07 13:51:08.630412 2025] [:error] [pid 25694:tid 25720] [client 4.189.120.86:38661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.bing.com/
[Sun Dec 07 13:51:08.743869 2025] [:error] [pid 25694:tid 25719] [client 4.189.120.86:38661] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aTUVzEf7996cewJ5N28CpQAAARc"], referer: https://www.bing.com/
[Sun Dec 07 13:51:08.979492 2025] [:error] [pid 25601:tid 25651] [client 4.189.120.86:40216] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aTUVzKtsSIqGPs4YVxEongAAAJA"], referer: https://www.yahoo.com/
[Sun Dec 07 13:51:09.266251 2025] [:error] [pid 25602:tid 25676] [client 4.189.120.86:10641] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aTUVzRMayYLriq9gRdfG3gAAAM4"], referer: https://www.google.com/
[Sun Dec 07 13:51:09.526091 2025] [:error] [pid 36068:tid 36070] [client 4.189.120.86:40250] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aTUVzVGuxqM4ZYob8lPInwAAAAA"], referer: https://www.google.com/
[Sun Dec 07 13:51:09.758104 2025] [:error] [pid 25601:tid 25653] [client 4.189.120.86:10684] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aTUVzatsSIqGPs4YVxEonwAAAJI"], referer: https://duckduckgo.com/
[Sun Dec 07 13:51:10.001480 2025] [:error] [pid 25602:tid 25667] [client 4.189.120.86:49756] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aTUVzhMayYLriq9gRdfG3wAAAMU"], referer: https://www.yahoo.com/
[Sun Dec 07 13:51:10.240116 2025] [:error] [pid 36068:tid 36077] [client 4.189.120.86:49336] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aTUVzlGuxqM4ZYob8lPIoAAAAAc"], referer: https://www.google.com/
[Sun Dec 07 13:51:10.467887 2025] [:error] [pid 36068:tid 36074] [client 4.189.120.86:44940] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aTUVzlGuxqM4ZYob8lPIoQAAAAQ"], referer: https://www.google.de/
[Sun Dec 07 13:51:10.724770 2025] [:error] [pid 25601:tid 25635] [client 4.189.120.86:49306] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aTUVzqtsSIqGPs4YVxEooAAAAIA"], referer: https://www.google.fr/
[Sun Dec 07 13:51:10.953322 2025] [:error] [pid 36068:tid 36071] [client 4.189.120.86:40229] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/index.php"] [unique_id "aTUVzlGuxqM4ZYob8lPIowAAAAE"], referer: https://www.google.fr/
[Sun Dec 07 13:51:11.182377 2025] [:error] [pid 36068:tid 36089] [client 4.189.120.86:34157] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aTUVz1GuxqM4ZYob8lPIpQAAABM"], referer: https://www.yahoo.com/
[Sun Dec 07 13:51:11.416225 2025] [:error] [pid 25600:tid 25608] [client 4.189.120.86:48216] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aTUVz4X3SVrXRURpt5IwWAAAAEE"], referer: https://www.google.de/
[Sun Dec 07 13:51:11.659168 2025] [:error] [pid 36068:tid 36073] [client 4.189.120.86:54517] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aTUVz1GuxqM4ZYob8lPIqAAAAAM"], referer: https://www.bing.com/
[Sun Dec 07 13:51:14.428715 2025] [:error] [pid 25600:tid 25608] [client 4.189.120.86:39483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php, referer: https://duckduckgo.com/
[Sun Dec 07 13:51:15.938436 2025] [:error] [pid 25600:tid 25620] [client 4.189.120.86:39483] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aTUV04X3SVrXRURpt5IwcAAAAE0"], referer: https://www.google.de/
[Sun Dec 07 13:51:16.287173 2025] [:error] [pid 25601:tid 25636] [client 4.189.120.86:39461] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aTUV1KtsSIqGPs4YVxEoowAAAIE"], referer: https://www.google.co.uk/
[Sun Dec 07 13:51:16.514498 2025] [:error] [pid 36068:tid 36087] [client 4.189.120.86:49768] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aTUV1FGuxqM4ZYob8lPIrgAAABE"], referer: https://www.bing.com/
[Sun Dec 07 13:51:16.750195 2025] [:error] [pid 36068:tid 36091] [client 4.189.120.86:44935] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aTUV1FGuxqM4ZYob8lPIrwAAABU"], referer: https://www.google.com/
[Sun Dec 07 13:51:16.982168 2025] [:error] [pid 25601:tid 25655] [client 4.189.120.86:42866] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aTUV1KtsSIqGPs4YVxEopAAAAJQ"], referer: https://www.google.fr/
[Sun Dec 07 13:51:17.457545 2025] [:error] [pid 36068:tid 36092] [client 4.189.120.86:54502] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aTUV1VGuxqM4ZYob8lPIsgAAABY"], referer: https://www.google.fr/
[Sun Dec 07 13:51:17.802242 2025] [:error] [pid 25602:tid 25675] [client 4.189.120.86:55122] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aTUV1RMayYLriq9gRdfG4QAAAM0"], referer: https://www.google.fr/
[Sun Dec 07 13:51:18.046606 2025] [:error] [pid 25602:tid 25684] [client 4.189.120.86:33076] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aTUV1hMayYLriq9gRdfG4gAAANY"], referer: https://www.google.fr/
[Sun Dec 07 13:51:18.275368 2025] [:error] [pid 25602:tid 25685] [client 4.189.120.86:40233] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aTUV1hMayYLriq9gRdfG5AAAANc"], referer: https://www.google.de/
[Sun Dec 07 13:51:18.504420 2025] [:error] [pid 25601:tid 25637] [client 4.189.120.86:49297] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aTUV1qtsSIqGPs4YVxEopgAAAII"], referer: https://www.bing.com/
[Sun Dec 07 13:51:18.854834 2025] [:error] [pid 36068:tid 36081] [client 4.189.120.86:40212] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aTUV1lGuxqM4ZYob8lPItAAAAAs"], referer: https://www.google.fr/
[Sun Dec 07 13:51:19.082484 2025] [:error] [pid 36068:tid 36088] [client 4.189.120.86:48220] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aTUV11GuxqM4ZYob8lPItQAAABI"], referer: https://duckduckgo.com/
[Sun Dec 07 13:51:19.543947 2025] [:error] [pid 25602:tid 25673] [client 4.189.120.86:40234] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/search/index.php"] [unique_id "aTUV1xMayYLriq9gRdfG5wAAAMs"], referer: https://www.bing.com/
[Sun Dec 07 13:51:19.893765 2025] [:error] [pid 25601:tid 25646] [client 4.189.120.86:34127] [client 4.189.120.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aTUV16tsSIqGPs4YVxEoqgAAAIs"], referer: https://duckduckgo.com/
[Sun Dec 07 13:51:20.136307 2025] [:error] [pid 36068:tid 36076] [client 4.189.120.86:49760] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php, referer: https://www.google.de/
[Sun Dec 07 13:51:20.255040 2025] [:error] [pid 36068:tid 36074] [client 4.189.120.86:49760] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php, referer: https://www.bing.com/
[Sun Dec 07 13:51:20.372169 2025] [:error] [pid 36068:tid 36087] [client 4.189.120.86:49760] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php, referer: https://www.yahoo.com/
[Sun Dec 07 14:59:56.473376 2025] [:error] [pid 25601:tid 25636] [client 122.167.116.62:32589] [client 122.167.116.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.167.116.62, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aTUl7KtsSIqGPs4YVxEzlAAAAIE"]
[Sun Dec 07 14:59:56.478768 2025] [:error] [pid 25601:tid 25636] [client 122.167.116.62:32589] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Dec 07 20:39:07.318530 2025] [:error] [pid 5224:tid 5298] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sun Dec 07 20:39:07.652362 2025] [:error] [pid 5224:tid 5289] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sun Dec 07 20:39:08.322399 2025] [:error] [pid 5224:tid 5304] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Dec 07 20:39:08.662916 2025] [:error] [pid 5224:tid 5288] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Sun Dec 07 20:39:08.995860 2025] [:error] [pid 5224:tid 5297] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/php_info.php
[Sun Dec 07 20:39:09.332455 2025] [:error] [pid 5224:tid 5281] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sun Dec 07 20:39:09.667961 2025] [:error] [pid 5224:tid 5300] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Sun Dec 07 20:39:10.676779 2025] [:error] [pid 5224:tid 5305] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Sun Dec 07 20:39:11.013614 2025] [:error] [pid 5224:tid 5296] [client 136.144.35.218:61097] File does not exist: /usr/local/apache/htdocs/suspended-page/php_version.php
[Sun Dec 07 20:39:11.680995 2025] [:error] [pid 5224:tid 5299] [client 136.144.35.218:61097] [client 136.144.35.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aTV1b_AAkbWt7RJBoF_jTQAAANI"]
[Sun Dec 07 20:39:22.343220 2025] [:error] [pid 5222:tid 5230] [client 136.144.35.236:54645] [client 136.144.35.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aTV1et8FU0HgkYWmt7s5XQAAAEQ"]
[Sun Dec 07 20:39:23.010871 2025] [:error] [pid 9961:tid 9979] [client 136.144.35.237:55515] [client 136.144.35.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aTV1e2Qdnfbgcnzr89JRkQAAAVA"]
[Sun Dec 07 20:39:23.684043 2025] [:error] [pid 9610:tid 9616] [client 136.144.35.230:23217] [client 136.144.35.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aTV1e8Z4Zl9G0UhQ7w0vOwAAAQQ"]
[Mon Dec 08 02:53:46.572547 2025] [:error] [pid 55699:tid 55746] [client 191.13.175.167:57018] [client 191.13.175.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.13.175.167, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aTXNOnp2c7AdOPMmDEOBsQAAAJA"]
[Mon Dec 08 02:53:46.577469 2025] [:error] [pid 55699:tid 55746] [client 191.13.175.167:57018] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Dec 08 06:16:18.193648 2025] [:error] [pid 54704:tid 54707] [client 178.218.144.101:14480] [client 178.218.144.101] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 0, BQ 1, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTX8snL1WYsMMmlqjh4ZygAAAUA"]
[Mon Dec 08 11:46:39.838688 2025] [:error] [pid 39160:tid 39216] [client 45.88.186.148:52739] [client 45.88.186.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTZKHym5Ndns0p3OT9CKYQAAAFc"]
[Mon Dec 08 11:46:40.255731 2025] [:error] [pid 39159:tid 39172] [client 45.88.186.148:52900] [client 45.88.186.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTZKIE48HaQt8jqjSbqC1wAAAAc"]
[Mon Dec 08 11:46:40.661058 2025] [:error] [pid 43361:tid 43370] [client 45.88.186.148:53061] [client 45.88.186.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTZKIMrZJ_dsPpuIXPnQdQAAAYY"]
[Mon Dec 08 11:46:41.063435 2025] [:error] [pid 53927:tid 53929] [client 45.88.186.148:53229] [client 45.88.186.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTZKIbTtIvPZ1Cm2r06boQAAAQA"]
[Mon Dec 08 11:46:41.467880 2025] [:error] [pid 53927:tid 53936] [client 45.88.186.148:53361] [client 45.88.186.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTZKIbTtIvPZ1Cm2r06btAAAAQc"]
[Mon Dec 08 13:29:48.222314 2025] [:error] [pid 13446:tid 13503] [client 45.132.224.35:60275] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "aTZiTFPLjuV-KbK89q34dQAAAJg"]
[Mon Dec 08 13:29:48.929171 2025] [:error] [pid 13445:tid 13466] [client 45.132.224.21:50275] [client 45.132.224.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "aTZiTMek7sIjbF2WoVbYfQAAAFA"]
[Mon Dec 08 13:29:50.073838 2025] [:error] [pid 16888:tid 16912] [client 45.132.224.35:23031] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/schema/yanz.php"] [unique_id "aTZiThSZHPLCPHyOpBVReAAAABU"]
[Mon Dec 08 13:29:50.903269 2025] [:error] [pid 16888:tid 16895] [client 45.132.224.7:56993] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/js-inc.php"] [unique_id "aTZiThSZHPLCPHyOpBVRewAAAAQ"]
[Mon Dec 08 13:29:51.362908 2025] [:error] [pid 13446:tid 13480] [client 45.132.224.23:62479] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/init-help/init.php"] [unique_id "aTZiT1PLjuV-KbK89q34eQAAAIE"]
[Mon Dec 08 13:29:51.979907 2025] [:error] [pid 13445:tid 13454] [client 45.132.224.50:21185] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wpcall-button/button-image.php"] [unique_id "aTZiT8ek7sIjbF2WoVbYggAAAEQ"]
[Mon Dec 08 13:29:52.479815 2025] [:error] [pid 13533:tid 13543] [client 45.132.224.16:62825] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/schema/geckos.php"] [unique_id "aTZiUEwxYk7zHgjCNdZkuQAAAUg"]
[Mon Dec 08 13:29:52.933101 2025] [:error] [pid 13447:tid 13521] [client 45.132.224.46:41575] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/SecurityFin/SecurityFin.php"] [unique_id "aTZiUHsXz7UXj3rHK1uo2QAAAM8"]
[Mon Dec 08 13:29:53.345740 2025] [:error] [pid 13533:tid 13551] [client 45.132.224.3:33547] [client 45.132.224.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wpr-addons/forms/b1ack.php"] [unique_id "aTZiUUwxYk7zHgjCNdZkugAAAVA"]
[Mon Dec 08 13:29:53.821643 2025] [:error] [pid 16888:tid 16894] [client 45.132.224.24:38147] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "aTZiURSZHPLCPHyOpBVRkwAAAAM"]
[Mon Dec 08 13:29:54.383863 2025] [:error] [pid 13446:tid 13487] [client 45.132.224.49:23345] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aTZiUlPLjuV-KbK89q34fQAAAIg"]
[Mon Dec 08 13:29:55.610545 2025] [:error] [pid 13447:tid 13509] [client 45.132.224.41:32681] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dzs-zoomsounds/1877.php"] [unique_id "aTZiU3sXz7UXj3rHK1uo3AAAAMM"]
[Mon Dec 08 13:29:56.042526 2025] [:error] [pid 13446:tid 13490] [client 45.132.224.19:36099] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "aTZiVFPLjuV-KbK89q34fwAAAIs"]
[Mon Dec 08 13:29:56.499999 2025] [:error] [pid 13447:tid 13512] [client 45.132.224.25:53723] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/linkpreview/index.php"] [unique_id "aTZiVHsXz7UXj3rHK1uo3QAAAMY"]
[Mon Dec 08 13:29:57.026296 2025] [:error] [pid 13533:tid 13548] [client 45.132.224.23:36961] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/linkpreview/db.php"] [unique_id "aTZiVUwxYk7zHgjCNdZkvwAAAU0"]
[Mon Dec 08 13:29:57.570626 2025] [:error] [pid 13533:tid 13541] [client 45.132.224.16:47581] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/db.php"] [unique_id "aTZiVUwxYk7zHgjCNdZkwAAAAUY"]
[Mon Dec 08 13:29:58.125255 2025] [:error] [pid 13533:tid 13544] [client 45.132.224.34:39325] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/press/wp-class.php"] [unique_id "aTZiVkwxYk7zHgjCNdZkwgAAAUk"]
[Mon Dec 08 13:29:59.098223 2025] [:error] [pid 16888:tid 16915] [client 45.132.224.2:43587] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aTZiVxSZHPLCPHyOpBVRmQAAABg"]
[Mon Dec 08 13:29:59.929451 2025] [:error] [pid 13447:tid 13515] [client 45.132.224.51:63429] [client 45.132.224.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/yanierin/akcc.php"] [unique_id "aTZiV3sXz7UXj3rHK1uo4QAAAMk"]
[Mon Dec 08 13:30:00.442310 2025] [:error] [pid 13533:tid 13549] [client 45.132.224.37:61541] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "aTZiWEwxYk7zHgjCNdZkxAAAAU4"]
[Mon Dec 08 13:30:01.209161 2025] [:error] [pid 13446:tid 13482] [client 45.132.224.32:41049] [client 45.132.224.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-mobile-detector/cache/settings_auto.php"] [unique_id "aTZiWVPLjuV-KbK89q34gwAAAIM"]
[Mon Dec 08 13:30:01.848045 2025] [:error] [pid 13445:tid 13470] [client 45.132.224.5:62571] [client 45.132.224.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentythree/patterns/index.php"] [unique_id "aTZiWcek7sIjbF2WoVbYjAAAAFQ"]
[Mon Dec 08 13:30:02.311420 2025] [:error] [pid 13533:tid 13554] [client 45.132.224.36:26321] [client 45.132.224.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aTZiWkwxYk7zHgjCNdZkyAAAAVM"]
[Mon Dec 08 13:30:03.288319 2025] [:error] [pid 16888:tid 16903] [client 45.132.224.39:29411] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aTZiWxSZHPLCPHyOpBVRnwAAAAw"]
[Mon Dec 08 13:30:04.043359 2025] [:error] [pid 13445:tid 13455] [client 45.132.224.16:46555] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aTZiXMek7sIjbF2WoVbYjgAAAEU"]
[Mon Dec 08 13:30:05.026667 2025] [:error] [pid 13445:tid 13450] [client 45.132.224.44:61085] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTZiXcek7sIjbF2WoVbYkQAAAEA"]
[Mon Dec 08 13:30:05.920844 2025] [:error] [pid 13533:tid 13557] [client 45.132.224.20:54263] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aTZiXUwxYk7zHgjCNdZkzwAAAVY"]
[Mon Dec 08 13:30:06.729691 2025] [:error] [pid 13446:tid 13499] [client 45.132.224.12:20473] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/about.php"] [unique_id "aTZiXlPLjuV-KbK89q34hgAAAJQ"]
[Mon Dec 08 13:30:07.326186 2025] [:error] [pid 16888:tid 16896] [client 45.132.224.18:36181] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTZiXxSZHPLCPHyOpBVRowAAAAU"]
[Mon Dec 08 13:30:08.850514 2025] [:error] [pid 13447:tid 13515] [client 45.132.224.10:26947] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twenty/twenty.php"] [unique_id "aTZiYHsXz7UXj3rHK1uo6gAAAMk"]
[Mon Dec 08 13:30:11.017334 2025] [:error] [pid 13533:tid 13538] [client 45.132.224.2:31999] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/moon.php"] [unique_id "aTZiY0wxYk7zHgjCNdZk2gAAAUM"]
[Mon Dec 08 13:30:11.794389 2025] [:error] [pid 16888:tid 16911] [client 45.132.224.40:52691] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/calmly/issue.php"] [unique_id "aTZiYxSZHPLCPHyOpBVRrAAAABQ"]
[Mon Dec 08 13:30:12.694676 2025] [:error] [pid 16888:tid 16902] [client 45.132.224.29:41765] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/shell/noimg.php"] [unique_id "aTZiZBSZHPLCPHyOpBVRrwAAAAs"]
[Mon Dec 08 13:30:14.103021 2025] [:error] [pid 16888:tid 16898] [client 45.132.224.23:65361] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/Cache/Cache.php"] [unique_id "aTZiZhSZHPLCPHyOpBVRswAAAAc"]
[Mon Dec 08 13:30:14.572057 2025] [:error] [pid 13446:tid 13487] [client 45.132.224.7:34641] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fonts/fonts.php"] [unique_id "aTZiZlPLjuV-KbK89q34jwAAAIg"]
[Mon Dec 08 13:30:15.561069 2025] [:error] [pid 13447:tid 13524] [client 45.132.224.23:65371] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "aTZiZ3sXz7UXj3rHK1upHwAAANI"]
[Mon Dec 08 13:30:16.354422 2025] [:error] [pid 16888:tid 16915] [client 45.132.224.16:33895] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "aTZiaBSZHPLCPHyOpBVRvAAAABg"]
[Mon Dec 08 13:30:17.156322 2025] [:error] [pid 13447:tid 13510] [client 45.132.224.47:37055] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aTZiaXsXz7UXj3rHK1upJwAAAMQ"]
[Mon Dec 08 13:30:17.917119 2025] [:error] [pid 13446:tid 13486] [client 45.132.224.29:42509] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aTZiaVPLjuV-KbK89q34mgAAAIc"]
[Mon Dec 08 13:30:18.442973 2025] [:error] [pid 13446:tid 13498] [client 45.132.224.49:31121] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/TOPXOH/wDR.php"] [unique_id "aTZialPLjuV-KbK89q34nAAAAJM"]
[Mon Dec 08 13:30:19.334332 2025] [:error] [pid 13445:tid 13471] [client 45.132.224.48:58655] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aTZia8ek7sIjbF2WoVbYpQAAAFU"]
[Mon Dec 08 13:30:19.929992 2025] [:error] [pid 13445:tid 13466] [client 45.132.224.51:35033] [client 45.132.224.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/Divi/404.php"] [unique_id "aTZia8ek7sIjbF2WoVbYpwAAAFA"]
[Mon Dec 08 13:30:20.435272 2025] [:error] [pid 13445:tid 13453] [client 45.132.224.19:29783] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aTZibMek7sIjbF2WoVbYqAAAAEM"]
[Mon Dec 08 13:30:21.200998 2025] [:error] [pid 16888:tid 16895] [client 45.132.224.3:63925] [client 45.132.224.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aTZibRSZHPLCPHyOpBVRwgAAAAQ"]
[Mon Dec 08 13:30:22.038330 2025] [:error] [pid 13445:tid 13450] [client 45.132.224.53:63551] [client 45.132.224.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTZibsek7sIjbF2WoVbYrwAAAEA"]
[Mon Dec 08 13:30:22.708475 2025] [:error] [pid 16888:tid 16896] [client 45.132.224.12:54555] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/about.php"] [unique_id "aTZibhSZHPLCPHyOpBVRzgAAAAU"]
[Mon Dec 08 13:30:23.462803 2025] [:error] [pid 13447:tid 13514] [client 45.132.224.30:52871] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hello.php"] [unique_id "aTZib3sXz7UXj3rHK1upMQAAAMg"]
[Mon Dec 08 13:30:24.302214 2025] [:error] [pid 16888:tid 16904] [client 45.132.224.14:29819] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aTZicBSZHPLCPHyOpBVR0wAAAA0"]
[Mon Dec 08 13:30:24.762958 2025] [:error] [pid 16888:tid 16894] [client 45.132.224.18:51977] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aTZicBSZHPLCPHyOpBVR1gAAAAM"]
[Mon Dec 08 13:30:26.140516 2025] [:error] [pid 13445:tid 13466] [client 45.132.224.39:24373] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aTZicsek7sIjbF2WoVbYsQAAAFA"]
[Mon Dec 08 13:30:26.931426 2025] [:error] [pid 16888:tid 16897] [client 45.132.224.44:24951] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aTZichSZHPLCPHyOpBVR3gAAAAY"]
[Mon Dec 08 13:30:27.544626 2025] [:error] [pid 16888:tid 16913] [client 45.132.224.31:34905] [client 45.132.224.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aTZicxSZHPLCPHyOpBVR4QAAABY"]
[Mon Dec 08 13:30:28.069493 2025] [:error] [pid 16888:tid 16899] [client 45.132.224.40:61103] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aTZidBSZHPLCPHyOpBVR5AAAAAg"]
[Mon Dec 08 13:30:28.787751 2025] [:error] [pid 16888:tid 16905] [client 45.132.224.3:53673] [client 45.132.224.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aTZidBSZHPLCPHyOpBVR6AAAAA4"]
[Mon Dec 08 13:30:29.210067 2025] [:error] [pid 13445:tid 13468] [client 45.132.224.15:61715] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/dropdown.php"] [unique_id "aTZidcek7sIjbF2WoVbYtAAAAFI"]
[Mon Dec 08 13:30:29.798395 2025] [:error] [pid 16888:tid 16892] [client 45.132.224.26:60791] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTZidRSZHPLCPHyOpBVR6gAAAAE"]
[Mon Dec 08 13:30:30.628243 2025] [:error] [pid 13445:tid 13455] [client 45.132.224.33:65303] [client 45.132.224.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTZidsek7sIjbF2WoVbYtQAAAEU"]
[Mon Dec 08 13:30:31.146088 2025] [:error] [pid 16888:tid 16908] [client 45.132.224.53:42873] [client 45.132.224.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aTZidxSZHPLCPHyOpBVR7QAAABE"]
[Mon Dec 08 13:30:31.691831 2025] [:error] [pid 16888:tid 16897] [client 45.132.224.46:64129] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/plugins.php"] [unique_id "aTZidxSZHPLCPHyOpBVR7wAAAAY"]
[Mon Dec 08 13:30:32.307115 2025] [:error] [pid 16888:tid 16910] [client 45.132.224.15:24081] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aTZieBSZHPLCPHyOpBVR8AAAABM"]
[Mon Dec 08 13:30:32.970244 2025] [:error] [pid 13445:tid 13472] [client 45.132.224.37:21925] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTZieMek7sIjbF2WoVbYtgAAAFY"]
[Mon Dec 08 13:30:33.519034 2025] [:error] [pid 13533:tid 13536] [client 45.132.224.49:43521] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/about.php"] [unique_id "aTZieUwxYk7zHgjCNdZk_QAAAUE"]
[Mon Dec 08 13:30:33.963282 2025] [:error] [pid 13445:tid 13465] [client 45.132.224.7:44097] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/dropdown.php"] [unique_id "aTZiecek7sIjbF2WoVbYtwAAAE8"]
[Mon Dec 08 13:30:34.669630 2025] [:error] [pid 13533:tid 13558] [client 45.132.224.23:27075] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aTZiekwxYk7zHgjCNdZlAAAAAVc"]
[Mon Dec 08 13:30:35.219898 2025] [:error] [pid 13533:tid 13557] [client 45.132.224.31:28309] [client 45.132.224.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aTZie0wxYk7zHgjCNdZlBQAAAVY"]
[Mon Dec 08 13:30:35.714269 2025] [:error] [pid 16888:tid 16891] [client 45.132.224.10:37835] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aTZiexSZHPLCPHyOpBVR9QAAAAA"]
[Mon Dec 08 13:30:36.232206 2025] [:error] [pid 13447:tid 13527] [client 45.132.224.28:24041] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/fmadmin.php"] [unique_id "aTZifHsXz7UXj3rHK1upNwAAANU"]
[Mon Dec 08 13:30:37.196361 2025] [:error] [pid 16888:tid 16914] [client 45.132.224.43:20831] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/options.php"] [unique_id "aTZifRSZHPLCPHyOpBVR-gAAABc"]
[Mon Dec 08 13:30:37.611464 2025] [:error] [pid 13447:tid 13528] [client 45.132.224.40:23023] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/about.php"] [unique_id "aTZifXsXz7UXj3rHK1upPQAAANY"]
[Mon Dec 08 13:30:38.487130 2025] [:error] [pid 13447:tid 13511] [client 45.132.224.26:43739] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aTZifnsXz7UXj3rHK1upPwAAAMU"]
[Mon Dec 08 13:30:39.444171 2025] [:error] [pid 13447:tid 13525] [client 45.132.224.22:64829] [client 45.132.224.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aTZif3sXz7UXj3rHK1upQQAAANM"]
[Mon Dec 08 13:30:40.193386 2025] [:error] [pid 13445:tid 13459] [client 45.132.224.5:41397] [client 45.132.224.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aTZigMek7sIjbF2WoVbYvAAAAEk"]
[Mon Dec 08 13:30:41.356206 2025] [:error] [pid 13446:tid 13486] [client 45.132.224.18:49075] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aTZigVPLjuV-KbK89q34wAAAAIc"]
[Mon Dec 08 13:30:41.775610 2025] [:error] [pid 16888:tid 16904] [client 45.132.224.52:39607] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wordfence-waf.php"] [unique_id "aTZigRSZHPLCPHyOpBVSCQAAAA0"]
[Mon Dec 08 13:30:42.750691 2025] [:error] [pid 16888:tid 16907] [client 45.132.224.47:37587] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/mah/function.php"] [unique_id "aTZighSZHPLCPHyOpBVSDwAAABA"]
[Mon Dec 08 13:30:43.977241 2025] [:error] [pid 13533:tid 13553] [client 45.132.224.52:61809] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/function.php"] [unique_id "aTZig0wxYk7zHgjCNdZlBwAAAVI"]
[Mon Dec 08 13:30:46.019194 2025] [:error] [pid 13446:tid 13489] [client 45.132.224.28:23705] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "aTZihlPLjuV-KbK89q34xAAAAIo"]
[Mon Dec 08 13:30:46.808411 2025] [:error] [pid 13445:tid 13471] [client 45.132.224.9:48731] [client 45.132.224.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aTZihsek7sIjbF2WoVbYwwAAAFU"]
[Mon Dec 08 13:30:47.487675 2025] [:error] [pid 13447:tid 13521] [client 45.132.224.31:59677] [client 45.132.224.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTZih3sXz7UXj3rHK1upRgAAAM8"]
[Mon Dec 08 13:30:47.970358 2025] [:error] [pid 13533:tid 13537] [client 45.132.224.53:42405] [client 45.132.224.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTZih0wxYk7zHgjCNdZlDgAAAUI"]
[Mon Dec 08 13:30:49.081251 2025] [:error] [pid 13533:tid 13556] [client 45.132.224.9:21109] [client 45.132.224.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aTZiiUwxYk7zHgjCNdZlEQAAAVU"]
[Mon Dec 08 13:30:51.167478 2025] [:error] [pid 13445:tid 13460] [client 45.132.224.30:48347] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aTZii8ek7sIjbF2WoVbYxgAAAEo"]
[Mon Dec 08 13:30:51.616515 2025] [:error] [pid 13533:tid 13541] [client 45.132.224.4:42487] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aTZii0wxYk7zHgjCNdZlFQAAAUY"]
[Mon Dec 08 13:30:53.001334 2025] [:error] [pid 13445:tid 13474] [client 45.132.224.37:23113] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aTZijcek7sIjbF2WoVbYyQAAAFg"]
[Mon Dec 08 13:30:53.546030 2025] [:error] [pid 13533:tid 13537] [client 45.132.224.35:57109] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTZijUwxYk7zHgjCNdZlGQAAAUI"]
[Mon Dec 08 13:30:54.371572 2025] [:error] [pid 16888:tid 16900] [client 45.132.224.46:65215] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTZijhSZHPLCPHyOpBVSGAAAAAk"]
[Mon Dec 08 13:30:54.818083 2025] [:error] [pid 13533:tid 13554] [client 45.132.224.41:50781] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xl2023.php"] [unique_id "aTZijkwxYk7zHgjCNdZlHgAAAVM"]
[Mon Dec 08 13:30:55.787451 2025] [:error] [pid 13445:tid 13473] [client 45.132.224.52:48849] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTZij8ek7sIjbF2WoVbYzwAAAFc"]
[Mon Dec 08 13:30:56.326433 2025] [:error] [pid 13445:tid 13466] [client 45.132.224.43:28695] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/login.php"] [unique_id "aTZikMek7sIjbF2WoVbY0gAAAFA"]
[Mon Dec 08 13:30:56.846723 2025] [:error] [pid 13533:tid 13539] [client 45.132.224.12:30293] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aTZikEwxYk7zHgjCNdZlIwAAAUQ"]
[Mon Dec 08 13:30:58.713521 2025] [:error] [pid 13447:tid 13512] [client 45.132.224.41:54949] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTZiknsXz7UXj3rHK1upTAAAAMY"]
[Mon Dec 08 13:30:59.251228 2025] [:error] [pid 16888:tid 16905] [client 45.132.224.24:60979] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aTZikxSZHPLCPHyOpBVSHwAAAA4"]
[Mon Dec 08 13:30:59.723049 2025] [:error] [pid 13533:tid 13547] [client 45.132.224.19:53231] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/gel4y.php"] [unique_id "aTZik0wxYk7zHgjCNdZlJQAAAUw"]
[Mon Dec 08 13:31:00.217705 2025] [:error] [pid 16888:tid 16913] [client 45.132.224.50:45951] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aTZilBSZHPLCPHyOpBVSIwAAABY"]
[Mon Dec 08 13:31:01.790602 2025] [:error] [pid 13533:tid 13535] [client 45.132.224.15:23047] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xleet.php"] [unique_id "aTZilUwxYk7zHgjCNdZlKQAAAUA"]
[Mon Dec 08 13:31:02.314700 2025] [:error] [pid 13533:tid 13554] [client 45.132.224.25:45671] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/pachr.php"] [unique_id "aTZilkwxYk7zHgjCNdZlKgAAAVM"]
[Mon Dec 08 13:31:03.084093 2025] [:error] [pid 13446:tid 13484] [client 45.132.224.11:37337] [client 45.132.224.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTZil1PLjuV-KbK89q342AAAAIU"]
[Mon Dec 08 13:31:03.529509 2025] [:error] [pid 13445:tid 13456] [client 45.132.224.24:40909] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aTZil8ek7sIjbF2WoVbY1QAAAEY"]
[Mon Dec 08 13:31:04.560642 2025] [:error] [pid 13446:tid 13493] [client 45.132.224.21:57243] [client 45.132.224.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aTZimFPLjuV-KbK89q342QAAAI4"]
[Mon Dec 08 13:31:05.208007 2025] [:error] [pid 16888:tid 16913] [client 45.132.224.48:35211] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aTZimRSZHPLCPHyOpBVSLAAAABY"]
[Mon Dec 08 13:31:05.766331 2025] [:error] [pid 16888:tid 16908] [client 45.132.224.17:23417] [client 45.132.224.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aTZimRSZHPLCPHyOpBVSMgAAABE"]
[Mon Dec 08 13:31:06.909065 2025] [:error] [pid 13533:tid 13558] [client 45.132.224.20:48849] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aTZimkwxYk7zHgjCNdZlMQAAAVc"]
[Mon Dec 08 13:31:07.773121 2025] [:error] [pid 16888:tid 16905] [client 45.132.224.17:51215] [client 45.132.224.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTZimxSZHPLCPHyOpBVSSgAAAA4"]
[Mon Dec 08 13:31:08.770190 2025] [:error] [pid 16888:tid 16896] [client 45.132.224.24:50687] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/text.php"] [unique_id "aTZinBSZHPLCPHyOpBVSTQAAAAU"]
[Mon Dec 08 13:31:09.614295 2025] [:error] [pid 13533:tid 13548] [client 45.132.224.8:38867] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aTZinUwxYk7zHgjCNdZlNQAAAU0"]
[Mon Dec 08 13:31:10.400002 2025] [:error] [pid 16888:tid 16897] [client 45.132.224.41:53149] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTZinhSZHPLCPHyOpBVSUQAAAAY"]
[Mon Dec 08 13:31:11.645778 2025] [:error] [pid 13447:tid 13522] [client 45.132.224.52:31429] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/demo.php"] [unique_id "aTZin3sXz7UXj3rHK1upVgAAANA"]
[Mon Dec 08 13:31:12.440698 2025] [:error] [pid 13446:tid 13496] [client 45.132.224.37:51517] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aTZioFPLjuV-KbK89q347gAAAJE"]
[Mon Dec 08 13:31:13.403737 2025] [:error] [pid 13445:tid 13474] [client 45.132.224.14:36911] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aTZiocek7sIjbF2WoVbY6QAAAFg"]
[Mon Dec 08 13:31:13.991060 2025] [:error] [pid 13533:tid 13552] [client 45.132.224.37:55503] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aTZioUwxYk7zHgjCNdZlOgAAAVE"]
[Mon Dec 08 13:31:14.831312 2025] [:error] [pid 16888:tid 16891] [client 45.132.224.24:34305] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xml.php"] [unique_id "aTZiohSZHPLCPHyOpBVSVAAAAAA"]
[Mon Dec 08 13:31:15.476421 2025] [:error] [pid 13446:tid 13485] [client 45.132.224.3:33309] [client 45.132.224.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTZio1PLjuV-KbK89q348wAAAIY"]
[Mon Dec 08 13:31:16.271252 2025] [:error] [pid 13533:tid 13536] [client 45.132.224.18:42575] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTZipEwxYk7zHgjCNdZlPQAAAUE"]
[Mon Dec 08 13:31:17.422764 2025] [:error] [pid 13446:tid 13497] [client 45.132.224.34:55329] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "aTZipVPLjuV-KbK89q34-AAAAJI"]
[Mon Dec 08 13:31:18.050722 2025] [:error] [pid 13446:tid 13503] [client 45.132.224.35:57855] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aTZiplPLjuV-KbK89q34-QAAAJg"]
[Mon Dec 08 13:31:18.655259 2025] [:error] [pid 13446:tid 13495] [client 45.132.224.15:28317] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTZiplPLjuV-KbK89q34-wAAAJA"]
[Mon Dec 08 13:31:19.071380 2025] [:error] [pid 16888:tid 16899] [client 45.132.224.49:21329] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aTZipxSZHPLCPHyOpBVSWwAAAAg"]
[Mon Dec 08 13:31:19.563913 2025] [:error] [pid 13533:tid 13541] [client 45.132.224.26:21963] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aTZip0wxYk7zHgjCNdZlPgAAAUY"]
[Mon Dec 08 13:31:20.252626 2025] [:error] [pid 13447:tid 13520] [client 45.132.224.16:39025] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTZiqHsXz7UXj3rHK1upYQAAAM4"]
[Mon Dec 08 13:31:20.895454 2025] [:error] [pid 16888:tid 16891] [client 45.132.224.11:30179] [client 45.132.224.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aTZiqBSZHPLCPHyOpBVSXgAAAAA"]
[Mon Dec 08 13:31:21.604301 2025] [:error] [pid 13445:tid 13474] [client 45.132.224.30:50305] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aTZiqcek7sIjbF2WoVbY7wAAAFg"]
[Mon Dec 08 13:31:22.384431 2025] [:error] [pid 13533:tid 13550] [client 45.132.224.7:39901] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTZiqkwxYk7zHgjCNdZlQQAAAU8"]
[Mon Dec 08 13:31:23.756931 2025] [:error] [pid 13446:tid 13494] [client 45.132.224.21:57251] [client 45.132.224.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aTZiq1PLjuV-KbK89q35AgAAAI8"]
[Mon Dec 08 13:31:24.265188 2025] [:error] [pid 13446:tid 13496] [client 45.132.224.30:27527] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aTZirFPLjuV-KbK89q35BAAAAJE"]
[Mon Dec 08 13:31:24.905618 2025] [:error] [pid 16888:tid 16903] [client 45.132.224.26:57359] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez/admin.php"] [unique_id "aTZirBSZHPLCPHyOpBVSZgAAAAw"]
[Mon Dec 08 13:31:25.446610 2025] [:error] [pid 13446:tid 13479] [client 45.132.224.45:49739] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/templates/bluestork/error.php"] [unique_id "aTZirVPLjuV-KbK89q35BQAAAIA"]
[Mon Dec 08 13:31:26.178751 2025] [:error] [pid 16888:tid 16895] [client 45.132.224.47:42725] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Yamato/index.php"] [unique_id "aTZirhSZHPLCPHyOpBVSaAAAAAQ"]
[Mon Dec 08 13:31:26.766383 2025] [:error] [pid 16888:tid 16896] [client 45.132.224.13:50775] [client 45.132.224.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/templates/isis/index.php"] [unique_id "aTZirhSZHPLCPHyOpBVSbgAAAAU"]
[Mon Dec 08 13:31:28.883158 2025] [:error] [pid 16888:tid 16891] [client 45.132.224.7:60087] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez3/error.php"] [unique_id "aTZisBSZHPLCPHyOpBVSdAAAAAA"]
[Mon Dec 08 13:31:29.411315 2025] [:error] [pid 13445:tid 13472] [client 45.132.224.10:22093] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Globy/index.php"] [unique_id "aTZiscek7sIjbF2WoVbY9QAAAFY"]
[Mon Dec 08 13:31:30.118308 2025] [:error] [pid 16888:tid 16915] [client 45.132.224.48:48429] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/ja_purity/index.php"] [unique_id "aTZishSZHPLCPHyOpBVSeAAAABg"]
[Mon Dec 08 13:31:30.847866 2025] [:error] [pid 16888:tid 16907] [client 45.132.224.18:30669] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/atomic/error.php"] [unique_id "aTZishSZHPLCPHyOpBVSewAAABA"]
[Mon Dec 08 13:31:31.385799 2025] [:error] [pid 16888:tid 16891] [client 45.132.224.2:39715] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez5/index.php"] [unique_id "aTZisxSZHPLCPHyOpBVSfgAAAAA"]
[Mon Dec 08 13:31:31.937930 2025] [:error] [pid 13533:tid 13548] [client 45.132.224.16:45339] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Beez3/index.php"] [unique_id "aTZis0wxYk7zHgjCNdZlRAAAAU0"]
[Mon Dec 08 13:31:32.449036 2025] [:error] [pid 16888:tid 16909] [client 45.132.224.30:64515] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/rhuk_solarflare_ii/index.php"] [unique_id "aTZitBSZHPLCPHyOpBVSggAAABI"]
[Mon Dec 08 13:31:32.960146 2025] [:error] [pid 13446:tid 13482] [client 45.132.224.48:47419] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Protostar/index.php"] [unique_id "aTZitFPLjuV-KbK89q35BwAAAIM"]
[Mon Dec 08 13:31:33.732080 2025] [:error] [pid 16888:tid 16895] [client 45.132.224.13:20039] [client 45.132.224.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/rhuk_milkyway/index.php"] [unique_id "aTZitRSZHPLCPHyOpBVShwAAAAQ"]
[Mon Dec 08 13:31:34.508907 2025] [:error] [pid 13533:tid 13558] [client 45.132.224.15:60467] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/templates/isis/error.php"] [unique_id "aTZitkwxYk7zHgjCNdZlRwAAAVc"]
[Mon Dec 08 13:31:35.114199 2025] [:error] [pid 16888:tid 16906] [client 45.132.224.25:59075] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez_20/index.php"] [unique_id "aTZitxSZHPLCPHyOpBVSiQAAAA8"]
[Mon Dec 08 13:31:35.617673 2025] [:error] [pid 13445:tid 13458] [client 45.132.224.8:30927] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Globy/error.php"] [unique_id "aTZit8ek7sIjbF2WoVbY-gAAAEg"]
[Mon Dec 08 13:31:36.313487 2025] [:error] [pid 13533:tid 13557] [client 45.132.224.28:22255] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Protostar/error.php"] [unique_id "aTZiuEwxYk7zHgjCNdZlSwAAAVY"]
[Mon Dec 08 13:31:37.294939 2025] [:error] [pid 13447:tid 13518] [client 45.132.224.27:30339] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/templates/hathor/error.php"] [unique_id "aTZiuXsXz7UXj3rHK1upZgAAAMw"]
[Mon Dec 08 13:31:38.148407 2025] [:error] [pid 16888:tid 16893] [client 45.132.224.43:27897] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Atomic/error.php"] [unique_id "aTZiuhSZHPLCPHyOpBVSjQAAAAI"]
[Mon Dec 08 13:31:38.641441 2025] [:error] [pid 16888:tid 16905] [client 45.132.224.34:30963] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/isis/error.php"] [unique_id "aTZiuhSZHPLCPHyOpBVSjwAAAA4"]
[Mon Dec 08 13:31:39.708549 2025] [:error] [pid 13447:tid 13524] [client 45.132.224.32:50787] [client 45.132.224.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Hoxa/error.php"] [unique_id "aTZiu3sXz7UXj3rHK1upZwAAANI"]
[Mon Dec 08 13:31:40.714907 2025] [:error] [pid 13446:tid 13481] [client 45.132.224.17:33533] [client 45.132.224.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/BeginDot/error.php"] [unique_id "aTZivFPLjuV-KbK89q35CgAAAII"]
[Mon Dec 08 13:31:41.254373 2025] [:error] [pid 13447:tid 13507] [client 45.132.224.18:59595] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Raees/index.php"] [unique_id "aTZivXsXz7UXj3rHK1upaQAAAME"]
[Mon Dec 08 13:31:42.448209 2025] [:error] [pid 13533:tid 13544] [client 45.132.224.42:23131] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/madeyourweb/error.php"] [unique_id "aTZivkwxYk7zHgjCNdZlVAAAAUk"]
[Mon Dec 08 13:31:42.909161 2025] [:error] [pid 13446:tid 13497] [client 45.132.224.45:43039] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Binv/error.php"] [unique_id "aTZivlPLjuV-KbK89q35DAAAAJI"]
[Mon Dec 08 13:31:43.754893 2025] [:error] [pid 13445:tid 13460] [client 45.132.224.26:54587] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Beez2/index.php"] [unique_id "aTZiv8ek7sIjbF2WoVbZBgAAAEo"]
[Mon Dec 08 13:31:44.695326 2025] [:error] [pid 16888:tid 16905] [client 45.132.224.11:51979] [client 45.132.224.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Atum/error.php"] [unique_id "aTZiwBSZHPLCPHyOpBVSlgAAAA4"]
[Mon Dec 08 13:31:45.152539 2025] [:error] [pid 13446:tid 13502] [client 45.132.224.37:44419] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/protostar/error.php"] [unique_id "aTZiwVPLjuV-KbK89q35EAAAAJc"]
[Mon Dec 08 13:31:45.626539 2025] [:error] [pid 13446:tid 13496] [client 45.132.224.33:32277] [client 45.132.224.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez_20/error.php"] [unique_id "aTZiwVPLjuV-KbK89q35EwAAAJE"]
[Mon Dec 08 13:31:46.090309 2025] [:error] [pid 13445:tid 13468] [client 45.132.224.47:23703] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/cassiopeia/index.php"] [unique_id "aTZiwsek7sIjbF2WoVbZDgAAAFI"]
[Mon Dec 08 13:31:46.586190 2025] [:error] [pid 13533:tid 13546] [client 45.132.224.29:46227] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez3/jsstrings.php"] [unique_id "aTZiwkwxYk7zHgjCNdZlXAAAAUs"]
[Mon Dec 08 13:31:47.660395 2025] [:error] [pid 13445:tid 13454] [client 45.132.224.20:55933] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/protostar/index.php"] [unique_id "aTZiw8ek7sIjbF2WoVbZEAAAAEQ"]
[Mon Dec 08 13:31:48.553264 2025] [:error] [pid 13445:tid 13463] [client 45.132.224.29:52117] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Atum/index.php"] [unique_id "aTZixMek7sIjbF2WoVbZEQAAAE0"]
[Mon Dec 08 13:31:49.131294 2025] [:error] [pid 13446:tid 13492] [client 45.132.224.8:20705] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Beez3/error.php"] [unique_id "aTZixVPLjuV-KbK89q35GwAAAI0"]
[Mon Dec 08 13:31:49.798865 2025] [:error] [pid 13446:tid 13495] [client 45.132.224.30:30307] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Hoxa/index.php"] [unique_id "aTZixVPLjuV-KbK89q35HAAAAJA"]
[Mon Dec 08 13:31:50.495716 2025] [:error] [pid 13447:tid 13522] [client 45.132.224.34:64971] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/isis/index.php"] [unique_id "aTZixnsXz7UXj3rHK1upcQAAANA"]
[Mon Dec 08 13:31:51.661739 2025] [:error] [pid 16888:tid 16893] [client 45.132.224.47:27415] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Aaika/error.php"] [unique_id "aTZixxSZHPLCPHyOpBVSmwAAAAI"]
[Mon Dec 08 13:31:52.699709 2025] [:error] [pid 13445:tid 13474] [client 45.132.224.19:29199] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Binv/index.php"] [unique_id "aTZiyMek7sIjbF2WoVbZFgAAAFg"]
[Mon Dec 08 13:31:54.437512 2025] [:error] [pid 16888:tid 16894] [client 45.132.224.24:48145] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/JMart/error.php"] [unique_id "aTZiyhSZHPLCPHyOpBVSoAAAAAM"]
[Mon Dec 08 13:31:55.118783 2025] [:error] [pid 13447:tid 13519] [client 45.132.224.48:30977] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Cassiopeia/error.php"] [unique_id "aTZiy3sXz7UXj3rHK1uphAAAAM0"]
[Mon Dec 08 13:31:55.804388 2025] [:error] [pid 13447:tid 13521] [client 45.132.224.53:40151] [client 45.132.224.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/atomic/index.php"] [unique_id "aTZiy3sXz7UXj3rHK1uphQAAAM8"]
[Mon Dec 08 13:31:56.702373 2025] [:error] [pid 13533:tid 13556] [client 45.132.224.22:47489] [client 45.132.224.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Beez5/error.php"] [unique_id "aTZizEwxYk7zHgjCNdZlcgAAAVU"]
[Mon Dec 08 13:31:57.384918 2025] [:error] [pid 13533:tid 13542] [client 45.132.224.24:22517] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Eatoreh/index.php"] [unique_id "aTZizUwxYk7zHgjCNdZldAAAAUc"]
[Mon Dec 08 13:31:57.901761 2025] [:error] [pid 13447:tid 13509] [client 45.132.224.11:28583] [client 45.132.224.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/rhuk_milkyway/error.php"] [unique_id "aTZizXsXz7UXj3rHK1uphwAAAMM"]
[Mon Dec 08 13:31:58.419437 2025] [:error] [pid 13447:tid 13529] [client 45.132.224.47:30647] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/ja-helio-farsi/index.php"] [unique_id "aTZiznsXz7UXj3rHK1upiQAAANc"]
[Mon Dec 08 13:31:59.687175 2025] [:error] [pid 13533:tid 13546] [client 45.132.224.45:45697] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Aaika/index.php"] [unique_id "aTZiz0wxYk7zHgjCNdZlfQAAAUs"]
[Mon Dec 08 13:32:00.315104 2025] [:error] [pid 13446:tid 13502] [client 45.132.224.27:38993] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/templates/hathor/index.php"] [unique_id "aTZi0FPLjuV-KbK89q35IwAAAJc"]
[Mon Dec 08 13:32:00.841153 2025] [:error] [pid 13447:tid 13526] [client 45.132.224.49:46981] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/madeyourweb/index.php"] [unique_id "aTZi0HsXz7UXj3rHK1uplQAAANQ"]
[Mon Dec 08 13:32:01.323723 2025] [:error] [pid 16888:tid 16909] [client 45.132.224.8:27403] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/hathor/index.php"] [unique_id "aTZi0RSZHPLCPHyOpBVSrwAAABI"]
[Mon Dec 08 13:32:02.906731 2025] [:error] [pid 13447:tid 13519] [client 45.132.224.42:43921] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Genius/error.php"] [unique_id "aTZi0nsXz7UXj3rHK1upmAAAAM0"]
[Mon Dec 08 13:32:03.904219 2025] [:error] [pid 13446:tid 13482] [client 45.132.224.32:21223] [client 45.132.224.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Atomic/index.php"] [unique_id "aTZi01PLjuV-KbK89q35LAAAAIM"]
[Mon Dec 08 13:32:04.377406 2025] [:error] [pid 13445:tid 13458] [client 45.132.224.43:55097] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Eatoreh/error.php"] [unique_id "aTZi1Mek7sIjbF2WoVbZLwAAAEg"]
[Mon Dec 08 13:32:04.877361 2025] [:error] [pid 13447:tid 13517] [client 45.132.224.20:52813] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/RiverS/error.php"] [unique_id "aTZi1HsXz7UXj3rHK1upowAAAMs"]
[Mon Dec 08 13:32:05.339724 2025] [:error] [pid 16888:tid 16901] [client 45.132.224.34:28065] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/hathor/error.php"] [unique_id "aTZi1RSZHPLCPHyOpBVStAAAAAo"]
[Mon Dec 08 13:32:06.108513 2025] [:error] [pid 13533:tid 13539] [client 45.132.224.34:38881] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/RiverS/index.php"] [unique_id "aTZi1kwxYk7zHgjCNdZlmAAAAUQ"]
[Mon Dec 08 13:32:06.635453 2025] [:error] [pid 16888:tid 16898] [client 45.132.224.41:34189] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez3/index.php"] [unique_id "aTZi1hSZHPLCPHyOpBVSvwAAAAc"]
[Mon Dec 08 13:32:07.125889 2025] [:error] [pid 13447:tid 13526] [client 45.132.224.24:32589] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Yamato/error.php"] [unique_id "aTZi13sXz7UXj3rHK1upyAAAANQ"]
[Mon Dec 08 13:32:08.163468 2025] [:error] [pid 13446:tid 13493] [client 45.132.224.41:47915] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/JMart/index.php"] [unique_id "aTZi2FPLjuV-KbK89q35MAAAAI4"]
[Mon Dec 08 13:32:08.712799 2025] [:error] [pid 16888:tid 16913] [client 45.132.224.2:21979] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez/index.php"] [unique_id "aTZi2BSZHPLCPHyOpBVSywAAABY"]
[Mon Dec 08 13:32:09.404999 2025] [:error] [pid 13446:tid 13498] [client 45.132.224.2:54897] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Cassiopeia/index.php"] [unique_id "aTZi2VPLjuV-KbK89q35MgAAAJM"]
[Mon Dec 08 13:32:10.149324 2025] [:error] [pid 13446:tid 13488] [client 45.132.224.7:63799] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/beez5/error.php"] [unique_id "aTZi2lPLjuV-KbK89q35NQAAAIk"]
[Mon Dec 08 13:32:10.590384 2025] [:error] [pid 16888:tid 16909] [client 45.132.224.18:24839] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Genius/index.php"] [unique_id "aTZi2hSZHPLCPHyOpBVSzgAAABI"]
[Mon Dec 08 13:32:11.238292 2025] [:error] [pid 13446:tid 13481] [client 45.132.224.40:32727] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Beez5/index.php"] [unique_id "aTZi21PLjuV-KbK89q35NwAAAII"]
[Mon Dec 08 13:32:11.728831 2025] [:error] [pid 16888:tid 16907] [client 45.132.224.26:41147] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Raees/error.php"] [unique_id "aTZi2xSZHPLCPHyOpBVS0gAAABA"]
[Mon Dec 08 13:32:12.231492 2025] [:error] [pid 13533:tid 13551] [client 45.132.224.23:50829] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/BeginDot/index.php"] [unique_id "aTZi3EwxYk7zHgjCNdZlmgAAAVA"]
[Mon Dec 08 13:32:12.963686 2025] [:error] [pid 16888:tid 16906] [client 45.132.224.40:60449] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/rhuk_solarflare_ii/error.php"] [unique_id "aTZi3BSZHPLCPHyOpBVS1gAAAA8"]
[Mon Dec 08 13:32:13.814943 2025] [:error] [pid 16888:tid 16905] [client 45.132.224.17:29405] [client 45.132.224.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Beez2/error.php"] [unique_id "aTZi3RSZHPLCPHyOpBVS2wAAAA4"]
[Mon Dec 08 13:32:14.487745 2025] [:error] [pid 16888:tid 16914] [client 45.132.224.16:41253] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/cassiopeia/error.php"] [unique_id "aTZi3hSZHPLCPHyOpBVS3AAAABc"]
[Mon Dec 08 13:32:14.962730 2025] [:error] [pid 13445:tid 13459] [client 45.132.224.39:27701] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Jollyany/index.php"] [unique_id "aTZi3sek7sIjbF2WoVbZYgAAAEk"]
[Mon Dec 08 13:32:15.564043 2025] [:error] [pid 13446:tid 13500] [client 45.132.224.19:61829] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/templates/Jollyany/error.php"] [unique_id "aTZi31PLjuV-KbK89q35QQAAAJU"]
[Mon Dec 08 13:32:16.021616 2025] [:error] [pid 13447:tid 13508] [client 45.132.224.9:62743] [client 45.132.224.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/ets_whatsapp/new.php"] [unique_id "aTZi4HsXz7UXj3rHK1up5AAAAMI"]
[Mon Dec 08 13:32:16.536672 2025] [:error] [pid 13447:tid 13513] [client 45.132.224.28:58653] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aTZi4HsXz7UXj3rHK1up5gAAAMc"]
[Mon Dec 08 13:32:17.037909 2025] [:error] [pid 13445:tid 13473] [client 45.132.224.45:38553] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/udd.php"] [unique_id "aTZi4cek7sIjbF2WoVbZZgAAAFc"]
[Mon Dec 08 13:32:17.473320 2025] [:error] [pid 13533:tid 13548] [client 45.132.224.4:21515] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/ets_whatsapp/security.php"] [unique_id "aTZi4UwxYk7zHgjCNdZlnwAAAU0"]
[Mon Dec 08 13:32:18.869361 2025] [:error] [pid 13445:tid 13462] [client 45.132.224.45:45817] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod%20ariimageslidersa/mod%20ariimageslidersa.php"] [unique_id "aTZi4sek7sIjbF2WoVbZbwAAAEw"]
[Mon Dec 08 13:32:19.302114 2025] [:error] [pid 13533:tid 13535] [client 45.132.224.33:35835] [client 45.132.224.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/age-restriction/modules/remote_support/remote_init.php"] [unique_id "aTZi40wxYk7zHgjCNdZlpQAAAUA"]
[Mon Dec 08 13:32:20.223466 2025] [:error] [pid 13533:tid 13551] [client 45.132.224.30:32041] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod_ju_articleslider/tmpl/admin.php"] [unique_id "aTZi5EwxYk7zHgjCNdZlpwAAAVA"]
[Mon Dec 08 13:32:21.010833 2025] [:error] [pid 13447:tid 13508] [client 45.132.224.42:33733] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod_rebug/library/index2.php"] [unique_id "aTZi5XsXz7UXj3rHK1up9gAAAMI"]
[Mon Dec 08 13:32:21.596056 2025] [:error] [pid 16888:tid 16894] [client 45.132.224.41:33917] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/mod_ariimageslidersa/mod_ariimageslidersa.php"] [unique_id "aTZi5RSZHPLCPHyOpBVS7wAAAAM"]
[Mon Dec 08 13:32:22.251763 2025] [:error] [pid 13533:tid 13543] [client 45.132.224.51:24855] [client 45.132.224.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/modules/modules.php"] [unique_id "aTZi5kwxYk7zHgjCNdZlrgAAAUg"]
[Mon Dec 08 13:32:23.360169 2025] [:error] [pid 16888:tid 16903] [client 45.132.224.13:40935] [client 45.132.224.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/scrollbottom/anamama-2.php"] [unique_id "aTZi5xSZHPLCPHyOpBVS8gAAAAw"]
[Mon Dec 08 13:32:23.799638 2025] [:error] [pid 16888:tid 16909] [client 45.132.224.19:21893] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/modules/sendinblue/mini.php"] [unique_id "aTZi5xSZHPLCPHyOpBVS8wAAABI"]
[Mon Dec 08 13:32:24.335661 2025] [:error] [pid 13447:tid 13511] [client 45.132.224.24:20511] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/vendor/htmlawed/htmlawed/gel4y.php"] [unique_id "aTZi6HsXz7UXj3rHK1up_QAAAMU"]
[Mon Dec 08 13:32:25.456563 2025] [:error] [pid 16888:tid 16908] [client 45.132.224.39:36431] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/libraries/joomla/index.php"] [unique_id "aTZi6RSZHPLCPHyOpBVS-QAAABE"]
[Mon Dec 08 13:32:26.041618 2025] [:error] [pid 13446:tid 13490] [client 45.132.224.14:51127] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/vendor/composer/about.php"] [unique_id "aTZi6lPLjuV-KbK89q35SgAAAIs"]
[Mon Dec 08 13:32:26.586346 2025] [:error] [pid 16888:tid 16894] [client 45.132.224.50:43601] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/components/com_newsfeeds/models/index.php"] [unique_id "aTZi6hSZHPLCPHyOpBVS-gAAAAM"]
[Mon Dec 08 13:32:27.217103 2025] [:error] [pid 13533:tid 13541] [client 45.132.224.37:20827] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/vendor/composer/cache.php"] [unique_id "aTZi60wxYk7zHgjCNdZltwAAAUY"]
[Mon Dec 08 13:32:28.052841 2025] [:error] [pid 13445:tid 13461] [client 45.132.224.24:49137] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/components/com_b2jcontact/izoc.php"] [unique_id "aTZi7Mek7sIjbF2WoVbZhAAAAEs"]
[Mon Dec 08 13:32:28.800919 2025] [:error] [pid 13445:tid 13451] [client 45.132.224.10:63809] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/libraries/joomla/jmail.php"] [unique_id "aTZi7Mek7sIjbF2WoVbZhgAAAEE"]
[Mon Dec 08 13:32:29.263022 2025] [:error] [pid 13533:tid 13544] [client 45.132.224.26:25559] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/libraries/joomla/css.php"] [unique_id "aTZi7UwxYk7zHgjCNdZlugAAAUk"]
[Mon Dec 08 13:32:29.757052 2025] [:error] [pid 13446:tid 13482] [client 45.132.224.24:48423] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/components/com_jbcatalog/libraries/jsupload/server/php/files/up.php"] [unique_id "aTZi7VPLjuV-KbK89q35TQAAAIM"]
[Mon Dec 08 13:32:30.198669 2025] [:error] [pid 13446:tid 13488] [client 45.132.224.24:46161] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/components/com_xcloner-backupandrestore/index2.php"] [unique_id "aTZi7lPLjuV-KbK89q35TwAAAIk"]
[Mon Dec 08 13:32:30.669233 2025] [:error] [pid 13446:tid 13481] [client 45.132.224.11:50229] [client 45.132.224.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/components/com_xcloner-backupandrestore/language/english.php"] [unique_id "aTZi7lPLjuV-KbK89q35UQAAAII"]
[Mon Dec 08 13:32:31.741294 2025] [:error] [pid 16888:tid 16913] [client 45.132.224.26:30861] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/updates.php"] [unique_id "aTZi7xSZHPLCPHyOpBVTAAAAABY"]
[Mon Dec 08 13:32:32.426286 2025] [:error] [pid 13447:tid 13523] [client 45.132.224.47:47799] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/libraries/phpmailer/updates.php"] [unique_id "aTZi8HsXz7UXj3rHK1uqBgAAANE"]
[Mon Dec 08 13:32:32.901147 2025] [:error] [pid 13445:tid 13474] [client 45.132.224.4:39059] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/libraries/vendor/updates.php"] [unique_id "aTZi8Mek7sIjbF2WoVbZigAAAFg"]
[Mon Dec 08 13:32:34.149710 2025] [:error] [pid 16888:tid 16914] [client 45.132.224.10:64475] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin/resources/dummy/log.php"] [unique_id "aTZi8hSZHPLCPHyOpBVTCwAAABc"]
[Mon Dec 08 13:32:34.733366 2025] [:error] [pid 13445:tid 13457] [client 45.132.224.38:49445] [client 45.132.224.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin/log.php"] [unique_id "aTZi8sek7sIjbF2WoVbZjQAAAEc"]
[Mon Dec 08 13:32:35.299714 2025] [:error] [pid 13445:tid 13462] [client 45.132.224.50:53495] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin/include/student.php"] [unique_id "aTZi88ek7sIjbF2WoVbZjgAAAEw"]
[Mon Dec 08 13:32:35.738135 2025] [:error] [pid 13446:tid 13482] [client 45.132.224.16:24107] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin/cache.php"] [unique_id "aTZi81PLjuV-KbK89q35WAAAAIM"]
[Mon Dec 08 13:32:36.274715 2025] [:error] [pid 13447:tid 13519] [client 45.132.224.32:64107] [client 45.132.224.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/administrator/index.php"] [unique_id "aTZi9HsXz7UXj3rHK1uqCgAAAM0"]
[Mon Dec 08 13:32:36.822671 2025] [:error] [pid 13533:tid 13557] [client 45.132.224.13:22995] [client 45.132.224.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/admin/controller/extension/extension/index.php"] [unique_id "aTZi9EwxYk7zHgjCNdZlwgAAAVY"]
[Mon Dec 08 13:32:37.817626 2025] [:error] [pid 13533:tid 13556] [client 45.132.224.10:50079] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/local/index.php"] [unique_id "aTZi9UwxYk7zHgjCNdZlyQAAAVU"]
[Mon Dec 08 13:32:38.371937 2025] [:error] [pid 13445:tid 13468] [client 45.132.224.38:39171] [client 45.132.224.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/themes/classic/x.php"] [unique_id "aTZi9sek7sIjbF2WoVbZlQAAAFI"]
[Mon Dec 08 13:32:39.712298 2025] [:error] [pid 13445:tid 13463] [client 45.132.224.18:29285] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/assets/images/adriv4.php"] [unique_id "aTZi98ek7sIjbF2WoVbZlwAAAE0"]
[Mon Dec 08 13:32:40.477689 2025] [:error] [pid 13533:tid 13545] [client 45.132.224.40:32869] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/themes/zMousse/otuz1.php"] [unique_id "aTZi-EwxYk7zHgjCNdZlzQAAAUo"]
[Mon Dec 08 13:32:41.272805 2025] [:error] [pid 13445:tid 13462] [client 45.132.224.43:40193] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/sites/default/files/index.php"] [unique_id "aTZi-cek7sIjbF2WoVbZmgAAAEw"]
[Mon Dec 08 13:32:41.970890 2025] [:error] [pid 13445:tid 13464] [client 45.132.224.35:23733] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/local/moodle_webshell/index.php"] [unique_id "aTZi-cek7sIjbF2WoVbZnAAAAE4"]
[Mon Dec 08 13:32:42.583731 2025] [:error] [pid 13447:tid 13519] [client 45.132.224.43:54821] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/plugins/content/apismtp/wp-domain.php"] [unique_id "aTZi-nsXz7UXj3rHK1uqEwAAAM0"]
[Mon Dec 08 13:32:43.188124 2025] [:error] [pid 13533:tid 13537] [client 45.132.224.25:64645] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/plugins/content/apismtp/setting-api.php"] [unique_id "aTZi-0wxYk7zHgjCNdZl0gAAAUI"]
[Mon Dec 08 19:08:33.229982 2025] [:error] [pid 63353:tid 63371] [client 209.97.156.74:49411] [client 209.97.156.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aTaxsRtg8HdYG392GAgdNAAAAI8"], referer: binance.com
[Mon Dec 08 19:08:39.215034 2025] [:error] [pid 58847:tid 58870] [client 209.97.156.74:50811] [client 209.97.156.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aTaxt3y4UHQXWKMwpHn2HQAAARE"], referer: binance.com
[Mon Dec 08 20:03:44.942533 2025] [:error] [pid 58759:tid 58811] [client 13.70.2.1:25112] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTa-oP6HZGkO2H0XX-in_gAAANU"]
[Mon Dec 08 20:03:45.242517 2025] [:error] [pid 63353:tid 63375] [client 13.70.2.1:25163] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTa-oRtg8HdYG392GAg3qAAAAJM"]
[Mon Dec 08 20:03:45.482858 2025] [:error] [pid 63353:tid 63366] [client 13.70.2.1:25094] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTa-oRtg8HdYG392GAg3qgAAAIo"]
[Mon Dec 08 20:03:45.717261 2025] [:error] [pid 63353:tid 63368] [client 13.70.2.1:25174] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aTa-oRtg8HdYG392GAg3rAAAAIw"]
[Mon Dec 08 22:59:15.050672 2025] [:error] [pid 48482:tid 48513] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon Dec 08 22:59:15.075894 2025] [:error] [pid 48482:tid 48521] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs18.php
[Mon Dec 08 22:59:15.097412 2025] [:error] [pid 48482:tid 48527] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Mon Dec 08 22:59:15.124958 2025] [:error] [pid 48482:tid 48519] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/ghh.php
[Mon Dec 08 22:59:15.300883 2025] [:error] [pid 48482:tid 48534] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/bb5.php
[Mon Dec 08 22:59:15.454057 2025] [:error] [pid 48482:tid 48530] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/ce.php
[Mon Dec 08 22:59:15.496713 2025] [:error] [pid 48482:tid 48529] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/sdm.php
[Mon Dec 08 22:59:15.518088 2025] [:error] [pid 48482:tid 48517] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/por.php
[Mon Dec 08 22:59:15.581045 2025] [:error] [pid 48482:tid 48514] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/nux.php
[Mon Dec 08 22:59:15.751459 2025] [:error] [pid 48482:tid 48523] [client 4.197.238.69:51460] File does not exist: /usr/local/apache/htdocs/suspended-page/IRI.php
[Mon Dec 08 22:59:15.769902 2025] [:error] [pid 48482:tid 48531] [client 4.197.238.69:51460] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTbnw323gV7gRu3vn82iWgAAAJM"]
[Mon Dec 08 22:59:16.565446 2025] [:error] [pid 50569:tid 50575] [client 4.197.238.69:13970] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTbnxPHhZxyKreYmWzLaqQAAAAM"]
[Mon Dec 08 22:59:17.058245 2025] [:error] [pid 48573:tid 48587] [client 4.197.238.69:26184] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTbnxVIayuqwlm3CEkarAgAAAUw"]
[Mon Dec 08 22:59:17.204737 2025] [:error] [pid 48482:tid 48522] [client 4.197.238.69:26201] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTbnxX23gV7gRu3vn82iXQAAAIo"]
[Mon Dec 08 22:59:17.347504 2025] [:error] [pid 48481:tid 48506] [client 4.197.238.69:50666] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/85ohni.php"] [unique_id "aTbnxSe0pzx5KCi3S0I5sgAAANU"]
[Mon Dec 08 22:59:17.562601 2025] [:error] [pid 48573:tid 48591] [client 4.197.238.69:50632] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/85ohni.php"] [unique_id "aTbnxVIayuqwlm3CEkarAwAAAVA"]
[Mon Dec 08 22:59:17.657239 2025] [:error] [pid 48541:tid 48558] [client 4.197.238.69:14011] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/85ohni.php"] [unique_id "aTbnxQSNhJPArxLCdWEnmQAAAQ8"]
[Mon Dec 08 22:59:17.814395 2025] [:error] [pid 48482:tid 48525] [client 4.197.238.69:51489] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/85ohni.php"] [unique_id "aTbnxX23gV7gRu3vn82iYAAAAI0"]
[Mon Dec 08 22:59:18.319235 2025] [:error] [pid 50569:tid 50594] [client 4.197.238.69:13999] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTbnxvHhZxyKreYmWzLasQAAABY"]
[Mon Dec 08 22:59:18.689843 2025] [:error] [pid 48482:tid 48526] [client 4.197.238.69:51502] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTbnxn23gV7gRu3vn82iYgAAAI4"]
[Mon Dec 08 22:59:18.818508 2025] [:error] [pid 48482:tid 48513] [client 4.197.238.69:26189] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTbnxn23gV7gRu3vn82iYwAAAIE"]
[Mon Dec 08 22:59:18.949363 2025] [:error] [pid 48481:tid 48498] [client 4.197.238.69:13964] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTbnxie0pzx5KCi3S0I5twAAAM0"]
[Mon Dec 08 22:59:19.193957 2025] [:error] [pid 48482:tid 48527] [client 4.197.238.69:51499] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gel4y.php"] [unique_id "aTbnx323gV7gRu3vn82iZgAAAI8"]
[Mon Dec 08 22:59:19.763016 2025] [:error] [pid 48573:tid 48584] [client 4.197.238.69:26207] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gel4y.php"] [unique_id "aTbnx1Iayuqwlm3CEkarBgAAAUk"]
[Mon Dec 08 22:59:20.021113 2025] [:error] [pid 48482:tid 48518] [client 4.197.238.69:13971] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gel4y.php"] [unique_id "aTbnyH23gV7gRu3vn82ibAAAAIY"]
[Mon Dec 08 22:59:20.743925 2025] [:error] [pid 48482:tid 48528] [client 4.197.238.69:13985] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gel4y.php"] [unique_id "aTbnyH23gV7gRu3vn82icgAAAJA"]
[Mon Dec 08 22:59:21.669312 2025] [:error] [pid 50569:tid 50593] [client 4.197.238.69:26178] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tyasd.php"] [unique_id "aTbnyfHhZxyKreYmWzLauQAAABU"]
[Mon Dec 08 22:59:22.262721 2025] [:error] [pid 50569:tid 50577] [client 4.197.238.69:51465] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tyasd.php"] [unique_id "aTbnyvHhZxyKreYmWzLauwAAAAU"]
[Mon Dec 08 22:59:22.656976 2025] [:error] [pid 48541:tid 48566] [client 4.197.238.69:51500] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tyasd.php"] [unique_id "aTbnygSNhJPArxLCdWEnmwAAARc"]
[Mon Dec 08 22:59:23.971876 2025] [:error] [pid 48482:tid 48529] [client 4.197.238.69:51468] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tyasd.php"] [unique_id "aTbny323gV7gRu3vn82iewAAAJE"]
[Mon Dec 08 22:59:24.947731 2025] [:error] [pid 50569:tid 50577] [client 4.197.238.69:50658] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-set.php"] [unique_id "aTbnzPHhZxyKreYmWzLayAAAAAU"]
[Mon Dec 08 22:59:25.360311 2025] [:error] [pid 48541:tid 48556] [client 4.197.238.69:50627] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-set.php"] [unique_id "aTbnzQSNhJPArxLCdWEnnwAAAQ0"]
[Mon Dec 08 22:59:25.855962 2025] [:error] [pid 48482:tid 48512] [client 4.197.238.69:13977] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-set.php"] [unique_id "aTbnzX23gV7gRu3vn82igAAAAIA"]
[Mon Dec 08 22:59:26.623564 2025] [:error] [pid 48482:tid 48535] [client 4.197.238.69:51497] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-set.php"] [unique_id "aTbnzn23gV7gRu3vn82ihQAAAJc"]
[Mon Dec 08 22:59:26.956667 2025] [:error] [pid 48482:tid 48530] [client 4.197.238.69:51512] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AMW.php"] [unique_id "aTbnzn23gV7gRu3vn82ihgAAAJI"]
[Mon Dec 08 22:59:27.252844 2025] [:error] [pid 48573:tid 48593] [client 4.197.238.69:26219] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AMW.php"] [unique_id "aTbnz1Iayuqwlm3CEkarFgAAAVI"]
[Mon Dec 08 22:59:28.512651 2025] [:error] [pid 48573:tid 48582] [client 4.197.238.69:59650] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AMW.php"] [unique_id "aTbn0FIayuqwlm3CEkarHQAAAUc"]
[Mon Dec 08 22:59:30.266255 2025] [:error] [pid 50569:tid 50595] [client 4.197.238.69:13983] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AMW.php"] [unique_id "aTbn0vHhZxyKreYmWzLa3wAAABc"]
[Mon Dec 08 22:59:31.917614 2025] [:error] [pid 48541:tid 48549] [client 4.197.238.69:13975] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aTbn0wSNhJPArxLCdWEnpQAAAQY"]
[Mon Dec 08 22:59:32.323621 2025] [:error] [pid 48541:tid 48560] [client 4.197.238.69:51482] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aTbn1ASNhJPArxLCdWEnpwAAARE"]
[Mon Dec 08 22:59:32.888838 2025] [:error] [pid 50569:tid 50596] [client 4.197.238.69:51547] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aTbn1PHhZxyKreYmWzLa7AAAABg"]
[Mon Dec 08 22:59:33.794526 2025] [:error] [pid 48541:tid 48546] [client 4.197.238.69:26229] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aTbn1QSNhJPArxLCdWEnsQAAAQM"]
[Mon Dec 08 22:59:34.088997 2025] [:error] [pid 50569:tid 50575] [client 4.197.238.69:48510] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waba.php"] [unique_id "aTbn1vHhZxyKreYmWzLa8AAAAAM"]
[Mon Dec 08 22:59:34.396801 2025] [:error] [pid 48482:tid 48522] [client 4.197.238.69:14008] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waba.php"] [unique_id "aTbn1n23gV7gRu3vn82ipgAAAIo"]
[Mon Dec 08 22:59:34.875718 2025] [:error] [pid 48541:tid 48543] [client 4.197.238.69:51471] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waba.php"] [unique_id "aTbn1gSNhJPArxLCdWEntAAAAQA"]
[Mon Dec 08 22:59:36.819482 2025] [:error] [pid 50569:tid 50573] [client 4.197.238.69:51483] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waba.php"] [unique_id "aTbn2PHhZxyKreYmWzLa9gAAAAE"]
[Mon Dec 08 22:59:37.698399 2025] [:error] [pid 50569:tid 50583] [client 4.197.238.69:13986] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aTbn2fHhZxyKreYmWzLa-AAAAAs"]
[Mon Dec 08 22:59:39.009581 2025] [:error] [pid 48573:tid 48581] [client 4.197.238.69:26185] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aTbn21Iayuqwlm3CEkarLwAAAUY"]
[Mon Dec 08 22:59:39.350092 2025] [:error] [pid 50569:tid 50589] [client 4.197.238.69:48500] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aTbn2_HhZxyKreYmWzLa-wAAABE"]
[Mon Dec 08 22:59:39.677056 2025] [:error] [pid 48482:tid 48519] [client 4.197.238.69:26218] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aTbn2323gV7gRu3vn82iswAAAIc"]
[Mon Dec 08 22:59:39.824221 2025] [:error] [pid 48541:tid 48557] [client 4.197.238.69:13961] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTbn2wSNhJPArxLCdWEnzAAAAQ4"]
[Mon Dec 08 22:59:40.456381 2025] [:error] [pid 48482:tid 48531] [client 4.197.238.69:26182] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTbn3H23gV7gRu3vn82itQAAAJM"]
[Mon Dec 08 22:59:40.860304 2025] [:error] [pid 48573:tid 48584] [client 4.197.238.69:48508] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTbn3FIayuqwlm3CEkarMQAAAUk"]
[Mon Dec 08 22:59:41.109275 2025] [:error] [pid 48541:tid 48551] [client 4.197.238.69:48463] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTbn3QSNhJPArxLCdWEn1QAAAQg"]
[Mon Dec 08 22:59:41.319912 2025] [:error] [pid 48541:tid 48563] [client 4.197.238.69:26213] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheko.php"] [unique_id "aTbn3QSNhJPArxLCdWEn1wAAARQ"]
[Mon Dec 08 22:59:41.669769 2025] [:error] [pid 48481:tid 48501] [client 4.197.238.69:26224] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheko.php"] [unique_id "aTbn3Se0pzx5KCi3S0I50wAAANA"]
[Mon Dec 08 22:59:41.877205 2025] [:error] [pid 48541:tid 48549] [client 4.197.238.69:53284] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheko.php"] [unique_id "aTbn3QSNhJPArxLCdWEn2gAAAQY"]
[Mon Dec 08 22:59:42.055527 2025] [:error] [pid 48573:tid 48583] [client 4.197.238.69:51504] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheko.php"] [unique_id "aTbn3lIayuqwlm3CEkarMwAAAUg"]
[Mon Dec 08 22:59:42.168504 2025] [:error] [pid 48482:tid 48516] [client 4.197.238.69:53298] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xindex.php"] [unique_id "aTbn3n23gV7gRu3vn82ivQAAAIQ"]
[Mon Dec 08 22:59:42.257655 2025] [:error] [pid 48541:tid 48566] [client 4.197.238.69:48509] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xindex.php"] [unique_id "aTbn3gSNhJPArxLCdWEn3QAAARc"]
[Mon Dec 08 22:59:42.628498 2025] [:error] [pid 48482:tid 48515] [client 4.197.238.69:54291] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xindex.php"] [unique_id "aTbn3n23gV7gRu3vn82ivwAAAIM"]
[Mon Dec 08 22:59:42.825561 2025] [:error] [pid 48481:tid 48506] [client 4.197.238.69:48493] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xindex.php"] [unique_id "aTbn3ie0pzx5KCi3S0I51QAAANU"]
[Mon Dec 08 22:59:43.012454 2025] [:error] [pid 48541:tid 48553] [client 4.197.238.69:48471] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aTbn3wSNhJPArxLCdWEn4AAAAQo"]
[Mon Dec 08 22:59:43.434919 2025] [:error] [pid 48573:tid 48587] [client 4.197.238.69:26183] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aTbn31Iayuqwlm3CEkarOAAAAUw"]
[Mon Dec 08 22:59:44.044033 2025] [:error] [pid 48482:tid 48523] [client 4.197.238.69:53272] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aTbn4H23gV7gRu3vn82ixQAAAIs"]
[Mon Dec 08 22:59:45.039997 2025] [:error] [pid 48482:tid 48529] [client 4.197.238.69:26238] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aTbn4X23gV7gRu3vn82ixwAAAJE"]
[Mon Dec 08 22:59:45.560209 2025] [:error] [pid 48573:tid 48592] [client 4.197.238.69:54326] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aTbn4VIayuqwlm3CEkarPgAAAVE"]
[Mon Dec 08 22:59:45.771675 2025] [:error] [pid 48573:tid 48589] [client 4.197.238.69:54347] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aTbn4VIayuqwlm3CEkarQAAAAU4"]
[Mon Dec 08 22:59:46.089572 2025] [:error] [pid 48541:tid 48559] [client 4.197.238.69:53260] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aTbn4gSNhJPArxLCdWEn5gAAARA"]
[Mon Dec 08 22:59:46.505321 2025] [:error] [pid 48573:tid 48595] [client 4.197.238.69:53249] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aTbn4lIayuqwlm3CEkarRQAAAVQ"]
[Mon Dec 08 22:59:47.639179 2025] [:error] [pid 48482:tid 48536] [client 4.197.238.69:54365] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "aTbn4323gV7gRu3vn82izAAAAJg"]
[Mon Dec 08 22:59:48.021851 2025] [:error] [pid 48482:tid 48516] [client 4.197.238.69:48452] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "aTbn5H23gV7gRu3vn82i0AAAAIQ"]
[Mon Dec 08 22:59:48.608680 2025] [:error] [pid 48573:tid 48575] [client 4.197.238.69:54288] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "aTbn5FIayuqwlm3CEkarSgAAAUA"]
[Mon Dec 08 22:59:48.930227 2025] [:error] [pid 48541:tid 48545] [client 4.197.238.69:54324] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "aTbn5ASNhJPArxLCdWEn7QAAAQI"]
[Mon Dec 08 22:59:50.668487 2025] [:error] [pid 48541:tid 48564] [client 4.197.238.69:54397] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t1.php"] [unique_id "aTbn5gSNhJPArxLCdWEn9wAAARU"]
[Mon Dec 08 22:59:50.933410 2025] [:error] [pid 48481:tid 48492] [client 4.197.238.69:54355] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t1.php"] [unique_id "aTbn5ie0pzx5KCi3S0I52wAAAMc"]
[Mon Dec 08 22:59:51.044971 2025] [:error] [pid 48482:tid 48526] [client 4.197.238.69:14013] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t1.php"] [unique_id "aTbn5323gV7gRu3vn82i1AAAAI4"]
[Mon Dec 08 22:59:51.135894 2025] [:error] [pid 50569:tid 50579] [client 4.197.238.69:54321] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t1.php"] [unique_id "aTbn5_HhZxyKreYmWzLbCQAAAAc"]
[Mon Dec 08 22:59:51.239383 2025] [:error] [pid 48573:tid 48582] [client 4.197.238.69:54352] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aTbn51Iayuqwlm3CEkarTQAAAUc"]
[Mon Dec 08 22:59:51.431470 2025] [:error] [pid 48482:tid 48513] [client 4.197.238.69:54369] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aTbn5323gV7gRu3vn82i1QAAAIE"]
[Mon Dec 08 22:59:51.702168 2025] [:error] [pid 48482:tid 48533] [client 4.197.238.69:59666] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aTbn5323gV7gRu3vn82i1gAAAJU"]
[Mon Dec 08 22:59:51.926383 2025] [:error] [pid 50569:tid 50578] [client 4.197.238.69:54306] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aTbn5_HhZxyKreYmWzLbCgAAAAY"]
[Mon Dec 08 22:59:52.422125 2025] [:error] [pid 48541:tid 48543] [client 4.197.238.69:54354] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oysdxc.php"] [unique_id "aTbn6ASNhJPArxLCdWEn_AAAAQA"]
[Mon Dec 08 22:59:52.896435 2025] [:error] [pid 48541:tid 48565] [client 4.197.238.69:54323] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oysdxc.php"] [unique_id "aTbn6ASNhJPArxLCdWEoAgAAARY"]
[Mon Dec 08 22:59:54.003450 2025] [:error] [pid 48481:tid 48487] [client 4.197.238.69:54395] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oysdxc.php"] [unique_id "aTbn6ie0pzx5KCi3S0I54QAAAMI"]
[Mon Dec 08 22:59:54.574825 2025] [:error] [pid 48481:tid 48499] [client 4.197.238.69:54394] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oysdxc.php"] [unique_id "aTbn6ie0pzx5KCi3S0I55AAAAM4"]
[Mon Dec 08 22:59:54.948496 2025] [:error] [pid 48541:tid 48556] [client 4.197.238.69:54330] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sfcl.php"] [unique_id "aTbn6gSNhJPArxLCdWEoCgAAAQ0"]
[Mon Dec 08 22:59:55.696704 2025] [:error] [pid 48482:tid 48531] [client 4.197.238.69:13963] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sfcl.php"] [unique_id "aTbn6323gV7gRu3vn82i3gAAAJM"]
[Mon Dec 08 22:59:56.638280 2025] [:error] [pid 48481:tid 48500] [client 4.197.238.69:54315] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sfcl.php"] [unique_id "aTbn7Ce0pzx5KCi3S0I55gAAAM8"]
[Mon Dec 08 22:59:57.110767 2025] [:error] [pid 48541:tid 48566] [client 4.197.238.69:54273] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sfcl.php"] [unique_id "aTbn7QSNhJPArxLCdWEoEAAAARc"]
[Mon Dec 08 22:59:58.506718 2025] [:error] [pid 48481:tid 48491] [client 4.197.238.69:53310] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flap.php"] [unique_id "aTbn7ie0pzx5KCi3S0I56AAAAMY"]
[Mon Dec 08 22:59:59.222934 2025] [:error] [pid 48481:tid 48504] [client 4.197.238.69:54284] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flap.php"] [unique_id "aTbn7ye0pzx5KCi3S0I56wAAANM"]
[Mon Dec 08 22:59:59.653966 2025] [:error] [pid 48573:tid 48593] [client 4.197.238.69:48507] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flap.php"] [unique_id "aTbn71Iayuqwlm3CEkarUAAAAVI"]
[Mon Dec 08 23:00:00.078398 2025] [:error] [pid 48573:tid 48592] [client 4.197.238.69:54384] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flap.php"] [unique_id "aTbn8FIayuqwlm3CEkarUgAAAVE"]
[Mon Dec 08 23:00:00.209528 2025] [:error] [pid 48573:tid 48581] [client 4.197.238.69:54371] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ycc.php"] [unique_id "aTbn8FIayuqwlm3CEkarVQAAAUY"]
[Mon Dec 08 23:00:00.570526 2025] [:error] [pid 48573:tid 48584] [client 4.197.238.69:54345] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ycc.php"] [unique_id "aTbn8FIayuqwlm3CEkarVwAAAUk"]
[Mon Dec 08 23:00:01.489965 2025] [:error] [pid 50569:tid 50587] [client 4.197.238.69:48466] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ycc.php"] [unique_id "aTbn8fHhZxyKreYmWzLbGAAAAA8"]
[Mon Dec 08 23:00:01.763409 2025] [:error] [pid 48541:tid 48552] [client 4.197.238.69:54310] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ycc.php"] [unique_id "aTbn8QSNhJPArxLCdWEoFgAAAQk"]
[Mon Dec 08 23:00:01.917277 2025] [:error] [pid 50569:tid 50592] [client 4.197.238.69:54339] [client 4.197.238.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/11.php"] [unique_id "aTbn8fHhZxyKreYmWzLbHQAAABQ"]
[Mon Dec 08 23:00:02.272845 2025] [:error] [pid 48482:tid 48529] [client 4.197.238.69:54341] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aTbn8n23gV7gRu3vn82i6QAAAJE"]
[Mon Dec 08 23:00:02.802162 2025] [:error] [pid 48541:tid 48556] [client 4.197.238.69:54372] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aTbn8gSNhJPArxLCdWEoGwAAAQ0"]
[Mon Dec 08 23:00:02.995104 2025] [:error] [pid 48541:tid 48561] [client 4.197.238.69:48461] [client 4.197.238.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aTbn8gSNhJPArxLCdWEoHQAAARI"]
[Tue Dec 09 05:43:43.401150 2025] [:error] [pid 62040:tid 62081] [client 77.239.108.81:50742] [client 77.239.108.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aTdGj_kSVjwLGqZL-9JjfwAAAEs"]
[Tue Dec 09 05:43:43.952759 2025] [:error] [pid 34783:tid 34790] [client 77.239.108.81:47422] [client 77.239.108.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aTdGj617odLapL7SFcwsZQAAAUU"]
[Tue Dec 09 08:01:00.707500 2025] [:error] [pid 62041:tid 62114] [client 167.99.181.249:39674] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aTdmvPOmnJGvfaNPxPNutgAAAJE"]
[Tue Dec 09 08:01:01.709992 2025] [:error] [pid 62039:tid 62063] [client 167.99.181.249:39682] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/graphql"] [unique_id "aTdmva-WdjFepfLrlW6iLgAAABQ"]
[Tue Dec 09 08:01:02.149810 2025] [:error] [pid 62040:tid 62085] [client 167.99.181.249:39698] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/api"] [unique_id "aTdmvvkSVjwLGqZL-9J_cwAAAE8"]
[Tue Dec 09 08:01:02.586760 2025] [:error] [pid 62041:tid 62115] [client 167.99.181.249:39700] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/api/graphql"] [unique_id "aTdmvvOmnJGvfaNPxPNuuAAAAJI"]
[Tue Dec 09 08:01:03.232587 2025] [:error] [pid 62124:tid 62150] [client 167.99.181.249:39706] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/graphql/api"] [unique_id "aTdmv1raBX51GaCVVuVhwAAAANc"]
[Tue Dec 09 08:01:03.668522 2025] [:error] [pid 62040:tid 62093] [client 167.99.181.249:39708] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/api/gql"] [unique_id "aTdmv_kSVjwLGqZL-9J_eAAAAFc"]
[Tue Dec 09 08:01:05.136141 2025] [:error] [pid 62124:tid 62136] [client 167.99.181.249:39724] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/swagger-ui.html"] [unique_id "aTdmwVraBX51GaCVVuVhxAAAAMk"]
[Tue Dec 09 08:01:06.129482 2025] [:error] [pid 6053:tid 6061] [client 167.99.181.249:39736] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/swagger/index.html"] [unique_id "aTdmwiHz_Tnml8kdMwzKmQAAAYY"]
[Tue Dec 09 08:01:07.133064 2025] [:error] [pid 34783:tid 34791] [client 167.99.181.249:39746] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/swagger/swagger-ui.html"] [unique_id "aTdmw617odLapL7SFcxRSQAAAUY"]
[Tue Dec 09 08:01:08.134942 2025] [:error] [pid 62040:tid 62075] [client 167.99.181.249:42696] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/webjars/swagger-ui/index.html"] [unique_id "aTdmxPkSVjwLGqZL-9J_hwAAAEU"]
[Tue Dec 09 08:01:09.134829 2025] [:error] [pid 6053:tid 6067] [client 167.99.181.249:42706] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/swagger.json"] [unique_id "aTdmxSHz_Tnml8kdMwzKowAAAYw"]
[Tue Dec 09 08:01:10.139462 2025] [:error] [pid 62124:tid 62142] [client 167.99.181.249:42722] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/swagger/v1/swagger.json"] [unique_id "aTdmxlraBX51GaCVVuVhygAAAM8"]
[Tue Dec 09 08:01:11.139784 2025] [:error] [pid 6097:tid 6112] [client 167.99.181.249:42736] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/v2/api-docs"] [unique_id "aTdmx-Y9nDD1R9gHO2S5xwAAAc0"]
[Tue Dec 09 08:01:12.139300 2025] [:error] [pid 6097:tid 6117] [client 167.99.181.249:42742] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/v3/api-docs"] [unique_id "aTdmyOY9nDD1R9gHO2S5yQAAAdI"]
[Tue Dec 09 08:01:13.139904 2025] [:error] [pid 62124:tid 62144] [client 167.99.181.249:42758] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/api-docs/swagger.json"] [unique_id "aTdmyVraBX51GaCVVuVhzgAAANE"]
[Tue Dec 09 08:01:14.139805 2025] [:error] [pid 62039:tid 62055] [client 167.99.181.249:42766] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/api/swagger.json"] [unique_id "aTdmyq-WdjFepfLrlW6iOwAAAAw"]
[Tue Dec 09 08:01:15.141773 2025] [:error] [pid 62124:tid 62151] [client 167.99.181.249:42776] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/@vite/env"] [unique_id "aTdmy1raBX51GaCVVuVh0AAAANg"]
[Tue Dec 09 08:01:16.141786 2025] [:error] [pid 6053:tid 6063] [client 167.99.181.249:42780] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/actuator/env"] [unique_id "aTdmzCHz_Tnml8kdMwzKpAAAAYg"]
[Tue Dec 09 08:01:17.143512 2025] [:error] [pid 34783:tid 34794] [client 167.99.181.249:42790] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/server"] [unique_id "aTdmza17odLapL7SFcxRUQAAAUk"]
[Tue Dec 09 08:01:18.143987 2025] [:error] [pid 6097:tid 6120] [client 167.99.181.249:52510] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aTdmzuY9nDD1R9gHO2S5zwAAAdU"]
[Tue Dec 09 08:01:20.144537 2025] [:error] [pid 62041:tid 62097] [client 167.99.181.249:52526] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about"] [unique_id "aTdm0POmnJGvfaNPxPNuwwAAAIA"]
[Tue Dec 09 08:01:21.150606 2025] [:error] [pid 62039:tid 62043] [client 167.99.181.249:52528] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/debug/default/view"] [unique_id "aTdm0a-WdjFepfLrlW6iQQAAAAA"]
[Tue Dec 09 08:01:22.146225 2025] [:error] [pid 62040:tid 62071] [client 167.99.181.249:52534] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/v2/_catalog"] [unique_id "aTdm0vkSVjwLGqZL-9J_kQAAAEE"]
[Tue Dec 09 08:01:23.145955 2025] [:error] [pid 62040:tid 62092] [client 167.99.181.249:52536] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aTdm0_kSVjwLGqZL-9J_kgAAAFY"]
[Tue Dec 09 08:01:24.147480 2025] [:error] [pid 26689:tid 26757] [client 167.99.181.249:52544] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/server-status"] [unique_id "aTdm1Nkbfj8nyBvIyRBdrAAAARU"]
[Tue Dec 09 08:01:25.146384 2025] [:error] [pid 6097:tid 6113] [client 167.99.181.249:52558] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/login.action"] [unique_id "aTdm1eY9nDD1R9gHO2S50gAAAc4"]
[Tue Dec 09 08:01:26.146869 2025] [:error] [pid 62039:tid 62057] [client 167.99.181.249:52568] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/_all_dbs"] [unique_id "aTdm1q-WdjFepfLrlW6iRQAAAA4"]
[Tue Dec 09 08:01:27.146856 2025] [:error] [pid 62041:tid 62119] [client 167.99.181.249:52578] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.DS_Store"] [unique_id "aTdm1_OmnJGvfaNPxPNuxQAAAJY"]
[Tue Dec 09 08:01:28.150338 2025] [:error] [pid 62041:tid 62118] [client 167.99.181.249:42470] [client 167.99.181.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aTdm2POmnJGvfaNPxPNuxgAAAJU"]
[Tue Dec 09 08:01:30.166299 2025] [:error] [pid 6097:tid 6108] [client 167.99.181.249:42482] [client 167.99.181.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aTdm2uY9nDD1R9gHO2S52AAAAck"]
[Tue Dec 09 08:01:31.157794 2025] [:error] [pid 6053:tid 6078] [client 167.99.181.249:42486] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aTdm2yHz_Tnml8kdMwzKqAAAAZc"]
[Tue Dec 09 08:01:32.152771 2025] [:error] [pid 6053:tid 6058] [client 167.99.181.249:42502] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/config.json"] [unique_id "aTdm3CHz_Tnml8kdMwzKqwAAAYM"]
[Tue Dec 09 08:01:33.148410 2025] [:error] [pid 62039:tid 62052] [client 167.99.181.249:42514] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/telescope/requests"] [unique_id "aTdm3a-WdjFepfLrlW6iTQAAAAk"]
[Tue Dec 09 08:01:34.206528 2025] [:error] [pid 62124:tid 62151] [client 167.99.181.249:42518] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aTdm3lraBX51GaCVVuVh2gAAANg"]
[Tue Dec 09 08:01:35.150791 2025] [:error] [pid 6097:tid 6108] [client 167.99.181.249:42528] [client 167.99.181.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aTdm3-Y9nDD1R9gHO2S53wAAAck"]
[Tue Dec 09 09:35:37.259760 2025] [:error] [pid 62039:tid 62043] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Tue Dec 09 09:35:37.597403 2025] [:error] [pid 62039:tid 62052] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Tue Dec 09 09:35:38.272147 2025] [:error] [pid 62039:tid 62061] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Dec 09 09:35:38.611245 2025] [:error] [pid 62039:tid 62047] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Tue Dec 09 09:35:38.948087 2025] [:error] [pid 62039:tid 62053] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/php_info.php
[Tue Dec 09 09:35:39.284872 2025] [:error] [pid 62039:tid 62058] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Tue Dec 09 09:35:39.622450 2025] [:error] [pid 62039:tid 62056] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Tue Dec 09 09:35:40.636249 2025] [:error] [pid 62039:tid 62063] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Tue Dec 09 09:35:40.980655 2025] [:error] [pid 62039:tid 62043] [client 45.86.202.120:23165] File does not exist: /usr/local/apache/htdocs/suspended-page/php_version.php
[Tue Dec 09 09:35:41.659099 2025] [:error] [pid 62039:tid 62053] [client 45.86.202.120:23165] [client 45.86.202.120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aTd87a-WdjFepfLrlW7LOAAAAAo"]
[Tue Dec 09 09:35:42.345234 2025] [:error] [pid 6097:tid 6102] [client 45.86.202.115:32747] [client 45.86.202.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.example"] [unique_id "aTd87uY9nDD1R9gHO2TYnAAAAcM"]
[Tue Dec 09 09:35:43.019506 2025] [:error] [pid 62040:tid 62088] [client 45.86.202.123:62671] [client 45.86.202.123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aTd87_kSVjwLGqZL-9KSsQAAAFI"]
[Tue Dec 09 09:35:43.688030 2025] [:error] [pid 62040:tid 62073] [client 45.86.202.111:29215] [client 45.86.202.111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aTd87_kSVjwLGqZL-9KSsgAAAEM"]
[Tue Dec 09 09:35:45.357945 2025] [:error] [pid 6053:tid 6056] [client 45.86.202.112:57551] [client 45.86.202.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aTd88SHz_Tnml8kdMwzk5wAAAYE"]
[Tue Dec 09 11:22:12.164873 2025] [:error] [pid 6053:tid 6075] [client 45.138.16.233:54523] [client 45.138.16.233] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/postnews.php"] [unique_id "aTeV5CHz_Tnml8kdMwz-eQAAAZQ"]
[Tue Dec 09 11:22:12.758534 2025] [:error] [pid 62039:tid 62047] [client 45.138.16.233:54618] [client 45.138.16.233] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/postnews.php"] [unique_id "aTeV5K-WdjFepfLrlW71GwAAAAQ"]
[Tue Dec 09 11:22:13.353332 2025] [:error] [pid 34783:tid 34794] [client 45.138.16.233:54722] [client 45.138.16.233] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "aTeV5a17odLapL7SFcx9UwAAAUk"]
[Tue Dec 09 14:03:56.395103 2025] [:error] [pid 59388:tid 59402] [client 145.239.10.137:43655] File does not exist: /usr/local/apache/htdocs/suspended-page/configwidgets.php, referer: http://aoswa.com.au/configwidgets.php
[Tue Dec 09 14:54:06.211731 2025] [:error] [pid 7382:tid 7416] [client 45.138.16.233:61242] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHjidEXhamGkzwq-gx_gAAAdY"], referer: www.google.com
[Tue Dec 09 14:54:06.228754 2025] [:error] [pid 7287:tid 7308] [client 45.138.16.233:61256] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTfHjv3UQf3HGDaVS5P9wQAAABM"]
[Tue Dec 09 14:54:06.228980 2025] [:error] [pid 7287:tid 7301] [client 45.138.16.233:61240] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aTfHjv3UQf3HGDaVS5P9wgAAAAw"], referer: www.google.com
[Tue Dec 09 14:54:06.229404 2025] [:error] [pid 7287:tid 7310] [client 45.138.16.233:61243] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHjv3UQf3HGDaVS5P9wwAAABU"], referer: www.google.com
[Tue Dec 09 14:54:06.806963 2025] [:error] [pid 59388:tid 59398] [client 45.138.16.233:60428] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHjt7acjYK4IXwCBWjKQAAAIg"], referer: www.google.com
[Tue Dec 09 14:54:06.822897 2025] [:error] [pid 59388:tid 59410] [client 45.138.16.233:57250] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTfHjt7acjYK4IXwCBWjKgAAAJQ"]
[Tue Dec 09 14:54:06.829205 2025] [:error] [pid 7382:tid 7407] [client 45.138.16.233:57251] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aTfHjidEXhamGkzwq-gyBQAAAc0"], referer: www.google.com
[Tue Dec 09 14:54:06.829540 2025] [:error] [pid 7325:tid 7371] [client 45.138.16.233:57724] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHjgqEQlZnpyQAsW1aOgAAAY8"], referer: www.google.com
[Tue Dec 09 14:54:07.110002 2025] [:error] [pid 12069:tid 12072] [client 45.138.16.233:61239] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHj2wNDNgPF6LHYDTcigAAAEE"], referer: www.google.com
[Tue Dec 09 14:54:07.424132 2025] [:error] [pid 59388:tid 59413] [client 45.138.16.233:61885] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHj97acjYK4IXwCBWjLQAAAJc"], referer: www.google.com
[Tue Dec 09 14:54:07.427754 2025] [:error] [pid 7382:tid 7414] [client 45.138.16.233:61884] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTfHjydEXhamGkzwq-gyDAAAAdQ"]
[Tue Dec 09 14:54:07.433663 2025] [:error] [pid 7287:tid 7291] [client 45.138.16.233:57359] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-plain.php, referer: www.google.com
[Tue Dec 09 14:54:07.716126 2025] [:error] [pid 12069:tid 12080] [client 45.138.16.233:59117] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHj2wNDNgPF6LHYDTckgAAAEk"], referer: www.google.com
[Tue Dec 09 14:54:07.737467 2025] [:error] [pid 7287:tid 7293] [client 45.138.16.233:57359] File does not exist: /usr/local/apache/htdocs/suspended-page/ukeafsmz.php, referer: www.google.com
[Tue Dec 09 14:54:08.031798 2025] [:error] [pid 12069:tid 12084] [client 45.138.16.233:60661] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHkGwNDNgPF6LHYDTclQAAAE0"], referer: www.google.com
[Tue Dec 09 14:54:08.033319 2025] [:error] [pid 12069:tid 12081] [client 45.138.16.233:60665] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTfHkGwNDNgPF6LHYDTclgAAAEo"]
[Tue Dec 09 14:54:08.310947 2025] [:error] [pid 59388:tid 59411] [client 45.138.16.233:57515] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHkN7acjYK4IXwCBWjNgAAAJU"], referer: www.google.com
[Tue Dec 09 14:54:08.335570 2025] [:error] [pid 7287:tid 7301] [client 45.138.16.233:57359] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTfHkP3UQf3HGDaVS5P90QAAAAw"]
[Tue Dec 09 14:54:08.638299 2025] [:error] [pid 59388:tid 59399] [client 45.138.16.233:59157] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHkN7acjYK4IXwCBWjPwAAAIk"], referer: www.google.com
[Tue Dec 09 14:54:08.946511 2025] [:error] [pid 59388:tid 59398] [client 45.138.16.233:51422] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aTfHkN7acjYK4IXwCBWjSQAAAIg"], referer: www.google.com
[Tue Dec 09 14:54:09.526028 2025] [:error] [pid 7325:tid 7357] [client 45.138.16.233:59442] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHkQqEQlZnpyQAsW1aVwAAAYE"], referer: www.google.com
[Tue Dec 09 14:54:09.861997 2025] [:error] [pid 7324:tid 7345] [client 45.138.16.233:59460] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHkef70zXc9zH4rTLUQwAAAVA"], referer: www.google.com
[Tue Dec 09 14:54:10.145984 2025] [:error] [pid 7287:tid 7297] [client 45.138.16.233:57998] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aTfHkv3UQf3HGDaVS5P95QAAAAg"], referer: www.google.com
[Tue Dec 09 14:54:10.729450 2025] [:error] [pid 59388:tid 59397] [client 45.138.16.233:60694] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHkt7acjYK4IXwCBWjYAAAAIc"], referer: www.google.com
[Tue Dec 09 14:54:11.083822 2025] [:error] [pid 59388:tid 59392] [client 45.138.16.233:60048] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHk97acjYK4IXwCBWjZAAAAII"], referer: www.google.com
[Tue Dec 09 14:54:11.350778 2025] [:error] [pid 12069:tid 12092] [client 45.138.16.233:60203] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aTfHk2wNDNgPF6LHYDTcyAAAAFU"], referer: www.google.com
[Tue Dec 09 14:54:11.943812 2025] [:error] [pid 7324:tid 7353] [client 45.138.16.233:50272] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHk-f70zXc9zH4rTLUXwAAAVg"], referer: www.google.com
[Tue Dec 09 14:54:12.294709 2025] [:error] [pid 59388:tid 59402] [client 45.138.16.233:57824] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHlN7acjYK4IXwCBWjcAAAAIw"], referer: www.google.com
[Tue Dec 09 14:54:12.594754 2025] [:error] [pid 59388:tid 59411] [client 45.138.16.233:60260] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aTfHlN7acjYK4IXwCBWjcwAAAJU"], referer: www.google.com
[Tue Dec 09 14:54:13.196367 2025] [:error] [pid 59388:tid 59410] [client 45.138.16.233:59527] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHld7acjYK4IXwCBWjdQAAAJQ"], referer: www.google.com
[Tue Dec 09 14:54:13.529462 2025] [:error] [pid 7287:tid 7295] [client 45.138.16.233:50311] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHlf3UQf3HGDaVS5P9-QAAAAY"], referer: www.google.com
[Tue Dec 09 14:54:13.836330 2025] [:error] [pid 12069:tid 12091] [client 45.138.16.233:62264] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aTfHlWwNDNgPF6LHYDTc4gAAAFQ"], referer: www.google.com
[Tue Dec 09 14:54:14.412670 2025] [:error] [pid 12069:tid 12089] [client 45.138.16.233:50230] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHlmwNDNgPF6LHYDTc8AAAAFI"], referer: www.google.com
[Tue Dec 09 14:54:14.770011 2025] [:error] [pid 59388:tid 59405] [client 45.138.16.233:58938] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHlt7acjYK4IXwCBWjjwAAAI8"], referer: www.google.com
[Tue Dec 09 14:57:46.207488 2025] [:error] [pid 7324:tid 7341] [client 103.77.106.81:52229] [client 103.77.106.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aTfIauf70zXc9zH4rTLWjgAAAUw"]
[Tue Dec 09 14:57:49.539285 2025] [:error] [pid 59388:tid 59400] [client 103.77.106.81:62025] [client 103.77.106.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aTfIbd7acjYK4IXwCBWmkgAAAIo"]
[Tue Dec 09 15:01:46.853753 2025] [:error] [pid 7287:tid 7304] [client 103.77.106.81:57331] [client 103.77.106.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aTfJWv3UQf3HGDaVS5MApAAAAA8"]
[Tue Dec 09 15:01:47.517232 2025] [:error] [pid 7324:tid 7351] [client 103.77.106.81:60686] [client 103.77.106.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aTfJW-f70zXc9zH4rTLXYgAAAVY"]
[Tue Dec 09 19:17:12.536375 2025] [:error] [pid 30500:tid 30573] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Dec 09 19:17:12.707587 2025] [:error] [pid 30500:tid 30559] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Tue Dec 09 19:17:12.848142 2025] [:error] [pid 30500:tid 30580] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/v.php
[Tue Dec 09 19:17:12.979181 2025] [:error] [pid 30500:tid 30568] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/d2.php
[Tue Dec 09 19:17:13.102473 2025] [:error] [pid 30500:tid 30562] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/snus.php
[Tue Dec 09 19:17:13.236241 2025] [:error] [pid 30500:tid 30576] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Tue Dec 09 19:17:13.359248 2025] [:error] [pid 30500:tid 30567] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/disaos.php
[Tue Dec 09 19:17:13.487836 2025] [:error] [pid 30500:tid 30572] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Tue Dec 09 19:17:13.610973 2025] [:error] [pid 30500:tid 30565] [client 4.190.203.237:39515] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Tue Dec 09 19:17:13.730839 2025] [:error] [pid 30500:tid 30578] [client 4.190.203.237:39515] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTgFOa2eIIK3JPWHCXW8IwAAAZU"]
[Tue Dec 09 19:17:14.079339 2025] [:error] [pid 30500:tid 30581] [client 4.190.203.237:2514] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTgFOq2eIIK3JPWHCXW8JQAAAZg"]
[Tue Dec 09 19:17:17.490380 2025] [:error] [pid 30500:tid 30568] [client 4.190.203.237:39506] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTgFPa2eIIK3JPWHCXW8LAAAAYs"]
[Tue Dec 09 19:17:26.083233 2025] [:error] [pid 30499:tid 30532] [client 4.190.203.237:39541] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTgFRk0x3OqZTOPp7cnaFAAAAUI"]
[Tue Dec 09 19:17:26.532835 2025] [:error] [pid 30499:tid 30542] [client 4.190.203.237:2496] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTgFRk0x3OqZTOPp7cnaFgAAAUw"]
[Tue Dec 09 19:17:27.710783 2025] [:error] [pid 36456:tid 36476] [client 4.190.203.237:35115] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTgFRx0pAnOyfXl_v40U4gAAAJI"]
[Tue Dec 09 19:17:28.335102 2025] [:error] [pid 30498:tid 30523] [client 4.190.203.237:35127] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTgFSB2mcZJQ5qP_RC0c9QAAABU"]
[Tue Dec 09 19:19:31.151043 2025] [:error] [pid 30591:tid 30600] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Dec 09 19:19:31.277015 2025] [:error] [pid 30591:tid 30601] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Tue Dec 09 19:19:31.402614 2025] [:error] [pid 30591:tid 30614] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Dec 09 19:19:31.526971 2025] [:error] [pid 30591:tid 30610] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/r.php
[Tue Dec 09 19:19:31.651377 2025] [:error] [pid 30591:tid 30602] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/v4.php
[Tue Dec 09 19:19:31.775168 2025] [:error] [pid 30591:tid 30604] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-22.php
[Tue Dec 09 19:19:31.899464 2025] [:error] [pid 30591:tid 30595] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Dec 09 19:19:32.023887 2025] [:error] [pid 30591:tid 30594] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Dec 09 19:19:32.155234 2025] [:error] [pid 30591:tid 30611] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Tue Dec 09 19:19:32.280009 2025] [:error] [pid 30591:tid 30617] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Tue Dec 09 19:19:32.405396 2025] [:error] [pid 30591:tid 30599] [client 4.190.203.237:2552] File does not exist: /usr/local/apache/htdocs/suspended-page/ee.php
[Tue Dec 09 19:19:32.526245 2025] [:error] [pid 30591:tid 30616] [client 4.190.203.237:2552] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTgFxBG-g76drVdWQUVjFAAAAFY"]
[Tue Dec 09 19:19:32.803951 2025] [:error] [pid 30500:tid 30557] [client 4.190.203.237:39498] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTgFxK2eIIK3JPWHCXW88AAAAYA"]
[Tue Dec 09 19:19:33.120083 2025] [:error] [pid 30591:tid 30597] [client 4.190.203.237:35080] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTgFxRG-g76drVdWQUVjFQAAAEM"]
[Tue Dec 09 19:19:33.379735 2025] [:error] [pid 30591:tid 30613] [client 4.190.203.237:39430] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aTgFxRG-g76drVdWQUVjFgAAAFM"]
[Tue Dec 09 19:19:33.667287 2025] [:error] [pid 30591:tid 30618] [client 4.190.203.237:32787] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aTgFxRG-g76drVdWQUVjFwAAAFg"]
[Tue Dec 09 19:20:42.401456 2025] [:error] [pid 30591:tid 30611] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/02.php
[Tue Dec 09 19:20:42.523830 2025] [:error] [pid 30591:tid 30595] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Dec 09 19:20:42.646170 2025] [:error] [pid 30591:tid 30617] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Dec 09 19:20:42.770763 2025] [:error] [pid 30591:tid 30594] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/ee.php
[Tue Dec 09 19:20:42.893137 2025] [:error] [pid 30591:tid 30613] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue Dec 09 19:20:43.018008 2025] [:error] [pid 30591:tid 30616] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/dichku.php
[Tue Dec 09 19:20:43.140828 2025] [:error] [pid 30591:tid 30599] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/h2a2ck.php
[Tue Dec 09 19:20:43.263585 2025] [:error] [pid 30591:tid 30606] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/y7.PHP
[Tue Dec 09 19:20:43.386958 2025] [:error] [pid 30591:tid 30598] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/yr.PHP
[Tue Dec 09 19:20:43.509904 2025] [:error] [pid 30591:tid 30612] [client 4.190.203.237:39456] File does not exist: /usr/local/apache/htdocs/suspended-page/l3gi0n.php
[Tue Dec 09 19:20:43.629813 2025] [:error] [pid 30591:tid 30607] [client 4.190.203.237:39456] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aTgGCxG-g76drVdWQUVjRAAAAE0"]
[Tue Dec 09 19:21:01.428203 2025] [:error] [pid 30498:tid 30521] [client 4.190.203.237:39497] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mj.php"] [unique_id "aTgGHR2mcZJQ5qP_RC0d8gAAABM"]
[Tue Dec 09 19:21:04.225159 2025] [:error] [pid 30500:tid 30580] [client 4.190.203.237:39443] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mj.php"] [unique_id "aTgGIK2eIIK3JPWHCXW9XgAAAZc"]
[Tue Dec 09 19:21:19.300828 2025] [:error] [pid 30498:tid 30504] [client 4.190.203.237:39476] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aTgGLx2mcZJQ5qP_RC0eAAAAAAI"]
[Tue Dec 09 19:21:20.031456 2025] [:error] [pid 30500:tid 30569] [client 4.190.203.237:39450] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aTgGMK2eIIK3JPWHCXW9eQAAAYw"]
[Tue Dec 09 19:21:37.552483 2025] [:error] [pid 30499:tid 30538] [client 4.190.203.237:32821] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsz.php"] [unique_id "aTgGQU0x3OqZTOPp7cna6QAAAUg"]
[Tue Dec 09 19:21:41.029598 2025] [:error] [pid 30500:tid 30577] [client 4.190.203.237:39477] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsz.php"] [unique_id "aTgGRa2eIIK3JPWHCXW9nwAAAZQ"]
[Tue Dec 09 19:23:37.017307 2025] [:error] [pid 30591:tid 30601] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/trplv.php
[Tue Dec 09 19:23:37.151204 2025] [:error] [pid 30591:tid 30604] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Tue Dec 09 19:23:37.285315 2025] [:error] [pid 30591:tid 30615] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/wa.php
[Tue Dec 09 19:23:37.417414 2025] [:error] [pid 30591:tid 30595] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Dec 09 19:23:37.540086 2025] [:error] [pid 30591:tid 30596] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Dec 09 19:23:37.666157 2025] [:error] [pid 30591:tid 30616] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Dec 09 19:23:37.789117 2025] [:error] [pid 30591:tid 30606] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Dec 09 19:23:37.912650 2025] [:error] [pid 30591:tid 30611] [client 4.190.203.237:27432] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Dec 09 19:23:38.034244 2025] [:error] [pid 30591:tid 30608] [client 4.190.203.237:27432] [client 4.190.203.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aTgGuhG-g76drVdWQUVj9gAAAE4"]
[Tue Dec 09 19:23:39.278803 2025] [:error] [pid 30500:tid 30572] [client 4.190.203.237:3042] [client 4.190.203.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aTgGu62eIIK3JPWHCXW-dgAAAY8"]
[Tue Dec 09 19:23:39.662789 2025] [:error] [pid 36456:tid 36480] [client 4.190.203.237:38415] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Tue Dec 09 19:23:39.935862 2025] [:error] [pid 36456:tid 36470] [client 4.190.203.237:38415] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Dec 09 19:23:40.327325 2025] [:error] [pid 36456:tid 36458] [client 4.190.203.237:38415] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTgGvB0pAnOyfXl_v40VwgAAAIA"]
[Tue Dec 09 19:23:41.678326 2025] [:error] [pid 5276:tid 5302] [client 4.190.203.237:36201] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTgGvUtSXwbewdwyu-1a9QAAANg"]
[Tue Dec 09 19:23:42.572348 2025] [:error] [pid 30591:tid 30617] [client 4.190.203.237:29637] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTgGvhG-g76drVdWQUVj-AAAAFc"]
[Tue Dec 09 19:23:43.559214 2025] [:error] [pid 30591:tid 30618] [client 4.190.203.237:2436] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTgGvxG-g76drVdWQUVj-QAAAFg"]
[Tue Dec 09 19:23:44.477798 2025] [:error] [pid 30500:tid 30578] [client 4.190.203.237:23012] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aTgGwK2eIIK3JPWHCXW-fQAAAZU"]
[Tue Dec 09 19:23:45.651348 2025] [:error] [pid 30500:tid 30574] [client 4.190.203.237:28458] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aTgGwa2eIIK3JPWHCXW-iAAAAZE"]
[Tue Dec 09 19:23:45.996130 2025] [:error] [pid 36456:tid 36467] [client 4.190.203.237:2150] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aTgGwR0pAnOyfXl_v40VzgAAAIk"]
[Tue Dec 09 19:23:46.861787 2025] [:error] [pid 30500:tid 30567] [client 4.190.203.237:2179] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aTgGwq2eIIK3JPWHCXW-jQAAAYo"]
[Tue Dec 09 19:23:47.470148 2025] [:error] [pid 30498:tid 30518] [client 4.190.203.237:2440] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/znz2ra.php"] [unique_id "aTgGwx2mcZJQ5qP_RC0e1wAAABA"]
[Tue Dec 09 19:23:48.134567 2025] [:error] [pid 30498:tid 30520] [client 4.190.203.237:39508] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/znz2ra.php"] [unique_id "aTgGxB2mcZJQ5qP_RC0e2QAAABI"]
[Tue Dec 09 19:23:48.704922 2025] [:error] [pid 30498:tid 30504] [client 4.190.203.237:28512] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/znz2ra.php"] [unique_id "aTgGxB2mcZJQ5qP_RC0e2wAAAAI"]
[Tue Dec 09 19:23:50.258232 2025] [:error] [pid 30591:tid 30602] [client 4.190.203.237:2108] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/znz2ra.php"] [unique_id "aTgGxhG-g76drVdWQUVj_QAAAEg"]
[Tue Dec 09 19:23:51.446980 2025] [:error] [pid 30591:tid 30596] [client 4.190.203.237:30596] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aTgGxxG-g76drVdWQUVkAgAAAEI"]
[Tue Dec 09 19:23:51.828099 2025] [:error] [pid 30591:tid 30616] [client 4.190.203.237:26116] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aTgGxxG-g76drVdWQUVkAwAAAFY"]
[Tue Dec 09 19:23:53.116586 2025] [:error] [pid 5276:tid 5289] [client 4.190.203.237:3064] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aTgGyUtSXwbewdwyu-1bAQAAAMs"]
[Tue Dec 09 19:23:53.429875 2025] [:error] [pid 30500:tid 30566] [client 4.190.203.237:33801] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aTgGya2eIIK3JPWHCXW-mAAAAYk"]
[Tue Dec 09 19:23:54.257953 2025] [:error] [pid 30498:tid 30519] [client 4.190.203.237:30597] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTgGyh2mcZJQ5qP_RC0e6QAAABE"]
[Tue Dec 09 19:23:55.095561 2025] [:error] [pid 30500:tid 30573] [client 4.190.203.237:39449] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTgGy62eIIK3JPWHCXW-oAAAAZA"]
[Tue Dec 09 19:23:55.760938 2025] [:error] [pid 30500:tid 30572] [client 4.190.203.237:39477] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTgGy62eIIK3JPWHCXW-pAAAAY8"]
[Tue Dec 09 19:23:56.375393 2025] [:error] [pid 36456:tid 36482] [client 4.190.203.237:35153] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTgGzB0pAnOyfXl_v40V0gAAAJg"]
[Tue Dec 09 19:23:57.422120 2025] [:error] [pid 30500:tid 30567] [client 4.190.203.237:2623] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTgGza2eIIK3JPWHCXW-rwAAAYo"]
[Tue Dec 09 19:23:57.735387 2025] [:error] [pid 30499:tid 30535] [client 4.190.203.237:2587] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTgGzU0x3OqZTOPp7cnbkAAAAUU"]
[Tue Dec 09 19:23:58.539320 2025] [:error] [pid 30498:tid 30521] [client 4.190.203.237:2656] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTgGzh2mcZJQ5qP_RC0e_QAAABM"]
[Tue Dec 09 19:23:59.136404 2025] [:error] [pid 36456:tid 36461] [client 4.190.203.237:2675] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aTgGzx0pAnOyfXl_v40V1AAAAIM"]
[Tue Dec 09 19:23:59.524986 2025] [:error] [pid 5276:tid 5291] [client 4.190.203.237:2680] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kk.php"] [unique_id "aTgGz0tSXwbewdwyu-1bGgAAAM0"]
[Tue Dec 09 19:24:26.429211 2025] [:error] [pid 30500:tid 30581] [client 4.190.203.237:36126] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTgG6q2eIIK3JPWHCXW-2wAAAZg"]
[Tue Dec 09 19:24:26.689409 2025] [:error] [pid 30500:tid 30571] [client 4.190.203.237:38465] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTgG6q2eIIK3JPWHCXW-3AAAAY4"]
[Tue Dec 09 19:24:26.933562 2025] [:error] [pid 5276:tid 5297] [client 4.190.203.237:38476] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTgG6ktSXwbewdwyu-1bNAAAANM"]
[Tue Dec 09 19:24:27.224861 2025] [:error] [pid 30499:tid 30540] [client 4.190.203.237:38405] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aTgG600x3OqZTOPp7cnbqgAAAUo"]
[Tue Dec 09 19:24:27.630444 2025] [:error] [pid 36456:tid 36473] [client 4.190.203.237:36203] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTgG6x0pAnOyfXl_v40V9AAAAI8"]
[Tue Dec 09 19:24:27.905429 2025] [:error] [pid 30591:tid 30610] [client 4.190.203.237:38434] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTgG6xG-g76drVdWQUVkZgAAAFA"]
[Tue Dec 09 19:24:28.181460 2025] [:error] [pid 30591:tid 30594] [client 4.190.203.237:38482] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTgG7BG-g76drVdWQUVkaAAAAEA"]
[Tue Dec 09 19:24:28.687978 2025] [:error] [pid 36456:tid 36479] [client 4.190.203.237:35191] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aTgG7B0pAnOyfXl_v40V9wAAAJU"]
[Tue Dec 09 19:24:29.124751 2025] [:error] [pid 5276:tid 5283] [client 4.190.203.237:2160] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTgG7UtSXwbewdwyu-1bNQAAAMU"]
[Tue Dec 09 19:24:29.845309 2025] [:error] [pid 30500:tid 30565] [client 4.190.203.237:2923] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTgG7a2eIIK3JPWHCXW-4AAAAYg"]
[Tue Dec 09 19:24:30.769510 2025] [:error] [pid 30498:tid 30522] [client 4.190.203.237:40835] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTgG7h2mcZJQ5qP_RC0fIQAAABQ"]
[Tue Dec 09 19:24:31.292150 2025] [:error] [pid 30591:tid 30599] [client 4.190.203.237:28526] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTgG7xG-g76drVdWQUVkawAAAEU"]
[Tue Dec 09 19:24:32.299361 2025] [:error] [pid 36456:tid 36469] [client 4.190.203.237:33829] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aTgG8B0pAnOyfXl_v40V_AAAAIs"]
[Tue Dec 09 19:24:32.991167 2025] [:error] [pid 36456:tid 36463] [client 4.190.203.237:39499] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aTgG8B0pAnOyfXl_v40V_wAAAIU"]
[Tue Dec 09 19:24:33.956172 2025] [:error] [pid 36456:tid 36459] [client 4.190.203.237:27481] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aTgG8R0pAnOyfXl_v40WAgAAAIE"]
[Tue Dec 09 19:24:34.535261 2025] [:error] [pid 30500:tid 30578] [client 4.190.203.237:2274] [client 4.190.203.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siln.php"] [unique_id "aTgG8q2eIIK3JPWHCXW-5QAAAZU"]
[Tue Dec 09 19:53:50.448493 2025] [:error] [pid 30498:tid 30510] [client 35.192.77.233:65256] [client 35.192.77.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTgNzh2mcZJQ5qP_RC0m-gAAAAg"]
[Tue Dec 09 19:53:50.848717 2025] [:error] [pid 30499:tid 30552] [client 35.192.77.233:49619] [client 35.192.77.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTgNzk0x3OqZTOPp7cnmPAAAAVY"]
[Tue Dec 09 19:53:51.316464 2025] [:error] [pid 30591:tid 30611] [client 35.192.77.233:61150] [client 35.192.77.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aTgNzxG-g76drVdWQUVtbQAAAFE"]
[Wed Dec 10 01:41:56.268692 2025] [:error] [pid 2279:tid 2318] [client 145.239.10.137:45305] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php, referer: http://aoswa.com.au/main.php
[Wed Dec 10 02:48:35.936005 2025] [:error] [pid 2366:tid 2386] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Wed Dec 10 02:48:36.062085 2025] [:error] [pid 2366:tid 2372] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Wed Dec 10 02:48:36.186361 2025] [:error] [pid 2366:tid 2374] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/abe.php
[Wed Dec 10 02:48:36.316239 2025] [:error] [pid 2366:tid 2381] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Dec 10 02:48:36.464420 2025] [:error] [pid 2366:tid 2373] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Dec 10 02:48:36.599055 2025] [:error] [pid 2366:tid 2383] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Wed Dec 10 02:48:36.747474 2025] [:error] [pid 2366:tid 2377] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/lock6.php
[Wed Dec 10 02:48:36.871786 2025] [:error] [pid 2366:tid 2387] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/news.php
[Wed Dec 10 02:48:36.995171 2025] [:error] [pid 2366:tid 2389] [client 4.189.125.63:65522] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Wed Dec 10 02:48:37.228198 2025] [:error] [pid 2366:tid 2386] [client 4.189.125.63:65522] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aThvBUAeBjkmsNRkd1OYEAAAANI"]
[Wed Dec 10 02:48:37.603944 2025] [:error] [pid 2366:tid 2375] [client 4.189.125.63:65518] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aThvBUAeBjkmsNRkd1OYEwAAAMc"]
[Wed Dec 10 02:48:38.217915 2025] [:error] [pid 2277:tid 2307] [client 4.189.125.63:64396] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aThvBoWGo731r6eS-w576wAAABg"]
[Wed Dec 10 02:48:38.482370 2025] [:error] [pid 2280:tid 2339] [client 4.189.125.63:20459] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aThvBncqIB-8ALgw4Zp8OQAAAII"]
[Wed Dec 10 02:48:38.903074 2025] [:error] [pid 2280:tid 2344] [client 4.189.125.63:65505] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aThvBncqIB-8ALgw4Zp8OwAAAIc"]
[Wed Dec 10 02:48:39.192140 2025] [:error] [pid 2277:tid 2284] [client 4.189.125.63:56248] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aThvB4WGo731r6eS-w577QAAAAI"]
[Wed Dec 10 02:48:39.567143 2025] [:error] [pid 37041:tid 37055] [client 4.189.125.63:57399] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aThvB7uffDW8UzBwa1bQ2gAAAEw"]
[Wed Dec 10 02:48:40.219467 2025] [:error] [pid 2277:tid 2283] [client 4.189.125.63:58791] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aThvCIWGo731r6eS-w577gAAAAE"]
[Wed Dec 10 02:48:40.783482 2025] [:error] [pid 37041:tid 37051] [client 4.189.125.63:62414] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aThvCLuffDW8UzBwa1bQ2wAAAEg"]
[Wed Dec 10 02:48:41.304195 2025] [:error] [pid 2366:tid 2390] [client 4.189.125.63:57351] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aThvCUAeBjkmsNRkd1OYIAAAANY"]
[Wed Dec 10 02:48:41.706154 2025] [:error] [pid 2279:tid 2314] [client 4.189.125.63:60314] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aThvCVmpdQscMcJOElXW5wAAAUQ"]
[Wed Dec 10 02:48:42.113799 2025] [:error] [pid 2279:tid 2313] [client 4.189.125.63:56197] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aThvClmpdQscMcJOElXW6AAAAUM"]
[Wed Dec 10 02:48:42.461946 2025] [:error] [pid 2280:tid 2354] [client 4.189.125.63:62421] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aThvCncqIB-8ALgw4Zp8QgAAAJE"]
[Wed Dec 10 02:48:42.731799 2025] [:error] [pid 2279:tid 2312] [client 4.189.125.63:4856] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aThvClmpdQscMcJOElXW7AAAAUI"]
[Wed Dec 10 02:48:43.095308 2025] [:error] [pid 2366:tid 2370] [client 4.189.125.63:60312] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aThvC0AeBjkmsNRkd1OYJgAAAMI"]
[Wed Dec 10 02:48:43.433901 2025] [:error] [pid 2366:tid 2373] [client 4.189.125.63:64408] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aThvC0AeBjkmsNRkd1OYJwAAAMU"]
[Wed Dec 10 02:48:43.778485 2025] [:error] [pid 2279:tid 2318] [client 4.189.125.63:57396] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aThvC1mpdQscMcJOElXW8AAAAUg"]
[Wed Dec 10 02:48:44.418175 2025] [:error] [pid 2279:tid 2331] [client 4.189.125.63:57380] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aThvDFmpdQscMcJOElXW8wAAAVU"]
[Wed Dec 10 02:48:44.956269 2025] [:error] [pid 37041:tid 37052] [client 4.189.125.63:56247] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aThvDLuffDW8UzBwa1bQ5QAAAEk"]
[Wed Dec 10 02:48:45.388121 2025] [:error] [pid 2366:tid 2386] [client 4.189.125.63:58084] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aThvDUAeBjkmsNRkd1OYKwAAANI"]
[Wed Dec 10 02:48:45.726688 2025] [:error] [pid 2277:tid 2291] [client 4.189.125.63:58061] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aThvDYWGo731r6eS-w57-AAAAAk"]
[Wed Dec 10 02:48:46.438081 2025] [:error] [pid 2277:tid 2290] [client 4.189.125.63:57346] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aThvDoWGo731r6eS-w57-gAAAAg"]
[Wed Dec 10 02:48:46.873627 2025] [:error] [pid 2366:tid 2391] [client 4.189.125.63:54649] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aThvDkAeBjkmsNRkd1OYMAAAANc"]
[Wed Dec 10 02:48:47.358789 2025] [:error] [pid 37041:tid 37061] [client 4.189.125.63:62461] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aThvD7uffDW8UzBwa1bQ6QAAAFI"]
[Wed Dec 10 02:48:47.762104 2025] [:error] [pid 37041:tid 37045] [client 4.189.125.63:64402] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aThvD7uffDW8UzBwa1bQ6gAAAEI"]
[Wed Dec 10 02:48:48.397652 2025] [:error] [pid 2279:tid 2315] [client 4.189.125.63:57377] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aThvEFmpdQscMcJOElXW-QAAAUU"]
[Wed Dec 10 02:48:48.864283 2025] [:error] [pid 37041:tid 37053] [client 4.189.125.63:55357] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aThvELuffDW8UzBwa1bQ7QAAAEo"]
[Wed Dec 10 02:48:49.432232 2025] [:error] [pid 2279:tid 2316] [client 4.189.125.63:56221] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aThvEVmpdQscMcJOElXW_AAAAUY"]
[Wed Dec 10 02:48:49.775286 2025] [:error] [pid 37041:tid 37044] [client 4.189.125.63:59050] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aThvEbuffDW8UzBwa1bQ7wAAAEE"]
[Wed Dec 10 02:48:50.238877 2025] [:error] [pid 37041:tid 37052] [client 4.189.125.63:5049] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aThvEruffDW8UzBwa1bQ8QAAAEk"]
[Wed Dec 10 02:48:50.744444 2025] [:error] [pid 2280:tid 2354] [client 4.189.125.63:57160] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aThvEncqIB-8ALgw4Zp8VAAAAJE"]
[Wed Dec 10 02:48:51.049795 2025] [:error] [pid 2280:tid 2360] [client 4.189.125.63:57163] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aThvE3cqIB-8ALgw4Zp8VQAAAJc"]
[Wed Dec 10 02:48:51.317609 2025] [:error] [pid 37041:tid 37064] [client 4.189.125.63:5036] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aThvE7uffDW8UzBwa1bQ-gAAAFU"]
[Wed Dec 10 02:48:51.656829 2025] [:error] [pid 37041:tid 37050] [client 4.189.125.63:5019] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aThvE7uffDW8UzBwa1bQ_AAAAEc"]
[Wed Dec 10 02:48:51.990102 2025] [:error] [pid 37041:tid 37052] [client 4.189.125.63:55305] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aThvE7uffDW8UzBwa1bQ_QAAAEk"]
[Wed Dec 10 02:48:52.404837 2025] [:error] [pid 37041:tid 37049] [client 4.189.125.63:57204] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aThvFLuffDW8UzBwa1bRAAAAAEY"]
[Wed Dec 10 02:48:52.837790 2025] [:error] [pid 37041:tid 37051] [client 4.189.125.63:60306] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aThvFLuffDW8UzBwa1bRAgAAAEg"]
[Wed Dec 10 02:48:53.334158 2025] [:error] [pid 2366:tid 2369] [client 4.189.125.63:62424] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aThvFUAeBjkmsNRkd1OYNgAAAME"]
[Wed Dec 10 02:48:53.721908 2025] [:error] [pid 2366:tid 2390] [client 4.189.125.63:5050] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aThvFUAeBjkmsNRkd1OYOAAAANY"]
[Wed Dec 10 02:48:54.058145 2025] [:error] [pid 37041:tid 37056] [client 4.189.125.63:58866] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aThvFruffDW8UzBwa1bRBwAAAE0"]
[Wed Dec 10 02:48:54.440175 2025] [:error] [pid 2280:tid 2359] [client 4.189.125.63:56211] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aThvFncqIB-8ALgw4Zp8WgAAAJY"]
[Wed Dec 10 02:48:54.926464 2025] [:error] [pid 2366:tid 2374] [client 4.189.125.63:55343] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aThvFkAeBjkmsNRkd1OYQAAAAMY"]
[Wed Dec 10 02:48:55.191348 2025] [:error] [pid 2279:tid 2329] [client 4.189.125.63:58819] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aThvF1mpdQscMcJOElXXBgAAAVM"]
[Wed Dec 10 02:48:55.755003 2025] [:error] [pid 2279:tid 2326] [client 4.189.125.63:55324] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aThvF1mpdQscMcJOElXXCQAAAVA"]
[Wed Dec 10 02:48:56.071376 2025] [:error] [pid 2280:tid 2357] [client 4.189.125.63:60310] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aThvGHcqIB-8ALgw4Zp8YAAAAJQ"]
[Wed Dec 10 02:48:56.523767 2025] [:error] [pid 2366:tid 2390] [client 4.189.125.63:55316] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aThvGEAeBjkmsNRkd1OYRQAAANY"]
[Wed Dec 10 02:48:56.888686 2025] [:error] [pid 2366:tid 2382] [client 4.189.125.63:57723] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aThvGEAeBjkmsNRkd1OYRgAAAM4"]
[Wed Dec 10 02:48:57.370823 2025] [:error] [pid 2279:tid 2311] [client 4.189.125.63:55970] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aThvGVmpdQscMcJOElXXDAAAAUE"]
[Wed Dec 10 02:48:57.670116 2025] [:error] [pid 37041:tid 37054] [client 4.189.125.63:55978] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hoot.php"] [unique_id "aThvGbuffDW8UzBwa1bRDAAAAEs"]
[Wed Dec 10 02:48:58.044560 2025] [:error] [pid 2279:tid 2328] [client 4.189.125.63:59019] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hoot.php"] [unique_id "aThvGlmpdQscMcJOElXXDgAAAVI"]
[Wed Dec 10 02:48:58.477542 2025] [:error] [pid 2277:tid 2298] [client 4.189.125.63:55983] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hoot.php"] [unique_id "aThvGoWGo731r6eS-w58BQAAAA8"]
[Wed Dec 10 02:48:58.923189 2025] [:error] [pid 2279:tid 2323] [client 4.189.125.63:20486] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hoot.php"] [unique_id "aThvGlmpdQscMcJOElXXEgAAAU0"]
[Wed Dec 10 02:48:59.286349 2025] [:error] [pid 2277:tid 2294] [client 4.189.125.63:55303] [client 4.189.125.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aThvG4WGo731r6eS-w58BwAAAAs"]
[Wed Dec 10 02:48:59.905490 2025] [:error] [pid 2280:tid 2343] [client 4.189.125.63:57673] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aThvG3cqIB-8ALgw4Zp8ZwAAAIY"]
[Wed Dec 10 02:49:00.292164 2025] [:error] [pid 2280:tid 2337] [client 4.189.125.63:20525] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aThvHHcqIB-8ALgw4Zp8aQAAAIA"]
[Wed Dec 10 02:49:01.018884 2025] [:error] [pid 2280:tid 2353] [client 4.189.125.63:20538] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aThvHXcqIB-8ALgw4Zp8bgAAAJA"]
[Wed Dec 10 02:49:01.566322 2025] [:error] [pid 2277:tid 2284] [client 4.189.125.63:4930] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aThvHYWGo731r6eS-w58DgAAAAI"]
[Wed Dec 10 02:49:02.163907 2025] [:error] [pid 2277:tid 2299] [client 4.189.125.63:63909] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aThvHoWGo731r6eS-w58EAAAABA"]
[Wed Dec 10 02:49:02.700483 2025] [:error] [pid 2279:tid 2331] [client 4.189.125.63:63918] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aThvHlmpdQscMcJOElXXGAAAAVU"]
[Wed Dec 10 02:49:03.384442 2025] [:error] [pid 2280:tid 2356] [client 4.189.125.63:59008] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aThvH3cqIB-8ALgw4Zp8cwAAAJM"]
[Wed Dec 10 02:49:03.826914 2025] [:error] [pid 2277:tid 2287] [client 4.189.125.63:4961] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aThvH4WGo731r6eS-w58FQAAAAU"]
[Wed Dec 10 02:49:04.493803 2025] [:error] [pid 2277:tid 2294] [client 4.189.125.63:54226] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aThvIIWGo731r6eS-w58FgAAAAs"]
[Wed Dec 10 02:49:04.985969 2025] [:error] [pid 2277:tid 2305] [client 4.189.125.63:62197] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aThvIIWGo731r6eS-w58GAAAABY"]
[Wed Dec 10 02:49:05.583217 2025] [:error] [pid 2277:tid 2301] [client 4.189.125.63:62190] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aThvIYWGo731r6eS-w58GQAAABI"]
[Wed Dec 10 02:49:05.877187 2025] [:error] [pid 2279:tid 2331] [client 4.189.125.63:62192] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aThvIVmpdQscMcJOElXXIgAAAVU"]
[Wed Dec 10 02:49:06.378074 2025] [:error] [pid 2277:tid 2291] [client 4.189.125.63:57703] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aThvIoWGo731r6eS-w58HQAAAAk"]
[Wed Dec 10 02:49:06.643431 2025] [:error] [pid 37041:tid 37063] [client 4.189.125.63:58853] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aThvIruffDW8UzBwa1bRHQAAAFQ"]
[Wed Dec 10 02:49:07.161906 2025] [:error] [pid 37041:tid 37045] [client 4.189.125.63:56769] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aThvI7uffDW8UzBwa1bRHwAAAEI"]
[Wed Dec 10 02:49:07.517892 2025] [:error] [pid 37041:tid 37056] [client 4.189.125.63:20484] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aThvI7uffDW8UzBwa1bRIQAAAE0"]
[Wed Dec 10 02:49:07.930345 2025] [:error] [pid 2277:tid 2288] [client 4.189.125.63:65426] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aThvI4WGo731r6eS-w58IQAAAAY"]
[Wed Dec 10 02:49:08.276798 2025] [:error] [pid 2366:tid 2389] [client 4.189.125.63:54256] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aThvJEAeBjkmsNRkd1OYXwAAANU"]
[Wed Dec 10 02:49:08.696399 2025] [:error] [pid 2277:tid 2293] [client 4.189.125.63:65421] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aThvJIWGo731r6eS-w58JAAAAAo"]
[Wed Dec 10 02:49:09.165149 2025] [:error] [pid 2277:tid 2296] [client 4.189.125.63:20526] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aThvJYWGo731r6eS-w58JQAAAA0"]
[Wed Dec 10 02:49:11.313746 2025] [:error] [pid 2277:tid 2291] [client 4.189.125.63:56799] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aThvJ4WGo731r6eS-w58KwAAAAk"]
[Wed Dec 10 02:49:11.684696 2025] [:error] [pid 2280:tid 2343] [client 4.189.125.63:54222] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aThvJ3cqIB-8ALgw4Zp8hQAAAIY"]
[Wed Dec 10 02:49:12.112324 2025] [:error] [pid 2366:tid 2389] [client 4.189.125.63:56776] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aThvKEAeBjkmsNRkd1OYawAAANU"]
[Wed Dec 10 02:49:12.431581 2025] [:error] [pid 37041:tid 37043] [client 4.189.125.63:62900] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aThvKLuffDW8UzBwa1bRKwAAAEA"]
[Wed Dec 10 02:49:12.821059 2025] [:error] [pid 2366:tid 2374] [client 4.189.125.63:55362] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geju.php"] [unique_id "aThvKEAeBjkmsNRkd1OYbQAAAMY"]
[Wed Dec 10 02:49:13.235165 2025] [:error] [pid 2366:tid 2369] [client 4.189.125.63:54221] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geju.php"] [unique_id "aThvKUAeBjkmsNRkd1OYcAAAAME"]
[Wed Dec 10 02:49:13.713514 2025] [:error] [pid 2277:tid 2303] [client 4.189.125.63:58478] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geju.php"] [unique_id "aThvKYWGo731r6eS-w58LgAAABQ"]
[Wed Dec 10 02:49:14.732455 2025] [:error] [pid 37041:tid 37064] [client 4.189.125.63:54236] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geju.php"] [unique_id "aThvKruffDW8UzBwa1bRNAAAAFU"]
[Wed Dec 10 02:49:15.186232 2025] [:error] [pid 2366:tid 2392] [client 4.189.125.63:62172] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aThvK0AeBjkmsNRkd1OYhgAAANg"]
[Wed Dec 10 02:49:15.609792 2025] [:error] [pid 2280:tid 2343] [client 4.189.125.63:65415] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aThvK3cqIB-8ALgw4Zp8kQAAAIY"]
[Wed Dec 10 02:49:16.070780 2025] [:error] [pid 2366:tid 2378] [client 4.189.125.63:54152] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aThvLEAeBjkmsNRkd1OYjwAAAMo"]
[Wed Dec 10 02:49:16.608459 2025] [:error] [pid 2280:tid 2337] [client 4.189.125.63:54212] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aThvLHcqIB-8ALgw4Zp8mwAAAIA"]
[Wed Dec 10 02:49:16.926401 2025] [:error] [pid 2277:tid 2284] [client 4.189.125.63:63980] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aThvLIWGo731r6eS-w58OQAAAAI"]
[Wed Dec 10 02:49:17.449018 2025] [:error] [pid 2366:tid 2391] [client 4.189.125.63:4719] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aThvLUAeBjkmsNRkd1OYnAAAANc"]
[Wed Dec 10 02:49:17.931619 2025] [:error] [pid 2277:tid 2297] [client 4.189.125.63:56800] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aThvLYWGo731r6eS-w58PQAAAA4"]
[Wed Dec 10 02:49:19.120412 2025] [:error] [pid 2366:tid 2373] [client 4.189.125.63:56824] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aThvL0AeBjkmsNRkd1OYogAAAMU"]
[Wed Dec 10 02:49:19.799695 2025] [:error] [pid 2277:tid 2293] [client 4.189.125.63:63943] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aThvL4WGo731r6eS-w58QQAAAAo"]
[Wed Dec 10 02:49:20.487496 2025] [:error] [pid 2366:tid 2383] [client 4.189.125.63:55396] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aThvMEAeBjkmsNRkd1OYpAAAAM8"]
[Wed Dec 10 02:49:20.996169 2025] [:error] [pid 37041:tid 37055] [client 4.189.125.63:63970] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aThvMLuffDW8UzBwa1bRRQAAAEw"]
[Wed Dec 10 02:49:21.391541 2025] [:error] [pid 2366:tid 2374] [client 4.189.125.63:63993] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aThvMUAeBjkmsNRkd1OYpgAAAMY"]
[Wed Dec 10 02:49:21.718272 2025] [:error] [pid 2277:tid 2295] [client 4.189.125.63:55386] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aThvMYWGo731r6eS-w58RQAAAAw"]
[Wed Dec 10 02:49:22.075539 2025] [:error] [pid 37041:tid 37052] [client 4.189.125.63:55022] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aThvMruffDW8UzBwa1bRRgAAAEk"]
[Wed Dec 10 02:49:22.861679 2025] [:error] [pid 2280:tid 2345] [client 4.189.125.63:63979] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aThvMncqIB-8ALgw4Zp8pAAAAIg"]
[Wed Dec 10 02:49:23.384249 2025] [:error] [pid 2366:tid 2380] [client 4.189.125.63:55033] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aThvM0AeBjkmsNRkd1OYqwAAAMw"]
[Wed Dec 10 02:49:23.878234 2025] [:error] [pid 2277:tid 2291] [client 4.189.125.63:63400] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aThvM4WGo731r6eS-w58RwAAAAk"]
[Wed Dec 10 02:49:24.209488 2025] [:error] [pid 37041:tid 37066] [client 4.189.125.63:63998] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aThvNLuffDW8UzBwa1bRTAAAAFc"]
[Wed Dec 10 02:49:24.602402 2025] [:error] [pid 37041:tid 37049] [client 4.189.125.63:58437] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aThvNLuffDW8UzBwa1bRTQAAAEY"]
[Wed Dec 10 02:49:25.056509 2025] [:error] [pid 2279:tid 2328] [client 4.189.125.63:4892] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aThvNVmpdQscMcJOElXXUAAAAVI"]
[Wed Dec 10 02:49:25.383640 2025] [:error] [pid 2366:tid 2377] [client 4.189.125.63:4708] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aThvNUAeBjkmsNRkd1OYsQAAAMk"]
[Wed Dec 10 02:49:25.885009 2025] [:error] [pid 37041:tid 37062] [client 4.189.125.63:63995] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aThvNbuffDW8UzBwa1bRUgAAAFM"]
[Wed Dec 10 02:49:27.719564 2025] [:error] [pid 2279:tid 2324] [client 4.189.125.63:62498] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aThvN1mpdQscMcJOElXXVwAAAU4"]
[Wed Dec 10 02:49:28.655032 2025] [:error] [pid 2366:tid 2380] [client 4.189.125.63:55029] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aThvOEAeBjkmsNRkd1OYtwAAAMw"]
[Wed Dec 10 02:49:29.225268 2025] [:error] [pid 2279:tid 2328] [client 4.189.125.63:62385] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aThvOVmpdQscMcJOElXXXAAAAVI"]
[Wed Dec 10 02:49:29.548283 2025] [:error] [pid 2277:tid 2294] [client 4.189.125.63:57605] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aThvOYWGo731r6eS-w58WgAAAAs"]
[Wed Dec 10 02:49:29.928140 2025] [:error] [pid 2366:tid 2382] [client 4.189.125.63:63382] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aThvOUAeBjkmsNRkd1OYuQAAAM4"]
[Wed Dec 10 02:49:30.353799 2025] [:error] [pid 37041:tid 37045] [client 4.189.125.63:62473] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aThvOruffDW8UzBwa1bRXAAAAEI"]
[Wed Dec 10 02:49:30.892840 2025] [:error] [pid 37041:tid 37056] [client 4.189.125.63:62619] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aThvOruffDW8UzBwa1bRXQAAAE0"]
[Wed Dec 10 02:49:31.314841 2025] [:error] [pid 2279:tid 2327] [client 4.189.125.63:62375] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aThvO1mpdQscMcJOElXXYAAAAVE"]
[Wed Dec 10 02:49:31.574579 2025] [:error] [pid 2277:tid 2300] [client 4.189.125.63:54179] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aThvO4WGo731r6eS-w58YwAAABE"]
[Wed Dec 10 02:49:31.973381 2025] [:error] [pid 2277:tid 2283] [client 4.189.125.63:63371] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aThvO4WGo731r6eS-w58ZwAAAAE"]
[Wed Dec 10 02:49:32.397337 2025] [:error] [pid 2279:tid 2315] [client 4.189.125.63:55030] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aThvPFmpdQscMcJOElXXYwAAAUU"]
[Wed Dec 10 02:49:33.278279 2025] [:error] [pid 2277:tid 2294] [client 4.189.125.63:62365] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aThvPYWGo731r6eS-w58bAAAAAs"]
[Wed Dec 10 02:49:33.596541 2025] [:error] [pid 2279:tid 2320] [client 4.189.125.63:62652] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aThvPVmpdQscMcJOElXXZgAAAUo"]
[Wed Dec 10 02:49:34.040909 2025] [:error] [pid 2277:tid 2306] [client 4.189.125.63:55005] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aThvPoWGo731r6eS-w58cAAAABc"]
[Wed Dec 10 02:49:34.376154 2025] [:error] [pid 2280:tid 2357] [client 4.189.125.63:4923] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aThvPncqIB-8ALgw4Zp8uAAAAJQ"]
[Wed Dec 10 02:49:35.211565 2025] [:error] [pid 2366:tid 2387] [client 4.189.125.63:4754] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aThvP0AeBjkmsNRkd1OYvgAAANM"]
[Wed Dec 10 02:49:35.571291 2025] [:error] [pid 37041:tid 37055] [client 4.189.125.63:4876] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aThvP7uffDW8UzBwa1bRaAAAAEw"]
[Wed Dec 10 02:49:35.880923 2025] [:error] [pid 37041:tid 37059] [client 4.189.125.63:54985] [client 4.189.125.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aThvP7uffDW8UzBwa1bRagAAAFA"]
[Wed Dec 10 02:49:37.145134 2025] [:error] [pid 2366:tid 2382] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Dec 10 02:49:37.263599 2025] [:error] [pid 2366:tid 2375] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Wed Dec 10 02:49:37.451337 2025] [:error] [pid 2366:tid 2389] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Wed Dec 10 02:49:37.594678 2025] [:error] [pid 2366:tid 2379] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php
[Wed Dec 10 02:49:37.747391 2025] [:error] [pid 2366:tid 2374] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 10 02:49:37.882743 2025] [:error] [pid 2366:tid 2369] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Dec 10 02:49:38.008599 2025] [:error] [pid 2366:tid 2377] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Dec 10 02:49:38.127232 2025] [:error] [pid 2366:tid 2368] [client 4.189.125.63:62381] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Dec 10 03:06:35.680164 2025] [:error] [pid 2366:tid 2384] [client 45.148.10.154:40142] [client 45.148.10.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aThzO0AeBjkmsNRkd1OlAwAAANA"]
[Wed Dec 10 06:59:00.429182 2025] [:error] [pid 16566:tid 16574] [client 185.238.231.2:38609] [client 185.238.231.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.2, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aTiptCEgzB1153EFuAbSMQAAAUY"]
[Wed Dec 10 06:59:00.433333 2025] [:error] [pid 16566:tid 16574] [client 185.238.231.2:38609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Dec 10 21:02:14.047699 2025] [:error] [pid 37062:tid 37072] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Wed Dec 10 21:02:14.180971 2025] [:error] [pid 37062:tid 37082] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/vbbn.php
[Wed Dec 10 21:02:14.394125 2025] [:error] [pid 37062:tid 37069] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Wed Dec 10 21:02:14.541928 2025] [:error] [pid 37062:tid 37088] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/fz.php
[Wed Dec 10 21:02:14.702792 2025] [:error] [pid 37062:tid 37067] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/wl.php
[Wed Dec 10 21:02:14.822320 2025] [:error] [pid 37062:tid 37080] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/sang.php
[Wed Dec 10 21:02:14.963132 2025] [:error] [pid 37062:tid 37078] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/0o0.php
[Wed Dec 10 21:02:15.081596 2025] [:error] [pid 37062:tid 37079] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/zxl.php
[Wed Dec 10 21:02:15.202319 2025] [:error] [pid 37062:tid 37070] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/dbc.php
[Wed Dec 10 21:02:15.319203 2025] [:error] [pid 37062:tid 37075] [client 4.189.145.111:16613] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Wed Dec 10 21:02:15.432639 2025] [:error] [pid 37062:tid 37084] [client 4.189.145.111:16613] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTlvVzB0I62HCw8Z5BRiDgAAABQ"]
[Wed Dec 10 21:02:15.806905 2025] [:error] [pid 36975:tid 37004] [client 4.189.145.111:16607] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTlvV9_ZNQ3zMmb38BFw3QAAAJg"]
[Wed Dec 10 21:02:16.108670 2025] [:error] [pid 36976:tid 37020] [client 4.189.145.111:16621] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTlvWCSpHW5KVaY9tJmwagAAAM0"]
[Wed Dec 10 21:02:16.460526 2025] [:error] [pid 36976:tid 37015] [client 4.189.145.111:16537] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aTlvWCSpHW5KVaY9tJmwawAAAMg"]
[Wed Dec 10 21:02:16.832256 2025] [:error] [pid 49095:tid 49113] [client 4.189.145.111:16605] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aTlvWMorr4Jt2Tfx_Eb39gAAAVA"]
[Wed Dec 10 21:02:17.271025 2025] [:error] [pid 36977:tid 37054] [client 4.189.145.111:16624] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aTlvWcc-JLl-uoL-Au7CXwAAAFQ"]
[Wed Dec 10 21:02:17.579801 2025] [:error] [pid 49095:tid 49117] [client 4.189.145.111:16542] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aTlvWcorr4Jt2Tfx_Eb39wAAAVQ"]
[Wed Dec 10 21:02:17.889930 2025] [:error] [pid 46868:tid 46894] [client 4.189.145.111:16525] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aTlvWY3NdlN2GOOyBjF9NQAAARg"]
[Wed Dec 10 21:02:18.251294 2025] [:error] [pid 46868:tid 46881] [client 4.189.145.111:16612] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTlvWo3NdlN2GOOyBjF9OQAAAQs"]
[Wed Dec 10 21:02:18.548571 2025] [:error] [pid 46868:tid 46890] [client 4.189.145.111:4042] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTlvWo3NdlN2GOOyBjF9OwAAARQ"]
[Wed Dec 10 21:02:18.963054 2025] [:error] [pid 49095:tid 49108] [client 4.189.145.111:4044] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTlvWsorr4Jt2Tfx_Eb3-wAAAUs"]
[Wed Dec 10 21:02:19.301327 2025] [:error] [pid 37062:tid 37067] [client 4.189.145.111:16596] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aTlvWzB0I62HCw8Z5BRiGQAAAAM"]
[Wed Dec 10 21:02:19.801833 2025] [:error] [pid 49095:tid 49112] [client 4.189.145.111:16516] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aTlvW8orr4Jt2Tfx_Eb4AAAAAU8"]
[Wed Dec 10 21:02:20.134328 2025] [:error] [pid 37062:tid 37085] [client 4.189.145.111:16584] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aTlvXDB0I62HCw8Z5BRiHQAAABU"]
[Wed Dec 10 21:02:20.550809 2025] [:error] [pid 36976:tid 37027] [client 4.189.145.111:16604] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aTlvXCSpHW5KVaY9tJmwfwAAANQ"]
[Wed Dec 10 21:02:20.936423 2025] [:error] [pid 36976:tid 37010] [client 4.189.145.111:16630] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aTlvXCSpHW5KVaY9tJmwgwAAAMM"]
[Wed Dec 10 21:02:21.340724 2025] [:error] [pid 36976:tid 37031] [client 4.189.145.111:16528] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aTlvXSSpHW5KVaY9tJmwiQAAANg"]
[Wed Dec 10 21:02:21.751408 2025] [:error] [pid 37062:tid 37065] [client 4.189.145.111:16589] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aTlvXTB0I62HCw8Z5BRiJQAAAAE"]
[Wed Dec 10 21:02:22.151625 2025] [:error] [pid 36976:tid 37030] [client 4.189.145.111:16632] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aTlvXiSpHW5KVaY9tJmwjgAAANc"]
[Wed Dec 10 21:02:22.691167 2025] [:error] [pid 46868:tid 46874] [client 4.189.145.111:16625] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aTlvXo3NdlN2GOOyBjF9SwAAAQQ"]
[Wed Dec 10 21:02:23.007910 2025] [:error] [pid 36976:tid 37019] [client 4.189.145.111:16538] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aTlvXySpHW5KVaY9tJmwmQAAAMw"]
[Wed Dec 10 21:02:23.276546 2025] [:error] [pid 37062:tid 37078] [client 4.189.145.111:16550] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aTlvXzB0I62HCw8Z5BRiLQAAAA4"]
[Wed Dec 10 21:02:26.887589 2025] [:error] [pid 46868:tid 46870] [client 4.189.145.111:16540] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aTlvYo3NdlN2GOOyBjF9XAAAAQA"]
[Wed Dec 10 21:02:27.351108 2025] [:error] [pid 36976:tid 37021] [client 4.189.145.111:16598] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aTlvYySpHW5KVaY9tJmwtAAAAM4"]
[Wed Dec 10 21:02:27.707242 2025] [:error] [pid 36976:tid 37026] [client 4.189.145.111:16577] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aTlvYySpHW5KVaY9tJmwvwAAANM"]
[Wed Dec 10 21:02:28.129041 2025] [:error] [pid 36976:tid 37009] [client 4.189.145.111:16514] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aTlvZCSpHW5KVaY9tJmwxwAAAMI"]
[Wed Dec 10 21:02:28.560840 2025] [:error] [pid 36975:tid 36985] [client 4.189.145.111:16610] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aTlvZN_ZNQ3zMmb38BFxBgAAAIU"]
[Wed Dec 10 21:02:28.891868 2025] [:error] [pid 49095:tid 49116] [client 4.189.145.111:4034] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aTlvZMorr4Jt2Tfx_Eb4SAAAAVM"]
[Wed Dec 10 21:02:29.219321 2025] [:error] [pid 36975:tid 36986] [client 4.189.145.111:16515] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTlvZd_ZNQ3zMmb38BFxBwAAAIY"]
[Wed Dec 10 21:02:29.608003 2025] [:error] [pid 37062:tid 37079] [client 4.189.145.111:16524] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTlvZTB0I62HCw8Z5BRiPQAAAA8"]
[Wed Dec 10 21:02:30.032446 2025] [:error] [pid 36975:tid 36990] [client 4.189.145.111:16635] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTlvZt_ZNQ3zMmb38BFxCAAAAIo"]
[Wed Dec 10 21:02:30.505725 2025] [:error] [pid 49095:tid 49102] [client 4.189.145.111:16638] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aTlvZsorr4Jt2Tfx_Eb4SQAAAUU"]
[Wed Dec 10 21:02:30.989330 2025] [:error] [pid 49095:tid 49098] [client 4.189.145.111:4074] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aTlvZsorr4Jt2Tfx_Eb4TAAAAUE"]
[Wed Dec 10 21:02:31.645044 2025] [:error] [pid 37062:tid 37066] [client 4.189.145.111:4068] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aTlvZzB0I62HCw8Z5BRiQgAAAAI"]
[Wed Dec 10 21:02:32.066073 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:16536] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aTlvaMc-JLl-uoL-Au7CdgAAAEU"]
[Wed Dec 10 21:02:32.733358 2025] [:error] [pid 36975:tid 36982] [client 4.189.145.111:16616] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aTlvaN_ZNQ3zMmb38BFxCgAAAII"]
[Wed Dec 10 21:02:33.059052 2025] [:error] [pid 36975:tid 36989] [client 4.189.145.111:16623] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aTlvad_ZNQ3zMmb38BFxCwAAAIk"]
[Wed Dec 10 21:02:33.653660 2025] [:error] [pid 49095:tid 49105] [client 4.189.145.111:16558] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aTlvacorr4Jt2Tfx_Eb4TgAAAUg"]
[Wed Dec 10 21:02:34.118771 2025] [:error] [pid 37062:tid 37082] [client 4.189.145.111:16614] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aTlvajB0I62HCw8Z5BRiRQAAABI"]
[Wed Dec 10 21:02:34.549251 2025] [:error] [pid 36975:tid 36991] [client 4.189.145.111:16519] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aTlvat_ZNQ3zMmb38BFxFgAAAIs"]
[Wed Dec 10 21:02:35.000643 2025] [:error] [pid 49095:tid 49114] [client 4.189.145.111:4035] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aTlvasorr4Jt2Tfx_Eb4XgAAAVE"]
[Wed Dec 10 21:02:35.398091 2025] [:error] [pid 49095:tid 49108] [client 4.189.145.111:16533] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aTlva8orr4Jt2Tfx_Eb4YwAAAUs"]
[Wed Dec 10 21:02:35.863813 2025] [:error] [pid 49095:tid 49100] [client 4.189.145.111:16593] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aTlva8orr4Jt2Tfx_Eb4agAAAUM"]
[Wed Dec 10 21:02:36.306771 2025] [:error] [pid 37062:tid 37078] [client 4.189.145.111:16521] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aTlvbDB0I62HCw8Z5BRiWAAAAA4"]
[Wed Dec 10 21:02:36.783252 2025] [:error] [pid 49095:tid 49116] [client 4.189.145.111:16590] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aTlvbMorr4Jt2Tfx_Eb4cQAAAVM"]
[Wed Dec 10 21:02:37.307640 2025] [:error] [pid 36976:tid 37007] [client 4.189.145.111:16603] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aTlvbSSpHW5KVaY9tJmwzwAAAMA"]
[Wed Dec 10 21:02:37.867603 2025] [:error] [pid 37062:tid 37065] [client 4.189.145.111:16541] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aTlvbTB0I62HCw8Z5BRiWwAAAAE"]
[Wed Dec 10 21:02:38.233046 2025] [:error] [pid 36976:tid 37022] [client 4.189.145.111:16580] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aTlvbiSpHW5KVaY9tJmw2AAAAM8"]
[Wed Dec 10 21:02:38.599379 2025] [:error] [pid 36975:tid 36999] [client 4.189.145.111:16620] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aTlvbt_ZNQ3zMmb38BFxIQAAAJM"]
[Wed Dec 10 21:02:38.900803 2025] [:error] [pid 36976:tid 37021] [client 4.189.145.111:4048] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aTlvbiSpHW5KVaY9tJmw3wAAAM4"]
[Wed Dec 10 21:02:39.354350 2025] [:error] [pid 46868:tid 46874] [client 4.189.145.111:4060] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aTlvb43NdlN2GOOyBjF9XgAAAQQ"]
[Wed Dec 10 21:02:39.790149 2025] [:error] [pid 46868:tid 46872] [client 4.189.145.111:16595] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aTlvb43NdlN2GOOyBjF9XwAAAQI"]
[Wed Dec 10 21:02:40.218046 2025] [:error] [pid 36976:tid 37029] [client 4.189.145.111:16592] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTlvcCSpHW5KVaY9tJmw6wAAANY"]
[Wed Dec 10 21:02:40.855831 2025] [:error] [pid 36976:tid 37009] [client 4.189.145.111:16636] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTlvcCSpHW5KVaY9tJmw8QAAAMI"]
[Wed Dec 10 21:02:41.152520 2025] [:error] [pid 36976:tid 37014] [client 4.189.145.111:16549] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTlvcSSpHW5KVaY9tJmw9QAAAMc"]
[Wed Dec 10 21:02:41.496856 2025] [:error] [pid 49095:tid 49111] [client 4.189.145.111:16629] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTlvccorr4Jt2Tfx_Eb4dQAAAU4"]
[Wed Dec 10 21:02:41.770489 2025] [:error] [pid 36976:tid 37013] [client 4.189.145.111:16527] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aTlvcSSpHW5KVaY9tJmw-wAAAMY"]
[Wed Dec 10 21:02:42.399998 2025] [:error] [pid 37062:tid 37067] [client 4.189.145.111:16513] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aTlvcjB0I62HCw8Z5BRiXQAAAAM"]
[Wed Dec 10 21:02:42.790153 2025] [:error] [pid 36975:tid 36986] [client 4.189.145.111:16583] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aTlvct_ZNQ3zMmb38BFxKQAAAIY"]
[Wed Dec 10 21:02:43.309589 2025] [:error] [pid 36977:tid 37047] [client 4.189.145.111:16556] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aTlvc8c-JLl-uoL-Au7CfQAAAE0"]
[Wed Dec 10 21:02:43.815370 2025] [:error] [pid 49095:tid 49113] [client 4.189.145.111:16579] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTlvc8orr4Jt2Tfx_Eb4eAAAAVA"]
[Wed Dec 10 21:02:44.215602 2025] [:error] [pid 36976:tid 37017] [client 4.189.145.111:16600] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTlvdCSpHW5KVaY9tJmxDwAAAMo"]
[Wed Dec 10 21:02:44.763581 2025] [:error] [pid 49095:tid 49112] [client 4.189.145.111:16546] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTlvdMorr4Jt2Tfx_Eb4egAAAU8"]
[Wed Dec 10 21:02:45.211480 2025] [:error] [pid 36976:tid 37025] [client 4.189.145.111:16608] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aTlvdSSpHW5KVaY9tJmxGAAAANI"]
[Wed Dec 10 21:02:45.732977 2025] [:error] [pid 49095:tid 49114] [client 4.189.145.111:16523] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTlvdcorr4Jt2Tfx_Eb4fAAAAVE"]
[Wed Dec 10 21:02:46.146842 2025] [:error] [pid 49095:tid 49115] [client 4.189.145.111:16615] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTlvdsorr4Jt2Tfx_Eb4fQAAAVI"]
[Wed Dec 10 21:02:46.649068 2025] [:error] [pid 49095:tid 49098] [client 4.189.145.111:16571] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTlvdsorr4Jt2Tfx_Eb4fgAAAUE"]
[Wed Dec 10 21:02:47.057535 2025] [:error] [pid 49095:tid 49107] [client 4.189.145.111:16601] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aTlvd8orr4Jt2Tfx_Eb4gAAAAUo"]
[Wed Dec 10 21:02:47.610947 2025] [:error] [pid 36976:tid 37010] [client 4.189.145.111:4080] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTlvdySpHW5KVaY9tJmxLAAAAMM"]
[Wed Dec 10 21:02:48.028436 2025] [:error] [pid 49095:tid 49108] [client 4.189.145.111:16639] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTlveMorr4Jt2Tfx_Eb4hAAAAUs"]
[Wed Dec 10 21:02:48.623664 2025] [:error] [pid 36975:tid 36981] [client 4.189.145.111:16609] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTlveN_ZNQ3zMmb38BFxLAAAAIE"]
[Wed Dec 10 21:02:48.886316 2025] [:error] [pid 37062:tid 37077] [client 4.189.145.111:4071] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aTlveDB0I62HCw8Z5BRiYAAAAA0"]
[Wed Dec 10 21:02:49.413406 2025] [:error] [pid 36977:tid 37054] [client 4.189.145.111:16532] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aTlvecc-JLl-uoL-Au7ChAAAAFQ"]
[Wed Dec 10 21:02:49.693695 2025] [:error] [pid 36977:tid 37044] [client 4.189.145.111:16531] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aTlvecc-JLl-uoL-Au7ChwAAAEo"]
[Wed Dec 10 21:02:50.101121 2025] [:error] [pid 36977:tid 37043] [client 4.189.145.111:16633] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aTlvesc-JLl-uoL-Au7CiQAAAEk"]
[Wed Dec 10 21:02:50.540028 2025] [:error] [pid 49095:tid 49099] [client 4.189.145.111:16517] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aTlvesorr4Jt2Tfx_Eb4hQAAAUI"]
[Wed Dec 10 21:02:50.990203 2025] [:error] [pid 46868:tid 46875] [client 4.189.145.111:16539] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aTlveo3NdlN2GOOyBjF9YQAAAQU"]
[Wed Dec 10 21:02:51.657833 2025] [:error] [pid 49095:tid 49113] [client 4.189.145.111:4036] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aTlve8orr4Jt2Tfx_Eb4iAAAAVA"]
[Wed Dec 10 21:02:52.132019 2025] [:error] [pid 36976:tid 37014] [client 4.189.145.111:16637] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aTlvfCSpHW5KVaY9tJmxNgAAAMc"]
[Wed Dec 10 21:02:52.642876 2025] [:error] [pid 36975:tid 36986] [client 4.189.145.111:16631] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aTlvfN_ZNQ3zMmb38BFxMQAAAIY"]
[Wed Dec 10 21:02:53.001772 2025] [:error] [pid 36975:tid 37001] [client 4.189.145.111:4062] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlvfd_ZNQ3zMmb38BFxMgAAAJU"]
[Wed Dec 10 21:02:53.355645 2025] [:error] [pid 46868:tid 46892] [client 4.189.145.111:16530] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlvfY3NdlN2GOOyBjF9ZAAAARY"]
[Wed Dec 10 21:02:53.623789 2025] [:error] [pid 36975:tid 36987] [client 4.189.145.111:16565] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlvfd_ZNQ3zMmb38BFxNQAAAIc"]
[Wed Dec 10 21:02:53.956089 2025] [:error] [pid 49095:tid 49102] [client 4.189.145.111:16562] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlvfcorr4Jt2Tfx_Eb4iQAAAUU"]
[Wed Dec 10 21:02:54.301504 2025] [:error] [pid 36976:tid 37030] [client 4.189.145.111:16619] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aTlvfiSpHW5KVaY9tJmxNwAAANc"]
[Wed Dec 10 21:02:54.744698 2025] [:error] [pid 49095:tid 49109] [client 4.189.145.111:3976] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aTlvfsorr4Jt2Tfx_Eb4iwAAAUw"]
[Wed Dec 10 21:02:55.048149 2025] [:error] [pid 46868:tid 46871] [client 4.189.145.111:16599] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aTlvf43NdlN2GOOyBjF9ZQAAAQE"]
[Wed Dec 10 21:02:55.317444 2025] [:error] [pid 49095:tid 49115] [client 4.189.145.111:16611] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aTlvf8orr4Jt2Tfx_Eb4jQAAAVI"]
[Wed Dec 10 21:02:55.556798 2025] [:error] [pid 49095:tid 49110] [client 4.189.145.111:16547] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTlvf8orr4Jt2Tfx_Eb4jgAAAU0"]
[Wed Dec 10 21:02:55.815020 2025] [:error] [pid 37062:tid 37068] [client 4.189.145.111:16569] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTlvfzB0I62HCw8Z5BRiYwAAAAQ"]
[Wed Dec 10 21:02:56.141870 2025] [:error] [pid 36976:tid 37017] [client 4.189.145.111:4083] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTlvgCSpHW5KVaY9tJmxOAAAAMo"]
[Wed Dec 10 21:02:56.459247 2025] [:error] [pid 37062:tid 37065] [client 4.189.145.111:16570] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTlvgDB0I62HCw8Z5BRiZAAAAAE"]
[Wed Dec 10 21:02:57.003995 2025] [:error] [pid 36975:tid 37003] [client 4.189.145.111:16634] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTlvgd_ZNQ3zMmb38BFxOQAAAJc"]
[Wed Dec 10 21:02:57.304314 2025] [:error] [pid 49095:tid 49108] [client 4.189.145.111:16529] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTlvgcorr4Jt2Tfx_Eb4kQAAAUs"]
[Wed Dec 10 21:02:57.589397 2025] [:error] [pid 37062:tid 37082] [client 4.189.145.111:4032] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTlvgTB0I62HCw8Z5BRiZwAAABI"]
[Wed Dec 10 21:02:57.978052 2025] [:error] [pid 36976:tid 37024] [client 4.189.145.111:16554] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTlvgSSpHW5KVaY9tJmxOgAAANE"]
[Wed Dec 10 21:02:58.708730 2025] [:error] [pid 37062:tid 37072] [client 4.189.145.111:3975] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTlvgjB0I62HCw8Z5BRiaQAAAAg"]
[Wed Dec 10 21:02:59.021714 2025] [:error] [pid 49095:tid 49111] [client 4.189.145.111:4077] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTlvg8orr4Jt2Tfx_Eb4lAAAAU4"]
[Wed Dec 10 21:02:59.335425 2025] [:error] [pid 49095:tid 49100] [client 4.189.145.111:4046] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTlvg8orr4Jt2Tfx_Eb4lQAAAUM"]
[Wed Dec 10 21:02:59.628105 2025] [:error] [pid 37062:tid 37087] [client 4.189.145.111:16586] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aTlvgzB0I62HCw8Z5BRiagAAABc"]
[Wed Dec 10 21:02:59.954923 2025] [:error] [pid 46868:tid 46890] [client 4.189.145.111:4067] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aTlvg43NdlN2GOOyBjF9aAAAARQ"]
[Wed Dec 10 21:03:00.713525 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:16618] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aTlvhMc-JLl-uoL-Au7CkAAAAEU"]
[Wed Dec 10 21:03:01.047569 2025] [:error] [pid 49095:tid 49099] [client 4.189.145.111:3925] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aTlvhcorr4Jt2Tfx_Eb4lwAAAUI"]
[Wed Dec 10 21:03:01.399393 2025] [:error] [pid 49095:tid 49104] [client 4.189.145.111:3977] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aTlvhcorr4Jt2Tfx_Eb4mAAAAUc"]
[Wed Dec 10 21:03:01.717188 2025] [:error] [pid 37062:tid 37088] [client 4.189.145.111:16566] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTlvhTB0I62HCw8Z5BRibwAAABg"]
[Wed Dec 10 21:03:02.099322 2025] [:error] [pid 36975:tid 36980] [client 4.189.145.111:16555] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTlvht_ZNQ3zMmb38BFxWAAAAIA"]
[Wed Dec 10 21:03:02.481178 2025] [:error] [pid 36976:tid 37012] [client 4.189.145.111:4053] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTlvhiSpHW5KVaY9tJmxQgAAAMU"]
[Wed Dec 10 21:03:02.731483 2025] [:error] [pid 49095:tid 49098] [client 4.189.145.111:16551] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTlvhsorr4Jt2Tfx_Eb4owAAAUE"]
[Wed Dec 10 21:03:03.326596 2025] [:error] [pid 36976:tid 37009] [client 4.189.145.111:16534] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTlvhySpHW5KVaY9tJmxRQAAAMI"]
[Wed Dec 10 21:03:03.666280 2025] [:error] [pid 36976:tid 37029] [client 4.189.145.111:4038] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTlvhySpHW5KVaY9tJmxSAAAANY"]
[Wed Dec 10 21:03:03.983722 2025] [:error] [pid 36975:tid 36999] [client 4.189.145.111:16626] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTlvh9_ZNQ3zMmb38BFxXwAAAJM"]
[Wed Dec 10 21:03:04.261032 2025] [:error] [pid 46868:tid 46883] [client 4.189.145.111:4033] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTlviI3NdlN2GOOyBjF9ewAAAQ0"]
[Wed Dec 10 21:03:04.569158 2025] [:error] [pid 36977:tid 37037] [client 4.189.145.111:3968] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlviMc-JLl-uoL-Au7ClAAAAEM"]
[Wed Dec 10 21:03:04.955688 2025] [:error] [pid 36976:tid 37014] [client 4.189.145.111:16575] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlviCSpHW5KVaY9tJmxSgAAAMc"]
[Wed Dec 10 21:03:05.387122 2025] [:error] [pid 36977:tid 37057] [client 4.189.145.111:16559] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlvicc-JLl-uoL-Au7ClQAAAFc"]
[Wed Dec 10 21:03:05.860590 2025] [:error] [pid 36975:tid 36991] [client 4.189.145.111:4086] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlvid_ZNQ3zMmb38BFxYAAAAIs"]
[Wed Dec 10 21:03:06.427585 2025] [:error] [pid 36976:tid 37018] [client 4.189.145.111:16548] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aTlviiSpHW5KVaY9tJmxSwAAAMs"]
[Wed Dec 10 21:03:06.727853 2025] [:error] [pid 36976:tid 37023] [client 4.189.145.111:3988] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlviiSpHW5KVaY9tJmxTAAAANA"]
[Wed Dec 10 21:03:07.223740 2025] [:error] [pid 36977:tid 37036] [client 4.189.145.111:16512] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlvi8c-JLl-uoL-Au7ClwAAAEI"]
[Wed Dec 10 21:03:07.549898 2025] [:error] [pid 36977:tid 37047] [client 4.189.145.111:4063] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlvi8c-JLl-uoL-Au7CmQAAAE0"]
[Wed Dec 10 21:03:07.856423 2025] [:error] [pid 49095:tid 49121] [client 4.189.145.111:16526] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aTlvi8orr4Jt2Tfx_Eb4pwAAAVg"]
[Wed Dec 10 21:03:08.193565 2025] [:error] [pid 36976:tid 37017] [client 4.189.145.111:16573] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aTlvjCSpHW5KVaY9tJmxTQAAAMo"]
[Wed Dec 10 21:03:08.492190 2025] [:error] [pid 49095:tid 49104] [client 4.189.145.111:3974] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aTlvjMorr4Jt2Tfx_Eb4qAAAAUc"]
[Wed Dec 10 21:03:08.895251 2025] [:error] [pid 46868:tid 46878] [client 4.189.145.111:16617] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aTlvjI3NdlN2GOOyBjF9fwAAAQg"]
[Wed Dec 10 21:03:09.728328 2025] [:error] [pid 46868:tid 46881] [client 4.189.145.111:4039] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aTlvjY3NdlN2GOOyBjF9ggAAAQs"]
[Wed Dec 10 21:03:10.019452 2025] [:error] [pid 36977:tid 37054] [client 4.189.145.111:16545] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvjsc-JLl-uoL-Au7CmwAAAFQ"]
[Wed Dec 10 21:03:11.000035 2025] [:error] [pid 36975:tid 37002] [client 4.189.145.111:16602] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvjt_ZNQ3zMmb38BFxaQAAAJY"]
[Wed Dec 10 21:03:11.276037 2025] [:error] [pid 49095:tid 49102] [client 4.189.145.111:4041] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvj8orr4Jt2Tfx_Eb4rgAAAUU"]
[Wed Dec 10 21:03:11.651049 2025] [:error] [pid 36976:tid 37010] [client 4.189.145.111:4002] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvjySpHW5KVaY9tJmxUQAAAMM"]
[Wed Dec 10 21:03:11.925821 2025] [:error] [pid 36976:tid 37026] [client 4.189.145.111:4092] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aTlvjySpHW5KVaY9tJmxUgAAANM"]
[Wed Dec 10 21:03:12.361305 2025] [:error] [pid 36976:tid 37025] [client 4.189.145.111:4045] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aTlvkCSpHW5KVaY9tJmxVAAAANI"]
[Wed Dec 10 21:03:12.704581 2025] [:error] [pid 36977:tid 37044] [client 4.189.145.111:4076] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aTlvkMc-JLl-uoL-Au7CnQAAAEo"]
[Wed Dec 10 21:03:12.953168 2025] [:error] [pid 36975:tid 36991] [client 4.189.145.111:4066] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aTlvkN_ZNQ3zMmb38BFxagAAAIs"]
[Wed Dec 10 21:03:13.253562 2025] [:error] [pid 37062:tid 37071] [client 4.189.145.111:16564] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aTlvkTB0I62HCw8Z5BRieQAAAAc"]
[Wed Dec 10 21:03:13.587443 2025] [:error] [pid 37062:tid 37080] [client 4.189.145.111:16553] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aTlvkTB0I62HCw8Z5BRiegAAABA"]
[Wed Dec 10 21:03:13.918682 2025] [:error] [pid 37062:tid 37084] [client 4.189.145.111:3985] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aTlvkTB0I62HCw8Z5BRifQAAABQ"]
[Wed Dec 10 21:03:14.320419 2025] [:error] [pid 46868:tid 46887] [client 4.189.145.111:4069] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aTlvko3NdlN2GOOyBjF9hQAAARE"]
[Wed Dec 10 21:03:14.805643 2025] [:error] [pid 37062:tid 37064] [client 4.189.145.111:16627] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTlvkjB0I62HCw8Z5BRifwAAAAA"]
[Wed Dec 10 21:03:15.628001 2025] [:error] [pid 36976:tid 37009] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Dec 10 21:03:15.749875 2025] [:error] [pid 36976:tid 37028] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Dec 10 21:03:16.011882 2025] [:error] [pid 36976:tid 37029] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 10 21:03:16.289169 2025] [:error] [pid 36976:tid 37014] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Dec 10 21:03:16.406753 2025] [:error] [pid 36976:tid 37018] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Dec 10 21:03:16.533369 2025] [:error] [pid 36976:tid 37030] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Dec 10 21:03:16.656679 2025] [:error] [pid 36976:tid 37023] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Dec 10 21:03:16.789422 2025] [:error] [pid 36976:tid 37016] [client 4.189.145.111:4057] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Dec 10 21:03:17.036056 2025] [:error] [pid 36976:tid 37011] [client 4.189.145.111:4057] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTlvlSSpHW5KVaY9tJmxYgAAAMQ"]
[Wed Dec 10 21:03:17.389741 2025] [:error] [pid 36975:tid 36984] [client 4.189.145.111:4010] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTlvld_ZNQ3zMmb38BFxbwAAAIQ"]
[Wed Dec 10 21:03:17.664341 2025] [:error] [pid 36975:tid 36987] [client 4.189.145.111:16560] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTlvld_ZNQ3zMmb38BFxcQAAAIc"]
[Wed Dec 10 21:03:17.909663 2025] [:error] [pid 46868:tid 46890] [client 4.189.145.111:16582] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTlvlY3NdlN2GOOyBjF9hwAAARQ"]
[Wed Dec 10 21:03:18.285815 2025] [:error] [pid 49095:tid 49103] [client 4.189.145.111:4022] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTlvlsorr4Jt2Tfx_Eb4sQAAAUY"]
[Wed Dec 10 21:03:18.615167 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:3928] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTlvlsc-JLl-uoL-Au7CoAAAAEU"]
[Wed Dec 10 21:03:19.051848 2025] [:error] [pid 36976:tid 37015] [client 4.189.145.111:16622] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTlvlySpHW5KVaY9tJmxYwAAAMg"]
[Wed Dec 10 21:03:19.411332 2025] [:error] [pid 36977:tid 37043] [client 4.189.145.111:16594] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTlvl8c-JLl-uoL-Au7CoQAAAEk"]
[Wed Dec 10 21:03:19.741244 2025] [:error] [pid 36977:tid 37049] [client 4.189.145.111:16587] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTlvl8c-JLl-uoL-Au7CogAAAE8"]
[Wed Dec 10 21:03:19.989489 2025] [:error] [pid 46868:tid 46872] [client 4.189.145.111:4037] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTlvl43NdlN2GOOyBjF9iAAAAQI"]
[Wed Dec 10 21:03:20.396204 2025] [:error] [pid 36977:tid 37057] [client 4.189.145.111:16606] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTlvmMc-JLl-uoL-Au7CpgAAAFc"]
[Wed Dec 10 21:03:20.655850 2025] [:error] [pid 36977:tid 37036] [client 4.189.145.111:16581] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTlvmMc-JLl-uoL-Au7CpwAAAEI"]
[Wed Dec 10 21:03:20.985878 2025] [:error] [pid 36977:tid 37045] [client 4.189.145.111:3984] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTlvmMc-JLl-uoL-Au7CqAAAAEs"]
[Wed Dec 10 21:03:21.351359 2025] [:error] [pid 36977:tid 37035] [client 4.189.145.111:4079] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTlvmcc-JLl-uoL-Au7CqQAAAEE"]
[Wed Dec 10 21:03:21.778466 2025] [:error] [pid 37062:tid 37068] [client 4.189.145.111:4012] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTlvmTB0I62HCw8Z5BRihAAAAAQ"]
[Wed Dec 10 21:03:22.213884 2025] [:error] [pid 36975:tid 37000] [client 4.189.145.111:16544] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aTlvmt_ZNQ3zMmb38BFxdQAAAJQ"]
[Wed Dec 10 21:03:22.667906 2025] [:error] [pid 37062:tid 37065] [client 4.189.145.111:16535] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aTlvmjB0I62HCw8Z5BRihQAAAAE"]
[Wed Dec 10 21:03:22.963975 2025] [:error] [pid 36975:tid 37002] [client 4.189.145.111:4040] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aTlvmt_ZNQ3zMmb38BFxdgAAAJY"]
[Wed Dec 10 21:03:23.364412 2025] [:error] [pid 46868:tid 46880] [client 4.189.145.111:4061] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aTlvm43NdlN2GOOyBjF9igAAAQo"]
[Wed Dec 10 21:03:23.728325 2025] [:error] [pid 49095:tid 49111] [client 4.189.145.111:16522] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aTlvm8orr4Jt2Tfx_Eb4tQAAAU4"]
[Wed Dec 10 21:03:24.047920 2025] [:error] [pid 37062:tid 37074] [client 4.189.145.111:3992] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTlvnDB0I62HCw8Z5BRiiAAAAAo"]
[Wed Dec 10 21:03:24.356674 2025] [:error] [pid 36975:tid 36981] [client 4.189.145.111:16543] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTlvnN_ZNQ3zMmb38BFxdwAAAIE"]
[Wed Dec 10 21:03:24.833655 2025] [:error] [pid 36975:tid 36991] [client 4.189.145.111:16591] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTlvnN_ZNQ3zMmb38BFxeAAAAIs"]
[Wed Dec 10 21:03:25.388621 2025] [:error] [pid 36976:tid 37020] [client 4.189.145.111:16572] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTlvnSSpHW5KVaY9tJmxZQAAAM0"]
[Wed Dec 10 21:03:25.767924 2025] [:error] [pid 37062:tid 37071] [client 4.189.145.111:4075] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvnTB0I62HCw8Z5BRiigAAAAc"]
[Wed Dec 10 21:03:26.111187 2025] [:error] [pid 36976:tid 37010] [client 4.189.145.111:4006] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvniSpHW5KVaY9tJmxZgAAAMM"]
[Wed Dec 10 21:03:26.548197 2025] [:error] [pid 36976:tid 37026] [client 4.189.145.111:3908] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvniSpHW5KVaY9tJmxZwAAANM"]
[Wed Dec 10 21:03:27.251246 2025] [:error] [pid 37062:tid 37075] [client 4.189.145.111:16574] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aTlvnzB0I62HCw8Z5BRiiwAAAAs"]
[Wed Dec 10 21:03:27.592797 2025] [:error] [pid 36977:tid 37040] [client 4.189.145.111:3990] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aTlvn8c-JLl-uoL-Au7CrgAAAEY"]
[Wed Dec 10 21:03:28.108678 2025] [:error] [pid 37062:tid 37088] [client 4.189.145.111:16557] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aTlvoDB0I62HCw8Z5BRijgAAABg"]
[Wed Dec 10 21:03:28.464571 2025] [:error] [pid 36977:tid 37046] [client 4.189.145.111:4082] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aTlvoMc-JLl-uoL-Au7CsQAAAEw"]
[Wed Dec 10 21:03:28.944905 2025] [:error] [pid 36977:tid 37036] [client 4.189.145.111:16585] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aTlvoMc-JLl-uoL-Au7CsgAAAEI"]
[Wed Dec 10 21:03:29.256098 2025] [:error] [pid 36976:tid 37019] [client 4.189.145.111:3989] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTlvoSSpHW5KVaY9tJmxaAAAAMw"]
[Wed Dec 10 21:03:29.595878 2025] [:error] [pid 36975:tid 36983] [client 4.189.145.111:3970] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTlvod_ZNQ3zMmb38BFxfwAAAIM"]
[Wed Dec 10 21:03:29.909017 2025] [:error] [pid 36975:tid 36982] [client 4.189.145.111:4008] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTlvod_ZNQ3zMmb38BFxgAAAAII"]
[Wed Dec 10 21:03:30.241796 2025] [:error] [pid 37062:tid 37083] [client 4.189.145.111:4093] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTlvojB0I62HCw8Z5BRikQAAABM"]
[Wed Dec 10 21:03:30.635317 2025] [:error] [pid 36976:tid 37012] [client 4.189.145.111:3983] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aTlvoiSpHW5KVaY9tJmxaQAAAMU"]
[Wed Dec 10 21:03:30.936242 2025] [:error] [pid 36976:tid 37008] [client 4.189.145.111:16568] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aTlvoiSpHW5KVaY9tJmxawAAAME"]
[Wed Dec 10 21:03:31.301867 2025] [:error] [pid 36976:tid 37028] [client 4.189.145.111:16552] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aTlvoySpHW5KVaY9tJmxbQAAANU"]
[Wed Dec 10 21:03:31.610359 2025] [:error] [pid 36975:tid 36999] [client 4.189.145.111:3981] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aTlvo9_ZNQ3zMmb38BFxhAAAAJM"]
[Wed Dec 10 21:03:32.137649 2025] [:error] [pid 36976:tid 37029] [client 4.189.145.111:4050] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTlvpCSpHW5KVaY9tJmxbwAAANY"]
[Wed Dec 10 21:03:32.501026 2025] [:error] [pid 49095:tid 49109] [client 4.189.145.111:4078] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTlvpMorr4Jt2Tfx_Eb4vgAAAUw"]
[Wed Dec 10 21:03:32.827024 2025] [:error] [pid 49095:tid 49114] [client 4.189.145.111:4011] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTlvpMorr4Jt2Tfx_Eb4wAAAAVE"]
[Wed Dec 10 21:03:33.120651 2025] [:error] [pid 36975:tid 37000] [client 4.189.145.111:4065] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTlvpd_ZNQ3zMmb38BFxhgAAAJQ"]
[Wed Dec 10 21:03:33.479150 2025] [:error] [pid 46868:tid 46889] [client 4.189.145.111:4070] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTlvpY3NdlN2GOOyBjF9jQAAARM"]
[Wed Dec 10 21:03:33.847644 2025] [:error] [pid 36976:tid 37021] [client 4.189.145.111:3979] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTlvpSSpHW5KVaY9tJmxcQAAAM4"]
[Wed Dec 10 21:03:34.242358 2025] [:error] [pid 36975:tid 36981] [client 4.189.145.111:4003] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTlvpt_ZNQ3zMmb38BFxiQAAAIE"]
[Wed Dec 10 21:03:34.614997 2025] [:error] [pid 36977:tid 37047] [client 4.189.145.111:3905] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aTlvpsc-JLl-uoL-Au7CtAAAAE0"]
[Wed Dec 10 21:03:35.105453 2025] [:error] [pid 36976:tid 37011] [client 4.189.145.111:4030] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTlvpySpHW5KVaY9tJmxdAAAAMQ"]
[Wed Dec 10 21:03:35.520954 2025] [:error] [pid 36976:tid 37015] [client 4.189.145.111:3993] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTlvpySpHW5KVaY9tJmxdQAAAMg"]
[Wed Dec 10 21:03:35.839529 2025] [:error] [pid 36977:tid 37034] [client 4.189.145.111:4001] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTlvp8c-JLl-uoL-Au7CtQAAAEA"]
[Wed Dec 10 21:03:36.159480 2025] [:error] [pid 36977:tid 37037] [client 4.189.145.111:4013] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTlvqMc-JLl-uoL-Au7CtgAAAEM"]
[Wed Dec 10 21:03:36.625962 2025] [:error] [pid 49095:tid 49105] [client 4.189.145.111:4009] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTlvqMorr4Jt2Tfx_Eb4xAAAAUg"]
[Wed Dec 10 21:03:37.136705 2025] [:error] [pid 49095:tid 49107] [client 4.189.145.111:3926] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTlvqcorr4Jt2Tfx_Eb4xgAAAUo"]
[Wed Dec 10 21:03:37.830877 2025] [:error] [pid 36976:tid 37010] [client 4.189.145.111:4027] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTlvqSSpHW5KVaY9tJmxdgAAAMM"]
[Wed Dec 10 21:03:38.354466 2025] [:error] [pid 36975:tid 36980] [client 4.189.145.111:3912] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aTlvqt_ZNQ3zMmb38BFxjwAAAIA"]
[Wed Dec 10 21:03:38.976371 2025] [:error] [pid 49095:tid 49111] [client 4.189.145.111:4058] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aTlvqsorr4Jt2Tfx_Eb4yQAAAU4"]
[Wed Dec 10 21:03:39.407620 2025] [:error] [pid 36976:tid 37019] [client 4.189.145.111:3932] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aTlvqySpHW5KVaY9tJmxdwAAAMw"]
[Wed Dec 10 21:03:39.689619 2025] [:error] [pid 37062:tid 37072] [client 4.189.145.111:4095] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aTlvqzB0I62HCw8Z5BRilAAAAAg"]
[Wed Dec 10 21:03:39.961221 2025] [:error] [pid 36977:tid 37052] [client 4.189.145.111:3939] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aTlvq8c-JLl-uoL-Au7CtwAAAFI"]
[Wed Dec 10 21:03:40.257431 2025] [:error] [pid 37062:tid 37074] [client 4.189.145.111:3927] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTlvrDB0I62HCw8Z5BRilQAAAAo"]
[Wed Dec 10 21:03:40.639960 2025] [:error] [pid 36975:tid 36987] [client 4.189.145.111:4088] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTlvrN_ZNQ3zMmb38BFxkAAAAIc"]
[Wed Dec 10 21:03:40.916148 2025] [:error] [pid 37062:tid 37076] [client 4.189.145.111:4028] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTlvrDB0I62HCw8Z5BRilwAAAAw"]
[Wed Dec 10 21:03:41.376235 2025] [:error] [pid 37062:tid 37080] [client 4.189.145.111:3864] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTlvrTB0I62HCw8Z5BRimAAAABA"]
[Wed Dec 10 21:03:41.731231 2025] [:error] [pid 36977:tid 37041] [client 4.189.145.111:4049] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aTlvrcc-JLl-uoL-Au7CuQAAAEc"]
[Wed Dec 10 21:03:42.315942 2025] [:error] [pid 36977:tid 37056] [client 4.189.145.111:3850] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aTlvrsc-JLl-uoL-Au7CuwAAAFY"]
[Wed Dec 10 21:03:42.691003 2025] [:error] [pid 37062:tid 37088] [client 4.189.145.111:4064] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aTlvrjB0I62HCw8Z5BRinAAAABg"]
[Wed Dec 10 21:03:43.031419 2025] [:error] [pid 46868:tid 46881] [client 4.189.145.111:4059] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aTlvr43NdlN2GOOyBjF9jgAAAQs"]
[Wed Dec 10 21:03:43.438999 2025] [:error] [pid 36977:tid 37044] [client 4.189.145.111:3945] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTlvr8c-JLl-uoL-Au7CvgAAAEo"]
[Wed Dec 10 21:03:43.765607 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:4025] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTlvr8c-JLl-uoL-Au7CvwAAAEU"]
[Wed Dec 10 21:03:44.110616 2025] [:error] [pid 46868:tid 46884] [client 4.189.145.111:3972] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTlvsI3NdlN2GOOyBjF9kgAAAQ4"]
[Wed Dec 10 21:03:44.566919 2025] [:error] [pid 37062:tid 37083] [client 4.189.145.111:16567] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aTlvsDB0I62HCw8Z5BRinQAAABM"]
[Wed Dec 10 21:03:45.120368 2025] [:error] [pid 36976:tid 37008] [client 4.189.145.111:4055] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aTlvsSSpHW5KVaY9tJmxeAAAAME"]
[Wed Dec 10 21:03:45.653365 2025] [:error] [pid 49095:tid 49099] [client 4.189.145.111:3956] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aTlvscorr4Jt2Tfx_Eb4ywAAAUI"]
[Wed Dec 10 21:03:46.111879 2025] [:error] [pid 37062:tid 37067] [client 4.189.145.111:4051] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aTlvsjB0I62HCw8Z5BRioAAAAAM"]
[Wed Dec 10 21:03:46.472828 2025] [:error] [pid 36977:tid 37048] [client 4.189.145.111:4089] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aTlvssc-JLl-uoL-Au7CwQAAAE4"]
[Wed Dec 10 21:03:46.970055 2025] [:error] [pid 37062:tid 37078] [client 4.189.145.111:3991] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aTlvsjB0I62HCw8Z5BRiowAAAA4"]
[Wed Dec 10 21:03:47.388348 2025] [:error] [pid 37062:tid 37087] [client 4.189.145.111:4087] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aTlvszB0I62HCw8Z5BRipAAAABc"]
[Wed Dec 10 21:03:48.254636 2025] [:error] [pid 46868:tid 46888] [client 4.189.145.111:3918] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aTlvtI3NdlN2GOOyBjF9lgAAARI"]
[Wed Dec 10 21:03:48.705346 2025] [:error] [pid 36976:tid 37016] [client 4.189.145.111:3946] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aTlvtCSpHW5KVaY9tJmxfQAAAMk"]
[Wed Dec 10 21:03:49.079148 2025] [:error] [pid 46868:tid 46885] [client 4.189.145.111:3987] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aTlvtY3NdlN2GOOyBjF9lwAAAQ8"]
[Wed Dec 10 21:03:49.720797 2025] [:error] [pid 36977:tid 37055] [client 4.189.145.111:4047] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aTlvtcc-JLl-uoL-Au7CxgAAAFU"]
[Wed Dec 10 21:03:50.038469 2025] [:error] [pid 37062:tid 37080] [client 4.189.145.111:4014] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aTlvtjB0I62HCw8Z5BRiqQAAABA"]
[Wed Dec 10 21:03:50.499143 2025] [:error] [pid 37062:tid 37075] [client 4.189.145.111:4081] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aTlvtjB0I62HCw8Z5BRiqgAAAAs"]
[Wed Dec 10 21:03:50.968123 2025] [:error] [pid 36977:tid 37052] [client 4.189.145.111:3847] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTlvtsc-JLl-uoL-Au7CygAAAFI"]
[Wed Dec 10 21:03:51.382929 2025] [:error] [pid 36977:tid 37056] [client 4.189.145.111:3964] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTlvt8c-JLl-uoL-Au7CywAAAFY"]
[Wed Dec 10 21:03:51.788587 2025] [:error] [pid 46868:tid 46872] [client 4.189.145.111:4043] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTlvt43NdlN2GOOyBjF9mQAAAQI"]
[Wed Dec 10 21:03:52.398356 2025] [:error] [pid 36975:tid 36994] [client 4.189.145.111:3913] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTlvuN_ZNQ3zMmb38BFxmQAAAI4"]
[Wed Dec 10 21:03:53.178461 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:3980] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aTlvucc-JLl-uoL-Au7CzgAAAEU"]
[Wed Dec 10 21:03:53.795658 2025] [:error] [pid 36977:tid 37049] [client 4.189.145.111:3916] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aTlvucc-JLl-uoL-Au7CzwAAAE8"]
[Wed Dec 10 21:03:54.828417 2025] [:error] [pid 46868:tid 46878] [client 4.189.145.111:4094] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aTlvuo3NdlN2GOOyBjF9nQAAAQg"]
[Wed Dec 10 21:03:55.297283 2025] [:error] [pid 36975:tid 36997] [client 4.189.145.111:16520] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aTlvu9_ZNQ3zMmb38BFxnAAAAJE"]
[Wed Dec 10 21:03:55.888689 2025] [:error] [pid 37062:tid 37083] [client 4.189.145.111:3911] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTlvuzB0I62HCw8Z5BRirAAAABM"]
[Wed Dec 10 21:03:56.392626 2025] [:error] [pid 46868:tid 46875] [client 4.189.145.111:3937] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTlvvI3NdlN2GOOyBjF9nwAAAQU"]
[Wed Dec 10 21:03:57.579117 2025] [:error] [pid 49095:tid 49098] [client 4.189.145.111:3857] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTlvvcorr4Jt2Tfx_Eb4zgAAAUE"]
[Wed Dec 10 21:03:58.238264 2025] [:error] [pid 36976:tid 37012] [client 4.189.145.111:3920] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTlvviSpHW5KVaY9tJmxiAAAAMU"]
[Wed Dec 10 21:03:59.148622 2025] [:error] [pid 49095:tid 49115] [client 4.189.145.111:4091] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aTlvv8orr4Jt2Tfx_Eb48AAAAVI"]
[Wed Dec 10 21:04:00.079488 2025] [:error] [pid 49095:tid 49097] [client 4.189.145.111:3971] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aTlvwMorr4Jt2Tfx_Eb48wAAAUA"]
[Wed Dec 10 21:04:00.953258 2025] [:error] [pid 36976:tid 37026] [client 4.189.145.111:16597] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aTlvwCSpHW5KVaY9tJmxjQAAANM"]
[Wed Dec 10 21:04:01.805963 2025] [:error] [pid 46868:tid 46875] [client 4.189.145.111:16561] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aTlvwY3NdlN2GOOyBjF9sQAAAQU"]
[Wed Dec 10 21:04:02.897701 2025] [:error] [pid 36976:tid 37021] [client 4.189.145.111:3852] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aTlvwiSpHW5KVaY9tJmxjgAAAM4"]
[Wed Dec 10 21:04:03.850624 2025] [:error] [pid 36976:tid 37016] [client 4.189.145.111:4084] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTlvwySpHW5KVaY9tJmxjwAAAMk"]
[Wed Dec 10 21:04:04.709380 2025] [:error] [pid 36975:tid 36982] [client 4.189.145.111:3994] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTlvxN_ZNQ3zMmb38BFxngAAAII"]
[Wed Dec 10 21:04:05.354146 2025] [:error] [pid 49095:tid 49110] [client 4.189.145.111:4085] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTlvxcorr4Jt2Tfx_Eb4-AAAAU0"]
[Wed Dec 10 21:04:05.700830 2025] [:error] [pid 49095:tid 49114] [client 4.189.145.111:3969] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTlvxcorr4Jt2Tfx_Eb4-wAAAVE"]
[Wed Dec 10 21:04:05.991767 2025] [:error] [pid 36976:tid 37018] [client 4.189.145.111:3943] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTlvxSSpHW5KVaY9tJmxkAAAAMs"]
[Wed Dec 10 21:04:06.251260 2025] [:error] [pid 36976:tid 37017] [client 4.189.145.111:4031] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTlvxiSpHW5KVaY9tJmxkgAAAMo"]
[Wed Dec 10 21:04:06.516404 2025] [:error] [pid 36976:tid 37015] [client 4.189.145.111:3982] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTlvxiSpHW5KVaY9tJmxkwAAAMg"]
[Wed Dec 10 21:04:06.894178 2025] [:error] [pid 36976:tid 37007] [client 4.189.145.111:3872] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTlvxiSpHW5KVaY9tJmxlgAAAMA"]
[Wed Dec 10 21:04:07.281573 2025] [:error] [pid 36977:tid 37036] [client 4.189.145.111:3909] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTlvx8c-JLl-uoL-Au7C3wAAAEI"]
[Wed Dec 10 21:04:07.653229 2025] [:error] [pid 49095:tid 49097] [client 4.189.145.111:4090] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTlvx8orr4Jt2Tfx_Eb5AAAAAUA"]
[Wed Dec 10 21:04:07.979998 2025] [:error] [pid 49095:tid 49117] [client 4.189.145.111:3851] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTlvx8orr4Jt2Tfx_Eb5AQAAAVQ"]
[Wed Dec 10 21:04:08.369443 2025] [:error] [pid 46868:tid 46881] [client 4.189.145.111:3921] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTlvyI3NdlN2GOOyBjF9sgAAAQs"]
[Wed Dec 10 21:04:08.821718 2025] [:error] [pid 46868:tid 46876] [client 4.189.145.111:4056] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTlvyI3NdlN2GOOyBjF9swAAAQY"]
[Wed Dec 10 21:04:09.191274 2025] [:error] [pid 46868:tid 46886] [client 4.189.145.111:3995] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTlvyY3NdlN2GOOyBjF9tAAAARA"]
[Wed Dec 10 21:04:09.525818 2025] [:error] [pid 37062:tid 37068] [client 4.189.145.111:4018] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTlvyTB0I62HCw8Z5BRisQAAAAQ"]
[Wed Dec 10 21:04:09.903265 2025] [:error] [pid 37062:tid 37087] [client 4.189.145.111:3986] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTlvyTB0I62HCw8Z5BRisgAAABc"]
[Wed Dec 10 21:04:10.230306 2025] [:error] [pid 36976:tid 37008] [client 4.189.145.111:3947] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aTlvyiSpHW5KVaY9tJmxnAAAAME"]
[Wed Dec 10 21:04:10.658043 2025] [:error] [pid 46868:tid 46879] [client 4.189.145.111:4072] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aTlvyo3NdlN2GOOyBjF9tgAAAQk"]
[Wed Dec 10 21:04:10.996963 2025] [:error] [pid 36976:tid 37028] [client 4.189.145.111:4024] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aTlvyiSpHW5KVaY9tJmxnQAAANU"]
[Wed Dec 10 21:04:11.332647 2025] [:error] [pid 46868:tid 46883] [client 4.189.145.111:3933] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aTlvy43NdlN2GOOyBjF9twAAAQ0"]
[Wed Dec 10 21:04:11.655855 2025] [:error] [pid 36976:tid 37026] [client 4.189.145.111:4019] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTlvyySpHW5KVaY9tJmxngAAANM"]
[Wed Dec 10 21:04:12.225425 2025] [:error] [pid 36976:tid 37021] [client 4.189.145.111:3999] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTlvzCSpHW5KVaY9tJmxoAAAAM4"]
[Wed Dec 10 21:04:12.936433 2025] [:error] [pid 36976:tid 37018] [client 4.189.145.111:3934] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTlvzCSpHW5KVaY9tJmxowAAAMs"]
[Wed Dec 10 21:04:13.529297 2025] [:error] [pid 49095:tid 49098] [client 4.189.145.111:3952] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTlvzcorr4Jt2Tfx_Eb5BgAAAUE"]
[Wed Dec 10 21:04:14.125884 2025] [:error] [pid 36977:tid 37037] [client 4.189.145.111:3907] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTlvzsc-JLl-uoL-Au7C4gAAAEM"]
[Wed Dec 10 21:04:14.553870 2025] [:error] [pid 37062:tid 37064] [client 4.189.145.111:3931] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTlvzjB0I62HCw8Z5BRiuAAAAAA"]
[Wed Dec 10 21:04:15.198853 2025] [:error] [pid 36976:tid 37024] [client 4.189.145.111:3944] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTlvzySpHW5KVaY9tJmxpAAAANE"]
[Wed Dec 10 21:04:15.836038 2025] [:error] [pid 37062:tid 37067] [client 4.189.145.111:3957] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTlvzzB0I62HCw8Z5BRiuQAAAAM"]
[Wed Dec 10 21:04:16.369402 2025] [:error] [pid 49095:tid 49115] [client 4.189.145.111:3895] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aTlv0Morr4Jt2Tfx_Eb5CQAAAVI"]
[Wed Dec 10 21:04:17.998975 2025] [:error] [pid 49095:tid 49107] [client 4.189.145.111:3998] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Dec 10 21:04:18.116897 2025] [:error] [pid 49095:tid 49116] [client 4.189.145.111:3998] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Wed Dec 10 21:04:18.240805 2025] [:error] [pid 49095:tid 49106] [client 4.189.145.111:3998] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aTlv0sorr4Jt2Tfx_Eb5FAAAAUk"]
[Wed Dec 10 21:04:18.712273 2025] [:error] [pid 37062:tid 37070] [client 4.189.145.111:3855] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aTlv0jB0I62HCw8Z5BRivAAAAAY"]
[Wed Dec 10 21:04:19.120114 2025] [:error] [pid 49095:tid 49110] [client 4.189.145.111:4004] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Dec 10 21:04:19.244154 2025] [:error] [pid 49095:tid 49105] [client 4.189.145.111:4004] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTlv08orr4Jt2Tfx_Eb5FwAAAUg"]
[Wed Dec 10 21:04:19.560344 2025] [:error] [pid 36975:tid 36981] [client 4.189.145.111:3940] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTlv09_ZNQ3zMmb38BFxpgAAAIE"]
[Wed Dec 10 21:04:19.868762 2025] [:error] [pid 49095:tid 49111] [client 4.189.145.111:3949] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTlv08orr4Jt2Tfx_Eb5GwAAAU4"]
[Wed Dec 10 21:04:20.303460 2025] [:error] [pid 46868:tid 46887] [client 4.189.145.111:3865] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aTlv1I3NdlN2GOOyBjF9ugAAARE"]
[Wed Dec 10 21:04:20.661561 2025] [:error] [pid 36977:tid 37051] [client 4.189.145.111:3910] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aTlv1Mc-JLl-uoL-Au7C5wAAAFE"]
[Wed Dec 10 21:04:21.283515 2025] [:error] [pid 36976:tid 37023] [client 4.189.145.111:3804] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aTlv1SSpHW5KVaY9tJmxsgAAANA"]
[Wed Dec 10 21:04:21.772581 2025] [:error] [pid 49095:tid 49102] [client 4.189.145.111:3962] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aTlv1corr4Jt2Tfx_Eb5JAAAAUU"]
[Wed Dec 10 21:04:22.136481 2025] [:error] [pid 46868:tid 46893] [client 4.189.145.111:3842] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aTlv1o3NdlN2GOOyBjF9vQAAARc"]
[Wed Dec 10 21:04:22.472356 2025] [:error] [pid 36975:tid 36982] [client 4.189.145.111:4029] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aTlv1t_ZNQ3zMmb38BFxqwAAAII"]
[Wed Dec 10 21:04:22.797097 2025] [:error] [pid 36977:tid 37044] [client 4.189.145.111:3870] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aTlv1sc-JLl-uoL-Au7C8QAAAEo"]
[Wed Dec 10 21:04:23.204254 2025] [:error] [pid 46868:tid 46878] [client 4.189.145.111:4054] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aTlv143NdlN2GOOyBjF9vgAAAQg"]
[Wed Dec 10 21:04:23.490353 2025] [:error] [pid 49095:tid 49120] [client 4.189.145.111:3996] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aTlv18orr4Jt2Tfx_Eb5JwAAAVc"]
[Wed Dec 10 21:04:23.811209 2025] [:error] [pid 49095:tid 49108] [client 4.189.145.111:3860] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTlv18orr4Jt2Tfx_Eb5KAAAAUs"]
[Wed Dec 10 21:04:24.402196 2025] [:error] [pid 46868:tid 46892] [client 4.189.145.111:3914] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTlv2I3NdlN2GOOyBjF9vwAAARY"]
[Wed Dec 10 21:04:24.789730 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:16576] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTlv2Mc-JLl-uoL-Au7C8gAAAEU"]
[Wed Dec 10 21:04:25.094346 2025] [:error] [pid 49095:tid 49113] [client 4.189.145.111:4000] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTlv2corr4Jt2Tfx_Eb5KwAAAVA"]
[Wed Dec 10 21:04:25.360971 2025] [:error] [pid 36975:tid 37000] [client 4.189.145.111:3868] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aTlv2d_ZNQ3zMmb38BFxrgAAAJQ"]
[Wed Dec 10 21:04:25.653239 2025] [:error] [pid 36976:tid 37021] [client 4.189.145.111:3844] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aTlv2SSpHW5KVaY9tJmxtgAAAM4"]
[Wed Dec 10 21:04:25.920972 2025] [:error] [pid 46868:tid 46875] [client 4.189.145.111:3935] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aTlv2Y3NdlN2GOOyBjF9wAAAAQU"]
[Wed Dec 10 21:04:26.593842 2025] [:error] [pid 49095:tid 49116] [client 4.189.145.111:3869] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aTlv2sorr4Jt2Tfx_Eb5LgAAAVM"]
[Wed Dec 10 21:04:27.054016 2025] [:error] [pid 36976:tid 37029] [client 4.189.145.111:4021] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aTlv2ySpHW5KVaY9tJmxtwAAANY"]
[Wed Dec 10 21:04:28.688788 2025] [:error] [pid 37062:tid 37082] [client 4.189.145.111:3859] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aTlv3DB0I62HCw8Z5BRivgAAABI"]
[Wed Dec 10 21:04:28.988381 2025] [:error] [pid 46868:tid 46870] [client 4.189.145.111:3917] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aTlv3I3NdlN2GOOyBjF9wQAAAQA"]
[Wed Dec 10 21:04:29.450448 2025] [:error] [pid 36976:tid 37014] [client 4.189.145.111:3874] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aTlv3SSpHW5KVaY9tJmxuQAAAMc"]
[Wed Dec 10 21:04:29.940519 2025] [:error] [pid 37062:tid 37081] [client 4.189.145.111:3919] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aTlv3TB0I62HCw8Z5BRivwAAABE"]
[Wed Dec 10 21:04:30.344976 2025] [:error] [pid 46868:tid 46894] [client 4.189.145.111:4023] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aTlv3o3NdlN2GOOyBjF9wgAAARg"]
[Wed Dec 10 21:04:30.587485 2025] [:error] [pid 36975:tid 37004] [client 4.189.145.111:3922] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aTlv3t_ZNQ3zMmb38BFxsgAAAJg"]
[Wed Dec 10 21:04:30.978408 2025] [:error] [pid 49095:tid 49105] [client 4.189.145.111:4005] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aTlv3sorr4Jt2Tfx_Eb5MgAAAUg"]
[Wed Dec 10 21:04:31.344593 2025] [:error] [pid 46868:tid 46873] [client 4.189.145.111:3923] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aTlv343NdlN2GOOyBjF9wwAAAQM"]
[Wed Dec 10 21:04:31.791364 2025] [:error] [pid 36976:tid 37016] [client 4.189.145.111:3967] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aTlv3ySpHW5KVaY9tJmxugAAAMk"]
[Wed Dec 10 21:04:32.065361 2025] [:error] [pid 36976:tid 37018] [client 4.189.145.111:3781] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aTlv4CSpHW5KVaY9tJmxuwAAAMs"]
[Wed Dec 10 21:04:32.330405 2025] [:error] [pid 36975:tid 36995] [client 4.189.145.111:3904] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aTlv4N_ZNQ3zMmb38BFxswAAAI8"]
[Wed Dec 10 21:04:32.728147 2025] [:error] [pid 49095:tid 49114] [client 4.189.145.111:3966] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aTlv4Morr4Jt2Tfx_Eb5MwAAAVE"]
[Wed Dec 10 21:04:33.001633 2025] [:error] [pid 36976:tid 37019] [client 4.189.145.111:3806] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aTlv4SSpHW5KVaY9tJmxvQAAAMw"]
[Wed Dec 10 21:04:33.481434 2025] [:error] [pid 36976:tid 37017] [client 4.189.145.111:4017] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aTlv4SSpHW5KVaY9tJmxvgAAAMo"]
[Wed Dec 10 21:04:33.811795 2025] [:error] [pid 36976:tid 37023] [client 4.189.145.111:3924] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aTlv4SSpHW5KVaY9tJmxwAAAANA"]
[Wed Dec 10 21:04:34.245433 2025] [:error] [pid 36977:tid 37047] [client 4.189.145.111:3796] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aTlv4sc-JLl-uoL-Au7C8wAAAE0"]
[Wed Dec 10 21:04:34.705625 2025] [:error] [pid 49095:tid 49101] [client 4.189.145.111:3961] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aTlv4sorr4Jt2Tfx_Eb5NwAAAUQ"]
[Wed Dec 10 21:04:35.201974 2025] [:error] [pid 36976:tid 37024] [client 4.189.145.111:3942] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aTlv4ySpHW5KVaY9tJmxwQAAANE"]
[Wed Dec 10 21:04:36.076313 2025] [:error] [pid 49095:tid 49108] [client 4.189.145.111:16588] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aTlv5Morr4Jt2Tfx_Eb5OgAAAUs"]
[Wed Dec 10 21:04:36.563139 2025] [:error] [pid 49095:tid 49097] [client 4.189.145.111:4052] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aTlv5Morr4Jt2Tfx_Eb5PAAAAUA"]
[Wed Dec 10 21:04:36.916385 2025] [:error] [pid 36976:tid 37030] [client 4.189.145.111:3861] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aTlv5CSpHW5KVaY9tJmxwgAAANc"]
[Wed Dec 10 21:04:37.419281 2025] [:error] [pid 49095:tid 49116] [client 4.189.145.111:4031] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aTlv5corr4Jt2Tfx_Eb5PgAAAVM"]
[Wed Dec 10 21:04:38.272300 2025] [:error] [pid 36977:tid 37046] [client 4.189.145.111:3953] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aTlv5sc-JLl-uoL-Au7C9gAAAEw"]
[Wed Dec 10 21:04:38.888061 2025] [:error] [pid 36976:tid 37007] [client 4.189.145.111:3748] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTlv5iSpHW5KVaY9tJmxwwAAAMA"]
[Wed Dec 10 21:04:39.461061 2025] [:error] [pid 49095:tid 49100] [client 4.189.145.111:3897] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTlv58orr4Jt2Tfx_Eb5QQAAAUM"]
[Wed Dec 10 21:04:40.230871 2025] [:error] [pid 49095:tid 49109] [client 4.189.145.111:4007] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTlv6Morr4Jt2Tfx_Eb5QgAAAUw"]
[Wed Dec 10 21:04:40.826307 2025] [:error] [pid 49095:tid 49112] [client 4.189.145.111:3929] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aTlv6Morr4Jt2Tfx_Eb5QwAAAU8"]
[Wed Dec 10 21:04:41.134914 2025] [:error] [pid 36976:tid 37012] [client 4.189.145.111:3863] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aTlv6SSpHW5KVaY9tJmxxAAAAMU"]
[Wed Dec 10 21:04:41.662121 2025] [:error] [pid 36977:tid 37048] [client 4.189.145.111:16518] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aTlv6cc-JLl-uoL-Au7C-QAAAE4"]
[Wed Dec 10 21:04:42.388990 2025] [:error] [pid 37062:tid 37076] [client 4.189.145.111:3963] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aTlv6jB0I62HCw8Z5BRiwgAAAAw"]
[Wed Dec 10 21:04:42.862514 2025] [:error] [pid 36976:tid 37020] [client 4.189.145.111:3955] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aTlv6iSpHW5KVaY9tJmxxQAAAM0"]
[Wed Dec 10 21:04:43.274447 2025] [:error] [pid 37062:tid 37071] [client 4.189.145.111:3814] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTlv6zB0I62HCw8Z5BRiwwAAAAc"]
[Wed Dec 10 21:04:43.646649 2025] [:error] [pid 36975:tid 36992] [client 4.189.145.111:3936] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTlv69_ZNQ3zMmb38BFxtwAAAIw"]
[Wed Dec 10 21:04:44.166164 2025] [:error] [pid 36975:tid 36998] [client 4.189.145.111:3845] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTlv7N_ZNQ3zMmb38BFxuAAAAJI"]
[Wed Dec 10 21:04:44.531459 2025] [:error] [pid 37062:tid 37080] [client 4.189.145.111:3856] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aTlv7DB0I62HCw8Z5BRixAAAABA"]
[Wed Dec 10 21:04:45.330505 2025] [:error] [pid 49095:tid 49115] [client 4.189.145.111:3841] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aTlv7corr4Jt2Tfx_Eb5RQAAAVI"]
[Wed Dec 10 21:04:45.859496 2025] [:error] [pid 36976:tid 37009] [client 4.189.145.111:3948] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aTlv7SSpHW5KVaY9tJmxxwAAAMI"]
[Wed Dec 10 21:04:46.861129 2025] [:error] [pid 36976:tid 37031] [client 4.189.145.111:3881] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aTlv7iSpHW5KVaY9tJmxyAAAANg"]
[Wed Dec 10 21:04:47.277387 2025] [:error] [pid 36977:tid 37057] [client 4.189.145.111:3879] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aTlv78c-JLl-uoL-Au7C_wAAAFc"]
[Wed Dec 10 21:04:47.607418 2025] [:error] [pid 36975:tid 36997] [client 4.189.145.111:3778] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTlv79_ZNQ3zMmb38BFxvQAAAJE"]
[Wed Dec 10 21:04:48.337721 2025] [:error] [pid 36976:tid 37022] [client 4.189.145.111:3802] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTlv8CSpHW5KVaY9tJmxygAAAM8"]
[Wed Dec 10 21:04:48.790587 2025] [:error] [pid 36976:tid 37013] [client 4.189.145.111:3997] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTlv8CSpHW5KVaY9tJmxywAAAMY"]
[Wed Dec 10 21:04:49.142346 2025] [:error] [pid 36976:tid 37021] [client 4.189.145.111:4073] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aTlv8SSpHW5KVaY9tJmxzAAAAM4"]
[Wed Dec 10 21:04:49.680838 2025] [:error] [pid 36977:tid 37052] [client 4.189.145.111:3784] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTlv8cc-JLl-uoL-Au7DAgAAAFI"]
[Wed Dec 10 21:04:50.283213 2025] [:error] [pid 36976:tid 37029] [client 4.189.145.111:3898] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTlv8iSpHW5KVaY9tJmxzQAAANY"]
[Wed Dec 10 21:04:50.823774 2025] [:error] [pid 36976:tid 37026] [client 4.189.145.111:3871] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTlv8iSpHW5KVaY9tJmxzgAAANM"]
[Wed Dec 10 21:04:51.667820 2025] [:error] [pid 36976:tid 37027] [client 4.189.145.111:3915] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aTlv8ySpHW5KVaY9tJmx0QAAANQ"]
[Wed Dec 10 21:04:51.984886 2025] [:error] [pid 36976:tid 37016] [client 4.189.145.111:4026] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTlv8ySpHW5KVaY9tJmx0gAAAMk"]
[Wed Dec 10 21:04:52.294984 2025] [:error] [pid 49095:tid 49119] [client 4.189.145.111:3893] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTlv9Morr4Jt2Tfx_Eb5SQAAAVY"]
[Wed Dec 10 21:04:52.822702 2025] [:error] [pid 36976:tid 37018] [client 4.189.145.111:3854] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTlv9CSpHW5KVaY9tJmx0wAAAMs"]
[Wed Dec 10 21:04:53.251257 2025] [:error] [pid 46868:tid 46883] [client 4.189.145.111:3836] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTlv9Y3NdlN2GOOyBjF9xwAAAQ0"]
[Wed Dec 10 21:04:53.694900 2025] [:error] [pid 37062:tid 37084] [client 4.189.145.111:3788] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aTlv9TB0I62HCw8Z5BRixgAAABQ"]
[Wed Dec 10 21:04:54.357811 2025] [:error] [pid 49095:tid 49113] [client 4.189.145.111:3878] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aTlv9sorr4Jt2Tfx_Eb5SgAAAVA"]
[Wed Dec 10 21:04:54.782459 2025] [:error] [pid 36975:tid 36993] [client 4.189.145.111:3884] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aTlv9t_ZNQ3zMmb38BFxvwAAAI0"]
[Wed Dec 10 21:04:55.114995 2025] [:error] [pid 36975:tid 36985] [client 4.189.145.111:3896] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aTlv99_ZNQ3zMmb38BFxwAAAAIU"]
[Wed Dec 10 21:04:55.399050 2025] [:error] [pid 37062:tid 37077] [client 4.189.145.111:3787] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aTlv9zB0I62HCw8Z5BRiyQAAAA0"]
[Wed Dec 10 21:04:55.694074 2025] [:error] [pid 37062:tid 37067] [client 4.189.145.111:3873] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aTlv9zB0I62HCw8Z5BRiygAAAAM"]
[Wed Dec 10 21:04:55.968743 2025] [:error] [pid 49095:tid 49103] [client 4.189.145.111:16563] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aTlv98orr4Jt2Tfx_Eb5SwAAAUY"]
[Wed Dec 10 21:04:56.366291 2025] [:error] [pid 46868:tid 46884] [client 4.189.145.111:3875] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aTlv-I3NdlN2GOOyBjF9yAAAAQ4"]
[Wed Dec 10 21:04:56.636041 2025] [:error] [pid 36977:tid 37044] [client 4.189.145.111:3951] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTlv-Mc-JLl-uoL-Au7DAwAAAEo"]
[Wed Dec 10 21:04:56.959458 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:3965] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTlv-Mc-JLl-uoL-Au7DBAAAAEU"]
[Wed Dec 10 21:04:57.303038 2025] [:error] [pid 36977:tid 37047] [client 4.189.145.111:3792] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTlv-cc-JLl-uoL-Au7DBQAAAE0"]
[Wed Dec 10 21:04:57.730308 2025] [:error] [pid 36977:tid 37051] [client 4.189.145.111:3782] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aTlv-cc-JLl-uoL-Au7DBgAAAFE"]
[Wed Dec 10 21:04:58.348669 2025] [:error] [pid 46868:tid 46885] [client 4.189.145.111:3906] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aTlv-o3NdlN2GOOyBjF9ygAAAQ8"]
[Wed Dec 10 21:04:58.632115 2025] [:error] [pid 46868:tid 46887] [client 4.189.145.111:3973] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aTlv-o3NdlN2GOOyBjF9ywAAARE"]
[Wed Dec 10 21:04:58.987748 2025] [:error] [pid 36977:tid 37038] [client 4.189.145.111:3941] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aTlv-sc-JLl-uoL-Au7DBwAAAEQ"]
[Wed Dec 10 21:04:59.555649 2025] [:error] [pid 49095:tid 49121] [client 4.189.145.111:3862] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aTlv-8orr4Jt2Tfx_Eb5TgAAAVg"]
[Wed Dec 10 21:04:59.893071 2025] [:error] [pid 37062:tid 37082] [client 4.189.145.111:4020] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aTlv-zB0I62HCw8Z5BRizgAAABI"]
[Wed Dec 10 21:05:00.350836 2025] [:error] [pid 36977:tid 37046] [client 4.189.145.111:16628] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aTlv_Mc-JLl-uoL-Au7DCAAAAEw"]
[Wed Dec 10 21:05:00.810122 2025] [:error] [pid 37062:tid 37081] [client 4.189.145.111:3954] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aTlv_DB0I62HCw8Z5BRizwAAABE"]
[Wed Dec 10 21:05:01.391625 2025] [:error] [pid 37062:tid 37074] [client 4.189.145.111:3818] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aTlv_TB0I62HCw8Z5BRi0AAAAAo"]
[Wed Dec 10 21:05:01.758848 2025] [:error] [pid 46868:tid 46880] [client 4.189.145.111:3938] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aTlv_Y3NdlN2GOOyBjF9zwAAAQo"]
[Wed Dec 10 21:05:02.307260 2025] [:error] [pid 36976:tid 37012] [client 4.189.145.111:3877] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aTlv_iSpHW5KVaY9tJmx1QAAAMU"]
[Wed Dec 10 21:05:02.588874 2025] [:error] [pid 36976:tid 37020] [client 4.189.145.111:3882] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aTlv_iSpHW5KVaY9tJmx1gAAAM0"]
[Wed Dec 10 21:05:03.019154 2025] [:error] [pid 36975:tid 36996] [client 4.189.145.111:3978] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aTlv_9_ZNQ3zMmb38BFxxgAAAJA"]
[Wed Dec 10 21:05:03.435729 2025] [:error] [pid 49095:tid 49100] [client 4.189.145.111:3867] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aTlv_8orr4Jt2Tfx_Eb5UgAAAUM"]
[Wed Dec 10 21:05:03.757900 2025] [:error] [pid 46868:tid 46877] [client 4.189.145.111:3900] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aTlv_43NdlN2GOOyBjF90AAAAQc"]
[Wed Dec 10 21:05:04.424448 2025] [:error] [pid 49095:tid 49109] [client 4.189.145.111:3780] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aTlwAMorr4Jt2Tfx_Eb5VAAAAUw"]
[Wed Dec 10 21:05:04.819663 2025] [:error] [pid 46868:tid 46892] [client 4.189.145.111:3811] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aTlwAI3NdlN2GOOyBjF90gAAARY"]
[Wed Dec 10 21:05:05.142114 2025] [:error] [pid 49095:tid 49110] [client 4.189.145.111:3820] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTlwAcorr4Jt2Tfx_Eb5VQAAAU0"]
[Wed Dec 10 21:05:05.525411 2025] [:error] [pid 46868:tid 46870] [client 4.189.145.111:3722] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTlwAY3NdlN2GOOyBjF90wAAAQA"]
[Wed Dec 10 21:05:05.830249 2025] [:error] [pid 36975:tid 36991] [client 4.189.145.111:3880] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTlwAd_ZNQ3zMmb38BFxxwAAAIs"]
[Wed Dec 10 21:05:06.117401 2025] [:error] [pid 49095:tid 49114] [client 4.189.145.111:3899] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aTlwAsorr4Jt2Tfx_Eb5WgAAAVE"]
[Wed Dec 10 21:05:06.514613 2025] [:error] [pid 36977:tid 37050] [client 4.189.145.111:3853] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlwAsc-JLl-uoL-Au7DCQAAAFA"]
[Wed Dec 10 21:05:06.842008 2025] [:error] [pid 49095:tid 49120] [client 4.189.145.111:4016] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlwAsorr4Jt2Tfx_Eb5WwAAAVc"]
[Wed Dec 10 21:05:07.250963 2025] [:error] [pid 36976:tid 37010] [client 4.189.145.111:3823] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlwAySpHW5KVaY9tJmx1wAAAMM"]
[Wed Dec 10 21:05:07.614175 2025] [:error] [pid 36976:tid 37031] [client 4.189.145.111:3892] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aTlwAySpHW5KVaY9tJmx2QAAANg"]
[Wed Dec 10 21:05:08.016178 2025] [:error] [pid 49095:tid 49097] [client 4.189.145.111:3953] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTlwBMorr4Jt2Tfx_Eb5XwAAAUA"]
[Wed Dec 10 21:05:08.384216 2025] [:error] [pid 36976:tid 37008] [client 4.189.145.111:3742] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTlwBCSpHW5KVaY9tJmx2wAAAME"]
[Wed Dec 10 21:05:08.922179 2025] [:error] [pid 36976:tid 37013] [client 4.189.145.111:3959] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTlwBCSpHW5KVaY9tJmx3QAAAMY"]
[Wed Dec 10 21:05:09.271676 2025] [:error] [pid 49095:tid 49117] [client 4.189.145.111:3795] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTlwBcorr4Jt2Tfx_Eb5YAAAAVQ"]
[Wed Dec 10 21:05:09.625021 2025] [:error] [pid 36977:tid 37048] [client 4.189.145.111:3805] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aTlwBcc-JLl-uoL-Au7DCwAAAE4"]
[Wed Dec 10 21:05:10.152419 2025] [:error] [pid 46868:tid 46879] [client 4.189.145.111:16566] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aTlwBo3NdlN2GOOyBjF91gAAAQk"]
[Wed Dec 10 21:05:10.532474 2025] [:error] [pid 37062:tid 37071] [client 4.189.145.111:3730] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aTlwBjB0I62HCw8Z5BRi6QAAAAc"]
[Wed Dec 10 21:05:11.138689 2025] [:error] [pid 49095:tid 49116] [client 4.189.145.111:3799] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aTlwB8orr4Jt2Tfx_Eb5YgAAAVM"]
[Wed Dec 10 21:05:11.583153 2025] [:error] [pid 46868:tid 46887] [client 4.189.145.111:3725] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTlwB43NdlN2GOOyBjF92AAAARE"]
[Wed Dec 10 21:05:11.867607 2025] [:error] [pid 49095:tid 49109] [client 4.189.145.111:3794] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTlwB8orr4Jt2Tfx_Eb5YwAAAUw"]
[Wed Dec 10 21:05:12.308038 2025] [:error] [pid 49095:tid 49099] [client 4.189.145.111:3890] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTlwCMorr4Jt2Tfx_Eb5ZAAAAUI"]
[Wed Dec 10 21:05:12.764218 2025] [:error] [pid 36977:tid 37053] [client 4.189.145.111:3876] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aTlwCMc-JLl-uoL-Au7DDAAAAFM"]
[Wed Dec 10 21:05:13.235933 2025] [:error] [pid 49095:tid 49101] [client 4.189.145.111:3826] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aTlwCcorr4Jt2Tfx_Eb5ZwAAAUQ"]
[Wed Dec 10 21:05:13.603661 2025] [:error] [pid 36977:tid 37049] [client 4.189.145.111:3889] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aTlwCcc-JLl-uoL-Au7DDgAAAE8"]
[Wed Dec 10 21:05:14.076877 2025] [:error] [pid 49095:tid 49104] [client 4.189.145.111:3718] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aTlwCsorr4Jt2Tfx_Eb5cwAAAUc"]
[Wed Dec 10 21:05:14.424995 2025] [:error] [pid 36977:tid 37057] [client 4.189.145.111:3816] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aTlwCsc-JLl-uoL-Au7DDwAAAFc"]
[Wed Dec 10 21:05:14.786051 2025] [:error] [pid 49095:tid 49119] [client 4.189.145.111:3785] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aTlwCsorr4Jt2Tfx_Eb5gQAAAVY"]
[Wed Dec 10 21:05:15.094796 2025] [:error] [pid 46868:tid 46879] [client 4.189.145.111:3831] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aTlwC43NdlN2GOOyBjF97QAAAQk"]
[Wed Dec 10 21:05:15.383658 2025] [:error] [pid 36977:tid 37035] [client 4.189.145.111:3883] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aTlwC8c-JLl-uoL-Au7DEAAAAEE"]
[Wed Dec 10 21:05:15.761076 2025] [:error] [pid 46868:tid 46888] [client 4.189.145.111:3777] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aTlwC43NdlN2GOOyBjF98wAAARI"]
[Wed Dec 10 21:05:16.349852 2025] [:error] [pid 36977:tid 37042] [client 4.189.145.111:3790] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aTlwDMc-JLl-uoL-Au7DEgAAAEg"]
[Wed Dec 10 21:05:16.682422 2025] [:error] [pid 37062:tid 37084] [client 4.189.145.111:3887] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aTlwDDB0I62HCw8Z5BRi7QAAABQ"]
[Wed Dec 10 21:05:17.124901 2025] [:error] [pid 36976:tid 37007] [client 4.189.145.111:3888] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aTlwDSSpHW5KVaY9tJmx5AAAAMA"]
[Wed Dec 10 21:05:17.652083 2025] [:error] [pid 49095:tid 49112] [client 4.189.145.111:3808] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aTlwDcorr4Jt2Tfx_Eb5jwAAAU8"]
[Wed Dec 10 21:05:18.433281 2025] [:error] [pid 36976:tid 37020] [client 4.189.145.111:3733] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aTlwDiSpHW5KVaY9tJmx5gAAAM0"]
[Wed Dec 10 21:05:18.787477 2025] [:error] [pid 37062:tid 37067] [client 4.189.145.111:4045] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aTlwDjB0I62HCw8Z5BRi8AAAAAM"]
[Wed Dec 10 21:05:19.143008 2025] [:error] [pid 36977:tid 37041] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Wed Dec 10 21:05:19.291070 2025] [:error] [pid 36977:tid 37056] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/vanta-1.php
[Wed Dec 10 21:05:19.407471 2025] [:error] [pid 36977:tid 37058] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Dec 10 21:05:19.525642 2025] [:error] [pid 36977:tid 37044] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Wed Dec 10 21:05:19.642514 2025] [:error] [pid 36977:tid 37039] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Wed Dec 10 21:05:19.766432 2025] [:error] [pid 36977:tid 37047] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Wed Dec 10 21:05:19.883502 2025] [:error] [pid 36977:tid 37051] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Wed Dec 10 21:05:20.057798 2025] [:error] [pid 36977:tid 37038] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Wed Dec 10 21:05:20.175886 2025] [:error] [pid 36977:tid 37046] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Wed Dec 10 21:05:20.306637 2025] [:error] [pid 36977:tid 37050] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Dec 10 21:05:20.420775 2025] [:error] [pid 36977:tid 37055] [client 4.189.145.111:3715] [client 4.189.145.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.145.111, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTlwEMc-JLl-uoL-Au7DHwAAAFU"]
[Wed Dec 10 21:05:20.425808 2025] [:error] [pid 36977:tid 37055] [client 4.189.145.111:3715] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Wed Dec 10 21:05:20.542717 2025] [:error] [pid 36977:tid 37048] [client 4.189.145.111:3715] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTlwEMc-JLl-uoL-Au7DIAAAAE4"]
[Wed Dec 10 21:05:21.178015 2025] [:error] [pid 49095:tid 49108] [client 4.189.145.111:3751] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTlwEcorr4Jt2Tfx_Eb5kQAAAUs"]
[Wed Dec 10 21:05:21.487668 2025] [:error] [pid 36975:tid 36989] [client 4.189.145.111:3801] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTlwEd_ZNQ3zMmb38BFx1AAAAIk"]
[Wed Dec 10 21:05:21.811880 2025] [:error] [pid 49095:tid 49097] [client 4.189.145.111:3760] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aTlwEcorr4Jt2Tfx_Eb5kwAAAUA"]
[Wed Dec 10 21:05:22.196807 2025] [:error] [pid 36975:tid 37002] [client 4.189.145.111:3803] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aTlwEt_ZNQ3zMmb38BFx1gAAAJY"]
[Wed Dec 10 21:05:22.662475 2025] [:error] [pid 49095:tid 49107] [client 4.189.145.111:3930] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aTlwEsorr4Jt2Tfx_Eb5lgAAAUo"]
[Wed Dec 10 21:05:23.134283 2025] [:error] [pid 49095:tid 49098] [client 4.189.145.111:3800] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aTlwE8orr4Jt2Tfx_Eb5lwAAAUE"]
[Wed Dec 10 21:05:23.658749 2025] [:error] [pid 36975:tid 36996] [client 4.189.145.111:3960] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aTlwE9_ZNQ3zMmb38BFx1wAAAJA"]
[Wed Dec 10 21:05:24.249927 2025] [:error] [pid 36976:tid 37009] [client 4.189.145.111:3849] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zafir1.php"] [unique_id "aTlwFCSpHW5KVaY9tJmx6AAAAMI"]
[Wed Dec 10 21:05:24.802325 2025] [:error] [pid 49095:tid 49110] [client 4.189.145.111:3771] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zafir1.php"] [unique_id "aTlwFMorr4Jt2Tfx_Eb5mQAAAU0"]
[Wed Dec 10 21:05:25.363339 2025] [:error] [pid 46868:tid 46879] [client 4.189.145.111:3843] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zafir1.php"] [unique_id "aTlwFY3NdlN2GOOyBjF-GAAAAQk"]
[Wed Dec 10 21:05:25.875096 2025] [:error] [pid 49095:tid 49101] [client 4.189.145.111:3654] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zafir1.php"] [unique_id "aTlwFcorr4Jt2Tfx_Eb5mgAAAUQ"]
[Wed Dec 10 21:05:26.481444 2025] [:error] [pid 49095:tid 49114] [client 4.189.145.111:3835] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aTlwFsorr4Jt2Tfx_Eb5mwAAAVE"]
[Wed Dec 10 21:05:26.924313 2025] [:error] [pid 49095:tid 49105] [client 4.189.145.111:3901] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aTlwFsorr4Jt2Tfx_Eb5nAAAAUg"]
[Wed Dec 10 21:05:27.470245 2025] [:error] [pid 46868:tid 46890] [client 4.189.145.111:3950] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aTlwF43NdlN2GOOyBjF-HwAAARQ"]
[Wed Dec 10 21:05:27.829521 2025] [:error] [pid 36975:tid 36981] [client 4.189.145.111:3886] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aTlwF9_ZNQ3zMmb38BFx2AAAAIE"]
[Wed Dec 10 21:05:28.217269 2025] [:error] [pid 36977:tid 37052] [client 4.189.145.111:3716] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/sx.php"] [unique_id "aTlwGMc-JLl-uoL-Au7DJAAAAFI"]
[Wed Dec 10 21:05:28.541151 2025] [:error] [pid 37062:tid 37080] [client 4.189.145.111:3834] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aTlwGDB0I62HCw8Z5BRi9gAAABA"]
[Wed Dec 10 21:05:28.881871 2025] [:error] [pid 36975:tid 36990] [client 4.189.145.111:3903] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aTlwGN_ZNQ3zMmb38BFx2gAAAIo"]
[Wed Dec 10 21:05:29.288730 2025] [:error] [pid 36975:tid 36984] [client 4.189.145.111:3858] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aTlwGd_ZNQ3zMmb38BFx2wAAAIQ"]
[Wed Dec 10 21:05:29.721019 2025] [:error] [pid 46868:tid 46875] [client 4.189.145.111:3717] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aTlwGY3NdlN2GOOyBjF-JQAAAQU"]
[Wed Dec 10 21:05:30.100431 2025] [:error] [pid 49095:tid 49119] [client 4.189.145.111:3815] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aTlwGsorr4Jt2Tfx_Eb5nwAAAVY"]
[Wed Dec 10 21:05:30.404526 2025] [:error] [pid 46868:tid 46881] [client 4.189.145.111:3755] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTlwGo3NdlN2GOOyBjF-KAAAAQs"]
[Wed Dec 10 21:05:30.837360 2025] [:error] [pid 37062:tid 37078] [client 4.189.145.111:3822] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTlwGjB0I62HCw8Z5BRi-AAAAA4"]
[Wed Dec 10 21:05:31.359264 2025] [:error] [pid 46868:tid 46871] [client 4.189.145.111:3743] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTlwG43NdlN2GOOyBjF-KgAAAQE"]
[Wed Dec 10 21:05:31.823667 2025] [:error] [pid 46868:tid 46876] [client 4.189.145.111:3825] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTlwG43NdlN2GOOyBjF-LAAAAQY"]
[Wed Dec 10 21:05:32.578385 2025] [:error] [pid 46868:tid 46879] [client 4.189.145.111:3832] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aTlwHI3NdlN2GOOyBjF-LQAAAQk"]
[Wed Dec 10 21:05:32.948622 2025] [:error] [pid 36976:tid 37018] [client 4.189.145.111:4015] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aTlwHCSpHW5KVaY9tJmx7QAAAMs"]
[Wed Dec 10 21:05:33.389243 2025] [:error] [pid 46868:tid 46887] [client 4.189.145.111:3657] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aTlwHY3NdlN2GOOyBjF-LwAAARE"]
[Wed Dec 10 21:05:33.885073 2025] [:error] [pid 36976:tid 37025] [client 4.189.145.111:3824] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aTlwHSSpHW5KVaY9tJmx7gAAANI"]
[Wed Dec 10 21:05:34.347227 2025] [:error] [pid 36977:tid 37051] [client 4.189.145.111:3724] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aTlwHsc-JLl-uoL-Au7DKAAAAFE"]
[Wed Dec 10 21:05:34.884197 2025] [:error] [pid 49095:tid 49104] [client 4.189.145.111:3812] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aTlwHsorr4Jt2Tfx_Eb5ogAAAUc"]
[Wed Dec 10 21:05:35.250403 2025] [:error] [pid 49095:tid 49113] [client 4.189.145.111:3891] [client 4.189.145.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aTlwH8orr4Jt2Tfx_Eb5owAAAVA"]
[Wed Dec 10 21:05:35.730672 2025] [:error] [pid 46868:tid 46875] [client 4.189.145.111:3783] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fopen.php"] [unique_id "aTlwH43NdlN2GOOyBjF-MgAAAQU"]
[Wed Dec 10 21:05:36.122537 2025] [:error] [pid 36975:tid 37000] [client 4.189.145.111:3819] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fopen.php"] [unique_id "aTlwIN_ZNQ3zMmb38BFx4QAAAJQ"]
[Wed Dec 10 21:05:36.473506 2025] [:error] [pid 36977:tid 37055] [client 4.189.145.111:3741] [client 4.189.145.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fopen.php"] [unique_id "aTlwIMc-JLl-uoL-Au7DKQAAAFU"]
[Wed Dec 10 23:18:39.307982 2025] [:error] [pid 36976:tid 37011] [client 104.28.241.184:54769] [client 104.28.241.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.241.184, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aTmPTySpHW5KVaY9tJnZgwAAAMQ"]
[Wed Dec 10 23:18:39.312818 2025] [:error] [pid 36976:tid 37011] [client 104.28.241.184:54769] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 10 23:18:41.944113 2025] [:error] [pid 36975:tid 37001] [client 27.7.137.152:58680] [client 27.7.137.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.7.137.152, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aTmPUd_ZNQ3zMmb38BGQ0AAAAJU"]
[Wed Dec 10 23:18:41.948814 2025] [:error] [pid 36975:tid 37001] [client 27.7.137.152:58680] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Dec 11 03:41:21.257615 2025] [:error] [pid 37537:tid 37648] [client 165.154.227.184:52516] [client 165.154.227.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/favicon.ico"] [unique_id "aTnM4RMr9iX_ABGbMJiAkwAAAIc"]
[Thu Dec 11 03:41:21.994820 2025] [:error] [pid 37522:tid 37593] [client 165.154.227.184:52528] [client 165.154.227.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/robots.txt"] [unique_id "aTnM4ZWwtXFilVQv-hr9yQAAAA4"]
[Thu Dec 11 03:41:23.435338 2025] [:error] [pid 37522:tid 37589] [client 165.154.227.184:45902] [client 165.154.227.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/favicon.ico"] [unique_id "aTnM45WwtXFilVQv-hr9zgAAAAo"]
[Thu Dec 11 03:41:24.130684 2025] [:error] [pid 37528:tid 37626] [client 165.154.227.184:45912] [client 165.154.227.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/robots.txt"] [unique_id "aTnM5BqXQCTisrpxySXpcQAAAEw"]
[Thu Dec 11 03:41:50.441798 2025] [:error] [pid 37522:tid 37598] [client 165.154.196.27:37498] [client 165.154.196.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/favicon.ico"] [unique_id "aTnM_pWwtXFilVQv-hr96AAAABM"]
[Thu Dec 11 03:41:51.071045 2025] [:error] [pid 57851:tid 57876] [client 165.154.196.27:37506] [client 165.154.196.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/robots.txt"] [unique_id "aTnM__7HbaGTqAi5ZqCkMwAAAUY"]
[Thu Dec 11 03:41:51.716648 2025] [:error] [pid 58228:tid 58285] [client 165.154.196.27:43008] [client 165.154.196.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/favicon.ico"] [unique_id "aTnM_x3vfpCrnHjvR-5K_QAAAkc"]
[Thu Dec 11 03:41:52.964894 2025] [:error] [pid 57851:tid 57886] [client 165.154.196.27:43020] [client 165.154.196.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/robots.txt"] [unique_id "aTnNAP7HbaGTqAi5ZqCkNAAAAVA"]
[Thu Dec 11 04:24:18.384246 2025] [:error] [pid 57991:tid 58041] [client 45.8.17.26:22307] [client 45.8.17.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.26, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aTnW8qPyGmNXA2ZsETbRuQAAAFM"]
[Thu Dec 11 04:24:18.388900 2025] [:error] [pid 57991:tid 58041] [client 45.8.17.26:22307] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Dec 11 05:53:43.891752 2025] [:error] [pid 57992:tid 58071] [client 216.24.219.223:36009] [client 216.24.219.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.223, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aTnr5-Ueau0BMFF2vHnnkgAAAJY"]
[Thu Dec 11 05:53:43.898292 2025] [:error] [pid 57992:tid 58071] [client 216.24.219.223:36009] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Dec 11 20:57:02.331247 2025] [:error] [pid 27459:tid 27477] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/ce.php
[Thu Dec 11 20:57:02.454186 2025] [:error] [pid 27459:tid 27481] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Thu Dec 11 20:57:02.578041 2025] [:error] [pid 27459:tid 27474] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/tithings.php
[Thu Dec 11 20:57:02.705638 2025] [:error] [pid 27459:tid 27462] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Dec 11 20:57:02.952953 2025] [:error] [pid 27459:tid 27480] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/nope.php
[Thu Dec 11 20:57:03.188721 2025] [:error] [pid 27459:tid 27466] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Thu Dec 11 20:57:03.449303 2025] [:error] [pid 27459:tid 27464] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/duplicand.php
[Thu Dec 11 20:57:03.590847 2025] [:error] [pid 27459:tid 27475] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/3i8som87avh59dosfymtvCakc.php
[Thu Dec 11 20:57:03.714478 2025] [:error] [pid 27459:tid 27479] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/ww5.php
[Thu Dec 11 20:57:03.848234 2025] [:error] [pid 27459:tid 27472] [client 4.190.219.196:42328] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Thu Dec 11 20:57:03.969631 2025] [:error] [pid 27459:tid 27468] [client 4.190.219.196:42328] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTq_n1hPEXihPBKMpRNgqgAAAQc"]
[Thu Dec 11 20:57:04.732370 2025] [:error] [pid 57992:tid 58064] [client 4.190.219.196:36303] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTq_oOUeau0BMFF2vHmz7AAAAI8"]
[Thu Dec 11 20:57:05.929622 2025] [:error] [pid 48261:tid 48276] [client 4.190.219.196:42351] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTq_oeyPI4WU-4JmiQPCwQAAAYw"]
[Thu Dec 11 20:57:06.668602 2025] [:error] [pid 58099:tid 58120] [client 4.190.219.196:32671] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTq_osKZVSF_bdPFqRgaHQAAANM"]
[Thu Dec 11 20:57:07.251057 2025] [:error] [pid 58814:tid 58836] [client 4.190.219.196:49431] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nonesoterically.php"] [unique_id "aTq_o9iz0l9AD_3pkMw3tQAAAdQ"]
[Thu Dec 11 20:57:07.778491 2025] [:error] [pid 58814:tid 58826] [client 4.190.219.196:7782] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nonesoterically.php"] [unique_id "aTq_o9iz0l9AD_3pkMw3twAAAco"]
[Thu Dec 11 20:57:08.364677 2025] [:error] [pid 58814:tid 58821] [client 4.190.219.196:7648] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nonesoterically.php"] [unique_id "aTq_pNiz0l9AD_3pkMw3uAAAAcU"]
[Thu Dec 11 20:57:09.185911 2025] [:error] [pid 24527:tid 24573] [client 4.190.219.196:53338] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nonesoterically.php"] [unique_id "aTq_pV9_glvtS5vXiTUK2QAAApE"]
[Thu Dec 11 20:57:09.877218 2025] [:error] [pid 58099:tid 58110] [client 4.190.219.196:38021] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xml.php"] [unique_id "aTq_pcKZVSF_bdPFqRgaHgAAAMk"]
[Thu Dec 11 20:57:10.808967 2025] [:error] [pid 48261:tid 48275] [client 4.190.219.196:33046] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xml.php"] [unique_id "aTq_puyPI4WU-4JmiQPCxAAAAYs"]
[Thu Dec 11 20:57:11.337503 2025] [:error] [pid 58814:tid 58827] [client 4.190.219.196:53371] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xml.php"] [unique_id "aTq_p9iz0l9AD_3pkMw3uQAAAcs"]
[Thu Dec 11 20:57:12.075822 2025] [:error] [pid 57991:tid 58038] [client 4.190.219.196:7635] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xml.php"] [unique_id "aTq_qKPyGmNXA2ZsETa5OgAAAFA"]
[Thu Dec 11 20:57:12.655472 2025] [:error] [pid 48261:tid 48267] [client 4.190.219.196:39432] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xrp.php"] [unique_id "aTq_qOyPI4WU-4JmiQPCxQAAAYM"]
[Thu Dec 11 20:57:13.520530 2025] [:error] [pid 24527:tid 24578] [client 4.190.219.196:33061] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xrp.php"] [unique_id "aTq_qV9_glvtS5vXiTUK2wAAApY"]
[Thu Dec 11 20:57:14.251957 2025] [:error] [pid 48261:tid 48274] [client 4.190.219.196:38058] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xrp.php"] [unique_id "aTq_quyPI4WU-4JmiQPCxgAAAYo"]
[Thu Dec 11 20:57:14.632807 2025] [:error] [pid 35112:tid 35132] [client 4.190.219.196:33739] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xrp.php"] [unique_id "aTq_qp9ZpQ0WIeJhsJdssgAAAVI"]
[Thu Dec 11 20:57:15.314130 2025] [:error] [pid 24483:tid 24498] [client 4.190.219.196:38071] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/palsy.php"] [unique_id "aTq_q1GHKh2d_uVkopRhTwAAAg0"]
[Thu Dec 11 20:57:15.823114 2025] [:error] [pid 24527:tid 24561] [client 4.190.219.196:33735] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/palsy.php"] [unique_id "aTq_q19_glvtS5vXiTUK3AAAAoU"]
[Thu Dec 11 20:57:16.524252 2025] [:error] [pid 58814:tid 58824] [client 4.190.219.196:36302] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/palsy.php"] [unique_id "aTq_rNiz0l9AD_3pkMw3vAAAAcg"]
[Thu Dec 11 20:57:17.267777 2025] [:error] [pid 58814:tid 58828] [client 4.190.219.196:32643] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/palsy.php"] [unique_id "aTq_rdiz0l9AD_3pkMw3vQAAAcw"]
[Thu Dec 11 20:57:18.030996 2025] [:error] [pid 57990:tid 58012] [client 4.190.219.196:31864] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aTq_rgqZT_dc36fQdXGFmgAAABE"]
[Thu Dec 11 20:57:18.624834 2025] [:error] [pid 35112:tid 35124] [client 4.190.219.196:39485] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aTq_rp9ZpQ0WIeJhsJdsswAAAUo"]
[Thu Dec 11 20:57:19.161704 2025] [:error] [pid 24527:tid 24558] [client 4.190.219.196:33039] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aTq_r19_glvtS5vXiTUK3gAAAoI"]
[Thu Dec 11 20:57:19.867983 2025] [:error] [pid 58814:tid 58825] [client 4.190.219.196:38044] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aTq_r9iz0l9AD_3pkMw3wQAAAck"]
[Thu Dec 11 20:57:20.870496 2025] [:error] [pid 24527:tid 24574] [client 4.190.219.196:33755] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aTq_sF9_glvtS5vXiTUK4gAAApI"]
[Thu Dec 11 20:57:21.644959 2025] [:error] [pid 57992:tid 58051] [client 4.190.219.196:32694] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aTq_seUeau0BMFF2vHmz7QAAAII"]
[Thu Dec 11 20:57:22.979275 2025] [:error] [pid 58814:tid 58826] [client 4.190.219.196:39434] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aTq_stiz0l9AD_3pkMw3xAAAAco"]
[Thu Dec 11 20:57:24.260420 2025] [:error] [pid 58099:tid 58108] [client 4.190.219.196:33078] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aTq_tMKZVSF_bdPFqRgaJAAAAMc"]
[Thu Dec 11 20:57:25.918846 2025] [:error] [pid 58814:tid 58831] [client 4.190.219.196:7253] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aTq_tdiz0l9AD_3pkMw3ygAAAc8"]
[Thu Dec 11 20:57:27.014435 2025] [:error] [pid 48261:tid 48268] [client 4.190.219.196:39428] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aTq_t-yPI4WU-4JmiQPCzQAAAYQ"]
[Thu Dec 11 20:57:28.068379 2025] [:error] [pid 57990:tid 58013] [client 4.190.219.196:34529] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aTq_uAqZT_dc36fQdXGFnQAAABI"]
[Thu Dec 11 20:57:28.903217 2025] [:error] [pid 57990:tid 58001] [client 4.190.219.196:61551] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aTq_uAqZT_dc36fQdXGFnwAAAAY"]
[Thu Dec 11 20:57:29.301536 2025] [:error] [pid 57991:tid 58029] [client 4.190.219.196:33741] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aTq_uaPyGmNXA2ZsETa5PQAAAEc"]
[Thu Dec 11 20:57:29.920496 2025] [:error] [pid 58814:tid 58823] [client 4.190.219.196:58903] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aTq_udiz0l9AD_3pkMw31gAAAcc"]
[Thu Dec 11 20:57:31.281238 2025] [:error] [pid 58099:tid 58122] [client 4.190.219.196:31856] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aTq_u8KZVSF_bdPFqRgaKQAAANU"]
[Thu Dec 11 20:57:32.568205 2025] [:error] [pid 27459:tid 27478] [client 4.190.219.196:53338] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aTq_vFhPEXihPBKMpRNgrwAAARE"]
[Thu Dec 11 20:57:33.400117 2025] [:error] [pid 57992:tid 58069] [client 4.190.219.196:61510] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cyanamids.php"] [unique_id "aTq_veUeau0BMFF2vHmz8AAAAJQ"]
[Thu Dec 11 20:57:34.788196 2025] [:error] [pid 24527:tid 24570] [client 4.190.219.196:40556] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cyanamids.php"] [unique_id "aTq_vl9_glvtS5vXiTUK6AAAAo4"]
[Thu Dec 11 20:57:35.611189 2025] [:error] [pid 57990:tid 58009] [client 4.190.219.196:40538] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cyanamids.php"] [unique_id "aTq_vwqZT_dc36fQdXGFqgAAAA4"]
[Thu Dec 11 20:57:36.845114 2025] [:error] [pid 27459:tid 27481] [client 4.190.219.196:7297] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cyanamids.php"] [unique_id "aTq_wFhPEXihPBKMpRNgswAAARQ"]
[Thu Dec 11 20:57:37.505356 2025] [:error] [pid 58814:tid 58818] [client 4.190.219.196:43694] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aTq_wdiz0l9AD_3pkMw33AAAAcI"]
[Thu Dec 11 20:57:38.164657 2025] [:error] [pid 58099:tid 58115] [client 4.190.219.196:47804] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aTq_wsKZVSF_bdPFqRgaMAAAAM4"]
[Thu Dec 11 20:57:38.798042 2025] [:error] [pid 24483:tid 24493] [client 4.190.219.196:41135] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aTq_wlGHKh2d_uVkopRhVgAAAgg"]
[Thu Dec 11 20:57:39.380895 2025] [:error] [pid 35112:tid 35124] [client 4.190.219.196:40548] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aTq_w59ZpQ0WIeJhsJdsvQAAAUo"]
[Thu Dec 11 20:57:39.818138 2025] [:error] [pid 58814:tid 58834] [client 4.190.219.196:61552] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app.php"] [unique_id "aTq_w9iz0l9AD_3pkMw34AAAAdI"]
[Thu Dec 11 20:57:41.205028 2025] [:error] [pid 48261:tid 48287] [client 4.190.219.196:35177] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app.php"] [unique_id "aTq_xeyPI4WU-4JmiQPC0gAAAZc"]
[Thu Dec 11 20:57:42.144446 2025] [:error] [pid 58099:tid 58120] [client 4.190.219.196:43674] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app.php"] [unique_id "aTq_xsKZVSF_bdPFqRgaMwAAANM"]
[Thu Dec 11 20:57:43.111077 2025] [:error] [pid 24527:tid 24563] [client 4.190.219.196:61548] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app.php"] [unique_id "aTq_x19_glvtS5vXiTUK8wAAAoc"]
[Thu Dec 11 20:57:44.558972 2025] [:error] [pid 24527:tid 24567] [client 4.190.219.196:61527] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aTq_yF9_glvtS5vXiTUK9wAAAos"]
[Thu Dec 11 20:57:45.554702 2025] [:error] [pid 24483:tid 24492] [client 4.190.219.196:41121] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aTq_yVGHKh2d_uVkopRhXAAAAgc"]
[Thu Dec 11 20:57:47.493924 2025] [:error] [pid 24527:tid 24559] [client 4.190.219.196:35179] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aTq_y19_glvtS5vXiTUK_gAAAoM"]
[Thu Dec 11 20:57:48.286224 2025] [:error] [pid 24527:tid 24564] [client 4.190.219.196:35195] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aTq_zF9_glvtS5vXiTULAwAAAog"]
[Thu Dec 11 20:57:48.860481 2025] [:error] [pid 35112:tid 35131] [client 4.190.219.196:40514] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aTq_zJ9ZpQ0WIeJhsJdsyAAAAVE"]
[Thu Dec 11 20:57:49.592596 2025] [:error] [pid 35112:tid 35124] [client 4.190.219.196:61516] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aTq_zZ9ZpQ0WIeJhsJdsygAAAUo"]
[Thu Dec 11 20:57:50.133341 2025] [:error] [pid 48261:tid 48278] [client 4.190.219.196:58924] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aTq_zuyPI4WU-4JmiQPC2gAAAY4"]
[Thu Dec 11 20:57:50.733663 2025] [:error] [pid 48261:tid 48267] [client 4.190.219.196:49350] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aTq_zuyPI4WU-4JmiQPC3AAAAYM"]
[Thu Dec 11 20:57:51.598329 2025] [:error] [pid 57990:tid 58012] [client 4.190.219.196:41858] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nof.php"] [unique_id "aTq_zwqZT_dc36fQdXGFuQAAABE"]
[Thu Dec 11 20:57:52.710523 2025] [:error] [pid 48261:tid 48270] [client 4.190.219.196:35163] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nof.php"] [unique_id "aTq_0OyPI4WU-4JmiQPC3gAAAYY"]
[Thu Dec 11 20:57:53.767270 2025] [:error] [pid 48261:tid 48277] [client 4.190.219.196:49347] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nof.php"] [unique_id "aTq_0eyPI4WU-4JmiQPC4AAAAY0"]
[Thu Dec 11 20:57:54.889296 2025] [:error] [pid 58099:tid 58125] [client 4.190.219.196:43665] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nof.php"] [unique_id "aTq_0sKZVSF_bdPFqRgaPgAAANg"]
[Thu Dec 11 20:57:55.478937 2025] [:error] [pid 57991:tid 58030] [client 4.190.219.196:35166] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disengaging.php"] [unique_id "aTq_06PyGmNXA2ZsETa5VQAAAEg"]
[Thu Dec 11 20:57:56.191039 2025] [:error] [pid 24483:tid 24504] [client 4.190.219.196:41871] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disengaging.php"] [unique_id "aTq_1FGHKh2d_uVkopRhaAAAAhM"]
[Thu Dec 11 20:57:56.960861 2025] [:error] [pid 57990:tid 58010] [client 4.190.219.196:40568] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disengaging.php"] [unique_id "aTq_1AqZT_dc36fQdXGFvwAAAA8"]
[Thu Dec 11 20:57:58.010912 2025] [:error] [pid 57990:tid 58017] [client 4.190.219.196:61522] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disengaging.php"] [unique_id "aTq_1gqZT_dc36fQdXGFwgAAABY"]
[Thu Dec 11 20:57:59.199244 2025] [:error] [pid 58099:tid 58115] [client 4.190.219.196:49387] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aTq_18KZVSF_bdPFqRgaRgAAAM4"]
[Thu Dec 11 20:57:59.967928 2025] [:error] [pid 58099:tid 58101] [client 4.190.219.196:40550] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aTq_18KZVSF_bdPFqRgaSAAAAMA"]
[Thu Dec 11 20:58:00.678607 2025] [:error] [pid 35112:tid 35116] [client 4.190.219.196:47751] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aTq_2J9ZpQ0WIeJhsJds2wAAAUI"]
[Thu Dec 11 20:58:01.052817 2025] [:error] [pid 35112:tid 35122] [client 4.190.219.196:43649] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aTq_2Z9ZpQ0WIeJhsJds3QAAAUg"]
[Thu Dec 11 20:58:01.849763 2025] [:error] [pid 24483:tid 24488] [client 4.190.219.196:49373] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unbefittingly.php"] [unique_id "aTq_2VGHKh2d_uVkopRhcAAAAgM"]
[Thu Dec 11 20:58:04.194753 2025] [:error] [pid 27459:tid 27483] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/unbefittingly.php
[Thu Dec 11 20:58:04.345031 2025] [:error] [pid 27459:tid 27470] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Thu Dec 11 20:58:04.471687 2025] [:error] [pid 27459:tid 27461] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Dec 11 20:58:04.598051 2025] [:error] [pid 27459:tid 27485] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/poliomyelopathy.php
[Thu Dec 11 20:58:04.727480 2025] [:error] [pid 27459:tid 27478] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Thu Dec 11 20:58:04.850717 2025] [:error] [pid 27459:tid 27465] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/naxc.php
[Thu Dec 11 20:58:04.976057 2025] [:error] [pid 27459:tid 27473] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Dec 11 20:58:05.384691 2025] [:error] [pid 27459:tid 27476] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Thu Dec 11 20:58:05.507926 2025] [:error] [pid 27459:tid 27463] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Thu Dec 11 20:58:05.632103 2025] [:error] [pid 27459:tid 27484] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Thu Dec 11 20:58:05.757639 2025] [:error] [pid 27459:tid 27467] [client 4.190.219.196:41912] File does not exist: /usr/local/apache/htdocs/suspended-page/disquiet.php
[Thu Dec 11 20:58:05.883753 2025] [:error] [pid 27459:tid 27481] [client 4.190.219.196:41912] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTq_3VhPEXihPBKMpRNg4gAAARQ"]
[Thu Dec 11 20:58:06.754480 2025] [:error] [pid 58099:tid 58107] [client 4.190.219.196:33791] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTq_3sKZVSF_bdPFqRgaUQAAAMY"]
[Thu Dec 11 20:58:07.489932 2025] [:error] [pid 24527:tid 24573] [client 4.190.219.196:40552] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTq_319_glvtS5vXiTULFwAAApE"]
[Thu Dec 11 20:58:07.954798 2025] [:error] [pid 57992:tid 58062] [client 4.190.219.196:43693] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aTq_3-Ueau0BMFF2vHm0HQAAAI0"]
[Thu Dec 11 20:58:08.350495 2025] [:error] [pid 24527:tid 24558] [client 4.190.219.196:40547] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTq_4F9_glvtS5vXiTULGAAAAoI"]
[Thu Dec 11 20:58:08.990315 2025] [:error] [pid 58099:tid 58112] [client 4.190.219.196:43686] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTq_4MKZVSF_bdPFqRgaXAAAAMs"]
[Thu Dec 11 20:58:09.616435 2025] [:error] [pid 58099:tid 58123] [client 4.190.219.196:40526] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTq_4cKZVSF_bdPFqRgaYAAAANY"]
[Thu Dec 11 20:58:10.614020 2025] [:error] [pid 57992:tid 58052] [client 4.190.219.196:47782] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aTq_4uUeau0BMFF2vHm0IAAAAIM"]
[Thu Dec 11 20:58:11.138563 2025] [:error] [pid 48261:tid 48266] [client 4.190.219.196:47746] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/parturiency.php"] [unique_id "aTq_4-yPI4WU-4JmiQPC9QAAAYI"]
[Thu Dec 11 20:58:11.579097 2025] [:error] [pid 58814:tid 58826] [client 4.190.219.196:61527] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/parturiency.php"] [unique_id "aTq_49iz0l9AD_3pkMw4IwAAAco"]
[Thu Dec 11 20:58:12.099446 2025] [:error] [pid 58814:tid 58820] [client 4.190.219.196:40517] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/parturiency.php"] [unique_id "aTq_5Niz0l9AD_3pkMw4JgAAAcQ"]
[Thu Dec 11 20:58:12.732597 2025] [:error] [pid 57990:tid 58007] [client 4.190.219.196:41877] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/parturiency.php"] [unique_id "aTq_5AqZT_dc36fQdXGFzwAAAAw"]
[Thu Dec 11 20:58:13.276879 2025] [:error] [pid 58099:tid 58123] [client 4.190.219.196:41088] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aTq_5cKZVSF_bdPFqRgabgAAANY"]
[Thu Dec 11 20:58:13.666332 2025] [:error] [pid 57991:tid 58035] [client 4.190.219.196:33467] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aTq_5aPyGmNXA2ZsETa5bAAAAE0"]
[Thu Dec 11 20:58:14.177961 2025] [:error] [pid 24527:tid 24560] [client 4.190.219.196:35708] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aTq_5l9_glvtS5vXiTULIAAAAoQ"]
[Thu Dec 11 20:58:15.166807 2025] [:error] [pid 24527:tid 24575] [client 4.190.219.196:43680] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aTq_519_glvtS5vXiTULIgAAApM"]
[Thu Dec 11 20:58:15.991185 2025] [:error] [pid 24527:tid 24572] [client 4.190.219.196:35668] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTq_519_glvtS5vXiTULJAAAApA"]
[Thu Dec 11 20:58:16.907033 2025] [:error] [pid 48261:tid 48268] [client 4.190.219.196:49346] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTq_6OyPI4WU-4JmiQPC-gAAAYQ"]
[Thu Dec 11 20:58:17.547666 2025] [:error] [pid 58099:tid 58116] [client 4.190.219.196:35652] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTq_6cKZVSF_bdPFqRgaeQAAAM8"]
[Thu Dec 11 20:58:17.971268 2025] [:error] [pid 57992:tid 58051] [client 4.190.219.196:35142] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aTq_6eUeau0BMFF2vHm0IwAAAII"]
[Thu Dec 11 20:58:18.285283 2025] [:error] [pid 57992:tid 58055] [client 4.190.219.196:35657] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aTq_6uUeau0BMFF2vHm0JAAAAIY"]
[Thu Dec 11 20:58:18.600826 2025] [:error] [pid 57992:tid 58073] [client 4.190.219.196:41111] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aTq_6uUeau0BMFF2vHm0JQAAAJg"]
[Thu Dec 11 20:58:19.394857 2025] [:error] [pid 24527:tid 24571] [client 4.190.219.196:49359] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aTq_619_glvtS5vXiTULLAAAAo8"]
[Thu Dec 11 20:58:19.872033 2025] [:error] [pid 58814:tid 58817] [client 4.190.219.196:43657] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aTq_69iz0l9AD_3pkMw4LAAAAcE"]
[Thu Dec 11 20:58:20.617325 2025] [:error] [pid 58099:tid 58110] [client 4.190.219.196:45579] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aTq_7MKZVSF_bdPFqRgalAAAAMk"]
[Thu Dec 11 20:58:21.235373 2025] [:error] [pid 58814:tid 58840] [client 4.190.219.196:39780] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aTq_7diz0l9AD_3pkMw4MQAAAdg"]
[Thu Dec 11 20:58:22.050029 2025] [:error] [pid 57990:tid 58005] [client 4.190.219.196:33466] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aTq_7gqZT_dc36fQdXGF0gAAAAo"]
[Thu Dec 11 20:58:22.690372 2025] [:error] [pid 57992:tid 58057] [client 4.190.219.196:35156] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aTq_7uUeau0BMFF2vHm0KAAAAIg"]
[Thu Dec 11 20:58:23.451583 2025] [:error] [pid 58814:tid 58837] [client 4.190.219.196:35144] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aTq_79iz0l9AD_3pkMw4NwAAAdU"]
[Thu Dec 11 20:58:24.504962 2025] [:error] [pid 27459:tid 27475] [client 4.190.219.196:45568] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aTq_8FhPEXihPBKMpRNg9gAAAQ4"]
[Thu Dec 11 20:58:25.077957 2025] [:error] [pid 35112:tid 35138] [client 4.190.219.196:45623] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aTq_8Z9ZpQ0WIeJhsJds5QAAAVg"]
[Thu Dec 11 20:58:25.851165 2025] [:error] [pid 57992:tid 58053] [client 4.190.219.196:47795] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aTq_8eUeau0BMFF2vHm0KwAAAIQ"]
[Thu Dec 11 20:58:26.603164 2025] [:error] [pid 57991:tid 58033] [client 4.190.219.196:7729] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aTq_8qPyGmNXA2ZsETa5jAAAAEs"]
[Thu Dec 11 20:58:27.727396 2025] [:error] [pid 57991:tid 58035] [client 4.190.219.196:43519] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aTq_86PyGmNXA2ZsETa5jQAAAE0"]
[Thu Dec 11 20:58:28.584004 2025] [:error] [pid 58814:tid 58833] [client 4.190.219.196:7721] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aTq_9Niz0l9AD_3pkMw4QAAAAdE"]
[Thu Dec 11 20:58:29.594605 2025] [:error] [pid 57992:tid 58060] [client 4.190.219.196:34103] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aTq_9eUeau0BMFF2vHm0LwAAAIs"]
[Thu Dec 11 20:58:30.150644 2025] [:error] [pid 27459:tid 27461] [client 4.190.219.196:47682] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTq_9lhPEXihPBKMpRNg-wAAAQA"]
[Thu Dec 11 20:58:30.783740 2025] [:error] [pid 57991:tid 58043] [client 4.190.219.196:34855] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTq_9qPyGmNXA2ZsETa5jwAAAFU"]
[Thu Dec 11 20:58:31.468039 2025] [:error] [pid 58814:tid 58839] [client 4.190.219.196:43477] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTq_99iz0l9AD_3pkMw4QgAAAdc"]
[Thu Dec 11 20:58:32.395762 2025] [:error] [pid 35112:tid 35126] [client 4.190.219.196:32351] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aTq_-J9ZpQ0WIeJhsJds7AAAAUw"]
[Thu Dec 11 20:58:32.992263 2025] [:error] [pid 27459:tid 27476] [client 4.190.219.196:7683] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aTq_-FhPEXihPBKMpRNg_gAAAQ8"]
[Thu Dec 11 20:58:33.762007 2025] [:error] [pid 57992:tid 58054] [client 4.190.219.196:34839] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aTq_-eUeau0BMFF2vHm0MwAAAIU"]
[Thu Dec 11 20:58:34.108380 2025] [:error] [pid 24483:tid 24503] [client 4.190.219.196:34087] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aTq_-lGHKh2d_uVkopRhiwAAAhI"]
[Thu Dec 11 20:58:34.823457 2025] [:error] [pid 57991:tid 58042] [client 4.190.219.196:34856] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aTq_-qPyGmNXA2ZsETa5lAAAAFQ"]
[Thu Dec 11 20:58:36.286409 2025] [:error] [pid 58814:tid 58830] [client 4.190.219.196:47692] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z57.php"] [unique_id "aTq__Niz0l9AD_3pkMw4RgAAAc4"]
[Thu Dec 11 20:58:37.261565 2025] [:error] [pid 57990:tid 58016] [client 4.190.219.196:36399] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z57.php"] [unique_id "aTq__QqZT_dc36fQdXGF2wAAABU"]
[Thu Dec 11 20:58:38.454956 2025] [:error] [pid 27459:tid 27477] [client 4.190.219.196:42382] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z57.php"] [unique_id "aTq__lhPEXihPBKMpRNhAAAAARA"]
[Thu Dec 11 20:58:39.324124 2025] [:error] [pid 48261:tid 48283] [client 4.190.219.196:7452] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z57.php"] [unique_id "aTq__-yPI4WU-4JmiQPDHAAAAZM"]
[Thu Dec 11 20:58:40.077281 2025] [:error] [pid 24527:tid 24566] [client 4.190.219.196:58903] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTrAAF9_glvtS5vXiTULPgAAAoo"]
[Thu Dec 11 20:58:40.763593 2025] [:error] [pid 58099:tid 58120] [client 4.190.219.196:57460] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTrAAMKZVSF_bdPFqRgaowAAANM"]
[Thu Dec 11 20:58:41.744183 2025] [:error] [pid 57990:tid 58011] [client 4.190.219.196:31297] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTrAAQqZT_dc36fQdXGF3wAAABA"]
[Thu Dec 11 20:58:42.386987 2025] [:error] [pid 35112:tid 35132] [client 4.190.219.196:36108] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTrAAp9ZpQ0WIeJhsJdtBgAAAVI"]
[Thu Dec 11 20:58:42.853301 2025] [:error] [pid 58814:tid 58816] [client 4.190.219.196:36390] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aTrAAtiz0l9AD_3pkMw4TwAAAcA"]
[Thu Dec 11 20:58:43.526043 2025] [:error] [pid 27459:tid 27464] [client 4.190.219.196:36124] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aTrAA1hPEXihPBKMpRNhBQAAAQM"]
[Thu Dec 11 20:58:44.188200 2025] [:error] [pid 58814:tid 58833] [client 4.190.219.196:44226] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aTrABNiz0l9AD_3pkMw4UQAAAdE"]
[Thu Dec 11 20:58:44.652676 2025] [:error] [pid 35112:tid 35114] [client 4.190.219.196:57468] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aTrABJ9ZpQ0WIeJhsJdtCQAAAUA"]
[Thu Dec 11 20:58:45.532834 2025] [:error] [pid 57992:tid 58057] [client 4.190.219.196:60175] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aTrABeUeau0BMFF2vHm0NwAAAIg"]
[Thu Dec 11 20:58:46.260366 2025] [:error] [pid 58814:tid 58832] [client 4.190.219.196:44255] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aTrABtiz0l9AD_3pkMw4UwAAAdA"]
[Thu Dec 11 20:58:46.818362 2025] [:error] [pid 57992:tid 58066] [client 4.190.219.196:7170] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aTrABuUeau0BMFF2vHm0OQAAAJE"]
[Thu Dec 11 20:58:47.176918 2025] [:error] [pid 57990:tid 58015] [client 4.190.219.196:38087] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aTrABwqZT_dc36fQdXGF7gAAABQ"]
[Thu Dec 11 20:58:47.506948 2025] [:error] [pid 24527:tid 24576] [client 4.190.219.196:7178] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aTrAB19_glvtS5vXiTULRgAAApQ"]
[Thu Dec 11 20:58:47.937630 2025] [:error] [pid 58099:tid 58114] [client 4.190.219.196:40004] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aTrAB8KZVSF_bdPFqRgaqgAAAM0"]
[Thu Dec 11 20:58:48.351401 2025] [:error] [pid 35112:tid 35133] [client 4.190.219.196:39822] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aTrACJ9ZpQ0WIeJhsJdtDAAAAVM"]
[Thu Dec 11 20:58:48.916208 2025] [:error] [pid 58099:tid 58107] [client 4.190.219.196:7441] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aTrACMKZVSF_bdPFqRgarAAAAMY"]
[Thu Dec 11 20:58:49.676537 2025] [:error] [pid 24527:tid 24565] [client 4.190.219.196:7206] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aTrACV9_glvtS5vXiTULSgAAAok"]
[Thu Dec 11 20:58:50.323972 2025] [:error] [pid 57992:tid 58067] [client 4.190.219.196:40055] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aTrACuUeau0BMFF2vHm0QQAAAJI"]
[Thu Dec 11 20:58:51.039870 2025] [:error] [pid 24483:tid 24499] [client 4.190.219.196:44251] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aTrAC1GHKh2d_uVkopRhqwAAAg4"]
[Thu Dec 11 20:58:51.667561 2025] [:error] [pid 27459:tid 27462] [client 4.190.219.196:40030] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aTrAC1hPEXihPBKMpRNhBgAAAQE"]
[Thu Dec 11 20:58:53.173069 2025] [:error] [pid 27459:tid 27478] [client 4.190.219.196:40017] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTrADVhPEXihPBKMpRNhDgAAARE"]
[Thu Dec 11 20:58:54.536534 2025] [:error] [pid 24527:tid 24558] [client 4.190.219.196:7217] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTrADl9_glvtS5vXiTULVwAAAoI"]
[Thu Dec 11 20:58:55.337791 2025] [:error] [pid 57991:tid 58025] [client 4.190.219.196:39842] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTrAD6PyGmNXA2ZsETa5tAAAAEM"]
[Thu Dec 11 20:58:55.972771 2025] [:error] [pid 24483:tid 24492] [client 4.190.219.196:7186] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aTrAD1GHKh2d_uVkopRhsAAAAgc"]
[Thu Dec 11 20:58:56.263444 2025] [:error] [pid 58814:tid 58818] [client 4.190.219.196:7175] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asciferous.php"] [unique_id "aTrAENiz0l9AD_3pkMw4WwAAAcI"]
[Thu Dec 11 20:58:56.757456 2025] [:error] [pid 58814:tid 58835] [client 4.190.219.196:38139] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asciferous.php"] [unique_id "aTrAENiz0l9AD_3pkMw4XAAAAdM"]
[Thu Dec 11 20:58:57.553454 2025] [:error] [pid 24527:tid 24566] [client 4.190.219.196:39825] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asciferous.php"] [unique_id "aTrAEV9_glvtS5vXiTULXQAAAoo"]
[Thu Dec 11 20:58:57.903888 2025] [:error] [pid 57990:tid 58000] [client 4.190.219.196:7228] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asciferous.php"] [unique_id "aTrAEQqZT_dc36fQdXGF9gAAAAU"]
[Thu Dec 11 20:58:58.802674 2025] [:error] [pid 58099:tid 58105] [client 4.190.219.196:45698] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTrAEsKZVSF_bdPFqRgauwAAAMQ"]
[Thu Dec 11 20:59:00.149852 2025] [:error] [pid 58099:tid 58106] [client 4.190.219.196:36769] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTrAFMKZVSF_bdPFqRgawAAAAMU"]
[Thu Dec 11 20:59:01.426745 2025] [:error] [pid 57990:tid 58004] [client 4.190.219.196:50187] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTrAFQqZT_dc36fQdXGF9wAAAAk"]
[Thu Dec 11 20:59:02.951481 2025] [:error] [pid 27459:tid 27468] [client 4.190.219.196:36743] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aTrAFlhPEXihPBKMpRNhHgAAAQc"]
[Thu Dec 11 20:59:03.925587 2025] [:error] [pid 48261:tid 48285] [client 4.190.219.196:36767] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8moue.php"] [unique_id "aTrAF-yPI4WU-4JmiQPDLAAAAZU"]
[Thu Dec 11 20:59:04.536059 2025] [:error] [pid 48261:tid 48276] [client 4.190.219.196:50209] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8moue.php"] [unique_id "aTrAGOyPI4WU-4JmiQPDLgAAAYw"]
[Thu Dec 11 20:59:04.936164 2025] [:error] [pid 57991:tid 58044] [client 4.190.219.196:36792] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8moue.php"] [unique_id "aTrAGKPyGmNXA2ZsETa5wwAAAFY"]
[Thu Dec 11 20:59:05.221603 2025] [:error] [pid 57991:tid 58038] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/f8moue.php
[Thu Dec 11 20:59:05.349111 2025] [:error] [pid 57991:tid 58029] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/fishmen.php
[Thu Dec 11 20:59:05.876282 2025] [:error] [pid 57991:tid 58037] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Thu Dec 11 20:59:06.118929 2025] [:error] [pid 57991:tid 58045] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/coenoecic.php
[Thu Dec 11 20:59:06.244522 2025] [:error] [pid 57991:tid 58043] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Thu Dec 11 20:59:06.374700 2025] [:error] [pid 57991:tid 58028] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-securitiy.php
[Thu Dec 11 20:59:06.503003 2025] [:error] [pid 57991:tid 58041] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Thu Dec 11 20:59:06.647669 2025] [:error] [pid 57991:tid 58035] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Thu Dec 11 20:59:06.781339 2025] [:error] [pid 57991:tid 58023] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/unbalanceable.php
[Thu Dec 11 20:59:08.472709 2025] [:error] [pid 57991:tid 58023] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/obfuscous.php
[Thu Dec 11 20:59:08.844653 2025] [:error] [pid 57991:tid 58024] [client 4.190.219.196:32733] File does not exist: /usr/local/apache/htdocs/suspended-page/phrensying.php
[Thu Dec 11 20:59:08.967360 2025] [:error] [pid 57991:tid 58039] [client 4.190.219.196:32733] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unprecipitously.php"] [unique_id "aTrAHKPyGmNXA2ZsETa52wAAAFE"]
[Thu Dec 11 20:59:09.748140 2025] [:error] [pid 58099:tid 58112] [client 4.190.219.196:40025] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unprecipitously.php"] [unique_id "aTrAHcKZVSF_bdPFqRgayQAAAMs"]
[Thu Dec 11 20:59:10.339823 2025] [:error] [pid 57990:tid 58004] [client 4.190.219.196:32726] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unprecipitously.php"] [unique_id "aTrAHgqZT_dc36fQdXGGBwAAAAk"]
[Thu Dec 11 20:59:10.954021 2025] [:error] [pid 24527:tid 24573] [client 4.190.219.196:7171] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unprecipitously.php"] [unique_id "aTrAHl9_glvtS5vXiTULbQAAApE"]
[Thu Dec 11 20:59:12.105953 2025] [:error] [pid 35112:tid 35127] [client 4.190.219.196:45738] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pyrometry.php"] [unique_id "aTrAIJ9ZpQ0WIeJhsJdtOwAAAU0"]
[Thu Dec 11 20:59:13.353018 2025] [:error] [pid 24483:tid 24485] [client 4.190.219.196:36749] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pyrometry.php"] [unique_id "aTrAIVGHKh2d_uVkopRhyAAAAgA"]
[Thu Dec 11 20:59:13.996448 2025] [:error] [pid 58099:tid 58111] [client 4.190.219.196:36789] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pyrometry.php"] [unique_id "aTrAIcKZVSF_bdPFqRgazAAAAMo"]
[Thu Dec 11 20:59:14.532364 2025] [:error] [pid 58099:tid 58121] [client 4.190.219.196:7203] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pyrometry.php"] [unique_id "aTrAIsKZVSF_bdPFqRga0wAAANQ"]
[Thu Dec 11 20:59:14.944244 2025] [:error] [pid 58099:tid 58116] [client 4.190.219.196:50208] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTrAIsKZVSF_bdPFqRga2AAAAM8"]
[Thu Dec 11 20:59:15.273592 2025] [:error] [pid 27459:tid 27461] [client 4.190.219.196:8000] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTrAI1hPEXihPBKMpRNhMwAAAQA"]
[Thu Dec 11 20:59:15.709038 2025] [:error] [pid 27459:tid 27485] [client 4.190.219.196:40026] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTrAI1hPEXihPBKMpRNhNQAAARg"]
[Thu Dec 11 20:59:16.140385 2025] [:error] [pid 24483:tid 24506] [client 4.190.219.196:60207] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aTrAJFGHKh2d_uVkopRhzAAAAhU"]
[Thu Dec 11 20:59:16.590500 2025] [:error] [pid 27459:tid 27482] [client 4.190.219.196:60211] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aTrAJFhPEXihPBKMpRNhNgAAARU"]
[Thu Dec 11 20:59:17.288307 2025] [:error] [pid 48261:tid 48272] [client 4.190.219.196:60182] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aTrAJeyPI4WU-4JmiQPDPgAAAYg"]
[Thu Dec 11 20:59:18.225352 2025] [:error] [pid 58099:tid 58124] [client 4.190.219.196:7204] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aTrAJsKZVSF_bdPFqRga5gAAANc"]
[Thu Dec 11 20:59:18.711503 2025] [:error] [pid 24527:tid 24561] [client 4.190.219.196:7191] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aTrAJl9_glvtS5vXiTULeQAAAoU"]
[Thu Dec 11 20:59:19.396437 2025] [:error] [pid 48261:tid 48288] [client 4.190.219.196:7227] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oitava.php"] [unique_id "aTrAJ-yPI4WU-4JmiQPDQQAAAZg"]
[Thu Dec 11 20:59:19.810687 2025] [:error] [pid 57990:tid 58019] [client 4.190.219.196:40062] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oitava.php"] [unique_id "aTrAJwqZT_dc36fQdXGGDgAAABg"]
[Thu Dec 11 20:59:20.256644 2025] [:error] [pid 24527:tid 24567] [client 4.190.219.196:50204] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oitava.php"] [unique_id "aTrAKF9_glvtS5vXiTULfAAAAos"]
[Thu Dec 11 20:59:20.918885 2025] [:error] [pid 24527:tid 24577] [client 4.190.219.196:44228] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oitava.php"] [unique_id "aTrAKF9_glvtS5vXiTULgQAAApU"]
[Thu Dec 11 20:59:21.451652 2025] [:error] [pid 57992:tid 58059] [client 4.190.219.196:8005] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aTrAKeUeau0BMFF2vHm0YQAAAIo"]
[Thu Dec 11 20:59:22.367735 2025] [:error] [pid 24527:tid 24566] [client 4.190.219.196:50223] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aTrAKl9_glvtS5vXiTULiQAAAoo"]
[Thu Dec 11 20:59:22.983630 2025] [:error] [pid 58814:tid 58831] [client 4.190.219.196:40017] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aTrAKtiz0l9AD_3pkMw4hgAAAc8"]
[Thu Dec 11 20:59:23.600065 2025] [:error] [pid 35112:tid 35118] [client 4.190.219.196:45701] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aTrAK59ZpQ0WIeJhsJdtSAAAAUQ"]
[Thu Dec 11 20:59:24.489749 2025] [:error] [pid 58099:tid 58109] [client 4.190.219.196:7463] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aTrALMKZVSF_bdPFqRga8AAAAMg"]
[Thu Dec 11 20:59:25.503058 2025] [:error] [pid 24527:tid 24558] [client 4.190.219.196:8051] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aTrALV9_glvtS5vXiTULlQAAAoI"]
[Thu Dec 11 20:59:25.940677 2025] [:error] [pid 57992:tid 58068] [client 4.190.219.196:60215] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aTrALeUeau0BMFF2vHm0ZQAAAJM"]
[Thu Dec 11 20:59:26.393161 2025] [:error] [pid 27459:tid 27473] [client 4.190.219.196:36766] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aTrALlhPEXihPBKMpRNhRgAAAQw"]
[Thu Dec 11 20:59:27.681112 2025] [:error] [pid 24527:tid 24577] [client 4.190.219.196:60212] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aTrAL19_glvtS5vXiTULnAAAApU"]
[Thu Dec 11 20:59:28.026311 2025] [:error] [pid 58099:tid 58101] [client 4.190.219.196:7173] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aTrAMMKZVSF_bdPFqRga-QAAAMA"]
[Thu Dec 11 20:59:29.049256 2025] [:error] [pid 48261:tid 48284] [client 4.190.219.196:60218] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aTrAMeyPI4WU-4JmiQPDTwAAAZQ"]
[Thu Dec 11 20:59:30.131795 2025] [:error] [pid 24483:tid 24494] [client 4.190.219.196:8017] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aTrAMlGHKh2d_uVkopRh2QAAAgk"]
[Thu Dec 11 20:59:30.870880 2025] [:error] [pid 35112:tid 35136] [client 4.190.219.196:32730] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bn.php"] [unique_id "aTrAMp9ZpQ0WIeJhsJdtTQAAAVY"]
[Thu Dec 11 20:59:31.641964 2025] [:error] [pid 27459:tid 27477] [client 4.190.219.196:32739] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bn.php"] [unique_id "aTrAM1hPEXihPBKMpRNhTQAAARA"]
[Thu Dec 11 20:59:33.355031 2025] [:error] [pid 58814:tid 58836] [client 4.190.219.196:40058] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bn.php"] [unique_id "aTrANdiz0l9AD_3pkMw4nAAAAdQ"]
[Thu Dec 11 20:59:34.076709 2025] [:error] [pid 58814:tid 58816] [client 4.190.219.196:38525] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bn.php"] [unique_id "aTrANtiz0l9AD_3pkMw4ngAAAcA"]
[Thu Dec 11 20:59:35.023978 2025] [:error] [pid 58814:tid 58829] [client 4.190.219.196:50238] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTrAN9iz0l9AD_3pkMw4oQAAAc0"]
[Thu Dec 11 20:59:35.368154 2025] [:error] [pid 58814:tid 58821] [client 4.190.219.196:36103] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTrAN9iz0l9AD_3pkMw4qAAAAcU"]
[Thu Dec 11 20:59:36.061396 2025] [:error] [pid 24527:tid 24578] [client 4.190.219.196:60164] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTrAOF9_glvtS5vXiTULqgAAApY"]
[Thu Dec 11 20:59:36.380060 2025] [:error] [pid 57992:tid 58057] [client 4.190.219.196:36757] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aTrAOOUeau0BMFF2vHm0cgAAAIg"]
[Thu Dec 11 20:59:37.107329 2025] [:error] [pid 35112:tid 35135] [client 4.190.219.196:50236] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edd.php"] [unique_id "aTrAOZ9ZpQ0WIeJhsJdtUgAAAVU"]
[Thu Dec 11 20:59:37.725746 2025] [:error] [pid 35112:tid 35125] [client 4.190.219.196:8030] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edd.php"] [unique_id "aTrAOZ9ZpQ0WIeJhsJdtUwAAAUs"]
[Thu Dec 11 20:59:38.050380 2025] [:error] [pid 57991:tid 58024] [client 4.190.219.196:7188] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edd.php"] [unique_id "aTrAOqPyGmNXA2ZsETa59QAAAEI"]
[Thu Dec 11 20:59:38.492631 2025] [:error] [pid 48261:tid 48280] [client 4.190.219.196:60213] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edd.php"] [unique_id "aTrAOuyPI4WU-4JmiQPDZwAAAZA"]
[Thu Dec 11 20:59:39.188342 2025] [:error] [pid 27459:tid 27480] [client 4.190.219.196:60167] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aTrAO1hPEXihPBKMpRNhVQAAARM"]
[Thu Dec 11 20:59:39.715165 2025] [:error] [pid 27459:tid 27464] [client 4.190.219.196:45737] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aTrAO1hPEXihPBKMpRNhWAAAAQM"]
[Thu Dec 11 20:59:40.608832 2025] [:error] [pid 48261:tid 48270] [client 4.190.219.196:32712] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aTrAPOyPI4WU-4JmiQPDagAAAYY"]
[Thu Dec 11 20:59:41.234162 2025] [:error] [pid 57990:tid 58008] [client 4.190.219.196:7172] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "aTrAPQqZT_dc36fQdXGGJAAAAA0"]
[Thu Dec 11 20:59:41.567834 2025] [:error] [pid 24527:tid 24577] [client 4.190.219.196:45752] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aTrAPV9_glvtS5vXiTULvwAAApU"]
[Thu Dec 11 20:59:42.151430 2025] [:error] [pid 48261:tid 48287] [client 4.190.219.196:50231] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aTrAPuyPI4WU-4JmiQPDcgAAAZc"]
[Thu Dec 11 20:59:42.562675 2025] [:error] [pid 57991:tid 58029] [client 4.190.219.196:40059] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aTrAPqPyGmNXA2ZsETa59gAAAEc"]
[Thu Dec 11 20:59:43.309635 2025] [:error] [pid 57990:tid 58003] [client 4.190.219.196:60223] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aTrAPwqZT_dc36fQdXGGKAAAAAg"]
[Thu Dec 11 20:59:43.816305 2025] [:error] [pid 24527:tid 24561] [client 4.190.219.196:36776] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdrex.php"] [unique_id "aTrAP19_glvtS5vXiTULxwAAAoU"]
[Thu Dec 11 20:59:44.186062 2025] [:error] [pid 57990:tid 58010] [client 4.190.219.196:60208] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdrex.php"] [unique_id "aTrAQAqZT_dc36fQdXGGKQAAAA8"]
[Thu Dec 11 20:59:44.538642 2025] [:error] [pid 35112:tid 35119] [client 4.190.219.196:50188] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdrex.php"] [unique_id "aTrAQJ9ZpQ0WIeJhsJdtVAAAAUU"]
[Thu Dec 11 20:59:45.027059 2025] [:error] [pid 24483:tid 24490] [client 4.190.219.196:8009] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdrex.php"] [unique_id "aTrAQVGHKh2d_uVkopRh7gAAAgU"]
[Thu Dec 11 20:59:45.478426 2025] [:error] [pid 57990:tid 58006] [client 4.190.219.196:7187] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTrAQQqZT_dc36fQdXGGKgAAAAs"]
[Thu Dec 11 20:59:45.912918 2025] [:error] [pid 57990:tid 58014] [client 4.190.219.196:36798] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTrAQQqZT_dc36fQdXGGLAAAABM"]
[Thu Dec 11 20:59:46.404251 2025] [:error] [pid 58814:tid 58838] [client 4.190.219.196:36765] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTrAQtiz0l9AD_3pkMw4tAAAAdY"]
[Thu Dec 11 20:59:46.982749 2025] [:error] [pid 27459:tid 27464] [client 4.190.219.196:50226] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aTrAQlhPEXihPBKMpRNhaAAAAQM"]
[Thu Dec 11 20:59:47.642851 2025] [:error] [pid 58814:tid 58833] [client 4.190.219.196:38492] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTrAQ9iz0l9AD_3pkMw4uAAAAdE"]
[Thu Dec 11 20:59:48.181306 2025] [:error] [pid 27459:tid 27479] [client 4.190.219.196:40044] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTrARFhPEXihPBKMpRNhawAAARI"]
[Thu Dec 11 20:59:48.850476 2025] [:error] [pid 27459:tid 27471] [client 4.190.219.196:36368] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTrARFhPEXihPBKMpRNhbwAAAQo"]
[Thu Dec 11 20:59:49.475276 2025] [:error] [pid 27459:tid 27485] [client 4.190.219.196:38524] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aTrARVhPEXihPBKMpRNhcgAAARg"]
[Thu Dec 11 20:59:49.924473 2025] [:error] [pid 57991:tid 58037] [client 4.190.219.196:32709] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTrARaPyGmNXA2ZsETa5_AAAAE8"]
[Thu Dec 11 20:59:50.635362 2025] [:error] [pid 58814:tid 58839] [client 4.190.219.196:38484] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTrARtiz0l9AD_3pkMw4ugAAAdc"]
[Thu Dec 11 20:59:51.707437 2025] [:error] [pid 24483:tid 24508] [client 4.190.219.196:38499] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTrAR1GHKh2d_uVkopRh_AAAAhc"]
[Thu Dec 11 20:59:52.515131 2025] [:error] [pid 24527:tid 24557] [client 4.190.219.196:32719] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aTrASF9_glvtS5vXiTUL0QAAAoE"]
[Thu Dec 11 20:59:53.218343 2025] [:error] [pid 27459:tid 27479] [client 4.190.219.196:36780] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn_sub.php"] [unique_id "aTrASVhPEXihPBKMpRNheQAAARI"]
[Thu Dec 11 20:59:54.225878 2025] [:error] [pid 24527:tid 24565] [client 4.190.219.196:60221] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn_sub.php"] [unique_id "aTrASl9_glvtS5vXiTUL1QAAAok"]
[Thu Dec 11 20:59:55.205687 2025] [:error] [pid 24527:tid 24576] [client 4.190.219.196:8032] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn_sub.php"] [unique_id "aTrAS19_glvtS5vXiTUL2gAAApQ"]
[Thu Dec 11 20:59:57.004534 2025] [:error] [pid 27459:tid 27471] [client 4.190.219.196:8062] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn_sub.php"] [unique_id "aTrATVhPEXihPBKMpRNhfgAAAQo"]
[Thu Dec 11 20:59:57.949294 2025] [:error] [pid 57991:tid 58040] [client 4.190.219.196:36793] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muscovadite.php"] [unique_id "aTrATaPyGmNXA2ZsETa6AAAAAFI"]
[Thu Dec 11 20:59:58.449639 2025] [:error] [pid 58814:tid 58837] [client 4.190.219.196:38505] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muscovadite.php"] [unique_id "aTrATtiz0l9AD_3pkMw4yAAAAdU"]
[Thu Dec 11 20:59:58.834188 2025] [:error] [pid 24527:tid 24565] [client 4.190.219.196:38479] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muscovadite.php"] [unique_id "aTrATl9_glvtS5vXiTUL7QAAAok"]
[Thu Dec 11 20:59:59.273446 2025] [:error] [pid 57991:tid 58025] [client 4.190.219.196:38495] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muscovadite.php"] [unique_id "aTrAT6PyGmNXA2ZsETa6AQAAAEM"]
[Thu Dec 11 20:59:59.934725 2025] [:error] [pid 58099:tid 58119] [client 4.190.219.196:40016] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuk.php"] [unique_id "aTrAT8KZVSF_bdPFqRgbDAAAANI"]
[Thu Dec 11 21:00:00.579500 2025] [:error] [pid 58099:tid 58112] [client 4.190.219.196:60174] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuk.php"] [unique_id "aTrAUMKZVSF_bdPFqRgbEAAAAMs"]
[Thu Dec 11 21:00:01.828086 2025] [:error] [pid 58099:tid 58102] [client 4.190.219.196:38510] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuk.php"] [unique_id "aTrAUcKZVSF_bdPFqRgbEwAAAME"]
[Thu Dec 11 21:00:02.484434 2025] [:error] [pid 58814:tid 58824] [client 4.190.219.196:32746] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuk.php"] [unique_id "aTrAUtiz0l9AD_3pkMw4zgAAAcg"]
[Thu Dec 11 21:00:03.808589 2025] [:error] [pid 48261:tid 48266] [client 4.190.219.196:60165] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aTrAU-yPI4WU-4JmiQPDfwAAAYI"]
[Thu Dec 11 21:00:05.851842 2025] [:error] [pid 58814:tid 58828] [client 4.190.219.196:50218] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aTrAVdiz0l9AD_3pkMw42AAAAcw"]
[Thu Dec 11 21:00:07.144253 2025] [:error] [pid 24527:tid 24563] [client 4.190.219.196:32707] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aTrAV19_glvtS5vXiTUL-AAAAoc"]
[Thu Dec 11 21:00:07.893050 2025] [:error] [pid 58099:tid 58101] [client 4.190.219.196:38494] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aTrAV8KZVSF_bdPFqRgbGQAAAMA"]
[Thu Dec 11 21:00:08.530139 2025] [:error] [pid 48261:tid 48280] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/starry.php
[Thu Dec 11 21:00:08.680484 2025] [:error] [pid 48261:tid 48279] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/byp7.php
[Thu Dec 11 21:00:08.805616 2025] [:error] [pid 48261:tid 48265] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/unwattled.php
[Thu Dec 11 21:00:08.934608 2025] [:error] [pid 48261:tid 48270] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Thu Dec 11 21:00:09.072468 2025] [:error] [pid 48261:tid 48271] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/xtt.php
[Thu Dec 11 21:00:09.197946 2025] [:error] [pid 48261:tid 48283] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Thu Dec 11 21:00:09.371865 2025] [:error] [pid 48261:tid 48273] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/diesinker.php
[Thu Dec 11 21:00:09.518624 2025] [:error] [pid 48261:tid 48269] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/dinah.php
[Thu Dec 11 21:00:09.645115 2025] [:error] [pid 48261:tid 48282] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/washland.php
[Thu Dec 11 21:00:09.775542 2025] [:error] [pid 48261:tid 48272] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/prototheria.php
[Thu Dec 11 21:00:10.222570 2025] [:error] [pid 48261:tid 48286] [client 4.190.219.196:36795] File does not exist: /usr/local/apache/htdocs/suspended-page/microspore.php
[Thu Dec 11 21:00:10.350802 2025] [:error] [pid 48261:tid 48284] [client 4.190.219.196:36795] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc2.php"] [unique_id "aTrAWuyPI4WU-4JmiQPDjQAAAZQ"]
[Thu Dec 11 21:00:11.161030 2025] [:error] [pid 48261:tid 48277] [client 4.190.219.196:44259] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc2.php"] [unique_id "aTrAW-yPI4WU-4JmiQPDjwAAAY0"]
[Thu Dec 11 21:00:11.623808 2025] [:error] [pid 35112:tid 35136] [client 4.190.219.196:40004] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc2.php"] [unique_id "aTrAW59ZpQ0WIeJhsJdtcAAAAVY"]
[Thu Dec 11 21:00:11.935476 2025] [:error] [pid 57991:tid 58032] [client 4.190.219.196:60214] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc2.php"] [unique_id "aTrAW6PyGmNXA2ZsETa6CwAAAEo"]
[Thu Dec 11 21:00:12.604182 2025] [:error] [pid 57991:tid 58022] [client 4.190.219.196:45723] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn.php"] [unique_id "aTrAXKPyGmNXA2ZsETa6DAAAAEA"]
[Thu Dec 11 21:00:13.314430 2025] [:error] [pid 27459:tid 27477] [client 4.190.219.196:60168] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn.php"] [unique_id "aTrAXVhPEXihPBKMpRNhhgAAARA"]
[Thu Dec 11 21:00:13.965448 2025] [:error] [pid 27459:tid 27474] [client 4.190.219.196:36775] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn.php"] [unique_id "aTrAXVhPEXihPBKMpRNhhwAAAQ0"]
[Thu Dec 11 21:00:14.441659 2025] [:error] [pid 57990:tid 58015] [client 4.190.219.196:32749] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2co_ipn.php"] [unique_id "aTrAXgqZT_dc36fQdXGGMQAAABQ"]
[Thu Dec 11 21:00:14.798396 2025] [:error] [pid 27459:tid 27472] [client 4.190.219.196:32731] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/speculative.php"] [unique_id "aTrAXlhPEXihPBKMpRNhiQAAAQs"]
[Thu Dec 11 21:00:15.290018 2025] [:error] [pid 57992:tid 58060] [client 4.190.219.196:8020] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/speculative.php"] [unique_id "aTrAX-Ueau0BMFF2vHm0hQAAAIs"]
[Thu Dec 11 21:00:15.842505 2025] [:error] [pid 57991:tid 58025] [client 4.190.219.196:38526] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/speculative.php"] [unique_id "aTrAX6PyGmNXA2ZsETa6EQAAAEM"]
[Thu Dec 11 21:00:16.722243 2025] [:error] [pid 57992:tid 58065] [client 4.190.219.196:36741] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/speculative.php"] [unique_id "aTrAYOUeau0BMFF2vHm0hwAAAJA"]
[Thu Dec 11 21:00:17.339963 2025] [:error] [pid 48261:tid 48275] [client 4.190.219.196:32766] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aTrAYeyPI4WU-4JmiQPDkAAAAYs"]
[Thu Dec 11 21:00:17.942412 2025] [:error] [pid 24527:tid 24562] [client 4.190.219.196:36773] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aTrAYV9_glvtS5vXiTUMBwAAAoY"]
[Thu Dec 11 21:00:18.367064 2025] [:error] [pid 58814:tid 58816] [client 4.190.219.196:32722] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aTrAYtiz0l9AD_3pkMw46gAAAcA"]
[Thu Dec 11 21:00:18.883087 2025] [:error] [pid 48261:tid 48281] [client 4.190.219.196:8013] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aTrAYuyPI4WU-4JmiQPDlAAAAZE"]
[Thu Dec 11 21:00:19.297497 2025] [:error] [pid 58099:tid 58115] [client 4.190.219.196:34452] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/krypton.php"] [unique_id "aTrAY8KZVSF_bdPFqRgbHwAAAM4"]
[Thu Dec 11 21:00:20.294293 2025] [:error] [pid 48261:tid 48270] [client 4.190.219.196:36744] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/krypton.php"] [unique_id "aTrAZOyPI4WU-4JmiQPDmAAAAYY"]
[Thu Dec 11 21:00:21.263650 2025] [:error] [pid 27459:tid 27482] [client 4.190.219.196:50221] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/krypton.php"] [unique_id "aTrAZVhPEXihPBKMpRNhjgAAARU"]
[Thu Dec 11 21:00:21.841181 2025] [:error] [pid 57991:tid 58023] [client 4.190.219.196:38515] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/krypton.php"] [unique_id "aTrAZaPyGmNXA2ZsETa6EwAAAEE"]
[Thu Dec 11 21:00:22.777780 2025] [:error] [pid 27459:tid 27484] [client 4.190.219.196:8041] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acholuria.php"] [unique_id "aTrAZlhPEXihPBKMpRNhjwAAARc"]
[Thu Dec 11 21:00:23.216042 2025] [:error] [pid 24527:tid 24571] [client 4.190.219.196:50194] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acholuria.php"] [unique_id "aTrAZ19_glvtS5vXiTUMDwAAAo8"]
[Thu Dec 11 21:00:24.139608 2025] [:error] [pid 24527:tid 24556] [client 4.190.219.196:50211] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acholuria.php"] [unique_id "aTrAaF9_glvtS5vXiTUMEQAAAoA"]
[Thu Dec 11 21:00:24.536742 2025] [:error] [pid 24527:tid 24559] [client 4.190.219.196:32747] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acholuria.php"] [unique_id "aTrAaF9_glvtS5vXiTUMEgAAAoM"]
[Thu Dec 11 21:00:24.856037 2025] [:error] [pid 27459:tid 27466] [client 4.190.219.196:32763] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTrAaFhPEXihPBKMpRNhkAAAAQU"]
[Thu Dec 11 21:00:25.214317 2025] [:error] [pid 58099:tid 58105] [client 4.190.219.196:32705] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTrAacKZVSF_bdPFqRgbKAAAAMQ"]
[Thu Dec 11 21:00:25.613697 2025] [:error] [pid 24483:tid 24502] [client 4.190.219.196:8034] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTrAaVGHKh2d_uVkopRiBgAAAhE"]
[Thu Dec 11 21:00:26.206497 2025] [:error] [pid 24483:tid 24504] [client 4.190.219.196:36782] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTrAalGHKh2d_uVkopRiBwAAAhM"]
[Thu Dec 11 21:00:26.813906 2025] [:error] [pid 58814:tid 58820] [client 4.190.219.196:8027] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTrAatiz0l9AD_3pkMw47gAAAcQ"]
[Thu Dec 11 21:00:27.387463 2025] [:error] [pid 24527:tid 24578] [client 4.190.219.196:50224] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTrAa19_glvtS5vXiTUMGwAAApY"]
[Thu Dec 11 21:00:28.765423 2025] [:error] [pid 27459:tid 27463] [client 4.190.219.196:40017] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTrAbFhPEXihPBKMpRNhkgAAAQI"]
[Thu Dec 11 21:00:29.155628 2025] [:error] [pid 24527:tid 24558] [client 4.190.219.196:38126] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aTrAbV9_glvtS5vXiTUMHwAAAoI"]
[Thu Dec 11 21:00:29.549985 2025] [:error] [pid 35112:tid 35136] [client 4.190.219.196:38527] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aporrhiegma.php"] [unique_id "aTrAbZ9ZpQ0WIeJhsJdtfQAAAVY"]
[Thu Dec 11 21:00:30.471776 2025] [:error] [pid 57992:tid 58049] [client 4.190.219.196:36746] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aporrhiegma.php"] [unique_id "aTrAbuUeau0BMFF2vHm0igAAAIA"]
[Thu Dec 11 21:00:31.395703 2025] [:error] [pid 24527:tid 24570] [client 4.190.219.196:38420] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aporrhiegma.php"] [unique_id "aTrAb19_glvtS5vXiTUMIwAAAo4"]
[Thu Dec 11 21:00:32.794308 2025] [:error] [pid 58099:tid 58103] [client 4.190.219.196:34458] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aporrhiegma.php"] [unique_id "aTrAcMKZVSF_bdPFqRgbMAAAAMI"]
[Thu Dec 11 21:00:33.838119 2025] [:error] [pid 24527:tid 24567] [client 4.190.219.196:45743] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTrAcV9_glvtS5vXiTUMKAAAAos"]
[Thu Dec 11 21:00:34.732134 2025] [:error] [pid 24527:tid 24571] [client 4.190.219.196:34439] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTrAcl9_glvtS5vXiTUMKgAAAo8"]
[Thu Dec 11 21:00:36.090895 2025] [:error] [pid 57992:tid 58068] [client 4.190.219.196:43016] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTrAdOUeau0BMFF2vHm0jwAAAJM"]
[Thu Dec 11 21:00:36.980323 2025] [:error] [pid 57990:tid 58015] [client 4.190.219.196:8045] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTrAdAqZT_dc36fQdXGGPwAAABQ"]
[Thu Dec 11 21:00:37.638997 2025] [:error] [pid 58814:tid 58821] [client 4.190.219.196:38426] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aTrAddiz0l9AD_3pkMw4_AAAAcU"]
[Thu Dec 11 21:00:38.173510 2025] [:error] [pid 58814:tid 58823] [client 4.190.219.196:34433] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aTrAdtiz0l9AD_3pkMw4_gAAAcc"]
[Thu Dec 11 21:00:39.260006 2025] [:error] [pid 24483:tid 24509] [client 4.190.219.196:54714] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aTrAd1GHKh2d_uVkopRiCwAAAhg"]
[Thu Dec 11 21:00:40.322132 2025] [:error] [pid 24527:tid 24567] [client 4.190.219.196:32318] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aTrAeF9_glvtS5vXiTUMMwAAAos"]
[Thu Dec 11 21:00:41.906643 2025] [:error] [pid 24527:tid 24568] [client 4.190.219.196:45537] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanbai.php"] [unique_id "aTrAeV9_glvtS5vXiTUMOAAAAow"]
[Thu Dec 11 21:00:43.613201 2025] [:error] [pid 24483:tid 24492] [client 4.190.219.196:34916] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanbai.php"] [unique_id "aTrAe1GHKh2d_uVkopRiDQAAAgc"]
[Thu Dec 11 21:00:44.868161 2025] [:error] [pid 48261:tid 48276] [client 4.190.219.196:43001] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanbai.php"] [unique_id "aTrAfOyPI4WU-4JmiQPDtgAAAYw"]
[Thu Dec 11 21:00:46.798231 2025] [:error] [pid 24527:tid 24572] [client 4.190.219.196:8077] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanbai.php"] [unique_id "aTrAfl9_glvtS5vXiTUMPQAAApA"]
[Thu Dec 11 21:00:47.571307 2025] [:error] [pid 58814:tid 58839] [client 4.190.219.196:43605] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aTrAf9iz0l9AD_3pkMw5DgAAAdc"]
[Thu Dec 11 21:00:48.337893 2025] [:error] [pid 58814:tid 58838] [client 4.190.219.196:8096] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aTrAgNiz0l9AD_3pkMw5DwAAAdY"]
[Thu Dec 11 21:00:49.930154 2025] [:error] [pid 57990:tid 57997] [client 4.190.219.196:31264] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aTrAgQqZT_dc36fQdXGGRQAAAAI"]
[Thu Dec 11 21:00:51.082157 2025] [:error] [pid 48261:tid 48288] [client 4.190.219.196:61474] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aTrAg-yPI4WU-4JmiQPDvAAAAZg"]
[Thu Dec 11 21:00:52.443950 2025] [:error] [pid 27459:tid 27467] [client 4.190.219.196:61496] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aTrAhFhPEXihPBKMpRNhqgAAAQY"]
[Thu Dec 11 21:00:53.004382 2025] [:error] [pid 24483:tid 24490] [client 4.190.219.196:37341] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aTrAhVGHKh2d_uVkopRiFgAAAgU"]
[Thu Dec 11 21:00:53.751497 2025] [:error] [pid 58814:tid 58829] [client 4.190.219.196:57381] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aTrAhdiz0l9AD_3pkMw5FQAAAc0"]
[Thu Dec 11 21:00:54.628295 2025] [:error] [pid 58099:tid 58125] [client 4.190.219.196:42948] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl6.php"] [unique_id "aTrAhsKZVSF_bdPFqRgbSAAAANg"]
[Thu Dec 11 21:00:55.704156 2025] [:error] [pid 48261:tid 48277] [client 4.190.219.196:60238] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aTrAh-yPI4WU-4JmiQPDvwAAAY0"]
[Thu Dec 11 21:00:56.466301 2025] [:error] [pid 48261:tid 48280] [client 4.190.219.196:31282] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aTrAiOyPI4WU-4JmiQPDwAAAAZA"]
[Thu Dec 11 21:00:57.247822 2025] [:error] [pid 27459:tid 27476] [client 4.190.219.196:41809] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aTrAiVhPEXihPBKMpRNhsQAAAQ8"]
[Thu Dec 11 21:00:57.673285 2025] [:error] [pid 58814:tid 58826] [client 4.190.219.196:36848] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aTrAidiz0l9AD_3pkMw5GwAAAco"]
[Thu Dec 11 21:00:58.524485 2025] [:error] [pid 24483:tid 24485] [client 4.190.219.196:31245] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTrAilGHKh2d_uVkopRiGgAAAgA"]
[Thu Dec 11 21:00:59.546631 2025] [:error] [pid 48261:tid 48264] [client 4.190.219.196:33741] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTrAi-yPI4WU-4JmiQPDyQAAAYA"]
[Thu Dec 11 21:01:00.052242 2025] [:error] [pid 58814:tid 58817] [client 4.190.219.196:44908] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTrAjNiz0l9AD_3pkMw5HgAAAcE"]
[Thu Dec 11 21:01:01.348366 2025] [:error] [pid 58099:tid 58113] [client 4.190.219.196:35091] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aTrAjcKZVSF_bdPFqRgbWwAAAMw"]
[Thu Dec 11 21:01:02.805039 2025] [:error] [pid 58814:tid 58840] [client 4.190.219.196:37311] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boyfile.php"] [unique_id "aTrAjtiz0l9AD_3pkMw5IgAAAdg"]
[Thu Dec 11 21:01:04.231859 2025] [:error] [pid 58099:tid 58115] [client 4.190.219.196:44887] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boyfile.php"] [unique_id "aTrAkMKZVSF_bdPFqRgbXgAAAM4"]
[Thu Dec 11 21:01:05.443875 2025] [:error] [pid 24527:tid 24580] [client 4.190.219.196:27110] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boyfile.php"] [unique_id "aTrAkV9_glvtS5vXiTUMXAAAApg"]
[Thu Dec 11 21:01:06.715644 2025] [:error] [pid 48261:tid 48267] [client 4.190.219.196:37303] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boyfile.php"] [unique_id "aTrAkuyPI4WU-4JmiQPDzgAAAYM"]
[Thu Dec 11 21:01:07.421673 2025] [:error] [pid 24527:tid 24556] [client 4.190.219.196:7527] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aTrAk19_glvtS5vXiTUMXgAAAoA"]
[Thu Dec 11 21:01:08.263602 2025] [:error] [pid 58099:tid 58117] [client 4.190.219.196:37305] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aTrAlMKZVSF_bdPFqRgbXwAAANA"]
[Thu Dec 11 21:01:09.300498 2025] [:error] [pid 24527:tid 24559] [client 4.190.219.196:7546] [client 4.190.219.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aTrAlV9_glvtS5vXiTUMYgAAAoM"]
[Thu Dec 11 21:01:10.450977 2025] [:error] [pid 58099:tid 58120] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/atex1.php
[Thu Dec 11 21:01:11.108726 2025] [:error] [pid 58099:tid 58108] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/attaining.php
[Thu Dec 11 21:01:11.267881 2025] [:error] [pid 58099:tid 58112] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/bunnies.php
[Thu Dec 11 21:01:11.396326 2025] [:error] [pid 58099:tid 58113] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/frenchwomen.php
[Thu Dec 11 21:01:11.547170 2025] [:error] [pid 58099:tid 58103] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/glucosidase.php
[Thu Dec 11 21:01:12.150636 2025] [:error] [pid 58099:tid 58103] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/modernize.php
[Thu Dec 11 21:01:12.280984 2025] [:error] [pid 58099:tid 58111] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/twohandedness.php
[Thu Dec 11 21:01:12.620865 2025] [:error] [pid 58099:tid 58104] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/undigitated.php
[Thu Dec 11 21:01:12.752642 2025] [:error] [pid 58099:tid 58122] [client 4.190.219.196:7615] File does not exist: /usr/local/apache/htdocs/suspended-page/unsafer.php
[Thu Dec 11 22:07:16.924641 2025] [:error] [pid 35112:tid 35130] [client 172.192.13.142:9809] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php, referer: https://www.bing.com/
[Thu Dec 11 22:07:17.166718 2025] [:error] [pid 35112:tid 35129] [client 172.192.13.142:9809] File does not exist: /usr/local/apache/htdocs/suspended-page/browse.php, referer: https://duckduckgo.com/
[Thu Dec 11 22:07:19.028960 2025] [:error] [pid 35112:tid 35123] [client 172.192.13.142:9809] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aTrQF59ZpQ0WIeJhsJd37QAAAUk"], referer: https://www.yahoo.com/
[Thu Dec 11 22:07:19.261147 2025] [:error] [pid 58099:tid 58104] [client 172.192.13.142:3723] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aTrQF8KZVSF_bdPFqRgo6QAAAMM"], referer: https://duckduckgo.com/
[Thu Dec 11 22:07:19.495638 2025] [:error] [pid 58814:tid 58816] [client 172.192.13.142:3740] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aTrQF9iz0l9AD_3pkMxRIgAAAcA"], referer: https://www.bing.com/
[Thu Dec 11 22:07:20.812767 2025] [:error] [pid 58814:tid 58831] [client 172.192.13.142:11135] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aTrQGNiz0l9AD_3pkMxRNQAAAc8"], referer: https://www.google.com/
[Thu Dec 11 22:07:21.892624 2025] [:error] [pid 35112:tid 35120] [client 172.192.13.142:2259] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.bing.com/
[Thu Dec 11 22:07:22.127826 2025] [:error] [pid 35112:tid 35137] [client 172.192.13.142:2259] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aTrQGp9ZpQ0WIeJhsJd3-QAAAVc"], referer: https://www.google.de/
[Thu Dec 11 22:07:22.484279 2025] [:error] [pid 48261:tid 48277] [client 172.192.13.142:2634] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aTrQGuyPI4WU-4JmiQPPtwAAAY0"], referer: https://www.google.com/
[Thu Dec 11 22:07:22.716743 2025] [:error] [pid 57990:tid 57997] [client 172.192.13.142:2291] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aTrQGgqZT_dc36fQdXGRJgAAAAI"], referer: https://www.google.com/
[Thu Dec 11 22:07:23.023276 2025] [:error] [pid 35112:tid 35115] [client 172.192.13.142:2261] [client 172.192.13.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aTrQG59ZpQ0WIeJhsJd3-gAAAUE"], referer: https://duckduckgo.com/
[Thu Dec 11 23:44:43.160202 2025] [:error] [pid 4911:tid 4924] [client 187.40.198.124:57995] [client 187.40.198.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.40.198.124, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aTrm6w-tKegTX9jNpJksQgAAAUo"]
[Thu Dec 11 23:44:43.166431 2025] [:error] [pid 4911:tid 4924] [client 187.40.198.124:57995] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Dec 12 03:08:23.329954 2025] [:error] [pid 48020:tid 48033] [client 45.8.17.114:20417] [client 45.8.17.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.114, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aTsWp0MEnZ0Mte0EP2mb0wAAAcs"]
[Fri Dec 12 03:08:23.333815 2025] [:error] [pid 48020:tid 48033] [client 45.8.17.114:20417] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Dec 12 08:48:04.400545 2025] [:error] [pid 26520:tid 26565] [client 185.112.59.5:61025] [client 185.112.59.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTtmREG_frlY5vNXu_B--gAAAE0"]
[Fri Dec 12 20:01:19.721524 2025] [:error] [pid 26519:tid 26528] [client 20.18.142.105:12113] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Dec 12 20:01:19.845772 2025] [:error] [pid 26519:tid 26524] [client 20.18.142.105:12113] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Fri Dec 12 20:01:19.978702 2025] [:error] [pid 26519:tid 26534] [client 20.18.142.105:12113] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Dec 12 20:01:20.126168 2025] [:error] [pid 26519:tid 26541] [client 20.18.142.105:12113] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Dec 12 20:01:20.266973 2025] [:error] [pid 26519:tid 26536] [client 20.18.142.105:12113] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Dec 12 20:01:20.387709 2025] [:error] [pid 26519:tid 26530] [client 20.18.142.105:12113] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aTwEEM8TRgSGOeWqEhfpdQAAAAc"]
[Fri Dec 12 20:01:21.608924 2025] [:error] [pid 55760:tid 55774] [client 20.18.142.105:11374] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aTwEEVObDQlftFDyGawC2wAAAYw"]
[Fri Dec 12 20:01:22.368450 2025] [:error] [pid 55760:tid 55782] [client 20.18.142.105:11362] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Fri Dec 12 20:01:22.495270 2025] [:error] [pid 55760:tid 55775] [client 20.18.142.105:11362] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Dec 12 20:01:22.619833 2025] [:error] [pid 55760:tid 55778] [client 20.18.142.105:11362] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Fri Dec 12 20:01:22.838190 2025] [:error] [pid 55760:tid 55780] [client 20.18.142.105:11362] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTwEElObDQlftFDyGawC4gAAAZI"]
[Fri Dec 12 20:01:23.207776 2025] [:error] [pid 55760:tid 55762] [client 20.18.142.105:11337] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTwEE1ObDQlftFDyGawC5gAAAYA"]
[Fri Dec 12 20:01:23.785826 2025] [:error] [pid 26607:tid 26609] [client 20.18.142.105:11387] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTwEE8b_b0tOEWTL2KmQWwAAAMA"]
[Fri Dec 12 20:01:24.292066 2025] [:error] [pid 26607:tid 26615] [client 20.18.142.105:11371] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aTwEFMb_b0tOEWTL2KmQXAAAAMY"]
[Fri Dec 12 20:01:25.855291 2025] [:error] [pid 26607:tid 26619] [client 20.18.142.105:12110] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTwEFcb_b0tOEWTL2KmQXwAAAMo"]
[Fri Dec 12 20:01:26.507648 2025] [:error] [pid 26520:tid 26559] [client 20.18.142.105:11329] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTwEFkG_frlY5vNXu_Dw6gAAAEc"]
[Fri Dec 12 20:01:27.257533 2025] [:error] [pid 26521:tid 26598] [client 20.18.142.105:12120] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTwEF5dhcAPU617AKTBsYgAAAJM"]
[Fri Dec 12 20:01:27.838643 2025] [:error] [pid 60649:tid 60676] [client 20.18.142.105:12119] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aTwEF1OcUGKU3sgfHP_tbAAAARg"]
[Fri Dec 12 20:01:28.263897 2025] [:error] [pid 26607:tid 26613] [client 20.18.142.105:12122] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aTwEGMb_b0tOEWTL2KmQYwAAAMQ"]
[Fri Dec 12 20:01:28.887888 2025] [:error] [pid 26607:tid 26628] [client 20.18.142.105:11339] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aTwEGMb_b0tOEWTL2KmQaQAAANM"]
[Fri Dec 12 20:01:29.343692 2025] [:error] [pid 27950:tid 27953] [client 20.18.142.105:11744] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aTwEGYVLRvkrdsSc1F2QHgAAAUE"]
[Fri Dec 12 20:01:30.153341 2025] [:error] [pid 27950:tid 27960] [client 20.18.142.105:11328] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aTwEGoVLRvkrdsSc1F2QKQAAAUg"]
[Fri Dec 12 20:01:31.400819 2025] [:error] [pid 26607:tid 26613] [client 20.18.142.105:11366] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aTwEG8b_b0tOEWTL2KmQcwAAAMQ"]
[Fri Dec 12 20:01:32.839169 2025] [:error] [pid 27950:tid 27952] [client 20.18.142.105:12107] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTwEHIVLRvkrdsSc1F2QLwAAAUA"]
[Fri Dec 12 20:01:34.159465 2025] [:error] [pid 26520:tid 26552] [client 20.18.142.105:11738] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTwEHkG_frlY5vNXu_Dw9gAAAEA"]
[Fri Dec 12 20:01:34.939949 2025] [:error] [pid 60649:tid 60652] [client 20.18.142.105:12116] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTwEHlOcUGKU3sgfHP_tcgAAAQA"]
[Fri Dec 12 20:01:35.555186 2025] [:error] [pid 27950:tid 27962] [client 20.18.142.105:11349] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aTwEH4VLRvkrdsSc1F2QOgAAAUo"]
[Fri Dec 12 20:01:36.567958 2025] [:error] [pid 55760:tid 55764] [client 20.18.142.105:11384] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTwEIFObDQlftFDyGawC-QAAAYI"]
[Fri Dec 12 20:01:37.579093 2025] [:error] [pid 55760:tid 55771] [client 20.18.142.105:11390] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTwEIVObDQlftFDyGawC_AAAAYk"]
[Fri Dec 12 20:01:38.229431 2025] [:error] [pid 27950:tid 27966] [client 20.18.142.105:12108] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTwEIoVLRvkrdsSc1F2QPgAAAU4"]
[Fri Dec 12 20:01:38.588292 2025] [:error] [pid 55760:tid 55767] [client 20.18.142.105:12139] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aTwEIlObDQlftFDyGawC_wAAAYU"]
[Fri Dec 12 20:01:39.499851 2025] [:error] [pid 26607:tid 26624] [client 20.18.142.105:11732] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwEI8b_b0tOEWTL2KmQewAAAM8"]
[Fri Dec 12 20:01:40.256010 2025] [:error] [pid 26521:tid 26583] [client 20.18.142.105:11350] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwEJJdhcAPU617AKTBsfAAAAIQ"]
[Fri Dec 12 20:01:40.803458 2025] [:error] [pid 26521:tid 26589] [client 20.18.142.105:11340] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwEJJdhcAPU617AKTBsfwAAAIo"]
[Fri Dec 12 20:01:41.249726 2025] [:error] [pid 55760:tid 55784] [client 20.18.142.105:12150] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwEJVObDQlftFDyGawDBgAAAZY"]
[Fri Dec 12 20:01:42.091097 2025] [:error] [pid 26521:tid 26598] [client 20.18.142.105:12098] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aTwEJpdhcAPU617AKTBsgQAAAJM"]
[Fri Dec 12 20:01:43.044238 2025] [:error] [pid 26521:tid 26581] [client 20.18.142.105:12126] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aTwEJ5dhcAPU617AKTBshAAAAII"]
[Fri Dec 12 20:01:43.555836 2025] [:error] [pid 55760:tid 55766] [client 20.18.142.105:11375] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aTwEJ1ObDQlftFDyGawDCgAAAYQ"]
[Fri Dec 12 20:01:44.017122 2025] [:error] [pid 26520:tid 26558] [client 20.18.142.105:12096] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aTwEKEG_frlY5vNXu_DxBQAAAEY"]
[Fri Dec 12 20:01:44.541410 2025] [:error] [pid 60649:tid 60657] [client 20.18.142.105:11391] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aTwEKFOcUGKU3sgfHP_tegAAAQU"]
[Fri Dec 12 20:01:45.290881 2025] [:error] [pid 26521:tid 26601] [client 20.18.142.105:11380] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTwEKZdhcAPU617AKTBsiAAAAJY"]
[Fri Dec 12 20:01:46.156613 2025] [:error] [pid 26521:tid 26589] [client 20.18.142.105:11763] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTwEKpdhcAPU617AKTBsiwAAAIo"]
[Fri Dec 12 20:01:46.536213 2025] [:error] [pid 26521:tid 26585] [client 20.18.142.105:11341] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTwEKpdhcAPU617AKTBsjAAAAIY"]
[Fri Dec 12 20:01:47.081659 2025] [:error] [pid 55760:tid 55764] [client 20.18.142.105:11358] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aTwEK1ObDQlftFDyGawDFwAAAYI"]
[Fri Dec 12 20:01:47.446375 2025] [:error] [pid 55760:tid 55767] [client 20.18.142.105:11338] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwEK1ObDQlftFDyGawDGQAAAYU"]
[Fri Dec 12 20:01:48.597367 2025] [:error] [pid 55760:tid 55762] [client 20.18.142.105:11379] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwELFObDQlftFDyGawDHgAAAYA"]
[Fri Dec 12 20:01:48.947502 2025] [:error] [pid 26607:tid 26625] [client 20.18.142.105:11357] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwELMb_b0tOEWTL2KmQfgAAANA"]
[Fri Dec 12 20:01:49.401340 2025] [:error] [pid 60649:tid 60663] [client 20.18.142.105:12127] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwELVOcUGKU3sgfHP_tgQAAAQs"]
[Fri Dec 12 20:01:49.923911 2025] [:error] [pid 27950:tid 27972] [client 20.18.142.105:12114] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aTwELYVLRvkrdsSc1F2QRgAAAVQ"]
[Fri Dec 12 20:01:50.388472 2025] [:error] [pid 26521:tid 26583] [client 20.18.142.105:11376] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aTwELpdhcAPU617AKTBskAAAAIQ"]
[Fri Dec 12 20:01:51.454820 2025] [:error] [pid 55760:tid 55766] [client 20.18.142.105:11372] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aTwEL1ObDQlftFDyGawDJgAAAYQ"]
[Fri Dec 12 20:01:51.959057 2025] [:error] [pid 26521:tid 26585] [client 20.18.142.105:11381] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aTwEL5dhcAPU617AKTBslgAAAIY"]
[Fri Dec 12 20:01:52.382868 2025] [:error] [pid 26521:tid 26593] [client 20.18.142.105:11377] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEMJdhcAPU617AKTBsmAAAAI4"]
[Fri Dec 12 20:01:53.530797 2025] [:error] [pid 26520:tid 26566] [client 20.18.142.105:12124] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEMUG_frlY5vNXu_DxCgAAAE4"]
[Fri Dec 12 20:01:54.419305 2025] [:error] [pid 26607:tid 26612] [client 20.18.142.105:12125] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEMsb_b0tOEWTL2KmQiAAAAMM"]
[Fri Dec 12 20:01:55.199947 2025] [:error] [pid 26607:tid 26624] [client 20.18.142.105:11363] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEM8b_b0tOEWTL2KmQiQAAAM8"]
[Fri Dec 12 20:01:56.242115 2025] [:error] [pid 55760:tid 55775] [client 20.18.142.105:11385] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTwENFObDQlftFDyGawDKwAAAY0"]
[Fri Dec 12 20:01:56.976765 2025] [:error] [pid 55760:tid 55783] [client 20.18.142.105:11368] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTwENFObDQlftFDyGawDLgAAAZU"]
[Fri Dec 12 20:01:57.499164 2025] [:error] [pid 55760:tid 55785] [client 20.18.142.105:11373] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTwENVObDQlftFDyGawDNAAAAZc"]
[Fri Dec 12 20:01:58.006044 2025] [:error] [pid 26520:tid 26564] [client 20.18.142.105:11335] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aTwENkG_frlY5vNXu_DxGwAAAEw"]
[Fri Dec 12 20:01:58.454046 2025] [:error] [pid 26521:tid 26594] [client 20.18.142.105:11724] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTwENpdhcAPU617AKTBsnQAAAI8"]
[Fri Dec 12 20:01:59.071234 2025] [:error] [pid 26521:tid 26603] [client 20.18.142.105:12156] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTwEN5dhcAPU617AKTBsnwAAAJg"]
[Fri Dec 12 20:01:59.775011 2025] [:error] [pid 55760:tid 55777] [client 20.18.142.105:11378] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTwEN1ObDQlftFDyGawDOwAAAY8"]
[Fri Dec 12 20:02:00.170132 2025] [:error] [pid 27950:tid 27959] [client 20.18.142.105:11386] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aTwEOIVLRvkrdsSc1F2QWgAAAUc"]
[Fri Dec 12 20:02:00.748411 2025] [:error] [pid 26521:tid 26593] [client 20.18.142.105:12147] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTwEOJdhcAPU617AKTBsoAAAAI4"]
[Fri Dec 12 20:02:01.151023 2025] [:error] [pid 26521:tid 26592] [client 20.18.142.105:11342] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTwEOZdhcAPU617AKTBsoQAAAI0"]
[Fri Dec 12 20:02:01.485519 2025] [:error] [pid 55760:tid 55764] [client 20.18.142.105:11383] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTwEOVObDQlftFDyGawDQAAAAYI"]
[Fri Dec 12 20:02:01.895871 2025] [:error] [pid 55760:tid 55762] [client 20.18.142.105:11752] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aTwEOVObDQlftFDyGawDQgAAAYA"]
[Fri Dec 12 20:02:02.381403 2025] [:error] [pid 27950:tid 27958] [client 20.18.142.105:11382] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTwEOoVLRvkrdsSc1F2QYAAAAUY"]
[Fri Dec 12 20:02:02.719872 2025] [:error] [pid 55760:tid 55785] [client 20.18.142.105:11722] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTwEOlObDQlftFDyGawDRgAAAZc"]
[Fri Dec 12 20:02:03.140539 2025] [:error] [pid 55760:tid 55784] [client 20.18.142.105:12118] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTwEO1ObDQlftFDyGawDSQAAAZY"]
[Fri Dec 12 20:02:04.109185 2025] [:error] [pid 55760:tid 55770] [client 20.18.142.105:12123] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aTwEPFObDQlftFDyGawDTAAAAYg"]
[Fri Dec 12 20:02:05.107657 2025] [:error] [pid 26521:tid 26594] [client 20.18.142.105:12111] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTwEPZdhcAPU617AKTBsqwAAAI8"]
[Fri Dec 12 20:02:05.664440 2025] [:error] [pid 26520:tid 26570] [client 20.18.142.105:11388] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTwEPUG_frlY5vNXu_DxJAAAAFI"]
[Fri Dec 12 20:02:06.508770 2025] [:error] [pid 60649:tid 60655] [client 20.18.142.105:12103] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTwEPlOcUGKU3sgfHP_tiwAAAQM"]
[Fri Dec 12 20:02:07.225782 2025] [:error] [pid 27950:tid 27964] [client 20.18.142.105:11367] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aTwEP4VLRvkrdsSc1F2QYwAAAUw"]
[Fri Dec 12 20:02:07.787987 2025] [:error] [pid 27950:tid 27960] [client 20.18.142.105:11352] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aTwEP4VLRvkrdsSc1F2QZAAAAUg"]
[Fri Dec 12 20:02:08.296486 2025] [:error] [pid 55760:tid 55769] [client 20.18.142.105:12154] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aTwEQFObDQlftFDyGawDVAAAAYc"]
[Fri Dec 12 20:02:08.871855 2025] [:error] [pid 55760:tid 55764] [client 20.18.142.105:11331] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aTwEQFObDQlftFDyGawDVgAAAYI"]
[Fri Dec 12 20:02:10.186700 2025] [:error] [pid 26519:tid 26531] [client 20.18.142.105:11736] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aTwEQs8TRgSGOeWqEhfpkwAAAAg"]
[Fri Dec 12 20:02:11.016126 2025] [:error] [pid 60649:tid 60667] [client 20.18.142.105:11750] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aTwEQ1OcUGKU3sgfHP_tjwAAAQ8"]
[Fri Dec 12 20:02:11.548416 2025] [:error] [pid 26607:tid 26630] [client 20.18.142.105:11343] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aTwEQ8b_b0tOEWTL2KmQsAAAANU"]
[Fri Dec 12 20:02:12.028452 2025] [:error] [pid 60649:tid 60660] [client 20.18.142.105:12106] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aTwERFOcUGKU3sgfHP_tkgAAAQg"]
[Fri Dec 12 20:02:12.571854 2025] [:error] [pid 55760:tid 55772] [client 20.18.142.105:11716] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aTwERFObDQlftFDyGawDXAAAAYo"]
[Fri Dec 12 20:02:13.212976 2025] [:error] [pid 55760:tid 55764] [client 20.18.142.105:11740] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aTwERVObDQlftFDyGawDYAAAAYI"]
[Fri Dec 12 20:02:13.769736 2025] [:error] [pid 26519:tid 26537] [client 20.18.142.105:11360] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aTwERc8TRgSGOeWqEhfpmAAAAA4"]
[Fri Dec 12 20:02:14.212999 2025] [:error] [pid 60649:tid 60668] [client 20.18.142.105:12115] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aTwERlOcUGKU3sgfHP_tkwAAARA"]
[Fri Dec 12 20:02:14.787489 2025] [:error] [pid 26607:tid 26622] [client 20.18.142.105:12099] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aTwERsb_b0tOEWTL2KmQsQAAAM0"]
[Fri Dec 12 20:02:15.230164 2025] [:error] [pid 26520:tid 26573] [client 20.18.142.105:12121] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aTwER0G_frlY5vNXu_DxLQAAAFU"]
[Fri Dec 12 20:02:15.840624 2025] [:error] [pid 26521:tid 26597] [client 20.18.142.105:11333] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aTwER5dhcAPU617AKTBsuwAAAJI"]
[Fri Dec 12 20:02:16.581779 2025] [:error] [pid 60649:tid 60670] [client 20.18.142.105:11354] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aTwESFOcUGKU3sgfHP_tlgAAARI"]
[Fri Dec 12 20:02:17.156111 2025] [:error] [pid 26521:tid 26602] [client 20.18.142.105:12152] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "aTwESZdhcAPU617AKTBsvwAAAJc"]
[Fri Dec 12 20:02:17.610924 2025] [:error] [pid 55760:tid 55775] [client 20.18.142.105:11389] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aTwESVObDQlftFDyGawDZQAAAY0"]
[Fri Dec 12 20:02:18.321947 2025] [:error] [pid 26521:tid 26596] [client 20.18.142.105:11730] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aTwESpdhcAPU617AKTBsxgAAAJE"]
[Fri Dec 12 20:02:18.812455 2025] [:error] [pid 26521:tid 26585] [client 20.18.142.105:12132] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aTwESpdhcAPU617AKTBsxwAAAIY"]
[Fri Dec 12 20:02:19.396837 2025] [:error] [pid 26521:tid 26603] [client 20.18.142.105:12145] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aTwES5dhcAPU617AKTBsygAAAJg"]
[Fri Dec 12 20:02:19.763529 2025] [:error] [pid 55760:tid 55773] [client 20.18.142.105:12109] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aTwES1ObDQlftFDyGawDZwAAAYs"]
[Fri Dec 12 20:02:20.339973 2025] [:error] [pid 26521:tid 26600] [client 20.18.142.105:12101] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aTwETJdhcAPU617AKTBszQAAAJU"]
[Fri Dec 12 20:02:21.605119 2025] [:error] [pid 60649:tid 60674] [client 20.18.142.105:11753] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aTwETVOcUGKU3sgfHP_tnAAAARY"]
[Fri Dec 12 20:02:22.883123 2025] [:error] [pid 26520:tid 26576] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Fri Dec 12 20:02:23.390566 2025] [:error] [pid 26520:tid 26561] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Fri Dec 12 20:02:23.515281 2025] [:error] [pid 26520:tid 26552] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Fri Dec 12 20:02:23.768293 2025] [:error] [pid 26520:tid 26562] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Dec 12 20:02:23.899565 2025] [:error] [pid 26520:tid 26557] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Dec 12 20:02:24.024789 2025] [:error] [pid 26520:tid 26568] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Dec 12 20:02:24.305272 2025] [:error] [pid 26520:tid 26558] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Dec 12 20:02:24.558159 2025] [:error] [pid 26520:tid 26573] [client 20.18.142.105:11355] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Fri Dec 12 20:02:24.686969 2025] [:error] [pid 26520:tid 26570] [client 20.18.142.105:11355] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwEUEG_frlY5vNXu_DxPQAAAFI"]
[Fri Dec 12 20:02:25.915923 2025] [:error] [pid 26519:tid 26537] [client 20.18.142.105:11334] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwEUc8TRgSGOeWqEhfpnwAAAA4"]
[Fri Dec 12 20:02:27.556009 2025] [:error] [pid 26519:tid 26529] [client 20.18.142.105:11771] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwEU88TRgSGOeWqEhfpowAAAAY"]
[Fri Dec 12 20:02:28.495045 2025] [:error] [pid 26607:tid 26627] [client 20.18.142.105:11353] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwEVMb_b0tOEWTL2KmQvAAAANI"]
[Fri Dec 12 20:02:29.121501 2025] [:error] [pid 26519:tid 26530] [client 20.18.142.105:11351] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aTwEVc8TRgSGOeWqEhfppwAAAAc"]
[Fri Dec 12 20:02:29.902944 2025] [:error] [pid 27950:tid 27952] [client 20.18.142.105:11734] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aTwEVYVLRvkrdsSc1F2QfgAAAUA"]
[Fri Dec 12 20:02:30.303619 2025] [:error] [pid 55760:tid 55762] [client 20.18.142.105:11735] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aTwEVlObDQlftFDyGawDcgAAAYA"]
[Fri Dec 12 20:02:30.805970 2025] [:error] [pid 27950:tid 27955] [client 20.18.142.105:12143] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aTwEVoVLRvkrdsSc1F2QfwAAAUM"]
[Fri Dec 12 20:02:31.198085 2025] [:error] [pid 27950:tid 27974] [client 20.18.142.105:11718] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aTwEV4VLRvkrdsSc1F2QgAAAAVY"]
[Fri Dec 12 20:02:31.684243 2025] [:error] [pid 55760:tid 55769] [client 20.18.142.105:11758] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aTwEV1ObDQlftFDyGawDdQAAAYc"]
[Fri Dec 12 20:02:32.117069 2025] [:error] [pid 26607:tid 26609] [client 20.18.142.105:11330] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aTwEWMb_b0tOEWTL2KmQwQAAAMA"]
[Fri Dec 12 20:02:32.526019 2025] [:error] [pid 26607:tid 26615] [client 20.18.142.105:12136] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aTwEWMb_b0tOEWTL2KmQxAAAAMY"]
[Fri Dec 12 20:02:33.185132 2025] [:error] [pid 26607:tid 26629] [client 20.18.142.105:11772] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aTwEWcb_b0tOEWTL2KmQxgAAANQ"]
[Fri Dec 12 20:02:33.749788 2025] [:error] [pid 26520:tid 26562] [client 20.18.142.105:27236] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aTwEWUG_frlY5vNXu_DxRgAAAEo"]
[Fri Dec 12 20:02:34.168370 2025] [:error] [pid 26607:tid 26619] [client 20.18.142.105:11713] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aTwEWsb_b0tOEWTL2KmQyQAAAMo"]
[Fri Dec 12 20:02:34.719948 2025] [:error] [pid 26607:tid 26614] [client 20.18.142.105:12148] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload/wp-info.php"] [unique_id "aTwEWsb_b0tOEWTL2KmQywAAAMU"]
[Fri Dec 12 20:02:35.036795 2025] [:error] [pid 26521:tid 26592] [client 20.18.142.105:11725] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aTwEW5dhcAPU617AKTBs4AAAAI0"]
[Fri Dec 12 20:02:35.562705 2025] [:error] [pid 26520:tid 26570] [client 20.18.142.105:12151] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aTwEW0G_frlY5vNXu_DxTgAAAFI"]
[Fri Dec 12 20:02:35.991454 2025] [:error] [pid 27950:tid 27968] [client 20.18.142.105:11365] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aTwEW4VLRvkrdsSc1F2QtAAAAVA"]
[Fri Dec 12 20:02:36.626336 2025] [:error] [pid 60649:tid 60672] [client 20.18.142.105:11765] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aTwEXFOcUGKU3sgfHP_tsQAAARQ"]
[Fri Dec 12 20:02:37.199477 2025] [:error] [pid 26520:tid 26574] [client 20.18.142.105:11364] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwEXUG_frlY5vNXu_DxUQAAAFY"]
[Fri Dec 12 20:02:37.627848 2025] [:error] [pid 55760:tid 55772] [client 20.18.142.105:11727] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwEXVObDQlftFDyGawDeAAAAYo"]
[Fri Dec 12 20:02:38.091256 2025] [:error] [pid 55760:tid 55769] [client 20.18.142.105:11712] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwEXlObDQlftFDyGawDeQAAAYc"]
[Fri Dec 12 20:02:38.585418 2025] [:error] [pid 26520:tid 26554] [client 20.18.142.105:12144] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwEXkG_frlY5vNXu_DxUgAAAEI"]
[Fri Dec 12 20:02:39.468892 2025] [:error] [pid 26521:tid 26583] [client 20.18.142.105:11733] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aTwEX5dhcAPU617AKTBs6gAAAIQ"]
[Fri Dec 12 20:02:39.840173 2025] [:error] [pid 26519:tid 26529] [client 20.18.142.105:27227] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aTwEX88TRgSGOeWqEhfprgAAAAY"]
[Fri Dec 12 20:02:40.666720 2025] [:error] [pid 60649:tid 60653] [client 20.18.142.105:27231] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aTwEYFOcUGKU3sgfHP_ttQAAAQE"]
[Fri Dec 12 20:02:41.082189 2025] [:error] [pid 26521:tid 26591] [client 20.18.142.105:12129] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aTwEYZdhcAPU617AKTBs7wAAAIw"]
[Fri Dec 12 20:02:41.710863 2025] [:error] [pid 26519:tid 26527] [client 20.18.142.105:12097] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mj.php"] [unique_id "aTwEYc8TRgSGOeWqEhfpsAAAAAQ"]
[Fri Dec 12 20:02:42.192781 2025] [:error] [pid 26519:tid 26545] [client 20.18.142.105:12112] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mj.php"] [unique_id "aTwEYs8TRgSGOeWqEhfpsQAAABY"]
[Fri Dec 12 20:02:42.682410 2025] [:error] [pid 55760:tid 55766] [client 20.18.142.105:12131] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mj.php"] [unique_id "aTwEYlObDQlftFDyGawDfQAAAYQ"]
[Fri Dec 12 20:02:43.497741 2025] [:error] [pid 26521:tid 26603] [client 20.18.142.105:11356] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mj.php"] [unique_id "aTwEY5dhcAPU617AKTBs8QAAAJg"]
[Fri Dec 12 20:02:44.239956 2025] [:error] [pid 26607:tid 26623] [client 20.18.142.105:12128] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aTwEZMb_b0tOEWTL2KmQzwAAAM4"]
[Fri Dec 12 20:02:44.634663 2025] [:error] [pid 26607:tid 26627] [client 20.18.142.105:27218] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aTwEZMb_b0tOEWTL2KmQ0AAAANI"]
[Fri Dec 12 20:02:45.066274 2025] [:error] [pid 26519:tid 26540] [client 20.18.142.105:27142] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aTwEZc8TRgSGOeWqEhfptAAAABE"]
[Fri Dec 12 20:02:45.506562 2025] [:error] [pid 26521:tid 26602] [client 20.18.142.105:11361] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aTwEZZdhcAPU617AKTBs9QAAAJc"]
[Fri Dec 12 20:02:46.893608 2025] [:error] [pid 55760:tid 55774] [client 20.18.142.105:11369] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsz.php"] [unique_id "aTwEZlObDQlftFDyGawDgAAAAYw"]
[Fri Dec 12 20:02:47.658037 2025] [:error] [pid 26520:tid 26561] [client 20.18.142.105:11747] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsz.php"] [unique_id "aTwEZ0G_frlY5vNXu_DxVgAAAEk"]
[Fri Dec 12 20:02:48.451004 2025] [:error] [pid 55760:tid 55776] [client 20.18.142.105:27219] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsz.php"] [unique_id "aTwEaFObDQlftFDyGawDggAAAY4"]
[Fri Dec 12 20:02:49.975107 2025] [:error] [pid 26519:tid 26526] [client 20.18.142.105:12130] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsz.php"] [unique_id "aTwEac8TRgSGOeWqEhfptwAAAAM"]
[Fri Dec 12 20:02:50.975541 2025] [:error] [pid 27950:tid 27971] [client 20.18.142.105:12142] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2a2ck.php"] [unique_id "aTwEaoVLRvkrdsSc1F2QwAAAAVM"]
[Fri Dec 12 20:02:51.429373 2025] [:error] [pid 55760:tid 55779] [client 20.18.142.105:27235] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2a2ck.php"] [unique_id "aTwEa1ObDQlftFDyGawDhAAAAZE"]
[Fri Dec 12 20:02:51.972127 2025] [:error] [pid 26519:tid 26541] [client 20.18.142.105:11347] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2a2ck.php"] [unique_id "aTwEa88TRgSGOeWqEhfpuQAAABI"]
[Fri Dec 12 20:02:52.511465 2025] [:error] [pid 26519:tid 26537] [client 20.18.142.105:11741] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2a2ck.php"] [unique_id "aTwEbM8TRgSGOeWqEhfpugAAAA4"]
[Fri Dec 12 20:02:52.933474 2025] [:error] [pid 60649:tid 60672] [client 20.18.142.105:12117] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aTwEbFOcUGKU3sgfHP_tugAAARQ"]
[Fri Dec 12 20:02:53.452676 2025] [:error] [pid 55760:tid 55786] [client 20.18.142.105:11756] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aTwEbVObDQlftFDyGawDigAAAZg"]
[Fri Dec 12 20:02:54.329638 2025] [:error] [pid 26520:tid 26576] [client 20.18.142.105:27222] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aTwEbkG_frlY5vNXu_DxWAAAAFg"]
[Fri Dec 12 20:02:55.069452 2025] [:error] [pid 26607:tid 26609] [client 20.18.142.105:11746] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aTwEb8b_b0tOEWTL2KmQ1wAAAMA"]
[Fri Dec 12 20:02:56.016245 2025] [:error] [pid 60649:tid 60663] [client 20.18.142.105:11754] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs6.php"] [unique_id "aTwEcFOcUGKU3sgfHP_tvgAAAQs"]
[Fri Dec 12 20:02:57.074742 2025] [:error] [pid 26519:tid 26529] [client 20.18.142.105:11748] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs6.php"] [unique_id "aTwEcc8TRgSGOeWqEhfpvQAAAAY"]
[Fri Dec 12 20:02:57.832202 2025] [:error] [pid 26607:tid 26621] [client 20.18.142.105:11728] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs6.php"] [unique_id "aTwEccb_b0tOEWTL2KmQ2gAAAMw"]
[Fri Dec 12 20:02:58.654643 2025] [:error] [pid 55760:tid 55769] [client 20.18.142.105:11773] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs6.php"] [unique_id "aTwEclObDQlftFDyGawDjwAAAYc"]
[Fri Dec 12 20:02:59.349657 2025] [:error] [pid 26520:tid 26560] [client 20.18.142.105:11714] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTwEc0G_frlY5vNXu_DxWgAAAEg"]
[Fri Dec 12 20:03:01.354942 2025] [:error] [pid 26520:tid 26555] [client 20.18.142.105:27239] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTwEdUG_frlY5vNXu_DxXQAAAEM"]
[Fri Dec 12 20:03:01.671180 2025] [:error] [pid 26521:tid 26603] [client 20.18.142.105:12158] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTwEdZdhcAPU617AKTBs_gAAAJg"]
[Fri Dec 12 20:03:02.284051 2025] [:error] [pid 60649:tid 60668] [client 20.18.142.105:11764] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aTwEdlOcUGKU3sgfHP_tyAAAARA"]
[Fri Dec 12 20:03:02.942333 2025] [:error] [pid 27950:tid 27962] [client 20.18.142.105:12105] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTwEdoVLRvkrdsSc1F2QwgAAAUo"]
[Fri Dec 12 20:03:03.478985 2025] [:error] [pid 26521:tid 26600] [client 20.18.142.105:11768] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTwEd5dhcAPU617AKTBtAgAAAJU"]
[Fri Dec 12 20:03:03.813499 2025] [:error] [pid 26521:tid 26594] [client 20.18.142.105:27168] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTwEd5dhcAPU617AKTBtAwAAAI8"]
[Fri Dec 12 20:03:04.306774 2025] [:error] [pid 26520:tid 26554] [client 20.18.142.105:11332] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aTwEeEG_frlY5vNXu_DxXgAAAEI"]
[Fri Dec 12 20:03:05.170629 2025] [:error] [pid 26520:tid 26566] [client 20.18.142.105:11745] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTwEeUG_frlY5vNXu_DxYAAAAE4"]
[Fri Dec 12 20:03:05.668484 2025] [:error] [pid 55760:tid 55785] [client 20.18.142.105:27212] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTwEeVObDQlftFDyGawDmAAAAZc"]
[Fri Dec 12 20:03:06.191590 2025] [:error] [pid 26521:tid 26590] [client 20.18.142.105:11717] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTwEepdhcAPU617AKTBtCAAAAIs"]
[Fri Dec 12 20:03:07.546848 2025] [:error] [pid 26521:tid 26591] [client 20.18.142.105:11720] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "aTwEe5dhcAPU617AKTBtDAAAAIw"]
[Fri Dec 12 20:03:08.110316 2025] [:error] [pid 55760:tid 55766] [client 20.18.142.105:11770] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTwEfFObDQlftFDyGawDnQAAAYQ"]
[Fri Dec 12 20:03:08.470124 2025] [:error] [pid 55760:tid 55781] [client 20.18.142.105:12157] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTwEfFObDQlftFDyGawDngAAAZM"]
[Fri Dec 12 20:03:09.231715 2025] [:error] [pid 60649:tid 60653] [client 20.18.142.105:11769] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTwEfVOcUGKU3sgfHP_tygAAAQE"]
[Fri Dec 12 20:03:10.904720 2025] [:error] [pid 55760:tid 55776] [client 20.18.142.105:27225] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aTwEflObDQlftFDyGawDogAAAY4"]
[Fri Dec 12 20:03:12.059984 2025] [:error] [pid 26520:tid 26560] [client 20.18.142.105:11749] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trplv.php"] [unique_id "aTwEgEG_frlY5vNXu_DxZwAAAEg"]
[Fri Dec 12 20:03:12.596767 2025] [:error] [pid 26520:tid 26570] [client 20.18.142.105:12159] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trplv.php"] [unique_id "aTwEgEG_frlY5vNXu_DxaQAAAFI"]
[Fri Dec 12 20:03:13.198665 2025] [:error] [pid 55760:tid 55775] [client 20.18.142.105:27261] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trplv.php"] [unique_id "aTwEgVObDQlftFDyGawDqAAAAY0"]
[Fri Dec 12 20:03:13.588769 2025] [:error] [pid 55760:tid 55781] [client 20.18.142.105:11751] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trplv.php"] [unique_id "aTwEgVObDQlftFDyGawDqgAAAZM"]
[Fri Dec 12 20:03:13.862567 2025] [:error] [pid 60649:tid 60675] [client 20.18.142.105:11344] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTwEgVOcUGKU3sgfHP_tzgAAARc"]
[Fri Dec 12 20:03:14.190621 2025] [:error] [pid 55760:tid 55777] [client 20.18.142.105:12100] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTwEglObDQlftFDyGawDrQAAAY8"]
[Fri Dec 12 20:03:14.850831 2025] [:error] [pid 60649:tid 60672] [client 20.18.142.105:11755] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTwEglOcUGKU3sgfHP_t0AAAARQ"]
[Fri Dec 12 20:03:15.138817 2025] [:error] [pid 60649:tid 60656] [client 20.18.142.105:27205] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aTwEg1OcUGKU3sgfHP_t0gAAAQQ"]
[Fri Dec 12 20:03:15.708213 2025] [:error] [pid 26520:tid 26554] [client 20.18.142.105:27249] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aTwEg0G_frlY5vNXu_DxagAAAEI"]
[Fri Dec 12 20:03:16.359191 2025] [:error] [pid 60649:tid 60662] [client 20.18.142.105:12104] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aTwEhFOcUGKU3sgfHP_t1AAAAQo"]
[Fri Dec 12 20:03:16.771297 2025] [:error] [pid 26521:tid 26599] [client 20.18.142.105:27210] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aTwEhJdhcAPU617AKTBtEwAAAJQ"]
[Fri Dec 12 20:03:17.218095 2025] [:error] [pid 26607:tid 26621] [client 20.18.142.105:12138] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aTwEhcb_b0tOEWTL2KmQ5AAAAMw"]
[Fri Dec 12 20:03:18.209847 2025] [:error] [pid 26519:tid 26528] [client 20.18.142.105:27220] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTwEhs8TRgSGOeWqEhfpwgAAAAU"]
[Fri Dec 12 20:03:18.820848 2025] [:error] [pid 26607:tid 26630] [client 20.18.142.105:12102] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTwEhsb_b0tOEWTL2KmQ5gAAANU"]
[Fri Dec 12 20:03:19.473705 2025] [:error] [pid 26521:tid 26585] [client 20.18.142.105:12155] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTwEh5dhcAPU617AKTBtGAAAAIY"]
[Fri Dec 12 20:03:20.008820 2025] [:error] [pid 27950:tid 27956] [client 20.18.142.105:27263] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aTwEiIVLRvkrdsSc1F2QzAAAAUQ"]
[Fri Dec 12 20:03:20.425790 2025] [:error] [pid 27950:tid 27967] [client 20.18.142.105:11739] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEiIVLRvkrdsSc1F2QzQAAAU8"]
[Fri Dec 12 20:03:20.905776 2025] [:error] [pid 26519:tid 26541] [client 20.18.142.105:27251] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEiM8TRgSGOeWqEhfpxQAAABI"]
[Fri Dec 12 20:03:21.315873 2025] [:error] [pid 26521:tid 26591] [client 20.18.142.105:27246] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEiZdhcAPU617AKTBtGwAAAIw"]
[Fri Dec 12 20:03:21.633126 2025] [:error] [pid 27950:tid 27953] [client 20.18.142.105:11345] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aTwEiYVLRvkrdsSc1F2QzwAAAUE"]
[Fri Dec 12 20:03:22.600334 2025] [:error] [pid 26521:tid 26600] [client 20.18.142.105:11336] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mc.php"] [unique_id "aTwEipdhcAPU617AKTBtIAAAAJU"]
[Fri Dec 12 20:03:23.083059 2025] [:error] [pid 26521:tid 26592] [client 20.18.142.105:27179] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mc.php"] [unique_id "aTwEi5dhcAPU617AKTBtIQAAAI0"]
[Fri Dec 12 20:03:23.619711 2025] [:error] [pid 26521:tid 26601] [client 20.18.142.105:12149] [client 20.18.142.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mc.php"] [unique_id "aTwEi5dhcAPU617AKTBtJAAAAJY"]
[Fri Dec 12 20:03:24.109860 2025] [:error] [pid 26519:tid 26542] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/mc.php
[Fri Dec 12 20:03:24.351606 2025] [:error] [pid 26519:tid 26529] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/article.php
[Fri Dec 12 20:03:24.501253 2025] [:error] [pid 26519:tid 26538] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Dec 12 20:03:24.650932 2025] [:error] [pid 26519:tid 26525] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Fri Dec 12 20:03:24.802226 2025] [:error] [pid 26519:tid 26527] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/if.php
[Fri Dec 12 20:03:24.951993 2025] [:error] [pid 26519:tid 26545] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Dec 12 20:03:25.101184 2025] [:error] [pid 26519:tid 26523] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Fri Dec 12 20:03:25.251200 2025] [:error] [pid 26519:tid 26530] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/geck.php
[Fri Dec 12 20:03:25.409361 2025] [:error] [pid 26519:tid 26534] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/avaa.php
[Fri Dec 12 20:03:25.561727 2025] [:error] [pid 26519:tid 26532] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Fri Dec 12 20:03:25.775615 2025] [:error] [pid 26519:tid 26531] [client 20.18.142.105:12134] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Dec 12 20:03:25.935600 2025] [:error] [pid 26519:tid 26528] [client 20.18.142.105:12134] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aTwEjc8TRgSGOeWqEhfp0QAAAAU"]
[Fri Dec 12 20:03:26.266517 2025] [:error] [pid 27950:tid 27955] [client 20.18.142.105:11729] [client 20.18.142.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/js420.php"] [unique_id "aTwEjoVLRvkrdsSc1F2Q0QAAAUM"]
[Fri Dec 12 21:43:33.270388 2025] [:error] [pid 60649:tid 60657] [client 189.130.200.41:61791] [client 189.130.200.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.130.200.41, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aTwcBVOcUGKU3sgfHP8BvAAAAQU"]
[Fri Dec 12 21:43:33.275895 2025] [:error] [pid 60649:tid 60657] [client 189.130.200.41:61791] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Dec 13 03:43:20.438990 2025] [:error] [pid 27950:tid 27973] [client 38.97.60.82:56755] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aTxwWIVLRvkrdsSc1F3uvwAAAVU"], referer: binance.com
[Sat Dec 13 03:52:55.115700 2025] [:error] [pid 23322:tid 23418] [client 38.97.60.82:63820] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aTxyl-GkmarhEO9bjcj4DQAAAAw"], referer: binance.com
[Sat Dec 13 04:18:32.235694 2025] [:error] [pid 28932:tid 28994] [client 38.97.60.82:64339] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aTx4mG8I1GCfaOX3X0wlkAAAARA"], referer: binance.com
[Sat Dec 13 04:28:54.125158 2025] [:error] [pid 43836:tid 43849] [client 38.97.60.82:49447] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aTx7BmAEOBirsxb11nZlXAAAAMs"], referer: binance.com
[Sat Dec 13 13:00:34.812569 2025] [:error] [pid 55037:tid 55050] [client 45.154.98.18:50671] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy8hyx7iFaaIMvMOFSnwAAAUs"]
[Sat Dec 13 13:00:35.594726 2025] [:error] [pid 8242:tid 8256] [client 45.154.98.18:51017] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy8yNKA7vSGNUfnOEVbwAAAkg"]
[Sat Dec 13 13:00:36.081276 2025] [:error] [pid 8181:tid 8200] [client 45.154.98.18:51850] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9IcsztoZQ9y1QdUPvQAAAgo"]
[Sat Dec 13 13:00:36.151963 2025] [:error] [pid 8243:tid 8296] [client 45.154.98.18:51960] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9CIrGC80ajIR9nJNIQAAApQ"]
[Sat Dec 13 13:00:36.658225 2025] [:error] [pid 43748:tid 43798] [client 45.154.98.18:52707] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9KrTT0VzE3gYjcCIAgAAAFM"]
[Sat Dec 13 13:00:36.745451 2025] [:error] [pid 55037:tid 55060] [client 45.154.98.18:52894] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9Byx7iFaaIMvMOFS6gAAAVU"]
[Sat Dec 13 13:00:37.258511 2025] [:error] [pid 43748:tid 43798] [client 45.154.98.18:53252] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9arTT0VzE3gYjcCIEwAAAFM"]
[Sat Dec 13 13:00:37.305189 2025] [:error] [pid 8242:tid 8250] [client 45.154.98.18:53260] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9SNKA7vSGNUfnOEVpAAAAkI"]
[Sat Dec 13 13:00:37.842681 2025] [:error] [pid 43747:tid 43760] [client 45.154.98.18:53509] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9ZYw3twBd_JQEHj1LAAAAAk"]
[Sat Dec 13 13:00:38.415405 2025] [:error] [pid 55037:tid 55048] [client 45.154.98.18:53781] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aTzy9hyx7iFaaIMvMOFTBAAAAUk"]
[Sat Dec 13 16:49:03.238677 2025] [:error] [pid 21342:tid 21364] [client 46.101.214.112:61697] [client 46.101.214.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.214.112, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aT0of_BL0VVSMIEvqstK9AAAAxI"]
[Sat Dec 13 16:49:03.246908 2025] [:error] [pid 21342:tid 21364] [client 46.101.214.112:61697] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Dec 13 20:33:34.146566 2025] [:error] [pid 20799:tid 20816] [client 160.30.68.34:34321] [client 160.30.68.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.68.34, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aT1dHqPz3eVRUTzZpOJ_tgAAAs8"]
[Sat Dec 13 20:33:34.154238 2025] [:error] [pid 20799:tid 20816] [client 160.30.68.34:34321] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Dec 14 00:53:44.892483 2025] [:error] [pid 14654:tid 14667] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Sun Dec 14 00:53:44.982039 2025] [:error] [pid 14654:tid 14665] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Dec 14 00:53:45.072272 2025] [:error] [pid 14654:tid 14672] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 14 00:53:45.165439 2025] [:error] [pid 14654:tid 14666] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Dec 14 00:53:45.255824 2025] [:error] [pid 14654:tid 14680] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Sun Dec 14 00:53:45.346406 2025] [:error] [pid 14654:tid 14659] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Dec 14 00:53:45.437978 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 14 00:53:45.529875 2025] [:error] [pid 14654:tid 14660] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Sun Dec 14 00:53:45.620906 2025] [:error] [pid 14654:tid 14678] [client 4.193.251.36:24848] File does not exist: /usr/local/apache/htdocs/suspended-page/cord.php
[Sun Dec 14 00:53:45.709168 2025] [:error] [pid 14654:tid 14669] [client 4.193.251.36:24848] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aT2aGTqZP_N7tgSGeZci7wAAAAw"]
[Sun Dec 14 00:53:45.895855 2025] [:error] [pid 14689:tid 14709] [client 4.193.251.36:24949] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aT2aGUEcifvaa9I7SnltdgAAAVA"]
[Sun Dec 14 00:53:46.072301 2025] [:error] [pid 14689:tid 14697] [client 4.193.251.36:24929] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aT2aGkEcifvaa9I7SnlteAAAAUQ"]
[Sun Dec 14 00:53:46.247032 2025] [:error] [pid 3635:tid 3682] [client 4.193.251.36:24851] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aT2aGjqfhzW7OpfKxKzfUAAAANE"]
[Sun Dec 14 00:53:46.429358 2025] [:error] [pid 3636:tid 3706] [client 4.193.251.36:24906] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aT2aGt4pNg3LXPqKgeYu6gAAAQ4"]
[Sun Dec 14 00:53:46.633656 2025] [:error] [pid 3720:tid 3740] [client 4.193.251.36:24907] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aT2aGu7_sgsCEY5RMYrWfQAAAJI"]
[Sun Dec 14 00:53:46.809732 2025] [:error] [pid 3636:tid 3701] [client 4.193.251.36:24941] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aT2aGt4pNg3LXPqKgeYu6wAAAQk"]
[Sun Dec 14 00:53:46.983652 2025] [:error] [pid 14654:tid 14681] [client 4.193.251.36:24853] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aT2aGjqZP_N7tgSGeZci8wAAABg"]
[Sun Dec 14 00:53:47.158025 2025] [:error] [pid 14654:tid 14673] [client 4.193.251.36:24849] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aT2aGzqZP_N7tgSGeZci9QAAABA"]
[Sun Dec 14 00:53:47.330939 2025] [:error] [pid 3635:tid 3666] [client 4.193.251.36:24901] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aT2aGzqfhzW7OpfKxKzfVgAAAME"]
[Sun Dec 14 00:53:47.506484 2025] [:error] [pid 3636:tid 3700] [client 4.193.251.36:24913] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aT2aG94pNg3LXPqKgeYu7gAAAQg"]
[Sun Dec 14 00:53:47.684127 2025] [:error] [pid 14689:tid 14699] [client 4.193.251.36:24938] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aT2aG0Ecifvaa9I7SnltgAAAAUY"]
[Sun Dec 14 00:53:47.857972 2025] [:error] [pid 14689:tid 14711] [client 4.193.251.36:24835] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aT2aG0Ecifvaa9I7SnltgQAAAVI"]
[Sun Dec 14 00:53:48.032754 2025] [:error] [pid 3720:tid 3738] [client 4.193.251.36:24920] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aT2aHO7_sgsCEY5RMYrWgAAAAJA"]
[Sun Dec 14 00:53:48.232396 2025] [:error] [pid 14654:tid 14665] [client 4.193.251.36:24898] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aT2aHDqZP_N7tgSGeZci-QAAAAg"]
[Sun Dec 14 00:53:48.406062 2025] [:error] [pid 14689:tid 14704] [client 4.193.251.36:24850] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aT2aHEEcifvaa9I7SnltgwAAAUs"]
[Sun Dec 14 00:53:48.586832 2025] [:error] [pid 3635:tid 3673] [client 4.193.251.36:24842] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT2aHDqfhzW7OpfKxKzfXQAAAMg"]
[Sun Dec 14 00:53:48.791637 2025] [:error] [pid 3636:tid 3709] [client 4.193.251.36:24840] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT2aHN4pNg3LXPqKgeYu8QAAARE"]
[Sun Dec 14 00:53:48.965777 2025] [:error] [pid 3635:tid 3671] [client 4.193.251.36:24933] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT2aHDqfhzW7OpfKxKzfYQAAAMY"]
[Sun Dec 14 00:53:49.144646 2025] [:error] [pid 3635:tid 3683] [client 4.193.251.36:17351] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT2aHTqfhzW7OpfKxKzfYwAAANI"]
[Sun Dec 14 00:53:49.341255 2025] [:error] [pid 3634:tid 3642] [client 4.193.251.36:24916] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aT2aHYbt-wTl4d7Q7qpzdAAAAEQ"]
[Sun Dec 14 00:53:49.519454 2025] [:error] [pid 3636:tid 3697] [client 4.193.251.36:24860] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aT2aHd4pNg3LXPqKgeYu-wAAAQU"]
[Sun Dec 14 00:53:49.693523 2025] [:error] [pid 3635:tid 3676] [client 4.193.251.36:24946] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aT2aHTqfhzW7OpfKxKzfZQAAAMs"]
[Sun Dec 14 00:53:49.876001 2025] [:error] [pid 14689:tid 14693] [client 4.193.251.36:24846] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aT2aHUEcifvaa9I7SnlthgAAAUA"]
[Sun Dec 14 00:53:50.049870 2025] [:error] [pid 14689:tid 14703] [client 4.193.251.36:24918] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aT2aHkEcifvaa9I7SnltiAAAAUo"]
[Sun Dec 14 00:53:50.225420 2025] [:error] [pid 14654:tid 14659] [client 4.193.251.36:24844] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aT2aHjqZP_N7tgSGeZci_QAAAAI"]
[Sun Dec 14 00:53:50.400766 2025] [:error] [pid 14689:tid 14701] [client 4.193.251.36:24854] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aT2aHkEcifvaa9I7SnltiwAAAUg"]
[Sun Dec 14 00:53:50.578564 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:24928] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aT2aHjqZP_N7tgSGeZci_wAAAAQ"]
[Sun Dec 14 00:53:50.761688 2025] [:error] [pid 3720:tid 3736] [client 4.193.251.36:24919] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aT2aHu7_sgsCEY5RMYrWiQAAAI4"]
[Sun Dec 14 00:53:50.935371 2025] [:error] [pid 3636:tid 3708] [client 4.193.251.36:24953] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aT2aHt4pNg3LXPqKgeYvCAAAARA"]
[Sun Dec 14 00:53:51.111206 2025] [:error] [pid 3634:tid 3640] [client 4.193.251.36:17358] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aT2aH4bt-wTl4d7Q7qpzegAAAEI"]
[Sun Dec 14 00:53:51.284760 2025] [:error] [pid 3635:tid 3682] [client 4.193.251.36:24843] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aT2aHzqfhzW7OpfKxKzfZwAAANE"]
[Sun Dec 14 00:53:51.459039 2025] [:error] [pid 14689:tid 14700] [client 4.193.251.36:17373] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aT2aH0Ecifvaa9I7SnltjgAAAUc"]
[Sun Dec 14 00:53:51.633604 2025] [:error] [pid 3635:tid 3675] [client 4.193.251.36:24959] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aT2aHzqfhzW7OpfKxKzfaQAAAMo"]
[Sun Dec 14 00:53:51.810379 2025] [:error] [pid 3636:tid 3716] [client 4.193.251.36:24903] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aT2aH94pNg3LXPqKgeYvDAAAARg"]
[Sun Dec 14 00:53:52.011789 2025] [:error] [pid 3720:tid 3725] [client 4.193.251.36:24902] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aT2aIO7_sgsCEY5RMYrWjgAAAIM"]
[Sun Dec 14 00:53:52.186287 2025] [:error] [pid 3634:tid 3652] [client 4.193.251.36:24940] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aT2aIIbt-wTl4d7Q7qpzfQAAAE4"]
[Sun Dec 14 00:53:52.360971 2025] [:error] [pid 14689:tid 14704] [client 4.193.251.36:17352] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aT2aIEEcifvaa9I7SnltkwAAAUs"]
[Sun Dec 14 00:53:52.534456 2025] [:error] [pid 14689:tid 14710] [client 4.193.251.36:24926] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aT2aIEEcifvaa9I7SnltlAAAAVE"]
[Sun Dec 14 00:53:52.708197 2025] [:error] [pid 14689:tid 14717] [client 4.193.251.36:17377] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aT2aIEEcifvaa9I7SnltlwAAAVg"]
[Sun Dec 14 00:53:52.891732 2025] [:error] [pid 3634:tid 3647] [client 4.193.251.36:24875] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aT2aIIbt-wTl4d7Q7qpzfwAAAEk"]
[Sun Dec 14 00:53:53.066311 2025] [:error] [pid 3636:tid 3700] [client 4.193.251.36:24834] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aT2aId4pNg3LXPqKgeYvEgAAAQg"]
[Sun Dec 14 00:53:53.240390 2025] [:error] [pid 14689:tid 14708] [client 4.193.251.36:24855] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aT2aIUEcifvaa9I7SnltnQAAAU8"]
[Sun Dec 14 00:53:53.414608 2025] [:error] [pid 3720:tid 3724] [client 4.193.251.36:24909] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aT2aIe7_sgsCEY5RMYrWlAAAAII"]
[Sun Dec 14 00:53:53.601868 2025] [:error] [pid 14689:tid 14700] [client 4.193.251.36:24832] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aT2aIUEcifvaa9I7SnltnwAAAUc"]
[Sun Dec 14 00:53:53.779091 2025] [:error] [pid 14689:tid 14698] [client 4.193.251.36:24878] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aT2aIUEcifvaa9I7SnltowAAAUU"]
[Sun Dec 14 00:53:53.952589 2025] [:error] [pid 3720:tid 3738] [client 4.193.251.36:24869] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aT2aIe7_sgsCEY5RMYrWlQAAAJA"]
[Sun Dec 14 00:53:54.125567 2025] [:error] [pid 3635:tid 3687] [client 4.193.251.36:24952] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aT2aIjqfhzW7OpfKxKzfcQAAANY"]
[Sun Dec 14 00:53:54.299910 2025] [:error] [pid 3636:tid 3712] [client 4.193.251.36:24937] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aT2aIt4pNg3LXPqKgeYvEwAAARQ"]
[Sun Dec 14 00:53:54.477176 2025] [:error] [pid 14689:tid 14694] [client 4.193.251.36:24931] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aT2aIkEcifvaa9I7SnltpwAAAUE"]
[Sun Dec 14 00:53:54.650905 2025] [:error] [pid 3636:tid 3707] [client 4.193.251.36:24838] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aT2aIt4pNg3LXPqKgeYvFAAAAQ8"]
[Sun Dec 14 00:53:54.824379 2025] [:error] [pid 14654:tid 14670] [client 4.193.251.36:24883] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aT2aIjqZP_N7tgSGeZcjDAAAAA0"]
[Sun Dec 14 00:53:55.007148 2025] [:error] [pid 14689:tid 14711] [client 4.193.251.36:24866] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aI0Ecifvaa9I7SnltqQAAAVI"]
[Sun Dec 14 00:53:55.182007 2025] [:error] [pid 14654:tid 14666] [client 4.193.251.36:24897] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aIzqZP_N7tgSGeZcjDQAAAAk"]
[Sun Dec 14 00:53:55.358015 2025] [:error] [pid 14654:tid 14657] [client 4.193.251.36:24955] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aIzqZP_N7tgSGeZcjEQAAAAA"]
[Sun Dec 14 00:53:55.557635 2025] [:error] [pid 14689:tid 14708] [client 4.193.251.36:24939] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aI0Ecifvaa9I7SnltrgAAAU8"]
[Sun Dec 14 00:53:55.730805 2025] [:error] [pid 14689:tid 14695] [client 4.193.251.36:24914] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aT2aI0Ecifvaa9I7SnltsAAAAUI"]
[Sun Dec 14 00:53:55.915430 2025] [:error] [pid 3720:tid 3727] [client 4.193.251.36:24892] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aT2aI-7_sgsCEY5RMYrWmQAAAIU"]
[Sun Dec 14 00:53:56.118186 2025] [:error] [pid 3635:tid 3676] [client 4.193.251.36:17362] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aT2aJDqfhzW7OpfKxKzfdQAAAMs"]
[Sun Dec 14 00:53:56.295278 2025] [:error] [pid 3720:tid 3739] [client 4.193.251.36:24841] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aT2aJO7_sgsCEY5RMYrWmwAAAJE"]
[Sun Dec 14 00:53:56.468407 2025] [:error] [pid 3720:tid 3737] [client 4.193.251.36:24943] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aT2aJO7_sgsCEY5RMYrWnQAAAI8"]
[Sun Dec 14 00:53:56.643175 2025] [:error] [pid 3720:tid 3736] [client 4.193.251.36:24857] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aT2aJO7_sgsCEY5RMYrWnwAAAI4"]
[Sun Dec 14 00:53:56.816709 2025] [:error] [pid 3720:tid 3735] [client 4.193.251.36:24877] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aT2aJO7_sgsCEY5RMYrWoQAAAI0"]
[Sun Dec 14 00:53:57.012817 2025] [:error] [pid 3636:tid 3693] [client 4.193.251.36:24896] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aT2aJd4pNg3LXPqKgeYvIAAAAQE"]
[Sun Dec 14 00:53:57.187509 2025] [:error] [pid 14689:tid 14694] [client 4.193.251.36:17359] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aT2aJUEcifvaa9I7SnltugAAAUE"]
[Sun Dec 14 00:53:57.361779 2025] [:error] [pid 14689:tid 14711] [client 4.193.251.36:24954] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aT2aJUEcifvaa9I7SnltvAAAAVI"]
[Sun Dec 14 00:53:57.535284 2025] [:error] [pid 3635:tid 3682] [client 4.193.251.36:17378] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aT2aJTqfhzW7OpfKxKzfdwAAANE"]
[Sun Dec 14 00:53:57.713091 2025] [:error] [pid 3636:tid 3696] [client 4.193.251.36:24845] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aT2aJd4pNg3LXPqKgeYvIgAAAQQ"]
[Sun Dec 14 00:53:57.897901 2025] [:error] [pid 3634:tid 3644] [client 4.193.251.36:17365] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aT2aJYbt-wTl4d7Q7qpzhgAAAEY"]
[Sun Dec 14 00:53:58.108007 2025] [:error] [pid 3636:tid 3700] [client 4.193.251.36:24915] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aT2aJt4pNg3LXPqKgeYvJQAAAQg"]
[Sun Dec 14 00:53:58.288349 2025] [:error] [pid 3634:tid 3651] [client 4.193.251.36:17353] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aT2aJobt-wTl4d7Q7qpziAAAAE0"]
[Sun Dec 14 00:53:58.466028 2025] [:error] [pid 14689:tid 14708] [client 4.193.251.36:17357] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aT2aJkEcifvaa9I7SnltwQAAAU8"]
[Sun Dec 14 00:53:58.640057 2025] [:error] [pid 3635:tid 3689] [client 4.193.251.36:24870] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aT2aJjqfhzW7OpfKxKzfeQAAANg"]
[Sun Dec 14 00:53:58.846948 2025] [:error] [pid 14689:tid 14705] [client 4.193.251.36:24874] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aT2aJkEcifvaa9I7SnltxwAAAUw"]
[Sun Dec 14 00:53:59.026571 2025] [:error] [pid 14689:tid 14715] [client 4.193.251.36:17380] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aT2aJ0Ecifvaa9I7SnltyQAAAVY"]
[Sun Dec 14 00:53:59.241421 2025] [:error] [pid 14689:tid 14716] [client 4.193.251.36:24862] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aT2aJ0Ecifvaa9I7SnltygAAAVc"]
[Sun Dec 14 00:53:59.449265 2025] [:error] [pid 3634:tid 3642] [client 4.193.251.36:17355] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT2aJ4bt-wTl4d7Q7qpzigAAAEQ"]
[Sun Dec 14 00:53:59.628247 2025] [:error] [pid 3634:tid 3656] [client 4.193.251.36:24864] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT2aJ4bt-wTl4d7Q7qpzjAAAAFI"]
[Sun Dec 14 00:53:59.801300 2025] [:error] [pid 3720:tid 3744] [client 4.193.251.36:24880] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT2aJ-7_sgsCEY5RMYrWrgAAAJY"]
[Sun Dec 14 00:53:59.979933 2025] [:error] [pid 3720:tid 3722] [client 4.193.251.36:24836] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT2aJ-7_sgsCEY5RMYrWsAAAAIA"]
[Sun Dec 14 00:54:00.158522 2025] [:error] [pid 3634:tid 3653] [client 4.193.251.36:24947] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aT2aKIbt-wTl4d7Q7qpzjgAAAE8"]
[Sun Dec 14 00:54:00.340143 2025] [:error] [pid 3634:tid 3649] [client 4.193.251.36:17350] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aT2aKIbt-wTl4d7Q7qpzjwAAAEs"]
[Sun Dec 14 00:54:00.516045 2025] [:error] [pid 3720:tid 3733] [client 4.193.251.36:24886] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aT2aKO7_sgsCEY5RMYrWswAAAIs"]
[Sun Dec 14 00:54:00.702101 2025] [:error] [pid 3634:tid 3658] [client 4.193.251.36:17348] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aT2aKIbt-wTl4d7Q7qpzkgAAAFQ"]
[Sun Dec 14 00:54:00.877495 2025] [:error] [pid 3634:tid 3659] [client 4.193.251.36:24856] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aKIbt-wTl4d7Q7qpzkwAAAFU"]
[Sun Dec 14 00:54:01.052325 2025] [:error] [pid 14689:tid 14707] [client 4.193.251.36:24871] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aKUEcifvaa9I7Snlt0wAAAU4"]
[Sun Dec 14 00:54:01.237053 2025] [:error] [pid 3635:tid 3681] [client 4.193.251.36:17361] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aKTqfhzW7OpfKxKzffgAAANA"]
[Sun Dec 14 00:54:01.411597 2025] [:error] [pid 14654:tid 14675] [client 4.193.251.36:24852] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aKTqZP_N7tgSGeZcjIgAAABI"]
[Sun Dec 14 00:54:01.586895 2025] [:error] [pid 3720:tid 3729] [client 4.193.251.36:24859] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT2aKe7_sgsCEY5RMYrWtAAAAIc"]
[Sun Dec 14 00:54:01.765401 2025] [:error] [pid 3636:tid 3710] [client 4.193.251.36:17289] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT2aKd4pNg3LXPqKgeYvLgAAARI"]
[Sun Dec 14 00:54:01.939227 2025] [:error] [pid 3636:tid 3711] [client 4.193.251.36:24945] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT2aKd4pNg3LXPqKgeYvLwAAARM"]
[Sun Dec 14 00:54:02.120782 2025] [:error] [pid 14689:tid 14708] [client 4.193.251.36:24876] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT2aKkEcifvaa9I7Snlt2QAAAU8"]
[Sun Dec 14 00:54:02.297704 2025] [:error] [pid 3636:tid 3713] [client 4.193.251.36:24944] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aT2aKt4pNg3LXPqKgeYvMAAAARU"]
[Sun Dec 14 00:54:02.471970 2025] [:error] [pid 14654:tid 14678] [client 4.193.251.36:24879] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aT2aKjqZP_N7tgSGeZcjKgAAABU"]
[Sun Dec 14 00:54:02.645393 2025] [:error] [pid 3635:tid 3673] [client 4.193.251.36:17354] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aT2aKjqfhzW7OpfKxKzfgQAAAMg"]
[Sun Dec 14 00:54:02.819046 2025] [:error] [pid 3635:tid 3687] [client 4.193.251.36:17347] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aT2aKjqfhzW7OpfKxKzfggAAANY"]
[Sun Dec 14 00:54:03.025158 2025] [:error] [pid 14654:tid 14668] [client 4.193.251.36:24956] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aT2aKzqZP_N7tgSGeZcjLQAAAAs"]
[Sun Dec 14 00:54:03.204396 2025] [:error] [pid 14654:tid 14676] [client 4.193.251.36:24904] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aT2aKzqZP_N7tgSGeZcjLwAAABM"]
[Sun Dec 14 00:54:03.396487 2025] [:error] [pid 14654:tid 14667] [client 4.193.251.36:17298] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aT2aKzqZP_N7tgSGeZcjMwAAAAo"]
[Sun Dec 14 00:54:03.576977 2025] [:error] [pid 14689:tid 14715] [client 4.193.251.36:24911] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aT2aK0Ecifvaa9I7Snlt4AAAAVY"]
[Sun Dec 14 00:54:03.756909 2025] [:error] [pid 3635:tid 3674] [client 4.193.251.36:24908] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aKzqfhzW7OpfKxKzfhQAAAMk"]
[Sun Dec 14 00:54:03.948150 2025] [:error] [pid 14689:tid 14699] [client 4.193.251.36:24922] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aK0Ecifvaa9I7Snlt4gAAAUY"]
[Sun Dec 14 00:54:04.122770 2025] [:error] [pid 14689:tid 14697] [client 4.193.251.36:24888] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aLEEcifvaa9I7Snlt4wAAAUQ"]
[Sun Dec 14 00:54:04.296208 2025] [:error] [pid 14654:tid 14666] [client 4.193.251.36:24910] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aLDqZP_N7tgSGeZcjOAAAAAk"]
[Sun Dec 14 00:54:04.471104 2025] [:error] [pid 3636:tid 3702] [client 4.193.251.36:24924] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aT2aLN4pNg3LXPqKgeYvOQAAAQo"]
[Sun Dec 14 00:54:04.654668 2025] [:error] [pid 3720:tid 3743] [client 4.193.251.36:17390] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aT2aLO7_sgsCEY5RMYrWtwAAAJU"]
[Sun Dec 14 00:54:04.836710 2025] [:error] [pid 14654:tid 14672] [client 4.193.251.36:17283] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aT2aLDqZP_N7tgSGeZcjPAAAAA8"]
[Sun Dec 14 00:54:05.025282 2025] [:error] [pid 3720:tid 3734] [client 4.193.251.36:17405] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aT2aLe7_sgsCEY5RMYrWuwAAAIw"]
[Sun Dec 14 00:54:05.206835 2025] [:error] [pid 3636:tid 3692] [client 4.193.251.36:17381] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aT2aLd4pNg3LXPqKgeYvOgAAAQA"]
[Sun Dec 14 00:54:05.411493 2025] [:error] [pid 14654:tid 14679] [client 4.193.251.36:24923] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aT2aLTqZP_N7tgSGeZcjPgAAABY"]
[Sun Dec 14 00:54:05.586925 2025] [:error] [pid 3634:tid 3655] [client 4.193.251.36:24861] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aT2aLYbt-wTl4d7Q7qpzmgAAAFE"]
[Sun Dec 14 00:54:05.767081 2025] [:error] [pid 14654:tid 14660] [client 4.193.251.36:17383] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aT2aLTqZP_N7tgSGeZcjPwAAAAM"]
[Sun Dec 14 00:54:05.880039 2025] [:error] [pid 14689:tid 14715] [client 4.193.251.36:24911] [client 4.193.251.36] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "66.249.70.99_2d969d8071b542d61d3e68d48bb83cae7a49d5cb"): Internal error (specific information not available) [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aT2aK0Ecifvaa9I7Snlt4AAAAVY"]
[Sun Dec 14 00:54:05.941404 2025] [:error] [pid 14654:tid 14671] [client 4.193.251.36:24925] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aT2aLTqZP_N7tgSGeZcjQgAAAA4"]
[Sun Dec 14 00:54:06.123201 2025] [:error] [pid 14689:tid 14717] [client 4.193.251.36:17391] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aT2aLkEcifvaa9I7Snlt6gAAAVg"]
[Sun Dec 14 00:54:06.301656 2025] [:error] [pid 14689:tid 14710] [client 4.193.251.36:24890] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aT2aLkEcifvaa9I7Snlt7AAAAVE"]
[Sun Dec 14 00:54:06.476479 2025] [:error] [pid 14654:tid 14681] [client 4.193.251.36:17344] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aT2aLjqZP_N7tgSGeZcjRQAAABg"]
[Sun Dec 14 00:54:06.652441 2025] [:error] [pid 14654:tid 14673] [client 4.193.251.36:17399] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT2aLjqZP_N7tgSGeZcjRgAAABA"]
[Sun Dec 14 00:54:06.828311 2025] [:error] [pid 3720:tid 3726] [client 4.193.251.36:24863] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT2aLu7_sgsCEY5RMYrWwgAAAIQ"]
[Sun Dec 14 00:54:07.001399 2025] [:error] [pid 14654:tid 14662] [client 4.193.251.36:24867] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT2aLzqZP_N7tgSGeZcjSAAAAAU"]
[Sun Dec 14 00:54:07.174501 2025] [:error] [pid 14654:tid 14674] [client 4.193.251.36:24858] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT2aLzqZP_N7tgSGeZcjSwAAABE"]
[Sun Dec 14 00:54:07.357730 2025] [:error] [pid 3720:tid 3736] [client 4.193.251.36:17404] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aT2aL-7_sgsCEY5RMYrWxQAAAI4"]
[Sun Dec 14 00:54:07.572456 2025] [:error] [pid 14654:tid 14679] [client 4.193.251.36:24957] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aT2aLzqZP_N7tgSGeZcjUgAAABY"]
[Sun Dec 14 00:54:07.746032 2025] [:error] [pid 3636:tid 3705] [client 4.193.251.36:17314] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aT2aL94pNg3LXPqKgeYvQQAAAQ0"]
[Sun Dec 14 00:54:07.919698 2025] [:error] [pid 3636:tid 3710] [client 4.193.251.36:17334] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aT2aL94pNg3LXPqKgeYvQwAAARI"]
[Sun Dec 14 00:54:08.096150 2025] [:error] [pid 14654:tid 14663] [client 4.193.251.36:17368] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT2aMDqZP_N7tgSGeZcjWAAAAAY"]
[Sun Dec 14 00:54:08.279447 2025] [:error] [pid 14654:tid 14681] [client 4.193.251.36:17371] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT2aMDqZP_N7tgSGeZcjWgAAABg"]
[Sun Dec 14 00:54:08.469949 2025] [:error] [pid 14654:tid 14674] [client 4.193.251.36:24894] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT2aMDqZP_N7tgSGeZcjXAAAABE"]
[Sun Dec 14 00:54:08.652977 2025] [:error] [pid 3720:tid 3730] [client 4.193.251.36:17363] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT2aMO7_sgsCEY5RMYrWyQAAAIg"]
[Sun Dec 14 00:54:08.858411 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:17400] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aT2aMDqZP_N7tgSGeZcjYAAAAAQ"]
[Sun Dec 14 00:54:09.060237 2025] [:error] [pid 14654:tid 14669] [client 4.193.251.36:24887] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aT2aMTqZP_N7tgSGeZcjZAAAAAw"]
[Sun Dec 14 00:54:09.233908 2025] [:error] [pid 3720:tid 3740] [client 4.193.251.36:24895] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aT2aMe7_sgsCEY5RMYrWywAAAJI"]
[Sun Dec 14 00:54:09.408380 2025] [:error] [pid 14654:tid 14676] [client 4.193.251.36:24917] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aT2aMTqZP_N7tgSGeZcjZQAAABM"]
[Sun Dec 14 00:54:09.582405 2025] [:error] [pid 3720:tid 3734] [client 4.193.251.36:24872] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aT2aMe7_sgsCEY5RMYrWzAAAAIw"]
[Sun Dec 14 00:54:09.756134 2025] [:error] [pid 3720:tid 3724] [client 4.193.251.36:24889] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aT2aMe7_sgsCEY5RMYrWzQAAAII"]
[Sun Dec 14 00:54:09.941727 2025] [:error] [pid 3720:tid 3738] [client 4.193.251.36:24899] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aT2aMe7_sgsCEY5RMYrWzgAAAJA"]
[Sun Dec 14 00:54:10.117576 2025] [:error] [pid 3720:tid 3732] [client 4.193.251.36:17291] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aT2aMu7_sgsCEY5RMYrW0AAAAIo"]
[Sun Dec 14 00:54:10.291459 2025] [:error] [pid 14654:tid 14667] [client 4.193.251.36:17372] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT2aMjqZP_N7tgSGeZcjcQAAAAo"]
[Sun Dec 14 00:54:10.465697 2025] [:error] [pid 3720:tid 3744] [client 4.193.251.36:17237] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT2aMu7_sgsCEY5RMYrW0gAAAJY"]
[Sun Dec 14 00:54:10.640921 2025] [:error] [pid 3720:tid 3726] [client 4.193.251.36:17396] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT2aMu7_sgsCEY5RMYrW1QAAAIQ"]
[Sun Dec 14 00:54:10.817668 2025] [:error] [pid 3635:tid 3686] [client 4.193.251.36:17398] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT2aMjqfhzW7OpfKxKzflwAAANU"]
[Sun Dec 14 00:54:11.000401 2025] [:error] [pid 14689:tid 14701] [client 4.193.251.36:17326] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aMkEcifvaa9I7Snlt7wAAAUg"]
[Sun Dec 14 00:54:11.176148 2025] [:error] [pid 3720:tid 3736] [client 4.193.251.36:17387] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aM-7_sgsCEY5RMYrW1wAAAI4"]
[Sun Dec 14 00:54:11.354505 2025] [:error] [pid 14689:tid 14703] [client 4.193.251.36:17288] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aM0Ecifvaa9I7Snlt8QAAAUo"]
[Sun Dec 14 00:54:11.535425 2025] [:error] [pid 3720:tid 3735] [client 4.193.251.36:24885] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aM-7_sgsCEY5RMYrW2QAAAI0"]
[Sun Dec 14 00:54:11.715078 2025] [:error] [pid 3720:tid 3730] [client 4.193.251.36:24958] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aT2aM-7_sgsCEY5RMYrW3AAAAIg"]
[Sun Dec 14 00:54:11.888434 2025] [:error] [pid 14654:tid 14681] [client 4.193.251.36:17397] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aT2aMzqZP_N7tgSGeZcjeAAAABg"]
[Sun Dec 14 00:54:12.066129 2025] [:error] [pid 3720:tid 3734] [client 4.193.251.36:17307] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aT2aNO7_sgsCEY5RMYrW4AAAAIw"]
[Sun Dec 14 00:54:12.243291 2025] [:error] [pid 14654:tid 14662] [client 4.193.251.36:17231] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aT2aNDqZP_N7tgSGeZcjfAAAAAU"]
[Sun Dec 14 00:54:12.432030 2025] [:error] [pid 3635:tid 3667] [client 4.193.251.36:24935] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT2aNDqfhzW7OpfKxKzfmwAAAMI"]
[Sun Dec 14 00:54:12.626618 2025] [:error] [pid 3720:tid 3742] [client 4.193.251.36:17293] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT2aNO7_sgsCEY5RMYrW5gAAAJQ"]
[Sun Dec 14 00:54:12.808236 2025] [:error] [pid 14689:tid 14706] [client 4.193.251.36:17360] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT2aNEEcifvaa9I7Snlt9AAAAU0"]
[Sun Dec 14 00:54:12.983394 2025] [:error] [pid 3635:tid 3669] [client 4.193.251.36:17374] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT2aNDqfhzW7OpfKxKzfoAAAAMQ"]
[Sun Dec 14 00:54:13.163885 2025] [:error] [pid 3634:tid 3649] [client 4.193.251.36:17370] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aT2aNYbt-wTl4d7Q7qpzogAAAEs"]
[Sun Dec 14 00:54:13.337676 2025] [:error] [pid 14654:tid 14667] [client 4.193.251.36:24865] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aT2aNTqZP_N7tgSGeZcjfgAAAAo"]
[Sun Dec 14 00:54:13.511797 2025] [:error] [pid 3636:tid 3713] [client 4.193.251.36:24927] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aT2aNd4pNg3LXPqKgeYvRQAAARU"]
[Sun Dec 14 00:54:13.686229 2025] [:error] [pid 3636:tid 3703] [client 4.193.251.36:17318] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aT2aNd4pNg3LXPqKgeYvSAAAAQs"]
[Sun Dec 14 00:54:13.862060 2025] [:error] [pid 14654:tid 14680] [client 4.193.251.36:17349] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aT2aNTqZP_N7tgSGeZcjgAAAABc"]
[Sun Dec 14 00:54:14.036650 2025] [:error] [pid 3636:tid 3694] [client 4.193.251.36:17324] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aT2aNt4pNg3LXPqKgeYvSwAAAQI"]
[Sun Dec 14 00:54:14.222249 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:24891] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aT2aNjqZP_N7tgSGeZcjggAAAAQ"]
[Sun Dec 14 00:54:14.415148 2025] [:error] [pid 3720:tid 3730] [client 4.193.251.36:17332] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aT2aNu7_sgsCEY5RMYrW7QAAAIg"]
[Sun Dec 14 00:54:14.595271 2025] [:error] [pid 3635:tid 3688] [client 4.193.251.36:17394] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aT2aNjqfhzW7OpfKxKzfqQAAANc"]
[Sun Dec 14 00:54:14.769677 2025] [:error] [pid 3635:tid 3668] [client 4.193.251.36:17327] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aT2aNjqfhzW7OpfKxKzfrgAAAMM"]
[Sun Dec 14 00:54:14.954300 2025] [:error] [pid 14654:tid 14669] [client 4.193.251.36:17376] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aT2aNjqZP_N7tgSGeZcjhAAAAAw"]
[Sun Dec 14 00:54:15.129125 2025] [:error] [pid 3636:tid 3715] [client 4.193.251.36:17308] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aT2aN94pNg3LXPqKgeYvUgAAARc"]
[Sun Dec 14 00:54:15.305481 2025] [:error] [pid 3720:tid 3745] [client 4.193.251.36:24868] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aT2aN-7_sgsCEY5RMYrW8gAAAJc"]
[Sun Dec 14 00:54:15.480041 2025] [:error] [pid 3635:tid 3667] [client 4.193.251.36:24881] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aT2aNzqfhzW7OpfKxKzfsgAAAMI"]
[Sun Dec 14 00:54:15.659849 2025] [:error] [pid 14654:tid 14672] [client 4.193.251.36:17402] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aT2aNzqZP_N7tgSGeZcjhgAAAA8"]
[Sun Dec 14 00:54:15.835831 2025] [:error] [pid 14654:tid 14657] [client 4.193.251.36:17221] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aT2aNzqZP_N7tgSGeZcjiAAAAAA"]
[Sun Dec 14 00:54:16.009464 2025] [:error] [pid 3635:tid 3674] [client 4.193.251.36:17333] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aT2aODqfhzW7OpfKxKzftgAAAMk"]
[Sun Dec 14 00:54:16.183156 2025] [:error] [pid 14654:tid 14678] [client 4.193.251.36:24921] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aT2aODqZP_N7tgSGeZcjiQAAABU"]
[Sun Dec 14 00:54:16.357020 2025] [:error] [pid 14689:tid 14717] [client 4.193.251.36:17296] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aT2aOEEcifvaa9I7Snlt-gAAAVg"]
[Sun Dec 14 00:54:16.530804 2025] [:error] [pid 3636:tid 3711] [client 4.193.251.36:24932] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aT2aON4pNg3LXPqKgeYvWQAAARM"]
[Sun Dec 14 00:54:16.741131 2025] [:error] [pid 3636:tid 3697] [client 4.193.251.36:17280] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aT2aON4pNg3LXPqKgeYvXAAAAQU"]
[Sun Dec 14 00:54:16.923847 2025] [:error] [pid 3636:tid 3698] [client 4.193.251.36:17313] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aT2aON4pNg3LXPqKgeYvXQAAAQY"]
[Sun Dec 14 00:54:17.097126 2025] [:error] [pid 3636:tid 3716] [client 4.193.251.36:17216] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aT2aOd4pNg3LXPqKgeYvYAAAARg"]
[Sun Dec 14 00:54:17.273791 2025] [:error] [pid 3636:tid 3693] [client 4.193.251.36:24837] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aT2aOd4pNg3LXPqKgeYvYgAAAQE"]
[Sun Dec 14 00:54:17.447491 2025] [:error] [pid 3720:tid 3734] [client 4.193.251.36:17345] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aT2aOe7_sgsCEY5RMYrXAQAAAIw"]
[Sun Dec 14 00:54:17.621052 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:24930] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aT2aOTqZP_N7tgSGeZcjkwAAAAQ"]
[Sun Dec 14 00:54:17.797518 2025] [:error] [pid 3634:tid 3658] [client 4.193.251.36:24936] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aT2aOYbt-wTl4d7Q7qpzpQAAAFQ"]
[Sun Dec 14 00:54:17.971796 2025] [:error] [pid 3634:tid 3641] [client 4.193.251.36:17358] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aT2aOYbt-wTl4d7Q7qpzpwAAAEM"]
[Sun Dec 14 00:54:18.150093 2025] [:error] [pid 3634:tid 3652] [client 4.193.251.36:17364] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aT2aOobt-wTl4d7Q7qpzqAAAAE4"]
[Sun Dec 14 00:54:18.323421 2025] [:error] [pid 14654:tid 14676] [client 4.193.251.36:17317] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aT2aOjqZP_N7tgSGeZcjngAAABM"]
[Sun Dec 14 00:54:18.499026 2025] [:error] [pid 14689:tid 14703] [client 4.193.251.36:17303] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aT2aOkEcifvaa9I7SnluAQAAAUo"]
[Sun Dec 14 00:54:18.672944 2025] [:error] [pid 3636:tid 3700] [client 4.193.251.36:17286] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aT2aOt4pNg3LXPqKgeYvZwAAAQg"]
[Sun Dec 14 00:54:18.847060 2025] [:error] [pid 3636:tid 3715] [client 4.193.251.36:24912] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aT2aOt4pNg3LXPqKgeYvaAAAARc"]
[Sun Dec 14 00:54:19.073293 2025] [:error] [pid 14654:tid 14677] [client 4.193.251.36:17323] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aT2aOzqZP_N7tgSGeZcjoQAAABQ"]
[Sun Dec 14 00:54:19.248211 2025] [:error] [pid 14654:tid 14673] [client 4.193.251.36:24873] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aT2aOzqZP_N7tgSGeZcjogAAABA"]
[Sun Dec 14 00:54:19.426433 2025] [:error] [pid 14654:tid 14674] [client 4.193.251.36:17302] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aT2aOzqZP_N7tgSGeZcjpwAAABE"]
[Sun Dec 14 00:54:19.602132 2025] [:error] [pid 14654:tid 14670] [client 4.193.251.36:17341] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aT2aOzqZP_N7tgSGeZcjqQAAAA0"]
[Sun Dec 14 00:54:19.776956 2025] [:error] [pid 14654:tid 14679] [client 4.193.251.36:24934] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aT2aOzqZP_N7tgSGeZcjqwAAABY"]
[Sun Dec 14 00:54:19.951087 2025] [:error] [pid 14654:tid 14657] [client 4.193.251.36:17292] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aT2aOzqZP_N7tgSGeZcjrQAAAAA"]
[Sun Dec 14 00:54:20.124659 2025] [:error] [pid 3634:tid 3644] [client 4.193.251.36:17343] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aT2aPIbt-wTl4d7Q7qpzsgAAAEY"]
[Sun Dec 14 00:54:20.299876 2025] [:error] [pid 14654:tid 14678] [client 4.193.251.36:17339] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aT2aPDqZP_N7tgSGeZcjrwAAABU"]
[Sun Dec 14 00:54:20.475574 2025] [:error] [pid 14689:tid 14713] [client 4.193.251.36:17379] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aT2aPEEcifvaa9I7SnluBwAAAVQ"]
[Sun Dec 14 00:54:20.650634 2025] [:error] [pid 3635:tid 3685] [client 4.193.251.36:17401] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aT2aPDqfhzW7OpfKxKzfwAAAANQ"]
[Sun Dec 14 00:54:20.822930 2025] [:error] [pid 14654:tid 14672] [client 4.193.251.36:17395] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aT2aPDqZP_N7tgSGeZcjsgAAAA8"]
[Sun Dec 14 00:54:20.995444 2025] [:error] [pid 3635:tid 3687] [client 4.193.251.36:24900] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aT2aPDqfhzW7OpfKxKzfwQAAANY"]
[Sun Dec 14 00:54:21.168860 2025] [:error] [pid 3635:tid 3665] [client 4.193.251.36:17366] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aT2aPTqfhzW7OpfKxKzfwwAAAMA"]
[Sun Dec 14 00:54:21.352019 2025] [:error] [pid 3634:tid 3649] [client 4.193.251.36:17356] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aT2aPYbt-wTl4d7Q7qpzuQAAAEs"]
[Sun Dec 14 00:54:21.525764 2025] [:error] [pid 14689:tid 14693] [client 4.193.251.36:24905] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aT2aPUEcifvaa9I7SnluCwAAAUA"]
[Sun Dec 14 00:54:21.699469 2025] [:error] [pid 3634:tid 3652] [client 4.193.251.36:24884] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aPYbt-wTl4d7Q7qpzvAAAAE4"]
[Sun Dec 14 00:54:21.873320 2025] [:error] [pid 14689:tid 14710] [client 4.193.251.36:17301] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aPUEcifvaa9I7SnluDgAAAVE"]
[Sun Dec 14 00:54:22.048424 2025] [:error] [pid 3635:tid 3667] [client 4.193.251.36:24847] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aPjqfhzW7OpfKxKzfxQAAAMI"]
[Sun Dec 14 00:54:22.222633 2025] [:error] [pid 14654:tid 14673] [client 4.193.251.36:17162] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aT2aPjqZP_N7tgSGeZcjtwAAABA"]
[Sun Dec 14 00:54:22.451120 2025] [:error] [pid 14689:tid 14712] [client 4.193.251.36:17278] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aT2aPkEcifvaa9I7SnluEQAAAVM"]
[Sun Dec 14 00:54:22.624787 2025] [:error] [pid 14654:tid 14667] [client 4.193.251.36:17337] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aT2aPjqZP_N7tgSGeZcjuAAAAAo"]
[Sun Dec 14 00:54:22.798462 2025] [:error] [pid 14689:tid 14708] [client 4.193.251.36:17389] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aT2aPkEcifvaa9I7SnluFAAAAU8"]
[Sun Dec 14 00:54:22.972473 2025] [:error] [pid 14689:tid 14695] [client 4.193.251.36:17346] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aT2aPkEcifvaa9I7SnluFgAAAUI"]
[Sun Dec 14 00:54:23.146227 2025] [:error] [pid 14654:tid 14670] [client 4.193.251.36:17319] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aT2aPzqZP_N7tgSGeZcjuwAAAA0"]
[Sun Dec 14 00:54:23.320172 2025] [:error] [pid 14654:tid 14669] [client 4.193.251.36:17224] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aT2aPzqZP_N7tgSGeZcjvQAAAAw"]
[Sun Dec 14 00:54:23.493681 2025] [:error] [pid 3720:tid 3724] [client 4.193.251.36:17406] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aT2aP-7_sgsCEY5RMYrXBAAAAII"]
[Sun Dec 14 00:54:23.666624 2025] [:error] [pid 3720:tid 3731] [client 4.193.251.36:17393] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aT2aP-7_sgsCEY5RMYrXBQAAAIk"]
[Sun Dec 14 00:54:23.845289 2025] [:error] [pid 3720:tid 3728] [client 4.193.251.36:17284] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aT2aP-7_sgsCEY5RMYrXCAAAAIY"]
[Sun Dec 14 00:54:24.018408 2025] [:error] [pid 14654:tid 14671] [client 4.193.251.36:24882] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aT2aQDqZP_N7tgSGeZcjvwAAAA4"]
[Sun Dec 14 00:54:24.196714 2025] [:error] [pid 3720:tid 3739] [client 4.193.251.36:17167] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aT2aQO7_sgsCEY5RMYrXCQAAAJE"]
[Sun Dec 14 00:54:24.370050 2025] [:error] [pid 14654:tid 14663] [client 4.193.251.36:17223] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aT2aQDqZP_N7tgSGeZcjxgAAAAY"]
[Sun Dec 14 00:54:24.543169 2025] [:error] [pid 3635:tid 3687] [client 4.193.251.36:17232] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aT2aQDqfhzW7OpfKxKzf0wAAANY"]
[Sun Dec 14 00:54:24.721012 2025] [:error] [pid 3635:tid 3670] [client 4.193.251.36:17316] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aT2aQDqfhzW7OpfKxKzf1gAAAMU"]
[Sun Dec 14 00:54:24.899603 2025] [:error] [pid 3636:tid 3701] [client 4.193.251.36:17342] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aT2aQN4pNg3LXPqKgeYvdwAAAQk"]
[Sun Dec 14 00:54:25.075522 2025] [:error] [pid 3636:tid 3702] [client 4.193.251.36:17219] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aT2aQd4pNg3LXPqKgeYveQAAAQo"]
[Sun Dec 14 00:54:25.248981 2025] [:error] [pid 3636:tid 3700] [client 4.193.251.36:17245] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aT2aQd4pNg3LXPqKgeYvfAAAAQg"]
[Sun Dec 14 00:54:25.422989 2025] [:error] [pid 14654:tid 14675] [client 4.193.251.36:17357] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aT2aQTqZP_N7tgSGeZcjyAAAABI"]
[Sun Dec 14 00:54:25.600002 2025] [:error] [pid 14689:tid 14717] [client 4.193.251.36:17282] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aT2aQUEcifvaa9I7SnluIAAAAVg"]
[Sun Dec 14 00:54:25.776383 2025] [:error] [pid 14654:tid 14664] [client 4.193.251.36:17310] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aT2aQTqZP_N7tgSGeZcjygAAAAc"]
[Sun Dec 14 00:54:25.949691 2025] [:error] [pid 14654:tid 14674] [client 4.193.251.36:17331] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aT2aQTqZP_N7tgSGeZcjzgAAABE"]
[Sun Dec 14 00:54:26.125378 2025] [:error] [pid 14689:tid 14709] [client 4.193.251.36:17407] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aT2aQkEcifvaa9I7SnluJwAAAVA"]
[Sun Dec 14 00:54:26.329105 2025] [:error] [pid 14689:tid 14702] [client 4.193.251.36:17275] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aT2aQkEcifvaa9I7SnluKQAAAUk"]
[Sun Dec 14 00:54:26.503102 2025] [:error] [pid 3635:tid 3682] [client 4.193.251.36:17299] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aT2aQjqfhzW7OpfKxKzf2wAAANE"]
[Sun Dec 14 00:54:26.677528 2025] [:error] [pid 3636:tid 3692] [client 4.193.251.36:17256] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT2aQt4pNg3LXPqKgeYvgQAAAQA"]
[Sun Dec 14 00:54:26.854106 2025] [:error] [pid 14654:tid 14679] [client 4.193.251.36:17155] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT2aQjqZP_N7tgSGeZcj0wAAABY"]
[Sun Dec 14 00:54:27.028345 2025] [:error] [pid 14654:tid 14678] [client 4.193.251.36:17276] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT2aQzqZP_N7tgSGeZcj1QAAABU"]
[Sun Dec 14 00:54:27.247511 2025] [:error] [pid 3634:tid 3651] [client 4.193.251.36:24942] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT2aQ4bt-wTl4d7Q7qpzxAAAAE0"]
[Sun Dec 14 00:54:27.421647 2025] [:error] [pid 3634:tid 3646] [client 4.193.251.36:17386] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT2aQ4bt-wTl4d7Q7qpzxwAAAEg"]
[Sun Dec 14 00:54:27.596612 2025] [:error] [pid 14689:tid 14698] [client 4.193.251.36:17369] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT2aQ0Ecifvaa9I7SnluMgAAAUU"]
[Sun Dec 14 00:54:27.770255 2025] [:error] [pid 14654:tid 14676] [client 4.193.251.36:17300] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT2aQzqZP_N7tgSGeZcj1gAAABM"]
[Sun Dec 14 00:54:27.944533 2025] [:error] [pid 14654:tid 14672] [client 4.193.251.36:17330] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT2aQzqZP_N7tgSGeZcj2AAAAA8"]
[Sun Dec 14 00:54:28.126172 2025] [:error] [pid 3634:tid 3658] [client 4.193.251.36:17154] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aT2aRIbt-wTl4d7Q7qpzywAAAFQ"]
[Sun Dec 14 00:54:28.301122 2025] [:error] [pid 14654:tid 14658] [client 4.193.251.36:17173] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aT2aRDqZP_N7tgSGeZcj2gAAAAE"]
[Sun Dec 14 00:54:28.481899 2025] [:error] [pid 14689:tid 14707] [client 4.193.251.36:17321] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aT2aREEcifvaa9I7SnluNQAAAU4"]
[Sun Dec 14 00:54:28.660874 2025] [:error] [pid 3634:tid 3660] [client 4.193.251.36:17384] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aT2aRIbt-wTl4d7Q7qpzzwAAAFY"]
[Sun Dec 14 00:54:28.837308 2025] [:error] [pid 3720:tid 3734] [client 4.193.251.36:17158] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aT2aRO7_sgsCEY5RMYrXEQAAAIw"]
[Sun Dec 14 00:54:29.012565 2025] [:error] [pid 3634:tid 3662] [client 4.193.251.36:17388] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aT2aRYbt-wTl4d7Q7qpz0gAAAFg"]
[Sun Dec 14 00:54:29.188746 2025] [:error] [pid 3634:tid 3639] [client 4.193.251.36:17320] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aT2aRYbt-wTl4d7Q7qpz0wAAAEE"]
[Sun Dec 14 00:54:29.382833 2025] [:error] [pid 14689:tid 14708] [client 4.193.251.36:17218] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aT2aRUEcifvaa9I7SnluPQAAAU8"]
[Sun Dec 14 00:54:29.559655 2025] [:error] [pid 3634:tid 3647] [client 4.193.251.36:17234] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT2aRYbt-wTl4d7Q7qpz1gAAAEk"]
[Sun Dec 14 00:54:29.733867 2025] [:error] [pid 14654:tid 14674] [client 4.193.251.36:24833] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT2aRTqZP_N7tgSGeZcj4AAAABE"]
[Sun Dec 14 00:54:29.910832 2025] [:error] [pid 3634:tid 3648] [client 4.193.251.36:17297] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT2aRYbt-wTl4d7Q7qpz2AAAAEo"]
[Sun Dec 14 00:54:30.087045 2025] [:error] [pid 3636:tid 3714] [client 4.193.251.36:17255] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT2aRt4pNg3LXPqKgeYvhgAAARY"]
[Sun Dec 14 00:54:30.262066 2025] [:error] [pid 3636:tid 3713] [client 4.193.251.36:17287] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aT2aRt4pNg3LXPqKgeYviAAAARU"]
[Sun Dec 14 00:54:30.455029 2025] [:error] [pid 3634:tid 3644] [client 4.193.251.36:17225] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aT2aRobt-wTl4d7Q7qpz2QAAAEY"]
[Sun Dec 14 00:54:30.629340 2025] [:error] [pid 3636:tid 3712] [client 4.193.251.36:17254] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aT2aRt4pNg3LXPqKgeYviQAAARQ"]
[Sun Dec 14 00:54:30.804176 2025] [:error] [pid 14654:tid 14672] [client 4.193.251.36:17236] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aT2aRjqZP_N7tgSGeZcj7AAAAA8"]
[Sun Dec 14 00:54:30.981392 2025] [:error] [pid 3720:tid 3745] [client 4.193.251.36:17131] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aT2aRu7_sgsCEY5RMYrXFAAAAJc"]
[Sun Dec 14 00:54:31.160629 2025] [:error] [pid 3634:tid 3646] [client 4.193.251.36:17265] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aT2aR4bt-wTl4d7Q7qpz3QAAAEg"]
[Sun Dec 14 00:54:31.343186 2025] [:error] [pid 3720:tid 3731] [client 4.193.251.36:17243] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aT2aR-7_sgsCEY5RMYrXGAAAAIk"]
[Sun Dec 14 00:54:31.548002 2025] [:error] [pid 3634:tid 3656] [client 4.193.251.36:17295] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aT2aR4bt-wTl4d7Q7qpz3gAAAFI"]
[Sun Dec 14 00:54:31.722166 2025] [:error] [pid 3634:tid 3657] [client 4.193.251.36:24893] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aT2aR4bt-wTl4d7Q7qpz3wAAAFM"]
[Sun Dec 14 00:54:31.895841 2025] [:error] [pid 14654:tid 14673] [client 4.193.251.36:24948] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aT2aRzqZP_N7tgSGeZcj8QAAABA"]
[Sun Dec 14 00:54:32.090538 2025] [:error] [pid 3720:tid 3728] [client 4.193.251.36:17235] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aT2aSO7_sgsCEY5RMYrXGwAAAIY"]
[Sun Dec 14 00:54:32.266725 2025] [:error] [pid 14654:tid 14680] [client 4.193.251.36:17266] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aT2aSDqZP_N7tgSGeZcj9gAAABc"]
[Sun Dec 14 00:54:32.439444 2025] [:error] [pid 3635:tid 3686] [client 4.193.251.36:17262] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aSDqfhzW7OpfKxKzf5AAAANU"]
[Sun Dec 14 00:54:32.614380 2025] [:error] [pid 14689:tid 14713] [client 4.193.251.36:17251] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aSEEcifvaa9I7SnluRQAAAVQ"]
[Sun Dec 14 00:54:32.788192 2025] [:error] [pid 3634:tid 3645] [client 4.193.251.36:17263] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aSIbt-wTl4d7Q7qpz5QAAAEc"]
[Sun Dec 14 00:54:32.966199 2025] [:error] [pid 3636:tid 3697] [client 4.193.251.36:17294] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT2aSN4pNg3LXPqKgeYvigAAAQU"]
[Sun Dec 14 00:54:33.140611 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:17201] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT2aSTqZP_N7tgSGeZcj9wAAAAQ"]
[Sun Dec 14 00:54:33.317059 2025] [:error] [pid 14689:tid 14707] [client 4.193.251.36:24951] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT2aSUEcifvaa9I7SnluSAAAAU4"]
[Sun Dec 14 00:54:33.493461 2025] [:error] [pid 3720:tid 3729] [client 4.193.251.36:24950] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT2aSe7_sgsCEY5RMYrXIQAAAIc"]
[Sun Dec 14 00:54:33.672068 2025] [:error] [pid 14654:tid 14669] [client 4.193.251.36:17273] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT2aSTqZP_N7tgSGeZcj-gAAAAw"]
[Sun Dec 14 00:54:33.848773 2025] [:error] [pid 3636:tid 3703] [client 4.193.251.36:17217] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aSd4pNg3LXPqKgeYvjAAAAQs"]
[Sun Dec 14 00:54:34.022330 2025] [:error] [pid 14654:tid 14678] [client 4.193.251.36:17304] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aSjqZP_N7tgSGeZcj_QAAABU"]
[Sun Dec 14 00:54:34.199284 2025] [:error] [pid 3720:tid 3746] [client 4.193.251.36:17269] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aSu7_sgsCEY5RMYrXJgAAAJg"]
[Sun Dec 14 00:54:34.375358 2025] [:error] [pid 3634:tid 3639] [client 4.193.251.36:17248] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aT2aSobt-wTl4d7Q7qpz5wAAAEE"]
[Sun Dec 14 00:54:34.550175 2025] [:error] [pid 3635:tid 3682] [client 4.193.251.36:17338] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aT2aSjqfhzW7OpfKxKzf7wAAANE"]
[Sun Dec 14 00:54:34.728796 2025] [:error] [pid 3634:tid 3647] [client 4.193.251.36:17095] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aT2aSobt-wTl4d7Q7qpz6gAAAEk"]
[Sun Dec 14 00:54:34.904768 2025] [:error] [pid 3720:tid 3722] [client 4.193.251.36:17242] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aT2aSu7_sgsCEY5RMYrXLQAAAIA"]
[Sun Dec 14 00:54:35.081569 2025] [:error] [pid 3720:tid 3724] [client 4.193.251.36:17247] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aT2aS-7_sgsCEY5RMYrXLgAAAII"]
[Sun Dec 14 00:54:35.255080 2025] [:error] [pid 3634:tid 3644] [client 4.193.251.36:17185] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aT2aS4bt-wTl4d7Q7qpz7QAAAEY"]
[Sun Dec 14 00:54:35.428885 2025] [:error] [pid 14689:tid 14710] [client 4.193.251.36:17153] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aT2aS0Ecifvaa9I7SnluTQAAAVE"]
[Sun Dec 14 00:54:35.628353 2025] [:error] [pid 14654:tid 14668] [client 4.193.251.36:17285] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aT2aSzqZP_N7tgSGeZckBQAAAAs"]
[Sun Dec 14 00:54:35.802774 2025] [:error] [pid 3720:tid 3727] [client 4.193.251.36:17385] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aT2aS-7_sgsCEY5RMYrXMgAAAIU"]
[Sun Dec 14 00:54:35.983900 2025] [:error] [pid 3720:tid 3739] [client 4.193.251.36:17222] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aT2aS-7_sgsCEY5RMYrXMwAAAJE"]
[Sun Dec 14 00:54:36.156968 2025] [:error] [pid 3634:tid 3642] [client 4.193.251.36:24839] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aT2aTIbt-wTl4d7Q7qpz7gAAAEQ"]
[Sun Dec 14 00:54:36.332668 2025] [:error] [pid 3720:tid 3736] [client 4.193.251.36:17249] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aT2aTO7_sgsCEY5RMYrXNQAAAI4"]
[Sun Dec 14 00:54:36.505979 2025] [:error] [pid 3634:tid 3656] [client 4.193.251.36:17316] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aT2aTIbt-wTl4d7Q7qpz8QAAAFI"]
[Sun Dec 14 00:54:36.681519 2025] [:error] [pid 14689:tid 14706] [client 4.193.251.36:17392] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aT2aTEEcifvaa9I7SnluVAAAAU0"]
[Sun Dec 14 00:54:36.860316 2025] [:error] [pid 3634:tid 3659] [client 4.193.251.36:17258] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aT2aTIbt-wTl4d7Q7qpz9AAAAFU"]
[Sun Dec 14 00:54:37.036062 2025] [:error] [pid 3634:tid 3639] [client 4.193.251.36:17367] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aT2aTYbt-wTl4d7Q7qpz9gAAAEE"]
[Sun Dec 14 00:54:37.209807 2025] [:error] [pid 3636:tid 3701] [client 4.193.251.36:17202] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aT2aTd4pNg3LXPqKgeYvjgAAAQk"]
[Sun Dec 14 00:54:37.385844 2025] [:error] [pid 3720:tid 3729] [client 4.193.251.36:17240] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aT2aTe7_sgsCEY5RMYrXOQAAAIc"]
[Sun Dec 14 00:54:37.559679 2025] [:error] [pid 3720:tid 3730] [client 4.193.251.36:17244] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aT2aTe7_sgsCEY5RMYrXOwAAAIg"]
[Sun Dec 14 00:54:37.734086 2025] [:error] [pid 14654:tid 14670] [client 4.193.251.36:17329] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aT2aTTqZP_N7tgSGeZckCgAAAA0"]
[Sun Dec 14 00:54:37.907771 2025] [:error] [pid 3720:tid 3733] [client 4.193.251.36:17180] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aT2aTe7_sgsCEY5RMYrXPQAAAIs"]
[Sun Dec 14 00:54:38.081365 2025] [:error] [pid 14654:tid 14679] [client 4.193.251.36:24864] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aT2aTjqZP_N7tgSGeZckDgAAABY"]
[Sun Dec 14 00:54:38.255204 2025] [:error] [pid 3720:tid 3740] [client 4.193.251.36:17382] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aT2aTu7_sgsCEY5RMYrXQAAAAJI"]
[Sun Dec 14 00:54:38.435299 2025] [:error] [pid 3720:tid 3722] [client 4.193.251.36:17264] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aT2aTu7_sgsCEY5RMYrXQQAAAIA"]
[Sun Dec 14 00:54:38.609598 2025] [:error] [pid 3634:tid 3644] [client 4.193.251.36:17178] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aT2aTobt-wTl4d7Q7qp0DgAAAEY"]
[Sun Dec 14 00:54:38.813720 2025] [:error] [pid 3720:tid 3737] [client 4.193.251.36:17227] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aT2aTu7_sgsCEY5RMYrXRQAAAI8"]
[Sun Dec 14 00:54:38.986954 2025] [:error] [pid 14654:tid 14660] [client 4.193.251.36:17268] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aT2aTjqZP_N7tgSGeZckEwAAAAM"]
[Sun Dec 14 00:54:39.160439 2025] [:error] [pid 3634:tid 3649] [client 4.193.251.36:17311] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aT2aT4bt-wTl4d7Q7qp0EwAAAEs"]
[Sun Dec 14 00:54:39.335690 2025] [:error] [pid 14689:tid 14704] [client 4.193.251.36:17309] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aT2aT0Ecifvaa9I7SnluYAAAAUs"]
[Sun Dec 14 00:54:39.510429 2025] [:error] [pid 14689:tid 14714] [client 4.193.251.36:17183] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT2aT0Ecifvaa9I7SnluYgAAAVU"]
[Sun Dec 14 00:54:39.684039 2025] [:error] [pid 3720:tid 3744] [client 4.193.251.36:17322] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT2aT-7_sgsCEY5RMYrXSgAAAJY"]
[Sun Dec 14 00:54:39.862520 2025] [:error] [pid 3634:tid 3648] [client 4.193.251.36:17226] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT2aT4bt-wTl4d7Q7qp0GQAAAEo"]
[Sun Dec 14 00:54:40.036323 2025] [:error] [pid 3720:tid 3729] [client 4.193.251.36:17272] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT2aUO7_sgsCEY5RMYrXTQAAAIc"]
[Sun Dec 14 00:54:40.210811 2025] [:error] [pid 14654:tid 14664] [client 4.193.251.36:17190] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aT2aUDqZP_N7tgSGeZckGwAAAAc"]
[Sun Dec 14 00:54:40.392591 2025] [:error] [pid 14689:tid 14712] [client 4.193.251.36:17170] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aT2aUEEcifvaa9I7SnluZgAAAVM"]
[Sun Dec 14 00:54:40.569338 2025] [:error] [pid 14689:tid 14695] [client 4.193.251.36:17250] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aT2aUEEcifvaa9I7SnluaAAAAUI"]
[Sun Dec 14 00:54:40.743692 2025] [:error] [pid 14689:tid 14706] [client 4.193.251.36:17270] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aT2aUEEcifvaa9I7SnluawAAAU0"]
[Sun Dec 14 00:54:40.918592 2025] [:error] [pid 3720:tid 3734] [client 4.193.251.36:17230] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aT2aUO7_sgsCEY5RMYrXUQAAAIw"]
[Sun Dec 14 00:54:41.093404 2025] [:error] [pid 14689:tid 14694] [client 4.193.251.36:17234] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aT2aUUEcifvaa9I7SnlubgAAAUE"]
[Sun Dec 14 00:54:41.268165 2025] [:error] [pid 14689:tid 14717] [client 4.193.251.36:17312] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aT2aUUEcifvaa9I7SnlucQAAAVg"]
[Sun Dec 14 00:54:41.441914 2025] [:error] [pid 3635:tid 3681] [client 4.193.251.36:17197] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aT2aUTqfhzW7OpfKxKzgDQAAANA"]
[Sun Dec 14 00:54:41.616156 2025] [:error] [pid 14654:tid 14676] [client 4.193.251.36:17277] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT2aUTqZP_N7tgSGeZckIwAAABM"]
[Sun Dec 14 00:54:41.793595 2025] [:error] [pid 14689:tid 14716] [client 4.193.251.36:17199] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT2aUUEcifvaa9I7SnludAAAAVc"]
[Sun Dec 14 00:54:41.969448 2025] [:error] [pid 3634:tid 3656] [client 4.193.251.36:17260] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT2aUYbt-wTl4d7Q7qp0LgAAAFI"]
[Sun Dec 14 00:54:42.142893 2025] [:error] [pid 3635:tid 3685] [client 4.193.251.36:17093] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT2aUjqfhzW7OpfKxKzgFAAAANQ"]
[Sun Dec 14 00:54:42.318493 2025] [:error] [pid 14689:tid 14712] [client 4.193.251.36:17375] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aT2aUkEcifvaa9I7SnluegAAAVM"]
[Sun Dec 14 00:54:42.495254 2025] [:error] [pid 14689:tid 14695] [client 4.193.251.36:17181] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aT2aUkEcifvaa9I7SnluewAAAUI"]
[Sun Dec 14 00:54:42.690914 2025] [:error] [pid 14654:tid 14663] [client 4.193.251.36:17140] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aT2aUjqZP_N7tgSGeZckJgAAAAY"]
[Sun Dec 14 00:54:42.864959 2025] [:error] [pid 14654:tid 14675] [client 4.193.251.36:17336] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aT2aUjqZP_N7tgSGeZckKQAAABI"]
[Sun Dec 14 00:54:43.042810 2025] [:error] [pid 3634:tid 3647] [client 4.193.251.36:17174] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aT2aU4bt-wTl4d7Q7qp0NwAAAEk"]
[Sun Dec 14 00:54:43.217301 2025] [:error] [pid 3636:tid 3695] [client 4.193.251.36:17290] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aT2aU94pNg3LXPqKgeYvlgAAAQM"]
[Sun Dec 14 00:54:43.400722 2025] [:error] [pid 3634:tid 3650] [client 4.193.251.36:17238] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aT2aU4bt-wTl4d7Q7qp0OAAAAEw"]
[Sun Dec 14 00:54:43.578800 2025] [:error] [pid 3634:tid 3641] [client 4.193.251.36:17163] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aT2aU4bt-wTl4d7Q7qp0PAAAAEM"]
[Sun Dec 14 00:54:43.753831 2025] [:error] [pid 3636:tid 3714] [client 4.193.251.36:17279] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aT2aU94pNg3LXPqKgeYvmAAAARY"]
[Sun Dec 14 00:54:43.927974 2025] [:error] [pid 14689:tid 14707] [client 4.193.251.36:17161] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aT2aU0Ecifvaa9I7SnluhQAAAU4"]
[Sun Dec 14 00:54:44.102089 2025] [:error] [pid 14654:tid 14657] [client 4.193.251.36:17229] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aT2aVDqZP_N7tgSGeZckLAAAAAA"]
[Sun Dec 14 00:54:44.276215 2025] [:error] [pid 3635:tid 3675] [client 4.193.251.36:17228] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aT2aVDqfhzW7OpfKxKzgHgAAAMo"]
[Sun Dec 14 00:54:44.450633 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:17114] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aT2aVDqZP_N7tgSGeZckMAAAAAQ"]
[Sun Dec 14 00:54:44.632243 2025] [:error] [pid 3636:tid 3713] [client 4.193.251.36:17101] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aT2aVN4pNg3LXPqKgeYvmgAAARU"]
[Sun Dec 14 00:54:44.807916 2025] [:error] [pid 3635:tid 3684] [client 4.193.251.36:17029] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aT2aVDqfhzW7OpfKxKzgIwAAANM"]
[Sun Dec 14 00:54:45.019400 2025] [:error] [pid 3635:tid 3686] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/asas.php
[Sun Dec 14 00:54:45.116759 2025] [:error] [pid 3635:tid 3687] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Dec 14 00:54:45.208739 2025] [:error] [pid 3635:tid 3683] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 14 00:54:45.299636 2025] [:error] [pid 3635:tid 3669] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Sun Dec 14 00:54:45.390907 2025] [:error] [pid 3635:tid 3665] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/zxl.php
[Sun Dec 14 00:54:45.482705 2025] [:error] [pid 3635:tid 3670] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/r.php
[Sun Dec 14 00:54:45.571829 2025] [:error] [pid 3635:tid 3667] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Sun Dec 14 00:54:45.664980 2025] [:error] [pid 3635:tid 3679] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/js.php
[Sun Dec 14 00:54:45.756162 2025] [:error] [pid 3635:tid 3674] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/file1.php
[Sun Dec 14 00:54:45.848288 2025] [:error] [pid 3635:tid 3676] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Dec 14 00:54:45.938439 2025] [:error] [pid 3635:tid 3675] [client 4.193.251.36:17157] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php
[Sun Dec 14 00:54:46.026072 2025] [:error] [pid 3635:tid 3681] [client 4.193.251.36:17157] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aT2aVjqfhzW7OpfKxKzgNgAAANA"]
[Sun Dec 14 00:54:46.201692 2025] [:error] [pid 3636:tid 3715] [client 4.193.251.36:17257] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aT2aVt4pNg3LXPqKgeYvpQAAARc"]
[Sun Dec 14 00:54:46.376135 2025] [:error] [pid 3634:tid 3639] [client 4.193.251.36:17168] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aT2aVobt-wTl4d7Q7qp0QgAAAEE"]
[Sun Dec 14 00:54:46.560905 2025] [:error] [pid 3720:tid 3726] [client 4.193.251.36:17162] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aT2aVu7_sgsCEY5RMYrXWAAAAIQ"]
[Sun Dec 14 00:54:46.734409 2025] [:error] [pid 3720:tid 3728] [client 4.193.251.36:17150] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aT2aVu7_sgsCEY5RMYrXWQAAAIY"]
[Sun Dec 14 00:54:46.912120 2025] [:error] [pid 14654:tid 14675] [client 4.193.251.36:17239] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aT2aVjqZP_N7tgSGeZckPgAAABI"]
[Sun Dec 14 00:54:47.104535 2025] [:error] [pid 3635:tid 3673] [client 4.193.251.36:17120] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aT2aVzqfhzW7OpfKxKzgPgAAAMg"]
[Sun Dec 14 00:54:47.291185 2025] [:error] [pid 14689:tid 14693] [client 4.193.251.36:17152] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aT2aV0Ecifvaa9I7SnluhgAAAUA"]
[Sun Dec 14 00:54:47.464856 2025] [:error] [pid 14689:tid 14714] [client 4.193.251.36:17196] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aT2aV0Ecifvaa9I7SnluiAAAAVU"]
[Sun Dec 14 00:54:47.662746 2025] [:error] [pid 3634:tid 3660] [client 4.193.251.36:17123] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aT2aV4bt-wTl4d7Q7qp0RgAAAFY"]
[Sun Dec 14 00:54:47.843618 2025] [:error] [pid 14689:tid 14704] [client 4.193.251.36:17184] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aT2aV0Ecifvaa9I7SnluigAAAUs"]
[Sun Dec 14 00:54:48.017632 2025] [:error] [pid 3635:tid 3665] [client 4.193.251.36:17172] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aT2aWDqfhzW7OpfKxKzgQAAAAMA"]
[Sun Dec 14 00:54:48.193732 2025] [:error] [pid 3636:tid 3698] [client 4.193.251.36:17241] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aT2aWN4pNg3LXPqKgeYvsAAAAQY"]
[Sun Dec 14 00:54:48.368341 2025] [:error] [pid 14654:tid 14658] [client 4.193.251.36:17166] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aT2aWDqZP_N7tgSGeZckRQAAAAE"]
[Sun Dec 14 00:54:48.542680 2025] [:error] [pid 3634:tid 3640] [client 4.193.251.36:17249] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aT2aWIbt-wTl4d7Q7qp0SwAAAEI"]
[Sun Dec 14 00:54:48.716074 2025] [:error] [pid 3720:tid 3729] [client 4.193.251.36:17179] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aT2aWO7_sgsCEY5RMYrXXwAAAIc"]
[Sun Dec 14 00:54:48.893353 2025] [:error] [pid 3634:tid 3653] [client 4.193.251.36:17233] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aT2aWIbt-wTl4d7Q7qp0TAAAAE8"]
[Sun Dec 14 00:54:49.067022 2025] [:error] [pid 3634:tid 3651] [client 4.193.251.36:17186] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aT2aWYbt-wTl4d7Q7qp0TQAAAE0"]
[Sun Dec 14 00:54:49.241615 2025] [:error] [pid 14689:tid 14712] [client 4.193.251.36:17107] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aT2aWUEcifvaa9I7SnlujQAAAVM"]
[Sun Dec 14 00:54:49.418248 2025] [:error] [pid 3634:tid 3654] [client 4.193.251.36:17198] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aT2aWYbt-wTl4d7Q7qp0TgAAAFA"]
[Sun Dec 14 00:54:49.592517 2025] [:error] [pid 3634:tid 3662] [client 4.193.251.36:17367] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aT2aWYbt-wTl4d7Q7qp0UAAAAFg"]
[Sun Dec 14 00:54:49.774440 2025] [:error] [pid 14689:tid 14717] [client 4.193.251.36:17165] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aT2aWUEcifvaa9I7SnlujwAAAVg"]
[Sun Dec 14 00:54:49.962418 2025] [:error] [pid 14689:tid 14700] [client 4.193.251.36:17214] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aT2aWUEcifvaa9I7SnlukQAAAUc"]
[Sun Dec 14 00:54:50.158055 2025] [:error] [pid 14689:tid 14706] [client 4.193.251.36:17122] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aT2aWkEcifvaa9I7SnlukgAAAU0"]
[Sun Dec 14 00:54:50.341712 2025] [:error] [pid 3636:tid 3708] [client 4.193.251.36:17175] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT2aWt4pNg3LXPqKgeYvvgAAARA"]
[Sun Dec 14 00:54:50.517108 2025] [:error] [pid 3636:tid 3710] [client 4.193.251.36:17203] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT2aWt4pNg3LXPqKgeYvvwAAARI"]
[Sun Dec 14 00:54:50.691703 2025] [:error] [pid 3634:tid 3648] [client 4.193.251.36:17176] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT2aWobt-wTl4d7Q7qp0UwAAAEo"]
[Sun Dec 14 00:54:50.880792 2025] [:error] [pid 3720:tid 3733] [client 4.193.251.36:17207] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT2aWu7_sgsCEY5RMYrXYgAAAIs"]
[Sun Dec 14 00:54:51.061596 2025] [:error] [pid 3636:tid 3703] [client 4.193.251.36:17089] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aT2aW94pNg3LXPqKgeYvwwAAAQs"]
[Sun Dec 14 00:54:51.275272 2025] [:error] [pid 3720:tid 3722] [client 4.193.251.36:17191] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aT2aW-7_sgsCEY5RMYrXZgAAAIA"]
[Sun Dec 14 00:54:51.458010 2025] [:error] [pid 3634:tid 3645] [client 4.193.251.36:17091] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aT2aW4bt-wTl4d7Q7qp0VQAAAEc"]
[Sun Dec 14 00:54:51.633234 2025] [:error] [pid 3720:tid 3743] [client 4.193.251.36:17094] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aT2aW-7_sgsCEY5RMYrXagAAAJU"]
[Sun Dec 14 00:54:51.810369 2025] [:error] [pid 3720:tid 3728] [client 4.193.251.36:17156] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aT2aW-7_sgsCEY5RMYrXbAAAAIY"]
[Sun Dec 14 00:54:51.989133 2025] [:error] [pid 3720:tid 3727] [client 4.193.251.36:17146] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aT2aW-7_sgsCEY5RMYrXbgAAAIU"]
[Sun Dec 14 00:54:52.177152 2025] [:error] [pid 3720:tid 3737] [client 4.193.251.36:17209] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aT2aXO7_sgsCEY5RMYrXbwAAAI8"]
[Sun Dec 14 00:54:52.391758 2025] [:error] [pid 3636:tid 3692] [client 4.193.251.36:17182] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aT2aXN4pNg3LXPqKgeYv0QAAAQA"]
[Sun Dec 14 00:54:52.566927 2025] [:error] [pid 3636:tid 3704] [client 4.193.251.36:17177] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aT2aXN4pNg3LXPqKgeYv0wAAAQw"]
[Sun Dec 14 00:54:52.759701 2025] [:error] [pid 3634:tid 3639] [client 4.193.251.36:17112] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aT2aXIbt-wTl4d7Q7qp0WAAAAEE"]
[Sun Dec 14 00:54:52.945706 2025] [:error] [pid 14689:tid 14696] [client 4.193.251.36:17042] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aT2aXEEcifvaa9I7SnlulwAAAUM"]
[Sun Dec 14 00:54:53.128972 2025] [:error] [pid 3634:tid 3650] [client 4.193.251.36:24921] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aT2aXYbt-wTl4d7Q7qp0WgAAAEw"]
[Sun Dec 14 00:54:53.337628 2025] [:error] [pid 3636:tid 3710] [client 4.193.251.36:17312] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT2aXd4pNg3LXPqKgeYv1gAAARI"]
[Sun Dec 14 00:54:53.528260 2025] [:error] [pid 3636:tid 3712] [client 4.193.251.36:17171] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT2aXd4pNg3LXPqKgeYv2AAAARQ"]
[Sun Dec 14 00:54:53.702299 2025] [:error] [pid 3635:tid 3686] [client 4.193.251.36:17271] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT2aXTqfhzW7OpfKxKzgSwAAANU"]
[Sun Dec 14 00:54:53.881638 2025] [:error] [pid 3635:tid 3669] [client 4.193.251.36:17103] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT2aXTqfhzW7OpfKxKzgTgAAAMQ"]
[Sun Dec 14 00:54:54.058374 2025] [:error] [pid 3720:tid 3723] [client 4.193.251.36:17403] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aT2aXu7_sgsCEY5RMYrXcwAAAIE"]
[Sun Dec 14 00:54:54.235364 2025] [:error] [pid 3720:tid 3730] [client 4.193.251.36:17092] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aT2aXu7_sgsCEY5RMYrXdAAAAIg"]
[Sun Dec 14 00:54:54.460432 2025] [:error] [pid 3634:tid 3640] [client 4.193.251.36:17340] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aT2aXobt-wTl4d7Q7qp0YAAAAEI"]
[Sun Dec 14 00:54:54.650173 2025] [:error] [pid 14654:tid 14673] [client 4.193.251.36:17281] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aT2aXjqZP_N7tgSGeZckVAAAABA"]
[Sun Dec 14 00:54:54.836900 2025] [:error] [pid 3720:tid 3742] [client 4.193.251.36:17099] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aT2aXu7_sgsCEY5RMYrXeAAAAJQ"]
[Sun Dec 14 00:54:55.013314 2025] [:error] [pid 14689:tid 14701] [client 4.193.251.36:17151] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aT2aX0Ecifvaa9I7SnlunQAAAUg"]
[Sun Dec 14 00:54:55.188488 2025] [:error] [pid 14654:tid 14664] [client 4.193.251.36:17246] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aT2aXzqZP_N7tgSGeZckVQAAAAc"]
[Sun Dec 14 00:54:55.413115 2025] [:error] [pid 14654:tid 14657] [client 4.193.251.36:17206] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aT2aXzqZP_N7tgSGeZckVgAAAAA"]
[Sun Dec 14 00:54:55.586376 2025] [:error] [pid 14654:tid 14674] [client 4.193.251.36:17135] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aT2aXzqZP_N7tgSGeZckVwAAABE"]
[Sun Dec 14 00:54:55.776898 2025] [:error] [pid 3720:tid 3731] [client 4.193.251.36:17035] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aT2aX-7_sgsCEY5RMYrXegAAAIk"]
[Sun Dec 14 00:54:55.954897 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:17220] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aT2aXzqZP_N7tgSGeZckWgAAAAQ"]
[Sun Dec 14 00:54:56.127605 2025] [:error] [pid 14689:tid 14699] [client 4.193.251.36:17119] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aT2aYEEcifvaa9I7SnluoQAAAUY"]
[Sun Dec 14 00:54:56.321520 2025] [:error] [pid 3634:tid 3646] [client 4.193.251.36:17130] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aT2aYIbt-wTl4d7Q7qp0ZAAAAEg"]
[Sun Dec 14 00:54:56.495486 2025] [:error] [pid 3634:tid 3656] [client 4.193.251.36:17205] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aT2aYIbt-wTl4d7Q7qp0ZQAAAFI"]
[Sun Dec 14 00:54:56.677083 2025] [:error] [pid 14654:tid 14679] [client 4.193.251.36:17212] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aT2aYDqZP_N7tgSGeZckXgAAABY"]
[Sun Dec 14 00:54:56.858418 2025] [:error] [pid 3636:tid 3706] [client 4.193.251.36:17169] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aT2aYN4pNg3LXPqKgeYv3AAAAQ4"]
[Sun Dec 14 00:54:57.035524 2025] [:error] [pid 3635:tid 3666] [client 4.193.251.36:17117] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aT2aYTqfhzW7OpfKxKzgVgAAAME"]
[Sun Dec 14 00:54:57.220204 2025] [:error] [pid 3636:tid 3698] [client 4.193.251.36:17137] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aT2aYd4pNg3LXPqKgeYv3QAAAQY"]
[Sun Dec 14 00:54:57.402449 2025] [:error] [pid 3720:tid 3726] [client 4.193.251.36:17108] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aT2aYe7_sgsCEY5RMYrXfQAAAIQ"]
[Sun Dec 14 00:54:57.588261 2025] [:error] [pid 3720:tid 3746] [client 4.193.251.36:17188] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aT2aYe7_sgsCEY5RMYrXfgAAAJg"]
[Sun Dec 14 00:54:57.763379 2025] [:error] [pid 3720:tid 3738] [client 4.193.251.36:17261] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aT2aYe7_sgsCEY5RMYrXfwAAAJA"]
[Sun Dec 14 00:54:57.942001 2025] [:error] [pid 3720:tid 3737] [client 4.193.251.36:17315] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aT2aYe7_sgsCEY5RMYrXgAAAAI8"]
[Sun Dec 14 00:54:58.125974 2025] [:error] [pid 3635:tid 3676] [client 4.193.251.36:17088] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aT2aYjqfhzW7OpfKxKzgVwAAAMs"]
[Sun Dec 14 00:54:58.315412 2025] [:error] [pid 3636:tid 3711] [client 4.193.251.36:17267] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aT2aYt4pNg3LXPqKgeYv3wAAARM"]
[Sun Dec 14 00:54:58.524691 2025] [:error] [pid 3636:tid 3692] [client 4.193.251.36:17335] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT2aYt4pNg3LXPqKgeYv4AAAAQA"]
[Sun Dec 14 00:54:58.707387 2025] [:error] [pid 14654:tid 14660] [client 4.193.251.36:17147] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT2aYjqZP_N7tgSGeZckYgAAAAM"]
[Sun Dec 14 00:54:58.881430 2025] [:error] [pid 14654:tid 14681] [client 4.193.251.36:17111] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT2aYjqZP_N7tgSGeZckYwAAABg"]
[Sun Dec 14 00:54:59.055535 2025] [:error] [pid 3635:tid 3679] [client 4.193.251.36:16964] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT2aYzqfhzW7OpfKxKzgWAAAAM4"]
[Sun Dec 14 00:54:59.232679 2025] [:error] [pid 3635:tid 3689] [client 4.193.251.36:17105] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aT2aYzqfhzW7OpfKxKzgWQAAANg"]
[Sun Dec 14 00:54:59.407450 2025] [:error] [pid 3634:tid 3659] [client 4.193.251.36:17159] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aT2aY4bt-wTl4d7Q7qp0aQAAAFU"]
[Sun Dec 14 00:54:59.587333 2025] [:error] [pid 3635:tid 3668] [client 4.193.251.36:17385] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aT2aYzqfhzW7OpfKxKzgXAAAAMM"]
[Sun Dec 14 00:54:59.800990 2025] [:error] [pid 14654:tid 14672] [client 4.193.251.36:17051] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aT2aYzqZP_N7tgSGeZckZQAAAA8"]
[Sun Dec 14 00:54:59.975137 2025] [:error] [pid 3720:tid 3729] [client 4.193.251.36:17200] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aT2aY-7_sgsCEY5RMYrXhQAAAIc"]
[Sun Dec 14 00:55:00.153364 2025] [:error] [pid 3720:tid 3736] [client 4.193.251.36:17073] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aT2aZO7_sgsCEY5RMYrXhgAAAI4"]
[Sun Dec 14 00:55:00.332879 2025] [:error] [pid 3634:tid 3643] [client 4.193.251.36:17132] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aT2aZIbt-wTl4d7Q7qp0agAAAEU"]
[Sun Dec 14 00:55:00.510715 2025] [:error] [pid 3634:tid 3638] [client 4.193.251.36:17253] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aT2aZIbt-wTl4d7Q7qp0awAAAEA"]
[Sun Dec 14 00:55:00.698683 2025] [:error] [pid 14654:tid 14668] [client 4.193.251.36:17115] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aZDqZP_N7tgSGeZckZgAAAAs"]
[Sun Dec 14 00:55:00.897451 2025] [:error] [pid 3635:tid 3678] [client 4.193.251.36:17097] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aZDqfhzW7OpfKxKzgXgAAAM0"]
[Sun Dec 14 00:55:01.074779 2025] [:error] [pid 14689:tid 14696] [client 4.193.251.36:17066] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aZUEcifvaa9I7SnluqAAAAUM"]
[Sun Dec 14 00:55:01.249973 2025] [:error] [pid 3635:tid 3687] [client 4.193.251.36:17148] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aT2aZTqfhzW7OpfKxKzgXwAAANY"]
[Sun Dec 14 00:55:01.425509 2025] [:error] [pid 14654:tid 14674] [client 4.193.251.36:17210] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aT2aZTqZP_N7tgSGeZckZwAAABE"]
[Sun Dec 14 00:55:01.615762 2025] [:error] [pid 14654:tid 14658] [client 4.193.251.36:24885] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aT2aZTqZP_N7tgSGeZckaAAAAAE"]
[Sun Dec 14 00:55:01.790173 2025] [:error] [pid 14654:tid 14661] [client 4.193.251.36:17192] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aT2aZTqZP_N7tgSGeZckagAAAAQ"]
[Sun Dec 14 00:55:01.982083 2025] [:error] [pid 14689:tid 14703] [client 4.193.251.36:17096] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aT2aZUEcifvaa9I7SnluqgAAAUo"]
[Sun Dec 14 00:55:02.162453 2025] [:error] [pid 3635:tid 3669] [client 4.193.251.36:17121] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aT2aZjqfhzW7OpfKxKzgYgAAAMQ"]
[Sun Dec 14 00:55:02.338434 2025] [:error] [pid 3634:tid 3642] [client 4.193.251.36:17127] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aT2aZobt-wTl4d7Q7qp0bAAAAEQ"]
[Sun Dec 14 00:55:02.512096 2025] [:error] [pid 3634:tid 3641] [client 4.193.251.36:17164] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aT2aZobt-wTl4d7Q7qp0bQAAAEM"]
[Sun Dec 14 00:55:02.689821 2025] [:error] [pid 14689:tid 14714] [client 4.193.251.36:17041] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aT2aZkEcifvaa9I7SnlurQAAAVU"]
[Sun Dec 14 00:55:02.865521 2025] [:error] [pid 3634:tid 3652] [client 4.193.251.36:16906] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aT2aZobt-wTl4d7Q7qp0bwAAAE4"]
[Sun Dec 14 00:55:03.048900 2025] [:error] [pid 3634:tid 3661] [client 4.193.251.36:17033] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aT2aZ4bt-wTl4d7Q7qp0cAAAAFc"]
[Sun Dec 14 00:55:03.227456 2025] [:error] [pid 3634:tid 3640] [client 4.193.251.36:17113] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aT2aZ4bt-wTl4d7Q7qp0cQAAAEI"]
[Sun Dec 14 00:55:03.406228 2025] [:error] [pid 3635:tid 3667] [client 4.193.251.36:17274] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aT2aZzqfhzW7OpfKxKzgZQAAAMI"]
[Sun Dec 14 00:55:03.582660 2025] [:error] [pid 3634:tid 3651] [client 4.193.251.36:17259] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aT2aZ4bt-wTl4d7Q7qp0cgAAAE0"]
[Sun Dec 14 00:55:03.760447 2025] [:error] [pid 14689:tid 14701] [client 4.193.251.36:17052] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aT2aZ0Ecifvaa9I7SnlurgAAAUg"]
[Sun Dec 14 00:55:03.937452 2025] [:error] [pid 14689:tid 14717] [client 4.193.251.36:17134] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aT2aZ0Ecifvaa9I7SnlurwAAAVg"]
[Sun Dec 14 00:55:04.131523 2025] [:error] [pid 3636:tid 3698] [client 4.193.251.36:17187] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aT2aaN4pNg3LXPqKgeYv6gAAAQY"]
[Sun Dec 14 00:55:04.306066 2025] [:error] [pid 3636:tid 3705] [client 4.193.251.36:17058] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aT2aaN4pNg3LXPqKgeYv6wAAAQ0"]
[Sun Dec 14 00:55:04.480576 2025] [:error] [pid 3634:tid 3657] [client 4.193.251.36:17325] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aT2aaIbt-wTl4d7Q7qp0dQAAAFM"]
[Sun Dec 14 00:55:04.659046 2025] [:error] [pid 3634:tid 3658] [client 4.193.251.36:17068] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aT2aaIbt-wTl4d7Q7qp0dgAAAFQ"]
[Sun Dec 14 00:55:04.852686 2025] [:error] [pid 3634:tid 3639] [client 4.193.251.36:17213] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aT2aaIbt-wTl4d7Q7qp0eAAAAEE"]
[Sun Dec 14 00:55:05.026888 2025] [:error] [pid 14689:tid 14694] [client 4.193.251.36:17252] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aT2aaUEcifvaa9I7SnlusQAAAUE"]
[Sun Dec 14 00:55:05.206424 2025] [:error] [pid 14689:tid 14713] [client 4.193.251.36:17102] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aT2aaUEcifvaa9I7SnlusgAAAVQ"]
[Sun Dec 14 00:55:05.381958 2025] [:error] [pid 14689:tid 14697] [client 4.193.251.36:17133] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aT2aaUEcifvaa9I7SnluswAAAUQ"]
[Sun Dec 14 00:55:05.562704 2025] [:error] [pid 3635:tid 3666] [client 4.193.251.36:17027] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aT2aaTqfhzW7OpfKxKzgagAAAME"]
[Sun Dec 14 00:55:05.749854 2025] [:error] [pid 3634:tid 3661] [client 4.193.251.36:17078] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aT2aaYbt-wTl4d7Q7qp0hgAAAFc"]
[Sun Dec 14 00:55:05.924372 2025] [:error] [pid 3720:tid 3732] [client 4.193.251.36:17036] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aT2aae7_sgsCEY5RMYrXiQAAAIo"]
[Sun Dec 14 00:55:06.099460 2025] [:error] [pid 14654:tid 14659] [client 4.193.251.36:17142] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aT2aajqZP_N7tgSGeZckbgAAAAI"]
[Sun Dec 14 00:55:06.274007 2025] [:error] [pid 14654:tid 14675] [client 4.193.251.36:17104] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aT2aajqZP_N7tgSGeZckbwAAABI"]
[Sun Dec 14 00:55:06.449686 2025] [:error] [pid 14654:tid 14681] [client 4.193.251.36:17255] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aT2aajqZP_N7tgSGeZckcgAAABg"]
[Sun Dec 14 00:55:06.630026 2025] [:error] [pid 3634:tid 3649] [client 4.193.251.36:17085] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aT2aaobt-wTl4d7Q7qp0kAAAAEs"]
[Sun Dec 14 00:55:06.869829 2025] [:error] [pid 3720:tid 3740] [client 4.193.251.36:16965] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aT2aau7_sgsCEY5RMYrXiwAAAJI"]
[Sun Dec 14 00:55:07.050811 2025] [:error] [pid 14689:tid 14693] [client 4.193.251.36:17109] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aT2aa0Ecifvaa9I7SnlutQAAAUA"]
[Sun Dec 14 00:55:07.225831 2025] [:error] [pid 14689:tid 14696] [client 4.193.251.36:17079] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT2aa0Ecifvaa9I7SnlutgAAAUM"]
[Sun Dec 14 00:55:07.401801 2025] [:error] [pid 14689:tid 14715] [client 4.193.251.36:17090] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT2aa0Ecifvaa9I7SnlutwAAAVY"]
[Sun Dec 14 00:55:07.578668 2025] [:error] [pid 3634:tid 3641] [client 4.193.251.36:16999] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT2aa4bt-wTl4d7Q7qp0lwAAAEM"]
[Sun Dec 14 00:55:07.753412 2025] [:error] [pid 3634:tid 3661] [client 4.193.251.36:17141] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT2aa4bt-wTl4d7Q7qp0mgAAAFc"]
[Sun Dec 14 00:55:07.939393 2025] [:error] [pid 14689:tid 14716] [client 4.193.251.36:17195] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aT2aa0Ecifvaa9I7SnluuAAAAVc"]
[Sun Dec 14 00:55:08.112690 2025] [:error] [pid 3635:tid 3678] [client 4.193.251.36:17390] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aT2abDqfhzW7OpfKxKzgbQAAAM0"]
[Sun Dec 14 00:55:08.290741 2025] [:error] [pid 3635:tid 3688] [client 4.193.251.36:17215] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aT2abDqfhzW7OpfKxKzgbgAAANc"]
[Sun Dec 14 00:55:08.465715 2025] [:error] [pid 3636:tid 3706] [client 4.193.251.36:17030] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aT2abN4pNg3LXPqKgeYv_QAAAQ4"]
[Sun Dec 14 00:55:08.649302 2025] [:error] [pid 3636:tid 3711] [client 4.193.251.36:17081] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aT2abN4pNg3LXPqKgeYv_gAAARM"]
[Sun Dec 14 00:55:08.843586 2025] [:error] [pid 3720:tid 3746] [client 4.193.251.36:17034] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aT2abO7_sgsCEY5RMYrXjQAAAJg"]
[Sun Dec 14 00:55:09.018790 2025] [:error] [pid 3636:tid 3707] [client 4.193.251.36:17061] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aT2abd4pNg3LXPqKgeYwAAAAAQ8"]
[Sun Dec 14 00:55:09.199655 2025] [:error] [pid 3635:tid 3687] [client 4.193.251.36:17204] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aT2abTqfhzW7OpfKxKzgcAAAANY"]
[Sun Dec 14 00:55:09.374177 2025] [:error] [pid 3634:tid 3642] [client 4.193.251.36:17160] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aT2abYbt-wTl4d7Q7qp0qAAAAEQ"]
[Sun Dec 14 00:55:09.548306 2025] [:error] [pid 3636:tid 3709] [client 4.193.251.36:17037] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aT2abd4pNg3LXPqKgeYwAgAAARE"]
[Sun Dec 14 00:55:09.724258 2025] [:error] [pid 3634:tid 3644] [client 4.193.251.36:17072] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aT2abYbt-wTl4d7Q7qp0qgAAAEY"]
[Sun Dec 14 00:55:09.899396 2025] [:error] [pid 3636:tid 3699] [client 4.193.251.36:17087] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aT2abd4pNg3LXPqKgeYwBAAAAQc"]
[Sun Dec 14 00:55:10.082028 2025] [:error] [pid 14689:tid 14707] [client 4.193.251.36:17306] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aT2abkEcifvaa9I7SnluuwAAAU4"]
[Sun Dec 14 00:55:10.258929 2025] [:error] [pid 14689:tid 14711] [client 4.193.251.36:17039] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aT2abkEcifvaa9I7SnluvAAAAVI"]
[Sun Dec 14 00:55:10.433370 2025] [:error] [pid 14654:tid 14664] [client 4.193.251.36:17139] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aT2abjqZP_N7tgSGeZckdAAAAAc"]
[Sun Dec 14 00:55:10.607877 2025] [:error] [pid 3636:tid 3714] [client 4.193.251.36:17048] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aT2abt4pNg3LXPqKgeYwBwAAARY"]
[Sun Dec 14 00:55:10.781111 2025] [:error] [pid 14689:tid 14702] [client 4.193.251.36:17193] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aT2abkEcifvaa9I7SnluwAAAAUk"]
[Sun Dec 14 00:55:10.971492 2025] [:error] [pid 14689:tid 14700] [client 4.193.251.36:17069] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aT2abkEcifvaa9I7SnluxAAAAUc"]
[Sun Dec 14 00:55:11.145394 2025] [:error] [pid 3636:tid 3713] [client 4.193.251.36:17054] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aT2ab94pNg3LXPqKgeYwCAAAARU"]
[Sun Dec 14 00:55:11.323489 2025] [:error] [pid 3636:tid 3710] [client 4.193.251.36:17056] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aT2ab94pNg3LXPqKgeYwCQAAARI"]
[Sun Dec 14 00:55:11.499074 2025] [:error] [pid 14689:tid 14696] [client 4.193.251.36:16974] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aT2ab0Ecifvaa9I7SnluxwAAAUM"]
[Sun Dec 14 00:55:11.677460 2025] [:error] [pid 14689:tid 14716] [client 4.193.251.36:17026] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aT2ab0Ecifvaa9I7SnluyQAAAVc"]
[Sun Dec 14 00:55:11.851622 2025] [:error] [pid 3720:tid 3727] [client 4.193.251.36:17116] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aT2ab-7_sgsCEY5RMYrXjwAAAIU"]
[Sun Dec 14 00:55:12.051790 2025] [:error] [pid 14689:tid 14703] [client 4.193.251.36:17328] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aT2acEEcifvaa9I7SnluygAAAUo"]
[Sun Dec 14 00:55:12.247889 2025] [:error] [pid 14689:tid 14711] [client 4.193.251.36:17138] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aT2acEEcifvaa9I7SnluywAAAVI"]
[Sun Dec 14 00:55:12.427861 2025] [:error] [pid 3636:tid 3696] [client 4.193.251.36:17194] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aT2acN4pNg3LXPqKgeYwCgAAAQQ"]
[Sun Dec 14 00:55:12.606642 2025] [:error] [pid 14654:tid 14669] [client 4.193.251.36:16973] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aT2acDqZP_N7tgSGeZckeAAAAAw"]
[Sun Dec 14 00:55:12.795830 2025] [:error] [pid 14689:tid 14714] [client 4.193.251.36:17047] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aT2acEEcifvaa9I7SnluzQAAAVU"]
[Sun Dec 14 00:55:13.000289 2025] [:error] [pid 14689:tid 14702] [client 4.193.251.36:17063] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aT2acEEcifvaa9I7SnluzwAAAUk"]
[Sun Dec 14 00:55:13.174436 2025] [:error] [pid 3634:tid 3643] [client 4.193.251.36:16985] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aT2acYbt-wTl4d7Q7qp0rgAAAEU"]
[Sun Dec 14 00:55:13.351177 2025] [:error] [pid 14654:tid 14679] [client 4.193.251.36:16981] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aT2acTqZP_N7tgSGeZckeQAAABY"]
[Sun Dec 14 00:55:13.526571 2025] [:error] [pid 3635:tid 3681] [client 4.193.251.36:17060] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aT2acTqfhzW7OpfKxKzgcwAAANA"]
[Sun Dec 14 00:55:13.708621 2025] [:error] [pid 14654:tid 14671] [client 4.193.251.36:17086] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aT2acTqZP_N7tgSGeZckegAAAA4"]
[Sun Dec 14 00:55:13.882947 2025] [:error] [pid 14654:tid 14657] [client 4.193.251.36:17057] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aT2acTqZP_N7tgSGeZckewAAAAA"]
[Sun Dec 14 00:55:14.063346 2025] [:error] [pid 14654:tid 14670] [client 4.193.251.36:17077] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aT2acjqZP_N7tgSGeZckfAAAAA0"]
[Sun Dec 14 00:55:14.241903 2025] [:error] [pid 14654:tid 14666] [client 4.193.251.36:17024] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aT2acjqZP_N7tgSGeZckfgAAAAk"]
[Sun Dec 14 00:55:14.418835 2025] [:error] [pid 14689:tid 14700] [client 4.193.251.36:17050] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aT2ackEcifvaa9I7Snlu0QAAAUc"]
[Sun Dec 14 00:55:14.592866 2025] [:error] [pid 3635:tid 3683] [client 4.193.251.36:17003] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aT2acjqfhzW7OpfKxKzgdgAAANI"]
[Sun Dec 14 00:55:14.766398 2025] [:error] [pid 14689:tid 14705] [client 4.193.251.36:17106] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aT2ackEcifvaa9I7Snlu0wAAAUw"]
[Sun Dec 14 00:55:14.941287 2025] [:error] [pid 3636:tid 3715] [client 4.193.251.36:16983] [client 4.193.251.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aT2act4pNg3LXPqKgeYwDgAAARc"]
[Sun Dec 14 11:27:05.551354 2025] [:error] [pid 40596:tid 40650] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 14 11:27:06.015352 2025] [:error] [pid 40596:tid 40645] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 14 11:27:06.451162 2025] [:error] [pid 40596:tid 40634] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 14 11:27:06.947217 2025] [:error] [pid 40596:tid 40629] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 14 11:27:07.375623 2025] [:error] [pid 40596:tid 40646] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 14 11:27:07.745081 2025] [:error] [pid 40596:tid 40644] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 14 11:27:08.093658 2025] [:error] [pid 40596:tid 40637] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 14 11:27:08.516149 2025] [:error] [pid 40596:tid 40633] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 14 11:27:09.429427 2025] [:error] [pid 40596:tid 40636] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 14 11:27:10.342672 2025] [:error] [pid 40596:tid 40631] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 14 11:27:10.804070 2025] [:error] [pid 40596:tid 40647] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 14 11:27:11.191564 2025] [:error] [pid 40596:tid 40626] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 14 11:27:11.651039 2025] [:error] [pid 40596:tid 40641] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 14 11:27:12.090109 2025] [:error] [pid 40596:tid 40640] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 14 11:27:12.532480 2025] [:error] [pid 40596:tid 40650] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 14 11:27:12.970381 2025] [:error] [pid 40596:tid 40645] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 14 11:27:13.392378 2025] [:error] [pid 40596:tid 40634] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 14 11:27:13.828520 2025] [:error] [pid 40596:tid 40649] [client 194.5.82.53:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 14 11:27:19.999346 2025] [:error] [pid 40596:tid 40644] [client 194.5.82.53:65289] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aT4ul2vZZo4N2X7WoLzHrwAAAdI"]
[Sun Dec 14 17:26:15.765744 2025] [:error] [pid 40596:tid 40633] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 14 17:26:16.003789 2025] [:error] [pid 40596:tid 40638] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 14 17:26:16.276342 2025] [:error] [pid 40596:tid 40641] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 14 17:26:16.558493 2025] [:error] [pid 40596:tid 40640] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 14 17:26:16.807561 2025] [:error] [pid 40596:tid 40627] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 14 17:26:17.052877 2025] [:error] [pid 40596:tid 40626] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 14 17:26:17.352775 2025] [:error] [pid 40596:tid 40642] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 14 17:26:17.617463 2025] [:error] [pid 40596:tid 40647] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 14 17:26:18.106593 2025] [:error] [pid 40596:tid 40646] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 14 17:26:18.668099 2025] [:error] [pid 40596:tid 40637] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 14 17:26:18.886802 2025] [:error] [pid 40596:tid 40644] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 14 17:26:19.107320 2025] [:error] [pid 40596:tid 40629] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 14 17:26:19.305664 2025] [:error] [pid 40596:tid 40632] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 14 17:26:19.504444 2025] [:error] [pid 40596:tid 40650] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 14 17:26:19.809385 2025] [:error] [pid 40596:tid 40633] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 14 17:26:20.070558 2025] [:error] [pid 40596:tid 40636] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 14 17:26:20.303610 2025] [:error] [pid 40596:tid 40638] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 14 17:26:20.544450 2025] [:error] [pid 40596:tid 40645] [client 194.5.82.117:26973] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 14 17:26:24.988419 2025] [:error] [pid 40596:tid 40650] [client 194.5.82.117:26973] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aT6CwGvZZo4N2X7WoLxArwAAAdg"]
[Sun Dec 14 17:26:26.261428 2025] [:error] [pid 40595:tid 40616] [client 194.5.82.113:32957] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aT6Cwvjrht6y4RN-xKTQkwAAAZE"]
[Sun Dec 14 17:26:27.998692 2025] [:error] [pid 39523:tid 39538] [client 194.5.82.121:60257] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 14 17:26:28.688957 2025] [:error] [pid 39523:tid 39537] [client 194.5.82.121:60257] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aT6CxDQTQH1raAj2lkikAgAAAAk"]
[Sun Dec 14 21:16:11.089828 2025] [:error] [pid 39525:tid 39607] [client 103.81.159.215:64693] [client 103.81.159.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.81.159.215, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aT64m01fX_pB_BrvE_5cSAAAAJg"]
[Sun Dec 14 21:16:11.096255 2025] [:error] [pid 39525:tid 39607] [client 103.81.159.215:64693] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Dec 14 21:16:13.973019 2025] [:error] [pid 41600:tid 41614] [client 161.248.187.126:50205] [client 161.248.187.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.248.187.126, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aT64ndFLTBZjcwNd_VssoQAAAQs"]
[Sun Dec 14 21:16:13.977793 2025] [:error] [pid 41600:tid 41614] [client 161.248.187.126:50205] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Dec 14 21:16:28.619938 2025] [:error] [pid 39525:tid 39601] [client 103.175.169.177:14178] [client 103.175.169.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.175.169.177, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aT64rE1fX_pB_BrvE_5cWwAAAJI"]
[Sun Dec 14 21:16:28.626774 2025] [:error] [pid 39525:tid 39601] [client 103.175.169.177:14178] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Dec 14 22:40:10.207810 2025] [:error] [pid 39525:tid 39602] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 14 22:40:10.401342 2025] [:error] [pid 39525:tid 39598] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 14 22:40:10.580542 2025] [:error] [pid 39525:tid 39588] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 14 22:40:10.759019 2025] [:error] [pid 39525:tid 39587] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 14 22:40:10.937271 2025] [:error] [pid 39525:tid 39593] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 14 22:40:11.115405 2025] [:error] [pid 39525:tid 39599] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 14 22:40:11.294824 2025] [:error] [pid 39525:tid 39595] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 14 22:40:11.473855 2025] [:error] [pid 39525:tid 39590] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 14 22:40:11.829356 2025] [:error] [pid 39525:tid 39583] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 14 22:40:12.189884 2025] [:error] [pid 39525:tid 39606] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 14 22:40:12.376203 2025] [:error] [pid 39525:tid 39592] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 14 22:40:12.554215 2025] [:error] [pid 39525:tid 39600] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 14 22:40:12.733040 2025] [:error] [pid 39525:tid 39589] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 14 22:40:12.911998 2025] [:error] [pid 39525:tid 39604] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 14 22:40:13.092370 2025] [:error] [pid 39525:tid 39594] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 14 22:40:13.273879 2025] [:error] [pid 39525:tid 39602] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 14 22:40:13.453108 2025] [:error] [pid 39525:tid 39598] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 14 22:40:13.633692 2025] [:error] [pid 39525:tid 39588] [client 149.88.106.148:42640] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 14 22:40:16.135058 2025] [:error] [pid 39525:tid 39589] [client 149.88.106.148:42640] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aT7MUE1fX_pB_BrvE_5tfgAAAIY"]
[Sun Dec 14 22:40:17.019658 2025] [:error] [pid 39524:tid 39574] [client 149.88.106.148:42650] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aT7MUWrVGpbDzFtDE9MbXwAAAFI"]
[Sun Dec 14 22:40:17.906820 2025] [:error] [pid 39524:tid 39558] [client 149.88.106.148:42662] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 14 22:40:19.422255 2025] [:error] [pid 39524:tid 39561] [client 149.88.106.148:42662] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aT7MU2rVGpbDzFtDE9MbaQAAAEU"]
[Sun Dec 14 22:40:20.125198 2025] [:error] [pid 39523:tid 39539] [client 149.88.106.148:59888] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Dec 14 22:40:20.298487 2025] [:error] [pid 39523:tid 39536] [client 149.88.106.148:59888] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aT7MVDQTQH1raAj2lkgFHgAAAAg"]
[Sun Dec 14 22:40:20.835068 2025] [:error] [pid 40595:tid 40617] [client 149.88.106.148:59892] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Dec 14 22:40:23.058917 2025] [:error] [pid 40595:tid 40608] [client 149.88.106.148:59892] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aT7MV_jrht6y4RN-xKRGtgAAAYk"]
[Sun Dec 14 22:40:23.588227 2025] [:error] [pid 13799:tid 13809] [client 149.88.106.148:59898] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aT7MV3jPEin01ElFTNZkMgAAAgc"]
[Sun Dec 14 22:40:23.938455 2025] [:error] [pid 40596:tid 40641] [client 149.88.106.148:59914] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aT7MV2vZZo4N2X7WoLy2jAAAAc8"]
[Sun Dec 14 22:40:24.287074 2025] [:error] [pid 40595:tid 40609] [client 149.88.106.148:59928] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aT7MWPjrht6y4RN-xKRGuQAAAYo"]
[Sun Dec 14 22:40:24.666255 2025] [:error] [pid 39525:tid 39586] [client 149.88.106.148:59938] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aT7MWE1fX_pB_BrvE_5thwAAAIM"]
[Sun Dec 14 22:40:25.019245 2025] [:error] [pid 41600:tid 41606] [client 149.88.106.148:59944] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aT7MWdFLTBZjcwNd_VtRAAAAAQM"]
[Sun Dec 14 22:40:25.552960 2025] [:error] [pid 40596:tid 40631] [client 149.88.106.148:59946] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aT7MWWvZZo4N2X7WoLy2jwAAAcU"]
[Sun Dec 14 22:40:25.942934 2025] [:error] [pid 41600:tid 41624] [client 149.88.106.148:59954] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Dec 14 22:40:26.294842 2025] [:error] [pid 41600:tid 41625] [client 149.88.106.148:59954] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aT7MWtFLTBZjcwNd_VtRAwAAARY"]
[Sun Dec 14 22:40:27.019442 2025] [:error] [pid 39614:tid 39631] [client 149.88.106.148:59958] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aT7MW_xybG8-9MflbDeW4AAAAM8"]
[Sun Dec 14 22:40:27.550424 2025] [:error] [pid 39524:tid 39579] [client 149.88.106.148:59972] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aT7MW2rVGpbDzFtDE9MbcgAAAFc"]
[Sun Dec 14 22:40:27.904165 2025] [:error] [pid 13799:tid 13819] [client 149.88.106.148:59984] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Dec 14 22:40:28.078432 2025] [:error] [pid 13799:tid 13812] [client 149.88.106.148:59984] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aT7MXHjPEin01ElFTNZkNQAAAgo"]
[Sun Dec 14 22:40:28.581131 2025] [:error] [pid 39614:tid 39622] [client 149.88.106.148:59990] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Dec 14 22:40:29.124379 2025] [:error] [pid 39614:tid 39627] [client 149.88.106.148:59990] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Dec 14 22:40:29.656327 2025] [:error] [pid 39614:tid 39625] [client 149.88.106.148:59990] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aT7MXfxybG8-9MflbDeW7gAAAMk"]
[Sun Dec 14 22:40:30.008162 2025] [:error] [pid 40595:tid 40616] [client 149.88.106.148:36146] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Dec 14 22:40:30.183349 2025] [:error] [pid 40595:tid 40602] [client 149.88.106.148:36146] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aT7MXvjrht6y4RN-xKRGvgAAAYM"]
[Sun Dec 14 22:40:30.536424 2025] [:error] [pid 39614:tid 39631] [client 149.88.106.148:36162] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Dec 14 22:40:30.900601 2025] [:error] [pid 39614:tid 39636] [client 149.88.106.148:36162] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aT7MXvxybG8-9MflbDeW9AAAANQ"]
[Sun Dec 14 22:40:31.423797 2025] [:error] [pid 39524:tid 39557] [client 149.88.106.148:36172] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aT7MX2rVGpbDzFtDE9MbdgAAAEE"]
[Sun Dec 14 22:40:31.952533 2025] [:error] [pid 41600:tid 41621] [client 149.88.106.148:36184] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Dec 14 22:40:32.131239 2025] [:error] [pid 41600:tid 41627] [client 149.88.106.148:36184] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Dec 14 22:40:32.487269 2025] [:error] [pid 41600:tid 41613] [client 149.88.106.148:36184] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aT7MYNFLTBZjcwNd_VtRGgAAAQo"]
[Sun Dec 14 22:40:33.017273 2025] [:error] [pid 39525:tid 39599] [client 149.88.106.148:36190] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aT7MYU1fX_pB_BrvE_5tmgAAAJA"]
[Sun Dec 14 22:40:33.540389 2025] [:error] [pid 39614:tid 39629] [client 149.88.106.148:36194] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aT7MYfxybG8-9MflbDeW-wAAAM0"]
[Sun Dec 14 22:40:33.901478 2025] [:error] [pid 39524:tid 39567] [client 149.88.106.148:36208] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aT7MYWrVGpbDzFtDE9MbeAAAAEs"]
[Sun Dec 14 22:40:34.247633 2025] [:error] [pid 39523:tid 39528] [client 149.88.106.148:36224] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aT7MYjQTQH1raAj2lkgFIgAAAAA"]
[Sun Dec 14 22:40:35.013629 2025] [:error] [pid 39524:tid 39579] [client 149.88.106.148:36230] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Dec 14 22:40:35.188778 2025] [:error] [pid 39524:tid 39556] [client 149.88.106.148:36230] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aT7MY2rVGpbDzFtDE9MbgAAAAEA"]
[Sun Dec 14 22:40:35.538878 2025] [:error] [pid 39524:tid 39566] [client 149.88.106.148:36242] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aT7MY2rVGpbDzFtDE9MbggAAAEo"]
[Sun Dec 14 22:40:35.888636 2025] [:error] [pid 39524:tid 39560] [client 149.88.106.148:36258] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aT7MY2rVGpbDzFtDE9MbgwAAAEQ"]
[Sun Dec 14 22:40:36.597270 2025] [:error] [pid 13799:tid 13814] [client 149.88.106.148:36270] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Dec 14 22:40:36.953464 2025] [:error] [pid 13799:tid 13823] [client 149.88.106.148:36270] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Dec 14 22:40:37.655215 2025] [:error] [pid 13799:tid 13809] [client 149.88.106.148:36270] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aT7MZXjPEin01ElFTNZkWQAAAgc"]
[Sun Dec 14 22:40:41.414837 2025] [:error] [pid 40596:tid 40649] [client 149.88.106.148:36282] [client 149.88.106.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.88.106.148, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aT7MaWvZZo4N2X7WoLy2yAAAAdc"]
[Sun Dec 14 22:40:41.599363 2025] [:error] [pid 40596:tid 40638] [client 149.88.106.148:36282] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Dec 14 22:40:42.502782 2025] [:error] [pid 40596:tid 40642] [client 149.88.106.148:36282] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Dec 14 22:40:42.681438 2025] [:error] [pid 40596:tid 40631] [client 149.88.106.148:36282] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Dec 14 22:40:43.575613 2025] [:error] [pid 40596:tid 40637] [client 149.88.106.148:36282] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aT7Ma2vZZo4N2X7WoLy21wAAAcs"]
[Sun Dec 14 22:40:44.103602 2025] [:error] [pid 13799:tid 13804] [client 149.88.106.148:60732] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Dec 14 22:40:44.277711 2025] [:error] [pid 13799:tid 13818] [client 149.88.106.148:60732] [client 149.88.106.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.88.106.148, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aT7MbHjPEin01ElFTNZkbAAAAhA"]
[Sun Dec 14 22:40:44.635119 2025] [:error] [pid 13799:tid 13809] [client 149.88.106.148:60732] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aT7MbHjPEin01ElFTNZkbgAAAgc"]
[Sun Dec 14 22:40:46.989755 2025] [:error] [pid 13799:tid 13803] [client 149.88.106.148:60746] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Dec 14 22:40:48.631785 2025] [:error] [pid 13799:tid 13819] [client 149.88.106.148:60746] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Dec 14 22:40:48.984440 2025] [:error] [pid 13799:tid 13808] [client 149.88.106.148:60746] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aT7McHjPEin01ElFTNZkdwAAAgY"]
[Sun Dec 14 22:40:49.339284 2025] [:error] [pid 41600:tid 41621] [client 149.88.106.148:35336] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Dec 14 22:40:49.874405 2025] [:error] [pid 41600:tid 41626] [client 149.88.106.148:35336] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Dec 14 22:40:50.233188 2025] [:error] [pid 41600:tid 41611] [client 149.88.106.148:35336] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Dec 14 22:40:51.982049 2025] [:error] [pid 41600:tid 41615] [client 149.88.106.148:35336] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Dec 14 22:40:52.156674 2025] [:error] [pid 41600:tid 41612] [client 149.88.106.148:35336] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aT7MdNFLTBZjcwNd_VtRlgAAAQk"]
[Sun Dec 14 22:40:52.507513 2025] [:error] [pid 40596:tid 40636] [client 149.88.106.148:35348] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Dec 14 22:40:52.683826 2025] [:error] [pid 40596:tid 40642] [client 149.88.106.148:35348] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Dec 14 22:40:52.857363 2025] [:error] [pid 40596:tid 40631] [client 149.88.106.148:35348] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aT7MdGvZZo4N2X7WoLy23QAAAcU"]
[Sun Dec 14 22:40:54.644735 2025] [:error] [pid 39523:tid 39545] [client 149.88.106.148:35356] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Dec 14 22:40:54.999224 2025] [:error] [pid 39523:tid 39536] [client 149.88.106.148:35356] [client 149.88.106.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.88.106.148, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aT7MdjQTQH1raAj2lkgFOAAAAAg"]
[Sun Dec 14 22:40:55.177720 2025] [:error] [pid 39523:tid 39540] [client 149.88.106.148:35356] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aT7MdzQTQH1raAj2lkgFOQAAAAw"]
[Sun Dec 14 22:40:57.327113 2025] [:error] [pid 39614:tid 39635] [client 149.88.106.148:35372] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Dec 14 22:40:58.405678 2025] [:error] [pid 39614:tid 39623] [client 149.88.106.148:35372] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Dec 14 22:40:58.584788 2025] [:error] [pid 39614:tid 39621] [client 149.88.106.148:35372] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aT7MevxybG8-9MflbDeXJwAAAMU"]
[Sun Dec 14 22:40:58.940432 2025] [:error] [pid 40595:tid 40620] [client 149.88.106.148:35380] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Dec 14 22:40:59.469720 2025] [:error] [pid 40595:tid 40603] [client 149.88.106.148:35380] [client 149.88.106.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.88.106.148, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aT7Me_jrht6y4RN-xKRG1wAAAYQ"]
[Sun Dec 14 22:40:59.653393 2025] [:error] [pid 40595:tid 40599] [client 149.88.106.148:35380] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Dec 14 22:40:59.833210 2025] [:error] [pid 40595:tid 40607] [client 149.88.106.148:35380] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Dec 14 22:41:00.011283 2025] [:error] [pid 40595:tid 40606] [client 149.88.106.148:35380] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Dec 14 22:41:00.186052 2025] [:error] [pid 40595:tid 40601] [client 149.88.106.148:35380] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aT7MfPjrht6y4RN-xKRG3AAAAYI"]
[Sun Dec 14 22:41:00.539666 2025] [:error] [pid 41600:tid 41607] [client 149.88.106.148:36684] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Dec 14 22:41:00.714131 2025] [:error] [pid 41600:tid 41620] [client 149.88.106.148:36684] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aT7MfNFLTBZjcwNd_VtRpwAAARE"]
[Sun Dec 14 22:41:01.242089 2025] [:error] [pid 41600:tid 41606] [client 149.88.106.148:36700] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Dec 14 22:41:01.415420 2025] [:error] [pid 41600:tid 41617] [client 149.88.106.148:36700] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aT7MfdFLTBZjcwNd_VtRqwAAAQ4"]
[Sun Dec 14 22:41:02.123896 2025] [:error] [pid 39524:tid 39576] [client 149.88.106.148:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Dec 14 22:41:02.298354 2025] [:error] [pid 39524:tid 39559] [client 149.88.106.148:36706] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aT7MfmrVGpbDzFtDE9MbnwAAAEM"]
[Sun Dec 14 22:41:02.642969 2025] [:error] [pid 40561:tid 40580] [client 149.88.106.148:36722] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aT7MfoY6r869zoqRQkT5HQAAAU8"]
[Sun Dec 14 22:41:02.994456 2025] [:error] [pid 39524:tid 39568] [client 149.88.106.148:36730] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Dec 14 22:41:03.170658 2025] [:error] [pid 39524:tid 39557] [client 149.88.106.148:36730] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Dec 14 22:41:03.876444 2025] [:error] [pid 39524:tid 39569] [client 149.88.106.148:36730] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aT7Mf2rVGpbDzFtDE9MbqQAAAE0"]
[Sun Dec 14 22:41:04.399457 2025] [:error] [pid 40596:tid 40647] [client 149.88.106.148:36736] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aT7MgGvZZo4N2X7WoLy26QAAAdU"]
[Sun Dec 14 22:41:05.289718 2025] [:error] [pid 13799:tid 13809] [client 149.88.106.148:36752] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aT7MgXjPEin01ElFTNZkkAAAAgc"]
[Sun Dec 14 22:41:05.640712 2025] [:error] [pid 39614:tid 39637] [client 149.88.106.148:36754] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Dec 14 22:41:05.996082 2025] [:error] [pid 39614:tid 39630] [client 149.88.106.148:36754] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Dec 14 22:41:06.170354 2025] [:error] [pid 39614:tid 39625] [client 149.88.106.148:36754] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aT7MgvxybG8-9MflbDeXMAAAAMk"]
[Sun Dec 14 22:41:06.521968 2025] [:error] [pid 40596:tid 40636] [client 149.88.106.148:36760] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Dec 14 22:41:06.876249 2025] [:error] [pid 40596:tid 40648] [client 149.88.106.148:36760] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aT7MgmvZZo4N2X7WoLy28QAAAdY"]
[Sun Dec 14 22:41:07.760422 2025] [:error] [pid 40595:tid 40620] [client 149.88.106.148:36772] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aT7Mg_jrht6y4RN-xKRG6QAAAZU"]
[Sun Dec 14 22:41:08.291985 2025] [:error] [pid 39525:tid 39585] [client 149.88.106.148:36780] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Dec 14 22:41:08.826330 2025] [:error] [pid 39525:tid 39604] [client 149.88.106.148:36780] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Dec 14 22:41:09.183869 2025] [:error] [pid 39525:tid 39598] [client 149.88.106.148:36780] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Dec 14 22:41:09.358449 2025] [:error] [pid 39525:tid 39601] [client 149.88.106.148:36780] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aT7MhU1fX_pB_BrvE_5t0wAAAJI"]
[Sun Dec 14 22:41:09.707935 2025] [:error] [pid 40596:tid 40637] [client 149.88.106.148:45094] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aT7MhWvZZo4N2X7WoLy29gAAAcs"]
[Sun Dec 14 22:41:10.056235 2025] [:error] [pid 39524:tid 39558] [client 149.88.106.148:45104] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aT7MhmrVGpbDzFtDE9MbswAAAEI"]
[Sun Dec 14 22:41:10.408302 2025] [:error] [pid 39524:tid 39572] [client 149.88.106.148:45118] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aT7MhmrVGpbDzFtDE9MbtQAAAFA"]
[Sun Dec 14 22:41:10.762393 2025] [:error] [pid 40595:tid 40623] [client 149.88.106.148:45134] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Dec 14 22:41:10.937348 2025] [:error] [pid 40595:tid 40621] [client 149.88.106.148:45134] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aT7Mhvjrht6y4RN-xKRG7QAAAZY"]
[Sun Dec 14 22:41:11.285460 2025] [:error] [pid 13799:tid 13813] [client 149.88.106.148:45144] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aT7Mh3jPEin01ElFTNZkmQAAAgs"]
[Sun Dec 14 22:41:11.636316 2025] [:error] [pid 40561:tid 40572] [client 149.88.106.148:45160] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Dec 14 22:41:11.989446 2025] [:error] [pid 40561:tid 40583] [client 149.88.106.148:45160] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aT7Mh4Y6r869zoqRQkT5KQAAAVI"]
[Sun Dec 14 22:41:12.338210 2025] [:error] [pid 39524:tid 39564] [client 149.88.106.148:45174] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aT7MiGrVGpbDzFtDE9MbtgAAAEg"]
[Sun Dec 14 22:41:12.688946 2025] [:error] [pid 41600:tid 41623] [client 149.88.106.148:45178] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aT7MiNFLTBZjcwNd_VtRtwAAARQ"]
[Sun Dec 14 22:41:13.036565 2025] [:error] [pid 13799:tid 13806] [client 149.88.106.148:45184] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aT7MiXjPEin01ElFTNZknAAAAgQ"]
[Sun Dec 14 22:41:13.562241 2025] [:error] [pid 39524:tid 39557] [client 149.88.106.148:45200] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aT7MiWrVGpbDzFtDE9MbvQAAAEE"]
[Sun Dec 14 22:41:14.281936 2025] [:error] [pid 39525:tid 39593] [client 149.88.106.148:45202] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aT7Mik1fX_pB_BrvE_5t3AAAAIo"]
[Sun Dec 14 22:41:14.636632 2025] [:error] [pid 39524:tid 39577] [client 149.88.106.148:45212] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Dec 14 22:41:15.183315 2025] [:error] [pid 39524:tid 39566] [client 149.88.106.148:45212] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Dec 14 22:41:15.358737 2025] [:error] [pid 39524:tid 39569] [client 149.88.106.148:45212] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aT7Mi2rVGpbDzFtDE9MbxgAAAE0"]
[Sun Dec 14 22:41:15.888343 2025] [:error] [pid 40595:tid 40604] [client 149.88.106.148:45220] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Dec 14 22:41:16.066829 2025] [:error] [pid 40595:tid 40616] [client 149.88.106.148:45220] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Dec 14 22:41:18.303040 2025] [:error] [pid 40595:tid 40616] [client 149.88.106.148:45220] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aT7Mjvjrht6y4RN-xKRHHwAAAZE"]
[Sun Dec 14 22:41:19.187207 2025] [:error] [pid 40596:tid 40648] [client 149.88.106.148:45228] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aT7Mj2vZZo4N2X7WoLy3AwAAAdY"]
[Sun Dec 14 22:41:19.536934 2025] [:error] [pid 41600:tid 41621] [client 149.88.106.148:45274] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aT7Mj9FLTBZjcwNd_VtRxwAAARI"]
[Sun Dec 14 22:41:22.067053 2025] [:error] [pid 39524:tid 39579] [client 149.88.106.148:45290] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aT7MkmrVGpbDzFtDE9Mb1gAAAFc"]
[Sun Dec 14 22:41:22.777180 2025] [:error] [pid 13799:tid 13804] [client 149.88.106.148:22949] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Dec 14 22:41:22.957703 2025] [:error] [pid 13799:tid 13806] [client 149.88.106.148:22949] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Dec 14 22:41:23.139455 2025] [:error] [pid 13799:tid 13824] [client 149.88.106.148:22949] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Dec 14 22:41:23.318096 2025] [:error] [pid 13799:tid 13820] [client 149.88.106.148:22949] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Dec 14 22:41:25.397023 2025] [:error] [pid 13799:tid 13823] [client 149.88.106.148:22949] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aT7MlXjPEin01ElFTNZktAAAAhU"]
[Sun Dec 14 22:41:25.748212 2025] [:error] [pid 40561:tid 40588] [client 149.88.106.148:45306] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aT7MlYY6r869zoqRQkT5NAAAAVc"]
[Sun Dec 14 22:41:26.095372 2025] [:error] [pid 39523:tid 39541] [client 149.88.106.148:45308] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aT7MljQTQH1raAj2lkgFQQAAAA0"]
[Sun Dec 14 22:41:26.445024 2025] [:error] [pid 39523:tid 39549] [client 149.88.106.148:45310] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aT7MljQTQH1raAj2lkgFQwAAABU"]
[Sun Dec 14 22:41:26.810982 2025] [:error] [pid 39614:tid 39625] [client 149.88.106.148:45324] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aT7MlvxybG8-9MflbDeXWAAAAMk"]
[Sun Dec 14 22:41:27.158422 2025] [:error] [pid 39524:tid 39579] [client 149.88.106.148:45334] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aT7Ml2rVGpbDzFtDE9Mb5wAAAFc"]
[Sun Dec 14 22:41:27.689478 2025] [:error] [pid 39523:tid 39537] [client 149.88.106.148:45348] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aT7MlzQTQH1raAj2lkgFRQAAAAk"]
[Sun Dec 14 22:41:28.037177 2025] [:error] [pid 41600:tid 41605] [client 149.88.106.148:45356] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aT7MmNFLTBZjcwNd_VtR6QAAAQI"]
[Sun Dec 14 22:41:28.386209 2025] [:error] [pid 39524:tid 39562] [client 149.88.106.148:45358] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aT7MmGrVGpbDzFtDE9Mb7QAAAEY"]
[Sun Dec 14 22:41:28.737357 2025] [:error] [pid 39614:tid 39640] [client 149.88.106.148:45372] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aT7MmPxybG8-9MflbDeXWQAAANg"]
[Sun Dec 14 22:41:29.452488 2025] [:error] [pid 13799:tid 13809] [client 149.88.106.148:39540] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aT7MmXjPEin01ElFTNZkuQAAAgc"]
[Sun Dec 14 22:41:29.982678 2025] [:error] [pid 13799:tid 13826] [client 149.88.106.148:39542] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aT7MmXjPEin01ElFTNZkuwAAAhg"]
[Sun Dec 14 22:41:30.333373 2025] [:error] [pid 13799:tid 13811] [client 149.88.106.148:39544] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Dec 14 22:41:30.685271 2025] [:error] [pid 13799:tid 13815] [client 149.88.106.148:39544] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aT7MmnjPEin01ElFTNZkvwAAAg0"]
[Sun Dec 14 22:41:31.385071 2025] [:error] [pid 41600:tid 41607] [client 149.88.106.148:39554] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aT7Mm9FLTBZjcwNd_VtR_gAAAQQ"]
[Sun Dec 14 22:41:32.093331 2025] [:error] [pid 39523:tid 39528] [client 149.88.106.148:39562] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Dec 14 22:41:32.267393 2025] [:error] [pid 39523:tid 39543] [client 149.88.106.148:39562] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aT7MnDQTQH1raAj2lkgFTwAAAA8"]
[Sun Dec 14 22:41:32.817613 2025] [:error] [pid 41600:tid 41604] [client 149.88.106.148:39578] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Dec 14 22:41:32.993878 2025] [:error] [pid 41600:tid 41621] [client 149.88.106.148:39578] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Dec 14 22:41:33.169215 2025] [:error] [pid 41600:tid 41610] [client 149.88.106.148:39578] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Dec 14 22:41:33.344195 2025] [:error] [pid 41600:tid 41611] [client 149.88.106.148:39578] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aT7MndFLTBZjcwNd_VtSDQAAAQg"]
[Sun Dec 14 22:41:33.696747 2025] [:error] [pid 41600:tid 41612] [client 149.88.106.148:39586] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Dec 14 22:41:33.870907 2025] [:error] [pid 41600:tid 41618] [client 149.88.106.148:39586] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aT7MndFLTBZjcwNd_VtSEgAAAQ8"]
[Sun Dec 14 22:41:34.583425 2025] [:error] [pid 39524:tid 39575] [client 149.88.106.148:39590] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Dec 14 22:41:34.760752 2025] [:error] [pid 39524:tid 39563] [client 149.88.106.148:39590] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Dec 14 22:41:34.936815 2025] [:error] [pid 39524:tid 39571] [client 149.88.106.148:39590] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Dec 14 22:41:35.824227 2025] [:error] [pid 39524:tid 39569] [client 149.88.106.148:39590] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Dec 14 22:41:36.002964 2025] [:error] [pid 39524:tid 39567] [client 149.88.106.148:39590] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Dec 14 22:41:36.356821 2025] [:error] [pid 39524:tid 39570] [client 149.88.106.148:39590] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Dec 14 22:41:38.192217 2025] [:error] [pid 39524:tid 39575] [client 149.88.106.148:39590] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Dec 14 22:41:38.365376 2025] [:error] [pid 39524:tid 39557] [client 149.88.106.148:39590] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aT7MomrVGpbDzFtDE9McHQAAAEE"]
[Sun Dec 14 22:41:38.731845 2025] [:error] [pid 39525:tid 39602] [client 149.88.106.148:39604] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aT7Mok1fX_pB_BrvE_5t9AAAAJM"]
[Sun Dec 14 22:41:39.078810 2025] [:error] [pid 39523:tid 39535] [client 149.88.106.148:49644] [client 149.88.106.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.88.106.148, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aT7MozQTQH1raAj2lkgFUAAAAAc"]
[Sun Dec 14 22:41:39.083446 2025] [:error] [pid 39523:tid 39535] [client 149.88.106.148:49644] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Dec 14 22:41:39.259068 2025] [:error] [pid 39523:tid 39537] [client 149.88.106.148:49644] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Dec 14 22:41:39.431888 2025] [:error] [pid 39523:tid 39545] [client 149.88.106.148:49644] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aT7MozQTQH1raAj2lkgFUgAAABE"]
[Sun Dec 14 22:41:39.997246 2025] [:error] [pid 39614:tid 39639] [client 149.88.106.148:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Dec 14 22:41:40.170248 2025] [:error] [pid 39614:tid 39629] [client 149.88.106.148:49646] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aT7MpPxybG8-9MflbDeXYAAAAM0"]
[Sun Dec 14 22:41:40.518523 2025] [:error] [pid 41600:tid 41621] [client 149.88.106.148:49652] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aT7MpNFLTBZjcwNd_VtSHgAAARI"]
[Sun Dec 14 22:41:41.681565 2025] [:error] [pid 41600:tid 41620] [client 149.88.106.148:49660] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aT7MpdFLTBZjcwNd_VtSJAAAARE"]
[Sun Dec 14 22:41:42.062825 2025] [:error] [pid 39524:tid 39579] [client 149.88.106.148:49664] [client 149.88.106.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/fm.php"] [unique_id "aT7MpmrVGpbDzFtDE9McIQAAAFc"]
[Sun Dec 14 22:41:42.622980 2025] [:error] [pid 41600:tid 41608] [client 149.88.106.148:49668] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php7"] [unique_id "aT7MptFLTBZjcwNd_VtSJwAAAQU"]
[Sun Dec 14 22:41:42.970317 2025] [:error] [pid 39524:tid 39566] [client 149.88.106.148:49672] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php7"] [unique_id "aT7MpmrVGpbDzFtDE9McIgAAAEo"]
[Sun Dec 14 22:41:43.320665 2025] [:error] [pid 40561:tid 40574] [client 149.88.106.148:49682] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php7"] [unique_id "aT7Mp4Y6r869zoqRQkT5PQAAAUk"]
[Sun Dec 14 22:41:43.670326 2025] [:error] [pid 40561:tid 40585] [client 149.88.106.148:49696] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php7"] [unique_id "aT7Mp4Y6r869zoqRQkT5QAAAAVQ"]
[Sun Dec 14 22:41:44.021367 2025] [:error] [pid 39523:tid 39531] [client 149.88.106.148:49712] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php7"] [unique_id "aT7MqDQTQH1raAj2lkgFVQAAAAM"]
[Sun Dec 14 22:41:53.182459 2025] [:error] [pid 39524:tid 39567] [client 149.88.106.148:49728] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "aT7MsWrVGpbDzFtDE9McPwAAAEs"]
[Sun Dec 14 22:41:53.537591 2025] [:error] [pid 40595:tid 40619] [client 149.88.106.148:58806] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "aT7Msfjrht6y4RN-xKRHXAAAAZQ"]
[Sun Dec 14 22:41:53.898929 2025] [:error] [pid 13799:tid 13810] [client 149.88.106.148:58812] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "aT7MsXjPEin01ElFTNZkxQAAAgg"]
[Sun Dec 14 22:41:54.249131 2025] [:error] [pid 40595:tid 40604] [client 149.88.106.148:58824] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "aT7Msvjrht6y4RN-xKRHXQAAAYU"]
[Sun Dec 14 22:41:54.598278 2025] [:error] [pid 41600:tid 41612] [client 149.88.106.148:58836] [client 149.88.106.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "aT7MstFLTBZjcwNd_VtSMgAAAQk"]
[Mon Dec 15 04:34:01.765838 2025] [:error] [pid 35019:tid 35040] [client 4.194.51.10:17484] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Dec 15 04:34:01.857357 2025] [:error] [pid 35019:tid 35043] [client 4.194.51.10:17484] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Mon Dec 15 04:34:01.947650 2025] [:error] [pid 35019:tid 35041] [client 4.194.51.10:17484] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Mon Dec 15 04:34:02.041806 2025] [:error] [pid 35019:tid 35030] [client 4.194.51.10:17484] File does not exist: /usr/local/apache/htdocs/suspended-page/disaos.php
[Mon Dec 15 04:34:03.787306 2025] [:error] [pid 35019:tid 35045] [client 4.194.51.10:17484] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Mon Dec 15 04:34:03.878973 2025] [:error] [pid 35019:tid 35034] [client 4.194.51.10:17484] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Dec 15 04:34:03.976859 2025] [:error] [pid 35019:tid 35038] [client 4.194.51.10:17484] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aT8fO62LAdKSfjdLIKJt_gAAAA8"]
[Mon Dec 15 04:34:04.186539 2025] [:error] [pid 35104:tid 35109] [client 4.194.51.10:17517] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aT8fPKWpPfWnBdEuPp4pYAAAAMI"]
[Mon Dec 15 04:34:04.393919 2025] [:error] [pid 35104:tid 35122] [client 4.194.51.10:17527] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aT8fPKWpPfWnBdEuPp4pYQAAAM8"]
[Mon Dec 15 04:34:04.619640 2025] [:error] [pid 35104:tid 35120] [client 4.194.51.10:17602] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "aT8fPKWpPfWnBdEuPp4pYgAAAM0"]
[Mon Dec 15 04:34:04.821719 2025] [:error] [pid 35104:tid 35113] [client 4.194.51.10:17626] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aT8fPKWpPfWnBdEuPp4pYwAAAMY"]
[Mon Dec 15 04:34:05.118102 2025] [:error] [pid 35104:tid 35129] [client 4.194.51.10:17496] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aT8fPaWpPfWnBdEuPp4pZAAAANY"]
[Mon Dec 15 04:34:05.335359 2025] [:error] [pid 35104:tid 35108] [client 4.194.51.10:17495] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aT8fPaWpPfWnBdEuPp4pZgAAAME"]
[Mon Dec 15 04:34:05.539781 2025] [:error] [pid 35021:tid 35086] [client 4.194.51.10:17614] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/fucku.php"] [unique_id "aT8fPS9sSwxVqtYnS1t6RAAAAIk"]
[Mon Dec 15 04:34:05.756094 2025] [:error] [pid 35021:tid 35094] [client 4.194.51.10:17526] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fPS9sSwxVqtYnS1t6RQAAAJE"]
[Mon Dec 15 04:34:05.969659 2025] [:error] [pid 35019:tid 35039] [client 4.194.51.10:17533] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fPa2LAdKSfjdLIKJuAQAAABA"]
[Mon Dec 15 04:34:06.269862 2025] [:error] [pid 35020:tid 35052] [client 4.194.51.10:17623] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fPiBMuWbtFfQIRIbR_wAAAEI"]
[Mon Dec 15 04:34:06.499063 2025] [:error] [pid 35020:tid 35050] [client 4.194.51.10:17503] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fPiBMuWbtFfQIRIbSAAAAAEA"]
[Mon Dec 15 04:34:06.725220 2025] [:error] [pid 35104:tid 35123] [client 4.194.51.10:17532] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT8fPqWpPfWnBdEuPp4pZwAAANA"]
[Mon Dec 15 04:34:06.899528 2025] [:error] [pid 35021:tid 35089] [client 4.194.51.10:17506] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT8fPi9sSwxVqtYnS1t6RgAAAIw"]
[Mon Dec 15 04:34:07.074146 2025] [:error] [pid 35104:tid 35124] [client 4.194.51.10:17619] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT8fP6WpPfWnBdEuPp4paAAAANE"]
[Mon Dec 15 04:34:07.259809 2025] [:error] [pid 35104:tid 35121] [client 4.194.51.10:17510] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aT8fP6WpPfWnBdEuPp4pagAAAM4"]
[Mon Dec 15 04:34:07.458423 2025] [:error] [pid 35019:tid 35037] [client 4.194.51.10:17474] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aT8fP62LAdKSfjdLIKJuAwAAAA4"]
[Mon Dec 15 04:34:07.714894 2025] [:error] [pid 35019:tid 35026] [client 4.194.51.10:17528] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aT8fP62LAdKSfjdLIKJuBQAAAAM"]
[Mon Dec 15 04:34:07.897456 2025] [:error] [pid 35104:tid 35111] [client 4.194.51.10:17479] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aT8fP6WpPfWnBdEuPp4pbgAAAMQ"]
[Mon Dec 15 04:34:08.105491 2025] [:error] [pid 35019:tid 35036] [client 4.194.51.10:17631] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aT8fQK2LAdKSfjdLIKJuEAAAAA0"]
[Mon Dec 15 04:34:08.302436 2025] [:error] [pid 35020:tid 35062] [client 4.194.51.10:17661] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aT8fQCBMuWbtFfQIRIbSAgAAAEw"]
[Mon Dec 15 04:34:08.509807 2025] [:error] [pid 35019:tid 35031] [client 4.194.51.10:17515] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aT8fQK2LAdKSfjdLIKJuIgAAAAg"]
[Mon Dec 15 04:34:08.796710 2025] [:error] [pid 35021:tid 35088] [client 4.194.51.10:17659] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aT8fQC9sSwxVqtYnS1t6RwAAAIs"]
[Mon Dec 15 04:34:08.971259 2025] [:error] [pid 35019:tid 35047] [client 4.194.51.10:17621] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aT8fQK2LAdKSfjdLIKJuKwAAABg"]
[Mon Dec 15 04:34:09.157276 2025] [:error] [pid 35019:tid 35023] [client 4.194.51.10:17925] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fQa2LAdKSfjdLIKJuLAAAAAA"]
[Mon Dec 15 04:34:09.362311 2025] [:error] [pid 35020:tid 35060] [client 4.194.51.10:17497] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fQSBMuWbtFfQIRIbSBAAAAEo"]
[Mon Dec 15 04:34:09.554500 2025] [:error] [pid 35021:tid 35079] [client 4.194.51.10:17488] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fQS9sSwxVqtYnS1t6SAAAAII"]
[Mon Dec 15 04:34:09.745202 2025] [:error] [pid 35020:tid 35055] [client 4.194.51.10:17491] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aT8fQSBMuWbtFfQIRIbSBQAAAEU"]
[Mon Dec 15 04:34:10.019653 2025] [:error] [pid 35104:tid 35123] [client 4.194.51.10:17472] [client 4.194.51.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aT8fQqWpPfWnBdEuPp4plQAAANA"]
[Mon Dec 15 04:34:10.203535 2025] [:error] [pid 35020:tid 35063] [client 4.194.51.10:17620] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aT8fQiBMuWbtFfQIRIbSCAAAAE0"]
[Mon Dec 15 04:34:10.529737 2025] [:error] [pid 35020:tid 35059] [client 4.194.51.10:17524] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aT8fQiBMuWbtFfQIRIbSCQAAAEk"]
[Mon Dec 15 04:34:10.725305 2025] [:error] [pid 35020:tid 35067] [client 4.194.51.10:17500] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aT8fQiBMuWbtFfQIRIbSCgAAAFE"]
[Mon Dec 15 04:34:10.950662 2025] [:error] [pid 35104:tid 35127] [client 4.194.51.10:17603] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aT8fQqWpPfWnBdEuPp4plgAAANQ"]
[Mon Dec 15 04:34:11.167538 2025] [:error] [pid 35020:tid 35053] [client 4.194.51.10:17935] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aT8fQyBMuWbtFfQIRIbSDAAAAEM"]
[Mon Dec 15 04:34:11.369241 2025] [:error] [pid 35020:tid 35072] [client 4.194.51.10:17486] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aT8fQyBMuWbtFfQIRIbSDQAAAFY"]
[Mon Dec 15 04:34:11.608889 2025] [:error] [pid 35020:tid 35069] [client 4.194.51.10:17521] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aT8fQyBMuWbtFfQIRIbSDgAAAFM"]
[Mon Dec 15 04:34:11.837149 2025] [:error] [pid 35020:tid 35057] [client 4.194.51.10:17624] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aT8fQyBMuWbtFfQIRIbSDwAAAEc"]
[Mon Dec 15 04:34:12.020317 2025] [:error] [pid 35020:tid 35064] [client 4.194.51.10:17487] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aT8fRCBMuWbtFfQIRIbSEQAAAE4"]
[Mon Dec 15 04:34:12.267294 2025] [:error] [pid 35021:tid 35091] [client 4.194.51.10:17492] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aT8fRC9sSwxVqtYnS1t6SQAAAI4"]
[Mon Dec 15 04:34:12.505399 2025] [:error] [pid 35104:tid 35131] [client 4.194.51.10:17480] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "aT8fRKWpPfWnBdEuPp4pmAAAANg"]
[Mon Dec 15 04:34:12.723249 2025] [:error] [pid 35104:tid 35114] [client 4.194.51.10:17622] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT8fRKWpPfWnBdEuPp4pmQAAAMc"]
[Mon Dec 15 04:34:12.952114 2025] [:error] [pid 35021:tid 35081] [client 4.194.51.10:17504] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT8fRC9sSwxVqtYnS1t6SgAAAIQ"]
[Mon Dec 15 04:34:13.156767 2025] [:error] [pid 35020:tid 35070] [client 4.194.51.10:17535] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT8fRSBMuWbtFfQIRIbSFAAAAFQ"]
[Mon Dec 15 04:34:13.477698 2025] [:error] [pid 35021:tid 35084] [client 4.194.51.10:17473] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aT8fRS9sSwxVqtYnS1t6SwAAAIc"]
[Mon Dec 15 04:34:13.678250 2025] [:error] [pid 35021:tid 35085] [client 4.194.51.10:17636] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aT8fRS9sSwxVqtYnS1t6TQAAAIg"]
[Mon Dec 15 04:34:13.997985 2025] [:error] [pid 35020:tid 35050] [client 4.194.51.10:17645] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aT8fRSBMuWbtFfQIRIbSFgAAAEA"]
[Mon Dec 15 04:34:14.286127 2025] [:error] [pid 35021:tid 35098] [client 4.194.51.10:17509] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aT8fRi9sSwxVqtYnS1t6TwAAAJU"]
[Mon Dec 15 04:34:14.548734 2025] [:error] [pid 35020:tid 35074] [client 4.194.51.10:17493] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "aT8fRiBMuWbtFfQIRIbSGAAAAFg"]
[Mon Dec 15 04:34:14.824701 2025] [:error] [pid 35020:tid 35062] [client 4.194.51.10:17617] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aT8fRiBMuWbtFfQIRIbSGQAAAEw"]
[Mon Dec 15 04:34:15.093563 2025] [:error] [pid 35021:tid 35095] [client 4.194.51.10:17612] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aT8fRy9sSwxVqtYnS1t6UgAAAJI"]
[Mon Dec 15 04:34:15.328965 2025] [:error] [pid 35020:tid 35060] [client 4.194.51.10:17635] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aT8fRyBMuWbtFfQIRIbSGwAAAEo"]
[Mon Dec 15 04:34:15.626642 2025] [:error] [pid 35021:tid 35093] [client 4.194.51.10:17627] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aT8fRy9sSwxVqtYnS1t6VAAAAJA"]
[Mon Dec 15 04:34:15.877908 2025] [:error] [pid 35020:tid 35065] [client 4.194.51.10:17663] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT8fRyBMuWbtFfQIRIbSHAAAAE8"]
[Mon Dec 15 04:34:16.103581 2025] [:error] [pid 35021:tid 35100] [client 4.194.51.10:17518] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT8fSC9sSwxVqtYnS1t6VQAAAJc"]
[Mon Dec 15 04:34:16.373290 2025] [:error] [pid 35021:tid 35092] [client 4.194.51.10:17514] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT8fSC9sSwxVqtYnS1t6VgAAAI8"]
[Mon Dec 15 04:34:16.620019 2025] [:error] [pid 35019:tid 35047] [client 4.194.51.10:17609] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aT8fSK2LAdKSfjdLIKJuNAAAABg"]
[Mon Dec 15 04:34:17.004281 2025] [:error] [pid 35019:tid 35023] [client 4.194.51.10:17485] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT8fSa2LAdKSfjdLIKJuNQAAAAA"]
[Mon Dec 15 04:34:17.396131 2025] [:error] [pid 35019:tid 35039] [client 4.194.51.10:17628] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT8fSa2LAdKSfjdLIKJuNgAAABA"]
[Mon Dec 15 04:34:17.646214 2025] [:error] [pid 35019:tid 35025] [client 4.194.51.10:17660] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT8fSa2LAdKSfjdLIKJuNwAAAAI"]
[Mon Dec 15 04:34:17.931726 2025] [:error] [pid 35019:tid 35042] [client 4.194.51.10:17516] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aT8fSa2LAdKSfjdLIKJuOAAAABM"]
[Mon Dec 15 04:34:18.132795 2025] [:error] [pid 35104:tid 35110] [client 4.194.51.10:17520] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aT8fSqWpPfWnBdEuPp4pmwAAAMM"]
[Mon Dec 15 04:34:18.369280 2025] [:error] [pid 35104:tid 35111] [client 4.194.51.10:17657] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aT8fSqWpPfWnBdEuPp4pnAAAAMQ"]
[Mon Dec 15 04:34:18.645927 2025] [:error] [pid 35020:tid 35053] [client 4.194.51.10:17658] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aT8fSiBMuWbtFfQIRIbSHwAAAEM"]
[Mon Dec 15 04:34:18.901693 2025] [:error] [pid 35019:tid 35026] [client 4.194.51.10:17947] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aT8fSq2LAdKSfjdLIKJuOQAAAAM"]
[Mon Dec 15 04:34:19.139571 2025] [:error] [pid 35021:tid 35080] [client 4.194.51.10:17534] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aT8fSy9sSwxVqtYnS1t6WgAAAIM"]
[Mon Dec 15 04:34:19.514746 2025] [:error] [pid 35020:tid 35061] [client 4.194.51.10:17922] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aT8fSyBMuWbtFfQIRIbSIgAAAEs"]
[Mon Dec 15 04:34:19.949502 2025] [:error] [pid 35021:tid 35079] [client 4.194.51.10:17960] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aT8fSy9sSwxVqtYnS1t6WwAAAII"]
[Mon Dec 15 04:34:20.198297 2025] [:error] [pid 35021:tid 35084] [client 4.194.51.10:17606] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aT8fTC9sSwxVqtYnS1t6XQAAAIc"]
[Mon Dec 15 04:34:20.434448 2025] [:error] [pid 35021:tid 35101] [client 4.194.51.10:17957] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aT8fTC9sSwxVqtYnS1t6XgAAAJg"]
[Mon Dec 15 04:34:20.620246 2025] [:error] [pid 35019:tid 35024] [client 4.194.51.10:17502] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aT8fTK2LAdKSfjdLIKJuPAAAAAE"]
[Mon Dec 15 04:34:21.050512 2025] [:error] [pid 35019:tid 35027] [client 4.194.51.10:17963] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aT8fTa2LAdKSfjdLIKJuPgAAAAQ"]
[Mon Dec 15 04:34:21.647051 2025] [:error] [pid 35019:tid 35030] [client 4.194.51.10:17529] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aT8fTa2LAdKSfjdLIKJuQAAAAAc"]
[Mon Dec 15 04:34:21.861650 2025] [:error] [pid 35019:tid 35036] [client 4.194.51.10:17952] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aT8fTa2LAdKSfjdLIKJuQgAAAA0"]
[Mon Dec 15 04:34:22.138908 2025] [:error] [pid 35019:tid 35038] [client 4.194.51.10:17605] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aT8fTq2LAdKSfjdLIKJuRQAAAA8"]
[Mon Dec 15 04:34:22.528031 2025] [:error] [pid 35104:tid 35131] [client 4.194.51.10:17501] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aT8fTqWpPfWnBdEuPp4pnwAAANg"]
[Mon Dec 15 04:34:22.811842 2025] [:error] [pid 35019:tid 35047] [client 4.194.51.10:17607] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aT8fTq2LAdKSfjdLIKJuSAAAABg"]
[Mon Dec 15 04:34:23.156867 2025] [:error] [pid 35019:tid 35025] [client 4.194.51.10:17931] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aT8fT62LAdKSfjdLIKJuTQAAAAI"]
[Mon Dec 15 04:34:23.710754 2025] [:error] [pid 35020:tid 35062] [client 4.194.51.10:17920] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aT8fTyBMuWbtFfQIRIbSJgAAAEw"]
[Mon Dec 15 04:34:23.931459 2025] [:error] [pid 35020:tid 35052] [client 4.194.51.10:17629] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aT8fTyBMuWbtFfQIRIbSJwAAAEI"]
[Mon Dec 15 04:34:24.134988 2025] [:error] [pid 35020:tid 35065] [client 4.194.51.10:17600] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aT8fUCBMuWbtFfQIRIbSKQAAAE8"]
[Mon Dec 15 04:34:24.480604 2025] [:error] [pid 35019:tid 35024] [client 4.194.51.10:17654] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aT8fUK2LAdKSfjdLIKJuTgAAAAE"]
[Mon Dec 15 04:34:24.750877 2025] [:error] [pid 35020:tid 35068] [client 4.194.51.10:17604] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aT8fUCBMuWbtFfQIRIbSKwAAAFI"]
[Mon Dec 15 04:34:25.026872 2025] [:error] [pid 35019:tid 35033] [client 4.194.51.10:17505] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aT8fUa2LAdKSfjdLIKJuTwAAAAo"]
[Mon Dec 15 04:34:25.257977 2025] [:error] [pid 35019:tid 35027] [client 4.194.51.10:17951] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aT8fUa2LAdKSfjdLIKJuUAAAAAQ"]
[Mon Dec 15 04:34:25.492301 2025] [:error] [pid 35019:tid 35045] [client 4.194.51.10:18417] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aT8fUa2LAdKSfjdLIKJuUgAAABY"]
[Mon Dec 15 04:34:25.767632 2025] [:error] [pid 35019:tid 35041] [client 4.194.51.10:18370] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aT8fUa2LAdKSfjdLIKJuVQAAABI"]
[Mon Dec 15 04:34:26.063619 2025] [:error] [pid 35019:tid 35042] [client 4.194.51.10:17946] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aT8fUq2LAdKSfjdLIKJuVwAAABM"]
[Mon Dec 15 04:34:26.330998 2025] [:error] [pid 35019:tid 35037] [client 4.194.51.10:17494] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aT8fUq2LAdKSfjdLIKJuWAAAAA4"]
[Mon Dec 15 04:34:26.874718 2025] [:error] [pid 35104:tid 35116] [client 4.194.51.10:17924] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20.php"] [unique_id "aT8fUqWpPfWnBdEuPp4poQAAAMk"]
[Mon Dec 15 04:34:27.650345 2025] [:error] [pid 35104:tid 35126] [client 4.194.51.10:17613] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20.php"] [unique_id "aT8fU6WpPfWnBdEuPp4pogAAANM"]
[Mon Dec 15 04:34:27.951923 2025] [:error] [pid 35019:tid 35024] [client 4.194.51.10:17650] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20.php"] [unique_id "aT8fU62LAdKSfjdLIKJuXAAAAAE"]
[Mon Dec 15 04:34:28.260027 2025] [:error] [pid 35019:tid 35033] [client 4.194.51.10:17927] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20.php"] [unique_id "aT8fVK2LAdKSfjdLIKJuXQAAAAo"]
[Mon Dec 15 04:34:28.491613 2025] [:error] [pid 35020:tid 35067] [client 4.194.51.10:17651] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT8fVCBMuWbtFfQIRIbSLgAAAFE"]
[Mon Dec 15 04:34:28.708254 2025] [:error] [pid 35021:tid 35092] [client 4.194.51.10:17944] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT8fVC9sSwxVqtYnS1t6ZAAAAI8"]
[Mon Dec 15 04:34:28.924183 2025] [:error] [pid 35020:tid 35071] [client 4.194.51.10:17969] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT8fVCBMuWbtFfQIRIbSMAAAAFU"]
[Mon Dec 15 04:34:29.132048 2025] [:error] [pid 35019:tid 35027] [client 4.194.51.10:17507] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aT8fVa2LAdKSfjdLIKJuXgAAAAQ"]
[Mon Dec 15 04:34:29.367300 2025] [:error] [pid 35019:tid 35029] [client 4.194.51.10:17956] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT8fVa2LAdKSfjdLIKJuXwAAAAY"]
[Mon Dec 15 04:34:29.569676 2025] [:error] [pid 35019:tid 35045] [client 4.194.51.10:17632] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT8fVa2LAdKSfjdLIKJuYAAAABY"]
[Mon Dec 15 04:34:29.758707 2025] [:error] [pid 35019:tid 35039] [client 4.194.51.10:17483] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT8fVa2LAdKSfjdLIKJuYQAAABA"]
[Mon Dec 15 04:34:29.964132 2025] [:error] [pid 35021:tid 35089] [client 4.194.51.10:17660] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aT8fVS9sSwxVqtYnS1t6bQAAAIw"]
[Mon Dec 15 04:34:30.149487 2025] [:error] [pid 35104:tid 35118] [client 4.194.51.10:17519] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT8fVqWpPfWnBdEuPp4ppwAAAMs"]
[Mon Dec 15 04:34:30.377649 2025] [:error] [pid 35020:tid 35061] [client 4.194.51.10:17926] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT8fViBMuWbtFfQIRIbSMQAAAEs"]
[Mon Dec 15 04:34:30.596074 2025] [:error] [pid 35104:tid 35120] [client 4.194.51.10:17630] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT8fVqWpPfWnBdEuPp4pqAAAAM0"]
[Mon Dec 15 04:34:30.901914 2025] [:error] [pid 35104:tid 35113] [client 4.194.51.10:17625] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aT8fVqWpPfWnBdEuPp4pqQAAAMY"]
[Mon Dec 15 04:34:31.120175 2025] [:error] [pid 35104:tid 35108] [client 4.194.51.10:17647] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aT8fV6WpPfWnBdEuPp4pqgAAAME"]
[Mon Dec 15 04:34:31.423876 2025] [:error] [pid 35020:tid 35051] [client 4.194.51.10:17601] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aT8fVyBMuWbtFfQIRIbSNAAAAEE"]
[Mon Dec 15 04:34:31.623762 2025] [:error] [pid 35021:tid 35093] [client 4.194.51.10:17656] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aT8fVy9sSwxVqtYnS1t6bgAAAJA"]
[Mon Dec 15 04:34:32.035322 2025] [:error] [pid 35021:tid 35086] [client 4.194.51.10:17640] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aT8fWC9sSwxVqtYnS1t6cQAAAIk"]
[Mon Dec 15 04:34:32.335068 2025] [:error] [pid 35019:tid 35023] [client 4.194.51.10:18369] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT8fWK2LAdKSfjdLIKJuZwAAAAA"]
[Mon Dec 15 04:34:32.593183 2025] [:error] [pid 35019:tid 35030] [client 4.194.51.10:17938] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT8fWK2LAdKSfjdLIKJuaAAAAAc"]
[Mon Dec 15 04:34:32.802952 2025] [:error] [pid 35020:tid 35066] [client 4.194.51.10:17923] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT8fWCBMuWbtFfQIRIbSNgAAAFA"]
[Mon Dec 15 04:34:33.015169 2025] [:error] [pid 35104:tid 35124] [client 4.194.51.10:17974] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aT8fWaWpPfWnBdEuPp4prAAAANE"]
[Mon Dec 15 04:34:33.278126 2025] [:error] [pid 35021:tid 35091] [client 4.194.51.10:17975] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT8fWS9sSwxVqtYnS1t6fQAAAI4"]
[Mon Dec 15 04:34:33.466182 2025] [:error] [pid 35021:tid 35098] [client 4.194.51.10:17964] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT8fWS9sSwxVqtYnS1t6fwAAAJU"]
[Mon Dec 15 04:34:33.708372 2025] [:error] [pid 35019:tid 35039] [client 4.194.51.10:18392] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT8fWa2LAdKSfjdLIKJuaQAAABA"]
[Mon Dec 15 04:34:33.894683 2025] [:error] [pid 35019:tid 35031] [client 4.194.51.10:17954] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aT8fWa2LAdKSfjdLIKJuagAAAAg"]
[Mon Dec 15 04:34:34.094296 2025] [:error] [pid 35019:tid 35041] [client 4.194.51.10:18375] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT8fWq2LAdKSfjdLIKJuawAAABI"]
[Mon Dec 15 04:34:34.305805 2025] [:error] [pid 35021:tid 35086] [client 4.194.51.10:18394] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT8fWi9sSwxVqtYnS1t6hwAAAIk"]
[Mon Dec 15 04:34:34.486960 2025] [:error] [pid 35021:tid 35096] [client 4.194.51.10:18387] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT8fWi9sSwxVqtYnS1t6igAAAJM"]
[Mon Dec 15 04:34:34.738426 2025] [:error] [pid 35021:tid 35088] [client 4.194.51.10:17936] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aT8fWi9sSwxVqtYnS1t6jQAAAIs"]
[Mon Dec 15 04:34:34.947554 2025] [:error] [pid 35104:tid 35121] [client 4.194.51.10:17948] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aT8fWqWpPfWnBdEuPp4prgAAAM4"]
[Mon Dec 15 04:34:35.146474 2025] [:error] [pid 35020:tid 35062] [client 4.194.51.10:17978] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aT8fWyBMuWbtFfQIRIbSOgAAAEw"]
[Mon Dec 15 04:34:35.380420 2025] [:error] [pid 35020:tid 35054] [client 4.194.51.10:17490] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aT8fWyBMuWbtFfQIRIbSPAAAAEQ"]
[Mon Dec 15 04:34:35.568902 2025] [:error] [pid 35020:tid 35068] [client 4.194.51.10:18391] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aT8fWyBMuWbtFfQIRIbSPgAAAFI"]
[Mon Dec 15 04:34:35.772295 2025] [:error] [pid 35019:tid 35040] [client 4.194.51.10:17522] [client 4.194.51.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aT8fW62LAdKSfjdLIKJubQAAABE"]
[Mon Dec 15 04:34:35.947480 2025] [:error] [pid 35104:tid 35115] [client 4.194.51.10:17511] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aT8fW6WpPfWnBdEuPp4psQAAAMg"]
[Mon Dec 15 04:34:36.148144 2025] [:error] [pid 35021:tid 35098] [client 4.194.51.10:17494] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aT8fXC9sSwxVqtYnS1t6lgAAAJU"]
[Mon Dec 15 04:34:36.355948 2025] [:error] [pid 35104:tid 35118] [client 4.194.51.10:17642] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aT8fXKWpPfWnBdEuPp4ptgAAAMs"]
[Mon Dec 15 04:34:36.582833 2025] [:error] [pid 35019:tid 35047] [client 4.194.51.10:17637] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aT8fXK2LAdKSfjdLIKJucAAAABg"]
[Mon Dec 15 04:34:36.794047 2025] [:error] [pid 35104:tid 35129] [client 4.194.51.10:17933] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aT8fXKWpPfWnBdEuPp4pugAAANY"]
[Mon Dec 15 04:34:36.979070 2025] [:error] [pid 35104:tid 35110] [client 4.194.51.10:18406] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aT8fXKWpPfWnBdEuPp4pvQAAAMM"]
[Mon Dec 15 04:34:37.172505 2025] [:error] [pid 35104:tid 35123] [client 4.194.51.10:17513] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aT8fXaWpPfWnBdEuPp4pvwAAANA"]
[Mon Dec 15 04:34:37.359560 2025] [:error] [pid 35020:tid 35071] [client 4.194.51.10:17650] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kk.php"] [unique_id "aT8fXSBMuWbtFfQIRIbSQgAAAFU"]
[Mon Dec 15 04:34:37.536974 2025] [:error] [pid 35019:tid 35043] [client 4.194.51.10:17608] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kk.php"] [unique_id "aT8fXa2LAdKSfjdLIKJucgAAABQ"]
[Mon Dec 15 04:34:37.750160 2025] [:error] [pid 35104:tid 35122] [client 4.194.51.10:17655] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kk.php"] [unique_id "aT8fXaWpPfWnBdEuPp4pxQAAAM8"]
[Mon Dec 15 04:34:37.989347 2025] [:error] [pid 35104:tid 35118] [client 4.194.51.10:18386] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kk.php"] [unique_id "aT8fXaWpPfWnBdEuPp4pyAAAAMs"]
[Mon Dec 15 04:34:38.359284 2025] [:error] [pid 35020:tid 35061] [client 4.194.51.10:17499] [client 4.194.51.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aT8fXiBMuWbtFfQIRIbSRQAAAEs"]
[Mon Dec 15 04:34:38.662539 2025] [:error] [pid 35021:tid 35092] [client 4.194.51.10:18421] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT8fXi9sSwxVqtYnS1t6mAAAAI8"]
[Mon Dec 15 04:34:38.894023 2025] [:error] [pid 35104:tid 35111] [client 4.194.51.10:17962] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT8fXqWpPfWnBdEuPp4p0gAAAMQ"]
[Mon Dec 15 04:34:39.120592 2025] [:error] [pid 35021:tid 35093] [client 4.194.51.10:17618] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT8fXy9sSwxVqtYnS1t6mgAAAJA"]
[Mon Dec 15 04:34:39.307184 2025] [:error] [pid 35020:tid 35066] [client 4.194.51.10:17643] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aT8fXyBMuWbtFfQIRIbSRwAAAFA"]
[Mon Dec 15 04:34:39.500001 2025] [:error] [pid 35020:tid 35074] [client 4.194.51.10:17752] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aT8fXyBMuWbtFfQIRIbSSgAAAFg"]
[Mon Dec 15 04:34:39.768908 2025] [:error] [pid 35019:tid 35044] [client 4.194.51.10:17940] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aT8fX62LAdKSfjdLIKJucwAAABU"]
[Mon Dec 15 04:34:39.964440 2025] [:error] [pid 35020:tid 35054] [client 4.194.51.10:17968] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aT8fXyBMuWbtFfQIRIbSTgAAAEQ"]
[Mon Dec 15 04:34:40.162850 2025] [:error] [pid 35020:tid 35060] [client 4.194.51.10:17950] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/403.php"] [unique_id "aT8fYCBMuWbtFfQIRIbSUAAAAEo"]
[Mon Dec 15 04:34:40.357697 2025] [:error] [pid 35019:tid 35046] [client 4.194.51.10:17610] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8fYK2LAdKSfjdLIKJudAAAABc"]
[Mon Dec 15 04:34:40.549904 2025] [:error] [pid 35104:tid 35118] [client 4.194.51.10:17945] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8fYKWpPfWnBdEuPp4p1wAAAMs"]
[Mon Dec 15 04:34:40.740468 2025] [:error] [pid 35019:tid 35032] [client 4.194.51.10:17498] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8fYK2LAdKSfjdLIKJudQAAAAk"]
[Mon Dec 15 04:34:40.918753 2025] [:error] [pid 35021:tid 35089] [client 4.194.51.10:17937] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8fYC9sSwxVqtYnS1t6nwAAAIw"]
[Mon Dec 15 04:34:41.105327 2025] [:error] [pid 35021:tid 35088] [client 4.194.51.10:17508] [client 4.194.51.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aT8fYS9sSwxVqtYnS1t6oAAAAIs"]
[Mon Dec 15 04:34:41.323373 2025] [:error] [pid 35021:tid 35090] [client 4.194.51.10:17941] [client 4.194.51.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aT8fYS9sSwxVqtYnS1t6pQAAAI0"]
[Mon Dec 15 04:34:41.573227 2025] [:error] [pid 35104:tid 35117] [client 4.194.51.10:17928] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aT8fYaWpPfWnBdEuPp4p2gAAAMo"]
[Mon Dec 15 04:34:41.780257 2025] [:error] [pid 35019:tid 35029] [client 4.194.51.10:18371] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aT8fYa2LAdKSfjdLIKJudgAAAAY"]
[Mon Dec 15 04:34:41.995571 2025] [:error] [pid 35020:tid 35056] [client 4.194.51.10:17489] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aT8fYSBMuWbtFfQIRIbSVwAAAEY"]
[Mon Dec 15 04:34:42.194962 2025] [:error] [pid 35019:tid 35034] [client 4.194.51.10:17662] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/coffee/index.php"] [unique_id "aT8fYq2LAdKSfjdLIKJueAAAAAs"]
[Mon Dec 15 04:34:42.415983 2025] [:error] [pid 35104:tid 35108] [client 4.194.51.10:17646] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/coffee/index.php"] [unique_id "aT8fYqWpPfWnBdEuPp4p3wAAAME"]
[Mon Dec 15 04:34:42.634965 2025] [:error] [pid 35104:tid 35125] [client 4.194.51.10:18395] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/coffee/index.php"] [unique_id "aT8fYqWpPfWnBdEuPp4p4QAAANI"]
[Mon Dec 15 04:34:42.814528 2025] [:error] [pid 35104:tid 35107] [client 4.194.51.10:18389] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/coffee/index.php"] [unique_id "aT8fYqWpPfWnBdEuPp4p4gAAAMA"]
[Mon Dec 15 04:34:43.015909 2025] [:error] [pid 35104:tid 35123] [client 4.194.51.10:17743] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT8fY6WpPfWnBdEuPp4p4wAAANA"]
[Mon Dec 15 04:34:43.191117 2025] [:error] [pid 35104:tid 35121] [client 4.194.51.10:17763] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT8fY6WpPfWnBdEuPp4p5AAAAM4"]
[Mon Dec 15 04:34:43.368433 2025] [:error] [pid 35104:tid 35112] [client 4.194.51.10:17639] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT8fY6WpPfWnBdEuPp4p5QAAAMU"]
[Mon Dec 15 04:34:43.548187 2025] [:error] [pid 35104:tid 35116] [client 4.194.51.10:18397] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aT8fY6WpPfWnBdEuPp4p5gAAAMk"]
[Mon Dec 15 04:34:43.786939 2025] [:error] [pid 35104:tid 35122] [client 4.194.51.10:17611] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aT8fY6WpPfWnBdEuPp4p6AAAAM8"]
[Mon Dec 15 04:34:43.960568 2025] [:error] [pid 35104:tid 35109] [client 4.194.51.10:17530] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aT8fY6WpPfWnBdEuPp4p6QAAAMI"]
[Mon Dec 15 04:34:44.148692 2025] [:error] [pid 35019:tid 35042] [client 4.194.51.10:17966] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aT8fZK2LAdKSfjdLIKJufQAAABM"]
[Mon Dec 15 04:34:44.331425 2025] [:error] [pid 35020:tid 35052] [client 4.194.51.10:17961] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aT8fZCBMuWbtFfQIRIbSWQAAAEI"]
[Mon Dec 15 04:34:44.521093 2025] [:error] [pid 35020:tid 35065] [client 4.194.51.10:17653] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT8fZCBMuWbtFfQIRIbSWgAAAE8"]
[Mon Dec 15 04:34:44.705674 2025] [:error] [pid 35021:tid 35086] [client 4.194.51.10:17531] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT8fZC9sSwxVqtYnS1t6rAAAAIk"]
[Mon Dec 15 04:34:44.928298 2025] [:error] [pid 35019:tid 35043] [client 4.194.51.10:17929] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT8fZK2LAdKSfjdLIKJugAAAABQ"]
[Mon Dec 15 04:34:45.132421 2025] [:error] [pid 35104:tid 35118] [client 4.194.51.10:17731] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aT8fZaWpPfWnBdEuPp4p6wAAAMs"]
[Mon Dec 15 04:34:45.338522 2025] [:error] [pid 35019:tid 35046] [client 4.194.51.10:17971] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aT8fZa2LAdKSfjdLIKJugQAAABc"]
[Mon Dec 15 04:34:45.550859 2025] [:error] [pid 35021:tid 35096] [client 4.194.51.10:18379] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aT8fZS9sSwxVqtYnS1t6rgAAAJM"]
[Mon Dec 15 04:34:45.736773 2025] [:error] [pid 35021:tid 35082] [client 4.194.51.10:17939] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aT8fZS9sSwxVqtYnS1t6rwAAAIU"]
[Mon Dec 15 04:34:45.943653 2025] [:error] [pid 35020:tid 35060] [client 4.194.51.10:18413] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aT8fZSBMuWbtFfQIRIbSXgAAAEo"]
[Mon Dec 15 04:34:46.172812 2025] [:error] [pid 35104:tid 35120] [client 4.194.51.10:18388] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aT8fZqWpPfWnBdEuPp4p7gAAAM0"]
[Mon Dec 15 04:34:46.389428 2025] [:error] [pid 35104:tid 35124] [client 4.194.51.10:18372] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aT8fZqWpPfWnBdEuPp4p7wAAANE"]
[Mon Dec 15 04:34:46.573527 2025] [:error] [pid 35020:tid 35072] [client 4.194.51.10:17930] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aT8fZiBMuWbtFfQIRIbSYAAAAFY"]
[Mon Dec 15 04:34:46.747963 2025] [:error] [pid 35104:tid 35113] [client 4.194.51.10:18398] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aT8fZqWpPfWnBdEuPp4p8QAAAMY"]
[Mon Dec 15 04:34:46.943283 2025] [:error] [pid 35021:tid 35090] [client 4.194.51.10:17649] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aT8fZi9sSwxVqtYnS1t6sgAAAI0"]
[Mon Dec 15 04:34:47.146882 2025] [:error] [pid 35019:tid 35030] [client 4.194.51.10:18403] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aT8fZ62LAdKSfjdLIKJuhQAAAAc"]
[Mon Dec 15 04:34:47.375488 2025] [:error] [pid 35104:tid 35110] [client 4.194.51.10:18368] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aT8fZ6WpPfWnBdEuPp4p8gAAAMM"]
[Mon Dec 15 04:34:47.559047 2025] [:error] [pid 35019:tid 35033] [client 4.194.51.10:17949] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "aT8fZ62LAdKSfjdLIKJuhwAAAAo"]
[Mon Dec 15 04:34:47.735006 2025] [:error] [pid 35020:tid 35064] [client 4.194.51.10:18410] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8fZyBMuWbtFfQIRIbSYQAAAE4"]
[Mon Dec 15 04:34:47.911127 2025] [:error] [pid 35104:tid 35111] [client 4.194.51.10:17652] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8fZ6WpPfWnBdEuPp4p8wAAAMQ"]
[Mon Dec 15 04:34:48.143953 2025] [:error] [pid 35019:tid 35039] [client 4.194.51.10:18402] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8faK2LAdKSfjdLIKJuiAAAABA"]
[Mon Dec 15 04:34:48.360231 2025] [:error] [pid 35104:tid 35107] [client 4.194.51.10:17644] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aT8faKWpPfWnBdEuPp4p9AAAAMA"]
[Mon Dec 15 04:34:48.642955 2025] [:error] [pid 35021:tid 35085] [client 4.194.51.10:17477] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aT8faC9sSwxVqtYnS1t6tgAAAIg"]
[Mon Dec 15 04:34:48.973380 2025] [:error] [pid 35021:tid 35079] [client 4.194.51.10:17958] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aT8faC9sSwxVqtYnS1t6twAAAII"]
[Mon Dec 15 04:34:49.236918 2025] [:error] [pid 35019:tid 35036] [client 4.194.51.10:17742] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aT8faa2LAdKSfjdLIKJuiQAAAA0"]
[Mon Dec 15 04:34:49.475021 2025] [:error] [pid 35104:tid 35112] [client 4.194.51.10:17932] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aT8faaWpPfWnBdEuPp4p9QAAAMU"]
[Mon Dec 15 04:34:49.652686 2025] [:error] [pid 35019:tid 35024] [client 4.194.51.10:17959] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aT8faa2LAdKSfjdLIKJuigAAAAE"]
[Mon Dec 15 04:34:49.941920 2025] [:error] [pid 35020:tid 35058] [client 4.194.51.10:17981] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aT8faSBMuWbtFfQIRIbSZAAAAEg"]
[Mon Dec 15 04:34:50.192849 2025] [:error] [pid 35104:tid 35116] [client 4.194.51.10:17973] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aT8faqWpPfWnBdEuPp4p9gAAAMk"]
[Mon Dec 15 04:34:50.417563 2025] [:error] [pid 35019:tid 35026] [client 4.194.51.10:17638] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "aT8faq2LAdKSfjdLIKJuiwAAAAM"]
[Mon Dec 15 04:34:50.638649 2025] [:error] [pid 35020:tid 35062] [client 4.194.51.10:18422] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aT8faiBMuWbtFfQIRIbSZwAAAEw"]
[Mon Dec 15 04:34:50.843129 2025] [:error] [pid 35104:tid 35109] [client 4.194.51.10:17943] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aT8faqWpPfWnBdEuPp4p-AAAAMI"]
[Mon Dec 15 04:34:51.024305 2025] [:error] [pid 35104:tid 35127] [client 4.194.51.10:17525] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aT8fa6WpPfWnBdEuPp4p-QAAANQ"]
[Mon Dec 15 04:34:51.226900 2025] [:error] [pid 35020:tid 35057] [client 4.194.51.10:17641] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ghreshttryu.php"] [unique_id "aT8fayBMuWbtFfQIRIbSaQAAAEc"]
[Mon Dec 15 04:34:51.492842 2025] [:error] [pid 35019:tid 35047] [client 4.194.51.10:17953] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT8fa62LAdKSfjdLIKJujAAAABg"]
[Mon Dec 15 04:34:51.710145 2025] [:error] [pid 35021:tid 35100] [client 4.194.51.10:18404] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT8fay9sSwxVqtYnS1t6ugAAAJc"]
[Mon Dec 15 04:34:51.932170 2025] [:error] [pid 35019:tid 35043] [client 4.194.51.10:17634] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT8fa62LAdKSfjdLIKJujQAAABQ"]
[Mon Dec 15 04:34:52.113405 2025] [:error] [pid 35019:tid 35046] [client 4.194.51.10:17736] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aT8fbK2LAdKSfjdLIKJujgAAABc"]
[Mon Dec 15 04:34:52.286673 2025] [:error] [pid 35019:tid 35044] [client 4.194.51.10:18393] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT8fbK2LAdKSfjdLIKJujwAAABU"]
[Mon Dec 15 04:34:52.499246 2025] [:error] [pid 35104:tid 35130] [client 4.194.51.10:18425] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT8fbKWpPfWnBdEuPp4p-gAAANc"]
[Mon Dec 15 04:34:52.706969 2025] [:error] [pid 35021:tid 35096] [client 4.194.51.10:17754] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT8fbC9sSwxVqtYnS1t6uwAAAJM"]
[Mon Dec 15 04:34:52.892700 2025] [:error] [pid 35019:tid 35025] [client 4.194.51.10:17766] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aT8fbK2LAdKSfjdLIKJukAAAAAI"]
[Mon Dec 15 04:34:53.069588 2025] [:error] [pid 35019:tid 35032] [client 4.194.51.10:18400] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aT8fba2LAdKSfjdLIKJukQAAAAk"]
[Mon Dec 15 04:34:53.244457 2025] [:error] [pid 35021:tid 35093] [client 4.194.51.10:17475] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aT8fbS9sSwxVqtYnS1t6vAAAAJA"]
[Mon Dec 15 04:34:53.499696 2025] [:error] [pid 35019:tid 35038] [client 4.194.51.10:17633] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aT8fba2LAdKSfjdLIKJukgAAAA8"]
[Mon Dec 15 04:34:53.695375 2025] [:error] [pid 35021:tid 35082] [client 4.194.51.10:17967] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aT8fbS9sSwxVqtYnS1t6vQAAAIU"]
[Mon Dec 15 04:34:53.985641 2025] [:error] [pid 35019:tid 35023] [client 4.194.51.10:17616] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aT8fba2LAdKSfjdLIKJukwAAAAA"]
[Mon Dec 15 04:34:54.204776 2025] [:error] [pid 35021:tid 35078] [client 4.194.51.10:17760] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aT8fbi9sSwxVqtYnS1t6vgAAAIE"]
[Mon Dec 15 04:34:54.421748 2025] [:error] [pid 35104:tid 35119] [client 4.194.51.10:17979] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aT8fbqWpPfWnBdEuPp4p_AAAAMw"]
[Mon Dec 15 04:34:54.761106 2025] [:error] [pid 35019:tid 35030] [client 4.194.51.10:17977] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aT8fbq2LAdKSfjdLIKJulQAAAAc"]
[Mon Dec 15 04:34:54.963768 2025] [:error] [pid 35019:tid 35033] [client 4.194.51.10:17982] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aT8fbq2LAdKSfjdLIKJulgAAAAo"]
[Mon Dec 15 04:34:55.184045 2025] [:error] [pid 35021:tid 35090] [client 4.194.51.10:17970] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aT8fby9sSwxVqtYnS1t6wAAAAI0"]
[Mon Dec 15 04:34:55.375114 2025] [:error] [pid 35021:tid 35097] [client 4.194.51.10:18321] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aT8fby9sSwxVqtYnS1t6wQAAAJQ"]
[Mon Dec 15 04:34:55.549053 2025] [:error] [pid 35104:tid 35110] [client 4.194.51.10:17748] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aT8fb6WpPfWnBdEuPp4p_wAAAMM"]
[Mon Dec 15 04:34:55.738696 2025] [:error] [pid 35104:tid 35125] [client 4.194.51.10:18346] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aT8fb6WpPfWnBdEuPp4qAAAAANI"]
[Mon Dec 15 04:34:55.983407 2025] [:error] [pid 35104:tid 35111] [client 4.194.51.10:17734] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aT8fb6WpPfWnBdEuPp4qAgAAAMQ"]
[Mon Dec 15 04:34:56.187454 2025] [:error] [pid 35019:tid 35040] [client 4.194.51.10:18401] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aT8fcK2LAdKSfjdLIKJumAAAABE"]
[Mon Dec 15 04:34:56.375977 2025] [:error] [pid 35104:tid 35128] [client 4.194.51.10:17942] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aT8fcKWpPfWnBdEuPp4qAwAAANU"]
[Mon Dec 15 04:34:56.559231 2025] [:error] [pid 35104:tid 35107] [client 4.194.51.10:18374] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aT8fcKWpPfWnBdEuPp4qBAAAAMA"]
[Mon Dec 15 04:34:56.737273 2025] [:error] [pid 35104:tid 35115] [client 4.194.51.10:18431] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aT8fcKWpPfWnBdEuPp4qBQAAAMg"]
[Mon Dec 15 04:34:56.970401 2025] [:error] [pid 35104:tid 35123] [client 4.194.51.10:17972] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aT8fcKWpPfWnBdEuPp4qBgAAANA"]
[Mon Dec 15 04:34:57.188530 2025] [:error] [pid 35104:tid 35109] [client 4.194.51.10:18381] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/system_log.php"] [unique_id "aT8fcaWpPfWnBdEuPp4qCAAAAMI"]
[Mon Dec 15 04:34:57.401375 2025] [:error] [pid 35104:tid 35130] [client 4.194.51.10:17745] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT8fcaWpPfWnBdEuPp4qCQAAANc"]
[Mon Dec 15 04:34:57.605303 2025] [:error] [pid 35019:tid 35039] [client 4.194.51.10:17512] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT8fca2LAdKSfjdLIKJumgAAABA"]
[Mon Dec 15 04:34:57.820036 2025] [:error] [pid 35021:tid 35091] [client 4.194.51.10:17744] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT8fcS9sSwxVqtYnS1t6wwAAAI4"]
[Mon Dec 15 04:34:58.028545 2025] [:error] [pid 35020:tid 35070] [client 4.194.51.10:18310] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aT8fciBMuWbtFfQIRIbSggAAAFQ"]
[Mon Dec 15 04:34:58.249561 2025] [:error] [pid 35104:tid 35114] [client 4.194.51.10:17656] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT8fcqWpPfWnBdEuPp4qCwAAAMc"]
[Mon Dec 15 04:34:58.484799 2025] [:error] [pid 35104:tid 35122] [client 4.194.51.10:18412] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT8fcqWpPfWnBdEuPp4qDQAAAM8"]
[Mon Dec 15 04:34:58.778590 2025] [:error] [pid 35020:tid 35067] [client 4.194.51.10:17934] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT8fciBMuWbtFfQIRIbShAAAAFE"]
[Mon Dec 15 04:34:59.079905 2025] [:error] [pid 35104:tid 35119] [client 4.194.51.10:17729] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aT8fc6WpPfWnBdEuPp4qDwAAAMw"]
[Mon Dec 15 04:34:59.291480 2025] [:error] [pid 35020:tid 35059] [client 4.194.51.10:18429] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aT8fcyBMuWbtFfQIRIbShQAAAEk"]
[Mon Dec 15 04:34:59.539841 2025] [:error] [pid 35104:tid 35125] [client 4.194.51.10:17976] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aT8fc6WpPfWnBdEuPp4qEAAAANI"]
[Mon Dec 15 04:34:59.758290 2025] [:error] [pid 35020:tid 35068] [client 4.194.51.10:18376] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aT8fcyBMuWbtFfQIRIbShgAAAFI"]
[Mon Dec 15 04:34:59.954786 2025] [:error] [pid 35021:tid 35101] [client 4.194.51.10:17501] [client 4.194.51.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aT8fcy9sSwxVqtYnS1t6xAAAAJg"]
[Mon Dec 15 20:49:05.012639 2025] [:error] [pid 31459:tid 31479] [client 117.242.149.43:50258] [client 117.242.149.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.242.149.43, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUADwTqerS0TDpViRztr2wAAABI"]
[Mon Dec 15 20:49:05.018365 2025] [:error] [pid 31459:tid 31479] [client 117.242.149.43:50258] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Dec 15 23:45:29.381132 2025] [:error] [pid 31459:tid 31485] [client 104.236.109.223:52378] [client 104.236.109.223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUAtGTqerS0TDpViRzvFqgAAABg"]
[Tue Dec 16 04:11:47.895624 2025] [:error] [pid 65267:tid 65322] [client 45.154.138.46:53609] [client 45.154.138.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/templates/atomic/"] [unique_id "aUBrg2rHTzAzdGldlZPtQAAAAFg"]
[Tue Dec 16 19:23:18.718734 2025] [:error] [pid 51991:tid 52010] [client 117.217.51.209:60626] [client 117.217.51.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.217.51.209, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUFBJq7zKCVJSuwV1xalYAAAARE"]
[Tue Dec 16 19:23:18.723944 2025] [:error] [pid 51991:tid 52010] [client 117.217.51.209:60626] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 16 19:35:45.075966 2025] [:error] [pid 18322:tid 18337] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/berlin.php
[Tue Dec 16 19:35:45.198241 2025] [:error] [pid 18322:tid 18334] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Tue Dec 16 19:35:45.325822 2025] [:error] [pid 18322:tid 18340] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/xz89.php
[Tue Dec 16 19:35:45.451379 2025] [:error] [pid 18322:tid 18343] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/lopst.php
[Tue Dec 16 19:35:45.586657 2025] [:error] [pid 18322:tid 18326] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Tue Dec 16 19:35:45.846627 2025] [:error] [pid 18322:tid 18332] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/vbbn.php
[Tue Dec 16 19:35:45.969433 2025] [:error] [pid 18322:tid 18345] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Tue Dec 16 19:35:46.236075 2025] [:error] [pid 18322:tid 18330] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/fz.php
[Tue Dec 16 19:35:46.386380 2025] [:error] [pid 18322:tid 18344] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/sang.php
[Tue Dec 16 19:35:46.587348 2025] [:error] [pid 18322:tid 18346] [client 4.190.217.18:19212] File does not exist: /usr/local/apache/htdocs/suspended-page/0o0.php
[Tue Dec 16 19:35:46.714302 2025] [:error] [pid 18322:tid 18347] [client 4.190.217.18:19212] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUFEEpsCeWBjrw28XtwHqwAAABU"]
[Tue Dec 16 19:35:47.061852 2025] [:error] [pid 53940:tid 53953] [client 4.190.217.18:1952] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUFEE191PNbcXLVkpR7tygAAAco"]
[Tue Dec 16 19:35:47.405574 2025] [:error] [pid 18408:tid 18414] [client 4.190.217.18:18856] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUFEEzi2Gr8pDzjrVBAZFAAAAMQ"]
[Tue Dec 16 19:35:47.882463 2025] [:error] [pid 18322:tid 18331] [client 4.190.217.18:1920] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUFEE5sCeWBjrw28XtwHrAAAAAU"]
[Tue Dec 16 19:35:48.536501 2025] [:error] [pid 18408:tid 18434] [client 4.190.217.18:18854] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aUFEFDi2Gr8pDzjrVBAZFQAAANg"]
[Tue Dec 16 19:35:48.983368 2025] [:error] [pid 18322:tid 18348] [client 4.190.217.18:18879] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aUFEFJsCeWBjrw28XtwHrQAAABY"]
[Tue Dec 16 19:35:49.295944 2025] [:error] [pid 51991:tid 52011] [client 4.190.217.18:30044] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aUFEFa7zKCVJSuwV1xao7AAAARI"]
[Tue Dec 16 19:35:49.650881 2025] [:error] [pid 18323:tid 18373] [client 4.190.217.18:19255] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aUFEFTJB6UFxIutsA8YsKQAAAFQ"]
[Tue Dec 16 19:35:50.090509 2025] [:error] [pid 18324:tid 18398] [client 4.190.217.18:18685] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUFEFqG4um2mD1VpJHKb7QAAAJI"]
[Tue Dec 16 19:35:51.119632 2025] [:error] [pid 18323:tid 18359] [client 4.190.217.18:18670] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUFEFzJB6UFxIutsA8YsKgAAAEY"]
[Tue Dec 16 19:35:51.600483 2025] [:error] [pid 53940:tid 53964] [client 4.190.217.18:23734] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUFEF191PNbcXLVkpR7tzAAAAdU"]
[Tue Dec 16 19:35:52.015495 2025] [:error] [pid 18322:tid 18338] [client 4.190.217.18:21535] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUFEGJsCeWBjrw28XtwHsgAAAAw"]
[Tue Dec 16 19:35:52.576694 2025] [:error] [pid 18324:tid 18381] [client 4.190.217.18:23719] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aUFEGKG4um2mD1VpJHKb8QAAAIE"]
[Tue Dec 16 19:35:52.961142 2025] [:error] [pid 18324:tid 18393] [client 4.190.217.18:26631] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aUFEGKG4um2mD1VpJHKb8gAAAI0"]
[Tue Dec 16 19:35:53.278499 2025] [:error] [pid 18324:tid 18402] [client 4.190.217.18:23725] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aUFEGaG4um2mD1VpJHKb8wAAAJY"]
[Tue Dec 16 19:35:53.634759 2025] [:error] [pid 35998:tid 36005] [client 4.190.217.18:21510] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aUFEGRKnhGuuhGxBSLOvkgAAAUQ"]
[Tue Dec 16 19:35:54.091451 2025] [:error] [pid 18322:tid 18342] [client 4.190.217.18:18764] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aUFEGpsCeWBjrw28XtwHtQAAABA"]
[Tue Dec 16 19:35:54.551769 2025] [:error] [pid 51991:tid 52014] [client 4.190.217.18:18807] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aUFEGq7zKCVJSuwV1xao8AAAARU"]
[Tue Dec 16 19:35:55.098589 2025] [:error] [pid 18408:tid 18418] [client 4.190.217.18:18799] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aUFEGzi2Gr8pDzjrVBAZFwAAAMg"]
[Tue Dec 16 19:35:56.031540 2025] [:error] [pid 18323:tid 18357] [client 4.190.217.18:18763] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aUFEHDJB6UFxIutsA8YsLwAAAEQ"]
[Tue Dec 16 19:35:56.525976 2025] [:error] [pid 53940:tid 53961] [client 4.190.217.18:26681] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEHF91PNbcXLVkpR7t0gAAAdI"]
[Tue Dec 16 19:35:56.945869 2025] [:error] [pid 53940:tid 53945] [client 4.190.217.18:20292] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEHF91PNbcXLVkpR7t0wAAAcI"]
[Tue Dec 16 19:35:57.531779 2025] [:error] [pid 12330:tid 12340] [client 4.190.217.18:18633] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEHV6iIQEVCIh8V1l9HgAAAYY"]
[Tue Dec 16 19:35:58.108100 2025] [:error] [pid 51991:tid 52009] [client 4.190.217.18:23703] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEHq7zKCVJSuwV1xao8gAAARA"]
[Tue Dec 16 19:35:58.765076 2025] [:error] [pid 12330:tid 12336] [client 4.190.217.18:23690] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aUFEHl6iIQEVCIh8V1l9IAAAAYI"]
[Tue Dec 16 19:35:59.228563 2025] [:error] [pid 35998:tid 36023] [client 4.190.217.18:21530] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aUFEHxKnhGuuhGxBSLOvlQAAAVY"]
[Tue Dec 16 19:35:59.619623 2025] [:error] [pid 53940:tid 53966] [client 4.190.217.18:20344] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aUFEH191PNbcXLVkpR7t2AAAAdc"]
[Tue Dec 16 19:36:00.121121 2025] [:error] [pid 35998:tid 36019] [client 4.190.217.18:1601] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aUFEIBKnhGuuhGxBSLOvlgAAAVI"]
[Tue Dec 16 19:36:00.618352 2025] [:error] [pid 18408:tid 18412] [client 4.190.217.18:30057] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUFEIDi2Gr8pDzjrVBAZGwAAAMI"]
[Tue Dec 16 19:36:01.137224 2025] [:error] [pid 18408:tid 18432] [client 4.190.217.18:1048] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUFEITi2Gr8pDzjrVBAZHQAAANY"]
[Tue Dec 16 19:36:01.679627 2025] [:error] [pid 18408:tid 18416] [client 4.190.217.18:20817] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUFEITi2Gr8pDzjrVBAZHgAAAMY"]
[Tue Dec 16 19:36:02.142983 2025] [:error] [pid 18322:tid 18329] [client 4.190.217.18:47991] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUFEIpsCeWBjrw28XtwHuAAAAAM"]
[Tue Dec 16 19:36:02.608368 2025] [:error] [pid 35998:tid 36007] [client 4.190.217.18:47945] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aUFEIhKnhGuuhGxBSLOvlwAAAUY"]
[Tue Dec 16 19:36:03.152748 2025] [:error] [pid 53940:tid 53963] [client 4.190.217.18:20331] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aUFEI191PNbcXLVkpR7t3QAAAdQ"]
[Tue Dec 16 19:36:03.460411 2025] [:error] [pid 18323:tid 18374] [client 4.190.217.18:23230] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aUFEIzJB6UFxIutsA8YsNwAAAFU"]
[Tue Dec 16 19:36:03.877263 2025] [:error] [pid 18324:tid 18382] [client 4.190.217.18:41618] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aUFEI6G4um2mD1VpJHKb-wAAAII"]
[Tue Dec 16 19:36:04.580993 2025] [:error] [pid 53940:tid 53966] [client 4.190.217.18:20806] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUFEJF91PNbcXLVkpR7t4QAAAdc"]
[Tue Dec 16 19:36:05.627409 2025] [:error] [pid 18322:tid 18326] [client 4.190.217.18:23281] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUFEJZsCeWBjrw28XtwHuwAAAAA"]
[Tue Dec 16 19:36:06.232407 2025] [:error] [pid 18322:tid 18333] [client 4.190.217.18:20837] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUFEJpsCeWBjrw28XtwHvQAAAAc"]
[Tue Dec 16 19:36:06.682590 2025] [:error] [pid 12330:tid 12350] [client 4.190.217.18:20297] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUFEJl6iIQEVCIh8V1l9JwAAAZA"]
[Tue Dec 16 19:36:07.526425 2025] [:error] [pid 12330:tid 12337] [client 4.190.217.18:18739] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUFEJ16iIQEVCIh8V1l9KgAAAYM"]
[Tue Dec 16 19:36:08.179536 2025] [:error] [pid 35998:tid 36005] [client 4.190.217.18:18786] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUFEKBKnhGuuhGxBSLOvmwAAAUQ"]
[Tue Dec 16 19:36:08.692259 2025] [:error] [pid 53940:tid 53965] [client 4.190.217.18:20860] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUFEKF91PNbcXLVkpR7t5AAAAdY"]
[Tue Dec 16 19:36:09.243627 2025] [:error] [pid 53940:tid 53950] [client 4.190.217.18:47952] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUFEKV91PNbcXLVkpR7t5QAAAcc"]
[Tue Dec 16 19:36:09.622331 2025] [:error] [pid 18322:tid 18344] [client 4.190.217.18:42903] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUFEKZsCeWBjrw28XtwHwAAAABI"]
[Tue Dec 16 19:36:10.558303 2025] [:error] [pid 18322:tid 18348] [client 4.190.217.18:18729] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUFEKpsCeWBjrw28XtwHwgAAABY"]
[Tue Dec 16 19:36:11.032735 2025] [:error] [pid 18322:tid 18337] [client 4.190.217.18:27304] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUFEK5sCeWBjrw28XtwHwwAAAAs"]
[Tue Dec 16 19:36:11.369600 2025] [:error] [pid 18408:tid 18426] [client 4.190.217.18:18731] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUFEKzi2Gr8pDzjrVBAZJwAAANA"]
[Tue Dec 16 19:36:11.799379 2025] [:error] [pid 12330:tid 12351] [client 4.190.217.18:27281] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUFEK16iIQEVCIh8V1l9LAAAAZE"]
[Tue Dec 16 19:36:12.363598 2025] [:error] [pid 35998:tid 36004] [client 4.190.217.18:47998] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUFELBKnhGuuhGxBSLOvoAAAAUM"]
[Tue Dec 16 19:36:12.766856 2025] [:error] [pid 18324:tid 18399] [client 4.190.217.18:21273] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUFELKG4um2mD1VpJHKcCQAAAJM"]
[Tue Dec 16 19:36:13.703312 2025] [:error] [pid 18408:tid 18414] [client 4.190.217.18:1043] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUFELTi2Gr8pDzjrVBAZLAAAAMQ"]
[Tue Dec 16 19:36:14.212384 2025] [:error] [pid 18324:tid 18384] [client 4.190.217.18:42911] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUFELqG4um2mD1VpJHKcDQAAAIQ"]
[Tue Dec 16 19:36:14.643218 2025] [:error] [pid 35998:tid 36023] [client 4.190.217.18:1514] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUFELhKnhGuuhGxBSLOvoQAAAVY"]
[Tue Dec 16 19:36:15.504134 2025] [:error] [pid 51991:tid 52006] [client 4.190.217.18:42898] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUFEL67zKCVJSuwV1xao_AAAAQ0"]
[Tue Dec 16 19:36:15.951561 2025] [:error] [pid 18323:tid 18364] [client 4.190.217.18:21256] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUFELzJB6UFxIutsA8YsOwAAAEs"]
[Tue Dec 16 19:36:16.578437 2025] [:error] [pid 12330:tid 12338] [client 4.190.217.18:21264] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUFEMF6iIQEVCIh8V1l9LwAAAYQ"]
[Tue Dec 16 19:36:17.179520 2025] [:error] [pid 53940:tid 53950] [client 4.190.217.18:47974] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUFEMV91PNbcXLVkpR7t6wAAAcc"]
[Tue Dec 16 19:36:17.772024 2025] [:error] [pid 51991:tid 51994] [client 4.190.217.18:21295] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUFEMa7zKCVJSuwV1xao_QAAAQE"]
[Tue Dec 16 19:36:18.190782 2025] [:error] [pid 51991:tid 52013] [client 4.190.217.18:1528] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUFEMq7zKCVJSuwV1xao_wAAARQ"]
[Tue Dec 16 19:36:18.728924 2025] [:error] [pid 18323:tid 18357] [client 4.190.217.18:18448] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUFEMjJB6UFxIutsA8YsQQAAAEQ"]
[Tue Dec 16 19:36:19.311483 2025] [:error] [pid 18408:tid 18412] [client 4.190.217.18:27908] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUFEMzi2Gr8pDzjrVBAZLwAAAMI"]
[Tue Dec 16 19:36:19.898522 2025] [:error] [pid 18408:tid 18416] [client 4.190.217.18:18929] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUFEMzi2Gr8pDzjrVBAZMQAAAMY"]
[Tue Dec 16 19:36:20.442417 2025] [:error] [pid 53940:tid 53954] [client 4.190.217.18:17529] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUFENF91PNbcXLVkpR7t7AAAAcs"]
[Tue Dec 16 19:36:20.833618 2025] [:error] [pid 18324:tid 18381] [client 4.190.217.18:18495] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUFENKG4um2mD1VpJHKcEQAAAIE"]
[Tue Dec 16 19:36:21.416318 2025] [:error] [pid 53940:tid 53955] [client 4.190.217.18:41641] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUFENV91PNbcXLVkpR7t7QAAAcw"]
[Tue Dec 16 19:36:21.928617 2025] [:error] [pid 18324:tid 18399] [client 4.190.217.18:1493] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUFENaG4um2mD1VpJHKcEgAAAJM"]
[Tue Dec 16 19:36:22.900809 2025] [:error] [pid 53940:tid 53958] [client 4.190.217.18:48683] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUFENl91PNbcXLVkpR7t7wAAAc8"]
[Tue Dec 16 19:36:23.382979 2025] [:error] [pid 12330:tid 12334] [client 4.190.217.18:1519] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUFEN16iIQEVCIh8V1l9NQAAAYA"]
[Tue Dec 16 19:36:23.942231 2025] [:error] [pid 53940:tid 53956] [client 4.190.217.18:17587] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUFEN191PNbcXLVkpR7t8AAAAc0"]
[Tue Dec 16 19:36:24.351648 2025] [:error] [pid 18324:tid 18387] [client 4.190.217.18:17497] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUFEOKG4um2mD1VpJHKcEwAAAIc"]
[Tue Dec 16 19:36:24.740593 2025] [:error] [pid 18324:tid 18389] [client 4.190.217.18:17545] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUFEOKG4um2mD1VpJHKcFAAAAIk"]
[Tue Dec 16 19:36:25.575728 2025] [:error] [pid 53940:tid 53957] [client 4.190.217.18:27917] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUFEOV91PNbcXLVkpR7t8QAAAc4"]
[Tue Dec 16 19:36:25.961065 2025] [:error] [pid 51991:tid 52014] [client 4.190.217.18:27931] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUFEOa7zKCVJSuwV1xapBwAAARU"]
[Tue Dec 16 19:36:26.491691 2025] [:error] [pid 51991:tid 52013] [client 4.190.217.18:2043] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUFEOq7zKCVJSuwV1xapCQAAARQ"]
[Tue Dec 16 19:36:26.871362 2025] [:error] [pid 12330:tid 12351] [client 4.190.217.18:27928] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUFEOl6iIQEVCIh8V1l9OAAAAZE"]
[Tue Dec 16 19:36:27.303367 2025] [:error] [pid 53940:tid 53944] [client 4.190.217.18:17624] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUFEO191PNbcXLVkpR7t9wAAAcE"]
[Tue Dec 16 19:36:27.739884 2025] [:error] [pid 53940:tid 53950] [client 4.190.217.18:27961] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUFEO191PNbcXLVkpR7t-QAAAcc"]
[Tue Dec 16 19:36:28.159203 2025] [:error] [pid 12330:tid 12349] [client 4.190.217.18:24265] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUFEPF6iIQEVCIh8V1l9OgAAAY8"]
[Tue Dec 16 19:36:28.597917 2025] [:error] [pid 18324:tid 18382] [client 4.190.217.18:27947] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUFEPKG4um2mD1VpJHKcGAAAAII"]
[Tue Dec 16 19:36:29.035990 2025] [:error] [pid 12330:tid 12350] [client 4.190.217.18:24735] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUFEPV6iIQEVCIh8V1l9OwAAAZA"]
[Tue Dec 16 19:36:29.410420 2025] [:error] [pid 12330:tid 12340] [client 4.190.217.18:19015] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUFEPV6iIQEVCIh8V1l9PAAAAYY"]
[Tue Dec 16 19:36:29.756157 2025] [:error] [pid 18408:tid 18422] [client 4.190.217.18:18436] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUFEPTi2Gr8pDzjrVBAZNwAAAMw"]
[Tue Dec 16 19:36:30.416102 2025] [:error] [pid 51991:tid 52011] [client 4.190.217.18:24256] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUFEPq7zKCVJSuwV1xapDQAAARI"]
[Tue Dec 16 19:36:31.003805 2025] [:error] [pid 12330:tid 12346] [client 4.190.217.18:48667] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUFEP16iIQEVCIh8V1l9QQAAAYw"]
[Tue Dec 16 19:36:31.375359 2025] [:error] [pid 18324:tid 18402] [client 4.190.217.18:19059] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUFEP6G4um2mD1VpJHKcGQAAAJY"]
[Tue Dec 16 19:36:31.899276 2025] [:error] [pid 51991:tid 52006] [client 4.190.217.18:17579] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUFEP67zKCVJSuwV1xapEgAAAQ0"]
[Tue Dec 16 19:36:32.471210 2025] [:error] [pid 51991:tid 52004] [client 4.190.217.18:17569] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUFEQK7zKCVJSuwV1xapIAAAAQs"]
[Tue Dec 16 19:36:33.556170 2025] [:error] [pid 18408:tid 18425] [client 4.190.217.18:24713] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUFEQTi2Gr8pDzjrVBAZQAAAAM8"]
[Tue Dec 16 19:36:33.977830 2025] [:error] [pid 35998:tid 36023] [client 4.190.217.18:53586] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUFEQRKnhGuuhGxBSLOv5AAAAVY"]
[Tue Dec 16 19:36:34.471428 2025] [:error] [pid 18408:tid 18417] [client 4.190.217.18:26013] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUFEQji2Gr8pDzjrVBAZRgAAAMc"]
[Tue Dec 16 19:36:34.748302 2025] [:error] [pid 18408:tid 18418] [client 4.190.217.18:18157] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUFEQji2Gr8pDzjrVBAZSAAAAMg"]
[Tue Dec 16 19:36:35.585478 2025] [:error] [pid 35998:tid 36017] [client 4.190.217.18:18174] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUFEQxKnhGuuhGxBSLOv5gAAAVA"]
[Tue Dec 16 19:36:35.855593 2025] [:error] [pid 35998:tid 36019] [client 4.190.217.18:53595] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUFEQxKnhGuuhGxBSLOv5wAAAVI"]
[Tue Dec 16 19:36:36.497781 2025] [:error] [pid 12330:tid 12344] [client 4.190.217.18:17615] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUFERF6iIQEVCIh8V1l9VwAAAYo"]
[Tue Dec 16 19:36:36.888513 2025] [:error] [pid 53940:tid 53947] [client 4.190.217.18:17638] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUFERF91PNbcXLVkpR7t_wAAAcQ"]
[Tue Dec 16 19:36:37.505499 2025] [:error] [pid 51991:tid 52003] [client 4.190.217.18:21108] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUFERa7zKCVJSuwV1xapWgAAAQo"]
[Tue Dec 16 19:36:38.063991 2025] [:error] [pid 53940:tid 53949] [client 4.190.217.18:24723] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUFERl91PNbcXLVkpR7uAAAAAcY"]
[Tue Dec 16 19:36:38.468314 2025] [:error] [pid 35998:tid 36021] [client 4.190.217.18:19265] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUFERhKnhGuuhGxBSLOv6gAAAVQ"]
[Tue Dec 16 19:36:39.049983 2025] [:error] [pid 53940:tid 53948] [client 4.190.217.18:18148] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUFER191PNbcXLVkpR7uAQAAAcU"]
[Tue Dec 16 19:36:39.477297 2025] [:error] [pid 18408:tid 18431] [client 4.190.217.18:2004] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUFERzi2Gr8pDzjrVBAZTQAAANU"]
[Tue Dec 16 19:36:40.363106 2025] [:error] [pid 51991:tid 52003] [client 4.190.217.18:24813] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUFESK7zKCVJSuwV1xapYAAAAQo"]
[Tue Dec 16 19:36:40.913067 2025] [:error] [pid 18408:tid 18433] [client 4.190.217.18:53573] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUFESDi2Gr8pDzjrVBAZUAAAANc"]
[Tue Dec 16 19:36:41.443655 2025] [:error] [pid 35998:tid 36020] [client 4.190.217.18:65392] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUFESRKnhGuuhGxBSLOv7QAAAVM"]
[Tue Dec 16 19:36:41.807504 2025] [:error] [pid 35998:tid 36014] [client 4.190.217.18:25993] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aUFESRKnhGuuhGxBSLOv7gAAAU0"]
[Tue Dec 16 19:36:42.352982 2025] [:error] [pid 35998:tid 36025] [client 4.190.217.18:19021] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aUFEShKnhGuuhGxBSLOv7wAAAVg"]
[Tue Dec 16 19:36:43.127596 2025] [:error] [pid 12330:tid 12346] [client 4.190.217.18:26038] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aUFES16iIQEVCIh8V1l9XAAAAYw"]
[Tue Dec 16 19:36:44.108727 2025] [:error] [pid 18324:tid 18389] [client 4.190.217.18:20080] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aUFETKG4um2mD1VpJHKcIAAAAIk"]
[Tue Dec 16 19:36:44.887743 2025] [:error] [pid 18408:tid 18430] [client 4.190.217.18:17463] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUFETDi2Gr8pDzjrVBAZVQAAANQ"]
[Tue Dec 16 19:36:45.832070 2025] [:error] [pid 53940:tid 53951] [client 4.190.217.18:21068] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUFETV91PNbcXLVkpR7uBAAAAcg"]
[Tue Dec 16 19:36:46.836394 2025] [:error] [pid 18408:tid 18431] [client 4.190.217.18:17443] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Dec 16 19:36:46.962055 2025] [:error] [pid 18408:tid 18424] [client 4.190.217.18:17443] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Dec 16 19:36:47.085860 2025] [:error] [pid 18408:tid 18415] [client 4.190.217.18:17443] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Dec 16 19:36:47.206616 2025] [:error] [pid 18408:tid 18413] [client 4.190.217.18:17443] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUFETzi2Gr8pDzjrVBAZWgAAAMM"]
[Tue Dec 16 19:36:48.070457 2025] [:error] [pid 35998:tid 36023] [client 4.190.217.18:17427] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Dec 16 19:36:48.195707 2025] [:error] [pid 35998:tid 36006] [client 4.190.217.18:17427] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Dec 16 19:36:48.318957 2025] [:error] [pid 35998:tid 36019] [client 4.190.217.18:17427] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Dec 16 19:36:48.646141 2025] [:error] [pid 35998:tid 36001] [client 4.190.217.18:17427] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Dec 16 19:36:48.794023 2025] [:error] [pid 35998:tid 36010] [client 4.190.217.18:17427] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Dec 16 19:36:48.970001 2025] [:error] [pid 35998:tid 36008] [client 4.190.217.18:17427] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Dec 16 19:36:49.100644 2025] [:error] [pid 35998:tid 36018] [client 4.190.217.18:17427] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Dec 16 19:36:49.427530 2025] [:error] [pid 35998:tid 36021] [client 4.190.217.18:17427] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEURKnhGuuhGxBSLOv-QAAAVQ"]
[Tue Dec 16 19:36:49.897953 2025] [:error] [pid 53940:tid 53950] [client 4.190.217.18:26023] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEUV91PNbcXLVkpR7uBgAAAcc"]
[Tue Dec 16 19:36:50.263546 2025] [:error] [pid 18408:tid 18434] [client 4.190.217.18:21099] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEUji2Gr8pDzjrVBAZYAAAANg"]
[Tue Dec 16 19:36:50.591403 2025] [:error] [pid 18408:tid 18419] [client 4.190.217.18:17426] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUFEUji2Gr8pDzjrVBAZYQAAAMk"]
[Tue Dec 16 19:36:51.092918 2025] [:error] [pid 12330:tid 12342] [client 4.190.217.18:20090] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUFEU16iIQEVCIh8V1l9XgAAAYg"]
[Tue Dec 16 19:36:51.874365 2025] [:error] [pid 18323:tid 18374] [client 4.190.217.18:18141] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUFEUzJB6UFxIutsA8YsVQAAAFU"]
[Tue Dec 16 19:36:52.574344 2025] [:error] [pid 18408:tid 18422] [client 4.190.217.18:17425] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUFEVDi2Gr8pDzjrVBAZZQAAAMw"]
[Tue Dec 16 19:36:53.134337 2025] [:error] [pid 18408:tid 18424] [client 4.190.217.18:27928] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUFEVTi2Gr8pDzjrVBAZZwAAAM4"]
[Tue Dec 16 19:36:53.626394 2025] [:error] [pid 18323:tid 18370] [client 4.190.217.18:19318] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUFEVTJB6UFxIutsA8YsVwAAAFE"]
[Tue Dec 16 19:36:54.570205 2025] [:error] [pid 51991:tid 52004] [client 4.190.217.18:19316] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUFEVq7zKCVJSuwV1xapbwAAAQs"]
[Tue Dec 16 19:36:55.292373 2025] [:error] [pid 18408:tid 18419] [client 4.190.217.18:1152] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUFEVzi2Gr8pDzjrVBAZbQAAAMk"]
[Tue Dec 16 19:36:55.938722 2025] [:error] [pid 51991:tid 52009] [client 4.190.217.18:17454] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUFEV67zKCVJSuwV1xapcAAAARA"]
[Tue Dec 16 19:36:56.590247 2025] [:error] [pid 18408:tid 18431] [client 4.190.217.18:1214] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUFEWDi2Gr8pDzjrVBAZbwAAANU"]
[Tue Dec 16 19:36:57.027754 2025] [:error] [pid 18324:tid 18400] [client 4.190.217.18:20081] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUFEWaG4um2mD1VpJHKcKwAAAJQ"]
[Tue Dec 16 19:36:57.635743 2025] [:error] [pid 18323:tid 18362] [client 4.190.217.18:26018] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUFEWTJB6UFxIutsA8YsWAAAAEk"]
[Tue Dec 16 19:36:58.171172 2025] [:error] [pid 18324:tid 18402] [client 4.190.217.18:24783] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUFEWqG4um2mD1VpJHKcLAAAAJY"]
[Tue Dec 16 19:36:59.195512 2025] [:error] [pid 18323:tid 18373] [client 4.190.217.18:21115] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUFEWzJB6UFxIutsA8YsWQAAAFQ"]
[Tue Dec 16 19:36:59.771007 2025] [:error] [pid 18323:tid 18357] [client 4.190.217.18:1155] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUFEWzJB6UFxIutsA8YsWwAAAEQ"]
[Tue Dec 16 19:37:00.187176 2025] [:error] [pid 18322:tid 18330] [client 4.190.217.18:65346] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUFEXJsCeWBjrw28XtwH4QAAAAQ"]
[Tue Dec 16 19:37:00.735213 2025] [:error] [pid 18323:tid 18363] [client 4.190.217.18:19404] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUFEXDJB6UFxIutsA8YsXgAAAEo"]
[Tue Dec 16 19:37:01.347085 2025] [:error] [pid 18323:tid 18354] [client 4.190.217.18:24247] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUFEXTJB6UFxIutsA8YsXwAAAEE"]
[Tue Dec 16 19:37:01.853988 2025] [:error] [pid 18408:tid 18415] [client 4.190.217.18:1456] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUFEXTi2Gr8pDzjrVBAZdgAAAMU"]
[Tue Dec 16 19:37:02.757483 2025] [:error] [pid 18323:tid 18374] [client 4.190.217.18:65360] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUFEXjJB6UFxIutsA8YsZgAAAFU"]
[Tue Dec 16 19:37:03.931873 2025] [:error] [pid 35998:tid 36005] [client 4.190.217.18:20039] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUFEXxKnhGuuhGxBSLOwAAAAAUQ"]
[Tue Dec 16 19:37:04.593966 2025] [:error] [pid 18408:tid 18416] [client 4.190.217.18:65402] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aUFEYDi2Gr8pDzjrVBAZfAAAAMY"]
[Tue Dec 16 19:37:05.367037 2025] [:error] [pid 18408:tid 18429] [client 4.190.217.18:24814] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aUFEYTi2Gr8pDzjrVBAZfwAAANM"]
[Tue Dec 16 19:37:06.130987 2025] [:error] [pid 18408:tid 18434] [client 4.190.217.18:24792] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aUFEYji2Gr8pDzjrVBAZgQAAANg"]
[Tue Dec 16 19:37:06.838159 2025] [:error] [pid 18408:tid 18424] [client 4.190.217.18:1196] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "aUFEYji2Gr8pDzjrVBAZhgAAAM4"]
[Tue Dec 16 19:37:07.645831 2025] [:error] [pid 53940:tid 53952] [client 4.190.217.18:1444] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUFEY191PNbcXLVkpR7uCgAAAck"]
[Tue Dec 16 19:37:08.755983 2025] [:error] [pid 18408:tid 18412] [client 4.190.217.18:1205] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUFEZDi2Gr8pDzjrVBAZiQAAAMI"]
[Tue Dec 16 19:37:09.501796 2025] [:error] [pid 51991:tid 52013] [client 4.190.217.18:1165] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUFEZa7zKCVJSuwV1xapdAAAARQ"]
[Tue Dec 16 19:37:10.137329 2025] [:error] [pid 18408:tid 18434] [client 4.190.217.18:1180] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUFEZji2Gr8pDzjrVBAZjAAAANg"]
[Tue Dec 16 19:37:11.263283 2025] [:error] [pid 18408:tid 18423] [client 4.190.217.18:24246] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUFEZzi2Gr8pDzjrVBAZjgAAAM0"]
[Tue Dec 16 19:37:12.421428 2025] [:error] [pid 51991:tid 52000] [client 4.190.217.18:20080] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUFEaK7zKCVJSuwV1xapeQAAAQc"]
[Tue Dec 16 19:37:13.821115 2025] [:error] [pid 51991:tid 52005] [client 4.190.217.18:23807] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUFEaa7zKCVJSuwV1xapiQAAAQw"]
[Tue Dec 16 19:37:15.360733 2025] [:error] [pid 53940:tid 53966] [client 4.190.217.18:18104] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUFEa191PNbcXLVkpR7uDAAAAdc"]
[Tue Dec 16 19:37:16.057304 2025] [:error] [pid 18323:tid 18353] [client 4.190.217.18:1806] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUFEbDJB6UFxIutsA8YseAAAAEA"]
[Tue Dec 16 19:37:16.524623 2025] [:error] [pid 12330:tid 12343] [client 4.190.217.18:18255] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUFEbF6iIQEVCIh8V1l9eAAAAYk"]
[Tue Dec 16 19:37:17.740838 2025] [:error] [pid 18323:tid 18356] [client 4.190.217.18:18273] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUFEbTJB6UFxIutsA8YsegAAAEM"]
[Tue Dec 16 19:37:18.324778 2025] [:error] [pid 12330:tid 12351] [client 4.190.217.18:17780] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUFEbl6iIQEVCIh8V1l9gAAAAZE"]
[Tue Dec 16 19:37:19.852327 2025] [:error] [pid 35998:tid 36017] [client 4.190.217.18:17726] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUFEbxKnhGuuhGxBSLOwCwAAAVA"]
[Tue Dec 16 19:37:20.459533 2025] [:error] [pid 12330:tid 12357] [client 4.190.217.18:1309] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUFEcF6iIQEVCIh8V1l9gwAAAZc"]
[Tue Dec 16 19:37:21.764294 2025] [:error] [pid 18322:tid 18346] [client 4.190.217.18:19382] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUFEcZsCeWBjrw28XtwH7QAAABQ"]
[Tue Dec 16 19:37:22.620817 2025] [:error] [pid 51991:tid 52005] [client 4.190.217.18:34284] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUFEcq7zKCVJSuwV1xapswAAAQw"]
[Tue Dec 16 19:37:23.111584 2025] [:error] [pid 35998:tid 36020] [client 4.190.217.18:32653] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUFEcxKnhGuuhGxBSLOwDAAAAVM"]
[Tue Dec 16 19:37:24.135475 2025] [:error] [pid 18408:tid 18429] [client 4.190.217.18:17754] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUFEdDi2Gr8pDzjrVBAZogAAANM"]
[Tue Dec 16 19:37:25.129295 2025] [:error] [pid 53940:tid 53961] [client 4.190.217.18:18579] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUFEdV91PNbcXLVkpR7uEwAAAdI"]
[Tue Dec 16 19:37:26.153828 2025] [:error] [pid 35998:tid 36025] [client 4.190.217.18:1282] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUFEdhKnhGuuhGxBSLOwDwAAAVg"]
[Tue Dec 16 19:37:27.218350 2025] [:error] [pid 35998:tid 36005] [client 4.190.217.18:32699] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUFEdxKnhGuuhGxBSLOwEwAAAUQ"]
[Tue Dec 16 19:37:27.756850 2025] [:error] [pid 35998:tid 36024] [client 4.190.217.18:28598] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUFEdxKnhGuuhGxBSLOwFQAAAVc"]
[Tue Dec 16 19:37:28.855921 2025] [:error] [pid 51991:tid 52011] [client 4.190.217.18:31458] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUFEeK7zKCVJSuwV1xapuQAAARI"]
[Tue Dec 16 19:37:29.511372 2025] [:error] [pid 53940:tid 53945] [client 4.190.217.18:28582] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUFEeV91PNbcXLVkpR7uFgAAAcI"]
[Tue Dec 16 19:37:30.869717 2025] [:error] [pid 18322:tid 18342] [client 4.190.217.18:20022] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUFEepsCeWBjrw28XtwH8QAAABA"]
[Tue Dec 16 19:37:31.651763 2025] [:error] [pid 53940:tid 53958] [client 4.190.217.18:28589] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUFEe191PNbcXLVkpR7uFwAAAc8"]
[Tue Dec 16 19:37:33.389033 2025] [:error] [pid 18324:tid 18402] [client 4.190.217.18:21584] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUFEfaG4um2mD1VpJHKcMgAAAJY"]
[Tue Dec 16 19:37:34.476854 2025] [:error] [pid 12330:tid 12349] [client 4.190.217.18:18204] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUFEfl6iIQEVCIh8V1l9hwAAAY8"]
[Tue Dec 16 19:37:35.423285 2025] [:error] [pid 18322:tid 18334] [client 4.190.217.18:18238] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUFEf5sCeWBjrw28XtwH-QAAAAg"]
[Tue Dec 16 19:37:36.353379 2025] [:error] [pid 18323:tid 18356] [client 4.190.217.18:18429] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUFEgDJB6UFxIutsA8YskAAAAEM"]
[Tue Dec 16 19:37:37.489538 2025] [:error] [pid 18323:tid 18357] [client 4.190.217.18:19980] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUFEgTJB6UFxIutsA8YsmQAAAEQ"]
[Tue Dec 16 19:37:38.065535 2025] [:error] [pid 18324:tid 18396] [client 4.190.217.18:20283] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUFEgqG4um2mD1VpJHKcSgAAAJA"]
[Tue Dec 16 19:37:39.603543 2025] [:error] [pid 53940:tid 53943] [client 4.190.217.18:19600] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUFEg191PNbcXLVkpR7uJwAAAcA"]
[Tue Dec 16 19:37:41.137909 2025] [:error] [pid 12330:tid 12353] [client 4.190.217.18:35483] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUFEhV6iIQEVCIh8V1l9jAAAAZM"]
[Tue Dec 16 19:37:42.277728 2025] [:error] [pid 51991:tid 52009] [client 4.190.217.18:31394] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUFEhq7zKCVJSuwV1xap0gAAARA"]
[Tue Dec 16 19:37:43.581463 2025] [:error] [pid 51991:tid 52005] [client 4.190.217.18:26746] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUFEh67zKCVJSuwV1xap1gAAAQw"]
[Tue Dec 16 19:37:44.574303 2025] [:error] [pid 18408:tid 18429] [client 4.190.217.18:20260] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUFEiDi2Gr8pDzjrVBAZqAAAANM"]
[Tue Dec 16 19:37:45.323916 2025] [:error] [pid 18408:tid 18416] [client 4.190.217.18:20272] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUFEiTi2Gr8pDzjrVBAZrAAAAMY"]
[Tue Dec 16 19:37:46.141115 2025] [:error] [pid 12330:tid 12348] [client 4.190.217.18:58715] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUFEil6iIQEVCIh8V1l9jwAAAY4"]
[Tue Dec 16 19:37:47.031707 2025] [:error] [pid 35998:tid 36004] [client 4.190.217.18:31372] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUFEixKnhGuuhGxBSLOwHgAAAUM"]
[Tue Dec 16 19:37:47.693381 2025] [:error] [pid 18324:tid 18395] [client 4.190.217.18:35463] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUFEi6G4um2mD1VpJHKcTQAAAI8"]
[Tue Dec 16 19:37:48.517242 2025] [:error] [pid 18324:tid 18394] [client 4.190.217.18:1275] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUFEjKG4um2mD1VpJHKcTgAAAI4"]
[Tue Dec 16 19:37:50.614222 2025] [:error] [pid 18408:tid 18414] [client 4.190.217.18:1896] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Dec 16 19:37:50.748767 2025] [:error] [pid 18408:tid 18417] [client 4.190.217.18:1896] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Dec 16 19:37:51.463174 2025] [:error] [pid 18408:tid 18416] [client 4.190.217.18:1896] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUFEjzi2Gr8pDzjrVBAZvgAAAMY"]
[Tue Dec 16 19:37:53.570832 2025] [:error] [pid 18408:tid 18415] [client 4.190.217.18:18371] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aUFEkTi2Gr8pDzjrVBAZxgAAAMU"]
[Tue Dec 16 19:37:55.491625 2025] [:error] [pid 35998:tid 36011] [client 4.190.217.18:26720] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aUFEkxKnhGuuhGxBSLOwIwAAAUo"]
[Tue Dec 16 19:37:57.084517 2025] [:error] [pid 53940:tid 53953] [client 4.190.217.18:1276] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUFElV91PNbcXLVkpR7uMQAAAco"]
[Tue Dec 16 19:37:57.553636 2025] [:error] [pid 18408:tid 18434] [client 4.190.217.18:17858] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUFElTi2Gr8pDzjrVBAZyAAAANg"]
[Tue Dec 16 19:37:58.206085 2025] [:error] [pid 18324:tid 18387] [client 4.190.217.18:31374] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUFElqG4um2mD1VpJHKcVgAAAIc"]
[Tue Dec 16 19:37:59.120048 2025] [:error] [pid 18322:tid 18344] [client 4.190.217.18:31412] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUFEl5sCeWBjrw28XtwIPwAAABI"]
[Tue Dec 16 19:38:00.034277 2025] [:error] [pid 18322:tid 18334] [client 4.190.217.18:17898] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aUFEmJsCeWBjrw28XtwIQgAAAAg"]
[Tue Dec 16 19:38:01.158333 2025] [:error] [pid 18322:tid 18346] [client 4.190.217.18:18350] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUFEmZsCeWBjrw28XtwIRQAAABQ"]
[Tue Dec 16 19:38:01.927485 2025] [:error] [pid 18408:tid 18433] [client 4.190.217.18:31418] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUFEmTi2Gr8pDzjrVBAZzQAAANc"]
[Tue Dec 16 19:38:03.244323 2025] [:error] [pid 12330:tid 12353] [client 4.190.217.18:26736] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUFEm16iIQEVCIh8V1l9pAAAAZM"]
[Tue Dec 16 19:38:04.215737 2025] [:error] [pid 18324:tid 18404] [client 4.190.217.18:20241] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUFEnKG4um2mD1VpJHKcWQAAAJg"]
[Tue Dec 16 19:38:04.764993 2025] [:error] [pid 51991:tid 52012] [client 4.190.217.18:25443] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUFEnK7zKCVJSuwV1xaqIAAAARM"]
[Tue Dec 16 19:38:05.222089 2025] [:error] [pid 51991:tid 52004] [client 4.190.217.18:31393] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUFEna7zKCVJSuwV1xaqIgAAAQs"]
[Tue Dec 16 19:38:05.777540 2025] [:error] [pid 18408:tid 18414] [client 4.190.217.18:17859] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUFEnTi2Gr8pDzjrVBAZzwAAAMQ"]
[Tue Dec 16 19:38:06.375268 2025] [:error] [pid 51991:tid 52016] [client 4.190.217.18:24814] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUFEnq7zKCVJSuwV1xaqJQAAARc"]
[Tue Dec 16 19:38:06.976526 2025] [:error] [pid 18408:tid 18434] [client 4.190.217.18:1917] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUFEnji2Gr8pDzjrVBAZ0QAAANg"]
[Tue Dec 16 19:38:08.091251 2025] [:error] [pid 12330:tid 12350] [client 4.190.217.18:18364] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUFEoF6iIQEVCIh8V1l9pQAAAZA"]
[Tue Dec 16 19:38:09.921067 2025] [:error] [pid 35998:tid 36002] [client 4.190.217.18:17862] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUFEoRKnhGuuhGxBSLOwKgAAAUE"]
[Tue Dec 16 19:38:11.105708 2025] [:error] [pid 35998:tid 36020] [client 4.190.217.18:58688] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUFEoxKnhGuuhGxBSLOwKwAAAVM"]
[Tue Dec 16 19:38:12.555401 2025] [:error] [pid 18322:tid 18338] [client 4.190.217.18:20234] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUFEpJsCeWBjrw28XtwIRwAAAAw"]
[Tue Dec 16 19:38:13.466729 2025] [:error] [pid 18324:tid 18390] [client 4.190.217.18:18306] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUFEpaG4um2mD1VpJHKcXQAAAIo"]
[Tue Dec 16 19:38:14.766061 2025] [:error] [pid 51991:tid 52003] [client 4.190.217.18:26712] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUFEpq7zKCVJSuwV1xaqKQAAAQo"]
[Tue Dec 16 19:38:15.631864 2025] [:error] [pid 18322:tid 18328] [client 4.190.217.18:19125] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUFEp5sCeWBjrw28XtwISAAAAAI"]
[Tue Dec 16 19:38:16.665276 2025] [:error] [pid 51991:tid 52000] [client 4.190.217.18:1355] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUFEqK7zKCVJSuwV1xaqKwAAAQc"]
[Tue Dec 16 19:38:18.594518 2025] [:error] [pid 18324:tid 18389] [client 4.190.217.18:1888] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUFEqqG4um2mD1VpJHKcXwAAAIk"]
[Tue Dec 16 19:38:19.912649 2025] [:error] [pid 18323:tid 18373] [client 4.190.217.18:26095] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUFEqzJB6UFxIutsA8YssQAAAFQ"]
[Tue Dec 16 19:38:20.703169 2025] [:error] [pid 18408:tid 18416] [client 4.190.217.18:19099] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUFErDi2Gr8pDzjrVBAZ2gAAAMY"]
[Tue Dec 16 19:38:22.127670 2025] [:error] [pid 18323:tid 18360] [client 4.190.217.18:26748] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUFErjJB6UFxIutsA8YstgAAAEc"]
[Tue Dec 16 19:38:22.749197 2025] [:error] [pid 51991:tid 52004] [client 4.190.217.18:1390] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUFErq7zKCVJSuwV1xaqLAAAAQs"]
[Tue Dec 16 19:38:24.386256 2025] [:error] [pid 18322:tid 18340] [client 4.190.217.18:1242] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUFEsJsCeWBjrw28XtwITAAAAA4"]
[Tue Dec 16 19:38:25.370627 2025] [:error] [pid 18324:tid 18404] [client 4.190.217.18:26084] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUFEsaG4um2mD1VpJHKcYgAAAJg"]
[Tue Dec 16 19:38:26.716594 2025] [:error] [pid 18324:tid 18396] [client 4.190.217.18:25422] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUFEsqG4um2mD1VpJHKcZwAAAJA"]
[Tue Dec 16 19:38:27.307426 2025] [:error] [pid 35998:tid 36014] [client 4.190.217.18:19120] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUFEsxKnhGuuhGxBSLOwMgAAAU0"]
[Tue Dec 16 19:38:28.195493 2025] [:error] [pid 35998:tid 36015] [client 4.190.217.18:25463] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUFEtBKnhGuuhGxBSLOwMwAAAU4"]
[Tue Dec 16 19:38:28.730197 2025] [:error] [pid 18322:tid 18330] [client 4.190.217.18:17906] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUFEtJsCeWBjrw28XtwIVQAAAAQ"]
[Tue Dec 16 19:38:29.591244 2025] [:error] [pid 51991:tid 52008] [client 4.190.217.18:1230] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUFEta7zKCVJSuwV1xaqMgAAAQ8"]
[Tue Dec 16 19:38:30.322902 2025] [:error] [pid 18322:tid 18334] [client 4.190.217.18:18336] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUFEtpsCeWBjrw28XtwIVwAAAAg"]
[Tue Dec 16 19:38:31.517171 2025] [:error] [pid 18324:tid 18388] [client 4.190.217.18:1864] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUFEt6G4um2mD1VpJHKcbQAAAIg"]
[Tue Dec 16 19:38:33.829145 2025] [:error] [pid 51991:tid 51995] [client 4.190.217.18:1360] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUFEua7zKCVJSuwV1xaqOwAAAQI"]
[Tue Dec 16 19:38:34.334428 2025] [:error] [pid 51991:tid 52013] [client 4.190.217.18:17914] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUFEuq7zKCVJSuwV1xaqPgAAARQ"]
[Tue Dec 16 19:38:35.304247 2025] [:error] [pid 18408:tid 18426] [client 4.190.217.18:1372] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUFEuzi2Gr8pDzjrVBAZ3QAAANA"]
[Tue Dec 16 19:38:39.392624 2025] [:error] [pid 18322:tid 18336] [client 4.190.217.18:25429] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUFEv5sCeWBjrw28XtwIZAAAAAo"]
[Tue Dec 16 19:38:40.115810 2025] [:error] [pid 51991:tid 52011] [client 4.190.217.18:25451] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUFEwK7zKCVJSuwV1xaqRgAAARI"]
[Tue Dec 16 19:38:41.308412 2025] [:error] [pid 51991:tid 52009] [client 4.190.217.18:1870] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUFEwa7zKCVJSuwV1xaqSwAAARA"]
[Tue Dec 16 19:38:42.178535 2025] [:error] [pid 53940:tid 53958] [client 4.190.217.18:25426] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aUFEwl91PNbcXLVkpR7uRwAAAc8"]
[Tue Dec 16 19:38:43.018664 2025] [:error] [pid 51991:tid 52015] [client 4.190.217.18:1353] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aUFEw67zKCVJSuwV1xaqUgAAARY"]
[Tue Dec 16 19:38:43.432949 2025] [:error] [pid 18323:tid 18368] [client 4.190.217.18:25440] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aUFEwzJB6UFxIutsA8YsvAAAAE8"]
[Tue Dec 16 19:38:45.616383 2025] [:error] [pid 12330:tid 12355] [client 4.190.217.18:26058] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aUFExV6iIQEVCIh8V1l9ugAAAZU"]
[Tue Dec 16 19:38:46.822817 2025] [:error] [pid 18323:tid 18376] [client 4.190.217.18:1865] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUFExjJB6UFxIutsA8YsvQAAAFc"]
[Tue Dec 16 19:38:47.237164 2025] [:error] [pid 51991:tid 52011] [client 4.190.217.18:18343] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUFEx67zKCVJSuwV1xaqWQAAARI"]
[Tue Dec 16 19:38:48.933137 2025] [:error] [pid 18322:tid 18327] [client 4.190.217.18:1863] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUFEyJsCeWBjrw28XtwIcAAAAAE"]
[Tue Dec 16 19:38:50.247869 2025] [:error] [pid 18408:tid 18419] [client 4.190.217.18:32086] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUFEyji2Gr8pDzjrVBAZ5QAAAMk"]
[Tue Dec 16 19:38:51.138454 2025] [:error] [pid 51991:tid 52012] [client 4.190.217.18:1279] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUFEy67zKCVJSuwV1xaqYgAAARM"]
[Tue Dec 16 19:38:51.503245 2025] [:error] [pid 51991:tid 52007] [client 4.190.217.18:32023] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUFEy67zKCVJSuwV1xaqZAAAAQ4"]
[Tue Dec 16 19:38:52.573596 2025] [:error] [pid 51991:tid 52014] [client 4.190.217.18:1233] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUFEzK7zKCVJSuwV1xaqaQAAARU"]
[Tue Dec 16 19:38:53.879017 2025] [:error] [pid 51991:tid 52015] [client 4.190.217.18:26690] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUFEza7zKCVJSuwV1xaqbAAAARY"]
[Tue Dec 16 19:38:55.285136 2025] [:error] [pid 53940:tid 53955] [client 4.190.217.18:32007] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUFEz191PNbcXLVkpR7uUQAAAcw"]
[Tue Dec 16 19:38:56.421817 2025] [:error] [pid 18323:tid 18355] [client 4.190.217.18:26719] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Dec 16 19:38:56.551355 2025] [:error] [pid 18323:tid 18357] [client 4.190.217.18:26719] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Tue Dec 16 19:38:56.670657 2025] [:error] [pid 18323:tid 18358] [client 4.190.217.18:26719] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aUFE0DJB6UFxIutsA8YszgAAAEU"]
[Tue Dec 16 19:38:57.210535 2025] [:error] [pid 18324:tid 18403] [client 4.190.217.18:19115] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aUFE0aG4um2mD1VpJHKcfwAAAJc"]
[Tue Dec 16 19:38:57.935980 2025] [:error] [pid 35998:tid 36013] [client 4.190.217.18:25436] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Dec 16 19:38:58.060230 2025] [:error] [pid 35998:tid 36024] [client 4.190.217.18:25436] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Dec 16 19:38:58.183773 2025] [:error] [pid 35998:tid 36011] [client 4.190.217.18:25436] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Tue Dec 16 19:38:58.308608 2025] [:error] [pid 35998:tid 36003] [client 4.190.217.18:25436] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Tue Dec 16 19:38:58.538695 2025] [:error] [pid 35998:tid 36016] [client 4.190.217.18:25436] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Tue Dec 16 19:38:58.849104 2025] [:error] [pid 35998:tid 36017] [client 4.190.217.18:25436] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Tue Dec 16 19:38:58.968899 2025] [:error] [pid 35998:tid 36007] [client 4.190.217.18:25436] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUFE0hKnhGuuhGxBSLOwTgAAAUY"]
[Tue Dec 16 19:39:00.666938 2025] [:error] [pid 53940:tid 53961] [client 4.190.217.18:25461] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUFE1F91PNbcXLVkpR7uWQAAAdI"]
[Tue Dec 16 19:39:02.190694 2025] [:error] [pid 18323:tid 18368] [client 4.190.217.18:58713] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUFE1jJB6UFxIutsA8Ys1wAAAE8"]
[Tue Dec 16 19:39:02.826785 2025] [:error] [pid 18322:tid 18332] [client 4.190.217.18:19619] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUFE1psCeWBjrw28XtwIfgAAAAY"]
[Tue Dec 16 19:39:03.438867 2025] [:error] [pid 18324:tid 18390] [client 4.190.217.18:19637] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUFE16G4um2mD1VpJHKcjAAAAIo"]
[Tue Dec 16 19:39:04.506736 2025] [:error] [pid 12330:tid 12346] [client 4.190.217.18:19610] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUFE2F6iIQEVCIh8V1l9zAAAAYw"]
[Tue Dec 16 19:39:06.000889 2025] [:error] [pid 53940:tid 53963] [client 4.190.217.18:17687] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUFE2V91PNbcXLVkpR7uXQAAAdQ"]
[Tue Dec 16 19:39:06.530310 2025] [:error] [pid 18408:tid 18430] [client 4.190.217.18:1321] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUFE2ji2Gr8pDzjrVBAZ8gAAANQ"]
[Tue Dec 16 19:39:07.850085 2025] [:error] [pid 18408:tid 18425] [client 4.190.217.18:23759] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUFE2zi2Gr8pDzjrVBAZ9gAAAM8"]
[Tue Dec 16 19:39:08.524891 2025] [:error] [pid 18324:tid 18389] [client 4.190.217.18:18597] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUFE3KG4um2mD1VpJHKclwAAAIk"]
[Tue Dec 16 19:39:11.443870 2025] [:error] [pid 53940:tid 53964] [client 4.190.217.18:1836] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUFE3191PNbcXLVkpR7uYgAAAdU"]
[Tue Dec 16 19:39:12.955733 2025] [:error] [pid 18322:tid 18336] [client 4.190.217.18:18599] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUFE4JsCeWBjrw28XtwIggAAAAo"]
[Tue Dec 16 19:39:13.695916 2025] [:error] [pid 51991:tid 52010] [client 4.190.217.18:1127] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUFE4a7zKCVJSuwV1xaqhQAAARE"]
[Tue Dec 16 19:39:21.697701 2025] [:error] [pid 51991:tid 52014] [client 4.190.217.18:17746] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUFE6a7zKCVJSuwV1xaqmwAAARU"]
[Tue Dec 16 19:39:23.006818 2025] [:error] [pid 18322:tid 18341] [client 4.190.217.18:58773] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUFE65sCeWBjrw28XtwInAAAAA8"]
[Tue Dec 16 19:39:23.559349 2025] [:error] [pid 51991:tid 52005] [client 4.190.217.18:18287] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUFE667zKCVJSuwV1xaqpwAAAQw"]
[Tue Dec 16 19:39:24.928077 2025] [:error] [pid 18322:tid 18348] [client 4.190.217.18:18300] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUFE7JsCeWBjrw28XtwIogAAABY"]
[Tue Dec 16 19:39:25.772734 2025] [:error] [pid 18324:tid 18404] [client 4.190.217.18:19462] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUFE7aG4um2mD1VpJHKczQAAAJg"]
[Tue Dec 16 19:39:27.440984 2025] [:error] [pid 18323:tid 18360] [client 4.190.217.18:58805] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUFE7zJB6UFxIutsA8Ys3gAAAEc"]
[Tue Dec 16 19:39:28.472435 2025] [:error] [pid 18323:tid 18363] [client 4.190.217.18:17930] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUFE8DJB6UFxIutsA8Ys4AAAAEo"]
[Tue Dec 16 19:39:29.614330 2025] [:error] [pid 18324:tid 18383] [client 4.190.217.18:58793] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUFE8aG4um2mD1VpJHKczwAAAIM"]
[Tue Dec 16 19:39:31.516606 2025] [:error] [pid 51991:tid 52008] [client 4.190.217.18:17961] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUFE867zKCVJSuwV1xaqsAAAAQ8"]
[Tue Dec 16 19:39:38.591734 2025] [:error] [pid 35998:tid 36001] [client 4.190.217.18:58776] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUFE-hKnhGuuhGxBSLOwZwAAAUA"]
[Tue Dec 16 19:39:40.306323 2025] [:error] [pid 18324:tid 18393] [client 4.190.217.18:17754] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUFE_KG4um2mD1VpJHKc-gAAAI0"]
[Tue Dec 16 19:39:41.280061 2025] [:error] [pid 53940:tid 53951] [client 4.190.217.18:17932] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUFE_V91PNbcXLVkpR7urgAAAcg"]
[Tue Dec 16 19:39:41.981668 2025] [:error] [pid 53940:tid 53958] [client 4.190.217.18:18016] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUFE_V91PNbcXLVkpR7usQAAAc8"]
[Tue Dec 16 19:39:42.917760 2025] [:error] [pid 35998:tid 36024] [client 4.190.217.18:1670] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUFE_hKnhGuuhGxBSLOwagAAAVc"]
[Tue Dec 16 19:39:43.739537 2025] [:error] [pid 53940:tid 53944] [client 4.190.217.18:18037] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUFE_191PNbcXLVkpR7usgAAAcE"]
[Tue Dec 16 19:39:44.714870 2025] [:error] [pid 18323:tid 18370] [client 4.190.217.18:1854] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUFFADJB6UFxIutsA8Ys-gAAAFE"]
[Tue Dec 16 19:39:45.699975 2025] [:error] [pid 18323:tid 18366] [client 4.190.217.18:18019] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUFFATJB6UFxIutsA8Ys-wAAAE0"]
[Tue Dec 16 19:39:46.408505 2025] [:error] [pid 18408:tid 18415] [client 4.190.217.18:58768] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUFFAji2Gr8pDzjrVBAaLAAAAMU"]
[Tue Dec 16 19:39:47.124457 2025] [:error] [pid 51991:tid 52006] [client 4.190.217.18:18253] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUFFA67zKCVJSuwV1xaqyAAAAQ0"]
[Tue Dec 16 19:39:48.049074 2025] [:error] [pid 51991:tid 52005] [client 4.190.217.18:58775] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUFFBK7zKCVJSuwV1xaqyQAAAQw"]
[Tue Dec 16 19:39:48.809350 2025] [:error] [pid 18324:tid 18401] [client 4.190.217.18:58790] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUFFBKG4um2mD1VpJHKdAwAAAJU"]
[Tue Dec 16 19:39:49.176515 2025] [:error] [pid 51991:tid 52000] [client 4.190.217.18:1725] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUFFBa7zKCVJSuwV1xaqzAAAAQc"]
[Tue Dec 16 19:39:49.885805 2025] [:error] [pid 51991:tid 51997] [client 4.190.217.18:23753] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUFFBa7zKCVJSuwV1xaqzgAAAQQ"]
[Tue Dec 16 19:39:50.534171 2025] [:error] [pid 18323:tid 18375] [client 4.190.217.18:1807] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUFFBjJB6UFxIutsA8Ys_wAAAFY"]
[Tue Dec 16 19:39:51.668602 2025] [:error] [pid 51991:tid 51996] [client 4.190.217.18:18030] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUFFB67zKCVJSuwV1xaq0gAAAQM"]
[Tue Dec 16 19:39:52.540736 2025] [:error] [pid 18322:tid 18334] [client 4.190.217.18:18014] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUFFCJsCeWBjrw28XtwIqgAAAAg"]
[Tue Dec 16 19:39:52.965613 2025] [:error] [pid 18408:tid 18420] [client 4.190.217.18:1819] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUFFCDi2Gr8pDzjrVBAaMgAAAMo"]
[Tue Dec 16 19:39:53.814566 2025] [:error] [pid 18322:tid 18343] [client 4.190.217.18:1704] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUFFCZsCeWBjrw28XtwIrAAAABE"]
[Tue Dec 16 19:39:54.540738 2025] [:error] [pid 18324:tid 18393] [client 4.190.217.18:30009] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUFFCqG4um2mD1VpJHKdDAAAAI0"]
[Tue Dec 16 19:39:55.780453 2025] [:error] [pid 18322:tid 18335] [client 4.190.217.18:19476] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUFFC5sCeWBjrw28XtwIvwAAAAk"]
[Tue Dec 16 19:39:56.638826 2025] [:error] [pid 51991:tid 52008] [client 4.190.217.18:1716] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUFFDK7zKCVJSuwV1xarIgAAAQ8"]
[Tue Dec 16 19:39:57.180264 2025] [:error] [pid 51991:tid 51994] [client 4.190.217.18:1810] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUFFDa7zKCVJSuwV1xarJgAAAQE"]
[Tue Dec 16 19:39:58.352817 2025] [:error] [pid 18408:tid 18427] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Tue Dec 16 19:39:58.499752 2025] [:error] [pid 18408:tid 18413] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Tue Dec 16 19:39:58.693652 2025] [:error] [pid 18408:tid 18431] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Tue Dec 16 19:39:58.977072 2025] [:error] [pid 18408:tid 18423] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Tue Dec 16 19:39:59.105252 2025] [:error] [pid 18408:tid 18434] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Tue Dec 16 19:39:59.228935 2025] [:error] [pid 18408:tid 18414] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Tue Dec 16 19:39:59.453340 2025] [:error] [pid 18408:tid 18420] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Tue Dec 16 19:39:59.576961 2025] [:error] [pid 18408:tid 18410] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Tue Dec 16 19:39:59.700827 2025] [:error] [pid 18408:tid 18417] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Tue Dec 16 19:39:59.824316 2025] [:error] [pid 18408:tid 18418] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Tue Dec 16 19:40:00.086628 2025] [:error] [pid 18408:tid 18422] [client 4.190.217.18:17971] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Tue Dec 16 19:40:00.209371 2025] [:error] [pid 18408:tid 18425] [client 4.190.217.18:17971] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUFFEDi2Gr8pDzjrVBAaSQAAAM8"]
[Tue Dec 16 19:40:01.305531 2025] [:error] [pid 18324:tid 18399] [client 4.190.217.18:29990] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUFFEaG4um2mD1VpJHKdDgAAAJM"]
[Tue Dec 16 19:40:02.267196 2025] [:error] [pid 18322:tid 18334] [client 4.190.217.18:17955] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUFFEpsCeWBjrw28XtwIzwAAAAg"]
[Tue Dec 16 19:40:02.692630 2025] [:error] [pid 51991:tid 52011] [client 4.190.217.18:1680] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUFFEq7zKCVJSuwV1xarLAAAARI"]
[Tue Dec 16 19:40:04.390545 2025] [:error] [pid 35998:tid 36017] [client 4.190.217.18:17936] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUFFFBKnhGuuhGxBSLOwhgAAAVA"]
[Tue Dec 16 19:40:05.653138 2025] [:error] [pid 18408:tid 18433] [client 4.190.217.18:29993] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUFFFTi2Gr8pDzjrVBAaTAAAANc"]
[Tue Dec 16 19:40:06.307073 2025] [:error] [pid 18323:tid 18366] [client 4.190.217.18:1707] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUFFFjJB6UFxIutsA8YtSQAAAE0"]
[Tue Dec 16 19:40:06.890750 2025] [:error] [pid 51991:tid 51999] [client 4.190.217.18:18031] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUFFFq7zKCVJSuwV1xarNgAAAQY"]
[Tue Dec 16 19:40:07.866620 2025] [:error] [pid 18408:tid 18416] [client 4.190.217.18:1832] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUFFFzi2Gr8pDzjrVBAaTQAAAMY"]
[Tue Dec 16 19:40:08.943367 2025] [:error] [pid 51991:tid 52001] [client 4.190.217.18:29998] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUFFGK7zKCVJSuwV1xarOgAAAQg"]
[Tue Dec 16 19:40:09.885113 2025] [:error] [pid 51991:tid 52005] [client 4.190.217.18:23773] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUFFGa7zKCVJSuwV1xarPAAAAQw"]
[Tue Dec 16 19:40:11.294232 2025] [:error] [pid 18323:tid 18356] [client 4.190.217.18:1825] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUFFGzJB6UFxIutsA8YtTgAAAEM"]
[Tue Dec 16 19:40:11.931075 2025] [:error] [pid 18408:tid 18417] [client 4.190.217.18:24783] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUFFGzi2Gr8pDzjrVBAaUwAAAMc"]
[Tue Dec 16 19:40:12.395452 2025] [:error] [pid 18323:tid 18360] [client 4.190.217.18:18017] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUFFHDJB6UFxIutsA8YtUQAAAEc"]
[Tue Dec 16 19:40:13.853412 2025] [:error] [pid 18324:tid 18391] [client 4.190.217.18:1673] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUFFHaG4um2mD1VpJHKdFgAAAIs"]
[Tue Dec 16 19:40:14.619228 2025] [:error] [pid 18323:tid 18363] [client 4.190.217.18:23757] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUFFHjJB6UFxIutsA8YtVAAAAEo"]
[Tue Dec 16 19:40:15.434202 2025] [:error] [pid 12330:tid 12353] [client 4.190.217.18:23760] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUFFH16iIQEVCIh8V1l-UQAAAZM"]
[Tue Dec 16 19:40:15.972297 2025] [:error] [pid 18408:tid 18429] [client 4.190.217.18:18267] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUFFHzi2Gr8pDzjrVBAaXAAAANM"]
[Tue Dec 16 19:40:16.973318 2025] [:error] [pid 18324:tid 18382] [client 4.190.217.18:19505] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUFFIKG4um2mD1VpJHKdHAAAAII"]
[Tue Dec 16 19:40:17.378501 2025] [:error] [pid 51991:tid 52009] [client 4.190.217.18:19514] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUFFIa7zKCVJSuwV1xarQQAAARA"]
[Tue Dec 16 19:40:18.119045 2025] [:error] [pid 51991:tid 52015] [client 4.190.217.18:17980] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aUFFIq7zKCVJSuwV1xarRAAAARY"]
[Tue Dec 16 19:40:18.615453 2025] [:error] [pid 51991:tid 51998] [client 4.190.217.18:23762] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aUFFIq7zKCVJSuwV1xarRgAAAQU"]
[Tue Dec 16 19:40:19.517148 2025] [:error] [pid 18324:tid 18380] [client 4.190.217.18:1690] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aUFFI6G4um2mD1VpJHKdIAAAAIA"]
[Tue Dec 16 19:40:19.937012 2025] [:error] [pid 51991:tid 51996] [client 4.190.217.18:19478] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aUFFI67zKCVJSuwV1xarSgAAAQM"]
[Tue Dec 16 19:40:20.366079 2025] [:error] [pid 51991:tid 52010] [client 4.190.217.18:17931] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/sx.php"] [unique_id "aUFFJK7zKCVJSuwV1xarSwAAARE"]
[Tue Dec 16 19:40:20.784308 2025] [:error] [pid 51991:tid 51995] [client 4.190.217.18:18246] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aUFFJK7zKCVJSuwV1xarTAAAAQI"]
[Tue Dec 16 19:40:21.775002 2025] [:error] [pid 51991:tid 51998] [client 4.190.217.18:1808] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUFFJa7zKCVJSuwV1xarVAAAAQU"]
[Tue Dec 16 19:40:22.295611 2025] [:error] [pid 51991:tid 52014] [client 4.190.217.18:23791] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUFFJq7zKCVJSuwV1xarVgAAARU"]
[Tue Dec 16 19:40:22.923810 2025] [:error] [pid 51991:tid 51995] [client 4.190.217.18:58809] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUFFJq7zKCVJSuwV1xarWQAAAQI"]
[Tue Dec 16 19:40:23.412686 2025] [:error] [pid 12330:tid 12343] [client 4.190.217.18:17965] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUFFJ16iIQEVCIh8V1l-cQAAAYk"]
[Tue Dec 16 19:40:24.422065 2025] [:error] [pid 12330:tid 12355] [client 4.190.217.18:23799] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aUFFKF6iIQEVCIh8V1l-dAAAAZU"]
[Tue Dec 16 19:40:24.762321 2025] [:error] [pid 53940:tid 53952] [client 4.190.217.18:17947] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aUFFKF91PNbcXLVkpR7uzwAAAck"]
[Tue Dec 16 19:40:25.397782 2025] [:error] [pid 18323:tid 18360] [client 4.190.217.18:17946] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aUFFKTJB6UFxIutsA8YtaQAAAEc"]
[Tue Dec 16 19:40:26.386758 2025] [:error] [pid 18324:tid 18399] [client 4.190.217.18:1708] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aUFFKqG4um2mD1VpJHKdJAAAAJM"]
[Tue Dec 16 19:40:27.441184 2025] [:error] [pid 18322:tid 18345] [client 4.190.217.18:23790] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aUFFK5sCeWBjrw28XtwI4wAAABM"]
[Tue Dec 16 19:40:28.220494 2025] [:error] [pid 18322:tid 18327] [client 4.190.217.18:29952] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aUFFLJsCeWBjrw28XtwI5AAAAAE"]
[Tue Dec 16 19:40:28.873938 2025] [:error] [pid 18324:tid 18397] [client 4.190.217.18:29956] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aUFFLKG4um2mD1VpJHKdJQAAAJE"]
[Tue Dec 16 19:40:29.739466 2025] [:error] [pid 35998:tid 36012] [client 4.190.217.18:1124] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aUFFLRKnhGuuhGxBSLOwmwAAAUs"]
[Tue Dec 16 19:40:30.217395 2025] [:error] [pid 53940:tid 53960] [client 4.190.217.18:18623] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signin.php"] [unique_id "aUFFLl91PNbcXLVkpR7u1AAAAdE"]
[Tue Dec 16 19:40:30.646982 2025] [:error] [pid 12330:tid 12357] [client 4.190.217.18:25444] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUFFLl6iIQEVCIh8V1l-egAAAZc"]
[Tue Dec 16 19:40:31.831156 2025] [:error] [pid 18408:tid 18410] [client 4.190.217.18:25449] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "aUFFLzi2Gr8pDzjrVBAadQAAAMA"]
[Tue Dec 16 19:40:32.531412 2025] [:error] [pid 53940:tid 53967] [client 4.190.217.18:58772] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "aUFFMF91PNbcXLVkpR7u1gAAAdg"]
[Tue Dec 16 19:40:33.286290 2025] [:error] [pid 53940:tid 53947] [client 4.190.217.18:18264] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "aUFFMV91PNbcXLVkpR7u2QAAAcQ"]
[Tue Dec 16 19:40:33.912563 2025] [:error] [pid 53940:tid 53953] [client 4.190.217.18:19486] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aUFFMV91PNbcXLVkpR7u3AAAAco"]
[Tue Dec 16 19:40:34.338985 2025] [:error] [pid 18324:tid 18389] [client 4.190.217.18:18242] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aUFFMqG4um2mD1VpJHKdKwAAAIk"]
[Tue Dec 16 19:40:35.057309 2025] [:error] [pid 18324:tid 18388] [client 4.190.217.18:19509] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aUFFM6G4um2mD1VpJHKdLQAAAIg"]
[Tue Dec 16 19:40:35.704940 2025] [:error] [pid 18324:tid 18402] [client 4.190.217.18:18285] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aUFFM6G4um2mD1VpJHKdLwAAAJY"]
[Tue Dec 16 19:40:36.150284 2025] [:error] [pid 18408:tid 18432] [client 4.190.217.18:1099] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aUFFNDi2Gr8pDzjrVBAaeQAAANY"]
[Tue Dec 16 19:40:36.980289 2025] [:error] [pid 35998:tid 36014] [client 4.190.217.18:58812] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aUFFNBKnhGuuhGxBSLOwpAAAAU0"]
[Tue Dec 16 19:40:38.385981 2025] [:error] [pid 18322:tid 18348] [client 4.190.217.18:18029] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aUFFNpsCeWBjrw28XtwI9AAAABY"]
[Tue Dec 16 19:40:39.353058 2025] [:error] [pid 18324:tid 18393] [client 4.190.217.18:25414] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aUFFN6G4um2mD1VpJHKdQwAAAI0"]
[Tue Dec 16 19:40:40.577494 2025] [:error] [pid 18324:tid 18396] [client 4.190.217.18:1700] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUFFOKG4um2mD1VpJHKdRgAAAJA"]
[Tue Dec 16 19:40:41.569301 2025] [:error] [pid 12330:tid 12340] [client 4.190.217.18:18018] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUFFOV6iIQEVCIh8V1l-mgAAAYY"]
[Tue Dec 16 19:40:41.951587 2025] [:error] [pid 18408:tid 18412] [client 4.190.217.18:18040] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUFFOTi2Gr8pDzjrVBAajAAAAMI"]
[Tue Dec 16 19:40:42.547916 2025] [:error] [pid 18322:tid 18328] [client 4.190.217.18:30010] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUFFOpsCeWBjrw28XtwJAgAAAAI"]
[Tue Dec 16 19:40:42.928714 2025] [:error] [pid 51991:tid 51994] [client 4.190.217.18:1692] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gzone.php"] [unique_id "aUFFOq7zKCVJSuwV1xareAAAAQE"]
[Tue Dec 16 19:40:44.032537 2025] [:error] [pid 18322:tid 18336] [client 4.190.217.18:29960] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gzone.php"] [unique_id "aUFFPJsCeWBjrw28XtwJAwAAAAo"]
[Tue Dec 16 19:40:44.923810 2025] [:error] [pid 18322:tid 18333] [client 4.190.217.18:23793] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gzone.php"] [unique_id "aUFFPJsCeWBjrw28XtwJBgAAAAc"]
[Tue Dec 16 19:40:45.906563 2025] [:error] [pid 53940:tid 53948] [client 4.190.217.18:1713] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gzone.php"] [unique_id "aUFFPV91PNbcXLVkpR7u5wAAAcU"]
[Tue Dec 16 19:40:46.514730 2025] [:error] [pid 53940:tid 53965] [client 4.190.217.18:25420] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aUFFPl91PNbcXLVkpR7u6QAAAdY"]
[Tue Dec 16 19:40:47.200945 2025] [:error] [pid 51991:tid 52007] [client 4.190.217.18:19511] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aUFFP67zKCVJSuwV1xarfQAAAQ4"]
[Tue Dec 16 19:40:47.587013 2025] [:error] [pid 18408:tid 18433] [client 4.190.217.18:18249] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aUFFPzi2Gr8pDzjrVBAanQAAANc"]
[Tue Dec 16 19:40:47.995885 2025] [:error] [pid 18408:tid 18424] [client 4.190.217.18:29997] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aUFFPzi2Gr8pDzjrVBAangAAAM4"]
[Tue Dec 16 19:40:48.502516 2025] [:error] [pid 18323:tid 18356] [client 4.190.217.18:58806] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aUFFQDJB6UFxIutsA8YthAAAAEM"]
[Tue Dec 16 19:40:48.889164 2025] [:error] [pid 53940:tid 53963] [client 4.190.217.18:18277] [client 4.190.217.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/index.php"] [unique_id "aUFFQF91PNbcXLVkpR7u7AAAAdQ"]
[Tue Dec 16 19:40:49.511241 2025] [:error] [pid 51991:tid 51998] [client 4.190.217.18:29976] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img/wp-login.php"] [unique_id "aUFFQa7zKCVJSuwV1xargAAAAQU"]
[Tue Dec 16 19:40:50.008162 2025] [:error] [pid 12330:tid 12355] [client 4.190.217.18:19493] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img/wp-login.php"] [unique_id "aUFFQl6iIQEVCIh8V1l-qAAAAZU"]
[Tue Dec 16 19:40:50.353622 2025] [:error] [pid 35998:tid 36008] [client 4.190.217.18:18290] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img/wp-login.php"] [unique_id "aUFFQhKnhGuuhGxBSLOwuwAAAUc"]
[Tue Dec 16 19:40:50.820229 2025] [:error] [pid 12330:tid 12352] [client 4.190.217.18:19495] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img/wp-login.php"] [unique_id "aUFFQl6iIQEVCIh8V1l-qwAAAZI"]
[Tue Dec 16 19:40:51.533391 2025] [:error] [pid 35998:tid 36001] [client 4.190.217.18:58814] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-damin.php"] [unique_id "aUFFQxKnhGuuhGxBSLOwvAAAAUA"]
[Tue Dec 16 19:40:52.450428 2025] [:error] [pid 51991:tid 52017] [client 4.190.217.18:25454] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-damin.php"] [unique_id "aUFFRK7zKCVJSuwV1xarhQAAARg"]
[Tue Dec 16 19:40:53.026490 2025] [:error] [pid 51991:tid 51993] [client 4.190.217.18:19460] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-damin.php"] [unique_id "aUFFRa7zKCVJSuwV1xariQAAAQA"]
[Tue Dec 16 19:40:53.418210 2025] [:error] [pid 51991:tid 52007] [client 4.190.217.18:1846] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-damin.php"] [unique_id "aUFFRa7zKCVJSuwV1xarjQAAAQ4"]
[Tue Dec 16 19:40:53.928058 2025] [:error] [pid 18324:tid 18403] [client 4.190.217.18:18104] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUFFRaG4um2mD1VpJHKdYwAAAJc"]
[Tue Dec 16 19:40:54.450559 2025] [:error] [pid 18323:tid 18369] [client 4.190.217.18:1821] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUFFRjJB6UFxIutsA8YtjgAAAFA"]
[Tue Dec 16 19:40:55.024413 2025] [:error] [pid 18322:tid 18336] [client 4.190.217.18:19386] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUFFR5sCeWBjrw28XtwJDwAAAAo"]
[Tue Dec 16 19:40:56.679260 2025] [:error] [pid 53940:tid 53965] [client 4.190.217.18:23792] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUFFSF91PNbcXLVkpR7u9AAAAdY"]
[Tue Dec 16 19:40:57.034291 2025] [:error] [pid 18408:tid 18415] [client 4.190.217.18:30004] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aUFFSTi2Gr8pDzjrVBAarwAAAMU"]
[Tue Dec 16 19:40:57.496436 2025] [:error] [pid 18324:tid 18382] [client 4.190.217.18:19480] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aUFFSaG4um2mD1VpJHKdaQAAAII"]
[Tue Dec 16 19:40:57.885918 2025] [:error] [pid 35998:tid 36024] [client 4.190.217.18:29987] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aUFFSRKnhGuuhGxBSLOwxQAAAVc"]
[Tue Dec 16 19:40:59.477162 2025] [:error] [pid 18323:tid 18360] [client 4.190.217.18:1853] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aUFFSzJB6UFxIutsA8YtkwAAAEc"]
[Tue Dec 16 19:40:59.934229 2025] [:error] [pid 53940:tid 53966] [client 4.190.217.18:19490] [client 4.190.217.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aUFFS191PNbcXLVkpR7u-QAAAdc"]
[Tue Dec 16 19:41:00.659154 2025] [:error] [pid 18408:tid 18421] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Tue Dec 16 19:41:00.869147 2025] [:error] [pid 18408:tid 18433] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/ah24.php
[Tue Dec 16 19:41:00.993312 2025] [:error] [pid 18408:tid 18415] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Tue Dec 16 19:41:01.164460 2025] [:error] [pid 18408:tid 18427] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/bipas.php
[Tue Dec 16 19:41:01.332958 2025] [:error] [pid 18408:tid 18411] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/conte.php
[Tue Dec 16 19:41:01.462702 2025] [:error] [pid 18408:tid 18431] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/class3.php
[Tue Dec 16 19:41:01.588874 2025] [:error] [pid 18408:tid 18425] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs18.php
[Tue Dec 16 19:41:01.722413 2025] [:error] [pid 18408:tid 18426] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/claa.php
[Tue Dec 16 19:41:01.846159 2025] [:error] [pid 18408:tid 18417] [client 4.190.217.18:1838] File does not exist: /usr/local/apache/htdocs/suspended-page/class_1.php
[Tue Dec 16 21:24:44.251158 2025] [:error] [pid 18323:tid 18373] [client 84.54.33.138:65128] [client 84.54.33.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aUFdnDJB6UFxIutsA8ZA9QAAAFQ"]
[Wed Dec 17 04:45:36.062770 2025] [:error] [pid 13302:tid 13319] [client 20.250.45.203:24155] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUHE8BDfKV-_W5RvJZ9WxQAAAM8"]
[Wed Dec 17 04:45:36.403328 2025] [:error] [pid 13302:tid 13322] [client 20.250.45.203:24155] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aUHE8BDfKV-_W5RvJZ9WxwAAANI"]
[Wed Dec 17 04:45:36.644348 2025] [:error] [pid 13302:tid 13311] [client 20.250.45.203:24155] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aUHE8BDfKV-_W5RvJZ9WyQAAAMc"]
[Wed Dec 17 04:45:36.884055 2025] [:error] [pid 13302:tid 13320] [client 20.250.45.203:24155] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aUHE8BDfKV-_W5RvJZ9WygAAANA"]
[Wed Dec 17 04:45:37.135670 2025] [:error] [pid 13302:tid 13321] [client 20.250.45.203:24155] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aUHE8RDfKV-_W5RvJZ9WzAAAANE"]
[Wed Dec 17 04:45:37.465671 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:24155] [client 20.250.45.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aUHE8RDfKV-_W5RvJZ9WzwAAAMQ"]
[Wed Dec 17 04:45:38.244620 2025] [:error] [pid 13217:tid 13275] [client 20.250.45.203:30110] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aUHE8rKPEDQzeQkr6QL_1wAAAIM"]
[Wed Dec 17 04:45:38.487675 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:30110] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUHE8rKPEDQzeQkr6QL_3QAAAJA"]
[Wed Dec 17 04:45:38.832394 2025] [:error] [pid 13217:tid 13292] [client 20.250.45.203:30110] [client 20.250.45.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/wp-login.php"] [unique_id "aUHE8rKPEDQzeQkr6QL_3wAAAJI"]
[Wed Dec 17 04:45:39.371971 2025] [:error] [pid 13302:tid 13314] [client 20.250.45.203:29701] [client 20.250.45.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aUHE8xDfKV-_W5RvJZ9W1gAAAMo"]
[Wed Dec 17 04:45:40.026742 2025] [:error] [pid 13216:tid 13271] [client 20.250.45.203:30172] [client 20.250.45.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aUHE9NkjYVDtADMjze77TwAAAFU"]
[Wed Dec 17 04:45:40.587157 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:29714] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aUHE9LKPEDQzeQkr6QL_7QAAAIA"]
[Wed Dec 17 04:45:40.828233 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:29714] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUHE9LKPEDQzeQkr6QL_7gAAAJA"]
[Wed Dec 17 04:45:40.834220 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:29714] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Wed Dec 17 04:45:41.069318 2025] [:error] [pid 13217:tid 13282] [client 20.250.45.203:29714] [client 20.250.45.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/wp-login.php"] [unique_id "aUHE9bKPEDQzeQkr6QL_8QAAAIg"]
[Wed Dec 17 04:45:42.081662 2025] [:error] [pid 13217:tid 13293] [client 20.250.45.203:30081] [client 20.250.45.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.250.45.203, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aUHE9rKPEDQzeQkr6QL_9gAAAJM"]
[Wed Dec 17 04:45:42.323589 2025] [:error] [pid 13217:tid 13273] [client 20.250.45.203:30081] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sxx.php"] [unique_id "aUHE9rKPEDQzeQkr6QL_-AAAAII"]
[Wed Dec 17 04:45:43.385746 2025] [:error] [pid 13302:tid 13304] [client 20.250.45.203:18583] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sxx.php"] [unique_id "aUHE9xDfKV-_W5RvJZ9W4gAAAMA"]
[Wed Dec 17 04:45:43.999594 2025] [:error] [pid 13215:tid 13228] [client 20.250.45.203:33624] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sxx.php"] [unique_id "aUHE93pS_Sk4Oyp_UPEs-gAAAAg"]
[Wed Dec 17 04:45:44.511980 2025] [:error] [pid 13302:tid 13325] [client 20.250.45.203:29660] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sxx.php"] [unique_id "aUHE-BDfKV-_W5RvJZ9W6AAAANU"]
[Wed Dec 17 04:45:45.127541 2025] [:error] [pid 13217:tid 13282] [client 20.250.45.203:30156] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP8"] [unique_id "aUHE-bKPEDQzeQkr6QL__QAAAIg"]
[Wed Dec 17 04:45:45.708014 2025] [:error] [pid 13217:tid 13289] [client 20.250.45.203:41161] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP8"] [unique_id "aUHE-bKPEDQzeQkr6QL__gAAAI8"]
[Wed Dec 17 04:45:46.326960 2025] [:error] [pid 13217:tid 13293] [client 20.250.45.203:18933] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP8"] [unique_id "aUHE-rKPEDQzeQkr6QIAAQAAAJM"]
[Wed Dec 17 04:45:46.833503 2025] [:error] [pid 13302:tid 13320] [client 20.250.45.203:29403] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP8"] [unique_id "aUHE-hDfKV-_W5RvJZ9W7gAAANA"]
[Wed Dec 17 04:45:47.347988 2025] [:error] [pid 13217:tid 13297] [client 20.250.45.203:18885] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUHE-7KPEDQzeQkr6QIAAgAAAJc"]
[Wed Dec 17 04:45:47.881601 2025] [:error] [pid 13217:tid 13270] [client 20.250.45.203:29664] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUHE-7KPEDQzeQkr6QIAAwAAAIE"]
[Wed Dec 17 04:45:48.676866 2025] [:error] [pid 13217:tid 13280] [client 20.250.45.203:29388] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUHE_LKPEDQzeQkr6QIACAAAAIY"]
[Wed Dec 17 04:45:49.377416 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:33648] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUHE_bKPEDQzeQkr6QIACgAAAIA"]
[Wed Dec 17 04:45:49.969778 2025] [:error] [pid 13302:tid 13316] [client 20.250.45.203:29710] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aUHE_RDfKV-_W5RvJZ9W9QAAAMw"]
[Wed Dec 17 04:45:50.456494 2025] [:error] [pid 13215:tid 13239] [client 20.250.45.203:29677] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aUHE_npS_Sk4Oyp_UPEtDAAAABM"]
[Wed Dec 17 04:45:51.050480 2025] [:error] [pid 13215:tid 13234] [client 20.250.45.203:29732] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aUHE_3pS_Sk4Oyp_UPEtDgAAAA4"]
[Wed Dec 17 04:45:51.937578 2025] [:error] [pid 13215:tid 13227] [client 20.250.45.203:23897] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aUHE_3pS_Sk4Oyp_UPEtEQAAAAc"]
[Wed Dec 17 04:45:52.572469 2025] [:error] [pid 13302:tid 13321] [client 20.250.45.203:26238] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2index.php"] [unique_id "aUHFABDfKV-_W5RvJZ9W_AAAANE"]
[Wed Dec 17 04:45:53.108416 2025] [:error] [pid 13302:tid 13306] [client 20.250.45.203:29675] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2index.php"] [unique_id "aUHFARDfKV-_W5RvJZ9W_gAAAMI"]
[Wed Dec 17 04:45:53.771964 2025] [:error] [pid 13302:tid 13319] [client 20.250.45.203:29408] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2index.php"] [unique_id "aUHFARDfKV-_W5RvJZ9XAwAAAM8"]
[Wed Dec 17 04:45:54.435611 2025] [:error] [pid 13216:tid 13259] [client 20.250.45.203:24186] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2index.php"] [unique_id "aUHFAtkjYVDtADMjze77iAAAAEw"]
[Wed Dec 17 04:45:54.957641 2025] [:error] [pid 13302:tid 13323] [client 20.250.45.203:22576] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aUHFAhDfKV-_W5RvJZ9XBQAAANM"]
[Wed Dec 17 04:45:55.527153 2025] [:error] [pid 13302:tid 13320] [client 20.250.45.203:30112] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aUHFAxDfKV-_W5RvJZ9XBgAAANA"]
[Wed Dec 17 04:45:56.019807 2025] [:error] [pid 13302:tid 13312] [client 20.250.45.203:23879] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aUHFBBDfKV-_W5RvJZ9XCAAAAMg"]
[Wed Dec 17 04:45:56.561034 2025] [:error] [pid 13217:tid 13282] [client 20.250.45.203:23931] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aUHFBLKPEDQzeQkr6QIAEwAAAIg"]
[Wed Dec 17 04:45:57.175157 2025] [:error] [pid 13216:tid 13260] [client 20.250.45.203:29722] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUHFBdkjYVDtADMjze77kQAAAE0"]
[Wed Dec 17 04:45:57.867869 2025] [:error] [pid 13215:tid 13238] [client 20.250.45.203:29391] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUHFBXpS_Sk4Oyp_UPEtJwAAABI"]
[Wed Dec 17 04:45:58.478238 2025] [:error] [pid 13215:tid 13223] [client 20.250.45.203:26193] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUHFBnpS_Sk4Oyp_UPEtKAAAAAM"]
[Wed Dec 17 04:45:59.081985 2025] [:error] [pid 13217:tid 13291] [client 20.250.45.203:29693] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUHFB7KPEDQzeQkr6QIAGAAAAJE"]
[Wed Dec 17 04:45:59.786875 2025] [:error] [pid 13216:tid 13253] [client 20.250.45.203:18932] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/01.php"] [unique_id "aUHFB9kjYVDtADMjze77mgAAAEY"]
[Wed Dec 17 04:46:00.638047 2025] [:error] [pid 13216:tid 13265] [client 20.250.45.203:23933] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/01.php"] [unique_id "aUHFCNkjYVDtADMjze77nQAAAFE"]
[Wed Dec 17 04:46:01.201890 2025] [:error] [pid 13216:tid 13258] [client 20.250.45.203:23872] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/01.php"] [unique_id "aUHFCdkjYVDtADMjze77ngAAAEs"]
[Wed Dec 17 04:46:01.809534 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:28395] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/01.php"] [unique_id "aUHFCbKPEDQzeQkr6QIAHQAAAIA"]
[Wed Dec 17 04:46:02.371985 2025] [:error] [pid 13216:tid 13263] [client 20.250.45.203:29279] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUHFCtkjYVDtADMjze77pgAAAFA"]
[Wed Dec 17 04:46:03.130420 2025] [:error] [pid 13302:tid 13305] [client 20.250.45.203:29311] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUHFCxDfKV-_W5RvJZ9XGAAAAME"]
[Wed Dec 17 04:46:03.734889 2025] [:error] [pid 13302:tid 13320] [client 20.250.45.203:19667] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUHFCxDfKV-_W5RvJZ9XGQAAANA"]
[Wed Dec 17 04:46:04.277562 2025] [:error] [pid 13217:tid 13288] [client 20.250.45.203:23429] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUHFDLKPEDQzeQkr6QIAIQAAAI4"]
[Wed Dec 17 04:46:04.887478 2025] [:error] [pid 13302:tid 13313] [client 20.250.45.203:22268] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aUHFDBDfKV-_W5RvJZ9XHwAAAMk"]
[Wed Dec 17 04:46:05.422340 2025] [:error] [pid 13215:tid 13240] [client 20.250.45.203:21422] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aUHFDXpS_Sk4Oyp_UPEtMwAAABQ"]
[Wed Dec 17 04:46:05.992560 2025] [:error] [pid 13217:tid 13285] [client 20.250.45.203:22574] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aUHFDbKPEDQzeQkr6QIAIgAAAIs"]
[Wed Dec 17 04:46:06.688255 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:24205] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "aUHFDrKPEDQzeQkr6QIAJQAAAJA"]
[Wed Dec 17 04:46:07.388207 2025] [:error] [pid 13217:tid 13287] [client 20.250.45.203:30014] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUHFD7KPEDQzeQkr6QIAJwAAAI0"]
[Wed Dec 17 04:46:07.901608 2025] [:error] [pid 13215:tid 13242] [client 20.250.45.203:28208] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUHFD3pS_Sk4Oyp_UPEtNAAAABY"]
[Wed Dec 17 04:46:08.445052 2025] [:error] [pid 13302:tid 13328] [client 20.250.45.203:26961] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUHFEBDfKV-_W5RvJZ9XNAAAANg"]
[Wed Dec 17 04:46:08.980447 2025] [:error] [pid 13217:tid 13277] [client 20.250.45.203:17216] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUHFELKPEDQzeQkr6QIAKQAAAIQ"]
[Wed Dec 17 04:46:09.630786 2025] [:error] [pid 13302:tid 13315] [client 20.250.45.203:30500] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aUHFERDfKV-_W5RvJZ9XNwAAAMs"]
[Wed Dec 17 04:46:10.385385 2025] [:error] [pid 13302:tid 13313] [client 20.250.45.203:21439] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aUHFEhDfKV-_W5RvJZ9XOgAAAMk"]
[Wed Dec 17 04:46:10.953686 2025] [:error] [pid 13216:tid 13256] [client 20.250.45.203:24779] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aUHFEtkjYVDtADMjze77rwAAAEk"]
[Wed Dec 17 04:46:11.600998 2025] [:error] [pid 13217:tid 13282] [client 20.250.45.203:22549] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aUHFE7KPEDQzeQkr6QIAMgAAAIg"]
[Wed Dec 17 04:46:12.147916 2025] [:error] [pid 13302:tid 13315] [client 20.250.45.203:27894] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUHFFBDfKV-_W5RvJZ9XQAAAAMs"]
[Wed Dec 17 04:46:13.040986 2025] [:error] [pid 13217:tid 13287] [client 20.250.45.203:29264] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUHFFbKPEDQzeQkr6QIANAAAAI0"]
[Wed Dec 17 04:46:13.971903 2025] [:error] [pid 13302:tid 13314] [client 20.250.45.203:17183] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUHFFRDfKV-_W5RvJZ9XRAAAAMo"]
[Wed Dec 17 04:46:14.788810 2025] [:error] [pid 13216:tid 13254] [client 20.250.45.203:26983] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUHFFtkjYVDtADMjze77sAAAAEc"]
[Wed Dec 17 04:46:15.310828 2025] [:error] [pid 13217:tid 13275] [client 20.250.45.203:52347] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUHFF7KPEDQzeQkr6QIAOgAAAIM"]
[Wed Dec 17 04:46:16.085215 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:21432] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUHFGLKPEDQzeQkr6QIAOwAAAJA"]
[Wed Dec 17 04:46:17.018831 2025] [:error] [pid 13217:tid 13277] [client 20.250.45.203:30504] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUHFGbKPEDQzeQkr6QIAPQAAAIQ"]
[Wed Dec 17 04:46:17.914320 2025] [:error] [pid 13216:tid 13255] [client 20.250.45.203:17276] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUHFGdkjYVDtADMjze77tAAAAEg"]
[Wed Dec 17 04:46:18.406838 2025] [:error] [pid 13216:tid 13265] [client 20.250.45.203:23482] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aUHFGtkjYVDtADMjze77uAAAAFE"]
[Wed Dec 17 04:46:19.180869 2025] [:error] [pid 13215:tid 13222] [client 20.250.45.203:26999] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aUHFG3pS_Sk4Oyp_UPEtOQAAAAI"]
[Wed Dec 17 04:46:19.844773 2025] [:error] [pid 13215:tid 13238] [client 20.250.45.203:22538] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aUHFG3pS_Sk4Oyp_UPEtOwAAABI"]
[Wed Dec 17 04:46:20.550305 2025] [:error] [pid 13216:tid 13263] [client 20.250.45.203:28181] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "aUHFHNkjYVDtADMjze77vgAAAFA"]
[Wed Dec 17 04:46:21.127863 2025] [:error] [pid 13216:tid 13276] [client 20.250.45.203:52295] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUHFHdkjYVDtADMjze77vwAAAFg"]
[Wed Dec 17 04:46:21.877015 2025] [:error] [pid 13215:tid 13235] [client 20.250.45.203:21433] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUHFHXpS_Sk4Oyp_UPEtQAAAAA8"]
[Wed Dec 17 04:46:22.376532 2025] [:error] [pid 13217:tid 13289] [client 20.250.45.203:29232] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUHFHrKPEDQzeQkr6QIAQQAAAI8"]
[Wed Dec 17 04:46:23.231398 2025] [:error] [pid 13216:tid 13262] [client 20.250.45.203:24239] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUHFH9kjYVDtADMjze77wAAAAE8"]
[Wed Dec 17 04:46:23.780705 2025] [:error] [pid 13216:tid 13257] [client 20.250.45.203:52324] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUHFH9kjYVDtADMjze77wQAAAEo"]
[Wed Dec 17 04:46:24.561858 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:52336] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUHFILKPEDQzeQkr6QIARAAAAJA"]
[Wed Dec 17 04:46:25.245509 2025] [:error] [pid 13217:tid 13279] [client 20.250.45.203:29241] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUHFIbKPEDQzeQkr6QIARQAAAIU"]
[Wed Dec 17 04:46:25.815999 2025] [:error] [pid 13217:tid 13287] [client 20.250.45.203:19664] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aUHFIbKPEDQzeQkr6QIARwAAAI0"]
[Wed Dec 17 04:46:26.540721 2025] [:error] [pid 13217:tid 13286] [client 20.250.45.203:29215] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUHFIrKPEDQzeQkr6QIASAAAAIw"]
[Wed Dec 17 04:46:27.199118 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:26232] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUHFI7KPEDQzeQkr6QIASQAAAIA"]
[Wed Dec 17 04:46:27.842064 2025] [:error] [pid 13216:tid 13267] [client 20.250.45.203:29642] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUHFI9kjYVDtADMjze77xQAAAFM"]
[Wed Dec 17 04:46:28.314137 2025] [:error] [pid 13302:tid 13313] [client 20.250.45.203:28373] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUHFJBDfKV-_W5RvJZ9XUgAAAMk"]
[Wed Dec 17 04:46:29.022314 2025] [:error] [pid 13215:tid 13221] [client 20.250.45.203:30158] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUHFJXpS_Sk4Oyp_UPEtSgAAAAE"]
[Wed Dec 17 04:46:29.564907 2025] [:error] [pid 13217:tid 13289] [client 20.250.45.203:26207] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUHFJbKPEDQzeQkr6QIATAAAAI8"]
[Wed Dec 17 04:46:30.242795 2025] [:error] [pid 13217:tid 13295] [client 20.250.45.203:30086] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUHFJrKPEDQzeQkr6QIATwAAAJU"]
[Wed Dec 17 04:46:30.842757 2025] [:error] [pid 13217:tid 13291] [client 20.250.45.203:41176] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUHFJrKPEDQzeQkr6QIAUAAAAJE"]
[Wed Dec 17 04:46:31.392564 2025] [:error] [pid 13302:tid 13324] [client 20.250.45.203:51809] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aUHFJxDfKV-_W5RvJZ9XVgAAANQ"]
[Wed Dec 17 04:46:32.097445 2025] [:error] [pid 13217:tid 13280] [client 20.250.45.203:51810] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aUHFKLKPEDQzeQkr6QIAUwAAAIY"]
[Wed Dec 17 04:46:32.654587 2025] [:error] [pid 13217:tid 13273] [client 20.250.45.203:51491] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aUHFKLKPEDQzeQkr6QIAVQAAAII"]
[Wed Dec 17 04:46:33.206983 2025] [:error] [pid 13215:tid 13242] [client 20.250.45.203:8388] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aUHFKXpS_Sk4Oyp_UPEtUgAAABY"]
[Wed Dec 17 04:46:34.210249 2025] [:error] [pid 13216:tid 13265] [client 20.250.45.203:28754] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aUHFKtkjYVDtADMjze77zAAAAFE"]
[Wed Dec 17 04:46:34.784221 2025] [:error] [pid 13217:tid 13286] [client 20.250.45.203:30327] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aUHFKrKPEDQzeQkr6QIAVwAAAIw"]
[Wed Dec 17 04:46:35.523602 2025] [:error] [pid 13302:tid 13309] [client 20.250.45.203:28225] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aUHFKxDfKV-_W5RvJZ9XXwAAAMU"]
[Wed Dec 17 04:46:36.244286 2025] [:error] [pid 13215:tid 13223] [client 20.250.45.203:29939] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "aUHFLHpS_Sk4Oyp_UPEtWAAAAAM"]
[Wed Dec 17 04:46:36.942502 2025] [:error] [pid 13302:tid 13321] [client 20.250.45.203:19227] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUHFLBDfKV-_W5RvJZ9XYgAAANE"]
[Wed Dec 17 04:46:37.860485 2025] [:error] [pid 13215:tid 13231] [client 20.250.45.203:19308] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUHFLXpS_Sk4Oyp_UPEtXAAAAAs"]
[Wed Dec 17 04:46:38.743968 2025] [:error] [pid 13216:tid 13263] [client 20.250.45.203:8710] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUHFLtkjYVDtADMjze77zwAAAFA"]
[Wed Dec 17 04:46:39.557685 2025] [:error] [pid 13302:tid 13311] [client 20.250.45.203:18666] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUHFLxDfKV-_W5RvJZ9XZQAAAMc"]
[Wed Dec 17 04:46:40.327525 2025] [:error] [pid 13215:tid 13220] [client 20.250.45.203:18842] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doti.php"] [unique_id "aUHFMHpS_Sk4Oyp_UPEtYgAAAAA"]
[Wed Dec 17 04:46:41.180349 2025] [:error] [pid 13217:tid 13282] [client 20.250.45.203:18180] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doti.php"] [unique_id "aUHFMbKPEDQzeQkr6QIAWwAAAIg"]
[Wed Dec 17 04:46:41.797635 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:26723] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doti.php"] [unique_id "aUHFMbKPEDQzeQkr6QIAXAAAAJA"]
[Wed Dec 17 04:46:42.386393 2025] [:error] [pid 13302:tid 13312] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/doti.php
[Wed Dec 17 04:46:42.626732 2025] [:error] [pid 13302:tid 13306] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/031.php
[Wed Dec 17 04:46:42.920771 2025] [:error] [pid 13302:tid 13324] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/wfile.php
[Wed Dec 17 04:46:43.160641 2025] [:error] [pid 13302:tid 13314] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Wed Dec 17 04:46:43.400613 2025] [:error] [pid 13302:tid 13316] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Wed Dec 17 04:46:43.639159 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/he.php
[Wed Dec 17 04:46:43.882173 2025] [:error] [pid 13302:tid 13320] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Wed Dec 17 04:46:44.251182 2025] [:error] [pid 13302:tid 13322] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Wed Dec 17 04:46:44.492261 2025] [:error] [pid 13302:tid 13313] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/nfile.php
[Wed Dec 17 04:46:44.730428 2025] [:error] [pid 13302:tid 13312] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Wed Dec 17 04:46:44.969457 2025] [:error] [pid 13302:tid 13317] [client 20.250.45.203:30025] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Wed Dec 17 04:46:45.212155 2025] [:error] [pid 13302:tid 13318] [client 20.250.45.203:30025] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aUHFNRDfKV-_W5RvJZ9XfAAAAM4"]
[Wed Dec 17 04:46:46.099113 2025] [:error] [pid 13216:tid 13263] [client 20.250.45.203:20041] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aUHFNtkjYVDtADMjze772QAAAFA"]
[Wed Dec 17 04:46:46.791017 2025] [:error] [pid 13215:tid 13226] [client 20.250.45.203:29868] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aUHFNnpS_Sk4Oyp_UPEtawAAAAY"]
[Wed Dec 17 04:46:47.831932 2025] [:error] [pid 13302:tid 13323] [client 20.250.45.203:8870] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aUHFNxDfKV-_W5RvJZ9XggAAANM"]
[Wed Dec 17 04:46:48.647929 2025] [:error] [pid 13302:tid 13311] [client 20.250.45.203:21852] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aUHFOBDfKV-_W5RvJZ9XhgAAAMc"]
[Wed Dec 17 04:46:49.277425 2025] [:error] [pid 13216:tid 13249] [client 20.250.45.203:20445] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aUHFOdkjYVDtADMjze773gAAAEI"]
[Wed Dec 17 04:46:49.902012 2025] [:error] [pid 13302:tid 13309] [client 20.250.45.203:21844] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aUHFORDfKV-_W5RvJZ9XiQAAAMU"]
[Wed Dec 17 04:46:50.518239 2025] [:error] [pid 13302:tid 13326] [client 20.250.45.203:21870] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "aUHFOhDfKV-_W5RvJZ9XiwAAANY"]
[Wed Dec 17 04:46:51.112521 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:23214] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUHFOxDfKV-_W5RvJZ9XjgAAAMQ"]
[Wed Dec 17 04:46:51.602100 2025] [:error] [pid 13302:tid 13318] [client 20.250.45.203:29879] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUHFOxDfKV-_W5RvJZ9XkAAAAM4"]
[Wed Dec 17 04:46:52.157169 2025] [:error] [pid 13302:tid 13323] [client 20.250.45.203:21113] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUHFPBDfKV-_W5RvJZ9XkgAAANM"]
[Wed Dec 17 04:46:52.700129 2025] [:error] [pid 13302:tid 13326] [client 20.250.45.203:29322] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUHFPBDfKV-_W5RvJZ9XlAAAANY"]
[Wed Dec 17 04:46:53.328031 2025] [:error] [pid 13217:tid 13283] [client 20.250.45.203:39323] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUHFPbKPEDQzeQkr6QIAYgAAAIk"]
[Wed Dec 17 04:46:54.054252 2025] [:error] [pid 13217:tid 13280] [client 20.250.45.203:29330] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUHFPrKPEDQzeQkr6QIAZAAAAIY"]
[Wed Dec 17 04:46:54.535722 2025] [:error] [pid 13215:tid 13223] [client 20.250.45.203:8193] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUHFPnpS_Sk4Oyp_UPEtbwAAAAM"]
[Wed Dec 17 04:46:55.327901 2025] [:error] [pid 13217:tid 13291] [client 20.250.45.203:23867] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUHFP7KPEDQzeQkr6QIAZgAAAJE"]
[Wed Dec 17 04:46:55.898368 2025] [:error] [pid 13216:tid 13269] [client 20.250.45.203:30245] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aUHFP9kjYVDtADMjze775AAAAFQ"]
[Wed Dec 17 04:46:56.659543 2025] [:error] [pid 13215:tid 13237] [client 20.250.45.203:18180] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aUHFQHpS_Sk4Oyp_UPEtcQAAABE"]
[Wed Dec 17 04:46:57.199924 2025] [:error] [pid 13217:tid 13279] [client 20.250.45.203:21091] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aUHFQbKPEDQzeQkr6QIAagAAAIU"]
[Wed Dec 17 04:46:57.727956 2025] [:error] [pid 13302:tid 13305] [client 20.250.45.203:42074] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aUHFQRDfKV-_W5RvJZ9XnAAAAME"]
[Wed Dec 17 04:46:58.313615 2025] [:error] [pid 13215:tid 13238] [client 20.250.45.203:39347] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aUHFQnpS_Sk4Oyp_UPEtcwAAABI"]
[Wed Dec 17 04:46:58.949288 2025] [:error] [pid 13302:tid 13317] [client 20.250.45.203:30112] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aUHFQhDfKV-_W5RvJZ9XsAAAAM0"]
[Wed Dec 17 04:46:59.721419 2025] [:error] [pid 13215:tid 13244] [client 20.250.45.203:25010] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aUHFQ3pS_Sk4Oyp_UPEtqgAAABg"]
[Wed Dec 17 04:47:00.495304 2025] [:error] [pid 13302:tid 13315] [client 20.250.45.203:8925] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aUHFRBDfKV-_W5RvJZ9XxwAAAMs"]
[Wed Dec 17 04:47:01.230125 2025] [:error] [pid 13215:tid 13223] [client 20.250.45.203:8951] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "aUHFRXpS_Sk4Oyp_UPEttAAAAAM"]
[Wed Dec 17 04:47:01.716176 2025] [:error] [pid 13215:tid 13243] [client 20.250.45.203:25821] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "aUHFRXpS_Sk4Oyp_UPEtuQAAABc"]
[Wed Dec 17 04:47:02.327196 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:33624] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "aUHFRhDfKV-_W5RvJZ9XzQAAAMQ"]
[Wed Dec 17 04:47:02.959039 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:24547] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "aUHFRrKPEDQzeQkr6QIAfwAAAIA"]
[Wed Dec 17 04:47:03.502006 2025] [:error] [pid 13216:tid 13258] [client 20.250.45.203:23852] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aUHFR9kjYVDtADMjze78KQAAAEs"]
[Wed Dec 17 04:47:04.646567 2025] [:error] [pid 13215:tid 13234] [client 20.250.45.203:23841] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aUHFSHpS_Sk4Oyp_UPEtvQAAAA4"]
[Wed Dec 17 04:47:05.862108 2025] [:error] [pid 13215:tid 13241] [client 20.250.45.203:22845] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aUHFSXpS_Sk4Oyp_UPEtvwAAABU"]
[Wed Dec 17 04:47:06.487817 2025] [:error] [pid 13302:tid 13314] [client 20.250.45.203:42681] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aUHFShDfKV-_W5RvJZ9X1gAAAMo"]
[Wed Dec 17 04:47:07.068917 2025] [:error] [pid 13216:tid 13250] [client 20.250.45.203:24767] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUHFS9kjYVDtADMjze78LgAAAEM"]
[Wed Dec 17 04:47:07.616906 2025] [:error] [pid 13215:tid 13237] [client 20.250.45.203:22841] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUHFS3pS_Sk4Oyp_UPEtwQAAABE"]
[Wed Dec 17 04:47:08.324457 2025] [:error] [pid 13302:tid 13325] [client 20.250.45.203:42648] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUHFTBDfKV-_W5RvJZ9X2QAAANU"]
[Wed Dec 17 04:47:09.119728 2025] [:error] [pid 13302:tid 13307] [client 20.250.45.203:42644] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUHFTRDfKV-_W5RvJZ9X3AAAAMM"]
[Wed Dec 17 04:47:09.761055 2025] [:error] [pid 13215:tid 13232] [client 20.250.45.203:8938] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aUHFTXpS_Sk4Oyp_UPEtzAAAAAw"]
[Wed Dec 17 04:47:10.536626 2025] [:error] [pid 13302:tid 13327] [client 20.250.45.203:25440] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aUHFThDfKV-_W5RvJZ9X3wAAANc"]
[Wed Dec 17 04:47:11.120105 2025] [:error] [pid 13215:tid 13235] [client 20.250.45.203:25142] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aUHFT3pS_Sk4Oyp_UPEt0QAAAA8"]
[Wed Dec 17 04:47:11.961397 2025] [:error] [pid 13215:tid 13238] [client 20.250.45.203:25446] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aUHFT3pS_Sk4Oyp_UPEt1AAAABI"]
[Wed Dec 17 04:47:12.618922 2025] [:error] [pid 13215:tid 13242] [client 20.250.45.203:8984] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUHFUHpS_Sk4Oyp_UPEt2AAAABY"]
[Wed Dec 17 04:47:13.175752 2025] [:error] [pid 13302:tid 13325] [client 20.250.45.203:24992] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUHFURDfKV-_W5RvJZ9X5QAAANU"]
[Wed Dec 17 04:47:13.687517 2025] [:error] [pid 13217:tid 13292] [client 20.250.45.203:42649] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUHFUbKPEDQzeQkr6QIAmAAAAJI"]
[Wed Dec 17 04:47:14.291094 2025] [:error] [pid 13302:tid 13310] [client 20.250.45.203:25486] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUHFUhDfKV-_W5RvJZ9X6QAAAMY"]
[Wed Dec 17 04:47:15.011166 2025] [:error] [pid 13302:tid 13327] [client 20.250.45.203:8982] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aUHFUxDfKV-_W5RvJZ9X7AAAANc"]
[Wed Dec 17 04:47:15.832626 2025] [:error] [pid 13302:tid 13306] [client 20.250.45.203:25518] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aUHFUxDfKV-_W5RvJZ9X7gAAAMI"]
[Wed Dec 17 04:47:16.592165 2025] [:error] [pid 13216:tid 13247] [client 20.250.45.203:20747] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aUHFVNkjYVDtADMjze78PAAAAEA"]
[Wed Dec 17 04:47:17.498033 2025] [:error] [pid 13215:tid 13235] [client 20.250.45.203:25464] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aUHFVXpS_Sk4Oyp_UPEt3QAAAA8"]
[Wed Dec 17 04:47:18.610379 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:24972] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUHFVhDfKV-_W5RvJZ9X8wAAAMQ"]
[Wed Dec 17 04:47:19.249461 2025] [:error] [pid 13302:tid 13305] [client 20.250.45.203:8525] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUHFVxDfKV-_W5RvJZ9X9gAAAME"]
[Wed Dec 17 04:47:19.794344 2025] [:error] [pid 13216:tid 13253] [client 20.250.45.203:8999] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUHFV9kjYVDtADMjze78QQAAAEY"]
[Wed Dec 17 04:47:20.497775 2025] [:error] [pid 13302:tid 13311] [client 20.250.45.203:26315] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUHFWBDfKV-_W5RvJZ9X-wAAAMc"]
[Wed Dec 17 04:47:21.026334 2025] [:error] [pid 13216:tid 13251] [client 20.250.45.203:25525] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUHFWdkjYVDtADMjze78RAAAAEQ"]
[Wed Dec 17 04:47:21.546942 2025] [:error] [pid 13302:tid 13307] [client 20.250.45.203:30265] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUHFWRDfKV-_W5RvJZ9YAAAAAMM"]
[Wed Dec 17 04:47:22.143486 2025] [:error] [pid 13302:tid 13314] [client 20.250.45.203:27421] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUHFWhDfKV-_W5RvJZ9YAwAAAMo"]
[Wed Dec 17 04:47:23.090384 2025] [:error] [pid 13216:tid 13257] [client 20.250.45.203:20780] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUHFW9kjYVDtADMjze78SgAAAEo"]
[Wed Dec 17 04:47:23.620699 2025] [:error] [pid 13302:tid 13318] [client 20.250.45.203:8651] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/030.php"] [unique_id "aUHFWxDfKV-_W5RvJZ9YCwAAAM4"]
[Wed Dec 17 04:47:24.709007 2025] [:error] [pid 13216:tid 13251] [client 20.250.45.203:27849] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/030.php"] [unique_id "aUHFXNkjYVDtADMjze78UgAAAEQ"]
[Wed Dec 17 04:47:25.602139 2025] [:error] [pid 13217:tid 13290] [client 20.250.45.203:25437] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/030.php"] [unique_id "aUHFXbKPEDQzeQkr6QIAnwAAAJA"]
[Wed Dec 17 04:47:26.203327 2025] [:error] [pid 13302:tid 13322] [client 20.250.45.203:8560] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/030.php"] [unique_id "aUHFXhDfKV-_W5RvJZ9YGgAAANI"]
[Wed Dec 17 04:47:27.061836 2025] [:error] [pid 13215:tid 13230] [client 20.250.45.203:25421] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haa.php"] [unique_id "aUHFX3pS_Sk4Oyp_UPEt5wAAAAo"]
[Wed Dec 17 04:47:27.783612 2025] [:error] [pid 13215:tid 13244] [client 20.250.45.203:21836] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haa.php"] [unique_id "aUHFX3pS_Sk4Oyp_UPEt6AAAABg"]
[Wed Dec 17 04:47:28.389589 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:20736] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haa.php"] [unique_id "aUHFYLKPEDQzeQkr6QIApgAAAIA"]
[Wed Dec 17 04:47:29.105768 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:25471] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haa.php"] [unique_id "aUHFYRDfKV-_W5RvJZ9YJwAAAMQ"]
[Wed Dec 17 04:47:29.935258 2025] [:error] [pid 13302:tid 13306] [client 20.250.45.203:20777] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aUHFYRDfKV-_W5RvJZ9YKAAAAMI"]
[Wed Dec 17 04:47:30.902244 2025] [:error] [pid 13302:tid 13326] [client 20.250.45.203:8666] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aUHFYhDfKV-_W5RvJZ9YLAAAANY"]
[Wed Dec 17 04:47:31.498345 2025] [:error] [pid 13215:tid 13221] [client 20.250.45.203:24557] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aUHFY3pS_Sk4Oyp_UPEt7gAAAAE"]
[Wed Dec 17 04:47:32.322714 2025] [:error] [pid 13216:tid 13276] [client 20.250.45.203:25178] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsox.php"] [unique_id "aUHFZNkjYVDtADMjze78WQAAAFg"]
[Wed Dec 17 04:47:33.307424 2025] [:error] [pid 13302:tid 13316] [client 20.250.45.203:30259] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aUHFZRDfKV-_W5RvJZ9YNAAAAMw"]
[Wed Dec 17 04:47:34.292276 2025] [:error] [pid 13302:tid 13318] [client 20.250.45.203:27879] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aUHFZhDfKV-_W5RvJZ9YOQAAAM4"]
[Wed Dec 17 04:47:34.939226 2025] [:error] [pid 13216:tid 13248] [client 20.250.45.203:17183] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aUHFZtkjYVDtADMjze78YgAAAEE"]
[Wed Dec 17 04:47:35.548003 2025] [:error] [pid 13302:tid 13316] [client 20.250.45.203:26309] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aUHFZxDfKV-_W5RvJZ9YPAAAAMw"]
[Wed Dec 17 04:47:36.302293 2025] [:error] [pid 13302:tid 13313] [client 20.250.45.203:27440] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aUHFaBDfKV-_W5RvJZ9YQgAAAMk"]
[Wed Dec 17 04:47:36.849611 2025] [:error] [pid 13216:tid 13252] [client 20.250.45.203:17211] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aUHFaNkjYVDtADMjze78ZwAAAEU"]
[Wed Dec 17 04:47:37.625481 2025] [:error] [pid 13217:tid 13280] [client 20.250.45.203:27885] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aUHFabKPEDQzeQkr6QIAsgAAAIY"]
[Wed Dec 17 04:47:38.232338 2025] [:error] [pid 13216:tid 13276] [client 20.250.45.203:30045] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aUHFatkjYVDtADMjze78aQAAAFg"]
[Wed Dec 17 04:47:39.231953 2025] [:error] [pid 13216:tid 13251] [client 20.250.45.203:30046] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aUHFa9kjYVDtADMjze78awAAAEQ"]
[Wed Dec 17 04:47:40.352678 2025] [:error] [pid 13216:tid 13262] [client 20.250.45.203:26703] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aUHFbNkjYVDtADMjze78bwAAAE8"]
[Wed Dec 17 04:47:41.009120 2025] [:error] [pid 13302:tid 13305] [client 20.250.45.203:26711] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aUHFbRDfKV-_W5RvJZ9YTQAAAME"]
[Wed Dec 17 04:47:41.860753 2025] [:error] [pid 13215:tid 13221] [client 20.250.45.203:9154] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aUHFbXpS_Sk4Oyp_UPEt9gAAAAE"]
[Wed Dec 17 04:47:42.701171 2025] [:error] [pid 13217:tid 13280] [client 20.250.45.203:22198] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aUHFbrKPEDQzeQkr6QIAwwAAAIY"]
[Wed Dec 17 04:47:43.349383 2025] [:error] [pid 13215:tid 13234] [client 20.250.45.203:9195] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aUHFb3pS_Sk4Oyp_UPEt-AAAAA4"]
[Wed Dec 17 04:47:44.551811 2025] [:error] [pid 13216:tid 13272] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/alpa.php
[Wed Dec 17 04:47:44.804261 2025] [:error] [pid 13216:tid 13250] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/finny.php
[Wed Dec 17 04:47:45.091800 2025] [:error] [pid 13216:tid 13262] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/file15.php
[Wed Dec 17 04:47:45.331744 2025] [:error] [pid 13216:tid 13249] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/0x0x.php
[Wed Dec 17 04:47:45.579249 2025] [:error] [pid 13216:tid 13254] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Wed Dec 17 04:47:45.818897 2025] [:error] [pid 13216:tid 13263] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Wed Dec 17 04:47:46.072679 2025] [:error] [pid 13216:tid 13256] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Wed Dec 17 04:47:46.310828 2025] [:error] [pid 13216:tid 13255] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/ilex.php
[Wed Dec 17 04:47:46.663236 2025] [:error] [pid 13216:tid 13251] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/tor.php
[Wed Dec 17 04:47:46.902603 2025] [:error] [pid 13216:tid 13261] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/klex.php
[Wed Dec 17 04:47:47.326955 2025] [:error] [pid 13216:tid 13272] [client 20.250.45.203:26303] File does not exist: /usr/local/apache/htdocs/suspended-page/htaccess.php
[Wed Dec 17 04:47:47.562225 2025] [:error] [pid 13216:tid 13274] [client 20.250.45.203:26303] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUHFc9kjYVDtADMjze78iQAAAFc"]
[Wed Dec 17 04:47:48.195770 2025] [:error] [pid 13216:tid 13252] [client 20.250.45.203:26232] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUHFdNkjYVDtADMjze78igAAAEU"]
[Wed Dec 17 04:47:49.292144 2025] [:error] [pid 13215:tid 13239] [client 20.250.45.203:41510] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUHFdXpS_Sk4Oyp_UPEuBwAAABM"]
[Wed Dec 17 04:47:50.393026 2025] [:error] [pid 13217:tid 13273] [client 20.250.45.203:23556] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUHFdrKPEDQzeQkr6QIA0AAAAII"]
[Wed Dec 17 04:47:51.040880 2025] [:error] [pid 13217:tid 13296] [client 20.250.45.203:9052] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUHFd7KPEDQzeQkr6QIA0gAAAJY"]
[Wed Dec 17 04:47:52.107091 2025] [:error] [pid 13216:tid 13247] [client 20.250.45.203:41475] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUHFeNkjYVDtADMjze78jQAAAEA"]
[Wed Dec 17 04:47:52.647422 2025] [:error] [pid 13215:tid 13233] [client 20.250.45.203:8249] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUHFeHpS_Sk4Oyp_UPEuEAAAAA0"]
[Wed Dec 17 04:47:53.279865 2025] [:error] [pid 13216:tid 13267] [client 20.250.45.203:8221] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUHFedkjYVDtADMjze78jwAAAFM"]
[Wed Dec 17 04:47:54.087442 2025] [:error] [pid 13216:tid 13262] [client 20.250.45.203:8819] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUHFetkjYVDtADMjze78kQAAAE8"]
[Wed Dec 17 04:47:55.032937 2025] [:error] [pid 13216:tid 13254] [client 20.250.45.203:8614] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUHFe9kjYVDtADMjze78kwAAAEc"]
[Wed Dec 17 04:47:55.861517 2025] [:error] [pid 13216:tid 13253] [client 20.250.45.203:8270] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUHFe9kjYVDtADMjze78mQAAAEY"]
[Wed Dec 17 04:47:56.390139 2025] [:error] [pid 13217:tid 13284] [client 20.250.45.203:23585] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUHFfLKPEDQzeQkr6QIA5QAAAIo"]
[Wed Dec 17 04:47:56.925398 2025] [:error] [pid 13216:tid 13266] [client 20.250.45.203:41476] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "aUHFfNkjYVDtADMjze78nQAAAFI"]
[Wed Dec 17 04:47:57.603818 2025] [:error] [pid 13215:tid 13235] [client 20.250.45.203:8789] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "aUHFfXpS_Sk4Oyp_UPEuFgAAAA8"]
[Wed Dec 17 04:47:58.372967 2025] [:error] [pid 13216:tid 13262] [client 20.250.45.203:8633] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "aUHFftkjYVDtADMjze78ogAAAE8"]
[Wed Dec 17 04:47:59.026622 2025] [:error] [pid 13215:tid 13244] [client 20.250.45.203:8244] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "aUHFf3pS_Sk4Oyp_UPEuHAAAABg"]
[Wed Dec 17 04:47:59.849451 2025] [:error] [pid 13302:tid 13311] [client 20.250.45.203:30110] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fdd2.php"] [unique_id "aUHFfxDfKV-_W5RvJZ9YaQAAAMc"]
[Wed Dec 17 04:48:00.566566 2025] [:error] [pid 13215:tid 13238] [client 20.250.45.203:27325] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fdd2.php"] [unique_id "aUHFgHpS_Sk4Oyp_UPEuHwAAABI"]
[Wed Dec 17 04:48:01.213182 2025] [:error] [pid 13215:tid 13220] [client 20.250.45.203:8200] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fdd2.php"] [unique_id "aUHFgXpS_Sk4Oyp_UPEuIQAAAAA"]
[Wed Dec 17 04:48:01.782011 2025] [:error] [pid 13302:tid 13314] [client 20.250.45.203:25585] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fdd2.php"] [unique_id "aUHFgRDfKV-_W5RvJZ9YawAAAMo"]
[Wed Dec 17 04:48:02.644668 2025] [:error] [pid 13302:tid 13316] [client 20.250.45.203:25560] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUHFghDfKV-_W5RvJZ9YbQAAAMw"]
[Wed Dec 17 04:48:03.275612 2025] [:error] [pid 13217:tid 13293] [client 20.250.45.203:8256] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUHFg7KPEDQzeQkr6QIA9AAAAJM"]
[Wed Dec 17 04:48:04.136293 2025] [:error] [pid 13302:tid 13323] [client 20.250.45.203:27516] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUHFhBDfKV-_W5RvJZ9YcwAAANM"]
[Wed Dec 17 04:48:04.715278 2025] [:error] [pid 13215:tid 13243] [client 20.250.45.203:9082] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUHFhHpS_Sk4Oyp_UPEuKQAAABc"]
[Wed Dec 17 04:48:05.808082 2025] [:error] [pid 13215:tid 13220] [client 20.250.45.203:29048] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aUHFhXpS_Sk4Oyp_UPEuLAAAAAA"]
[Wed Dec 17 04:48:06.443155 2025] [:error] [pid 13302:tid 13311] [client 20.250.45.203:25576] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aUHFhhDfKV-_W5RvJZ9YeAAAAMc"]
[Wed Dec 17 04:48:06.987132 2025] [:error] [pid 13216:tid 13254] [client 20.250.45.203:8607] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aUHFhtkjYVDtADMjze78sQAAAEc"]
[Wed Dec 17 04:48:07.587368 2025] [:error] [pid 13215:tid 13226] [client 20.250.45.203:29031] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sto.php"] [unique_id "aUHFh3pS_Sk4Oyp_UPEuLgAAAAY"]
[Wed Dec 17 04:48:08.789284 2025] [:error] [pid 13216:tid 13252] [client 20.250.45.203:27297] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7h.php"] [unique_id "aUHFiNkjYVDtADMjze78tAAAAEU"]
[Wed Dec 17 04:48:10.192519 2025] [:error] [pid 13217:tid 13275] [client 20.250.45.203:30363] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7h.php"] [unique_id "aUHFirKPEDQzeQkr6QIBAwAAAIM"]
[Wed Dec 17 04:48:10.805002 2025] [:error] [pid 13302:tid 13306] [client 20.250.45.203:27519] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7h.php"] [unique_id "aUHFihDfKV-_W5RvJZ9YjAAAAMI"]
[Wed Dec 17 04:48:11.351414 2025] [:error] [pid 13302:tid 13328] [client 20.250.45.203:8258] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7h.php"] [unique_id "aUHFixDfKV-_W5RvJZ9YkgAAANg"]
[Wed Dec 17 04:48:11.955811 2025] [:error] [pid 13302:tid 13324] [client 20.250.45.203:25592] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fh26.php"] [unique_id "aUHFixDfKV-_W5RvJZ9YlwAAANQ"]
[Wed Dec 17 04:48:12.637015 2025] [:error] [pid 13302:tid 13311] [client 20.250.45.203:8306] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fh26.php"] [unique_id "aUHFjBDfKV-_W5RvJZ9YmwAAAMc"]
[Wed Dec 17 04:48:13.400545 2025] [:error] [pid 13215:tid 13237] [client 20.250.45.203:28997] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fh26.php"] [unique_id "aUHFjXpS_Sk4Oyp_UPEuNQAAABE"]
[Wed Dec 17 04:48:13.987489 2025] [:error] [pid 13302:tid 13323] [client 20.250.45.203:8290] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fh26.php"] [unique_id "aUHFjRDfKV-_W5RvJZ9YowAAANM"]
[Wed Dec 17 04:48:14.599789 2025] [:error] [pid 13216:tid 13271] [client 20.250.45.203:17904] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ixj.php"] [unique_id "aUHFjtkjYVDtADMjze78vAAAAFU"]
[Wed Dec 17 04:48:15.187418 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:29054] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ixj.php"] [unique_id "aUHFj7KPEDQzeQkr6QIBCAAAAIA"]
[Wed Dec 17 04:48:15.928171 2025] [:error] [pid 13302:tid 13326] [client 20.250.45.203:51999] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ixj.php"] [unique_id "aUHFjxDfKV-_W5RvJZ9YrgAAANY"]
[Wed Dec 17 04:48:16.657593 2025] [:error] [pid 13216:tid 13253] [client 20.250.45.203:18818] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ixj.php"] [unique_id "aUHFkNkjYVDtADMjze78wwAAAEY"]
[Wed Dec 17 04:48:17.305462 2025] [:error] [pid 13215:tid 13235] [client 20.250.45.203:42302] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x23.php"] [unique_id "aUHFkXpS_Sk4Oyp_UPEuOAAAAA8"]
[Wed Dec 17 04:48:17.883634 2025] [:error] [pid 13215:tid 13225] [client 20.250.45.203:23234] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x23.php"] [unique_id "aUHFkXpS_Sk4Oyp_UPEuOgAAAAU"]
[Wed Dec 17 04:48:18.593161 2025] [:error] [pid 13217:tid 13280] [client 20.250.45.203:8714] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x23.php"] [unique_id "aUHFkrKPEDQzeQkr6QIBFQAAAIY"]
[Wed Dec 17 04:48:19.358371 2025] [:error] [pid 13217:tid 13268] [client 20.250.45.203:18195] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x23.php"] [unique_id "aUHFk7KPEDQzeQkr6QIBFwAAAIA"]
[Wed Dec 17 04:48:20.063072 2025] [:error] [pid 13302:tid 13310] [client 20.250.45.203:23270] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xs.php"] [unique_id "aUHFlBDfKV-_W5RvJZ9YvwAAAMY"]
[Wed Dec 17 04:48:20.725858 2025] [:error] [pid 13217:tid 13270] [client 20.250.45.203:17858] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xs.php"] [unique_id "aUHFlLKPEDQzeQkr6QIBHAAAAIE"]
[Wed Dec 17 04:48:21.247812 2025] [:error] [pid 13217:tid 13281] [client 20.250.45.203:41764] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xs.php"] [unique_id "aUHFlbKPEDQzeQkr6QIBHwAAAIc"]
[Wed Dec 17 04:48:21.829487 2025] [:error] [pid 13217:tid 13292] [client 20.250.45.203:18220] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xs.php"] [unique_id "aUHFlbKPEDQzeQkr6QIBIAAAAJI"]
[Wed Dec 17 04:48:22.471282 2025] [:error] [pid 13215:tid 13229] [client 20.250.45.203:23269] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Zeiss.php"] [unique_id "aUHFlnpS_Sk4Oyp_UPEuQgAAAAk"]
[Wed Dec 17 04:48:23.516826 2025] [:error] [pid 13302:tid 13307] [client 20.250.45.203:17887] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Zeiss.php"] [unique_id "aUHFlxDfKV-_W5RvJZ9YxAAAAMM"]
[Wed Dec 17 04:48:24.492920 2025] [:error] [pid 13216:tid 13272] [client 20.250.45.203:26629] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Zeiss.php"] [unique_id "aUHFmNkjYVDtADMjze780AAAAFY"]
[Wed Dec 17 04:48:25.691354 2025] [:error] [pid 13302:tid 13307] [client 20.250.45.203:8759] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Zeiss.php"] [unique_id "aUHFmRDfKV-_W5RvJZ9YzQAAAMM"]
[Wed Dec 17 04:48:26.455364 2025] [:error] [pid 13217:tid 13283] [client 20.250.45.203:23278] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0x.php"] [unique_id "aUHFmrKPEDQzeQkr6QIBJQAAAIk"]
[Wed Dec 17 04:48:27.461864 2025] [:error] [pid 13217:tid 13291] [client 20.250.45.203:28427] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0x.php"] [unique_id "aUHFm7KPEDQzeQkr6QIBKAAAAJE"]
[Wed Dec 17 04:48:28.065578 2025] [:error] [pid 13302:tid 13321] [client 20.250.45.203:8194] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0x.php"] [unique_id "aUHFnBDfKV-_W5RvJZ9Y1QAAANE"]
[Wed Dec 17 04:48:28.679424 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:42280] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0x.php"] [unique_id "aUHFnBDfKV-_W5RvJZ9Y2QAAAMQ"]
[Wed Dec 17 04:48:29.432814 2025] [:error] [pid 13216:tid 13255] [client 20.250.45.203:42268] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adin.php"] [unique_id "aUHFndkjYVDtADMjze782wAAAEg"]
[Wed Dec 17 04:48:29.977002 2025] [:error] [pid 13216:tid 13259] [client 20.250.45.203:8745] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adin.php"] [unique_id "aUHFndkjYVDtADMjze783QAAAEw"]
[Wed Dec 17 04:48:30.613366 2025] [:error] [pid 13216:tid 13272] [client 20.250.45.203:25557] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adin.php"] [unique_id "aUHFntkjYVDtADMjze783wAAAFY"]
[Wed Dec 17 04:48:31.361204 2025] [:error] [pid 13302:tid 13315] [client 20.250.45.203:23254] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adin.php"] [unique_id "aUHFnxDfKV-_W5RvJZ9Y5AAAAMs"]
[Wed Dec 17 04:48:32.213654 2025] [:error] [pid 13302:tid 13308] [client 20.250.45.203:19209] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUHFoBDfKV-_W5RvJZ9Y5gAAAMQ"]
[Wed Dec 17 04:48:33.457179 2025] [:error] [pid 13302:tid 13309] [client 20.250.45.203:8715] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUHFoRDfKV-_W5RvJZ9Y5wAAAMU"]
[Wed Dec 17 04:48:34.419447 2025] [:error] [pid 13217:tid 13279] [client 20.250.45.203:18871] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUHForKPEDQzeQkr6QIBQAAAAIU"]
[Wed Dec 17 04:48:35.359863 2025] [:error] [pid 13216:tid 13271] [client 20.250.45.203:33288] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUHFo9kjYVDtADMjze787gAAAFU"]
[Wed Dec 17 04:48:36.251391 2025] [:error] [pid 13302:tid 13304] [client 20.250.45.203:28459] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUHFpBDfKV-_W5RvJZ9Y7wAAAMA"]
[Wed Dec 17 04:48:37.433276 2025] [:error] [pid 13215:tid 13226] [client 20.250.45.203:42293] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUHFpXpS_Sk4Oyp_UPEuXgAAAAY"]
[Wed Dec 17 04:48:39.007896 2025] [:error] [pid 13215:tid 13225] [client 20.250.45.203:26675] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUHFp3pS_Sk4Oyp_UPEuZAAAAAU"]
[Wed Dec 17 04:48:40.289529 2025] [:error] [pid 13215:tid 13237] [client 20.250.45.203:8758] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUHFqHpS_Sk4Oyp_UPEuZgAAABE"]
[Wed Dec 17 04:48:40.927485 2025] [:error] [pid 13302:tid 13304] [client 20.250.45.203:26663] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUHFqBDfKV-_W5RvJZ9ZBAAAAMA"]
[Wed Dec 17 04:48:41.723156 2025] [:error] [pid 13216:tid 13258] [client 20.250.45.203:28695] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUHFqdkjYVDtADMjze78-wAAAEs"]
[Wed Dec 17 04:48:42.395849 2025] [:error] [pid 13217:tid 13284] [client 20.250.45.203:51974] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUHFqrKPEDQzeQkr6QIBWAAAAIo"]
[Wed Dec 17 04:48:43.062107 2025] [:error] [pid 13302:tid 13323] [client 20.250.45.203:8731] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUHFqxDfKV-_W5RvJZ9ZCgAAANM"]
[Wed Dec 17 04:48:43.753580 2025] [:error] [pid 13216:tid 13272] [client 20.250.45.203:19217] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUHFq9kjYVDtADMjze79AgAAAFY"]
[Wed Dec 17 04:48:44.457789 2025] [:error] [pid 13217:tid 13283] [client 20.250.45.203:28460] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUHFrLKPEDQzeQkr6QIBWgAAAIk"]
[Wed Dec 17 04:48:45.181277 2025] [:error] [pid 13215:tid 13223] [client 20.250.45.203:26669] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUHFrXpS_Sk4Oyp_UPEubAAAAAM"]
[Wed Dec 17 04:48:45.987714 2025] [:error] [pid 13217:tid 13288] [client 20.250.45.203:8874] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUHFrbKPEDQzeQkr6QIBXAAAAI4"]
[Wed Dec 17 04:48:46.651187 2025] [:error] [pid 13216:tid 13261] [client 20.250.45.203:19271] [client 20.250.45.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUHFrtkjYVDtADMjze79CwAAAE4"]
[Wed Dec 17 04:48:47.720746 2025] [:error] [pid 13302:tid 13309] [client 20.250.45.203:17805] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Dec 17 11:35:39.027110 2025] [:error] [pid 45531:tid 45587] [client 45.130.203.149:54375] [client 45.130.203.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aUIlC4juE-Fd-sBWjvXPzQAAAFg"]
[Wed Dec 17 11:35:40.067201 2025] [:error] [pid 45532:tid 45602] [client 45.130.203.144:60699] [client 45.130.203.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aUIlDAeWB-JXOyTKNs2B7QAAAIw"]
[Wed Dec 17 12:42:40.367649 2025] [:error] [pid 45621:tid 45639] [client 98.159.37.247:21349] [client 98.159.37.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.247, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUI0wOVNGQfJ1rR90pSzsAAAAM0"]
[Wed Dec 17 12:42:40.371257 2025] [:error] [pid 45621:tid 45639] [client 98.159.37.247:21349] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Dec 17 13:12:48.827628 2025] [:error] [pid 11733:tid 11743] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-729.php
[Wed Dec 17 13:12:48.963990 2025] [:error] [pid 11733:tid 11735] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Wed Dec 17 13:12:49.088722 2025] [:error] [pid 11733:tid 11759] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Wed Dec 17 13:12:49.215125 2025] [:error] [pid 11733:tid 11740] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/tesTyuj.php
[Wed Dec 17 13:12:49.354311 2025] [:error] [pid 11733:tid 11746] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Wed Dec 17 13:12:49.484203 2025] [:error] [pid 11733:tid 11757] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Dec 17 13:12:49.620719 2025] [:error] [pid 11733:tid 11752] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/ww3.php
[Wed Dec 17 13:12:49.751814 2025] [:error] [pid 11733:tid 11754] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Wed Dec 17 13:12:50.015287 2025] [:error] [pid 11733:tid 11756] [client 4.190.206.155:2558] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-64wscx6shd.php
[Wed Dec 17 13:12:50.267500 2025] [:error] [pid 11733:tid 11739] [client 4.190.206.155:2558] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUI70jzmtBRXExJb1PFyzAAAAQQ"]
[Wed Dec 17 13:12:53.925235 2025] [:error] [pid 45532:tid 45594] [client 4.190.206.155:25737] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUI71QeWB-JXOyTKNs2prwAAAIQ"]
[Wed Dec 17 13:12:55.876098 2025] [:error] [pid 11733:tid 11742] [client 4.190.206.155:33089] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUI71zzmtBRXExJb1PFy3QAAAQc"]
[Wed Dec 17 13:12:58.531113 2025] [:error] [pid 45621:tid 45646] [client 4.190.206.155:16338] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUI72uVNGQfJ1rR90pS_uQAAANQ"]
[Wed Dec 17 13:13:01.285042 2025] [:error] [pid 45621:tid 45649] [client 4.190.206.155:25008] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUI73eVNGQfJ1rR90pS_vgAAANc"]
[Wed Dec 17 13:13:03.462417 2025] [:error] [pid 45530:tid 45550] [client 4.190.206.155:2920] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUI7324IsXcKlf7LWf9JpwAAAA8"]
[Wed Dec 17 13:13:06.446049 2025] [:error] [pid 45532:tid 45602] [client 4.190.206.155:16348] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUI74geWB-JXOyTKNs2ptgAAAIw"]
[Wed Dec 17 13:13:11.887388 2025] [:error] [pid 45532:tid 45613] [client 4.190.206.155:25004] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUI75weWB-JXOyTKNs2puwAAAJc"]
[Wed Dec 17 13:13:15.893732 2025] [:error] [pid 45531:tid 45564] [client 4.190.206.155:23599] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUI764juE-Fd-sBWjvXvqwAAAEE"]
[Wed Dec 17 13:13:18.420586 2025] [:error] [pid 45532:tid 45605] [client 4.190.206.155:25539] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUI77geWB-JXOyTKNs2pwAAAAI8"]
[Wed Dec 17 13:13:19.673329 2025] [:error] [pid 45621:tid 45632] [client 4.190.206.155:24133] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUI77-VNGQfJ1rR90pS_1QAAAMY"]
[Wed Dec 17 13:13:21.611560 2025] [:error] [pid 45531:tid 45572] [client 4.190.206.155:25784] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUI78YjuE-Fd-sBWjvXvsgAAAEk"]
[Wed Dec 17 13:13:23.272686 2025] [:error] [pid 45621:tid 45644] [client 4.190.206.155:15838] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUI78-VNGQfJ1rR90pS_3QAAANI"]
[Wed Dec 17 13:13:24.176027 2025] [:error] [pid 45621:tid 45628] [client 4.190.206.155:24188] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUI79OVNGQfJ1rR90pS_3gAAAMI"]
[Wed Dec 17 13:13:26.676690 2025] [:error] [pid 45621:tid 45641] [client 4.190.206.155:24137] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUI79uVNGQfJ1rR90pS_4gAAAM8"]
[Wed Dec 17 13:13:28.302424 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:24960] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUI7-DzmtBRXExJb1PFy-QAAAQI"]
[Wed Dec 17 13:13:30.698878 2025] [:error] [pid 45532:tid 45597] [client 4.190.206.155:33059] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUI7-geWB-JXOyTKNs2p0QAAAIc"]
[Wed Dec 17 13:13:32.723353 2025] [:error] [pid 45531:tid 45576] [client 4.190.206.155:24158] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUI7_IjuE-Fd-sBWjvXvwgAAAE0"]
[Wed Dec 17 13:13:33.745600 2025] [:error] [pid 45532:tid 45598] [client 4.190.206.155:27705] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUI7_QeWB-JXOyTKNs2p2gAAAIg"]
[Wed Dec 17 13:13:35.288565 2025] [:error] [pid 45531:tid 45564] [client 4.190.206.155:24182] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUI7_4juE-Fd-sBWjvXvzgAAAEE"]
[Wed Dec 17 13:13:37.441695 2025] [:error] [pid 45621:tid 45632] [client 4.190.206.155:27683] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUI8AeVNGQfJ1rR90pS_8gAAAMY"]
[Wed Dec 17 13:13:39.945682 2025] [:error] [pid 45532:tid 45610] [client 4.190.206.155:16052] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUI8AweWB-JXOyTKNs2p6gAAAJQ"]
[Wed Dec 17 13:13:43.031299 2025] [:error] [pid 45530:tid 45548] [client 4.190.206.155:32724] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUI8B24IsXcKlf7LWf9J-AAAAA0"]
[Wed Dec 17 13:13:46.026916 2025] [:error] [pid 45532:tid 45590] [client 4.190.206.155:26361] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUI8CgeWB-JXOyTKNs2p7wAAAIA"]
[Wed Dec 17 13:13:50.381145 2025] [:error] [pid 45530:tid 45550] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Wed Dec 17 13:13:50.522913 2025] [:error] [pid 45530:tid 45552] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-home.php
[Wed Dec 17 13:13:50.653603 2025] [:error] [pid 45530:tid 45559] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/re.php
[Wed Dec 17 13:13:50.777576 2025] [:error] [pid 45530:tid 45551] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/atex1.php
[Wed Dec 17 13:13:50.929270 2025] [:error] [pid 45530:tid 45539] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/kdgok.php
[Wed Dec 17 13:13:51.054923 2025] [:error] [pid 45530:tid 45537] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Wed Dec 17 13:13:51.195265 2025] [:error] [pid 45530:tid 45543] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Dec 17 13:13:51.321564 2025] [:error] [pid 45530:tid 45544] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/sid-file.php
[Wed Dec 17 13:13:51.451853 2025] [:error] [pid 45530:tid 45548] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/l3gi0n.php
[Wed Dec 17 13:13:52.574920 2025] [:error] [pid 45530:tid 45541] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Wed Dec 17 13:13:52.698967 2025] [:error] [pid 45530:tid 45557] [client 4.190.206.155:27680] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Wed Dec 17 13:13:52.820897 2025] [:error] [pid 45530:tid 45553] [client 4.190.206.155:27680] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aUI8EG4IsXcKlf7LWf9KHAAAABI"]
[Wed Dec 17 13:13:53.950907 2025] [:error] [pid 45621:tid 45635] [client 4.190.206.155:32766] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aUI8EeVNGQfJ1rR90pTAEwAAAMk"]
[Wed Dec 17 13:13:56.542966 2025] [:error] [pid 45530:tid 45554] [client 4.190.206.155:16046] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aUI8FG4IsXcKlf7LWf9KKAAAABM"]
[Wed Dec 17 13:13:59.706413 2025] [:error] [pid 45531:tid 45575] [client 4.190.206.155:2644] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aUI8F4juE-Fd-sBWjvXv-gAAAEw"]
[Wed Dec 17 13:14:00.250105 2025] [:error] [pid 45621:tid 45635] [client 4.190.206.155:25545] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUI8GOVNGQfJ1rR90pTAIAAAAMk"]
[Wed Dec 17 13:14:03.745716 2025] [:error] [pid 11733:tid 11735] [client 4.190.206.155:12997] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUI8GzzmtBRXExJb1PFzIAAAAQA"]
[Wed Dec 17 13:14:05.657622 2025] [:error] [pid 45531:tid 45566] [client 4.190.206.155:24169] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUI8HYjuE-Fd-sBWjvXwCAAAAEM"]
[Wed Dec 17 13:14:07.103441 2025] [:error] [pid 45532:tid 45597] [client 4.190.206.155:13048] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUI8HweWB-JXOyTKNs2qDwAAAIc"]
[Wed Dec 17 13:14:08.074354 2025] [:error] [pid 11733:tid 11740] [client 4.190.206.155:24130] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUI8IDzmtBRXExJb1PFzLAAAAQU"]
[Wed Dec 17 13:14:10.656482 2025] [:error] [pid 45530:tid 45555] [client 4.190.206.155:2626] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUI8Im4IsXcKlf7LWf9KVQAAABQ"]
[Wed Dec 17 13:14:12.254973 2025] [:error] [pid 45621:tid 45636] [client 4.190.206.155:33026] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUI8JOVNGQfJ1rR90pTALAAAAMo"]
[Wed Dec 17 13:14:14.315335 2025] [:error] [pid 45621:tid 45642] [client 4.190.206.155:16058] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUI8JuVNGQfJ1rR90pTAMAAAANA"]
[Wed Dec 17 13:14:15.995832 2025] [:error] [pid 45530:tid 45547] [client 4.190.206.155:12996] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aUI8J24IsXcKlf7LWf9KaAAAAAw"]
[Wed Dec 17 13:14:21.090081 2025] [:error] [pid 45530:tid 45538] [client 4.190.206.155:27708] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aUI8LW4IsXcKlf7LWf9KfwAAAAM"]
[Wed Dec 17 13:14:21.515211 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:2647] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aUI8LTzmtBRXExJb1PFzQgAAAQI"]
[Wed Dec 17 13:14:25.585465 2025] [:error] [pid 45531:tid 45585] [client 4.190.206.155:33064] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aUI8MYjuE-Fd-sBWjvXwIAAAAFY"]
[Wed Dec 17 13:14:30.195609 2025] [:error] [pid 45621:tid 45645] [client 4.190.206.155:24191] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inghl.php"] [unique_id "aUI8NuVNGQfJ1rR90pTAQwAAANM"]
[Wed Dec 17 13:14:35.860747 2025] [:error] [pid 45531:tid 45580] [client 4.190.206.155:32689] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inghl.php"] [unique_id "aUI8O4juE-Fd-sBWjvXwKQAAAFE"]
[Wed Dec 17 13:14:43.802854 2025] [:error] [pid 45531:tid 45578] [client 4.190.206.155:27667] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUI8Q4juE-Fd-sBWjvXwNQAAAE8"]
[Wed Dec 17 13:14:45.768512 2025] [:error] [pid 45531:tid 45579] [client 4.190.206.155:32764] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUI8RYjuE-Fd-sBWjvXwOwAAAFA"]
[Wed Dec 17 13:14:48.891465 2025] [:error] [pid 11733:tid 11748] [client 4.190.206.155:13911] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUI8SDzmtBRXExJb1PFzcAAAAQ0"]
[Wed Dec 17 13:14:51.018315 2025] [:error] [pid 45621:tid 45632] [client 4.190.206.155:24155] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUI8S-VNGQfJ1rR90pTAWgAAAMY"]
[Wed Dec 17 13:14:53.037823 2025] [:error] [pid 11733:tid 11742] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Dec 17 13:14:53.168441 2025] [:error] [pid 11733:tid 11744] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ac.php
[Wed Dec 17 13:14:54.798955 2025] [:error] [pid 11733:tid 11749] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/krypton.php
[Wed Dec 17 13:14:54.929867 2025] [:error] [pid 11733:tid 11758] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/karma_57c3d4.php
[Wed Dec 17 13:14:55.053652 2025] [:error] [pid 11733:tid 11735] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/fc72f.php
[Wed Dec 17 13:14:55.180195 2025] [:error] [pid 11733:tid 11740] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Dec 17 13:14:55.599224 2025] [:error] [pid 11733:tid 11748] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/jjrpo.php
[Wed Dec 17 13:14:55.724152 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Wed Dec 17 13:14:55.873950 2025] [:error] [pid 11733:tid 11759] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-advaced.php
[Wed Dec 17 13:14:56.036282 2025] [:error] [pid 11733:tid 11742] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Wed Dec 17 13:14:56.163031 2025] [:error] [pid 11733:tid 11744] [client 4.190.206.155:32661] File does not exist: /usr/local/apache/htdocs/suspended-page/xtt.php
[Wed Dec 17 13:14:56.287785 2025] [:error] [pid 11733:tid 11746] [client 4.190.206.155:32661] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUI8UDzmtBRXExJb1PFzggAAAQs"]
[Wed Dec 17 13:14:59.191097 2025] [:error] [pid 45621:tid 45628] [client 4.190.206.155:24170] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUI8U-VNGQfJ1rR90pTAYwAAAMI"]
[Wed Dec 17 13:15:01.264471 2025] [:error] [pid 45621:tid 45638] [client 4.190.206.155:6316] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUI8VeVNGQfJ1rR90pTAawAAAMw"]
[Wed Dec 17 13:15:02.510392 2025] [:error] [pid 45621:tid 45639] [client 4.190.206.155:13533] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUI8VuVNGQfJ1rR90pTAbgAAAM0"]
[Wed Dec 17 13:15:04.633619 2025] [:error] [pid 11733:tid 11750] [client 4.190.206.155:25596] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUI8WDzmtBRXExJb1PFziQAAAQ8"]
[Wed Dec 17 13:15:06.092674 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:13535] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUI8WjzmtBRXExJb1PFzjQAAAQI"]
[Wed Dec 17 13:15:08.223780 2025] [:error] [pid 45532:tid 45609] [client 4.190.206.155:25553] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUI8XAeWB-JXOyTKNs2qQQAAAJM"]
[Wed Dec 17 13:15:11.916699 2025] [:error] [pid 45532:tid 45604] [client 4.190.206.155:6329] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUI8XweWB-JXOyTKNs2qRgAAAI4"]
[Wed Dec 17 13:15:13.663922 2025] [:error] [pid 11733:tid 11755] [client 4.190.206.155:25547] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUI8YTzmtBRXExJb1PFzmwAAARQ"]
[Wed Dec 17 13:15:16.089298 2025] [:error] [pid 45531:tid 45569] [client 4.190.206.155:17959] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUI8ZIjuE-Fd-sBWjvXwVwAAAEY"]
[Wed Dec 17 13:15:18.259695 2025] [:error] [pid 45530:tid 45559] [client 4.190.206.155:17935] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUI8Zm4IsXcKlf7LWf9K-AAAABg"]
[Wed Dec 17 13:15:20.411997 2025] [:error] [pid 45532:tid 45600] [client 4.190.206.155:17670] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUI8aAeWB-JXOyTKNs2qYwAAAIo"]
[Wed Dec 17 13:15:21.918398 2025] [:error] [pid 45621:tid 45647] [client 4.190.206.155:2686] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUI8aeVNGQfJ1rR90pTAhAAAANU"]
[Wed Dec 17 13:15:24.942210 2025] [:error] [pid 45621:tid 45648] [client 4.190.206.155:17678] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUI8bOVNGQfJ1rR90pTAjgAAANY"]
[Wed Dec 17 13:15:26.776068 2025] [:error] [pid 45530:tid 45546] [client 4.190.206.155:23082] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUI8bm4IsXcKlf7LWf9LNAAAAAs"]
[Wed Dec 17 13:15:29.581239 2025] [:error] [pid 45530:tid 45557] [client 4.190.206.155:18715] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUI8cW4IsXcKlf7LWf9LSwAAABY"]
[Wed Dec 17 13:15:30.656138 2025] [:error] [pid 11733:tid 11751] [client 4.190.206.155:17983] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUI8cjzmtBRXExJb1PFz7gAAARA"]
[Wed Dec 17 13:15:33.504126 2025] [:error] [pid 11733:tid 11754] [client 4.190.206.155:18478] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUI8dTzmtBRXExJb1PFz9AAAARM"]
[Wed Dec 17 13:15:34.754220 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:10336] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUI8djzmtBRXExJb1PFz-AAAAQI"]
[Wed Dec 17 13:15:35.907365 2025] [:error] [pid 11733:tid 11744] [client 4.190.206.155:18509] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUI8dzzmtBRXExJb1PF0AgAAAQk"]
[Wed Dec 17 13:15:36.933571 2025] [:error] [pid 45621:tid 45650] [client 4.190.206.155:18526] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUI8eOVNGQfJ1rR90pTAsgAAANg"]
[Wed Dec 17 13:15:37.499312 2025] [:error] [pid 45532:tid 45601] [client 4.190.206.155:10308] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUI8eQeWB-JXOyTKNs2qkQAAAIs"]
[Wed Dec 17 13:15:38.517490 2025] [:error] [pid 45530:tid 45550] [client 4.190.206.155:10358] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUI8em4IsXcKlf7LWf9LWAAAAA8"]
[Wed Dec 17 13:15:39.562442 2025] [:error] [pid 45531:tid 45568] [client 4.190.206.155:5839] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUI8e4juE-Fd-sBWjvXwqgAAAEU"]
[Wed Dec 17 13:15:41.887851 2025] [:error] [pid 45531:tid 45563] [client 4.190.206.155:10656] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUI8fYjuE-Fd-sBWjvXwtAAAAEA"]
[Wed Dec 17 13:15:44.580861 2025] [:error] [pid 45621:tid 45643] [client 4.190.206.155:17514] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUI8gOVNGQfJ1rR90pTAuQAAANE"]
[Wed Dec 17 13:15:45.736786 2025] [:error] [pid 11733:tid 11740] [client 4.190.206.155:5842] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUI8gTzmtBRXExJb1PF0GgAAAQU"]
[Wed Dec 17 13:15:46.855894 2025] [:error] [pid 45532:tid 45607] [client 4.190.206.155:12950] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUI8ggeWB-JXOyTKNs2qoAAAAJE"]
[Wed Dec 17 13:15:51.170455 2025] [:error] [pid 45531:tid 45563] [client 4.190.206.155:30068] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aUI8h4juE-Fd-sBWjvXw0wAAAEA"]
[Wed Dec 17 13:15:53.409288 2025] [:error] [pid 11733:tid 11756] [client 4.190.206.155:5596] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aUI8iTzmtBRXExJb1PF0LAAAARU"]
[Wed Dec 17 13:15:55.869209 2025] [:error] [pid 45532:tid 45597] [client 4.190.206.155:10294] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aUI8iweWB-JXOyTKNs2qrQAAAIc"]
[Wed Dec 17 13:15:58.366910 2025] [:error] [pid 45532:tid 45596] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Dec 17 13:15:58.497399 2025] [:error] [pid 45532:tid 45599] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/ghreshttryu.php
[Wed Dec 17 13:15:58.624090 2025] [:error] [pid 45532:tid 45602] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/xopvne.php
[Wed Dec 17 13:15:58.753269 2025] [:error] [pid 45532:tid 45592] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/lm18.php
[Wed Dec 17 13:15:58.906703 2025] [:error] [pid 45532:tid 45593] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/5b9ac.php
[Wed Dec 17 13:15:59.041821 2025] [:error] [pid 45532:tid 45598] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Wed Dec 17 13:15:59.183955 2025] [:error] [pid 45532:tid 45605] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/56c53.php
[Wed Dec 17 13:15:59.308074 2025] [:error] [pid 45532:tid 45601] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/ce.php
[Wed Dec 17 13:15:59.433911 2025] [:error] [pid 45532:tid 45600] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Wed Dec 17 13:15:59.559235 2025] [:error] [pid 45532:tid 45606] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/55b76.php
[Wed Dec 17 13:15:59.701123 2025] [:error] [pid 45532:tid 45595] [client 4.190.206.155:22788] File does not exist: /usr/local/apache/htdocs/suspended-page/asa.php
[Wed Dec 17 13:15:59.829342 2025] [:error] [pid 45532:tid 45594] [client 4.190.206.155:22788] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUI8jweWB-JXOyTKNs2qugAAAIQ"]
[Wed Dec 17 13:16:03.587217 2025] [:error] [pid 45532:tid 45590] [client 4.190.206.155:12520] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUI8kweWB-JXOyTKNs2qwAAAAIA"]
[Wed Dec 17 13:16:06.392430 2025] [:error] [pid 11733:tid 11739] [client 4.190.206.155:18290] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUI8ljzmtBRXExJb1PF0QAAAAQQ"]
[Wed Dec 17 13:16:10.852853 2025] [:error] [pid 45621:tid 45643] [client 4.190.206.155:28918] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUI8muVNGQfJ1rR90pTAywAAANE"]
[Wed Dec 17 13:16:14.600107 2025] [:error] [pid 45531:tid 45563] [client 4.190.206.155:18262] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z123.php"] [unique_id "aUI8nojuE-Fd-sBWjvXw5AAAAEA"]
[Wed Dec 17 13:16:18.929108 2025] [:error] [pid 45531:tid 45566] [client 4.190.206.155:30440] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z123.php"] [unique_id "aUI8oojuE-Fd-sBWjvXw6gAAAEM"]
[Wed Dec 17 13:16:25.031756 2025] [:error] [pid 11733:tid 11757] [client 4.190.206.155:2362] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z123.php"] [unique_id "aUI8qTzmtBRXExJb1PF0VgAAARY"]
[Wed Dec 17 13:16:27.427328 2025] [:error] [pid 45532:tid 45611] [client 4.190.206.155:5803] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aUI8qweWB-JXOyTKNs2q4gAAAJU"]
[Wed Dec 17 13:16:30.187237 2025] [:error] [pid 45531:tid 45581] [client 4.190.206.155:2304] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aUI8rojuE-Fd-sBWjvXw9AAAAFI"]
[Wed Dec 17 13:16:31.816338 2025] [:error] [pid 45532:tid 45605] [client 4.190.206.155:28142] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aUI8rweWB-JXOyTKNs2q6gAAAI8"]
[Wed Dec 17 13:16:32.661659 2025] [:error] [pid 45530:tid 45536] [client 4.190.206.155:2269] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aUI8sG4IsXcKlf7LWf9L0AAAAAE"]
[Wed Dec 17 13:16:36.024206 2025] [:error] [pid 45621:tid 45635] [client 4.190.206.155:2738] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUI8tOVNGQfJ1rR90pTA5gAAAMk"]
[Wed Dec 17 13:16:40.442277 2025] [:error] [pid 45530:tid 45539] [client 4.190.206.155:5353] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUI8uG4IsXcKlf7LWf9L3gAAAAQ"]
[Wed Dec 17 13:16:44.393840 2025] [:error] [pid 45621:tid 45649] [client 4.190.206.155:17987] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUI8vOVNGQfJ1rR90pTA7AAAANc"]
[Wed Dec 17 13:16:46.306425 2025] [:error] [pid 11733:tid 11743] [client 4.190.206.155:18014] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUI8vjzmtBRXExJb1PF0bQAAAQg"]
[Wed Dec 17 13:16:47.920791 2025] [:error] [pid 45621:tid 45640] [client 4.190.206.155:27769] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUI8v-VNGQfJ1rR90pTA7QAAAM4"]
[Wed Dec 17 13:16:53.905934 2025] [:error] [pid 45621:tid 45637] [client 4.190.206.155:2867] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUI8xeVNGQfJ1rR90pTA8gAAAMs"]
[Wed Dec 17 13:16:55.081625 2025] [:error] [pid 45621:tid 45638] [client 4.190.206.155:5362] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUI8x-VNGQfJ1rR90pTA9AAAAMw"]
[Wed Dec 17 13:16:57.918106 2025] [:error] [pid 45621:tid 45631] [client 4.190.206.155:14918] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUI8yeVNGQfJ1rR90pTA-QAAAMU"]
[Wed Dec 17 13:17:04.190136 2025] [:error] [pid 45531:tid 45580] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Wed Dec 17 13:17:04.314771 2025] [:error] [pid 45531:tid 45567] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 17 13:17:06.144725 2025] [:error] [pid 45531:tid 45578] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/s121ws2s.php
[Wed Dec 17 13:17:07.402763 2025] [:error] [pid 45531:tid 45563] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Wed Dec 17 13:17:07.528567 2025] [:error] [pid 45531:tid 45575] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Wed Dec 17 13:17:07.658715 2025] [:error] [pid 45531:tid 45584] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/ww3.php
[Wed Dec 17 13:17:07.804369 2025] [:error] [pid 45531:tid 45566] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/783de.php
[Wed Dec 17 13:17:07.930089 2025] [:error] [pid 45531:tid 45571] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/lm15.php
[Wed Dec 17 13:17:08.056605 2025] [:error] [pid 45531:tid 45573] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Wed Dec 17 13:17:08.837519 2025] [:error] [pid 45531:tid 45564] [client 4.190.206.155:2389] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Dec 17 13:17:08.958410 2025] [:error] [pid 45531:tid 45586] [client 4.190.206.155:2389] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aUI81IjuE-Fd-sBWjvXxJwAAAFc"]
[Wed Dec 17 13:17:10.431448 2025] [:error] [pid 11733:tid 11743] [client 4.190.206.155:5293] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aUI81jzmtBRXExJb1PF0hQAAAQg"]
[Wed Dec 17 13:17:16.238688 2025] [:error] [pid 45621:tid 45645] [client 4.190.206.155:16087] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aUI83OVNGQfJ1rR90pTBCQAAANM"]
[Wed Dec 17 13:17:17.671642 2025] [:error] [pid 45621:tid 45641] [client 4.190.206.155:3024] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aUI83eVNGQfJ1rR90pTBDAAAAM8"]
[Wed Dec 17 13:17:20.660685 2025] [:error] [pid 45530:tid 45556] [client 4.190.206.155:27738] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aUI84G4IsXcKlf7LWf9MKQAAABU"]
[Wed Dec 17 13:17:23.166251 2025] [:error] [pid 45532:tid 45612] [client 4.190.206.155:14660] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aUI84weWB-JXOyTKNs2rHgAAAJY"]
[Wed Dec 17 13:17:24.296553 2025] [:error] [pid 11733:tid 11744] [client 4.190.206.155:2157] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aUI85DzmtBRXExJb1PF0nwAAAQk"]
[Wed Dec 17 13:17:27.438771 2025] [:error] [pid 45530:tid 45555] [client 4.190.206.155:27775] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aUI8524IsXcKlf7LWf9MMAAAABQ"]
[Wed Dec 17 13:17:28.820273 2025] [:error] [pid 45621:tid 45631] [client 4.190.206.155:19468] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUI86OVNGQfJ1rR90pTBGwAAAMU"]
[Wed Dec 17 13:17:30.753119 2025] [:error] [pid 11733:tid 11747] [client 4.190.206.155:14852] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUI86jzmtBRXExJb1PF0qAAAAQw"]
[Wed Dec 17 13:17:32.215332 2025] [:error] [pid 11733:tid 11745] [client 4.190.206.155:2704] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUI87DzmtBRXExJb1PF0qgAAAQo"]
[Wed Dec 17 13:17:33.507885 2025] [:error] [pid 45530:tid 45559] [client 4.190.206.155:17268] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUI87W4IsXcKlf7LWf9MQgAAABg"]
[Wed Dec 17 13:17:36.644326 2025] [:error] [pid 11733:tid 11740] [client 4.190.206.155:33868] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUI88DzmtBRXExJb1PF0swAAAQU"]
[Wed Dec 17 13:17:38.338731 2025] [:error] [pid 45621:tid 45640] [client 4.190.206.155:16972] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUI88uVNGQfJ1rR90pTBJAAAAM4"]
[Wed Dec 17 13:17:40.684686 2025] [:error] [pid 11733:tid 11756] [client 4.190.206.155:18558] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUI89DzmtBRXExJb1PF0uQAAARU"]
[Wed Dec 17 13:17:43.677264 2025] [:error] [pid 45530:tid 45544] [client 4.190.206.155:18746] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUI8924IsXcKlf7LWf9MZQAAAAk"]
[Wed Dec 17 13:17:49.081437 2025] [:error] [pid 45532:tid 45593] [client 4.190.206.155:2679] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kUgr4yGzxN.php"] [unique_id "aUI8_QeWB-JXOyTKNs2rMQAAAIM"]
[Wed Dec 17 13:17:54.782534 2025] [:error] [pid 11733:tid 11745] [client 4.190.206.155:32645] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kUgr4yGzxN.php"] [unique_id "aUI9AjzmtBRXExJb1PF0zwAAAQo"]
[Wed Dec 17 13:17:59.658844 2025] [:error] [pid 11733:tid 11736] [client 4.190.206.155:25073] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kUgr4yGzxN.php"] [unique_id "aUI9BzzmtBRXExJb1PF01AAAAQE"]
[Wed Dec 17 13:18:03.261313 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:25075] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUI9CzzmtBRXExJb1PF02AAAAQI"]
[Wed Dec 17 13:18:06.954202 2025] [:error] [pid 45532:tid 45606] [client 4.190.206.155:32312] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUI9DgeWB-JXOyTKNs2rRAAAAJA"]
[Wed Dec 17 13:18:08.786058 2025] [:error] [pid 45621:tid 45626] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/file30.php
[Wed Dec 17 13:18:08.910471 2025] [:error] [pid 45621:tid 45649] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/rp8zi.php
[Wed Dec 17 13:18:09.037660 2025] [:error] [pid 45621:tid 45633] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/cc3.php
[Wed Dec 17 13:18:09.161415 2025] [:error] [pid 45621:tid 45646] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Dec 17 13:18:09.288755 2025] [:error] [pid 45621:tid 45643] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Dec 17 13:18:09.421359 2025] [:error] [pid 45621:tid 45628] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Wed Dec 17 13:18:09.565900 2025] [:error] [pid 45621:tid 45642] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/qV9GbcJwZgK.php
[Wed Dec 17 13:18:09.689807 2025] [:error] [pid 45621:tid 45640] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/qsntqiho.php
[Wed Dec 17 13:18:09.814733 2025] [:error] [pid 45621:tid 45634] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/qjaqjahu.php
[Wed Dec 17 13:18:09.938509 2025] [:error] [pid 45621:tid 45650] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/qhLaGswd9DS.php
[Wed Dec 17 13:18:10.072417 2025] [:error] [pid 45621:tid 45648] [client 4.190.206.155:25077] File does not exist: /usr/local/apache/htdocs/suspended-page/pwyjwrfr.php
[Wed Dec 17 13:18:10.200996 2025] [:error] [pid 45621:tid 45636] [client 4.190.206.155:25077] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUI9EuVNGQfJ1rR90pTBVgAAAMo"]
[Wed Dec 17 13:18:12.882316 2025] [:error] [pid 45531:tid 45576] [client 4.190.206.155:13462] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUI9FIjuE-Fd-sBWjvXxeAAAAE0"]
[Wed Dec 17 13:18:16.127919 2025] [:error] [pid 45532:tid 45607] [client 4.190.206.155:32358] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUI9GAeWB-JXOyTKNs2rUAAAAJE"]
[Wed Dec 17 13:18:17.616819 2025] [:error] [pid 45531:tid 45577] [client 4.190.206.155:6547] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUI9GYjuE-Fd-sBWjvXxfwAAAE4"]
[Wed Dec 17 13:18:21.096755 2025] [:error] [pid 45530:tid 45548] [client 4.190.206.155:32289] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUI9HW4IsXcKlf7LWf9MmAAAAA0"]
[Wed Dec 17 13:18:22.170456 2025] [:error] [pid 11733:tid 11749] [client 4.190.206.155:25994] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUI9HjzmtBRXExJb1PF07QAAAQ4"]
[Wed Dec 17 13:18:24.300584 2025] [:error] [pid 45532:tid 45592] [client 4.190.206.155:13720] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUI9IAeWB-JXOyTKNs2rVQAAAII"]
[Wed Dec 17 13:18:25.775470 2025] [:error] [pid 45532:tid 45610] [client 4.190.206.155:13705] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUI9IQeWB-JXOyTKNs2rVgAAAJQ"]
[Wed Dec 17 13:18:26.902006 2025] [:error] [pid 45532:tid 45590] [client 4.190.206.155:23158] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUI9IgeWB-JXOyTKNs2rWQAAAIA"]
[Wed Dec 17 13:18:28.465650 2025] [:error] [pid 45532:tid 45605] [client 4.190.206.155:23810] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUI9JAeWB-JXOyTKNs2rXAAAAI8"]
[Wed Dec 17 13:18:31.940236 2025] [:error] [pid 11733:tid 11757] [client 4.190.206.155:32373] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUI9JzzmtBRXExJb1PF0-AAAARY"]
[Wed Dec 17 13:18:37.498314 2025] [:error] [pid 11733:tid 11750] [client 4.190.206.155:2182] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUI9LTzmtBRXExJb1PF1AAAAAQ8"]
[Wed Dec 17 13:18:41.076828 2025] [:error] [pid 45530:tid 45553] [client 4.190.206.155:32352] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUI9MW4IsXcKlf7LWf9MqQAAABI"]
[Wed Dec 17 13:18:44.333816 2025] [:error] [pid 45532:tid 45600] [client 4.190.206.155:25997] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUI9NAeWB-JXOyTKNs2rcAAAAIo"]
[Wed Dec 17 13:18:47.767424 2025] [:error] [pid 45530:tid 45553] [client 4.190.206.155:13456] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUI9N24IsXcKlf7LWf9MsgAAABI"]
[Wed Dec 17 13:18:48.577591 2025] [:error] [pid 11733:tid 11751] [client 4.190.206.155:6622] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUI9ODzmtBRXExJb1PF1LgAAARA"]
[Wed Dec 17 13:18:51.385397 2025] [:error] [pid 45532:tid 45598] [client 4.190.206.155:6542] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUI9OweWB-JXOyTKNs2rdwAAAIg"]
[Wed Dec 17 13:18:54.325228 2025] [:error] [pid 45621:tid 45640] [client 4.190.206.155:31959] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUI9PuVNGQfJ1rR90pTBzwAAAM4"]
[Wed Dec 17 13:18:59.630756 2025] [:error] [pid 45530:tid 45558] [client 4.190.206.155:29228] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUI9Q24IsXcKlf7LWf9MxgAAABc"]
[Wed Dec 17 13:19:02.181508 2025] [:error] [pid 45530:tid 45542] [client 4.190.206.155:26108] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUI9Rm4IsXcKlf7LWf9MzQAAAAc"]
[Wed Dec 17 13:19:03.856290 2025] [:error] [pid 45621:tid 45626] [client 4.190.206.155:25016] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mhpglaje.php"] [unique_id "aUI9R-VNGQfJ1rR90pTB0wAAAMA"]
[Wed Dec 17 13:19:07.168814 2025] [:error] [pid 45621:tid 45647] [client 4.190.206.155:33085] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mhpglaje.php"] [unique_id "aUI9S-VNGQfJ1rR90pTB1wAAANU"]
[Wed Dec 17 13:19:09.340682 2025] [:error] [pid 45531:tid 45563] [client 4.190.206.155:26104] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mhpglaje.php"] [unique_id "aUI9TYjuE-Fd-sBWjvXx9AAAAEA"]
[Wed Dec 17 13:19:13.015780 2025] [:error] [pid 11733:tid 11759] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/mhpglaje.php
[Wed Dec 17 13:19:15.182177 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/LvCBeZWaSgQ.php
[Wed Dec 17 13:19:16.987277 2025] [:error] [pid 11733:tid 11749] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/KV7EGJmhHzX.php
[Wed Dec 17 13:19:17.113106 2025] [:error] [pid 11733:tid 11744] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/ijNdPI1Orya.php
[Wed Dec 17 13:19:17.242024 2025] [:error] [pid 11733:tid 11740] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/HPum4ZEBJRC.php
[Wed Dec 17 13:19:17.369322 2025] [:error] [pid 11733:tid 11755] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/6kDPjgFTmvS.php
[Wed Dec 17 13:19:17.506945 2025] [:error] [pid 11733:tid 11746] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/8xg5Bv6XIUw.php
[Wed Dec 17 13:19:17.632802 2025] [:error] [pid 11733:tid 11759] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-header.php
[Wed Dec 17 13:19:17.780865 2025] [:error] [pid 11733:tid 11745] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/aGeTbFjB5Zu.php
[Wed Dec 17 13:19:17.908230 2025] [:error] [pid 11733:tid 11753] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/BMjXQkgwpeb.php
[Wed Dec 17 13:19:18.035107 2025] [:error] [pid 11733:tid 11737] [client 4.190.206.155:2496] File does not exist: /usr/local/apache/htdocs/suspended-page/FSCMNvnjPX4.php
[Wed Dec 17 13:19:18.156632 2025] [:error] [pid 11733:tid 11751] [client 4.190.206.155:2496] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUI9VjzmtBRXExJb1PF1YwAAARA"]
[Wed Dec 17 13:19:21.245227 2025] [:error] [pid 45532:tid 45608] [client 4.190.206.155:26062] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUI9WQeWB-JXOyTKNs2rkAAAAJI"]
[Wed Dec 17 13:19:24.756623 2025] [:error] [pid 11733:tid 11736] [client 4.190.206.155:6878] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUI9XDzmtBRXExJb1PF1bgAAAQE"]
[Wed Dec 17 13:19:27.013133 2025] [:error] [pid 45532:tid 45613] [client 4.190.206.155:17420] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUI9XweWB-JXOyTKNs2rngAAAJc"]
[Wed Dec 17 13:19:32.082163 2025] [:error] [pid 11733:tid 11740] [client 4.190.206.155:2226] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUI9ZDzmtBRXExJb1PF1egAAAQU"]
[Wed Dec 17 13:19:37.029127 2025] [:error] [pid 11733:tid 11744] [client 4.190.206.155:33124] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUI9aTzmtBRXExJb1PF1gQAAAQk"]
[Wed Dec 17 13:19:40.064888 2025] [:error] [pid 45532:tid 45596] [client 4.190.206.155:33074] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUI9bAeWB-JXOyTKNs2rtAAAAIY"]
[Wed Dec 17 13:19:47.803720 2025] [:error] [pid 11733:tid 11755] [client 4.190.206.155:6875] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUI9czzmtBRXExJb1PF1iQAAARQ"]
[Wed Dec 17 13:19:49.928724 2025] [:error] [pid 45621:tid 45639] [client 4.190.206.155:17702] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUI9deVNGQfJ1rR90pTCKwAAAM0"]
[Wed Dec 17 13:19:52.156380 2025] [:error] [pid 45530:tid 45537] [client 4.190.206.155:2176] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUI9eG4IsXcKlf7LWf9NPwAAAAI"]
[Wed Dec 17 13:19:53.389691 2025] [:error] [pid 45530:tid 45558] [client 4.190.206.155:6891] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUI9eW4IsXcKlf7LWf9NQQAAABc"]
[Wed Dec 17 13:19:57.018623 2025] [:error] [pid 45532:tid 45596] [client 4.190.206.155:15774] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUI9fQeWB-JXOyTKNs2rxQAAAIY"]
[Wed Dec 17 13:19:59.010025 2025] [:error] [pid 45532:tid 45614] [client 4.190.206.155:25780] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUI9fweWB-JXOyTKNs2rywAAAJg"]
[Wed Dec 17 13:20:01.308038 2025] [:error] [pid 45530:tid 45558] [client 4.190.206.155:6872] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUI9gW4IsXcKlf7LWf9NSAAAABc"]
[Wed Dec 17 13:20:03.496054 2025] [:error] [pid 45530:tid 45551] [client 4.190.206.155:25762] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUI9g24IsXcKlf7LWf9NTAAAABA"]
[Wed Dec 17 13:20:06.628374 2025] [:error] [pid 45530:tid 45552] [client 4.190.206.155:33034] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUI9hm4IsXcKlf7LWf9NUwAAABE"]
[Wed Dec 17 13:20:11.981527 2025] [:error] [pid 45532:tid 45608] [client 4.190.206.155:25783] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUI9iweWB-JXOyTKNs2r1QAAAJI"]
[Wed Dec 17 13:20:14.397882 2025] [:error] [pid 11733:tid 11744] [client 4.190.206.155:25790] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUI9jjzmtBRXExJb1PF1pgAAAQk"]
[Wed Dec 17 13:20:16.568248 2025] [:error] [pid 45530:tid 45546] [client 4.190.206.155:29582] [client 4.190.206.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUI9kG4IsXcKlf7LWf9NZgAAAAs"]
[Wed Dec 17 13:20:19.132364 2025] [:error] [pid 45621:tid 45649] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Dec 17 13:20:20.198839 2025] [:error] [pid 45621:tid 45637] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Dec 17 13:20:20.336649 2025] [:error] [pid 45621:tid 45632] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Wed Dec 17 13:20:20.470231 2025] [:error] [pid 45621:tid 45647] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Wed Dec 17 13:20:20.613936 2025] [:error] [pid 45621:tid 45635] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Dec 17 13:20:20.774480 2025] [:error] [pid 45621:tid 45629] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/dejavu.php
[Wed Dec 17 13:20:20.901528 2025] [:error] [pid 45621:tid 45646] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Dec 17 13:20:21.051242 2025] [:error] [pid 45621:tid 45633] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Wed Dec 17 13:20:21.694016 2025] [:error] [pid 45621:tid 45642] [client 4.190.206.155:18524] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Dec 17 16:50:49.622107 2025] [:error] [pid 45532:tid 45613] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Wed Dec 17 16:50:49.643688 2025] [:error] [pid 45532:tid 45602] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Dec 17 16:50:49.664058 2025] [:error] [pid 45532:tid 45609] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 17 16:50:49.689196 2025] [:error] [pid 45532:tid 45614] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Dec 17 16:50:49.709422 2025] [:error] [pid 45532:tid 45611] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Wed Dec 17 16:50:49.733138 2025] [:error] [pid 45532:tid 45593] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Dec 17 16:50:49.752561 2025] [:error] [pid 45532:tid 45598] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Dec 17 16:50:49.773170 2025] [:error] [pid 45532:tid 45600] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Dec 17 16:50:49.792079 2025] [:error] [pid 45532:tid 45595] [client 4.197.185.167:12625] File does not exist: /usr/local/apache/htdocs/suspended-page/cord.php
[Wed Dec 17 16:50:49.809187 2025] [:error] [pid 45532:tid 45592] [client 4.197.185.167:12625] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aUJu6QeWB-JXOyTKNs39ngAAAII"]
[Wed Dec 17 16:50:49.852241 2025] [:error] [pid 45530:tid 45559] [client 4.197.185.167:12575] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aUJu6W4IsXcKlf7LWf_PAgAAABg"]
[Wed Dec 17 16:50:49.941207 2025] [:error] [pid 45531:tid 45565] [client 4.197.185.167:12627] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aUJu6YjuE-Fd-sBWjvVAVQAAAEI"]
[Wed Dec 17 16:50:50.017495 2025] [:error] [pid 11733:tid 11735] [client 4.197.185.167:12621] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aUJu6jzmtBRXExJb1PHbiAAAAQA"]
[Wed Dec 17 16:50:50.055808 2025] [:error] [pid 11733:tid 11759] [client 4.197.185.167:12608] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aUJu6jzmtBRXExJb1PHbiQAAARg"]
[Wed Dec 17 16:50:50.105234 2025] [:error] [pid 45531:tid 45573] [client 4.197.185.167:12560] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aUJu6ojuE-Fd-sBWjvVAVgAAAEo"]
[Wed Dec 17 16:50:50.155261 2025] [:error] [pid 45621:tid 45629] [client 4.197.185.167:12546] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaIQAAAMM"]
[Wed Dec 17 16:50:50.212351 2025] [:error] [pid 45531:tid 45567] [client 4.197.185.167:12637] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aUJu6ojuE-Fd-sBWjvVAVwAAAEQ"]
[Wed Dec 17 16:50:50.306415 2025] [:error] [pid 45621:tid 45636] [client 4.197.185.167:12556] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaIgAAAMo"]
[Wed Dec 17 16:50:50.398158 2025] [:error] [pid 45621:tid 45646] [client 4.197.185.167:12635] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaIwAAANQ"]
[Wed Dec 17 16:50:50.437421 2025] [:error] [pid 45531:tid 45583] [client 4.197.185.167:12656] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aUJu6ojuE-Fd-sBWjvVAWAAAAFQ"]
[Wed Dec 17 16:50:50.467978 2025] [:error] [pid 45621:tid 45649] [client 4.197.185.167:12572] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaJAAAANc"]
[Wed Dec 17 16:50:50.508538 2025] [:error] [pid 11733:tid 11745] [client 4.197.185.167:12611] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aUJu6jzmtBRXExJb1PHbigAAAQo"]
[Wed Dec 17 16:50:50.543320 2025] [:error] [pid 45531:tid 45572] [client 4.197.185.167:12633] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aUJu6ojuE-Fd-sBWjvVAWQAAAEk"]
[Wed Dec 17 16:50:50.617942 2025] [:error] [pid 11733:tid 11736] [client 4.197.185.167:12570] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aUJu6jzmtBRXExJb1PHbiwAAAQE"]
[Wed Dec 17 16:50:50.664090 2025] [:error] [pid 45621:tid 45643] [client 4.197.185.167:12661] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaJgAAANE"]
[Wed Dec 17 16:50:50.734897 2025] [:error] [pid 45621:tid 45632] [client 4.197.185.167:12624] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaJwAAAMY"]
[Wed Dec 17 16:50:50.771987 2025] [:error] [pid 45621:tid 45638] [client 4.197.185.167:12670] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaKAAAAMw"]
[Wed Dec 17 16:50:50.823983 2025] [:error] [pid 45532:tid 45610] [client 4.197.185.167:12658] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aUJu6geWB-JXOyTKNs39ogAAAJQ"]
[Wed Dec 17 16:50:50.857144 2025] [:error] [pid 45532:tid 45606] [client 4.197.185.167:12563] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aUJu6geWB-JXOyTKNs39owAAAJA"]
[Wed Dec 17 16:50:50.911949 2025] [:error] [pid 45531:tid 45580] [client 4.197.185.167:3016] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aUJu6ojuE-Fd-sBWjvVAWgAAAFE"]
[Wed Dec 17 16:50:50.954060 2025] [:error] [pid 45621:tid 45641] [client 4.197.185.167:12569] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aUJu6uVNGQfJ1rR90pQaKQAAAM8"]
[Wed Dec 17 16:50:51.019051 2025] [:error] [pid 11733:tid 11748] [client 4.197.185.167:12653] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aUJu6zzmtBRXExJb1PHbjAAAAQ0"]
[Wed Dec 17 16:50:51.067463 2025] [:error] [pid 45621:tid 45647] [client 4.197.185.167:12558] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aUJu6-VNGQfJ1rR90pQaKgAAANU"]
[Wed Dec 17 16:50:51.116711 2025] [:error] [pid 45621:tid 45634] [client 4.197.185.167:3033] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aUJu6-VNGQfJ1rR90pQaKwAAAMg"]
[Wed Dec 17 16:50:51.170196 2025] [:error] [pid 11733:tid 11754] [client 4.197.185.167:3060] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aUJu6zzmtBRXExJb1PHbjgAAARM"]
[Wed Dec 17 16:50:51.215310 2025] [:error] [pid 45621:tid 45630] [client 4.197.185.167:12665] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aUJu6-VNGQfJ1rR90pQaLAAAAMQ"]
[Wed Dec 17 16:50:51.302386 2025] [:error] [pid 11733:tid 11749] [client 4.197.185.167:12663] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aUJu6zzmtBRXExJb1PHbjwAAAQ4"]
[Wed Dec 17 16:50:51.336276 2025] [:error] [pid 45531:tid 45578] [client 4.197.185.167:12549] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aUJu64juE-Fd-sBWjvVAWwAAAE8"]
[Wed Dec 17 16:50:51.367461 2025] [:error] [pid 45531:tid 45564] [client 4.197.185.167:12618] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aUJu64juE-Fd-sBWjvVAXAAAAEE"]
[Wed Dec 17 16:50:51.407070 2025] [:error] [pid 11733:tid 11746] [client 4.197.185.167:12634] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aUJu6zzmtBRXExJb1PHbkAAAAQs"]
[Wed Dec 17 16:50:51.439379 2025] [:error] [pid 11733:tid 11756] [client 4.197.185.167:12561] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aUJu6zzmtBRXExJb1PHbkQAAARU"]
[Wed Dec 17 16:50:51.471759 2025] [:error] [pid 45531:tid 45574] [client 4.197.185.167:12616] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aUJu64juE-Fd-sBWjvVAXQAAAEs"]
[Wed Dec 17 16:50:51.506798 2025] [:error] [pid 45532:tid 45594] [client 4.197.185.167:12568] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aUJu6weWB-JXOyTKNs39pAAAAIQ"]
[Wed Dec 17 16:50:51.546517 2025] [:error] [pid 45621:tid 45628] [client 4.197.185.167:3054] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aUJu6-VNGQfJ1rR90pQaLQAAAMI"]
[Wed Dec 17 16:50:51.578509 2025] [:error] [pid 45621:tid 45640] [client 4.197.185.167:12553] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aUJu6-VNGQfJ1rR90pQaLgAAAM4"]
[Wed Dec 17 16:50:51.614476 2025] [:error] [pid 45621:tid 45635] [client 4.197.185.167:3046] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aUJu6-VNGQfJ1rR90pQaMQAAAMk"]
[Wed Dec 17 16:50:51.644896 2025] [:error] [pid 45531:tid 45579] [client 4.197.185.167:12631] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aUJu64juE-Fd-sBWjvVAXgAAAFA"]
[Wed Dec 17 16:50:51.680001 2025] [:error] [pid 11733:tid 11744] [client 4.197.185.167:12571] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aUJu6zzmtBRXExJb1PHbkgAAAQk"]
[Wed Dec 17 16:50:51.712722 2025] [:error] [pid 45531:tid 45570] [client 4.197.185.167:12662] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aUJu64juE-Fd-sBWjvVAXwAAAEc"]
[Wed Dec 17 16:50:51.743533 2025] [:error] [pid 45531:tid 45585] [client 4.197.185.167:12579] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aUJu64juE-Fd-sBWjvVAYAAAAFY"]
[Wed Dec 17 16:50:51.782891 2025] [:error] [pid 45531:tid 45586] [client 4.197.185.167:12641] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aUJu64juE-Fd-sBWjvVAYgAAAFc"]
[Wed Dec 17 16:50:51.817840 2025] [:error] [pid 45530:tid 45546] [client 4.197.185.167:12630] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aUJu624IsXcKlf7LWf_PAwAAAAs"]
[Wed Dec 17 16:50:51.851407 2025] [:error] [pid 11733:tid 11751] [client 4.197.185.167:12590] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aUJu6zzmtBRXExJb1PHbkwAAARA"]
[Wed Dec 17 16:50:51.896291 2025] [:error] [pid 11733:tid 11757] [client 4.197.185.167:12636] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aUJu6zzmtBRXExJb1PHblAAAARY"]
[Wed Dec 17 16:50:51.930511 2025] [:error] [pid 45532:tid 45590] [client 4.197.185.167:12623] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aUJu6weWB-JXOyTKNs39pQAAAIA"]
[Wed Dec 17 16:50:51.981016 2025] [:error] [pid 11733:tid 11740] [client 4.197.185.167:12592] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aUJu6zzmtBRXExJb1PHblQAAAQU"]
[Wed Dec 17 16:50:52.040484 2025] [:error] [pid 11733:tid 11758] [client 4.197.185.167:12667] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aUJu7DzmtBRXExJb1PHblgAAARc"]
[Wed Dec 17 16:50:52.072576 2025] [:error] [pid 45532:tid 45596] [client 4.197.185.167:12615] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aUJu7AeWB-JXOyTKNs39pgAAAIY"]
[Wed Dec 17 16:50:52.102681 2025] [:error] [pid 11733:tid 11739] [client 4.197.185.167:12619] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aUJu7DzmtBRXExJb1PHblwAAAQQ"]
[Wed Dec 17 16:50:52.143195 2025] [:error] [pid 45532:tid 45605] [client 4.197.185.167:12566] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aUJu7AeWB-JXOyTKNs39pwAAAI8"]
[Wed Dec 17 16:50:52.186604 2025] [:error] [pid 45531:tid 45577] [client 4.197.185.167:12554] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aUJu7IjuE-Fd-sBWjvVAZQAAAE4"]
[Wed Dec 17 16:50:52.218609 2025] [:error] [pid 45532:tid 45612] [client 4.197.185.167:12564] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aUJu7AeWB-JXOyTKNs39qAAAAJY"]
[Wed Dec 17 16:50:52.251319 2025] [:error] [pid 11733:tid 11741] [client 4.197.185.167:12643] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aUJu7DzmtBRXExJb1PHbmQAAAQY"]
[Wed Dec 17 16:50:52.319465 2025] [:error] [pid 11733:tid 11735] [client 4.197.185.167:12584] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aUJu7DzmtBRXExJb1PHbmgAAAQA"]
[Wed Dec 17 16:50:52.353146 2025] [:error] [pid 11733:tid 11759] [client 4.197.185.167:12557] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aUJu7DzmtBRXExJb1PHbmwAAARg"]
[Wed Dec 17 16:50:52.383740 2025] [:error] [pid 45531:tid 45569] [client 4.197.185.167:12555] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aUJu7IjuE-Fd-sBWjvVAZgAAAEY"]
[Wed Dec 17 16:50:52.413438 2025] [:error] [pid 45532:tid 45613] [client 4.197.185.167:12577] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aUJu7AeWB-JXOyTKNs39qQAAAJc"]
[Wed Dec 17 16:50:52.446981 2025] [:error] [pid 45532:tid 45609] [client 4.197.185.167:12552] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aUJu7AeWB-JXOyTKNs39qwAAAJM"]
[Wed Dec 17 16:50:52.476881 2025] [:error] [pid 45532:tid 45611] [client 4.197.185.167:3037] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aUJu7AeWB-JXOyTKNs39rAAAAJU"]
[Wed Dec 17 16:50:52.510171 2025] [:error] [pid 45531:tid 45587] [client 4.197.185.167:12578] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aUJu7IjuE-Fd-sBWjvVAZwAAAFg"]
[Wed Dec 17 16:50:52.555437 2025] [:error] [pid 11733:tid 11750] [client 4.197.185.167:3025] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aUJu7DzmtBRXExJb1PHbnAAAAQ8"]
[Wed Dec 17 16:50:52.590814 2025] [:error] [pid 11733:tid 11745] [client 4.197.185.167:12647] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aUJu7DzmtBRXExJb1PHbnQAAAQo"]
[Wed Dec 17 16:50:52.622693 2025] [:error] [pid 45532:tid 45600] [client 4.197.185.167:3030] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aUJu7AeWB-JXOyTKNs39rwAAAIo"]
[Wed Dec 17 16:50:52.668048 2025] [:error] [pid 11733:tid 11738] [client 4.197.185.167:12648] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aUJu7DzmtBRXExJb1PHbngAAAQM"]
[Wed Dec 17 16:50:52.702346 2025] [:error] [pid 45532:tid 45595] [client 4.197.185.167:12562] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aUJu7AeWB-JXOyTKNs39sAAAAIU"]
[Wed Dec 17 16:50:52.765617 2025] [:error] [pid 45621:tid 45645] [client 4.197.185.167:3010] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aUJu7OVNGQfJ1rR90pQaMgAAANM"]
[Wed Dec 17 16:50:52.803608 2025] [:error] [pid 11733:tid 11748] [client 4.197.185.167:12654] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aUJu7DzmtBRXExJb1PHbnwAAAQ0"]
[Wed Dec 17 16:50:52.834496 2025] [:error] [pid 11733:tid 11754] [client 4.197.185.167:12559] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUJu7DzmtBRXExJb1PHboAAAARM"]
[Wed Dec 17 16:50:52.865758 2025] [:error] [pid 11733:tid 11747] [client 4.197.185.167:12660] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUJu7DzmtBRXExJb1PHboQAAAQw"]
[Wed Dec 17 16:50:52.897213 2025] [:error] [pid 45530:tid 45544] [client 4.197.185.167:3035] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUJu7G4IsXcKlf7LWf_PBAAAAAk"]
[Wed Dec 17 16:50:52.934723 2025] [:error] [pid 11733:tid 11755] [client 4.197.185.167:12593] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUJu7DzmtBRXExJb1PHbogAAARQ"]
[Wed Dec 17 16:50:52.964523 2025] [:error] [pid 45621:tid 45629] [client 4.197.185.167:12586] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu7OVNGQfJ1rR90pQaMwAAAMM"]
[Wed Dec 17 16:50:53.001773 2025] [:error] [pid 11733:tid 11749] [client 4.197.185.167:2957] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu7TzmtBRXExJb1PHbowAAAQ4"]
[Wed Dec 17 16:50:53.034148 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:12602] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PBQAAABU"]
[Wed Dec 17 16:50:53.073180 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:12671] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu7eVNGQfJ1rR90pQaNAAAANI"]
[Wed Dec 17 16:50:53.122096 2025] [:error] [pid 45531:tid 45581] [client 4.197.185.167:12597] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aUJu7YjuE-Fd-sBWjvVAaAAAAFI"]
[Wed Dec 17 16:50:53.176122 2025] [:error] [pid 45531:tid 45576] [client 4.197.185.167:3044] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aUJu7YjuE-Fd-sBWjvVAaQAAAE0"]
[Wed Dec 17 16:50:53.217275 2025] [:error] [pid 45532:tid 45601] [client 4.197.185.167:12652] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aUJu7QeWB-JXOyTKNs39tAAAAIs"]
[Wed Dec 17 16:50:53.252368 2025] [:error] [pid 45531:tid 45565] [client 4.197.185.167:12547] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aUJu7YjuE-Fd-sBWjvVAagAAAEI"]
[Wed Dec 17 16:50:53.284766 2025] [:error] [pid 45531:tid 45573] [client 4.197.185.167:12606] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUJu7YjuE-Fd-sBWjvVAawAAAEo"]
[Wed Dec 17 16:50:53.366370 2025] [:error] [pid 45530:tid 45536] [client 4.197.185.167:12589] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PBgAAAAE"]
[Wed Dec 17 16:50:53.406815 2025] [:error] [pid 45530:tid 45558] [client 4.197.185.167:12603] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PBwAAABc"]
[Wed Dec 17 16:50:53.438033 2025] [:error] [pid 45530:tid 45555] [client 4.197.185.167:3045] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PCAAAABQ"]
[Wed Dec 17 16:50:53.478738 2025] [:error] [pid 11733:tid 11742] [client 4.197.185.167:2963] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aUJu7TzmtBRXExJb1PHbpAAAAQc"]
[Wed Dec 17 16:50:53.512149 2025] [:error] [pid 45530:tid 45559] [client 4.197.185.167:3029] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PCQAAABg"]
[Wed Dec 17 16:50:53.545994 2025] [:error] [pid 45530:tid 45547] [client 4.197.185.167:3009] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PCgAAAAw"]
[Wed Dec 17 16:50:53.583720 2025] [:error] [pid 45530:tid 45553] [client 4.197.185.167:12620] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PCwAAABI"]
[Wed Dec 17 16:50:53.614669 2025] [:error] [pid 45621:tid 45636] [client 4.197.185.167:12581] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUJu7eVNGQfJ1rR90pQaNQAAAMo"]
[Wed Dec 17 16:50:53.644053 2025] [:error] [pid 45530:tid 45554] [client 4.197.185.167:12583] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PDQAAABM"]
[Wed Dec 17 16:50:53.683416 2025] [:error] [pid 45621:tid 45646] [client 4.197.185.167:2992] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUJu7eVNGQfJ1rR90pQaNgAAANQ"]
[Wed Dec 17 16:50:53.727149 2025] [:error] [pid 45530:tid 45542] [client 4.197.185.167:12666] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PDgAAAAc"]
[Wed Dec 17 16:50:53.756541 2025] [:error] [pid 45621:tid 45649] [client 4.197.185.167:12657] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUJu7eVNGQfJ1rR90pQaNwAAANc"]
[Wed Dec 17 16:50:53.791462 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:12544] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUJu7W4IsXcKlf7LWf_PDwAAAAQ"]
[Wed Dec 17 16:50:53.821407 2025] [:error] [pid 45621:tid 45627] [client 4.197.185.167:12610] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUJu7eVNGQfJ1rR90pQaOAAAAME"]
[Wed Dec 17 16:50:53.851432 2025] [:error] [pid 45532:tid 45610] [client 4.197.185.167:12550] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUJu7QeWB-JXOyTKNs39tgAAAJQ"]
[Wed Dec 17 16:50:53.883372 2025] [:error] [pid 45532:tid 45594] [client 4.197.185.167:3003] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUJu7QeWB-JXOyTKNs39twAAAIQ"]
[Wed Dec 17 16:50:53.927986 2025] [:error] [pid 45531:tid 45583] [client 4.197.185.167:12599] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUJu7YjuE-Fd-sBWjvVAbQAAAFQ"]
[Wed Dec 17 16:50:53.963834 2025] [:error] [pid 45621:tid 45643] [client 4.197.185.167:12601] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUJu7eVNGQfJ1rR90pQaOQAAANE"]
[Wed Dec 17 16:50:54.011140 2025] [:error] [pid 45621:tid 45632] [client 4.197.185.167:2959] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaOgAAAMY"]
[Wed Dec 17 16:50:54.043534 2025] [:error] [pid 45621:tid 45639] [client 4.197.185.167:12664] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaOwAAAM0"]
[Wed Dec 17 16:50:54.075071 2025] [:error] [pid 45532:tid 45590] [client 4.197.185.167:12587] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aUJu7geWB-JXOyTKNs39uAAAAIA"]
[Wed Dec 17 16:50:54.105914 2025] [:error] [pid 45621:tid 45638] [client 4.197.185.167:12613] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaPAAAAMw"]
[Wed Dec 17 16:50:54.136291 2025] [:error] [pid 45532:tid 45596] [client 4.197.185.167:12607] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aUJu7geWB-JXOyTKNs39uQAAAIY"]
[Wed Dec 17 16:50:54.167948 2025] [:error] [pid 11733:tid 11743] [client 4.197.185.167:12588] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu7jzmtBRXExJb1PHbpgAAAQg"]
[Wed Dec 17 16:50:54.199951 2025] [:error] [pid 45531:tid 45572] [client 4.197.185.167:12551] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu7ojuE-Fd-sBWjvVAbgAAAEk"]
[Wed Dec 17 16:50:54.236376 2025] [:error] [pid 45531:tid 45580] [client 4.197.185.167:12646] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu7ojuE-Fd-sBWjvVAbwAAAFE"]
[Wed Dec 17 16:50:54.266807 2025] [:error] [pid 45532:tid 45605] [client 4.197.185.167:12638] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu7geWB-JXOyTKNs39ugAAAI8"]
[Wed Dec 17 16:50:54.297696 2025] [:error] [pid 45621:tid 45641] [client 4.197.185.167:3024] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaPQAAAM8"]
[Wed Dec 17 16:50:54.340359 2025] [:error] [pid 45531:tid 45578] [client 4.197.185.167:3048] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUJu7ojuE-Fd-sBWjvVAcAAAAE8"]
[Wed Dec 17 16:50:54.402131 2025] [:error] [pid 45531:tid 45564] [client 4.197.185.167:3065] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUJu7ojuE-Fd-sBWjvVAcQAAAEE"]
[Wed Dec 17 16:50:54.438211 2025] [:error] [pid 45531:tid 45574] [client 4.197.185.167:12612] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUJu7ojuE-Fd-sBWjvVAcgAAAEs"]
[Wed Dec 17 16:50:54.468737 2025] [:error] [pid 45621:tid 45647] [client 4.197.185.167:3053] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaPgAAANU"]
[Wed Dec 17 16:50:54.501279 2025] [:error] [pid 45532:tid 45612] [client 4.197.185.167:3067] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aUJu7geWB-JXOyTKNs39vAAAAJY"]
[Wed Dec 17 16:50:54.539621 2025] [:error] [pid 45530:tid 45541] [client 4.197.185.167:12640] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aUJu7m4IsXcKlf7LWf_PEgAAAAY"]
[Wed Dec 17 16:50:54.572384 2025] [:error] [pid 45621:tid 45634] [client 4.197.185.167:3049] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaPwAAAMg"]
[Wed Dec 17 16:50:54.609434 2025] [:error] [pid 45621:tid 45630] [client 4.197.185.167:3015] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaQQAAAMQ"]
[Wed Dec 17 16:50:54.654283 2025] [:error] [pid 45530:tid 45551] [client 4.197.185.167:12591] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aUJu7m4IsXcKlf7LWf_PEwAAABA"]
[Wed Dec 17 16:50:54.686866 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:12545] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aUJu7m4IsXcKlf7LWf_PFAAAAA0"]
[Wed Dec 17 16:50:54.724382 2025] [:error] [pid 45530:tid 45536] [client 4.197.185.167:12585] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aUJu7m4IsXcKlf7LWf_PFQAAAAE"]
[Wed Dec 17 16:50:54.757609 2025] [:error] [pid 45530:tid 45558] [client 4.197.185.167:12651] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu7m4IsXcKlf7LWf_PFgAAABc"]
[Wed Dec 17 16:50:54.789426 2025] [:error] [pid 45621:tid 45640] [client 4.197.185.167:12659] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaQgAAAM4"]
[Wed Dec 17 16:50:54.827630 2025] [:error] [pid 45621:tid 45637] [client 4.197.185.167:12655] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaRAAAAMs"]
[Wed Dec 17 16:50:54.865632 2025] [:error] [pid 45532:tid 45597] [client 4.197.185.167:12574] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu7geWB-JXOyTKNs39vQAAAIc"]
[Wed Dec 17 16:50:54.895131 2025] [:error] [pid 11733:tid 11756] [client 4.197.185.167:2954] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUJu7jzmtBRXExJb1PHbpwAAARU"]
[Wed Dec 17 16:50:54.928340 2025] [:error] [pid 11733:tid 11744] [client 4.197.185.167:12594] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUJu7jzmtBRXExJb1PHbqAAAAQk"]
[Wed Dec 17 16:50:54.972532 2025] [:error] [pid 45621:tid 45645] [client 4.197.185.167:12596] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUJu7uVNGQfJ1rR90pQaRQAAANM"]
[Wed Dec 17 16:50:55.011101 2025] [:error] [pid 11733:tid 11757] [client 4.197.185.167:3022] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUJu7zzmtBRXExJb1PHbqQAAARY"]
[Wed Dec 17 16:50:55.041786 2025] [:error] [pid 11733:tid 11740] [client 4.197.185.167:12565] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aUJu7zzmtBRXExJb1PHbqgAAAQU"]
[Wed Dec 17 16:50:55.074467 2025] [:error] [pid 11733:tid 11758] [client 4.197.185.167:3034] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aUJu7zzmtBRXExJb1PHbqwAAARc"]
[Wed Dec 17 16:50:55.107201 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:12645] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaRgAAANI"]
[Wed Dec 17 16:50:55.137490 2025] [:error] [pid 45530:tid 45538] [client 4.197.185.167:12626] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aUJu724IsXcKlf7LWf_PFwAAAAM"]
[Wed Dec 17 16:50:55.172966 2025] [:error] [pid 45621:tid 45650] [client 4.197.185.167:3070] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaRwAAANg"]
[Wed Dec 17 16:50:55.203725 2025] [:error] [pid 45532:tid 45613] [client 4.197.185.167:12548] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUJu7weWB-JXOyTKNs39vgAAAJc"]
[Wed Dec 17 16:50:55.236192 2025] [:error] [pid 45531:tid 45579] [client 4.197.185.167:3012] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUJu74juE-Fd-sBWjvVAcwAAAFA"]
[Wed Dec 17 16:50:55.274357 2025] [:error] [pid 45621:tid 45649] [client 4.197.185.167:12609] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaSAAAANc"]
[Wed Dec 17 16:50:55.326130 2025] [:error] [pid 45621:tid 45627] [client 4.197.185.167:3041] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaSQAAAME"]
[Wed Dec 17 16:50:55.399277 2025] [:error] [pid 45531:tid 45570] [client 4.197.185.167:12632] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUJu74juE-Fd-sBWjvVAdAAAAEc"]
[Wed Dec 17 16:50:55.434583 2025] [:error] [pid 45532:tid 45602] [client 4.197.185.167:3039] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUJu7weWB-JXOyTKNs39wAAAAIw"]
[Wed Dec 17 16:50:55.467563 2025] [:error] [pid 45532:tid 45611] [client 4.197.185.167:2958] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUJu7weWB-JXOyTKNs39wgAAAJU"]
[Wed Dec 17 16:50:55.499431 2025] [:error] [pid 45531:tid 45585] [client 4.197.185.167:2946] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUJu74juE-Fd-sBWjvVAdQAAAFY"]
[Wed Dec 17 16:50:55.563073 2025] [:error] [pid 11733:tid 11739] [client 4.197.185.167:12576] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUJu7zzmtBRXExJb1PHbrQAAAQQ"]
[Wed Dec 17 16:50:55.598723 2025] [:error] [pid 45532:tid 45598] [client 4.197.185.167:12580] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUJu7weWB-JXOyTKNs39wwAAAIg"]
[Wed Dec 17 16:50:55.630870 2025] [:error] [pid 45530:tid 45553] [client 4.197.185.167:3051] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUJu724IsXcKlf7LWf_PGAAAABI"]
[Wed Dec 17 16:50:55.663178 2025] [:error] [pid 45530:tid 45554] [client 4.197.185.167:12605] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUJu724IsXcKlf7LWf_PGQAAABM"]
[Wed Dec 17 16:50:55.695008 2025] [:error] [pid 11733:tid 11741] [client 4.197.185.167:12600] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUJu7zzmtBRXExJb1PHbrwAAAQY"]
[Wed Dec 17 16:50:55.725497 2025] [:error] [pid 45621:tid 45632] [client 4.197.185.167:3064] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaSwAAAMY"]
[Wed Dec 17 16:50:55.758046 2025] [:error] [pid 45531:tid 45582] [client 4.197.185.167:3031] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUJu74juE-Fd-sBWjvVAdgAAAFM"]
[Wed Dec 17 16:50:55.789440 2025] [:error] [pid 45530:tid 45549] [client 4.197.185.167:12639] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aUJu724IsXcKlf7LWf_PGgAAAA4"]
[Wed Dec 17 16:50:55.819999 2025] [:error] [pid 45621:tid 45638] [client 4.197.185.167:12573] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaTAAAAMw"]
[Wed Dec 17 16:50:55.854713 2025] [:error] [pid 45621:tid 45648] [client 4.197.185.167:3056] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaTQAAANY"]
[Wed Dec 17 16:50:55.896310 2025] [:error] [pid 45531:tid 45586] [client 4.197.185.167:12668] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aUJu74juE-Fd-sBWjvVAdwAAAFc"]
[Wed Dec 17 16:50:55.937417 2025] [:error] [pid 45532:tid 45595] [client 4.197.185.167:2953] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUJu7weWB-JXOyTKNs39xAAAAIU"]
[Wed Dec 17 16:50:55.968578 2025] [:error] [pid 45621:tid 45626] [client 4.197.185.167:3014] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaTgAAAMA"]
[Wed Dec 17 16:50:56.000201 2025] [:error] [pid 45621:tid 45628] [client 4.197.185.167:2962] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUJu7-VNGQfJ1rR90pQaTwAAAMI"]
[Wed Dec 17 16:50:56.040799 2025] [:error] [pid 45531:tid 45575] [client 4.197.185.167:3055] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUJu8IjuE-Fd-sBWjvVAeAAAAEw"]
[Wed Dec 17 16:50:56.076269 2025] [:error] [pid 11733:tid 11737] [client 4.197.185.167:2964] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aUJu8DzmtBRXExJb1PHbsQAAAQI"]
[Wed Dec 17 16:50:56.118737 2025] [:error] [pid 11733:tid 11759] [client 4.197.185.167:2883] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aUJu8DzmtBRXExJb1PHbsgAAARg"]
[Wed Dec 17 16:50:56.153180 2025] [:error] [pid 45531:tid 45568] [client 4.197.185.167:3047] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aUJu8IjuE-Fd-sBWjvVAegAAAEU"]
[Wed Dec 17 16:50:56.183955 2025] [:error] [pid 11733:tid 11750] [client 4.197.185.167:3043] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aUJu8DzmtBRXExJb1PHbswAAAQ8"]
[Wed Dec 17 16:50:56.227984 2025] [:error] [pid 11733:tid 11745] [client 4.197.185.167:2945] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8DzmtBRXExJb1PHbtAAAAQo"]
[Wed Dec 17 16:50:56.260477 2025] [:error] [pid 45532:tid 45603] [client 4.197.185.167:2952] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8AeWB-JXOyTKNs39xQAAAI0"]
[Wed Dec 17 16:50:56.295290 2025] [:error] [pid 45530:tid 45546] [client 4.197.185.167:2890] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8G4IsXcKlf7LWf_PGwAAAAs"]
[Wed Dec 17 16:50:56.340883 2025] [:error] [pid 45530:tid 45537] [client 4.197.185.167:12629] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8G4IsXcKlf7LWf_PHAAAAAI"]
[Wed Dec 17 16:50:56.383709 2025] [:error] [pid 45621:tid 45635] [client 4.197.185.167:3069] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aUJu8OVNGQfJ1rR90pQaUAAAAMk"]
[Wed Dec 17 16:50:56.434892 2025] [:error] [pid 45621:tid 45645] [client 4.197.185.167:3026] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aUJu8OVNGQfJ1rR90pQaUQAAANM"]
[Wed Dec 17 16:50:56.471991 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:12598] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aUJu8G4IsXcKlf7LWf_PHQAAABU"]
[Wed Dec 17 16:50:56.508731 2025] [:error] [pid 45530:tid 45557] [client 4.197.185.167:3008] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aUJu8G4IsXcKlf7LWf_PHgAAABY"]
[Wed Dec 17 16:50:56.542470 2025] [:error] [pid 11733:tid 11738] [client 4.197.185.167:3018] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aUJu8DzmtBRXExJb1PHbtQAAAQM"]
[Wed Dec 17 16:50:56.576554 2025] [:error] [pid 45621:tid 45629] [client 4.197.185.167:12595] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aUJu8OVNGQfJ1rR90pQaUgAAAMM"]
[Wed Dec 17 16:50:56.611230 2025] [:error] [pid 11733:tid 11748] [client 4.197.185.167:3028] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aUJu8DzmtBRXExJb1PHbtgAAAQ0"]
[Wed Dec 17 16:50:56.641888 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:2944] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aUJu8OVNGQfJ1rR90pQaVAAAANI"]
[Wed Dec 17 16:50:56.674630 2025] [:error] [pid 45621:tid 45650] [client 4.197.185.167:2994] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aUJu8OVNGQfJ1rR90pQaVQAAANg"]
[Wed Dec 17 16:50:56.708266 2025] [:error] [pid 45532:tid 45599] [client 4.197.185.167:3032] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aUJu8AeWB-JXOyTKNs39xgAAAIk"]
[Wed Dec 17 16:50:56.752169 2025] [:error] [pid 11733:tid 11754] [client 4.197.185.167:3021] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aUJu8DzmtBRXExJb1PHbtwAAARM"]
[Wed Dec 17 16:50:56.791459 2025] [:error] [pid 11733:tid 11747] [client 4.197.185.167:3013] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aUJu8DzmtBRXExJb1PHbuAAAAQw"]
[Wed Dec 17 16:50:56.827274 2025] [:error] [pid 45532:tid 45592] [client 4.197.185.167:12650] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aUJu8AeWB-JXOyTKNs39xwAAAII"]
[Wed Dec 17 16:50:56.868398 2025] [:error] [pid 45532:tid 45601] [client 4.197.185.167:2997] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aUJu8AeWB-JXOyTKNs39yAAAAIs"]
[Wed Dec 17 16:50:56.902190 2025] [:error] [pid 11733:tid 11755] [client 4.197.185.167:12614] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aUJu8DzmtBRXExJb1PHbuQAAARQ"]
[Wed Dec 17 16:50:56.935590 2025] [:error] [pid 11733:tid 11749] [client 4.197.185.167:2976] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aUJu8DzmtBRXExJb1PHbugAAAQ4"]
[Wed Dec 17 16:50:56.968237 2025] [:error] [pid 45532:tid 45608] [client 4.197.185.167:3042] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aUJu8AeWB-JXOyTKNs39yQAAAJI"]
[Wed Dec 17 16:50:56.998676 2025] [:error] [pid 11733:tid 11742] [client 4.197.185.167:2990] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aUJu8DzmtBRXExJb1PHbuwAAAQc"]
[Wed Dec 17 16:50:57.029028 2025] [:error] [pid 11733:tid 11756] [client 4.197.185.167:2925] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aUJu8TzmtBRXExJb1PHbvAAAARU"]
[Wed Dec 17 16:50:57.063124 2025] [:error] [pid 11733:tid 11744] [client 4.197.185.167:3019] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aUJu8TzmtBRXExJb1PHbvQAAAQk"]
[Wed Dec 17 16:50:57.106319 2025] [:error] [pid 11733:tid 11757] [client 4.197.185.167:2985] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aUJu8TzmtBRXExJb1PHbvgAAARY"]
[Wed Dec 17 16:50:57.143177 2025] [:error] [pid 45621:tid 45643] [client 4.197.185.167:12622] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aUJu8eVNGQfJ1rR90pQaVwAAANE"]
[Wed Dec 17 16:50:57.173611 2025] [:error] [pid 11733:tid 11740] [client 4.197.185.167:2885] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aUJu8TzmtBRXExJb1PHbvwAAAQU"]
[Wed Dec 17 16:50:57.207291 2025] [:error] [pid 11733:tid 11758] [client 4.197.185.167:12644] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aUJu8TzmtBRXExJb1PHbwAAAARc"]
[Wed Dec 17 16:50:57.255912 2025] [:error] [pid 11733:tid 11746] [client 4.197.185.167:3023] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aUJu8TzmtBRXExJb1PHbwQAAAQs"]
[Wed Dec 17 16:50:57.287346 2025] [:error] [pid 11733:tid 11739] [client 4.197.185.167:2934] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aUJu8TzmtBRXExJb1PHbwgAAAQQ"]
[Wed Dec 17 16:50:57.317872 2025] [:error] [pid 45532:tid 45614] [client 4.197.185.167:2914] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aUJu8QeWB-JXOyTKNs39ygAAAJg"]
[Wed Dec 17 16:50:57.358066 2025] [:error] [pid 11733:tid 11741] [client 4.197.185.167:2969] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aUJu8TzmtBRXExJb1PHbwwAAAQY"]
[Wed Dec 17 16:50:57.407972 2025] [:error] [pid 45621:tid 45638] [client 4.197.185.167:2996] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUJu8eVNGQfJ1rR90pQaWQAAAMw"]
[Wed Dec 17 16:50:57.458227 2025] [:error] [pid 11733:tid 11751] [client 4.197.185.167:2900] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUJu8TzmtBRXExJb1PHbxAAAARA"]
[Wed Dec 17 16:50:57.495875 2025] [:error] [pid 45530:tid 45551] [client 4.197.185.167:3040] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUJu8W4IsXcKlf7LWf_PIAAAABA"]
[Wed Dec 17 16:50:57.530500 2025] [:error] [pid 45621:tid 45648] [client 4.197.185.167:2999] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUJu8eVNGQfJ1rR90pQaWgAAANY"]
[Wed Dec 17 16:50:57.563897 2025] [:error] [pid 45532:tid 45593] [client 4.197.185.167:3063] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aUJu8QeWB-JXOyTKNs39ywAAAIM"]
[Wed Dec 17 16:50:57.594959 2025] [:error] [pid 45532:tid 45610] [client 4.197.185.167:3038] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aUJu8QeWB-JXOyTKNs39zAAAAJQ"]
[Wed Dec 17 16:50:57.627883 2025] [:error] [pid 45532:tid 45594] [client 4.197.185.167:3061] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aUJu8QeWB-JXOyTKNs39zQAAAIQ"]
[Wed Dec 17 16:50:57.659378 2025] [:error] [pid 45621:tid 45641] [client 4.197.185.167:2974] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aUJu8eVNGQfJ1rR90pQaWwAAAM8"]
[Wed Dec 17 16:50:57.691160 2025] [:error] [pid 45621:tid 45647] [client 4.197.185.167:2949] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aUJu8eVNGQfJ1rR90pQaXAAAANU"]
[Wed Dec 17 16:50:57.731514 2025] [:error] [pid 45621:tid 45634] [client 4.197.185.167:12567] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aUJu8eVNGQfJ1rR90pQaXQAAAMg"]
[Wed Dec 17 16:50:57.807605 2025] [:error] [pid 45532:tid 45613] [client 4.197.185.167:3057] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aUJu8QeWB-JXOyTKNs390AAAAJc"]
[Wed Dec 17 16:50:57.840207 2025] [:error] [pid 45532:tid 45591] [client 4.197.185.167:2831] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aUJu8QeWB-JXOyTKNs390QAAAIE"]
[Wed Dec 17 16:50:57.874052 2025] [:error] [pid 45532:tid 45602] [client 4.197.185.167:2965] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aUJu8QeWB-JXOyTKNs390gAAAIw"]
[Wed Dec 17 16:50:57.904370 2025] [:error] [pid 45532:tid 45611] [client 4.197.185.167:2859] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aUJu8QeWB-JXOyTKNs390wAAAJU"]
[Wed Dec 17 16:50:57.934762 2025] [:error] [pid 45532:tid 45598] [client 4.197.185.167:3062] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aUJu8QeWB-JXOyTKNs391AAAAIg"]
[Wed Dec 17 16:50:57.964864 2025] [:error] [pid 11733:tid 11737] [client 4.197.185.167:2956] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aUJu8TzmtBRXExJb1PHbxQAAAQI"]
[Wed Dec 17 16:50:58.004661 2025] [:error] [pid 45532:tid 45600] [client 4.197.185.167:2895] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aUJu8geWB-JXOyTKNs391QAAAIo"]
[Wed Dec 17 16:50:58.044615 2025] [:error] [pid 11733:tid 11750] [client 4.197.185.167:2916] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aUJu8jzmtBRXExJb1PHbxgAAAQ8"]
[Wed Dec 17 16:50:58.081632 2025] [:error] [pid 11733:tid 11736] [client 4.197.185.167:3059] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aUJu8jzmtBRXExJb1PHbxwAAAQE"]
[Wed Dec 17 16:50:58.115373 2025] [:error] [pid 11733:tid 11738] [client 4.197.185.167:2998] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aUJu8jzmtBRXExJb1PHbyAAAAQM"]
[Wed Dec 17 16:50:58.149026 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:2982] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aUJu8m4IsXcKlf7LWf_PIQAAAA0"]
[Wed Dec 17 16:50:58.182227 2025] [:error] [pid 45621:tid 45626] [client 4.197.185.167:2948] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaXgAAAMA"]
[Wed Dec 17 16:50:58.214105 2025] [:error] [pid 45621:tid 45628] [client 4.197.185.167:2960] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaXwAAAMI"]
[Wed Dec 17 16:50:58.249036 2025] [:error] [pid 11733:tid 11748] [client 4.197.185.167:12642] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aUJu8jzmtBRXExJb1PHbygAAAQ0"]
[Wed Dec 17 16:50:58.280223 2025] [:error] [pid 45621:tid 45640] [client 4.197.185.167:3036] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaYAAAAM4"]
[Wed Dec 17 16:50:58.323103 2025] [:error] [pid 45621:tid 45635] [client 4.197.185.167:3001] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaYQAAAMk"]
[Wed Dec 17 16:50:58.355232 2025] [:error] [pid 45621:tid 45645] [client 4.197.185.167:2903] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaYgAAANM"]
[Wed Dec 17 16:50:58.389435 2025] [:error] [pid 45621:tid 45629] [client 4.197.185.167:2821] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaYwAAAMM"]
[Wed Dec 17 16:50:58.457304 2025] [:error] [pid 45530:tid 45552] [client 4.197.185.167:2951] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8m4IsXcKlf7LWf_PIgAAABE"]
[Wed Dec 17 16:50:58.496677 2025] [:error] [pid 45530:tid 45555] [client 4.197.185.167:12628] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8m4IsXcKlf7LWf_PJAAAABQ"]
[Wed Dec 17 16:50:58.532708 2025] [:error] [pid 45530:tid 45559] [client 4.197.185.167:2966] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8m4IsXcKlf7LWf_PJQAAABg"]
[Wed Dec 17 16:50:58.567463 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:3068] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaZAAAANI"]
[Wed Dec 17 16:50:58.599432 2025] [:error] [pid 45530:tid 45547] [client 4.197.185.167:3004] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUJu8m4IsXcKlf7LWf_PJgAAAAw"]
[Wed Dec 17 16:50:58.630863 2025] [:error] [pid 45621:tid 45631] [client 4.197.185.167:2961] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaZgAAAMU"]
[Wed Dec 17 16:50:58.672956 2025] [:error] [pid 45621:tid 45630] [client 4.197.185.167:3071] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaZwAAAMQ"]
[Wed Dec 17 16:50:58.710619 2025] [:error] [pid 45621:tid 45637] [client 4.197.185.167:2835] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaaAAAAMs"]
[Wed Dec 17 16:50:58.743391 2025] [:error] [pid 45532:tid 45592] [client 4.197.185.167:2906] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aUJu8geWB-JXOyTKNs391gAAAII"]
[Wed Dec 17 16:50:58.777410 2025] [:error] [pid 45621:tid 45646] [client 4.197.185.167:2908] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aUJu8uVNGQfJ1rR90pQaaQAAANQ"]
[Wed Dec 17 16:50:58.818756 2025] [:error] [pid 45530:tid 45553] [client 4.197.185.167:2920] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aUJu8m4IsXcKlf7LWf_PJwAAABI"]
[Wed Dec 17 16:50:58.852007 2025] [:error] [pid 45530:tid 45554] [client 4.197.185.167:2918] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aUJu8m4IsXcKlf7LWf_PKAAAABM"]
[Wed Dec 17 16:50:58.894016 2025] [:error] [pid 45532:tid 45614] [client 4.197.185.167:2884] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aUJu8geWB-JXOyTKNs392AAAAJg"]
[Wed Dec 17 16:50:58.925690 2025] [:error] [pid 45532:tid 45610] [client 4.197.185.167:2987] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aUJu8geWB-JXOyTKNs392QAAAJQ"]
[Wed Dec 17 16:50:58.956820 2025] [:error] [pid 45531:tid 45576] [client 4.197.185.167:2917] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aUJu8ojuE-Fd-sBWjvVAfAAAAE0"]
[Wed Dec 17 16:50:58.987688 2025] [:error] [pid 45531:tid 45573] [client 4.197.185.167:2955] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aUJu8ojuE-Fd-sBWjvVAfQAAAEo"]
[Wed Dec 17 16:50:59.021400 2025] [:error] [pid 45532:tid 45590] [client 4.197.185.167:2973] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aUJu8weWB-JXOyTKNs392gAAAIA"]
[Wed Dec 17 16:50:59.051221 2025] [:error] [pid 45532:tid 45605] [client 4.197.185.167:2975] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aUJu8weWB-JXOyTKNs392wAAAI8"]
[Wed Dec 17 16:50:59.081280 2025] [:error] [pid 45621:tid 45649] [client 4.197.185.167:2971] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aUJu8-VNGQfJ1rR90pQaagAAANc"]
[Wed Dec 17 16:50:59.114389 2025] [:error] [pid 45532:tid 45612] [client 4.197.185.167:2935] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aUJu8weWB-JXOyTKNs393AAAAJY"]
[Wed Dec 17 16:50:59.148438 2025] [:error] [pid 45621:tid 45627] [client 4.197.185.167:2939] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aUJu8-VNGQfJ1rR90pQaawAAAME"]
[Wed Dec 17 16:50:59.181067 2025] [:error] [pid 45532:tid 45597] [client 4.197.185.167:2898] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aUJu8weWB-JXOyTKNs393QAAAIc"]
[Wed Dec 17 16:50:59.211515 2025] [:error] [pid 45621:tid 45643] [client 4.197.185.167:3020] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aUJu8-VNGQfJ1rR90pQabAAAANE"]
[Wed Dec 17 16:50:59.244192 2025] [:error] [pid 45621:tid 45632] [client 4.197.185.167:2972] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aUJu8-VNGQfJ1rR90pQabQAAAMY"]
[Wed Dec 17 16:50:59.275974 2025] [:error] [pid 45621:tid 45638] [client 4.197.185.167:2993] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUJu8-VNGQfJ1rR90pQabgAAAMw"]
[Wed Dec 17 16:50:59.308460 2025] [:error] [pid 45621:tid 45641] [client 4.197.185.167:3052] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUJu8-VNGQfJ1rR90pQacAAAAM8"]
[Wed Dec 17 16:50:59.353467 2025] [:error] [pid 45531:tid 45567] [client 4.197.185.167:2762] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUJu84juE-Fd-sBWjvVAfwAAAEQ"]
[Wed Dec 17 16:50:59.385383 2025] [:error] [pid 45532:tid 45591] [client 4.197.185.167:2848] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUJu8weWB-JXOyTKNs393gAAAIE"]
[Wed Dec 17 16:50:59.419737 2025] [:error] [pid 45531:tid 45583] [client 4.197.185.167:12669] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUJu84juE-Fd-sBWjvVAgAAAAFQ"]
[Wed Dec 17 16:50:59.491989 2025] [:error] [pid 45532:tid 45602] [client 4.197.185.167:2889] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUJu8weWB-JXOyTKNs393wAAAIw"]
[Wed Dec 17 16:50:59.523170 2025] [:error] [pid 45621:tid 45634] [client 4.197.185.167:2909] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUJu8-VNGQfJ1rR90pQacQAAAMg"]
[Wed Dec 17 16:50:59.556154 2025] [:error] [pid 45531:tid 45572] [client 4.197.185.167:2979] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUJu84juE-Fd-sBWjvVAgQAAAEk"]
[Wed Dec 17 16:50:59.590362 2025] [:error] [pid 45621:tid 45626] [client 4.197.185.167:3011] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUJu8-VNGQfJ1rR90pQacgAAAMA"]
[Wed Dec 17 16:50:59.644452 2025] [:error] [pid 45621:tid 45628] [client 4.197.185.167:2929] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUJu8-VNGQfJ1rR90pQacwAAAMI"]
[Wed Dec 17 16:50:59.686290 2025] [:error] [pid 45530:tid 45543] [client 4.197.185.167:2967] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUJu824IsXcKlf7LWf_PKgAAAAg"]
[Wed Dec 17 16:50:59.720976 2025] [:error] [pid 45530:tid 45535] [client 4.197.185.167:2922] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUJu824IsXcKlf7LWf_PKwAAAAA"]
[Wed Dec 17 16:50:59.756401 2025] [:error] [pid 45621:tid 45635] [client 4.197.185.167:2824] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUJu8-VNGQfJ1rR90pQadAAAAMk"]
[Wed Dec 17 16:50:59.787024 2025] [:error] [pid 45530:tid 45542] [client 4.197.185.167:3050] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUJu824IsXcKlf7LWf_PLAAAAAc"]
[Wed Dec 17 16:50:59.822659 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:12604] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUJu824IsXcKlf7LWf_PLQAAAAQ"]
[Wed Dec 17 16:50:59.866391 2025] [:error] [pid 45621:tid 45645] [client 4.197.185.167:2820] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUJu8-VNGQfJ1rR90pQadgAAANM"]
[Wed Dec 17 16:50:59.905385 2025] [:error] [pid 45530:tid 45545] [client 4.197.185.167:3017] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aUJu824IsXcKlf7LWf_PLgAAAAo"]
[Wed Dec 17 16:50:59.937434 2025] [:error] [pid 45531:tid 45564] [client 4.197.185.167:2977] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aUJu84juE-Fd-sBWjvVAgwAAAEE"]
[Wed Dec 17 16:50:59.970797 2025] [:error] [pid 45530:tid 45546] [client 4.197.185.167:2912] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aUJu824IsXcKlf7LWf_PLwAAAAs"]
[Wed Dec 17 16:51:00.005038 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:2875] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aUJu9OVNGQfJ1rR90pQadwAAANI"]
[Wed Dec 17 16:51:00.042925 2025] [:error] [pid 45532:tid 45611] [client 4.197.185.167:2980] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aUJu9AeWB-JXOyTKNs394AAAAJU"]
[Wed Dec 17 16:51:00.074240 2025] [:error] [pid 45531:tid 45574] [client 4.197.185.167:2844] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAhAAAAEs"]
[Wed Dec 17 16:51:00.105094 2025] [:error] [pid 45531:tid 45579] [client 4.197.185.167:2892] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAhQAAAFA"]
[Wed Dec 17 16:51:00.137563 2025] [:error] [pid 45531:tid 45570] [client 4.197.185.167:2841] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAhgAAAEc"]
[Wed Dec 17 16:51:00.172139 2025] [:error] [pid 45532:tid 45598] [client 4.197.185.167:2760] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aUJu9AeWB-JXOyTKNs394QAAAIg"]
[Wed Dec 17 16:51:00.205514 2025] [:error] [pid 45532:tid 45600] [client 4.197.185.167:2872] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aUJu9AeWB-JXOyTKNs394gAAAIo"]
[Wed Dec 17 16:51:00.237582 2025] [:error] [pid 45621:tid 45631] [client 4.197.185.167:2850] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aUJu9OVNGQfJ1rR90pQaeQAAAMU"]
[Wed Dec 17 16:51:00.271449 2025] [:error] [pid 45621:tid 45630] [client 4.197.185.167:2897] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aUJu9OVNGQfJ1rR90pQaegAAAMQ"]
[Wed Dec 17 16:51:00.302291 2025] [:error] [pid 45532:tid 45595] [client 4.197.185.167:2915] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUJu9AeWB-JXOyTKNs394wAAAIU"]
[Wed Dec 17 16:51:00.334481 2025] [:error] [pid 45532:tid 45603] [client 4.197.185.167:2981] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUJu9AeWB-JXOyTKNs395AAAAI0"]
[Wed Dec 17 16:51:00.367085 2025] [:error] [pid 45532:tid 45599] [client 4.197.185.167:2989] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUJu9AeWB-JXOyTKNs395QAAAIk"]
[Wed Dec 17 16:51:00.405766 2025] [:error] [pid 45531:tid 45585] [client 4.197.185.167:2933] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAhwAAAFY"]
[Wed Dec 17 16:51:00.439509 2025] [:error] [pid 45530:tid 45537] [client 4.197.185.167:2864] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUJu9G4IsXcKlf7LWf_PMAAAAAI"]
[Wed Dec 17 16:51:00.501867 2025] [:error] [pid 45621:tid 45637] [client 4.197.185.167:2832] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUJu9OVNGQfJ1rR90pQaewAAAMs"]
[Wed Dec 17 16:51:00.536316 2025] [:error] [pid 45621:tid 45650] [client 4.197.185.167:2847] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUJu9OVNGQfJ1rR90pQafAAAANg"]
[Wed Dec 17 16:51:00.573520 2025] [:error] [pid 45530:tid 45544] [client 4.197.185.167:2943] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUJu9G4IsXcKlf7LWf_PMQAAAAk"]
[Wed Dec 17 16:51:00.623481 2025] [:error] [pid 45530:tid 45551] [client 4.197.185.167:3006] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu9G4IsXcKlf7LWf_PMwAAABA"]
[Wed Dec 17 16:51:00.664713 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:3027] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu9G4IsXcKlf7LWf_PNAAAABU"]
[Wed Dec 17 16:51:00.695791 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:3005] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu9G4IsXcKlf7LWf_PNQAAAA0"]
[Wed Dec 17 16:51:00.739436 2025] [:error] [pid 45531:tid 45575] [client 4.197.185.167:2880] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAiQAAAEw"]
[Wed Dec 17 16:51:00.777454 2025] [:error] [pid 45621:tid 45646] [client 4.197.185.167:2978] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aUJu9OVNGQfJ1rR90pQafgAAANQ"]
[Wed Dec 17 16:51:00.808327 2025] [:error] [pid 45531:tid 45568] [client 4.197.185.167:2828] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAigAAAEU"]
[Wed Dec 17 16:51:00.843996 2025] [:error] [pid 45531:tid 45566] [client 4.197.185.167:2886] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAiwAAAEM"]
[Wed Dec 17 16:51:00.884623 2025] [:error] [pid 45531:tid 45577] [client 4.197.185.167:2970] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAjQAAAE4"]
[Wed Dec 17 16:51:00.918233 2025] [:error] [pid 45531:tid 45571] [client 4.197.185.167:2868] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAjgAAAEg"]
[Wed Dec 17 16:51:00.951039 2025] [:error] [pid 45531:tid 45569] [client 4.197.185.167:2826] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAjwAAAEY"]
[Wed Dec 17 16:51:00.983169 2025] [:error] [pid 45531:tid 45576] [client 4.197.185.167:2797] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu9IjuE-Fd-sBWjvVAkAAAAE0"]
[Wed Dec 17 16:51:01.015648 2025] [:error] [pid 45531:tid 45573] [client 4.197.185.167:2936] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAkQAAAEo"]
[Wed Dec 17 16:51:01.046924 2025] [:error] [pid 45531:tid 45587] [client 4.197.185.167:2984] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAkgAAAFg"]
[Wed Dec 17 16:51:01.077679 2025] [:error] [pid 45531:tid 45567] [client 4.197.185.167:2921] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAkwAAAEQ"]
[Wed Dec 17 16:51:01.109166 2025] [:error] [pid 45621:tid 45649] [client 4.197.185.167:2839] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aUJu9eVNGQfJ1rR90pQafwAAANc"]
[Wed Dec 17 16:51:01.142758 2025] [:error] [pid 45531:tid 45583] [client 4.197.185.167:2508] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAlAAAAFQ"]
[Wed Dec 17 16:51:01.175739 2025] [:error] [pid 45621:tid 45627] [client 4.197.185.167:12649] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aUJu9eVNGQfJ1rR90pQagAAAAME"]
[Wed Dec 17 16:51:01.207785 2025] [:error] [pid 45532:tid 45609] [client 4.197.185.167:2837] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aUJu9QeWB-JXOyTKNs395gAAAJM"]
[Wed Dec 17 16:51:01.242184 2025] [:error] [pid 45530:tid 45550] [client 4.197.185.167:2893] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aUJu9W4IsXcKlf7LWf_PNgAAAA8"]
[Wed Dec 17 16:51:01.286667 2025] [:error] [pid 45530:tid 45536] [client 4.197.185.167:2882] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aUJu9W4IsXcKlf7LWf_PNwAAAAE"]
[Wed Dec 17 16:51:01.319893 2025] [:error] [pid 45530:tid 45552] [client 4.197.185.167:2932] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aUJu9W4IsXcKlf7LWf_POAAAABE"]
[Wed Dec 17 16:51:01.353526 2025] [:error] [pid 45530:tid 45555] [client 4.197.185.167:2888] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aUJu9W4IsXcKlf7LWf_POQAAABQ"]
[Wed Dec 17 16:51:01.391232 2025] [:error] [pid 45530:tid 45547] [client 4.197.185.167:2907] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aUJu9W4IsXcKlf7LWf_POwAAAAw"]
[Wed Dec 17 16:51:01.422030 2025] [:error] [pid 45530:tid 45553] [client 4.197.185.167:2901] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aUJu9W4IsXcKlf7LWf_PPAAAABI"]
[Wed Dec 17 16:51:01.456453 2025] [:error] [pid 45530:tid 45554] [client 4.197.185.167:2905] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aUJu9W4IsXcKlf7LWf_PPQAAABM"]
[Wed Dec 17 16:51:01.514370 2025] [:error] [pid 45531:tid 45580] [client 4.197.185.167:2904] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAlQAAAFE"]
[Wed Dec 17 16:51:01.548597 2025] [:error] [pid 45621:tid 45643] [client 4.197.185.167:12582] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aUJu9eVNGQfJ1rR90pQagQAAANE"]
[Wed Dec 17 16:51:01.581819 2025] [:error] [pid 45532:tid 45601] [client 4.197.185.167:3066] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aUJu9QeWB-JXOyTKNs395wAAAIs"]
[Wed Dec 17 16:51:01.612374 2025] [:error] [pid 45532:tid 45614] [client 4.197.185.167:2927] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aUJu9QeWB-JXOyTKNs396AAAAJg"]
[Wed Dec 17 16:51:01.667095 2025] [:error] [pid 45532:tid 45608] [client 4.197.185.167:2823] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aUJu9QeWB-JXOyTKNs396QAAAJI"]
[Wed Dec 17 16:51:01.700440 2025] [:error] [pid 45532:tid 45593] [client 4.197.185.167:2941] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aUJu9QeWB-JXOyTKNs396gAAAIM"]
[Wed Dec 17 16:51:01.739705 2025] [:error] [pid 45621:tid 45632] [client 4.197.185.167:2931] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aUJu9eVNGQfJ1rR90pQaggAAAMY"]
[Wed Dec 17 16:51:01.781923 2025] [:error] [pid 45531:tid 45578] [client 4.197.185.167:2896] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAlwAAAE8"]
[Wed Dec 17 16:51:01.814804 2025] [:error] [pid 45531:tid 45565] [client 4.197.185.167:2988] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAmAAAAEI"]
[Wed Dec 17 16:51:01.848681 2025] [:error] [pid 45621:tid 45648] [client 4.197.185.167:2887] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUJu9eVNGQfJ1rR90pQagwAAANY"]
[Wed Dec 17 16:51:01.878867 2025] [:error] [pid 45530:tid 45549] [client 4.197.185.167:3002] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUJu9W4IsXcKlf7LWf_PPgAAAA4"]
[Wed Dec 17 16:51:01.910498 2025] [:error] [pid 45621:tid 45641] [client 4.197.185.167:2928] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUJu9eVNGQfJ1rR90pQahAAAAM8"]
[Wed Dec 17 16:51:01.943535 2025] [:error] [pid 45530:tid 45538] [client 4.197.185.167:2845] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUJu9W4IsXcKlf7LWf_PPwAAAAM"]
[Wed Dec 17 16:51:01.976695 2025] [:error] [pid 45531:tid 45579] [client 4.197.185.167:3058] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUJu9YjuE-Fd-sBWjvVAmgAAAFA"]
[Wed Dec 17 16:51:02.027816 2025] [:error] [pid 45621:tid 45634] [client 4.197.185.167:2769] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUJu9uVNGQfJ1rR90pQahQAAAMg"]
[Wed Dec 17 16:51:02.067463 2025] [:error] [pid 45532:tid 45606] [client 4.197.185.167:2816] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUJu9geWB-JXOyTKNs396wAAAJA"]
[Wed Dec 17 16:51:02.101360 2025] [:error] [pid 45531:tid 45570] [client 4.197.185.167:2937] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAmwAAAEc"]
[Wed Dec 17 16:51:02.133657 2025] [:error] [pid 45621:tid 45626] [client 4.197.185.167:2902] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUJu9uVNGQfJ1rR90pQahgAAAMA"]
[Wed Dec 17 16:51:02.163902 2025] [:error] [pid 45532:tid 45610] [client 4.197.185.167:2833] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUJu9geWB-JXOyTKNs397AAAAJQ"]
[Wed Dec 17 16:51:02.208096 2025] [:error] [pid 45532:tid 45594] [client 4.197.185.167:2857] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUJu9geWB-JXOyTKNs397QAAAIQ"]
[Wed Dec 17 16:51:02.240750 2025] [:error] [pid 45621:tid 45628] [client 4.197.185.167:2761] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUJu9uVNGQfJ1rR90pQahwAAAMI"]
[Wed Dec 17 16:51:02.273432 2025] [:error] [pid 45531:tid 45585] [client 4.197.185.167:2911] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAnAAAAFY"]
[Wed Dec 17 16:51:02.306147 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:2870] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUJu9m4IsXcKlf7LWf_PQAAAAAQ"]
[Wed Dec 17 16:51:02.348796 2025] [:error] [pid 45532:tid 45596] [client 4.197.185.167:2840] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aUJu9geWB-JXOyTKNs397gAAAIY"]
[Wed Dec 17 16:51:02.380503 2025] [:error] [pid 45530:tid 45540] [client 4.197.185.167:2891] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aUJu9m4IsXcKlf7LWf_PQQAAAAU"]
[Wed Dec 17 16:51:02.411472 2025] [:error] [pid 45530:tid 45545] [client 4.197.185.167:2881] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aUJu9m4IsXcKlf7LWf_PQgAAAAo"]
[Wed Dec 17 16:51:02.446003 2025] [:error] [pid 45621:tid 45640] [client 4.197.185.167:2919] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aUJu9uVNGQfJ1rR90pQaiAAAAM4"]
[Wed Dec 17 16:51:02.478622 2025] [:error] [pid 45621:tid 45635] [client 4.197.185.167:2754] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUJu9uVNGQfJ1rR90pQaiQAAAMk"]
[Wed Dec 17 16:51:02.543490 2025] [:error] [pid 45530:tid 45537] [client 4.197.185.167:2983] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUJu9m4IsXcKlf7LWf_PRAAAAAI"]
[Wed Dec 17 16:51:02.576353 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:2854] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUJu9uVNGQfJ1rR90pQaigAAANI"]
[Wed Dec 17 16:51:02.608634 2025] [:error] [pid 45621:tid 45647] [client 4.197.185.167:2986] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUJu9uVNGQfJ1rR90pQajAAAANU"]
[Wed Dec 17 16:51:02.642328 2025] [:error] [pid 45531:tid 45575] [client 4.197.185.167:2771] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAnQAAAEw"]
[Wed Dec 17 16:51:02.703661 2025] [:error] [pid 45531:tid 45568] [client 4.197.185.167:2836] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAngAAAEU"]
[Wed Dec 17 16:51:02.734618 2025] [:error] [pid 45531:tid 45566] [client 4.197.185.167:2849] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAnwAAAEM"]
[Wed Dec 17 16:51:02.768425 2025] [:error] [pid 45531:tid 45563] [client 4.197.185.167:2894] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAoAAAAEA"]
[Wed Dec 17 16:51:02.799598 2025] [:error] [pid 45531:tid 45577] [client 4.197.185.167:2753] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAoQAAAE4"]
[Wed Dec 17 16:51:02.830311 2025] [:error] [pid 45531:tid 45571] [client 4.197.185.167:2942] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVAogAAAEg"]
[Wed Dec 17 16:51:02.862896 2025] [:error] [pid 45530:tid 45541] [client 4.197.185.167:2763] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUJu9m4IsXcKlf7LWf_PSAAAAAY"]
[Wed Dec 17 16:51:02.893353 2025] [:error] [pid 45531:tid 45576] [client 4.197.185.167:2819] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUJu9ojuE-Fd-sBWjvVApAAAAE0"]
[Wed Dec 17 16:51:02.923811 2025] [:error] [pid 45530:tid 45544] [client 4.197.185.167:2923] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aUJu9m4IsXcKlf7LWf_PSQAAAAk"]
[Wed Dec 17 16:51:02.954348 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:2855] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aUJu9m4IsXcKlf7LWf_PSgAAABU"]
[Wed Dec 17 16:51:02.987415 2025] [:error] [pid 45621:tid 45633] [client 4.197.185.167:2818] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aUJu9uVNGQfJ1rR90pQajQAAAMc"]
[Wed Dec 17 16:51:03.017716 2025] [:error] [pid 45532:tid 45605] [client 4.197.185.167:2772] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aUJu9weWB-JXOyTKNs398AAAAI8"]
[Wed Dec 17 16:51:03.048004 2025] [:error] [pid 45621:tid 45636] [client 4.197.185.167:2759] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aUJu9-VNGQfJ1rR90pQajgAAAMo"]
[Wed Dec 17 16:51:03.081076 2025] [:error] [pid 45621:tid 45646] [client 4.197.185.167:2773] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aUJu9-VNGQfJ1rR90pQajwAAANQ"]
[Wed Dec 17 16:51:03.112950 2025] [:error] [pid 45621:tid 45629] [client 4.197.185.167:2780] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aUJu9-VNGQfJ1rR90pQakAAAAMM"]
[Wed Dec 17 16:51:03.144198 2025] [:error] [pid 11733:tid 11758] [client 4.197.185.167:2867] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aUJu9zzmtBRXExJb1PHb0AAAARc"]
[Wed Dec 17 16:51:03.176866 2025] [:error] [pid 45621:tid 45649] [client 4.197.185.167:2878] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUJu9-VNGQfJ1rR90pQakgAAANc"]
[Wed Dec 17 16:51:03.207973 2025] [:error] [pid 45621:tid 45627] [client 4.197.185.167:2825] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUJu9-VNGQfJ1rR90pQakwAAAME"]
[Wed Dec 17 16:51:03.239760 2025] [:error] [pid 45531:tid 45587] [client 4.197.185.167:2521] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUJu94juE-Fd-sBWjvVApQAAAFg"]
[Wed Dec 17 16:51:03.276215 2025] [:error] [pid 45531:tid 45583] [client 4.197.185.167:2926] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUJu94juE-Fd-sBWjvVApgAAAFQ"]
[Wed Dec 17 16:51:03.320835 2025] [:error] [pid 45531:tid 45572] [client 4.197.185.167:2796] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUJu94juE-Fd-sBWjvVApwAAAEk"]
[Wed Dec 17 16:51:03.354605 2025] [:error] [pid 45531:tid 45580] [client 4.197.185.167:2838] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUJu94juE-Fd-sBWjvVAqAAAAFE"]
[Wed Dec 17 16:51:03.414529 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:2924] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUJu924IsXcKlf7LWf_PSwAAAA0"]
[Wed Dec 17 16:51:03.445674 2025] [:error] [pid 45621:tid 45643] [client 4.197.185.167:2503] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUJu9-VNGQfJ1rR90pQalAAAANE"]
[Wed Dec 17 16:51:03.478292 2025] [:error] [pid 45532:tid 45613] [client 4.197.185.167:2913] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aUJu9weWB-JXOyTKNs398QAAAJc"]
[Wed Dec 17 16:51:03.553594 2025] [:error] [pid 45531:tid 45578] [client 4.197.185.167:2874] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aUJu94juE-Fd-sBWjvVAqQAAAE8"]
[Wed Dec 17 16:51:03.588672 2025] [:error] [pid 45621:tid 45638] [client 4.197.185.167:2792] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aUJu9-VNGQfJ1rR90pQalQAAAMw"]
[Wed Dec 17 16:51:03.619509 2025] [:error] [pid 45530:tid 45536] [client 4.197.185.167:2506] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aUJu924IsXcKlf7LWf_PTAAAAAE"]
[Wed Dec 17 16:51:03.651432 2025] [:error] [pid 45531:tid 45581] [client 4.197.185.167:2509] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUJu94juE-Fd-sBWjvVAqwAAAFI"]
[Wed Dec 17 16:51:03.684385 2025] [:error] [pid 45530:tid 45552] [client 4.197.185.167:2798] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUJu924IsXcKlf7LWf_PTQAAABE"]
[Wed Dec 17 16:51:03.726647 2025] [:error] [pid 45531:tid 45565] [client 4.197.185.167:2834] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUJu94juE-Fd-sBWjvVArAAAAEI"]
[Wed Dec 17 16:51:03.756905 2025] [:error] [pid 45531:tid 45579] [client 4.197.185.167:2827] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aUJu94juE-Fd-sBWjvVArQAAAFA"]
[Wed Dec 17 16:51:03.803563 2025] [:error] [pid 45531:tid 45570] [client 4.197.185.167:2776] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aUJu94juE-Fd-sBWjvVArwAAAEc"]
[Wed Dec 17 16:51:03.836457 2025] [:error] [pid 45531:tid 45585] [client 4.197.185.167:2938] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aUJu94juE-Fd-sBWjvVAsAAAAFY"]
[Wed Dec 17 16:51:03.869470 2025] [:error] [pid 45531:tid 45582] [client 4.197.185.167:12617] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aUJu94juE-Fd-sBWjvVAsQAAAFM"]
[Wed Dec 17 16:51:03.902668 2025] [:error] [pid 45531:tid 45586] [client 4.197.185.167:2774] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aUJu94juE-Fd-sBWjvVAsgAAAFc"]
[Wed Dec 17 16:51:03.933715 2025] [:error] [pid 45531:tid 45575] [client 4.197.185.167:2830] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aUJu94juE-Fd-sBWjvVAswAAAEw"]
[Wed Dec 17 16:51:03.966790 2025] [:error] [pid 45531:tid 45568] [client 4.197.185.167:2871] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aUJu94juE-Fd-sBWjvVAtAAAAEU"]
[Wed Dec 17 16:51:04.004433 2025] [:error] [pid 45530:tid 45559] [client 4.197.185.167:3000] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PTwAAABg"]
[Wed Dec 17 16:51:04.043995 2025] [:error] [pid 45530:tid 45547] [client 4.197.185.167:2991] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PUAAAAAw"]
[Wed Dec 17 16:51:04.076100 2025] [:error] [pid 45530:tid 45553] [client 4.197.185.167:2862] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PUQAAABI"]
[Wed Dec 17 16:51:04.113211 2025] [:error] [pid 45621:tid 45648] [client 4.197.185.167:2930] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aUJu-OVNGQfJ1rR90pQalgAAANY"]
[Wed Dec 17 16:51:04.150148 2025] [:error] [pid 45531:tid 45566] [client 4.197.185.167:2766] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aUJu-IjuE-Fd-sBWjvVAtQAAAEM"]
[Wed Dec 17 16:51:04.180251 2025] [:error] [pid 45530:tid 45554] [client 4.197.185.167:2876] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PUgAAABM"]
[Wed Dec 17 16:51:04.214746 2025] [:error] [pid 45530:tid 45549] [client 4.197.185.167:2811] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PUwAAAA4"]
[Wed Dec 17 16:51:04.246496 2025] [:error] [pid 45530:tid 45538] [client 4.197.185.167:2947] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PVAAAAAM"]
[Wed Dec 17 16:51:04.280294 2025] [:error] [pid 45621:tid 45626] [client 4.197.185.167:2777] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUJu-OVNGQfJ1rR90pQamQAAAMA"]
[Wed Dec 17 16:51:04.320090 2025] [:error] [pid 45531:tid 45576] [client 4.197.185.167:2507] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aUJu-IjuE-Fd-sBWjvVAtgAAAE0"]
[Wed Dec 17 16:51:04.355422 2025] [:error] [pid 45621:tid 45628] [client 4.197.185.167:2793] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aUJu-OVNGQfJ1rR90pQamgAAAMI"]
[Wed Dec 17 16:51:04.389448 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:2950] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PVQAAAAQ"]
[Wed Dec 17 16:51:04.422352 2025] [:error] [pid 45530:tid 45540] [client 4.197.185.167:2860] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PVgAAAAU"]
[Wed Dec 17 16:51:04.457975 2025] [:error] [pid 45621:tid 45640] [client 4.197.185.167:2829] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aUJu-OVNGQfJ1rR90pQamwAAAM4"]
[Wed Dec 17 16:51:04.494000 2025] [:error] [pid 45531:tid 45587] [client 4.197.185.167:2779] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aUJu-IjuE-Fd-sBWjvVAtwAAAFg"]
[Wed Dec 17 16:51:04.576940 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:2861] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aUJu-OVNGQfJ1rR90pQanAAAANI"]
[Wed Dec 17 16:51:04.607976 2025] [:error] [pid 45530:tid 45537] [client 4.197.185.167:2846] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PVwAAAAI"]
[Wed Dec 17 16:51:04.638445 2025] [:error] [pid 45531:tid 45572] [client 4.197.185.167:2866] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aUJu-IjuE-Fd-sBWjvVAuAAAAEk"]
[Wed Dec 17 16:51:04.685144 2025] [:error] [pid 45532:tid 45611] [client 4.197.185.167:2756] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aUJu-AeWB-JXOyTKNs398wAAAJU"]
[Wed Dec 17 16:51:04.743133 2025] [:error] [pid 45621:tid 45631] [client 4.197.185.167:2804] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aUJu-OVNGQfJ1rR90pQangAAAMU"]
[Wed Dec 17 16:51:04.773232 2025] [:error] [pid 45531:tid 45580] [client 4.197.185.167:2758] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aUJu-IjuE-Fd-sBWjvVAuQAAAFE"]
[Wed Dec 17 16:51:04.804567 2025] [:error] [pid 45530:tid 45542] [client 4.197.185.167:2808] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PWAAAAAc"]
[Wed Dec 17 16:51:04.837478 2025] [:error] [pid 45532:tid 45598] [client 4.197.185.167:2968] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUJu-AeWB-JXOyTKNs399AAAAIg"]
[Wed Dec 17 16:51:04.869892 2025] [:error] [pid 45530:tid 45543] [client 4.197.185.167:2852] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PWQAAAAg"]
[Wed Dec 17 16:51:04.904977 2025] [:error] [pid 45530:tid 45558] [client 4.197.185.167:2809] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUJu-G4IsXcKlf7LWf_PWgAAABc"]
[Wed Dec 17 16:51:04.937334 2025] [:error] [pid 45621:tid 45647] [client 4.197.185.167:2869] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUJu-OVNGQfJ1rR90pQanwAAANU"]
[Wed Dec 17 16:51:04.971820 2025] [:error] [pid 45531:tid 45581] [client 4.197.185.167:2534] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUJu-IjuE-Fd-sBWjvVAugAAAFI"]
[Wed Dec 17 16:51:05.018024 2025] [:error] [pid 11733:tid 11750] [client 4.197.185.167:2498] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUJu-TzmtBRXExJb1PHb0QAAAQ8"]
[Wed Dec 17 16:51:05.062734 2025] [:error] [pid 45532:tid 45600] [client 4.197.185.167:2799] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUJu-QeWB-JXOyTKNs399QAAAIo"]
[Wed Dec 17 16:51:05.095118 2025] [:error] [pid 45621:tid 45650] [client 4.197.185.167:2515] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUJu-eVNGQfJ1rR90pQaoAAAANg"]
[Wed Dec 17 16:51:05.137912 2025] [:error] [pid 45530:tid 45541] [client 4.197.185.167:2813] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PXAAAAAY"]
[Wed Dec 17 16:51:05.170181 2025] [:error] [pid 45532:tid 45595] [client 4.197.185.167:2786] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aUJu-QeWB-JXOyTKNs399gAAAIU"]
[Wed Dec 17 16:51:05.204783 2025] [:error] [pid 45621:tid 45633] [client 4.197.185.167:2765] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aUJu-eVNGQfJ1rR90pQaogAAAMc"]
[Wed Dec 17 16:51:05.244872 2025] [:error] [pid 45530:tid 45551] [client 4.197.185.167:2545] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PXgAAABA"]
[Wed Dec 17 16:51:05.284773 2025] [:error] [pid 45621:tid 45646] [client 4.197.185.167:3007] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUJu-eVNGQfJ1rR90pQaowAAANQ"]
[Wed Dec 17 16:51:05.318844 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:2803] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PXwAAABU"]
[Wed Dec 17 16:51:05.354398 2025] [:error] [pid 45621:tid 45629] [client 4.197.185.167:2496] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUJu-eVNGQfJ1rR90pQapAAAAMM"]
[Wed Dec 17 16:51:05.385420 2025] [:error] [pid 45532:tid 45603] [client 4.197.185.167:2524] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aUJu-QeWB-JXOyTKNs399wAAAI0"]
[Wed Dec 17 16:51:05.417044 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:2791] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PYAAAAA0"]
[Wed Dec 17 16:51:05.446907 2025] [:error] [pid 45530:tid 45536] [client 4.197.185.167:2940] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PYgAAAAE"]
[Wed Dec 17 16:51:05.485010 2025] [:error] [pid 45530:tid 45547] [client 4.197.185.167:2851] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PYwAAAAw"]
[Wed Dec 17 16:51:05.517240 2025] [:error] [pid 45532:tid 45609] [client 4.197.185.167:2500] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aUJu-QeWB-JXOyTKNs39-AAAAJM"]
[Wed Dec 17 16:51:05.604642 2025] [:error] [pid 45532:tid 45601] [client 4.197.185.167:2477] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aUJu-QeWB-JXOyTKNs39-QAAAIs"]
[Wed Dec 17 16:51:05.636282 2025] [:error] [pid 45532:tid 45614] [client 4.197.185.167:2432] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aUJu-QeWB-JXOyTKNs39-gAAAJg"]
[Wed Dec 17 16:51:05.673071 2025] [:error] [pid 45532:tid 45608] [client 4.197.185.167:2817] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aUJu-QeWB-JXOyTKNs39-wAAAJI"]
[Wed Dec 17 16:51:05.707999 2025] [:error] [pid 45530:tid 45553] [client 4.197.185.167:2856] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PZAAAABI"]
[Wed Dec 17 16:51:05.739714 2025] [:error] [pid 45530:tid 45554] [client 4.197.185.167:2505] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PZQAAABM"]
[Wed Dec 17 16:51:05.776088 2025] [:error] [pid 11733:tid 11738] [client 4.197.185.167:2783] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aUJu-TzmtBRXExJb1PHb0wAAAQM"]
[Wed Dec 17 16:51:05.818700 2025] [:error] [pid 45530:tid 45549] [client 4.197.185.167:2778] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PZgAAAA4"]
[Wed Dec 17 16:51:05.859003 2025] [:error] [pid 45530:tid 45538] [client 4.197.185.167:2863] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PZwAAAAM"]
[Wed Dec 17 16:51:05.905446 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:2806] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PaQAAAAQ"]
[Wed Dec 17 16:51:05.938908 2025] [:error] [pid 45530:tid 45540] [client 4.197.185.167:2782] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aUJu-W4IsXcKlf7LWf_PagAAAAU"]
[Wed Dec 17 16:51:05.969361 2025] [:error] [pid 11733:tid 11748] [client 4.197.185.167:2767] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aUJu-TzmtBRXExJb1PHb1AAAAQ0"]
[Wed Dec 17 16:51:05.999052 2025] [:error] [pid 45532:tid 45593] [client 4.197.185.167:2522] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aUJu-QeWB-JXOyTKNs39_AAAAIM"]
[Wed Dec 17 16:51:06.040715 2025] [:error] [pid 45530:tid 45558] [client 4.197.185.167:2810] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PawAAABc"]
[Wed Dec 17 16:51:06.080350 2025] [:error] [pid 11733:tid 11752] [client 4.197.185.167:2535] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUJu-jzmtBRXExJb1PHb1QAAARE"]
[Wed Dec 17 16:51:06.111196 2025] [:error] [pid 11733:tid 11754] [client 4.197.185.167:2805] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUJu-jzmtBRXExJb1PHb1gAAARM"]
[Wed Dec 17 16:51:06.148244 2025] [:error] [pid 45530:tid 45557] [client 4.197.185.167:2443] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PbAAAABY"]
[Wed Dec 17 16:51:06.187537 2025] [:error] [pid 45530:tid 45544] [client 4.197.185.167:2842] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PbQAAAAk"]
[Wed Dec 17 16:51:06.217895 2025] [:error] [pid 45530:tid 45551] [client 4.197.185.167:2453] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PbgAAABA"]
[Wed Dec 17 16:51:06.249148 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:2822] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PbwAAABU"]
[Wed Dec 17 16:51:06.282342 2025] [:error] [pid 45531:tid 45585] [client 4.197.185.167:2502] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVAvQAAAFY"]
[Wed Dec 17 16:51:06.316447 2025] [:error] [pid 45531:tid 45582] [client 4.197.185.167:2790] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVAvgAAAFM"]
[Wed Dec 17 16:51:06.349479 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:2873] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PcAAAAA0"]
[Wed Dec 17 16:51:06.381627 2025] [:error] [pid 45530:tid 45550] [client 4.197.185.167:2459] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PcQAAAA8"]
[Wed Dec 17 16:51:06.422513 2025] [:error] [pid 45621:tid 45638] [client 4.197.185.167:2899] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aUJu-uVNGQfJ1rR90pQapgAAAMw"]
[Wed Dec 17 16:51:06.459299 2025] [:error] [pid 45531:tid 45569] [client 4.197.185.167:2511] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVAxAAAAEY"]
[Wed Dec 17 16:51:06.493642 2025] [:error] [pid 45531:tid 45577] [client 4.197.185.167:2501] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVAxwAAAE4"]
[Wed Dec 17 16:51:06.525022 2025] [:error] [pid 45531:tid 45580] [client 4.197.185.167:2800] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVAywAAAFE"]
[Wed Dec 17 16:51:06.557283 2025] [:error] [pid 45531:tid 45584] [client 4.197.185.167:2815] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVAzgAAAFU"]
[Wed Dec 17 16:51:06.622517 2025] [:error] [pid 45530:tid 45545] [client 4.197.185.167:2795] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PhgAAAAo"]
[Wed Dec 17 16:51:06.654736 2025] [:error] [pid 11733:tid 11759] [client 4.197.185.167:2775] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aUJu-jzmtBRXExJb1PHb1wAAARg"]
[Wed Dec 17 16:51:06.684692 2025] [:error] [pid 45530:tid 45549] [client 4.197.185.167:2551] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PkQAAAA4"]
[Wed Dec 17 16:51:06.720467 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:2781] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aUJu-m4IsXcKlf7LWf_PlQAAAAQ"]
[Wed Dec 17 16:51:06.782056 2025] [:error] [pid 45621:tid 45648] [client 4.197.185.167:2719] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUJu-uVNGQfJ1rR90pQapwAAANY"]
[Wed Dec 17 16:51:06.817959 2025] [:error] [pid 45531:tid 45563] [client 4.197.185.167:2696] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVA3QAAAEA"]
[Wed Dec 17 16:51:06.848958 2025] [:error] [pid 45532:tid 45594] [client 4.197.185.167:2435] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUJu-geWB-JXOyTKNs39_gAAAIQ"]
[Wed Dec 17 16:51:06.888573 2025] [:error] [pid 45531:tid 45571] [client 4.197.185.167:2528] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUJu-ojuE-Fd-sBWjvVA3wAAAEg"]
[Wed Dec 17 16:51:06.919070 2025] [:error] [pid 45621:tid 45641] [client 4.197.185.167:2543] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aUJu-uVNGQfJ1rR90pQaqAAAAM8"]
[Wed Dec 17 16:51:06.956223 2025] [:error] [pid 45621:tid 45626] [client 4.197.185.167:2552] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aUJu-uVNGQfJ1rR90pQaqQAAAMA"]
[Wed Dec 17 16:51:06.991505 2025] [:error] [pid 11733:tid 11755] [client 4.197.185.167:2527] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aUJu-jzmtBRXExJb1PHb2QAAARQ"]
[Wed Dec 17 16:51:07.028275 2025] [:error] [pid 45621:tid 45628] [client 4.197.185.167:2807] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aUJu--VNGQfJ1rR90pQaqgAAAMI"]
[Wed Dec 17 16:51:07.064164 2025] [:error] [pid 45532:tid 45596] [client 4.197.185.167:2755] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aUJu-weWB-JXOyTKNs39_wAAAIY"]
[Wed Dec 17 16:51:07.095026 2025] [:error] [pid 45530:tid 45554] [client 4.197.185.167:2517] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aUJu-24IsXcKlf7LWf_PvAAAABM"]
[Wed Dec 17 16:51:07.128474 2025] [:error] [pid 45531:tid 45579] [client 4.197.185.167:2692] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aUJu-4juE-Fd-sBWjvVA5wAAAFA"]
[Wed Dec 17 16:51:07.164402 2025] [:error] [pid 45621:tid 45632] [client 4.197.185.167:2550] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aUJu--VNGQfJ1rR90pQaqwAAAMY"]
[Wed Dec 17 16:51:07.194331 2025] [:error] [pid 45530:tid 45535] [client 4.197.185.167:2757] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aUJu-24IsXcKlf7LWf_PwgAAAAA"]
[Wed Dec 17 16:51:07.232558 2025] [:error] [pid 11733:tid 11745] [client 4.197.185.167:2519] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aUJu-zzmtBRXExJb1PHb2gAAAQo"]
[Wed Dec 17 16:51:07.272775 2025] [:error] [pid 45530:tid 45552] [client 4.197.185.167:2548] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aUJu-24IsXcKlf7LWf_PyQAAABE"]
[Wed Dec 17 16:51:07.304392 2025] [:error] [pid 45532:tid 45592] [client 4.197.185.167:2559] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aUJu-weWB-JXOyTKNs3-AAAAAII"]
[Wed Dec 17 16:51:07.337344 2025] [:error] [pid 45530:tid 45550] [client 4.197.185.167:2518] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aUJu-24IsXcKlf7LWf_PzgAAAA8"]
[Wed Dec 17 16:51:07.369487 2025] [:error] [pid 11733:tid 11749] [client 4.197.185.167:2456] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aUJu-zzmtBRXExJb1PHb2wAAAQ4"]
[Wed Dec 17 16:51:07.410641 2025] [:error] [pid 11733:tid 11742] [client 4.197.185.167:2910] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aUJu-zzmtBRXExJb1PHb3AAAAQc"]
[Wed Dec 17 16:51:07.441338 2025] [:error] [pid 45532:tid 45590] [client 4.197.185.167:2504] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aUJu-weWB-JXOyTKNs3-AQAAAIA"]
[Wed Dec 17 16:51:07.520221 2025] [:error] [pid 45532:tid 45597] [client 4.197.185.167:2523] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aUJu-weWB-JXOyTKNs3-AgAAAIc"]
[Wed Dec 17 16:51:07.560632 2025] [:error] [pid 45621:tid 45644] [client 4.197.185.167:2558] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aUJu--VNGQfJ1rR90pQarAAAANI"]
[Wed Dec 17 16:51:07.616725 2025] [:error] [pid 45621:tid 45631] [client 4.197.185.167:2544] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aUJu--VNGQfJ1rR90pQarQAAAMU"]
[Wed Dec 17 16:51:07.657761 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:2794] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aUJu-24IsXcKlf7LWf_P2wAAABU"]
[Wed Dec 17 16:51:07.688263 2025] [:error] [pid 11733:tid 11756] [client 4.197.185.167:2454] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu-zzmtBRXExJb1PHb3QAAARU"]
[Wed Dec 17 16:51:07.720101 2025] [:error] [pid 45532:tid 45607] [client 4.197.185.167:2485] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu-weWB-JXOyTKNs3-AwAAAJE"]
[Wed Dec 17 16:51:07.801312 2025] [:error] [pid 45532:tid 45613] [client 4.197.185.167:2549] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu-weWB-JXOyTKNs3-BAAAAJc"]
[Wed Dec 17 16:51:07.841800 2025] [:error] [pid 45531:tid 45577] [client 4.197.185.167:2722] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUJu-4juE-Fd-sBWjvVA9QAAAE4"]
[Wed Dec 17 16:51:07.874115 2025] [:error] [pid 45530:tid 45544] [client 4.197.185.167:2789] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aUJu-24IsXcKlf7LWf_P3QAAAAk"]
[Wed Dec 17 16:51:07.907508 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:2514] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aUJu-24IsXcKlf7LWf_P3gAAAA0"]
[Wed Dec 17 16:51:07.940392 2025] [:error] [pid 45532:tid 45591] [client 4.197.185.167:2843] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aUJu-weWB-JXOyTKNs3-BQAAAIE"]
[Wed Dec 17 16:51:07.973372 2025] [:error] [pid 45530:tid 45550] [client 4.197.185.167:2513] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aUJu-24IsXcKlf7LWf_P3wAAAA8"]
[Wed Dec 17 16:51:08.022191 2025] [:error] [pid 45621:tid 45636] [client 4.197.185.167:2688] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aUJu_OVNGQfJ1rR90pQasAAAAMo"]
[Wed Dec 17 16:51:08.053411 2025] [:error] [pid 45531:tid 45572] [client 4.197.185.167:2510] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aUJu_IjuE-Fd-sBWjvVA9gAAAEk"]
[Wed Dec 17 16:51:08.086229 2025] [:error] [pid 45530:tid 45540] [client 4.197.185.167:2788] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P4AAAAAU"]
[Wed Dec 17 16:51:08.117387 2025] [:error] [pid 11733:tid 11757] [client 4.197.185.167:2541] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aUJu_DzmtBRXExJb1PHb3gAAARY"]
[Wed Dec 17 16:51:08.149664 2025] [:error] [pid 45532:tid 45611] [client 4.197.185.167:2801] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aUJu_AeWB-JXOyTKNs3-BgAAAJU"]
[Wed Dec 17 16:51:08.182714 2025] [:error] [pid 11733:tid 11740] [client 4.197.185.167:2700] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aUJu_DzmtBRXExJb1PHb3wAAAQU"]
[Wed Dec 17 16:51:08.214120 2025] [:error] [pid 45530:tid 45547] [client 4.197.185.167:2450] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P4QAAAAw"]
[Wed Dec 17 16:51:08.247176 2025] [:error] [pid 11733:tid 11743] [client 4.197.185.167:2538] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aUJu_DzmtBRXExJb1PHb4AAAAQg"]
[Wed Dec 17 16:51:08.284750 2025] [:error] [pid 45531:tid 45584] [client 4.197.185.167:2451] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aUJu_IjuE-Fd-sBWjvVA-AAAAFU"]
[Wed Dec 17 16:51:08.335429 2025] [:error] [pid 45530:tid 45543] [client 4.197.185.167:2995] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P4gAAAAg"]
[Wed Dec 17 16:51:08.385314 2025] [:error] [pid 11733:tid 11746] [client 4.197.185.167:2542] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aUJu_DzmtBRXExJb1PHb4QAAAQs"]
[Wed Dec 17 16:51:08.430923 2025] [:error] [pid 11733:tid 11741] [client 4.197.185.167:2812] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aUJu_DzmtBRXExJb1PHb4wAAAQY"]
[Wed Dec 17 16:51:08.466167 2025] [:error] [pid 45531:tid 45565] [client 4.197.185.167:2553] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aUJu_IjuE-Fd-sBWjvVA-gAAAEI"]
[Wed Dec 17 16:51:08.501140 2025] [:error] [pid 11733:tid 11751] [client 4.197.185.167:2478] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aUJu_DzmtBRXExJb1PHb5AAAARA"]
[Wed Dec 17 16:51:08.543627 2025] [:error] [pid 45531:tid 45583] [client 4.197.185.167:2764] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aUJu_IjuE-Fd-sBWjvVA_AAAAFQ"]
[Wed Dec 17 16:51:08.576050 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:2547] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P6AAAAAQ"]
[Wed Dec 17 16:51:08.630751 2025] [:error] [pid 45531:tid 45570] [client 4.197.185.167:2814] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aUJu_IjuE-Fd-sBWjvVA_QAAAEc"]
[Wed Dec 17 16:51:08.687345 2025] [:error] [pid 45532:tid 45598] [client 4.197.185.167:2449] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aUJu_AeWB-JXOyTKNs3-BwAAAIg"]
[Wed Dec 17 16:51:08.720488 2025] [:error] [pid 45621:tid 45635] [client 4.197.185.167:2466] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aUJu_OVNGQfJ1rR90pQatAAAAMk"]
[Wed Dec 17 16:51:08.752391 2025] [:error] [pid 45530:tid 45542] [client 4.197.185.167:2490] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P6QAAAAc"]
[Wed Dec 17 16:51:08.784007 2025] [:error] [pid 45530:tid 45558] [client 4.197.185.167:2482] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P6gAAABc"]
[Wed Dec 17 16:51:08.822625 2025] [:error] [pid 45530:tid 45538] [client 4.197.185.167:2768] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P6wAAAAM"]
[Wed Dec 17 16:51:08.853065 2025] [:error] [pid 45621:tid 45629] [client 4.197.185.167:2530] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUJu_OVNGQfJ1rR90pQatQAAAMM"]
[Wed Dec 17 16:51:08.886943 2025] [:error] [pid 45531:tid 45582] [client 4.197.185.167:2626] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aUJu_IjuE-Fd-sBWjvVA_wAAAFM"]
[Wed Dec 17 16:51:08.917194 2025] [:error] [pid 45530:tid 45552] [client 4.197.185.167:2865] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P7QAAABE"]
[Wed Dec 17 16:51:08.950813 2025] [:error] [pid 45530:tid 45557] [client 4.197.185.167:2440] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aUJu_G4IsXcKlf7LWf_P7gAAABY"]
[Wed Dec 17 16:51:09.011944 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:2877] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P8QAAAA0"]
[Wed Dec 17 16:51:09.058215 2025] [:error] [pid 45530:tid 45540] [client 4.197.185.167:2529] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P8wAAAAU"]
[Wed Dec 17 16:51:09.091958 2025] [:error] [pid 45530:tid 45547] [client 4.197.185.167:2858] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P9AAAAAw"]
[Wed Dec 17 16:51:09.123310 2025] [:error] [pid 45621:tid 45634] [client 4.197.185.167:2512] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUJu_eVNGQfJ1rR90pQatgAAAMg"]
[Wed Dec 17 16:51:09.172335 2025] [:error] [pid 45531:tid 45586] [client 4.197.185.167:2447] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUJu_YjuE-Fd-sBWjvVBAQAAAFc"]
[Wed Dec 17 16:51:09.206053 2025] [:error] [pid 45531:tid 45564] [client 4.197.185.167:2770] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUJu_YjuE-Fd-sBWjvVBAgAAAEE"]
[Wed Dec 17 16:51:09.239510 2025] [:error] [pid 11733:tid 11737] [client 4.197.185.167:2499] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aUJu_TzmtBRXExJb1PHb5QAAAQI"]
[Wed Dec 17 16:51:09.279330 2025] [:error] [pid 45531:tid 45567] [client 4.197.185.167:2436] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aUJu_YjuE-Fd-sBWjvVBAwAAAEQ"]
[Wed Dec 17 16:51:09.309925 2025] [:error] [pid 45530:tid 45545] [client 4.197.185.167:2468] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P9QAAAAo"]
[Wed Dec 17 16:51:09.340147 2025] [:error] [pid 11733:tid 11750] [client 4.197.185.167:2445] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aUJu_TzmtBRXExJb1PHb5gAAAQ8"]
[Wed Dec 17 16:51:09.378559 2025] [:error] [pid 45530:tid 45555] [client 4.197.185.167:2787] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P9gAAABQ"]
[Wed Dec 17 16:51:09.443070 2025] [:error] [pid 45530:tid 45553] [client 4.197.185.167:2707] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P9wAAABI"]
[Wed Dec 17 16:51:09.475352 2025] [:error] [pid 45530:tid 45546] [client 4.197.185.167:2715] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P-AAAAAs"]
[Wed Dec 17 16:51:09.505600 2025] [:error] [pid 45530:tid 45539] [client 4.197.185.167:2444] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P-QAAAAQ"]
[Wed Dec 17 16:51:09.538069 2025] [:error] [pid 11733:tid 11748] [client 4.197.185.167:2853] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUJu_TzmtBRXExJb1PHb5wAAAQ0"]
[Wed Dec 17 16:51:09.569913 2025] [:error] [pid 11733:tid 11735] [client 4.197.185.167:2531] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUJu_TzmtBRXExJb1PHb6AAAAQA"]
[Wed Dec 17 16:51:09.600243 2025] [:error] [pid 45532:tid 45600] [client 4.197.185.167:2698] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUJu_QeWB-JXOyTKNs3-CAAAAIo"]
[Wed Dec 17 16:51:09.632332 2025] [:error] [pid 45532:tid 45595] [client 4.197.185.167:2452] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aUJu_QeWB-JXOyTKNs3-CQAAAIU"]
[Wed Dec 17 16:51:09.719327 2025] [:error] [pid 45621:tid 45643] [client 4.197.185.167:2695] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aUJu_eVNGQfJ1rR90pQatwAAANE"]
[Wed Dec 17 16:51:09.749719 2025] [:error] [pid 45531:tid 45568] [client 4.197.185.167:2497] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aUJu_YjuE-Fd-sBWjvVBBAAAAEU"]
[Wed Dec 17 16:51:09.787709 2025] [:error] [pid 45530:tid 45542] [client 4.197.185.167:2557] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aUJu_W4IsXcKlf7LWf_P_AAAAAc"]
[Wed Dec 17 16:51:09.853479 2025] [:error] [pid 11733:tid 11752] [client 4.197.185.167:2492] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aUJu_TzmtBRXExJb1PHb6QAAARE"]
[Wed Dec 17 16:51:09.885876 2025] [:error] [pid 11733:tid 11754] [client 4.197.185.167:2480] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUJu_TzmtBRXExJb1PHb6gAAARM"]
[Wed Dec 17 16:51:09.918499 2025] [:error] [pid 45532:tid 45603] [client 4.197.185.167:2546] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUJu_QeWB-JXOyTKNs3-CgAAAI0"]
[Wed Dec 17 16:51:09.951564 2025] [:error] [pid 45531:tid 45566] [client 4.197.185.167:2457] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUJu_YjuE-Fd-sBWjvVBBgAAAEM"]
[Wed Dec 17 16:51:09.983770 2025] [:error] [pid 11733:tid 11759] [client 4.197.185.167:2540] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUJu_TzmtBRXExJb1PHb7AAAARg"]
[Wed Dec 17 16:51:10.015007 2025] [:error] [pid 11733:tid 11755] [client 4.197.185.167:2752] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aUJu_jzmtBRXExJb1PHb7QAAARQ"]
[Wed Dec 17 16:51:10.046823 2025] [:error] [pid 45530:tid 45556] [client 4.197.185.167:2717] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aUJu_m4IsXcKlf7LWf_P_QAAABU"]
[Wed Dec 17 16:51:10.089092 2025] [:error] [pid 45530:tid 45552] [client 4.197.185.167:2718] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aUJu_m4IsXcKlf7LWf_P_gAAABE"]
[Wed Dec 17 16:51:10.121564 2025] [:error] [pid 45530:tid 45557] [client 4.197.185.167:2448] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aUJu_m4IsXcKlf7LWf_P_wAAABY"]
[Wed Dec 17 16:51:10.152935 2025] [:error] [pid 45530:tid 45559] [client 4.197.185.167:2713] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aUJu_m4IsXcKlf7LWf_QAAAAABg"]
[Wed Dec 17 16:51:10.187875 2025] [:error] [pid 11733:tid 11745] [client 4.197.185.167:2463] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aUJu_jzmtBRXExJb1PHb7gAAAQo"]
[Wed Dec 17 16:51:10.225076 2025] [:error] [pid 11733:tid 11749] [client 4.197.185.167:2721] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aUJu_jzmtBRXExJb1PHb7wAAAQ4"]
[Wed Dec 17 16:51:10.258298 2025] [:error] [pid 11733:tid 11742] [client 4.197.185.167:2525] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aUJu_jzmtBRXExJb1PHb8AAAAQc"]
[Wed Dec 17 16:51:10.295880 2025] [:error] [pid 11733:tid 11736] [client 4.197.185.167:2460] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUJu_jzmtBRXExJb1PHb8QAAAQE"]
[Wed Dec 17 16:51:10.327149 2025] [:error] [pid 45530:tid 45536] [client 4.197.185.167:2439] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUJu_m4IsXcKlf7LWf_QAgAAAAE"]
[Wed Dec 17 16:51:10.368934 2025] [:error] [pid 45531:tid 45577] [client 4.197.185.167:2708] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUJu_ojuE-Fd-sBWjvVBBwAAAE4"]
[Wed Dec 17 16:51:10.400281 2025] [:error] [pid 45532:tid 45599] [client 4.197.185.167:2465] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUJu_geWB-JXOyTKNs3-CwAAAIk"]
[Wed Dec 17 16:51:10.432157 2025] [:error] [pid 45530:tid 45548] [client 4.197.185.167:2537] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aUJu_m4IsXcKlf7LWf_QBAAAAA0"]
[Wed Dec 17 16:51:10.464789 2025] [:error] [pid 45530:tid 45549] [client 4.197.185.167:2520] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aUJu_m4IsXcKlf7LWf_QBQAAAA4"]
[Wed Dec 17 16:51:10.501765 2025] [:error] [pid 11733:tid 11753] [client 4.197.185.167:2716] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aUJu_jzmtBRXExJb1PHb8gAAARI"]
[Wed Dec 17 16:51:10.535658 2025] [:error] [pid 11733:tid 11744] [client 4.197.185.167:2438] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aUJu_jzmtBRXExJb1PHb8wAAAQk"]
[Wed Dec 17 16:51:10.566968 2025] [:error] [pid 11733:tid 11757] [client 4.197.185.167:2709] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aUJu_jzmtBRXExJb1PHb9AAAARY"]
[Wed Dec 17 16:51:10.602037 2025] [:error] [pid 11733:tid 11740] [client 4.197.185.167:2691] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aUJu_jzmtBRXExJb1PHb9QAAAQU"]
[Wed Dec 17 16:51:10.638119 2025] [:error] [pid 45532:tid 45609] [client 4.197.185.167:2532] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aUJu_geWB-JXOyTKNs3-DAAAAJM"]
[Wed Dec 17 16:51:10.669927 2025] [:error] [pid 11733:tid 11743] [client 4.197.185.167:2473] [client 4.197.185.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aUJu_jzmtBRXExJb1PHb9gAAAQg"]
[Thu Dec 18 06:51:49.399812 2025] [:error] [pid 23645:tid 23671] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Dec 18 06:51:49.784755 2025] [:error] [pid 23645:tid 23654] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Dec 18 06:51:50.236289 2025] [:error] [pid 23645:tid 23649] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Dec 18 06:51:50.690958 2025] [:error] [pid 23645:tid 23648] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Dec 18 06:51:51.093385 2025] [:error] [pid 23645:tid 23649] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Dec 18 06:51:51.572938 2025] [:error] [pid 23645:tid 23653] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Dec 18 06:51:51.932031 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Dec 18 06:51:52.294976 2025] [:error] [pid 23645:tid 23658] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Dec 18 06:51:53.119766 2025] [:error] [pid 23645:tid 23654] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Dec 18 06:51:53.892950 2025] [:error] [pid 23645:tid 23648] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Dec 18 06:51:54.307784 2025] [:error] [pid 23645:tid 23658] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Dec 18 06:51:54.696712 2025] [:error] [pid 23645:tid 23671] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Dec 18 06:51:55.134651 2025] [:error] [pid 23645:tid 23668] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Dec 18 06:51:55.520066 2025] [:error] [pid 23645:tid 23647] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Dec 18 06:51:55.942180 2025] [:error] [pid 23645:tid 23663] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Dec 18 06:51:56.347163 2025] [:error] [pid 23645:tid 23653] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Dec 18 06:51:56.782227 2025] [:error] [pid 23645:tid 23666] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Dec 18 06:51:57.124262 2025] [:error] [pid 23645:tid 23650] [client 193.19.109.165:48693] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Dec 18 06:52:03.151316 2025] [:error] [pid 23645:tid 23667] [client 193.19.109.165:48693] [client 193.19.109.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUM0Ezf_Rx0Y0ao_QJiOVAAAAJQ"]
[Thu Dec 18 06:52:04.749159 2025] [:error] [pid 24542:tid 24565] [client 193.19.109.193:60419] [client 193.19.109.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/kill.php"] [unique_id "aUM0FEtQz4H2oS3NrDYYKwAAAVU"]
[Thu Dec 18 06:52:05.542789 2025] [:error] [pid 25357:tid 25361] [client 193.19.109.187:50747] [client 193.19.109.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/kill.php"] [unique_id "aUM0FYaT7bsEXnJVfJdO9wAAAcI"]
[Thu Dec 18 06:52:06.692934 2025] [:error] [pid 24542:tid 24562] [client 193.19.109.171:44031] [client 193.19.109.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUM0FktQz4H2oS3NrDYYPQAAAVI"]
[Thu Dec 18 06:52:07.473272 2025] [:error] [pid 23556:tid 23572] [client 193.19.109.162:35763] [client 193.19.109.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aUM0FxnmLlk3u5yt9kEL5AAAAAw"]
[Thu Dec 18 06:52:09.596191 2025] [:error] [pid 24433:tid 24443] [client 193.19.109.186:21165] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Dec 18 06:52:10.787515 2025] [:error] [pid 24433:tid 24457] [client 193.19.109.186:21165] [client 193.19.109.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aUM0Gp4pN9ycmipm8TgkiAAAARU"]
[Thu Dec 18 06:52:12.303882 2025] [:error] [pid 23645:tid 23653] [client 193.19.109.174:46015] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Dec 18 06:52:12.746621 2025] [:error] [pid 23645:tid 23650] [client 193.19.109.174:46015] [client 193.19.109.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUM0HDf_Rx0Y0ao_QJiO8wAAAIM"]
[Thu Dec 18 06:52:13.891358 2025] [:error] [pid 24542:tid 24552] [client 193.19.109.191:51327] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Dec 18 06:52:15.796564 2025] [:error] [pid 24542:tid 24547] [client 193.19.109.191:51327] [client 193.19.109.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUM0H0tQz4H2oS3NrDYYpAAAAUM"]
[Thu Dec 18 06:52:16.999695 2025] [:error] [pid 23556:tid 23564] [client 193.19.109.205:59693] [client 193.19.109.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUM0IBnmLlk3u5yt9kEMNgAAAAQ"]
[Thu Dec 18 06:52:17.748426 2025] [:error] [pid 24433:tid 24448] [client 193.19.109.176:33545] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUM0IZ4pN9ycmipm8Tgk2QAAAQw"]
[Thu Dec 18 06:52:18.648406 2025] [:error] [pid 24433:tid 24448] [client 193.19.109.204:20293] [client 193.19.109.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUM0Ip4pN9ycmipm8Tgk5wAAAQw"]
[Thu Dec 18 06:52:19.363375 2025] [:error] [pid 24542:tid 24547] [client 193.19.109.171:29351] [client 193.19.109.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUM0I0tQz4H2oS3NrDYYzQAAAUM"]
[Thu Dec 18 06:52:20.151884 2025] [:error] [pid 23557:tid 23590] [client 193.19.109.186:20899] [client 193.19.109.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUM0JBYcs6rFVxbdP_k4rAAAAEI"]
[Thu Dec 18 06:52:21.203654 2025] [:error] [pid 24542:tid 24559] [client 193.19.109.172:58547] [client 193.19.109.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUM0JUtQz4H2oS3NrDYY2wAAAU8"]
[Thu Dec 18 06:52:21.964771 2025] [:error] [pid 23645:tid 23658] [client 193.19.109.187:50193] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Dec 18 06:52:23.333405 2025] [:error] [pid 23645:tid 23670] [client 193.19.109.187:50193] [client 193.19.109.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aUM0Jzf_Rx0Y0ao_QJiPYQAAAJc"]
[Thu Dec 18 06:52:24.795954 2025] [:error] [pid 23556:tid 23572] [client 193.19.109.180:28163] [client 193.19.109.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUM0KBnmLlk3u5yt9kEMhQAAAAw"]
[Thu Dec 18 06:52:25.913518 2025] [:error] [pid 24958:tid 24961] [client 193.19.109.173:56311] [client 193.19.109.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUM0KckDOrUkd0wNm2EQdwAAAYA"]
[Thu Dec 18 06:52:26.660396 2025] [:error] [pid 25357:tid 25365] [client 193.19.109.169:23825] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Dec 18 06:52:27.021152 2025] [:error] [pid 25357:tid 25375] [client 193.19.109.169:23825] [client 193.19.109.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUM0K4aT7bsEXnJVfJdQNAAAAdA"]
[Thu Dec 18 06:52:27.753617 2025] [:error] [pid 24542:tid 24564] [client 193.19.109.190:62023] [client 193.19.109.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-signup.php"] [unique_id "aUM0K0tQz4H2oS3NrDYZJwAAAVQ"]
[Thu Dec 18 06:52:28.495613 2025] [:error] [pid 24433:tid 24446] [client 193.19.109.176:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Dec 18 06:52:29.688193 2025] [:error] [pid 24433:tid 24449] [client 193.19.109.176:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Dec 18 06:52:30.873610 2025] [:error] [pid 24433:tid 24450] [client 193.19.109.176:33431] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUM0Lp4pN9ycmipm8TglbgAAAQ4"]
[Thu Dec 18 06:52:31.658861 2025] [:error] [pid 24542:tid 24556] [client 193.19.109.190:49049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Dec 18 06:52:31.997775 2025] [:error] [pid 24542:tid 24564] [client 193.19.109.190:49049] [client 193.19.109.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUM0L0tQz4H2oS3NrDYZXQAAAVQ"]
[Thu Dec 18 06:52:32.775918 2025] [:error] [pid 25357:tid 25377] [client 193.19.109.178:44643] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Dec 18 06:52:33.114678 2025] [:error] [pid 25357:tid 25361] [client 193.19.109.178:44643] [client 193.19.109.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd-1/admin.php"] [unique_id "aUM0MYaT7bsEXnJVfJdQhwAAAcI"]
[Thu Dec 18 06:52:34.206615 2025] [:error] [pid 23645:tid 23666] [client 193.19.109.162:63213] [client 193.19.109.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUM0Mjf_Rx0Y0ao_QJiPyQAAAJM"]
[Thu Dec 18 06:52:35.408734 2025] [:error] [pid 25357:tid 25373] [client 193.19.109.182:51503] [client 193.19.109.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUM0M4aT7bsEXnJVfJdQqQAAAc4"]
[Thu Dec 18 06:52:39.114933 2025] [:error] [pid 24433:tid 24440] [client 193.19.109.182:54489] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Dec 18 06:52:39.487723 2025] [:error] [pid 24433:tid 24436] [client 193.19.109.182:54489] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Dec 18 06:52:40.366188 2025] [:error] [pid 24433:tid 24452] [client 193.19.109.182:54489] [client 193.19.109.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUM0OJ4pN9ycmipm8Tgl1wAAARA"]
[Thu Dec 18 06:52:41.505018 2025] [:error] [pid 23645:tid 23665] [client 193.19.109.174:31871] [client 193.19.109.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUM0OTf_Rx0Y0ao_QJiQJQAAAJI"]
[Thu Dec 18 06:52:42.613747 2025] [:error] [pid 24958:tid 24962] [client 193.19.109.187:42249] [client 193.19.109.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUM0OskDOrUkd0wNm2ERMwAAAYE"]
[Thu Dec 18 06:52:43.373762 2025] [:error] [pid 25357:tid 25363] [client 193.19.109.200:37901] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUM0O4aT7bsEXnJVfJdQ_gAAAcQ"]
[Thu Dec 18 06:52:48.764748 2025] [:error] [pid 24542:tid 24544] [client 193.19.109.169:28139] [client 193.19.109.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUM0QEtQz4H2oS3NrDYZ9gAAAUA"]
[Thu Dec 18 06:52:50.268878 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.189:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Dec 18 06:52:50.608708 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.189:37251] [client 193.19.109.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aUM0Qjf_Rx0Y0ao_QJiQsgAAAI4"]
[Thu Dec 18 06:52:51.362651 2025] [:error] [pid 25357:tid 25366] [client 193.19.109.176:43109] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aUM0Q4aT7bsEXnJVfJdRTQAAAcc"]
[Thu Dec 18 06:52:52.099242 2025] [:error] [pid 24542:tid 24553] [client 193.19.109.183:58699] [client 193.19.109.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUM0REtQz4H2oS3NrDYaFwAAAUk"]
[Thu Dec 18 06:52:53.598792 2025] [:error] [pid 23558:tid 23626] [client 193.19.109.201:29873] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Dec 18 06:52:54.330945 2025] [:error] [pid 23558:tid 23633] [client 193.19.109.201:29873] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Dec 18 06:52:56.271312 2025] [:error] [pid 23558:tid 23623] [client 193.19.109.201:29873] [client 193.19.109.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aUM0SOHam9NbgPQa9uY8dgAAAMg"]
[Thu Dec 18 06:52:58.102164 2025] [:error] [pid 23557:tid 23592] [client 193.19.109.182:33481] [client 193.19.109.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.182, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUM0ShYcs6rFVxbdP_k6WwAAAEQ"]
[Thu Dec 18 06:52:58.511497 2025] [:error] [pid 23557:tid 23603] [client 193.19.109.182:33481] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Dec 18 06:53:00.387852 2025] [:error] [pid 23557:tid 23612] [client 193.19.109.182:33481] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Dec 18 06:53:00.782775 2025] [:error] [pid 23557:tid 23595] [client 193.19.109.182:33481] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Dec 18 06:53:02.698532 2025] [:error] [pid 23557:tid 23597] [client 193.19.109.182:33481] [client 193.19.109.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUM0ThYcs6rFVxbdP_k6ggAAAEk"]
[Thu Dec 18 06:53:03.798795 2025] [:error] [pid 24958:tid 24973] [client 193.19.109.182:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Dec 18 06:53:04.165701 2025] [:error] [pid 24958:tid 24971] [client 193.19.109.182:36755] [client 193.19.109.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.182, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUM0UMkDOrUkd0wNm2ESKgAAAYo"]
[Thu Dec 18 06:53:04.903494 2025] [:error] [pid 24958:tid 24966] [client 193.19.109.182:36755] [client 193.19.109.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aUM0UMkDOrUkd0wNm2ESNwAAAYU"]
[Thu Dec 18 06:53:08.125293 2025] [:error] [pid 24542:tid 24557] [client 193.19.109.207:48271] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Dec 18 06:53:08.919778 2025] [:error] [pid 24542:tid 24566] [client 193.19.109.207:48271] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Dec 18 06:53:09.771386 2025] [:error] [pid 24542:tid 24553] [client 193.19.109.207:48271] [client 193.19.109.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUM0VUtQz4H2oS3NrDYasQAAAUk"]
[Thu Dec 18 06:53:10.480707 2025] [:error] [pid 24542:tid 24562] [client 193.19.109.186:40891] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Dec 18 06:53:11.574077 2025] [:error] [pid 24542:tid 24547] [client 193.19.109.186:40891] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Dec 18 06:53:12.417827 2025] [:error] [pid 24542:tid 24556] [client 193.19.109.186:40891] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Dec 18 06:53:13.170401 2025] [:error] [pid 24542:tid 24556] [client 193.19.109.186:40891] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Dec 18 06:53:13.593811 2025] [:error] [pid 24542:tid 24557] [client 193.19.109.186:40891] [client 193.19.109.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUM0WUtQz4H2oS3NrDYa5gAAAU0"]
[Thu Dec 18 06:53:14.361243 2025] [:error] [pid 23645:tid 23670] [client 193.19.109.204:27183] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Dec 18 06:53:14.709567 2025] [:error] [pid 23645:tid 23666] [client 193.19.109.204:27183] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Dec 18 06:53:15.149902 2025] [:error] [pid 23645:tid 23669] [client 193.19.109.204:27183] [client 193.19.109.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUM0Wzf_Rx0Y0ao_QJiSGgAAAJY"]
[Thu Dec 18 06:53:16.305607 2025] [:error] [pid 23558:tid 23629] [client 193.19.109.200:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Dec 18 06:53:17.086023 2025] [:error] [pid 23558:tid 23615] [client 193.19.109.200:52211] [client 193.19.109.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.200, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUM0XeHam9NbgPQa9uY9SQAAAMA"]
[Thu Dec 18 06:53:17.472569 2025] [:error] [pid 23558:tid 23636] [client 193.19.109.200:52211] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUM0XeHam9NbgPQa9uY9TgAAANU"]
[Thu Dec 18 06:53:22.308116 2025] [:error] [pid 23558:tid 23634] [client 193.19.109.205:53415] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Dec 18 06:53:24.624422 2025] [:error] [pid 23558:tid 23623] [client 193.19.109.205:53415] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Dec 18 06:53:25.015644 2025] [:error] [pid 23558:tid 23615] [client 193.19.109.205:53415] [client 193.19.109.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUM0ZeHam9NbgPQa9uY9lwAAAMA"]
[Thu Dec 18 06:53:26.567312 2025] [:error] [pid 25357:tid 25371] [client 193.19.109.207:55389] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Dec 18 06:53:27.769449 2025] [:error] [pid 25357:tid 25383] [client 193.19.109.207:55389] [client 193.19.109.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.207, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUM0Z4aT7bsEXnJVfJdSrwAAAdg"]
[Thu Dec 18 06:53:28.141066 2025] [:error] [pid 25357:tid 25360] [client 193.19.109.207:55389] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Dec 18 06:53:28.608082 2025] [:error] [pid 25357:tid 25381] [client 193.19.109.207:55389] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Dec 18 06:53:29.072853 2025] [:error] [pid 25357:tid 25359] [client 193.19.109.207:55389] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Dec 18 06:53:29.507418 2025] [:error] [pid 25357:tid 25365] [client 193.19.109.207:55389] [client 193.19.109.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUM0aYaT7bsEXnJVfJdSvQAAAcY"]
[Thu Dec 18 06:53:30.260857 2025] [:error] [pid 23645:tid 23659] [client 193.19.109.190:28433] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Dec 18 06:53:30.604614 2025] [:error] [pid 23645:tid 23664] [client 193.19.109.190:28433] [client 193.19.109.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aUM0ajf_Rx0Y0ao_QJiSlQAAAJE"]
[Thu Dec 18 06:53:32.795671 2025] [:error] [pid 23645:tid 23659] [client 193.19.109.188:37177] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Dec 18 06:53:33.171261 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.188:37177] [client 193.19.109.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUM0bTf_Rx0Y0ao_QJiSsgAAAI4"]
[Thu Dec 18 06:53:34.725807 2025] [:error] [pid 25357:tid 25360] [client 193.19.109.178:32585] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Dec 18 06:53:35.182035 2025] [:error] [pid 25357:tid 25377] [client 193.19.109.178:32585] [client 193.19.109.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUM0b4aT7bsEXnJVfJdTBgAAAdI"]
[Thu Dec 18 06:53:35.867633 2025] [:error] [pid 23558:tid 23616] [client 193.19.109.171:36297] [client 193.19.109.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUM0b-Ham9NbgPQa9uY93QAAAME"]
[Thu Dec 18 06:53:36.585872 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.163:44979] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Dec 18 06:53:36.969732 2025] [:error] [pid 23645:tid 23650] [client 193.19.109.163:44979] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Dec 18 06:53:38.491659 2025] [:error] [pid 23645:tid 23664] [client 193.19.109.163:44979] [client 193.19.109.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUM0cjf_Rx0Y0ao_QJiS3AAAAJE"]
[Thu Dec 18 06:53:39.609613 2025] [:error] [pid 23558:tid 23625] [client 193.19.109.208:45647] [client 193.19.109.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUM0c-Ham9NbgPQa9uY-EQAAAMo"]
[Thu Dec 18 06:53:41.621883 2025] [:error] [pid 23645:tid 23655] [client 193.19.109.180:55125] [client 193.19.109.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aUM0dTf_Rx0Y0ao_QJiTAgAAAIg"]
[Thu Dec 18 06:53:42.476807 2025] [:error] [pid 23645:tid 23653] [client 193.19.109.161:40875] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Dec 18 06:53:43.295074 2025] [:error] [pid 23645:tid 23656] [client 193.19.109.161:40875] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Dec 18 06:53:43.671448 2025] [:error] [pid 23645:tid 23648] [client 193.19.109.161:40875] [client 193.19.109.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aUM0dzf_Rx0Y0ao_QJiTIgAAAIE"]
[Thu Dec 18 06:53:45.486786 2025] [:error] [pid 23645:tid 23663] [client 193.19.109.173:50211] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Dec 18 06:53:46.215879 2025] [:error] [pid 23645:tid 23660] [client 193.19.109.173:50211] [client 193.19.109.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aUM0ejf_Rx0Y0ao_QJiTKwAAAI0"]
[Thu Dec 18 06:53:48.162814 2025] [:error] [pid 25357:tid 25381] [client 193.19.109.175:55919] [client 193.19.109.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aUM0fIaT7bsEXnJVfJdTcgAAAdY"]
[Thu Dec 18 06:53:49.235774 2025] [:error] [pid 23645:tid 23652] [client 193.19.109.189:32793] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Dec 18 06:53:50.483016 2025] [:error] [pid 23645:tid 23666] [client 193.19.109.189:32793] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Dec 18 06:53:51.199560 2025] [:error] [pid 23645:tid 23670] [client 193.19.109.189:32793] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Dec 18 06:53:51.671172 2025] [:error] [pid 23645:tid 23648] [client 193.19.109.189:32793] [client 193.19.109.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aUM0fzf_Rx0Y0ao_QJiTRwAAAIE"]
[Thu Dec 18 06:53:52.388673 2025] [:error] [pid 24542:tid 24555] [client 193.19.109.161:21585] [client 193.19.109.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aUM0gEtQz4H2oS3NrDYcUQAAAUs"]
[Thu Dec 18 06:53:53.151482 2025] [:error] [pid 23556:tid 23569] [client 193.19.109.208:49749] [client 193.19.109.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aUM0gRnmLlk3u5yt9kEPRAAAAAk"]
[Thu Dec 18 06:53:53.873971 2025] [:error] [pid 24542:tid 24548] [client 193.19.109.206:64581] [client 193.19.109.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aUM0gUtQz4H2oS3NrDYcYgAAAUQ"]
[Thu Dec 18 06:53:54.583808 2025] [:error] [pid 25357:tid 25359] [client 193.19.109.193:23019] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Dec 18 06:53:54.963340 2025] [:error] [pid 25357:tid 25366] [client 193.19.109.193:23019] [client 193.19.109.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aUM0goaT7bsEXnJVfJdToQAAAcc"]
[Thu Dec 18 06:53:55.723115 2025] [:error] [pid 25357:tid 25372] [client 193.19.109.200:41995] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUM0g4aT7bsEXnJVfJdTqQAAAc0"]
[Thu Dec 18 06:53:59.572116 2025] [:error] [pid 24958:tid 24962] [client 193.19.109.182:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Dec 18 06:54:00.292281 2025] [:error] [pid 24958:tid 24984] [client 193.19.109.182:57533] [client 193.19.109.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aUM0iMkDOrUkd0wNm2EUkwAAAZc"]
[Thu Dec 18 06:54:01.047779 2025] [:error] [pid 23557:tid 23607] [client 193.19.109.202:56757] [client 193.19.109.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUM0iRYcs6rFVxbdP_k8CgAAAFM"]
[Thu Dec 18 06:54:01.770649 2025] [:error] [pid 24433:tid 24455] [client 193.19.109.182:52931] [client 193.19.109.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aUM0iZ4pN9ycmipm8Tgo0gAAARM"]
[Thu Dec 18 06:54:02.478570 2025] [:error] [pid 24542:tid 24544] [client 193.19.109.199:53731] [client 193.19.109.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aUM0iktQz4H2oS3NrDYclQAAAUA"]
[Thu Dec 18 06:54:03.601624 2025] [:error] [pid 25357:tid 25369] [client 193.19.109.178:25359] [client 193.19.109.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aUM0i4aT7bsEXnJVfJdUAQAAAco"]
[Thu Dec 18 06:54:05.118167 2025] [:error] [pid 23557:tid 23606] [client 193.19.109.203:47099] [client 193.19.109.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aUM0jRYcs6rFVxbdP_k8MgAAAFI"]
[Thu Dec 18 06:54:05.891890 2025] [:error] [pid 23557:tid 23597] [client 193.19.109.208:25949] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Dec 18 06:54:09.835295 2025] [:error] [pid 23557:tid 23589] [client 193.19.109.208:25949] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Dec 18 06:54:10.236310 2025] [:error] [pid 23557:tid 23603] [client 193.19.109.208:25949] [client 193.19.109.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aUM0khYcs6rFVxbdP_k8ZQAAAE8"]
[Thu Dec 18 06:54:12.221839 2025] [:error] [pid 24958:tid 24962] [client 193.19.109.166:61279] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Dec 18 06:54:12.602300 2025] [:error] [pid 24958:tid 24978] [client 193.19.109.166:61279] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Dec 18 06:54:14.500526 2025] [:error] [pid 24958:tid 24967] [client 193.19.109.166:61279] [client 193.19.109.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aUM0lskDOrUkd0wNm2EVQgAAAYY"]
[Thu Dec 18 06:54:16.512003 2025] [:error] [pid 23556:tid 23580] [client 193.19.109.174:61011] [client 193.19.109.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aUM0mBnmLlk3u5yt9kEP1gAAABQ"]
[Thu Dec 18 06:54:17.264449 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.202:35217] [client 193.19.109.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aUM0mTf_Rx0Y0ao_QJiTxAAAAI4"]
[Thu Dec 18 06:54:20.901417 2025] [:error] [pid 23556:tid 23582] [client 193.19.109.196:36509] [client 193.19.109.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUM0nBnmLlk3u5yt9kEQDAAAABY"]
[Thu Dec 18 06:54:22.431422 2025] [:error] [pid 23558:tid 23637] [client 193.19.109.172:26311] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Dec 18 06:54:22.790956 2025] [:error] [pid 23558:tid 23617] [client 193.19.109.172:26311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Dec 18 06:54:23.136270 2025] [:error] [pid 23558:tid 23618] [client 193.19.109.172:26311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Dec 18 06:54:23.502884 2025] [:error] [pid 23558:tid 23634] [client 193.19.109.172:26311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Dec 18 06:54:25.402546 2025] [:error] [pid 23558:tid 23621] [client 193.19.109.172:26311] [client 193.19.109.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUM0oeHam9NbgPQa9uY_XwAAAMY"]
[Thu Dec 18 06:54:26.155497 2025] [:error] [pid 23558:tid 23618] [client 193.19.109.192:33755] [client 193.19.109.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aUM0ouHam9NbgPQa9uY_ZQAAAMM"]
[Thu Dec 18 06:54:26.885441 2025] [:error] [pid 23557:tid 23604] [client 193.19.109.167:61561] [client 193.19.109.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aUM0ohYcs6rFVxbdP_k82AAAAFA"]
[Thu Dec 18 06:54:27.568693 2025] [:error] [pid 24958:tid 24978] [client 193.19.109.177:33747] [client 193.19.109.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aUM0o8kDOrUkd0wNm2EVvwAAAZE"]
[Thu Dec 18 06:54:28.286518 2025] [:error] [pid 23556:tid 23574] [client 193.19.109.205:52903] [client 193.19.109.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aUM0pBnmLlk3u5yt9kEQSAAAAA4"]
[Thu Dec 18 06:54:29.084082 2025] [:error] [pid 24542:tid 24567] [client 193.19.109.209:41089] [client 193.19.109.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aUM0pUtQz4H2oS3NrDYdewAAAVc"]
[Thu Dec 18 06:54:30.967127 2025] [:error] [pid 24958:tid 24968] [client 193.19.109.179:46999] [client 193.19.109.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aUM0pskDOrUkd0wNm2EV0QAAAYc"]
[Thu Dec 18 06:54:31.664753 2025] [:error] [pid 25357:tid 25376] [client 193.19.109.206:51251] [client 193.19.109.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aUM0p4aT7bsEXnJVfJdU7wAAAdE"]
[Thu Dec 18 06:54:33.477514 2025] [:error] [pid 24433:tid 24454] [client 193.19.109.195:41763] [client 193.19.109.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aUM0qZ4pN9ycmipm8TgpwwAAARI"]
[Thu Dec 18 06:54:34.165383 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.200:31237] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aUM0qjf_Rx0Y0ao_QJiULwAAAI4"]
[Thu Dec 18 06:54:36.791872 2025] [:error] [pid 23558:tid 23619] [client 193.19.109.204:33411] [client 193.19.109.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aUM0rOHam9NbgPQa9uY_3wAAAMQ"]
[Thu Dec 18 06:54:37.913253 2025] [:error] [pid 23556:tid 23566] [client 193.19.109.167:24571] [client 193.19.109.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aUM0rRnmLlk3u5yt9kEQegAAAAY"]
[Thu Dec 18 06:54:38.663927 2025] [:error] [pid 25357:tid 25374] [client 193.19.109.174:44931] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Dec 18 06:54:39.371427 2025] [:error] [pid 25357:tid 25365] [client 193.19.109.174:44931] [client 193.19.109.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aUM0r4aT7bsEXnJVfJdVUwAAAcY"]
[Thu Dec 18 06:54:40.867307 2025] [:error] [pid 25357:tid 25380] [client 193.19.109.190:40343] [client 193.19.109.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aUM0sIaT7bsEXnJVfJdVaAAAAdU"]
[Thu Dec 18 06:54:43.374266 2025] [:error] [pid 23557:tid 23596] [client 193.19.109.193:30907] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Dec 18 06:54:43.805447 2025] [:error] [pid 23557:tid 23601] [client 193.19.109.193:30907] [client 193.19.109.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aUM0sxYcs6rFVxbdP_k9KwAAAE0"]
[Thu Dec 18 06:54:44.981412 2025] [:error] [pid 23557:tid 23596] [client 193.19.109.192:39267] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Dec 18 06:54:45.323815 2025] [:error] [pid 23557:tid 23595] [client 193.19.109.192:39267] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Dec 18 06:54:45.817912 2025] [:error] [pid 23557:tid 23606] [client 193.19.109.192:39267] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Dec 18 06:54:46.190053 2025] [:error] [pid 23557:tid 23607] [client 193.19.109.192:39267] [client 193.19.109.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aUM0thYcs6rFVxbdP_k9QwAAAFM"]
[Thu Dec 18 06:54:46.950676 2025] [:error] [pid 23557:tid 23606] [client 193.19.109.190:50989] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Dec 18 06:54:47.322610 2025] [:error] [pid 23557:tid 23611] [client 193.19.109.190:50989] [client 193.19.109.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aUM0txYcs6rFVxbdP_k9TQAAAFc"]
[Thu Dec 18 06:54:48.977594 2025] [:error] [pid 23645:tid 23669] [client 193.19.109.178:45339] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Dec 18 06:54:49.324950 2025] [:error] [pid 23645:tid 23653] [client 193.19.109.178:45339] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Dec 18 06:54:50.417877 2025] [:error] [pid 23645:tid 23660] [client 193.19.109.178:45339] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Dec 18 06:54:52.504506 2025] [:error] [pid 23645:tid 23667] [client 193.19.109.178:45339] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Dec 18 06:54:52.982961 2025] [:error] [pid 23645:tid 23665] [client 193.19.109.178:45339] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Dec 18 06:54:53.918295 2025] [:error] [pid 23645:tid 23666] [client 193.19.109.178:45339] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Dec 18 06:54:55.069770 2025] [:error] [pid 23645:tid 23667] [client 193.19.109.178:45339] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Dec 18 06:54:55.416065 2025] [:error] [pid 23645:tid 23651] [client 193.19.109.178:45339] [client 193.19.109.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aUM0vzf_Rx0Y0ao_QJiUtQAAAIQ"]
[Thu Dec 18 06:54:56.174275 2025] [:error] [pid 24433:tid 24438] [client 193.19.109.177:54743] [client 193.19.109.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aUM0wJ4pN9ycmipm8TgqYwAAAQI"]
[Thu Dec 18 06:54:56.890829 2025] [:error] [pid 23645:tid 23656] [client 193.19.109.191:41065] [client 193.19.109.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.191, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUM0wDf_Rx0Y0ao_QJiUuwAAAIk"]
[Thu Dec 18 06:54:56.896215 2025] [:error] [pid 23645:tid 23656] [client 193.19.109.191:41065] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Dec 18 06:54:57.302003 2025] [:error] [pid 23645:tid 23655] [client 193.19.109.191:41065] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Dec 18 06:54:57.700543 2025] [:error] [pid 23645:tid 23663] [client 193.19.109.191:41065] [client 193.19.109.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aUM0wTf_Rx0Y0ao_QJiUvgAAAJA"]
[Thu Dec 18 06:54:58.826663 2025] [:error] [pid 24542:tid 24554] [client 193.19.109.184:45931] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Dec 18 06:54:59.174647 2025] [:error] [pid 24542:tid 24555] [client 193.19.109.184:45931] [client 193.19.109.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aUM0w0tQz4H2oS3NrDYeEQAAAUs"]
[Thu Dec 18 06:54:59.874371 2025] [:error] [pid 23558:tid 23636] [client 193.19.109.175:32813] [client 193.19.109.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aUM0w-Ham9NbgPQa9uZAggAAANU"]
[Thu Dec 18 06:55:02.595485 2025] [:error] [pid 24958:tid 24966] [client 193.19.109.203:32873] [client 193.19.109.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aUM0xskDOrUkd0wNm2EWfgAAAYU"]
[Thu Dec 18 06:55:03.361613 2025] [:error] [pid 23556:tid 23560] [client 193.19.109.161:37697] [client 193.19.109.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aUM0xxnmLlk3u5yt9kERCwAAAAA"]
[Thu Dec 18 06:55:05.333343 2025] [:error] [pid 23558:tid 23638] [client 193.19.109.166:38431] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Dec 18 06:55:06.096098 2025] [:error] [pid 23558:tid 23626] [client 193.19.109.166:38431] [client 193.19.109.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aUM0yuHam9NbgPQa9uZAtQAAAMs"]
[Thu Dec 18 06:55:08.492931 2025] [:error] [pid 23556:tid 23583] [client 193.19.109.193:25433] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Dec 18 06:55:09.303526 2025] [:error] [pid 23556:tid 23562] [client 193.19.109.193:25433] [client 193.19.109.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aUM0zRnmLlk3u5yt9kERQQAAAAI"]
[Thu Dec 18 06:55:10.076311 2025] [:error] [pid 23558:tid 23633] [client 193.19.109.191:27725] [client 193.19.109.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aUM0zuHam9NbgPQa9uZAvgAAANI"]
[Thu Dec 18 06:55:11.238070 2025] [:error] [pid 23645:tid 23652] [client 193.19.109.204:38517] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Dec 18 06:55:11.624282 2025] [:error] [pid 23645:tid 23671] [client 193.19.109.204:38517] [client 193.19.109.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aUM0zzf_Rx0Y0ao_QJiVAgAAAJg"]
[Thu Dec 18 06:55:13.398431 2025] [:error] [pid 24542:tid 24551] [client 193.19.109.188:22007] [client 193.19.109.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aUM00UtQz4H2oS3NrDYeagAAAUc"]
[Thu Dec 18 06:55:16.921042 2025] [:error] [pid 23645:tid 23669] [client 193.19.109.173:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Dec 18 06:55:17.308071 2025] [:error] [pid 23645:tid 23660] [client 193.19.109.173:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Dec 18 06:55:18.075492 2025] [:error] [pid 23645:tid 23665] [client 193.19.109.173:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Dec 18 06:55:18.777470 2025] [:error] [pid 23645:tid 23669] [client 193.19.109.173:64823] [client 193.19.109.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aUM01jf_Rx0Y0ao_QJiVLAAAAJY"]
[Thu Dec 18 06:55:19.475310 2025] [:error] [pid 24433:tid 24455] [client 193.19.109.184:57391] [client 193.19.109.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aUM0154pN9ycmipm8TgrJAAAARM"]
[Thu Dec 18 06:55:23.575984 2025] [:error] [pid 24542:tid 24566] [client 193.19.109.161:25743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Dec 18 06:55:23.970528 2025] [:error] [pid 24542:tid 24565] [client 193.19.109.161:25743] [client 193.19.109.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aUM020tQz4H2oS3NrDYepgAAAVU"]
[Thu Dec 18 06:55:24.679562 2025] [:error] [pid 25357:tid 25363] [client 193.19.109.176:31347] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aUM03IaT7bsEXnJVfJdXDwAAAcQ"]
[Thu Dec 18 06:55:25.375316 2025] [:error] [pid 23558:tid 23632] [client 193.19.109.209:62785] [client 193.19.109.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aUM03eHam9NbgPQa9uZBBwAAANE"]
[Thu Dec 18 06:55:27.774904 2025] [:error] [pid 24542:tid 24547] [client 193.19.109.191:38541] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Dec 18 06:55:28.117755 2025] [:error] [pid 24542:tid 24556] [client 193.19.109.191:38541] [client 193.19.109.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aUM04EtQz4H2oS3NrDYetwAAAUw"]
[Thu Dec 18 06:55:29.290623 2025] [:error] [pid 24958:tid 24977] [client 193.19.109.178:24567] [client 193.19.109.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aUM04ckDOrUkd0wNm2EXZwAAAZA"]
[Thu Dec 18 06:55:30.054064 2025] [:error] [pid 23558:tid 23630] [client 193.19.109.165:31465] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Dec 18 06:55:30.469261 2025] [:error] [pid 23558:tid 23623] [client 193.19.109.165:31465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Dec 18 06:55:31.214151 2025] [:error] [pid 23558:tid 23627] [client 193.19.109.165:31465] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Dec 18 06:55:32.713208 2025] [:error] [pid 23558:tid 23620] [client 193.19.109.165:31465] [client 193.19.109.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.165, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aUM05OHam9NbgPQa9uZBLwAAAMU"]
[Thu Dec 18 06:55:33.616714 2025] [:error] [pid 23558:tid 23626] [client 193.19.109.165:31465] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Dec 18 06:55:34.422198 2025] [:error] [pid 23558:tid 23625] [client 193.19.109.165:31465] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Dec 18 06:55:34.795100 2025] [:error] [pid 23558:tid 23635] [client 193.19.109.165:31465] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Dec 18 06:55:35.580690 2025] [:error] [pid 23558:tid 23637] [client 193.19.109.165:31465] [client 193.19.109.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aUM05-Ham9NbgPQa9uZBRAAAANY"]
[Thu Dec 18 06:55:36.352726 2025] [:error] [pid 24542:tid 24556] [client 193.19.109.163:51407] [client 193.19.109.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.163, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aUM06EtQz4H2oS3NrDYe-QAAAUw"]
[Thu Dec 18 06:55:37.493852 2025] [:error] [pid 24542:tid 24551] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Dec 18 06:55:37.904457 2025] [:error] [pid 24542:tid 24554] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Dec 18 06:55:39.011126 2025] [:error] [pid 24542:tid 24558] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Dec 18 06:55:39.810077 2025] [:error] [pid 24542:tid 24566] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Dec 18 06:55:40.925773 2025] [:error] [pid 24542:tid 24550] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Dec 18 06:55:44.074352 2025] [:error] [pid 24542:tid 24560] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Dec 18 06:55:44.419158 2025] [:error] [pid 24542:tid 24553] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Dec 18 06:55:46.191085 2025] [:error] [pid 24542:tid 24568] [client 193.19.109.163:51407] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Dec 18 06:55:46.973220 2025] [:error] [pid 24542:tid 24566] [client 193.19.109.163:51407] [client 193.19.109.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aUM08ktQz4H2oS3NrDYfYwAAAVY"]
[Thu Dec 18 06:55:48.486869 2025] [:error] [pid 23558:tid 23631] [client 193.19.109.170:42969] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Dec 18 06:55:48.899740 2025] [:error] [pid 23558:tid 23635] [client 193.19.109.170:42969] [client 193.19.109.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aUM09OHam9NbgPQa9uZBpQAAANQ"]
[Thu Dec 18 06:55:50.004740 2025] [:error] [pid 24433:tid 24453] [client 193.19.109.181:34031] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Dec 18 06:55:50.371372 2025] [:error] [pid 24433:tid 24445] [client 193.19.109.181:34031] [client 193.19.109.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aUM09p4pN9ycmipm8TgsAwAAAQk"]
[Thu Dec 18 06:55:51.816269 2025] [:error] [pid 23556:tid 23576] [client 193.19.109.177:34685] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Dec 18 06:55:52.582093 2025] [:error] [pid 23556:tid 23563] [client 193.19.109.177:34685] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Dec 18 06:55:53.396630 2025] [:error] [pid 23556:tid 23575] [client 193.19.109.177:34685] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Dec 18 06:55:53.787657 2025] [:error] [pid 23556:tid 23579] [client 193.19.109.177:34685] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Thu Dec 18 06:55:54.585282 2025] [:error] [pid 23556:tid 23583] [client 193.19.109.177:34685] [client 193.19.109.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aUM0-hnmLlk3u5yt9kESWgAAABc"]
[Thu Dec 18 06:55:55.459585 2025] [:error] [pid 24433:tid 24458] [client 193.19.109.194:63607] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Dec 18 06:55:55.895863 2025] [:error] [pid 24433:tid 24441] [client 193.19.109.194:63607] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Dec 18 06:55:56.334897 2025] [:error] [pid 24433:tid 24441] [client 193.19.109.194:63607] [client 193.19.109.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aUM0_J4pN9ycmipm8TgsJwAAAQU"]
[Thu Dec 18 06:55:57.477668 2025] [:error] [pid 25357:tid 25369] [client 193.19.109.200:50045] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aUM0_YaT7bsEXnJVfJdYMAAAAco"]
[Thu Dec 18 06:55:58.580265 2025] [:error] [pid 23556:tid 23576] [client 193.19.109.203:31727] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Dec 18 06:55:59.690632 2025] [:error] [pid 23556:tid 23581] [client 193.19.109.203:31727] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Thu Dec 18 06:56:00.105421 2025] [:error] [pid 23556:tid 23566] [client 193.19.109.203:31727] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Dec 18 06:56:00.479720 2025] [:error] [pid 23556:tid 23565] [client 193.19.109.203:31727] [client 193.19.109.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aUM1ABnmLlk3u5yt9kEScQAAAAU"]
[Thu Dec 18 06:56:01.200809 2025] [:error] [pid 23556:tid 23573] [client 193.19.109.164:34797] [client 193.19.109.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aUM1ARnmLlk3u5yt9kEScgAAAA0"]
[Thu Dec 18 06:56:03.794378 2025] [:error] [pid 24433:tid 24445] [client 193.19.109.164:25995] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Dec 18 06:56:04.577443 2025] [:error] [pid 24433:tid 24457] [client 193.19.109.164:25995] [client 193.19.109.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aUM1BJ4pN9ycmipm8TgsbQAAARU"]
[Thu Dec 18 06:56:05.611705 2025] [:error] [pid 24958:tid 24985] [client 193.19.109.166:39891] [client 193.19.109.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aUM1BckDOrUkd0wNm2EYIwAAAZg"]
[Thu Dec 18 06:56:07.711909 2025] [:error] [pid 23645:tid 23650] [client 193.19.109.176:27059] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Dec 18 06:56:08.103733 2025] [:error] [pid 23645:tid 23652] [client 193.19.109.176:27059] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Dec 18 06:56:08.468338 2025] [:error] [pid 23645:tid 23662] [client 193.19.109.176:27059] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aUM1CDf_Rx0Y0ao_QJiWkwAAAI8"]
[Thu Dec 18 06:56:09.513156 2025] [:error] [pid 23558:tid 23624] [client 193.19.109.172:35145] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Dec 18 06:56:09.894667 2025] [:error] [pid 23558:tid 23626] [client 193.19.109.172:35145] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Thu Dec 18 06:56:10.674350 2025] [:error] [pid 23558:tid 23636] [client 193.19.109.172:35145] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Dec 18 06:56:12.186783 2025] [:error] [pid 23558:tid 23619] [client 193.19.109.172:35145] [client 193.19.109.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aUM1DOHam9NbgPQa9uZCTgAAAMQ"]
[Thu Dec 18 06:56:12.960568 2025] [:error] [pid 23556:tid 23569] [client 193.19.109.169:49389] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Thu Dec 18 06:56:14.094458 2025] [:error] [pid 23556:tid 23572] [client 193.19.109.169:49389] [client 193.19.109.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aUM1DhnmLlk3u5yt9kESyQAAAAw"]
[Thu Dec 18 07:22:11.143453 2025] [:error] [pid 24542:tid 24553] [client 84.239.43.178:59527] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7I0tQz4H2oS3NrDYxdQAAAUk"]
[Thu Dec 18 07:22:16.942375 2025] [:error] [pid 23645:tid 23657] [client 84.239.43.178:32768] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7KDf_Rx0Y0ao_QJilxAAAAIo"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:22:30.670205 2025] [:error] [pid 24958:tid 24965] [client 84.239.43.178:63102] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00"] [unique_id "aUM7NskDOrUkd0wNm2Ep6QAAAYQ"]
[Thu Dec 18 07:22:33.235123 2025] [:error] [pid 23645:tid 23651] [client 84.239.43.178:4575] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.json"] [unique_id "aUM7OTf_Rx0Y0ao_QJilzgAAAIQ"], referer: https://chat.openai.com/
[Thu Dec 18 07:22:35.574677 2025] [:error] [pid 23558:tid 23639] [client 84.239.43.178:44078] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.html"] [unique_id "aUM7O-Ham9NbgPQa9uZN8wAAANg"], referer: https://www.google.com/
[Thu Dec 18 07:22:41.045177 2025] [:error] [pid 23558:tid 23630] [client 84.239.43.178:40197] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.txt"] [unique_id "aUM7QeHam9NbgPQa9uZN9wAAAM8"], referer: https://twitter.com/
[Thu Dec 18 07:22:43.425277 2025] [:error] [pid 24542:tid 24553] [client 84.239.43.178:3086] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00/"] [unique_id "aUM7Q0tQz4H2oS3NrDYxiAAAAUk"]
[Thu Dec 18 07:22:45.779263 2025] [:error] [pid 23556:tid 23566] [client 84.239.43.178:23734] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/config"] [unique_id "aUM7RRnmLlk3u5yt9kEg3AAAAAY"]
[Thu Dec 18 07:22:49.879811 2025] [:error] [pid 24958:tid 24978] [client 84.239.43.178:50723] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/config"] [unique_id "aUM7SckDOrUkd0wNm2Ep9AAAAZE"]
[Thu Dec 18 07:22:52.208792 2025] [:error] [pid 23645:tid 23662] [client 84.239.43.178:41320] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;"] [unique_id "aUM7TDf_Rx0Y0ao_QJil2AAAAI8"]
[Thu Dec 18 07:22:55.072099 2025] [:error] [pid 24958:tid 24963] [client 84.239.43.178:40362] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;/"] [unique_id "aUM7T8kDOrUkd0wNm2Ep9wAAAYI"], referer: https://twitter.com/
[Thu Dec 18 07:23:01.818371 2025] [:error] [pid 24542:tid 24553] [client 84.239.43.178:54887] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.;/.git/config"] [unique_id "aUM7VUtQz4H2oS3NrDYxlwAAAUk"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:23:07.012699 2025] [:error] [pid 23645:tid 23668] [client 84.239.43.178:30375] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config"] [unique_id "aUM7Wzf_Rx0Y0ao_QJil3AAAAJU"], referer: https://stackoverflow.com/
[Thu Dec 18 07:23:09.375371 2025] [:error] [pid 23557:tid 23610] [client 84.239.43.178:19001] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/."] [unique_id "aUM7XRYcs6rFVxbdP_lNfwAAAFY"]
[Thu Dec 18 07:23:13.299344 2025] [:error] [pid 23557:tid 23601] [client 84.239.43.178:39054] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/./"] [unique_id "aUM7YRYcs6rFVxbdP_lNgQAAAE0"], referer: https://www.linkedin.com/
[Thu Dec 18 07:23:15.728662 2025] [:error] [pid 24958:tid 24967] [client 84.239.43.178:8189] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.git/config"] [unique_id "aUM7Y8kDOrUkd0wNm2Ep_wAAAYY"], referer: https://www.reddit.com/
[Thu Dec 18 07:23:18.098119 2025] [:error] [pid 24958:tid 24961] [client 84.239.43.178:26833] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7ZskDOrUkd0wNm2EqAQAAAYA"], referer: https://chat.openai.com/
[Thu Dec 18 07:23:22.495492 2025] [:error] [pid 25357:tid 25380] [client 84.239.43.178:11939] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7aoaT7bsEXnJVfJdqgwAAAdU"], referer: https://www.google.com/
[Thu Dec 18 07:23:25.285697 2025] [:error] [pid 23557:tid 23598] [client 84.239.43.178:46347] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git//config"] [unique_id "aUM7bRYcs6rFVxbdP_lNhQAAAEo"]
[Thu Dec 18 07:23:32.633696 2025] [:error] [pid 23557:tid 23595] [client 84.239.43.178:31100] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GIT/CONFIG"] [unique_id "aUM7dBYcs6rFVxbdP_lNhwAAAEc"]
[Thu Dec 18 07:23:35.010269 2025] [:error] [pid 24433:tid 24440] [client 84.239.43.178:34129] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GiT/CoNfIg"] [unique_id "aUM7dp4pN9ycmipm8Tg7qwAAAQQ"], referer: https://github.com/
[Thu Dec 18 07:23:40.014659 2025] [:error] [pid 23645:tid 23656] [client 84.239.43.178:24769] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.json"] [unique_id "aUM7fDf_Rx0Y0ao_QJil3gAAAIk"]
[Thu Dec 18 07:23:42.354117 2025] [:error] [pid 25357:tid 25365] [client 84.239.43.178:31292] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.html"] [unique_id "aUM7foaT7bsEXnJVfJdq0QAAAcY"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:23:47.724200 2025] [:error] [pid 25357:tid 25376] [client 84.239.43.178:43335] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.php"] [unique_id "aUM7g4aT7bsEXnJVfJdq2wAAAdE"]
[Thu Dec 18 07:23:50.076355 2025] [:error] [pid 24958:tid 24969] [client 84.239.43.178:35232] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.asp"] [unique_id "aUM7hskDOrUkd0wNm2EqOgAAAYg"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:23:52.428267 2025] [:error] [pid 24433:tid 24445] [client 84.239.43.178:53405] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.aspx"] [unique_id "aUM7iJ4pN9ycmipm8Tg7vwAAAQk"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:23:55.548407 2025] [:error] [pid 23556:tid 23571] [client 84.239.43.178:55591] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.jsp"] [unique_id "aUM7ixnmLlk3u5yt9kEhSwAAAAs"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:23:57.997360 2025] [:error] [pid 25357:tid 25361] [client 84.239.43.178:36890] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.txt"] [unique_id "aUM7jYaT7bsEXnJVfJdq5wAAAcI"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:24:00.354881 2025] [:error] [pid 24542:tid 24557] [client 84.239.43.178:40624] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.xml"] [unique_id "aUM7kEtQz4H2oS3NrDYxygAAAU0"]
[Thu Dec 18 07:24:03.427759 2025] [:error] [pid 24958:tid 24964] [client 84.239.43.178:12992] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config::$DATA"] [unique_id "aUM7k8kDOrUkd0wNm2EqQgAAAYM"], referer: https://www.facebook.com/
[Thu Dec 18 07:24:07.365394 2025] [:error] [pid 25357:tid 25360] [client 84.239.43.178:24734] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7l4aT7bsEXnJVfJdrBgAAAcE"]
[Thu Dec 18 07:24:14.943350 2025] [:error] [pid 25357:tid 25380] [client 84.239.43.178:29860] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7noaT7bsEXnJVfJdrEwAAAdU"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:24:17.348666 2025] [:error] [pid 23556:tid 23581] [client 84.239.43.178:14462] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7oRnmLlk3u5yt9kEhUwAAABU"]
[Thu Dec 18 07:24:21.770095 2025] [:error] [pid 23558:tid 23624] [client 84.239.43.178:28688] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7peHam9NbgPQa9uZOJAAAAMk"]
[Thu Dec 18 07:24:24.163203 2025] [:error] [pid 23557:tid 23601] [client 84.239.43.178:14812] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7qBYcs6rFVxbdP_lNrwAAAE0"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:24:27.899628 2025] [:error] [pid 24542:tid 24561] [client 84.239.43.178:13714] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7q0tQz4H2oS3NrDYx4AAAAVE"]
[Thu Dec 18 07:24:33.864419 2025] [:error] [pid 25357:tid 25379] [client 84.239.43.178:21145] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7sYaT7bsEXnJVfJdrOwAAAdQ"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:24:39.905401 2025] [:error] [pid 25357:tid 25376] [client 84.239.43.178:15001] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7t4aT7bsEXnJVfJdrQgAAAdE"]
[Thu Dec 18 07:24:42.353253 2025] [:error] [pid 25357:tid 25372] [client 84.239.43.178:40108] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7uoaT7bsEXnJVfJdrQwAAAc0"], referer: https://stackoverflow.com/
[Thu Dec 18 07:24:58.096350 2025] [:error] [pid 24958:tid 24963] [client 84.239.43.178:48977] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7yskDOrUkd0wNm2EqbAAAAYI"]
[Thu Dec 18 07:25:03.740336 2025] [:error] [pid 24542:tid 24547] [client 84.239.43.178:53732] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM7z0tQz4H2oS3NrDYx8QAAAUM"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:25:06.087722 2025] [:error] [pid 23558:tid 23620] [client 84.239.43.178:7205] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM70uHam9NbgPQa9uZONwAAAMU"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:25:10.449101 2025] [:error] [pid 23558:tid 23622] [client 84.239.43.178:30799] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM71uHam9NbgPQa9uZOOgAAAMc"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:25:12.914643 2025] [:error] [pid 25357:tid 25359] [client 84.239.43.178:13072] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM72IaT7bsEXnJVfJdrTgAAAcA"], referer: https://stackoverflow.com/
[Thu Dec 18 07:25:15.271825 2025] [:error] [pid 25357:tid 25382] [client 84.239.43.178:18463] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%09"] [unique_id "aUM724aT7bsEXnJVfJdrUQAAAdc"], referer: https://github.com/
[Thu Dec 18 07:25:18.236924 2025] [:error] [pid 23645:tid 23652] [client 84.239.43.178:31204] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0a"] [unique_id "aUM73jf_Rx0Y0ao_QJimCQAAAIU"]
[Thu Dec 18 07:25:20.688385 2025] [:error] [pid 25357:tid 25372] [client 84.239.43.178:48213] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d"] [unique_id "aUM74IaT7bsEXnJVfJdrUwAAAc0"], referer: https://chat.openai.com/
[Thu Dec 18 07:25:23.642096 2025] [:error] [pid 25357:tid 25375] [client 84.239.43.178:24503] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d%0a"] [unique_id "aUM744aT7bsEXnJVfJdrVwAAAdA"], referer: https://www.linkedin.com/
[Thu Dec 18 07:25:28.681330 2025] [:error] [pid 25357:tid 25371] [client 84.239.43.178:49800] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM76IaT7bsEXnJVfJdrWgAAAcw"]
[Thu Dec 18 07:25:31.033566 2025] [:error] [pid 24542:tid 24552] [client 84.239.43.178:33501] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/"] [unique_id "aUM760tQz4H2oS3NrDYyBAAAAUg"]
[Thu Dec 18 07:25:33.908948 2025] [:error] [pid 24542:tid 24564] [client 84.239.43.178:38123] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config//"] [unique_id "aUM77UtQz4H2oS3NrDYyBgAAAVQ"]
[Thu Dec 18 07:25:38.369377 2025] [:error] [pid 23558:tid 23619] [client 84.239.43.178:51859] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config..;/"] [unique_id "aUM78uHam9NbgPQa9uZOQQAAAMQ"], referer: https://twitter.com/
[Thu Dec 18 07:25:40.707347 2025] [:error] [pid 23558:tid 23629] [client 84.239.43.178:31497] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/..;/"] [unique_id "aUM79OHam9NbgPQa9uZORwAAAM4"], referer: https://stackoverflow.com/
[Thu Dec 18 07:25:43.682872 2025] [:error] [pid 25357:tid 25366] [client 84.239.43.178:32141] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config/./"] [unique_id "aUM794aT7bsEXnJVfJdrZwAAAcc"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:25:46.135749 2025] [:error] [pid 23558:tid 23620] [client 84.239.43.178:60124] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/whatever/../.git/config"] [unique_id "aUM7-uHam9NbgPQa9uZOTAAAAMU"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:25:49.109419 2025] [:error] [pid 23645:tid 23657] [client 84.239.43.178:6727] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aaa/../.git/config"] [unique_id "aUM7_Tf_Rx0Y0ao_QJimFwAAAIo"], referer: https://github.com/
[Thu Dec 18 07:25:55.990005 2025] [:error] [pid 25357:tid 25365] [client 84.239.43.178:15012] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.git/config"] [unique_id "aUM8A4aT7bsEXnJVfJdregAAAcY"]
[Thu Dec 18 07:25:58.918106 2025] [:error] [pid 25357:tid 25360] [client 84.239.43.178:38177] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v1/.git/config"] [unique_id "aUM8BoaT7bsEXnJVfJdrlAAAAcE"]
[Thu Dec 18 07:26:01.492989 2025] [:error] [pid 23557:tid 23605] [client 84.239.43.178:1472] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v2/.git/config"] [unique_id "aUM8CRYcs6rFVxbdP_lNzgAAAFE"], referer: https://twitter.com/
[Thu Dec 18 07:26:03.846832 2025] [:error] [pid 24542:tid 24548] [client 84.239.43.178:28664] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.git/config"] [unique_id "aUM8C0tQz4H2oS3NrDYyUgAAAUQ"]
[Thu Dec 18 07:26:11.992460 2025] [:error] [pid 24433:tid 24452] [client 84.239.43.178:59334] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static/.git/config"] [unique_id "aUM8E54pN9ycmipm8Tg8XgAAARA"]
[Thu Dec 18 07:26:16.889540 2025] [:error] [pid 23645:tid 23667] [client 84.239.43.178:59373] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.git/config"] [unique_id "aUM8GDf_Rx0Y0ao_QJimPQAAAJQ"]
[Thu Dec 18 07:26:19.227384 2025] [:error] [pid 24958:tid 24983] [client 84.239.43.178:3251] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/_/.git/config"] [unique_id "aUM8G8kDOrUkd0wNm2EqmQAAAZY"]
[Thu Dec 18 07:26:21.575055 2025] [:error] [pid 24958:tid 24977] [client 84.239.43.178:47514] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/~/.git/config"] [unique_id "aUM8HckDOrUkd0wNm2EqmwAAAZA"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:26:26.926973 2025] [:error] [pid 23557:tid 23594] [client 84.239.43.178:57256] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/@/.git/config"] [unique_id "aUM8IhYcs6rFVxbdP_lN2AAAAEY"], referer: https://stackoverflow.com/
[Thu Dec 18 07:26:29.744012 2025] [:error] [pid 23556:tid 23566] [client 84.239.43.178:38344] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/-/.git/config"] [unique_id "aUM8JRnmLlk3u5yt9kEhfwAAAAY"]
[Thu Dec 18 07:26:32.629176 2025] [:error] [pid 24958:tid 24970] [client 84.239.43.178:1937] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8KMkDOrUkd0wNm2EqpQAAAYk"]
[Thu Dec 18 07:26:44.720981 2025] [:error] [pid 23558:tid 23626] [client 84.239.43.178:36116] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00"] [unique_id "aUM8NOHam9NbgPQa9uZOpgAAAMs"], referer: https://www.facebook.com/
[Thu Dec 18 07:26:47.062814 2025] [:error] [pid 23557:tid 23601] [client 84.239.43.178:27305] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.json"] [unique_id "aUM8NxYcs6rFVxbdP_lN4wAAAE0"]
[Thu Dec 18 07:26:51.572076 2025] [:error] [pid 23645:tid 23661] [client 84.239.43.178:37557] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.html"] [unique_id "aUM8Ozf_Rx0Y0ao_QJimdwAAAI4"]
[Thu Dec 18 07:26:54.416160 2025] [:error] [pid 25357:tid 25365] [client 84.239.43.178:48324] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.txt"] [unique_id "aUM8PoaT7bsEXnJVfJdr9wAAAcY"], referer: https://github.com/
[Thu Dec 18 07:27:00.510798 2025] [:error] [pid 25357:tid 25383] [client 84.239.43.178:41423] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00/"] [unique_id "aUM8RIaT7bsEXnJVfJdr_AAAAdg"]
[Thu Dec 18 07:27:02.868178 2025] [:error] [pid 23558:tid 23630] [client 84.239.43.178:62749] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/config"] [unique_id "aUM8RuHam9NbgPQa9uZOrQAAAM8"]
[Thu Dec 18 07:27:07.035628 2025] [:error] [pid 25357:tid 25381] [client 84.239.43.178:21165] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/config"] [unique_id "aUM8S4aT7bsEXnJVfJdsBgAAAdY"]
[Thu Dec 18 07:27:09.489531 2025] [:error] [pid 23558:tid 23638] [client 84.239.43.178:57242] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;"] [unique_id "aUM8TeHam9NbgPQa9uZOsAAAANc"]
[Thu Dec 18 07:27:11.853358 2025] [:error] [pid 24433:tid 24455] [client 84.239.43.178:45187] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;/"] [unique_id "aUM8T54pN9ycmipm8Tg8hAAAARM"]
[Thu Dec 18 07:27:17.331673 2025] [:error] [pid 23556:tid 23569] [client 84.239.43.178:12588] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.;/.git/config"] [unique_id "aUM8VRnmLlk3u5yt9kEhvgAAAAk"]
[Thu Dec 18 07:27:20.292543 2025] [:error] [pid 24542:tid 24548] [client 84.239.43.178:44873] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config"] [unique_id "aUM8WEtQz4H2oS3NrDYygAAAAUQ"]
[Thu Dec 18 07:27:23.311401 2025] [:error] [pid 23645:tid 23664] [client 84.239.43.178:54301] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/."] [unique_id "aUM8Wzf_Rx0Y0ao_QJimhQAAAJE"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:27:27.203208 2025] [:error] [pid 25357:tid 25362] [client 84.239.43.178:35191] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/./"] [unique_id "aUM8X4aT7bsEXnJVfJdsDAAAAcM"]
[Thu Dec 18 07:27:30.788279 2025] [:error] [pid 25357:tid 25374] [client 84.239.43.178:42609] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.git/config"] [unique_id "aUM8YoaT7bsEXnJVfJdsEwAAAc8"], referer: https://stackoverflow.com/
[Thu Dec 18 07:27:33.379135 2025] [:error] [pid 23557:tid 23590] [client 84.239.43.178:1209] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8ZRYcs6rFVxbdP_lN8gAAAEI"], referer: https://www.facebook.com/
[Thu Dec 18 07:27:35.732457 2025] [:error] [pid 23645:tid 23648] [client 84.239.43.178:34604] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8Zzf_Rx0Y0ao_QJimiQAAAIE"]
[Thu Dec 18 07:27:38.590291 2025] [:error] [pid 23558:tid 23637] [client 84.239.43.178:41072] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git//config"] [unique_id "aUM8auHam9NbgPQa9uZOtwAAANY"]
[Thu Dec 18 07:27:46.355354 2025] [:error] [pid 23558:tid 23639] [client 84.239.43.178:8090] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GIT/CONFIG"] [unique_id "aUM8cuHam9NbgPQa9uZOvAAAANg"]
[Thu Dec 18 07:27:50.004484 2025] [:error] [pid 25357:tid 25375] [client 84.239.43.178:34539] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GiT/CoNfIg"] [unique_id "aUM8doaT7bsEXnJVfJdsbQAAAdA"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:27:52.364419 2025] [:error] [pid 23557:tid 23588] [client 84.239.43.178:38406] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.json"] [unique_id "aUM8eBYcs6rFVxbdP_lN9wAAAEA"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:27:54.768853 2025] [:error] [pid 23556:tid 23581] [client 84.239.43.178:31819] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.html"] [unique_id "aUM8ehnmLlk3u5yt9kEh2gAAABU"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:27:58.415391 2025] [:error] [pid 23558:tid 23636] [client 84.239.43.178:39768] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.php"] [unique_id "aUM8fuHam9NbgPQa9uZOzQAAANU"], referer: https://chat.openai.com/
[Thu Dec 18 07:28:00.759363 2025] [:error] [pid 23558:tid 23627] [client 84.239.43.178:6232] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.asp"] [unique_id "aUM8gOHam9NbgPQa9uZOzgAAAMw"]
[Thu Dec 18 07:28:03.603768 2025] [:error] [pid 23558:tid 23629] [client 84.239.43.178:20004] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.aspx"] [unique_id "aUM8g-Ham9NbgPQa9uZO0QAAAM4"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:28:07.106087 2025] [:error] [pid 24433:tid 24453] [client 84.239.43.178:10872] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.jsp"] [unique_id "aUM8h54pN9ycmipm8Tg8iwAAARE"]
[Thu Dec 18 07:28:09.835645 2025] [:error] [pid 23556:tid 23577] [client 84.239.43.178:11011] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.txt"] [unique_id "aUM8iRnmLlk3u5yt9kEh8wAAABE"], referer: https://www.google.com/
[Thu Dec 18 07:28:14.745215 2025] [:error] [pid 24958:tid 24962] [client 84.239.43.178:41797] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.xml"] [unique_id "aUM8jskDOrUkd0wNm2ErIwAAAYE"], referer: https://www.linkedin.com/
[Thu Dec 18 07:28:17.084041 2025] [:error] [pid 23557:tid 23606] [client 84.239.43.178:56409] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config::$DATA"] [unique_id "aUM8kRYcs6rFVxbdP_lOCgAAAFI"], referer: https://www.linkedin.com/
[Thu Dec 18 07:28:19.446363 2025] [:error] [pid 25357:tid 25372] [client 84.239.43.178:37945] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8k4aT7bsEXnJVfJdsewAAAc0"]
[Thu Dec 18 07:28:23.488167 2025] [:error] [pid 23557:tid 23589] [client 84.239.43.178:30713] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8lxYcs6rFVxbdP_lOCwAAAEE"], referer: https://github.com/
[Thu Dec 18 07:28:25.836125 2025] [:error] [pid 23558:tid 23629] [client 84.239.43.178:43283] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8meHam9NbgPQa9uZO2wAAAM4"]
[Thu Dec 18 07:28:28.211914 2025] [:error] [pid 24433:tid 24458] [client 84.239.43.178:34302] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8nJ4pN9ycmipm8Tg8lwAAARY"]
[Thu Dec 18 07:28:31.511072 2025] [:error] [pid 25357:tid 25377] [client 84.239.43.178:32766] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8n4aT7bsEXnJVfJdsgQAAAdI"], referer: https://www.facebook.com/
[Thu Dec 18 07:28:33.848139 2025] [:error] [pid 23556:tid 23566] [client 84.239.43.178:56649] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8oRnmLlk3u5yt9kEiEQAAAAY"]
[Thu Dec 18 07:28:36.202157 2025] [:error] [pid 25357:tid 25378] [client 84.239.43.178:14229] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8pIaT7bsEXnJVfJdshQAAAdM"]
[Thu Dec 18 07:28:39.863605 2025] [:error] [pid 23558:tid 23618] [client 84.239.43.178:34580] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8p-Ham9NbgPQa9uZO5AAAAMM"]
[Thu Dec 18 07:28:42.235432 2025] [:error] [pid 25357:tid 25360] [client 84.239.43.178:31382] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8qoaT7bsEXnJVfJdslQAAAcE"]
[Thu Dec 18 07:28:57.645115 2025] [:error] [pid 25357:tid 25362] [client 84.239.43.178:9578] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8uYaT7bsEXnJVfJdspAAAAcM"]
[Thu Dec 18 07:29:00.014988 2025] [:error] [pid 23645:tid 23664] [client 84.239.43.178:56569] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8vDf_Rx0Y0ao_QJimuAAAAJE"], referer: https://www.facebook.com/
[Thu Dec 18 07:29:03.106076 2025] [:error] [pid 23645:tid 23649] [client 84.239.43.178:8753] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8vzf_Rx0Y0ao_QJimuwAAAII"]
[Thu Dec 18 07:29:07.058336 2025] [:error] [pid 24958:tid 24970] [client 84.239.43.178:51558] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM8w8kDOrUkd0wNm2ErOwAAAYk"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:29:09.424799 2025] [:error] [pid 24433:tid 24446] [client 84.239.43.178:53680] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM8xZ4pN9ycmipm8Tg8sQAAAQo"]
[Thu Dec 18 07:29:13.666109 2025] [:error] [pid 23645:tid 23661] [client 84.239.43.178:50116] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%09"] [unique_id "aUM8yTf_Rx0Y0ao_QJimvwAAAI4"]
[Thu Dec 18 07:29:16.034858 2025] [:error] [pid 24958:tid 24971] [client 84.239.43.178:21512] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0a"] [unique_id "aUM8zMkDOrUkd0wNm2ErPwAAAYo"], referer: https://www.linkedin.com/
[Thu Dec 18 07:29:19.654153 2025] [:error] [pid 24433:tid 24437] [client 84.239.43.178:7141] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d"] [unique_id "aUM8z54pN9ycmipm8Tg8uAAAAQE"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:29:25.459039 2025] [:error] [pid 25357:tid 25363] [client 84.239.43.178:1055] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d%0a"] [unique_id "aUM81YaT7bsEXnJVfJdswQAAAcQ"]
[Thu Dec 18 07:29:29.404103 2025] [:error] [pid 24958:tid 24970] [client 84.239.43.178:18587] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM82ckDOrUkd0wNm2ErSQAAAYk"]
[Thu Dec 18 07:29:31.819241 2025] [:error] [pid 24433:tid 24443] [client 84.239.43.178:54923] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/"] [unique_id "aUM8254pN9ycmipm8Tg8vgAAAQc"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:29:34.178405 2025] [:error] [pid 23557:tid 23597] [client 84.239.43.178:44280] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config//"] [unique_id "aUM83hYcs6rFVxbdP_lOMwAAAEk"]
[Thu Dec 18 07:29:38.522261 2025] [:error] [pid 23645:tid 23663] [client 84.239.43.178:49298] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config..;/"] [unique_id "aUM84jf_Rx0Y0ao_QJimzgAAAJA"], referer: https://www.linkedin.com/
[Thu Dec 18 07:29:40.902890 2025] [:error] [pid 24542:tid 24561] [client 84.239.43.178:19511] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/..;/"] [unique_id "aUM85EtQz4H2oS3NrDYy-gAAAVE"]
[Thu Dec 18 07:29:46.178789 2025] [:error] [pid 25357:tid 25376] [client 84.239.43.178:16334] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config/./"] [unique_id "aUM86oaT7bsEXnJVfJds7AAAAdE"], referer: https://www.linkedin.com/
[Thu Dec 18 07:29:48.523670 2025] [:error] [pid 23558:tid 23638] [client 84.239.43.178:52577] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/whatever/../.git/config"] [unique_id "aUM87OHam9NbgPQa9uZPCwAAANc"]
[Thu Dec 18 07:29:50.878929 2025] [:error] [pid 23645:tid 23670] [client 84.239.43.178:18807] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aaa/../.git/config"] [unique_id "aUM87jf_Rx0Y0ao_QJim0QAAAJc"]
[Thu Dec 18 07:29:55.348412 2025] [:error] [pid 23556:tid 23568] [client 84.239.43.178:15335] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.git/config"] [unique_id "aUM88xnmLlk3u5yt9kEiSwAAAAg"], referer: https://github.com/
[Thu Dec 18 07:29:58.422723 2025] [:error] [pid 23557:tid 23588] [client 84.239.43.178:48681] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v1/.git/config"] [unique_id "aUM89hYcs6rFVxbdP_lOjwAAAEA"], referer: https://www.linkedin.com/
[Thu Dec 18 07:30:03.782468 2025] [:error] [pid 23556:tid 23565] [client 84.239.43.178:65238] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v2/.git/config"] [unique_id "aUM8-xnmLlk3u5yt9kEiTgAAAAU"], referer: https://github.com/
[Thu Dec 18 07:30:06.798402 2025] [:error] [pid 23558:tid 23618] [client 84.239.43.178:65285] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.git/config"] [unique_id "aUM8_uHam9NbgPQa9uZPHQAAAMM"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:30:12.160122 2025] [:error] [pid 24433:tid 24455] [client 84.239.43.178:50690] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static/.git/config"] [unique_id "aUM9BJ4pN9ycmipm8Tg82wAAARM"], referer: https://www.facebook.com/
[Thu Dec 18 07:30:14.526772 2025] [:error] [pid 25357:tid 25364] [client 84.239.43.178:47012] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.git/config"] [unique_id "aUM9BoaT7bsEXnJVfJdtEgAAAcU"]
[Thu Dec 18 07:30:20.385752 2025] [:error] [pid 23557:tid 23601] [client 84.239.43.178:63935] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/_/.git/config"] [unique_id "aUM9DBYcs6rFVxbdP_lOlQAAAE0"]
[Thu Dec 18 07:30:22.773890 2025] [:error] [pid 24958:tid 24977] [client 84.239.43.178:48017] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/~/.git/config"] [unique_id "aUM9DskDOrUkd0wNm2ErcwAAAZA"], referer: https://www.reddit.com/
[Thu Dec 18 07:30:25.676128 2025] [:error] [pid 24433:tid 24440] [client 84.239.43.178:22153] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/@/.git/config"] [unique_id "aUM9EZ4pN9ycmipm8Tg84wAAAQQ"], referer: https://stackoverflow.com/
[Thu Dec 18 07:30:28.275144 2025] [:error] [pid 24542:tid 24568] [client 84.239.43.178:57186] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/-/.git/config"] [unique_id "aUM9FEtQz4H2oS3NrDYzGwAAAVg"]
[Thu Dec 18 07:30:31.037618 2025] [:error] [pid 23645:tid 23657] [client 84.239.43.178:61585] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9Fzf_Rx0Y0ao_QJim7QAAAIo"], referer: https://twitter.com/
[Thu Dec 18 07:30:44.873948 2025] [:error] [pid 24958:tid 24966] [client 84.239.43.178:25195] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00"] [unique_id "aUM9JMkDOrUkd0wNm2ErrQAAAYU"], referer: https://www.linkedin.com/
[Thu Dec 18 07:30:47.269496 2025] [:error] [pid 24433:tid 24453] [client 84.239.43.178:28209] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.json"] [unique_id "aUM9J54pN9ycmipm8Tg9DwAAARE"], referer: https://stackoverflow.com/
[Thu Dec 18 07:30:50.110202 2025] [:error] [pid 23645:tid 23662] [client 84.239.43.178:15342] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.html"] [unique_id "aUM9Kjf_Rx0Y0ao_QJinFwAAAI8"]
[Thu Dec 18 07:30:54.000663 2025] [:error] [pid 24433:tid 24451] [client 84.239.43.178:54215] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.txt"] [unique_id "aUM9Lp4pN9ycmipm8Tg9EQAAAQ8"]
[Thu Dec 18 07:30:56.360913 2025] [:error] [pid 24542:tid 24555] [client 84.239.43.178:33086] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00/"] [unique_id "aUM9MEtQz4H2oS3NrDYzSwAAAUs"], referer: https://www.reddit.com/
[Thu Dec 18 07:31:00.868589 2025] [:error] [pid 25357:tid 25378] [client 84.239.43.178:12052] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/config"] [unique_id "aUM9NIaT7bsEXnJVfJdtfwAAAdM"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:31:03.207691 2025] [:error] [pid 23557:tid 23612] [client 84.239.43.178:8060] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/config"] [unique_id "aUM9NxYcs6rFVxbdP_lOsgAAAFg"]
[Thu Dec 18 07:31:05.557318 2025] [:error] [pid 24542:tid 24560] [client 84.239.43.178:45280] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;"] [unique_id "aUM9OUtQz4H2oS3NrDYzTgAAAVA"]
[Thu Dec 18 07:31:08.792688 2025] [:error] [pid 23556:tid 23569] [client 84.239.43.178:56037] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;/"] [unique_id "aUM9PBnmLlk3u5yt9kEiYQAAAAk"]
[Thu Dec 18 07:31:14.020759 2025] [:error] [pid 25357:tid 25382] [client 84.239.43.178:19542] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.;/.git/config"] [unique_id "aUM9QoaT7bsEXnJVfJdtiwAAAdc"]
[Thu Dec 18 07:31:18.661826 2025] [:error] [pid 23558:tid 23637] [client 84.239.43.178:33959] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config"] [unique_id "aUM9RuHam9NbgPQa9uZPbwAAANY"]
[Thu Dec 18 07:31:21.024237 2025] [:error] [pid 24433:tid 24440] [client 84.239.43.178:60769] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/."] [unique_id "aUM9SZ4pN9ycmipm8Tg9JAAAAQQ"], referer: https://chat.openai.com/
[Thu Dec 18 07:31:25.895118 2025] [:error] [pid 23558:tid 23615] [client 84.239.43.178:54285] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/./"] [unique_id "aUM9TeHam9NbgPQa9uZPdgAAAMA"], referer: https://chat.openai.com/
[Thu Dec 18 07:31:28.235049 2025] [:error] [pid 24433:tid 24446] [client 84.239.43.178:7309] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.git/config"] [unique_id "aUM9UJ4pN9ycmipm8Tg9KwAAAQo"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:31:30.614645 2025] [:error] [pid 25357:tid 25370] [client 84.239.43.178:57108] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9UoaT7bsEXnJVfJdtnQAAAcs"]
[Thu Dec 18 07:31:35.186203 2025] [:error] [pid 23645:tid 23654] [client 84.239.43.178:18145] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9Vzf_Rx0Y0ao_QJinQAAAAIc"], referer: https://www.reddit.com/
[Thu Dec 18 07:31:37.531363 2025] [:error] [pid 24433:tid 24452] [client 84.239.43.178:62589] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git//config"] [unique_id "aUM9WZ4pN9ycmipm8Tg9LQAAARA"], referer: https://www.reddit.com/
[Thu Dec 18 07:31:42.689764 2025] [:error] [pid 25357:tid 25360] [client 84.239.43.178:52271] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GIT/CONFIG"] [unique_id "aUM9XoaT7bsEXnJVfJdttAAAAcE"]
[Thu Dec 18 07:31:45.664195 2025] [:error] [pid 23556:tid 23574] [client 84.239.43.178:16972] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GiT/CoNfIg"] [unique_id "aUM9YRnmLlk3u5yt9kEibQAAAA4"]
[Thu Dec 18 07:31:48.522519 2025] [:error] [pid 25357:tid 25372] [client 84.239.43.178:8816] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.json"] [unique_id "aUM9ZIaT7bsEXnJVfJdtuwAAAc0"], referer: https://twitter.com/
[Thu Dec 18 07:31:51.282893 2025] [:error] [pid 24958:tid 24973] [client 84.239.43.178:13292] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.html"] [unique_id "aUM9Z8kDOrUkd0wNm2ErzwAAAYw"], referer: https://www.reddit.com/
[Thu Dec 18 07:31:53.624141 2025] [:error] [pid 24433:tid 24446] [client 84.239.43.178:35636] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.php"] [unique_id "aUM9aZ4pN9ycmipm8Tg9NwAAAQo"], referer: https://twitter.com/
[Thu Dec 18 07:31:56.345167 2025] [:error] [pid 24542:tid 24546] [client 84.239.43.178:3741] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.asp"] [unique_id "aUM9bEtQz4H2oS3NrDYzaQAAAUI"]
[Thu Dec 18 07:32:00.289291 2025] [:error] [pid 23558:tid 23615] [client 84.239.43.178:54307] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.aspx"] [unique_id "aUM9cOHam9NbgPQa9uZPgAAAAMA"], referer: https://www.linkedin.com/
[Thu Dec 18 07:32:02.898783 2025] [:error] [pid 23645:tid 23658] [client 84.239.43.178:19691] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.jsp"] [unique_id "aUM9cjf_Rx0Y0ao_QJinSQAAAIs"]
[Thu Dec 18 07:32:08.239538 2025] [:error] [pid 24433:tid 24455] [client 84.239.43.178:4390] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.txt"] [unique_id "aUM9eJ4pN9ycmipm8Tg9PQAAARM"], referer: https://stackoverflow.com/
[Thu Dec 18 07:32:11.171163 2025] [:error] [pid 24542:tid 24552] [client 84.239.43.178:31061] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.xml"] [unique_id "aUM9e0tQz4H2oS3NrDYzfAAAAUg"]
[Thu Dec 18 07:32:17.486732 2025] [:error] [pid 24433:tid 24460] [client 84.239.43.178:3538] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config::$DATA"] [unique_id "aUM9gZ4pN9ycmipm8Tg9RQAAARg"]
[Thu Dec 18 07:32:19.899245 2025] [:error] [pid 24433:tid 24436] [client 84.239.43.178:63217] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9g54pN9ycmipm8Tg9TAAAAQA"]
[Thu Dec 18 07:32:22.818898 2025] [:error] [pid 24958:tid 24977] [client 84.239.43.178:1132] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9hskDOrUkd0wNm2Er4wAAAZA"], referer: https://chat.openai.com/
[Thu Dec 18 07:32:25.195352 2025] [:error] [pid 24542:tid 24565] [client 84.239.43.178:28745] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9iUtQz4H2oS3NrDYzgQAAAVU"]
[Thu Dec 18 07:32:27.551577 2025] [:error] [pid 24542:tid 24545] [client 84.239.43.178:22992] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9i0tQz4H2oS3NrDYzgwAAAUE"]
[Thu Dec 18 07:32:31.509292 2025] [:error] [pid 23558:tid 23625] [client 84.239.43.178:55272] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9j-Ham9NbgPQa9uZPjwAAAMo"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:32:34.032084 2025] [:error] [pid 23557:tid 23590] [client 84.239.43.178:10002] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9khYcs6rFVxbdP_lO5wAAAEI"], referer: https://www.reddit.com/
[Thu Dec 18 07:32:36.392572 2025] [:error] [pid 25357:tid 25381] [client 84.239.43.178:14468] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9lIaT7bsEXnJVfJdtywAAAdY"]
[Thu Dec 18 07:32:39.759775 2025] [:error] [pid 23558:tid 23637] [client 84.239.43.178:34702] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9l-Ham9NbgPQa9uZPkwAAANY"]
[Thu Dec 18 07:32:42.208670 2025] [:error] [pid 24433:tid 24453] [client 84.239.43.178:39612] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9mp4pN9ycmipm8Tg9TwAAARE"]
[Thu Dec 18 07:32:58.321753 2025] [:error] [pid 23558:tid 23623] [client 84.239.43.178:48888] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9quHam9NbgPQa9uZPlQAAAMg"]
[Thu Dec 18 07:33:00.674859 2025] [:error] [pid 23556:tid 23572] [client 84.239.43.178:18325] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9rBnmLlk3u5yt9kEiiwAAAAw"]
[Thu Dec 18 07:33:03.255800 2025] [:error] [pid 23557:tid 23589] [client 84.239.43.178:7932] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9rxYcs6rFVxbdP_lO6QAAAEE"]
[Thu Dec 18 07:33:06.823392 2025] [:error] [pid 24542:tid 24547] [client 84.239.43.178:4610] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM9sktQz4H2oS3NrDYzkwAAAUM"]
[Thu Dec 18 07:33:09.165683 2025] [:error] [pid 24542:tid 24551] [client 84.239.43.178:1401] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM9tUtQz4H2oS3NrDYzlgAAAUc"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:33:14.012366 2025] [:error] [pid 24958:tid 24969] [client 84.239.43.178:12422] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%09"] [unique_id "aUM9uckDOrUkd0wNm2Er-AAAAYg"], referer: https://github.com/
[Thu Dec 18 07:33:17.009335 2025] [:error] [pid 24433:tid 24451] [client 84.239.43.178:18368] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0a"] [unique_id "aUM9vZ4pN9ycmipm8Tg9WQAAAQ8"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:33:19.414254 2025] [:error] [pid 23645:tid 23664] [client 84.239.43.178:17506] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d"] [unique_id "aUM9vzf_Rx0Y0ao_QJinYgAAAJE"]
[Thu Dec 18 07:33:24.337941 2025] [:error] [pid 23558:tid 23632] [client 84.239.43.178:56886] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d%0a"] [unique_id "aUM9xOHam9NbgPQa9uZPoAAAANE"], referer: https://twitter.com/
[Thu Dec 18 07:33:28.188419 2025] [:error] [pid 24433:tid 24447] [client 84.239.43.178:55213] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM9yJ4pN9ycmipm8Tg9YAAAAQs"]
[Thu Dec 18 07:33:30.955400 2025] [:error] [pid 23558:tid 23635] [client 84.239.43.178:46652] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/"] [unique_id "aUM9yuHam9NbgPQa9uZPpwAAANQ"]
[Thu Dec 18 07:33:33.330291 2025] [:error] [pid 24433:tid 24444] [client 84.239.43.178:20811] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config//"] [unique_id "aUM9zZ4pN9ycmipm8Tg9YwAAAQg"], referer: https://chat.openai.com/
[Thu Dec 18 07:33:36.468039 2025] [:error] [pid 23558:tid 23626] [client 84.239.43.178:23579] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config..;/"] [unique_id "aUM90OHam9NbgPQa9uZPqwAAAMs"], referer: https://github.com/
[Thu Dec 18 07:33:39.649749 2025] [:error] [pid 25357:tid 25376] [client 84.239.43.178:38578] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/..;/"] [unique_id "aUM904aT7bsEXnJVfJduAQAAAdE"]
[Thu Dec 18 07:33:42.005066 2025] [:error] [pid 23557:tid 23588] [client 84.239.43.178:29034] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config/./"] [unique_id "aUM91hYcs6rFVxbdP_lO8AAAAEA"]
[Thu Dec 18 07:33:45.761991 2025] [:error] [pid 24958:tid 24962] [client 84.239.43.178:58761] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/whatever/../.git/config"] [unique_id "aUM92ckDOrUkd0wNm2EsBQAAAYE"]
[Thu Dec 18 07:33:48.292817 2025] [:error] [pid 23645:tid 23647] [client 84.239.43.178:46401] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aaa/../.git/config"] [unique_id "aUM93Df_Rx0Y0ao_QJindQAAAIA"]
[Thu Dec 18 07:33:56.317710 2025] [:error] [pid 24958:tid 24966] [client 84.239.43.178:26960] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.git/config"] [unique_id "aUM95MkDOrUkd0wNm2EsEQAAAYU"]
[Thu Dec 18 07:33:58.703487 2025] [:error] [pid 24958:tid 24976] [client 84.239.43.178:5699] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v1/.git/config"] [unique_id "aUM95skDOrUkd0wNm2EsFgAAAY8"], referer: https://chat.openai.com/
[Thu Dec 18 07:34:02.426718 2025] [:error] [pid 24542:tid 24556] [client 84.239.43.178:13461] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v2/.git/config"] [unique_id "aUM96ktQz4H2oS3NrDYzrQAAAUw"]
[Thu Dec 18 07:34:05.480764 2025] [:error] [pid 23645:tid 23653] [client 84.239.43.178:30493] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.git/config"] [unique_id "aUM97Tf_Rx0Y0ao_QJinewAAAIY"], referer: https://www.google.com/
[Thu Dec 18 07:34:07.839220 2025] [:error] [pid 24958:tid 24982] [client 84.239.43.178:59709] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static/.git/config"] [unique_id "aUM978kDOrUkd0wNm2EsHAAAAZU"]
[Thu Dec 18 07:34:10.793059 2025] [:error] [pid 24958:tid 24981] [client 84.239.43.178:3431] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.git/config"] [unique_id "aUM98skDOrUkd0wNm2EsHwAAAZQ"], referer: https://twitter.com/
[Thu Dec 18 07:34:13.240126 2025] [:error] [pid 23556:tid 23563] [client 84.239.43.178:37600] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/_/.git/config"] [unique_id "aUM99RnmLlk3u5yt9kEiogAAAAM"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:34:15.595887 2025] [:error] [pid 23557:tid 23604] [client 84.239.43.178:20587] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/~/.git/config"] [unique_id "aUM99xYcs6rFVxbdP_lO9wAAAFA"]
[Thu Dec 18 07:34:19.995929 2025] [:error] [pid 24433:tid 24449] [client 84.239.43.178:51900] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/@/.git/config"] [unique_id "aUM9-54pN9ycmipm8Tg9fAAAAQ0"]
[Thu Dec 18 07:34:22.474440 2025] [:error] [pid 25357:tid 25364] [client 84.239.43.178:12632] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/-/.git/config"] [unique_id "aUM9_oaT7bsEXnJVfJduFgAAAcU"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:34:24.859161 2025] [:error] [pid 23558:tid 23637] [client 84.239.43.178:44931] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-AOHam9NbgPQa9uZP1AAAANY"]
[Thu Dec 18 07:34:41.877724 2025] [:error] [pid 23558:tid 23624] [client 84.239.43.178:36547] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00"] [unique_id "aUM-EeHam9NbgPQa9uZP3QAAAMk"]
[Thu Dec 18 07:34:46.364247 2025] [:error] [pid 23557:tid 23589] [client 84.239.43.178:43948] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.json"] [unique_id "aUM-FhYcs6rFVxbdP_lPCQAAAEE"]
[Thu Dec 18 07:34:48.703829 2025] [:error] [pid 23558:tid 23616] [client 84.239.43.178:28671] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.html"] [unique_id "aUM-GOHam9NbgPQa9uZP4AAAAME"], referer: https://www.reddit.com/
[Thu Dec 18 07:34:52.437396 2025] [:error] [pid 23558:tid 23625] [client 84.239.43.178:24375] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00.txt"] [unique_id "aUM-HOHam9NbgPQa9uZP4gAAAMo"], referer: https://www.reddit.com/
[Thu Dec 18 07:34:54.920193 2025] [:error] [pid 25357:tid 25364] [client 84.239.43.178:11231] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%00/"] [unique_id "aUM-HoaT7bsEXnJVfJduXQAAAcU"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:34:57.260442 2025] [:error] [pid 25357:tid 25382] [client 84.239.43.178:26039] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/config"] [unique_id "aUM-IYaT7bsEXnJVfJduYQAAAdc"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:35:03.291414 2025] [:error] [pid 24433:tid 24454] [client 84.239.43.178:48835] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/config"] [unique_id "aUM-J54pN9ycmipm8Tg9kAAAARI"], referer: https://github.com/
[Thu Dec 18 07:35:05.638694 2025] [:error] [pid 23645:tid 23648] [client 84.239.43.178:38573] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;"] [unique_id "aUM-KTf_Rx0Y0ao_QJinrwAAAIE"]
[Thu Dec 18 07:35:08.614268 2025] [:error] [pid 23558:tid 23627] [client 84.239.43.178:5960] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config;/"] [unique_id "aUM-LOHam9NbgPQa9uZP5gAAAMw"], referer: https://www.reddit.com/
[Thu Dec 18 07:35:13.521367 2025] [:error] [pid 23645:tid 23666] [client 84.239.43.178:50608] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.;/.git/config"] [unique_id "aUM-MTf_Rx0Y0ao_QJinsgAAAJM"]
[Thu Dec 18 07:35:16.392798 2025] [:error] [pid 24433:tid 24443] [client 84.239.43.178:10296] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config"] [unique_id "aUM-NJ4pN9ycmipm8Tg9mQAAAQc"]
[Thu Dec 18 07:35:19.837535 2025] [:error] [pid 24433:tid 24457] [client 84.239.43.178:38067] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/."] [unique_id "aUM-N54pN9ycmipm8Tg9nQAAARU"], referer: https://www.facebook.com/
[Thu Dec 18 07:35:22.185365 2025] [:error] [pid 24542:tid 24554] [client 84.239.43.178:16104] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/./"] [unique_id "aUM-OktQz4H2oS3NrDYz8wAAAUo"]
[Thu Dec 18 07:35:27.065504 2025] [:error] [pid 23557:tid 23611] [client 84.239.43.178:56765] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.git/config"] [unique_id "aUM-PxYcs6rFVxbdP_lPIAAAAFc"]
[Thu Dec 18 07:35:29.419812 2025] [:error] [pid 25357:tid 25366] [client 84.239.43.178:40136] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-QYaT7bsEXnJVfJduiwAAAcc"], referer: https://stackoverflow.com/
[Thu Dec 18 07:35:31.778434 2025] [:error] [pid 24958:tid 24979] [client 84.239.43.178:5066] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-Q8kDOrUkd0wNm2EspAAAAZI"], referer: https://github.com/
[Thu Dec 18 07:35:36.306312 2025] [:error] [pid 24542:tid 24545] [client 84.239.43.178:38874] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git//config"] [unique_id "aUM-SEtQz4H2oS3NrDYz_AAAAUE"], referer: https://twitter.com/
[Thu Dec 18 07:35:40.740980 2025] [:error] [pid 24433:tid 24459] [client 84.239.43.178:37518] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GIT/CONFIG"] [unique_id "aUM-TJ4pN9ycmipm8Tg9qAAAARc"]
[Thu Dec 18 07:35:44.680824 2025] [:error] [pid 23645:tid 23650] [client 84.239.43.178:59038] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GiT/CoNfIg"] [unique_id "aUM-UDf_Rx0Y0ao_QJinyAAAAIM"]
[Thu Dec 18 07:35:47.023193 2025] [:error] [pid 24958:tid 24970] [client 84.239.43.178:62493] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.json"] [unique_id "aUM-U8kDOrUkd0wNm2EssQAAAYk"], referer: https://github.com/
[Thu Dec 18 07:35:53.557248 2025] [:error] [pid 23558:tid 23632] [client 84.239.43.178:1428] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.html"] [unique_id "aUM-WOHam9NbgPQa9uZP9QAAANE"], referer: https://www.linkedin.com/
[Thu Dec 18 07:35:55.935999 2025] [:error] [pid 23556:tid 23567] [client 84.239.43.178:23883] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.php"] [unique_id "aUM-WxnmLlk3u5yt9kEiygAAAAc"], referer: https://www.facebook.com/
[Thu Dec 18 07:35:59.861592 2025] [:error] [pid 24958:tid 24972] [client 84.239.43.178:35006] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.asp"] [unique_id "aUM-X8kDOrUkd0wNm2EstAAAAYs"], referer: https://stackoverflow.com/
[Thu Dec 18 07:36:02.296399 2025] [:error] [pid 23645:tid 23651] [client 84.239.43.178:24960] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.aspx"] [unique_id "aUM-Yjf_Rx0Y0ao_QJin0QAAAIQ"]
[Thu Dec 18 07:36:05.689647 2025] [:error] [pid 24958:tid 24968] [client 84.239.43.178:4420] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.jsp"] [unique_id "aUM-ZckDOrUkd0wNm2EstQAAAYc"]
[Thu Dec 18 07:36:09.756487 2025] [:error] [pid 24542:tid 24560] [client 84.239.43.178:40629] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.txt"] [unique_id "aUM-aUtQz4H2oS3NrDY0DAAAAVA"], referer: https://chat.openai.com/
[Thu Dec 18 07:36:12.118327 2025] [:error] [pid 24433:tid 24449] [client 84.239.43.178:9574] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config.xml"] [unique_id "aUM-bJ4pN9ycmipm8Tg9twAAAQ0"]
[Thu Dec 18 07:36:17.066266 2025] [:error] [pid 24433:tid 24450] [client 84.239.43.178:48949] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config::$DATA"] [unique_id "aUM-cZ4pN9ycmipm8Tg9ugAAAQ4"]
[Thu Dec 18 07:36:19.423059 2025] [:error] [pid 24958:tid 24975] [client 84.239.43.178:3631] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-c8kDOrUkd0wNm2EsuQAAAY4"]
[Thu Dec 18 07:36:21.831469 2025] [:error] [pid 25357:tid 25377] [client 84.239.43.178:29516] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-dYaT7bsEXnJVfJdurQAAAdI"]
[Thu Dec 18 07:36:26.745819 2025] [:error] [pid 23556:tid 23565] [client 84.239.43.178:10156] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-ehnmLlk3u5yt9kEi1gAAAAU"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:36:29.127279 2025] [:error] [pid 23556:tid 23574] [client 84.239.43.178:53288] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-fRnmLlk3u5yt9kEi2AAAAA4"], referer: https://chat.openai.com/
[Thu Dec 18 07:36:33.492102 2025] [:error] [pid 25357:tid 25366] [client 84.239.43.178:22490] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-gYaT7bsEXnJVfJdusAAAAcc"]
[Thu Dec 18 07:36:35.859169 2025] [:error] [pid 23556:tid 23571] [client 84.239.43.178:2304] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-gxnmLlk3u5yt9kEi2QAAAAs"], referer: https://www.reddit.com/
[Thu Dec 18 07:36:38.249945 2025] [:error] [pid 25357:tid 25376] [client 84.239.43.178:41321] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-hoaT7bsEXnJVfJdutQAAAdE"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:36:42.676234 2025] [:error] [pid 25357:tid 25382] [client 84.239.43.178:23128] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-ioaT7bsEXnJVfJdutwAAAdc"]
[Thu Dec 18 07:36:45.400263 2025] [:error] [pid 23556:tid 23581] [client 84.239.43.178:25908] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-jRnmLlk3u5yt9kEi3AAAABU"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:37:00.094846 2025] [:error] [pid 25357:tid 25375] [client 84.239.43.178:46108] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-nIaT7bsEXnJVfJdu5gAAAdA"], referer: https://github.com/
[Thu Dec 18 07:37:03.051635 2025] [:error] [pid 24958:tid 24984] [client 84.239.43.178:1398] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-n8kDOrUkd0wNm2EsxwAAAZc"]
[Thu Dec 18 07:37:06.063429 2025] [:error] [pid 23558:tid 23623] [client 84.239.43.178:9629] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-ouHam9NbgPQa9uZQDQAAAMg"], referer: https://www.google.com/
[Thu Dec 18 07:37:10.013524 2025] [:error] [pid 24542:tid 24559] [client 84.239.43.178:36926] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUM-pktQz4H2oS3NrDY0VgAAAU8"]
[Thu Dec 18 07:37:12.466021 2025] [:error] [pid 25357:tid 25365] [client 84.239.43.178:8285] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM-qIaT7bsEXnJVfJdvCAAAAcY"], referer: https://chat.openai.com/
[Thu Dec 18 07:37:16.667321 2025] [:error] [pid 23558:tid 23618] [client 84.239.43.178:22111] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%09"] [unique_id "aUM-rOHam9NbgPQa9uZQEAAAAMM"], referer: https://twitter.com/
[Thu Dec 18 07:37:19.028017 2025] [:error] [pid 24958:tid 24964] [client 84.239.43.178:40298] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0a"] [unique_id "aUM-r8kDOrUkd0wNm2EsygAAAYM"]
[Thu Dec 18 07:37:24.896524 2025] [:error] [pid 23557:tid 23604] [client 84.239.43.178:28678] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d"] [unique_id "aUM-tBYcs6rFVxbdP_lPWgAAAFA"], referer: https://github.com/
[Thu Dec 18 07:37:27.765813 2025] [:error] [pid 24542:tid 24559] [client 84.239.43.178:35225] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%0d%0a"] [unique_id "aUM-t0tQz4H2oS3NrDY0ZAAAAU8"]
[Thu Dec 18 07:37:32.409720 2025] [:error] [pid 23556:tid 23584] [client 84.239.43.178:16207] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config%20"] [unique_id "aUM-vBnmLlk3u5yt9kEi_QAAABg"]
[Thu Dec 18 07:37:34.792596 2025] [:error] [pid 23645:tid 23668] [client 84.239.43.178:10951] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/"] [unique_id "aUM-vjf_Rx0Y0ao_QJin_QAAAJU"], referer: https://www.reddit.com/
[Thu Dec 18 07:37:37.513342 2025] [:error] [pid 24433:tid 24447] [client 84.239.43.178:24240] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config//"] [unique_id "aUM-wZ4pN9ycmipm8Tg94wAAAQs"]
[Thu Dec 18 07:37:41.521980 2025] [:error] [pid 23645:tid 23654] [client 84.239.43.178:29990] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config..;/"] [unique_id "aUM-xTf_Rx0Y0ao_QJioAwAAAIc"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:37:43.866345 2025] [:error] [pid 24433:tid 24453] [client 84.239.43.178:7019] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config/..;/"] [unique_id "aUM-x54pN9ycmipm8Tg95wAAARE"], referer: https://www.reddit.com/
[Thu Dec 18 07:37:46.422636 2025] [:error] [pid 24542:tid 24562] [client 84.239.43.178:33077] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/config/./"] [unique_id "aUM-yktQz4H2oS3NrDY0bQAAAVI"], referer: https://www.reddit.com/
[Thu Dec 18 07:37:50.795883 2025] [:error] [pid 23645:tid 23647] [client 84.239.43.178:45382] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/whatever/../.git/config"] [unique_id "aUM-zjf_Rx0Y0ao_QJioCAAAAIA"], referer: https://www.linkedin.com/
[Thu Dec 18 07:37:53.150560 2025] [:error] [pid 23645:tid 23658] [client 84.239.43.178:49883] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aaa/../.git/config"] [unique_id "aUM-0Tf_Rx0Y0ao_QJioCwAAAIs"], referer: https://www.reddit.com/
[Thu Dec 18 07:37:57.732330 2025] [:error] [pid 24542:tid 24546] [client 84.239.43.178:27982] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.git/config"] [unique_id "aUM-1UtQz4H2oS3NrDY0cgAAAUI"]
[Thu Dec 18 07:38:00.082815 2025] [:error] [pid 23556:tid 23568] [client 84.239.43.178:33106] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v1/.git/config"] [unique_id "aUM-2BnmLlk3u5yt9kEjBQAAAAg"]
[Thu Dec 18 07:38:03.637882 2025] [:error] [pid 25357:tid 25382] [client 84.239.43.178:44890] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v2/.git/config"] [unique_id "aUM-24aT7bsEXnJVfJdvFQAAAdc"]
[Thu Dec 18 07:38:06.222779 2025] [:error] [pid 24542:tid 24555] [client 84.239.43.178:52097] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.git/config"] [unique_id "aUM-3ktQz4H2oS3NrDY0eAAAAUs"]
[Thu Dec 18 07:38:08.591235 2025] [:error] [pid 24433:tid 24456] [client 84.239.43.178:5399] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static/.git/config"] [unique_id "aUM-4J4pN9ycmipm8Tg97gAAARQ"], referer: https://www.facebook.com/
[Thu Dec 18 07:38:12.046958 2025] [:error] [pid 25357:tid 25360] [client 84.239.43.178:35233] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.git/config"] [unique_id "aUM-5IaT7bsEXnJVfJdvHgAAAcE"]
[Thu Dec 18 07:38:14.987946 2025] [:error] [pid 23645:tid 23666] [client 84.239.43.178:52554] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/_/.git/config"] [unique_id "aUM-5jf_Rx0Y0ao_QJioDgAAAJM"]
[Thu Dec 18 07:38:17.329045 2025] [:error] [pid 25357:tid 25363] [client 84.239.43.178:47625] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/~/.git/config"] [unique_id "aUM-6YaT7bsEXnJVfJdvOwAAAcQ"], referer: https://www.reddit.com/
[Thu Dec 18 07:38:20.420134 2025] [:error] [pid 23558:tid 23615] [client 84.239.43.178:53917] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/@/.git/config"] [unique_id "aUM-7OHam9NbgPQa9uZQQQAAAMA"]
[Thu Dec 18 07:38:22.948839 2025] [:error] [pid 24958:tid 24969] [client 84.239.43.178:39808] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/-/.git/config"] [unique_id "aUM-7skDOrUkd0wNm2Es1QAAAYg"]
[Thu Dec 18 07:38:24.304282 2025] [:error] [pid 23556:tid 23572] [client 84.239.43.178:41919] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM-8BnmLlk3u5yt9kEjTwAAAAw"]
[Thu Dec 18 07:38:26.649494 2025] [:error] [pid 24542:tid 24555] [client 84.239.43.178:37698] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM-8ktQz4H2oS3NrDY0kAAAAUs"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:38:40.007255 2025] [:error] [pid 24958:tid 24974] [client 84.239.43.178:9199] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00"] [unique_id "aUM_AMkDOrUkd0wNm2Es4QAAAY0"]
[Thu Dec 18 07:38:42.346866 2025] [:error] [pid 23557:tid 23605] [client 84.239.43.178:63675] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00.json"] [unique_id "aUM_AhYcs6rFVxbdP_lPaAAAAFE"], referer: https://stackoverflow.com/
[Thu Dec 18 07:38:45.453127 2025] [:error] [pid 24542:tid 24554] [client 84.239.43.178:20212] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00.html"] [unique_id "aUM_BUtQz4H2oS3NrDY0nQAAAUo"]
[Thu Dec 18 07:38:50.820979 2025] [:error] [pid 23556:tid 23562] [client 84.239.43.178:2043] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00.txt"] [unique_id "aUM_ChnmLlk3u5yt9kEjVQAAAAI"], referer: https://stackoverflow.com/
[Thu Dec 18 07:38:58.241044 2025] [:error] [pid 23558:tid 23633] [client 84.239.43.178:33129] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00/"] [unique_id "aUM_EuHam9NbgPQa9uZQTQAAANI"]
[Thu Dec 18 07:39:01.709376 2025] [:error] [pid 25357:tid 25362] [client 84.239.43.178:17070] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/credentials"] [unique_id "aUM_FYaT7bsEXnJVfJdvZAAAAcM"]
[Thu Dec 18 07:39:05.598484 2025] [:error] [pid 25357:tid 25381] [client 84.239.43.178:27828] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/credentials"] [unique_id "aUM_GYaT7bsEXnJVfJdvaQAAAdY"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:39:07.959489 2025] [:error] [pid 24433:tid 24454] [client 84.239.43.178:46131] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials;"] [unique_id "aUM_G54pN9ycmipm8Tg-JwAAARI"], referer: https://chat.openai.com/
[Thu Dec 18 07:39:12.344337 2025] [:error] [pid 25357:tid 25378] [client 84.239.43.178:35098] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials;/"] [unique_id "aUM_IIaT7bsEXnJVfJdveQAAAdM"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:39:17.169506 2025] [:error] [pid 24542:tid 24560] [client 84.239.43.178:58816] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.;/.git/credentials"] [unique_id "aUM_JUtQz4H2oS3NrDY0pgAAAVA"]
[Thu Dec 18 07:39:21.760342 2025] [:error] [pid 23556:tid 23563] [client 84.239.43.178:41376] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/credentials"] [unique_id "aUM_KRnmLlk3u5yt9kEjaQAAAAM"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:39:24.652352 2025] [:error] [pid 23557:tid 23588] [client 84.239.43.178:40357] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials/."] [unique_id "aUM_LBYcs6rFVxbdP_lPeAAAAEA"], referer: https://www.google.com/
[Thu Dec 18 07:39:27.810736 2025] [:error] [pid 23557:tid 23600] [client 84.239.43.178:1118] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials/./"] [unique_id "aUM_LxYcs6rFVxbdP_lPegAAAEw"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:39:30.232111 2025] [:error] [pid 23557:tid 23599] [client 84.239.43.178:21663] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.git/credentials"] [unique_id "aUM_MhYcs6rFVxbdP_lPfAAAAEs"]
[Thu Dec 18 07:39:32.732423 2025] [:error] [pid 24433:tid 24442] [client 84.239.43.178:30672] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_NJ4pN9ycmipm8Tg-QwAAAQY"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:39:35.625136 2025] [:error] [pid 25357:tid 25366] [client 84.239.43.178:45733] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_N4aT7bsEXnJVfJdvgAAAAcc"]
[Thu Dec 18 07:39:38.199081 2025] [:error] [pid 23556:tid 23576] [client 84.239.43.178:8628] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git//credentials"] [unique_id "aUM_OhnmLlk3u5yt9kEjbQAAABA"]
[Thu Dec 18 07:39:43.397871 2025] [:error] [pid 25357:tid 25366] [client 84.239.43.178:61822] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GIT/CREDENTIALS"] [unique_id "aUM_P4aT7bsEXnJVfJdvlQAAAcc"], referer: https://stackoverflow.com/
[Thu Dec 18 07:39:46.869030 2025] [:error] [pid 23558:tid 23633] [client 84.239.43.178:10400] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.GiT/CrEdEnTiAlS"] [unique_id "aUM_QuHam9NbgPQa9uZQZQAAANI"]
[Thu Dec 18 07:39:49.285322 2025] [:error] [pid 23557:tid 23588] [client 84.239.43.178:61143] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.json"] [unique_id "aUM_RRYcs6rFVxbdP_lPgwAAAEA"], referer: https://www.google.com/search?q=aoswa.com.au
[Thu Dec 18 07:39:54.556262 2025] [:error] [pid 23557:tid 23590] [client 84.239.43.178:52088] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.html"] [unique_id "aUM_ShYcs6rFVxbdP_lPhgAAAEI"], referer: https://search.yahoo.com/search?p=aoswa.com.au
[Thu Dec 18 07:39:56.900094 2025] [:error] [pid 23645:tid 23658] [client 84.239.43.178:46347] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.php"] [unique_id "aUM_TDf_Rx0Y0ao_QJioTgAAAIs"]
[Thu Dec 18 07:39:59.252381 2025] [:error] [pid 25357:tid 25370] [client 84.239.43.178:60332] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.asp"] [unique_id "aUM_T4aT7bsEXnJVfJdvrQAAAcs"]
[Thu Dec 18 07:40:04.010597 2025] [:error] [pid 23556:tid 23582] [client 84.239.43.178:17577] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.aspx"] [unique_id "aUM_VBnmLlk3u5yt9kEjewAAABY"]
[Thu Dec 18 07:40:06.371895 2025] [:error] [pid 23558:tid 23615] [client 84.239.43.178:51819] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.jsp"] [unique_id "aUM_VuHam9NbgPQa9uZQagAAAMA"], referer: https://www.google.com/
[Thu Dec 18 07:40:11.682300 2025] [:error] [pid 24542:tid 24567] [client 84.239.43.178:64777] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.txt"] [unique_id "aUM_W0tQz4H2oS3NrDY0tAAAAVc"]
[Thu Dec 18 07:40:14.030273 2025] [:error] [pid 24542:tid 24544] [client 84.239.43.178:22365] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials.xml"] [unique_id "aUM_XktQz4H2oS3NrDY0tQAAAUA"], referer: https://chat.openai.com/
[Thu Dec 18 07:40:16.896277 2025] [:error] [pid 23556:tid 23573] [client 84.239.43.178:53243] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials::$DATA"] [unique_id "aUM_YBnmLlk3u5yt9kEjgAAAAA0"]
[Thu Dec 18 07:40:21.828790 2025] [:error] [pid 24958:tid 24975] [client 84.239.43.178:54055] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_ZckDOrUkd0wNm2EtOQAAAY4"]
[Thu Dec 18 07:40:24.178783 2025] [:error] [pid 24958:tid 24982] [client 84.239.43.178:25127] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_aMkDOrUkd0wNm2EtOgAAAZU"]
[Thu Dec 18 07:40:27.985396 2025] [:error] [pid 23645:tid 23661] [client 84.239.43.178:7067] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_azf_Rx0Y0ao_QJioWQAAAI4"], referer: https://chat.openai.com/
[Thu Dec 18 07:40:30.330032 2025] [:error] [pid 23558:tid 23630] [client 84.239.43.178:39441] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_buHam9NbgPQa9uZQcwAAAM8"]
[Thu Dec 18 07:40:33.019639 2025] [:error] [pid 23645:tid 23669] [client 84.239.43.178:58022] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_cDf_Rx0Y0ao_QJioXAAAAJY"]
[Thu Dec 18 07:40:36.488747 2025] [:error] [pid 24542:tid 24562] [client 84.239.43.178:3704] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_dEtQz4H2oS3NrDY0uwAAAVI"]
[Thu Dec 18 07:40:39.531081 2025] [:error] [pid 25357:tid 25369] [client 84.239.43.178:35015] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_d4aT7bsEXnJVfJdv_gAAAco"]
[Thu Dec 18 07:40:43.802155 2025] [:error] [pid 23556:tid 23572] [client 84.239.43.178:51691] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_exnmLlk3u5yt9kEjhgAAAAw"], referer: https://www.google.com/
[Thu Dec 18 07:40:46.262799 2025] [:error] [pid 25357:tid 25362] [client 84.239.43.178:60568] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_foaT7bsEXnJVfJdwBwAAAcM"]
[Thu Dec 18 07:41:03.039361 2025] [:error] [pid 23558:tid 23636] [client 84.239.43.178:13527] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_j-Ham9NbgPQa9uZQfAAAANU"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:41:05.396604 2025] [:error] [pid 24958:tid 24978] [client 84.239.43.178:1560] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_kckDOrUkd0wNm2EtZAAAAZE"]
[Thu Dec 18 07:41:10.738491 2025] [:error] [pid 24958:tid 24963] [client 84.239.43.178:9669] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_lskDOrUkd0wNm2EtaAAAAYI"]
[Thu Dec 18 07:41:13.109765 2025] [:error] [pid 23645:tid 23667] [client 84.239.43.178:53230] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_mTf_Rx0Y0ao_QJioZwAAAJQ"]
[Thu Dec 18 07:41:17.004176 2025] [:error] [pid 24433:tid 24444] [client 84.239.43.178:44826] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%20"] [unique_id "aUM_nJ4pN9ycmipm8Tg-lAAAAQg"], referer: https://www.facebook.com/
[Thu Dec 18 07:41:19.457772 2025] [:error] [pid 23557:tid 23590] [client 84.239.43.178:32332] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%09"] [unique_id "aUM_nxYcs6rFVxbdP_lPjwAAAEI"], referer: https://www.linkedin.com/
[Thu Dec 18 07:41:21.796730 2025] [:error] [pid 24958:tid 24977] [client 84.239.43.178:28937] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%0a"] [unique_id "aUM_ockDOrUkd0wNm2EtbwAAAZA"]
[Thu Dec 18 07:41:27.080529 2025] [:error] [pid 25357:tid 25380] [client 84.239.43.178:9640] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%0d"] [unique_id "aUM_p4aT7bsEXnJVfJdwWQAAAdU"]
[Thu Dec 18 07:41:29.442837 2025] [:error] [pid 24542:tid 24550] [client 84.239.43.178:47853] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%0d%0a"] [unique_id "aUM_qUtQz4H2oS3NrDY07wAAAUY"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:41:35.211269 2025] [:error] [pid 23556:tid 23578] [client 84.239.43.178:57561] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%20"] [unique_id "aUM_rxnmLlk3u5yt9kEjlgAAABI"]
[Thu Dec 18 07:41:37.550223 2025] [:error] [pid 23556:tid 23560] [client 84.239.43.178:29176] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials/"] [unique_id "aUM_sRnmLlk3u5yt9kEjmAAAAAA"], referer: https://www.google.com/
[Thu Dec 18 07:41:40.159530 2025] [:error] [pid 24542:tid 24561] [client 84.239.43.178:17101] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials//"] [unique_id "aUM_tEtQz4H2oS3NrDY09QAAAVE"]
[Thu Dec 18 07:41:44.103597 2025] [:error] [pid 25357:tid 25377] [client 84.239.43.178:60081] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials..;/"] [unique_id "aUM_uIaT7bsEXnJVfJdwYwAAAdI"]
[Thu Dec 18 07:41:48.461074 2025] [:error] [pid 23558:tid 23617] [client 84.239.43.178:10740] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials/..;/"] [unique_id "aUM_vOHam9NbgPQa9uZQhwAAAMI"], referer: https://stackoverflow.com/
[Thu Dec 18 07:41:53.743468 2025] [:error] [pid 25357:tid 25373] [client 84.239.43.178:5898] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/credentials/./"] [unique_id "aUM_wYaT7bsEXnJVfJdwbwAAAc4"]
[Thu Dec 18 07:41:56.081238 2025] [:error] [pid 23556:tid 23581] [client 84.239.43.178:25176] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/whatever/../.git/credentials"] [unique_id "aUM_xBnmLlk3u5yt9kEjnAAAABU"], referer: https://www.google.com/
[Thu Dec 18 07:42:00.055919 2025] [:error] [pid 23558:tid 23638] [client 84.239.43.178:36748] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/aaa/../.git/credentials"] [unique_id "aUM_yOHam9NbgPQa9uZQjQAAANc"]
[Thu Dec 18 07:42:04.415187 2025] [:error] [pid 23645:tid 23655] [client 84.239.43.178:28094] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.git/credentials"] [unique_id "aUM_zDf_Rx0Y0ao_QJiodwAAAIg"]
[Thu Dec 18 07:42:11.234558 2025] [:error] [pid 23556:tid 23577] [client 84.239.43.178:1354] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v1/.git/credentials"] [unique_id "aUM_0xnmLlk3u5yt9kEjowAAABE"], referer: https://twitter.com/
[Thu Dec 18 07:42:14.851824 2025] [:error] [pid 24433:tid 24440] [client 84.239.43.178:52155] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v2/.git/credentials"] [unique_id "aUM_1p4pN9ycmipm8Tg-ywAAAQQ"], referer: https://www.bing.com/search?q=aoswa.com.au
[Thu Dec 18 07:42:17.299928 2025] [:error] [pid 24958:tid 24970] [client 84.239.43.178:15136] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.git/credentials"] [unique_id "aUM_2ckDOrUkd0wNm2Et6wAAAYk"], referer: https://twitter.com/
[Thu Dec 18 07:42:19.648022 2025] [:error] [pid 24542:tid 24566] [client 84.239.43.178:30131] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/static/.git/credentials"] [unique_id "aUM_20tQz4H2oS3NrDY1EwAAAVY"], referer: https://github.com/
[Thu Dec 18 07:42:22.752825 2025] [:error] [pid 23645:tid 23648] [client 84.239.43.178:64695] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/assets/.git/credentials"] [unique_id "aUM_3jf_Rx0Y0ao_QJiofwAAAIE"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:42:25.809921 2025] [:error] [pid 25357:tid 25366] [client 84.239.43.178:24503] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/_/.git/credentials"] [unique_id "aUM_4YaT7bsEXnJVfJdwgwAAAcc"]
[Thu Dec 18 07:42:28.137153 2025] [:error] [pid 23556:tid 23560] [client 84.239.43.178:8954] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/~/.git/credentials"] [unique_id "aUM_5BnmLlk3u5yt9kEjqwAAAAA"]
[Thu Dec 18 07:42:33.184329 2025] [:error] [pid 23557:tid 23590] [client 84.239.43.178:37498] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/@/.git/credentials"] [unique_id "aUM_6RYcs6rFVxbdP_lPoQAAAEI"]
[Thu Dec 18 07:42:35.526207 2025] [:error] [pid 23557:tid 23591] [client 84.239.43.178:10916] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/-/.git/credentials"] [unique_id "aUM_6xYcs6rFVxbdP_lPpAAAAEM"]
[Thu Dec 18 07:42:37.863319 2025] [:error] [pid 23556:tid 23578] [client 84.239.43.178:47021] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUM_7RnmLlk3u5yt9kEjtQAAABI"], referer: https://twitter.com/
[Thu Dec 18 07:42:51.179618 2025] [:error] [pid 23557:tid 23612] [client 84.239.43.178:56018] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00"] [unique_id "aUM_-xYcs6rFVxbdP_lPqwAAAFg"], referer: https://chat.openai.com/
[Thu Dec 18 07:42:53.527693 2025] [:error] [pid 23558:tid 23635] [client 84.239.43.178:33865] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00.json"] [unique_id "aUM__eHam9NbgPQa9uZQngAAANQ"]
[Thu Dec 18 07:42:57.588834 2025] [:error] [pid 25357:tid 25368] [client 84.239.43.178:57162] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00.html"] [unique_id "aUNAAYaT7bsEXnJVfJdwoAAAAck"], referer: https://www.reddit.com/
[Thu Dec 18 07:42:59.921636 2025] [:error] [pid 23557:tid 23604] [client 84.239.43.178:63709] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00.txt"] [unique_id "aUNAAxYcs6rFVxbdP_lPrgAAAFA"]
[Thu Dec 18 07:43:03.068520 2025] [:error] [pid 23556:tid 23579] [client 84.239.43.178:64223] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials%00/"] [unique_id "aUNABxnmLlk3u5yt9kEjvQAAABM"], referer: https://www.linkedin.com/
[Thu Dec 18 07:43:07.150645 2025] [:error] [pid 25357:tid 25380] [client 84.239.43.178:51725] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/..;/.git/credentials"] [unique_id "aUNAC4aT7bsEXnJVfJdwqwAAAdU"], referer: https://duckduckgo.com/?q=aoswa.com.au
[Thu Dec 18 07:43:09.492004 2025] [:error] [pid 24542:tid 24562] [client 84.239.43.178:44660] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/;/.git/credentials"] [unique_id "aUNADUtQz4H2oS3NrDY1OQAAAVI"], referer: https://www.google.com/
[Thu Dec 18 07:43:11.927032 2025] [:error] [pid 24433:tid 24456] [client 84.239.43.178:64381] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials;"] [unique_id "aUNAD54pN9ycmipm8Tg-5AAAARQ"]
[Thu Dec 18 07:43:14.891750 2025] [:error] [pid 25357:tid 25376] [client 84.239.43.178:20488] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials;/"] [unique_id "aUNAEoaT7bsEXnJVfJdwvQAAAdE"], referer: https://twitter.com/
[Thu Dec 18 07:43:19.588202 2025] [:error] [pid 25357:tid 25371] [client 84.239.43.178:49251] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.;/.git/credentials"] [unique_id "aUNAF4aT7bsEXnJVfJdwyQAAAcw"], referer: https://github.com/
[Thu Dec 18 07:43:23.948425 2025] [:error] [pid 23558:tid 23628] [client 84.239.43.178:53665] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/./.git/credentials"] [unique_id "aUNAG-Ham9NbgPQa9uZQrgAAAM0"]
[Thu Dec 18 07:43:27.122098 2025] [:error] [pid 23557:tid 23595] [client 84.239.43.178:18575] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials/."] [unique_id "aUNAHxYcs6rFVxbdP_lPvQAAAEc"], referer: https://www.facebook.com/
[Thu Dec 18 07:43:31.008957 2025] [:error] [pid 23557:tid 23596] [client 84.239.43.178:57298] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials/./"] [unique_id "aUNAIhYcs6rFVxbdP_lPvwAAAEg"]
[Thu Dec 18 07:43:33.438179 2025] [:error] [pid 24542:tid 24547] [client 84.239.43.178:56860] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/../.git/credentials"] [unique_id "aUNAJUtQz4H2oS3NrDY1hwAAAUM"]
[Thu Dec 18 07:43:35.789867 2025] [:error] [pid 24958:tid 24962] [client 84.239.43.178:16082] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUNAJ8kDOrUkd0wNm2EuLgAAAYE"]
[Thu Dec 18 07:43:41.126958 2025] [:error] [pid 24433:tid 24440] [client 84.239.43.178:54583] [client 84.239.43.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/credentials"] [unique_id "aUNALZ4pN9ycmipm8Tg_DAAAAQQ"], referer: https://www.reddit.com/
[Thu Dec 18 11:42:37.697450 2025] [:error] [pid 24433:tid 24436] [client 57.128.243.0:42528] [client 57.128.243.0] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/robots.txt"] [unique_id "aUN4LZ4pN9ycmipm8ThtTgAAAQA"]
[Thu Dec 18 18:27:26.311419 2025] [:error] [pid 24433:tid 24447] [client 74.225.199.56:14266] [client 74.225.199.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUPXDp4pN9ycmipm8Ti50gAAAQs"]
[Thu Dec 18 18:27:26.664945 2025] [:error] [pid 24433:tid 24446] [client 74.225.199.56:14270] [client 74.225.199.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUPXDp4pN9ycmipm8Ti50wAAAQo"]
[Thu Dec 18 18:27:27.613201 2025] [:error] [pid 23558:tid 23639] [client 74.225.199.56:14252] [client 74.225.199.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUPXD-Ham9NbgPQa9ubyzQAAANg"]
[Thu Dec 18 18:27:28.460719 2025] [:error] [pid 24433:tid 24460] [client 74.225.199.56:14228] [client 74.225.199.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUPXEJ4pN9ycmipm8Ti52AAAARg"]
[Thu Dec 18 21:45:51.145757 2025] [:error] [pid 24433:tid 24446] [client 149.102.225.182:62424] [client 149.102.225.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.102.225.182, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUQFj54pN9ycmipm8TjhtwAAAQo"]
[Thu Dec 18 21:45:51.149407 2025] [:error] [pid 24433:tid 24446] [client 149.102.225.182:62424] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Dec 18 21:45:53.228923 2025] [:error] [pid 24433:tid 24454] [client 149.102.225.182:62424] [client 149.102.225.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aUQFkZ4pN9ycmipm8TjhwwAAARI"]
[Thu Dec 18 21:45:53.593029 2025] [:error] [pid 12383:tid 12408] [client 149.102.225.182:59334] [client 149.102.225.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aUQFkfdgllo9h1cyxGbNSwAAAtY"]
[Thu Dec 18 21:45:53.915768 2025] [:error] [pid 24958:tid 24977] [client 149.102.225.182:59348] [client 149.102.225.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aUQFkckDOrUkd0wNm2HUSQAAAZA"]
[Thu Dec 18 21:45:54.247619 2025] [:error] [pid 23645:tid 23657] [client 149.102.225.182:59350] [client 149.102.225.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aUQFkjf_Rx0Y0ao_QJhlmQAAAIo"]
[Thu Dec 18 21:45:54.573878 2025] [:error] [pid 25357:tid 25360] [client 149.102.225.182:59366] [client 149.102.225.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aUQFkoaT7bsEXnJVfJdzTwAAAcE"]
[Thu Dec 18 21:45:54.889240 2025] [:error] [pid 23556:tid 23576] [client 149.102.225.182:59382] [client 149.102.225.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aUQFkhnmLlk3u5yt9kHwrgAAABA"]
[Thu Dec 18 21:45:55.206518 2025] [:error] [pid 25357:tid 25361] [client 149.102.225.182:59394] [client 149.102.225.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aUQFk4aT7bsEXnJVfJdzUQAAAcI"]
[Thu Dec 18 23:18:17.581931 2025] [:error] [pid 24433:tid 24438] [client 74.225.154.77:18405] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Dec 18 23:18:17.734800 2025] [:error] [pid 24433:tid 24440] [client 74.225.154.77:18405] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Thu Dec 18 23:18:17.877159 2025] [:error] [pid 24433:tid 24437] [client 74.225.154.77:18405] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Thu Dec 18 23:18:18.017388 2025] [:error] [pid 24433:tid 24447] [client 74.225.154.77:18405] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Thu Dec 18 23:18:18.353728 2025] [:error] [pid 24433:tid 24439] [client 74.225.154.77:18405] File does not exist: /usr/local/apache/htdocs/suspended-page/ah22.php
[Thu Dec 18 23:18:18.524821 2025] [:error] [pid 24433:tid 24450] [client 74.225.154.77:18405] File does not exist: /usr/local/apache/htdocs/suspended-page/styll.php
[Thu Dec 18 23:18:18.759384 2025] [:error] [pid 24433:tid 24456] [client 74.225.154.77:18405] [client 74.225.154.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "aUQbOp4pN9ycmipm8TjuXwAAARQ"]
[Thu Dec 18 23:18:20.769840 2025] [:error] [pid 23558:tid 23626] [client 74.225.154.77:18326] File does not exist: /usr/local/apache/htdocs/suspended-page/wfile.php
[Thu Dec 18 23:18:20.906901 2025] [:error] [pid 23558:tid 23631] [client 74.225.154.77:18326] [client 74.225.154.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/zxl.php"] [unique_id "aUQbPOHam9NbgPQa9uZAtwAAANA"]
[Thu Dec 18 23:18:21.884698 2025] [:error] [pid 12239:tid 12258] [client 74.225.154.77:18306] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Dec 18 23:18:22.032298 2025] [:error] [pid 12239:tid 12261] [client 74.225.154.77:18306] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbPtNnXxfGIuWO6ak4wwAAApE"]
[Thu Dec 18 23:18:22.791873 2025] [:error] [pid 24958:tid 24979] [client 74.225.154.77:18384] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbPskDOrUkd0wNm2HftwAAAZI"]
[Thu Dec 18 23:18:23.327479 2025] [:error] [pid 12035:tid 12065] [client 74.225.154.77:18313] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbP7cVHrNSHjCo-0qpggAAAhY"]
[Thu Dec 18 23:18:24.044039 2025] [:error] [pid 12383:tid 12390] [client 74.225.154.77:18418] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbQPdgllo9h1cyxGbZggAAAsQ"]
[Thu Dec 18 23:18:25.072356 2025] [:error] [pid 12239:tid 12263] [client 74.225.154.77:18409] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu.php"] [unique_id "aUQbQdNnXxfGIuWO6ak4xAAAApM"]
[Thu Dec 18 23:18:25.846018 2025] [:error] [pid 23558:tid 23632] [client 74.225.154.77:18391] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu.php"] [unique_id "aUQbQeHam9NbgPQa9uZAuQAAANE"]
[Thu Dec 18 23:18:26.401062 2025] [:error] [pid 12035:tid 12042] [client 74.225.154.77:18408] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu.php"] [unique_id "aUQbQrcVHrNSHjCo-0qphAAAAgA"]
[Thu Dec 18 23:18:26.866434 2025] [:error] [pid 24958:tid 24964] [client 74.225.154.77:18401] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu.php"] [unique_id "aUQbQskDOrUkd0wNm2HfuwAAAYM"]
[Thu Dec 18 23:18:27.671747 2025] [:error] [pid 12239:tid 12248] [client 74.225.154.77:18311] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aUQbQ9NnXxfGIuWO6ak4xgAAAoQ"]
[Thu Dec 18 23:18:28.291603 2025] [:error] [pid 24542:tid 24552] [client 74.225.154.77:18417] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aUQbREtQz4H2oS3NrDY_SgAAAUg"]
[Thu Dec 18 23:18:28.872178 2025] [:error] [pid 12239:tid 12253] [client 74.225.154.77:18368] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aUQbRNNnXxfGIuWO6ak4xwAAAok"]
[Thu Dec 18 23:18:29.258088 2025] [:error] [pid 24958:tid 24965] [client 74.225.154.77:18389] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "aUQbRckDOrUkd0wNm2HfvAAAAYQ"]
[Thu Dec 18 23:18:29.852635 2025] [:error] [pid 24433:tid 24442] [client 74.225.154.77:18411] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npcs7k.php"] [unique_id "aUQbRZ4pN9ycmipm8TjuYwAAAQY"]
[Thu Dec 18 23:18:30.530078 2025] [:error] [pid 12239:tid 12249] [client 74.225.154.77:18323] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npcs7k.php"] [unique_id "aUQbRtNnXxfGIuWO6ak4zAAAAoU"]
[Thu Dec 18 23:18:31.057806 2025] [:error] [pid 23558:tid 23639] [client 74.225.154.77:18426] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npcs7k.php"] [unique_id "aUQbR-Ham9NbgPQa9uZAvgAAANg"]
[Thu Dec 18 23:18:31.819778 2025] [:error] [pid 23556:tid 23568] [client 74.225.154.77:18431] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npcs7k.php"] [unique_id "aUQbRxnmLlk3u5yt9kEAYgAAAAg"]
[Thu Dec 18 23:18:32.535880 2025] [:error] [pid 12383:tid 12389] [client 74.225.154.77:18305] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aUQbSPdgllo9h1cyxGbZgwAAAsM"]
[Thu Dec 18 23:18:33.450701 2025] [:error] [pid 25357:tid 25366] [client 74.225.154.77:18332] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aUQbSYaT7bsEXnJVfJeC5gAAAcc"]
[Thu Dec 18 23:18:34.010224 2025] [:error] [pid 12035:tid 12052] [client 74.225.154.77:18413] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aUQbSrcVHrNSHjCo-0qpiAAAAgo"]
[Thu Dec 18 23:18:34.853831 2025] [:error] [pid 12239:tid 12263] [client 74.225.154.77:18371] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aUQbStNnXxfGIuWO6ak40QAAApM"]
[Thu Dec 18 23:18:35.613801 2025] [:error] [pid 12035:tid 12047] [client 74.225.154.77:12237] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUQbS7cVHrNSHjCo-0qpiQAAAgU"]
[Thu Dec 18 23:18:36.424312 2025] [:error] [pid 12239:tid 12248] [client 74.225.154.77:12238] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUQbTNNnXxfGIuWO6ak40wAAAoQ"]
[Thu Dec 18 23:18:37.085175 2025] [:error] [pid 23645:tid 23671] [client 74.225.154.77:18421] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUQbTTf_Rx0Y0ao_QJh0kAAAAJg"]
[Thu Dec 18 23:18:37.572004 2025] [:error] [pid 12239:tid 12255] [client 74.225.154.77:18328] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cro.php"] [unique_id "aUQbTdNnXxfGIuWO6ak42AAAAos"]
[Thu Dec 18 23:18:38.183258 2025] [:error] [pid 23556:tid 23562] [client 74.225.154.77:18404] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/egu.php"] [unique_id "aUQbThnmLlk3u5yt9kEAaAAAAAI"]
[Thu Dec 18 23:18:39.095497 2025] [:error] [pid 24433:tid 24460] [client 74.225.154.77:18419] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/egu.php"] [unique_id "aUQbT54pN9ycmipm8TjuZQAAARg"]
[Thu Dec 18 23:18:39.630380 2025] [:error] [pid 24433:tid 24438] [client 74.225.154.77:18381] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/egu.php"] [unique_id "aUQbT54pN9ycmipm8TjuZgAAAQI"]
[Thu Dec 18 23:18:40.033248 2025] [:error] [pid 12035:tid 12056] [client 74.225.154.77:18400] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/egu.php"] [unique_id "aUQbULcVHrNSHjCo-0qpjAAAAg0"]
[Thu Dec 18 23:18:40.437389 2025] [:error] [pid 23558:tid 23633] [client 74.225.154.77:18312] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doo.php"] [unique_id "aUQbUOHam9NbgPQa9uZAwgAAANI"]
[Thu Dec 18 23:18:41.210277 2025] [:error] [pid 12383:tid 12392] [client 74.225.154.77:18331] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doo.php"] [unique_id "aUQbUfdgllo9h1cyxGbZhAAAAsY"]
[Thu Dec 18 23:18:41.784235 2025] [:error] [pid 12383:tid 12393] [client 74.225.154.77:18321] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doo.php"] [unique_id "aUQbUfdgllo9h1cyxGbZhgAAAsc"]
[Thu Dec 18 23:18:42.404401 2025] [:error] [pid 24433:tid 24437] [client 74.225.154.77:18410] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doo.php"] [unique_id "aUQbUp4pN9ycmipm8TjuaAAAAQE"]
[Thu Dec 18 23:18:43.184652 2025] [:error] [pid 12239:tid 12265] [client 74.225.154.77:18416] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbU9NnXxfGIuWO6ak44AAAApU"]
[Thu Dec 18 23:18:43.561429 2025] [:error] [pid 12035:tid 12045] [client 74.225.154.77:18423] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbU7cVHrNSHjCo-0qpjwAAAgM"]
[Thu Dec 18 23:18:44.726073 2025] [:error] [pid 24433:tid 24450] [client 74.225.154.77:18402] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbVJ4pN9ycmipm8TjuaQAAAQ4"]
[Thu Dec 18 23:18:45.451820 2025] [:error] [pid 23556:tid 23574] [client 74.225.154.77:18338] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbVRnmLlk3u5yt9kEAbQAAAA4"]
[Thu Dec 18 23:18:46.125005 2025] [:error] [pid 12383:tid 12386] [client 74.225.154.77:18366] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUQbVvdgllo9h1cyxGbZhwAAAsA"]
[Thu Dec 18 23:18:47.194137 2025] [:error] [pid 12383:tid 12398] [client 74.225.154.77:18304] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUQbV_dgllo9h1cyxGbZiQAAAsw"]
[Thu Dec 18 23:18:48.026771 2025] [:error] [pid 24542:tid 24559] [client 74.225.154.77:18364] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUQbWEtQz4H2oS3NrDY_UwAAAU8"]
[Thu Dec 18 23:18:48.567622 2025] [:error] [pid 12239:tid 12268] [client 74.225.154.77:18337] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aUQbWNNnXxfGIuWO6ak44wAAApg"]
[Thu Dec 18 23:18:49.266121 2025] [:error] [pid 12239:tid 12253] [client 74.225.154.77:18387] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUQbWdNnXxfGIuWO6ak45AAAAok"]
[Thu Dec 18 23:18:49.717000 2025] [:error] [pid 24433:tid 24454] [client 74.225.154.77:18319] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUQbWZ4pN9ycmipm8TjubAAAARI"]
[Thu Dec 18 23:18:50.435080 2025] [:error] [pid 23556:tid 23569] [client 74.225.154.77:18315] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUQbWhnmLlk3u5yt9kEAbwAAAAk"]
[Thu Dec 18 23:18:51.184648 2025] [:error] [pid 23558:tid 23634] [client 74.225.154.77:18305] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUQbW-Ham9NbgPQa9uZAxgAAANM"]
[Thu Dec 18 23:18:52.265285 2025] [:error] [pid 24433:tid 24441] [client 74.225.154.77:18329] [client 74.225.154.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUQbXJ4pN9ycmipm8TjubQAAAQU"]
[Thu Dec 18 23:18:53.101133 2025] [:error] [pid 25357:tid 25359] [client 74.225.154.77:12271] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aUQbXYaT7bsEXnJVfJeC7QAAAcA"]
[Thu Dec 18 23:18:53.970455 2025] [:error] [pid 23556:tid 23576] [client 74.225.154.77:18359] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aUQbXRnmLlk3u5yt9kEAcQAAABA"]
[Thu Dec 18 23:18:54.479403 2025] [:error] [pid 23558:tid 23630] [client 74.225.154.77:18374] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aUQbXuHam9NbgPQa9uZAyQAAAM8"]
[Thu Dec 18 23:18:55.262429 2025] [:error] [pid 23558:tid 23621] [client 74.225.154.77:18403] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aUQbX-Ham9NbgPQa9uZAygAAAMY"]
[Thu Dec 18 23:18:55.656274 2025] [:error] [pid 12239:tid 12267] [client 74.225.154.77:18369] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUQbX9NnXxfGIuWO6ak47QAAApc"]
[Thu Dec 18 23:18:56.381221 2025] [:error] [pid 12383:tid 12409] [client 74.225.154.77:18375] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUQbYPdgllo9h1cyxGbZjwAAAtc"]
[Thu Dec 18 23:18:56.862752 2025] [:error] [pid 23558:tid 23628] [client 74.225.154.77:18318] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUQbYOHam9NbgPQa9uZAzAAAAM0"]
[Thu Dec 18 23:18:57.277918 2025] [:error] [pid 12239:tid 12250] [client 74.225.154.77:18370] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aUQbYdNnXxfGIuWO6ak4-AAAAoY"]
[Thu Dec 18 23:18:57.759545 2025] [:error] [pid 12239:tid 12251] [client 74.225.154.77:18377] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUQbYdNnXxfGIuWO6ak4_QAAAoc"]
[Thu Dec 18 23:18:58.294914 2025] [:error] [pid 25357:tid 25378] [client 74.225.154.77:12257] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUQbYoaT7bsEXnJVfJeC8AAAAdM"]
[Thu Dec 18 23:18:58.881052 2025] [:error] [pid 12383:tid 12400] [client 74.225.154.77:18406] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUQbYvdgllo9h1cyxGbZkQAAAs4"]
[Thu Dec 18 23:18:59.339342 2025] [:error] [pid 12035:tid 12045] [client 74.225.154.77:18330] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aUQbY7cVHrNSHjCo-0qpmgAAAgM"]
[Thu Dec 18 23:18:59.879279 2025] [:error] [pid 23558:tid 23617] [client 74.225.154.77:18388] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUQbY-Ham9NbgPQa9uZAzwAAAMI"]
[Thu Dec 18 23:19:00.903397 2025] [:error] [pid 23556:tid 23567] [client 74.225.154.77:18342] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUQbZBnmLlk3u5yt9kEAdQAAAAc"]
[Thu Dec 18 23:19:01.591449 2025] [:error] [pid 12239:tid 12261] [client 74.225.154.77:18317] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUQbZdNnXxfGIuWO6ak5BQAAApE"]
[Thu Dec 18 23:19:02.760711 2025] [:error] [pid 12239:tid 12256] [client 74.225.154.77:12255] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUQbZtNnXxfGIuWO6ak5BgAAAow"]
[Thu Dec 18 23:19:03.478758 2025] [:error] [pid 24958:tid 24983] [client 74.225.154.77:18397] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aUQbZ8kDOrUkd0wNm2Hf7wAAAZY"]
[Thu Dec 18 23:19:04.057050 2025] [:error] [pid 23558:tid 23622] [client 74.225.154.77:12229] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aUQbaOHam9NbgPQa9uZA0QAAAMc"]
[Thu Dec 18 23:19:04.410421 2025] [:error] [pid 24542:tid 24552] [client 74.225.154.77:12233] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aUQbaEtQz4H2oS3NrDY_YgAAAUg"]
[Thu Dec 18 23:19:04.780952 2025] [:error] [pid 23645:tid 23666] [client 74.225.154.77:18333] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aUQbaDf_Rx0Y0ao_QJh0nAAAAJM"]
[Thu Dec 18 23:19:05.334941 2025] [:error] [pid 25357:tid 25360] [client 74.225.154.77:18316] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbaYaT7bsEXnJVfJeC8wAAAcE"]
[Thu Dec 18 23:19:05.790498 2025] [:error] [pid 24433:tid 24446] [client 74.225.154.77:18382] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbaZ4pN9ycmipm8TjugwAAAQo"]
[Thu Dec 18 23:19:06.293178 2025] [:error] [pid 23556:tid 23580] [client 74.225.154.77:18356] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbahnmLlk3u5yt9kEAeAAAABQ"]
[Thu Dec 18 23:19:06.777720 2025] [:error] [pid 12239:tid 12254] [client 74.225.154.77:18325] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUQbatNnXxfGIuWO6ak5CQAAAoo"]
[Thu Dec 18 23:19:07.743197 2025] [:error] [pid 23558:tid 23620] [client 74.225.154.77:18398] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUQba-Ham9NbgPQa9uZA0wAAAMU"]
[Thu Dec 18 23:19:08.260667 2025] [:error] [pid 23645:tid 23654] [client 74.225.154.77:12232] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUQbbDf_Rx0Y0ao_QJh0ngAAAIc"]
[Thu Dec 18 23:19:09.057136 2025] [:error] [pid 24433:tid 24450] [client 74.225.154.77:18365] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUQbbZ4pN9ycmipm8TjuhgAAAQ4"]
[Thu Dec 18 23:19:09.516012 2025] [:error] [pid 12239:tid 12249] [client 74.225.154.77:12250] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUQbbdNnXxfGIuWO6ak5DAAAAoU"]
[Thu Dec 18 23:19:09.924465 2025] [:error] [pid 25357:tid 25383] [client 74.225.154.77:18362] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aUQbbYaT7bsEXnJVfJeC9wAAAdg"]
[Thu Dec 18 23:19:10.303255 2025] [:error] [pid 12239:tid 12262] [client 74.225.154.77:18412] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aUQbbtNnXxfGIuWO6ak5DQAAApI"]
[Thu Dec 18 23:19:11.048982 2025] [:error] [pid 23558:tid 23632] [client 74.225.154.77:18425] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aUQbb-Ham9NbgPQa9uZA1QAAANE"]
[Thu Dec 18 23:19:12.120702 2025] [:error] [pid 12239:tid 12245] [client 74.225.154.77:18327] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "aUQbcNNnXxfGIuWO6ak5DgAAAoE"]
[Thu Dec 18 23:19:12.498117 2025] [:error] [pid 24542:tid 24566] [client 74.225.154.77:18424] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/chosen.php"] [unique_id "aUQbcEtQz4H2oS3NrDY_aQAAAVY"]
[Thu Dec 18 23:19:13.425637 2025] [:error] [pid 25357:tid 25380] [client 74.225.154.77:12272] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/chosen.php"] [unique_id "aUQbcYaT7bsEXnJVfJeC-gAAAdU"]
[Thu Dec 18 23:19:14.198431 2025] [:error] [pid 23645:tid 23661] [client 74.225.154.77:18415] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/chosen.php"] [unique_id "aUQbcjf_Rx0Y0ao_QJh0ogAAAI4"]
[Thu Dec 18 23:19:14.788273 2025] [:error] [pid 24433:tid 24445] [client 74.225.154.77:18385] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/chosen.php"] [unique_id "aUQbcp4pN9ycmipm8TjuiQAAAQk"]
[Thu Dec 18 23:19:15.374294 2025] [:error] [pid 24542:tid 24555] [client 74.225.154.77:18390] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aUQbc0tQz4H2oS3NrDY_awAAAUs"]
[Thu Dec 18 23:19:16.165424 2025] [:error] [pid 12383:tid 12397] [client 74.225.154.77:18379] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aUQbdPdgllo9h1cyxGbZmQAAAss"]
[Thu Dec 18 23:19:16.667169 2025] [:error] [pid 24542:tid 24558] [client 74.225.154.77:12276] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aUQbdEtQz4H2oS3NrDY_bQAAAU4"]
[Thu Dec 18 23:19:18.001354 2025] [:error] [pid 12383:tid 12399] [client 74.225.154.77:12273] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aUQbdvdgllo9h1cyxGbZmwAAAs0"]
[Thu Dec 18 23:19:18.483089 2025] [:error] [pid 24542:tid 24561] [client 74.225.154.77:12225] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aUQbdktQz4H2oS3NrDY_bwAAAVE"]
[Thu Dec 18 23:19:19.584767 2025] [:error] [pid 12239:tid 12251] [client 74.225.154.77:18322] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aUQbd9NnXxfGIuWO6ak5FQAAAoc"]
[Thu Dec 18 23:19:20.501806 2025] [:error] [pid 12239:tid 12265] [client 74.225.154.77:12243] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aUQbeNNnXxfGIuWO6ak5GAAAApU"]
[Thu Dec 18 23:19:21.346978 2025] [:error] [pid 12035:tid 12058] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/manage.php
[Thu Dec 18 23:19:21.489662 2025] [:error] [pid 12035:tid 12051] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Dec 18 23:19:21.633766 2025] [:error] [pid 12035:tid 12046] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Thu Dec 18 23:19:21.783310 2025] [:error] [pid 12035:tid 12066] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Thu Dec 18 23:19:21.932723 2025] [:error] [pid 12035:tid 12060] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Dec 18 23:19:22.257718 2025] [:error] [pid 12035:tid 12052] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Thu Dec 18 23:19:22.397523 2025] [:error] [pid 12035:tid 12049] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Dec 18 23:19:22.596056 2025] [:error] [pid 12035:tid 12059] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Dec 18 23:19:22.886755 2025] [:error] [pid 12035:tid 12047] [client 74.225.154.77:18367] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Thu Dec 18 23:19:23.024524 2025] [:error] [pid 12035:tid 12055] [client 74.225.154.77:18367] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aUQbe7cVHrNSHjCo-0qpqQAAAgw"]
[Thu Dec 18 23:19:23.649189 2025] [:error] [pid 12383:tid 12395] [client 74.225.154.77:12244] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aUQbe_dgllo9h1cyxGbZnAAAAsk"]
[Thu Dec 18 23:19:24.250678 2025] [:error] [pid 12383:tid 12388] [client 74.225.154.77:12258] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aUQbfPdgllo9h1cyxGbZnQAAAsI"]
[Thu Dec 18 23:19:25.021184 2025] [:error] [pid 24542:tid 24565] [client 74.225.154.77:12283] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/packed.php"] [unique_id "aUQbfUtQz4H2oS3NrDY_cwAAAVU"]
[Thu Dec 18 23:19:26.102094 2025] [:error] [pid 24542:tid 24549] [client 74.225.154.77:18380] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUQbfktQz4H2oS3NrDY_dAAAAUU"]
[Thu Dec 18 23:19:26.692881 2025] [:error] [pid 12035:tid 12057] [client 74.225.154.77:12174] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUQbfrcVHrNSHjCo-0qpqwAAAg4"]
[Thu Dec 18 23:19:27.162441 2025] [:error] [pid 24433:tid 24436] [client 74.225.154.77:18428] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUQbf54pN9ycmipm8TjujwAAAQA"]
[Thu Dec 18 23:19:27.562454 2025] [:error] [pid 25357:tid 25371] [client 74.225.154.77:12256] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aUQbf4aT7bsEXnJVfJeDAQAAAcw"]
[Thu Dec 18 23:19:27.968315 2025] [:error] [pid 23556:tid 23569] [client 74.225.154.77:12247] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aUQbfxnmLlk3u5yt9kEAhQAAAAk"]
[Thu Dec 18 23:19:28.382850 2025] [:error] [pid 12239:tid 12251] [client 74.225.154.77:18344] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aUQbgNNnXxfGIuWO6ak5HgAAAoc"]
[Thu Dec 18 23:19:28.956595 2025] [:error] [pid 23556:tid 23576] [client 74.225.154.77:18372] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aUQbgBnmLlk3u5yt9kEAiQAAABA"]
[Thu Dec 18 23:19:29.530735 2025] [:error] [pid 24542:tid 24568] [client 74.225.154.77:12261] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aUQbgUtQz4H2oS3NrDY_ewAAAVg"]
[Thu Dec 18 23:19:30.275599 2025] [:error] [pid 25357:tid 25363] [client 74.225.154.77:12253] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUQbgoaT7bsEXnJVfJeDBQAAAcQ"]
[Thu Dec 18 23:19:31.438236 2025] [:error] [pid 23558:tid 23625] [client 74.225.154.77:18414] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUQbg-Ham9NbgPQa9uZBAwAAAMo"]
[Thu Dec 18 23:19:32.126174 2025] [:error] [pid 23556:tid 23580] [client 74.225.154.77:12248] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUQbhBnmLlk3u5yt9kEAmQAAABQ"]
[Thu Dec 18 23:19:32.764868 2025] [:error] [pid 23645:tid 23667] [client 74.225.154.77:18345] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUQbhDf_Rx0Y0ao_QJh0sAAAAJQ"]
[Thu Dec 18 23:19:33.255124 2025] [:error] [pid 12035:tid 12046] [client 74.225.154.77:18343] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aUQbhbcVHrNSHjCo-0qpswAAAgQ"]
[Thu Dec 18 23:19:33.650706 2025] [:error] [pid 12383:tid 12395] [client 74.225.154.77:12176] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aUQbhfdgllo9h1cyxGbZsgAAAsk"]
[Thu Dec 18 23:19:34.075280 2025] [:error] [pid 23558:tid 23637] [client 74.225.154.77:18427] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aUQbhuHam9NbgPQa9uZBDwAAANY"]
[Thu Dec 18 23:19:34.481112 2025] [:error] [pid 12239:tid 12246] [client 74.225.154.77:12199] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aUQbhtNnXxfGIuWO6ak5IQAAAoI"]
[Thu Dec 18 23:19:34.798434 2025] [:error] [pid 24542:tid 24565] [client 74.225.154.77:18309] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUQbhktQz4H2oS3NrDY_gQAAAVU"]
[Thu Dec 18 23:19:35.455828 2025] [:error] [pid 12239:tid 12258] [client 74.225.154.77:18394] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUQbh9NnXxfGIuWO6ak5JAAAAo4"]
[Thu Dec 18 23:19:35.904386 2025] [:error] [pid 25357:tid 25360] [client 74.225.154.77:18346] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUQbh4aT7bsEXnJVfJeDEAAAAcE"]
[Thu Dec 18 23:19:36.333745 2025] [:error] [pid 12239:tid 12248] [client 74.225.154.77:12224] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUQbiNNnXxfGIuWO6ak5KAAAAoQ"]
[Thu Dec 18 23:19:36.837989 2025] [:error] [pid 23645:tid 23671] [client 74.225.154.77:12172] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUQbiDf_Rx0Y0ao_QJh0swAAAJg"]
[Thu Dec 18 23:19:37.761841 2025] [:error] [pid 24958:tid 24974] [client 74.225.154.77:12265] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUQbickDOrUkd0wNm2HgPAAAAY0"]
[Thu Dec 18 23:19:38.224349 2025] [:error] [pid 23558:tid 23617] [client 74.225.154.77:18340] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUQbiuHam9NbgPQa9uZBEgAAAMI"]
[Thu Dec 18 23:19:38.874342 2025] [:error] [pid 23556:tid 23581] [client 74.225.154.77:12236] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aUQbihnmLlk3u5yt9kEAnwAAABU"]
[Thu Dec 18 23:19:39.273964 2025] [:error] [pid 12239:tid 12244] [client 74.225.154.77:12263] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aUQbi9NnXxfGIuWO6ak5KwAAAoA"]
[Thu Dec 18 23:19:39.736765 2025] [:error] [pid 25357:tid 25382] [client 74.225.154.77:12267] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aUQbi4aT7bsEXnJVfJeDEQAAAdc"]
[Thu Dec 18 23:19:40.286731 2025] [:error] [pid 24958:tid 24971] [client 74.225.154.77:18383] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aUQbjMkDOrUkd0wNm2HgQgAAAYo"]
[Thu Dec 18 23:19:40.772110 2025] [:error] [pid 12035:tid 12048] [client 74.225.154.77:18347] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aUQbjLcVHrNSHjCo-0qptwAAAgY"]
[Thu Dec 18 23:19:41.357643 2025] [:error] [pid 23558:tid 23619] [client 74.225.154.77:18339] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUQbjeHam9NbgPQa9uZBGgAAAMQ"]
[Thu Dec 18 23:19:41.736800 2025] [:error] [pid 24958:tid 24978] [client 74.225.154.77:12268] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUQbjckDOrUkd0wNm2HgQwAAAZE"]
[Thu Dec 18 23:19:42.410244 2025] [:error] [pid 24958:tid 24964] [client 74.225.154.77:18324] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUQbjskDOrUkd0wNm2HgRAAAAYM"]
[Thu Dec 18 23:19:42.730099 2025] [:error] [pid 23558:tid 23621] [client 74.225.154.77:12096] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUQbjuHam9NbgPQa9uZBHAAAAMY"]
[Thu Dec 18 23:19:43.855433 2025] [:error] [pid 12239:tid 12264] [client 74.225.154.77:18354] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aUQbj9NnXxfGIuWO6ak5OAAAApQ"]
[Thu Dec 18 23:19:44.423256 2025] [:error] [pid 12383:tid 12405] [client 74.225.154.77:18430] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aUQbkPdgllo9h1cyxGbZvAAAAtM"]
[Thu Dec 18 23:19:44.914289 2025] [:error] [pid 24542:tid 24561] [client 74.225.154.77:18320] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aUQbkEtQz4H2oS3NrDY_hwAAAVE"]
[Thu Dec 18 23:19:45.464512 2025] [:error] [pid 12239:tid 12260] [client 74.225.154.77:18360] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aUQbkdNnXxfGIuWO6ak5OgAAApA"]
[Thu Dec 18 23:19:46.202258 2025] [:error] [pid 12383:tid 12399] [client 74.225.154.77:18396] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUQbkvdgllo9h1cyxGbZvgAAAs0"]
[Thu Dec 18 23:19:46.622403 2025] [:error] [pid 25357:tid 25379] [client 74.225.154.77:12239] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUQbkoaT7bsEXnJVfJeDJwAAAdQ"]
[Thu Dec 18 23:19:47.222312 2025] [:error] [pid 23558:tid 23629] [client 74.225.154.77:12185] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUQbk-Ham9NbgPQa9uZBJgAAAM4"]
[Thu Dec 18 23:19:47.874387 2025] [:error] [pid 25357:tid 25376] [client 74.225.154.77:12230] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aUQbk4aT7bsEXnJVfJeDKAAAAdE"]
[Thu Dec 18 23:19:48.361209 2025] [:error] [pid 23645:tid 23650] [client 74.225.154.77:12209] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aUQblDf_Rx0Y0ao_QJh0ugAAAIM"]
[Thu Dec 18 23:19:48.828875 2025] [:error] [pid 24958:tid 24977] [client 74.225.154.77:18335] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aUQblMkDOrUkd0wNm2HgSAAAAZA"]
[Thu Dec 18 23:19:49.360808 2025] [:error] [pid 24958:tid 24974] [client 74.225.154.77:12245] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aUQblckDOrUkd0wNm2HgSgAAAY0"]
[Thu Dec 18 23:19:49.707215 2025] [:error] [pid 23645:tid 23663] [client 74.225.154.77:18310] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "aUQblTf_Rx0Y0ao_QJh0uwAAAJA"]
[Thu Dec 18 23:19:50.067208 2025] [:error] [pid 12239:tid 12256] [client 74.225.154.77:12264] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUQbltNnXxfGIuWO6ak5PwAAAow"]
[Thu Dec 18 23:19:50.450029 2025] [:error] [pid 12239:tid 12268] [client 74.225.154.77:12274] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUQbltNnXxfGIuWO6ak5QAAAApg"]
[Thu Dec 18 23:19:51.197805 2025] [:error] [pid 12239:tid 12260] [client 74.225.154.77:12277] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUQbl9NnXxfGIuWO6ak5QwAAApA"]
[Thu Dec 18 23:19:51.627122 2025] [:error] [pid 12239:tid 12257] [client 74.225.154.77:18361] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aUQbl9NnXxfGIuWO6ak5RAAAAo0"]
[Thu Dec 18 23:19:52.109335 2025] [:error] [pid 24542:tid 24552] [client 74.225.154.77:18336] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUQbmEtQz4H2oS3NrDY_iQAAAUg"]
[Thu Dec 18 23:19:52.890002 2025] [:error] [pid 24542:tid 24559] [client 74.225.154.77:12260] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUQbmEtQz4H2oS3NrDY_igAAAU8"]
[Thu Dec 18 23:19:53.227171 2025] [:error] [pid 24542:tid 24556] [client 74.225.154.77:18399] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUQbmUtQz4H2oS3NrDY_iwAAAUw"]
[Thu Dec 18 23:19:53.683234 2025] [:error] [pid 23558:tid 23626] [client 74.225.154.77:18429] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUQbmeHam9NbgPQa9uZBKwAAAMs"]
[Thu Dec 18 23:19:54.050674 2025] [:error] [pid 23558:tid 23636] [client 74.225.154.77:18355] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUQbmuHam9NbgPQa9uZBLAAAANU"]
[Thu Dec 18 23:19:54.681503 2025] [:error] [pid 23556:tid 23560] [client 74.225.154.77:18334] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUQbmhnmLlk3u5yt9kEAqQAAAAA"]
[Thu Dec 18 23:19:55.016333 2025] [:error] [pid 25357:tid 25377] [client 74.225.154.77:12270] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUQbm4aT7bsEXnJVfJeDLQAAAdI"]
[Thu Dec 18 23:19:55.380324 2025] [:error] [pid 12035:tid 12067] [client 74.225.154.77:12212] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUQbm7cVHrNSHjCo-0qpvAAAAhg"]
[Thu Dec 18 23:19:55.784844 2025] [:error] [pid 12035:tid 12064] [client 74.225.154.77:18308] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUQbm7cVHrNSHjCo-0qpvQAAAhU"]
[Thu Dec 18 23:19:56.184215 2025] [:error] [pid 24542:tid 24547] [client 74.225.154.77:12227] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUQbnEtQz4H2oS3NrDY_jwAAAUM"]
[Thu Dec 18 23:19:56.509851 2025] [:error] [pid 24433:tid 24458] [client 74.225.154.77:18341] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUQbnJ4pN9ycmipm8TjupAAAARY"]
[Thu Dec 18 23:19:56.902008 2025] [:error] [pid 12239:tid 12258] [client 74.225.154.77:12251] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUQbnNNnXxfGIuWO6ak5RwAAAo4"]
[Thu Dec 18 23:19:57.530489 2025] [:error] [pid 12383:tid 12392] [client 74.225.154.77:12252] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/"] [unique_id "aUQbnfdgllo9h1cyxGbZwwAAAsY"]
[Thu Dec 18 23:19:58.016037 2025] [:error] [pid 24542:tid 24567] [client 74.225.154.77:12142] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/"] [unique_id "aUQbnktQz4H2oS3NrDY_kQAAAVc"]
[Thu Dec 18 23:19:58.465009 2025] [:error] [pid 12383:tid 12398] [client 74.225.154.77:18422] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/"] [unique_id "aUQbnvdgllo9h1cyxGbZyAAAAsw"]
[Thu Dec 18 23:19:58.934437 2025] [:error] [pid 12383:tid 12407] [client 74.225.154.77:12175] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/"] [unique_id "aUQbnvdgllo9h1cyxGbZyQAAAtU"]
[Thu Dec 18 23:19:59.338446 2025] [:error] [pid 24433:tid 24442] [client 74.225.154.77:12259] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aUQbn54pN9ycmipm8TjupgAAAQY"]
[Thu Dec 18 23:20:00.387597 2025] [:error] [pid 24958:tid 24966] [client 74.225.154.77:12200] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aUQboMkDOrUkd0wNm2HgTwAAAYU"]
[Thu Dec 18 23:20:00.874391 2025] [:error] [pid 24542:tid 24548] [client 74.225.154.77:18376] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aUQboEtQz4H2oS3NrDY_kgAAAUQ"]
[Thu Dec 18 23:20:01.215464 2025] [:error] [pid 24542:tid 24554] [client 74.225.154.77:12228] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aUQboUtQz4H2oS3NrDY_kwAAAUo"]
[Thu Dec 18 23:20:01.584841 2025] [:error] [pid 23645:tid 23647] [client 74.225.154.77:12216] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUQboTf_Rx0Y0ao_QJh0xAAAAIA"]
[Thu Dec 18 23:20:02.022251 2025] [:error] [pid 23645:tid 23661] [client 74.225.154.77:12168] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUQbojf_Rx0Y0ao_QJh0xgAAAI4"]
[Thu Dec 18 23:20:02.649768 2025] [:error] [pid 25357:tid 25359] [client 74.225.154.77:12187] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUQbooaT7bsEXnJVfJeDLwAAAcA"]
[Thu Dec 18 23:20:03.157138 2025] [:error] [pid 24958:tid 24984] [client 74.225.154.77:12196] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aUQbo8kDOrUkd0wNm2HgUAAAAZc"]
[Thu Dec 18 23:20:04.084095 2025] [:error] [pid 12239:tid 12260] [client 74.225.154.77:12266] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aUQbpNNnXxfGIuWO6ak5TAAAApA"]
[Thu Dec 18 23:20:04.675593 2025] [:error] [pid 12035:tid 12047] [client 74.225.154.77:12240] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aUQbpLcVHrNSHjCo-0qpxAAAAgU"]
[Thu Dec 18 23:20:05.191848 2025] [:error] [pid 24542:tid 24552] [client 74.225.154.77:12184] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aUQbpUtQz4H2oS3NrDY_mQAAAUg"]
[Thu Dec 18 23:20:05.560538 2025] [:error] [pid 12035:tid 12042] [client 74.225.154.77:12190] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/m.php"] [unique_id "aUQbpbcVHrNSHjCo-0qpxgAAAgA"]
[Thu Dec 18 23:20:06.078799 2025] [:error] [pid 25357:tid 25381] [client 74.225.154.77:18353] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUQbpoaT7bsEXnJVfJeDNAAAAdY"]
[Thu Dec 18 23:20:06.625176 2025] [:error] [pid 24958:tid 24983] [client 74.225.154.77:18386] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUQbpskDOrUkd0wNm2HgUwAAAZY"]
[Thu Dec 18 23:20:07.321035 2025] [:error] [pid 24433:tid 24437] [client 74.225.154.77:18348] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUQbp54pN9ycmipm8TjurAAAAQE"]
[Thu Dec 18 23:20:07.882457 2025] [:error] [pid 24542:tid 24565] [client 74.225.154.77:12197] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUQbp0tQz4H2oS3NrDY_nwAAAVU"]
[Thu Dec 18 23:20:08.480960 2025] [:error] [pid 12035:tid 12044] [client 74.225.154.77:18325] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUQbqLcVHrNSHjCo-0qpywAAAgI"]
[Thu Dec 18 23:20:08.903468 2025] [:error] [pid 12035:tid 12067] [client 74.225.154.77:12165] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUQbqLcVHrNSHjCo-0qpzAAAAhg"]
[Thu Dec 18 23:20:09.405464 2025] [:error] [pid 12035:tid 12064] [client 74.225.154.77:18373] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUQbqbcVHrNSHjCo-0qpzQAAAhU"]
[Thu Dec 18 23:20:10.193348 2025] [:error] [pid 23558:tid 23636] [client 74.225.154.77:18352] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aUQbquHam9NbgPQa9uZBQAAAANU"]
[Thu Dec 18 23:20:10.661796 2025] [:error] [pid 12239:tid 12262] [client 74.225.154.77:12279] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/json.php"] [unique_id "aUQbqtNnXxfGIuWO6ak5UwAAApI"]
[Thu Dec 18 23:20:11.130339 2025] [:error] [pid 24542:tid 24567] [client 74.225.154.77:12261] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/json.php"] [unique_id "aUQbq0tQz4H2oS3NrDY_sAAAAVc"]
[Thu Dec 18 23:20:11.510013 2025] [:error] [pid 12035:tid 12049] [client 74.225.154.77:12249] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/json.php"] [unique_id "aUQbq7cVHrNSHjCo-0qp1wAAAgc"]
[Thu Dec 18 23:20:11.909260 2025] [:error] [pid 24542:tid 24544] [client 74.225.154.77:12135] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/json.php"] [unique_id "aUQbq0tQz4H2oS3NrDY_sgAAAUA"]
[Thu Dec 18 23:20:12.421060 2025] [:error] [pid 23558:tid 23617] [client 74.225.154.77:12254] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUQbrOHam9NbgPQa9uZBUgAAAMI"]
[Thu Dec 18 23:20:12.918953 2025] [:error] [pid 24958:tid 24979] [client 74.225.154.77:12100] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUQbrMkDOrUkd0wNm2HgVwAAAZI"]
[Thu Dec 18 23:20:13.450339 2025] [:error] [pid 23556:tid 23574] [client 74.225.154.77:18350] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUQbrRnmLlk3u5yt9kEAsgAAAA4"]
[Thu Dec 18 23:20:13.956700 2025] [:error] [pid 23556:tid 23575] [client 74.225.154.77:12164] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUQbrRnmLlk3u5yt9kEAswAAAA8"]
[Thu Dec 18 23:20:14.302092 2025] [:error] [pid 24542:tid 24551] [client 74.225.154.77:18395] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQbrktQz4H2oS3NrDY_tQAAAUc"]
[Thu Dec 18 23:20:14.645657 2025] [:error] [pid 12239:tid 12244] [client 74.225.154.77:12117] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQbrtNnXxfGIuWO6ak5YgAAAoA"]
[Thu Dec 18 23:20:15.038066 2025] [:error] [pid 24958:tid 24976] [client 74.225.154.77:12162] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQbr8kDOrUkd0wNm2HgXwAAAY8"]
[Thu Dec 18 23:20:15.612927 2025] [:error] [pid 23558:tid 23628] [client 74.225.154.77:12275] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQbr-Ham9NbgPQa9uZBVAAAAM0"]
[Thu Dec 18 23:20:15.978999 2025] [:error] [pid 12035:tid 12054] [client 74.225.154.77:12235] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbr7cVHrNSHjCo-0qp3QAAAgs"]
[Thu Dec 18 23:20:16.599987 2025] [:error] [pid 24542:tid 24563] [client 74.225.154.77:12166] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbsEtQz4H2oS3NrDY_vAAAAVM"]
[Thu Dec 18 23:20:17.284043 2025] [:error] [pid 12239:tid 12248] [client 74.225.154.77:12220] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbsdNnXxfGIuWO6ak5cwAAAoQ"]
[Thu Dec 18 23:20:17.649509 2025] [:error] [pid 23556:tid 23564] [client 74.225.154.77:12123] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUQbsRnmLlk3u5yt9kEAvAAAAAQ"]
[Thu Dec 18 23:20:18.081816 2025] [:error] [pid 23558:tid 23623] [client 74.225.154.77:12132] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aUQbsuHam9NbgPQa9uZBVQAAAMg"]
[Thu Dec 18 23:20:18.478929 2025] [:error] [pid 23556:tid 23566] [client 74.225.154.77:12130] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aUQbshnmLlk3u5yt9kEAvwAAAAY"]
[Thu Dec 18 23:20:18.831825 2025] [:error] [pid 23556:tid 23578] [client 74.225.154.77:12195] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aUQbshnmLlk3u5yt9kEAwAAAABI"]
[Thu Dec 18 23:20:19.265357 2025] [:error] [pid 23556:tid 23573] [client 74.225.154.77:18314] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loads.PhP"] [unique_id "aUQbsxnmLlk3u5yt9kEAwQAAAA0"]
[Thu Dec 18 23:20:19.766157 2025] [:error] [pid 23645:tid 23648] [client 74.225.154.77:12179] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/"] [unique_id "aUQbszf_Rx0Y0ao_QJh04QAAAIE"]
[Thu Dec 18 23:20:20.086969 2025] [:error] [pid 24542:tid 24551] [client 74.225.154.77:12186] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/"] [unique_id "aUQbtEtQz4H2oS3NrDY_xQAAAUc"]
[Thu Dec 18 23:20:20.394301 2025] [:error] [pid 24542:tid 24564] [client 74.225.154.77:12246] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/"] [unique_id "aUQbtEtQz4H2oS3NrDY_xgAAAVQ"]
[Thu Dec 18 23:20:20.733991 2025] [:error] [pid 23645:tid 23649] [client 74.225.154.77:18307] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/"] [unique_id "aUQbtDf_Rx0Y0ao_QJh04wAAAII"]
[Thu Dec 18 23:20:21.068395 2025] [:error] [pid 24958:tid 24968] [client 74.225.154.77:12204] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/update.php"] [unique_id "aUQbtckDOrUkd0wNm2HgdAAAAYc"]
[Thu Dec 18 23:20:21.505701 2025] [:error] [pid 12239:tid 12258] [client 74.225.154.77:12211] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/update.php"] [unique_id "aUQbtdNnXxfGIuWO6ak5iwAAAo4"]
[Thu Dec 18 23:20:23.026292 2025] [:error] [pid 12383:tid 12399] [client 74.225.154.77:12201] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Dec 18 23:20:23.168528 2025] [:error] [pid 12383:tid 12389] [client 74.225.154.77:12201] File does not exist: /usr/local/apache/htdocs/suspended-page/file1.php
[Thu Dec 18 23:20:23.344485 2025] [:error] [pid 12383:tid 12392] [client 74.225.154.77:12201] File does not exist: /usr/local/apache/htdocs/suspended-page/2r.php
[Thu Dec 18 23:20:23.484214 2025] [:error] [pid 12383:tid 12409] [client 74.225.154.77:12201] [client 74.225.154.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.154.77, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUQbt_dgllo9h1cyxGbZ-wAAAtc"]
[Thu Dec 18 23:20:23.635036 2025] [:error] [pid 12383:tid 12404] [client 74.225.154.77:12201] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Thu Dec 18 23:20:23.883045 2025] [:error] [pid 12383:tid 12386] [client 74.225.154.77:12201] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Dec 18 23:20:24.061241 2025] [:error] [pid 12383:tid 12406] [client 74.225.154.77:12201] [client 74.225.154.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUQbuPdgllo9h1cyxGbaAAAAAtQ"]
[Thu Dec 18 23:20:24.553758 2025] [:error] [pid 23645:tid 23655] [client 74.225.154.77:12215] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Thu Dec 18 23:20:24.855500 2025] [:error] [pid 23645:tid 23663] [client 74.225.154.77:12215] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Thu Dec 18 23:20:25.035428 2025] [:error] [pid 23645:tid 23650] [client 74.225.154.77:12215] [client 74.225.154.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.154.77, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUQbuTf_Rx0Y0ao_QJh05wAAAIM"]
[Thu Dec 18 23:20:25.039151 2025] [:error] [pid 23645:tid 23650] [client 74.225.154.77:12215] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Dec 18 23:20:25.215458 2025] [:error] [pid 23645:tid 23656] [client 74.225.154.77:12215] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Dec 18 23:20:25.352491 2025] [:error] [pid 23645:tid 23667] [client 74.225.154.77:12215] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aUQbuTf_Rx0Y0ao_QJh06QAAAJQ"]
[Thu Dec 18 23:20:25.771976 2025] [:error] [pid 23556:tid 23561] [client 74.225.154.77:12210] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aUQbuRnmLlk3u5yt9kEAxAAAAAE"]
[Thu Dec 18 23:20:26.170890 2025] [:error] [pid 12239:tid 12259] [client 74.225.154.77:12189] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aUQbutNnXxfGIuWO6ak5mAAAAo8"]
[Thu Dec 18 23:20:26.571327 2025] [:error] [pid 23556:tid 23567] [client 74.225.154.77:12285] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aUQbuhnmLlk3u5yt9kEAxQAAAAc"]
[Thu Dec 18 23:20:27.270862 2025] [:error] [pid 24958:tid 24971] [client 74.225.154.77:18392] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQbu8kDOrUkd0wNm2HgfgAAAYo"]
[Thu Dec 18 23:20:27.793744 2025] [:error] [pid 23556:tid 23575] [client 74.225.154.77:12214] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQbuxnmLlk3u5yt9kEAxwAAAA8"]
[Thu Dec 18 23:20:28.263999 2025] [:error] [pid 23558:tid 23637] [client 74.225.154.77:12169] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQbvOHam9NbgPQa9uZBXgAAANY"]
[Thu Dec 18 23:20:28.656968 2025] [:error] [pid 24542:tid 24553] [client 74.225.154.77:18349] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQbvEtQz4H2oS3NrDY_ywAAAUk"]
[Thu Dec 18 23:20:29.413605 2025] [:error] [pid 25357:tid 25368] [client 74.225.154.77:12234] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUQbvYaT7bsEXnJVfJeDRgAAAck"]
[Thu Dec 18 23:20:29.968631 2025] [:error] [pid 12239:tid 12248] [client 74.225.154.77:12188] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUQbvdNnXxfGIuWO6ak5mwAAAoQ"]
[Thu Dec 18 23:20:30.401263 2025] [:error] [pid 12239:tid 12245] [client 74.225.154.77:12193] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUQbvtNnXxfGIuWO6ak5nwAAAoE"]
[Thu Dec 18 23:20:31.039818 2025] [:error] [pid 12239:tid 12263] [client 74.225.154.77:12181] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aUQbv9NnXxfGIuWO6ak5pAAAApM"]
[Thu Dec 18 23:20:31.672194 2025] [:error] [pid 12035:tid 12066] [client 74.225.154.77:18351] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUQbv7cVHrNSHjCo-0qp5QAAAhc"]
[Thu Dec 18 23:20:32.139229 2025] [:error] [pid 12239:tid 12266] [client 74.225.154.77:12208] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUQbwNNnXxfGIuWO6ak5qgAAApY"]
[Thu Dec 18 23:20:32.611790 2025] [:error] [pid 12239:tid 12256] [client 74.225.154.77:12180] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUQbwNNnXxfGIuWO6ak5rQAAAow"]
[Thu Dec 18 23:20:33.062055 2025] [:error] [pid 24958:tid 24968] [client 74.225.154.77:12178] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUQbwckDOrUkd0wNm2HgggAAAYc"]
[Thu Dec 18 23:20:33.575668 2025] [:error] [pid 23556:tid 23562] [client 74.225.154.77:12160] [client 74.225.154.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUQbwRnmLlk3u5yt9kEAyAAAAAI"]
[Thu Dec 18 23:20:34.067356 2025] [:error] [pid 24433:tid 24441] [client 74.225.154.77:12039] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qlex1.php"] [unique_id "aUQbwp4pN9ycmipm8TjuxAAAAQU"]
[Thu Dec 18 23:20:34.382521 2025] [:error] [pid 12239:tid 12262] [client 74.225.154.77:12146] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qlex1.php"] [unique_id "aUQbwtNnXxfGIuWO6ak5vAAAApI"]
[Thu Dec 18 23:20:34.920416 2025] [:error] [pid 12383:tid 12409] [client 74.225.154.77:12192] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qlex1.php"] [unique_id "aUQbwvdgllo9h1cyxGbaCgAAAtc"]
[Thu Dec 18 23:20:35.452015 2025] [:error] [pid 12239:tid 12261] [client 74.225.154.77:12177] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qlex1.php"] [unique_id "aUQbw9NnXxfGIuWO6ak5yQAAApE"]
[Thu Dec 18 23:20:35.837356 2025] [:error] [pid 23556:tid 23576] [client 74.225.154.77:12120] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUQbwxnmLlk3u5yt9kEAzAAAABA"]
[Thu Dec 18 23:20:36.404431 2025] [:error] [pid 23645:tid 23669] [client 74.225.154.77:12182] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUQbxDf_Rx0Y0ao_QJh07gAAAJY"]
[Thu Dec 18 23:20:36.894794 2025] [:error] [pid 12383:tid 12393] [client 74.225.154.77:18363] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUQbxPdgllo9h1cyxGbaEQAAAsc"]
[Thu Dec 18 23:20:37.313948 2025] [:error] [pid 24958:tid 24963] [client 74.225.154.77:12111] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aUQbxckDOrUkd0wNm2HgiAAAAYI"]
[Thu Dec 18 23:20:38.011464 2025] [:error] [pid 12035:tid 12050] [client 74.225.154.77:12103] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQbxrcVHrNSHjCo-0qp7wAAAgg"]
[Thu Dec 18 23:20:38.504025 2025] [:error] [pid 23556:tid 23578] [client 74.225.154.77:12099] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQbxhnmLlk3u5yt9kEA0AAAABI"]
[Thu Dec 18 23:20:39.104892 2025] [:error] [pid 24542:tid 24560] [client 74.225.154.77:12157] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQbx0tQz4H2oS3NrDZAFQAAAVA"]
[Thu Dec 18 23:20:39.591045 2025] [:error] [pid 23556:tid 23571] [client 74.225.154.77:12104] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQbxxnmLlk3u5yt9kEA0wAAAAs"]
[Thu Dec 18 23:20:39.994891 2025] [:error] [pid 23556:tid 23574] [client 74.225.154.77:12107] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUQbxxnmLlk3u5yt9kEA2AAAAA4"]
[Thu Dec 18 23:20:40.428075 2025] [:error] [pid 23556:tid 23564] [client 74.225.154.77:12109] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUQbyBnmLlk3u5yt9kEA3AAAAAQ"]
[Thu Dec 18 23:20:40.866481 2025] [:error] [pid 24542:tid 24557] [client 74.225.154.77:12080] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUQbyEtQz4H2oS3NrDZAFgAAAU0"]
[Thu Dec 18 23:20:41.360708 2025] [:error] [pid 25357:tid 25360] [client 74.225.154.77:12281] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUQbyYaT7bsEXnJVfJeDWgAAAcE"]
[Thu Dec 18 23:20:41.727128 2025] [:error] [pid 12035:tid 12060] [client 74.225.154.77:18393] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUQbybcVHrNSHjCo-0qp8QAAAhE"]
[Thu Dec 18 23:20:42.307522 2025] [:error] [pid 24958:tid 24971] [client 74.225.154.77:12126] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUQbyskDOrUkd0wNm2HgigAAAYo"]
[Thu Dec 18 23:20:42.618905 2025] [:error] [pid 24958:tid 24964] [client 74.225.154.77:12191] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUQbyskDOrUkd0wNm2HgjAAAAYM"]
[Thu Dec 18 23:20:42.930041 2025] [:error] [pid 24958:tid 24978] [client 74.225.154.77:12122] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aUQbyskDOrUkd0wNm2HgjQAAAZE"]
[Thu Dec 18 23:20:43.397859 2025] [:error] [pid 23645:tid 23670] [client 74.225.154.77:12194] [client 74.225.154.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mah.php"] [unique_id "aUQbyzf_Rx0Y0ao_QJh09gAAAJc"]
[Thu Dec 18 23:20:43.967169 2025] [:error] [pid 12035:tid 12043] [client 74.225.154.77:12071] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUQby7cVHrNSHjCo-0qp8gAAAgE"]
[Thu Dec 18 23:20:44.703650 2025] [:error] [pid 24958:tid 24977] [client 74.225.154.77:12105] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUQbzMkDOrUkd0wNm2HgjwAAAZA"]
[Thu Dec 18 23:20:45.061064 2025] [:error] [pid 23645:tid 23647] [client 74.225.154.77:12112] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUQbzTf_Rx0Y0ao_QJh0_wAAAIA"]
[Thu Dec 18 23:20:45.425356 2025] [:error] [pid 23556:tid 23567] [client 74.225.154.77:18358] [client 74.225.154.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "aUQbzRnmLlk3u5yt9kEA7AAAAAc"]
[Fri Dec 19 01:58:23.782832 2025] [:error] [pid 45737:tid 45765] [client 170.64.219.248:19400] [client 170.64.219.248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aURAv1AGdb8SXm6CLHigLwAAABg"]
[Fri Dec 19 01:58:23.961445 2025] [:error] [pid 37418:tid 37442] [client 170.64.219.248:19412] [client 170.64.219.248] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aURAv60VAcRIm10OnozKyQAAAJY"]
[Fri Dec 19 06:27:35.641077 2025] [:error] [pid 61922:tid 61962] [client 170.64.188.244:9930] [client 170.64.188.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aUR_1xsDXYvsvN0FFlBAzwAAAEo"]
[Fri Dec 19 06:27:37.101490 2025] [:error] [pid 62008:tid 62029] [client 170.64.188.244:9942] [client 170.64.188.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aUR_2ZJCOG7NAlbm_OR4cgAAANI"]
[Fri Dec 19 15:57:59.140202 2025] [:error] [pid 20581:tid 20621] [client 182.48.215.214:47015] [client 182.48.215.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.48.215.214, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUUFh_xEv7WXNhnFD1kyTwAAAIY"]
[Fri Dec 19 15:57:59.145115 2025] [:error] [pid 20581:tid 20621] [client 182.48.215.214:47015] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Dec 19 17:05:26.048255 2025] [:error] [pid 41451:tid 41474] [client 195.178.110.68:38074] [client 195.178.110.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aUUVVgYXFn-DbZghZBGGHwAAABQ"]
[Fri Dec 19 17:05:46.386209 2025] [:error] [pid 41451:tid 41477] [client 195.178.110.68:22630] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Fri Dec 19 17:05:47.526848 2025] [:error] [pid 20581:tid 20617] [client 195.178.110.68:22640] [client 195.178.110.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/wp-config.php"] [unique_id "aUUVa_xEv7WXNhnFD1lA3AAAAII"]
[Fri Dec 19 17:06:09.139159 2025] [:error] [pid 41451:tid 41470] [client 195.178.110.68:18310] [client 195.178.110.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env.local"] [unique_id "aUUVgQYXFn-DbZghZBGGewAAABA"]
[Fri Dec 19 20:06:57.453113 2025] [:error] [pid 16026:tid 16050] [client 104.215.27.139:38258] File does not exist: /usr/local/apache/htdocs/suspended-page/index4.php
[Fri Dec 19 20:06:57.608049 2025] [:error] [pid 16026:tid 16031] [client 104.215.27.139:38258] File does not exist: /usr/local/apache/htdocs/suspended-page/panelx.php
[Fri Dec 19 20:06:57.784317 2025] [:error] [pid 16026:tid 16053] [client 104.215.27.139:38258] File does not exist: /usr/local/apache/htdocs/suspended-page/bekle.php
[Fri Dec 19 20:06:57.929694 2025] [:error] [pid 16026:tid 16045] [client 104.215.27.139:38258] File does not exist: /usr/local/apache/htdocs/suspended-page/auths.php
[Fri Dec 19 20:06:58.083190 2025] [:error] [pid 16026:tid 16051] [client 104.215.27.139:38258] File does not exist: /usr/local/apache/htdocs/suspended-page/rasp.php
[Fri Dec 19 20:06:58.236883 2025] [:error] [pid 16026:tid 16041] [client 104.215.27.139:38258] File does not exist: /usr/local/apache/htdocs/suspended-page/_inc-rasberry0342.php
[Fri Dec 19 20:06:58.423768 2025] [:error] [pid 16026:tid 16030] [client 104.215.27.139:38258] File does not exist: /usr/local/apache/htdocs/suspended-page/router.php
[Fri Dec 19 20:06:58.572370 2025] [:error] [pid 16026:tid 16042] [client 104.215.27.139:38258] [client 104.215.27.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp-config.php"] [unique_id "aUU_4kLVfhf4Jb3enmMthwAAAU0"]
[Fri Dec 19 20:07:03.842381 2025] [:error] [pid 20580:tid 20594] [client 104.215.27.139:50370] File does not exist: /usr/local/apache/htdocs/suspended-page/blackhat.php
[Fri Dec 19 20:07:04.016448 2025] [:error] [pid 20580:tid 20592] [client 104.215.27.139:50370] File does not exist: /usr/local/apache/htdocs/suspended-page/1a.php
[Fri Dec 19 20:07:04.209913 2025] [:error] [pid 20580:tid 20589] [client 104.215.27.139:50370] File does not exist: /usr/local/apache/htdocs/suspended-page/1s.php
[Fri Dec 19 20:07:04.499724 2025] [:error] [pid 20580:tid 20596] [client 104.215.27.139:50370] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aUU_6Emd1op_YdAdgR2WxQAAAEo"]
[Fri Dec 19 20:07:07.189687 2025] [:error] [pid 41451:tid 41454] [client 104.215.27.139:43747] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aUU_6wYXFn-DbZghZBHT1wAAAAA"]
[Fri Dec 19 20:07:21.802079 2025] [:error] [pid 18438:tid 18446] [client 104.215.27.139:46357] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logs.php"] [unique_id "aUU_-ZRArClWV1iij_R_lwAAAYU"]
[Fri Dec 19 20:07:23.320842 2025] [:error] [pid 20582:tid 20654] [client 104.215.27.139:50483] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logs.php"] [unique_id "aUU_-8pAnrkQKZ4b5gYp7AAAAMw"]
[Fri Dec 19 20:07:27.590764 2025] [:error] [pid 20581:tid 20637] [client 104.215.27.139:40555] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logs.php"] [unique_id "aUU___xEv7WXNhnFD1l9_AAAAJY"]
[Fri Dec 19 20:07:36.615092 2025] [:error] [pid 20582:tid 20657] [client 104.215.27.139:40556] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aUVACMpAnrkQKZ4b5gYp-QAAAM8"]
[Fri Dec 19 20:07:39.321052 2025] [:error] [pid 41451:tid 41458] [client 104.215.27.139:42915] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aUVACwYXFn-DbZghZBHUBAAAAAQ"]
[Fri Dec 19 20:07:44.931454 2025] [:error] [pid 41451:tid 41467] [client 104.215.27.139:40522] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aUVAEAYXFn-DbZghZBHUCwAAAA0"]
[Fri Dec 19 20:07:53.640012 2025] [:error] [pid 20582:tid 20653] [client 104.215.27.139:44087] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testphp.php"] [unique_id "aUVAGcpAnrkQKZ4b5gYqCgAAAMs"]
[Fri Dec 19 20:07:59.124922 2025] [:error] [pid 20582:tid 20652] [client 104.215.27.139:44141] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testphp.php"] [unique_id "aUVAH8pAnrkQKZ4b5gYqEAAAAMo"]
[Fri Dec 19 20:08:00.510476 2025] [:error] [pid 20582:tid 20654] [client 104.215.27.139:38058] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testphp.php"] [unique_id "aUVAIMpAnrkQKZ4b5gYqEgAAAMw"]
[Fri Dec 19 20:08:03.023618 2025] [:error] [pid 18438:tid 18448] [client 104.215.27.139:46443] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/testphp.php"] [unique_id "aUVAI5RArClWV1iij_R_3AAAAYc"]
[Fri Dec 19 20:08:04.509478 2025] [:error] [pid 18438:tid 18455] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/logo_img.php
[Fri Dec 19 20:08:04.699781 2025] [:error] [pid 18438:tid 18442] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/tempfs.php
[Fri Dec 19 20:08:05.132626 2025] [:error] [pid 18438:tid 18454] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Fri Dec 19 20:08:05.306612 2025] [:error] [pid 18438:tid 18458] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/dump.php
[Fri Dec 19 20:08:05.459793 2025] [:error] [pid 18438:tid 18453] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/joomla_hashes.php
[Fri Dec 19 20:08:05.616903 2025] [:error] [pid 18438:tid 18447] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/indexs.php
[Fri Dec 19 20:08:05.909647 2025] [:error] [pid 18438:tid 18452] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Fri Dec 19 20:08:06.111142 2025] [:error] [pid 18438:tid 18460] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Fri Dec 19 20:08:06.288858 2025] [:error] [pid 18438:tid 18449] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/mage.php
[Fri Dec 19 20:08:06.579931 2025] [:error] [pid 18438:tid 18442] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/conf.php
[Fri Dec 19 20:08:06.722918 2025] [:error] [pid 18438:tid 18454] [client 104.215.27.139:47229] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Dec 19 20:08:06.874951 2025] [:error] [pid 18438:tid 18459] [client 104.215.27.139:47229] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/newsletter_signup.php"] [unique_id "aUVAJpRArClWV1iij_R_8gAAAZI"]
[Fri Dec 19 20:08:07.963722 2025] [:error] [pid 41451:tid 41476] [client 104.215.27.139:41077] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/newsletter_signup.php"] [unique_id "aUVAJwYXFn-DbZghZBHUJQAAABY"]
[Fri Dec 19 20:08:10.228432 2025] [:error] [pid 41451:tid 41474] [client 104.215.27.139:40628] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/newsletter_signup.php"] [unique_id "aUVAKgYXFn-DbZghZBHUKwAAABQ"]
[Fri Dec 19 20:08:13.031693 2025] [:error] [pid 18438:tid 18444] [client 104.215.27.139:45224] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/newsletter_signup.php"] [unique_id "aUVALZRArClWV1iij_R_-AAAAYM"]
[Fri Dec 19 20:08:56.099002 2025] [:error] [pid 18438:tid 18465] [client 104.215.27.139:41476] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/card.php"] [unique_id "aUVAWJRArClWV1iij_SAawAAAZg"]
[Fri Dec 19 20:09:08.791162 2025] [:error] [pid 18438:tid 18442] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/card.php
[Fri Dec 19 20:09:08.956228 2025] [:error] [pid 18438:tid 18457] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/personal.php
[Fri Dec 19 20:09:09.130473 2025] [:error] [pid 18438:tid 18454] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/mob.php
[Fri Dec 19 20:09:09.297156 2025] [:error] [pid 18438:tid 18456] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/shippings.php
[Fri Dec 19 20:09:10.800387 2025] [:error] [pid 18438:tid 18456] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.6.6.php
[Fri Dec 19 20:09:11.018123 2025] [:error] [pid 18438:tid 18455] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.6.5.php
[Fri Dec 19 20:09:11.176905 2025] [:error] [pid 18438:tid 18458] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.6.4.php
[Fri Dec 19 20:09:11.334989 2025] [:error] [pid 18438:tid 18457] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/logout.php
[Fri Dec 19 20:09:11.506753 2025] [:error] [pid 18438:tid 18445] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/signin.php
[Fri Dec 19 20:09:11.672709 2025] [:error] [pid 18438:tid 18447] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/weblinks.php
[Fri Dec 19 20:09:11.834450 2025] [:error] [pid 18438:tid 18452] [client 104.215.27.139:38536] File does not exist: /usr/local/apache/htdocs/suspended-page/vbv.php
[Fri Dec 19 20:09:12.094894 2025] [:error] [pid 18438:tid 18464] [client 104.215.27.139:38536] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.7.0.php"] [unique_id "aUVAaJRArClWV1iij_SAugAAAZc"]
[Fri Dec 19 20:09:16.024046 2025] [:error] [pid 18438:tid 18452] [client 104.215.27.139:41562] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.7.0.php"] [unique_id "aUVAbJRArClWV1iij_SAxwAAAYs"]
[Fri Dec 19 20:09:17.906109 2025] [:error] [pid 18438:tid 18449] [client 104.215.27.139:47823] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.7.0.php"] [unique_id "aUVAbZRArClWV1iij_SAzwAAAYg"]
[Fri Dec 19 20:09:19.432585 2025] [:error] [pid 18438:tid 18459] [client 104.215.27.139:40099] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.7.0.php"] [unique_id "aUVAb5RArClWV1iij_SA1QAAAZI"]
[Fri Dec 19 20:09:20.133244 2025] [:error] [pid 20582:tid 20645] [client 104.215.27.139:38773] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loginfailed.php"] [unique_id "aUVAcMpAnrkQKZ4b5gYqfAAAAMM"]
[Fri Dec 19 20:09:24.585318 2025] [:error] [pid 20581:tid 20629] [client 104.215.27.139:39559] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loginfailed.php"] [unique_id "aUVAdPxEv7WXNhnFD1l-VAAAAI4"]
[Fri Dec 19 20:09:26.962417 2025] [:error] [pid 16026:tid 16042] [client 104.215.27.139:47903] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loginfailed.php"] [unique_id "aUVAdkLVfhf4Jb3enmMuIgAAAU0"]
[Fri Dec 19 20:09:28.389318 2025] [:error] [pid 16026:tid 16050] [client 104.215.27.139:41540] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/loginfailed.php"] [unique_id "aUVAeELVfhf4Jb3enmMuJQAAAVU"]
[Fri Dec 19 20:09:30.144007 2025] [:error] [pid 20582:tid 20658] [client 104.215.27.139:41579] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logins.php"] [unique_id "aUVAespAnrkQKZ4b5gYqiQAAANA"]
[Fri Dec 19 20:09:38.109356 2025] [:error] [pid 20582:tid 20665] [client 104.215.27.139:39176] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logins.php"] [unique_id "aUVAgspAnrkQKZ4b5gYqmgAAANc"]
[Fri Dec 19 20:09:45.320722 2025] [:error] [pid 20582:tid 20647] [client 104.215.27.139:40333] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pac.php"] [unique_id "aUVAicpAnrkQKZ4b5gYqxgAAAMU"]
[Fri Dec 19 20:09:49.168790 2025] [:error] [pid 41451:tid 41461] [client 104.215.27.139:47896] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pac.php"] [unique_id "aUVAjQYXFn-DbZghZBHUqQAAAAc"]
[Fri Dec 19 20:10:07.384773 2025] [:error] [pid 41451:tid 41469] [client 104.215.27.139:40294] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.7.1.php"] [unique_id "aUVAnwYXFn-DbZghZBHU5AAAAA8"]
[Fri Dec 19 20:10:08.598338 2025] [:error] [pid 41451:tid 41457] [client 104.215.27.139:41815] [client 104.215.27.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.7.1.php"] [unique_id "aUVAoAYXFn-DbZghZBHU5gAAAAM"]
[Fri Dec 19 20:10:30.745682 2025] [:error] [pid 16026:tid 16040] [client 104.215.27.139:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.7.2.php
[Fri Dec 19 20:10:30.925907 2025] [:error] [pid 16026:tid 16036] [client 104.215.27.139:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.7.3.php
[Fri Dec 19 20:10:31.088690 2025] [:error] [pid 16026:tid 16032] [client 104.215.27.139:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.7.4.php
[Fri Dec 19 20:10:31.272350 2025] [:error] [pid 16026:tid 16047] [client 104.215.27.139:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.7.5.php
[Fri Dec 19 20:10:31.454484 2025] [:error] [pid 16026:tid 16050] [client 104.215.27.139:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.7.6.php
[Fri Dec 19 20:10:31.942543 2025] [:error] [pid 16026:tid 16037] [client 104.215.27.139:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.2.3-en.php
[Fri Dec 19 22:51:58.918081 2025] [:error] [pid 18438:tid 18463] [client 143.198.220.98:55589] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/api/index.php/v1/config/application"] [unique_id "aUVmjpRArClWV1iij_TDxQAAAZY"]
[Sat Dec 20 07:39:22.297340 2025] [:error] [pid 18807:tid 18814] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 20 07:39:22.581344 2025] [:error] [pid 18807:tid 18827] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 20 07:39:22.868880 2025] [:error] [pid 18807:tid 18810] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Dec 20 07:39:23.157467 2025] [:error] [pid 18807:tid 18821] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Dec 20 07:39:23.442388 2025] [:error] [pid 18807:tid 18811] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 20 07:39:23.736912 2025] [:error] [pid 18807:tid 18821] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 07:39:24.024828 2025] [:error] [pid 18807:tid 18827] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 07:39:24.316945 2025] [:error] [pid 18807:tid 18826] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 20 07:39:24.895530 2025] [:error] [pid 18807:tid 18828] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 20 07:39:25.480884 2025] [:error] [pid 18807:tid 18817] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Dec 20 07:39:25.769780 2025] [:error] [pid 18807:tid 18813] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Dec 20 07:39:26.054196 2025] [:error] [pid 18807:tid 18814] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 20 07:39:26.363727 2025] [:error] [pid 18807:tid 18824] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Dec 20 07:39:26.648474 2025] [:error] [pid 18807:tid 18818] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Dec 20 07:39:26.940966 2025] [:error] [pid 18807:tid 18814] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Dec 20 07:39:27.224992 2025] [:error] [pid 18807:tid 18827] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Dec 20 07:39:27.515031 2025] [:error] [pid 18807:tid 18817] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Dec 20 07:39:27.815566 2025] [:error] [pid 18807:tid 18818] [client 45.86.202.92:53703] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Dec 20 07:39:32.039522 2025] [:error] [pid 18807:tid 18815] [client 45.86.202.92:53703] [client 45.86.202.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUXiNGRP9n5OCTllYeUMYQAAAYY"]
[Sat Dec 20 07:39:33.478288 2025] [:error] [pid 14286:tid 14291] [client 45.86.202.61:21607] [client 45.86.202.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUXiNZ7rbXIrw6rGSdbEXwAAAUE"]
[Sat Dec 20 07:39:34.952844 2025] [:error] [pid 39577:tid 39595] [client 45.86.202.88:35353] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 20 07:39:35.805480 2025] [:error] [pid 39577:tid 39582] [client 45.86.202.88:35353] [client 45.86.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aUXiN7viRnt1rJiSOfyfxgAAAMM"]
[Sat Dec 20 07:39:36.955457 2025] [:error] [pid 14247:tid 14265] [client 45.86.202.60:62865] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 20 07:39:37.239479 2025] [:error] [pid 14247:tid 14269] [client 45.86.202.60:62865] [client 45.86.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUXiOSDv9TtKKdJQn9loGAAAARQ"]
[Sat Dec 20 07:39:38.121485 2025] [:error] [pid 18807:tid 18822] [client 45.86.202.60:28859] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Dec 20 07:39:39.600362 2025] [:error] [pid 18807:tid 18809] [client 45.86.202.60:28859] [client 45.86.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUXiO2RP9n5OCTllYeUMugAAAYA"]
[Sat Dec 20 07:39:40.549140 2025] [:error] [pid 14247:tid 14263] [client 45.86.202.76:61689] [client 45.86.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUXiPCDv9TtKKdJQn9loOAAAAQ4"]
[Sat Dec 20 07:39:48.140359 2025] [:error] [pid 39493:tid 39552] [client 45.86.202.58:46503] [client 45.86.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUXiRGhjL2VG_FmIHqAmlAAAAIM"]
[Sat Dec 20 07:39:48.736356 2025] [:error] [pid 39577:tid 39602] [client 45.86.202.67:27807] [client 45.86.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUXiRLviRnt1rJiSOfygRgAAANc"]
[Sat Dec 20 07:39:49.326643 2025] [:error] [pid 39577:tid 39603] [client 45.86.202.79:52665] [client 45.86.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUXiRbviRnt1rJiSOfygTQAAANg"]
[Sat Dec 20 07:39:50.933423 2025] [:error] [pid 39492:tid 39546] [client 45.86.202.85:65169] [client 45.86.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUXiRos_ZYP1UQNM9hazXwAAAFg"]
[Sat Dec 20 07:39:58.919514 2025] [:error] [pid 39491:tid 39495] [client 45.86.202.81:37689] [client 45.86.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUXiTltw2ggYvDxu2EDc_QAAAAA"]
[Sat Dec 20 07:39:59.487450 2025] [:error] [pid 14247:tid 14272] [client 45.86.202.57:49287] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Dec 20 07:40:00.061151 2025] [:error] [pid 14247:tid 14265] [client 45.86.202.57:49287] [client 45.86.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aUXiUCDv9TtKKdJQn9lo2wAAARA"]
[Sat Dec 20 07:40:01.247662 2025] [:error] [pid 39577:tid 39579] [client 45.86.202.87:48873] [client 45.86.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUXiUbviRnt1rJiSOfyg8QAAAMA"]
[Sat Dec 20 07:40:02.110381 2025] [:error] [pid 39491:tid 39516] [client 45.86.202.89:31925] [client 45.86.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUXiUltw2ggYvDxu2EDdHwAAABU"]
[Sat Dec 20 07:40:31.809226 2025] [:error] [pid 39493:tid 39553] [client 45.86.202.52:59545] [client 45.86.202.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/images/slider/"] [unique_id "aUXib2hjL2VG_FmIHqAo6QAAAIQ"]
[Sat Dec 20 07:40:45.564982 2025] [:error] [pid 39577:tid 39602] [client 45.86.202.64:46091] [client 45.86.202.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2023/"] [unique_id "aUXifbviRnt1rJiSOfyi8gAAANc"]
[Sat Dec 20 07:41:17.173090 2025] [:error] [pid 39492:tid 39535] [client 45.86.202.81:42539] [client 45.86.202.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/"] [unique_id "aUXinYs_ZYP1UQNM9ha4rQAAAE0"]
[Sat Dec 20 07:42:23.621381 2025] [:error] [pid 39493:tid 39562] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 20 07:42:23.949089 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 20 07:42:24.326511 2025] [:error] [pid 39493:tid 39564] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Dec 20 07:42:24.678161 2025] [:error] [pid 39493:tid 39566] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Dec 20 07:42:25.018745 2025] [:error] [pid 39493:tid 39573] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 20 07:42:26.045239 2025] [:error] [pid 39493:tid 39550] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 07:42:26.373151 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 07:42:26.699184 2025] [:error] [pid 39493:tid 39570] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 20 07:42:27.326759 2025] [:error] [pid 39493:tid 39555] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 20 07:42:28.013007 2025] [:error] [pid 39493:tid 39570] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Dec 20 07:42:28.351335 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Dec 20 07:42:28.667875 2025] [:error] [pid 39493:tid 39570] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 20 07:42:29.018612 2025] [:error] [pid 39493:tid 39557] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Dec 20 07:42:29.344921 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Dec 20 07:42:29.682643 2025] [:error] [pid 39493:tid 39568] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Dec 20 07:42:30.014448 2025] [:error] [pid 39493:tid 39562] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Dec 20 07:42:30.336077 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Dec 20 07:42:30.680898 2025] [:error] [pid 39493:tid 39572] [client 45.86.202.99:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Dec 20 07:42:35.594106 2025] [:error] [pid 39493:tid 39564] [client 45.86.202.99:48749] [client 45.86.202.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUXi62hjL2VG_FmIHqAwnwAAAI8"]
[Sat Dec 20 07:42:37.141455 2025] [:error] [pid 39493:tid 39561] [client 45.86.202.98:31995] [client 45.86.202.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUXi7WhjL2VG_FmIHqAwuwAAAIw"]
[Sat Dec 20 07:42:38.752033 2025] [:error] [pid 39492:tid 39543] [client 45.86.202.98:38155] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 20 07:42:39.688344 2025] [:error] [pid 39492:tid 39535] [client 45.86.202.98:38155] [client 45.86.202.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aUXi74s_ZYP1UQNM9ha-AAAAAE0"]
[Sat Dec 20 07:42:42.006942 2025] [:error] [pid 18807:tid 18832] [client 45.86.202.73:25291] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 20 07:42:42.330329 2025] [:error] [pid 18807:tid 18832] [client 45.86.202.73:25291] [client 45.86.202.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUXi8mRP9n5OCTllYeUZGAAAAZc"]
[Sat Dec 20 07:42:43.226154 2025] [:error] [pid 39492:tid 39546] [client 45.86.202.64:22191] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Dec 20 07:42:44.781637 2025] [:error] [pid 39492:tid 39524] [client 45.86.202.64:22191] [client 45.86.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUXi9Is_ZYP1UQNM9ha-RwAAAEI"]
[Sat Dec 20 07:42:45.674851 2025] [:error] [pid 39492:tid 39524] [client 45.86.202.83:20877] [client 45.86.202.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUXi9Ys_ZYP1UQNM9ha-XwAAAEI"]
[Sat Dec 20 07:42:46.287336 2025] [:error] [pid 39577:tid 39596] [client 45.86.202.79:27911] [client 45.86.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUXi9rviRnt1rJiSOfyqDgAAANE"]
[Sat Dec 20 07:42:47.922381 2025] [:error] [pid 39492:tid 39544] [client 45.86.202.86:33871] [client 45.86.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUXi94s_ZYP1UQNM9ha-hAAAAFY"]
[Sat Dec 20 07:42:48.554376 2025] [:error] [pid 14286:tid 14291] [client 45.86.202.76:45841] [client 45.86.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUXi-J7rbXIrw6rGSdbQSwAAAUE"]
[Sat Dec 20 07:42:49.214347 2025] [:error] [pid 14286:tid 14306] [client 45.86.202.85:48769] [client 45.86.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUXi-Z7rbXIrw6rGSdbQVQAAAVA"]
[Sat Dec 20 07:42:50.131565 2025] [:error] [pid 39491:tid 39518] [client 45.86.202.73:46949] [client 45.86.202.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUXi-ltw2ggYvDxu2EDn2AAAABc"]
[Sat Dec 20 07:42:50.770389 2025] [:error] [pid 39491:tid 39518] [client 45.86.202.81:46825] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Dec 20 07:42:51.386429 2025] [:error] [pid 39491:tid 39513] [client 45.86.202.81:46825] [client 45.86.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aUXi-1tw2ggYvDxu2EDn8wAAABI"]
[Sat Dec 20 07:42:52.611464 2025] [:error] [pid 39577:tid 39586] [client 45.86.202.93:53243] [client 45.86.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUXi_LviRnt1rJiSOfyqagAAAMc"]
[Sat Dec 20 07:42:53.518362 2025] [:error] [pid 14286:tid 14307] [client 45.86.202.66:63527] [client 45.86.202.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUXi_Z7rbXIrw6rGSdbQlwAAAVE"]
[Sat Dec 20 07:42:54.129953 2025] [:error] [pid 18807:tid 18810] [client 45.86.202.220:54421] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Dec 20 07:42:54.457327 2025] [:error] [pid 18807:tid 18818] [client 45.86.202.220:54421] [client 45.86.202.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUXi_mRP9n5OCTllYeUaEgAAAYk"]
[Sat Dec 20 07:42:55.044649 2025] [:error] [pid 39493:tid 39563] [client 45.86.202.87:63707] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Dec 20 07:42:55.997113 2025] [:error] [pid 39493:tid 39556] [client 45.86.202.87:63707] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Dec 20 07:42:56.984752 2025] [:error] [pid 39493:tid 39572] [client 45.86.202.87:63707] [client 45.86.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUXjAGhjL2VG_FmIHqAyUQAAAJc"]
[Sat Dec 20 07:42:57.607612 2025] [:error] [pid 39492:tid 39524] [client 45.86.202.71:21147] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sat Dec 20 07:42:57.915050 2025] [:error] [pid 39492:tid 39544] [client 45.86.202.71:21147] [client 45.86.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUXjAYs_ZYP1UQNM9ha_SAAAAFY"]
[Sat Dec 20 07:42:58.554300 2025] [:error] [pid 39577:tid 39586] [client 45.86.202.74:34563] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Dec 20 07:42:59.217220 2025] [:error] [pid 39577:tid 39591] [client 45.86.202.74:34563] [client 45.86.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUXjA7viRnt1rJiSOfyq0AAAAMw"]
[Sat Dec 20 07:43:00.160530 2025] [:error] [pid 39492:tid 39542] [client 45.86.202.57:53939] [client 45.86.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUXjBIs_ZYP1UQNM9ha_dgAAAFQ"]
[Sat Dec 20 07:43:01.149952 2025] [:error] [pid 39577:tid 39599] [client 45.86.202.88:55579] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sat Dec 20 07:43:01.478684 2025] [:error] [pid 39577:tid 39588] [client 45.86.202.88:55579] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Dec 20 07:43:02.121241 2025] [:error] [pid 39577:tid 39597] [client 45.86.202.88:55579] [client 45.86.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUXjBrviRnt1rJiSOfyrBAAAANI"]
[Sat Dec 20 07:43:03.028406 2025] [:error] [pid 18807:tid 18824] [client 45.86.202.81:36987] [client 45.86.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUXjB2RP9n5OCTllYeUawwAAAY8"]
[Sat Dec 20 07:43:03.959420 2025] [:error] [pid 39492:tid 39535] [client 45.86.202.54:47199] [client 45.86.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUXjB4s_ZYP1UQNM9ha_ywAAAE0"]
[Sat Dec 20 07:43:04.589249 2025] [:error] [pid 39491:tid 39518] [client 45.86.202.74:60565] [client 45.86.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUXjCFtw2ggYvDxu2EDo6QAAABc"]
[Sat Dec 20 07:43:05.188797 2025] [:error] [pid 14286:tid 14296] [client 45.86.202.94:43777] [client 45.86.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUXjCZ7rbXIrw6rGSdbROwAAAUY"]
[Sat Dec 20 07:43:06.571308 2025] [:error] [pid 39493:tid 39549] [client 45.86.202.51:53859] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sat Dec 20 07:43:06.900072 2025] [:error] [pid 39493:tid 39558] [client 45.86.202.51:53859] [client 45.86.202.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aUXjCmhjL2VG_FmIHqAzFAAAAIk"]
[Sat Dec 20 07:43:07.519381 2025] [:error] [pid 39577:tid 39595] [client 45.86.202.56:63365] [client 45.86.202.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aUXjC7viRnt1rJiSOfyrUgAAANA"]
[Sat Dec 20 07:43:08.158906 2025] [:error] [pid 39491:tid 39498] [client 45.86.202.57:26481] [client 45.86.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUXjDFtw2ggYvDxu2EDpMwAAAAM"]
[Sat Dec 20 07:43:09.374134 2025] [:error] [pid 39492:tid 39530] [client 45.86.202.72:60537] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sat Dec 20 07:43:10.008420 2025] [:error] [pid 39492:tid 39528] [client 45.86.202.72:60537] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Dec 20 07:43:11.270031 2025] [:error] [pid 39492:tid 39545] [client 45.86.202.72:60537] [client 45.86.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aUXjD4s_ZYP1UQNM9hbAhwAAAFc"]
[Sat Dec 20 07:43:12.820519 2025] [:error] [pid 39577:tid 39594] [client 45.86.202.62:57931] [client 45.86.202.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.62, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUXjELviRnt1rJiSOfyrpQAAAM8"]
[Sat Dec 20 07:43:13.147812 2025] [:error] [pid 39577:tid 39592] [client 45.86.202.62:57931] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Dec 20 07:43:14.701633 2025] [:error] [pid 39577:tid 39597] [client 45.86.202.62:57931] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sat Dec 20 07:43:14.996815 2025] [:error] [pid 39577:tid 39600] [client 45.86.202.62:57931] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Dec 20 07:43:16.511465 2025] [:error] [pid 39577:tid 39603] [client 45.86.202.62:57931] [client 45.86.202.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUXjFLviRnt1rJiSOfyr4gAAANg"]
[Sat Dec 20 07:43:17.407459 2025] [:error] [pid 14286:tid 14303] [client 45.86.202.81:59915] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sat Dec 20 07:43:17.711428 2025] [:error] [pid 14286:tid 14302] [client 45.86.202.81:59915] [client 45.86.202.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.81, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUXjFZ7rbXIrw6rGSdbSYwAAAUw"]
[Sat Dec 20 07:43:18.305685 2025] [:error] [pid 14286:tid 14302] [client 45.86.202.81:59915] [client 45.86.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aUXjFp7rbXIrw6rGSdbScwAAAUw"]
[Sat Dec 20 07:43:20.136084 2025] [:error] [pid 18807:tid 18832] [client 45.86.202.63:28227] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Dec 20 07:43:20.754727 2025] [:error] [pid 18807:tid 18821] [client 45.86.202.63:28227] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sat Dec 20 07:43:21.377224 2025] [:error] [pid 18807:tid 18832] [client 45.86.202.63:28227] [client 45.86.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUXjGWRP9n5OCTllYeUcEAAAAZc"]
[Sat Dec 20 07:43:21.972208 2025] [:error] [pid 14286:tid 14302] [client 45.86.202.59:57823] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Dec 20 07:43:22.947046 2025] [:error] [pid 14286:tid 14295] [client 45.86.202.59:57823] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sat Dec 20 07:43:23.569909 2025] [:error] [pid 14286:tid 14298] [client 45.86.202.59:57823] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sat Dec 20 07:43:24.210772 2025] [:error] [pid 14286:tid 14294] [client 45.86.202.59:57823] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Dec 20 07:43:24.503490 2025] [:error] [pid 14286:tid 14291] [client 45.86.202.59:57823] [client 45.86.202.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUXjHJ7rbXIrw6rGSdbS5AAAAUE"]
[Sat Dec 20 07:43:25.155099 2025] [:error] [pid 18807:tid 18822] [client 45.86.202.64:20085] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Dec 20 07:43:25.465945 2025] [:error] [pid 18807:tid 18827] [client 45.86.202.64:20085] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Dec 20 07:43:25.772508 2025] [:error] [pid 18807:tid 18827] [client 45.86.202.64:20085] [client 45.86.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUXjHWRP9n5OCTllYeUcSQAAAZI"]
[Sat Dec 20 07:43:33.718214 2025] [:error] [pid 39492:tid 39529] [client 45.86.202.96:45331] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sat Dec 20 07:43:34.348103 2025] [:error] [pid 39492:tid 39545] [client 45.86.202.96:45331] [client 45.86.202.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.96, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUXjJos_ZYP1UQNM9hbChAAAAFc"]
[Sat Dec 20 07:43:34.652908 2025] [:error] [pid 39492:tid 39535] [client 45.86.202.96:45331] [client 45.86.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUXjJos_ZYP1UQNM9hbCigAAAE0"]
[Sat Dec 20 07:43:38.376199 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.67:65299] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sat Dec 20 07:43:40.223485 2025] [:error] [pid 39493:tid 39565] [client 45.86.202.67:65299] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Dec 20 07:43:40.546535 2025] [:error] [pid 39493:tid 39563] [client 45.86.202.67:65299] [client 45.86.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUXjLGhjL2VG_FmIHqA1IAAAAI4"]
[Sat Dec 20 07:43:41.150049 2025] [:error] [pid 18807:tid 18829] [client 45.86.202.221:63373] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Dec 20 07:43:42.100625 2025] [:error] [pid 18807:tid 18825] [client 45.86.202.221:63373] [client 45.86.202.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.221, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUXjLmRP9n5OCTllYeUdTwAAAZA"]
[Sat Dec 20 07:43:42.461633 2025] [:error] [pid 18807:tid 18809] [client 45.86.202.221:63373] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Dec 20 07:43:42.762234 2025] [:error] [pid 18807:tid 18817] [client 45.86.202.221:63373] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sat Dec 20 07:43:43.058036 2025] [:error] [pid 18807:tid 18809] [client 45.86.202.221:63373] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sat Dec 20 07:43:43.363334 2025] [:error] [pid 18807:tid 18818] [client 45.86.202.221:63373] [client 45.86.202.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUXjL2RP9n5OCTllYeUdZQAAAYk"]
[Sat Dec 20 07:43:43.962676 2025] [:error] [pid 14247:tid 14260] [client 45.86.202.79:57213] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sat Dec 20 07:43:44.280445 2025] [:error] [pid 14247:tid 14272] [client 45.86.202.79:57213] [client 45.86.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aUXjMCDv9TtKKdJQn9l1dQAAARc"]
[Sat Dec 20 07:43:45.244975 2025] [:error] [pid 39577:tid 39580] [client 45.86.202.69:32255] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Dec 20 07:43:45.557643 2025] [:error] [pid 39577:tid 39582] [client 45.86.202.69:32255] [client 45.86.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUXjMbviRnt1rJiSOfyt5QAAAMM"]
[Sat Dec 20 07:43:47.754594 2025] [:error] [pid 18807:tid 18812] [client 45.86.202.90:48391] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sat Dec 20 07:43:48.061054 2025] [:error] [pid 18807:tid 18825] [client 45.86.202.90:48391] [client 45.86.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUXjNGRP9n5OCTllYeUdqQAAAZA"]
[Sat Dec 20 07:43:49.662399 2025] [:error] [pid 39493:tid 39571] [client 45.86.202.77:49601] [client 45.86.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUXjNWhjL2VG_FmIHqA1lwAAAJY"]
[Sat Dec 20 07:43:51.358805 2025] [:error] [pid 14286:tid 14296] [client 45.86.202.88:29645] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Dec 20 07:43:51.671382 2025] [:error] [pid 14286:tid 14310] [client 45.86.202.88:29645] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sat Dec 20 07:43:52.923448 2025] [:error] [pid 14286:tid 14295] [client 45.86.202.88:29645] [client 45.86.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUXjOJ7rbXIrw6rGSdbVYAAAAUU"]
[Sat Dec 20 07:43:53.824737 2025] [:error] [pid 14247:tid 14253] [client 45.86.202.91:49391] [client 45.86.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUXjOSDv9TtKKdJQn9l2MAAAAQQ"]
[Sat Dec 20 07:43:56.310266 2025] [:error] [pid 39493:tid 39567] [client 45.86.202.93:22329] [client 45.86.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aUXjPGhjL2VG_FmIHqA1_AAAAJI"]
[Sat Dec 20 07:43:56.931882 2025] [:error] [pid 18807:tid 18819] [client 45.86.202.85:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sat Dec 20 07:43:57.550995 2025] [:error] [pid 18807:tid 18821] [client 45.86.202.85:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sat Dec 20 07:43:57.833484 2025] [:error] [pid 18807:tid 18827] [client 45.86.202.85:26445] [client 45.86.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aUXjPWRP9n5OCTllYeUeWwAAAZI"]
[Sat Dec 20 07:43:58.435173 2025] [:error] [pid 39577:tid 39587] [client 45.86.202.90:63997] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Dec 20 07:43:59.046370 2025] [:error] [pid 39577:tid 39599] [client 45.86.202.90:63997] [client 45.86.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aUXjP7viRnt1rJiSOfyuoAAAANQ"]
[Sat Dec 20 07:44:00.659672 2025] [:error] [pid 18807:tid 18820] [client 45.86.202.76:28193] [client 45.86.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aUXjQGRP9n5OCTllYeUekQAAAYs"]
[Sat Dec 20 07:44:01.656192 2025] [:error] [pid 39577:tid 39584] [client 45.86.202.94:62275] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Dec 20 07:44:02.838326 2025] [:error] [pid 39577:tid 39599] [client 45.86.202.94:62275] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sat Dec 20 07:44:03.447418 2025] [:error] [pid 39577:tid 39598] [client 45.86.202.94:62275] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Dec 20 07:44:03.738345 2025] [:error] [pid 39577:tid 39580] [client 45.86.202.94:62275] [client 45.86.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aUXjQ7viRnt1rJiSOfyu5gAAAME"]
[Sat Dec 20 07:44:05.373966 2025] [:error] [pid 39493:tid 39567] [client 45.86.202.90:48615] [client 45.86.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aUXjRWhjL2VG_FmIHqA2uQAAAJI"]
[Sat Dec 20 15:02:15.175362 2025] [:error] [pid 39491:tid 39513] [client 3.14.82.135:51700] [client 3.14.82.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.14.82.135, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUZJ91tw2ggYvDxu2EA9ywAAABI"]
[Sat Dec 20 15:02:15.179138 2025] [:error] [pid 39491:tid 39513] [client 3.14.82.135:51700] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Dec 20 15:02:19.533515 2025] [:error] [pid 39491:tid 39496] [client 3.14.82.135:51700] [client 3.14.82.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aUZJ-1tw2ggYvDxu2EA92gAAAAE"]
[Sat Dec 20 15:02:20.028987 2025] [:error] [pid 18807:tid 18820] [client 3.14.82.135:61201] [client 3.14.82.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aUZJ_GRP9n5OCTllYeWzsAAAAYs"]
[Sat Dec 20 15:02:20.526963 2025] [:error] [pid 39493:tid 39555] [client 3.14.82.135:51035] [client 3.14.82.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aUZJ_GhjL2VG_FmIHqCnvwAAAIY"]
[Sat Dec 20 15:02:21.010666 2025] [:error] [pid 39493:tid 39549] [client 3.14.82.135:63202] [client 3.14.82.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aUZJ_WhjL2VG_FmIHqCnwQAAAIA"]
[Sat Dec 20 15:02:21.499639 2025] [:error] [pid 39493:tid 39562] [client 3.14.82.135:51410] [client 3.14.82.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aUZJ_WhjL2VG_FmIHqCnwgAAAI0"]
[Sat Dec 20 15:02:21.976386 2025] [:error] [pid 14286:tid 14296] [client 3.14.82.135:61180] [client 3.14.82.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aUZJ_Z7rbXIrw6rGSdYuIAAAAUY"]
[Sat Dec 20 15:02:23.732980 2025] [:error] [pid 14247:tid 14259] [client 3.14.82.135:61592] [client 3.14.82.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aUZJ_yDv9TtKKdJQn9nQuwAAAQo"]
[Sat Dec 20 21:53:54.372010 2025] [:error] [pid 14247:tid 14258] [client 85.203.34.16:26189] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Dec 20 21:53:55.001259 2025] [:error] [pid 14247:tid 14249] [client 85.203.34.16:26189] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 20 21:53:55.342021 2025] [:error] [pid 14247:tid 14253] [client 85.203.34.16:26189] [client 85.203.34.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUaqcyDv9TtKKdJQn9ksdgAAAQQ"]
[Sat Dec 20 21:53:56.029224 2025] [:error] [pid 33687:tid 33695] [client 85.203.34.22:45373] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Dec 20 21:53:56.940169 2025] [:error] [pid 33687:tid 33695] [client 85.203.34.22:45373] [client 85.203.34.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aUaqdDYMR4qK1N4g7vjmuAAAAkU"]
[Sat Dec 20 21:53:58.599316 2025] [:error] [pid 39493:tid 39556] [client 85.203.34.27:26209] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sat Dec 20 21:53:59.222650 2025] [:error] [pid 39493:tid 39562] [client 85.203.34.27:26209] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 20 21:53:59.520309 2025] [:error] [pid 39493:tid 39567] [client 85.203.34.27:26209] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:53:59.839511 2025] [:error] [pid 39493:tid 39551] [client 85.203.34.27:26209] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Dec 20 21:54:00.439099 2025] [:error] [pid 39493:tid 39566] [client 85.203.34.27:26209] [client 85.203.34.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aUaqeGhjL2VG_FmIHqAVZgAAAJE"]
[Sat Dec 20 21:54:01.087635 2025] [:error] [pid 39493:tid 39572] [client 85.203.34.1:34671] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 20 21:54:01.404181 2025] [:error] [pid 39493:tid 39566] [client 85.203.34.1:34671] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Dec 20 21:54:01.723132 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.1:34671] [client 85.203.34.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aUaqeWhjL2VG_FmIHqAVfgAAAJQ"]
[Sat Dec 20 21:54:02.361331 2025] [:error] [pid 33793:tid 33809] [client 85.203.34.39:40169] [client 85.203.34.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aUaqelSicyB0BFmbRMzrpAAAAs4"]
[Sat Dec 20 21:54:02.969225 2025] [:error] [pid 33687:tid 33702] [client 85.203.34.18:65017] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aUaqejYMR4qK1N4g7vjm4wAAAkw"]
[Sat Dec 20 21:54:03.880521 2025] [:error] [pid 33570:tid 33600] [client 85.203.34.34:57505] [client 85.203.34.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aUaqe4TNveA-c6YcSrImdgAAAdg"]
[Sat Dec 20 21:54:04.758308 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.25:42815] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aUaqfITNveA-c6YcSrImgwAAAdU"]
[Sat Dec 20 21:54:05.898876 2025] [:error] [pid 62124:tid 62127] [client 85.203.34.32:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Dec 20 21:54:06.905776 2025] [:error] [pid 62124:tid 62142] [client 85.203.34.32:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sat Dec 20 21:54:07.254391 2025] [:error] [pid 62124:tid 62132] [client 85.203.34.32:31525] [client 85.203.34.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aUaqf1s94zPA9ULQOjmZoQAAAAY"]
[Sat Dec 20 21:54:07.918780 2025] [:error] [pid 39577:tid 39582] [client 85.203.34.4:37339] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aUaqf7viRnt1rJiSOfyDtAAAAMM"]
[Sat Dec 20 21:54:08.930351 2025] [:error] [pid 33793:tid 33814] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sat Dec 20 21:54:09.262581 2025] [:error] [pid 33793:tid 33799] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Sat Dec 20 21:54:09.601765 2025] [:error] [pid 33793:tid 33808] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Dec 20 21:54:09.915613 2025] [:error] [pid 33793:tid 33807] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Dec 20 21:54:10.222803 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Sat Dec 20 21:54:10.551744 2025] [:error] [pid 33793:tid 33819] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Dec 20 21:54:10.881103 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Sat Dec 20 21:54:11.233033 2025] [:error] [pid 33793:tid 33811] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat Dec 20 21:54:11.571291 2025] [:error] [pid 33793:tid 33814] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Sat Dec 20 21:54:11.898491 2025] [:error] [pid 33793:tid 33813] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sat Dec 20 21:54:12.229270 2025] [:error] [pid 33793:tid 33805] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Sat Dec 20 21:54:12.619436 2025] [:error] [pid 33793:tid 33815] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Dec 20 21:54:13.160253 2025] [:error] [pid 33793:tid 33819] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sat Dec 20 21:54:13.483269 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Sat Dec 20 21:54:13.819814 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Sat Dec 20 21:54:14.163222 2025] [:error] [pid 33793:tid 33811] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Dec 20 21:54:14.528026 2025] [:error] [pid 33793:tid 33802] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sat Dec 20 21:54:14.846356 2025] [:error] [pid 33793:tid 33800] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Dec 20 21:54:15.201002 2025] [:error] [pid 33793:tid 33818] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Sat Dec 20 21:54:15.535064 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Dec 20 21:54:15.869140 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sat Dec 20 21:54:16.179778 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Dec 20 21:54:16.486188 2025] [:error] [pid 33793:tid 33813] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sat Dec 20 21:54:16.824692 2025] [:error] [pid 33793:tid 33815] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Dec 20 21:54:17.179247 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sat Dec 20 21:54:17.509216 2025] [:error] [pid 33793:tid 33797] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sat Dec 20 21:54:17.832877 2025] [:error] [pid 33793:tid 33810] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sat Dec 20 21:54:18.162035 2025] [:error] [pid 33793:tid 33813] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Sat Dec 20 21:54:18.498837 2025] [:error] [pid 33793:tid 33811] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Sat Dec 20 21:54:18.812993 2025] [:error] [pid 33793:tid 33818] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sat Dec 20 21:54:19.122406 2025] [:error] [pid 33793:tid 33815] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Sat Dec 20 21:54:19.447601 2025] [:error] [pid 33793:tid 33819] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Sat Dec 20 21:54:19.774706 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Dec 20 21:54:20.109399 2025] [:error] [pid 33793:tid 33812] [client 85.203.34.10:30677] [client 85.203.34.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.10, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUaqjFSicyB0BFmbRMzsHwAAAtE"]
[Sat Dec 20 21:54:20.112645 2025] [:error] [pid 33793:tid 33812] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Dec 20 21:54:20.796982 2025] [:error] [pid 33793:tid 33811] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sat Dec 20 21:54:21.111565 2025] [:error] [pid 33793:tid 33805] [client 85.203.34.10:30677] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sat Dec 20 21:54:21.439104 2025] [:error] [pid 33793:tid 33802] [client 85.203.34.10:30677] [client 85.203.34.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aUaqjVSicyB0BFmbRMzsKwAAAsc"]
[Sat Dec 20 21:54:22.074418 2025] [:error] [pid 62124:tid 62132] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Sat Dec 20 21:54:22.393530 2025] [:error] [pid 62124:tid 62131] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sat Dec 20 21:54:23.034618 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Sat Dec 20 21:54:23.340095 2025] [:error] [pid 62124:tid 62146] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Sat Dec 20 21:54:23.649124 2025] [:error] [pid 62124:tid 62130] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Sat Dec 20 21:54:23.974061 2025] [:error] [pid 62124:tid 62132] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Sat Dec 20 21:54:24.290155 2025] [:error] [pid 62124:tid 62145] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Sat Dec 20 21:54:24.631649 2025] [:error] [pid 62124:tid 62127] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Sat Dec 20 21:54:24.954694 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.8:57075] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Sat Dec 20 21:54:25.603543 2025] [:error] [pid 62124:tid 62127] [client 85.203.34.8:57075] [client 85.203.34.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aUaqkVs94zPA9ULQOjmaVwAAAAE"]
[Sat Dec 20 21:54:26.268133 2025] [:error] [pid 39577:tid 39580] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Sat Dec 20 21:54:26.609002 2025] [:error] [pid 39577:tid 39579] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Sat Dec 20 21:54:28.310645 2025] [:error] [pid 39577:tid 39590] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sat Dec 20 21:54:28.667076 2025] [:error] [pid 39577:tid 39581] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Sat Dec 20 21:54:29.006632 2025] [:error] [pid 39577:tid 39593] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Sat Dec 20 21:54:29.367722 2025] [:error] [pid 39577:tid 39583] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Sat Dec 20 21:54:29.709063 2025] [:error] [pid 39577:tid 39584] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Sat Dec 20 21:54:30.721041 2025] [:error] [pid 39577:tid 39591] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Sat Dec 20 21:54:31.059746 2025] [:error] [pid 39577:tid 39590] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Sat Dec 20 21:54:31.380900 2025] [:error] [pid 39577:tid 39592] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Sat Dec 20 21:54:31.689411 2025] [:error] [pid 39577:tid 39587] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Sat Dec 20 21:54:32.012584 2025] [:error] [pid 39577:tid 39594] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Sat Dec 20 21:54:32.311487 2025] [:error] [pid 39577:tid 39601] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Sat Dec 20 21:54:32.653130 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Sat Dec 20 21:54:33.289704 2025] [:error] [pid 39577:tid 39587] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Sat Dec 20 21:54:33.603942 2025] [:error] [pid 39577:tid 39579] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Sat Dec 20 21:54:34.234245 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.45:24753] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Sat Dec 20 21:54:34.553455 2025] [:error] [pid 39577:tid 39588] [client 85.203.34.45:24753] [client 85.203.34.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h0110w4y.php"] [unique_id "aUaqmrviRnt1rJiSOfyEsAAAAMk"]
[Sat Dec 20 21:54:35.137717 2025] [:error] [pid 39493:tid 39572] [client 85.203.34.24:36833] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Sat Dec 20 21:54:35.468130 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.24:36833] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Sat Dec 20 21:54:35.792033 2025] [:error] [pid 39493:tid 39553] [client 85.203.34.24:36833] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Dec 20 21:54:36.082503 2025] [:error] [pid 39493:tid 39554] [client 85.203.34.24:36833] [client 85.203.34.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-db.php"] [unique_id "aUaqnGhjL2VG_FmIHqAWugAAAIU"]
[Sat Dec 20 21:54:36.720849 2025] [:error] [pid 33570:tid 33592] [client 185.92.25.138:51971] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Sat Dec 20 21:54:37.038494 2025] [:error] [pid 33570:tid 33579] [client 185.92.25.138:51971] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/lx.php"] [unique_id "aUaqnYTNveA-c6YcSrIngQAAAcM"]
[Sat Dec 20 21:54:38.309894 2025] [:error] [pid 14247:tid 14262] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Sat Dec 20 21:54:38.657687 2025] [:error] [pid 14247:tid 14263] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Sat Dec 20 21:54:39.013838 2025] [:error] [pid 14247:tid 14256] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Sat Dec 20 21:54:39.353101 2025] [:error] [pid 14247:tid 14252] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Sat Dec 20 21:54:39.663926 2025] [:error] [pid 14247:tid 14261] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Sat Dec 20 21:54:39.990721 2025] [:error] [pid 14247:tid 14262] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sat Dec 20 21:54:40.291512 2025] [:error] [pid 14247:tid 14250] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Sat Dec 20 21:54:40.595858 2025] [:error] [pid 14247:tid 14252] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Sat Dec 20 21:54:40.907972 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Sat Dec 20 21:54:41.254908 2025] [:error] [pid 14247:tid 14256] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Sat Dec 20 21:54:41.580025 2025] [:error] [pid 14247:tid 14253] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Dec 20 21:54:41.910894 2025] [:error] [pid 14247:tid 14267] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Sat Dec 20 21:54:42.238750 2025] [:error] [pid 14247:tid 14272] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Sat Dec 20 21:54:42.571668 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Sat Dec 20 21:54:42.895984 2025] [:error] [pid 14247:tid 14263] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Sat Dec 20 21:54:43.197578 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Sat Dec 20 21:54:43.517560 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Sat Dec 20 21:54:43.823739 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Sat Dec 20 21:54:46.465905 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Sat Dec 20 21:54:46.799850 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Sat Dec 20 21:54:47.158818 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Sat Dec 20 21:54:47.466479 2025] [:error] [pid 14247:tid 14268] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Dec 20 21:54:47.768005 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Sat Dec 20 21:54:48.285949 2025] [:error] [pid 14247:tid 14269] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Sat Dec 20 21:54:48.594915 2025] [:error] [pid 14247:tid 14272] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Sat Dec 20 21:54:48.911911 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Dec 20 21:54:51.794967 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Sat Dec 20 21:54:52.126249 2025] [:error] [pid 14247:tid 14267] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Dec 20 21:54:52.426887 2025] [:error] [pid 14247:tid 14249] [client 85.203.34.46:59437] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Sat Dec 20 21:54:58.814341 2025] [:error] [pid 14247:tid 14260] [client 85.203.34.46:59437] [client 85.203.34.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aUaqsiDv9TtKKdJQn9kufwAAAQs"]
[Sat Dec 20 21:54:59.794119 2025] [:error] [pid 39577:tid 39585] [client 85.203.34.15:59047] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Sat Dec 20 21:55:02.878283 2025] [:error] [pid 39577:tid 39603] [client 85.203.34.15:59047] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Sat Dec 20 21:55:03.205064 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.15:59047] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Sat Dec 20 21:55:03.539079 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.15:59047] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Sat Dec 20 21:55:04.524782 2025] [:error] [pid 39577:tid 39585] [client 85.203.34.15:59047] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Sat Dec 20 21:55:06.468692 2025] [:error] [pid 39577:tid 39596] [client 85.203.34.15:59047] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Sat Dec 20 21:55:06.801052 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.15:59047] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sat Dec 20 21:55:07.123811 2025] [:error] [pid 39577:tid 39603] [client 85.203.34.15:59047] [client 85.203.34.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.api.php"] [unique_id "aUaqu7viRnt1rJiSOfyFtwAAANg"]
[Sat Dec 20 21:55:07.742978 2025] [:error] [pid 33749:tid 33756] [client 185.92.25.138:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sat Dec 20 21:55:08.116187 2025] [:error] [pid 33749:tid 33759] [client 185.92.25.138:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sat Dec 20 21:55:08.429232 2025] [:error] [pid 33749:tid 33763] [client 185.92.25.138:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sat Dec 20 21:55:08.743065 2025] [:error] [pid 33749:tid 33764] [client 185.92.25.138:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Sat Dec 20 21:55:09.347486 2025] [:error] [pid 33749:tid 33754] [client 185.92.25.138:32671] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUaqvdoInXJnb96wei-QzQAAAoM"]
[Sat Dec 20 21:55:09.970694 2025] [:error] [pid 14286:tid 14294] [client 85.203.34.4:61761] [client 85.203.34.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.34.4, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUaqvZ7rbXIrw6rGSdaiqAAAAUQ"]
[Sat Dec 20 21:55:09.973977 2025] [:error] [pid 14286:tid 14294] [client 85.203.34.4:61761] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Dec 20 21:55:10.298632 2025] [:error] [pid 14286:tid 14310] [client 85.203.34.4:61761] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sat Dec 20 21:55:10.962341 2025] [:error] [pid 14286:tid 14293] [client 85.203.34.4:61761] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUaqvp7rbXIrw6rGSdaisgAAAUM"]
[Sat Dec 20 21:55:11.963797 2025] [:error] [pid 33687:tid 33706] [client 85.203.34.40:62177] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Sat Dec 20 21:55:13.595270 2025] [:error] [pid 33687:tid 33703] [client 85.203.34.40:62177] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 20 21:55:14.242209 2025] [:error] [pid 33687:tid 33693] [client 85.203.34.40:62177] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sat Dec 20 21:55:14.553972 2025] [:error] [pid 33687:tid 33708] [client 85.203.34.40:62177] [client 85.203.34.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUaqwjYMR4qK1N4g7vjpHgAAAlI"]
[Sat Dec 20 21:55:15.155656 2025] [:error] [pid 33687:tid 33698] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Sat Dec 20 21:55:15.464787 2025] [:error] [pid 33687:tid 33700] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Sat Dec 20 21:55:15.790935 2025] [:error] [pid 33687:tid 33703] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Sat Dec 20 21:55:17.076156 2025] [:error] [pid 33687:tid 33704] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Sat Dec 20 21:55:17.402335 2025] [:error] [pid 33687:tid 33705] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 20 21:55:17.709821 2025] [:error] [pid 33687:tid 33693] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 20 21:55:18.042711 2025] [:error] [pid 33687:tid 33708] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Sat Dec 20 21:55:19.668011 2025] [:error] [pid 33687:tid 33712] [client 85.203.34.16:31309] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sat Dec 20 21:55:20.347010 2025] [:error] [pid 33687:tid 33706] [client 85.203.34.16:31309] [client 85.203.34.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aUaqyDYMR4qK1N4g7vjpNgAAAlA"]
[Sat Dec 20 21:55:20.958755 2025] [:error] [pid 14247:tid 14251] [client 85.203.34.35:47277] [client 85.203.34.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUaqyCDv9TtKKdJQn9kvIwAAAQI"]
[Sat Dec 20 21:55:21.588598 2025] [:error] [pid 33570:tid 33584] [client 185.92.25.138:42247] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aUaqyYTNveA-c6YcSrIocQAAAcg"]
[Sat Dec 20 21:55:22.299924 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.36:29903] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aUaqyls94zPA9ULQOjmcBgAAABY"]
[Sat Dec 20 21:55:22.947299 2025] [:error] [pid 39493:tid 39565] [client 85.203.34.22:59957] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Sat Dec 20 21:55:23.309717 2025] [:error] [pid 39493:tid 39551] [client 85.203.34.22:59957] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Sat Dec 20 21:55:23.968349 2025] [:error] [pid 39493:tid 39558] [client 85.203.34.22:59957] [client 85.203.34.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.22, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aUaqy2hjL2VG_FmIHqAYWAAAAIk"]
[Sat Dec 20 21:55:25.811484 2025] [:error] [pid 39493:tid 39558] [client 85.203.34.22:59957] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sat Dec 20 21:55:26.475990 2025] [:error] [pid 39493:tid 39550] [client 85.203.34.22:59957] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Dec 20 21:55:28.435349 2025] [:error] [pid 39493:tid 39573] [client 85.203.34.22:59957] [client 85.203.34.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aUaq0GhjL2VG_FmIHqAYfwAAAJg"]
[Sat Dec 20 21:55:29.152164 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.36:33945] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Dec 20 21:55:30.136662 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.36:33945] [client 85.203.34.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.36, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aUaq0rviRnt1rJiSOfyGRAAAANI"]
[Sat Dec 20 21:55:30.472682 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.36:33945] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Sat Dec 20 21:55:31.241230 2025] [:error] [pid 39577:tid 39585] [client 85.203.34.36:33945] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Sat Dec 20 21:55:31.566492 2025] [:error] [pid 39577:tid 39582] [client 85.203.34.36:33945] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Sat Dec 20 21:55:32.171372 2025] [:error] [pid 39577:tid 39593] [client 85.203.34.36:33945] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Dec 20 21:55:32.503379 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.36:33945] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sat Dec 20 21:55:32.825033 2025] [:error] [pid 39577:tid 39590] [client 85.203.34.36:33945] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aUaq1LviRnt1rJiSOfyGXAAAAMs"]
[Sat Dec 20 21:55:33.428563 2025] [:error] [pid 62124:tid 62126] [client 85.203.34.29:41839] [client 85.203.34.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aUaq1Vs94zPA9ULQOjmcVgAAAAA"]
[Sat Dec 20 21:55:34.039947 2025] [:error] [pid 62124:tid 62138] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Sat Dec 20 21:55:34.357443 2025] [:error] [pid 62124:tid 62136] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sat Dec 20 21:55:34.688841 2025] [:error] [pid 62124:tid 62131] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sat Dec 20 21:55:35.030272 2025] [:error] [pid 62124:tid 62143] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Dec 20 21:55:35.674461 2025] [:error] [pid 62124:tid 62136] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Sat Dec 20 21:55:36.992353 2025] [:error] [pid 62124:tid 62145] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/zmFM.php
[Sat Dec 20 21:55:39.944958 2025] [:error] [pid 62124:tid 62128] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Sat Dec 20 21:55:40.286283 2025] [:error] [pid 62124:tid 62134] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Dec 20 21:55:40.592208 2025] [:error] [pid 62124:tid 62135] [client 85.203.34.15:30417] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Sat Dec 20 21:55:41.202341 2025] [:error] [pid 62124:tid 62146] [client 85.203.34.15:30417] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUaq3Vs94zPA9ULQOjmcpgAAABQ"]
[Sat Dec 20 21:55:43.308331 2025] [:error] [pid 62124:tid 62146] [client 85.203.34.29:53425] [client 85.203.34.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bak.php"] [unique_id "aUaq31s94zPA9ULQOjmcxgAAABQ"]
[Sat Dec 20 21:55:43.907045 2025] [:error] [pid 33687:tid 33698] [client 85.203.34.38:50589] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sat Dec 20 21:55:44.212628 2025] [:error] [pid 33687:tid 33704] [client 85.203.34.38:50589] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUaq4DYMR4qK1N4g7vjpxAAAAk4"]
[Sat Dec 20 21:55:46.485902 2025] [:error] [pid 14247:tid 14258] [client 85.203.34.48:63349] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Sat Dec 20 21:55:47.142636 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.48:63349] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Dec 20 21:55:47.461871 2025] [:error] [pid 14247:tid 14256] [client 85.203.34.48:63349] [client 85.203.34.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aUaq4yDv9TtKKdJQn9kvowAAAQc"]
[Sat Dec 20 21:55:48.098626 2025] [:error] [pid 33687:tid 33699] [client 85.203.34.28:63687] [client 85.203.34.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUaq5DYMR4qK1N4g7vjp3QAAAkk"]
[Sat Dec 20 21:55:48.751415 2025] [:error] [pid 39493:tid 39552] [client 85.203.34.10:58081] [client 85.203.34.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.10, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aUaq5GhjL2VG_FmIHqAZBAAAAIM"]
[Sat Dec 20 21:55:49.078611 2025] [:error] [pid 39493:tid 39560] [client 85.203.34.10:58081] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sat Dec 20 21:55:49.717342 2025] [:error] [pid 39493:tid 39573] [client 85.203.34.10:58081] [client 85.203.34.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/themes.php"] [unique_id "aUaq5WhjL2VG_FmIHqAZCwAAAJg"]
[Sat Dec 20 21:55:50.346125 2025] [:error] [pid 33844:tid 33867] [client 85.203.34.15:55841] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:55:50.966501 2025] [:error] [pid 33844:tid 33849] [client 85.203.34.15:55841] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Sat Dec 20 21:55:52.540603 2025] [:error] [pid 33844:tid 33853] [client 85.203.34.15:55841] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aUaq6CaNtwGsyqqVmQES8gAAAwc"]
[Sat Dec 20 21:55:53.188167 2025] [:error] [pid 14247:tid 14265] [client 85.203.34.20:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Dec 20 21:55:53.808456 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.20:53303] [client 85.203.34.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aUaq6SDv9TtKKdJQn9kvtwAAARY"]
[Sat Dec 20 21:55:54.726686 2025] [:error] [pid 33793:tid 33800] [client 85.203.34.33:54979] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Sat Dec 20 21:55:55.043377 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.33:54979] [client 85.203.34.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aUaq61SicyB0BFmbRMzvXAAAAsk"]
[Sat Dec 20 21:55:56.289488 2025] [:error] [pid 14247:tid 14255] [client 85.203.34.48:49841] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Sat Dec 20 21:55:56.597351 2025] [:error] [pid 14247:tid 14259] [client 85.203.34.48:49841] [client 85.203.34.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.48, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aUaq7CDv9TtKKdJQn9kvwwAAAQo"]
[Sat Dec 20 21:55:57.550848 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.48:49841] [client 85.203.34.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aUaq7SDv9TtKKdJQn9kvygAAAQg"]
[Sat Dec 20 21:55:58.173345 2025] [:error] [pid 14247:tid 14260] [client 85.203.34.43:22489] [client 85.203.34.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUaq7iDv9TtKKdJQn9kvzQAAAQs"]
[Sat Dec 20 21:55:59.786172 2025] [:error] [pid 14247:tid 14264] [client 85.203.34.4:60227] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sat Dec 20 21:56:00.924912 2025] [:error] [pid 14247:tid 14251] [client 85.203.34.4:60227] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Sat Dec 20 21:56:01.597282 2025] [:error] [pid 14247:tid 14249] [client 85.203.34.4:60227] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Dec 20 21:56:01.921347 2025] [:error] [pid 14247:tid 14266] [client 85.203.34.4:60227] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Sat Dec 20 21:56:02.597295 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.4:60227] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aUaq8iDv9TtKKdJQn9kv8AAAARg"]
[Sat Dec 20 21:56:03.885297 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.39:24225] [client 85.203.34.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUaq89oInXJnb96wei-SNgAAAoo"]
[Sat Dec 20 21:56:04.461347 2025] [:error] [pid 39493:tid 39550] [client 85.203.34.47:20227] [client 85.203.34.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aUaq9GhjL2VG_FmIHqAZdQAAAIE"]
[Sat Dec 20 21:56:05.081782 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.11:51077] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aUaq9YTNveA-c6YcSrIpbQAAAdU"]
[Sat Dec 20 21:56:06.026661 2025] [:error] [pid 33570:tid 33580] [client 85.203.34.23:21771] [client 85.203.34.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aUaq9oTNveA-c6YcSrIpbwAAAcQ"]
[Sat Dec 20 21:56:07.887825 2025] [:error] [pid 33844:tid 33851] [client 85.203.34.24:35443] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Sat Dec 20 21:56:08.185031 2025] [:error] [pid 33844:tid 33849] [client 85.203.34.24:35443] [client 85.203.34.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aUaq-CaNtwGsyqqVmQETFAAAAwM"]
[Sat Dec 20 21:56:09.101926 2025] [:error] [pid 33687:tid 33702] [client 85.203.34.29:24005] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Dec 20 21:56:09.422156 2025] [:error] [pid 33687:tid 33710] [client 85.203.34.29:24005] File does not exist: /usr/local/apache/htdocs/suspended-page/rcc.php
[Sat Dec 20 21:56:09.737736 2025] [:error] [pid 33687:tid 33706] [client 85.203.34.29:24005] [client 85.203.34.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUaq-TYMR4qK1N4g7vjqGwAAAlA"]
[Sat Dec 20 21:56:10.340146 2025] [:error] [pid 33749:tid 33775] [client 85.203.34.45:51349] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sat Dec 20 21:56:10.668452 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.45:51349] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Sat Dec 20 21:56:10.960560 2025] [:error] [pid 33749:tid 33760] [client 85.203.34.45:51349] [client 85.203.34.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUaq-toInXJnb96wei-SYAAAAok"]
[Sat Dec 20 21:56:11.569919 2025] [:error] [pid 39493:tid 39564] [client 85.203.34.49:36887] File does not exist: /usr/local/apache/htdocs/suspended-page/history.php
[Sat Dec 20 21:56:11.884708 2025] [:error] [pid 39493:tid 39554] [client 85.203.34.49:36887] [client 85.203.34.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aUaq-2hjL2VG_FmIHqAZpgAAAIU"]
[Sat Dec 20 21:56:13.486766 2025] [:error] [pid 39577:tid 39594] [client 85.203.34.31:39717] [client 85.203.34.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aUaq_bviRnt1rJiSOfyHtQAAAM8"]
[Sat Dec 20 21:56:14.124374 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.43:47609] [client 85.203.34.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aUaq_toInXJnb96wei-ScgAAAoM"]
[Sat Dec 20 21:56:15.078304 2025] [:error] [pid 33844:tid 33858] [client 185.92.25.139:55423] [client 185.92.25.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aUaq_yaNtwGsyqqVmQETIQAAAww"]
[Sat Dec 20 21:56:15.731975 2025] [:error] [pid 33687:tid 33694] [client 85.203.34.32:30395] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 21:56:16.366486 2025] [:error] [pid 33687:tid 33697] [client 85.203.34.32:30395] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Dec 20 21:56:16.699244 2025] [:error] [pid 33687:tid 33703] [client 85.203.34.32:30395] [client 85.203.34.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.32, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUarADYMR4qK1N4g7vjqVgAAAk0"]
[Sat Dec 20 21:56:17.353248 2025] [:error] [pid 33687:tid 33694] [client 85.203.34.32:30395] [client 85.203.34.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aUarATYMR4qK1N4g7vjqXQAAAkQ"]
[Sat Dec 20 21:56:17.998607 2025] [:error] [pid 33844:tid 33869] [client 85.203.34.47:50979] [client 85.203.34.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aUarASaNtwGsyqqVmQETJQAAAxc"]
[Sat Dec 20 21:56:18.694848 2025] [:error] [pid 62124:tid 62141] [client 85.203.34.38:23075] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sat Dec 20 21:56:19.024219 2025] [:error] [pid 62124:tid 62131] [client 85.203.34.38:23075] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sat Dec 20 21:56:20.570955 2025] [:error] [pid 62124:tid 62136] [client 85.203.34.38:23075] File does not exist: /usr/local/apache/htdocs/suspended-page/login.php
[Sat Dec 20 21:56:21.561301 2025] [:error] [pid 62124:tid 62145] [client 85.203.34.38:23075] [client 85.203.34.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.38, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aUarBVs94zPA9ULQOjmdvgAAABM"]
[Sat Dec 20 21:56:21.869460 2025] [:error] [pid 62124:tid 62143] [client 85.203.34.38:23075] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aUarBVs94zPA9ULQOjmdwgAAABE"]
[Sat Dec 20 21:56:22.465086 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.47:52075] [client 85.203.34.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aUarBtoInXJnb96wei-SngAAApE"]
[Sat Dec 20 21:56:23.134438 2025] [:error] [pid 33793:tid 33796] [client 85.203.34.7:50789] [client 85.203.34.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aUarB1SicyB0BFmbRMzv6gAAAsE"]
[Sat Dec 20 21:56:24.720358 2025] [:error] [pid 33687:tid 33705] [client 85.203.34.11:25389] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Sat Dec 20 21:56:25.029248 2025] [:error] [pid 33687:tid 33708] [client 85.203.34.11:25389] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aUarCTYMR4qK1N4g7vjqggAAAlI"]
[Sat Dec 20 21:56:26.271509 2025] [:error] [pid 33844:tid 33853] [client 85.203.34.47:32145] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Sat Dec 20 21:56:27.933420 2025] [:error] [pid 33844:tid 33852] [client 85.203.34.47:32145] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 20 21:56:28.917488 2025] [:error] [pid 33844:tid 33850] [client 85.203.34.47:32145] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Sat Dec 20 21:56:29.251678 2025] [:error] [pid 33844:tid 33864] [client 85.203.34.47:32145] [client 85.203.34.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUarDSaNtwGsyqqVmQETNwAAAxI"]
[Sat Dec 20 21:56:30.189474 2025] [:error] [pid 14247:tid 14262] [client 85.203.34.13:25093] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Sat Dec 20 21:56:30.931103 2025] [:error] [pid 14247:tid 14259] [client 85.203.34.13:25093] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUarDiDv9TtKKdJQn9kwagAAAQo"]
[Sat Dec 20 21:56:31.945655 2025] [:error] [pid 62124:tid 62136] [client 85.203.34.44:57719] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Dec 20 21:56:33.184466 2025] [:error] [pid 62124:tid 62150] [client 85.203.34.44:57719] [client 85.203.34.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aUarEVs94zPA9ULQOjmd_wAAABg"]
[Sat Dec 20 21:56:34.285074 2025] [:error] [pid 14286:tid 14310] [client 85.203.34.17:50503] [client 85.203.34.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aUarEp7rbXIrw6rGSdalFQAAAVQ"]
[Sat Dec 20 21:56:35.274358 2025] [:error] [pid 14286:tid 14291] [client 85.203.34.28:61097] [client 85.203.34.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUarE57rbXIrw6rGSdalGwAAAUE"]
[Sat Dec 20 21:56:36.236308 2025] [:error] [pid 14286:tid 14310] [client 85.203.34.19:48021] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aUarFJ7rbXIrw6rGSdalIgAAAVQ"]
[Sat Dec 20 21:56:37.204350 2025] [:error] [pid 39493:tid 39555] [client 85.203.34.25:64951] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aUarFWhjL2VG_FmIHqAaSAAAAIY"]
[Sat Dec 20 21:56:38.503290 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.4:32735] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aUarFrviRnt1rJiSOfyIEwAAANI"]
[Sat Dec 20 21:56:39.517047 2025] [:error] [pid 33793:tid 33817] [client 85.203.34.22:25821] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Dec 20 21:56:40.192667 2025] [:error] [pid 33793:tid 33797] [client 85.203.34.22:25821] [client 85.203.34.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aUarGFSicyB0BFmbRMzwPwAAAsI"]
[Sat Dec 20 21:56:41.190961 2025] [:error] [pid 33687:tid 33695] [client 85.203.34.26:31131] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Sat Dec 20 21:56:41.531346 2025] [:error] [pid 33687:tid 33700] [client 85.203.34.26:31131] File does not exist: /usr/local/apache/htdocs/suspended-page/conf_upload.php
[Sat Dec 20 21:56:41.846569 2025] [:error] [pid 33687:tid 33698] [client 85.203.34.26:31131] [client 85.203.34.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aUarGTYMR4qK1N4g7vjq0AAAAkg"]
[Sat Dec 20 21:56:43.142822 2025] [:error] [pid 33793:tid 33808] [client 85.203.34.13:21161] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aUarG1SicyB0BFmbRMzwSAAAAs0"]
[Sat Dec 20 21:56:43.787310 2025] [:error] [pid 14247:tid 14266] [client 85.203.34.50:41667] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sat Dec 20 21:56:44.463679 2025] [:error] [pid 14247:tid 14265] [client 85.203.34.50:41667] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sat Dec 20 21:56:45.109729 2025] [:error] [pid 14247:tid 14250] [client 85.203.34.50:41667] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Dec 20 21:56:45.446399 2025] [:error] [pid 14247:tid 14263] [client 85.203.34.50:41667] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aUarHSDv9TtKKdJQn9kwhwAAAQ4"]
[Sat Dec 20 21:56:46.326024 2025] [:error] [pid 14286:tid 14301] [client 85.203.34.7:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Dec 20 21:56:47.280081 2025] [:error] [pid 14286:tid 14313] [client 85.203.34.7:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sat Dec 20 21:56:47.834751 2025] [:error] [pid 14286:tid 14313] [client 85.203.34.7:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sat Dec 20 21:56:48.881279 2025] [:error] [pid 14286:tid 14299] [client 85.203.34.7:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sat Dec 20 21:56:49.181320 2025] [:error] [pid 14286:tid 14306] [client 85.203.34.7:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Sat Dec 20 21:56:50.498772 2025] [:error] [pid 14286:tid 14296] [client 85.203.34.7:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Sat Dec 20 21:56:50.812508 2025] [:error] [pid 14286:tid 14295] [client 85.203.34.7:55401] [client 85.203.34.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aUarIp7rbXIrw6rGSdalgQAAAUU"]
[Sat Dec 20 21:56:51.424502 2025] [:error] [pid 14286:tid 14308] [client 85.203.34.25:29911] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aUarI57rbXIrw6rGSdalhAAAAVI"]
[Sat Dec 20 21:56:52.094848 2025] [:error] [pid 33570:tid 33600] [client 85.203.34.18:58101] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 20 21:56:53.551372 2025] [:error] [pid 33570:tid 33600] [client 85.203.34.18:58101] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Dec 20 21:56:53.867946 2025] [:error] [pid 33570:tid 33576] [client 85.203.34.18:58101] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Dec 20 21:56:54.185325 2025] [:error] [pid 33570:tid 33585] [client 85.203.34.18:58101] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aUarJoTNveA-c6YcSrIqoAAAAck"]
[Sat Dec 20 21:56:54.824598 2025] [:error] [pid 39577:tid 39587] [client 85.203.34.40:35259] [client 85.203.34.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUarJrviRnt1rJiSOfyITQAAAMg"]
[Sat Dec 20 21:56:55.468444 2025] [:error] [pid 33749:tid 33762] [client 85.203.34.17:44839] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Dec 20 21:56:55.785210 2025] [:error] [pid 33749:tid 33774] [client 85.203.34.17:44839] [client 85.203.34.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aUarJ9oInXJnb96wei-TPQAAApc"]
[Sat Dec 20 21:56:56.389233 2025] [:error] [pid 33793:tid 33808] [client 85.203.34.19:56545] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Sat Dec 20 21:56:56.685615 2025] [:error] [pid 33793:tid 33799] [client 85.203.34.19:56545] File does not exist: /usr/local/apache/htdocs/suspended-page/sck.php
[Sat Dec 20 21:56:57.015540 2025] [:error] [pid 33793:tid 33796] [client 85.203.34.19:56545] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Sat Dec 20 21:56:57.682435 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.19:56545] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Sat Dec 20 21:56:58.010667 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.19:56545] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 21:56:58.336407 2025] [:error] [pid 33793:tid 33803] [client 85.203.34.19:56545] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aUarKlSicyB0BFmbRMzwdwAAAsg"]
[Sat Dec 20 21:56:59.296568 2025] [:error] [pid 39577:tid 39603] [client 85.203.34.11:38861] [client 85.203.34.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.11, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUarK7viRnt1rJiSOfyIZAAAANg"]
[Sat Dec 20 21:56:59.603927 2025] [:error] [pid 39577:tid 39599] [client 85.203.34.11:38861] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sat Dec 20 21:56:59.935501 2025] [:error] [pid 39577:tid 39598] [client 85.203.34.11:38861] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUarK7viRnt1rJiSOfyIagAAANM"]
[Sat Dec 20 21:57:00.485381 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.15:48063] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aUarLLviRnt1rJiSOfyIbQAAAMc"]
[Sat Dec 20 21:57:01.652405 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.37:30115] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:57:03.658612 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.37:30115] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Sat Dec 20 21:57:03.968424 2025] [:error] [pid 33570:tid 33590] [client 85.203.34.37:30115] [client 85.203.34.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aUarL4TNveA-c6YcSrIq0AAAAc4"]
[Sat Dec 20 21:57:04.594327 2025] [:error] [pid 33687:tid 33707] [client 85.203.34.48:51779] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Sat Dec 20 21:57:04.897337 2025] [:error] [pid 33687:tid 33691] [client 85.203.34.48:51779] [client 85.203.34.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aUarMDYMR4qK1N4g7vjrCwAAAkE"]
[Sat Dec 20 21:57:05.836801 2025] [:error] [pid 33844:tid 33851] [client 85.203.34.23:22693] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Dec 20 21:57:06.121920 2025] [:error] [pid 33844:tid 33852] [client 85.203.34.23:22693] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sat Dec 20 21:57:06.410233 2025] [:error] [pid 33844:tid 33853] [client 85.203.34.23:22693] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/cloud.php
[Sat Dec 20 21:57:07.897465 2025] [:error] [pid 33844:tid 33864] [client 85.203.34.23:22693] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Sat Dec 20 21:57:08.200101 2025] [:error] [pid 33844:tid 33857] [client 85.203.34.23:22693] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/class_api.php
[Sat Dec 20 21:57:08.787306 2025] [:error] [pid 33844:tid 33856] [client 85.203.34.23:22693] [client 85.203.34.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aUarNCaNtwGsyqqVmQETmAAAAwo"]
[Sat Dec 20 21:57:09.376645 2025] [:error] [pid 14247:tid 14262] [client 85.203.34.9:30139] File does not exist: /usr/local/apache/htdocs/suspended-page/base.php
[Sat Dec 20 21:57:10.020650 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.9:30139] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Sat Dec 20 21:57:10.340369 2025] [:error] [pid 14247:tid 14259] [client 85.203.34.9:30139] [client 85.203.34.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aUarNiDv9TtKKdJQn9kwwAAAAQo"]
[Sat Dec 20 21:57:11.388721 2025] [:error] [pid 62124:tid 62135] [client 85.203.34.8:61271] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sat Dec 20 21:57:11.696336 2025] [:error] [pid 62124:tid 62143] [client 85.203.34.8:61271] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Dec 20 21:57:12.007336 2025] [:error] [pid 62124:tid 62131] [client 85.203.34.8:61271] [client 85.203.34.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.8, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUarOFs94zPA9ULQOjmegwAAAAU"]
[Sat Dec 20 21:57:12.011875 2025] [:error] [pid 62124:tid 62131] [client 85.203.34.8:61271] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sat Dec 20 21:57:12.900153 2025] [:error] [pid 62124:tid 62138] [client 85.203.34.8:61271] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Sat Dec 20 21:57:13.194708 2025] [:error] [pid 62124:tid 62134] [client 85.203.34.8:61271] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 20 21:57:13.828569 2025] [:error] [pid 62124:tid 62132] [client 85.203.34.8:61271] [client 85.203.34.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mah.php"] [unique_id "aUarOVs94zPA9ULQOjmelAAAAAY"]
[Sat Dec 20 21:57:14.408383 2025] [:error] [pid 33570:tid 33586] [client 85.203.34.8:52021] [client 85.203.34.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.8, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aUarOoTNveA-c6YcSrIrBwAAAco"]
[Sat Dec 20 21:57:14.712534 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.8:52021] [client 85.203.34.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aUarOoTNveA-c6YcSrIrCgAAAdU"]
[Sat Dec 20 21:57:17.102213 2025] [:error] [pid 39577:tid 39582] [client 185.92.25.138:40029] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sat Dec 20 21:57:18.044296 2025] [:error] [pid 39577:tid 39584] [client 185.92.25.138:40029] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aUarPrviRnt1rJiSOfyIpQAAAMU"]
[Sat Dec 20 21:57:18.601344 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.22:64545] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Dec 20 21:57:19.179854 2025] [:error] [pid 39577:tid 39592] [client 85.203.34.22:64545] [client 85.203.34.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aUarP7viRnt1rJiSOfyIrAAAAM0"]
[Sat Dec 20 21:57:19.995609 2025] [:error] [pid 39577:tid 39596] [client 85.203.34.47:40137] [client 85.203.34.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.47, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aUarP7viRnt1rJiSOfyIsAAAANE"]
[Sat Dec 20 21:57:20.881039 2025] [:error] [pid 39577:tid 39594] [client 85.203.34.47:40137] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sat Dec 20 21:57:21.187045 2025] [:error] [pid 39577:tid 39584] [client 85.203.34.47:40137] File does not exist: /usr/local/apache/htdocs/suspended-page/bulk.php
[Sat Dec 20 21:57:21.492785 2025] [:error] [pid 39577:tid 39603] [client 85.203.34.47:40137] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Sat Dec 20 21:57:22.083254 2025] [:error] [pid 39577:tid 39581] [client 85.203.34.47:40137] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logout.php
[Sat Dec 20 21:57:22.381458 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.47:40137] [client 85.203.34.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aUarQrviRnt1rJiSOfyIuwAAAMo"]
[Sat Dec 20 21:57:23.260634 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.38:58457] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/packed.php"] [unique_id "aUarQ1SicyB0BFmbRMzwuAAAAsk"]
[Sat Dec 20 21:57:23.851012 2025] [:error] [pid 33570:tid 33580] [client 85.203.34.38:59793] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 20 21:57:24.135772 2025] [:error] [pid 33570:tid 33590] [client 85.203.34.38:59793] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sat Dec 20 21:57:25.206243 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.38:59793] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sat Dec 20 21:57:25.493772 2025] [:error] [pid 33570:tid 33590] [client 85.203.34.38:59793] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-simple.php
[Sat Dec 20 21:57:26.600325 2025] [:error] [pid 33570:tid 33586] [client 85.203.34.38:59793] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aUarRoTNveA-c6YcSrIrUQAAAco"]
[Sat Dec 20 21:57:27.450661 2025] [:error] [pid 39493:tid 39566] [client 185.92.25.139:48957] [client 185.92.25.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aUarR2hjL2VG_FmIHqAaywAAAJE"]
[Sat Dec 20 21:57:28.337342 2025] [:error] [pid 14286:tid 14304] [client 85.203.34.28:60111] [client 85.203.34.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aUarSJ7rbXIrw6rGSdampwAAAU4"]
[Sat Dec 20 21:57:28.915783 2025] [:error] [pid 33844:tid 33868] [client 85.203.34.32:25973] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sat Dec 20 21:57:30.312427 2025] [:error] [pid 33844:tid 33860] [client 85.203.34.32:25973] [client 85.203.34.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.32, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aUarSiaNtwGsyqqVmQETwQAAAw4"]
[Sat Dec 20 21:57:30.613325 2025] [:error] [pid 33844:tid 33847] [client 85.203.34.32:25973] [client 85.203.34.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUarSiaNtwGsyqqVmQETwgAAAwE"]
[Sat Dec 20 21:57:32.373740 2025] [:error] [pid 62124:tid 62126] [client 85.203.34.50:23277] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Sat Dec 20 21:57:32.660901 2025] [:error] [pid 62124:tid 62145] [client 85.203.34.50:23277] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sat Dec 20 21:57:33.238629 2025] [:error] [pid 62124:tid 62150] [client 85.203.34.50:23277] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUarTVs94zPA9ULQOjme1AAAABg"]
[Sat Dec 20 21:57:33.820305 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.43:26475] [client 85.203.34.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aUarTWhjL2VG_FmIHqAa6gAAAJQ"]
[Sat Dec 20 21:57:34.417627 2025] [:error] [pid 39493:tid 39566] [client 85.203.34.15:24693] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Sat Dec 20 21:57:35.617115 2025] [:error] [pid 39493:tid 39563] [client 85.203.34.15:24693] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/moon.php
[Sat Dec 20 21:57:36.530866 2025] [:error] [pid 39493:tid 39571] [client 85.203.34.15:24693] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/dropdown.php
[Sat Dec 20 21:57:36.825331 2025] [:error] [pid 39493:tid 39554] [client 85.203.34.15:24693] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aUarUGhjL2VG_FmIHqAbBAAAAIU"]
[Sat Dec 20 21:57:37.428479 2025] [:error] [pid 39493:tid 39561] [client 85.203.34.34:57213] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 21:57:37.754727 2025] [:error] [pid 39493:tid 39551] [client 85.203.34.34:57213] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Sat Dec 20 21:57:38.385875 2025] [:error] [pid 39493:tid 39556] [client 85.203.34.34:57213] [client 85.203.34.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/votes.php"] [unique_id "aUarUmhjL2VG_FmIHqAbDgAAAIc"]
[Sat Dec 20 21:57:40.282885 2025] [:error] [pid 39577:tid 39600] [client 85.203.34.46:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/sk.php
[Sat Dec 20 21:57:40.916706 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.46:29051] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/blurbs.php
[Sat Dec 20 21:57:41.540679 2025] [:error] [pid 39577:tid 39595] [client 85.203.34.46:29051] [client 85.203.34.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "aUarVbviRnt1rJiSOfyI1QAAANA"]
[Sat Dec 20 21:57:43.387318 2025] [:error] [pid 33749:tid 33759] [client 85.203.34.37:35971] [client 85.203.34.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aUarV9oInXJnb96wei-TnwAAAog"]
[Sat Dec 20 21:57:44.840660 2025] [:error] [pid 39577:tid 39581] [client 185.92.25.139:33311] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Sat Dec 20 21:57:45.711912 2025] [:error] [pid 39577:tid 39602] [client 185.92.25.139:33311] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sat Dec 20 21:57:45.991424 2025] [:error] [pid 39577:tid 39597] [client 185.92.25.139:33311] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sat Dec 20 21:57:46.276619 2025] [:error] [pid 39577:tid 39592] [client 185.92.25.139:33311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sat Dec 20 21:57:46.562564 2025] [:error] [pid 39577:tid 39580] [client 185.92.25.139:33311] [client 185.92.25.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aUarWrviRnt1rJiSOfyI4AAAAME"]
[Sat Dec 20 21:57:47.162299 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.19:55039] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/doc.php
[Sat Dec 20 21:57:47.509735 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.19:55039] File does not exist: /usr/local/apache/htdocs/suspended-page/fm1.php
[Sat Dec 20 21:57:48.443128 2025] [:error] [pid 33570:tid 33595] [client 85.203.34.19:55039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Sat Dec 20 21:57:48.746652 2025] [:error] [pid 33570:tid 33581] [client 85.203.34.19:55039] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aUarXITNveA-c6YcSrIrzwAAAcU"]
[Sat Dec 20 21:57:49.341941 2025] [:error] [pid 62124:tid 62146] [client 85.203.34.26:32573] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Sat Dec 20 21:57:49.627680 2025] [:error] [pid 62124:tid 62141] [client 85.203.34.26:32573] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sat Dec 20 21:57:50.238217 2025] [:error] [pid 62124:tid 62135] [client 85.203.34.26:32573] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Sat Dec 20 21:57:50.868640 2025] [:error] [pid 62124:tid 62144] [client 85.203.34.26:32573] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi01.php
[Sat Dec 20 21:57:51.850412 2025] [:error] [pid 62124:tid 62135] [client 85.203.34.26:32573] [client 85.203.34.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/item.php"] [unique_id "aUarX1s94zPA9ULQOjmfCQAAAAk"]
[Sat Dec 20 21:57:55.647631 2025] [:error] [pid 62124:tid 62137] [client 85.203.34.2:39119] [client 85.203.34.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.2, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aUarY1s94zPA9ULQOjmfGwAAAAs"]
[Sat Dec 20 21:57:55.940335 2025] [:error] [pid 62124:tid 62135] [client 85.203.34.2:39119] [client 85.203.34.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.2, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aUarY1s94zPA9ULQOjmfHQAAAAk"]
[Sat Dec 20 21:57:56.250426 2025] [:error] [pid 62124:tid 62133] [client 85.203.34.2:39119] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mani.php"] [unique_id "aUarZFs94zPA9ULQOjmfHgAAAAc"]
[Sat Dec 20 21:57:56.851484 2025] [:error] [pid 62124:tid 62140] [client 85.203.34.26:21673] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Dec 20 21:57:59.189514 2025] [:error] [pid 62124:tid 62143] [client 85.203.34.26:21673] [client 85.203.34.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aUarZ1s94zPA9ULQOjmfLAAAABE"]
[Sat Dec 20 21:57:59.767131 2025] [:error] [pid 62124:tid 62142] [client 85.203.34.32:57809] File does not exist: /usr/local/apache/htdocs/suspended-page/images.php
[Sat Dec 20 21:58:00.059799 2025] [:error] [pid 62124:tid 62147] [client 85.203.34.32:57809] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aespa.php
[Sat Dec 20 21:58:00.369566 2025] [:error] [pid 62124:tid 62137] [client 85.203.34.32:57809] [client 85.203.34.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUaraFs94zPA9ULQOjmfMAAAAAs"]
[Sat Dec 20 21:58:02.063167 2025] [:error] [pid 39493:tid 39572] [client 85.203.34.24:35059] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mariju.php
[Sat Dec 20 21:58:02.946872 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.24:35059] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/themes.php
[Sat Dec 20 21:58:03.521512 2025] [:error] [pid 39493:tid 39558] [client 85.203.34.24:35059] [client 85.203.34.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aUara2hjL2VG_FmIHqAbrAAAAIk"]
[Sat Dec 20 21:58:04.089350 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.12:50167] [client 85.203.34.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aUarbLviRnt1rJiSOfyI7gAAANI"]
[Sat Dec 20 21:58:04.929158 2025] [:error] [pid 39493:tid 39562] [client 85.203.34.18:52137] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sat Dec 20 21:58:05.797718 2025] [:error] [pid 39493:tid 39563] [client 85.203.34.18:52137] [client 85.203.34.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.18, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-login.php"] [unique_id "aUarbWhjL2VG_FmIHqAbvgAAAI4"]
[Sat Dec 20 21:58:07.025569 2025] [:error] [pid 39493:tid 39561] [client 85.203.34.18:52137] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aUarb2hjL2VG_FmIHqAbxgAAAIw"]
[Sat Dec 20 21:58:07.660846 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.24:24165] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Dec 20 21:58:07.942709 2025] [:error] [pid 39493:tid 39571] [client 85.203.34.24:24165] [client 85.203.34.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aUarb2hjL2VG_FmIHqAbywAAAJY"]
[Sat Dec 20 21:58:08.573255 2025] [:error] [pid 33844:tid 33869] [client 85.203.34.35:53247] [client 85.203.34.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aUarcCaNtwGsyqqVmQET9gAAAxc"]
[Sat Dec 20 21:58:09.455314 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.24:47999] [client 85.203.34.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUarcbviRnt1rJiSOfyI9AAAAMc"]
[Sat Dec 20 21:58:11.480006 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.31:20607] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/parx.php
[Sat Dec 20 21:58:12.049735 2025] [:error] [pid 33749:tid 33775] [client 85.203.34.31:20607] [client 85.203.34.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aUardNoInXJnb96wei-TwQAAApg"]
[Sat Dec 20 21:58:12.923748 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.2:21107] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sat Dec 20 21:58:13.211827 2025] [:error] [pid 33793:tid 33807] [client 85.203.34.2:21107] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sat Dec 20 21:58:14.401676 2025] [:error] [pid 33793:tid 33808] [client 85.203.34.2:21107] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sat Dec 20 21:58:14.688696 2025] [:error] [pid 33793:tid 33812] [client 85.203.34.2:21107] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Sat Dec 20 21:58:14.972437 2025] [:error] [pid 33793:tid 33817] [client 85.203.34.2:21107] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Sat Dec 20 21:58:15.258261 2025] [:error] [pid 33793:tid 33799] [client 85.203.34.2:21107] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sat Dec 20 21:58:15.866108 2025] [:error] [pid 33793:tid 33814] [client 85.203.34.2:21107] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Dec 20 21:58:16.970359 2025] [:error] [pid 33793:tid 33810] [client 85.203.34.2:21107] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/radio.php"] [unique_id "aUareFSicyB0BFmbRMzxDgAAAs8"]
[Sat Dec 20 21:58:17.870000 2025] [:error] [pid 33570:tid 33593] [client 85.203.34.12:20833] File does not exist: /usr/local/apache/htdocs/suspended-page/payout.php
[Sat Dec 20 21:58:18.181228 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.12:20833] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Dec 20 21:58:18.472865 2025] [:error] [pid 33570:tid 33596] [client 85.203.34.12:20833] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Dec 20 21:58:18.778239 2025] [:error] [pid 33570:tid 33588] [client 85.203.34.12:20833] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Sat Dec 20 21:58:19.366016 2025] [:error] [pid 33570:tid 33592] [client 85.203.34.12:20833] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Sat Dec 20 21:58:19.685684 2025] [:error] [pid 33570:tid 33577] [client 85.203.34.12:20833] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Sat Dec 20 21:58:20.268309 2025] [:error] [pid 33570:tid 33599] [client 85.203.34.12:20833] [client 85.203.34.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aUarfITNveA-c6YcSrIsVwAAAdc"]
[Sat Dec 20 21:58:22.294481 2025] [:error] [pid 39493:tid 39554] [client 85.203.34.36:60255] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aUarfmhjL2VG_FmIHqAb3gAAAIU"]
[Sat Dec 20 21:58:23.159723 2025] [:error] [pid 33749:tid 33771] [client 85.203.34.43:62943] [client 85.203.34.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aUarf9oInXJnb96wei-TzAAAApQ"]
[Sat Dec 20 21:58:23.720461 2025] [:error] [pid 33793:tid 33809] [client 85.203.34.37:52707] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sat Dec 20 21:58:23.994089 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.37:52707] File does not exist: /usr/local/apache/htdocs/suspended-page/fox.php
[Sat Dec 20 21:58:24.267629 2025] [:error] [pid 33793:tid 33818] [client 85.203.34.37:52707] File does not exist: /usr/local/apache/htdocs/suspended-page/google.php
[Sat Dec 20 21:58:24.861427 2025] [:error] [pid 33793:tid 33802] [client 85.203.34.37:52707] File does not exist: /usr/local/apache/htdocs/suspended-page/ovatools.php
[Sat Dec 20 21:58:25.160371 2025] [:error] [pid 33793:tid 33795] [client 85.203.34.37:52707] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwso.php
[Sat Dec 20 21:58:25.459356 2025] [:error] [pid 33793:tid 33805] [client 85.203.34.37:52707] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Sat Dec 20 21:58:25.759726 2025] [:error] [pid 33793:tid 33808] [client 85.203.34.37:52707] [client 85.203.34.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aUargVSicyB0BFmbRMzxJAAAAs0"]
[Sat Dec 20 21:58:26.356392 2025] [:error] [pid 14247:tid 14253] [client 85.203.34.44:58853] [client 85.203.34.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aUargiDv9TtKKdJQn9kxZgAAAQQ"]
[Sat Dec 20 21:58:27.610804 2025] [:error] [pid 39493:tid 39561] [client 85.203.34.49:23933] [client 85.203.34.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aUarg2hjL2VG_FmIHqAb5AAAAIw"]
[Sat Dec 20 21:58:28.527262 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sat Dec 20 21:58:28.831128 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Sat Dec 20 21:58:29.121814 2025] [:error] [pid 33749:tid 33756] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/style2.php
[Sat Dec 20 21:58:29.420043 2025] [:error] [pid 33749:tid 33760] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scripts.php
[Sat Dec 20 21:58:29.738497 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Dec 20 21:58:30.021707 2025] [:error] [pid 33749:tid 33759] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Sat Dec 20 21:58:30.302991 2025] [:error] [pid 33749:tid 33771] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/comfunctions.php
[Sat Dec 20 21:58:30.630115 2025] [:error] [pid 33749:tid 33751] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sat Dec 20 21:58:30.986930 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Sat Dec 20 21:58:31.355231 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sat Dec 20 21:58:31.657594 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/hinfofuns.php
[Sat Dec 20 21:58:31.962247 2025] [:error] [pid 33749:tid 33775] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/qfunctions.php
[Sat Dec 20 21:58:32.276196 2025] [:error] [pid 33749:tid 33758] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/qinfofuns.php
[Sat Dec 20 21:58:32.562495 2025] [:error] [pid 33749:tid 33774] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Sat Dec 20 21:58:32.864662 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Sat Dec 20 21:58:33.231065 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php
[Sat Dec 20 21:58:33.557840 2025] [:error] [pid 33749:tid 33766] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Sat Dec 20 21:58:33.867946 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sat Dec 20 21:58:34.186183 2025] [:error] [pid 33749:tid 33771] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/my-sites.php
[Sat Dec 20 21:58:34.491039 2025] [:error] [pid 33749:tid 33769] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Sat Dec 20 21:58:34.799304 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/nav-menus.php
[Sat Dec 20 21:58:35.122435 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sat Dec 20 21:58:35.410604 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Sat Dec 20 21:58:35.724794 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/revision.php
[Sat Dec 20 21:58:36.016516 2025] [:error] [pid 33749:tid 33775] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Sat Dec 20 21:58:36.313412 2025] [:error] [pid 33749:tid 33758] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sat Dec 20 21:58:36.608961 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sat Dec 20 21:58:36.889481 2025] [:error] [pid 33749:tid 33774] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sat Dec 20 21:58:37.194286 2025] [:error] [pid 33749:tid 33756] [client 85.203.34.46:61331] File does not exist: /usr/local/apache/htdocs/suspended-page/moded.php
[Sat Dec 20 21:58:37.476496 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.46:61331] [client 85.203.34.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aUarjdoInXJnb96wei-T-gAAApA"]
[Sat Dec 20 21:58:38.074499 2025] [:error] [pid 14247:tid 14250] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/upgrade.php
[Sat Dec 20 21:58:38.367322 2025] [:error] [pid 14247:tid 14263] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/gh.php
[Sat Dec 20 21:58:38.656284 2025] [:error] [pid 14247:tid 14264] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/version.php
[Sat Dec 20 21:58:38.941925 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/head.php
[Sat Dec 20 21:58:39.245112 2025] [:error] [pid 14247:tid 14259] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Sat Dec 20 21:58:39.569257 2025] [:error] [pid 14247:tid 14269] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/theme-insqbzk.php
[Sat Dec 20 21:58:39.890668 2025] [:error] [pid 14247:tid 14261] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Sat Dec 20 21:58:40.187371 2025] [:error] [pid 14247:tid 14268] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Sat Dec 20 21:58:40.770336 2025] [:error] [pid 14247:tid 14255] [client 85.203.34.9:65175] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Sat Dec 20 21:58:41.071311 2025] [:error] [pid 14247:tid 14266] [client 85.203.34.9:65175] [client 85.203.34.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "aUarkSDv9TtKKdJQn9kxggAAARE"]
[Sat Dec 20 21:58:42.567391 2025] [:error] [pid 39493:tid 39565] [client 85.203.34.24:52953] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Sat Dec 20 21:58:47.242462 2025] [:error] [pid 39493:tid 39570] [client 85.203.34.24:52953] [client 85.203.34.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aUarl2hjL2VG_FmIHqAcAQAAAJU"]
[Sat Dec 20 21:58:47.800358 2025] [:error] [pid 39577:tid 39581] [client 85.203.34.39:46789] [client 85.203.34.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aUarl7viRnt1rJiSOfyJMgAAAMI"]
[Sat Dec 20 21:58:49.013394 2025] [:error] [pid 33793:tid 33796] [client 85.203.34.34:63319] [client 85.203.34.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aUarmVSicyB0BFmbRMzxQwAAAsE"]
[Sat Dec 20 21:58:49.857864 2025] [:error] [pid 33844:tid 33852] [client 85.203.34.2:41499] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/repeater.php"] [unique_id "aUarmSaNtwGsyqqVmQEUJQAAAwY"]
[Sat Dec 20 21:58:51.384263 2025] [:error] [pid 39577:tid 39588] [client 85.203.34.26:29107] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php
[Sat Dec 20 21:58:51.697642 2025] [:error] [pid 39577:tid 39600] [client 85.203.34.26:29107] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php
[Sat Dec 20 21:58:52.298633 2025] [:error] [pid 39577:tid 39592] [client 85.203.34.26:29107] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php
[Sat Dec 20 21:58:54.671063 2025] [:error] [pid 39577:tid 39588] [client 85.203.34.26:29107] [client 85.203.34.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aUarnrviRnt1rJiSOfyJUQAAAMk"]
[Sat Dec 20 21:58:56.264619 2025] [:error] [pid 39577:tid 39595] [client 85.203.34.47:60659] [client 85.203.34.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aUaroLviRnt1rJiSOfyJVQAAANA"]
[Sat Dec 20 21:58:57.137558 2025] [:error] [pid 14247:tid 14260] [client 85.203.34.43:32435] [client 85.203.34.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/options.php"] [unique_id "aUaroSDv9TtKKdJQn9kxpgAAAQs"]
[Sat Dec 20 21:58:57.706788 2025] [:error] [pid 39577:tid 39599] [client 85.203.34.28:32233] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Dec 20 21:58:58.547373 2025] [:error] [pid 39577:tid 39582] [client 85.203.34.28:32233] [client 85.203.34.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aUarorviRnt1rJiSOfyJXQAAAMM"]
[Sat Dec 20 21:58:59.166776 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.41:59637] [client 85.203.34.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aUaro4TNveA-c6YcSrIswgAAAdU"]
[Sat Dec 20 21:59:00.423507 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.8:30249] [client 85.203.34.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.8, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/images/wp-login.php"] [unique_id "aUarpCDv9TtKKdJQn9kxrAAAARU"]
[Sat Dec 20 21:59:00.732564 2025] [:error] [pid 14247:tid 14272] [client 85.203.34.8:30249] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sat Dec 20 21:59:01.766588 2025] [:error] [pid 14247:tid 14264] [client 85.203.34.8:30249] [client 85.203.34.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aUarpSDv9TtKKdJQn9kxsQAAAQ8"]
[Sat Dec 20 21:59:02.417569 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.39:43747] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads-config.php
[Sat Dec 20 21:59:03.699658 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.39:43747] [client 85.203.34.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aUarp9oInXJnb96wei-UJwAAApA"]
[Sat Dec 20 21:59:04.335481 2025] [:error] [pid 14247:tid 14260] [client 85.203.34.25:65221] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aUarqCDv9TtKKdJQn9kxtAAAAQs"]
[Sat Dec 20 21:59:04.916909 2025] [:error] [pid 39493:tid 39572] [client 185.92.25.139:64197] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/autoload_classmap.php
[Sat Dec 20 21:59:05.226673 2025] [:error] [pid 39493:tid 39560] [client 185.92.25.139:64197] [client 185.92.25.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.92.25.139, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aUarqWhjL2VG_FmIHqAcFQAAAIs"]
[Sat Dec 20 21:59:05.545891 2025] [:error] [pid 39493:tid 39557] [client 185.92.25.139:64197] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Sat Dec 20 21:59:05.877944 2025] [:error] [pid 39493:tid 39571] [client 185.92.25.139:64197] [client 185.92.25.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aUarqWhjL2VG_FmIHqAcFwAAAJY"]
[Sat Dec 20 21:59:06.460784 2025] [:error] [pid 14247:tid 14252] [client 185.92.25.138:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/indeex.php
[Sat Dec 20 21:59:06.752980 2025] [:error] [pid 14247:tid 14271] [client 185.92.25.138:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sat Dec 20 21:59:07.842325 2025] [:error] [pid 14247:tid 14264] [client 185.92.25.138:62871] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aUarqyDv9TtKKdJQn9kxvgAAAQ8"]
[Sat Dec 20 21:59:08.428435 2025] [:error] [pid 62124:tid 62142] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Sat Dec 20 21:59:09.023873 2025] [:error] [pid 62124:tid 62128] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/credits.php
[Sat Dec 20 21:59:09.312081 2025] [:error] [pid 62124:tid 62144] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-comments.php
[Sat Dec 20 21:59:09.602873 2025] [:error] [pid 62124:tid 62129] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Sat Dec 20 21:59:09.904872 2025] [:error] [pid 62124:tid 62134] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Sat Dec 20 21:59:10.206976 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Sat Dec 20 21:59:10.515929 2025] [:error] [pid 62124:tid 62139] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/load-scripts.php
[Sat Dec 20 21:59:10.819684 2025] [:error] [pid 62124:tid 62143] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/load-styles.php
[Sat Dec 20 21:59:11.139387 2025] [:error] [pid 62124:tid 62141] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/options-discussion.php
[Sat Dec 20 21:59:11.456097 2025] [:error] [pid 62124:tid 62149] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/options-general.php
[Sat Dec 20 21:59:11.747439 2025] [:error] [pid 62124:tid 62126] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/options-permalink.php
[Sat Dec 20 21:59:12.031946 2025] [:error] [pid 62124:tid 62132] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/options-privacy.php
[Sat Dec 20 21:59:12.345201 2025] [:error] [pid 62124:tid 62142] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sat Dec 20 21:59:12.642623 2025] [:error] [pid 62124:tid 62140] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sat Dec 20 21:59:12.933280 2025] [:error] [pid 62124:tid 62128] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/post-new.php
[Sat Dec 20 21:59:13.212445 2025] [:error] [pid 62124:tid 62144] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Sat Dec 20 21:59:13.501307 2025] [:error] [pid 62124:tid 62137] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Sat Dec 20 21:59:13.788441 2025] [:error] [pid 62124:tid 62145] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/site-health.php
[Sat Dec 20 21:59:14.084461 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Sat Dec 20 21:59:14.368777 2025] [:error] [pid 62124:tid 62133] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sat Dec 20 21:59:14.658181 2025] [:error] [pid 62124:tid 62138] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/user-edit.php
[Sat Dec 20 21:59:14.968887 2025] [:error] [pid 62124:tid 62143] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/user-new.php
[Sat Dec 20 21:59:16.664368 2025] [:error] [pid 62124:tid 62143] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Sat Dec 20 21:59:16.955112 2025] [:error] [pid 62124:tid 62131] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/bar.php
[Sat Dec 20 21:59:17.236719 2025] [:error] [pid 62124:tid 62132] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Sat Dec 20 21:59:17.516654 2025] [:error] [pid 62124:tid 62140] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sat Dec 20 21:59:17.818278 2025] [:error] [pid 62124:tid 62146] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sat Dec 20 21:59:18.122663 2025] [:error] [pid 62124:tid 62144] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sat Dec 20 21:59:18.415863 2025] [:error] [pid 62124:tid 62137] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/km.php
[Sat Dec 20 21:59:18.724541 2025] [:error] [pid 62124:tid 62130] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/LA.php
[Sat Dec 20 21:59:19.041087 2025] [:error] [pid 62124:tid 62150] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Dec 20 21:59:19.346660 2025] [:error] [pid 62124:tid 62145] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ldd.php
[Sat Dec 20 21:59:19.660970 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/sgd.php
[Sat Dec 20 21:59:19.951671 2025] [:error] [pid 62124:tid 62138] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/wzy.php
[Sat Dec 20 21:59:20.812307 2025] [:error] [pid 62124:tid 62131] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:59:21.397267 2025] [:error] [pid 62124:tid 62140] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Dec 20 21:59:22.584777 2025] [:error] [pid 62124:tid 62145] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Dec 20 21:59:22.863379 2025] [:error] [pid 62124:tid 62141] [client 85.203.34.13:52405] [client 85.203.34.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.13, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aUaruls94zPA9ULQOjmgGwAAAA8"]
[Sat Dec 20 21:59:23.187809 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Sat Dec 20 21:59:24.099283 2025] [:error] [pid 62124:tid 62127] [client 85.203.34.13:52405] [client 85.203.34.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.13, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.tmb/wp-login.php"] [unique_id "aUarvFs94zPA9ULQOjmgIQAAAAE"]
[Sat Dec 20 21:59:24.675964 2025] [:error] [pid 62124:tid 62149] [client 85.203.34.13:52405] File does not exist: /usr/local/apache/htdocs/suspended-page/FroggBaba.php
[Sat Dec 20 21:59:24.960339 2025] [:error] [pid 62124:tid 62132] [client 85.203.34.13:52405] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aUarvFs94zPA9ULQOjmgJwAAAAY"]
[Sat Dec 20 21:59:25.557654 2025] [:error] [pid 39577:tid 39595] [client 85.203.34.19:38357] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aUarvbviRnt1rJiSOfyJiAAAANA"]
[Sat Dec 20 21:59:26.119488 2025] [:error] [pid 33844:tid 33867] [client 85.203.34.12:53787] [client 85.203.34.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aUarviaNtwGsyqqVmQEUbAAAAxU"]
[Sat Dec 20 21:59:42.316386 2025] [autoindex:error] [pid 62124:tid 62134] [client 85.203.34.2:45555] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 01:04:01.796541 2025] [:error] [pid 8641:tid 8685] [client 143.198.220.98:50674] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUbXAXE703usYSvQGLRVAQAAAMc"]
[Sun Dec 21 01:04:02.888423 2025] [:error] [pid 8640:tid 8660] [client 143.198.220.98:50729] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aUbXAvVclzlEWWhvYtldrgAAAIo"]
[Sun Dec 21 01:04:03.100175 2025] [:error] [pid 8640:tid 8673] [client 143.198.220.98:50721] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/prevlaravel/sftp-config.json"] [unique_id "aUbXA_VclzlEWWhvYtldsQAAAJc"]
[Sun Dec 21 01:04:04.382021 2025] [:error] [pid 8641:tid 8696] [client 143.198.220.98:50819] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/prevlaravel/sftp-config.json"] [unique_id "aUbXBHE703usYSvQGLRVCQAAANE"]
[Sun Dec 21 01:04:04.729973 2025] [:error] [pid 8640:tid 8659] [client 143.198.220.98:50849] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aUbXBPVclzlEWWhvYtldtgAAAIk"]
[Sun Dec 21 01:04:04.730085 2025] [:error] [pid 8640:tid 8671] [client 143.198.220.98:50802] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aUbXBPVclzlEWWhvYtldtwAAAJU"]
[Sun Dec 21 01:04:04.730936 2025] [:error] [pid 8640:tid 8667] [client 143.198.220.98:50800] [client 143.198.220.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/sftp.json"] [unique_id "aUbXBPVclzlEWWhvYtlduAAAAJE"]
[Sun Dec 21 01:06:22.524956 2025] [:error] [pid 8751:tid 8776] [client 146.235.18.147:53440] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUbXjmvrnuGjNP7vtDQUBQAAABc"]
[Sun Dec 21 01:06:22.529053 2025] [:error] [pid 8751:tid 8776] [client 146.235.18.147:53440] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Dec 21 01:06:22.887726 2025] [:error] [pid 8751:tid 8754] [client 146.235.18.147:53471] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUbXjmvrnuGjNP7vtDQUBgAAAAE"], referer: https://www.google.com/
[Sun Dec 21 01:06:22.891632 2025] [:error] [pid 8751:tid 8754] [client 146.235.18.147:53471] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Sun Dec 21 01:06:24.074405 2025] [:error] [pid 8642:tid 8716] [client 146.235.18.147:53516] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUbXkCJkiik8k41igp0FwwAAAQs"]
[Sun Dec 21 01:06:24.079415 2025] [:error] [pid 8642:tid 8716] [client 146.235.18.147:53516] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Dec 21 01:06:24.445623 2025] [:error] [pid 8751:tid 8770] [client 146.235.18.147:53541] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUbXkGvrnuGjNP7vtDQUCgAAABE"], referer: https://www.bing.com/
[Sun Dec 21 01:06:24.450686 2025] [:error] [pid 8751:tid 8770] [client 146.235.18.147:53541] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.bing.com/
[Sun Dec 21 01:13:58.898564 2025] [:error] [pid 8751:tid 8766] [client 45.88.186.197:58891] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUbZVmvrnuGjNP7vtDQX6wAAAA0"]
[Sun Dec 21 01:13:59.311710 2025] [:error] [pid 8751:tid 8769] [client 45.88.186.197:59046] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUbZV2vrnuGjNP7vtDQYDwAAABA"]
[Sun Dec 21 01:13:59.717344 2025] [:error] [pid 8642:tid 8699] [client 45.88.186.197:59178] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUbZVyJkiik8k41igp0IiQAAAQE"]
[Sun Dec 21 01:14:00.132387 2025] [:error] [pid 22338:tid 22390] [client 45.88.186.197:59314] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUbZWHGYQSUt-opKpSINCQAAAEY"]
[Sun Dec 21 01:14:00.536454 2025] [:error] [pid 22338:tid 22407] [client 45.88.186.197:59434] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUbZWHGYQSUt-opKpSINEwAAAFY"]
[Sun Dec 21 02:06:59.593817 2025] [:error] [pid 8640:tid 8668] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.yahoo.com/
[Sun Dec 21 02:06:59.734586 2025] [:error] [pid 8640:tid 8664] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.fr/
[Sun Dec 21 02:06:59.874188 2025] [:error] [pid 8640:tid 8673] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.de/
[Sun Dec 21 02:07:00.158323 2025] [:error] [pid 8640:tid 8669] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php, referer: https://www.google.co.uk/
[Sun Dec 21 02:07:00.300915 2025] [:error] [pid 8640:tid 8654] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.de/
[Sun Dec 21 02:07:00.595254 2025] [:error] [pid 8640:tid 8655] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.de/
[Sun Dec 21 02:07:00.735004 2025] [:error] [pid 8640:tid 8667] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.google.de/
[Sun Dec 21 02:07:01.015835 2025] [:error] [pid 8640:tid 8653] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php, referer: https://www.google.fr/
[Sun Dec 21 02:07:01.158151 2025] [:error] [pid 8640:tid 8657] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: https://duckduckgo.com/
[Sun Dec 21 02:07:01.313876 2025] [:error] [pid 8640:tid 8672] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php, referer: https://www.google.com/
[Sun Dec 21 02:07:02.015899 2025] [:error] [pid 8640:tid 8650] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.google.de/
[Sun Dec 21 02:07:02.156776 2025] [:error] [pid 8640:tid 8660] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://duckduckgo.com/
[Sun Dec 21 02:07:02.298393 2025] [:error] [pid 8640:tid 8668] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.google.co.uk/
[Sun Dec 21 02:07:02.438603 2025] [:error] [pid 8640:tid 8663] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.yahoo.com/
[Sun Dec 21 02:07:02.578147 2025] [:error] [pid 8640:tid 8664] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.co.uk/
[Sun Dec 21 02:07:02.718192 2025] [:error] [pid 8640:tid 8671] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.google.fr/
[Sun Dec 21 02:07:02.861884 2025] [:error] [pid 8640:tid 8654] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.de/
[Sun Dec 21 02:07:03.002133 2025] [:error] [pid 8640:tid 8656] [client 135.235.163.228:64777] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php, referer: https://www.bing.com/
[Sun Dec 21 02:07:03.731125 2025] [:error] [pid 8640:tid 8661] [client 135.235.163.228:64777] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aUblx_VclzlEWWhvYtlzggAAAIs"], referer: https://www.google.co.uk/
[Sun Dec 21 02:07:04.147910 2025] [:error] [pid 8641:tid 8705] [client 135.235.163.228:64845] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/index.php"] [unique_id "aUblyHE703usYSvQGLRqzgAAANY"], referer: https://duckduckgo.com/
[Sun Dec 21 02:07:04.576721 2025] [:error] [pid 22338:tid 22403] [client 135.235.163.228:64846] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php, referer: https://www.bing.com/
[Sun Dec 21 02:07:04.717496 2025] [:error] [pid 22338:tid 22389] [client 135.235.163.228:64846] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php, referer: https://www.bing.com/
[Sun Dec 21 02:07:04.857825 2025] [:error] [pid 22338:tid 22405] [client 135.235.163.228:64846] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.fr/
[Sun Dec 21 02:07:04.998944 2025] [:error] [pid 22338:tid 22402] [client 135.235.163.228:64846] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php, referer: https://www.google.de/
[Sun Dec 21 02:07:05.140142 2025] [:error] [pid 22338:tid 22393] [client 135.235.163.228:64846] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php, referer: https://www.google.de/
[Sun Dec 21 02:07:05.308419 2025] [:error] [pid 22338:tid 22396] [client 135.235.163.228:64846] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.yahoo.com/
[Sun Dec 21 02:07:05.468487 2025] [:error] [pid 22338:tid 22407] [client 135.235.163.228:64846] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php, referer: https://www.yahoo.com/
[Sun Dec 21 02:07:09.420424 2025] [:error] [pid 22338:tid 22403] [client 135.235.163.228:64846] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUblzXGYQSUt-opKpSImywAAAFI"], referer: https://www.google.fr/
[Sun Dec 21 02:07:09.694206 2025] [:error] [pid 22338:tid 22398] [client 135.235.163.228:64884] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUblzXGYQSUt-opKpSImzgAAAE0"], referer: https://www.bing.com/
[Sun Dec 21 02:07:10.253102 2025] [:error] [pid 8751:tid 8764] [client 135.235.163.228:64832] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/index.php"] [unique_id "aUblzmvrnuGjNP7vtDQ49wAAAAs"], referer: https://duckduckgo.com/
[Sun Dec 21 02:07:10.811841 2025] [:error] [pid 22338:tid 22408] [client 135.235.163.228:64806] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aUblznGYQSUt-opKpSIm1AAAAFc"], referer: https://duckduckgo.com/
[Sun Dec 21 02:07:11.085474 2025] [:error] [pid 8642:tid 8706] [client 135.235.163.228:64775] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aUblzyJkiik8k41igp0cCQAAAQQ"], referer: https://www.google.com/
[Sun Dec 21 02:07:11.360309 2025] [:error] [pid 8751:tid 8758] [client 135.235.163.228:64791] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aUblz2vrnuGjNP7vtDQ4_QAAAAU"], referer: https://www.google.co.uk/
[Sun Dec 21 02:07:11.644378 2025] [:error] [pid 8751:tid 8774] [client 135.235.163.228:64781] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/development/index.php"] [unique_id "aUblz2vrnuGjNP7vtDQ5AQAAABU"], referer: https://www.google.com/
[Sun Dec 21 02:07:11.918474 2025] [:error] [pid 8640:tid 8664] [client 135.235.163.228:64890] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUblz_VclzlEWWhvYtlzjAAAAI4"], referer: https://www.google.fr/
[Sun Dec 21 02:07:12.330899 2025] [:error] [pid 8642:tid 8711] [client 135.235.163.228:64876] [client 135.235.163.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aUbl0CJkiik8k41igp0cDwAAAQc"], referer: https://www.google.com/
[Sun Dec 21 02:42:42.108734 2025] [:error] [pid 44515:tid 44542] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 21 02:42:42.412522 2025] [:error] [pid 44515:tid 44520] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 21 02:42:42.718797 2025] [:error] [pid 44515:tid 44529] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 21 02:42:43.015962 2025] [:error] [pid 44515:tid 44542] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 21 02:42:43.337452 2025] [:error] [pid 44515:tid 44527] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 21 02:42:43.655599 2025] [:error] [pid 44515:tid 44529] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 21 02:42:44.019667 2025] [:error] [pid 44515:tid 44529] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 21 02:42:46.095424 2025] [:error] [pid 44515:tid 44529] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 21 02:42:46.739399 2025] [:error] [pid 44515:tid 44533] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 21 02:42:47.330006 2025] [:error] [pid 44515:tid 44529] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 21 02:42:47.619518 2025] [:error] [pid 44515:tid 44537] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 21 02:42:47.919521 2025] [:error] [pid 44515:tid 44525] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 21 02:42:48.221359 2025] [:error] [pid 44515:tid 44526] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 21 02:42:48.548028 2025] [:error] [pid 44515:tid 44524] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 21 02:42:48.856467 2025] [:error] [pid 44515:tid 44519] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 21 02:42:49.161799 2025] [:error] [pid 44515:tid 44527] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 21 02:42:49.483383 2025] [:error] [pid 44515:tid 44533] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 21 02:42:49.785921 2025] [:error] [pid 44515:tid 44532] [client 31.171.130.147:44791] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 21 02:42:54.703306 2025] [:error] [pid 44515:tid 44526] [client 31.171.130.147:44791] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUbuLpZAdBRP9gwGvJ5ZGgAAAYg"]
[Sun Dec 21 02:42:56.374505 2025] [:error] [pid 44515:tid 44518] [client 31.171.130.142:60155] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUbuMJZAdBRP9gwGvJ5ZKQAAAYA"]
[Sun Dec 21 02:42:57.919091 2025] [:error] [pid 8641:tid 8682] [client 31.171.130.107:62943] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 21 02:42:58.837291 2025] [:error] [pid 8641:tid 8680] [client 31.171.130.107:62943] [client 31.171.130.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aUbuMnE703usYSvQGLSL9wAAAMI"]
[Sun Dec 21 02:43:00.055317 2025] [:error] [pid 8751:tid 8769] [client 31.171.130.135:49229] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Dec 21 02:43:00.348265 2025] [:error] [pid 8751:tid 8753] [client 31.171.130.135:49229] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUbuNGvrnuGjNP7vtDRmqQAAAAA"]
[Sun Dec 21 02:43:01.276333 2025] [:error] [pid 8640:tid 8672] [client 31.171.130.154:39171] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Dec 21 02:43:02.902369 2025] [:error] [pid 8640:tid 8664] [client 31.171.130.154:39171] [client 31.171.130.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUbuNvVclzlEWWhvYtmRnQAAAI4"]
[Sun Dec 21 02:43:03.801383 2025] [:error] [pid 44515:tid 44525] [client 31.171.130.158:61981] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUbuN5ZAdBRP9gwGvJ5ZVQAAAYc"]
[Sun Dec 21 02:43:04.651661 2025] [:error] [pid 8641:tid 8707] [client 31.171.130.131:34087] [client 31.171.130.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUbuOHE703usYSvQGLSMCgAAANc"]
[Sun Dec 21 02:43:05.242223 2025] [:error] [pid 22338:tid 22407] [client 31.171.130.134:62783] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUbuOXGYQSUt-opKpSJLWQAAAFY"]
[Sun Dec 21 02:43:05.816032 2025] [:error] [pid 8642:tid 8716] [client 31.171.130.112:49357] [client 31.171.130.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUbuOSJkiik8k41igp07-gAAAQs"]
[Sun Dec 21 02:43:06.433659 2025] [:error] [pid 8751:tid 8777] [client 31.171.130.156:56005] [client 31.171.130.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUbuOmvrnuGjNP7vtDRmxQAAABg"]
[Sun Dec 21 02:43:09.068366 2025] [:error] [pid 8641:tid 8685] [client 31.171.130.138:23809] [client 31.171.130.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUbuPXE703usYSvQGLSMIgAAAMc"]
[Sun Dec 21 02:43:10.041814 2025] [:error] [pid 8640:tid 8667] [client 31.171.130.155:50867] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Dec 21 02:43:10.664947 2025] [:error] [pid 8640:tid 8671] [client 31.171.130.155:50867] [client 31.171.130.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aUbuPvVclzlEWWhvYtmRzAAAAJU"]
[Sun Dec 21 02:43:13.303439 2025] [:error] [pid 8641:tid 8693] [client 31.171.130.137:57229] [client 31.171.130.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUbuQXE703usYSvQGLSMOgAAAM4"]
[Sun Dec 21 02:43:14.504204 2025] [:error] [pid 43680:tid 43689] [client 31.171.130.151:45643] [client 31.171.130.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUbuQkDkAAJVjNqC6UXHkgAAAUU"]
[Sun Dec 21 02:43:15.194939 2025] [:error] [pid 8641:tid 8678] [client 31.171.130.132:25759] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Dec 21 02:43:15.492273 2025] [:error] [pid 8641:tid 8696] [client 31.171.130.132:25759] [client 31.171.130.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUbuQ3E703usYSvQGLSMVgAAANE"]
[Sun Dec 21 02:43:16.141996 2025] [:error] [pid 8751:tid 8754] [client 31.171.130.147:44095] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Dec 21 02:43:17.073491 2025] [:error] [pid 8751:tid 8774] [client 31.171.130.147:44095] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Dec 21 02:43:18.026635 2025] [:error] [pid 8751:tid 8777] [client 31.171.130.147:44095] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUbuRmvrnuGjNP7vtDRm-QAAABg"]
[Sun Dec 21 02:43:19.646414 2025] [:error] [pid 8751:tid 8774] [client 31.171.130.150:44483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Dec 21 02:43:20.949603 2025] [:error] [pid 8751:tid 8762] [client 31.171.130.150:44483] [client 31.171.130.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUbuSGvrnuGjNP7vtDRnEwAAAAk"]
[Sun Dec 21 02:43:21.553787 2025] [:error] [pid 8640:tid 8653] [client 31.171.130.129:41501] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Dec 21 02:43:22.379622 2025] [:error] [pid 8640:tid 8658] [client 31.171.130.129:41501] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUbuSvVclzlEWWhvYtmSDgAAAIg"]
[Sun Dec 21 02:43:23.285343 2025] [:error] [pid 44515:tid 44538] [client 31.171.130.145:63323] [client 31.171.130.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUbuS5ZAdBRP9gwGvJ5Z2gAAAZQ"]
[Sun Dec 21 02:43:24.202916 2025] [:error] [pid 22338:tid 22395] [client 31.171.130.115:51385] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Dec 21 02:43:24.510042 2025] [:error] [pid 22338:tid 22390] [client 31.171.130.115:51385] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Dec 21 02:43:25.157692 2025] [:error] [pid 22338:tid 22397] [client 31.171.130.115:51385] [client 31.171.130.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUbuTXGYQSUt-opKpSJLzgAAAEw"]
[Sun Dec 21 02:43:26.874503 2025] [:error] [pid 8640:tid 8657] [client 31.171.130.162:57203] [client 31.171.130.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUbuTvVclzlEWWhvYtmSHgAAAIc"]
[Sun Dec 21 02:43:27.723689 2025] [:error] [pid 43680:tid 43686] [client 31.171.130.129:53809] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUbuT0DkAAJVjNqC6UXH3QAAAUI"]
[Sun Dec 21 02:43:28.346231 2025] [:error] [pid 8642:tid 8729] [client 31.171.130.152:42719] [client 31.171.130.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUbuUCJkiik8k41igp08yQAAARg"]
[Sun Dec 21 02:43:28.982700 2025] [:error] [pid 8640:tid 8660] [client 31.171.130.131:43185] [client 31.171.130.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUbuUPVclzlEWWhvYtmSJAAAAIo"]
[Sun Dec 21 02:43:30.293069 2025] [:error] [pid 22338:tid 22387] [client 31.171.130.122:20721] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Dec 21 02:43:30.590397 2025] [:error] [pid 22338:tid 22388] [client 31.171.130.122:20721] [client 31.171.130.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aUbuUnGYQSUt-opKpSJL7QAAAEQ"]
[Sun Dec 21 02:43:31.455478 2025] [:error] [pid 8640:tid 8657] [client 31.171.130.137:47067] [client 31.171.130.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aUbuU_VclzlEWWhvYtmSLQAAAIc"]
[Sun Dec 21 02:43:32.054322 2025] [:error] [pid 44515:tid 44524] [client 31.171.130.164:30769] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUbuVJZAdBRP9gwGvJ5aJAAAAYY"]
[Sun Dec 21 02:43:33.454910 2025] [:error] [pid 44515:tid 44533] [client 31.171.130.115:21797] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Dec 21 02:43:34.067413 2025] [:error] [pid 44515:tid 44531] [client 31.171.130.115:21797] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Dec 21 02:43:35.259984 2025] [:error] [pid 44515:tid 44531] [client 31.171.130.115:21797] [client 31.171.130.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aUbuV5ZAdBRP9gwGvJ5aSAAAAY0"]
[Sun Dec 21 02:43:36.913878 2025] [:error] [pid 44515:tid 44533] [client 31.171.130.155:32965] [client 31.171.130.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.155, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUbuWJZAdBRP9gwGvJ5aXQAAAY8"]
[Sun Dec 21 02:43:37.215729 2025] [:error] [pid 44515:tid 44526] [client 31.171.130.155:32965] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Dec 21 02:43:38.775846 2025] [:error] [pid 44515:tid 44538] [client 31.171.130.155:32965] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Dec 21 02:43:39.069973 2025] [:error] [pid 44515:tid 44533] [client 31.171.130.155:32965] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Dec 21 02:43:40.922790 2025] [:error] [pid 44515:tid 44536] [client 31.171.130.155:32965] [client 31.171.130.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUbuXJZAdBRP9gwGvJ5aiAAAAZI"]
[Sun Dec 21 02:43:42.871194 2025] [:error] [pid 44515:tid 44540] [client 31.171.130.160:33353] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Dec 21 02:43:43.185532 2025] [:error] [pid 44515:tid 44522] [client 31.171.130.160:33353] [client 31.171.130.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.160, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUbuX5ZAdBRP9gwGvJ5arwAAAYQ"]
[Sun Dec 21 02:43:43.796915 2025] [:error] [pid 44515:tid 44520] [client 31.171.130.160:33353] [client 31.171.130.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aUbuX5ZAdBRP9gwGvJ5augAAAYI"]
[Sun Dec 21 02:43:45.629526 2025] [:error] [pid 44515:tid 44526] [client 31.171.130.133:32649] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Dec 21 02:43:46.286132 2025] [:error] [pid 44515:tid 44533] [client 31.171.130.133:32649] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Dec 21 02:43:46.896494 2025] [:error] [pid 44515:tid 44539] [client 31.171.130.133:32649] [client 31.171.130.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUbuYpZAdBRP9gwGvJ5a-AAAAZU"]
[Sun Dec 21 02:43:47.522450 2025] [:error] [pid 8642:tid 8723] [client 31.171.130.129:50921] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Dec 21 02:43:48.416613 2025] [:error] [pid 8642:tid 8708] [client 31.171.130.129:50921] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Dec 21 02:43:49.078837 2025] [:error] [pid 8642:tid 8724] [client 31.171.130.129:50921] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Dec 21 02:43:49.694951 2025] [:error] [pid 8642:tid 8725] [client 31.171.130.129:50921] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Dec 21 02:43:49.983751 2025] [:error] [pid 8642:tid 8704] [client 31.171.130.129:50921] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUbuZSJkiik8k41igp09SwAAAQM"]
[Sun Dec 21 02:43:50.611723 2025] [:error] [pid 43680:tid 43688] [client 31.171.130.111:52743] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Dec 21 02:43:50.896216 2025] [:error] [pid 43680:tid 43706] [client 31.171.130.111:52743] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Dec 21 02:43:51.188346 2025] [:error] [pid 43680:tid 43695] [client 31.171.130.111:52743] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUbuZ0DkAAJVjNqC6UXIYgAAAUs"]
[Sun Dec 21 02:43:52.136347 2025] [:error] [pid 8640:tid 8662] [client 31.171.130.121:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Dec 21 02:43:52.728908 2025] [:error] [pid 8640:tid 8665] [client 31.171.130.121:25269] [client 31.171.130.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.121, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUbuaPVclzlEWWhvYtmS4AAAAI8"]
[Sun Dec 21 02:43:53.042368 2025] [:error] [pid 8640:tid 8660] [client 31.171.130.121:25269] [client 31.171.130.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUbuafVclzlEWWhvYtmS5AAAAIo"]
[Sun Dec 21 02:43:56.743483 2025] [:error] [pid 8642:tid 8723] [client 31.171.130.156:34905] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Dec 21 02:43:58.901969 2025] [:error] [pid 8642:tid 8720] [client 31.171.130.156:34905] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Dec 21 02:43:59.212110 2025] [:error] [pid 8642:tid 8728] [client 31.171.130.156:34905] [client 31.171.130.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUbubyJkiik8k41igp09bwAAARc"]
[Sun Dec 21 02:43:59.830835 2025] [:error] [pid 8640:tid 8668] [client 31.171.130.130:55247] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Dec 21 02:44:00.726260 2025] [:error] [pid 8640:tid 8655] [client 31.171.130.130:55247] [client 31.171.130.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.130, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUbucPVclzlEWWhvYtmTJgAAAIU"]
[Sun Dec 21 02:44:01.082819 2025] [:error] [pid 8640:tid 8674] [client 31.171.130.130:55247] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Dec 21 02:44:01.404029 2025] [:error] [pid 8640:tid 8672] [client 31.171.130.130:55247] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Dec 21 02:44:01.719755 2025] [:error] [pid 8640:tid 8656] [client 31.171.130.130:55247] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Dec 21 02:44:02.031626 2025] [:error] [pid 8640:tid 8655] [client 31.171.130.130:55247] [client 31.171.130.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUbucvVclzlEWWhvYtmTOAAAAIU"]
[Sun Dec 21 02:44:03.633139 2025] [:error] [pid 43680:tid 43699] [client 31.171.130.110:53733] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Dec 21 02:44:03.938568 2025] [:error] [pid 43680:tid 43704] [client 31.171.130.110:53733] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aUbuc0DkAAJVjNqC6UXImAAAAVQ"]
[Sun Dec 21 02:44:04.808071 2025] [:error] [pid 22338:tid 22387] [client 31.171.130.111:30721] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Dec 21 02:44:05.111631 2025] [:error] [pid 22338:tid 22405] [client 31.171.130.111:30721] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUbudXGYQSUt-opKpSJMyAAAAFQ"]
[Sun Dec 21 02:44:06.599686 2025] [:error] [pid 8640:tid 8655] [client 31.171.130.142:53545] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Dec 21 02:44:06.893389 2025] [:error] [pid 8640:tid 8671] [client 31.171.130.142:53545] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUbudvVclzlEWWhvYtmTbQAAAJU"]
[Sun Dec 21 02:44:07.559862 2025] [:error] [pid 8640:tid 8659] [client 31.171.130.154:56943] [client 31.171.130.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUbud_VclzlEWWhvYtmTdQAAAIk"]
[Sun Dec 21 02:44:08.226299 2025] [:error] [pid 8640:tid 8674] [client 31.171.130.135:33517] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Dec 21 02:44:08.565472 2025] [:error] [pid 8640:tid 8672] [client 31.171.130.135:33517] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Dec 21 02:44:10.167372 2025] [:error] [pid 8640:tid 8666] [client 31.171.130.135:33517] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUbuevVclzlEWWhvYtmTmAAAAJA"]
[Sun Dec 21 02:44:11.085197 2025] [:error] [pid 43680:tid 43689] [client 31.171.130.129:44601] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUbue0DkAAJVjNqC6UXIuQAAAUU"]
[Sun Dec 21 02:44:12.790447 2025] [:error] [pid 8641:tid 8689] [client 31.171.130.110:55507] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aUbufHE703usYSvQGLSOCgAAAMs"]
[Sun Dec 21 02:44:13.357612 2025] [:error] [pid 8751:tid 8759] [client 31.171.130.122:36631] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Dec 21 02:44:13.965474 2025] [:error] [pid 8751:tid 8755] [client 31.171.130.122:36631] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Dec 21 02:44:14.315370 2025] [:error] [pid 8751:tid 8765] [client 31.171.130.122:36631] [client 31.171.130.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aUbufmvrnuGjNP7vtDRojAAAAAw"]
[Sun Dec 21 02:44:14.919754 2025] [:error] [pid 8640:tid 8663] [client 31.171.130.150:26025] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Dec 21 02:44:15.587457 2025] [:error] [pid 8640:tid 8672] [client 31.171.130.150:26025] [client 31.171.130.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aUbuf_VclzlEWWhvYtmTyAAAAJY"]
[Sun Dec 21 02:44:17.179137 2025] [:error] [pid 8641:tid 8703] [client 31.171.130.135:35063] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aUbugXE703usYSvQGLSOKAAAANU"]
[Sun Dec 21 02:44:18.062133 2025] [:error] [pid 44515:tid 44538] [client 31.171.130.122:45919] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Dec 21 02:44:18.946930 2025] [:error] [pid 44515:tid 44542] [client 31.171.130.122:45919] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Dec 21 02:44:19.774395 2025] [:error] [pid 44515:tid 44529] [client 31.171.130.122:45919] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Dec 21 02:44:20.048593 2025] [:error] [pid 44515:tid 44541] [client 31.171.130.122:45919] [client 31.171.130.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aUbuhJZAdBRP9gwGvJ5cKAAAAZc"]
[Sun Dec 21 02:44:20.622369 2025] [:error] [pid 8642:tid 8723] [client 31.171.130.151:49865] [client 31.171.130.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aUbuhCJkiik8k41igp09uAAAARI"]
[Sun Dec 21 02:44:21.953628 2025] [:error] [pid 8642:tid 8722] [client 31.171.130.139:50043] [client 31.171.130.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aUbuhSJkiik8k41igp09vQAAARE"]
[Sun Dec 21 02:44:22.534743 2025] [:error] [pid 8640:tid 8664] [client 31.171.130.159:29285] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aUbuhvVclzlEWWhvYtmT9wAAAI4"]
[Sun Dec 21 02:44:23.145106 2025] [:error] [pid 8640:tid 8670] [client 31.171.130.161:50157] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Dec 21 02:44:23.435342 2025] [:error] [pid 8640:tid 8658] [client 31.171.130.161:50157] [client 31.171.130.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aUbuh_VclzlEWWhvYtmT_QAAAIg"]
[Sun Dec 21 02:44:24.116326 2025] [:error] [pid 8642:tid 8710] [client 31.171.130.123:61465] [client 31.171.130.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUbuiCJkiik8k41igp09zgAAAQY"]
[Sun Dec 21 02:44:24.749413 2025] [:error] [pid 8640:tid 8656] [client 31.171.130.154:54367] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Dec 21 02:44:25.380295 2025] [:error] [pid 8640:tid 8661] [client 31.171.130.154:54367] [client 31.171.130.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aUbuifVclzlEWWhvYtmUDAAAAIs"]
[Sun Dec 21 02:44:26.010281 2025] [:error] [pid 43680:tid 43692] [client 31.171.130.135:38081] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUbuikDkAAJVjNqC6UXJJQAAAUg"]
[Sun Dec 21 02:44:26.567331 2025] [:error] [pid 8641:tid 8692] [client 31.171.130.150:65201] [client 31.171.130.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aUbuinE703usYSvQGLSOaQAAAM0"]
[Sun Dec 21 02:44:27.249917 2025] [:error] [pid 8751:tid 8770] [client 31.171.130.149:51741] [client 31.171.130.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aUbui2vrnuGjNP7vtDRougAAABE"]
[Sun Dec 21 02:44:28.517276 2025] [:error] [pid 8641:tid 8693] [client 31.171.130.148:35997] [client 31.171.130.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aUbujHE703usYSvQGLSOdwAAAM4"]
[Sun Dec 21 02:44:30.647681 2025] [:error] [pid 8642:tid 8719] [client 31.171.130.144:45231] [client 31.171.130.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aUbujiJkiik8k41igp093gAAAQ4"]
[Sun Dec 21 02:44:31.395689 2025] [:error] [pid 44515:tid 44542] [client 31.171.130.118:65055] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Dec 21 02:44:32.536500 2025] [:error] [pid 44515:tid 44531] [client 31.171.130.118:65055] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Dec 21 02:44:32.836333 2025] [:error] [pid 44515:tid 44539] [client 31.171.130.118:65055] [client 31.171.130.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aUbukJZAdBRP9gwGvJ5cuwAAAZU"]
[Sun Dec 21 02:44:33.698867 2025] [:error] [pid 8640:tid 8664] [client 31.171.130.147:48763] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Dec 21 02:44:34.001459 2025] [:error] [pid 8640:tid 8672] [client 31.171.130.147:48763] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Dec 21 02:44:35.624681 2025] [:error] [pid 8640:tid 8656] [client 31.171.130.147:48763] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aUbuk_VclzlEWWhvYtmURAAAAIY"]
[Sun Dec 21 02:44:37.140668 2025] [:error] [pid 8751:tid 8765] [client 31.171.130.159:65095] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aUbulWvrnuGjNP7vtDRo6gAAAAw"]
[Sun Dec 21 02:44:37.747410 2025] [:error] [pid 8640:tid 8651] [client 31.171.130.133:47677] [client 31.171.130.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aUbulfVclzlEWWhvYtmUUQAAAIE"]
[Sun Dec 21 02:44:42.094199 2025] [:error] [pid 43680:tid 43707] [client 31.171.130.129:41639] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUbumkDkAAJVjNqC6UXJpQAAAVc"]
[Sun Dec 21 02:44:43.311669 2025] [:error] [pid 22338:tid 22391] [client 31.171.130.150:54577] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Dec 21 02:44:43.602835 2025] [:error] [pid 22338:tid 22388] [client 31.171.130.150:54577] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Dec 21 02:44:44.844286 2025] [:error] [pid 22338:tid 22385] [client 31.171.130.150:54577] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Dec 21 02:44:45.170908 2025] [:error] [pid 22338:tid 22407] [client 31.171.130.150:54577] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Dec 21 02:44:47.033469 2025] [:error] [pid 22338:tid 22396] [client 31.171.130.150:54577] [client 31.171.130.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUbun3GYQSUt-opKpSJNnwAAAEs"]
[Sun Dec 21 02:44:47.649319 2025] [:error] [pid 8640:tid 8662] [client 31.171.130.162:53379] [client 31.171.130.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aUbun_VclzlEWWhvYtmUgwAAAIw"]
[Sun Dec 21 02:44:48.241385 2025] [:error] [pid 8751:tid 8765] [client 31.171.130.113:23509] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aUbuoGvrnuGjNP7vtDRpMAAAAAw"]
[Sun Dec 21 02:44:48.955381 2025] [:error] [pid 8640:tid 8652] [client 31.171.130.111:56919] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aUbuoPVclzlEWWhvYtmUhgAAAII"]
[Sun Dec 21 02:44:49.568665 2025] [:error] [pid 8642:tid 8708] [client 31.171.130.151:62819] [client 31.171.130.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aUbuoSJkiik8k41igp0-QQAAAQU"]
[Sun Dec 21 02:44:50.159590 2025] [:error] [pid 8642:tid 8727] [client 31.171.130.120:65021] [client 31.171.130.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aUbuoiJkiik8k41igp0-RAAAARY"]
[Sun Dec 21 02:44:51.267616 2025] [:error] [pid 44515:tid 44541] [client 31.171.130.120:26861] [client 31.171.130.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aUbuo5ZAdBRP9gwGvJ5dcAAAAZc"]
[Sun Dec 21 02:44:52.141256 2025] [:error] [pid 8640:tid 8664] [client 31.171.130.142:37311] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aUbupPVclzlEWWhvYtmUlgAAAI4"]
[Sun Dec 21 02:44:52.785353 2025] [:error] [pid 8642:tid 8710] [client 31.171.130.108:39973] [client 31.171.130.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aUbupCJkiik8k41igp0-VwAAAQY"]
[Sun Dec 21 02:44:53.757527 2025] [:error] [pid 8751:tid 8754] [client 31.171.130.108:40597] [client 31.171.130.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aUbupWvrnuGjNP7vtDRpVwAAAAE"]
[Sun Dec 21 02:44:55.318448 2025] [:error] [pid 8640:tid 8664] [client 31.171.130.159:32933] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aUbup_VclzlEWWhvYtmUpQAAAI4"]
[Sun Dec 21 02:44:56.316318 2025] [:error] [pid 22338:tid 22386] [client 31.171.130.138:32975] [client 31.171.130.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aUbuqHGYQSUt-opKpSJNywAAAEI"]
[Sun Dec 21 02:44:56.932335 2025] [:error] [pid 43680:tid 43706] [client 31.171.130.110:36825] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Dec 21 02:44:57.521606 2025] [:error] [pid 43680:tid 43684] [client 31.171.130.110:36825] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aUbuqUDkAAJVjNqC6UXKEgAAAUA"]
[Sun Dec 21 02:44:59.845561 2025] [:error] [pid 8641:tid 8681] [client 31.171.130.160:29275] [client 31.171.130.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aUbuq3E703usYSvQGLSPCQAAAMM"]
[Sun Dec 21 02:45:01.107747 2025] [:error] [pid 8751:tid 8773] [client 31.171.130.121:50871] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Dec 21 02:45:01.415396 2025] [:error] [pid 8751:tid 8756] [client 31.171.130.121:50871] [client 31.171.130.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aUburWvrnuGjNP7vtDRpjgAAAAM"]
[Sun Dec 21 02:45:02.484963 2025] [:error] [pid 8642:tid 8706] [client 31.171.130.141:39195] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Dec 21 02:45:02.779456 2025] [:error] [pid 8642:tid 8718] [client 31.171.130.141:39195] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Dec 21 02:45:03.101464 2025] [:error] [pid 8642:tid 8701] [client 31.171.130.141:39195] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Dec 21 02:45:03.445462 2025] [:error] [pid 8642:tid 8710] [client 31.171.130.141:39195] [client 31.171.130.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aUburyJkiik8k41igp0-mwAAAQY"]
[Sun Dec 21 02:45:04.056505 2025] [:error] [pid 8642:tid 8727] [client 31.171.130.156:21389] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Dec 21 02:45:04.359197 2025] [:error] [pid 8642:tid 8716] [client 31.171.130.156:21389] [client 31.171.130.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aUbusCJkiik8k41igp0-oAAAAQs"]
[Sun Dec 21 02:45:05.581066 2025] [:error] [pid 8751:tid 8773] [client 31.171.130.165:21477] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Dec 21 02:45:05.887689 2025] [:error] [pid 8751:tid 8761] [client 31.171.130.165:21477] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Dec 21 02:45:06.211252 2025] [:error] [pid 8751:tid 8767] [client 31.171.130.165:21477] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Dec 21 02:45:07.716386 2025] [:error] [pid 8751:tid 8773] [client 31.171.130.165:21477] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Dec 21 02:45:08.036461 2025] [:error] [pid 8751:tid 8755] [client 31.171.130.165:21477] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Dec 21 02:45:08.622710 2025] [:error] [pid 8751:tid 8756] [client 31.171.130.165:21477] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Dec 21 02:45:09.541132 2025] [:error] [pid 8751:tid 8767] [client 31.171.130.165:21477] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Dec 21 02:45:09.864657 2025] [:error] [pid 8751:tid 8771] [client 31.171.130.165:21477] [client 31.171.130.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aUbutWvrnuGjNP7vtDRpywAAABI"]
[Sun Dec 21 02:45:10.477103 2025] [:error] [pid 44515:tid 44538] [client 31.171.130.115:40383] [client 31.171.130.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aUbutpZAdBRP9gwGvJ5eHAAAAZQ"]
[Sun Dec 21 02:45:11.073358 2025] [:error] [pid 44515:tid 44518] [client 31.171.130.160:41909] [client 31.171.130.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.160, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUbut5ZAdBRP9gwGvJ5eIAAAAYA"]
[Sun Dec 21 02:45:11.077414 2025] [:error] [pid 44515:tid 44518] [client 31.171.130.160:41909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Dec 21 02:45:11.500817 2025] [:error] [pid 44515:tid 44519] [client 31.171.130.160:41909] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Dec 21 02:45:11.810996 2025] [:error] [pid 44515:tid 44538] [client 31.171.130.160:41909] [client 31.171.130.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aUbut5ZAdBRP9gwGvJ5eKQAAAZQ"]
[Sun Dec 21 02:45:13.121169 2025] [:error] [pid 8751:tid 8757] [client 31.171.130.149:52121] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Dec 21 02:45:13.429309 2025] [:error] [pid 8751:tid 8758] [client 31.171.130.149:52121] [client 31.171.130.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aUbuuWvrnuGjNP7vtDRp4AAAAAU"]
[Sun Dec 21 02:50:58.357597 2025] [:error] [pid 8640:tid 8651] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 21 02:50:58.680608 2025] [:error] [pid 8640:tid 8657] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 21 02:50:58.993013 2025] [:error] [pid 8640:tid 8658] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 21 02:50:59.328896 2025] [:error] [pid 8640:tid 8652] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 21 02:50:59.614203 2025] [:error] [pid 8640:tid 8664] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 21 02:50:59.932127 2025] [:error] [pid 8640:tid 8656] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 21 02:51:00.207372 2025] [:error] [pid 8640:tid 8665] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 21 02:51:00.507566 2025] [:error] [pid 8640:tid 8650] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 21 02:51:03.553105 2025] [:error] [pid 8640:tid 8652] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 21 02:51:04.154580 2025] [:error] [pid 8640:tid 8665] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 21 02:51:04.458218 2025] [:error] [pid 8640:tid 8670] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 21 02:51:04.752719 2025] [:error] [pid 8640:tid 8651] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 21 02:51:05.043414 2025] [:error] [pid 8640:tid 8668] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 21 02:51:05.356658 2025] [:error] [pid 8640:tid 8657] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 21 02:51:05.654327 2025] [:error] [pid 8640:tid 8672] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 21 02:51:05.951771 2025] [:error] [pid 8640:tid 8665] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 21 02:51:06.259716 2025] [:error] [pid 8640:tid 8650] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 21 02:51:06.565177 2025] [:error] [pid 8640:tid 8662] [client 31.171.130.119:37343] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 21 02:51:11.037381 2025] [:error] [pid 8640:tid 8654] [client 31.171.130.119:37343] [client 31.171.130.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUbwH_VclzlEWWhvYtmgNAAAAIQ"]
[Sun Dec 21 02:51:12.511632 2025] [:error] [pid 8751:tid 8766] [client 31.171.130.152:39887] [client 31.171.130.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUbwIGvrnuGjNP7vtDR0EQAAAA0"]
[Sun Dec 21 02:51:14.049778 2025] [:error] [pid 43680:tid 43692] [client 31.171.130.144:37905] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 21 02:51:15.248662 2025] [:error] [pid 43680:tid 43695] [client 31.171.130.144:37905] [client 31.171.130.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aUbwI0DkAAJVjNqC6UXVrQAAAUs"]
[Sun Dec 21 02:51:16.448825 2025] [:error] [pid 22338:tid 22405] [client 31.171.130.157:30371] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Dec 21 02:51:16.769416 2025] [:error] [pid 22338:tid 22401] [client 31.171.130.157:30371] [client 31.171.130.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUbwJHGYQSUt-opKpSJbSgAAAFA"]
[Sun Dec 21 02:51:17.694053 2025] [:error] [pid 8751:tid 8764] [client 31.171.130.164:64185] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Dec 21 02:51:19.221337 2025] [:error] [pid 8751:tid 8756] [client 31.171.130.164:64185] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUbwJ2vrnuGjNP7vtDR0YwAAAAM"]
[Sun Dec 21 02:51:20.159467 2025] [:error] [pid 8640:tid 8657] [client 31.171.130.157:48829] [client 31.171.130.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUbwKPVclzlEWWhvYtmgUwAAAIc"]
[Sun Dec 21 02:51:20.756361 2025] [:error] [pid 44515:tid 44520] [client 31.171.130.158:26973] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUbwKJZAdBRP9gwGvJ5paAAAAYI"]
[Sun Dec 21 02:51:21.408780 2025] [:error] [pid 43680:tid 43708] [client 31.171.130.161:34631] [client 31.171.130.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUbwKUDkAAJVjNqC6UXV1QAAAVg"]
[Sun Dec 21 02:51:21.986733 2025] [:error] [pid 8642:tid 8715] [client 31.171.130.145:46797] [client 31.171.130.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUbwKSJkiik8k41igp1JiQAAAQo"]
[Sun Dec 21 02:51:22.563331 2025] [:error] [pid 8751:tid 8773] [client 31.171.130.107:58063] [client 31.171.130.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUbwKmvrnuGjNP7vtDR0iQAAABQ"]
[Sun Dec 21 02:51:23.429303 2025] [:error] [pid 43680:tid 43707] [client 31.171.130.111:57841] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUbwK0DkAAJVjNqC6UXV5gAAAVc"]
[Sun Dec 21 02:51:24.079759 2025] [:error] [pid 22338:tid 22400] [client 31.171.130.142:21163] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Dec 21 02:51:24.700646 2025] [:error] [pid 22338:tid 22393] [client 31.171.130.142:21163] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aUbwLHGYQSUt-opKpSJblgAAAEk"]
[Sun Dec 21 02:51:25.887370 2025] [:error] [pid 22338:tid 22402] [client 31.171.130.161:24117] [client 31.171.130.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUbwLXGYQSUt-opKpSJboAAAAFE"]
[Sun Dec 21 02:51:26.994886 2025] [:error] [pid 44515:tid 44521] [client 31.171.130.113:27923] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUbwLpZAdBRP9gwGvJ5pogAAAYM"]
[Sun Dec 21 02:51:27.561389 2025] [:error] [pid 8640:tid 8668] [client 31.171.130.111:40491] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Dec 21 02:51:27.869399 2025] [:error] [pid 8640:tid 8658] [client 31.171.130.111:40491] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUbwL_VclzlEWWhvYtmgfQAAAIg"]
[Sun Dec 21 02:51:28.468005 2025] [:error] [pid 8640:tid 8663] [client 31.171.130.111:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Dec 21 02:51:29.371238 2025] [:error] [pid 8640:tid 8659] [client 31.171.130.111:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Dec 21 02:51:30.327324 2025] [:error] [pid 8640:tid 8661] [client 31.171.130.111:26609] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUbwMvVclzlEWWhvYtmglgAAAIs"]
[Sun Dec 21 02:51:30.920375 2025] [:error] [pid 43680:tid 43699] [client 31.171.130.135:57343] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Dec 21 02:51:31.203421 2025] [:error] [pid 43680:tid 43687] [client 31.171.130.135:57343] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUbwM0DkAAJVjNqC6UXWIwAAAUM"]
[Sun Dec 21 02:51:31.796942 2025] [:error] [pid 43680:tid 43685] [client 31.171.130.164:24201] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Dec 21 02:51:32.407155 2025] [:error] [pid 43680:tid 43701] [client 31.171.130.164:24201] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUbwNEDkAAJVjNqC6UXWLQAAAVE"]
[Sun Dec 21 02:51:33.291449 2025] [:error] [pid 8751:tid 8763] [client 31.171.130.111:54749] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUbwNWvrnuGjNP7vtDR03AAAAAo"]
[Sun Dec 21 02:51:34.581467 2025] [:error] [pid 8642:tid 8708] [client 31.171.130.152:42951] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Dec 21 02:51:34.904111 2025] [:error] [pid 8642:tid 8718] [client 31.171.130.152:42951] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Dec 21 02:51:35.534381 2025] [:error] [pid 8642:tid 8717] [client 31.171.130.152:42951] [client 31.171.130.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUbwNyJkiik8k41igp1J8AAAAQw"]
[Sun Dec 21 02:51:37.507236 2025] [:error] [pid 8641:tid 8695] [client 31.171.130.159:20333] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUbwOXE703usYSvQGLSZhAAAANA"]
[Sun Dec 21 02:51:38.358400 2025] [:error] [pid 8641:tid 8681] [client 31.171.130.150:50353] [client 31.171.130.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUbwOnE703usYSvQGLSZiAAAAMM"]
[Sun Dec 21 02:51:38.979110 2025] [:error] [pid 8641:tid 8679] [client 31.171.130.142:62083] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUbwOnE703usYSvQGLSZiwAAAME"]
[Sun Dec 21 02:51:39.605356 2025] [:error] [pid 8751:tid 8774] [client 31.171.130.165:25601] [client 31.171.130.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUbwO2vrnuGjNP7vtDR1DgAAABU"]
[Sun Dec 21 02:51:40.826255 2025] [:error] [pid 22338:tid 22393] [client 31.171.130.144:26815] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Dec 21 02:51:41.123210 2025] [:error] [pid 22338:tid 22387] [client 31.171.130.144:26815] [client 31.171.130.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aUbwPXGYQSUt-opKpSJb9gAAAEM"]
[Sun Dec 21 02:51:41.781505 2025] [:error] [pid 43680:tid 43702] [client 31.171.130.134:29793] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aUbwPUDkAAJVjNqC6UXWbAAAAVI"]
[Sun Dec 21 02:51:42.371497 2025] [:error] [pid 8640:tid 8671] [client 31.171.130.134:36635] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUbwPvVclzlEWWhvYtmgxgAAAJU"]
[Sun Dec 21 02:51:43.646390 2025] [:error] [pid 8751:tid 8765] [client 31.171.130.158:20803] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Dec 21 02:51:44.250850 2025] [:error] [pid 8751:tid 8755] [client 31.171.130.158:20803] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Dec 21 02:51:45.724422 2025] [:error] [pid 8751:tid 8772] [client 31.171.130.158:20803] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aUbwQWvrnuGjNP7vtDR1OQAAABM"]
[Sun Dec 21 02:51:47.273633 2025] [:error] [pid 43680:tid 43686] [client 31.171.130.135:30777] [client 31.171.130.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.135, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUbwQ0DkAAJVjNqC6UXWigAAAUI"]
[Sun Dec 21 02:51:47.573990 2025] [:error] [pid 43680:tid 43702] [client 31.171.130.135:30777] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Dec 21 02:51:49.162797 2025] [:error] [pid 43680:tid 43707] [client 31.171.130.135:30777] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Dec 21 02:51:49.461220 2025] [:error] [pid 43680:tid 43705] [client 31.171.130.135:30777] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Dec 21 02:51:51.055351 2025] [:error] [pid 43680:tid 43684] [client 31.171.130.135:30777] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUbwR0DkAAJVjNqC6UXWsQAAAUA"]
[Sun Dec 21 02:51:52.969176 2025] [:error] [pid 8640:tid 8652] [client 31.171.130.131:28261] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Dec 21 02:51:53.277426 2025] [:error] [pid 8640:tid 8668] [client 31.171.130.131:28261] [client 31.171.130.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.131, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUbwSfVclzlEWWhvYtmhAQAAAJI"]
[Sun Dec 21 02:51:54.117594 2025] [:error] [pid 8640:tid 8659] [client 31.171.130.131:28261] [client 31.171.130.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aUbwSvVclzlEWWhvYtmhBwAAAIk"]
[Sun Dec 21 02:51:55.951911 2025] [:error] [pid 8642:tid 8711] [client 31.171.130.139:51775] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Dec 21 02:51:56.566090 2025] [:error] [pid 8642:tid 8723] [client 31.171.130.139:51775] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Dec 21 02:51:57.161254 2025] [:error] [pid 8642:tid 8718] [client 31.171.130.139:51775] [client 31.171.130.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUbwTSJkiik8k41igp1LJQAAAQ0"]
[Sun Dec 21 02:51:57.730353 2025] [:error] [pid 8640:tid 8669] [client 31.171.130.142:64021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Dec 21 02:51:58.885854 2025] [:error] [pid 8640:tid 8671] [client 31.171.130.142:64021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Dec 21 02:51:59.532131 2025] [:error] [pid 8640:tid 8652] [client 31.171.130.142:64021] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Dec 21 02:52:00.127456 2025] [:error] [pid 8640:tid 8671] [client 31.171.130.142:64021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Dec 21 02:52:00.455858 2025] [:error] [pid 8640:tid 8650] [client 31.171.130.142:64021] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUbwUPVclzlEWWhvYtmhNwAAAIA"]
[Sun Dec 21 02:52:01.079418 2025] [:error] [pid 22338:tid 22393] [client 31.171.130.147:26733] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Dec 21 02:52:01.378926 2025] [:error] [pid 22338:tid 22386] [client 31.171.130.147:26733] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Dec 21 02:52:01.692380 2025] [:error] [pid 22338:tid 22385] [client 31.171.130.147:26733] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUbwUXGYQSUt-opKpSJcTQAAAEE"]
[Sun Dec 21 02:52:02.646106 2025] [:error] [pid 8642:tid 8717] [client 31.171.130.152:26721] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Dec 21 02:52:03.281711 2025] [:error] [pid 8642:tid 8725] [client 31.171.130.152:26721] [client 31.171.130.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.152, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUbwUyJkiik8k41igp1LewAAARQ"]
[Sun Dec 21 02:52:03.584248 2025] [:error] [pid 8642:tid 8699] [client 31.171.130.152:26721] [client 31.171.130.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUbwUyJkiik8k41igp1LgQAAAQE"]
[Sun Dec 21 02:52:07.613567 2025] [:error] [pid 8641:tid 8688] [client 31.171.130.137:34991] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Dec 21 02:52:09.438160 2025] [:error] [pid 8641:tid 8683] [client 31.171.130.137:34991] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Dec 21 02:52:09.966299 2025] [:error] [pid 8641:tid 8679] [client 31.171.130.137:34991] [client 31.171.130.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUbwWXE703usYSvQGLSaagAAAME"]
[Sun Dec 21 02:52:10.543020 2025] [:error] [pid 8751:tid 8775] [client 31.171.130.113:43737] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Dec 21 02:52:11.885409 2025] [:error] [pid 8751:tid 8771] [client 31.171.130.113:43737] [client 31.171.130.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.113, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUbwW2vrnuGjNP7vtDR2HAAAABI"]
[Sun Dec 21 02:52:12.194053 2025] [:error] [pid 8751:tid 8765] [client 31.171.130.113:43737] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Dec 21 02:52:12.495014 2025] [:error] [pid 8751:tid 8770] [client 31.171.130.113:43737] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Dec 21 02:52:12.801137 2025] [:error] [pid 8751:tid 8758] [client 31.171.130.113:43737] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Dec 21 02:52:13.108511 2025] [:error] [pid 8751:tid 8762] [client 31.171.130.113:43737] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUbwXWvrnuGjNP7vtDR2MQAAAAk"]
[Sun Dec 21 02:52:13.662429 2025] [:error] [pid 8641:tid 8679] [client 31.171.130.107:40549] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Dec 21 02:52:13.967387 2025] [:error] [pid 8641:tid 8687] [client 31.171.130.107:40549] [client 31.171.130.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aUbwXXE703usYSvQGLSafQAAAMk"]
[Sun Dec 21 02:52:14.876639 2025] [:error] [pid 22338:tid 22400] [client 31.171.130.160:22897] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Dec 21 02:52:15.428132 2025] [:error] [pid 22338:tid 22405] [client 31.171.130.160:22897] [client 31.171.130.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUbwX3GYQSUt-opKpSJcqgAAAFQ"]
[Sun Dec 21 02:52:16.903498 2025] [:error] [pid 43680:tid 43704] [client 31.171.130.163:22163] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Dec 21 02:52:17.199282 2025] [:error] [pid 43680:tid 43700] [client 31.171.130.163:22163] [client 31.171.130.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUbwYUDkAAJVjNqC6UXXrAAAAVA"]
[Sun Dec 21 02:52:17.796467 2025] [:error] [pid 8642:tid 8701] [client 31.171.130.114:48419] [client 31.171.130.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUbwYSJkiik8k41igp1MKwAAAQI"]
[Sun Dec 21 02:52:18.384686 2025] [:error] [pid 43680:tid 43695] [client 31.171.130.146:28049] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Dec 21 02:52:18.676892 2025] [:error] [pid 43680:tid 43704] [client 31.171.130.146:28049] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Dec 21 02:52:19.875252 2025] [:error] [pid 43680:tid 43703] [client 31.171.130.146:28049] [client 31.171.130.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUbwY0DkAAJVjNqC6UXXzAAAAVM"]
[Sun Dec 21 02:52:20.775388 2025] [:error] [pid 8751:tid 8777] [client 31.171.130.154:43161] [client 31.171.130.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUbwZGvrnuGjNP7vtDR2jQAAABg"]
[Sun Dec 21 02:52:22.267320 2025] [:error] [pid 8751:tid 8772] [client 31.171.130.161:56495] [client 31.171.130.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aUbwZmvrnuGjNP7vtDR2owAAABM"]
[Sun Dec 21 02:52:24.863688 2025] [:error] [pid 8751:tid 8764] [client 31.171.130.109:32513] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Dec 21 02:52:25.699906 2025] [:error] [pid 8751:tid 8756] [client 31.171.130.109:32513] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Dec 21 02:52:26.235661 2025] [:error] [pid 8751:tid 8761] [client 31.171.130.109:32513] [client 31.171.130.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aUbwamvrnuGjNP7vtDR21gAAAAg"]
[Sun Dec 21 02:52:26.838464 2025] [:error] [pid 44515:tid 44525] [client 31.171.130.159:55223] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Dec 21 02:52:27.430330 2025] [:error] [pid 44515:tid 44532] [client 31.171.130.159:55223] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aUbwa5ZAdBRP9gwGvJ5sgAAAAY4"]
[Sun Dec 21 02:52:28.965764 2025] [:error] [pid 43680:tid 43691] [client 31.171.130.116:64979] [client 31.171.130.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aUbwbEDkAAJVjNqC6UXYDgAAAUc"]
[Sun Dec 21 02:52:31.011798 2025] [:error] [pid 43680:tid 43699] [client 31.171.130.165:45399] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Dec 21 02:52:31.910878 2025] [:error] [pid 43680:tid 43685] [client 31.171.130.165:45399] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Dec 21 02:52:32.501230 2025] [:error] [pid 43680:tid 43686] [client 31.171.130.165:45399] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Dec 21 02:52:32.812225 2025] [:error] [pid 43680:tid 43684] [client 31.171.130.165:45399] [client 31.171.130.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aUbwcEDkAAJVjNqC6UXYLQAAAUA"]
[Sun Dec 21 02:52:34.456597 2025] [:error] [pid 8751:tid 8777] [client 31.171.130.155:40095] [client 31.171.130.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aUbwcmvrnuGjNP7vtDR3GgAAABg"]
[Sun Dec 21 02:52:36.081444 2025] [:error] [pid 44515:tid 44518] [client 31.171.130.164:58645] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aUbwdJZAdBRP9gwGvJ5s2gAAAYA"]
[Sun Dec 21 02:52:37.679082 2025] [:error] [pid 44515:tid 44521] [client 31.171.130.158:39119] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aUbwdZZAdBRP9gwGvJ5s6gAAAYM"]
[Sun Dec 21 02:52:38.278002 2025] [:error] [pid 8640:tid 8668] [client 31.171.130.158:23805] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Dec 21 02:52:38.590328 2025] [:error] [pid 8640:tid 8663] [client 31.171.130.158:23805] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aUbwdvVclzlEWWhvYtmiQAAAAI0"]
[Sun Dec 21 02:52:39.190514 2025] [:error] [pid 44515:tid 44538] [client 31.171.130.157:64629] [client 31.171.130.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUbwd5ZAdBRP9gwGvJ5tAQAAAZQ"]
[Sun Dec 21 02:52:40.800686 2025] [:error] [pid 8640:tid 8663] [client 31.171.130.164:32437] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Dec 21 02:52:41.369699 2025] [:error] [pid 8640:tid 8659] [client 31.171.130.164:32437] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aUbwefVclzlEWWhvYtmibQAAAIk"]
[Sun Dec 21 02:52:42.923469 2025] [:error] [pid 43680:tid 43703] [client 31.171.130.163:46311] [client 31.171.130.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUbwekDkAAJVjNqC6UXYggAAAVM"]
[Sun Dec 21 02:52:43.809819 2025] [:error] [pid 44515:tid 44530] [client 31.171.130.151:36435] [client 31.171.130.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aUbwe5ZAdBRP9gwGvJ5tOwAAAYw"]
[Sun Dec 21 02:52:44.407637 2025] [:error] [pid 8751:tid 8765] [client 31.171.130.121:42323] [client 31.171.130.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aUbwfGvrnuGjNP7vtDR3ggAAAAw"]
[Sun Dec 21 02:52:48.336391 2025] [:error] [pid 44515:tid 44529] [client 31.171.130.137:34805] [client 31.171.130.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aUbwgJZAdBRP9gwGvJ5tbgAAAYs"]
[Sun Dec 21 02:52:49.515290 2025] [:error] [pid 8642:tid 8711] [client 31.171.130.135:35069] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aUbwgSJkiik8k41igp1NMgAAAQc"]
[Sun Dec 21 02:52:50.086809 2025] [:error] [pid 8642:tid 8728] [client 31.171.130.112:53665] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Dec 21 02:52:50.967935 2025] [:error] [pid 8642:tid 8729] [client 31.171.130.112:53665] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Dec 21 02:52:51.264639 2025] [:error] [pid 8642:tid 8713] [client 31.171.130.112:53665] [client 31.171.130.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aUbwgyJkiik8k41igp1NPgAAAQg"]
[Sun Dec 21 06:39:29.849606 2025] [:error] [pid 20676:tid 20735] [client 103.65.236.149:64733] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aUcloapSa967F4pOO5zSCQAAAII"]
[Sun Dec 21 17:30:16.582502 2025] [:error] [pid 12191:tid 12198] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/dejavu.php
[Sun Dec 21 17:30:16.769959 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/yu.php
[Sun Dec 21 17:30:16.922289 2025] [:error] [pid 12191:tid 12205] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/bbn.php
[Sun Dec 21 17:30:17.080324 2025] [:error] [pid 12191:tid 12201] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/ssxsl.php
[Sun Dec 21 17:30:17.273713 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/tqloh.php
[Sun Dec 21 17:30:17.442489 2025] [:error] [pid 12191:tid 12211] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/hbyra.php
[Sun Dec 21 17:30:17.600898 2025] [:error] [pid 12191:tid 12208] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/dparm.php
[Sun Dec 21 17:30:17.758259 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/doelr.php
[Sun Dec 21 17:30:17.908250 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/xenium4x.php
[Sun Dec 21 17:30:18.073349 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.176:16378] File does not exist: /usr/local/apache/htdocs/suspended-page/dout.php
[Sun Dec 21 17:30:18.223034 2025] [:error] [pid 12191:tid 12193] [client 4.189.104.176:16378] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dng.php"] [unique_id "aUe-KgM0m463UZmqdiDDNAAAAQA"]
[Sun Dec 21 17:30:18.557387 2025] [:error] [pid 20674:tid 20687] [client 4.189.104.176:16359] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dng.php"] [unique_id "aUe-KthSbhHOCK6TAw_JMAAAAAk"]
[Sun Dec 21 17:30:18.850138 2025] [:error] [pid 16016:tid 16019] [client 4.189.104.176:16344] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dng.php"] [unique_id "aUe-KsHQ_KQh3iINaCNsfQAAAUE"]
[Sun Dec 21 17:30:19.184270 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.176:16352] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dng.php"] [unique_id "aUe-K9hSbhHOCK6TAw_JMgAAAAY"]
[Sun Dec 21 17:30:19.451899 2025] [:error] [pid 20676:tid 20735] [client 4.189.104.176:16273] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh1.php"] [unique_id "aUe-K6pSa967F4pOO5x17wAAAII"]
[Sun Dec 21 17:30:19.771621 2025] [:error] [pid 60191:tid 60202] [client 4.189.104.176:16286] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh1.php"] [unique_id "aUe-K6klhK29C3vVvLWAFgAAAYk"]
[Sun Dec 21 17:30:20.127664 2025] [:error] [pid 20676:tid 20736] [client 4.189.104.176:16356] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh1.php"] [unique_id "aUe-LKpSa967F4pOO5x18QAAAIM"]
[Sun Dec 21 17:30:20.437942 2025] [:error] [pid 20760:tid 20770] [client 4.189.104.176:16380] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh1.php"] [unique_id "aUe-LOXEVvRTAtWo3gldGQAAAMc"]
[Sun Dec 21 17:30:20.794114 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.176:16349] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3llstore.php"] [unique_id "aUe-LKpSa967F4pOO5x19QAAAJI"]
[Sun Dec 21 17:30:21.163686 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.176:16331] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3llstore.php"] [unique_id "aUe-LapSa967F4pOO5x1-AAAAJM"]
[Sun Dec 21 17:30:21.477012 2025] [:error] [pid 20674:tid 20702] [client 4.189.104.176:16366] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3llstore.php"] [unique_id "aUe-LdhSbhHOCK6TAw_JNgAAABg"]
[Sun Dec 21 17:30:21.805954 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.176:16362] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3llstore.php"] [unique_id "aUe-LdhSbhHOCK6TAw_JOgAAABQ"]
[Sun Dec 21 17:30:22.082983 2025] [:error] [pid 20675:tid 20720] [client 4.189.104.176:16368] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s12.php"] [unique_id "aUe-LryUvZnd3bHSR3am1AAAAE4"]
[Sun Dec 21 17:30:22.433386 2025] [:error] [pid 20675:tid 20721] [client 4.189.104.176:16284] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s12.php"] [unique_id "aUe-LryUvZnd3bHSR3am1QAAAE8"]
[Sun Dec 21 17:30:22.894070 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.176:16365] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s12.php"] [unique_id "aUe-LqpSa967F4pOO5x2AQAAAJI"]
[Sun Dec 21 17:30:23.183898 2025] [:error] [pid 20675:tid 20712] [client 4.189.104.176:16278] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s12.php"] [unique_id "aUe-L7yUvZnd3bHSR3am1wAAAEY"]
[Sun Dec 21 17:30:23.508281 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.176:16338] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUe-L-XEVvRTAtWo3gldHQAAAMg"]
[Sun Dec 21 17:30:23.823289 2025] [:error] [pid 16016:tid 16023] [client 4.189.104.176:16379] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUe-L8HQ_KQh3iINaCNshgAAAUU"]
[Sun Dec 21 17:30:24.213508 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.176:16363] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUe-MAM0m463UZmqdiDDOwAAARg"]
[Sun Dec 21 17:30:24.595068 2025] [:error] [pid 12191:tid 12193] [client 4.189.104.176:16337] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUe-MAM0m463UZmqdiDDPAAAAQA"]
[Sun Dec 21 17:30:24.873010 2025] [:error] [pid 12191:tid 12210] [client 4.189.104.176:16340] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aUe-MAM0m463UZmqdiDDPgAAARE"]
[Sun Dec 21 17:30:25.205991 2025] [:error] [pid 16016:tid 16035] [client 4.189.104.176:16354] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aUe-McHQ_KQh3iINaCNsiQAAAVE"]
[Sun Dec 21 17:30:25.530395 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.176:16348] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aUe-MQM0m463UZmqdiDDQQAAAQ0"]
[Sun Dec 21 17:30:25.892653 2025] [:error] [pid 12191:tid 12198] [client 4.189.104.176:16296] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aUe-MQM0m463UZmqdiDDRAAAAQU"]
[Sun Dec 21 17:30:26.257365 2025] [:error] [pid 12191:tid 12201] [client 4.189.104.176:16382] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/man.php"] [unique_id "aUe-MgM0m463UZmqdiDDRQAAAQg"]
[Sun Dec 21 17:30:26.585480 2025] [:error] [pid 12191:tid 12204] [client 4.189.104.176:16367] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/man.php"] [unique_id "aUe-MgM0m463UZmqdiDDSQAAAQs"]
[Sun Dec 21 17:30:26.872088 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.176:16381] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/man.php"] [unique_id "aUe-MqklhK29C3vVvLWAVgAAAZg"]
[Sun Dec 21 17:30:27.164080 2025] [:error] [pid 20674:tid 20678] [client 4.189.104.176:16329] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/man.php"] [unique_id "aUe-M9hSbhHOCK6TAw_JUAAAAAA"]
[Sun Dec 21 17:30:27.527305 2025] [:error] [pid 20675:tid 20711] [client 4.189.104.176:16295] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g7y.php"] [unique_id "aUe-M7yUvZnd3bHSR3am2QAAAEU"]
[Sun Dec 21 17:30:27.831741 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.176:16266] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g7y.php"] [unique_id "aUe-MwM0m463UZmqdiDDWQAAAQ4"]
[Sun Dec 21 17:30:28.159526 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.176:16297] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g7y.php"] [unique_id "aUe-NMHQ_KQh3iINaCNsjAAAAVM"]
[Sun Dec 21 17:30:28.472936 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.176:16268] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g7y.php"] [unique_id "aUe-NKpSa967F4pOO5x2AwAAAIg"]
[Sun Dec 21 17:30:28.777986 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.176:16320] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ging.php"] [unique_id "aUe-NAM0m463UZmqdiDDYgAAARU"]
[Sun Dec 21 17:30:29.125533 2025] [:error] [pid 20674:tid 20700] [client 4.189.104.176:16328] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ging.php"] [unique_id "aUe-NdhSbhHOCK6TAw_JVgAAABY"]
[Sun Dec 21 17:30:29.409374 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.176:16272] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ging.php"] [unique_id "aUe-NdhSbhHOCK6TAw_JVwAAABE"]
[Sun Dec 21 17:30:29.760350 2025] [:error] [pid 60191:tid 60193] [client 4.189.104.176:16271] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ging.php"] [unique_id "aUe-NaklhK29C3vVvLWAWgAAAYA"]
[Sun Dec 21 17:30:30.087210 2025] [:error] [pid 60191:tid 60203] [client 4.189.104.176:16345] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veuntzdf.php"] [unique_id "aUe-NqklhK29C3vVvLWAXgAAAYo"]
[Sun Dec 21 17:30:30.350037 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.176:16306] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veuntzdf.php"] [unique_id "aUe-NqklhK29C3vVvLWAYAAAAYc"]
[Sun Dec 21 17:30:30.594663 2025] [:error] [pid 16016:tid 16022] [client 4.189.104.176:16281] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veuntzdf.php"] [unique_id "aUe-NsHQ_KQh3iINaCNskQAAAUQ"]
[Sun Dec 21 17:30:30.965056 2025] [:error] [pid 20675:tid 20710] [client 4.189.104.176:16333] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veuntzdf.php"] [unique_id "aUe-NryUvZnd3bHSR3am4AAAAEQ"]
[Sun Dec 21 17:30:31.327042 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.176:16334] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "aUe-NwM0m463UZmqdiDDegAAAQk"]
[Sun Dec 21 17:30:31.603740 2025] [:error] [pid 20760:tid 20763] [client 4.189.104.176:16375] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "aUe-N-XEVvRTAtWo3gldIQAAAMA"]
[Sun Dec 21 17:30:31.899298 2025] [:error] [pid 20675:tid 20724] [client 4.189.104.176:16313] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "aUe-N7yUvZnd3bHSR3am5QAAAFI"]
[Sun Dec 21 17:30:32.166910 2025] [:error] [pid 20674:tid 20699] [client 4.189.104.176:16260] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "aUe-ONhSbhHOCK6TAw_JWgAAABU"]
[Sun Dec 21 17:30:32.442938 2025] [:error] [pid 20760:tid 20778] [client 4.189.104.176:16342] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu8.php"] [unique_id "aUe-OOXEVvRTAtWo3gldIgAAAM8"]
[Sun Dec 21 17:30:32.867368 2025] [:error] [pid 20676:tid 20754] [client 4.189.104.176:16371] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu8.php"] [unique_id "aUe-OKpSa967F4pOO5x2BQAAAJU"]
[Sun Dec 21 17:30:33.236556 2025] [:error] [pid 20674:tid 20694] [client 4.189.104.176:16290] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu8.php"] [unique_id "aUe-OdhSbhHOCK6TAw_JWwAAABA"]
[Sun Dec 21 17:30:33.496645 2025] [:error] [pid 20676:tid 20750] [client 4.189.104.176:16289] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu8.php"] [unique_id "aUe-OapSa967F4pOO5x2BwAAAJE"]
[Sun Dec 21 17:30:33.769677 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.176:16256] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aUe-OaklhK29C3vVvLWAaAAAAYg"]
[Sun Dec 21 17:30:34.077392 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.176:16330] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aUe-OgM0m463UZmqdiDDjgAAAQ4"]
[Sun Dec 21 17:30:34.439164 2025] [:error] [pid 20674:tid 20693] [client 4.189.104.176:16335] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aUe-OthSbhHOCK6TAw_JXAAAAA8"]
[Sun Dec 21 17:30:34.831348 2025] [:error] [pid 20760:tid 20764] [client 4.189.104.176:8154] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-front.php"] [unique_id "aUe-OuXEVvRTAtWo3gldJAAAAME"]
[Sun Dec 21 17:30:35.174988 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:16347] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-Blogs.php"] [unique_id "aUe-O8HQ_KQh3iINaCNsmQAAAU8"]
[Sun Dec 21 17:30:35.488484 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.176:8151] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-Blogs.php"] [unique_id "aUe-O9hSbhHOCK6TAw_JYgAAAAY"]
[Sun Dec 21 17:30:35.870376 2025] [:error] [pid 20760:tid 20769] [client 4.189.104.176:16325] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-Blogs.php"] [unique_id "aUe-O-XEVvRTAtWo3gldJwAAAMY"]
[Sun Dec 21 17:30:36.228641 2025] [:error] [pid 20675:tid 20721] [client 4.189.104.176:16376] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-Blogs.php"] [unique_id "aUe-PLyUvZnd3bHSR3am9gAAAE8"]
[Sun Dec 21 17:30:36.532091 2025] [:error] [pid 20675:tid 20715] [client 4.189.104.176:16341] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-loccs.php"] [unique_id "aUe-PLyUvZnd3bHSR3am9wAAAEk"]
[Sun Dec 21 17:30:36.805873 2025] [:error] [pid 60191:tid 60208] [client 4.189.104.176:16302] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-loccs.php"] [unique_id "aUe-PKklhK29C3vVvLWAbQAAAY8"]
[Sun Dec 21 17:30:37.132896 2025] [:error] [pid 20760:tid 20765] [client 4.189.104.176:8162] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-loccs.php"] [unique_id "aUe-PeXEVvRTAtWo3gldKQAAAMI"]
[Sun Dec 21 17:30:37.507102 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.176:16285] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-loccs.php"] [unique_id "aUe-PaklhK29C3vVvLWAbgAAAZg"]
[Sun Dec 21 17:30:37.909898 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.176:16269] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aUe-PcHQ_KQh3iINaCNsnAAAAUc"]
[Sun Dec 21 17:30:38.279137 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.176:8174] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aUe-PqklhK29C3vVvLWAcAAAAYw"]
[Sun Dec 21 17:30:38.614121 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.176:16276] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aUe-PsHQ_KQh3iINaCNsnQAAAVc"]
[Sun Dec 21 17:30:38.911683 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.176:16294] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aUe-PqklhK29C3vVvLWAcgAAAZA"]
[Sun Dec 21 17:30:39.270316 2025] [:error] [pid 20675:tid 20730] [client 4.189.104.176:8142] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aUe-P7yUvZnd3bHSR3am-gAAAFg"]
[Sun Dec 21 17:30:39.634110 2025] [:error] [pid 20676:tid 20733] [client 4.189.104.176:16282] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aUe-P6pSa967F4pOO5x2DQAAAIA"]
[Sun Dec 21 17:30:40.027385 2025] [:error] [pid 12191:tid 12209] [client 4.189.104.176:16265] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aUe-QAM0m463UZmqdiDDlwAAARA"]
[Sun Dec 21 17:30:40.348171 2025] [:error] [pid 12191:tid 12194] [client 4.189.104.176:16283] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aUe-QAM0m463UZmqdiDDmAAAAQE"]
[Sun Dec 21 17:30:40.676671 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:8148] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "aUe-QMHQ_KQh3iINaCNsogAAAU8"]
[Sun Dec 21 17:30:41.025850 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.176:8138] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "aUe-QaklhK29C3vVvLWAdgAAAZc"]
[Sun Dec 21 17:30:41.347263 2025] [:error] [pid 20676:tid 20756] [client 4.189.104.176:8155] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "aUe-QapSa967F4pOO5x2EQAAAJc"]
[Sun Dec 21 17:30:41.632636 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.176:16339] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "aUe-QcHQ_KQh3iINaCNspQAAAUM"]
[Sun Dec 21 17:30:41.907640 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.176:16275] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kao.php"] [unique_id "aUe-QdhSbhHOCK6TAw_JbQAAAAc"]
[Sun Dec 21 17:30:42.221972 2025] [:error] [pid 20676:tid 20736] [client 4.189.104.176:16300] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kao.php"] [unique_id "aUe-QqpSa967F4pOO5x2EwAAAIM"]
[Sun Dec 21 17:30:42.539824 2025] [:error] [pid 60191:tid 60195] [client 4.189.104.176:16274] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kao.php"] [unique_id "aUe-QqklhK29C3vVvLWAeQAAAYI"]
[Sun Dec 21 17:30:42.868095 2025] [:error] [pid 16016:tid 16042] [client 4.189.104.176:16318] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kao.php"] [unique_id "aUe-QsHQ_KQh3iINaCNspwAAAVg"]
[Sun Dec 21 17:30:43.264473 2025] [:error] [pid 20676:tid 20753] [client 4.189.104.176:16369] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii5file.php"] [unique_id "aUe-Q6pSa967F4pOO5x2GQAAAJQ"]
[Sun Dec 21 17:30:43.640870 2025] [:error] [pid 60191:tid 60212] [client 4.189.104.176:16358] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii5file.php"] [unique_id "aUe-Q6klhK29C3vVvLWAfAAAAZM"]
[Sun Dec 21 17:30:43.927048 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.176:16336] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii5file.php"] [unique_id "aUe-Q6pSa967F4pOO5x2GgAAAJM"]
[Sun Dec 21 17:30:44.215459 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.176:16315] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ii5file.php"] [unique_id "aUe-RKklhK29C3vVvLWAfgAAAYw"]
[Sun Dec 21 17:30:44.591194 2025] [:error] [pid 60191:tid 60198] [client 4.189.104.176:16287] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUe-RKklhK29C3vVvLWAgAAAAYU"]
[Sun Dec 21 17:30:44.868995 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.176:7621] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUe-RAM0m463UZmqdiDDmwAAAQI"]
[Sun Dec 21 17:30:45.150318 2025] [:error] [pid 12191:tid 12204] [client 4.189.104.176:7629] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUe-RQM0m463UZmqdiDDnAAAAQs"]
[Sun Dec 21 17:30:45.568484 2025] [:error] [pid 16016:tid 16040] [client 4.189.104.176:16372] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUe-RcHQ_KQh3iINaCNssgAAAVY"]
[Sun Dec 21 17:30:45.855562 2025] [:error] [pid 20674:tid 20701] [client 4.189.104.176:8179] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aUe-RdhSbhHOCK6TAw_JbgAAABc"]
[Sun Dec 21 17:30:46.290371 2025] [:error] [pid 12191:tid 12210] [client 4.189.104.176:16374] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aUe-RgM0m463UZmqdiDDnQAAARE"]
[Sun Dec 21 17:30:46.579139 2025] [:error] [pid 12191:tid 12216] [client 4.189.104.176:8159] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aUe-RgM0m463UZmqdiDDoAAAARc"]
[Sun Dec 21 17:30:46.958613 2025] [:error] [pid 20674:tid 20697] [client 4.189.104.176:7648] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aUe-RthSbhHOCK6TAw_JcwAAABM"]
[Sun Dec 21 17:30:47.246647 2025] [:error] [pid 12191:tid 12204] [client 4.189.104.176:16277] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUe-RwM0m463UZmqdiDDpwAAAQs"]
[Sun Dec 21 17:30:47.544211 2025] [:error] [pid 20674:tid 20681] [client 4.189.104.176:16308] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUe-R9hSbhHOCK6TAw_JdwAAAAM"]
[Sun Dec 21 17:30:47.846217 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.176:16305] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUe-R6pSa967F4pOO5x2HgAAAJI"]
[Sun Dec 21 17:30:48.252877 2025] [:error] [pid 12191:tid 12211] [client 4.189.104.176:16373] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUe-SAM0m463UZmqdiDDqwAAARI"]
[Sun Dec 21 17:30:48.604140 2025] [:error] [pid 20674:tid 20701] [client 4.189.104.176:16357] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aUe-SNhSbhHOCK6TAw_JgAAAABc"]
[Sun Dec 21 17:30:48.947065 2025] [:error] [pid 16016:tid 16038] [client 4.189.104.176:8157] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aUe-SMHQ_KQh3iINaCNsuQAAAVQ"]
[Sun Dec 21 17:30:49.265115 2025] [:error] [pid 20675:tid 20717] [client 4.189.104.176:16353] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aUe-SbyUvZnd3bHSR3anBAAAAEs"]
[Sun Dec 21 17:30:49.690586 2025] [:error] [pid 12191:tid 12193] [client 4.189.104.176:8161] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aUe-SQM0m463UZmqdiDDrgAAAQA"]
[Sun Dec 21 17:30:50.046834 2025] [:error] [pid 20760:tid 20766] [client 4.189.104.176:16279] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUe-SuXEVvRTAtWo3gldNQAAAMM"]
[Sun Dec 21 17:30:50.343855 2025] [:error] [pid 20760:tid 20783] [client 4.189.104.176:16288] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUe-SuXEVvRTAtWo3gldNgAAANQ"]
[Sun Dec 21 17:30:50.632638 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.176:16346] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUe-SqpSa967F4pOO5x2IQAAAIg"]
[Sun Dec 21 17:30:51.046613 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.176:8137] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUe-S8HQ_KQh3iINaCNsvQAAAUM"]
[Sun Dec 21 17:30:51.335353 2025] [:error] [pid 12191:tid 12205] [client 4.189.104.176:16261] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aUe-SwM0m463UZmqdiDDsAAAAQw"]
[Sun Dec 21 17:30:51.808204 2025] [:error] [pid 20760:tid 20779] [client 4.189.104.176:8187] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aUe-S-XEVvRTAtWo3gldNwAAANA"]
[Sun Dec 21 17:30:52.099782 2025] [:error] [pid 20674:tid 20680] [client 4.189.104.176:8152] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aUe-TNhSbhHOCK6TAw_JiQAAAAI"]
[Sun Dec 21 17:30:52.434902 2025] [:error] [pid 20676:tid 20750] [client 4.189.104.176:16312] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "aUe-TKpSa967F4pOO5x2JQAAAJE"]
[Sun Dec 21 17:30:52.709869 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.176:7663] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aUe-TAM0m463UZmqdiDDsgAAAQI"]
[Sun Dec 21 17:30:53.061713 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.176:16350] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aUe-TcHQ_KQh3iINaCNszAAAAUM"]
[Sun Dec 21 17:30:53.344679 2025] [:error] [pid 16016:tid 16031] [client 4.189.104.176:16332] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aUe-TcHQ_KQh3iINaCNszgAAAU0"]
[Sun Dec 21 17:30:53.643093 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.176:16293] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aUe-TQM0m463UZmqdiDDswAAARM"]
[Sun Dec 21 17:30:54.009795 2025] [:error] [pid 16016:tid 16026] [client 4.189.104.176:16323] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUe-TsHQ_KQh3iINaCNszwAAAUg"]
[Sun Dec 21 17:30:54.321916 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.176:7676] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUe-TgM0m463UZmqdiDDtgAAAQ4"]
[Sun Dec 21 17:30:54.635467 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.176:16262] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUe-TgM0m463UZmqdiDDtwAAAQ0"]
[Sun Dec 21 17:30:55.069533 2025] [:error] [pid 20676:tid 20746] [client 4.189.104.176:16280] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUe-T6pSa967F4pOO5x2JwAAAI0"]
[Sun Dec 21 17:30:55.341318 2025] [:error] [pid 60191:tid 60214] [client 4.189.104.176:8144] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aUe-T6klhK29C3vVvLWAiAAAAZU"]
[Sun Dec 21 17:30:55.700473 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.176:16264] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aUe-T6klhK29C3vVvLWAiQAAAZc"]
[Sun Dec 21 17:30:56.025204 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.176:7653] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aUe-UKklhK29C3vVvLWAigAAAYg"]
[Sun Dec 21 17:30:56.371999 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.176:16304] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aUe-UNhSbhHOCK6TAw_JjwAAAAc"]
[Sun Dec 21 17:30:56.751126 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.176:8170] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUe-UKklhK29C3vVvLWAjAAAAZQ"]
[Sun Dec 21 17:30:57.107420 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.176:16370] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUe-UaklhK29C3vVvLWAjwAAAYc"]
[Sun Dec 21 17:30:57.456943 2025] [:error] [pid 20676:tid 20748] [client 4.189.104.176:8178] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUe-UapSa967F4pOO5x2LQAAAI8"]
[Sun Dec 21 17:30:57.751441 2025] [:error] [pid 20675:tid 20718] [client 4.189.104.176:8156] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aUe-UbyUvZnd3bHSR3anCwAAAEw"]
[Sun Dec 21 17:30:58.030231 2025] [:error] [pid 60191:tid 60199] [client 4.189.104.176:7652] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUe-UqklhK29C3vVvLWAkAAAAYY"]
[Sun Dec 21 17:30:58.370072 2025] [:error] [pid 60191:tid 60197] [client 4.189.104.176:16319] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUe-UqklhK29C3vVvLWAkgAAAYQ"]
[Sun Dec 21 17:30:58.686191 2025] [:error] [pid 12191:tid 12198] [client 4.189.104.176:8134] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUe-UgM0m463UZmqdiDDwwAAAQU"]
[Sun Dec 21 17:30:59.044280 2025] [:error] [pid 60191:tid 60204] [client 4.189.104.176:8145] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUe-U6klhK29C3vVvLWAlAAAAYs"]
[Sun Dec 21 17:30:59.353643 2025] [:error] [pid 12191:tid 12197] [client 4.189.104.176:16263] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aUe-UwM0m463UZmqdiDDxgAAAQQ"]
[Sun Dec 21 17:30:59.633896 2025] [:error] [pid 20674:tid 20697] [client 4.189.104.176:8130] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aUe-U9hSbhHOCK6TAw_JlQAAABM"]
[Sun Dec 21 17:30:59.927105 2025] [:error] [pid 20674:tid 20683] [client 4.189.104.176:8064] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aUe-U9hSbhHOCK6TAw_JlwAAAAU"]
[Sun Dec 21 17:31:00.237569 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.176:7655] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aUe-VKklhK29C3vVvLWAlQAAAYw"]
[Sun Dec 21 17:31:00.551617 2025] [:error] [pid 20676:tid 20754] [client 4.189.104.176:7623] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aUe-VKpSa967F4pOO5x2OQAAAJU"]
[Sun Dec 21 17:31:00.857614 2025] [:error] [pid 16016:tid 16027] [client 4.189.104.176:8169] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aUe-VMHQ_KQh3iINaCNs1AAAAUk"]
[Sun Dec 21 17:31:01.236034 2025] [:error] [pid 20675:tid 20720] [client 4.189.104.176:7670] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aUe-VbyUvZnd3bHSR3anEAAAAE4"]
[Sun Dec 21 17:31:01.616776 2025] [:error] [pid 12191:tid 12194] [client 4.189.104.176:8141] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-advaced.php"] [unique_id "aUe-VQM0m463UZmqdiDDzAAAAQE"]
[Sun Dec 21 17:31:02.013510 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.176:7636] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUe-VqklhK29C3vVvLWAmgAAAZc"]
[Sun Dec 21 17:31:02.318387 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.176:7639] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUe-VqklhK29C3vVvLWAnQAAAYg"]
[Sun Dec 21 17:31:02.735219 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.176:7641] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUe-VgM0m463UZmqdiDD0QAAARU"]
[Sun Dec 21 17:31:03.155127 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.176:8143] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aUe-VwM0m463UZmqdiDD1QAAARM"]
[Sun Dec 21 17:31:03.438979 2025] [:error] [pid 12191:tid 12211] [client 4.189.104.176:8173] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUe-VwM0m463UZmqdiDD1gAAARI"]
[Sun Dec 21 17:31:03.786303 2025] [:error] [pid 20676:tid 20743] [client 4.189.104.176:8147] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUe-V6pSa967F4pOO5x2QwAAAIo"]
[Sun Dec 21 17:31:04.060106 2025] [:error] [pid 20674:tid 20697] [client 4.189.104.176:16310] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUe-WNhSbhHOCK6TAw_JpQAAABM"]
[Sun Dec 21 17:31:04.328324 2025] [:error] [pid 20676:tid 20735] [client 4.189.104.176:8164] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUe-WKpSa967F4pOO5x2RQAAAII"]
[Sun Dec 21 17:31:04.631561 2025] [:error] [pid 60191:tid 60203] [client 4.189.104.176:16257] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUe-WKklhK29C3vVvLWApQAAAYo"]
[Sun Dec 21 17:31:04.953473 2025] [:error] [pid 20676:tid 20734] [client 4.189.104.176:7630] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUe-WKpSa967F4pOO5x2RgAAAIE"]
[Sun Dec 21 17:31:05.283854 2025] [:error] [pid 60191:tid 60211] [client 4.189.104.176:8169] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUe-WaklhK29C3vVvLWAqwAAAZI"]
[Sun Dec 21 17:31:05.624469 2025] [:error] [pid 20676:tid 20753] [client 4.189.104.176:8182] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aUe-WapSa967F4pOO5x2SgAAAJQ"]
[Sun Dec 21 17:31:05.949678 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.176:8181] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aUe-WaklhK29C3vVvLWAsQAAAZg"]
[Sun Dec 21 17:31:06.257697 2025] [:error] [pid 20675:tid 20724] [client 4.189.104.176:8136] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aUe-WryUvZnd3bHSR3anFAAAAFI"]
[Sun Dec 21 17:31:06.537643 2025] [:error] [pid 16016:tid 16023] [client 4.189.104.176:7632] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aUe-WsHQ_KQh3iINaCNs2gAAAUU"]
[Sun Dec 21 17:31:06.867770 2025] [:error] [pid 20674:tid 20680] [client 4.189.104.176:7643] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aUe-WthSbhHOCK6TAw_JrgAAAAI"]
[Sun Dec 21 17:31:07.202432 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.176:7648] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUe-W6klhK29C3vVvLWAtAAAAZc"]
[Sun Dec 21 17:31:07.513448 2025] [:error] [pid 60191:tid 60210] [client 4.189.104.176:16360] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUe-W6klhK29C3vVvLWAtgAAAZE"]
[Sun Dec 21 17:31:07.800728 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.176:8183] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUe-W6klhK29C3vVvLWAuAAAAZA"]
[Sun Dec 21 17:31:08.115922 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.176:16292] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUe-XNhSbhHOCK6TAw_JsQAAAAY"]
[Sun Dec 21 17:31:08.371346 2025] [:error] [pid 20674:tid 20683] [client 4.189.104.176:16324] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aUe-XNhSbhHOCK6TAw_JsgAAAAU"]
[Sun Dec 21 17:31:08.647910 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.176:7661] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aUe-XNhSbhHOCK6TAw_JtAAAABQ"]
[Sun Dec 21 17:31:08.947944 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.176:8189] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aUe-XNhSbhHOCK6TAw_JtQAAABE"]
[Sun Dec 21 17:31:09.265587 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.176:16374] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aUe-XbyUvZnd3bHSR3anGwAAAEA"]
[Sun Dec 21 17:31:09.664342 2025] [:error] [pid 20675:tid 20727] [client 4.189.104.176:7664] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUe-XbyUvZnd3bHSR3anHQAAAFU"]
[Sun Dec 21 17:31:09.959028 2025] [:error] [pid 20760:tid 20784] [client 4.189.104.176:16316] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUe-XeXEVvRTAtWo3gldXAAAANU"]
[Sun Dec 21 17:31:10.253214 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.176:8172] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUe-XthSbhHOCK6TAw_JtgAAAAs"]
[Sun Dec 21 17:31:10.535503 2025] [:error] [pid 20760:tid 20787] [client 4.189.104.176:8128] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUe-XuXEVvRTAtWo3gldXwAAANg"]
[Sun Dec 21 17:31:10.911331 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.176:8087] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUe-XgM0m463UZmqdiDD5QAAARg"]
[Sun Dec 21 17:31:11.273347 2025] [:error] [pid 12191:tid 12201] [client 4.189.104.176:8066] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUe-XwM0m463UZmqdiDD5gAAAQg"]
[Sun Dec 21 17:31:11.619338 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.176:8184] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUe-X6pSa967F4pOO5x2VQAAAIw"]
[Sun Dec 21 17:31:11.905052 2025] [:error] [pid 20760:tid 20779] [client 4.189.104.176:16326] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUe-X-XEVvRTAtWo3gldYwAAANA"]
[Sun Dec 21 17:31:12.199478 2025] [:error] [pid 16016:tid 16028] [client 4.189.104.176:16267] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUe-YMHQ_KQh3iINaCNs4gAAAUo"]
[Sun Dec 21 17:31:12.532353 2025] [:error] [pid 20760:tid 20770] [client 4.189.104.176:16270] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUe-YOXEVvRTAtWo3gldZAAAAMc"]
[Sun Dec 21 17:31:12.820401 2025] [:error] [pid 60191:tid 60208] [client 4.189.104.176:16309] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUe-YKklhK29C3vVvLWAugAAAY8"]
[Sun Dec 21 17:31:13.123351 2025] [:error] [pid 20760:tid 20785] [client 4.189.104.176:8188] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aUe-YeXEVvRTAtWo3gldaQAAANY"]
[Sun Dec 21 17:31:13.499531 2025] [:error] [pid 60191:tid 60210] [client 4.189.104.176:16307] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUe-YaklhK29C3vVvLWAuwAAAZE"]
[Sun Dec 21 17:31:13.914505 2025] [:error] [pid 16016:tid 16030] [client 4.189.104.176:16299] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUe-YcHQ_KQh3iINaCNs5gAAAUw"]
[Sun Dec 21 17:31:14.215620 2025] [:error] [pid 16016:tid 16036] [client 4.189.104.176:7622] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUe-YsHQ_KQh3iINaCNs5wAAAVI"]
[Sun Dec 21 17:31:14.516348 2025] [:error] [pid 60191:tid 60198] [client 4.189.104.176:8171] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUe-YqklhK29C3vVvLWAvQAAAYU"]
[Sun Dec 21 17:31:14.863911 2025] [:error] [pid 20675:tid 20728] [client 4.189.104.176:8190] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aUe-YryUvZnd3bHSR3anIwAAAFY"]
[Sun Dec 21 17:31:15.181052 2025] [:error] [pid 60191:tid 60211] [client 4.189.104.176:16291] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aUe-Y6klhK29C3vVvLWAvwAAAZI"]
[Sun Dec 21 17:31:15.513098 2025] [:error] [pid 16016:tid 16032] [client 4.189.104.176:8071] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aUe-Y8HQ_KQh3iINaCNs6gAAAU4"]
[Sun Dec 21 17:31:15.847937 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:7642] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aUe-Y8HQ_KQh3iINaCNs7AAAAU8"]
[Sun Dec 21 17:31:16.091767 2025] [:error] [pid 60191:tid 60199] [client 4.189.104.176:7654] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUe-ZKklhK29C3vVvLWAwQAAAYY"]
[Sun Dec 21 17:31:16.321320 2025] [:error] [pid 20674:tid 20687] [client 4.189.104.176:16361] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUe-ZNhSbhHOCK6TAw_JugAAAAk"]
[Sun Dec 21 17:31:16.601221 2025] [:error] [pid 60191:tid 60206] [client 4.189.104.176:8140] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUe-ZKklhK29C3vVvLWAwgAAAY0"]
[Sun Dec 21 17:31:16.884912 2025] [:error] [pid 20676:tid 20749] [client 4.189.104.176:8146] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUe-ZKpSa967F4pOO5x2WQAAAJA"]
[Sun Dec 21 17:31:17.117809 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.176:16301] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUe-ZapSa967F4pOO5x2WgAAAI4"]
[Sun Dec 21 17:31:17.379153 2025] [:error] [pid 20675:tid 20716] [client 4.189.104.176:8067] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUe-ZbyUvZnd3bHSR3anJgAAAEo"]
[Sun Dec 21 17:31:17.605272 2025] [:error] [pid 20676:tid 20736] [client 4.189.104.176:7633] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUe-ZapSa967F4pOO5x2WwAAAIM"]
[Sun Dec 21 17:31:17.891998 2025] [:error] [pid 20676:tid 20735] [client 4.189.104.176:8085] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "aUe-ZapSa967F4pOO5x2XAAAAII"]
[Sun Dec 21 17:31:18.146523 2025] [:error] [pid 20676:tid 20734] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/ghreshttryu.php
[Sun Dec 21 17:31:18.263635 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/krypton.php
[Sun Dec 21 17:31:18.380710 2025] [:error] [pid 20676:tid 20754] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Sun Dec 21 17:31:18.505401 2025] [:error] [pid 20676:tid 20744] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Sun Dec 21 17:31:18.623138 2025] [:error] [pid 20676:tid 20742] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-header.php
[Sun Dec 21 17:31:18.740193 2025] [:error] [pid 20676:tid 20756] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/dox.php
[Sun Dec 21 17:31:18.856276 2025] [:error] [pid 20676:tid 20755] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Sun Dec 21 17:31:18.995252 2025] [:error] [pid 20676:tid 20753] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Sun Dec 21 17:31:19.111466 2025] [:error] [pid 20676:tid 20733] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Sun Dec 21 17:31:19.228408 2025] [:error] [pid 20676:tid 20757] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/tesTyuj.php
[Sun Dec 21 17:31:19.344265 2025] [:error] [pid 20676:tid 20737] [client 4.189.104.176:8132] File does not exist: /usr/local/apache/htdocs/suspended-page/ww3.php
[Sun Dec 21 17:31:19.458155 2025] [:error] [pid 20676:tid 20739] [client 4.189.104.176:8132] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/budmachine/web/s.php"] [unique_id "aUe-Z6pSa967F4pOO5x2bAAAAIY"]
[Sun Dec 21 17:31:19.726263 2025] [:error] [pid 60191:tid 60193] [client 4.189.104.176:16351] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/budmachine/web/s.php"] [unique_id "aUe-Z6klhK29C3vVvLWAxgAAAYA"]
[Sun Dec 21 17:31:19.962649 2025] [:error] [pid 20675:tid 20712] [client 4.189.104.176:16322] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/budmachine/web/s.php"] [unique_id "aUe-Z7yUvZnd3bHSR3anKAAAAEY"]
[Sun Dec 21 17:31:20.191489 2025] [:error] [pid 20675:tid 20729] [client 4.189.104.176:8133] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/budmachine/web/s.php"] [unique_id "aUe-aLyUvZnd3bHSR3anKgAAAFc"]
[Sun Dec 21 17:31:20.446871 2025] [:error] [pid 60191:tid 60212] [client 4.189.104.176:8131] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUe-aKklhK29C3vVvLWAxwAAAZM"]
[Sun Dec 21 17:31:20.756853 2025] [:error] [pid 20675:tid 20711] [client 4.189.104.176:8073] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUe-aLyUvZnd3bHSR3anKwAAAEU"]
[Sun Dec 21 17:31:21.063867 2025] [:error] [pid 12191:tid 12209] [client 4.189.104.176:8078] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUe-aQM0m463UZmqdiDD6AAAARA"]
[Sun Dec 21 17:31:21.310950 2025] [:error] [pid 16016:tid 16024] [client 4.189.104.176:7672] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-sid.php"] [unique_id "aUe-acHQ_KQh3iINaCNs8AAAAUY"]
[Sun Dec 21 17:31:21.581340 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.176:8165] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUe-aQM0m463UZmqdiDD6QAAARU"]
[Sun Dec 21 17:31:21.831409 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.176:7620] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUe-acHQ_KQh3iINaCNs8QAAAVM"]
[Sun Dec 21 17:31:22.128526 2025] [:error] [pid 16016:tid 16029] [client 4.189.104.176:8129] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUe-asHQ_KQh3iINaCNs9AAAAUs"]
[Sun Dec 21 17:31:22.368468 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.176:7616] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-title.php"] [unique_id "aUe-aqpSa967F4pOO5x2bwAAAJM"]
[Sun Dec 21 17:31:22.609618 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.176:7645] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aUe-asHQ_KQh3iINaCNs-AAAAUc"]
[Sun Dec 21 17:31:22.875229 2025] [:error] [pid 20674:tid 20682] [client 4.189.104.176:7627] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aUe-athSbhHOCK6TAw_JxAAAAAQ"]
[Sun Dec 21 17:31:23.120906 2025] [:error] [pid 12191:tid 12197] [client 4.189.104.176:8163] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aUe-awM0m463UZmqdiDD6wAAAQQ"]
[Sun Dec 21 17:31:23.450733 2025] [:error] [pid 20674:tid 20679] [client 4.189.104.176:7626] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-home.php"] [unique_id "aUe-a9hSbhHOCK6TAw_JxQAAAAE"]
[Sun Dec 21 17:31:23.787750 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.176:8083] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aUe-awM0m463UZmqdiDD7QAAAQ4"]
[Sun Dec 21 17:31:24.114041 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:8168] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aUe-bMHQ_KQh3iINaCNtAwAAAU8"]
[Sun Dec 21 17:31:24.339585 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.176:8166] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aUe-bAM0m463UZmqdiDD7gAAARg"]
[Sun Dec 21 17:31:24.696355 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.176:8168] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aUe-bAM0m463UZmqdiDD7wAAARQ"]
[Sun Dec 21 17:31:24.985375 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.176:8107] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aUe-bMHQ_KQh3iINaCNtBQAAAUA"]
[Sun Dec 21 17:31:25.244942 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.176:8070] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aUe-bQM0m463UZmqdiDD8QAAAQk"]
[Sun Dec 21 17:31:25.710221 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.176:8186] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aUe-bdhSbhHOCK6TAw_JyQAAABI"]
[Sun Dec 21 17:31:26.039283 2025] [:error] [pid 12191:tid 12208] [client 4.189.104.176:7667] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aUe-bgM0m463UZmqdiDD8gAAAQ8"]
[Sun Dec 21 17:31:26.342628 2025] [:error] [pid 60191:tid 60199] [client 4.189.104.176:8115] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid-file.php"] [unique_id "aUe-bqklhK29C3vVvLWAywAAAYY"]
[Sun Dec 21 17:31:26.674197 2025] [:error] [pid 20760:tid 20768] [client 4.189.104.176:8013] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid-file.php"] [unique_id "aUe-buXEVvRTAtWo3glddQAAAMU"]
[Sun Dec 21 17:31:27.047773 2025] [:error] [pid 20760:tid 20767] [client 4.189.104.176:7651] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid-file.php"] [unique_id "aUe-b-XEVvRTAtWo3glddgAAAMQ"]
[Sun Dec 21 17:31:27.457427 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.176:16258] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid-file.php"] [unique_id "aUe-b6klhK29C3vVvLWAzAAAAZQ"]
[Sun Dec 21 17:31:27.866100 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.176:8080] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/l3gi0n.php"] [unique_id "aUe-b6pSa967F4pOO5x2dwAAAIw"]
[Sun Dec 21 17:31:28.195737 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.176:8150] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/l3gi0n.php"] [unique_id "aUe-cKpSa967F4pOO5x2eAAAAIg"]
[Sun Dec 21 17:31:28.540798 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.176:7644] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/l3gi0n.php"] [unique_id "aUe-cKpSa967F4pOO5x2eQAAAIU"]
[Sun Dec 21 17:31:28.878218 2025] [:error] [pid 60191:tid 60204] [client 4.189.104.176:8047] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/l3gi0n.php"] [unique_id "aUe-cKklhK29C3vVvLWAzQAAAYs"]
[Sun Dec 21 17:31:29.228591 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.176:7637] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aUe-capSa967F4pOO5x2ewAAAI4"]
[Sun Dec 21 17:31:29.614142 2025] [:error] [pid 12191:tid 12197] [client 4.189.104.176:7677] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aUe-cQM0m463UZmqdiDD-QAAAQQ"]
[Sun Dec 21 17:31:29.985278 2025] [:error] [pid 20674:tid 20699] [client 4.189.104.176:8149] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aUe-cdhSbhHOCK6TAw_JzwAAABU"]
[Sun Dec 21 17:31:30.309636 2025] [:error] [pid 16016:tid 16020] [client 4.189.104.176:7671] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aUe-csHQ_KQh3iINaCNtDQAAAUI"]
[Sun Dec 21 17:31:30.833626 2025] [:error] [pid 20760:tid 20780] [client 4.189.104.176:7635] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUe-cuXEVvRTAtWo3gldfAAAANE"]
[Sun Dec 21 17:31:31.476861 2025] [:error] [pid 20674:tid 20700] [client 4.189.104.176:16317] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUe-c9hSbhHOCK6TAw_J0wAAABY"]
[Sun Dec 21 17:31:31.889424 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.176:7634] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUe-cwM0m463UZmqdiDD_QAAARQ"]
[Sun Dec 21 17:31:32.201763 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.176:8111] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Contrller.php"] [unique_id "aUe-dNhSbhHOCK6TAw_J1AAAAAc"]
[Sun Dec 21 17:31:32.510210 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.176:8191] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUe-dNhSbhHOCK6TAw_J1QAAABQ"]
[Sun Dec 21 17:31:32.795409 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.176:7624] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUe-dKklhK29C3vVvLWA0wAAAZc"]
[Sun Dec 21 17:31:33.101306 2025] [:error] [pid 20675:tid 20719] [client 4.189.104.176:8077] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUe-dbyUvZnd3bHSR3anMgAAAE0"]
[Sun Dec 21 17:31:33.376494 2025] [:error] [pid 20675:tid 20711] [client 4.189.104.176:7649] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o2.php"] [unique_id "aUe-dbyUvZnd3bHSR3anMwAAAEU"]
[Sun Dec 21 17:31:33.670231 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.176:16298] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inghl.php"] [unique_id "aUe-daklhK29C3vVvLWA1AAAAYg"]
[Sun Dec 21 17:31:34.004250 2025] [:error] [pid 20675:tid 20728] [client 4.189.104.176:8082] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inghl.php"] [unique_id "aUe-dryUvZnd3bHSR3anNgAAAFY"]
[Sun Dec 21 17:31:34.335775 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.176:8092] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inghl.php"] [unique_id "aUe-dryUvZnd3bHSR3anNwAAAEA"]
[Sun Dec 21 17:31:34.606450 2025] [:error] [pid 20675:tid 20710] [client 4.189.104.176:7659] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inghl.php"] [unique_id "aUe-dryUvZnd3bHSR3anOQAAAEQ"]
[Sun Dec 21 17:31:34.878288 2025] [:error] [pid 20676:tid 20755] [client 4.189.104.176:8135] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUe-dqpSa967F4pOO5x2fQAAAJY"]
[Sun Dec 21 17:31:35.291499 2025] [:error] [pid 20674:tid 20688] [client 4.189.104.176:8000] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUe-d9hSbhHOCK6TAw_J2gAAAAo"]
[Sun Dec 21 17:31:35.581616 2025] [:error] [pid 16016:tid 16042] [client 4.189.104.176:7673] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUe-d8HQ_KQh3iINaCNtEAAAAVg"]
[Sun Dec 21 17:31:35.938107 2025] [:error] [pid 20676:tid 20739] [client 4.189.104.176:8122] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-securitiy.php"] [unique_id "aUe-d6pSa967F4pOO5x2gQAAAIY"]
[Sun Dec 21 17:31:36.188621 2025] [:error] [pid 60191:tid 60207] [client 4.189.104.176:7638] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUe-eKklhK29C3vVvLWA2wAAAY4"]
[Sun Dec 21 17:31:36.458352 2025] [:error] [pid 16016:tid 16023] [client 4.189.104.176:8091] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUe-eMHQ_KQh3iINaCNtEwAAAUU"]
[Sun Dec 21 17:31:36.734400 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.176:16314] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUe-eMHQ_KQh3iINaCNtFAAAAUM"]
[Sun Dec 21 17:31:37.043415 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.176:8095] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aUe-eaklhK29C3vVvLWA3AAAAYc"]
[Sun Dec 21 17:31:37.373155 2025] [:error] [pid 20676:tid 20748] [client 4.189.104.176:8012] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aUe-eapSa967F4pOO5x2hAAAAI8"]
[Sun Dec 21 17:31:37.628991 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.176:7678] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aUe-eeXEVvRTAtWo3gldgQAAAMk"]
[Sun Dec 21 17:31:37.912529 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.176:16355] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aUe-eapSa967F4pOO5x2hQAAAJM"]
[Sun Dec 21 17:31:38.186610 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.176:7661] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aUe-egM0m463UZmqdiDEAwAAARg"]
[Sun Dec 21 17:31:38.469095 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.176:16364] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_57c3d4.php"] [unique_id "aUe-ethSbhHOCK6TAw_J3QAAABE"]
[Sun Dec 21 17:31:38.721739 2025] [:error] [pid 20760:tid 20766] [client 4.189.104.176:7679] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_57c3d4.php"] [unique_id "aUe-euXEVvRTAtWo3gldgwAAAMM"]
[Sun Dec 21 17:31:39.000398 2025] [:error] [pid 20676:tid 20736] [client 4.189.104.176:8185] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_57c3d4.php"] [unique_id "aUe-eqpSa967F4pOO5x2hgAAAIM"]
[Sun Dec 21 17:31:39.315589 2025] [:error] [pid 20675:tid 20709] [client 4.189.104.176:16311] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karma_57c3d4.php"] [unique_id "aUe-e7yUvZnd3bHSR3anQwAAAEM"]
[Sun Dec 21 17:31:39.589327 2025] [:error] [pid 20675:tid 20710] [client 4.189.104.176:8094] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fc72f.php"] [unique_id "aUe-e7yUvZnd3bHSR3anRAAAAEQ"]
[Sun Dec 21 17:31:39.893870 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.176:7618] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fc72f.php"] [unique_id "aUe-e6klhK29C3vVvLWA3gAAAYw"]
[Sun Dec 21 17:31:40.249892 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.176:8139] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fc72f.php"] [unique_id "aUe-fNhSbhHOCK6TAw_J4AAAABQ"]
[Sun Dec 21 17:31:40.676073 2025] [:error] [pid 20676:tid 20743] [client 4.189.104.176:8103] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fc72f.php"] [unique_id "aUe-fKpSa967F4pOO5x2iAAAAIo"]
[Sun Dec 21 17:31:41.024578 2025] [:error] [pid 60191:tid 60208] [client 4.189.104.176:7675] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUe-faklhK29C3vVvLWA4QAAAY8"]
[Sun Dec 21 17:31:41.363508 2025] [:error] [pid 20675:tid 20707] [client 4.189.104.176:7674] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUe-fbyUvZnd3bHSR3anSQAAAEE"]
[Sun Dec 21 17:31:41.705650 2025] [:error] [pid 20675:tid 20729] [client 4.189.104.176:8081] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUe-fbyUvZnd3bHSR3anTgAAAFc"]
[Sun Dec 21 17:31:41.971067 2025] [:error] [pid 20675:tid 20728] [client 4.189.104.176:8069] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aUe-fbyUvZnd3bHSR3anUQAAAFY"]
[Sun Dec 21 17:31:42.334367 2025] [:error] [pid 20675:tid 20724] [client 4.189.104.176:8158] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jjrpo.php"] [unique_id "aUe-fryUvZnd3bHSR3anVAAAAFI"]
[Sun Dec 21 17:31:42.776136 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.176:8112] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jjrpo.php"] [unique_id "aUe-fqpSa967F4pOO5x2igAAAIw"]
[Sun Dec 21 17:31:43.051172 2025] [:error] [pid 20675:tid 20714] [client 4.189.104.176:7650] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jjrpo.php"] [unique_id "aUe-f7yUvZnd3bHSR3anWgAAAEg"]
[Sun Dec 21 17:31:43.299100 2025] [:error] [pid 20676:tid 20733] [client 4.189.104.176:7640] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jjrpo.php"] [unique_id "aUe-f6pSa967F4pOO5x2iwAAAIA"]
[Sun Dec 21 17:31:43.584184 2025] [:error] [pid 16016:tid 16022] [client 4.189.104.176:8100] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "aUe-f8HQ_KQh3iINaCNtHQAAAUQ"]
[Sun Dec 21 17:31:43.934876 2025] [:error] [pid 12191:tid 12197] [client 4.189.104.176:16259] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "aUe-fwM0m463UZmqdiDECQAAAQQ"]
[Sun Dec 21 17:31:44.211941 2025] [:error] [pid 60191:tid 60199] [client 4.189.104.176:8041] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "aUe-gKklhK29C3vVvLWA6QAAAYY"]
[Sun Dec 21 17:31:44.534258 2025] [:error] [pid 20674:tid 20691] [client 4.189.104.176:8110] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "aUe-gNhSbhHOCK6TAw_J5QAAAA0"]
[Sun Dec 21 17:31:44.966749 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.176:8102] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtt.php"] [unique_id "aUe-gKklhK29C3vVvLWA6gAAAZQ"]
[Sun Dec 21 17:31:45.303747 2025] [:error] [pid 20675:tid 20719] [client 4.189.104.176:7617] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtt.php"] [unique_id "aUe-gbyUvZnd3bHSR3anXgAAAE0"]
[Sun Dec 21 17:31:45.588975 2025] [:error] [pid 16016:tid 16028] [client 4.189.104.176:8127] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtt.php"] [unique_id "aUe-gcHQ_KQh3iINaCNtIQAAAUo"]
[Sun Dec 21 17:31:45.902276 2025] [:error] [pid 16016:tid 16038] [client 4.189.104.176:8086] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtt.php"] [unique_id "aUe-gcHQ_KQh3iINaCNtIgAAAVQ"]
[Sun Dec 21 17:31:46.167720 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:8027] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-gsHQ_KQh3iINaCNtIwAAAU8"]
[Sun Dec 21 17:31:46.470733 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.176:8118] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-ggM0m463UZmqdiDEDQAAAQ4"]
[Sun Dec 21 17:31:46.855371 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.176:8180] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-gthSbhHOCK6TAw_J6gAAAAY"]
[Sun Dec 21 17:31:47.458104 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.176:8153] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-g8HQ_KQh3iINaCNtKAAAAUA"]
[Sun Dec 21 17:31:47.800633 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.176:8031] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUe-gwM0m463UZmqdiDEDwAAAQM"]
[Sun Dec 21 17:31:48.132143 2025] [:error] [pid 16016:tid 16042] [client 4.189.104.176:8089] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUe-hMHQ_KQh3iINaCNtLQAAAVg"]
[Sun Dec 21 17:31:48.529296 2025] [:error] [pid 20675:tid 20730] [client 4.189.104.176:8011] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUe-hLyUvZnd3bHSR3anYAAAAFg"]
[Sun Dec 21 17:31:48.788407 2025] [:error] [pid 12191:tid 12194] [client 4.189.104.176:8177] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aUe-hAM0m463UZmqdiDEEgAAAQE"]
[Sun Dec 21 17:31:49.101957 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.176:8167] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUe-hapSa967F4pOO5x2kgAAAIc"]
[Sun Dec 21 17:31:49.364366 2025] [:error] [pid 20676:tid 20742] [client 4.189.104.176:8074] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUe-hapSa967F4pOO5x2lAAAAIk"]
[Sun Dec 21 17:31:49.675053 2025] [:error] [pid 20675:tid 20725] [client 4.189.104.176:8160] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUe-hbyUvZnd3bHSR3anYgAAAFM"]
[Sun Dec 21 17:31:49.966425 2025] [:error] [pid 60191:tid 60202] [client 4.189.104.176:8029] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUe-haklhK29C3vVvLWA7gAAAYk"]
[Sun Dec 21 17:31:50.216000 2025] [:error] [pid 20676:tid 20744] [client 4.189.104.176:8018] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUe-hqpSa967F4pOO5x2lQAAAIs"]
[Sun Dec 21 17:31:50.502308 2025] [:error] [pid 20675:tid 20722] [client 4.189.104.176:8125] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUe-hryUvZnd3bHSR3anZwAAAFA"]
[Sun Dec 21 17:31:50.742512 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.176:7669] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUe-huXEVvRTAtWo3gldhwAAAMg"]
[Sun Dec 21 17:31:51.007426 2025] [:error] [pid 12191:tid 12197] [client 4.189.104.176:8119] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jdlqi.php"] [unique_id "aUe-hwM0m463UZmqdiDEFwAAAQQ"]
[Sun Dec 21 17:31:51.321124 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.176:8003] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUe-h9hSbhHOCK6TAw_J8AAAAAs"]
[Sun Dec 21 17:31:51.596541 2025] [:error] [pid 16016:tid 16031] [client 4.189.104.176:8023] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUe-h8HQ_KQh3iINaCNtMAAAAU0"]
[Sun Dec 21 17:31:51.841277 2025] [:error] [pid 20760:tid 20782] [client 4.189.104.176:8062] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUe-h-XEVvRTAtWo3gldiwAAANM"]
[Sun Dec 21 17:31:52.130645 2025] [:error] [pid 20674:tid 20687] [client 4.189.104.176:8175] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/khgdl.php"] [unique_id "aUe-iNhSbhHOCK6TAw_J8QAAAAk"]
[Sun Dec 21 17:31:52.400496 2025] [:error] [pid 20760:tid 20763] [client 4.189.104.176:8105] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aUe-iOXEVvRTAtWo3gldjQAAAMA"]
[Sun Dec 21 17:31:52.714207 2025] [:error] [pid 20674:tid 20680] [client 4.189.104.176:8009] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aUe-iNhSbhHOCK6TAw_J8gAAAAI"]
[Sun Dec 21 17:31:52.955940 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.176:7619] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aUe-iAM0m463UZmqdiDEGQAAARQ"]
[Sun Dec 21 17:31:53.233410 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.176:7625] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aUe-iapSa967F4pOO5x2mQAAAIg"]
[Sun Dec 21 17:31:53.553856 2025] [:error] [pid 12191:tid 12216] [client 4.189.104.176:8120] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xopvne.php"] [unique_id "aUe-iQM0m463UZmqdiDEHQAAARc"]
[Sun Dec 21 17:31:53.808868 2025] [:error] [pid 20674:tid 20701] [client 4.189.104.176:8049] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xopvne.php"] [unique_id "aUe-idhSbhHOCK6TAw_J9AAAABc"]
[Sun Dec 21 17:31:54.057475 2025] [:error] [pid 20760:tid 20773] [client 4.189.104.176:8099] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xopvne.php"] [unique_id "aUe-iuXEVvRTAtWo3gldkQAAAMo"]
[Sun Dec 21 17:31:54.311183 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.176:16303] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xopvne.php"] [unique_id "aUe-igM0m463UZmqdiDEIQAAARM"]
[Sun Dec 21 17:31:54.658213 2025] [:error] [pid 20760:tid 20786] [client 4.189.104.176:8017] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm18.php"] [unique_id "aUe-iuXEVvRTAtWo3gldkwAAANc"]
[Sun Dec 21 17:31:54.910268 2025] [:error] [pid 20760:tid 20770] [client 4.189.104.176:8076] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm18.php"] [unique_id "aUe-iuXEVvRTAtWo3gldlgAAAMc"]
[Sun Dec 21 17:31:55.164755 2025] [:error] [pid 16016:tid 16036] [client 4.189.104.176:8113] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm18.php"] [unique_id "aUe-i8HQ_KQh3iINaCNtMwAAAVI"]
[Sun Dec 21 17:31:55.392989 2025] [:error] [pid 20674:tid 20683] [client 4.189.104.176:8096] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm18.php"] [unique_id "aUe-i9hSbhHOCK6TAw_J_gAAAAU"]
[Sun Dec 21 17:31:55.621576 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.176:7628] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aUe-i6pSa967F4pOO5x2nAAAAI4"]
[Sun Dec 21 17:31:55.882331 2025] [:error] [pid 60191:tid 60197] [client 4.189.104.176:8022] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aUe-i6klhK29C3vVvLWA9gAAAYQ"]
[Sun Dec 21 17:31:56.122449 2025] [:error] [pid 20674:tid 20700] [client 4.189.104.176:8079] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aUe-jNhSbhHOCK6TAw_KAAAAABY"]
[Sun Dec 21 17:31:56.399806 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.176:7646] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aUe-jNhSbhHOCK6TAw_KAQAAAAc"]
[Sun Dec 21 17:31:56.659367 2025] [:error] [pid 16016:tid 16026] [client 4.189.104.176:7658] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aUe-jMHQ_KQh3iINaCNtNwAAAUg"]
[Sun Dec 21 17:31:56.934364 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.176:7952] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aUe-jAM0m463UZmqdiDEJAAAAQ4"]
[Sun Dec 21 17:31:57.259911 2025] [:error] [pid 16016:tid 16022] [client 4.189.104.176:8093] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aUe-jcHQ_KQh3iINaCNtOQAAAUQ"]
[Sun Dec 21 17:31:57.615711 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.176:7968] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/co.php"] [unique_id "aUe-jQM0m463UZmqdiDEJgAAARU"]
[Sun Dec 21 17:31:57.949718 2025] [:error] [pid 20674:tid 20680] [client 4.189.104.176:7665] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aUe-jdhSbhHOCK6TAw_KBAAAAAI"]
[Sun Dec 21 17:31:58.287563 2025] [:error] [pid 60191:tid 60194] [client 4.189.104.176:8106] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aUe-jqklhK29C3vVvLWA-QAAAYE"]
[Sun Dec 21 17:31:58.557318 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.176:7668] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aUe-jqklhK29C3vVvLWA_AAAAZA"]
[Sun Dec 21 17:31:58.841102 2025] [:error] [pid 20675:tid 20720] [client 4.189.104.176:16377] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aUe-jryUvZnd3bHSR3ancgAAAE4"]
[Sun Dec 21 17:31:59.249867 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.176:8176] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ce.php"] [unique_id "aUe-j6klhK29C3vVvLWBAQAAAYc"]
[Sun Dec 21 17:31:59.515684 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.176:7943] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ce.php"] [unique_id "aUe-j6pSa967F4pOO5x2qgAAAIU"]
[Sun Dec 21 17:31:59.803461 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.176:8090] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ce.php"] [unique_id "aUe-j6pSa967F4pOO5x2rAAAAI4"]
[Sun Dec 21 17:32:00.041411 2025] [:error] [pid 20674:tid 20700] [client 4.189.104.176:8088] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ce.php"] [unique_id "aUe-kNhSbhHOCK6TAw_KCgAAABY"]
[Sun Dec 21 17:32:00.305232 2025] [:error] [pid 60191:tid 60207] [client 4.189.104.176:8035] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aUe-kKklhK29C3vVvLWBAwAAAY4"]
[Sun Dec 21 17:32:00.563958 2025] [:error] [pid 20760:tid 20766] [client 4.189.104.176:8123] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aUe-kOXEVvRTAtWo3gldmgAAAMM"]
[Sun Dec 21 17:32:00.798045 2025] [:error] [pid 20676:tid 20753] [client 4.189.104.176:16343] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aUe-kKpSa967F4pOO5x2swAAAJQ"]
[Sun Dec 21 17:32:01.034246 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.176:8026] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aUe-kcHQ_KQh3iINaCNtPwAAAVM"]
[Sun Dec 21 17:32:01.290431 2025] [:error] [pid 12191:tid 12197] [client 4.189.104.176:7662] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aUe-kQM0m463UZmqdiDEWQAAAQQ"]
[Sun Dec 21 17:32:01.561111 2025] [:error] [pid 20675:tid 20709] [client 4.189.104.176:8034] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aUe-kbyUvZnd3bHSR3andAAAAEM"]
[Sun Dec 21 17:32:01.853777 2025] [:error] [pid 16016:tid 16035] [client 4.189.104.176:8075] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aUe-kcHQ_KQh3iINaCNtQQAAAVE"]
[Sun Dec 21 17:32:02.084308 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:8020] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aUe-ksHQ_KQh3iINaCNtQgAAAU8"]
[Sun Dec 21 17:32:02.339103 2025] [:error] [pid 20674:tid 20686] [client 4.189.104.176:16321] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asa.php"] [unique_id "aUe-kthSbhHOCK6TAw_KDAAAAAg"]
[Sun Dec 21 17:32:02.604905 2025] [:error] [pid 20674:tid 20682] [client 4.189.104.176:8007] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asa.php"] [unique_id "aUe-kthSbhHOCK6TAw_KDgAAAAQ"]
[Sun Dec 21 17:32:02.852272 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.176:16383] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asa.php"] [unique_id "aUe-kthSbhHOCK6TAw_KEAAAAAY"]
[Sun Dec 21 17:32:03.112529 2025] [:error] [pid 20675:tid 20725] [client 4.189.104.176:8108] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asa.php"] [unique_id "aUe-k7yUvZnd3bHSR3andQAAAFM"]
[Sun Dec 21 17:32:03.353449 2025] [:error] [pid 12191:tid 12205] [client 4.189.104.176:8084] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUe-kwM0m463UZmqdiDEXAAAAQw"]
[Sun Dec 21 17:32:03.593305 2025] [:error] [pid 20675:tid 20726] [client 4.189.104.176:7657] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUe-k7yUvZnd3bHSR3andgAAAFQ"]
[Sun Dec 21 17:32:03.827274 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.176:8004] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUe-kwM0m463UZmqdiDEXgAAARg"]
[Sun Dec 21 17:32:04.110525 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.176:8065] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4fk6.php"] [unique_id "aUe-lKpSa967F4pOO5x2twAAAIw"]
[Sun Dec 21 17:32:04.366909 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.176:8097] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z123.php"] [unique_id "aUe-lKpSa967F4pOO5x2uAAAAIg"]
[Sun Dec 21 17:32:04.668539 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.176:8006] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z123.php"] [unique_id "aUe-lKklhK29C3vVvLWBCAAAAYM"]
[Sun Dec 21 17:32:04.940798 2025] [:error] [pid 20760:tid 20786] [client 4.189.104.176:7939] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z123.php"] [unique_id "aUe-lOXEVvRTAtWo3gldnQAAANc"]
[Sun Dec 21 17:32:05.181345 2025] [:error] [pid 60191:tid 60195] [client 4.189.104.176:8010] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z123.php"] [unique_id "aUe-laklhK29C3vVvLWBCQAAAYI"]
[Sun Dec 21 17:32:05.424614 2025] [:error] [pid 20675:tid 20730] [client 4.189.104.176:8098] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUe-lbyUvZnd3bHSR3aneQAAAFg"]
[Sun Dec 21 17:32:05.683401 2025] [:error] [pid 20675:tid 20715] [client 4.189.104.176:8051] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUe-lbyUvZnd3bHSR3anegAAAEk"]
[Sun Dec 21 17:32:05.962507 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.176:16351] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUe-lcHQ_KQh3iINaCNtRQAAAVc"]
[Sun Dec 21 17:32:06.219441 2025] [:error] [pid 16016:tid 16026] [client 4.189.104.176:8124] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccea.php"] [unique_id "aUe-lsHQ_KQh3iINaCNtRgAAAUg"]
[Sun Dec 21 17:32:06.455810 2025] [:error] [pid 16016:tid 16034] [client 4.189.104.176:8060] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUe-lsHQ_KQh3iINaCNtSAAAAVA"]
[Sun Dec 21 17:32:06.721120 2025] [:error] [pid 20674:tid 20702] [client 4.189.104.176:8030] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUe-lthSbhHOCK6TAw_KFAAAABg"]
[Sun Dec 21 17:32:07.078867 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.176:8068] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUe-l6klhK29C3vVvLWBCgAAAYc"]
[Sun Dec 21 17:32:07.368959 2025] [:error] [pid 20674:tid 20683] [client 4.189.104.176:7961] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aUe-l9hSbhHOCK6TAw_KFQAAAAU"]
[Sun Dec 21 17:32:07.599952 2025] [:error] [pid 20675:tid 20728] [client 4.189.104.176:8104] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aUe-l7yUvZnd3bHSR3anfAAAAFY"]
[Sun Dec 21 17:32:08.034928 2025] [:error] [pid 20760:tid 20769] [client 4.189.104.176:8024] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aUe-mOXEVvRTAtWo3gldoQAAAMY"]
[Sun Dec 21 17:32:08.295012 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.176:8055] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aUe-mNhSbhHOCK6TAw_KGAAAAAc"]
[Sun Dec 21 17:32:08.623633 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.176:7631] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aUe-mKklhK29C3vVvLWBDQAAAZQ"]
[Sun Dec 21 17:32:08.863173 2025] [:error] [pid 20676:tid 20750] [client 4.189.104.176:7964] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-mKpSa967F4pOO5x2vAAAAJE"]
[Sun Dec 21 17:32:09.185489 2025] [:error] [pid 20760:tid 20765] [client 4.189.104.176:7974] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-meXEVvRTAtWo3gldpgAAAMI"]
[Sun Dec 21 17:32:09.425786 2025] [:error] [pid 20760:tid 20777] [client 4.189.104.176:7949] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-meXEVvRTAtWo3gldpwAAAM4"]
[Sun Dec 21 17:32:09.679849 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.176:7936] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aUe-mQM0m463UZmqdiDEYwAAARg"]
[Sun Dec 21 17:32:09.924010 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.176:7647] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-mQM0m463UZmqdiDEZAAAAQ0"]
[Sun Dec 21 17:32:10.215783 2025] [:error] [pid 12191:tid 12216] [client 4.189.104.176:7937] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-mgM0m463UZmqdiDEZQAAARc"]
[Sun Dec 21 17:32:10.506152 2025] [:error] [pid 12191:tid 12194] [client 4.189.104.176:7991] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-mgM0m463UZmqdiDEZwAAAQE"]
[Sun Dec 21 17:32:10.750289 2025] [:error] [pid 20676:tid 20734] [client 4.189.104.176:8114] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-mqpSa967F4pOO5x2wgAAAIE"]
[Sun Dec 21 17:32:11.024308 2025] [:error] [pid 20674:tid 20680] [client 4.189.104.176:8121] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s121ws2s.php"] [unique_id "aUe-m9hSbhHOCK6TAw_KGQAAAAI"]
[Sun Dec 21 17:32:11.261728 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.176:8117] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s121ws2s.php"] [unique_id "aUe-m9hSbhHOCK6TAw_KGgAAABQ"]
[Sun Dec 21 17:32:11.587167 2025] [:error] [pid 60191:tid 60203] [client 4.189.104.176:8101] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s121ws2s.php"] [unique_id "aUe-m6klhK29C3vVvLWBEgAAAYo"]
[Sun Dec 21 17:32:11.856606 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.176:8005] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s121ws2s.php"] [unique_id "aUe-m9hSbhHOCK6TAw_KHAAAABI"]
[Sun Dec 21 17:32:12.126422 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.176:8038] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUe-nAM0m463UZmqdiDEaQAAAQM"]
[Sun Dec 21 17:32:12.400301 2025] [:error] [pid 20674:tid 20687] [client 4.189.104.176:8045] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUe-nNhSbhHOCK6TAw_KIQAAAAk"]
[Sun Dec 21 17:32:12.725824 2025] [:error] [pid 20674:tid 20683] [client 4.189.104.176:8050] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUe-nNhSbhHOCK6TAw_KIgAAAAU"]
[Sun Dec 21 17:32:12.991459 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.176:7942] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUe-nKklhK29C3vVvLWBFAAAAZA"]
[Sun Dec 21 17:32:13.225409 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.176:7953] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUe-ndhSbhHOCK6TAw_KJAAAAAc"]
[Sun Dec 21 17:32:13.484471 2025] [:error] [pid 20674:tid 20679] [client 4.189.104.176:7947] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUe-ndhSbhHOCK6TAw_KJgAAAAE"]
[Sun Dec 21 17:32:13.733202 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.176:8001] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUe-napSa967F4pOO5x2xQAAAI4"]
[Sun Dec 21 17:32:14.040153 2025] [:error] [pid 20676:tid 20742] [client 4.189.104.176:7951] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aUe-nqpSa967F4pOO5x2yAAAAIk"]
[Sun Dec 21 17:32:14.379109 2025] [:error] [pid 20674:tid 20678] [client 4.189.104.176:7966] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aUe-nthSbhHOCK6TAw_KKAAAAAA"]
[Sun Dec 21 17:32:14.643945 2025] [:error] [pid 20676:tid 20746] [client 4.189.104.176:8036] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aUe-nqpSa967F4pOO5x2zAAAAI0"]
[Sun Dec 21 17:32:14.967601 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.176:7660] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aUe-nthSbhHOCK6TAw_KKQAAAAs"]
[Sun Dec 21 17:32:15.228480 2025] [:error] [pid 20674:tid 20680] [client 4.189.104.176:7980] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww3.php"] [unique_id "aUe-n9hSbhHOCK6TAw_KKgAAAAI"]
[Sun Dec 21 17:32:15.530126 2025] [:error] [pid 20674:tid 20691] [client 4.189.104.176:7948] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/783de.php"] [unique_id "aUe-n9hSbhHOCK6TAw_KKwAAAA0"]
[Sun Dec 21 17:32:15.792934 2025] [:error] [pid 20674:tid 20692] [client 4.189.104.176:8057] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/783de.php"] [unique_id "aUe-n9hSbhHOCK6TAw_KLgAAAA4"]
[Sun Dec 21 17:32:16.062903 2025] [:error] [pid 60191:tid 60211] [client 4.189.104.176:7975] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/783de.php"] [unique_id "aUe-oKklhK29C3vVvLWBHAAAAZI"]
[Sun Dec 21 17:32:16.325871 2025] [:error] [pid 20676:tid 20734] [client 4.189.104.176:7893] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/783de.php"] [unique_id "aUe-oKpSa967F4pOO5x2zgAAAIE"]
[Sun Dec 21 17:32:16.565412 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.176:16288] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aUe-oKklhK29C3vVvLWBHgAAAZY"]
[Sun Dec 21 17:32:16.806389 2025] [:error] [pid 20760:tid 20779] [client 4.189.104.176:8008] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aUe-oOXEVvRTAtWo3gldqQAAANA"]
[Sun Dec 21 17:32:17.042434 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.176:7938] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aUe-ocHQ_KQh3iINaCNtTwAAAVc"]
[Sun Dec 21 17:32:17.353122 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.176:7984] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aUe-ocHQ_KQh3iINaCNtUAAAAUA"]
[Sun Dec 21 17:32:17.592784 2025] [:error] [pid 20760:tid 20782] [client 4.189.104.176:7963] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aUe-oeXEVvRTAtWo3gldrAAAANM"]
[Sun Dec 21 17:32:17.820989 2025] [:error] [pid 60191:tid 60194] [client 4.189.104.176:8037] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aUe-oaklhK29C3vVvLWBIAAAAYE"]
[Sun Dec 21 17:32:18.307241 2025] [:error] [pid 20675:tid 20714] [client 4.189.104.176:8008] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aUe-oryUvZnd3bHSR3anggAAAEg"]
[Sun Dec 21 17:32:18.567989 2025] [:error] [pid 16016:tid 16034] [client 4.189.104.176:8126] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aUe-osHQ_KQh3iINaCNtUgAAAVA"]
[Sun Dec 21 17:32:18.805340 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.176:8048] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aUe-oqklhK29C3vVvLWBIQAAAYc"]
[Sun Dec 21 17:32:19.085738 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 21 17:32:19.214525 2025] [:error] [pid 20760:tid 20774] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/3i8som87avh59dosfymtvCakc.php
[Sun Dec 21 17:32:19.329719 2025] [:error] [pid 20760:tid 20778] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/rzki.php
[Sun Dec 21 17:32:19.464417 2025] [:error] [pid 20760:tid 20781] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sun Dec 21 17:32:19.581827 2025] [:error] [pid 20760:tid 20763] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/6kUgr4yGzxN.php
[Sun Dec 21 17:32:19.704609 2025] [:error] [pid 20760:tid 20766] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/rp8zi.php
[Sun Dec 21 17:32:19.820078 2025] [:error] [pid 20760:tid 20780] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/cc3.php
[Sun Dec 21 17:32:19.935892 2025] [:error] [pid 20760:tid 20767] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Dec 21 17:32:20.052017 2025] [:error] [pid 20760:tid 20785] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Dec 21 17:32:20.170301 2025] [:error] [pid 20760:tid 20764] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Sun Dec 21 17:32:20.290150 2025] [:error] [pid 20760:tid 20773] [client 4.189.104.176:7950] File does not exist: /usr/local/apache/htdocs/suspended-page/qV9GbcJwZgK.php
[Sun Dec 21 17:32:20.433409 2025] [:error] [pid 20760:tid 20779] [client 4.189.104.176:7950] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qsntqiho.php"] [unique_id "aUe-pOXEVvRTAtWo3glduwAAANA"]
[Sun Dec 21 17:32:20.770476 2025] [:error] [pid 20675:tid 20718] [client 4.189.104.176:8019] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qsntqiho.php"] [unique_id "aUe-pLyUvZnd3bHSR3anhgAAAEw"]
[Sun Dec 21 17:32:21.068606 2025] [:error] [pid 20676:tid 20744] [client 4.189.104.176:8109] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qsntqiho.php"] [unique_id "aUe-papSa967F4pOO5x20QAAAIs"]
[Sun Dec 21 17:32:21.352463 2025] [:error] [pid 20675:tid 20715] [client 4.189.104.176:7656] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qsntqiho.php"] [unique_id "aUe-pbyUvZnd3bHSR3aniAAAAEk"]
[Sun Dec 21 17:32:21.614991 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.176:8042] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qjaqjahu.php"] [unique_id "aUe-peXEVvRTAtWo3gldvAAAAMg"]
[Sun Dec 21 17:32:21.971900 2025] [:error] [pid 20760:tid 20786] [client 4.189.104.176:7958] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qjaqjahu.php"] [unique_id "aUe-peXEVvRTAtWo3gldvQAAANc"]
[Sun Dec 21 17:32:22.246871 2025] [:error] [pid 20676:tid 20756] [client 4.189.104.176:8058] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qjaqjahu.php"] [unique_id "aUe-pqpSa967F4pOO5x21AAAAJc"]
[Sun Dec 21 17:32:22.555237 2025] [:error] [pid 60191:tid 60204] [client 4.189.104.176:7972] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qjaqjahu.php"] [unique_id "aUe-pqklhK29C3vVvLWBJQAAAYs"]
[Sun Dec 21 17:32:22.804924 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.176:7955] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aUe-pqklhK29C3vVvLWBJgAAAYM"]
[Sun Dec 21 17:32:23.190935 2025] [:error] [pid 60191:tid 60212] [client 4.189.104.176:7878] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aUe-p6klhK29C3vVvLWBJwAAAZM"]
[Sun Dec 21 17:32:23.517489 2025] [:error] [pid 60191:tid 60208] [client 4.189.104.176:8014] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aUe-p6klhK29C3vVvLWBKQAAAY8"]
[Sun Dec 21 17:32:23.779249 2025] [:error] [pid 20676:tid 20739] [client 4.189.104.176:8056] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aUe-p6pSa967F4pOO5x21QAAAIY"]
[Sun Dec 21 17:32:24.183051 2025] [:error] [pid 60191:tid 60203] [client 4.189.104.176:7981] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwyjwrfr.php"] [unique_id "aUe-qKklhK29C3vVvLWBLAAAAYo"]
[Sun Dec 21 17:32:24.599707 2025] [:error] [pid 16016:tid 16040] [client 4.189.104.176:7876] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwyjwrfr.php"] [unique_id "aUe-qMHQ_KQh3iINaCNtYQAAAVY"]
[Sun Dec 21 17:32:25.007611 2025] [:error] [pid 20760:tid 20774] [client 4.189.104.176:7666] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwyjwrfr.php"] [unique_id "aUe-qeXEVvRTAtWo3gldwAAAAMs"]
[Sun Dec 21 17:32:25.352703 2025] [:error] [pid 20760:tid 20778] [client 4.189.104.176:7973] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwyjwrfr.php"] [unique_id "aUe-qeXEVvRTAtWo3gldwQAAAM8"]
[Sun Dec 21 17:32:25.676296 2025] [:error] [pid 20760:tid 20781] [client 4.189.104.176:7971] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUe-qeXEVvRTAtWo3gldwgAAANI"]
[Sun Dec 21 17:32:25.985442 2025] [:error] [pid 12191:tid 12201] [client 4.189.104.176:7986] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUe-qQM0m463UZmqdiDEfgAAAQg"]
[Sun Dec 21 17:32:26.408042 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.176:7962] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUe-qqpSa967F4pOO5x22wAAAIc"]
[Sun Dec 21 17:32:26.716755 2025] [:error] [pid 20676:tid 20743] [client 4.189.104.176:7970] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aUe-qqpSa967F4pOO5x23AAAAIo"]
[Sun Dec 21 17:32:27.046180 2025] [:error] [pid 20760:tid 20777] [client 4.189.104.176:7954] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUe-q-XEVvRTAtWo3gldwwAAAM4"]
[Sun Dec 21 17:32:27.366568 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.176:7969] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUe-q6pSa967F4pOO5x23gAAAJM"]
[Sun Dec 21 17:32:27.669835 2025] [:error] [pid 16016:tid 16029] [client 4.189.104.176:8039] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUe-q8HQ_KQh3iINaCNtYgAAAUs"]
[Sun Dec 21 17:32:27.961446 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:7988] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ox8xhkkw.php"] [unique_id "aUe-q8HQ_KQh3iINaCNtYwAAAU8"]
[Sun Dec 21 17:32:28.243148 2025] [:error] [pid 16016:tid 16028] [client 4.189.104.176:7882] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUe-rMHQ_KQh3iINaCNtZQAAAUo"]
[Sun Dec 21 17:32:28.617838 2025] [:error] [pid 20674:tid 20692] [client 4.189.104.176:7931] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUe-rNhSbhHOCK6TAw_KOgAAAA4"]
[Sun Dec 21 17:32:29.071611 2025] [:error] [pid 60191:tid 60203] [client 4.189.104.176:7977] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUe-raklhK29C3vVvLWBNwAAAYo"]
[Sun Dec 21 17:32:29.351784 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.176:7957] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oc460l3x.php"] [unique_id "aUe-rQM0m463UZmqdiDEgwAAAQk"]
[Sun Dec 21 17:32:29.640981 2025] [:error] [pid 16016:tid 16023] [client 4.189.104.176:8021] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUe-rcHQ_KQh3iINaCNtkQAAAUU"]
[Sun Dec 21 17:32:29.898978 2025] [:error] [pid 20674:tid 20701] [client 4.189.104.176:8046] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUe-rdhSbhHOCK6TAw_KTwAAABc"]
[Sun Dec 21 17:32:30.332609 2025] [:error] [pid 12191:tid 12209] [client 4.189.104.176:7898] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUe-rgM0m463UZmqdiDEhQAAARA"]
[Sun Dec 21 17:32:30.757702 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.176:7956] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NWqz649FIe7.php"] [unique_id "aUe-rryUvZnd3bHSR3anlwAAAEA"]
[Sun Dec 21 17:32:31.011508 2025] [:error] [pid 20676:tid 20756] [client 4.189.104.176:7890] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUe-r6pSa967F4pOO5x24wAAAJc"]
[Sun Dec 21 17:32:31.277099 2025] [:error] [pid 12191:tid 12205] [client 4.189.104.176:7930] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUe-rwM0m463UZmqdiDEiAAAAQw"]
[Sun Dec 21 17:32:31.533474 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.176:7872] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUe-r8HQ_KQh3iINaCNt1wAAAUA"]
[Sun Dec 21 17:32:31.859251 2025] [:error] [pid 16016:tid 16042] [client 4.189.104.176:7965] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nucqsqeg.php"] [unique_id "aUe-r8HQ_KQh3iINaCNt2wAAAVg"]
[Sun Dec 21 17:32:32.240814 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.176:7919] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mhpglaje.php"] [unique_id "aUe-sAM0m463UZmqdiDEiQAAAQY"]
[Sun Dec 21 17:32:32.649298 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.176:7875] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mhpglaje.php"] [unique_id "aUe-sMHQ_KQh3iINaCNt4wAAAUM"]
[Sun Dec 21 17:32:33.021651 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.176:7989] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mhpglaje.php"] [unique_id "aUe-scHQ_KQh3iINaCNt5wAAAUA"]
[Sun Dec 21 17:32:33.554431 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.176:7904] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mhpglaje.php"] [unique_id "aUe-sdhSbhHOCK6TAw_KZAAAAAs"]
[Sun Dec 21 17:32:33.799715 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.176:8054] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aUe-sapSa967F4pOO5x25AAAAIc"]
[Sun Dec 21 17:32:34.075865 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.176:8116] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aUe-sgM0m463UZmqdiDEigAAAQ0"]
[Sun Dec 21 17:32:34.540176 2025] [:error] [pid 12191:tid 12201] [client 4.189.104.176:7838] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aUe-sgM0m463UZmqdiDEiwAAAQg"]
[Sun Dec 21 17:32:34.837366 2025] [:error] [pid 20674:tid 20702] [client 4.189.104.176:8016] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aUe-sthSbhHOCK6TAw_KZwAAABg"]
[Sun Dec 21 17:32:35.292269 2025] [:error] [pid 20760:tid 20782] [client 4.189.104.176:8049] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aUe-s-XEVvRTAtWo3gldygAAANM"]
[Sun Dec 21 17:32:35.700858 2025] [:error] [pid 60191:tid 60206] [client 4.189.104.176:8015] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aUe-s6klhK29C3vVvLWBfgAAAY0"]
[Sun Dec 21 17:32:36.171222 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.176:7828] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aUe-tAM0m463UZmqdiDEjwAAARQ"]
[Sun Dec 21 17:32:36.834441 2025] [:error] [pid 16016:tid 16028] [client 4.189.104.176:8032] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aUe-tMHQ_KQh3iINaCNt8gAAAUo"]
[Sun Dec 21 17:32:37.727079 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.176:8053] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aUe-tQM0m463UZmqdiDEkgAAAQk"]
[Sun Dec 21 17:32:38.366796 2025] [:error] [pid 20676:tid 20757] [client 4.189.104.176:7966] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aUe-tqpSa967F4pOO5x26QAAAJg"]
[Sun Dec 21 17:32:39.085671 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.176:7998] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aUe-t6klhK29C3vVvLWBggAAAZA"]
[Sun Dec 21 17:32:39.745279 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.176:16365] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aUe-t6klhK29C3vVvLWBgwAAAYc"]
[Sun Dec 21 17:32:40.306847 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.176:7874] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aUe-uAM0m463UZmqdiDElwAAARM"]
[Sun Dec 21 17:32:40.846505 2025] [:error] [pid 20676:tid 20739] [client 4.189.104.176:7994] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aUe-uKpSa967F4pOO5x27AAAAIY"]
[Sun Dec 21 17:32:41.395182 2025] [:error] [pid 16016:tid 16027] [client 4.189.104.176:7940] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aUe-ucHQ_KQh3iINaCNuAAAAAUk"]
[Sun Dec 21 17:32:41.873843 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.176:7873] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aUe-ucHQ_KQh3iINaCNuCgAAAVc"]
[Sun Dec 21 17:32:42.325234 2025] [:error] [pid 20760:tid 20777] [client 4.189.104.176:7675] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aUe-uuXEVvRTAtWo3gldzQAAAM4"]
[Sun Dec 21 17:32:42.953842 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.176:7990] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aUe-uqpSa967F4pOO5x27gAAAJI"]
[Sun Dec 21 17:32:43.382461 2025] [:error] [pid 20674:tid 20681] [client 4.189.104.176:7992] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aUe-u9hSbhHOCK6TAw_KcAAAAAM"]
[Sun Dec 21 17:32:43.746248 2025] [:error] [pid 16016:tid 16027] [client 4.189.104.176:7910] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aUe-u8HQ_KQh3iINaCNuEQAAAUk"]
[Sun Dec 21 17:32:44.164754 2025] [:error] [pid 20760:tid 20767] [client 4.189.104.176:7879] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aUe-vOXEVvRTAtWo3gld0AAAAMQ"]
[Sun Dec 21 17:32:44.506398 2025] [:error] [pid 20675:tid 20727] [client 4.189.104.176:8059] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aUe-vLyUvZnd3bHSR3anoAAAAFU"]
[Sun Dec 21 17:32:44.984238 2025] [:error] [pid 16016:tid 16020] [client 4.189.104.176:7976] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aUe-vMHQ_KQh3iINaCNuGQAAAUI"]
[Sun Dec 21 17:32:45.328174 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.176:7929] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aUe-vbyUvZnd3bHSR3anqQAAAEA"]
[Sun Dec 21 17:32:45.815777 2025] [:error] [pid 12191:tid 12194] [client 4.189.104.176:7884] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aUe-vQM0m463UZmqdiDErAAAAQE"]
[Sun Dec 21 17:32:46.142852 2025] [:error] [pid 60191:tid 60198] [client 4.189.104.176:7987] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aUe-vqklhK29C3vVvLWBhwAAAYU"]
[Sun Dec 21 17:32:46.553041 2025] [:error] [pid 20675:tid 20726] [client 4.189.104.176:7846] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aUe-vryUvZnd3bHSR3anvAAAAFQ"]
[Sun Dec 21 17:32:46.927641 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.176:8044] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aUe-vqklhK29C3vVvLWBiAAAAZc"]
[Sun Dec 21 17:32:47.395795 2025] [:error] [pid 20674:tid 20697] [client 4.189.104.176:7979] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aUe-v9hSbhHOCK6TAw_KdAAAABM"]
[Sun Dec 21 17:32:47.789620 2025] [:error] [pid 16016:tid 16034] [client 4.189.104.176:7997] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aUe-v8HQ_KQh3iINaCNuVQAAAVA"]
[Sun Dec 21 17:32:48.180284 2025] [:error] [pid 20675:tid 20730] [client 4.189.104.176:7967] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aUe-wLyUvZnd3bHSR3anxgAAAFg"]
[Sun Dec 21 17:32:48.520331 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.176:7912] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aUe-wAM0m463UZmqdiDEugAAAQI"]
[Sun Dec 21 17:32:48.946381 2025] [:error] [pid 20760:tid 20776] [client 4.189.104.176:7830] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FSCMNvnjPX4.php"] [unique_id "aUe-wOXEVvRTAtWo3gld2gAAAM0"]
[Sun Dec 21 17:32:49.287297 2025] [:error] [pid 20760:tid 20781] [client 4.189.104.176:7883] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FSCMNvnjPX4.php"] [unique_id "aUe-weXEVvRTAtWo3gld3AAAANI"]
[Sun Dec 21 17:32:49.768065 2025] [:error] [pid 16016:tid 16031] [client 4.189.104.176:7978] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FSCMNvnjPX4.php"] [unique_id "aUe-wcHQ_KQh3iINaCNuWQAAAU0"]
[Sun Dec 21 17:32:50.099467 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.176:7897] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FSCMNvnjPX4.php"] [unique_id "aUe-wsHQ_KQh3iINaCNuWwAAAUc"]
[Sun Dec 21 17:32:50.646803 2025] [:error] [pid 16016:tid 16035] [client 4.189.104.176:7945] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-wsHQ_KQh3iINaCNuXAAAAVE"]
[Sun Dec 21 17:32:51.037977 2025] [:error] [pid 20760:tid 20775] [client 4.189.104.176:7809] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-w-XEVvRTAtWo3gld4AAAAMw"]
[Sun Dec 21 17:32:51.349982 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.176:8033] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-w9hSbhHOCK6TAw_KeQAAABI"]
[Sun Dec 21 17:32:51.731560 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.176:7959] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUe-w6pSa967F4pOO5x2-AAAAJI"]
[Sun Dec 21 17:32:52.062867 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.176:7809] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUe-xAM0m463UZmqdiDEwQAAARU"]
[Sun Dec 21 17:32:52.474974 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.176:7909] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUe-xKpSa967F4pOO5x2-gAAAIg"]
[Sun Dec 21 17:32:52.886753 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.176:7996] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUe-xAM0m463UZmqdiDExAAAAQY"]
[Sun Dec 21 17:32:53.209259 2025] [:error] [pid 20676:tid 20753] [client 4.189.104.176:16327] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "aUe-xapSa967F4pOO5x2_AAAAJQ"]
[Sun Dec 21 17:32:53.650961 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.176:7744] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUe-xeXEVvRTAtWo3gld5wAAAMg"]
[Sun Dec 21 17:32:53.951821 2025] [:error] [pid 60191:tid 60195] [client 4.189.104.176:8043] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUe-xaklhK29C3vVvLWBjgAAAYI"]
[Sun Dec 21 17:32:54.381370 2025] [:error] [pid 16016:tid 16032] [client 4.189.104.176:8072] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUe-xsHQ_KQh3iINaCNuYQAAAU4"]
[Sun Dec 21 17:32:54.772043 2025] [:error] [pid 20675:tid 20714] [client 4.189.104.176:7815] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUe-xryUvZnd3bHSR3anyQAAAEg"]
[Sun Dec 21 17:32:55.344136 2025] [:error] [pid 20760:tid 20783] [client 4.189.104.176:7927] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aUe-x-XEVvRTAtWo3gld6wAAANQ"]
[Sun Dec 21 17:32:55.698718 2025] [:error] [pid 20674:tid 20690] [client 4.189.104.176:7845] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aUe-x9hSbhHOCK6TAw_KgQAAAAw"]
[Sun Dec 21 17:32:56.103243 2025] [:error] [pid 20675:tid 20722] [client 4.189.104.176:7833] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aUe-yLyUvZnd3bHSR3anzAAAAFA"]
[Sun Dec 21 17:32:56.542154 2025] [:error] [pid 60191:tid 60199] [client 4.189.104.176:7765] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aUe-yKklhK29C3vVvLWBkwAAAYY"]
[Sun Dec 21 17:32:57.020629 2025] [:error] [pid 20674:tid 20679] [client 4.189.104.176:7812] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aUe-ydhSbhHOCK6TAw_KhAAAAAE"]
[Sun Dec 21 17:32:57.621789 2025] [:error] [pid 20676:tid 20744] [client 4.189.104.176:7842] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aUe-yapSa967F4pOO5x3AgAAAIs"]
[Sun Dec 21 17:32:58.411840 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.176:7933] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aUe-yqpSa967F4pOO5x3AwAAAIw"]
[Sun Dec 21 17:32:58.874447 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.176:7941] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aUe-yqklhK29C3vVvLWBlwAAAYg"]
[Sun Dec 21 17:32:59.313218 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.176:7835] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aUe-y8HQ_KQh3iINaCNuZAAAAUc"]
[Sun Dec 21 17:32:59.914954 2025] [:error] [pid 20676:tid 20746] [client 4.189.104.176:7808] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aUe-y6pSa967F4pOO5x3BwAAAI0"]
[Sun Dec 21 17:33:00.593148 2025] [:error] [pid 20675:tid 20720] [client 4.189.104.176:7826] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aUe-zLyUvZnd3bHSR3an0QAAAE4"]
[Sun Dec 21 17:33:01.232828 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.176:7891] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aUe-zdhSbhHOCK6TAw_KiQAAABQ"]
[Sun Dec 21 17:33:02.209260 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.176:7993] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aUe-zgM0m463UZmqdiDEzQAAAQk"]
[Sun Dec 21 17:33:02.600661 2025] [:error] [pid 12191:tid 12193] [client 4.189.104.176:7920] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aUe-zgM0m463UZmqdiDEzgAAAQA"]
[Sun Dec 21 17:33:03.615747 2025] [:error] [pid 20676:tid 20755] [client 4.189.104.176:7839] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aUe-z6pSa967F4pOO5x3DgAAAJY"]
[Sun Dec 21 17:33:04.344141 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.176:7926] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aUe-0AM0m463UZmqdiDE0AAAAQ0"]
[Sun Dec 21 17:33:05.208270 2025] [:error] [pid 20676:tid 20757] [client 4.189.104.176:7836] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aUe-0apSa967F4pOO5x3EAAAAJg"]
[Sun Dec 21 17:33:05.801738 2025] [:error] [pid 20760:tid 20769] [client 4.189.104.176:7999] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aUe-0eXEVvRTAtWo3gld8gAAAMY"]
[Sun Dec 21 17:33:06.188217 2025] [:error] [pid 12191:tid 12209] [client 4.189.104.176:7819] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aUe-0gM0m463UZmqdiDE1QAAARA"]
[Sun Dec 21 17:33:06.717186 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.176:7775] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aUe-0sHQ_KQh3iINaCNucAAAAU8"]
[Sun Dec 21 17:33:07.207678 2025] [:error] [pid 60191:tid 60198] [client 4.189.104.176:8063] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sikma.php"] [unique_id "aUe-06klhK29C3vVvLWBoQAAAYU"]
[Sun Dec 21 17:33:07.541940 2025] [:error] [pid 60191:tid 60206] [client 4.189.104.176:7811] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sikma.php"] [unique_id "aUe-06klhK29C3vVvLWBogAAAY0"]
[Sun Dec 21 17:33:08.040146 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.176:8028] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sikma.php"] [unique_id "aUe-1KklhK29C3vVvLWBowAAAYw"]
[Sun Dec 21 17:33:08.442881 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.176:7901] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sikma.php"] [unique_id "aUe-1MHQ_KQh3iINaCNucQAAAVM"]
[Sun Dec 21 17:33:08.831326 2025] [:error] [pid 12191:tid 12215] [client 4.189.104.176:7892] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "aUe-1AM0m463UZmqdiDE3QAAARY"]
[Sun Dec 21 17:33:09.176354 2025] [:error] [pid 20676:tid 20734] [client 4.189.104.176:7916] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "aUe-1apSa967F4pOO5x3EgAAAIE"]
[Sun Dec 21 17:33:09.548179 2025] [:error] [pid 20675:tid 20709] [client 4.189.104.176:7932] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "aUe-1byUvZnd3bHSR3an3AAAAEM"]
[Sun Dec 21 17:33:09.875712 2025] [:error] [pid 20675:tid 20708] [client 4.189.104.176:7917] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "aUe-1byUvZnd3bHSR3an3QAAAEI"]
[Sun Dec 21 17:33:10.364007 2025] [:error] [pid 20675:tid 20714] [client 4.189.104.176:7923] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/database.php"] [unique_id "aUe-1ryUvZnd3bHSR3an4AAAAEg"]
[Sun Dec 21 17:33:11.190424 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.176:7895] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/database.php"] [unique_id "aUe-1wM0m463UZmqdiDE6QAAAQk"]
[Sun Dec 21 17:33:11.529160 2025] [:error] [pid 16016:tid 16032] [client 4.189.104.176:7907] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/database.php"] [unique_id "aUe-18HQ_KQh3iINaCNucwAAAU4"]
[Sun Dec 21 17:33:11.910260 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.176:8040] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/database.php"] [unique_id "aUe-18HQ_KQh3iINaCNudAAAAUA"]
[Sun Dec 21 17:33:12.427264 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.176:7844] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUe-2KklhK29C3vVvLWBqQAAAYM"]
[Sun Dec 21 17:33:12.760535 2025] [:error] [pid 16016:tid 16040] [client 4.189.104.176:7908] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUe-2MHQ_KQh3iINaCNudQAAAVY"]
[Sun Dec 21 17:33:13.091375 2025] [:error] [pid 20760:tid 20774] [client 4.189.104.176:8002] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUe-2eXEVvRTAtWo3gld9wAAAMs"]
[Sun Dec 21 17:33:13.383967 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.176:7825] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUe-2apSa967F4pOO5x3GAAAAIw"]
[Sun Dec 21 17:33:13.709280 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.176:7944] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aUe-2cHQ_KQh3iINaCNudgAAAUM"]
[Sun Dec 21 17:33:13.989767 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.176:7855] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aUe-2aklhK29C3vVvLWBrQAAAZY"]
[Sun Dec 21 17:33:14.362938 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.176:7894] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aUe-2gM0m463UZmqdiDE8wAAAQY"]
[Sun Dec 21 17:33:14.927934 2025] [:error] [pid 12191:tid 12200] [client 4.189.104.176:7915] [client 4.189.104.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aUe-2gM0m463UZmqdiDE9AAAAQc"]
[Mon Dec 22 00:04:48.845445 2025] [:error] [pid 30183:tid 30190] [client 167.172.29.113:48540] [client 167.172.29.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUgaoOCmP2zCzk_WZcVI1AAAAQU"]
[Mon Dec 22 00:23:15.552291 2025] [:error] [pid 45306:tid 45322] [client 138.197.36.149:38554] [client 138.197.36.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aUge89sL27CzxZxVWqQkAwAAAEY"]
[Mon Dec 22 00:27:47.791323 2025] [:error] [pid 45308:tid 45355] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.5.1.php
[Mon Dec 22 00:27:47.960208 2025] [:error] [pid 45308:tid 45353] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.5.0.php
[Mon Dec 22 00:27:48.219061 2025] [:error] [pid 45308:tid 45356] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.2.4-en.php
[Mon Dec 22 00:27:48.377655 2025] [:error] [pid 45308:tid 45368] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.4.0.php
[Mon Dec 22 00:27:48.532816 2025] [:error] [pid 45308:tid 45349] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.3.4.php
[Mon Dec 22 00:27:48.686836 2025] [:error] [pid 45308:tid 45358] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.3.3.php
[Mon Dec 22 00:27:49.235730 2025] [:error] [pid 45308:tid 45350] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.2.5-en.php
[Mon Dec 22 00:27:49.392796 2025] [:error] [pid 45308:tid 45365] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.3.2.php
[Mon Dec 22 00:27:49.544809 2025] [:error] [pid 45308:tid 45355] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.3.1.php
[Mon Dec 22 00:27:49.724153 2025] [:error] [pid 45308:tid 45359] [client 74.225.156.134:12194] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.3.0.php
[Mon Dec 22 00:27:49.880466 2025] [:error] [pid 45308:tid 45364] [client 74.225.156.134:12194] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.0-en.php"] [unique_id "aUggBWQKrTzAeGeriX240wAAAJQ"]
[Mon Dec 22 00:27:53.288607 2025] [:error] [pid 45399:tid 45414] [client 74.225.156.134:11517] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.0-en.php"] [unique_id "aUggCTHbaarUHjCTA4t4kgAAAQ0"]
[Mon Dec 22 00:27:58.920157 2025] [:error] [pid 45309:tid 45372] [client 74.225.156.134:65000] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.0-en.php"] [unique_id "aUggDoitmFVpLjGlR3izpAAAAME"]
[Mon Dec 22 00:28:06.181567 2025] [:error] [pid 45308:tid 45361] [client 74.225.156.134:60100] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-3.2.2.php"] [unique_id "aUggFmQKrTzAeGeriX247QAAAJE"]
[Mon Dec 22 00:28:13.391763 2025] [:error] [pid 45308:tid 45361] [client 74.225.156.134:60700] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-3.2.2.php"] [unique_id "aUggHWQKrTzAeGeriX249gAAAJE"]
[Mon Dec 22 00:28:17.353040 2025] [:error] [pid 46403:tid 46422] [client 74.225.156.134:60665] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-3.2.2.php"] [unique_id "aUggIVuzQIlydmAwinpQgwAAAZE"]
[Mon Dec 22 00:28:40.074603 2025] [:error] [pid 45399:tid 45418] [client 74.225.156.134:60475] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-3.2.0.php"] [unique_id "aUggODHbaarUHjCTA4t4sgAAARE"]
[Mon Dec 22 00:28:41.528585 2025] [:error] [pid 45308:tid 45359] [client 74.225.156.134:36937] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-3.2.0.php"] [unique_id "aUggOWQKrTzAeGeriX25HwAAAI8"]
[Mon Dec 22 00:28:45.191495 2025] [:error] [pid 46403:tid 46422] [client 74.225.156.134:60958] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-3.2.0.php"] [unique_id "aUggPVuzQIlydmAwinpQowAAAZE"]
[Mon Dec 22 00:28:46.382233 2025] [:error] [pid 45306:tid 45328] [client 74.225.156.134:61274] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-3.2.0.php"] [unique_id "aUggPtsL27CzxZxVWqQlAAAAAEw"]
[Mon Dec 22 00:28:47.230867 2025] [:error] [pid 45399:tid 45423] [client 74.225.156.134:61285] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.1-en.php"] [unique_id "aUggPzHbaarUHjCTA4t4uQAAARY"]
[Mon Dec 22 00:29:00.182781 2025] [:error] [pid 45309:tid 45372] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.3.1-en.php
[Mon Dec 22 00:29:00.357629 2025] [:error] [pid 45309:tid 45392] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.1.0.php
[Mon Dec 22 00:29:00.510023 2025] [:error] [pid 45309:tid 45380] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.0.1.php
[Mon Dec 22 00:29:00.657635 2025] [:error] [pid 45309:tid 45371] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-3.0.0.php
[Mon Dec 22 00:29:00.827087 2025] [:error] [pid 45309:tid 45382] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.4.0-en.php
[Mon Dec 22 00:29:00.998047 2025] [:error] [pid 45309:tid 45390] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.5.0-en.php
[Mon Dec 22 00:29:01.174560 2025] [:error] [pid 45309:tid 45385] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.6.0-en.php
[Mon Dec 22 00:29:02.591691 2025] [:error] [pid 45309:tid 45385] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.6.1-en.php
[Mon Dec 22 00:29:02.776071 2025] [:error] [pid 45309:tid 45386] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.6.2-en.php
[Mon Dec 22 00:29:02.957109 2025] [:error] [pid 45309:tid 45381] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.6.3-en.php
[Mon Dec 22 00:29:03.217300 2025] [:error] [pid 45309:tid 45393] [client 74.225.156.134:16680] File does not exist: /usr/local/apache/htdocs/suspended-page/yapgb.php
[Mon Dec 22 00:29:03.378457 2025] [:error] [pid 45309:tid 45394] [client 74.225.156.134:16680] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/book.php"] [unique_id "aUggT4itmFVpLjGlR3iz6AAAANc"]
[Mon Dec 22 00:29:11.872295 2025] [:error] [pid 45309:tid 45383] [client 74.225.156.134:65352] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/book.php"] [unique_id "aUggV4itmFVpLjGlR3iz7QAAAMw"]
[Mon Dec 22 00:29:30.960038 2025] [:error] [pid 45308:tid 45348] [client 74.225.156.134:63097] [client 74.225.156.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.7.0-en.php"] [unique_id "aUggamQKrTzAeGeriX25dAAAAIQ"]
[Mon Dec 22 02:32:53.129684 2025] [:error] [pid 46374:tid 46398] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon Dec 22 02:32:53.257474 2025] [:error] [pid 46374:tid 46376] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Dec 22 02:32:53.540838 2025] [:error] [pid 46374:tid 46383] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Mon Dec 22 02:32:53.841103 2025] [:error] [pid 46374:tid 46379] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Mon Dec 22 02:32:54.249454 2025] [:error] [pid 46374:tid 46379] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Dec 22 02:32:54.371100 2025] [:error] [pid 46374:tid 46385] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Mon Dec 22 02:32:54.490851 2025] [:error] [pid 46374:tid 46395] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Mon Dec 22 02:32:54.756470 2025] [:error] [pid 46374:tid 46387] [client 40.83.96.65:12411] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Mon Dec 22 02:32:54.875762 2025] [:error] [pid 46374:tid 46389] [client 40.83.96.65:12411] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUg9VhLD7sK-wqrnXHUqUAAAAU0"]
[Mon Dec 22 02:32:55.797038 2025] [:error] [pid 45309:tid 45389] [client 40.83.96.65:12312] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUg9V4itmFVpLjGlR3jV9wAAANI"]
[Mon Dec 22 02:32:57.097865 2025] [:error] [pid 45308:tid 45357] [client 40.83.96.65:12377] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUg9WWQKrTzAeGeriX3kwQAAAI0"]
[Mon Dec 22 02:32:59.406163 2025] [:error] [pid 45308:tid 45361] [client 40.83.96.65:12359] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUg9W2QKrTzAeGeriX3kxgAAAJE"]
[Mon Dec 22 02:32:59.699358 2025] [:error] [pid 46343:tid 46364] [client 40.83.96.65:12318] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUg9WxzbW_u_EvstJwQ1SgAAABI"]
[Mon Dec 22 02:33:00.287531 2025] [:error] [pid 46403:tid 46421] [client 40.83.96.65:12298] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUg9XFuzQIlydmAwinpsJQAAAZA"]
[Mon Dec 22 02:33:01.596710 2025] [:error] [pid 46374:tid 46388] [client 40.83.96.65:12364] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUg9XRLD7sK-wqrnXHUqUQAAAUw"]
[Mon Dec 22 02:33:02.586429 2025] [:error] [pid 45309:tid 45376] [client 40.83.96.65:12372] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUg9XoitmFVpLjGlR3jV_gAAAMU"]
[Mon Dec 22 02:33:03.681416 2025] [:error] [pid 45399:tid 45421] [client 40.83.96.65:5108] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aUg9XzHbaarUHjCTA4uWaAAAARQ"]
[Mon Dec 22 02:33:04.188261 2025] [:error] [pid 45309:tid 45384] [client 40.83.96.65:12404] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aUg9YIitmFVpLjGlR3jV_wAAAM0"]
[Mon Dec 22 02:33:04.982624 2025] [:error] [pid 45308:tid 45351] [client 40.83.96.65:5099] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aUg9YGQKrTzAeGeriX3k1gAAAIc"]
[Mon Dec 22 02:33:06.996271 2025] [:error] [pid 45306:tid 45317] [client 40.83.96.65:12327] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aUg9YtsL27CzxZxVWqQ8mgAAAEE"]
[Mon Dec 22 02:33:07.685046 2025] [:error] [pid 45309:tid 45375] [client 40.83.96.65:12313] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUg9Y4itmFVpLjGlR3jWAQAAAMQ"]
[Mon Dec 22 02:33:08.955919 2025] [:error] [pid 45399:tid 45425] [client 40.83.96.65:12357] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUg9ZDHbaarUHjCTA4uWbgAAARg"]
[Mon Dec 22 02:33:09.465795 2025] [:error] [pid 45399:tid 45401] [client 40.83.96.65:12360] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUg9ZTHbaarUHjCTA4uWcQAAAQA"]
[Mon Dec 22 02:33:10.273874 2025] [:error] [pid 46403:tid 46415] [client 40.83.96.65:12365] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUg9ZluzQIlydmAwinpsLQAAAYo"]
[Mon Dec 22 02:33:11.561752 2025] [:error] [pid 45309:tid 45379] [client 40.83.96.65:12304] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUg9Z4itmFVpLjGlR3jWBgAAAMg"]
[Mon Dec 22 02:33:12.339140 2025] [:error] [pid 46343:tid 46351] [client 40.83.96.65:12326] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUg9aBzbW_u_EvstJwQ1WwAAAAU"]
[Mon Dec 22 02:33:12.924788 2025] [:error] [pid 46403:tid 46420] [client 40.83.96.65:12299] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUg9aFuzQIlydmAwinpsMwAAAY8"]
[Mon Dec 22 02:33:13.665423 2025] [:error] [pid 46374:tid 46382] [client 40.83.96.65:12392] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUg9aRLD7sK-wqrnXHUqWgAAAUY"]
[Mon Dec 22 02:33:14.660435 2025] [:error] [pid 45308:tid 45362] [client 40.83.96.65:12412] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUg9amQKrTzAeGeriX3k2gAAAJI"]
[Mon Dec 22 02:33:15.094315 2025] [:error] [pid 46403:tid 46416] [client 40.83.96.65:12305] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUg9a1uzQIlydmAwinpsOgAAAYs"]
[Mon Dec 22 02:33:15.871312 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:12296] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUg9a2QKrTzAeGeriX3k2wAAAJc"]
[Mon Dec 22 02:33:16.248330 2025] [:error] [pid 45308:tid 45361] [client 40.83.96.65:12379] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUg9bGQKrTzAeGeriX3k3gAAAJE"]
[Mon Dec 22 02:33:17.270904 2025] [:error] [pid 45309:tid 45389] [client 40.83.96.65:12310] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUg9bYitmFVpLjGlR3jWCAAAANI"]
[Mon Dec 22 02:33:17.667758 2025] [:error] [pid 45308:tid 45348] [client 40.83.96.65:12374] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUg9bWQKrTzAeGeriX3k4gAAAIQ"]
[Mon Dec 22 02:33:18.162363 2025] [:error] [pid 46403:tid 46421] [client 40.83.96.65:12380] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUg9bluzQIlydmAwinpsPgAAAZA"]
[Mon Dec 22 02:33:18.458895 2025] [:error] [pid 45308:tid 45350] [client 40.83.96.65:12408] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUg9bmQKrTzAeGeriX3k5gAAAIY"]
[Mon Dec 22 02:33:19.072300 2025] [:error] [pid 45308:tid 45363] [client 40.83.96.65:12366] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUg9b2QKrTzAeGeriX3k6QAAAJM"]
[Mon Dec 22 02:33:20.830302 2025] [:error] [pid 46403:tid 46416] [client 40.83.96.65:12297] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUg9cFuzQIlydmAwinpsQgAAAYs"]
[Mon Dec 22 02:33:21.222334 2025] [:error] [pid 45309:tid 45384] [client 40.83.96.65:12398] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUg9cYitmFVpLjGlR3jWDAAAAM0"]
[Mon Dec 22 02:33:21.587020 2025] [:error] [pid 45309:tid 45374] [client 40.83.96.65:12397] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUg9cYitmFVpLjGlR3jWDwAAAMM"]
[Mon Dec 22 02:33:22.043647 2025] [:error] [pid 45309:tid 45380] [client 40.83.96.65:12356] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUg9coitmFVpLjGlR3jWEQAAAMk"]
[Mon Dec 22 02:33:22.531664 2025] [:error] [pid 45309:tid 45373] [client 40.83.96.65:12302] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUg9coitmFVpLjGlR3jWFAAAAMI"]
[Mon Dec 22 02:33:23.369096 2025] [:error] [pid 45309:tid 45377] [client 40.83.96.65:12361] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUg9c4itmFVpLjGlR3jWFwAAAMY"]
[Mon Dec 22 02:33:24.086085 2025] [:error] [pid 45308:tid 45357] [client 40.83.96.65:12317] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUg9dGQKrTzAeGeriX3k9QAAAI0"]
[Mon Dec 22 02:33:25.457271 2025] [:error] [pid 46374:tid 46397] [client 40.83.96.65:12308] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUg9dRLD7sK-wqrnXHUqXAAAAVU"]
[Mon Dec 22 02:33:26.459792 2025] [:error] [pid 45308:tid 45345] [client 40.83.96.65:12410] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUg9dmQKrTzAeGeriX3k_AAAAIE"]
[Mon Dec 22 02:33:27.222322 2025] [:error] [pid 46403:tid 46409] [client 40.83.96.65:12292] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUg9d1uzQIlydmAwinpsRgAAAYQ"]
[Mon Dec 22 02:33:28.012725 2025] [:error] [pid 45306:tid 45335] [client 40.83.96.65:12348] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aUg9eNsL27CzxZxVWqQ8owAAAFM"]
[Mon Dec 22 02:33:28.749735 2025] [:error] [pid 45399:tid 45405] [client 40.83.96.65:12381] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUg9eDHbaarUHjCTA4uWfwAAAQQ"]
[Mon Dec 22 02:33:29.333073 2025] [:error] [pid 45399:tid 45401] [client 40.83.96.65:12307] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUg9eTHbaarUHjCTA4uWgwAAAQA"]
[Mon Dec 22 02:33:30.316903 2025] [:error] [pid 46343:tid 46347] [client 40.83.96.65:12301] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUg9ehzbW_u_EvstJwQ1YgAAAAE"]
[Mon Dec 22 02:33:31.306372 2025] [:error] [pid 45306:tid 45334] [client 40.83.96.65:12322] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUg9e9sL27CzxZxVWqQ8pwAAAFI"]
[Mon Dec 22 02:33:31.787710 2025] [:error] [pid 45308:tid 45360] [client 40.83.96.65:12311] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUg9e2QKrTzAeGeriX3lAQAAAJA"]
[Mon Dec 22 02:33:32.489677 2025] [:error] [pid 45308:tid 45346] [client 40.83.96.65:12358] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUg9fGQKrTzAeGeriX3lAgAAAII"]
[Mon Dec 22 02:33:35.412940 2025] [:error] [pid 45399:tid 45410] [client 40.83.96.65:12323] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUg9fzHbaarUHjCTA4uWkQAAAQk"]
[Mon Dec 22 02:33:36.335070 2025] [:error] [pid 46403:tid 46421] [client 40.83.96.65:12383] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aUg9gFuzQIlydmAwinpsUwAAAZA"]
[Mon Dec 22 02:33:36.823925 2025] [:error] [pid 46374:tid 46385] [client 40.83.96.65:12373] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUg9gBLD7sK-wqrnXHUqbgAAAUk"]
[Mon Dec 22 02:33:38.365008 2025] [:error] [pid 45309:tid 45373] [client 40.83.96.65:12405] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUg9goitmFVpLjGlR3jWJQAAAMI"]
[Mon Dec 22 02:33:39.449223 2025] [:error] [pid 46374:tid 46395] [client 40.83.96.65:5063] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUg9gxLD7sK-wqrnXHUqbwAAAVM"]
[Mon Dec 22 02:33:41.401283 2025] [:error] [pid 46343:tid 46346] [client 40.83.96.65:5066] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aUg9hRzbW_u_EvstJwQ1bwAAAAA"]
[Mon Dec 22 02:33:42.067021 2025] [:error] [pid 45306:tid 45340] [client 40.83.96.65:12343] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUg9htsL27CzxZxVWqQ8rgAAAFg"]
[Mon Dec 22 02:33:42.825885 2025] [:error] [pid 45399:tid 45417] [client 40.83.96.65:12288] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUg9hjHbaarUHjCTA4uWlgAAARA"]
[Mon Dec 22 02:33:43.138094 2025] [:error] [pid 45306:tid 45317] [client 40.83.96.65:12407] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUg9h9sL27CzxZxVWqQ8sAAAAEE"]
[Mon Dec 22 02:33:43.629634 2025] [:error] [pid 45399:tid 45413] [client 40.83.96.65:12382] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUg9hzHbaarUHjCTA4uWlwAAAQw"]
[Mon Dec 22 02:33:44.143583 2025] [:error] [pid 46403:tid 46415] [client 40.83.96.65:12314] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg9iFuzQIlydmAwinpsWwAAAYo"]
[Mon Dec 22 02:33:45.346005 2025] [:error] [pid 46374:tid 46386] [client 40.83.96.65:12401] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg9iRLD7sK-wqrnXHUqdAAAAUo"]
[Mon Dec 22 02:33:46.856466 2025] [:error] [pid 45399:tid 45409] [client 40.83.96.65:12303] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg9ijHbaarUHjCTA4uWmQAAAQg"]
[Mon Dec 22 02:33:48.540252 2025] [:error] [pid 46403:tid 46428] [client 40.83.96.65:5111] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg9jFuzQIlydmAwinpsXAAAAZc"]
[Mon Dec 22 02:33:50.032290 2025] [:error] [pid 45308:tid 45357] [client 40.83.96.65:12339] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUg9jmQKrTzAeGeriX3lDwAAAI0"]
[Mon Dec 22 02:33:50.888311 2025] [:error] [pid 45306:tid 45320] [client 40.83.96.65:12400] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUg9jtsL27CzxZxVWqQ8swAAAEQ"]
[Mon Dec 22 02:33:52.469362 2025] [:error] [pid 46343:tid 46353] [client 40.83.96.65:5096] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUg9kBzbW_u_EvstJwQ1fgAAAAc"]
[Mon Dec 22 02:33:53.334982 2025] [:error] [pid 46403:tid 46427] [client 40.83.96.65:12290] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUg9kVuzQIlydmAwinpsYAAAAZY"]
[Mon Dec 22 02:33:54.255834 2025] [:error] [pid 45308:tid 45349] [client 40.83.96.65:12294] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Dec 22 02:33:54.667176 2025] [:error] [pid 45308:tid 45353] [client 40.83.96.65:12294] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Mon Dec 22 02:33:54.787285 2025] [:error] [pid 45308:tid 45345] [client 40.83.96.65:12294] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Mon Dec 22 02:33:54.920110 2025] [:error] [pid 45308:tid 45360] [client 40.83.96.65:12294] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Mon Dec 22 02:33:55.044095 2025] [:error] [pid 45308:tid 45348] [client 40.83.96.65:12294] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Dec 22 02:33:55.164613 2025] [:error] [pid 45308:tid 45363] [client 40.83.96.65:12294] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Mon Dec 22 02:33:55.286157 2025] [:error] [pid 45308:tid 45354] [client 40.83.96.65:12294] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Mon Dec 22 02:33:55.403462 2025] [:error] [pid 45308:tid 45357] [client 40.83.96.65:12294] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUg9k2QKrTzAeGeriX3lHQAAAI0"]
[Mon Dec 22 02:33:55.922682 2025] [:error] [pid 45399:tid 45410] [client 40.83.96.65:12376] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Mon Dec 22 02:33:56.043032 2025] [:error] [pid 45399:tid 45425] [client 40.83.96.65:12376] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Mon Dec 22 02:33:56.160522 2025] [:error] [pid 45399:tid 45417] [client 40.83.96.65:12376] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9lDHbaarUHjCTA4uWpAAAARA"]
[Mon Dec 22 02:33:56.523324 2025] [:error] [pid 45309:tid 45376] [client 40.83.96.65:12403] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9lIitmFVpLjGlR3jWNwAAAMU"]
[Mon Dec 22 02:33:57.122559 2025] [:error] [pid 45308:tid 45359] [client 40.83.96.65:12316] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9lWQKrTzAeGeriX3lHwAAAI8"]
[Mon Dec 22 02:33:57.627923 2025] [:error] [pid 46343:tid 46369] [client 40.83.96.65:12363] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9lRzbW_u_EvstJwQ1hgAAABc"]
[Mon Dec 22 02:33:57.971050 2025] [:error] [pid 46343:tid 46354] [client 40.83.96.65:5056] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUg9lRzbW_u_EvstJwQ1hwAAAAg"]
[Mon Dec 22 02:33:58.489352 2025] [:error] [pid 46374:tid 46390] [client 40.83.96.65:12388] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUg9lhLD7sK-wqrnXHUqfwAAAU4"]
[Mon Dec 22 02:33:58.881562 2025] [:error] [pid 45306:tid 45326] [client 40.83.96.65:12338] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUg9ltsL27CzxZxVWqQ8uAAAAEo"]
[Mon Dec 22 02:33:59.468782 2025] [:error] [pid 45308:tid 45355] [client 40.83.96.65:12319] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aUg9l2QKrTzAeGeriX3lIgAAAIs"]
[Mon Dec 22 02:34:00.212632 2025] [:error] [pid 45399:tid 45406] [client 40.83.96.65:12381] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUg9mDHbaarUHjCTA4uWpQAAAQU"]
[Mon Dec 22 02:34:01.134149 2025] [:error] [pid 45308:tid 45347] [client 40.83.96.65:12387] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUg9mWQKrTzAeGeriX3lIwAAAIM"]
[Mon Dec 22 02:34:01.815303 2025] [:error] [pid 46374:tid 46386] [client 40.83.96.65:5057] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUg9mRLD7sK-wqrnXHUqiAAAAUo"]
[Mon Dec 22 02:34:03.099026 2025] [:error] [pid 46343:tid 46349] [client 40.83.96.65:12315] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aUg9mxzbW_u_EvstJwQ1iQAAAAM"]
[Mon Dec 22 02:34:03.701163 2025] [:error] [pid 45308:tid 45346] [client 40.83.96.65:12349] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUg9m2QKrTzAeGeriX3lJwAAAII"]
[Mon Dec 22 02:34:04.135441 2025] [:error] [pid 45306:tid 45334] [client 40.83.96.65:12289] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUg9nNsL27CzxZxVWqQ8vgAAAFI"]
[Mon Dec 22 02:34:05.338040 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:5073] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUg9nWQKrTzAeGeriX3lKgAAAJc"]
[Mon Dec 22 02:34:05.890730 2025] [:error] [pid 45308:tid 45364] [client 40.83.96.65:5083] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUg9nWQKrTzAeGeriX3lLAAAAJQ"]
[Mon Dec 22 02:34:06.772107 2025] [:error] [pid 45308:tid 45347] [client 40.83.96.65:12293] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUg9nmQKrTzAeGeriX3lLwAAAIM"]
[Mon Dec 22 02:34:07.474747 2025] [:error] [pid 45308:tid 45365] [client 40.83.96.65:12402] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUg9n2QKrTzAeGeriX3lMQAAAJU"]
[Mon Dec 22 02:34:07.763866 2025] [:error] [pid 46403:tid 46410] [client 40.83.96.65:12409] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUg9n1uzQIlydmAwinpsbQAAAYU"]
[Mon Dec 22 02:34:09.203762 2025] [:error] [pid 45399:tid 45420] [client 40.83.96.65:12352] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aUg9oTHbaarUHjCTA4uWqwAAARM"]
[Mon Dec 22 02:34:10.343264 2025] [:error] [pid 45309:tid 45391] [client 40.83.96.65:12306] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aUg9ooitmFVpLjGlR3jWPwAAANQ"]
[Mon Dec 22 02:34:11.008606 2025] [:error] [pid 45309:tid 45388] [client 40.83.96.65:12415] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aUg9o4itmFVpLjGlR3jWQQAAANE"]
[Mon Dec 22 02:34:11.472348 2025] [:error] [pid 45309:tid 45385] [client 40.83.96.65:12320] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aUg9o4itmFVpLjGlR3jWQwAAAM4"]
[Mon Dec 22 02:34:12.136475 2025] [:error] [pid 45306:tid 45337] [client 40.83.96.65:4994] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aUg9pNsL27CzxZxVWqQ8wQAAAFU"]
[Mon Dec 22 02:34:12.627284 2025] [:error] [pid 46343:tid 46370] [client 40.83.96.65:5069] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUg9pBzbW_u_EvstJwQ1jAAAABg"]
[Mon Dec 22 02:34:13.388038 2025] [:error] [pid 45308:tid 45348] [client 40.83.96.65:12368] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUg9pWQKrTzAeGeriX3lNAAAAIQ"]
[Mon Dec 22 02:34:13.825693 2025] [:error] [pid 45309:tid 45392] [client 40.83.96.65:12344] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUg9pYitmFVpLjGlR3jWRAAAANU"]
[Mon Dec 22 02:34:14.169526 2025] [:error] [pid 45309:tid 45393] [client 40.83.96.65:5112] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUg9poitmFVpLjGlR3jWRQAAANY"]
[Mon Dec 22 02:34:14.942204 2025] [:error] [pid 45399:tid 45409] [client 40.83.96.65:5095] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUg9pjHbaarUHjCTA4uWsQAAAQg"]
[Mon Dec 22 02:34:15.536318 2025] [:error] [pid 46374:tid 46399] [client 40.83.96.65:12385] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUg9pxLD7sK-wqrnXHUqngAAAVc"]
[Mon Dec 22 02:34:16.224199 2025] [:error] [pid 46343:tid 46366] [client 40.83.96.65:12291] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUg9qBzbW_u_EvstJwQ1jgAAABQ"]
[Mon Dec 22 02:34:17.118014 2025] [:error] [pid 45306:tid 45327] [client 40.83.96.65:5093] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUg9qdsL27CzxZxVWqQ8xgAAAEs"]
[Mon Dec 22 02:34:17.705751 2025] [:error] [pid 46343:tid 46358] [client 40.83.96.65:12332] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUg9qRzbW_u_EvstJwQ1kgAAAAw"]
[Mon Dec 22 02:34:18.111917 2025] [:error] [pid 45306:tid 45318] [client 40.83.96.65:12384] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUg9qtsL27CzxZxVWqQ8yAAAAEI"]
[Mon Dec 22 02:34:18.610419 2025] [:error] [pid 46343:tid 46350] [client 40.83.96.65:12309] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUg9qhzbW_u_EvstJwQ1lAAAAAQ"]
[Mon Dec 22 02:34:19.763569 2025] [:error] [pid 45308:tid 45349] [client 40.83.96.65:12321] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aUg9q2QKrTzAeGeriX3lOgAAAIU"]
[Mon Dec 22 02:34:20.534625 2025] [:error] [pid 46343:tid 46368] [client 40.83.96.65:12300] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUg9rBzbW_u_EvstJwQ1lwAAABY"]
[Mon Dec 22 02:34:21.466774 2025] [:error] [pid 45308:tid 45360] [client 40.83.96.65:5071] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUg9rWQKrTzAeGeriX3lPAAAAJA"]
[Mon Dec 22 02:34:22.404432 2025] [:error] [pid 45308:tid 45368] [client 40.83.96.65:12396] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUg9rmQKrTzAeGeriX3lQQAAAJg"]
[Mon Dec 22 02:34:23.599472 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:12413] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUg9r2QKrTzAeGeriX3lRAAAAJc"]
[Mon Dec 22 02:34:24.714424 2025] [:error] [pid 45306:tid 45325] [client 40.83.96.65:5059] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUg9sNsL27CzxZxVWqQ80gAAAEk"]
[Mon Dec 22 02:34:25.455856 2025] [:error] [pid 45309:tid 45372] [client 40.83.96.65:5080] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUg9sYitmFVpLjGlR3jWTQAAAME"]
[Mon Dec 22 02:34:26.253790 2025] [:error] [pid 46343:tid 46360] [client 40.83.96.65:12329] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUg9shzbW_u_EvstJwQ1mwAAAA4"]
[Mon Dec 22 02:34:27.123748 2025] [:error] [pid 45306:tid 45320] [client 40.83.96.65:12324] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUg9s9sL27CzxZxVWqQ81QAAAEQ"]
[Mon Dec 22 02:34:27.503294 2025] [:error] [pid 46374:tid 46386] [client 40.83.96.65:5011] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUg9sxLD7sK-wqrnXHUqpwAAAUo"]
[Mon Dec 22 02:34:27.872245 2025] [:error] [pid 45308:tid 45351] [client 40.83.96.65:12350] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUg9s2QKrTzAeGeriX3lRwAAAIc"]
[Mon Dec 22 02:34:28.278857 2025] [:error] [pid 45399:tid 45403] [client 40.83.96.65:5027] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUg9tDHbaarUHjCTA4uWtgAAAQI"]
[Mon Dec 22 02:34:28.590541 2025] [:error] [pid 45308:tid 45368] [client 40.83.96.65:12375] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUg9tGQKrTzAeGeriX3lSQAAAJg"]
[Mon Dec 22 02:34:29.317475 2025] [:error] [pid 46374:tid 46394] [client 40.83.96.65:5064] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUg9tRLD7sK-wqrnXHUqqgAAAVI"]
[Mon Dec 22 02:34:29.988624 2025] [:error] [pid 45308:tid 45363] [client 40.83.96.65:12330] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUg9tWQKrTzAeGeriX3lTAAAAJM"]
[Mon Dec 22 02:34:30.407949 2025] [:error] [pid 46403:tid 46416] [client 40.83.96.65:5101] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUg9tluzQIlydmAwinpseQAAAYs"]
[Mon Dec 22 02:34:30.885451 2025] [:error] [pid 46403:tid 46423] [client 40.83.96.65:12328] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aUg9tluzQIlydmAwinpsfAAAAZI"]
[Mon Dec 22 02:34:31.587840 2025] [:error] [pid 46403:tid 46413] [client 40.83.96.65:12391] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUg9t1uzQIlydmAwinpsfQAAAYg"]
[Mon Dec 22 02:34:32.325044 2025] [:error] [pid 45308:tid 45348] [client 40.83.96.65:5097] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUg9uGQKrTzAeGeriX3lTwAAAIQ"]
[Mon Dec 22 02:34:32.770468 2025] [:error] [pid 46343:tid 46364] [client 40.83.96.65:12334] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUg9uBzbW_u_EvstJwQ1oQAAABI"]
[Mon Dec 22 02:34:33.097315 2025] [:error] [pid 46374:tid 46378] [client 40.83.96.65:5076] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aUg9uRLD7sK-wqrnXHUqrQAAAUI"]
[Mon Dec 22 02:34:33.729240 2025] [:error] [pid 45308:tid 45347] [client 40.83.96.65:12389] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUg9uWQKrTzAeGeriX3lUQAAAIM"]
[Mon Dec 22 02:34:34.495262 2025] [:error] [pid 46374:tid 46377] [client 40.83.96.65:12394] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUg9uhLD7sK-wqrnXHUqrwAAAUE"]
[Mon Dec 22 02:34:34.959762 2025] [:error] [pid 45309:tid 45392] [client 40.83.96.65:12386] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUg9uoitmFVpLjGlR3jWUQAAANU"]
[Mon Dec 22 02:34:35.546258 2025] [:error] [pid 46343:tid 46360] [client 40.83.96.65:5106] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUg9uxzbW_u_EvstJwQ1pAAAAA4"]
[Mon Dec 22 02:34:35.996664 2025] [:error] [pid 46343:tid 46362] [client 40.83.96.65:5098] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUg9uxzbW_u_EvstJwQ1pgAAABA"]
[Mon Dec 22 02:34:37.076108 2025] [:error] [pid 45306:tid 45331] [client 40.83.96.65:12333] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUg9vdsL27CzxZxVWqQ82QAAAE8"]
[Mon Dec 22 02:34:38.116333 2025] [:error] [pid 46374:tid 46387] [client 40.83.96.65:12370] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUg9vhLD7sK-wqrnXHUquAAAAUs"]
[Mon Dec 22 02:34:38.607222 2025] [:error] [pid 46343:tid 46365] [client 40.83.96.65:5090] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUg9vhzbW_u_EvstJwQ1qwAAABM"]
[Mon Dec 22 02:34:39.280601 2025] [:error] [pid 45308:tid 45357] [client 40.83.96.65:5050] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUg9v2QKrTzAeGeriX3lVQAAAI0"]
[Mon Dec 22 02:34:39.905668 2025] [:error] [pid 46343:tid 46367] [client 40.83.96.65:5092] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUg9vxzbW_u_EvstJwQ1rwAAABU"]
[Mon Dec 22 02:34:40.182479 2025] [:error] [pid 45306:tid 45319] [client 40.83.96.65:12399] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUg9wNsL27CzxZxVWqQ82wAAAEM"]
[Mon Dec 22 02:34:40.891966 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:5091] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUg9wGQKrTzAeGeriX3lVwAAAJc"]
[Mon Dec 22 02:34:41.444901 2025] [:error] [pid 45308:tid 45347] [client 40.83.96.65:5006] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUg9wWQKrTzAeGeriX3lXAAAAIM"]
[Mon Dec 22 02:34:42.199979 2025] [:error] [pid 45309:tid 45390] [client 40.83.96.65:5081] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUg9woitmFVpLjGlR3jWVQAAANM"]
[Mon Dec 22 02:34:42.630251 2025] [:error] [pid 45309:tid 45395] [client 40.83.96.65:5085] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUg9woitmFVpLjGlR3jWVwAAANg"]
[Mon Dec 22 02:34:43.458891 2025] [:error] [pid 45309:tid 45372] [client 40.83.96.65:5038] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUg9w4itmFVpLjGlR3jWWAAAAME"]
[Mon Dec 22 02:34:44.000497 2025] [:error] [pid 46343:tid 46369] [client 40.83.96.65:5007] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUg9wxzbW_u_EvstJwQ1sgAAABc"]
[Mon Dec 22 02:34:44.263952 2025] [:error] [pid 46403:tid 46409] [client 40.83.96.65:12353] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUg9xFuzQIlydmAwinpsigAAAYQ"]
[Mon Dec 22 02:34:44.723182 2025] [:error] [pid 46374:tid 46397] [client 40.83.96.65:5107] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUg9xBLD7sK-wqrnXHUqvAAAAVU"]
[Mon Dec 22 02:34:45.157604 2025] [:error] [pid 46343:tid 46350] [client 40.83.96.65:5070] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aUg9xRzbW_u_EvstJwQ1tAAAAAQ"]
[Mon Dec 22 02:34:45.729475 2025] [:error] [pid 45308:tid 45346] [client 40.83.96.65:5102] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUg9xWQKrTzAeGeriX3lYQAAAII"]
[Mon Dec 22 02:34:46.226436 2025] [:error] [pid 45308:tid 45354] [client 40.83.96.65:12393] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUg9xmQKrTzAeGeriX3lYgAAAIo"]
[Mon Dec 22 02:34:46.664457 2025] [:error] [pid 45399:tid 45423] [client 40.83.96.65:12340] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUg9xjHbaarUHjCTA4uWwAAAARY"]
[Mon Dec 22 02:34:47.143175 2025] [:error] [pid 46403:tid 46418] [client 40.83.96.65:5016] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aUg9x1uzQIlydmAwinpsiwAAAY0"]
[Mon Dec 22 02:34:47.591968 2025] [:error] [pid 45309:tid 45383] [client 40.83.96.65:12341] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUg9x4itmFVpLjGlR3jWXQAAAMw"]
[Mon Dec 22 02:34:48.338284 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:12355] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUg9yGQKrTzAeGeriX3lZAAAAJc"]
[Mon Dec 22 02:34:49.016437 2025] [:error] [pid 46343:tid 46363] [client 40.83.96.65:5046] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUg9yRzbW_u_EvstJwQ1tQAAABE"]
[Mon Dec 22 02:34:49.524103 2025] [:error] [pid 45306:tid 45324] [client 40.83.96.65:5014] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUg9ydsL27CzxZxVWqQ84QAAAEg"]
[Mon Dec 22 02:34:50.095382 2025] [:error] [pid 45309:tid 45392] [client 40.83.96.65:12295] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9yoitmFVpLjGlR3jWbQAAANU"]
[Mon Dec 22 02:34:50.669540 2025] [:error] [pid 45306:tid 45333] [client 40.83.96.65:4997] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9ytsL27CzxZxVWqQ85AAAAFE"]
[Mon Dec 22 02:34:50.959291 2025] [:error] [pid 45309:tid 45374] [client 40.83.96.65:5115] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9yoitmFVpLjGlR3jWbgAAAMM"]
[Mon Dec 22 02:34:51.417281 2025] [:error] [pid 46343:tid 46365] [client 40.83.96.65:5088] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aUg9yxzbW_u_EvstJwQ1twAAABM"]
[Mon Dec 22 02:34:51.788279 2025] [:error] [pid 45309:tid 45394] [client 40.83.96.65:5017] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUg9y4itmFVpLjGlR3jWcAAAANc"]
[Mon Dec 22 02:34:52.235030 2025] [:error] [pid 46343:tid 46359] [client 40.83.96.65:5062] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUg9zBzbW_u_EvstJwQ1ugAAAA0"]
[Mon Dec 22 02:34:52.531679 2025] [:error] [pid 45308:tid 45346] [client 40.83.96.65:5013] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUg9zGQKrTzAeGeriX3lZwAAAII"]
[Mon Dec 22 02:34:52.974854 2025] [:error] [pid 45309:tid 45379] [client 40.83.96.65:4956] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aUg9zIitmFVpLjGlR3jWcwAAAMg"]
[Mon Dec 22 02:34:53.395982 2025] [:error] [pid 45309:tid 45391] [client 40.83.96.65:5015] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUg9zYitmFVpLjGlR3jWdAAAANQ"]
[Mon Dec 22 02:34:53.745442 2025] [:error] [pid 45306:tid 45340] [client 40.83.96.65:12395] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUg9zdsL27CzxZxVWqQ86gAAAFg"]
[Mon Dec 22 02:34:54.289174 2025] [:error] [pid 46343:tid 46367] [client 40.83.96.65:5114] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUg9zhzbW_u_EvstJwQ1vAAAABU"]
[Mon Dec 22 02:34:54.696200 2025] [:error] [pid 46343:tid 46370] [client 40.83.96.65:5005] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUg9zhzbW_u_EvstJwQ1vgAAABg"]
[Mon Dec 22 02:34:55.300353 2025] [:error] [pid 45309:tid 45381] [client 40.83.96.65:5024] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUg9z4itmFVpLjGlR3jWdwAAAMo"]
[Mon Dec 22 02:34:55.681247 2025] [:error] [pid 46374:tid 46377] [client 40.83.96.65:12325] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUg9zxLD7sK-wqrnXHUqwgAAAUE"]
[Mon Dec 22 02:34:56.054074 2025] [:error] [pid 45308:tid 45357] [client 40.83.96.65:5045] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Mon Dec 22 02:34:56.316660 2025] [:error] [pid 45308:tid 45359] [client 40.83.96.65:5045] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Mon Dec 22 02:34:56.435511 2025] [:error] [pid 45308:tid 45361] [client 40.83.96.65:5045] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Dec 22 02:34:56.555511 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:5045] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Mon Dec 22 02:34:56.767753 2025] [:error] [pid 45308:tid 45364] [client 40.83.96.65:5045] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Mon Dec 22 02:34:58.057759 2025] [:error] [pid 45308:tid 45355] [client 40.83.96.65:5045] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Mon Dec 22 02:34:58.193010 2025] [:error] [pid 45308:tid 45351] [client 40.83.96.65:5045] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUg90mQKrTzAeGeriX3leQAAAIc"]
[Mon Dec 22 02:34:59.082029 2025] [:error] [pid 45399:tid 45407] [client 40.83.96.65:12346] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aUg90zHbaarUHjCTA4uXNwAAAQY"]
[Mon Dec 22 02:34:59.449806 2025] [:error] [pid 46343:tid 46349] [client 40.83.96.65:5010] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUg90xzbW_u_EvstJwQ1ygAAAAM"]
[Mon Dec 22 02:35:00.287291 2025] [:error] [pid 45309:tid 45380] [client 40.83.96.65:5117] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUg91IitmFVpLjGlR3jWewAAAMk"]
[Mon Dec 22 02:35:00.535873 2025] [:error] [pid 45399:tid 45410] [client 40.83.96.65:5082] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUg91DHbaarUHjCTA4uXOAAAAQk"]
[Mon Dec 22 02:35:01.074671 2025] [:error] [pid 45306:tid 45326] [client 40.83.96.65:5067] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUg91dsL27CzxZxVWqQ88AAAAEo"]
[Mon Dec 22 02:35:01.439495 2025] [:error] [pid 45306:tid 45323] [client 40.83.96.65:4933] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aUg91dsL27CzxZxVWqQ88QAAAEc"]
[Mon Dec 22 02:35:01.866142 2025] [:error] [pid 45309:tid 45382] [client 40.83.96.65:5031] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aUg91YitmFVpLjGlR3jWfAAAAMs"]
[Mon Dec 22 02:35:02.360668 2025] [:error] [pid 45309:tid 45387] [client 40.83.96.65:5020] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aUg91oitmFVpLjGlR3jWfgAAANA"]
[Mon Dec 22 02:35:02.988830 2025] [:error] [pid 45309:tid 45385] [client 40.83.96.65:5060] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aUg91oitmFVpLjGlR3jWfwAAAM4"]
[Mon Dec 22 02:35:03.351034 2025] [:error] [pid 45309:tid 45392] [client 40.83.96.65:5001] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUg914itmFVpLjGlR3jWgQAAANU"]
[Mon Dec 22 02:35:04.014504 2025] [:error] [pid 45308:tid 45352] [client 40.83.96.65:5047] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUg92GQKrTzAeGeriX3legAAAIg"]
[Mon Dec 22 02:35:04.381850 2025] [:error] [pid 45308:tid 45359] [client 40.83.96.65:12337] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUg92GQKrTzAeGeriX3lewAAAI8"]
[Mon Dec 22 02:35:04.889548 2025] [:error] [pid 45308:tid 45361] [client 40.83.96.65:4939] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUg92GQKrTzAeGeriX3lfAAAAJE"]
[Mon Dec 22 02:35:05.386180 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:12351] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aUg92WQKrTzAeGeriX3lfQAAAJc"]
[Mon Dec 22 02:35:05.787793 2025] [:error] [pid 45399:tid 45405] [client 40.83.96.65:5104] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUg92THbaarUHjCTA4uXPgAAAQQ"]
[Mon Dec 22 02:35:06.207299 2025] [:error] [pid 45399:tid 45424] [client 40.83.96.65:5035] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUg92jHbaarUHjCTA4uXbAAAARc"]
[Mon Dec 22 02:35:06.542387 2025] [:error] [pid 45399:tid 45407] [client 40.83.96.65:5012] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUg92jHbaarUHjCTA4uXfQAAAQY"]
[Mon Dec 22 02:35:07.116211 2025] [:error] [pid 45309:tid 45390] [client 40.83.96.65:5049] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUg924itmFVpLjGlR3jWiQAAANM"]
[Mon Dec 22 02:35:07.402192 2025] [:error] [pid 46374:tid 46396] [client 40.83.96.65:5084] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUg92xLD7sK-wqrnXHUq5QAAAVQ"]
[Mon Dec 22 02:35:07.697504 2025] [:error] [pid 46374:tid 46400] [client 40.83.96.65:5058] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUg92xLD7sK-wqrnXHUq5gAAAVg"]
[Mon Dec 22 02:35:08.025621 2025] [:error] [pid 45309:tid 45373] [client 40.83.96.65:4993] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUg93IitmFVpLjGlR3jWigAAAMI"]
[Mon Dec 22 02:35:08.750982 2025] [:error] [pid 46374:tid 46385] [client 40.83.96.65:12345] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUg93BLD7sK-wqrnXHUq5wAAAUk"]
[Mon Dec 22 02:35:09.386926 2025] [:error] [pid 46374:tid 46399] [client 40.83.96.65:4931] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aUg93RLD7sK-wqrnXHUq6QAAAVc"]
[Mon Dec 22 02:35:09.867855 2025] [:error] [pid 45399:tid 45413] [client 40.83.96.65:4995] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUg93THbaarUHjCTA4uXzgAAAQw"]
[Mon Dec 22 02:35:10.415500 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:5075] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUg93mQKrTzAeGeriX3lvQAAAJc"]
[Mon Dec 22 02:35:10.806022 2025] [:error] [pid 45308:tid 45364] [client 40.83.96.65:12414] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aUg93mQKrTzAeGeriX3lvwAAAJQ"]
[Mon Dec 22 02:35:11.208377 2025] [:error] [pid 45399:tid 45404] [client 40.83.96.65:12390] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUg93zHbaarUHjCTA4uXzwAAAQM"]
[Mon Dec 22 02:35:11.845331 2025] [:error] [pid 45306:tid 45326] [client 40.83.96.65:5109] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUg939sL27CzxZxVWqQ89gAAAEo"]
[Mon Dec 22 02:35:12.135964 2025] [:error] [pid 45309:tid 45381] [client 40.83.96.65:5113] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUg94IitmFVpLjGlR3jWkAAAAMo"]
[Mon Dec 22 02:35:12.518085 2025] [:error] [pid 45306:tid 45321] [client 40.83.96.65:5009] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUg94NsL27CzxZxVWqQ8-AAAAEU"]
[Mon Dec 22 02:35:12.914793 2025] [:error] [pid 45399:tid 45421] [client 40.83.96.65:12335] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUg94DHbaarUHjCTA4uX0QAAARQ"]
[Mon Dec 22 02:35:13.342592 2025] [:error] [pid 45308:tid 45347] [client 40.83.96.65:5019] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUg94WQKrTzAeGeriX3lwgAAAIM"]
[Mon Dec 22 02:35:13.690404 2025] [:error] [pid 45309:tid 45393] [client 40.83.96.65:12406] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUg94YitmFVpLjGlR3jWkgAAANY"]
[Mon Dec 22 02:35:14.183974 2025] [:error] [pid 46374:tid 46380] [client 40.83.96.65:12362] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aUg94hLD7sK-wqrnXHUq7AAAAUQ"]
[Mon Dec 22 02:35:14.781791 2025] [:error] [pid 45399:tid 45403] [client 40.83.96.65:12347] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUg94jHbaarUHjCTA4uX0gAAAQI"]
[Mon Dec 22 02:35:15.457212 2025] [:error] [pid 46343:tid 46367] [client 40.83.96.65:4963] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUg94xzbW_u_EvstJwQ11gAAABU"]
[Mon Dec 22 02:35:16.001823 2025] [:error] [pid 46343:tid 46363] [client 40.83.96.65:5100] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUg95BzbW_u_EvstJwQ11wAAABE"]
[Mon Dec 22 02:35:17.130508 2025] [:error] [pid 45399:tid 45418] [client 40.83.96.65:5089] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUg95THbaarUHjCTA4uX1AAAARE"]
[Mon Dec 22 02:35:17.786855 2025] [:error] [pid 46343:tid 46354] [client 40.83.96.65:5039] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUg95RzbW_u_EvstJwQ13QAAAAg"]
[Mon Dec 22 02:35:18.280892 2025] [:error] [pid 45309:tid 45387] [client 40.83.96.65:4928] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUg95oitmFVpLjGlR3jWlQAAANA"]
[Mon Dec 22 02:35:18.910381 2025] [:error] [pid 45309:tid 45376] [client 40.83.96.65:5044] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUg95oitmFVpLjGlR3jWlwAAAMU"]
[Mon Dec 22 02:35:19.367283 2025] [:error] [pid 45399:tid 45424] [client 40.83.96.65:12369] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUg95zHbaarUHjCTA4uX1wAAARc"]
[Mon Dec 22 02:35:19.936451 2025] [:error] [pid 45399:tid 45407] [client 40.83.96.65:5110] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUg95zHbaarUHjCTA4uX2QAAAQY"]
[Mon Dec 22 02:35:20.355193 2025] [:error] [pid 45309:tid 45374] [client 40.83.96.65:5034] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUg96IitmFVpLjGlR3jWmwAAAMM"]
[Mon Dec 22 02:35:20.831997 2025] [:error] [pid 45399:tid 45404] [client 40.83.96.65:4950] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUg96DHbaarUHjCTA4uX3AAAAQM"]
[Mon Dec 22 02:35:21.225721 2025] [:error] [pid 45309:tid 45392] [client 40.83.96.65:12331] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aUg96YitmFVpLjGlR3jWngAAANU"]
[Mon Dec 22 02:35:22.196693 2025] [:error] [pid 45308:tid 45352] [client 40.83.96.65:5004] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUg96mQKrTzAeGeriX3lyQAAAIg"]
[Mon Dec 22 02:35:22.655678 2025] [:error] [pid 45309:tid 45373] [client 40.83.96.65:4867] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUg96oitmFVpLjGlR3jWogAAAMI"]
[Mon Dec 22 02:35:23.092064 2025] [:error] [pid 45308:tid 45358] [client 40.83.96.65:12378] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUg962QKrTzAeGeriX3lzAAAAI4"]
[Mon Dec 22 02:35:23.647931 2025] [:error] [pid 46403:tid 46413] [client 40.83.96.65:5003] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUg961uzQIlydmAwinpszwAAAYg"]
[Mon Dec 22 02:35:24.044186 2025] [:error] [pid 45308:tid 45364] [client 40.83.96.65:12367] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUg97GQKrTzAeGeriX3lzwAAAJQ"]
[Mon Dec 22 02:35:24.359153 2025] [:error] [pid 46403:tid 46408] [client 40.83.96.65:5054] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUg97FuzQIlydmAwinps0QAAAYM"]
[Mon Dec 22 02:35:24.933753 2025] [:error] [pid 45309:tid 45376] [client 40.83.96.65:4967] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUg97IitmFVpLjGlR3jWpQAAAMU"]
[Mon Dec 22 02:35:25.274278 2025] [:error] [pid 46403:tid 46429] [client 40.83.96.65:5074] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUg97VuzQIlydmAwinps0wAAAZg"]
[Mon Dec 22 02:35:25.808400 2025] [:error] [pid 45309:tid 45381] [client 40.83.96.65:5094] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUg97YitmFVpLjGlR3jWqQAAAMo"]
[Mon Dec 22 02:35:26.459430 2025] [:error] [pid 45308:tid 45360] [client 40.83.96.65:4984] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUg97mQKrTzAeGeriX3l1AAAAJA"]
[Mon Dec 22 02:35:26.929118 2025] [:error] [pid 45308:tid 45346] [client 40.83.96.65:5048] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUg97mQKrTzAeGeriX3l1wAAAII"]
[Mon Dec 22 02:35:27.308378 2025] [:error] [pid 45308:tid 45366] [client 40.83.96.65:5119] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUg972QKrTzAeGeriX3l2gAAAJY"]
[Mon Dec 22 02:35:28.148246 2025] [:error] [pid 45399:tid 45403] [client 40.83.96.65:5032] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUg98DHbaarUHjCTA4uX5wAAAQI"]
[Mon Dec 22 02:35:28.958599 2025] [:error] [pid 45308:tid 45358] [client 40.83.96.65:5065] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aUg98GQKrTzAeGeriX3l3QAAAI4"]
[Mon Dec 22 02:35:29.422177 2025] [:error] [pid 45308:tid 45363] [client 40.83.96.65:5036] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aUg98WQKrTzAeGeriX3l4QAAAJM"]
[Mon Dec 22 02:35:29.813632 2025] [:error] [pid 45308:tid 45365] [client 40.83.96.65:5077] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aUg98WQKrTzAeGeriX3l4gAAAJU"]
[Mon Dec 22 02:35:30.236164 2025] [:error] [pid 45399:tid 45420] [client 40.83.96.65:12354] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUg98jHbaarUHjCTA4uX7AAAARM"]
[Mon Dec 22 02:35:30.917450 2025] [:error] [pid 45399:tid 45406] [client 40.83.96.65:5055] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUg98jHbaarUHjCTA4uX7QAAAQU"]
[Mon Dec 22 02:35:31.952955 2025] [:error] [pid 45399:tid 45401] [client 40.83.96.65:5002] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUg98zHbaarUHjCTA4uX7wAAAQA"]
[Mon Dec 22 02:35:32.954306 2025] [:error] [pid 46374:tid 46377] [client 40.83.96.65:4941] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUg99BLD7sK-wqrnXHUq9gAAAUE"]
[Mon Dec 22 02:35:33.210021 2025] [:error] [pid 45308:tid 45347] [client 40.83.96.65:4936] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUg99WQKrTzAeGeriX3l5QAAAIM"]
[Mon Dec 22 02:35:33.637842 2025] [:error] [pid 45308:tid 45345] [client 40.83.96.65:5042] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUg99WQKrTzAeGeriX3l6AAAAIE"]
[Mon Dec 22 02:35:33.909273 2025] [:error] [pid 45308:tid 45365] [client 40.83.96.65:4972] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUg99WQKrTzAeGeriX3l6gAAAJU"]
[Mon Dec 22 02:35:34.379259 2025] [:error] [pid 45308:tid 45353] [client 40.83.96.65:5086] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aUg99mQKrTzAeGeriX3l7QAAAIk"]
[Mon Dec 22 02:35:34.792929 2025] [:error] [pid 45308:tid 45352] [client 40.83.96.65:5103] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUg99mQKrTzAeGeriX3l7wAAAIg"]
[Mon Dec 22 02:35:35.137455 2025] [:error] [pid 45399:tid 45416] [client 40.83.96.65:4872] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUg99zHbaarUHjCTA4uX8gAAAQ8"]
[Mon Dec 22 02:35:35.742651 2025] [:error] [pid 45309:tid 45387] [client 40.83.96.65:4878] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUg994itmFVpLjGlR3jWrQAAANA"]
[Mon Dec 22 02:35:36.144331 2025] [:error] [pid 45308:tid 45345] [client 40.83.96.65:5041] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUg9-GQKrTzAeGeriX3l8gAAAIE"]
[Mon Dec 22 02:35:36.860650 2025] [:error] [pid 46403:tid 46419] [client 40.83.96.65:4978] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUg9-FuzQIlydmAwinps1wAAAY4"]
[Mon Dec 22 02:35:38.285905 2025] [:error] [pid 46403:tid 46417] [client 40.83.96.65:4988] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUg9-luzQIlydmAwinps2QAAAYw"]
[Mon Dec 22 02:35:38.977965 2025] [:error] [pid 45306:tid 45319] [client 40.83.96.65:4949] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUg9-tsL27CzxZxVWqQ9AgAAAEM"]
[Mon Dec 22 02:35:39.360769 2025] [:error] [pid 46403:tid 46425] [client 40.83.96.65:4965] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUg9-1uzQIlydmAwinps3QAAAZQ"]
[Mon Dec 22 02:35:39.935188 2025] [:error] [pid 45306:tid 45340] [client 40.83.96.65:5118] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUg9-9sL27CzxZxVWqQ9AwAAAFg"]
[Mon Dec 22 02:35:40.352821 2025] [:error] [pid 45399:tid 45414] [client 40.83.96.65:4992] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUg9_DHbaarUHjCTA4uX9wAAAQ0"]
[Mon Dec 22 02:35:40.658901 2025] [:error] [pid 45306:tid 45327] [client 40.83.96.65:4945] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUg9_NsL27CzxZxVWqQ9BAAAAEs"]
[Mon Dec 22 02:35:41.032608 2025] [:error] [pid 45308:tid 45345] [client 40.83.96.65:4839] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUg9_WQKrTzAeGeriX3l-AAAAIE"]
[Mon Dec 22 02:35:41.488171 2025] [:error] [pid 45308:tid 45359] [client 40.83.96.65:4966] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aUg9_WQKrTzAeGeriX3l-QAAAI8"]
[Mon Dec 22 02:35:42.251589 2025] [:error] [pid 45306:tid 45328] [client 40.83.96.65:4951] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aUg9_tsL27CzxZxVWqQ9BgAAAEw"]
[Mon Dec 22 02:35:43.223498 2025] [:error] [pid 46374:tid 46390] [client 40.83.96.65:4961] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aUg9_xLD7sK-wqrnXHUq-gAAAU4"]
[Mon Dec 22 02:35:43.930722 2025] [:error] [pid 45399:tid 45407] [client 40.83.96.65:4957] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aUg9_zHbaarUHjCTA4uX_wAAAQY"]
[Mon Dec 22 02:35:44.681023 2025] [:error] [pid 45309:tid 45375] [client 40.83.96.65:5079] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUg-AIitmFVpLjGlR3jWtQAAAMQ"]
[Mon Dec 22 02:35:45.485959 2025] [:error] [pid 46343:tid 46357] [client 40.83.96.65:4886] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUg-ARzbW_u_EvstJwQ14wAAAAs"]
[Mon Dec 22 02:35:46.101521 2025] [:error] [pid 45308:tid 45345] [client 40.83.96.65:4948] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUg-AmQKrTzAeGeriX3mAgAAAIE"]
[Mon Dec 22 02:35:46.416607 2025] [:error] [pid 45308:tid 45349] [client 40.83.96.65:4934] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aUg-AmQKrTzAeGeriX3mBAAAAIU"]
[Mon Dec 22 02:35:46.924583 2025] [:error] [pid 45308:tid 45368] [client 40.83.96.65:5022] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aUg-AmQKrTzAeGeriX3mBgAAAJg"]
[Mon Dec 22 02:35:47.545513 2025] [:error] [pid 46403:tid 46407] [client 40.83.96.65:4971] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aUg-A1uzQIlydmAwinps3gAAAYI"]
[Mon Dec 22 02:35:48.310999 2025] [:error] [pid 46403:tid 46427] [client 40.83.96.65:4929] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aUg-BFuzQIlydmAwinps4AAAAZY"]
[Mon Dec 22 02:35:49.138315 2025] [:error] [pid 46403:tid 46410] [client 40.83.96.65:5018] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aUg-BVuzQIlydmAwinps4gAAAYU"]
[Mon Dec 22 02:35:49.677190 2025] [:error] [pid 45309:tid 45387] [client 40.83.96.65:4998] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aUg-BYitmFVpLjGlR3jWuAAAANA"]
[Mon Dec 22 02:35:50.263828 2025] [:error] [pid 45309:tid 45385] [client 40.83.96.65:4868] [client 40.83.96.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aUg-BoitmFVpLjGlR3jWuQAAAM4"]
[Mon Dec 22 02:35:51.088701 2025] [:error] [pid 46403:tid 46414] [client 40.83.96.65:4979] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUg-B1uzQIlydmAwinps5wAAAYk"]
[Mon Dec 22 02:35:51.570628 2025] [:error] [pid 46403:tid 46405] [client 40.83.96.65:4991] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUg-B1uzQIlydmAwinps6gAAAYA"]
[Mon Dec 22 02:35:52.397221 2025] [:error] [pid 46374:tid 46382] [client 40.83.96.65:4890] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUg-CBLD7sK-wqrnXHUq_gAAAUY"]
[Mon Dec 22 02:35:53.036517 2025] [:error] [pid 45399:tid 45406] [client 40.83.96.65:4983] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUg-CTHbaarUHjCTA4uYBgAAAQU"]
[Mon Dec 22 02:35:53.619644 2025] [:error] [pid 45309:tid 45374] [client 40.83.96.65:4947] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUg-CYitmFVpLjGlR3jWvQAAAMM"]
[Mon Dec 22 02:35:54.088896 2025] [:error] [pid 45309:tid 45388] [client 40.83.96.65:12371] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUg-CoitmFVpLjGlR3jWvwAAANE"]
[Mon Dec 22 02:35:54.587416 2025] [:error] [pid 45399:tid 45402] [client 40.83.96.65:5000] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUg-CjHbaarUHjCTA4uYDAAAAQE"]
[Mon Dec 22 02:35:55.104972 2025] [:error] [pid 45308:tid 45358] [client 40.83.96.65:4973] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUg-C2QKrTzAeGeriX3mDwAAAI4"]
[Mon Dec 22 02:35:55.785857 2025] [:error] [pid 46403:tid 46410] [client 40.83.96.65:4940] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUg-C1uzQIlydmAwinps8AAAAYU"]
[Mon Dec 22 02:35:56.235851 2025] [:error] [pid 46374:tid 46384] [client 40.83.96.65:5030] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUg-DBLD7sK-wqrnXHUrAQAAAUg"]
[Mon Dec 22 02:35:56.670927 2025] [:error] [pid 45308:tid 45356] [client 40.83.96.65:4942] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUg-DGQKrTzAeGeriX3mEwAAAIw"]
[Mon Dec 22 02:35:57.196994 2025] [:error] [pid 45308:tid 45347] [client 40.83.96.65:4864] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUg-DWQKrTzAeGeriX3mFQAAAIM"]
[Mon Dec 22 02:35:57.979240 2025] [:error] [pid 45399:tid 45417] [client 40.83.96.65:4980] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aUg-DTHbaarUHjCTA4uYEgAAARA"]
[Mon Dec 22 02:35:58.475806 2025] [:error] [pid 46403:tid 46415] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Mon Dec 22 02:35:58.595313 2025] [:error] [pid 46403:tid 46413] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Mon Dec 22 02:35:58.735331 2025] [:error] [pid 46403:tid 46411] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Mon Dec 22 02:35:58.864947 2025] [:error] [pid 46403:tid 46408] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Mon Dec 22 02:35:58.985623 2025] [:error] [pid 46403:tid 46422] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Mon Dec 22 02:35:59.107319 2025] [:error] [pid 46403:tid 46429] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Mon Dec 22 02:35:59.271608 2025] [:error] [pid 46403:tid 46428] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Mon Dec 22 02:35:59.393157 2025] [:error] [pid 46403:tid 46427] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Mon Dec 22 02:35:59.597920 2025] [:error] [pid 46403:tid 46407] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Mon Dec 22 02:35:59.718312 2025] [:error] [pid 46403:tid 46410] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Mon Dec 22 02:35:59.839388 2025] [:error] [pid 46403:tid 46424] [client 40.83.96.65:4869] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Mon Dec 22 02:35:59.976766 2025] [:error] [pid 46403:tid 46409] [client 40.83.96.65:4869] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aUg-D1uzQIlydmAwinptAQAAAYQ"]
[Mon Dec 22 02:36:01.028122 2025] [:error] [pid 45309:tid 45375] [client 40.83.96.65:4873] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aUg-EYitmFVpLjGlR3jWwwAAAMQ"]
[Mon Dec 22 02:36:01.637063 2025] [:error] [pid 45399:tid 45401] [client 40.83.96.65:4892] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aUg-ETHbaarUHjCTA4uYGQAAAQA"]
[Mon Dec 22 02:36:02.377868 2025] [:error] [pid 45308:tid 45350] [client 40.83.96.65:4952] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aUg-EmQKrTzAeGeriX3mHQAAAIY"]
[Mon Dec 22 02:36:03.173321 2025] [:error] [pid 45309:tid 45373] [client 40.83.96.65:4944] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aUg-E4itmFVpLjGlR3jWyAAAAMI"]
[Mon Dec 22 02:36:03.646041 2025] [:error] [pid 46343:tid 46360] [client 40.83.96.65:4955] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aUg-ExzbW_u_EvstJwQ15AAAAA4"]
[Mon Dec 22 02:36:04.632458 2025] [:error] [pid 46374:tid 46397] [client 40.83.96.65:4904] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aUg-FBLD7sK-wqrnXHUrBwAAAVU"]
[Mon Dec 22 02:36:05.402630 2025] [:error] [pid 46374:tid 46387] [client 40.83.96.65:12342] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aUg-FRLD7sK-wqrnXHUrCAAAAUs"]
[Mon Dec 22 02:36:05.861814 2025] [:error] [pid 46343:tid 46369] [client 40.83.96.65:12336] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUg-FRzbW_u_EvstJwQ15QAAABc"]
[Mon Dec 22 02:36:06.144968 2025] [:error] [pid 46403:tid 46415] [client 40.83.96.65:4882] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUg-FluzQIlydmAwinptAwAAAYo"]
[Mon Dec 22 02:36:06.490371 2025] [:error] [pid 45309:tid 45384] [client 40.83.96.65:4996] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUg-FoitmFVpLjGlR3jWzQAAAM0"]
[Mon Dec 22 02:36:06.972718 2025] [:error] [pid 46403:tid 46413] [client 40.83.96.65:4975] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUg-FluzQIlydmAwinptBAAAAYg"]
[Mon Dec 22 02:36:07.429643 2025] [:error] [pid 46343:tid 46351] [client 40.83.96.65:5072] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUg-FxzbW_u_EvstJwQ15gAAAAU"]
[Mon Dec 22 02:36:08.542329 2025] [:error] [pid 46403:tid 46422] [client 40.83.96.65:4921] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUg-GFuzQIlydmAwinptBwAAAZE"]
[Mon Dec 22 02:36:09.406480 2025] [:error] [pid 45306:tid 45324] [client 40.83.96.65:5052] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUg-GdsL27CzxZxVWqQ9FgAAAEg"]
[Mon Dec 22 02:36:10.094279 2025] [:error] [pid 46374:tid 46388] [client 40.83.96.65:4825] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUg-GhLD7sK-wqrnXHUrDAAAAUw"]
[Mon Dec 22 02:36:10.860692 2025] [:error] [pid 45308:tid 45358] [client 40.83.96.65:4937] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUg-GmQKrTzAeGeriX3mJQAAAI4"]
[Mon Dec 22 02:36:11.486220 2025] [:error] [pid 45399:tid 45404] [client 40.83.96.65:4985] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUg-GzHbaarUHjCTA4uYJQAAAQM"]
[Mon Dec 22 02:36:11.864703 2025] [:error] [pid 46374:tid 46379] [client 40.83.96.65:4968] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUg-GxLD7sK-wqrnXHUrDgAAAUM"]
[Mon Dec 22 02:36:12.665063 2025] [:error] [pid 46374:tid 46390] [client 40.83.96.65:5023] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUg-HBLD7sK-wqrnXHUrDwAAAU4"]
[Mon Dec 22 02:36:13.065990 2025] [:error] [pid 46403:tid 46428] [client 40.83.96.65:4900] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUg-HVuzQIlydmAwinptCgAAAZc"]
[Mon Dec 22 02:36:13.903086 2025] [:error] [pid 46343:tid 46350] [client 40.83.96.65:4897] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUg-HRzbW_u_EvstJwQ17gAAAAQ"]
[Mon Dec 22 02:36:14.637997 2025] [:error] [pid 46343:tid 46353] [client 40.83.96.65:5008] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUg-HhzbW_u_EvstJwQ18QAAAAc"]
[Mon Dec 22 02:36:15.175243 2025] [:error] [pid 45399:tid 45405] [client 40.83.96.65:4930] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUg-HzHbaarUHjCTA4uYKAAAAQQ"]
[Mon Dec 22 02:36:15.744705 2025] [:error] [pid 45309:tid 45378] [client 40.83.96.65:4810] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUg-H4itmFVpLjGlR3jW2AAAAMc"]
[Mon Dec 22 02:36:16.407662 2025] [:error] [pid 45308:tid 45360] [client 40.83.96.65:4943] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUg-IGQKrTzAeGeriX3mMgAAAJA"]
[Mon Dec 22 02:36:16.804185 2025] [:error] [pid 46403:tid 46408] [client 40.83.96.65:4958] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUg-IFuzQIlydmAwinptEQAAAYM"]
[Mon Dec 22 02:36:17.854654 2025] [:error] [pid 45308:tid 45367] [client 40.83.96.65:4905] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUg-IWQKrTzAeGeriX3mNQAAAJc"]
[Mon Dec 22 02:36:18.831094 2025] [:error] [pid 45308:tid 45365] [client 40.83.96.65:4824] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUg-ImQKrTzAeGeriX3mNwAAAJU"]
[Mon Dec 22 02:36:19.800605 2025] [:error] [pid 46343:tid 46350] [client 40.83.96.65:4814] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUg-IxzbW_u_EvstJwQ19AAAAAQ"]
[Mon Dec 22 02:36:20.828394 2025] [:error] [pid 46374:tid 46380] [client 40.83.96.65:4903] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUg-JBLD7sK-wqrnXHUrFAAAAUQ"]
[Mon Dec 22 02:36:21.131811 2025] [:error] [pid 45309:tid 45377] [client 40.83.96.65:4866] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUg-JYitmFVpLjGlR3jW4QAAAMY"]
[Mon Dec 22 02:36:21.686279 2025] [:error] [pid 45308:tid 45363] [client 40.83.96.65:5078] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUg-JWQKrTzAeGeriX3mOQAAAJM"]
[Mon Dec 22 02:36:22.748910 2025] [:error] [pid 45399:tid 45414] [client 40.83.96.65:4989] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUg-JjHbaarUHjCTA4uYMgAAAQ0"]
[Mon Dec 22 02:36:23.374567 2025] [:error] [pid 46343:tid 46367] [client 40.83.96.65:4927] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUg-JxzbW_u_EvstJwQ19QAAABU"]
[Mon Dec 22 02:36:23.878131 2025] [:error] [pid 46374:tid 46393] [client 40.83.96.65:4870] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUg-JxLD7sK-wqrnXHUrFQAAAVE"]
[Mon Dec 22 02:36:24.270839 2025] [:error] [pid 46403:tid 46427] [client 40.83.96.65:5037] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUg-KFuzQIlydmAwinptGAAAAZY"]
[Mon Dec 22 02:36:25.100363 2025] [:error] [pid 46374:tid 46395] [client 40.83.96.65:5087] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUg-KRLD7sK-wqrnXHUrGAAAAVM"]
[Mon Dec 22 02:36:26.015780 2025] [:error] [pid 45308:tid 45344] [client 40.83.96.65:4926] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUg-KmQKrTzAeGeriX3mQgAAAIA"]
[Mon Dec 22 02:36:26.460413 2025] [:error] [pid 45309:tid 45383] [client 40.83.96.65:4881] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUg-KoitmFVpLjGlR3jW5gAAAMw"]
[Mon Dec 22 02:36:26.861472 2025] [:error] [pid 45308:tid 45363] [client 40.83.96.65:4871] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUg-KmQKrTzAeGeriX3mRgAAAJM"]
[Mon Dec 22 02:36:27.475449 2025] [:error] [pid 46403:tid 46421] [client 40.83.96.65:5116] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUg-K1uzQIlydmAwinptHAAAAZA"]
[Mon Dec 22 02:36:27.896193 2025] [:error] [pid 45399:tid 45416] [client 40.83.96.65:4969] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUg-KzHbaarUHjCTA4uYOAAAAQ8"]
[Mon Dec 22 02:36:28.290787 2025] [:error] [pid 46374:tid 46388] [client 40.83.96.65:5026] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aUg-LBLD7sK-wqrnXHUrGgAAAUw"]
[Mon Dec 22 02:36:28.887505 2025] [:error] [pid 46403:tid 46419] [client 40.83.96.65:5053] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUg-LFuzQIlydmAwinptHwAAAY4"]
[Mon Dec 22 02:36:30.134342 2025] [:error] [pid 45309:tid 45391] [client 40.83.96.65:4899] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUg-LoitmFVpLjGlR3jW6wAAANQ"]
[Mon Dec 22 02:36:30.852912 2025] [:error] [pid 45308:tid 45350] [client 40.83.96.65:4935] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUg-LmQKrTzAeGeriX3mSQAAAIY"]
[Mon Dec 22 02:36:31.327040 2025] [:error] [pid 46343:tid 46357] [client 40.83.96.65:4970] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aUg-LxzbW_u_EvstJwQ1-AAAAAs"]
[Mon Dec 22 02:36:31.900606 2025] [:error] [pid 46343:tid 46369] [client 40.83.96.65:5068] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUg-LxzbW_u_EvstJwQ1-wAAABc"]
[Mon Dec 22 02:36:32.589728 2025] [:error] [pid 45308:tid 45364] [client 40.83.96.65:5028] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUg-MGQKrTzAeGeriX3mTwAAAJQ"]
[Mon Dec 22 02:36:33.914049 2025] [:error] [pid 45308:tid 45360] [client 40.83.96.65:4910] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUg-MWQKrTzAeGeriX3mVQAAAJA"]
[Mon Dec 22 02:36:34.803982 2025] [:error] [pid 45309:tid 45375] [client 40.83.96.65:4879] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aUg-MoitmFVpLjGlR3jW7gAAAMQ"]
[Mon Dec 22 02:36:35.549573 2025] [:error] [pid 45309:tid 45381] [client 40.83.96.65:4954] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUg-M4itmFVpLjGlR3jW7wAAAMo"]
[Mon Dec 22 02:36:36.027377 2025] [:error] [pid 45308:tid 45366] [client 40.83.96.65:4856] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUg-NGQKrTzAeGeriX3mWAAAAJY"]
[Mon Dec 22 02:36:37.072979 2025] [:error] [pid 45309:tid 45391] [client 40.83.96.65:5061] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUg-NYitmFVpLjGlR3jW8gAAANQ"]
[Mon Dec 22 02:36:37.963439 2025] [:error] [pid 45309:tid 45395] [client 40.83.96.65:4828] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUg-NYitmFVpLjGlR3jW9gAAANg"]
[Mon Dec 22 02:36:38.576811 2025] [:error] [pid 45399:tid 45403] [client 40.83.96.65:4816] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aUg-NjHbaarUHjCTA4uYPgAAAQI"]
[Mon Dec 22 02:36:39.285413 2025] [:error] [pid 45399:tid 45402] [client 40.83.96.65:4853] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aUg-NzHbaarUHjCTA4uYQAAAAQE"]
[Mon Dec 22 02:36:39.779749 2025] [:error] [pid 45399:tid 45412] [client 40.83.96.65:4974] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aUg-NzHbaarUHjCTA4uYQgAAAQs"]
[Mon Dec 22 02:36:40.417928 2025] [:error] [pid 45399:tid 45421] [client 40.83.96.65:4976] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aUg-ODHbaarUHjCTA4uYRQAAARQ"]
[Mon Dec 22 02:36:40.805562 2025] [:error] [pid 46374:tid 46381] [client 40.83.96.65:4953] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUg-OBLD7sK-wqrnXHUrJAAAAUU"]
[Mon Dec 22 02:36:41.304332 2025] [:error] [pid 45309:tid 45374] [client 40.83.96.65:4938] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUg-OYitmFVpLjGlR3jW_gAAAMM"]
[Mon Dec 22 02:36:42.150794 2025] [:error] [pid 45399:tid 45413] [client 40.83.96.65:4803] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUg-OjHbaarUHjCTA4uYRwAAAQw"]
[Mon Dec 22 02:36:42.746490 2025] [:error] [pid 45399:tid 45401] [client 40.83.96.65:4911] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aUg-OjHbaarUHjCTA4uYSQAAAQA"]
[Mon Dec 22 02:36:43.456169 2025] [:error] [pid 45306:tid 45329] [client 40.83.96.65:5033] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aUg-O9sL27CzxZxVWqQ9IgAAAE0"]
[Mon Dec 22 02:36:44.465285 2025] [:error] [pid 45309:tid 45377] [client 40.83.96.65:4946] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aUg-PIitmFVpLjGlR3jXAgAAAMY"]
[Mon Dec 22 02:36:45.158883 2025] [:error] [pid 46343:tid 46354] [client 40.83.96.65:4986] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aUg-PRzbW_u_EvstJwQ2CQAAAAg"]
[Mon Dec 22 02:36:46.259412 2025] [:error] [pid 46403:tid 46425] [client 40.83.96.65:12357] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aUg-PluzQIlydmAwinptNAAAAZQ"]
[Mon Dec 22 02:36:47.187597 2025] [:error] [pid 45309:tid 45395] [client 40.83.96.65:4877] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg-P4itmFVpLjGlR3jXBQAAANg"]
[Mon Dec 22 02:36:48.050282 2025] [:error] [pid 45306:tid 45325] [client 40.83.96.65:4849] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg-QNsL27CzxZxVWqQ9LwAAAEk"]
[Mon Dec 22 02:36:48.803363 2025] [:error] [pid 46343:tid 46350] [client 40.83.96.65:5043] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg-QBzbW_u_EvstJwQ2DgAAAAQ"]
[Mon Dec 22 02:36:49.419979 2025] [:error] [pid 45309:tid 45382] [client 40.83.96.65:4916] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aUg-QYitmFVpLjGlR3jXBwAAAMs"]
[Mon Dec 22 02:36:50.078341 2025] [:error] [pid 45308:tid 45366] [client 40.83.96.65:5029] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUg-QmQKrTzAeGeriX3mfgAAAJY"]
[Mon Dec 22 02:36:50.403776 2025] [:error] [pid 45308:tid 45353] [client 40.83.96.65:4802] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUg-QmQKrTzAeGeriX3mfwAAAIk"]
[Mon Dec 22 02:36:50.853875 2025] [:error] [pid 45309:tid 45376] [client 40.83.96.65:4918] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUg-QoitmFVpLjGlR3jXCQAAAMU"]
[Mon Dec 22 02:36:51.407049 2025] [:error] [pid 45308:tid 45363] [client 40.83.96.65:4800] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUg-Q2QKrTzAeGeriX3mgwAAAJM"]
[Mon Dec 22 02:36:52.411565 2025] [:error] [pid 46403:tid 46412] [client 40.83.96.65:4964] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUg-RFuzQIlydmAwinptOwAAAYc"]
[Mon Dec 22 02:36:53.022833 2025] [:error] [pid 45399:tid 45416] [client 40.83.96.65:4990] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUg-RTHbaarUHjCTA4uYUAAAAQ8"]
[Mon Dec 22 02:36:53.864647 2025] [:error] [pid 46374:tid 46396] [client 40.83.96.65:4908] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUg-RRLD7sK-wqrnXHUrMgAAAVQ"]
[Mon Dec 22 02:36:54.810709 2025] [:error] [pid 45399:tid 45425] [client 40.83.96.65:4893] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUg-RjHbaarUHjCTA4uYVgAAARg"]
[Mon Dec 22 02:36:55.474494 2025] [:error] [pid 46343:tid 46361] [client 40.83.96.65:4752] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aUg-RxzbW_u_EvstJwQ2EwAAAA8"]
[Mon Dec 22 02:36:56.135597 2025] [:error] [pid 45309:tid 45373] [client 40.83.96.65:4876] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aUg-SIitmFVpLjGlR3jXEwAAAMI"]
[Mon Dec 22 02:36:57.330805 2025] [:error] [pid 46403:tid 46408] [client 40.83.96.65:4838] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aUg-SVuzQIlydmAwinptRAAAAYM"]
[Mon Dec 22 02:36:57.856455 2025] [:error] [pid 45306:tid 45326] [client 40.83.96.65:4907] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aUg-SdsL27CzxZxVWqQ9PAAAAEo"]
[Mon Dec 22 02:36:58.189143 2025] [:error] [pid 45309:tid 45390] [client 40.83.96.65:4834] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aUg-SoitmFVpLjGlR3jXGAAAANM"]
[Mon Dec 22 02:36:58.517277 2025] [:error] [pid 45306:tid 45317] [client 40.83.96.65:4811] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aUg-StsL27CzxZxVWqQ9PQAAAEE"]
[Mon Dec 22 02:36:59.236134 2025] [:error] [pid 46343:tid 46350] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Mon Dec 22 02:36:59.357344 2025] [:error] [pid 46343:tid 46353] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Mon Dec 22 02:36:59.479686 2025] [:error] [pid 46343:tid 46349] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Mon Dec 22 02:36:59.601716 2025] [:error] [pid 46343:tid 46367] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Mon Dec 22 02:36:59.721797 2025] [:error] [pid 46343:tid 46368] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Mon Dec 22 02:36:59.842134 2025] [:error] [pid 46343:tid 46363] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Mon Dec 22 02:36:59.992199 2025] [:error] [pid 46343:tid 46352] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Mon Dec 22 02:37:00.114185 2025] [:error] [pid 46343:tid 46355] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Mon Dec 22 02:37:00.236472 2025] [:error] [pid 46343:tid 46359] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Mon Dec 22 02:37:01.157384 2025] [:error] [pid 46343:tid 46370] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Mon Dec 22 02:37:01.278381 2025] [:error] [pid 46343:tid 46357] [client 40.83.96.65:4914] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Mon Dec 22 02:37:01.406831 2025] [:error] [pid 46343:tid 46361] [client 40.83.96.65:4914] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUg-TRzbW_u_EvstJwQ2JgAAAA8"]
[Mon Dec 22 02:37:01.743366 2025] [:error] [pid 45309:tid 45383] [client 40.83.96.65:4896] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUg-TYitmFVpLjGlR3jXHAAAAMw"]
[Mon Dec 22 02:37:02.611851 2025] [:error] [pid 46374:tid 46398] [client 40.83.96.65:4912] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUg-ThLD7sK-wqrnXHUrPAAAAVY"]
[Mon Dec 22 02:37:04.177219 2025] [:error] [pid 46343:tid 46348] [client 40.83.96.65:5051] [client 40.83.96.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aUg-UBzbW_u_EvstJwQ2KAAAAAI"]
[Mon Dec 22 07:37:29.437143 2025] [:error] [pid 33440:tid 33450] [client 52.13.171.147:55757] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiEuZOsUWKqgxu6QTR3dQAAAQg"]
[Mon Dec 22 07:37:29.827175 2025] [:error] [pid 33472:tid 33501] [client 52.13.171.147:65270] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiEuZ5p2WQpPIK8HAkwWAAAAYA"]
[Mon Dec 22 07:37:30.217826 2025] [:error] [pid 33565:tid 33604] [client 52.13.171.147:59604] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aUiEutOWX69q8T0m_yKGLQAAAko"]
[Mon Dec 22 07:37:30.810131 2025] [:error] [pid 33643:tid 33660] [client 52.13.171.147:52942] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiEukoNwyN4xVhAvNONFQAAAo4"]
[Mon Dec 22 07:37:31.211326 2025] [:error] [pid 33565:tid 33616] [client 52.13.171.147:58099] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiEu9OWX69q8T0m_yKGRQAAAlY"]
[Mon Dec 22 07:37:31.614450 2025] [:error] [pid 58079:tid 58126] [client 52.13.171.147:60585] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aUiEu3xLB7WYaNS5A7jaawAAAE0"]
[Mon Dec 22 10:20:19.464140 2025] [:error] [pid 33472:tid 33505] [client 2.58.56.27:59700] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aUiq455p2WQpPIK8HAlSZwAAAYQ"], referer: www.google.com
[Mon Dec 22 10:20:19.466055 2025] [:error] [pid 58078:tid 58083] [client 2.58.56.27:64495] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aUiq45WKg9Bf8njHlB6mRgAAAAA"]
[Mon Dec 22 10:20:19.476871 2025] [:error] [pid 33471:tid 33479] [client 2.58.56.27:55778] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq475BeNE7regJ7izGIAAAAUU"], referer: www.google.com
[Mon Dec 22 10:20:19.481594 2025] [:error] [pid 58172:tid 58176] [client 2.58.56.27:57261] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq4-SVKDT5jWOcnSUlwAAAAMI"], referer: www.google.com
[Mon Dec 22 10:20:20.186054 2025] [:error] [pid 56044:tid 56050] [client 2.58.56.27:57443] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiq4-60uUaieriJqP3tyAAAAII"]
[Mon Dec 22 10:20:21.061676 2025] [:error] [pid 33565:tid 33594] [client 2.58.56.27:55706] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq5dOWX69q8T0m_yKfrgAAAkA"], referer: www.google.com
[Mon Dec 22 10:20:21.164315 2025] [:error] [pid 33471:tid 33482] [client 2.58.56.27:62220] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiq5b5BeNE7regJ7izGWQAAAUg"]
[Mon Dec 22 10:20:21.494653 2025] [:error] [pid 56078:tid 56110] [client 2.58.56.27:61187] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq5JB-mi1iY1_On76u6gAAAtE"], referer: www.google.com
[Mon Dec 22 10:20:21.494782 2025] [:error] [pid 56078:tid 56107] [client 2.58.56.27:63176] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aUiq5JB-mi1iY1_On76u6wAAAs4"]
[Mon Dec 22 10:20:21.501796 2025] [:error] [pid 56078:tid 56114] [client 2.58.56.27:56431] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aUiq5JB-mi1iY1_On76u9gAAAtU"], referer: www.google.com
[Mon Dec 22 10:20:22.279657 2025] [:error] [pid 33535:tid 33541] [client 2.58.56.27:50686] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq5mOCI8D9Xtn-n7QdHAAAAcQ"], referer: www.google.com
[Mon Dec 22 10:20:22.349985 2025] [:error] [pid 58078:tid 58086] [client 2.58.56.27:51543] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq5pWKg9Bf8njHlB6mpQAAAAM"], referer: www.google.com
[Mon Dec 22 10:20:22.620564 2025] [:error] [pid 56153:tid 56177] [client 2.58.56.27:57491] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiq5USS5f47yfDofyQSnAAAA00"]
[Mon Dec 22 10:20:22.786695 2025] [:error] [pid 56153:tid 56165] [client 2.58.56.27:53762] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aUiq5kSS5f47yfDofyQSqgAAA0E"]
[Mon Dec 22 10:20:22.797136 2025] [:error] [pid 56155:tid 56241] [client 2.58.56.27:53740] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aUiq5mG8a3wQucsuN656vAAAA5M"], referer: www.google.com
[Mon Dec 22 10:20:23.072544 2025] [:error] [pid 33565:tid 33602] [client 2.58.56.27:62851] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq59OWX69q8T0m_yKf5QAAAkg"], referer: www.google.com
[Mon Dec 22 10:20:23.347630 2025] [:error] [pid 58079:tid 58115] [client 2.58.56.27:56936] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiq53xLB7WYaNS5A7j4nwAAAEI"]
[Mon Dec 22 10:20:23.519166 2025] [:error] [pid 33564:tid 33581] [client 2.58.56.27:53120] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq5wSHeG6oLmMnKY4HVwAAAg4"], referer: www.google.com
[Mon Dec 22 10:20:23.532637 2025] [:error] [pid 33440:tid 33461] [client 2.58.56.27:55422] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aUiq55OsUWKqgxu6QTSWbQAAARM"]
[Mon Dec 22 10:20:23.600521 2025] [:error] [pid 56153:tid 56177] [client 2.58.56.27:58466] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aUiq50SS5f47yfDofyQStwAAA00"], referer: www.google.com
[Mon Dec 22 10:20:23.727169 2025] [:error] [pid 33564:tid 33588] [client 2.58.56.27:61230] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq5wSHeG6oLmMnKY4HXAAAAhU"], referer: www.google.com
[Mon Dec 22 10:20:24.102817 2025] [:error] [pid 56156:tid 56197] [client 2.58.56.27:61129] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUiq6Ft4V0DS5rs9y54e2QAAA8E"]
[Mon Dec 22 10:20:24.221948 2025] [:error] [pid 56044:tid 56055] [client 2.58.56.27:59229] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aUiq6O60uUaieriJqP3uKgAAAIc"]
[Mon Dec 22 10:20:24.274278 2025] [:error] [pid 56153:tid 56186] [client 2.58.56.27:57020] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "aUiq6ESS5f47yfDofyQSvQAAA1Y"], referer: www.google.com
[Mon Dec 22 10:20:24.817791 2025] [:error] [pid 58079:tid 58131] [client 2.58.56.27:56404] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq6HxLB7WYaNS5A7j4rQAAAFI"], referer: www.google.com
[Mon Dec 22 10:20:24.965916 2025] [:error] [pid 33472:tid 33507] [client 2.58.56.27:61064] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq6J5p2WQpPIK8HAlS6wAAAYY"], referer: www.google.com
[Mon Dec 22 10:20:26.063737 2025] [:error] [pid 58172:tid 58178] [client 2.58.56.27:60749] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq6uSVKDT5jWOcnSUmTgAAAMQ"], referer: www.google.com
[Mon Dec 22 10:20:26.098124 2025] [:error] [pid 58078:tid 58097] [client 2.58.56.27:49949] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq6pWKg9Bf8njHlB6mxAAAAA4"], referer: www.google.com
[Mon Dec 22 10:20:27.226400 2025] [:error] [pid 58172:tid 58198] [client 2.58.56.27:62781] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq6-SVKDT5jWOcnSUmVwAAANg"], referer: www.google.com
[Mon Dec 22 10:20:28.377390 2025] [:error] [pid 33643:tid 33668] [client 2.58.56.27:50716] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq7EoNwyN4xVhAvNOoBgAAApY"], referer: www.google.com
[Mon Dec 22 10:20:29.481812 2025] [:error] [pid 56044:tid 56059] [client 2.58.56.27:65313] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq7e60uUaieriJqP3uQwAAAIs"], referer: www.google.com
[Mon Dec 22 16:47:16.080333 2025] [:error] [pid 56080:tid 56148] [client 161.118.192.180:49868] [client 161.118.192.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.192.180, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUkFlJIHT3YJq9hjDc6yfAAAAxg"]
[Mon Dec 22 16:47:16.084332 2025] [:error] [pid 56080:tid 56148] [client 161.118.192.180:49868] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Dec 22 16:47:16.463761 2025] [:error] [pid 56080:tid 56131] [client 161.118.192.180:52301] [client 161.118.192.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.192.180, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUkFlJIHT3YJq9hjDc6yfQAAAwc"]
[Mon Dec 22 16:47:16.469639 2025] [:error] [pid 56080:tid 56131] [client 161.118.192.180:52301] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Dec 22 16:47:17.619258 2025] [:error] [pid 33440:tid 33454] [client 161.118.192.180:53731] [client 161.118.192.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.192.180, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aUkFlZOsUWKqgxu6QTT3QgAAAQw"], referer: https://t.co/
[Mon Dec 22 16:47:17.623150 2025] [:error] [pid 33440:tid 33454] [client 161.118.192.180:53731] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://t.co/
[Mon Dec 22 20:44:15.492605 2025] [:error] [pid 33564:tid 33584] [client 103.65.236.153:52642] [client 103.65.236.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aUk9HwSHeG6oLmMnKY7FAAAAAhE"]
[Mon Dec 22 21:01:36.979899 2025] [:error] [pid 33472:tid 33525] [client 116.212.159.242:50589] [client 116.212.159.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.212.159.242, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUlBMJ5p2WQpPIK8HAk2JAAAAZg"]
[Mon Dec 22 21:01:36.989003 2025] [:error] [pid 33472:tid 33525] [client 116.212.159.242:50589] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 23 02:48:55.092908 2025] [:error] [pid 12110:tid 12113] [client 195.24.236.147:56730] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUmSlwYatzD_WebWpOrrRAAAAIE"]
[Tue Dec 23 02:48:55.751130 2025] [:error] [pid 40267:tid 40285] [client 195.24.236.147:56875] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUmSl-TPWWVt2GkrftCNMQAAAAw"]
[Tue Dec 23 02:48:56.397092 2025] [:error] [pid 40268:tid 40319] [client 195.24.236.147:56995] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUmSmJWtCyS5tdJAiFx18wAAANE"]
[Tue Dec 23 02:48:57.104364 2025] [:error] [pid 40267:tid 40273] [client 195.24.236.147:57145] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUmSmeTPWWVt2GkrftCNVwAAAAA"]
[Tue Dec 23 02:48:57.747629 2025] [:error] [pid 40267:tid 40287] [client 195.24.236.147:57303] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUmSmeTPWWVt2GkrftCNYgAAAA4"]
[Tue Dec 23 06:01:32.235921 2025] [:error] [pid 49060:tid 49065] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Dec 23 06:01:32.326896 2025] [:error] [pid 49060:tid 49070] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Dec 23 06:01:32.522765 2025] [:error] [pid 49060:tid 49081] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Tue Dec 23 06:01:32.827608 2025] [:error] [pid 49060:tid 49086] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Dec 23 06:01:32.917721 2025] [:error] [pid 49060:tid 49071] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Tue Dec 23 06:01:33.007798 2025] [:error] [pid 49060:tid 49085] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Dec 23 06:01:33.207625 2025] [:error] [pid 49060:tid 49068] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Dec 23 06:01:33.582337 2025] [:error] [pid 49060:tid 49079] [client 4.194.67.230:14595] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Dec 23 06:01:33.831489 2025] [:error] [pid 49060:tid 49069] [client 4.194.67.230:14595] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aUm_vfvdpPyXg0aYbMVkmAAAAAU"]
[Tue Dec 23 06:01:34.369821 2025] [:error] [pid 49062:tid 49134] [client 4.194.67.230:14617] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aUm_vv_oMXBKdV37va21VAAAAI8"]
[Tue Dec 23 06:01:34.714596 2025] [:error] [pid 49062:tid 49143] [client 4.194.67.230:14623] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aUm_vv_oMXBKdV37va21VQAAAJg"]
[Tue Dec 23 06:01:35.259054 2025] [:error] [pid 49061:tid 49106] [client 4.194.67.230:14691] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aUm_v2RtvGWfzuDz6nQ-xgAAAE4"]
[Tue Dec 23 06:01:35.832023 2025] [:error] [pid 49150:tid 49156] [client 4.194.67.230:14684] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUm_v0uL91O4jNPzb4GGCwAAAMQ"]
[Tue Dec 23 06:01:36.201577 2025] [:error] [pid 49150:tid 49153] [client 4.194.67.230:14661] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUm_wEuL91O4jNPzb4GGDQAAAME"]
[Tue Dec 23 06:01:36.505382 2025] [:error] [pid 49150:tid 49162] [client 4.194.67.230:14659] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUm_wEuL91O4jNPzb4GGDgAAAMo"]
[Tue Dec 23 06:01:36.899614 2025] [:error] [pid 49150:tid 49163] [client 4.194.67.230:14705] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aUm_wEuL91O4jNPzb4GGDwAAAMs"]
[Tue Dec 23 06:01:37.735183 2025] [:error] [pid 49150:tid 49168] [client 4.194.67.230:14656] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUm_wUuL91O4jNPzb4GGEwAAANA"]
[Tue Dec 23 06:01:38.308996 2025] [:error] [pid 49150:tid 49152] [client 4.194.67.230:14614] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUm_wkuL91O4jNPzb4GGFgAAAMA"]
[Tue Dec 23 06:01:39.005235 2025] [:error] [pid 49150:tid 49169] [client 4.194.67.230:14601] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUm_w0uL91O4jNPzb4GGGgAAANE"]
[Tue Dec 23 06:01:39.630520 2025] [:error] [pid 49150:tid 49160] [client 4.194.67.230:14611] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aUm_w0uL91O4jNPzb4GGHgAAAMg"]
[Tue Dec 23 06:01:39.961506 2025] [:error] [pid 49150:tid 49153] [client 4.194.67.230:14716] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUm_w0uL91O4jNPzb4GGIAAAAME"]
[Tue Dec 23 06:01:40.487161 2025] [:error] [pid 49150:tid 49158] [client 4.194.67.230:14666] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUm_xEuL91O4jNPzb4GGJwAAAMY"]
[Tue Dec 23 06:01:40.718897 2025] [:error] [pid 49150:tid 49174] [client 4.194.67.230:14680] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUm_xEuL91O4jNPzb4GGKQAAANY"]
[Tue Dec 23 06:01:41.114802 2025] [:error] [pid 49150:tid 49161] [client 4.194.67.230:14602] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aUm_xUuL91O4jNPzb4GGKwAAAMk"]
[Tue Dec 23 06:01:41.454343 2025] [:error] [pid 49150:tid 49164] [client 4.194.67.230:14714] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUm_xUuL91O4jNPzb4GGLgAAAMw"]
[Tue Dec 23 06:01:42.022713 2025] [:error] [pid 49150:tid 49155] [client 4.194.67.230:14594] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUm_xkuL91O4jNPzb4GGMgAAAMM"]
[Tue Dec 23 06:01:42.734079 2025] [:error] [pid 49150:tid 49166] [client 4.194.67.230:14692] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUm_xkuL91O4jNPzb4GGNgAAAM4"]
[Tue Dec 23 06:01:43.322328 2025] [:error] [pid 49150:tid 49157] [client 4.194.67.230:14606] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aUm_x0uL91O4jNPzb4GGPQAAAMU"]
[Tue Dec 23 06:01:43.667344 2025] [:error] [pid 49060:tid 49082] [client 4.194.67.230:14643] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUm_x_vdpPyXg0aYbMVkpgAAABI"]
[Tue Dec 23 06:01:43.924690 2025] [:error] [pid 49061:tid 49106] [client 4.194.67.230:4938] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUm_x2RtvGWfzuDz6nQ-0QAAAE4"]
[Tue Dec 23 06:01:44.222614 2025] [:error] [pid 49060:tid 49078] [client 4.194.67.230:14675] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUm_yPvdpPyXg0aYbMVkqAAAAA4"]
[Tue Dec 23 06:01:44.456972 2025] [:error] [pid 49061:tid 49104] [client 4.194.67.230:14681] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aUm_yGRtvGWfzuDz6nQ-0wAAAEw"]
[Tue Dec 23 06:01:44.732618 2025] [:error] [pid 49061:tid 49096] [client 4.194.67.230:14636] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aUm_yGRtvGWfzuDz6nQ-1gAAAEQ"]
[Tue Dec 23 06:01:45.012585 2025] [:error] [pid 49061:tid 49116] [client 4.194.67.230:14701] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aUm_yWRtvGWfzuDz6nQ-2AAAAFg"]
[Tue Dec 23 06:01:45.264875 2025] [:error] [pid 49061:tid 49095] [client 4.194.67.230:14667] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aUm_yWRtvGWfzuDz6nQ-2wAAAEM"]
[Tue Dec 23 06:01:45.520017 2025] [:error] [pid 49061:tid 49113] [client 4.194.67.230:14673] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aUm_yWRtvGWfzuDz6nQ-3QAAAFU"]
[Tue Dec 23 06:01:45.826619 2025] [:error] [pid 49062:tid 49140] [client 4.194.67.230:14674] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aUm_yf_oMXBKdV37va21YAAAAJU"]
[Tue Dec 23 06:01:46.154692 2025] [:error] [pid 49150:tid 49162] [client 4.194.67.230:14703] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aUm_ykuL91O4jNPzb4GGQwAAAMo"]
[Tue Dec 23 06:01:46.409918 2025] [:error] [pid 49150:tid 49173] [client 4.194.67.230:14707] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aUm_ykuL91O4jNPzb4GGRQAAANU"]
[Tue Dec 23 06:01:47.007712 2025] [:error] [pid 49060:tid 49079] [client 4.194.67.230:14687] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aUm_y_vdpPyXg0aYbMVksAAAAA8"]
[Tue Dec 23 06:01:47.264676 2025] [:error] [pid 49060:tid 49078] [client 4.194.67.230:14628] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aUm_y_vdpPyXg0aYbMVkswAAAA4"]
[Tue Dec 23 06:01:47.440700 2025] [:error] [pid 49060:tid 49084] [client 4.194.67.230:14700] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aUm_y_vdpPyXg0aYbMVktQAAABQ"]
[Tue Dec 23 06:01:47.729834 2025] [:error] [pid 49150:tid 49169] [client 4.194.67.230:14686] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aUm_y0uL91O4jNPzb4GGRgAAANE"]
[Tue Dec 23 06:01:47.911239 2025] [:error] [pid 49150:tid 49156] [client 4.194.67.230:14604] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aUm_y0uL91O4jNPzb4GGRwAAAMQ"]
[Tue Dec 23 06:01:48.338394 2025] [:error] [pid 49060:tid 49086] [client 4.194.67.230:14597] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUm_zPvdpPyXg0aYbMVkvAAAABY"]
[Tue Dec 23 06:01:48.756292 2025] [:error] [pid 49061:tid 49112] [client 4.194.67.230:14663] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUm_zGRtvGWfzuDz6nQ-4wAAAFQ"]
[Tue Dec 23 06:01:49.018320 2025] [:error] [pid 49061:tid 49116] [client 4.194.67.230:14717] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUm_zWRtvGWfzuDz6nQ-5AAAAFg"]
[Tue Dec 23 06:01:49.333106 2025] [:error] [pid 49060:tid 49079] [client 4.194.67.230:14658] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUm_zfvdpPyXg0aYbMVkvwAAAA8"]
[Tue Dec 23 06:01:49.568364 2025] [:error] [pid 49060:tid 49069] [client 4.194.67.230:14648] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUm_zfvdpPyXg0aYbMVkwQAAAAU"]
[Tue Dec 23 06:01:49.806269 2025] [:error] [pid 49062:tid 49131] [client 4.194.67.230:4930] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUm_zf_oMXBKdV37va21YwAAAIw"]
[Tue Dec 23 06:01:50.044008 2025] [:error] [pid 49150:tid 49162] [client 4.194.67.230:14610] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUm_zkuL91O4jNPzb4GGTgAAAMo"]
[Tue Dec 23 06:01:50.330785 2025] [:error] [pid 49150:tid 49155] [client 4.194.67.230:14621] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aUm_zkuL91O4jNPzb4GGUAAAAMM"]
[Tue Dec 23 06:01:50.693344 2025] [:error] [pid 49060:tid 49072] [client 4.194.67.230:14640] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUm_zvvdpPyXg0aYbMVkxgAAAAg"]
[Tue Dec 23 06:01:51.068743 2025] [:error] [pid 49060:tid 49068] [client 4.194.67.230:14635] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUm_z_vdpPyXg0aYbMVkxwAAAAQ"]
[Tue Dec 23 06:01:51.413358 2025] [:error] [pid 49062:tid 49122] [client 4.194.67.230:14672] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUm_z__oMXBKdV37va21aAAAAIM"]
[Tue Dec 23 06:01:51.627674 2025] [:error] [pid 49062:tid 49139] [client 4.194.67.230:14613] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "aUm_z__oMXBKdV37va21aQAAAJQ"]
[Tue Dec 23 06:01:51.891017 2025] [:error] [pid 49062:tid 49126] [client 4.194.67.230:14698] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUm_z__oMXBKdV37va21agAAAIc"]
[Tue Dec 23 06:01:52.333764 2025] [:error] [pid 49061:tid 49093] [client 4.194.67.230:14689] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUm_0GRtvGWfzuDz6nQ-7QAAAEE"]
[Tue Dec 23 06:01:52.764781 2025] [:error] [pid 49062:tid 49128] [client 4.194.67.230:14708] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUm_0P_oMXBKdV37va21cAAAAIk"]
[Tue Dec 23 06:01:53.103839 2025] [:error] [pid 49061:tid 49102] [client 4.194.67.230:14631] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUm_0WRtvGWfzuDz6nQ-8AAAAEo"]
[Tue Dec 23 06:01:53.313199 2025] [:error] [pid 49061:tid 49095] [client 4.194.67.230:4980] [client 4.194.67.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aUm_0WRtvGWfzuDz6nQ-8wAAAEM"]
[Tue Dec 23 06:01:53.522807 2025] [:error] [pid 49060:tid 49080] [client 4.194.67.230:14682] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aUm_0fvdpPyXg0aYbMVkzwAAABA"]
[Tue Dec 23 06:01:53.798844 2025] [:error] [pid 49060:tid 49074] [client 4.194.67.230:14619] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aUm_0fvdpPyXg0aYbMVk0QAAAAo"]
[Tue Dec 23 06:01:54.125893 2025] [:error] [pid 49062:tid 49127] [client 4.194.67.230:14612] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aUm_0v_oMXBKdV37va21dgAAAIg"]
[Tue Dec 23 06:01:54.398684 2025] [:error] [pid 49061:tid 49107] [client 4.194.67.230:14677] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUm_0mRtvGWfzuDz6nQ--AAAAE8"]
[Tue Dec 23 06:01:54.789815 2025] [:error] [pid 49060:tid 49073] [client 4.194.67.230:14685] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUm_0vvdpPyXg0aYbMVk0wAAAAk"]
[Tue Dec 23 06:01:55.119015 2025] [:error] [pid 49062:tid 49119] [client 4.194.67.230:14624] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUm_0__oMXBKdV37va21ewAAAIA"]
[Tue Dec 23 06:01:55.563697 2025] [:error] [pid 49150:tid 49165] [client 4.194.67.230:14699] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aUm_00uL91O4jNPzb4GGWAAAAM0"]
[Tue Dec 23 06:01:56.029994 2025] [:error] [pid 49150:tid 49171] [client 4.194.67.230:14664] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUm_1EuL91O4jNPzb4GGWgAAANM"]
[Tue Dec 23 06:01:56.625701 2025] [:error] [pid 49061:tid 49116] [client 4.194.67.230:14622] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUm_1GRtvGWfzuDz6nQ-_QAAAFg"]
[Tue Dec 23 06:01:56.927031 2025] [:error] [pid 49060:tid 49078] [client 4.194.67.230:4962] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUm_1PvdpPyXg0aYbMVk2AAAAA4"]
[Tue Dec 23 06:01:57.120666 2025] [:error] [pid 49061:tid 49109] [client 4.194.67.230:14646] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aUm_1WRtvGWfzuDz6nQ-_gAAAFE"]
[Tue Dec 23 06:01:57.363340 2025] [:error] [pid 49061:tid 49104] [client 4.194.67.230:14706] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aUm_1WRtvGWfzuDz6nQ_AAAAAEw"]
[Tue Dec 23 06:01:57.583716 2025] [:error] [pid 49060:tid 49072] [client 4.194.67.230:14670] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aUm_1fvdpPyXg0aYbMVk3QAAAAg"]
[Tue Dec 23 06:01:57.782104 2025] [:error] [pid 49150:tid 49155] [client 4.194.67.230:14630] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aUm_1UuL91O4jNPzb4GGXAAAAMM"]
[Tue Dec 23 06:01:58.085920 2025] [:error] [pid 49062:tid 49127] [client 4.194.67.230:14627] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aUm_1v_oMXBKdV37va21ggAAAIg"]
[Tue Dec 23 06:01:58.289848 2025] [:error] [pid 49150:tid 49157] [client 4.194.67.230:4946] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUm_1kuL91O4jNPzb4GGXgAAAMU"]
[Tue Dec 23 06:01:58.568193 2025] [:error] [pid 49062:tid 49122] [client 4.194.67.230:14616] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUm_1v_oMXBKdV37va21gwAAAIM"]
[Tue Dec 23 06:01:58.841801 2025] [:error] [pid 49062:tid 49126] [client 4.194.67.230:4944] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUm_1v_oMXBKdV37va21hAAAAIc"]
[Tue Dec 23 06:01:59.048364 2025] [:error] [pid 49062:tid 49119] [client 4.194.67.230:14618] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUm_1__oMXBKdV37va21hQAAAIA"]
[Tue Dec 23 06:01:59.377325 2025] [:error] [pid 49060:tid 49075] [client 4.194.67.230:14592] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aUm_1_vdpPyXg0aYbMVk3wAAAAs"]
[Tue Dec 23 06:01:59.602110 2025] [:error] [pid 49060:tid 49088] [client 4.194.67.230:4960] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aUm_1_vdpPyXg0aYbMVk4AAAABg"]
[Tue Dec 23 06:01:59.872432 2025] [:error] [pid 49060:tid 49085] [client 4.194.67.230:14715] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aUm_1_vdpPyXg0aYbMVk4gAAABU"]
[Tue Dec 23 06:02:00.395673 2025] [:error] [pid 49062:tid 49128] [client 4.194.67.230:14704] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aUm_2P_oMXBKdV37va21iAAAAIk"]
[Tue Dec 23 06:02:00.994308 2025] [:error] [pid 49062:tid 49134] [client 4.194.67.230:4954] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUm_2P_oMXBKdV37va21iwAAAI8"]
[Tue Dec 23 06:02:01.370390 2025] [:error] [pid 49062:tid 49124] [client 4.194.67.230:14603] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUm_2f_oMXBKdV37va21jgAAAIU"]
[Tue Dec 23 06:02:02.028745 2025] [:error] [pid 49062:tid 49140] [client 4.194.67.230:14694] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUm_2v_oMXBKdV37va21kwAAAJU"]
[Tue Dec 23 06:02:02.447898 2025] [:error] [pid 49062:tid 49120] [client 4.194.67.230:14605] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aUm_2v_oMXBKdV37va21lgAAAIE"]
[Tue Dec 23 06:02:02.949556 2025] [:error] [pid 49062:tid 49138] [client 4.194.67.230:14620] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUm_2v_oMXBKdV37va21mAAAAJM"]
[Tue Dec 23 06:02:03.297273 2025] [:error] [pid 49060:tid 49065] [client 4.194.67.230:4963] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUm_2_vdpPyXg0aYbMVk6QAAAAE"]
[Tue Dec 23 06:02:03.614178 2025] [:error] [pid 49061:tid 49113] [client 4.194.67.230:14657] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUm_22RtvGWfzuDz6nQ_BgAAAFU"]
[Tue Dec 23 06:02:03.795354 2025] [:error] [pid 49062:tid 49142] [client 4.194.67.230:14654] [client 4.194.67.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aUm_2__oMXBKdV37va21mQAAAJc"]
[Tue Dec 23 14:01:25.681911 2025] [:error] [pid 3404:tid 3422] [client 139.64.164.4:38160] [client 139.64.164.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/config.yml" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app_dev.php/_profiler/open"] [unique_id "aUowNcJGbPWZNlrhVJfzQgAAAc0"]
[Tue Dec 23 15:58:20.382273 2025] [:error] [pid 3406:tid 3482] [client 34.133.99.121:50651] [client 34.133.99.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.99.121, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUpLnPn8DLWxW7TPzpGQTAAAAFI"]
[Tue Dec 23 15:58:20.385487 2025] [:error] [pid 3406:tid 3482] [client 34.133.99.121:50651] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 23 15:58:22.649515 2025] [:error] [pid 3406:tid 3464] [client 34.133.99.121:50651] [client 34.133.99.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aUpLnvn8DLWxW7TPzpGQWAAAAEA"]
[Tue Dec 23 15:58:23.062297 2025] [:error] [pid 3404:tid 3428] [client 34.133.99.121:63903] [client 34.133.99.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aUpLn8JGbPWZNlrhVJcX6AAAAdM"]
[Tue Dec 23 15:58:23.487183 2025] [:error] [pid 3405:tid 3454] [client 34.133.99.121:63310] [client 34.133.99.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aUpLn7dHHpIDpQ39rwnzRAAAABE"]
[Tue Dec 23 15:58:23.908668 2025] [:error] [pid 11812:tid 11818] [client 34.133.99.121:58634] [client 34.133.99.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aUpLn7BkIQ4nTXm4A3XZzQAAAIQ"]
[Tue Dec 23 15:58:24.336670 2025] [:error] [pid 3405:tid 3453] [client 34.133.99.121:58516] [client 34.133.99.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aUpLoLdHHpIDpQ39rwnzRQAAABA"]
[Tue Dec 23 15:58:24.783819 2025] [:error] [pid 11812:tid 11831] [client 34.133.99.121:53859] [client 34.133.99.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aUpLoLBkIQ4nTXm4A3XZzgAAAJE"]
[Tue Dec 23 15:58:25.191348 2025] [:error] [pid 3406:tid 3482] [client 34.133.99.121:51624] [client 34.133.99.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aUpLofn8DLWxW7TPzpGQWgAAAFI"]
[Tue Dec 23 20:34:09.632050 2025] [:error] [pid 25976:tid 25995] [client 82.129.23.0:37771] [client 82.129.23.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.129.23.0, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUqMQbF6LaWzQScE-xN-OgAAARE"]
[Tue Dec 23 20:34:09.636826 2025] [:error] [pid 25976:tid 25995] [client 82.129.23.0:37771] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 24 00:53:42.467024 2025] [:error] [pid 10374:tid 10392] [client 34.86.10.142:55027] [client 34.86.10.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.10.142, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUrJFvgeiZmmnSvZBQ0vGAAAANA"]
[Wed Dec 24 00:53:42.470532 2025] [:error] [pid 10374:tid 10392] [client 34.86.10.142:55027] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 24 00:53:45.460441 2025] [:error] [pid 10374:tid 10391] [client 34.86.10.142:55027] [client 34.86.10.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aUrJGfgeiZmmnSvZBQ0vKQAAAM8"]
[Wed Dec 24 00:53:46.053914 2025] [:error] [pid 17495:tid 17555] [client 34.86.10.142:49751] [client 34.86.10.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aUrJGiX1bYzs2kDzvLW1JgAAAEQ"]
[Wed Dec 24 00:53:46.714327 2025] [:error] [pid 17495:tid 17571] [client 34.86.10.142:62515] [client 34.86.10.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aUrJGiX1bYzs2kDzvLW1JwAAAFQ"]
[Wed Dec 24 00:53:47.259879 2025] [:error] [pid 17591:tid 17604] [client 34.86.10.142:50701] [client 34.86.10.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aUrJG5H0gxj6Q9MQR2L-HQAAAIo"]
[Wed Dec 24 00:53:47.874095 2025] [:error] [pid 17495:tid 17556] [client 34.86.10.142:59198] [client 34.86.10.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aUrJGyX1bYzs2kDzvLW1KQAAAEU"]
[Wed Dec 24 00:53:48.412842 2025] [:error] [pid 17591:tid 17595] [client 34.86.10.142:53883] [client 34.86.10.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aUrJHJH0gxj6Q9MQR2L-HwAAAIE"]
[Wed Dec 24 00:53:49.012382 2025] [:error] [pid 17591:tid 17594] [client 34.86.10.142:50231] [client 34.86.10.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aUrJHZH0gxj6Q9MQR2L-JAAAAIA"]
[Wed Dec 24 03:53:43.947834 2025] [:error] [pid 16550:tid 16559] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php, referer: https://duckduckgo.com/
[Wed Dec 24 03:53:44.091810 2025] [:error] [pid 16550:tid 16575] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php, referer: https://www.google.de/
[Wed Dec 24 03:53:44.231033 2025] [:error] [pid 16550:tid 16574] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://www.bing.com/
[Wed Dec 24 03:53:44.371028 2025] [:error] [pid 16550:tid 16554] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://duckduckgo.com/
[Wed Dec 24 03:53:44.647595 2025] [:error] [pid 16550:tid 16569] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/alf.php, referer: https://www.yahoo.com/
[Wed Dec 24 03:53:44.786878 2025] [:error] [pid 16550:tid 16565] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/alfav4.1-tesla.php, referer: https://www.google.fr/
[Wed Dec 24 03:53:44.925163 2025] [:error] [pid 16550:tid 16570] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php, referer: https://www.google.de/
[Wed Dec 24 03:53:45.063247 2025] [:error] [pid 16550:tid 16564] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/bb.php, referer: https://www.google.co.uk/
[Wed Dec 24 03:53:45.200650 2025] [:error] [pid 16550:tid 16555] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/black.php, referer: https://www.google.de/
[Wed Dec 24 03:53:45.338464 2025] [:error] [pid 16550:tid 16576] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php, referer: https://www.yahoo.com/
[Wed Dec 24 03:53:45.623172 2025] [:error] [pid 16550:tid 16558] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/cyber.php, referer: https://www.google.de/
[Wed Dec 24 03:53:45.761361 2025] [:error] [pid 16550:tid 16571] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php, referer: https://www.google.fr/
[Wed Dec 24 03:53:45.900522 2025] [:error] [pid 16550:tid 16573] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php, referer: https://www.google.de/
[Wed Dec 24 03:53:46.037323 2025] [:error] [pid 16550:tid 16568] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/fx.php, referer: https://www.google.com/
[Wed Dec 24 03:53:46.174849 2025] [:error] [pid 16550:tid 16559] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php, referer: https://duckduckgo.com/
[Wed Dec 24 03:53:46.313173 2025] [:error] [pid 16550:tid 16575] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/gelay.php, referer: https://www.google.co.uk/
[Wed Dec 24 03:53:46.459508 2025] [:error] [pid 16550:tid 16574] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php, referer: https://www.bing.com/
[Wed Dec 24 03:53:46.877630 2025] [:error] [pid 16550:tid 16569] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php, referer: https://www.bing.com/
[Wed Dec 24 03:53:47.015945 2025] [:error] [pid 16550:tid 16565] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/luuf.php, referer: https://www.google.co.uk/
[Wed Dec 24 03:53:47.154077 2025] [:error] [pid 16550:tid 16570] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/o.php, referer: https://www.google.co.uk/
[Wed Dec 24 03:53:47.293205 2025] [:error] [pid 16550:tid 16560] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php, referer: https://www.google.fr/
[Wed Dec 24 03:53:47.432088 2025] [:error] [pid 16550:tid 16556] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/phpmailer.lang-sv.php, referer: https://www.google.co.uk/
[Wed Dec 24 03:53:47.570161 2025] [:error] [pid 16550:tid 16555] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/sa.php, referer: https://www.google.com/
[Wed Dec 24 03:53:47.708446 2025] [:error] [pid 16550:tid 16576] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php, referer: https://www.google.fr/
[Wed Dec 24 03:53:47.846120 2025] [:error] [pid 16550:tid 16553] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php, referer: https://www.google.de/
[Wed Dec 24 03:53:48.128705 2025] [:error] [pid 16550:tid 16561] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/tmp.php, referer: https://duckduckgo.com/
[Wed Dec 24 03:53:48.267823 2025] [:error] [pid 16550:tid 16566] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php, referer: https://www.bing.com/
[Wed Dec 24 03:53:48.405249 2025] [:error] [pid 16550:tid 16573] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/uploaded_script.php, referer: https://www.bing.com/
[Wed Dec 24 03:53:48.681930 2025] [:error] [pid 16550:tid 16552] [client 4.217.236.28:63075] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php, referer: https://duckduckgo.com/
[Wed Dec 24 03:53:52.605700 2025] [:error] [pid 16550:tid 16554] [client 4.217.236.28:63075] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/4.php"] [unique_id "aUrzUKYYcdD-LuO7vrDaiAAAAMI"], referer: https://www.yahoo.com/
[Wed Dec 24 03:53:52.876363 2025] [:error] [pid 16468:tid 16524] [client 4.217.236.28:63834] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aUrzUIdyfuSTFLkCbP-j4gAAAIA"], referer: https://duckduckgo.com/
[Wed Dec 24 03:53:53.149538 2025] [:error] [pid 16468:tid 16539] [client 4.217.236.28:63077] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aUrzUYdyfuSTFLkCbP-j4wAAAI8"], referer: https://www.google.com/
[Wed Dec 24 03:53:53.419938 2025] [:error] [pid 16466:tid 16494] [client 4.217.236.28:61266] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aUrzUbu0JcuKJMjJn6xTCwAAABg"], referer: https://www.google.fr/
[Wed Dec 24 03:53:53.690415 2025] [:error] [pid 16468:tid 16544] [client 4.217.236.28:63144] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/gelay.php"] [unique_id "aUrzUYdyfuSTFLkCbP-j5AAAAJQ"], referer: https://www.google.co.uk/
[Wed Dec 24 03:53:53.964085 2025] [:error] [pid 16466:tid 16475] [client 4.217.236.28:60753] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/cropper.php"] [unique_id "aUrzUbu0JcuKJMjJn6xTDgAAAAU"], referer: https://www.bing.com/
[Wed Dec 24 03:53:54.241073 2025] [:error] [pid 16467:tid 16500] [client 4.217.236.28:60744] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/thickbox.php"] [unique_id "aUrzUo0TJMcBxX5slgpmTAAAAEM"], referer: https://www.google.de/
[Wed Dec 24 03:53:54.516719 2025] [:error] [pid 16550:tid 16565] [client 4.217.236.28:60108] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/about.php"] [unique_id "aUrzUqYYcdD-LuO7vrDaiQAAAM0"], referer: https://www.google.de/
[Wed Dec 24 03:53:54.801237 2025] [:error] [pid 16550:tid 16556] [client 4.217.236.28:61274] [client 4.217.236.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mini.php"] [unique_id "aUrzUqYYcdD-LuO7vrDajAAAAMQ"], referer: https://www.bing.com/
[Wed Dec 24 03:53:55.081620 2025] [:error] [pid 16550:tid 16558] [client 4.217.236.28:63832] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-video.php, referer: https://www.google.de/
[Wed Dec 24 03:53:55.228688 2025] [:error] [pid 16550:tid 16571] [client 4.217.236.28:63832] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xml.php, referer: https://www.google.fr/
[Wed Dec 24 03:53:55.372931 2025] [:error] [pid 16550:tid 16567] [client 4.217.236.28:63832] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php, referer: https://www.google.com/
[Wed Dec 24 08:22:06.543280 2025] [:error] [pid 16467:tid 16498] [client 202.61.228.174:52754] [client 202.61.228.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUsyLo0TJMcBxX5slgqoCAAAAEE"]
[Wed Dec 24 08:22:07.187186 2025] [:error] [pid 54139:tid 54158] [client 202.61.228.174:63433] [client 202.61.228.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aUsyL8rYCZenIDzgXuKxtwAAARE"]
[Wed Dec 24 08:22:07.827264 2025] [:error] [pid 54139:tid 54142] [client 202.61.228.174:62072] [client 202.61.228.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aUsyL8rYCZenIDzgXuKxuAAAAQE"]
[Wed Dec 24 08:35:25.819166 2025] [:error] [pid 16466:tid 16479] [client 45.139.104.214:60255] [client 45.139.104.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aUs1Tbu0JcuKJMjJn6yQugAAAAk"]
[Wed Dec 24 10:49:16.987409 2025] [:error] [pid 29371:tid 29374] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Dec 24 10:49:17.218222 2025] [:error] [pid 29371:tid 29381] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Dec 24 10:49:17.940001 2025] [:error] [pid 29371:tid 29381] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Dec 24 10:49:18.173218 2025] [:error] [pid 29371:tid 29381] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Dec 24 10:49:18.406291 2025] [:error] [pid 29371:tid 29377] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Dec 24 10:49:18.656005 2025] [:error] [pid 29371:tid 29385] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Dec 24 10:49:18.941979 2025] [:error] [pid 29371:tid 29386] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Dec 24 10:49:19.205269 2025] [:error] [pid 29371:tid 29387] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 24 10:49:19.763176 2025] [:error] [pid 29371:tid 29390] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Dec 24 10:49:20.230171 2025] [:error] [pid 29371:tid 29394] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Dec 24 10:49:20.493494 2025] [:error] [pid 29371:tid 29391] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Dec 24 10:49:20.724092 2025] [:error] [pid 29371:tid 29382] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Dec 24 10:49:20.960097 2025] [:error] [pid 29371:tid 29397] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Dec 24 10:49:21.271701 2025] [:error] [pid 29371:tid 29393] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Dec 24 10:49:21.517108 2025] [:error] [pid 29371:tid 29373] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Dec 24 10:49:21.744616 2025] [:error] [pid 29371:tid 29376] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Dec 24 10:49:21.981415 2025] [:error] [pid 29371:tid 29394] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Dec 24 10:49:22.211822 2025] [:error] [pid 29371:tid 29386] [client 63.135.161.62:46437] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Dec 24 10:49:25.745006 2025] [:error] [pid 29371:tid 29373] [client 63.135.161.62:46437] [client 63.135.161.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUtUtXs-DlKLysSq5L8OkQAAAcA"]
[Wed Dec 24 10:49:26.887690 2025] [:error] [pid 54139:tid 54155] [client 63.135.161.51:57025] [client 63.135.161.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUtUtsrYCZenIDzgXuL8QQAAAQ4"]
[Wed Dec 24 10:49:28.136369 2025] [:error] [pid 16466:tid 16494] [client 63.135.161.50:33849] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Dec 24 10:49:28.896192 2025] [:error] [pid 16466:tid 16477] [client 63.135.161.50:33849] [client 63.135.161.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aUtUuLu0JcuKJMjJn6y_pAAAAAc"]
[Wed Dec 24 10:49:29.836811 2025] [:error] [pid 54139:tid 54155] [client 104.234.53.218:21011] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Dec 24 10:49:30.048876 2025] [:error] [pid 54139:tid 54158] [client 104.234.53.218:21011] [client 104.234.53.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUtUusrYCZenIDzgXuL8awAAARE"]
[Wed Dec 24 10:49:30.762931 2025] [:error] [pid 29371:tid 29382] [client 63.135.161.69:46847] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Dec 24 10:49:32.234701 2025] [:error] [pid 29371:tid 29374] [client 63.135.161.69:46847] [client 63.135.161.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUtUvHs-DlKLysSq5L8O7wAAAcE"]
[Wed Dec 24 10:49:32.966685 2025] [:error] [pid 29371:tid 29388] [client 63.135.161.72:55561] [client 63.135.161.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUtUvHs-DlKLysSq5L8PAgAAAc8"]
[Wed Dec 24 10:49:34.428372 2025] [:error] [pid 16550:tid 16574] [client 104.234.53.208:57643] [client 104.234.53.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUtUvqYYcdD-LuO7vrBjGQAAANY"]
[Wed Dec 24 10:49:34.854307 2025] [:error] [pid 29371:tid 29376] [client 63.135.161.64:42461] [client 63.135.161.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUtUvns-DlKLysSq5L8PJgAAAcM"]
[Wed Dec 24 10:49:35.290752 2025] [:error] [pid 16550:tid 16573] [client 104.234.53.215:57523] [client 104.234.53.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUtUv6YYcdD-LuO7vrBjNAAAANU"]
[Wed Dec 24 10:49:35.713293 2025] [:error] [pid 28777:tid 28780] [client 104.234.53.226:26171] [client 104.234.53.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUtUv5BVBcZ34cSqz8q_RAAAAYE"]
[Wed Dec 24 10:49:36.383873 2025] [:error] [pid 16468:tid 16534] [client 104.234.53.208:29531] [client 104.234.53.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUtUwIdyfuSTFLkCbP8hNwAAAIo"]
[Wed Dec 24 10:49:36.838786 2025] [:error] [pid 16550:tid 16567] [client 63.135.161.50:22887] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Dec 24 10:49:37.306420 2025] [:error] [pid 16550:tid 16572] [client 63.135.161.50:22887] [client 63.135.161.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aUtUwaYYcdD-LuO7vrBjawAAANQ"]
[Wed Dec 24 10:49:38.201282 2025] [:error] [pid 16550:tid 16575] [client 63.135.161.57:39525] [client 63.135.161.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUtUwqYYcdD-LuO7vrBjfwAAANc"]
[Wed Dec 24 10:49:39.919070 2025] [:error] [pid 28405:tid 28425] [client 63.135.161.46:43693] [client 63.135.161.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUtUw8KkTWlhmfdXFqbnLgAAAU8"]
[Wed Dec 24 10:49:40.407044 2025] [:error] [pid 28405:tid 28419] [client 63.135.161.53:41237] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Dec 24 10:49:40.648328 2025] [:error] [pid 28405:tid 28421] [client 63.135.161.53:41237] [client 63.135.161.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUtUxMKkTWlhmfdXFqbnPgAAAUs"]
[Wed Dec 24 10:50:00.822781 2025] [:error] [pid 54139:tid 54161] [client 63.135.161.66:52541] [client 63.135.161.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/tflow/"] [unique_id "aUtU2MrYCZenIDzgXuL-mwAAARQ"]
[Wed Dec 24 10:50:43.131171 2025] [:error] [pid 54139:tid 54153] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Dec 24 10:50:43.348277 2025] [:error] [pid 54139:tid 54160] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Dec 24 10:50:43.563094 2025] [:error] [pid 54139:tid 54157] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Dec 24 10:50:43.811628 2025] [:error] [pid 54139:tid 54144] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Dec 24 10:50:44.027720 2025] [:error] [pid 54139:tid 54142] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Dec 24 10:50:44.242751 2025] [:error] [pid 54139:tid 54151] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Dec 24 10:50:44.464190 2025] [:error] [pid 54139:tid 54163] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Dec 24 10:50:44.683764 2025] [:error] [pid 54139:tid 54152] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 24 10:50:45.149880 2025] [:error] [pid 54139:tid 54148] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Dec 24 10:50:45.586394 2025] [:error] [pid 54139:tid 54150] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Dec 24 10:50:45.819219 2025] [:error] [pid 54139:tid 54160] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Dec 24 10:50:46.088357 2025] [:error] [pid 54139:tid 54162] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Dec 24 10:50:46.349107 2025] [:error] [pid 54139:tid 54164] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Dec 24 10:50:46.602132 2025] [:error] [pid 54139:tid 54142] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Dec 24 10:50:46.840935 2025] [:error] [pid 54139:tid 54148] [client 104.234.53.215:63245] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Dec 24 10:50:47.059353 2025] [:error] [pid 54139:tid 54155] [client 104.234.53.215:63245] [client 104.234.53.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ahax.php"] [unique_id "aUtVB8rYCZenIDzgXuIBqQAAAQ4"]
[Wed Dec 24 10:50:47.493160 2025] [:error] [pid 29371:tid 29394] [client 104.234.53.214:38885] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Dec 24 10:50:47.709318 2025] [:error] [pid 29371:tid 29381] [client 104.234.53.214:38885] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Dec 24 10:50:47.954410 2025] [:error] [pid 29371:tid 29395] [client 104.234.53.214:38885] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Dec 24 10:50:51.214330 2025] [:error] [pid 29371:tid 29394] [client 104.234.53.214:38885] [client 104.234.53.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUtVC3s-DlKLysSq5L8V6gAAAdU"]
[Wed Dec 24 10:50:52.471217 2025] [:error] [pid 28405:tid 28420] [client 63.135.161.56:22979] [client 63.135.161.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUtVDMKkTWlhmfdXFqbrhAAAAUo"]
[Wed Dec 24 10:50:53.638685 2025] [:error] [pid 16468:tid 16548] [client 63.135.161.64:43677] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Dec 24 10:50:54.339478 2025] [:error] [pid 16468:tid 16527] [client 63.135.161.64:43677] [client 63.135.161.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aUtVDodyfuSTFLkCbP8lKQAAAIM"]
[Wed Dec 24 10:50:55.246487 2025] [:error] [pid 28405:tid 28422] [client 63.135.161.58:61533] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Dec 24 10:50:55.471913 2025] [:error] [pid 28405:tid 28430] [client 63.135.161.58:61533] [client 63.135.161.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUtVD8KkTWlhmfdXFqbroAAAAVQ"]
[Wed Dec 24 10:50:56.142231 2025] [:error] [pid 29371:tid 29385] [client 63.135.161.49:60817] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Dec 24 10:50:57.324759 2025] [:error] [pid 29371:tid 29396] [client 63.135.161.49:60817] [client 63.135.161.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUtVEXs-DlKLysSq5L8WXAAAAdc"]
[Wed Dec 24 10:51:04.182394 2025] [:error] [pid 16466:tid 16476] [client 104.234.53.208:41761] [client 104.234.53.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUtVGLu0JcuKJMjJn6zEqgAAAAY"]
[Wed Dec 24 10:51:04.602547 2025] [:error] [pid 28777:tid 28801] [client 104.234.53.211:49713] [client 104.234.53.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUtVGJBVBcZ34cSqz8rErwAAAZY"]
[Wed Dec 24 10:51:05.033201 2025] [:error] [pid 54139:tid 54149] [client 63.135.161.57:26001] [client 63.135.161.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUtVGcrYCZenIDzgXuIDHgAAAQg"]
[Wed Dec 24 10:51:05.473297 2025] [:error] [pid 16550:tid 16567] [client 63.135.161.52:48315] [client 63.135.161.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUtVGaYYcdD-LuO7vrBtlgAAAM8"]
[Wed Dec 24 10:51:05.928324 2025] [:error] [pid 28405:tid 28430] [client 63.135.161.68:37069] [client 63.135.161.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUtVGcKkTWlhmfdXFqbsKgAAAVQ"]
[Wed Dec 24 10:51:06.621057 2025] [:error] [pid 28777:tid 28800] [client 104.234.53.212:31323] [client 104.234.53.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUtVGpBVBcZ34cSqz8rEzAAAAZU"]
[Wed Dec 24 10:51:07.050883 2025] [:error] [pid 16468:tid 16538] [client 104.234.53.210:65079] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Dec 24 10:51:07.520331 2025] [:error] [pid 16468:tid 16544] [client 104.234.53.210:65079] [client 104.234.53.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aUtVG4dyfuSTFLkCbP8l-AAAAJQ"]
[Wed Dec 24 10:51:08.386624 2025] [:error] [pid 28777:tid 28800] [client 104.234.53.224:60235] [client 104.234.53.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUtVHJBVBcZ34cSqz8rE2AAAAZU"]
[Wed Dec 24 10:51:09.069454 2025] [:error] [pid 16467:tid 16514] [client 63.135.161.66:40235] [client 63.135.161.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUtVHY0TJMcBxX5slgripgAAAFE"]
[Wed Dec 24 10:51:09.508276 2025] [:error] [pid 16468:tid 16539] [client 104.234.53.211:39733] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Dec 24 10:51:09.722215 2025] [:error] [pid 16468:tid 16543] [client 104.234.53.211:39733] [client 104.234.53.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUtVHYdyfuSTFLkCbP8mIwAAAJM"]
[Wed Dec 24 10:51:10.165405 2025] [:error] [pid 29371:tid 29395] [client 63.135.161.65:50625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Dec 24 10:51:10.650422 2025] [:error] [pid 29371:tid 29376] [client 63.135.161.65:50625] [client 63.135.161.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/upload/css.php"] [unique_id "aUtVHns-DlKLysSq5L8XsQAAAcM"]
[Wed Dec 24 10:51:11.357908 2025] [:error] [pid 16467:tid 16502] [client 63.135.161.67:20191] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Dec 24 10:51:12.041379 2025] [:error] [pid 16467:tid 16505] [client 63.135.161.67:20191] [client 63.135.161.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUtVII0TJMcBxX5slgrizwAAAEg"]
[Wed Dec 24 10:51:12.485013 2025] [:error] [pid 28405:tid 28433] [client 63.135.161.58:49263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Dec 24 10:51:12.710277 2025] [:error] [pid 28405:tid 28423] [client 63.135.161.58:49263] [client 63.135.161.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUtVIMKkTWlhmfdXFqbskQAAAU0"]
[Wed Dec 24 10:51:13.162025 2025] [:error] [pid 28777:tid 28793] [client 63.135.161.72:52573] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Dec 24 10:51:13.650314 2025] [:error] [pid 28777:tid 28801] [client 63.135.161.72:52573] [client 63.135.161.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUtVIZBVBcZ34cSqz8rFIwAAAZY"]
[Wed Dec 24 10:51:14.328963 2025] [:error] [pid 16467:tid 16508] [client 104.234.53.219:33247] [client 104.234.53.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUtVIo0TJMcBxX5slgri_QAAAEs"]
[Wed Dec 24 10:51:14.972641 2025] [:error] [pid 28405:tid 28432] [client 104.234.53.214:43577] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Dec 24 10:51:15.211227 2025] [:error] [pid 28405:tid 28413] [client 104.234.53.214:43577] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Dec 24 10:51:15.638162 2025] [:error] [pid 28405:tid 28413] [client 104.234.53.214:43577] [client 104.234.53.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUtVI8KkTWlhmfdXFqbs0wAAAUQ"]
[Wed Dec 24 10:51:16.325363 2025] [:error] [pid 28777:tid 28803] [client 63.135.161.76:29707] [client 63.135.161.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUtVJJBVBcZ34cSqz8rFSwAAAZg"]
[Wed Dec 24 10:51:17.010995 2025] [:error] [pid 16466:tid 16477] [client 63.135.161.48:37135] [client 63.135.161.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUtVJbu0JcuKJMjJn6zFkwAAAAc"]
[Wed Dec 24 10:51:17.489429 2025] [:error] [pid 28777:tid 28794] [client 104.234.53.211:52313] [client 104.234.53.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUtVJZBVBcZ34cSqz8rFYQAAAY8"]
[Wed Dec 24 10:51:17.919411 2025] [:error] [pid 16466:tid 16493] [client 63.135.161.66:61695] [client 63.135.161.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUtVJbu0JcuKJMjJn6zFoAAAABc"]
[Wed Dec 24 10:51:18.838808 2025] [:error] [pid 16467:tid 16498] [client 63.135.161.52:28109] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Dec 24 10:51:19.059127 2025] [:error] [pid 16467:tid 16506] [client 63.135.161.52:28109] [client 63.135.161.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aUtVJ40TJMcBxX5slgrjdgAAAEk"]
[Wed Dec 24 10:51:19.517400 2025] [:error] [pid 16467:tid 16500] [client 104.234.53.222:32059] [client 104.234.53.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aUtVJ40TJMcBxX5slgrjggAAAEM"]
[Wed Dec 24 10:51:20.008402 2025] [:error] [pid 29371:tid 29388] [client 63.135.161.62:20205] [client 63.135.161.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUtVKHs-DlKLysSq5L8YbgAAAc8"]
[Wed Dec 24 10:51:20.913223 2025] [:error] [pid 16550:tid 16562] [client 104.234.53.210:45625] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Dec 24 10:51:21.384327 2025] [:error] [pid 16550:tid 16575] [client 104.234.53.210:45625] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Dec 24 10:51:22.255035 2025] [:error] [pid 16550:tid 16555] [client 104.234.53.210:45625] [client 104.234.53.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aUtVKqYYcdD-LuO7vrBwAwAAAMM"]
[Wed Dec 24 10:51:23.394520 2025] [:error] [pid 16550:tid 16566] [client 63.135.161.48:39513] [client 63.135.161.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.48, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUtVK6YYcdD-LuO7vrBwJAAAAM4"]
[Wed Dec 24 10:51:23.646477 2025] [:error] [pid 16550:tid 16553] [client 63.135.161.48:39513] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Dec 24 10:51:24.803020 2025] [:error] [pid 16550:tid 16568] [client 63.135.161.48:39513] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Dec 24 10:51:25.026533 2025] [:error] [pid 16550:tid 16556] [client 63.135.161.48:39513] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Dec 24 10:51:26.176761 2025] [:error] [pid 16550:tid 16571] [client 63.135.161.48:39513] [client 63.135.161.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUtVLqYYcdD-LuO7vrBwXQAAANM"]
[Wed Dec 24 10:51:26.829587 2025] [:error] [pid 54139:tid 54141] [client 104.234.53.225:35287] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Dec 24 10:51:27.049080 2025] [:error] [pid 54139:tid 54149] [client 104.234.53.225:35287] [client 104.234.53.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.225, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUtVL8rYCZenIDzgXuIFJAAAAQg"]
[Wed Dec 24 10:51:27.506368 2025] [:error] [pid 54139:tid 54159] [client 104.234.53.225:35287] [client 104.234.53.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aUtVL8rYCZenIDzgXuIFMgAAARI"]
[Wed Dec 24 10:51:28.910123 2025] [:error] [pid 16550:tid 16568] [client 63.135.161.47:63091] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Dec 24 10:51:29.365174 2025] [:error] [pid 16550:tid 16571] [client 63.135.161.47:63091] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Wed Dec 24 10:51:29.847308 2025] [:error] [pid 16550:tid 16554] [client 63.135.161.47:63091] [client 63.135.161.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUtVMaYYcdD-LuO7vrBwmAAAAMI"]
[Wed Dec 24 10:51:30.356835 2025] [:error] [pid 16466:tid 16487] [client 63.135.161.51:38071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Dec 24 10:51:33.243021 2025] [:error] [pid 16466:tid 16485] [client 63.135.161.51:38071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Dec 24 10:51:33.795911 2025] [:error] [pid 16466:tid 16487] [client 63.135.161.51:38071] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Dec 24 10:51:34.330820 2025] [:error] [pid 16466:tid 16471] [client 63.135.161.51:38071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Dec 24 10:51:34.562419 2025] [:error] [pid 16466:tid 16470] [client 63.135.161.51:38071] [client 63.135.161.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUtVNru0JcuKJMjJn6zGlwAAAAA"]
[Wed Dec 24 10:51:35.016160 2025] [:error] [pid 28405:tid 28424] [client 104.234.53.222:47421] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Dec 24 10:51:35.236476 2025] [:error] [pid 28405:tid 28410] [client 104.234.53.222:47421] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Dec 24 10:51:35.520623 2025] [:error] [pid 28405:tid 28419] [client 104.234.53.222:47421] [client 104.234.53.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUtVN8KkTWlhmfdXFqbuSgAAAUk"]
[Wed Dec 24 10:51:36.304757 2025] [:error] [pid 54139:tid 54164] [client 104.234.53.222:51391] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Dec 24 10:51:36.736602 2025] [:error] [pid 54139:tid 54161] [client 104.234.53.222:51391] [client 104.234.53.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.222, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUtVOMrYCZenIDzgXuIF4AAAARQ"]
[Wed Dec 24 10:51:36.958423 2025] [:error] [pid 54139:tid 54151] [client 104.234.53.222:51391] [client 104.234.53.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUtVOMrYCZenIDzgXuIF5AAAAQo"]
[Wed Dec 24 10:51:39.911385 2025] [:error] [pid 16550:tid 16572] [client 63.135.161.61:24491] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Dec 24 10:51:41.384344 2025] [:error] [pid 16550:tid 16562] [client 63.135.161.61:24491] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Dec 24 10:51:41.620959 2025] [:error] [pid 16550:tid 16573] [client 63.135.161.61:24491] [client 63.135.161.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUtVPaYYcdD-LuO7vrBxgAAAANU"]
[Wed Dec 24 10:51:42.056288 2025] [:error] [pid 16466:tid 16490] [client 104.234.53.222:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Dec 24 10:51:42.744482 2025] [:error] [pid 16466:tid 16472] [client 104.234.53.222:33107] [client 104.234.53.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.222, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUtVPru0JcuKJMjJn6zHDAAAAAI"]
[Wed Dec 24 10:51:43.011874 2025] [:error] [pid 16466:tid 16479] [client 104.234.53.222:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Dec 24 10:51:43.231445 2025] [:error] [pid 16466:tid 16482] [client 104.234.53.222:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Dec 24 10:51:43.448592 2025] [:error] [pid 16466:tid 16485] [client 104.234.53.222:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Dec 24 10:51:43.711278 2025] [:error] [pid 16466:tid 16471] [client 104.234.53.222:33107] [client 104.234.53.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUtVP7u0JcuKJMjJn6zHIAAAAAE"]
[Wed Dec 24 10:51:44.215508 2025] [:error] [pid 29371:tid 29385] [client 104.234.53.213:25039] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Dec 24 10:51:44.429308 2025] [:error] [pid 29371:tid 29390] [client 104.234.53.213:25039] [client 104.234.53.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aUtVQHs-DlKLysSq5L8aVwAAAdE"]
[Wed Dec 24 10:51:45.066618 2025] [:error] [pid 29371:tid 29379] [client 104.234.53.207:58535] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Dec 24 10:51:45.308420 2025] [:error] [pid 29371:tid 29389] [client 104.234.53.207:58535] [client 104.234.53.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUtVQXs-DlKLysSq5L8aZwAAAdA"]
[Wed Dec 24 10:51:46.226959 2025] [:error] [pid 29371:tid 29391] [client 63.135.161.59:53599] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Dec 24 10:51:46.451302 2025] [:error] [pid 29371:tid 29394] [client 63.135.161.59:53599] [client 63.135.161.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUtVQns-DlKLysSq5L8agwAAAdU"]
[Wed Dec 24 10:51:46.953627 2025] [:error] [pid 28777:tid 28792] [client 63.135.161.62:51319] [client 63.135.161.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUtVQpBVBcZ34cSqz8rHqQAAAY0"]
[Wed Dec 24 10:51:47.393339 2025] [:error] [pid 16466:tid 16487] [client 63.135.161.62:59393] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Dec 24 10:51:47.615608 2025] [:error] [pid 16466:tid 16492] [client 63.135.161.62:59393] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Wed Dec 24 10:51:48.536483 2025] [:error] [pid 16466:tid 16472] [client 63.135.161.62:59393] [client 63.135.161.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUtVRLu0JcuKJMjJn6zHmQAAAAI"]
[Wed Dec 24 10:51:49.215659 2025] [:error] [pid 54139:tid 54153] [client 104.234.53.220:40355] [client 104.234.53.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUtVRcrYCZenIDzgXuIG1QAAAQw"]
[Wed Dec 24 10:51:54.308891 2025] [:error] [pid 28405:tid 28433] [client 63.135.161.45:54647] [client 63.135.161.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aUtVSsKkTWlhmfdXFqbvvwAAAVc"]
[Wed Dec 24 10:51:54.766206 2025] [:error] [pid 28405:tid 28409] [client 63.135.161.68:41617] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Dec 24 10:51:55.235459 2025] [:error] [pid 28405:tid 28420] [client 63.135.161.68:41617] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Dec 24 10:51:55.475472 2025] [:error] [pid 28405:tid 28419] [client 63.135.161.68:41617] [client 63.135.161.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aUtVS8KkTWlhmfdXFqbv0AAAAUk"]
[Wed Dec 24 10:51:55.939311 2025] [:error] [pid 29371:tid 29376] [client 63.135.161.51:39707] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Dec 24 10:51:56.393570 2025] [:error] [pid 29371:tid 29397] [client 63.135.161.51:39707] [client 63.135.161.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aUtVTHs-DlKLysSq5L8bNAAAAdg"]
[Wed Dec 24 10:51:57.644204 2025] [:error] [pid 16550:tid 16554] [client 63.135.161.47:33391] [client 63.135.161.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aUtVTaYYcdD-LuO7vrByxQAAAMI"]
[Wed Dec 24 10:51:58.413621 2025] [:error] [pid 16466:tid 16494] [client 63.135.161.74:33421] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Dec 24 10:51:59.240864 2025] [:error] [pid 16466:tid 16494] [client 63.135.161.74:33421] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Dec 24 10:51:59.711315 2025] [:error] [pid 16466:tid 16471] [client 63.135.161.74:33421] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Dec 24 10:51:59.932294 2025] [:error] [pid 16466:tid 16474] [client 63.135.161.74:33421] [client 63.135.161.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aUtVT7u0JcuKJMjJn6zInwAAAAQ"]
[Wed Dec 24 10:52:00.396147 2025] [:error] [pid 16468:tid 16545] [client 63.135.161.51:32419] [client 63.135.161.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aUtVUIdyfuSTFLkCbP8qfgAAAJU"]
[Wed Dec 24 10:52:00.881080 2025] [:error] [pid 16467:tid 16503] [client 63.135.161.54:44735] [client 63.135.161.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aUtVUI0TJMcBxX5slgrm1QAAAEY"]
[Wed Dec 24 10:52:01.361864 2025] [:error] [pid 16550:tid 16560] [client 63.135.161.63:62415] [client 63.135.161.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aUtVUaYYcdD-LuO7vrBzFgAAAMg"]
[Wed Dec 24 10:52:01.846930 2025] [:error] [pid 29371:tid 29397] [client 63.135.161.54:29697] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Wed Dec 24 10:52:02.073459 2025] [:error] [pid 29371:tid 29378] [client 63.135.161.54:29697] [client 63.135.161.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aUtVUns-DlKLysSq5L8b3wAAAcU"]
[Wed Dec 24 10:52:02.506346 2025] [:error] [pid 16467:tid 16520] [client 104.234.53.223:42469] [client 104.234.53.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUtVUo0TJMcBxX5slgrm6gAAAFc"]
[Wed Dec 24 10:52:02.993393 2025] [:error] [pid 16550:tid 16553] [client 63.135.161.70:26607] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Dec 24 10:52:03.445969 2025] [:error] [pid 16550:tid 16566] [client 63.135.161.70:26607] [client 63.135.161.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aUtVU6YYcdD-LuO7vrBzWAAAAM4"]
[Wed Dec 24 10:52:03.984027 2025] [:error] [pid 16550:tid 16565] [client 63.135.161.73:46127] [client 63.135.161.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUtVU6YYcdD-LuO7vrBzaAAAAM0"]
[Wed Dec 24 10:52:04.456518 2025] [:error] [pid 16466:tid 16481] [client 63.135.161.75:53409] [client 63.135.161.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aUtVVLu0JcuKJMjJn6zI-QAAAAs"]
[Wed Dec 24 10:52:04.894882 2025] [:error] [pid 28405:tid 28434] [client 104.234.53.216:35915] [client 104.234.53.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aUtVVMKkTWlhmfdXFqbwdgAAAVg"]
[Wed Dec 24 10:52:05.583056 2025] [:error] [pid 16467:tid 16503] [client 104.234.53.219:39207] [client 104.234.53.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aUtVVY0TJMcBxX5slgrnFwAAAEY"]
[Wed Dec 24 10:52:06.530313 2025] [:error] [pid 16550:tid 16575] [client 63.135.161.58:38063] [client 63.135.161.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aUtVVqYYcdD-LuO7vrBztQAAANc"]
[Wed Dec 24 10:52:10.927717 2025] [:error] [pid 54139:tid 54145] [client 63.135.161.75:58411] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Dec 24 10:52:11.622752 2025] [:error] [pid 54139:tid 54165] [client 63.135.161.75:58411] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Dec 24 10:52:11.844451 2025] [:error] [pid 54139:tid 54143] [client 63.135.161.75:58411] [client 63.135.161.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aUtVW8rYCZenIDzgXuIIbAAAAQI"]
[Wed Dec 24 10:52:12.522623 2025] [:error] [pid 28405:tid 28420] [client 104.234.53.212:37245] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Wed Dec 24 10:52:12.737420 2025] [:error] [pid 28405:tid 28427] [client 104.234.53.212:37245] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Wed Dec 24 10:52:13.893072 2025] [:error] [pid 28405:tid 28432] [client 104.234.53.212:37245] [client 104.234.53.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aUtVXcKkTWlhmfdXFqbxFAAAAVY"]
[Wed Dec 24 10:52:15.034597 2025] [:error] [pid 54139:tid 54148] [client 63.135.161.64:52379] [client 63.135.161.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aUtVX8rYCZenIDzgXuIIngAAAQc"]
[Wed Dec 24 10:52:16.477535 2025] [:error] [pid 16467:tid 16511] [client 104.234.53.224:28203] [client 104.234.53.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aUtVYI0TJMcBxX5slgrnyQAAAE4"]
[Wed Dec 24 10:52:17.848468 2025] [:error] [pid 28405:tid 28410] [client 63.135.161.52:46603] [client 63.135.161.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUtVYcKkTWlhmfdXFqbxYwAAAUE"]
[Wed Dec 24 10:52:18.721758 2025] [:error] [pid 16466:tid 16489] [client 104.234.53.210:20627] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Dec 24 10:52:18.936766 2025] [:error] [pid 16466:tid 16479] [client 104.234.53.210:20627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Wed Dec 24 10:52:19.150499 2025] [:error] [pid 16466:tid 16482] [client 104.234.53.210:20627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Wed Dec 24 10:52:19.370048 2025] [:error] [pid 16466:tid 16484] [client 104.234.53.210:20627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Wed Dec 24 10:52:20.498962 2025] [:error] [pid 16466:tid 16491] [client 104.234.53.210:20627] [client 104.234.53.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUtVZLu0JcuKJMjJn6zJ6AAAABU"]
[Wed Dec 24 10:52:20.933332 2025] [:error] [pid 16468:tid 16548] [client 63.135.161.47:62539] [client 63.135.161.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aUtVZIdyfuSTFLkCbP8sCAAAAJg"]
[Wed Dec 24 10:52:21.397656 2025] [:error] [pid 28405:tid 28425] [client 104.234.53.217:56621] [client 104.234.53.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aUtVZcKkTWlhmfdXFqbxtgAAAU8"]
[Wed Dec 24 10:52:22.851936 2025] [:error] [pid 28405:tid 28428] [client 63.135.161.69:42067] [client 63.135.161.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aUtVZsKkTWlhmfdXFqbx0wAAAVI"]
[Wed Dec 24 10:52:24.325170 2025] [:error] [pid 29371:tid 29397] [client 63.135.161.53:27833] [client 63.135.161.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aUtVaHs-DlKLysSq5L8eAwAAAdg"]
[Wed Dec 24 16:17:40.625351 2025] [:error] [pid 54139:tid 54154] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Wed Dec 24 16:17:40.768628 2025] [:error] [pid 54139:tid 54162] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Wed Dec 24 16:17:41.076482 2025] [:error] [pid 54139:tid 54161] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Wed Dec 24 16:17:41.227962 2025] [:error] [pid 54139:tid 54152] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Wed Dec 24 16:17:41.380981 2025] [:error] [pid 54139:tid 54148] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/tebar.php
[Wed Dec 24 16:17:41.533961 2025] [:error] [pid 54139:tid 54149] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/ty226.php
[Wed Dec 24 16:17:41.741144 2025] [:error] [pid 54139:tid 54158] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/songsa.php
[Wed Dec 24 16:17:41.898704 2025] [:error] [pid 54139:tid 54144] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/qing2.php
[Wed Dec 24 16:17:42.141020 2025] [:error] [pid 54139:tid 54153] [client 104.215.51.146:32647] File does not exist: /usr/local/apache/htdocs/suspended-page/massby2.php
[Wed Dec 24 16:17:42.345630 2025] [:error] [pid 54139:tid 54147] [client 104.215.51.146:32647] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qual.php"] [unique_id "aUuhpsrYCZenIDzgXuJxOAAAAQY"]
[Wed Dec 24 16:17:42.834593 2025] [:error] [pid 29371:tid 29390] [client 104.215.51.146:50327] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qual.php"] [unique_id "aUuhpns-DlKLysSq5L9yGAAAAdE"]
[Wed Dec 24 16:17:43.356267 2025] [:error] [pid 29371:tid 29394] [client 104.215.51.146:45686] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qual.php"] [unique_id "aUuhp3s-DlKLysSq5L9yGQAAAdU"]
[Wed Dec 24 16:17:43.821732 2025] [:error] [pid 29371:tid 29397] [client 104.215.51.146:45054] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qual.php"] [unique_id "aUuhp3s-DlKLysSq5L9yHAAAAdg"]
[Wed Dec 24 16:17:44.331933 2025] [:error] [pid 29371:tid 29387] [client 104.215.51.146:32427] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/udnkq.php"] [unique_id "aUuhqHs-DlKLysSq5L9yHQAAAc4"]
[Wed Dec 24 16:17:44.909611 2025] [:error] [pid 16466:tid 16492] [client 104.215.51.146:36170] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/udnkq.php"] [unique_id "aUuhqLu0JcuKJMjJn6wIIgAAABY"]
[Wed Dec 24 16:17:45.914930 2025] [:error] [pid 16466:tid 16491] [client 104.215.51.146:4564] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/udnkq.php"] [unique_id "aUuhqbu0JcuKJMjJn6wIIwAAABU"]
[Wed Dec 24 16:17:46.974328 2025] [:error] [pid 16468:tid 16535] [client 104.215.51.146:36186] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/udnkq.php"] [unique_id "aUuhqodyfuSTFLkCbP9tkAAAAIs"]
[Wed Dec 24 16:17:47.336131 2025] [:error] [pid 28405:tid 28422] [client 104.215.51.146:31393] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aUuhq8KkTWlhmfdXFqY2OAAAAUw"]
[Wed Dec 24 16:17:47.905167 2025] [:error] [pid 54139:tid 54157] [client 104.215.51.146:46202] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aUuhq8rYCZenIDzgXuJxOgAAARA"]
[Wed Dec 24 16:17:48.643085 2025] [:error] [pid 29371:tid 29377] [client 104.215.51.146:43755] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aUuhrHs-DlKLysSq5L9yIwAAAcQ"]
[Wed Dec 24 16:17:49.098568 2025] [:error] [pid 16550:tid 16576] [client 104.215.51.146:32389] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aUuhraYYcdD-LuO7vrDWOgAAANg"]
[Wed Dec 24 16:17:49.556797 2025] [:error] [pid 54139:tid 54145] [client 104.215.51.146:43760] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z4qmm5.php"] [unique_id "aUuhrcrYCZenIDzgXuJxOwAAAQQ"]
[Wed Dec 24 16:17:50.068749 2025] [:error] [pid 16467:tid 16520] [client 104.215.51.146:46185] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z4qmm5.php"] [unique_id "aUuhro0TJMcBxX5slgooiwAAAFc"]
[Wed Dec 24 16:17:50.944484 2025] [:error] [pid 28405:tid 28414] [client 104.215.51.146:45023] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z4qmm5.php"] [unique_id "aUuhrsKkTWlhmfdXFqY2OwAAAUU"]
[Wed Dec 24 16:17:51.426657 2025] [:error] [pid 16468:tid 16543] [client 104.215.51.146:45035] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z4qmm5.php"] [unique_id "aUuhr4dyfuSTFLkCbP9tkwAAAJM"]
[Wed Dec 24 16:17:51.777758 2025] [:error] [pid 28405:tid 28429] [client 104.215.51.146:28614] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no3.php"] [unique_id "aUuhr8KkTWlhmfdXFqY2PQAAAVM"]
[Wed Dec 24 16:17:52.141576 2025] [:error] [pid 16550:tid 16572] [client 104.215.51.146:43728] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no3.php"] [unique_id "aUuhsKYYcdD-LuO7vrDWPQAAANQ"]
[Wed Dec 24 16:17:52.523407 2025] [:error] [pid 54139:tid 54154] [client 104.215.51.146:46144] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no3.php"] [unique_id "aUuhsMrYCZenIDzgXuJxPAAAAQ0"]
[Wed Dec 24 16:17:52.993261 2025] [:error] [pid 29371:tid 29396] [client 104.215.51.146:32432] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no3.php"] [unique_id "aUuhsHs-DlKLysSq5L9yJgAAAdc"]
[Wed Dec 24 16:17:53.537692 2025] [:error] [pid 29371:tid 29387] [client 104.215.51.146:45037] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "aUuhsXs-DlKLysSq5L9yKAAAAc4"]
[Wed Dec 24 16:17:53.883449 2025] [:error] [pid 28405:tid 28431] [client 104.215.51.146:52560] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "aUuhscKkTWlhmfdXFqY2QgAAAVU"]
[Wed Dec 24 16:17:54.364207 2025] [:error] [pid 16468:tid 16534] [client 104.215.51.146:38090] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "aUuhsodyfuSTFLkCbP9tlwAAAIo"]
[Wed Dec 24 16:17:54.950064 2025] [:error] [pid 16467:tid 16513] [client 104.215.51.146:52544] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "aUuhso0TJMcBxX5slgoomAAAAFA"]
[Wed Dec 24 16:17:55.578143 2025] [:error] [pid 16468:tid 16547] [client 104.215.51.146:31401] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aUuhs4dyfuSTFLkCbP9tqwAAAJc"]
[Wed Dec 24 16:17:55.901958 2025] [:error] [pid 54139:tid 54149] [client 104.215.51.146:27811] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aUuhs8rYCZenIDzgXuJxWQAAAQg"]
[Wed Dec 24 16:17:56.323260 2025] [:error] [pid 16466:tid 16480] [client 104.215.51.146:27790] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aUuhtLu0JcuKJMjJn6wIOgAAAAo"]
[Wed Dec 24 16:17:56.745391 2025] [:error] [pid 54139:tid 54150] [client 104.215.51.146:36164] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aUuhtMrYCZenIDzgXuJxWwAAAQk"]
[Wed Dec 24 16:17:57.410102 2025] [:error] [pid 54139:tid 54153] [client 104.215.51.146:45030] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUuhtcrYCZenIDzgXuJxXAAAAQw"]
[Wed Dec 24 16:17:57.968453 2025] [:error] [pid 54139:tid 54156] [client 104.215.51.146:32006] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUuhtcrYCZenIDzgXuJxXwAAAQ8"]
[Wed Dec 24 16:17:58.689181 2025] [:error] [pid 28405:tid 28432] [client 104.215.51.146:32060] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUuhtsKkTWlhmfdXFqY2ZgAAAVY"]
[Wed Dec 24 16:17:59.139985 2025] [:error] [pid 16467:tid 16497] [client 104.215.51.146:45107] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aUuht40TJMcBxX5slgoooQAAAEA"]
[Wed Dec 24 16:17:59.529985 2025] [:error] [pid 28777:tid 28788] [client 104.215.51.146:31313] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cka.php"] [unique_id "aUuht5BVBcZ34cSqz8oVMwAAAYk"]
[Wed Dec 24 16:18:00.135978 2025] [:error] [pid 16468:tid 16531] [client 104.215.51.146:36831] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cka.php"] [unique_id "aUuhuIdyfuSTFLkCbP9ttAAAAIc"]
[Wed Dec 24 16:18:00.999609 2025] [:error] [pid 28405:tid 28413] [client 104.215.51.146:31315] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cka.php"] [unique_id "aUuhuMKkTWlhmfdXFqY2bQAAAUQ"]
[Wed Dec 24 16:18:02.088366 2025] [:error] [pid 16468:tid 16528] [client 104.215.51.146:45116] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cka.php"] [unique_id "aUuhuodyfuSTFLkCbP9tugAAAIQ"]
[Wed Dec 24 16:18:02.482093 2025] [:error] [pid 54139:tid 54141] [client 104.215.51.146:31329] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUuhusrYCZenIDzgXuJxagAAAQA"]
[Wed Dec 24 16:18:03.091720 2025] [:error] [pid 16467:tid 16510] [client 104.215.51.146:32051] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUuhu40TJMcBxX5slgoopQAAAE0"]
[Wed Dec 24 16:18:03.721402 2025] [:error] [pid 54139:tid 54154] [client 104.215.51.146:31364] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUuhu8rYCZenIDzgXuJxbAAAAQ0"]
[Wed Dec 24 16:18:04.228014 2025] [:error] [pid 29371:tid 29393] [client 104.215.51.146:36853] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aUuhvHs-DlKLysSq5L9yRwAAAdQ"]
[Wed Dec 24 16:18:04.789719 2025] [:error] [pid 54139:tid 54142] [client 104.215.51.146:39200] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUuhvMrYCZenIDzgXuJxbgAAAQE"]
[Wed Dec 24 16:18:05.277823 2025] [:error] [pid 28777:tid 28781] [client 104.215.51.146:34589] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUuhvZBVBcZ34cSqz8oVPAAAAYI"]
[Wed Dec 24 16:18:06.687880 2025] [:error] [pid 28405:tid 28417] [client 104.215.51.146:39217] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUuhvsKkTWlhmfdXFqY2cwAAAUg"]
[Wed Dec 24 16:18:07.552405 2025] [:error] [pid 16468:tid 16540] [client 104.215.51.146:38024] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aUuhv4dyfuSTFLkCbP9tvwAAAJA"]
[Wed Dec 24 16:18:08.029290 2025] [:error] [pid 16468:tid 16532] [client 104.215.51.146:34593] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUuhwIdyfuSTFLkCbP9twAAAAIg"]
[Wed Dec 24 16:18:08.668266 2025] [:error] [pid 16468:tid 16541] [client 104.215.51.146:45117] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUuhwIdyfuSTFLkCbP9twwAAAJE"]
[Wed Dec 24 16:18:09.143179 2025] [:error] [pid 28777:tid 28790] [client 104.215.51.146:34606] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUuhwZBVBcZ34cSqz8oVQAAAAYs"]
[Wed Dec 24 16:18:09.575112 2025] [:error] [pid 16467:tid 16503] [client 104.215.51.146:31338] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aUuhwY0TJMcBxX5slgooqgAAAEY"]
[Wed Dec 24 16:18:09.994350 2025] [:error] [pid 54139:tid 54145] [client 104.215.51.146:52547] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUuhwcrYCZenIDzgXuJxewAAAQQ"]
[Wed Dec 24 16:18:10.681524 2025] [:error] [pid 28405:tid 28420] [client 104.215.51.146:34619] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUuhwsKkTWlhmfdXFqY2dwAAAUo"]
[Wed Dec 24 16:18:11.063270 2025] [:error] [pid 16467:tid 16497] [client 104.215.51.146:36136] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUuhw40TJMcBxX5slgoorAAAAEA"]
[Wed Dec 24 16:18:11.499319 2025] [:error] [pid 28777:tid 28785] [client 104.215.51.146:32040] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aUuhw5BVBcZ34cSqz8oVRwAAAYY"]
[Wed Dec 24 16:18:11.876270 2025] [:error] [pid 28777:tid 28793] [client 104.215.51.146:34621] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUuhw5BVBcZ34cSqz8oVTAAAAY4"]
[Wed Dec 24 16:18:12.419649 2025] [:error] [pid 54139:tid 54157] [client 104.215.51.146:38310] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUuhxMrYCZenIDzgXuJxfQAAARA"]
[Wed Dec 24 16:18:12.831985 2025] [:error] [pid 54139:tid 54148] [client 104.215.51.146:36804] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUuhxMrYCZenIDzgXuJxfgAAAQc"]
[Wed Dec 24 16:18:13.320258 2025] [:error] [pid 16468:tid 16537] [client 104.215.51.146:45105] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aUuhxYdyfuSTFLkCbP9txwAAAI0"]
[Wed Dec 24 16:18:14.135020 2025] [:error] [pid 16550:tid 16576] [client 104.215.51.146:38296] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUuhxqYYcdD-LuO7vrDWTwAAANg"]
[Wed Dec 24 16:18:14.631985 2025] [:error] [pid 16550:tid 16571] [client 104.215.51.146:34616] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUuhxqYYcdD-LuO7vrDWUAAAANM"]
[Wed Dec 24 16:18:14.986455 2025] [:error] [pid 28777:tid 28792] [client 104.215.51.146:36843] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUuhxpBVBcZ34cSqz8oVTQAAAY0"]
[Wed Dec 24 16:18:15.497641 2025] [:error] [pid 16466:tid 16485] [client 104.215.51.146:28729] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aUuhx7u0JcuKJMjJn6wISwAAAA8"]
[Wed Dec 24 16:18:15.965601 2025] [:error] [pid 16466:tid 16479] [client 104.215.51.146:44401] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUuhx7u0JcuKJMjJn6wITAAAAAk"]
[Wed Dec 24 16:18:16.962120 2025] [:error] [pid 54139:tid 54146] [client 104.215.51.146:35508] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUuhyMrYCZenIDzgXuJxggAAAQU"]
[Wed Dec 24 16:18:17.615583 2025] [:error] [pid 16550:tid 16553] [client 104.215.51.146:28683] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUuhyaYYcdD-LuO7vrDWUgAAAME"]
[Wed Dec 24 16:18:18.028627 2025] [:error] [pid 54139:tid 54162] [client 104.215.51.146:29171] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aUuhysrYCZenIDzgXuJxhgAAARU"]
[Wed Dec 24 16:18:18.445370 2025] [:error] [pid 16550:tid 16554] [client 104.215.51.146:44400] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUuhyqYYcdD-LuO7vrDWVAAAAMI"]
[Wed Dec 24 16:18:18.868331 2025] [:error] [pid 29371:tid 29395] [client 104.215.51.146:34608] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUuhyns-DlKLysSq5L9yUwAAAdY"]
[Wed Dec 24 16:18:19.446236 2025] [:error] [pid 28405:tid 28414] [client 104.215.51.146:35481] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUuhy8KkTWlhmfdXFqY2fAAAAUU"]
[Wed Dec 24 16:18:19.883153 2025] [:error] [pid 28405:tid 28410] [client 104.215.51.146:35461] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUuhy8KkTWlhmfdXFqY2fQAAAUE"]
[Wed Dec 24 16:18:20.202351 2025] [:error] [pid 28405:tid 28429] [client 104.215.51.146:29145] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUuhzMKkTWlhmfdXFqY2fgAAAVM"]
[Wed Dec 24 16:18:20.535363 2025] [:error] [pid 28777:tid 28788] [client 104.215.51.146:46261] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUuhzJBVBcZ34cSqz8oVUgAAAYk"]
[Wed Dec 24 16:18:20.891957 2025] [:error] [pid 28405:tid 28419] [client 104.215.51.146:44398] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUuhzMKkTWlhmfdXFqY2gQAAAUk"]
[Wed Dec 24 16:18:21.606898 2025] [:error] [pid 16466:tid 16478] [client 104.215.51.146:38311] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aUuhzbu0JcuKJMjJn6wIUgAAAAg"]
[Wed Dec 24 16:18:22.184357 2025] [:error] [pid 16466:tid 16483] [client 104.215.51.146:36107] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUuhzru0JcuKJMjJn6wIUwAAAA0"]
[Wed Dec 24 16:18:22.724831 2025] [:error] [pid 28777:tid 28803] [client 104.215.51.146:29161] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUuhzpBVBcZ34cSqz8oVVQAAAZg"]
[Wed Dec 24 16:18:23.536881 2025] [:error] [pid 16466:tid 16492] [client 104.215.51.146:34560] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUuhz7u0JcuKJMjJn6wIVwAAABY"]
[Wed Dec 24 16:18:24.276339 2025] [:error] [pid 28405:tid 28424] [client 104.215.51.146:33455] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aUuh0MKkTWlhmfdXFqY2iAAAAU4"]
[Wed Dec 24 16:18:25.108400 2025] [:error] [pid 28405:tid 28431] [client 104.215.51.146:33447] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUuh0cKkTWlhmfdXFqY2iwAAAVU"]
[Wed Dec 24 16:18:25.450842 2025] [:error] [pid 16466:tid 16473] [client 104.215.51.146:33467] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUuh0bu0JcuKJMjJn6wIWQAAAAM"]
[Wed Dec 24 16:18:26.027281 2025] [:error] [pid 28405:tid 28432] [client 104.215.51.146:50765] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUuh0sKkTWlhmfdXFqY2jgAAAVY"]
[Wed Dec 24 16:18:26.427741 2025] [:error] [pid 28777:tid 28790] [client 104.215.51.146:50788] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aUuh0pBVBcZ34cSqz8oVWwAAAYs"]
[Wed Dec 24 16:18:26.832279 2025] [:error] [pid 28405:tid 28423] [client 104.215.51.146:34619] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUuh0sKkTWlhmfdXFqY2kgAAAU0"]
[Wed Dec 24 16:18:27.262779 2025] [:error] [pid 16467:tid 16516] [client 104.215.51.146:33408] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUuh040TJMcBxX5slgoouQAAAFM"]
[Wed Dec 24 16:18:27.629250 2025] [:error] [pid 28405:tid 28420] [client 104.215.51.146:33462] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUuh08KkTWlhmfdXFqY2lAAAAUo"]
[Wed Dec 24 16:18:28.093446 2025] [:error] [pid 28777:tid 28780] [client 104.215.51.146:35474] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aUuh1JBVBcZ34cSqz8oVXgAAAYE"]
[Wed Dec 24 16:18:28.679996 2025] [:error] [pid 28405:tid 28434] [client 104.215.51.146:52097] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aUuh1MKkTWlhmfdXFqY2mAAAAVg"]
[Wed Dec 24 16:18:29.331469 2025] [:error] [pid 28405:tid 28419] [client 104.215.51.146:44409] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aUuh1cKkTWlhmfdXFqY2nAAAAUk"]
[Wed Dec 24 16:18:29.740023 2025] [:error] [pid 28777:tid 28800] [client 104.215.51.146:44402] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aUuh1ZBVBcZ34cSqz8oVXwAAAZU"]
[Wed Dec 24 16:18:30.272499 2025] [:error] [pid 16466:tid 16475] [client 104.215.51.146:33419] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aUuh1ru0JcuKJMjJn6wIXQAAAAU"]
[Wed Dec 24 16:18:30.770942 2025] [:error] [pid 16466:tid 16488] [client 104.215.51.146:50756] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUuh1ru0JcuKJMjJn6wIXgAAABI"]
[Wed Dec 24 16:18:31.612885 2025] [:error] [pid 28405:tid 28413] [client 104.215.51.146:31087] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUuh18KkTWlhmfdXFqY2owAAAUQ"]
[Wed Dec 24 16:18:32.467241 2025] [:error] [pid 28405:tid 28431] [client 104.215.51.146:46737] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUuh2MKkTWlhmfdXFqY2pwAAAVU"]
[Wed Dec 24 16:18:32.965074 2025] [:error] [pid 28777:tid 28801] [client 104.215.51.146:29123] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aUuh2JBVBcZ34cSqz8oVYwAAAZY"]
[Wed Dec 24 16:18:33.364138 2025] [:error] [pid 28405:tid 28412] [client 104.215.51.146:50770] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUuh2cKkTWlhmfdXFqY2rAAAAUM"]
[Wed Dec 24 16:18:33.913990 2025] [:error] [pid 28405:tid 28420] [client 104.215.51.146:37339] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUuh2cKkTWlhmfdXFqY2rQAAAUo"]
[Wed Dec 24 16:18:34.342882 2025] [:error] [pid 28405:tid 28434] [client 104.215.51.146:33442] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUuh2sKkTWlhmfdXFqY2rwAAAVg"]
[Wed Dec 24 16:18:34.995508 2025] [:error] [pid 28405:tid 28433] [client 104.215.51.146:4923] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aUuh2sKkTWlhmfdXFqY2sQAAAVc"]
[Wed Dec 24 16:18:35.273763 2025] [:error] [pid 28405:tid 28417] [client 104.215.51.146:52133] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUuh28KkTWlhmfdXFqY2tAAAAUg"]
[Wed Dec 24 16:18:35.681416 2025] [:error] [pid 28405:tid 28427] [client 104.215.51.146:35506] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUuh28KkTWlhmfdXFqY2uAAAAVE"]
[Wed Dec 24 16:18:36.020622 2025] [:error] [pid 28777:tid 28799] [client 104.215.51.146:36698] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUuh3JBVBcZ34cSqz8oVZQAAAZQ"]
[Wed Dec 24 16:18:36.430488 2025] [:error] [pid 28777:tid 28784] [client 104.215.51.146:4916] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aUuh3JBVBcZ34cSqz8oVaAAAAYU"]
[Wed Dec 24 16:18:36.976499 2025] [:error] [pid 28777:tid 28790] [client 104.215.51.146:37370] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUuh3JBVBcZ34cSqz8oVagAAAYs"]
[Wed Dec 24 16:18:37.368695 2025] [:error] [pid 28405:tid 28434] [client 104.215.51.146:64237] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUuh3cKkTWlhmfdXFqY2uwAAAVg"]
[Wed Dec 24 16:18:37.720531 2025] [:error] [pid 28405:tid 28421] [client 104.215.51.146:37353] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUuh3cKkTWlhmfdXFqY2vAAAAUs"]
[Wed Dec 24 16:18:38.108239 2025] [:error] [pid 28777:tid 28795] [client 104.215.51.146:37696] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aUuh3pBVBcZ34cSqz8oVbQAAAZA"]
[Wed Dec 24 16:18:38.491472 2025] [:error] [pid 28405:tid 28431] [client 104.215.51.146:50776] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUuh3sKkTWlhmfdXFqY2wAAAAVU"]
[Wed Dec 24 16:18:38.914180 2025] [:error] [pid 28405:tid 28413] [client 104.215.51.146:4888] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUuh3sKkTWlhmfdXFqY2wwAAAUQ"]
[Wed Dec 24 16:18:39.403720 2025] [:error] [pid 28405:tid 28415] [client 104.215.51.146:37716] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUuh38KkTWlhmfdXFqY2xQAAAUY"]
[Wed Dec 24 16:18:39.834407 2025] [:error] [pid 16550:tid 16574] [client 104.215.51.146:64213] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUuh36YYcdD-LuO7vrDWXAAAANY"]
[Wed Dec 24 16:18:40.397399 2025] [:error] [pid 28405:tid 28433] [client 104.215.51.146:5119] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUuh4MKkTWlhmfdXFqY2yQAAAVc"]
[Wed Dec 24 16:18:40.950340 2025] [:error] [pid 29371:tid 29388] [client 104.215.51.146:31975] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUuh4Hs-DlKLysSq5L9yVAAAAc8"]
[Wed Dec 24 16:18:41.465201 2025] [:error] [pid 16466:tid 16479] [client 104.215.51.146:37741] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUuh4bu0JcuKJMjJn6wIaAAAAAk"]
[Wed Dec 24 16:18:41.919887 2025] [:error] [pid 28777:tid 28784] [client 104.215.51.146:31968] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aUuh4ZBVBcZ34cSqz8oVdQAAAYU"]
[Wed Dec 24 16:18:42.479863 2025] [:error] [pid 16550:tid 16564] [client 104.215.51.146:64241] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Wed Dec 24 16:18:42.635005 2025] [:error] [pid 16550:tid 16554] [client 104.215.51.146:64241] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Wed Dec 24 16:18:42.791299 2025] [:error] [pid 16550:tid 16572] [client 104.215.51.146:64241] File does not exist: /usr/local/apache/htdocs/suspended-page/x56.php
[Wed Dec 24 16:18:43.108594 2025] [:error] [pid 16550:tid 16552] [client 104.215.51.146:64241] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Dec 24 16:18:43.262456 2025] [:error] [pid 16550:tid 16566] [client 104.215.51.146:64241] [client 104.215.51.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aUuh46YYcdD-LuO7vrDWYwAAAM4"]
[Wed Dec 24 16:18:43.631350 2025] [:error] [pid 28405:tid 28415] [client 104.215.51.146:47895] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Dec 24 16:18:43.967560 2025] [:error] [pid 28405:tid 28430] [client 104.215.51.146:47895] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Wed Dec 24 16:18:44.337907 2025] [:error] [pid 28405:tid 28417] [client 104.215.51.146:47895] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Wed Dec 24 16:18:44.488738 2025] [:error] [pid 28405:tid 28409] [client 104.215.51.146:47895] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Wed Dec 24 16:18:44.637893 2025] [:error] [pid 28405:tid 28416] [client 104.215.51.146:47895] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUuh5MKkTWlhmfdXFqY22gAAAUc"]
[Wed Dec 24 16:18:45.257706 2025] [:error] [pid 16550:tid 16562] [client 104.215.51.146:31586] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUuh5aYYcdD-LuO7vrDWZgAAAMo"]
[Wed Dec 24 16:18:45.671564 2025] [:error] [pid 28405:tid 28410] [client 104.215.51.146:31616] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUuh5cKkTWlhmfdXFqY22wAAAUE"]
[Wed Dec 24 16:18:46.052522 2025] [:error] [pid 28405:tid 28429] [client 104.215.51.146:31993] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUuh5sKkTWlhmfdXFqY23gAAAVM"]
[Wed Dec 24 16:18:46.413781 2025] [:error] [pid 16550:tid 16563] [client 104.215.51.146:64271] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUuh5qYYcdD-LuO7vrDWZwAAAMs"]
[Wed Dec 24 16:18:46.883971 2025] [:error] [pid 16466:tid 16480] [client 104.215.51.146:31992] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUuh5ru0JcuKJMjJn6wIcAAAAAo"]
[Wed Dec 24 16:18:47.515964 2025] [:error] [pid 29371:tid 29396] [client 104.215.51.146:5063] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUuh53s-DlKLysSq5L9yVgAAAdc"]
[Wed Dec 24 16:18:48.107006 2025] [:error] [pid 16550:tid 16570] [client 104.215.51.146:31949] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUuh6KYYcdD-LuO7vrDWaQAAANI"]
[Wed Dec 24 16:18:48.499405 2025] [:error] [pid 16468:tid 16531] [client 104.215.51.146:4904] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aUuh6IdyfuSTFLkCbP9tywAAAIc"]
[Wed Dec 24 16:18:48.822032 2025] [:error] [pid 28777:tid 28791] [client 104.215.51.146:5108] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aUuh6JBVBcZ34cSqz8oVeQAAAYw"]
[Wed Dec 24 16:18:49.219407 2025] [:error] [pid 16466:tid 16479] [client 104.215.51.146:5114] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aUuh6bu0JcuKJMjJn6wIcwAAAAk"]
[Wed Dec 24 16:18:49.684390 2025] [:error] [pid 28777:tid 28802] [client 104.215.51.146:4618] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aUuh6ZBVBcZ34cSqz8oVewAAAZc"]
[Wed Dec 24 16:18:50.085820 2025] [:error] [pid 16468:tid 16540] [client 104.215.51.146:4631] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUuh6odyfuSTFLkCbP9tzQAAAJA"]
[Wed Dec 24 16:18:50.640306 2025] [:error] [pid 29371:tid 29374] [client 104.215.51.146:47889] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUuh6ns-DlKLysSq5L9yWQAAAcE"]
[Wed Dec 24 16:18:50.935136 2025] [:error] [pid 29371:tid 29394] [client 104.215.51.146:38673] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUuh6ns-DlKLysSq5L9yWgAAAdU"]
[Wed Dec 24 16:18:51.486780 2025] [:error] [pid 16466:tid 16477] [client 104.215.51.146:38663] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aUuh67u0JcuKJMjJn6wIdgAAAAc"]
[Wed Dec 24 16:18:51.895186 2025] [:error] [pid 16466:tid 16484] [client 104.215.51.146:38746] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUuh67u0JcuKJMjJn6wIeAAAAA4"]
[Wed Dec 24 16:18:52.254512 2025] [:error] [pid 28405:tid 28414] [client 104.215.51.146:4653] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUuh7MKkTWlhmfdXFqY25gAAAUU"]
[Wed Dec 24 16:18:52.604249 2025] [:error] [pid 16466:tid 16483] [client 104.215.51.146:47923] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUuh7Lu0JcuKJMjJn6wIewAAAA0"]
[Wed Dec 24 16:18:53.142646 2025] [:error] [pid 16468:tid 16545] [client 104.215.51.146:52626] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aUuh7YdyfuSTFLkCbP9t0AAAAJU"]
[Wed Dec 24 16:18:53.843981 2025] [:error] [pid 29371:tid 29379] [client 104.215.51.146:48434] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUuh7Xs-DlKLysSq5L9yXwAAAcY"]
[Wed Dec 24 16:18:54.310476 2025] [:error] [pid 29371:tid 29388] [client 104.215.51.146:48433] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUuh7ns-DlKLysSq5L9yYgAAAc8"]
[Wed Dec 24 16:18:54.690387 2025] [:error] [pid 28405:tid 28422] [client 104.215.51.146:38772] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUuh7sKkTWlhmfdXFqY25wAAAUw"]
[Wed Dec 24 16:18:55.240810 2025] [:error] [pid 16466:tid 16480] [client 104.215.51.146:64306] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aUuh77u0JcuKJMjJn6wIfQAAAAo"]
[Wed Dec 24 16:18:55.742317 2025] [:error] [pid 28405:tid 28434] [client 104.215.51.146:48404] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUuh78KkTWlhmfdXFqY26wAAAVg"]
[Wed Dec 24 16:18:59.458254 2025] [:error] [pid 28405:tid 28431] [client 104.215.51.146:4319] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUuh88KkTWlhmfdXFqY29gAAAVU"]
[Wed Dec 24 16:19:00.183171 2025] [:error] [pid 16466:tid 16472] [client 104.215.51.146:49724] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUuh9Lu0JcuKJMjJn6wIfwAAAAI"]
[Wed Dec 24 16:19:00.671266 2025] [:error] [pid 28405:tid 28422] [client 104.215.51.146:38741] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aUuh9MKkTWlhmfdXFqY2-QAAAUw"]
[Wed Dec 24 16:19:01.263917 2025] [:error] [pid 16550:tid 16566] [client 104.215.51.146:64311] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUuh9aYYcdD-LuO7vrDWcAAAAM4"]
[Wed Dec 24 16:19:01.806836 2025] [:error] [pid 28405:tid 28413] [client 104.215.51.146:4302] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUuh9cKkTWlhmfdXFqY2-wAAAUQ"]
[Wed Dec 24 16:19:02.355370 2025] [:error] [pid 28405:tid 28430] [client 104.215.51.146:64312] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUuh9sKkTWlhmfdXFqY3AAAAAVQ"]
[Wed Dec 24 16:19:02.886893 2025] [:error] [pid 16468:tid 16537] [client 104.215.51.146:49689] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aUuh9odyfuSTFLkCbP9t0gAAAI0"]
[Wed Dec 24 16:19:03.330891 2025] [:error] [pid 16466:tid 16490] [client 104.215.51.146:48388] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUuh97u0JcuKJMjJn6wIgAAAABQ"]
[Wed Dec 24 16:19:03.947966 2025] [:error] [pid 16467:tid 16509] [client 104.215.51.146:4628] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUuh940TJMcBxX5slgoowgAAAEw"]
[Wed Dec 24 16:19:04.401113 2025] [:error] [pid 16468:tid 16533] [client 104.215.51.146:48390] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUuh-IdyfuSTFLkCbP9t1AAAAIk"]
[Wed Dec 24 16:19:05.006203 2025] [:error] [pid 16468:tid 16528] [client 104.215.51.146:31605] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aUuh-YdyfuSTFLkCbP9t1QAAAIQ"]
[Wed Dec 24 16:19:05.633144 2025] [:error] [pid 28405:tid 28410] [client 104.215.51.146:31601] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aUuh-cKkTWlhmfdXFqY3BgAAAUE"]
[Wed Dec 24 16:19:06.300296 2025] [:error] [pid 16467:tid 16500] [client 104.215.51.146:64304] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aUuh-o0TJMcBxX5slgooxAAAAEM"]
[Wed Dec 24 16:19:06.741984 2025] [:error] [pid 28405:tid 28434] [client 104.215.51.146:49602] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aUuh-sKkTWlhmfdXFqY3CQAAAVg"]
[Wed Dec 24 16:19:07.125204 2025] [:error] [pid 16467:tid 16507] [client 104.215.51.146:49641] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aUuh-40TJMcBxX5slgooxQAAAEo"]
[Wed Dec 24 16:19:07.544897 2025] [:error] [pid 28405:tid 28413] [client 104.215.51.146:4475] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUuh-8KkTWlhmfdXFqY3CgAAAUQ"]
[Wed Dec 24 16:19:08.018996 2025] [:error] [pid 16550:tid 16569] [client 104.215.51.146:64318] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUuh_KYYcdD-LuO7vrDWdAAAANE"]
[Wed Dec 24 16:19:08.873845 2025] [:error] [pid 54139:tid 54165] [client 104.215.51.146:51489] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUuh_MrYCZenIDzgXuJxlQAAARg"]
[Wed Dec 24 16:19:09.464828 2025] [:error] [pid 16468:tid 16534] [client 104.215.51.146:4644] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aUuh_YdyfuSTFLkCbP9t2AAAAIo"]
[Wed Dec 24 16:19:09.886183 2025] [:error] [pid 29371:tid 29389] [client 104.215.51.146:31594] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUuh_Xs-DlKLysSq5L9ybQAAAdA"]
[Wed Dec 24 16:19:10.323886 2025] [:error] [pid 28405:tid 28427] [client 104.215.51.146:4457] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUuh_sKkTWlhmfdXFqY3DAAAAVE"]
[Wed Dec 24 16:19:10.820493 2025] [:error] [pid 54139:tid 54157] [client 104.215.51.146:52650] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUuh_srYCZenIDzgXuJxmgAAARA"]
[Wed Dec 24 16:19:11.470134 2025] [:error] [pid 16467:tid 16517] [client 104.215.51.146:64267] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUuh_40TJMcBxX5slgooyQAAAFQ"]
[Wed Dec 24 16:19:12.070766 2025] [:error] [pid 54139:tid 54156] [client 104.215.51.146:51509] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUuiAMrYCZenIDzgXuJxoAAAAQ8"]
[Wed Dec 24 16:19:12.494360 2025] [:error] [pid 16468:tid 16529] [client 104.215.51.146:30736] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUuiAIdyfuSTFLkCbP9t2gAAAIU"]
[Wed Dec 24 16:19:13.379531 2025] [:error] [pid 54139:tid 54146] [client 104.215.51.146:31585] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUuiAcrYCZenIDzgXuJxogAAAQU"]
[Wed Dec 24 16:19:13.850189 2025] [:error] [pid 28405:tid 28428] [client 104.215.51.146:4350] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aUuiAcKkTWlhmfdXFqY3DgAAAVI"]
[Wed Dec 24 16:19:14.295752 2025] [:error] [pid 54139:tid 54153] [client 104.215.51.146:51514] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUuiAsrYCZenIDzgXuJxowAAAQw"]
[Wed Dec 24 16:19:14.973857 2025] [:error] [pid 16468:tid 16546] [client 104.215.51.146:4626] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUuiAodyfuSTFLkCbP9t3wAAAJY"]
[Wed Dec 24 16:19:15.853590 2025] [:error] [pid 28777:tid 28790] [client 104.215.51.146:47898] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUuiA5BVBcZ34cSqz8oVhAAAAYs"]
[Wed Dec 24 16:19:16.271680 2025] [:error] [pid 29371:tid 29396] [client 104.215.51.146:4304] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aUuiBHs-DlKLysSq5L9ycAAAAdc"]
[Wed Dec 24 16:19:17.231483 2025] [:error] [pid 54139:tid 54143] [client 104.215.51.146:30724] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUuiBcrYCZenIDzgXuJxpwAAAQI"]
[Wed Dec 24 16:19:17.791473 2025] [:error] [pid 16468:tid 16545] [client 104.215.51.146:49712] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUuiBYdyfuSTFLkCbP9t4AAAAJU"]
[Wed Dec 24 16:19:18.215419 2025] [:error] [pid 16468:tid 16536] [client 104.215.51.146:4458] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUuiBodyfuSTFLkCbP9t4gAAAIw"]
[Wed Dec 24 16:19:18.653203 2025] [:error] [pid 54139:tid 54161] [client 104.215.51.146:5004] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aUuiBsrYCZenIDzgXuJxqgAAARQ"]
[Wed Dec 24 16:19:19.203117 2025] [:error] [pid 54139:tid 54164] [client 104.215.51.146:49069] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUuiB8rYCZenIDzgXuJxrQAAARc"]
[Wed Dec 24 16:19:20.011292 2025] [:error] [pid 16466:tid 16470] [client 104.215.51.146:4671] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUuiCLu0JcuKJMjJn6wIhwAAAAA"]
[Wed Dec 24 16:19:20.359438 2025] [:error] [pid 28405:tid 28426] [client 104.215.51.146:29706] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUuiCMKkTWlhmfdXFqY3EAAAAVA"]
[Wed Dec 24 16:19:20.981516 2025] [:error] [pid 16466:tid 16489] [client 104.215.51.146:29725] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aUuiCLu0JcuKJMjJn6wIiQAAABM"]
[Wed Dec 24 16:19:21.439955 2025] [:error] [pid 16468:tid 16547] [client 104.215.51.146:51517] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUuiCYdyfuSTFLkCbP9t5gAAAJc"]
[Wed Dec 24 16:19:21.992497 2025] [:error] [pid 28777:tid 28795] [client 104.215.51.146:49603] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUuiCZBVBcZ34cSqz8oVhwAAAZA"]
[Wed Dec 24 16:19:22.533565 2025] [:error] [pid 28777:tid 28779] [client 104.215.51.146:37282] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUuiCpBVBcZ34cSqz8oVigAAAYA"]
[Wed Dec 24 16:19:22.906679 2025] [:error] [pid 28777:tid 28785] [client 104.215.51.146:30745] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUuiCpBVBcZ34cSqz8oViwAAAYY"]
[Wed Dec 24 16:19:23.274458 2025] [:error] [pid 16468:tid 16524] [client 104.215.51.146:4327] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUuiC4dyfuSTFLkCbP9t5wAAAIA"]
[Wed Dec 24 16:19:23.669445 2025] [:error] [pid 28777:tid 28796] [client 104.215.51.146:30740] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUuiC5BVBcZ34cSqz8oVjgAAAZE"]
[Wed Dec 24 16:19:24.243898 2025] [:error] [pid 28777:tid 28784] [client 104.215.51.146:51493] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUuiDJBVBcZ34cSqz8oVjwAAAYU"]
[Wed Dec 24 16:19:24.938433 2025] [:error] [pid 28405:tid 28423] [client 104.215.51.146:49604] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aUuiDMKkTWlhmfdXFqY3EQAAAU0"]
[Wed Dec 24 16:19:25.596274 2025] [:error] [pid 16468:tid 16540] [client 104.215.51.146:30748] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aUuiDYdyfuSTFLkCbP9t7AAAAJA"]
[Wed Dec 24 16:19:26.065069 2025] [:error] [pid 28405:tid 28432] [client 104.215.51.146:37283] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aUuiDsKkTWlhmfdXFqY3EwAAAVY"]
[Wed Dec 24 16:19:26.658695 2025] [:error] [pid 28405:tid 28414] [client 104.215.51.146:30760] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aUuiDsKkTWlhmfdXFqY3FQAAAUU"]
[Wed Dec 24 16:19:27.374668 2025] [:error] [pid 28405:tid 28420] [client 104.215.51.146:4988] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aUuiD8KkTWlhmfdXFqY3FwAAAUo"]
[Wed Dec 24 16:19:27.936294 2025] [:error] [pid 28777:tid 28792] [client 104.215.51.146:44450] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUuiD5BVBcZ34cSqz8oVkgAAAY0"]
[Wed Dec 24 16:19:28.271808 2025] [:error] [pid 16550:tid 16569] [client 104.215.51.146:49609] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUuiEKYYcdD-LuO7vrDWfgAAANE"]
[Wed Dec 24 16:19:28.603226 2025] [:error] [pid 16468:tid 16525] [client 104.215.51.146:35029] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUuiEIdyfuSTFLkCbP9t7gAAAIE"]
[Wed Dec 24 16:19:28.986862 2025] [:error] [pid 16467:tid 16509] [client 104.215.51.146:4183] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUuiEI0TJMcBxX5slgoo0AAAAEw"]
[Wed Dec 24 16:19:29.698113 2025] [:error] [pid 16467:tid 16510] [client 104.215.51.146:29709] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUuiEY0TJMcBxX5slgoo0gAAAE0"]
[Wed Dec 24 16:19:30.180753 2025] [:error] [pid 29371:tid 29380] [client 104.215.51.146:4946] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUuiEns-DlKLysSq5L9ydQAAAcc"]
[Wed Dec 24 16:19:30.777875 2025] [:error] [pid 16467:tid 16515] [client 104.215.51.146:49084] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUuiEo0TJMcBxX5slgoo1AAAAFI"]
[Wed Dec 24 16:19:31.385560 2025] [:error] [pid 16550:tid 16573] [client 104.215.51.146:44420] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aUuiE6YYcdD-LuO7vrDWgQAAANU"]
[Wed Dec 24 16:19:32.079916 2025] [:error] [pid 16550:tid 16565] [client 104.215.51.146:30746] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUuiFKYYcdD-LuO7vrDWggAAAM0"]
[Wed Dec 24 16:19:32.785586 2025] [:error] [pid 28777:tid 28803] [client 104.215.51.146:33925] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUuiFJBVBcZ34cSqz8oVmAAAAZg"]
[Wed Dec 24 16:19:33.637038 2025] [:error] [pid 54139:tid 54163] [client 104.215.51.146:33958] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUuiFcrYCZenIDzgXuJxtwAAARY"]
[Wed Dec 24 16:19:34.339319 2025] [:error] [pid 54139:tid 54151] [client 104.215.51.146:4162] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aUuiFsrYCZenIDzgXuJxuQAAAQo"]
[Wed Dec 24 16:19:34.726610 2025] [:error] [pid 16550:tid 16560] [client 104.215.51.146:4854] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUuiFqYYcdD-LuO7vrDWgwAAAMg"]
[Wed Dec 24 16:19:35.565592 2025] [:error] [pid 16468:tid 16539] [client 104.215.51.146:34629] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUuiF4dyfuSTFLkCbP9t8AAAAI8"]
[Wed Dec 24 16:19:36.218660 2025] [:error] [pid 54139:tid 54165] [client 104.215.51.146:37288] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUuiGMrYCZenIDzgXuJxuwAAARg"]
[Wed Dec 24 16:19:36.903454 2025] [:error] [pid 16468:tid 16536] [client 104.215.51.146:4751] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aUuiGIdyfuSTFLkCbP9t8QAAAIw"]
[Wed Dec 24 16:19:37.556144 2025] [:error] [pid 16466:tid 16486] [client 104.215.51.146:4928] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUuiGbu0JcuKJMjJn6wIjwAAABA"]
[Wed Dec 24 16:19:38.199713 2025] [:error] [pid 16550:tid 16553] [client 104.215.51.146:29736] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUuiGqYYcdD-LuO7vrDWhgAAAME"]
[Wed Dec 24 16:19:38.876354 2025] [:error] [pid 28777:tid 28789] [client 104.215.51.146:44432] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUuiGpBVBcZ34cSqz8oVngAAAYo"]
[Wed Dec 24 16:19:39.362629 2025] [:error] [pid 16466:tid 16482] [client 104.215.51.146:35071] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUuiG7u0JcuKJMjJn6wIkAAAAAw"]
[Wed Dec 24 16:19:39.827894 2025] [:error] [pid 16467:tid 16500] [client 104.215.51.146:34659] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUuiG40TJMcBxX5slgoo4QAAAEM"]
[Wed Dec 24 16:19:40.265986 2025] [:error] [pid 28405:tid 28417] [client 104.215.51.146:4759] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUuiHMKkTWlhmfdXFqY3IAAAAUg"]
[Wed Dec 24 16:19:40.766120 2025] [:error] [pid 54139:tid 54157] [client 104.215.51.146:49043] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUuiHMrYCZenIDzgXuJxvwAAARA"]
[Wed Dec 24 16:19:41.281882 2025] [:error] [pid 16466:tid 16489] [client 104.215.51.146:4169] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aUuiHbu0JcuKJMjJn6wImQAAABM"]
[Wed Dec 24 16:19:41.944694 2025] [:error] [pid 54139:tid 54150] [client 104.215.51.146:35050] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUuiHcrYCZenIDzgXuJxwwAAAQk"]
[Wed Dec 24 16:19:42.497334 2025] [:error] [pid 16550:tid 16552] [client 104.215.51.146:44425] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUuiHqYYcdD-LuO7vrDWiAAAAMA"]
[Wed Dec 24 16:19:43.176663 2025] [:error] [pid 29371:tid 29390] [client 104.215.51.146:44449] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUuiH3s-DlKLysSq5L9yfQAAAdE"]
[Wed Dec 24 16:19:43.675640 2025] [:error] [pid 29371:tid 29397] [client 104.215.51.146:37252] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aUuiH3s-DlKLysSq5L9yfgAAAdg"]
[Wed Dec 24 16:19:44.387799 2025] [:error] [pid 29371:tid 29394] [client 104.215.51.146:4764] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Dec 24 16:19:44.615952 2025] [:error] [pid 29371:tid 29380] [client 104.215.51.146:4764] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Dec 24 16:19:45.154804 2025] [:error] [pid 29371:tid 29376] [client 104.215.51.146:4764] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Dec 24 16:19:45.493736 2025] [:error] [pid 29371:tid 29378] [client 104.215.51.146:4764] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Wed Dec 24 16:19:45.705146 2025] [:error] [pid 29371:tid 29382] [client 104.215.51.146:4764] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Wed Dec 24 16:19:46.038900 2025] [:error] [pid 29371:tid 29396] [client 104.215.51.146:4764] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Wed Dec 24 16:19:46.638077 2025] [:error] [pid 29371:tid 29390] [client 104.215.51.146:4764] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUuiIns-DlKLysSq5L9yjQAAAdE"]
[Wed Dec 24 16:19:47.934650 2025] [:error] [pid 16466:tid 16474] [client 104.215.51.146:35024] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUuiI7u0JcuKJMjJn6wIuQAAAAQ"]
[Wed Dec 24 16:19:48.413324 2025] [:error] [pid 16466:tid 16475] [client 104.215.51.146:4166] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUuiJLu0JcuKJMjJn6wIvAAAAAU"]
[Wed Dec 24 16:19:49.037132 2025] [:error] [pid 28777:tid 28801] [client 104.215.51.146:36470] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aUuiJZBVBcZ34cSqz8oVvAAAAZY"]
[Wed Dec 24 16:19:49.626611 2025] [:error] [pid 16550:tid 16574] [client 104.215.51.146:33970] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUuiJaYYcdD-LuO7vrDWkQAAANY"]
[Wed Dec 24 16:19:50.168313 2025] [:error] [pid 54139:tid 54143] [client 104.215.51.146:4208] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUuiJsrYCZenIDzgXuJxywAAAQI"]
[Wed Dec 24 16:19:50.723704 2025] [:error] [pid 16468:tid 16538] [client 104.215.51.146:34954] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUuiJodyfuSTFLkCbP9uCAAAAI4"]
[Wed Dec 24 16:19:51.433655 2025] [:error] [pid 16468:tid 16524] [client 104.215.51.146:33950] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aUuiJ4dyfuSTFLkCbP9uCwAAAIA"]
[Wed Dec 24 16:19:52.215221 2025] [:error] [pid 16468:tid 16545] [client 104.215.51.146:34962] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aUuiKIdyfuSTFLkCbP9uDwAAAJU"]
[Wed Dec 24 16:19:52.863256 2025] [:error] [pid 16468:tid 16536] [client 104.215.51.146:35042] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aUuiKIdyfuSTFLkCbP9uEQAAAIw"]
[Wed Dec 24 16:19:53.358125 2025] [:error] [pid 28777:tid 28789] [client 104.215.51.146:4816] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aUuiKZBVBcZ34cSqz8oVxQAAAYo"]
[Wed Dec 24 16:19:54.017146 2025] [:error] [pid 28405:tid 28431] [client 104.215.51.146:34976] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aUuiKsKkTWlhmfdXFqY3RgAAAVU"]
[Wed Dec 24 16:19:54.428314 2025] [:error] [pid 28405:tid 28422] [client 104.215.51.146:33980] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUuiKsKkTWlhmfdXFqY3SAAAAUw"]
[Wed Dec 24 16:19:55.424439 2025] [:error] [pid 16468:tid 16528] [client 104.215.51.146:51398] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUuiK4dyfuSTFLkCbP9uEgAAAIQ"]
[Wed Dec 24 16:19:56.253633 2025] [:error] [pid 28777:tid 28802] [client 104.215.51.146:51397] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUuiLJBVBcZ34cSqz8oVxgAAAZc"]
[Wed Dec 24 16:19:56.884250 2025] [:error] [pid 16550:tid 16562] [client 104.215.51.146:4160] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aUuiLKYYcdD-LuO7vrDWmwAAAMo"]
[Wed Dec 24 16:19:57.569631 2025] [:error] [pid 54139:tid 54163] [client 104.215.51.146:35032] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUuiLcrYCZenIDzgXuJxzwAAARY"]
[Wed Dec 24 16:19:58.310483 2025] [:error] [pid 16466:tid 16483] [client 104.215.51.146:4847] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUuiLru0JcuKJMjJn6wIzQAAAA0"]
[Wed Dec 24 16:19:59.025291 2025] [:error] [pid 16466:tid 16489] [client 104.215.51.146:50878] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUuiL7u0JcuKJMjJn6wIzgAAABM"]
[Wed Dec 24 16:19:59.396964 2025] [:error] [pid 16466:tid 16493] [client 104.215.51.146:35020] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aUuiL7u0JcuKJMjJn6wI0AAAABc"]
[Wed Dec 24 16:19:59.816455 2025] [:error] [pid 16550:tid 16558] [client 104.215.51.146:4167] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUuiL6YYcdD-LuO7vrDWnwAAAMY"]
[Wed Dec 24 16:20:01.857523 2025] [:error] [pid 16550:tid 16554] [client 104.215.51.146:51426] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUuiMaYYcdD-LuO7vrDWoAAAAMI"]
[Wed Dec 24 16:20:03.153535 2025] [:error] [pid 16550:tid 16557] [client 104.215.51.146:33043] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUuiM6YYcdD-LuO7vrDWpAAAAMU"]
[Wed Dec 24 16:20:03.915500 2025] [:error] [pid 16467:tid 16518] [client 104.215.51.146:4797] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aUuiM40TJMcBxX5slgoo5QAAAFU"]
[Wed Dec 24 16:20:04.661344 2025] [:error] [pid 16550:tid 16569] [client 104.215.51.146:34660] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUuiNKYYcdD-LuO7vrDWpgAAANE"]
[Wed Dec 24 16:20:05.116423 2025] [:error] [pid 16467:tid 16501] [client 104.215.51.146:4812] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUuiNY0TJMcBxX5slgoo5gAAAEQ"]
[Wed Dec 24 16:20:05.749680 2025] [:error] [pid 54139:tid 54161] [client 104.215.51.146:4176] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUuiNcrYCZenIDzgXuJx2AAAARQ"]
[Wed Dec 24 16:20:06.587825 2025] [:error] [pid 54139:tid 54158] [client 104.215.51.146:33920] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUuiNsrYCZenIDzgXuJx2QAAARE"]
[Wed Dec 24 16:20:07.144049 2025] [:error] [pid 28405:tid 28427] [client 104.215.51.146:33047] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUuiN8KkTWlhmfdXFqY3VwAAAVE"]
[Wed Dec 24 16:20:07.994503 2025] [:error] [pid 16466:tid 16481] [client 104.215.51.146:29648] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUuiN7u0JcuKJMjJn6wI1QAAAAs"]
[Wed Dec 24 16:20:08.915331 2025] [:error] [pid 54139:tid 54149] [client 104.215.51.146:4792] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUuiOMrYCZenIDzgXuJx3gAAAQg"]
[Wed Dec 24 16:20:09.269669 2025] [:error] [pid 16467:tid 16499] [client 104.215.51.146:50843] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aUuiOY0TJMcBxX5slgoo6gAAAEI"]
[Wed Dec 24 16:20:09.836634 2025] [:error] [pid 54139:tid 54141] [client 104.215.51.146:29664] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUuiOcrYCZenIDzgXuJx4QAAAQA"]
[Wed Dec 24 16:20:10.811881 2025] [:error] [pid 28405:tid 28428] [client 104.215.51.146:45752] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUuiOsKkTWlhmfdXFqY3XgAAAVI"]
[Wed Dec 24 16:20:12.308959 2025] [:error] [pid 54139:tid 54146] [client 104.215.51.146:45742] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUuiPMrYCZenIDzgXuJx4gAAAQU"]
[Wed Dec 24 16:20:13.235248 2025] [:error] [pid 28405:tid 28432] [client 104.215.51.146:34291] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUuiPcKkTWlhmfdXFqY3YQAAAVY"]
[Wed Dec 24 16:20:13.654800 2025] [:error] [pid 16466:tid 16488] [client 104.215.51.146:33144] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUuiPbu0JcuKJMjJn6wI2AAAABI"]
[Wed Dec 24 16:20:14.340850 2025] [:error] [pid 54139:tid 54157] [client 104.215.51.146:34243] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUuiPsrYCZenIDzgXuJx5QAAARA"]
[Wed Dec 24 16:20:15.318445 2025] [:error] [pid 16550:tid 16571] [client 104.215.51.146:32728] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUuiP6YYcdD-LuO7vrDWrwAAANM"]
[Wed Dec 24 16:20:15.748466 2025] [:error] [pid 54139:tid 54161] [client 104.215.51.146:30047] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUuiP8rYCZenIDzgXuJx6AAAARQ"]
[Wed Dec 24 16:20:16.584899 2025] [:error] [pid 29371:tid 29373] [client 104.215.51.146:33074] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUuiQHs-DlKLysSq5L9ynQAAAcA"]
[Wed Dec 24 16:20:16.968152 2025] [:error] [pid 54139:tid 54163] [client 104.215.51.146:42462] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUuiQMrYCZenIDzgXuJx7AAAARY"]
[Wed Dec 24 16:20:17.668185 2025] [:error] [pid 29371:tid 29375] [client 104.215.51.146:47398] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUuiQXs-DlKLysSq5L9yngAAAcI"]
[Wed Dec 24 16:20:18.047814 2025] [:error] [pid 16467:tid 16500] [client 104.215.51.146:33145] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aUuiQo0TJMcBxX5slgoo7QAAAEM"]
[Wed Dec 24 16:20:18.595542 2025] [:error] [pid 16467:tid 16506] [client 104.215.51.146:47404] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUuiQo0TJMcBxX5slgoo7gAAAEk"]
[Wed Dec 24 16:20:19.109617 2025] [:error] [pid 29371:tid 29395] [client 104.215.51.146:27449] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUuiQ3s-DlKLysSq5L9yoAAAAdY"]
[Wed Dec 24 16:20:19.914268 2025] [:error] [pid 16468:tid 16541] [client 104.215.51.146:52046] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUuiQ4dyfuSTFLkCbP9uKQAAAJE"]
[Wed Dec 24 16:20:20.545459 2025] [:error] [pid 16468:tid 16546] [client 104.215.51.146:47405] [client 104.215.51.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aUuiRIdyfuSTFLkCbP9uKgAAAJY"]
[Wed Dec 24 19:58:35.546099 2025] [:error] [pid 28405:tid 28425] [client 20.2.117.38:54444] [client 20.2.117.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUvVa8KkTWlhmfdXFqaHJQAAAU8"]
[Wed Dec 24 19:58:37.941396 2025] [:error] [pid 16466:tid 16476] [client 20.2.117.38:54405] [client 20.2.117.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUvVbbu0JcuKJMjJn6xB3QAAAAY"]
[Wed Dec 24 19:58:39.739022 2025] [:error] [pid 29371:tid 29385] [client 20.2.117.38:61551] [client 20.2.117.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUvVb3s-DlKLysSq5L-d4AAAAcw"]
[Wed Dec 24 19:58:41.046141 2025] [:error] [pid 28777:tid 28786] [client 20.2.117.38:3017] [client 20.2.117.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aUvVcZBVBcZ34cSqz8o7_QAAAYc"]
[Wed Dec 24 20:29:05.835676 2025] [:error] [pid 28405:tid 28427] [client 106.219.147.101:15449] [client 106.219.147.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.147.101, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUvckcKkTWlhmfdXFqaT3wAAAVE"]
[Wed Dec 24 20:29:05.840891 2025] [:error] [pid 28405:tid 28427] [client 106.219.147.101:15449] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 24 20:40:49.882064 2025] [:error] [pid 16466:tid 16485] [client 34.86.187.168:64582] [client 34.86.187.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.187.168, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aUvfUbu0JcuKJMjJn6xPUQAAAA8"]
[Wed Dec 24 20:40:49.886259 2025] [:error] [pid 16466:tid 16485] [client 34.86.187.168:64582] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 24 20:40:53.088875 2025] [:error] [pid 16466:tid 16477] [client 34.86.187.168:64582] [client 34.86.187.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aUvfVbu0JcuKJMjJn6xPXwAAAAc"]
[Wed Dec 24 20:40:53.574866 2025] [:error] [pid 28405:tid 28413] [client 34.86.187.168:56137] [client 34.86.187.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aUvfVcKkTWlhmfdXFqaYCgAAAUQ"]
[Wed Dec 24 20:40:54.266226 2025] [:error] [pid 28405:tid 28426] [client 34.86.187.168:63936] [client 34.86.187.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aUvfVsKkTWlhmfdXFqaYDAAAAVA"]
[Wed Dec 24 20:40:54.829231 2025] [:error] [pid 29371:tid 29383] [client 34.86.187.168:61729] [client 34.86.187.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aUvfVns-DlKLysSq5L-nPQAAAco"]
[Wed Dec 24 20:40:55.316121 2025] [:error] [pid 16466:tid 16470] [client 34.86.187.168:49594] [client 34.86.187.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aUvfV7u0JcuKJMjJn6xPYQAAAAA"]
[Wed Dec 24 20:40:55.833749 2025] [:error] [pid 16466:tid 16489] [client 34.86.187.168:56905] [client 34.86.187.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aUvfV7u0JcuKJMjJn6xPYgAAABM"]
[Wed Dec 24 20:40:56.313015 2025] [:error] [pid 16466:tid 16485] [client 34.86.187.168:50415] [client 34.86.187.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aUvfWLu0JcuKJMjJn6xPZAAAAA8"]
[Thu Dec 25 00:04:26.455779 2025] [:error] [pid 28405:tid 28409] [client 161.118.209.86:50716] [client 161.118.209.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aUwPCsKkTWlhmfdXFqbYzQAAAUA"]
[Thu Dec 25 00:04:26.868797 2025] [:error] [pid 29371:tid 29381] [client 161.118.209.86:62321] [client 161.118.209.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aUwPCns-DlKLysSq5L_NaQAAAcg"]
[Thu Dec 25 00:04:26.869755 2025] [:error] [pid 29371:tid 29384] [client 161.118.209.86:62114] [client 161.118.209.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/prevlaravel/sftp-config.json"] [unique_id "aUwPCns-DlKLysSq5L_NagAAAcs"]
[Thu Dec 25 00:04:27.274417 2025] [:error] [pid 28405:tid 28430] [client 161.118.209.86:55882] [client 161.118.209.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aUwPC8KkTWlhmfdXFqbYzwAAAVQ"]
[Thu Dec 25 00:04:27.275090 2025] [:error] [pid 28405:tid 28417] [client 161.118.209.86:54716] [client 161.118.209.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/prevlaravel/sftp-config.json"] [unique_id "aUwPC8KkTWlhmfdXFqbY0AAAAUg"]
[Thu Dec 25 00:04:27.275148 2025] [:error] [pid 54139:tid 54159] [client 161.118.209.86:54599] [client 161.118.209.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aUwPC8rYCZenIDzgXuLbvgAAARI"]
[Thu Dec 25 00:04:27.275325 2025] [:error] [pid 54139:tid 54161] [client 161.118.209.86:54305] [client 161.118.209.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/sftp.json"] [unique_id "aUwPC8rYCZenIDzgXuLbvwAAARQ"]
[Thu Dec 25 08:12:31.230920 2025] [:error] [pid 31569:tid 31589] [client 45.148.10.238:56482] [client 45.148.10.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aUyBb2iSFBH7Ee_uldUNIQAAABA"]
[Thu Dec 25 19:43:52.143413 2025] [:error] [pid 31655:tid 31676] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Thu Dec 25 19:43:52.163952 2025] [:error] [pid 31655:tid 31667] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/d4.php
[Thu Dec 25 19:43:52.186911 2025] [:error] [pid 31655:tid 31663] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Thu Dec 25 19:43:52.385207 2025] [:error] [pid 31655:tid 31673] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/dlex.php
[Thu Dec 25 19:43:52.477348 2025] [:error] [pid 31655:tid 31679] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Dec 25 19:43:52.496419 2025] [:error] [pid 31655:tid 31658] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/pass.php
[Thu Dec 25 19:43:52.662704 2025] [:error] [pid 31655:tid 31674] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Thu Dec 25 19:43:52.682493 2025] [:error] [pid 31655:tid 31671] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Dec 25 19:43:52.709225 2025] [:error] [pid 31655:tid 31681] [client 4.196.91.63:9254] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Dec 25 19:43:52.970005 2025] [:error] [pid 31655:tid 31668] [client 4.196.91.63:9254] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU0jeJozPMk9HPtIJPOm0gAAAMs"]
[Thu Dec 25 19:43:53.985873 2025] [:error] [pid 64910:tid 64963] [client 4.196.91.63:10450] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU0jeees2ob7vYHBZqB6kwAAAhY"]
[Thu Dec 25 19:43:56.222000 2025] [:error] [pid 64973:tid 65028] [client 4.196.91.63:9225] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU0jfOqHYEKj6K8dhUE3ZAAAApg"]
[Thu Dec 25 19:43:59.397707 2025] [:error] [pid 64909:tid 64925] [client 4.196.91.63:10430] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU0jfx45RBsBaT7_YDVjmwAAAcs"]
[Thu Dec 25 19:43:59.925117 2025] [:error] [pid 31655:tid 31677] [client 4.196.91.63:9243] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npi.php"] [unique_id "aU0jf5ozPMk9HPtIJPOm3QAAANQ"]
[Thu Dec 25 19:44:00.932821 2025] [:error] [pid 64971:tid 64994] [client 4.196.91.63:10406] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npi.php"] [unique_id "aU0jgKqyk1GkxTrDJixNBAAAAlE"]
[Thu Dec 25 19:44:01.770638 2025] [:error] [pid 64820:tid 64838] [client 4.196.91.63:10382] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npi.php"] [unique_id "aU0jgcSuTdTvkipi541E9QAAAU4"]
[Thu Dec 25 19:44:05.758449 2025] [:error] [pid 64975:tid 65060] [client 4.196.91.63:9271] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npi.php"] [unique_id "aU0jhSXyboSuXIThjj6X_QAAAwI"]
[Thu Dec 25 19:44:06.667641 2025] [:error] [pid 64910:tid 64965] [client 4.196.91.63:10394] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aU0jhues2ob7vYHBZqB6mwAAAhg"]
[Thu Dec 25 19:44:58.838937 2025] [:error] [pid 64971:tid 64994] [client 4.196.91.63:10387] [client 4.196.91.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aU0juqqyk1GkxTrDJixNKwAAAlE"]
[Thu Dec 25 19:44:59.630117 2025] [:error] [pid 64910:tid 64960] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Dec 25 19:44:59.654305 2025] [:error] [pid 64910:tid 64947] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/litanies.php
[Thu Dec 25 19:45:00.016560 2025] [:error] [pid 64910:tid 64952] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Thu Dec 25 19:45:00.037507 2025] [:error] [pid 64910:tid 64942] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Thu Dec 25 19:45:00.077312 2025] [:error] [pid 64910:tid 64959] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/kwm4.php
[Thu Dec 25 19:45:00.096744 2025] [:error] [pid 64910:tid 64953] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/just2.php
[Thu Dec 25 19:45:00.117064 2025] [:error] [pid 64910:tid 64962] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Thu Dec 25 19:45:00.160854 2025] [:error] [pid 64910:tid 64965] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/geger.php
[Thu Dec 25 19:45:00.181530 2025] [:error] [pid 64910:tid 64951] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/let.php
[Thu Dec 25 19:45:00.202441 2025] [:error] [pid 64910:tid 64961] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/np.php
[Thu Dec 25 19:45:00.511046 2025] [:error] [pid 64910:tid 64955] [client 4.196.91.63:10412] File does not exist: /usr/local/apache/htdocs/suspended-page/ask.php
[Thu Dec 25 19:45:00.606997 2025] [:error] [pid 64910:tid 64958] [client 4.196.91.63:10412] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aU0jvOes2ob7vYHBZqB6yQAAAhE"]
[Thu Dec 25 19:45:02.473866 2025] [:error] [pid 64909:tid 64920] [client 4.196.91.63:9263] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aU0jvh45RBsBaT7_YDVjyQAAAcY"]
[Thu Dec 25 19:45:03.963087 2025] [:error] [pid 31655:tid 31674] [client 4.196.91.63:9238] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aU0jv5ozPMk9HPtIJPOnHgAAANE"]
[Thu Dec 25 19:45:09.930259 2025] [:error] [pid 64910:tid 64950] [client 4.196.91.63:9217] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aU0jxees2ob7vYHBZqB6zgAAAgk"]
[Thu Dec 25 19:45:11.011016 2025] [:error] [pid 64820:tid 64845] [client 4.196.91.63:10372] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aU0jx8SuTdTvkipi541FSAAAAVU"]
[Thu Dec 25 19:45:23.967787 2025] [:error] [pid 64909:tid 64926] [client 4.196.91.63:9274] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aU0j0x45RBsBaT7_YDVj3QAAAcw"]
[Thu Dec 25 19:45:33.082211 2025] [:error] [pid 64909:tid 64919] [client 4.196.91.63:9252] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mek.php"] [unique_id "aU0j3R45RBsBaT7_YDVj4gAAAcU"]
[Thu Dec 25 19:45:34.335712 2025] [:error] [pid 31569:tid 31594] [client 4.196.91.63:9222] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mek.php"] [unique_id "aU0j3miSFBH7Ee_uldXjzAAAABU"]
[Thu Dec 25 19:45:47.999276 2025] [:error] [pid 64971:tid 65001] [client 4.196.91.63:10451] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU0j66qyk1GkxTrDJixNTAAAAlg"]
[Thu Dec 25 19:45:48.878340 2025] [:error] [pid 31570:tid 31620] [client 4.196.91.63:9234] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU0j7GPy2DpAzW_4a2hNyQAAAFQ"]
[Thu Dec 25 19:45:49.531981 2025] [:error] [pid 64909:tid 64916] [client 4.196.91.63:10378] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU0j7R45RBsBaT7_YDVj7gAAAcI"]
[Thu Dec 25 19:45:59.204524 2025] [:error] [pid 31569:tid 31575] [client 4.196.91.63:10404] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU0j92iSFBH7Ee_uldXj3gAAAAI"]
[Thu Dec 25 19:46:10.346816 2025] [:error] [pid 64820:tid 64841] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/ex.php
[Thu Dec 25 19:46:10.407210 2025] [:error] [pid 64820:tid 64846] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/asd67.php
[Thu Dec 25 19:46:10.471706 2025] [:error] [pid 64820:tid 64827] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Dec 25 19:46:10.549818 2025] [:error] [pid 64820:tid 64844] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Dec 25 19:46:10.613834 2025] [:error] [pid 64820:tid 64842] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/shlo.php
[Thu Dec 25 19:46:10.703323 2025] [:error] [pid 64820:tid 64836] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/sec.php
[Thu Dec 25 19:46:10.769158 2025] [:error] [pid 64820:tid 64840] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Dec 25 19:46:10.806946 2025] [:error] [pid 64820:tid 64828] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Dec 25 19:46:10.833792 2025] [:error] [pid 64820:tid 64829] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Thu Dec 25 19:46:10.869334 2025] [:error] [pid 64820:tid 64833] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Thu Dec 25 19:46:10.961847 2025] [:error] [pid 64820:tid 64834] [client 4.196.91.63:10410] File does not exist: /usr/local/apache/htdocs/suspended-page/bluejackets.php
[Thu Dec 25 19:46:10.978316 2025] [:error] [pid 64820:tid 64826] [client 4.196.91.63:10410] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU0kAsSuTdTvkipi541FegAAAUI"]
[Thu Dec 25 19:46:13.162393 2025] [:error] [pid 64820:tid 64838] [client 4.196.91.63:10399] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU0kBcSuTdTvkipi541FfwAAAU4"]
[Thu Dec 25 19:46:20.717410 2025] [:error] [pid 64973:tid 65015] [client 4.196.91.63:10461] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU0kDOqHYEKj6K8dhUE3ygAAAos"]
[Thu Dec 25 19:46:23.776822 2025] [:error] [pid 31570:tid 31620] [client 4.196.91.63:9256] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU0kD2Py2DpAzW_4a2hN1QAAAFQ"]
[Thu Dec 25 19:46:24.740063 2025] [:error] [pid 31570:tid 31615] [client 4.196.91.63:10376] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx21_1.php"] [unique_id "aU0kEGPy2DpAzW_4a2hN2QAAAE8"]
[Thu Dec 25 19:46:26.250931 2025] [:error] [pid 64975:tid 65058] [client 4.196.91.63:10407] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx21_1.php"] [unique_id "aU0kEiXyboSuXIThjj6YZAAAAwA"]
[Thu Dec 25 19:46:30.291722 2025] [:error] [pid 64910:tid 64964] [client 4.196.91.63:9279] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx21_1.php"] [unique_id "aU0kFues2ob7vYHBZqB6-AAAAhc"]
[Thu Dec 25 19:46:31.863085 2025] [:error] [pid 31655:tid 31662] [client 4.196.91.63:10468] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx21_1.php"] [unique_id "aU0kF5ozPMk9HPtIJPOnZgAAAMU"]
[Thu Dec 25 19:46:39.122610 2025] [:error] [pid 64820:tid 64830] [client 4.196.91.63:9258] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aU0kH8SuTdTvkipi541FiwAAAUY"]
[Thu Dec 25 19:46:41.073145 2025] [:error] [pid 31569:tid 31576] [client 4.196.91.63:9231] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aU0kIWiSFBH7Ee_uldXj7QAAAAM"]
[Thu Dec 25 19:46:45.425302 2025] [:error] [pid 64820:tid 64832] [client 4.196.91.63:9219] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aU0kJcSuTdTvkipi541FlAAAAUg"]
[Thu Dec 25 19:46:47.438587 2025] [:error] [pid 64975:tid 65060] [client 4.196.91.63:10370] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU0kJyXyboSuXIThjj6YbwAAAwI"]
[Thu Dec 25 19:46:49.066360 2025] [:error] [pid 31571:tid 31639] [client 4.196.91.63:10418] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU0kKe7e_lLK2X5wU8nE6wAAAIw"]
[Thu Dec 25 19:46:51.602021 2025] [:error] [pid 31570:tid 31605] [client 4.196.91.63:10572] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU0kK2Py2DpAzW_4a2hN7AAAAEU"]
[Thu Dec 25 19:46:55.626357 2025] [:error] [pid 31570:tid 31619] [client 4.196.91.63:10704] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU0kL2Py2DpAzW_4a2hN7wAAAFM"]
[Thu Dec 25 19:46:58.725440 2025] [:error] [pid 31655:tid 31673] [client 4.196.91.63:10416] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU0kMpozPMk9HPtIJPOnbwAAANA"]
[Thu Dec 25 19:47:01.025647 2025] [:error] [pid 64820:tid 64847] [client 4.196.91.63:10371] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU0kNcSuTdTvkipi541FpAAAAVc"]
[Thu Dec 25 19:47:02.445868 2025] [:error] [pid 64971:tid 64980] [client 4.196.91.63:10409] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU0kNqqyk1GkxTrDJixNYgAAAkM"]
[Thu Dec 25 19:47:03.601887 2025] [:error] [pid 64973:tid 65024] [client 4.196.91.63:9240] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU0kN-qHYEKj6K8dhUE32gAAApQ"]
[Thu Dec 25 19:47:15.159510 2025] [:error] [pid 64909:tid 64933] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/aw.php
[Thu Dec 25 19:47:15.205118 2025] [:error] [pid 64909:tid 64928] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/sfvul.php
[Thu Dec 25 19:47:15.224841 2025] [:error] [pid 64909:tid 64923] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/icdwb.php
[Thu Dec 25 19:47:15.244358 2025] [:error] [pid 64909:tid 64929] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/ticket.php
[Thu Dec 25 19:47:15.263614 2025] [:error] [pid 64909:tid 64919] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Dec 25 19:47:15.328358 2025] [:error] [pid 64909:tid 64938] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Dec 25 19:47:15.603723 2025] [:error] [pid 64909:tid 64931] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/amphicyon.php
[Thu Dec 25 19:47:15.640019 2025] [:error] [pid 64909:tid 64917] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Dec 25 19:47:15.696587 2025] [:error] [pid 64909:tid 64916] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/lock1.php
[Thu Dec 25 19:47:15.717524 2025] [:error] [pid 64909:tid 64934] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Dec 25 19:47:15.738120 2025] [:error] [pid 64909:tid 64924] [client 4.196.91.63:10397] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Thu Dec 25 19:47:15.778587 2025] [:error] [pid 64909:tid 64921] [client 4.196.91.63:10397] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aU0kQx45RBsBaT7_YDVkHwAAAcc"]
[Thu Dec 25 19:47:28.281080 2025] [:error] [pid 64973:tid 65006] [client 4.196.91.63:10431] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aU0kUOqHYEKj6K8dhUE35QAAAoI"]
[Thu Dec 25 19:47:34.203337 2025] [:error] [pid 64910:tid 64954] [client 4.196.91.63:10369] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aU0kVues2ob7vYHBZqB7HAAAAg0"]
[Thu Dec 25 19:47:35.619985 2025] [:error] [pid 64975:tid 65074] [client 4.196.91.63:10484] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aU0kVyXyboSuXIThjj6YfwAAAxA"]
[Thu Dec 25 19:47:39.756355 2025] [:error] [pid 64973:tid 65010] [client 4.196.91.63:9269] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aU0kW-qHYEKj6K8dhUE36QAAAoY"]
[Thu Dec 25 19:47:40.350785 2025] [:error] [pid 64820:tid 64833] [client 4.196.91.63:9230] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aU0kXMSuTdTvkipi541F1gAAAUk"]
[Thu Dec 25 19:47:43.812953 2025] [:error] [pid 31571:tid 31636] [client 4.196.91.63:10443] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU0kX-7e_lLK2X5wU8nFFgAAAIk"]
[Thu Dec 25 19:47:45.605488 2025] [:error] [pid 31570:tid 31611] [client 4.196.91.63:9245] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU0kYWPy2DpAzW_4a2hOHQAAAEs"]
[Thu Dec 25 19:47:51.849775 2025] [:error] [pid 31570:tid 31621] [client 4.196.91.63:9226] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU0kZ2Py2DpAzW_4a2hOIQAAAFU"]
[Thu Dec 25 19:47:53.198486 2025] [:error] [pid 64820:tid 64844] [client 4.196.91.63:10398] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU0kacSuTdTvkipi541F3wAAAVQ"]
[Thu Dec 25 19:47:55.052685 2025] [:error] [pid 64973:tid 65026] [client 4.196.91.63:10388] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU0ka-qHYEKj6K8dhUE37gAAApY"]
[Thu Dec 25 19:47:55.641896 2025] [:error] [pid 31569:tid 31574] [client 4.196.91.63:10561] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU0ka2iSFBH7Ee_uldXkEwAAAAE"]
[Thu Dec 25 19:47:57.914359 2025] [:error] [pid 31569:tid 31575] [client 4.196.91.63:9268] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU0kbWiSFBH7Ee_uldXkFwAAAAI"]
[Thu Dec 25 19:48:00.257147 2025] [:error] [pid 64975:tid 65067] [client 4.196.91.63:10386] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU0kcCXyboSuXIThjj6YkQAAAwk"]
[Thu Dec 25 19:48:05.303962 2025] [:error] [pid 64820:tid 64829] [client 4.196.91.63:10403] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx.php"] [unique_id "aU0kdcSuTdTvkipi541F8wAAAUU"]
[Thu Dec 25 19:48:07.459774 2025] [:error] [pid 64820:tid 64832] [client 4.196.91.63:10608] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx.php"] [unique_id "aU0kd8SuTdTvkipi541F-AAAAUg"]
[Thu Dec 25 19:48:08.240275 2025] [:error] [pid 31571:tid 31649] [client 4.196.91.63:9230] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx.php"] [unique_id "aU0keO7e_lLK2X5wU8nFLgAAAJY"]
[Thu Dec 25 19:48:12.137525 2025] [:error] [pid 31571:tid 31639] [client 4.196.91.63:10689] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx.php"] [unique_id "aU0kfO7e_lLK2X5wU8nFMgAAAIw"]
[Thu Dec 25 19:48:12.646702 2025] [:error] [pid 64973:tid 65025] [client 4.196.91.63:10390] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU0kfOqHYEKj6K8dhUE3_AAAApU"]
[Thu Dec 25 19:48:13.852657 2025] [:error] [pid 64820:tid 64828] [client 4.196.91.63:10459] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU0kfcSuTdTvkipi541GBwAAAUQ"]
[Thu Dec 25 19:48:14.506714 2025] [:error] [pid 64820:tid 64842] [client 4.196.91.63:10467] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU0kfsSuTdTvkipi541GDwAAAVI"]
[Thu Dec 25 19:48:16.763095 2025] [:error] [pid 31570:tid 31617] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Dec 25 19:48:17.106432 2025] [:error] [pid 31570:tid 31614] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Thu Dec 25 19:48:17.124060 2025] [:error] [pid 31570:tid 31612] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/xpw.php
[Thu Dec 25 19:48:17.141467 2025] [:error] [pid 31570:tid 31606] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Thu Dec 25 19:48:17.158143 2025] [:error] [pid 31570:tid 31603] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/akp.php
[Thu Dec 25 19:48:17.544674 2025] [:error] [pid 31570:tid 31601] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/cwsd.php
[Thu Dec 25 19:48:17.684009 2025] [:error] [pid 31570:tid 31624] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/tll.php
[Thu Dec 25 19:48:17.716989 2025] [:error] [pid 31570:tid 31623] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Thu Dec 25 19:48:17.744931 2025] [:error] [pid 31570:tid 31610] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/idea.php
[Thu Dec 25 19:48:18.063621 2025] [:error] [pid 31570:tid 31620] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/pepe.php
[Thu Dec 25 19:48:18.130710 2025] [:error] [pid 31570:tid 31618] [client 4.196.91.63:9246] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Thu Dec 25 19:48:18.274748 2025] [:error] [pid 31570:tid 31619] [client 4.196.91.63:9246] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yca.php"] [unique_id "aU0kgmPy2DpAzW_4a2hORwAAAFM"]
[Thu Dec 25 19:48:22.504419 2025] [:error] [pid 64973:tid 65014] [client 4.196.91.63:10432] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yca.php"] [unique_id "aU0khuqHYEKj6K8dhUE4AQAAAoo"]
[Thu Dec 25 19:48:22.826340 2025] [:error] [pid 64909:tid 64926] [client 4.196.91.63:10402] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yca.php"] [unique_id "aU0khh45RBsBaT7_YDVkMQAAAcw"]
[Thu Dec 25 19:48:24.287852 2025] [:error] [pid 64820:tid 64842] [client 4.196.91.63:10429] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yca.php"] [unique_id "aU0kiMSuTdTvkipi541GHgAAAVI"]
[Thu Dec 25 19:48:25.484362 2025] [:error] [pid 64820:tid 64834] [client 4.196.91.63:10384] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU0kicSuTdTvkipi541GJAAAAUo"]
[Thu Dec 25 19:48:26.677946 2025] [:error] [pid 64971:tid 64988] [client 4.196.91.63:10585] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU0kiqqyk1GkxTrDJixNlgAAAks"]
[Thu Dec 25 19:48:27.513254 2025] [:error] [pid 64971:tid 64986] [client 4.196.91.63:10463] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU0ki6qyk1GkxTrDJixNmAAAAkk"]
[Thu Dec 25 19:48:29.135627 2025] [:error] [pid 64909:tid 64919] [client 4.196.91.63:9266] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU0kjR45RBsBaT7_YDVkNgAAAcU"]
[Thu Dec 25 19:48:31.279256 2025] [:error] [pid 64909:tid 64917] [client 4.196.91.63:10457] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aU0kjx45RBsBaT7_YDVkOQAAAcM"]
[Thu Dec 25 19:48:35.110153 2025] [:error] [pid 64909:tid 64934] [client 4.196.91.63:9271] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aU0kkx45RBsBaT7_YDVkUgAAAdQ"]
[Thu Dec 25 19:48:36.499123 2025] [:error] [pid 31655:tid 31657] [client 4.196.91.63:9227] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aU0klJozPMk9HPtIJPOn-gAAAMA"]
[Thu Dec 25 19:48:37.184016 2025] [:error] [pid 64820:tid 64834] [client 4.196.91.63:10453] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aU0klcSuTdTvkipi541GnwAAAUo"]
[Thu Dec 25 19:48:38.305401 2025] [:error] [pid 64971:tid 64977] [client 4.196.91.63:10574] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU0klqqyk1GkxTrDJixNoAAAAkA"]
[Thu Dec 25 19:48:40.820361 2025] [:error] [pid 31571:tid 31634] [client 4.196.91.63:10598] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU0kmO7e_lLK2X5wU8nFPQAAAIc"]
[Thu Dec 25 19:48:42.592208 2025] [:error] [pid 64820:tid 64836] [client 4.196.91.63:10383] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU0kmsSuTdTvkipi541GrQAAAUw"]
[Thu Dec 25 19:48:43.785383 2025] [:error] [pid 31571:tid 31644] [client 4.196.91.63:9229] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU0km-7e_lLK2X5wU8nFPgAAAJE"]
[Thu Dec 25 19:48:46.153369 2025] [:error] [pid 31571:tid 31635] [client 4.196.91.63:9218] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU0knu7e_lLK2X5wU8nFQQAAAIg"]
[Thu Dec 25 19:48:49.014251 2025] [:error] [pid 31570:tid 31602] [client 4.196.91.63:10377] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU0koWPy2DpAzW_4a2hOUQAAAEI"]
[Thu Dec 25 19:48:52.447514 2025] [:error] [pid 31569:tid 31593] [client 4.196.91.63:10393] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU0kpGiSFBH7Ee_uldXkLQAAABQ"]
[Thu Dec 25 19:48:55.065406 2025] [:error] [pid 64971:tid 65001] [client 4.196.91.63:9267] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU0kp6qyk1GkxTrDJixNqgAAAlg"]
[Thu Dec 25 19:48:56.775893 2025] [:error] [pid 64820:tid 64828] [client 4.196.91.63:10455] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aU0kqMSuTdTvkipi541GsQAAAUQ"]
[Thu Dec 25 19:48:58.332723 2025] [:error] [pid 64820:tid 64830] [client 4.196.91.63:9254] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aU0kqsSuTdTvkipi541GtQAAAUY"]
[Thu Dec 25 19:49:00.799369 2025] [:error] [pid 64975:tid 65078] [client 4.196.91.63:10441] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aU0krCXyboSuXIThjj6YuQAAAxQ"]
[Thu Dec 25 19:49:07.328389 2025] [:error] [pid 64820:tid 64829] [client 4.196.91.63:10368] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aU0ks8SuTdTvkipi541GvwAAAUU"]
[Thu Dec 25 19:49:13.600640 2025] [:error] [pid 64971:tid 64977] [client 4.196.91.63:10611] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ucp.php"] [unique_id "aU0kuaqyk1GkxTrDJixNvQAAAkA"]
[Thu Dec 25 19:49:14.351037 2025] [:error] [pid 64820:tid 64837] [client 4.196.91.63:10396] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ucp.php"] [unique_id "aU0kusSuTdTvkipi541GyQAAAU0"]
[Thu Dec 25 19:49:15.710568 2025] [:error] [pid 64909:tid 64914] [client 4.196.91.63:10493] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ucp.php"] [unique_id "aU0kux45RBsBaT7_YDVkYQAAAcA"]
[Thu Dec 25 19:49:17.868296 2025] [:error] [pid 31655:tid 31658] [client 4.196.91.63:10434] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ucp.php"] [unique_id "aU0kvZozPMk9HPtIJPOoFgAAAME"]
[Thu Dec 25 19:49:21.967368 2025] [:error] [pid 31570:tid 31612] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/zse.php
[Thu Dec 25 19:49:22.023630 2025] [:error] [pid 31570:tid 31617] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Thu Dec 25 19:49:22.084454 2025] [:error] [pid 31570:tid 31614] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Thu Dec 25 19:49:22.145497 2025] [:error] [pid 31570:tid 31606] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Thu Dec 25 19:49:22.204005 2025] [:error] [pid 31570:tid 31603] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Dec 25 19:49:22.298204 2025] [:error] [pid 31570:tid 31615] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/orm.php
[Thu Dec 25 19:49:22.369000 2025] [:error] [pid 31570:tid 31616] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Thu Dec 25 19:49:22.445647 2025] [:error] [pid 31570:tid 31624] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Dec 25 19:49:22.681324 2025] [:error] [pid 31570:tid 31609] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Thu Dec 25 19:49:22.725301 2025] [:error] [pid 31570:tid 31607] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Dec 25 19:49:22.750321 2025] [:error] [pid 31570:tid 31621] [client 4.196.91.63:10462] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv.php
[Thu Dec 25 19:49:22.765299 2025] [:error] [pid 31570:tid 31604] [client 4.196.91.63:10462] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ea3f.php"] [unique_id "aU0kwmPy2DpAzW_4a2hOcgAAAEQ"]
[Thu Dec 25 19:49:24.654170 2025] [:error] [pid 64975:tid 65061] [client 4.196.91.63:10603] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ea3f.php"] [unique_id "aU0kxCXyboSuXIThjj6YzQAAAwM"]
[Thu Dec 25 19:49:25.772754 2025] [:error] [pid 64909:tid 64919] [client 4.196.91.63:10447] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ea3f.php"] [unique_id "aU0kxR45RBsBaT7_YDVkaQAAAcU"]
[Thu Dec 25 19:49:26.914377 2025] [:error] [pid 64909:tid 64916] [client 4.196.91.63:10770] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ea3f.php"] [unique_id "aU0kxh45RBsBaT7_YDVkbQAAAcI"]
[Thu Dec 25 19:49:28.904508 2025] [:error] [pid 64975:tid 65063] [client 4.196.91.63:10368] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/price.php"] [unique_id "aU0kyCXyboSuXIThjj6Y0wAAAwU"]
[Thu Dec 25 19:49:36.773793 2025] [:error] [pid 64909:tid 64937] [client 4.196.91.63:10414] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/price.php"] [unique_id "aU0k0B45RBsBaT7_YDVkegAAAdc"]
[Thu Dec 25 19:49:41.142399 2025] [:error] [pid 64975:tid 65065] [client 4.196.91.63:10382] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/price.php"] [unique_id "aU0k1SXyboSuXIThjj6Y4gAAAwc"]
[Thu Dec 25 19:49:42.888716 2025] [:error] [pid 64910:tid 64948] [client 4.196.91.63:10486] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU0k1ues2ob7vYHBZqB7TQAAAgc"]
[Thu Dec 25 19:49:43.521226 2025] [:error] [pid 64909:tid 64914] [client 4.196.91.63:9264] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU0k1x45RBsBaT7_YDVkgQAAAcA"]
[Thu Dec 25 19:49:44.443475 2025] [:error] [pid 64971:tid 64998] [client 4.196.91.63:10411] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU0k2Kqyk1GkxTrDJixN0gAAAlU"]
[Thu Dec 25 19:49:46.231132 2025] [:error] [pid 64909:tid 64919] [client 4.196.91.63:10372] [client 4.196.91.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU0k2h45RBsBaT7_YDVkhAAAAcU"]
[Fri Dec 26 00:14:55.160513 2025] [:error] [pid 24864:tid 24929] [client 110.235.188.5:50520] [client 110.235.188.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.235.188.5, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aU1i_8u59XOK5DpQQdB0vQAAAUk"]
[Fri Dec 26 00:14:55.166315 2025] [:error] [pid 24864:tid 24929] [client 110.235.188.5:50520] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Dec 26 14:40:46.314190 2025] [:error] [pid 28355:tid 28365] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Dec 26 14:40:46.756362 2025] [:error] [pid 28355:tid 28370] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Dec 26 14:40:47.204719 2025] [:error] [pid 28355:tid 28375] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Dec 26 14:40:47.678351 2025] [:error] [pid 28355:tid 28358] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Dec 26 14:40:48.427154 2025] [:error] [pid 28355:tid 28368] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Dec 26 14:40:48.846424 2025] [:error] [pid 28355:tid 28358] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Dec 26 14:40:49.274754 2025] [:error] [pid 28355:tid 28378] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Dec 26 14:40:49.735040 2025] [:error] [pid 28355:tid 28381] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Dec 26 14:40:50.989011 2025] [:error] [pid 28355:tid 28369] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Dec 26 14:40:51.897673 2025] [:error] [pid 28355:tid 28368] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Dec 26 14:40:52.363988 2025] [:error] [pid 28355:tid 28366] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Dec 26 14:40:52.834855 2025] [:error] [pid 28355:tid 28370] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Dec 26 14:40:53.618183 2025] [:error] [pid 28355:tid 28364] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Dec 26 14:40:54.398081 2025] [:error] [pid 28355:tid 28370] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Dec 26 14:40:55.259369 2025] [:error] [pid 28355:tid 28358] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Dec 26 14:40:55.717696 2025] [:error] [pid 28355:tid 28380] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Dec 26 14:40:56.159449 2025] [:error] [pid 28355:tid 28376] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Dec 26 14:40:56.626790 2025] [:error] [pid 28355:tid 28374] [client 203.159.81.45:61471] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Dec 26 14:41:03.314348 2025] [:error] [pid 28355:tid 28381] [client 203.159.81.45:61471] [client 203.159.81.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aU4t_7sFqKXf7ADZcTbE3wAAANg"]
[Fri Dec 26 14:41:06.656331 2025] [:error] [pid 7160:tid 7173] [client 203.159.81.47:40503] [client 203.159.81.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aU4uAuw_ihNZR5L8vEUWXQAAAYo"]
[Fri Dec 26 14:41:08.930306 2025] [:error] [pid 15063:tid 15080] [client 203.159.81.18:62587] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Dec 26 14:41:10.308960 2025] [:error] [pid 15063:tid 15085] [client 203.159.81.18:62587] [client 203.159.81.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aU4uBuDsf_aL46Jy7z-rrQAAARQ"]
[Fri Dec 26 14:41:16.357803 2025] [:error] [pid 7160:tid 7187] [client 203.159.81.9:47615] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Dec 26 14:41:16.829587 2025] [:error] [pid 7160:tid 7182] [client 203.159.81.9:47615] [client 203.159.81.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aU4uDOw_ihNZR5L8vEUWuQAAAZM"]
[Fri Dec 26 14:41:19.350667 2025] [:error] [pid 34865:tid 34872] [client 203.159.81.36:22391] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Dec 26 14:41:21.694853 2025] [:error] [pid 34865:tid 34879] [client 203.159.81.36:22391] [client 203.159.81.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aU4uEai4zjVVKBdvuTSTLQAAAUw"]
[Fri Dec 26 14:41:25.075298 2025] [:error] [pid 28270:tid 28329] [client 203.159.81.7:29041] [client 203.159.81.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aU4uFV9Ac79_ckdPN5IDOAAAAIA"]
[Fri Dec 26 14:41:26.075061 2025] [:error] [pid 28355:tid 28374] [client 203.159.81.1:57101] [client 203.159.81.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aU4uFrsFqKXf7ADZcTbFowAAANE"]
[Fri Dec 26 14:41:28.035401 2025] [:error] [pid 15063:tid 15069] [client 203.159.81.34:25043] [client 203.159.81.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aU4uGODsf_aL46Jy7z-sTgAAAQQ"]
[Fri Dec 26 14:41:29.090946 2025] [:error] [pid 28355:tid 28376] [client 203.159.81.14:26063] [client 203.159.81.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aU4uGbsFqKXf7ADZcTbFtwAAANM"]
[Fri Dec 26 14:41:30.021290 2025] [:error] [pid 28268:tid 28296] [client 203.159.81.8:45695] [client 203.159.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aU4uGnc_KuO_55-uPTRejAAAABU"]
[Fri Dec 26 14:41:32.377651 2025] [:error] [pid 7160:tid 7171] [client 203.159.81.7:43371] [client 203.159.81.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/index.php"] [unique_id "aU4uHOw_ihNZR5L8vEUXNgAAAYg"]
[Fri Dec 26 14:41:34.219612 2025] [:error] [pid 7160:tid 7164] [client 203.159.81.10:20417] [client 203.159.81.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aU4uHuw_ihNZR5L8vEUXRAAAAYE"]
[Fri Dec 26 14:41:36.177147 2025] [:error] [pid 28268:tid 28289] [client 203.159.81.48:56603] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Dec 26 14:41:37.076529 2025] [:error] [pid 28268:tid 28276] [client 203.159.81.48:56603] [client 203.159.81.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aU4uIXc_KuO_55-uPTRetQAAAAE"]
[Fri Dec 26 14:41:39.087423 2025] [:error] [pid 28355:tid 28376] [client 203.159.81.14:55681] [client 203.159.81.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aU4uI7sFqKXf7ADZcTbGJQAAANM"]
[Fri Dec 26 14:41:44.299186 2025] [:error] [pid 15063:tid 15081] [client 203.159.81.12:47493] [client 203.159.81.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aU4uKODsf_aL46Jy7z-szAAAARA"]
[Fri Dec 26 14:41:45.218563 2025] [:error] [pid 28268:tid 28299] [client 203.159.81.28:58751] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Dec 26 14:41:45.674001 2025] [:error] [pid 28268:tid 28282] [client 203.159.81.28:58751] [client 203.159.81.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aU4uKXc_KuO_55-uPTRe-gAAAAc"]
[Fri Dec 26 14:41:46.699744 2025] [:error] [pid 34865:tid 34870] [client 203.159.81.13:54465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Dec 26 14:41:48.108659 2025] [:error] [pid 34865:tid 34880] [client 203.159.81.13:54465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Dec 26 14:41:50.240221 2025] [:error] [pid 34865:tid 34872] [client 203.159.81.13:54465] [client 203.159.81.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aU4uLqi4zjVVKBdvuTSUCAAAAUU"]
[Fri Dec 26 15:24:24.831251 2025] [:error] [pid 15063:tid 15072] [client 185.238.231.24:52137] [client 185.238.231.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.24, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aU44KODsf_aL46Jy7z-9dgAAAQc"]
[Fri Dec 26 15:24:24.834900 2025] [:error] [pid 15063:tid 15072] [client 185.238.231.24:52137] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Dec 26 22:57:23.064176 2025] [:error] [pid 28269:tid 28324] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Fri Dec 26 22:57:23.595592 2025] [:error] [pid 28269:tid 28308] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/d4.php
[Fri Dec 26 22:57:23.983993 2025] [:error] [pid 28269:tid 28312] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Fri Dec 26 22:57:24.261709 2025] [:error] [pid 28269:tid 28323] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/dlex.php
[Fri Dec 26 22:57:24.427445 2025] [:error] [pid 28269:tid 28320] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Dec 26 22:57:24.586806 2025] [:error] [pid 28269:tid 28304] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/pass.php
[Fri Dec 26 22:57:24.729602 2025] [:error] [pid 28269:tid 28311] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Fri Dec 26 22:57:24.869938 2025] [:error] [pid 28269:tid 28316] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Fri Dec 26 22:57:25.200243 2025] [:error] [pid 28269:tid 28325] [client 20.196.89.188:13749] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Fri Dec 26 22:57:25.697992 2025] [:error] [pid 28269:tid 28302] [client 20.196.89.188:13749] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU6iVZ3ZK8bJ-c9-kjOn9AAAAEA"]
[Fri Dec 26 22:57:26.940259 2025] [:error] [pid 7160:tid 7180] [client 20.196.89.188:31172] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU6iVuw_ihNZR5L8vEWpEgAAAZE"]
[Fri Dec 26 22:57:28.630357 2025] [:error] [pid 28268:tid 28294] [client 20.196.89.188:29020] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU6iWHc_KuO_55-uPTTQBgAAABM"]
[Fri Dec 26 22:57:30.393198 2025] [:error] [pid 34865:tid 34872] [client 20.196.89.188:28999] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU6iWqi4zjVVKBdvuTQKBAAAAUU"]
[Fri Dec 26 22:57:31.517417 2025] [:error] [pid 34865:tid 34879] [client 20.196.89.188:13482] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npi.php"] [unique_id "aU6iW6i4zjVVKBdvuTQKBQAAAUw"]
[Fri Dec 26 22:57:33.870417 2025] [:error] [pid 15063:tid 15081] [client 20.196.89.188:34811] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npi.php"] [unique_id "aU6iXeDsf_aL46Jy7z8xJgAAARA"]
[Fri Dec 26 22:57:41.006395 2025] [:error] [pid 28355:tid 28365] [client 20.196.89.188:31213] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/npi.php"] [unique_id "aU6iZbsFqKXf7ADZcTY2wAAAAMg"]
[Fri Dec 26 22:57:50.273546 2025] [:error] [pid 7160:tid 7179] [client 20.196.89.188:31106] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aU6ibuw_ihNZR5L8vEWpMQAAAZA"]
[Fri Dec 26 22:57:58.498759 2025] [:error] [pid 28270:tid 28333] [client 20.196.89.188:31114] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aU6idl9Ac79_ckdPN5JzxAAAAIQ"]
[Fri Dec 26 22:58:00.130911 2025] [:error] [pid 28268:tid 28297] [client 20.196.89.188:28935] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aU6ieHc_KuO_55-uPTTQMAAAABY"]
[Fri Dec 26 22:58:00.942803 2025] [:error] [pid 15063:tid 15088] [client 20.196.89.188:33949] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aU6ieODsf_aL46Jy7z8xTgAAARc"]
[Fri Dec 26 22:58:02.714859 2025] [:error] [pid 28355:tid 28378] [client 20.196.89.188:28966] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU6iersFqKXf7ADZcTY2zgAAANU"]
[Fri Dec 26 22:58:03.561566 2025] [:error] [pid 28269:tid 28316] [client 20.196.89.188:13611] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU6ie53ZK8bJ-c9-kjOoDAAAAE4"]
[Fri Dec 26 22:58:04.079249 2025] [:error] [pid 28270:tid 28352] [client 20.196.89.188:31649] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU6ifF9Ac79_ckdPN5JzzAAAAJc"]
[Fri Dec 26 22:58:06.766116 2025] [:error] [pid 28269:tid 28318] [client 20.196.89.188:31620] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU6ifp3ZK8bJ-c9-kjOoDwAAAFA"]
[Fri Dec 26 22:58:08.731664 2025] [:error] [pid 7160:tid 7180] [client 20.196.89.188:37762] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aU6igOw_ihNZR5L8vEWpTAAAAZE"]
[Fri Dec 26 22:58:10.712366 2025] [:error] [pid 7160:tid 7178] [client 20.196.89.188:37162] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aU6iguw_ihNZR5L8vEWpVQAAAY8"]
[Fri Dec 26 22:58:12.058675 2025] [:error] [pid 15063:tid 15080] [client 20.196.89.188:37168] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aU6ihODsf_aL46Jy7z8xhwAAAQ8"]
[Fri Dec 26 22:58:13.489247 2025] [:error] [pid 28270:tid 28341] [client 20.196.89.188:28573] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aU6ihV9Ac79_ckdPN5Jz3AAAAIw"]
[Fri Dec 26 22:58:14.262342 2025] [:error] [pid 28269:tid 28307] [client 20.196.89.188:13615] [client 20.196.89.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aU6ihp3ZK8bJ-c9-kjOoFgAAAEU"]
[Fri Dec 26 22:58:14.960483 2025] [:error] [pid 7160:tid 7179] [client 20.196.89.188:37136] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aU6ihuw_ihNZR5L8vEWpWgAAAZA"]
[Fri Dec 26 22:58:16.029180 2025] [:error] [pid 15063:tid 15071] [client 20.196.89.188:37210] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aU6iiODsf_aL46Jy7z8xigAAAQY"]
[Fri Dec 26 22:58:17.870116 2025] [:error] [pid 34865:tid 34873] [client 20.196.89.188:50606] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aU6iiai4zjVVKBdvuTQKKgAAAUY"]
[Fri Dec 26 22:58:19.009699 2025] [:error] [pid 7160:tid 7184] [client 20.196.89.188:28600] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/litanies.php"] [unique_id "aU6ii-w_ihNZR5L8vEWpYQAAAZU"]
[Fri Dec 26 22:58:22.410741 2025] [:error] [pid 7160:tid 7164] [client 20.196.89.188:35603] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/litanies.php"] [unique_id "aU6ijuw_ihNZR5L8vEWpZwAAAYE"]
[Fri Dec 26 22:58:27.099606 2025] [:error] [pid 28268:tid 28297] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/litanies.php
[Fri Dec 26 22:58:27.270197 2025] [:error] [pid 28268:tid 28283] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Fri Dec 26 22:58:27.595101 2025] [:error] [pid 28268:tid 28290] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Fri Dec 26 22:58:27.781287 2025] [:error] [pid 28268:tid 28276] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/kwm4.php
[Fri Dec 26 22:58:27.977719 2025] [:error] [pid 28268:tid 28279] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/just2.php
[Fri Dec 26 22:58:28.183971 2025] [:error] [pid 28268:tid 28281] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Fri Dec 26 22:58:28.364163 2025] [:error] [pid 28268:tid 28295] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/geger.php
[Fri Dec 26 22:58:28.564981 2025] [:error] [pid 28268:tid 28287] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/let.php
[Fri Dec 26 22:58:28.712134 2025] [:error] [pid 28268:tid 28285] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/np.php
[Fri Dec 26 22:58:28.868471 2025] [:error] [pid 28268:tid 28292] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/ask.php
[Fri Dec 26 22:58:29.137214 2025] [:error] [pid 28268:tid 28289] [client 20.196.89.188:28103] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Fri Dec 26 22:58:29.273641 2025] [:error] [pid 28268:tid 28280] [client 20.196.89.188:28103] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aU6ilXc_KuO_55-uPTTQaAAAAAU"]
[Fri Dec 26 22:58:34.558848 2025] [:error] [pid 34865:tid 34882] [client 20.196.89.188:41530] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aU6imqi4zjVVKBdvuTQKOQAAAU8"]
[Fri Dec 26 22:58:35.793309 2025] [:error] [pid 28355:tid 28368] [client 20.196.89.188:38434] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aU6im7sFqKXf7ADZcTY25AAAAMs"]
[Fri Dec 26 22:58:40.933590 2025] [:error] [pid 7160:tid 7170] [client 20.196.89.188:14274] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aU6ioOw_ihNZR5L8vEWpgAAAAYc"]
[Fri Dec 26 22:58:44.651415 2025] [:error] [pid 28268:tid 28282] [client 20.196.89.188:13374] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mek.php"] [unique_id "aU6ipHc_KuO_55-uPTTQgwAAAAc"]
[Fri Dec 26 22:58:46.270104 2025] [:error] [pid 7160:tid 7187] [client 20.196.89.188:32763] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mek.php"] [unique_id "aU6ipuw_ihNZR5L8vEWphgAAAZg"]
[Fri Dec 26 22:58:47.446670 2025] [:error] [pid 34865:tid 34886] [client 20.196.89.188:38028] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mek.php"] [unique_id "aU6ip6i4zjVVKBdvuTQKSQAAAVM"]
[Fri Dec 26 22:58:48.968505 2025] [:error] [pid 34865:tid 34877] [client 20.196.89.188:13323] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mek.php"] [unique_id "aU6iqKi4zjVVKBdvuTQKSwAAAUo"]
[Fri Dec 26 22:58:50.845664 2025] [:error] [pid 7160:tid 7183] [client 20.196.89.188:37594] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU6iquw_ihNZR5L8vEWpkQAAAZQ"]
[Fri Dec 26 22:58:53.438939 2025] [:error] [pid 28268:tid 28294] [client 20.196.89.188:14311] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU6irXc_KuO_55-uPTTQkgAAABM"]
[Fri Dec 26 22:58:54.424375 2025] [:error] [pid 28269:tid 28304] [client 20.196.89.188:32737] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU6irp3ZK8bJ-c9-kjOoOgAAAEI"]
[Fri Dec 26 22:58:56.002591 2025] [:error] [pid 34865:tid 34884] [client 20.196.89.188:13817] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fjpeb.php"] [unique_id "aU6isKi4zjVVKBdvuTQKUgAAAVE"]
[Fri Dec 26 22:58:57.149431 2025] [:error] [pid 34865:tid 34874] [client 20.196.89.188:13789] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ex.php"] [unique_id "aU6isai4zjVVKBdvuTQKVQAAAUc"]
[Fri Dec 26 22:58:59.566195 2025] [:error] [pid 28270:tid 28344] [client 20.196.89.188:28151] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ex.php"] [unique_id "aU6is19Ac79_ckdPN5J0AAAAAI8"]
[Fri Dec 26 22:59:08.108483 2025] [:error] [pid 28270:tid 28336] [client 20.196.89.188:13540] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ex.php"] [unique_id "aU6ivF9Ac79_ckdPN5J0CAAAAIc"]
[Fri Dec 26 22:59:08.684862 2025] [:error] [pid 7160:tid 7174] [client 20.196.89.188:14296] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ex.php"] [unique_id "aU6ivOw_ihNZR5L8vEWpqQAAAYs"]
[Fri Dec 26 22:59:11.704907 2025] [:error] [pid 28268:tid 28287] [client 20.196.89.188:41334] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aU6iv3c_KuO_55-uPTTQpwAAAAw"]
[Fri Dec 26 22:59:12.564495 2025] [:error] [pid 15063:tid 15067] [client 20.196.89.188:29020] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aU6iwODsf_aL46Jy7z8x6gAAAQI"]
[Fri Dec 26 22:59:13.332298 2025] [:error] [pid 15063:tid 15076] [client 20.196.89.188:37631] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aU6iweDsf_aL46Jy7z8x7gAAAQs"]
[Fri Dec 26 22:59:15.455891 2025] [:error] [pid 7160:tid 7186] [client 20.196.89.188:33523] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aU6iw-w_ihNZR5L8vEWptwAAAZc"]
[Fri Dec 26 22:59:18.062650 2025] [:error] [pid 28270:tid 28353] [client 20.196.89.188:31924] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aU6ixl9Ac79_ckdPN5J0FgAAAJg"]
[Fri Dec 26 22:59:23.836698 2025] [:error] [pid 34865:tid 34879] [client 20.196.89.188:13514] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aU6iy6i4zjVVKBdvuTQKcQAAAUw"]
[Fri Dec 26 22:59:39.362963 2025] [:error] [pid 7160:tid 7183] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Dec 26 22:59:39.589753 2025] [:error] [pid 7160:tid 7175] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/shlo.php
[Fri Dec 26 22:59:39.730899 2025] [:error] [pid 7160:tid 7180] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/sec.php
[Fri Dec 26 22:59:39.890055 2025] [:error] [pid 7160:tid 7168] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Fri Dec 26 22:59:40.040221 2025] [:error] [pid 7160:tid 7174] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Dec 26 22:59:40.200364 2025] [:error] [pid 7160:tid 7166] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Fri Dec 26 22:59:40.431870 2025] [:error] [pid 7160:tid 7177] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Fri Dec 26 22:59:40.613635 2025] [:error] [pid 7160:tid 7172] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/bluejackets.php
[Fri Dec 26 22:59:40.751932 2025] [:error] [pid 7160:tid 7167] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Fri Dec 26 22:59:40.891370 2025] [:error] [pid 7160:tid 7182] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/sx21_1.php
[Fri Dec 26 22:59:41.053489 2025] [:error] [pid 7160:tid 7164] [client 20.196.89.188:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Fri Dec 26 22:59:41.192299 2025] [:error] [pid 7160:tid 7176] [client 20.196.89.188:40843] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU6i3ew_ihNZR5L8vEWp-gAAAY0"]
[Fri Dec 26 22:59:41.845246 2025] [:error] [pid 7160:tid 7163] [client 20.196.89.188:27171] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU6i3ew_ihNZR5L8vEWp-wAAAYA"]
[Fri Dec 26 22:59:44.223565 2025] [:error] [pid 28270:tid 28334] [client 20.196.89.188:29625] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU6i4F9Ac79_ckdPN5J0QwAAAIU"]
[Fri Dec 26 22:59:50.323722 2025] [:error] [pid 15063:tid 15073] [client 20.196.89.188:14171] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx9.php"] [unique_id "aU6i5uDsf_aL46Jy7z8yMAAAAQg"]
[Fri Dec 26 22:59:54.174680 2025] [:error] [pid 28268:tid 28275] [client 20.196.89.188:32459] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU6i6nc_KuO_55-uPTTQwwAAAAA"]
[Fri Dec 26 22:59:55.051924 2025] [:error] [pid 28268:tid 28290] [client 20.196.89.188:13875] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU6i63c_KuO_55-uPTTQxQAAAA8"]
[Fri Dec 26 22:59:58.756631 2025] [:error] [pid 28269:tid 28326] [client 20.196.89.188:26583] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU6i7p3ZK8bJ-c9-kjOodwAAAFg"]
[Fri Dec 26 23:00:01.555247 2025] [:error] [pid 15063:tid 15089] [client 20.196.89.188:14141] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU6i8eDsf_aL46Jy7z8yRQAAARg"]
[Fri Dec 26 23:00:03.139830 2025] [:error] [pid 7160:tid 7166] [client 20.196.89.188:32911] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aU6i8-w_ihNZR5L8vEWqHwAAAYM"]
[Fri Dec 26 23:00:03.906717 2025] [:error] [pid 28270:tid 28329] [client 20.196.89.188:50303] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aU6i819Ac79_ckdPN5J0WAAAAIA"]
[Fri Dec 26 23:00:04.701391 2025] [:error] [pid 28270:tid 28332] [client 20.196.89.188:14262] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aU6i9F9Ac79_ckdPN5J0WQAAAIM"]
[Fri Dec 26 23:00:11.397310 2025] [:error] [pid 28270:tid 28345] [client 20.196.89.188:32228] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aU6i-19Ac79_ckdPN5J0YAAAAJA"]
[Fri Dec 26 23:00:13.620629 2025] [:error] [pid 7160:tid 7168] [client 20.196.89.188:44269] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfvul.php"] [unique_id "aU6i_ew_ihNZR5L8vEWqKwAAAYU"]
[Fri Dec 26 23:00:37.546223 2025] [:error] [pid 15063:tid 15084] [client 20.196.89.188:52604] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/icdwb.php"] [unique_id "aU6jFeDsf_aL46Jy7z8yggAAARM"]
[Fri Dec 26 23:00:40.500633 2025] [:error] [pid 7160:tid 7186] [client 20.196.89.188:30607] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/icdwb.php"] [unique_id "aU6jGOw_ihNZR5L8vEWqRAAAAZc"]
[Fri Dec 26 23:00:42.726518 2025] [:error] [pid 28270:tid 28345] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/icdwb.php
[Fri Dec 26 23:00:42.899911 2025] [:error] [pid 28270:tid 28351] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/ticket.php
[Fri Dec 26 23:00:43.255022 2025] [:error] [pid 28270:tid 28346] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Dec 26 23:00:43.397758 2025] [:error] [pid 28270:tid 28347] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Dec 26 23:00:43.539958 2025] [:error] [pid 28270:tid 28353] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/amphicyon.php
[Fri Dec 26 23:00:43.711034 2025] [:error] [pid 28270:tid 28338] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Fri Dec 26 23:00:43.886030 2025] [:error] [pid 28270:tid 28330] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/lock1.php
[Fri Dec 26 23:00:44.049563 2025] [:error] [pid 28270:tid 28329] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Fri Dec 26 23:00:44.202783 2025] [:error] [pid 28270:tid 28336] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Fri Dec 26 23:00:44.351193 2025] [:error] [pid 28270:tid 28335] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Fri Dec 26 23:00:44.490290 2025] [:error] [pid 28270:tid 28337] [client 20.196.89.188:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Fri Dec 26 23:00:44.742202 2025] [:error] [pid 28270:tid 28350] [client 20.196.89.188:32671] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU6jHF9Ac79_ckdPN5J0iwAAAJU"]
[Fri Dec 26 23:00:48.925987 2025] [:error] [pid 7160:tid 7187] [client 20.196.89.188:37854] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU6jIOw_ihNZR5L8vEWqVwAAAZg"]
[Fri Dec 26 23:00:51.791129 2025] [:error] [pid 28270:tid 28333] [client 20.196.89.188:27387] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU6jI19Ac79_ckdPN5J0jgAAAIQ"]
[Fri Dec 26 23:00:53.832464 2025] [:error] [pid 15063:tid 15086] [client 20.196.89.188:34737] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aU6jJeDsf_aL46Jy7z8ytAAAARU"]
[Fri Dec 26 23:00:55.267790 2025] [:error] [pid 7160:tid 7169] [client 20.196.89.188:26779] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU6jJ-w_ihNZR5L8vEWqYAAAAYY"]
[Fri Dec 26 23:00:57.535565 2025] [:error] [pid 28268:tid 28285] [client 20.196.89.188:50578] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU6jKXc_KuO_55-uPTTRCQAAAAo"]
[Fri Dec 26 23:01:01.048806 2025] [:error] [pid 34865:tid 34874] [client 20.196.89.188:34861] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU6jLai4zjVVKBdvuTQLBwAAAUc"]
[Fri Dec 26 23:01:04.488958 2025] [:error] [pid 28268:tid 28287] [client 20.196.89.188:26822] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU6jMHc_KuO_55-uPTTREgAAAAw"]
[Fri Dec 26 23:01:07.717833 2025] [:error] [pid 28269:tid 28305] [client 20.196.89.188:34702] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx.php"] [unique_id "aU6jM53ZK8bJ-c9-kjOosAAAAEM"]
[Fri Dec 26 23:01:10.691870 2025] [:error] [pid 28269:tid 28319] [client 20.196.89.188:35228] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx.php"] [unique_id "aU6jNp3ZK8bJ-c9-kjOosgAAAFE"]
[Fri Dec 26 23:01:24.394482 2025] [:error] [pid 28270:tid 28330] [client 20.196.89.188:32253] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU6jRF9Ac79_ckdPN5J0ogAAAIE"]
[Fri Dec 26 23:01:26.414924 2025] [:error] [pid 28268:tid 28275] [client 20.196.89.188:14048] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU6jRnc_KuO_55-uPTTRIQAAAAA"]
[Fri Dec 26 23:01:30.542853 2025] [:error] [pid 7160:tid 7181] [client 20.196.89.188:31485] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU6jSuw_ihNZR5L8vEWqgAAAAZI"]
[Fri Dec 26 23:01:37.660934 2025] [:error] [pid 28268:tid 28280] [client 20.196.89.188:32252] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aU6jUXc_KuO_55-uPTTRKAAAAAU"]
[Fri Dec 26 23:01:41.044889 2025] [:error] [pid 34865:tid 34874] [client 20.196.89.188:32980] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aU6jVai4zjVVKBdvuTQLPQAAAUc"]
[Fri Dec 26 23:01:43.137889 2025] [:error] [pid 7160:tid 7181] [client 20.196.89.188:40590] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aU6jV-w_ihNZR5L8vEWqiwAAAZI"]
[Fri Dec 26 23:01:44.313957 2025] [:error] [pid 34865:tid 34876] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Fri Dec 26 23:01:44.497705 2025] [:error] [pid 34865:tid 34878] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/xpw.php
[Fri Dec 26 23:01:44.848198 2025] [:error] [pid 34865:tid 34886] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Fri Dec 26 23:01:45.026935 2025] [:error] [pid 34865:tid 34867] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/akp.php
[Fri Dec 26 23:01:45.544240 2025] [:error] [pid 34865:tid 34879] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/cwsd.php
[Fri Dec 26 23:01:45.712864 2025] [:error] [pid 34865:tid 34883] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/tll.php
[Fri Dec 26 23:01:46.090883 2025] [:error] [pid 34865:tid 34877] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Fri Dec 26 23:01:46.271895 2025] [:error] [pid 34865:tid 34881] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/idea.php
[Fri Dec 26 23:01:46.447457 2025] [:error] [pid 34865:tid 34875] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/pepe.php
[Fri Dec 26 23:01:46.610689 2025] [:error] [pid 34865:tid 34868] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Fri Dec 26 23:01:46.793226 2025] [:error] [pid 34865:tid 34889] [client 20.196.89.188:31433] File does not exist: /usr/local/apache/htdocs/suspended-page/yca.php
[Fri Dec 26 23:01:47.423248 2025] [:error] [pid 34865:tid 34871] [client 20.196.89.188:31433] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU6jW6i4zjVVKBdvuTQLTQAAAUQ"]
[Fri Dec 26 23:01:51.369008 2025] [:error] [pid 28355:tid 28361] [client 20.196.89.188:38470] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU6jX7sFqKXf7ADZcTY3ggAAAMQ"]
[Fri Dec 26 23:01:56.583097 2025] [:error] [pid 34865:tid 34888] [client 20.196.89.188:32398] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU6jZKi4zjVVKBdvuTQLZQAAAVU"]
[Fri Dec 26 23:01:59.196058 2025] [:error] [pid 28270:tid 28335] [client 20.196.89.188:37534] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU6jZ19Ac79_ckdPN5J0vgAAAIY"]
[Fri Dec 26 23:02:02.776306 2025] [:error] [pid 7160:tid 7178] [client 20.196.89.188:31211] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aU6jauw_ihNZR5L8vEWquwAAAY8"]
[Fri Dec 26 23:02:03.938448 2025] [:error] [pid 28270:tid 28344] [client 20.196.89.188:32978] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aU6ja19Ac79_ckdPN5J0xwAAAI8"]
[Fri Dec 26 23:02:05.848401 2025] [:error] [pid 28269:tid 28315] [client 20.196.89.188:37547] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ot.php"] [unique_id "aU6jbZ3ZK8bJ-c9-kjOo3wAAAE0"]
[Fri Dec 26 23:02:15.826946 2025] [:error] [pid 34865:tid 34877] [client 20.196.89.188:31723] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU6jd6i4zjVVKBdvuTQLjwAAAUo"]
[Fri Dec 26 23:02:16.955236 2025] [:error] [pid 34865:tid 34882] [client 20.196.89.188:26743] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU6jeKi4zjVVKBdvuTQLkAAAAU8"]
[Fri Dec 26 23:02:19.843435 2025] [:error] [pid 28268:tid 28280] [client 20.196.89.188:33957] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU6je3c_KuO_55-uPTTRRwAAAAU"]
[Fri Dec 26 23:02:20.746149 2025] [:error] [pid 28269:tid 28321] [client 20.196.89.188:33934] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aU6jfJ3ZK8bJ-c9-kjOo4QAAAFM"]
[Fri Dec 26 23:02:22.033256 2025] [:error] [pid 28269:tid 28302] [client 20.196.89.188:34766] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU6jfp3ZK8bJ-c9-kjOo5AAAAEA"]
[Fri Dec 26 23:02:22.912370 2025] [:error] [pid 15063:tid 15067] [client 20.196.89.188:34761] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU6jfuDsf_aL46Jy7z8y_gAAAQI"]
[Fri Dec 26 23:02:27.753931 2025] [:error] [pid 28268:tid 28290] [client 20.196.89.188:37762] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU6jg3c_KuO_55-uPTTRUwAAAA8"]
[Fri Dec 26 23:02:29.437773 2025] [:error] [pid 28268:tid 28283] [client 20.196.89.188:31141] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/j.php"] [unique_id "aU6jhXc_KuO_55-uPTTRVwAAAAg"]
[Fri Dec 26 23:02:29.975701 2025] [:error] [pid 28355:tid 28360] [client 20.196.89.188:31128] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aU6jhbsFqKXf7ADZcTY3mwAAAMM"]
[Fri Dec 26 23:02:58.648012 2025] [:error] [pid 34865:tid 34885] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/ucp.php
[Fri Dec 26 23:02:58.982052 2025] [:error] [pid 34865:tid 34872] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/zse.php
[Fri Dec 26 23:02:59.159295 2025] [:error] [pid 34865:tid 34876] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Fri Dec 26 23:02:59.337271 2025] [:error] [pid 34865:tid 34890] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Dec 26 23:02:59.512675 2025] [:error] [pid 34865:tid 34883] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Fri Dec 26 23:02:59.692132 2025] [:error] [pid 34865:tid 34867] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Dec 26 23:02:59.871180 2025] [:error] [pid 34865:tid 34891] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/orm.php
[Fri Dec 26 23:03:00.067999 2025] [:error] [pid 34865:tid 34886] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Fri Dec 26 23:03:00.273516 2025] [:error] [pid 34865:tid 34868] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Dec 26 23:03:00.530153 2025] [:error] [pid 34865:tid 34882] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Dec 26 23:03:01.891846 2025] [:error] [pid 34865:tid 34882] [client 20.196.89.188:28560] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Fri Dec 26 23:03:02.071327 2025] [:error] [pid 34865:tid 34873] [client 20.196.89.188:28560] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolv.php"] [unique_id "aU6jpqi4zjVVKBdvuTQLvgAAAUY"]
[Fri Dec 26 23:03:03.015579 2025] [:error] [pid 34865:tid 34884] [client 20.196.89.188:35594] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolv.php"] [unique_id "aU6jp6i4zjVVKBdvuTQLwgAAAVE"]
[Fri Dec 26 23:03:04.014034 2025] [:error] [pid 15063:tid 15079] [client 20.196.89.188:28599] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolv.php"] [unique_id "aU6jqODsf_aL46Jy7z8zGgAAAQ4"]
[Fri Dec 26 23:03:19.535364 2025] [:error] [pid 15063:tid 15069] [client 20.196.89.188:38463] [client 20.196.89.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ea3f.php"] [unique_id "aU6jt-Dsf_aL46Jy7z8zIgAAAQQ"]
[Fri Dec 26 23:04:14.638929 2025] [:error] [pid 28269:tid 28318] [client 20.196.89.188:38059] File does not exist: /usr/local/apache/htdocs/suspended-page/price.php
[Fri Dec 26 23:04:14.947357 2025] [:error] [pid 28269:tid 28302] [client 20.196.89.188:38059] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Sat Dec 27 03:12:54.742791 2025] [:error] [pid 47566:tid 47582] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 27 03:12:54.862741 2025] [:error] [pid 47566:tid 47584] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Dec 27 03:12:55.944704 2025] [:error] [pid 47566:tid 47593] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/maint.php
[Sat Dec 27 03:12:56.074024 2025] [:error] [pid 47566:tid 47586] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Dec 27 03:12:56.195402 2025] [:error] [pid 47566:tid 47570] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Dec 27 03:12:56.316301 2025] [:error] [pid 47566:tid 47590] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Dec 27 03:12:56.437702 2025] [:error] [pid 47566:tid 47588] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 27 03:12:56.577777 2025] [:error] [pid 47566:tid 47581] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Sat Dec 27 03:12:56.708355 2025] [:error] [pid 47566:tid 47576] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 27 03:12:56.893626 2025] [:error] [pid 47566:tid 47573] [client 20.187.77.217:2860] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Dec 27 03:12:57.011664 2025] [:error] [pid 47566:tid 47578] [client 20.187.77.217:2860] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aU7eOayYgLfR4YwO7byuAgAAAQk"]
[Sat Dec 27 03:12:57.803661 2025] [:error] [pid 34274:tid 34290] [client 20.187.77.217:2501] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aU7eOc6fabpS0mfhiCExOgAAAM4"]
[Sat Dec 27 03:13:00.610869 2025] [:error] [pid 34188:tid 34241] [client 20.187.77.217:4841] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aU7ePA54j0mXgip5BAHJ7gAAAFU"]
[Sat Dec 27 03:13:02.249289 2025] [:error] [pid 34187:tid 34196] [client 20.187.77.217:4994] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aU7ePqv8srZGEpsIm8AWZAAAAAQ"]
[Sat Dec 27 03:13:03.306228 2025] [:error] [pid 34189:tid 34252] [client 20.187.77.217:4813] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU7ePwnn007DnMwSsfdI0QAAAIU"]
[Sat Dec 27 03:13:05.544045 2025] [:error] [pid 47566:tid 47577] [client 20.187.77.217:3853] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU7eQayYgLfR4YwO7byuBwAAAQg"]
[Sat Dec 27 03:13:07.224400 2025] [:error] [pid 34187:tid 34215] [client 20.187.77.217:4443] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU7eQ6v8srZGEpsIm8AWawAAABc"]
[Sat Dec 27 03:13:08.037416 2025] [:error] [pid 34274:tid 34298] [client 20.187.77.217:3488] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU7eRM6fabpS0mfhiCExQgAAANY"]
[Sat Dec 27 03:13:09.150761 2025] [:error] [pid 34188:tid 34222] [client 20.187.77.217:6288] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aU7eRQ54j0mXgip5BAHJ9QAAAEI"]
[Sat Dec 27 03:13:10.397712 2025] [:error] [pid 47566:tid 47573] [client 20.187.77.217:2525] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aU7eRqyYgLfR4YwO7byuDgAAAQQ"]
[Sat Dec 27 03:13:11.038748 2025] [:error] [pid 34187:tid 34196] [client 20.187.77.217:2526] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aU7eR6v8srZGEpsIm8AWbwAAAAQ"]
[Sat Dec 27 03:13:11.830971 2025] [:error] [pid 34188:tid 34229] [client 20.187.77.217:7406] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aU7eRw54j0mXgip5BAHJ-wAAAEk"]
[Sat Dec 27 03:13:13.775287 2025] [:error] [pid 34187:tid 34193] [client 20.187.77.217:6126] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aU7eSav8srZGEpsIm8AWcgAAAAE"]
[Sat Dec 27 03:13:16.643922 2025] [:error] [pid 34274:tid 34286] [client 20.187.77.217:4860] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aU7eTM6fabpS0mfhiCExUQAAAMo"]
[Sat Dec 27 03:13:18.785725 2025] [:error] [pid 34274:tid 34298] [client 20.187.77.217:2437] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aU7eTs6fabpS0mfhiCExVwAAANY"]
[Sat Dec 27 03:13:20.570829 2025] [:error] [pid 34274:tid 34300] [client 20.187.77.217:7416] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aU7eUM6fabpS0mfhiCExXQAAANg"]
[Sat Dec 27 03:13:22.696998 2025] [:error] [pid 34187:tid 34196] [client 20.187.77.217:6301] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin2.php"] [unique_id "aU7eUqv8srZGEpsIm8AWeAAAAAQ"]
[Sat Dec 27 03:13:23.631657 2025] [:error] [pid 47566:tid 47569] [client 20.187.77.217:2530] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin2.php"] [unique_id "aU7eU6yYgLfR4YwO7byuGAAAAQA"]
[Sat Dec 27 03:13:24.749135 2025] [:error] [pid 34189:tid 34254] [client 20.187.77.217:2440] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin2.php"] [unique_id "aU7eVAnn007DnMwSsfdI3gAAAIc"]
[Sat Dec 27 03:13:26.197587 2025] [:error] [pid 34189:tid 34263] [client 20.187.77.217:3029] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin2.php"] [unique_id "aU7eVgnn007DnMwSsfdI4QAAAJA"]
[Sat Dec 27 03:13:27.281417 2025] [:error] [pid 34188:tid 34241] [client 20.187.77.217:2888] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7eVw54j0mXgip5BAHKFgAAAFU"]
[Sat Dec 27 03:13:28.462861 2025] [:error] [pid 34188:tid 34230] [client 20.187.77.217:4853] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7eWA54j0mXgip5BAHKFwAAAEo"]
[Sat Dec 27 03:13:29.138906 2025] [:error] [pid 34188:tid 34243] [client 20.187.77.217:3069] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7eWQ54j0mXgip5BAHKGAAAAFc"]
[Sat Dec 27 03:13:29.771484 2025] [:error] [pid 34188:tid 34236] [client 20.187.77.217:8181] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7eWQ54j0mXgip5BAHKGgAAAFA"]
[Sat Dec 27 03:13:31.247837 2025] [:error] [pid 34274:tid 34280] [client 20.187.77.217:4809] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aU7eW86fabpS0mfhiCExZQAAAMQ"]
[Sat Dec 27 03:13:33.263185 2025] [:error] [pid 47566:tid 47587] [client 20.187.77.217:8167] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aU7eXayYgLfR4YwO7byuJAAAARI"]
[Sat Dec 27 03:13:34.474437 2025] [:error] [pid 34188:tid 34241] [client 20.187.77.217:3480] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aU7eXg54j0mXgip5BAHKIgAAAFU"]
[Sat Dec 27 03:13:35.342439 2025] [:error] [pid 34189:tid 34251] [client 20.187.77.217:1717] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aU7eXwnn007DnMwSsfdI7wAAAIQ"]
[Sat Dec 27 03:13:36.794474 2025] [:error] [pid 34187:tid 34203] [client 20.187.77.217:1612] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aU7eYKv8srZGEpsIm8AWfQAAAAs"]
[Sat Dec 27 03:13:37.648973 2025] [:error] [pid 34189:tid 34269] [client 20.187.77.217:1650] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aU7eYQnn007DnMwSsfdI9AAAAJY"]
[Sat Dec 27 03:13:38.691127 2025] [:error] [pid 34188:tid 34234] [client 20.187.77.217:4308] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aU7eYg54j0mXgip5BAHKJwAAAE4"]
[Sat Dec 27 03:13:41.069474 2025] [:error] [pid 34274:tid 34291] [client 20.187.77.217:5951] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aU7eZc6fabpS0mfhiCExcgAAAM8"]
[Sat Dec 27 03:13:42.780990 2025] [:error] [pid 47566:tid 47591] [client 20.187.77.217:5773] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7eZqyYgLfR4YwO7byuLwAAARY"]
[Sat Dec 27 03:13:44.211901 2025] [:error] [pid 47566:tid 47573] [client 20.187.77.217:4236] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7eaKyYgLfR4YwO7byuNgAAAQQ"]
[Sat Dec 27 03:13:45.987367 2025] [:error] [pid 47566:tid 47586] [client 20.187.77.217:3769] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7eaayYgLfR4YwO7byuPAAAARE"]
[Sat Dec 27 03:13:47.897360 2025] [:error] [pid 47566:tid 47588] [client 20.187.77.217:1267] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7ea6yYgLfR4YwO7byuQwAAARM"]
[Sat Dec 27 03:13:49.040911 2025] [:error] [pid 34189:tid 34259] [client 20.187.77.217:4279] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7ebQnn007DnMwSsfdJAgAAAIw"]
[Sat Dec 27 03:13:50.866123 2025] [:error] [pid 47566:tid 47570] [client 20.187.77.217:1992] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7ebqyYgLfR4YwO7byuWwAAAQE"]
[Sat Dec 27 03:13:52.061652 2025] [:error] [pid 47566:tid 47570] [client 20.187.77.217:3742] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7ecKyYgLfR4YwO7byubwAAAQE"]
[Sat Dec 27 03:13:52.629613 2025] [:error] [pid 34274:tid 34287] [client 20.187.77.217:5762] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7ecM6fabpS0mfhiCExhAAAAMs"]
[Sat Dec 27 03:13:53.609592 2025] [:error] [pid 34187:tid 34212] [client 20.187.77.217:3747] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aU7ecav8srZGEpsIm8AWoQAAABQ"]
[Sat Dec 27 03:13:54.564582 2025] [:error] [pid 34187:tid 34206] [client 20.187.77.217:5795] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aU7ecqv8srZGEpsIm8AWpAAAAA4"]
[Sat Dec 27 03:13:55.423038 2025] [:error] [pid 34274:tid 34294] [client 20.187.77.217:5911] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aU7ec86fabpS0mfhiCExigAAANI"]
[Sat Dec 27 03:13:56.293870 2025] [:error] [pid 34188:tid 34236] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Dec 27 03:13:56.418506 2025] [:error] [pid 34188:tid 34233] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/ki1k.php
[Sat Dec 27 03:13:56.573582 2025] [:error] [pid 34188:tid 34234] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Sat Dec 27 03:13:56.693247 2025] [:error] [pid 34188:tid 34237] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Dec 27 03:13:56.825131 2025] [:error] [pid 34188:tid 34227] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Sat Dec 27 03:13:56.968983 2025] [:error] [pid 34188:tid 34239] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sat Dec 27 03:13:57.321293 2025] [:error] [pid 34188:tid 34231] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Dec 27 03:13:57.488882 2025] [:error] [pid 34188:tid 34220] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Sat Dec 27 03:13:57.908643 2025] [:error] [pid 34188:tid 34229] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Sat Dec 27 03:13:58.036097 2025] [:error] [pid 34188:tid 34238] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sat Dec 27 03:13:58.170577 2025] [:error] [pid 34188:tid 34221] [client 20.187.77.217:5807] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sat Dec 27 03:13:58.286938 2025] [:error] [pid 34188:tid 34230] [client 20.187.77.217:5807] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aU7edg54j0mXgip5BAHKQgAAAEo"]
[Sat Dec 27 03:13:59.349948 2025] [:error] [pid 34188:tid 34228] [client 20.187.77.217:2504] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aU7edw54j0mXgip5BAHKRAAAAEg"]
[Sat Dec 27 03:14:04.594127 2025] [:error] [pid 34187:tid 34215] [client 20.187.77.217:4863] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aU7efKv8srZGEpsIm8AWsAAAABc"]
[Sat Dec 27 03:14:06.561126 2025] [:error] [pid 34187:tid 34209] [client 20.187.77.217:2499] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aU7efqv8srZGEpsIm8AWswAAABE"]
[Sat Dec 27 03:14:08.102898 2025] [:error] [pid 34187:tid 34203] [client 20.187.77.217:3009] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brand.php"] [unique_id "aU7egKv8srZGEpsIm8AWtwAAAAs"]
[Sat Dec 27 03:14:10.933362 2025] [:error] [pid 34187:tid 34195] [client 20.187.77.217:1623] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brand.php"] [unique_id "aU7egqv8srZGEpsIm8AWvAAAAAM"]
[Sat Dec 27 03:14:12.658973 2025] [:error] [pid 34189:tid 34265] [client 20.187.77.217:1621] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brand.php"] [unique_id "aU7ehAnn007DnMwSsfdJIQAAAJI"]
[Sat Dec 27 03:14:15.104020 2025] [:error] [pid 47566:tid 47582] [client 20.187.77.217:3465] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brand.php"] [unique_id "aU7eh6yYgLfR4YwO7byulQAAAQ0"]
[Sat Dec 27 03:14:16.577907 2025] [:error] [pid 34274:tid 34299] [client 20.187.77.217:3759] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aU7eiM6fabpS0mfhiCExpwAAANc"]
[Sat Dec 27 03:14:20.236914 2025] [:error] [pid 47566:tid 47570] [client 20.187.77.217:1654] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aU7ejKyYgLfR4YwO7byunwAAAQE"]
[Sat Dec 27 03:14:22.209491 2025] [:error] [pid 34274:tid 34293] [client 20.187.77.217:5808] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aU7ejs6fabpS0mfhiCExwgAAANE"]
[Sat Dec 27 03:14:24.394081 2025] [:error] [pid 34274:tid 34288] [client 20.187.77.217:2149] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aU7ekM6fabpS0mfhiCExygAAAMw"]
[Sat Dec 27 03:14:25.553260 2025] [:error] [pid 34274:tid 34290] [client 20.187.77.217:4764] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwnd.php"] [unique_id "aU7ekc6fabpS0mfhiCExzAAAAM4"]
[Sat Dec 27 03:14:27.627228 2025] [:error] [pid 34274:tid 34285] [client 20.187.77.217:4136] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwnd.php"] [unique_id "aU7ek86fabpS0mfhiCEx0gAAAMk"]
[Sat Dec 27 03:14:28.495323 2025] [:error] [pid 34189:tid 34262] [client 20.187.77.217:6611] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwnd.php"] [unique_id "aU7elAnn007DnMwSsfdJKwAAAI8"]
[Sat Dec 27 03:14:28.887494 2025] [:error] [pid 47566:tid 47572] [client 20.187.77.217:2144] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pwnd.php"] [unique_id "aU7elKyYgLfR4YwO7byutgAAAQM"]
[Sat Dec 27 03:14:29.202073 2025] [:error] [pid 34274:tid 34299] [client 20.187.77.217:4126] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "aU7elc6fabpS0mfhiCEx1wAAANc"]
[Sat Dec 27 03:14:29.726072 2025] [:error] [pid 47566:tid 47576] [client 20.187.77.217:4158] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "aU7elayYgLfR4YwO7byuuAAAAQc"]
[Sat Dec 27 03:14:30.668946 2025] [:error] [pid 47566:tid 47570] [client 20.187.77.217:2148] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "aU7elqyYgLfR4YwO7byuvAAAAQE"]
[Sat Dec 27 03:14:31.720103 2025] [:error] [pid 34189:tid 34268] [client 20.187.77.217:4765] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "aU7elwnn007DnMwSsfdJLQAAAJU"]
[Sat Dec 27 03:14:32.860652 2025] [:error] [pid 34189:tid 34270] [client 20.187.77.217:6655] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714170928.php"] [unique_id "aU7emAnn007DnMwSsfdJMgAAAJc"]
[Sat Dec 27 03:14:34.306120 2025] [:error] [pid 34274:tid 34296] [client 20.187.77.217:4103] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714170928.php"] [unique_id "aU7ems6fabpS0mfhiCEx4gAAANQ"]
[Sat Dec 27 03:14:35.066814 2025] [:error] [pid 34274:tid 34286] [client 20.187.77.217:3573] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714170928.php"] [unique_id "aU7em86fabpS0mfhiCEx5QAAAMo"]
[Sat Dec 27 03:14:36.183922 2025] [:error] [pid 34188:tid 34230] [client 20.187.77.217:4125] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714170928.php"] [unique_id "aU7enA54j0mXgip5BAHKWwAAAEo"]
[Sat Dec 27 03:14:38.100988 2025] [:error] [pid 34274:tid 34282] [client 20.187.77.217:1627] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714203832.php"] [unique_id "aU7ens6fabpS0mfhiCEx8QAAAMY"]
[Sat Dec 27 03:14:39.151082 2025] [:error] [pid 47566:tid 47573] [client 20.187.77.217:6631] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714203832.php"] [unique_id "aU7en6yYgLfR4YwO7byuxgAAAQQ"]
[Sat Dec 27 03:14:40.206344 2025] [:error] [pid 47566:tid 47577] [client 20.187.77.217:3540] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714203832.php"] [unique_id "aU7eoKyYgLfR4YwO7byuywAAAQg"]
[Sat Dec 27 03:14:42.149384 2025] [:error] [pid 47566:tid 47590] [client 20.187.77.217:1214] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_250714203832.php"] [unique_id "aU7eoqyYgLfR4YwO7byu1AAAARU"]
[Sat Dec 27 03:14:44.018478 2025] [:error] [pid 34274:tid 34278] [client 20.187.77.217:3528] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aU7epM6fabpS0mfhiCEx_AAAAMI"]
[Sat Dec 27 03:14:45.302428 2025] [:error] [pid 34189:tid 34271] [client 20.187.77.217:2135] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aU7epQnn007DnMwSsfdJOgAAAJg"]
[Sat Dec 27 03:14:45.867126 2025] [:error] [pid 34189:tid 34248] [client 20.187.77.217:1180] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aU7epQnn007DnMwSsfdJOwAAAIE"]
[Sat Dec 27 03:14:48.827373 2025] [:error] [pid 34274:tid 34298] [client 20.187.77.217:6612] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aU7eqM6fabpS0mfhiCEyAgAAANY"]
[Sat Dec 27 03:14:50.024669 2025] [:error] [pid 34189:tid 34257] [client 20.187.77.217:4147] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-post.php"] [unique_id "aU7eqgnn007DnMwSsfdJQQAAAIo"]
[Sat Dec 27 03:14:51.619761 2025] [:error] [pid 47566:tid 47582] [client 20.187.77.217:3543] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-post.php"] [unique_id "aU7eq6yYgLfR4YwO7byu4wAAAQ0"]
[Sat Dec 27 03:14:54.618627 2025] [:error] [pid 34188:tid 34229] [client 20.187.77.217:3547] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-post.php"] [unique_id "aU7erg54j0mXgip5BAHKbQAAAEk"]
[Sat Dec 27 03:14:57.296735 2025] [:error] [pid 34189:tid 34260] [client 20.187.77.217:4751] [client 20.187.77.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-post.php"] [unique_id "aU7esQnn007DnMwSsfdJTQAAAI0"]
[Sat Dec 27 03:14:59.310660 2025] [:error] [pid 34189:tid 34259] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Sat Dec 27 03:14:59.526809 2025] [:error] [pid 34189:tid 34259] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sat Dec 27 03:14:59.653065 2025] [:error] [pid 34189:tid 34258] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Dec 27 03:14:59.783334 2025] [:error] [pid 34189:tid 34271] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/priv.php
[Sat Dec 27 03:14:59.920717 2025] [:error] [pid 34189:tid 34270] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/allez.php
[Sat Dec 27 03:15:00.056167 2025] [:error] [pid 34189:tid 34265] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sat Dec 27 03:15:00.178478 2025] [:error] [pid 34189:tid 34267] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sat Dec 27 03:15:00.299040 2025] [:error] [pid 34189:tid 34266] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/goat1.php
[Sat Dec 27 03:15:00.432185 2025] [:error] [pid 34189:tid 34248] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/class-envato-market-github.php
[Sat Dec 27 03:15:00.561011 2025] [:error] [pid 34189:tid 34255] [client 20.187.77.217:5930] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Sat Dec 27 03:15:02.427304 2025] [:error] [pid 34274:tid 34290] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/bless14.php
[Sat Dec 27 03:15:02.577378 2025] [:error] [pid 34274:tid 34300] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Dec 27 03:15:02.667942 2025] [:error] [pid 34274:tid 34294] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Sat Dec 27 03:15:02.793385 2025] [:error] [pid 34274:tid 34298] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Sat Dec 27 03:15:02.901437 2025] [:error] [pid 34274:tid 34279] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Sat Dec 27 03:15:02.994358 2025] [:error] [pid 34274:tid 34286] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/acwfihfh.php
[Sat Dec 27 03:15:03.112617 2025] [:error] [pid 34274:tid 34281] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/f8.php
[Sat Dec 27 03:15:03.221532 2025] [:error] [pid 34274:tid 34283] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/bras.php
[Sat Dec 27 03:15:03.559402 2025] [:error] [pid 34274:tid 34289] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/an8.php
[Sat Dec 27 03:15:03.946156 2025] [:error] [pid 34274:tid 34291] [client 4.194.49.120:38088] File does not exist: /usr/local/apache/htdocs/suspended-page/esp.php
[Sat Dec 27 03:15:04.054449 2025] [:error] [pid 34274:tid 34296] [client 4.194.49.120:38088] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aU7euM6fabpS0mfhiCEyJAAAANQ"]
[Sat Dec 27 03:15:04.576501 2025] [:error] [pid 34187:tid 34198] [client 4.194.49.120:38087] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aU7euKv8srZGEpsIm8AW3gAAAAY"]
[Sat Dec 27 03:15:06.347163 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:3274] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aU7eus6fabpS0mfhiCEyKAAAAME"]
[Sat Dec 27 03:15:07.293627 2025] [:error] [pid 34274:tid 34294] [client 4.194.49.120:43321] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aU7eu86fabpS0mfhiCEyKgAAANI"]
[Sat Dec 27 03:15:08.118820 2025] [:error] [pid 34188:tid 34240] [client 4.194.49.120:43280] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aU7evA54j0mXgip5BAHKeAAAAFQ"]
[Sat Dec 27 03:15:09.467353 2025] [:error] [pid 34274:tid 34292] [client 4.194.49.120:53946] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aU7evc6fabpS0mfhiCEyKwAAANA"]
[Sat Dec 27 03:15:10.090949 2025] [:error] [pid 34187:tid 34203] [client 4.194.49.120:47266] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aU7evqv8srZGEpsIm8AW4QAAAAs"]
[Sat Dec 27 03:15:10.450663 2025] [:error] [pid 34187:tid 34192] [client 4.194.49.120:47248] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aU7evqv8srZGEpsIm8AW4gAAAAA"]
[Sat Dec 27 03:15:10.997396 2025] [:error] [pid 34274:tid 34288] [client 4.194.49.120:47289] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aU7evs6fabpS0mfhiCEyLgAAAMw"]
[Sat Dec 27 03:15:13.519225 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:43283] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aU7ewc6fabpS0mfhiCEyMwAAAME"]
[Sat Dec 27 03:15:14.271206 2025] [:error] [pid 34274:tid 34287] [client 4.194.49.120:43316] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aU7ews6fabpS0mfhiCEyNgAAAMs"]
[Sat Dec 27 03:15:15.165263 2025] [:error] [pid 34188:tid 34236] [client 4.194.49.120:53889] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aU7eww54j0mXgip5BAHKfAAAAFA"]
[Sat Dec 27 03:15:18.342921 2025] [:error] [pid 47566:tid 47569] [client 4.194.49.120:47335] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aU7exqyYgLfR4YwO7byvFgAAAQA"]
[Sat Dec 27 03:15:19.710984 2025] [:error] [pid 47566:tid 47592] [client 4.194.49.120:3514] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aU7ex6yYgLfR4YwO7byvHgAAARc"]
[Sat Dec 27 03:15:20.366988 2025] [:error] [pid 34189:tid 34254] [client 4.194.49.120:36958] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aU7eyAnn007DnMwSsfdJbQAAAIc"]
[Sat Dec 27 03:15:21.390425 2025] [:error] [pid 34188:tid 34223] [client 4.194.49.120:3461] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aU7eyQ54j0mXgip5BAHKhgAAAEM"]
[Sat Dec 27 03:15:22.135656 2025] [:error] [pid 47566:tid 47581] [client 4.194.49.120:56631] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aU7eyqyYgLfR4YwO7byvIgAAAQw"]
[Sat Dec 27 03:15:22.929311 2025] [:error] [pid 34187:tid 34195] [client 4.194.49.120:42086] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aU7eyqv8srZGEpsIm8AW9AAAAAM"]
[Sat Dec 27 03:15:23.694095 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:3758] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aU7ey86fabpS0mfhiCEyRQAAAME"]
[Sat Dec 27 03:15:24.513315 2025] [:error] [pid 47566:tid 47583] [client 4.194.49.120:3516] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aU7ezKyYgLfR4YwO7byvNwAAAQ4"]
[Sat Dec 27 03:15:25.076141 2025] [:error] [pid 47566:tid 47571] [client 4.194.49.120:3754] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aU7ezayYgLfR4YwO7byvOwAAAQI"]
[Sat Dec 27 03:15:25.733829 2025] [:error] [pid 47566:tid 47584] [client 4.194.49.120:3738] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aU7ezayYgLfR4YwO7byvPwAAAQ8"]
[Sat Dec 27 03:15:27.787246 2025] [:error] [pid 34187:tid 34194] [client 4.194.49.120:62480] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aU7ez6v8srZGEpsIm8AW-wAAAAI"]
[Sat Dec 27 03:15:28.641492 2025] [:error] [pid 34187:tid 34199] [client 4.194.49.120:36973] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aU7e0Kv8srZGEpsIm8AW_QAAAAc"]
[Sat Dec 27 03:15:29.734516 2025] [:error] [pid 34189:tid 34251] [client 4.194.49.120:37035] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e0Qnn007DnMwSsfdJeAAAAIQ"]
[Sat Dec 27 03:15:30.477667 2025] [:error] [pid 34187:tid 34195] [client 4.194.49.120:40784] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e0qv8srZGEpsIm8AXAQAAAAM"]
[Sat Dec 27 03:15:30.905045 2025] [:error] [pid 34189:tid 34257] [client 4.194.49.120:57203] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e0gnn007DnMwSsfdJewAAAIo"]
[Sat Dec 27 03:15:31.604697 2025] [:error] [pid 34274:tid 34296] [client 4.194.49.120:40022] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e086fabpS0mfhiCEyTgAAANQ"]
[Sat Dec 27 03:15:32.265479 2025] [:error] [pid 34188:tid 34223] [client 4.194.49.120:36392] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws13.php"] [unique_id "aU7e1A54j0mXgip5BAHKlwAAAEM"]
[Sat Dec 27 03:15:33.524491 2025] [:error] [pid 34274:tid 34283] [client 4.194.49.120:40798] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws13.php"] [unique_id "aU7e1c6fabpS0mfhiCEyUAAAAMc"]
[Sat Dec 27 03:15:34.436540 2025] [:error] [pid 34187:tid 34204] [client 4.194.49.120:37014] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws13.php"] [unique_id "aU7e1qv8srZGEpsIm8AXCQAAAAw"]
[Sat Dec 27 03:15:35.608284 2025] [:error] [pid 34187:tid 34195] [client 4.194.49.120:40789] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws13.php"] [unique_id "aU7e16v8srZGEpsIm8AXDgAAAAM"]
[Sat Dec 27 03:15:36.226294 2025] [:error] [pid 47566:tid 47583] [client 4.194.49.120:36411] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aU7e2KyYgLfR4YwO7byvTQAAAQ4"]
[Sat Dec 27 03:15:37.105172 2025] [:error] [pid 34188:tid 34235] [client 4.194.49.120:40807] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aU7e2Q54j0mXgip5BAHKmgAAAE8"]
[Sat Dec 27 03:15:37.704198 2025] [:error] [pid 47566:tid 47580] [client 4.194.49.120:52684] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aU7e2ayYgLfR4YwO7byvUAAAAQs"]
[Sat Dec 27 03:15:38.591269 2025] [:error] [pid 34189:tid 34247] [client 4.194.49.120:52726] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aU7e2gnn007DnMwSsfdJhgAAAIA"]
[Sat Dec 27 03:15:39.783030 2025] [:error] [pid 34274:tid 34300] [client 4.194.49.120:59334] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww7.php"] [unique_id "aU7e286fabpS0mfhiCEyXAAAANg"]
[Sat Dec 27 03:15:40.510373 2025] [:error] [pid 34188:tid 34225] [client 4.194.49.120:3356] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww7.php"] [unique_id "aU7e3A54j0mXgip5BAHKnQAAAEU"]
[Sat Dec 27 03:15:41.581932 2025] [:error] [pid 34189:tid 34261] [client 4.194.49.120:36348] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww7.php"] [unique_id "aU7e3Qnn007DnMwSsfdJjAAAAI4"]
[Sat Dec 27 03:15:42.156032 2025] [:error] [pid 34189:tid 34264] [client 4.194.49.120:55889] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww7.php"] [unique_id "aU7e3gnn007DnMwSsfdJjwAAAJE"]
[Sat Dec 27 03:15:42.696093 2025] [:error] [pid 34189:tid 34248] [client 4.194.49.120:36324] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "aU7e3gnn007DnMwSsfdJkgAAAIE"]
[Sat Dec 27 03:15:43.490369 2025] [:error] [pid 34274:tid 34291] [client 4.194.49.120:3401] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "aU7e386fabpS0mfhiCEyYAAAAM8"]
[Sat Dec 27 03:15:44.283338 2025] [:error] [pid 34274:tid 34284] [client 4.194.49.120:55934] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "aU7e4M6fabpS0mfhiCEyZQAAAMg"]
[Sat Dec 27 03:15:44.922467 2025] [:error] [pid 34274:tid 34279] [client 4.194.49.120:55890] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "aU7e4M6fabpS0mfhiCEyZwAAAMM"]
[Sat Dec 27 03:15:45.798355 2025] [:error] [pid 34274:tid 34286] [client 4.194.49.120:3364] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aU7e4c6fabpS0mfhiCEyawAAAMo"]
[Sat Dec 27 03:15:46.735943 2025] [:error] [pid 34189:tid 34267] [client 4.194.49.120:42136] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aU7e4gnn007DnMwSsfdJmAAAAJQ"]
[Sat Dec 27 03:15:47.189899 2025] [:error] [pid 34274:tid 34284] [client 4.194.49.120:61809] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aU7e486fabpS0mfhiCEycQAAAMg"]
[Sat Dec 27 03:15:49.764611 2025] [:error] [pid 34187:tid 34212] [client 4.194.49.120:45126] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aU7e5av8srZGEpsIm8AXIgAAABQ"]
[Sat Dec 27 03:15:50.680146 2025] [:error] [pid 34189:tid 34255] [client 4.194.49.120:45142] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aU7e5gnn007DnMwSsfdJnAAAAIg"]
[Sat Dec 27 03:15:51.452354 2025] [:error] [pid 34189:tid 34247] [client 4.194.49.120:61784] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aU7e5wnn007DnMwSsfdJnQAAAIA"]
[Sat Dec 27 03:15:52.863475 2025] [:error] [pid 34187:tid 34201] [client 4.194.49.120:42167] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aU7e6Kv8srZGEpsIm8AXIwAAAAk"]
[Sat Dec 27 03:15:53.755162 2025] [:error] [pid 34274:tid 34284] [client 4.194.49.120:45129] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aU7e6c6fabpS0mfhiCEyegAAAMg"]
[Sat Dec 27 03:15:54.935062 2025] [:error] [pid 34187:tid 34207] [client 4.194.49.120:61321] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aU7e6qv8srZGEpsIm8AXKgAAAA8"]
[Sat Dec 27 03:15:55.518041 2025] [:error] [pid 34187:tid 34210] [client 4.194.49.120:3346] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aU7e66v8srZGEpsIm8AXLQAAABI"]
[Sat Dec 27 03:15:56.151164 2025] [:error] [pid 47566:tid 47581] [client 4.194.49.120:61776] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aU7e7KyYgLfR4YwO7byvdwAAAQw"]
[Sat Dec 27 03:15:57.028981 2025] [:error] [pid 47566:tid 47585] [client 4.194.49.120:39547] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aU7e7ayYgLfR4YwO7byveQAAARA"]
[Sat Dec 27 03:15:57.390454 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:53269] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aU7e7ayYgLfR4YwO7byvegAAAQY"]
[Sat Dec 27 03:15:57.854337 2025] [:error] [pid 34189:tid 34257] [client 4.194.49.120:61808] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aU7e7Qnn007DnMwSsfdJpgAAAIo"]
[Sat Dec 27 03:15:58.477856 2025] [:error] [pid 34274:tid 34280] [client 4.194.49.120:61801] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aU7e7s6fabpS0mfhiCEyhQAAAMQ"]
[Sat Dec 27 03:15:58.849486 2025] [:error] [pid 34189:tid 34248] [client 4.194.49.120:42129] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aU7e7gnn007DnMwSsfdJpwAAAIE"]
[Sat Dec 27 03:15:59.429612 2025] [:error] [pid 34188:tid 34231] [client 4.194.49.120:3343] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aU7e7w54j0mXgip5BAHKpwAAAEs"]
[Sat Dec 27 03:16:00.160138 2025] [:error] [pid 34274:tid 34296] [client 4.194.49.120:36390] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aU7e8M6fabpS0mfhiCEyiwAAANQ"]
[Sat Dec 27 03:16:00.904684 2025] [:error] [pid 34188:tid 34221] [client 4.194.49.120:45168] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aU7e8A54j0mXgip5BAHKrQAAAEE"]
[Sat Dec 27 03:16:01.303260 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:39488] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aU7e8ayYgLfR4YwO7byvgAAAARI"]
[Sat Dec 27 03:16:01.854079 2025] [:error] [pid 34188:tid 34235] [client 4.194.49.120:42145] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aU7e8Q54j0mXgip5BAHKrgAAAE8"]
[Sat Dec 27 03:16:02.219830 2025] [:error] [pid 34189:tid 34263] [client 4.194.49.120:36412] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aU7e8gnn007DnMwSsfdJqgAAAJA"]
[Sat Dec 27 03:16:02.961116 2025] [:error] [pid 34274:tid 34286] [client 4.194.49.120:45178] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aU7e8s6fabpS0mfhiCEykwAAAMo"]
[Sat Dec 27 03:16:03.263608 2025] [:error] [pid 34188:tid 34242] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 27 03:16:03.374491 2025] [:error] [pid 34188:tid 34228] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Sat Dec 27 03:16:03.468247 2025] [:error] [pid 34188:tid 34234] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/bipas.php
[Sat Dec 27 03:16:03.560407 2025] [:error] [pid 34188:tid 34222] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/conte.php
[Sat Dec 27 03:16:03.654856 2025] [:error] [pid 34188:tid 34227] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/class3.php
[Sat Dec 27 03:16:03.758760 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs18.php
[Sat Dec 27 03:16:03.849272 2025] [:error] [pid 34188:tid 34233] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/claa.php
[Sat Dec 27 03:16:03.970839 2025] [:error] [pid 34188:tid 34240] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/shoyo.php
[Sat Dec 27 03:16:04.062107 2025] [:error] [pid 34188:tid 34225] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Dec 27 03:16:04.162943 2025] [:error] [pid 34188:tid 34239] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/waq.php
[Sat Dec 27 03:16:04.388328 2025] [:error] [pid 34188:tid 34237] [client 4.194.49.120:53305] File does not exist: /usr/local/apache/htdocs/suspended-page/wakak.php
[Sat Dec 27 03:16:04.480883 2025] [:error] [pid 34188:tid 34231] [client 4.194.49.120:53305] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7e9A54j0mXgip5BAHKuwAAAEs"]
[Sat Dec 27 03:16:04.856053 2025] [:error] [pid 34187:tid 34198] [client 4.194.49.120:61765] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7e9Kv8srZGEpsIm8AXNAAAAAY"]
[Sat Dec 27 03:16:05.137417 2025] [:error] [pid 34189:tid 34248] [client 4.194.49.120:39511] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7e9Qnn007DnMwSsfdJswAAAIE"]
[Sat Dec 27 03:16:05.522116 2025] [:error] [pid 34187:tid 34213] [client 4.194.49.120:42118] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7e9av8srZGEpsIm8AXNwAAABU"]
[Sat Dec 27 03:16:06.146178 2025] [:error] [pid 34189:tid 34259] [client 4.194.49.120:36403] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aU7e9gnn007DnMwSsfdJtgAAAIw"]
[Sat Dec 27 03:16:06.543972 2025] [:error] [pid 47566:tid 47571] [client 4.194.49.120:45127] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aU7e9qyYgLfR4YwO7byvhwAAAQI"]
[Sat Dec 27 03:16:06.886038 2025] [:error] [pid 47566:tid 47584] [client 4.194.49.120:39489] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aU7e9qyYgLfR4YwO7byvigAAAQ8"]
[Sat Dec 27 03:16:07.514207 2025] [:error] [pid 34274:tid 34280] [client 4.194.49.120:61818] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aU7e986fabpS0mfhiCEylwAAAMQ"]
[Sat Dec 27 03:16:07.867720 2025] [:error] [pid 34189:tid 34269] [client 4.194.49.120:61371] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aU7e9wnn007DnMwSsfdJuAAAAJY"]
[Sat Dec 27 03:16:08.189453 2025] [:error] [pid 34188:tid 34236] [client 4.194.49.120:45181] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aU7e-A54j0mXgip5BAHKvgAAAFA"]
[Sat Dec 27 03:16:08.459200 2025] [:error] [pid 34187:tid 34192] [client 4.194.49.120:36375] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aU7e-Kv8srZGEpsIm8AXOwAAAAA"]
[Sat Dec 27 03:16:09.077081 2025] [:error] [pid 47566:tid 47569] [client 4.194.49.120:39517] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xse25.php"] [unique_id "aU7e-ayYgLfR4YwO7byvkQAAAQA"]
[Sat Dec 27 03:16:09.576317 2025] [:error] [pid 34187:tid 34214] [client 4.194.49.120:53291] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e-av8srZGEpsIm8AXPwAAABY"]
[Sat Dec 27 03:16:09.968285 2025] [:error] [pid 34274:tid 34276] [client 4.194.49.120:61768] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e-c6fabpS0mfhiCEynQAAAMA"]
[Sat Dec 27 03:16:10.339232 2025] [:error] [pid 34189:tid 34252] [client 4.194.49.120:45153] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e-gnn007DnMwSsfdJuQAAAIU"]
[Sat Dec 27 03:16:11.326103 2025] [:error] [pid 34189:tid 34271] [client 4.194.49.120:42152] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aU7e-wnn007DnMwSsfdJvAAAAJg"]
[Sat Dec 27 03:16:12.046295 2025] [:error] [pid 34189:tid 34248] [client 4.194.49.120:42155] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aU7e_Ann007DnMwSsfdJvQAAAIE"]
[Sat Dec 27 03:16:12.628136 2025] [:error] [pid 34187:tid 34209] [client 4.194.49.120:3346] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aU7e_Kv8srZGEpsIm8AXQwAAABE"]
[Sat Dec 27 03:16:14.304106 2025] [:error] [pid 47566:tid 47581] [client 4.194.49.120:61333] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aU7e_qyYgLfR4YwO7byvlgAAAQw"]
[Sat Dec 27 03:16:14.765299 2025] [:error] [pid 34188:tid 34227] [client 4.194.49.120:53271] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aU7e_g54j0mXgip5BAHKwAAAAEc"]
[Sat Dec 27 03:16:15.374663 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:42121] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7e_w54j0mXgip5BAHKwQAAAFU"]
[Sat Dec 27 03:16:16.170830 2025] [:error] [pid 34274:tid 34278] [client 4.194.49.120:61762] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7fAM6fabpS0mfhiCEyqAAAAMI"]
[Sat Dec 27 03:16:16.680091 2025] [:error] [pid 34274:tid 34287] [client 4.194.49.120:39537] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7fAM6fabpS0mfhiCEyqwAAAMs"]
[Sat Dec 27 03:16:17.520802 2025] [:error] [pid 34188:tid 34220] [client 4.194.49.120:53264] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7fAQ54j0mXgip5BAHKyAAAAEA"]
[Sat Dec 27 03:16:17.985420 2025] [:error] [pid 34189:tid 34258] [client 4.194.49.120:61327] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aU7fAQnn007DnMwSsfdJxAAAAIs"]
[Sat Dec 27 03:16:18.366351 2025] [:error] [pid 34189:tid 34262] [client 4.194.49.120:61799] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aU7fAgnn007DnMwSsfdJxwAAAI8"]
[Sat Dec 27 03:16:18.702480 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:42161] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aU7fAqyYgLfR4YwO7byvnQAAARI"]
[Sat Dec 27 03:16:19.071765 2025] [:error] [pid 34188:tid 34244] [client 4.194.49.120:42141] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aU7fAw54j0mXgip5BAHKygAAAFg"]
[Sat Dec 27 03:16:19.787960 2025] [:error] [pid 47566:tid 47574] [client 4.194.49.120:53257] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU7fA6yYgLfR4YwO7byvoAAAAQU"]
[Sat Dec 27 03:16:20.288578 2025] [:error] [pid 47566:tid 47582] [client 4.194.49.120:39516] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU7fBKyYgLfR4YwO7byvowAAAQ0"]
[Sat Dec 27 03:16:21.089308 2025] [:error] [pid 34189:tid 34262] [client 4.194.49.120:45134] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU7fBQnn007DnMwSsfdJ1gAAAI8"]
[Sat Dec 27 03:16:21.392031 2025] [:error] [pid 34187:tid 34196] [client 4.194.49.120:61375] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU7fBav8srZGEpsIm8AXSAAAAAQ"]
[Sat Dec 27 03:16:21.799777 2025] [:error] [pid 34274:tid 34279] [client 4.194.49.120:36364] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU7fBc6fabpS0mfhiCEyswAAAMM"]
[Sat Dec 27 03:16:22.214916 2025] [:error] [pid 47566:tid 47583] [client 4.194.49.120:42128] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU7fBqyYgLfR4YwO7byvqQAAAQ4"]
[Sat Dec 27 03:16:22.540121 2025] [:error] [pid 34189:tid 34255] [client 4.194.49.120:45170] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU7fBgnn007DnMwSsfdJ2gAAAIg"]
[Sat Dec 27 03:16:22.872676 2025] [:error] [pid 34187:tid 34213] [client 4.194.49.120:42153] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU7fBqv8srZGEpsIm8AXSwAAABU"]
[Sat Dec 27 03:16:23.512279 2025] [:error] [pid 34189:tid 34260] [client 4.194.49.120:45167] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fBwnn007DnMwSsfdJ2wAAAI0"]
[Sat Dec 27 03:16:23.847506 2025] [:error] [pid 47566:tid 47577] [client 4.194.49.120:36372] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fB6yYgLfR4YwO7byvrAAAAQg"]
[Sat Dec 27 03:16:24.715816 2025] [:error] [pid 47566:tid 47569] [client 4.194.49.120:59356] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fCKyYgLfR4YwO7byvsAAAAQA"]
[Sat Dec 27 03:16:24.954338 2025] [:error] [pid 47566:tid 47570] [client 4.194.49.120:3339] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fCKyYgLfR4YwO7byvtAAAAQE"]
[Sat Dec 27 03:16:25.307668 2025] [:error] [pid 34187:tid 34192] [client 4.194.49.120:42164] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU7fCav8srZGEpsIm8AXUAAAAAA"]
[Sat Dec 27 03:16:25.902890 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:42124] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU7fCayYgLfR4YwO7byvuwAAARQ"]
[Sat Dec 27 03:16:26.587601 2025] [:error] [pid 34274:tid 34280] [client 4.194.49.120:59345] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU7fCs6fabpS0mfhiCEyugAAAMQ"]
[Sat Dec 27 03:16:26.940751 2025] [:error] [pid 34188:tid 34236] [client 4.194.49.120:39527] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU7fCg54j0mXgip5BAHK1wAAAFA"]
[Sat Dec 27 03:16:27.417511 2025] [:error] [pid 47566:tid 47580] [client 4.194.49.120:3342] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU7fC6yYgLfR4YwO7byvwAAAAQs"]
[Sat Dec 27 03:16:27.864066 2025] [:error] [pid 47566:tid 47590] [client 4.194.49.120:53293] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU7fC6yYgLfR4YwO7byvwgAAARU"]
[Sat Dec 27 03:16:29.014369 2025] [:error] [pid 34189:tid 34269] [client 4.194.49.120:42174] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU7fDQnn007DnMwSsfdJ5QAAAJY"]
[Sat Dec 27 03:16:29.306356 2025] [:error] [pid 47566:tid 47582] [client 4.194.49.120:36313] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU7fDayYgLfR4YwO7byvyQAAAQ0"]
[Sat Dec 27 03:16:29.683286 2025] [:error] [pid 34274:tid 34279] [client 4.194.49.120:39493] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU7fDc6fabpS0mfhiCEyvAAAAMM"]
[Sat Dec 27 03:16:30.061040 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:61315] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU7fDg54j0mXgip5BAHK2wAAAFU"]
[Sat Dec 27 03:16:30.459197 2025] [:error] [pid 34274:tid 34285] [client 4.194.49.120:53255] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU7fDs6fabpS0mfhiCEyvwAAAMk"]
[Sat Dec 27 03:16:30.789662 2025] [:error] [pid 47566:tid 47576] [client 4.194.49.120:61372] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU7fDqyYgLfR4YwO7byvywAAAQc"]
[Sat Dec 27 03:16:31.584086 2025] [:error] [pid 34188:tid 34225] [client 4.194.49.120:61343] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU7fDw54j0mXgip5BAHK3gAAAEU"]
[Sat Dec 27 03:16:32.179369 2025] [:error] [pid 34274:tid 34281] [client 4.194.49.120:59362] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU7fEM6fabpS0mfhiCEywgAAAMU"]
[Sat Dec 27 03:16:32.928045 2025] [:error] [pid 34189:tid 34267] [client 4.194.49.120:61775] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU7fEAnn007DnMwSsfdJ6wAAAJQ"]
[Sat Dec 27 03:16:33.251284 2025] [:error] [pid 34189:tid 34255] [client 4.194.49.120:61772] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU7fEQnn007DnMwSsfdJ7gAAAIg"]
[Sat Dec 27 03:16:33.527958 2025] [:error] [pid 34187:tid 34197] [client 4.194.49.120:61364] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU7fEav8srZGEpsIm8AXVQAAAAU"]
[Sat Dec 27 03:16:33.898497 2025] [:error] [pid 47566:tid 47573] [client 4.194.49.120:3332] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU7fEayYgLfR4YwO7byv0AAAAQQ"]
[Sat Dec 27 03:16:34.705280 2025] [:error] [pid 34274:tid 34280] [client 4.194.49.120:61820] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU7fEs6fabpS0mfhiCEyyQAAAMQ"]
[Sat Dec 27 03:16:35.151116 2025] [:error] [pid 47566:tid 47579] [client 4.194.49.120:3336] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU7fE6yYgLfR4YwO7byv0gAAAQo"]
[Sat Dec 27 03:16:35.580375 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:39520] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU7fE6yYgLfR4YwO7byv1QAAARI"]
[Sat Dec 27 03:16:35.870174 2025] [:error] [pid 34187:tid 34193] [client 4.194.49.120:39551] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU7fE6v8srZGEpsIm8AXWgAAAAE"]
[Sat Dec 27 03:16:36.172129 2025] [:error] [pid 34189:tid 34264] [client 4.194.49.120:61811] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU7fFAnn007DnMwSsfdJ9AAAAJE"]
[Sat Dec 27 03:16:36.533980 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:36366] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU7fFA54j0mXgip5BAHK4gAAAFU"]
[Sat Dec 27 03:16:36.895252 2025] [:error] [pid 34187:tid 34215] [client 4.194.49.120:36413] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7fFKv8srZGEpsIm8AXXAAAABc"]
[Sat Dec 27 03:16:37.219380 2025] [:error] [pid 34187:tid 34195] [client 4.194.49.120:36415] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7fFav8srZGEpsIm8AXXgAAAAM"]
[Sat Dec 27 03:16:37.652718 2025] [:error] [pid 34189:tid 34268] [client 4.194.49.120:61373] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7fFQnn007DnMwSsfdJ-AAAAJU"]
[Sat Dec 27 03:16:38.103547 2025] [:error] [pid 34189:tid 34257] [client 4.194.49.120:53294] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7fFgnn007DnMwSsfdJ-QAAAIo"]
[Sat Dec 27 03:16:38.444690 2025] [:error] [pid 34189:tid 34250] [client 4.194.49.120:45150] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7fFgnn007DnMwSsfdJ-wAAAIM"]
[Sat Dec 27 03:16:38.941651 2025] [:error] [pid 34187:tid 34210] [client 4.194.49.120:3345] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7fFqv8srZGEpsIm8AXYQAAABI"]
[Sat Dec 27 03:16:39.447828 2025] [:error] [pid 47566:tid 47574] [client 4.194.49.120:39505] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7fF6yYgLfR4YwO7byv3AAAAQU"]
[Sat Dec 27 03:16:39.931505 2025] [:error] [pid 47566:tid 47569] [client 4.194.49.120:39526] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7fF6yYgLfR4YwO7byv3gAAAQA"]
[Sat Dec 27 03:16:40.499357 2025] [:error] [pid 34187:tid 34199] [client 4.194.49.120:42117] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU7fGKv8srZGEpsIm8AXYwAAAAc"]
[Sat Dec 27 03:16:41.013472 2025] [:error] [pid 34187:tid 34200] [client 4.194.49.120:61312] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU7fGav8srZGEpsIm8AXZQAAAAg"]
[Sat Dec 27 03:16:41.517512 2025] [:error] [pid 34187:tid 34193] [client 4.194.49.120:61786] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU7fGav8srZGEpsIm8AXZgAAAAE"]
[Sat Dec 27 03:16:42.123593 2025] [:error] [pid 34188:tid 34231] [client 4.194.49.120:61766] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU7fGg54j0mXgip5BAHK6QAAAEs"]
[Sat Dec 27 03:16:42.633622 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:42149] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7fGqyYgLfR4YwO7byv5QAAARY"]
[Sat Dec 27 03:16:43.095633 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:53308] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7fG6yYgLfR4YwO7byv5gAAARQ"]
[Sat Dec 27 03:16:43.550386 2025] [:error] [pid 47566:tid 47574] [client 4.194.49.120:61317] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7fG6yYgLfR4YwO7byv6AAAAQU"]
[Sat Dec 27 03:16:43.928502 2025] [:error] [pid 47566:tid 47592] [client 4.194.49.120:36386] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7fG6yYgLfR4YwO7byv6wAAARc"]
[Sat Dec 27 03:16:44.254840 2025] [:error] [pid 34188:tid 34224] [client 4.194.49.120:61361] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7fHA54j0mXgip5BAHK6wAAAEQ"]
[Sat Dec 27 03:16:44.924433 2025] [:error] [pid 34274:tid 34300] [client 4.194.49.120:61792] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7fHM6fabpS0mfhiCEy1QAAANg"]
[Sat Dec 27 03:16:45.362353 2025] [:error] [pid 34274:tid 34298] [client 4.194.49.120:59334] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7fHc6fabpS0mfhiCEy2AAAANY"]
[Sat Dec 27 03:16:46.061429 2025] [:error] [pid 34187:tid 34199] [client 4.194.49.120:39528] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7fHqv8srZGEpsIm8AXcAAAAAc"]
[Sat Dec 27 03:16:46.713872 2025] [:error] [pid 34189:tid 34255] [client 4.194.49.120:61325] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU7fHgnn007DnMwSsfdKFgAAAIg"]
[Sat Dec 27 03:16:47.089459 2025] [:error] [pid 34188:tid 34220] [client 4.194.49.120:39502] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU7fHw54j0mXgip5BAHK8AAAAEA"]
[Sat Dec 27 03:16:47.666373 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:3411] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU7fH6yYgLfR4YwO7byv9QAAAQY"]
[Sat Dec 27 03:16:48.021715 2025] [:error] [pid 47566:tid 47577] [client 4.194.49.120:36378] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU7fIKyYgLfR4YwO7byv9gAAAQg"]
[Sat Dec 27 03:16:48.453502 2025] [:error] [pid 34188:tid 34233] [client 4.194.49.120:39497] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU7fIA54j0mXgip5BAHK8wAAAE0"]
[Sat Dec 27 03:16:48.774150 2025] [:error] [pid 34188:tid 34238] [client 4.194.49.120:53289] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU7fIA54j0mXgip5BAHK9QAAAFI"]
[Sat Dec 27 03:16:49.485250 2025] [:error] [pid 34188:tid 34228] [client 4.194.49.120:36379] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU7fIQ54j0mXgip5BAHK-gAAAEg"]
[Sat Dec 27 03:16:49.859801 2025] [:error] [pid 34189:tid 34267] [client 4.194.49.120:59386] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU7fIQnn007DnMwSsfdKGwAAAJQ"]
[Sat Dec 27 03:16:50.144253 2025] [:error] [pid 47566:tid 47578] [client 4.194.49.120:45148] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU7fIqyYgLfR4YwO7byv_AAAAQk"]
[Sat Dec 27 03:16:50.430285 2025] [:error] [pid 47566:tid 47569] [client 4.194.49.120:53259] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU7fIqyYgLfR4YwO7byv_gAAAQA"]
[Sat Dec 27 03:16:50.747105 2025] [:error] [pid 34188:tid 34233] [client 4.194.49.120:42529] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU7fIg54j0mXgip5BAHK_wAAAE0"]
[Sat Dec 27 03:16:51.228950 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:42557] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU7fI6yYgLfR4YwO7bywAgAAARY"]
[Sat Dec 27 03:16:51.543984 2025] [:error] [pid 34188:tid 34230] [client 4.194.49.120:53303] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU7fIw54j0mXgip5BAHLBAAAAEo"]
[Sat Dec 27 03:16:52.250935 2025] [:error] [pid 47566:tid 47586] [client 4.194.49.120:45157] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU7fJKyYgLfR4YwO7bywBAAAARE"]
[Sat Dec 27 03:16:52.543222 2025] [:error] [pid 34188:tid 34234] [client 4.194.49.120:61362] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU7fJA54j0mXgip5BAHLCgAAAE4"]
[Sat Dec 27 03:16:52.800931 2025] [:error] [pid 47566:tid 47593] [client 4.194.49.120:45138] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU7fJKyYgLfR4YwO7bywBwAAARg"]
[Sat Dec 27 03:16:52.993430 2025] [:error] [pid 34274:tid 34298] [client 4.194.49.120:40768] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU7fJM6fabpS0mfhiCEy4AAAANY"]
[Sat Dec 27 03:16:53.342279 2025] [:error] [pid 34188:tid 34239] [client 4.194.49.120:42543] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU7fJQ54j0mXgip5BAHLDgAAAFM"]
[Sat Dec 27 03:16:53.892112 2025] [:error] [pid 34187:tid 34213] [client 4.194.49.120:45135] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU7fJav8srZGEpsIm8AXdwAAABU"]
[Sat Dec 27 03:16:54.573376 2025] [:error] [pid 34187:tid 34205] [client 4.194.49.120:3396] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU7fJqv8srZGEpsIm8AXeAAAAA0"]
[Sat Dec 27 03:16:55.045517 2025] [:error] [pid 47566:tid 47590] [client 4.194.49.120:61819] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU7fJ6yYgLfR4YwO7bywCAAAARU"]
[Sat Dec 27 03:16:55.572028 2025] [:error] [pid 34188:tid 34237] [client 4.194.49.120:39536] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU7fJw54j0mXgip5BAHLGQAAAFE"]
[Sat Dec 27 03:16:55.861009 2025] [:error] [pid 47566:tid 47570] [client 4.194.49.120:42532] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU7fJ6yYgLfR4YwO7bywCQAAAQE"]
[Sat Dec 27 03:16:56.128308 2025] [:error] [pid 47566:tid 47571] [client 4.194.49.120:42499] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU7fKKyYgLfR4YwO7bywDAAAAQI"]
[Sat Dec 27 03:16:56.388951 2025] [:error] [pid 47566:tid 47578] [client 4.194.49.120:36408] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU7fKKyYgLfR4YwO7bywDQAAAQk"]
[Sat Dec 27 03:16:56.708346 2025] [:error] [pid 47566:tid 47588] [client 4.194.49.120:36325] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU7fKKyYgLfR4YwO7bywDwAAARM"]
[Sat Dec 27 03:16:57.027684 2025] [:error] [pid 34189:tid 34259] [client 4.194.49.120:36374] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU7fKQnn007DnMwSsfdKIAAAAIw"]
[Sat Dec 27 03:16:57.430413 2025] [:error] [pid 34188:tid 34229] [client 4.194.49.120:53279] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU7fKQ54j0mXgip5BAHLIAAAAEk"]
[Sat Dec 27 03:16:57.671781 2025] [:error] [pid 34188:tid 34238] [client 4.194.49.120:42519] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aU7fKQ54j0mXgip5BAHLIQAAAFI"]
[Sat Dec 27 03:16:57.927817 2025] [:error] [pid 34188:tid 34224] [client 4.194.49.120:61335] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aU7fKQ54j0mXgip5BAHLJAAAAEQ"]
[Sat Dec 27 03:16:58.421215 2025] [:error] [pid 34187:tid 34203] [client 4.194.49.120:53298] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aU7fKqv8srZGEpsIm8AXfgAAAAs"]
[Sat Dec 27 03:16:58.933861 2025] [:error] [pid 47566:tid 47577] [client 4.194.49.120:61763] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aU7fKqyYgLfR4YwO7bywEgAAAQg"]
[Sat Dec 27 03:16:59.241113 2025] [:error] [pid 34187:tid 34211] [client 4.194.49.120:42525] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aU7fK6v8srZGEpsIm8AXggAAABM"]
[Sat Dec 27 03:16:59.578222 2025] [:error] [pid 47566:tid 47572] [client 4.194.49.120:55873] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aU7fK6yYgLfR4YwO7bywFgAAAQM"]
[Sat Dec 27 03:16:59.907150 2025] [:error] [pid 47566:tid 47570] [client 4.194.49.120:40849] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aU7fK6yYgLfR4YwO7bywFwAAAQE"]
[Sat Dec 27 03:17:00.380453 2025] [:error] [pid 34187:tid 34195] [client 4.194.49.120:40893] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aU7fLKv8srZGEpsIm8AXhQAAAAM"]
[Sat Dec 27 03:17:00.612514 2025] [:error] [pid 34187:tid 34206] [client 4.194.49.120:40853] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aU7fLKv8srZGEpsIm8AXhwAAAA4"]
[Sat Dec 27 03:17:01.273823 2025] [:error] [pid 34274:tid 34291] [client 4.194.49.120:45070] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aU7fLc6fabpS0mfhiCEy5gAAAM8"]
[Sat Dec 27 03:17:01.630533 2025] [:error] [pid 34274:tid 34298] [client 4.194.49.120:36368] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aU7fLc6fabpS0mfhiCEy6AAAANY"]
[Sat Dec 27 03:17:01.953571 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:53267] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aU7fLc6fabpS0mfhiCEy6QAAAME"]
[Sat Dec 27 03:17:02.249036 2025] [:error] [pid 34274:tid 34300] [client 4.194.49.120:45124] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU7fLs6fabpS0mfhiCEy6wAAANg"]
[Sat Dec 27 03:17:02.620732 2025] [:error] [pid 47566:tid 47588] [client 4.194.49.120:42537] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU7fLqyYgLfR4YwO7bywHQAAARM"]
[Sat Dec 27 03:17:03.095155 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:61794] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU7fL6yYgLfR4YwO7bywHwAAAQY"]
[Sat Dec 27 03:17:03.341102 2025] [:error] [pid 47566:tid 47573] [client 4.194.49.120:42551] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU7fL6yYgLfR4YwO7bywIgAAAQQ"]
[Sat Dec 27 03:17:03.602640 2025] [:error] [pid 34274:tid 34289] [client 4.194.49.120:40837] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aU7fL86fabpS0mfhiCEy7wAAAM0"]
[Sat Dec 27 03:17:04.109361 2025] [:error] [pid 47566:tid 47580] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Sat Dec 27 03:17:04.278405 2025] [:error] [pid 47566:tid 47584] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Dec 27 03:17:04.368191 2025] [:error] [pid 47566:tid 47593] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 27 03:17:04.458338 2025] [:error] [pid 47566:tid 47581] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Dec 27 03:17:04.547735 2025] [:error] [pid 47566:tid 47579] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sat Dec 27 03:17:04.645162 2025] [:error] [pid 47566:tid 47576] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Dec 27 03:17:04.735247 2025] [:error] [pid 47566:tid 47578] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 27 03:17:04.829640 2025] [:error] [pid 47566:tid 47574] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 27 03:17:04.938968 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 27 03:17:05.057692 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sat Dec 27 03:17:05.187207 2025] [:error] [pid 47566:tid 47582] [client 4.194.49.120:45065] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 27 03:17:05.296699 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:45065] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7fMayYgLfR4YwO7bywMwAAARQ"]
[Sat Dec 27 03:17:05.714610 2025] [:error] [pid 34187:tid 34201] [client 4.194.49.120:36303] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7fMav8srZGEpsIm8AXkgAAAAk"]
[Sat Dec 27 03:17:05.979611 2025] [:error] [pid 34187:tid 34209] [client 4.194.49.120:39529] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7fMav8srZGEpsIm8AXkwAAABE"]
[Sat Dec 27 03:17:06.200030 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:39538] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7fMs6fabpS0mfhiCEy-gAAAME"]
[Sat Dec 27 03:17:06.471085 2025] [:error] [pid 34274:tid 34300] [client 4.194.49.120:39499] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU7fMs6fabpS0mfhiCEy_AAAANg"]
[Sat Dec 27 03:17:06.819102 2025] [:error] [pid 34274:tid 34288] [client 4.194.49.120:61816] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU7fMs6fabpS0mfhiCEy_QAAAMw"]
[Sat Dec 27 03:17:07.182587 2025] [:error] [pid 34187:tid 34213] [client 4.194.49.120:39539] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU7fM6v8srZGEpsIm8AXlQAAABU"]
[Sat Dec 27 03:17:07.625732 2025] [:error] [pid 34274:tid 34282] [client 4.194.49.120:45140] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU7fM86fabpS0mfhiCEzAAAAAMY"]
[Sat Dec 27 03:17:07.823493 2025] [:error] [pid 47566:tid 47570] [client 4.194.49.120:53299] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7fM6yYgLfR4YwO7bywNwAAAQE"]
[Sat Dec 27 03:17:08.108258 2025] [:error] [pid 47566:tid 47581] [client 4.194.49.120:59346] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7fNKyYgLfR4YwO7bywOAAAAQw"]
[Sat Dec 27 03:17:08.380289 2025] [:error] [pid 34187:tid 34202] [client 4.194.49.120:36373] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7fNKv8srZGEpsIm8AXlgAAAAo"]
[Sat Dec 27 03:17:08.659274 2025] [:error] [pid 47566:tid 47574] [client 4.194.49.120:53296] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7fNKyYgLfR4YwO7bywOgAAAQU"]
[Sat Dec 27 03:17:09.001530 2025] [:error] [pid 47566:tid 47585] [client 4.194.49.120:61349] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU7fNayYgLfR4YwO7bywPQAAARA"]
[Sat Dec 27 03:17:09.305995 2025] [:error] [pid 34188:tid 34240] [client 4.194.49.120:61326] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU7fNQ54j0mXgip5BAHLMAAAAFQ"]
[Sat Dec 27 03:17:09.749441 2025] [:error] [pid 34189:tid 34262] [client 4.194.49.120:39541] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU7fNQnn007DnMwSsfdKJAAAAI8"]
[Sat Dec 27 03:17:10.131605 2025] [:error] [pid 34189:tid 34253] [client 4.194.49.120:61782] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU7fNgnn007DnMwSsfdKJQAAAIY"]
[Sat Dec 27 03:17:10.550742 2025] [:error] [pid 34189:tid 34249] [client 4.194.49.120:3350] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fNgnn007DnMwSsfdKJwAAAII"]
[Sat Dec 27 03:17:10.981799 2025] [:error] [pid 34189:tid 34255] [client 4.194.49.120:36345] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fNgnn007DnMwSsfdKKAAAAIg"]
[Sat Dec 27 03:17:11.462370 2025] [:error] [pid 34189:tid 34264] [client 4.194.49.120:59377] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fNwnn007DnMwSsfdKKgAAAJE"]
[Sat Dec 27 03:17:11.767842 2025] [:error] [pid 34188:tid 34233] [client 4.194.49.120:45089] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fNw54j0mXgip5BAHLOAAAAE0"]
[Sat Dec 27 03:17:12.129487 2025] [:error] [pid 34189:tid 34251] [client 4.194.49.120:61771] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU7fOAnn007DnMwSsfdKLAAAAIQ"]
[Sat Dec 27 03:17:12.789134 2025] [:error] [pid 34188:tid 34236] [client 4.194.49.120:61360] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU7fOA54j0mXgip5BAHLPAAAAFA"]
[Sat Dec 27 03:17:13.106941 2025] [:error] [pid 34188:tid 34234] [client 4.194.49.120:53310] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU7fOQ54j0mXgip5BAHLPgAAAE4"]
[Sat Dec 27 03:17:13.712321 2025] [:error] [pid 34188:tid 34230] [client 4.194.49.120:42559] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU7fOQ54j0mXgip5BAHLQQAAAEo"]
[Sat Dec 27 03:17:14.229112 2025] [:error] [pid 34187:tid 34211] [client 4.194.49.120:36388] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU7fOqv8srZGEpsIm8AXnAAAABM"]
[Sat Dec 27 03:17:14.647179 2025] [:error] [pid 34274:tid 34293] [client 4.194.49.120:42535] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU7fOs6fabpS0mfhiCEzBwAAANE"]
[Sat Dec 27 03:17:14.895387 2025] [:error] [pid 34187:tid 34204] [client 4.194.49.120:3411] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU7fOqv8srZGEpsIm8AXnQAAAAw"]
[Sat Dec 27 03:17:15.220412 2025] [:error] [pid 34187:tid 34215] [client 4.194.49.120:39521] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU7fO6v8srZGEpsIm8AXnwAAABc"]
[Sat Dec 27 03:17:15.485167 2025] [:error] [pid 34187:tid 34206] [client 4.194.49.120:40891] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7fO6v8srZGEpsIm8AXoQAAAA4"]
[Sat Dec 27 03:17:15.767934 2025] [:error] [pid 34189:tid 34265] [client 4.194.49.120:53232] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7fOwnn007DnMwSsfdKMwAAAJI"]
[Sat Dec 27 03:17:16.037193 2025] [:error] [pid 34187:tid 34196] [client 4.194.49.120:40888] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7fPKv8srZGEpsIm8AXowAAAAQ"]
[Sat Dec 27 03:17:16.853894 2025] [:error] [pid 34189:tid 34266] [client 4.194.49.120:45083] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7fPAnn007DnMwSsfdKNgAAAJM"]
[Sat Dec 27 03:17:17.172959 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:36400] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU7fPayYgLfR4YwO7bywSAAAARI"]
[Sat Dec 27 03:17:17.511451 2025] [:error] [pid 47566:tid 47592] [client 4.194.49.120:53215] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU7fPayYgLfR4YwO7bywTAAAARc"]
[Sat Dec 27 03:17:17.872818 2025] [:error] [pid 34188:tid 34228] [client 4.194.49.120:3371] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU7fPQ54j0mXgip5BAHLRwAAAEg"]
[Sat Dec 27 03:17:20.982606 2025] [:error] [pid 34187:tid 34193] [client 4.194.49.120:42498] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU7fQKv8srZGEpsIm8AXqwAAAAE"]
[Sat Dec 27 03:17:21.486497 2025] [:error] [pid 34189:tid 34258] [client 4.194.49.120:55901] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fQQnn007DnMwSsfdKPQAAAIs"]
[Sat Dec 27 03:17:22.119798 2025] [:error] [pid 47566:tid 47584] [client 4.194.49.120:53227] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fQqyYgLfR4YwO7bywXAAAAQ8"]
[Sat Dec 27 03:17:22.432115 2025] [:error] [pid 47566:tid 47583] [client 4.194.49.120:42515] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fQqyYgLfR4YwO7bywXwAAAQ4"]
[Sat Dec 27 03:17:22.683269 2025] [:error] [pid 47566:tid 47580] [client 4.194.49.120:61779] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7fQqyYgLfR4YwO7bywYAAAAQs"]
[Sat Dec 27 03:17:23.100068 2025] [:error] [pid 34274:tid 34278] [client 4.194.49.120:42512] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU7fQ86fabpS0mfhiCEzCgAAAMI"]
[Sat Dec 27 03:17:23.346944 2025] [:error] [pid 34274:tid 34284] [client 4.194.49.120:41231] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU7fQ86fabpS0mfhiCEzCwAAAMg"]
[Sat Dec 27 03:17:23.839103 2025] [:error] [pid 34187:tid 34205] [client 4.194.49.120:40847] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU7fQ6v8srZGEpsIm8AXrgAAAA0"]
[Sat Dec 27 03:17:24.138673 2025] [:error] [pid 34274:tid 34291] [client 4.194.49.120:53242] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU7fRM6fabpS0mfhiCEzDgAAAM8"]
[Sat Dec 27 03:17:24.473209 2025] [:error] [pid 34274:tid 34297] [client 4.194.49.120:53192] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aU7fRM6fabpS0mfhiCEzDwAAANU"]
[Sat Dec 27 03:17:24.839088 2025] [:error] [pid 34274:tid 34290] [client 4.194.49.120:61780] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aU7fRM6fabpS0mfhiCEzEQAAAM4"]
[Sat Dec 27 03:17:25.130820 2025] [:error] [pid 47566:tid 47578] [client 4.194.49.120:59389] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aU7fRayYgLfR4YwO7bywZgAAAQk"]
[Sat Dec 27 03:17:25.463202 2025] [:error] [pid 47566:tid 47583] [client 4.194.49.120:42536] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aU7fRayYgLfR4YwO7bywZwAAAQ4"]
[Sat Dec 27 03:17:25.734513 2025] [:error] [pid 34274:tid 34295] [client 4.194.49.120:40845] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aU7fRc6fabpS0mfhiCEzFAAAANM"]
[Sat Dec 27 03:17:26.458370 2025] [:error] [pid 34189:tid 34262] [client 4.194.49.120:53212] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aU7fRgnn007DnMwSsfdKPgAAAI8"]
[Sat Dec 27 03:17:26.731642 2025] [:error] [pid 34274:tid 34284] [client 4.194.49.120:39548] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aU7fRs6fabpS0mfhiCEzGAAAAMg"]
[Sat Dec 27 03:17:27.036857 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:45084] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aU7fR86fabpS0mfhiCEzGgAAAME"]
[Sat Dec 27 03:17:27.334231 2025] [:error] [pid 34188:tid 34232] [client 4.194.49.120:39500] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU7fRw54j0mXgip5BAHLSgAAAEw"]
[Sat Dec 27 03:17:27.573497 2025] [:error] [pid 34274:tid 34288] [client 4.194.49.120:3366] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU7fR86fabpS0mfhiCEzHQAAAMw"]
[Sat Dec 27 03:17:27.896629 2025] [:error] [pid 34274:tid 34289] [client 4.194.49.120:42510] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU7fR86fabpS0mfhiCEzIQAAAM0"]
[Sat Dec 27 03:17:28.255215 2025] [:error] [pid 34189:tid 34267] [client 4.194.49.120:53226] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU7fSAnn007DnMwSsfdKQwAAAJQ"]
[Sat Dec 27 03:17:28.621343 2025] [:error] [pid 34189:tid 34269] [client 4.194.49.120:41278] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aU7fSAnn007DnMwSsfdKRgAAAJY"]
[Sat Dec 27 03:17:28.897829 2025] [:error] [pid 34189:tid 34257] [client 4.194.49.120:45100] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aU7fSAnn007DnMwSsfdKSQAAAIo"]
[Sat Dec 27 03:17:29.162790 2025] [:error] [pid 34188:tid 34227] [client 4.194.49.120:61796] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aU7fSQ54j0mXgip5BAHLSwAAAEc"]
[Sat Dec 27 03:17:29.478180 2025] [:error] [pid 34188:tid 34236] [client 4.194.49.120:41240] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.php"] [unique_id "aU7fSQ54j0mXgip5BAHLTAAAAFA"]
[Sat Dec 27 03:17:30.031872 2025] [:error] [pid 34188:tid 34234] [client 4.194.49.120:39514] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aU7fSg54j0mXgip5BAHLTgAAAE4"]
[Sat Dec 27 03:17:30.484252 2025] [:error] [pid 34187:tid 34205] [client 4.194.49.120:42505] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aU7fSqv8srZGEpsIm8AXuQAAAA0"]
[Sat Dec 27 03:17:31.154394 2025] [:error] [pid 34188:tid 34224] [client 4.194.49.120:39498] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aU7fSw54j0mXgip5BAHLUQAAAEQ"]
[Sat Dec 27 03:17:31.815376 2025] [:error] [pid 34274:tid 34297] [client 4.194.49.120:45107] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fwe.php"] [unique_id "aU7fS86fabpS0mfhiCEzKwAAANU"]
[Sat Dec 27 03:17:32.167203 2025] [:error] [pid 34188:tid 34230] [client 4.194.49.120:45132] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU7fTA54j0mXgip5BAHLVAAAAEo"]
[Sat Dec 27 03:17:32.642796 2025] [:error] [pid 34188:tid 34229] [client 4.194.49.120:53261] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU7fTA54j0mXgip5BAHLVQAAAEk"]
[Sat Dec 27 03:17:33.206463 2025] [:error] [pid 34188:tid 34235] [client 4.194.49.120:41263] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU7fTQ54j0mXgip5BAHLVgAAAE8"]
[Sat Dec 27 03:17:33.494513 2025] [:error] [pid 34274:tid 34286] [client 4.194.49.120:41225] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU7fTc6fabpS0mfhiCEzLwAAAMo"]
[Sat Dec 27 03:17:34.024033 2025] [:error] [pid 47566:tid 47586] [client 4.194.49.120:45075] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU7fTqyYgLfR4YwO7bywagAAARE"]
[Sat Dec 27 03:17:34.365952 2025] [:error] [pid 47566:tid 47582] [client 4.194.49.120:40841] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU7fTqyYgLfR4YwO7bywbAAAAQ0"]
[Sat Dec 27 03:17:34.736795 2025] [:error] [pid 34189:tid 34247] [client 4.194.49.120:45068] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU7fTgnn007DnMwSsfdKWwAAAIA"]
[Sat Dec 27 03:17:35.144911 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:41221] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU7fTw54j0mXgip5BAHLWwAAAFU"]
[Sat Dec 27 03:17:35.489387 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:42503] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU7fT6yYgLfR4YwO7bywcQAAARI"]
[Sat Dec 27 03:17:36.063739 2025] [:error] [pid 34188:tid 34220] [client 4.194.49.120:45153] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU7fUA54j0mXgip5BAHLXgAAAEA"]
[Sat Dec 27 03:17:36.323968 2025] [:error] [pid 47566:tid 47592] [client 4.194.49.120:45110] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU7fUKyYgLfR4YwO7bywdgAAARc"]
[Sat Dec 27 03:17:36.525399 2025] [:error] [pid 34187:tid 34215] [client 4.194.49.120:39496] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU7fUKv8srZGEpsIm8AXvwAAABc"]
[Sat Dec 27 03:17:36.770576 2025] [:error] [pid 34187:tid 34211] [client 4.194.49.120:42151] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU7fUKv8srZGEpsIm8AXwAAAABM"]
[Sat Dec 27 03:17:37.135166 2025] [:error] [pid 47566:tid 47586] [client 4.194.49.120:45141] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU7fUayYgLfR4YwO7bywegAAARE"]
[Sat Dec 27 03:17:37.602391 2025] [:error] [pid 47566:tid 47588] [client 4.194.49.120:53237] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU7fUayYgLfR4YwO7bywfgAAARM"]
[Sat Dec 27 03:17:38.053078 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:39525] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU7fUqyYgLfR4YwO7bywhAAAARY"]
[Sat Dec 27 03:17:38.525281 2025] [:error] [pid 47566:tid 47577] [client 4.194.49.120:40882] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7fUqyYgLfR4YwO7bywhwAAAQg"]
[Sat Dec 27 03:17:38.938176 2025] [:error] [pid 47566:tid 47584] [client 4.194.49.120:61798] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7fUqyYgLfR4YwO7bywiwAAAQ8"]
[Sat Dec 27 03:17:39.351707 2025] [:error] [pid 34189:tid 34262] [client 4.194.49.120:53194] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7fUwnn007DnMwSsfdKXgAAAI8"]
[Sat Dec 27 03:17:39.552156 2025] [:error] [pid 34187:tid 34208] [client 4.194.49.120:53290] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7fU6v8srZGEpsIm8AXxgAAABA"]
[Sat Dec 27 03:17:39.953346 2025] [:error] [pid 34189:tid 34253] [client 4.194.49.120:61769] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU7fUwnn007DnMwSsfdKXwAAAIY"]
[Sat Dec 27 03:17:40.249129 2025] [:error] [pid 47566:tid 47573] [client 4.194.49.120:53199] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU7fVKyYgLfR4YwO7bywkwAAAQQ"]
[Sat Dec 27 03:17:40.578020 2025] [:error] [pid 47566:tid 47574] [client 4.194.49.120:45115] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU7fVKyYgLfR4YwO7bywlgAAAQU"]
[Sat Dec 27 03:17:40.855661 2025] [:error] [pid 34187:tid 34198] [client 4.194.49.120:45111] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU7fVKv8srZGEpsIm8AXyQAAAAY"]
[Sat Dec 27 03:17:41.741982 2025] [:error] [pid 47566:tid 47586] [client 4.194.49.120:41238] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7fVayYgLfR4YwO7bywmQAAARE"]
[Sat Dec 27 03:17:42.078695 2025] [:error] [pid 34187:tid 34215] [client 4.194.49.120:40894] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7fVqv8srZGEpsIm8AXzgAAABc"]
[Sat Dec 27 03:17:42.492510 2025] [:error] [pid 34187:tid 34206] [client 4.194.49.120:57119] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7fVqv8srZGEpsIm8AX0AAAAA4"]
[Sat Dec 27 03:17:42.841814 2025] [:error] [pid 34188:tid 34223] [client 4.194.49.120:41237] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7fVg54j0mXgip5BAHLYgAAAEM"]
[Sat Dec 27 03:17:43.159109 2025] [:error] [pid 34188:tid 34240] [client 4.194.49.120:45154] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU7fVw54j0mXgip5BAHLYwAAAFQ"]
[Sat Dec 27 03:17:43.579610 2025] [:error] [pid 34188:tid 34237] [client 4.194.49.120:53211] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU7fVw54j0mXgip5BAHLZAAAAFE"]
[Sat Dec 27 03:17:44.175010 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:45160] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU7fWA54j0mXgip5BAHLZQAAAFU"]
[Sat Dec 27 03:17:44.614908 2025] [:error] [pid 34187:tid 34197] [client 4.194.49.120:40865] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU7fWKv8srZGEpsIm8AX0gAAAAU"]
[Sat Dec 27 03:17:45.038306 2025] [:error] [pid 34187:tid 34214] [client 4.194.49.120:40860] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU7fWav8srZGEpsIm8AX0wAAABY"]
[Sat Dec 27 03:17:45.722247 2025] [:error] [pid 34188:tid 34227] [client 4.194.49.120:40840] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU7fWQ54j0mXgip5BAHLaQAAAEc"]
[Sat Dec 27 03:17:46.151676 2025] [:error] [pid 34187:tid 34211] [client 4.194.49.120:53238] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU7fWqv8srZGEpsIm8AX2QAAABM"]
[Sat Dec 27 03:17:46.744048 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:3937] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU7fWqyYgLfR4YwO7bywowAAARI"]
[Sat Dec 27 03:17:47.475277 2025] [:error] [pid 34188:tid 34224] [client 4.194.49.120:41228] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fWw54j0mXgip5BAHLbAAAAEQ"]
[Sat Dec 27 03:17:47.897802 2025] [:error] [pid 34189:tid 34259] [client 4.194.49.120:45104] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fWwnn007DnMwSsfdKeQAAAIw"]
[Sat Dec 27 03:17:48.641332 2025] [:error] [pid 34189:tid 34264] [client 4.194.49.120:53186] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fXAnn007DnMwSsfdKfQAAAJE"]
[Sat Dec 27 03:17:49.073285 2025] [:error] [pid 47566:tid 47573] [client 4.194.49.120:40866] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU7fXayYgLfR4YwO7bywqQAAAQQ"]
[Sat Dec 27 03:17:49.352280 2025] [:error] [pid 47566:tid 47583] [client 4.194.49.120:3966] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheka.php"] [unique_id "aU7fXayYgLfR4YwO7bywqgAAAQ4"]
[Sat Dec 27 03:17:50.001095 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:3917] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheka.php"] [unique_id "aU7fXqyYgLfR4YwO7bywrAAAARY"]
[Sat Dec 27 03:17:50.492444 2025] [:error] [pid 34274:tid 34285] [client 4.194.49.120:57139] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheka.php"] [unique_id "aU7fXs6fabpS0mfhiCEzMwAAAMk"]
[Sat Dec 27 03:17:50.824516 2025] [:error] [pid 34189:tid 34255] [client 4.194.49.120:57134] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cheka.php"] [unique_id "aU7fXgnn007DnMwSsfdKgQAAAIg"]
[Sat Dec 27 03:17:51.193298 2025] [:error] [pid 47566:tid 47582] [client 4.194.49.120:40864] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aU7fX6yYgLfR4YwO7bywswAAAQ0"]
[Sat Dec 27 03:17:51.387927 2025] [:error] [pid 47566:tid 47571] [client 4.194.49.120:57140] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aU7fX6yYgLfR4YwO7bywtQAAAQI"]
[Sat Dec 27 03:17:51.589319 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:42539] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aU7fX6yYgLfR4YwO7bywtgAAARQ"]
[Sat Dec 27 03:17:52.175279 2025] [:error] [pid 34274:tid 34286] [client 4.194.49.120:45093] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "aU7fYM6fabpS0mfhiCEzNAAAAMo"]
[Sat Dec 27 03:17:53.128492 2025] [:error] [pid 34187:tid 34201] [client 4.194.49.120:42496] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aU7fYav8srZGEpsIm8AX5AAAAAk"]
[Sat Dec 27 03:17:53.411343 2025] [:error] [pid 34189:tid 34265] [client 4.194.49.120:42502] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aU7fYQnn007DnMwSsfdKhQAAAJI"]
[Sat Dec 27 03:17:53.743114 2025] [:error] [pid 47566:tid 47571] [client 4.194.49.120:42549] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aU7fYayYgLfR4YwO7bywwAAAAQI"]
[Sat Dec 27 03:17:54.259006 2025] [:error] [pid 47566:tid 47592] [client 4.194.49.120:41266] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aU7fYqyYgLfR4YwO7bywwwAAARc"]
[Sat Dec 27 03:17:54.625903 2025] [:error] [pid 47566:tid 47577] [client 4.194.49.120:45071] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aU7fYqyYgLfR4YwO7bywxQAAAQg"]
[Sat Dec 27 03:17:54.960400 2025] [:error] [pid 47566:tid 47585] [client 4.194.49.120:40838] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aU7fYqyYgLfR4YwO7bywyAAAARA"]
[Sat Dec 27 03:17:55.323810 2025] [:error] [pid 47566:tid 47590] [client 4.194.49.120:42555] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aU7fY6yYgLfR4YwO7bywyQAAARU"]
[Sat Dec 27 03:17:55.832105 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:40895] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aU7fY6yYgLfR4YwO7bywzQAAAQY"]
[Sat Dec 27 03:17:56.263273 2025] [:error] [pid 34188:tid 34220] [client 4.194.49.120:39532] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtride.php"] [unique_id "aU7fZA54j0mXgip5BAHLdAAAAEA"]
[Sat Dec 27 03:17:56.798869 2025] [:error] [pid 34274:tid 34292] [client 4.194.49.120:3960] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtride.php"] [unique_id "aU7fZM6fabpS0mfhiCEzOgAAANA"]
[Sat Dec 27 03:17:57.148203 2025] [:error] [pid 34187:tid 34215] [client 4.194.49.120:45102] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtride.php"] [unique_id "aU7fZav8srZGEpsIm8AX5wAAABc"]
[Sat Dec 27 03:17:57.709813 2025] [:error] [pid 34187:tid 34196] [client 4.194.49.120:57101] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xtride.php"] [unique_id "aU7fZav8srZGEpsIm8AX6AAAAAQ"]
[Sat Dec 27 03:17:58.388192 2025] [:error] [pid 34274:tid 34289] [client 4.194.49.120:45082] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aU7fZs6fabpS0mfhiCEzPQAAAM0"]
[Sat Dec 27 03:17:58.707364 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:61329] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aU7fZqyYgLfR4YwO7byw1gAAAQY"]
[Sat Dec 27 03:17:58.952465 2025] [:error] [pid 34274:tid 34297] [client 4.194.49.120:40871] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aU7fZs6fabpS0mfhiCEzPgAAANU"]
[Sat Dec 27 03:17:59.280397 2025] [:error] [pid 34274:tid 34283] [client 4.194.49.120:43255] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aU7fZ86fabpS0mfhiCEzPwAAAMc"]
[Sat Dec 27 03:17:59.847194 2025] [:error] [pid 34274:tid 34286] [client 4.194.49.120:53207] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aU7fZ86fabpS0mfhiCEzRAAAAMo"]
[Sat Dec 27 03:18:00.155596 2025] [:error] [pid 34187:tid 34206] [client 4.194.49.120:43207] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aU7faKv8srZGEpsIm8AX7QAAAA4"]
[Sat Dec 27 03:18:00.587417 2025] [:error] [pid 34274:tid 34298] [client 4.194.49.120:3962] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aU7faM6fabpS0mfhiCEzSAAAANY"]
[Sat Dec 27 03:18:01.137710 2025] [:error] [pid 34188:tid 34221] [client 4.194.49.120:57117] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aU7faQ54j0mXgip5BAHLfAAAAEE"]
[Sat Dec 27 03:18:01.735006 2025] [:error] [pid 34274:tid 34289] [client 4.194.49.120:57126] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aU7fac6fabpS0mfhiCEzSwAAAM0"]
[Sat Dec 27 03:18:02.066911 2025] [:error] [pid 34274:tid 34297] [client 4.194.49.120:48879] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aU7fas6fabpS0mfhiCEzTAAAANU"]
[Sat Dec 27 03:18:02.254007 2025] [:error] [pid 34274:tid 34279] [client 4.194.49.120:3943] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aU7fas6fabpS0mfhiCEzTwAAAMM"]
[Sat Dec 27 03:18:02.527667 2025] [:error] [pid 34274:tid 34293] [client 4.194.49.120:53187] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aU7fas6fabpS0mfhiCEzUQAAANE"]
[Sat Dec 27 03:18:03.072492 2025] [:error] [pid 34274:tid 34298] [client 4.194.49.120:41255] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aU7fa86fabpS0mfhiCEzVQAAANY"]
[Sat Dec 27 03:18:03.540158 2025] [:error] [pid 34274:tid 34291] [client 4.194.49.120:54716] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aU7fa86fabpS0mfhiCEzWQAAAM8"]
[Sat Dec 27 03:18:04.157375 2025] [:error] [pid 47566:tid 47585] [client 4.194.49.120:3921] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aU7fbKyYgLfR4YwO7byw4AAAARA"]
[Sat Dec 27 03:18:04.801494 2025] [:error] [pid 34189:tid 34267] [client 4.194.49.120:40834] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aU7fbAnn007DnMwSsfdKiQAAAJQ"]
[Sat Dec 27 03:18:05.260350 2025] [:error] [pid 47566:tid 47582] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/aqw.php
[Sat Dec 27 03:18:05.355765 2025] [:error] [pid 47566:tid 47574] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/ca1.php
[Sat Dec 27 03:18:05.466152 2025] [:error] [pid 47566:tid 47578] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/abouta.php
[Sat Dec 27 03:18:05.560100 2025] [:error] [pid 47566:tid 47593] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/fclas.php
[Sat Dec 27 03:18:05.659527 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/bbn.php
[Sat Dec 27 03:18:05.753869 2025] [:error] [pid 47566:tid 47592] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sat Dec 27 03:18:05.856036 2025] [:error] [pid 47566:tid 47577] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/xz89.php
[Sat Dec 27 03:18:06.160047 2025] [:error] [pid 47566:tid 47570] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/wft.php
[Sat Dec 27 03:18:06.255304 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/ws28.php
[Sat Dec 27 03:18:06.349414 2025] [:error] [pid 47566:tid 47583] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Sat Dec 27 03:18:06.476002 2025] [:error] [pid 47566:tid 47590] [client 4.194.49.120:45074] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Sat Dec 27 03:18:06.645968 2025] [:error] [pid 47566:tid 47569] [client 4.194.49.120:45074] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aU7fbqyYgLfR4YwO7byw8AAAAQA"]
[Sat Dec 27 03:18:07.133562 2025] [:error] [pid 34274:tid 34290] [client 4.194.49.120:48847] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aU7fb86fabpS0mfhiCEzZgAAAM4"]
[Sat Dec 27 03:18:07.457020 2025] [:error] [pid 34187:tid 34195] [client 4.194.49.120:43228] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aU7fb6v8srZGEpsIm8AX-QAAAAM"]
[Sat Dec 27 03:18:07.688685 2025] [:error] [pid 34188:tid 34224] [client 4.194.49.120:41224] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aU7fbw54j0mXgip5BAHLggAAAEQ"]
[Sat Dec 27 03:18:07.995141 2025] [:error] [pid 34189:tid 34253] [client 4.194.49.120:3955] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aU7fbwnn007DnMwSsfdKlAAAAIY"]
[Sat Dec 27 03:18:08.533311 2025] [:error] [pid 47566:tid 47576] [client 4.194.49.120:54665] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aU7fcKyYgLfR4YwO7byw9wAAAQc"]
[Sat Dec 27 03:18:08.971309 2025] [:error] [pid 34188:tid 34225] [client 4.194.49.120:54705] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aU7fcA54j0mXgip5BAHLhgAAAEU"]
[Sat Dec 27 03:18:09.459209 2025] [:error] [pid 34187:tid 34209] [client 4.194.49.120:42485] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aU7fcav8srZGEpsIm8AX-gAAABE"]
[Sat Dec 27 03:18:10.183363 2025] [:error] [pid 34189:tid 34257] [client 4.194.49.120:52786] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aU7fcgnn007DnMwSsfdKmQAAAIo"]
[Sat Dec 27 03:18:10.687224 2025] [:error] [pid 34189:tid 34269] [client 4.194.49.120:43223] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aU7fcgnn007DnMwSsfdKmgAAAJY"]
[Sat Dec 27 03:18:10.988350 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:42444] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aU7fcqyYgLfR4YwO7byxBAAAARI"]
[Sat Dec 27 03:18:11.329032 2025] [:error] [pid 34188:tid 34229] [client 4.194.49.120:3906] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aU7fcw54j0mXgip5BAHLiQAAAEk"]
[Sat Dec 27 03:18:11.721987 2025] [:error] [pid 34187:tid 34196] [client 4.194.49.120:54667] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aU7fc6v8srZGEpsIm8AYAQAAAAQ"]
[Sat Dec 27 03:18:12.065104 2025] [:error] [pid 34189:tid 34259] [client 4.194.49.120:52787] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aU7fdAnn007DnMwSsfdKngAAAIw"]
[Sat Dec 27 03:18:12.342338 2025] [:error] [pid 34189:tid 34251] [client 4.194.49.120:42452] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aU7fdAnn007DnMwSsfdKoAAAAIQ"]
[Sat Dec 27 03:18:12.896203 2025] [:error] [pid 34188:tid 34220] [client 4.194.49.120:43257] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aU7fdA54j0mXgip5BAHLjgAAAEA"]
[Sat Dec 27 03:18:13.368747 2025] [:error] [pid 34189:tid 34253] [client 4.194.49.120:54708] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aU7fdQnn007DnMwSsfdKowAAAIY"]
[Sat Dec 27 03:18:13.906126 2025] [:error] [pid 34274:tid 34295] [client 4.194.49.120:42442] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aU7fdc6fabpS0mfhiCEzbgAAANM"]
[Sat Dec 27 03:18:14.273856 2025] [:error] [pid 47566:tid 47585] [client 4.194.49.120:40781] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aU7fdqyYgLfR4YwO7byxCgAAARA"]
[Sat Dec 27 03:18:14.725845 2025] [:error] [pid 47566:tid 47573] [client 4.194.49.120:43262] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aU7fdqyYgLfR4YwO7byxDAAAAQQ"]
[Sat Dec 27 03:18:15.332627 2025] [:error] [pid 34188:tid 34244] [client 4.194.49.120:52757] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU7fdw54j0mXgip5BAHLkgAAAFg"]
[Sat Dec 27 03:18:15.788773 2025] [:error] [pid 34189:tid 34259] [client 4.194.49.120:41248] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU7fdwnn007DnMwSsfdKqQAAAIw"]
[Sat Dec 27 03:18:16.150759 2025] [:error] [pid 34189:tid 34251] [client 4.194.49.120:52763] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU7feAnn007DnMwSsfdKqwAAAIQ"]
[Sat Dec 27 03:18:16.698077 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:3914] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU7feA54j0mXgip5BAHLngAAAFU"]
[Sat Dec 27 03:18:17.148596 2025] [:error] [pid 34188:tid 34232] [client 4.194.49.120:3945] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aU7feQ54j0mXgip5BAHLowAAAEw"]
[Sat Dec 27 03:18:17.790849 2025] [:error] [pid 34187:tid 34215] [client 4.194.49.120:57090] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aU7feav8srZGEpsIm8AYEAAAABc"]
[Sat Dec 27 03:18:18.523977 2025] [:error] [pid 34188:tid 34236] [client 4.194.49.120:3958] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aU7feg54j0mXgip5BAHLqQAAAFA"]
[Sat Dec 27 03:18:19.056252 2025] [:error] [pid 34188:tid 34222] [client 4.194.49.120:43202] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aU7few54j0mXgip5BAHLqwAAAEI"]
[Sat Dec 27 03:18:19.500105 2025] [:error] [pid 34187:tid 34208] [client 4.194.49.120:54684] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aU7fe6v8srZGEpsIm8AYGgAAABA"]
[Sat Dec 27 03:18:20.326717 2025] [:error] [pid 47566:tid 47585] [client 4.194.49.120:53204] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aU7ffKyYgLfR4YwO7byxFAAAARA"]
[Sat Dec 27 03:18:20.731082 2025] [:error] [pid 34188:tid 34228] [client 4.194.49.120:42439] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aU7ffA54j0mXgip5BAHLrwAAAEg"]
[Sat Dec 27 03:18:21.030916 2025] [:error] [pid 34189:tid 34267] [client 4.194.49.120:54688] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aU7ffQnn007DnMwSsfdKuAAAAJQ"]
[Sat Dec 27 03:18:21.604507 2025] [:error] [pid 34188:tid 34240] [client 4.194.49.120:54677] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aU7ffQ54j0mXgip5BAHLsgAAAFQ"]
[Sat Dec 27 03:18:21.928297 2025] [:error] [pid 47566:tid 47570] [client 4.194.49.120:54714] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aU7ffayYgLfR4YwO7byxHAAAAQE"]
[Sat Dec 27 03:18:22.287139 2025] [:error] [pid 34274:tid 34290] [client 4.194.49.120:3941] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aU7ffs6fabpS0mfhiCEzfAAAAM4"]
[Sat Dec 27 03:18:22.989796 2025] [:error] [pid 34274:tid 34280] [client 4.194.49.120:42434] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aU7ffs6fabpS0mfhiCEzfwAAAMQ"]
[Sat Dec 27 03:18:23.419100 2025] [:error] [pid 34188:tid 34234] [client 4.194.49.120:42495] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aU7ffw54j0mXgip5BAHLugAAAE4"]
[Sat Dec 27 03:18:23.654617 2025] [:error] [pid 34189:tid 34252] [client 4.194.49.120:53184] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aU7ffwnn007DnMwSsfdKvgAAAIU"]
[Sat Dec 27 03:18:23.951985 2025] [:error] [pid 34274:tid 34284] [client 4.194.49.120:3926] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aU7ff86fabpS0mfhiCEzggAAAMg"]
[Sat Dec 27 03:18:24.273018 2025] [:error] [pid 34187:tid 34196] [client 4.194.49.120:3960] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aU7fgKv8srZGEpsIm8AYKAAAAAQ"]
[Sat Dec 27 03:18:24.700660 2025] [:error] [pid 34274:tid 34295] [client 4.194.49.120:3910] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aU7fgM6fabpS0mfhiCEzhwAAANM"]
[Sat Dec 27 03:18:25.358369 2025] [:error] [pid 34274:tid 34299] [client 4.194.49.120:52782] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aU7fgc6fabpS0mfhiCEziQAAANc"]
[Sat Dec 27 03:18:26.069522 2025] [:error] [pid 34274:tid 34294] [client 4.194.49.120:54671] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aU7fgs6fabpS0mfhiCEzjQAAANI"]
[Sat Dec 27 03:18:26.630081 2025] [:error] [pid 47566:tid 47576] [client 4.194.49.120:53200] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "aU7fgqyYgLfR4YwO7byxJgAAAQc"]
[Sat Dec 27 03:18:26.965119 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:42448] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aU7fgqyYgLfR4YwO7byxKQAAARY"]
[Sat Dec 27 03:18:27.342617 2025] [:error] [pid 47566:tid 47577] [client 4.194.49.120:52794] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aU7fg6yYgLfR4YwO7byxLAAAAQg"]
[Sat Dec 27 03:18:27.623628 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:52748] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aU7fg6yYgLfR4YwO7byxLgAAARQ"]
[Sat Dec 27 03:18:27.921868 2025] [:error] [pid 34188:tid 34222] [client 4.194.49.120:53222] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aU7fgw54j0mXgip5BAHLwwAAAEI"]
[Sat Dec 27 03:18:28.474385 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:48854] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aU7fhKyYgLfR4YwO7byxMQAAAQY"]
[Sat Dec 27 03:18:28.795484 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:52752] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aU7fhKyYgLfR4YwO7byxMgAAARI"]
[Sat Dec 27 03:18:29.300732 2025] [:error] [pid 47566:tid 47580] [client 4.194.49.120:43222] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aU7fhayYgLfR4YwO7byxNQAAAQs"]
[Sat Dec 27 03:18:29.830446 2025] [:error] [pid 34274:tid 34298] [client 4.194.49.120:45064] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aU7fhc6fabpS0mfhiCEzmwAAANY"]
[Sat Dec 27 03:18:30.213878 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:54658] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aU7fhqyYgLfR4YwO7byxQAAAAQY"]
[Sat Dec 27 03:18:31.404166 2025] [:error] [pid 47566:tid 47569] [client 4.194.49.120:54664] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aU7fh6yYgLfR4YwO7byxUQAAAQA"]
[Sat Dec 27 03:18:31.957562 2025] [:error] [pid 47566:tid 47593] [client 4.194.49.120:3924] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aU7fh6yYgLfR4YwO7byxWAAAARg"]
[Sat Dec 27 03:18:32.617648 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:3929] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "aU7fiKyYgLfR4YwO7byxXgAAARQ"]
[Sat Dec 27 03:18:33.449850 2025] [:error] [pid 34188:tid 34233] [client 4.194.49.120:35679] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid.php"] [unique_id "aU7fiQ54j0mXgip5BAHLxgAAAE0"]
[Sat Dec 27 03:18:34.125308 2025] [:error] [pid 34274:tid 34292] [client 4.194.49.120:54669] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid.php"] [unique_id "aU7fis6fabpS0mfhiCEzqQAAANA"]
[Sat Dec 27 03:18:34.707194 2025] [:error] [pid 34188:tid 34226] [client 4.194.49.120:42466] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid.php"] [unique_id "aU7fig54j0mXgip5BAHLyAAAAEY"]
[Sat Dec 27 03:18:35.188615 2025] [:error] [pid 34274:tid 34282] [client 4.194.49.120:42467] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid.php"] [unique_id "aU7fi86fabpS0mfhiCEzrwAAAMY"]
[Sat Dec 27 03:18:35.580413 2025] [:error] [pid 47566:tid 47589] [client 4.194.49.120:35045] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssss.php"] [unique_id "aU7fi6yYgLfR4YwO7byxaAAAARQ"]
[Sat Dec 27 03:18:36.284341 2025] [:error] [pid 47566:tid 47587] [client 4.194.49.120:35016] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssss.php"] [unique_id "aU7fjKyYgLfR4YwO7byxbgAAARI"]
[Sat Dec 27 03:18:36.759335 2025] [:error] [pid 47566:tid 47578] [client 4.194.49.120:3107] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssss.php"] [unique_id "aU7fjKyYgLfR4YwO7byxcwAAAQk"]
[Sat Dec 27 03:18:37.170870 2025] [:error] [pid 34187:tid 34205] [client 4.194.49.120:35018] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssss.php"] [unique_id "aU7fjav8srZGEpsIm8AYNgAAAA0"]
[Sat Dec 27 03:18:37.631843 2025] [:error] [pid 34188:tid 34224] [client 4.194.49.120:60485] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aU7fjQ54j0mXgip5BAHLzQAAAEQ"]
[Sat Dec 27 03:18:38.283325 2025] [:error] [pid 34274:tid 34285] [client 4.194.49.120:35696] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aU7fjs6fabpS0mfhiCEztwAAAMk"]
[Sat Dec 27 03:18:38.597303 2025] [:error] [pid 34187:tid 34208] [client 4.194.49.120:42471] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aU7fjqv8srZGEpsIm8AYOgAAABA"]
[Sat Dec 27 03:18:39.031798 2025] [:error] [pid 34187:tid 34214] [client 4.194.49.120:35659] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aU7fj6v8srZGEpsIm8AYPgAAABY"]
[Sat Dec 27 03:18:39.367944 2025] [:error] [pid 34187:tid 34211] [client 4.194.49.120:3662] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aU7fj6v8srZGEpsIm8AYPwAAABM"]
[Sat Dec 27 03:18:39.640899 2025] [:error] [pid 34189:tid 34250] [client 4.194.49.120:35703] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aU7fjwnn007DnMwSsfdKxwAAAIM"]
[Sat Dec 27 03:18:39.988564 2025] [:error] [pid 34187:tid 34194] [client 4.194.49.120:52737] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aU7fj6v8srZGEpsIm8AYRgAAAAI"]
[Sat Dec 27 03:18:40.433301 2025] [:error] [pid 47566:tid 47592] [client 4.194.49.120:60542] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aU7fkKyYgLfR4YwO7byxfAAAARc"]
[Sat Dec 27 03:18:40.867053 2025] [:error] [pid 47566:tid 47578] [client 4.194.49.120:42490] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aU7fkKyYgLfR4YwO7byxfwAAAQk"]
[Sat Dec 27 03:18:41.459293 2025] [:error] [pid 34187:tid 34216] [client 4.194.49.120:42481] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aU7fkav8srZGEpsIm8AYSgAAABg"]
[Sat Dec 27 03:18:42.165116 2025] [:error] [pid 34188:tid 34233] [client 4.194.49.120:35650] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aU7fkg54j0mXgip5BAHL2QAAAE0"]
[Sat Dec 27 03:18:42.591380 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:42454] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "aU7fks6fabpS0mfhiCEzvwAAAME"]
[Sat Dec 27 03:18:42.994808 2025] [:error] [pid 34188:tid 34230] [client 4.194.49.120:42487] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asus.php"] [unique_id "aU7fkg54j0mXgip5BAHL4QAAAEo"]
[Sat Dec 27 03:18:43.759455 2025] [:error] [pid 34188:tid 34228] [client 4.194.49.120:3339] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asus.php"] [unique_id "aU7fkw54j0mXgip5BAHL5AAAAEg"]
[Sat Dec 27 03:18:44.112667 2025] [:error] [pid 34188:tid 34223] [client 4.194.49.120:3097] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asus.php"] [unique_id "aU7flA54j0mXgip5BAHL5gAAAEM"]
[Sat Dec 27 03:18:44.486851 2025] [:error] [pid 34187:tid 34207] [client 4.194.49.120:42432] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asus.php"] [unique_id "aU7flKv8srZGEpsIm8AYTwAAAA8"]
[Sat Dec 27 03:18:44.929213 2025] [:error] [pid 34188:tid 34244] [client 4.194.49.120:3081] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aU7flA54j0mXgip5BAHL6QAAAFg"]
[Sat Dec 27 03:18:45.186649 2025] [:error] [pid 34187:tid 34204] [client 4.194.49.120:52792] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aU7flav8srZGEpsIm8AYUgAAAAw"]
[Sat Dec 27 03:18:45.562427 2025] [:error] [pid 47566:tid 47584] [client 4.194.49.120:60518] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aU7flayYgLfR4YwO7byxiwAAAQ8"]
[Sat Dec 27 03:18:46.009066 2025] [:error] [pid 34188:tid 34241] [client 4.194.49.120:60543] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aU7flg54j0mXgip5BAHL6gAAAFU"]
[Sat Dec 27 03:18:46.249474 2025] [:error] [pid 47566:tid 47579] [client 4.194.49.120:3120] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU7flqyYgLfR4YwO7byxjwAAAQo"]
[Sat Dec 27 03:18:46.585614 2025] [:error] [pid 34188:tid 34232] [client 4.194.49.120:42472] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU7flg54j0mXgip5BAHL6wAAAEw"]
[Sat Dec 27 03:18:46.939682 2025] [:error] [pid 34188:tid 34226] [client 4.194.49.120:35064] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU7flg54j0mXgip5BAHL7gAAAEY"]
[Sat Dec 27 03:18:47.370567 2025] [:error] [pid 34189:tid 34270] [client 4.194.49.120:42451] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU7flwnn007DnMwSsfdK1AAAAJc"]
[Sat Dec 27 03:18:47.684446 2025] [:error] [pid 34189:tid 34265] [client 4.194.49.120:43796] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU7flwnn007DnMwSsfdK2AAAAJI"]
[Sat Dec 27 03:18:47.909128 2025] [:error] [pid 34189:tid 34249] [client 4.194.49.120:35031] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU7flwnn007DnMwSsfdK2QAAAII"]
[Sat Dec 27 03:18:48.309948 2025] [:error] [pid 47566:tid 47591] [client 4.194.49.120:60537] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU7fmKyYgLfR4YwO7byxlwAAARY"]
[Sat Dec 27 03:18:48.796634 2025] [:error] [pid 34188:tid 34234] [client 4.194.49.120:60523] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU7fmA54j0mXgip5BAHL9wAAAE4"]
[Sat Dec 27 03:18:49.261066 2025] [:error] [pid 34188:tid 34230] [client 4.194.49.120:52761] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU7fmQ54j0mXgip5BAHL-QAAAEo"]
[Sat Dec 27 03:18:49.787807 2025] [:error] [pid 47566:tid 47590] [client 4.194.49.120:42526] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU7fmayYgLfR4YwO7byxmgAAARU"]
[Sat Dec 27 03:18:50.186612 2025] [:error] [pid 34188:tid 34236] [client 4.194.49.120:3122] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU7fmg54j0mXgip5BAHMAAAAAFA"]
[Sat Dec 27 03:18:50.732940 2025] [:error] [pid 34188:tid 34237] [client 4.194.49.120:3974] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU7fmg54j0mXgip5BAHMAgAAAFE"]
[Sat Dec 27 03:18:51.040100 2025] [:error] [pid 34188:tid 34223] [client 4.194.49.120:60487] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU7fmw54j0mXgip5BAHMAwAAAEM"]
[Sat Dec 27 03:18:51.435085 2025] [:error] [pid 34188:tid 34226] [client 4.194.49.120:35037] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU7fmw54j0mXgip5BAHMCAAAAEY"]
[Sat Dec 27 03:18:51.886501 2025] [:error] [pid 34188:tid 34228] [client 4.194.49.120:4029] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU7fmw54j0mXgip5BAHMDQAAAEg"]
[Sat Dec 27 03:18:52.513527 2025] [:error] [pid 34189:tid 34265] [client 4.194.49.120:43806] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU7fnAnn007DnMwSsfdK5AAAAJI"]
[Sat Dec 27 03:18:52.899289 2025] [:error] [pid 34188:tid 34239] [client 4.194.49.120:4011] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU7fnA54j0mXgip5BAHMEgAAAFM"]
[Sat Dec 27 03:18:53.282698 2025] [:error] [pid 34274:tid 34277] [client 4.194.49.120:3982] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU7fnc6fabpS0mfhiCEz3gAAAME"]
[Sat Dec 27 03:18:53.695433 2025] [:error] [pid 47566:tid 47586] [client 4.194.49.120:35053] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU7fnayYgLfR4YwO7byxpQAAARE"]
[Sat Dec 27 03:18:54.178280 2025] [:error] [pid 34189:tid 34249] [client 4.194.49.120:43809] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU7fngnn007DnMwSsfdK5gAAAII"]
[Sat Dec 27 03:18:54.602368 2025] [:error] [pid 34187:tid 34198] [client 4.194.49.120:55475] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aU7fnqv8srZGEpsIm8AYVwAAAAY"]
[Sat Dec 27 03:18:55.141511 2025] [:error] [pid 34187:tid 34196] [client 4.194.49.120:4035] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aU7fn6v8srZGEpsIm8AYWQAAAAQ"]
[Sat Dec 27 03:18:55.669624 2025] [:error] [pid 34187:tid 34209] [client 4.194.49.120:3079] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aU7fn6v8srZGEpsIm8AYWwAAABE"]
[Sat Dec 27 03:18:56.432323 2025] [:error] [pid 34274:tid 34291] [client 4.194.49.120:50929] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aU7foM6fabpS0mfhiCEz5gAAAM8"]
[Sat Dec 27 03:18:56.822622 2025] [:error] [pid 47566:tid 47572] [client 4.194.49.120:55949] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU7foKyYgLfR4YwO7byxsQAAAQM"]
[Sat Dec 27 03:18:57.337442 2025] [:error] [pid 34187:tid 34194] [client 4.194.49.120:53291] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU7foav8srZGEpsIm8AYYAAAAAI"]
[Sat Dec 27 03:18:57.642708 2025] [:error] [pid 34274:tid 34290] [client 4.194.49.120:55376] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU7foc6fabpS0mfhiCEz6AAAAM4"]
[Sat Dec 27 03:18:57.926825 2025] [:error] [pid 34187:tid 34210] [client 4.194.49.120:55400] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU7foav8srZGEpsIm8AYYQAAABI"]
[Sat Dec 27 03:18:58.221833 2025] [:error] [pid 34274:tid 34300] [client 4.194.49.120:50194] [client 4.194.49.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aU7fos6fabpS0mfhiCEz6wAAANg"]
[Sat Dec 27 03:18:58.759663 2025] [:error] [pid 34188:tid 34240] [client 4.194.49.120:35084] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aU7fog54j0mXgip5BAHMHAAAAFQ"]
[Sat Dec 27 03:18:59.823187 2025] [:error] [pid 34187:tid 34213] [client 4.194.49.120:38199] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aU7fo6v8srZGEpsIm8AYaAAAABU"]
[Sat Dec 27 03:19:00.433746 2025] [:error] [pid 34274:tid 34286] [client 4.194.49.120:55390] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aU7fpM6fabpS0mfhiCEz8AAAAMo"]
[Sat Dec 27 03:19:01.273097 2025] [:error] [pid 47566:tid 47575] [client 4.194.49.120:44559] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU7fpayYgLfR4YwO7byxywAAAQY"]
[Sat Dec 27 03:19:01.832066 2025] [:error] [pid 47566:tid 47582] [client 4.194.49.120:61305] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU7fpayYgLfR4YwO7byxzwAAAQ0"]
[Sat Dec 27 03:19:02.516347 2025] [:error] [pid 34187:tid 34210] [client 4.194.49.120:61279] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU7fpqv8srZGEpsIm8AYbAAAABI"]
[Sat Dec 27 03:19:02.795421 2025] [:error] [pid 47566:tid 47576] [client 4.194.49.120:61703] [client 4.194.49.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU7fpqyYgLfR4YwO7byx2AAAAQc"]
[Sat Dec 27 04:41:53.872379 2025] [:error] [pid 32278:tid 32289] [client 4.189.96.64:13894] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Sat Dec 27 04:41:53.989807 2025] [:error] [pid 32278:tid 32294] [client 4.189.96.64:13894] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Sat Dec 27 04:41:54.134448 2025] [:error] [pid 32278:tid 32303] [client 4.189.96.64:13894] File does not exist: /usr/local/apache/htdocs/suspended-page/13k.php
[Sat Dec 27 04:41:54.412664 2025] [:error] [pid 32278:tid 32301] [client 4.189.96.64:13894] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Sat Dec 27 04:41:54.530297 2025] [:error] [pid 32278:tid 32284] [client 4.189.96.64:13894] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 27 04:41:54.873805 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:13894] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 27 04:41:54.988364 2025] [:error] [pid 32278:tid 32296] [client 4.189.96.64:13894] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aU7zEn-IfCN2Cy9GcchnSwAAANA"]
[Sat Dec 27 04:41:55.387619 2025] [:error] [pid 32193:tid 32259] [client 4.189.96.64:13830] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aU7zExgw0eCOc2qYqaIA5gAAAIk"]
[Sat Dec 27 04:41:55.900457 2025] [:error] [pid 32278:tid 32285] [client 4.189.96.64:13892] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aU7zE3-IfCN2Cy9GcchnTQAAAMU"]
[Sat Dec 27 04:41:56.282031 2025] [:error] [pid 32191:tid 32209] [client 4.189.96.64:13919] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aU7zFLPNtMgrjVCHIdFtSQAAAA4"]
[Sat Dec 27 04:41:56.615460 2025] [:error] [pid 32191:tid 32195] [client 4.189.96.64:13927] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU7zFLPNtMgrjVCHIdFtTAAAAAA"]
[Sat Dec 27 04:41:57.104969 2025] [:error] [pid 32278:tid 32282] [client 4.189.96.64:13826] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU7zFX-IfCN2Cy9GcchnUgAAAMI"]
[Sat Dec 27 04:41:57.422323 2025] [:error] [pid 32278:tid 32303] [client 4.189.96.64:13922] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU7zFX-IfCN2Cy9GcchnVgAAANc"]
[Sat Dec 27 04:41:57.664661 2025] [:error] [pid 32193:tid 32270] [client 4.189.96.64:5069] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU7zFRgw0eCOc2qYqaIA7QAAAJQ"]
[Sat Dec 27 04:41:58.053787 2025] [:error] [pid 32192:tid 32226] [client 4.189.96.64:13840] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "aU7zFi_q0VFe066lbk-sXgAAAEM"]
[Sat Dec 27 04:41:58.483228 2025] [:error] [pid 32278:tid 32298] [client 4.189.96.64:13842] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "aU7zFn-IfCN2Cy9GcchnWQAAANI"]
[Sat Dec 27 04:41:58.856064 2025] [:error] [pid 32278:tid 32284] [client 4.189.96.64:13865] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "aU7zFn-IfCN2Cy9GcchnXAAAAMQ"]
[Sat Dec 27 04:41:59.189049 2025] [:error] [pid 32193:tid 32257] [client 4.189.96.64:13832] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "aU7zFxgw0eCOc2qYqaIA8QAAAIc"]
[Sat Dec 27 04:41:59.514295 2025] [:error] [pid 32193:tid 32266] [client 4.189.96.64:13855] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7zFxgw0eCOc2qYqaIA9QAAAJA"]
[Sat Dec 27 04:41:59.826022 2025] [:error] [pid 32191:tid 32208] [client 4.189.96.64:13846] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7zF7PNtMgrjVCHIdFtWAAAAA0"]
[Sat Dec 27 04:42:00.170808 2025] [:error] [pid 32191:tid 32202] [client 4.189.96.64:13848] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7zGLPNtMgrjVCHIdFtWwAAAAc"]
[Sat Dec 27 04:42:00.597927 2025] [:error] [pid 32193:tid 32259] [client 4.189.96.64:13918] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aU7zGBgw0eCOc2qYqaIA9wAAAIk"]
[Sat Dec 27 04:42:01.194399 2025] [:error] [pid 32193:tid 32263] [client 4.189.96.64:13838] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akc.php"] [unique_id "aU7zGRgw0eCOc2qYqaIA-QAAAI0"]
[Sat Dec 27 04:42:01.534851 2025] [:error] [pid 32191:tid 32196] [client 4.189.96.64:13942] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akc.php"] [unique_id "aU7zGbPNtMgrjVCHIdFtYAAAAAE"]
[Sat Dec 27 04:42:01.940092 2025] [:error] [pid 32278:tid 32299] [client 4.189.96.64:13856] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akc.php"] [unique_id "aU7zGX-IfCN2Cy9GcchnYgAAANM"]
[Sat Dec 27 04:42:02.234886 2025] [:error] [pid 32192:tid 32239] [client 4.189.96.64:5075] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akc.php"] [unique_id "aU7zGi_q0VFe066lbk-sYgAAAFA"]
[Sat Dec 27 04:42:02.653344 2025] [:error] [pid 32278:tid 32295] [client 4.189.96.64:13951] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xleet"] [unique_id "aU7zGn-IfCN2Cy9GcchnZAAAAM8"]
[Sat Dec 27 04:42:02.975346 2025] [:error] [pid 32191:tid 32214] [client 4.189.96.64:13896] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xleet"] [unique_id "aU7zGrPNtMgrjVCHIdFtZAAAABM"]
[Sat Dec 27 04:42:03.293385 2025] [:error] [pid 32193:tid 32258] [client 4.189.96.64:13943] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xleet"] [unique_id "aU7zGxgw0eCOc2qYqaIBAAAAAIg"]
[Sat Dec 27 04:42:03.726692 2025] [:error] [pid 32278:tid 32300] [client 4.189.96.64:13904] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xleet"] [unique_id "aU7zG3-IfCN2Cy9GcchnZQAAANQ"]
[Sat Dec 27 04:42:04.044808 2025] [:error] [pid 32192:tid 32241] [client 4.189.96.64:13852] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aU7zHC_q0VFe066lbk-sZQAAAFI"]
[Sat Dec 27 04:42:04.369104 2025] [:error] [pid 32278:tid 32303] [client 4.189.96.64:13932] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aU7zHH-IfCN2Cy9GcchnaAAAANc"]
[Sat Dec 27 04:42:04.697648 2025] [:error] [pid 32193:tid 32254] [client 4.189.96.64:13825] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aU7zHBgw0eCOc2qYqaIBAwAAAIQ"]
[Sat Dec 27 04:42:04.989357 2025] [:error] [pid 32191:tid 32218] [client 4.189.96.64:13831] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aU7zHLPNtMgrjVCHIdFtbAAAABc"]
[Sat Dec 27 04:42:05.398507 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:13828] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU7zHS_q0VFe066lbk-sawAAAFE"]
[Sat Dec 27 04:42:05.750794 2025] [:error] [pid 32278:tid 32298] [client 4.189.96.64:13947] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU7zHX-IfCN2Cy9GcchnbAAAANI"]
[Sat Dec 27 04:42:06.132386 2025] [:error] [pid 32193:tid 32266] [client 4.189.96.64:5097] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU7zHhgw0eCOc2qYqaIBBwAAAJA"]
[Sat Dec 27 04:42:07.095440 2025] [:error] [pid 32193:tid 32263] [client 4.189.96.64:13890] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU7zHxgw0eCOc2qYqaIBCwAAAI0"]
[Sat Dec 27 04:42:07.523211 2025] [:error] [pid 32192:tid 32244] [client 4.189.96.64:13934] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7zHy_q0VFe066lbk-scgAAAFU"]
[Sat Dec 27 04:42:07.982714 2025] [:error] [pid 32278:tid 32280] [client 4.189.96.64:13935] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7zH3-IfCN2Cy9GcchndQAAAMA"]
[Sat Dec 27 04:42:08.394251 2025] [:error] [pid 32191:tid 32200] [client 4.189.96.64:13937] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7zILPNtMgrjVCHIdFteAAAAAU"]
[Sat Dec 27 04:42:08.719081 2025] [:error] [pid 32192:tid 32245] [client 4.189.96.64:5108] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU7zIC_q0VFe066lbk-sdQAAAFY"]
[Sat Dec 27 04:42:09.062966 2025] [:error] [pid 32193:tid 32274] [client 4.189.96.64:13931] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU7zIRgw0eCOc2qYqaIBEgAAAJg"]
[Sat Dec 27 04:42:09.684055 2025] [:error] [pid 32191:tid 32201] [client 4.189.96.64:13911] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU7zIbPNtMgrjVCHIdFtewAAAAY"]
[Sat Dec 27 04:42:10.062438 2025] [:error] [pid 32191:tid 32219] [client 4.189.96.64:13899] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU7zIrPNtMgrjVCHIdFtfQAAABg"]
[Sat Dec 27 04:42:10.509310 2025] [:error] [pid 32192:tid 32241] [client 4.189.96.64:13854] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aU7zIi_q0VFe066lbk-seQAAAFI"]
[Sat Dec 27 04:42:10.833432 2025] [:error] [pid 32192:tid 32228] [client 4.189.96.64:13867] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/doc.php"] [unique_id "aU7zIi_q0VFe066lbk-sewAAAEU"]
[Sat Dec 27 04:42:11.315192 2025] [:error] [pid 32278:tid 32287] [client 4.189.96.64:13858] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/doc.php"] [unique_id "aU7zI3-IfCN2Cy9GcchniAAAAMc"]
[Sat Dec 27 04:42:11.891035 2025] [:error] [pid 32191:tid 32218] [client 4.189.96.64:13887] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/doc.php"] [unique_id "aU7zI7PNtMgrjVCHIdFtgwAAABc"]
[Sat Dec 27 04:42:12.345389 2025] [:error] [pid 32192:tid 32244] [client 4.189.96.64:5112] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/doc.php"] [unique_id "aU7zJC_q0VFe066lbk-sgAAAAFU"]
[Sat Dec 27 04:42:12.845279 2025] [:error] [pid 32192:tid 32245] [client 4.189.96.64:13849] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aU7zJC_q0VFe066lbk-shgAAAFY"]
[Sat Dec 27 04:42:13.203754 2025] [:error] [pid 32278:tid 32293] [client 4.189.96.64:13900] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aU7zJX-IfCN2Cy9GcchnjgAAAM0"]
[Sat Dec 27 04:42:13.641160 2025] [:error] [pid 32191:tid 32212] [client 4.189.96.64:13902] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aU7zJbPNtMgrjVCHIdFtiAAAABE"]
[Sat Dec 27 04:42:14.308822 2025] [:error] [pid 32192:tid 32236] [client 4.189.96.64:13923] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aU7zJi_q0VFe066lbk-sigAAAE0"]
[Sat Dec 27 04:42:14.950729 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:5110] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aU7zJi_q0VFe066lbk-sjAAAAFE"]
[Sat Dec 27 04:42:15.216717 2025] [:error] [pid 32192:tid 32242] [client 4.189.96.64:5096] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aU7zJy_q0VFe066lbk-sjQAAAFM"]
[Sat Dec 27 04:42:15.708561 2025] [:error] [pid 32191:tid 32195] [client 4.189.96.64:5060] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aU7zJ7PNtMgrjVCHIdFtkAAAAAA"]
[Sat Dec 27 04:42:16.082935 2025] [:error] [pid 32192:tid 32244] [client 4.189.96.64:5033] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/auth.php"] [unique_id "aU7zKC_q0VFe066lbk-skQAAAFU"]
[Sat Dec 27 04:42:16.584909 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:13884] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU7zKH-IfCN2Cy9GcchnlgAAAMM"]
[Sat Dec 27 04:42:16.923447 2025] [:error] [pid 32191:tid 32214] [client 4.189.96.64:13920] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU7zKLPNtMgrjVCHIdFtkwAAABM"]
[Sat Dec 27 04:42:17.290674 2025] [:error] [pid 32191:tid 32219] [client 4.189.96.64:13950] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU7zKbPNtMgrjVCHIdFtlgAAABg"]
[Sat Dec 27 04:42:17.570228 2025] [:error] [pid 32192:tid 32227] [client 4.189.96.64:13915] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU7zKS_q0VFe066lbk-slgAAAEQ"]
[Sat Dec 27 04:42:17.910108 2025] [:error] [pid 32278:tid 32294] [client 4.189.96.64:5081] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7zKX-IfCN2Cy9GcchnlwAAAM4"]
[Sat Dec 27 04:42:18.225146 2025] [:error] [pid 32278:tid 32299] [client 4.189.96.64:13872] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7zKn-IfCN2Cy9GcchnmQAAANM"]
[Sat Dec 27 04:42:18.525327 2025] [:error] [pid 32193:tid 32250] [client 4.189.96.64:13850] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7zKhgw0eCOc2qYqaIBKwAAAIA"]
[Sat Dec 27 04:42:18.855628 2025] [:error] [pid 32278:tid 32293] [client 4.189.96.64:13834] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7zKn-IfCN2Cy9GcchnngAAAM0"]
[Sat Dec 27 04:42:19.252361 2025] [:error] [pid 32192:tid 32223] [client 4.189.96.64:5086] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aU7zKy_q0VFe066lbk-smQAAAEA"]
[Sat Dec 27 04:42:19.656460 2025] [:error] [pid 32193:tid 32256] [client 4.189.96.64:13912] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aU7zKxgw0eCOc2qYqaIBMAAAAIY"]
[Sat Dec 27 04:42:19.959369 2025] [:error] [pid 32191:tid 32205] [client 4.189.96.64:13889] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aU7zK7PNtMgrjVCHIdFtmQAAAAo"]
[Sat Dec 27 04:42:20.437945 2025] [:error] [pid 32191:tid 32215] [client 4.189.96.64:13901] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aU7zLLPNtMgrjVCHIdFtmwAAABQ"]
[Sat Dec 27 04:42:20.749190 2025] [:error] [pid 32191:tid 32197] [client 4.189.96.64:13841] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/fw.php"] [unique_id "aU7zLLPNtMgrjVCHIdFtngAAAAI"]
[Sat Dec 27 04:42:21.371070 2025] [:error] [pid 32191:tid 32203] [client 4.189.96.64:13882] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/fw.php"] [unique_id "aU7zLbPNtMgrjVCHIdFtoQAAAAg"]
[Sat Dec 27 04:42:21.739332 2025] [:error] [pid 32193:tid 32261] [client 4.189.96.64:13863] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/fw.php"] [unique_id "aU7zLRgw0eCOc2qYqaIBNQAAAIs"]
[Sat Dec 27 04:42:22.154871 2025] [:error] [pid 32191:tid 32199] [client 4.189.96.64:13875] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/fw.php"] [unique_id "aU7zLrPNtMgrjVCHIdFtowAAAAQ"]
[Sat Dec 27 04:42:22.676325 2025] [:error] [pid 32192:tid 32236] [client 4.189.96.64:13835] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugz.php"] [unique_id "aU7zLi_q0VFe066lbk-snQAAAE0"]
[Sat Dec 27 04:42:23.048201 2025] [:error] [pid 32193:tid 32260] [client 4.189.96.64:13886] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugz.php"] [unique_id "aU7zLxgw0eCOc2qYqaIBOQAAAIo"]
[Sat Dec 27 04:42:23.380257 2025] [:error] [pid 32191:tid 32207] [client 4.189.96.64:13897] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugz.php"] [unique_id "aU7zL7PNtMgrjVCHIdFtqQAAAAw"]
[Sat Dec 27 04:42:23.730421 2025] [:error] [pid 32191:tid 32213] [client 4.189.96.64:13933] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugz.php"] [unique_id "aU7zL7PNtMgrjVCHIdFtrAAAABI"]
[Sat Dec 27 04:42:24.201851 2025] [:error] [pid 32191:tid 32219] [client 4.189.96.64:5104] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aU7zMLPNtMgrjVCHIdFtrQAAABg"]
[Sat Dec 27 04:42:24.507494 2025] [:error] [pid 32192:tid 32225] [client 4.189.96.64:13928] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aU7zMC_q0VFe066lbk-sogAAAEI"]
[Sat Dec 27 04:42:24.797342 2025] [:error] [pid 32192:tid 32228] [client 4.189.96.64:13868] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aU7zMC_q0VFe066lbk-sowAAAEU"]
[Sat Dec 27 04:42:25.209926 2025] [:error] [pid 32192:tid 32232] [client 4.189.96.64:13939] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aU7zMS_q0VFe066lbk-spQAAAEk"]
[Sat Dec 27 04:42:25.601947 2025] [:error] [pid 32278:tid 32286] [client 4.189.96.64:13944] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aU7zMX-IfCN2Cy9GcchnrQAAAMY"]
[Sat Dec 27 04:42:25.869397 2025] [:error] [pid 32191:tid 32202] [client 4.189.96.64:5071] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aU7zMbPNtMgrjVCHIdFttgAAAAc"]
[Sat Dec 27 04:42:26.157871 2025] [:error] [pid 32191:tid 32196] [client 4.189.96.64:13941] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aU7zMrPNtMgrjVCHIdFtuAAAAAE"]
[Sat Dec 27 04:42:26.571769 2025] [:error] [pid 32191:tid 32200] [client 4.189.96.64:5016] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aU7zMrPNtMgrjVCHIdFtuQAAAAU"]
[Sat Dec 27 04:42:26.900692 2025] [:error] [pid 32278:tid 32298] [client 4.189.96.64:5093] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7zMn-IfCN2Cy9GcchntAAAANI"]
[Sat Dec 27 04:42:27.414345 2025] [:error] [pid 32278:tid 32290] [client 4.189.96.64:13824] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7zM3-IfCN2Cy9GcchntQAAAMo"]
[Sat Dec 27 04:42:27.741455 2025] [:error] [pid 32193:tid 32252] [client 4.189.96.64:13893] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7zMxgw0eCOc2qYqaIBQQAAAII"]
[Sat Dec 27 04:42:28.125530 2025] [:error] [pid 32191:tid 32206] [client 4.189.96.64:13885] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aU7zNLPNtMgrjVCHIdFtvgAAAAs"]
[Sat Dec 27 04:42:28.484955 2025] [:error] [pid 32192:tid 32239] [client 4.189.96.64:13851] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7zNC_q0VFe066lbk-srAAAAFA"]
[Sat Dec 27 04:42:28.809983 2025] [:error] [pid 32192:tid 32234] [client 4.189.96.64:13853] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7zNC_q0VFe066lbk-srgAAAEs"]
[Sat Dec 27 04:42:29.275083 2025] [:error] [pid 32278:tid 32294] [client 4.189.96.64:5064] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7zNX-IfCN2Cy9GcchnvAAAAM4"]
[Sat Dec 27 04:42:29.582458 2025] [:error] [pid 32278:tid 32285] [client 4.189.96.64:5115] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU7zNX-IfCN2Cy9GcchnwgAAAMU"]
[Sat Dec 27 04:42:29.894645 2025] [:error] [pid 32193:tid 32251] [client 4.189.96.64:13869] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU7zNRgw0eCOc2qYqaIBSAAAAIE"]
[Sat Dec 27 04:42:30.248269 2025] [:error] [pid 32193:tid 32255] [client 4.189.96.64:13836] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU7zNhgw0eCOc2qYqaIBSwAAAIU"]
[Sat Dec 27 04:42:30.475891 2025] [:error] [pid 32193:tid 32268] [client 4.189.96.64:13921] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU7zNhgw0eCOc2qYqaIBTAAAAJI"]
[Sat Dec 27 04:42:31.084839 2025] [:error] [pid 32278:tid 32295] [client 4.189.96.64:13860] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU7zN3-IfCN2Cy9GcchnxwAAAM8"]
[Sat Dec 27 04:42:31.454717 2025] [:error] [pid 32192:tid 32236] [client 4.189.96.64:13913] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/composer.php"] [unique_id "aU7zNy_q0VFe066lbk-ssQAAAE0"]
[Sat Dec 27 04:42:31.800066 2025] [:error] [pid 32192:tid 32225] [client 4.189.96.64:5076] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/composer.php"] [unique_id "aU7zNy_q0VFe066lbk-stAAAAEI"]
[Sat Dec 27 04:42:32.414430 2025] [:error] [pid 32193:tid 32270] [client 4.189.96.64:5029] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/composer.php"] [unique_id "aU7zOBgw0eCOc2qYqaIBUgAAAJQ"]
[Sat Dec 27 04:42:32.782235 2025] [:error] [pid 32192:tid 32244] [client 4.189.96.64:5065] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/composer.php"] [unique_id "aU7zOC_q0VFe066lbk-suQAAAFU"]
[Sat Dec 27 04:42:33.344552 2025] [:error] [pid 32192:tid 32247] [client 4.189.96.64:5107] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7zOS_q0VFe066lbk-svgAAAFg"]
[Sat Dec 27 04:42:33.686277 2025] [:error] [pid 32278:tid 32287] [client 4.189.96.64:13861] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7zOX-IfCN2Cy9GcchnzAAAAMc"]
[Sat Dec 27 04:42:34.057984 2025] [:error] [pid 32193:tid 32267] [client 4.189.96.64:5055] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7zOhgw0eCOc2qYqaIBVwAAAJE"]
[Sat Dec 27 04:42:34.335803 2025] [:error] [pid 32278:tid 32302] [client 4.189.96.64:5109] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU7zOn-IfCN2Cy9GcchnzwAAANY"]
[Sat Dec 27 04:42:34.659007 2025] [:error] [pid 32278:tid 32293] [client 4.189.96.64:13930] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7zOn-IfCN2Cy9Gcchn0wAAAM0"]
[Sat Dec 27 04:42:35.164889 2025] [:error] [pid 32191:tid 32195] [client 4.189.96.64:5040] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7zO7PNtMgrjVCHIdFtwwAAAAA"]
[Sat Dec 27 04:42:35.472710 2025] [:error] [pid 32278:tid 32299] [client 4.189.96.64:13924] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7zO3-IfCN2Cy9Gcchn1gAAANM"]
[Sat Dec 27 04:42:35.745345 2025] [:error] [pid 32278:tid 32304] [client 4.189.96.64:13915] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aU7zO3-IfCN2Cy9Gcchn1wAAANg"]
[Sat Dec 27 04:42:36.309247 2025] [:error] [pid 32278:tid 32282] [client 4.189.96.64:5003] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aU7zPH-IfCN2Cy9Gcchn2gAAAMI"]
[Sat Dec 27 04:42:36.702334 2025] [:error] [pid 32193:tid 32268] [client 4.189.96.64:13914] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aU7zPBgw0eCOc2qYqaIBXAAAAJI"]
[Sat Dec 27 04:42:37.170232 2025] [:error] [pid 32278:tid 32297] [client 4.189.96.64:13876] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aU7zPX-IfCN2Cy9Gcchn4AAAANE"]
[Sat Dec 27 04:42:37.612904 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:13843] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aU7zPX-IfCN2Cy9Gcchn5AAAAMM"]
[Sat Dec 27 04:42:38.089510 2025] [:error] [pid 32191:tid 32203] [client 4.189.96.64:5031] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7zPrPNtMgrjVCHIdFtxAAAAAg"]
[Sat Dec 27 04:42:38.638240 2025] [:error] [pid 32191:tid 32213] [client 4.189.96.64:5058] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7zPrPNtMgrjVCHIdFtyQAAABI"]
[Sat Dec 27 04:42:38.939997 2025] [:error] [pid 32191:tid 32218] [client 4.189.96.64:13905] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7zPrPNtMgrjVCHIdFt0AAAABc"]
[Sat Dec 27 04:42:39.371714 2025] [:error] [pid 32191:tid 32197] [client 4.189.96.64:13926] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU7zP7PNtMgrjVCHIdFt1QAAAAI"]
[Sat Dec 27 04:42:39.752017 2025] [:error] [pid 32193:tid 32250] [client 4.189.96.64:13879] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU7zPxgw0eCOc2qYqaIBYgAAAIA"]
[Sat Dec 27 04:42:40.248129 2025] [:error] [pid 32193:tid 32271] [client 4.189.96.64:13908] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU7zQBgw0eCOc2qYqaIBYwAAAJU"]
[Sat Dec 27 04:42:40.601941 2025] [:error] [pid 32191:tid 32199] [client 4.189.96.64:13907] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU7zQLPNtMgrjVCHIdFt3AAAAAQ"]
[Sat Dec 27 04:42:41.184524 2025] [:error] [pid 32278:tid 32303] [client 4.189.96.64:13948] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU7zQX-IfCN2Cy9Gcchn7QAAANc"]
[Sat Dec 27 04:42:41.548629 2025] [:error] [pid 32193:tid 32253] [client 4.189.96.64:5067] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aU7zQRgw0eCOc2qYqaIBZwAAAIM"]
[Sat Dec 27 04:42:41.901642 2025] [:error] [pid 32191:tid 32200] [client 4.189.96.64:13936] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aU7zQbPNtMgrjVCHIdFt4wAAAAU"]
[Sat Dec 27 04:42:42.225998 2025] [:error] [pid 32193:tid 32265] [client 4.189.96.64:13875] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aU7zQhgw0eCOc2qYqaIBaAAAAI8"]
[Sat Dec 27 04:42:42.893640 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:5061] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aU7zQn-IfCN2Cy9Gcchn8wAAAMM"]
[Sat Dec 27 04:42:43.317719 2025] [:error] [pid 32193:tid 32257] [client 4.189.96.64:5089] [client 4.189.96.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aU7zQxgw0eCOc2qYqaIBcgAAAIc"]
[Sat Dec 27 04:42:43.750630 2025] [:error] [pid 32191:tid 32208] [client 4.189.96.64:13829] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/index.php"] [unique_id "aU7zQ7PNtMgrjVCHIdFt5wAAAA0"]
[Sat Dec 27 04:42:44.247715 2025] [:error] [pid 32193:tid 32265] [client 4.189.96.64:5090] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/index.php"] [unique_id "aU7zRBgw0eCOc2qYqaIBegAAAI8"]
[Sat Dec 27 04:42:44.771716 2025] [:error] [pid 32193:tid 32251] [client 4.189.96.64:5056] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/index.php"] [unique_id "aU7zRBgw0eCOc2qYqaIBewAAAIE"]
[Sat Dec 27 04:42:45.070283 2025] [:error] [pid 32278:tid 32299] [client 4.189.96.64:5087] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fix.php"] [unique_id "aU7zRX-IfCN2Cy9Gcchn_QAAANM"]
[Sat Dec 27 04:42:45.462277 2025] [:error] [pid 32278:tid 32281] [client 4.189.96.64:5072] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fix.php"] [unique_id "aU7zRX-IfCN2Cy9GcchoAQAAAME"]
[Sat Dec 27 04:42:45.972415 2025] [:error] [pid 32193:tid 32269] [client 4.189.96.64:5066] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fix.php"] [unique_id "aU7zRRgw0eCOc2qYqaIBggAAAJM"]
[Sat Dec 27 04:42:46.393564 2025] [:error] [pid 32193:tid 32266] [client 4.189.96.64:13864] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fix.php"] [unique_id "aU7zRhgw0eCOc2qYqaIBiAAAAJA"]
[Sat Dec 27 04:42:46.676197 2025] [:error] [pid 32193:tid 32261] [client 4.189.96.64:13883] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aU7zRhgw0eCOc2qYqaIBiwAAAIs"]
[Sat Dec 27 04:42:47.233502 2025] [:error] [pid 32193:tid 32258] [client 4.189.96.64:4995] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aU7zRxgw0eCOc2qYqaIBkQAAAIg"]
[Sat Dec 27 04:42:47.754156 2025] [:error] [pid 32278:tid 32290] [client 4.189.96.64:5114] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aU7zR3-IfCN2Cy9GcchoAwAAAMo"]
[Sat Dec 27 04:42:48.534212 2025] [:error] [pid 32193:tid 32255] [client 4.189.96.64:13847] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aU7zSBgw0eCOc2qYqaIBmwAAAIU"]
[Sat Dec 27 04:42:49.009627 2025] [:error] [pid 32191:tid 32213] [client 4.189.96.64:13906] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fox.php"] [unique_id "aU7zSbPNtMgrjVCHIdFt6gAAABI"]
[Sat Dec 27 04:42:49.418366 2025] [:error] [pid 32193:tid 32270] [client 4.189.96.64:5106] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fox.php"] [unique_id "aU7zSRgw0eCOc2qYqaIBnAAAAJQ"]
[Sat Dec 27 04:42:49.957594 2025] [:error] [pid 32193:tid 32256] [client 4.189.96.64:13877] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fox.php"] [unique_id "aU7zSRgw0eCOc2qYqaIBoAAAAIY"]
[Sat Dec 27 04:42:50.344587 2025] [:error] [pid 32278:tid 32286] [client 4.189.96.64:13827] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fox.php"] [unique_id "aU7zSn-IfCN2Cy9GcchoCQAAAMY"]
[Sat Dec 27 04:42:50.838580 2025] [:error] [pid 32278:tid 32291] [client 4.189.96.64:13845] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function/function.php"] [unique_id "aU7zSn-IfCN2Cy9GcchoDQAAAMs"]
[Sat Dec 27 04:42:51.750410 2025] [:error] [pid 32193:tid 32267] [client 4.189.96.64:5098] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function/function.php"] [unique_id "aU7zSxgw0eCOc2qYqaIBpgAAAJE"]
[Sat Dec 27 04:42:52.399380 2025] [:error] [pid 32278:tid 32290] [client 4.189.96.64:5050] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function/function.php"] [unique_id "aU7zTH-IfCN2Cy9GcchoEgAAAMo"]
[Sat Dec 27 04:42:52.944263 2025] [:error] [pid 32193:tid 32264] [client 4.189.96.64:5059] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function/function.php"] [unique_id "aU7zTBgw0eCOc2qYqaIBqQAAAI4"]
[Sat Dec 27 04:42:53.344659 2025] [:error] [pid 32278:tid 32280] [client 4.189.96.64:5079] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU7zTX-IfCN2Cy9GcchoGAAAAMA"]
[Sat Dec 27 04:42:53.718593 2025] [:error] [pid 32278:tid 32286] [client 4.189.96.64:5077] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU7zTX-IfCN2Cy9GcchoHAAAAMY"]
[Sat Dec 27 04:42:54.057069 2025] [:error] [pid 32192:tid 32243] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sat Dec 27 04:42:54.194339 2025] [:error] [pid 32192:tid 32239] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sat Dec 27 04:42:54.311285 2025] [:error] [pid 32192:tid 32223] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php
[Sat Dec 27 04:42:54.429183 2025] [:error] [pid 32192:tid 32234] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/gelay.php
[Sat Dec 27 04:42:54.657205 2025] [:error] [pid 32192:tid 32224] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sat Dec 27 04:42:54.776319 2025] [:error] [pid 32192:tid 32237] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sat Dec 27 04:42:54.907826 2025] [:error] [pid 32192:tid 32235] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Dec 27 04:42:55.038285 2025] [:error] [pid 32192:tid 32231] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Sat Dec 27 04:42:55.436605 2025] [:error] [pid 32192:tid 32242] [client 4.189.96.64:5080] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Dec 27 04:42:55.553084 2025] [:error] [pid 32192:tid 32225] [client 4.189.96.64:5080] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.bak.php"] [unique_id "aU7zTy_q0VFe066lbk-s2gAAAEI"]
[Sat Dec 27 04:42:56.369431 2025] [:error] [pid 32193:tid 32261] [client 4.189.96.64:13844] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.bak.php"] [unique_id "aU7zUBgw0eCOc2qYqaIBsQAAAIs"]
[Sat Dec 27 04:42:56.662039 2025] [:error] [pid 32191:tid 32196] [client 4.189.96.64:4933] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.bak.php"] [unique_id "aU7zULPNtMgrjVCHIdFt_QAAAAE"]
[Sat Dec 27 04:42:57.126296 2025] [:error] [pid 32278:tid 32282] [client 4.189.96.64:5073] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.bak.php"] [unique_id "aU7zUX-IfCN2Cy9GcchoIwAAAMI"]
[Sat Dec 27 04:42:58.019224 2025] [:error] [pid 32193:tid 32265] [client 4.189.96.64:13881] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aU7zUhgw0eCOc2qYqaIBtwAAAI8"]
[Sat Dec 27 04:42:58.636856 2025] [:error] [pid 32191:tid 32211] [client 4.189.96.64:13909] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aU7zUrPNtMgrjVCHIdFt_gAAABA"]
[Sat Dec 27 04:42:59.720166 2025] [:error] [pid 32193:tid 32273] [client 4.189.96.64:5083] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aU7zUxgw0eCOc2qYqaIBugAAAJc"]
[Sat Dec 27 04:43:00.213152 2025] [:error] [pid 32278:tid 32300] [client 4.189.96.64:13870] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aU7zVH-IfCN2Cy9GcchoLgAAANQ"]
[Sat Dec 27 04:43:00.744938 2025] [:error] [pid 32192:tid 32226] [client 4.189.96.64:5063] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7zVC_q0VFe066lbk-s3gAAAEM"]
[Sat Dec 27 04:43:01.403594 2025] [:error] [pid 32278:tid 32304] [client 4.189.96.64:5099] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7zVX-IfCN2Cy9GcchoMgAAANg"]
[Sat Dec 27 04:43:01.970795 2025] [:error] [pid 32193:tid 32264] [client 4.189.96.64:5024] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7zVRgw0eCOc2qYqaIBvQAAAI4"]
[Sat Dec 27 04:43:03.038728 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:13837] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aU7zV3-IfCN2Cy9GcchoPQAAAMM"]
[Sat Dec 27 04:43:03.700247 2025] [:error] [pid 32191:tid 32201] [client 4.189.96.64:13932] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/infos.php"] [unique_id "aU7zV7PNtMgrjVCHIdFuBAAAAAY"]
[Sat Dec 27 04:43:04.219057 2025] [:error] [pid 32191:tid 32198] [client 4.189.96.64:5028] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/infos.php"] [unique_id "aU7zWLPNtMgrjVCHIdFuBwAAAAM"]
[Sat Dec 27 04:43:05.048566 2025] [:error] [pid 32191:tid 32197] [client 4.189.96.64:4971] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/infos.php"] [unique_id "aU7zWbPNtMgrjVCHIdFuDgAAAAI"]
[Sat Dec 27 04:43:05.845062 2025] [:error] [pid 32191:tid 32203] [client 4.189.96.64:5113] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/infos.php"] [unique_id "aU7zWbPNtMgrjVCHIdFuEgAAAAg"]
[Sat Dec 27 04:43:06.159311 2025] [:error] [pid 32191:tid 32204] [client 4.189.96.64:13874] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7zWrPNtMgrjVCHIdFuFQAAAAk"]
[Sat Dec 27 04:43:07.000487 2025] [:error] [pid 32278:tid 32292] [client 4.189.96.64:13888] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7zWn-IfCN2Cy9GcchoSgAAAMw"]
[Sat Dec 27 04:43:07.356681 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:4992] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7zW3-IfCN2Cy9GcchoTAAAAMM"]
[Sat Dec 27 04:43:07.747479 2025] [:error] [pid 32191:tid 32196] [client 4.189.96.64:4996] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU7zW7PNtMgrjVCHIdFuJwAAAAE"]
[Sat Dec 27 04:43:08.248845 2025] [:error] [pid 32193:tid 32261] [client 4.189.96.64:5030] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU7zXBgw0eCOc2qYqaIBxQAAAIs"]
[Sat Dec 27 04:43:08.813287 2025] [:error] [pid 32192:tid 32235] [client 4.189.96.64:5078] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU7zXC_q0VFe066lbk-s6gAAAEw"]
[Sat Dec 27 04:43:09.373608 2025] [:error] [pid 32192:tid 32229] [client 4.189.96.64:5015] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU7zXS_q0VFe066lbk-s7QAAAEY"]
[Sat Dec 27 04:43:09.909373 2025] [:error] [pid 32191:tid 32217] [client 4.189.96.64:13903] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU7zXbPNtMgrjVCHIdFuNgAAABY"]
[Sat Dec 27 04:43:10.431768 2025] [:error] [pid 32278:tid 32289] [client 4.189.96.64:4944] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aU7zXn-IfCN2Cy9GcchoWgAAAMk"]
[Sat Dec 27 04:43:10.806409 2025] [:error] [pid 32191:tid 32203] [client 4.189.96.64:5119] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aU7zXrPNtMgrjVCHIdFuOQAAAAg"]
[Sat Dec 27 04:43:11.286332 2025] [:error] [pid 32193:tid 32259] [client 4.189.96.64:5088] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aU7zXxgw0eCOc2qYqaIB0gAAAIk"]
[Sat Dec 27 04:43:12.003845 2025] [:error] [pid 32191:tid 32212] [client 4.189.96.64:5013] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aU7zYLPNtMgrjVCHIdFuRQAAABE"]
[Sat Dec 27 04:43:12.258342 2025] [:error] [pid 32193:tid 32252] [client 4.189.96.64:5091] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini"] [unique_id "aU7zYBgw0eCOc2qYqaIB1QAAAII"]
[Sat Dec 27 04:43:12.591219 2025] [:error] [pid 32191:tid 32195] [client 4.189.96.64:13940] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini"] [unique_id "aU7zYLPNtMgrjVCHIdFuSgAAAAA"]
[Sat Dec 27 04:43:12.925889 2025] [:error] [pid 32191:tid 32196] [client 4.189.96.64:5100] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini"] [unique_id "aU7zYLPNtMgrjVCHIdFuTQAAAAE"]
[Sat Dec 27 04:43:13.829399 2025] [:error] [pid 32192:tid 32231] [client 4.189.96.64:5020] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini"] [unique_id "aU7zYS_q0VFe066lbk-s_QAAAEg"]
[Sat Dec 27 04:43:14.225214 2025] [:error] [pid 32278:tid 32295] [client 4.189.96.64:5085] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aU7zYn-IfCN2Cy9GcchoXgAAAM8"]
[Sat Dec 27 04:43:14.776397 2025] [:error] [pid 32191:tid 32209] [client 4.189.96.64:4951] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aU7zYrPNtMgrjVCHIdFuWQAAAA4"]
[Sat Dec 27 04:43:15.257774 2025] [:error] [pid 32191:tid 32217] [client 4.189.96.64:5092] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aU7zY7PNtMgrjVCHIdFuYAAAABY"]
[Sat Dec 27 04:43:15.570136 2025] [:error] [pid 32192:tid 32232] [client 4.189.96.64:5057] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aU7zYy_q0VFe066lbk-tBAAAAEk"]
[Sat Dec 27 04:43:15.929473 2025] [:error] [pid 32278:tid 32293] [client 4.189.96.64:5002] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mm.php"] [unique_id "aU7zY3-IfCN2Cy9GcchobgAAAM0"]
[Sat Dec 27 04:43:16.454387 2025] [:error] [pid 32193:tid 32270] [client 4.189.96.64:5023] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mm.php"] [unique_id "aU7zZBgw0eCOc2qYqaIB3QAAAJQ"]
[Sat Dec 27 04:43:16.986431 2025] [:error] [pid 32191:tid 32215] [client 4.189.96.64:5009] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mm.php"] [unique_id "aU7zZLPNtMgrjVCHIdFubgAAABQ"]
[Sat Dec 27 04:43:17.735494 2025] [:error] [pid 32278:tid 32281] [client 4.189.96.64:5070] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mm.php"] [unique_id "aU7zZX-IfCN2Cy9GcchodAAAAME"]
[Sat Dec 27 04:43:18.068438 2025] [:error] [pid 32193:tid 32253] [client 4.189.96.64:4957] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aU7zZhgw0eCOc2qYqaIB4gAAAIM"]
[Sat Dec 27 04:43:18.583207 2025] [:error] [pid 32278:tid 32294] [client 4.189.96.64:13917] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aU7zZn-IfCN2Cy9GcchoeAAAAM4"]
[Sat Dec 27 04:43:19.016099 2025] [:error] [pid 32193:tid 32260] [client 4.189.96.64:5021] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aU7zZxgw0eCOc2qYqaIB6wAAAIo"]
[Sat Dec 27 04:43:19.583110 2025] [:error] [pid 32193:tid 32250] [client 4.189.96.64:13857] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aU7zZxgw0eCOc2qYqaIB8gAAAIA"]
[Sat Dec 27 04:43:20.049789 2025] [:error] [pid 32278:tid 32297] [client 4.189.96.64:5000] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-themes.php"] [unique_id "aU7zaH-IfCN2Cy9GcchoiQAAANE"]
[Sat Dec 27 04:43:20.659237 2025] [:error] [pid 32193:tid 32267] [client 4.189.96.64:5006] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-themes.php"] [unique_id "aU7zaBgw0eCOc2qYqaIB-gAAAJE"]
[Sat Dec 27 04:43:20.982107 2025] [:error] [pid 32278:tid 32296] [client 4.189.96.64:13946] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-themes.php"] [unique_id "aU7zaH-IfCN2Cy9GcchojQAAANA"]
[Sat Dec 27 04:43:21.728179 2025] [:error] [pid 32193:tid 32251] [client 4.189.96.64:5102] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-themes.php"] [unique_id "aU7zaRgw0eCOc2qYqaICAgAAAIE"]
[Sat Dec 27 04:43:22.039226 2025] [:error] [pid 32193:tid 32268] [client 4.189.96.64:13925] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-reading.php"] [unique_id "aU7zahgw0eCOc2qYqaICBQAAAJI"]
[Sat Dec 27 04:43:22.444879 2025] [:error] [pid 32193:tid 32253] [client 4.189.96.64:13859] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-reading.php"] [unique_id "aU7zahgw0eCOc2qYqaICCAAAAIM"]
[Sat Dec 27 04:43:22.850259 2025] [:error] [pid 32191:tid 32196] [client 4.189.96.64:5111] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-reading.php"] [unique_id "aU7zarPNtMgrjVCHIdFugQAAAAE"]
[Sat Dec 27 04:43:23.539527 2025] [:error] [pid 32278:tid 32286] [client 4.189.96.64:5062] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-reading.php"] [unique_id "aU7za3-IfCN2Cy9GccholgAAAMY"]
[Sat Dec 27 04:43:24.456444 2025] [:error] [pid 32193:tid 32251] [client 4.189.96.64:5105] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-writing.php"] [unique_id "aU7zbBgw0eCOc2qYqaICFgAAAIE"]
[Sat Dec 27 04:43:25.160831 2025] [:error] [pid 32278:tid 32292] [client 4.189.96.64:5010] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-writing.php"] [unique_id "aU7zbX-IfCN2Cy9GcchonQAAAMw"]
[Sat Dec 27 04:43:25.753315 2025] [:error] [pid 32193:tid 32256] [client 4.189.96.64:5018] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-writing.php"] [unique_id "aU7zbRgw0eCOc2qYqaICGwAAAIY"]
[Sat Dec 27 04:43:26.807962 2025] [:error] [pid 32278:tid 32280] [client 4.189.96.64:5041] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-writing.php"] [unique_id "aU7zbn-IfCN2Cy9GcchopgAAAMA"]
[Sat Dec 27 04:43:27.296670 2025] [:error] [pid 32191:tid 32202] [client 4.189.96.64:4958] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aU7zb7PNtMgrjVCHIdFuiwAAAAc"]
[Sat Dec 27 04:43:28.042377 2025] [:error] [pid 32278:tid 32285] [client 4.189.96.64:4939] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aU7zcH-IfCN2Cy9GcchorgAAAMU"]
[Sat Dec 27 04:43:28.416261 2025] [:error] [pid 32193:tid 32269] [client 4.189.96.64:5095] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aU7zcBgw0eCOc2qYqaICIwAAAJM"]
[Sat Dec 27 04:43:28.820431 2025] [:error] [pid 32192:tid 32230] [client 4.189.96.64:4928] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aU7zcC_q0VFe066lbk-tGgAAAEc"]
[Sat Dec 27 04:43:29.335811 2025] [:error] [pid 32193:tid 32260] [client 4.189.96.64:5113] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aU7zcRgw0eCOc2qYqaICJAAAAIo"]
[Sat Dec 27 04:43:30.015435 2025] [:error] [pid 32278:tid 32300] [client 4.189.96.64:13945] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aU7zcn-IfCN2Cy9GcchotgAAANQ"]
[Sat Dec 27 04:43:30.467620 2025] [:error] [pid 32191:tid 32215] [client 4.189.96.64:13910] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aU7zcrPNtMgrjVCHIdFukgAAABQ"]
[Sat Dec 27 04:43:30.724811 2025] [:error] [pid 32278:tid 32294] [client 4.189.96.64:5074] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aU7zcn-IfCN2Cy9GcchouQAAAM4"]
[Sat Dec 27 04:43:31.192227 2025] [:error] [pid 32191:tid 32201] [client 4.189.96.64:4930] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-config-sample.php"] [unique_id "aU7zc7PNtMgrjVCHIdFulgAAAAY"]
[Sat Dec 27 04:43:31.780096 2025] [:error] [pid 32278:tid 32288] [client 4.189.96.64:5052] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-config-sample.php"] [unique_id "aU7zc3-IfCN2Cy9GcchovQAAAMg"]
[Sat Dec 27 04:43:32.033665 2025] [:error] [pid 32191:tid 32211] [client 4.189.96.64:13949] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-config-sample.php"] [unique_id "aU7zdLPNtMgrjVCHIdFumAAAABA"]
[Sat Dec 27 04:43:32.765020 2025] [:error] [pid 32191:tid 32213] [client 4.189.96.64:13916] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-config-sample.php"] [unique_id "aU7zdLPNtMgrjVCHIdFunAAAABI"]
[Sat Dec 27 04:43:33.327369 2025] [:error] [pid 32278:tid 32291] [client 4.189.96.64:5022] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activat.php"] [unique_id "aU7zdX-IfCN2Cy9GcchowwAAAMs"]
[Sat Dec 27 04:43:33.711455 2025] [:error] [pid 32191:tid 32199] [client 4.189.96.64:13873] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activat.php"] [unique_id "aU7zdbPNtMgrjVCHIdFuoAAAAAQ"]
[Sat Dec 27 04:43:34.216470 2025] [:error] [pid 32192:tid 32225] [client 4.189.96.64:5012] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activat.php"] [unique_id "aU7zdi_q0VFe066lbk-tMQAAAEI"]
[Sat Dec 27 04:43:34.835296 2025] [:error] [pid 32278:tid 32296] [client 4.189.96.64:13871] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activat.php"] [unique_id "aU7zdn-IfCN2Cy9GcchoyQAAANA"]
[Sat Dec 27 04:43:35.235880 2025] [:error] [pid 32192:tid 32242] [client 4.189.96.64:5094] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aU7zdy_q0VFe066lbk-tOAAAAFM"]
[Sat Dec 27 04:43:35.555197 2025] [:error] [pid 32278:tid 32304] [client 4.189.96.64:5043] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aU7zd3-IfCN2Cy9GcchozQAAANg"]
[Sat Dec 27 04:43:36.087032 2025] [:error] [pid 32192:tid 32241] [client 4.189.96.64:4883] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aU7zeC_q0VFe066lbk-tQQAAAFI"]
[Sat Dec 27 04:43:36.514291 2025] [:error] [pid 32192:tid 32236] [client 4.189.96.64:13880] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pages.php"] [unique_id "aU7zeC_q0VFe066lbk-tRAAAAE0"]
[Sat Dec 27 04:43:37.016017 2025] [:error] [pid 32192:tid 32231] [client 4.189.96.64:4932] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU7zeS_q0VFe066lbk-tSAAAAEg"]
[Sat Dec 27 04:43:37.451594 2025] [:error] [pid 32193:tid 32262] [client 4.189.96.64:4949] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU7zeRgw0eCOc2qYqaICMAAAAIw"]
[Sat Dec 27 04:43:37.936935 2025] [:error] [pid 32191:tid 32215] [client 4.189.96.64:4865] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU7zebPNtMgrjVCHIdFupgAAABQ"]
[Sat Dec 27 04:43:38.250896 2025] [:error] [pid 32192:tid 32245] [client 4.189.96.64:4969] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aU7zei_q0VFe066lbk-tUQAAAFY"]
[Sat Dec 27 04:43:38.612560 2025] [:error] [pid 32278:tid 32286] [client 4.189.96.64:5103] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nf.php"] [unique_id "aU7zen-IfCN2Cy9Gccho1AAAAMY"]
[Sat Dec 27 04:43:39.072959 2025] [:error] [pid 32191:tid 32210] [client 4.189.96.64:4947] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nf.php"] [unique_id "aU7ze7PNtMgrjVCHIdFuqQAAAA8"]
[Sat Dec 27 04:43:39.525327 2025] [:error] [pid 32278:tid 32292] [client 4.189.96.64:5011] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nf.php"] [unique_id "aU7ze3-IfCN2Cy9Gccho1wAAAMw"]
[Sat Dec 27 04:43:39.792283 2025] [:error] [pid 32278:tid 32297] [client 4.189.96.64:5115] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nf.php"] [unique_id "aU7ze3-IfCN2Cy9Gccho2QAAANE"]
[Sat Dec 27 04:43:40.200353 2025] [:error] [pid 32193:tid 32269] [client 4.189.96.64:5084] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7zfBgw0eCOc2qYqaICNwAAAJM"]
[Sat Dec 27 04:43:41.226249 2025] [:error] [pid 32192:tid 32232] [client 4.189.96.64:4997] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7zfS_q0VFe066lbk-tXgAAAEk"]
[Sat Dec 27 04:43:43.070880 2025] [:error] [pid 32193:tid 32271] [client 4.189.96.64:5082] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7zfxgw0eCOc2qYqaICRAAAAJU"]
[Sat Dec 27 04:43:43.928893 2025] [:error] [pid 32193:tid 32255] [client 4.189.96.64:4999] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU7zfxgw0eCOc2qYqaICSwAAAIU"]
[Sat Dec 27 04:43:44.814631 2025] [:error] [pid 32278:tid 32286] [client 4.189.96.64:4973] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aU7zgH-IfCN2Cy9Gccho5wAAAMY"]
[Sat Dec 27 04:43:45.276997 2025] [:error] [pid 32191:tid 32197] [client 4.189.96.64:4993] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aU7zgbPNtMgrjVCHIdFuugAAAAI"]
[Sat Dec 27 04:43:45.794013 2025] [:error] [pid 32192:tid 32225] [client 4.189.96.64:5036] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aU7zgS_q0VFe066lbk-tcgAAAEI"]
[Sat Dec 27 04:43:46.148297 2025] [:error] [pid 32192:tid 32229] [client 4.189.96.64:4948] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aU7zgi_q0VFe066lbk-tdAAAAEY"]
[Sat Dec 27 04:43:46.914471 2025] [:error] [pid 32278:tid 32281] [client 4.189.96.64:5005] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU7zgn-IfCN2Cy9Gccho8QAAAME"]
[Sat Dec 27 04:43:47.404667 2025] [:error] [pid 32191:tid 32219] [client 4.189.96.64:5017] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU7zg7PNtMgrjVCHIdFuwAAAABg"]
[Sat Dec 27 04:43:47.890510 2025] [:error] [pid 32193:tid 32274] [client 4.189.96.64:4946] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU7zgxgw0eCOc2qYqaICVQAAAJg"]
[Sat Dec 27 04:43:48.573092 2025] [:error] [pid 32191:tid 32204] [client 4.189.96.64:5018] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php.php"] [unique_id "aU7zhLPNtMgrjVCHIdFuwQAAAAk"]
[Sat Dec 27 04:43:49.368032 2025] [:error] [pid 32192:tid 32230] [client 4.189.96.64:4953] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7zhS_q0VFe066lbk-tdwAAAEc"]
[Sat Dec 27 04:43:49.799642 2025] [:error] [pid 32191:tid 32215] [client 4.189.96.64:4994] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7zhbPNtMgrjVCHIdFuxwAAABQ"]
[Sat Dec 27 04:43:50.420074 2025] [:error] [pid 32191:tid 32205] [client 4.189.96.64:5039] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7zhrPNtMgrjVCHIdFuywAAAAo"]
[Sat Dec 27 04:43:51.091143 2025] [:error] [pid 32193:tid 32274] [client 4.189.96.64:13839] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU7zhxgw0eCOc2qYqaICZwAAAJg"]
[Sat Dec 27 04:43:51.597509 2025] [:error] [pid 32193:tid 32268] [client 4.189.96.64:5044] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php8.php"] [unique_id "aU7zhxgw0eCOc2qYqaICbAAAAJI"]
[Sat Dec 27 04:43:51.935291 2025] [:error] [pid 32193:tid 32257] [client 4.189.96.64:5042] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php8.php"] [unique_id "aU7zhxgw0eCOc2qYqaICcQAAAIc"]
[Sat Dec 27 04:43:52.377444 2025] [:error] [pid 32191:tid 32207] [client 4.189.96.64:5007] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php8.php"] [unique_id "aU7ziLPNtMgrjVCHIdFuzwAAAAw"]
[Sat Dec 27 04:43:52.907515 2025] [:error] [pid 32193:tid 32262] [client 4.189.96.64:13938] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/php8.php"] [unique_id "aU7ziBgw0eCOc2qYqaICdwAAAIw"]
[Sat Dec 27 04:43:53.302513 2025] [:error] [pid 32278:tid 32291] [client 4.189.96.64:4875] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aU7ziX-IfCN2Cy9Gccho-gAAAMs"]
[Sat Dec 27 04:43:53.777287 2025] [:error] [pid 32278:tid 32303] [client 4.189.96.64:4941] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aU7ziX-IfCN2Cy9Gccho_AAAANc"]
[Sat Dec 27 04:43:54.512378 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:4986] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aU7zin-IfCN2Cy9GcchpAQAAAMM"]
[Sat Dec 27 04:43:54.879956 2025] [:error] [pid 32192:tid 32227] [client 4.189.96.64:4978] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aU7zii_q0VFe066lbk-thAAAAEQ"]
[Sat Dec 27 04:43:55.394125 2025] [:error] [pid 32192:tid 32238] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Sat Dec 27 04:43:55.532348 2025] [:error] [pid 32192:tid 32228] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Dec 27 04:43:55.669155 2025] [:error] [pid 32192:tid 32224] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Dec 27 04:43:55.823511 2025] [:error] [pid 32192:tid 32244] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Dec 27 04:43:55.940268 2025] [:error] [pid 32192:tid 32230] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Dec 27 04:43:56.078779 2025] [:error] [pid 32192:tid 32247] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Dec 27 04:43:56.232466 2025] [:error] [pid 32192:tid 32235] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Sat Dec 27 04:43:56.391066 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/rt.php
[Sat Dec 27 04:43:56.538878 2025] [:error] [pid 32192:tid 32236] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Sat Dec 27 04:43:56.703050 2025] [:error] [pid 32192:tid 32234] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sat Dec 27 04:43:56.861501 2025] [:error] [pid 32192:tid 32237] [client 4.189.96.64:5047] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Dec 27 04:43:57.026522 2025] [:error] [pid 32192:tid 32242] [client 4.189.96.64:5047] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sts.php"] [unique_id "aU7zjS_q0VFe066lbk-tmQAAAFM"]
[Sat Dec 27 04:43:57.809490 2025] [:error] [pid 32191:tid 32202] [client 4.189.96.64:5014] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sts.php"] [unique_id "aU7zjbPNtMgrjVCHIdFu2AAAAAc"]
[Sat Dec 27 04:43:58.397512 2025] [:error] [pid 32191:tid 32200] [client 4.189.96.64:13929] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sts.php"] [unique_id "aU7zjrPNtMgrjVCHIdFu3AAAAAU"]
[Sat Dec 27 04:43:58.802995 2025] [:error] [pid 32278:tid 32290] [client 4.189.96.64:13833] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sts.php"] [unique_id "aU7zjn-IfCN2Cy9GcchpFAAAAMo"]
[Sat Dec 27 04:43:59.451568 2025] [:error] [pid 32192:tid 32247] [client 4.189.96.64:5004] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aU7zjy_q0VFe066lbk-toQAAAFg"]
[Sat Dec 27 04:44:00.157122 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:5068] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aU7zkC_q0VFe066lbk-tpQAAAFE"]
[Sat Dec 27 04:44:00.510095 2025] [:error] [pid 32192:tid 32241] [client 4.189.96.64:5048] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aU7zkC_q0VFe066lbk-tqAAAAFI"]
[Sat Dec 27 04:44:00.830188 2025] [:error] [pid 32191:tid 32198] [client 4.189.96.64:5101] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aU7zkLPNtMgrjVCHIdFu4wAAAAM"]
[Sat Dec 27 04:44:01.216877 2025] [:error] [pid 32278:tid 32290] [client 4.189.96.64:5049] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aU7zkX-IfCN2Cy9GcchpKwAAAMo"]
[Sat Dec 27 04:44:01.582824 2025] [:error] [pid 32278:tid 32281] [client 4.189.96.64:13830] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aU7zkX-IfCN2Cy9GcchpLwAAAME"]
[Sat Dec 27 04:44:02.052763 2025] [:error] [pid 32193:tid 32251] [client 4.189.96.64:4935] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aU7zkhgw0eCOc2qYqaICggAAAIE"]
[Sat Dec 27 04:44:02.995347 2025] [:error] [pid 32192:tid 32239] [client 4.189.96.64:13898] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aU7zki_q0VFe066lbk-tugAAAFA"]
[Sat Dec 27 04:44:03.503110 2025] [:error] [pid 32193:tid 32262] [client 4.189.96.64:4807] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file/function.php"] [unique_id "aU7zkxgw0eCOc2qYqaICiAAAAIw"]
[Sat Dec 27 04:44:03.926260 2025] [:error] [pid 32278:tid 32296] [client 4.189.96.64:4934] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file/function.php"] [unique_id "aU7zk3-IfCN2Cy9GcchpQwAAANA"]
[Sat Dec 27 04:44:04.536900 2025] [:error] [pid 32278:tid 32298] [client 4.189.96.64:4900] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file/function.php"] [unique_id "aU7zlH-IfCN2Cy9GcchpSQAAANI"]
[Sat Dec 27 04:44:04.940731 2025] [:error] [pid 32278:tid 32285] [client 4.189.96.64:5038] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file/function.php"] [unique_id "aU7zlH-IfCN2Cy9GcchpUAAAAMU"]
[Sat Dec 27 04:44:05.672869 2025] [:error] [pid 32278:tid 32300] [client 4.189.96.64:4938] [client 4.189.96.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aU7zlX-IfCN2Cy9GcchpVwAAANQ"]
[Sat Dec 27 04:44:06.246989 2025] [:error] [pid 32193:tid 32273] [client 4.189.96.64:4809] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aU7zlhgw0eCOc2qYqaICkAAAAJc"]
[Sat Dec 27 04:44:06.978607 2025] [:error] [pid 32193:tid 32272] [client 4.189.96.64:5021] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aU7zlhgw0eCOc2qYqaICkwAAAJY"]
[Sat Dec 27 04:44:07.534611 2025] [:error] [pid 32191:tid 32215] [client 4.189.96.64:5082] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aU7zl7PNtMgrjVCHIdFvCQAAABQ"]
[Sat Dec 27 04:44:08.133287 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:5037] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aU7zmH-IfCN2Cy9GcchpZwAAAMM"]
[Sat Dec 27 04:44:09.019452 2025] [:error] [pid 32278:tid 32298] [client 4.189.96.64:13946] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/users.php"] [unique_id "aU7zmX-IfCN2Cy9GcchpcAAAANI"]
[Sat Dec 27 04:44:09.637558 2025] [:error] [pid 32191:tid 32211] [client 4.189.96.64:13925] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/users.php"] [unique_id "aU7zmbPNtMgrjVCHIdFvDwAAABA"]
[Sat Dec 27 04:44:10.081480 2025] [:error] [pid 32191:tid 32202] [client 4.189.96.64:5008] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/users.php"] [unique_id "aU7zmrPNtMgrjVCHIdFvEgAAAAc"]
[Sat Dec 27 04:44:10.587050 2025] [:error] [pid 32193:tid 32271] [client 4.189.96.64:4739] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/users.php"] [unique_id "aU7zmhgw0eCOc2qYqaICngAAAJU"]
[Sat Dec 27 04:44:11.169722 2025] [:error] [pid 32191:tid 32209] [client 4.189.96.64:4831] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7zm7PNtMgrjVCHIdFvGwAAAA4"]
[Sat Dec 27 04:44:11.534779 2025] [:error] [pid 32193:tid 32255] [client 4.189.96.64:4987] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7zmxgw0eCOc2qYqaICowAAAIU"]
[Sat Dec 27 04:44:12.037605 2025] [:error] [pid 32278:tid 32300] [client 4.189.96.64:13895] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7znH-IfCN2Cy9GcchplgAAANQ"]
[Sat Dec 27 04:44:12.535267 2025] [:error] [pid 32193:tid 32266] [client 4.189.96.64:4980] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU7znBgw0eCOc2qYqaICqAAAAJA"]
[Sat Dec 27 04:44:12.927788 2025] [:error] [pid 32193:tid 32250] [client 4.189.96.64:4968] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aU7znBgw0eCOc2qYqaICrQAAAIA"]
[Sat Dec 27 04:44:13.295361 2025] [:error] [pid 32278:tid 32295] [client 4.189.96.64:5046] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aU7znX-IfCN2Cy9GcchpmgAAAM8"]
[Sat Dec 27 04:44:13.789203 2025] [:error] [pid 32278:tid 32288] [client 4.189.96.64:4990] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aU7znX-IfCN2Cy9GcchpoQAAAMg"]
[Sat Dec 27 04:44:14.124686 2025] [:error] [pid 32192:tid 32246] [client 4.189.96.64:4955] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aU7zni_q0VFe066lbk-t1wAAAFc"]
[Sat Dec 27 04:44:14.762790 2025] [:error] [pid 32192:tid 32230] [client 4.189.96.64:4879] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "aU7zni_q0VFe066lbk-t3AAAAEc"]
[Sat Dec 27 04:44:15.767158 2025] [:error] [pid 32193:tid 32272] [client 4.189.96.64:4874] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "aU7znxgw0eCOc2qYqaICvQAAAJY"]
[Sat Dec 27 04:44:16.243665 2025] [:error] [pid 32278:tid 32294] [client 4.189.96.64:5025] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "aU7zoH-IfCN2Cy9GcchpuAAAAM4"]
[Sat Dec 27 04:44:17.430057 2025] [:error] [pid 32191:tid 32209] [client 4.189.96.64:13862] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "aU7zobPNtMgrjVCHIdFvLAAAAA4"]
[Sat Dec 27 04:44:18.200039 2025] [:error] [pid 32191:tid 32195] [client 4.189.96.64:4981] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "aU7zorPNtMgrjVCHIdFvNQAAAAA"]
[Sat Dec 27 04:44:18.933497 2025] [:error] [pid 32193:tid 32259] [client 4.189.96.64:4877] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "aU7zohgw0eCOc2qYqaIC2AAAAIk"]
[Sat Dec 27 04:44:19.624809 2025] [:error] [pid 32192:tid 32225] [client 4.189.96.64:4929] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "aU7zoy_q0VFe066lbk-t9wAAAEI"]
[Sat Dec 27 04:44:20.038891 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:13878] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "aU7zpC_q0VFe066lbk-t-gAAAFE"]
[Sat Dec 27 04:44:20.460995 2025] [:error] [pid 32278:tid 32295] [client 4.189.96.64:4962] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aU7zpH-IfCN2Cy9Gcchp2QAAAM8"]
[Sat Dec 27 04:44:21.101725 2025] [:error] [pid 32278:tid 32299] [client 4.189.96.64:5116] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aU7zpX-IfCN2Cy9Gcchp3gAAANM"]
[Sat Dec 27 04:44:21.570677 2025] [:error] [pid 32278:tid 32296] [client 4.189.96.64:4752] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aU7zpX-IfCN2Cy9Gcchp3wAAANA"]
[Sat Dec 27 04:44:21.953706 2025] [:error] [pid 32192:tid 32237] [client 4.189.96.64:4919] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aU7zpS_q0VFe066lbk-uAQAAAE4"]
[Sat Dec 27 04:44:22.722998 2025] [:error] [pid 32278:tid 32288] [client 4.189.96.64:4977] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/moon.php"] [unique_id "aU7zpn-IfCN2Cy9Gcchp4AAAAMg"]
[Sat Dec 27 04:44:23.512738 2025] [:error] [pid 32278:tid 32290] [client 4.189.96.64:4952] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/moon.php"] [unique_id "aU7zp3-IfCN2Cy9Gcchp5wAAAMo"]
[Sat Dec 27 04:44:24.393429 2025] [:error] [pid 32192:tid 32243] [client 4.189.96.64:4985] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/moon.php"] [unique_id "aU7zqC_q0VFe066lbk-uAwAAAFQ"]
[Sat Dec 27 04:44:24.974952 2025] [:error] [pid 32192:tid 32231] [client 4.189.96.64:4932] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/moon.php"] [unique_id "aU7zqC_q0VFe066lbk-uBAAAAEg"]
[Sat Dec 27 04:44:25.850917 2025] [:error] [pid 32193:tid 32254] [client 4.189.96.64:4902] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/colour.php"] [unique_id "aU7zqRgw0eCOc2qYqaIC7wAAAIQ"]
[Sat Dec 27 04:44:26.697194 2025] [:error] [pid 32278:tid 32301] [client 4.189.96.64:4880] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/colour.php"] [unique_id "aU7zqn-IfCN2Cy9Gcchp7QAAANU"]
[Sat Dec 27 04:44:27.640615 2025] [:error] [pid 32193:tid 32253] [client 4.189.96.64:4923] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/colour.php"] [unique_id "aU7zqxgw0eCOc2qYqaIC8AAAAIM"]
[Sat Dec 27 04:44:28.043738 2025] [:error] [pid 32193:tid 32263] [client 4.189.96.64:4991] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/colour.php"] [unique_id "aU7zrBgw0eCOc2qYqaIC8gAAAI0"]
[Sat Dec 27 04:44:28.899995 2025] [:error] [pid 32192:tid 32246] [client 4.189.96.64:4811] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aU7zrC_q0VFe066lbk-uBwAAAFc"]
[Sat Dec 27 04:44:29.768332 2025] [:error] [pid 32191:tid 32196] [client 4.189.96.64:4950] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aU7zrbPNtMgrjVCHIdFvSgAAAAE"]
[Sat Dec 27 04:44:30.596830 2025] [:error] [pid 32192:tid 32224] [client 4.189.96.64:4943] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aU7zri_q0VFe066lbk-uCQAAAEE"]
[Sat Dec 27 04:44:31.304180 2025] [:error] [pid 32193:tid 32267] [client 4.189.96.64:4904] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aU7zrxgw0eCOc2qYqaIC9QAAAJE"]
[Sat Dec 27 04:44:32.098777 2025] [:error] [pid 32193:tid 32261] [client 4.189.96.64:5051] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "aU7zsBgw0eCOc2qYqaIC9wAAAIs"]
[Sat Dec 27 04:44:32.885206 2025] [:error] [pid 32193:tid 32252] [client 4.189.96.64:4963] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "aU7zsBgw0eCOc2qYqaIC-QAAAII"]
[Sat Dec 27 04:44:33.251466 2025] [:error] [pid 32193:tid 32268] [client 4.189.96.64:4967] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "aU7zsRgw0eCOc2qYqaIC-wAAAJI"]
[Sat Dec 27 04:44:33.633637 2025] [:error] [pid 32193:tid 32256] [client 4.189.96.64:4937] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "aU7zsRgw0eCOc2qYqaIC_AAAAIY"]
[Sat Dec 27 04:44:33.957395 2025] [:error] [pid 32278:tid 32292] [client 4.189.96.64:5053] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aU7zsX-IfCN2Cy9Gcchp8gAAAMw"]
[Sat Dec 27 04:44:34.653750 2025] [:error] [pid 32193:tid 32250] [client 4.189.96.64:5032] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aU7zshgw0eCOc2qYqaIC_QAAAIA"]
[Sat Dec 27 04:44:34.972580 2025] [:error] [pid 32191:tid 32204] [client 4.189.96.64:4881] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aU7zsrPNtMgrjVCHIdFvZAAAAAk"]
[Sat Dec 27 04:44:35.301233 2025] [:error] [pid 32192:tid 32236] [client 4.189.96.64:5001] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aU7zsy_q0VFe066lbk-uDgAAAE0"]
[Sat Dec 27 04:44:35.694513 2025] [:error] [pid 32192:tid 32241] [client 4.189.96.64:4899] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU7zsy_q0VFe066lbk-uDwAAAFI"]
[Sat Dec 27 04:44:35.973330 2025] [:error] [pid 32193:tid 32265] [client 4.189.96.64:4989] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU7zsxgw0eCOc2qYqaIDAQAAAI8"]
[Sat Dec 27 04:44:36.237918 2025] [:error] [pid 32192:tid 32245] [client 4.189.96.64:4988] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU7ztC_q0VFe066lbk-uEAAAAFY"]
[Sat Dec 27 04:44:36.899208 2025] [:error] [pid 32192:tid 32237] [client 4.189.96.64:4918] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU7ztC_q0VFe066lbk-uEgAAAE4"]
[Sat Dec 27 04:44:37.157351 2025] [:error] [pid 32191:tid 32212] [client 4.189.96.64:4869] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7ztbPNtMgrjVCHIdFvcwAAABE"]
[Sat Dec 27 04:44:37.872642 2025] [:error] [pid 32191:tid 32207] [client 4.189.96.64:4965] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7ztbPNtMgrjVCHIdFvewAAAAw"]
[Sat Dec 27 04:44:38.479317 2025] [:error] [pid 32193:tid 32250] [client 4.189.96.64:4979] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7zthgw0eCOc2qYqaIDFgAAAIA"]
[Sat Dec 27 04:44:39.083088 2025] [:error] [pid 32192:tid 32231] [client 4.189.96.64:4868] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7zty_q0VFe066lbk-uFAAAAEg"]
[Sat Dec 27 04:44:39.495141 2025] [:error] [pid 32278:tid 32291] [client 4.189.96.64:4893] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7zt3-IfCN2Cy9Gcchp9AAAAMs"]
[Sat Dec 27 04:44:39.885381 2025] [:error] [pid 32192:tid 32232] [client 4.189.96.64:4840] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7zty_q0VFe066lbk-uFwAAAEk"]
[Sat Dec 27 04:44:40.334396 2025] [:error] [pid 32278:tid 32293] [client 4.189.96.64:4974] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7zuH-IfCN2Cy9Gcchp9wAAAM0"]
[Sat Dec 27 04:44:40.964209 2025] [:error] [pid 32192:tid 32229] [client 4.189.96.64:5118] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7zuC_q0VFe066lbk-uGAAAAEY"]
[Sat Dec 27 04:44:41.427357 2025] [:error] [pid 32192:tid 32247] [client 4.189.96.64:4940] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7zuS_q0VFe066lbk-uGQAAAFg"]
[Sat Dec 27 04:44:41.762865 2025] [:error] [pid 32192:tid 32225] [client 4.189.96.64:4803] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7zuS_q0VFe066lbk-uGgAAAEI"]
[Sat Dec 27 04:44:42.321874 2025] [:error] [pid 32278:tid 32304] [client 4.189.96.64:5019] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7zun-IfCN2Cy9Gcchp-wAAANg"]
[Sat Dec 27 04:44:43.480689 2025] [:error] [pid 32192:tid 32244] [client 4.189.96.64:4822] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7zuy_q0VFe066lbk-uHAAAAFU"]
[Sat Dec 27 04:44:43.773336 2025] [:error] [pid 32278:tid 32281] [client 4.189.96.64:4848] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aU7zu3-IfCN2Cy9Gcchp_gAAAME"]
[Sat Dec 27 04:44:44.157779 2025] [:error] [pid 32192:tid 32235] [client 4.189.96.64:4864] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aU7zvC_q0VFe066lbk-uHQAAAEw"]
[Sat Dec 27 04:44:44.424634 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:5027] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aU7zvC_q0VFe066lbk-uHwAAAFE"]
[Sat Dec 27 04:44:44.994223 2025] [:error] [pid 32193:tid 32266] [client 4.189.96.64:4802] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aU7zvBgw0eCOc2qYqaIDSAAAAJA"]
[Sat Dec 27 04:44:45.465676 2025] [:error] [pid 32193:tid 32271] [client 4.189.96.64:4830] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-api.php"] [unique_id "aU7zvRgw0eCOc2qYqaIDTQAAAJU"]
[Sat Dec 27 04:44:46.041232 2025] [:error] [pid 32191:tid 32212] [client 4.189.96.64:4891] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-api.php"] [unique_id "aU7zvrPNtMgrjVCHIdFvtQAAABE"]
[Sat Dec 27 04:44:47.176260 2025] [:error] [pid 32192:tid 32231] [client 4.189.96.64:4910] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-api.php"] [unique_id "aU7zvy_q0VFe066lbk-uJAAAAEg"]
[Sat Dec 27 04:44:47.674798 2025] [:error] [pid 32191:tid 32214] [client 4.189.96.64:4866] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-api.php"] [unique_id "aU7zv7PNtMgrjVCHIdFvvgAAABM"]
[Sat Dec 27 04:44:48.432872 2025] [:error] [pid 32192:tid 32244] [client 4.189.96.64:4768] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments.php"] [unique_id "aU7zwC_q0VFe066lbk-uLAAAAFU"]
[Sat Dec 27 04:44:49.252359 2025] [:error] [pid 32192:tid 32234] [client 4.189.96.64:4831] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments.php"] [unique_id "aU7zwS_q0VFe066lbk-uNQAAAEs"]
[Sat Dec 27 04:44:49.717392 2025] [:error] [pid 32192:tid 32242] [client 4.189.96.64:4736] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments.php"] [unique_id "aU7zwS_q0VFe066lbk-uOQAAAFM"]
[Sat Dec 27 04:44:50.499524 2025] [:error] [pid 32192:tid 32229] [client 4.189.96.64:4871] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments.php"] [unique_id "aU7zwi_q0VFe066lbk-uQgAAAEY"]
[Sat Dec 27 04:44:51.131937 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:4889] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/1.php"] [unique_id "aU7zwy_q0VFe066lbk-uRgAAAFE"]
[Sat Dec 27 04:44:51.396698 2025] [:error] [pid 32192:tid 32234] [client 4.189.96.64:4921] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/1.php"] [unique_id "aU7zwy_q0VFe066lbk-uSQAAAEs"]
[Sat Dec 27 04:44:52.110573 2025] [:error] [pid 32191:tid 32204] [client 4.189.96.64:4895] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/1.php"] [unique_id "aU7zxLPNtMgrjVCHIdFv1AAAAAk"]
[Sat Dec 27 04:44:52.398747 2025] [:error] [pid 32191:tid 32219] [client 4.189.96.64:4901] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/1.php"] [unique_id "aU7zxLPNtMgrjVCHIdFv1wAAABg"]
[Sat Dec 27 04:44:52.775867 2025] [:error] [pid 32278:tid 32301] [client 4.189.96.64:4984] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7zxH-IfCN2Cy9GcchqBgAAANU"]
[Sat Dec 27 04:44:53.093077 2025] [:error] [pid 32278:tid 32296] [client 4.189.96.64:5054] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7zxX-IfCN2Cy9GcchqBwAAANA"]
[Sat Dec 27 04:44:53.585878 2025] [:error] [pid 32191:tid 32202] [client 4.189.96.64:4909] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7zxbPNtMgrjVCHIdFv3wAAAAc"]
[Sat Dec 27 04:44:54.193413 2025] [:error] [pid 32278:tid 32281] [client 4.189.96.64:4842] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7zxn-IfCN2Cy9GcchqCwAAAME"]
[Sat Dec 27 04:44:54.534732 2025] [:error] [pid 32278:tid 32299] [client 4.189.96.64:4956] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/about.php"] [unique_id "aU7zxn-IfCN2Cy9GcchqDAAAANM"]
[Sat Dec 27 04:44:54.937005 2025] [:error] [pid 32193:tid 32270] [client 4.189.96.64:4960] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/about.php"] [unique_id "aU7zxhgw0eCOc2qYqaIDbQAAAJQ"]
[Sat Dec 27 04:44:55.331370 2025] [:error] [pid 32278:tid 32294] [client 4.189.96.64:4817] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/about.php"] [unique_id "aU7zx3-IfCN2Cy9GcchqEAAAAM4"]
[Sat Dec 27 04:44:55.694855 2025] [:error] [pid 32278:tid 32283] [client 4.189.96.64:4982] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/about.php"] [unique_id "aU7zx3-IfCN2Cy9GcchqEQAAAMM"]
[Sat Dec 27 04:44:56.108331 2025] [:error] [pid 32192:tid 32237] [client 4.189.96.64:4872] [client 4.189.96.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aU7zyC_q0VFe066lbk-uXAAAAE4"]
[Sat Dec 27 04:44:56.924445 2025] [:error] [pid 32192:tid 32227] [client 4.189.96.64:13866] [client 4.189.96.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aU7zyC_q0VFe066lbk-uXgAAAEQ"]
[Sat Dec 27 04:44:57.840049 2025] [:error] [pid 32278:tid 32295] [client 4.189.96.64:4876] [client 4.189.96.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aU7zyX-IfCN2Cy9GcchqFAAAAM8"]
[Sat Dec 27 04:44:58.325388 2025] [:error] [pid 32193:tid 32252] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logs.php
[Sat Dec 27 04:44:58.445852 2025] [:error] [pid 32193:tid 32268] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setting.php
[Sat Dec 27 04:44:58.570681 2025] [:error] [pid 32193:tid 32251] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sat Dec 27 04:44:58.798891 2025] [:error] [pid 32193:tid 32256] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Sat Dec 27 04:44:58.974116 2025] [:error] [pid 32193:tid 32250] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-wso.php
[Sat Dec 27 04:44:59.199810 2025] [:error] [pid 32193:tid 32259] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Dec 27 04:44:59.344672 2025] [:error] [pid 32193:tid 32258] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wrong_datlib.php
[Sat Dec 27 04:44:59.517537 2025] [:error] [pid 32193:tid 32265] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sat Dec 27 04:44:59.696419 2025] [:error] [pid 32193:tid 32262] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sat Dec 27 04:44:59.846390 2025] [:error] [pid 32193:tid 32274] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Sat Dec 27 04:45:00.003204 2025] [:error] [pid 32193:tid 32254] [client 4.189.96.64:4966] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 27 04:45:01.627362 2025] [:error] [pid 32193:tid 32263] [client 4.189.96.64:4966] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring"] [unique_id "aU7zzRgw0eCOc2qYqaIDfQAAAI0"]
[Sat Dec 27 04:45:02.068648 2025] [:error] [pid 32193:tid 32257] [client 4.189.96.64:13844] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring"] [unique_id "aU7zzhgw0eCOc2qYqaIDfgAAAIc"]
[Sat Dec 27 04:45:02.783291 2025] [:error] [pid 32278:tid 32297] [client 4.189.96.64:4804] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring"] [unique_id "aU7zzn-IfCN2Cy9GcchqFwAAANE"]
[Sat Dec 27 04:45:03.479534 2025] [:error] [pid 32278:tid 32289] [client 4.189.96.64:4850] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring"] [unique_id "aU7zz3-IfCN2Cy9GcchqGQAAAMk"]
[Sat Dec 27 04:45:04.913283 2025] [:error] [pid 32192:tid 32234] [client 4.189.96.64:4894] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs"] [unique_id "aU7z0C_q0VFe066lbk-uZwAAAEs"]
[Sat Dec 27 04:45:05.587408 2025] [:error] [pid 32278:tid 32288] [client 4.189.96.64:4945] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs"] [unique_id "aU7z0X-IfCN2Cy9GcchqHAAAAMg"]
[Sat Dec 27 04:45:06.117899 2025] [:error] [pid 32278:tid 32300] [client 4.189.96.64:4810] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs"] [unique_id "aU7z0n-IfCN2Cy9GcchqHwAAANQ"]
[Sat Dec 27 04:45:06.846965 2025] [:error] [pid 32192:tid 32240] [client 4.189.96.64:5034] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs"] [unique_id "aU7z0i_q0VFe066lbk-uaAAAAFE"]
[Sat Dec 27 04:45:08.266869 2025] [:error] [pid 32278:tid 32286] [client 4.189.96.64:5117] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7z1H-IfCN2Cy9GcchqIQAAAMY"]
[Sat Dec 27 04:45:09.510163 2025] [:error] [pid 32278:tid 32295] [client 4.189.96.64:4906] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7z1X-IfCN2Cy9GcchqIgAAAM8"]
[Sat Dec 27 04:45:10.213654 2025] [:error] [pid 32193:tid 32259] [client 4.189.96.64:4813] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7z1hgw0eCOc2qYqaIDhwAAAIk"]
[Sat Dec 27 04:45:10.976411 2025] [:error] [pid 32192:tid 32243] [client 4.189.96.64:4972] [client 4.189.96.64] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU7z1i_q0VFe066lbk-ubQAAAFQ"]
[Sat Dec 27 08:16:37.943871 2025] [:error] [pid 45373:tid 45389] [client 104.28.230.216:52777] [client 104.28.230.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.230.216, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aU8lZS7p_wFcbpu46HXr1QAAAU4"]
[Sat Dec 27 08:16:37.949754 2025] [:error] [pid 45373:tid 45389] [client 104.28.230.216:52777] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Dec 27 08:32:33.146052 2025] [:error] [pid 32193:tid 32271] [client 131.161.66.186:61775] [client 131.161.66.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 131.161.66.186, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aU8pIRgw0eCOc2qYqaI60wAAAJU"]
[Sat Dec 27 08:32:33.151810 2025] [:error] [pid 32193:tid 32271] [client 131.161.66.186:61775] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Dec 27 22:03:19.711358 2025] [:error] [pid 32191:tid 32204] [client 13.70.48.86:14018] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sat Dec 27 22:03:19.832521 2025] [:error] [pid 32191:tid 32219] [client 13.70.48.86:14018] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 27 22:03:20.106324 2025] [:error] [pid 32191:tid 32206] [client 13.70.48.86:14018] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sat Dec 27 22:03:20.240057 2025] [:error] [pid 32191:tid 32195] [client 13.70.48.86:14018] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Dec 27 22:03:20.416112 2025] [:error] [pid 32191:tid 32212] [client 13.70.48.86:14018] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 27 22:03:20.537469 2025] [:error] [pid 32191:tid 32197] [client 13.70.48.86:14018] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sat Dec 27 22:03:20.667227 2025] [:error] [pid 32191:tid 32208] [client 13.70.48.86:14018] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sat Dec 27 22:03:20.907475 2025] [:error] [pid 32191:tid 32214] [client 13.70.48.86:14018] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU_nKLPNtMgrjVCHIdFCsAAAABM"]
[Sat Dec 27 22:03:21.210590 2025] [:error] [pid 32191:tid 32199] [client 13.70.48.86:14048] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU_nKbPNtMgrjVCHIdFCsgAAAAQ"]
[Sat Dec 27 22:03:21.463252 2025] [:error] [pid 31933:tid 31949] [client 13.70.48.86:13972] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU_nKcGr1WIJr39uqaoBjQAAAc4"]
[Sat Dec 27 22:03:21.731402 2025] [:error] [pid 31933:tid 31939] [client 13.70.48.86:13982] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aU_nKcGr1WIJr39uqaoBjgAAAcQ"]
[Sat Dec 27 22:03:21.995220 2025] [:error] [pid 45373:tid 45384] [client 13.70.48.86:13975] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU_nKS7p_wFcbpu46HWQrQAAAUk"]
[Sat Dec 27 22:03:22.257788 2025] [:error] [pid 32192:tid 32223] [client 13.70.48.86:14069] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU_nKi_q0VFe066lbk9oAQAAAEA"]
[Sat Dec 27 22:03:22.682981 2025] [:error] [pid 45373:tid 45397] [client 13.70.48.86:14044] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU_nKi7p_wFcbpu46HWQsAAAAVY"]
[Sat Dec 27 22:03:22.941595 2025] [:error] [pid 3114:tid 3121] [client 13.70.48.86:8183] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aU_nKmJGrIkLOdbPpJi5KQAAAYM"]
[Sat Dec 27 22:03:23.212391 2025] [:error] [pid 32192:tid 32242] [client 13.70.48.86:14052] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU_nKy_q0VFe066lbk9oAgAAAFM"]
[Sat Dec 27 22:03:23.500989 2025] [:error] [pid 32193:tid 32271] [client 13.70.48.86:14036] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU_nKxgw0eCOc2qYqaK8-QAAAJU"]
[Sat Dec 27 22:03:23.753321 2025] [:error] [pid 32192:tid 32232] [client 13.70.48.86:8154] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU_nKy_q0VFe066lbk9oAwAAAEk"]
[Sat Dec 27 22:03:24.013899 2025] [:error] [pid 15939:tid 15954] [client 13.70.48.86:13971] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aU_nLOZ7qdnFxikanML0iAAAAQ0"]
[Sat Dec 27 22:03:24.273588 2025] [:error] [pid 31933:tid 31945] [client 13.70.48.86:14026] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aU_nLMGr1WIJr39uqaoBkAAAAco"]
[Sat Dec 27 22:03:24.640524 2025] [:error] [pid 45373:tid 45394] [client 13.70.48.86:14021] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aU_nLC7p_wFcbpu46HWQsQAAAVM"]
[Sat Dec 27 22:03:24.925208 2025] [:error] [pid 15939:tid 15949] [client 13.70.48.86:13977] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aU_nLOZ7qdnFxikanML0iQAAAQg"]
[Sat Dec 27 22:03:25.195781 2025] [:error] [pid 45373:tid 45376] [client 13.70.48.86:8142] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aU_nLS7p_wFcbpu46HWQswAAAUE"]
[Sat Dec 27 22:03:25.457953 2025] [:error] [pid 45373:tid 45393] [client 13.70.48.86:13989] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aU_nLS7p_wFcbpu46HWQtAAAAVI"]
[Sat Dec 27 22:03:25.785099 2025] [:error] [pid 31933:tid 31943] [client 13.70.48.86:8132] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aU_nLcGr1WIJr39uqaoBkQAAAcg"]
[Sat Dec 27 22:03:26.110461 2025] [:error] [pid 31933:tid 31935] [client 13.70.48.86:14058] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aU_nLsGr1WIJr39uqaoBkwAAAcA"]
[Sat Dec 27 22:03:26.430349 2025] [:error] [pid 31933:tid 31959] [client 13.70.48.86:14033] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aU_nLsGr1WIJr39uqaoBlAAAAdg"]
[Sat Dec 27 22:03:26.680633 2025] [:error] [pid 3114:tid 3123] [client 13.70.48.86:14062] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU_nLmJGrIkLOdbPpJi5LQAAAYU"]
[Sat Dec 27 22:03:26.914862 2025] [:error] [pid 32191:tid 32199] [client 13.70.48.86:13959] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU_nLrPNtMgrjVCHIdFCxAAAAAQ"]
[Sat Dec 27 22:03:27.220861 2025] [:error] [pid 31933:tid 31936] [client 13.70.48.86:14040] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU_nL8Gr1WIJr39uqaoBlQAAAcE"]
[Sat Dec 27 22:03:27.534671 2025] [:error] [pid 31933:tid 31947] [client 13.70.48.86:14075] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aU_nL8Gr1WIJr39uqaoBlgAAAcw"]
[Sat Dec 27 22:03:27.792607 2025] [:error] [pid 31933:tid 31940] [client 13.70.48.86:13961] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aU_nL8Gr1WIJr39uqaoBlwAAAcU"]
[Sat Dec 27 22:03:28.069896 2025] [:error] [pid 32278:tid 32292] [client 13.70.48.86:14030] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aU_nMH-IfCN2Cy9Gccg72wAAAMw"]
[Sat Dec 27 22:03:28.345672 2025] [:error] [pid 31933:tid 31956] [client 13.70.48.86:14057] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aU_nMMGr1WIJr39uqaoBmAAAAdU"]
[Sat Dec 27 22:03:28.593101 2025] [:error] [pid 3114:tid 3122] [client 13.70.48.86:14073] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aU_nMGJGrIkLOdbPpJi5LwAAAYQ"]
[Sat Dec 27 22:03:28.858905 2025] [:error] [pid 45373:tid 45382] [client 13.70.48.86:14064] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU_nMC7p_wFcbpu46HWQugAAAUc"]
[Sat Dec 27 22:03:29.110498 2025] [:error] [pid 45373:tid 45396] [client 13.70.48.86:14068] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU_nMS7p_wFcbpu46HWQuwAAAVU"]
[Sat Dec 27 22:03:29.466758 2025] [:error] [pid 45373:tid 45391] [client 13.70.48.86:13990] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU_nMS7p_wFcbpu46HWQvQAAAVA"]
[Sat Dec 27 22:03:29.724221 2025] [:error] [pid 31933:tid 31948] [client 13.70.48.86:14022] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aU_nMcGr1WIJr39uqaoBmgAAAc0"]
[Sat Dec 27 22:03:29.994813 2025] [:error] [pid 31933:tid 31938] [client 13.70.48.86:13962] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU_nMcGr1WIJr39uqaoBmwAAAcM"]
[Sat Dec 27 22:03:30.362508 2025] [:error] [pid 31933:tid 31954] [client 13.70.48.86:14051] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU_nMsGr1WIJr39uqaoBnAAAAdM"]
[Sat Dec 27 22:03:30.602982 2025] [:error] [pid 32192:tid 32224] [client 13.70.48.86:14041] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU_nMi_q0VFe066lbk9oBQAAAEE"]
[Sat Dec 27 22:03:30.844840 2025] [:error] [pid 31933:tid 31957] [client 13.70.48.86:13955] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aU_nMsGr1WIJr39uqaoBnQAAAdY"]
[Sat Dec 27 22:03:31.080367 2025] [:error] [pid 31933:tid 31937] [client 13.70.48.86:13981] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aU_nM8Gr1WIJr39uqaoBngAAAcI"]
[Sat Dec 27 22:03:31.385333 2025] [:error] [pid 32193:tid 32251] [client 13.70.48.86:13999] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aU_nMxgw0eCOc2qYqaK8_gAAAIE"]
[Sat Dec 27 22:03:31.632122 2025] [:error] [pid 31933:tid 31949] [client 13.70.48.86:13983] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aU_nM8Gr1WIJr39uqaoBnwAAAc4"]
[Sat Dec 27 22:03:31.945046 2025] [:error] [pid 32278:tid 32283] [client 13.70.48.86:13968] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aU_nM3-IfCN2Cy9Gccg73gAAAMM"]
[Sat Dec 27 22:03:32.224949 2025] [:error] [pid 3114:tid 3119] [client 13.70.48.86:14053] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU_nNGJGrIkLOdbPpJi5MAAAAYE"]
[Sat Dec 27 22:03:32.469847 2025] [:error] [pid 31933:tid 31945] [client 13.70.48.86:8147] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU_nNMGr1WIJr39uqaoBogAAAco"]
[Sat Dec 27 22:03:32.724775 2025] [:error] [pid 45373:tid 45389] [client 13.70.48.86:13958] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU_nNC7p_wFcbpu46HWQwgAAAU4"]
[Sat Dec 27 22:03:33.060980 2025] [:error] [pid 32191:tid 32207] [client 13.70.48.86:14065] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aU_nNbPNtMgrjVCHIdFC1gAAAAw"]
[Sat Dec 27 22:03:33.307264 2025] [:error] [pid 45373:tid 45381] [client 13.70.48.86:13991] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU_nNS7p_wFcbpu46HWQxAAAAUY"]
[Sat Dec 27 22:03:33.592833 2025] [:error] [pid 32191:tid 32213] [client 13.70.48.86:14003] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU_nNbPNtMgrjVCHIdFC2AAAABI"]
[Sat Dec 27 22:03:33.943768 2025] [:error] [pid 31933:tid 31935] [client 13.70.48.86:13996] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU_nNcGr1WIJr39uqaoBpQAAAcA"]
[Sat Dec 27 22:03:34.261460 2025] [:error] [pid 31933:tid 31953] [client 13.70.48.86:8145] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aU_nNsGr1WIJr39uqaoBpwAAAdI"]
[Sat Dec 27 22:03:34.519697 2025] [:error] [pid 31933:tid 31958] [client 13.70.48.86:8156] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU_nNsGr1WIJr39uqaoBqAAAAdc"]
[Sat Dec 27 22:03:34.814694 2025] [:error] [pid 3114:tid 3120] [client 13.70.48.86:14027] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU_nNmJGrIkLOdbPpJi5MgAAAYI"]
[Sat Dec 27 22:03:35.136646 2025] [:error] [pid 15939:tid 15962] [client 13.70.48.86:14054] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU_nN-Z7qdnFxikanML0jQAAARU"]
[Sat Dec 27 22:03:35.421599 2025] [:error] [pid 32278:tid 32296] [client 13.70.48.86:8131] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aU_nN3-IfCN2Cy9Gccg74AAAANA"]
[Sat Dec 27 22:03:35.700841 2025] [:error] [pid 31933:tid 31947] [client 13.70.48.86:13964] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU_nN8Gr1WIJr39uqaoBqgAAAcw"]
[Sat Dec 27 22:03:35.963403 2025] [:error] [pid 45373:tid 45376] [client 13.70.48.86:13961] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU_nNy7p_wFcbpu46HWQxgAAAUE"]
[Sat Dec 27 22:03:36.317664 2025] [:error] [pid 3114:tid 3131] [client 13.70.48.86:14071] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU_nOGJGrIkLOdbPpJi5NAAAAY0"]
[Sat Dec 27 22:03:36.576860 2025] [:error] [pid 3114:tid 3133] [client 13.70.48.86:14035] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aU_nOGJGrIkLOdbPpJi5NQAAAY8"]
[Sat Dec 27 22:03:36.832285 2025] [:error] [pid 45373:tid 45398] [client 13.70.48.86:8145] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU_nOC7p_wFcbpu46HWQyAAAAVc"]
[Sat Dec 27 22:03:37.081760 2025] [:error] [pid 45373:tid 45396] [client 13.70.48.86:8155] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU_nOS7p_wFcbpu46HWQyQAAAVU"]
[Sat Dec 27 22:03:37.324050 2025] [:error] [pid 3114:tid 3127] [client 13.70.48.86:14024] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU_nOWJGrIkLOdbPpJi5NgAAAYk"]
[Sat Dec 27 22:03:37.600056 2025] [:error] [pid 32193:tid 32262] [client 13.70.48.86:8013] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aU_nORgw0eCOc2qYqaK9AgAAAIw"]
[Sat Dec 27 22:03:37.897238 2025] [:error] [pid 32193:tid 32260] [client 13.70.48.86:8073] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nORgw0eCOc2qYqaK9BQAAAIo"]
[Sat Dec 27 22:03:38.198030 2025] [:error] [pid 32191:tid 32212] [client 13.70.48.86:13978] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nOrPNtMgrjVCHIdFC5wAAABE"]
[Sat Dec 27 22:03:38.467705 2025] [:error] [pid 31933:tid 31948] [client 13.70.48.86:14042] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nOsGr1WIJr39uqaoBrAAAAc0"]
[Sat Dec 27 22:03:38.768951 2025] [:error] [pid 31933:tid 31954] [client 13.70.48.86:13960] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nOsGr1WIJr39uqaoBrQAAAdM"]
[Sat Dec 27 22:03:39.075816 2025] [:error] [pid 3114:tid 3128] [client 13.70.48.86:14076] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU_nO2JGrIkLOdbPpJi5NwAAAYo"]
[Sat Dec 27 22:03:39.324743 2025] [:error] [pid 32191:tid 32207] [client 13.70.48.86:14031] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU_nO7PNtMgrjVCHIdFC6wAAAAw"]
[Sat Dec 27 22:03:39.663449 2025] [:error] [pid 32192:tid 32246] [client 13.70.48.86:14059] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU_nOy_q0VFe066lbk9oCwAAAFc"]
[Sat Dec 27 22:03:39.978020 2025] [:error] [pid 45373:tid 45385] [client 13.70.48.86:8137] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aU_nOy7p_wFcbpu46HWQywAAAUo"]
[Sat Dec 27 22:03:40.243403 2025] [:error] [pid 32192:tid 32235] [client 13.70.48.86:13976] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU_nPC_q0VFe066lbk9oDAAAAEw"]
[Sat Dec 27 22:03:40.514782 2025] [:error] [pid 3114:tid 3124] [client 13.70.48.86:8151] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU_nPGJGrIkLOdbPpJi5OgAAAYY"]
[Sat Dec 27 22:03:40.796726 2025] [:error] [pid 3114:tid 3123] [client 13.70.48.86:13967] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU_nPGJGrIkLOdbPpJi5OwAAAYU"]
[Sat Dec 27 22:03:41.251136 2025] [:error] [pid 3114:tid 3130] [client 13.70.48.86:13957] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aU_nPWJGrIkLOdbPpJi5PAAAAYw"]
[Sat Dec 27 22:03:41.532846 2025] [:error] [pid 15939:tid 15946] [client 13.70.48.86:14078] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU_nPeZ7qdnFxikanML0kgAAAQU"]
[Sat Dec 27 22:03:41.882118 2025] [:error] [pid 3114:tid 3122] [client 13.70.48.86:13970] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU_nPWJGrIkLOdbPpJi5PgAAAYQ"]
[Sat Dec 27 22:03:42.258222 2025] [:error] [pid 45373:tid 45384] [client 13.70.48.86:13965] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU_nPi7p_wFcbpu46HWQzAAAAUk"]
[Sat Dec 27 22:03:42.563095 2025] [:error] [pid 32191:tid 32218] [client 13.70.48.86:14039] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU_nPrPNtMgrjVCHIdFC9QAAABc"]
[Sat Dec 27 22:03:42.824152 2025] [:error] [pid 32278:tid 32284] [client 13.70.48.86:14023] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aU_nPn-IfCN2Cy9Gccg76QAAAMQ"]
[Sat Dec 27 22:03:43.134510 2025] [:error] [pid 15939:tid 15965] [client 13.70.48.86:14074] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aU_nP-Z7qdnFxikanML0lQAAARg"]
[Sat Dec 27 22:03:43.578276 2025] [:error] [pid 32192:tid 32242] [client 13.70.48.86:14029] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aU_nPy_q0VFe066lbk9oEgAAAFM"]
[Sat Dec 27 22:03:43.823509 2025] [:error] [pid 32192:tid 32232] [client 13.70.48.86:13953] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aU_nPy_q0VFe066lbk9oFAAAAEk"]
[Sat Dec 27 22:03:44.145315 2025] [:error] [pid 32192:tid 32224] [client 13.70.48.86:8174] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU_nQC_q0VFe066lbk9oFwAAAEE"]
[Sat Dec 27 22:03:44.445677 2025] [:error] [pid 31933:tid 31943] [client 13.70.48.86:8179] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU_nQMGr1WIJr39uqaoBsAAAAcg"]
[Sat Dec 27 22:03:44.771638 2025] [:error] [pid 32278:tid 32287] [client 13.70.48.86:14008] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU_nQH-IfCN2Cy9Gccg76gAAAMc"]
[Sat Dec 27 22:03:45.059123 2025] [:error] [pid 32192:tid 32244] [client 13.70.48.86:8150] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aU_nQS_q0VFe066lbk9oGQAAAFU"]
[Sat Dec 27 22:03:45.311767 2025] [:error] [pid 32278:tid 32304] [client 13.70.48.86:8171] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU_nQX-IfCN2Cy9Gccg77QAAANg"]
[Sat Dec 27 22:03:45.609313 2025] [:error] [pid 31933:tid 31935] [client 13.70.48.86:8099] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU_nQcGr1WIJr39uqaoBswAAAcA"]
[Sat Dec 27 22:03:45.890564 2025] [:error] [pid 15939:tid 15958] [client 13.70.48.86:13994] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU_nQeZ7qdnFxikanML0lgAAARE"]
[Sat Dec 27 22:03:46.188379 2025] [:error] [pid 31933:tid 31959] [client 13.70.48.86:14017] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aU_nQsGr1WIJr39uqaoBtQAAAdg"]
[Sat Dec 27 22:03:46.440250 2025] [:error] [pid 32192:tid 32237] [client 13.70.48.86:8143] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aU_nQi_q0VFe066lbk9oGgAAAE4"]
[Sat Dec 27 22:03:46.918204 2025] [:error] [pid 31933:tid 31936] [client 13.70.48.86:8184] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aU_nQsGr1WIJr39uqaoBtgAAAcE"]
[Sat Dec 27 22:03:47.304439 2025] [:error] [pid 15939:tid 15956] [client 13.70.48.86:8161] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aU_nQ-Z7qdnFxikanML0lwAAAQ8"]
[Sat Dec 27 22:03:47.782139 2025] [:error] [pid 32192:tid 32235] [client 13.70.48.86:8175] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aU_nQy_q0VFe066lbk9oHQAAAEw"]
[Sat Dec 27 22:03:48.025900 2025] [:error] [pid 31933:tid 31955] [client 13.70.48.86:14006] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU_nRMGr1WIJr39uqaoBuAAAAdQ"]
[Sat Dec 27 22:03:48.343922 2025] [:error] [pid 45373:tid 45388] [client 13.70.48.86:8072] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU_nRC7p_wFcbpu46HWQzQAAAU0"]
[Sat Dec 27 22:03:48.612477 2025] [:error] [pid 45373:tid 45383] [client 13.70.48.86:8141] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU_nRC7p_wFcbpu46HWQzwAAAUg"]
[Sat Dec 27 22:03:49.033440 2025] [:error] [pid 45373:tid 45397] [client 13.70.48.86:14020] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aU_nRS7p_wFcbpu46HWQ0AAAAVY"]
[Sat Dec 27 22:03:49.509128 2025] [:error] [pid 31933:tid 31954] [client 13.70.48.86:8177] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nRcGr1WIJr39uqaoBugAAAdM"]
[Sat Dec 27 22:03:49.764728 2025] [:error] [pid 32191:tid 32205] [client 13.70.48.86:14004] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nRbPNtMgrjVCHIdFDDQAAAAo"]
[Sat Dec 27 22:03:50.115177 2025] [:error] [pid 15939:tid 15961] [client 13.70.48.86:14011] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nRuZ7qdnFxikanML0mgAAARQ"]
[Sat Dec 27 22:03:50.492400 2025] [:error] [pid 32192:tid 32223] [client 13.70.48.86:13966] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nRi_q0VFe066lbk9oHwAAAEA"]
[Sat Dec 27 22:03:50.746253 2025] [:error] [pid 32192:tid 32229] [client 13.70.48.86:14014] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nRi_q0VFe066lbk9oIgAAAEY"]
[Sat Dec 27 22:03:51.074871 2025] [:error] [pid 32193:tid 32272] [client 13.70.48.86:14056] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nRxgw0eCOc2qYqaK9CQAAAJY"]
[Sat Dec 27 22:03:51.410399 2025] [:error] [pid 32193:tid 32252] [client 13.70.48.86:8166] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nRxgw0eCOc2qYqaK9DAAAAII"]
[Sat Dec 27 22:03:51.660497 2025] [:error] [pid 32191:tid 32200] [client 13.70.48.86:8168] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nR7PNtMgrjVCHIdFDEQAAAAU"]
[Sat Dec 27 22:03:52.084882 2025] [:error] [pid 3114:tid 3131] [client 13.70.48.86:14063] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aU_nSGJGrIkLOdbPpJi5QwAAAY0"]
[Sat Dec 27 22:03:52.374360 2025] [:error] [pid 45373:tid 45393] [client 13.70.48.86:8074] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nSC7p_wFcbpu46HWQ0gAAAVI"]
[Sat Dec 27 22:03:52.684078 2025] [:error] [pid 31933:tid 31951] [client 13.70.48.86:14045] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nSMGr1WIJr39uqaoBvwAAAdA"]
[Sat Dec 27 22:03:52.977964 2025] [:error] [pid 15939:tid 15945] [client 13.70.48.86:13952] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nSOZ7qdnFxikanML0mwAAAQQ"]
[Sat Dec 27 22:03:53.276467 2025] [:error] [pid 32191:tid 32212] [client 13.70.48.86:14002] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aU_nSbPNtMgrjVCHIdFDEgAAABE"]
[Sat Dec 27 22:03:53.579714 2025] [:error] [pid 32191:tid 32197] [client 13.70.48.86:8148] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU_nSbPNtMgrjVCHIdFDFAAAAAI"]
[Sat Dec 27 22:03:53.906433 2025] [:error] [pid 32191:tid 32210] [client 13.70.48.86:14032] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU_nSbPNtMgrjVCHIdFDFwAAAA8"]
[Sat Dec 27 22:03:54.164777 2025] [:error] [pid 3114:tid 3141] [client 13.70.48.86:8128] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU_nSmJGrIkLOdbPpJi5RwAAAZc"]
[Sat Dec 27 22:03:54.496467 2025] [:error] [pid 31933:tid 31955] [client 13.70.48.86:13963] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aU_nSsGr1WIJr39uqaoBwgAAAdQ"]
[Sat Dec 27 22:03:54.755429 2025] [:error] [pid 15939:tid 15955] [client 13.70.48.86:14010] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU_nSuZ7qdnFxikanML0nQAAAQ4"]
[Sat Dec 27 22:03:55.016179 2025] [:error] [pid 15939:tid 15951] [client 13.70.48.86:8067] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU_nS-Z7qdnFxikanML0ngAAAQo"]
[Sat Dec 27 22:03:55.255337 2025] [:error] [pid 15939:tid 15948] [client 13.70.48.86:14072] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU_nS-Z7qdnFxikanML0nwAAAQc"]
[Sat Dec 27 22:03:55.543116 2025] [:error] [pid 15939:tid 15960] [client 13.70.48.86:8109] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aU_nS-Z7qdnFxikanML0oAAAARM"]
[Sat Dec 27 22:03:55.815477 2025] [:error] [pid 15939:tid 15963] [client 13.70.48.86:14001] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU_nS-Z7qdnFxikanML0oQAAARY"]
[Sat Dec 27 22:03:56.154751 2025] [:error] [pid 32278:tid 32281] [client 13.70.48.86:8135] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU_nTH-IfCN2Cy9Gccg78wAAAME"]
[Sat Dec 27 22:03:56.474498 2025] [:error] [pid 45373:tid 45381] [client 13.70.48.86:14067] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU_nTC7p_wFcbpu46HWQ1AAAAUY"]
[Sat Dec 27 22:03:56.752586 2025] [:error] [pid 31933:tid 31941] [client 13.70.48.86:14055] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aU_nTMGr1WIJr39uqaoByAAAAcY"]
[Sat Dec 27 22:03:57.024894 2025] [:error] [pid 32278:tid 32303] [client 13.70.48.86:8158] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU_nTX-IfCN2Cy9Gccg79AAAANc"]
[Sat Dec 27 22:03:57.315122 2025] [:error] [pid 31933:tid 31945] [client 13.70.48.86:13995] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU_nTcGr1WIJr39uqaoBygAAAco"]
[Sat Dec 27 22:03:57.647203 2025] [:error] [pid 3114:tid 3123] [client 13.70.48.86:14034] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU_nTWJGrIkLOdbPpJi5SwAAAYU"]
[Sat Dec 27 22:03:57.959342 2025] [:error] [pid 32278:tid 32288] [client 13.70.48.86:13979] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aU_nTX-IfCN2Cy9Gccg79wAAAMg"]
[Sat Dec 27 22:03:58.357306 2025] [:error] [pid 45373:tid 45379] [client 13.70.48.86:8138] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nTi7p_wFcbpu46HWQ2AAAAUQ"]
[Sat Dec 27 22:03:58.673785 2025] [:error] [pid 15939:tid 15959] [client 13.70.48.86:14046] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nTuZ7qdnFxikanML0owAAARI"]
[Sat Dec 27 22:03:58.983422 2025] [:error] [pid 31933:tid 31946] [client 13.70.48.86:8075] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nTsGr1WIJr39uqaoB0QAAAcs"]
[Sat Dec 27 22:03:59.297639 2025] [:error] [pid 31933:tid 31959] [client 13.70.48.86:8098] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aU_nT8Gr1WIJr39uqaoB0gAAAdg"]
[Sat Dec 27 22:03:59.615021 2025] [:error] [pid 45373:tid 45390] [client 13.70.48.86:14009] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU_nTy7p_wFcbpu46HWQ2gAAAU8"]
[Sat Dec 27 22:03:59.899357 2025] [:error] [pid 45373:tid 45377] [client 13.70.48.86:13974] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU_nTy7p_wFcbpu46HWQ3AAAAUI"]
[Sat Dec 27 22:04:00.187319 2025] [:error] [pid 31933:tid 31950] [client 13.70.48.86:8186] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU_nUMGr1WIJr39uqaoB0wAAAc8"]
[Sat Dec 27 22:04:00.497817 2025] [:error] [pid 32193:tid 32258] [client 13.70.48.86:8172] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aU_nUBgw0eCOc2qYqaK9NAAAAIg"]
[Sat Dec 27 22:04:00.930316 2025] [:error] [pid 31933:tid 31956] [client 13.70.48.86:8167] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aU_nUMGr1WIJr39uqaoB1QAAAdU"]
[Sat Dec 27 22:04:01.263715 2025] [:error] [pid 32278:tid 32286] [client 13.70.48.86:8164] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aU_nUX-IfCN2Cy9Gccg7-gAAAMY"]
[Sat Dec 27 22:04:01.499225 2025] [:error] [pid 32278:tid 32296] [client 13.70.48.86:14047] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aU_nUX-IfCN2Cy9Gccg7-wAAANA"]
[Sat Dec 27 22:04:01.764459 2025] [:error] [pid 45373:tid 45383] [client 13.70.48.86:14060] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aU_nUS7p_wFcbpu46HWQ3gAAAUg"]
[Sat Dec 27 22:04:02.057417 2025] [:error] [pid 32193:tid 32255] [client 13.70.48.86:13973] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU_nUhgw0eCOc2qYqaK9OQAAAIU"]
[Sat Dec 27 22:04:02.373472 2025] [:error] [pid 3114:tid 3129] [client 13.70.48.86:8081] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU_nUmJGrIkLOdbPpJi5TwAAAYs"]
[Sat Dec 27 22:04:02.627092 2025] [:error] [pid 32193:tid 32273] [client 13.70.48.86:8126] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU_nUhgw0eCOc2qYqaK9PAAAAJc"]
[Sat Dec 27 22:04:02.879883 2025] [:error] [pid 32191:tid 32205] [client 13.70.48.86:8165] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aU_nUrPNtMgrjVCHIdFDGwAAAAo"]
[Sat Dec 27 22:04:03.487548 2025] [:error] [pid 32192:tid 32239] [client 13.70.48.86:8130] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU_nUy_q0VFe066lbk9oOQAAAFA"]
[Sat Dec 27 22:04:03.856338 2025] [:error] [pid 32192:tid 32241] [client 13.70.48.86:14077] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU_nUy_q0VFe066lbk9oOwAAAFI"]
[Sat Dec 27 22:04:04.182063 2025] [:error] [pid 45373:tid 45379] [client 13.70.48.86:13986] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU_nVC7p_wFcbpu46HWQ4gAAAUQ"]
[Sat Dec 27 22:04:04.536668 2025] [:error] [pid 32278:tid 32291] [client 13.70.48.86:13980] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU_nVH-IfCN2Cy9Gccg7_gAAAMs"]
[Sat Dec 27 22:04:04.864718 2025] [:error] [pid 45373:tid 45378] [client 13.70.48.86:8020] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU_nVC7p_wFcbpu46HWQ4wAAAUM"]
[Sat Dec 27 22:04:05.217330 2025] [:error] [pid 32191:tid 32219] [client 13.70.48.86:13956] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU_nVbPNtMgrjVCHIdFDHgAAABg"]
[Sat Dec 27 22:04:05.494475 2025] [:error] [pid 32191:tid 32197] [client 13.70.48.86:14013] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU_nVbPNtMgrjVCHIdFDHwAAAAI"]
[Sat Dec 27 22:04:06.354717 2025] [:error] [pid 32192:tid 32231] [client 13.70.48.86:14038] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aU_nVi_q0VFe066lbk9oPwAAAEg"]
[Sat Dec 27 22:04:06.675768 2025] [:error] [pid 32193:tid 32258] [client 13.70.48.86:8180] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aU_nVhgw0eCOc2qYqaK9QwAAAIg"]
[Sat Dec 27 22:04:07.071033 2025] [:error] [pid 32191:tid 32208] [client 13.70.48.86:8129] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aU_nV7PNtMgrjVCHIdFDJAAAAA0"]
[Sat Dec 27 22:04:07.367153 2025] [:error] [pid 32278:tid 32293] [client 13.70.48.86:14079] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aU_nV3-IfCN2Cy9Gccg7_wAAAM0"]
[Sat Dec 27 22:04:07.688544 2025] [:error] [pid 31933:tid 31939] [client 13.70.48.86:8086] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aU_nV8Gr1WIJr39uqaoB2AAAAcQ"]
[Sat Dec 27 22:04:07.951149 2025] [:error] [pid 31933:tid 31940] [client 13.70.48.86:8133] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU_nV8Gr1WIJr39uqaoB2wAAAcU"]
[Sat Dec 27 22:04:08.216283 2025] [:error] [pid 32191:tid 32198] [client 13.70.48.86:14019] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU_nWLPNtMgrjVCHIdFDJwAAAAM"]
[Sat Dec 27 22:04:08.687892 2025] [:error] [pid 32192:tid 32225] [client 13.70.48.86:13992] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU_nWC_q0VFe066lbk9oQQAAAEI"]
[Sat Dec 27 22:04:08.955508 2025] [:error] [pid 32193:tid 32251] [client 13.70.48.86:13988] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aU_nWBgw0eCOc2qYqaK9RgAAAIE"]
[Sat Dec 27 22:04:09.216875 2025] [:error] [pid 45373:tid 45377] [client 13.70.48.86:8153] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aU_nWS7p_wFcbpu46HWQ5QAAAUI"]
[Sat Dec 27 22:04:09.481237 2025] [:error] [pid 32192:tid 32236] [client 13.70.48.86:8185] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aU_nWS_q0VFe066lbk9oQgAAAE0"]
[Sat Dec 27 22:04:09.743051 2025] [:error] [pid 45373:tid 45385] [client 13.70.48.86:13997] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aU_nWS7p_wFcbpu46HWQ5gAAAUo"]
[Sat Dec 27 22:04:09.991608 2025] [:error] [pid 45373:tid 45391] [client 13.70.48.86:8146] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aU_nWS7p_wFcbpu46HWQ5wAAAVA"]
[Sat Dec 27 22:04:10.361424 2025] [:error] [pid 32193:tid 32266] [client 13.70.48.86:8082] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aU_nWhgw0eCOc2qYqaK9SAAAAJA"]
[Sat Dec 27 22:04:10.666296 2025] [:error] [pid 3114:tid 3137] [client 13.70.48.86:8136] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aU_nWmJGrIkLOdbPpJi5WAAAAZM"]
[Sat Dec 27 22:04:10.909015 2025] [:error] [pid 32191:tid 32209] [client 13.70.48.86:14070] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aU_nWrPNtMgrjVCHIdFDKAAAAA4"]
[Sat Dec 27 22:04:11.207482 2025] [:error] [pid 3114:tid 3140] [client 13.70.48.86:8157] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aU_nW2JGrIkLOdbPpJi5WQAAAZY"]
[Sat Dec 27 22:04:11.661047 2025] [:error] [pid 45373:tid 45388] [client 13.70.48.86:8190] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU_nWy7p_wFcbpu46HWQ6gAAAU0"]
[Sat Dec 27 22:04:11.986383 2025] [:error] [pid 32191:tid 32203] [client 13.70.48.86:13963] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU_nW7PNtMgrjVCHIdFDKgAAAAg"]
[Sat Dec 27 22:04:12.286237 2025] [:error] [pid 45373:tid 45375] [client 13.70.48.86:14007] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU_nXC7p_wFcbpu46HWQ7AAAAUA"]
[Sat Dec 27 22:04:12.691847 2025] [:error] [pid 32278:tid 32281] [client 13.70.48.86:14049] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aU_nXH-IfCN2Cy9Gccg8AgAAAME"]
[Sat Dec 27 22:04:13.034050 2025] [:error] [pid 32278:tid 32303] [client 13.70.48.86:14043] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aU_nXX-IfCN2Cy9Gccg8AwAAANc"]
[Sat Dec 27 22:04:13.324067 2025] [:error] [pid 32192:tid 32235] [client 13.70.48.86:8144] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aU_nXS_q0VFe066lbk9oQwAAAEw"]
[Sat Dec 27 22:04:13.629430 2025] [:error] [pid 31933:tid 31950] [client 13.70.48.86:8091] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aU_nXcGr1WIJr39uqaoB4QAAAc8"]
[Sat Dec 27 22:04:13.878983 2025] [:error] [pid 45373:tid 45387] [client 13.70.48.86:14005] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aU_nXS7p_wFcbpu46HWQ7QAAAUw"]
[Sat Dec 27 22:04:14.171476 2025] [:error] [pid 32191:tid 32217] [client 13.70.48.86:14008] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU_nXrPNtMgrjVCHIdFDKwAAABY"]
[Sat Dec 27 22:04:14.545352 2025] [:error] [pid 31933:tid 31936] [client 13.70.48.86:8036] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU_nXsGr1WIJr39uqaoB4wAAAcE"]
[Sat Dec 27 22:04:14.893178 2025] [:error] [pid 32278:tid 32301] [client 13.70.48.86:8117] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU_nXn-IfCN2Cy9Gccg8BAAAANU"]
[Sat Dec 27 22:04:15.337819 2025] [:error] [pid 32192:tid 32223] [client 13.70.48.86:8181] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU_nXy_q0VFe066lbk9oRgAAAEA"]
[Sat Dec 27 22:04:15.616405 2025] [:error] [pid 32193:tid 32274] [client 13.70.48.86:8180] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU_nXxgw0eCOc2qYqaK9TQAAAJg"]
[Sat Dec 27 22:04:15.884217 2025] [:error] [pid 32193:tid 32257] [client 13.70.48.86:8079] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU_nXxgw0eCOc2qYqaK9TgAAAIc"]
[Sat Dec 27 22:04:16.201044 2025] [:error] [pid 32278:tid 32280] [client 13.70.48.86:8066] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU_nYH-IfCN2Cy9Gccg8BwAAAMA"]
[Sat Dec 27 22:04:16.481738 2025] [:error] [pid 31933:tid 31957] [client 13.70.48.86:14050] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU_nYMGr1WIJr39uqaoB5AAAAdY"]
[Sat Dec 27 22:04:16.763080 2025] [:error] [pid 15939:tid 15944] [client 13.70.48.86:8069] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aU_nYOZ7qdnFxikanML0qQAAAQM"]
[Sat Dec 27 22:04:17.021612 2025] [:error] [pid 31933:tid 31941] [client 13.70.48.86:14016] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aU_nYcGr1WIJr39uqaoB5gAAAcY"]
[Sat Dec 27 22:04:17.259608 2025] [:error] [pid 32192:tid 32229] [client 13.70.48.86:14000] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aU_nYS_q0VFe066lbk9oSAAAAEY"]
[Sat Dec 27 22:04:17.521945 2025] [:error] [pid 45373:tid 45380] [client 13.70.48.86:8176] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aU_nYS7p_wFcbpu46HWQ8AAAAUU"]
[Sat Dec 27 22:04:17.893775 2025] [:error] [pid 31933:tid 31942] [client 13.70.48.86:8182] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aU_nYcGr1WIJr39uqaoB5wAAAcc"]
[Sat Dec 27 22:04:18.152992 2025] [:error] [pid 32192:tid 32224] [client 13.70.48.86:14012] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aU_nYi_q0VFe066lbk9oSQAAAEE"]
[Sat Dec 27 22:04:18.448021 2025] [:error] [pid 32192:tid 32239] [client 13.70.48.86:13954] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aU_nYi_q0VFe066lbk9oSgAAAFA"]
[Sat Dec 27 22:04:18.736366 2025] [:error] [pid 32192:tid 32241] [client 13.70.48.86:8093] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aU_nYi_q0VFe066lbk9oTAAAAFI"]
[Sat Dec 27 22:04:19.094411 2025] [:error] [pid 45373:tid 45378] [client 13.70.48.86:14025] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aU_nYy7p_wFcbpu46HWQ8gAAAUM"]
[Sat Dec 27 22:04:19.362298 2025] [:error] [pid 32193:tid 32258] [client 13.70.48.86:8121] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aU_nYxgw0eCOc2qYqaK9UAAAAIg"]
[Sat Dec 27 22:04:19.614435 2025] [:error] [pid 32193:tid 32255] [client 13.70.48.86:8064] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aU_nYxgw0eCOc2qYqaK9VAAAAIU"]
[Sat Dec 27 22:04:19.870395 2025] [:error] [pid 32193:tid 32267] [client 13.70.48.86:8050] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aU_nYxgw0eCOc2qYqaK9VgAAAJE"]
[Sat Dec 27 22:04:20.311826 2025] [:error] [pid 31933:tid 31940] [client 13.70.48.86:14015] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sat Dec 27 22:04:20.432532 2025] [:error] [pid 31933:tid 31945] [client 13.70.48.86:14015] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Dec 27 22:04:20.694440 2025] [:error] [pid 31933:tid 31952] [client 13.70.48.86:14015] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Dec 27 22:04:20.935307 2025] [:error] [pid 31933:tid 31951] [client 13.70.48.86:14015] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Dec 27 22:04:21.064412 2025] [:error] [pid 31933:tid 31953] [client 13.70.48.86:14015] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Dec 27 22:04:21.238445 2025] [:error] [pid 31933:tid 31943] [client 13.70.48.86:14015] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Dec 27 22:04:22.651230 2025] [:error] [pid 31933:tid 31943] [client 13.70.48.86:14015] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Dec 27 22:04:22.768787 2025] [:error] [pid 31933:tid 31955] [client 13.70.48.86:14015] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aU_nZsGr1WIJr39uqaoB9AAAAdQ"]
[Sat Dec 27 22:04:23.006968 2025] [:error] [pid 32192:tid 32231] [client 13.70.48.86:8189] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aU_nZy_q0VFe066lbk9oTQAAAEg"]
[Sat Dec 27 22:04:23.309146 2025] [:error] [pid 3114:tid 3132] [client 13.70.48.86:14066] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aU_nZ2JGrIkLOdbPpJi5WwAAAY4"]
[Sat Dec 27 22:04:23.556891 2025] [:error] [pid 45373:tid 45386] [client 13.70.48.86:8002] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aU_nZy7p_wFcbpu46HWQ9wAAAUs"]
[Sat Dec 27 22:04:23.808612 2025] [:error] [pid 32193:tid 32252] [client 13.70.48.86:8085] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU_nZxgw0eCOc2qYqaK9WwAAAII"]
[Sat Dec 27 22:04:24.145924 2025] [:error] [pid 45373:tid 45384] [client 13.70.48.86:8111] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU_naC7p_wFcbpu46HWQ-AAAAUk"]
[Sat Dec 27 22:04:24.402296 2025] [:error] [pid 45373:tid 45397] [client 13.70.48.86:8065] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU_naC7p_wFcbpu46HWQ-QAAAVY"]
[Sat Dec 27 22:04:24.733228 2025] [:error] [pid 32278:tid 32290] [client 13.70.48.86:8015] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU_naH-IfCN2Cy9Gccg8DQAAAMo"]
[Sat Dec 27 22:04:25.054456 2025] [:error] [pid 32193:tid 32274] [client 13.70.48.86:8187] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU_naRgw0eCOc2qYqaK9XQAAAJg"]
[Sat Dec 27 22:04:25.389663 2025] [:error] [pid 3114:tid 3142] [client 13.70.48.86:8018] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU_naWJGrIkLOdbPpJi5XAAAAZg"]
[Sat Dec 27 22:04:25.814236 2025] [:error] [pid 3114:tid 3129] [client 13.70.48.86:8120] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU_naWJGrIkLOdbPpJi5XQAAAYs"]
[Sat Dec 27 22:04:26.204439 2025] [:error] [pid 31933:tid 31954] [client 13.70.48.86:8070] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aU_nasGr1WIJr39uqaoB-AAAAdM"]
[Sat Dec 27 22:04:26.538390 2025] [:error] [pid 31933:tid 31938] [client 13.70.48.86:8113] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU_nasGr1WIJr39uqaoB-QAAAcM"]
[Sat Dec 27 22:04:26.813277 2025] [:error] [pid 31933:tid 31942] [client 13.70.48.86:8108] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU_nasGr1WIJr39uqaoB-gAAAcc"]
[Sat Dec 27 22:04:27.179919 2025] [:error] [pid 3114:tid 3118] [client 13.70.48.86:8134] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU_na2JGrIkLOdbPpJi5XgAAAYA"]
[Sat Dec 27 22:04:27.448166 2025] [:error] [pid 31933:tid 31952] [client 13.70.48.86:8124] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aU_na8Gr1WIJr39uqaoB_gAAAdE"]
[Sat Dec 27 22:04:27.814734 2025] [:error] [pid 15939:tid 15958] [client 13.70.48.86:13987] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aU_na-Z7qdnFxikanML0sgAAARE"]
[Sat Dec 27 22:04:28.105890 2025] [:error] [pid 15939:tid 15956] [client 13.70.48.86:8114] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aU_nbOZ7qdnFxikanML0swAAAQ8"]
[Sat Dec 27 22:04:28.402390 2025] [:error] [pid 15939:tid 15949] [client 13.70.48.86:8107] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aU_nbOZ7qdnFxikanML0tAAAAQg"]
[Sat Dec 27 22:04:28.674064 2025] [:error] [pid 3114:tid 3135] [client 13.70.48.86:8105] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aU_nbGJGrIkLOdbPpJi5XwAAAZE"]
[Sat Dec 27 22:04:29.047117 2025] [:error] [pid 3114:tid 3134] [client 13.70.48.86:8092] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aU_nbWJGrIkLOdbPpJi5YAAAAZA"]
[Sat Dec 27 22:04:29.306416 2025] [:error] [pid 15939:tid 15944] [client 13.70.48.86:7967] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aU_nbeZ7qdnFxikanML0tgAAAQM"]
[Sat Dec 27 22:04:29.562432 2025] [:error] [pid 45373:tid 45392] [client 13.70.48.86:8160] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU_nbS7p_wFcbpu46HWQ_gAAAVE"]
[Sat Dec 27 22:04:29.968604 2025] [:error] [pid 31933:tid 31946] [client 13.70.48.86:8191] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU_nbcGr1WIJr39uqaoCAgAAAcs"]
[Sat Dec 27 22:04:30.325278 2025] [:error] [pid 15939:tid 15955] [client 13.70.48.86:8033] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU_nbuZ7qdnFxikanML0uAAAAQ4"]
[Sat Dec 27 22:04:30.568447 2025] [:error] [pid 31933:tid 31954] [client 13.70.48.86:8004] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU_nbsGr1WIJr39uqaoCBQAAAdM"]
[Sat Dec 27 22:04:30.820108 2025] [:error] [pid 45373:tid 45380] [client 13.70.48.86:8149] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aU_nbi7p_wFcbpu46HWQ_wAAAUU"]
[Sat Dec 27 22:04:31.138228 2025] [:error] [pid 32278:tid 32303] [client 13.70.48.86:8162] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aU_nb3-IfCN2Cy9Gccg8EQAAANc"]
[Sat Dec 27 22:04:31.419894 2025] [:error] [pid 32192:tid 32226] [client 13.70.48.86:13993] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aU_nby_q0VFe066lbk9oUwAAAEM"]
[Sat Dec 27 22:04:31.692366 2025] [:error] [pid 32278:tid 32280] [client 13.70.48.86:8064] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aU_nb3-IfCN2Cy9Gccg8EwAAAMA"]
[Sat Dec 27 22:04:32.046145 2025] [:error] [pid 31933:tid 31941] [client 13.70.48.86:8178] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aU_ncMGr1WIJr39uqaoCBgAAAcY"]
[Sat Dec 27 22:04:32.436715 2025] [:error] [pid 32192:tid 32232] [client 13.70.48.86:8000] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aU_ncC_q0VFe066lbk9oVQAAAEk"]
[Sat Dec 27 22:04:32.795359 2025] [:error] [pid 32278:tid 32299] [client 13.70.48.86:8188] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aU_ncH-IfCN2Cy9Gccg8FAAAANM"]
[Sat Dec 27 22:04:33.211575 2025] [:error] [pid 32278:tid 32284] [client 13.70.48.86:8122] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aU_ncX-IfCN2Cy9Gccg8FgAAAMQ"]
[Sat Dec 27 22:04:33.617216 2025] [:error] [pid 32191:tid 32214] [client 13.70.48.86:8071] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aU_ncbPNtMgrjVCHIdFDMQAAABM"]
[Sat Dec 27 22:04:33.932662 2025] [:error] [pid 32193:tid 32267] [client 13.70.48.86:8170] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aU_ncRgw0eCOc2qYqaK9ZAAAAJE"]
[Sat Dec 27 22:04:34.200699 2025] [:error] [pid 3114:tid 3133] [client 13.70.48.86:8110] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aU_ncmJGrIkLOdbPpJi5YgAAAY8"]
[Sat Dec 27 22:04:34.575035 2025] [:error] [pid 32192:tid 32234] [client 13.70.48.86:8007] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aU_nci_q0VFe066lbk9oVwAAAEs"]
[Sat Dec 27 22:04:34.836715 2025] [:error] [pid 32193:tid 32260] [client 13.70.48.86:8027] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU_nchgw0eCOc2qYqaK9ZQAAAIo"]
[Sat Dec 27 22:04:35.260880 2025] [:error] [pid 32193:tid 32250] [client 13.70.48.86:8118] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU_ncxgw0eCOc2qYqaK9aAAAAIA"]
[Sat Dec 27 22:04:35.731877 2025] [:error] [pid 3114:tid 3128] [client 13.70.48.86:8084] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU_nc2JGrIkLOdbPpJi5ZgAAAYo"]
[Sat Dec 27 22:04:36.016625 2025] [:error] [pid 3114:tid 3123] [client 13.70.48.86:13969] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU_ndGJGrIkLOdbPpJi5aAAAAYU"]
[Sat Dec 27 22:04:36.360142 2025] [:error] [pid 3114:tid 3125] [client 13.70.48.86:8023] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aU_ndGJGrIkLOdbPpJi5aQAAAYc"]
[Sat Dec 27 22:04:36.803754 2025] [:error] [pid 32191:tid 32201] [client 13.70.48.86:8163] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aU_ndLPNtMgrjVCHIdFDNQAAAAY"]
[Sat Dec 27 22:04:37.201513 2025] [:error] [pid 32192:tid 32230] [client 13.70.48.86:8078] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aU_ndS_q0VFe066lbk9oWQAAAEc"]
[Sat Dec 27 22:04:37.474876 2025] [:error] [pid 32193:tid 32257] [client 13.70.48.86:8115] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aU_ndRgw0eCOc2qYqaK9agAAAIc"]
[Sat Dec 27 22:04:37.952943 2025] [:error] [pid 32278:tid 32292] [client 13.70.48.86:8088] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aU_ndX-IfCN2Cy9Gccg8GAAAAMw"]
[Sat Dec 27 22:04:38.229184 2025] [:error] [pid 32193:tid 32253] [client 13.70.48.86:8009] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aU_ndhgw0eCOc2qYqaK9bAAAAIM"]
[Sat Dec 27 22:04:38.626611 2025] [:error] [pid 31933:tid 31944] [client 13.70.48.86:7961] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aU_ndsGr1WIJr39uqaoCDwAAAck"]
[Sat Dec 27 22:04:38.985741 2025] [:error] [pid 32278:tid 32283] [client 13.70.48.86:8006] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aU_ndn-IfCN2Cy9Gccg8GgAAAMM"]
[Sat Dec 27 22:04:39.496023 2025] [:error] [pid 15939:tid 15947] [client 13.70.48.86:8097] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU_nd-Z7qdnFxikanML0vQAAAQY"]
[Sat Dec 27 22:04:39.785397 2025] [:error] [pid 32278:tid 32296] [client 13.70.48.86:8003] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU_nd3-IfCN2Cy9Gccg8GwAAANA"]
[Sat Dec 27 22:04:40.123176 2025] [:error] [pid 45373:tid 45383] [client 13.70.48.86:8008] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU_neC7p_wFcbpu46HWRBQAAAUg"]
[Sat Dec 27 22:04:40.544501 2025] [:error] [pid 32278:tid 32290] [client 13.70.48.86:7970] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aU_neH-IfCN2Cy9Gccg8HAAAAMo"]
[Sat Dec 27 22:04:40.953752 2025] [:error] [pid 32278:tid 32293] [client 13.70.48.86:8080] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aU_neH-IfCN2Cy9Gccg8HgAAAM0"]
[Sat Dec 27 22:04:41.279134 2025] [:error] [pid 32192:tid 32235] [client 13.70.48.86:8005] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aU_neS_q0VFe066lbk9oXgAAAEw"]
[Sat Dec 27 22:04:41.545033 2025] [:error] [pid 3114:tid 3118] [client 13.70.48.86:8096] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aU_neWJGrIkLOdbPpJi5bgAAAYA"]
[Sat Dec 27 22:04:41.914308 2025] [:error] [pid 32192:tid 32244] [client 13.70.48.86:14028] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aU_neS_q0VFe066lbk9oYAAAAFU"]
[Sat Dec 27 22:04:42.192424 2025] [:error] [pid 32192:tid 32242] [client 13.70.48.86:8038] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU_nei_q0VFe066lbk9oYgAAAFM"]
[Sat Dec 27 22:04:42.472141 2025] [:error] [pid 15939:tid 15953] [client 13.70.48.86:8077] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU_neuZ7qdnFxikanML0wQAAAQw"]
[Sat Dec 27 22:04:42.813725 2025] [:error] [pid 45373:tid 45388] [client 13.70.48.86:8123] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU_nei7p_wFcbpu46HWRBwAAAU0"]
[Sat Dec 27 22:04:43.056904 2025] [:error] [pid 15939:tid 15956] [client 13.70.48.86:8055] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU_ne-Z7qdnFxikanML0wgAAAQ8"]
[Sat Dec 27 22:04:43.565634 2025] [:error] [pid 15939:tid 15949] [client 13.70.48.86:8100] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU_ne-Z7qdnFxikanML0wwAAAQg"]
[Sat Dec 27 22:04:43.820851 2025] [:error] [pid 32278:tid 32303] [client 13.70.48.86:8011] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU_ne3-IfCN2Cy9Gccg8IQAAANc"]
[Sat Dec 27 22:04:44.117282 2025] [:error] [pid 31933:tid 31938] [client 13.70.48.86:8173] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU_nfMGr1WIJr39uqaoCEwAAAcM"]
[Sat Dec 27 22:04:44.384221 2025] [:error] [pid 45373:tid 45393] [client 13.70.48.86:8076] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aU_nfC7p_wFcbpu46HWRCgAAAVI"]
[Sat Dec 27 22:04:44.654400 2025] [:error] [pid 32191:tid 32210] [client 13.70.48.86:8010] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU_nfLPNtMgrjVCHIdFDOgAAAA8"]
[Sat Dec 27 22:04:44.941995 2025] [:error] [pid 45373:tid 45387] [client 13.70.48.86:8055] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU_nfC7p_wFcbpu46HWRCwAAAUw"]
[Sat Dec 27 22:04:45.233168 2025] [:error] [pid 32278:tid 32284] [client 13.70.48.86:8026] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU_nfX-IfCN2Cy9Gccg8JAAAAMQ"]
[Sat Dec 27 22:04:45.477226 2025] [:error] [pid 32192:tid 32245] [client 13.70.48.86:7946] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU_nfS_q0VFe066lbk9oZAAAAFY"]
[Sat Dec 27 22:04:45.804034 2025] [:error] [pid 3114:tid 3133] [client 13.70.48.86:8025] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU_nfWJGrIkLOdbPpJi5cQAAAY8"]
[Sat Dec 27 22:04:46.065318 2025] [:error] [pid 32192:tid 32229] [client 13.70.48.86:8045] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU_nfi_q0VFe066lbk9oZQAAAEY"]
[Sat Dec 27 22:04:46.474282 2025] [:error] [pid 3114:tid 3131] [client 13.70.48.86:7875] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU_nfmJGrIkLOdbPpJi5cgAAAY0"]
[Sat Dec 27 22:04:46.983280 2025] [:error] [pid 15939:tid 15955] [client 13.70.48.86:8038] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aU_nfuZ7qdnFxikanML0xQAAAQ4"]
[Sat Dec 27 22:04:47.480667 2025] [:error] [pid 32193:tid 32266] [client 13.70.48.86:8024] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU_nfxgw0eCOc2qYqaK9cQAAAJA"]
[Sat Dec 27 22:04:47.846755 2025] [:error] [pid 32193:tid 32267] [client 13.70.48.86:8014] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU_nfxgw0eCOc2qYqaK9cgAAAJE"]
[Sat Dec 27 22:04:48.153384 2025] [:error] [pid 32191:tid 32216] [client 13.70.48.86:8168] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU_ngLPNtMgrjVCHIdFDPgAAABU"]
[Sat Dec 27 22:04:48.425722 2025] [:error] [pid 32278:tid 32304] [client 13.70.48.86:7968] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU_ngH-IfCN2Cy9Gccg8JgAAANg"]
[Sat Dec 27 22:04:48.678189 2025] [:error] [pid 32193:tid 32260] [client 13.70.48.86:13984] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aU_ngBgw0eCOc2qYqaK9cwAAAIo"]
[Sat Dec 27 22:04:48.944135 2025] [:error] [pid 32278:tid 32294] [client 13.70.48.86:8089] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU_ngH-IfCN2Cy9Gccg8JwAAAM4"]
[Sat Dec 27 22:04:49.239681 2025] [:error] [pid 3114:tid 3128] [client 13.70.48.86:8041] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU_ngWJGrIkLOdbPpJi5dgAAAYo"]
[Sat Dec 27 22:04:49.699090 2025] [:error] [pid 15939:tid 15951] [client 13.70.48.86:8035] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU_ngeZ7qdnFxikanML0yAAAAQo"]
[Sat Dec 27 22:04:49.947576 2025] [:error] [pid 15939:tid 15952] [client 13.70.48.86:7987] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aU_ngeZ7qdnFxikanML0yQAAAQs"]
[Sat Dec 27 22:04:50.271756 2025] [:error] [pid 32192:tid 32243] [client 13.70.48.86:7950] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU_ngi_q0VFe066lbk9oawAAAFQ"]
[Sat Dec 27 22:04:50.555216 2025] [:error] [pid 31933:tid 31942] [client 13.70.48.86:8112] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU_ngsGr1WIJr39uqaoCFAAAAcc"]
[Sat Dec 27 22:04:50.895239 2025] [:error] [pid 31933:tid 31945] [client 13.70.48.86:8017] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU_ngsGr1WIJr39uqaoCFQAAAco"]
[Sat Dec 27 22:04:51.269482 2025] [:error] [pid 3114:tid 3122] [client 13.70.48.86:7953] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU_ng2JGrIkLOdbPpJi5eAAAAYQ"]
[Sat Dec 27 22:04:51.592827 2025] [:error] [pid 3114:tid 3124] [client 13.70.48.86:8139] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aU_ng2JGrIkLOdbPpJi5eQAAAYY"]
[Sat Dec 27 22:04:52.101610 2025] [:error] [pid 32192:tid 32227] [client 13.70.48.86:7942] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aU_nhC_q0VFe066lbk9obgAAAEQ"]
[Sat Dec 27 22:04:52.429567 2025] [:error] [pid 31933:tid 31950] [client 13.70.48.86:8083] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aU_nhMGr1WIJr39uqaoCGgAAAc8"]
[Sat Dec 27 22:04:52.820294 2025] [:error] [pid 31933:tid 31944] [client 13.70.48.86:8056] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aU_nhMGr1WIJr39uqaoCGwAAAck"]
[Sat Dec 27 22:04:53.258700 2025] [:error] [pid 31933:tid 31940] [client 13.70.48.86:13985] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU_nhcGr1WIJr39uqaoCHAAAAcU"]
[Sat Dec 27 22:04:53.644105 2025] [:error] [pid 31933:tid 31956] [client 13.70.48.86:7958] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU_nhcGr1WIJr39uqaoCIAAAAdU"]
[Sat Dec 27 22:04:53.968012 2025] [:error] [pid 15939:tid 15960] [client 13.70.48.86:8054] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU_nheZ7qdnFxikanML0ygAAARM"]
[Sat Dec 27 22:04:54.246113 2025] [:error] [pid 3114:tid 3132] [client 13.70.48.86:8021] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aU_nhmJGrIkLOdbPpJi5fAAAAY4"]
[Sat Dec 27 22:04:54.594063 2025] [:error] [pid 45373:tid 45393] [client 13.70.48.86:13991] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aU_nhi7p_wFcbpu46HWRFgAAAVI"]
[Sat Dec 27 22:04:54.895933 2025] [:error] [pid 45373:tid 45394] [client 13.70.48.86:7974] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aU_nhi7p_wFcbpu46HWRFwAAAVM"]
[Sat Dec 27 22:04:55.285375 2025] [:error] [pid 45373:tid 45398] [client 13.70.48.86:8169] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aU_nhy7p_wFcbpu46HWRGAAAAVc"]
[Sat Dec 27 22:04:55.657375 2025] [:error] [pid 3114:tid 3135] [client 13.70.48.86:8140] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aU_nh2JGrIkLOdbPpJi5fgAAAZE"]
[Sat Dec 27 22:04:55.973377 2025] [:error] [pid 45373:tid 45380] [client 13.70.48.86:8048] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aU_nhy7p_wFcbpu46HWRGQAAAUU"]
[Sat Dec 27 22:04:56.282798 2025] [:error] [pid 45373:tid 45379] [client 13.70.48.86:8125] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aU_niC7p_wFcbpu46HWRGgAAAUQ"]
[Sat Dec 27 22:04:56.555458 2025] [:error] [pid 32191:tid 32198] [client 13.70.48.86:8030] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aU_niLPNtMgrjVCHIdFDQAAAAAM"]
[Sat Dec 27 22:04:57.143090 2025] [:error] [pid 3114:tid 3128] [client 13.70.48.86:7943] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aU_niWJGrIkLOdbPpJi5gwAAAYo"]
[Sat Dec 27 22:04:57.516283 2025] [:error] [pid 3114:tid 3141] [client 13.70.48.86:8152] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aU_niWJGrIkLOdbPpJi5hAAAAZc"]
[Sat Dec 27 22:04:58.026522 2025] [:error] [pid 45373:tid 45376] [client 13.70.48.86:7973] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aU_nii7p_wFcbpu46HWRHAAAAUE"]
[Sat Dec 27 22:04:58.361060 2025] [:error] [pid 45373:tid 45390] [client 13.70.48.86:7937] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aU_nii7p_wFcbpu46HWRHQAAAU8"]
[Sat Dec 27 22:04:58.657432 2025] [:error] [pid 32278:tid 32296] [client 13.70.48.86:8140] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aU_nin-IfCN2Cy9Gccg8KgAAANA"]
[Sat Dec 27 22:04:58.908546 2025] [:error] [pid 32193:tid 32265] [client 13.70.48.86:8052] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU_nihgw0eCOc2qYqaK9eAAAAI8"]
[Sat Dec 27 22:04:59.273002 2025] [:error] [pid 3114:tid 3125] [client 13.70.48.86:7984] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU_ni2JGrIkLOdbPpJi5hwAAAYc"]
[Sat Dec 27 22:04:59.573465 2025] [:error] [pid 32191:tid 32201] [client 13.70.48.86:7894] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU_ni7PNtMgrjVCHIdFDQQAAAAY"]
[Sat Dec 27 22:05:00.013169 2025] [:error] [pid 32191:tid 32205] [client 13.70.48.86:7981] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aU_njLPNtMgrjVCHIdFDQwAAAAo"]
[Sat Dec 27 22:05:00.345785 2025] [:error] [pid 3114:tid 3136] [client 13.70.48.86:8012] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU_njGJGrIkLOdbPpJi5iAAAAZI"]
[Sat Dec 27 22:05:00.760336 2025] [:error] [pid 3114:tid 3130] [client 13.70.48.86:8159] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU_njGJGrIkLOdbPpJi5jAAAAYw"]
[Sat Dec 27 22:05:01.039014 2025] [:error] [pid 3114:tid 3129] [client 13.70.48.86:7890] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU_njWJGrIkLOdbPpJi5jQAAAYs"]
[Sat Dec 27 22:05:01.386621 2025] [:error] [pid 45373:tid 45389] [client 13.70.48.86:13998] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aU_njS7p_wFcbpu46HWRHwAAAU4"]
[Sat Dec 27 22:05:01.654710 2025] [:error] [pid 45373:tid 45391] [client 13.70.48.86:14037] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aU_njS7p_wFcbpu46HWRIQAAAVA"]
[Sat Dec 27 22:05:02.036007 2025] [:error] [pid 31933:tid 31951] [client 13.70.48.86:8116] [client 13.70.48.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aU_njsGr1WIJr39uqaoCJwAAAdA"]
[Sat Dec 27 22:05:02.348590 2025] [:error] [pid 45373:tid 45386] [client 13.70.48.86:7948] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU_nji7p_wFcbpu46HWRJAAAAUs"]
[Sat Dec 27 22:05:02.613656 2025] [:error] [pid 45373:tid 45393] [client 13.70.48.86:8068] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU_nji7p_wFcbpu46HWRJgAAAVI"]
[Sat Dec 27 22:05:02.990349 2025] [:error] [pid 31933:tid 31950] [client 13.70.48.86:8087] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aU_njsGr1WIJr39uqaoCKQAAAc8"]
[Sat Dec 27 22:05:03.276370 2025] [:error] [pid 32192:tid 32223] [client 13.70.48.86:7941] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU_njy_q0VFe066lbk9ocAAAAEA"]
[Sat Dec 27 22:05:03.570443 2025] [:error] [pid 15939:tid 15941] [client 13.70.48.86:8028] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU_nj-Z7qdnFxikanML0zwAAAQA"]
[Sat Dec 27 22:05:03.929451 2025] [:error] [pid 32192:tid 32247] [client 13.70.48.86:8119] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU_njy_q0VFe066lbk9ocQAAAFg"]
[Sat Dec 27 22:05:04.227480 2025] [:error] [pid 15939:tid 15958] [client 13.70.48.86:8051] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aU_nkOZ7qdnFxikanML00AAAARE"]
[Sat Dec 27 22:05:04.520370 2025] [:error] [pid 32192:tid 32245] [client 13.70.48.86:8046] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU_nkC_q0VFe066lbk9ocwAAAFY"]
[Sat Dec 27 22:05:04.758703 2025] [:error] [pid 32192:tid 32224] [client 13.70.48.86:8001] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU_nkC_q0VFe066lbk9odAAAAEE"]
[Sat Dec 27 22:05:05.087115 2025] [:error] [pid 3114:tid 3121] [client 13.70.48.86:8058] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU_nkWJGrIkLOdbPpJi5jwAAAYM"]
[Sat Dec 27 22:05:05.502151 2025] [:error] [pid 32278:tid 32302] [client 13.70.48.86:8104] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aU_nkX-IfCN2Cy9Gccg8LAAAANY"]
[Sat Dec 27 22:05:05.745076 2025] [:error] [pid 32191:tid 32210] [client 13.70.48.86:8037] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aU_nkbPNtMgrjVCHIdFDRwAAAA8"]
[Sat Dec 27 22:05:06.004048 2025] [:error] [pid 32191:tid 32215] [client 13.70.48.86:8031] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aU_nkrPNtMgrjVCHIdFDSAAAABQ"]
[Sat Dec 27 22:05:06.285174 2025] [:error] [pid 32191:tid 32207] [client 13.70.48.86:8016] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aU_nkrPNtMgrjVCHIdFDSwAAAAw"]
[Sat Dec 27 22:05:06.577350 2025] [:error] [pid 32191:tid 32214] [client 13.70.48.86:7947] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aU_nkrPNtMgrjVCHIdFDTAAAABM"]
[Sat Dec 27 22:05:06.885766 2025] [:error] [pid 32278:tid 32295] [client 13.70.48.86:8049] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU_nkn-IfCN2Cy9Gccg8LgAAAM8"]
[Sat Dec 27 22:05:07.147028 2025] [:error] [pid 32278:tid 32300] [client 13.70.48.86:7899] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU_nk3-IfCN2Cy9Gccg8LwAAANQ"]
[Sat Dec 27 22:05:07.412415 2025] [:error] [pid 32278:tid 32303] [client 13.70.48.86:8042] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU_nk3-IfCN2Cy9Gccg8MQAAANc"]
[Sat Dec 27 22:05:07.667851 2025] [:error] [pid 32278:tid 32280] [client 13.70.48.86:7940] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aU_nk3-IfCN2Cy9Gccg8MwAAAMA"]
[Sat Dec 27 22:05:07.935385 2025] [:error] [pid 32191:tid 32213] [client 13.70.48.86:7966] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU_nk7PNtMgrjVCHIdFDTwAAABI"]
[Sat Dec 27 22:05:08.338753 2025] [:error] [pid 31933:tid 31955] [client 13.70.48.86:8032] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU_nlMGr1WIJr39uqaoCKgAAAdQ"]
[Sat Dec 27 22:05:08.614002 2025] [:error] [pid 32192:tid 32225] [client 13.70.48.86:8101] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU_nlC_q0VFe066lbk9ofgAAAEI"]
[Sat Dec 27 22:05:09.008271 2025] [:error] [pid 31933:tid 31943] [client 13.70.48.86:8063] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aU_nlcGr1WIJr39uqaoCKwAAAcg"]
[Sat Dec 27 22:05:09.328378 2025] [:error] [pid 31933:tid 31956] [client 13.70.48.86:7957] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aU_nlcGr1WIJr39uqaoCLAAAAdU"]
[Sat Dec 27 22:05:09.623504 2025] [:error] [pid 31933:tid 31936] [client 13.70.48.86:7949] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aU_nlcGr1WIJr39uqaoCLQAAAcE"]
[Sat Dec 27 22:05:09.995314 2025] [:error] [pid 32192:tid 32242] [client 13.70.48.86:7945] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aU_nlS_q0VFe066lbk9ohgAAAFM"]
[Sat Dec 27 22:05:10.229062 2025] [:error] [pid 45373:tid 45387] [client 13.70.48.86:8022] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aU_nli7p_wFcbpu46HWRKAAAAUw"]
[Sat Dec 27 22:05:10.508320 2025] [:error] [pid 45373:tid 45380] [client 13.70.48.86:7959] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aU_nli7p_wFcbpu46HWRKQAAAUU"]
[Sat Dec 27 22:05:10.991228 2025] [:error] [pid 3114:tid 3126] [client 13.70.48.86:7899] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aU_nlmJGrIkLOdbPpJi5kgAAAYg"]
[Sat Dec 27 22:05:11.257331 2025] [:error] [pid 15939:tid 15942] [client 13.70.48.86:8057] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aU_nl-Z7qdnFxikanML00gAAAQE"]
[Sat Dec 27 22:05:11.512775 2025] [:error] [pid 3114:tid 3123] [client 13.70.48.86:7999] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aU_nl2JGrIkLOdbPpJi5kwAAAYU"]
[Sat Dec 27 22:05:11.748789 2025] [:error] [pid 31933:tid 31938] [client 13.70.48.86:7944] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aU_nl8Gr1WIJr39uqaoCMAAAAcM"]
[Sat Dec 27 22:05:12.189409 2025] [:error] [pid 3114:tid 3138] [client 13.70.48.86:7977] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aU_nmGJGrIkLOdbPpJi5lAAAAZQ"]
[Sat Dec 27 22:05:12.600385 2025] [:error] [pid 3114:tid 3141] [client 13.70.48.86:7964] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aU_nmGJGrIkLOdbPpJi5lQAAAZc"]
[Sat Dec 27 22:05:12.990627 2025] [:error] [pid 45373:tid 45377] [client 13.70.48.86:7985] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aU_nmC7p_wFcbpu46HWRLQAAAUI"]
[Sat Dec 27 22:05:13.263013 2025] [:error] [pid 45373:tid 45389] [client 13.70.48.86:7811] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aU_nmS7p_wFcbpu46HWRLwAAAU4"]
[Sat Dec 27 22:05:13.566063 2025] [:error] [pid 32192:tid 32244] [client 13.70.48.86:7999] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aU_nmS_q0VFe066lbk9omAAAAFU"]
[Sat Dec 27 22:05:13.970541 2025] [:error] [pid 45373:tid 45383] [client 13.70.48.86:14061] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aU_nmS7p_wFcbpu46HWRMQAAAUg"]
[Sat Dec 27 22:05:14.219381 2025] [:error] [pid 45373:tid 45395] [client 13.70.48.86:7977] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aU_nmi7p_wFcbpu46HWRMgAAAVQ"]
[Sat Dec 27 22:05:14.592063 2025] [:error] [pid 45373:tid 45397] [client 13.70.48.86:8061] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU_nmi7p_wFcbpu46HWRNgAAAVY"]
[Sat Dec 27 22:05:14.828397 2025] [:error] [pid 45373:tid 45375] [client 13.70.48.86:7901] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU_nmi7p_wFcbpu46HWRNwAAAUA"]
[Sat Dec 27 22:05:15.182915 2025] [:error] [pid 45373:tid 45394] [client 13.70.48.86:7951] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU_nmy7p_wFcbpu46HWROAAAAVM"]
[Sat Dec 27 22:05:15.450886 2025] [:error] [pid 15939:tid 15955] [client 13.70.48.86:8039] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aU_nm-Z7qdnFxikanML01QAAAQ4"]
[Sat Dec 27 22:05:15.742429 2025] [:error] [pid 3114:tid 3137] [client 13.70.48.86:8019] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU_nm2JGrIkLOdbPpJi5lwAAAZM"]
[Sat Dec 27 22:05:16.139450 2025] [:error] [pid 3114:tid 3125] [client 13.70.48.86:8102] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU_nnGJGrIkLOdbPpJi5mAAAAYc"]
[Sat Dec 27 22:05:16.394279 2025] [:error] [pid 15939:tid 15961] [client 13.70.48.86:8034] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU_nnOZ7qdnFxikanML01gAAARQ"]
[Sat Dec 27 22:05:16.685795 2025] [:error] [pid 15939:tid 15948] [client 13.70.48.86:8090] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aU_nnOZ7qdnFxikanML01wAAAQc"]
[Sat Dec 27 22:05:17.042584 2025] [:error] [pid 15939:tid 15952] [client 13.70.48.86:8029] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU_nneZ7qdnFxikanML02gAAAQs"]
[Sat Dec 27 22:05:17.393499 2025] [:error] [pid 15939:tid 15960] [client 13.70.48.86:8059] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU_nneZ7qdnFxikanML02wAAARM"]
[Sat Dec 27 22:05:17.641877 2025] [:error] [pid 15939:tid 15959] [client 13.70.48.86:7938] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU_nneZ7qdnFxikanML03AAAARI"]
[Sat Dec 27 22:05:17.927659 2025] [:error] [pid 32191:tid 32204] [client 13.70.48.86:7989] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aU_nnbPNtMgrjVCHIdFDWAAAAAk"]
[Sat Dec 27 22:05:18.310497 2025] [:error] [pid 15939:tid 15946] [client 13.70.48.86:7983] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU_nnuZ7qdnFxikanML03wAAAQU"]
[Sat Dec 27 22:05:18.745784 2025] [:error] [pid 32191:tid 32195] [client 13.70.48.86:7990] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU_nnrPNtMgrjVCHIdFDWgAAAAA"]
[Sat Dec 27 22:05:18.993711 2025] [:error] [pid 32278:tid 32297] [client 13.70.48.86:8029] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU_nnn-IfCN2Cy9Gccg8NwAAANE"]
[Sat Dec 27 22:05:19.304357 2025] [:error] [pid 32191:tid 32198] [client 13.70.48.86:7993] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aU_nn7PNtMgrjVCHIdFDWwAAAAM"]
[Sat Dec 27 22:05:19.636247 2025] [:error] [pid 32191:tid 32201] [client 13.70.48.86:8047] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU_nn7PNtMgrjVCHIdFDXAAAAAY"]
[Sat Dec 27 22:05:19.955212 2025] [:error] [pid 45373:tid 45377] [client 13.70.48.86:7939] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU_nny7p_wFcbpu46HWRPAAAAUI"]
[Sat Dec 27 22:05:20.225255 2025] [:error] [pid 45373:tid 45390] [client 13.70.48.86:7892] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU_noC7p_wFcbpu46HWRPgAAAU8"]
[Sat Dec 27 22:05:20.527318 2025] [:error] [pid 45373:tid 45378] [client 13.70.48.86:7873] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aU_noC7p_wFcbpu46HWRQAAAAUM"]
[Sat Dec 27 22:05:20.849341 2025] [:error] [pid 45373:tid 45391] [client 13.70.48.86:7960] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aU_noC7p_wFcbpu46HWRQQAAAVA"]
[Sat Dec 27 22:05:21.138760 2025] [:error] [pid 32191:tid 32211] [client 13.70.48.86:8127] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aU_nobPNtMgrjVCHIdFDXQAAABA"]
[Sat Dec 27 22:05:21.497033 2025] [:error] [pid 32191:tid 32203] [client 13.70.48.86:7969] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aU_nobPNtMgrjVCHIdFDXwAAAAg"]
[Sat Dec 27 22:05:21.799043 2025] [:error] [pid 32191:tid 32212] [client 13.70.48.86:7914] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aU_nobPNtMgrjVCHIdFDYAAAABE"]
[Sat Dec 27 22:05:22.200864 2025] [:error] [pid 31933:tid 31949] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Sat Dec 27 22:05:22.341110 2025] [:error] [pid 31933:tid 31951] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Sat Dec 27 22:05:22.474975 2025] [:error] [pid 31933:tid 31935] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Dec 27 22:05:22.594518 2025] [:error] [pid 31933:tid 31953] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sat Dec 27 22:05:22.716096 2025] [:error] [pid 31933:tid 31950] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Sat Dec 27 22:05:22.874332 2025] [:error] [pid 31933:tid 31944] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sat Dec 27 22:05:23.133075 2025] [:error] [pid 31933:tid 31946] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Sat Dec 27 22:05:23.260776 2025] [:error] [pid 31933:tid 31955] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Sat Dec 27 22:05:23.380255 2025] [:error] [pid 31933:tid 31943] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Dec 27 22:05:23.523857 2025] [:error] [pid 31933:tid 31956] [client 13.70.48.86:7996] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Sat Dec 27 22:05:23.641098 2025] [:error] [pid 31933:tid 31936] [client 13.70.48.86:7996] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU_no8Gr1WIJr39uqaoCPwAAAcE"]
[Sat Dec 27 22:05:23.909236 2025] [:error] [pid 32193:tid 32255] [client 13.70.48.86:7986] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU_noxgw0eCOc2qYqaK9ewAAAIU"]
[Sat Dec 27 22:05:24.181450 2025] [:error] [pid 3114:tid 3129] [client 13.70.48.86:8127] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU_npGJGrIkLOdbPpJi5nQAAAYs"]
[Sat Dec 27 22:05:24.539741 2025] [:error] [pid 32193:tid 32264] [client 13.70.48.86:7881] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aU_npBgw0eCOc2qYqaK9fQAAAI4"]
[Sat Dec 27 22:05:24.908566 2025] [:error] [pid 32193:tid 32273] [client 13.70.48.86:7933] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU_npBgw0eCOc2qYqaK9fgAAAJc"]
[Sat Dec 27 22:05:25.185064 2025] [:error] [pid 32278:tid 32302] [client 13.70.48.86:8043] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU_npX-IfCN2Cy9Gccg8OwAAANY"]
[Sat Dec 27 22:05:25.681733 2025] [:error] [pid 3114:tid 3119] [client 13.70.48.86:7910] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU_npWJGrIkLOdbPpJi5ngAAAYE"]
[Sat Dec 27 22:05:25.967396 2025] [:error] [pid 32278:tid 32291] [client 13.70.48.86:7972] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aU_npX-IfCN2Cy9Gccg8PgAAAMs"]
[Sat Dec 27 22:05:26.280811 2025] [:error] [pid 32278:tid 32303] [client 13.70.48.86:7978] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aU_npn-IfCN2Cy9Gccg8PwAAANc"]
[Sat Dec 27 22:05:26.530171 2025] [:error] [pid 32192:tid 32235] [client 13.70.48.86:7887] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aU_npi_q0VFe066lbk9oqgAAAEw"]
[Sat Dec 27 22:05:26.950626 2025] [:error] [pid 32278:tid 32289] [client 13.70.48.86:7893] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aU_npn-IfCN2Cy9Gccg8QAAAAMk"]
[Sat Dec 27 22:05:27.270147 2025] [:error] [pid 3114:tid 3133] [client 13.70.48.86:7995] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aU_np2JGrIkLOdbPpJi5oQAAAY8"]
[Sat Dec 27 22:05:27.689294 2025] [:error] [pid 3114:tid 3126] [client 13.70.48.86:7872] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aU_np2JGrIkLOdbPpJi5ogAAAYg"]
[Sat Dec 27 22:05:27.983461 2025] [:error] [pid 32278:tid 32288] [client 13.70.48.86:7982] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aU_np3-IfCN2Cy9Gccg8QgAAAMg"]
[Sat Dec 27 22:05:28.516157 2025] [:error] [pid 32278:tid 32298] [client 13.70.48.86:7808] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aU_nqH-IfCN2Cy9Gccg8RgAAANI"]
[Sat Dec 27 22:05:28.767524 2025] [:error] [pid 45373:tid 45375] [client 13.70.48.86:8060] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aU_nqC7p_wFcbpu46HWRRQAAAUA"]
[Sat Dec 27 22:05:29.012581 2025] [:error] [pid 32192:tid 32224] [client 13.70.48.86:8106] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nqS_q0VFe066lbk9orAAAAEE"]
[Sat Dec 27 22:05:29.383117 2025] [:error] [pid 32278:tid 32302] [client 13.70.48.86:7888] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nqX-IfCN2Cy9Gccg8TAAAANY"]
[Sat Dec 27 22:05:29.707079 2025] [:error] [pid 32192:tid 32239] [client 13.70.48.86:7900] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nqS_q0VFe066lbk9orQAAAFA"]
[Sat Dec 27 22:05:30.026137 2025] [:error] [pid 32191:tid 32219] [client 13.70.48.86:7994] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aU_nqrPNtMgrjVCHIdFDZAAAABg"]
[Sat Dec 27 22:05:30.310947 2025] [:error] [pid 31933:tid 31957] [client 13.70.48.86:7884] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aU_nqsGr1WIJr39uqaoCQQAAAdY"]
[Sat Dec 27 22:05:30.718282 2025] [:error] [pid 31933:tid 31937] [client 13.70.48.86:7924] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aU_nqsGr1WIJr39uqaoCQgAAAcI"]
[Sat Dec 27 22:05:30.986492 2025] [:error] [pid 15939:tid 15944] [client 13.70.48.86:8053] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aU_nquZ7qdnFxikanML04wAAAQM"]
[Sat Dec 27 22:05:31.265278 2025] [:error] [pid 32278:tid 32288] [client 13.70.48.86:7891] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aU_nq3-IfCN2Cy9Gccg8TwAAAMg"]
[Sat Dec 27 22:05:31.573843 2025] [:error] [pid 15939:tid 15957] [client 13.70.48.86:7925] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU_nq-Z7qdnFxikanML05AAAARA"]
[Sat Dec 27 22:05:32.058275 2025] [:error] [pid 32193:tid 32261] [client 13.70.48.86:7979] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU_nrBgw0eCOc2qYqaK9fwAAAIs"]
[Sat Dec 27 22:05:32.362360 2025] [:error] [pid 32191:tid 32206] [client 13.70.48.86:7913] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU_nrLPNtMgrjVCHIdFDaAAAAAs"]
[Sat Dec 27 22:05:32.697322 2025] [:error] [pid 3114:tid 3135] [client 13.70.48.86:8103] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aU_nrGJGrIkLOdbPpJi5qwAAAZE"]
[Sat Dec 27 22:05:33.005984 2025] [:error] [pid 15939:tid 15955] [client 13.70.48.86:7975] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aU_nreZ7qdnFxikanML05gAAAQ4"]
[Sat Dec 27 22:05:33.359004 2025] [:error] [pid 32191:tid 32216] [client 13.70.48.86:7809] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aU_nrbPNtMgrjVCHIdFDaQAAABU"]
[Sat Dec 27 22:05:33.664300 2025] [:error] [pid 15939:tid 15952] [client 13.70.48.86:8094] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aU_nreZ7qdnFxikanML05wAAAQs"]
[Sat Dec 27 22:05:34.017968 2025] [:error] [pid 15939:tid 15948] [client 13.70.48.86:7932] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aU_nruZ7qdnFxikanML06QAAAQc"]
[Sat Dec 27 22:05:34.264387 2025] [:error] [pid 15939:tid 15954] [client 13.70.48.86:7991] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU_nruZ7qdnFxikanML06wAAAQ0"]
[Sat Dec 27 22:05:34.585240 2025] [:error] [pid 32191:tid 32204] [client 13.70.48.86:7885] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU_nrrPNtMgrjVCHIdFDagAAAAk"]
[Sat Dec 27 22:05:34.884905 2025] [:error] [pid 45373:tid 45394] [client 13.70.48.86:7980] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU_nri7p_wFcbpu46HWRRgAAAVM"]
[Sat Dec 27 22:05:35.279241 2025] [:error] [pid 45373:tid 45386] [client 13.70.48.86:7818] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aU_nry7p_wFcbpu46HWRRwAAAUs"]
[Sat Dec 27 22:05:35.545828 2025] [:error] [pid 45373:tid 45398] [client 13.70.48.86:7952] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU_nry7p_wFcbpu46HWRSQAAAVc"]
[Sat Dec 27 22:05:35.817773 2025] [:error] [pid 45373:tid 45387] [client 13.70.48.86:7931] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU_nry7p_wFcbpu46HWRSgAAAUw"]
[Sat Dec 27 22:05:36.243435 2025] [:error] [pid 45373:tid 45380] [client 13.70.48.86:7923] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU_nsC7p_wFcbpu46HWRSwAAAUU"]
[Sat Dec 27 22:05:36.516140 2025] [:error] [pid 15939:tid 15941] [client 13.70.48.86:7879] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aU_nsOZ7qdnFxikanML07gAAAQA"]
[Sat Dec 27 22:05:36.864289 2025] [:error] [pid 15939:tid 15958] [client 13.70.48.86:7909] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aU_nsOZ7qdnFxikanML08AAAARE"]
[Sat Dec 27 22:05:37.356227 2025] [:error] [pid 15939:tid 15942] [client 13.70.48.86:7755] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aU_nseZ7qdnFxikanML08gAAAQE"]
[Sat Dec 27 22:05:37.665534 2025] [:error] [pid 45373:tid 45379] [client 13.70.48.86:7895] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aU_nsS7p_wFcbpu46HWRTAAAAUQ"]
[Sat Dec 27 22:05:38.579036 2025] [:error] [pid 15939:tid 15962] [client 13.70.48.86:7691] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aU_nsuZ7qdnFxikanML09AAAARU"]
[Sat Dec 27 22:05:39.875126 2025] [:error] [pid 45373:tid 45378] [client 13.70.48.86:8062] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aU_nsy7p_wFcbpu46HWRUQAAAUM"]
[Sat Dec 27 22:05:40.783614 2025] [:error] [pid 32191:tid 32205] [client 13.70.48.86:7783] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aU_ntLPNtMgrjVCHIdFDbwAAAAo"]
[Sat Dec 27 22:05:41.082802 2025] [:error] [pid 45373:tid 45384] [client 13.70.48.86:7930] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aU_ntS7p_wFcbpu46HWRUwAAAUk"]
[Sat Dec 27 22:05:41.445964 2025] [:error] [pid 3114:tid 3128] [client 13.70.48.86:7998] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aU_ntWJGrIkLOdbPpJi5sQAAAYo"]
[Sat Dec 27 22:05:41.984136 2025] [:error] [pid 3114:tid 3125] [client 13.70.48.86:7889] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aU_ntWJGrIkLOdbPpJi5sgAAAYc"]
[Sat Dec 27 22:05:42.438682 2025] [:error] [pid 3114:tid 3139] [client 13.70.48.86:7874] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aU_ntmJGrIkLOdbPpJi5swAAAZU"]
[Sat Dec 27 22:05:42.793004 2025] [:error] [pid 31933:tid 31940] [client 13.70.48.86:7911] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aU_ntsGr1WIJr39uqaoCSQAAAcU"]
[Sat Dec 27 22:05:43.093891 2025] [:error] [pid 45373:tid 45382] [client 13.70.48.86:7904] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aU_nty7p_wFcbpu46HWRVAAAAUc"]
[Sat Dec 27 22:05:43.599990 2025] [:error] [pid 32278:tid 32288] [client 13.70.48.86:7929] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aU_nt3-IfCN2Cy9Gccg8WgAAAMg"]
[Sat Dec 27 22:05:43.847321 2025] [:error] [pid 15939:tid 15964] [client 13.70.48.86:7857] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aU_nt-Z7qdnFxikanML09gAAARc"]
[Sat Dec 27 22:05:44.296538 2025] [:error] [pid 31933:tid 31955] [client 13.70.48.86:7813] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aU_nuMGr1WIJr39uqaoCSgAAAdQ"]
[Sat Dec 27 22:05:44.585400 2025] [:error] [pid 3114:tid 3136] [client 13.70.48.86:7955] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aU_nuGJGrIkLOdbPpJi5tQAAAZI"]
[Sat Dec 27 22:05:44.851676 2025] [:error] [pid 45373:tid 45393] [client 13.70.48.86:8040] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aU_nuC7p_wFcbpu46HWRVQAAAVI"]
[Sat Dec 27 22:05:45.154599 2025] [:error] [pid 32191:tid 32217] [client 13.70.48.86:7907] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aU_nubPNtMgrjVCHIdFDcwAAABY"]
[Sat Dec 27 22:05:45.474030 2025] [:error] [pid 3114:tid 3140] [client 13.70.48.86:7842] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aU_nuWJGrIkLOdbPpJi5tgAAAZY"]
[Sat Dec 27 22:05:45.914655 2025] [:error] [pid 31933:tid 31956] [client 13.70.48.86:7956] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aU_nucGr1WIJr39uqaoCSwAAAdU"]
[Sat Dec 27 22:05:46.313965 2025] [:error] [pid 32191:tid 32219] [client 13.70.48.86:7812] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU_nurPNtMgrjVCHIdFDdAAAABg"]
[Sat Dec 27 22:05:46.601682 2025] [:error] [pid 31933:tid 31947] [client 13.70.48.86:7912] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU_nusGr1WIJr39uqaoCTgAAAcw"]
[Sat Dec 27 22:05:46.987084 2025] [:error] [pid 31933:tid 31937] [client 13.70.48.86:7825] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU_nusGr1WIJr39uqaoCTwAAAcI"]
[Sat Dec 27 22:05:47.502564 2025] [:error] [pid 31933:tid 31939] [client 13.70.48.86:7896] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aU_nu8Gr1WIJr39uqaoCUQAAAcQ"]
[Sat Dec 27 22:05:48.075876 2025] [:error] [pid 32193:tid 32258] [client 13.70.48.86:7971] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU_nvBgw0eCOc2qYqaK9hQAAAIg"]
[Sat Dec 27 22:05:48.534150 2025] [:error] [pid 32193:tid 32253] [client 13.70.48.86:7878] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU_nvBgw0eCOc2qYqaK9hwAAAIM"]
[Sat Dec 27 22:05:49.020836 2025] [:error] [pid 31933:tid 31945] [client 13.70.48.86:7954] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU_nvcGr1WIJr39uqaoCVAAAAco"]
[Sat Dec 27 22:05:50.021318 2025] [:error] [pid 3114:tid 3135] [client 13.70.48.86:8095] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aU_nvmJGrIkLOdbPpJi5ugAAAZE"]
[Sat Dec 27 22:05:50.327438 2025] [:error] [pid 32278:tid 32290] [client 13.70.48.86:7833] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aU_nvn-IfCN2Cy9Gccg8XwAAAMo"]
[Sat Dec 27 22:05:50.644704 2025] [:error] [pid 32192:tid 32243] [client 13.70.48.86:7854] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aU_nvi_q0VFe066lbk9osgAAAFQ"]
[Sat Dec 27 22:05:51.107285 2025] [:error] [pid 32191:tid 32210] [client 13.70.48.86:7919] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aU_nv7PNtMgrjVCHIdFDdwAAAA8"]
[Sat Dec 27 22:05:51.444075 2025] [:error] [pid 45373:tid 45395] [client 13.70.48.86:7828] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aU_nvy7p_wFcbpu46HWRZgAAAVQ"]
[Sat Dec 27 22:05:52.063811 2025] [:error] [pid 32191:tid 32204] [client 13.70.48.86:7846] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU_nwLPNtMgrjVCHIdFDeAAAAAk"]
[Sat Dec 27 22:05:52.657394 2025] [:error] [pid 32192:tid 32237] [client 13.70.48.86:8044] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU_nwC_q0VFe066lbk9oswAAAE4"]
[Sat Dec 27 22:05:52.992111 2025] [:error] [pid 31933:tid 31944] [client 13.70.48.86:7822] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU_nwMGr1WIJr39uqaoCWAAAAck"]
[Sat Dec 27 22:05:53.365777 2025] [:error] [pid 32191:tid 32213] [client 13.70.48.86:7786] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aU_nwbPNtMgrjVCHIdFDegAAABI"]
[Sat Dec 27 22:05:53.810339 2025] [:error] [pid 31933:tid 31943] [client 13.70.48.86:7908] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU_nwcGr1WIJr39uqaoCWgAAAcg"]
[Sat Dec 27 22:05:54.071493 2025] [:error] [pid 3114:tid 3118] [client 13.70.48.86:7997] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU_nwmJGrIkLOdbPpJi5vAAAAYA"]
[Sat Dec 27 22:05:54.559463 2025] [:error] [pid 3114:tid 3120] [client 13.70.48.86:7848] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU_nwmJGrIkLOdbPpJi5vQAAAYI"]
[Sat Dec 27 22:05:55.047777 2025] [:error] [pid 32278:tid 32291] [client 13.70.48.86:7877] [client 13.70.48.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aU_nw3-IfCN2Cy9Gccg8YwAAAMs"]
[Sun Dec 28 03:42:13.959213 2025] [:error] [pid 64137:tid 64177] [client 177.245.229.174:1095] [client 177.245.229.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aVA2leqo3j9PF2he08wFDgAAABQ"]
[Sun Dec 28 03:42:15.222875 2025] [:error] [pid 64137:tid 64176] [client 170.246.208.121:59382] [client 170.246.208.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aVA2l-qo3j9PF2he08wFEAAAABM"]
[Sun Dec 28 05:38:15.199683 2025] [:error] [pid 29388:tid 29408] [client 144.172.104.100:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/unzipper.php
[Sun Dec 28 07:01:30.450534 2025] [:error] [pid 42292:tid 42313] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.bing.com/
[Sun Dec 28 07:01:30.589681 2025] [:error] [pid 42292:tid 42296] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php, referer: https://www.yahoo.com/
[Sun Dec 28 07:01:30.723166 2025] [:error] [pid 42292:tid 42299] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php, referer: https://www.google.fr/
[Sun Dec 28 07:01:30.869887 2025] [:error] [pid 42292:tid 42315] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.de/
[Sun Dec 28 07:01:31.005161 2025] [:error] [pid 42292:tid 42304] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.bing.com/
[Sun Dec 28 07:01:31.141279 2025] [:error] [pid 42292:tid 42300] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.de/
[Sun Dec 28 07:01:31.439485 2025] [:error] [pid 42292:tid 42312] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.google.co.uk/
[Sun Dec 28 07:01:31.592239 2025] [:error] [pid 42292:tid 42311] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php, referer: https://duckduckgo.com/
[Sun Dec 28 07:01:31.738924 2025] [:error] [pid 42292:tid 42303] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.bing.com/
[Sun Dec 28 07:01:31.890679 2025] [:error] [pid 42292:tid 42319] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php, referer: https://www.bing.com/
[Sun Dec 28 07:01:32.209686 2025] [:error] [pid 42292:tid 42298] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php, referer: https://duckduckgo.com/
[Sun Dec 28 07:01:32.352797 2025] [:error] [pid 42292:tid 42309] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php, referer: https://www.google.co.uk/
[Sun Dec 28 07:01:32.510125 2025] [:error] [pid 42292:tid 42302] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.bing.com/
[Sun Dec 28 07:01:32.648319 2025] [:error] [pid 42292:tid 42306] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.com/
[Sun Dec 28 07:01:32.785357 2025] [:error] [pid 42292:tid 42297] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php, referer: https://www.google.com/
[Sun Dec 28 07:01:32.919617 2025] [:error] [pid 42292:tid 42313] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/htaccess.php, referer: https://duckduckgo.com/
[Sun Dec 28 07:01:33.348692 2025] [:error] [pid 42292:tid 42299] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.com/
[Sun Dec 28 07:01:33.499929 2025] [:error] [pid 42292:tid 42315] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php, referer: https://www.bing.com/
[Sun Dec 28 07:01:33.645420 2025] [:error] [pid 42292:tid 42304] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php, referer: https://www.yahoo.com/
[Sun Dec 28 07:01:37.234438 2025] [:error] [pid 42292:tid 42307] [client 40.83.101.78:57022] [client 40.83.101.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.83.101.78, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aVBlUZyOrM_vaFx1osbc8QAAAAs"], referer: https://www.google.fr/
[Sun Dec 28 07:01:38.211173 2025] [:error] [pid 42292:tid 42310] [client 40.83.101.78:57022] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fclass.php, referer: https://www.google.de/
[Sun Dec 28 07:01:38.571755 2025] [:error] [pid 42292:tid 42311] [client 40.83.101.78:57022] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aVBlUpyOrM_vaFx1osbc_gAAAA8"], referer: https://www.bing.com/
[Sun Dec 28 07:01:38.806029 2025] [:error] [pid 29388:tid 29400] [client 40.83.101.78:13508] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/alfa-rex.php"] [unique_id "aVBlUtoLv2L2zI_SpdVn1wAAAUQ"], referer: https://duckduckgo.com/
[Sun Dec 28 07:01:39.161143 2025] [:error] [pid 29437:tid 29472] [client 40.83.101.78:20699] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aVBlUxhDotAbVk6pZLcwOgAAAcY"], referer: https://www.google.com/
[Sun Dec 28 07:01:39.520089 2025] [:error] [pid 42292:tid 42308] [client 40.83.101.78:37847] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aVBlU5yOrM_vaFx1osbdAQAAAAw"], referer: https://duckduckgo.com/
[Sun Dec 28 07:01:39.753815 2025] [:error] [pid 29437:tid 29475] [client 40.83.101.78:30010] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aVBlUxhDotAbVk6pZLcwPAAAAck"], referer: https://duckduckgo.com/
[Sun Dec 28 07:01:39.992275 2025] [:error] [pid 29437:tid 29490] [client 40.83.101.78:20980] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aVBlUxhDotAbVk6pZLcwPQAAAdg"], referer: https://www.google.com/
[Sun Dec 28 07:01:40.478395 2025] [:error] [pid 42294:tid 42372] [client 40.83.101.78:29508] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aVBlVNTE5kYcYCOzl9FUiAAAAJY"], referer: https://www.google.de/
[Sun Dec 28 07:01:40.838643 2025] [:error] [pid 29436:tid 29457] [client 40.83.101.78:21328] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aVBlVLchzOOtNL9VPNJOrAAAAZI"], referer: https://www.google.de/
[Sun Dec 28 07:01:41.079038 2025] [:error] [pid 42293:tid 42329] [client 40.83.101.78:20962] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aVBlVcvc9B-5cwN385I4YgAAAEY"], referer: https://duckduckgo.com/
[Sun Dec 28 07:01:41.334274 2025] [:error] [pid 29388:tid 29408] [client 40.83.101.78:30010] [client 40.83.101.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aVBlVdoLv2L2zI_SpdVn2QAAAUw"], referer: https://www.google.de/
[Sun Dec 28 07:01:41.792382 2025] [:error] [pid 42292:tid 42306] [client 40.83.101.78:13739] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php, referer: https://www.google.co.uk/
[Sun Dec 28 07:01:41.919342 2025] [:error] [pid 42292:tid 42297] [client 40.83.101.78:13739] [client 40.83.101.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.83.101.78, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVBlVZyOrM_vaFx1osbdBQAAAAE"], referer: https://www.google.fr/
[Sun Dec 28 07:01:41.922676 2025] [:error] [pid 42292:tid 42297] [client 40.83.101.78:13739] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://www.google.fr/
[Sun Dec 28 12:05:58.943008 2025] [:error] [pid 29436:tid 29460] [client 103.198.96.179:56846] [client 103.198.96.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.198.96.179, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVCsprchzOOtNL9VPNJ5jgAAAZU"]
[Sun Dec 28 12:05:58.947501 2025] [:error] [pid 29436:tid 29460] [client 103.198.96.179:56846] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Dec 28 19:09:21.327709 2025] [:error] [pid 29388:tid 29412] [client 152.42.193.224:60198] [client 152.42.193.224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aVEP4doLv2L2zI_SpdXTiwAAAVA"]
[Sun Dec 28 21:19:50.791920 2025] [:error] [pid 29437:tid 29479] [client 34.75.131.7:59957] [client 34.75.131.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.75.131.7, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVEudhhDotAbVk6pZLfb0wAAAc0"]
[Sun Dec 28 21:19:50.795312 2025] [:error] [pid 29437:tid 29479] [client 34.75.131.7:59957] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Dec 28 21:19:53.401683 2025] [:error] [pid 29437:tid 29488] [client 34.75.131.7:59957] [client 34.75.131.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aVEueRhDotAbVk6pZLfb3gAAAdY"]
[Sun Dec 28 21:19:54.031739 2025] [:error] [pid 43789:tid 43810] [client 34.75.131.7:52545] [client 34.75.131.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aVEuega-tUppni4CcCZJUQAAARM"]
[Sun Dec 28 21:19:54.533790 2025] [:error] [pid 29388:tid 29402] [client 34.75.131.7:52563] [client 34.75.131.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aVEuetoLv2L2zI_SpdX2_QAAAUY"]
[Sun Dec 28 21:19:54.998325 2025] [:error] [pid 29388:tid 29397] [client 34.75.131.7:53380] [client 34.75.131.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aVEuetoLv2L2zI_SpdX3AAAAAUE"]
[Sun Dec 28 21:19:55.453493 2025] [:error] [pid 42378:tid 42389] [client 34.75.131.7:62380] [client 34.75.131.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aVEuezgtcN-KHAjWrX8vCAAAAMk"]
[Sun Dec 28 21:19:55.928576 2025] [:error] [pid 42292:tid 42300] [client 34.75.131.7:51480] [client 34.75.131.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aVEue5yOrM_vaFx1osZeQwAAAAQ"]
[Sun Dec 28 21:19:56.356741 2025] [:error] [pid 29388:tid 29414] [client 34.75.131.7:61120] [client 34.75.131.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aVEufNoLv2L2zI_SpdX3BQAAAVI"]
[Mon Dec 29 01:05:49.147815 2025] [:error] [pid 46536:tid 46558] [client 185.177.72.13:12230] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aVFjbd72_BregW2fmRb8lAAAABI"]
[Mon Dec 29 01:05:50.665628 2025] [:error] [pid 62317:tid 62327] [client 185.177.72.13:12238] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aVFjbjrMrOtzJhli_KVuhgAAAQg"]
[Mon Dec 29 01:05:52.123325 2025] [:error] [pid 62278:tid 62288] [client 185.177.72.13:12246] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aVFjcLXlQgY5k1TX4Y1FewAAAEg"]
[Mon Dec 29 01:05:53.351620 2025] [:error] [pid 46622:tid 46639] [client 185.177.72.13:12258] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.txt"] [unique_id "aVFjcSZDJSVZN5_8UUN5OgAAAU8"]
[Mon Dec 29 01:05:54.666502 2025] [:error] [pid 8076:tid 8097] [client 185.177.72.13:12266] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.example"] [unique_id "aVFjcumk6HKGnPEdvsJ59wAAAhM"]
[Mon Dec 29 01:05:55.861288 2025] [:error] [pid 8229:tid 8301] [client 185.177.72.13:12276] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.log"] [unique_id "aVFjcyk6YVu4f2yMJ5uZbwAAAlY"]
[Mon Dec 29 01:05:57.001019 2025] [:error] [pid 62278:tid 62285] [client 185.177.72.13:12288] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/tmp/.env"] [unique_id "aVFjdbXlQgY5k1TX4Y1FfQAAAEU"]
[Mon Dec 29 01:05:58.329103 2025] [:error] [pid 8229:tid 8302] [client 185.177.72.13:12292] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev.local"] [unique_id "aVFjdik6YVu4f2yMJ5uZcQAAAlc"]
[Mon Dec 29 01:05:59.523913 2025] [:error] [pid 8804:tid 8819] [client 185.177.72.13:19608] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aVFjdzVoh1fD5_MoMv3lxgAAAsw"]
[Mon Dec 29 01:06:00.986438 2025] [:error] [pid 46536:tid 46554] [client 185.177.72.13:19624] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "aVFjeN72_BregW2fmRb8lgAAAA4"]
[Mon Dec 29 01:06:02.482191 2025] [:error] [pid 62278:tid 62304] [client 185.177.72.13:19640] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aVFjerXlQgY5k1TX4Y1FfwAAAFg"]
[Mon Dec 29 01:06:03.947839 2025] [:error] [pid 62317:tid 62322] [client 185.177.72.13:19650] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aVFjezrMrOtzJhli_KVujgAAAQM"]
[Mon Dec 29 01:06:05.384173 2025] [:error] [pid 62317:tid 62340] [client 185.177.72.13:19662] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "aVFjfTrMrOtzJhli_KVukQAAARU"]
[Mon Dec 29 01:06:10.958601 2025] [:error] [pid 8076:tid 8091] [client 185.177.72.13:21216] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aVFjgumk6HKGnPEdvsJ5_QAAAg0"]
[Mon Dec 29 01:06:12.280210 2025] [:error] [pid 62317:tid 62336] [client 185.177.72.13:21218] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aVFjhDrMrOtzJhli_KVuoAAAARE"]
[Mon Dec 29 01:06:13.461535 2025] [:error] [pid 62317:tid 62323] [client 185.177.72.13:21222] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env"] [unique_id "aVFjhTrMrOtzJhli_KVuogAAAQQ"]
[Mon Dec 29 01:06:14.685563 2025] [:error] [pid 46537:tid 46588] [client 185.177.72.13:21226] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/storage/.env"] [unique_id "aVFjhhIwkdHOre8AuwAuQgAAAJQ"]
[Tue Dec 30 02:42:03.974679 2025] [:error] [pid 61009:tid 61032] [client 208.115.224.163:52249] [client 208.115.224.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.224.163, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVLLexC7RSyMuwnpVqVCcgAAAdU"]
[Tue Dec 30 02:42:03.978453 2025] [:error] [pid 61009:tid 61032] [client 208.115.224.163:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Dec 30 07:03:03.441102 2025] [:error] [pid 21424:tid 21443] [client 4.197.92.48:28640] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Dec 30 07:03:03.513353 2025] [:error] [pid 21424:tid 21445] [client 4.197.92.48:28640] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Dec 30 07:03:03.941595 2025] [:error] [pid 21424:tid 21448] [client 4.197.92.48:28640] File does not exist: /usr/local/apache/htdocs/suspended-page/home.php
[Tue Dec 30 07:03:03.961979 2025] [:error] [pid 21424:tid 21434] [client 4.197.92.48:28640] [client 4.197.92.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aVMIp_6vZjHcdZm1ozDJJAAAAQg"]
[Tue Dec 30 07:03:04.005901 2025] [:error] [pid 21424:tid 21429] [client 4.197.92.48:28666] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Dec 30 07:03:04.049373 2025] [:error] [pid 21424:tid 21435] [client 4.197.92.48:28666] File does not exist: /usr/local/apache/htdocs/suspended-page/aksinet.php
[Tue Dec 30 07:03:04.074107 2025] [:error] [pid 21424:tid 21447] [client 4.197.92.48:28666] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Tue Dec 30 07:03:04.099436 2025] [:error] [pid 21424:tid 21432] [client 4.197.92.48:28666] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Dec 30 07:03:04.141806 2025] [:error] [pid 21424:tid 21439] [client 4.197.92.48:28666] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wb0f6val/autoload_classmap.php"] [unique_id "aVMIqP6vZjHcdZm1ozDJKwAAAQ0"]
[Tue Dec 30 07:03:04.177695 2025] [:error] [pid 55724:tid 55791] [client 4.197.92.48:28662] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wb0f6val/autoload_classmap.php"] [unique_id "aVMIqP2xaJh1srfKTGR1cwAAAIY"]
[Tue Dec 30 07:03:04.210626 2025] [:error] [pid 55724:tid 55797] [client 4.197.92.48:28641] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wb0f6val/autoload_classmap.php"] [unique_id "aVMIqP2xaJh1srfKTGR1dQAAAIw"]
[Tue Dec 30 07:03:04.247957 2025] [:error] [pid 55827:tid 55847] [client 4.197.92.48:28545] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wb0f6val/autoload_classmap.php"] [unique_id "aVMIqDGIC-EorhVIeG_tFQAAANI"]
[Tue Dec 30 12:24:35.012419 2025] [:error] [pid 28954:tid 28974] [client 117.212.41.148:1908] [client 117.212.41.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.212.41.148, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVNUA6RZgqk7uuu8M0zXpwAAABI"]
[Tue Dec 30 12:24:35.019965 2025] [:error] [pid 28954:tid 28974] [client 117.212.41.148:1908] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 30 13:06:02.258201 2025] [:error] [pid 28826:tid 28914] [client 103.77.107.57:55210] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aVNduvOyQggePm1Ed9tGagAAAQg"]
[Tue Dec 30 13:09:03.079469 2025] [:error] [pid 38777:tid 38800] [client 139.59.0.127:61349] [client 139.59.0.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.59.0.127, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVNeb2Ln9GPxJXPhnHauawAAAFQ"]
[Tue Dec 30 13:09:03.083449 2025] [:error] [pid 38777:tid 38800] [client 139.59.0.127:61349] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Dec 30 15:28:45.412823 2025] [:error] [pid 47553:tid 47569] [client 194.26.192.112:63294] [client 194.26.192.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.26.192.112, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVN_Lbvhy9HerwSnwIS6swAAAY4"]
[Tue Dec 30 15:28:45.419216 2025] [:error] [pid 47553:tid 47569] [client 194.26.192.112:63294] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 30 15:35:02.262179 2025] [:error] [pid 28825:tid 28879] [client 103.65.236.149:65445] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aVOApj6dbc1G2hX-KfQq1QAAAMA"]
[Tue Dec 30 15:42:45.649478 2025] [:error] [pid 47441:tid 47456] [client 104.28.246.115:15083] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aVOCdS6d2esGSN6Ne3MWoQAAAUw"]
[Tue Dec 30 15:42:47.134143 2025] [:error] [pid 38777:tid 38792] [client 104.28.246.115:29662] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/style.php"] [unique_id "aVOCd2Ln9GPxJXPhnHbgPQAAAEw"]
[Tue Dec 30 15:42:47.617898 2025] [:error] [pid 28825:tid 28894] [client 104.28.246.115:29664] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "aVOCdz6dbc1G2hX-KfQr8QAAAM8"]
[Tue Dec 30 20:54:14.824923 2025] [:error] [pid 47553:tid 47576] [client 103.77.106.57:54047] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/postnews.php"] [unique_id "aVPLdrvhy9HerwSnwIQQmAAAAZU"]
[Tue Dec 30 20:54:17.593857 2025] [:error] [pid 28825:tid 28883] [client 103.77.106.57:54478] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/postnews.php"] [unique_id "aVPLeT6dbc1G2hX-KfRbiAAAAMQ"]
[Tue Dec 30 20:54:21.098067 2025] [:error] [pid 47441:tid 47468] [client 103.77.106.57:54957] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "aVPLfS6d2esGSN6Ne3NZqwAAAVg"]
[Wed Dec 31 00:33:52.961618 2025] [:error] [pid 50266:tid 50277] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/mda.php
[Wed Dec 31 00:33:53.387232 2025] [:error] [pid 50266:tid 50269] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/cheka.php
[Wed Dec 31 00:33:53.606331 2025] [:error] [pid 50266:tid 50271] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Wed Dec 31 00:33:53.815123 2025] [:error] [pid 50266:tid 50276] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Wed Dec 31 00:33:54.030287 2025] [:error] [pid 50266:tid 50272] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/zsz.php
[Wed Dec 31 00:33:54.274388 2025] [:error] [pid 50266:tid 50274] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/kaza.php
[Wed Dec 31 00:33:54.514069 2025] [:error] [pid 50266:tid 50284] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/lites.php
[Wed Dec 31 00:33:54.730893 2025] [:error] [pid 50266:tid 50290] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/bby.php
[Wed Dec 31 00:33:54.943106 2025] [:error] [pid 50266:tid 50270] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/get.php
[Wed Dec 31 00:33:55.152500 2025] [:error] [pid 50266:tid 50280] [client 172.191.157.70:36074] File does not exist: /usr/local/apache/htdocs/suspended-page/xtride.php
[Wed Dec 31 00:33:55.359850 2025] [:error] [pid 50266:tid 50289] [client 172.191.157.70:36074] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aVP-8_w6SPY9puCUnH9mJwAAAFU"]
[Wed Dec 31 00:33:56.050128 2025] [:error] [pid 49982:tid 50028] [client 172.191.157.70:36037] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aVP-9CFJSHqasQiscZ7YGgAAAM0"]
[Wed Dec 31 00:33:57.096373 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:36044] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aVP-9SFJSHqasQiscZ7YHQAAAMM"]
[Wed Dec 31 00:33:58.213786 2025] [:error] [pid 50266:tid 50269] [client 172.191.157.70:36019] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aVP-9vw6SPY9puCUnH9mLAAAAEE"]
[Wed Dec 31 00:33:59.457897 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:36051] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aVP-9_w6SPY9puCUnH9mMwAAAE4"]
[Wed Dec 31 00:33:59.930887 2025] [:error] [pid 50266:tid 50274] [client 172.191.157.70:11845] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aVP-9_w6SPY9puCUnH9mNAAAAEY"]
[Wed Dec 31 00:34:00.507873 2025] [:error] [pid 50266:tid 50290] [client 172.191.157.70:36085] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aVP--Pw6SPY9puCUnH9mNwAAAFY"]
[Wed Dec 31 00:34:01.105220 2025] [:error] [pid 50266:tid 50289] [client 172.191.157.70:36075] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aVP--fw6SPY9puCUnH9mOQAAAFU"]
[Wed Dec 31 00:34:01.599595 2025] [:error] [pid 50068:tid 50074] [client 172.191.157.70:35981] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aVP--fJem-CRnWG3ZuxqnwAAAAQ"]
[Wed Dec 31 00:34:02.127188 2025] [:error] [pid 50068:tid 50070] [client 172.191.157.70:35993] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aVP--vJem-CRnWG3ZuxqowAAAAA"]
[Wed Dec 31 00:34:02.717577 2025] [:error] [pid 50266:tid 50279] [client 172.191.157.70:36062] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aVP--vw6SPY9puCUnH9mPgAAAEs"]
[Wed Dec 31 00:34:03.547967 2025] [:error] [pid 49982:tid 50019] [client 172.191.157.70:36014] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s11.php"] [unique_id "aVP--yFJSHqasQiscZ7YJQAAAMQ"]
[Wed Dec 31 00:34:04.352005 2025] [:error] [pid 50068:tid 50086] [client 172.191.157.70:36092] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aVP-_PJem-CRnWG3ZuxqqQAAABA"]
[Wed Dec 31 00:34:05.083777 2025] [:error] [pid 49981:tid 49987] [client 172.191.157.70:36068] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aVP-_ZCCXHPw9uuzhExWpgAAAII"]
[Wed Dec 31 00:34:05.917703 2025] [:error] [pid 50266:tid 50287] [client 172.191.157.70:35992] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aVP-_fw6SPY9puCUnH9mSAAAAFM"]
[Wed Dec 31 00:34:06.570635 2025] [:error] [pid 49982:tid 50022] [client 172.191.157.70:35995] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dir.php"] [unique_id "aVP-_iFJSHqasQiscZ7YLQAAAMc"]
[Wed Dec 31 00:34:07.119495 2025] [:error] [pid 50068:tid 50074] [client 172.191.157.70:36058] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aqw.php"] [unique_id "aVP-__Jem-CRnWG3ZuxqrAAAAAQ"]
[Wed Dec 31 00:34:07.659498 2025] [:error] [pid 49981:tid 50000] [client 172.191.157.70:36077] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aqw.php"] [unique_id "aVP-_5CCXHPw9uuzhExWrQAAAI8"]
[Wed Dec 31 00:34:08.194710 2025] [:error] [pid 49982:tid 50039] [client 172.191.157.70:36021] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aqw.php"] [unique_id "aVP_ACFJSHqasQiscZ7YMQAAANg"]
[Wed Dec 31 00:34:08.789581 2025] [:error] [pid 49982:tid 50016] [client 172.191.157.70:35988] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aqw.php"] [unique_id "aVP_ACFJSHqasQiscZ7YNAAAAME"]
[Wed Dec 31 00:34:09.242040 2025] [:error] [pid 49983:tid 50054] [client 172.191.157.70:36052] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca1.php"] [unique_id "aVP_AWiL1pay2WifcvZ-aQAAAQw"]
[Wed Dec 31 00:34:09.851063 2025] [:error] [pid 50068:tid 50076] [client 172.191.157.70:36083] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca1.php"] [unique_id "aVP_AfJem-CRnWG3ZuxqsQAAAAY"]
[Wed Dec 31 00:34:10.593677 2025] [:error] [pid 49983:tid 50050] [client 172.191.157.70:35984] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca1.php"] [unique_id "aVP_AmiL1pay2WifcvZ-bwAAAQg"]
[Wed Dec 31 00:34:11.162827 2025] [:error] [pid 49983:tid 50061] [client 172.191.157.70:35976] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca1.php"] [unique_id "aVP_A2iL1pay2WifcvZ-cAAAARM"]
[Wed Dec 31 00:34:11.764755 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:36078] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "aVP_A_Jem-CRnWG3ZuxqtQAAABU"]
[Wed Dec 31 00:34:12.332465 2025] [:error] [pid 50068:tid 50071] [client 172.191.157.70:36065] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "aVP_BPJem-CRnWG3ZuxquAAAAAE"]
[Wed Dec 31 00:34:12.985499 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:35996] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "aVP_BCFJSHqasQiscZ7YOAAAAMM"]
[Wed Dec 31 00:34:13.555024 2025] [:error] [pid 49982:tid 50022] [client 172.191.157.70:12058] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "aVP_BSFJSHqasQiscZ7YOwAAAMc"]
[Wed Dec 31 00:34:14.139049 2025] [:error] [pid 50068:tid 50077] [client 172.191.157.70:36047] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abouta.php"] [unique_id "aVP_BvJem-CRnWG3ZuxqvQAAAAc"]
[Wed Dec 31 00:34:15.022777 2025] [:error] [pid 49983:tid 50048] [client 172.191.157.70:11915] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abouta.php"] [unique_id "aVP_B2iL1pay2WifcvZ-dAAAAQY"]
[Wed Dec 31 00:34:15.965017 2025] [:error] [pid 49981:tid 50008] [client 172.191.157.70:36004] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abouta.php"] [unique_id "aVP_B5CCXHPw9uuzhExWuwAAAJc"]
[Wed Dec 31 00:34:16.731992 2025] [:error] [pid 49983:tid 50060] [client 172.191.157.70:35989] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abouta.php"] [unique_id "aVP_CGiL1pay2WifcvZ-dwAAARI"]
[Wed Dec 31 00:34:17.366995 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:36046] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fclas.php"] [unique_id "aVP_CZCCXHPw9uuzhExWvgAAAJY"]
[Wed Dec 31 00:34:17.848633 2025] [:error] [pid 49983:tid 50054] [client 172.191.157.70:36053] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fclas.php"] [unique_id "aVP_CWiL1pay2WifcvZ-ewAAAQw"]
[Wed Dec 31 00:34:18.410802 2025] [:error] [pid 50068:tid 50088] [client 172.191.157.70:36007] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fclas.php"] [unique_id "aVP_CvJem-CRnWG3ZuxqwgAAABI"]
[Wed Dec 31 00:34:18.868389 2025] [:error] [pid 49981:tid 50001] [client 172.191.157.70:36091] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fclas.php"] [unique_id "aVP_CpCCXHPw9uuzhExWwwAAAJA"]
[Wed Dec 31 00:34:19.470597 2025] [:error] [pid 49981:tid 50003] [client 172.191.157.70:12255] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/File.php"] [unique_id "aVP_C5CCXHPw9uuzhExWxwAAAJI"]
[Wed Dec 31 00:34:20.038222 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:36086] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/File.php"] [unique_id "aVP_DPw6SPY9puCUnH9mWAAAAE4"]
[Wed Dec 31 00:34:20.656922 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:36061] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/File.php"] [unique_id "aVP_DPJem-CRnWG3ZuxqxgAAABU"]
[Wed Dec 31 00:34:21.265091 2025] [:error] [pid 49981:tid 49993] [client 172.191.157.70:36090] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/File.php"] [unique_id "aVP_DZCCXHPw9uuzhExWyQAAAIg"]
[Wed Dec 31 00:34:21.956184 2025] [:error] [pid 49982:tid 50036] [client 172.191.157.70:36035] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/all.php"] [unique_id "aVP_DSFJSHqasQiscZ7YQQAAANU"]
[Wed Dec 31 00:34:22.656070 2025] [:error] [pid 50266:tid 50283] [client 172.191.157.70:36002] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/all.php"] [unique_id "aVP_Dvw6SPY9puCUnH9mYwAAAE8"]
[Wed Dec 31 00:34:23.203079 2025] [:error] [pid 50266:tid 50275] [client 172.191.157.70:36015] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/all.php"] [unique_id "aVP_D_w6SPY9puCUnH9mZQAAAEc"]
[Wed Dec 31 00:34:23.701154 2025] [:error] [pid 50266:tid 50274] [client 172.191.157.70:36094] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/all.php"] [unique_id "aVP_D_w6SPY9puCUnH9magAAAEY"]
[Wed Dec 31 00:34:24.192343 2025] [:error] [pid 49982:tid 50021] [client 172.191.157.70:36081] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbn.php"] [unique_id "aVP_ECFJSHqasQiscZ7YQwAAAMY"]
[Wed Dec 31 00:34:25.110231 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:11926] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbn.php"] [unique_id "aVP_ESFJSHqasQiscZ7YRQAAAMM"]
[Wed Dec 31 00:34:25.804422 2025] [:error] [pid 49982:tid 50022] [client 172.191.157.70:36043] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbn.php"] [unique_id "aVP_ESFJSHqasQiscZ7YRwAAAMc"]
[Wed Dec 31 00:34:26.445833 2025] [:error] [pid 50068:tid 50094] [client 172.191.157.70:35969] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbn.php"] [unique_id "aVP_EvJem-CRnWG3ZuxqzgAAABg"]
[Wed Dec 31 00:34:27.043198 2025] [:error] [pid 50266:tid 50291] [client 172.191.157.70:36064] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aVP_E_w6SPY9puCUnH9mbwAAAFc"]
[Wed Dec 31 00:34:27.609851 2025] [:error] [pid 50266:tid 50277] [client 172.191.157.70:36038] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aVP_E_w6SPY9puCUnH9mcQAAAEk"]
[Wed Dec 31 00:34:28.116249 2025] [:error] [pid 49981:tid 49998] [client 172.191.157.70:11950] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aVP_FJCCXHPw9uuzhExW0wAAAI0"]
[Wed Dec 31 00:34:28.667537 2025] [:error] [pid 49982:tid 50017] [client 172.191.157.70:35986] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aVP_FCFJSHqasQiscZ7YUQAAAMI"]
[Wed Dec 31 00:34:29.206332 2025] [:error] [pid 50266:tid 50278] [client 172.191.157.70:35990] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aVP_Ffw6SPY9puCUnH9mdQAAAEo"]
[Wed Dec 31 00:34:29.754904 2025] [:error] [pid 49982:tid 50015] [client 172.191.157.70:35978] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aVP_FSFJSHqasQiscZ7YVgAAAMA"]
[Wed Dec 31 00:34:30.563418 2025] [:error] [pid 49983:tid 50056] [client 172.191.157.70:36060] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aVP_FmiL1pay2WifcvZ-jQAAAQ4"]
[Wed Dec 31 00:34:31.447410 2025] [:error] [pid 49981:tid 49987] [client 172.191.157.70:36088] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aVP_F5CCXHPw9uuzhExW1wAAAII"]
[Wed Dec 31 00:34:32.018750 2025] [:error] [pid 50068:tid 50076] [client 172.191.157.70:11909] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xz89.php"] [unique_id "aVP_GPJem-CRnWG3Zuxq0AAAAAY"]
[Wed Dec 31 00:34:32.798786 2025] [:error] [pid 49981:tid 49985] [client 172.191.157.70:11912] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xz89.php"] [unique_id "aVP_GJCCXHPw9uuzhExW2QAAAIA"]
[Wed Dec 31 00:34:33.489531 2025] [:error] [pid 49982:tid 50039] [client 172.191.157.70:12244] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xz89.php"] [unique_id "aVP_GSFJSHqasQiscZ7YXQAAANg"]
[Wed Dec 31 00:34:34.041211 2025] [:error] [pid 50068:tid 50078] [client 172.191.157.70:36084] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xz89.php"] [unique_id "aVP_GvJem-CRnWG3Zuxq3gAAAAg"]
[Wed Dec 31 00:34:34.653062 2025] [:error] [pid 50068:tid 50089] [client 172.191.157.70:12233] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thai.php"] [unique_id "aVP_GvJem-CRnWG3Zuxq4wAAABM"]
[Wed Dec 31 00:34:35.158202 2025] [:error] [pid 49983:tid 50055] [client 172.191.157.70:35985] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thai.php"] [unique_id "aVP_G2iL1pay2WifcvZ-mAAAAQ0"]
[Wed Dec 31 00:34:35.912687 2025] [:error] [pid 49983:tid 50045] [client 172.191.157.70:36015] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thai.php"] [unique_id "aVP_G2iL1pay2WifcvZ-mwAAAQM"]
[Wed Dec 31 00:34:36.526638 2025] [:error] [pid 49983:tid 50060] [client 172.191.157.70:35974] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thai.php"] [unique_id "aVP_HGiL1pay2WifcvZ-nAAAARI"]
[Wed Dec 31 00:34:37.006908 2025] [:error] [pid 49983:tid 50057] [client 172.191.157.70:35973] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lopst.php"] [unique_id "aVP_HWiL1pay2WifcvZ-ngAAAQ8"]
[Wed Dec 31 00:34:37.493440 2025] [:error] [pid 49982:tid 50015] [client 172.191.157.70:35999] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lopst.php"] [unique_id "aVP_HSFJSHqasQiscZ7YZAAAAMA"]
[Wed Dec 31 00:34:37.943318 2025] [:error] [pid 49982:tid 50019] [client 172.191.157.70:36036] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lopst.php"] [unique_id "aVP_HSFJSHqasQiscZ7YZgAAAMQ"]
[Wed Dec 31 00:34:38.584047 2025] [:error] [pid 49981:tid 50001] [client 172.191.157.70:36076] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lopst.php"] [unique_id "aVP_HpCCXHPw9uuzhExW4gAAAJA"]
[Wed Dec 31 00:34:39.359150 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:36033] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wft.php"] [unique_id "aVP_H_Jem-CRnWG3Zuxq9gAAABU"]
[Wed Dec 31 00:34:39.905335 2025] [:error] [pid 49982:tid 50038] [client 172.191.157.70:36093] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wft.php"] [unique_id "aVP_HyFJSHqasQiscZ7YbQAAANc"]
[Wed Dec 31 00:34:40.368000 2025] [:error] [pid 50068:tid 50087] [client 172.191.157.70:35979] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wft.php"] [unique_id "aVP_IPJem-CRnWG3Zuxq_AAAABE"]
[Wed Dec 31 00:34:41.060146 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:11914] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wft.php"] [unique_id "aVP_IZCCXHPw9uuzhExW5wAAAJY"]
[Wed Dec 31 00:34:41.512214 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:35982] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws28.php"] [unique_id "aVP_ISFJSHqasQiscZ7YcAAAAMM"]
[Wed Dec 31 00:34:42.052381 2025] [:error] [pid 50266:tid 50275] [client 172.191.157.70:11944] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws28.php"] [unique_id "aVP_Ivw6SPY9puCUnH9mgQAAAEc"]
[Wed Dec 31 00:34:42.590811 2025] [:error] [pid 49981:tid 50000] [client 172.191.157.70:11905] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws28.php"] [unique_id "aVP_IpCCXHPw9uuzhExW6gAAAI8"]
[Wed Dec 31 00:34:43.115173 2025] [:error] [pid 50068:tid 50082] [client 172.191.157.70:11924] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws28.php"] [unique_id "aVP_I_Jem-CRnWG3ZuxrBAAAAAw"]
[Wed Dec 31 00:34:43.665675 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:11893] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aVP_I_Jem-CRnWG3ZuxrBwAAABc"]
[Wed Dec 31 00:34:44.152716 2025] [:error] [pid 49983:tid 50065] [client 172.191.157.70:35977] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aVP_JGiL1pay2WifcvZ-pQAAARc"]
[Wed Dec 31 00:34:44.652860 2025] [:error] [pid 49981:tid 50002] [client 172.191.157.70:35975] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aVP_JJCCXHPw9uuzhExW6wAAAJE"]
[Wed Dec 31 00:34:45.145409 2025] [:error] [pid 49983:tid 50055] [client 172.191.157.70:36041] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aVP_JWiL1pay2WifcvZ-qQAAAQ0"]
[Wed Dec 31 00:34:45.719567 2025] [:error] [pid 49981:tid 49986] [client 172.191.157.70:11949] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vbbn.php"] [unique_id "aVP_JZCCXHPw9uuzhExW7AAAAIE"]
[Wed Dec 31 00:34:46.157502 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:11907] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vbbn.php"] [unique_id "aVP_Jvw6SPY9puCUnH9mhQAAAEU"]
[Wed Dec 31 00:34:46.739458 2025] [:error] [pid 50266:tid 50272] [client 172.191.157.70:12274] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vbbn.php"] [unique_id "aVP_Jvw6SPY9puCUnH9miQAAAEQ"]
[Wed Dec 31 00:34:47.186226 2025] [:error] [pid 49982:tid 50023] [client 172.191.157.70:11945] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vbbn.php"] [unique_id "aVP_JyFJSHqasQiscZ7YdQAAAMg"]
[Wed Dec 31 00:34:47.636342 2025] [:error] [pid 49981:tid 50001] [client 172.191.157.70:36073] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVP_J5CCXHPw9uuzhExW7gAAAJA"]
[Wed Dec 31 00:34:48.074654 2025] [:error] [pid 50266:tid 50289] [client 172.191.157.70:36055] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVP_KPw6SPY9puCUnH9migAAAFU"]
[Wed Dec 31 00:34:48.583296 2025] [:error] [pid 50068:tid 50073] [client 172.191.157.70:36087] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVP_KPJem-CRnWG3ZuxrGwAAAAM"]
[Wed Dec 31 00:34:49.070708 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:36056] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVP_Kfw6SPY9puCUnH9mjQAAAFE"]
[Wed Dec 31 00:34:49.534331 2025] [:error] [pid 50266:tid 50278] [client 172.191.157.70:11960] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aVP_Kfw6SPY9puCUnH9mkQAAAEo"]
[Wed Dec 31 00:34:50.003560 2025] [:error] [pid 50068:tid 50094] [client 172.191.157.70:11933] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aVP_KvJem-CRnWG3ZuxrHwAAABg"]
[Wed Dec 31 00:34:50.545115 2025] [:error] [pid 49982:tid 50015] [client 172.191.157.70:36012] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aVP_KiFJSHqasQiscZ7YfwAAAMA"]
[Wed Dec 31 00:34:51.126246 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:36011] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aVP_KyFJSHqasQiscZ7YgAAAAMM"]
[Wed Dec 31 00:34:51.617319 2025] [:error] [pid 50068:tid 50080] [client 172.191.157.70:36071] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aVP_K_Jem-CRnWG3ZuxrKAAAAAo"]
[Wed Dec 31 00:34:52.109044 2025] [:error] [pid 50068:tid 50077] [client 172.191.157.70:11906] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aVP_LPJem-CRnWG3ZuxrKgAAAAc"]
[Wed Dec 31 00:34:52.593599 2025] [:error] [pid 50266:tid 50291] [client 172.191.157.70:35998] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aVP_LPw6SPY9puCUnH9mmAAAAFc"]
[Wed Dec 31 00:34:53.190954 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:11927] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sang.php"] [unique_id "aVP_Lfw6SPY9puCUnH9mnAAAAFE"]
[Wed Dec 31 00:34:53.692331 2025] [:error] [pid 50266:tid 50269] [client 172.191.157.70:36063] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aVP_Lfw6SPY9puCUnH9moAAAAEE"]
[Wed Dec 31 00:34:54.222137 2025] [:error] [pid 50266:tid 50281] [client 172.191.157.70:36050] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aVP_Lvw6SPY9puCUnH9mowAAAE0"]
[Wed Dec 31 00:34:54.804809 2025] [:error] [pid 49982:tid 50029] [client 172.191.157.70:11925] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aVP_LiFJSHqasQiscZ7YhwAAAM4"]
[Wed Dec 31 00:34:55.274000 2025] [:error] [pid 49981:tid 49985] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/0o0.php
[Wed Dec 31 00:34:55.493464 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/zxl.php
[Wed Dec 31 00:34:55.715072 2025] [:error] [pid 49981:tid 49995] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Dec 31 00:34:56.166376 2025] [:error] [pid 49981:tid 49988] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Wed Dec 31 00:34:56.379789 2025] [:error] [pid 49981:tid 49993] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Wed Dec 31 00:34:56.592940 2025] [:error] [pid 49981:tid 50006] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 31 00:34:56.812370 2025] [:error] [pid 49981:tid 49992] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Wed Dec 31 00:34:57.025770 2025] [:error] [pid 49981:tid 50001] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Wed Dec 31 00:34:57.253342 2025] [:error] [pid 49981:tid 49991] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Wed Dec 31 00:34:57.465491 2025] [:error] [pid 49981:tid 49989] [client 172.191.157.70:12238] File does not exist: /usr/local/apache/htdocs/suspended-page/tx1.php
[Wed Dec 31 00:34:57.684287 2025] [:error] [pid 49981:tid 49994] [client 172.191.157.70:12238] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aVP_MZCCXHPw9uuzhExXAgAAAIk"]
[Wed Dec 31 00:34:58.175365 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:36018] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aVP_Mvw6SPY9puCUnH9mrgAAAE4"]
[Wed Dec 31 00:34:58.703974 2025] [:error] [pid 50266:tid 50292] [client 172.191.157.70:11965] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aVP_Mvw6SPY9puCUnH9msAAAAFg"]
[Wed Dec 31 00:34:59.223656 2025] [:error] [pid 49983:tid 50064] [client 172.191.157.70:36048] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aVP_M2iL1pay2WifcvZ-tAAAARY"]
[Wed Dec 31 00:34:59.846187 2025] [:error] [pid 49982:tid 50027] [client 172.191.157.70:11911] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aVP_MyFJSHqasQiscZ7YkQAAAMw"]
[Wed Dec 31 00:35:00.418716 2025] [:error] [pid 49981:tid 50003] [client 172.191.157.70:36066] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aVP_NJCCXHPw9uuzhExXBgAAAJI"]
[Wed Dec 31 00:35:01.053631 2025] [:error] [pid 49981:tid 49997] [client 172.191.157.70:35971] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aVP_NZCCXHPw9uuzhExXCAAAAIw"]
[Wed Dec 31 00:35:01.566479 2025] [:error] [pid 49983:tid 50061] [client 172.191.157.70:36070] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aVP_NWiL1pay2WifcvZ-tgAAARM"]
[Wed Dec 31 00:35:02.077397 2025] [:error] [pid 49981:tid 49986] [client 172.191.157.70:11932] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aVP_NpCCXHPw9uuzhExXDwAAAIE"]
[Wed Dec 31 00:35:02.585644 2025] [:error] [pid 50068:tid 50081] [client 172.191.157.70:11928] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aVP_NvJem-CRnWG3ZuxrRAAAAAs"]
[Wed Dec 31 00:35:03.074954 2025] [:error] [pid 49982:tid 50039] [client 172.191.157.70:12098] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aVP_NyFJSHqasQiscZ7YlQAAANg"]
[Wed Dec 31 00:35:03.604668 2025] [:error] [pid 50068:tid 50075] [client 172.191.157.70:36023] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aVP_N_Jem-CRnWG3ZuxrSQAAAAU"]
[Wed Dec 31 00:35:04.077353 2025] [:error] [pid 50266:tid 50279] [client 172.191.157.70:36022] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVP_OPw6SPY9puCUnH9mvAAAAEs"]
[Wed Dec 31 00:35:04.554384 2025] [:error] [pid 50266:tid 50281] [client 172.191.157.70:36029] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVP_OPw6SPY9puCUnH9mwAAAAE0"]
[Wed Dec 31 00:35:05.066480 2025] [:error] [pid 50266:tid 50271] [client 172.191.157.70:35972] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVP_Ofw6SPY9puCUnH9mwgAAAEM"]
[Wed Dec 31 00:35:05.535705 2025] [:error] [pid 50068:tid 50087] [client 172.191.157.70:12284] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVP_OfJem-CRnWG3ZuxrTgAAABE"]
[Wed Dec 31 00:35:06.075841 2025] [:error] [pid 49981:tid 49995] [client 172.191.157.70:12236] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aVP_OpCCXHPw9uuzhExXGQAAAIo"]
[Wed Dec 31 00:35:06.649354 2025] [:error] [pid 49981:tid 50000] [client 172.191.157.70:36017] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aVP_OpCCXHPw9uuzhExXGwAAAI8"]
[Wed Dec 31 00:35:07.122247 2025] [:error] [pid 49983:tid 50049] [client 172.191.157.70:12242] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aVP_O2iL1pay2WifcvZ-ugAAAQc"]
[Wed Dec 31 00:35:07.652511 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:11947] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aVP_O_w6SPY9puCUnH9mxAAAAFE"]
[Wed Dec 31 00:35:08.140417 2025] [:error] [pid 49983:tid 50051] [client 172.191.157.70:11946] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aVP_PGiL1pay2WifcvZ-wQAAAQk"]
[Wed Dec 31 00:35:08.676063 2025] [:error] [pid 49983:tid 50050] [client 172.191.157.70:36072] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aVP_PGiL1pay2WifcvZ-xAAAAQg"]
[Wed Dec 31 00:35:09.190385 2025] [:error] [pid 50266:tid 50287] [client 172.191.157.70:11952] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aVP_Pfw6SPY9puCUnH9myQAAAFM"]
[Wed Dec 31 00:35:09.634362 2025] [:error] [pid 50068:tid 50085] [client 172.191.157.70:12004] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aVP_PfJem-CRnWG3ZuxrVgAAAA8"]
[Wed Dec 31 00:35:10.337029 2025] [:error] [pid 49983:tid 50048] [client 172.191.157.70:12190] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aVP_PmiL1pay2WifcvZ-yAAAAQY"]
[Wed Dec 31 00:35:10.874211 2025] [:error] [pid 49983:tid 50047] [client 172.191.157.70:12132] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aVP_PmiL1pay2WifcvZ-ygAAAQU"]
[Wed Dec 31 00:35:11.387407 2025] [:error] [pid 49983:tid 50045] [client 172.191.157.70:11939] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aVP_P2iL1pay2WifcvZ-ywAAAQM"]
[Wed Dec 31 00:35:11.981074 2025] [:error] [pid 49983:tid 50063] [client 172.191.157.70:12246] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aVP_P2iL1pay2WifcvZ-zwAAARU"]
[Wed Dec 31 00:35:12.501808 2025] [:error] [pid 49981:tid 49998] [client 172.191.157.70:12192] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aVP_QJCCXHPw9uuzhExXHwAAAI0"]
[Wed Dec 31 00:35:12.997547 2025] [:error] [pid 50266:tid 50270] [client 172.191.157.70:11918] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aVP_QPw6SPY9puCUnH9m0gAAAEI"]
[Wed Dec 31 00:35:13.471207 2025] [:error] [pid 50266:tid 50291] [client 172.191.157.70:35983] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aVP_Qfw6SPY9puCUnH9m0wAAAFc"]
[Wed Dec 31 00:35:13.953629 2025] [:error] [pid 49982:tid 50021] [client 172.191.157.70:12269] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aVP_QSFJSHqasQiscZ7YnQAAAMY"]
[Wed Dec 31 00:35:14.499379 2025] [:error] [pid 49982:tid 50022] [client 172.191.157.70:36020] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aVP_QiFJSHqasQiscZ7YnwAAAMc"]
[Wed Dec 31 00:35:15.050513 2025] [:error] [pid 49981:tid 50002] [client 172.191.157.70:35980] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aVP_Q5CCXHPw9uuzhExXJAAAAJE"]
[Wed Dec 31 00:35:15.513764 2025] [:error] [pid 50068:tid 50074] [client 172.191.157.70:12263] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aVP_Q_Jem-CRnWG3ZuxrYwAAAAQ"]
[Wed Dec 31 00:35:16.098330 2025] [:error] [pid 49983:tid 50055] [client 172.191.157.70:11916] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aVP_RGiL1pay2WifcvZ-2wAAAQ0"]
[Wed Dec 31 00:35:16.745698 2025] [:error] [pid 49983:tid 50043] [client 172.191.157.70:12133] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aVP_RGiL1pay2WifcvZ-3gAAAQE"]
[Wed Dec 31 00:35:17.354605 2025] [:error] [pid 49983:tid 50053] [client 172.191.157.70:36013] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aVP_RWiL1pay2WifcvZ-4QAAAQs"]
[Wed Dec 31 00:35:17.945938 2025] [:error] [pid 49983:tid 50066] [client 172.191.157.70:36045] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aVP_RWiL1pay2WifcvZ-4wAAARg"]
[Wed Dec 31 00:35:18.559080 2025] [:error] [pid 49983:tid 50059] [client 172.191.157.70:35987] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aVP_RmiL1pay2WifcvZ-5gAAARE"]
[Wed Dec 31 00:35:19.164113 2025] [:error] [pid 49983:tid 50048] [client 172.191.157.70:11913] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_R2iL1pay2WifcvZ-6wAAAQY"]
[Wed Dec 31 00:35:19.706149 2025] [:error] [pid 49981:tid 49985] [client 172.191.157.70:36031] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_R5CCXHPw9uuzhExXJgAAAIA"]
[Wed Dec 31 00:35:20.399930 2025] [:error] [pid 49982:tid 50025] [client 172.191.157.70:36000] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_SCFJSHqasQiscZ7YrwAAAMo"]
[Wed Dec 31 00:35:21.060243 2025] [:error] [pid 49982:tid 50016] [client 172.191.157.70:36080] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_SSFJSHqasQiscZ7YsQAAAME"]
[Wed Dec 31 00:35:21.517865 2025] [:error] [pid 50068:tid 50075] [client 172.191.157.70:11908] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVP_SfJem-CRnWG3ZuxragAAAAU"]
[Wed Dec 31 00:35:22.066176 2025] [:error] [pid 50266:tid 50283] [client 172.191.157.70:12202] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVP_Svw6SPY9puCUnH9m1wAAAE8"]
[Wed Dec 31 00:35:22.585140 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:11941] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVP_Svw6SPY9puCUnH9m2wAAAE4"]
[Wed Dec 31 00:35:23.198500 2025] [:error] [pid 49982:tid 50026] [client 172.191.157.70:36040] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVP_SyFJSHqasQiscZ7YtwAAAMs"]
[Wed Dec 31 00:35:23.737607 2025] [:error] [pid 49982:tid 50030] [client 172.191.157.70:36089] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVP_SyFJSHqasQiscZ7YvAAAAM8"]
[Wed Dec 31 00:35:24.376877 2025] [:error] [pid 49983:tid 50061] [client 172.191.157.70:36069] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVP_TGiL1pay2WifcvZ--AAAARM"]
[Wed Dec 31 00:35:24.937220 2025] [:error] [pid 50266:tid 50270] [client 172.191.157.70:11930] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVP_TPw6SPY9puCUnH9m4gAAAEI"]
[Wed Dec 31 00:35:25.461193 2025] [:error] [pid 50266:tid 50290] [client 172.191.157.70:11921] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVP_Tfw6SPY9puCUnH9m5AAAAFY"]
[Wed Dec 31 00:35:26.063468 2025] [:error] [pid 49981:tid 50009] [client 172.191.157.70:36032] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVP_TpCCXHPw9uuzhExXLAAAAJg"]
[Wed Dec 31 00:35:27.574415 2025] [:error] [pid 49983:tid 50051] [client 172.191.157.70:11922] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVP_T2iL1pay2WifcvZ_AAAAAQk"]
[Wed Dec 31 00:35:28.146203 2025] [:error] [pid 49983:tid 50060] [client 172.191.157.70:11936] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVP_UGiL1pay2WifcvZ_AgAAARI"]
[Wed Dec 31 00:35:28.740943 2025] [:error] [pid 50068:tid 50087] [client 172.191.157.70:12254] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVP_UPJem-CRnWG3ZuxrbgAAABE"]
[Wed Dec 31 00:35:29.231273 2025] [:error] [pid 49982:tid 50015] [client 172.191.157.70:11935] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVP_USFJSHqasQiscZ7YzgAAAMA"]
[Wed Dec 31 00:35:29.779638 2025] [:error] [pid 49981:tid 49998] [client 172.191.157.70:12112] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVP_UZCCXHPw9uuzhExXLgAAAI0"]
[Wed Dec 31 00:35:30.236570 2025] [:error] [pid 49983:tid 50057] [client 172.191.157.70:12201] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVP_UmiL1pay2WifcvZ_CgAAAQ8"]
[Wed Dec 31 00:35:30.808314 2025] [:error] [pid 49982:tid 50016] [client 172.191.157.70:11955] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVP_UiFJSHqasQiscZ7Y0gAAAME"]
[Wed Dec 31 00:35:31.320469 2025] [:error] [pid 49982:tid 50038] [client 172.191.157.70:12250] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aVP_UyFJSHqasQiscZ7Y2QAAANc"]
[Wed Dec 31 00:35:31.878169 2025] [:error] [pid 49981:tid 50001] [client 172.191.157.70:36079] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aVP_U5CCXHPw9uuzhExXMAAAAJA"]
[Wed Dec 31 00:35:32.399284 2025] [:error] [pid 49981:tid 50008] [client 172.191.157.70:12235] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aVP_VJCCXHPw9uuzhExXMgAAAJc"]
[Wed Dec 31 00:35:33.006908 2025] [:error] [pid 49981:tid 49989] [client 172.191.157.70:36034] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aVP_VZCCXHPw9uuzhExXNAAAAIQ"]
[Wed Dec 31 00:35:33.477948 2025] [:error] [pid 49981:tid 49987] [client 172.191.157.70:11943] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVP_VZCCXHPw9uuzhExXNQAAAII"]
[Wed Dec 31 00:35:34.015957 2025] [:error] [pid 50068:tid 50089] [client 172.191.157.70:11917] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVP_VvJem-CRnWG3ZuxrdAAAABM"]
[Wed Dec 31 00:35:34.471720 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:12171] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVP_VvJem-CRnWG3ZuxrdgAAABU"]
[Wed Dec 31 00:35:35.068401 2025] [:error] [pid 49982:tid 50024] [client 172.191.157.70:35994] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVP_VyFJSHqasQiscZ7Y3QAAAMk"]
[Wed Dec 31 00:35:35.604345 2025] [:error] [pid 50068:tid 50082] [client 172.191.157.70:11901] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_V_Jem-CRnWG3ZuxrewAAAAw"]
[Wed Dec 31 00:35:36.084957 2025] [:error] [pid 50266:tid 50290] [client 172.191.157.70:36027] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_WPw6SPY9puCUnH9m8AAAAFY"]
[Wed Dec 31 00:35:36.621850 2025] [:error] [pid 50068:tid 50090] [client 172.191.157.70:36006] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_WPJem-CRnWG3ZuxrfQAAABQ"]
[Wed Dec 31 00:35:37.123805 2025] [:error] [pid 50266:tid 50278] [client 172.191.157.70:11953] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_Wfw6SPY9puCUnH9m9gAAAEo"]
[Wed Dec 31 00:35:37.582298 2025] [:error] [pid 49981:tid 49993] [client 172.191.157.70:36042] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aVP_WZCCXHPw9uuzhExXPAAAAIg"]
[Wed Dec 31 00:35:38.143432 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:11961] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aVP_WiFJSHqasQiscZ7Y4QAAAMM"]
[Wed Dec 31 00:35:38.615789 2025] [:error] [pid 50068:tid 50086] [client 172.191.157.70:11879] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aVP_WvJem-CRnWG3ZuxrggAAABA"]
[Wed Dec 31 00:35:39.205105 2025] [:error] [pid 49981:tid 49988] [client 172.191.157.70:11905] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aVP_W5CCXHPw9uuzhExXQAAAAIM"]
[Wed Dec 31 00:35:39.736077 2025] [:error] [pid 49983:tid 50060] [client 172.191.157.70:12249] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aVP_W2iL1pay2WifcvZ_IwAAARI"]
[Wed Dec 31 00:35:40.247169 2025] [:error] [pid 49981:tid 49990] [client 172.191.157.70:35968] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVP_XJCCXHPw9uuzhExXQQAAAIU"]
[Wed Dec 31 00:35:40.729725 2025] [:error] [pid 49983:tid 50042] [client 172.191.157.70:12261] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVP_XGiL1pay2WifcvZ_KQAAAQA"]
[Wed Dec 31 00:35:41.420897 2025] [:error] [pid 50266:tid 50283] [client 172.191.157.70:11954] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVP_Xfw6SPY9puCUnH9m-wAAAE8"]
[Wed Dec 31 00:35:41.947312 2025] [:error] [pid 50068:tid 50076] [client 172.191.157.70:12247] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_XfJem-CRnWG3ZuxrigAAAAY"]
[Wed Dec 31 00:35:42.404447 2025] [:error] [pid 50266:tid 50288] [client 172.191.157.70:12268] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_Xvw6SPY9puCUnH9m_AAAAFQ"]
[Wed Dec 31 00:35:43.072142 2025] [:error] [pid 49983:tid 50063] [client 172.191.157.70:11904] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_X2iL1pay2WifcvZ_MgAAARU"]
[Wed Dec 31 00:35:43.660102 2025] [:error] [pid 50266:tid 50291] [client 172.191.157.70:12160] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_X_w6SPY9puCUnH9nAwAAAFc"]
[Wed Dec 31 00:35:44.263780 2025] [:error] [pid 50266:tid 50277] [client 172.191.157.70:12229] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVP_YPw6SPY9puCUnH9nBgAAAEk"]
[Wed Dec 31 00:35:44.820417 2025] [:error] [pid 49982:tid 50031] [client 172.191.157.70:12230] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVP_YCFJSHqasQiscZ7Y6QAAANA"]
[Wed Dec 31 00:35:45.303213 2025] [:error] [pid 49982:tid 50037] [client 172.191.157.70:12175] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVP_YSFJSHqasQiscZ7Y6gAAANY"]
[Wed Dec 31 00:35:45.811334 2025] [:error] [pid 50266:tid 50279] [client 172.191.157.70:36026] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVP_Yfw6SPY9puCUnH9nDQAAAEs"]
[Wed Dec 31 00:35:46.269054 2025] [:error] [pid 50266:tid 50288] [client 172.191.157.70:12164] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aVP_Yvw6SPY9puCUnH9nEQAAAFQ"]
[Wed Dec 31 00:35:46.973737 2025] [:error] [pid 50068:tid 50085] [client 172.191.157.70:36095] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aVP_YvJem-CRnWG3ZuxrlAAAAA8"]
[Wed Dec 31 00:35:47.605648 2025] [:error] [pid 49982:tid 50024] [client 172.191.157.70:11966] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aVP_YyFJSHqasQiscZ7Y7QAAAMk"]
[Wed Dec 31 00:35:48.112295 2025] [:error] [pid 50068:tid 50080] [client 172.191.157.70:11919] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aVP_ZPJem-CRnWG3ZuxrlQAAAAo"]
[Wed Dec 31 00:35:48.641831 2025] [:error] [pid 50266:tid 50287] [client 172.191.157.70:35970] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_ZPw6SPY9puCUnH9nFwAAAFM"]
[Wed Dec 31 00:35:49.328292 2025] [:error] [pid 50068:tid 50075] [client 172.191.157.70:11937] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_ZfJem-CRnWG3ZuxrmQAAAAU"]
[Wed Dec 31 00:35:49.968621 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:12146] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_ZfJem-CRnWG3ZuxrngAAABc"]
[Wed Dec 31 00:35:50.485325 2025] [:error] [pid 50068:tid 50074] [client 172.191.157.70:11998] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aVP_ZvJem-CRnWG3ZuxroQAAAAQ"]
[Wed Dec 31 00:35:51.001214 2025] [:error] [pid 50266:tid 50281] [client 172.191.157.70:12271] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVP_Z_w6SPY9puCUnH9nHAAAAE0"]
[Wed Dec 31 00:35:51.690881 2025] [:error] [pid 49981:tid 50003] [client 172.191.157.70:12248] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVP_Z5CCXHPw9uuzhExXRAAAAJI"]
[Wed Dec 31 00:35:52.313622 2025] [:error] [pid 50068:tid 50092] [client 172.191.157.70:12226] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVP_aPJem-CRnWG3ZuxrpgAAABY"]
[Wed Dec 31 00:35:52.860316 2025] [:error] [pid 49982:tid 50035] [client 172.191.157.70:12264] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVP_aCFJSHqasQiscZ7Y7gAAANQ"]
[Wed Dec 31 00:35:53.582481 2025] [:error] [pid 50068:tid 50077] [client 172.191.157.70:11957] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aVP_afJem-CRnWG3ZuxrrQAAAAc"]
[Wed Dec 31 00:35:54.233526 2025] [:error] [pid 49983:tid 50066] [client 172.191.157.70:12117] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aVP_amiL1pay2WifcvZ_QgAAARg"]
[Wed Dec 31 00:35:54.822035 2025] [:error] [pid 50068:tid 50075] [client 172.191.157.70:36067] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aVP_avJem-CRnWG3ZuxrtAAAAAU"]
[Wed Dec 31 00:35:55.744087 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:11938] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 31 00:35:56.301906 2025] [:error] [pid 50068:tid 50092] [client 172.191.157.70:11938] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Dec 31 00:35:56.518632 2025] [:error] [pid 50068:tid 50089] [client 172.191.157.70:11938] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Dec 31 00:35:56.834041 2025] [:error] [pid 50068:tid 50075] [client 172.191.157.70:11938] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Dec 31 00:35:57.050337 2025] [:error] [pid 50068:tid 50087] [client 172.191.157.70:11938] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Dec 31 00:35:57.285533 2025] [:error] [pid 50068:tid 50079] [client 172.191.157.70:11938] File does not exist: /usr/local/apache/htdocs/suspended-page/about3.php
[Wed Dec 31 00:35:57.937848 2025] [:error] [pid 50068:tid 50081] [client 172.191.157.70:11938] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVP_bfJem-CRnWG3Zuxr0gAAAAs"]
[Wed Dec 31 00:35:58.661244 2025] [:error] [pid 49982:tid 50033] [client 172.191.157.70:12184] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVP_biFJSHqasQiscZ7Y-QAAANI"]
[Wed Dec 31 00:35:59.165323 2025] [:error] [pid 49982:tid 50023] [client 172.191.157.70:11942] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVP_byFJSHqasQiscZ7Y_AAAAMg"]
[Wed Dec 31 00:36:00.412105 2025] [:error] [pid 50068:tid 50086] [client 172.191.157.70:12179] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVP_cPJem-CRnWG3Zuxr3QAAABA"]
[Wed Dec 31 00:36:00.995273 2025] [:error] [pid 49983:tid 50042] [client 172.191.157.70:12065] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVP_cGiL1pay2WifcvZ_RgAAAQA"]
[Wed Dec 31 00:36:01.676416 2025] [:error] [pid 49982:tid 50015] [client 172.191.157.70:12279] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVP_cSFJSHqasQiscZ7ZBwAAAMA"]
[Wed Dec 31 00:36:02.220942 2025] [:error] [pid 49982:tid 50025] [client 172.191.157.70:12267] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVP_ciFJSHqasQiscZ7ZCQAAAMo"]
[Wed Dec 31 00:36:02.732710 2025] [:error] [pid 49982:tid 50029] [client 172.191.157.70:11964] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVP_ciFJSHqasQiscZ7ZDQAAAM4"]
[Wed Dec 31 00:36:03.215318 2025] [:error] [pid 50068:tid 50071] [client 172.191.157.70:12163] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVP_c_Jem-CRnWG3Zuxr5AAAAAE"]
[Wed Dec 31 00:36:03.823229 2025] [:error] [pid 49983:tid 50057] [client 172.191.157.70:36039] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVP_c2iL1pay2WifcvZ_TAAAAQ8"]
[Wed Dec 31 00:36:04.364459 2025] [:error] [pid 50068:tid 50082] [client 172.191.157.70:35991] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVP_dPJem-CRnWG3Zuxr5gAAAAw"]
[Wed Dec 31 00:36:04.983096 2025] [:error] [pid 49982:tid 50030] [client 172.191.157.70:12240] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVP_dCFJSHqasQiscZ7ZEAAAAM8"]
[Wed Dec 31 00:36:05.495177 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:12215] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVP_dSFJSHqasQiscZ7ZEwAAAMM"]
[Wed Dec 31 00:36:06.029494 2025] [:error] [pid 49982:tid 50027] [client 172.191.157.70:36016] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVP_diFJSHqasQiscZ7ZGQAAAMw"]
[Wed Dec 31 00:36:06.628980 2025] [:error] [pid 50068:tid 50072] [client 172.191.157.70:12282] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVP_dvJem-CRnWG3Zuxr7wAAAAI"]
[Wed Dec 31 00:36:07.248840 2025] [:error] [pid 50266:tid 50287] [client 172.191.157.70:12251] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVP_d_w6SPY9puCUnH9nJgAAAFM"]
[Wed Dec 31 00:36:07.827726 2025] [:error] [pid 50266:tid 50279] [client 172.191.157.70:12260] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_d_w6SPY9puCUnH9nKwAAAEs"]
[Wed Dec 31 00:36:08.249627 2025] [:error] [pid 49982:tid 50029] [client 172.191.157.70:12109] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_eCFJSHqasQiscZ7ZGwAAAM4"]
[Wed Dec 31 00:36:09.008023 2025] [:error] [pid 49981:tid 49995] [client 172.191.157.70:36049] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_eZCCXHPw9uuzhExXSAAAAIo"]
[Wed Dec 31 00:36:09.535260 2025] [:error] [pid 49982:tid 50026] [client 172.191.157.70:11956] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVP_eSFJSHqasQiscZ7ZHgAAAMs"]
[Wed Dec 31 00:36:10.088994 2025] [:error] [pid 49982:tid 50031] [client 172.191.157.70:11948] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVP_eiFJSHqasQiscZ7ZHwAAANA"]
[Wed Dec 31 00:36:11.041526 2025] [:error] [pid 49981:tid 50006] [client 172.191.157.70:12167] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVP_e5CCXHPw9uuzhExXTQAAAJU"]
[Wed Dec 31 00:36:11.618784 2025] [:error] [pid 49982:tid 50030] [client 172.191.157.70:11940] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVP_eyFJSHqasQiscZ7ZIwAAAM8"]
[Wed Dec 31 00:36:12.235822 2025] [:error] [pid 49982:tid 50015] [client 172.191.157.70:36010] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVP_fCFJSHqasQiscZ7ZKAAAAMA"]
[Wed Dec 31 00:36:12.844817 2025] [:error] [pid 49981:tid 49998] [client 172.191.157.70:11936] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aVP_fJCCXHPw9uuzhExXTwAAAI0"]
[Wed Dec 31 00:36:13.469667 2025] [:error] [pid 49982:tid 50016] [client 172.191.157.70:12245] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aVP_fSFJSHqasQiscZ7ZKwAAAME"]
[Wed Dec 31 00:36:13.943894 2025] [:error] [pid 49983:tid 50066] [client 172.191.157.70:35997] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aVP_fWiL1pay2WifcvZ_VAAAARg"]
[Wed Dec 31 00:36:14.647486 2025] [:error] [pid 49982:tid 50022] [client 172.191.157.70:12205] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aVP_fiFJSHqasQiscZ7ZLAAAAMc"]
[Wed Dec 31 00:36:15.182435 2025] [:error] [pid 49983:tid 50054] [client 172.191.157.70:12266] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVP_f2iL1pay2WifcvZ_VgAAAQw"]
[Wed Dec 31 00:36:15.737028 2025] [:error] [pid 49981:tid 49997] [client 172.191.157.70:12034] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVP_f5CCXHPw9uuzhExXVwAAAIw"]
[Wed Dec 31 00:36:16.294189 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:12258] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVP_gPJem-CRnWG3ZuxsAwAAABU"]
[Wed Dec 31 00:36:16.773185 2025] [:error] [pid 50068:tid 50071] [client 172.191.157.70:12186] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVP_gPJem-CRnWG3ZuxsBwAAAAE"]
[Wed Dec 31 00:36:17.432178 2025] [:error] [pid 49982:tid 50039] [client 172.191.157.70:12126] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aVP_gSFJSHqasQiscZ7ZLwAAANg"]
[Wed Dec 31 00:36:18.095940 2025] [:error] [pid 49983:tid 50049] [client 172.191.157.70:12281] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aVP_gmiL1pay2WifcvZ_WQAAAQc"]
[Wed Dec 31 00:36:18.987099 2025] [:error] [pid 49982:tid 50031] [client 172.191.157.70:36003] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aVP_giFJSHqasQiscZ7ZMwAAANA"]
[Wed Dec 31 00:36:19.905048 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:36024] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aVP_g_Jem-CRnWG3ZuxsEgAAABU"]
[Wed Dec 31 00:36:20.628885 2025] [:error] [pid 49982:tid 50018] [client 172.191.157.70:12223] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aVP_hCFJSHqasQiscZ7ZNgAAAMM"]
[Wed Dec 31 00:36:21.099070 2025] [:error] [pid 49982:tid 50035] [client 172.191.157.70:12106] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aVP_hSFJSHqasQiscZ7ZOAAAANQ"]
[Wed Dec 31 00:36:21.623227 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:11959] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aVP_hZCCXHPw9uuzhExXYwAAAJY"]
[Wed Dec 31 00:36:22.279860 2025] [:error] [pid 49981:tid 49986] [client 172.191.157.70:12237] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aVP_hpCCXHPw9uuzhExXZwAAAIE"]
[Wed Dec 31 00:36:23.154539 2025] [:error] [pid 49982:tid 50029] [client 172.191.157.70:12101] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aVP_hyFJSHqasQiscZ7ZPwAAAM4"]
[Wed Dec 31 00:36:23.631326 2025] [:error] [pid 49983:tid 50060] [client 172.191.157.70:12225] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aVP_h2iL1pay2WifcvZ_YQAAARI"]
[Wed Dec 31 00:36:24.223475 2025] [:error] [pid 49982:tid 50023] [client 172.191.157.70:12280] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aVP_iCFJSHqasQiscZ7ZQQAAAMg"]
[Wed Dec 31 00:36:24.921012 2025] [:error] [pid 49983:tid 50065] [client 172.191.157.70:11958] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aVP_iGiL1pay2WifcvZ_aQAAARc"]
[Wed Dec 31 00:36:25.533409 2025] [:error] [pid 49982:tid 50026] [client 172.191.157.70:11910] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aVP_iSFJSHqasQiscZ7ZQwAAAMs"]
[Wed Dec 31 00:36:26.329446 2025] [:error] [pid 50266:tid 50268] [client 172.191.157.70:12161] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aVP_ivw6SPY9puCUnH9nOAAAAEA"]
[Wed Dec 31 00:36:26.954580 2025] [:error] [pid 50266:tid 50280] [client 172.191.157.70:12178] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aVP_ivw6SPY9puCUnH9nOgAAAEw"]
[Wed Dec 31 00:36:27.508986 2025] [:error] [pid 50068:tid 50084] [client 172.191.157.70:12181] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aVP_i_Jem-CRnWG3ZuxsFQAAAA4"]
[Wed Dec 31 00:36:28.181637 2025] [:error] [pid 49983:tid 50049] [client 172.191.157.70:12241] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aVP_jGiL1pay2WifcvZ_egAAAQc"]
[Wed Dec 31 00:36:29.132516 2025] [:error] [pid 49981:tid 49996] [client 172.191.157.70:12194] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVP_jZCCXHPw9uuzhExXbgAAAIs"]
[Wed Dec 31 00:36:29.796831 2025] [:error] [pid 50068:tid 50082] [client 172.191.157.70:12162] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVP_jfJem-CRnWG3ZuxsFwAAAAw"]
[Wed Dec 31 00:36:30.458791 2025] [:error] [pid 49982:tid 50037] [client 172.191.157.70:12168] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVP_jiFJSHqasQiscZ7ZRAAAANY"]
[Wed Dec 31 00:36:30.981399 2025] [:error] [pid 49983:tid 50045] [client 172.191.157.70:12219] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVP_jmiL1pay2WifcvZ_gwAAAQM"]
[Wed Dec 31 00:36:31.514873 2025] [:error] [pid 50266:tid 50292] [client 172.191.157.70:36008] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aVP_j_w6SPY9puCUnH9nRQAAAFg"]
[Wed Dec 31 00:36:32.023218 2025] [:error] [pid 50068:tid 50080] [client 172.191.157.70:12256] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVP_kPJem-CRnWG3ZuxsGgAAAAo"]
[Wed Dec 31 00:36:32.697465 2025] [:error] [pid 49981:tid 50002] [client 172.191.157.70:12173] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVP_kJCCXHPw9uuzhExXcgAAAJE"]
[Wed Dec 31 00:36:33.336523 2025] [:error] [pid 49982:tid 50020] [client 172.191.157.70:12224] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVP_kSFJSHqasQiscZ7ZUAAAAMU"]
[Wed Dec 31 00:36:33.934526 2025] [:error] [pid 50266:tid 50276] [client 172.191.157.70:12107] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVP_kfw6SPY9puCUnH9nSgAAAEg"]
[Wed Dec 31 00:36:34.632515 2025] [:error] [pid 49981:tid 50009] [client 172.191.157.70:12270] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVP_kpCCXHPw9uuzhExXegAAAJg"]
[Wed Dec 31 00:36:35.431094 2025] [:error] [pid 50068:tid 50087] [client 172.191.157.70:11951] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVP_k_Jem-CRnWG3ZuxsHQAAABE"]
[Wed Dec 31 00:36:35.985728 2025] [:error] [pid 49982:tid 50035] [client 172.191.157.70:12259] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVP_kyFJSHqasQiscZ7ZWgAAANQ"]
[Wed Dec 31 00:36:36.428881 2025] [:error] [pid 49982:tid 50028] [client 172.191.157.70:12197] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aVP_lCFJSHqasQiscZ7ZXQAAAM0"]
[Wed Dec 31 00:36:37.158549 2025] [:error] [pid 50266:tid 50275] [client 172.191.157.70:12176] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVP_lfw6SPY9puCUnH9nUAAAAEc"]
[Wed Dec 31 00:36:38.026461 2025] [:error] [pid 49981:tid 50002] [client 172.191.157.70:12283] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVP_lpCCXHPw9uuzhExXggAAAJE"]
[Wed Dec 31 00:36:38.558731 2025] [:error] [pid 49982:tid 50033] [client 172.191.157.70:12234] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVP_liFJSHqasQiscZ7ZZAAAANI"]
[Wed Dec 31 00:36:39.045329 2025] [:error] [pid 49982:tid 50031] [client 172.191.157.70:12182] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aVP_lyFJSHqasQiscZ7ZZQAAANA"]
[Wed Dec 31 00:36:39.744422 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:12211] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aVP_l_w6SPY9puCUnH9nVgAAAFE"]
[Wed Dec 31 00:36:40.219979 2025] [:error] [pid 50266:tid 50281] [client 172.191.157.70:12265] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aVP_mPw6SPY9puCUnH9nWAAAAE0"]
[Wed Dec 31 00:36:40.899754 2025] [:error] [pid 49982:tid 50025] [client 172.191.157.70:12209] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aVP_mCFJSHqasQiscZ7ZZgAAAMo"]
[Wed Dec 31 00:36:41.505413 2025] [:error] [pid 50068:tid 50075] [client 172.191.157.70:11967] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aVP_mfJem-CRnWG3ZuxsLwAAAAU"]
[Wed Dec 31 00:36:42.390396 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:12207] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aVP_mvw6SPY9puCUnH9nYAAAAEU"]
[Wed Dec 31 00:36:43.348090 2025] [:error] [pid 50266:tid 50272] [client 172.191.157.70:12047] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aVP_m_w6SPY9puCUnH9nYgAAAEQ"]
[Wed Dec 31 00:36:43.821101 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:12193] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aVP_m_w6SPY9puCUnH9nZQAAAFE"]
[Wed Dec 31 00:36:44.466496 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:12189] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aVP_nPJem-CRnWG3ZuxsNgAAABc"]
[Wed Dec 31 00:36:45.272496 2025] [:error] [pid 50266:tid 50281] [client 172.191.157.70:12218] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aVP_nfw6SPY9puCUnH9nZwAAAE0"]
[Wed Dec 31 00:36:45.848164 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:12174] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aVP_nZCCXHPw9uuzhExXkAAAAJY"]
[Wed Dec 31 00:36:46.418964 2025] [:error] [pid 49983:tid 50057] [client 172.191.157.70:12286] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aVP_nmiL1pay2WifcvZ_lgAAAQ8"]
[Wed Dec 31 00:36:47.082024 2025] [:error] [pid 49983:tid 50064] [client 172.191.157.70:36025] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aVP_n2iL1pay2WifcvZ_mAAAARY"]
[Wed Dec 31 00:36:48.119158 2025] [:error] [pid 49982:tid 50029] [client 172.191.157.70:12273] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVP_oCFJSHqasQiscZ7ZbQAAAM4"]
[Wed Dec 31 00:36:48.724684 2025] [:error] [pid 49982:tid 50035] [client 172.191.157.70:36082] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVP_oCFJSHqasQiscZ7ZcAAAANQ"]
[Wed Dec 31 00:36:49.235233 2025] [:error] [pid 50068:tid 50087] [client 172.191.157.70:12232] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVP_ofJem-CRnWG3ZuxsRAAAABE"]
[Wed Dec 31 00:36:49.952124 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:12180] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVP_ofJem-CRnWG3ZuxsSgAAABc"]
[Wed Dec 31 00:36:50.437936 2025] [:error] [pid 50068:tid 50070] [client 172.191.157.70:11934] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVP_ovJem-CRnWG3ZuxsSwAAAAA"]
[Wed Dec 31 00:36:51.301520 2025] [:error] [pid 49983:tid 50046] [client 172.191.157.70:12104] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVP_o2iL1pay2WifcvZ_nwAAAQQ"]
[Wed Dec 31 00:36:52.122498 2025] [:error] [pid 50266:tid 50284] [client 172.191.157.70:12129] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVP_pPw6SPY9puCUnH9nbwAAAFA"]
[Wed Dec 31 00:36:53.116026 2025] [:error] [pid 50266:tid 50277] [client 172.191.157.70:11931] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVP_pfw6SPY9puCUnH9ndQAAAEk"]
[Wed Dec 31 00:36:53.632713 2025] [:error] [pid 49982:tid 50034] [client 172.191.157.70:12191] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aVP_pSFJSHqasQiscZ7ZdgAAANM"]
[Wed Dec 31 00:36:54.256622 2025] [:error] [pid 49983:tid 50062] [client 172.191.157.70:12036] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aVP_pmiL1pay2WifcvZ_pQAAARQ"]
[Wed Dec 31 00:36:55.194597 2025] [:error] [pid 50266:tid 50269] [client 172.191.157.70:36057] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aVP_p_w6SPY9puCUnH9nfAAAAEE"]
[Wed Dec 31 00:36:56.249969 2025] [:error] [pid 50068:tid 50080] [client 172.191.157.70:12200] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aVP_qPJem-CRnWG3ZuxsVAAAAAo"]
[Wed Dec 31 00:37:00.406661 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:12114] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aVP_rPJem-CRnWG3ZuxsXQAAABc"]
[Wed Dec 31 00:37:02.225047 2025] [:error] [pid 50266:tid 50271] [client 172.191.157.70:12278] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Dec 31 00:37:02.434351 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:12278] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aVP_rvw6SPY9puCUnH9nkQAAAFE"]
[Wed Dec 31 00:37:03.000040 2025] [:error] [pid 50068:tid 50094] [client 172.191.157.70:12177] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aVP_rvJem-CRnWG3ZuxsYwAAABg"]
[Wed Dec 31 00:37:03.687389 2025] [:error] [pid 49983:tid 50045] [client 172.191.157.70:12275] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aVP_r2iL1pay2WifcvZ_twAAAQM"]
[Wed Dec 31 00:37:04.244804 2025] [:error] [pid 49981:tid 49999] [client 172.191.157.70:11963] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aVP_sJCCXHPw9uuzhExXrQAAAI4"]
[Wed Dec 31 00:37:04.767008 2025] [:error] [pid 49983:tid 50063] [client 172.191.157.70:36001] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVP_sGiL1pay2WifcvZ_uAAAARU"]
[Wed Dec 31 00:37:05.548975 2025] [:error] [pid 49983:tid 50052] [client 172.191.157.70:11929] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVP_sWiL1pay2WifcvZ_uQAAAQo"]
[Wed Dec 31 00:37:06.485740 2025] [:error] [pid 49982:tid 50036] [client 172.191.157.70:12257] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVP_siFJSHqasQiscZ7ZggAAANU"]
[Wed Dec 31 00:37:07.280412 2025] [:error] [pid 49982:tid 50017] [client 172.191.157.70:12272] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVP_syFJSHqasQiscZ7ZgwAAAMI"]
[Wed Dec 31 00:37:07.902013 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:12124] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVP_s5CCXHPw9uuzhExXswAAAJY"]
[Wed Dec 31 00:37:08.429776 2025] [:error] [pid 50266:tid 50271] [client 172.191.157.70:12056] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVP_tPw6SPY9puCUnH9nnwAAAEM"]
[Wed Dec 31 00:37:08.865449 2025] [:error] [pid 49983:tid 50057] [client 172.191.157.70:11920] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVP_tGiL1pay2WifcvZ_wwAAAQ8"]
[Wed Dec 31 00:37:09.602095 2025] [:error] [pid 49983:tid 50043] [client 172.191.157.70:36030] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVP_tWiL1pay2WifcvZ_yAAAAQE"]
[Wed Dec 31 00:37:10.382876 2025] [:error] [pid 50068:tid 50086] [client 172.191.157.70:12210] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aVP_tvJem-CRnWG3ZuxseAAAABA"]
[Wed Dec 31 00:37:11.189322 2025] [:error] [pid 50266:tid 50279] [client 172.191.157.70:12166] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aVP_t_w6SPY9puCUnH9nrgAAAEs"]
[Wed Dec 31 00:37:11.869739 2025] [:error] [pid 50068:tid 50084] [client 172.191.157.70:12134] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aVP_t_Jem-CRnWG3ZuxsggAAAA4"]
[Wed Dec 31 00:37:12.601137 2025] [:error] [pid 50068:tid 50092] [client 172.191.157.70:12099] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aVP_uPJem-CRnWG3ZuxsiAAAABY"]
[Wed Dec 31 00:37:13.533254 2025] [:error] [pid 49983:tid 50050] [client 172.191.157.70:12195] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aVP_uWiL1pay2WifcvZ_4gAAAQg"]
[Wed Dec 31 00:37:14.610960 2025] [:error] [pid 49983:tid 50054] [client 172.191.157.70:11962] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aVP_umiL1pay2WifcvZ_5QAAAQw"]
[Wed Dec 31 00:37:15.351399 2025] [:error] [pid 49983:tid 50062] [client 172.191.157.70:12116] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aVP_u2iL1pay2WifcvZ_6QAAARQ"]
[Wed Dec 31 00:37:16.226330 2025] [:error] [pid 49982:tid 50038] [client 172.191.157.70:12243] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aVP_vCFJSHqasQiscZ7ZigAAANc"]
[Wed Dec 31 00:37:16.785780 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:12128] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aVP_vPw6SPY9puCUnH9nwwAAAE4"]
[Wed Dec 31 00:37:17.251233 2025] [:error] [pid 49981:tid 50003] [client 172.191.157.70:12150] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aVP_vZCCXHPw9uuzhExXyQAAAJI"]
[Wed Dec 31 00:37:17.905979 2025] [:error] [pid 49981:tid 49993] [client 172.191.157.70:12092] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aVP_vZCCXHPw9uuzhExXzwAAAIg"]
[Wed Dec 31 00:37:18.794752 2025] [:error] [pid 49981:tid 49999] [client 172.191.157.70:36059] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aVP_vpCCXHPw9uuzhExX1AAAAI4"]
[Wed Dec 31 00:37:19.409021 2025] [:error] [pid 49981:tid 49996] [client 172.191.157.70:12110] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVP_v5CCXHPw9uuzhExX1QAAAIs"]
[Wed Dec 31 00:37:20.080240 2025] [:error] [pid 50266:tid 50270] [client 172.191.157.70:12239] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVP_wPw6SPY9puCUnH9nzwAAAEI"]
[Wed Dec 31 00:37:20.883908 2025] [:error] [pid 49982:tid 50033] [client 172.191.157.70:12217] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVP_wCFJSHqasQiscZ7ZiwAAANI"]
[Wed Dec 31 00:37:21.799527 2025] [:error] [pid 50068:tid 50086] [client 172.191.157.70:12049] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVP_wfJem-CRnWG3ZuxsmAAAABA"]
[Wed Dec 31 00:37:22.348470 2025] [:error] [pid 49983:tid 50061] [client 172.191.157.70:12035] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVP_wmiL1pay2WifcvZ__wAAARM"]
[Wed Dec 31 00:37:22.913756 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:12115] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVP_wpCCXHPw9uuzhExX2AAAAJY"]
[Wed Dec 31 00:37:23.510581 2025] [:error] [pid 49981:tid 49993] [client 172.191.157.70:12108] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVP_w5CCXHPw9uuzhExX2wAAAIg"]
[Wed Dec 31 00:37:24.055721 2025] [:error] [pid 49983:tid 50066] [client 172.191.157.70:12206] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVP_xGiL1pay2WifcvaAAwAAARg"]
[Wed Dec 31 00:37:24.689751 2025] [:error] [pid 49981:tid 49999] [client 172.191.157.70:12185] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVP_xJCCXHPw9uuzhExX4AAAAI4"]
[Wed Dec 31 00:37:25.234981 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:12213] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVP_xfw6SPY9puCUnH9n1gAAAFE"]
[Wed Dec 31 00:37:25.925196 2025] [:error] [pid 49983:tid 50047] [client 172.191.157.70:36054] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVP_xWiL1pay2WifcvaACAAAAQU"]
[Wed Dec 31 00:37:26.637611 2025] [:error] [pid 49982:tid 50024] [client 172.191.157.70:12208] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVP_xiFJSHqasQiscZ7ZjQAAAMk"]
[Wed Dec 31 00:37:27.303859 2025] [:error] [pid 50068:tid 50089] [client 172.191.157.70:12043] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVP_x_Jem-CRnWG3ZuxsoQAAABM"]
[Wed Dec 31 00:37:27.947080 2025] [:error] [pid 49981:tid 49985] [client 172.191.157.70:12158] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVP_x5CCXHPw9uuzhExX4QAAAIA"]
[Wed Dec 31 00:37:28.469098 2025] [:error] [pid 50068:tid 50073] [client 172.191.157.70:12102] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVP_yPJem-CRnWG3ZuxspgAAAAM"]
[Wed Dec 31 00:37:29.184860 2025] [:error] [pid 49982:tid 50023] [client 172.191.157.70:12105] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVP_ySFJSHqasQiscZ7ZkgAAAMg"]
[Wed Dec 31 00:37:29.675801 2025] [:error] [pid 49981:tid 49995] [client 172.191.157.70:36009] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVP_yZCCXHPw9uuzhExX5AAAAIo"]
[Wed Dec 31 00:37:30.163411 2025] [:error] [pid 50266:tid 50290] [client 172.191.157.70:12111] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVP_yvw6SPY9puCUnH9n5AAAAFY"]
[Wed Dec 31 00:37:30.727002 2025] [:error] [pid 49981:tid 50002] [client 172.191.157.70:12276] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVP_ypCCXHPw9uuzhExX5wAAAJE"]
[Wed Dec 31 00:37:31.224464 2025] [:error] [pid 50266:tid 50269] [client 172.191.157.70:36028] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVP_y_w6SPY9puCUnH9n6gAAAEE"]
[Wed Dec 31 00:37:31.813282 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:12122] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aVP_y_w6SPY9puCUnH9n6wAAAEU"]
[Wed Dec 31 00:37:32.364182 2025] [:error] [pid 50266:tid 50278] [client 172.191.157.70:12064] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aVP_zPw6SPY9puCUnH9n8AAAAEo"]
[Wed Dec 31 00:37:32.972164 2025] [:error] [pid 50266:tid 50276] [client 172.191.157.70:12070] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aVP_zPw6SPY9puCUnH9n8wAAAEg"]
[Wed Dec 31 00:37:33.653713 2025] [:error] [pid 50068:tid 50081] [client 172.191.157.70:11994] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "aVP_zfJem-CRnWG3ZuxsrQAAAAs"]
[Wed Dec 31 00:37:34.174760 2025] [:error] [pid 49982:tid 50020] [client 172.191.157.70:12287] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aVP_ziFJSHqasQiscZ7ZnAAAAMU"]
[Wed Dec 31 00:37:34.636387 2025] [:error] [pid 50266:tid 50271] [client 172.191.157.70:12130] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aVP_zvw6SPY9puCUnH9n9wAAAEM"]
[Wed Dec 31 00:37:35.193271 2025] [:error] [pid 49982:tid 50032] [client 172.191.157.70:12052] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aVP_zyFJSHqasQiscZ7ZnQAAANE"]
[Wed Dec 31 00:37:35.728414 2025] [:error] [pid 49983:tid 50059] [client 172.191.157.70:12142] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aVP_z2iL1pay2WifcvaAGAAAARE"]
[Wed Dec 31 00:37:36.228590 2025] [:error] [pid 49983:tid 50043] [client 172.191.157.70:12048] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVP_0GiL1pay2WifcvaAGwAAAQE"]
[Wed Dec 31 00:37:36.681364 2025] [:error] [pid 49983:tid 50048] [client 172.191.157.70:12145] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVP_0GiL1pay2WifcvaAHAAAAQY"]
[Wed Dec 31 00:37:37.259645 2025] [:error] [pid 49982:tid 50039] [client 172.191.157.70:12041] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVP_0SFJSHqasQiscZ7ZpwAAANg"]
[Wed Dec 31 00:37:37.775588 2025] [:error] [pid 49982:tid 50020] [client 172.191.157.70:12221] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVP_0SFJSHqasQiscZ7ZrQAAAMU"]
[Wed Dec 31 00:37:38.487737 2025] [:error] [pid 50266:tid 50280] [client 172.191.157.70:12125] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aVP_0vw6SPY9puCUnH9oBAAAAEw"]
[Wed Dec 31 00:37:39.017889 2025] [:error] [pid 49983:tid 50044] [client 172.191.157.70:12220] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aVP_02iL1pay2WifcvaAJgAAAQI"]
[Wed Dec 31 00:37:39.607957 2025] [:error] [pid 50266:tid 50277] [client 172.191.157.70:12252] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aVP_0_w6SPY9puCUnH9oBwAAAEk"]
[Wed Dec 31 00:37:40.186841 2025] [:error] [pid 50068:tid 50077] [client 172.191.157.70:12097] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aVP_1PJem-CRnWG3ZuxswwAAAAc"]
[Wed Dec 31 00:37:40.737974 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:12033] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aVP_1PJem-CRnWG3ZuxsxwAAABU"]
[Wed Dec 31 00:37:41.228682 2025] [:error] [pid 50068:tid 50089] [client 172.191.157.70:11981] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aVP_1fJem-CRnWG3ZuxsygAAABM"]
[Wed Dec 31 00:37:41.857379 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:12154] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aVP_1fw6SPY9puCUnH9oCQAAAEU"]
[Wed Dec 31 00:37:42.547788 2025] [:error] [pid 50068:tid 50077] [client 172.191.157.70:12116] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aVP_1vJem-CRnWG3Zuxs0QAAAAc"]
[Wed Dec 31 00:37:43.045339 2025] [:error] [pid 50068:tid 50094] [client 172.191.157.70:12148] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVP_1_Jem-CRnWG3Zuxs0gAAABg"]
[Wed Dec 31 00:37:43.538874 2025] [:error] [pid 49982:tid 50036] [client 172.191.157.70:12069] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVP_1yFJSHqasQiscZ7ZtAAAANU"]
[Wed Dec 31 00:37:44.076345 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:12086] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVP_2Pw6SPY9puCUnH9oDQAAAE4"]
[Wed Dec 31 00:37:44.593518 2025] [:error] [pid 49982:tid 50025] [client 172.191.157.70:12087] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVP_2CFJSHqasQiscZ7ZtwAAAMo"]
[Wed Dec 31 00:37:45.042265 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:12262] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aVP_2fw6SPY9puCUnH9oEgAAAFE"]
[Wed Dec 31 00:37:45.575679 2025] [:error] [pid 50266:tid 50271] [client 172.191.157.70:12085] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aVP_2fw6SPY9puCUnH9oFgAAAEM"]
[Wed Dec 31 00:37:46.188767 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:12044] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aVP_2vw6SPY9puCUnH9oGQAAAEU"]
[Wed Dec 31 00:37:46.696964 2025] [:error] [pid 50266:tid 50289] [client 172.191.157.70:12127] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aVP_2vw6SPY9puCUnH9oGgAAAFU"]
[Wed Dec 31 00:37:47.130174 2025] [:error] [pid 49981:tid 49989] [client 172.191.157.70:12038] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aVP_25CCXHPw9uuzhExX_gAAAIQ"]
[Wed Dec 31 00:37:47.619201 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:12169] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aVP_2_Jem-CRnWG3Zuxs2QAAABc"]
[Wed Dec 31 00:37:48.169766 2025] [:error] [pid 49981:tid 50000] [client 172.191.157.70:12216] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aVP_3JCCXHPw9uuzhExYAgAAAI8"]
[Wed Dec 31 00:37:48.595976 2025] [:error] [pid 50068:tid 50086] [client 172.191.157.70:12100] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aVP_3PJem-CRnWG3Zuxs2wAAABA"]
[Wed Dec 31 00:37:49.282888 2025] [:error] [pid 50068:tid 50094] [client 172.191.157.70:12183] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aVP_3fJem-CRnWG3Zuxs3wAAABg"]
[Wed Dec 31 00:37:49.792499 2025] [:error] [pid 49981:tid 49986] [client 172.191.157.70:12144] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aVP_3ZCCXHPw9uuzhExYBQAAAIE"]
[Wed Dec 31 00:37:50.578473 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:36005] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aVP_3vJem-CRnWG3Zuxs4gAAABU"]
[Wed Dec 31 00:37:51.185602 2025] [:error] [pid 50068:tid 50081] [client 172.191.157.70:11983] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aVP_3_Jem-CRnWG3Zuxs5AAAAAs"]
[Wed Dec 31 00:37:51.671132 2025] [:error] [pid 49982:tid 50023] [client 172.191.157.70:12042] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_3yFJSHqasQiscZ7ZvQAAAMg"]
[Wed Dec 31 00:37:52.268952 2025] [:error] [pid 49982:tid 50030] [client 172.191.157.70:12204] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_4CFJSHqasQiscZ7ZvwAAAM8"]
[Wed Dec 31 00:37:52.826632 2025] [:error] [pid 49983:tid 50063] [client 172.191.157.70:12060] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_4GiL1pay2WifcvaATAAAARU"]
[Wed Dec 31 00:37:53.504707 2025] [:error] [pid 49982:tid 50016] [client 172.191.157.70:12159] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aVP_4SFJSHqasQiscZ7ZwgAAAME"]
[Wed Dec 31 00:37:53.970359 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:12120] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aVP_4fJem-CRnWG3Zuxs5wAAABc"]
[Wed Dec 31 00:37:54.500546 2025] [:error] [pid 50068:tid 50071] [client 172.191.157.70:12222] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aVP_4vJem-CRnWG3Zuxs6AAAAAE"]
[Wed Dec 31 00:37:54.997468 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:12040] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aVP_4vw6SPY9puCUnH9oLAAAAE4"]
[Wed Dec 31 00:37:55.572701 2025] [:error] [pid 50068:tid 50078] [client 172.191.157.70:12005] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aVP_4_Jem-CRnWG3Zuxs6wAAAAg"]
[Wed Dec 31 00:37:56.063999 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:12285] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aVP_5Pw6SPY9puCUnH9oMAAAAEU"]
[Wed Dec 31 00:37:56.608015 2025] [:error] [pid 49983:tid 50048] [client 172.191.157.70:12277] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aVP_5GiL1pay2WifcvaAUgAAAQY"]
[Wed Dec 31 00:37:57.330418 2025] [:error] [pid 49982:tid 50033] [client 172.191.157.70:11977] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aVP_5SFJSHqasQiscZ7ZygAAANI"]
[Wed Dec 31 00:37:57.844121 2025] [:error] [pid 50266:tid 50292] [client 172.191.157.70:11986] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "aVP_5fw6SPY9puCUnH9oOAAAAFg"]
[Wed Dec 31 00:37:58.383177 2025] [:error] [pid 50266:tid 50278] [client 172.191.157.70:12141] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aVP_5vw6SPY9puCUnH9oOgAAAEo"]
[Wed Dec 31 00:37:59.898325 2025] [:error] [pid 50068:tid 50093] [client 172.191.157.70:12147] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aVP_5_Jem-CRnWG3Zuxs8wAAABc"]
[Wed Dec 31 00:38:01.122238 2025] [:error] [pid 50266:tid 50291] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Wed Dec 31 00:38:01.342873 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Wed Dec 31 00:38:01.558566 2025] [:error] [pid 50266:tid 50268] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Wed Dec 31 00:38:01.775080 2025] [:error] [pid 50266:tid 50289] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Wed Dec 31 00:38:02.005798 2025] [:error] [pid 50266:tid 50270] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Wed Dec 31 00:38:02.224062 2025] [:error] [pid 50266:tid 50281] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Dec 31 00:38:02.436781 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:12240] [client 172.191.157.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.191.157.70, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVP_6vw6SPY9puCUnH9oRwAAAE4"]
[Wed Dec 31 00:38:02.440350 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Wed Dec 31 00:38:02.658350 2025] [:error] [pid 50266:tid 50269] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Dec 31 00:38:02.956289 2025] [:error] [pid 50266:tid 50278] [client 172.191.157.70:12240] File does not exist: /usr/local/apache/htdocs/suspended-page/xse25.php
[Wed Dec 31 00:38:03.386332 2025] [:error] [pid 50266:tid 50275] [client 172.191.157.70:12240] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aVP_6_w6SPY9puCUnH9oTgAAAEc"]
[Wed Dec 31 00:38:03.918268 2025] [:error] [pid 49982:tid 50015] [client 172.191.157.70:12138] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Wed Dec 31 00:38:04.126057 2025] [:error] [pid 49982:tid 50036] [client 172.191.157.70:12138] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "aVP_7CFJSHqasQiscZ7Z2AAAANU"]
[Wed Dec 31 00:38:04.592526 2025] [:error] [pid 50068:tid 50083] [client 172.191.157.70:12211] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "aVP_7PJem-CRnWG3Zuxs_QAAAA0"]
[Wed Dec 31 00:38:05.144363 2025] [:error] [pid 50068:tid 50073] [client 172.191.157.70:12123] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "aVP_7fJem-CRnWG3ZuxtAAAAAAM"]
[Wed Dec 31 00:38:05.693519 2025] [:error] [pid 49981:tid 50002] [client 172.191.157.70:12157] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "aVP_7ZCCXHPw9uuzhExYDwAAAJE"]
[Wed Dec 31 00:38:06.299679 2025] [:error] [pid 49983:tid 50057] [client 172.191.157.70:12083] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aVP_7miL1pay2WifcvaAcAAAAQ8"]
[Wed Dec 31 00:38:06.966979 2025] [:error] [pid 50266:tid 50281] [client 172.191.157.70:12196] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aVP_7vw6SPY9puCUnH9oVAAAAE0"]
[Wed Dec 31 00:38:07.560811 2025] [:error] [pid 49981:tid 49988] [client 172.191.157.70:12063] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aVP_75CCXHPw9uuzhExYEQAAAIM"]
[Wed Dec 31 00:38:08.106495 2025] [:error] [pid 50068:tid 50087] [client 172.191.157.70:12172] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aVP_8PJem-CRnWG3ZuxtCAAAABE"]
[Wed Dec 31 00:38:08.629173 2025] [:error] [pid 49983:tid 50066] [client 172.191.157.70:12139] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aVP_8GiL1pay2WifcvaAcwAAARg"]
[Wed Dec 31 00:38:09.142646 2025] [:error] [pid 50068:tid 50094] [client 172.191.157.70:12045] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aVP_8fJem-CRnWG3ZuxtCQAAABg"]
[Wed Dec 31 00:38:09.785384 2025] [:error] [pid 50266:tid 50272] [client 172.191.157.70:12076] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aVP_8fw6SPY9puCUnH9oWAAAAEQ"]
[Wed Dec 31 00:38:10.364197 2025] [:error] [pid 49983:tid 50053] [client 172.191.157.70:12121] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "aVP_8miL1pay2WifcvaAdgAAAQs"]
[Wed Dec 31 00:38:10.956260 2025] [:error] [pid 50068:tid 50079] [client 172.191.157.70:12016] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aVP_8vJem-CRnWG3ZuxtDwAAAAk"]
[Wed Dec 31 00:38:11.487805 2025] [:error] [pid 49981:tid 49985] [client 172.191.157.70:12253] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aVP_85CCXHPw9uuzhExYGAAAAIA"]
[Wed Dec 31 00:38:12.023784 2025] [:error] [pid 50068:tid 50075] [client 172.191.157.70:12095] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aVP_9PJem-CRnWG3ZuxtEgAAAAU"]
[Wed Dec 31 00:38:12.725202 2025] [:error] [pid 50266:tid 50277] [client 172.191.157.70:12170] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "aVP_9Pw6SPY9puCUnH9oXAAAAEk"]
[Wed Dec 31 00:38:13.261153 2025] [:error] [pid 49982:tid 50021] [client 172.191.157.70:11988] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aVP_9SFJSHqasQiscZ7Z4wAAAMY"]
[Wed Dec 31 00:38:13.865429 2025] [:error] [pid 49981:tid 49991] [client 172.191.157.70:12088] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aVP_9ZCCXHPw9uuzhExYIAAAAIY"]
[Wed Dec 31 00:38:14.388985 2025] [:error] [pid 50266:tid 50271] [client 172.191.157.70:12143] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aVP_9vw6SPY9puCUnH9oXwAAAEM"]
[Wed Dec 31 00:38:14.997849 2025] [:error] [pid 50266:tid 50273] [client 172.191.157.70:12187] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aVP_9vw6SPY9puCUnH9oYAAAAEU"]
[Wed Dec 31 00:38:15.476812 2025] [:error] [pid 50266:tid 50290] [client 172.191.157.70:12135] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aVP_9_w6SPY9puCUnH9oZAAAAFY"]
[Wed Dec 31 00:38:16.104071 2025] [:error] [pid 50266:tid 50282] [client 172.191.157.70:12103] [client 172.191.157.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/index.php"] [unique_id "aVP_-Pw6SPY9puCUnH9oZgAAAE4"]
[Wed Dec 31 00:38:16.693657 2025] [:error] [pid 49983:tid 50065] [client 172.191.157.70:12081] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVP_-GiL1pay2WifcvaAgAAAARc"]
[Wed Dec 31 00:38:17.170772 2025] [:error] [pid 50068:tid 50083] [client 172.191.157.70:12155] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVP_-fJem-CRnWG3ZuxtHQAAAA0"]
[Wed Dec 31 00:38:17.933152 2025] [:error] [pid 49981:tid 49998] [client 172.191.157.70:12140] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVP_-ZCCXHPw9uuzhExYJAAAAI0"]
[Wed Dec 31 00:38:18.688371 2025] [:error] [pid 50068:tid 50077] [client 172.191.157.70:12084] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVP_-vJem-CRnWG3ZuxtIQAAAAc"]
[Wed Dec 31 00:38:19.447521 2025] [:error] [pid 49982:tid 50036] [client 172.191.157.70:11969] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aVP_-yFJSHqasQiscZ7Z5QAAANU"]
[Wed Dec 31 00:38:20.185371 2025] [:error] [pid 50266:tid 50278] [client 172.191.157.70:12073] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aVP__Pw6SPY9puCUnH9obQAAAEo"]
[Wed Dec 31 00:38:21.201259 2025] [:error] [pid 49981:tid 49990] [client 172.191.157.70:12046] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aVP__ZCCXHPw9uuzhExYKwAAAIU"]
[Wed Dec 31 00:38:21.792058 2025] [:error] [pid 50266:tid 50290] [client 172.191.157.70:12214] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aVP__fw6SPY9puCUnH9ocwAAAFY"]
[Wed Dec 31 00:38:22.907537 2025] [:error] [pid 49983:tid 50054] [client 172.191.157.70:12119] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah24.php"] [unique_id "aVP__miL1pay2WifcvaAiQAAAQw"]
[Wed Dec 31 00:38:24.514490 2025] [:error] [pid 49983:tid 50044] [client 172.191.157.70:12025] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah24.php"] [unique_id "aVQAAGiL1pay2WifcvaAjwAAAQI"]
[Wed Dec 31 00:38:25.036495 2025] [:error] [pid 49982:tid 50026] [client 172.191.157.70:12002] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah24.php"] [unique_id "aVQAASFJSHqasQiscZ7Z7gAAAMs"]
[Wed Dec 31 00:38:25.853289 2025] [:error] [pid 50068:tid 50078] [client 172.191.157.70:12131] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah24.php"] [unique_id "aVQAAfJem-CRnWG3ZuxtJgAAAAg"]
[Wed Dec 31 00:38:26.585942 2025] [:error] [pid 49983:tid 50047] [client 172.191.157.70:12165] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aVQAAmiL1pay2WifcvaAkQAAAQU"]
[Wed Dec 31 00:38:27.954202 2025] [:error] [pid 49983:tid 50056] [client 172.191.157.70:12053] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aVQAA2iL1pay2WifcvaAkwAAAQ4"]
[Wed Dec 31 00:38:29.672212 2025] [:error] [pid 49981:tid 50008] [client 172.191.157.70:12093] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aVQABZCCXHPw9uuzhExYNAAAAJc"]
[Wed Dec 31 00:38:30.921298 2025] [:error] [pid 50266:tid 50288] [client 172.191.157.70:12149] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aVQABvw6SPY9puCUnH9oiAAAAFQ"]
[Wed Dec 31 00:38:32.032635 2025] [:error] [pid 50068:tid 50074] [client 172.191.157.70:11974] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "aVQACPJem-CRnWG3ZuxtMQAAAAQ"]
[Wed Dec 31 00:38:32.983183 2025] [:error] [pid 50266:tid 50285] [client 172.191.157.70:12054] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "aVQACPw6SPY9puCUnH9oigAAAFE"]
[Wed Dec 31 00:38:34.337846 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:12039] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "aVQACvJem-CRnWG3ZuxtNwAAABU"]
[Wed Dec 31 00:38:35.103534 2025] [:error] [pid 49981:tid 50007] [client 172.191.157.70:12068] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "aVQAC5CCXHPw9uuzhExYOgAAAJY"]
[Wed Dec 31 00:38:35.793958 2025] [:error] [pid 50068:tid 50070] [client 172.191.157.70:12156] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "aVQAC_Jem-CRnWG3ZuxtOwAAAAA"]
[Wed Dec 31 00:38:36.740099 2025] [:error] [pid 49983:tid 50061] [client 172.191.157.70:12061] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "aVQADGiL1pay2WifcvaAqgAAARM"]
[Wed Dec 31 00:38:37.528236 2025] [:error] [pid 50266:tid 50270] [client 172.191.157.70:12012] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "aVQADfw6SPY9puCUnH9okgAAAEI"]
[Wed Dec 31 00:38:39.065031 2025] [:error] [pid 50068:tid 50085] [client 172.191.157.70:11991] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "aVQAD_Jem-CRnWG3ZuxtRQAAAA8"]
[Wed Dec 31 00:38:40.799294 2025] [:error] [pid 50068:tid 50084] [client 172.191.157.70:12137] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "aVQAEPJem-CRnWG3ZuxtTgAAAA4"]
[Wed Dec 31 00:38:42.059571 2025] [:error] [pid 50068:tid 50094] [client 172.191.157.70:12118] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "aVQAEvJem-CRnWG3ZuxtUwAAABg"]
[Wed Dec 31 00:38:43.181803 2025] [:error] [pid 50266:tid 50291] [client 172.191.157.70:11972] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "aVQAE_w6SPY9puCUnH9oogAAAFc"]
[Wed Dec 31 00:38:44.380781 2025] [:error] [pid 50068:tid 50086] [client 172.191.157.70:11987] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "aVQAFPJem-CRnWG3ZuxtWAAAABA"]
[Wed Dec 31 00:38:45.827837 2025] [:error] [pid 49983:tid 50059] [client 172.191.157.70:11871] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aVQAFWiL1pay2WifcvaAwwAAARE"]
[Wed Dec 31 00:38:47.397177 2025] [:error] [pid 50068:tid 50076] [client 172.191.157.70:12094] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aVQAF_Jem-CRnWG3ZuxtYwAAAAY"]
[Wed Dec 31 00:38:48.359255 2025] [:error] [pid 50068:tid 50091] [client 172.191.157.70:11975] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aVQAGPJem-CRnWG3ZuxtZAAAABU"]
[Wed Dec 31 00:38:49.328264 2025] [:error] [pid 49981:tid 49988] [client 172.191.157.70:12172] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aVQAGZCCXHPw9uuzhExYUgAAAIM"]
[Wed Dec 31 00:38:50.031464 2025] [:error] [pid 1651:tid 1702] [client 172.191.157.70:12188] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "aVQAGnAnYt-Xi20L7fDcDgAAAUs"]
[Wed Dec 31 00:38:50.823323 2025] [:error] [pid 49983:tid 50043] [client 172.191.157.70:36037] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "aVQAGmiL1pay2WifcvaAzwAAAQE"]
[Wed Dec 31 00:38:51.620125 2025] [:error] [pid 1651:tid 1705] [client 172.191.157.70:11990] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "aVQAG3AnYt-Xi20L7fDcEAAAAU4"]
[Wed Dec 31 00:38:53.259107 2025] [:error] [pid 50068:tid 50082] [client 172.191.157.70:12228] [client 172.191.157.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "aVQAHfJem-CRnWG3ZuxtagAAAAw"]
[Wed Dec 31 02:02:38.345299 2025] [:error] [pid 49982:tid 50034] [client 195.178.110.190:44924] [client 195.178.110.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aVQTviFJSHqasQiscZ7z3AAAANM"]
[Wed Dec 31 05:44:23.194922 2025] [:error] [pid 33004:tid 33077] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.co.uk/
[Wed Dec 31 05:44:23.313957 2025] [:error] [pid 33004:tid 33066] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.com/
[Wed Dec 31 05:44:24.930321 2025] [:error] [pid 33004:tid 33066] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.co.uk/
[Wed Dec 31 05:44:25.054980 2025] [:error] [pid 33004:tid 33077] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.google.com/
[Wed Dec 31 05:44:25.170372 2025] [:error] [pid 33004:tid 33089] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.yahoo.com/
[Wed Dec 31 05:44:25.289955 2025] [:error] [pid 33004:tid 33070] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.fr/
[Wed Dec 31 05:44:25.408985 2025] [:error] [pid 33004:tid 33079] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.bing.com/
[Wed Dec 31 05:44:25.527294 2025] [:error] [pid 33004:tid 33065] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.co.uk/
[Wed Dec 31 05:44:25.645000 2025] [:error] [pid 33004:tid 33084] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.yahoo.com/
[Wed Dec 31 05:44:25.763738 2025] [:error] [pid 33004:tid 33083] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://duckduckgo.com/
[Wed Dec 31 05:44:25.881018 2025] [:error] [pid 33004:tid 33088] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.bing.com/
[Wed Dec 31 05:44:25.998105 2025] [:error] [pid 33004:tid 33081] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.de/
[Wed Dec 31 05:44:26.117306 2025] [:error] [pid 33004:tid 33066] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.de/
[Wed Dec 31 05:44:26.233778 2025] [:error] [pid 33004:tid 33089] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php, referer: https://www.google.de/
[Wed Dec 31 05:44:26.347292 2025] [:error] [pid 33004:tid 33070] [client 74.176.56.30:25814] [client 74.176.56.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.176.56.30, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVRHuvogj9CrK-80KNwYwQAAAIU"], referer: https://www.google.com/
[Wed Dec 31 05:44:26.350822 2025] [:error] [pid 33004:tid 33070] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://www.google.com/
[Wed Dec 31 05:44:26.468452 2025] [:error] [pid 33004:tid 33086] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.com/
[Wed Dec 31 05:44:26.584562 2025] [:error] [pid 33004:tid 33079] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.bing.com/
[Wed Dec 31 05:44:26.700944 2025] [:error] [pid 33004:tid 33067] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php, referer: https://duckduckgo.com/
[Wed Dec 31 05:44:26.827278 2025] [:error] [pid 33004:tid 33065] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.google.co.uk/
[Wed Dec 31 05:44:26.943808 2025] [:error] [pid 33004:tid 33088] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.de/
[Wed Dec 31 05:44:27.062875 2025] [:error] [pid 33004:tid 33076] [client 74.176.56.30:25814] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.yahoo.com/
[Wed Dec 31 05:44:28.486399 2025] [:error] [pid 33004:tid 33078] [client 74.176.56.30:25814] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aVRHvPogj9CrK-80KNwY1AAAAI0"], referer: https://www.google.com/
[Wed Dec 31 05:44:28.715923 2025] [:error] [pid 33109:tid 33117] [client 74.176.56.30:53972] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aVRHvMYN9k_fnLM-n47nwgAAAMY"], referer: https://duckduckgo.com/
[Wed Dec 31 05:44:28.942871 2025] [:error] [pid 26113:tid 26126] [client 74.176.56.30:39022] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aVRHvCU0NRJ9y9rL1aWwOQAAAQs"], referer: https://www.bing.com/
[Wed Dec 31 05:44:29.172128 2025] [:error] [pid 33003:tid 33052] [client 74.176.56.30:32020] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aVRHvbOkdrCgTt0MxWLmHgAAAE4"], referer: https://www.yahoo.com/
[Wed Dec 31 05:44:29.402033 2025] [:error] [pid 33003:tid 33061] [client 74.176.56.30:34022] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aVRHvbOkdrCgTt0MxWLmHwAAAFc"], referer: https://www.google.co.uk/
[Wed Dec 31 05:44:31.233296 2025] [:error] [pid 26113:tid 26125] [client 74.176.56.30:59254] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aVRHvyU0NRJ9y9rL1aWwQwAAAQo"], referer: https://duckduckgo.com/
[Wed Dec 31 05:44:31.462390 2025] [:error] [pid 33002:tid 33019] [client 74.176.56.30:14695] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aVRHv_nsZEcORmTFnrisMwAAAAg"], referer: https://www.yahoo.com/
[Wed Dec 31 05:44:31.689141 2025] [:error] [pid 33002:tid 33014] [client 74.176.56.30:14663] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aVRHv_nsZEcORmTFnrisNAAAAAM"], referer: https://www.google.fr/
[Wed Dec 31 05:44:31.916310 2025] [:error] [pid 33002:tid 33023] [client 74.176.56.30:39039] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aVRHv_nsZEcORmTFnrisNQAAAAw"], referer: https://www.google.de/
[Wed Dec 31 05:44:32.144668 2025] [:error] [pid 26113:tid 26118] [client 74.176.56.30:25805] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aVRHwCU0NRJ9y9rL1aWwRQAAAQM"], referer: https://www.google.com/
[Wed Dec 31 05:44:32.372722 2025] [:error] [pid 33109:tid 33120] [client 74.176.56.30:28951] [client 74.176.56.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aVRHwMYN9k_fnLM-n47nzQAAAMk"], referer: https://www.google.de/
[Wed Dec 31 05:44:33.425996 2025] [autoindex:error] [pid 33004:tid 33069] [client 74.176.56.30:29007] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Dec 31 06:30:27.201801 2025] [:error] [pid 33003:tid 33056] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Wed Dec 31 06:30:27.453897 2025] [:error] [pid 33003:tid 33054] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Dec 31 06:30:27.708491 2025] [:error] [pid 33003:tid 33057] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/Cachex.php
[Wed Dec 31 06:30:27.964200 2025] [:error] [pid 33003:tid 33048] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/wpup.php
[Wed Dec 31 06:30:28.218576 2025] [:error] [pid 33003:tid 33038] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Wed Dec 31 06:30:28.470621 2025] [:error] [pid 33003:tid 33039] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/wpupex.php
[Wed Dec 31 06:30:28.723748 2025] [:error] [pid 33003:tid 33058] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/halo.php
[Wed Dec 31 06:30:28.974899 2025] [:error] [pid 33003:tid 33060] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/nck.php
[Wed Dec 31 06:30:29.228633 2025] [:error] [pid 33003:tid 33044] [client 40.69.37.190:9426] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 31 06:30:29.477251 2025] [:error] [pid 33003:tid 33061] [client 40.69.37.190:9426] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aVRShbOkdrCgTt0MxWL5DwAAAFc"]
[Wed Dec 31 06:30:30.013621 2025] [:error] [pid 33109:tid 33128] [client 40.69.37.190:9464] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aVRShsYN9k_fnLM-n44AcQAAANE"]
[Wed Dec 31 06:30:30.520353 2025] [:error] [pid 33004:tid 33069] [client 40.69.37.190:9604] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aVRShvogj9CrK-80KNwtRQAAAIQ"]
[Wed Dec 31 06:30:31.026304 2025] [:error] [pid 33003:tid 33049] [client 40.69.37.190:9421] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aVRSh7OkdrCgTt0MxWL5EQAAAEs"]
[Wed Dec 31 06:30:31.525400 2025] [:error] [pid 33109:tid 33126] [client 40.69.37.190:9419] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aVRSh8YN9k_fnLM-n44AdQAAAM8"]
[Wed Dec 31 06:30:32.025061 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:9608] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aVRSiCU0NRJ9y9rL1aXPUwAAAQ0"]
[Wed Dec 31 06:30:32.524454 2025] [:error] [pid 26113:tid 26123] [client 40.69.37.190:9628] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aVRSiCU0NRJ9y9rL1aXPWgAAAQg"]
[Wed Dec 31 06:30:33.025135 2025] [:error] [pid 33109:tid 33115] [client 40.69.37.190:9410] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aVRSicYN9k_fnLM-n44AeAAAAMQ"]
[Wed Dec 31 06:30:33.547444 2025] [:error] [pid 33002:tid 33033] [client 40.69.37.190:9605] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aVRSifnsZEcORmTFnri_IwAAABY"]
[Wed Dec 31 06:30:34.086468 2025] [:error] [pid 33109:tid 33131] [client 40.69.37.190:9613] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aVRSisYN9k_fnLM-n44AewAAANQ"]
[Wed Dec 31 06:30:34.586742 2025] [:error] [pid 26113:tid 26131] [client 40.69.37.190:9471] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aVRSiiU0NRJ9y9rL1aXPZAAAARA"]
[Wed Dec 31 06:30:35.115011 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:9440] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aVRSiyU0NRJ9y9rL1aXPZwAAARE"]
[Wed Dec 31 06:30:35.612612 2025] [:error] [pid 33109:tid 33129] [client 40.69.37.190:9627] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aVRSi8YN9k_fnLM-n44AgQAAANI"]
[Wed Dec 31 06:30:36.130923 2025] [:error] [pid 33003:tid 33057] [client 40.69.37.190:9430] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aVRSjLOkdrCgTt0MxWL5FgAAAFM"]
[Wed Dec 31 06:30:36.628367 2025] [:error] [pid 33003:tid 33045] [client 40.69.37.190:9615] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aVRSjLOkdrCgTt0MxWL5IgAAAEc"]
[Wed Dec 31 06:30:37.127081 2025] [:error] [pid 33003:tid 33062] [client 40.69.37.190:9450] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aVRSjbOkdrCgTt0MxWL5KgAAAFg"]
[Wed Dec 31 06:30:37.644867 2025] [:error] [pid 33004:tid 33070] [client 40.69.37.190:9453] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRSjfogj9CrK-80KNwtwAAAAIU"]
[Wed Dec 31 06:30:38.145343 2025] [:error] [pid 33004:tid 33072] [client 40.69.37.190:9428] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRSjvogj9CrK-80KNwtxAAAAIc"]
[Wed Dec 31 06:30:38.643958 2025] [:error] [pid 33004:tid 33068] [client 40.69.37.190:9456] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRSjvogj9CrK-80KNwtyQAAAIM"]
[Wed Dec 31 06:30:39.182807 2025] [:error] [pid 33002:tid 33023] [client 40.69.37.190:9437] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRSj_nsZEcORmTFnri_PwAAAAw"]
[Wed Dec 31 06:30:39.684540 2025] [:error] [pid 33109:tid 33114] [client 40.69.37.190:9657] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aVRSj8YN9k_fnLM-n44AoQAAAMM"]
[Wed Dec 31 06:30:40.212193 2025] [:error] [pid 33003:tid 33046] [client 40.69.37.190:9754] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aVRSkLOkdrCgTt0MxWL5MwAAAEg"]
[Wed Dec 31 06:30:40.737267 2025] [:error] [pid 33003:tid 33062] [client 40.69.37.190:9644] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aVRSkLOkdrCgTt0MxWL5NAAAAFg"]
[Wed Dec 31 06:30:41.286401 2025] [:error] [pid 33003:tid 33056] [client 40.69.37.190:9729] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aVRSkbOkdrCgTt0MxWL5NgAAAFI"]
[Wed Dec 31 06:30:41.785171 2025] [:error] [pid 33003:tid 33054] [client 40.69.37.190:9441] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aVRSkbOkdrCgTt0MxWL5OgAAAFA"]
[Wed Dec 31 06:30:42.285582 2025] [:error] [pid 33109:tid 33126] [client 40.69.37.190:9416] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aVRSksYN9k_fnLM-n44ApgAAAM8"]
[Wed Dec 31 06:30:42.789499 2025] [:error] [pid 33002:tid 33011] [client 40.69.37.190:9647] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aVRSkvnsZEcORmTFnri_QwAAAAA"]
[Wed Dec 31 06:30:43.319092 2025] [:error] [pid 33003:tid 33045] [client 40.69.37.190:9457] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aVRSk7OkdrCgTt0MxWL5PgAAAEc"]
[Wed Dec 31 06:30:43.823501 2025] [:error] [pid 26113:tid 26138] [client 40.69.37.190:9622] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aVRSkyU0NRJ9y9rL1aXPfgAAARc"]
[Wed Dec 31 06:30:44.353599 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:9455] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aVRSlCU0NRJ9y9rL1aXPfwAAAQ0"]
[Wed Dec 31 06:30:44.866930 2025] [:error] [pid 33004:tid 33081] [client 40.69.37.190:9635] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aVRSlPogj9CrK-80KNwt3AAAAJA"]
[Wed Dec 31 06:30:45.385002 2025] [:error] [pid 26113:tid 26131] [client 40.69.37.190:9750] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aVRSlSU0NRJ9y9rL1aXPhAAAARA"]
[Wed Dec 31 06:30:45.891009 2025] [:error] [pid 33004:tid 33067] [client 40.69.37.190:9623] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVRSlfogj9CrK-80KNwt3wAAAII"]
[Wed Dec 31 06:30:46.420093 2025] [:error] [pid 26113:tid 26116] [client 40.69.37.190:9643] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVRSliU0NRJ9y9rL1aXPhwAAAQE"]
[Wed Dec 31 06:30:46.921138 2025] [:error] [pid 33004:tid 33085] [client 40.69.37.190:9607] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVRSlvogj9CrK-80KNwt4gAAAJQ"]
[Wed Dec 31 06:30:47.448021 2025] [:error] [pid 33109:tid 33133] [client 40.69.37.190:9620] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVRSl8YN9k_fnLM-n44AqQAAANY"]
[Wed Dec 31 06:30:47.967197 2025] [:error] [pid 33003:tid 33051] [client 40.69.37.190:9626] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aVRSl7OkdrCgTt0MxWL5RgAAAE0"]
[Wed Dec 31 06:30:48.481171 2025] [:error] [pid 26113:tid 26138] [client 40.69.37.190:9634] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aVRSmCU0NRJ9y9rL1aXPigAAARc"]
[Wed Dec 31 06:30:48.981208 2025] [:error] [pid 33109:tid 33119] [client 40.69.37.190:9469] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aVRSmMYN9k_fnLM-n44ArAAAAMg"]
[Wed Dec 31 06:30:49.499204 2025] [:error] [pid 33109:tid 33112] [client 40.69.37.190:9425] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aVRSmcYN9k_fnLM-n44AsQAAAME"]
[Wed Dec 31 06:30:49.998773 2025] [:error] [pid 33004:tid 33081] [client 40.69.37.190:9602] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aVRSmfogj9CrK-80KNwt5gAAAJA"]
[Wed Dec 31 06:30:50.519887 2025] [:error] [pid 33004:tid 33065] [client 40.69.37.190:9612] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aVRSmvogj9CrK-80KNwt5wAAAIA"]
[Wed Dec 31 06:30:51.021503 2025] [:error] [pid 26113:tid 26125] [client 40.69.37.190:9759] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aVRSmyU0NRJ9y9rL1aXPjQAAAQo"]
[Wed Dec 31 06:30:51.552304 2025] [:error] [pid 33002:tid 33023] [client 40.69.37.190:9609] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aVRSm_nsZEcORmTFnri_UwAAAAw"]
[Wed Dec 31 06:30:52.053536 2025] [:error] [pid 33003:tid 33062] [client 40.69.37.190:9442] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aVRSnLOkdrCgTt0MxWL5SgAAAFg"]
[Wed Dec 31 06:30:52.590843 2025] [:error] [pid 33004:tid 33077] [client 40.69.37.190:9436] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aVRSnPogj9CrK-80KNwt6gAAAIw"]
[Wed Dec 31 06:30:53.090658 2025] [:error] [pid 33002:tid 33018] [client 40.69.37.190:9728] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aVRSnfnsZEcORmTFnri_VQAAAAc"]
[Wed Dec 31 06:30:53.615893 2025] [:error] [pid 33109:tid 33122] [client 40.69.37.190:9624] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aVRSncYN9k_fnLM-n44AtQAAAMs"]
[Wed Dec 31 06:30:54.120019 2025] [:error] [pid 33004:tid 33076] [client 40.69.37.190:9427] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aVRSnvogj9CrK-80KNwt7gAAAIs"]
[Wed Dec 31 06:30:54.658778 2025] [:error] [pid 33004:tid 33079] [client 40.69.37.190:9451] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aVRSnvogj9CrK-80KNwt8QAAAI4"]
[Wed Dec 31 06:30:55.157824 2025] [:error] [pid 33004:tid 33086] [client 40.69.37.190:9449] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aVRSn_ogj9CrK-80KNwt8wAAAJU"]
[Wed Dec 31 06:30:55.698020 2025] [:error] [pid 33002:tid 33030] [client 40.69.37.190:9448] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aVRSn_nsZEcORmTFnri_WwAAABM"]
[Wed Dec 31 06:30:56.204121 2025] [:error] [pid 33002:tid 33021] [client 40.69.37.190:9467] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aVRSoPnsZEcORmTFnri_XAAAAAo"]
[Wed Dec 31 06:30:56.732101 2025] [:error] [pid 33002:tid 33025] [client 40.69.37.190:9418] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aVRSoPnsZEcORmTFnri_XQAAAA4"]
[Wed Dec 31 06:30:57.237019 2025] [:error] [pid 33004:tid 33082] [client 40.69.37.190:9423] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aVRSofogj9CrK-80KNwt-wAAAJE"]
[Wed Dec 31 06:30:57.757257 2025] [:error] [pid 26113:tid 26126] [client 40.69.37.190:9630] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aVRSoSU0NRJ9y9rL1aXPlgAAAQs"]
[Wed Dec 31 06:30:58.263122 2025] [:error] [pid 33004:tid 33066] [client 40.69.37.190:9757] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aVRSovogj9CrK-80KNwt_AAAAIE"]
[Wed Dec 31 06:30:59.148123 2025] [:error] [pid 33002:tid 33015] [client 40.69.37.190:9444] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aVRSo_nsZEcORmTFnri_YQAAAAQ"]
[Wed Dec 31 06:30:59.647660 2025] [:error] [pid 33002:tid 33029] [client 40.69.37.190:9660] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aVRSo_nsZEcORmTFnri_YgAAABI"]
[Wed Dec 31 06:31:00.148518 2025] [:error] [pid 33004:tid 33081] [client 40.69.37.190:9614] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aVRSpPogj9CrK-80KNwuAAAAAJA"]
[Wed Dec 31 06:31:00.653042 2025] [:error] [pid 26113:tid 26129] [client 40.69.37.190:9616] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aVRSpCU0NRJ9y9rL1aXPmQAAAQ4"]
[Wed Dec 31 06:31:01.153842 2025] [:error] [pid 33002:tid 33014] [client 40.69.37.190:9639] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aVRSpfnsZEcORmTFnri_ZgAAAAM"]
[Wed Dec 31 06:31:01.651766 2025] [:error] [pid 33004:tid 33074] [client 40.69.37.190:9443] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aVRSpfogj9CrK-80KNwuBQAAAIk"]
[Wed Dec 31 06:31:02.158852 2025] [:error] [pid 33003:tid 33043] [client 40.69.37.190:9439] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aVRSprOkdrCgTt0MxWL5VQAAAEU"]
[Wed Dec 31 06:31:02.680341 2025] [:error] [pid 33003:tid 33040] [client 40.69.37.190:9744] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aVRSprOkdrCgTt0MxWL5VgAAAEI"]
[Wed Dec 31 06:31:03.182981 2025] [:error] [pid 33002:tid 33021] [client 40.69.37.190:9743] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aVRSp_nsZEcORmTFnri_aQAAAAo"]
[Wed Dec 31 06:31:03.701790 2025] [:error] [pid 26113:tid 26134] [client 40.69.37.190:9433] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aVRSpyU0NRJ9y9rL1aXPnAAAARM"]
[Wed Dec 31 06:31:04.210048 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:9445] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aVRSqCU0NRJ9y9rL1aXPnQAAARI"]
[Wed Dec 31 06:31:04.742911 2025] [:error] [pid 33004:tid 33070] [client 40.69.37.190:9470] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aVRSqPogj9CrK-80KNwuCAAAAIU"]
[Wed Dec 31 06:31:05.245336 2025] [:error] [pid 33002:tid 33022] [client 40.69.37.190:9738] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aVRSqfnsZEcORmTFnri_agAAAAs"]
[Wed Dec 31 06:31:05.771181 2025] [:error] [pid 33002:tid 33019] [client 40.69.37.190:9733] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aVRSqfnsZEcORmTFnri_awAAAAg"]
[Wed Dec 31 06:31:06.281199 2025] [:error] [pid 33109:tid 33134] [client 40.69.37.190:9424] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aVRSqsYN9k_fnLM-n44AwgAAANc"]
[Wed Dec 31 06:31:06.808371 2025] [:error] [pid 33109:tid 33115] [client 40.69.37.190:9654] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aVRSqsYN9k_fnLM-n44AxQAAAMQ"]
[Wed Dec 31 06:31:07.307523 2025] [:error] [pid 33109:tid 33112] [client 40.69.37.190:9645] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aVRSq8YN9k_fnLM-n44AxgAAAME"]
[Wed Dec 31 06:31:07.828745 2025] [:error] [pid 33109:tid 33114] [client 40.69.37.190:9737] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aVRSq8YN9k_fnLM-n44AxwAAAMM"]
[Wed Dec 31 06:31:08.332453 2025] [:error] [pid 33004:tid 33075] [client 40.69.37.190:9466] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aVRSrPogj9CrK-80KNwuCgAAAIo"]
[Wed Dec 31 06:31:08.851057 2025] [:error] [pid 33003:tid 33045] [client 40.69.37.190:9770] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aVRSrLOkdrCgTt0MxWL5XwAAAEc"]
[Wed Dec 31 06:31:09.347838 2025] [:error] [pid 33004:tid 33086] [client 40.69.37.190:9438] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aVRSrfogj9CrK-80KNwuCwAAAJU"]
[Wed Dec 31 06:31:09.885697 2025] [:error] [pid 33002:tid 33028] [client 40.69.37.190:9462] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aVRSrfnsZEcORmTFnri_cwAAABE"]
[Wed Dec 31 06:31:10.403981 2025] [:error] [pid 33109:tid 33128] [client 40.69.37.190:9735] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aVRSrsYN9k_fnLM-n44AyQAAANE"]
[Wed Dec 31 06:31:10.924117 2025] [:error] [pid 26113:tid 26118] [client 40.69.37.190:9659] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aVRSriU0NRJ9y9rL1aXPoAAAAQM"]
[Wed Dec 31 06:31:11.446471 2025] [:error] [pid 33002:tid 33022] [client 40.69.37.190:9411] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aVRSr_nsZEcORmTFnri_fAAAAAs"]
[Wed Dec 31 06:31:11.953767 2025] [:error] [pid 33002:tid 33031] [client 40.69.37.190:9749] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aVRSr_nsZEcORmTFnri_gQAAABQ"]
[Wed Dec 31 06:31:12.457725 2025] [:error] [pid 33004:tid 33077] [client 40.69.37.190:10159] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lzyrj.php"] [unique_id "aVRSsPogj9CrK-80KNwuDgAAAIw"]
[Wed Dec 31 06:31:12.984860 2025] [:error] [pid 33109:tid 33120] [client 40.69.37.190:9617] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aVRSsMYN9k_fnLM-n44AywAAAMk"]
[Wed Dec 31 06:31:13.487464 2025] [:error] [pid 33109:tid 33123] [client 40.69.37.190:9409] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aVRSscYN9k_fnLM-n44AzAAAAMw"]
[Wed Dec 31 06:31:14.022389 2025] [:error] [pid 33002:tid 33030] [client 40.69.37.190:9465] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aVRSsvnsZEcORmTFnri_hgAAABM"]
[Wed Dec 31 06:31:14.521807 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:9420] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/laudq.php"] [unique_id "aVRSssYN9k_fnLM-n44AzQAAANU"]
[Wed Dec 31 06:31:15.058776 2025] [:error] [pid 33109:tid 33127] [client 40.69.37.190:9601] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aVRSs8YN9k_fnLM-n44AzgAAANA"]
[Wed Dec 31 06:31:15.567974 2025] [:error] [pid 26113:tid 26124] [client 40.69.37.190:9619] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aVRSsyU0NRJ9y9rL1aXPowAAAQk"]
[Wed Dec 31 06:31:16.080616 2025] [:error] [pid 33002:tid 33016] [client 40.69.37.190:9625] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aVRStPnsZEcORmTFnri_igAAAAU"]
[Wed Dec 31 06:31:16.585663 2025] [:error] [pid 33004:tid 33069] [client 40.69.37.190:9452] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aVRStPogj9CrK-80KNwuEAAAAIQ"]
[Wed Dec 31 06:31:17.138189 2025] [:error] [pid 33002:tid 33017] [client 40.69.37.190:9732] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aVRStfnsZEcORmTFnri_iwAAAAY"]
[Wed Dec 31 06:31:17.644034 2025] [:error] [pid 33002:tid 33019] [client 40.69.37.190:9649] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aVRStfnsZEcORmTFnri_jAAAAAg"]
[Wed Dec 31 06:31:18.159137 2025] [:error] [pid 33004:tid 33067] [client 40.69.37.190:9461] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aVRStvogj9CrK-80KNwuEgAAAII"]
[Wed Dec 31 06:31:18.677464 2025] [:error] [pid 33109:tid 33122] [client 40.69.37.190:9606] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aVRStsYN9k_fnLM-n44A0QAAAMs"]
[Wed Dec 31 06:31:19.195863 2025] [:error] [pid 33004:tid 33084] [client 40.69.37.190:9760] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVRSt_ogj9CrK-80KNwuEwAAAJM"]
[Wed Dec 31 06:31:19.705272 2025] [:error] [pid 33003:tid 33041] [client 40.69.37.190:9417] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVRSt7OkdrCgTt0MxWL5aAAAAEM"]
[Wed Dec 31 06:31:20.214639 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:9663] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVRSuCU0NRJ9y9rL1aXPpgAAARU"]
[Wed Dec 31 06:31:20.731162 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:9413] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVRSuCU0NRJ9y9rL1aXPqAAAAQU"]
[Wed Dec 31 06:31:21.246968 2025] [:error] [pid 33003:tid 33046] [client 40.69.37.190:9756] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRSubOkdrCgTt0MxWL5aQAAAEg"]
[Wed Dec 31 06:31:21.750899 2025] [:error] [pid 26113:tid 26115] [client 40.69.37.190:9431] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRSuSU0NRJ9y9rL1aXPqwAAAQA"]
[Wed Dec 31 06:31:22.324438 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:9658] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRSuiU0NRJ9y9rL1aXPrgAAARI"]
[Wed Dec 31 06:31:22.845832 2025] [:error] [pid 33004:tid 33082] [client 40.69.37.190:9772] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRSuvogj9CrK-80KNwuFQAAAJE"]
[Wed Dec 31 06:31:23.367512 2025] [:error] [pid 33004:tid 33070] [client 40.69.37.190:10114] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVRSu_ogj9CrK-80KNwuFgAAAIU"]
[Wed Dec 31 06:31:23.872915 2025] [:error] [pid 33003:tid 33056] [client 40.69.37.190:9768] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVRSu7OkdrCgTt0MxWL5bAAAAFI"]
[Wed Dec 31 06:31:24.389381 2025] [:error] [pid 26113:tid 26122] [client 40.69.37.190:9769] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVRSvCU0NRJ9y9rL1aXPsgAAAQc"]
[Wed Dec 31 06:31:24.911468 2025] [:error] [pid 33003:tid 33047] [client 40.69.37.190:9629] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aVRSvLOkdrCgTt0MxWL5bgAAAEk"]
[Wed Dec 31 06:31:25.423023 2025] [:error] [pid 33002:tid 33026] [client 40.69.37.190:9435] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aVRSvfnsZEcORmTFnri_jgAAAA8"]
[Wed Dec 31 06:31:25.944191 2025] [:error] [pid 33003:tid 33058] [client 40.69.37.190:9611] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aVRSvbOkdrCgTt0MxWL5cAAAAFQ"]
[Wed Dec 31 06:31:26.443881 2025] [:error] [pid 33003:tid 33060] [client 40.69.37.190:9766] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aVRSvrOkdrCgTt0MxWL5cQAAAFY"]
[Wed Dec 31 06:31:26.949538 2025] [:error] [pid 33003:tid 33044] [client 40.69.37.190:10128] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aVRSvrOkdrCgTt0MxWL5cgAAAEY"]
[Wed Dec 31 06:31:27.449425 2025] [:error] [pid 33109:tid 33129] [client 40.69.37.190:9776] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aVRSv8YN9k_fnLM-n44A2AAAANI"]
[Wed Dec 31 06:31:27.956246 2025] [:error] [pid 33109:tid 33128] [client 40.69.37.190:9746] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aVRSv8YN9k_fnLM-n44A2QAAANE"]
[Wed Dec 31 06:31:28.483159 2025] [:error] [pid 33109:tid 33126] [client 40.69.37.190:9640] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aVRSwMYN9k_fnLM-n44A2wAAAM8"]
[Wed Dec 31 06:31:28.982085 2025] [:error] [pid 33002:tid 33030] [client 40.69.37.190:9603] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aVRSwPnsZEcORmTFnri_kwAAABM"]
[Wed Dec 31 06:31:29.550797 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Wed Dec 31 06:31:29.811608 2025] [:error] [pid 33109:tid 33127] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Wed Dec 31 06:31:30.063357 2025] [:error] [pid 33109:tid 33113] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Dec 31 06:31:30.324997 2025] [:error] [pid 33109:tid 33116] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Wed Dec 31 06:31:30.580120 2025] [:error] [pid 33109:tid 33131] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Dec 31 06:31:30.844167 2025] [:error] [pid 33109:tid 33122] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Dec 31 06:31:31.097788 2025] [:error] [pid 33109:tid 33133] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Dec 31 06:31:31.352303 2025] [:error] [pid 33109:tid 33125] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Wed Dec 31 06:31:31.605385 2025] [:error] [pid 33109:tid 33121] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Dec 31 06:31:31.857779 2025] [:error] [pid 33109:tid 33115] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Wed Dec 31 06:31:32.110009 2025] [:error] [pid 33109:tid 33111] [client 40.69.37.190:9652] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Wed Dec 31 06:31:32.359826 2025] [:error] [pid 33109:tid 33112] [client 40.69.37.190:9652] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVRSxMYN9k_fnLM-n44A5wAAAME"]
[Wed Dec 31 06:31:32.863618 2025] [:error] [pid 33004:tid 33074] [client 40.69.37.190:9434] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVRSxPogj9CrK-80KNwuHwAAAIk"]
[Wed Dec 31 06:31:33.378900 2025] [:error] [pid 33004:tid 33089] [client 40.69.37.190:9637] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVRSxfogj9CrK-80KNwuIQAAAJg"]
[Wed Dec 31 06:31:33.883448 2025] [:error] [pid 33003:tid 33040] [client 40.69.37.190:9752] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVRSxbOkdrCgTt0MxWL5egAAAEI"]
[Wed Dec 31 06:31:34.395542 2025] [:error] [pid 33002:tid 33019] [client 40.69.37.190:10134] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVRSxvnsZEcORmTFnri_mQAAAAg"]
[Wed Dec 31 06:31:34.899242 2025] [:error] [pid 33002:tid 33027] [client 40.69.37.190:9791] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVRSxvnsZEcORmTFnri_mgAAABA"]
[Wed Dec 31 06:31:35.397440 2025] [:error] [pid 33003:tid 33044] [client 40.69.37.190:10151] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVRSx7OkdrCgTt0MxWL5fAAAAEY"]
[Wed Dec 31 06:31:35.940416 2025] [:error] [pid 33003:tid 33050] [client 40.69.37.190:9745] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aVRSx7OkdrCgTt0MxWL5fgAAAEw"]
[Wed Dec 31 06:31:36.448514 2025] [:error] [pid 33109:tid 33130] [client 40.69.37.190:9600] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aVRSyMYN9k_fnLM-n44A7gAAANM"]
[Wed Dec 31 06:31:36.967393 2025] [:error] [pid 33004:tid 33077] [client 40.69.37.190:9651] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aVRSyPogj9CrK-80KNwuKgAAAIw"]
[Wed Dec 31 06:31:37.467258 2025] [:error] [pid 33003:tid 33053] [client 40.69.37.190:9446] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aVRSybOkdrCgTt0MxWL5gAAAAE8"]
[Wed Dec 31 06:31:37.986640 2025] [:error] [pid 33003:tid 33048] [client 40.69.37.190:9412] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aVRSybOkdrCgTt0MxWL5gQAAAEo"]
[Wed Dec 31 06:31:38.497394 2025] [:error] [pid 33004:tid 33089] [client 40.69.37.190:9782] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aVRSyvogj9CrK-80KNwuLQAAAJg"]
[Wed Dec 31 06:31:39.067235 2025] [:error] [pid 26113:tid 26125] [client 40.69.37.190:10147] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aVRSyyU0NRJ9y9rL1aXPtgAAAQo"]
[Wed Dec 31 06:31:39.573318 2025] [:error] [pid 33004:tid 33066] [client 40.69.37.190:10119] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aVRSy_ogj9CrK-80KNwuLwAAAIE"]
[Wed Dec 31 06:31:40.074326 2025] [:error] [pid 26113:tid 26121] [client 40.69.37.190:10156] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aVRSzCU0NRJ9y9rL1aXPtwAAAQY"]
[Wed Dec 31 06:31:40.599672 2025] [:error] [pid 33109:tid 33121] [client 40.69.37.190:9783] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aVRSzMYN9k_fnLM-n44A9AAAAMo"]
[Wed Dec 31 06:31:41.136165 2025] [:error] [pid 26113:tid 26123] [client 40.69.37.190:9636] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aVRSzSU0NRJ9y9rL1aXPvAAAAQg"]
[Wed Dec 31 06:31:41.642684 2025] [:error] [pid 33003:tid 33055] [client 40.69.37.190:9429] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aVRSzbOkdrCgTt0MxWL5gwAAAFE"]
[Wed Dec 31 06:31:42.156985 2025] [:error] [pid 26113:tid 26127] [client 40.69.37.190:9662] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aVRSziU0NRJ9y9rL1aXPvQAAAQw"]
[Wed Dec 31 06:31:42.655960 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:9779] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVRSziU0NRJ9y9rL1aXPwQAAAQ0"]
[Wed Dec 31 06:31:43.200988 2025] [:error] [pid 26113:tid 26126] [client 40.69.37.190:9653] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVRSzyU0NRJ9y9rL1aXPwwAAAQs"]
[Wed Dec 31 06:31:43.797793 2025] [:error] [pid 26113:tid 26121] [client 40.69.37.190:10172] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVRSzyU0NRJ9y9rL1aXPxgAAAQY"]
[Wed Dec 31 06:31:44.348995 2025] [:error] [pid 33109:tid 33120] [client 40.69.37.190:9767] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aVRS0MYN9k_fnLM-n44A9wAAAMk"]
[Wed Dec 31 06:31:44.887503 2025] [:error] [pid 26113:tid 26118] [client 40.69.37.190:9454] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVRS0CU0NRJ9y9rL1aXPyQAAAQM"]
[Wed Dec 31 06:31:45.634761 2025] [:error] [pid 33003:tid 33061] [client 40.69.37.190:10157] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVRS0bOkdrCgTt0MxWL5kwAAAFc"]
[Wed Dec 31 06:31:46.196746 2025] [:error] [pid 33109:tid 33123] [client 40.69.37.190:10160] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVRS0sYN9k_fnLM-n44A-QAAAMw"]
[Wed Dec 31 06:31:46.736589 2025] [:error] [pid 33002:tid 33028] [client 40.69.37.190:9376] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVRS0vnsZEcORmTFnri_nAAAABE"]
[Wed Dec 31 06:31:47.251650 2025] [:error] [pid 33002:tid 33018] [client 40.69.37.190:10121] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS0_nsZEcORmTFnri_ngAAAAc"]
[Wed Dec 31 06:31:47.822594 2025] [:error] [pid 33002:tid 33020] [client 40.69.37.190:9753] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS0_nsZEcORmTFnri_oAAAAAk"]
[Wed Dec 31 06:31:48.386426 2025] [:error] [pid 26113:tid 26124] [client 40.69.37.190:10155] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS1CU0NRJ9y9rL1aXPzQAAAQk"]
[Wed Dec 31 06:31:48.908851 2025] [:error] [pid 33002:tid 33021] [client 40.69.37.190:9762] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS1PnsZEcORmTFnri_owAAAAo"]
[Wed Dec 31 06:31:49.435985 2025] [:error] [pid 26113:tid 26117] [client 40.69.37.190:9362] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aVRS1SU0NRJ9y9rL1aXPzgAAAQI"]
[Wed Dec 31 06:31:49.939002 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:9761] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aVRS1SU0NRJ9y9rL1aXP0gAAAQU"]
[Wed Dec 31 06:31:50.499893 2025] [:error] [pid 33002:tid 33022] [client 40.69.37.190:10152] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aVRS1vnsZEcORmTFnri_pQAAAAs"]
[Wed Dec 31 06:31:51.076139 2025] [:error] [pid 33003:tid 33046] [client 40.69.37.190:9610] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aVRS17OkdrCgTt0MxWL5qgAAAEg"]
[Wed Dec 31 06:31:51.582709 2025] [:error] [pid 33003:tid 33040] [client 40.69.37.190:9787] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aVRS17OkdrCgTt0MxWL5rgAAAEI"]
[Wed Dec 31 06:31:52.093637 2025] [:error] [pid 33002:tid 33018] [client 40.69.37.190:9730] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aVRS2PnsZEcORmTFnri_qwAAAAc"]
[Wed Dec 31 06:31:52.595686 2025] [:error] [pid 33004:tid 33074] [client 40.69.37.190:9642] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aVRS2Pogj9CrK-80KNwuMgAAAIk"]
[Wed Dec 31 06:31:53.093385 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:9788] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aVRS2SU0NRJ9y9rL1aXP1QAAARE"]
[Wed Dec 31 06:31:53.622477 2025] [:error] [pid 33004:tid 33085] [client 40.69.37.190:9646] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVRS2fogj9CrK-80KNwuNgAAAJQ"]
[Wed Dec 31 06:31:54.153976 2025] [:error] [pid 26113:tid 26127] [client 40.69.37.190:9458] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVRS2iU0NRJ9y9rL1aXP1wAAAQw"]
[Wed Dec 31 06:31:54.677512 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:9632] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVRS2sYN9k_fnLM-n44BBAAAANU"]
[Wed Dec 31 06:31:55.188109 2025] [:error] [pid 33109:tid 33113] [client 40.69.37.190:9786] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVRS28YN9k_fnLM-n44BBQAAAMI"]
[Wed Dec 31 06:31:55.706873 2025] [:error] [pid 26113:tid 26126] [client 40.69.37.190:49284] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aVRS2yU0NRJ9y9rL1aXP2wAAAQs"]
[Wed Dec 31 06:31:56.208227 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:9460] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aVRS3CU0NRJ9y9rL1aXP3AAAAQU"]
[Wed Dec 31 06:31:56.722224 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:9463] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aVRS3CU0NRJ9y9rL1aXP3gAAARU"]
[Wed Dec 31 06:31:57.263860 2025] [:error] [pid 26113:tid 26139] [client 40.69.37.190:9742] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aVRS3SU0NRJ9y9rL1aXP4AAAARg"]
[Wed Dec 31 06:31:57.786123 2025] [:error] [pid 33003:tid 33059] [client 40.69.37.190:10141] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aVRS3bOkdrCgTt0MxWL5swAAAFU"]
[Wed Dec 31 06:31:58.283461 2025] [:error] [pid 33109:tid 33111] [client 40.69.37.190:9734] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aVRS3sYN9k_fnLM-n44BCQAAAMA"]
[Wed Dec 31 06:31:58.787887 2025] [:error] [pid 33002:tid 33022] [client 40.69.37.190:10153] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aVRS3vnsZEcORmTFnri_sAAAAAs"]
[Wed Dec 31 06:31:59.309351 2025] [:error] [pid 33004:tid 33078] [client 40.69.37.190:9656] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aVRS3_ogj9CrK-80KNwuPwAAAI0"]
[Wed Dec 31 06:31:59.823914 2025] [:error] [pid 26113:tid 26118] [client 40.69.37.190:9459] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aVRS3yU0NRJ9y9rL1aXP4gAAAQM"]
[Wed Dec 31 06:32:00.324604 2025] [:error] [pid 33003:tid 33055] [client 40.69.37.190:9748] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aVRS4LOkdrCgTt0MxWL5tgAAAFE"]
[Wed Dec 31 06:32:00.877637 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:10167] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aVRS4CU0NRJ9y9rL1aXP5AAAARE"]
[Wed Dec 31 06:32:01.382736 2025] [:error] [pid 33004:tid 33071] [client 40.69.37.190:10150] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aVRS4fogj9CrK-80KNwuQwAAAIY"]
[Wed Dec 31 06:32:01.947298 2025] [:error] [pid 33004:tid 33074] [client 40.69.37.190:9432] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aVRS4fogj9CrK-80KNwuRAAAAIk"]
[Wed Dec 31 06:32:02.461340 2025] [:error] [pid 33003:tid 33052] [client 40.69.37.190:9758] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aVRS4rOkdrCgTt0MxWL5twAAAE4"]
[Wed Dec 31 06:32:02.979957 2025] [:error] [pid 33109:tid 33121] [client 40.69.37.190:10135] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aVRS4sYN9k_fnLM-n44BCwAAAMo"]
[Wed Dec 31 06:32:03.484248 2025] [:error] [pid 33003:tid 33044] [client 40.69.37.190:9775] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aVRS47OkdrCgTt0MxWL5vwAAAEY"]
[Wed Dec 31 06:32:04.005384 2025] [:error] [pid 33004:tid 33076] [client 40.69.37.190:9774] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aVRS5Pogj9CrK-80KNwuUwAAAIs"]
[Wed Dec 31 06:32:04.508870 2025] [:error] [pid 33002:tid 33026] [client 40.69.37.190:10137] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aVRS5PnsZEcORmTFnri_tQAAAA8"]
[Wed Dec 31 06:32:05.008235 2025] [:error] [pid 33002:tid 33028] [client 40.69.37.190:9763] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aVRS5fnsZEcORmTFnri_uAAAABE"]
[Wed Dec 31 06:32:05.531273 2025] [:error] [pid 33004:tid 33079] [client 40.69.37.190:10143] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aVRS5fogj9CrK-80KNwuYAAAAI4"]
[Wed Dec 31 06:32:06.030512 2025] [:error] [pid 33004:tid 33075] [client 40.69.37.190:9406] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aVRS5vogj9CrK-80KNwuZQAAAIo"]
[Wed Dec 31 06:32:06.556472 2025] [:error] [pid 26113:tid 26127] [client 40.69.37.190:10126] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aVRS5iU0NRJ9y9rL1aXP-QAAAQw"]
[Wed Dec 31 06:32:07.061296 2025] [:error] [pid 33002:tid 33020] [client 40.69.37.190:10163] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aVRS5_nsZEcORmTFnri_uQAAAAk"]
[Wed Dec 31 06:32:07.558588 2025] [:error] [pid 33003:tid 33056] [client 40.69.37.190:9773] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aVRS57OkdrCgTt0MxWL59gAAAFI"]
[Wed Dec 31 06:32:08.073835 2025] [:error] [pid 26113:tid 26122] [client 40.69.37.190:10136] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aVRS6CU0NRJ9y9rL1aXP_QAAAQc"]
[Wed Dec 31 06:32:08.576424 2025] [:error] [pid 26113:tid 26125] [client 40.69.37.190:9739] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aVRS6CU0NRJ9y9rL1aXP_wAAAQo"]
[Wed Dec 31 06:32:09.110335 2025] [:error] [pid 26113:tid 26129] [client 40.69.37.190:9736] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aVRS6SU0NRJ9y9rL1aXQBAAAAQ4"]
[Wed Dec 31 06:32:09.615211 2025] [:error] [pid 33002:tid 33013] [client 40.69.37.190:9638] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aVRS6fnsZEcORmTFnri_ugAAAAI"]
[Wed Dec 31 06:32:10.131628 2025] [:error] [pid 33109:tid 33128] [client 40.69.37.190:9731] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aVRS6sYN9k_fnLM-n44BDwAAANE"]
[Wed Dec 31 06:32:10.633506 2025] [:error] [pid 26113:tid 26118] [client 40.69.37.190:9781] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aVRS6iU0NRJ9y9rL1aXQBQAAAQM"]
[Wed Dec 31 06:32:11.177136 2025] [:error] [pid 26113:tid 26123] [client 40.69.37.190:9405] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aVRS6yU0NRJ9y9rL1aXQBwAAAQg"]
[Wed Dec 31 06:32:11.689620 2025] [:error] [pid 26113:tid 26135] [client 40.69.37.190:9353] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aa.php"] [unique_id "aVRS6yU0NRJ9y9rL1aXQCgAAARQ"]
[Wed Dec 31 06:32:12.217441 2025] [:error] [pid 33004:tid 33088] [client 40.69.37.190:9764] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aVRS7Pogj9CrK-80KNwudAAAAJc"]
[Wed Dec 31 06:32:12.719218 2025] [:error] [pid 33004:tid 33070] [client 40.69.37.190:9364] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aVRS7Pogj9CrK-80KNwueAAAAIU"]
[Wed Dec 31 06:32:13.248415 2025] [:error] [pid 33002:tid 33029] [client 40.69.37.190:9447] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aVRS7fnsZEcORmTFnri_vwAAABI"]
[Wed Dec 31 06:32:13.746511 2025] [:error] [pid 33109:tid 33122] [client 40.69.37.190:9650] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cart.php"] [unique_id "aVRS7cYN9k_fnLM-n44BFQAAAMs"]
[Wed Dec 31 06:32:14.301191 2025] [:error] [pid 33003:tid 33058] [client 40.69.37.190:10116] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aVRS7rOkdrCgTt0MxWL5-wAAAFQ"]
[Wed Dec 31 06:32:14.802414 2025] [:error] [pid 33003:tid 33051] [client 40.69.37.190:9765] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aVRS7rOkdrCgTt0MxWL5_AAAAE0"]
[Wed Dec 31 06:32:15.351506 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:9344] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aVRS7yU0NRJ9y9rL1aXQDwAAARU"]
[Wed Dec 31 06:32:15.860054 2025] [:error] [pid 26113:tid 26134] [client 40.69.37.190:10174] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/compare.php"] [unique_id "aVRS7yU0NRJ9y9rL1aXQEQAAARM"]
[Wed Dec 31 06:32:16.379361 2025] [:error] [pid 26113:tid 26139] [client 40.69.37.190:9641] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aVRS8CU0NRJ9y9rL1aXQEgAAARg"]
[Wed Dec 31 06:32:16.947763 2025] [:error] [pid 33004:tid 33082] [client 40.69.37.190:10170] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aVRS8Pogj9CrK-80KNwugAAAAJE"]
[Wed Dec 31 06:32:17.448417 2025] [:error] [pid 33109:tid 33114] [client 40.69.37.190:9661] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aVRS8cYN9k_fnLM-n44BFwAAAMM"]
[Wed Dec 31 06:32:17.963521 2025] [:error] [pid 33109:tid 33118] [client 40.69.37.190:9784] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aVRS8cYN9k_fnLM-n44BGQAAAMc"]
[Wed Dec 31 06:32:18.496729 2025] [:error] [pid 33109:tid 33119] [client 40.69.37.190:9780] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS8sYN9k_fnLM-n44BGgAAAMg"]
[Wed Dec 31 06:32:19.009291 2025] [:error] [pid 33002:tid 33018] [client 40.69.37.190:9361] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS8_nsZEcORmTFnri_wgAAAAc"]
[Wed Dec 31 06:32:19.506739 2025] [:error] [pid 33002:tid 33023] [client 40.69.37.190:9349] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS8_nsZEcORmTFnri_wwAAAAw"]
[Wed Dec 31 06:32:20.011471 2025] [:error] [pid 26113:tid 26116] [client 40.69.37.190:9385] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aVRS9CU0NRJ9y9rL1aXQFQAAAQE"]
[Wed Dec 31 06:32:20.520859 2025] [:error] [pid 33109:tid 33128] [client 40.69.37.190:10166] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVRS9MYN9k_fnLM-n44BHQAAANE"]
[Wed Dec 31 06:32:21.020854 2025] [:error] [pid 33109:tid 33123] [client 40.69.37.190:9357] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVRS9cYN9k_fnLM-n44BHwAAAMw"]
[Wed Dec 31 06:32:21.546991 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:9367] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVRS9cYN9k_fnLM-n44BIAAAANU"]
[Wed Dec 31 06:32:22.047775 2025] [:error] [pid 33003:tid 33048] [client 40.69.37.190:10125] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aVRS9rOkdrCgTt0MxWL6AQAAAEo"]
[Wed Dec 31 06:32:22.635626 2025] [:error] [pid 33109:tid 33125] [client 40.69.37.190:9468] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aVRS9sYN9k_fnLM-n44BIwAAAM4"]
[Wed Dec 31 06:32:23.154767 2025] [:error] [pid 33002:tid 33028] [client 40.69.37.190:9655] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aVRS9_nsZEcORmTFnri_xQAAABE"]
[Wed Dec 31 06:32:23.672568 2025] [:error] [pid 33109:tid 33115] [client 40.69.37.190:9345] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aVRS98YN9k_fnLM-n44BJQAAAMQ"]
[Wed Dec 31 06:32:24.179172 2025] [:error] [pid 26113:tid 26125] [client 40.69.37.190:10139] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atom.php"] [unique_id "aVRS-CU0NRJ9y9rL1aXQGAAAAQo"]
[Wed Dec 31 06:32:24.709675 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:10158] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aVRS-CU0NRJ9y9rL1aXQGQAAAQ0"]
[Wed Dec 31 06:32:25.266817 2025] [:error] [pid 33004:tid 33071] [client 40.69.37.190:9370] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aVRS-fogj9CrK-80KNwuhAAAAIY"]
[Wed Dec 31 06:32:25.784057 2025] [:error] [pid 33109:tid 33120] [client 40.69.37.190:9631] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aVRS-cYN9k_fnLM-n44BKQAAAMk"]
[Wed Dec 31 06:32:26.293383 2025] [:error] [pid 33002:tid 33025] [client 40.69.37.190:9396] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/case.php"] [unique_id "aVRS-vnsZEcORmTFnri_yAAAAA4"]
[Wed Dec 31 06:32:26.795486 2025] [:error] [pid 33109:tid 33128] [client 40.69.37.190:10168] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aVRS-sYN9k_fnLM-n44BKgAAANE"]
[Wed Dec 31 06:32:27.296605 2025] [:error] [pid 26113:tid 26134] [client 40.69.37.190:9393] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aVRS-yU0NRJ9y9rL1aXQHAAAARM"]
[Wed Dec 31 06:32:27.811627 2025] [:error] [pid 33004:tid 33085] [client 40.69.37.190:10117] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aVRS-_ogj9CrK-80KNwuiAAAAJQ"]
[Wed Dec 31 06:32:28.324759 2025] [:error] [pid 33002:tid 33032] [client 40.69.37.190:9777] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/docs.php"] [unique_id "aVRS_PnsZEcORmTFnri_ygAAABU"]
[Wed Dec 31 06:32:28.822363 2025] [:error] [pid 33004:tid 33088] [client 40.69.37.190:9352] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aVRS_Pogj9CrK-80KNwujQAAAJc"]
[Wed Dec 31 06:32:29.321310 2025] [:error] [pid 33002:tid 33031] [client 40.69.37.190:49292] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aVRS_fnsZEcORmTFnri_ywAAABQ"]
[Wed Dec 31 06:32:29.836419 2025] [:error] [pid 33004:tid 33068] [client 40.69.37.190:9648] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aVRS_fogj9CrK-80KNwujwAAAIM"]
[Wed Dec 31 06:32:30.334736 2025] [:error] [pid 33004:tid 33083] [client 40.69.37.190:9740] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ios.php"] [unique_id "aVRS_vogj9CrK-80KNwukQAAAJI"]
[Wed Dec 31 06:32:30.862195 2025] [:error] [pid 33002:tid 33018] [client 40.69.37.190:9386] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVRS_vnsZEcORmTFnri_zwAAAAc"]
[Wed Dec 31 06:32:31.360997 2025] [:error] [pid 33109:tid 33113] [client 40.69.37.190:9346] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVRS_8YN9k_fnLM-n44BLQAAAMI"]
[Wed Dec 31 06:32:31.904209 2025] [:error] [pid 33002:tid 33027] [client 40.69.37.190:9778] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVRS__nsZEcORmTFnri_0QAAABA"]
[Wed Dec 31 06:32:32.405800 2025] [:error] [pid 26113:tid 26130] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Dec 31 06:32:32.658399 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Dec 31 06:32:32.911192 2025] [:error] [pid 26113:tid 26135] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Dec 31 06:32:33.164990 2025] [:error] [pid 26113:tid 26127] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Dec 31 06:32:33.418102 2025] [:error] [pid 26113:tid 26116] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Wed Dec 31 06:32:33.670759 2025] [:error] [pid 26113:tid 26137] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/goat1.php
[Wed Dec 31 06:32:33.923480 2025] [:error] [pid 26113:tid 26115] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/f.php
[Wed Dec 31 06:32:34.175704 2025] [:error] [pid 26113:tid 26124] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Wed Dec 31 06:32:34.428636 2025] [:error] [pid 26113:tid 26125] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Dec 31 06:32:34.681359 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Dec 31 06:32:34.937035 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:9372] File does not exist: /usr/local/apache/htdocs/suspended-page/v.php
[Wed Dec 31 06:32:35.187049 2025] [:error] [pid 26113:tid 26138] [client 40.69.37.190:9372] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRTAyU0NRJ9y9rL1aXQLAAAARc"]
[Wed Dec 31 06:32:35.684768 2025] [:error] [pid 33003:tid 33041] [client 40.69.37.190:9347] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRTA7OkdrCgTt0MxWL6CwAAAEM"]
[Wed Dec 31 06:32:36.182703 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:10131] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRTBCU0NRJ9y9rL1aXQLQAAAQU"]
[Wed Dec 31 06:32:36.681051 2025] [:error] [pid 33003:tid 33048] [client 40.69.37.190:9785] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aVRTBLOkdrCgTt0MxWL6DQAAAEo"]
[Wed Dec 31 06:32:37.183133 2025] [:error] [pid 33004:tid 33069] [client 40.69.37.190:10132] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aVRTBfogj9CrK-80KNwunwAAAIQ"]
[Wed Dec 31 06:32:37.693089 2025] [:error] [pid 26113:tid 26130] [client 40.69.37.190:10144] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aVRTBSU0NRJ9y9rL1aXQLwAAAQ8"]
[Wed Dec 31 06:32:38.201660 2025] [:error] [pid 33004:tid 33089] [client 40.69.37.190:9741] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aVRTBvogj9CrK-80KNwuogAAAJg"]
[Wed Dec 31 06:32:38.707454 2025] [:error] [pid 33004:tid 33088] [client 40.69.37.190:10129] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aVRTBvogj9CrK-80KNwuowAAAJc"]
[Wed Dec 31 06:32:39.207857 2025] [:error] [pid 33004:tid 33087] [client 40.69.37.190:10122] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aVRTB_ogj9CrK-80KNwupAAAAJY"]
[Wed Dec 31 06:32:39.708736 2025] [:error] [pid 33002:tid 33032] [client 40.69.37.190:9363] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aVRTB_nsZEcORmTFnri_2AAAABU"]
[Wed Dec 31 06:32:40.207830 2025] [:error] [pid 33004:tid 33083] [client 40.69.37.190:10127] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aVRTCPogj9CrK-80KNwupwAAAJI"]
[Wed Dec 31 06:32:40.716445 2025] [:error] [pid 33002:tid 33019] [client 40.69.37.190:9468] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aVRTCPnsZEcORmTFnri_2wAAAAg"]
[Wed Dec 31 06:32:41.233300 2025] [:error] [pid 33002:tid 33029] [client 40.69.37.190:9407] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aVRTCfnsZEcORmTFnri_3QAAABI"]
[Wed Dec 31 06:32:41.731708 2025] [:error] [pid 26113:tid 26124] [client 40.69.37.190:9789] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aVRTCSU0NRJ9y9rL1aXQOAAAAQk"]
[Wed Dec 31 06:32:42.290005 2025] [:error] [pid 33003:tid 33040] [client 40.69.37.190:49316] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aVRTCrOkdrCgTt0MxWL6EwAAAEI"]
[Wed Dec 31 06:32:42.788361 2025] [:error] [pid 33004:tid 33071] [client 40.69.37.190:9365] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aVRTCvogj9CrK-80KNwuqwAAAIY"]
[Wed Dec 31 06:32:43.309105 2025] [:error] [pid 33004:tid 33067] [client 40.69.37.190:9366] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aVRTC_ogj9CrK-80KNwurAAAAII"]
[Wed Dec 31 06:32:43.806761 2025] [:error] [pid 33109:tid 33118] [client 40.69.37.190:10112] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aVRTC8YN9k_fnLM-n44BMwAAAMc"]
[Wed Dec 31 06:32:44.344696 2025] [:error] [pid 26113:tid 26119] [client 40.69.37.190:49283] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aVRTDCU0NRJ9y9rL1aXQPgAAAQQ"]
[Wed Dec 31 06:32:44.860820 2025] [:error] [pid 26113:tid 26123] [client 40.69.37.190:49281] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aVRTDCU0NRJ9y9rL1aXQQQAAAQg"]
[Wed Dec 31 06:32:45.368347 2025] [:error] [pid 33109:tid 33120] [client 40.69.37.190:9350] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aVRTDcYN9k_fnLM-n44BNQAAAMk"]
[Wed Dec 31 06:32:45.867325 2025] [:error] [pid 33109:tid 33119] [client 40.69.37.190:9395] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aVRTDcYN9k_fnLM-n44BNgAAAMg"]
[Wed Dec 31 06:32:46.408391 2025] [:error] [pid 26113:tid 26118] [client 40.69.37.190:49301] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aVRTDiU0NRJ9y9rL1aXQRgAAAQM"]
[Wed Dec 31 06:32:46.918439 2025] [:error] [pid 26113:tid 26139] [client 40.69.37.190:10124] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aVRTDiU0NRJ9y9rL1aXQSQAAARg"]
[Wed Dec 31 06:32:47.484319 2025] [:error] [pid 33002:tid 33032] [client 40.69.37.190:10133] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVRTD_nsZEcORmTFnri_4wAAABU"]
[Wed Dec 31 06:32:47.996812 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:9360] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVRTD8YN9k_fnLM-n44BOQAAANU"]
[Wed Dec 31 06:32:48.522394 2025] [:error] [pid 33002:tid 33034] [client 40.69.37.190:9755] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVRTEPnsZEcORmTFnri_5QAAABc"]
[Wed Dec 31 06:32:49.024840 2025] [:error] [pid 33004:tid 33069] [client 40.69.37.190:10175] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aVRTEfogj9CrK-80KNwurwAAAIQ"]
[Wed Dec 31 06:32:49.526264 2025] [:error] [pid 33109:tid 33131] [client 40.69.37.190:10115] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aVRTEcYN9k_fnLM-n44BPAAAANQ"]
[Wed Dec 31 06:32:50.027270 2025] [:error] [pid 33109:tid 33117] [client 40.69.37.190:9388] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aVRTEsYN9k_fnLM-n44BPQAAAMY"]
[Wed Dec 31 06:32:50.592411 2025] [:error] [pid 33109:tid 33125] [client 40.69.37.190:9374] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aVRTEsYN9k_fnLM-n44BPwAAAM4"]
[Wed Dec 31 06:32:51.124092 2025] [:error] [pid 33109:tid 33121] [client 40.69.37.190:9354] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aVRTE8YN9k_fnLM-n44BQQAAAMo"]
[Wed Dec 31 06:32:51.638098 2025] [:error] [pid 33004:tid 33083] [client 40.69.37.190:49339] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVRTE_ogj9CrK-80KNwusgAAAJI"]
[Wed Dec 31 06:32:52.148533 2025] [:error] [pid 33004:tid 33086] [client 40.69.37.190:10123] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVRTFPogj9CrK-80KNwuswAAAJU"]
[Wed Dec 31 06:32:52.659255 2025] [:error] [pid 26113:tid 26130] [client 40.69.37.190:9390] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVRTFCU0NRJ9y9rL1aXQTgAAAQ8"]
[Wed Dec 31 06:32:53.173349 2025] [:error] [pid 33109:tid 33119] [client 40.69.37.190:10142] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aVRTFcYN9k_fnLM-n44BRQAAAMg"]
[Wed Dec 31 06:32:53.680765 2025] [:error] [pid 33109:tid 33134] [client 40.69.37.190:9414] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVRTFcYN9k_fnLM-n44BRgAAANc"]
[Wed Dec 31 06:32:54.178376 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:9394] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVRTFsYN9k_fnLM-n44BSAAAANU"]
[Wed Dec 31 06:32:54.720818 2025] [:error] [pid 33109:tid 33130] [client 40.69.37.190:9391] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVRTFsYN9k_fnLM-n44BTQAAANM"]
[Wed Dec 31 06:32:55.236371 2025] [:error] [pid 33109:tid 33122] [client 40.69.37.190:10118] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVRTF8YN9k_fnLM-n44BUAAAAMs"]
[Wed Dec 31 06:32:55.757034 2025] [:error] [pid 33109:tid 33121] [client 40.69.37.190:10162] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aVRTF8YN9k_fnLM-n44BUwAAAMo"]
[Wed Dec 31 06:32:56.267374 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:9618] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aVRTGCU0NRJ9y9rL1aXQUAAAARU"]
[Wed Dec 31 06:32:56.780609 2025] [:error] [pid 33004:tid 33079] [client 40.69.37.190:10148] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aVRTGPogj9CrK-80KNwutgAAAI4"]
[Wed Dec 31 06:32:57.278386 2025] [:error] [pid 33004:tid 33075] [client 40.69.37.190:10169] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aVRTGfogj9CrK-80KNwutwAAAIo"]
[Wed Dec 31 06:32:57.817297 2025] [:error] [pid 33109:tid 33123] [client 40.69.37.190:9959] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aVRTGcYN9k_fnLM-n44BVwAAAMw"]
[Wed Dec 31 06:32:58.316673 2025] [:error] [pid 33003:tid 33053] [client 40.69.37.190:9381] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aVRTGrOkdrCgTt0MxWL6FQAAAE8"]
[Wed Dec 31 06:32:58.883810 2025] [:error] [pid 26113:tid 26129] [client 40.69.37.190:9378] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aVRTGiU0NRJ9y9rL1aXQWQAAAQ4"]
[Wed Dec 31 06:32:59.397498 2025] [:error] [pid 33004:tid 33084] [client 40.69.37.190:9375] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aVRTG_ogj9CrK-80KNwuuQAAAJM"]
[Wed Dec 31 06:32:59.957670 2025] [:error] [pid 33002:tid 33017] [client 40.69.37.190:49296] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aVRTG_nsZEcORmTFnri_6gAAAAY"]
[Wed Dec 31 06:33:00.471017 2025] [:error] [pid 33002:tid 33035] [client 40.69.37.190:49295] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aVRTHPnsZEcORmTFnri_6wAAABg"]
[Wed Dec 31 06:33:00.983915 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:9751] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aVRTHCU0NRJ9y9rL1aXQXQAAARE"]
[Wed Dec 31 06:33:01.496877 2025] [:error] [pid 26113:tid 26131] [client 40.69.37.190:10146] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aVRTHSU0NRJ9y9rL1aXQXgAAARA"]
[Wed Dec 31 06:33:02.034638 2025] [:error] [pid 33004:tid 33066] [client 40.69.37.190:9784] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aVRTHvogj9CrK-80KNwuvAAAAIE"]
[Wed Dec 31 06:33:02.533794 2025] [:error] [pid 33004:tid 33081] [client 40.69.37.190:9621] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aVRTHvogj9CrK-80KNwuvwAAAJA"]
[Wed Dec 31 06:33:03.045183 2025] [:error] [pid 33003:tid 33056] [client 40.69.37.190:9633] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aVRTH7OkdrCgTt0MxWL6GQAAAFI"]
[Wed Dec 31 06:33:03.552544 2025] [:error] [pid 33004:tid 33083] [client 40.69.37.190:49328] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aVRTH_ogj9CrK-80KNwuwAAAAJI"]
[Wed Dec 31 06:33:04.082003 2025] [:error] [pid 33004:tid 33072] [client 40.69.37.190:9356] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aVRTIPogj9CrK-80KNwuwgAAAIc"]
[Wed Dec 31 06:33:04.581935 2025] [:error] [pid 33004:tid 33065] [client 40.69.37.190:10164] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aVRTIPogj9CrK-80KNwuxAAAAIA"]
[Wed Dec 31 06:33:05.085618 2025] [:error] [pid 33004:tid 33075] [client 40.69.37.190:49313] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aVRTIfogj9CrK-80KNwuxQAAAIo"]
[Wed Dec 31 06:33:05.584608 2025] [:error] [pid 33004:tid 33076] [client 40.69.37.190:10120] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aVRTIfogj9CrK-80KNwuyAAAAIs"]
[Wed Dec 31 06:33:06.090408 2025] [:error] [pid 26113:tid 26118] [client 40.69.37.190:9348] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aVRTIiU0NRJ9y9rL1aXQYwAAAQM"]
[Wed Dec 31 06:33:06.594316 2025] [:error] [pid 26113:tid 26117] [client 40.69.37.190:9377] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aVRTIiU0NRJ9y9rL1aXQZAAAAQI"]
[Wed Dec 31 06:33:07.113323 2025] [:error] [pid 33003:tid 33040] [client 40.69.37.190:9790] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aVRTI7OkdrCgTt0MxWL6HQAAAEI"]
[Wed Dec 31 06:33:07.617565 2025] [:error] [pid 33004:tid 33069] [client 40.69.37.190:10149] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aVRTI_ogj9CrK-80KNwuywAAAIQ"]
[Wed Dec 31 06:33:08.160071 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:49311] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVRTJCU0NRJ9y9rL1aXQaAAAARE"]
[Wed Dec 31 06:33:08.662667 2025] [:error] [pid 33003:tid 33050] [client 40.69.37.190:49302] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVRTJLOkdrCgTt0MxWL6HgAAAEw"]
[Wed Dec 31 06:33:09.224602 2025] [:error] [pid 26113:tid 26129] [client 40.69.37.190:9939] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVRTJSU0NRJ9y9rL1aXQbAAAAQ4"]
[Wed Dec 31 06:33:09.741357 2025] [:error] [pid 33003:tid 33049] [client 40.69.37.190:9771] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aVRTJbOkdrCgTt0MxWL6IQAAAEs"]
[Wed Dec 31 06:33:10.241122 2025] [:error] [pid 33003:tid 33055] [client 40.69.37.190:49308] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVRTJrOkdrCgTt0MxWL6IwAAAFE"]
[Wed Dec 31 06:33:10.743518 2025] [:error] [pid 33002:tid 33029] [client 40.69.37.190:9397] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVRTJvnsZEcORmTFnri_8QAAABI"]
[Wed Dec 31 06:33:11.272756 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:9404] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVRTJyU0NRJ9y9rL1aXQcQAAAQU"]
[Wed Dec 31 06:33:11.776692 2025] [:error] [pid 33003:tid 33054] [client 40.69.37.190:9368] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVRTJ7OkdrCgTt0MxWL6MgAAAFA"]
[Wed Dec 31 06:33:12.308944 2025] [:error] [pid 33003:tid 33046] [client 40.69.37.190:9359] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aVRTKLOkdrCgTt0MxWL6NwAAAEg"]
[Wed Dec 31 06:33:12.817809 2025] [:error] [pid 26113:tid 26122] [client 40.69.37.190:49300] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aVRTKCU0NRJ9y9rL1aXQdQAAAQc"]
[Wed Dec 31 06:33:13.347101 2025] [:error] [pid 33109:tid 33111] [client 40.69.37.190:10165] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aVRTKcYN9k_fnLM-n44BXAAAAMA"]
[Wed Dec 31 06:33:13.873747 2025] [:error] [pid 33109:tid 33115] [client 40.69.37.190:9389] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aVRTKcYN9k_fnLM-n44BXQAAAMQ"]
[Wed Dec 31 06:33:15.377031 2025] [:error] [pid 33109:tid 33131] [client 40.69.37.190:9358] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aVRTK8YN9k_fnLM-n44BYAAAANQ"]
[Wed Dec 31 06:33:15.890465 2025] [:error] [pid 33002:tid 33018] [client 40.69.37.190:9382] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aVRTK_nsZEcORmTFnri_8wAAAAc"]
[Wed Dec 31 06:33:16.397423 2025] [:error] [pid 33003:tid 33047] [client 40.69.37.190:9402] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aVRTLLOkdrCgTt0MxWL6PgAAAEk"]
[Wed Dec 31 06:33:16.897048 2025] [:error] [pid 33002:tid 33027] [client 40.69.37.190:49309] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aVRTLPnsZEcORmTFnri_9QAAABA"]
[Wed Dec 31 06:33:17.407454 2025] [:error] [pid 26113:tid 26130] [client 40.69.37.190:9369] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aVRTLSU0NRJ9y9rL1aXQegAAAQ8"]
[Wed Dec 31 06:33:17.912058 2025] [:error] [pid 26113:tid 26117] [client 40.69.37.190:49312] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aVRTLSU0NRJ9y9rL1aXQewAAAQI"]
[Wed Dec 31 06:33:18.434177 2025] [:error] [pid 33003:tid 33059] [client 40.69.37.190:49289] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aVRTLrOkdrCgTt0MxWL6QgAAAFU"]
[Wed Dec 31 06:33:18.961913 2025] [:error] [pid 33003:tid 33057] [client 40.69.37.190:9351] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aVRTLrOkdrCgTt0MxWL6QwAAAFM"]
[Wed Dec 31 06:33:19.467161 2025] [:error] [pid 33003:tid 33060] [client 40.69.37.190:9747] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVRTL7OkdrCgTt0MxWL6RQAAAFY"]
[Wed Dec 31 06:33:19.977089 2025] [:error] [pid 33004:tid 33069] [client 40.69.37.190:9938] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVRTL_ogj9CrK-80KNwu1gAAAIQ"]
[Wed Dec 31 06:33:20.491336 2025] [:error] [pid 33004:tid 33066] [client 40.69.37.190:10145] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVRTMPogj9CrK-80KNwu1wAAAIE"]
[Wed Dec 31 06:33:20.988530 2025] [:error] [pid 33004:tid 33081] [client 40.69.37.190:9481] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVRTMPogj9CrK-80KNwu2AAAAJA"]
[Wed Dec 31 06:33:21.488931 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:49297] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aVRTMSU0NRJ9y9rL1aXQhAAAAQ0"]
[Wed Dec 31 06:33:21.996768 2025] [:error] [pid 33003:tid 33058] [client 40.69.37.190:49331] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aVRTMbOkdrCgTt0MxWL6RgAAAFQ"]
[Wed Dec 31 06:33:22.502461 2025] [:error] [pid 33002:tid 33028] [client 40.69.37.190:9937] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aVRTMvnsZEcORmTFnri_-wAAABE"]
[Wed Dec 31 06:33:23.009066 2025] [:error] [pid 33003:tid 33051] [client 40.69.37.190:10154] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aVRTM7OkdrCgTt0MxWL6RwAAAE0"]
[Wed Dec 31 06:33:23.522297 2025] [:error] [pid 26113:tid 26131] [client 40.69.37.190:49325] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aVRTMyU0NRJ9y9rL1aXQhgAAARA"]
[Wed Dec 31 06:33:24.021089 2025] [:error] [pid 33003:tid 33047] [client 40.69.37.190:49282] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aVRTNLOkdrCgTt0MxWL6SAAAAEk"]
[Wed Dec 31 06:33:24.525668 2025] [:error] [pid 33003:tid 33044] [client 40.69.37.190:49336] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aVRTNLOkdrCgTt0MxWL6SQAAAEY"]
[Wed Dec 31 06:33:25.024894 2025] [:error] [pid 26113:tid 26119] [client 40.69.37.190:9422] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aVRTNSU0NRJ9y9rL1aXQiAAAAQQ"]
[Wed Dec 31 06:33:25.568398 2025] [:error] [pid 33109:tid 33127] [client 40.69.37.190:10138] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVRTNcYN9k_fnLM-n44BZQAAANA"]
[Wed Dec 31 06:33:26.068381 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:49294] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVRTNiU0NRJ9y9rL1aXQiwAAAQU"]
[Wed Dec 31 06:33:26.602964 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:49288] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVRTNiU0NRJ9y9rL1aXQjAAAARI"]
[Wed Dec 31 06:33:27.101609 2025] [:error] [pid 26113:tid 26115] [client 40.69.37.190:49333] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVRTNyU0NRJ9y9rL1aXQjgAAAQA"]
[Wed Dec 31 06:33:27.603433 2025] [:error] [pid 33003:tid 33053] [client 40.69.37.190:9415] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aVRTN7OkdrCgTt0MxWL6SgAAAE8"]
[Wed Dec 31 06:33:28.101639 2025] [:error] [pid 33002:tid 33020] [client 40.69.37.190:9369] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aVRTOPnsZEcORmTFnrjAAAAAAAk"]
[Wed Dec 31 06:33:28.599951 2025] [:error] [pid 33109:tid 33121] [client 40.69.37.190:49324] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aVRTOMYN9k_fnLM-n44BaAAAAMo"]
[Wed Dec 31 06:33:29.100414 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:9920] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aVRTOSU0NRJ9y9rL1aXQlAAAAQ0"]
[Wed Dec 31 06:33:29.602092 2025] [:error] [pid 33109:tid 33115] [client 40.69.37.190:49330] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aVRTOcYN9k_fnLM-n44BaQAAAMQ"]
[Wed Dec 31 06:33:30.099930 2025] [:error] [pid 33002:tid 33025] [client 40.69.37.190:49340] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aVRTOvnsZEcORmTFnrjABAAAAA4"]
[Wed Dec 31 06:33:30.599006 2025] [:error] [pid 26113:tid 26123] [client 40.69.37.190:49307] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aVRTOiU0NRJ9y9rL1aXQlgAAAQg"]
[Wed Dec 31 06:33:31.097381 2025] [:error] [pid 33002:tid 33032] [client 40.69.37.190:49298] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aVRTO_nsZEcORmTFnrjABQAAABU"]
[Wed Dec 31 06:33:31.599371 2025] [:error] [pid 33109:tid 33126] [client 40.69.37.190:49332] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVRTO8YN9k_fnLM-n44BbgAAAM8"]
[Wed Dec 31 06:33:32.106072 2025] [:error] [pid 33004:tid 33069] [client 40.69.37.190:49322] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVRTPPogj9CrK-80KNwu4gAAAIQ"]
[Wed Dec 31 06:33:32.610483 2025] [:error] [pid 33109:tid 33122] [client 40.69.37.190:9962] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVRTPMYN9k_fnLM-n44BcQAAAMs"]
[Wed Dec 31 06:33:33.111209 2025] [:error] [pid 33109:tid 33113] [client 40.69.37.190:9979] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aVRTPcYN9k_fnLM-n44BdAAAAMI"]
[Wed Dec 31 06:33:33.611731 2025] [:error] [pid 33002:tid 33019] [client 40.69.37.190:49285] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aVRTPfnsZEcORmTFnrjACAAAAAg"]
[Wed Dec 31 06:33:34.124523 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Dec 31 06:33:34.377713 2025] [:error] [pid 26113:tid 26129] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Wed Dec 31 06:33:34.630118 2025] [:error] [pid 26113:tid 26126] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Dec 31 06:33:34.883232 2025] [:error] [pid 26113:tid 26124] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Wed Dec 31 06:33:35.136963 2025] [:error] [pid 26113:tid 26138] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Wed Dec 31 06:33:35.391454 2025] [:error] [pid 26113:tid 26137] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Wed Dec 31 06:33:35.643948 2025] [:error] [pid 26113:tid 26131] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Dec 31 06:33:35.895963 2025] [:error] [pid 26113:tid 26134] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Dec 31 06:33:36.149274 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Wed Dec 31 06:33:36.401824 2025] [:error] [pid 26113:tid 26127] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/xo.php
[Wed Dec 31 06:33:36.659126 2025] [:error] [pid 26113:tid 26130] [client 40.69.37.190:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/dlu.php
[Wed Dec 31 06:33:36.908814 2025] [:error] [pid 26113:tid 26115] [client 40.69.37.190:49280] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aVRTQCU0NRJ9y9rL1aXQqgAAAQA"]
[Wed Dec 31 06:33:37.408790 2025] [:error] [pid 26113:tid 26138] [client 40.69.37.190:10113] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aVRTQSU0NRJ9y9rL1aXQrgAAARc"]
[Wed Dec 31 06:33:37.916139 2025] [:error] [pid 33003:tid 33062] [client 40.69.37.190:49343] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aVRTQbOkdrCgTt0MxWL6TQAAAFg"]
[Wed Dec 31 06:33:38.415624 2025] [:error] [pid 33004:tid 33083] [client 40.69.37.190:9373] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aVRTQvogj9CrK-80KNwu5AAAAJI"]
[Wed Dec 31 06:33:38.916404 2025] [:error] [pid 33003:tid 33057] [client 40.69.37.190:9398] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aVRTQrOkdrCgTt0MxWL6UAAAAFM"]
[Wed Dec 31 06:33:39.425233 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:9923] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aVRTQyU0NRJ9y9rL1aXQsAAAARI"]
[Wed Dec 31 06:33:39.926354 2025] [:error] [pid 26113:tid 26122] [client 40.69.37.190:49327] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aVRTQyU0NRJ9y9rL1aXQsQAAAQc"]
[Wed Dec 31 06:33:40.438923 2025] [:error] [pid 33002:tid 33023] [client 40.69.37.190:9371] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aVRTRPnsZEcORmTFnrjADwAAAAw"]
[Wed Dec 31 06:33:40.941685 2025] [:error] [pid 33003:tid 33045] [client 40.69.37.190:10171] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aVRTRLOkdrCgTt0MxWL6VAAAAEc"]
[Wed Dec 31 06:33:41.440883 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:49304] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aVRTRSU0NRJ9y9rL1aXQswAAARU"]
[Wed Dec 31 06:33:41.941214 2025] [:error] [pid 26113:tid 26119] [client 40.69.37.190:49303] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aVRTRSU0NRJ9y9rL1aXQtAAAAQQ"]
[Wed Dec 31 06:33:42.461033 2025] [:error] [pid 33109:tid 33128] [client 40.69.37.190:49321] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aVRTRsYN9k_fnLM-n44BeAAAANE"]
[Wed Dec 31 06:33:42.967465 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:49326] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aVRTRsYN9k_fnLM-n44BeQAAANU"]
[Wed Dec 31 06:33:43.485975 2025] [:error] [pid 26113:tid 26121] [client 40.69.37.190:9383] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aVRTRyU0NRJ9y9rL1aXQtgAAAQY"]
[Wed Dec 31 06:33:43.984297 2025] [:error] [pid 33109:tid 33135] [client 40.69.37.190:49320] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aVRTR8YN9k_fnLM-n44BewAAANg"]
[Wed Dec 31 06:33:44.490337 2025] [:error] [pid 33003:tid 33049] [client 40.69.37.190:9930] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aVRTSLOkdrCgTt0MxWL6WQAAAEs"]
[Wed Dec 31 06:33:44.990012 2025] [:error] [pid 33004:tid 33088] [client 40.69.37.190:9379] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVRTSPogj9CrK-80KNwu9gAAAJc"]
[Wed Dec 31 06:33:45.518280 2025] [:error] [pid 33109:tid 33117] [client 40.69.37.190:9934] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVRTScYN9k_fnLM-n44BkQAAAMY"]
[Wed Dec 31 06:33:46.019003 2025] [:error] [pid 26113:tid 26138] [client 40.69.37.190:9971] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVRTSiU0NRJ9y9rL1aXQvAAAARc"]
[Wed Dec 31 06:33:46.552535 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:9380] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVRTSiU0NRJ9y9rL1aXQvQAAARE"]
[Wed Dec 31 06:33:47.070669 2025] [:error] [pid 33002:tid 33013] [client 40.69.37.190:9953] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aVRTS_nsZEcORmTFnrjAMQAAAAI"]
[Wed Dec 31 06:33:47.590006 2025] [:error] [pid 33109:tid 33114] [client 40.69.37.190:49329] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aVRTS8YN9k_fnLM-n44BtwAAAMM"]
[Wed Dec 31 06:33:48.121424 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:49338] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aVRTTCU0NRJ9y9rL1aXQwAAAARI"]
[Wed Dec 31 06:33:48.630891 2025] [:error] [pid 33002:tid 33032] [client 40.69.37.190:9495] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aVRTTPnsZEcORmTFnrjAPgAAABU"]
[Wed Dec 31 06:33:49.142089 2025] [:error] [pid 33003:tid 33054] [client 40.69.37.190:10130] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aVRTTbOkdrCgTt0MxWL6iAAAAFA"]
[Wed Dec 31 06:33:49.652348 2025] [:error] [pid 33004:tid 33078] [client 40.69.37.190:9960] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aVRTTfogj9CrK-80KNwvMQAAAI0"]
[Wed Dec 31 06:33:50.152509 2025] [:error] [pid 33109:tid 33132] [client 40.69.37.190:9928] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aVRTTsYN9k_fnLM-n44ByAAAANU"]
[Wed Dec 31 06:33:50.684619 2025] [:error] [pid 33002:tid 33031] [client 40.69.37.190:49323] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mariju.php"] [unique_id "aVRTTvnsZEcORmTFnrjAQAAAABQ"]
[Wed Dec 31 06:33:51.182838 2025] [:error] [pid 33002:tid 33034] [client 40.69.37.190:9392] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRTT_nsZEcORmTFnrjARAAAABc"]
[Wed Dec 31 06:33:51.715545 2025] [:error] [pid 33004:tid 33082] [client 40.69.37.190:9491] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRTT_ogj9CrK-80KNwvMgAAAJE"]
[Wed Dec 31 06:33:52.222328 2025] [:error] [pid 33003:tid 33047] [client 40.69.37.190:49334] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRTULOkdrCgTt0MxWL6jAAAAEk"]
[Wed Dec 31 06:33:52.753865 2025] [:error] [pid 26113:tid 26116] [client 40.69.37.190:9921] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aVRTUCU0NRJ9y9rL1aXQzwAAAQE"]
[Wed Dec 31 06:33:53.251636 2025] [:error] [pid 33004:tid 33087] [client 40.69.37.190:9943] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aVRTUfogj9CrK-80KNwvMwAAAJY"]
[Wed Dec 31 06:33:53.749646 2025] [:error] [pid 33109:tid 33127] [client 40.69.37.190:9977] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aVRTUcYN9k_fnLM-n44BywAAANA"]
[Wed Dec 31 06:33:54.247777 2025] [:error] [pid 33003:tid 33041] [client 40.69.37.190:49335] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aVRTUrOkdrCgTt0MxWL6jwAAAEM"]
[Wed Dec 31 06:33:54.747454 2025] [:error] [pid 26113:tid 26119] [client 40.69.37.190:9949] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aVRTUiU0NRJ9y9rL1aXQ1gAAAQQ"]
[Wed Dec 31 06:33:55.250470 2025] [:error] [pid 33003:tid 33051] [client 40.69.37.190:9969] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aVRTU7OkdrCgTt0MxWL6lAAAAE0"]
[Wed Dec 31 06:33:55.750457 2025] [:error] [pid 33003:tid 33042] [client 40.69.37.190:9970] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aVRTU7OkdrCgTt0MxWL6lQAAAEQ"]
[Wed Dec 31 06:33:56.256817 2025] [:error] [pid 33004:tid 33089] [client 40.69.37.190:9968] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aVRTVPogj9CrK-80KNwvNAAAAJg"]
[Wed Dec 31 06:33:56.762016 2025] [:error] [pid 26113:tid 26126] [client 40.69.37.190:9975] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aVRTVCU0NRJ9y9rL1aXQ3QAAAQs"]
[Wed Dec 31 06:33:57.261269 2025] [:error] [pid 26113:tid 26138] [client 40.69.37.190:9403] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aVRTVSU0NRJ9y9rL1aXQ3wAAARc"]
[Wed Dec 31 06:33:57.810064 2025] [:error] [pid 33004:tid 33084] [client 40.69.37.190:9945] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aVRTVfogj9CrK-80KNwvNQAAAJM"]
[Wed Dec 31 06:33:58.317018 2025] [:error] [pid 33002:tid 33032] [client 40.69.37.190:9387] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aVRTVvnsZEcORmTFnrjASgAAABU"]
[Wed Dec 31 06:33:58.826699 2025] [:error] [pid 33002:tid 33022] [client 40.69.37.190:9958] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aVRTVvnsZEcORmTFnrjASwAAAAs"]
[Wed Dec 31 06:33:59.377238 2025] [:error] [pid 33004:tid 33071] [client 40.69.37.190:49305] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aVRTV_ogj9CrK-80KNwvOgAAAIY"]
[Wed Dec 31 06:33:59.892929 2025] [:error] [pid 33002:tid 33019] [client 40.69.37.190:49317] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aVRTV_nsZEcORmTFnrjATgAAAAg"]
[Wed Dec 31 06:34:00.391043 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:9946] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aVRTWCU0NRJ9y9rL1aXQ4QAAARI"]
[Wed Dec 31 06:34:00.894132 2025] [:error] [pid 26113:tid 26122] [client 40.69.37.190:9464] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "aVRTWCU0NRJ9y9rL1aXQ4wAAAQc"]
[Wed Dec 31 06:34:01.394696 2025] [:error] [pid 33003:tid 33041] [client 40.69.37.190:9355] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aVRTWbOkdrCgTt0MxWL6uwAAAEM"]
[Wed Dec 31 06:34:01.920843 2025] [:error] [pid 33109:tid 33113] [client 40.69.37.190:49315] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aVRTWcYN9k_fnLM-n44B1gAAAMI"]
[Wed Dec 31 06:34:02.431381 2025] [:error] [pid 26113:tid 26126] [client 40.69.37.190:9925] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aVRTWiU0NRJ9y9rL1aXQ6AAAAQs"]
[Wed Dec 31 06:34:02.931581 2025] [:error] [pid 33002:tid 33034] [client 40.69.37.190:9921] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aVRTWvnsZEcORmTFnrjATwAAABc"]
[Wed Dec 31 06:34:03.443363 2025] [:error] [pid 33109:tid 33134] [client 40.69.37.190:9965] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aVRTW8YN9k_fnLM-n44B2wAAANc"]
[Wed Dec 31 06:34:03.941363 2025] [:error] [pid 33109:tid 33119] [client 40.69.37.190:10172] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aVRTW8YN9k_fnLM-n44B3QAAAMg"]
[Wed Dec 31 06:34:04.438975 2025] [:error] [pid 33004:tid 33088] [client 40.69.37.190:49318] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aVRTXPogj9CrK-80KNwvPgAAAJc"]
[Wed Dec 31 06:34:04.943956 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:9399] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "aVRTXCU0NRJ9y9rL1aXQ7QAAAQ0"]
[Wed Dec 31 06:34:05.445157 2025] [:error] [pid 33002:tid 33030] [client 40.69.37.190:9931] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVRTXfnsZEcORmTFnrjAUAAAABM"]
[Wed Dec 31 06:34:06.025145 2025] [:error] [pid 33003:tid 33038] [client 40.69.37.190:10140] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVRTXrOkdrCgTt0MxWL6ygAAAEA"]
[Wed Dec 31 06:34:06.526927 2025] [:error] [pid 33003:tid 33057] [client 40.69.37.190:9479] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVRTXrOkdrCgTt0MxWL6ywAAAFM"]
[Wed Dec 31 06:34:07.059826 2025] [:error] [pid 33002:tid 33021] [client 40.69.37.190:10161] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVRTX_nsZEcORmTFnrjAUgAAAAo"]
[Wed Dec 31 06:34:07.558244 2025] [:error] [pid 26113:tid 26123] [client 40.69.37.190:9388] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aVRTXyU0NRJ9y9rL1aXQ8gAAAQg"]
[Wed Dec 31 06:34:08.084732 2025] [:error] [pid 26113:tid 26115] [client 40.69.37.190:10139] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aVRTYCU0NRJ9y9rL1aXQ8wAAAQA"]
[Wed Dec 31 06:34:08.587395 2025] [:error] [pid 33004:tid 33089] [client 40.69.37.190:9503] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aVRTYPogj9CrK-80KNwvQQAAAJg"]
[Wed Dec 31 06:34:09.110253 2025] [:error] [pid 26113:tid 26117] [client 40.69.37.190:9981] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aVRTYSU0NRJ9y9rL1aXQ9gAAAQI"]
[Wed Dec 31 06:34:09.608829 2025] [:error] [pid 26113:tid 26124] [client 40.69.37.190:9401] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aVRTYSU0NRJ9y9rL1aXQ9wAAAQk"]
[Wed Dec 31 06:34:10.105715 2025] [:error] [pid 26113:tid 26125] [client 40.69.37.190:9940] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aVRTYiU0NRJ9y9rL1aXQ-QAAAQo"]
[Wed Dec 31 06:34:10.605520 2025] [:error] [pid 26113:tid 26133] [client 40.69.37.190:9980] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aVRTYiU0NRJ9y9rL1aXQ-wAAARI"]
[Wed Dec 31 06:34:11.108062 2025] [:error] [pid 33004:tid 33076] [client 40.69.37.190:9480] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aVRTY_ogj9CrK-80KNwvQwAAAIs"]
[Wed Dec 31 06:34:11.632898 2025] [:error] [pid 33003:tid 33056] [client 40.69.37.190:49293] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aVRTY7OkdrCgTt0MxWL60AAAAFI"]
[Wed Dec 31 06:34:12.146856 2025] [:error] [pid 33004:tid 33073] [client 40.69.37.190:9948] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aVRTZPogj9CrK-80KNwvRAAAAIg"]
[Wed Dec 31 06:34:12.698398 2025] [:error] [pid 33109:tid 33121] [client 40.69.37.190:49319] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aVRTZMYN9k_fnLM-n44B5AAAAMo"]
[Wed Dec 31 06:34:13.196928 2025] [:error] [pid 33004:tid 33077] [client 40.69.37.190:9523] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aVRTZfogj9CrK-80KNwvRgAAAIw"]
[Wed Dec 31 06:34:13.723327 2025] [:error] [pid 33004:tid 33083] [client 40.69.37.190:49286] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aVRTZfogj9CrK-80KNwvSQAAAJI"]
[Wed Dec 31 06:34:14.227639 2025] [:error] [pid 33003:tid 33049] [client 40.69.37.190:9532] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aVRTZrOkdrCgTt0MxWL60gAAAEs"]
[Wed Dec 31 06:34:14.727116 2025] [:error] [pid 33004:tid 33082] [client 40.69.37.190:9954] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aVRTZvogj9CrK-80KNwvTQAAAJE"]
[Wed Dec 31 06:34:15.250607 2025] [:error] [pid 26113:tid 26123] [client 40.69.37.190:9976] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aVRTZyU0NRJ9y9rL1aXQ_gAAAQg"]
[Wed Dec 31 06:34:15.759951 2025] [:error] [pid 33003:tid 33054] [client 40.69.37.190:9942] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aVRTZ7OkdrCgTt0MxWL61AAAAFA"]
[Wed Dec 31 06:34:16.282385 2025] [:error] [pid 33004:tid 33089] [client 40.69.37.190:49306] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aVRTaPogj9CrK-80KNwvTgAAAJg"]
[Wed Dec 31 06:34:16.939478 2025] [:error] [pid 33109:tid 33119] [client 40.69.37.190:9956] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aVRTaMYN9k_fnLM-n44B6QAAAMg"]
[Wed Dec 31 06:34:17.442238 2025] [:error] [pid 33002:tid 33023] [client 40.69.37.190:9478] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aVRTafnsZEcORmTFnrjAVgAAAAw"]
[Wed Dec 31 06:34:17.940042 2025] [:error] [pid 26113:tid 26120] [client 40.69.37.190:10173] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aVRTaSU0NRJ9y9rL1aXRAgAAAQU"]
[Wed Dec 31 06:34:18.471953 2025] [:error] [pid 33002:tid 33025] [client 40.69.37.190:9498] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aVRTavnsZEcORmTFnrjAWgAAAA4"]
[Wed Dec 31 06:34:18.998950 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:9487] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aVRTaiU0NRJ9y9rL1aXRBwAAARE"]
[Wed Dec 31 06:34:19.513419 2025] [:error] [pid 33002:tid 33027] [client 40.69.37.190:9926] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aVRTa_nsZEcORmTFnrjAXwAAABA"]
[Wed Dec 31 06:34:20.053139 2025] [:error] [pid 33003:tid 33047] [client 40.69.37.190:9475] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aVRTbLOkdrCgTt0MxWL62gAAAEk"]
[Wed Dec 31 06:34:20.589447 2025] [:error] [pid 33002:tid 33029] [client 40.69.37.190:9488] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aVRTbPnsZEcORmTFnrjAYAAAABI"]
[Wed Dec 31 06:34:21.100180 2025] [:error] [pid 33004:tid 33071] [client 40.69.37.190:9877] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aVRTbfogj9CrK-80KNwvVAAAAIY"]
[Wed Dec 31 06:34:21.665449 2025] [:error] [pid 33003:tid 33055] [client 40.69.37.190:9869] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aVRTbbOkdrCgTt0MxWL63AAAAFE"]
[Wed Dec 31 06:34:22.201694 2025] [:error] [pid 33002:tid 33015] [client 40.69.37.190:49337] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aVRTbvnsZEcORmTFnrjAYwAAAAQ"]
[Wed Dec 31 06:34:22.716250 2025] [:error] [pid 33002:tid 33023] [client 40.69.37.190:9922] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aVRTbvnsZEcORmTFnrjAZgAAAAw"]
[Wed Dec 31 06:34:23.218588 2025] [:error] [pid 33004:tid 33066] [client 40.69.37.190:9972] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aVRTb_ogj9CrK-80KNwvWAAAAIE"]
[Wed Dec 31 06:34:23.746770 2025] [:error] [pid 26113:tid 26139] [client 40.69.37.190:9477] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aVRTbyU0NRJ9y9rL1aXREgAAARg"]
[Wed Dec 31 06:34:24.268386 2025] [:error] [pid 33004:tid 33078] [client 40.69.37.190:9384] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aVRTcPogj9CrK-80KNwvXAAAAI0"]
[Wed Dec 31 06:34:24.831324 2025] [:error] [pid 33004:tid 33084] [client 40.69.37.190:9929] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aVRTcPogj9CrK-80KNwvXgAAAJM"]
[Wed Dec 31 06:34:25.397749 2025] [:error] [pid 33003:tid 33049] [client 40.69.37.190:49290] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aVRTcbOkdrCgTt0MxWL64AAAAEs"]
[Wed Dec 31 06:34:25.906447 2025] [:error] [pid 26113:tid 26122] [client 40.69.37.190:9486] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aVRTcSU0NRJ9y9rL1aXRHAAAAQc"]
[Wed Dec 31 06:34:26.434004 2025] [:error] [pid 26113:tid 26128] [client 40.69.37.190:9860] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aVRTciU0NRJ9y9rL1aXRHwAAAQ0"]
[Wed Dec 31 06:34:26.939426 2025] [:error] [pid 33003:tid 33054] [client 40.69.37.190:9467] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aVRTcrOkdrCgTt0MxWL64QAAAFA"]
[Wed Dec 31 06:34:27.469608 2025] [:error] [pid 33109:tid 33124] [client 40.69.37.190:9472] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aVRTc8YN9k_fnLM-n44B9wAAAM0"]
[Wed Dec 31 06:34:27.971294 2025] [:error] [pid 33109:tid 33135] [client 40.69.37.190:9885] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aVRTc8YN9k_fnLM-n44B-gAAANg"]
[Wed Dec 31 06:34:28.523195 2025] [:error] [pid 26113:tid 26124] [client 40.69.37.190:9950] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aVRTdCU0NRJ9y9rL1aXRIgAAAQk"]
[Wed Dec 31 06:34:29.051919 2025] [:error] [pid 26113:tid 26132] [client 40.69.37.190:9517] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aVRTdSU0NRJ9y9rL1aXRIwAAARE"]
[Wed Dec 31 06:34:29.555465 2025] [:error] [pid 33002:tid 33022] [client 40.69.37.190:9497] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aVRTdfnsZEcORmTFnrjAcQAAAAs"]
[Wed Dec 31 06:34:30.083212 2025] [:error] [pid 26113:tid 26119] [client 40.69.37.190:9602] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aVRTdiU0NRJ9y9rL1aXRJwAAAQQ"]
[Wed Dec 31 06:34:30.586473 2025] [:error] [pid 33004:tid 33077] [client 40.69.37.190:9519] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aVRTdvogj9CrK-80KNwvdwAAAIw"]
[Wed Dec 31 06:34:31.103292 2025] [:error] [pid 33003:tid 33040] [client 40.69.37.190:49314] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aVRTd7OkdrCgTt0MxWL66QAAAEI"]
[Wed Dec 31 06:34:31.633467 2025] [:error] [pid 26113:tid 26136] [client 40.69.37.190:9887] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aVRTdyU0NRJ9y9rL1aXRKAAAARU"]
[Wed Dec 31 06:34:32.231653 2025] [:error] [pid 26113:tid 26117] [client 40.69.37.190:9878] [client 40.69.37.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aVRTeCU0NRJ9y9rL1aXRKwAAAQI"]
[Wed Dec 31 13:55:27.104325 2025] [:error] [pid 64406:tid 64432] [client 177.4.16.24:26430] [client 177.4.16.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.4.16.24, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVS6zyLRcJYP7e7OhBa9cwAAARg"]
[Wed Dec 31 13:55:27.111103 2025] [:error] [pid 64406:tid 64432] [client 177.4.16.24:26430] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 31 19:42:50.056294 2025] [:error] [pid 48714:tid 48766] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 31 19:42:50.304524 2025] [:error] [pid 48714:tid 48768] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Dec 31 19:42:50.541650 2025] [:error] [pid 48714:tid 48764] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Dec 31 19:42:50.777546 2025] [:error] [pid 48714:tid 48750] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Wed Dec 31 19:42:51.350318 2025] [:error] [pid 48714:tid 48760] [client 172.213.212.238:12410] [client 172.213.212.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.213.212.238, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVUMO79PcChEHWa6ViuN8AAAAA8"]
[Wed Dec 31 19:42:51.355678 2025] [:error] [pid 48714:tid 48760] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Dec 31 19:42:51.591821 2025] [:error] [pid 48714:tid 48761] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Wed Dec 31 19:42:51.827649 2025] [:error] [pid 48714:tid 48757] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Dec 31 19:42:52.077263 2025] [:error] [pid 48714:tid 48763] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Dec 31 19:42:52.313184 2025] [:error] [pid 48714:tid 48762] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Dec 31 19:42:52.572073 2025] [:error] [pid 48714:tid 48753] [client 172.213.212.238:12410] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Dec 31 19:42:52.812779 2025] [:error] [pid 48714:tid 48748] [client 172.213.212.238:12410] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVUMPL9PcChEHWa6ViuN9gAAAAM"]
[Wed Dec 31 19:42:53.928386 2025] [:error] [pid 7800:tid 7810] [client 172.213.212.238:12370] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVUMPSN6RFoECeReAPVgJwAAAYc"]
[Wed Dec 31 19:42:54.822951 2025] [:error] [pid 8068:tid 8079] [client 172.213.212.238:12377] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVUMPiSVtzoWnijCxFZcVQAAAck"]
[Wed Dec 31 19:42:55.708346 2025] [:error] [pid 48715:tid 48790] [client 172.213.212.238:12412] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aVUMP2amQpQY7KfuoW1hGQAAAJI"]
[Wed Dec 31 19:42:56.322024 2025] [:error] [pid 48714:tid 48755] [client 172.213.212.238:12397] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVUMQL9PcChEHWa6ViuN9wAAAAo"]
[Wed Dec 31 19:42:57.058010 2025] [:error] [pid 48833:tid 48852] [client 172.213.212.238:12318] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVUMQWPnRNOqqZ1OQg_yXQAAAFE"]
[Wed Dec 31 19:42:57.713484 2025] [:error] [pid 7800:tid 7826] [client 172.213.212.238:12296] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVUMQSN6RFoECeReAPVgKQAAAZc"]
[Wed Dec 31 19:42:58.441712 2025] [:error] [pid 48714:tid 48746] [client 172.213.212.238:12392] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aVUMQr9PcChEHWa6ViuN-AAAAAE"]
[Wed Dec 31 19:42:59.050391 2025] [:error] [pid 7800:tid 7818] [client 172.213.212.238:12359] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aVUMQyN6RFoECeReAPVgKwAAAY8"]
[Wed Dec 31 19:42:59.660334 2025] [:error] [pid 8068:tid 8084] [client 172.213.212.238:12310] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aVUMQySVtzoWnijCxFZcXgAAAc4"]
[Wed Dec 31 19:43:00.209017 2025] [:error] [pid 48715:tid 48775] [client 172.213.212.238:12362] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aVUMRGamQpQY7KfuoW1hGwAAAIM"]
[Wed Dec 31 19:43:00.730313 2025] [:error] [pid 7576:tid 7578] [client 172.213.212.238:12379] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aVUMRKFUpQkpGJNxC_-4JwAAAUA"]
[Wed Dec 31 19:43:01.267718 2025] [:error] [pid 7800:tid 7825] [client 172.213.212.238:12408] [client 172.213.212.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aVUMRSN6RFoECeReAPVgLgAAAZY"]
[Wed Dec 31 19:43:01.806931 2025] [:error] [pid 8068:tid 8083] [client 172.213.212.238:12396] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aVUMRSSVtzoWnijCxFZcYwAAAc0"]
[Wed Dec 31 19:43:02.436704 2025] [:error] [pid 8068:tid 8077] [client 172.213.212.238:12380] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aVUMRiSVtzoWnijCxFZcZgAAAcc"]
[Wed Dec 31 19:43:03.075916 2025] [:error] [pid 48833:tid 48853] [client 172.213.212.238:12358] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aVUMR2PnRNOqqZ1OQg_yXwAAAFI"]
[Wed Dec 31 19:43:03.565364 2025] [:error] [pid 8068:tid 8072] [client 172.213.212.238:12294] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aVUMRySVtzoWnijCxFZcZwAAAcI"]
[Wed Dec 31 19:43:04.071640 2025] [:error] [pid 64406:tid 64430] [client 172.213.212.238:12355] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aVUMSCLRcJYP7e7OhBYc7AAAARY"]
[Wed Dec 31 19:43:04.568061 2025] [:error] [pid 64406:tid 64425] [client 172.213.212.238:12304] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aVUMSCLRcJYP7e7OhBYc7QAAARE"]
[Wed Dec 31 19:43:05.124928 2025] [:error] [pid 8068:tid 8093] [client 172.213.212.238:12366] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aVUMSSSVtzoWnijCxFZcaAAAAdc"]
[Wed Dec 31 19:43:05.814887 2025] [:error] [pid 64406:tid 64421] [client 172.213.212.238:12348] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVUMSSLRcJYP7e7OhBYc8AAAAQ0"]
[Wed Dec 31 19:43:06.370494 2025] [:error] [pid 64406:tid 64417] [client 172.213.212.238:12315] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVUMSiLRcJYP7e7OhBYc8wAAAQk"]
[Wed Dec 31 19:43:06.849931 2025] [:error] [pid 64406:tid 64431] [client 172.213.212.238:12321] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVUMSiLRcJYP7e7OhBYc9QAAARc"]
[Wed Dec 31 19:43:07.369427 2025] [:error] [pid 8068:tid 8082] [client 172.213.212.238:12339] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aVUMSySVtzoWnijCxFZcagAAAcw"]
[Wed Dec 31 19:43:07.884180 2025] [:error] [pid 8068:tid 8074] [client 172.213.212.238:12376] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aVUMSySVtzoWnijCxFZcbAAAAcQ"]
[Wed Dec 31 19:43:08.395469 2025] [:error] [pid 8068:tid 8087] [client 172.213.212.238:12363] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aVUMTCSVtzoWnijCxFZccAAAAdE"]
[Wed Dec 31 19:43:08.965189 2025] [:error] [pid 8068:tid 8091] [client 172.213.212.238:12353] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aVUMTCSVtzoWnijCxFZccwAAAdU"]
[Wed Dec 31 19:43:09.640485 2025] [:error] [pid 8068:tid 8090] [client 172.213.212.238:12388] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aVUMTSSVtzoWnijCxFZcdQAAAdQ"]
[Wed Dec 31 19:43:10.274237 2025] [:error] [pid 64406:tid 64416] [client 172.213.212.238:12313] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aVUMTiLRcJYP7e7OhBYc9gAAAQg"]
[Wed Dec 31 19:43:10.804283 2025] [:error] [pid 48833:tid 48855] [client 172.213.212.238:12375] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aVUMTmPnRNOqqZ1OQg_yaAAAAFQ"]
[Wed Dec 31 19:43:11.383131 2025] [:error] [pid 64406:tid 64427] [client 172.213.212.238:12292] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aVUMTyLRcJYP7e7OhBYc_AAAARM"]
[Wed Dec 31 19:43:12.024179 2025] [:error] [pid 8068:tid 8080] [client 172.213.212.238:12289] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aVUMUCSVtzoWnijCxFZchQAAAco"]
[Wed Dec 31 19:43:12.539819 2025] [:error] [pid 48714:tid 48764] [client 172.213.212.238:2014] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aVUMUL9PcChEHWa6ViuOBAAAABM"]
[Wed Dec 31 19:43:13.403028 2025] [:error] [pid 48715:tid 48787] [client 172.213.212.238:12391] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aVUMUWamQpQY7KfuoW1hHAAAAI8"]
[Wed Dec 31 19:43:13.968386 2025] [:error] [pid 48715:tid 48777] [client 172.213.212.238:12299] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aVUMUWamQpQY7KfuoW1hHQAAAIU"]
[Wed Dec 31 19:43:14.601903 2025] [:error] [pid 48715:tid 48774] [client 172.213.212.238:12390] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C.php"] [unique_id "aVUMUmamQpQY7KfuoW1hHgAAAII"]
[Wed Dec 31 19:43:15.172794 2025] [:error] [pid 48713:tid 48732] [client 172.213.212.238:12303] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aVUMU0yNMVAGtWvMliPqiQAAAM4"]
[Wed Dec 31 19:43:15.680433 2025] [:error] [pid 64406:tid 64431] [client 172.213.212.238:12311] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aVUMUyLRcJYP7e7OhBYdCQAAARc"]
[Wed Dec 31 19:43:16.507932 2025] [:error] [pid 48715:tid 48784] [client 172.213.212.238:12325] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aVUMVGamQpQY7KfuoW1hIAAAAIw"]
[Wed Dec 31 19:43:17.242025 2025] [:error] [pid 48833:tid 48847] [client 172.213.212.238:12382] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aVUMVWPnRNOqqZ1OQg_ycgAAAEw"]
[Wed Dec 31 19:43:17.916173 2025] [:error] [pid 48715:tid 48776] [client 172.213.212.238:12308] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aVUMVWamQpQY7KfuoW1hIQAAAIQ"]
[Wed Dec 31 19:43:18.522377 2025] [:error] [pid 64406:tid 64420] [client 172.213.212.238:12288] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aVUMViLRcJYP7e7OhBYdDgAAAQw"]
[Wed Dec 31 19:43:19.140014 2025] [:error] [pid 7800:tid 7819] [client 172.213.212.238:12298] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aVUMVyN6RFoECeReAPVgMgAAAZA"]
[Wed Dec 31 19:43:19.762827 2025] [:error] [pid 7800:tid 7823] [client 172.213.212.238:12293] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aVUMVyN6RFoECeReAPVgMwAAAZQ"]
[Wed Dec 31 19:43:20.300414 2025] [:error] [pid 48715:tid 48772] [client 172.213.212.238:12378] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVUMWGamQpQY7KfuoW1hIwAAAIA"]
[Wed Dec 31 19:43:20.793063 2025] [:error] [pid 48715:tid 48791] [client 172.213.212.238:2024] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVUMWGamQpQY7KfuoW1hJAAAAJM"]
[Wed Dec 31 19:43:21.287356 2025] [:error] [pid 48713:tid 48734] [client 172.213.212.238:12411] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVUMWUyNMVAGtWvMliPqkAAAANA"]
[Wed Dec 31 19:43:21.852383 2025] [:error] [pid 48715:tid 48780] [client 172.213.212.238:12335] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aVUMWWamQpQY7KfuoW1hJwAAAIg"]
[Wed Dec 31 19:43:22.372411 2025] [:error] [pid 48833:tid 48846] [client 172.213.212.238:12389] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aVUMWmPnRNOqqZ1OQg_ydQAAAEs"]
[Wed Dec 31 19:43:22.865748 2025] [:error] [pid 64406:tid 64421] [client 172.213.212.238:12393] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aVUMWiLRcJYP7e7OhBYdEQAAAQ0"]
[Wed Dec 31 19:43:23.400289 2025] [:error] [pid 8068:tid 8081] [client 172.213.212.238:1995] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aVUMWySVtzoWnijCxFZcogAAAcs"]
[Wed Dec 31 19:43:24.027664 2025] [:error] [pid 48713:tid 48722] [client 172.213.212.238:12414] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "aVUMXEyNMVAGtWvMliPqlAAAAMQ"]
[Wed Dec 31 19:43:24.604736 2025] [:error] [pid 64406:tid 64412] [client 172.213.212.238:12413] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aVUMXCLRcJYP7e7OhBYdEgAAAQQ"]
[Wed Dec 31 19:43:25.145929 2025] [:error] [pid 64406:tid 64426] [client 172.213.212.238:12316] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aVUMXSLRcJYP7e7OhBYdFAAAARI"]
[Wed Dec 31 19:43:25.776172 2025] [:error] [pid 64406:tid 64431] [client 172.213.212.238:12324] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aVUMXSLRcJYP7e7OhBYdFgAAARc"]
[Wed Dec 31 19:43:26.345346 2025] [:error] [pid 48713:tid 48738] [client 172.213.212.238:1939] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aVUMXkyNMVAGtWvMliPqlgAAANQ"]
[Wed Dec 31 19:43:26.885451 2025] [:error] [pid 8068:tid 8073] [client 172.213.212.238:12399] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVUMXiSVtzoWnijCxFZcpQAAAcM"]
[Wed Dec 31 19:43:27.523673 2025] [:error] [pid 64406:tid 64416] [client 172.213.212.238:12337] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVUMXyLRcJYP7e7OhBYdGAAAAQg"]
[Wed Dec 31 19:43:28.166138 2025] [:error] [pid 8068:tid 8085] [client 172.213.212.238:12415] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVUMYCSVtzoWnijCxFZcpwAAAc8"]
[Wed Dec 31 19:43:28.732172 2025] [:error] [pid 8068:tid 8071] [client 172.213.212.238:12361] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aVUMYCSVtzoWnijCxFZcqQAAAcE"]
[Wed Dec 31 19:43:29.263185 2025] [:error] [pid 48714:tid 48765] [client 172.213.212.238:12306] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aVUMYb9PcChEHWa6ViuODAAAABQ"]
[Wed Dec 31 19:43:29.733605 2025] [:error] [pid 7576:tid 7604] [client 172.213.212.238:12330] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aVUMYaFUpQkpGJNxC_-4KgAAAVg"]
[Wed Dec 31 19:43:30.233221 2025] [:error] [pid 48715:tid 48781] [client 172.213.212.238:12328] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aVUMYmamQpQY7KfuoW1hMwAAAIk"]
[Wed Dec 31 19:43:30.879434 2025] [:error] [pid 64406:tid 64413] [client 172.213.212.238:12372] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manage.php"] [unique_id "aVUMYiLRcJYP7e7OhBYdHQAAAQU"]
[Wed Dec 31 19:43:31.511430 2025] [:error] [pid 64406:tid 64423] [client 172.213.212.238:12409] [client 172.213.212.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aVUMYyLRcJYP7e7OhBYdHgAAAQ8"]
[Wed Dec 31 19:43:32.100476 2025] [:error] [pid 7800:tid 7819] [client 172.213.212.238:1997] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aVUMZCN6RFoECeReAPVgPgAAAZA"]
[Wed Dec 31 19:43:32.676211 2025] [:error] [pid 7576:tid 7599] [client 172.213.212.238:12406] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aVUMZKFUpQkpGJNxC_-4KwAAAVU"]
[Wed Dec 31 19:43:33.234889 2025] [:error] [pid 48715:tid 48778] [client 172.213.212.238:1990] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aVUMZWamQpQY7KfuoW1hNAAAAIY"]
[Wed Dec 31 19:43:33.882076 2025] [:error] [pid 7576:tid 7603] [client 172.213.212.238:12345] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVUMZaFUpQkpGJNxC_-4LAAAAVc"]
[Wed Dec 31 19:43:34.524501 2025] [:error] [pid 7576:tid 7598] [client 172.213.212.238:12323] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVUMZqFUpQkpGJNxC_-4LgAAAVQ"]
[Wed Dec 31 19:43:35.234588 2025] [:error] [pid 48833:tid 48853] [client 172.213.212.238:12333] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVUMZ2PnRNOqqZ1OQg_yewAAAFI"]
[Wed Dec 31 19:43:38.781863 2025] [:error] [pid 8068:tid 8094] [client 172.213.212.238:12405] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aVUMaiSVtzoWnijCxFZcrwAAAdg"]
[Wed Dec 31 19:43:39.517956 2025] [:error] [pid 7576:tid 7590] [client 172.213.212.238:12386] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVUMa6FUpQkpGJNxC_-4MgAAAUw"]
[Wed Dec 31 19:43:40.143366 2025] [:error] [pid 64406:tid 64414] [client 172.213.212.238:12295] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVUMbCLRcJYP7e7OhBYdJwAAAQY"]
[Wed Dec 31 19:43:40.955848 2025] [:error] [pid 48713:tid 48724] [client 172.213.212.238:12329] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVUMbEyNMVAGtWvMliPqmQAAAMY"]
[Wed Dec 31 19:43:41.528109 2025] [:error] [pid 8068:tid 8086] [client 172.213.212.238:1986] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aVUMbSSVtzoWnijCxFZcswAAAdA"]
[Wed Dec 31 19:43:42.264273 2025] [:error] [pid 48833:tid 48851] [client 172.213.212.238:12312] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aVUMbmPnRNOqqZ1OQg_yfgAAAFA"]
[Wed Dec 31 19:43:42.897374 2025] [:error] [pid 8068:tid 8085] [client 172.213.212.238:1984] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aVUMbiSVtzoWnijCxFZctQAAAc8"]
[Wed Dec 31 19:43:43.429426 2025] [:error] [pid 7576:tid 7595] [client 172.213.212.238:12374] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aVUMb6FUpQkpGJNxC_-4NQAAAVE"]
[Wed Dec 31 19:43:43.991322 2025] [:error] [pid 48715:tid 48796] [client 172.213.212.238:12317] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aVUMb2amQpQY7KfuoW1hOAAAAJg"]
[Wed Dec 31 19:43:44.605597 2025] [:error] [pid 48715:tid 48784] [client 172.213.212.238:12290] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVUMcGamQpQY7KfuoW1hOQAAAIw"]
[Wed Dec 31 19:43:45.235326 2025] [:error] [pid 48833:tid 48857] [client 172.213.212.238:12364] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVUMcWPnRNOqqZ1OQg_yhAAAAFY"]
[Wed Dec 31 19:43:46.082094 2025] [:error] [pid 8068:tid 8074] [client 172.213.212.238:1990] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVUMciSVtzoWnijCxFZcuAAAAcQ"]
[Wed Dec 31 19:43:46.651114 2025] [:error] [pid 48833:tid 48858] [client 172.213.212.238:12309] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVUMcmPnRNOqqZ1OQg_yhwAAAFc"]
[Wed Dec 31 19:43:47.306465 2025] [:error] [pid 48715:tid 48792] [client 172.213.212.238:12400] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVUMc2amQpQY7KfuoW1hPQAAAJQ"]
[Wed Dec 31 19:43:47.966629 2025] [:error] [pid 64406:tid 64425] [client 172.213.212.238:1996] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVUMcyLRcJYP7e7OhBYdLAAAARE"]
[Wed Dec 31 19:43:48.482095 2025] [:error] [pid 7800:tid 7809] [client 172.213.212.238:1992] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVUMdCN6RFoECeReAPVgRAAAAYY"]
[Wed Dec 31 19:43:49.122022 2025] [:error] [pid 48714:tid 48763] [client 172.213.212.238:12319] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aVUMdb9PcChEHWa6ViuOHgAAABI"]
[Wed Dec 31 19:43:49.852467 2025] [:error] [pid 7800:tid 7804] [client 172.213.212.238:2033] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVUMdSN6RFoECeReAPVgRQAAAYE"]
[Wed Dec 31 19:43:50.497018 2025] [:error] [pid 7800:tid 7815] [client 172.213.212.238:12331] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVUMdiN6RFoECeReAPVgRgAAAYw"]
[Wed Dec 31 19:43:51.220625 2025] [:error] [pid 48833:tid 48851] [client 172.213.212.238:12320] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVUMd2PnRNOqqZ1OQg_yiwAAAFA"]
[Wed Dec 31 19:43:51.773136 2025] [:error] [pid 7800:tid 7821] [client 172.213.212.238:2035] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVUMdyN6RFoECeReAPVgSAAAAZI"]
[Wed Dec 31 19:43:52.315685 2025] [:error] [pid 7800:tid 7822] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/news.php
[Wed Dec 31 19:43:52.560628 2025] [:error] [pid 7800:tid 7807] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Dec 31 19:43:53.034123 2025] [:error] [pid 7800:tid 7817] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Wed Dec 31 19:43:53.270892 2025] [:error] [pid 7800:tid 7819] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Dec 31 19:43:53.512893 2025] [:error] [pid 7800:tid 7814] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Dec 31 19:43:53.752184 2025] [:error] [pid 7800:tid 7810] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed Dec 31 19:43:53.990398 2025] [:error] [pid 7800:tid 7820] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Wed Dec 31 19:43:54.300455 2025] [:error] [pid 7800:tid 7808] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Dec 31 19:43:54.554133 2025] [:error] [pid 7800:tid 7818] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Dec 31 19:43:54.796863 2025] [:error] [pid 7800:tid 7827] [client 172.213.212.238:1985] File does not exist: /usr/local/apache/htdocs/suspended-page/pepe.php
[Wed Dec 31 19:43:55.047805 2025] [:error] [pid 7800:tid 7811] [client 172.213.212.238:1985] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVUMeyN6RFoECeReAPVgVgAAAYg"]
[Wed Dec 31 19:43:55.549566 2025] [:error] [pid 8068:tid 8090] [client 172.213.212.238:12340] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVUMeySVtzoWnijCxFZcwQAAAdQ"]
[Wed Dec 31 19:43:56.086088 2025] [:error] [pid 64406:tid 64422] [client 172.213.212.238:2003] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVUMfCLRcJYP7e7OhBYdMAAAAQ4"]
[Wed Dec 31 19:43:56.802493 2025] [:error] [pid 48714:tid 48765] [client 172.213.212.238:12343] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aVUMfL9PcChEHWa6ViuOIwAAABQ"]
[Wed Dec 31 19:43:57.347404 2025] [:error] [pid 48715:tid 48794] [client 172.213.212.238:2031] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function.php"] [unique_id "aVUMfWamQpQY7KfuoW1hQAAAAJY"]
[Wed Dec 31 19:43:57.975543 2025] [:error] [pid 48714:tid 48754] [client 172.213.212.238:12395] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function.php"] [unique_id "aVUMfb9PcChEHWa6ViuOJQAAAAk"]
[Wed Dec 31 19:43:58.523170 2025] [:error] [pid 48715:tid 48788] [client 172.213.212.238:12369] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function.php"] [unique_id "aVUMfmamQpQY7KfuoW1hQQAAAJA"]
[Wed Dec 31 19:43:59.096257 2025] [:error] [pid 64406:tid 64418] [client 172.213.212.238:2009] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/function.php"] [unique_id "aVUMfyLRcJYP7e7OhBYdMwAAAQo"]
[Wed Dec 31 19:43:59.973057 2025] [:error] [pid 48715:tid 48790] [client 172.213.212.238:2047] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aVUMf2amQpQY7KfuoW1hQgAAAJI"]
[Wed Dec 31 19:44:00.732888 2025] [:error] [pid 8068:tid 8077] [client 172.213.212.238:1988] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aVUMgCSVtzoWnijCxFZcwwAAAcc"]
[Wed Dec 31 19:44:01.402854 2025] [:error] [pid 7800:tid 7804] [client 172.213.212.238:12351] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aVUMgSN6RFoECeReAPVgWQAAAYE"]
[Wed Dec 31 19:44:02.026225 2025] [:error] [pid 64406:tid 64415] [client 172.213.212.238:12365] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aVUMgiLRcJYP7e7OhBYdNgAAAQc"]
[Wed Dec 31 19:44:02.629249 2025] [:error] [pid 48833:tid 48853] [client 172.213.212.238:1934] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv.php"] [unique_id "aVUMgmPnRNOqqZ1OQg_ylgAAAFI"]
[Wed Dec 31 19:44:03.273378 2025] [:error] [pid 48833:tid 48844] [client 172.213.212.238:2015] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv.php"] [unique_id "aVUMg2PnRNOqqZ1OQg_ylwAAAEk"]
[Wed Dec 31 19:44:03.775999 2025] [:error] [pid 7800:tid 7821] [client 172.213.212.238:12301] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv.php"] [unique_id "aVUMgyN6RFoECeReAPVgXAAAAZI"]
[Wed Dec 31 19:44:04.465380 2025] [:error] [pid 7800:tid 7807] [client 172.213.212.238:12338] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv.php"] [unique_id "aVUMhCN6RFoECeReAPVgXgAAAYQ"]
[Wed Dec 31 19:44:05.421482 2025] [:error] [pid 48715:tid 48796] [client 172.213.212.238:12394] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVUMhWamQpQY7KfuoW1hRgAAAJg"]
[Wed Dec 31 19:44:06.123453 2025] [:error] [pid 48715:tid 48774] [client 172.213.212.238:12297] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVUMhmamQpQY7KfuoW1hSQAAAII"]
[Wed Dec 31 19:44:06.742930 2025] [:error] [pid 48833:tid 48850] [client 172.213.212.238:12398] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVUMhmPnRNOqqZ1OQg_ymwAAAE8"]
[Wed Dec 31 19:44:07.500599 2025] [:error] [pid 48714:tid 48760] [client 172.213.212.238:2004] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aVUMh79PcChEHWa6ViuOLAAAAA8"]
[Wed Dec 31 19:44:08.159700 2025] [:error] [pid 48714:tid 48746] [client 172.213.212.238:1875] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aVUMiL9PcChEHWa6ViuOLQAAAAE"]
[Wed Dec 31 19:44:09.000107 2025] [:error] [pid 48714:tid 48748] [client 172.213.212.238:2019] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aVUMiL9PcChEHWa6ViuOLwAAAAM"]
[Wed Dec 31 19:44:09.563498 2025] [:error] [pid 48713:tid 48725] [client 172.213.212.238:2026] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aVUMiUyNMVAGtWvMliPqngAAAMc"]
[Wed Dec 31 19:44:10.514500 2025] [:error] [pid 7576:tid 7584] [client 172.213.212.238:12332] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "aVUMiqFUpQkpGJNxC_-4OAAAAUY"]
[Wed Dec 31 19:44:11.601184 2025] [:error] [pid 8068:tid 8072] [client 172.213.212.238:2021] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aVUMiySVtzoWnijCxFZcyQAAAcI"]
[Wed Dec 31 19:44:12.427223 2025] [:error] [pid 48713:tid 48740] [client 172.213.212.238:12403] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aVUMjEyNMVAGtWvMliPqoAAAANY"]
[Wed Dec 31 19:44:13.095669 2025] [:error] [pid 7576:tid 7593] [client 172.213.212.238:12300] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aVUMjaFUpQkpGJNxC_-4PQAAAU8"]
[Wed Dec 31 19:44:13.666711 2025] [:error] [pid 48713:tid 48730] [client 172.213.212.238:2005] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options.php"] [unique_id "aVUMjUyNMVAGtWvMliPqoQAAAMw"]
[Wed Dec 31 19:44:14.198898 2025] [:error] [pid 64406:tid 64412] [client 172.213.212.238:2043] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVUMjiLRcJYP7e7OhBYdOgAAAQQ"]
[Wed Dec 31 19:44:14.839467 2025] [:error] [pid 7800:tid 7811] [client 172.213.212.238:1922] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVUMjiN6RFoECeReAPVgZQAAAYg"]
[Wed Dec 31 19:44:15.493496 2025] [:error] [pid 8068:tid 8089] [client 172.213.212.238:2029] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVUMjySVtzoWnijCxFZczAAAAdM"]
[Wed Dec 31 19:44:16.364876 2025] [:error] [pid 7800:tid 7813] [client 172.213.212.238:1991] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aVUMkCN6RFoECeReAPVgaAAAAYo"]
[Wed Dec 31 19:44:17.018571 2025] [:error] [pid 7576:tid 7582] [client 172.213.212.238:2046] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVUMkaFUpQkpGJNxC_-4RAAAAUQ"]
[Wed Dec 31 19:44:17.685909 2025] [:error] [pid 48713:tid 48733] [client 172.213.212.238:2018] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVUMkUyNMVAGtWvMliPqowAAAM8"]
[Wed Dec 31 19:44:18.392995 2025] [:error] [pid 7576:tid 7586] [client 172.213.212.238:12407] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVUMkqFUpQkpGJNxC_-4SAAAAUg"]
[Wed Dec 31 19:44:20.781531 2025] [:error] [pid 48715:tid 48786] [client 172.213.212.238:12291] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aVUMlGamQpQY7KfuoW1hVQAAAI4"]
[Wed Dec 31 19:44:21.390516 2025] [:error] [pid 7800:tid 7803] [client 172.213.212.238:1930] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aVUMlSN6RFoECeReAPVgawAAAYA"]
[Wed Dec 31 19:44:21.941624 2025] [:error] [pid 48833:tid 48857] [client 172.213.212.238:12307] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aVUMlWPnRNOqqZ1OQg_yngAAAFY"]
[Wed Dec 31 19:44:22.525523 2025] [:error] [pid 48714:tid 48768] [client 172.213.212.238:12385] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aVUMlr9PcChEHWa6ViuONgAAABc"]
[Wed Dec 31 19:44:23.154818 2025] [:error] [pid 48713:tid 48736] [client 172.213.212.238:1940] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "aVUMl0yNMVAGtWvMliPqpQAAANI"]
[Wed Dec 31 19:44:23.996434 2025] [:error] [pid 48833:tid 48836] [client 172.213.212.238:2006] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aVUMl2PnRNOqqZ1OQg_ynwAAAEE"]
[Wed Dec 31 19:44:24.540114 2025] [:error] [pid 48714:tid 48769] [client 172.213.212.238:2032] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aVUMmL9PcChEHWa6ViuOOAAAABg"]
[Wed Dec 31 19:44:25.152563 2025] [:error] [pid 48714:tid 48757] [client 172.213.212.238:1937] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aVUMmb9PcChEHWa6ViuOOQAAAAw"]
[Wed Dec 31 19:44:25.751033 2025] [:error] [pid 7576:tid 7599] [client 172.213.212.238:1998] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aVUMmaFUpQkpGJNxC_-4UgAAAVU"]
[Wed Dec 31 19:44:26.742663 2025] [:error] [pid 48713:tid 48720] [client 172.213.212.238:1923] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aVUMmkyNMVAGtWvMliPqqAAAAMI"]
[Wed Dec 31 19:44:27.409614 2025] [:error] [pid 8068:tid 8083] [client 172.213.212.238:12302] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aVUMmySVtzoWnijCxFZc0wAAAc0"]
[Wed Dec 31 19:44:28.001998 2025] [:error] [pid 8068:tid 8092] [client 172.213.212.238:12305] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aVUMnCSVtzoWnijCxFZc1QAAAdY"]
[Wed Dec 31 19:44:28.823198 2025] [:error] [pid 8068:tid 8073] [client 172.213.212.238:12346] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aVUMnCSVtzoWnijCxFZc2AAAAcM"]
[Wed Dec 31 19:44:29.491345 2025] [:error] [pid 8068:tid 8089] [client 172.213.212.238:1959] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aVUMnSSVtzoWnijCxFZc2gAAAdM"]
[Wed Dec 31 19:44:30.022952 2025] [:error] [pid 48715:tid 48773] [client 172.213.212.238:2013] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aVUMnmamQpQY7KfuoW1hWQAAAIE"]
[Wed Dec 31 19:44:30.554700 2025] [:error] [pid 48714:tid 48761] [client 172.213.212.238:1924] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aVUMnr9PcChEHWa6ViuOPAAAABA"]
[Wed Dec 31 19:44:31.215372 2025] [:error] [pid 64406:tid 64417] [client 172.213.212.238:1927] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aVUMnyLRcJYP7e7OhBYdPgAAAQk"]
[Wed Dec 31 19:44:31.925266 2025] [:error] [pid 48715:tid 48793] [client 172.213.212.238:1929] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aVUMn2amQpQY7KfuoW1hWwAAAJU"]
[Wed Dec 31 19:44:32.632393 2025] [:error] [pid 48715:tid 48775] [client 172.213.212.238:1993] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aVUMoGamQpQY7KfuoW1hXQAAAIM"]
[Wed Dec 31 19:44:33.201557 2025] [:error] [pid 7800:tid 7814] [client 172.213.212.238:2011] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aVUMoSN6RFoECeReAPVgbQAAAYs"]
[Wed Dec 31 19:44:33.874433 2025] [:error] [pid 48713:tid 48728] [client 172.213.212.238:1930] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aVUMoUyNMVAGtWvMliPqqgAAAMo"]
[Wed Dec 31 19:44:34.425240 2025] [:error] [pid 48713:tid 48740] [client 172.213.212.238:2025] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/plugins.php"] [unique_id "aVUMokyNMVAGtWvMliPqrAAAANY"]
[Wed Dec 31 19:44:35.092436 2025] [:error] [pid 64406:tid 64424] [client 172.213.212.238:1955] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/plugins.php"] [unique_id "aVUMoyLRcJYP7e7OhBYdPwAAARA"]
[Wed Dec 31 19:44:35.985700 2025] [:error] [pid 48833:tid 48838] [client 172.213.212.238:1942] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/plugins.php"] [unique_id "aVUMo2PnRNOqqZ1OQg_yqQAAAEM"]
[Wed Dec 31 19:44:36.831418 2025] [:error] [pid 8068:tid 8071] [client 172.213.212.238:2012] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/plugins.php"] [unique_id "aVUMpCSVtzoWnijCxFZc3QAAAcE"]
[Wed Dec 31 19:44:37.531148 2025] [:error] [pid 8068:tid 8076] [client 172.213.212.238:1969] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aVUMpSSVtzoWnijCxFZc4AAAAcY"]
[Wed Dec 31 19:44:38.082816 2025] [:error] [pid 8068:tid 8070] [client 172.213.212.238:1979] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aVUMpiSVtzoWnijCxFZc4wAAAcA"]
[Wed Dec 31 19:44:38.929917 2025] [:error] [pid 7576:tid 7593] [client 172.213.212.238:12327] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aVUMpqFUpQkpGJNxC_-4VgAAAU8"]
[Wed Dec 31 19:44:39.497032 2025] [:error] [pid 7576:tid 7581] [client 172.213.212.238:1954] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aVUMp6FUpQkpGJNxC_-4WAAAAUM"]
[Wed Dec 31 19:44:40.063026 2025] [:error] [pid 7800:tid 7818] [client 172.213.212.238:2017] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVUMqCN6RFoECeReAPVgcQAAAY8"]
[Wed Dec 31 19:44:40.609033 2025] [:error] [pid 7800:tid 7812] [client 172.213.212.238:1880] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVUMqCN6RFoECeReAPVgcwAAAYk"]
[Wed Dec 31 19:44:41.188187 2025] [:error] [pid 8068:tid 8073] [client 172.213.212.238:12411] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVUMqSSVtzoWnijCxFZc6AAAAcM"]
[Wed Dec 31 19:44:41.714213 2025] [:error] [pid 7800:tid 7805] [client 172.213.212.238:1925] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aVUMqSN6RFoECeReAPVgdwAAAYI"]
[Wed Dec 31 19:44:42.764942 2025] [:error] [pid 8068:tid 8089] [client 172.213.212.238:12356] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aVUMqiSVtzoWnijCxFZc6QAAAdM"]
[Wed Dec 31 19:44:43.494259 2025] [:error] [pid 48833:tid 48846] [client 172.213.212.238:1965] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aVUMq2PnRNOqqZ1OQg_yqwAAAEs"]
[Wed Dec 31 19:44:44.108043 2025] [:error] [pid 7800:tid 7807] [client 172.213.212.238:2001] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aVUMrCN6RFoECeReAPVgegAAAYQ"]
[Wed Dec 31 19:44:44.727020 2025] [:error] [pid 7800:tid 7817] [client 172.213.212.238:2023] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aVUMrCN6RFoECeReAPVgewAAAY4"]
[Wed Dec 31 19:44:45.297901 2025] [:error] [pid 64406:tid 64427] [client 172.213.212.238:2020] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aVUMrSLRcJYP7e7OhBYdRAAAARM"]
[Wed Dec 31 19:44:45.839672 2025] [:error] [pid 7800:tid 7819] [client 172.213.212.238:1947] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aVUMrSN6RFoECeReAPVgfQAAAZA"]
[Wed Dec 31 19:44:46.494053 2025] [:error] [pid 7800:tid 7810] [client 172.213.212.238:1999] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aVUMriN6RFoECeReAPVgfgAAAYc"]
[Wed Dec 31 19:44:47.209028 2025] [:error] [pid 48713:tid 48738] [client 172.213.212.238:12357] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upload.php"] [unique_id "aVUMr0yNMVAGtWvMliPqsAAAANQ"]
[Wed Dec 31 19:44:48.043172 2025] [:error] [pid 8068:tid 8093] [client 172.213.212.238:12367] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVUMsCSVtzoWnijCxFZc7QAAAdc"]
[Wed Dec 31 19:44:48.665776 2025] [:error] [pid 8068:tid 8075] [client 172.213.212.238:1994] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVUMsCSVtzoWnijCxFZc8QAAAcU"]
[Wed Dec 31 19:44:49.223842 2025] [:error] [pid 7800:tid 7824] [client 172.213.212.238:12314] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVUMsSN6RFoECeReAPVgfwAAAZU"]
[Wed Dec 31 19:44:49.765621 2025] [:error] [pid 48715:tid 48785] [client 172.213.212.238:1933] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aVUMsWamQpQY7KfuoW1hZAAAAI0"]
[Wed Dec 31 19:44:50.457177 2025] [:error] [pid 7800:tid 7818] [client 172.213.212.238:1891] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aVUMsiN6RFoECeReAPVggAAAAY8"]
[Wed Dec 31 19:44:51.012511 2025] [:error] [pid 7800:tid 7808] [client 172.213.212.238:12368] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aVUMsyN6RFoECeReAPVggQAAAYU"]
[Wed Dec 31 19:44:51.569479 2025] [:error] [pid 7800:tid 7812] [client 172.213.212.238:2039] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aVUMsyN6RFoECeReAPVgggAAAYk"]
[Wed Dec 31 19:44:52.304733 2025] [:error] [pid 48833:tid 48844] [client 172.213.212.238:2034] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aVUMtGPnRNOqqZ1OQg_ysgAAAEk"]
[Wed Dec 31 19:44:52.839448 2025] [:error] [pid 48833:tid 48852] [client 172.213.212.238:2045] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aVUMtGPnRNOqqZ1OQg_yswAAAFE"]
[Wed Dec 31 19:44:53.600014 2025] [:error] [pid 48714:tid 48756] [client 172.213.212.238:1987] [client 172.213.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aVUMtb9PcChEHWa6ViuOSwAAAAs"]
[Wed Dec 31 19:44:54.154977 2025] [:error] [pid 64406:tid 64412] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Dec 31 19:44:54.436436 2025] [:error] [pid 64406:tid 64428] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Wed Dec 31 19:44:54.699444 2025] [:error] [pid 64406:tid 64431] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Wed Dec 31 19:44:54.974386 2025] [:error] [pid 64406:tid 64426] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Wed Dec 31 19:44:56.610334 2025] [:error] [pid 64406:tid 64424] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Dec 31 19:44:56.898193 2025] [:error] [pid 64406:tid 64418] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Wed Dec 31 19:44:57.178971 2025] [:error] [pid 64406:tid 64414] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Wed Dec 31 19:44:57.737090 2025] [:error] [pid 64406:tid 64409] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Wed Dec 31 19:44:58.019719 2025] [:error] [pid 64406:tid 64415] [client 172.213.212.238:1944] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Thu Jan 01 17:40:11.830325 2026] [:error] [pid 26613:tid 26628] [client 160.30.68.82:60331] [client 160.30.68.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.68.82, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVZA-5ZHnkJdYNvbC--eNAAAAEY"]
[Thu Jan 01 17:40:11.836330 2026] [:error] [pid 26613:tid 26628] [client 160.30.68.82:60331] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Jan 02 03:17:04.854892 2026] [:error] [pid 19497:tid 19573] [client 4.193.190.39:63015] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php, referer: https://www.google.com/
[Fri Jan 02 03:17:06.164074 2026] [:error] [pid 19497:tid 19559] [client 4.193.190.39:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.bing.com/
[Fri Jan 02 03:17:08.998724 2026] [:error] [pid 19497:tid 19568] [client 4.193.190.39:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php, referer: https://www.google.co.uk/
[Fri Jan 02 03:17:13.783015 2026] [:error] [pid 19497:tid 19577] [client 4.193.190.39:63015] [client 4.193.190.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/index.php"] [unique_id "aVbIOazNNNiUujf1d5Fk8QAAANY"], referer: https://www.bing.com/
[Fri Jan 02 04:10:12.265793 2026] [:error] [pid 63208:tid 63232] [client 154.26.129.117:58870] [client 154.26.129.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aVbUpHKLI9INGPLzfndSJQAAANU"]
[Sat Jan 03 00:05:55.954567 2026] [:error] [pid 43358:tid 43369] [client 98.70.103.76:17359] [client 98.70.103.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVfs4wncbHK9auzvrA-DcQAAAck"]
[Sat Jan 03 00:05:57.421154 2026] [:error] [pid 43358:tid 43374] [client 98.70.103.76:17286] [client 98.70.103.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVfs5QncbHK9auzvrA-DdwAAAc4"]
[Sat Jan 03 00:05:58.755771 2026] [:error] [pid 43358:tid 43377] [client 98.70.103.76:17390] [client 98.70.103.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVfs5gncbHK9auzvrA-DfQAAAdE"]
[Sat Jan 03 00:06:01.822102 2026] [:error] [pid 43358:tid 43378] [client 98.70.103.76:17404] [client 98.70.103.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVfs6QncbHK9auzvrA-DfgAAAdI"]
[Sat Jan 03 01:38:31.397624 2026] [:error] [pid 24749:tid 24754] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/lisa.php
[Sat Jan 03 01:38:31.539024 2026] [:error] [pid 24749:tid 24773] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Sat Jan 03 01:38:31.986732 2026] [:error] [pid 24749:tid 24764] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sat Jan 03 01:38:32.140433 2026] [:error] [pid 24749:tid 24759] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/bless14.php
[Sat Jan 03 01:38:32.283715 2026] [:error] [pid 24749:tid 24775] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/ws35.php
[Sat Jan 03 01:38:32.422082 2026] [:error] [pid 24749:tid 24753] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Sat Jan 03 01:38:32.638272 2026] [:error] [pid 24749:tid 24769] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Sat Jan 03 01:38:32.787401 2026] [:error] [pid 24749:tid 24762] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Jan 03 01:38:33.161270 2026] [:error] [pid 24749:tid 24756] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/acwfihfh.php
[Sat Jan 03 01:38:33.501183 2026] [:error] [pid 24749:tid 24755] [client 20.214.242.147:18200] File does not exist: /usr/local/apache/htdocs/suspended-page/f8.php
[Sat Jan 03 01:38:35.175741 2026] [:error] [pid 24749:tid 24765] [client 20.214.242.147:18200] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgCm0iv6Q9UlqwBJkZg3wAAAM4"]
[Sat Jan 03 01:38:35.699640 2026] [:error] [pid 24661:tid 24739] [client 20.214.242.147:18181] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgCmxfxsu5kmLDAcZuVqgAAAJM"]
[Sat Jan 03 01:38:38.580478 2026] [:error] [pid 24659:tid 24687] [client 20.214.242.147:18201] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgCnmucj-rXdFUnVEs2mgAAABc"]
[Sat Jan 03 01:38:39.267658 2026] [:error] [pid 24749:tid 24753] [client 20.214.242.147:18191] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgCn0iv6Q9UlqwBJkZg6QAAAMI"]
[Sat Jan 03 01:38:42.239392 2026] [:error] [pid 24659:tid 24669] [client 20.214.242.147:18226] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVgComucj-rXdFUnVEs2oAAAAAU"]
[Sat Jan 03 01:38:43.895399 2026] [:error] [pid 24660:tid 24700] [client 20.214.242.147:18371] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVgCo2ZwWsLNsJ3ZH7bRbwAAAEc"]
[Sat Jan 03 01:38:59.286870 2026] [:error] [pid 24659:tid 24666] [client 20.214.242.147:18211] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVgCs2ucj-rXdFUnVEs2vwAAAAI"]
[Sat Jan 03 01:39:22.507273 2026] [:error] [pid 24660:tid 24702] [client 20.214.242.147:18192] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aVgCymZwWsLNsJ3ZH7bRuwAAAEk"]
[Sat Jan 03 01:39:28.499182 2026] [:error] [pid 24749:tid 24765] [client 20.214.242.147:18187] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aVgC0Eiv6Q9UlqwBJkZhdgAAAM4"]
[Sat Jan 03 01:39:33.210895 2026] [:error] [pid 24749:tid 24752] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/21x.php
[Sat Jan 03 01:39:33.354920 2026] [:error] [pid 24749:tid 24770] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/out.php
[Sat Jan 03 01:39:33.525620 2026] [:error] [pid 24749:tid 24763] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/flower2.php
[Sat Jan 03 01:39:33.676051 2026] [:error] [pid 24749:tid 24764] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/family.php
[Sat Jan 03 01:39:33.865686 2026] [:error] [pid 24749:tid 24760] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Sat Jan 03 01:39:34.020788 2026] [:error] [pid 24749:tid 24768] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Sat Jan 03 01:39:34.183363 2026] [:error] [pid 24749:tid 24767] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Sat Jan 03 01:39:34.360175 2026] [:error] [pid 24749:tid 24756] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/lanz.php
[Sat Jan 03 01:39:34.498358 2026] [:error] [pid 24749:tid 24761] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/xeeex.php
[Sat Jan 03 01:39:34.663961 2026] [:error] [pid 24749:tid 24751] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/tons.php
[Sat Jan 03 01:39:34.821481 2026] [:error] [pid 24749:tid 24759] [client 20.214.242.147:18387] File does not exist: /usr/local/apache/htdocs/suspended-page/wpup.php
[Sat Jan 03 01:39:34.959157 2026] [:error] [pid 24749:tid 24755] [client 20.214.242.147:18387] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aVgC1kiv6Q9UlqwBJkZhmQAAAMQ"]
[Sat Jan 03 01:39:35.873610 2026] [:error] [pid 24661:tid 24735] [client 20.214.242.147:18223] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aVgC1xfxsu5kmLDAcZuWPgAAAI8"]
[Sat Jan 03 01:39:48.469639 2026] [:error] [pid 24749:tid 24760] [client 20.214.242.147:18221] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aVgC5Eiv6Q9UlqwBJkZhuwAAAMk"]
[Sat Jan 03 01:40:00.342347 2026] [:error] [pid 24661:tid 24732] [client 20.214.242.147:18236] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2f.php"] [unique_id "aVgC8Bfxsu5kmLDAcZuWbAAAAIw"]
[Sat Jan 03 01:40:01.501777 2026] [:error] [pid 24661:tid 24742] [client 20.214.242.147:18220] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2f.php"] [unique_id "aVgC8Rfxsu5kmLDAcZuWbgAAAJY"]
[Sat Jan 03 01:40:04.509096 2026] [:error] [pid 24749:tid 24771] [client 20.214.242.147:18213] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2f.php"] [unique_id "aVgC9Eiv6Q9UlqwBJkZh8wAAANQ"]
[Sat Jan 03 01:40:24.733764 2026] [:error] [pid 24660:tid 24706] [client 20.214.242.147:18374] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aVgDCGZwWsLNsJ3ZH7bSIAAAAE0"]
[Sat Jan 03 01:40:32.962679 2026] [:error] [pid 24749:tid 24761] [client 20.214.242.147:18189] [client 20.214.242.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aVgDEEiv6Q9UlqwBJkZiEwAAAMo"]
[Sat Jan 03 01:40:35.975797 2026] [:error] [pid 24660:tid 24710] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sat Jan 03 01:40:36.118911 2026] [:error] [pid 24660:tid 24708] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/990.php
[Sat Jan 03 01:40:36.603166 2026] [:error] [pid 24660:tid 24703] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/d996699999.php
[Sat Jan 03 01:40:36.746324 2026] [:error] [pid 24660:tid 24699] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/ierne.php
[Sat Jan 03 01:40:36.899854 2026] [:error] [pid 24660:tid 24700] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/xde.php
[Sat Jan 03 01:40:37.038023 2026] [:error] [pid 24660:tid 24698] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/1yade.php
[Sat Jan 03 01:40:37.332308 2026] [:error] [pid 24660:tid 24712] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Sat Jan 03 01:40:37.490748 2026] [:error] [pid 24660:tid 24707] [client 20.214.242.147:18376] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sat Jan 03 02:37:49.587871 2026] [:error] [pid 24659:tid 24684] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/lisa.php
[Sat Jan 03 02:37:49.981220 2026] [:error] [pid 24659:tid 24668] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Sat Jan 03 02:37:52.575211 2026] [:error] [pid 24659:tid 24668] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sat Jan 03 02:37:52.715517 2026] [:error] [pid 24659:tid 24664] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/bless14.php
[Sat Jan 03 02:37:52.855181 2026] [:error] [pid 24659:tid 24687] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/ws35.php
[Sat Jan 03 02:37:52.994925 2026] [:error] [pid 24659:tid 24665] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Sat Jan 03 02:37:53.134482 2026] [:error] [pid 24659:tid 24686] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Sat Jan 03 02:37:53.277210 2026] [:error] [pid 24659:tid 24680] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Jan 03 02:37:53.418130 2026] [:error] [pid 24659:tid 24688] [client 135.235.168.239:65257] File does not exist: /usr/local/apache/htdocs/suspended-page/acwfihfh.php
[Sat Jan 03 02:37:53.801057 2026] [:error] [pid 24659:tid 24683] [client 135.235.168.239:65257] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVgQgWucj-rXdFUnVEtOvQAAABM"]
[Sat Jan 03 02:37:54.859656 2026] [:error] [pid 24660:tid 24693] [client 135.235.168.239:64403] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVgQgmZwWsLNsJ3ZH7bqZwAAAEA"]
[Sat Jan 03 02:37:56.304016 2026] [:error] [pid 47234:tid 47260] [client 135.235.168.239:64399] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVgQhB2w_O5NbPWiWO_mEwAAARg"]
[Sat Jan 03 02:37:56.837480 2026] [:error] [pid 24661:tid 24729] [client 135.235.168.239:65196] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVgQhBfxsu5kmLDAcZuxcgAAAIk"]
[Sat Jan 03 02:37:57.607725 2026] [:error] [pid 24661:tid 24741] [client 135.235.168.239:65209] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgQhRfxsu5kmLDAcZuxdAAAAJU"]
[Sat Jan 03 02:37:58.089660 2026] [:error] [pid 47234:tid 47256] [client 135.235.168.239:65193] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgQhh2w_O5NbPWiWO_mGAAAARQ"]
[Sat Jan 03 02:37:58.580679 2026] [:error] [pid 47234:tid 47244] [client 135.235.168.239:65251] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgQhh2w_O5NbPWiWO_mGgAAAQg"]
[Sat Jan 03 02:37:59.177605 2026] [:error] [pid 47234:tid 47251] [client 135.235.168.239:64491] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVgQhx2w_O5NbPWiWO_mHgAAAQ8"]
[Sat Jan 03 02:37:59.676455 2026] [:error] [pid 24659:tid 24684] [client 135.235.168.239:64484] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVgQh2ucj-rXdFUnVEtOwwAAABQ"]
[Sat Jan 03 02:38:01.631698 2026] [:error] [pid 47234:tid 47255] [client 135.235.168.239:64473] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVgQiR2w_O5NbPWiWO_mJQAAARM"]
[Sat Jan 03 02:38:02.164118 2026] [:error] [pid 24659:tid 24687] [client 135.235.168.239:65220] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVgQimucj-rXdFUnVEtOyAAAABc"]
[Sat Jan 03 02:38:03.408053 2026] [:error] [pid 47234:tid 47236] [client 135.235.168.239:64407] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVgQix2w_O5NbPWiWO_mJwAAAQA"]
[Sat Jan 03 02:38:04.967396 2026] [:error] [pid 24660:tid 24717] [client 135.235.168.239:64486] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVgQjGZwWsLNsJ3ZH7bqbAAAAFg"]
[Sat Jan 03 02:38:05.771517 2026] [:error] [pid 24661:tid 24741] [client 135.235.168.239:65211] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVgQjRfxsu5kmLDAcZuxgwAAAJU"]
[Sat Jan 03 02:38:06.639099 2026] [:error] [pid 47234:tid 47245] [client 135.235.168.239:65247] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVgQjh2w_O5NbPWiWO_mLAAAAQk"]
[Sat Jan 03 02:38:08.220020 2026] [:error] [pid 24660:tid 24703] [client 135.235.168.239:64463] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVgQkGZwWsLNsJ3ZH7bqbQAAAEo"]
[Sat Jan 03 02:38:10.622875 2026] [:error] [pid 24660:tid 24697] [client 135.235.168.239:62971] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aVgQkmZwWsLNsJ3ZH7bqdAAAAEQ"]
[Sat Jan 03 02:38:11.576214 2026] [:error] [pid 24661:tid 24731] [client 135.235.168.239:64396] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aVgQkxfxsu5kmLDAcZuxiwAAAIs"]
[Sat Jan 03 02:38:12.458889 2026] [:error] [pid 24659:tid 24684] [client 135.235.168.239:64496] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aVgQlGucj-rXdFUnVEtO0AAAABQ"]
[Sat Jan 03 02:38:13.012473 2026] [:error] [pid 24661:tid 24723] [client 135.235.168.239:64389] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/21x.php"] [unique_id "aVgQlRfxsu5kmLDAcZuxkAAAAIM"]
[Sat Jan 03 02:38:13.735368 2026] [:error] [pid 24660:tid 24698] [client 135.235.168.239:65267] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aVgQlWZwWsLNsJ3ZH7bqeQAAAEU"]
[Sat Jan 03 02:38:15.210310 2026] [:error] [pid 24660:tid 24715] [client 135.235.168.239:64412] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aVgQl2ZwWsLNsJ3ZH7bqfQAAAFY"]
[Sat Jan 03 02:38:17.097502 2026] [:error] [pid 24660:tid 24701] [client 135.235.168.239:64454] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aVgQmWZwWsLNsJ3ZH7bqggAAAEg"]
[Sat Jan 03 02:38:17.650003 2026] [:error] [pid 24660:tid 24704] [client 135.235.168.239:64386] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/out.php"] [unique_id "aVgQmWZwWsLNsJ3ZH7bqhAAAAEs"]
[Sat Jan 03 02:38:18.847556 2026] [:error] [pid 47234:tid 47238] [client 135.235.168.239:64488] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aVgQmh2w_O5NbPWiWO_mOQAAAQI"]
[Sat Jan 03 02:38:19.975009 2026] [:error] [pid 47234:tid 47241] [client 135.235.168.239:65165] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aVgQmx2w_O5NbPWiWO_mPAAAAQU"]
[Sat Jan 03 02:38:20.672374 2026] [:error] [pid 24661:tid 24724] [client 135.235.168.239:65237] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aVgQnBfxsu5kmLDAcZuxmQAAAIQ"]
[Sat Jan 03 02:38:22.874045 2026] [:error] [pid 24661:tid 24734] [client 135.235.168.239:65170] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower2.php"] [unique_id "aVgQnhfxsu5kmLDAcZuxqAAAAI4"]
[Sat Jan 03 02:38:23.648144 2026] [:error] [pid 47234:tid 47260] [client 135.235.168.239:64485] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aVgQnx2w_O5NbPWiWO_mQAAAARg"]
[Sat Jan 03 02:38:24.369796 2026] [:error] [pid 24749:tid 24756] [client 135.235.168.239:65241] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aVgQoEiv6Q9UlqwBJkaDrwAAAMU"]
[Sat Jan 03 02:38:26.127472 2026] [:error] [pid 24749:tid 24759] [client 135.235.168.239:61698] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aVgQokiv6Q9UlqwBJkaDuwAAAMg"]
[Sat Jan 03 02:38:27.526599 2026] [:error] [pid 24749:tid 24767] [client 135.235.168.239:64398] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/family.php"] [unique_id "aVgQo0iv6Q9UlqwBJkaDxwAAANA"]
[Sat Jan 03 02:38:28.692157 2026] [:error] [pid 24749:tid 24751] [client 135.235.168.239:64501] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aVgQpEiv6Q9UlqwBJkaD1QAAAMA"]
[Sat Jan 03 02:38:29.268502 2026] [:error] [pid 24749:tid 24767] [client 135.235.168.239:64404] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aVgQpUiv6Q9UlqwBJkaD1wAAANA"]
[Sat Jan 03 02:38:30.132654 2026] [:error] [pid 24749:tid 24761] [client 135.235.168.239:65273] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aVgQpkiv6Q9UlqwBJkaD2QAAAMo"]
[Sat Jan 03 02:38:30.908138 2026] [:error] [pid 24749:tid 24763] [client 135.235.168.239:65197] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aVgQpkiv6Q9UlqwBJkaD3AAAAMw"]
[Sat Jan 03 02:38:32.451045 2026] [:error] [pid 24661:tid 24734] [client 135.235.168.239:65221] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aVgQqBfxsu5kmLDAcZuxtwAAAI4"]
[Sat Jan 03 02:38:33.052756 2026] [:error] [pid 24661:tid 24726] [client 135.235.168.239:65233] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aVgQqRfxsu5kmLDAcZuxuQAAAIY"]
[Sat Jan 03 02:38:34.099213 2026] [:error] [pid 24661:tid 24738] [client 135.235.168.239:65179] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aVgQqhfxsu5kmLDAcZuxvAAAAJI"]
[Sat Jan 03 02:38:34.636989 2026] [:error] [pid 24659:tid 24675] [client 135.235.168.239:65192] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aVgQqmucj-rXdFUnVEtO2QAAAAs"]
[Sat Jan 03 02:38:35.549999 2026] [:error] [pid 47234:tid 47255] [client 135.235.168.239:64500] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aVgQqx2w_O5NbPWiWO_mYgAAARM"]
[Sat Jan 03 02:38:36.374812 2026] [:error] [pid 24659:tid 24682] [client 135.235.168.239:65163] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aVgQrGucj-rXdFUnVEtO2wAAABI"]
[Sat Jan 03 02:38:36.844563 2026] [:error] [pid 24749:tid 24760] [client 135.235.168.239:61701] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aVgQrEiv6Q9UlqwBJkaD6QAAAMk"]
[Sat Jan 03 02:38:37.981779 2026] [:error] [pid 24661:tid 24732] [client 135.235.168.239:62913] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aVgQrRfxsu5kmLDAcZuxxwAAAIw"]
[Sat Jan 03 02:38:39.076372 2026] [:error] [pid 24660:tid 24705] [client 135.235.168.239:64405] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVgQr2ZwWsLNsJ3ZH7bqrgAAAEw"]
[Sat Jan 03 02:38:39.987334 2026] [:error] [pid 24661:tid 24736] [client 135.235.168.239:64468] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVgQrxfxsu5kmLDAcZux0wAAAJA"]
[Sat Jan 03 02:38:41.072649 2026] [:error] [pid 24660:tid 24702] [client 135.235.168.239:65229] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVgQsWZwWsLNsJ3ZH7bquQAAAEk"]
[Sat Jan 03 02:38:42.223755 2026] [:error] [pid 47234:tid 47257] [client 135.235.168.239:65155] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVgQsh2w_O5NbPWiWO_mdgAAARU"]
[Sat Jan 03 02:38:42.828345 2026] [:error] [pid 24749:tid 24759] [client 135.235.168.239:65235] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVgQskiv6Q9UlqwBJkaD-AAAAMg"]
[Sat Jan 03 02:38:43.709339 2026] [:error] [pid 47234:tid 47253] [client 135.235.168.239:65176] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVgQsx2w_O5NbPWiWO_mfQAAARE"]
[Sat Jan 03 02:38:45.872810 2026] [:error] [pid 47234:tid 47249] [client 135.235.168.239:64450] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVgQtR2w_O5NbPWiWO_mhQAAAQ0"]
[Sat Jan 03 02:38:46.391919 2026] [:error] [pid 47234:tid 47252] [client 135.235.168.239:64453] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVgQth2w_O5NbPWiWO_miAAAARA"]
[Sat Jan 03 02:38:47.208452 2026] [:error] [pid 47234:tid 47253] [client 135.235.168.239:65183] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVgQtx2w_O5NbPWiWO_mkQAAARE"]
[Sat Jan 03 02:38:48.795122 2026] [:error] [pid 24749:tid 24770] [client 135.235.168.239:65194] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVgQuEiv6Q9UlqwBJkaECgAAANM"]
[Sat Jan 03 02:38:51.383286 2026] [:error] [pid 47234:tid 47241] [client 135.235.168.239:64467] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVgQux2w_O5NbPWiWO_mqQAAAQU"]
[Sat Jan 03 02:38:52.486858 2026] [:error] [pid 24749:tid 24771] [client 135.235.168.239:64424] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVgQvEiv6Q9UlqwBJkaEHAAAANQ"]
[Sat Jan 03 02:38:53.400478 2026] [:error] [pid 24749:tid 24760] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/wpup.php
[Sat Jan 03 02:38:53.846676 2026] [:error] [pid 24749:tid 24754] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Sat Jan 03 02:38:53.995703 2026] [:error] [pid 24749:tid 24758] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/f2f.php
[Sat Jan 03 02:38:54.136077 2026] [:error] [pid 24749:tid 24775] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/ths.php
[Sat Jan 03 02:38:54.289035 2026] [:error] [pid 24749:tid 24756] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sat Jan 03 02:38:54.727726 2026] [:error] [pid 24749:tid 24755] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/990.php
[Sat Jan 03 02:38:54.885851 2026] [:error] [pid 24749:tid 24769] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/d996699999.php
[Sat Jan 03 02:38:55.026971 2026] [:error] [pid 24749:tid 24766] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/ierne.php
[Sat Jan 03 02:38:55.198280 2026] [:error] [pid 24749:tid 24751] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/xde.php
[Sat Jan 03 02:38:55.336985 2026] [:error] [pid 24749:tid 24771] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/1yade.php
[Sat Jan 03 02:38:55.476658 2026] [:error] [pid 24749:tid 24767] [client 135.235.168.239:65188] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Sat Jan 03 02:38:55.612325 2026] [:error] [pid 24749:tid 24764] [client 135.235.168.239:65188] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVgQv0iv6Q9UlqwBJkaENAAAAM0"]
[Sat Jan 03 02:38:57.129410 2026] [:error] [pid 24660:tid 24706] [client 135.235.168.239:65268] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVgQwWZwWsLNsJ3ZH7bq3AAAAE0"]
[Sat Jan 03 02:38:58.254002 2026] [:error] [pid 24749:tid 24763] [client 135.235.168.239:65254] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVgQwkiv6Q9UlqwBJkaERAAAAMw"]
[Sat Jan 03 02:39:00.303704 2026] [:error] [pid 24659:tid 24675] [client 135.235.168.239:64421] [client 135.235.168.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVgQxGucj-rXdFUnVEtPAQAAAAs"]
[Sat Jan 03 07:27:19.115175 2026] [:error] [pid 34260:tid 34264] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.yahoo.com/
[Sat Jan 03 07:27:19.135051 2026] [:error] [pid 34260:tid 34265] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.bing.com/
[Sat Jan 03 07:27:19.154817 2026] [:error] [pid 34260:tid 34285] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.de/
[Sat Jan 03 07:27:19.175169 2026] [:error] [pid 34260:tid 34275] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.google.co.uk/
[Sat Jan 03 07:27:19.195777 2026] [:error] [pid 34260:tid 34278] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.google.de/
[Sat Jan 03 07:27:19.216117 2026] [:error] [pid 34260:tid 34286] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.bing.com/
[Sat Jan 03 07:27:19.235773 2026] [:error] [pid 34260:tid 34263] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.google.co.uk/
[Sat Jan 03 07:27:19.255426 2026] [:error] [pid 34260:tid 34269] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.bing.com/
[Sat Jan 03 07:27:19.276841 2026] [:error] [pid 34260:tid 34281] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://duckduckgo.com/
[Sat Jan 03 07:27:19.296752 2026] [:error] [pid 34260:tid 34271] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://duckduckgo.com/
[Sat Jan 03 07:27:19.317380 2026] [:error] [pid 34260:tid 34272] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.yahoo.com/
[Sat Jan 03 07:27:19.338312 2026] [:error] [pid 34260:tid 34270] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.bing.com/
[Sat Jan 03 07:27:19.360052 2026] [:error] [pid 34260:tid 34276] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.bing.com/
[Sat Jan 03 07:27:19.379760 2026] [:error] [pid 34260:tid 34282] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php, referer: https://www.google.fr/
[Sat Jan 03 07:27:19.395723 2026] [:error] [pid 34260:tid 34267] [client 68.218.89.201:35709] [client 68.218.89.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.218.89.201, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVhUV0WWhyvZ0O9KNVTpnQAAAQU"], referer: https://www.google.co.uk/
[Sat Jan 03 07:27:19.399567 2026] [:error] [pid 34260:tid 34267] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://www.google.co.uk/
[Sat Jan 03 07:27:19.418994 2026] [:error] [pid 34260:tid 34277] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.bing.com/
[Sat Jan 03 07:27:19.438738 2026] [:error] [pid 34260:tid 34279] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://duckduckgo.com/
[Sat Jan 03 07:27:19.458342 2026] [:error] [pid 34260:tid 34284] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php, referer: https://www.google.co.uk/
[Sat Jan 03 07:27:19.478567 2026] [:error] [pid 34260:tid 34274] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.yahoo.com/
[Sat Jan 03 07:27:19.498983 2026] [:error] [pid 34260:tid 34283] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.de/
[Sat Jan 03 07:27:19.518988 2026] [:error] [pid 34260:tid 34266] [client 68.218.89.201:35709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.de/
[Sat Jan 03 07:27:21.152112 2026] [:error] [pid 34260:tid 34282] [client 68.218.89.201:35709] [client 68.218.89.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aVhUWUWWhyvZ0O9KNVTpsQAAARQ"], referer: https://www.google.co.uk/
[Sat Jan 03 07:27:21.182056 2026] [:error] [pid 1930:tid 1979] [client 68.218.89.201:35703] [client 68.218.89.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aVhUWZP-6mqhfUDa89wZAwAAAE0"], referer: https://duckduckgo.com/
[Sat Jan 03 07:27:21.218393 2026] [:error] [pid 1930:tid 1981] [client 68.218.89.201:35590] [client 68.218.89.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aVhUWZP-6mqhfUDa89wZBAAAAE8"], referer: https://www.google.co.uk/
[Sat Jan 03 07:27:21.250933 2026] [:error] [pid 1930:tid 1987] [client 68.218.89.201:35589] [client 68.218.89.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aVhUWZP-6mqhfUDa89wZBQAAAFU"], referer: https://www.google.de/
[Sat Jan 03 07:27:21.284010 2026] [:error] [pid 19639:tid 19658] [client 68.218.89.201:35648] [client 68.218.89.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aVhUWSQ7fWZUytnlHEw91QAAAVE"], referer: https://www.yahoo.com/
[Sat Jan 03 21:45:28.840677 2026] [:error] [pid 19639:tid 19649] [client 170.80.37.100:24575] [client 170.80.37.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.80.37.100, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aVkdeCQ7fWZUytnlHEwDLAAAAUg"]
[Sat Jan 03 21:45:28.845425 2026] [:error] [pid 19639:tid 19649] [client 170.80.37.100:24575] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Jan 04 01:42:14.397391 2026] [:error] [pid 49228:tid 49247] [client 104.28.246.116:32318] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aVlU9nCPk2c4rRZq2JT9qQAAAA4"]
[Sun Jan 04 01:42:15.835090 2026] [:error] [pid 49230:tid 49304] [client 104.28.246.116:32320] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/style.php"] [unique_id "aVlU932klmw7JRfgM3jFNQAAAJA"]
[Sun Jan 04 02:13:32.848609 2026] [:error] [pid 49319:tid 49327] [client 103.77.106.81:55431] [client 103.77.106.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aVlcTLcNXYLFZOiX4cRb3gAAAMY"]
[Sun Jan 04 05:19:53.641190 2026] [:error] [pid 37536:tid 37556] [client 103.77.107.178:61229] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aVmH-W-iKLialy_3rkvvxgAAABA"]
[Sun Jan 04 15:21:12.413736 2026] [:error] [pid 64248:tid 64259] [client 195.178.110.246:55042] [client 195.178.110.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aVoU6MZZ_5Iet2g0ae3WwwAAAEk"]
[Sun Jan 04 18:05:55.630939 2026] [:error] [pid 15480:tid 15499] [client 138.197.13.155:55308] [client 138.197.13.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/"] [unique_id "aVo7gxBWKIu3SdvwTFigqQAAAJE"], referer: binance.com
[Sun Jan 04 18:05:58.140241 2026] [:error] [pid 40438:tid 40488] [client 138.197.13.155:54243] [client 138.197.13.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aVo7hm-Zg2tMMYUYJEc0bQAAApU"], referer: binance.com
[Sun Jan 04 18:06:00.716727 2026] [:error] [pid 40438:tid 40468] [client 138.197.13.155:51850] [client 138.197.13.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aVo7iG-Zg2tMMYUYJEc0dQAAAoE"], referer: binance.com
[Sun Jan 04 18:31:39.960932 2026] [:error] [pid 1020:tid 1032] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/nz.php
[Sun Jan 04 18:31:40.443903 2026] [:error] [pid 1020:tid 1040] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Sun Jan 04 18:31:40.582335 2026] [:error] [pid 1020:tid 1030] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sun Jan 04 18:31:40.720256 2026] [:error] [pid 1020:tid 1033] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Sun Jan 04 18:31:40.857786 2026] [:error] [pid 1020:tid 1038] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Sun Jan 04 18:31:40.996330 2026] [:error] [pid 1020:tid 1035] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Jan 04 18:31:41.216053 2026] [:error] [pid 1020:tid 1034] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Sun Jan 04 18:31:41.353958 2026] [:error] [pid 1020:tid 1045] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Sun Jan 04 18:31:41.509358 2026] [:error] [pid 1020:tid 1023] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Sun Jan 04 18:31:41.662170 2026] [:error] [pid 1020:tid 1047] [client 20.196.89.46:50560] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sun Jan 04 18:31:41.807335 2026] [:error] [pid 1020:tid 1025] [client 20.196.89.46:50560] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVpBjVzz6-t0R3_Ito1ATgAAAUI"]
[Sun Jan 04 18:31:48.259044 2026] [:error] [pid 47095:tid 47132] [client 20.196.89.46:45654] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVpBlL4vyPZCmfGyjmpwtQAAAcg"]
[Sun Jan 04 18:31:50.939221 2026] [:error] [pid 47094:tid 47101] [client 20.196.89.46:50597] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVpBluAxKgshwhlDnPMtDQAAAQQ"]
[Sun Jan 04 18:31:53.730324 2026] [:error] [pid 1020:tid 1037] [client 20.196.89.46:47041] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aVpBmVzz6-t0R3_Ito1AVgAAAU4"]
[Sun Jan 04 18:31:55.814321 2026] [:error] [pid 47942:tid 47956] [client 20.196.89.46:49807] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpBm9l8KP_6OW2F8x8c6AAAAYs"]
[Sun Jan 04 18:31:58.260098 2026] [:error] [pid 47095:tid 47128] [client 20.196.89.46:45392] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpBnr4vyPZCmfGyjmpwvwAAAcQ"]
[Sun Jan 04 18:32:00.847766 2026] [:error] [pid 47999:tid 48026] [client 20.196.89.46:45150] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpBoOMhn5ryR2RfEqn5TwAAApc"]
[Sun Jan 04 18:32:05.405101 2026] [:error] [pid 47095:tid 47129] [client 20.196.89.46:44554] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpBpb4vyPZCmfGyjmpw0QAAAcU"]
[Sun Jan 04 18:32:06.060202 2026] [:error] [pid 47943:tid 47973] [client 20.196.89.46:49810] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpBpr2PMvm86Oe91S9OIwAAAgE"]
[Sun Jan 04 18:32:07.398129 2026] [:error] [pid 47943:tid 47988] [client 20.196.89.46:50285] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpBp72PMvm86Oe91S9OKQAAAhA"]
[Sun Jan 04 18:32:08.296598 2026] [:error] [pid 47943:tid 47977] [client 20.196.89.46:13760] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpBqL2PMvm86Oe91S9OMgAAAgU"]
[Sun Jan 04 18:32:08.952520 2026] [:error] [pid 47943:tid 47981] [client 20.196.89.46:45139] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpBqL2PMvm86Oe91S9ONAAAAgk"]
[Sun Jan 04 18:32:10.168518 2026] [:error] [pid 47943:tid 47982] [client 20.196.89.46:44549] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpBqr2PMvm86Oe91S9OOwAAAgo"]
[Sun Jan 04 18:32:11.145384 2026] [:error] [pid 47943:tid 47972] [client 20.196.89.46:49796] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpBq72PMvm86Oe91S9OPQAAAgA"]
[Sun Jan 04 18:32:12.084872 2026] [:error] [pid 47943:tid 47974] [client 20.196.89.46:13321] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpBrL2PMvm86Oe91S9OQAAAAgI"]
[Sun Jan 04 18:32:14.048826 2026] [:error] [pid 1080:tid 1152] [client 20.196.89.46:49825] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpBriu2Hm9AcIiqg0q80AAAA80"]
[Sun Jan 04 18:32:16.646703 2026] [:error] [pid 47942:tid 47958] [client 20.196.89.46:45425] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVpBsNl8KP_6OW2F8x8c-wAAAY0"]
[Sun Jan 04 18:32:18.686049 2026] [:error] [pid 47942:tid 47966] [client 20.196.89.46:45380] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVpBstl8KP_6OW2F8x8dAQAAAZU"]
[Sun Jan 04 18:32:25.954005 2026] [:error] [pid 47943:tid 47982] [client 20.196.89.46:45423] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVpBub2PMvm86Oe91S9OVgAAAgo"]
[Sun Jan 04 18:32:31.853326 2026] [:error] [pid 47943:tid 47980] [client 20.196.89.46:13345] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpBv72PMvm86Oe91S9OaQAAAgg"]
[Sun Jan 04 18:32:36.645313 2026] [:error] [pid 47094:tid 47105] [client 20.196.89.46:49826] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpBxOAxKgshwhlDnPMtJQAAAQg"]
[Sun Jan 04 18:32:38.412159 2026] [:error] [pid 47943:tid 47985] [client 20.196.89.46:14212] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpBxr2PMvm86Oe91S9OcQAAAg0"]
[Sun Jan 04 18:32:40.152452 2026] [:error] [pid 47094:tid 47104] [client 20.196.89.46:50269] [client 20.196.89.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpByOAxKgshwhlDnPMtKAAAAQc"]
[Sun Jan 04 18:32:43.028137 2026] [:error] [pid 47943:tid 47974] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/gaje.php
[Sun Jan 04 18:32:44.406119 2026] [:error] [pid 47943:tid 47974] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Sun Jan 04 18:32:44.579652 2026] [:error] [pid 47943:tid 47990] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Sun Jan 04 18:32:44.723451 2026] [:error] [pid 47943:tid 47981] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/msy.php
[Sun Jan 04 18:32:44.939321 2026] [:error] [pid 47943:tid 47979] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/alog.php
[Sun Jan 04 18:32:45.076249 2026] [:error] [pid 47943:tid 47985] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/X7T6.php
[Sun Jan 04 18:32:45.213806 2026] [:error] [pid 47943:tid 47973] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Sun Jan 04 18:32:45.371286 2026] [:error] [pid 47943:tid 47994] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Sun Jan 04 18:32:45.526583 2026] [:error] [pid 47943:tid 47977] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Sun Jan 04 18:32:45.675632 2026] [:error] [pid 47943:tid 47989] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Sun Jan 04 18:32:45.813339 2026] [:error] [pid 47943:tid 47984] [client 20.196.89.46:44862] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Sun Jan 04 21:04:22.673383 2026] [:error] [pid 17268:tid 17274] [client 158.178.240.178:59660] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVplVrPW8UB8HzRRfIdETgAAAUM"], referer: https://www.google.com/
[Sun Jan 04 21:04:22.677578 2026] [:error] [pid 17268:tid 17274] [client 158.178.240.178:59660] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Sun Jan 04 21:04:23.038831 2026] [:error] [pid 23868:tid 23894] [client 158.178.240.178:59901] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVplV7baf-JYFyQL_057vAAAAFI"], referer: https://duckduckgo.com/
[Sun Jan 04 21:04:23.043029 2026] [:error] [pid 23868:tid 23894] [client 158.178.240.178:59901] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://duckduckgo.com/
[Sun Jan 04 21:04:23.982396 2026] [:error] [pid 23968:tid 24001] [client 158.178.240.178:60086] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVplV2zpAzHWBUMs-z6AGAAAAgM"], referer: https://www.bing.com/
[Sun Jan 04 21:04:23.989018 2026] [:error] [pid 23968:tid 24001] [client 158.178.240.178:60086] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.bing.com/
[Sun Jan 04 21:04:24.348453 2026] [:error] [pid 29414:tid 29418] [client 158.178.240.178:60363] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVplWJjI-BFMXszJTEp8TAAAAwA"], referer: https://www.google.com/
[Sun Jan 04 21:04:24.352716 2026] [:error] [pid 29414:tid 29418] [client 158.178.240.178:60363] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Sun Jan 04 21:49:10.509427 2026] [:error] [pid 37227:tid 37306] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Sun Jan 04 21:49:10.628814 2026] [:error] [pid 37227:tid 37296] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sun Jan 04 21:49:10.748243 2026] [:error] [pid 37227:tid 37292] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Sun Jan 04 21:49:11.492391 2026] [:error] [pid 37227:tid 37294] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Sun Jan 04 21:49:11.614611 2026] [:error] [pid 37227:tid 37286] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Jan 04 21:49:11.775063 2026] [:error] [pid 37227:tid 37309] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Sun Jan 04 21:49:11.895122 2026] [:error] [pid 37227:tid 37305] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Sun Jan 04 21:49:12.045939 2026] [:error] [pid 37227:tid 37291] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Sun Jan 04 21:49:12.167410 2026] [:error] [pid 37227:tid 37285] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sun Jan 04 21:49:12.288595 2026] [:error] [pid 37227:tid 37293] [client 20.205.97.96:34428] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Sun Jan 04 21:49:12.406087 2026] [:error] [pid 37227:tid 37289] [client 20.205.97.96:34428] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpv2JAQAfXb5IgCkZOZ4AAAA8Q"]
[Sun Jan 04 21:49:13.512669 2026] [:error] [pid 37165:tid 37213] [client 20.205.97.96:28256] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpv2VwRLzfe8wOrQpRc0wAAAk4"]
[Sun Jan 04 21:49:14.202005 2026] [:error] [pid 30954:tid 30964] [client 20.205.97.96:34378] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpv2k4oIXUIQsb698rogAAAAQg"]
[Sun Jan 04 21:49:15.142988 2026] [:error] [pid 30954:tid 30980] [client 20.205.97.96:28278] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVpv204oIXUIQsb698rohAAAARg"]
[Sun Jan 04 21:49:15.804369 2026] [:error] [pid 37227:tid 37301] [client 20.205.97.96:39030] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpv25AQAfXb5IgCkZOZ4QAAA9A"]
[Sun Jan 04 21:49:16.807310 2026] [:error] [pid 23868:tid 23890] [client 20.205.97.96:39037] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpv3Lbaf-JYFyQL_06KYwAAAE4"]
[Sun Jan 04 21:49:17.565594 2026] [:error] [pid 30985:tid 31038] [client 20.205.97.96:38980] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpv3UisiM0XfzVcTWCtVwAAAdg"]
[Sun Jan 04 21:49:18.276925 2026] [:error] [pid 30985:tid 31028] [client 20.205.97.96:39038] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVpv3kisiM0XfzVcTWCtWgAAAc4"]
[Sun Jan 04 21:49:19.605515 2026] [:error] [pid 23868:tid 23880] [client 20.205.97.96:39026] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpv37baf-JYFyQL_06KZgAAAEQ"]
[Sun Jan 04 21:49:20.181111 2026] [:error] [pid 23868:tid 23881] [client 20.205.97.96:34375] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpv4Lbaf-JYFyQL_06KagAAAEU"]
[Sun Jan 04 21:49:21.699512 2026] [:error] [pid 37165:tid 37200] [client 20.205.97.96:34403] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpv4VwRLzfe8wOrQpRc4QAAAkE"]
[Sun Jan 04 21:49:22.701504 2026] [:error] [pid 37165:tid 37220] [client 20.205.97.96:39101] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVpv4lwRLzfe8wOrQpRc4wAAAlU"]
[Sun Jan 04 21:49:23.288181 2026] [:error] [pid 37165:tid 37206] [client 20.205.97.96:39081] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVpv41wRLzfe8wOrQpRc5gAAAkc"]
[Sun Jan 04 21:49:23.998455 2026] [:error] [pid 34877:tid 34895] [client 20.205.97.96:17000] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVpv4973XYSsDqIgloxDHwAAAZA"]
[Sun Jan 04 21:49:25.247643 2026] [:error] [pid 29351:tid 29387] [client 20.205.97.96:34429] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVpv5ZtGiMsRmNcKXvpB3QAAAsM"]
[Sun Jan 04 21:49:25.860013 2026] [:error] [pid 34968:tid 35015] [client 20.205.97.96:16991] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVpv5XfPZUTHI4LyaU3GXQAAA5E"]
[Sun Jan 04 21:49:26.314978 2026] [:error] [pid 30985:tid 31030] [client 20.205.97.96:28231] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpv5kisiM0XfzVcTWCtXwAAAdA"]
[Sun Jan 04 21:49:27.306787 2026] [:error] [pid 37165:tid 37213] [client 20.205.97.96:31318] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpv51wRLzfe8wOrQpRc7QAAAk4"]
[Sun Jan 04 21:49:27.916979 2026] [:error] [pid 34968:tid 35003] [client 20.205.97.96:11788] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpv53fPZUTHI4LyaU3GXwAAA4U"]
[Sun Jan 04 21:49:28.980605 2026] [:error] [pid 34968:tid 35021] [client 20.205.97.96:28244] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVpv6HfPZUTHI4LyaU3GYgAAA5c"]
[Sun Jan 04 21:49:30.103694 2026] [:error] [pid 23868:tid 23884] [client 20.205.97.96:34431] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aVpv6rbaf-JYFyQL_06KeQAAAEg"]
[Sun Jan 04 21:49:32.160740 2026] [:error] [pid 29351:tid 29399] [client 20.205.97.96:31354] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aVpv7JtGiMsRmNcKXvpB4gAAAs8"]
[Sun Jan 04 21:49:33.075568 2026] [:error] [pid 30954:tid 30979] [client 20.205.97.96:17009] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aVpv7U4oIXUIQsb698romQAAARc"]
[Sun Jan 04 21:49:33.534092 2026] [:error] [pid 34877:tid 34903] [client 20.205.97.96:39092] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aVpv7d73XYSsDqIgloxDKgAAAZg"]
[Sun Jan 04 21:49:34.255298 2026] [:error] [pid 34909:tid 34921] [client 20.205.97.96:31359] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aVpv7vapPFwNYuuHrErqsAAAAgg"]
[Sun Jan 04 21:49:34.936399 2026] [:error] [pid 23868:tid 23893] [client 20.205.97.96:39070] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aVpv7rbaf-JYFyQL_06KfgAAAFE"]
[Sun Jan 04 21:49:35.926401 2026] [:error] [pid 30985:tid 31033] [client 20.205.97.96:28236] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aVpv70isiM0XfzVcTWCtaAAAAdM"]
[Sun Jan 04 21:49:36.912356 2026] [:error] [pid 37164:tid 37178] [client 20.205.97.96:31326] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aVpv8OtKMVhFX_Z4JX7I5QAAAUY"]
[Sun Jan 04 21:49:38.194470 2026] [:error] [pid 37164:tid 37182] [client 20.205.97.96:16999] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aVpv8utKMVhFX_Z4JX7I7AAAAUo"]
[Sun Jan 04 21:49:39.090382 2026] [:error] [pid 30954:tid 30957] [client 20.205.97.96:22965] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aVpv804oIXUIQsb698rorQAAAQE"]
[Sun Jan 04 21:49:39.775301 2026] [:error] [pid 37165:tid 37222] [client 20.205.97.96:32632] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aVpv81wRLzfe8wOrQpRdAAAAAlc"]
[Sun Jan 04 21:49:40.371964 2026] [:error] [pid 29351:tid 29395] [client 20.205.97.96:38977] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aVpv9JtGiMsRmNcKXvpB6gAAAss"]
[Sun Jan 04 21:49:41.020417 2026] [:error] [pid 37165:tid 37211] [client 20.205.97.96:17005] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aVpv9VwRLzfe8wOrQpRdAwAAAkw"]
[Sun Jan 04 21:49:42.728904 2026] [:error] [pid 37227:tid 37300] [client 20.205.97.96:17013] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aVpv9pAQAfXb5IgCkZOZ6gAAA88"]
[Sun Jan 04 21:49:43.987345 2026] [:error] [pid 34968:tid 35002] [client 20.205.97.96:28251] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aVpv93fPZUTHI4LyaU3GZQAAA4Q"]
[Sun Jan 04 21:49:44.829522 2026] [:error] [pid 34877:tid 34890] [client 20.205.97.96:28249] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aVpv-N73XYSsDqIgloxDOQAAAYs"]
[Sun Jan 04 21:49:46.027567 2026] [:error] [pid 34968:tid 35020] [client 20.205.97.96:20181] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aVpv-nfPZUTHI4LyaU3GagAAA5Y"]
[Sun Jan 04 21:49:46.992201 2026] [:error] [pid 30985:tid 31037] [client 20.205.97.96:28261] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aVpv-kisiM0XfzVcTWCtfgAAAdc"]
[Sun Jan 04 21:49:47.457228 2026] [:error] [pid 37227:tid 37289] [client 20.205.97.96:31357] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aVpv-5AQAfXb5IgCkZOZ8gAAA8Q"]
[Sun Jan 04 21:49:48.053908 2026] [:error] [pid 30985:tid 31021] [client 20.205.97.96:11792] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aVpv_EisiM0XfzVcTWCtggAAAcc"]
[Sun Jan 04 21:49:48.747894 2026] [:error] [pid 34877:tid 34895] [client 20.205.97.96:28250] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aVpv_N73XYSsDqIgloxDRAAAAZA"]
[Sun Jan 04 21:49:49.243142 2026] [:error] [pid 37165:tid 37201] [client 20.205.97.96:28237] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aVpv_VwRLzfe8wOrQpRdCQAAAkI"]
[Sun Jan 04 21:49:50.167235 2026] [:error] [pid 34877:tid 34891] [client 20.205.97.96:22939] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aVpv_t73XYSsDqIgloxDRgAAAYw"]
[Sun Jan 04 21:49:50.696622 2026] [:error] [pid 37164:tid 37196] [client 20.205.97.96:20195] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aVpv_utKMVhFX_Z4JX7JAQAAAVg"]
[Sun Jan 04 21:49:51.257823 2026] [:error] [pid 37164:tid 37191] [client 20.205.97.96:31332] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aVpv_-tKMVhFX_Z4JX7JAwAAAVM"]
[Sun Jan 04 21:49:51.808882 2026] [:error] [pid 30985:tid 31021] [client 20.205.97.96:22969] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aVpv_0isiM0XfzVcTWCtiwAAAcc"]
[Sun Jan 04 21:49:52.251436 2026] [:error] [pid 23868:tid 23898] [client 20.205.97.96:32610] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aVpwALbaf-JYFyQL_06KkQAAAFY"]
[Sun Jan 04 21:49:53.127417 2026] [:error] [pid 30985:tid 31022] [client 20.205.97.96:32628] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aVpwAUisiM0XfzVcTWCtjgAAAcg"]
[Sun Jan 04 21:49:53.690368 2026] [:error] [pid 30954:tid 30980] [client 20.205.97.96:31335] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aVpwAU4oIXUIQsb698roswAAARg"]
[Sun Jan 04 21:49:54.880590 2026] [:error] [pid 30954:tid 30957] [client 20.205.97.96:26579] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aVpwAk4oIXUIQsb698rotAAAAQE"]
[Sun Jan 04 21:49:55.368383 2026] [:error] [pid 34909:tid 34936] [client 20.205.97.96:36118] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aVpwA_apPFwNYuuHrErquAAAAhc"]
[Sun Jan 04 21:49:55.823491 2026] [:error] [pid 23868:tid 23889] [client 20.205.97.96:36126] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aVpwA7baf-JYFyQL_06KlwAAAE0"]
[Sun Jan 04 21:49:56.422617 2026] [:error] [pid 29351:tid 29404] [client 20.205.97.96:20312] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aVpwBJtGiMsRmNcKXvpB9AAAAtQ"]
[Sun Jan 04 21:49:57.035666 2026] [:error] [pid 34968:tid 35011] [client 20.205.97.96:12009] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aVpwBXfPZUTHI4LyaU3GbgAAA40"]
[Sun Jan 04 21:49:58.093261 2026] [:error] [pid 29351:tid 29405] [client 20.205.97.96:20122] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aVpwBptGiMsRmNcKXvpB9gAAAtU"]
[Sun Jan 04 21:49:58.847111 2026] [:error] [pid 37165:tid 37206] [client 20.205.97.96:36148] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aVpwBlwRLzfe8wOrQpRdFQAAAkc"]
[Sun Jan 04 21:49:59.650827 2026] [:error] [pid 37227:tid 37285] [client 20.205.97.96:12015] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aVpwB5AQAfXb5IgCkZOZ-wAAA8A"]
[Sun Jan 04 21:50:00.126220 2026] [:error] [pid 37165:tid 37216] [client 20.205.97.96:39398] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aVpwCFwRLzfe8wOrQpRdGQAAAlE"]
[Sun Jan 04 21:50:00.824464 2026] [:error] [pid 30954:tid 30973] [client 20.205.97.96:26576] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aVpwCE4oIXUIQsb698rovAAAARE"]
[Sun Jan 04 21:50:01.325998 2026] [:error] [pid 34968:tid 35014] [client 20.205.97.96:26613] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aVpwCXfPZUTHI4LyaU3GcQAAA5A"]
[Sun Jan 04 21:50:02.442562 2026] [:error] [pid 34968:tid 35013] [client 20.205.97.96:16798] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aVpwCnfPZUTHI4LyaU3GcgAAA48"]
[Sun Jan 04 21:50:03.597682 2026] [:error] [pid 37165:tid 37202] [client 20.205.97.96:20314] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aVpwC1wRLzfe8wOrQpRdHgAAAkM"]
[Sun Jan 04 21:50:04.151254 2026] [:error] [pid 34968:tid 35022] [client 20.205.97.96:27591] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aVpwDHfPZUTHI4LyaU3GeAAAA5g"]
[Sun Jan 04 21:50:05.099656 2026] [:error] [pid 34877:tid 34895] [client 20.205.97.96:20112] [client 20.205.97.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aVpwDd73XYSsDqIgloxDWgAAAZA"]
[Mon Jan 05 00:10:03.222000 2026] [:error] [pid 22630:tid 22646] [client 45.61.148.251:59721] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Providers/HtmlEditorProviders/Telerik/Telerik.Web.UI.DialogHandler.aspx"] [unique_id "aVqQ25xemtx5dcQQ28Xb9gAAAE4"]
[Mon Jan 05 00:10:04.458249 2026] [:error] [pid 22540:tid 22574] [client 45.61.148.251:59787] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Providers/HtmlEditorProviders/Telerik/Telerik.Web.UI.DialogHandler.aspx"] [unique_id "aVqQ3DQAa5AoSeJHBNpwqAAAAAA"]
[Mon Jan 05 00:10:05.317263 2026] [:error] [pid 22630:tid 22655] [client 45.61.148.251:59846] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ3Zxemtx5dcQQ28Xb-QAAAFc"]
[Mon Jan 05 00:10:06.070955 2026] [:error] [pid 22541:tid 22604] [client 45.61.148.251:59847] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ3kkjzS6tgkL3JEuhmQAAAgM"]
[Mon Jan 05 00:10:07.064531 2026] [:error] [pid 22539:tid 22553] [client 45.61.148.251:59850] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/DesktopModules/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ3xhJ_AcHbaXPfzEqFwAAAwk"]
[Mon Jan 05 00:10:07.839479 2026] [:error] [pid 22630:tid 22649] [client 45.61.148.251:59909] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/DesktopModules/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ35xemtx5dcQQ28Xb_gAAAFE"]
[Mon Jan 05 00:10:08.860138 2026] [:error] [pid 22540:tid 22595] [client 45.61.148.251:59914] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/DesktopModules/Admin/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ4DQAa5AoSeJHBNpwsAAAABU"]
[Mon Jan 05 00:10:09.987110 2026] [:error] [pid 22540:tid 22590] [client 45.61.148.251:59919] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/DesktopModules/Admin/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ4TQAa5AoSeJHBNpwsgAAABA"]
[Mon Jan 05 00:10:10.895510 2026] [:error] [pid 22630:tid 22641] [client 45.61.148.251:59972] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/DesktopModules/TelerikWebUI/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ4pxemtx5dcQQ28XcBQAAAEk"]
[Mon Jan 05 00:10:11.782620 2026] [:error] [pid 22540:tid 22579] [client 45.61.148.251:59975] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/DesktopModules/TelerikWebUI/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ4zQAa5AoSeJHBNpwuwAAAAU"]
[Mon Jan 05 00:10:12.718912 2026] [:error] [pid 22630:tid 22632] [client 45.61.148.251:59978] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Providers/HtmlEditorProviders/Telerik/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ5Jxemtx5dcQQ28XcDgAAAEA"]
[Mon Jan 05 00:10:13.446624 2026] [:error] [pid 22541:tid 22619] [client 45.61.148.251:59981] [client 45.61.148.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Providers/HtmlEditorProviders/Telerik/Telerik.Web.UI.WebResource.axd"] [unique_id "aVqQ5UkjzS6tgkL3JEuhoQAAAhI"]
[Mon Jan 05 03:41:12.566758 2026] [:error] [pid 2963:tid 3070] [client 158.178.240.178:53720] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVrCWBQTgbzsI_gSnPRfHgAAAEU"]
[Mon Jan 05 03:41:12.571376 2026] [:error] [pid 2963:tid 3070] [client 158.178.240.178:53720] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Jan 05 03:41:12.947073 2026] [:error] [pid 2963:tid 3068] [client 158.178.240.178:53890] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVrCWBQTgbzsI_gSnPRfIAAAAEM"], referer: https://www.google.com/
[Mon Jan 05 03:41:12.950926 2026] [:error] [pid 2963:tid 3068] [client 158.178.240.178:53890] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Mon Jan 05 03:41:13.945448 2026] [:error] [pid 2963:tid 3071] [client 158.178.240.178:54062] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVrCWRQTgbzsI_gSnPRfIwAAAEY"]
[Mon Jan 05 03:41:13.949252 2026] [:error] [pid 2963:tid 3071] [client 158.178.240.178:54062] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Jan 05 03:41:14.318826 2026] [:error] [pid 2958:tid 3036] [client 158.178.240.178:54231] [client 158.178.240.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.178.240.178, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVrCWov-f7LkmF_kF-wT4AAAAAQ"], referer: https://www.google.com/search?q=wordpress
[Mon Jan 05 03:41:14.322855 2026] [:error] [pid 2958:tid 3036] [client 158.178.240.178:54231] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/search?q=wordpress
[Mon Jan 05 15:36:38.987525 2026] [:error] [pid 54081:tid 54095] [client 173.212.218.148:53257] [client 173.212.218.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aVtqBlL4jLgtF-b9w4c8XAAAAUs"]
[Mon Jan 05 15:36:39.701788 2026] [:error] [pid 5632:tid 5652] [client 173.212.218.148:52354] [client 173.212.218.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/app/etc/local.xml" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/etc/local.xml"] [unique_id "aVtqB4N3ZWvlOh-nbt99KwAAAMg"]
[Mon Jan 05 17:45:51.663291 2026] [:error] [pid 6680:tid 6688] [client 94.130.222.48:51798] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Mon Jan 05 17:45:57.096322 2026] [:error] [pid 28407:tid 28429] [client 94.130.222.48:62751] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Mon Jan 05 17:46:02.946450 2026] [:error] [pid 6680:tid 6682] [client 94.130.222.48:52266] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Mon Jan 05 17:46:14.050863 2026] [:error] [pid 5534:tid 5555] [client 94.130.222.48:57964] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Mon Jan 05 19:50:28.662879 2026] [:error] [pid 5534:tid 5561] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Mon Jan 05 19:50:28.800883 2026] [:error] [pid 5534:tid 5556] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Mon Jan 05 19:50:28.938767 2026] [:error] [pid 5534:tid 5554] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Mon Jan 05 19:50:29.295403 2026] [:error] [pid 5534:tid 5564] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Mon Jan 05 19:50:29.438509 2026] [:error] [pid 5534:tid 5563] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Mon Jan 05 19:50:29.591022 2026] [:error] [pid 5534:tid 5545] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Mon Jan 05 19:50:29.734197 2026] [:error] [pid 5534:tid 5567] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Mon Jan 05 19:50:29.871676 2026] [:error] [pid 5534:tid 5555] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Mon Jan 05 19:50:30.010235 2026] [:error] [pid 5534:tid 5550] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Mon Jan 05 19:50:30.503564 2026] [:error] [pid 5534:tid 5551] [client 4.217.221.21:61848] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Mon Jan 05 19:50:30.639045 2026] [:error] [pid 5534:tid 5562] [client 4.217.221.21:61848] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVulhpNs9XmbR6unB0y9GAAAABM"]
[Mon Jan 05 19:50:31.575670 2026] [:error] [pid 5534:tid 5546] [client 4.217.221.21:58531] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVulh5Ns9XmbR6unB0y9GQAAAAM"]
[Mon Jan 05 19:50:36.788592 2026] [:error] [pid 28407:tid 28414] [client 4.217.221.21:58734] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVuljNercd3ptydUzM0_DgAAAYQ"]
[Mon Jan 05 19:50:41.532373 2026] [:error] [pid 5534:tid 5561] [client 4.217.221.21:58506] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aVulkZNs9XmbR6unB0y9HwAAABI"]
[Mon Jan 05 19:50:45.290035 2026] [:error] [pid 5536:tid 5616] [client 4.217.221.21:10614] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVullQRtMZNG6xI8yDzhuwAAAJM"]
[Mon Jan 05 19:50:47.832311 2026] [:error] [pid 6680:tid 6697] [client 4.217.221.21:56712] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVull6E58uNoazzTmx3qsQAAAQ8"]
[Mon Jan 05 19:50:49.346778 2026] [:error] [pid 5632:tid 5645] [client 4.217.221.21:56090] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVulmYN3ZWvlOh-nbt-_WgAAAME"]
[Mon Jan 05 19:50:51.596884 2026] [:error] [pid 5536:tid 5602] [client 4.217.221.21:56724] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aVulmwRtMZNG6xI8yDzhwAAAAIU"]
[Mon Jan 05 19:50:53.553180 2026] [:error] [pid 28407:tid 28415] [client 4.217.221.21:55882] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVulndercd3ptydUzM0_IAAAAYU"]
[Mon Jan 05 19:50:56.333461 2026] [:error] [pid 6680:tid 6698] [client 4.217.221.21:57706] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVuloKE58uNoazzTmx3quAAAARA"]
[Mon Jan 05 19:50:59.026800 2026] [:error] [pid 5534:tid 5565] [client 4.217.221.21:50599] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVulo5Ns9XmbR6unB0y9UwAAABY"]
[Mon Jan 05 19:51:00.467877 2026] [:error] [pid 5632:tid 5647] [client 4.217.221.21:57690] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aVulpIN3ZWvlOh-nbt-_XgAAAMM"]
[Mon Jan 05 19:51:03.277579 2026] [:error] [pid 5632:tid 5651] [client 4.217.221.21:50606] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVulp4N3ZWvlOh-nbt-_YwAAAMc"]
[Mon Jan 05 19:51:08.705118 2026] [:error] [pid 5535:tid 5583] [client 4.217.221.21:62411] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aVulrGnkedMjhVX0PTVqQAAAAE0"]
[Mon Jan 05 19:51:16.769941 2026] [:error] [pid 54081:tid 54102] [client 4.217.221.21:56781] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVultFL4jLgtF-b9w4d9LwAAAVI"]
[Mon Jan 05 19:51:20.046176 2026] [:error] [pid 54081:tid 54095] [client 4.217.221.21:11171] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVuluFL4jLgtF-b9w4d9MwAAAUs"]
[Mon Jan 05 19:51:23.391487 2026] [:error] [pid 5534:tid 5564] [client 4.217.221.21:52937] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVulu5Ns9XmbR6unB0y9WwAAABU"]
[Mon Jan 05 19:51:25.218922 2026] [:error] [pid 5536:tid 5620] [client 4.217.221.21:57610] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aVulvQRtMZNG6xI8yDzh8wAAAJc"]
[Mon Jan 05 19:51:26.433135 2026] [:error] [pid 54081:tid 54097] [client 4.217.221.21:52941] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aVulvlL4jLgtF-b9w4d9OAAAAU0"]
[Mon Jan 05 19:51:27.491446 2026] [:error] [pid 5632:tid 5645] [client 4.217.221.21:62463] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aVulv4N3ZWvlOh-nbt-_cAAAAME"]
[Mon Jan 05 19:51:29.345967 2026] [:error] [pid 54081:tid 54084] [client 4.217.221.21:52928] [client 4.217.221.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aVulwVL4jLgtF-b9w4d9PAAAAUA"]
[Mon Jan 05 19:51:30.292455 2026] [:error] [pid 5536:tid 5608] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/gaje.php
[Mon Jan 05 19:51:30.670701 2026] [:error] [pid 5536:tid 5615] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Mon Jan 05 19:51:30.894134 2026] [:error] [pid 5536:tid 5601] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Mon Jan 05 19:51:31.031118 2026] [:error] [pid 5536:tid 5611] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/msy.php
[Mon Jan 05 19:51:31.170128 2026] [:error] [pid 5536:tid 5606] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/alog.php
[Mon Jan 05 19:51:31.308819 2026] [:error] [pid 5536:tid 5599] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/X7T6.php
[Mon Jan 05 19:51:31.470623 2026] [:error] [pid 5536:tid 5620] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Mon Jan 05 19:51:31.609202 2026] [:error] [pid 5536:tid 5604] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Mon Jan 05 19:51:31.871996 2026] [:error] [pid 5536:tid 5610] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Mon Jan 05 19:51:32.009165 2026] [:error] [pid 5536:tid 5597] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Mon Jan 05 19:51:32.192533 2026] [:error] [pid 5536:tid 5618] [client 4.217.221.21:56092] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Tue Jan 06 00:29:31.985234 2026] [:error] [pid 60509:tid 60537] [client 40.71.212.238:2011] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conter.php
[Tue Jan 06 00:29:32.837506 2026] [:error] [pid 60509:tid 60525] [client 40.71.212.238:2011] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-adminmaintmailer.php
[Tue Jan 06 00:29:33.046517 2026] [:error] [pid 60509:tid 60541] [client 40.71.212.238:2011] [client 40.71.212.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.71.212.238, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/en/wp-login.php"] [unique_id "aVvm7aBSiT1_wVwKSvQX8gAAAFQ"]
[Tue Jan 06 00:29:33.934158 2026] [:error] [pid 60509:tid 60540] [client 40.71.212.238:2011] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "aVvm7aBSiT1_wVwKSvQX-AAAAFM"]
[Tue Jan 06 00:29:35.734309 2026] [:error] [pid 60514:tid 60583] [client 40.71.212.238:2005] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "aVvm7270C0kefOIBEs9Q7wAAAMg"]
[Tue Jan 06 00:29:36.678374 2026] [:error] [pid 60509:tid 60544] [client 40.71.212.238:2006] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "aVvm8KBSiT1_wVwKSvQYAAAAAFc"]
[Tue Jan 06 00:29:37.304375 2026] [:error] [pid 60605:tid 60617] [client 40.71.212.238:2028] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "aVvm8ZGdDsTlcaRtgxQ2gwAAAQo"]
[Tue Jan 06 00:29:37.790329 2026] [:error] [pid 60514:tid 60580] [client 40.71.212.238:2024] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "aVvm8W70C0kefOIBEs9Q9gAAAMU"]
[Tue Jan 06 00:29:38.484033 2026] [:error] [pid 60510:tid 60565] [client 40.71.212.238:1744] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "aVvm8m3HNEkuMRrTL0L_pQAAAJE"]
[Tue Jan 06 00:29:39.795227 2026] [:error] [pid 60605:tid 60612] [client 40.71.212.238:2023] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "aVvm85GdDsTlcaRtgxQ2jQAAAQU"]
[Tue Jan 06 00:29:40.525088 2026] [:error] [pid 29187:tid 29211] [client 40.71.212.238:1739] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "aVvm9ISYYRtfmMXGZCp8KgAAABY"]
[Tue Jan 06 00:29:41.146187 2026] [:error] [pid 29187:tid 29192] [client 40.71.212.238:1986] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVvm9YSYYRtfmMXGZCp8LQAAAAM"]
[Tue Jan 06 00:29:42.335388 2026] [:error] [pid 60605:tid 60607] [client 40.71.212.238:2047] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVvm9pGdDsTlcaRtgxQ2kAAAAQA"]
[Tue Jan 06 00:29:43.269225 2026] [:error] [pid 60605:tid 60618] [client 40.71.212.238:1994] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVvm95GdDsTlcaRtgxQ2kQAAAQs"]
[Tue Jan 06 00:29:43.825815 2026] [:error] [pid 60514:tid 60585] [client 40.71.212.238:2025] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanz.php"] [unique_id "aVvm9270C0kefOIBEs9RBgAAAMo"]
[Tue Jan 06 00:29:44.651617 2026] [:error] [pid 29187:tid 29204] [client 40.71.212.238:1745] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVvm-ISYYRtfmMXGZCp8NQAAAA8"]
[Tue Jan 06 00:29:45.531502 2026] [:error] [pid 29187:tid 29207] [client 40.71.212.238:2000] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVvm-YSYYRtfmMXGZCp8NwAAABI"]
[Tue Jan 06 00:29:46.307608 2026] [:error] [pid 60514:tid 60576] [client 40.71.212.238:1984] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVvm-m70C0kefOIBEs9RCwAAAME"]
[Tue Jan 06 00:29:46.903292 2026] [:error] [pid 29187:tid 29208] [client 40.71.212.238:1746] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xeeex.php"] [unique_id "aVvm-oSYYRtfmMXGZCp8PAAAABM"]
[Tue Jan 06 00:29:47.717709 2026] [:error] [pid 60514:tid 60598] [client 40.71.212.238:1736] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVvm-270C0kefOIBEs9RDgAAANc"]
[Tue Jan 06 00:29:48.420064 2026] [:error] [pid 29187:tid 29192] [client 40.71.212.238:2030] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVvm_ISYYRtfmMXGZCp8SQAAAAM"]
[Tue Jan 06 00:29:49.126959 2026] [:error] [pid 60605:tid 60613] [client 40.71.212.238:1987] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVvm_ZGdDsTlcaRtgxQ2mwAAAQY"]
[Tue Jan 06 00:29:50.208212 2026] [:error] [pid 60510:tid 60555] [client 40.71.212.238:2038] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tons.php"] [unique_id "aVvm_m3HNEkuMRrTL0L_twAAAIc"]
[Tue Jan 06 00:29:51.472920 2026] [:error] [pid 29187:tid 29210] [client 40.71.212.238:2015] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aVvm_4SYYRtfmMXGZCp8WgAAABU"]
[Tue Jan 06 00:29:53.672538 2026] [:error] [pid 60605:tid 60620] [client 40.71.212.238:1728] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aVvnAZGdDsTlcaRtgxQ2rAAAAQ0"]
[Tue Jan 06 00:29:56.969216 2026] [:error] [pid 60509:tid 60529] [client 40.71.212.238:2032] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aVvnBKBSiT1_wVwKSvQYJQAAAEg"]
[Tue Jan 06 00:29:59.379009 2026] [:error] [pid 60605:tid 60630] [client 40.71.212.238:1750] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aVvnB5GdDsTlcaRtgxQ2vQAAARc"]
[Tue Jan 06 00:30:02.794762 2026] [:error] [pid 60514:tid 60576] [client 40.71.212.238:1938] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aVvnCm70C0kefOIBEs9RGQAAAME"]
[Tue Jan 06 00:30:04.452503 2026] [:error] [pid 60510:tid 60567] [client 40.71.212.238:1734] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aVvnDG3HNEkuMRrTL0L_2QAAAJM"]
[Tue Jan 06 00:30:06.317406 2026] [:error] [pid 60510:tid 60558] [client 40.71.212.238:2026] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aVvnDm3HNEkuMRrTL0L_4AAAAIo"]
[Tue Jan 06 00:30:07.944443 2026] [:error] [pid 60509:tid 60534] [client 40.71.212.238:2018] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aVvnD6BSiT1_wVwKSvQYMwAAAE0"]
[Tue Jan 06 00:30:08.688361 2026] [:error] [pid 60605:tid 60615] [client 40.71.212.238:2040] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVvnEJGdDsTlcaRtgxQ23gAAAQg"]
[Tue Jan 06 00:30:10.179428 2026] [:error] [pid 60514:tid 60585] [client 40.71.212.238:1752] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVvnEm70C0kefOIBEs9RJQAAAMo"]
[Tue Jan 06 00:30:11.777833 2026] [:error] [pid 29187:tid 29207] [client 40.71.212.238:2003] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVvnE4SYYRtfmMXGZCp82AAAABI"]
[Tue Jan 06 00:30:12.427620 2026] [:error] [pid 60510:tid 60556] [client 40.71.212.238:2044] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aVvnFG3HNEkuMRrTL0L_7QAAAIg"]
[Tue Jan 06 00:30:13.631489 2026] [:error] [pid 60514:tid 60590] [client 40.71.212.238:2043] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acwfihfh.php"] [unique_id "aVvnFW70C0kefOIBEs9RKwAAAM8"]
[Tue Jan 06 00:30:14.957720 2026] [:error] [pid 60514:tid 60584] [client 40.71.212.238:1749] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acwfihfh.php"] [unique_id "aVvnFm70C0kefOIBEs9RLgAAAMk"]
[Tue Jan 06 00:30:15.551306 2026] [:error] [pid 60605:tid 60629] [client 40.71.212.238:1998] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acwfihfh.php"] [unique_id "aVvnF5GdDsTlcaRtgxQ27gAAARY"]
[Tue Jan 06 00:30:16.806120 2026] [:error] [pid 60605:tid 60616] [client 40.71.212.238:1779] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acwfihfh.php"] [unique_id "aVvnGJGdDsTlcaRtgxQ29gAAAQk"]
[Tue Jan 06 00:30:17.612933 2026] [:error] [pid 29187:tid 29192] [client 40.71.212.238:1747] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVvnGYSYYRtfmMXGZCp85AAAAAM"]
[Tue Jan 06 00:30:18.385938 2026] [:error] [pid 60514:tid 60599] [client 40.71.212.238:2036] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVvnGm70C0kefOIBEs9RNQAAANg"]
[Tue Jan 06 00:30:19.439742 2026] [:error] [pid 29187:tid 29191] [client 40.71.212.238:2020] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVvnG4SYYRtfmMXGZCp86gAAAAI"]
[Tue Jan 06 00:30:20.454431 2026] [:error] [pid 60510:tid 60552] [client 40.71.212.238:1995] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f8.php"] [unique_id "aVvnHG3HNEkuMRrTL0L__QAAAIQ"]
[Tue Jan 06 00:30:21.415221 2026] [:error] [pid 29187:tid 29205] [client 40.71.212.238:2019] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVvnHYSYYRtfmMXGZCp89AAAABA"]
[Tue Jan 06 00:30:22.282151 2026] [:error] [pid 29187:tid 29200] [client 40.71.212.238:1731] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVvnHoSYYRtfmMXGZCp8-AAAAAs"]
[Tue Jan 06 00:30:23.441353 2026] [:error] [pid 60510:tid 60562] [client 40.71.212.238:1751] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVvnH23HNEkuMRrTL0IABgAAAI4"]
[Tue Jan 06 00:30:24.555388 2026] [:error] [pid 60514:tid 60596] [client 40.71.212.238:1756] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bras.php"] [unique_id "aVvnIG70C0kefOIBEs9RPgAAANU"]
[Tue Jan 06 00:30:25.244419 2026] [:error] [pid 60605:tid 60630] [client 40.71.212.238:2022] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVvnIZGdDsTlcaRtgxQ3BQAAARc"]
[Tue Jan 06 00:30:26.113055 2026] [:error] [pid 60510:tid 60548] [client 40.71.212.238:2009] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVvnIm3HNEkuMRrTL0IACwAAAIA"]
[Tue Jan 06 00:30:27.429609 2026] [:error] [pid 60605:tid 60628] [client 40.71.212.238:1769] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVvnI5GdDsTlcaRtgxQ3CQAAARU"]
[Tue Jan 06 00:30:28.097435 2026] [:error] [pid 60509:tid 60533] [client 40.71.212.238:2029] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an8.php"] [unique_id "aVvnJKBSiT1_wVwKSvQYkAAAAEw"]
[Tue Jan 06 00:30:29.001822 2026] [:error] [pid 60605:tid 60629] [client 40.71.212.238:2046] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVvnJZGdDsTlcaRtgxQ3DgAAARY"]
[Tue Jan 06 00:30:29.725997 2026] [:error] [pid 60509:tid 60529] [client 40.71.212.238:1742] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVvnJaBSiT1_wVwKSvQYlgAAAEg"]
[Tue Jan 06 00:30:30.397259 2026] [:error] [pid 60509:tid 60534] [client 40.71.212.238:1765] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVvnJqBSiT1_wVwKSvQYmgAAAE0"]
[Tue Jan 06 00:30:32.136315 2026] [:error] [pid 60514:tid 60592] [client 40.71.212.238:2034] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/esp.php"] [unique_id "aVvnKG70C0kefOIBEs9RTAAAANE"]
[Tue Jan 06 00:30:33.073253 2026] [:error] [pid 60605:tid 60610] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/21x.php
[Tue Jan 06 00:30:33.479389 2026] [:error] [pid 60605:tid 60608] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/out.php
[Tue Jan 06 00:30:33.739633 2026] [:error] [pid 60605:tid 60608] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/flower2.php
[Tue Jan 06 00:30:33.960300 2026] [:error] [pid 60605:tid 60622] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/family.php
[Tue Jan 06 00:30:34.177745 2026] [:error] [pid 60605:tid 60609] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Tue Jan 06 00:30:34.396225 2026] [:error] [pid 60605:tid 60618] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Tue Jan 06 00:30:34.744447 2026] [:error] [pid 60605:tid 60623] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Tue Jan 06 00:30:34.963449 2026] [:error] [pid 60605:tid 60621] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/bless14.php
[Tue Jan 06 00:30:35.407420 2026] [:error] [pid 60605:tid 60631] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/ws35.php
[Tue Jan 06 00:30:35.622934 2026] [:error] [pid 60605:tid 60620] [client 40.71.212.238:1789] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Tue Jan 06 00:30:36.307405 2026] [:error] [pid 60605:tid 60610] [client 40.71.212.238:1789] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aVvnLJGdDsTlcaRtgxQ3JgAAAQM"]
[Tue Jan 06 00:30:37.395488 2026] [:error] [pid 60605:tid 60608] [client 40.71.212.238:1946] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aVvnLZGdDsTlcaRtgxQ3KQAAAQE"]
[Tue Jan 06 00:30:38.165851 2026] [:error] [pid 60509:tid 60539] [client 40.71.212.238:1767] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aVvnLqBSiT1_wVwKSvQYygAAAFI"]
[Tue Jan 06 00:30:39.045039 2026] [:error] [pid 60605:tid 60618] [client 40.71.212.238:1782] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lisa.php"] [unique_id "aVvnL5GdDsTlcaRtgxQ3KwAAAQs"]
[Tue Jan 06 00:30:39.848529 2026] [:error] [pid 29187:tid 29200] [client 40.71.212.238:2041] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aVvnL4SYYRtfmMXGZCp9JwAAAAs"]
[Tue Jan 06 00:30:40.579315 2026] [:error] [pid 60605:tid 60627] [client 40.71.212.238:1785] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aVvnMJGdDsTlcaRtgxQ3MAAAARQ"]
[Tue Jan 06 00:30:41.959746 2026] [:error] [pid 29187:tid 29205] [client 40.71.212.238:1989] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aVvnMYSYYRtfmMXGZCp9KwAAABA"]
[Tue Jan 06 00:30:42.616111 2026] [:error] [pid 60605:tid 60613] [client 40.71.212.238:1748] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aVvnMpGdDsTlcaRtgxQ3NgAAAQY"]
[Tue Jan 06 00:30:43.787941 2026] [:error] [pid 60509:tid 60538] [client 40.71.212.238:1952] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aVvnM6BSiT1_wVwKSvQY2gAAAFE"]
[Tue Jan 06 00:30:44.753714 2026] [:error] [pid 60510:tid 60559] [client 40.71.212.238:1923] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aVvnNG3HNEkuMRrTL0IANwAAAIs"]
[Tue Jan 06 00:30:46.364296 2026] [:error] [pid 60514:tid 60589] [client 40.71.212.238:1729] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aVvnNm70C0kefOIBEs9RZAAAAM4"]
[Tue Jan 06 00:30:47.743158 2026] [:error] [pid 60509:tid 60521] [client 40.71.212.238:1774] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aVvnN6BSiT1_wVwKSvQY3gAAAEA"]
[Tue Jan 06 00:30:48.591466 2026] [:error] [pid 60509:tid 60533] [client 40.71.212.238:1753] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2f.php"] [unique_id "aVvnOKBSiT1_wVwKSvQY4QAAAEw"]
[Tue Jan 06 00:30:50.087167 2026] [:error] [pid 60509:tid 60529] [client 40.71.212.238:2035] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2f.php"] [unique_id "aVvnOqBSiT1_wVwKSvQY4wAAAEg"]
[Tue Jan 06 00:30:51.488382 2026] [:error] [pid 60514:tid 60597] [client 40.71.212.238:1737] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2f.php"] [unique_id "aVvnO270C0kefOIBEs9RbQAAANY"]
[Tue Jan 06 00:30:52.170897 2026] [:error] [pid 29187:tid 29207] [client 40.71.212.238:2002] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2f.php"] [unique_id "aVvnPISYYRtfmMXGZCp9RAAAABI"]
[Tue Jan 06 00:30:52.718811 2026] [:error] [pid 29187:tid 29199] [client 40.71.212.238:2004] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ths.php"] [unique_id "aVvnPISYYRtfmMXGZCp9RwAAAAo"]
[Tue Jan 06 00:30:53.324606 2026] [:error] [pid 60514:tid 60575] [client 40.71.212.238:1996] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ths.php"] [unique_id "aVvnPW70C0kefOIBEs9RcAAAAMA"]
[Tue Jan 06 00:30:53.976751 2026] [:error] [pid 60514:tid 60578] [client 40.71.212.238:2017] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ths.php"] [unique_id "aVvnPW70C0kefOIBEs9RcgAAAMM"]
[Tue Jan 06 00:30:55.050009 2026] [:error] [pid 29187:tid 29205] [client 40.71.212.238:2031] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ths.php"] [unique_id "aVvnP4SYYRtfmMXGZCp9TQAAABA"]
[Tue Jan 06 00:30:55.998429 2026] [:error] [pid 29187:tid 29203] [client 40.71.212.238:1993] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aVvnP4SYYRtfmMXGZCp9VAAAAA4"]
[Tue Jan 06 00:30:57.109254 2026] [:error] [pid 60510:tid 60565] [client 40.71.212.238:1741] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aVvnQW3HNEkuMRrTL0IATwAAAJE"]
[Tue Jan 06 00:30:59.205303 2026] [:error] [pid 29187:tid 29203] [client 40.71.212.238:1985] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aVvnQ4SYYRtfmMXGZCp9YAAAAA4"]
[Tue Jan 06 00:31:00.903211 2026] [:error] [pid 60514:tid 60594] [client 40.71.212.238:1929] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aVvnRG70C0kefOIBEs9RhwAAANM"]
[Tue Jan 06 00:31:03.575681 2026] [:error] [pid 29187:tid 29199] [client 40.71.212.238:1772] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aVvnR4SYYRtfmMXGZCp9cwAAAAo"]
[Tue Jan 06 00:31:04.632646 2026] [:error] [pid 60514:tid 60575] [client 40.71.212.238:1966] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aVvnSG70C0kefOIBEs9RkAAAAMA"]
[Tue Jan 06 00:31:05.267464 2026] [:error] [pid 60605:tid 60619] [client 40.71.212.238:2008] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aVvnSZGdDsTlcaRtgxQ3ZAAAAQw"]
[Tue Jan 06 00:31:06.064632 2026] [:error] [pid 29187:tid 29208] [client 40.71.212.238:1787] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aVvnSoSYYRtfmMXGZCp9ewAAABM"]
[Tue Jan 06 00:31:06.655140 2026] [:error] [pid 60605:tid 60620] [client 40.71.212.238:2016] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d996699999.php"] [unique_id "aVvnSpGdDsTlcaRtgxQ3ZwAAAQ0"]
[Tue Jan 06 00:31:07.190025 2026] [:error] [pid 60514:tid 60580] [client 40.71.212.238:1999] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d996699999.php"] [unique_id "aVvnS270C0kefOIBEs9RmQAAAMU"]
[Tue Jan 06 00:31:07.981388 2026] [:error] [pid 60509:tid 60545] [client 40.71.212.238:1932] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d996699999.php"] [unique_id "aVvnS6BSiT1_wVwKSvQY9wAAAFg"]
[Tue Jan 06 00:31:09.081817 2026] [:error] [pid 60605:tid 60613] [client 40.71.212.238:1733] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d996699999.php"] [unique_id "aVvnTZGdDsTlcaRtgxQ3cAAAAQY"]
[Tue Jan 06 00:31:09.974541 2026] [:error] [pid 60509:tid 60526] [client 40.71.212.238:1924] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ierne.php"] [unique_id "aVvnTaBSiT1_wVwKSvQY-QAAAEU"]
[Tue Jan 06 00:31:10.593880 2026] [:error] [pid 60510:tid 60569] [client 40.71.212.238:1743] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ierne.php"] [unique_id "aVvnTm3HNEkuMRrTL0IAZQAAAJU"]
[Tue Jan 06 00:31:11.233470 2026] [:error] [pid 60605:tid 60626] [client 40.71.212.238:1942] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ierne.php"] [unique_id "aVvnT5GdDsTlcaRtgxQ3egAAARM"]
[Tue Jan 06 00:31:12.245475 2026] [:error] [pid 60605:tid 60630] [client 40.71.212.238:1777] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ierne.php"] [unique_id "aVvnUJGdDsTlcaRtgxQ3fAAAARc"]
[Tue Jan 06 00:31:12.919317 2026] [:error] [pid 60509:tid 60540] [client 40.71.212.238:1790] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xde.php"] [unique_id "aVvnUKBSiT1_wVwKSvQY_wAAAFM"]
[Tue Jan 06 00:31:13.959569 2026] [:error] [pid 60514:tid 60581] [client 40.71.212.238:1788] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xde.php"] [unique_id "aVvnUW70C0kefOIBEs9RpAAAAMY"]
[Tue Jan 06 00:31:14.637401 2026] [:error] [pid 29187:tid 29213] [client 40.71.212.238:1979] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xde.php"] [unique_id "aVvnUoSYYRtfmMXGZCp9hAAAABg"]
[Tue Jan 06 00:31:15.184995 2026] [:error] [pid 60509:tid 60529] [client 40.71.212.238:1345] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xde.php"] [unique_id "aVvnU6BSiT1_wVwKSvQZAwAAAEg"]
[Tue Jan 06 00:31:15.937815 2026] [:error] [pid 60605:tid 60610] [client 40.71.212.238:1947] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1yade.php"] [unique_id "aVvnU5GdDsTlcaRtgxQ3fwAAAQM"]
[Tue Jan 06 00:31:16.713233 2026] [:error] [pid 60509:tid 60528] [client 40.71.212.238:2042] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1yade.php"] [unique_id "aVvnVKBSiT1_wVwKSvQZDwAAAEc"]
[Tue Jan 06 00:31:17.468097 2026] [:error] [pid 60509:tid 60543] [client 40.71.212.238:2007] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1yade.php"] [unique_id "aVvnVaBSiT1_wVwKSvQZFAAAAFY"]
[Tue Jan 06 00:31:18.408545 2026] [:error] [pid 60509:tid 60542] [client 40.71.212.238:1934] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1yade.php"] [unique_id "aVvnVqBSiT1_wVwKSvQZFwAAAFU"]
[Tue Jan 06 00:31:19.093113 2026] [:error] [pid 60605:tid 60631] [client 40.71.212.238:1362] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aVvnV5GdDsTlcaRtgxQ3iQAAARg"]
[Tue Jan 06 00:31:19.728296 2026] [:error] [pid 60509:tid 60531] [client 40.71.212.238:1927] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aVvnV6BSiT1_wVwKSvQZHgAAAEo"]
[Tue Jan 06 00:31:21.331454 2026] [:error] [pid 60509:tid 60532] [client 40.71.212.238:1766] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aVvnWaBSiT1_wVwKSvQZJgAAAEs"]
[Tue Jan 06 00:31:23.888409 2026] [:error] [pid 60514:tid 60583] [client 40.71.212.238:1921] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aVvnW270C0kefOIBEs9RuAAAAMg"]
[Tue Jan 06 00:31:26.318526 2026] [:error] [pid 60509:tid 60528] [client 40.71.212.238:1740] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVvnXqBSiT1_wVwKSvQZNwAAAEc"]
[Tue Jan 06 00:31:27.300846 2026] [:error] [pid 60605:tid 60622] [client 40.71.212.238:1783] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVvnX5GdDsTlcaRtgxQ3nQAAAQ8"]
[Tue Jan 06 00:31:28.795517 2026] [:error] [pid 60510:tid 60552] [client 40.71.212.238:2014] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVvnYG3HNEkuMRrTL0IAdAAAAIQ"]
[Tue Jan 06 00:31:29.430628 2026] [:error] [pid 29187:tid 29197] [client 40.71.212.238:1732] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aVvnYYSYYRtfmMXGZCp9wQAAAAg"]
[Tue Jan 06 00:31:30.740689 2026] [:error] [pid 60510:tid 60564] [client 40.71.212.238:1780] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-help/mini.php"] [unique_id "aVvnYm3HNEkuMRrTL0IAdgAAAJA"]
[Tue Jan 06 00:31:31.775439 2026] [:error] [pid 29187:tid 29192] [client 40.71.212.238:1959] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-help/mini.php"] [unique_id "aVvnY4SYYRtfmMXGZCp9ywAAAAM"]
[Tue Jan 06 00:31:32.983724 2026] [:error] [pid 60514:tid 60581] [client 40.71.212.238:1926] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-help/mini.php"] [unique_id "aVvnZG70C0kefOIBEs9RzAAAAMY"]
[Tue Jan 06 00:31:33.751690 2026] [:error] [pid 60510:tid 60572] [client 40.71.212.238:1735] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-help/mini.php"] [unique_id "aVvnZW3HNEkuMRrTL0IAfQAAAJg"]
[Tue Jan 06 00:31:34.354210 2026] [:error] [pid 29187:tid 29212] [client 40.71.212.238:1977] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpformbuilder/plugins/filemanager/dialog.php"] [unique_id "aVvnZoSYYRtfmMXGZCp92QAAABc"]
[Tue Jan 06 00:31:35.879298 2026] [:error] [pid 60514:tid 60582] [client 40.71.212.238:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/yl10gohp.php
[Tue Jan 06 00:31:36.090776 2026] [:error] [pid 60514:tid 60589] [client 40.71.212.238:1997] [client 40.71.212.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/wpview/wp/about.php"] [unique_id "aVvnaG70C0kefOIBEs9R2QAAAM4"]
[Tue Jan 06 00:31:36.711425 2026] [:error] [pid 60509:tid 60534] [client 40.71.212.238:1941] [client 40.71.212.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/defaults.php"] [unique_id "aVvnaKBSiT1_wVwKSvQZRgAAAE0"]
[Tue Jan 06 00:31:37.398223 2026] [:error] [pid 29187:tid 29201] [client 40.71.212.238:1755] File does not exist: /usr/local/apache/htdocs/suspended-page/djfksr4.php
[Tue Jan 06 00:31:38.062421 2026] [:error] [pid 29187:tid 29191] [client 40.71.212.238:1755] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-upload.php
[Tue Jan 06 00:31:38.276824 2026] [:error] [pid 29187:tid 29212] [client 40.71.212.238:1755] File does not exist: /usr/local/apache/htdocs/suspended-page/file51.php
[Tue Jan 06 00:31:38.518068 2026] [:error] [pid 29187:tid 29194] [client 40.71.212.238:1755] File does not exist: /usr/local/apache/htdocs/suspended-page/unrubbish.php
[Tue Jan 06 00:31:38.756801 2026] [:error] [pid 29187:tid 29202] [client 40.71.212.238:1755] File does not exist: /usr/local/apache/htdocs/suspended-page/strubbly.php
[Tue Jan 06 00:31:38.968354 2026] [:error] [pid 29187:tid 29193] [client 40.71.212.238:1755] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiqdc.php"] [unique_id "aVvnaoSYYRtfmMXGZCp99AAAAAQ"]
[Tue Jan 06 00:31:39.727950 2026] [:error] [pid 29187:tid 29195] [client 40.71.212.238:1970] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiqdc.php"] [unique_id "aVvna4SYYRtfmMXGZCp99gAAAAY"]
[Tue Jan 06 00:31:40.390236 2026] [:error] [pid 60514:tid 60586] [client 40.71.212.238:2033] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiqdc.php"] [unique_id "aVvnbG70C0kefOIBEs9R3wAAAMs"]
[Tue Jan 06 00:31:41.565447 2026] [:error] [pid 60514:tid 60597] [client 40.71.212.238:1768] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiqdc.php"] [unique_id "aVvnbW70C0kefOIBEs9R4gAAANY"]
[Tue Jan 06 00:31:42.933465 2026] [:error] [pid 60510:tid 60560] [client 40.71.212.238:1760] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hdwta.php"] [unique_id "aVvnbm3HNEkuMRrTL0IAhgAAAIw"]
[Tue Jan 06 00:31:43.941042 2026] [:error] [pid 60510:tid 60570] [client 40.71.212.238:1352] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hdwta.php"] [unique_id "aVvnb23HNEkuMRrTL0IAjQAAAJY"]
[Tue Jan 06 00:31:44.949905 2026] [:error] [pid 29187:tid 29195] [client 40.71.212.238:1960] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hdwta.php"] [unique_id "aVvncISYYRtfmMXGZCp-CAAAAAY"]
[Tue Jan 06 00:31:45.699193 2026] [:error] [pid 29187:tid 29191] [client 40.71.212.238:1784] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hdwta.php"] [unique_id "aVvncYSYYRtfmMXGZCp-CwAAAAI"]
[Tue Jan 06 00:31:46.775491 2026] [:error] [pid 60510:tid 60550] [client 40.71.212.238:1791] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/INFECTED.php"] [unique_id "aVvncm3HNEkuMRrTL0IAmQAAAII"]
[Tue Jan 06 00:31:48.383843 2026] [:error] [pid 60514:tid 60589] [client 40.71.212.238:1939] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/INFECTED.php"] [unique_id "aVvndG70C0kefOIBEs9R7gAAAM4"]
[Tue Jan 06 00:31:49.751706 2026] [:error] [pid 60514:tid 60580] [client 40.71.212.238:2039] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/INFECTED.php"] [unique_id "aVvndW70C0kefOIBEs9R8QAAAMU"]
[Tue Jan 06 00:31:51.021346 2026] [:error] [pid 60509:tid 60531] [client 40.71.212.238:1758] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/INFECTED.php"] [unique_id "aVvnd6BSiT1_wVwKSvQZbwAAAEo"]
[Tue Jan 06 00:31:52.332343 2026] [:error] [pid 29187:tid 29211] [client 40.71.212.238:1925] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maint.php"] [unique_id "aVvneISYYRtfmMXGZCp-GAAAABY"]
[Tue Jan 06 00:31:53.581304 2026] [:error] [pid 29187:tid 29195] [client 40.71.212.238:1372] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maint.php"] [unique_id "aVvneYSYYRtfmMXGZCp-GgAAAAY"]
[Tue Jan 06 00:31:54.484525 2026] [:error] [pid 29187:tid 29202] [client 40.71.212.238:1388] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maint.php"] [unique_id "aVvneoSYYRtfmMXGZCp-HwAAAA0"]
[Tue Jan 06 00:31:55.305831 2026] [:error] [pid 60605:tid 60617] [client 40.71.212.238:1738] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maint.php"] [unique_id "aVvne5GdDsTlcaRtgxQ38AAAAQo"]
[Tue Jan 06 00:31:56.245359 2026] [:error] [pid 60514:tid 60577] [client 40.71.212.238:1764] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aVvnfG70C0kefOIBEs9SAAAAAMI"]
[Tue Jan 06 00:31:57.084176 2026] [:error] [pid 60510:tid 60563] [client 40.71.212.238:1950] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aVvnfW3HNEkuMRrTL0IAswAAAI8"]
[Tue Jan 06 00:31:58.283671 2026] [:error] [pid 60509:tid 60528] [client 40.71.212.238:1931] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aVvnfqBSiT1_wVwKSvQZegAAAEc"]
[Tue Jan 06 00:31:59.669478 2026] [:error] [pid 60605:tid 60609] [client 40.71.212.238:1778] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aVvnf5GdDsTlcaRtgxQ4AQAAAQI"]
[Tue Jan 06 00:32:00.688029 2026] [:error] [pid 60509:tid 60536] [client 40.71.212.238:1367] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aVvngKBSiT1_wVwKSvQZgQAAAE8"]
[Tue Jan 06 00:32:01.396459 2026] [:error] [pid 60510:tid 60549] [client 40.71.212.238:1933] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aVvngW3HNEkuMRrTL0IAvgAAAIE"]
[Tue Jan 06 00:32:02.547670 2026] [:error] [pid 60509:tid 60530] [client 40.71.212.238:1378] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aVvngqBSiT1_wVwKSvQZiQAAAEk"]
[Tue Jan 06 00:32:03.562326 2026] [:error] [pid 29187:tid 29195] [client 40.71.212.238:1771] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aVvng4SYYRtfmMXGZCp-bgAAAAY"]
[Tue Jan 06 00:32:04.839934 2026] [:error] [pid 60509:tid 60521] [client 40.71.212.238:1351] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aVvnhKBSiT1_wVwKSvQZjwAAAEA"]
[Tue Jan 06 00:32:05.478831 2026] [:error] [pid 29187:tid 29193] [client 40.71.212.238:1943] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aVvnhYSYYRtfmMXGZCp-ggAAAAQ"]
[Tue Jan 06 00:32:06.628812 2026] [:error] [pid 60514:tid 60599] [client 40.71.212.238:1988] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aVvnhm70C0kefOIBEs9SKwAAANg"]
[Tue Jan 06 00:32:07.357276 2026] [:error] [pid 60509:tid 60544] [client 40.71.212.238:2021] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aVvnh6BSiT1_wVwKSvQZkwAAAFc"]
[Tue Jan 06 00:32:08.376506 2026] [:error] [pid 60510:tid 60552] [client 40.71.212.238:1920] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctex1.php"] [unique_id "aVvniG3HNEkuMRrTL0IA1gAAAIQ"]
[Tue Jan 06 00:32:09.523211 2026] [:error] [pid 60509:tid 60535] [client 40.71.212.238:1962] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctex1.php"] [unique_id "aVvniaBSiT1_wVwKSvQZowAAAE4"]
[Tue Jan 06 00:32:10.345508 2026] [:error] [pid 60514:tid 60597] [client 40.71.212.238:1953] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctex1.php"] [unique_id "aVvnim70C0kefOIBEs9SNwAAANY"]
[Tue Jan 06 00:32:11.318454 2026] [:error] [pid 29187:tid 29200] [client 40.71.212.238:1364] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctex1.php"] [unique_id "aVvni4SYYRtfmMXGZCp-tQAAAAs"]
[Tue Jan 06 00:32:12.764811 2026] [:error] [pid 60514:tid 60576] [client 40.71.212.238:1757] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsz.php"] [unique_id "aVvnjG70C0kefOIBEs9SOAAAAME"]
[Tue Jan 06 00:32:13.651126 2026] [:error] [pid 60509:tid 60531] [client 40.71.212.238:1945] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsz.php"] [unique_id "aVvnjaBSiT1_wVwKSvQZqAAAAEo"]
[Tue Jan 06 00:32:14.529971 2026] [:error] [pid 60605:tid 60624] [client 40.71.212.238:1992] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsz.php"] [unique_id "aVvnjpGdDsTlcaRtgxQ4SQAAARE"]
[Tue Jan 06 00:32:15.923072 2026] [:error] [pid 29187:tid 29206] [client 40.71.212.238:1940] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsz.php"] [unique_id "aVvnj4SYYRtfmMXGZCp-2wAAABE"]
[Tue Jan 06 00:32:17.196996 2026] [:error] [pid 60514:tid 60577] [client 40.71.212.238:1955] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahy66.php"] [unique_id "aVvnkW70C0kefOIBEs9SQQAAAMI"]
[Tue Jan 06 00:32:18.344078 2026] [:error] [pid 29187:tid 29212] [client 40.71.212.238:1346] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahy66.php"] [unique_id "aVvnkoSYYRtfmMXGZCp-5AAAABc"]
[Tue Jan 06 00:32:19.642426 2026] [:error] [pid 60510:tid 60554] [client 40.71.212.238:1761] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahy66.php"] [unique_id "aVvnk23HNEkuMRrTL0IBCgAAAIY"]
[Tue Jan 06 00:32:21.035412 2026] [:error] [pid 29187:tid 29207] [client 40.71.212.238:1357] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahy66.php"] [unique_id "aVvnlYSYYRtfmMXGZCp-7wAAABI"]
[Tue Jan 06 00:32:22.428197 2026] [:error] [pid 29187:tid 29206] [client 40.71.212.238:1374] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20ojy.php"] [unique_id "aVvnloSYYRtfmMXGZCp-9QAAABE"]
[Tue Jan 06 00:32:23.830728 2026] [:error] [pid 29187:tid 29189] [client 40.71.212.238:1969] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20ojy.php"] [unique_id "aVvnl4SYYRtfmMXGZCp-_gAAAAA"]
[Tue Jan 06 00:32:24.744391 2026] [:error] [pid 29187:tid 29207] [client 40.71.212.238:2012] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20ojy.php"] [unique_id "aVvnmISYYRtfmMXGZCp-_wAAABI"]
[Tue Jan 06 00:32:25.541766 2026] [:error] [pid 60514:tid 60577] [client 40.71.212.238:1951] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/20ojy.php"] [unique_id "aVvnmW70C0kefOIBEs9STAAAAMI"]
[Tue Jan 06 00:32:26.793008 2026] [:error] [pid 60510:tid 60567] [client 40.71.212.238:1344] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pt.php"] [unique_id "aVvnmm3HNEkuMRrTL0IBFAAAAJM"]
[Tue Jan 06 00:32:28.445514 2026] [:error] [pid 29187:tid 29196] [client 40.71.212.238:1972] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pt.php"] [unique_id "aVvnnISYYRtfmMXGZCp_BwAAAAc"]
[Tue Jan 06 00:32:29.882010 2026] [:error] [pid 60514:tid 60588] [client 40.71.212.238:1968] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pt.php"] [unique_id "aVvnnW70C0kefOIBEs9SYAAAAM0"]
[Tue Jan 06 00:32:31.384944 2026] [:error] [pid 60509:tid 60527] [client 40.71.212.238:1781] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pt.php"] [unique_id "aVvnn6BSiT1_wVwKSvQZzgAAAEY"]
[Tue Jan 06 00:32:32.346783 2026] [:error] [pid 29187:tid 29199] [client 40.71.212.238:1349] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abruzi.php"] [unique_id "aVvnoISYYRtfmMXGZCp_FQAAAAo"]
[Tue Jan 06 00:32:32.907838 2026] [:error] [pid 60510:tid 60559] [client 40.71.212.238:1385] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abruzi.php"] [unique_id "aVvnoG3HNEkuMRrTL0IBLAAAAIs"]
[Tue Jan 06 00:32:33.662777 2026] [:error] [pid 60514:tid 60599] [client 40.71.212.238:1762] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abruzi.php"] [unique_id "aVvnoW70C0kefOIBEs9SYwAAANg"]
[Tue Jan 06 00:32:34.416156 2026] [:error] [pid 29187:tid 29205] [client 40.71.212.238:1358] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abruzi.php"] [unique_id "aVvnooSYYRtfmMXGZCp_HgAAABA"]
[Tue Jan 06 00:32:35.382220 2026] [:error] [pid 60509:tid 60538] [client 40.71.212.238:1383] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1wx.php"] [unique_id "aVvno6BSiT1_wVwKSvQZ1QAAAFE"]
[Tue Jan 06 00:32:36.832695 2026] [:error] [pid 60514:tid 60593] [client 40.71.212.238:1974] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1wx.php"] [unique_id "aVvnpG70C0kefOIBEs9SZwAAANI"]
[Tue Jan 06 00:32:38.131973 2026] [:error] [pid 29187:tid 29208] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/1wx.php
[Tue Jan 06 00:32:38.498423 2026] [:error] [pid 29187:tid 29201] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-is.php
[Tue Jan 06 00:32:38.713806 2026] [:error] [pid 29187:tid 29192] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/Hd.php
[Tue Jan 06 00:32:38.929687 2026] [:error] [pid 29187:tid 29190] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/Alex-Cross.php
[Tue Jan 06 00:32:40.412342 2026] [:error] [pid 29187:tid 29199] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Jan 06 00:32:40.651255 2026] [:error] [pid 29187:tid 29211] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Tue Jan 06 00:32:40.866243 2026] [:error] [pid 29187:tid 29198] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Tue Jan 06 00:32:41.082270 2026] [:error] [pid 29187:tid 29212] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Tue Jan 06 00:32:41.760656 2026] [:error] [pid 29187:tid 29191] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Tue Jan 06 00:32:41.976265 2026] [:error] [pid 29187:tid 29213] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Tue Jan 06 00:32:42.193746 2026] [:error] [pid 29187:tid 29199] [client 40.71.212.238:1285] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Tue Jan 06 00:32:42.406625 2026] [:error] [pid 29187:tid 29195] [client 40.71.212.238:1285] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aVvnqoSYYRtfmMXGZCp_RAAAAAY"]
[Tue Jan 06 00:32:43.077667 2026] [:error] [pid 29187:tid 29204] [client 40.71.212.238:1347] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aVvnq4SYYRtfmMXGZCp_SwAAAA8"]
[Tue Jan 06 00:32:44.205450 2026] [:error] [pid 60514:tid 60596] [client 40.71.212.238:1312] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aVvnrG70C0kefOIBEs9SgwAAANU"]
[Tue Jan 06 00:32:45.382221 2026] [:error] [pid 60509:tid 60534] [client 40.71.212.238:1291] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aVvnraBSiT1_wVwKSvQZ8AAAAE0"]
[Tue Jan 06 00:32:46.166379 2026] [:error] [pid 60605:tid 60608] [client 40.71.212.238:1958] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aVvnrpGdDsTlcaRtgxQ4hwAAAQE"]
[Tue Jan 06 00:32:46.828206 2026] [:error] [pid 60605:tid 60615] [client 40.71.212.238:1356] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aVvnrpGdDsTlcaRtgxQ4igAAAQg"]
[Tue Jan 06 00:32:48.514219 2026] [:error] [pid 60514:tid 60581] [client 40.71.212.238:1281] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aVvnsG70C0kefOIBEs9SiQAAAMY"]
[Tue Jan 06 00:32:49.375645 2026] [:error] [pid 60605:tid 60631] [client 40.71.212.238:1770] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aVvnsZGdDsTlcaRtgxQ4jwAAARg"]
[Tue Jan 06 00:32:50.360807 2026] [:error] [pid 60509:tid 60523] [client 40.71.212.238:1983] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVvnsqBSiT1_wVwKSvQZ-wAAAEI"]
[Tue Jan 06 00:32:51.177940 2026] [:error] [pid 60509:tid 60527] [client 40.71.212.238:1286] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVvns6BSiT1_wVwKSvQZ_AAAAEY"]
[Tue Jan 06 00:32:52.514739 2026] [:error] [pid 60510:tid 60571] [client 40.71.212.238:1350] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVvntG3HNEkuMRrTL0IBXQAAAJc"]
[Tue Jan 06 00:32:53.538223 2026] [:error] [pid 60510:tid 60566] [client 40.71.212.238:1965] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aVvntW3HNEkuMRrTL0IBYQAAAJI"]
[Tue Jan 06 00:32:54.432561 2026] [:error] [pid 60605:tid 60609] [client 40.71.212.238:1775] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVvntpGdDsTlcaRtgxQ4lgAAAQI"]
[Tue Jan 06 00:32:55.258052 2026] [:error] [pid 60514:tid 60575] [client 40.71.212.238:1389] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVvnt270C0kefOIBEs9SjAAAAMA"]
[Tue Jan 06 00:32:56.448397 2026] [:error] [pid 60509:tid 60521] [client 40.71.212.238:1949] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVvnuKBSiT1_wVwKSvQaBwAAAEA"]
[Tue Jan 06 00:32:57.307772 2026] [:error] [pid 60514:tid 60580] [client 40.71.212.238:1375] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aVvnuW70C0kefOIBEs9SlgAAAMU"]
[Tue Jan 06 00:32:58.746956 2026] [:error] [pid 60605:tid 60619] [client 40.71.212.238:1944] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVvnupGdDsTlcaRtgxQ4mgAAAQw"]
[Tue Jan 06 00:33:00.487947 2026] [:error] [pid 29187:tid 29197] [client 40.71.212.238:1922] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVvnvISYYRtfmMXGZCp_dQAAAAg"]
[Tue Jan 06 00:33:02.207923 2026] [:error] [pid 29187:tid 29203] [client 40.71.212.238:1347] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVvnvoSYYRtfmMXGZCp_fgAAAA4"]
[Tue Jan 06 00:33:02.951970 2026] [:error] [pid 60514:tid 60592] [client 40.71.212.238:1991] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aVvnvm70C0kefOIBEs9SnwAAANE"]
[Tue Jan 06 00:33:03.921052 2026] [:error] [pid 60514:tid 60591] [client 40.71.212.238:1754] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVvnv270C0kefOIBEs9SogAAANA"]
[Tue Jan 06 00:33:04.490566 2026] [:error] [pid 60605:tid 60626] [client 40.71.212.238:1359] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVvnwJGdDsTlcaRtgxQ4pQAAARM"]
[Tue Jan 06 00:33:05.893008 2026] [:error] [pid 60605:tid 60620] [client 40.71.212.238:1391] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVvnwZGdDsTlcaRtgxQ4rgAAAQ0"]
[Tue Jan 06 00:33:07.032018 2026] [:error] [pid 60514:tid 60590] [client 40.71.212.238:1954] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aVvnw270C0kefOIBEs9SrAAAAM8"]
[Tue Jan 06 00:33:08.941717 2026] [:error] [pid 29187:tid 29198] [client 40.71.212.238:1366] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aVvnxISYYRtfmMXGZCp_iAAAAAk"]
[Tue Jan 06 00:33:10.099417 2026] [:error] [pid 60510:tid 60556] [client 40.71.212.238:1930] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aVvnxm3HNEkuMRrTL0IBdAAAAIg"]
[Tue Jan 06 00:33:11.753634 2026] [:error] [pid 60605:tid 60631] [client 40.71.212.238:1353] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aVvnx5GdDsTlcaRtgxQ4uQAAARg"]
[Tue Jan 06 00:33:12.773876 2026] [:error] [pid 60605:tid 60623] [client 40.71.212.238:1354] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aVvnyJGdDsTlcaRtgxQ4vgAAARA"]
[Tue Jan 06 00:33:14.394275 2026] [:error] [pid 60510:tid 60555] [client 40.71.212.238:1381] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aVvnym3HNEkuMRrTL0IBfAAAAIc"]
[Tue Jan 06 00:33:15.875137 2026] [:error] [pid 60605:tid 60607] [client 40.71.212.238:1936] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aVvny5GdDsTlcaRtgxQ4wwAAAQA"]
[Tue Jan 06 00:33:16.802230 2026] [:error] [pid 60514:tid 60591] [client 40.71.212.238:1301] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aVvnzG70C0kefOIBEs9SvwAAANA"]
[Tue Jan 06 00:33:18.264764 2026] [:error] [pid 60510:tid 60553] [client 40.71.212.238:1773] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aVvnzm3HNEkuMRrTL0IBhQAAAIU"]
[Tue Jan 06 00:33:19.349207 2026] [:error] [pid 29187:tid 29209] [client 40.71.212.238:1339] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aVvnz4SYYRtfmMXGZCp_pwAAABQ"]
[Tue Jan 06 00:33:20.726181 2026] [:error] [pid 60514:tid 60575] [client 40.71.212.238:1368] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aVvn0G70C0kefOIBEs9SywAAAMA"]
[Tue Jan 06 00:33:22.330430 2026] [:error] [pid 60514:tid 60597] [client 40.71.212.238:1296] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aVvn0m70C0kefOIBEs9S0AAAANY"]
[Tue Jan 06 00:33:24.243811 2026] [:error] [pid 60514:tid 60593] [client 40.71.212.238:1937] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aVvn1G70C0kefOIBEs9S1gAAANI"]
[Tue Jan 06 00:33:26.014529 2026] [:error] [pid 29187:tid 29194] [client 40.71.212.238:1964] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aVvn1oSYYRtfmMXGZCp_vwAAAAU"]
[Tue Jan 06 00:33:27.781777 2026] [:error] [pid 29187:tid 29202] [client 40.71.212.238:1373] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aVvn14SYYRtfmMXGZCp_wwAAAA0"]
[Tue Jan 06 00:33:29.565816 2026] [:error] [pid 60514:tid 60586] [client 40.71.212.238:1935] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aVvn2W70C0kefOIBEs9S4QAAAMs"]
[Tue Jan 06 00:33:31.758043 2026] [:error] [pid 29187:tid 29200] [client 40.71.212.238:1283] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aVvn24SYYRtfmMXGZCp_0QAAAAs"]
[Tue Jan 06 00:33:33.993415 2026] [:error] [pid 60605:tid 60626] [client 40.71.212.238:2040] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVvn3ZGdDsTlcaRtgxQ4zwAAARM"]
[Tue Jan 06 00:33:35.149489 2026] [:error] [pid 60510:tid 60554] [client 40.71.212.238:1379] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVvn323HNEkuMRrTL0IBlQAAAIY"]
[Tue Jan 06 00:33:35.953236 2026] [:error] [pid 60509:tid 60545] [client 40.71.212.238:1376] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVvn36BSiT1_wVwKSvQaQAAAAFg"]
[Tue Jan 06 00:33:37.400989 2026] [:error] [pid 60509:tid 60527] [client 40.71.212.238:1360] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aVvn4aBSiT1_wVwKSvQaRAAAAEY"]
[Tue Jan 06 00:33:38.154848 2026] [:error] [pid 29187:tid 29195] [client 40.71.212.238:1956] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aVvn4oSYYRtfmMXGZCp_6wAAAAY"]
[Tue Jan 06 00:33:40.097566 2026] [:error] [pid 60509:tid 60532] [client 40.71.212.238:2037] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aVvn5KBSiT1_wVwKSvQaSgAAAEs"]
[Tue Jan 06 00:33:42.095807 2026] [:error] [pid 60605:tid 60631] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Tue Jan 06 00:33:42.706331 2026] [:error] [pid 60605:tid 60631] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Tue Jan 06 00:33:42.931187 2026] [:error] [pid 60605:tid 60612] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Jan 06 00:33:44.248964 2026] [:error] [pid 60605:tid 60627] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Tue Jan 06 00:33:44.464294 2026] [:error] [pid 60605:tid 60624] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Tue Jan 06 00:33:44.678836 2026] [:error] [pid 60605:tid 60628] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Jan 06 00:33:44.893497 2026] [:error] [pid 60605:tid 60626] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Tue Jan 06 00:33:45.109338 2026] [:error] [pid 60605:tid 60621] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Tue Jan 06 00:33:45.468344 2026] [:error] [pid 60605:tid 60618] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Tue Jan 06 00:33:45.684054 2026] [:error] [pid 60605:tid 60627] [client 40.71.212.238:1957] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Tue Jan 06 00:33:45.903120 2026] [:error] [pid 60605:tid 60624] [client 40.71.212.238:1957] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aVvn6ZGdDsTlcaRtgxQ5AgAAARE"]
[Tue Jan 06 00:33:46.959733 2026] [:error] [pid 60514:tid 60593] [client 40.71.212.238:2027] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aVvn6m70C0kefOIBEs9TDQAAANI"]
[Tue Jan 06 00:33:48.891895 2026] [:error] [pid 60605:tid 60619] [client 40.71.212.238:1776] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aVvn7JGdDsTlcaRtgxQ5JwAAAQw"]
[Tue Jan 06 00:33:51.423373 2026] [:error] [pid 60514:tid 60593] [client 40.71.212.238:1298] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aVvn7270C0kefOIBEs9THwAAANI"]
[Tue Jan 06 00:33:53.799233 2026] [:error] [pid 29187:tid 29209] [client 40.71.212.238:1990] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix1.php"] [unique_id "aVvn8YSYYRtfmMXGZCqATwAAABQ"]
[Tue Jan 06 00:33:58.534964 2026] [:error] [pid 60514:tid 60591] [client 40.71.212.238:1288] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix1.php"] [unique_id "aVvn9m70C0kefOIBEs9TKQAAANA"]
[Tue Jan 06 00:34:01.191199 2026] [:error] [pid 29187:tid 29193] [client 40.71.212.238:1322] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix1.php"] [unique_id "aVvn-YSYYRtfmMXGZCqAWwAAAAQ"]
[Tue Jan 06 00:34:03.436850 2026] [:error] [pid 60509:tid 60530] [client 40.71.212.238:1287] [client 40.71.212.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix1.php"] [unique_id "aVvn-6BSiT1_wVwKSvQaYwAAAEk"]
[Tue Jan 06 00:50:11.151961 2026] [:error] [pid 60509:tid 60538] [client 185.238.231.106:52237] [client 185.238.231.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.106, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aVvrw6BSiT1_wVwKSvQhCQAAAFE"]
[Tue Jan 06 00:50:11.155910 2026] [:error] [pid 60509:tid 60538] [client 185.238.231.106:52237] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Jan 06 03:00:08.674882 2026] [:error] [pid 60605:tid 60609] [client 34.106.64.243:54286] [client 34.106.64.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aVwKOJGdDsTlcaRtgxR8UwAAAQI"]
[Tue Jan 06 12:06:05.714063 2026] [:error] [pid 44903:tid 44919] [client 172.81.133.44:61791] [client 172.81.133.44] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aVyKLdhHqjs38zbkQPChQAAAAAw"]
[Tue Jan 06 14:03:38.991168 2026] [:error] [pid 45959:tid 45968] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Jan 06 14:03:39.523661 2026] [:error] [pid 45959:tid 45976] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Jan 06 14:03:40.050906 2026] [:error] [pid 45959:tid 45973] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Jan 06 14:03:40.580028 2026] [:error] [pid 45959:tid 45984] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Jan 06 14:03:41.121970 2026] [:error] [pid 45959:tid 45969] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Jan 06 14:03:41.650737 2026] [:error] [pid 45959:tid 45967] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Jan 06 14:03:42.179899 2026] [:error] [pid 45959:tid 45962] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Jan 06 14:03:42.718260 2026] [:error] [pid 45959:tid 45968] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Jan 06 14:03:43.771605 2026] [:error] [pid 45959:tid 45986] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Jan 06 14:03:44.823691 2026] [:error] [pid 45959:tid 45980] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Jan 06 14:03:45.352676 2026] [:error] [pid 45959:tid 45968] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Jan 06 14:03:45.878164 2026] [:error] [pid 45959:tid 45983] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Jan 06 14:03:46.403183 2026] [:error] [pid 45959:tid 45980] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Jan 06 14:03:46.931387 2026] [:error] [pid 45959:tid 45971] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Jan 06 14:03:47.457677 2026] [:error] [pid 45959:tid 45969] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Jan 06 14:03:47.984675 2026] [:error] [pid 45959:tid 45966] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Jan 06 14:03:48.529530 2026] [:error] [pid 45959:tid 45979] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Jan 06 14:03:49.073563 2026] [:error] [pid 45959:tid 45971] [client 173.244.55.27:41075] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Jan 06 14:03:56.505267 2026] [:error] [pid 45959:tid 45973] [client 173.244.55.27:41075] [client 173.244.55.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aVylzFajdn8P3hjgMYxKqQAAAUs"]
[Tue Jan 06 14:03:59.150960 2026] [:error] [pid 44905:tid 44981] [client 173.244.55.19:62009] [client 173.244.55.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aVylz7u7ufwWVst9EAuB1AAAAI0"]
[Tue Jan 06 14:04:01.814280 2026] [:error] [pid 45959:tid 45975] [client 173.244.55.27:36651] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Jan 06 14:04:03.495308 2026] [:error] [pid 45959:tid 45970] [client 173.244.55.27:36651] [client 173.244.55.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aVyl01ajdn8P3hjgMYxKtQAAAUg"]
[Tue Jan 06 14:04:05.629128 2026] [:error] [pid 44904:tid 44949] [client 173.244.55.16:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Jan 06 14:04:06.182885 2026] [:error] [pid 44904:tid 44944] [client 173.244.55.16:59035] [client 173.244.55.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aVyl1jtieuI1BJEZcvfc0QAAAEM"]
[Tue Jan 06 14:04:07.764225 2026] [:error] [pid 35140:tid 35142] [client 173.244.55.17:28533] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Jan 06 14:04:10.425475 2026] [:error] [pid 35140:tid 35160] [client 173.244.55.17:28533] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aVyl2noQaIDFMbT-XMx-9AAAARI"]
[Tue Jan 06 14:04:12.008944 2026] [:error] [pid 45959:tid 45976] [client 173.244.55.18:54231] [client 173.244.55.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aVyl3Fajdn8P3hjgMYxKyAAAAU4"]
[Tue Jan 06 14:04:13.069407 2026] [:error] [pid 44903:tid 44924] [client 173.244.55.19:33955] [client 173.244.55.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aVyl3dhHqjs38zbkQPC9-wAAABE"]
[Tue Jan 06 14:04:14.113764 2026] [:error] [pid 44904:tid 44947] [client 173.244.55.27:25181] [client 173.244.55.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aVyl3jtieuI1BJEZcvfc2QAAAEY"]
[Tue Jan 06 14:04:15.166849 2026] [:error] [pid 44905:tid 44983] [client 173.244.55.17:33471] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aVyl37u7ufwWVst9EAuB4gAAAI8"]
[Tue Jan 06 14:04:16.222382 2026] [:error] [pid 45959:tid 45976] [client 173.244.55.24:55847] [client 173.244.55.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aVyl4Fajdn8P3hjgMYxK1AAAAU4"]
[Tue Jan 06 14:04:17.811353 2026] [:error] [pid 44905:tid 44979] [client 173.244.55.17:62199] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aVyl4bu7ufwWVst9EAuB6QAAAIs"]
[Tue Jan 06 14:04:18.863610 2026] [:error] [pid 45012:tid 45035] [client 173.244.55.24:32979] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Jan 06 14:04:19.911676 2026] [:error] [pid 45012:tid 45037] [client 173.244.55.24:32979] [client 173.244.55.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aVyl4xaMAxCuju1d0uaMwQAAANc"]
[Tue Jan 06 14:04:22.046429 2026] [:error] [pid 44905:tid 44978] [client 173.244.55.16:32397] [client 173.244.55.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aVyl5ru7ufwWVst9EAuB8gAAAIo"]
[Tue Jan 06 14:04:23.630099 2026] [:error] [pid 44904:tid 44952] [client 173.244.55.18:55015] [client 173.244.55.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aVyl5ztieuI1BJEZcvfc3AAAAEs"]
[Tue Jan 06 14:04:24.691148 2026] [:error] [pid 44905:tid 44987] [client 173.244.55.17:57931] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Jan 06 14:04:25.219622 2026] [:error] [pid 44905:tid 44971] [client 173.244.55.17:57931] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aVyl6bu7ufwWVst9EAuB9QAAAIM"]
[Tue Jan 06 14:04:26.278734 2026] [:error] [pid 44903:tid 44918] [client 173.244.55.18:28079] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Jan 06 14:04:27.883062 2026] [:error] [pid 44903:tid 44922] [client 173.244.55.18:28079] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Jan 06 14:04:29.472143 2026] [:error] [pid 44903:tid 44916] [client 173.244.55.18:28079] [client 173.244.55.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aVyl7dhHqjs38zbkQPC-DgAAAAk"]
[Tue Jan 06 14:04:30.531940 2026] [:error] [pid 35140:tid 35165] [client 173.244.55.17:33579] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Jan 06 14:04:31.064071 2026] [:error] [pid 35140:tid 35155] [client 173.244.55.17:33579] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aVyl73oQaIDFMbT-XMx_CAAAAQ0"]
[Tue Jan 06 14:04:32.129712 2026] [:error] [pid 44905:tid 44992] [client 173.244.55.18:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Jan 06 14:04:33.192971 2026] [:error] [pid 44905:tid 44978] [client 173.244.55.18:45781] [client 173.244.55.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aVyl8bu7ufwWVst9EAuB-wAAAIo"]
[Tue Jan 06 14:04:34.793505 2026] [:error] [pid 45959:tid 45962] [client 173.244.55.19:54535] [client 173.244.55.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aVyl8lajdn8P3hjgMYxK6wAAAUA"]
[Tue Jan 06 14:04:36.402233 2026] [:error] [pid 44903:tid 44910] [client 173.244.55.17:34097] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue Jan 06 14:04:36.932365 2026] [:error] [pid 44903:tid 44909] [client 173.244.55.17:34097] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Jan 06 14:04:38.010258 2026] [:error] [pid 44903:tid 44919] [client 173.244.55.17:34097] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aVyl9thHqjs38zbkQPC-FwAAAAw"]
[Tue Jan 06 14:04:40.598877 2026] [:error] [pid 35140:tid 35165] [client 173.244.55.18:41375] [client 173.244.55.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aVyl-HoQaIDFMbT-XMx_EwAAARc"]
[Tue Jan 06 14:04:43.184368 2026] [:error] [pid 45012:tid 45035] [client 173.244.55.24:63061] [client 173.244.55.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aVyl-xaMAxCuju1d0uaM1wAAANU"]
[Tue Jan 06 14:04:44.238528 2026] [:error] [pid 44905:tid 44978] [client 173.244.55.27:51593] [client 173.244.55.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aVyl_Lu7ufwWVst9EAuCCAAAAIo"]
[Tue Jan 06 14:04:45.294201 2026] [:error] [pid 35140:tid 35161] [client 173.244.55.24:41737] [client 173.244.55.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aVyl_XoQaIDFMbT-XMx_GwAAARM"]
[Tue Jan 06 14:04:47.426727 2026] [:error] [pid 45959:tid 45964] [client 173.244.55.19:37595] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Jan 06 14:04:47.950760 2026] [:error] [pid 45959:tid 45972] [client 173.244.55.19:37595] [client 173.244.55.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aVyl_1ajdn8P3hjgMYxLBgAAAUo"]
[Tue Jan 06 14:04:48.998241 2026] [:error] [pid 44903:tid 44910] [client 173.244.55.18:54305] [client 173.244.55.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aVymANhHqjs38zbkQPC-HgAAAAM"]
[Tue Jan 06 14:04:50.044054 2026] [:error] [pid 44904:tid 44944] [client 173.244.55.27:51719] [client 173.244.55.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVymAjtieuI1BJEZcvfc-wAAAEM"]
[Tue Jan 06 14:04:53.176059 2026] [:error] [pid 45959:tid 45962] [client 173.244.55.24:57491] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Jan 06 14:04:54.241680 2026] [:error] [pid 45959:tid 45986] [client 173.244.55.24:57491] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Jan 06 14:04:56.365693 2026] [:error] [pid 45959:tid 45974] [client 173.244.55.24:57491] [client 173.244.55.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aVymCFajdn8P3hjgMYxLJAAAAUw"]
[Tue Jan 06 14:04:59.016765 2026] [:error] [pid 45959:tid 45982] [client 173.244.55.24:63955] [client 173.244.55.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.24, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aVymC1ajdn8P3hjgMYxLKwAAAVQ"]
[Tue Jan 06 14:04:59.552990 2026] [:error] [pid 45959:tid 45962] [client 173.244.55.24:63955] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Jan 06 14:05:02.219196 2026] [:error] [pid 45959:tid 45971] [client 173.244.55.24:63955] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Jan 06 14:05:02.753992 2026] [:error] [pid 45959:tid 45985] [client 173.244.55.24:63955] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Jan 06 14:05:05.407599 2026] [:error] [pid 45959:tid 45965] [client 173.244.55.24:63955] [client 173.244.55.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aVymEVajdn8P3hjgMYxLOgAAAUM"]
[Tue Jan 06 14:05:07.005438 2026] [:error] [pid 44903:tid 44925] [client 173.244.55.17:48325] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Jan 06 14:05:07.534347 2026] [:error] [pid 44903:tid 44911] [client 173.244.55.17:48325] [client 173.244.55.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.17, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aVymE9hHqjs38zbkQPC-MgAAAAQ"]
[Tue Jan 06 14:05:08.613141 2026] [:error] [pid 44903:tid 44910] [client 173.244.55.17:48325] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aVymFNhHqjs38zbkQPC-NQAAAAM"]
[Tue Jan 06 14:05:11.802014 2026] [:error] [pid 44903:tid 44923] [client 173.244.55.17:57981] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Jan 06 14:05:12.867415 2026] [:error] [pid 44903:tid 44911] [client 173.244.55.17:57981] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Tue Jan 06 14:05:13.934995 2026] [:error] [pid 44903:tid 44920] [client 173.244.55.17:57981] [client 173.244.55.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aVymGdhHqjs38zbkQPC-RQAAAA0"]
[Tue Jan 06 23:19:37.379876 2026] [:error] [pid 44904:tid 44943] [client 4.247.167.136:4452] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Tue Jan 06 23:19:37.516180 2026] [:error] [pid 44904:tid 44948] [client 4.247.167.136:4452] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aV0oCTtieuI1BJEZcvdZkgAAAEc"]
[Tue Jan 06 23:19:43.745221 2026] [:error] [pid 45959:tid 45970] [client 4.247.167.136:4483] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aV0oD1ajdn8P3hjgMYwY4wAAAUg"]
[Tue Jan 06 23:19:52.145497 2026] [:error] [pid 45012:tid 45028] [client 4.247.167.136:4658] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aV0oGBaMAxCuju1d0uYsrQAAAM4"]
[Tue Jan 06 23:19:53.839344 2026] [:error] [pid 44904:tid 44964] [client 4.247.167.136:4885] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aV0oGTtieuI1BJEZcvdaLgAAAFc"]
[Tue Jan 06 23:19:55.243319 2026] [:error] [pid 44903:tid 44933] [client 4.247.167.136:4775] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aV0oG9hHqjs38zbkQPA97AAAABg"]
[Tue Jan 06 23:19:56.788628 2026] [:error] [pid 45959:tid 45968] [client 4.247.167.136:4894] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aV0oHFajdn8P3hjgMYwZLAAAAUY"]
[Tue Jan 06 23:19:57.253717 2026] [:error] [pid 44905:tid 44988] [client 4.247.167.136:4250] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aV0oHbu7ufwWVst9EAsN7AAAAJQ"]
[Tue Jan 06 23:20:00.308941 2026] [:error] [pid 44903:tid 44927] [client 4.247.167.136:4667] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aV0oINhHqjs38zbkQPA-BwAAABQ"]
[Tue Jan 06 23:20:02.033962 2026] [:error] [pid 44903:tid 44932] [client 4.247.167.136:4974] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aV0oIthHqjs38zbkQPA-DwAAABc"]
[Tue Jan 06 23:20:03.120009 2026] [:error] [pid 44905:tid 44984] [client 4.247.167.136:5092] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aV0oI7u7ufwWVst9EAsOCQAAAJA"]
[Tue Jan 06 23:20:05.497600 2026] [:error] [pid 44905:tid 44988] [client 4.247.167.136:4783] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aV0oJbu7ufwWVst9EAsOFAAAAJQ"]
[Tue Jan 06 23:20:06.200691 2026] [:error] [pid 35140:tid 35152] [client 4.247.167.136:4239] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aV0oJnoQaIDFMbT-XMz2qAAAAQo"]
[Tue Jan 06 23:20:07.385721 2026] [:error] [pid 45012:tid 45033] [client 4.247.167.136:4907] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aV0oJxaMAxCuju1d0uYs0AAAANM"]
[Tue Jan 06 23:20:08.978286 2026] [:error] [pid 35140:tid 35161] [client 4.247.167.136:4169] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aV0oKHoQaIDFMbT-XMz2rAAAARM"]
[Tue Jan 06 23:20:10.726801 2026] [:error] [pid 35140:tid 35160] [client 4.247.167.136:4801] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aV0oKnoQaIDFMbT-XMz2rgAAARI"]
[Tue Jan 06 23:20:12.404301 2026] [:error] [pid 44905:tid 44975] [client 4.247.167.136:4189] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV0oLLu7ufwWVst9EAsOIAAAAIc"]
[Tue Jan 06 23:20:13.790063 2026] [:error] [pid 44904:tid 44960] [client 4.247.167.136:4767] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV0oLTtieuI1BJEZcvdaTAAAAFM"]
[Tue Jan 06 23:20:14.774460 2026] [:error] [pid 44904:tid 44954] [client 4.247.167.136:4790] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV0oLjtieuI1BJEZcvdaTgAAAE0"]
[Tue Jan 06 23:20:15.350430 2026] [:error] [pid 44905:tid 44977] [client 4.247.167.136:4177] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV0oL7u7ufwWVst9EAsOKwAAAIk"]
[Tue Jan 06 23:20:15.775886 2026] [:error] [pid 44903:tid 44912] [client 4.247.167.136:4179] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ADMIN.php"] [unique_id "aV0oL9hHqjs38zbkQPA-WAAAAAU"]
[Tue Jan 06 23:20:16.153693 2026] [:error] [pid 44905:tid 44985] [client 4.247.167.136:4257] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ADMIN.php"] [unique_id "aV0oMLu7ufwWVst9EAsOMwAAAJE"]
[Tue Jan 06 23:20:16.526370 2026] [:error] [pid 45959:tid 45978] [client 4.247.167.136:4278] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ADMIN.php"] [unique_id "aV0oMFajdn8P3hjgMYwZWQAAAVA"]
[Tue Jan 06 23:20:17.002453 2026] [:error] [pid 45959:tid 45970] [client 4.247.167.136:4272] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ADMIN.php"] [unique_id "aV0oMVajdn8P3hjgMYwZZAAAAUg"]
[Wed Jan 07 01:39:14.231839 2026] [:error] [pid 44904:tid 44962] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Wed Jan 07 01:39:14.369343 2026] [:error] [pid 44904:tid 44945] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Wed Jan 07 01:39:14.525352 2026] [:error] [pid 44904:tid 44953] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Wed Jan 07 01:39:14.667522 2026] [:error] [pid 44904:tid 44950] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Wed Jan 07 01:39:14.883611 2026] [:error] [pid 44904:tid 44958] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Wed Jan 07 01:39:15.040807 2026] [:error] [pid 44904:tid 44943] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Wed Jan 07 01:39:15.186115 2026] [:error] [pid 44904:tid 44961] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Wed Jan 07 01:39:15.324196 2026] [:error] [pid 44904:tid 44948] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Wed Jan 07 01:39:15.635878 2026] [:error] [pid 44904:tid 44960] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Wed Jan 07 01:39:15.773314 2026] [:error] [pid 44904:tid 44951] [client 20.249.73.6:15344] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Wed Jan 07 01:39:15.967688 2026] [:error] [pid 44904:tid 44946] [client 20.249.73.6:15344] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aV1IwztieuI1BJEZcveICAAAAEU"]
[Wed Jan 07 01:39:16.681053 2026] [:error] [pid 44903:tid 44923] [client 20.249.73.6:15309] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aV1IxNhHqjs38zbkQPBtRgAAABA"]
[Wed Jan 07 01:39:16.968738 2026] [:error] [pid 44903:tid 44911] [client 20.249.73.6:15254] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aV1IxNhHqjs38zbkQPBtSAAAAAQ"]
[Wed Jan 07 01:39:17.473945 2026] [:error] [pid 44904:tid 44949] [client 20.249.73.6:15347] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "aV1IxTtieuI1BJEZcveIDAAAAEg"]
[Wed Jan 07 01:39:17.825888 2026] [:error] [pid 44904:tid 44957] [client 20.249.73.6:15250] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aV1IxTtieuI1BJEZcveIDQAAAFA"]
[Wed Jan 07 01:39:18.268000 2026] [:error] [pid 44904:tid 44954] [client 20.249.73.6:15302] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aV1IxjtieuI1BJEZcveIDgAAAE0"]
[Wed Jan 07 01:39:18.752680 2026] [:error] [pid 45012:tid 45038] [client 20.249.73.6:15240] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aV1IxhaMAxCuju1d0uZjoQAAANg"]
[Wed Jan 07 01:39:19.083285 2026] [:error] [pid 44905:tid 44969] [client 20.249.73.6:15244] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aV1Ix7u7ufwWVst9EAs_HQAAAIE"]
[Wed Jan 07 01:39:19.381275 2026] [:error] [pid 44903:tid 44924] [client 20.249.73.6:15356] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aV1Ix9hHqjs38zbkQPBtUAAAABE"]
[Wed Jan 07 01:39:19.726711 2026] [:error] [pid 45959:tid 45976] [client 20.249.73.6:15317] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aV1Ix1ajdn8P3hjgMYxb3gAAAU4"]
[Wed Jan 07 01:39:20.111092 2026] [:error] [pid 45959:tid 45968] [client 20.249.73.6:15232] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aV1IyFajdn8P3hjgMYxb3wAAAUY"]
[Wed Jan 07 01:39:20.461076 2026] [:error] [pid 45959:tid 45982] [client 20.249.73.6:15358] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aV1IyFajdn8P3hjgMYxb4QAAAVQ"]
[Wed Jan 07 01:39:20.885064 2026] [:error] [pid 35140:tid 35162] [client 20.249.73.6:15338] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aV1IyHoQaIDFMbT-XMwjVAAAARQ"]
[Wed Jan 07 01:39:21.229636 2026] [:error] [pid 45959:tid 45979] [client 20.249.73.6:15258] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aV1IyVajdn8P3hjgMYxb4wAAAVE"]
[Wed Jan 07 01:39:21.682362 2026] [:error] [pid 35140:tid 35149] [client 20.249.73.6:15351] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aV1IyXoQaIDFMbT-XMwjVwAAAQc"]
[Wed Jan 07 01:39:22.088060 2026] [:error] [pid 45012:tid 45022] [client 20.249.73.6:15318] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "aV1IyhaMAxCuju1d0uZjowAAAMg"]
[Wed Jan 07 01:39:22.469489 2026] [:error] [pid 35140:tid 35142] [client 20.249.73.6:15239] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aV1IynoQaIDFMbT-XMwjWQAAAQA"]
[Wed Jan 07 01:39:22.846500 2026] [:error] [pid 35140:tid 35155] [client 20.249.73.6:15359] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aV1IynoQaIDFMbT-XMwjWgAAAQ0"]
[Wed Jan 07 01:39:23.169960 2026] [:error] [pid 44903:tid 44914] [client 20.249.73.6:15354] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aV1Iy9hHqjs38zbkQPBtWgAAAAc"]
[Wed Jan 07 01:39:23.512198 2026] [:error] [pid 35140:tid 35147] [client 20.249.73.6:15350] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "aV1Iy3oQaIDFMbT-XMwjWwAAAQU"]
[Wed Jan 07 01:39:23.833032 2026] [:error] [pid 45012:tid 45033] [client 20.249.73.6:15274] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aV1IyxaMAxCuju1d0uZjpAAAANM"]
[Wed Jan 07 01:39:24.132258 2026] [:error] [pid 35140:tid 35157] [client 20.249.73.6:15314] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aV1IzHoQaIDFMbT-XMwjXQAAAQ8"]
[Wed Jan 07 01:39:24.480235 2026] [:error] [pid 45959:tid 45969] [client 20.249.73.6:15323] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aV1IzFajdn8P3hjgMYxb7QAAAUc"]
[Wed Jan 07 01:39:24.832128 2026] [:error] [pid 45959:tid 45982] [client 20.249.73.6:7117] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "aV1IzFajdn8P3hjgMYxb7wAAAVQ"]
[Wed Jan 07 01:39:25.161025 2026] [:error] [pid 45012:tid 45026] [client 20.249.73.6:15312] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aV1IzRaMAxCuju1d0uZjpwAAAMw"]
[Wed Jan 07 01:39:25.470057 2026] [:error] [pid 35140:tid 35144] [client 20.249.73.6:15335] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aV1IzXoQaIDFMbT-XMwjYQAAAQI"]
[Wed Jan 07 01:39:25.855813 2026] [:error] [pid 45012:tid 45024] [client 20.249.73.6:15319] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aV1IzRaMAxCuju1d0uZjqwAAAMo"]
[Wed Jan 07 01:39:26.145110 2026] [:error] [pid 35140:tid 35151] [client 20.249.73.6:15331] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "aV1IznoQaIDFMbT-XMwjZQAAAQk"]
[Wed Jan 07 01:39:26.473358 2026] [:error] [pid 35140:tid 35143] [client 20.249.73.6:15234] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aV1IznoQaIDFMbT-XMwjaAAAAQE"]
[Wed Jan 07 01:39:26.792972 2026] [:error] [pid 35140:tid 35142] [client 20.249.73.6:15348] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aV1IznoQaIDFMbT-XMwjaQAAAQA"]
[Wed Jan 07 01:39:27.105788 2026] [:error] [pid 44905:tid 44981] [client 20.249.73.6:15340] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aV1Iz7u7ufwWVst9EAs_HgAAAI0"]
[Wed Jan 07 01:39:27.402107 2026] [:error] [pid 45012:tid 45022] [client 20.249.73.6:15289] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "aV1IzxaMAxCuju1d0uZjtAAAAMg"]
[Wed Jan 07 01:39:27.678739 2026] [:error] [pid 44903:tid 44924] [client 20.249.73.6:15310] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aV1Iz9hHqjs38zbkQPBtXgAAABE"]
[Wed Jan 07 01:39:27.977616 2026] [:error] [pid 44905:tid 44977] [client 20.249.73.6:15334] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aV1Iz7u7ufwWVst9EAs_HwAAAIk"]
[Wed Jan 07 01:39:28.250694 2026] [:error] [pid 44904:tid 44958] [client 20.249.73.6:15327] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aV1I0DtieuI1BJEZcveIEgAAAFE"]
[Wed Jan 07 01:39:28.539937 2026] [:error] [pid 44904:tid 44943] [client 20.249.73.6:15253] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "aV1I0DtieuI1BJEZcveIEwAAAEI"]
[Wed Jan 07 01:39:28.816542 2026] [:error] [pid 44903:tid 44913] [client 20.249.73.6:15324] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aV1I0NhHqjs38zbkQPBtYQAAAAY"]
[Wed Jan 07 01:39:29.127907 2026] [:error] [pid 44904:tid 44948] [client 20.249.73.6:7116] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aV1I0TtieuI1BJEZcveIFgAAAEc"]
[Wed Jan 07 01:39:29.417474 2026] [:error] [pid 44903:tid 44915] [client 20.249.73.6:15339] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aV1I0dhHqjs38zbkQPBtZgAAAAg"]
[Wed Jan 07 01:39:29.718212 2026] [:error] [pid 45959:tid 45975] [client 20.249.73.6:15345] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "aV1I0Vajdn8P3hjgMYxb-QAAAU0"]
[Wed Jan 07 01:39:30.029170 2026] [:error] [pid 44905:tid 44970] [client 20.249.73.6:15269] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aV1I0ru7ufwWVst9EAs_IAAAAII"]
[Wed Jan 07 01:39:30.316957 2026] [:error] [pid 45012:tid 45033] [client 20.249.73.6:15276] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aV1I0haMAxCuju1d0uZjtQAAANM"]
[Wed Jan 07 01:39:30.606883 2026] [:error] [pid 44903:tid 44916] [client 20.249.73.6:15257] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aV1I0thHqjs38zbkQPBtZwAAAAk"]
[Wed Jan 07 01:39:30.934163 2026] [:error] [pid 45959:tid 45974] [client 20.249.73.6:15337] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "aV1I0lajdn8P3hjgMYxb_QAAAUw"]
[Wed Jan 07 01:39:31.208757 2026] [:error] [pid 44903:tid 44907] [client 20.249.73.6:15233] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aV1I09hHqjs38zbkQPBtbAAAAAA"]
[Wed Jan 07 01:39:31.482392 2026] [:error] [pid 44903:tid 44930] [client 20.249.73.6:15260] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aV1I09hHqjs38zbkQPBtbgAAABY"]
[Wed Jan 07 01:39:31.764820 2026] [:error] [pid 45959:tid 45970] [client 20.249.73.6:7112] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aV1I01ajdn8P3hjgMYxb_gAAAUg"]
[Wed Jan 07 01:39:32.065357 2026] [:error] [pid 45959:tid 45969] [client 20.249.73.6:7122] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "aV1I1Fajdn8P3hjgMYxb_wAAAUc"]
[Wed Jan 07 01:39:32.372529 2026] [:error] [pid 45012:tid 45025] [client 20.249.73.6:7132] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aV1I1BaMAxCuju1d0uZjuAAAAMs"]
[Wed Jan 07 01:39:32.674228 2026] [:error] [pid 45959:tid 45968] [client 20.249.73.6:15285] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aV1I1Fajdn8P3hjgMYxcAAAAAUY"]
[Wed Jan 07 01:39:32.953070 2026] [:error] [pid 45012:tid 45029] [client 20.249.73.6:7141] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aV1I1BaMAxCuju1d0uZjugAAAM8"]
[Wed Jan 07 01:39:33.248955 2026] [:error] [pid 45959:tid 45972] [client 20.249.73.6:7140] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Rk41.php"] [unique_id "aV1I1Vajdn8P3hjgMYxcBAAAAUo"]
[Wed Jan 07 01:39:33.540648 2026] [:error] [pid 44903:tid 44912] [client 20.249.73.6:15255] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aV1I1dhHqjs38zbkQPBtcAAAAAU"]
[Wed Jan 07 01:39:33.886276 2026] [:error] [pid 44903:tid 44908] [client 20.249.73.6:15261] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aV1I1dhHqjs38zbkQPBtcQAAAAE"]
[Wed Jan 07 01:39:34.308213 2026] [:error] [pid 45959:tid 45964] [client 20.249.73.6:15242] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aV1I1lajdn8P3hjgMYxcCQAAAUI"]
[Wed Jan 07 01:39:34.580234 2026] [:error] [pid 44904:tid 44961] [client 20.249.73.6:15343] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ztv.php"] [unique_id "aV1I1jtieuI1BJEZcveIJgAAAFQ"]
[Wed Jan 07 01:39:34.861622 2026] [:error] [pid 45959:tid 45975] [client 20.249.73.6:15303] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aV1I1lajdn8P3hjgMYxcDAAAAU0"]
[Wed Jan 07 01:39:35.151953 2026] [:error] [pid 45012:tid 45015] [client 20.249.73.6:7105] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aV1I1xaMAxCuju1d0uZjvgAAAME"]
[Wed Jan 07 01:39:35.465431 2026] [:error] [pid 45012:tid 45036] [client 20.249.73.6:15336] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aV1I1xaMAxCuju1d0uZjvwAAANY"]
[Wed Jan 07 01:39:35.756335 2026] [:error] [pid 44904:tid 44962] [client 20.249.73.6:15283] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "aV1I1ztieuI1BJEZcveIMgAAAFU"]
[Wed Jan 07 01:39:36.096018 2026] [:error] [pid 45012:tid 45016] [client 20.249.73.6:15300] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aV1I2BaMAxCuju1d0uZjwAAAAMI"]
[Wed Jan 07 01:39:36.388059 2026] [:error] [pid 45959:tid 45971] [client 20.249.73.6:15301] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aV1I2Fajdn8P3hjgMYxcDwAAAUk"]
[Wed Jan 07 01:39:36.662153 2026] [:error] [pid 45012:tid 45030] [client 20.249.73.6:15308] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aV1I2BaMAxCuju1d0uZjwgAAANA"]
[Wed Jan 07 01:39:36.946107 2026] [:error] [pid 45959:tid 45970] [client 20.249.73.6:15237] [client 20.249.73.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aV1I2Fajdn8P3hjgMYxcEgAAAUg"]
[Wed Jan 07 04:47:56.100006 2026] [:error] [pid 51200:tid 51264] [client 43.241.146.58:35238] [client 43.241.146.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.146.58, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aV10_Ijhb00oxKSD4leGFQAAARA"]
[Wed Jan 07 04:47:56.106035 2026] [:error] [pid 51200:tid 51264] [client 43.241.146.58:35238] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 07 14:57:03.944840 2026] [:error] [pid 30633:tid 30668] [client 195.178.110.161:57494] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aV4Dv_ZiVWlF7303nMhjMgAAAEU"]
[Wed Jan 07 15:36:54.070098 2026] [:error] [pid 30634:tid 30713] [client 195.178.110.161:55570] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aV4NFoCIPBibObtmZtvFvwAAANc"]
[Wed Jan 07 20:02:24.328132 2026] [:error] [pid 58330:tid 58342] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Wed Jan 07 20:02:24.452133 2026] [:error] [pid 58330:tid 58341] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Jan 07 20:02:24.577623 2026] [:error] [pid 58330:tid 58338] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/rezor.php
[Wed Jan 07 20:02:24.703263 2026] [:error] [pid 58330:tid 58348] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/windex.php
[Wed Jan 07 20:02:24.828733 2026] [:error] [pid 58330:tid 58337] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/ajq1s.php
[Wed Jan 07 20:02:24.951998 2026] [:error] [pid 58330:tid 58343] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/world.php
[Wed Jan 07 20:02:25.080127 2026] [:error] [pid 58330:tid 58344] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Wed Jan 07 20:02:25.205979 2026] [:error] [pid 58330:tid 58335] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/spip.php
[Wed Jan 07 20:02:25.331945 2026] [:error] [pid 58330:tid 58332] [client 4.190.193.202:22513] File does not exist: /usr/local/apache/htdocs/suspended-page/geido.php
[Wed Jan 07 20:02:25.455035 2026] [:error] [pid 58330:tid 58350] [client 4.190.193.202:22513] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cachex.php"] [unique_id "aV5LUQ8kGngKGK7_wnf16QAAARI"]
[Wed Jan 07 20:02:25.720223 2026] [:error] [pid 30634:tid 30706] [client 4.190.193.202:22510] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cachex.php"] [unique_id "aV5LUYCIPBibObtmZtv--QAAANA"]
[Wed Jan 07 20:02:25.970429 2026] [:error] [pid 30632:tid 30638] [client 4.190.193.202:22508] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cachex.php"] [unique_id "aV5LUed3_LCpBJzo02f_jQAAAAI"]
[Wed Jan 07 20:02:26.213286 2026] [:error] [pid 51128:tid 51149] [client 4.190.193.202:22478] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cachex.php"] [unique_id "aV5LUkGjtE8U88mrwuec2gAAAZM"]
[Wed Jan 07 20:02:26.455955 2026] [:error] [pid 30720:tid 30728] [client 4.190.193.202:22480] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aV5LUodgcpQjqzUi9WaCGwAAAUY"]
[Wed Jan 07 20:02:26.705957 2026] [:error] [pid 30633:tid 30677] [client 4.190.193.202:22524] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aV5LUvZiVWlF7303nMim7gAAAE4"]
[Wed Jan 07 20:02:26.963295 2026] [:error] [pid 30633:tid 30666] [client 4.190.193.202:22412] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aV5LUvZiVWlF7303nMim7wAAAEM"]
[Wed Jan 07 20:02:27.207008 2026] [:error] [pid 30634:tid 30702] [client 4.190.193.202:22517] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpup.php"] [unique_id "aV5LU4CIPBibObtmZtv--gAAAMw"]
[Wed Jan 07 20:02:27.447669 2026] [:error] [pid 30634:tid 30704] [client 4.190.193.202:22502] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aV5LU4CIPBibObtmZtv-_AAAAM4"]
[Wed Jan 07 20:02:27.686647 2026] [:error] [pid 58330:tid 58341] [client 4.190.193.202:22487] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aV5LUw8kGngKGK7_wnf17gAAAQk"]
[Wed Jan 07 20:02:27.927389 2026] [:error] [pid 58294:tid 58315] [client 4.190.193.202:22424] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aV5LU1fzA7c0ITpf3nEe6wAAAJM"]
[Wed Jan 07 20:02:28.169534 2026] [:error] [pid 30633:tid 30686] [client 4.190.193.202:22493] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aV5LVPZiVWlF7303nMim8QAAAFc"]
[Wed Jan 07 20:02:28.429263 2026] [:error] [pid 30720:tid 30744] [client 4.190.193.202:22470] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aV5LVIdgcpQjqzUi9WaCHQAAAVY"]
[Wed Jan 07 20:02:28.684113 2026] [:error] [pid 30632:tid 30641] [client 4.190.193.202:22419] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aV5LVOd3_LCpBJzo02f_kAAAAAU"]
[Wed Jan 07 20:02:28.924593 2026] [:error] [pid 51128:tid 51137] [client 4.190.193.202:22430] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aV5LVEGjtE8U88mrwuec3gAAAYc"]
[Wed Jan 07 20:02:29.174267 2026] [:error] [pid 30632:tid 30643] [client 4.190.193.202:22522] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aV5LVed3_LCpBJzo02f_kwAAAAc"]
[Wed Jan 07 20:02:29.413452 2026] [:error] [pid 30632:tid 30655] [client 4.190.193.202:10205] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nck.php"] [unique_id "aV5LVed3_LCpBJzo02f_lQAAABM"]
[Wed Jan 07 20:02:29.666047 2026] [:error] [pid 30634:tid 30693] [client 4.190.193.202:22477] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nck.php"] [unique_id "aV5LVYCIPBibObtmZtv_AAAAAMM"]
[Wed Jan 07 20:02:29.918383 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:22506] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nck.php"] [unique_id "aV5LVfZiVWlF7303nMim9wAAAEU"]
[Wed Jan 07 20:02:30.169123 2026] [:error] [pid 30720:tid 30724] [client 4.190.193.202:22416] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nck.php"] [unique_id "aV5LVodgcpQjqzUi9WaCHwAAAUI"]
[Wed Jan 07 20:02:30.412284 2026] [:error] [pid 30633:tid 30675] [client 4.190.193.202:22423] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV5LVvZiVWlF7303nMim-AAAAEw"]
[Wed Jan 07 20:02:30.654385 2026] [:error] [pid 30720:tid 30741] [client 4.190.193.202:22406] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV5LVodgcpQjqzUi9WaCIAAAAVM"]
[Wed Jan 07 20:02:30.902459 2026] [:error] [pid 30632:tid 30638] [client 4.190.193.202:22505] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV5LVud3_LCpBJzo02f_lwAAAAI"]
[Wed Jan 07 20:02:31.142064 2026] [:error] [pid 30632:tid 30653] [client 4.190.193.202:22498] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV5LV-d3_LCpBJzo02f_mAAAABE"]
[Wed Jan 07 20:02:31.386473 2026] [:error] [pid 30632:tid 30649] [client 4.190.193.202:22472] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV5LV-d3_LCpBJzo02f_mgAAAA0"]
[Wed Jan 07 20:02:31.631173 2026] [:error] [pid 58294:tid 58314] [client 4.190.193.202:22434] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV5LV1fzA7c0ITpf3nEe7gAAAJI"]
[Wed Jan 07 20:02:31.872794 2026] [:error] [pid 30720:tid 30738] [client 4.190.193.202:22499] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV5LV4dgcpQjqzUi9WaCIgAAAVA"]
[Wed Jan 07 20:02:32.113112 2026] [:error] [pid 30720:tid 30736] [client 4.190.193.202:22400] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV5LWIdgcpQjqzUi9WaCIwAAAU4"]
[Wed Jan 07 20:02:32.372919 2026] [:error] [pid 30720:tid 30735] [client 4.190.193.202:10189] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aV5LWIdgcpQjqzUi9WaCJAAAAU0"]
[Wed Jan 07 20:02:32.636222 2026] [:error] [pid 30634:tid 30694] [client 4.190.193.202:22443] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aV5LWICIPBibObtmZtv_AwAAAMQ"]
[Wed Jan 07 20:02:32.876530 2026] [:error] [pid 30720:tid 30731] [client 4.190.193.202:22494] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aV5LWIdgcpQjqzUi9WaCJgAAAUk"]
[Wed Jan 07 20:02:33.116417 2026] [:error] [pid 30632:tid 30651] [client 4.190.193.202:10190] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aV5LWed3_LCpBJzo02f_nAAAAA8"]
[Wed Jan 07 20:02:33.356416 2026] [:error] [pid 58330:tid 58332] [client 4.190.193.202:22401] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aV5LWQ8kGngKGK7_wnf18gAAAQA"]
[Wed Jan 07 20:02:33.595519 2026] [:error] [pid 30634:tid 30700] [client 4.190.193.202:10176] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aV5LWYCIPBibObtmZtv_BAAAAMo"]
[Wed Jan 07 20:02:33.834725 2026] [:error] [pid 58294:tid 58303] [client 4.190.193.202:22507] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aV5LWVfzA7c0ITpf3nEe7wAAAIc"]
[Wed Jan 07 20:02:34.074423 2026] [:error] [pid 51128:tid 51138] [client 4.190.193.202:22408] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aV5LWkGjtE8U88mrwuec4AAAAYg"]
[Wed Jan 07 20:02:34.320369 2026] [:error] [pid 30634:tid 30697] [client 4.190.193.202:22415] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aV5LWoCIPBibObtmZtv_BwAAAMc"]
[Wed Jan 07 20:02:34.562019 2026] [:error] [pid 58330:tid 58347] [client 4.190.193.202:22455] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aV5LWg8kGngKGK7_wnf19AAAAQ8"]
[Wed Jan 07 20:02:34.802104 2026] [:error] [pid 30632:tid 30636] [client 4.190.193.202:22490] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aV5LWud3_LCpBJzo02f_nQAAAAA"]
[Wed Jan 07 20:02:35.057410 2026] [:error] [pid 30634:tid 30701] [client 4.190.193.202:22527] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aV5LW4CIPBibObtmZtv_CAAAAMs"]
[Wed Jan 07 20:02:35.303344 2026] [:error] [pid 51128:tid 51142] [client 4.190.193.202:22421] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5LW0GjtE8U88mrwuec4QAAAYw"]
[Wed Jan 07 20:02:35.546432 2026] [:error] [pid 58294:tid 58309] [client 4.190.193.202:22413] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5LW1fzA7c0ITpf3nEe8gAAAI0"]
[Wed Jan 07 20:02:35.786629 2026] [:error] [pid 51128:tid 51145] [client 4.190.193.202:10219] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5LW0GjtE8U88mrwuec4gAAAY8"]
[Wed Jan 07 20:02:36.041109 2026] [:error] [pid 58330:tid 58333] [client 4.190.193.202:22471] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5LXA8kGngKGK7_wnf19QAAAQE"]
[Wed Jan 07 20:02:36.310122 2026] [:error] [pid 30632:tid 30646] [client 4.190.193.202:10188] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aV5LXOd3_LCpBJzo02f_nwAAAAo"]
[Wed Jan 07 20:02:36.555375 2026] [:error] [pid 30634:tid 30695] [client 4.190.193.202:22485] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aV5LXICIPBibObtmZtv_DQAAAMU"]
[Wed Jan 07 20:02:36.795605 2026] [:error] [pid 30632:tid 30642] [client 4.190.193.202:22432] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aV5LXOd3_LCpBJzo02f_oAAAAAY"]
[Wed Jan 07 20:02:37.041476 2026] [:error] [pid 30633:tid 30680] [client 4.190.193.202:22461] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "aV5LXfZiVWlF7303nMinAQAAAFE"]
[Wed Jan 07 20:02:37.282042 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:22427] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aV5LXfZiVWlF7303nMinAgAAAEU"]
[Wed Jan 07 20:02:37.522632 2026] [:error] [pid 30632:tid 30660] [client 4.190.193.202:22448] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aV5LXed3_LCpBJzo02f_owAAABg"]
[Wed Jan 07 20:02:37.767992 2026] [:error] [pid 30632:tid 30652] [client 4.190.193.202:22525] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aV5LXed3_LCpBJzo02f_pgAAABA"]
[Wed Jan 07 20:02:38.014227 2026] [:error] [pid 30632:tid 30645] [client 4.190.193.202:22496] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "aV5LXud3_LCpBJzo02f_qAAAAAk"]
[Wed Jan 07 20:02:38.256051 2026] [:error] [pid 51128:tid 51150] [client 4.190.193.202:22409] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aV5LXkGjtE8U88mrwuec4wAAAZQ"]
[Wed Jan 07 20:02:38.495588 2026] [:error] [pid 51128:tid 51146] [client 4.190.193.202:22526] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aV5LXkGjtE8U88mrwuec5AAAAZA"]
[Wed Jan 07 20:02:38.749073 2026] [:error] [pid 30634:tid 30690] [client 4.190.193.202:22503] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aV5LXoCIPBibObtmZtv_EQAAAMA"]
[Wed Jan 07 20:02:38.994101 2026] [:error] [pid 58330:tid 58349] [client 4.190.193.202:22417] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aV5LXg8kGngKGK7_wnf19wAAARE"]
[Wed Jan 07 20:02:39.245704 2026] [:error] [pid 30634:tid 30694] [client 4.190.193.202:10118] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aV5LX4CIPBibObtmZtv_EgAAAMQ"]
[Wed Jan 07 20:02:39.487295 2026] [:error] [pid 58330:tid 58336] [client 4.190.193.202:22441] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aV5LXw8kGngKGK7_wnf1-AAAAQQ"]
[Wed Jan 07 20:02:39.728724 2026] [:error] [pid 30634:tid 30705] [client 4.190.193.202:22495] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aV5LX4CIPBibObtmZtv_FgAAAM8"]
[Wed Jan 07 20:02:39.978293 2026] [:error] [pid 30632:tid 30637] [client 4.190.193.202:22469] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php"] [unique_id "aV5LX-d3_LCpBJzo02f_rAAAAAE"]
[Wed Jan 07 20:02:40.217764 2026] [:error] [pid 30632:tid 30649] [client 4.190.193.202:22475] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aV5LYOd3_LCpBJzo02f_rQAAAA0"]
[Wed Jan 07 20:02:40.458326 2026] [:error] [pid 58330:tid 58334] [client 4.190.193.202:22462] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aV5LYA8kGngKGK7_wnf1_QAAAQI"]
[Wed Jan 07 20:02:40.699603 2026] [:error] [pid 30632:tid 30651] [client 4.190.193.202:22428] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aV5LYOd3_LCpBJzo02f_rgAAAA8"]
[Wed Jan 07 20:02:40.939957 2026] [:error] [pid 58294:tid 58301] [client 4.190.193.202:22476] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aV5LYFfzA7c0ITpf3nEe-AAAAIU"]
[Wed Jan 07 20:02:41.181848 2026] [:error] [pid 58294:tid 58308] [client 4.190.193.202:22402] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aV5LYVfzA7c0ITpf3nEe-QAAAIw"]
[Wed Jan 07 20:02:41.422203 2026] [:error] [pid 30720:tid 30730] [client 4.190.193.202:10215] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aV5LYYdgcpQjqzUi9WaCKgAAAUg"]
[Wed Jan 07 20:02:41.679235 2026] [:error] [pid 58294:tid 58305] [client 4.190.193.202:22501] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aV5LYVfzA7c0ITpf3nEe-wAAAIk"]
[Wed Jan 07 20:02:41.952143 2026] [:error] [pid 30720:tid 30734] [client 4.190.193.202:22464] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "aV5LYYdgcpQjqzUi9WaCKwAAAUw"]
[Wed Jan 07 20:02:42.197162 2026] [:error] [pid 58294:tid 58303] [client 4.190.193.202:22436] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aV5LYlfzA7c0ITpf3nEe_AAAAIc"]
[Wed Jan 07 20:02:42.447174 2026] [:error] [pid 58294:tid 58312] [client 4.190.193.202:22429] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aV5LYlfzA7c0ITpf3nEe_QAAAJA"]
[Wed Jan 07 20:02:42.687044 2026] [:error] [pid 30634:tid 30696] [client 4.190.193.202:22479] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aV5LYoCIPBibObtmZtv_GgAAAMY"]
[Wed Jan 07 20:02:42.936201 2026] [:error] [pid 58294:tid 58311] [client 4.190.193.202:22514] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php"] [unique_id "aV5LYlfzA7c0ITpf3nEe_gAAAI8"]
[Wed Jan 07 20:02:43.179004 2026] [:error] [pid 30634:tid 30703] [client 4.190.193.202:10184] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aV5LY4CIPBibObtmZtv_HAAAAM0"]
[Wed Jan 07 20:02:43.443693 2026] [:error] [pid 30632:tid 30642] [client 4.190.193.202:22420] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aV5LY-d3_LCpBJzo02f_rwAAAAY"]
[Wed Jan 07 20:02:43.712247 2026] [:error] [pid 30634:tid 30713] [client 4.190.193.202:10237] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aV5LY4CIPBibObtmZtv_HQAAANc"]
[Wed Jan 07 20:02:43.959411 2026] [:error] [pid 30634:tid 30693] [client 4.190.193.202:22431] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zsec.php"] [unique_id "aV5LY4CIPBibObtmZtv_HgAAAMM"]
[Wed Jan 07 20:02:44.202795 2026] [:error] [pid 30634:tid 30694] [client 4.190.193.202:22437] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aV5LZICIPBibObtmZtv_IAAAAMQ"]
[Wed Jan 07 20:02:44.442768 2026] [:error] [pid 30633:tid 30685] [client 4.190.193.202:22515] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aV5LZPZiVWlF7303nMinBgAAAFY"]
[Wed Jan 07 20:02:44.685941 2026] [:error] [pid 30633:tid 30669] [client 4.190.193.202:22439] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aV5LZPZiVWlF7303nMinCAAAAEY"]
[Wed Jan 07 20:02:44.927583 2026] [:error] [pid 51128:tid 51143] [client 4.190.193.202:10179] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/arig.php"] [unique_id "aV5LZEGjtE8U88mrwuec6wAAAY0"]
[Wed Jan 07 20:02:45.175698 2026] [:error] [pid 51128:tid 51136] [client 4.190.193.202:22440] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aV5LZUGjtE8U88mrwuec7AAAAYY"]
[Wed Jan 07 20:02:45.416903 2026] [:error] [pid 51128:tid 51135] [client 4.190.193.202:22516] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aV5LZUGjtE8U88mrwuec7wAAAYU"]
[Wed Jan 07 20:02:45.659859 2026] [:error] [pid 51128:tid 51152] [client 4.190.193.202:10208] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aV5LZUGjtE8U88mrwuec8AAAAZY"]
[Wed Jan 07 20:02:45.898945 2026] [:error] [pid 30634:tid 30712] [client 4.190.193.202:10121] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin1.php"] [unique_id "aV5LZYCIPBibObtmZtv_IwAAANY"]
[Wed Jan 07 20:02:46.137925 2026] [:error] [pid 58294:tid 58309] [client 4.190.193.202:10193] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV5LZlfzA7c0ITpf3nEfAAAAAI0"]
[Wed Jan 07 20:02:46.377115 2026] [:error] [pid 58294:tid 58317] [client 4.190.193.202:10123] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV5LZlfzA7c0ITpf3nEfAgAAAJU"]
[Wed Jan 07 20:02:46.621041 2026] [:error] [pid 58294:tid 58318] [client 4.190.193.202:10178] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV5LZlfzA7c0ITpf3nEfAwAAAJY"]
[Wed Jan 07 20:02:46.870825 2026] [:error] [pid 30632:tid 30641] [client 4.190.193.202:10206] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV5LZud3_LCpBJzo02f_sAAAAAU"]
[Wed Jan 07 20:02:47.110968 2026] [:error] [pid 58294:tid 58299] [client 4.190.193.202:22474] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aV5LZ1fzA7c0ITpf3nEfBQAAAIM"]
[Wed Jan 07 20:02:47.351784 2026] [:error] [pid 30632:tid 30654] [client 4.190.193.202:22489] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aV5LZ-d3_LCpBJzo02f_sQAAABI"]
[Wed Jan 07 20:02:47.592000 2026] [:error] [pid 30633:tid 30677] [client 4.190.193.202:22446] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aV5LZ_ZiVWlF7303nMinCgAAAE4"]
[Wed Jan 07 20:02:47.834149 2026] [:error] [pid 30720:tid 30746] [client 4.190.193.202:22492] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/af32.php"] [unique_id "aV5LZ4dgcpQjqzUi9WaCLQAAAVg"]
[Wed Jan 07 20:02:48.076068 2026] [:error] [pid 30633:tid 30666] [client 4.190.193.202:22520] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aV5LaPZiVWlF7303nMinDAAAAEM"]
[Wed Jan 07 20:02:48.323206 2026] [:error] [pid 30633:tid 30686] [client 4.190.193.202:10201] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aV5LaPZiVWlF7303nMinDQAAAFc"]
[Wed Jan 07 20:02:48.563813 2026] [:error] [pid 58330:tid 58352] [client 4.190.193.202:22509] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aV5LaA8kGngKGK7_wnf2BAAAARQ"]
[Wed Jan 07 20:02:48.808790 2026] [:error] [pid 30720:tid 30741] [client 4.190.193.202:22459] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rz.php"] [unique_id "aV5LaIdgcpQjqzUi9WaCLwAAAVM"]
[Wed Jan 07 20:02:49.052841 2026] [:error] [pid 58330:tid 58339] [client 4.190.193.202:10125] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aV5LaQ8kGngKGK7_wnf2BQAAAQc"]
[Wed Jan 07 20:02:49.293555 2026] [:error] [pid 30633:tid 30680] [client 4.190.193.202:10238] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aV5LafZiVWlF7303nMinDwAAAFE"]
[Wed Jan 07 20:02:49.534054 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:22443] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aV5LafZiVWlF7303nMinEAAAAEU"]
[Wed Jan 07 20:02:49.794291 2026] [:error] [pid 51128:tid 51150] [client 4.190.193.202:22405] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hugo.php"] [unique_id "aV5LaUGjtE8U88mrwuec8gAAAZQ"]
[Wed Jan 07 20:02:50.047450 2026] [:error] [pid 30633:tid 30675] [client 4.190.193.202:22410] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aV5LavZiVWlF7303nMinEgAAAEw"]
[Wed Jan 07 20:02:50.292253 2026] [:error] [pid 30634:tid 30707] [client 4.190.193.202:22433] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aV5LaoCIPBibObtmZtv_KgAAANE"]
[Wed Jan 07 20:02:50.533495 2026] [:error] [pid 30634:tid 30690] [client 4.190.193.202:22518] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aV5LaoCIPBibObtmZtv_KwAAAMA"]
[Wed Jan 07 20:02:50.773061 2026] [:error] [pid 30634:tid 30698] [client 4.190.193.202:10221] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "aV5LaoCIPBibObtmZtv_LAAAAMg"]
[Wed Jan 07 20:02:51.041768 2026] [:error] [pid 30633:tid 30683] [client 4.190.193.202:10177] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aV5La_ZiVWlF7303nMinFQAAAFQ"]
[Wed Jan 07 20:02:51.284495 2026] [:error] [pid 58330:tid 58355] [client 4.190.193.202:22426] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aV5Law8kGngKGK7_wnf2BgAAARc"]
[Wed Jan 07 20:02:51.525777 2026] [:error] [pid 51128:tid 51144] [client 4.190.193.202:10192] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aV5La0GjtE8U88mrwuec9AAAAY4"]
[Wed Jan 07 20:02:51.767764 2026] [:error] [pid 51128:tid 51133] [client 4.190.193.202:22444] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anjay.php"] [unique_id "aV5La0GjtE8U88mrwuec9QAAAYM"]
[Wed Jan 07 20:02:52.008265 2026] [:error] [pid 30720:tid 30737] [client 4.190.193.202:22435] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aV5LbIdgcpQjqzUi9WaCMwAAAU8"]
[Wed Jan 07 20:02:52.249915 2026] [:error] [pid 51128:tid 51132] [client 4.190.193.202:22521] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aV5LbEGjtE8U88mrwuec9wAAAYI"]
[Wed Jan 07 20:02:52.501784 2026] [:error] [pid 58330:tid 58342] [client 4.190.193.202:10113] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aV5LbA8kGngKGK7_wnf2CAAAAQo"]
[Wed Jan 07 20:02:52.743703 2026] [:error] [pid 30720:tid 30730] [client 4.190.193.202:22445] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/let.php"] [unique_id "aV5LbIdgcpQjqzUi9WaCNQAAAUg"]
[Wed Jan 07 20:02:52.983000 2026] [:error] [pid 58330:tid 58348] [client 4.190.193.202:10236] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV5LbA8kGngKGK7_wnf2CgAAARA"]
[Wed Jan 07 20:02:53.222446 2026] [:error] [pid 51128:tid 51141] [client 4.190.193.202:22484] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV5LbUGjtE8U88mrwuec-gAAAYs"]
[Wed Jan 07 20:02:53.466576 2026] [:error] [pid 51128:tid 51136] [client 4.190.193.202:22425] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV5LbUGjtE8U88mrwuec-wAAAYY"]
[Wed Jan 07 20:02:53.730528 2026] [:error] [pid 58330:tid 58341] [client 4.190.193.202:22511] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV5LbQ8kGngKGK7_wnf2DQAAAQk"]
[Wed Jan 07 20:02:53.984073 2026] [:error] [pid 30633:tid 30666] [client 4.190.193.202:22407] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aV5LbfZiVWlF7303nMinGwAAAEM"]
[Wed Jan 07 20:02:54.244940 2026] [:error] [pid 30633:tid 30673] [client 4.190.193.202:22452] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aV5LbvZiVWlF7303nMinHgAAAEo"]
[Wed Jan 07 20:02:54.484635 2026] [:error] [pid 51128:tid 51138] [client 4.190.193.202:10183] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aV5LbkGjtE8U88mrwuec_gAAAYg"]
[Wed Jan 07 20:02:54.731667 2026] [:error] [pid 30633:tid 30680] [client 4.190.193.202:22500] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aV5LbvZiVWlF7303nMinHwAAAFE"]
[Wed Jan 07 20:02:54.989278 2026] [:error] [pid 30720:tid 30728] [client 4.190.193.202:10186] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aV5LbodgcpQjqzUi9WaCOQAAAUY"]
[Wed Jan 07 20:02:55.229269 2026] [:error] [pid 30633:tid 30679] [client 4.190.193.202:10067] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aV5Lb_ZiVWlF7303nMinIAAAAFA"]
[Wed Jan 07 20:02:55.479590 2026] [:error] [pid 30633:tid 30674] [client 4.190.193.202:22512] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aV5Lb_ZiVWlF7303nMinIgAAAEs"]
[Wed Jan 07 20:02:55.718993 2026] [:error] [pid 51128:tid 51150] [client 4.190.193.202:22403] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aV5Lb0GjtE8U88mrwuedAQAAAZQ"]
[Wed Jan 07 20:02:55.959349 2026] [:error] [pid 51128:tid 51144] [client 4.190.193.202:22456] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aV5Lb0GjtE8U88mrwuedAgAAAY4"]
[Wed Jan 07 20:02:56.203808 2026] [:error] [pid 30632:tid 30660] [client 4.190.193.202:10229] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aV5LcOd3_LCpBJzo02f_sgAAABg"]
[Wed Jan 07 20:02:56.443898 2026] [:error] [pid 30632:tid 30655] [client 4.190.193.202:10204] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aV5LcOd3_LCpBJzo02f_swAAABM"]
[Wed Jan 07 20:02:56.704534 2026] [:error] [pid 58330:tid 58335] [client 4.190.193.202:22414] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aV5LcA8kGngKGK7_wnf2DgAAAQM"]
[Wed Jan 07 20:02:56.951627 2026] [:error] [pid 58294:tid 58302] [client 4.190.193.202:22457] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aV5LcFfzA7c0ITpf3nEfCAAAAIY"]
[Wed Jan 07 20:02:57.212210 2026] [:error] [pid 30720:tid 30744] [client 4.190.193.202:10223] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aV5LcYdgcpQjqzUi9WaCOgAAAVY"]
[Wed Jan 07 20:02:57.457485 2026] [:error] [pid 58330:tid 58343] [client 4.190.193.202:10217] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aV5LcQ8kGngKGK7_wnf2EAAAAQs"]
[Wed Jan 07 20:02:57.705013 2026] [:error] [pid 58330:tid 58353] [client 4.190.193.202:10233] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aV5LcQ8kGngKGK7_wnf2EgAAARU"]
[Wed Jan 07 20:02:57.947713 2026] [:error] [pid 58330:tid 58354] [client 4.190.193.202:22491] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aV5LcQ8kGngKGK7_wnf2EwAAARY"]
[Wed Jan 07 20:02:58.188251 2026] [:error] [pid 58294:tid 58301] [client 4.190.193.202:10213] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aV5LclfzA7c0ITpf3nEfCQAAAIU"]
[Wed Jan 07 20:02:58.445433 2026] [:error] [pid 30633:tid 30669] [client 4.190.193.202:10134] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aV5LcvZiVWlF7303nMinJgAAAEY"]
[Wed Jan 07 20:02:58.704310 2026] [:error] [pid 51128:tid 51146] [client 4.190.193.202:10139] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aV5LckGjtE8U88mrwuedBwAAAZA"]
[Wed Jan 07 20:02:59.029060 2026] [:error] [pid 51128:tid 51131] [client 4.190.193.202:10187] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aV5Lc0GjtE8U88mrwuedCgAAAYE"]
[Wed Jan 07 20:02:59.297729 2026] [:error] [pid 58330:tid 58336] [client 4.190.193.202:10181] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aV5Lcw8kGngKGK7_wnf2GAAAAQQ"]
[Wed Jan 07 20:02:59.564339 2026] [:error] [pid 30720:tid 30725] [client 4.190.193.202:22418] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aV5Lc4dgcpQjqzUi9WaCTwAAAUM"]
[Wed Jan 07 20:02:59.811805 2026] [:error] [pid 58330:tid 58334] [client 4.190.193.202:22404] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aV5Lcw8kGngKGK7_wnf2HwAAAQI"]
[Wed Jan 07 20:03:00.054627 2026] [:error] [pid 58294:tid 58319] [client 4.190.193.202:22504] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV5LdFfzA7c0ITpf3nEfEgAAAJc"]
[Wed Jan 07 20:03:00.313624 2026] [:error] [pid 58294:tid 58318] [client 4.190.193.202:10182] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV5LdFfzA7c0ITpf3nEfFwAAAJY"]
[Wed Jan 07 20:03:00.554839 2026] [:error] [pid 30720:tid 30743] [client 4.190.193.202:10116] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV5LdIdgcpQjqzUi9WaCXQAAAVU"]
[Wed Jan 07 20:03:00.796706 2026] [:error] [pid 30632:tid 30652] [client 4.190.193.202:10195] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV5LdOd3_LCpBJzo02f_tAAAABA"]
[Wed Jan 07 20:03:01.076486 2026] [:error] [pid 58330:tid 58338] [client 4.190.193.202:10197] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aV5LdQ8kGngKGK7_wnf2IwAAAQY"]
[Wed Jan 07 20:03:01.317504 2026] [:error] [pid 58330:tid 58353] [client 4.190.193.202:22519] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aV5LdQ8kGngKGK7_wnf2JwAAARU"]
[Wed Jan 07 20:03:01.557105 2026] [:error] [pid 30720:tid 30741] [client 4.190.193.202:10194] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aV5LdYdgcpQjqzUi9WaCZgAAAVM"]
[Wed Jan 07 20:03:01.799229 2026] [:error] [pid 30634:tid 30696] [client 4.190.193.202:10115] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cloud.php"] [unique_id "aV5LdYCIPBibObtmZtv_PAAAAMY"]
[Wed Jan 07 20:03:02.043801 2026] [:error] [pid 30720:tid 30722] [client 4.190.193.202:22447] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV5LdodgcpQjqzUi9WaCagAAAUA"]
[Wed Jan 07 20:03:02.290984 2026] [:error] [pid 51128:tid 51137] [client 4.190.193.202:22467] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV5LdkGjtE8U88mrwuedDgAAAYc"]
[Wed Jan 07 20:03:02.535171 2026] [:error] [pid 51128:tid 51135] [client 4.190.193.202:22451] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV5LdkGjtE8U88mrwuedDwAAAYU"]
[Wed Jan 07 20:03:02.790359 2026] [:error] [pid 58330:tid 58356] [client 4.190.193.202:10174] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV5Ldg8kGngKGK7_wnf2MAAAARg"]
[Wed Jan 07 20:03:03.035456 2026] [:error] [pid 58330:tid 58340] [client 4.190.193.202:22463] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV5Ldw8kGngKGK7_wnf2MgAAAQg"]
[Wed Jan 07 20:03:03.276534 2026] [:error] [pid 58294:tid 58320] [client 4.190.193.202:10212] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV5Ld1fzA7c0ITpf3nEfKgAAAJg"]
[Wed Jan 07 20:03:03.517906 2026] [:error] [pid 51128:tid 51132] [client 4.190.193.202:22411] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV5Ld0GjtE8U88mrwuedFgAAAYI"]
[Wed Jan 07 20:03:03.770758 2026] [:error] [pid 58330:tid 58345] [client 4.190.193.202:10072] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV5Ldw8kGngKGK7_wnf2OAAAAQ0"]
[Wed Jan 07 20:03:04.024211 2026] [:error] [pid 51128:tid 51146] [client 4.190.193.202:22481] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aV5LeEGjtE8U88mrwuedGQAAAZA"]
[Wed Jan 07 20:03:04.263801 2026] [:error] [pid 30632:tid 30651] [client 4.190.193.202:22486] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aV5LeOd3_LCpBJzo02f_wQAAAA8"]
[Wed Jan 07 20:03:04.503271 2026] [:error] [pid 30633:tid 30674] [client 4.190.193.202:22497] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aV5LePZiVWlF7303nMinMQAAAEs"]
[Wed Jan 07 20:03:04.747760 2026] [:error] [pid 30720:tid 30725] [client 4.190.193.202:10152] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aV5LeIdgcpQjqzUi9WaCewAAAUM"]
[Wed Jan 07 20:03:05.017313 2026] [:error] [pid 51128:tid 51137] [client 4.190.193.202:10239] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5LeUGjtE8U88mrwuedIAAAAYc"]
[Wed Jan 07 20:03:05.263749 2026] [:error] [pid 30633:tid 30686] [client 4.190.193.202:10226] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5LefZiVWlF7303nMinOAAAAFc"]
[Wed Jan 07 20:03:05.510657 2026] [:error] [pid 30633:tid 30667] [client 4.190.193.202:10140] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5LefZiVWlF7303nMinOwAAAEQ"]
[Wed Jan 07 20:03:05.751427 2026] [:error] [pid 51128:tid 51130] [client 4.190.193.202:10191] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5LeUGjtE8U88mrwuedKwAAAYA"]
[Wed Jan 07 20:03:05.993821 2026] [:error] [pid 30633:tid 30681] [client 4.190.193.202:10169] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV5LefZiVWlF7303nMinQAAAAFI"]
[Wed Jan 07 20:03:06.234683 2026] [:error] [pid 30633:tid 30670] [client 4.190.193.202:10198] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV5LevZiVWlF7303nMinRQAAAEc"]
[Wed Jan 07 20:03:06.482499 2026] [:error] [pid 30633:tid 30685] [client 4.190.193.202:10130] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV5LevZiVWlF7303nMinSgAAAFY"]
[Wed Jan 07 20:03:06.732611 2026] [:error] [pid 30632:tid 30655] [client 4.190.193.202:10180] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV5Leud3_LCpBJzo02f_ywAAABM"]
[Wed Jan 07 20:03:06.972805 2026] [:error] [pid 58330:tid 58333] [client 4.190.193.202:22523] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aV5Leg8kGngKGK7_wnf2WAAAAQE"]
[Wed Jan 07 20:03:07.213084 2026] [:error] [pid 30632:tid 30638] [client 4.190.193.202:22460] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aV5Le-d3_LCpBJzo02f_0AAAAAI"]
[Wed Jan 07 20:03:07.452235 2026] [:error] [pid 30632:tid 30649] [client 4.190.193.202:10200] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aV5Le-d3_LCpBJzo02f_1QAAAA0"]
[Wed Jan 07 20:03:07.692375 2026] [:error] [pid 58330:tid 58355] [client 4.190.193.202:10171] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aV5Lew8kGngKGK7_wnf2YQAAARc"]
[Wed Jan 07 20:03:07.933963 2026] [:error] [pid 30720:tid 30737] [client 4.190.193.202:10127] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aV5Le4dgcpQjqzUi9WaChwAAAU8"]
[Wed Jan 07 20:03:08.184956 2026] [:error] [pid 58294:tid 58312] [client 4.190.193.202:10111] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aV5LfFfzA7c0ITpf3nEfOAAAAJA"]
[Wed Jan 07 20:03:08.427209 2026] [:error] [pid 58294:tid 58309] [client 4.190.193.202:10196] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aV5LfFfzA7c0ITpf3nEfPQAAAI0"]
[Wed Jan 07 20:03:08.672968 2026] [:error] [pid 30720:tid 30724] [client 4.190.193.202:22454] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aV5LfIdgcpQjqzUi9WaCkQAAAUI"]
[Wed Jan 07 20:03:08.914805 2026] [:error] [pid 58294:tid 58297] [client 4.190.193.202:10162] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV5LfFfzA7c0ITpf3nEfRQAAAIE"]
[Wed Jan 07 20:03:09.157165 2026] [:error] [pid 58294:tid 58315] [client 4.190.193.202:10114] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV5LfVfzA7c0ITpf3nEfSAAAAJM"]
[Wed Jan 07 20:03:09.415722 2026] [:error] [pid 30633:tid 30673] [client 4.190.193.202:10227] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV5LffZiVWlF7303nMinUgAAAEo"]
[Wed Jan 07 20:03:09.661655 2026] [:error] [pid 30720:tid 30745] [client 4.190.193.202:22449] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV5LfYdgcpQjqzUi9WaCmAAAAVc"]
[Wed Jan 07 20:03:09.902350 2026] [:error] [pid 58294:tid 58305] [client 4.190.193.202:22473] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aV5LfVfzA7c0ITpf3nEfUgAAAIk"]
[Wed Jan 07 20:03:10.142753 2026] [:error] [pid 51128:tid 51135] [client 4.190.193.202:22453] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aV5LfkGjtE8U88mrwuedNwAAAYU"]
[Wed Jan 07 20:03:10.382807 2026] [:error] [pid 51128:tid 51150] [client 4.190.193.202:10199] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aV5LfkGjtE8U88mrwuedPAAAAZQ"]
[Wed Jan 07 20:03:10.623850 2026] [:error] [pid 30633:tid 30670] [client 4.190.193.202:22458] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aV5LfvZiVWlF7303nMinVgAAAEc"]
[Wed Jan 07 20:03:10.862865 2026] [:error] [pid 30633:tid 30674] [client 4.190.193.202:10209] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aV5LfvZiVWlF7303nMinWwAAAEs"]
[Wed Jan 07 20:03:11.123944 2026] [:error] [pid 30633:tid 30685] [client 4.190.193.202:10112] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aV5Lf_ZiVWlF7303nMinXwAAAFY"]
[Wed Jan 07 20:03:11.363585 2026] [:error] [pid 30633:tid 30666] [client 4.190.193.202:22442] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aV5Lf_ZiVWlF7303nMinZwAAAEM"]
[Wed Jan 07 20:03:11.603494 2026] [:error] [pid 58330:tid 58356] [client 4.190.193.202:10170] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aV5Lfw8kGngKGK7_wnf2bwAAARg"]
[Wed Jan 07 20:03:11.843617 2026] [:error] [pid 30633:tid 30665] [client 4.190.193.202:10117] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aV5Lf_ZiVWlF7303nMinbQAAAEI"]
[Wed Jan 07 20:03:12.083789 2026] [:error] [pid 30632:tid 30643] [client 4.190.193.202:10133] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aV5LgOd3_LCpBJzo02f_7gAAAAc"]
[Wed Jan 07 20:03:12.326364 2026] [:error] [pid 58330:tid 58355] [client 4.190.193.202:10055] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aV5LgA8kGngKGK7_wnf2dwAAARc"]
[Wed Jan 07 20:03:12.566089 2026] [:error] [pid 30633:tid 30683] [client 4.190.193.202:10086] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uana.php"] [unique_id "aV5LgPZiVWlF7303nMincAAAAFQ"]
[Wed Jan 07 20:03:12.813947 2026] [:error] [pid 30632:tid 30646] [client 4.190.193.202:10084] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV5LgOd3_LCpBJzo02f_8AAAAAo"]
[Wed Jan 07 20:03:13.062161 2026] [:error] [pid 30720:tid 30726] [client 4.190.193.202:10157] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV5LgYdgcpQjqzUi9WaCrgAAAUQ"]
[Wed Jan 07 20:03:13.308960 2026] [:error] [pid 51128:tid 51132] [client 4.190.193.202:10119] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV5LgUGjtE8U88mrwuedPgAAAYI"]
[Wed Jan 07 20:03:13.548755 2026] [:error] [pid 30720:tid 30737] [client 4.190.193.202:22468] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV5LgYdgcpQjqzUi9WaCsQAAAU8"]
[Wed Jan 07 20:03:13.787088 2026] [:error] [pid 51128:tid 51145] [client 4.190.193.202:10120] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aV5LgUGjtE8U88mrwuedQgAAAY8"]
[Wed Jan 07 20:03:14.027204 2026] [:error] [pid 30632:tid 30654] [client 4.190.193.202:22488] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aV5Lgud3_LCpBJzo02f_-AAAABI"]
[Wed Jan 07 20:03:14.278005 2026] [:error] [pid 30632:tid 30653] [client 4.190.193.202:10145] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aV5Lgud3_LCpBJzo02cAAAAAABE"]
[Wed Jan 07 20:03:14.524165 2026] [:error] [pid 30632:tid 30658] [client 4.190.193.202:10128] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aV5Lgud3_LCpBJzo02cACAAAABY"]
[Wed Jan 07 20:03:14.762795 2026] [:error] [pid 58294:tid 58309] [client 4.190.193.202:10175] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aV5LglfzA7c0ITpf3nEfaQAAAI0"]
[Wed Jan 07 20:03:15.002228 2026] [:error] [pid 58294:tid 58318] [client 4.190.193.202:10231] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aV5Lg1fzA7c0ITpf3nEfbAAAAJY"]
[Wed Jan 07 20:03:15.242616 2026] [:error] [pid 51128:tid 51139] [client 4.190.193.202:10091] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aV5Lg0GjtE8U88mrwuedRgAAAYk"]
[Wed Jan 07 20:03:15.481584 2026] [:error] [pid 58294:tid 58308] [client 4.190.193.202:10034] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/api.php"] [unique_id "aV5Lg1fzA7c0ITpf3nEfeQAAAIw"]
[Wed Jan 07 20:03:15.721285 2026] [:error] [pid 58294:tid 58306] [client 4.190.193.202:10129] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aV5Lg1fzA7c0ITpf3nEfgAAAAIo"]
[Wed Jan 07 20:03:15.970159 2026] [:error] [pid 58294:tid 58318] [client 4.190.193.202:10216] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aV5Lg1fzA7c0ITpf3nEfgwAAAJY"]
[Wed Jan 07 20:03:16.216750 2026] [:error] [pid 51128:tid 51130] [client 4.190.193.202:10210] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aV5LhEGjtE8U88mrwuedVQAAAYA"]
[Wed Jan 07 20:03:16.455967 2026] [:error] [pid 30632:tid 30655] [client 4.190.193.202:10222] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aV5LhOd3_LCpBJzo02cAEQAAABM"]
[Wed Jan 07 20:03:16.697761 2026] [:error] [pid 30634:tid 30690] [client 4.190.193.202:10225] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV5LhICIPBibObtmZtv_WAAAAMA"]
[Wed Jan 07 20:03:16.938371 2026] [:error] [pid 30720:tid 30746] [client 4.190.193.202:10154] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV5LhIdgcpQjqzUi9WaCtgAAAVg"]
[Wed Jan 07 20:03:17.177895 2026] [:error] [pid 30634:tid 30698] [client 4.190.193.202:10159] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV5LhYCIPBibObtmZtv_XAAAAMg"]
[Wed Jan 07 20:03:17.419286 2026] [:error] [pid 30720:tid 30727] [client 4.190.193.202:22422] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV5LhYdgcpQjqzUi9WaCuAAAAUU"]
[Wed Jan 07 20:03:17.661079 2026] [:error] [pid 30720:tid 30725] [client 4.190.193.202:10163] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aV5LhYdgcpQjqzUi9WaCugAAAUM"]
[Wed Jan 07 20:03:17.905299 2026] [:error] [pid 58330:tid 58337] [client 4.190.193.202:10232] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aV5LhQ8kGngKGK7_wnf2kAAAAQU"]
[Wed Jan 07 20:03:18.148257 2026] [:error] [pid 30633:tid 30686] [client 4.190.193.202:10203] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aV5LhvZiVWlF7303nMiniAAAAFc"]
[Wed Jan 07 20:03:18.388920 2026] [:error] [pid 51128:tid 51137] [client 4.190.193.202:22438] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-rex4.php7"] [unique_id "aV5LhkGjtE8U88mrwuedYAAAAYc"]
[Wed Jan 07 20:03:18.628221 2026] [:error] [pid 30720:tid 30722] [client 4.190.193.202:10064] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aV5LhodgcpQjqzUi9WaCvwAAAUA"]
[Wed Jan 07 20:03:18.869946 2026] [:error] [pid 58294:tid 58305] [client 4.190.193.202:10059] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aV5LhlfzA7c0ITpf3nEfkQAAAIk"]
[Wed Jan 07 20:03:19.117830 2026] [:error] [pid 58294:tid 58316] [client 4.190.193.202:10074] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aV5Lh1fzA7c0ITpf3nEfmAAAAJQ"]
[Wed Jan 07 20:03:19.364126 2026] [:error] [pid 30632:tid 30636] [client 4.190.193.202:10124] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aV5Lh-d3_LCpBJzo02cAIAAAAAA"]
[Wed Jan 07 20:03:19.605254 2026] [:error] [pid 51128:tid 51151] [client 4.190.193.202:10137] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aV5Lh0GjtE8U88mrwuedYgAAAZU"]
[Wed Jan 07 20:03:19.844153 2026] [:error] [pid 30633:tid 30684] [client 4.190.193.202:10214] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aV5Lh_ZiVWlF7303nMinjQAAAFU"]
[Wed Jan 07 20:03:20.083052 2026] [:error] [pid 58294:tid 58307] [client 4.190.193.202:10080] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aV5LiFfzA7c0ITpf3nEfngAAAIs"]
[Wed Jan 07 20:03:20.323075 2026] [:error] [pid 58294:tid 58312] [client 4.190.193.202:10073] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aV5LiFfzA7c0ITpf3nEfoAAAAJA"]
[Wed Jan 07 20:03:20.564424 2026] [:error] [pid 30720:tid 30734] [client 4.190.193.202:10220] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aV5LiIdgcpQjqzUi9WaCwgAAAUw"]
[Wed Jan 07 20:03:20.814063 2026] [:error] [pid 30720:tid 30737] [client 4.190.193.202:10065] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aV5LiIdgcpQjqzUi9WaCwwAAAU8"]
[Wed Jan 07 20:03:21.067374 2026] [:error] [pid 58294:tid 58296] [client 4.190.193.202:10131] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aV5LiVfzA7c0ITpf3nEfowAAAIA"]
[Wed Jan 07 20:03:21.308252 2026] [:error] [pid 30632:tid 30641] [client 4.190.193.202:10151] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aV5Lied3_LCpBJzo02cAIwAAAAU"]
[Wed Jan 07 20:03:21.555608 2026] [:error] [pid 30634:tid 30693] [client 4.190.193.202:22466] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aV5LiYCIPBibObtmZtv_agAAAMM"]
[Wed Jan 07 20:03:21.805638 2026] [:error] [pid 30720:tid 30740] [client 4.190.193.202:10160] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aV5LiYdgcpQjqzUi9WaCxAAAAVI"]
[Wed Jan 07 20:03:22.048069 2026] [:error] [pid 58294:tid 58308] [client 4.190.193.202:10230] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aV5LilfzA7c0ITpf3nEfpAAAAIw"]
[Wed Jan 07 20:03:22.300195 2026] [:error] [pid 51128:tid 51140] [client 4.190.193.202:9988] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php7"] [unique_id "aV5LikGjtE8U88mrwuedaAAAAYo"]
[Wed Jan 07 20:03:22.550075 2026] [:error] [pid 58294:tid 58304] [client 4.190.193.202:10138] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aV5LilfzA7c0ITpf3nEfpwAAAIg"]
[Wed Jan 07 20:03:22.790502 2026] [:error] [pid 58294:tid 58319] [client 4.190.193.202:10146] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aV5LilfzA7c0ITpf3nEfqQAAAJc"]
[Wed Jan 07 20:03:23.037051 2026] [:error] [pid 30632:tid 30655] [client 4.190.193.202:10235] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aV5Li-d3_LCpBJzo02cAJwAAABM"]
[Wed Jan 07 20:03:23.279918 2026] [:error] [pid 58330:tid 58336] [client 4.190.193.202:10012] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "aV5Liw8kGngKGK7_wnf2nQAAAQQ"]
[Wed Jan 07 20:03:23.521868 2026] [:error] [pid 51128:tid 51145] [client 4.190.193.202:10050] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aV5Li0GjtE8U88mrwuedawAAAY8"]
[Wed Jan 07 20:03:23.764350 2026] [:error] [pid 58330:tid 58340] [client 4.190.193.202:9985] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aV5Liw8kGngKGK7_wnf2ngAAAQg"]
[Wed Jan 07 20:03:24.005066 2026] [:error] [pid 58294:tid 58318] [client 4.190.193.202:10052] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aV5LjFfzA7c0ITpf3nEfrAAAAJY"]
[Wed Jan 07 20:03:24.250728 2026] [:error] [pid 58294:tid 58320] [client 4.190.193.202:10002] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pekok.php"] [unique_id "aV5LjFfzA7c0ITpf3nEfrQAAAJg"]
[Wed Jan 07 20:03:24.492799 2026] [:error] [pid 58294:tid 58313] [client 4.190.193.202:10096] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aV5LjFfzA7c0ITpf3nEfrgAAAJE"]
[Wed Jan 07 20:03:24.733304 2026] [:error] [pid 30632:tid 30650] [client 4.190.193.202:10234] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aV5LjOd3_LCpBJzo02cALAAAAA4"]
[Wed Jan 07 20:03:24.974195 2026] [:error] [pid 58294:tid 58315] [client 4.190.193.202:10135] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aV5LjFfzA7c0ITpf3nEfsQAAAJM"]
[Wed Jan 07 20:03:25.224888 2026] [:error] [pid 58294:tid 58312] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Jan 07 20:03:25.348485 2026] [:error] [pid 58294:tid 58297] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aa.php
[Wed Jan 07 20:03:25.471768 2026] [:error] [pid 58294:tid 58301] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/cart.php
[Wed Jan 07 20:03:25.594849 2026] [:error] [pid 58294:tid 58296] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/compare.php
[Wed Jan 07 20:03:25.717774 2026] [:error] [pid 58294:tid 58308] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Wed Jan 07 20:03:25.841401 2026] [:error] [pid 58294:tid 58303] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php
[Wed Jan 07 20:03:25.965577 2026] [:error] [pid 58294:tid 58305] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Jan 07 20:03:26.090136 2026] [:error] [pid 58294:tid 58311] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/atom.php
[Wed Jan 07 20:03:26.213743 2026] [:error] [pid 58294:tid 58309] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/case.php
[Wed Jan 07 20:03:26.337687 2026] [:error] [pid 58294:tid 58316] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/docs.php
[Wed Jan 07 20:03:26.461979 2026] [:error] [pid 58294:tid 58317] [client 4.190.193.202:10004] File does not exist: /usr/local/apache/htdocs/suspended-page/ios.php
[Wed Jan 07 20:03:26.582176 2026] [:error] [pid 58294:tid 58320] [client 4.190.193.202:10004] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV5LjlfzA7c0ITpf3nEfvwAAAJg"]
[Wed Jan 07 20:03:26.822483 2026] [:error] [pid 58294:tid 58315] [client 4.190.193.202:10082] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV5LjlfzA7c0ITpf3nEfwgAAAJM"]
[Wed Jan 07 20:03:27.062814 2026] [:error] [pid 30632:tid 30646] [client 4.190.193.202:9990] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV5Lj-d3_LCpBJzo02cALQAAAAo"]
[Wed Jan 07 20:03:27.300747 2026] [:error] [pid 30632:tid 30636] [client 4.190.193.202:10161] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV5Lj-d3_LCpBJzo02cALwAAAAA"]
[Wed Jan 07 20:03:27.539583 2026] [:error] [pid 30633:tid 30681] [client 4.190.193.202:10053] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV5Lj_ZiVWlF7303nMinlAAAAFI"]
[Wed Jan 07 20:03:27.779374 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:10207] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV5Lj_ZiVWlF7303nMinlQAAAEU"]
[Wed Jan 07 20:03:28.019341 2026] [:error] [pid 58330:tid 58348] [client 4.190.193.202:10166] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV5LkA8kGngKGK7_wnf2oAAAARA"]
[Wed Jan 07 20:03:28.268278 2026] [:error] [pid 58330:tid 58349] [client 4.190.193.202:10150] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV5LkA8kGngKGK7_wnf2ogAAARE"]
[Wed Jan 07 20:03:28.516604 2026] [:error] [pid 30633:tid 30674] [client 4.190.193.202:10147] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV5LkPZiVWlF7303nMinlwAAAEs"]
[Wed Jan 07 20:03:28.758341 2026] [:error] [pid 30632:tid 30641] [client 4.190.193.202:10153] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV5LkOd3_LCpBJzo02cAMwAAAAU"]
[Wed Jan 07 20:03:28.998903 2026] [:error] [pid 30633:tid 30677] [client 4.190.193.202:10085] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV5LkPZiVWlF7303nMinngAAAE4"]
[Wed Jan 07 20:03:29.238658 2026] [:error] [pid 58330:tid 58343] [client 4.190.193.202:10008] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV5LkQ8kGngKGK7_wnf2wAAAAQs"]
[Wed Jan 07 20:03:29.479544 2026] [:error] [pid 30720:tid 30735] [client 4.190.193.202:10054] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV5LkYdgcpQjqzUi9WaCxwAAAU0"]
[Wed Jan 07 20:03:29.719220 2026] [:error] [pid 30720:tid 30732] [client 4.190.193.202:10122] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV5LkYdgcpQjqzUi9WaCyAAAAUo"]
[Wed Jan 07 20:03:29.968811 2026] [:error] [pid 30632:tid 30655] [client 4.190.193.202:9926] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV5Lked3_LCpBJzo02cANgAAABM"]
[Wed Jan 07 20:03:30.211107 2026] [:error] [pid 51128:tid 51136] [client 4.190.193.202:10087] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV5LkkGjtE8U88mrwuedbgAAAYY"]
[Wed Jan 07 20:03:30.450772 2026] [:error] [pid 30632:tid 30638] [client 4.190.193.202:10010] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aV5Lkud3_LCpBJzo02cANwAAAAI"]
[Wed Jan 07 20:03:30.694397 2026] [:error] [pid 30634:tid 30705] [client 4.190.193.202:10070] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aV5LkoCIPBibObtmZtv_bQAAAM8"]
[Wed Jan 07 20:03:30.935251 2026] [:error] [pid 30720:tid 30723] [client 4.190.193.202:10165] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aV5LkodgcpQjqzUi9WaCyQAAAUE"]
[Wed Jan 07 20:03:31.175261 2026] [:error] [pid 30720:tid 30728] [client 4.190.193.202:10071] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aV5Lk4dgcpQjqzUi9WaCywAAAUY"]
[Wed Jan 07 20:03:31.430841 2026] [:error] [pid 30632:tid 30639] [client 4.190.193.202:10211] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aV5Lk-d3_LCpBJzo02cAOgAAAAM"]
[Wed Jan 07 20:03:31.677484 2026] [:error] [pid 30632:tid 30659] [client 4.190.193.202:10100] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aV5Lk-d3_LCpBJzo02cAPAAAABc"]
[Wed Jan 07 20:03:31.918014 2026] [:error] [pid 30633:tid 30673] [client 4.190.193.202:10126] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aV5Lk_ZiVWlF7303nMinpgAAAEo"]
[Wed Jan 07 20:03:32.161739 2026] [:error] [pid 51128:tid 51150] [client 4.190.193.202:10202] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "aV5LlEGjtE8U88mrwuedcQAAAZQ"]
[Wed Jan 07 20:03:32.402981 2026] [:error] [pid 30632:tid 30649] [client 4.190.193.202:10185] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aV5LlOd3_LCpBJzo02cAPgAAAA0"]
[Wed Jan 07 20:03:32.642956 2026] [:error] [pid 58330:tid 58348] [client 4.190.193.202:10051] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aV5LlA8kGngKGK7_wnf2ygAAARA"]
[Wed Jan 07 20:03:32.888728 2026] [:error] [pid 58330:tid 58349] [client 4.190.193.202:10108] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aV5LlA8kGngKGK7_wnf2ywAAARE"]
[Wed Jan 07 20:03:33.127489 2026] [:error] [pid 58330:tid 58350] [client 4.190.193.202:10141] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.php"] [unique_id "aV5LlQ8kGngKGK7_wnf2zgAAARI"]
[Wed Jan 07 20:03:33.377133 2026] [:error] [pid 30634:tid 30699] [client 4.190.193.202:10000] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aV5LlYCIPBibObtmZtv_cQAAAMk"]
[Wed Jan 07 20:03:33.618949 2026] [:error] [pid 30634:tid 30707] [client 4.190.193.202:10040] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aV5LlYCIPBibObtmZtv_cwAAANE"]
[Wed Jan 07 20:03:33.859620 2026] [:error] [pid 30634:tid 30709] [client 4.190.193.202:10066] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aV5LlYCIPBibObtmZtv_dAAAANM"]
[Wed Jan 07 20:03:34.101084 2026] [:error] [pid 30720:tid 30726] [client 4.190.193.202:10104] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "aV5LlodgcpQjqzUi9WaC1AAAAUQ"]
[Wed Jan 07 20:03:34.347119 2026] [:error] [pid 30632:tid 30636] [client 4.190.193.202:10068] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV5Llud3_LCpBJzo02cAQAAAAAA"]
[Wed Jan 07 20:03:34.594840 2026] [:error] [pid 30634:tid 30701] [client 4.190.193.202:10228] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV5LloCIPBibObtmZtv_dgAAAMs"]
[Wed Jan 07 20:03:34.835349 2026] [:error] [pid 30634:tid 30697] [client 4.190.193.202:10057] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV5LloCIPBibObtmZtv_eAAAAMc"]
[Wed Jan 07 20:03:35.076314 2026] [:error] [pid 30634:tid 30706] [client 4.190.193.202:9989] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV5Ll4CIPBibObtmZtv_egAAANA"]
[Wed Jan 07 20:03:35.325705 2026] [:error] [pid 30720:tid 30743] [client 4.190.193.202:10223] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5Ll4dgcpQjqzUi9WaC2AAAAVU"]
[Wed Jan 07 20:03:35.566516 2026] [:error] [pid 30720:tid 30736] [client 4.190.193.202:10224] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5Ll4dgcpQjqzUi9WaC2QAAAU4"]
[Wed Jan 07 20:03:35.807418 2026] [:error] [pid 30632:tid 30651] [client 4.190.193.202:10090] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5Ll-d3_LCpBJzo02cAQgAAAA8"]
[Wed Jan 07 20:03:36.051324 2026] [:error] [pid 30634:tid 30690] [client 4.190.193.202:10095] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV5LmICIPBibObtmZtv_fwAAAMA"]
[Wed Jan 07 20:03:36.301253 2026] [:error] [pid 58330:tid 58345] [client 4.190.193.202:10024] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aV5LmA8kGngKGK7_wnf2zwAAAQ0"]
[Wed Jan 07 20:03:36.543748 2026] [:error] [pid 51128:tid 51148] [client 4.190.193.202:10098] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aV5LmEGjtE8U88mrwueddAAAAZI"]
[Wed Jan 07 20:03:36.783489 2026] [:error] [pid 30632:tid 30658] [client 4.190.193.202:10097] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aV5LmOd3_LCpBJzo02cAQwAAABY"]
[Wed Jan 07 20:03:37.033930 2026] [:error] [pid 58294:tid 58301] [client 4.190.193.202:10078] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aV5LmVfzA7c0ITpf3nEf2gAAAIU"]
[Wed Jan 07 20:03:37.274318 2026] [:error] [pid 51128:tid 51130] [client 4.190.193.202:10158] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5LmUGjtE8U88mrwueddQAAAYA"]
[Wed Jan 07 20:03:37.514651 2026] [:error] [pid 30632:tid 30641] [client 4.190.193.202:10143] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5Lmed3_LCpBJzo02cARAAAAAU"]
[Wed Jan 07 20:03:37.754740 2026] [:error] [pid 30720:tid 30745] [client 4.190.193.202:10142] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5LmYdgcpQjqzUi9WaC3QAAAVc"]
[Wed Jan 07 20:03:37.997782 2026] [:error] [pid 30633:tid 30686] [client 4.190.193.202:22476] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aV5LmfZiVWlF7303nMinrAAAAFc"]
[Wed Jan 07 20:03:38.239885 2026] [:error] [pid 51128:tid 51149] [client 4.190.193.202:10062] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aV5LmkGjtE8U88mrwueddgAAAZM"]
[Wed Jan 07 20:03:38.485475 2026] [:error] [pid 30720:tid 30735] [client 4.190.193.202:10003] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aV5LmodgcpQjqzUi9WaC4QAAAU0"]
[Wed Jan 07 20:03:38.742089 2026] [:error] [pid 30720:tid 30732] [client 4.190.193.202:10136] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aV5LmodgcpQjqzUi9WaC4gAAAUo"]
[Wed Jan 07 20:03:38.987903 2026] [:error] [pid 58330:tid 58342] [client 4.190.193.202:10148] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "aV5Lmg8kGngKGK7_wnf20QAAAQo"]
[Wed Jan 07 20:03:39.231806 2026] [:error] [pid 30633:tid 30676] [client 4.190.193.202:10020] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aV5Lm_ZiVWlF7303nMinrgAAAE0"]
[Wed Jan 07 20:03:39.472687 2026] [:error] [pid 30634:tid 30699] [client 4.190.193.202:10103] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aV5Lm4CIPBibObtmZtv_gQAAAMk"]
[Wed Jan 07 20:03:39.722643 2026] [:error] [pid 30633:tid 30684] [client 4.190.193.202:10058] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aV5Lm_ZiVWlF7303nMinsQAAAFU"]
[Wed Jan 07 20:03:39.963868 2026] [:error] [pid 58330:tid 58332] [client 4.190.193.202:10076] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aV5Lmw8kGngKGK7_wnf20wAAAQA"]
[Wed Jan 07 20:03:40.212691 2026] [:error] [pid 30634:tid 30709] [client 4.190.193.202:9950] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aV5LnICIPBibObtmZtv_ggAAANM"]
[Wed Jan 07 20:03:40.473119 2026] [:error] [pid 30634:tid 30701] [client 4.190.193.202:10109] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aV5LnICIPBibObtmZtv_gwAAAMs"]
[Wed Jan 07 20:03:40.713335 2026] [:error] [pid 58294:tid 58319] [client 4.190.193.202:9923] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aV5LnFfzA7c0ITpf3nEf2wAAAJc"]
[Wed Jan 07 20:03:40.953651 2026] [:error] [pid 58294:tid 58308] [client 4.190.193.202:10102] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aV5LnFfzA7c0ITpf3nEf3AAAAIw"]
[Wed Jan 07 20:03:41.193416 2026] [:error] [pid 58294:tid 58312] [client 4.190.193.202:9966] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aV5LnVfzA7c0ITpf3nEf3gAAAJA"]
[Wed Jan 07 20:03:41.434887 2026] [:error] [pid 30632:tid 30639] [client 4.190.193.202:10032] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aV5Lned3_LCpBJzo02cASQAAAAM"]
[Wed Jan 07 20:03:41.702513 2026] [:error] [pid 30632:tid 30659] [client 4.190.193.202:9998] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aV5Lned3_LCpBJzo02cASgAAABc"]
[Wed Jan 07 20:03:41.944113 2026] [:error] [pid 58330:tid 58351] [client 4.190.193.202:10009] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aV5LnQ8kGngKGK7_wnf21QAAARM"]
[Wed Jan 07 20:03:42.186227 2026] [:error] [pid 30720:tid 30723] [client 4.190.193.202:9997] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aV5LnodgcpQjqzUi9WaC5AAAAUE"]
[Wed Jan 07 20:03:42.427193 2026] [:error] [pid 58330:tid 58339] [client 4.190.193.202:10132] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aV5Lng8kGngKGK7_wnf21gAAAQc"]
[Wed Jan 07 20:03:42.671478 2026] [:error] [pid 30632:tid 30648] [client 4.190.193.202:10096] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aV5Lnud3_LCpBJzo02cATAAAAAw"]
[Wed Jan 07 20:03:42.912014 2026] [:error] [pid 30633:tid 30663] [client 4.190.193.202:9986] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aV5LnvZiVWlF7303nMintAAAAEA"]
[Wed Jan 07 20:03:43.153687 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:10218] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV5Ln_ZiVWlF7303nMintQAAAEU"]
[Wed Jan 07 20:03:43.394301 2026] [:error] [pid 30632:tid 30649] [client 4.190.193.202:10167] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV5Ln-d3_LCpBJzo02cATQAAAA0"]
[Wed Jan 07 20:03:43.637163 2026] [:error] [pid 30633:tid 30665] [client 4.190.193.202:9984] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV5Ln_ZiVWlF7303nMintwAAAEI"]
[Wed Jan 07 20:03:43.878894 2026] [:error] [pid 58330:tid 58349] [client 4.190.193.202:10031] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV5Lnw8kGngKGK7_wnf22AAAARE"]
[Wed Jan 07 20:03:44.118502 2026] [:error] [pid 30632:tid 30636] [client 4.190.193.202:10056] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aV5LoOd3_LCpBJzo02cATwAAAAA"]
[Wed Jan 07 20:03:44.358541 2026] [:error] [pid 30720:tid 30738] [client 4.190.193.202:9999] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aV5LoIdgcpQjqzUi9WaC5wAAAVA"]
[Wed Jan 07 20:03:44.613643 2026] [:error] [pid 30720:tid 30733] [client 4.190.193.202:10101] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aV5LoIdgcpQjqzUi9WaC6AAAAUs"]
[Wed Jan 07 20:03:44.853647 2026] [:error] [pid 30720:tid 30742] [client 4.190.193.202:10048] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aV5LoIdgcpQjqzUi9WaC6gAAAVQ"]
[Wed Jan 07 20:03:45.093420 2026] [:error] [pid 30632:tid 30643] [client 4.190.193.202:10082] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV5Loed3_LCpBJzo02cAUgAAAAc"]
[Wed Jan 07 20:03:45.333025 2026] [:error] [pid 58330:tid 58338] [client 4.190.193.202:10094] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV5LoQ8kGngKGK7_wnf22wAAAQY"]
[Wed Jan 07 20:03:45.571891 2026] [:error] [pid 30634:tid 30696] [client 4.190.193.202:10168] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV5LoYCIPBibObtmZtv_hgAAAMY"]
[Wed Jan 07 20:03:45.812685 2026] [:error] [pid 30634:tid 30695] [client 4.190.193.202:10075] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV5LoYCIPBibObtmZtv_hwAAAMU"]
[Wed Jan 07 20:03:46.052870 2026] [:error] [pid 51128:tid 51141] [client 4.190.193.202:22465] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aV5LokGjtE8U88mrwuedeAAAAYs"]
[Wed Jan 07 20:03:46.303083 2026] [:error] [pid 30634:tid 30713] [client 4.190.193.202:10007] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aV5LooCIPBibObtmZtv_iAAAANc"]
[Wed Jan 07 20:03:46.543036 2026] [:error] [pid 30632:tid 30658] [client 4.190.193.202:10060] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aV5Loud3_LCpBJzo02cAUwAAABY"]
[Wed Jan 07 20:03:46.792281 2026] [:error] [pid 30633:tid 30666] [client 4.190.193.202:10106] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aV5LovZiVWlF7303nMinvQAAAEM"]
[Wed Jan 07 20:03:47.031605 2026] [:error] [pid 30632:tid 30645] [client 4.190.193.202:9936] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aV5Lo-d3_LCpBJzo02cAVQAAAAk"]
[Wed Jan 07 20:03:47.273093 2026] [:error] [pid 30634:tid 30692] [client 4.190.193.202:9992] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aV5Lo4CIPBibObtmZtv_igAAAMI"]
[Wed Jan 07 20:03:47.512759 2026] [:error] [pid 30720:tid 30735] [client 4.190.193.202:9995] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aV5Lo4dgcpQjqzUi9WaC7QAAAU0"]
[Wed Jan 07 20:03:47.795437 2026] [:error] [pid 30633:tid 30672] [client 4.190.193.202:9873] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/go.php"] [unique_id "aV5Lo_ZiVWlF7303nMinvwAAAEk"]
[Wed Jan 07 20:03:48.036501 2026] [:error] [pid 58294:tid 58299] [client 4.190.193.202:10083] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV5LpFfzA7c0ITpf3nEf4QAAAIM"]
[Wed Jan 07 20:03:48.276497 2026] [:error] [pid 58294:tid 58317] [client 4.190.193.202:9959] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV5LpFfzA7c0ITpf3nEf4wAAAJU"]
[Wed Jan 07 20:03:48.516005 2026] [:error] [pid 30634:tid 30690] [client 4.190.193.202:10016] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV5LpICIPBibObtmZtv_iwAAAMA"]
[Wed Jan 07 20:03:48.757633 2026] [:error] [pid 30720:tid 30724] [client 4.190.193.202:9933] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV5LpIdgcpQjqzUi9WaC7gAAAUI"]
[Wed Jan 07 20:03:48.997908 2026] [:error] [pid 30633:tid 30673] [client 4.190.193.202:10088] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aV5LpPZiVWlF7303nMinwgAAAEo"]
[Wed Jan 07 20:03:49.240234 2026] [:error] [pid 58294:tid 58314] [client 4.190.193.202:10036] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aV5LpVfzA7c0ITpf3nEf5QAAAJI"]
[Wed Jan 07 20:03:49.479397 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:10176] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aV5LpfZiVWlF7303nMinwwAAAEU"]
[Wed Jan 07 20:03:49.719961 2026] [:error] [pid 30632:tid 30653] [client 4.190.193.202:10045] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aV5Lped3_LCpBJzo02cAWQAAABE"]
[Wed Jan 07 20:03:49.964282 2026] [:error] [pid 58330:tid 58345] [client 4.190.193.202:10027] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aV5LpQ8kGngKGK7_wnf23gAAAQ0"]
[Wed Jan 07 20:03:50.205461 2026] [:error] [pid 30632:tid 30639] [client 4.190.193.202:10046] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aV5Lpud3_LCpBJzo02cAWgAAAAM"]
[Wed Jan 07 20:03:50.453483 2026] [:error] [pid 30634:tid 30694] [client 4.190.193.202:10079] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aV5LpoCIPBibObtmZtv_jQAAAMQ"]
[Wed Jan 07 20:03:50.701204 2026] [:error] [pid 30633:tid 30681] [client 4.190.193.202:9965] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aV5LpvZiVWlF7303nMinxAAAAFI"]
[Wed Jan 07 20:03:50.941521 2026] [:error] [pid 30633:tid 30683] [client 4.190.193.202:10043] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aV5LpvZiVWlF7303nMinxQAAAFQ"]
[Wed Jan 07 20:03:51.183513 2026] [:error] [pid 30634:tid 30699] [client 4.190.193.202:22407] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aV5Lp4CIPBibObtmZtv_jwAAAMk"]
[Wed Jan 07 20:03:51.475824 2026] [:error] [pid 30634:tid 30707] [client 4.190.193.202:10093] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aV5Lp4CIPBibObtmZtv_kAAAANE"]
[Wed Jan 07 20:03:51.716877 2026] [:error] [pid 30633:tid 30687] [client 4.190.193.202:9996] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aV5Lp_ZiVWlF7303nMinxwAAAFg"]
[Wed Jan 07 20:03:51.962331 2026] [:error] [pid 30633:tid 30669] [client 4.190.193.202:10099] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aV5Lp_ZiVWlF7303nMinyQAAAEY"]
[Wed Jan 07 20:03:52.212116 2026] [:error] [pid 58294:tid 58315] [client 4.190.193.202:10022] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aV5LqFfzA7c0ITpf3nEf5wAAAJM"]
[Wed Jan 07 20:03:52.479608 2026] [:error] [pid 30720:tid 30727] [client 4.190.193.202:9803] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aV5LqIdgcpQjqzUi9WaC8gAAAUU"]
[Wed Jan 07 20:03:52.729717 2026] [:error] [pid 58294:tid 58308] [client 4.190.193.202:9978] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asas.php"] [unique_id "aV5LqFfzA7c0ITpf3nEf6gAAAIw"]
[Wed Jan 07 20:03:52.969684 2026] [:error] [pid 30634:tid 30709] [client 4.190.193.202:9929] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV5LqICIPBibObtmZtv_kQAAANM"]
[Wed Jan 07 20:03:53.210841 2026] [:error] [pid 30632:tid 30657] [client 4.190.193.202:10038] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV5Lqed3_LCpBJzo02cAXgAAABU"]
[Wed Jan 07 20:03:53.461624 2026] [:error] [pid 30633:tid 30684] [client 4.190.193.202:10041] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV5LqfZiVWlF7303nMinzAAAAFU"]
[Wed Jan 07 20:03:53.707216 2026] [:error] [pid 30632:tid 30637] [client 4.190.193.202:9954] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV5Lqed3_LCpBJzo02cAYQAAAAE"]
[Wed Jan 07 20:03:53.957835 2026] [:error] [pid 30633:tid 30677] [client 4.190.193.202:9889] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV5LqfZiVWlF7303nMinzQAAAE4"]
[Wed Jan 07 20:03:54.198671 2026] [:error] [pid 30632:tid 30640] [client 4.190.193.202:10092] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV5Lqud3_LCpBJzo02cAYwAAAAQ"]
[Wed Jan 07 20:03:54.438202 2026] [:error] [pid 30720:tid 30725] [client 4.190.193.202:10025] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV5LqodgcpQjqzUi9WaC9AAAAUM"]
[Wed Jan 07 20:03:54.804048 2026] [:error] [pid 30632:tid 30641] [client 4.190.193.202:10061] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV5Lqud3_LCpBJzo02cAZQAAAAU"]
[Wed Jan 07 20:03:55.053770 2026] [:error] [pid 58330:tid 58334] [client 4.190.193.202:10015] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aV5Lqw8kGngKGK7_wnf25AAAAQI"]
[Wed Jan 07 20:03:55.301258 2026] [:error] [pid 51128:tid 51139] [client 4.190.193.202:9951] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aV5Lq0GjtE8U88mrwuedeQAAAYk"]
[Wed Jan 07 20:03:55.554653 2026] [:error] [pid 30632:tid 30652] [client 4.190.193.202:9878] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aV5Lq-d3_LCpBJzo02cAaAAAABA"]
[Wed Jan 07 20:03:55.800566 2026] [:error] [pid 58294:tid 58311] [client 4.190.193.202:9934] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aV5Lq1fzA7c0ITpf3nEf7gAAAI8"]
[Wed Jan 07 20:03:56.078303 2026] [:error] [pid 30632:tid 30655] [client 4.190.193.202:9957] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aV5LrOd3_LCpBJzo02cAaQAAABM"]
[Wed Jan 07 20:03:56.377022 2026] [:error] [pid 30633:tid 30673] [client 4.190.193.202:10077] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aV5LrPZiVWlF7303nMin0gAAAEo"]
[Wed Jan 07 20:03:56.621210 2026] [:error] [pid 51128:tid 51132] [client 4.190.193.202:9935] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aV5LrEGjtE8U88mrwuedegAAAYI"]
[Wed Jan 07 20:03:56.903180 2026] [:error] [pid 30632:tid 30648] [client 4.190.193.202:10049] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxl.php"] [unique_id "aV5LrOd3_LCpBJzo02cAbQAAAAw"]
[Wed Jan 07 20:03:57.239731 2026] [:error] [pid 51128:tid 51134] [client 4.190.193.202:9991] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aV5LrUGjtE8U88mrwuedfAAAAYQ"]
[Wed Jan 07 20:03:57.565623 2026] [:error] [pid 51128:tid 51135] [client 4.190.193.202:9967] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aV5LrUGjtE8U88mrwuedfQAAAYU"]
[Wed Jan 07 20:03:57.915048 2026] [:error] [pid 30720:tid 30730] [client 4.190.193.202:10144] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aV5LrYdgcpQjqzUi9WaC9gAAAUg"]
[Wed Jan 07 20:03:58.233102 2026] [:error] [pid 30633:tid 30675] [client 4.190.193.202:9993] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aV5LrvZiVWlF7303nMin1wAAAEw"]
[Wed Jan 07 20:03:58.564452 2026] [:error] [pid 30633:tid 30682] [client 4.190.193.202:10110] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV5LrvZiVWlF7303nMin2AAAAFM"]
[Wed Jan 07 20:03:58.871205 2026] [:error] [pid 30632:tid 30646] [client 4.190.193.202:10044] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV5Lrud3_LCpBJzo02cAcAAAAAo"]
[Wed Jan 07 20:03:59.173181 2026] [:error] [pid 30720:tid 30742] [client 4.190.193.202:10026] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV5Lr4dgcpQjqzUi9WaC-AAAAVQ"]
[Wed Jan 07 20:03:59.505044 2026] [:error] [pid 58330:tid 58351] [client 4.190.193.202:10028] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV5Lrw8kGngKGK7_wnf25QAAARM"]
[Wed Jan 07 20:03:59.844498 2026] [:error] [pid 30633:tid 30677] [client 4.190.193.202:10107] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aV5Lr_ZiVWlF7303nMin2QAAAE4"]
[Wed Jan 07 20:04:00.170948 2026] [:error] [pid 30633:tid 30666] [client 4.190.193.202:9994] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aV5LsPZiVWlF7303nMin2gAAAEM"]
[Wed Jan 07 20:04:00.457924 2026] [:error] [pid 30720:tid 30726] [client 4.190.193.202:10063] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aV5LsIdgcpQjqzUi9WaC-wAAAUQ"]
[Wed Jan 07 20:04:00.773284 2026] [:error] [pid 30633:tid 30679] [client 4.190.193.202:9921] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aV5LsPZiVWlF7303nMin3QAAAFA"]
[Wed Jan 07 20:04:01.088396 2026] [:error] [pid 30634:tid 30697] [client 4.190.193.202:10011] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aV5LsYCIPBibObtmZtv_kwAAAMc"]
[Wed Jan 07 20:04:01.422273 2026] [:error] [pid 51128:tid 51151] [client 4.190.193.202:9930] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aV5LsUGjtE8U88mrwuedgAAAAZU"]
[Wed Jan 07 20:04:01.740269 2026] [:error] [pid 30633:tid 30678] [client 4.190.193.202:10081] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aV5LsfZiVWlF7303nMin3wAAAE8"]
[Wed Jan 07 20:04:02.075060 2026] [:error] [pid 30720:tid 30724] [client 4.190.193.202:10017] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aV5LsodgcpQjqzUi9WaC_QAAAUI"]
[Wed Jan 07 20:04:02.404205 2026] [:error] [pid 58294:tid 58304] [client 4.190.193.202:9948] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aV5LslfzA7c0ITpf3nEf8QAAAIg"]
[Wed Jan 07 20:04:02.727368 2026] [:error] [pid 51128:tid 51153] [client 4.190.193.202:22483] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aV5LskGjtE8U88mrwuedggAAAZc"]
[Wed Jan 07 20:04:03.062744 2026] [:error] [pid 30634:tid 30711] [client 4.190.193.202:10149] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aV5Ls4CIPBibObtmZtv_lgAAANU"]
[Wed Jan 07 20:04:03.363040 2026] [:error] [pid 30720:tid 30743] [client 4.190.193.202:9939] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aV5Ls4dgcpQjqzUi9WaC_wAAAVU"]
[Wed Jan 07 20:04:03.653462 2026] [:error] [pid 58330:tid 58349] [client 4.190.193.202:9937] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aV5Lsw8kGngKGK7_wnf25wAAARE"]
[Wed Jan 07 20:04:03.970042 2026] [:error] [pid 30634:tid 30696] [client 4.190.193.202:9894] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aV5Ls4CIPBibObtmZtv_lwAAAMY"]
[Wed Jan 07 20:04:04.310647 2026] [:error] [pid 30633:tid 30680] [client 4.190.193.202:10014] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aV5LtPZiVWlF7303nMin4AAAAFE"]
[Wed Jan 07 20:04:04.635098 2026] [:error] [pid 58330:tid 58350] [client 4.190.193.202:10001] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "aV5LtA8kGngKGK7_wnf26QAAARI"]
[Wed Jan 07 20:04:04.944717 2026] [:error] [pid 51128:tid 51148] [client 4.190.193.202:9955] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aV5LtEGjtE8U88mrwuedhQAAAZI"]
[Wed Jan 07 20:04:05.276005 2026] [:error] [pid 30720:tid 30722] [client 4.190.193.202:9928] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aV5LtYdgcpQjqzUi9WaDAAAAAUA"]
[Wed Jan 07 20:04:05.607389 2026] [:error] [pid 30633:tid 30673] [client 4.190.193.202:10155] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aV5LtfZiVWlF7303nMin4QAAAEo"]
[Wed Jan 07 20:04:05.907206 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:9940] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/321.php"] [unique_id "aV5LtfZiVWlF7303nMin4gAAAEU"]
[Wed Jan 07 20:04:06.219800 2026] [:error] [pid 51128:tid 51149] [client 4.190.193.202:10089] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV5LtkGjtE8U88mrwuedhwAAAZM"]
[Wed Jan 07 20:04:06.541367 2026] [:error] [pid 30720:tid 30739] [client 4.190.193.202:9943] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV5LtodgcpQjqzUi9WaDAgAAAVE"]
[Wed Jan 07 20:04:06.847691 2026] [:error] [pid 58294:tid 58309] [client 4.190.193.202:9946] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV5LtlfzA7c0ITpf3nEf9QAAAI0"]
[Wed Jan 07 20:04:07.170196 2026] [:error] [pid 30633:tid 30683] [client 4.190.193.202:9932] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV5Lt_ZiVWlF7303nMin4wAAAFQ"]
[Wed Jan 07 20:04:08.491967 2026] [:error] [pid 51128:tid 51141] [client 4.190.193.202:9963] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV5LuEGjtE8U88mrwuediQAAAYs"]
[Wed Jan 07 20:04:08.797117 2026] [:error] [pid 30720:tid 30738] [client 4.190.193.202:9956] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV5LuIdgcpQjqzUi9WaDBAAAAVA"]
[Wed Jan 07 20:04:09.080479 2026] [:error] [pid 30720:tid 30746] [client 4.190.193.202:10153] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV5LuYdgcpQjqzUi9WaDBgAAAVg"]
[Wed Jan 07 20:04:09.359849 2026] [:error] [pid 51128:tid 51139] [client 4.190.193.202:9962] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV5LuUGjtE8U88mrwuediwAAAYk"]
[Wed Jan 07 20:04:09.642117 2026] [:error] [pid 30633:tid 30666] [client 4.190.193.202:10021] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aV5LufZiVWlF7303nMin6AAAAEM"]
[Wed Jan 07 20:04:09.974891 2026] [:error] [pid 30720:tid 30740] [client 4.190.193.202:22482] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aV5LuYdgcpQjqzUi9WaDCQAAAVI"]
[Wed Jan 07 20:04:10.302138 2026] [:error] [pid 30634:tid 30713] [client 4.190.193.202:9931] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aV5LuoCIPBibObtmZtv_mQAAANc"]
[Wed Jan 07 20:04:10.612141 2026] [:error] [pid 30634:tid 30693] [client 4.190.193.202:9976] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/al.php"] [unique_id "aV5LuoCIPBibObtmZtv_mgAAAMM"]
[Wed Jan 07 20:04:10.932547 2026] [:error] [pid 30633:tid 30676] [client 4.190.193.202:10005] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV5LuvZiVWlF7303nMin6QAAAE0"]
[Wed Jan 07 20:04:11.258500 2026] [:error] [pid 51128:tid 51134] [client 4.190.193.202:9909] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV5Lu0GjtE8U88mrwuedjQAAAYQ"]
[Wed Jan 07 20:04:11.565138 2026] [:error] [pid 30632:tid 30643] [client 4.190.193.202:10033] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV5Lu-d3_LCpBJzo02cAfwAAAAc"]
[Wed Jan 07 20:04:11.877490 2026] [:error] [pid 58294:tid 58315] [client 4.190.193.202:10029] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV5Lu1fzA7c0ITpf3nEf-AAAAJM"]
[Wed Jan 07 20:04:12.166590 2026] [:error] [pid 58294:tid 58313] [client 4.190.193.202:9796] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aV5LvFfzA7c0ITpf3nEf-QAAAJE"]
[Wed Jan 07 20:04:12.475984 2026] [:error] [pid 30632:tid 30648] [client 4.190.193.202:9891] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aV5LvOd3_LCpBJzo02cAgwAAAAw"]
[Wed Jan 07 20:04:12.781070 2026] [:error] [pid 58330:tid 58335] [client 4.190.193.202:9977] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aV5LvA8kGngKGK7_wnf27QAAAQM"]
[Wed Jan 07 20:04:13.073739 2026] [:error] [pid 58330:tid 58342] [client 4.190.193.202:9896] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aV5LvQ8kGngKGK7_wnf27gAAAQo"]
[Wed Jan 07 20:04:13.354721 2026] [:error] [pid 30633:tid 30674] [client 4.190.193.202:9863] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aV5LvfZiVWlF7303nMin7AAAAEs"]
[Wed Jan 07 20:04:13.663096 2026] [:error] [pid 58294:tid 58297] [client 4.190.193.202:9960] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aV5LvVfzA7c0ITpf3nEf-wAAAIE"]
[Wed Jan 07 20:04:13.956503 2026] [:error] [pid 30720:tid 30745] [client 4.190.193.202:9868] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aV5LvYdgcpQjqzUi9WaDCgAAAVc"]
[Wed Jan 07 20:04:14.230483 2026] [:error] [pid 30632:tid 30638] [client 4.190.193.202:22450] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aV5Lvud3_LCpBJzo02cAhgAAAAI"]
[Wed Jan 07 20:04:14.518158 2026] [:error] [pid 30632:tid 30659] [client 4.190.193.202:9904] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV5Lvud3_LCpBJzo02cAhwAAABc"]
[Wed Jan 07 20:04:14.810198 2026] [:error] [pid 30633:tid 30679] [client 4.190.193.202:9925] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV5LvvZiVWlF7303nMin7QAAAFA"]
[Wed Jan 07 20:04:15.090079 2026] [:error] [pid 30634:tid 30691] [client 4.190.193.202:9964] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV5Lv4CIPBibObtmZtv_ngAAAME"]
[Wed Jan 07 20:04:15.383464 2026] [:error] [pid 51128:tid 51151] [client 4.190.193.202:10030] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV5Lv0GjtE8U88mrwuedjwAAAZU"]
[Wed Jan 07 20:04:15.653157 2026] [:error] [pid 58294:tid 58319] [client 4.190.193.202:10006] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aV5Lv1fzA7c0ITpf3nEf_QAAAJc"]
[Wed Jan 07 20:04:15.927265 2026] [:error] [pid 58294:tid 58296] [client 4.190.193.202:10035] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aV5Lv1fzA7c0ITpf3nEf_wAAAIA"]
[Wed Jan 07 20:04:16.197116 2026] [:error] [pid 30632:tid 30654] [client 4.190.193.202:9947] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aV5LwOd3_LCpBJzo02cAigAAABI"]
[Wed Jan 07 20:04:16.466411 2026] [:error] [pid 30632:tid 30644] [client 4.190.193.202:9797] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aV5LwOd3_LCpBJzo02cAiwAAAAg"]
[Wed Jan 07 20:04:16.729338 2026] [:error] [pid 30720:tid 30744] [client 4.190.193.202:10018] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV5LwIdgcpQjqzUi9WaDDAAAAVY"]
[Wed Jan 07 20:04:16.993455 2026] [:error] [pid 30720:tid 30743] [client 4.190.193.202:9953] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV5LwIdgcpQjqzUi9WaDDQAAAVU"]
[Wed Jan 07 20:04:17.264552 2026] [:error] [pid 30633:tid 30668] [client 4.190.193.202:10039] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV5LwfZiVWlF7303nMin8AAAAEU"]
[Wed Jan 07 20:04:17.553717 2026] [:error] [pid 30632:tid 30640] [client 4.190.193.202:9958] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV5Lwed3_LCpBJzo02cAjwAAAAQ"]
[Wed Jan 07 20:04:17.829450 2026] [:error] [pid 30634:tid 30710] [client 4.190.193.202:9866] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aV5LwYCIPBibObtmZtv_nwAAANQ"]
[Wed Jan 07 20:04:18.085453 2026] [:error] [pid 30720:tid 30722] [client 4.190.193.202:10164] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aV5LwodgcpQjqzUi9WaDEAAAAUA"]
[Wed Jan 07 20:04:18.327437 2026] [:error] [pid 30632:tid 30637] [client 4.190.193.202:10105] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aV5Lwud3_LCpBJzo02cAkgAAAAE"]
[Wed Jan 07 20:04:18.576409 2026] [:error] [pid 30632:tid 30657] [client 4.190.193.202:9952] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aV5Lwud3_LCpBJzo02cAkwAAABU"]
[Wed Jan 07 20:04:18.853188 2026] [:error] [pid 58330:tid 58332] [client 4.190.193.202:9961] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aV5Lwg8kGngKGK7_wnf28gAAAQA"]
[Wed Jan 07 20:04:19.099265 2026] [:error] [pid 30633:tid 30681] [client 4.190.193.202:9969] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aV5Lw_ZiVWlF7303nMin8gAAAFI"]
[Wed Jan 07 20:04:19.345206 2026] [:error] [pid 58330:tid 58351] [client 4.190.193.202:10019] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aV5Lww8kGngKGK7_wnf28wAAARM"]
[Wed Jan 07 20:04:19.587669 2026] [:error] [pid 58294:tid 58309] [client 4.190.193.202:9884] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xo.php"] [unique_id "aV5Lw1fzA7c0ITpf3nEgBQAAAI0"]
[Wed Jan 07 20:04:19.833398 2026] [:error] [pid 58330:tid 58339] [client 4.190.193.202:9927] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aV5Lww8kGngKGK7_wnf29QAAAQc"]
[Wed Jan 07 20:04:20.073986 2026] [:error] [pid 30633:tid 30665] [client 4.190.193.202:9973] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aV5LxPZiVWlF7303nMin9AAAAEI"]
[Wed Jan 07 20:04:20.318716 2026] [:error] [pid 30633:tid 30687] [client 4.190.193.202:9881] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aV5LxPZiVWlF7303nMin9QAAAFg"]
[Wed Jan 07 20:04:20.567937 2026] [:error] [pid 51128:tid 51141] [client 4.190.193.202:9895] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dlu.php"] [unique_id "aV5LxEGjtE8U88mrwuedlgAAAYs"]
[Wed Jan 07 20:04:20.814848 2026] [:error] [pid 30633:tid 30685] [client 4.190.193.202:9987] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aV5LxPZiVWlF7303nMin9gAAAFY"]
[Wed Jan 07 20:04:21.056765 2026] [:error] [pid 30633:tid 30675] [client 4.190.193.202:9794] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aV5LxfZiVWlF7303nMin9wAAAEw"]
[Wed Jan 07 20:04:21.307168 2026] [:error] [pid 30633:tid 30669] [client 4.190.193.202:9826] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aV5LxfZiVWlF7303nMin-AAAAEY"]
[Wed Jan 07 20:04:21.554291 2026] [:error] [pid 30632:tid 30654] [client 4.190.193.202:10013] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rk2.php"] [unique_id "aV5Lxed3_LCpBJzo02cAmQAAABI"]
[Wed Jan 07 20:04:21.820940 2026] [:error] [pid 58330:tid 58350] [client 4.190.193.202:9941] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV5LxQ8kGngKGK7_wnf2-AAAARI"]
[Wed Jan 07 20:04:22.068753 2026] [:error] [pid 30720:tid 30730] [client 4.190.193.202:9860] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV5LxodgcpQjqzUi9WaDFQAAAUg"]
[Wed Jan 07 20:04:22.307529 2026] [:error] [pid 30634:tid 30700] [client 4.190.193.202:10069] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV5LxoCIPBibObtmZtv_oQAAAMo"]
[Wed Jan 07 20:04:22.549212 2026] [:error] [pid 30720:tid 30741] [client 4.190.193.202:9880] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV5LxodgcpQjqzUi9WaDFwAAAVM"]
[Wed Jan 07 20:04:22.811003 2026] [:error] [pid 30634:tid 30701] [client 4.190.193.202:9922] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aV5LxoCIPBibObtmZtv_owAAAMs"]
[Wed Jan 07 20:04:23.052384 2026] [:error] [pid 30632:tid 30636] [client 4.190.193.202:9856] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aV5Lx-d3_LCpBJzo02cAmwAAAAA"]
[Wed Jan 07 20:04:23.293960 2026] [:error] [pid 58294:tid 58297] [client 4.190.193.202:9949] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aV5Lx1fzA7c0ITpf3nEgCwAAAIE"]
[Wed Jan 07 20:04:23.534305 2026] [:error] [pid 30632:tid 30642] [client 4.190.193.202:9901] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aV5Lx-d3_LCpBJzo02cAnQAAAAY"]
[Wed Jan 07 20:04:23.776112 2026] [:error] [pid 58294:tid 58319] [client 4.190.193.202:9942] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aV5Lx1fzA7c0ITpf3nEgDAAAAJc"]
[Wed Jan 07 20:04:24.029385 2026] [:error] [pid 30632:tid 30656] [client 4.190.193.202:9972] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aV5LyOd3_LCpBJzo02cAngAAABQ"]
[Wed Jan 07 20:04:24.279129 2026] [:error] [pid 30632:tid 30637] [client 4.190.193.202:9890] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aV5LyOd3_LCpBJzo02cAnwAAAAE"]
[Wed Jan 07 20:04:24.533278 2026] [:error] [pid 58330:tid 58345] [client 4.190.193.202:10173] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aV5LyA8kGngKGK7_wnf2-gAAAQ0"]
[Wed Jan 07 20:04:24.774275 2026] [:error] [pid 51128:tid 51146] [client 4.190.193.202:9974] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aV5LyEGjtE8U88mrwuednQAAAZA"]
[Wed Jan 07 20:04:25.036132 2026] [:error] [pid 30634:tid 30696] [client 4.190.193.202:9914] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aV5LyYCIPBibObtmZtv_pgAAAMY"]
[Wed Jan 07 20:04:25.293349 2026] [:error] [pid 30633:tid 30684] [client 4.190.193.202:9915] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aV5LyfZiVWlF7303nMin-gAAAFU"]
[Wed Jan 07 20:04:25.552400 2026] [:error] [pid 30632:tid 30651] [client 4.190.193.202:9865] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aV5Lyed3_LCpBJzo02cAoQAAAA8"]
[Wed Jan 07 20:04:25.797674 2026] [:error] [pid 51128:tid 51147] [client 4.190.193.202:9870] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aV5LyUGjtE8U88mrwuedngAAAZE"]
[Wed Jan 07 20:04:26.039879 2026] [:error] [pid 58330:tid 58342] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/406.php
[Wed Jan 07 20:04:26.444437 2026] [:error] [pid 58330:tid 58342] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Wed Jan 07 20:04:26.568064 2026] [:error] [pid 58330:tid 58334] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Jan 07 20:04:26.691073 2026] [:error] [pid 58330:tid 58332] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Jan 07 20:04:26.814926 2026] [:error] [pid 58330:tid 58347] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/zfile.php
[Wed Jan 07 20:04:26.938720 2026] [:error] [pid 58330:tid 58354] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Wed Jan 07 20:04:27.062455 2026] [:error] [pid 58330:tid 58351] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/des.php
[Wed Jan 07 20:04:27.184130 2026] [:error] [pid 58330:tid 58339] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/ant.php
[Wed Jan 07 20:04:27.308116 2026] [:error] [pid 58330:tid 58356] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Wed Jan 07 20:04:27.431747 2026] [:error] [pid 58330:tid 58336] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Jan 07 20:04:27.556256 2026] [:error] [pid 58330:tid 58333] [client 4.190.193.202:9911] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Wed Jan 07 20:04:27.676938 2026] [:error] [pid 58330:tid 58348] [client 4.190.193.202:9911] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aV5Lyw8kGngKGK7_wnf3CQAAARA"]
[Wed Jan 07 20:04:27.922143 2026] [:error] [pid 51128:tid 51144] [client 4.190.193.202:9916] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aV5Ly0GjtE8U88mrwuedoQAAAY4"]
[Wed Jan 07 20:04:28.162832 2026] [:error] [pid 30632:tid 30646] [client 4.190.193.202:9968] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aV5LzOd3_LCpBJzo02cApQAAAAo"]
[Wed Jan 07 20:04:28.402306 2026] [:error] [pid 51128:tid 51148] [client 4.190.193.202:9980] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aV5LzEGjtE8U88mrwuedogAAAZI"]
[Wed Jan 07 20:04:28.662648 2026] [:error] [pid 58330:tid 58349] [client 4.190.193.202:9876] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aV5LzA8kGngKGK7_wnf3CgAAARE"]
[Wed Jan 07 20:04:28.907137 2026] [:error] [pid 58294:tid 58312] [client 4.190.193.202:9920] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aV5LzFfzA7c0ITpf3nEgEAAAAJA"]
[Wed Jan 07 20:04:29.147786 2026] [:error] [pid 58294:tid 58311] [client 4.190.193.202:9877] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aV5LzVfzA7c0ITpf3nEgEQAAAI8"]
[Wed Jan 07 20:04:29.388509 2026] [:error] [pid 30633:tid 30683] [client 4.190.193.202:9811] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpc.php"] [unique_id "aV5LzfZiVWlF7303nMioAwAAAFQ"]
[Wed Jan 07 20:04:29.629089 2026] [:error] [pid 30720:tid 30743] [client 4.190.193.202:10156] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aV5LzYdgcpQjqzUi9WaDHAAAAVU"]
[Wed Jan 07 20:04:29.870974 2026] [:error] [pid 58330:tid 58350] [client 4.190.193.202:9846] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aV5LzQ8kGngKGK7_wnf3DAAAARI"]
[Wed Jan 07 20:04:30.123608 2026] [:error] [pid 30632:tid 30656] [client 4.190.193.202:9728] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aV5Lzud3_LCpBJzo02cAqgAAABQ"]
[Wed Jan 07 20:04:30.375898 2026] [:error] [pid 58330:tid 58355] [client 4.190.193.202:9869] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aV5Lzg8kGngKGK7_wnf3DQAAARc"]
[Wed Jan 07 20:04:30.617423 2026] [:error] [pid 58294:tid 58304] [client 4.190.193.202:9945] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aV5LzlfzA7c0ITpf3nEgEwAAAIg"]
[Wed Jan 07 20:04:30.867469 2026] [:error] [pid 30720:tid 30736] [client 4.190.193.202:9917] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aV5LzodgcpQjqzUi9WaDHQAAAU4"]
[Wed Jan 07 20:04:31.107477 2026] [:error] [pid 30634:tid 30710] [client 4.190.193.202:10037] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aV5Lz4CIPBibObtmZtv_rQAAANQ"]
[Wed Jan 07 20:04:31.353860 2026] [:error] [pid 30720:tid 30722] [client 4.190.193.202:9905] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mlex.php"] [unique_id "aV5Lz4dgcpQjqzUi9WaDHgAAAUA"]
[Wed Jan 07 20:04:31.601498 2026] [:error] [pid 30633:tid 30663] [client 4.190.193.202:10114] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aV5Lz_ZiVWlF7303nMioBAAAAEA"]
[Wed Jan 07 20:04:31.849422 2026] [:error] [pid 30634:tid 30698] [client 4.190.193.202:9853] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aV5Lz4CIPBibObtmZtv_rgAAAMg"]
[Wed Jan 07 20:04:32.090245 2026] [:error] [pid 30634:tid 30699] [client 4.190.193.202:9839] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aV5L0ICIPBibObtmZtv_rwAAAMk"]
[Wed Jan 07 20:04:32.330673 2026] [:error] [pid 30634:tid 30700] [client 4.190.193.202:9979] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aV5L0ICIPBibObtmZtv_sQAAAMo"]
[Wed Jan 07 20:04:32.572199 2026] [:error] [pid 30632:tid 30641] [client 4.190.193.202:9971] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV5L0Od3_LCpBJzo02cArgAAAAU"]
[Wed Jan 07 20:04:32.813358 2026] [:error] [pid 58294:tid 58314] [client 4.190.193.202:9872] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV5L0FfzA7c0ITpf3nEgFwAAAJI"]
[Wed Jan 07 20:04:33.066918 2026] [:error] [pid 30632:tid 30660] [client 4.190.193.202:9938] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV5L0ed3_LCpBJzo02cArwAAABg"]
[Wed Jan 07 20:04:33.310276 2026] [:error] [pid 51128:tid 51135] [client 4.190.193.202:9816] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV5L0UGjtE8U88mrwuedqAAAAYU"]
[Wed Jan 07 20:04:33.558042 2026] [:error] [pid 58330:tid 58345] [client 4.190.193.202:9906] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aV5L0Q8kGngKGK7_wnf3DgAAAQ0"]
[Wed Jan 07 20:04:33.800600 2026] [:error] [pid 30634:tid 30706] [client 4.190.193.202:9834] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aV5L0YCIPBibObtmZtv_tQAAANA"]
[Wed Jan 07 20:04:34.044789 2026] [:error] [pid 30634:tid 30713] [client 4.190.193.202:9842] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aV5L0oCIPBibObtmZtv_tgAAANc"]
[Wed Jan 07 20:04:34.312177 2026] [:error] [pid 58294:tid 58315] [client 4.190.193.202:22452] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mpvloi.php"] [unique_id "aV5L0lfzA7c0ITpf3nEgGAAAAJM"]
[Wed Jan 07 20:04:34.556997 2026] [:error] [pid 30634:tid 30690] [client 4.190.193.202:9810] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aV5L0oCIPBibObtmZtv_uAAAAMA"]
[Wed Jan 07 20:04:34.798335 2026] [:error] [pid 30720:tid 30738] [client 4.190.193.202:10172] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aV5L0odgcpQjqzUi9WaDIAAAAVA"]
[Wed Jan 07 20:04:35.040397 2026] [:error] [pid 58330:tid 58344] [client 4.190.193.202:9903] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aV5L0w8kGngKGK7_wnf3EAAAAQw"]
[Wed Jan 07 20:04:35.281611 2026] [:error] [pid 30720:tid 30737] [client 4.190.193.202:9910] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1.php"] [unique_id "aV5L04dgcpQjqzUi9WaDIQAAAU8"]
[Wed Jan 07 20:04:35.521804 2026] [:error] [pid 51128:tid 51139] [client 4.190.193.202:10023] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aV5L00GjtE8U88mrwuedqgAAAYk"]
[Wed Jan 07 20:04:35.761454 2026] [:error] [pid 58294:tid 58302] [client 4.190.193.202:9897] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aV5L01fzA7c0ITpf3nEgGQAAAIY"]
[Wed Jan 07 20:04:36.010386 2026] [:error] [pid 51128:tid 51134] [client 4.190.193.202:9858] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aV5L1EGjtE8U88mrwuedqwAAAYQ"]
[Wed Jan 07 20:04:36.257489 2026] [:error] [pid 30632:tid 30652] [client 4.190.193.202:9807] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aV5L1Od3_LCpBJzo02cAswAAABA"]
[Wed Jan 07 20:04:36.498197 2026] [:error] [pid 30633:tid 30684] [client 4.190.193.202:9989] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aV5L1PZiVWlF7303nMioBgAAAFU"]
[Wed Jan 07 20:04:36.743218 2026] [:error] [pid 30632:tid 30644] [client 4.190.193.202:9772] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aV5L1Od3_LCpBJzo02cAtAAAAAg"]
[Wed Jan 07 20:04:36.985029 2026] [:error] [pid 30633:tid 30682] [client 4.190.193.202:9871] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aV5L1PZiVWlF7303nMioBwAAAFM"]
[Wed Jan 07 20:04:37.237097 2026] [:error] [pid 30720:tid 30731] [client 4.190.193.202:9812] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "aV5L1YdgcpQjqzUi9WaDIwAAAUk"]
[Wed Jan 07 20:04:37.489250 2026] [:error] [pid 30633:tid 30664] [client 4.190.193.202:9864] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aV5L1fZiVWlF7303nMioCAAAAEE"]
[Wed Jan 07 20:04:37.729186 2026] [:error] [pid 51128:tid 51151] [client 4.190.193.202:9788] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aV5L1UGjtE8U88mrwuedrgAAAZU"]
[Wed Jan 07 20:04:37.969298 2026] [:error] [pid 58330:tid 58354] [client 4.190.193.202:9900] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aV5L1Q8kGngKGK7_wnf3FQAAARY"]
[Wed Jan 07 20:04:38.215467 2026] [:error] [pid 30633:tid 30667] [client 4.190.193.202:9823] [client 4.190.193.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/angelV2.php"] [unique_id "aV5L1vZiVWlF7303nMioDAAAAEQ"]
[Wed Jan 07 20:37:17.064314 2026] [:error] [pid 58330:tid 58347] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Wed Jan 07 20:37:17.200492 2026] [:error] [pid 58330:tid 58346] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Wed Jan 07 20:37:17.410508 2026] [:error] [pid 58330:tid 58338] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Wed Jan 07 20:37:17.501316 2026] [:error] [pid 58330:tid 58349] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Wed Jan 07 20:37:17.595060 2026] [:error] [pid 58330:tid 58351] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/baee.php
[Wed Jan 07 20:37:17.685801 2026] [:error] [pid 58330:tid 58334] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/iov.php
[Wed Jan 07 20:37:17.815933 2026] [:error] [pid 58330:tid 58340] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/mds.php
[Wed Jan 07 20:37:19.219076 2026] [:error] [pid 58330:tid 58340] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/mga.php
[Wed Jan 07 20:37:19.569329 2026] [:error] [pid 58330:tid 58343] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/rendi59.php
[Wed Jan 07 20:37:20.198391 2026] [:error] [pid 58330:tid 58347] [client 4.194.8.37:16585] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Wed Jan 07 20:37:20.300089 2026] [:error] [pid 58330:tid 58346] [client 4.194.8.37:16585] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assacc.php"] [unique_id "aV5TgA8kGngKGK7_wnf92wAAAQ4"]
[Wed Jan 07 20:37:21.325560 2026] [:error] [pid 58294:tid 58305] [client 4.194.8.37:16527] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assacc.php"] [unique_id "aV5TgVfzA7c0ITpf3nElHwAAAIk"]
[Wed Jan 07 20:37:21.934999 2026] [:error] [pid 51128:tid 51134] [client 4.194.8.37:16592] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assacc.php"] [unique_id "aV5TgUGjtE8U88mrwuej_wAAAYQ"]
[Wed Jan 07 20:37:22.759490 2026] [:error] [pid 58330:tid 58356] [client 4.194.8.37:16539] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assacc.php"] [unique_id "aV5Tgg8kGngKGK7_wnf93wAAARg"]
[Wed Jan 07 20:37:23.202667 2026] [:error] [pid 58330:tid 58355] [client 4.194.8.37:16606] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6y7t.php"] [unique_id "aV5Tgw8kGngKGK7_wnf94AAAARc"]
[Wed Jan 07 20:37:23.600981 2026] [:error] [pid 58294:tid 58311] [client 4.194.8.37:16622] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6y7t.php"] [unique_id "aV5Tg1fzA7c0ITpf3nElIgAAAI8"]
[Wed Jan 07 20:37:24.363449 2026] [:error] [pid 58294:tid 58308] [client 4.194.8.37:16595] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6y7t.php"] [unique_id "aV5ThFfzA7c0ITpf3nElIwAAAIw"]
[Wed Jan 07 20:37:24.695178 2026] [:error] [pid 51128:tid 51135] [client 4.194.8.37:16639] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6y7t.php"] [unique_id "aV5ThEGjtE8U88mrwuekBQAAAYU"]
[Wed Jan 07 20:37:25.043624 2026] [:error] [pid 51128:tid 51138] [client 4.194.8.37:16607] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/monso.php"] [unique_id "aV5ThUGjtE8U88mrwuekCgAAAYg"]
[Wed Jan 07 20:37:25.556355 2026] [:error] [pid 51128:tid 51142] [client 4.194.8.37:16635] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/monso.php"] [unique_id "aV5ThUGjtE8U88mrwuekDAAAAYw"]
[Wed Jan 07 20:37:26.086204 2026] [:error] [pid 30633:tid 30681] [client 4.194.8.37:16583] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/monso.php"] [unique_id "aV5ThvZiVWlF7303nMityQAAAFI"]
[Wed Jan 07 20:37:26.452251 2026] [:error] [pid 58330:tid 58347] [client 4.194.8.37:16636] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/monso.php"] [unique_id "aV5Thg8kGngKGK7_wnf95AAAAQ8"]
[Wed Jan 07 20:37:26.750401 2026] [:error] [pid 58330:tid 58345] [client 4.194.8.37:16581] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnnof6.php"] [unique_id "aV5Thg8kGngKGK7_wnf95wAAAQ0"]
[Wed Jan 07 20:37:27.572656 2026] [:error] [pid 30633:tid 30683] [client 4.194.8.37:16577] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnnof6.php"] [unique_id "aV5Th_ZiVWlF7303nMit2AAAAFQ"]
[Wed Jan 07 20:37:27.951301 2026] [:error] [pid 30632:tid 30659] [client 4.194.8.37:16632] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnnof6.php"] [unique_id "aV5Th-d3_LCpBJzo02cJGgAAABc"]
[Wed Jan 07 20:37:28.267403 2026] [:error] [pid 58294:tid 58318] [client 4.194.8.37:16603] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnnof6.php"] [unique_id "aV5TiFfzA7c0ITpf3nElJwAAAJY"]
[Wed Jan 07 20:37:28.535677 2026] [:error] [pid 58330:tid 58349] [client 4.194.8.37:16535] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/str.php"] [unique_id "aV5TiA8kGngKGK7_wnf96gAAARE"]
[Wed Jan 07 20:37:29.102020 2026] [:error] [pid 51128:tid 51146] [client 4.194.8.37:16532] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/str.php"] [unique_id "aV5TiUGjtE8U88mrwuekGAAAAZA"]
[Wed Jan 07 20:37:30.052797 2026] [:error] [pid 58330:tid 58336] [client 4.194.8.37:16584] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/str.php"] [unique_id "aV5Tig8kGngKGK7_wnf98AAAAQQ"]
[Wed Jan 07 20:37:30.972410 2026] [:error] [pid 51128:tid 51137] [client 4.194.8.37:12240] [client 4.194.8.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/str.php"] [unique_id "aV5TikGjtE8U88mrwuekHgAAAYc"]
[Wed Jan 07 21:41:18.722118 2026] [:error] [pid 50905:tid 50911] [client 167.71.90.72:52936] [client 167.71.90.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aV5ifmpNgk5-gt30I7aNyQAAAkQ"], referer: binance.com
[Wed Jan 07 22:16:38.643310 2026] [:error] [pid 30632:tid 30652] [client 182.253.238.235:52134] [client 182.253.238.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.253.238.235, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aV5qxud3_LCpBJzo02cegwAAABA"]
[Wed Jan 07 22:16:38.646851 2026] [:error] [pid 30632:tid 30652] [client 182.253.238.235:52134] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 07 22:16:38.956372 2026] [:error] [pid 30632:tid 30657] [client 182.253.238.235:52134] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aV5qxud3_LCpBJzo02cehAAAABU"]
[Wed Jan 07 22:16:39.587337 2026] [:error] [pid 30634:tid 30691] [client 182.253.238.235:52850] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aV5qx4CIPBibObtmZtsT0gAAAME"]
[Wed Jan 07 22:16:40.212723 2026] [:error] [pid 58330:tid 58348] [client 182.253.238.235:53146] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "aV5qyA8kGngKGK7_wncP_wAAARA"]
[Wed Jan 07 22:16:42.092616 2026] [:error] [pid 30633:tid 30681] [client 182.253.238.235:53446] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "aV5qyvZiVWlF7303nMi_OQAAAFI"]
[Wed Jan 07 22:16:42.736368 2026] [:error] [pid 58330:tid 58332] [client 182.253.238.235:54240] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "aV5qyg8kGngKGK7_wncQDQAAAQA"]
[Wed Jan 07 22:16:43.386809 2026] [:error] [pid 30634:tid 30691] [client 182.253.238.235:54518] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "aV5qy4CIPBibObtmZtsT_AAAAME"]
[Wed Jan 07 22:16:44.033359 2026] [:error] [pid 50838:tid 50850] [client 182.253.238.235:54828] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "aV5qzLSweZ27JIN4H8vXtAAAAco"]
[Wed Jan 07 22:16:44.658722 2026] [:error] [pid 30632:tid 30653] [client 182.253.238.235:55168] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aV5qzOd3_LCpBJzo02ceoQAAABE"]
[Thu Jan 08 00:34:27.014371 2026] [:error] [pid 30633:tid 30680] [client 104.248.243.8:55750] [client 104.248.243.8] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aV6LE_ZiVWlF7303nMjRwQAAAFE"]
[Thu Jan 08 00:44:51.703264 2026] [:error] [pid 50905:tid 50920] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Thu Jan 08 00:44:51.823153 2026] [:error] [pid 50905:tid 50907] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Jan 08 00:44:52.076585 2026] [:error] [pid 50905:tid 50929] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Thu Jan 08 00:44:52.195144 2026] [:error] [pid 50905:tid 50919] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Jan 08 00:44:52.321920 2026] [:error] [pid 50905:tid 50921] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Jan 08 00:44:52.438386 2026] [:error] [pid 50905:tid 50922] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Thu Jan 08 00:44:52.562797 2026] [:error] [pid 50905:tid 50924] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Thu Jan 08 00:44:52.804113 2026] [:error] [pid 50905:tid 50918] [client 4.241.224.33:33556] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Thu Jan 08 00:44:52.920213 2026] [:error] [pid 50905:tid 50915] [client 4.241.224.33:33556] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aV6NhGpNgk5-gt30I7a8iwAAAkg"]
[Thu Jan 08 00:44:53.191028 2026] [:error] [pid 30634:tid 30709] [client 4.241.224.33:33652] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aV6NhYCIPBibObtmZtsq7gAAANM"]
[Thu Jan 08 00:44:53.438333 2026] [:error] [pid 50870:tid 50877] [client 4.241.224.33:33614] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aV6NhRlePfspAt1BzouS9wAAAgU"]
[Thu Jan 08 00:44:53.712540 2026] [:error] [pid 50870:tid 50876] [client 4.241.224.33:33600] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aV6NhRlePfspAt1BzouS-AAAAgQ"]
[Thu Jan 08 00:44:53.964441 2026] [:error] [pid 58294:tid 58301] [client 4.241.224.33:33549] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aV6NhVfzA7c0ITpf3nFUUAAAAIU"]
[Thu Jan 08 00:44:54.198761 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:33564] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aV6NhmpNgk5-gt30I7a8jAAAAkI"]
[Thu Jan 08 00:44:54.436850 2026] [:error] [pid 30634:tid 30691] [client 4.241.224.33:33636] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aV6NhoCIPBibObtmZtsq7wAAAME"]
[Thu Jan 08 00:44:54.678364 2026] [:error] [pid 50870:tid 50875] [client 4.241.224.33:33634] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aV6NhhlePfspAt1BzouS-gAAAgM"]
[Thu Jan 08 00:44:54.950219 2026] [:error] [pid 30634:tid 30711] [client 4.241.224.33:33606] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aV6NhoCIPBibObtmZtsq8AAAANU"]
[Thu Jan 08 00:44:55.183769 2026] [:error] [pid 30632:tid 30647] [client 4.241.224.33:33559] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aV6Nh-d3_LCpBJzo02c0pAAAAAs"]
[Thu Jan 08 00:44:55.450372 2026] [:error] [pid 50905:tid 50912] [client 4.241.224.33:33542] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aV6Nh2pNgk5-gt30I7a8jgAAAkU"]
[Thu Jan 08 00:44:55.688721 2026] [:error] [pid 50905:tid 50908] [client 4.241.224.33:12275] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aV6Nh2pNgk5-gt30I7a8kAAAAkE"]
[Thu Jan 08 00:44:55.935404 2026] [:error] [pid 50905:tid 50919] [client 4.241.224.33:33548] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aV6Nh2pNgk5-gt30I7a8kwAAAkw"]
[Thu Jan 08 00:44:56.164144 2026] [:error] [pid 58294:tid 58312] [client 4.241.224.33:33651] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aV6NiFfzA7c0ITpf3nFUVAAAAJA"]
[Thu Jan 08 00:44:56.395243 2026] [:error] [pid 30633:tid 30677] [client 4.241.224.33:33610] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aV6NiPZiVWlF7303nMjTlQAAAE4"]
[Thu Jan 08 00:44:56.641925 2026] [:error] [pid 30633:tid 30684] [client 4.241.224.33:33612] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aV6NiPZiVWlF7303nMjTlgAAAFU"]
[Thu Jan 08 00:44:56.887460 2026] [:error] [pid 58294:tid 58310] [client 4.241.224.33:33643] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aV6NiFfzA7c0ITpf3nFUVgAAAI4"]
[Thu Jan 08 00:44:57.133944 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:33605] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aV6NiWpNgk5-gt30I7a8mAAAAkI"]
[Thu Jan 08 00:44:57.410391 2026] [:error] [pid 30634:tid 30690] [client 4.241.224.33:33560] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aV6NiYCIPBibObtmZtsq8wAAAMA"]
[Thu Jan 08 00:44:57.647874 2026] [:error] [pid 30633:tid 30667] [client 4.241.224.33:33546] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aV6NifZiVWlF7303nMjTmwAAAEQ"]
[Thu Jan 08 00:44:57.878344 2026] [:error] [pid 30633:tid 30668] [client 4.241.224.33:33646] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aV6NifZiVWlF7303nMjTnAAAAEU"]
[Thu Jan 08 00:44:58.154837 2026] [:error] [pid 50936:tid 50948] [client 4.241.224.33:12242] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aV6NirDlg80QUdd5qc4vawAAAoo"]
[Thu Jan 08 00:44:58.388157 2026] [:error] [pid 58330:tid 58355] [client 4.241.224.33:33632] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aV6Nig8kGngKGK7_wncq9AAAARc"]
[Thu Jan 08 00:44:58.622678 2026] [:error] [pid 58330:tid 58350] [client 4.241.224.33:33551] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aV6Nig8kGngKGK7_wncq9QAAARI"]
[Thu Jan 08 00:44:58.851719 2026] [:error] [pid 30633:tid 30673] [client 4.241.224.33:12257] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aV6NivZiVWlF7303nMjTnwAAAEo"]
[Thu Jan 08 00:44:59.083465 2026] [:error] [pid 50936:tid 50957] [client 4.241.224.33:33625] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aV6Ni7Dlg80QUdd5qc4vbgAAApM"]
[Thu Jan 08 00:44:59.312756 2026] [:error] [pid 50936:tid 50939] [client 4.241.224.33:33588] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aV6Ni7Dlg80QUdd5qc4vbwAAAoE"]
[Thu Jan 08 00:44:59.560445 2026] [:error] [pid 50905:tid 50914] [client 4.241.224.33:33663] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aV6Ni2pNgk5-gt30I7a8oAAAAkc"]
[Thu Jan 08 00:44:59.786306 2026] [:error] [pid 50936:tid 50951] [client 4.241.224.33:33645] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV6Ni7Dlg80QUdd5qc4vcQAAAo0"]
[Thu Jan 08 00:45:00.075574 2026] [:error] [pid 50905:tid 50928] [client 4.241.224.33:33554] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV6NjGpNgk5-gt30I7a8pQAAAlU"]
[Thu Jan 08 00:45:00.376255 2026] [:error] [pid 50936:tid 50946] [client 4.241.224.33:33575] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV6NjLDlg80QUdd5qc4vcwAAAog"]
[Thu Jan 08 00:45:00.606581 2026] [:error] [pid 30634:tid 30710] [client 4.241.224.33:33644] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV6NjICIPBibObtmZtsq9QAAANQ"]
[Thu Jan 08 00:45:00.837734 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:33648] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aV6NjGpNgk5-gt30I7a8qQAAAkI"]
[Thu Jan 08 00:45:01.074219 2026] [:error] [pid 30633:tid 30677] [client 4.241.224.33:33593] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aV6NjfZiVWlF7303nMjTogAAAE4"]
[Thu Jan 08 00:45:01.343415 2026] [:error] [pid 50936:tid 50955] [client 4.241.224.33:33613] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aV6NjbDlg80QUdd5qc4vdQAAApE"]
[Thu Jan 08 00:45:01.570426 2026] [:error] [pid 50905:tid 50920] [client 4.241.224.33:12236] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aV6NjWpNgk5-gt30I7a8qwAAAk0"]
[Thu Jan 08 00:45:01.834623 2026] [:error] [pid 50838:tid 50850] [client 4.241.224.33:33561] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV6NjbSweZ27JIN4H8vo7AAAAco"]
[Thu Jan 08 00:45:02.118172 2026] [:error] [pid 50905:tid 50907] [client 4.241.224.33:33661] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV6NjmpNgk5-gt30I7a8rQAAAkA"]
[Thu Jan 08 00:45:02.379885 2026] [:error] [pid 50870:tid 50880] [client 4.241.224.33:33553] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV6NjhlePfspAt1BzouS_wAAAgg"]
[Thu Jan 08 00:45:02.611796 2026] [:error] [pid 50936:tid 50956] [client 4.241.224.33:12188] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aV6NjrDlg80QUdd5qc4vdwAAApI"]
[Thu Jan 08 00:45:02.842636 2026] [:error] [pid 50936:tid 50940] [client 4.241.224.33:33565] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aV6NjrDlg80QUdd5qc4veAAAAoI"]
[Thu Jan 08 00:45:03.078610 2026] [:error] [pid 58330:tid 58351] [client 4.241.224.33:33655] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aV6Njw8kGngKGK7_wncq9wAAARM"]
[Thu Jan 08 00:45:03.354081 2026] [:error] [pid 58294:tid 58316] [client 4.241.224.33:33660] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aV6Nj1fzA7c0ITpf3nFUVwAAAJQ"]
[Thu Jan 08 00:45:03.585758 2026] [:error] [pid 50905:tid 50922] [client 4.241.224.33:33633] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aV6Nj2pNgk5-gt30I7a8sQAAAk8"]
[Thu Jan 08 00:45:03.837738 2026] [:error] [pid 30633:tid 30674] [client 4.241.224.33:33657] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aV6Nj_ZiVWlF7303nMjTpQAAAEs"]
[Thu Jan 08 00:45:04.066181 2026] [:error] [pid 50936:tid 50961] [client 4.241.224.33:33601] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aV6NkLDlg80QUdd5qc4vewAAApc"]
[Thu Jan 08 00:45:04.306080 2026] [:error] [pid 58330:tid 58348] [client 4.241.224.33:33623] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aV6NkA8kGngKGK7_wncq-gAAARA"]
[Thu Jan 08 00:45:04.554885 2026] [:error] [pid 50936:tid 50948] [client 4.241.224.33:33611] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aV6NkLDlg80QUdd5qc4vfgAAAoo"]
[Thu Jan 08 00:45:04.785317 2026] [:error] [pid 58330:tid 58336] [client 4.241.224.33:33654] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aV6NkA8kGngKGK7_wncq_QAAAQQ"]
[Thu Jan 08 00:45:05.014892 2026] [:error] [pid 50936:tid 50939] [client 4.241.224.33:33635] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aV6NkbDlg80QUdd5qc4vgQAAAoE"]
[Thu Jan 08 00:45:05.250929 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:12195] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aV6NkWpNgk5-gt30I7a8swAAAkI"]
[Thu Jan 08 00:45:05.477174 2026] [:error] [pid 58330:tid 58356] [client 4.241.224.33:33621] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aV6NkQ8kGngKGK7_wncq_wAAARg"]
[Thu Jan 08 00:45:05.780416 2026] [:error] [pid 50936:tid 50952] [client 4.241.224.33:33626] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aV6NkbDlg80QUdd5qc4vhQAAAo4"]
[Thu Jan 08 00:45:06.014171 2026] [:error] [pid 50905:tid 50931] [client 4.241.224.33:33642] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aV6NkmpNgk5-gt30I7a8tQAAAlg"]
[Thu Jan 08 00:45:06.274256 2026] [:error] [pid 58330:tid 58347] [client 4.241.224.33:33537] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aV6Nkg8kGngKGK7_wncrBAAAAQ8"]
[Thu Jan 08 00:45:06.504706 2026] [:error] [pid 50905:tid 50926] [client 4.241.224.33:33570] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aV6NkmpNgk5-gt30I7a8twAAAlM"]
[Thu Jan 08 00:45:06.754963 2026] [:error] [pid 50905:tid 50921] [client 4.241.224.33:12282] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aV6NkmpNgk5-gt30I7a8uQAAAk4"]
[Thu Jan 08 00:45:06.993435 2026] [:error] [pid 58294:tid 58302] [client 4.241.224.33:33583] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aV6NklfzA7c0ITpf3nFUWQAAAIY"]
[Thu Jan 08 00:45:07.253183 2026] [:error] [pid 58330:tid 58353] [client 4.241.224.33:33579] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aV6Nkw8kGngKGK7_wncrBgAAARU"]
[Thu Jan 08 00:45:07.483351 2026] [:error] [pid 51128:tid 51142] [client 4.241.224.33:12238] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aV6Nk0GjtE8U88mrwufGXwAAAYw"]
[Thu Jan 08 00:45:07.714465 2026] [:error] [pid 58330:tid 58348] [client 4.241.224.33:33653] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV6Nkw8kGngKGK7_wncrBwAAARA"]
[Thu Jan 08 00:45:07.947935 2026] [:error] [pid 58330:tid 58337] [client 4.241.224.33:12234] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV6Nkw8kGngKGK7_wncrCAAAAQU"]
[Thu Jan 08 00:45:08.175106 2026] [:error] [pid 50838:tid 50852] [client 4.241.224.33:33541] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV6NlLSweZ27JIN4H8vo7wAAAcw"]
[Thu Jan 08 00:45:08.477451 2026] [:error] [pid 50870:tid 50877] [client 4.241.224.33:12201] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aV6NlBlePfspAt1BzouTAAAAAgU"]
[Thu Jan 08 00:45:08.713968 2026] [:error] [pid 50936:tid 50962] [client 4.241.224.33:12232] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aV6NlLDlg80QUdd5qc4viAAAApg"]
[Thu Jan 08 00:45:08.947937 2026] [:error] [pid 30634:tid 30700] [client 4.241.224.33:33557] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aV6NlICIPBibObtmZtsq9wAAAMo"]
[Thu Jan 08 00:45:09.194813 2026] [:error] [pid 30633:tid 30683] [client 4.241.224.33:33604] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aV6NlfZiVWlF7303nMjTpwAAAFQ"]
[Thu Jan 08 00:45:09.450999 2026] [:error] [pid 58294:tid 58301] [client 4.241.224.33:12239] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aV6NlVfzA7c0ITpf3nFUWgAAAIU"]
[Thu Jan 08 00:45:09.698249 2026] [:error] [pid 50870:tid 50878] [client 4.241.224.33:33555] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aV6NlRlePfspAt1BzouTBAAAAgY"]
[Thu Jan 08 00:45:09.962625 2026] [:error] [pid 50870:tid 50893] [client 4.241.224.33:33539] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aV6NlRlePfspAt1BzouTBQAAAhU"]
[Thu Jan 08 00:45:10.207126 2026] [:error] [pid 51128:tid 51139] [client 4.241.224.33:33599] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aV6NlkGjtE8U88mrwufGZAAAAYk"]
[Thu Jan 08 00:45:10.444323 2026] [:error] [pid 50870:tid 50882] [client 4.241.224.33:33572] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aV6NlhlePfspAt1BzouTBgAAAgo"]
[Thu Jan 08 00:45:10.715836 2026] [:error] [pid 30633:tid 30678] [client 4.241.224.33:33608] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aV6NlvZiVWlF7303nMjTqwAAAE8"]
[Thu Jan 08 00:45:10.976602 2026] [:error] [pid 30634:tid 30713] [client 4.241.224.33:33538] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aV6NloCIPBibObtmZtsq-AAAANc"]
[Thu Jan 08 00:45:11.244747 2026] [:error] [pid 58294:tid 58320] [client 4.241.224.33:12251] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aV6Nl1fzA7c0ITpf3nFUWwAAAJg"]
[Thu Jan 08 00:45:11.491035 2026] [:error] [pid 58330:tid 58335] [client 4.241.224.33:12250] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aV6Nlw8kGngKGK7_wncrDwAAAQM"]
[Thu Jan 08 00:45:11.740414 2026] [:error] [pid 51128:tid 51145] [client 4.241.224.33:33552] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV6Nl0GjtE8U88mrwufGZgAAAY8"]
[Thu Jan 08 00:45:11.999218 2026] [:error] [pid 50838:tid 50858] [client 4.241.224.33:33658] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV6Nl7SweZ27JIN4H8vo8QAAAdI"]
[Thu Jan 08 00:45:12.322699 2026] [:error] [pid 30633:tid 30676] [client 4.241.224.33:33616] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV6NmPZiVWlF7303nMjTrgAAAE0"]
[Thu Jan 08 00:45:12.615570 2026] [:error] [pid 58330:tid 58354] [client 4.241.224.33:33569] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aV6NmA8kGngKGK7_wncrEQAAARY"]
[Thu Jan 08 00:45:12.914636 2026] [:error] [pid 30633:tid 30686] [client 4.241.224.33:33566] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aV6NmPZiVWlF7303nMjTsAAAAFc"]
[Thu Jan 08 00:45:13.156755 2026] [:error] [pid 50838:tid 50845] [client 4.241.224.33:33637] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aV6NmbSweZ27JIN4H8vo8wAAAcU"]
[Thu Jan 08 00:45:13.428375 2026] [:error] [pid 58294:tid 58297] [client 4.241.224.33:33543] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aV6NmVfzA7c0ITpf3nFUXwAAAIE"]
[Thu Jan 08 00:45:13.753194 2026] [:error] [pid 30633:tid 30668] [client 4.241.224.33:33589] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aV6NmfZiVWlF7303nMjTswAAAEU"]
[Thu Jan 08 00:45:14.050704 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:33558] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV6NmmpNgk5-gt30I7a8xAAAAkI"]
[Thu Jan 08 00:45:14.294850 2026] [:error] [pid 50870:tid 50892] [client 4.241.224.33:12237] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV6NmhlePfspAt1BzouTCwAAAhQ"]
[Thu Jan 08 00:45:14.605860 2026] [:error] [pid 30634:tid 30714] [client 4.241.224.33:12281] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV6NmoCIPBibObtmZtsq-gAAANg"]
[Thu Jan 08 00:45:14.886748 2026] [:error] [pid 30633:tid 30682] [client 4.241.224.33:33540] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aV6NmvZiVWlF7303nMjTtQAAAFM"]
[Thu Jan 08 00:45:15.146966 2026] [:error] [pid 58294:tid 58315] [client 4.241.224.33:12243] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV6Nm1fzA7c0ITpf3nFUYgAAAJM"]
[Thu Jan 08 00:45:15.381490 2026] [:error] [pid 50838:tid 50842] [client 4.241.224.33:33578] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV6Nm7SweZ27JIN4H8vo9QAAAcI"]
[Thu Jan 08 00:45:15.648226 2026] [:error] [pid 30633:tid 30683] [client 4.241.224.33:33629] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV6Nm_ZiVWlF7303nMjTuQAAAFQ"]
[Thu Jan 08 00:45:15.912901 2026] [:error] [pid 58330:tid 58349] [client 4.241.224.33:12233] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV6Nmw8kGngKGK7_wncrEwAAARE"]
[Thu Jan 08 00:45:16.271815 2026] [:error] [pid 58294:tid 58317] [client 4.241.224.33:12228] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6NnFfzA7c0ITpf3nFUZAAAAJU"]
[Thu Jan 08 00:45:16.631679 2026] [:error] [pid 50905:tid 50931] [client 4.241.224.33:33584] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6NnGpNgk5-gt30I7a8xwAAAlg"]
[Thu Jan 08 00:45:16.884401 2026] [:error] [pid 51128:tid 51141] [client 4.241.224.33:12230] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6NnEGjtE8U88mrwufGaAAAAYs"]
[Thu Jan 08 00:45:17.170141 2026] [:error] [pid 51128:tid 51153] [client 4.241.224.33:12162] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6NnUGjtE8U88mrwufGaQAAAZc"]
[Thu Jan 08 00:45:17.433713 2026] [:error] [pid 51128:tid 51154] [client 4.241.224.33:33617] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6NnUGjtE8U88mrwufGawAAAZg"]
[Thu Jan 08 00:45:17.696225 2026] [:error] [pid 50936:tid 50956] [client 4.241.224.33:33536] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6NnbDlg80QUdd5qc4v1gAAApI"]
[Thu Jan 08 00:45:17.967394 2026] [:error] [pid 51128:tid 51134] [client 4.241.224.33:33620] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6NnUGjtE8U88mrwufGbQAAAYQ"]
[Thu Jan 08 00:45:18.243685 2026] [:error] [pid 50870:tid 50876] [client 4.241.224.33:12229] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6NnhlePfspAt1BzouTEQAAAgQ"]
[Thu Jan 08 00:45:18.512506 2026] [:error] [pid 58330:tid 58343] [client 4.241.224.33:33624] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aV6Nng8kGngKGK7_wncrFQAAAQs"]
[Thu Jan 08 00:45:18.745180 2026] [:error] [pid 51128:tid 51144] [client 4.241.224.33:33656] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6NnkGjtE8U88mrwufGbgAAAY4"]
[Thu Jan 08 00:45:18.998406 2026] [:error] [pid 50870:tid 50893] [client 4.241.224.33:33649] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6NnhlePfspAt1BzouTEwAAAhU"]
[Thu Jan 08 00:45:19.393200 2026] [:error] [pid 58294:tid 58320] [client 4.241.224.33:33545] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6Nn1fzA7c0ITpf3nFUawAAAJg"]
[Thu Jan 08 00:45:19.787444 2026] [:error] [pid 58294:tid 58297] [client 4.241.224.33:12244] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aV6Nn1fzA7c0ITpf3nFUbQAAAIE"]
[Thu Jan 08 00:45:20.034087 2026] [:error] [pid 51128:tid 51132] [client 4.241.224.33:33581] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV6NoEGjtE8U88mrwufGcwAAAYI"]
[Thu Jan 08 00:45:20.444294 2026] [:error] [pid 50870:tid 50892] [client 4.241.224.33:12199] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV6NoBlePfspAt1BzouTFQAAAhQ"]
[Thu Jan 08 00:45:21.093517 2026] [:error] [pid 58294:tid 58318] [client 4.241.224.33:33568] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV6NoVfzA7c0ITpf3nFUcAAAAJY"]
[Thu Jan 08 00:45:21.436186 2026] [:error] [pid 30634:tid 30706] [client 4.241.224.33:12245] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aV6NoYCIPBibObtmZtsq_AAAANA"]
[Thu Jan 08 00:45:22.097071 2026] [:error] [pid 58330:tid 58345] [client 4.241.224.33:12235] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6Nog8kGngKGK7_wncrFwAAAQ0"]
[Thu Jan 08 00:45:23.023623 2026] [:error] [pid 30632:tid 30654] [client 4.241.224.33:33650] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6No-d3_LCpBJzo02c0rAAAABI"]
[Thu Jan 08 00:45:23.402684 2026] [:error] [pid 51128:tid 51141] [client 4.241.224.33:12168] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6No0GjtE8U88mrwufGeAAAAYs"]
[Thu Jan 08 00:45:23.670846 2026] [:error] [pid 58330:tid 58335] [client 4.241.224.33:33622] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6Now8kGngKGK7_wncrGQAAAQM"]
[Thu Jan 08 00:45:24.199130 2026] [:error] [pid 50905:tid 50921] [client 4.241.224.33:12279] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV6NpGpNgk5-gt30I7a8zgAAAk4"]
[Thu Jan 08 00:45:24.519904 2026] [:error] [pid 50905:tid 50922] [client 4.241.224.33:33595] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV6NpGpNgk5-gt30I7a8zwAAAk8"]
[Thu Jan 08 00:45:24.898966 2026] [:error] [pid 30634:tid 30695] [client 4.241.224.33:33627] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV6NpICIPBibObtmZtsrAgAAAMU"]
[Thu Jan 08 00:45:25.398547 2026] [:error] [pid 51128:tid 51134] [client 4.241.224.33:33563] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aV6NpUGjtE8U88mrwufGegAAAYQ"]
[Thu Jan 08 00:45:25.959448 2026] [:error] [pid 58330:tid 58337] [client 4.241.224.33:12253] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aV6NpQ8kGngKGK7_wncrHQAAAQU"]
[Thu Jan 08 00:45:26.230270 2026] [:error] [pid 30634:tid 30698] [client 4.241.224.33:12246] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aV6NpoCIPBibObtmZtsrAwAAAMg"]
[Thu Jan 08 00:45:26.534105 2026] [:error] [pid 58294:tid 58316] [client 4.241.224.33:12265] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aV6NplfzA7c0ITpf3nFUcgAAAJQ"]
[Thu Jan 08 00:45:26.779329 2026] [:error] [pid 51128:tid 51140] [client 4.241.224.33:12224] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aV6NpkGjtE8U88mrwufGfAAAAYo"]
[Thu Jan 08 00:45:27.070990 2026] [:error] [pid 50905:tid 50925] [client 4.241.224.33:33571] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6Np2pNgk5-gt30I7a81gAAAlI"]
[Thu Jan 08 00:45:27.333026 2026] [:error] [pid 50870:tid 50893] [client 4.241.224.33:12193] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6NpxlePfspAt1BzouTGwAAAhU"]
[Thu Jan 08 00:45:27.627291 2026] [:error] [pid 30634:tid 30709] [client 4.241.224.33:33573] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6Np4CIPBibObtmZtsrBAAAANM"]
[Thu Jan 08 00:45:27.983019 2026] [:error] [pid 30634:tid 30714] [client 4.241.224.33:33582] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aV6Np4CIPBibObtmZtsrBQAAANg"]
[Thu Jan 08 00:45:28.226308 2026] [:error] [pid 50870:tid 50873] [client 4.241.224.33:33590] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aV6NqBlePfspAt1BzouTHgAAAgE"]
[Thu Jan 08 00:45:28.499773 2026] [:error] [pid 58294:tid 58302] [client 4.241.224.33:33597] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aV6NqFfzA7c0ITpf3nFUcwAAAIY"]
[Thu Jan 08 00:45:28.752299 2026] [:error] [pid 58294:tid 58320] [client 4.241.224.33:33580] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aV6NqFfzA7c0ITpf3nFUdAAAAJg"]
[Thu Jan 08 00:45:28.996529 2026] [:error] [pid 30633:tid 30672] [client 4.241.224.33:33602] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aV6NqPZiVWlF7303nMjTwAAAAEk"]
[Thu Jan 08 00:45:29.334417 2026] [:error] [pid 50870:tid 50887] [client 4.241.224.33:12178] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aV6NqRlePfspAt1BzouTIgAAAg8"]
[Thu Jan 08 00:45:29.734370 2026] [:error] [pid 30633:tid 30679] [client 4.241.224.33:33662] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aV6NqfZiVWlF7303nMjTwwAAAFA"]
[Thu Jan 08 00:45:29.984599 2026] [:error] [pid 30633:tid 30666] [client 4.241.224.33:12240] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aV6NqfZiVWlF7303nMjTxgAAAEM"]
[Thu Jan 08 00:45:30.382461 2026] [:error] [pid 51128:tid 51132] [client 4.241.224.33:33585] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aV6NqkGjtE8U88mrwufGgAAAAYI"]
[Thu Jan 08 00:45:30.654086 2026] [:error] [pid 30632:tid 30641] [client 4.241.224.33:33619] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV6Nqud3_LCpBJzo02c0swAAAAU"]
[Thu Jan 08 00:45:30.990308 2026] [:error] [pid 30633:tid 30678] [client 4.241.224.33:12185] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV6NqvZiVWlF7303nMjTxwAAAE8"]
[Thu Jan 08 00:45:31.248447 2026] [:error] [pid 30632:tid 30658] [client 4.241.224.33:12231] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV6Nq-d3_LCpBJzo02c0tAAAABY"]
[Thu Jan 08 00:45:31.641171 2026] [:error] [pid 30632:tid 30650] [client 4.241.224.33:12170] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aV6Nq-d3_LCpBJzo02c0twAAAA4"]
[Thu Jan 08 00:45:31.913805 2026] [:error] [pid 50838:tid 50855] [client 4.241.224.33:12270] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aV6Nq7SweZ27JIN4H8vpKgAAAc8"]
[Thu Jan 08 00:45:32.244696 2026] [:error] [pid 30633:tid 30686] [client 4.241.224.33:12166] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aV6NrPZiVWlF7303nMjTzAAAAFc"]
[Thu Jan 08 00:45:32.477381 2026] [:error] [pid 51128:tid 51146] [client 4.241.224.33:12260] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aV6NrEGjtE8U88mrwufGggAAAZA"]
[Thu Jan 08 00:45:32.737878 2026] [:error] [pid 50905:tid 50923] [client 4.241.224.33:33631] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aV6NrGpNgk5-gt30I7a83wAAAlA"]
[Thu Jan 08 00:45:33.020738 2026] [:error] [pid 58330:tid 58345] [client 4.241.224.33:33562] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV6NrQ8kGngKGK7_wncrIgAAAQ0"]
[Thu Jan 08 00:45:33.403460 2026] [:error] [pid 58330:tid 58336] [client 4.241.224.33:12269] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV6NrQ8kGngKGK7_wncrJAAAAQQ"]
[Thu Jan 08 00:45:33.742425 2026] [:error] [pid 30634:tid 30706] [client 4.241.224.33:12268] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV6NrYCIPBibObtmZtsrCQAAANA"]
[Thu Jan 08 00:45:34.069005 2026] [:error] [pid 50838:tid 50852] [client 4.241.224.33:12207] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV6NrrSweZ27JIN4H8vpLwAAAcw"]
[Thu Jan 08 00:45:34.368600 2026] [:error] [pid 30633:tid 30672] [client 4.241.224.33:12227] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV6NrvZiVWlF7303nMjTzgAAAEk"]
[Thu Jan 08 00:45:34.613589 2026] [:error] [pid 30633:tid 30667] [client 4.241.224.33:12164] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV6NrvZiVWlF7303nMjTzwAAAEQ"]
[Thu Jan 08 00:45:34.844304 2026] [:error] [pid 30632:tid 30637] [client 4.241.224.33:12283] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV6Nrud3_LCpBJzo02c0uwAAAAE"]
[Thu Jan 08 00:45:35.112017 2026] [:error] [pid 51128:tid 51153] [client 4.241.224.33:33574] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aV6Nr0GjtE8U88mrwufGhAAAAZc"]
[Thu Jan 08 00:45:35.390426 2026] [:error] [pid 51128:tid 51134] [client 4.241.224.33:12255] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV6Nr0GjtE8U88mrwufGhQAAAYQ"]
[Thu Jan 08 00:45:35.751943 2026] [:error] [pid 58294:tid 58318] [client 4.241.224.33:12180] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV6Nr1fzA7c0ITpf3nFUeQAAAJY"]
[Thu Jan 08 00:45:36.053041 2026] [:error] [pid 50870:tid 50889] [client 4.241.224.33:33607] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV6NsBlePfspAt1BzouTJAAAAhE"]
[Thu Jan 08 00:45:36.297079 2026] [:error] [pid 50838:tid 50848] [client 4.241.224.33:33550] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aV6NsLSweZ27JIN4H8vpNAAAAcg"]
[Thu Jan 08 00:45:36.590355 2026] [:error] [pid 58294:tid 58307] [client 4.241.224.33:33596] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV6NsFfzA7c0ITpf3nFUewAAAIs"]
[Thu Jan 08 00:45:36.912686 2026] [:error] [pid 58294:tid 58317] [client 4.241.224.33:33587] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV6NsFfzA7c0ITpf3nFUfAAAAJU"]
[Thu Jan 08 00:45:37.179421 2026] [:error] [pid 58294:tid 58300] [client 4.241.224.33:12248] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV6NsVfzA7c0ITpf3nFUfQAAAIQ"]
[Thu Jan 08 00:45:37.516646 2026] [:error] [pid 50870:tid 50878] [client 4.241.224.33:33603] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV6NsRlePfspAt1BzouTKAAAAgY"]
[Thu Jan 08 00:45:38.010082 2026] [:error] [pid 50870:tid 50895] [client 4.241.224.33:33586] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV6NshlePfspAt1BzouTKgAAAhc"]
[Thu Jan 08 00:45:38.336607 2026] [:error] [pid 58330:tid 58347] [client 4.241.224.33:12262] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV6Nsg8kGngKGK7_wncrJgAAAQ8"]
[Thu Jan 08 00:45:38.603817 2026] [:error] [pid 58330:tid 58351] [client 4.241.224.33:12204] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV6Nsg8kGngKGK7_wncrJwAAARM"]
[Thu Jan 08 00:45:38.868154 2026] [:error] [pid 50838:tid 50853] [client 4.241.224.33:12205] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aV6NsrSweZ27JIN4H8vpOQAAAc0"]
[Thu Jan 08 00:45:39.124746 2026] [:error] [pid 50905:tid 50907] [client 4.241.224.33:33567] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV6Ns2pNgk5-gt30I7a85gAAAkA"]
[Thu Jan 08 00:45:39.412054 2026] [:error] [pid 50870:tid 50872] [client 4.241.224.33:12147] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV6NsxlePfspAt1BzouTLQAAAgA"]
[Thu Jan 08 00:45:39.673247 2026] [:error] [pid 30632:tid 30641] [client 4.241.224.33:33577] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV6Ns-d3_LCpBJzo02c0wQAAAAU"]
[Thu Jan 08 00:45:39.923587 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:33547] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV6Ns2pNgk5-gt30I7a86AAAAkI"]
[Thu Jan 08 00:45:40.188051 2026] [:error] [pid 58294:tid 58313] [client 4.241.224.33:12273] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aV6NtFfzA7c0ITpf3nFUgQAAAJE"]
[Thu Jan 08 00:45:40.433480 2026] [:error] [pid 58294:tid 58302] [client 4.241.224.33:12110] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aV6NtFfzA7c0ITpf3nFUhAAAAIY"]
[Thu Jan 08 00:45:40.666538 2026] [:error] [pid 30633:tid 30681] [client 4.241.224.33:12175] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aV6NtPZiVWlF7303nMjT0wAAAFI"]
[Thu Jan 08 00:45:40.901493 2026] [:error] [pid 30634:tid 30707] [client 4.241.224.33:12271] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aV6NtICIPBibObtmZtsrCgAAANE"]
[Thu Jan 08 00:45:41.209960 2026] [:error] [pid 51128:tid 51149] [client 4.241.224.33:12189] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aV6NtUGjtE8U88mrwufGhwAAAZM"]
[Thu Jan 08 00:45:41.558874 2026] [:error] [pid 30633:tid 30677] [client 4.241.224.33:12264] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aV6NtfZiVWlF7303nMjT1QAAAE4"]
[Thu Jan 08 00:45:41.821878 2026] [:error] [pid 51128:tid 51143] [client 4.241.224.33:12101] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aV6NtUGjtE8U88mrwufGiQAAAY0"]
[Thu Jan 08 00:45:42.137676 2026] [:error] [pid 30634:tid 30696] [client 4.241.224.33:12098] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aV6NtoCIPBibObtmZtsrCwAAAMY"]
[Thu Jan 08 00:45:42.472277 2026] [:error] [pid 50905:tid 50917] [client 4.241.224.33:12163] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aV6NtmpNgk5-gt30I7a86wAAAko"]
[Thu Jan 08 00:45:42.797590 2026] [:error] [pid 30634:tid 30695] [client 4.241.224.33:12252] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aV6NtoCIPBibObtmZtsrDgAAAMU"]
[Thu Jan 08 00:45:43.095017 2026] [:error] [pid 30634:tid 30712] [client 4.241.224.33:12106] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aV6Nt4CIPBibObtmZtsrDwAAANY"]
[Thu Jan 08 00:45:43.381149 2026] [:error] [pid 30634:tid 30698] [client 4.241.224.33:12198] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aV6Nt4CIPBibObtmZtsrEAAAAMg"]
[Thu Jan 08 00:45:43.693422 2026] [:error] [pid 50905:tid 50931] [client 4.241.224.33:12247] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aV6Nt2pNgk5-gt30I7a87QAAAlg"]
[Thu Jan 08 00:45:43.945407 2026] [:error] [pid 50936:tid 50946] [client 4.241.224.33:12267] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aV6Nt7Dlg80QUdd5qc4v-AAAAog"]
[Thu Jan 08 00:45:44.226115 2026] [:error] [pid 58330:tid 58349] [client 4.241.224.33:12165] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aV6NuA8kGngKGK7_wncrLQAAARE"]
[Thu Jan 08 00:45:44.514042 2026] [:error] [pid 50905:tid 50913] [client 4.241.224.33:12167] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aV6NuGpNgk5-gt30I7a88AAAAkY"]
[Thu Jan 08 00:45:44.774870 2026] [:error] [pid 30634:tid 30709] [client 4.241.224.33:12258] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV6NuICIPBibObtmZtsrEwAAANM"]
[Thu Jan 08 00:45:45.072128 2026] [:error] [pid 50838:tid 50855] [client 4.241.224.33:12194] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV6NubSweZ27JIN4H8vpPQAAAc8"]
[Thu Jan 08 00:45:45.319155 2026] [:error] [pid 58330:tid 58352] [client 4.241.224.33:33640] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV6NuQ8kGngKGK7_wncrLgAAARQ"]
[Thu Jan 08 00:45:45.572454 2026] [:error] [pid 30634:tid 30700] [client 4.241.224.33:12160] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV6NuYCIPBibObtmZtsrFAAAAMo"]
[Thu Jan 08 00:45:45.821692 2026] [:error] [pid 58294:tid 58307] [client 4.241.224.33:12284] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aV6NuVfzA7c0ITpf3nFUiAAAAIs"]
[Thu Jan 08 00:45:46.082829 2026] [:error] [pid 50905:tid 50924] [client 4.241.224.33:12127] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aV6NumpNgk5-gt30I7a88wAAAlE"]
[Thu Jan 08 00:45:46.361708 2026] [:error] [pid 50905:tid 50921] [client 4.241.224.33:33647] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aV6NumpNgk5-gt30I7a89QAAAk4"]
[Thu Jan 08 00:45:46.601175 2026] [:error] [pid 50905:tid 50910] [client 4.241.224.33:12266] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aV6NumpNgk5-gt30I7a89gAAAkM"]
[Thu Jan 08 00:45:46.864689 2026] [:error] [pid 30632:tid 30646] [client 4.241.224.33:12126] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aV6Nuud3_LCpBJzo02c0wwAAAAo"]
[Thu Jan 08 00:45:47.113400 2026] [:error] [pid 30634:tid 30711] [client 4.241.224.33:12226] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aV6Nu4CIPBibObtmZtsrFgAAANU"]
[Thu Jan 08 00:45:47.411763 2026] [:error] [pid 30633:tid 30679] [client 4.241.224.33:12263] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aV6Nu_ZiVWlF7303nMjT2AAAAFA"]
[Thu Jan 08 00:45:47.711904 2026] [:error] [pid 30634:tid 30708] [client 4.241.224.33:12184] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aV6Nu4CIPBibObtmZtsrFwAAANI"]
[Thu Jan 08 00:45:48.104702 2026] [:error] [pid 58330:tid 58345] [client 4.241.224.33:12186] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6NvA8kGngKGK7_wncrMAAAAQ0"]
[Thu Jan 08 00:45:48.378199 2026] [:error] [pid 50838:tid 50863] [client 4.241.224.33:12190] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6NvLSweZ27JIN4H8vpQgAAAdc"]
[Thu Jan 08 00:45:48.638392 2026] [:error] [pid 58294:tid 58313] [client 4.241.224.33:33598] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6NvFfzA7c0ITpf3nFUiQAAAJE"]
[Thu Jan 08 00:45:48.886416 2026] [:error] [pid 51128:tid 51136] [client 4.241.224.33:12278] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aV6NvEGjtE8U88mrwufGkAAAAYY"]
[Thu Jan 08 00:45:49.122488 2026] [:error] [pid 50870:tid 50878] [client 4.241.224.33:12145] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV6NvRlePfspAt1BzouTMAAAAgY"]
[Thu Jan 08 00:45:49.435515 2026] [:error] [pid 30632:tid 30654] [client 4.241.224.33:12221] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV6Nved3_LCpBJzo02c0xQAAABI"]
[Thu Jan 08 00:45:49.697748 2026] [:error] [pid 50905:tid 50922] [client 4.241.224.33:12179] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV6NvWpNgk5-gt30I7a89wAAAk8"]
[Thu Jan 08 00:45:49.947709 2026] [:error] [pid 30634:tid 30693] [client 4.241.224.33:33618] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aV6NvYCIPBibObtmZtsrHQAAAMM"]
[Thu Jan 08 00:45:50.228601 2026] [:error] [pid 50838:tid 50842] [client 4.241.224.33:12211] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aV6NvrSweZ27JIN4H8vpSAAAAcI"]
[Thu Jan 08 00:45:50.513680 2026] [:error] [pid 58330:tid 58351] [client 4.241.224.33:33592] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aV6Nvg8kGngKGK7_wncrMwAAARM"]
[Thu Jan 08 00:45:50.804446 2026] [:error] [pid 30632:tid 30639] [client 4.241.224.33:12107] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aV6Nvud3_LCpBJzo02c0xgAAAAM"]
[Thu Jan 08 00:45:51.102114 2026] [:error] [pid 50905:tid 50916] [client 4.241.224.33:33594] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aV6Nv2pNgk5-gt30I7a8-QAAAkk"]
[Thu Jan 08 00:45:51.398460 2026] [:error] [pid 58330:tid 58338] [client 4.241.224.33:33609] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aV6Nvw8kGngKGK7_wncrNQAAAQY"]
[Thu Jan 08 00:45:51.701609 2026] [:error] [pid 58294:tid 58296] [client 4.241.224.33:12209] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aV6Nv1fzA7c0ITpf3nFUjAAAAIA"]
[Thu Jan 08 00:45:51.997657 2026] [:error] [pid 30632:tid 30657] [client 4.241.224.33:12191] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aV6Nv-d3_LCpBJzo02c0yQAAABU"]
[Thu Jan 08 00:45:52.279074 2026] [:error] [pid 50870:tid 50893] [client 4.241.224.33:33544] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Thu Jan 08 00:45:52.513113 2026] [:error] [pid 50870:tid 50882] [client 4.241.224.33:33544] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Jan 08 00:45:52.642917 2026] [:error] [pid 50870:tid 50872] [client 4.241.224.33:33544] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Jan 08 00:45:52.769237 2026] [:error] [pid 50870:tid 50873] [client 4.241.224.33:33544] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Jan 08 00:45:52.885137 2026] [:error] [pid 50870:tid 50885] [client 4.241.224.33:33544] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Jan 08 00:45:53.374210 2026] [:error] [pid 50870:tid 50896] [client 4.241.224.33:33544] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Thu Jan 08 00:45:53.487466 2026] [:error] [pid 50870:tid 50884] [client 4.241.224.33:33544] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aV6NwRlePfspAt1BzouTOwAAAgw"]
[Thu Jan 08 00:45:53.852447 2026] [:error] [pid 30633:tid 30671] [client 4.241.224.33:33630] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aV6NwfZiVWlF7303nMjT2wAAAEg"]
[Thu Jan 08 00:45:54.084421 2026] [:error] [pid 50870:tid 50874] [client 4.241.224.33:12111] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aV6NwhlePfspAt1BzouTPAAAAgI"]
[Thu Jan 08 00:45:54.312325 2026] [:error] [pid 58330:tid 58334] [client 4.241.224.33:12037] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aV6Nwg8kGngKGK7_wncrOwAAAQI"]
[Thu Jan 08 00:45:54.573015 2026] [:error] [pid 30633:tid 30677] [client 4.241.224.33:12100] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aV6NwvZiVWlF7303nMjT3AAAAE4"]
[Thu Jan 08 00:45:54.800561 2026] [:error] [pid 50936:tid 50957] [client 4.241.224.33:12249] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aV6NwrDlg80QUdd5qc4v-wAAApM"]
[Thu Jan 08 00:45:55.052656 2026] [:error] [pid 50870:tid 50887] [client 4.241.224.33:12272] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aV6NwxlePfspAt1BzouTPQAAAg8"]
[Thu Jan 08 00:45:55.310185 2026] [:error] [pid 58294:tid 58304] [client 4.241.224.33:12181] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aV6Nw1fzA7c0ITpf3nFUkQAAAIg"]
[Thu Jan 08 00:45:55.553260 2026] [:error] [pid 30633:tid 30682] [client 4.241.224.33:12119] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aV6Nw_ZiVWlF7303nMjT3wAAAFM"]
[Thu Jan 08 00:45:55.866607 2026] [:error] [pid 30633:tid 30664] [client 4.241.224.33:12125] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aV6Nw_ZiVWlF7303nMjT4QAAAEE"]
[Thu Jan 08 00:45:56.108110 2026] [:error] [pid 58330:tid 58356] [client 4.241.224.33:12241] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aV6NxA8kGngKGK7_wncrQAAAARg"]
[Thu Jan 08 00:45:56.362069 2026] [:error] [pid 30634:tid 30708] [client 4.241.224.33:12183] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aV6NxICIPBibObtmZtsrJAAAANI"]
[Thu Jan 08 00:45:56.594128 2026] [:error] [pid 58294:tid 58312] [client 4.241.224.33:12254] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aV6NxFfzA7c0ITpf3nFUkgAAAJA"]
[Thu Jan 08 00:45:56.856022 2026] [:error] [pid 58294:tid 58307] [client 4.241.224.33:12225] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aV6NxFfzA7c0ITpf3nFUlAAAAIs"]
[Thu Jan 08 00:45:57.087500 2026] [:error] [pid 30632:tid 30645] [client 4.241.224.33:12277] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aV6Nxed3_LCpBJzo02c0zgAAAAk"]
[Thu Jan 08 00:45:57.337366 2026] [:error] [pid 50936:tid 50949] [client 4.241.224.33:12182] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aV6NxbDlg80QUdd5qc4v_wAAAos"]
[Thu Jan 08 00:45:57.569207 2026] [:error] [pid 50838:tid 50861] [client 4.241.224.33:12115] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aV6NxbSweZ27JIN4H8vpTwAAAdU"]
[Thu Jan 08 00:45:57.806067 2026] [:error] [pid 58294:tid 58319] [client 4.241.224.33:12261] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aV6NxVfzA7c0ITpf3nFUlwAAAJc"]
[Thu Jan 08 00:45:58.070326 2026] [:error] [pid 50936:tid 50947] [client 4.241.224.33:12176] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aV6NxrDlg80QUdd5qc4wAAAAAok"]
[Thu Jan 08 00:45:58.326686 2026] [:error] [pid 50870:tid 50880] [client 4.241.224.33:12256] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aV6NxhlePfspAt1BzouTPwAAAgg"]
[Thu Jan 08 00:45:58.623035 2026] [:error] [pid 50936:tid 50954] [client 4.241.224.33:12222] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aV6NxrDlg80QUdd5qc4wAQAAApA"]
[Thu Jan 08 00:45:58.880050 2026] [:error] [pid 58330:tid 58332] [client 4.241.224.33:12177] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aV6Nxg8kGngKGK7_wncrRAAAAQA"]
[Thu Jan 08 00:45:59.128882 2026] [:error] [pid 58294:tid 58296] [client 4.241.224.33:33587] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aV6Nx1fzA7c0ITpf3nFUmgAAAIA"]
[Thu Jan 08 00:45:59.371922 2026] [:error] [pid 30632:tid 30637] [client 4.241.224.33:12112] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aV6Nx-d3_LCpBJzo02c0zwAAAAE"]
[Thu Jan 08 00:45:59.626373 2026] [:error] [pid 58294:tid 58316] [client 4.241.224.33:12212] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aV6Nx1fzA7c0ITpf3nFUmwAAAJQ"]
[Thu Jan 08 00:45:59.856035 2026] [:error] [pid 58294:tid 58306] [client 4.241.224.33:12161] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aV6Nx1fzA7c0ITpf3nFUnQAAAIo"]
[Thu Jan 08 00:46:00.083930 2026] [:error] [pid 50936:tid 50939] [client 4.241.224.33:12041] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aV6NyLDlg80QUdd5qc4wBQAAAoE"]
[Thu Jan 08 00:46:00.311035 2026] [:error] [pid 50838:tid 50842] [client 4.241.224.33:33628] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aV6NyLSweZ27JIN4H8vpUwAAAcI"]
[Thu Jan 08 00:46:00.548528 2026] [:error] [pid 50838:tid 50857] [client 4.241.224.33:12203] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aV6NyLSweZ27JIN4H8vpVAAAAdE"]
[Thu Jan 08 00:46:00.809474 2026] [:error] [pid 50838:tid 50854] [client 4.241.224.33:12169] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aV6NyLSweZ27JIN4H8vpVQAAAc4"]
[Thu Jan 08 00:46:01.045018 2026] [:error] [pid 30633:tid 30681] [client 4.241.224.33:12213] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aV6NyfZiVWlF7303nMjT5wAAAFI"]
[Thu Jan 08 00:46:01.309234 2026] [:error] [pid 30632:tid 30655] [client 4.241.224.33:12116] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aV6Nyed3_LCpBJzo02c00AAAABM"]
[Thu Jan 08 00:46:01.548313 2026] [:error] [pid 50936:tid 50946] [client 4.241.224.33:12276] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aV6NybDlg80QUdd5qc4wBwAAAog"]
[Thu Jan 08 00:46:01.775069 2026] [:error] [pid 58294:tid 58317] [client 4.241.224.33:12285] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aV6NyVfzA7c0ITpf3nFUoAAAAJU"]
[Thu Jan 08 00:46:02.048536 2026] [:error] [pid 30634:tid 30695] [client 4.241.224.33:12046] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aV6NyoCIPBibObtmZtsrKQAAAMU"]
[Thu Jan 08 00:46:02.278434 2026] [:error] [pid 58330:tid 58334] [client 4.241.224.33:12192] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aV6Nyg8kGngKGK7_wncrRgAAAQI"]
[Thu Jan 08 00:46:02.505639 2026] [:error] [pid 30634:tid 30694] [client 4.241.224.33:12109] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aV6NyoCIPBibObtmZtsrKwAAAMQ"]
[Thu Jan 08 00:46:02.737521 2026] [:error] [pid 50936:tid 50961] [client 4.241.224.33:33639] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aV6NyrDlg80QUdd5qc4wCwAAApc"]
[Thu Jan 08 00:46:02.966385 2026] [:error] [pid 50936:tid 50949] [client 4.241.224.33:12218] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aV6NyrDlg80QUdd5qc4wDQAAAos"]
[Thu Jan 08 00:46:03.218409 2026] [:error] [pid 50936:tid 50954] [client 4.241.224.33:33591] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aV6Ny7Dlg80QUdd5qc4wDgAAApA"]
[Thu Jan 08 00:46:03.477230 2026] [:error] [pid 30633:tid 30686] [client 4.241.224.33:12197] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aV6Ny_ZiVWlF7303nMjT7AAAAFc"]
[Thu Jan 08 00:46:03.710646 2026] [:error] [pid 50905:tid 50916] [client 4.241.224.33:12042] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aV6Ny2pNgk5-gt30I7a9AwAAAkk"]
[Thu Jan 08 00:46:03.977309 2026] [:error] [pid 30634:tid 30699] [client 4.241.224.33:12039] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aV6Ny4CIPBibObtmZtsrLAAAAMk"]
[Thu Jan 08 00:46:04.203522 2026] [:error] [pid 30634:tid 30709] [client 4.241.224.33:12219] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aV6NzICIPBibObtmZtsrLQAAANM"]
[Thu Jan 08 00:46:04.449052 2026] [:error] [pid 30633:tid 30664] [client 4.241.224.33:12172] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aV6NzPZiVWlF7303nMjT7gAAAEE"]
[Thu Jan 08 00:46:04.686956 2026] [:error] [pid 50905:tid 50913] [client 4.241.224.33:12081] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aV6NzGpNgk5-gt30I7a9BQAAAkY"]
[Thu Jan 08 00:46:04.918463 2026] [:error] [pid 30632:tid 30648] [client 4.241.224.33:12136] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aV6NzOd3_LCpBJzo02c01AAAAAw"]
[Thu Jan 08 00:46:05.154402 2026] [:error] [pid 50936:tid 50941] [client 4.241.224.33:12104] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aV6NzbDlg80QUdd5qc4wEQAAAoM"]
[Thu Jan 08 00:46:05.392297 2026] [:error] [pid 50905:tid 50931] [client 4.241.224.33:12099] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aV6NzWpNgk5-gt30I7a9CAAAAlg"]
[Thu Jan 08 00:46:05.620447 2026] [:error] [pid 50905:tid 50927] [client 4.241.224.33:12196] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aV6NzWpNgk5-gt30I7a9CQAAAlQ"]
[Thu Jan 08 00:46:05.884674 2026] [:error] [pid 30632:tid 30649] [client 4.241.224.33:12173] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aV6Nzed3_LCpBJzo02c01gAAAA0"]
[Thu Jan 08 00:46:06.126944 2026] [:error] [pid 50838:tid 50863] [client 4.241.224.33:12187] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aV6NzrSweZ27JIN4H8vpWgAAAdc"]
[Thu Jan 08 00:46:06.376289 2026] [:error] [pid 50936:tid 50946] [client 4.241.224.33:12118] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aV6NzrDlg80QUdd5qc4wEwAAAog"]
[Thu Jan 08 00:46:06.608890 2026] [:error] [pid 58294:tid 58299] [client 4.241.224.33:12132] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aV6NzlfzA7c0ITpf3nFUpAAAAIM"]
[Thu Jan 08 00:46:06.847206 2026] [:error] [pid 50838:tid 50859] [client 4.241.224.33:12217] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aV6NzrSweZ27JIN4H8vpXAAAAdM"]
[Thu Jan 08 00:46:07.102118 2026] [:error] [pid 50936:tid 50961] [client 4.241.224.33:12102] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aV6Nz7Dlg80QUdd5qc4wFQAAApc"]
[Thu Jan 08 00:46:07.335408 2026] [:error] [pid 50936:tid 50950] [client 4.241.224.33:12055] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aV6Nz7Dlg80QUdd5qc4wFgAAAow"]
[Thu Jan 08 00:46:07.563487 2026] [:error] [pid 50936:tid 50943] [client 4.241.224.33:12120] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aV6Nz7Dlg80QUdd5qc4wGAAAAoU"]
[Thu Jan 08 00:46:07.798811 2026] [:error] [pid 50936:tid 50949] [client 4.241.224.33:12171] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aV6Nz7Dlg80QUdd5qc4wGQAAAos"]
[Thu Jan 08 00:46:08.034432 2026] [:error] [pid 30633:tid 30665] [client 4.241.224.33:12139] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aV6N0PZiVWlF7303nMjT-AAAAEI"]
[Thu Jan 08 00:46:08.297208 2026] [:error] [pid 50870:tid 50878] [client 4.241.224.33:12220] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aV6N0BlePfspAt1BzouTQwAAAgY"]
[Thu Jan 08 00:46:08.548352 2026] [:error] [pid 50870:tid 50893] [client 4.241.224.33:12103] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aV6N0BlePfspAt1BzouTRAAAAhU"]
[Thu Jan 08 00:46:08.783640 2026] [:error] [pid 50905:tid 50910] [client 4.241.224.33:12129] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aV6N0GpNgk5-gt30I7a9DQAAAkM"]
[Thu Jan 08 00:46:09.044707 2026] [:error] [pid 50870:tid 50882] [client 4.241.224.33:12131] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aV6N0RlePfspAt1BzouTRgAAAgo"]
[Thu Jan 08 00:46:09.283403 2026] [:error] [pid 50838:tid 50851] [client 4.241.224.33:12274] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aV6N0bSweZ27JIN4H8vpYAAAAcs"]
[Thu Jan 08 00:46:09.533333 2026] [:error] [pid 50936:tid 50941] [client 4.241.224.33:12032] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aV6N0bDlg80QUdd5qc4wHwAAAoM"]
[Thu Jan 08 00:46:09.761277 2026] [:error] [pid 58294:tid 58316] [client 4.241.224.33:12043] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aV6N0VfzA7c0ITpf3nFUpwAAAJQ"]
[Thu Jan 08 00:46:09.998729 2026] [:error] [pid 30632:tid 30641] [client 4.241.224.33:12134] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aV6N0ed3_LCpBJzo02c01wAAAAU"]
[Thu Jan 08 00:46:10.227595 2026] [:error] [pid 30634:tid 30702] [client 4.241.224.33:12174] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aV6N0oCIPBibObtmZtsrMAAAAMw"]
[Thu Jan 08 00:46:10.549011 2026] [:error] [pid 58294:tid 58310] [client 4.241.224.33:12063] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aV6N0lfzA7c0ITpf3nFUqgAAAI4"]
[Thu Jan 08 00:46:10.776391 2026] [:error] [pid 58330:tid 58332] [client 4.241.224.33:12122] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aV6N0g8kGngKGK7_wncrSgAAAQA"]
[Thu Jan 08 00:46:11.065569 2026] [:error] [pid 50936:tid 50957] [client 4.241.224.33:12151] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aV6N07Dlg80QUdd5qc4wIgAAApM"]
[Thu Jan 08 00:46:11.351032 2026] [:error] [pid 30632:tid 30646] [client 4.241.224.33:12259] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aV6N0-d3_LCpBJzo02c02wAAAAo"]
[Thu Jan 08 00:46:11.587832 2026] [:error] [pid 51128:tid 51150] [client 4.241.224.33:12051] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aV6N00GjtE8U88mrwufGmQAAAZQ"]
[Thu Jan 08 00:46:11.827279 2026] [:error] [pid 50936:tid 50950] [client 4.241.224.33:12113] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aV6N07Dlg80QUdd5qc4wIwAAAow"]
[Thu Jan 08 00:46:12.089730 2026] [:error] [pid 58330:tid 58347] [client 4.241.224.33:11983] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aV6N1A8kGngKGK7_wncrTAAAAQ8"]
[Thu Jan 08 00:46:12.324084 2026] [:error] [pid 50936:tid 50949] [client 4.241.224.33:12082] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aV6N1LDlg80QUdd5qc4wJQAAAos"]
[Thu Jan 08 00:46:12.575404 2026] [:error] [pid 50838:tid 50846] [client 4.241.224.33:12096] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aV6N1LSweZ27JIN4H8vpZAAAAcY"]
[Thu Jan 08 00:46:12.814967 2026] [:error] [pid 58294:tid 58315] [client 4.241.224.33:12154] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aV6N1FfzA7c0ITpf3nFUrQAAAJM"]
[Thu Jan 08 00:46:13.053059 2026] [:error] [pid 58294:tid 58303] [client 4.241.224.33:12206] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aV6N1VfzA7c0ITpf3nFUrwAAAIc"]
[Thu Jan 08 00:46:13.308526 2026] [:error] [pid 58294:tid 58299] [client 4.241.224.33:12108] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aV6N1VfzA7c0ITpf3nFUsQAAAIM"]
[Thu Jan 08 00:46:13.540849 2026] [:error] [pid 30633:tid 30681] [client 4.241.224.33:12072] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aV6N1fZiVWlF7303nMjT-wAAAFI"]
[Thu Jan 08 00:46:13.814871 2026] [:error] [pid 50936:tid 50947] [client 4.241.224.33:12124] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aV6N1bDlg80QUdd5qc4wKAAAAok"]
[Thu Jan 08 00:46:14.061966 2026] [:error] [pid 58294:tid 58298] [client 4.241.224.33:12137] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aV6N1lfzA7c0ITpf3nFUsgAAAII"]
[Thu Jan 08 00:46:14.296313 2026] [:error] [pid 50905:tid 50911] [client 4.241.224.33:12138] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aV6N1mpNgk5-gt30I7a9EAAAAkQ"]
[Thu Jan 08 00:46:14.545141 2026] [:error] [pid 58330:tid 58333] [client 4.241.224.33:12114] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aV6N1g8kGngKGK7_wncrUAAAAQE"]
[Thu Jan 08 00:46:14.786341 2026] [:error] [pid 50870:tid 50894] [client 4.241.224.33:12215] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aV6N1hlePfspAt1BzouTSQAAAhY"]
[Thu Jan 08 00:46:15.030691 2026] [:error] [pid 50936:tid 50951] [client 4.241.224.33:12121] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV6N17Dlg80QUdd5qc4wKQAAAo0"]
[Thu Jan 08 00:46:15.259539 2026] [:error] [pid 58294:tid 58301] [client 4.241.224.33:12150] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV6N11fzA7c0ITpf3nFUswAAAIU"]
[Thu Jan 08 00:46:15.585229 2026] [:error] [pid 30633:tid 30671] [client 4.241.224.33:12097] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV6N1_ZiVWlF7303nMjT_AAAAEg"]
[Thu Jan 08 00:46:15.896607 2026] [:error] [pid 30634:tid 30690] [client 4.241.224.33:12084] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aV6N14CIPBibObtmZtsrNwAAAMA"]
[Thu Jan 08 00:46:16.178138 2026] [:error] [pid 58294:tid 58309] [client 4.241.224.33:33638] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aV6N2FfzA7c0ITpf3nFUtgAAAI0"]
[Thu Jan 08 00:46:16.450882 2026] [:error] [pid 58294:tid 58304] [client 4.241.224.33:12045] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aV6N2FfzA7c0ITpf3nFUuAAAAIg"]
[Thu Jan 08 00:46:16.770368 2026] [:error] [pid 30634:tid 30707] [client 4.241.224.33:12080] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aV6N2ICIPBibObtmZtsrOAAAANE"]
[Thu Jan 08 00:46:17.012261 2026] [:error] [pid 50905:tid 50931] [client 4.241.224.33:12054] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aV6N2WpNgk5-gt30I7a9FAAAAlg"]
[Thu Jan 08 00:46:17.249878 2026] [:error] [pid 50905:tid 50925] [client 4.241.224.33:11982] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aV6N2WpNgk5-gt30I7a9FQAAAlI"]
[Thu Jan 08 00:46:17.495136 2026] [:error] [pid 58294:tid 58315] [client 4.241.224.33:12146] [client 4.241.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aV6N2VfzA7c0ITpf3nFUvAAAAJM"]
[Thu Jan 08 00:46:17.850024 2026] [:error] [pid 30634:tid 30696] [client 4.241.224.33:12060] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV6N2YCIPBibObtmZtsrOwAAAMY"]
[Thu Jan 08 00:46:18.166673 2026] [:error] [pid 58330:tid 58356] [client 4.241.224.33:12223] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV6N2g8kGngKGK7_wncrVgAAARg"]
[Thu Jan 08 00:46:18.414060 2026] [:error] [pid 30634:tid 30695] [client 4.241.224.33:12155] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV6N2oCIPBibObtmZtsrPAAAAMU"]
[Thu Jan 08 00:46:18.702878 2026] [:error] [pid 50838:tid 50857] [client 4.241.224.33:12287] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aV6N2rSweZ27JIN4H8vpbQAAAdE"]
[Thu Jan 08 00:46:18.996473 2026] [:error] [pid 58330:tid 58342] [client 4.241.224.33:11988] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aV6N2g8kGngKGK7_wncrVwAAAQo"]
[Thu Jan 08 00:46:19.382217 2026] [:error] [pid 51128:tid 51144] [client 4.241.224.33:12066] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aV6N20GjtE8U88mrwufGngAAAY4"]
[Thu Jan 08 00:46:19.635829 2026] [:error] [pid 50870:tid 50888] [client 4.241.224.33:12159] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aV6N2xlePfspAt1BzouTSwAAAhA"]
[Thu Jan 08 00:46:19.983309 2026] [:error] [pid 51128:tid 51140] [client 4.241.224.33:11969] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aV6N20GjtE8U88mrwufGoAAAAYo"]
[Thu Jan 08 00:46:20.329958 2026] [:error] [pid 50870:tid 50874] [client 4.241.224.33:33659] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aV6N3BlePfspAt1BzouTTAAAAgI"]
[Thu Jan 08 00:46:20.656748 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:33558] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aV6N3GpNgk5-gt30I7a9HQAAAkI"]
[Thu Jan 08 00:46:21.108772 2026] [:error] [pid 58330:tid 58345] [client 4.241.224.33:12130] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aV6N3Q8kGngKGK7_wncrXAAAAQ0"]
[Thu Jan 08 00:46:21.383917 2026] [:error] [pid 50905:tid 50911] [client 4.241.224.33:12141] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aV6N3WpNgk5-gt30I7a9HwAAAkQ"]
[Thu Jan 08 00:46:21.639596 2026] [:error] [pid 58294:tid 58320] [client 4.241.224.33:12067] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aV6N3VfzA7c0ITpf3nFUvQAAAJg"]
[Thu Jan 08 00:46:21.937428 2026] [:error] [pid 30633:tid 30670] [client 4.241.224.33:12152] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aV6N3fZiVWlF7303nMjT_QAAAEc"]
[Thu Jan 08 00:46:22.186838 2026] [:error] [pid 58330:tid 58342] [client 4.241.224.33:12048] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aV6N3g8kGngKGK7_wncrYgAAAQo"]
[Thu Jan 08 00:46:22.447944 2026] [:error] [pid 30632:tid 30648] [client 4.241.224.33:12105] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aV6N3ud3_LCpBJzo02c03gAAAAw"]
[Thu Jan 08 00:46:22.763592 2026] [:error] [pid 50905:tid 50915] [client 4.241.224.33:12052] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aV6N3mpNgk5-gt30I7a9IAAAAkg"]
[Thu Jan 08 00:46:23.108195 2026] [:error] [pid 50905:tid 50931] [client 4.241.224.33:33615] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aV6N32pNgk5-gt30I7a9IQAAAlg"]
[Thu Jan 08 00:46:23.388998 2026] [:error] [pid 50905:tid 50925] [client 4.241.224.33:12057] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aV6N32pNgk5-gt30I7a9IgAAAlI"]
[Thu Jan 08 00:46:23.797050 2026] [:error] [pid 50838:tid 50844] [client 4.241.224.33:12148] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aV6N37SweZ27JIN4H8vpcwAAAcQ"]
[Thu Jan 08 00:46:24.186438 2026] [:error] [pid 58330:tid 58343] [client 4.241.224.33:12083] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aV6N4A8kGngKGK7_wncrZAAAAQs"]
[Thu Jan 08 00:46:24.586666 2026] [:error] [pid 58330:tid 58355] [client 4.241.224.33:11971] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aV6N4A8kGngKGK7_wncrZQAAARc"]
[Thu Jan 08 00:46:24.889770 2026] [:error] [pid 50905:tid 50920] [client 4.241.224.33:12117] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aV6N4GpNgk5-gt30I7a9JgAAAk0"]
[Thu Jan 08 00:46:25.401234 2026] [:error] [pid 51128:tid 51142] [client 4.241.224.33:12214] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aV6N4UGjtE8U88mrwufGpAAAAYw"]
[Thu Jan 08 00:46:26.006271 2026] [:error] [pid 50905:tid 50924] [client 4.241.224.33:12090] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV6N4mpNgk5-gt30I7a9KAAAAlE"]
[Thu Jan 08 00:46:26.487819 2026] [:error] [pid 30633:tid 30677] [client 4.241.224.33:12216] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV6N4vZiVWlF7303nMjUAAAAAE4"]
[Thu Jan 08 00:46:26.902343 2026] [:error] [pid 50936:tid 50959] [client 4.241.224.33:12056] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV6N4rDlg80QUdd5qc4wLQAAApU"]
[Thu Jan 08 00:46:27.302240 2026] [:error] [pid 30633:tid 30686] [client 4.241.224.33:12077] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aV6N4_ZiVWlF7303nMjUAQAAAFc"]
[Thu Jan 08 00:46:27.591671 2026] [:error] [pid 50838:tid 50852] [client 4.241.224.33:12200] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aV6N47SweZ27JIN4H8vpeQAAAcw"]
[Thu Jan 08 00:46:27.857360 2026] [:error] [pid 30633:tid 30665] [client 4.241.224.33:12033] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aV6N4_ZiVWlF7303nMjUAgAAAEI"]
[Thu Jan 08 00:46:28.172679 2026] [:error] [pid 50905:tid 50922] [client 4.241.224.33:11990] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aV6N5GpNgk5-gt30I7a9KwAAAk8"]
[Thu Jan 08 00:46:28.430004 2026] [:error] [pid 30633:tid 30676] [client 4.241.224.33:12103] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aV6N5PZiVWlF7303nMjUAwAAAE0"]
[Thu Jan 08 00:46:28.719762 2026] [:error] [pid 50905:tid 50916] [client 4.241.224.33:12153] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aV6N5GpNgk5-gt30I7a9LAAAAkk"]
[Thu Jan 08 00:46:28.962450 2026] [:error] [pid 30633:tid 30664] [client 4.241.224.33:12143] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aV6N5PZiVWlF7303nMjUBAAAAEE"]
[Thu Jan 08 00:46:29.269316 2026] [:error] [pid 58294:tid 58315] [client 4.241.224.33:12053] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aV6N5VfzA7c0ITpf3nFUwwAAAJM"]
[Thu Jan 08 00:46:29.592669 2026] [:error] [pid 30634:tid 30695] [client 4.241.224.33:12064] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aV6N5YCIPBibObtmZtsrRwAAAMU"]
[Thu Jan 08 00:46:29.873653 2026] [:error] [pid 51128:tid 51135] [client 4.241.224.33:12027] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aV6N5UGjtE8U88mrwufGqAAAAYU"]
[Thu Jan 08 00:46:30.123695 2026] [:error] [pid 51128:tid 51145] [client 4.241.224.33:12210] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aV6N5kGjtE8U88mrwufGqQAAAY8"]
[Thu Jan 08 00:46:30.391132 2026] [:error] [pid 50905:tid 50927] [client 4.241.224.33:12068] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aV6N5mpNgk5-gt30I7a9MwAAAlQ"]
[Thu Jan 08 00:46:30.660483 2026] [:error] [pid 50905:tid 50919] [client 4.241.224.33:33655] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aV6N5mpNgk5-gt30I7a9NAAAAkw"]
[Thu Jan 08 00:46:30.996652 2026] [:error] [pid 50905:tid 50924] [client 4.241.224.33:12144] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV6N5mpNgk5-gt30I7a9NQAAAlE"]
[Thu Jan 08 00:46:31.300842 2026] [:error] [pid 50936:tid 50938] [client 4.241.224.33:12128] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV6N57Dlg80QUdd5qc4wMAAAAoA"]
[Thu Jan 08 00:46:31.594266 2026] [:error] [pid 58330:tid 58336] [client 4.241.224.33:12035] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV6N5w8kGngKGK7_wncraQAAAQQ"]
[Thu Jan 08 00:46:31.867130 2026] [:error] [pid 30634:tid 30705] [client 4.241.224.33:12280] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aV6N54CIPBibObtmZtsrSAAAAM8"]
[Thu Jan 08 00:46:32.115013 2026] [:error] [pid 50905:tid 50909] [client 4.241.224.33:12038] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aV6N6GpNgk5-gt30I7a9OAAAAkI"]
[Thu Jan 08 00:46:32.361820 2026] [:error] [pid 30633:tid 30674] [client 4.241.224.33:12133] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aV6N6PZiVWlF7303nMjUCQAAAEs"]
[Thu Jan 08 00:46:32.682732 2026] [:error] [pid 50905:tid 50910] [client 4.241.224.33:12154] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aV6N6GpNgk5-gt30I7a9OgAAAkM"]
[Thu Jan 08 00:46:32.952819 2026] [:error] [pid 51128:tid 51130] [client 4.241.224.33:12158] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aV6N6EGjtE8U88mrwufGswAAAYA"]
[Thu Jan 08 00:46:33.210174 2026] [:error] [pid 50870:tid 50875] [client 4.241.224.33:12123] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV6N6RlePfspAt1BzouTTwAAAgM"]
[Thu Jan 08 00:46:33.463774 2026] [:error] [pid 51128:tid 51154] [client 4.241.224.33:12011] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV6N6UGjtE8U88mrwufGtAAAAZg"]
[Thu Jan 08 00:46:33.771367 2026] [:error] [pid 30634:tid 30702] [client 4.241.224.33:11972] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV6N6YCIPBibObtmZtsrTQAAAMw"]
[Thu Jan 08 00:46:34.008164 2026] [:error] [pid 51128:tid 51153] [client 4.241.224.33:12157] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aV6N6kGjtE8U88mrwufGtQAAAZc"]
[Thu Jan 08 00:46:34.283775 2026] [:error] [pid 51128:tid 51145] [client 4.241.224.33:12040] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aV6N6kGjtE8U88mrwufGtgAAAY8"]
[Thu Jan 08 00:46:34.641877 2026] [:error] [pid 50936:tid 50956] [client 4.241.224.33:12089] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aV6N6rDlg80QUdd5qc4wNQAAApI"]
[Thu Jan 08 00:46:34.915770 2026] [:error] [pid 30634:tid 30711] [client 4.241.224.33:12044] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aV6N6oCIPBibObtmZtsrUAAAANU"]
[Thu Jan 08 00:46:35.248976 2026] [:error] [pid 51128:tid 51143] [client 4.241.224.33:12142] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aV6N60GjtE8U88mrwufGuAAAAY0"]
[Thu Jan 08 00:46:35.522428 2026] [:error] [pid 58330:tid 58340] [client 4.241.224.33:11994] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aV6N6w8kGngKGK7_wncrawAAAQg"]
[Thu Jan 08 00:46:35.892546 2026] [:error] [pid 51128:tid 51140] [client 4.241.224.33:11968] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aV6N60GjtE8U88mrwufGuwAAAYo"]
[Thu Jan 08 00:46:36.161888 2026] [:error] [pid 50905:tid 50910] [client 4.241.224.33:12070] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aV6N7GpNgk5-gt30I7a9QAAAAkM"]
[Thu Jan 08 00:46:36.469041 2026] [:error] [pid 50905:tid 50915] [client 4.241.224.33:12034] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aV6N7GpNgk5-gt30I7a9QgAAAkg"]
[Thu Jan 08 00:46:36.722621 2026] [:error] [pid 50870:tid 50893] [client 4.241.224.33:12092] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aV6N7BlePfspAt1BzouTUgAAAhU"]
[Thu Jan 08 00:46:37.017082 2026] [:error] [pid 51128:tid 51130] [client 4.241.224.33:11926] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aV6N7UGjtE8U88mrwufGvwAAAYA"]
[Thu Jan 08 00:46:37.258563 2026] [:error] [pid 50870:tid 50895] [client 4.241.224.33:12076] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aV6N7RlePfspAt1BzouTVgAAAhc"]
[Thu Jan 08 00:46:37.637062 2026] [:error] [pid 50936:tid 50955] [client 4.241.224.33:11973] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aV6N7bDlg80QUdd5qc4wOgAAApE"]
[Thu Jan 08 00:46:38.092611 2026] [:error] [pid 58330:tid 58338] [client 4.241.224.33:12060] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aV6N7g8kGngKGK7_wncrbAAAAQY"]
[Thu Jan 08 00:46:38.370368 2026] [:error] [pid 50905:tid 50912] [client 4.241.224.33:11978] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aV6N7mpNgk5-gt30I7a9QwAAAkU"]
[Thu Jan 08 00:46:38.686860 2026] [:error] [pid 50936:tid 50942] [client 4.241.224.33:12085] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aV6N7rDlg80QUdd5qc4wPAAAAoQ"]
[Thu Jan 08 00:46:38.960090 2026] [:error] [pid 30633:tid 30678] [client 4.241.224.33:12094] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aV6N7vZiVWlF7303nMjUGAAAAE8"]
[Thu Jan 08 00:46:39.460507 2026] [:error] [pid 50905:tid 50921] [client 4.241.224.33:12135] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aV6N72pNgk5-gt30I7a9SAAAAk4"]
[Thu Jan 08 00:46:39.915216 2026] [:error] [pid 50905:tid 50917] [client 4.241.224.33:11918] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aV6N72pNgk5-gt30I7a9SgAAAko"]
[Thu Jan 08 00:46:40.380486 2026] [:error] [pid 50838:tid 50843] [client 4.241.224.33:12022] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aV6N8LSweZ27JIN4H8vpfQAAAcM"]
[Thu Jan 08 00:46:40.705007 2026] [:error] [pid 50838:tid 50853] [client 4.241.224.33:12058] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aV6N8LSweZ27JIN4H8vpfgAAAc0"]
[Thu Jan 08 00:46:41.211012 2026] [:error] [pid 58294:tid 58310] [client 4.241.224.33:12075] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV6N8VfzA7c0ITpf3nFU0QAAAI4"]
[Thu Jan 08 00:46:41.524018 2026] [:error] [pid 50905:tid 50911] [client 4.241.224.33:11936] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV6N8WpNgk5-gt30I7a9TAAAAkQ"]
[Thu Jan 08 00:46:42.012734 2026] [:error] [pid 30632:tid 30648] [client 4.241.224.33:11981] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV6N8ud3_LCpBJzo02c06QAAAAw"]
[Thu Jan 08 00:46:42.763094 2026] [:error] [pid 50936:tid 50939] [client 4.241.224.33:12149] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aV6N8rDlg80QUdd5qc4wPgAAAoE"]
[Thu Jan 08 00:46:43.552660 2026] [:error] [pid 50905:tid 50914] [client 4.241.224.33:11993] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aV6N82pNgk5-gt30I7a9UQAAAkc"]
[Thu Jan 08 00:46:44.043953 2026] [:error] [pid 30634:tid 30702] [client 4.241.224.33:12008] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aV6N9ICIPBibObtmZtsrVgAAAMw"]
[Thu Jan 08 00:46:44.379425 2026] [:error] [pid 30632:tid 30660] [client 4.241.224.33:11920] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aV6N9Od3_LCpBJzo02c06wAAABg"]
[Thu Jan 08 00:46:44.861749 2026] [:error] [pid 50936:tid 50951] [client 4.241.224.33:11910] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aV6N9LDlg80QUdd5qc4wPwAAAo0"]
[Thu Jan 08 00:46:45.563363 2026] [:error] [pid 50838:tid 50856] [client 4.241.224.33:11979] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aV6N9bSweZ27JIN4H8vpgQAAAdA"]
[Thu Jan 08 00:46:46.186966 2026] [:error] [pid 58294:tid 58320] [client 4.241.224.33:11977] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aV6N9lfzA7c0ITpf3nFU3wAAAJg"]
[Thu Jan 08 00:46:46.629414 2026] [:error] [pid 30634:tid 30701] [client 4.241.224.33:12062] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aV6N9oCIPBibObtmZtsrXQAAAMs"]
[Thu Jan 08 00:46:47.155623 2026] [:error] [pid 58294:tid 58296] [client 4.241.224.33:12029] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aV6N91fzA7c0ITpf3nFU4AAAAIA"]
[Thu Jan 08 00:46:47.598138 2026] [:error] [pid 50905:tid 50911] [client 4.241.224.33:12020] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aV6N92pNgk5-gt30I7a9WwAAAkQ"]
[Thu Jan 08 00:46:48.220407 2026] [:error] [pid 50905:tid 50931] [client 4.241.224.33:11906] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aV6N-GpNgk5-gt30I7a9XgAAAlg"]
[Thu Jan 08 00:46:48.940862 2026] [:error] [pid 58330:tid 58353] [client 4.241.224.33:11905] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aV6N-A8kGngKGK7_wncrdgAAARU"]
[Thu Jan 08 00:46:49.247338 2026] [:error] [pid 50905:tid 50927] [client 4.241.224.33:11986] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aV6N-WpNgk5-gt30I7a9YQAAAlQ"]
[Thu Jan 08 00:46:49.528943 2026] [:error] [pid 58330:tid 58335] [client 4.241.224.33:12095] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aV6N-Q8kGngKGK7_wncreQAAAQM"]
[Thu Jan 08 00:46:49.773077 2026] [:error] [pid 50870:tid 50886] [client 4.241.224.33:33576] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aV6N-RlePfspAt1BzouTiAAAAg4"]
[Thu Jan 08 00:46:50.064680 2026] [:error] [pid 30634:tid 30709] [client 4.241.224.33:12002] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aV6N-oCIPBibObtmZtsrYgAAANM"]
[Thu Jan 08 00:46:50.327564 2026] [:error] [pid 50870:tid 50881] [client 4.241.224.33:12065] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aV6N-hlePfspAt1BzouTiQAAAgk"]
[Thu Jan 08 00:46:50.582603 2026] [:error] [pid 58330:tid 58340] [client 4.241.224.33:11980] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aV6N-g8kGngKGK7_wncrfQAAAQg"]
[Thu Jan 08 00:46:50.872779 2026] [:error] [pid 50936:tid 50952] [client 4.241.224.33:11925] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aV6N-rDlg80QUdd5qc4wQgAAAo4"]
[Thu Jan 08 00:46:51.180789 2026] [:error] [pid 50936:tid 50956] [client 4.241.224.33:12253] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aV6N-7Dlg80QUdd5qc4wQwAAApI"]
[Thu Jan 08 00:46:51.431742 2026] [:error] [pid 30634:tid 30713] [client 4.241.224.33:12049] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aV6N-4CIPBibObtmZtsrZQAAANc"]
[Thu Jan 08 00:46:51.751506 2026] [:error] [pid 58330:tid 58347] [client 4.241.224.33:11995] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aV6N-w8kGngKGK7_wncrgQAAAQ8"]
[Thu Jan 08 00:46:52.012342 2026] [:error] [pid 51128:tid 51151] [client 4.241.224.33:12134] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aV6N_EGjtE8U88mrwufG1wAAAZU"]
[Thu Jan 08 00:46:52.281947 2026] [:error] [pid 30633:tid 30666] [client 4.241.224.33:12061] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aV6N_PZiVWlF7303nMjULgAAAEM"]
[Thu Jan 08 00:46:52.595785 2026] [:error] [pid 50905:tid 50923] [client 4.241.224.33:11991] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aV6N_GpNgk5-gt30I7a9YgAAAlA"]
[Thu Jan 08 00:46:52.955741 2026] [:error] [pid 50870:tid 50879] [client 4.241.224.33:12014] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV6N_BlePfspAt1BzouTjAAAAgc"]
[Thu Jan 08 00:46:53.231163 2026] [:error] [pid 58294:tid 58300] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Jan 08 00:46:53.358032 2026] [:error] [pid 58294:tid 58317] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Thu Jan 08 00:46:53.476071 2026] [:error] [pid 58294:tid 58303] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Thu Jan 08 00:46:53.618909 2026] [:error] [pid 58294:tid 58299] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Thu Jan 08 00:46:53.747204 2026] [:error] [pid 58294:tid 58311] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Thu Jan 08 00:46:53.861704 2026] [:error] [pid 58294:tid 58319] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Thu Jan 08 00:46:53.986705 2026] [:error] [pid 58294:tid 58298] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Thu Jan 08 00:46:54.105612 2026] [:error] [pid 58294:tid 58296] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Thu Jan 08 00:46:54.224281 2026] [:error] [pid 58294:tid 58313] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Thu Jan 08 00:46:54.354060 2026] [:error] [pid 58294:tid 58306] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Jan 08 00:46:54.470822 2026] [:error] [pid 58294:tid 58304] [client 4.241.224.33:11984] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Thu Jan 08 00:46:54.650880 2026] [:error] [pid 58294:tid 58316] [client 4.241.224.33:11984] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aV6N_lfzA7c0ITpf3nFU8wAAAJQ"]
[Thu Jan 08 00:46:54.945145 2026] [:error] [pid 30634:tid 30703] [client 4.241.224.33:12059] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aV6N_oCIPBibObtmZtsraAAAAM0"]
[Thu Jan 08 00:46:55.218491 2026] [:error] [pid 58294:tid 58310] [client 4.241.224.33:11930] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aV6N_1fzA7c0ITpf3nFU9wAAAI4"]
[Thu Jan 08 00:46:55.464145 2026] [:error] [pid 58330:tid 58342] [client 4.241.224.33:12093] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aV6N_w8kGngKGK7_wncriAAAAQo"]
[Thu Jan 08 00:46:55.726761 2026] [:error] [pid 50905:tid 50915] [client 4.241.224.33:12088] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aV6N_2pNgk5-gt30I7a9ZAAAAkg"]
[Thu Jan 08 00:46:56.026761 2026] [:error] [pid 50870:tid 50877] [client 4.241.224.33:11956] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aV6OABlePfspAt1BzouTjgAAAgU"]
[Thu Jan 08 00:46:56.407094 2026] [:error] [pid 50936:tid 50942] [client 4.241.224.33:12137] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aV6OALDlg80QUdd5qc4wRwAAAoQ"]
[Thu Jan 08 00:46:56.674410 2026] [:error] [pid 58294:tid 58302] [client 4.241.224.33:12030] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "aV6OAFfzA7c0ITpf3nFU-wAAAIY"]
[Thu Jan 08 00:46:57.077841 2026] [:error] [pid 58294:tid 58314] [client 4.241.224.33:12202] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aV6OAVfzA7c0ITpf3nFU_AAAAJI"]
[Thu Jan 08 00:46:57.330877 2026] [:error] [pid 30633:tid 30667] [client 4.241.224.33:11964] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aV6OAfZiVWlF7303nMjULwAAAEQ"]
[Thu Jan 08 00:46:57.593307 2026] [:error] [pid 30632:tid 30650] [client 4.241.224.33:12028] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aV6OAed3_LCpBJzo02c07wAAAA4"]
[Thu Jan 08 00:46:57.878399 2026] [:error] [pid 50838:tid 50848] [client 4.241.224.33:11954] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aV6OAbSweZ27JIN4H8vpigAAAcg"]
[Thu Jan 08 00:46:58.176117 2026] [:error] [pid 58330:tid 58351] [client 4.241.224.33:12031] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aV6OAg8kGngKGK7_wncrjAAAARM"]
[Thu Jan 08 00:46:58.459978 2026] [:error] [pid 30633:tid 30675] [client 4.241.224.33:12024] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aV6OAvZiVWlF7303nMjUMgAAAEw"]
[Thu Jan 08 00:46:58.881890 2026] [:error] [pid 50870:tid 50891] [client 4.241.224.33:11996] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aV6OAhlePfspAt1BzouTjwAAAhM"]
[Thu Jan 08 00:46:59.220934 2026] [:error] [pid 50870:tid 50888] [client 4.241.224.33:11985] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aV6OAxlePfspAt1BzouTkgAAAhA"]
[Thu Jan 08 00:46:59.544622 2026] [:error] [pid 50870:tid 50887] [client 4.241.224.33:11921] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aV6OAxlePfspAt1BzouTlgAAAg8"]
[Thu Jan 08 00:46:59.807240 2026] [:error] [pid 51128:tid 51145] [client 4.241.224.33:11947] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aV6OA0GjtE8U88mrwufG5gAAAY8"]
[Thu Jan 08 00:47:00.097588 2026] [:error] [pid 50838:tid 50855] [client 4.241.224.33:11957] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aV6OBLSweZ27JIN4H8vpjgAAAc8"]
[Thu Jan 08 00:47:00.413320 2026] [:error] [pid 58294:tid 58320] [client 4.241.224.33:11916] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aV6OBFfzA7c0ITpf3nFU_wAAAJg"]
[Thu Jan 08 00:47:00.738122 2026] [:error] [pid 50905:tid 50926] [client 4.241.224.33:11934] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aV6OBGpNgk5-gt30I7a9ZwAAAlM"]
[Thu Jan 08 00:47:01.081424 2026] [:error] [pid 30632:tid 30655] [client 4.241.224.33:12086] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aV6OBed3_LCpBJzo02c08wAAABM"]
[Thu Jan 08 00:47:01.394772 2026] [:error] [pid 50838:tid 50851] [client 4.241.224.33:11908] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aV6OBbSweZ27JIN4H8vpkAAAAcs"]
[Thu Jan 08 00:47:01.686831 2026] [:error] [pid 51128:tid 51140] [client 4.241.224.33:12007] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aV6OBUGjtE8U88mrwufG6QAAAYo"]
[Thu Jan 08 00:47:01.953059 2026] [:error] [pid 30634:tid 30694] [client 4.241.224.33:12079] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aV6OBYCIPBibObtmZtsrawAAAMQ"]
[Thu Jan 08 00:47:02.197761 2026] [:error] [pid 50936:tid 50951] [client 4.241.224.33:11951] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aV6OBrDlg80QUdd5qc4wTAAAAo0"]
[Thu Jan 08 00:47:02.448000 2026] [:error] [pid 30634:tid 30709] [client 4.241.224.33:11997] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aV6OBoCIPBibObtmZtsrbAAAANM"]
[Thu Jan 08 00:47:02.796266 2026] [:error] [pid 50838:tid 50844] [client 4.241.224.33:12050] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aV6OBrSweZ27JIN4H8vpkwAAAcQ"]
[Thu Jan 08 00:47:03.181406 2026] [:error] [pid 58330:tid 58333] [client 4.241.224.33:12019] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aV6OBw8kGngKGK7_wncrlAAAAQE"]
[Thu Jan 08 00:47:03.504119 2026] [:error] [pid 50838:tid 50863] [client 4.241.224.33:11898] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aV6OB7SweZ27JIN4H8vplAAAAdc"]
[Thu Jan 08 00:47:03.790276 2026] [:error] [pid 50838:tid 50862] [client 4.241.224.33:11917] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aV6OB7SweZ27JIN4H8vplQAAAdY"]
[Thu Jan 08 00:47:04.026590 2026] [:error] [pid 50936:tid 50946] [client 4.241.224.33:12000] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aV6OCLDlg80QUdd5qc4wTQAAAog"]
[Thu Jan 08 00:47:04.270845 2026] [:error] [pid 50936:tid 50961] [client 4.241.224.33:12025] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aV6OCLDlg80QUdd5qc4wTwAAApc"]
[Thu Jan 08 00:47:04.627148 2026] [:error] [pid 50905:tid 50930] [client 4.241.224.33:11992] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aV6OCGpNgk5-gt30I7a9bQAAAlc"]
[Thu Jan 08 00:47:04.961028 2026] [:error] [pid 51128:tid 51146] [client 4.241.224.33:11976] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aV6OCEGjtE8U88mrwufG7wAAAZA"]
[Thu Jan 08 00:47:05.343154 2026] [:error] [pid 30634:tid 30698] [client 4.241.224.33:12156] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aV6OCYCIPBibObtmZtsrcAAAAMg"]
[Thu Jan 08 00:47:05.627826 2026] [:error] [pid 50905:tid 50910] [client 4.241.224.33:12005] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aV6OCWpNgk5-gt30I7a9bwAAAkM"]
[Thu Jan 08 00:47:05.900953 2026] [:error] [pid 50936:tid 50950] [client 4.241.224.33:11998] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aV6OCbDlg80QUdd5qc4wUAAAAow"]
[Thu Jan 08 00:47:06.344665 2026] [:error] [pid 30633:tid 30669] [client 4.241.224.33:11904] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aV6OCvZiVWlF7303nMjUNQAAAEY"]
[Thu Jan 08 00:47:06.692587 2026] [:error] [pid 50870:tid 50876] [client 4.241.224.33:12023] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aV6OChlePfspAt1BzouTmAAAAgQ"]
[Thu Jan 08 00:47:07.030084 2026] [:error] [pid 50936:tid 50955] [client 4.241.224.33:12087] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aV6OC7Dlg80QUdd5qc4wUgAAApE"]
[Thu Jan 08 00:47:07.459325 2026] [:error] [pid 58294:tid 58309] [client 4.241.224.33:12013] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aV6OC1fzA7c0ITpf3nFVAQAAAI0"]
[Thu Jan 08 00:47:07.813394 2026] [:error] [pid 50838:tid 50864] [client 4.241.224.33:12012] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aV6OC7SweZ27JIN4H8vpmQAAAdg"]
[Thu Jan 08 00:47:08.115798 2026] [:error] [pid 50870:tid 50882] [client 4.241.224.33:11850] [client 4.241.224.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aV6ODBlePfspAt1BzouTnAAAAgo"]
[Thu Jan 08 01:20:21.692770 2026] [:error] [pid 50905:tid 50916] [client 138.197.32.240:56227] [client 138.197.32.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/"] [unique_id "aV6V1WpNgk5-gt30I7bKbQAAAkk"], referer: binance.com
[Thu Jan 08 01:20:30.713370 2026] [:error] [pid 58294:tid 58309] [client 138.197.32.240:50153] [client 138.197.32.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aV6V3lfzA7c0ITpf3nFe6wAAAI0"], referer: binance.com
[Thu Jan 08 01:20:38.659880 2026] [:error] [pid 30632:tid 30651] [client 138.197.32.240:56719] [client 138.197.32.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aV6V5ud3_LCpBJzo02c84gAAAA8"], referer: binance.com
[Thu Jan 08 04:13:19.427193 2026] [:error] [pid 15264:tid 15305] [client 146.235.18.147:60058] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV6-X4ov6_kvS0Owh-pb8gAAAEY"], referer: https://www.bing.com/
[Thu Jan 08 04:13:19.431463 2026] [:error] [pid 15264:tid 15305] [client 146.235.18.147:60058] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.bing.com/
[Thu Jan 08 04:13:19.796384 2026] [:error] [pid 15265:tid 15349] [client 146.235.18.147:64284] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV6-X6E6VBKhew2LTFR6NAAAAJc"], referer: https://www.google.com/
[Thu Jan 08 04:13:19.800218 2026] [:error] [pid 15265:tid 15349] [client 146.235.18.147:64284] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Thu Jan 08 04:13:20.816034 2026] [:error] [pid 15265:tid 15326] [client 146.235.18.147:64969] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV6-YKE6VBKhew2LTFR6OwAAAIA"]
[Thu Jan 08 04:13:20.821933 2026] [:error] [pid 15265:tid 15326] [client 146.235.18.147:64969] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Jan 08 04:13:21.196006 2026] [:error] [pid 15264:tid 15301] [client 146.235.18.147:60777] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV6-YYov6_kvS0Owh-pb9gAAAEI"], referer: https://wordpress.org/
[Thu Jan 08 04:13:21.199894 2026] [:error] [pid 15264:tid 15301] [client 146.235.18.147:60777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://wordpress.org/
[Thu Jan 08 05:30:16.701156 2026] [:error] [pid 2424:tid 2431] [client 49.145.221.178:18550] [client 49.145.221.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.221.178, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aV7QaLTDJR8aofkBk9RblgAAAQU"]
[Thu Jan 08 05:30:16.707068 2026] [:error] [pid 2424:tid 2431] [client 49.145.221.178:18550] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Jan 08 09:50:08.002769 2026] [:error] [pid 2424:tid 2442] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php, referer: https://www.google.com/
[Thu Jan 08 09:50:08.170904 2026] [:error] [pid 2424:tid 2430] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:08.291591 2026] [:error] [pid 2424:tid 2445] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:08.433441 2026] [:error] [pid 2424:tid 2449] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:08.553668 2026] [:error] [pid 2424:tid 2441] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:08.677699 2026] [:error] [pid 2424:tid 2444] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:08.812286 2026] [:error] [pid 2424:tid 2434] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:08.951860 2026] [:error] [pid 2424:tid 2427] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:09.073155 2026] [:error] [pid 2424:tid 2439] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.de/
[Thu Jan 08 09:50:09.195234 2026] [:error] [pid 2424:tid 2438] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.de/
[Thu Jan 08 09:50:09.334711 2026] [:error] [pid 2424:tid 2447] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.com/
[Thu Jan 08 09:50:09.482069 2026] [:error] [pid 2424:tid 2436] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:09.608538 2026] [:error] [pid 2424:tid 2426] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-header.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:10.364739 2026] [:error] [pid 2424:tid 2428] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:10.486073 2026] [:error] [pid 2424:tid 2433] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:10.613902 2026] [:error] [pid 2424:tid 2448] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:10.735074 2026] [:error] [pid 2424:tid 2446] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/alf.php, referer: https://www.google.de/
[Thu Jan 08 09:50:10.867707 2026] [:error] [pid 2424:tid 2429] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:13.740444 2026] [:error] [pid 2424:tid 2435] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:13.860828 2026] [:error] [pid 2424:tid 2450] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:13.982134 2026] [:error] [pid 2424:tid 2443] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:14.102278 2026] [:error] [pid 2424:tid 2440] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:14.518324 2026] [:error] [pid 2424:tid 2432] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:14.781466 2026] [:error] [pid 2424:tid 2432] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.google.de/
[Thu Jan 08 09:50:14.968416 2026] [:error] [pid 2424:tid 2437] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:15.514577 2026] [:error] [pid 2424:tid 2431] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:15.767577 2026] [:error] [pid 2424:tid 2442] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.google.de/
[Thu Jan 08 09:50:15.895580 2026] [:error] [pid 2424:tid 2445] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.com/
[Thu Jan 08 09:50:16.063035 2026] [:error] [pid 2424:tid 2449] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php, referer: https://www.google.com/
[Thu Jan 08 09:50:16.184417 2026] [:error] [pid 2424:tid 2441] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php, referer: https://www.google.com/
[Thu Jan 08 09:50:16.318679 2026] [:error] [pid 2424:tid 2444] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:16.439772 2026] [:error] [pid 2424:tid 2434] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:16.591836 2026] [:error] [pid 2424:tid 2427] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/ee.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:16.713341 2026] [:error] [pid 2424:tid 2439] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/favicon.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:16.834525 2026] [:error] [pid 2424:tid 2438] [client 20.24.67.181:3349] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:18.399758 2026] [:error] [pid 2424:tid 2438] [client 20.24.67.181:3349] [client 20.24.67.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aV8NWrTDJR8aofkBk9SNmQAAAQw"], referer: https://www.bing.com/
[Thu Jan 08 09:50:19.341657 2026] [:error] [pid 15263:tid 15275] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/fx.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:19.463457 2026] [:error] [pid 15263:tid 15273] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php, referer: https://www.google.de/
[Thu Jan 08 09:50:19.600458 2026] [:error] [pid 15263:tid 15291] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko-new.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:19.737055 2026] [:error] [pid 15263:tid 15296] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php, referer: https://www.google.de/
[Thu Jan 08 09:50:20.194263 2026] [:error] [pid 15263:tid 15287] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:20.317995 2026] [:error] [pid 15263:tid 15278] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:20.449675 2026] [:error] [pid 15263:tid 15286] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/help.php, referer: https://www.google.com/
[Thu Jan 08 09:50:20.606360 2026] [:error] [pid 15263:tid 15295] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:20.728536 2026] [:error] [pid 15263:tid 15284] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:20.850006 2026] [:error] [pid 15263:tid 15294] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:20.973387 2026] [:error] [pid 15263:tid 15293] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:21.099621 2026] [:error] [pid 15263:tid 15280] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:21.227975 2026] [:error] [pid 15263:tid 15274] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:21.393001 2026] [:error] [pid 15263:tid 15279] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/man.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:22.297662 2026] [:error] [pid 15263:tid 15283] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:22.845630 2026] [:error] [pid 15263:tid 15276] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.de/
[Thu Jan 08 09:50:23.207830 2026] [:error] [pid 15263:tid 15282] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:23.329169 2026] [:error] [pid 15263:tid 15289] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/root.php, referer: https://www.google.com/
[Thu Jan 08 09:50:23.509673 2026] [:error] [pid 15263:tid 15285] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php, referer: https://www.google.de/
[Thu Jan 08 09:50:23.630478 2026] [:error] [pid 15263:tid 15292] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php, referer: https://www.google.de/
[Thu Jan 08 09:50:23.751214 2026] [:error] [pid 15263:tid 15275] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/termps.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:23.872083 2026] [:error] [pid 15263:tid 15273] [client 20.24.67.181:4242] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:24.469516 2026] [:error] [pid 15263:tid 15277] [client 20.24.67.181:4242] [client 20.24.67.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aV8NYNv61bxum7WG_e-XfgAAAAU"], referer: https://www.google.de/
[Thu Jan 08 09:50:27.869476 2026] [:error] [pid 17404:tid 17419] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php, referer: https://www.bing.com/
[Thu Jan 08 09:50:27.990622 2026] [:error] [pid 17404:tid 17407] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php, referer: https://www.google.de/
[Thu Jan 08 09:50:28.111376 2026] [:error] [pid 17404:tid 17414] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:28.235417 2026] [:error] [pid 17404:tid 17428] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:28.356204 2026] [:error] [pid 17404:tid 17411] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:28.476604 2026] [:error] [pid 17404:tid 17408] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-include.php, referer: https://www.google.fr/
[Thu Jan 08 09:50:28.598672 2026] [:error] [pid 17404:tid 17422] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:28.744128 2026] [:error] [pid 17404:tid 17423] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php, referer: https://www.google.com/
[Thu Jan 08 09:50:28.866949 2026] [:error] [pid 17404:tid 17409] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:29.051872 2026] [:error] [pid 17404:tid 17421] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://duckduckgo.com/
[Thu Jan 08 09:50:29.189591 2026] [:error] [pid 17404:tid 17416] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php, referer: https://www.google.co.uk/
[Thu Jan 08 09:50:29.317288 2026] [:error] [pid 17404:tid 17424] [client 20.24.67.181:1482] [client 20.24.67.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.24.67.181, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aV8NZWVd_oH193N6AnVI9AAAAZI"], referer: https://www.yahoo.com/
[Thu Jan 08 09:50:29.322441 2026] [:error] [pid 17404:tid 17424] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://www.yahoo.com/
[Thu Jan 08 09:50:29.455837 2026] [:error] [pid 17404:tid 17429] [client 20.24.67.181:1482] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.de/
[Thu Jan 08 10:27:23.699443 2026] [:error] [pid 15263:tid 15281] [client 103.77.107.178:54471] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aV8WC9v61bxum7WG_e-fmgAAAAk"]
[Fri Jan 09 01:56:05.450541 2026] [:error] [pid 15265:tid 15331] [client 20.89.218.83:16870] File does not exist: /usr/local/apache/htdocs/suspended-page/mad.php
[Fri Jan 09 01:56:05.953638 2026] [:error] [pid 15265:tid 15329] [client 20.89.218.83:16870] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Fri Jan 09 01:56:06.077817 2026] [:error] [pid 15265:tid 15328] [client 20.89.218.83:16870] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Jan 09 01:56:06.333726 2026] [:error] [pid 15265:tid 15345] [client 20.89.218.83:16870] File does not exist: /usr/local/apache/htdocs/suspended-page/7x.php
[Fri Jan 09 01:56:06.457324 2026] [:error] [pid 15265:tid 15338] [client 20.89.218.83:16870] File does not exist: /usr/local/apache/htdocs/suspended-page/x7.php
[Fri Jan 09 01:56:06.814455 2026] [:error] [pid 15265:tid 15330] [client 20.89.218.83:16870] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri Jan 09 01:56:06.939273 2026] [:error] [pid 15265:tid 15348] [client 20.89.218.83:16870] File does not exist: /usr/local/apache/htdocs/suspended-page/anon.php
[Fri Jan 09 01:56:07.060278 2026] [:error] [pid 15265:tid 15341] [client 20.89.218.83:16870] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anonymous.php"] [unique_id "aV_vt6E6VBKhew2LTFSJCwAAAI8"]
[Fri Jan 09 01:56:07.919151 2026] [:error] [pid 13673:tid 13686] [client 20.89.218.83:16879] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anonymous.php"] [unique_id "aV_vt4D4ue0-noJ7SHPAOAAAAgs"]
[Fri Jan 09 01:56:08.250834 2026] [:error] [pid 15264:tid 15302] [client 20.89.218.83:16849] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anonymous.php"] [unique_id "aV_vuIov6_kvS0Owh-pFbAAAAEM"]
[Fri Jan 09 01:56:08.751241 2026] [:error] [pid 15263:tid 15282] [client 20.89.218.83:16775] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anonymous.php"] [unique_id "aV_vuNv61bxum7WG_e881wAAAAo"]
[Fri Jan 09 01:56:09.345339 2026] [:error] [pid 15263:tid 15276] [client 20.89.218.83:16872] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aV_vudv61bxum7WG_e882gAAAAQ"]
[Fri Jan 09 01:56:09.854155 2026] [:error] [pid 15358:tid 15378] [client 20.89.218.83:16873] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aV_vuSoRk9xWJ3toSBK-mQAAAMg"]
[Fri Jan 09 01:56:10.829782 2026] [:error] [pid 2484:tid 2490] [client 20.89.218.83:16855] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aV_vujiDlnlaQQK_AEPf-wAAAUQ"]
[Fri Jan 09 01:56:11.168834 2026] [:error] [pid 15264:tid 15322] [client 20.89.218.83:16881] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aV_vu4ov6_kvS0Owh-pFcQAAAFc"]
[Fri Jan 09 01:56:11.796961 2026] [:error] [pid 15265:tid 15349] [client 20.89.218.83:16851] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aV_vu6E6VBKhew2LTFSJDgAAAJc"]
[Fri Jan 09 01:56:12.288674 2026] [:error] [pid 15263:tid 15284] [client 20.89.218.83:16862] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aV_vvNv61bxum7WG_e883gAAAAw"]
[Fri Jan 09 01:56:13.596350 2026] [:error] [pid 15358:tid 15390] [client 20.89.218.83:16894] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aV_vvSoRk9xWJ3toSBK-nQAAANQ"]
[Fri Jan 09 01:56:14.442159 2026] [:error] [pid 7586:tid 7610] [client 20.89.218.83:16891] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "aV_vvsJyk37GdXP5TmWj8AAAAdQ"]
[Fri Jan 09 01:56:15.136140 2026] [:error] [pid 17404:tid 17414] [client 20.89.218.83:16884] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/madspotshell.php"] [unique_id "aV_vv2Vd_oH193N6AnX7yAAAAYg"]
[Fri Jan 09 01:56:15.919204 2026] [:error] [pid 15263:tid 15282] [client 20.89.218.83:16795] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/madspotshell.php"] [unique_id "aV_vv9v61bxum7WG_e886QAAAAo"]
[Fri Jan 09 01:56:16.382347 2026] [:error] [pid 2424:tid 2446] [client 20.89.218.83:16820] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/madspotshell.php"] [unique_id "aV_vwLTDJR8aofkBk9RvrAAAARQ"]
[Fri Jan 09 01:56:17.359811 2026] [:error] [pid 15263:tid 15290] [client 20.89.218.83:16843] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/madspotshell.php"] [unique_id "aV_vwdv61bxum7WG_e886wAAABI"]
[Fri Jan 09 01:56:18.323630 2026] [:error] [pid 2424:tid 2450] [client 20.89.218.83:11217] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b374k.php"] [unique_id "aV_vwrTDJR8aofkBk9RvtQAAARg"]
[Fri Jan 09 01:56:19.379283 2026] [:error] [pid 13673:tid 13698] [client 20.89.218.83:16840] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b374k.php"] [unique_id "aV_vw4D4ue0-noJ7SHPAPAAAAhc"]
[Fri Jan 09 01:56:20.133703 2026] [:error] [pid 13673:tid 13685] [client 20.89.218.83:16799] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b374k.php"] [unique_id "aV_vxID4ue0-noJ7SHPAQgAAAgo"]
[Fri Jan 09 01:56:20.705945 2026] [:error] [pid 2424:tid 2433] [client 20.89.218.83:16791] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b374k.php"] [unique_id "aV_vxLTDJR8aofkBk9RvvQAAAQc"]
[Fri Jan 09 01:56:21.437522 2026] [:error] [pid 13673:tid 13688] [client 20.89.218.83:16876] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c100.php"] [unique_id "aV_vxYD4ue0-noJ7SHPARQAAAg0"]
[Fri Jan 09 01:56:22.162444 2026] [:error] [pid 15358:tid 15386] [client 20.89.218.83:16792] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c100.php"] [unique_id "aV_vxioRk9xWJ3toSBK-pgAAANA"]
[Fri Jan 09 01:56:23.666894 2026] [:error] [pid 17404:tid 17411] [client 20.89.218.83:16883] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c100.php"] [unique_id "aV_vx2Vd_oH193N6AnX71AAAAYU"]
[Fri Jan 09 01:56:24.309393 2026] [:error] [pid 2484:tid 2490] [client 20.89.218.83:16825] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c100.php"] [unique_id "aV_vyDiDlnlaQQK_AEPgBwAAAUQ"]
[Fri Jan 09 01:56:25.036884 2026] [:error] [pid 17404:tid 17425] [client 20.89.218.83:16790] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aV_vyWVd_oH193N6AnX71wAAAZM"]
[Fri Jan 09 01:56:25.696122 2026] [:error] [pid 17404:tid 17430] [client 20.89.218.83:16836] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aV_vyWVd_oH193N6AnX72gAAAZg"]
[Fri Jan 09 01:56:26.129018 2026] [:error] [pid 15265:tid 15330] [client 20.89.218.83:16797] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aV_vyqE6VBKhew2LTFSJGgAAAIQ"]
[Fri Jan 09 01:56:26.424162 2026] [:error] [pid 17404:tid 17426] [client 20.89.218.83:16793] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/priv8.php"] [unique_id "aV_vymVd_oH193N6AnX73AAAAZQ"]
[Fri Jan 09 01:56:26.754082 2026] [:error] [pid 15358:tid 15377] [client 20.89.218.83:16860] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/private.php"] [unique_id "aV_vyioRk9xWJ3toSBK-rQAAAMc"]
[Fri Jan 09 01:56:27.573243 2026] [:error] [pid 2424:tid 2432] [client 20.89.218.83:16802] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/private.php"] [unique_id "aV_vy7TDJR8aofkBk9RvxgAAAQY"]
[Fri Jan 09 01:56:28.734544 2026] [:error] [pid 15263:tid 15288] [client 20.89.218.83:16817] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/private.php"] [unique_id "aV_vzNv61bxum7WG_e889AAAABA"]
[Fri Jan 09 01:56:29.293491 2026] [:error] [pid 15358:tid 15387] [client 20.89.218.83:11237] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/private.php"] [unique_id "aV_vzSoRk9xWJ3toSBK-sAAAANE"]
[Fri Jan 09 01:56:29.902499 2026] [:error] [pid 2424:tid 2448] [client 20.89.218.83:16864] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV_vzbTDJR8aofkBk9RvzQAAARY"]
[Fri Jan 09 01:56:30.694754 2026] [:error] [pid 15263:tid 15294] [client 20.89.218.83:16780] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV_vztv61bxum7WG_e889gAAABY"]
[Fri Jan 09 01:56:31.475264 2026] [:error] [pid 15265:tid 15331] [client 20.89.218.83:16781] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV_vz6E6VBKhew2LTFSJIQAAAIU"]
[Fri Jan 09 01:56:31.915059 2026] [:error] [pid 15265:tid 15346] [client 20.89.218.83:16888] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aV_vz6E6VBKhew2LTFSJJAAAAJQ"]
[Fri Jan 09 01:56:32.807870 2026] [:error] [pid 7586:tid 7604] [client 20.89.218.83:16768] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV_v0MJyk37GdXP5TmWkAQAAAc4"]
[Fri Jan 09 01:56:33.228814 2026] [:error] [pid 2484:tid 2493] [client 20.89.218.83:16847] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV_v0TiDlnlaQQK_AEPgDAAAAUY"]
[Fri Jan 09 01:56:33.675902 2026] [:error] [pid 2484:tid 2494] [client 20.89.218.83:16882] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV_v0TiDlnlaQQK_AEPgDgAAAUc"]
[Fri Jan 09 01:56:34.285395 2026] [:error] [pid 2424:tid 2428] [client 20.89.218.83:16886] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV_v0rTDJR8aofkBk9Rv1AAAAQI"]
[Fri Jan 09 01:56:34.898859 2026] [:error] [pid 2424:tid 2426] [client 20.89.218.83:16832] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aV_v0rTDJR8aofkBk9Rv1QAAAQA"]
[Fri Jan 09 01:56:35.752691 2026] [:error] [pid 15264:tid 15311] [client 20.89.218.83:16776] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aV_v04ov6_kvS0Owh-pFhgAAAEw"]
[Fri Jan 09 01:56:36.220078 2026] [:error] [pid 2484:tid 2510] [client 20.89.218.83:16800] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aV_v1DiDlnlaQQK_AEPgEgAAAVY"]
[Fri Jan 09 01:56:36.833845 2026] [:error] [pid 2424:tid 2440] [client 20.89.218.83:16859] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aV_v1LTDJR8aofkBk9Rv2wAAAQ4"]
[Fri Jan 09 01:56:37.196789 2026] [:error] [pid 2484:tid 2497] [client 20.89.218.83:16770] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aV_v1TiDlnlaQQK_AEPgEwAAAUo"]
[Fri Jan 09 01:56:37.630147 2026] [:error] [pid 15358:tid 15376] [client 20.89.218.83:11205] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aV_v1SoRk9xWJ3toSBK-swAAAMY"]
[Fri Jan 09 01:56:38.224238 2026] [:error] [pid 15358:tid 15379] [client 20.89.218.83:16844] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aV_v1ioRk9xWJ3toSBK-tgAAAMk"]
[Fri Jan 09 01:56:38.632665 2026] [:error] [pid 13673:tid 13681] [client 20.89.218.83:16834] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aV_v1oD4ue0-noJ7SHPAYAAAAgY"]
[Fri Jan 09 01:56:39.018914 2026] [:error] [pid 2484:tid 2495] [client 20.89.218.83:16839] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV_v1ziDlnlaQQK_AEPgFwAAAUg"]
[Fri Jan 09 01:56:39.628420 2026] [:error] [pid 17404:tid 17414] [client 20.89.218.83:11222] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV_v12Vd_oH193N6AnX75gAAAYg"]
[Fri Jan 09 01:56:40.122982 2026] [:error] [pid 13673:tid 13679] [client 20.89.218.83:16848] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV_v2ID4ue0-noJ7SHPAZwAAAgQ"]
[Fri Jan 09 01:56:40.675456 2026] [:error] [pid 2484:tid 2509] [client 20.89.218.83:16828] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aV_v2DiDlnlaQQK_AEPgGgAAAVU"]
[Fri Jan 09 01:56:41.398177 2026] [:error] [pid 15263:tid 15273] [client 20.89.218.83:16856] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/upfile.php"] [unique_id "aV_v2dv61bxum7WG_e89AQAAAAE"]
[Fri Jan 09 01:56:41.803895 2026] [:error] [pid 15263:tid 15275] [client 20.89.218.83:16788] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/upfile.php"] [unique_id "aV_v2dv61bxum7WG_e89AwAAAAM"]
[Fri Jan 09 01:56:42.211837 2026] [:error] [pid 7586:tid 7610] [client 20.89.218.83:16773] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/upfile.php"] [unique_id "aV_v2sJyk37GdXP5TmWkDAAAAdQ"]
[Fri Jan 09 01:56:42.747773 2026] [:error] [pid 17404:tid 17417] [client 20.89.218.83:16889] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/upfile.php"] [unique_id "aV_v2mVd_oH193N6AnX76wAAAYs"]
[Fri Jan 09 01:56:43.280570 2026] [:error] [pid 17404:tid 17413] [client 20.89.218.83:16789] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/userfiles/files/u.php7"] [unique_id "aV_v22Vd_oH193N6AnX77gAAAYc"]
[Fri Jan 09 01:56:43.779977 2026] [:error] [pid 2424:tid 2437] [client 20.89.218.83:16831] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/userfiles/files/u.php7"] [unique_id "aV_v27TDJR8aofkBk9Rv4AAAAQs"]
[Fri Jan 09 01:56:44.546386 2026] [:error] [pid 2424:tid 2439] [client 20.89.218.83:16867] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/userfiles/files/u.php7"] [unique_id "aV_v3LTDJR8aofkBk9Rv4gAAAQ0"]
[Fri Jan 09 01:56:44.905000 2026] [:error] [pid 17404:tid 17421] [client 20.89.218.83:16877] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/userfiles/files/u.php7"] [unique_id "aV_v3GVd_oH193N6AnX78AAAAY8"]
[Fri Jan 09 01:56:45.501295 2026] [:error] [pid 13673:tid 13692] [client 20.89.218.83:16858] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aV_v3YD4ue0-noJ7SHPAagAAAhE"]
[Fri Jan 09 01:56:45.915117 2026] [:error] [pid 2424:tid 2428] [client 20.89.218.83:16794] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aV_v3bTDJR8aofkBk9Rv5AAAAQI"]
[Fri Jan 09 01:56:46.276687 2026] [:error] [pid 2424:tid 2426] [client 20.89.218.83:16854] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aV_v3rTDJR8aofkBk9Rv5QAAAQA"]
[Fri Jan 09 01:56:46.611075 2026] [:error] [pid 2424:tid 2432] [client 20.89.218.83:16824] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aV_v3rTDJR8aofkBk9Rv5gAAAQY"]
[Fri Jan 09 01:56:47.201145 2026] [:error] [pid 17404:tid 17409] [client 20.89.218.83:11216] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV_v32Vd_oH193N6AnX78gAAAYM"]
[Fri Jan 09 01:56:47.701508 2026] [:error] [pid 15265:tid 15339] [client 20.89.218.83:16857] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV_v36E6VBKhew2LTFSJKwAAAI0"]
[Fri Jan 09 01:56:48.088768 2026] [:error] [pid 15263:tid 15288] [client 20.89.218.83:16778] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV_v4Nv61bxum7WG_e89FgAAABA"]
[Fri Jan 09 01:56:48.519463 2026] [:error] [pid 13673:tid 13681] [client 20.89.218.83:16819] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aV_v4ID4ue0-noJ7SHPAbQAAAgY"]
[Fri Jan 09 01:56:48.862076 2026] [:error] [pid 15265:tid 15344] [client 20.89.218.83:16861] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/yyobang/mar.php"] [unique_id "aV_v4KE6VBKhew2LTFSJLQAAAJI"]
[Fri Jan 09 01:56:49.399002 2026] [:error] [pid 15263:tid 15295] [client 20.89.218.83:16823] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/yyobang/mar.php"] [unique_id "aV_v4dv61bxum7WG_e89GwAAABc"]
[Fri Jan 09 01:56:49.909774 2026] [:error] [pid 13673:tid 13686] [client 20.89.218.83:11147] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/yyobang/mar.php"] [unique_id "aV_v4YD4ue0-noJ7SHPAcAAAAgs"]
[Fri Jan 09 01:56:50.345945 2026] [:error] [pid 2424:tid 2437] [client 20.89.218.83:16785] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/yyobang/mar.php"] [unique_id "aV_v4rTDJR8aofkBk9Rv8QAAAQs"]
[Fri Jan 09 01:56:50.787852 2026] [:error] [pid 15265:tid 15331] [client 20.89.218.83:11220] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "aV_v4qE6VBKhew2LTFSJLwAAAIU"]
[Fri Jan 09 01:56:51.187752 2026] [:error] [pid 2484:tid 2486] [client 20.89.218.83:16878] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "aV_v4ziDlnlaQQK_AEPgJgAAAUA"]
[Fri Jan 09 01:56:51.642945 2026] [:error] [pid 15263:tid 15289] [client 20.89.218.83:11251] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "aV_v49v61bxum7WG_e89IQAAABE"]
[Fri Jan 09 01:56:52.014488 2026] [:error] [pid 13673:tid 13690] [client 20.89.218.83:11192] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "aV_v5ID4ue0-noJ7SHPAcgAAAg8"]
[Fri Jan 09 01:56:52.455356 2026] [:error] [pid 13673:tid 13695] [client 20.89.218.83:11244] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aV_v5ID4ue0-noJ7SHPAdgAAAhQ"]
[Fri Jan 09 01:56:52.773448 2026] [:error] [pid 2424:tid 2444] [client 20.89.218.83:16769] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aV_v5LTDJR8aofkBk9Rv8wAAARI"]
[Fri Jan 09 01:56:53.221013 2026] [:error] [pid 2424:tid 2439] [client 20.89.218.83:16777] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aV_v5bTDJR8aofkBk9Rv9AAAAQ0"]
[Fri Jan 09 01:56:53.728361 2026] [:error] [pid 13673:tid 13698] [client 20.89.218.83:16863] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aV_v5YD4ue0-noJ7SHPAeAAAAhc"]
[Fri Jan 09 01:56:54.074105 2026] [:error] [pid 15265:tid 15343] [client 20.89.218.83:16890] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV_v5qE6VBKhew2LTFSJNgAAAJE"]
[Fri Jan 09 01:56:55.046544 2026] [:error] [pid 17404:tid 17430] [client 20.89.218.83:16869] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV_v52Vd_oH193N6AnX79QAAAZg"]
[Fri Jan 09 01:56:55.802723 2026] [:error] [pid 15263:tid 15275] [client 20.89.218.83:16866] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV_v59v61bxum7WG_e89JwAAAAM"]
[Fri Jan 09 01:56:56.185179 2026] [:error] [pid 15265:tid 15339] [client 20.89.218.83:11212] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aV_v6KE6VBKhew2LTFSJOgAAAI0"]
[Fri Jan 09 01:56:56.684820 2026] [:error] [pid 13673:tid 13681] [client 20.89.218.83:16822] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV_v6ID4ue0-noJ7SHPAfwAAAgY"]
[Fri Jan 09 01:56:57.117413 2026] [:error] [pid 15265:tid 15337] [client 20.89.218.83:16880] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV_v6aE6VBKhew2LTFSJQAAAAIs"]
[Fri Jan 09 01:56:57.594695 2026] [:error] [pid 13673:tid 13686] [client 20.89.218.83:16803] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV_v6YD4ue0-noJ7SHPAggAAAgs"]
[Fri Jan 09 01:56:58.001637 2026] [:error] [pid 15265:tid 15333] [client 20.89.218.83:16835] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV_v6qE6VBKhew2LTFSJRwAAAIc"]
[Fri Jan 09 01:56:58.565169 2026] [:error] [pid 15265:tid 15332] [client 20.89.218.83:16852] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV_v6qE6VBKhew2LTFSJSQAAAIY"]
[Fri Jan 09 01:56:59.159830 2026] [:error] [pid 15265:tid 15341] [client 20.89.218.83:16838] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV_v66E6VBKhew2LTFSJSwAAAI8"]
[Fri Jan 09 01:56:59.964875 2026] [:error] [pid 15265:tid 15347] [client 20.89.218.83:16771] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV_v66E6VBKhew2LTFSJTgAAAJU"]
[Fri Jan 09 01:57:00.392375 2026] [:error] [pid 13673:tid 13685] [client 20.89.218.83:11143] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV_v7ID4ue0-noJ7SHPAjwAAAgo"]
[Fri Jan 09 01:57:00.921834 2026] [:error] [pid 15264:tid 15318] [client 20.89.218.83:16853] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV_v7Iov6_kvS0Owh-pFjQAAAFM"]
[Fri Jan 09 01:57:01.395829 2026] [:error] [pid 2484:tid 2489] [client 20.89.218.83:16842] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV_v7TiDlnlaQQK_AEPgKQAAAUM"]
[Fri Jan 09 01:57:02.009813 2026] [:error] [pid 15264:tid 15301] [client 20.89.218.83:16815] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV_v7oov6_kvS0Owh-pFjgAAAEI"]
[Fri Jan 09 01:57:02.375416 2026] [:error] [pid 15264:tid 15307] [client 20.89.218.83:16868] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV_v7oov6_kvS0Owh-pFkAAAAEg"]
[Fri Jan 09 01:57:03.110504 2026] [:error] [pid 7586:tid 7613] [client 20.89.218.83:11248] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV_v78Jyk37GdXP5TmWkEwAAAdc"]
[Fri Jan 09 01:57:03.631950 2026] [:error] [pid 7586:tid 7603] [client 20.89.218.83:16816] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV_v78Jyk37GdXP5TmWkFAAAAc0"]
[Fri Jan 09 01:57:03.990598 2026] [:error] [pid 2484:tid 2493] [client 20.89.218.83:16772] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV_v7ziDlnlaQQK_AEPgLgAAAUY"]
[Fri Jan 09 01:57:04.416976 2026] [:error] [pid 2484:tid 2508] [client 20.89.218.83:16861] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aV_v8DiDlnlaQQK_AEPgMAAAAVQ"]
[Fri Jan 09 01:57:04.723859 2026] [:error] [pid 15265:tid 15340] [client 20.89.218.83:11227] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cp.php"] [unique_id "aV_v8KE6VBKhew2LTFSJYgAAAI4"]
[Fri Jan 09 01:57:05.256711 2026] [:error] [pid 15265:tid 15349] [client 20.89.218.83:11209] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cp.php"] [unique_id "aV_v8aE6VBKhew2LTFSJZAAAAJc"]
[Fri Jan 09 01:57:05.741716 2026] [:error] [pid 7586:tid 7608] [client 20.89.218.83:16774] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cp.php"] [unique_id "aV_v8cJyk37GdXP5TmWkFQAAAdI"]
[Fri Jan 09 01:57:06.251377 2026] [:error] [pid 15265:tid 15335] [client 20.89.218.83:11225] File does not exist: /usr/local/apache/htdocs/suspended-page/cp.php
[Fri Jan 09 01:57:06.382407 2026] [:error] [pid 15265:tid 15343] [client 20.89.218.83:11225] File does not exist: /usr/local/apache/htdocs/suspended-page/cpbrute.php
[Fri Jan 09 01:57:07.017292 2026] [:error] [pid 15265:tid 15328] [client 20.89.218.83:11225] File does not exist: /usr/local/apache/htdocs/suspended-page/upp.php
[Fri Jan 09 01:57:07.204062 2026] [:error] [pid 15265:tid 15346] [client 20.89.218.83:11225] File does not exist: /usr/local/apache/htdocs/suspended-page/Shellton.php
[Fri Jan 09 01:57:07.327743 2026] [:error] [pid 15265:tid 15341] [client 20.89.218.83:11225] File does not exist: /usr/local/apache/htdocs/suspended-page/ShellTon.php
[Fri Jan 09 01:57:07.451676 2026] [:error] [pid 15265:tid 15345] [client 20.89.218.83:11225] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Jan 09 01:57:07.617962 2026] [:error] [pid 15265:tid 15347] [client 20.89.218.83:11225] File does not exist: /usr/local/apache/htdocs/suspended-page/hacked.php
[Fri Jan 09 01:57:07.863743 2026] [:error] [pid 15265:tid 15348] [client 20.89.218.83:11225] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV_v86E6VBKhew2LTFSJcwAAAJY"]
[Fri Jan 09 01:57:08.455993 2026] [:error] [pid 2424:tid 2448] [client 20.89.218.83:11233] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV_v9LTDJR8aofkBk9Rv-wAAARY"]
[Fri Jan 09 01:57:08.902020 2026] [:error] [pid 13673:tid 13695] [client 20.89.218.83:16892] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV_v9ID4ue0-noJ7SHPAmAAAAhQ"]
[Fri Jan 09 01:57:09.385970 2026] [:error] [pid 15264:tid 15308] [client 20.89.218.83:11215] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aV_v9Yov6_kvS0Owh-pFmwAAAEk"]
[Fri Jan 09 01:57:09.856689 2026] [:error] [pid 17404:tid 17414] [client 20.89.218.83:16809] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso24.php"] [unique_id "aV_v9WVd_oH193N6AnX8BgAAAYg"]
[Fri Jan 09 01:57:10.334308 2026] [:error] [pid 17404:tid 17430] [client 20.89.218.83:11221] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso24.php"] [unique_id "aV_v9mVd_oH193N6AnX8CAAAAZg"]
[Fri Jan 09 01:57:11.044279 2026] [:error] [pid 15358:tid 15391] [client 20.89.218.83:16846] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso24.php"] [unique_id "aV_v9yoRk9xWJ3toSBK-yQAAANU"]
[Fri Jan 09 01:57:11.507994 2026] [:error] [pid 15265:tid 15336] [client 20.89.218.83:16805] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso24.php"] [unique_id "aV_v96E6VBKhew2LTFSJdgAAAIo"]
[Fri Jan 09 01:57:12.085632 2026] [:error] [pid 13673:tid 13699] [client 20.89.218.83:11259] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso26.php"] [unique_id "aV_v-ID4ue0-noJ7SHPAmwAAAhg"]
[Fri Jan 09 01:57:12.675582 2026] [:error] [pid 15265:tid 15335] [client 20.89.218.83:11139] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso26.php"] [unique_id "aV_v-KE6VBKhew2LTFSJegAAAIk"]
[Fri Jan 09 01:57:13.190370 2026] [:error] [pid 2424:tid 2450] [client 20.89.218.83:16810] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso26.php"] [unique_id "aV_v-bTDJR8aofkBk9Rv_QAAARg"]
[Fri Jan 09 01:57:13.562989 2026] [:error] [pid 15265:tid 15332] [client 20.89.218.83:16827] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso26.php"] [unique_id "aV_v-aE6VBKhew2LTFSJfAAAAIY"]
[Fri Jan 09 01:57:14.138430 2026] [:error] [pid 15263:tid 15296] [client 20.89.218.83:16808] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso404.php"] [unique_id "aV_v-tv61bxum7WG_e89OwAAABg"]
[Fri Jan 09 01:57:14.824674 2026] [:error] [pid 13673:tid 13681] [client 20.89.218.83:16806] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso404.php"] [unique_id "aV_v-oD4ue0-noJ7SHPAogAAAgY"]
[Fri Jan 09 01:57:15.196208 2026] [:error] [pid 2424:tid 2437] [client 20.89.218.83:16895] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso404.php"] [unique_id "aV_v-7TDJR8aofkBk9RwAAAAAQs"]
[Fri Jan 09 01:57:15.872733 2026] [:error] [pid 13673:tid 13686] [client 20.89.218.83:16821] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso404.php"] [unique_id "aV_v-4D4ue0-noJ7SHPApAAAAgs"]
[Fri Jan 09 01:57:16.621524 2026] [:error] [pid 13673:tid 13690] [client 20.89.218.83:11230] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sym.php"] [unique_id "aV_v_ID4ue0-noJ7SHPAqAAAAg8"]
[Fri Jan 09 01:57:17.239874 2026] [:error] [pid 15263:tid 15293] [client 20.89.218.83:11229] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sym.php"] [unique_id "aV_v_dv61bxum7WG_e89PwAAABU"]
[Fri Jan 09 01:57:17.696276 2026] [:error] [pid 13673:tid 13679] [client 20.89.218.83:16796] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sym.php"] [unique_id "aV_v_YD4ue0-noJ7SHPArAAAAgQ"]
[Fri Jan 09 01:57:18.347036 2026] [:error] [pid 17404:tid 17419] [client 20.89.218.83:16875] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sym.php"] [unique_id "aV_v_mVd_oH193N6AnX8DgAAAY0"]
[Fri Jan 09 01:57:18.804317 2026] [:error] [pid 17404:tid 17428] [client 20.89.218.83:11188] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aV_v_mVd_oH193N6AnX8EQAAAZY"]
[Fri Jan 09 01:57:19.430279 2026] [:error] [pid 17404:tid 17406] [client 20.89.218.83:16818] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aV_v_2Vd_oH193N6AnX8EgAAAYA"]
[Fri Jan 09 01:57:19.966277 2026] [:error] [pid 13673:tid 13687] [client 20.89.218.83:11194] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aV_v_4D4ue0-noJ7SHPAsgAAAgw"]
[Fri Jan 09 01:57:20.366875 2026] [:error] [pid 13673:tid 13691] [client 20.89.218.83:11136] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aV_wAID4ue0-noJ7SHPAtAAAAhA"]
[Fri Jan 09 01:57:20.770424 2026] [:error] [pid 17404:tid 17430] [client 20.89.218.83:16783] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aV_wAGVd_oH193N6AnX8FwAAAZg"]
[Fri Jan 09 01:57:21.311688 2026] [:error] [pid 17404:tid 17422] [client 20.89.218.83:11236] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aV_wAWVd_oH193N6AnX8GAAAAZA"]
[Fri Jan 09 01:57:22.202764 2026] [:error] [pid 15265:tid 15332] [client 20.89.218.83:16807] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aV_wAqE6VBKhew2LTFSJjAAAAIY"]
[Fri Jan 09 01:57:22.795749 2026] [:error] [pid 2484:tid 2502] [client 20.89.218.83:11138] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aV_wAjiDlnlaQQK_AEPgPAAAAU4"]
[Fri Jan 09 01:57:23.219495 2026] [:error] [pid 17404:tid 17408] [client 20.89.218.83:11218] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV_wA2Vd_oH193N6AnX8HwAAAYI"]
[Fri Jan 09 01:57:23.543203 2026] [:error] [pid 2484:tid 2508] [client 20.89.218.83:11219] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV_wAziDlnlaQQK_AEPgPgAAAVQ"]
[Fri Jan 09 01:57:23.826337 2026] [:error] [pid 13673:tid 13693] [client 20.89.218.83:11182] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV_wA4D4ue0-noJ7SHPAuAAAAhI"]
[Fri Jan 09 01:57:24.154686 2026] [:error] [pid 15358:tid 15377] [client 20.89.218.83:16830] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV_wBCoRk9xWJ3toSBK-zgAAAMc"]
[Fri Jan 09 01:57:24.624388 2026] [:error] [pid 2484:tid 2501] [client 20.89.218.83:11156] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV_wBDiDlnlaQQK_AEPgQQAAAU0"]
[Fri Jan 09 01:57:25.113395 2026] [:error] [pid 17404:tid 17406] [client 20.89.218.83:11191] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV_wBWVd_oH193N6AnX8JAAAAYA"]
[Fri Jan 09 01:57:25.406914 2026] [:error] [pid 2424:tid 2430] [client 20.89.218.83:16779] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV_wBbTDJR8aofkBk9RwCAAAAQQ"]
[Fri Jan 09 01:57:25.694471 2026] [:error] [pid 13673:tid 13684] [client 20.89.218.83:11201] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV_wBYD4ue0-noJ7SHPAuQAAAgk"]
[Fri Jan 09 01:57:26.006035 2026] [:error] [pid 15263:tid 15272] [client 20.89.218.83:11078] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aV_wBtv61bxum7WG_e89RwAAAAA"]
[Fri Jan 09 01:57:26.371055 2026] [:error] [pid 15264:tid 15321] [client 20.89.218.83:16865] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aV_wBoov6_kvS0Owh-pFpgAAAFY"]
[Fri Jan 09 01:57:26.993328 2026] [:error] [pid 13673:tid 13683] [client 20.89.218.83:11256] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aV_wBoD4ue0-noJ7SHPAvgAAAgg"]
[Fri Jan 09 01:57:27.394678 2026] [:error] [pid 13673:tid 13695] [client 20.89.218.83:16784] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aV_wB4D4ue0-noJ7SHPAwQAAAhQ"]
[Fri Jan 09 01:57:27.727277 2026] [:error] [pid 13673:tid 13678] [client 20.89.218.83:11204] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV_wB4D4ue0-noJ7SHPAwwAAAgM"]
[Fri Jan 09 01:57:28.049166 2026] [:error] [pid 15264:tid 15309] [client 20.89.218.83:11235] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV_wCIov6_kvS0Owh-pFqgAAAEo"]
[Fri Jan 09 01:57:28.547857 2026] [:error] [pid 13673:tid 13692] [client 20.89.218.83:11210] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV_wCID4ue0-noJ7SHPAyAAAAhE"]
[Fri Jan 09 01:57:28.933205 2026] [:error] [pid 13673:tid 13682] [client 20.89.218.83:11243] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aV_wCID4ue0-noJ7SHPAygAAAgc"]
[Fri Jan 09 01:57:29.290238 2026] [:error] [pid 15263:tid 15295] [client 20.89.218.83:11211] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV_wCdv61bxum7WG_e89SAAAABc"]
[Fri Jan 09 01:57:29.842939 2026] [:error] [pid 15263:tid 15280] [client 20.89.218.83:11241] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV_wCdv61bxum7WG_e89SwAAAAg"]
[Fri Jan 09 01:57:30.369176 2026] [:error] [pid 2484:tid 2511] [client 20.89.218.83:11158] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV_wCjiDlnlaQQK_AEPgQwAAAVc"]
[Fri Jan 09 01:57:30.830392 2026] [:error] [pid 15265:tid 15344] [client 20.89.218.83:11141] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV_wCqE6VBKhew2LTFSJkgAAAJI"]
[Fri Jan 09 01:57:31.356098 2026] [:error] [pid 13673:tid 13677] [client 20.89.218.83:16826] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aV_wC4D4ue0-noJ7SHPA1QAAAgI"]
[Fri Jan 09 01:57:32.114052 2026] [:error] [pid 2484:tid 2486] [client 20.89.218.83:16786] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aV_wDDiDlnlaQQK_AEPgRgAAAUA"]
[Fri Jan 09 01:57:32.393214 2026] [:error] [pid 7586:tid 7593] [client 20.89.218.83:16814] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aV_wDMJyk37GdXP5TmWkLAAAAcU"]
[Fri Jan 09 01:57:32.674886 2026] [:error] [pid 13673:tid 13692] [client 20.89.218.83:16871] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aV_wDID4ue0-noJ7SHPA2AAAAhE"]
[Fri Jan 09 01:57:32.990312 2026] [:error] [pid 13673:tid 13681] [client 20.89.218.83:11214] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aV_wDID4ue0-noJ7SHPA2QAAAgY"]
[Fri Jan 09 01:57:33.289338 2026] [:error] [pid 15265:tid 15326] [client 20.89.218.83:11260] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aV_wDaE6VBKhew2LTFSJlQAAAIA"]
[Fri Jan 09 01:57:33.744388 2026] [:error] [pid 15264:tid 15318] [client 20.89.218.83:11186] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aV_wDYov6_kvS0Owh-pFrgAAAFM"]
[Fri Jan 09 01:57:34.318148 2026] [:error] [pid 15358:tid 15375] [client 20.89.218.83:11112] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aV_wDioRk9xWJ3toSBK-1wAAAMU"]
[Fri Jan 09 01:57:34.959259 2026] [:error] [pid 15265:tid 15335] [client 20.89.218.83:11262] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "aV_wDqE6VBKhew2LTFSJmQAAAIk"]
[Fri Jan 09 01:57:35.236665 2026] [:error] [pid 13673:tid 13696] [client 20.89.218.83:11175] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV_wD4D4ue0-noJ7SHPA3QAAAhU"]
[Fri Jan 09 01:57:35.672077 2026] [:error] [pid 13673:tid 13683] [client 20.89.218.83:11203] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV_wD4D4ue0-noJ7SHPA3gAAAgg"]
[Fri Jan 09 01:57:35.941078 2026] [:error] [pid 15265:tid 15343] [client 20.89.218.83:11228] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV_wD6E6VBKhew2LTFSJnQAAAJE"]
[Fri Jan 09 01:57:36.523936 2026] [:error] [pid 15265:tid 15328] [client 20.89.218.83:16829] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV_wEKE6VBKhew2LTFSJngAAAII"]
[Fri Jan 09 01:57:37.083438 2026] [:error] [pid 2484:tid 2506] [client 20.89.218.83:11092] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV_wETiDlnlaQQK_AEPgSAAAAVI"]
[Fri Jan 09 01:57:37.593737 2026] [:error] [pid 15265:tid 15337] [client 20.89.218.83:11263] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV_wEaE6VBKhew2LTFSJowAAAIs"]
[Fri Jan 09 01:57:37.908471 2026] [:error] [pid 15265:tid 15326] [client 20.89.218.83:11238] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV_wEaE6VBKhew2LTFSJpgAAAIA"]
[Fri Jan 09 01:57:38.588125 2026] [:error] [pid 15265:tid 15335] [client 20.89.218.83:11224] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV_wEqE6VBKhew2LTFSJqAAAAIk"]
[Fri Jan 09 01:57:38.860172 2026] [:error] [pid 15265:tid 15329] [client 20.89.218.83:11156] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV_wEqE6VBKhew2LTFSJqgAAAIM"]
[Fri Jan 09 01:57:39.194133 2026] [:error] [pid 15263:tid 15273] [client 20.89.218.83:16782] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV_wE9v61bxum7WG_e89UgAAAAE"]
[Fri Jan 09 01:57:39.680286 2026] [:error] [pid 15263:tid 15283] [client 20.89.218.83:11191] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV_wE9v61bxum7WG_e89UwAAAAs"]
[Fri Jan 09 01:57:40.270957 2026] [:error] [pid 7586:tid 7606] [client 20.89.218.83:11240] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV_wFMJyk37GdXP5TmWkMAAAAdA"]
[Fri Jan 09 01:57:40.959433 2026] [:error] [pid 15264:tid 15310] [client 20.89.218.83:11150] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV_wFIov6_kvS0Owh-pFsQAAAEs"]
[Fri Jan 09 01:57:41.580631 2026] [:error] [pid 2424:tid 2433] [client 20.89.218.83:11146] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV_wFbTDJR8aofkBk9RwDQAAAQc"]
[Fri Jan 09 01:57:41.923070 2026] [:error] [pid 17404:tid 17426] [client 20.89.218.83:11152] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV_wFWVd_oH193N6AnX8KAAAAZQ"]
[Fri Jan 09 01:57:42.481691 2026] [:error] [pid 17404:tid 17412] [client 20.89.218.83:16837] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aV_wFmVd_oH193N6AnX8KQAAAYY"]
[Fri Jan 09 01:57:42.967781 2026] [:error] [pid 7586:tid 7592] [client 20.89.218.83:11239] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV_wFsJyk37GdXP5TmWkMwAAAcQ"]
[Fri Jan 09 01:57:44.059140 2026] [:error] [pid 2484:tid 2490] [client 20.89.218.83:11234] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV_wGDiDlnlaQQK_AEPgSgAAAUQ"]
[Fri Jan 09 01:57:44.502231 2026] [:error] [pid 15358:tid 15373] [client 20.89.218.83:11223] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV_wGCoRk9xWJ3toSBK-3AAAAMM"]
[Fri Jan 09 01:57:45.272324 2026] [:error] [pid 15264:tid 15311] [client 20.89.218.83:11187] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV_wGYov6_kvS0Owh-pFtAAAAEw"]
[Fri Jan 09 01:57:46.047595 2026] [:error] [pid 7586:tid 7598] [client 20.89.218.83:11242] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV_wGsJyk37GdXP5TmWkNgAAAco"]
[Fri Jan 09 01:57:46.616488 2026] [:error] [pid 13673:tid 13682] [client 20.89.218.83:16804] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV_wGoD4ue0-noJ7SHPA9gAAAgc"]
[Fri Jan 09 01:57:47.448606 2026] [:error] [pid 2424:tid 2449] [client 20.89.218.83:11149] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV_wG7TDJR8aofkBk9RwEAAAARc"]
[Fri Jan 09 01:57:47.952953 2026] [:error] [pid 13673:tid 13687] [client 20.89.218.83:16787] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV_wG4D4ue0-noJ7SHPA-QAAAgw"]
[Fri Jan 09 01:57:48.436698 2026] [:error] [pid 13673:tid 13694] [client 20.89.218.83:11254] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV_wHID4ue0-noJ7SHPA-wAAAhM"]
[Fri Jan 09 01:57:48.989880 2026] [:error] [pid 2424:tid 2443] [client 20.89.218.83:16874] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV_wHLTDJR8aofkBk9RwEwAAARE"]
[Fri Jan 09 01:57:49.510207 2026] [:error] [pid 13673:tid 13697] [client 20.89.218.83:11108] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV_wHYD4ue0-noJ7SHPA_QAAAhY"]
[Fri Jan 09 01:57:50.011009 2026] [:error] [pid 13673:tid 13682] [client 20.89.218.83:11200] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV_wHoD4ue0-noJ7SHPBAQAAAgc"]
[Fri Jan 09 01:57:50.643105 2026] [:error] [pid 15358:tid 15392] [client 20.89.218.83:16885] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "aV_wHioRk9xWJ3toSBK-5QAAANY"]
[Fri Jan 09 01:57:50.984984 2026] [:error] [pid 2424:tid 2426] [client 20.89.218.83:11231] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "aV_wHrTDJR8aofkBk9RwFQAAAQA"]
[Fri Jan 09 01:57:51.382510 2026] [:error] [pid 2484:tid 2501] [client 20.89.218.83:11137] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "aV_wHziDlnlaQQK_AEPgTwAAAU0"]
[Fri Jan 09 01:57:51.723671 2026] [:error] [pid 15358:tid 15394] [client 20.89.218.83:11110] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "aV_wHyoRk9xWJ3toSBK-6AAAANg"]
[Fri Jan 09 01:57:52.023753 2026] [:error] [pid 15265:tid 15327] [client 20.89.218.83:11226] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aV_wIKE6VBKhew2LTFSJrAAAAIE"]
[Fri Jan 09 01:57:52.766324 2026] [:error] [pid 13673:tid 13686] [client 20.89.218.83:11080] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aV_wIID4ue0-noJ7SHPBCwAAAgs"]
[Fri Jan 09 01:57:53.218279 2026] [:error] [pid 2484:tid 2498] [client 20.89.218.83:16893] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aV_wITiDlnlaQQK_AEPgUQAAAUs"]
[Fri Jan 09 01:57:53.750522 2026] [:error] [pid 15358:tid 15379] [client 20.89.218.83:11207] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "aV_wISoRk9xWJ3toSBK-6QAAAMk"]
[Fri Jan 09 01:57:54.057380 2026] [:error] [pid 15358:tid 15388] [client 20.89.218.83:11161] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "aV_wIioRk9xWJ3toSBK-6wAAANI"]
[Fri Jan 09 01:57:54.578996 2026] [:error] [pid 15264:tid 15303] [client 20.89.218.83:11167] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "aV_wIoov6_kvS0Owh-pFuwAAAEQ"]
[Fri Jan 09 01:57:55.123325 2026] [:error] [pid 15358:tid 15373] [client 20.89.218.83:11252] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "aV_wIyoRk9xWJ3toSBK-7AAAAMM"]
[Fri Jan 09 01:57:55.613713 2026] [:error] [pid 15264:tid 15316] [client 20.89.218.83:11142] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "aV_wI4ov6_kvS0Owh-pFvQAAAFE"]
[Fri Jan 09 01:57:56.026060 2026] [:error] [pid 15263:tid 15274] [client 20.89.218.83:11198] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "aV_wJNv61bxum7WG_e89XQAAAAI"]
[Fri Jan 09 01:57:56.373876 2026] [:error] [pid 15265:tid 15332] [client 20.89.218.83:11170] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "aV_wJKE6VBKhew2LTFSJtgAAAIY"]
[Fri Jan 09 01:57:56.691732 2026] [:error] [pid 15263:tid 15286] [client 20.89.218.83:11176] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "aV_wJNv61bxum7WG_e89XwAAAA4"]
[Fri Jan 09 01:57:57.113753 2026] [:error] [pid 15358:tid 15372] [client 20.89.218.83:11208] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "aV_wJSoRk9xWJ3toSBK-8AAAAMI"]
[Fri Jan 09 01:57:57.733530 2026] [:error] [pid 7586:tid 7599] [client 20.89.218.83:11094] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "aV_wJcJyk37GdXP5TmWkOQAAAcs"]
[Fri Jan 09 01:57:58.259809 2026] [:error] [pid 15358:tid 15371] [client 20.89.218.83:11174] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "aV_wJioRk9xWJ3toSBK-8wAAAME"]
[Fri Jan 09 01:57:58.625750 2026] [:error] [pid 7586:tid 7593] [client 20.89.218.83:11232] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "aV_wJsJyk37GdXP5TmWkPAAAAcU"]
[Fri Jan 09 01:57:59.164767 2026] [:error] [pid 13673:tid 13684] [client 20.89.218.83:11180] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "aV_wJ4D4ue0-noJ7SHPBEAAAAgk"]
[Fri Jan 09 01:57:59.774646 2026] [:error] [pid 15263:tid 15281] [client 20.89.218.83:16813] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "aV_wJ9v61bxum7WG_e89ZQAAAAk"]
[Fri Jan 09 01:58:00.097307 2026] [:error] [pid 15264:tid 15311] [client 20.89.218.83:16833] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "aV_wKIov6_kvS0Owh-pFwwAAAEw"]
[Fri Jan 09 01:58:00.454249 2026] [:error] [pid 7586:tid 7605] [client 20.89.218.83:11154] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV_wKMJyk37GdXP5TmWkPgAAAc8"]
[Fri Jan 09 01:58:00.765435 2026] [:error] [pid 7586:tid 7607] [client 20.89.218.83:11106] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV_wKMJyk37GdXP5TmWkPwAAAdE"]
[Fri Jan 09 01:58:01.177321 2026] [:error] [pid 13673:tid 13686] [client 20.89.218.83:11160] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV_wKYD4ue0-noJ7SHPBFAAAAgs"]
[Fri Jan 09 01:58:01.646109 2026] [:error] [pid 17404:tid 17430] [client 20.89.218.83:11253] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aV_wKWVd_oH193N6AnX8MgAAAZg"]
[Fri Jan 09 01:58:01.939765 2026] [:error] [pid 13673:tid 13691] [client 20.89.218.83:11076] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aV_wKYD4ue0-noJ7SHPBFwAAAhA"]
[Fri Jan 09 01:58:02.722054 2026] [:error] [pid 13673:tid 13682] [client 20.89.218.83:11117] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aV_wKoD4ue0-noJ7SHPBGAAAAgc"]
[Fri Jan 09 01:58:03.100731 2026] [:error] [pid 17404:tid 17409] [client 20.89.218.83:11105] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aV_wK2Vd_oH193N6AnX8NgAAAYM"]
[Fri Jan 09 01:58:03.517335 2026] [:error] [pid 17404:tid 17412] [client 20.89.218.83:11166] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aV_wK2Vd_oH193N6AnX8OAAAAYY"]
[Fri Jan 09 01:58:04.086816 2026] [:error] [pid 17404:tid 17428] [client 20.89.218.83:11148] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "aV_wLGVd_oH193N6AnX8OgAAAZY"]
[Fri Jan 09 01:58:04.583607 2026] [:error] [pid 17404:tid 17423] [client 20.89.218.83:11190] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "aV_wLGVd_oH193N6AnX8PAAAAZE"]
[Fri Jan 09 01:58:05.020379 2026] [:error] [pid 7586:tid 7611] [client 20.89.218.83:11181] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "aV_wLcJyk37GdXP5TmWkSwAAAdU"]
[Fri Jan 09 01:58:05.503538 2026] [:error] [pid 15358:tid 15379] [client 20.89.218.83:11178] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "aV_wLSoRk9xWJ3toSBK--AAAAMk"]
[Fri Jan 09 01:58:05.789978 2026] [:error] [pid 13673:tid 13690] [client 20.89.218.83:11257] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Assets/item.php"] [unique_id "aV_wLYD4ue0-noJ7SHPBHAAAAg8"]
[Fri Jan 09 01:58:06.282324 2026] [:error] [pid 15358:tid 15388] [client 20.89.218.83:11102] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Assets/item.php"] [unique_id "aV_wLioRk9xWJ3toSBK--QAAANI"]
[Fri Jan 09 01:58:06.736914 2026] [:error] [pid 2424:tid 2434] [client 20.89.218.83:11169] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Assets/item.php"] [unique_id "aV_wLrTDJR8aofkBk9RwFwAAAQg"]
[Fri Jan 09 01:58:07.476722 2026] [:error] [pid 7586:tid 7610] [client 20.89.218.83:11087] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/preferences/index.php"] [unique_id "aV_wL8Jyk37GdXP5TmWkUAAAAdQ"]
[Fri Jan 09 01:58:08.102331 2026] [:error] [pid 2424:tid 2449] [client 20.89.218.83:11015] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aV_wMLTDJR8aofkBk9RwGwAAARc"]
[Fri Jan 09 01:58:08.733376 2026] [:error] [pid 13673:tid 13699] [client 20.89.218.83:11037] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Jan 09 01:58:09.090641 2026] [:error] [pid 13673:tid 13678] [client 20.89.218.83:11037] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aV_wMYD4ue0-noJ7SHPBJQAAAgM"]
[Fri Jan 09 01:58:09.733012 2026] [:error] [pid 7586:tid 7589] [client 20.89.218.83:11255] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/vuln.php"] [unique_id "aV_wMcJyk37GdXP5TmWkUgAAAcE"]
[Fri Jan 09 01:58:10.211741 2026] [:error] [pid 15265:tid 15326] [client 20.89.218.83:11153] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aV_wMqE6VBKhew2LTFSJxgAAAIA"]
[Fri Jan 09 01:58:10.533035 2026] [:error] [pid 17404:tid 17409] [client 20.89.218.83:16841] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aV_wMmVd_oH193N6AnX8QQAAAYM"]
[Fri Jan 09 01:58:11.594823 2026] [:error] [pid 13673:tid 13679] [client 20.89.218.83:11171] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Jan 09 01:58:11.916317 2026] [:error] [pid 13673:tid 13686] [client 20.89.218.83:11171] [client 20.89.218.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.89.218.83, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aV_wM4D4ue0-noJ7SHPBLgAAAgs"]
[Fri Jan 09 01:58:12.040074 2026] [:error] [pid 13673:tid 13685] [client 20.89.218.83:11171] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12wudscz.php"] [unique_id "aV_wNID4ue0-noJ7SHPBLwAAAgo"]
[Fri Jan 09 01:58:12.464595 2026] [:error] [pid 7586:tid 7598] [client 20.89.218.83:11090] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12wudscz.php"] [unique_id "aV_wNMJyk37GdXP5TmWkVQAAAco"]
[Fri Jan 09 01:58:12.864873 2026] [:error] [pid 15358:tid 15374] [client 20.89.218.83:11246] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12wudscz.php"] [unique_id "aV_wNCoRk9xWJ3toSBK_AAAAAMQ"]
[Fri Jan 09 01:58:13.250274 2026] [:error] [pid 15358:tid 15378] [client 20.89.218.83:11179] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12wudscz.php"] [unique_id "aV_wNSoRk9xWJ3toSBK_AwAAAMg"]
[Fri Jan 09 01:58:13.581349 2026] [:error] [pid 15358:tid 15370] [client 20.89.218.83:11206] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV_wNSoRk9xWJ3toSBK_BAAAAMA"]
[Fri Jan 09 01:58:13.993993 2026] [:error] [pid 15264:tid 15300] [client 20.89.218.83:11249] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV_wNYov6_kvS0Owh-pFzgAAAEE"]
[Fri Jan 09 01:58:14.544821 2026] [:error] [pid 13673:tid 13692] [client 20.89.218.83:16887] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV_wNoD4ue0-noJ7SHPBNwAAAhE"]
[Fri Jan 09 01:58:14.850387 2026] [:error] [pid 2424:tid 2443] [client 20.89.218.83:11144] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV_wNrTDJR8aofkBk9RwIAAAARE"]
[Fri Jan 09 01:58:15.181859 2026] [:error] [pid 15265:tid 15331] [client 20.89.218.83:11100] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aV_wN6E6VBKhew2LTFSJywAAAIU"]
[Fri Jan 09 01:58:15.434064 2026] [:error] [pid 15265:tid 15328] [client 20.89.218.83:11183] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV_wN6E6VBKhew2LTFSJzQAAAII"]
[Fri Jan 09 01:58:15.876710 2026] [:error] [pid 15265:tid 15327] [client 20.89.218.83:11162] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV_wN6E6VBKhew2LTFSJ0AAAAIE"]
[Fri Jan 09 01:58:16.202498 2026] [:error] [pid 15265:tid 15344] [client 20.89.218.83:11062] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV_wOKE6VBKhew2LTFSJ0wAAAJI"]
[Fri Jan 09 01:58:16.774315 2026] [:error] [pid 7586:tid 7588] [client 20.89.218.83:16812] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV_wOMJyk37GdXP5TmWkVgAAAcA"]
[Fri Jan 09 01:58:17.196240 2026] [:error] [pid 13673:tid 13683] [client 20.89.218.83:11008] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV_wOYD4ue0-noJ7SHPBOgAAAgg"]
[Fri Jan 09 01:58:17.879002 2026] [:error] [pid 13673:tid 13675] [client 20.89.218.83:11261] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV_wOYD4ue0-noJ7SHPBPAAAAgA"]
[Fri Jan 09 01:58:18.658987 2026] [:error] [pid 15358:tid 15387] [client 20.89.218.83:11250] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV_wOioRk9xWJ3toSBK_CgAAANE"]
[Fri Jan 09 01:58:18.955630 2026] [:error] [pid 2424:tid 2428] [client 20.89.218.83:11077] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aV_wOrTDJR8aofkBk9RwIgAAAQI"]
[Fri Jan 09 01:58:19.394671 2026] [:error] [pid 7586:tid 7599] [client 20.89.218.83:11010] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/wp-login.php"] [unique_id "aV_wO8Jyk37GdXP5TmWkWQAAAcs"]
[Fri Jan 09 01:58:20.005316 2026] [:error] [pid 2484:tid 2494] [client 20.89.218.83:11168] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV_wPDiDlnlaQQK_AEPgVwAAAUc"]
[Fri Jan 09 01:58:20.387914 2026] [:error] [pid 7586:tid 7593] [client 20.89.218.83:11122] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV_wPMJyk37GdXP5TmWkWwAAAcU"]
[Fri Jan 09 01:58:20.776812 2026] [:error] [pid 7586:tid 7605] [client 20.89.218.83:11177] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV_wPMJyk37GdXP5TmWkXAAAAc8"]
[Fri Jan 09 01:58:21.269871 2026] [:error] [pid 15265:tid 15327] [client 20.89.218.83:11155] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV_wPaE6VBKhew2LTFSJ3QAAAIE"]
[Fri Jan 09 01:58:22.133908 2026] [:error] [pid 13673:tid 13689] [client 20.89.218.83:11151] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aV_wPoD4ue0-noJ7SHPBQgAAAg4"]
[Fri Jan 09 01:58:22.637288 2026] [:error] [pid 2484:tid 2504] [client 20.89.218.83:11124] [client 20.89.218.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aV_wPjiDlnlaQQK_AEPgYAAAAVA"]
[Fri Jan 09 01:58:23.259395 2026] [:error] [pid 13673:tid 13683] [client 20.89.218.83:16811] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/about.php"] [unique_id "aV_wP4D4ue0-noJ7SHPBRAAAAgg"]
[Fri Jan 09 01:58:23.583103 2026] [:error] [pid 2484:tid 2506] [client 20.89.218.83:16845] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/about.php"] [unique_id "aV_wPziDlnlaQQK_AEPgYwAAAVI"]
[Fri Jan 09 01:58:24.040837 2026] [:error] [pid 7586:tid 7602] [client 20.89.218.83:11133] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/about.php"] [unique_id "aV_wQMJyk37GdXP5TmWkYQAAAcw"]
[Fri Jan 09 01:58:24.705204 2026] [:error] [pid 2484:tid 2490] [client 20.89.218.83:11213] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/about.php"] [unique_id "aV_wQDiDlnlaQQK_AEPgZAAAAUQ"]
[Fri Jan 09 01:58:25.491188 2026] [:error] [pid 7586:tid 7604] [client 20.89.218.83:11172] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV_wQcJyk37GdXP5TmWkYwAAAc4"]
[Fri Jan 09 01:58:25.946420 2026] [:error] [pid 13673:tid 13685] [client 20.89.218.83:11258] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV_wQYD4ue0-noJ7SHPBRgAAAgo"]
[Fri Jan 09 01:58:26.537608 2026] [:error] [pid 13673:tid 13691] [client 20.89.218.83:11107] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV_wQoD4ue0-noJ7SHPBRwAAAhA"]
[Fri Jan 09 01:58:27.597147 2026] [:error] [pid 2424:tid 2440] [client 20.89.218.83:11197] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aV_wQ7TDJR8aofkBk9RwKAAAAQ4"]
[Fri Jan 09 01:58:28.297253 2026] [:error] [pid 2484:tid 2501] [client 20.89.218.83:11028] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/about.php"] [unique_id "aV_wRDiDlnlaQQK_AEPgZwAAAU0"]
[Fri Jan 09 01:58:30.907086 2026] [:error] [pid 13673:tid 13682] [client 20.89.218.83:11024] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/about.php"] [unique_id "aV_wRoD4ue0-noJ7SHPBTwAAAgc"]
[Fri Jan 09 01:58:31.324682 2026] [:error] [pid 15264:tid 15311] [client 20.89.218.83:11245] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/about.php"] [unique_id "aV_wR4ov6_kvS0Owh-pF0gAAAEw"]
[Fri Jan 09 01:58:31.655418 2026] [:error] [pid 15358:tid 15390] [client 20.89.218.83:11261] [client 20.89.218.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/about.php"] [unique_id "aV_wRyoRk9xWJ3toSBK_EQAAANQ"]
[Fri Jan 09 07:58:12.092502 2026] [:error] [pid 35810:tid 35840] [client 86.153.43.46:60663] [client 86.153.43.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.153.43.46, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWBElIrJrhH8tOUNM5AjjgAAABU"]
[Fri Jan 09 07:58:12.097042 2026] [:error] [pid 35810:tid 35840] [client 86.153.43.46:60663] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Jan 09 10:21:09.621879 2026] [:error] [pid 44848:tid 44871] [client 143.244.141.160:53988] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/"] [unique_id "aWBmFajajoTJAbEk87wp2gAAAFU"], referer: binance.com
[Fri Jan 09 10:21:29.330159 2026] [:error] [pid 30113:tid 30121] [client 143.244.141.160:57000] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aWBmKasz80DbrolLWsHqpwAAAQU"], referer: binance.com
[Fri Jan 09 10:21:49.994106 2026] [:error] [pid 30020:tid 30065] [client 143.244.141.160:59996] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aWBmPcrjc66qOisG6L16WQAAAIs"], referer: binance.com
[Fri Jan 09 10:29:14.109314 2026] [:error] [pid 30113:tid 30130] [client 64.225.8.2:57901] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aWBn-qsz80DbrolLWsHvbgAAAQ4"]
[Sat Jan 10 01:45:19.733261 2026] [:error] [pid 30019:tid 30040] [client 161.118.211.239:60316] [client 161.118.211.239] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aWE-r0z3igHGwX5f7IogigAAABA"]
[Sat Jan 10 01:45:20.090437 2026] [:error] [pid 14801:tid 14820] [client 161.118.211.239:49789] [client 161.118.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.211.239, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWE-sN8UWXrz_OQYgF2SGwAAAlE"]
[Sat Jan 10 01:45:20.093741 2026] [:error] [pid 14801:tid 14820] [client 161.118.211.239:49789] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Jan 10 17:57:08.139600 2026] [:error] [pid 57649:tid 57668] [client 143.244.141.160:64472] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/"] [unique_id "aWIidFcvIwrych3kBnonvwAAApE"], referer: binance.com
[Sat Jan 10 17:57:14.684596 2026] [:error] [pid 57088:tid 57105] [client 143.244.141.160:50033] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aWIiekGS_UStbgMYQWgF-AAAAg8"], referer: binance.com
[Sat Jan 10 17:57:21.905805 2026] [:error] [pid 1339:tid 1345] [client 143.244.141.160:52227] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aWIigScsOJx4B_mSFzlElgAAA4M"], referer: binance.com
[Sat Jan 10 20:02:07.089335 2026] [:error] [pid 57649:tid 57675] [client 213.35.103.47:65113] [client 213.35.103.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aWI_v1cvIwrych3kBnoyRwAAApg"]
[Sat Jan 10 20:02:07.474393 2026] [:error] [pid 64621:tid 64636] [client 213.35.103.47:65510] [client 213.35.103.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.35.103.47, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWI_v4a9na_3sfYAP9qozwAAAw0"]
[Sat Jan 10 20:02:07.478424 2026] [:error] [pid 64621:tid 64636] [client 213.35.103.47:65510] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Jan 11 00:11:09.806516 2026] [autoindex:error] [pid 1383:tid 1407] [client 74.225.218.73:33573] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Jan 11 01:20:29.477340 2026] [:error] [pid 1383:tid 1387] [client 143.198.39.172:51637] [client 143.198.39.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.39.172, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWKKXSSbzyQbm27sbcKUhgAAA8I"]
[Sun Jan 11 01:20:29.481260 2026] [:error] [pid 1383:tid 1387] [client 143.198.39.172:51637] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Jan 11 01:20:31.955510 2026] [:error] [pid 1383:tid 1399] [client 143.198.39.172:51637] [client 143.198.39.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aWKKXySbzyQbm27sbcKUkQAAA8o"]
[Sun Jan 11 01:20:32.392491 2026] [:error] [pid 57088:tid 57106] [client 143.198.39.172:62805] [client 143.198.39.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aWKKYEGS_UStbgMYQWgo-QAAAhA"]
[Sun Jan 11 01:20:32.829453 2026] [:error] [pid 1125:tid 1147] [client 143.198.39.172:64267] [client 143.198.39.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aWKKYHqAWYc4UwRgeOeIqQAAAFQ"]
[Sun Jan 11 01:20:33.266487 2026] [:error] [pid 1339:tid 1345] [client 143.198.39.172:56728] [client 143.198.39.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aWKKYScsOJx4B_mSFzlw6AAAA4M"]
[Sun Jan 11 01:20:33.704366 2026] [:error] [pid 1125:tid 1140] [client 143.198.39.172:64385] [client 143.198.39.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aWKKYXqAWYc4UwRgeOeIqgAAAE0"]
[Sun Jan 11 01:20:34.140894 2026] [:error] [pid 1296:tid 1320] [client 143.198.39.172:50450] [client 143.198.39.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aWKKYibQW-fowWjMNKDB-wAAAlY"]
[Sun Jan 11 01:20:34.578588 2026] [:error] [pid 1296:tid 1302] [client 143.198.39.172:51550] [client 143.198.39.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aWKKYibQW-fowWjMNKDB_AAAAkQ"]
[Sun Jan 11 15:30:57.115057 2026] [:error] [pid 5155:tid 5232] [client 161.118.212.145:53940] [client 161.118.212.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.212.145, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWNRsVgEKFpNs0_zLGnt0QAAAJA"], referer: https://www.google.com/
[Sun Jan 11 15:30:57.119412 2026] [:error] [pid 5155:tid 5232] [client 161.118.212.145:53940] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Sun Jan 11 15:30:57.486379 2026] [:error] [pid 35977:tid 35989] [client 161.118.212.145:54266] [client 161.118.212.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.212.145, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWNRsbDST5RMqStLeP1B_QAAAgk"], referer: https://www.facebook.com/
[Sun Jan 11 15:30:57.490699 2026] [:error] [pid 35977:tid 35989] [client 161.118.212.145:54266] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.facebook.com/
[Sun Jan 11 15:30:58.429189 2026] [:error] [pid 40191:tid 40201] [client 161.118.212.145:54480] [client 161.118.212.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.212.145, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWNRskm2BH1CV1p0EUGmmQAAAsg"]
[Sun Jan 11 15:30:58.435588 2026] [:error] [pid 40191:tid 40201] [client 161.118.212.145:54480] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Jan 11 15:30:58.802425 2026] [:error] [pid 5155:tid 5234] [client 161.118.212.145:54829] [client 161.118.212.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.212.145, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWNRslgEKFpNs0_zLGnt0wAAAJI"], referer: https://www.bing.com/
[Sun Jan 11 15:30:58.807265 2026] [:error] [pid 5155:tid 5234] [client 161.118.212.145:54829] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.bing.com/
[Sun Jan 11 16:14:13.582595 2026] [:error] [pid 5272:tid 5291] [client 49.204.141.153:27598] [client 49.204.141.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.141.153, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWNb1Vp55bCsukUvYGZAlgAAANE"]
[Sun Jan 11 16:14:13.587969 2026] [:error] [pid 5272:tid 5291] [client 49.204.141.153:27598] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Jan 11 20:58:35.565584 2026] [:error] [pid 5153:tid 5195] [client 104.215.26.144:41346] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php, referer: https://www.yahoo.com/
[Sun Jan 11 20:58:36.057191 2026] [:error] [pid 5153:tid 5198] [client 104.215.26.144:41346] [client 104.215.26.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/themes7.php"] [unique_id "aWOefM1QbNSPD9bRi77LsQAAAEk"], referer: https://duckduckgo.com/
[Sun Jan 11 20:58:36.307731 2026] [:error] [pid 5155:tid 5226] [client 104.215.26.144:32767] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php, referer: https://www.google.com/
[Sun Jan 11 20:58:36.432502 2026] [:error] [pid 5155:tid 5225] [client 104.215.26.144:32767] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php, referer: https://www.yahoo.com/
[Sun Jan 11 20:58:37.943797 2026] [:error] [pid 5155:tid 5216] [client 104.215.26.144:32767] [client 104.215.26.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.26.144, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWOefVgEKFpNs0_zLGkhnQAAAIA"], referer: https://www.google.com/
[Sun Jan 11 20:58:37.947798 2026] [:error] [pid 5155:tid 5216] [client 104.215.26.144:32767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Sun Jan 11 20:58:38.204781 2026] [:error] [pid 5155:tid 5236] [client 104.215.26.144:32767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-Owl.php, referer: https://www.google.co.uk/
[Sun Jan 11 20:58:38.328527 2026] [:error] [pid 5155:tid 5219] [client 104.215.26.144:32767] File does not exist: /usr/local/apache/htdocs/suspended-page/classsmtps.php, referer: https://www.yahoo.com/
[Sun Jan 11 20:58:38.818456 2026] [:error] [pid 5155:tid 5234] [client 104.215.26.144:32767] [client 104.215.26.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aWOeflgEKFpNs0_zLGkhpQAAAJI"], referer: https://www.bing.com/
[Sun Jan 11 20:58:39.562248 2026] [:error] [pid 11747:tid 11766] [client 104.215.26.144:48175] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.google.fr/
[Sun Jan 11 20:58:39.687442 2026] [:error] [pid 11747:tid 11773] [client 104.215.26.144:48175] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php, referer: https://www.google.co.uk/
[Sun Jan 11 20:58:40.055209 2026] [:error] [pid 11747:tid 11753] [client 104.215.26.144:48175] [client 104.215.26.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aWOegKRFw84LNpZSk7nkaAAAAUI"], referer: https://www.google.com/
[Sun Jan 11 20:58:40.667307 2026] [:error] [pid 35730:tid 35732] [client 104.215.26.144:31880] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php, referer: https://www.google.fr/
[Sun Jan 11 20:58:40.790592 2026] [:error] [pid 35730:tid 35743] [client 104.215.26.144:31880] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php, referer: https://duckduckgo.com/
[Sun Jan 11 20:58:40.913055 2026] [:error] [pid 35730:tid 35747] [client 104.215.26.144:31880] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php, referer: https://www.yahoo.com/
[Sun Jan 11 20:58:41.033215 2026] [:error] [pid 35730:tid 35745] [client 104.215.26.144:31880] [client 104.215.26.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aWOegTi7U_mfHtESQHlgQwAAAc0"], referer: https://www.google.com/
[Sun Jan 11 20:58:41.277427 2026] [:error] [pid 11748:tid 11799] [client 104.215.26.144:23582] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php, referer: https://www.google.co.uk/
[Sun Jan 11 20:58:41.401165 2026] [:error] [pid 11748:tid 11779] [client 104.215.26.144:23582] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php, referer: https://duckduckgo.com/
[Sun Jan 11 20:58:41.526811 2026] [:error] [pid 11748:tid 11788] [client 104.215.26.144:23582] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php, referer: https://www.yahoo.com/
[Sun Jan 11 20:58:41.651163 2026] [:error] [pid 11748:tid 11795] [client 104.215.26.144:23582] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php, referer: https://www.google.fr/
[Sun Jan 11 20:58:41.900936 2026] [:error] [pid 11748:tid 11782] [client 104.215.26.144:23582] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php, referer: https://www.google.fr/
[Sun Jan 11 20:58:42.146478 2026] [:error] [pid 11748:tid 11786] [client 104.215.26.144:23582] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php, referer: https://www.yahoo.com/
[Sun Jan 11 20:58:42.272466 2026] [:error] [pid 11748:tid 11800] [client 104.215.26.144:23582] File does not exist: /usr/local/apache/htdocs/suspended-page/eagle.php, referer: https://www.google.de/
[Sun Jan 11 20:58:42.765060 2026] [:error] [pid 11748:tid 11794] [client 104.215.26.144:23582] [client 104.215.26.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aWOeggC5xybrWOCNnoYC6wAAAZA"], referer: https://duckduckgo.com/
[Sun Jan 11 20:58:43.009098 2026] [:error] [pid 5152:tid 5166] [client 104.215.26.144:48133] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php, referer: https://duckduckgo.com/
[Sun Jan 11 20:58:43.133731 2026] [:error] [pid 5152:tid 5174] [client 104.215.26.144:48133] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.bing.com/
[Sun Jan 11 20:58:43.257381 2026] [:error] [pid 5152:tid 5164] [client 104.215.26.144:48133] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php, referer: https://www.bing.com/
[Sun Jan 11 20:58:43.377316 2026] [:error] [pid 5152:tid 5185] [client 104.215.26.144:48133] [client 104.215.26.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/ty.php"] [unique_id "aWOegxm0axGMFrpuXHCXuwAAABc"], referer: https://www.google.com/
[Sun Jan 11 20:58:43.992723 2026] [:error] [pid 35730:tid 35732] [client 104.215.26.144:48144] [client 104.215.26.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aWOegzi7U_mfHtESQHlgTwAAAcA"], referer: https://www.google.fr/
[Sun Jan 11 21:47:27.199456 2026] [:error] [pid 5272:tid 5290] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Sun Jan 11 21:47:27.531485 2026] [:error] [pid 5272:tid 5291] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sample-load.php
[Sun Jan 11 21:47:27.675029 2026] [:error] [pid 5272:tid 5280] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header-json.php
[Sun Jan 11 21:47:27.804969 2026] [:error] [pid 5272:tid 5276] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Jan 11 21:47:27.950245 2026] [:error] [pid 5272:tid 5288] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/old.php
[Sun Jan 11 21:47:28.086469 2026] [:error] [pid 5272:tid 5292] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sun Jan 11 21:47:28.209574 2026] [:error] [pid 5272:tid 5281] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/ultra.php
[Sun Jan 11 21:47:28.330814 2026] [:error] [pid 5272:tid 5275] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Sun Jan 11 21:47:28.711205 2026] [:error] [pid 5272:tid 5287] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Jan 11 21:47:28.831511 2026] [:error] [pid 5272:tid 5283] [client 13.70.39.23:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Sun Jan 11 21:47:28.970702 2026] [:error] [pid 5272:tid 5296] [client 13.70.39.23:32406] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aWOp8Fp55bCsukUvYGaDnwAAANY"]
[Sun Jan 11 21:47:31.011224 2026] [:error] [pid 36611:tid 36614] [client 13.70.39.23:19486] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aWOp8z8oZoZHsoTdjhhrSwAAAkE"]
[Sun Jan 11 21:47:38.968840 2026] [:error] [pid 5155:tid 5222] [client 13.70.39.23:19509] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aWOp-lgEKFpNs0_zLGkrugAAAIY"]
[Sun Jan 11 21:47:45.872543 2026] [:error] [pid 11747:tid 11770] [client 13.70.39.23:19516] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWOqAaRFw84LNpZSk7nr9wAAAVM"]
[Sun Jan 11 21:48:06.883248 2026] [:error] [pid 5153:tid 5191] [client 13.70.39.23:8129] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWOqFs1QbNSPD9bRi77TyAAAAEI"]
[Sun Jan 11 21:48:12.525782 2026] [:error] [pid 35730:tid 35747] [client 13.70.39.23:8162] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWOqHDi7U_mfHtESQHlt6wAAAc8"]
[Sun Jan 11 21:48:14.979897 2026] [:error] [pid 5152:tid 5179] [client 13.70.39.23:19541] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWOqHhm0axGMFrpuXHCfqAAAABE"]
[Sun Jan 11 21:48:18.457952 2026] [:error] [pid 40191:tid 40216] [client 13.70.39.23:15509] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWOqIkm2BH1CV1p0EUHfOwAAAtc"]
[Sun Jan 11 21:48:19.589728 2026] [:error] [pid 35730:tid 35738] [client 13.70.39.23:8137] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aWOqIzi7U_mfHtESQHlt9QAAAcY"]
[Sun Jan 11 21:48:23.215032 2026] [:error] [pid 11747:tid 11753] [client 13.70.39.23:19913] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aWOqJ6RFw84LNpZSk7nsIwAAAUI"]
[Sun Jan 11 21:48:26.849850 2026] [:error] [pid 40191:tid 40217] [client 13.70.39.23:35945] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aWOqKkm2BH1CV1p0EUHfQgAAAtg"]
[Sun Jan 11 21:48:37.980880 2026] [:error] [pid 5272:tid 5282] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/inject.php
[Sun Jan 11 21:48:38.101715 2026] [:error] [pid 5272:tid 5291] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Sun Jan 11 21:48:38.222311 2026] [:error] [pid 5272:tid 5297] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/pro.php
[Sun Jan 11 21:48:38.346984 2026] [:error] [pid 5272:tid 5276] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Sun Jan 11 21:48:38.466713 2026] [:error] [pid 5272:tid 5288] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Sun Jan 11 21:48:38.625161 2026] [:error] [pid 5272:tid 5292] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sun Jan 11 21:48:38.745767 2026] [:error] [pid 5272:tid 5275] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Jan 11 21:48:38.865257 2026] [:error] [pid 5272:tid 5298] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Jan 11 21:48:38.986458 2026] [:error] [pid 5272:tid 5281] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sun Jan 11 21:48:39.106996 2026] [:error] [pid 5272:tid 5284] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Jan 11 21:48:39.228242 2026] [:error] [pid 5272:tid 5277] [client 13.70.39.23:19860] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Jan 11 21:48:39.345763 2026] [:error] [pid 5272:tid 5278] [client 13.70.39.23:19860] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aWOqN1p55bCsukUvYGaD3AAAAMQ"]
[Sun Jan 11 21:48:42.733299 2026] [:error] [pid 11747:tid 11775] [client 13.70.39.23:8159] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aWOqOqRFw84LNpZSk7nsLAAAAVg"]
[Sun Jan 11 21:48:46.673033 2026] [:error] [pid 36611:tid 36614] [client 13.70.39.23:8173] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aWOqPj8oZoZHsoTdjhhrgAAAAkE"]
[Sun Jan 11 21:48:55.255118 2026] [:error] [pid 5152:tid 5173] [client 13.70.39.23:7649] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/debug.php"] [unique_id "aWOqRxm0axGMFrpuXHCfvAAAAAs"]
[Sun Jan 11 21:48:57.257387 2026] [:error] [pid 11748:tid 11780] [client 13.70.39.23:2794] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/debug.php"] [unique_id "aWOqSQC5xybrWOCNnoYMeQAAAYI"]
[Sun Jan 11 21:49:06.386123 2026] [:error] [pid 5155:tid 5229] [client 13.70.39.23:7658] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/debug.php"] [unique_id "aWOqUlgEKFpNs0_zLGkr_wAAAI0"]
[Sun Jan 11 21:49:12.015792 2026] [:error] [pid 11748:tid 11794] [client 13.70.39.23:22243] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/debug.php"] [unique_id "aWOqWAC5xybrWOCNnoYMjAAAAZA"]
[Sun Jan 11 21:49:16.610446 2026] [:error] [pid 5152:tid 5163] [client 13.70.39.23:7478] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aWOqXBm0axGMFrpuXHCgCgAAAAE"]
[Sun Jan 11 21:49:18.311943 2026] [:error] [pid 11748:tid 11797] [client 13.70.39.23:8129] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aWOqXgC5xybrWOCNnoYM5gAAAZM"]
[Sun Jan 11 21:49:19.484753 2026] [:error] [pid 11747:tid 11754] [client 13.70.39.23:8122] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aWOqX6RFw84LNpZSk7nsPQAAAUM"]
[Sun Jan 11 21:49:28.909300 2026] [:error] [pid 40191:tid 40199] [client 13.70.39.23:7643] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aWOqaEm2BH1CV1p0EUHfXgAAAsY"]
[Sun Jan 11 21:49:30.996382 2026] [:error] [pid 35977:tid 35992] [client 13.70.39.23:15577] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aWOqarDST5RMqStLeP2ICgAAAgw"]
[Sun Jan 11 21:49:34.104922 2026] [:error] [pid 40191:tid 40211] [client 13.70.39.23:19533] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aWOqbkm2BH1CV1p0EUHfaAAAAtI"]
[Sun Jan 11 21:50:12.037601 2026] [:error] [pid 11748:tid 11789] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Sun Jan 11 21:50:12.199100 2026] [:error] [pid 11748:tid 11790] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/data.php
[Sun Jan 11 21:50:12.975617 2026] [:error] [pid 11748:tid 11785] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Jan 11 21:50:13.110453 2026] [:error] [pid 11748:tid 11784] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sun Jan 11 21:50:13.284135 2026] [:error] [pid 11748:tid 11796] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Jan 11 21:50:13.415230 2026] [:error] [pid 11748:tid 11781] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/backup.php
[Sun Jan 11 21:50:14.251113 2026] [:error] [pid 11748:tid 11778] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Jan 11 21:50:14.371743 2026] [:error] [pid 11748:tid 11779] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Sun Jan 11 21:50:14.520376 2026] [:error] [pid 11748:tid 11799] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Jan 11 21:50:14.659513 2026] [:error] [pid 11748:tid 11788] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Jan 11 21:50:14.787939 2026] [:error] [pid 11748:tid 11780] [client 13.70.39.23:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Jan 11 21:50:14.907827 2026] [:error] [pid 11748:tid 11787] [client 13.70.39.23:28469] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aWOqlgC5xybrWOCNnoYNFAAAAYk"]
[Sun Jan 11 21:50:16.508689 2026] [:error] [pid 5272:tid 5297] [client 13.70.39.23:37060] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aWOqmFp55bCsukUvYGaEBwAAANc"]
[Sun Jan 11 21:50:21.279425 2026] [:error] [pid 5153:tid 5189] [client 13.70.39.23:3869] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aWOqnc1QbNSPD9bRi77T-gAAAEA"]
[Sun Jan 11 21:50:39.907535 2026] [:error] [pid 35977:tid 35997] [client 13.70.39.23:36741] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aWOqr7DST5RMqStLeP2IZAAAAhE"]
[Sun Jan 11 21:50:43.458380 2026] [:error] [pid 5155:tid 5220] [client 13.70.39.23:41608] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aWOqs1gEKFpNs0_zLGksWwAAAIQ"]
[Sun Jan 11 21:50:48.905014 2026] [:error] [pid 5155:tid 5226] [client 13.70.39.23:36748] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aWOquFgEKFpNs0_zLGksawAAAIo"]
[Sun Jan 11 21:50:57.238258 2026] [:error] [pid 5152:tid 5176] [client 13.70.39.23:42200] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aWOqwRm0axGMFrpuXHCgPwAAAA4"]
[Sun Jan 11 21:50:59.003579 2026] [:error] [pid 35977:tid 35987] [client 13.70.39.23:27486] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aWOqw7DST5RMqStLeP2IcwAAAgc"]
[Sun Jan 11 21:51:05.606727 2026] [:error] [pid 5153:tid 5199] [client 13.70.39.23:34095] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.exe"] [unique_id "aWOqyc1QbNSPD9bRi77UNAAAAEo"]
[Sun Jan 11 21:51:08.875922 2026] [:error] [pid 11747:tid 11759] [client 13.70.39.23:9521] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.exe"] [unique_id "aWOqzKRFw84LNpZSk7nsfwAAAUg"]
[Sun Jan 11 21:51:10.018931 2026] [:error] [pid 5152:tid 5186] [client 13.70.39.23:9492] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.exe"] [unique_id "aWOqzhm0axGMFrpuXHCgTQAAABg"]
[Sun Jan 11 21:51:15.343584 2026] [:error] [pid 11748:tid 11781] [client 13.70.39.23:27965] File does not exist: /usr/local/apache/htdocs/suspended-page/u.php
[Sun Jan 11 21:51:15.485375 2026] [:error] [pid 11748:tid 11796] [client 13.70.39.23:27965] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Jan 11 21:51:15.603398 2026] [:error] [pid 11748:tid 11799] [client 13.70.39.23:27965] [client 13.70.39.23] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aoswa.com.au|F|2"] [data ".phpquebecoils.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aoswa.com.au"] [uri "/info.phpquebecoils.com"] [unique_id "aWOq0wC5xybrWOCNnoYNQgAAAZU"]
[Mon Jan 12 19:21:41.233872 2026] [:error] [pid 9303:tid 9319] [client 223.181.35.104:23108] [client 223.181.35.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.35.104, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWTZRdEoWhpeQ69gVtHhDgAAAU0"]
[Mon Jan 12 19:21:41.242797 2026] [:error] [pid 9303:tid 9319] [client 223.181.35.104:23108] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Jan 12 20:03:28.396141 2026] [:error] [pid 51863:tid 51873] [client 167.172.235.216:61753] [client 167.172.235.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aWTjED2-QXSEuiZdYYZqnAAAAgY"], referer: binance.com
[Tue Jan 13 06:57:09.165091 2026] [:error] [pid 26395:tid 26402] [client 74.225.244.89:9185] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php, referer: https://www.yahoo.com/
[Tue Jan 13 06:57:09.301759 2026] [:error] [pid 26395:tid 26399] [client 74.225.244.89:9185] [client 74.225.244.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.244.89, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aWV8RZhRkuVub9GmnFgk4AAAAQI"], referer: https://www.google.com/
[Tue Jan 13 06:57:09.305636 2026] [:error] [pid 26395:tid 26399] [client 74.225.244.89:9185] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php, referer: https://www.google.com/
[Tue Jan 13 06:57:10.003975 2026] [:error] [pid 26395:tid 26407] [client 74.225.244.89:9185] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aWV8RphRkuVub9GmnFgk5QAAAQo"], referer: https://www.yahoo.com/
[Tue Jan 13 06:57:10.279884 2026] [:error] [pid 57659:tid 57699] [client 74.225.244.89:9108] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aWV8RopeWOFQSBXk4xrC7AAAAEk"], referer: https://www.google.de/
[Tue Jan 13 06:57:10.557102 2026] [:error] [pid 57653:tid 57674] [client 74.225.244.89:9209] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aWV8RoVjCK8w3mABKuGn1AAAAAw"], referer: https://www.google.co.uk/
[Tue Jan 13 06:57:10.975327 2026] [:error] [pid 64816:tid 64846] [client 74.225.244.89:9183] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aWV8Rj7hQ-K4Qk-LZFxLagAAAoA"], referer: https://www.bing.com/
[Tue Jan 13 06:57:11.251961 2026] [:error] [pid 64816:tid 64861] [client 74.225.244.89:9107] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aWV8Rz7hQ-K4Qk-LZFxLawAAAo8"], referer: https://www.yahoo.com/
[Tue Jan 13 06:57:11.527983 2026] [:error] [pid 57756:tid 57771] [client 74.225.244.89:9208] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aWV8Rxb7B3uqOEHw10nWTgAAAM0"], referer: https://www.google.fr/
[Tue Jan 13 06:57:11.803707 2026] [:error] [pid 26395:tid 26400] [client 74.225.244.89:9036] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aWV8R5hRkuVub9GmnFgk5gAAAQM"], referer: https://www.google.de/
[Tue Jan 13 06:57:12.078218 2026] [:error] [pid 57653:tid 57680] [client 74.225.244.89:9197] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aWV8SIVjCK8w3mABKuGn2AAAABI"], referer: https://duckduckgo.com/
[Tue Jan 13 06:57:12.355101 2026] [:error] [pid 57653:tid 57683] [client 74.225.244.89:9088] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aWV8SIVjCK8w3mABKuGn2gAAABU"], referer: https://www.yahoo.com/
[Tue Jan 13 06:57:14.107201 2026] [:error] [pid 64816:tid 64858] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php, referer: https://www.google.de/
[Tue Jan 13 06:57:14.247818 2026] [:error] [pid 64816:tid 64852] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.bing.com/
[Tue Jan 13 06:57:14.388344 2026] [:error] [pid 64816:tid 64869] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.de/
[Tue Jan 13 06:57:14.530225 2026] [:error] [pid 64816:tid 64867] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.yahoo.com/
[Tue Jan 13 06:57:14.670376 2026] [:error] [pid 64816:tid 64870] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.com/
[Tue Jan 13 06:57:14.810974 2026] [:error] [pid 64816:tid 64866] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.yahoo.com/
[Tue Jan 13 06:57:15.093311 2026] [:error] [pid 64816:tid 64855] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.yahoo.com/
[Tue Jan 13 06:57:15.234822 2026] [:error] [pid 64816:tid 64859] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.google.com/
[Tue Jan 13 06:57:15.376026 2026] [:error] [pid 64816:tid 64854] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://www.google.fr/
[Tue Jan 13 06:57:15.516295 2026] [:error] [pid 64816:tid 64857] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php, referer: https://www.google.com/
[Tue Jan 13 06:57:15.656925 2026] [:error] [pid 64816:tid 64851] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:15.946122 2026] [:error] [pid 64816:tid 64863] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.com/
[Tue Jan 13 06:57:16.087893 2026] [:error] [pid 64816:tid 64848] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://duckduckgo.com/
[Tue Jan 13 06:57:16.229671 2026] [:error] [pid 64816:tid 64853] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://duckduckgo.com/
[Tue Jan 13 06:57:16.370377 2026] [:error] [pid 64816:tid 64847] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.bing.com/
[Tue Jan 13 06:57:16.511068 2026] [:error] [pid 64816:tid 64850] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.com/
[Tue Jan 13 06:57:16.652602 2026] [:error] [pid 64816:tid 64846] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://duckduckgo.com/
[Tue Jan 13 06:57:16.793976 2026] [:error] [pid 64816:tid 64856] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:17.075793 2026] [:error] [pid 64816:tid 64861] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php, referer: https://duckduckgo.com/
[Tue Jan 13 06:57:17.218601 2026] [:error] [pid 64816:tid 64858] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:17.359630 2026] [:error] [pid 64816:tid 64852] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://duckduckgo.com/
[Tue Jan 13 06:57:17.501395 2026] [:error] [pid 64816:tid 64869] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:17.642242 2026] [:error] [pid 64816:tid 64867] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:18.064091 2026] [:error] [pid 64816:tid 64862] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php, referer: https://www.google.de/
[Tue Jan 13 06:57:18.204413 2026] [:error] [pid 64816:tid 64855] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.bing.com/
[Tue Jan 13 06:57:18.489074 2026] [:error] [pid 64816:tid 64854] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.google.fr/
[Tue Jan 13 06:57:18.629893 2026] [:error] [pid 64816:tid 64857] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php, referer: https://www.google.fr/
[Tue Jan 13 06:57:19.053779 2026] [:error] [pid 64816:tid 64863] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://www.google.com/
[Tue Jan 13 06:57:19.194690 2026] [:error] [pid 64816:tid 64848] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php, referer: https://www.google.com/
[Tue Jan 13 06:57:19.476387 2026] [:error] [pid 64816:tid 64847] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:19.757649 2026] [:error] [pid 64816:tid 64846] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.de/
[Tue Jan 13 06:57:19.898438 2026] [:error] [pid 64816:tid 64856] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php, referer: https://www.google.de/
[Tue Jan 13 06:57:20.039207 2026] [:error] [pid 64816:tid 64864] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:20.459175 2026] [:error] [pid 64816:tid 64868] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.yahoo.com/
[Tue Jan 13 06:57:20.880893 2026] [:error] [pid 64816:tid 64852] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php, referer: https://www.google.co.uk/
[Tue Jan 13 06:57:21.869391 2026] [:error] [pid 64816:tid 64859] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php, referer: https://www.google.com/
[Tue Jan 13 06:57:22.997900 2026] [:error] [pid 64816:tid 64847] [client 74.225.244.89:9180] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://duckduckgo.com/
[Tue Jan 13 06:57:23.135350 2026] [:error] [pid 64816:tid 64850] [client 74.225.244.89:9180] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aWV8Uz7hQ-K4Qk-LZFxLrQAAAoQ"], referer: https://www.google.co.uk/
[Tue Jan 13 06:57:23.415308 2026] [:error] [pid 26395:tid 26400] [client 74.225.244.89:9179] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aWV8U5hRkuVub9GmnFgk7QAAAQM"], referer: https://duckduckgo.com/
[Tue Jan 13 06:57:23.697394 2026] [:error] [pid 64636:tid 64670] [client 74.225.244.89:9176] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aWV8U_Gqpzg-cXyoK5lhPQAAAcQ"], referer: https://www.google.de/
[Tue Jan 13 06:57:23.988279 2026] [:error] [pid 64816:tid 64856] [client 74.225.244.89:9106] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aWV8Uz7hQ-K4Qk-LZFxLrgAAAoo"], referer: https://www.google.co.uk/
[Tue Jan 13 06:57:24.291510 2026] [:error] [pid 57660:tid 57719] [client 74.225.244.89:9161] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aWV8VNMDflPZjoqTTeFfgQAAAII"], referer: https://www.bing.com/
[Tue Jan 13 06:57:24.587122 2026] [:error] [pid 64601:tid 64613] [client 74.225.244.89:9194] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aWV8VGA4qvmy2KOnZAgw7AAAAUo"], referer: https://www.google.de/
[Tue Jan 13 06:57:24.895796 2026] [:error] [pid 26395:tid 26411] [client 74.225.244.89:9090] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aWV8VJhRkuVub9GmnFgk8AAAAQ4"], referer: https://www.google.com/
[Tue Jan 13 06:57:25.171104 2026] [:error] [pid 64635:tid 64659] [client 74.225.244.89:9210] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/index.php"] [unique_id "aWV8VfXsJjgHYKhN2UrTxQAAAZQ"], referer: https://www.google.fr/
[Tue Jan 13 06:57:25.446772 2026] [:error] [pid 26395:tid 26408] [client 74.225.244.89:9211] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aWV8VZhRkuVub9GmnFgk8QAAAQs"], referer: https://www.yahoo.com/
[Tue Jan 13 06:57:25.724718 2026] [:error] [pid 64816:tid 64861] [client 74.225.244.89:9101] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aWV8VT7hQ-K4Qk-LZFxLrwAAAo8"], referer: https://www.google.fr/
[Tue Jan 13 06:57:26.005995 2026] [:error] [pid 57659:tid 57700] [client 74.225.244.89:9117] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aWV8VopeWOFQSBXk4xrC8gAAAEo"], referer: https://www.bing.com/
[Tue Jan 13 06:57:27.861597 2026] [:error] [pid 57756:tid 57774] [client 74.225.244.89:9189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php, referer: https://www.google.fr/
[Tue Jan 13 06:57:28.145145 2026] [:error] [pid 57756:tid 57761] [client 74.225.244.89:9189] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aWV8WBb7B3uqOEHw10nWYQAAAMM"], referer: https://www.yahoo.com/
[Tue Jan 13 06:57:28.561914 2026] [:error] [pid 64635:tid 64663] [client 74.225.244.89:9027] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aWV8WPXsJjgHYKhN2UrTxwAAAZg"], referer: https://www.google.de/
[Tue Jan 13 06:57:28.834163 2026] [:error] [pid 64635:tid 64656] [client 74.225.244.89:9025] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aWV8WPXsJjgHYKhN2UrTyAAAAZE"], referer: https://www.yahoo.com/
[Tue Jan 13 06:57:29.106974 2026] [:error] [pid 64601:tid 64605] [client 74.225.244.89:9100] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aWV8WWA4qvmy2KOnZAgw7QAAAUI"], referer: https://www.bing.com/
[Tue Jan 13 06:57:29.384970 2026] [:error] [pid 64816:tid 64852] [client 74.225.244.89:9215] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aWV8WT7hQ-K4Qk-LZFxLsQAAAoY"], referer: https://www.google.fr/
[Tue Jan 13 06:57:29.941459 2026] [:error] [pid 64816:tid 64859] [client 74.225.244.89:9130] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aWV8WT7hQ-K4Qk-LZFxLtQAAAo0"], referer: https://www.google.fr/
[Tue Jan 13 06:57:30.361287 2026] [:error] [pid 64816:tid 64863] [client 74.225.244.89:9195] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aWV8Wj7hQ-K4Qk-LZFxLuAAAApE"], referer: https://www.google.com/
[Tue Jan 13 06:57:30.639382 2026] [:error] [pid 57653:tid 57667] [client 74.225.244.89:9166] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aWV8WoVjCK8w3mABKuGn9AAAAAU"], referer: https://www.google.co.uk/
[Tue Jan 13 06:57:30.911709 2026] [:error] [pid 57660:tid 57721] [client 74.225.244.89:9163] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aWV8WtMDflPZjoqTTeFfiAAAAIQ"], referer: https://www.google.co.uk/
[Tue Jan 13 06:57:31.184454 2026] [:error] [pid 64635:tid 64646] [client 74.225.244.89:9156] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aWV8W_XsJjgHYKhN2UrTywAAAYc"], referer: https://www.google.fr/
[Tue Jan 13 06:57:31.606893 2026] [:error] [pid 26395:tid 26419] [client 74.225.244.89:9149] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aWV8W5hRkuVub9GmnFgk-gAAARY"], referer: https://www.google.fr/
[Tue Jan 13 06:57:31.884493 2026] [:error] [pid 64816:tid 64846] [client 74.225.244.89:9178] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aWV8Wz7hQ-K4Qk-LZFxLuwAAAoA"], referer: https://www.google.co.uk/
[Tue Jan 13 06:57:32.451823 2026] [:error] [pid 57660:tid 57727] [client 74.225.244.89:9191] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/search/index.php"] [unique_id "aWV8XNMDflPZjoqTTeFfjgAAAIo"], referer: https://www.google.de/
[Tue Jan 13 06:57:32.864015 2026] [:error] [pid 64816:tid 64860] [client 74.225.244.89:9135] [client 74.225.244.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aWV8XD7hQ-K4Qk-LZFxLvQAAAo4"], referer: https://www.bing.com/
[Tue Jan 13 06:57:33.140581 2026] [:error] [pid 57660:tid 57730] [client 74.225.244.89:9089] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php, referer: https://www.yahoo.com/
[Tue Jan 13 06:57:33.281016 2026] [:error] [pid 57660:tid 57734] [client 74.225.244.89:9089] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php, referer: https://www.google.fr/
[Tue Jan 13 06:57:33.421583 2026] [:error] [pid 57660:tid 57733] [client 74.225.244.89:9089] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php, referer: https://www.bing.com/
[Tue Jan 13 17:04:02.751995 2026] [:error] [pid 22426:tid 22475] [client 174.138.0.66:62405] [client 174.138.0.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 174.138.0.66, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWYKgty1Q5toryYTHgOP8gAAANE"]
[Tue Jan 13 17:04:02.754969 2026] [:error] [pid 22426:tid 22475] [client 174.138.0.66:62405] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Jan 13 21:37:06.012861 2026] [:error] [pid 22389:tid 22413] [client 194.233.68.138:57040] [client 194.233.68.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aWZKgiLIB_8b411qalJZaAAAAVY"]
[Wed Jan 14 01:00:54.680721 2026] [:error] [pid 63931:tid 63946] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php, referer: https://www.yahoo.com/
[Wed Jan 14 01:00:54.699353 2026] [:error] [pid 63931:tid 63948] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.de/
[Wed Jan 14 01:00:54.717634 2026] [:error] [pid 63931:tid 63953] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.google.de/
[Wed Jan 14 01:00:54.736399 2026] [:error] [pid 63931:tid 63939] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.com/
[Wed Jan 14 01:00:54.755103 2026] [:error] [pid 63931:tid 63936] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.bing.com/
[Wed Jan 14 01:00:54.775460 2026] [:error] [pid 63931:tid 63951] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.com/
[Wed Jan 14 01:00:54.794420 2026] [:error] [pid 63931:tid 63937] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.google.co.uk/
[Wed Jan 14 01:00:54.814805 2026] [:error] [pid 63931:tid 63956] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.fr/
[Wed Jan 14 01:00:54.833383 2026] [:error] [pid 63931:tid 63938] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.fr/
[Wed Jan 14 01:00:54.852351 2026] [:error] [pid 63931:tid 63945] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.fr/
[Wed Jan 14 01:00:54.871045 2026] [:error] [pid 63931:tid 63947] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.de/
[Wed Jan 14 01:00:54.891547 2026] [:error] [pid 63931:tid 63950] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.de/
[Wed Jan 14 01:00:54.911872 2026] [:error] [pid 63931:tid 63942] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.yahoo.com/
[Wed Jan 14 01:00:54.932022 2026] [:error] [pid 63931:tid 63954] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php, referer: https://www.google.de/
[Wed Jan 14 01:00:54.951870 2026] [:error] [pid 63931:tid 63933] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://www.bing.com/
[Wed Jan 14 01:00:54.971023 2026] [:error] [pid 63931:tid 63949] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php, referer: https://www.bing.com/
[Wed Jan 14 01:00:54.989697 2026] [:error] [pid 63931:tid 63957] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php, referer: https://www.yahoo.com/
[Wed Jan 14 01:00:55.009119 2026] [:error] [pid 63931:tid 63941] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.fr/
[Wed Jan 14 01:00:55.028657 2026] [:error] [pid 63931:tid 63934] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php, referer: https://www.bing.com/
[Wed Jan 14 01:00:55.068208 2026] [:error] [pid 63931:tid 63944] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.google.de/
[Wed Jan 14 01:00:55.087090 2026] [:error] [pid 63931:tid 63952] [client 20.42.210.242:62300] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.yahoo.com/
[Wed Jan 14 01:00:55.420072 2026] [:error] [pid 63931:tid 63949] [client 20.42.210.242:62300] [client 20.42.210.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aWZ6R9VnG0cQj3cwmW8-pwAAABA"], referer: https://www.google.de/
[Wed Jan 14 01:00:55.472827 2026] [:error] [pid 63844:tid 63920] [client 20.42.210.242:62287] [client 20.42.210.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/buttons/index.php"] [unique_id "aWZ6R0L9rjD8EK1UiLkM6gAAANM"], referer: https://www.google.co.uk/
[Wed Jan 14 01:12:06.278420 2026] [:error] [pid 63843:tid 63879] [client 140.245.117.185:55610] [client 140.245.117.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aWZ85oqxEwB7D1-DxXfcQQAAAIU"]
[Wed Jan 14 01:12:06.698482 2026] [:error] [pid 63843:tid 63891] [client 140.245.117.185:64682] [client 140.245.117.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.117.185, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aWZ85oqxEwB7D1-DxXfcUAAAAJE"]
[Wed Jan 14 01:12:06.701162 2026] [:error] [pid 63843:tid 63891] [client 140.245.117.185:64682] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Jan 14 01:12:07.928439 2026] [:error] [pid 25809:tid 25815] [client 140.245.117.185:54504] [client 140.245.117.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user/login"] [unique_id "aWZ8549SDqNJ9R9VfZD7VgAAAEQ"]
[Wed Jan 14 01:12:08.317321 2026] [:error] [pid 43385:tid 43413] [client 140.245.117.185:62003] [client 140.245.117.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin"] [unique_id "aWZ86MFJIMneckmN0mrn1wAAARE"]
[Wed Jan 14 01:12:08.712210 2026] [:error] [pid 63842:tid 63851] [client 140.245.117.185:65410] [client 140.245.117.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/login"] [unique_id "aWZ86G0zPTD54ET7u1kmTAAAAUU"]
[Wed Jan 14 03:35:10.990918 2026] [:error] [pid 24602:tid 24661] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php, referer: https://www.google.fr/
[Wed Jan 14 03:35:11.109653 2026] [:error] [pid 24602:tid 24658] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.fr/
[Wed Jan 14 03:35:11.234880 2026] [:error] [pid 24602:tid 24653] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.google.co.uk/
[Wed Jan 14 03:35:11.351830 2026] [:error] [pid 24602:tid 24656] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.fr/
[Wed Jan 14 03:35:11.473396 2026] [:error] [pid 24602:tid 24641] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.yahoo.com/
[Wed Jan 14 03:35:11.590567 2026] [:error] [pid 24602:tid 24654] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.co.uk/
[Wed Jan 14 03:35:11.707739 2026] [:error] [pid 24602:tid 24662] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://duckduckgo.com/
[Wed Jan 14 03:35:11.823840 2026] [:error] [pid 24602:tid 24642] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.co.uk/
[Wed Jan 14 03:35:11.940621 2026] [:error] [pid 24602:tid 24655] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.fr/
[Wed Jan 14 03:35:12.058501 2026] [:error] [pid 24602:tid 24652] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.bing.com/
[Wed Jan 14 03:35:12.175373 2026] [:error] [pid 24602:tid 24638] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.yahoo.com/
[Wed Jan 14 03:35:12.292143 2026] [:error] [pid 24602:tid 24640] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.bing.com/
[Wed Jan 14 03:35:12.408924 2026] [:error] [pid 24602:tid 24650] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.fr/
[Wed Jan 14 03:35:12.525656 2026] [:error] [pid 24602:tid 24643] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php, referer: https://duckduckgo.com/
[Wed Jan 14 03:35:12.644595 2026] [:error] [pid 24602:tid 24645] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://duckduckgo.com/
[Wed Jan 14 03:35:12.762627 2026] [:error] [pid 24602:tid 24646] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php, referer: https://www.google.de/
[Wed Jan 14 03:35:12.881250 2026] [:error] [pid 24602:tid 24647] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php, referer: https://www.yahoo.com/
[Wed Jan 14 03:35:12.998223 2026] [:error] [pid 24602:tid 24660] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.com/
[Wed Jan 14 03:35:13.116756 2026] [:error] [pid 24602:tid 24639] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php, referer: https://www.google.de/
[Wed Jan 14 03:35:13.352179 2026] [:error] [pid 24602:tid 24661] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.google.de/
[Wed Jan 14 03:35:13.468840 2026] [:error] [pid 24602:tid 24658] [client 4.214.17.14:53246] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://duckduckgo.com/
[Wed Jan 14 03:35:18.132228 2026] [:error] [pid 24602:tid 24658] [client 4.214.17.14:53246] [client 4.214.17.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aWaedkooYwabcb9R9fwpzgAAAFQ"], referer: https://www.google.fr/
[Wed Jan 14 03:35:18.477960 2026] [:error] [pid 24601:tid 24632] [client 4.214.17.14:54463] [client 4.214.17.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/buttons/index.php"] [unique_id "aWaedkCtWkZ9rlKW5n9yrgAAABY"], referer: https://www.google.de/
[Wed Jan 14 03:35:18.705417 2026] [:error] [pid 24603:tid 24676] [client 4.214.17.14:53184] [client 4.214.17.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/gallery/index.php"] [unique_id "aWaedpPBJGFGN8VT8_SKOQAAAIs"], referer: https://www.google.co.uk/
[Wed Jan 14 03:35:18.932568 2026] [:error] [pid 24603:tid 24667] [client 4.214.17.14:11359] [client 4.214.17.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/list-item/index.php"] [unique_id "aWaedpPBJGFGN8VT8_SKOgAAAII"], referer: https://www.google.de/
[Wed Jan 14 03:35:19.160187 2026] [:error] [pid 24710:tid 24724] [client 4.214.17.14:55142] [client 4.214.17.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aWaed2XBo5bEhDEEhs1CrwAAAMw"], referer: https://www.google.co.uk/
[Wed Jan 14 04:36:29.289626 2026] [:error] [pid 59074:tid 59099] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Wed Jan 14 04:36:29.414007 2026] [:error] [pid 59074:tid 59089] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/ea.php
[Wed Jan 14 04:36:29.537963 2026] [:error] [pid 59074:tid 59077] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/gi.php
[Wed Jan 14 04:36:29.672021 2026] [:error] [pid 59074:tid 59080] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/nov.php
[Wed Jan 14 04:36:29.796229 2026] [:error] [pid 59074:tid 59088] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/xo.php
[Wed Jan 14 04:36:29.920179 2026] [:error] [pid 59074:tid 59078] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/555.php
[Wed Jan 14 04:36:30.047272 2026] [:error] [pid 59074:tid 59091] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/anskrit.php
[Wed Jan 14 04:36:30.171001 2026] [:error] [pid 59074:tid 59079] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/win.php
[Wed Jan 14 04:36:30.295774 2026] [:error] [pid 59074:tid 59084] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/ut.php
[Wed Jan 14 04:36:30.421206 2026] [:error] [pid 59074:tid 59097] [client 20.27.218.116:32406] File does not exist: /usr/local/apache/htdocs/suspended-page/ooaiyc.php
[Wed Jan 14 04:36:30.541898 2026] [:error] [pid 59074:tid 59086] [client 20.27.218.116:32406] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aWaszk_KrJ818pzhB3xfBQAAAko"]
[Wed Jan 14 04:36:30.808594 2026] [:error] [pid 58699:tid 58709] [client 20.27.218.116:32402] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aWaszuYdPBtkMLK2SdqkGwAAAQc"]
[Wed Jan 14 04:36:31.049263 2026] [:error] [pid 58699:tid 58705] [client 20.27.218.116:32405] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aWasz-YdPBtkMLK2SdqkHAAAAQM"]
[Wed Jan 14 04:36:31.290108 2026] [:error] [pid 58868:tid 58873] [client 20.27.218.116:32468] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nx1.php"] [unique_id "aWasz067yj8PZAmdsbllDAAAAUM"]
[Wed Jan 14 04:36:31.575024 2026] [:error] [pid 24602:tid 24639] [client 20.27.218.116:11233] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avtst.php"] [unique_id "aWasz0ooYwabcb9R9fw0IQAAAEE"]
[Wed Jan 14 04:36:31.836480 2026] [:error] [pid 58899:tid 58911] [client 20.27.218.116:32467] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avtst.php"] [unique_id "aWaszwWViGQd5R44tHFtoAAAAYg"]
[Wed Jan 14 04:36:32.085058 2026] [:error] [pid 58868:tid 58894] [client 20.27.218.116:32504] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avtst.php"] [unique_id "aWas0E67yj8PZAmdsbllDQAAAVg"]
[Wed Jan 14 04:36:32.347505 2026] [:error] [pid 24601:tid 24629] [client 20.27.218.116:32388] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avtst.php"] [unique_id "aWas0ECtWkZ9rlKW5n99fQAAABM"]
[Wed Jan 14 04:36:32.587146 2026] [:error] [pid 24601:tid 24618] [client 20.27.218.116:32463] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aWas0ECtWkZ9rlKW5n99fgAAAAg"]
[Wed Jan 14 04:36:32.834772 2026] [:error] [pid 58977:tid 58982] [client 20.27.218.116:32498] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aWas0LlT6ggZLRx9QvD8HAAAAgI"]
[Wed Jan 14 04:36:33.075027 2026] [:error] [pid 58868:tid 58879] [client 20.27.218.116:32492] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aWas0U67yj8PZAmdsbllDgAAAUk"]
[Wed Jan 14 04:36:33.319002 2026] [:error] [pid 58977:tid 58992] [client 20.27.218.116:32409] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "aWas0blT6ggZLRx9QvD8HgAAAgw"]
[Wed Jan 14 04:36:33.581156 2026] [:error] [pid 58868:tid 58893] [client 20.27.218.116:32449] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aWas0U67yj8PZAmdsbllDwAAAVc"]
[Wed Jan 14 04:36:33.835936 2026] [:error] [pid 58868:tid 58883] [client 20.27.218.116:11203] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aWas0U67yj8PZAmdsbllEAAAAU0"]
[Wed Jan 14 04:36:34.088049 2026] [:error] [pid 24601:tid 24619] [client 20.27.218.116:32486] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aWas0kCtWkZ9rlKW5n99gAAAAAk"]
[Wed Jan 14 04:36:34.345368 2026] [:error] [pid 24602:tid 24659] [client 20.27.218.116:32401] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classgoto24.php"] [unique_id "aWas0kooYwabcb9R9fw0IwAAAFU"]
[Wed Jan 14 04:36:34.638770 2026] [:error] [pid 24603:tid 24689] [client 20.27.218.116:32481] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aWas0pPBJGFGN8VT8_SbOQAAAJg"]
[Wed Jan 14 04:36:34.941854 2026] [:error] [pid 24602:tid 24653] [client 20.27.218.116:32408] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aWas0kooYwabcb9R9fw0JAAAAE8"]
[Wed Jan 14 04:36:35.239335 2026] [:error] [pid 24603:tid 24670] [client 20.27.218.116:32422] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aWas05PBJGFGN8VT8_SbOgAAAIU"]
[Wed Jan 14 04:36:35.486576 2026] [:error] [pid 24603:tid 24669] [client 20.27.218.116:32431] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lx.php"] [unique_id "aWas05PBJGFGN8VT8_SbOwAAAIQ"]
[Wed Jan 14 04:36:35.789496 2026] [:error] [pid 24603:tid 24683] [client 20.27.218.116:32485] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/die.php"] [unique_id "aWas05PBJGFGN8VT8_SbPAAAAJI"]
[Wed Jan 14 04:36:36.045806 2026] [:error] [pid 58868:tid 58890] [client 20.27.218.116:32507] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/die.php"] [unique_id "aWas1E67yj8PZAmdsbllEgAAAVQ"]
[Wed Jan 14 04:36:36.301014 2026] [:error] [pid 58868:tid 58882] [client 20.27.218.116:32477] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/die.php"] [unique_id "aWas1E67yj8PZAmdsbllEwAAAUw"]
[Wed Jan 14 04:36:36.540938 2026] [:error] [pid 24602:tid 24656] [client 20.27.218.116:32483] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/die.php"] [unique_id "aWas1EooYwabcb9R9fw0JQAAAFI"]
[Wed Jan 14 04:36:36.780977 2026] [:error] [pid 58868:tid 58884] [client 20.27.218.116:32400] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaaa.php"] [unique_id "aWas1E67yj8PZAmdsbllFAAAAU4"]
[Wed Jan 14 04:36:37.051086 2026] [:error] [pid 24603:tid 24684] [client 20.27.218.116:32390] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaaa.php"] [unique_id "aWas1ZPBJGFGN8VT8_SbPQAAAJM"]
[Wed Jan 14 04:36:37.354823 2026] [:error] [pid 24603:tid 24665] [client 20.27.218.116:32476] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaaa.php"] [unique_id "aWas1ZPBJGFGN8VT8_SbPgAAAIA"]
[Wed Jan 14 04:36:37.610696 2026] [:error] [pid 24603:tid 24679] [client 20.27.218.116:32470] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaaa.php"] [unique_id "aWas1ZPBJGFGN8VT8_SbPwAAAI4"]
[Wed Jan 14 04:36:37.895774 2026] [:error] [pid 24603:tid 24673] [client 20.27.218.116:32475] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbbb.php"] [unique_id "aWas1ZPBJGFGN8VT8_SbQAAAAIg"]
[Wed Jan 14 04:36:38.167426 2026] [:error] [pid 24603:tid 24681] [client 20.27.218.116:32495] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbbb.php"] [unique_id "aWas1pPBJGFGN8VT8_SbQQAAAJA"]
[Wed Jan 14 04:36:38.460942 2026] [:error] [pid 24601:tid 24631] [client 20.27.218.116:32455] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbbb.php"] [unique_id "aWas1kCtWkZ9rlKW5n99gQAAABU"]
[Wed Jan 14 04:36:38.704578 2026] [:error] [pid 24601:tid 24611] [client 20.27.218.116:32471] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bbbb.php"] [unique_id "aWas1kCtWkZ9rlKW5n99ggAAAAE"]
[Wed Jan 14 04:36:38.988894 2026] [:error] [pid 24601:tid 24633] [client 20.27.218.116:32387] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aWas1kCtWkZ9rlKW5n99gwAAABc"]
[Wed Jan 14 04:36:39.377430 2026] [:error] [pid 58977:tid 58996] [client 20.27.218.116:32395] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aWas17lT6ggZLRx9QvD8HwAAAhA"]
[Wed Jan 14 04:36:39.655110 2026] [:error] [pid 58699:tid 58724] [client 20.27.218.116:32428] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aWas1-YdPBtkMLK2SdqkIQAAARY"]
[Wed Jan 14 04:36:39.918760 2026] [:error] [pid 24601:tid 24615] [client 20.27.218.116:32500] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aWas10CtWkZ9rlKW5n99hQAAAAU"]
[Wed Jan 14 04:36:40.238906 2026] [:error] [pid 58977:tid 58991] [client 20.27.218.116:32459] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aWas2LlT6ggZLRx9QvD8IAAAAgs"]
[Wed Jan 14 04:36:40.525797 2026] [:error] [pid 58977:tid 58989] [client 20.27.218.116:32480] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aWas2LlT6ggZLRx9QvD8IQAAAgk"]
[Wed Jan 14 04:36:40.923090 2026] [:error] [pid 58899:tid 58918] [client 20.27.218.116:32458] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aWas2AWViGQd5R44tHFtpwAAAY8"]
[Wed Jan 14 04:36:41.268409 2026] [:error] [pid 24710:tid 24723] [client 20.27.218.116:32489] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aWas2WXBo5bEhDEEhs1V3wAAAMs"]
[Wed Jan 14 04:36:41.633727 2026] [:error] [pid 58899:tid 58917] [client 20.27.218.116:32451] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aWas2QWViGQd5R44tHFtqgAAAY4"]
[Wed Jan 14 04:36:41.949835 2026] [:error] [pid 24710:tid 24732] [client 20.27.218.116:32398] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aWas2WXBo5bEhDEEhs1V4AAAANQ"]
[Wed Jan 14 04:36:42.285272 2026] [:error] [pid 24710:tid 24734] [client 20.27.218.116:32478] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aWas2mXBo5bEhDEEhs1V4QAAANY"]
[Wed Jan 14 04:36:42.644949 2026] [:error] [pid 24603:tid 24677] [client 20.27.218.116:32488] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aWas2pPBJGFGN8VT8_SbRAAAAIw"]
[Wed Jan 14 04:36:42.922657 2026] [:error] [pid 58901:tid 58942] [client 20.27.218.116:32461] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aWas2r3kQSrcqIWtO0ofkQAAAcw"]
[Wed Jan 14 04:36:43.192515 2026] [:error] [pid 58977:tid 58986] [client 20.27.218.116:11160] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aWas27lT6ggZLRx9QvD8IwAAAgY"]
[Wed Jan 14 04:36:43.432179 2026] [:error] [pid 24601:tid 24634] [client 20.27.218.116:32494] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aWas20CtWkZ9rlKW5n99hgAAABg"]
[Wed Jan 14 04:36:43.692814 2026] [:error] [pid 24710:tid 24722] [client 20.27.218.116:32444] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aWas22XBo5bEhDEEhs1V4gAAAMo"]
[Wed Jan 14 04:36:43.954440 2026] [:error] [pid 24602:tid 24645] [client 20.27.218.116:32453] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aWas20ooYwabcb9R9fw0JgAAAEc"]
[Wed Jan 14 04:36:44.209934 2026] [:error] [pid 58899:tid 58915] [client 20.27.218.116:32474] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aWas3AWViGQd5R44tHFtrAAAAYw"]
[Wed Jan 14 04:36:44.498199 2026] [:error] [pid 24710:tid 24714] [client 20.27.218.116:32462] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aWas3GXBo5bEhDEEhs1V5AAAAMI"]
[Wed Jan 14 04:36:44.743446 2026] [:error] [pid 24710:tid 24725] [client 20.27.218.116:32429] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aWas3GXBo5bEhDEEhs1V5QAAAM0"]
[Wed Jan 14 04:36:45.017455 2026] [:error] [pid 24710:tid 24720] [client 20.27.218.116:32393] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aWas3WXBo5bEhDEEhs1V5gAAAMg"]
[Wed Jan 14 04:36:45.265246 2026] [:error] [pid 24710:tid 24724] [client 20.27.218.116:11230] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aWas3WXBo5bEhDEEhs1V6AAAAMw"]
[Wed Jan 14 04:36:45.512042 2026] [:error] [pid 58899:tid 58922] [client 20.27.218.116:32404] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aWas3QWViGQd5R44tHFtrgAAAZM"]
[Wed Jan 14 04:36:45.752267 2026] [:error] [pid 58899:tid 58920] [client 20.27.218.116:32479] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aWas3QWViGQd5R44tHFtrwAAAZE"]
[Wed Jan 14 04:36:46.009514 2026] [:error] [pid 24710:tid 24713] [client 20.27.218.116:32460] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aWas3mXBo5bEhDEEhs1V6gAAAME"]
[Wed Jan 14 04:36:46.269596 2026] [:error] [pid 24602:tid 24657] [client 20.27.218.116:32499] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aWas3kooYwabcb9R9fw0JwAAAFM"]
[Wed Jan 14 04:36:46.521645 2026] [:error] [pid 58901:tid 58952] [client 20.27.218.116:32391] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aWas3r3kQSrcqIWtO0ofkgAAAdY"]
[Wed Jan 14 04:36:46.795641 2026] [:error] [pid 24710:tid 24729] [client 20.27.218.116:32399] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "aWas3mXBo5bEhDEEhs1V6wAAANE"]
[Wed Jan 14 04:36:47.049372 2026] [:error] [pid 58699:tid 58726] [client 20.27.218.116:32446] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aWas3-YdPBtkMLK2SdqkIgAAARg"]
[Wed Jan 14 04:36:47.299261 2026] [:error] [pid 24710:tid 24733] [client 20.27.218.116:32385] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aWas32XBo5bEhDEEhs1V7AAAANU"]
[Wed Jan 14 04:36:47.544472 2026] [:error] [pid 24710:tid 24735] [client 20.27.218.116:32411] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aWas32XBo5bEhDEEhs1V7QAAANc"]
[Wed Jan 14 04:36:47.788965 2026] [:error] [pid 24710:tid 24728] [client 20.27.218.116:32394] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aWas32XBo5bEhDEEhs1V7wAAANA"]
[Wed Jan 14 04:36:48.086186 2026] [:error] [pid 58901:tid 58943] [client 20.27.218.116:32509] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aWas4L3kQSrcqIWtO0ofkwAAAc0"]
[Wed Jan 14 04:36:48.327231 2026] [:error] [pid 58901:tid 58950] [client 20.27.218.116:32491] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aWas4L3kQSrcqIWtO0oflAAAAdQ"]
[Wed Jan 14 04:36:48.568365 2026] [:error] [pid 24601:tid 24613] [client 20.27.218.116:32497] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aWas4ECtWkZ9rlKW5n99iAAAAAM"]
[Wed Jan 14 04:36:48.814637 2026] [:error] [pid 58901:tid 58935] [client 20.27.218.116:32501] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aWas4L3kQSrcqIWtO0oflgAAAcU"]
[Wed Jan 14 04:36:49.058608 2026] [:error] [pid 58901:tid 58953] [client 20.27.218.116:32414] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file13.php"] [unique_id "aWas4b3kQSrcqIWtO0ofmgAAAdc"]
[Wed Jan 14 04:36:49.298427 2026] [:error] [pid 58901:tid 58947] [client 20.27.218.116:11253] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file13.php"] [unique_id "aWas4b3kQSrcqIWtO0ofnQAAAdE"]
[Wed Jan 14 04:36:49.540564 2026] [:error] [pid 24602:tid 24652] [client 20.27.218.116:32413] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file13.php"] [unique_id "aWas4UooYwabcb9R9fw0KAAAAE4"]
[Wed Jan 14 04:36:49.787834 2026] [:error] [pid 24601:tid 24626] [client 20.27.218.116:32386] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file13.php"] [unique_id "aWas4UCtWkZ9rlKW5n99igAAABA"]
[Wed Jan 14 04:36:50.033152 2026] [:error] [pid 58899:tid 58924] [client 20.27.218.116:11256] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aWas4gWViGQd5R44tHFttQAAAZU"]
[Wed Jan 14 04:36:50.310076 2026] [:error] [pid 58901:tid 58945] [client 20.27.218.116:32424] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aWas4r3kQSrcqIWtO0ofpgAAAc8"]
[Wed Jan 14 04:36:50.564826 2026] [:error] [pid 24602:tid 24658] [client 20.27.218.116:32503] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aWas4kooYwabcb9R9fw0KQAAAFQ"]
[Wed Jan 14 04:36:50.814649 2026] [:error] [pid 59074:tid 59098] [client 20.27.218.116:32490] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aWas4k_KrJ818pzhB3xfBgAAAlY"]
[Wed Jan 14 04:36:51.059800 2026] [:error] [pid 58868:tid 58877] [client 20.27.218.116:32465] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3406.php"] [unique_id "aWas4067yj8PZAmdsbllFwAAAUc"]
[Wed Jan 14 04:36:51.337116 2026] [:error] [pid 58868:tid 58888] [client 20.27.218.116:11220] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3406.php"] [unique_id "aWas4067yj8PZAmdsbllGAAAAVI"]
[Wed Jan 14 04:36:51.602505 2026] [:error] [pid 24601:tid 24617] [client 20.27.218.116:11239] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3406.php"] [unique_id "aWas40CtWkZ9rlKW5n99jAAAAAc"]
[Wed Jan 14 04:36:51.843293 2026] [:error] [pid 24710:tid 24718] [client 20.27.218.116:32396] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3406.php"] [unique_id "aWas42XBo5bEhDEEhs1V8gAAAMY"]
[Wed Jan 14 04:36:52.084627 2026] [:error] [pid 59074:tid 59082] [client 20.27.218.116:11211] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/963e.php"] [unique_id "aWas5E_KrJ818pzhB3xfBwAAAkY"]
[Wed Jan 14 04:36:52.346802 2026] [:error] [pid 58699:tid 58702] [client 20.27.218.116:32473] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/963e.php"] [unique_id "aWas5OYdPBtkMLK2SdqkIwAAAQA"]
[Wed Jan 14 04:36:52.629192 2026] [:error] [pid 24601:tid 24610] [client 20.27.218.116:32392] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/963e.php"] [unique_id "aWas5ECtWkZ9rlKW5n99jQAAAAA"]
[Wed Jan 14 04:36:52.873681 2026] [:error] [pid 58699:tid 58719] [client 20.27.218.116:32417] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/963e.php"] [unique_id "aWas5OYdPBtkMLK2SdqkJAAAARE"]
[Wed Jan 14 04:36:53.130543 2026] [:error] [pid 24601:tid 24618] [client 20.27.218.116:11217] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aWas5UCtWkZ9rlKW5n99kAAAAAg"]
[Wed Jan 14 04:36:53.370762 2026] [:error] [pid 59074:tid 59093] [client 20.27.218.116:32447] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aWas5U_KrJ818pzhB3xfCAAAAlE"]
[Wed Jan 14 04:36:53.629545 2026] [:error] [pid 24601:tid 24628] [client 20.27.218.116:32420] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aWas5UCtWkZ9rlKW5n99kgAAABI"]
[Wed Jan 14 04:36:53.885071 2026] [:error] [pid 24603:tid 24675] [client 20.27.218.116:32439] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aWas5ZPBJGFGN8VT8_SbRQAAAIo"]
[Wed Jan 14 04:36:54.133069 2026] [:error] [pid 24603:tid 24685] [client 20.27.218.116:32456] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cjfuns.php"] [unique_id "aWas5pPBJGFGN8VT8_SbRgAAAJQ"]
[Wed Jan 14 04:36:54.402663 2026] [:error] [pid 24710:tid 24732] [client 20.27.218.116:11153] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cjfuns.php"] [unique_id "aWas5mXBo5bEhDEEhs1V8wAAANQ"]
[Wed Jan 14 04:36:54.682854 2026] [:error] [pid 24710:tid 24734] [client 20.27.218.116:32457] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cjfuns.php"] [unique_id "aWas5mXBo5bEhDEEhs1V9AAAANY"]
[Wed Jan 14 04:36:54.924201 2026] [:error] [pid 24710:tid 24722] [client 20.27.218.116:32407] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cjfuns.php"] [unique_id "aWas5mXBo5bEhDEEhs1V9QAAAMo"]
[Wed Jan 14 04:36:55.178298 2026] [:error] [pid 24710:tid 24725] [client 20.27.218.116:32425] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aWas52XBo5bEhDEEhs1V9gAAAM0"]
[Wed Jan 14 04:36:55.422002 2026] [:error] [pid 59074:tid 59095] [client 20.27.218.116:32430] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aWas50_KrJ818pzhB3xfCQAAAlM"]
[Wed Jan 14 04:36:55.662977 2026] [:error] [pid 24710:tid 24720] [client 20.27.218.116:32432] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aWas52XBo5bEhDEEhs1V9wAAAMg"]
[Wed Jan 14 04:36:55.911939 2026] [:error] [pid 58699:tid 58723] [client 20.27.218.116:32403] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akk.php"] [unique_id "aWas5-YdPBtkMLK2SdqkJQAAARU"]
[Wed Jan 14 04:36:56.177818 2026] [:error] [pid 24602:tid 24647] [client 20.27.218.116:32450] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aWas6EooYwabcb9R9fw0KwAAAEk"]
[Wed Jan 14 04:36:56.443989 2026] [:error] [pid 58699:tid 58703] [client 20.27.218.116:32427] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aWas6OYdPBtkMLK2SdqkJwAAAQE"]
[Wed Jan 14 04:36:56.729493 2026] [:error] [pid 24710:tid 24719] [client 20.27.218.116:32510] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aWas6GXBo5bEhDEEhs1V-AAAAMc"]
[Wed Jan 14 04:36:56.994205 2026] [:error] [pid 58977:tid 58997] [client 20.27.218.116:11222] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aWas6LlT6ggZLRx9QvD8JQAAAhE"]
[Wed Jan 14 04:36:57.247269 2026] [:error] [pid 24601:tid 24633] [client 20.27.218.116:32502] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aWas6UCtWkZ9rlKW5n99lQAAABc"]
[Wed Jan 14 04:36:57.496766 2026] [:error] [pid 24603:tid 24676] [client 20.27.218.116:11169] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aWas6ZPBJGFGN8VT8_SbRwAAAIs"]
[Wed Jan 14 04:36:57.776299 2026] [:error] [pid 58699:tid 58704] [client 20.27.218.116:11236] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aWas6eYdPBtkMLK2SdqkKAAAAQI"]
[Wed Jan 14 04:36:58.020885 2026] [:error] [pid 24601:tid 24614] [client 20.27.218.116:11201] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "aWas6kCtWkZ9rlKW5n99lgAAAAQ"]
[Wed Jan 14 04:36:58.265071 2026] [:error] [pid 24602:tid 24655] [client 20.27.218.116:11143] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aWas6kooYwabcb9R9fw0LQAAAFE"]
[Wed Jan 14 04:36:58.508122 2026] [:error] [pid 24602:tid 24638] [client 20.27.218.116:11245] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aWas6kooYwabcb9R9fw0LgAAAEA"]
[Wed Jan 14 04:36:58.748654 2026] [:error] [pid 59074:tid 59085] [client 20.27.218.116:11258] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aWas6k_KrJ818pzhB3xfCwAAAkk"]
[Wed Jan 14 04:36:59.004205 2026] [:error] [pid 24710:tid 24712] [client 20.27.218.116:32389] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "aWas62XBo5bEhDEEhs1V-QAAAMA"]
[Wed Jan 14 04:36:59.261855 2026] [:error] [pid 24710:tid 24717] [client 20.27.218.116:11223] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aWas62XBo5bEhDEEhs1V-gAAAMU"]
[Wed Jan 14 04:36:59.552916 2026] [:error] [pid 24603:tid 24678] [client 20.27.218.116:32506] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aWas65PBJGFGN8VT8_SbSAAAAI0"]
[Wed Jan 14 04:36:59.813888 2026] [:error] [pid 24603:tid 24668] [client 20.27.218.116:11234] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aWas65PBJGFGN8VT8_SbSQAAAIM"]
[Wed Jan 14 04:37:00.068332 2026] [:error] [pid 59074:tid 59092] [client 20.27.218.116:11155] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aWas7E_KrJ818pzhB3xfDAAAAlA"]
[Wed Jan 14 04:37:00.318137 2026] [:error] [pid 59074:tid 59081] [client 20.27.218.116:32421] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aWas7E_KrJ818pzhB3xfDQAAAkU"]
[Wed Jan 14 04:37:00.571081 2026] [:error] [pid 24601:tid 24615] [client 20.27.218.116:32423] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aWas7ECtWkZ9rlKW5n99lwAAAAU"]
[Wed Jan 14 04:37:00.812734 2026] [:error] [pid 24601:tid 24624] [client 20.27.218.116:11200] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aWas7ECtWkZ9rlKW5n99mAAAAA4"]
[Wed Jan 14 04:37:01.058150 2026] [:error] [pid 24601:tid 24623] [client 20.27.218.116:11206] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aWas7UCtWkZ9rlKW5n99mQAAAA0"]
[Wed Jan 14 04:37:01.331771 2026] [:error] [pid 24601:tid 24613] [client 20.27.218.116:11225] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aWas7UCtWkZ9rlKW5n99mgAAAAM"]
[Wed Jan 14 04:37:01.571072 2026] [:error] [pid 24602:tid 24662] [client 20.27.218.116:11231] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aWas7UooYwabcb9R9fw0LwAAAFg"]
[Wed Jan 14 04:37:01.811362 2026] [:error] [pid 24601:tid 24616] [client 20.27.218.116:32482] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aWas7UCtWkZ9rlKW5n99mwAAAAY"]
[Wed Jan 14 04:37:02.056725 2026] [:error] [pid 59074:tid 59080] [client 20.27.218.116:11204] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aWas7k_KrJ818pzhB3xfEwAAAkQ"]
[Wed Jan 14 04:37:02.304375 2026] [:error] [pid 24710:tid 24713] [client 20.27.218.116:32496] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aWas7mXBo5bEhDEEhs1V_AAAAME"]
[Wed Jan 14 04:37:02.550177 2026] [:error] [pid 58977:tid 58981] [client 20.27.218.116:32412] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aWas7rlT6ggZLRx9QvD8JwAAAgE"]
[Wed Jan 14 04:37:02.804382 2026] [:error] [pid 58899:tid 58920] [client 20.27.218.116:32418] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aWas7gWViGQd5R44tHFtwgAAAZE"]
[Wed Jan 14 04:37:03.052148 2026] [:error] [pid 58977:tid 58985] [client 20.27.218.116:11246] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aWas77lT6ggZLRx9QvD8KAAAAgU"]
[Wed Jan 14 04:37:03.295994 2026] [:error] [pid 58977:tid 58998] [client 20.27.218.116:32474] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aWas77lT6ggZLRx9QvD8KQAAAhI"]
[Wed Jan 14 04:37:03.538502 2026] [:error] [pid 24710:tid 24733] [client 20.27.218.116:32466] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aWas72XBo5bEhDEEhs1V_gAAANU"]
[Wed Jan 14 04:37:03.779487 2026] [:error] [pid 58899:tid 58923] [client 20.27.218.116:11229] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aWas7wWViGQd5R44tHFtxAAAAZQ"]
[Wed Jan 14 04:37:04.022579 2026] [:error] [pid 24710:tid 24735] [client 20.27.218.116:32511] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aWas8GXBo5bEhDEEhs1V_wAAANc"]
[Wed Jan 14 04:37:04.265812 2026] [:error] [pid 24710:tid 24721] [client 20.27.218.116:32445] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aWas8GXBo5bEhDEEhs1WAAAAAMk"]
[Wed Jan 14 04:37:04.508442 2026] [:error] [pid 24710:tid 24728] [client 20.27.218.116:11161] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aWas8GXBo5bEhDEEhs1WAQAAANA"]
[Wed Jan 14 04:37:04.757422 2026] [:error] [pid 24710:tid 24727] [client 20.27.218.116:11251] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aWas8GXBo5bEhDEEhs1WAgAAAM8"]
[Wed Jan 14 04:37:05.012341 2026] [:error] [pid 58977:tid 59003] [client 20.27.218.116:32441] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aWas8blT6ggZLRx9QvD8LAAAAhc"]
[Wed Jan 14 04:37:05.261334 2026] [:error] [pid 58977:tid 58990] [client 20.27.218.116:11261] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aWas8blT6ggZLRx9QvD8LQAAAgo"]
[Wed Jan 14 04:37:05.502672 2026] [:error] [pid 24710:tid 24726] [client 20.27.218.116:11156] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aWas8WXBo5bEhDEEhs1WAwAAAM4"]
[Wed Jan 14 04:37:05.770652 2026] [:error] [pid 24601:tid 24621] [client 20.27.218.116:11232] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aWas8UCtWkZ9rlKW5n99nAAAAAs"]
[Wed Jan 14 04:37:06.017842 2026] [:error] [pid 58868:tid 58874] [client 20.27.218.116:32433] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell1.php"] [unique_id "aWas8k67yj8PZAmdsbllHQAAAUQ"]
[Wed Jan 14 04:37:06.265856 2026] [:error] [pid 58899:tid 58919] [client 20.27.218.116:11209] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aWas8gWViGQd5R44tHFtxwAAAZA"]
[Wed Jan 14 04:37:06.508795 2026] [:error] [pid 24710:tid 24716] [client 20.27.218.116:32454] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aWas8mXBo5bEhDEEhs1WBQAAAMQ"]
[Wed Jan 14 04:37:06.756340 2026] [:error] [pid 24710:tid 24718] [client 20.27.218.116:11093] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aWas8mXBo5bEhDEEhs1WBgAAAMY"]
[Wed Jan 14 04:37:07.001074 2026] [:error] [pid 24710:tid 24734] [client 20.27.218.116:32434] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aWas82XBo5bEhDEEhs1WCAAAANY"]
[Wed Jan 14 04:37:07.262634 2026] [:error] [pid 24710:tid 24722] [client 20.27.218.116:32493] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aWas82XBo5bEhDEEhs1WCQAAAMo"]
[Wed Jan 14 04:37:07.536488 2026] [:error] [pid 24601:tid 24630] [client 20.27.218.116:11180] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aWas80CtWkZ9rlKW5n99nQAAABQ"]
[Wed Jan 14 04:37:07.814286 2026] [:error] [pid 58899:tid 58911] [client 20.27.218.116:11168] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aWas8wWViGQd5R44tHFtyQAAAYg"]
[Wed Jan 14 04:37:08.058382 2026] [:error] [pid 58899:tid 58908] [client 20.27.218.116:32397] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aWas9AWViGQd5R44tHFtygAAAYU"]
[Wed Jan 14 04:37:08.305064 2026] [:error] [pid 58868:tid 58894] [client 20.27.218.116:11227] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hexx.php"] [unique_id "aWas9E67yj8PZAmdsbllHgAAAVg"]
[Wed Jan 14 04:37:08.565072 2026] [:error] [pid 24710:tid 24720] [client 20.27.218.116:11247] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hexx.php"] [unique_id "aWas9GXBo5bEhDEEhs1WCgAAAMg"]
[Wed Jan 14 04:37:08.810717 2026] [:error] [pid 58868:tid 58879] [client 20.27.218.116:32487] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hexx.php"] [unique_id "aWas9E67yj8PZAmdsbllHwAAAUk"]
[Wed Jan 14 04:37:09.097360 2026] [:error] [pid 24710:tid 24719] [client 20.27.218.116:11215] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hexx.php"] [unique_id "aWas9WXBo5bEhDEEhs1WCwAAAMc"]
[Wed Jan 14 04:37:09.348297 2026] [:error] [pid 58868:tid 58893] [client 20.27.218.116:11142] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aWas9U67yj8PZAmdsbllIAAAAVc"]
[Wed Jan 14 04:37:09.607626 2026] [:error] [pid 58868:tid 58883] [client 20.27.218.116:32443] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aWas9U67yj8PZAmdsbllIQAAAU0"]
[Wed Jan 14 04:37:09.882968 2026] [:error] [pid 58868:tid 58891] [client 20.27.218.116:11249] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aWas9U67yj8PZAmdsbllIgAAAVU"]
[Wed Jan 14 04:37:10.134649 2026] [:error] [pid 58868:tid 58885] [client 20.27.218.116:11214] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aWas9k67yj8PZAmdsbllIwAAAU8"]
[Wed Jan 14 04:37:10.384304 2026] [:error] [pid 58868:tid 58890] [client 20.27.218.116:11136] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aWas9k67yj8PZAmdsbllJAAAAVQ"]
[Wed Jan 14 04:37:10.627141 2026] [:error] [pid 24601:tid 24617] [client 20.27.218.116:11107] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aWas9kCtWkZ9rlKW5n99ngAAAAc"]
[Wed Jan 14 04:37:10.874351 2026] [:error] [pid 24710:tid 24717] [client 20.27.218.116:11242] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aWas9mXBo5bEhDEEhs1WDQAAAMU"]
[Wed Jan 14 04:37:11.130956 2026] [:error] [pid 58699:tid 58707] [client 20.27.218.116:11259] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aWas9-YdPBtkMLK2SdqkKQAAAQU"]
[Wed Jan 14 04:37:11.396978 2026] [:error] [pid 24710:tid 24714] [client 20.27.218.116:11228] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aWas92XBo5bEhDEEhs1WDgAAAMI"]
[Wed Jan 14 04:37:11.649207 2026] [:error] [pid 58699:tid 58721] [client 20.27.218.116:11158] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aWas9-YdPBtkMLK2SdqkKgAAARM"]
[Wed Jan 14 04:37:11.890410 2026] [:error] [pid 24710:tid 24731] [client 20.27.218.116:11237] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aWas92XBo5bEhDEEhs1WDwAAANM"]
[Wed Jan 14 04:37:12.133342 2026] [:error] [pid 58977:tid 58992] [client 20.27.218.116:11151] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aWas-LlT6ggZLRx9QvD8LgAAAgw"]
[Wed Jan 14 04:37:12.377083 2026] [:error] [pid 58977:tid 59004] [client 20.27.218.116:11263] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aWas-LlT6ggZLRx9QvD8LwAAAhg"]
[Wed Jan 14 04:37:12.618198 2026] [:error] [pid 58699:tid 58718] [client 20.27.218.116:32415] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aWas-OYdPBtkMLK2SdqkKwAAARA"]
[Wed Jan 14 04:37:12.869713 2026] [:error] [pid 58699:tid 58709] [client 20.27.218.116:11183] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aWas-OYdPBtkMLK2SdqkLQAAAQc"]
[Wed Jan 14 04:37:13.111019 2026] [:error] [pid 58699:tid 58710] [client 20.27.218.116:32419] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aWas-eYdPBtkMLK2SdqkLgAAAQg"]
[Wed Jan 14 04:37:13.354477 2026] [:error] [pid 24603:tid 24682] [client 20.27.218.116:11207] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aWas-ZPBJGFGN8VT8_SbTAAAAJE"]
[Wed Jan 14 04:37:13.594100 2026] [:error] [pid 59074:tid 59088] [client 20.27.218.116:32384] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aWas-U_KrJ818pzhB3xfRAAAAkw"]
[Wed Jan 14 04:37:13.856804 2026] [:error] [pid 58868:tid 58880] [client 20.27.218.116:32426] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aWas-U67yj8PZAmdsbllJgAAAUo"]
[Wed Jan 14 04:37:14.097416 2026] [:error] [pid 24603:tid 24689] [client 20.27.218.116:11218] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aWas-pPBJGFGN8VT8_SbTQAAAJg"]
[Wed Jan 14 04:37:14.337851 2026] [:error] [pid 24710:tid 24728] [client 20.27.218.116:32472] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWas-mXBo5bEhDEEhs1WEQAAANA"]
[Wed Jan 14 04:37:14.581055 2026] [:error] [pid 24710:tid 24727] [client 20.27.218.116:11174] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWas-mXBo5bEhDEEhs1WEgAAAM8"]
[Wed Jan 14 04:37:14.828639 2026] [:error] [pid 24710:tid 24716] [client 20.27.218.116:32457] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWas-mXBo5bEhDEEhs1WEwAAAMQ"]
[Wed Jan 14 04:37:15.086382 2026] [:error] [pid 24710:tid 24718] [client 20.27.218.116:32436] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWas-2XBo5bEhDEEhs1WFQAAAMY"]
[Wed Jan 14 04:37:15.363523 2026] [:error] [pid 58699:tid 58703] [client 20.27.218.116:32448] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aWas--YdPBtkMLK2SdqkNAAAAQE"]
[Wed Jan 14 04:37:15.620131 2026] [:error] [pid 24710:tid 24722] [client 20.27.218.116:11240] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aWas-2XBo5bEhDEEhs1WFgAAAMo"]
[Wed Jan 14 04:37:15.859924 2026] [:error] [pid 24603:tid 24677] [client 20.27.218.116:11198] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aWas-5PBJGFGN8VT8_SbUwAAAIw"]
[Wed Jan 14 04:37:16.107422 2026] [:error] [pid 58901:tid 58941] [client 20.27.218.116:11157] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aWas_L3kQSrcqIWtO0of_wAAAcs"]
[Wed Jan 14 04:37:16.357900 2026] [:error] [pid 24603:tid 24675] [client 20.27.218.116:11248] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aWas_JPBJGFGN8VT8_SbVAAAAIo"]
[Wed Jan 14 04:37:16.598386 2026] [:error] [pid 24603:tid 24685] [client 20.27.218.116:11145] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aWas_JPBJGFGN8VT8_SbVQAAAJQ"]
[Wed Jan 14 04:37:16.839935 2026] [:error] [pid 24603:tid 24668] [client 20.27.218.116:11208] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aWas_JPBJGFGN8VT8_SbVwAAAIM"]
[Wed Jan 14 04:37:17.094037 2026] [:error] [pid 58868:tid 58877] [client 20.27.218.116:32438] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aWas_U67yj8PZAmdsbllKAAAAUc"]
[Wed Jan 14 04:37:17.356259 2026] [:error] [pid 58899:tid 58918] [client 20.27.218.116:32410] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aWas_QWViGQd5R44tHFtzwAAAY8"]
[Wed Jan 14 04:37:17.601287 2026] [:error] [pid 58699:tid 58720] [client 20.27.218.116:11219] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aWas_eYdPBtkMLK2SdqkNgAAARI"]
[Wed Jan 14 04:37:17.849171 2026] [:error] [pid 24710:tid 24732] [client 20.27.218.116:11149] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aWas_WXBo5bEhDEEhs1WFwAAANQ"]
[Wed Jan 14 04:37:18.097204 2026] [:error] [pid 58901:tid 58947] [client 20.27.218.116:11260] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conflg.php"] [unique_id "aWas_r3kQSrcqIWtO0ogAAAAAdE"]
[Wed Jan 14 04:37:18.338882 2026] [:error] [pid 58901:tid 58949] [client 20.27.218.116:11245] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aWas_r3kQSrcqIWtO0ogAQAAAdM"]
[Wed Jan 14 04:37:18.598274 2026] [:error] [pid 58901:tid 58936] [client 20.27.218.116:32464] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aWas_r3kQSrcqIWtO0ogAgAAAcY"]
[Wed Jan 14 04:37:18.884194 2026] [:error] [pid 58699:tid 58721] [client 20.27.218.116:11173] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aWas_uYdPBtkMLK2SdqkOAAAARM"]
[Wed Jan 14 04:37:19.126331 2026] [:error] [pid 58699:tid 58718] [client 20.27.218.116:11241] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aWas_-YdPBtkMLK2SdqkOQAAARA"]
[Wed Jan 14 04:37:19.396264 2026] [:error] [pid 58977:tid 58991] [client 20.27.218.116:11080] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aWas_7lT6ggZLRx9QvD8MgAAAgs"]
[Wed Jan 14 04:37:19.673192 2026] [:error] [pid 58977:tid 58989] [client 20.27.218.116:11202] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aWas_7lT6ggZLRx9QvD8MwAAAgk"]
[Wed Jan 14 04:37:19.949860 2026] [:error] [pid 58699:tid 58709] [client 20.27.218.116:11150] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aWas_-YdPBtkMLK2SdqkOwAAAQc"]
[Wed Jan 14 04:37:20.204157 2026] [:error] [pid 58977:tid 58997] [client 20.27.218.116:11235] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aWatALlT6ggZLRx9QvD8NgAAAhE"]
[Wed Jan 14 04:37:20.452276 2026] [:error] [pid 58977:tid 59002] [client 20.27.218.116:11244] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aWatALlT6ggZLRx9QvD8NwAAAhY"]
[Wed Jan 14 04:37:20.692031 2026] [:error] [pid 58977:tid 58985] [client 20.27.218.116:11056] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aWatALlT6ggZLRx9QvD8OgAAAgU"]
[Wed Jan 14 04:37:20.986122 2026] [:error] [pid 58699:tid 58705] [client 20.27.218.116:11172] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aWatAOYdPBtkMLK2SdqkPQAAAQM"]
[Wed Jan 14 04:37:21.251904 2026] [:error] [pid 58901:tid 58932] [client 20.27.218.116:11166] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aWatAb3kQSrcqIWtO0ogAwAAAcI"]
[Wed Jan 14 04:37:21.518169 2026] [:error] [pid 58977:tid 58990] [client 20.27.218.116:11205] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aWatAblT6ggZLRx9QvD8PQAAAgo"]
[Wed Jan 14 04:37:21.773864 2026] [:error] [pid 58699:tid 58710] [client 20.27.218.116:11186] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aWatAeYdPBtkMLK2SdqkPgAAAQg"]
[Wed Jan 14 04:37:22.016949 2026] [:error] [pid 58699:tid 58715] [client 20.27.218.116:11084] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aWatAuYdPBtkMLK2SdqkPwAAAQ0"]
[Wed Jan 14 04:37:22.266627 2026] [:error] [pid 58699:tid 58713] [client 20.27.218.116:11087] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "aWatAuYdPBtkMLK2SdqkQAAAAQs"]
[Wed Jan 14 04:37:22.513286 2026] [:error] [pid 58699:tid 58725] [client 20.27.218.116:32435] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aWatAuYdPBtkMLK2SdqkQQAAARc"]
[Wed Jan 14 04:37:22.761299 2026] [:error] [pid 24602:tid 24639] [client 20.27.218.116:11029] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aWatAkooYwabcb9R9fw0MQAAAEE"]
[Wed Jan 14 04:37:23.004120 2026] [:error] [pid 24602:tid 24659] [client 20.27.218.116:11229] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aWatA0ooYwabcb9R9fw0MgAAAFU"]
[Wed Jan 14 04:37:23.283582 2026] [:error] [pid 58901:tid 58951] [client 20.27.218.116:11175] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/406.php"] [unique_id "aWatA73kQSrcqIWtO0ogBAAAAdU"]
[Wed Jan 14 04:37:23.560356 2026] [:error] [pid 24710:tid 24719] [client 20.27.218.116:32442] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aWatA2XBo5bEhDEEhs1WGQAAAMc"]
[Wed Jan 14 04:37:23.828541 2026] [:error] [pid 58901:tid 58930] [client 20.27.218.116:32484] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aWatA73kQSrcqIWtO0ogBQAAAcA"]
[Wed Jan 14 04:37:24.199187 2026] [:error] [pid 24710:tid 24714] [client 20.27.218.116:11139] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aWatBGXBo5bEhDEEhs1WGwAAAMI"]
[Wed Jan 14 04:37:24.438697 2026] [:error] [pid 24602:tid 24641] [client 20.27.218.116:11195] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aWatBEooYwabcb9R9fw0MwAAAEM"]
[Wed Jan 14 04:37:24.688321 2026] [:error] [pid 58901:tid 58938] [client 20.27.218.116:11212] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aWatBL3kQSrcqIWtO0ogBgAAAcg"]
[Wed Jan 14 04:37:24.929721 2026] [:error] [pid 58899:tid 58925] [client 20.27.218.116:11199] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aWatBAWViGQd5R44tHFt0AAAAZY"]
[Wed Jan 14 04:37:25.193904 2026] [:error] [pid 58977:tid 59004] [client 20.27.218.116:11178] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aWatBblT6ggZLRx9QvD8PwAAAhg"]
[Wed Jan 14 04:37:25.433910 2026] [:error] [pid 58699:tid 58726] [client 20.27.218.116:11120] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-info.php"] [unique_id "aWatBeYdPBtkMLK2SdqkQwAAARg"]
[Wed Jan 14 04:37:25.674332 2026] [:error] [pid 24602:tid 24649] [client 20.27.218.116:11170] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aWatBUooYwabcb9R9fw0NQAAAEs"]
[Wed Jan 14 04:37:25.922760 2026] [:error] [pid 24603:tid 24674] [client 20.27.218.116:11164] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aWatBZPBJGFGN8VT8_SbXAAAAIk"]
[Wed Jan 14 04:37:26.166226 2026] [:error] [pid 24603:tid 24689] [client 20.27.218.116:11254] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aWatBpPBJGFGN8VT8_SbXgAAAJg"]
[Wed Jan 14 04:37:26.423651 2026] [:error] [pid 24602:tid 24645] [client 20.27.218.116:11079] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aWatBkooYwabcb9R9fw0NwAAAEc"]
[Wed Jan 14 04:37:26.708192 2026] [:error] [pid 24602:tid 24657] [client 20.27.218.116:11103] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aWatBkooYwabcb9R9fw0OAAAAFM"]
[Wed Jan 14 04:37:26.981633 2026] [:error] [pid 58699:tid 58719] [client 20.27.218.116:32508] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aWatBuYdPBtkMLK2SdqkRAAAARE"]
[Wed Jan 14 04:37:27.237043 2026] [:error] [pid 58901:tid 58942] [client 20.27.218.116:11130] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aWatB73kQSrcqIWtO0ogCgAAAcw"]
[Wed Jan 14 04:37:27.517778 2026] [:error] [pid 58901:tid 58952] [client 20.27.218.116:32505] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aWatB73kQSrcqIWtO0ogCwAAAdY"]
[Wed Jan 14 04:37:27.802014 2026] [:error] [pid 58977:tid 58996] [client 20.27.218.116:11138] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aWatB7lT6ggZLRx9QvD8RAAAAhA"]
[Wed Jan 14 04:37:28.052089 2026] [:error] [pid 58977:tid 58997] [client 20.27.218.116:11105] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aWatCLlT6ggZLRx9QvD8RgAAAhE"]
[Wed Jan 14 04:37:28.298113 2026] [:error] [pid 59074:tid 59078] [client 20.27.218.116:11181] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aWatCE_KrJ818pzhB3xfRQAAAkI"]
[Wed Jan 14 04:37:28.559454 2026] [:error] [pid 59074:tid 59091] [client 20.27.218.116:11122] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aWatCE_KrJ818pzhB3xfRgAAAk8"]
[Wed Jan 14 04:37:28.807608 2026] [:error] [pid 58977:tid 58981] [client 20.27.218.116:11128] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWatCLlT6ggZLRx9QvD8SwAAAgE"]
[Wed Jan 14 04:37:29.065627 2026] [:error] [pid 24603:tid 24681] [client 20.27.218.116:11104] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWatCZPBJGFGN8VT8_SbZgAAAJA"]
[Wed Jan 14 04:37:29.319988 2026] [:error] [pid 24603:tid 24686] [client 20.27.218.116:11179] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWatCZPBJGFGN8VT8_SbaAAAAJU"]
[Wed Jan 14 04:37:29.596660 2026] [:error] [pid 24710:tid 24731] [client 20.27.218.116:11167] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWatCWXBo5bEhDEEhs1WHAAAANM"]
[Wed Jan 14 04:37:29.846106 2026] [:error] [pid 59074:tid 59079] [client 20.27.218.116:11148] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aWatCU_KrJ818pzhB3xfRwAAAkM"]
[Wed Jan 14 04:37:30.109092 2026] [:error] [pid 58901:tid 58950] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Jan 14 04:37:30.234935 2026] [:error] [pid 58901:tid 58948] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Wed Jan 14 04:37:30.359006 2026] [:error] [pid 58901:tid 58953] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Jan 14 04:37:30.483820 2026] [:error] [pid 58901:tid 58934] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/asas.php
[Wed Jan 14 04:37:30.608656 2026] [:error] [pid 58901:tid 58947] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/rk2.php
[Wed Jan 14 04:37:30.732558 2026] [:error] [pid 58901:tid 58936] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Wed Jan 14 04:37:30.871319 2026] [:error] [pid 58901:tid 58932] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Jan 14 04:37:30.997348 2026] [:error] [pid 58901:tid 58951] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aespa.php
[Wed Jan 14 04:37:31.123823 2026] [:error] [pid 58901:tid 58930] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Jan 14 04:37:31.249706 2026] [:error] [pid 58901:tid 58938] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Jan 14 04:37:31.373782 2026] [:error] [pid 58901:tid 58937] [client 20.27.218.116:11012] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Wed Jan 14 04:37:32.887686 2026] [:error] [pid 58901:tid 58937] [client 20.27.218.116:11012] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aWatDL3kQSrcqIWtO0ogNQAAAcc"]
[Wed Jan 14 04:37:33.133972 2026] [:error] [pid 58901:tid 58944] [client 20.27.218.116:11118] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aWatDb3kQSrcqIWtO0ogNgAAAc4"]
[Wed Jan 14 04:37:33.394465 2026] [:error] [pid 58977:tid 58999] [client 20.27.218.116:11146] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aWatDblT6ggZLRx9QvD8UwAAAhM"]
[Wed Jan 14 04:37:33.647945 2026] [:error] [pid 58699:tid 58714] [client 20.27.218.116:11145] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aWatDeYdPBtkMLK2SdqkRQAAAQw"]
[Wed Jan 14 04:37:34.007374 2026] [:error] [pid 58868:tid 58888] [client 20.27.218.116:11238] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aWatDk67yj8PZAmdsbllKQAAAVI"]
[Wed Jan 14 04:37:34.259541 2026] [:error] [pid 58699:tid 58703] [client 20.27.218.116:11193] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aWatDuYdPBtkMLK2SdqkRwAAAQE"]
[Wed Jan 14 04:37:34.695498 2026] [:error] [pid 24710:tid 24712] [client 20.27.218.116:11255] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aWatDmXBo5bEhDEEhs1WHQAAAMA"]
[Wed Jan 14 04:37:34.943563 2026] [:error] [pid 58977:tid 58992] [client 20.27.218.116:11165] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aWatDrlT6ggZLRx9QvD8VAAAAgw"]
[Wed Jan 14 04:37:35.225306 2026] [:error] [pid 58901:tid 58940] [client 20.27.218.116:11098] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aWatD73kQSrcqIWtO0ogNwAAAco"]
[Wed Jan 14 04:37:35.581066 2026] [:error] [pid 24710:tid 24729] [client 20.27.218.116:11116] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aWatD2XBo5bEhDEEhs1WHwAAANE"]
[Wed Jan 14 04:37:35.919852 2026] [:error] [pid 58899:tid 58910] [client 20.27.218.116:11072] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aWatDwWViGQd5R44tHFt0wAAAYc"]
[Wed Jan 14 04:37:36.165978 2026] [:error] [pid 58899:tid 58926] [client 20.27.218.116:11100] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aWatEAWViGQd5R44tHFt1AAAAZc"]
[Wed Jan 14 04:37:36.418583 2026] [:error] [pid 24602:tid 24641] [client 20.27.218.116:11250] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aWatEEooYwabcb9R9fw0RgAAAEM"]
[Wed Jan 14 04:37:36.690362 2026] [:error] [pid 58899:tid 58905] [client 20.27.218.116:11190] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aWatEAWViGQd5R44tHFt1gAAAYI"]
[Wed Jan 14 04:37:36.982901 2026] [:error] [pid 58899:tid 58920] [client 20.27.218.116:11192] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aWatEAWViGQd5R44tHFt1wAAAZE"]
[Wed Jan 14 04:37:37.309287 2026] [:error] [pid 24710:tid 24733] [client 20.27.218.116:11221] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aWatEWXBo5bEhDEEhs1WIAAAANU"]
[Wed Jan 14 04:37:37.613373 2026] [:error] [pid 58899:tid 58922] [client 20.27.218.116:11109] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aWatEQWViGQd5R44tHFt2AAAAZM"]
[Wed Jan 14 04:37:37.886702 2026] [:error] [pid 58899:tid 58923] [client 20.27.218.116:32440] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aWatEQWViGQd5R44tHFt2QAAAZQ"]
[Wed Jan 14 04:37:38.184139 2026] [:error] [pid 58899:tid 58927] [client 20.27.218.116:11172] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aWatEgWViGQd5R44tHFt2gAAAZg"]
[Wed Jan 14 04:37:38.471845 2026] [:error] [pid 24710:tid 24721] [client 20.27.218.116:11197] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aWatEmXBo5bEhDEEhs1WIQAAAMk"]
[Wed Jan 14 04:37:38.722608 2026] [:error] [pid 59074:tid 59084] [client 20.27.218.116:11013] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aWatEk_KrJ818pzhB3xfSAAAAkg"]
[Wed Jan 14 04:37:38.978379 2026] [:error] [pid 58899:tid 58916] [client 20.27.218.116:11097] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aWatEgWViGQd5R44tHFt3AAAAY0"]
[Wed Jan 14 04:37:39.270909 2026] [:error] [pid 24710:tid 24716] [client 20.27.218.116:11034] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aWatE2XBo5bEhDEEhs1WIwAAAMQ"]
[Wed Jan 14 04:37:39.518204 2026] [:error] [pid 24602:tid 24653] [client 20.27.218.116:11076] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js.php"] [unique_id "aWatE0ooYwabcb9R9fw0RwAAAE8"]
[Wed Jan 14 04:37:39.783821 2026] [:error] [pid 24602:tid 24656] [client 20.27.218.116:11099] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aWatE0ooYwabcb9R9fw0SAAAAFI"]
[Wed Jan 14 04:37:40.207914 2026] [:error] [pid 24602:tid 24654] [client 20.27.218.116:11110] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aWatFEooYwabcb9R9fw0SQAAAFA"]
[Wed Jan 14 04:37:40.473176 2026] [:error] [pid 24602:tid 24645] [client 20.27.218.116:11106] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aWatFEooYwabcb9R9fw0SgAAAEc"]
[Wed Jan 14 04:37:40.771927 2026] [:error] [pid 24603:tid 24682] [client 20.27.218.116:11226] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aWatFJPBJGFGN8VT8_SbdgAAAJE"]
[Wed Jan 14 04:37:41.219521 2026] [:error] [pid 24710:tid 24730] [client 20.27.218.116:32469] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aWatFWXBo5bEhDEEhs1WJQAAANI"]
[Wed Jan 14 04:37:41.493093 2026] [:error] [pid 24601:tid 24611] [client 20.27.218.116:11262] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aWatFUCtWkZ9rlKW5n99pgAAAAE"]
[Wed Jan 14 04:37:41.793768 2026] [:error] [pid 24601:tid 24627] [client 20.27.218.116:11171] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aWatFUCtWkZ9rlKW5n99pwAAABE"]
[Wed Jan 14 04:37:42.099492 2026] [:error] [pid 24710:tid 24715] [client 20.27.218.116:11182] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aWatFmXBo5bEhDEEhs1WJgAAAMM"]
[Wed Jan 14 04:37:42.393285 2026] [:error] [pid 24601:tid 24633] [client 20.27.218.116:11137] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oivcl.php"] [unique_id "aWatFkCtWkZ9rlKW5n99qQAAABc"]
[Wed Jan 14 04:37:42.644951 2026] [:error] [pid 24603:tid 24669] [client 20.27.218.116:11102] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oivcl.php"] [unique_id "aWatFpPBJGFGN8VT8_SbeAAAAIQ"]
[Wed Jan 14 04:37:42.912029 2026] [:error] [pid 24710:tid 24734] [client 20.27.218.116:11196] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oivcl.php"] [unique_id "aWatFmXBo5bEhDEEhs1WKAAAANY"]
[Wed Jan 14 04:37:43.181914 2026] [:error] [pid 24710:tid 24732] [client 20.27.218.116:32437] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oivcl.php"] [unique_id "aWatF2XBo5bEhDEEhs1WKQAAANQ"]
[Wed Jan 14 04:37:43.422222 2026] [:error] [pid 24603:tid 24683] [client 20.27.218.116:11075] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwwha.php"] [unique_id "aWatF5PBJGFGN8VT8_SbeQAAAJI"]
[Wed Jan 14 04:37:43.669744 2026] [:error] [pid 24710:tid 24720] [client 20.27.218.116:11159] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwwha.php"] [unique_id "aWatF2XBo5bEhDEEhs1WKgAAAMg"]
[Wed Jan 14 04:37:43.930492 2026] [:error] [pid 24603:tid 24665] [client 20.27.218.116:11115] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwwha.php"] [unique_id "aWatF5PBJGFGN8VT8_SbegAAAIA"]
[Wed Jan 14 04:37:44.170685 2026] [:error] [pid 24710:tid 24719] [client 20.27.218.116:11092] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwwha.php"] [unique_id "aWatGGXBo5bEhDEEhs1WLAAAAMc"]
[Wed Jan 14 04:37:44.414477 2026] [:error] [pid 24710:tid 24714] [client 20.27.218.116:11010] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jvcpa.php"] [unique_id "aWatGGXBo5bEhDEEhs1WLQAAAMI"]
[Wed Jan 14 04:37:44.690763 2026] [:error] [pid 24710:tid 24717] [client 20.27.218.116:11124] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jvcpa.php"] [unique_id "aWatGGXBo5bEhDEEhs1WLgAAAMU"]
[Wed Jan 14 04:37:44.941680 2026] [:error] [pid 58868:tid 58887] [client 20.27.218.116:11009] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jvcpa.php"] [unique_id "aWatGE67yj8PZAmdsbllKgAAAVE"]
[Wed Jan 14 04:37:45.184436 2026] [:error] [pid 24601:tid 24634] [client 20.27.218.116:11194] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jvcpa.php"] [unique_id "aWatGUCtWkZ9rlKW5n99rAAAABg"]
[Wed Jan 14 04:37:45.432199 2026] [:error] [pid 24710:tid 24729] [client 20.27.218.116:11090] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lddxs.php"] [unique_id "aWatGWXBo5bEhDEEhs1WMQAAANE"]
[Wed Jan 14 04:37:45.674073 2026] [:error] [pid 24603:tid 24684] [client 20.27.218.116:11181] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lddxs.php"] [unique_id "aWatGZPBJGFGN8VT8_SbfAAAAJM"]
[Wed Jan 14 04:37:45.938541 2026] [:error] [pid 58699:tid 58721] [client 20.27.218.116:11121] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lddxs.php"] [unique_id "aWatGeYdPBtkMLK2SdqkSAAAARM"]
[Wed Jan 14 04:37:46.214901 2026] [:error] [pid 58699:tid 58708] [client 20.27.218.116:11046] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lddxs.php"] [unique_id "aWatGuYdPBtkMLK2SdqkSQAAAQY"]
[Wed Jan 14 04:37:46.462817 2026] [:error] [pid 24710:tid 24728] [client 20.27.218.116:11051] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aWatGmXBo5bEhDEEhs1WMgAAANA"]
[Wed Jan 14 04:37:46.708490 2026] [:error] [pid 24710:tid 24713] [client 20.27.218.116:11131] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aWatGmXBo5bEhDEEhs1WMwAAAME"]
[Wed Jan 14 04:37:46.953061 2026] [:error] [pid 24603:tid 24681] [client 20.27.218.116:11210] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aWatGpPBJGFGN8VT8_SbfgAAAJA"]
[Wed Jan 14 04:37:47.235898 2026] [:error] [pid 24710:tid 24716] [client 20.27.218.116:11184] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aWatG2XBo5bEhDEEhs1WNAAAAMQ"]
[Wed Jan 14 04:37:47.504414 2026] [:error] [pid 24710:tid 24726] [client 20.27.218.116:11129] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-miiss.php.php"] [unique_id "aWatG2XBo5bEhDEEhs1WNQAAAM4"]
[Wed Jan 14 04:37:47.774813 2026] [:error] [pid 58899:tid 58907] [client 20.27.218.116:32452] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-miiss.php.php"] [unique_id "aWatGwWViGQd5R44tHFt4QAAAYQ"]
[Wed Jan 14 04:37:48.073451 2026] [:error] [pid 58699:tid 58718] [client 20.27.218.116:11243] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-miiss.php.php"] [unique_id "aWatHOYdPBtkMLK2SdqkSgAAARA"]
[Wed Jan 14 04:37:48.320445 2026] [:error] [pid 58699:tid 58707] [client 20.27.218.116:11055] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-miiss.php.php"] [unique_id "aWatHOYdPBtkMLK2SdqkSwAAAQU"]
[Wed Jan 14 04:37:48.562415 2026] [:error] [pid 24603:tid 24686] [client 20.27.218.116:11217] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aWatHJPBJGFGN8VT8_SbgAAAAJU"]
[Wed Jan 14 04:37:48.815080 2026] [:error] [pid 58899:tid 58913] [client 20.27.218.116:11114] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aWatHAWViGQd5R44tHFt4gAAAYo"]
[Wed Jan 14 04:37:49.063297 2026] [:error] [pid 24710:tid 24715] [client 20.27.218.116:11152] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aWatHWXBo5bEhDEEhs1WNgAAAMM"]
[Wed Jan 14 04:37:49.323722 2026] [:error] [pid 58699:tid 58705] [client 20.27.218.116:11132] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aWatHeYdPBtkMLK2SdqkTQAAAQM"]
[Wed Jan 14 04:37:49.613016 2026] [:error] [pid 24603:tid 24666] [client 20.27.218.116:11162] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aWatHZPBJGFGN8VT8_SbggAAAIE"]
[Wed Jan 14 04:37:49.874826 2026] [:error] [pid 24710:tid 24723] [client 20.27.218.116:11081] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aWatHWXBo5bEhDEEhs1WOAAAAMs"]
[Wed Jan 14 04:37:50.154903 2026] [:error] [pid 24603:tid 24667] [client 20.27.218.116:11154] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aWatHpPBJGFGN8VT8_SbgwAAAII"]
[Wed Jan 14 04:37:50.407255 2026] [:error] [pid 58899:tid 58914] [client 20.27.218.116:11252] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aWatHgWViGQd5R44tHFt5AAAAYs"]
[Wed Jan 14 04:37:50.649445 2026] [:error] [pid 24603:tid 24675] [client 20.27.218.116:11117] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aWatHpPBJGFGN8VT8_SbhQAAAIo"]
[Wed Jan 14 04:37:50.904314 2026] [:error] [pid 24710:tid 24734] [client 20.27.218.116:11011] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aWatHmXBo5bEhDEEhs1WOQAAANY"]
[Wed Jan 14 04:37:51.169292 2026] [:error] [pid 24603:tid 24685] [client 20.27.218.116:11185] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aWatH5PBJGFGN8VT8_SbhgAAAJQ"]
[Wed Jan 14 04:37:51.416822 2026] [:error] [pid 24710:tid 24722] [client 20.27.218.116:11135] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aWatH2XBo5bEhDEEhs1WOgAAAMo"]
[Wed Jan 14 04:37:51.660626 2026] [:error] [pid 58699:tid 58715] [client 20.27.218.116:11048] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aWatH-YdPBtkMLK2SdqkUAAAAQ0"]
[Wed Jan 14 04:37:51.900759 2026] [:error] [pid 24710:tid 24732] [client 20.27.218.116:11044] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aWatH2XBo5bEhDEEhs1WOwAAANQ"]
[Wed Jan 14 04:37:52.166124 2026] [:error] [pid 58699:tid 58713] [client 20.27.218.116:11050] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aWatIOYdPBtkMLK2SdqkUQAAAQs"]
[Wed Jan 14 04:37:52.415521 2026] [:error] [pid 58899:tid 58912] [client 20.27.218.116:11119] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "aWatIAWViGQd5R44tHFt5gAAAYk"]
[Wed Jan 14 04:37:52.671127 2026] [:error] [pid 58699:tid 58725] [client 20.27.218.116:11094] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aWatIOYdPBtkMLK2SdqkUgAAARc"]
[Wed Jan 14 04:37:52.916260 2026] [:error] [pid 24710:tid 24719] [client 20.27.218.116:11111] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aWatIGXBo5bEhDEEhs1WPQAAAMc"]
[Wed Jan 14 04:37:53.163500 2026] [:error] [pid 58868:tid 58870] [client 20.27.218.116:11088] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aWatIU67yj8PZAmdsbllKwAAAUA"]
[Wed Jan 14 04:37:53.412966 2026] [:error] [pid 24603:tid 24671] [client 20.27.218.116:11188] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php"] [unique_id "aWatIZPBJGFGN8VT8_SbiQAAAIY"]
[Wed Jan 14 04:37:53.659909 2026] [:error] [pid 59074:tid 59086] [client 20.27.218.116:10945] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w-1.php"] [unique_id "aWatIU_KrJ818pzhB3xfSQAAAko"]
[Wed Jan 14 04:37:53.920713 2026] [:error] [pid 59074:tid 59097] [client 20.27.218.116:11036] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w-1.php"] [unique_id "aWatIU_KrJ818pzhB3xfSgAAAlU"]
[Wed Jan 14 04:37:54.175620 2026] [:error] [pid 24603:tid 24682] [client 20.27.218.116:11024] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w-1.php"] [unique_id "aWatIpPBJGFGN8VT8_SbiwAAAJE"]
[Wed Jan 14 04:37:54.436798 2026] [:error] [pid 24603:tid 24669] [client 20.27.218.116:11014] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w-1.php"] [unique_id "aWatIpPBJGFGN8VT8_SbjAAAAIQ"]
[Wed Jan 14 04:37:54.691980 2026] [:error] [pid 58977:tid 58991] [client 20.27.218.116:11155] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aWatIrlT6ggZLRx9QvD8VQAAAgs"]
[Wed Jan 14 04:37:54.938777 2026] [:error] [pid 58868:tid 58881] [client 20.27.218.116:11125] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aWatIk67yj8PZAmdsbllLAAAAUs"]
[Wed Jan 14 04:37:55.199801 2026] [:error] [pid 24601:tid 24630] [client 20.27.218.116:11213] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aWatI0CtWkZ9rlKW5n99sgAAABQ"]
[Wed Jan 14 04:37:55.443251 2026] [:error] [pid 59074:tid 59096] [client 20.27.218.116:11033] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aWatI0_KrJ818pzhB3xfSwAAAlQ"]
[Wed Jan 14 04:37:55.725361 2026] [:error] [pid 24710:tid 24717] [client 20.27.218.116:11073] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aWatI2XBo5bEhDEEhs1WPwAAAMU"]
[Wed Jan 14 04:37:55.975851 2026] [:error] [pid 24710:tid 24724] [client 20.27.218.116:11016] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aWatI2XBo5bEhDEEhs1WQAAAAMw"]
[Wed Jan 14 04:37:56.255198 2026] [:error] [pid 24603:tid 24679] [client 20.27.218.116:11086] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aWatJJPBJGFGN8VT8_SbkQAAAI4"]
[Wed Jan 14 04:37:56.515006 2026] [:error] [pid 24603:tid 24673] [client 20.27.218.116:11060] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aWatJJPBJGFGN8VT8_SbkgAAAIg"]
[Wed Jan 14 04:37:56.756233 2026] [:error] [pid 58868:tid 58889] [client 20.27.218.116:11031] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aWatJE67yj8PZAmdsbllLgAAAVM"]
[Wed Jan 14 04:37:57.020906 2026] [:error] [pid 24603:tid 24686] [client 20.27.218.116:11085] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aWatJZPBJGFGN8VT8_SblAAAAJU"]
[Wed Jan 14 04:37:57.295292 2026] [:error] [pid 24603:tid 24672] [client 20.27.218.116:11017] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aWatJZPBJGFGN8VT8_SblQAAAIc"]
[Wed Jan 14 04:37:57.545412 2026] [:error] [pid 59074:tid 59087] [client 20.27.218.116:11224] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aWatJU_KrJ818pzhB3xfTQAAAks"]
[Wed Jan 14 04:37:57.786723 2026] [:error] [pid 59074:tid 59082] [client 20.27.218.116:11074] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aWatJU_KrJ818pzhB3xfTgAAAkY"]
[Wed Jan 14 04:37:58.033811 2026] [:error] [pid 58699:tid 58726] [client 20.27.218.116:11058] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aWatJuYdPBtkMLK2SdqkVAAAARg"]
[Wed Jan 14 04:37:58.274827 2026] [:error] [pid 58699:tid 58712] [client 20.27.218.116:10961] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aWatJuYdPBtkMLK2SdqkVQAAAQo"]
[Wed Jan 14 04:37:58.531049 2026] [:error] [pid 24602:tid 24658] [client 20.27.218.116:11021] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aWatJkooYwabcb9R9fw0TAAAAFQ"]
[Wed Jan 14 04:37:58.781262 2026] [:error] [pid 58699:tid 58716] [client 20.27.218.116:11091] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "aWatJuYdPBtkMLK2SdqkVgAAAQ4"]
[Wed Jan 14 04:37:59.022980 2026] [:error] [pid 58699:tid 58722] [client 20.27.218.116:11257] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "aWatJ-YdPBtkMLK2SdqkVwAAARQ"]
[Wed Jan 14 04:37:59.263133 2026] [:error] [pid 58899:tid 58904] [client 20.27.218.116:32416] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "aWatJwWViGQd5R44tHFt6gAAAYE"]
[Wed Jan 14 04:37:59.503871 2026] [:error] [pid 24710:tid 24712] [client 20.27.218.116:10962] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "aWatJ2XBo5bEhDEEhs1WQQAAAMA"]
[Wed Jan 14 04:37:59.751098 2026] [:error] [pid 24710:tid 24729] [client 20.27.218.116:11040] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aWatJ2XBo5bEhDEEhs1WQwAAANE"]
[Wed Jan 14 04:37:59.998114 2026] [:error] [pid 58868:tid 58872] [client 20.27.218.116:11032] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aWatJ067yj8PZAmdsbllMAAAAUI"]
[Wed Jan 14 04:38:00.252154 2026] [:error] [pid 58899:tid 58910] [client 20.27.218.116:11112] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aWatKAWViGQd5R44tHFt6wAAAYc"]
[Wed Jan 14 04:38:00.501152 2026] [:error] [pid 58868:tid 58873] [client 20.27.218.116:11147] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpupex.php"] [unique_id "aWatKE67yj8PZAmdsbllMQAAAUM"]
[Wed Jan 14 04:38:00.743479 2026] [:error] [pid 24603:tid 24676] [client 20.27.218.116:11015] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aWatKJPBJGFGN8VT8_SbmwAAAIs"]
[Wed Jan 14 04:38:00.988380 2026] [:error] [pid 58699:tid 58723] [client 20.27.218.116:11077] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aWatKOYdPBtkMLK2SdqkWQAAARU"]
[Wed Jan 14 04:38:01.231393 2026] [:error] [pid 58868:tid 58894] [client 20.27.218.116:11108] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aWatKU67yj8PZAmdsbllMgAAAVg"]
[Wed Jan 14 04:38:01.471489 2026] [:error] [pid 58699:tid 58721] [client 20.27.218.116:11187] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aWatKeYdPBtkMLK2SdqkWgAAARM"]
[Wed Jan 14 04:38:01.714397 2026] [:error] [pid 58699:tid 58708] [client 20.27.218.116:11054] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aWatKeYdPBtkMLK2SdqkXAAAAQY"]
[Wed Jan 14 04:38:01.955503 2026] [:error] [pid 58868:tid 58879] [client 20.27.218.116:11064] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aWatKU67yj8PZAmdsbllMwAAAUk"]
[Wed Jan 14 04:38:02.199842 2026] [:error] [pid 24710:tid 24727] [client 20.27.218.116:10952] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aWatKmXBo5bEhDEEhs1WRQAAAM8"]
[Wed Jan 14 04:38:02.453431 2026] [:error] [pid 58899:tid 58905] [client 20.27.218.116:10974] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aWatKgWViGQd5R44tHFt7QAAAYI"]
[Wed Jan 14 04:38:02.699356 2026] [:error] [pid 58901:tid 58933] [client 20.27.218.116:11181] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aWatKr3kQSrcqIWtO0ogOgAAAcM"]
[Wed Jan 14 04:38:02.945767 2026] [:error] [pid 24710:tid 24716] [client 20.27.218.116:11141] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aWatKmXBo5bEhDEEhs1WSAAAAMQ"]
[Wed Jan 14 04:38:03.207057 2026] [:error] [pid 58977:tid 58995] [client 20.27.218.116:10959] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aWatK7lT6ggZLRx9QvD8WAAAAg8"]
[Wed Jan 14 04:38:03.447187 2026] [:error] [pid 24710:tid 24726] [client 20.27.218.116:11096] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aWatK2XBo5bEhDEEhs1WSQAAAM4"]
[Wed Jan 14 04:38:03.715115 2026] [:error] [pid 59074:tid 59081] [client 20.27.218.116:11177] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aWatK0_KrJ818pzhB3xfUQAAAkU"]
[Wed Jan 14 04:38:03.964684 2026] [:error] [pid 58977:tid 58997] [client 20.27.218.116:11123] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aWatK7lT6ggZLRx9QvD8WQAAAhE"]
[Wed Jan 14 04:38:04.205395 2026] [:error] [pid 24710:tid 24730] [client 20.27.218.116:10978] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aWatLGXBo5bEhDEEhs1WSgAAANI"]
[Wed Jan 14 04:38:04.459793 2026] [:error] [pid 24710:tid 24715] [client 20.27.218.116:11026] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aWatLGXBo5bEhDEEhs1WSwAAAMM"]
[Wed Jan 14 04:38:04.715211 2026] [:error] [pid 24602:tid 24648] [client 20.27.218.116:11030] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aWatLEooYwabcb9R9fw0TgAAAEo"]
[Wed Jan 14 04:38:04.984310 2026] [:error] [pid 59074:tid 59100] [client 20.27.218.116:11140] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aWatLE_KrJ818pzhB3xfVAAAAlg"]
[Wed Jan 14 04:38:05.232071 2026] [:error] [pid 58977:tid 58983] [client 20.27.218.116:11191] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aWatLblT6ggZLRx9QvD8WgAAAgM"]
[Wed Jan 14 04:38:05.506006 2026] [:error] [pid 58899:tid 58919] [client 20.27.218.116:11027] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aWatLQWViGQd5R44tHFt9gAAAZA"]
[Wed Jan 14 04:38:05.755487 2026] [:error] [pid 24710:tid 24723] [client 20.27.218.116:11038] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aWatLWXBo5bEhDEEhs1WTAAAAMs"]
[Wed Jan 14 04:38:06.040558 2026] [:error] [pid 58868:tid 58885] [client 20.27.218.116:10983] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aWatLk67yj8PZAmdsbllNwAAAU8"]
[Wed Jan 14 04:38:06.300620 2026] [:error] [pid 58868:tid 58890] [client 20.27.218.116:10944] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aWatLk67yj8PZAmdsbllOAAAAVQ"]
[Wed Jan 14 04:38:06.552514 2026] [:error] [pid 24710:tid 24734] [client 20.27.218.116:10999] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aWatLmXBo5bEhDEEhs1WTQAAANY"]
[Wed Jan 14 04:38:06.798383 2026] [:error] [pid 24601:tid 24631] [client 20.27.218.116:11039] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aWatLkCtWkZ9rlKW5n99uwAAABU"]
[Wed Jan 14 04:38:07.068644 2026] [:error] [pid 58868:tid 58882] [client 20.27.218.116:11176] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aWatL067yj8PZAmdsbllOQAAAUw"]
[Wed Jan 14 04:38:07.350076 2026] [:error] [pid 59074:tid 59089] [client 20.27.218.116:11065] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aWatL0_KrJ818pzhB3xfVQAAAk0"]
[Wed Jan 14 04:38:07.636387 2026] [:error] [pid 24602:tid 24651] [client 20.27.218.116:11133] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aWatL0ooYwabcb9R9fw0TwAAAE0"]
[Wed Jan 14 04:38:07.903639 2026] [:error] [pid 58977:tid 58987] [client 20.27.218.116:10881] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "aWatL7lT6ggZLRx9QvD8XQAAAgc"]
[Wed Jan 14 04:38:08.152644 2026] [:error] [pid 59074:tid 59077] [client 20.27.218.116:11020] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "aWatME_KrJ818pzhB3xfVgAAAkE"]
[Wed Jan 14 04:38:08.423328 2026] [:error] [pid 59074:tid 59080] [client 20.27.218.116:11216] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "aWatME_KrJ818pzhB3xfVwAAAkQ"]
[Wed Jan 14 04:38:08.702137 2026] [:error] [pid 58977:tid 58994] [client 20.27.218.116:11082] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "aWatMLlT6ggZLRx9QvD8XgAAAg4"]
[Wed Jan 14 04:38:08.972122 2026] [:error] [pid 58699:tid 58722] [client 20.27.218.116:10971] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cache/"] [unique_id "aWatMOYdPBtkMLK2SdqkagAAARQ"]
[Wed Jan 14 04:38:09.232161 2026] [:error] [pid 24602:tid 24638] [client 20.27.218.116:11163] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cache/"] [unique_id "aWatMUooYwabcb9R9fw0UQAAAEA"]
[Wed Jan 14 04:38:09.498458 2026] [:error] [pid 58977:tid 58990] [client 20.27.218.116:11067] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cache/"] [unique_id "aWatMblT6ggZLRx9QvD8YAAAAgo"]
[Wed Jan 14 04:38:09.756945 2026] [:error] [pid 58977:tid 58984] [client 20.27.218.116:11078] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cache/"] [unique_id "aWatMblT6ggZLRx9QvD8YQAAAgQ"]
[Wed Jan 14 04:38:10.022849 2026] [:error] [pid 59074:tid 59078] [client 20.27.218.116:11018] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aWatMk_KrJ818pzhB3xfWAAAAkI"]
[Wed Jan 14 04:38:10.279664 2026] [:error] [pid 24602:tid 24640] [client 20.27.218.116:11037] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aWatMkooYwabcb9R9fw0UgAAAEI"]
[Wed Jan 14 04:38:10.524530 2026] [:error] [pid 58977:tid 58993] [client 20.27.218.116:10979] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aWatMrlT6ggZLRx9QvD8YgAAAg0"]
[Wed Jan 14 04:38:10.792134 2026] [:error] [pid 59074:tid 59091] [client 20.27.218.116:11057] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aWatMk_KrJ818pzhB3xfWQAAAk8"]
[Wed Jan 14 06:11:52.482120 2026] [:error] [pid 58899:tid 58924] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php, referer: https://www.yahoo.com/
[Wed Jan 14 06:11:52.606574 2026] [:error] [pid 58899:tid 58919] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.de/
[Wed Jan 14 06:11:52.730914 2026] [:error] [pid 58899:tid 58915] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.google.fr/
[Wed Jan 14 06:11:52.855208 2026] [:error] [pid 58899:tid 58926] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.fr/
[Wed Jan 14 06:11:52.978618 2026] [:error] [pid 58899:tid 58925] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.google.fr/
[Wed Jan 14 06:11:53.102713 2026] [:error] [pid 58899:tid 58905] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.bing.com/
[Wed Jan 14 06:11:53.226671 2026] [:error] [pid 58899:tid 58913] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php, referer: https://www.bing.com/
[Wed Jan 14 06:11:53.350691 2026] [:error] [pid 58899:tid 58903] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.fr/
[Wed Jan 14 06:11:53.474527 2026] [:error] [pid 58899:tid 58918] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.yahoo.com/
[Wed Jan 14 06:11:53.599015 2026] [:error] [pid 58899:tid 58914] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.de/
[Wed Jan 14 06:11:53.722891 2026] [:error] [pid 58899:tid 58908] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.google.de/
[Wed Jan 14 06:11:53.851294 2026] [:error] [pid 58899:tid 58920] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.bing.com/
[Wed Jan 14 06:11:54.766885 2026] [:error] [pid 58899:tid 58920] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.yahoo.com/
[Wed Jan 14 06:11:54.890796 2026] [:error] [pid 58899:tid 58910] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php, referer: https://www.google.de/
[Wed Jan 14 06:11:55.016011 2026] [:error] [pid 58899:tid 58906] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php, referer: https://duckduckgo.com/
[Wed Jan 14 06:11:55.140821 2026] [:error] [pid 58899:tid 58927] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php, referer: https://www.yahoo.com/
[Wed Jan 14 06:11:55.265389 2026] [:error] [pid 58899:tid 58904] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php, referer: https://www.google.com/
[Wed Jan 14 06:11:55.389127 2026] [:error] [pid 58899:tid 58916] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://duckduckgo.com/
[Wed Jan 14 06:11:55.515412 2026] [:error] [pid 58899:tid 58923] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php, referer: https://www.google.com/
[Wed Jan 14 06:11:55.763788 2026] [:error] [pid 58899:tid 58911] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.google.com/
[Wed Jan 14 06:11:55.887655 2026] [:error] [pid 58899:tid 58921] [client 4.190.190.129:44399] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.yahoo.com/
[Wed Jan 14 06:11:58.002639 2026] [:error] [pid 58899:tid 58922] [client 4.190.190.129:44399] [client 4.190.190.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aWbDLgWViGQd5R44tHF6ugAAAZM"], referer: https://www.google.de/
[Wed Jan 14 07:18:52.665279 2026] [:error] [pid 58977:tid 58985] [client 64.225.8.2:57277] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aWbS3LlT6ggZLRx9QvATJAAAAgU"]
[Wed Jan 14 08:48:06.325929 2026] [:error] [pid 19278:tid 19304] [client 104.28.152.248:34080] [client 104.28.152.248] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aWbnxlGofyyxZQcTd1U92QAAABg"]
[Wed Jan 14 23:52:56.217882 2026] [:error] [pid 61377:tid 61417] [client 112.208.189.115:4411] [client 112.208.189.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.189.115, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWe72Mx0Xs4tcq6R-WioQwAAAcc"]
[Wed Jan 14 23:52:56.223954 2026] [:error] [pid 61377:tid 61417] [client 112.208.189.115:4411] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Jan 15 04:09:53.838067 2026] [:error] [pid 5292:tid 5368] [client 195.178.110.191:58798] [client 195.178.110.191] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aWf4EWWxK-ai3L9DjxbNPQAAAI0"]
[Fri Jan 16 01:07:59.262299 2026] [:error] [pid 51857:tid 51877] [client 161.97.129.154:43990] [client 161.97.129.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aWke73DlXoqhkNNyf_wAdAAAAVI"]
[Fri Jan 16 01:07:59.336016 2026] [:error] [pid 51857:tid 51875] [client 161.97.129.154:43998] [client 161.97.129.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aWke73DlXoqhkNNyf_wAdQAAAVA"]
[Fri Jan 16 02:53:14.296871 2026] [:error] [pid 51857:tid 51882] [client 151.237.64.226:53916] [client 151.237.64.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.237.64.226, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWk3mnDlXoqhkNNyf_wifwAAAVc"]
[Fri Jan 16 02:53:14.303138 2026] [:error] [pid 51857:tid 51882] [client 151.237.64.226:53916] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Jan 16 02:54:35.714167 2026] [:error] [pid 51857:tid 51865] [client 49.36.192.198:55337] [client 49.36.192.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.192.198, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWk363DlXoqhkNNyf_wisQAAAUY"]
[Fri Jan 16 02:54:35.718959 2026] [:error] [pid 51857:tid 51865] [client 49.36.192.198:55337] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Jan 16 04:37:51.893122 2026] [:error] [pid 43435:tid 43456] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/ver.php
[Fri Jan 16 04:37:52.288865 2026] [:error] [pid 43435:tid 43449] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/ultra.php
[Fri Jan 16 04:37:52.506704 2026] [:error] [pid 43435:tid 43442] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/pro.php
[Fri Jan 16 04:37:52.718239 2026] [:error] [pid 43435:tid 43450] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Jan 16 04:37:52.954478 2026] [:error] [pid 43435:tid 43446] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Fri Jan 16 04:37:53.166670 2026] [:error] [pid 43435:tid 43455] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/data.php
[Fri Jan 16 04:37:53.444396 2026] [:error] [pid 43435:tid 43459] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri Jan 16 04:37:53.656862 2026] [:error] [pid 43435:tid 43457] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Fri Jan 16 04:37:53.879785 2026] [:error] [pid 43435:tid 43441] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Jan 16 04:37:54.234720 2026] [:error] [pid 43435:tid 43447] [client 40.79.87.53:2062] File does not exist: /usr/local/apache/htdocs/suspended-page/image.php
[Fri Jan 16 04:37:54.445150 2026] [:error] [pid 43435:tid 43443] [client 40.79.87.53:2062] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aWlQIsTShPLPoPKNBO0dkAAAAQY"]
[Fri Jan 16 04:37:54.991996 2026] [:error] [pid 4655:tid 4664] [client 40.79.87.53:2065] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aWlQIowNRVf4tI0Wv762BwAAAAA"]
[Fri Jan 16 04:37:55.635067 2026] [:error] [pid 4657:tid 4726] [client 40.79.87.53:2137] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aWlQIyTED8rXaYv2tKbJPAAAAIg"]
[Fri Jan 16 04:37:56.296595 2026] [:error] [pid 4752:tid 4783] [client 40.79.87.53:2125] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file22.php"] [unique_id "aWlQJLl8TqZp7XXXIGvnlgAAANM"]
[Fri Jan 16 04:37:56.892691 2026] [:error] [pid 43435:tid 43456] [client 40.79.87.53:2150] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWlQJMTShPLPoPKNBO0dkwAAARM"]
[Fri Jan 16 04:37:57.478235 2026] [:error] [pid 4657:tid 4719] [client 40.79.87.53:2069] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWlQJSTED8rXaYv2tKbJPwAAAIE"]
[Fri Jan 16 04:37:58.024311 2026] [:error] [pid 4657:tid 4740] [client 40.79.87.53:2143] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWlQJiTED8rXaYv2tKbJQQAAAJY"]
[Fri Jan 16 04:37:58.456311 2026] [:error] [pid 4657:tid 4737] [client 40.79.87.53:2114] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/check.php"] [unique_id "aWlQJiTED8rXaYv2tKbJQgAAAJM"]
[Fri Jan 16 04:37:58.917437 2026] [:error] [pid 4752:tid 4766] [client 40.79.87.53:2121] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-header-json.php"] [unique_id "aWlQJrl8TqZp7XXXIGvnngAAAMI"]
[Fri Jan 16 04:37:59.836191 2026] [:error] [pid 4655:tid 4675] [client 40.79.87.53:2104] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-header-json.php"] [unique_id "aWlQJ4wNRVf4tI0Wv762CQAAAAs"]
[Fri Jan 16 04:38:01.118315 2026] [:error] [pid 43435:tid 43443] [client 40.79.87.53:2156] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-header-json.php"] [unique_id "aWlQKcTShPLPoPKNBO0dmQAAAQY"]
[Fri Jan 16 04:38:01.804469 2026] [:error] [pid 4655:tid 4688] [client 40.79.87.53:2128] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-header-json.php"] [unique_id "aWlQKYwNRVf4tI0Wv762DgAAABg"]
[Fri Jan 16 04:38:03.910761 2026] [:error] [pid 4656:tid 4704] [client 40.79.87.53:2171] [client 40.79.87.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aWlQK6jsvji3BAaL5mwBAAAAAE0"]
[Fri Jan 16 04:38:04.660748 2026] [:error] [pid 4752:tid 4766] [client 40.79.87.53:2163] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWlQLLl8TqZp7XXXIGvnpAAAAMI"]
[Fri Jan 16 04:38:05.244134 2026] [:error] [pid 4657:tid 4731] [client 40.79.87.53:2112] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWlQLSTED8rXaYv2tKbJVAAAAI0"]
[Fri Jan 16 04:38:06.225487 2026] [:error] [pid 4655:tid 4680] [client 40.79.87.53:2072] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWlQLowNRVf4tI0Wv762EwAAABA"]
[Fri Jan 16 04:38:07.959741 2026] [:error] [pid 4752:tid 4775] [client 40.79.87.53:2059] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aWlQL7l8TqZp7XXXIGvnqwAAAMs"]
[Fri Jan 16 04:38:08.857949 2026] [:error] [pid 4656:tid 4693] [client 40.79.87.53:2132] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aWlQMKjsvji3BAaL5mwBBQAAAEI"]
[Fri Jan 16 04:38:09.488991 2026] [:error] [pid 4752:tid 4788] [client 40.79.87.53:2169] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aWlQMbl8TqZp7XXXIGvnsQAAANg"]
[Fri Jan 16 04:38:10.249312 2026] [:error] [pid 43435:tid 43440] [client 40.79.87.53:2144] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aWlQMsTShPLPoPKNBO0dowAAAQM"]
[Fri Jan 16 04:38:10.779758 2026] [:error] [pid 4655:tid 4673] [client 40.79.87.53:2160] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aWlQMowNRVf4tI0Wv762FwAAAAk"]
[Fri Jan 16 04:38:11.411648 2026] [:error] [pid 43435:tid 43455] [client 40.79.87.53:2070] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aWlQM8TShPLPoPKNBO0dpwAAARI"]
[Fri Jan 16 04:38:12.188531 2026] [:error] [pid 4656:tid 4695] [client 40.79.87.53:2067] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aWlQNKjsvji3BAaL5mwBDAAAAEQ"]
[Fri Jan 16 04:38:13.119647 2026] [:error] [pid 4655:tid 4678] [client 40.79.87.53:2134] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aWlQNYwNRVf4tI0Wv762GgAAAA4"]
[Fri Jan 16 04:38:13.834875 2026] [:error] [pid 4656:tid 4711] [client 40.79.87.53:2157] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aWlQNajsvji3BAaL5mwBEAAAAFQ"]
[Fri Jan 16 04:38:14.298130 2026] [:error] [pid 4752:tid 4786] [client 40.79.87.53:2140] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aWlQNrl8TqZp7XXXIGvntgAAANY"]
[Fri Jan 16 04:38:14.726095 2026] [:error] [pid 4752:tid 4777] [client 40.79.87.53:2138] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aWlQNrl8TqZp7XXXIGvnuQAAAM0"]
[Fri Jan 16 04:38:15.257069 2026] [:error] [pid 4752:tid 4785] [client 40.79.87.53:2109] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aWlQN7l8TqZp7XXXIGvnvAAAANU"]
[Fri Jan 16 04:38:16.359134 2026] [:error] [pid 43435:tid 43442] [client 40.79.87.53:2074] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aWlQOMTShPLPoPKNBO0dtAAAAQU"]
[Fri Jan 16 04:38:17.669191 2026] [:error] [pid 43435:tid 43437] [client 40.79.87.53:2122] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWlQOcTShPLPoPKNBO0duAAAAQA"]
[Fri Jan 16 04:38:18.212719 2026] [:error] [pid 43435:tid 43451] [client 40.79.87.53:2048] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWlQOsTShPLPoPKNBO0dvAAAAQ4"]
[Fri Jan 16 04:38:19.128118 2026] [:error] [pid 4656:tid 4691] [client 40.79.87.53:2063] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWlQO6jsvji3BAaL5mwBFQAAAEA"]
[Fri Jan 16 04:38:20.040952 2026] [:error] [pid 43435:tid 43459] [client 40.79.87.53:2164] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWlQPMTShPLPoPKNBO0dwQAAARY"]
[Fri Jan 16 04:38:21.478017 2026] [:error] [pid 4656:tid 4709] [client 40.79.87.53:2086] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file56.php"] [unique_id "aWlQPajsvji3BAaL5mwBFgAAAFI"]
[Fri Jan 16 04:38:22.320235 2026] [:error] [pid 4656:tid 4711] [client 40.79.87.53:2154] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file56.php"] [unique_id "aWlQPqjsvji3BAaL5mwBGQAAAFQ"]
[Fri Jan 16 04:38:24.000677 2026] [:error] [pid 4752:tid 4776] [client 40.79.87.53:2110] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file56.php"] [unique_id "aWlQP7l8TqZp7XXXIGvnvwAAAMw"]
[Fri Jan 16 04:38:24.722117 2026] [:error] [pid 4657:tid 4720] [client 40.79.87.53:2158] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file56.php"] [unique_id "aWlQQCTED8rXaYv2tKbJcQAAAII"]
[Fri Jan 16 04:38:25.436262 2026] [:error] [pid 43435:tid 43453] [client 40.79.87.53:2082] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aWlQQcTShPLPoPKNBO0dywAAARA"]
[Fri Jan 16 04:38:25.983265 2026] [:error] [pid 43435:tid 43460] [client 40.79.87.53:2139] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aWlQQcTShPLPoPKNBO0dzQAAARc"]
[Fri Jan 16 04:38:26.472209 2026] [:error] [pid 4752:tid 4785] [client 40.79.87.53:2135] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aWlQQrl8TqZp7XXXIGvnxAAAANU"]
[Fri Jan 16 04:38:27.058702 2026] [:error] [pid 43435:tid 43442] [client 40.79.87.53:2102] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aWlQQ8TShPLPoPKNBO0d0wAAAQU"]
[Fri Jan 16 04:38:27.726366 2026] [:error] [pid 43435:tid 43461] [client 40.79.87.53:2075] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aWlQQ8TShPLPoPKNBO0d1gAAARg"]
[Fri Jan 16 04:38:28.690448 2026] [:error] [pid 4657:tid 4727] [client 40.79.87.53:2133] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aWlQRCTED8rXaYv2tKbJdAAAAIk"]
[Fri Jan 16 04:38:29.362459 2026] [:error] [pid 4752:tid 4769] [client 40.79.87.53:2073] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aWlQRbl8TqZp7XXXIGvnygAAAMU"]
[Fri Jan 16 04:38:30.210836 2026] [:error] [pid 4657:tid 4738] [client 40.79.87.53:2088] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aWlQRiTED8rXaYv2tKbJeAAAAJQ"]
[Fri Jan 16 04:38:30.713246 2026] [:error] [pid 4657:tid 4729] [client 40.79.87.53:2170] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWlQRiTED8rXaYv2tKbJfQAAAIs"]
[Fri Jan 16 04:38:31.503893 2026] [:error] [pid 4657:tid 4727] [client 40.79.87.53:2123] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWlQRyTED8rXaYv2tKbJgwAAAIk"]
[Fri Jan 16 04:38:32.096635 2026] [:error] [pid 43435:tid 43446] [client 40.79.87.53:2051] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWlQSMTShPLPoPKNBO0d2AAAAQk"]
[Fri Jan 16 04:38:32.670432 2026] [:error] [pid 43435:tid 43451] [client 40.79.87.53:2126] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aWlQSMTShPLPoPKNBO0d2gAAAQ4"]
[Fri Jan 16 04:38:33.394016 2026] [:error] [pid 4752:tid 4770] [client 40.79.87.53:2141] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aWlQSbl8TqZp7XXXIGvnzgAAAMY"]
[Fri Jan 16 04:38:33.889454 2026] [:error] [pid 4655:tid 4668] [client 40.79.87.53:2130] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aWlQSYwNRVf4tI0Wv762IQAAAAQ"]
[Fri Jan 16 04:38:34.539735 2026] [:error] [pid 4655:tid 4672] [client 40.79.87.53:2049] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aWlQSowNRVf4tI0Wv762IwAAAAg"]
[Fri Jan 16 04:38:35.381345 2026] [:error] [pid 4657:tid 4732] [client 40.79.87.53:2078] [client 40.79.87.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aWlQSyTED8rXaYv2tKbJiAAAAI4"]
[Fri Jan 16 05:16:44.775476 2026] [:error] [pid 43435:tid 43445] [client 34.133.255.234:54889] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Fri Jan 16 05:16:51.387264 2026] [:error] [pid 4752:tid 4783] [client 34.133.255.234:65261] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Jan 16 05:17:05.097307 2026] [:error] [pid 4655:tid 4683] [client 34.133.255.234:52230] [client 34.133.255.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env/.env.bak"] [unique_id "aWlZUYwNRVf4tI0Wv77ASgAAABM"]
[Fri Jan 16 05:17:19.080465 2026] [:error] [pid 4657:tid 4738] [client 34.133.255.234:57604] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Fri Jan 16 17:02:29.419381 2026] [:error] [pid 30925:tid 30939] [client 84.247.169.220:60931] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aWn-pbPyx6TwF5dNaFqipAAAAYw"]
[Fri Jan 16 17:02:30.638048 2026] [:error] [pid 30925:tid 30929] [client 84.247.169.220:61052] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-json/wc/v3/payment_gateways"] [unique_id "aWn-prPyx6TwF5dNaFqipwAAAYI"]
[Fri Jan 16 17:02:32.034078 2026] [:error] [pid 54008:tid 54022] [client 84.247.169.220:61181] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-json/wc/v2/payment_gateways"] [unique_id "aWn-qMeowS6CyLOmCzOjygAAAIw"]
[Fri Jan 16 17:02:33.296189 2026] [:error] [pid 30925:tid 30946] [client 84.247.169.220:61352] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-json/wc/store/v1/cart"] [unique_id "aWn-qbPyx6TwF5dNaFqisQAAAZM"]
[Fri Jan 16 17:02:34.560450 2026] [:error] [pid 30925:tid 30935] [client 84.247.169.220:61455] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-json/wc/store/v1/payment_methods"] [unique_id "aWn-qrPyx6TwF5dNaFqiuAAAAYg"]
[Sat Jan 17 08:41:57.246894 2026] [:error] [pid 31224:tid 31271] [client 189.6.240.14:10549] [client 189.6.240.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.240.14, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWra1TgpVpEMk8-OQkiSjAAAAEo"]
[Sat Jan 17 08:41:57.253804 2026] [:error] [pid 31224:tid 31271] [client 189.6.240.14:10549] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Jan 17 23:17:26.162699 2026] [:error] [pid 31322:tid 31354] [client 207.154.219.217:55430] [client 207.154.219.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aWuoBnxOW98yk2MBlyoDIQAAANQ"]
[Sun Jan 18 16:42:53.152366 2026] [:error] [pid 12924:tid 12976] [client 49.47.154.31:49375] [client 49.47.154.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.154.31, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aWydDSuv3PUo9LR6V6b1GwAAAFA"]
[Sun Jan 18 16:42:53.156922 2026] [:error] [pid 12924:tid 12976] [client 49.47.154.31:49375] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Jan 19 12:46:50.438712 2026] [:error] [pid 45561:tid 45580] [client 103.77.106.118:59608] [client 103.77.106.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aW23Oq4ONSZn4nkTayLhgwAAAA4"]
[Mon Jan 19 19:27:29.942067 2026] [:error] [pid 47089:tid 47093] [client 104.28.246.115:33546] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aW4VIRlIzijVNfdIsZ7qygAAAQI"]
[Mon Jan 19 19:27:31.371385 2026] [:error] [pid 45563:tid 45633] [client 104.28.246.115:58137] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/style.php"] [unique_id "aW4VI5I4--OKA-PqumyWPgAAAIw"]
[Mon Jan 19 19:27:31.788740 2026] [:error] [pid 36216:tid 36230] [client 104.28.246.115:58144] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "aW4VI8IpfKKs9fzB-yCAIgAAAUw"]
[Mon Jan 19 19:27:32.206820 2026] [:error] [pid 36216:tid 36234] [client 104.28.246.115:58146] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/style.php"] [unique_id "aW4VJMIpfKKs9fzB-yCAJgAAAVA"]
[Mon Jan 19 19:27:32.625296 2026] [:error] [pid 36216:tid 36228] [client 104.28.246.115:58153] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style.php"] [unique_id "aW4VJMIpfKKs9fzB-yCAJwAAAUo"]
[Mon Jan 19 19:27:34.052110 2026] [:error] [pid 45657:tid 45664] [client 104.28.246.115:49583] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aW4VJg4XFYp2OcwCx-B8pwAAAMU"]
[Mon Jan 19 19:27:34.478677 2026] [:error] [pid 45657:tid 45661] [client 104.28.246.115:49587] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aW4VJg4XFYp2OcwCx-B8qwAAAMI"]
[Mon Jan 19 19:31:19.661761 2026] [:error] [pid 45562:tid 45603] [client 104.28.157.224:46391] [client 104.28.157.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aW4WBzoUil_kwpvtDW7PIgAAAEk"]
[Mon Jan 19 21:07:09.522978 2026] [:error] [pid 45562:tid 45595] [client 104.28.246.115:19669] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aW4sfToUil_kwpvtDW7f4QAAAEE"]
[Mon Jan 19 23:36:52.010600 2026] [:error] [pid 45561:tid 45573] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Mon Jan 19 23:36:52.279433 2026] [:error] [pid 45561:tid 45570] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/sikma.php
[Mon Jan 19 23:36:52.545673 2026] [:error] [pid 45561:tid 45567] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/rh1.php
[Mon Jan 19 23:36:52.805831 2026] [:error] [pid 45561:tid 45577] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Mon Jan 19 23:36:53.080881 2026] [:error] [pid 45561:tid 45576] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Mon Jan 19 23:36:53.290228 2026] [:error] [pid 45561:tid 45578] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/krypton.php
[Mon Jan 19 23:36:53.598757 2026] [:error] [pid 45561:tid 45569] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/zoo.php
[Mon Jan 19 23:36:54.084326 2026] [:error] [pid 45561:tid 45581] [client 4.206.147.225:21062] File does not exist: /usr/local/apache/htdocs/suspended-page/maul.php
[Mon Jan 19 23:36:54.499172 2026] [:error] [pid 45561:tid 45590] [client 4.206.147.225:21062] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer/adminer474.php"] [unique_id "aW5Plq4ONSZn4nkTayKKeAAAABg"]
[Mon Jan 19 23:36:55.693537 2026] [:error] [pid 45657:tid 45675] [client 4.206.147.225:21096] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer/adminer474.php"] [unique_id "aW5Plw4XFYp2OcwCx-CykwAAANA"]
[Mon Jan 19 23:36:56.918461 2026] [:error] [pid 36216:tid 36242] [client 4.206.147.225:20999] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer/adminer474.php"] [unique_id "aW5PmMIpfKKs9fzB-yDTcAAAAVg"]
[Mon Jan 19 23:36:57.897626 2026] [:error] [pid 47089:tid 47099] [client 4.206.147.225:21005] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer/adminer474.php"] [unique_id "aW5PmRlIzijVNfdIsZ4hQAAAAQg"]
[Mon Jan 19 23:36:58.476991 2026] [:error] [pid 47089:tid 47113] [client 4.206.147.225:21007] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/download.php"] [unique_id "aW5PmhlIzijVNfdIsZ4hQQAAARY"]
[Mon Jan 19 23:37:00.086464 2026] [:error] [pid 36216:tid 36232] [client 4.206.147.225:21097] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/download.php"] [unique_id "aW5PnMIpfKKs9fzB-yDTdwAAAU4"]
[Mon Jan 19 23:37:00.723935 2026] [:error] [pid 45563:tid 45639] [client 4.206.147.225:21067] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/download.php"] [unique_id "aW5PnJI4--OKA-PqumzZygAAAJI"]
[Mon Jan 19 23:37:01.900024 2026] [:error] [pid 45657:tid 45682] [client 4.206.147.225:21084] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/download.php"] [unique_id "aW5PnQ4XFYp2OcwCx-CylgAAANc"]
[Mon Jan 19 23:37:03.295200 2026] [:error] [pid 47089:tid 47105] [client 4.206.147.225:21002] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aW5PnxlIzijVNfdIsZ4hSgAAAQ4"]
[Mon Jan 19 23:37:04.704996 2026] [:error] [pid 45562:tid 45602] [client 4.206.147.225:21071] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aW5PoDoUil_kwpvtDW7_yAAAAEg"]
[Mon Jan 19 23:37:06.574899 2026] [:error] [pid 45657:tid 45667] [client 4.206.147.225:21111] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aW5Pog4XFYp2OcwCx-CyngAAAMg"]
[Mon Jan 19 23:37:08.590625 2026] [:error] [pid 45561:tid 45577] [client 4.206.147.225:21056] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aW5PpK4ONSZn4nkTayKKkQAAAAs"]
[Mon Jan 19 23:37:09.278895 2026] [:error] [pid 45563:tid 45626] [client 4.206.147.225:21018] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/authorize.php"] [unique_id "aW5PpZI4--OKA-PqumzZ0wAAAIU"]
[Mon Jan 19 23:37:10.108432 2026] [:error] [pid 45561:tid 45569] [client 4.206.147.225:21114] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/authorize.php"] [unique_id "aW5Ppq4ONSZn4nkTayKKlAAAAAM"]
[Mon Jan 19 23:37:10.887615 2026] [:error] [pid 45561:tid 45582] [client 4.206.147.225:21117] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/authorize.php"] [unique_id "aW5Ppq4ONSZn4nkTayKKmAAAABA"]
[Mon Jan 19 23:37:11.728403 2026] [:error] [pid 45561:tid 45581] [client 4.206.147.225:21113] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/authorize.php"] [unique_id "aW5Pp64ONSZn4nkTayKKmwAAAA8"]
[Mon Jan 19 23:37:12.579121 2026] [:error] [pid 45561:tid 45589] [client 4.206.147.225:21098] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aW5PqK4ONSZn4nkTayKKoAAAABc"]
[Mon Jan 19 23:37:13.412545 2026] [:error] [pid 36216:tid 36228] [client 4.206.147.225:21085] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aW5PqcIpfKKs9fzB-yDTiQAAAUo"]
[Mon Jan 19 23:37:14.874376 2026] [:error] [pid 45562:tid 45608] [client 4.206.147.225:20993] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aW5PqjoUil_kwpvtDW7_1gAAAE4"]
[Mon Jan 19 23:37:15.650365 2026] [:error] [pid 45563:tid 45632] [client 4.206.147.225:21014] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aW5Pq5I4--OKA-PqumzZ3AAAAIs"]
[Mon Jan 19 23:37:17.076378 2026] [:error] [pid 36216:tid 36224] [client 4.206.147.225:21015] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aW5PrcIpfKKs9fzB-yDTjgAAAUY"]
[Mon Jan 19 23:37:18.111369 2026] [:error] [pid 45563:tid 45626] [client 4.206.147.225:21016] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aW5PrpI4--OKA-PqumzZ3wAAAIU"]
[Mon Jan 19 23:37:19.027175 2026] [:error] [pid 45561:tid 45581] [client 4.206.147.225:21020] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aW5Pr64ONSZn4nkTayKKtQAAAA8"]
[Mon Jan 19 23:37:19.792777 2026] [:error] [pid 36216:tid 36242] [client 4.206.147.225:21076] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "aW5Pr8IpfKKs9fzB-yDTkQAAAVg"]
[Mon Jan 19 23:37:20.935659 2026] [:error] [pid 45561:tid 45577] [client 4.206.147.225:21003] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aW5PsK4ONSZn4nkTayKKuwAAAAs"]
[Mon Jan 19 23:37:21.491416 2026] [:error] [pid 45562:tid 45616] [client 4.206.147.225:21066] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aW5PsToUil_kwpvtDW7_3AAAAFY"]
[Mon Jan 19 23:37:22.398946 2026] [:error] [pid 36216:tid 36224] [client 4.206.147.225:21106] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aW5PssIpfKKs9fzB-yDTlQAAAUY"]
[Mon Jan 19 23:37:23.995774 2026] [:error] [pid 45562:tid 45615] [client 4.206.147.225:21029] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aW5PszoUil_kwpvtDW7_3gAAAFU"]
[Mon Jan 19 23:37:24.568908 2026] [:error] [pid 45562:tid 45606] [client 4.206.147.225:21021] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aW5PtDoUil_kwpvtDW7_4AAAAEw"]
[Mon Jan 19 23:37:25.578008 2026] [:error] [pid 47089:tid 47106] [client 4.206.147.225:21036] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aW5PtRlIzijVNfdIsZ4hXQAAAQ8"]
[Mon Jan 19 23:37:26.523866 2026] [:error] [pid 36216:tid 36237] [client 4.206.147.225:21119] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aW5PtsIpfKKs9fzB-yDTmwAAAVM"]
[Mon Jan 19 23:37:27.450142 2026] [:error] [pid 45563:tid 45623] [client 4.206.147.225:21075] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "aW5Pt5I4--OKA-PqumzZ7AAAAII"]
[Mon Jan 19 23:37:28.076946 2026] [:error] [pid 47089:tid 47108] [client 4.206.147.225:21001] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aW5PuBlIzijVNfdIsZ4hYQAAARE"]
[Mon Jan 19 23:37:28.774817 2026] [:error] [pid 36216:tid 36234] [client 4.206.147.225:21009] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aW5PuMIpfKKs9fzB-yDTnwAAAVA"]
[Mon Jan 19 23:37:29.819847 2026] [:error] [pid 36216:tid 36232] [client 4.206.147.225:20997] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aW5PucIpfKKs9fzB-yDToQAAAU4"]
[Mon Jan 19 23:37:31.022666 2026] [:error] [pid 36216:tid 36221] [client 4.206.147.225:21072] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "aW5Pu8IpfKKs9fzB-yDTogAAAUM"]
[Mon Jan 19 23:37:31.762447 2026] [:error] [pid 45562:tid 45612] [client 4.206.147.225:8179] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aW5PuzoUil_kwpvtDW7_7AAAAFI"]
[Mon Jan 19 23:37:32.296831 2026] [:error] [pid 45563:tid 45638] [client 4.206.147.225:21112] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aW5PvJI4--OKA-PqumzZ-QAAAJE"]
[Mon Jan 19 23:37:32.989326 2026] [:error] [pid 45561:tid 45585] [client 4.206.147.225:21059] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aW5PvK4ONSZn4nkTayKK2AAAABM"]
[Mon Jan 19 23:37:34.115225 2026] [:error] [pid 47089:tid 47111] [client 4.206.147.225:21058] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aW5PvhlIzijVNfdIsZ4haQAAARQ"]
[Mon Jan 19 23:37:34.988426 2026] [:error] [pid 45657:tid 45682] [client 4.206.147.225:21116] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aW5Pvg4XFYp2OcwCx-CyvAAAANc"]
[Mon Jan 19 23:37:35.951389 2026] [:error] [pid 45563:tid 45638] [client 4.206.147.225:21073] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aW5Pv5I4--OKA-PqumzaBQAAAJE"]
[Mon Jan 19 23:37:37.009725 2026] [:error] [pid 45563:tid 45629] [client 4.206.147.225:21101] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aW5PwZI4--OKA-PqumzaDwAAAIg"]
[Mon Jan 19 23:37:37.884334 2026] [:error] [pid 36216:tid 36230] [client 4.206.147.225:8159] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aW5PwcIpfKKs9fzB-yDTqgAAAUw"]
[Mon Jan 19 23:37:38.466958 2026] [:error] [pid 45561:tid 45589] [client 4.206.147.225:21012] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aW5Pwq4ONSZn4nkTayKK5gAAABc"]
[Mon Jan 19 23:37:39.159229 2026] [:error] [pid 45563:tid 45632] [client 4.206.147.225:21039] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aW5Pw5I4--OKA-PqumzaFwAAAIs"]
[Mon Jan 19 23:37:39.905859 2026] [:error] [pid 45562:tid 45614] [client 4.206.147.225:21057] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aW5PwzoUil_kwpvtDW7_9AAAAFQ"]
[Mon Jan 19 23:37:40.928813 2026] [:error] [pid 45561:tid 45581] [client 4.206.147.225:8155] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aW5PxK4ONSZn4nkTayKK8AAAAA8"]
[Mon Jan 19 23:37:41.477047 2026] [:error] [pid 47089:tid 47097] [client 4.206.147.225:21000] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aW5PxRlIzijVNfdIsZ4hcgAAAQY"]
[Mon Jan 19 23:37:42.751068 2026] [:error] [pid 36216:tid 36233] [client 4.206.147.225:21032] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aW5PxsIpfKKs9fzB-yDTsAAAAU8"]
[Mon Jan 19 23:37:43.656675 2026] [:error] [pid 47089:tid 47107] [client 4.206.147.225:20992] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aW5PxxlIzijVNfdIsZ4hewAAARA"]
[Mon Jan 19 23:37:44.259989 2026] [:error] [pid 36216:tid 36222] [client 4.206.147.225:21118] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "aW5PyMIpfKKs9fzB-yDTswAAAUQ"]
[Mon Jan 19 23:37:44.971352 2026] [:error] [pid 45657:tid 45678] [client 4.206.147.225:21008] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aW5PyA4XFYp2OcwCx-CyyQAAANM"]
[Mon Jan 19 23:37:45.647389 2026] [:error] [pid 45657:tid 45667] [client 4.206.147.225:21093] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aW5PyQ4XFYp2OcwCx-CyzAAAAMg"]
[Mon Jan 19 23:37:46.356023 2026] [:error] [pid 45563:tid 45624] [client 4.206.147.225:21115] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aW5PypI4--OKA-PqumzaKAAAAIM"]
[Mon Jan 19 23:37:47.059349 2026] [:error] [pid 45657:tid 45677] [client 4.206.147.225:21055] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qaez.php56"] [unique_id "aW5Pyw4XFYp2OcwCx-Cy0gAAANI"]
[Mon Jan 19 23:37:48.155737 2026] [:error] [pid 45563:tid 45634] [client 4.206.147.225:21064] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aW5PzJI4--OKA-PqumzaKwAAAI0"]
[Mon Jan 19 23:37:49.022856 2026] [:error] [pid 47089:tid 47099] [client 4.206.147.225:8167] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aW5PzRlIzijVNfdIsZ4hlwAAAQg"]
[Mon Jan 19 23:37:50.106889 2026] [:error] [pid 45563:tid 45632] [client 4.206.147.225:21054] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aW5PzpI4--OKA-PqumzaLgAAAIs"]
[Mon Jan 19 23:37:50.772160 2026] [:error] [pid 45563:tid 45636] [client 4.206.147.225:8129] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dox.php"] [unique_id "aW5PzpI4--OKA-PqumzaLwAAAI8"]
[Mon Jan 19 23:37:51.286499 2026] [:error] [pid 45561:tid 45573] [client 4.206.147.225:21103] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aW5Pz64ONSZn4nkTayKLCAAAAAc"]
[Mon Jan 19 23:37:51.906351 2026] [:error] [pid 36216:tid 36221] [client 4.206.147.225:21049] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aW5Pz8IpfKKs9fzB-yDTxQAAAUM"]
[Mon Jan 19 23:37:52.396636 2026] [:error] [pid 47089:tid 47094] [client 4.206.147.225:21013] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aW5P0BlIzijVNfdIsZ4hnwAAAQM"]
[Mon Jan 19 23:37:53.364782 2026] [:error] [pid 47089:tid 47113] [client 4.206.147.225:21104] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "aW5P0RlIzijVNfdIsZ4hoQAAARY"]
[Mon Jan 19 23:37:54.367367 2026] [:error] [pid 47089:tid 47105] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Jan 19 23:37:54.575954 2026] [:error] [pid 47089:tid 47108] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/6kUgr4yGzxN.php
[Mon Jan 19 23:37:54.860071 2026] [:error] [pid 47089:tid 47107] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Mon Jan 19 23:37:55.070368 2026] [:error] [pid 47089:tid 47093] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Mon Jan 19 23:37:55.279998 2026] [:error] [pid 47089:tid 47114] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Mon Jan 19 23:37:55.688145 2026] [:error] [pid 47089:tid 47103] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Mon Jan 19 23:37:56.008508 2026] [:error] [pid 47089:tid 47092] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/ii5file.php
[Mon Jan 19 23:37:56.220671 2026] [:error] [pid 47089:tid 47109] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Mon Jan 19 23:37:56.429835 2026] [:error] [pid 47089:tid 47091] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/re.php
[Mon Jan 19 23:37:56.652929 2026] [:error] [pid 47089:tid 47106] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Mon Jan 19 23:37:56.907241 2026] [:error] [pid 47089:tid 47105] [client 4.206.147.225:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/asus.php
[Mon Jan 19 23:37:57.122123 2026] [:error] [pid 47089:tid 47095] [client 4.206.147.225:21095] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aW5P1RlIzijVNfdIsZ4htwAAAQQ"]
[Mon Jan 19 23:37:57.634193 2026] [:error] [pid 45561:tid 45581] [client 4.206.147.225:21109] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aW5P1a4ONSZn4nkTayKLFwAAAA8"]
[Mon Jan 19 23:37:58.382496 2026] [:error] [pid 45563:tid 45643] [client 4.206.147.225:21027] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aW5P1pI4--OKA-PqumzaSAAAAJY"]
[Mon Jan 19 23:37:58.939180 2026] [:error] [pid 45561:tid 45585] [client 4.206.147.225:8157] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aW5P1q4ONSZn4nkTayKLGwAAABM"]
[Mon Jan 19 23:37:59.656318 2026] [:error] [pid 45657:tid 45672] [client 4.206.147.225:21028] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aW5P1w4XFYp2OcwCx-Cy5wAAAM0"]
[Mon Jan 19 23:38:00.930768 2026] [:error] [pid 36216:tid 36224] [client 4.206.147.225:21017] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aW5P2MIpfKKs9fzB-yDT4AAAAUY"]
[Mon Jan 19 23:38:01.724612 2026] [:error] [pid 45561:tid 45576] [client 4.206.147.225:21048] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aW5P2a4ONSZn4nkTayKLIQAAAAo"]
[Mon Jan 19 23:38:02.502060 2026] [:error] [pid 45563:tid 45638] [client 4.206.147.225:21079] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aW5P2pI4--OKA-PqumzaTgAAAJE"]
[Mon Jan 19 23:38:03.200799 2026] [:error] [pid 45562:tid 45611] [client 4.206.147.225:21086] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aW5P2zoUil_kwpvtDW4AGAAAAFE"]
[Mon Jan 19 23:38:03.980561 2026] [:error] [pid 47089:tid 47102] [client 4.206.147.225:21068] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aW5P2xlIzijVNfdIsZ4hxgAAAQs"]
[Mon Jan 19 23:38:04.844414 2026] [:error] [pid 45562:tid 45603] [client 4.206.147.225:21087] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aW5P3DoUil_kwpvtDW4AHAAAAEk"]
[Mon Jan 19 23:38:06.523474 2026] [:error] [pid 45561:tid 45567] [client 4.206.147.225:21081] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/domains.php"] [unique_id "aW5P3q4ONSZn4nkTayKLLgAAAAE"]
[Mon Jan 19 23:38:07.548662 2026] [:error] [pid 45561:tid 45571] [client 4.206.147.225:21042] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-goods.php"] [unique_id "aW5P364ONSZn4nkTayKLMAAAAAU"]
[Mon Jan 19 23:38:08.288756 2026] [:error] [pid 36216:tid 36228] [client 4.206.147.225:21004] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-goods.php"] [unique_id "aW5P4MIpfKKs9fzB-yDT8AAAAUo"]
[Mon Jan 19 23:38:09.170901 2026] [:error] [pid 45561:tid 45585] [client 4.206.147.225:20996] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-goods.php"] [unique_id "aW5P4a4ONSZn4nkTayKLNgAAABM"]
[Mon Jan 19 23:38:10.459782 2026] [:error] [pid 45561:tid 45587] [client 4.206.147.225:21025] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-goods.php"] [unique_id "aW5P4q4ONSZn4nkTayKLPwAAABU"]
[Mon Jan 19 23:38:11.480976 2026] [:error] [pid 45562:tid 45602] [client 4.206.147.225:21099] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/144.php"] [unique_id "aW5P4zoUil_kwpvtDW4AIQAAAEg"]
[Mon Jan 19 23:38:12.510890 2026] [:error] [pid 47089:tid 47110] [client 4.206.147.225:8079] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/144.php"] [unique_id "aW5P5BlIzijVNfdIsZ4hzAAAARM"]
[Mon Jan 19 23:38:13.479647 2026] [:error] [pid 36216:tid 36226] [client 4.206.147.225:8189] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/144.php"] [unique_id "aW5P5cIpfKKs9fzB-yDT_gAAAUg"]
[Mon Jan 19 23:38:13.989386 2026] [:error] [pid 45657:tid 45669] [client 4.206.147.225:21061] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/144.php"] [unique_id "aW5P5Q4XFYp2OcwCx-Cy-gAAAMo"]
[Mon Jan 19 23:38:14.727070 2026] [:error] [pid 36216:tid 36232] [client 4.206.147.225:8182] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aW5P5sIpfKKs9fzB-yDUAwAAAU4"]
[Mon Jan 19 23:38:15.811327 2026] [:error] [pid 36216:tid 36237] [client 4.206.147.225:21074] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aW5P58IpfKKs9fzB-yDUCAAAAVM"]
[Mon Jan 19 23:38:17.111482 2026] [:error] [pid 45563:tid 45633] [client 4.206.147.225:21010] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aW5P6ZI4--OKA-PqumzaXgAAAIw"]
[Mon Jan 19 23:38:18.807257 2026] [:error] [pid 45561:tid 45569] [client 4.206.147.225:20998] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aW5P6q4ONSZn4nkTayKLUwAAAAM"]
[Mon Jan 19 23:38:19.368661 2026] [:error] [pid 47089:tid 47096] [client 4.206.147.225:21030] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aW5P6xlIzijVNfdIsZ4h0gAAAQU"]
[Mon Jan 19 23:38:20.201916 2026] [:error] [pid 45657:tid 45676] [client 4.206.147.225:21024] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aW5P7A4XFYp2OcwCx-CzAAAAANE"]
[Mon Jan 19 23:38:20.899854 2026] [:error] [pid 45562:tid 45604] [client 4.206.147.225:8165] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aW5P7DoUil_kwpvtDW4ALAAAAEo"]
[Mon Jan 19 23:38:22.522943 2026] [:error] [pid 36216:tid 36232] [client 4.206.147.225:21090] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "aW5P7sIpfKKs9fzB-yDUHQAAAU4"]
[Mon Jan 19 23:38:23.361467 2026] [:error] [pid 36216:tid 36218] [client 4.206.147.225:21105] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aW5P78IpfKKs9fzB-yDUIgAAAUA"]
[Mon Jan 19 23:38:24.350183 2026] [:error] [pid 45563:tid 45638] [client 4.206.147.225:21045] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aW5P8JI4--OKA-PqumzaZAAAAJE"]
[Mon Jan 19 23:38:25.068013 2026] [:error] [pid 45561:tid 45566] [client 4.206.147.225:21102] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aW5P8a4ONSZn4nkTayKLXQAAAAA"]
[Mon Jan 19 23:38:25.861781 2026] [:error] [pid 45563:tid 45637] [client 4.206.147.225:8147] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aW5P8ZI4--OKA-PqumzaZwAAAJA"]
[Mon Jan 19 23:38:26.489012 2026] [:error] [pid 45561:tid 45584] [client 4.206.147.225:21023] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aW5P8q4ONSZn4nkTayKLXwAAABI"]
[Mon Jan 19 23:38:27.315368 2026] [:error] [pid 36216:tid 36224] [client 4.206.147.225:21108] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aW5P88IpfKKs9fzB-yDULAAAAUY"]
[Mon Jan 19 23:38:28.000195 2026] [:error] [pid 45657:tid 45666] [client 4.206.147.225:8130] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aW5P8w4XFYp2OcwCx-CzBwAAAMc"]
[Mon Jan 19 23:38:29.010123 2026] [:error] [pid 45657:tid 45662] [client 4.206.147.225:21091] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "aW5P9Q4XFYp2OcwCx-CzCQAAAMM"]
[Mon Jan 19 23:38:29.596109 2026] [:error] [pid 45657:tid 45671] [client 4.206.147.225:8077] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aW5P9Q4XFYp2OcwCx-CzCwAAAMw"]
[Mon Jan 19 23:38:30.456014 2026] [:error] [pid 36216:tid 36228] [client 4.206.147.225:8177] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aW5P9sIpfKKs9fzB-yDUMwAAAUo"]
[Mon Jan 19 23:38:31.069684 2026] [:error] [pid 45657:tid 45678] [client 4.206.147.225:21012] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aW5P9w4XFYp2OcwCx-CzDgAAANM"]
[Mon Jan 19 23:38:31.854028 2026] [:error] [pid 45563:tid 45623] [client 4.206.147.225:8142] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-729.php"] [unique_id "aW5P95I4--OKA-PqumzabwAAAII"]
[Mon Jan 19 23:38:32.665122 2026] [:error] [pid 45657:tid 45679] [client 4.206.147.225:21070] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aW5P-A4XFYp2OcwCx-CzEAAAANQ"]
[Mon Jan 19 23:38:33.679453 2026] [:error] [pid 45562:tid 45615] [client 4.206.147.225:21069] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aW5P-ToUil_kwpvtDW4ANgAAAFU"]
[Mon Jan 19 23:38:34.543367 2026] [:error] [pid 47089:tid 47095] [client 4.206.147.225:21110] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aW5P-hlIzijVNfdIsZ4h4wAAAQQ"]
[Mon Jan 19 23:38:35.234284 2026] [:error] [pid 36216:tid 36224] [client 4.206.147.225:21078] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "aW5P-8IpfKKs9fzB-yDURQAAAUY"]
[Mon Jan 19 23:38:36.076210 2026] [:error] [pid 36216:tid 36229] [client 4.206.147.225:21006] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aW5P_MIpfKKs9fzB-yDURwAAAUs"]
[Mon Jan 19 23:38:36.859329 2026] [:error] [pid 47089:tid 47102] [client 4.206.147.225:21065] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aW5P_BlIzijVNfdIsZ4h5gAAAQs"]
[Mon Jan 19 23:38:37.365652 2026] [:error] [pid 47089:tid 47100] [client 4.206.147.225:8176] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aW5P_RlIzijVNfdIsZ4h6QAAAQk"]
[Mon Jan 19 23:38:38.134785 2026] [:error] [pid 36216:tid 36218] [client 4.206.147.225:8140] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aW5P_sIpfKKs9fzB-yDUTQAAAUA"]
[Mon Jan 19 23:38:39.045047 2026] [:error] [pid 36216:tid 36229] [client 4.206.147.225:8164] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aW5P_8IpfKKs9fzB-yDUUgAAAUs"]
[Mon Jan 19 23:38:39.932421 2026] [:error] [pid 36216:tid 36234] [client 4.206.147.225:21092] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aW5P_8IpfKKs9fzB-yDUVwAAAVA"]
[Mon Jan 19 23:38:41.749185 2026] [:error] [pid 36216:tid 36236] [client 4.206.147.225:21083] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aW5QAcIpfKKs9fzB-yDUZgAAAVI"]
[Mon Jan 19 23:38:42.724401 2026] [:error] [pid 45561:tid 45575] [client 4.206.147.225:8188] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aW5QAq4ONSZn4nkTayKLfAAAAAk"]
[Mon Jan 19 23:38:43.596526 2026] [:error] [pid 45561:tid 45578] [client 4.206.147.225:21047] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aW5QA64ONSZn4nkTayKLfgAAAAw"]
[Mon Jan 19 23:38:44.699893 2026] [:error] [pid 45562:tid 45608] [client 4.206.147.225:8128] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aW5QBDoUil_kwpvtDW4AOAAAAE4"]
[Mon Jan 19 23:38:45.504369 2026] [:error] [pid 36216:tid 36228] [client 4.206.147.225:21040] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aW5QBcIpfKKs9fzB-yDUewAAAUo"]
[Mon Jan 19 23:38:46.319323 2026] [:error] [pid 47089:tid 47104] [client 4.206.147.225:8134] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aW5QBhlIzijVNfdIsZ4h7gAAAQ0"]
[Mon Jan 19 23:38:47.490607 2026] [:error] [pid 47089:tid 47114] [client 4.206.147.225:8146] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FII.php"] [unique_id "aW5QBxlIzijVNfdIsZ4h7wAAARc"]
[Mon Jan 19 23:38:48.028152 2026] [:error] [pid 45561:tid 45566] [client 4.206.147.225:21041] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FII.php"] [unique_id "aW5QCK4ONSZn4nkTayKLjAAAAAA"]
[Mon Jan 19 23:38:48.738908 2026] [:error] [pid 45561:tid 45567] [client 4.206.147.225:20995] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FII.php"] [unique_id "aW5QCK4ONSZn4nkTayKLkQAAAAE"]
[Mon Jan 19 23:38:49.826505 2026] [:error] [pid 45563:tid 45627] [client 4.206.147.225:21107] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FII.php"] [unique_id "aW5QCZI4--OKA-PqumzagAAAAIY"]
[Mon Jan 19 23:38:50.923066 2026] [:error] [pid 36216:tid 36242] [client 4.206.147.225:21089] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aW5QCsIpfKKs9fzB-yDUhQAAAVg"]
[Mon Jan 19 23:38:51.773726 2026] [:error] [pid 45563:tid 45637] [client 4.206.147.225:8144] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aW5QC5I4--OKA-PqumzagwAAAJA"]
[Mon Jan 19 23:38:52.959636 2026] [:error] [pid 45562:tid 45602] [client 4.206.147.225:8073] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aW5QDDoUil_kwpvtDW4ARAAAAEg"]
[Mon Jan 19 23:38:53.898148 2026] [:error] [pid 45563:tid 45622] [client 4.206.147.225:8033] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ac.php"] [unique_id "aW5QDZI4--OKA-PqumzahgAAAIE"]
[Mon Jan 19 23:38:54.665645 2026] [:error] [pid 45562:tid 45614] [client 4.206.147.225:8139] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atex1.php"] [unique_id "aW5QDjoUil_kwpvtDW4ARQAAAFQ"]
[Mon Jan 19 23:38:56.350222 2026] [:error] [pid 45561:tid 45587] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/atex1.php
[Mon Jan 19 23:38:56.558482 2026] [:error] [pid 45561:tid 45569] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/blox.php
[Mon Jan 19 23:38:56.772877 2026] [:error] [pid 45561:tid 45583] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-64wscx6shd.php
[Mon Jan 19 23:38:57.257212 2026] [:error] [pid 45561:tid 45584] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Mon Jan 19 23:38:57.468414 2026] [:error] [pid 45561:tid 45571] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/sxx.php
[Mon Jan 19 23:38:57.679436 2026] [:error] [pid 45561:tid 45578] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Mon Jan 19 23:38:57.959593 2026] [:error] [pid 45561:tid 45586] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Mon Jan 19 23:38:58.176733 2026] [:error] [pid 45561:tid 45577] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Mon Jan 19 23:38:58.388677 2026] [:error] [pid 45561:tid 45570] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Mon Jan 19 23:38:58.602631 2026] [:error] [pid 45561:tid 45580] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/5b9ac.php
[Mon Jan 19 23:38:58.811689 2026] [:error] [pid 45561:tid 45576] [client 4.206.147.225:21100] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Mon Jan 19 23:38:59.018916 2026] [:error] [pid 45561:tid 45567] [client 4.206.147.225:21100] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aW5QE64ONSZn4nkTayKLqwAAAAE"]
[Mon Jan 19 23:38:59.766304 2026] [:error] [pid 45562:tid 45612] [client 4.206.147.225:8190] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aW5QEzoUil_kwpvtDW4ASAAAAFI"]
[Mon Jan 19 23:39:00.912135 2026] [:error] [pid 45561:tid 45571] [client 4.206.147.225:21060] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aW5QFK4ONSZn4nkTayKLsgAAAAU"]
[Mon Jan 19 23:39:01.489017 2026] [:error] [pid 45561:tid 45578] [client 4.206.147.225:21085] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aW5QFa4ONSZn4nkTayKLtAAAAAw"]
[Mon Jan 19 23:39:02.701421 2026] [:error] [pid 45561:tid 45577] [client 4.206.147.225:8135] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aW5QFq4ONSZn4nkTayKLtgAAAAs"]
[Mon Jan 19 23:39:03.265952 2026] [:error] [pid 45563:tid 45642] [client 4.206.147.225:8086] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aW5QF5I4--OKA-PqumzamgAAAJU"]
[Mon Jan 19 23:39:03.829710 2026] [:error] [pid 45657:tid 45672] [client 4.206.147.225:20994] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aW5QFw4XFYp2OcwCx-CzHwAAAM0"]
[Mon Jan 19 23:39:04.577631 2026] [:error] [pid 47089:tid 47108] [client 4.206.147.225:8107] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aW5QGBlIzijVNfdIsZ4iCQAAARE"]
[Mon Jan 19 23:39:06.876278 2026] [:error] [pid 36216:tid 36222] [client 4.206.147.225:21033] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aW5QGsIpfKKs9fzB-yDUmwAAAUQ"]
[Mon Jan 19 23:39:07.702990 2026] [:error] [pid 45563:tid 45638] [client 4.206.147.225:8137] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aW5QG5I4--OKA-PqumzaogAAAJE"]
[Mon Jan 19 23:39:08.407715 2026] [:error] [pid 45562:tid 45596] [client 4.206.147.225:8136] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aW5QHDoUil_kwpvtDW4AUQAAAEI"]
[Mon Jan 19 23:39:09.051037 2026] [:error] [pid 45563:tid 45625] [client 4.206.147.225:21051] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "aW5QHZI4--OKA-PqumzapgAAAIQ"]
[Mon Jan 19 23:39:09.996580 2026] [:error] [pid 45561:tid 45588] [client 4.206.147.225:8131] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aW5QHa4ONSZn4nkTayKLwgAAABY"]
[Mon Jan 19 23:39:10.647955 2026] [:error] [pid 36216:tid 36234] [client 4.206.147.225:21094] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aW5QHsIpfKKs9fzB-yDUoQAAAVA"]
[Mon Jan 19 23:39:11.425463 2026] [:error] [pid 36216:tid 36230] [client 4.206.147.225:8178] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aW5QH8IpfKKs9fzB-yDUpAAAAUw"]
[Mon Jan 19 23:39:12.609964 2026] [:error] [pid 36216:tid 36229] [client 4.206.147.225:8181] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aW5QIMIpfKKs9fzB-yDUpQAAAUs"]
[Mon Jan 19 23:39:13.305361 2026] [:error] [pid 45561:tid 45589] [client 4.206.147.225:8068] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aW5QIa4ONSZn4nkTayKLxwAAABc"]
[Mon Jan 19 23:39:14.552438 2026] [:error] [pid 45561:tid 45588] [client 4.206.147.225:21019] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aW5QIq4ONSZn4nkTayKLzAAAABY"]
[Mon Jan 19 23:39:15.098425 2026] [:error] [pid 45563:tid 45635] [client 4.206.147.225:8087] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aW5QI5I4--OKA-PqumzasQAAAI4"]
[Mon Jan 19 23:39:16.054502 2026] [:error] [pid 45561:tid 45568] [client 4.206.147.225:21035] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aW5QJK4ONSZn4nkTayKLzwAAAAI"]
[Mon Jan 19 23:39:17.431968 2026] [:error] [pid 45563:tid 45633] [client 4.206.147.225:8065] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin836.php"] [unique_id "aW5QJZI4--OKA-PqumzatQAAAIw"]
[Mon Jan 19 23:39:18.066472 2026] [:error] [pid 45561:tid 45573] [client 4.206.147.225:8019] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin836.php"] [unique_id "aW5QJq4ONSZn4nkTayKL1AAAAAc"]
[Mon Jan 19 23:39:19.102171 2026] [:error] [pid 45657:tid 45671] [client 4.206.147.225:8010] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin836.php"] [unique_id "aW5QJw4XFYp2OcwCx-CzKwAAAMw"]
[Mon Jan 19 23:39:19.980989 2026] [:error] [pid 45562:tid 45601] [client 4.206.147.225:8123] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin836.php"] [unique_id "aW5QJzoUil_kwpvtDW4AXAAAAEc"]
[Mon Jan 19 23:39:20.728519 2026] [:error] [pid 45657:tid 45683] [client 4.206.147.225:8089] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aW5QKA4XFYp2OcwCx-CzLgAAANg"]
[Mon Jan 19 23:39:21.566453 2026] [:error] [pid 45657:tid 45668] [client 4.206.147.225:8154] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aW5QKQ4XFYp2OcwCx-CzLwAAAMk"]
[Mon Jan 19 23:39:22.146368 2026] [:error] [pid 45561:tid 45578] [client 4.206.147.225:21034] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aW5QKq4ONSZn4nkTayKL2gAAAAw"]
[Mon Jan 19 23:39:22.809848 2026] [:error] [pid 45563:tid 45641] [client 4.206.147.225:8149] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aW5QKpI4--OKA-PqumzawQAAAJQ"]
[Mon Jan 19 23:39:23.393261 2026] [:error] [pid 45561:tid 45571] [client 4.206.147.225:8171] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aW5QK64ONSZn4nkTayKL3QAAAAU"]
[Mon Jan 19 23:39:24.482839 2026] [:error] [pid 45657:tid 45674] [client 4.206.147.225:21031] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aW5QLA4XFYp2OcwCx-CzMgAAAM8"]
[Mon Jan 19 23:39:25.978204 2026] [:error] [pid 45563:tid 45624] [client 4.206.147.225:8106] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aW5QLZI4--OKA-PqumzaygAAAIM"]
[Mon Jan 19 23:39:26.726959 2026] [:error] [pid 45563:tid 45622] [client 4.206.147.225:8119] [client 4.206.147.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aW5QLpI4--OKA-PqumzazgAAAIE"]
[Tue Jan 20 13:17:24.410319 2026] [:error] [pid 56291:tid 56310] [client 69.10.42.26:54710] [client 69.10.42.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aW8P5LXgW_1T5Nikxa24AgAAAE8"]
[Tue Jan 20 13:29:12.765628 2026] [:error] [pid 54259:tid 54300] [client 103.77.107.178:49462] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aW8SqA2q1USrePnOoFSykQAAAJc"]
[Tue Jan 20 20:15:07.889621 2026] [:error] [pid 54382:tid 54395] [client 64.225.8.2:57467] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.vscode/sftp-config.json"] [unique_id "aW9xy0TJlZ9SJ6sBOEukIAAAAAo"]
[Tue Jan 20 20:15:10.445125 2026] [:error] [pid 56291:tid 56298] [client 64.225.8.2:50586] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sftp.json"] [unique_id "aW9xzrXgW_1T5Nikxa3vBQAAAEM"]
[Tue Jan 20 20:15:12.989790 2026] [:error] [pid 54382:tid 54389] [client 64.225.8.2:58003] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ftp-sync.json"] [unique_id "aW9x0ETJlZ9SJ6sBOEukIgAAAAQ"]
[Tue Jan 20 20:15:15.475981 2026] [:error] [pid 63647:tid 63663] [client 64.225.8.2:63522] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ftp-sync.json"] [unique_id "aW9x01UaYw1xHOoaFFIDkgAAAg4"]
[Tue Jan 20 20:15:18.128882 2026] [:error] [pid 54261:tid 54345] [client 64.225.8.2:54674] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ftp.json"] [unique_id "aW9x1gESZyr5alDl9TvtwAAAAco"]
[Tue Jan 20 20:15:20.718783 2026] [:error] [pid 54382:tid 54394] [client 64.225.8.2:61190] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ftp-config.json"] [unique_id "aW9x2ETJlZ9SJ6sBOEukJwAAAAk"]
[Tue Jan 20 20:15:22.935022 2026] [:error] [pid 56291:tid 56298] [client 64.225.8.2:51589] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ftp-config.json"] [unique_id "aW9x2rXgW_1T5Nikxa3vCgAAAEM"]
[Tue Jan 20 20:15:25.235422 2026] [:error] [pid 54382:tid 54407] [client 64.225.8.2:57375] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aW9x3UTJlZ9SJ6sBOEukKQAAABY"]
[Tue Jan 20 23:25:15.717377 2026] [:error] [pid 17340:tid 17367] [client 138.124.67.224:38266] [client 138.124.67.224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aW-eW_AsOSYVgw_35t28cAAAAks"]
[Wed Jan 21 04:17:41.727836 2026] [:error] [pid 59863:tid 59875] [client 20.89.17.172:61006] [client 20.89.17.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aW_i5bHQ1zVZ4yLuI-y7ogAAAQg"]
[Wed Jan 21 04:17:42.183439 2026] [:error] [pid 21456:tid 21527] [client 20.89.17.172:11376] [client 20.89.17.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aW_i5gKyVQ9Ob2YxRApx1QAAAIk"]
[Wed Jan 21 04:17:42.644799 2026] [:error] [pid 21455:tid 21498] [client 20.89.17.172:48421] [client 20.89.17.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aW_i5opOKALCSo1URZEy2wAAAEc"]
[Wed Jan 21 04:17:43.104249 2026] [:error] [pid 21563:tid 21588] [client 20.89.17.172:11364] [client 20.89.17.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aW_i5xZq__dTorabEoyCkQAAANc"]
[Wed Jan 21 06:02:46.583873 2026] [:error] [pid 21563:tid 21588] [client 103.65.236.149:51187] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aW_7hhZq__dTorabEoyiPwAAANc"]
[Wed Jan 21 06:44:30.065082 2026] [:error] [pid 21454:tid 21485] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/eee.php
[Wed Jan 21 06:44:30.207940 2026] [:error] [pid 21454:tid 21479] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Jan 21 06:44:30.349999 2026] [:error] [pid 21454:tid 21480] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Wed Jan 21 06:44:30.494517 2026] [:error] [pid 21454:tid 21470] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Wed Jan 21 06:44:30.635912 2026] [:error] [pid 21454:tid 21488] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Jan 21 06:44:30.779288 2026] [:error] [pid 21454:tid 21464] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/support.php
[Wed Jan 21 06:44:31.065666 2026] [:error] [pid 21454:tid 21473] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/dox.php
[Wed Jan 21 06:44:31.208947 2026] [:error] [pid 21454:tid 21471] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/siteheads.php
[Wed Jan 21 06:44:31.350326 2026] [:error] [pid 21454:tid 21472] [client 4.188.251.0:15622] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Jan 21 06:44:31.488939 2026] [:error] [pid 21454:tid 21474] [client 4.188.251.0:15622] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aXAFTzwp5UZmMFzY2bpouQAAAAo"]
[Wed Jan 21 06:44:31.765945 2026] [:error] [pid 21455:tid 21494] [client 4.188.251.0:15710] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aXAFT4pOKALCSo1URZFV2gAAAEM"]
[Wed Jan 21 06:44:32.042254 2026] [:error] [pid 21563:tid 21580] [client 4.188.251.0:15711] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aXAFUBZq__dTorabEoyvEAAAAM8"]
[Wed Jan 21 06:44:32.315477 2026] [:error] [pid 21454:tid 21486] [client 4.188.251.0:15632] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aXAFUDwp5UZmMFzY2bpouwAAABY"]
[Wed Jan 21 06:44:32.593326 2026] [:error] [pid 21563:tid 21588] [client 4.188.251.0:15721] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logout.php"] [unique_id "aXAFUBZq__dTorabEoyvEQAAANc"]
[Wed Jan 21 06:44:32.867111 2026] [:error] [pid 21454:tid 21465] [client 4.188.251.0:15646] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logout.php"] [unique_id "aXAFUDwp5UZmMFzY2bpovQAAAAE"]
[Wed Jan 21 06:44:33.143526 2026] [:error] [pid 21456:tid 21520] [client 4.188.251.0:15725] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logout.php"] [unique_id "aXAFUQKyVQ9Ob2YxRAqYMwAAAII"]
[Wed Jan 21 06:44:33.415290 2026] [:error] [pid 21563:tid 21586] [client 4.188.251.0:15645] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-logout.php"] [unique_id "aXAFURZq__dTorabEoyvFAAAANU"]
[Wed Jan 21 06:44:33.685404 2026] [:error] [pid 21454:tid 21469] [client 4.188.251.0:15713] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFUTwp5UZmMFzY2bpovwAAAAU"]
[Wed Jan 21 06:44:33.957203 2026] [:error] [pid 21454:tid 21477] [client 4.188.251.0:15743] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFUTwp5UZmMFzY2bpowAAAAA0"]
[Wed Jan 21 06:44:34.232998 2026] [:error] [pid 21454:tid 21485] [client 4.188.251.0:15625] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFUjwp5UZmMFzY2bpowQAAABU"]
[Wed Jan 21 06:44:34.510328 2026] [:error] [pid 21454:tid 21479] [client 4.188.251.0:6088] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFUjwp5UZmMFzY2bpoxAAAAA8"]
[Wed Jan 21 06:44:34.783789 2026] [:error] [pid 21454:tid 21470] [client 4.188.251.0:15631] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aXAFUjwp5UZmMFzY2bpoxgAAAAY"]
[Wed Jan 21 06:44:35.058172 2026] [:error] [pid 21454:tid 21482] [client 4.188.251.0:15687] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aXAFUzwp5UZmMFzY2bpoyAAAABI"]
[Wed Jan 21 06:44:35.344170 2026] [:error] [pid 21454:tid 21476] [client 4.188.251.0:15716] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aXAFUzwp5UZmMFzY2bpoywAAAAw"]
[Wed Jan 21 06:44:35.626780 2026] [:error] [pid 21563:tid 21565] [client 4.188.251.0:15703] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0o0.php"] [unique_id "aXAFUxZq__dTorabEoyvGAAAAMA"]
[Wed Jan 21 06:44:35.900746 2026] [:error] [pid 59863:tid 59884] [client 4.188.251.0:15707] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aXAFU7HQ1zVZ4yLuI-z5IAAAARE"]
[Wed Jan 21 06:44:36.177208 2026] [:error] [pid 21456:tid 21540] [client 4.188.251.0:6083] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aXAFVAKyVQ9Ob2YxRAqYNAAAAJY"]
[Wed Jan 21 06:44:36.450434 2026] [:error] [pid 21456:tid 21529] [client 4.188.251.0:15630] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aXAFVAKyVQ9Ob2YxRAqYNQAAAIs"]
[Wed Jan 21 06:44:36.722419 2026] [:error] [pid 21454:tid 21478] [client 4.188.251.0:6119] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aXAFVDwp5UZmMFzY2bpo0QAAAA4"]
[Wed Jan 21 06:44:37.007527 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:15736] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aXAFVRZq__dTorabEoyvHAAAAMg"]
[Wed Jan 21 06:44:37.280538 2026] [:error] [pid 21563:tid 21587] [client 4.188.251.0:15726] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aXAFVRZq__dTorabEoyvHQAAANY"]
[Wed Jan 21 06:44:37.562515 2026] [:error] [pid 21455:tid 21495] [client 4.188.251.0:15733] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aXAFVYpOKALCSo1URZFV3gAAAEQ"]
[Wed Jan 21 06:44:37.866986 2026] [:error] [pid 21454:tid 21465] [client 4.188.251.0:15725] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aXAFVTwp5UZmMFzY2bpo0wAAAAE"]
[Wed Jan 21 06:44:38.143399 2026] [:error] [pid 21456:tid 21536] [client 4.188.251.0:15637] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "aXAFVgKyVQ9Ob2YxRAqYNwAAAJI"]
[Wed Jan 21 06:44:38.417455 2026] [:error] [pid 21563:tid 21586] [client 4.188.251.0:15685] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "aXAFVhZq__dTorabEoyvIAAAANU"]
[Wed Jan 21 06:44:38.691907 2026] [:error] [pid 59863:tid 59885] [client 4.188.251.0:6120] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "aXAFVrHQ1zVZ4yLuI-z5IwAAARI"]
[Wed Jan 21 06:44:38.966351 2026] [:error] [pid 59863:tid 59877] [client 4.188.251.0:15692] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "aXAFVrHQ1zVZ4yLuI-z5JAAAAQo"]
[Wed Jan 21 06:44:39.238434 2026] [:error] [pid 59863:tid 59869] [client 4.188.251.0:15627] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/about.php"] [unique_id "aXAFV7HQ1zVZ4yLuI-z5JwAAAQI"]
[Wed Jan 21 06:44:39.512787 2026] [:error] [pid 21454:tid 21467] [client 4.188.251.0:15623] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/about.php"] [unique_id "aXAFVzwp5UZmMFzY2bpo1wAAAAM"]
[Wed Jan 21 06:44:39.787462 2026] [:error] [pid 21454:tid 21481] [client 4.188.251.0:15621] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/about.php"] [unique_id "aXAFVzwp5UZmMFzY2bpo2AAAABE"]
[Wed Jan 21 06:44:40.063960 2026] [:error] [pid 21455:tid 21510] [client 4.188.251.0:15616] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/about.php"] [unique_id "aXAFWIpOKALCSo1URZFV4AAAAFM"]
[Wed Jan 21 06:44:40.354277 2026] [:error] [pid 21455:tid 21500] [client 4.188.251.0:15644] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aXAFWIpOKALCSo1URZFV4QAAAEk"]
[Wed Jan 21 06:44:40.629636 2026] [:error] [pid 21455:tid 21492] [client 4.188.251.0:6099] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aXAFWIpOKALCSo1URZFV4gAAAEE"]
[Wed Jan 21 06:44:40.905197 2026] [:error] [pid 21455:tid 21514] [client 4.188.251.0:15647] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aXAFWIpOKALCSo1URZFV4wAAAFc"]
[Wed Jan 21 06:44:41.189957 2026] [:error] [pid 59863:tid 59881] [client 4.188.251.0:15636] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aXAFWbHQ1zVZ4yLuI-z5KAAAAQ4"]
[Wed Jan 21 06:44:41.473156 2026] [:error] [pid 59863:tid 59889] [client 4.188.251.0:15643] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-users.php"] [unique_id "aXAFWbHQ1zVZ4yLuI-z5KQAAARY"]
[Wed Jan 21 06:44:41.749279 2026] [:error] [pid 59863:tid 59890] [client 4.188.251.0:15700] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-users.php"] [unique_id "aXAFWbHQ1zVZ4yLuI-z5KgAAARc"]
[Wed Jan 21 06:44:42.026361 2026] [:error] [pid 59863:tid 59879] [client 4.188.251.0:15740] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-users.php"] [unique_id "aXAFWrHQ1zVZ4yLuI-z5LQAAAQw"]
[Wed Jan 21 06:44:42.302520 2026] [:error] [pid 21563:tid 21571] [client 4.188.251.0:15618] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-users.php"] [unique_id "aXAFWhZq__dTorabEoyvMQAAAMY"]
[Wed Jan 21 06:44:42.574063 2026] [:error] [pid 21454:tid 21480] [client 4.188.251.0:15691] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "aXAFWjwp5UZmMFzY2bppBwAAABA"]
[Wed Jan 21 06:44:42.850081 2026] [:error] [pid 21456:tid 21523] [client 4.188.251.0:15634] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "aXAFWgKyVQ9Ob2YxRAqYPAAAAIU"]
[Wed Jan 21 06:44:43.126473 2026] [:error] [pid 59863:tid 59877] [client 4.188.251.0:15734] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "aXAFW7HQ1zVZ4yLuI-z5SgAAAQo"]
[Wed Jan 21 06:44:43.413377 2026] [:error] [pid 59863:tid 59881] [client 4.188.251.0:15673] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "aXAFW7HQ1zVZ4yLuI-z5UQAAAQ4"]
[Wed Jan 21 06:44:43.701620 2026] [:error] [pid 21456:tid 21525] [client 4.188.251.0:15686] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aXAFWwKyVQ9Ob2YxRAqYPwAAAIc"]
[Wed Jan 21 06:44:43.984805 2026] [:error] [pid 21563:tid 21581] [client 4.188.251.0:15675] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aXAFWxZq__dTorabEoyvSwAAANA"]
[Wed Jan 21 06:44:44.259495 2026] [:error] [pid 21563:tid 21582] [client 4.188.251.0:15701] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aXAFXBZq__dTorabEoyvTAAAANE"]
[Wed Jan 21 06:44:44.547437 2026] [:error] [pid 21563:tid 21583] [client 4.188.251.0:15712] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/revision.php"] [unique_id "aXAFXBZq__dTorabEoyvTQAAANI"]
[Wed Jan 21 06:44:44.821002 2026] [:error] [pid 59863:tid 59879] [client 4.188.251.0:15619] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aXAFXLHQ1zVZ4yLuI-z5UwAAAQw"]
[Wed Jan 21 06:44:45.095254 2026] [:error] [pid 59863:tid 59871] [client 4.188.251.0:15732] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aXAFXbHQ1zVZ4yLuI-z5VQAAAQQ"]
[Wed Jan 21 06:44:45.369459 2026] [:error] [pid 21563:tid 21587] [client 4.188.251.0:6103] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aXAFXRZq__dTorabEoyvTwAAANY"]
[Wed Jan 21 06:44:45.640974 2026] [:error] [pid 21456:tid 21538] [client 4.188.251.0:15678] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "aXAFXQKyVQ9Ob2YxRAqYQAAAAJQ"]
[Wed Jan 21 06:44:45.919233 2026] [:error] [pid 21563:tid 21588] [client 4.188.251.0:15626] [client 4.188.251.0] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aXAFXRZq__dTorabEoyvUQAAANc"]
[Wed Jan 21 06:44:46.208839 2026] [:error] [pid 21563:tid 21567] [client 4.188.251.0:15629] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "aXAFXhZq__dTorabEoyvUgAAAMI"]
[Wed Jan 21 06:44:46.483973 2026] [:error] [pid 21455:tid 21494] [client 4.188.251.0:15690] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "aXAFXopOKALCSo1URZFWLgAAAEM"]
[Wed Jan 21 06:44:46.763162 2026] [:error] [pid 21563:tid 21578] [client 4.188.251.0:15617] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "aXAFXhZq__dTorabEoyvUwAAAM0"]
[Wed Jan 21 06:44:47.036171 2026] [:error] [pid 21563:tid 21571] [client 4.188.251.0:15727] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aXAFXxZq__dTorabEoyvVAAAAMY"]
[Wed Jan 21 06:44:47.316032 2026] [:error] [pid 21563:tid 21565] [client 4.188.251.0:15680] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aXAFXxZq__dTorabEoyvVQAAAMA"]
[Wed Jan 21 06:44:47.598597 2026] [:error] [pid 21454:tid 21467] [client 4.188.251.0:15642] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aXAFXzwp5UZmMFzY2bppKgAAAAM"]
[Wed Jan 21 06:44:47.876970 2026] [:error] [pid 21456:tid 21521] [client 4.188.251.0:15638] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aXAFXwKyVQ9Ob2YxRAqYRgAAAIM"]
[Wed Jan 21 06:44:48.151211 2026] [:error] [pid 59863:tid 59882] [client 4.188.251.0:15668] [client 4.188.251.0] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aXAFYLHQ1zVZ4yLuI-z5YAAAAQ8"]
[Wed Jan 21 06:44:48.424354 2026] [:error] [pid 59863:tid 59881] [client 4.188.251.0:15681] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aXAFYLHQ1zVZ4yLuI-z5YQAAAQ4"]
[Wed Jan 21 06:44:48.699210 2026] [:error] [pid 59863:tid 59884] [client 4.188.251.0:15693] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aXAFYLHQ1zVZ4yLuI-z5YgAAARE"]
[Wed Jan 21 06:44:48.975877 2026] [:error] [pid 59863:tid 59873] [client 4.188.251.0:15715] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aXAFYLHQ1zVZ4yLuI-z5YwAAAQY"]
[Wed Jan 21 06:44:49.251339 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:15665] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aXAFYRZq__dTorabEoyvVwAAAMg"]
[Wed Jan 21 06:44:49.525135 2026] [:error] [pid 21563:tid 21587] [client 4.188.251.0:15699] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aXAFYRZq__dTorabEoyvWAAAANY"]
[Wed Jan 21 06:44:49.798060 2026] [:error] [pid 21563:tid 21576] [client 4.188.251.0:15704] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aXAFYRZq__dTorabEoyvWQAAAMs"]
[Wed Jan 21 06:44:50.084364 2026] [:error] [pid 21455:tid 21514] [client 4.188.251.0:15735] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell20211028.php"] [unique_id "aXAFYopOKALCSo1URZFWMgAAAFc"]
[Wed Jan 21 06:44:50.357379 2026] [:error] [pid 21563:tid 21588] [client 4.188.251.0:6109] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aXAFYhZq__dTorabEoyvWwAAANc"]
[Wed Jan 21 06:44:50.646299 2026] [:error] [pid 21563:tid 21567] [client 4.188.251.0:15635] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aXAFYhZq__dTorabEoyvXgAAAMI"]
[Wed Jan 21 06:44:50.923864 2026] [:error] [pid 21563:tid 21571] [client 4.188.251.0:15717] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aXAFYhZq__dTorabEoyvYAAAAMY"]
[Wed Jan 21 06:44:51.214262 2026] [:error] [pid 21563:tid 21570] [client 4.188.251.0:15662] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aXAFYxZq__dTorabEoyvYQAAAMU"]
[Wed Jan 21 06:44:51.488892 2026] [:error] [pid 21563:tid 21574] [client 4.188.251.0:15628] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aXAFYxZq__dTorabEoyvYwAAAMk"]
[Wed Jan 21 06:44:51.768213 2026] [:error] [pid 21563:tid 21581] [client 4.188.251.0:15723] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aXAFYxZq__dTorabEoyvZAAAANA"]
[Wed Jan 21 06:44:52.041846 2026] [:error] [pid 21563:tid 21582] [client 4.188.251.0:15677] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aXAFZBZq__dTorabEoyvZgAAANE"]
[Wed Jan 21 06:44:52.314801 2026] [:error] [pid 21455:tid 21511] [client 4.188.251.0:6128] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aXAFZIpOKALCSo1URZFWMwAAAFQ"]
[Wed Jan 21 06:44:52.603149 2026] [:error] [pid 59863:tid 59869] [client 4.188.251.0:15730] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aXAFZLHQ1zVZ4yLuI-z5aQAAAQI"]
[Wed Jan 21 06:44:52.896274 2026] [:error] [pid 21563:tid 21580] [client 4.188.251.0:15624] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aXAFZBZq__dTorabEoyvaQAAAM8"]
[Wed Jan 21 06:44:53.176796 2026] [:error] [pid 59863:tid 59881] [client 4.188.251.0:15702] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aXAFZbHQ1zVZ4yLuI-z5agAAAQ4"]
[Wed Jan 21 06:44:53.449717 2026] [:error] [pid 21454:tid 21472] [client 4.188.251.0:15720] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aXAFZTwp5UZmMFzY2bppMgAAAAg"]
[Wed Jan 21 06:44:53.724938 2026] [:error] [pid 59863:tid 59886] [client 4.188.251.0:6095] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baxa1.phP8"] [unique_id "aXAFZbHQ1zVZ4yLuI-z5awAAARM"]
[Wed Jan 21 06:44:53.998989 2026] [:error] [pid 21454:tid 21466] [client 4.188.251.0:15722] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baxa1.phP8"] [unique_id "aXAFZTwp5UZmMFzY2bppNAAAAAI"]
[Wed Jan 21 06:44:54.280004 2026] [:error] [pid 21454:tid 21485] [client 4.188.251.0:15737] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baxa1.phP8"] [unique_id "aXAFZjwp5UZmMFzY2bppNQAAABU"]
[Wed Jan 21 06:44:54.558216 2026] [:error] [pid 59863:tid 59875] [client 4.188.251.0:15640] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baxa1.phP8"] [unique_id "aXAFZrHQ1zVZ4yLuI-z5bAAAAQg"]
[Wed Jan 21 06:44:54.833333 2026] [:error] [pid 21563:tid 21579] [client 4.188.251.0:15661] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/page.php"] [unique_id "aXAFZhZq__dTorabEoyvbAAAAM4"]
[Wed Jan 21 06:44:55.131139 2026] [:error] [pid 21455:tid 21495] [client 4.188.251.0:6116] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/page.php"] [unique_id "aXAFZ4pOKALCSo1URZFWNwAAAEQ"]
[Wed Jan 21 06:44:55.406299 2026] [:error] [pid 59863:tid 59877] [client 4.188.251.0:15657] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/page.php"] [unique_id "aXAFZ7HQ1zVZ4yLuI-z5bgAAAQo"]
[Wed Jan 21 06:44:55.687230 2026] [:error] [pid 21456:tid 21537] [client 4.188.251.0:6026] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/page.php"] [unique_id "aXAFZwKyVQ9Ob2YxRAqYSAAAAJM"]
[Wed Jan 21 06:44:55.960994 2026] [:error] [pid 21563:tid 21578] [client 4.188.251.0:6025] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tempfuns.php"] [unique_id "aXAFZxZq__dTorabEoyvbQAAAM0"]
[Wed Jan 21 06:44:56.236243 2026] [:error] [pid 21454:tid 21480] [client 4.188.251.0:15688] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tempfuns.php"] [unique_id "aXAFaDwp5UZmMFzY2bppOQAAABA"]
[Wed Jan 21 06:44:56.509705 2026] [:error] [pid 21456:tid 21540] [client 4.188.251.0:6023] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tempfuns.php"] [unique_id "aXAFaAKyVQ9Ob2YxRAqYSQAAAJY"]
[Wed Jan 21 06:44:56.784947 2026] [:error] [pid 21455:tid 21513] [client 4.188.251.0:6096] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tempfuns.php"] [unique_id "aXAFaIpOKALCSo1URZFWOQAAAFY"]
[Wed Jan 21 06:44:57.058769 2026] [:error] [pid 21454:tid 21476] [client 4.188.251.0:6100] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/past.php"] [unique_id "aXAFaTwp5UZmMFzY2bppPAAAAAw"]
[Wed Jan 21 06:44:57.333397 2026] [:error] [pid 21454:tid 21474] [client 4.188.251.0:6089] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/past.php"] [unique_id "aXAFaTwp5UZmMFzY2bppPQAAAAo"]
[Wed Jan 21 06:44:57.622328 2026] [:error] [pid 21456:tid 21528] [client 4.188.251.0:15655] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/past.php"] [unique_id "aXAFaQKyVQ9Ob2YxRAqYSwAAAIo"]
[Wed Jan 21 06:44:57.895754 2026] [:error] [pid 21455:tid 21497] [client 4.188.251.0:6035] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/past.php"] [unique_id "aXAFaYpOKALCSo1URZFWOgAAAEY"]
[Wed Jan 21 06:44:58.165438 2026] [:error] [pid 59863:tid 59873] [client 4.188.251.0:15667] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aXAFarHQ1zVZ4yLuI-z5cQAAAQY"]
[Wed Jan 21 06:44:58.438384 2026] [:error] [pid 21454:tid 21464] [client 4.188.251.0:15658] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aXAFajwp5UZmMFzY2bppPwAAAAA"]
[Wed Jan 21 06:44:58.709390 2026] [:error] [pid 59863:tid 59867] [client 4.188.251.0:15664] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aXAFarHQ1zVZ4yLuI-z5cgAAAQA"]
[Wed Jan 21 06:44:58.983595 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:15641] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aXAFahZq__dTorabEoyvbgAAAMg"]
[Wed Jan 21 06:44:59.258877 2026] [:error] [pid 59863:tid 59882] [client 4.188.251.0:15724] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aXAFa7HQ1zVZ4yLuI-z5dAAAAQ8"]
[Wed Jan 21 06:44:59.532683 2026] [:error] [pid 21454:tid 21473] [client 4.188.251.0:15620] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aXAFazwp5UZmMFzY2bppQQAAAAk"]
[Wed Jan 21 06:44:59.824755 2026] [:error] [pid 21454:tid 21478] [client 4.188.251.0:15698] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aXAFazwp5UZmMFzY2bppQgAAAA4"]
[Wed Jan 21 06:45:00.099046 2026] [:error] [pid 21454:tid 21487] [client 4.188.251.0:15697] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aXAFbDwp5UZmMFzY2bppQwAAABc"]
[Wed Jan 21 06:45:00.380765 2026] [:error] [pid 59863:tid 59876] [client 4.188.251.0:6094] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aXAFbLHQ1zVZ4yLuI-z5egAAAQk"]
[Wed Jan 21 06:45:00.653340 2026] [:error] [pid 59863:tid 59874] [client 4.188.251.0:15652] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aXAFbLHQ1zVZ4yLuI-z5ewAAAQc"]
[Wed Jan 21 06:45:00.930212 2026] [:error] [pid 21456:tid 21536] [client 4.188.251.0:6090] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aXAFbAKyVQ9Ob2YxRAqYUQAAAJI"]
[Wed Jan 21 06:45:01.209901 2026] [:error] [pid 21456:tid 21535] [client 4.188.251.0:15738] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aXAFbQKyVQ9Ob2YxRAqYUgAAAJE"]
[Wed Jan 21 06:45:01.509757 2026] [:error] [pid 21563:tid 21571] [client 4.188.251.0:6110] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "aXAFbRZq__dTorabEoyvcAAAAMY"]
[Wed Jan 21 06:45:01.784705 2026] [:error] [pid 21455:tid 21511] [client 4.188.251.0:15639] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "aXAFbYpOKALCSo1URZFWPwAAAFQ"]
[Wed Jan 21 06:45:02.064082 2026] [:error] [pid 21456:tid 21523] [client 4.188.251.0:15681] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "aXAFbgKyVQ9Ob2YxRAqYVAAAAIU"]
[Wed Jan 21 06:45:02.344899 2026] [:error] [pid 21454:tid 21485] [client 4.188.251.0:15742] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "aXAFbjwp5UZmMFzY2bppRwAAABU"]
[Wed Jan 21 06:45:02.618503 2026] [:error] [pid 21454:tid 21469] [client 4.188.251.0:6102] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aXAFbjwp5UZmMFzY2bppSAAAAAU"]
[Wed Jan 21 06:45:02.889804 2026] [:error] [pid 21456:tid 21533] [client 4.188.251.0:15679] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aXAFbgKyVQ9Ob2YxRAqYVgAAAI8"]
[Wed Jan 21 06:45:03.170936 2026] [:error] [pid 21456:tid 21525] [client 4.188.251.0:15739] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aXAFbwKyVQ9Ob2YxRAqYWAAAAIc"]
[Wed Jan 21 06:45:03.455444 2026] [:error] [pid 21563:tid 21589] [client 4.188.251.0:15708] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aXAFbxZq__dTorabEoyvcwAAANg"]
[Wed Jan 21 06:45:03.731917 2026] [:error] [pid 21563:tid 21570] [client 4.188.251.0:15714] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aXAFbxZq__dTorabEoyvdAAAAMU"]
[Wed Jan 21 06:45:04.008134 2026] [:error] [pid 21456:tid 21542] [client 4.188.251.0:6094] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aXAFcAKyVQ9Ob2YxRAqYWwAAAJg"]
[Wed Jan 21 06:45:04.284192 2026] [:error] [pid 21456:tid 21528] [client 4.188.251.0:6049] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aXAFcAKyVQ9Ob2YxRAqYXQAAAIo"]
[Wed Jan 21 06:45:04.557029 2026] [:error] [pid 21455:tid 21499] [client 4.188.251.0:6097] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aXAFcIpOKALCSo1URZFWQgAAAEg"]
[Wed Jan 21 06:45:04.829764 2026] [:error] [pid 21454:tid 21482] [client 4.188.251.0:6086] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9v6.php"] [unique_id "aXAFcDwp5UZmMFzY2bppTQAAABI"]
[Wed Jan 21 06:45:05.116689 2026] [:error] [pid 21454:tid 21483] [client 4.188.251.0:15633] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9v6.php"] [unique_id "aXAFcTwp5UZmMFzY2bppTgAAABM"]
[Wed Jan 21 06:45:05.390704 2026] [:error] [pid 59863:tid 59879] [client 4.188.251.0:6021] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9v6.php"] [unique_id "aXAFcbHQ1zVZ4yLuI-z5fAAAAQw"]
[Wed Jan 21 06:45:05.666519 2026] [:error] [pid 21563:tid 21574] [client 4.188.251.0:15728] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9v6.php"] [unique_id "aXAFcRZq__dTorabEoyvdgAAAMk"]
[Wed Jan 21 06:45:05.948159 2026] [:error] [pid 21563:tid 21581] [client 4.188.251.0:6124] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aXAFcRZq__dTorabEoyveAAAANA"]
[Wed Jan 21 06:45:06.221117 2026] [:error] [pid 21563:tid 21583] [client 4.188.251.0:6107] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aXAFchZq__dTorabEoyveQAAANI"]
[Wed Jan 21 06:45:06.504418 2026] [:error] [pid 59863:tid 59871] [client 4.188.251.0:15719] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aXAFcrHQ1zVZ4yLuI-z5fQAAAQQ"]
[Wed Jan 21 06:45:06.782500 2026] [:error] [pid 59863:tid 59891] [client 4.188.251.0:6114] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "aXAFcrHQ1zVZ4yLuI-z5fgAAARg"]
[Wed Jan 21 06:45:07.056876 2026] [:error] [pid 21455:tid 21505] [client 4.188.251.0:6042] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aXAFc4pOKALCSo1URZFWRQAAAE4"]
[Wed Jan 21 06:45:07.330749 2026] [:error] [pid 21456:tid 21523] [client 4.188.251.0:6091] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aXAFcwKyVQ9Ob2YxRAqYYwAAAIU"]
[Wed Jan 21 06:45:07.603975 2026] [:error] [pid 21456:tid 21519] [client 4.188.251.0:6135] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aXAFcwKyVQ9Ob2YxRAqYZAAAAIE"]
[Wed Jan 21 06:45:07.877034 2026] [:error] [pid 21456:tid 21533] [client 4.188.251.0:15731] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aXAFcwKyVQ9Ob2YxRAqYZQAAAI8"]
[Wed Jan 21 06:45:08.160419 2026] [:error] [pid 21454:tid 21472] [client 4.188.251.0:6098] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "aXAFdDwp5UZmMFzY2bppVQAAAAg"]
[Wed Jan 21 06:45:08.431398 2026] [:error] [pid 59863:tid 59889] [client 4.188.251.0:6030] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "aXAFdLHQ1zVZ4yLuI-z5ggAAARY"]
[Wed Jan 21 06:45:08.716680 2026] [:error] [pid 21563:tid 21566] [client 4.188.251.0:6101] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "aXAFdBZq__dTorabEoyvfAAAAME"]
[Wed Jan 21 06:45:08.996660 2026] [:error] [pid 21455:tid 21504] [client 4.188.251.0:15689] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "aXAFdIpOKALCSo1URZFWSAAAAE0"]
[Wed Jan 21 06:45:09.272037 2026] [:error] [pid 21454:tid 21469] [client 4.188.251.0:6133] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXAFdTwp5UZmMFzY2bppWAAAAAU"]
[Wed Jan 21 06:45:09.547690 2026] [:error] [pid 21455:tid 21500] [client 4.188.251.0:6141] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXAFdYpOKALCSo1URZFWSQAAAEk"]
[Wed Jan 21 06:45:09.820304 2026] [:error] [pid 21456:tid 21542] [client 4.188.251.0:15653] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXAFdQKyVQ9Ob2YxRAqYZgAAAJg"]
[Wed Jan 21 06:45:10.091485 2026] [:error] [pid 21455:tid 21514] [client 4.188.251.0:6111] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXAFdopOKALCSo1URZFWSgAAAFc"]
[Wed Jan 21 06:45:10.364526 2026] [:error] [pid 21563:tid 21571] [client 4.188.251.0:6104] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAFdhZq__dTorabEoyvfwAAAMY"]
[Wed Jan 21 06:45:10.637782 2026] [:error] [pid 21563:tid 21584] [client 4.188.251.0:15683] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAFdhZq__dTorabEoyvgAAAANM"]
[Wed Jan 21 06:45:10.914491 2026] [:error] [pid 21455:tid 21502] [client 4.188.251.0:15651] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAFdopOKALCSo1URZFWTgAAAEs"]
[Wed Jan 21 06:45:11.203353 2026] [:error] [pid 21563:tid 21569] [client 4.188.251.0:15659] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAFdxZq__dTorabEoyvggAAAMQ"]
[Wed Jan 21 06:45:11.476233 2026] [:error] [pid 21456:tid 21521] [client 4.188.251.0:15666] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aXAFdwKyVQ9Ob2YxRAqYZwAAAIM"]
[Wed Jan 21 06:45:11.748783 2026] [:error] [pid 21455:tid 21499] [client 4.188.251.0:15705] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aXAFd4pOKALCSo1URZFWUAAAAEg"]
[Wed Jan 21 06:45:12.021542 2026] [:error] [pid 21456:tid 21523] [client 4.188.251.0:15650] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aXAFeAKyVQ9Ob2YxRAqYaAAAAIU"]
[Wed Jan 21 06:45:12.294370 2026] [:error] [pid 59863:tid 59882] [client 4.188.251.0:6085] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aXAFeLHQ1zVZ4yLuI-z5hgAAAQ8"]
[Wed Jan 21 06:45:12.568184 2026] [:error] [pid 21563:tid 21588] [client 4.188.251.0:15670] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aXAFeBZq__dTorabEoyvhwAAANc"]
[Wed Jan 21 06:45:12.839151 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:6050] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aXAFeBZq__dTorabEoyviAAAAMg"]
[Wed Jan 21 06:45:13.111503 2026] [:error] [pid 59863:tid 59879] [client 4.188.251.0:15674] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aXAFebHQ1zVZ4yLuI-z5iAAAAQw"]
[Wed Jan 21 06:45:13.394399 2026] [:error] [pid 21563:tid 21579] [client 4.188.251.0:5969] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aXAFeRZq__dTorabEoyvigAAAM4"]
[Wed Jan 21 06:45:13.668127 2026] [:error] [pid 21563:tid 21567] [client 4.188.251.0:6053] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aXAFeRZq__dTorabEoyviwAAAMI"]
[Wed Jan 21 06:45:13.949974 2026] [:error] [pid 21454:tid 21472] [client 4.188.251.0:6118] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aXAFeTwp5UZmMFzY2bppYgAAAAg"]
[Wed Jan 21 06:45:14.243558 2026] [:error] [pid 21456:tid 21532] [client 4.188.251.0:6071] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aXAFegKyVQ9Ob2YxRAqYagAAAI4"]
[Wed Jan 21 06:45:14.518801 2026] [:error] [pid 21563:tid 21586] [client 4.188.251.0:5962] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aXAFehZq__dTorabEoyvjAAAANU"]
[Wed Jan 21 06:45:14.799172 2026] [:error] [pid 59863:tid 59874] [client 4.188.251.0:6137] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "aXAFerHQ1zVZ4yLuI-z5jAAAAQc"]
[Wed Jan 21 06:45:15.074444 2026] [:error] [pid 21454:tid 21471] [client 4.188.251.0:15654] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "aXAFezwp5UZmMFzY2bppZQAAAAc"]
[Wed Jan 21 06:45:15.358790 2026] [:error] [pid 59863:tid 59877] [client 4.188.251.0:6048] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "aXAFe7HQ1zVZ4yLuI-z5jQAAAQo"]
[Wed Jan 21 06:45:15.631612 2026] [:error] [pid 21455:tid 21495] [client 4.188.251.0:6115] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "aXAFe4pOKALCSo1URZFWUwAAAEQ"]
[Wed Jan 21 06:45:15.903720 2026] [:error] [pid 59863:tid 59868] [client 4.188.251.0:6044] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aXAFe7HQ1zVZ4yLuI-z5kQAAAQE"]
[Wed Jan 21 06:45:16.175560 2026] [:error] [pid 21454:tid 21479] [client 4.188.251.0:6019] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aXAFfDwp5UZmMFzY2bppaQAAAA8"]
[Wed Jan 21 06:45:16.452133 2026] [:error] [pid 21455:tid 21513] [client 4.188.251.0:6139] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aXAFfIpOKALCSo1URZFWVAAAAFY"]
[Wed Jan 21 06:45:16.727680 2026] [:error] [pid 21563:tid 21583] [client 4.188.251.0:5891] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aXAFfBZq__dTorabEoyvjQAAANI"]
[Wed Jan 21 06:45:17.001230 2026] [:error] [pid 21454:tid 21475] [client 4.188.251.0:6117] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFfTwp5UZmMFzY2bppagAAAAs"]
[Wed Jan 21 06:45:17.293310 2026] [:error] [pid 21455:tid 21512] [client 4.188.251.0:15718] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFfYpOKALCSo1URZFWVwAAAFU"]
[Wed Jan 21 06:45:17.569013 2026] [:error] [pid 59863:tid 59884] [client 4.188.251.0:6039] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFfbHQ1zVZ4yLuI-z5kwAAARE"]
[Wed Jan 21 06:45:17.842066 2026] [:error] [pid 21563:tid 21577] [client 4.188.251.0:5954] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFfRZq__dTorabEoyvkAAAAMw"]
[Wed Jan 21 06:45:18.116284 2026] [:error] [pid 21455:tid 21514] [client 4.188.251.0:6018] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aXAFfopOKALCSo1URZFWWAAAAFc"]
[Wed Jan 21 06:45:18.399517 2026] [:error] [pid 21454:tid 21478] [client 4.188.251.0:6132] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aXAFfjwp5UZmMFzY2bppcAAAAA4"]
[Wed Jan 21 06:45:18.675609 2026] [:error] [pid 59863:tid 59888] [client 4.188.251.0:6136] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aXAFfrHQ1zVZ4yLuI-z5lAAAARU"]
[Wed Jan 21 06:45:18.959845 2026] [:error] [pid 59863:tid 59887] [client 4.188.251.0:6084] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "aXAFfrHQ1zVZ4yLuI-z5lgAAARQ"]
[Wed Jan 21 06:45:19.231427 2026] [:error] [pid 21563:tid 21587] [client 4.188.251.0:6051] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aXAFfxZq__dTorabEoyvkgAAANY"]
[Wed Jan 21 06:45:19.560979 2026] [:error] [pid 21454:tid 21470] [client 4.188.251.0:6106] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aXAFfzwp5UZmMFzY2bppcgAAAAY"]
[Wed Jan 21 06:45:19.835984 2026] [:error] [pid 21454:tid 21481] [client 4.188.251.0:6126] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aXAFfzwp5UZmMFzY2bppcwAAABE"]
[Wed Jan 21 06:45:20.111466 2026] [:error] [pid 21455:tid 21502] [client 4.188.251.0:15656] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws35.php"] [unique_id "aXAFgIpOKALCSo1URZFWWQAAAEs"]
[Wed Jan 21 06:45:20.385487 2026] [:error] [pid 21455:tid 21499] [client 4.188.251.0:6140] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aXAFgIpOKALCSo1URZFWWgAAAEg"]
[Wed Jan 21 06:45:20.656208 2026] [:error] [pid 21454:tid 21483] [client 4.188.251.0:6080] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aXAFgDwp5UZmMFzY2bppdgAAABM"]
[Wed Jan 21 06:45:20.926404 2026] [:error] [pid 21454:tid 21467] [client 4.188.251.0:6047] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aXAFgDwp5UZmMFzY2bppeAAAAAM"]
[Wed Jan 21 06:45:21.197580 2026] [:error] [pid 21454:tid 21475] [client 4.188.251.0:15741] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aXAFgTwp5UZmMFzY2bppeQAAAAs"]
[Wed Jan 21 06:45:21.475242 2026] [:error] [pid 59863:tid 59869] [client 4.188.251.0:6113] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aXAFgbHQ1zVZ4yLuI-z5mgAAAQI"]
[Wed Jan 21 06:45:21.752286 2026] [:error] [pid 59863:tid 59889] [client 4.188.251.0:5959] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aXAFgbHQ1zVZ4yLuI-z5mwAAARY"]
[Wed Jan 21 06:45:22.026885 2026] [:error] [pid 21456:tid 21542] [client 4.188.251.0:15696] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aXAFggKyVQ9Ob2YxRAqYbQAAAJg"]
[Wed Jan 21 06:45:22.299211 2026] [:error] [pid 21456:tid 21540] [client 4.188.251.0:5958] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aXAFggKyVQ9Ob2YxRAqYbgAAAJY"]
[Wed Jan 21 06:45:22.578815 2026] [:error] [pid 21563:tid 21579] [client 4.188.251.0:15682] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aXAFghZq__dTorabEoyvlAAAAM4"]
[Wed Jan 21 06:45:22.885162 2026] [:error] [pid 21456:tid 21520] [client 4.188.251.0:6037] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aXAFggKyVQ9Ob2YxRAqYbwAAAII"]
[Wed Jan 21 06:45:23.162833 2026] [:error] [pid 21454:tid 21478] [client 4.188.251.0:5968] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aXAFgzwp5UZmMFzY2bppfQAAAA4"]
[Wed Jan 21 06:45:23.434663 2026] [:error] [pid 21563:tid 21566] [client 4.188.251.0:6087] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "aXAFgxZq__dTorabEoyvlQAAAME"]
[Wed Jan 21 06:45:23.707857 2026] [:error] [pid 21455:tid 21497] [client 4.188.251.0:6076] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aXAFg4pOKALCSo1URZFWXwAAAEY"]
[Wed Jan 21 06:45:23.983118 2026] [:error] [pid 21563:tid 21584] [client 4.188.251.0:6022] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aXAFgxZq__dTorabEoyvlgAAANM"]
[Wed Jan 21 06:45:24.255168 2026] [:error] [pid 59863:tid 59887] [client 4.188.251.0:6061] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aXAFhLHQ1zVZ4yLuI-z5nQAAARQ"]
[Wed Jan 21 06:45:24.526307 2026] [:error] [pid 21454:tid 21470] [client 4.188.251.0:6033] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aXAFhDwp5UZmMFzY2bppfwAAAAY"]
[Wed Jan 21 06:45:24.801013 2026] [:error] [pid 21563:tid 21569] [client 4.188.251.0:6093] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aXAFhBZq__dTorabEoyvmQAAAMQ"]
[Wed Jan 21 06:45:25.075455 2026] [:error] [pid 59863:tid 59885] [client 4.188.251.0:6038] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aXAFhbHQ1zVZ4yLuI-z5nwAAARI"]
[Wed Jan 21 06:45:25.370096 2026] [:error] [pid 59863:tid 59890] [client 4.188.251.0:6016] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aXAFhbHQ1zVZ4yLuI-z5oAAAARc"]
[Wed Jan 21 06:45:25.649176 2026] [:error] [pid 59863:tid 59886] [client 4.188.251.0:6121] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aXAFhbHQ1zVZ4yLuI-z5oQAAARM"]
[Wed Jan 21 06:45:25.928188 2026] [:error] [pid 59863:tid 59876] [client 4.188.251.0:6036] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aXAFhbHQ1zVZ4yLuI-z5ogAAAQk"]
[Wed Jan 21 06:45:26.204097 2026] [:error] [pid 59863:tid 59877] [client 4.188.251.0:5972] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aXAFhrHQ1zVZ4yLuI-z5owAAAQo"]
[Wed Jan 21 06:45:26.497429 2026] [:error] [pid 59863:tid 59873] [client 4.188.251.0:6068] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aXAFhrHQ1zVZ4yLuI-z5pQAAAQY"]
[Wed Jan 21 06:45:26.770308 2026] [:error] [pid 21456:tid 21537] [client 4.188.251.0:6069] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "aXAFhgKyVQ9Ob2YxRAqYcQAAAJM"]
[Wed Jan 21 06:45:27.045743 2026] [:error] [pid 59863:tid 59883] [client 4.188.251.0:5952] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aXAFh7HQ1zVZ4yLuI-z5pwAAARA"]
[Wed Jan 21 06:45:27.326070 2026] [:error] [pid 21563:tid 21576] [client 4.188.251.0:6057] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aXAFhxZq__dTorabEoyvnwAAAMs"]
[Wed Jan 21 06:45:27.642151 2026] [:error] [pid 21563:tid 21582] [client 4.188.251.0:6059] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aXAFhxZq__dTorabEoyvoAAAANE"]
[Wed Jan 21 06:45:27.915917 2026] [:error] [pid 21563:tid 21588] [client 4.188.251.0:15729] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ma.php"] [unique_id "aXAFhxZq__dTorabEoyvoQAAANc"]
[Wed Jan 21 06:45:28.192521 2026] [:error] [pid 59863:tid 59889] [client 4.188.251.0:6046] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aXAFiLHQ1zVZ4yLuI-z5qgAAARY"]
[Wed Jan 21 06:45:28.469665 2026] [:error] [pid 59863:tid 59880] [client 4.188.251.0:6000] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aXAFiLHQ1zVZ4yLuI-z5qwAAAQ0"]
[Wed Jan 21 06:45:28.746623 2026] [:error] [pid 59863:tid 59884] [client 4.188.251.0:6024] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aXAFiLHQ1zVZ4yLuI-z5rAAAARE"]
[Wed Jan 21 06:45:29.017989 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:6027] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "aXAFiRZq__dTorabEoyvogAAAMg"]
[Wed Jan 21 06:45:29.298398 2026] [:error] [pid 21563:tid 21579] [client 4.188.251.0:6130] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aXAFiRZq__dTorabEoyvowAAAM4"]
[Wed Jan 21 06:45:29.603773 2026] [:error] [pid 21563:tid 21566] [client 4.188.251.0:15663] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aXAFiRZq__dTorabEoyvpAAAAME"]
[Wed Jan 21 06:45:29.877671 2026] [:error] [pid 21455:tid 21509] [client 4.188.251.0:15676] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aXAFiYpOKALCSo1URZFWbAAAAFI"]
[Wed Jan 21 06:45:30.151310 2026] [:error] [pid 21563:tid 21584] [client 4.188.251.0:6020] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws29.php"] [unique_id "aXAFihZq__dTorabEoyvpgAAANM"]
[Wed Jan 21 06:45:30.440712 2026] [:error] [pid 21454:tid 21467] [client 4.188.251.0:5987] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1100.php"] [unique_id "aXAFijwp5UZmMFzY2bppgAAAAAM"]
[Wed Jan 21 06:45:30.712625 2026] [:error] [pid 21454:tid 21479] [client 4.188.251.0:15669] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1100.php"] [unique_id "aXAFijwp5UZmMFzY2bppgQAAAA8"]
[Wed Jan 21 06:45:30.988328 2026] [:error] [pid 21563:tid 21578] [client 4.188.251.0:6081] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1100.php"] [unique_id "aXAFihZq__dTorabEoyvpwAAAM0"]
[Wed Jan 21 06:45:31.272590 2026] [:error] [pid 21455:tid 21504] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Wed Jan 21 06:45:31.412696 2026] [:error] [pid 21455:tid 21515] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/ws46.php
[Wed Jan 21 06:45:31.552340 2026] [:error] [pid 21455:tid 21512] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/ws43.php
[Wed Jan 21 06:45:31.692711 2026] [:error] [pid 21455:tid 21514] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/ws36.php
[Wed Jan 21 06:45:31.832930 2026] [:error] [pid 21455:tid 21496] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/ws34.php
[Wed Jan 21 06:45:31.973579 2026] [:error] [pid 21455:tid 21492] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Wed Jan 21 06:45:32.114335 2026] [:error] [pid 21455:tid 21491] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Jan 21 06:45:32.258395 2026] [:error] [pid 21455:tid 21502] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Wed Jan 21 06:45:32.398534 2026] [:error] [pid 21455:tid 21506] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/blox.php
[Wed Jan 21 06:45:32.538458 2026] [:error] [pid 21455:tid 21503] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Wed Jan 21 06:45:32.678488 2026] [:error] [pid 21455:tid 21499] [client 4.188.251.0:6092] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Wed Jan 21 06:45:32.814980 2026] [:error] [pid 21455:tid 21507] [client 4.188.251.0:6092] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aXAFjIpOKALCSo1URZFWfAAAAFA"]
[Wed Jan 21 06:45:33.102543 2026] [:error] [pid 59863:tid 59891] [client 4.188.251.0:5984] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aXAFjbHQ1zVZ4yLuI-z5sgAAARg"]
[Wed Jan 21 06:45:33.391464 2026] [:error] [pid 21563:tid 21572] [client 4.188.251.0:6122] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aXAFjRZq__dTorabEoyvqQAAAMc"]
[Wed Jan 21 06:45:33.663780 2026] [:error] [pid 21456:tid 21538] [client 4.188.251.0:5953] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pn.php"] [unique_id "aXAFjQKyVQ9Ob2YxRAqYeQAAAJQ"]
[Wed Jan 21 06:45:33.936104 2026] [:error] [pid 21454:tid 21488] [client 4.188.251.0:5999] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aXAFjTwp5UZmMFzY2bpphAAAABg"]
[Wed Jan 21 06:45:34.225264 2026] [:error] [pid 21456:tid 21540] [client 4.188.251.0:6029] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aXAFjgKyVQ9Ob2YxRAqYegAAAJY"]
[Wed Jan 21 06:45:34.500910 2026] [:error] [pid 21456:tid 21520] [client 4.188.251.0:6143] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aXAFjgKyVQ9Ob2YxRAqYfAAAAII"]
[Wed Jan 21 06:45:34.776392 2026] [:error] [pid 21563:tid 21577] [client 4.188.251.0:6075] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aXAFjhZq__dTorabEoyvqwAAAMw"]
[Wed Jan 21 06:45:35.051726 2026] [:error] [pid 21455:tid 21498] [client 4.188.251.0:15649] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/smklh.php"] [unique_id "aXAFj4pOKALCSo1URZFWfwAAAEc"]
[Wed Jan 21 06:45:35.323991 2026] [:error] [pid 21454:tid 21466] [client 4.188.251.0:6072] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/smklh.php"] [unique_id "aXAFjzwp5UZmMFzY2bpphgAAAAI"]
[Wed Jan 21 06:45:35.606439 2026] [:error] [pid 21456:tid 21528] [client 4.188.251.0:5989] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/smklh.php"] [unique_id "aXAFjwKyVQ9Ob2YxRAqYfgAAAIo"]
[Wed Jan 21 06:45:35.888700 2026] [:error] [pid 21456:tid 21529] [client 4.188.251.0:6065] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/smklh.php"] [unique_id "aXAFjwKyVQ9Ob2YxRAqYfwAAAIs"]
[Wed Jan 21 06:45:36.159412 2026] [:error] [pid 21456:tid 21522] [client 4.188.251.0:15660] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aXAFkAKyVQ9Ob2YxRAqYgAAAAIQ"]
[Wed Jan 21 06:45:36.434018 2026] [:error] [pid 21456:tid 21518] [client 4.188.251.0:15709] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aXAFkAKyVQ9Ob2YxRAqYgQAAAIA"]
[Wed Jan 21 06:45:36.713313 2026] [:error] [pid 21454:tid 21474] [client 4.188.251.0:6032] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aXAFkDwp5UZmMFzY2bppiAAAAAo"]
[Wed Jan 21 06:45:36.983655 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:5976] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aXAFkBZq__dTorabEoyvsAAAAMg"]
[Wed Jan 21 06:45:37.262585 2026] [:error] [pid 21563:tid 21579] [client 4.188.251.0:5978] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/horeg.php"] [unique_id "aXAFkRZq__dTorabEoyvsQAAAM4"]
[Wed Jan 21 06:45:37.536629 2026] [:error] [pid 21456:tid 21521] [client 4.188.251.0:5934] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/horeg.php"] [unique_id "aXAFkQKyVQ9Ob2YxRAqYgwAAAIM"]
[Wed Jan 21 06:45:37.821599 2026] [:error] [pid 21456:tid 21525] [client 4.188.251.0:6055] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/horeg.php"] [unique_id "aXAFkQKyVQ9Ob2YxRAqYhAAAAIc"]
[Wed Jan 21 06:45:38.096397 2026] [:error] [pid 21456:tid 21532] [client 4.188.251.0:15672] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/horeg.php"] [unique_id "aXAFkgKyVQ9Ob2YxRAqYhQAAAI4"]
[Wed Jan 21 06:45:38.369233 2026] [:error] [pid 21456:tid 21536] [client 4.188.251.0:5957] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aXAFkgKyVQ9Ob2YxRAqYhwAAAJI"]
[Wed Jan 21 06:45:38.649361 2026] [:error] [pid 21454:tid 21485] [client 4.188.251.0:6112] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aXAFkjwp5UZmMFzY2bppjgAAABU"]
[Wed Jan 21 06:45:38.922091 2026] [:error] [pid 21456:tid 21526] [client 4.188.251.0:6052] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aXAFkgKyVQ9Ob2YxRAqYiAAAAIg"]
[Wed Jan 21 06:45:39.200043 2026] [:error] [pid 21456:tid 21534] [client 4.188.251.0:6034] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aXAFkwKyVQ9Ob2YxRAqYiQAAAJA"]
[Wed Jan 21 06:45:39.471307 2026] [:error] [pid 21456:tid 21538] [client 4.188.251.0:6060] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aXAFkwKyVQ9Ob2YxRAqYigAAAJQ"]
[Wed Jan 21 06:45:39.741750 2026] [:error] [pid 21454:tid 21475] [client 4.188.251.0:6108] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aXAFkzwp5UZmMFzY2bppkwAAAAs"]
[Wed Jan 21 06:45:40.016633 2026] [:error] [pid 21563:tid 21565] [client 4.188.251.0:6078] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aXAFlBZq__dTorabEoyvuwAAAMA"]
[Wed Jan 21 06:45:40.313385 2026] [:error] [pid 21563:tid 21585] [client 4.188.251.0:6077] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aXAFlBZq__dTorabEoyvvwAAANQ"]
[Wed Jan 21 06:45:40.586687 2026] [:error] [pid 21454:tid 21477] [client 4.188.251.0:6063] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aXAFlDwp5UZmMFzY2bppmAAAAA0"]
[Wed Jan 21 06:45:40.869781 2026] [:error] [pid 21454:tid 21474] [client 4.188.251.0:6054] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aXAFlDwp5UZmMFzY2bppmgAAAAo"]
[Wed Jan 21 06:45:41.146692 2026] [:error] [pid 21455:tid 21499] [client 4.188.251.0:5899] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aXAFlYpOKALCSo1URZFWgQAAAEg"]
[Wed Jan 21 06:45:41.421299 2026] [:error] [pid 21563:tid 21566] [client 4.188.251.0:5955] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aXAFlRZq__dTorabEoyvwQAAAME"]
[Wed Jan 21 06:45:41.701511 2026] [:error] [pid 21455:tid 21507] [client 4.188.251.0:6006] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aXAFlYpOKALCSo1URZFWggAAAFA"]
[Wed Jan 21 06:45:41.977058 2026] [:error] [pid 21455:tid 21511] [client 4.188.251.0:6129] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aXAFlYpOKALCSo1URZFWgwAAAFQ"]
[Wed Jan 21 06:45:42.254098 2026] [:error] [pid 21455:tid 21505] [client 4.188.251.0:6067] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aXAFlopOKALCSo1URZFWhAAAAE4"]
[Wed Jan 21 06:45:42.532969 2026] [:error] [pid 21563:tid 21578] [client 4.188.251.0:6131] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aXAFlhZq__dTorabEoyvxgAAAM0"]
[Wed Jan 21 06:45:42.803439 2026] [:error] [pid 59863:tid 59886] [client 4.188.251.0:5967] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aXAFlrHQ1zVZ4yLuI-z5ugAAARM"]
[Wed Jan 21 06:45:43.080777 2026] [:error] [pid 21563:tid 21570] [client 4.188.251.0:6125] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aXAFlxZq__dTorabEoyvxwAAAMU"]
[Wed Jan 21 06:45:43.356379 2026] [:error] [pid 21455:tid 21493] [client 4.188.251.0:5965] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aXAFl4pOKALCSo1URZFWhQAAAEI"]
[Wed Jan 21 06:45:43.643288 2026] [:error] [pid 59863:tid 59873] [client 4.188.251.0:6043] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aXAFl7HQ1zVZ4yLuI-z5vQAAAQY"]
[Wed Jan 21 06:45:43.921242 2026] [:error] [pid 21455:tid 21513] [client 4.188.251.0:6066] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aXAFl4pOKALCSo1URZFWhgAAAFY"]
[Wed Jan 21 06:45:44.196013 2026] [:error] [pid 21456:tid 21525] [client 4.188.251.0:6012] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aXAFmAKyVQ9Ob2YxRAqYqwAAAIc"]
[Wed Jan 21 06:45:44.471047 2026] [:error] [pid 59863:tid 59883] [client 4.188.251.0:5905] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aXAFmLHQ1zVZ4yLuI-z5vwAAARA"]
[Wed Jan 21 06:45:44.742939 2026] [:error] [pid 21563:tid 21575] [client 4.188.251.0:6017] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aXAFmBZq__dTorabEoyvyAAAAMo"]
[Wed Jan 21 06:45:45.033938 2026] [:error] [pid 21456:tid 21540] [client 4.188.251.0:5988] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aXAFmQKyVQ9Ob2YxRAqYswAAAJY"]
[Wed Jan 21 06:45:45.312252 2026] [:error] [pid 21456:tid 21542] [client 4.188.251.0:15684] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aXAFmQKyVQ9Ob2YxRAqYtwAAAJg"]
[Wed Jan 21 06:45:45.593566 2026] [:error] [pid 21455:tid 21494] [client 4.188.251.0:6010] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aXAFmYpOKALCSo1URZFWhwAAAEM"]
[Wed Jan 21 06:45:45.875521 2026] [:error] [pid 21563:tid 21572] [client 4.188.251.0:5975] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aXAFmRZq__dTorabEoyvyQAAAMc"]
[Wed Jan 21 06:45:46.157525 2026] [:error] [pid 21563:tid 21565] [client 4.188.251.0:6031] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aXAFmhZq__dTorabEoyvygAAAMA"]
[Wed Jan 21 06:45:46.428837 2026] [:error] [pid 59863:tid 59870] [client 4.188.251.0:5992] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aXAFmrHQ1zVZ4yLuI-z5wQAAAQM"]
[Wed Jan 21 06:45:46.701470 2026] [:error] [pid 21455:tid 21508] [client 4.188.251.0:5896] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aXAFmopOKALCSo1URZFWiAAAAFE"]
[Wed Jan 21 06:45:46.975662 2026] [:error] [pid 21563:tid 21576] [client 4.188.251.0:6040] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aXAFmhZq__dTorabEoyvywAAAMs"]
[Wed Jan 21 06:45:47.255271 2026] [:error] [pid 21563:tid 21582] [client 4.188.251.0:5920] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws46.php"] [unique_id "aXAFmxZq__dTorabEoyvzAAAANE"]
[Wed Jan 21 06:45:47.546935 2026] [:error] [pid 21455:tid 21497] [client 4.188.251.0:6009] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws46.php"] [unique_id "aXAFm4pOKALCSo1URZFWiQAAAEY"]
[Wed Jan 21 06:45:47.823101 2026] [:error] [pid 21456:tid 21536] [client 4.188.251.0:6056] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws46.php"] [unique_id "aXAFmwKyVQ9Ob2YxRAqYwwAAAJI"]
[Wed Jan 21 06:45:48.098670 2026] [:error] [pid 21455:tid 21495] [client 4.188.251.0:6073] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws46.php"] [unique_id "aXAFnIpOKALCSo1URZFWiwAAAEQ"]
[Wed Jan 21 06:45:48.372455 2026] [:error] [pid 21456:tid 21523] [client 4.188.251.0:6045] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aXAFnAKyVQ9Ob2YxRAqYxAAAAIU"]
[Wed Jan 21 06:45:48.644725 2026] [:error] [pid 21455:tid 21498] [client 4.188.251.0:6058] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aXAFnIpOKALCSo1URZFWjAAAAEc"]
[Wed Jan 21 06:45:48.918153 2026] [:error] [pid 21563:tid 21567] [client 4.188.251.0:5973] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aXAFnBZq__dTorabEoyvzgAAAMI"]
[Wed Jan 21 06:45:49.190433 2026] [:error] [pid 21563:tid 21587] [client 4.188.251.0:5956] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "aXAFnRZq__dTorabEoyvzwAAANY"]
[Wed Jan 21 06:45:49.467981 2026] [:error] [pid 21455:tid 21501] [client 4.188.251.0:5961] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aXAFnYpOKALCSo1URZFWjQAAAEo"]
[Wed Jan 21 06:45:49.741422 2026] [:error] [pid 21455:tid 21504] [client 4.188.251.0:5985] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aXAFnYpOKALCSo1URZFWjgAAAE0"]
[Wed Jan 21 06:45:50.014720 2026] [:error] [pid 21456:tid 21538] [client 4.188.251.0:5924] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aXAFngKyVQ9Ob2YxRAqYxgAAAJQ"]
[Wed Jan 21 06:45:50.286145 2026] [:error] [pid 21456:tid 21519] [client 4.188.251.0:6138] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aXAFngKyVQ9Ob2YxRAqYxwAAAIE"]
[Wed Jan 21 06:45:50.560645 2026] [:error] [pid 21455:tid 21515] [client 4.188.251.0:5888] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAFnopOKALCSo1URZFWjwAAAFg"]
[Wed Jan 21 06:45:50.837160 2026] [:error] [pid 21456:tid 21542] [client 4.188.251.0:5993] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAFngKyVQ9Ob2YxRAqYyAAAAJg"]
[Wed Jan 21 06:45:51.143988 2026] [:error] [pid 21455:tid 21514] [client 4.188.251.0:5995] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAFn4pOKALCSo1URZFWkQAAAFc"]
[Wed Jan 21 06:45:51.425149 2026] [:error] [pid 21455:tid 21496] [client 4.188.251.0:6074] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAFn4pOKALCSo1URZFWkgAAAEU"]
[Wed Jan 21 06:45:51.699538 2026] [:error] [pid 21456:tid 21539] [client 4.188.251.0:5844] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFnwKyVQ9Ob2YxRAqYyQAAAJU"]
[Wed Jan 21 06:45:51.973403 2026] [:error] [pid 21454:tid 21467] [client 4.188.251.0:15648] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFnzwp5UZmMFzY2bppnwAAAAM"]
[Wed Jan 21 06:45:52.254374 2026] [:error] [pid 21455:tid 21492] [client 4.188.251.0:15694] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFoIpOKALCSo1URZFWkwAAAEE"]
[Wed Jan 21 06:45:52.530412 2026] [:error] [pid 21456:tid 21518] [client 4.188.251.0:6127] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aXAFoAKyVQ9Ob2YxRAqYywAAAIA"]
[Wed Jan 21 06:45:52.806866 2026] [:error] [pid 21454:tid 21482] [client 4.188.251.0:5900] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aXAFoDwp5UZmMFzY2bppoAAAABI"]
[Wed Jan 21 06:45:53.085018 2026] [:error] [pid 21454:tid 21475] [client 4.188.251.0:6041] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aXAFoTwp5UZmMFzY2bppoQAAAAs"]
[Wed Jan 21 06:45:53.385004 2026] [:error] [pid 21456:tid 21532] [client 4.188.251.0:15695] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aXAFoQKyVQ9Ob2YxRAqYzAAAAI4"]
[Wed Jan 21 06:45:53.660281 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:6142] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ana.php"] [unique_id "aXAFoRZq__dTorabEoyv0QAAAMg"]
[Wed Jan 21 06:45:53.937267 2026] [:error] [pid 59863:tid 59883] [client 4.188.251.0:6105] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aXAFobHQ1zVZ4yLuI-z5yQAAARA"]
[Wed Jan 21 06:45:54.210488 2026] [:error] [pid 21456:tid 21526] [client 4.188.251.0:5971] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aXAFogKyVQ9Ob2YxRAqY1QAAAIg"]
[Wed Jan 21 06:45:54.493596 2026] [:error] [pid 21454:tid 21483] [client 4.188.251.0:5996] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aXAFojwp5UZmMFzY2bppogAAABM"]
[Wed Jan 21 06:45:54.768203 2026] [:error] [pid 21454:tid 21488] [client 4.188.251.0:5994] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aXAFojwp5UZmMFzY2bppowAAABg"]
[Wed Jan 21 06:45:55.044949 2026] [:error] [pid 21563:tid 21589] [client 4.188.251.0:5906] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFoxZq__dTorabEoyv0wAAANg"]
[Wed Jan 21 06:45:55.330689 2026] [:error] [pid 59863:tid 59869] [client 4.188.251.0:5926] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFo7HQ1zVZ4yLuI-z5ywAAAQI"]
[Wed Jan 21 06:45:55.614496 2026] [:error] [pid 59863:tid 59872] [client 4.188.251.0:5910] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFo7HQ1zVZ4yLuI-z5zAAAAQU"]
[Wed Jan 21 06:45:55.888081 2026] [:error] [pid 21454:tid 21464] [client 4.188.251.0:5894] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/87.php"] [unique_id "aXAFozwp5UZmMFzY2bpppAAAAAA"]
[Wed Jan 21 06:45:56.163427 2026] [:error] [pid 21454:tid 21477] [client 4.188.251.0:5889] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aXAFpDwp5UZmMFzY2bpppgAAAA0"]
[Wed Jan 21 06:45:56.434500 2026] [:error] [pid 21454:tid 21474] [client 4.188.251.0:6134] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aXAFpDwp5UZmMFzY2bpppwAAAAo"]
[Wed Jan 21 06:45:56.722809 2026] [:error] [pid 21563:tid 21578] [client 4.188.251.0:5977] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aXAFpBZq__dTorabEoyv1QAAAM0"]
[Wed Jan 21 06:45:56.996181 2026] [:error] [pid 21454:tid 21473] [client 4.188.251.0:6079] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aXAFpDwp5UZmMFzY2bppqAAAAAk"]
[Wed Jan 21 06:45:57.267613 2026] [:error] [pid 21454:tid 21487] [client 4.188.251.0:5903] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aXAFpTwp5UZmMFzY2bppqQAAABc"]
[Wed Jan 21 06:45:57.538960 2026] [:error] [pid 21456:tid 21529] [client 4.188.251.0:6008] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aXAFpQKyVQ9Ob2YxRAqY8AAAAIs"]
[Wed Jan 21 06:45:57.835367 2026] [:error] [pid 21454:tid 21478] [client 4.188.251.0:5893] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aXAFpTwp5UZmMFzY2bppqwAAAA4"]
[Wed Jan 21 06:45:58.115122 2026] [:error] [pid 21455:tid 21510] [client 4.188.251.0:5912] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redi.php"] [unique_id "aXAFpopOKALCSo1URZFWlgAAAFM"]
[Wed Jan 21 06:45:58.387924 2026] [:error] [pid 21456:tid 21525] [client 4.188.251.0:5921] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aXAFpgKyVQ9Ob2YxRAqY-QAAAIc"]
[Wed Jan 21 06:45:58.661586 2026] [:error] [pid 21455:tid 21511] [client 4.188.251.0:5986] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aXAFpopOKALCSo1URZFWmAAAAFQ"]
[Wed Jan 21 06:45:58.936943 2026] [:error] [pid 21455:tid 21505] [client 4.188.251.0:5901] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aXAFpopOKALCSo1URZFWmQAAAE4"]
[Wed Jan 21 06:45:59.210305 2026] [:error] [pid 21455:tid 21513] [client 4.188.251.0:5892] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aXAFp4pOKALCSo1URZFWmgAAAFY"]
[Wed Jan 21 06:45:59.502351 2026] [:error] [pid 21455:tid 21494] [client 4.188.251.0:5970] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aXAFp4pOKALCSo1URZFWmwAAAEM"]
[Wed Jan 21 06:45:59.774459 2026] [:error] [pid 21455:tid 21508] [client 4.188.251.0:6028] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aXAFp4pOKALCSo1URZFWnQAAAFE"]
[Wed Jan 21 06:46:00.055284 2026] [:error] [pid 21456:tid 21529] [client 4.188.251.0:15671] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aXAFqAKyVQ9Ob2YxRAqZCAAAAIs"]
[Wed Jan 21 06:46:00.326694 2026] [:error] [pid 21563:tid 21575] [client 4.188.251.0:5983] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aXAFqBZq__dTorabEoyv2QAAAMo"]
[Wed Jan 21 06:46:00.601833 2026] [:error] [pid 59863:tid 59879] [client 4.188.251.0:5942] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aXAFqLHQ1zVZ4yLuI-z50AAAAQw"]
[Wed Jan 21 06:46:00.885280 2026] [:error] [pid 21454:tid 21470] [client 4.188.251.0:5933] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aXAFqDwp5UZmMFzY2bpprAAAAAY"]
[Wed Jan 21 06:46:01.160515 2026] [:error] [pid 59863:tid 59881] [client 4.188.251.0:5897] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aXAFqbHQ1zVZ4yLuI-z50QAAAQ4"]
[Wed Jan 21 06:46:01.432408 2026] [:error] [pid 21454:tid 21485] [client 4.188.251.0:5917] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aXAFqTwp5UZmMFzY2bpprQAAABU"]
[Wed Jan 21 06:46:01.707204 2026] [:error] [pid 21563:tid 21572] [client 4.188.251.0:5941] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aXAFqRZq__dTorabEoyv2gAAAMc"]
[Wed Jan 21 06:46:01.979280 2026] [:error] [pid 21455:tid 21498] [client 4.188.251.0:6013] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aXAFqYpOKALCSo1URZFWngAAAEc"]
[Wed Jan 21 06:46:02.251811 2026] [:error] [pid 21563:tid 21565] [client 4.188.251.0:5918] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aXAFqhZq__dTorabEoyv2wAAAMA"]
[Wed Jan 21 06:46:02.527617 2026] [:error] [pid 21563:tid 21577] [client 4.188.251.0:6004] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/indo.php"] [unique_id "aXAFqhZq__dTorabEoyv3AAAAMw"]
[Wed Jan 21 06:46:02.806252 2026] [:error] [pid 21455:tid 21501] [client 4.188.251.0:5982] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xx.php"] [unique_id "aXAFqopOKALCSo1URZFWnwAAAEo"]
[Wed Jan 21 06:46:03.078660 2026] [:error] [pid 21455:tid 21504] [client 4.188.251.0:5916] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xx.php"] [unique_id "aXAFq4pOKALCSo1URZFWoAAAAE0"]
[Wed Jan 21 06:46:03.349455 2026] [:error] [pid 21454:tid 21471] [client 4.188.251.0:5841] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xx.php"] [unique_id "aXAFqzwp5UZmMFzY2bpprwAAAAc"]
[Wed Jan 21 06:46:03.622870 2026] [:error] [pid 21455:tid 21512] [client 4.188.251.0:6062] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0xx.php"] [unique_id "aXAFq4pOKALCSo1URZFWoQAAAFU"]
[Wed Jan 21 06:46:03.901026 2026] [:error] [pid 21563:tid 21582] [client 4.188.251.0:5907] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "aXAFqxZq__dTorabEoyv3QAAANE"]
[Wed Jan 21 06:46:04.176985 2026] [:error] [pid 21455:tid 21500] [client 4.188.251.0:5880] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "aXAFrIpOKALCSo1URZFWowAAAEk"]
[Wed Jan 21 06:46:04.450105 2026] [:error] [pid 21563:tid 21580] [client 4.188.251.0:6082] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "aXAFrBZq__dTorabEoyv3gAAAM8"]
[Wed Jan 21 06:46:04.724402 2026] [:error] [pid 21454:tid 21469] [client 4.188.251.0:6005] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "aXAFrDwp5UZmMFzY2bppsAAAAAU"]
[Wed Jan 21 06:46:05.021848 2026] [:error] [pid 21455:tid 21509] [client 4.188.251.0:6001] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aXAFrYpOKALCSo1URZFWpAAAAFI"]
[Wed Jan 21 06:46:05.294799 2026] [:error] [pid 21455:tid 21514] [client 4.188.251.0:5974] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aXAFrYpOKALCSo1URZFWpQAAAFc"]
[Wed Jan 21 06:46:05.566087 2026] [:error] [pid 21454:tid 21480] [client 4.188.251.0:5895] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aXAFrTwp5UZmMFzY2bppsQAAABA"]
[Wed Jan 21 06:46:05.870635 2026] [:error] [pid 21563:tid 21588] [client 4.188.251.0:5939] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aXAFrRZq__dTorabEoyv4AAAANc"]
[Wed Jan 21 06:46:06.145229 2026] [:error] [pid 21454:tid 21479] [client 4.188.251.0:5946] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aXAFrjwp5UZmMFzY2bppsgAAAA8"]
[Wed Jan 21 06:46:06.438601 2026] [:error] [pid 21563:tid 21566] [client 4.188.251.0:6014] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aXAFrhZq__dTorabEoyv4QAAAME"]
[Wed Jan 21 06:46:06.718926 2026] [:error] [pid 21455:tid 21492] [client 4.188.251.0:5832] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aXAFropOKALCSo1URZFWpgAAAEE"]
[Wed Jan 21 06:46:07.001865 2026] [:error] [pid 21454:tid 21484] [client 4.188.251.0:5834] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aXAFrzwp5UZmMFzY2bppswAAABQ"]
[Wed Jan 21 06:46:07.297512 2026] [:error] [pid 21454:tid 21467] [client 4.188.251.0:5784] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aXAFrzwp5UZmMFzY2bpptAAAAAM"]
[Wed Jan 21 06:46:07.575489 2026] [:error] [pid 21456:tid 21538] [client 4.188.251.0:5824] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aXAFrwKyVQ9Ob2YxRAqZGQAAAJQ"]
[Wed Jan 21 06:46:07.848251 2026] [:error] [pid 21563:tid 21587] [client 4.188.251.0:6123] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aXAFrxZq__dTorabEoyv4wAAANY"]
[Wed Jan 21 06:46:08.138342 2026] [:error] [pid 59863:tid 59874] [client 4.188.251.0:5840] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aXAFsLHQ1zVZ4yLuI-z50wAAAQc"]
[Wed Jan 21 06:46:08.414032 2026] [:error] [pid 21563:tid 21569] [client 4.188.251.0:5966] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aXAFsBZq__dTorabEoyv5wAAAMQ"]
[Wed Jan 21 06:46:08.686819 2026] [:error] [pid 21455:tid 21505] [client 4.188.251.0:5908] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aXAFsIpOKALCSo1URZFWrQAAAE4"]
[Wed Jan 21 06:46:08.963011 2026] [:error] [pid 59863:tid 59883] [client 4.188.251.0:5833] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aXAFsLHQ1zVZ4yLuI-z52QAAARA"]
[Wed Jan 21 06:46:09.236446 2026] [:error] [pid 59863:tid 59872] [client 4.188.251.0:5980] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aXAFsbHQ1zVZ4yLuI-z53AAAAQU"]
[Wed Jan 21 06:46:09.528355 2026] [:error] [pid 21454:tid 21475] [client 4.188.251.0:6015] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aXAFsTwp5UZmMFzY2bpptgAAAAs"]
[Wed Jan 21 06:46:09.806292 2026] [:error] [pid 59863:tid 59868] [client 4.188.251.0:5960] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aXAFsbHQ1zVZ4yLuI-z54gAAAQE"]
[Wed Jan 21 06:46:10.082737 2026] [:error] [pid 21455:tid 21497] [client 4.188.251.0:5911] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aXAFsopOKALCSo1URZFWsgAAAEY"]
[Wed Jan 21 06:46:10.358965 2026] [:error] [pid 21456:tid 21528] [client 4.188.251.0:5991] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aXAFsgKyVQ9Ob2YxRAqZHQAAAIo"]
[Wed Jan 21 06:46:10.635344 2026] [:error] [pid 21456:tid 21529] [client 4.188.251.0:6003] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aXAFsgKyVQ9Ob2YxRAqZHgAAAIs"]
[Wed Jan 21 06:46:10.905038 2026] [:error] [pid 59863:tid 59890] [client 4.188.251.0:5884] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aXAFsrHQ1zVZ4yLuI-z56AAAARc"]
[Wed Jan 21 06:46:11.186457 2026] [:error] [pid 59863:tid 59886] [client 4.188.251.0:5960] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aXAFs7HQ1zVZ4yLuI-z57AAAARM"]
[Wed Jan 21 06:46:11.461402 2026] [:error] [pid 21563:tid 21566] [client 4.188.251.0:5925] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configs.php"] [unique_id "aXAFsxZq__dTorabEoyv9QAAAME"]
[Wed Jan 21 06:46:11.733811 2026] [:error] [pid 21456:tid 21539] [client 4.188.251.0:5865] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aXAFswKyVQ9Ob2YxRAqZIQAAAJU"]
[Wed Jan 21 06:46:12.034872 2026] [:error] [pid 21456:tid 21530] [client 4.188.251.0:5913] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aXAFtAKyVQ9Ob2YxRAqZIwAAAIw"]
[Wed Jan 21 06:46:12.308162 2026] [:error] [pid 21456:tid 21533] [client 4.188.251.0:5830] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aXAFtAKyVQ9Ob2YxRAqZJAAAAI8"]
[Wed Jan 21 06:46:12.579515 2026] [:error] [pid 21563:tid 21573] [client 4.188.251.0:5964] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aXAFtBZq__dTorabEoyv9wAAAMg"]
[Wed Jan 21 06:46:12.862545 2026] [:error] [pid 21456:tid 21521] [client 4.188.251.0:5928] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aXAFtAKyVQ9Ob2YxRAqZJgAAAIM"]
[Wed Jan 21 06:46:13.138542 2026] [:error] [pid 21456:tid 21518] [client 4.188.251.0:5963] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aXAFtQKyVQ9Ob2YxRAqZJwAAAIA"]
[Wed Jan 21 06:46:13.416425 2026] [:error] [pid 21456:tid 21525] [client 4.188.251.0:6002] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aXAFtQKyVQ9Ob2YxRAqZKAAAAIc"]
[Wed Jan 21 06:46:13.689589 2026] [:error] [pid 59863:tid 59891] [client 4.188.251.0:5850] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "aXAFtbHQ1zVZ4yLuI-z57QAAARg"]
[Wed Jan 21 06:46:13.965258 2026] [:error] [pid 21563:tid 21589] [client 4.188.251.0:5858] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aXAFtRZq__dTorabEoyv-QAAANg"]
[Wed Jan 21 06:46:14.236940 2026] [:error] [pid 21456:tid 21532] [client 4.188.251.0:5831] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aXAFtgKyVQ9Ob2YxRAqZKgAAAI4"]
[Wed Jan 21 06:46:14.510798 2026] [:error] [pid 21456:tid 21524] [client 4.188.251.0:5863] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aXAFtgKyVQ9Ob2YxRAqZKwAAAIY"]
[Wed Jan 21 06:46:14.785061 2026] [:error] [pid 21454:tid 21488] [client 4.188.251.0:5829] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "aXAFtjwp5UZmMFzY2bpptwAAABg"]
[Wed Jan 21 06:46:15.058266 2026] [:error] [pid 21563:tid 21585] [client 4.188.251.0:5828] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aXAFtxZq__dTorabEoyv-wAAANQ"]
[Wed Jan 21 06:46:15.333888 2026] [:error] [pid 21563:tid 21578] [client 4.188.251.0:5838] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aXAFtxZq__dTorabEoyv_AAAAM0"]
[Wed Jan 21 06:46:15.617887 2026] [:error] [pid 21563:tid 21568] [client 4.188.251.0:5898] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aXAFtxZq__dTorabEoyv_QAAAMM"]
[Wed Jan 21 06:46:15.892067 2026] [:error] [pid 21456:tid 21523] [client 4.188.251.0:5929] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "aXAFtwKyVQ9Ob2YxRAqZLQAAAIU"]
[Wed Jan 21 06:46:16.169433 2026] [:error] [pid 21454:tid 21464] [client 4.188.251.0:5825] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aXAFuDwp5UZmMFzY2bppuAAAAAA"]
[Wed Jan 21 06:46:16.454444 2026] [:error] [pid 21456:tid 21535] [client 4.188.251.0:5883] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aXAFuAKyVQ9Ob2YxRAqZLgAAAJE"]
[Wed Jan 21 06:46:16.727774 2026] [:error] [pid 21455:tid 21492] [client 4.188.251.0:5873] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aXAFuIpOKALCSo1URZFWugAAAEE"]
[Wed Jan 21 06:46:17.003426 2026] [:error] [pid 21454:tid 21477] [client 4.188.251.0:5879] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "aXAFuTwp5UZmMFzY2bppuQAAAA0"]
[Wed Jan 21 06:46:17.276141 2026] [:error] [pid 21456:tid 21538] [client 4.188.251.0:6011] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aXAFuQKyVQ9Ob2YxRAqZLwAAAJQ"]
[Wed Jan 21 06:46:17.559852 2026] [:error] [pid 21456:tid 21519] [client 4.188.251.0:5827] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aXAFuQKyVQ9Ob2YxRAqZMQAAAIE"]
[Wed Jan 21 06:46:17.835473 2026] [:error] [pid 21454:tid 21474] [client 4.188.251.0:5902] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aXAFuTwp5UZmMFzY2bppugAAAAo"]
[Wed Jan 21 06:46:18.111299 2026] [:error] [pid 59863:tid 59882] [client 4.188.251.0:5940] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aXAFurHQ1zVZ4yLuI-z57wAAAQ8"]
[Wed Jan 21 06:46:18.387155 2026] [:error] [pid 21563:tid 21575] [client 4.188.251.0:5993] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aXAFuhZq__dTorabEoyv_wAAAMo"]
[Wed Jan 21 06:46:18.659637 2026] [:error] [pid 21563:tid 21583] [client 4.188.251.0:5864] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aXAFuhZq__dTorabEoywAQAAANI"]
[Wed Jan 21 06:46:18.934283 2026] [:error] [pid 21456:tid 21534] [client 4.188.251.0:5930] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aXAFugKyVQ9Ob2YxRAqZMgAAAJA"]
[Wed Jan 21 06:46:19.214110 2026] [:error] [pid 21455:tid 21502] [client 4.188.251.0:5945] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webix.php"] [unique_id "aXAFu4pOKALCSo1URZFWuwAAAEs"]
[Wed Jan 21 06:46:19.489338 2026] [:error] [pid 21454:tid 21473] [client 4.188.251.0:5781] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aXAFuzwp5UZmMFzY2bppuwAAAAk"]
[Wed Jan 21 06:46:19.764907 2026] [:error] [pid 59863:tid 59889] [client 4.188.251.0:5846] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aXAFu7HQ1zVZ4yLuI-z58AAAARY"]
[Wed Jan 21 06:46:20.037765 2026] [:error] [pid 21454:tid 21487] [client 4.188.251.0:5904] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aXAFvDwp5UZmMFzY2bppvAAAABc"]
[Wed Jan 21 06:46:20.315598 2026] [:error] [pid 21563:tid 21576] [client 4.188.251.0:5998] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "aXAFvBZq__dTorabEoywAwAAAMs"]
[Wed Jan 21 06:46:20.601511 2026] [:error] [pid 21563:tid 21570] [client 4.188.251.0:5867] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aXAFvBZq__dTorabEoywBAAAAMU"]
[Wed Jan 21 06:46:20.881452 2026] [:error] [pid 21454:tid 21486] [client 4.188.251.0:5949] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aXAFvDwp5UZmMFzY2bppvQAAABY"]
[Wed Jan 21 06:46:21.181301 2026] [:error] [pid 21454:tid 21476] [client 4.188.251.0:5878] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aXAFvTwp5UZmMFzY2bppwAAAAAw"]
[Wed Jan 21 06:46:21.454245 2026] [:error] [pid 21456:tid 21533] [client 4.188.251.0:5944] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hans.php"] [unique_id "aXAFvQKyVQ9Ob2YxRAqZOQAAAI8"]
[Wed Jan 21 06:46:21.727605 2026] [:error] [pid 21454:tid 21468] [client 4.188.251.0:5932] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aXAFvTwp5UZmMFzY2bppwQAAAAQ"]
[Wed Jan 21 06:46:22.012277 2026] [:error] [pid 21455:tid 21511] [client 4.188.251.0:6009] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aXAFvopOKALCSo1URZFWvgAAAFQ"]
[Wed Jan 21 06:46:22.286434 2026] [:error] [pid 21454:tid 21470] [client 4.188.251.0:6070] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aXAFvjwp5UZmMFzY2bppwgAAAAY"]
[Wed Jan 21 06:46:22.560590 2026] [:error] [pid 21455:tid 21494] [client 4.188.251.0:5852] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aXAFvopOKALCSo1URZFWwAAAAEM"]
[Wed Jan 21 06:46:22.833096 2026] [:error] [pid 21454:tid 21465] [client 4.188.251.0:5919] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aXAFvjwp5UZmMFzY2bppxAAAAAE"]
[Wed Jan 21 06:46:23.104173 2026] [:error] [pid 21454:tid 21480] [client 4.188.251.0:5923] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aXAFvzwp5UZmMFzY2bppxgAAABA"]
[Wed Jan 21 06:46:23.377808 2026] [:error] [pid 21454:tid 21479] [client 4.188.251.0:5826] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aXAFvzwp5UZmMFzY2bppxwAAAA8"]
[Wed Jan 21 06:46:23.650369 2026] [:error] [pid 21563:tid 21580] [client 4.188.251.0:5770] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aXAFvxZq__dTorabEoywBQAAAM8"]
[Wed Jan 21 06:46:23.924189 2026] [:error] [pid 59863:tid 59885] [client 4.188.251.0:5951] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aXAFv7HQ1zVZ4yLuI-z59AAAARI"]
[Wed Jan 21 06:46:24.197471 2026] [:error] [pid 59863:tid 59880] [client 4.188.251.0:5856] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aXAFwLHQ1zVZ4yLuI-z59QAAAQ0"]
[Wed Jan 21 06:46:24.470439 2026] [:error] [pid 59863:tid 59876] [client 4.188.251.0:5915] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aXAFwLHQ1zVZ4yLuI-z59wAAAQk"]
[Wed Jan 21 06:46:24.743802 2026] [:error] [pid 59863:tid 59874] [client 4.188.251.0:5837] [client 4.188.251.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aXAFwLHQ1zVZ4yLuI-z5-QAAAQc"]
[Wed Jan 21 07:27:37.374898 2026] [:error] [pid 21563:tid 21576] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Wed Jan 21 07:27:37.640777 2026] [:error] [pid 21563:tid 21588] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Wed Jan 21 07:27:37.766828 2026] [:error] [pid 21563:tid 21583] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Wed Jan 21 07:27:37.891736 2026] [:error] [pid 21563:tid 21577] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Wed Jan 21 07:27:38.028320 2026] [:error] [pid 21563:tid 21572] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Jan 21 07:27:38.278662 2026] [:error] [pid 21563:tid 21565] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Jan 21 07:27:38.404139 2026] [:error] [pid 21563:tid 21578] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php
[Wed Jan 21 07:27:38.528329 2026] [:error] [pid 21563:tid 21585] [client 4.190.210.95:5111] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Wed Jan 21 07:27:38.778731 2026] [:error] [pid 21563:tid 21573] [client 4.190.210.95:5111] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAPahZq__dTorabEoy9HwAAAMg"]
[Wed Jan 21 07:27:39.267657 2026] [:error] [pid 21454:tid 21476] [client 4.190.210.95:5097] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAPazwp5UZmMFzY2bp0ZQAAAAw"]
[Wed Jan 21 07:27:39.757388 2026] [:error] [pid 21563:tid 21584] [client 4.190.210.95:5103] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAPaxZq__dTorabEoy9IQAAANM"]
[Wed Jan 21 07:27:40.241695 2026] [:error] [pid 21454:tid 21484] [client 4.190.210.95:5078] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXAPbDwp5UZmMFzY2bp0ZwAAABQ"]
[Wed Jan 21 08:12:31.127884 2026] [:error] [pid 59863:tid 59873] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Jan 21 08:12:31.251106 2026] [:error] [pid 59863:tid 59884] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Jan 21 08:12:31.391390 2026] [:error] [pid 59863:tid 59888] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Jan 21 08:12:31.514699 2026] [:error] [pid 59863:tid 59874] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Jan 21 08:12:32.873236 2026] [:error] [pid 59863:tid 59880] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Jan 21 08:12:32.999359 2026] [:error] [pid 59863:tid 59871] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Jan 21 08:12:33.246668 2026] [:error] [pid 59863:tid 59882] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Jan 21 08:12:33.369866 2026] [:error] [pid 59863:tid 59868] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php
[Wed Jan 21 08:12:33.504016 2026] [:error] [pid 59863:tid 59875] [client 4.190.210.95:64184] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Jan 21 08:12:33.629460 2026] [:error] [pid 59863:tid 59876] [client 4.190.210.95:64184] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAZ8bHQ1zVZ4yLuI-whcAAAAQk"]
[Wed Jan 21 08:12:34.128068 2026] [:error] [pid 56352:tid 56369] [client 4.190.210.95:33430] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAZ8tWN6wYNPTU3efVusAAAAU8"]
[Wed Jan 21 08:12:34.611277 2026] [:error] [pid 21454:tid 21477] [client 4.190.210.95:64139] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAZ8jwp5UZmMFzY2bp_3wAAAA0"]
[Wed Jan 21 08:12:35.097519 2026] [:error] [pid 59863:tid 59881] [client 4.190.210.95:55709] [client 4.190.210.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aXAZ87HQ1zVZ4yLuI-whcgAAAQ4"]
[Wed Jan 21 22:48:54.956304 2026] [:error] [pid 21455:tid 21510] [client 145.239.10.137:60863] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: http://aoswa.com.au/info.php
[Wed Jan 21 22:48:55.747606 2026] [:error] [pid 59863:tid 59885] [client 145.239.10.137:50450] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php, referer: http://aoswa.com.au/vx.php
[Thu Jan 22 02:09:10.153645 2026] [:error] [pid 4382:tid 4390] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Jan 22 02:09:10.274959 2026] [:error] [pid 4382:tid 4387] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Jan 22 02:09:10.396507 2026] [:error] [pid 4382:tid 4399] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Jan 22 02:09:10.524828 2026] [:error] [pid 4382:tid 4393] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Thu Jan 22 02:09:10.645349 2026] [:error] [pid 4382:tid 4408] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Jan 22 02:09:10.768656 2026] [:error] [pid 4382:tid 4398] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Jan 22 02:09:10.888859 2026] [:error] [pid 4382:tid 4386] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/deepseek_d.php
[Thu Jan 22 02:09:11.009511 2026] [:error] [pid 4382:tid 4397] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Jan 22 02:09:11.129694 2026] [:error] [pid 4382:tid 4389] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Jan 22 02:09:11.388456 2026] [:error] [pid 4382:tid 4406] [client 40.83.90.33:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Thu Jan 22 02:09:11.512424 2026] [:error] [pid 4382:tid 4400] [client 40.83.90.33:15157] [client 40.83.90.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aXEWR5Hg0falVG3JFbCVTAAAAZA"]
[Thu Jan 22 02:09:11.989181 2026] [:error] [pid 59863:tid 59874] [client 40.83.90.33:15020] [client 40.83.90.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aXEWR7HQ1zVZ4yLuI-wXRQAAAQc"]
[Thu Jan 22 02:09:12.471739 2026] [:error] [pid 21454:tid 21472] [client 40.83.90.33:14641] [client 40.83.90.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aXEWSDwp5UZmMFzY2bqMNQAAAAg"]
[Thu Jan 22 02:09:12.955304 2026] [:error] [pid 21455:tid 21505] [client 40.83.90.33:18717] [client 40.83.90.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aXEWSIpOKALCSo1URZF36gAAAE4"]
[Thu Jan 22 03:44:43.607621 2026] [:error] [pid 21563:tid 21589] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Jan 22 03:44:43.746715 2026] [:error] [pid 21563:tid 21584] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Thu Jan 22 03:44:43.885233 2026] [:error] [pid 21563:tid 21588] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Thu Jan 22 03:44:44.026228 2026] [:error] [pid 21563:tid 21573] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php
[Thu Jan 22 03:44:44.166729 2026] [:error] [pid 21563:tid 21567] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Jan 22 03:44:44.309689 2026] [:error] [pid 21563:tid 21572] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Jan 22 03:44:44.453991 2026] [:error] [pid 21563:tid 21569] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Jan 22 03:44:44.593103 2026] [:error] [pid 21563:tid 21571] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php
[Thu Jan 22 03:44:44.732519 2026] [:error] [pid 21563:tid 21570] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Jan 22 03:44:44.873483 2026] [:error] [pid 21563:tid 21568] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/fast.php
[Thu Jan 22 03:44:45.014749 2026] [:error] [pid 21563:tid 21586] [client 52.231.68.47:48092] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Jan 22 03:44:45.150090 2026] [:error] [pid 21563:tid 21574] [client 52.231.68.47:48092] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aXEsrRZq__dTorabEozq8QAAAMk"]
[Thu Jan 22 03:44:45.703416 2026] [:error] [pid 21455:tid 21494] [client 52.231.68.47:55664] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aXEsrYpOKALCSo1URZGL-AAAAEM"]
[Thu Jan 22 03:44:46.249089 2026] [:error] [pid 56352:tid 56354] [client 52.231.68.47:48083] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aXEsrtWN6wYNPTU3efVjqAAAAUA"]
[Thu Jan 22 03:44:46.795316 2026] [:error] [pid 56352:tid 56375] [client 52.231.68.47:55639] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r.php"] [unique_id "aXEsrtWN6wYNPTU3efVjqgAAAVU"]
[Thu Jan 22 05:32:48.059440 2026] [:error] [pid 52447:tid 52530] [client 187.44.219.99:64201] [client 187.44.219.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.44.219.99, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXFGAHRLA2NsdGqJzosxYgAAAJU"]
[Thu Jan 22 05:32:48.064860 2026] [:error] [pid 52447:tid 52530] [client 187.44.219.99:64201] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Jan 22 06:33:54.409489 2026] [:error] [pid 36083:tid 36101] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Jan 22 06:33:54.963339 2026] [:error] [pid 36083:tid 36106] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Jan 22 06:33:55.277269 2026] [:error] [pid 36083:tid 36087] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Jan 22 06:33:55.542721 2026] [:error] [pid 36083:tid 36102] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Jan 22 06:33:55.857897 2026] [:error] [pid 36083:tid 36097] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Jan 22 06:33:56.045098 2026] [:error] [pid 36083:tid 36100] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Jan 22 06:33:56.272190 2026] [:error] [pid 36083:tid 36094] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Jan 22 06:33:57.887608 2026] [:error] [pid 36083:tid 36091] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Jan 22 06:33:58.037960 2026] [:error] [pid 36083:tid 36099] [client 52.231.68.47:64066] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Jan 22 06:33:58.200097 2026] [:error] [pid 36083:tid 36090] [client 52.231.68.47:64066] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXFUVpCng2nQoR5iqwq1ggAAAUQ"]
[Thu Jan 22 06:33:58.770567 2026] [:error] [pid 36083:tid 36106] [client 52.231.68.47:45417] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXFUVpCng2nQoR5iqwq1hAAAAVQ"]
[Thu Jan 22 06:33:59.341292 2026] [:error] [pid 52446:tid 52498] [client 52.231.68.47:50249] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXFUV7J6clMw4kdrHYFavQAAAFA"]
[Thu Jan 22 06:33:59.924014 2026] [:error] [pid 27550:tid 27554] [client 52.231.68.47:46774] [client 52.231.68.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXFUV-OQDPzfV5R2LYRK1wAAAQI"]
[Thu Jan 22 09:50:25.758114 2026] [:error] [pid 52447:tid 52510] [client 159.65.8.157:52284] [client 159.65.8.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.65.8.157, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXGCYXRLA2NsdGqJzoudyAAAAIE"]
[Thu Jan 22 09:50:25.761837 2026] [:error] [pid 52447:tid 52510] [client 159.65.8.157:52284] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Jan 22 13:50:06.829120 2026] [:error] [pid 27550:tid 27572] [client 216.24.210.140:31921] [client 216.24.210.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.140, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXG6juOQDPzfV5R2LYTUVgAAARQ"]
[Thu Jan 22 13:50:06.832015 2026] [:error] [pid 27550:tid 27572] [client 216.24.210.140:31921] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Jan 22 13:50:07.164213 2026] [:error] [pid 52447:tid 52532] [client 216.24.210.123:27103] [client 216.24.210.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.123, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXG6j3RLA2NsdGqJzovw0gAAAJc"]
[Thu Jan 22 13:50:07.168380 2026] [:error] [pid 52447:tid 52532] [client 216.24.210.123:27103] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Jan 22 21:58:25.138739 2026] [:error] [pid 34321:tid 34344] [client 146.235.18.147:49492] [client 146.235.18.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aXItARLMkukwqSCtKrCrYAAAAdQ"]
[Thu Jan 22 21:58:25.496887 2026] [:error] [pid 27550:tid 27572] [client 146.235.18.147:49499] [client 146.235.18.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aXItAeOQDPzfV5R2LYRVTAAAARQ"]
[Thu Jan 22 22:35:44.903747 2026] [:error] [pid 27550:tid 27555] [client 95.216.63.67:53915] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php, referer: www.google.com
[Thu Jan 22 23:37:40.775750 2026] [:error] [pid 20418:tid 20443] [client 95.216.63.67:60186] [client 95.216.63.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/woocommerce-payments/readme.txt"] [unique_id "aXJERBahoKEa6eS4cSqc3AAAAZU"], referer: www.google.com
[Fri Jan 23 00:31:17.916365 2026] [:error] [pid 36083:tid 36108] [client 105.159.181.160:55070] [client 105.159.181.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aXJQ1ZCng2nQoR5iqwrR0gAAAVY"], referer: https://www.amazon.com/
[Fri Jan 23 00:31:20.387155 2026] [:error] [pid 34321:tid 34346] [client 105.159.181.160:55797] [client 105.159.181.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aXJQ2BLMkukwqSCtKrDaJAAAAdY"], referer: https://github.com/
[Fri Jan 23 00:31:21.884238 2026] [:error] [pid 52445:tid 52472] [client 105.159.181.160:56984] [client 105.159.181.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aXJQ2evMmsFgpSSb5L2upgAAABI"], referer: https://github.com/
[Fri Jan 23 00:31:23.373826 2026] [:error] [pid 52445:tid 52454] [client 105.159.181.160:57755] [client 105.159.181.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aXJQ2-vMmsFgpSSb5L2uqwAAAAA"], referer: https://www.google.com/search?q=
[Fri Jan 23 00:31:24.866069 2026] [:error] [pid 20418:tid 20423] [client 105.159.181.160:58585] [client 105.159.181.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aXJQ3BahoKEa6eS4cSqkjgAAAYE"], referer: https://www.ebay.com/sch/i.html?_nkw=vintage+camera&_sacat=0
[Fri Jan 23 00:31:27.814430 2026] [:error] [pid 52447:tid 52527] [client 105.159.181.160:60478] [client 105.159.181.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aXJQ33RLA2NsdGqJzouP4gAAAJI"], referer: https://t.me/share/url?url=https%3A%2F%2Frecipe-site.com&text=Great+recipe
[Fri Jan 23 06:59:43.594576 2026] [:error] [pid 11607:tid 11655] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Jan 23 06:59:43.886338 2026] [:error] [pid 11607:tid 11667] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Fri Jan 23 06:59:44.026486 2026] [:error] [pid 11607:tid 11645] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Fri Jan 23 06:59:44.166984 2026] [:error] [pid 11607:tid 11669] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Fri Jan 23 06:59:44.307651 2026] [:error] [pid 11607:tid 11647] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Jan 23 06:59:44.588766 2026] [:error] [pid 11607:tid 11652] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Jan 23 06:59:44.729153 2026] [:error] [pid 11607:tid 11651] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php
[Fri Jan 23 06:59:46.119654 2026] [:error] [pid 11607:tid 11657] [client 20.214.146.246:23091] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Fri Jan 23 06:59:46.395819 2026] [:error] [pid 11607:tid 11663] [client 20.214.146.246:23091] [client 20.214.146.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXKr4gucTAUsUUzKw5c6igAAAFI"]
[Fri Jan 23 06:59:46.940600 2026] [:error] [pid 11608:tid 11672] [client 20.214.146.246:20071] [client 20.214.146.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXKr4r4alK6RZLlMctqUQAAAAIA"]
[Fri Jan 23 06:59:47.483897 2026] [:error] [pid 11606:tid 11617] [client 20.214.146.246:23099] [client 20.214.146.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXKr41njAJqfHEQLcsiY9gAAAAI"]
[Fri Jan 23 06:59:48.026165 2026] [:error] [pid 11608:tid 11680] [client 20.214.146.246:39396] [client 20.214.146.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aXKr5L4alK6RZLlMctqURgAAAIg"]
[Fri Jan 23 09:20:45.749661 2026] [:error] [pid 11607:tid 11669] [client 20.205.10.3:42460] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Fri Jan 23 09:20:45.872247 2026] [:error] [pid 11607:tid 11661] [client 20.205.10.3:42460] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Jan 23 09:20:46.004492 2026] [:error] [pid 11607:tid 11655] [client 20.205.10.3:42460] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Fri Jan 23 09:20:46.257007 2026] [:error] [pid 11607:tid 11666] [client 20.205.10.3:42460] [client 20.205.10.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/berlin.php"] [unique_id "aXLM7gucTAUsUUzKw5d3JgAAAFU"]
[Fri Jan 23 09:20:46.785987 2026] [:error] [pid 11606:tid 11634] [client 20.205.10.3:11809] [client 20.205.10.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aXLM7lnjAJqfHEQLcsjdzQAAABM"]
[Fri Jan 23 09:20:47.286133 2026] [:error] [pid 64912:tid 64931] [client 20.205.10.3:12041] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Fri Jan 23 09:20:47.424771 2026] [:error] [pid 64912:tid 64917] [client 20.205.10.3:12041] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Jan 23 09:20:48.828281 2026] [:error] [pid 64912:tid 64926] [client 20.205.10.3:12041] File does not exist: /usr/local/apache/htdocs/suspended-page/ggfi.php
[Fri Jan 23 09:20:49.281514 2026] [:error] [pid 64912:tid 64925] [client 20.205.10.3:12041] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Jan 23 09:20:49.409492 2026] [:error] [pid 64912:tid 64932] [client 20.205.10.3:12041] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Jan 23 09:20:49.559108 2026] [:error] [pid 64912:tid 64918] [client 20.205.10.3:12041] [client 20.205.10.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aXLM8bem6jVGKqodwtI1qAAAAYQ"]
[Fri Jan 23 09:20:50.047479 2026] [:error] [pid 11608:tid 11683] [client 20.205.10.3:46272] [client 20.205.10.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aXLM8r4alK6RZLlMctra_QAAAIs"]
[Fri Jan 23 09:20:50.575909 2026] [:error] [pid 11607:tid 11665] [client 20.205.10.3:42461] [client 20.205.10.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aXLM8gucTAUsUUzKw5d3JwAAAFQ"]
[Fri Jan 23 09:20:51.066195 2026] [:error] [pid 64912:tid 64938] [client 20.205.10.3:46292] [client 20.205.10.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "aXLM87em6jVGKqodwtI1qwAAAZg"]
[Fri Jan 23 13:04:29.156173 2026] [:error] [pid 64230:tid 64235] [client 129.212.186.67:55143] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/administrator/"] [unique_id "aXMBXa2JXmVjD91caKJX9AAAAUI"]
[Fri Jan 23 13:04:29.541051 2026] [:error] [pid 11732:tid 11753] [client 129.212.186.67:55266] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/administrator/index.php"] [unique_id "aXMBXefd54xxq04JKuMMvQAAANM"]
[Fri Jan 23 13:04:29.922748 2026] [:error] [pid 11732:tid 11754] [client 129.212.186.67:55393] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/administrator/index2.php"] [unique_id "aXMBXefd54xxq04JKuMMvgAAANQ"]
[Fri Jan 23 13:04:30.311626 2026] [:error] [pid 64912:tid 64937] [client 129.212.186.67:55510] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/administrator/index3.php"] [unique_id "aXMBXrem6jVGKqodwtKCqAAAAZc"]
[Fri Jan 23 13:04:30.705618 2026] [:error] [pid 11608:tid 11692] [client 129.212.186.67:55640] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/joomla/administrator/"] [unique_id "aXMBXr4alK6RZLlMcto-7AAAAJQ"]
[Fri Jan 23 13:04:31.096939 2026] [:error] [pid 11606:tid 11617] [client 129.212.186.67:55785] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/administrator/"] [unique_id "aXMBX1njAJqfHEQLcsgeogAAAAI"]
[Fri Jan 23 13:04:31.489308 2026] [:error] [pid 11607:tid 11647] [client 129.212.186.67:55907] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/administrator/"] [unique_id "aXMBXwucTAUsUUzKw5evlQAAAEM"]
[Fri Jan 23 13:04:31.884114 2026] [:error] [pid 11607:tid 11650] [client 129.212.186.67:55994] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web/administrator/"] [unique_id "aXMBXwucTAUsUUzKw5evmAAAAEY"]
[Fri Jan 23 13:04:32.277689 2026] [:error] [pid 64912:tid 64927] [client 129.212.186.67:56097] [client 129.212.186.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/panel/administrator/"] [unique_id "aXMBYLem6jVGKqodwtKCrQAAAY0"]
[Fri Jan 23 13:54:00.297249 2026] [:error] [pid 62368:tid 62394] [client 103.55.213.122:62833] [client 103.55.213.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.55.213.122, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXMM-CeMzKRnyYLMANMuBgAAARc"]
[Fri Jan 23 13:54:00.303269 2026] [:error] [pid 62368:tid 62394] [client 103.55.213.122:62833] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Jan 23 15:21:09.011731 2026] [:error] [pid 11732:tid 11747] [client 212.227.175.43:54284] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Fri Jan 23 15:21:17.504108 2026] [:error] [pid 11607:tid 11669] [client 212.227.175.43:58895] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Fri Jan 23 15:21:25.926606 2026] [:error] [pid 11608:tid 11680] [client 212.227.175.43:51027] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Fri Jan 23 15:21:34.137250 2026] [:error] [pid 64912:tid 64933] [client 212.227.175.43:51109] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Fri Jan 23 21:37:36.134566 2026] [:error] [pid 64912:tid 64928] [client 196.177.114.215:55869] [client 196.177.114.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aXN5oLem6jVGKqodwtIF4AAAAY4"]
[Fri Jan 23 21:37:36.136041 2026] [:error] [pid 11607:tid 11656] [client 196.177.114.215:55870] [client 196.177.114.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aXN5oAucTAUsUUzKw5caNgAAAEw"]
[Sat Jan 24 08:32:05.563857 2026] [:error] [pid 40902:tid 40932] [client 213.209.159.55:40204] [client 213.209.159.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aXQTBQSCceZpurDgOeszuAAAABQ"]
[Sat Jan 24 09:10:18.305554 2026] [:error] [pid 40902:tid 40915] [client 170.205.31.138:57351] [client 170.205.31.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-confiq.php"] [unique_id "aXQb-gSCceZpurDgOes9kwAAAAM"]
[Sat Jan 24 20:03:26.108806 2026] [:error] [pid 41009:tid 41024] [client 157.51.91.138:63484] [client 157.51.91.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.51.91.138, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXS1DmrewfoFUDD3TM2sXQAAAM0"]
[Sat Jan 24 20:03:26.114252 2026] [:error] [pid 41009:tid 41024] [client 157.51.91.138:63484] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Jan 25 00:57:06.891778 2026] [:error] [pid 60761:tid 60779] [client 64.89.163.25:59219] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXT54lZQvxLvEbXXh9KgjwAAAU8"]
[Sun Jan 25 00:57:07.528144 2026] [:error] [pid 40902:tid 40926] [client 64.89.163.25:59464] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXT54wSCceZpurDgOese0wAAAA4"]
[Sun Jan 25 00:57:08.163210 2026] [:error] [pid 40902:tid 40925] [client 64.89.163.25:59665] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXT55ASCceZpurDgOese8QAAAA0"]
[Sun Jan 25 00:57:08.800459 2026] [:error] [pid 41009:tid 41019] [client 64.89.163.25:59900] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXT55GrewfoFUDD3TM3_3AAAAMg"]
[Sun Jan 25 00:57:09.437787 2026] [:error] [pid 40903:tid 40947] [client 64.89.163.25:60065] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXT55Rxw3xvyqXTcGl_dDgAAAEg"]
[Sun Jan 25 02:26:25.524003 2026] [:error] [pid 14976:tid 14984] [client 213.209.159.55:46232] [client 213.209.159.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aXUO0WvdigydYOB2KS-38gAAAYY"]
[Sun Jan 25 04:06:21.392355 2026] [:error] [pid 53521:tid 53547] [client 35.159.32.17:7537] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sun Jan 25 10:36:37.166440 2026] [:error] [pid 53420:tid 53463] [client 103.77.106.81:54535] [client 103.77.106.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aXWBtY5y-t2ZKNqnnbXCKgAAAEc"]
[Sun Jan 25 16:06:48.060952 2026] [:error] [pid 53420:tid 53473] [client 45.141.215.153:33724] [client 45.141.215.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aXXPGI5y-t2ZKNqnnbUJ6wAAAFE"]
[Sun Jan 25 16:06:48.253194 2026] [:error] [pid 33687:tid 33699] [client 45.141.215.153:33734] [client 45.141.215.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aXXPGIc6VUyZP5DZSy50mgAAAQk"]
[Sun Jan 25 16:06:51.339930 2026] [:error] [pid 53419:tid 53439] [client 45.141.215.153:33754] [client 45.141.215.153] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "51.222.168.31_38fe0bde74a94317ba64948c2013b47a85fb6514"): Internal error (specific information not available) [hostname "aoswa.com.au"] [uri "/index.html"] [unique_id "aXXPGSNxBUypy_ALgwPdkAAAAAs"]
[Mon Jan 26 00:38:40.173300 2026] [:error] [pid 48920:tid 48995] [client 40.81.232.73:54558] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 00:38:40.314720 2026] [:error] [pid 48920:tid 48997] [client 40.81.232.73:54558] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 00:38:40.455999 2026] [:error] [pid 48920:tid 48999] [client 40.81.232.73:54558] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 00:38:40.597515 2026] [:error] [pid 48920:tid 49000] [client 40.81.232.73:54558] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 04:30:13.602713 2026] [:error] [pid 61252:tid 61272] [client 159.203.3.128:64135] [client 159.203.3.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.3.128, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXZ9VbrGlf8FG2etxUCqkgAAARI"]
[Mon Jan 26 04:30:13.607674 2026] [:error] [pid 61252:tid 61272] [client 159.203.3.128:64135] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Jan 26 04:30:13.826028 2026] [:error] [pid 61252:tid 61256] [client 159.203.3.128:64135] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXZ9VbrGlf8FG2etxUCqlAAAAQI"]
[Mon Jan 26 04:30:14.262131 2026] [:error] [pid 61286:tid 61311] [client 159.203.3.128:64538] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9VsnVt687wYGMPn9CtwAAAVU"]
[Mon Jan 26 04:30:14.696937 2026] [:error] [pid 61287:tid 61337] [client 159.203.3.128:64691] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9VtimZOwAM64CfR5eEQAAAZQ"]
[Mon Jan 26 04:30:15.131705 2026] [:error] [pid 24557:tid 24613] [client 159.203.3.128:64854] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9V-rlG7Vm9pxV14xHTAAAAFM"]
[Mon Jan 26 04:30:15.566671 2026] [:error] [pid 24556:tid 24572] [client 159.203.3.128:65029] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9V0yDW1_EbgDa3XJKmgAAAAc"]
[Mon Jan 26 04:30:16.001058 2026] [:error] [pid 24558:tid 24633] [client 159.203.3.128:65200] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WAo1PXqeJqIMTQbsYAAAAIw"]
[Mon Jan 26 04:30:16.436292 2026] [:error] [pid 24557:tid 24595] [client 159.203.3.128:65396] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WOrlG7Vm9pxV14xHaQAAAEE"]
[Mon Jan 26 04:30:16.872490 2026] [:error] [pid 61252:tid 61271] [client 159.203.3.128:49201] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2020/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WLrGlf8FG2etxUCqzAAAARE"]
[Mon Jan 26 04:30:17.307556 2026] [:error] [pid 61252:tid 61263] [client 159.203.3.128:49426] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WbrGlf8FG2etxUCq4AAAAQk"]
[Mon Jan 26 04:30:17.742349 2026] [:error] [pid 24558:tid 24635] [client 159.203.3.128:49646] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WQo1PXqeJqIMTQbsdQAAAI4"]
[Mon Jan 26 04:30:18.176509 2026] [:error] [pid 61287:tid 61334] [client 159.203.3.128:49870] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WtimZOwAM64CfR5eiwAAAZE"]
[Mon Jan 26 04:30:18.612561 2026] [:error] [pid 61287:tid 61340] [client 159.203.3.128:50067] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WtimZOwAM64CfR5ejwAAAZc"]
[Mon Jan 26 04:30:19.047568 2026] [:error] [pid 24557:tid 24600] [client 159.203.3.128:50251] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9W-rlG7Vm9pxV14xHkAAAAEY"]
[Mon Jan 26 04:30:19.482112 2026] [:error] [pid 24558:tid 24621] [client 159.203.3.128:50379] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9Wwo1PXqeJqIMTQbshwAAAIA"]
[Mon Jan 26 04:30:19.929214 2026] [:error] [pid 24557:tid 24607] [client 159.203.3.128:50510] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9W-rlG7Vm9pxV14xHkgAAAE0"]
[Mon Jan 26 04:30:20.365292 2026] [:error] [pid 61287:tid 61337] [client 159.203.3.128:50625] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9XNimZOwAM64CfR5elwAAAZQ"]
[Mon Jan 26 23:14:19.976784 2026] [:error] [pid 24666:tid 24669] [client 45.133.5.78:32183] [client 45.133.5.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.78, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXeEy5mH-L0_jbK3i9HrvgAAAME"]
[Mon Jan 26 23:14:19.982771 2026] [:error] [pid 24666:tid 24669] [client 45.133.5.78:32183] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Jan 27 01:48:46.115075 2026] [:error] [pid 57173:tid 57254] [client 203.25.124.191:51497] [client 203.25.124.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.25.124.191, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXeo_k4W-bz8q8pfNmgjfwAAABU"]
[Tue Jan 27 01:48:46.117337 2026] [:error] [pid 57173:tid 57254] [client 203.25.124.191:51497] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Jan 27 05:35:45.739592 2026] [:error] [pid 41780:tid 41795] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Jan 27 05:35:45.889479 2026] [:error] [pid 41780:tid 41784] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Tue Jan 27 05:35:46.031681 2026] [:error] [pid 41780:tid 41787] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Jan 27 05:35:46.335105 2026] [:error] [pid 41780:tid 41805] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Jan 27 05:35:46.766051 2026] [:error] [pid 41780:tid 41786] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Tue Jan 27 05:35:47.224628 2026] [:error] [pid 41780:tid 41798] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Tue Jan 27 05:35:47.389580 2026] [:error] [pid 41780:tid 41800] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Jan 27 05:35:47.911773 2026] [:error] [pid 41780:tid 41792] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Tue Jan 27 05:35:48.061213 2026] [:error] [pid 41780:tid 41782] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Jan 27 05:35:48.207899 2026] [:error] [pid 41780:tid 41785] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Jan 27 05:35:48.663074 2026] [:error] [pid 41780:tid 41797] [client 20.214.153.76:8353] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Jan 27 05:35:48.805135 2026] [:error] [pid 41780:tid 41806] [client 20.214.153.76:8353] [client 20.214.153.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXfeNFvu-XLQ0TaZ4FFh0wAAARg"]
[Tue Jan 27 05:35:49.360515 2026] [:error] [pid 7452:tid 7479] [client 20.214.153.76:13859] [client 20.214.153.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXfeNWlXocEpHDB6FUZpQwAAABI"]
[Tue Jan 27 05:35:49.928748 2026] [:error] [pid 7561:tid 7588] [client 20.214.153.76:13838] [client 20.214.153.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXfeNbXGI6mgvHQqkXwPGwAAANg"]
[Tue Jan 27 05:35:50.499496 2026] [:error] [pid 41780:tid 41784] [client 20.214.153.76:11380] [client 20.214.153.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "aXfeNlvu-XLQ0TaZ4FFh3AAAAQI"]
[Tue Jan 27 07:30:37.867233 2026] [:error] [pid 41780:tid 41798] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Jan 27 07:30:38.010747 2026] [:error] [pid 41780:tid 41801] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Jan 27 07:30:38.450643 2026] [:error] [pid 41780:tid 41795] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Tue Jan 27 07:30:38.607742 2026] [:error] [pid 41780:tid 41784] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Jan 27 07:30:38.912996 2026] [:error] [pid 41780:tid 41800] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Jan 27 07:30:39.333788 2026] [:error] [pid 41780:tid 41806] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue Jan 27 07:30:39.485514 2026] [:error] [pid 41780:tid 41791] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Jan 27 07:30:39.636051 2026] [:error] [pid 41780:tid 41793] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Jan 27 07:30:39.958852 2026] [:error] [pid 41780:tid 41803] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Jan 27 07:30:40.107664 2026] [:error] [pid 41780:tid 41790] [client 104.211.88.109:25088] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Jan 27 07:30:40.399626 2026] [:error] [pid 41780:tid 41787] [client 104.211.88.109:25088] [client 104.211.88.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ae.php"] [unique_id "aXf5IFvu-XLQ0TaZ4FGEnwAAAQU"]
[Tue Jan 27 07:30:40.982967 2026] [:error] [pid 7454:tid 7518] [client 104.211.88.109:25192] [client 104.211.88.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ae.php"] [unique_id "aXf5IJltCoZEfMmfl8CbfgAAAII"]
[Tue Jan 27 07:30:41.557430 2026] [:error] [pid 7454:tid 7537] [client 104.211.88.109:20777] [client 104.211.88.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ae.php"] [unique_id "aXf5IZltCoZEfMmfl8CbhAAAAJU"]
[Tue Jan 27 07:30:42.159976 2026] [:error] [pid 7452:tid 7461] [client 104.211.88.109:20781] [client 104.211.88.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ae.php"] [unique_id "aXf5ImlXocEpHDB6FUaRRgAAAAA"]
[Tue Jan 27 11:40:32.718905 2026] [:error] [pid 48412:tid 48417] [client 64.225.49.30:56279] [client 64.225.49.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aXgzsHbJMfAKlln88JGG1QAAAUM"], referer: binance.com
[Wed Jan 28 05:17:08.579914 2026] [:error] [pid 58254:tid 58262] [client 45.154.138.2:33229] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Jan 28 05:17:09.537910 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.2:33229] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Jan 28 05:17:10.005224 2026] [:error] [pid 58254:tid 58267] [client 45.154.138.2:33229] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aXkrVvF8nSyBg9wOsa8PIwAAAQs"]
[Wed Jan 28 05:17:10.927566 2026] [:error] [pid 17424:tid 17454] [client 45.154.138.31:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Jan 28 05:17:11.387262 2026] [:error] [pid 17424:tid 17448] [client 45.154.138.31:63869] [client 45.154.138.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aXkrV2RvtDRvGDe-pItEJwAAAA8"]
[Wed Jan 28 05:17:12.319431 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.25:45149] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Jan 28 05:17:13.273492 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.25:45149] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Jan 28 05:17:13.745035 2026] [:error] [pid 17426:tid 17497] [client 45.154.138.25:45149] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Jan 28 05:17:14.209940 2026] [:error] [pid 17426:tid 17512] [client 45.154.138.25:45149] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Jan 28 05:17:15.139844 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.25:45149] [client 45.154.138.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aXkrW08zvf_03BnziRf61QAAAIA"]
[Wed Jan 28 05:17:16.062086 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.12:63415] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Jan 28 05:17:16.541366 2026] [:error] [pid 17425:tid 17477] [client 45.154.138.12:63415] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Jan 28 05:17:17.026585 2026] [:error] [pid 17425:tid 17462] [client 45.154.138.12:63415] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aXkrXarcODKH1Dl7aZAi8AAAAEA"]
[Wed Jan 28 05:17:17.945290 2026] [:error] [pid 64842:tid 64860] [client 45.154.138.41:24731] [client 45.154.138.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aXkrXVuAAQZ5AN_SnDb2nQAAAVA"]
[Wed Jan 28 05:17:18.868058 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.18:30603] [client 45.154.138.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aXkrXvF8nSyBg9wOsa8PjQAAARc"]
[Wed Jan 28 05:17:20.255594 2026] [:error] [pid 17425:tid 17486] [client 45.154.138.30:34507] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aXkrYKrcODKH1Dl7aZAjDAAAAFc"]
[Wed Jan 28 05:17:21.662558 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.26:24485] [client 45.154.138.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aXkrYarcODKH1Dl7aZAjFgAAAE0"]
[Wed Jan 28 05:17:23.535484 2026] [:error] [pid 17535:tid 17542] [client 45.154.138.30:52999] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Jan 28 05:17:24.982600 2026] [:error] [pid 17535:tid 17552] [client 45.154.138.30:52999] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Jan 28 05:17:25.444378 2026] [:error] [pid 17535:tid 17538] [client 45.154.138.30:52999] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aXkrZa3QiSMgVscnN5IVBgAAAMA"]
[Wed Jan 28 05:17:26.367657 2026] [:error] [pid 17535:tid 17562] [client 45.154.138.3:57355] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aXkrZq3QiSMgVscnN5IVDwAAANg"]
[Wed Jan 28 05:17:27.762698 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Wed Jan 28 05:17:28.240471 2026] [:error] [pid 58254:tid 58258] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Wed Jan 28 05:17:28.746222 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Jan 28 05:17:29.214093 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Jan 28 05:17:29.687962 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Wed Jan 28 05:17:30.156346 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Wed Jan 28 05:17:30.624927 2026] [:error] [pid 58254:tid 58274] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Wed Jan 28 05:17:31.177044 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Jan 28 05:17:31.641016 2026] [:error] [pid 58254:tid 58259] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Wed Jan 28 05:17:32.115509 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Jan 28 05:17:32.615366 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Wed Jan 28 05:17:33.104228 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Jan 28 05:17:33.597212 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Jan 28 05:17:34.063185 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Wed Jan 28 05:17:34.525612 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Wed Jan 28 05:17:34.986999 2026] [:error] [pid 58254:tid 58266] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Jan 28 05:17:35.451794 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Wed Jan 28 05:17:35.916394 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed Jan 28 05:17:36.388589 2026] [:error] [pid 58254:tid 58280] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Wed Jan 28 05:17:36.858831 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Jan 28 05:17:37.325111 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Wed Jan 28 05:17:37.788794 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Jan 28 05:17:38.254026 2026] [:error] [pid 58254:tid 58267] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Jan 28 05:17:38.722341 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Jan 28 05:17:39.188937 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Jan 28 05:17:39.651025 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Wed Jan 28 05:17:40.116223 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Jan 28 05:17:40.579099 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Wed Jan 28 05:17:41.046055 2026] [:error] [pid 58254:tid 58280] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Wed Jan 28 05:17:41.542366 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Wed Jan 28 05:17:42.009308 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Wed Jan 28 05:17:42.475563 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Wed Jan 28 05:17:42.940530 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Jan 28 05:17:43.400133 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.8:61263] [client 45.154.138.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.8, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXkrd_F8nSyBg9wOsa8Q4QAAAQ4"]
[Wed Jan 28 05:17:43.402445 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Jan 28 05:17:44.342456 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Wed Jan 28 05:17:44.811650 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.8:61263] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Jan 28 05:17:45.278585 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.8:61263] [client 45.154.138.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aXkrefF8nSyBg9wOsa8Q-QAAARQ"]
[Wed Jan 28 05:17:46.216493 2026] [:error] [pid 2454:tid 2482] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Wed Jan 28 05:17:46.684964 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Jan 28 05:17:47.632684 2026] [:error] [pid 2454:tid 2465] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Wed Jan 28 05:17:48.105024 2026] [:error] [pid 2454:tid 2476] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Wed Jan 28 05:17:48.579255 2026] [:error] [pid 2454:tid 2461] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Wed Jan 28 05:17:49.045743 2026] [:error] [pid 2454:tid 2478] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Wed Jan 28 05:17:49.518410 2026] [:error] [pid 2454:tid 2464] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Wed Jan 28 05:17:49.984444 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Wed Jan 28 05:17:50.458781 2026] [:error] [pid 2454:tid 2478] [client 45.154.138.36:25777] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Wed Jan 28 05:17:51.401101 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.36:25777] [client 45.154.138.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aXkrf5vv4I21Ywd7NNboXQAAAYs"]
[Wed Jan 28 05:17:52.330665 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Wed Jan 28 05:17:52.849681 2026] [:error] [pid 64842:tid 64848] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Wed Jan 28 05:17:55.313056 2026] [:error] [pid 64842:tid 64846] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Jan 28 05:17:55.778848 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Wed Jan 28 05:17:56.246451 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Wed Jan 28 05:17:56.714827 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Wed Jan 28 05:17:57.189280 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Wed Jan 28 05:17:58.600498 2026] [:error] [pid 64842:tid 64861] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Wed Jan 28 05:17:59.090942 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Wed Jan 28 05:17:59.580032 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Wed Jan 28 05:18:00.044779 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Wed Jan 28 05:18:00.509337 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Wed Jan 28 05:18:01.077799 2026] [:error] [pid 64842:tid 64844] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Wed Jan 28 05:18:01.557870 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Wed Jan 28 05:18:02.504321 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Wed Jan 28 05:18:02.979736 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Wed Jan 28 05:18:03.918237 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Wed Jan 28 05:18:04.390990 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Wed Jan 28 05:18:04.856486 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Wed Jan 28 05:18:05.341353 2026] [:error] [pid 64842:tid 64851] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Wed Jan 28 05:18:05.807848 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.27:22161] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Wed Jan 28 05:18:06.280707 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.27:22161] [client 45.154.138.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/lx.php"] [unique_id "aXkrjluAAQZ5AN_SnDb4xwAAAU0"]
[Wed Jan 28 05:18:08.152648 2026] [:error] [pid 58254:tid 58259] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Wed Jan 28 05:18:08.624251 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Wed Jan 28 05:18:09.095374 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Wed Jan 28 05:18:09.582483 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Wed Jan 28 05:18:10.059323 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Wed Jan 28 05:18:10.522945 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Wed Jan 28 05:18:10.997906 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Wed Jan 28 05:18:11.495819 2026] [:error] [pid 58254:tid 58266] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Wed Jan 28 05:18:15.981906 2026] [:error] [pid 58254:tid 58266] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Wed Jan 28 05:18:16.451558 2026] [:error] [pid 58254:tid 58280] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Wed Jan 28 05:18:16.920242 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Jan 28 05:18:17.423352 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Wed Jan 28 05:18:17.918616 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Wed Jan 28 05:18:18.383287 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Wed Jan 28 05:18:18.851006 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Wed Jan 28 05:18:19.314280 2026] [:error] [pid 58254:tid 58273] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Wed Jan 28 05:18:19.779875 2026] [:error] [pid 58254:tid 58268] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Wed Jan 28 05:18:20.242724 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Wed Jan 28 05:18:23.060114 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Wed Jan 28 05:18:23.529944 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Wed Jan 28 05:18:23.993413 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Wed Jan 28 05:18:24.457546 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Jan 28 05:18:24.929377 2026] [:error] [pid 58254:tid 58273] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Wed Jan 28 05:18:25.392029 2026] [:error] [pid 58254:tid 58262] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Wed Jan 28 05:18:25.857030 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Wed Jan 28 05:18:26.319718 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Jan 28 05:18:26.797881 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Wed Jan 28 05:18:27.271391 2026] [:error] [pid 58254:tid 58280] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Jan 28 05:18:27.745019 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.47:61051] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Wed Jan 28 05:18:37.154469 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.47:61051] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aXkrrfF8nSyBg9wOsa8TdAAAAQc"]
[Wed Jan 28 05:18:38.557593 2026] [:error] [pid 17535:tid 17557] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Wed Jan 28 05:18:42.771780 2026] [:error] [pid 17535:tid 17547] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Wed Jan 28 05:18:43.233323 2026] [:error] [pid 17535:tid 17539] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Wed Jan 28 05:18:43.718973 2026] [:error] [pid 17535:tid 17552] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Wed Jan 28 05:18:45.156687 2026] [:error] [pid 17535:tid 17552] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Wed Jan 28 05:18:48.022754 2026] [:error] [pid 17535:tid 17542] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Wed Jan 28 05:18:48.492236 2026] [:error] [pid 17535:tid 17555] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Wed Jan 28 05:18:48.960350 2026] [:error] [pid 17535:tid 17552] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Jan 28 05:18:49.424755 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Wed Jan 28 05:18:49.889028 2026] [:error] [pid 17535:tid 17544] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Wed Jan 28 05:18:50.366828 2026] [:error] [pid 17535:tid 17556] [client 45.154.138.49:22465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Wed Jan 28 05:18:51.301305 2026] [:error] [pid 17535:tid 17560] [client 45.154.138.49:22465] [client 45.154.138.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aXkru63QiSMgVscnN5IZeAAAANY"]
[Wed Jan 28 05:18:52.234076 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.12:48511] [client 45.154.138.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.154.138.12, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXkrvPF8nSyBg9wOsa8UKAAAAQ4"]
[Wed Jan 28 05:18:52.237783 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.12:48511] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 28 05:18:52.703728 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.12:48511] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Wed Jan 28 05:18:53.636664 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.12:48511] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aXkrvfF8nSyBg9wOsa8UNQAAAQg"]
[Wed Jan 28 05:18:55.038557 2026] [:error] [pid 17424:tid 17435] [client 45.154.138.14:23385] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Wed Jan 28 05:18:57.385838 2026] [:error] [pid 17424:tid 17436] [client 45.154.138.14:23385] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Jan 28 05:18:58.315981 2026] [:error] [pid 17424:tid 17436] [client 45.154.138.14:23385] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Wed Jan 28 05:18:58.783353 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.14:23385] [client 45.154.138.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aXkrwmRvtDRvGDe-pItJ5gAAABQ"]
[Wed Jan 28 05:18:59.726762 2026] [:error] [pid 17424:tid 17447] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Wed Jan 28 05:19:00.201981 2026] [:error] [pid 17424:tid 17452] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Wed Jan 28 05:19:00.668036 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Wed Jan 28 05:19:02.636048 2026] [:error] [pid 17424:tid 17445] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Wed Jan 28 05:19:03.101268 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Jan 28 05:19:03.572203 2026] [:error] [pid 17424:tid 17434] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Jan 28 05:19:04.045269 2026] [:error] [pid 17424:tid 17457] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Wed Jan 28 05:19:05.931354 2026] [:error] [pid 17424:tid 17436] [client 45.154.138.23:22799] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Jan 28 05:19:06.862895 2026] [:error] [pid 17424:tid 17445] [client 45.154.138.23:22799] [client 45.154.138.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aXkrymRvtDRvGDe-pItKTgAAAAw"]
[Wed Jan 28 05:19:07.782787 2026] [:error] [pid 64842:tid 64861] [client 45.154.138.26:56333] [client 45.154.138.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aXkry1uAAQZ5AN_SnDb74gAAAVE"]
[Wed Jan 28 05:19:08.715912 2026] [:error] [pid 17424:tid 17441] [client 45.154.138.45:35375] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aXkrzGRvtDRvGDe-pItKbgAAAAg"]
[Wed Jan 28 05:19:09.689027 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.3:20053] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aXkrzZvv4I21Ywd7NNbtdwAAAZc"]
[Wed Jan 28 05:19:10.629919 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.2:29633] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Wed Jan 28 05:19:11.101523 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.2:29633] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Wed Jan 28 05:19:12.029301 2026] [:error] [pid 2454:tid 2474] [client 45.154.138.2:29633] [client 45.154.138.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.2, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aXkr0Jvv4I21Ywd7NNbtsAAAAZA"]
[Wed Jan 28 05:19:14.874656 2026] [:error] [pid 2454:tid 2479] [client 45.154.138.2:29633] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Wed Jan 28 05:19:15.835222 2026] [:error] [pid 2454:tid 2479] [client 45.154.138.2:29633] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Wed Jan 28 05:19:18.652703 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.2:29633] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aXkr1pvv4I21Ywd7NNbuNAAAAZc"]
[Wed Jan 28 05:19:19.580467 2026] [:error] [pid 2454:tid 2461] [client 45.154.138.36:44045] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Jan 28 05:19:20.981418 2026] [:error] [pid 2454:tid 2459] [client 45.154.138.36:44045] [client 45.154.138.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.36, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aXkr2Jvv4I21Ywd7NNbuZAAAAYE"]
[Wed Jan 28 05:19:21.452853 2026] [:error] [pid 2454:tid 2479] [client 45.154.138.36:44045] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Wed Jan 28 05:19:22.398679 2026] [:error] [pid 2454:tid 2462] [client 45.154.138.36:44045] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Wed Jan 28 05:19:22.876700 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.36:44045] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Wed Jan 28 05:19:23.819651 2026] [:error] [pid 2454:tid 2480] [client 45.154.138.36:44045] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Jan 28 05:19:24.317472 2026] [:error] [pid 2454:tid 2462] [client 45.154.138.36:44045] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Jan 28 05:19:24.781958 2026] [:error] [pid 2454:tid 2478] [client 45.154.138.36:44045] [client 45.154.138.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aXkr3Jvv4I21Ywd7NNbusAAAAZQ"]
[Wed Jan 28 05:19:25.704083 2026] [:error] [pid 17424:tid 17433] [client 45.154.138.50:53561] [client 45.154.138.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aXkr3WRvtDRvGDe-pItLIAAAAAA"]
[Wed Jan 28 05:19:26.628145 2026] [:error] [pid 58254:tid 58266] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Wed Jan 28 05:19:27.120651 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Wed Jan 28 05:19:27.617783 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Wed Jan 28 05:19:28.098890 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Jan 28 05:19:29.082612 2026] [:error] [pid 58254:tid 58257] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Wed Jan 28 05:19:31.076413 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/zmFM.php
[Wed Jan 28 05:19:35.381117 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Wed Jan 28 05:19:35.861344 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Jan 28 05:19:36.326475 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.20:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Wed Jan 28 05:19:37.255205 2026] [:error] [pid 58254:tid 58265] [client 45.154.138.20:56133] [client 45.154.138.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aXkr6fF8nSyBg9wOsa8WkwAAAQk"]
[Wed Jan 28 05:19:40.046792 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.4:60961] [client 45.154.138.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bak.php"] [unique_id "aXkr7K3QiSMgVscnN5IcSQAAAMc"]
[Wed Jan 28 05:19:40.968452 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.38:27183] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Wed Jan 28 05:19:41.435926 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.38:27183] [client 45.154.138.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aXkr7WRvtDRvGDe-pItL3wAAABc"]
[Wed Jan 28 05:19:43.323304 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.26:25307] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Wed Jan 28 05:19:44.273443 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.26:25307] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Jan 28 05:19:44.751036 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.26:25307] [client 45.154.138.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aXkr8GRvtDRvGDe-pItMCwAAABQ"]
[Wed Jan 28 05:19:45.669852 2026] [:error] [pid 2454:tid 2460] [client 45.154.138.7:25957] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aXkr8Zvv4I21Ywd7NNbv8wAAAYI"]
[Wed Jan 28 05:19:46.595672 2026] [:error] [pid 17535:tid 17547] [client 45.154.138.47:41403] [client 45.154.138.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.47, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aXkr8q3QiSMgVscnN5IclwAAAMk"]
[Wed Jan 28 05:19:47.077949 2026] [:error] [pid 17535:tid 17542] [client 45.154.138.47:41403] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Wed Jan 28 05:19:48.044487 2026] [:error] [pid 17535:tid 17543] [client 45.154.138.47:41403] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/themes.php"] [unique_id "aXkr9K3QiSMgVscnN5IcpwAAAMU"]
[Wed Jan 28 05:19:48.987046 2026] [:error] [pid 17535:tid 17562] [client 45.154.138.45:55517] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Jan 28 05:19:49.939889 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.45:55517] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Wed Jan 28 05:19:52.316446 2026] [:error] [pid 17535:tid 17551] [client 45.154.138.45:55517] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aXkr-K3QiSMgVscnN5Ic1gAAAM0"]
[Wed Jan 28 05:19:53.239763 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.17:41749] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Jan 28 05:19:54.182972 2026] [:error] [pid 17425:tid 17479] [client 45.154.138.17:41749] [client 45.154.138.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aXkr-qrcODKH1Dl7aZAqWwAAAFE"]
[Wed Jan 28 05:19:55.594209 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.5:60893] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Wed Jan 28 05:19:56.052461 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.5:60893] [client 45.154.138.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aXkr_Jvv4I21Ywd7NNbwpwAAAY0"]
[Wed Jan 28 05:19:57.925221 2026] [:error] [pid 64842:tid 64845] [client 45.154.138.29:31409] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Wed Jan 28 05:19:58.392656 2026] [:error] [pid 64842:tid 64852] [client 45.154.138.29:31409] [client 45.154.138.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.29, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aXkr_luAAQZ5AN_SnDb-cgAAAUg"]
[Wed Jan 28 05:19:59.807683 2026] [:error] [pid 64842:tid 64848] [client 45.154.138.29:31409] [client 45.154.138.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aXkr_1uAAQZ5AN_SnDb-fwAAAUQ"]
[Wed Jan 28 05:20:00.730510 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.45:65203] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aXksAFuAAQZ5AN_SnDb-iAAAAUw"]
[Wed Jan 28 05:20:03.077665 2026] [:error] [pid 64842:tid 64849] [client 45.154.138.35:57363] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Wed Jan 28 05:20:04.494037 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.35:57363] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Wed Jan 28 05:20:05.434715 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.35:57363] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Jan 28 05:20:05.926567 2026] [:error] [pid 64842:tid 64859] [client 45.154.138.35:57363] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Wed Jan 28 05:20:06.862484 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.35:57363] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aXksBluAAQZ5AN_SnDb-2QAAAVI"]
[Wed Jan 28 05:20:11.684366 2026] [:error] [pid 2454:tid 2465] [client 45.154.138.40:21533] [client 45.154.138.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aXksC5vv4I21Ywd7NNbxsQAAAYc"]
[Wed Jan 28 05:20:12.606286 2026] [:error] [pid 2454:tid 2473] [client 45.154.138.28:22171] [client 45.154.138.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aXksDJvv4I21Ywd7NNbxvwAAAY8"]
[Wed Jan 28 05:20:13.543047 2026] [:error] [pid 17425:tid 17483] [client 45.154.138.22:34657] [client 45.154.138.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aXksDarcODKH1Dl7aZArEwAAAFU"]
[Wed Jan 28 05:20:14.464966 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.8:25459] [client 45.154.138.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aXksDmRvtDRvGDe-pItNEAAAAAk"]
[Wed Jan 28 05:20:17.320665 2026] [:error] [pid 17426:tid 17508] [client 45.154.138.28:36243] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Wed Jan 28 05:20:17.783236 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.28:36243] [client 45.154.138.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aXksEU8zvf_03BnziRcEPgAAAIA"]
[Wed Jan 28 05:20:19.245042 2026] [:error] [pid 2454:tid 2472] [client 45.154.138.1:50331] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Jan 28 05:20:19.707257 2026] [:error] [pid 2454:tid 2468] [client 45.154.138.1:50331] File does not exist: /usr/local/apache/htdocs/suspended-page/rcc.php
[Wed Jan 28 05:20:20.177082 2026] [:error] [pid 2454:tid 2466] [client 45.154.138.1:50331] [client 45.154.138.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aXksFJvv4I21Ywd7NNbx_QAAAYg"]
[Wed Jan 28 05:20:21.128453 2026] [:error] [pid 58254:tid 58262] [client 45.154.138.46:57363] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Jan 28 05:20:21.597176 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.46:57363] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Wed Jan 28 05:20:22.060639 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.46:57363] [client 45.154.138.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aXksFvF8nSyBg9wOsa8ZCAAAAQc"]
[Wed Jan 28 05:20:23.021846 2026] [:error] [pid 17426:tid 17493] [client 45.154.138.17:43573] File does not exist: /usr/local/apache/htdocs/suspended-page/history.php
[Wed Jan 28 05:20:23.483491 2026] [:error] [pid 17426:tid 17497] [client 45.154.138.17:43573] [client 45.154.138.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aXksF08zvf_03BnziRcEiwAAAIg"]
[Wed Jan 28 05:20:25.854044 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.22:46075] [client 45.154.138.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aXksGZvv4I21Ywd7NNbySwAAAY0"]
[Wed Jan 28 05:20:26.781793 2026] [:error] [pid 17424:tid 17448] [client 45.154.138.10:23959] [client 45.154.138.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aXksGmRvtDRvGDe-pItNnQAAAA8"]
[Wed Jan 28 05:20:29.217175 2026] [:error] [pid 2454:tid 2467] [client 45.154.138.3:40515] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aXksHZvv4I21Ywd7NNbyjQAAAYk"]
[Wed Jan 28 05:20:30.179125 2026] [:error] [pid 17425:tid 17472] [client 45.154.138.31:48479] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Jan 28 05:20:31.197291 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.31:48479] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Jan 28 05:20:31.675253 2026] [:error] [pid 17425:tid 17471] [client 45.154.138.31:48479] [client 45.154.138.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.31, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aXksH6rcODKH1Dl7aZAsHwAAAEk"]
[Wed Jan 28 05:20:32.615567 2026] [:error] [pid 17425:tid 17487] [client 45.154.138.31:48479] [client 45.154.138.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aXksIKrcODKH1Dl7aZAsLgAAAFg"]
[Wed Jan 28 05:20:33.557649 2026] [:error] [pid 17424:tid 17439] [client 45.154.138.2:23997] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aXksIWRvtDRvGDe-pItN4AAAAAY"]
[Wed Jan 28 05:20:34.489386 2026] [:error] [pid 64842:tid 64853] [client 45.154.138.47:44013] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Jan 28 05:20:34.959975 2026] [:error] [pid 64842:tid 64861] [client 45.154.138.47:44013] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Jan 28 05:20:36.816357 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.47:44013] File does not exist: /usr/local/apache/htdocs/suspended-page/login.php
[Wed Jan 28 05:20:38.261285 2026] [:error] [pid 64842:tid 64845] [client 45.154.138.47:44013] [client 45.154.138.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.47, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aXksJluAAQZ5AN_SnDYAegAAAUE"]
[Wed Jan 28 05:20:38.736327 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.47:44013] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aXksJluAAQZ5AN_SnDYAgAAAAU4"]
[Wed Jan 28 05:20:39.685072 2026] [:error] [pid 2454:tid 2462] [client 45.154.138.2:41269] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aXksJ5vv4I21Ywd7NNbzUAAAAYQ"]
[Wed Jan 28 05:20:40.613367 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.6:61617] [client 45.154.138.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aXksKE8zvf_03BnziRcFKwAAAI4"]
[Wed Jan 28 05:20:42.989893 2026] [:error] [pid 17424:tid 17451] [client 45.154.138.33:40317] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Wed Jan 28 05:20:43.452071 2026] [:error] [pid 17424:tid 17435] [client 45.154.138.33:40317] [client 45.154.138.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aXksK2RvtDRvGDe-pItOZwAAAAI"]
[Wed Jan 28 05:20:44.840494 2026] [:error] [pid 17425:tid 17471] [client 45.154.138.50:39747] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Wed Jan 28 05:20:47.198260 2026] [:error] [pid 17425:tid 17469] [client 45.154.138.50:39747] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Jan 28 05:20:48.609942 2026] [:error] [pid 17425:tid 17487] [client 45.154.138.50:39747] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Wed Jan 28 05:20:49.070621 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.50:39747] [client 45.154.138.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aXksMarcODKH1Dl7aZAtBAAAAEw"]
[Wed Jan 28 05:20:50.460908 2026] [:error] [pid 2454:tid 2463] [client 45.154.138.40:61747] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Wed Jan 28 05:20:51.390346 2026] [:error] [pid 2454:tid 2458] [client 45.154.138.40:61747] [client 45.154.138.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aXksM5vv4I21Ywd7NNb0DgAAAYA"]
[Wed Jan 28 05:20:52.816168 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.50:58707] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Jan 28 05:20:54.220771 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.50:58707] [client 45.154.138.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aXksNq3QiSMgVscnN5If6QAAAM8"]
[Wed Jan 28 05:20:55.139606 2026] [:error] [pid 64842:tid 64861] [client 45.154.138.35:22209] [client 45.154.138.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/autoload_classmap.php"] [unique_id "aXksN1uAAQZ5AN_SnDYBKAAAAVE"]
[Wed Jan 28 05:20:56.578304 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.50:37077] [client 45.154.138.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aXksOFuAAQZ5AN_SnDYBRQAAAVI"]
[Wed Jan 28 05:20:57.983080 2026] [:error] [pid 17535:tid 17554] [client 45.154.138.43:20843] [client 45.154.138.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aXksOa3QiSMgVscnN5IgCAAAANA"]
[Wed Jan 28 05:20:59.399454 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.18:43875] [client 45.154.138.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aXksO_F8nSyBg9wOsa8a4AAAARM"]
[Wed Jan 28 05:21:00.934760 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.48:48069] [client 45.154.138.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aXksPKrcODKH1Dl7aZAtagAAAEI"]
[Wed Jan 28 05:21:02.807618 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.48:23225] [client 45.154.138.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aXksPvF8nSyBg9wOsa8bBAAAAQU"]
[Wed Jan 28 05:21:04.200909 2026] [:error] [pid 17424:tid 17433] [client 45.154.138.5:52703] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Jan 28 05:21:05.138347 2026] [:error] [pid 17424:tid 17433] [client 45.154.138.5:52703] [client 45.154.138.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aXksQWRvtDRvGDe-pItPZQAAAAA"]
[Wed Jan 28 05:21:06.535588 2026] [:error] [pid 2454:tid 2470] [client 45.154.138.35:46305] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Wed Jan 28 05:21:07.031196 2026] [:error] [pid 2454:tid 2474] [client 45.154.138.35:46305] File does not exist: /usr/local/apache/htdocs/suspended-page/conf_upload.php
[Wed Jan 28 05:21:07.510493 2026] [:error] [pid 2454:tid 2482] [client 45.154.138.35:46305] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aXksQ5vv4I21Ywd7NNb1FgAAAZg"]
[Wed Jan 28 05:21:09.367410 2026] [:error] [pid 2454:tid 2462] [client 45.154.138.1:20955] [client 45.154.138.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aXksRZvv4I21Ywd7NNb1NAAAAYQ"]
[Wed Jan 28 05:21:10.315256 2026] [:error] [pid 2454:tid 2459] [client 45.154.138.18:25405] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Wed Jan 28 05:21:11.262182 2026] [:error] [pid 2454:tid 2478] [client 45.154.138.18:25405] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Wed Jan 28 05:21:12.210422 2026] [:error] [pid 2454:tid 2461] [client 45.154.138.18:25405] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Jan 28 05:21:12.673929 2026] [:error] [pid 2454:tid 2460] [client 45.154.138.18:25405] [client 45.154.138.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aXksSJvv4I21Ywd7NNb1eAAAAYI"]
[Wed Jan 28 05:21:14.062411 2026] [:error] [pid 17535:tid 17555] [client 45.154.138.235:43625] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Jan 28 05:21:15.523578 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.235:43625] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Wed Jan 28 05:21:15.993954 2026] [:error] [pid 17535:tid 17558] [client 45.154.138.235:43625] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Jan 28 05:21:17.406941 2026] [:error] [pid 17535:tid 17540] [client 45.154.138.235:43625] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Wed Jan 28 05:21:17.884124 2026] [:error] [pid 17535:tid 17544] [client 45.154.138.235:43625] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Wed Jan 28 05:21:19.751780 2026] [:error] [pid 17535:tid 17551] [client 45.154.138.235:43625] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Wed Jan 28 05:21:20.214613 2026] [:error] [pid 17535:tid 17555] [client 45.154.138.235:43625] [client 45.154.138.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aXksUK3QiSMgVscnN5IhLQAAANE"]
[Wed Jan 28 05:21:21.173881 2026] [:error] [pid 2454:tid 2478] [client 45.154.138.15:39165] [client 45.154.138.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aXksUZvv4I21Ywd7NNb2JAAAAZQ"]
[Wed Jan 28 05:21:22.102479 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.6:22857] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Jan 28 05:21:22.563947 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.6:22857] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Jan 28 05:21:23.028844 2026] [:error] [pid 17424:tid 17439] [client 45.154.138.6:22857] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Jan 28 05:21:23.495324 2026] [:error] [pid 17424:tid 17440] [client 45.154.138.6:22857] [client 45.154.138.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aXksU2RvtDRvGDe-pItQTwAAAAc"]
[Wed Jan 28 05:21:24.420671 2026] [:error] [pid 2454:tid 2464] [client 45.154.138.47:33731] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aXksVJvv4I21Ywd7NNb2SgAAAYY"]
[Wed Jan 28 05:21:25.348293 2026] [:error] [pid 17425:tid 17485] [client 45.154.138.38:34869] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Jan 28 05:21:25.809394 2026] [:error] [pid 17425:tid 17466] [client 45.154.138.38:34869] [client 45.154.138.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aXksVarcODKH1Dl7aZAuKwAAAEQ"]
[Wed Jan 28 05:21:26.738834 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.49:22099] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Wed Jan 28 05:21:27.202035 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.49:22099] File does not exist: /usr/local/apache/htdocs/suspended-page/sck.php
[Wed Jan 28 05:21:27.666949 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.49:22099] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Wed Jan 28 05:21:28.603497 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.49:22099] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Wed Jan 28 05:21:29.072911 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.49:22099] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Jan 28 05:21:29.535681 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.49:22099] [client 45.154.138.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aXksWVuAAQZ5AN_SnDYC4wAAAVc"]
[Wed Jan 28 05:21:31.073023 2026] [:error] [pid 17425:tid 17476] [client 45.154.138.7:24869] [client 45.154.138.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.7, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aXksW6rcODKH1Dl7aZAuagAAAE4"]
[Wed Jan 28 05:21:31.553580 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.7:24869] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Wed Jan 28 05:21:32.013446 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.7:24869] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aXksXKrcODKH1Dl7aZAudAAAAEw"]
[Wed Jan 28 05:21:32.942646 2026] [:error] [pid 2454:tid 2460] [client 45.154.138.235:25023] [client 45.154.138.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aXksXJvv4I21Ywd7NNb2pQAAAYI"]
[Wed Jan 28 05:21:34.346898 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.26:27377] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Jan 28 05:21:34.811809 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.26:27377] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Wed Jan 28 05:21:35.287453 2026] [:error] [pid 17426:tid 17496] [client 45.154.138.26:27377] [client 45.154.138.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aXksX08zvf_03BnziRcIDgAAAIc"]
[Wed Jan 28 05:21:36.237124 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.35:47733] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Wed Jan 28 05:21:36.696802 2026] [:error] [pid 17424:tid 17438] [client 45.154.138.35:47733] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aXksYGRvtDRvGDe-pItRFAAAAAU"]
[Wed Jan 28 05:21:38.099911 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.30:41627] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Jan 28 05:21:38.565048 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.30:41627] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Wed Jan 28 05:21:39.031713 2026] [:error] [pid 58254:tid 58259] [client 45.154.138.30:41627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/cloud.php
[Wed Jan 28 05:21:41.352563 2026] [:error] [pid 58254:tid 58259] [client 45.154.138.30:41627] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Wed Jan 28 05:21:41.847465 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.30:41627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/class_api.php
[Wed Jan 28 05:21:47.382985 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.30:41627] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aXksa_F8nSyBg9wOsa8dfAAAAQQ"]
[Wed Jan 28 05:21:48.305130 2026] [:error] [pid 17424:tid 17451] [client 45.154.138.13:21163] File does not exist: /usr/local/apache/htdocs/suspended-page/base.php
[Wed Jan 28 05:21:49.268301 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.13:21163] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Wed Jan 28 05:21:49.777309 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.13:21163] [client 45.154.138.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aXksbWRvtDRvGDe-pItRnQAAAAs"]
[Wed Jan 28 05:21:51.210447 2026] [:error] [pid 17424:tid 17443] [client 45.154.138.20:20301] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Jan 28 05:21:51.732528 2026] [:error] [pid 17424:tid 17452] [client 45.154.138.20:20301] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Jan 28 05:21:52.193646 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.20:20301] [client 45.154.138.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.20, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aXkscGRvtDRvGDe-pItRuwAAABQ"]
[Wed Jan 28 05:21:52.199791 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.20:20301] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Wed Jan 28 05:21:53.600858 2026] [:error] [pid 17424:tid 17457] [client 45.154.138.20:20301] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Wed Jan 28 05:21:54.096245 2026] [:error] [pid 17424:tid 17443] [client 45.154.138.20:20301] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Jan 28 05:21:55.039340 2026] [:error] [pid 17424:tid 17457] [client 45.154.138.20:20301] [client 45.154.138.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mah.php"] [unique_id "aXksc2RvtDRvGDe-pItR2AAAABg"]
[Wed Jan 28 05:21:55.959434 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.27:51753] [client 45.154.138.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.27, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aXksc6rcODKH1Dl7aZAvnwAAAEw"]
[Wed Jan 28 05:21:56.490735 2026] [:error] [pid 17425:tid 17469] [client 45.154.138.27:51753] [client 45.154.138.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aXksdKrcODKH1Dl7aZAvqQAAAEc"]
[Wed Jan 28 05:22:00.362356 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.23:26507] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Wed Jan 28 05:22:01.846566 2026] [:error] [pid 58254:tid 58262] [client 45.154.138.23:26507] [client 45.154.138.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aXksefF8nSyBg9wOsa8eZAAAAQY"]
[Wed Jan 28 05:22:02.772356 2026] [:error] [pid 17424:tid 17433] [client 45.154.138.8:41439] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Jan 28 05:22:03.699817 2026] [:error] [pid 17424:tid 17436] [client 45.154.138.8:41439] [client 45.154.138.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aXkse2RvtDRvGDe-pItSNQAAAAM"]
[Wed Jan 28 05:22:05.091140 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.5:35579] [client 45.154.138.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.5, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aXksfWRvtDRvGDe-pItSSAAAABc"]
[Wed Jan 28 05:22:06.518953 2026] [:error] [pid 17424:tid 17449] [client 45.154.138.5:35579] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Wed Jan 28 05:22:06.984683 2026] [:error] [pid 17424:tid 17443] [client 45.154.138.5:35579] File does not exist: /usr/local/apache/htdocs/suspended-page/bulk.php
[Wed Jan 28 05:22:07.453129 2026] [:error] [pid 17424:tid 17447] [client 45.154.138.5:35579] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Wed Jan 28 05:22:08.384772 2026] [:error] [pid 17424:tid 17439] [client 45.154.138.5:35579] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logout.php
[Wed Jan 28 05:22:08.846319 2026] [:error] [pid 17424:tid 17449] [client 45.154.138.5:35579] [client 45.154.138.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aXksgGRvtDRvGDe-pItSgwAAABA"]
[Wed Jan 28 05:22:10.243004 2026] [:error] [pid 2454:tid 2479] [client 45.154.138.35:26503] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/packed.php"] [unique_id "aXksgpvv4I21Ywd7NNb4lAAAAZU"]
[Wed Jan 28 05:22:11.167168 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.33:61543] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Jan 28 05:22:11.635369 2026] [:error] [pid 2454:tid 2463] [client 45.154.138.33:61543] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Jan 28 05:22:13.060100 2026] [:error] [pid 2454:tid 2463] [client 45.154.138.33:61543] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Wed Jan 28 05:22:13.530949 2026] [:error] [pid 2454:tid 2463] [client 45.154.138.33:61543] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-simple.php
[Wed Jan 28 05:22:14.943159 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.33:61543] [client 45.154.138.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aXkshpvv4I21Ywd7NNb43wAAAZc"]
[Wed Jan 28 05:22:16.330439 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.13:37875] [client 45.154.138.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aXksiJvv4I21Ywd7NNb49gAAAZc"]
[Wed Jan 28 05:22:17.725948 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.28:54193] [client 45.154.138.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aXksiZvv4I21Ywd7NNb5DgAAAZc"]
[Wed Jan 28 05:22:18.655744 2026] [:error] [pid 17535:tid 17557] [client 45.154.138.4:27829] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Jan 28 05:22:20.533262 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.4:27829] [client 45.154.138.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.4, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aXksjK3QiSMgVscnN5Ij9AAAAMc"]
[Wed Jan 28 05:22:21.010733 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.4:27829] [client 45.154.138.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aXksjK3QiSMgVscnN5Ij-wAAAM8"]
[Wed Jan 28 05:22:23.349368 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.25:46599] [client 45.154.138.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/header.php"] [unique_id "aXksj1uAAQZ5AN_SnDYFTQAAAUw"]
[Wed Jan 28 05:22:24.275265 2026] [:error] [pid 17424:tid 17454] [client 45.154.138.32:39413] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Wed Jan 28 05:22:24.743404 2026] [:error] [pid 17424:tid 17440] [client 45.154.138.32:39413] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Wed Jan 28 05:22:25.682374 2026] [:error] [pid 17424:tid 17433] [client 45.154.138.32:39413] [client 45.154.138.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aXkskWRvtDRvGDe-pItTdQAAAAA"]
[Wed Jan 28 05:22:26.602419 2026] [:error] [pid 17426:tid 17499] [client 45.154.138.12:39393] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aXkskk8zvf_03BnziRcLDwAAAIo"]
[Wed Jan 28 05:22:27.531059 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.19:35699] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Wed Jan 28 05:22:29.404600 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.19:35699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/moon.php
[Wed Jan 28 05:22:30.891276 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.19:35699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/dropdown.php
[Wed Jan 28 05:22:31.371368 2026] [:error] [pid 64842:tid 64853] [client 45.154.138.19:35699] [client 45.154.138.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aXksl1uAAQZ5AN_SnDYFvAAAAUk"]
[Wed Jan 28 05:22:32.303172 2026] [:error] [pid 17424:tid 17441] [client 45.154.138.22:53407] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Jan 28 05:22:32.775923 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.22:53407] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Wed Jan 28 05:22:33.723022 2026] [:error] [pid 17424:tid 17445] [client 45.154.138.22:53407] [client 45.154.138.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/votes.php"] [unique_id "aXksmWRvtDRvGDe-pItT0AAAAAw"]
[Wed Jan 28 05:22:36.584503 2026] [:error] [pid 17425:tid 17483] [client 45.154.138.17:29299] File does not exist: /usr/local/apache/htdocs/suspended-page/sk.php
[Wed Jan 28 05:22:37.511352 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.17:29299] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/blurbs.php
[Wed Jan 28 05:22:38.438625 2026] [:error] [pid 17425:tid 17472] [client 45.154.138.17:29299] [client 45.154.138.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "aXksnqrcODKH1Dl7aZAyLgAAAEo"]
[Wed Jan 28 05:22:41.231823 2026] [:error] [pid 17535:tid 17552] [client 45.154.138.15:36907] [client 45.154.138.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aXksoa3QiSMgVscnN5Ik9AAAAM4"]
[Wed Jan 28 05:22:43.551005 2026] [:error] [pid 17426:tid 17492] [client 45.154.138.15:65249] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Wed Jan 28 05:22:44.945863 2026] [:error] [pid 17426:tid 17499] [client 45.154.138.15:65249] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Jan 28 05:22:45.408316 2026] [:error] [pid 17426:tid 17498] [client 45.154.138.15:65249] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Wed Jan 28 05:22:45.892397 2026] [:error] [pid 17426:tid 17506] [client 45.154.138.15:65249] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Wed Jan 28 05:22:46.354501 2026] [:error] [pid 17426:tid 17497] [client 45.154.138.15:65249] [client 45.154.138.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aXkspk8zvf_03BnziRcMRAAAAIg"]
[Wed Jan 28 05:22:47.276896 2026] [:error] [pid 17535:tid 17554] [client 45.154.138.47:31249] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/doc.php
[Wed Jan 28 05:22:47.739041 2026] [:error] [pid 17535:tid 17548] [client 45.154.138.47:31249] File does not exist: /usr/local/apache/htdocs/suspended-page/fm1.php
[Wed Jan 28 05:22:49.145274 2026] [:error] [pid 17535:tid 17539] [client 45.154.138.47:31249] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Wed Jan 28 05:22:49.650105 2026] [:error] [pid 17535:tid 17558] [client 45.154.138.47:31249] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aXksqa3QiSMgVscnN5IlbwAAANQ"]
[Wed Jan 28 05:22:50.573053 2026] [:error] [pid 58254:tid 58271] [client 45.154.138.39:58397] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Wed Jan 28 05:22:51.041491 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.39:58397] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Jan 28 05:22:51.985616 2026] [:error] [pid 58254:tid 58267] [client 45.154.138.39:58397] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Wed Jan 28 05:22:52.916446 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.39:58397] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi01.php
[Wed Jan 28 05:22:54.315125 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.39:58397] [client 45.154.138.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/item.php"] [unique_id "aXksrvF8nSyBg9wOsa8g-AAAARQ"]
[Wed Jan 28 05:22:58.038190 2026] [:error] [pid 17535:tid 17544] [client 45.154.138.44:56973] [client 45.154.138.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.44, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aXkssq3QiSMgVscnN5IlzgAAAMY"]
[Wed Jan 28 05:22:58.502618 2026] [:error] [pid 17535:tid 17548] [client 45.154.138.44:56973] [client 45.154.138.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.44, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aXkssq3QiSMgVscnN5Il1wAAAMo"]
[Wed Jan 28 05:22:58.969399 2026] [:error] [pid 17535:tid 17562] [client 45.154.138.44:56973] [client 45.154.138.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mani.php"] [unique_id "aXkssq3QiSMgVscnN5Il3gAAANg"]
[Wed Jan 28 05:22:59.895485 2026] [:error] [pid 17535:tid 17562] [client 45.154.138.1:54563] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Jan 28 05:23:03.753975 2026] [:error] [pid 17535:tid 17555] [client 45.154.138.1:54563] [client 45.154.138.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aXkst63QiSMgVscnN5ImIgAAANE"]
[Wed Jan 28 05:23:04.683592 2026] [:error] [pid 17425:tid 17471] [client 45.154.138.9:22483] File does not exist: /usr/local/apache/htdocs/suspended-page/images.php
[Wed Jan 28 05:23:05.147509 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.9:22483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aespa.php
[Wed Jan 28 05:23:05.607751 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.9:22483] [client 45.154.138.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aXksuarcODKH1Dl7aZAz1gAAAFA"]
[Wed Jan 28 05:23:08.426482 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.35:63175] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mariju.php
[Wed Jan 28 05:23:09.834216 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.35:63175] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/themes.php
[Wed Jan 28 05:23:10.768416 2026] [:error] [pid 17425:tid 17466] [client 45.154.138.35:63175] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aXksvqrcODKH1Dl7aZA0EQAAAEQ"]
[Wed Jan 28 05:23:11.720508 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.46:39913] [client 45.154.138.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aXksv63QiSMgVscnN5ImewAAAMc"]
[Wed Jan 28 05:23:13.110883 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.44:53989] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Jan 28 05:23:14.509375 2026] [:error] [pid 17425:tid 17485] [client 45.154.138.44:53989] [client 45.154.138.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.44, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-login.php"] [unique_id "aXkswqrcODKH1Dl7aZA0MwAAAFY"]
[Wed Jan 28 05:23:16.400487 2026] [:error] [pid 17425:tid 17485] [client 45.154.138.44:53989] [client 45.154.138.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aXksxKrcODKH1Dl7aZA0RAAAAFY"]
[Wed Jan 28 05:23:17.336312 2026] [:error] [pid 17425:tid 17472] [client 45.154.138.46:48705] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Jan 28 05:23:17.795506 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.46:48705] [client 45.154.138.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aXksxarcODKH1Dl7aZA0TgAAAEE"]
[Wed Jan 28 05:23:18.714316 2026] [:error] [pid 2454:tid 2475] [client 45.154.138.12:54057] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aXksxpvv4I21Ywd7NNb8xwAAAZE"]
[Wed Jan 28 05:23:20.114210 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.37:29275] [client 45.154.138.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aXksyFuAAQZ5AN_SnDYIrAAAAU4"]
[Wed Jan 28 05:23:23.429022 2026] [:error] [pid 58254:tid 58274] [client 45.154.138.41:63545] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/parx.php
[Wed Jan 28 05:23:24.399975 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.41:63545] [client 45.154.138.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aXkszPF8nSyBg9wOsa8iiQAAARc"]
[Wed Jan 28 05:23:25.799648 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.45:37133] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Wed Jan 28 05:23:26.263348 2026] [:error] [pid 58254:tid 58280] [client 45.154.138.45:37133] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Jan 28 05:23:28.147155 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.45:37133] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Wed Jan 28 05:23:28.622787 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.45:37133] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Wed Jan 28 05:23:29.113818 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.45:37133] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Wed Jan 28 05:23:29.591558 2026] [:error] [pid 58254:tid 58266] [client 45.154.138.45:37133] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Jan 28 05:23:30.537449 2026] [:error] [pid 58254:tid 58280] [client 45.154.138.45:37133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Jan 28 05:23:32.027125 2026] [:error] [pid 58254:tid 58257] [client 45.154.138.45:37133] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/radio.php"] [unique_id "aXks1PF8nSyBg9wOsa8jFQAAAQE"]
[Wed Jan 28 05:23:33.437791 2026] [:error] [pid 17535:tid 17557] [client 45.154.138.41:49839] File does not exist: /usr/local/apache/htdocs/suspended-page/payout.php
[Wed Jan 28 05:23:33.902895 2026] [:error] [pid 17535:tid 17559] [client 45.154.138.41:49839] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Jan 28 05:23:34.382686 2026] [:error] [pid 17535:tid 17539] [client 45.154.138.41:49839] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Jan 28 05:23:34.850419 2026] [:error] [pid 17535:tid 17551] [client 45.154.138.41:49839] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Wed Jan 28 05:23:35.791033 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.41:49839] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Wed Jan 28 05:23:36.256894 2026] [:error] [pid 17535:tid 17538] [client 45.154.138.41:49839] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Wed Jan 28 05:23:37.211994 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.41:49839] [client 45.154.138.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aXks2a3QiSMgVscnN5In2gAAAMg"]
[Wed Jan 28 05:23:40.489387 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.37:38791] [client 45.154.138.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aXks3KrcODKH1Dl7aZA1ZwAAAFA"]
[Wed Jan 28 05:23:41.890958 2026] [:error] [pid 58254:tid 58273] [client 45.154.138.36:54085] [client 45.154.138.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aXks3fF8nSyBg9wOsa8juwAAARE"]
[Wed Jan 28 05:23:42.815849 2026] [:error] [pid 17425:tid 17468] [client 45.154.138.44:30895] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Jan 28 05:23:43.308392 2026] [:error] [pid 17425:tid 17465] [client 45.154.138.44:30895] File does not exist: /usr/local/apache/htdocs/suspended-page/fox.php
[Wed Jan 28 05:23:43.776026 2026] [:error] [pid 17425:tid 17473] [client 45.154.138.44:30895] File does not exist: /usr/local/apache/htdocs/suspended-page/google.php
[Wed Jan 28 05:23:44.758306 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.44:30895] File does not exist: /usr/local/apache/htdocs/suspended-page/ovatools.php
[Wed Jan 28 05:23:45.236394 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.44:30895] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwso.php
[Wed Jan 28 05:23:45.714386 2026] [:error] [pid 17425:tid 17485] [client 45.154.138.44:30895] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Wed Jan 28 05:23:46.185604 2026] [:error] [pid 17425:tid 17468] [client 45.154.138.44:30895] [client 45.154.138.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aXks4qrcODKH1Dl7aZA1xQAAAEY"]
[Wed Jan 28 05:23:47.106527 2026] [:error] [pid 17425:tid 17485] [client 45.154.138.101:57549] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aXks46rcODKH1Dl7aZA1zwAAAFY"]
[Wed Jan 28 05:23:49.008767 2026] [:error] [pid 2454:tid 2480] [client 45.154.138.36:56715] [client 45.154.138.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aXks5Zvv4I21Ywd7NNb-jgAAAZY"]
[Wed Jan 28 05:23:50.410577 2026] [:error] [pid 17426:tid 17511] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Wed Jan 28 05:23:50.876927 2026] [:error] [pid 17426:tid 17496] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Wed Jan 28 05:23:51.342137 2026] [:error] [pid 17426:tid 17504] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/style2.php
[Wed Jan 28 05:23:51.809288 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scripts.php
[Wed Jan 28 05:23:52.276665 2026] [:error] [pid 17426:tid 17504] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Jan 28 05:23:52.741947 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Wed Jan 28 05:23:53.208458 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/comfunctions.php
[Wed Jan 28 05:23:53.672903 2026] [:error] [pid 17426:tid 17508] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Wed Jan 28 05:23:54.140101 2026] [:error] [pid 17426:tid 17501] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Wed Jan 28 05:23:54.638626 2026] [:error] [pid 17426:tid 17512] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Wed Jan 28 05:23:55.103680 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/hinfofuns.php
[Wed Jan 28 05:23:55.569098 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/qfunctions.php
[Wed Jan 28 05:23:56.038423 2026] [:error] [pid 17426:tid 17506] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/qinfofuns.php
[Wed Jan 28 05:23:56.514147 2026] [:error] [pid 17426:tid 17510] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Wed Jan 28 05:23:56.978208 2026] [:error] [pid 17426:tid 17491] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Wed Jan 28 05:23:57.460177 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.4:22735] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php
[Wed Jan 28 05:23:57.929428 2026] [:error] [pid 17426:tid 17495] [client 45.154.138.4:22735] [client 45.154.138.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aXks7U8zvf_03BnziRcP3QAAAIY"]
[Wed Jan 28 05:23:58.879944 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Wed Jan 28 05:23:59.345361 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Jan 28 05:23:59.812901 2026] [:error] [pid 17424:tid 17454] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/my-sites.php
[Wed Jan 28 05:24:00.276872 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Wed Jan 28 05:24:00.744125 2026] [:error] [pid 17424:tid 17457] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/nav-menus.php
[Wed Jan 28 05:24:01.214562 2026] [:error] [pid 17424:tid 17436] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Wed Jan 28 05:24:01.679672 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Wed Jan 28 05:24:02.150391 2026] [:error] [pid 17424:tid 17452] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/revision.php
[Wed Jan 28 05:24:02.617451 2026] [:error] [pid 17424:tid 17454] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Wed Jan 28 05:24:03.081592 2026] [:error] [pid 17424:tid 17455] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Jan 28 05:24:03.551214 2026] [:error] [pid 17424:tid 17436] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Jan 28 05:24:04.016232 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Wed Jan 28 05:24:04.502052 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.45:25901] File does not exist: /usr/local/apache/htdocs/suspended-page/moded.php
[Wed Jan 28 05:24:04.962492 2026] [:error] [pid 17424:tid 17454] [client 45.154.138.45:25901] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aXks9GRvtDRvGDe-pItXqwAAABU"]
[Wed Jan 28 05:24:05.893742 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/upgrade.php
[Wed Jan 28 05:24:06.364340 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/gh.php
[Wed Jan 28 05:24:06.833411 2026] [:error] [pid 64842:tid 64851] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/version.php
[Wed Jan 28 05:24:07.317097 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/head.php
[Wed Jan 28 05:24:07.786033 2026] [:error] [pid 64842:tid 64848] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Wed Jan 28 05:24:08.252243 2026] [:error] [pid 64842:tid 64849] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/theme-insqbzk.php
[Wed Jan 28 05:24:08.716041 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Wed Jan 28 05:24:09.191030 2026] [:error] [pid 64842:tid 64849] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Wed Jan 28 05:24:10.157445 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.45:36041] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Wed Jan 28 05:24:10.633452 2026] [:error] [pid 64842:tid 64853] [client 45.154.138.45:36041] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "aXks-luAAQZ5AN_SnDYL-gAAAUk"]
[Wed Jan 28 05:24:13.004564 2026] [:error] [pid 64842:tid 64845] [client 45.154.138.30:60125] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Wed Jan 28 05:24:17.754848 2026] [:error] [pid 64842:tid 64844] [client 45.154.138.30:60125] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aXktAVuAAQZ5AN_SnDYMUAAAAUA"]
[Wed Jan 28 05:24:18.678871 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.235:58455] [client 45.154.138.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aXktAmRvtDRvGDe-pItYbQAAAAQ"]
[Wed Jan 28 05:24:20.558012 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.1:52283] [client 45.154.138.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aXktBPF8nSyBg9wOsa8lfQAAAQ4"]
[Wed Jan 28 05:24:21.962908 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.11:51109] [client 45.154.138.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/repeater.php"] [unique_id "aXktBWRvtDRvGDe-pItYugAAABE"]
[Wed Jan 28 05:24:24.313626 2026] [:error] [pid 58254:tid 58273] [client 45.154.138.28:31933] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php
[Wed Jan 28 05:24:24.816093 2026] [:error] [pid 58254:tid 58257] [client 45.154.138.28:31933] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php
[Wed Jan 28 05:24:25.764012 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.28:31933] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php
[Wed Jan 28 05:24:26.701918 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.28:31933] [client 45.154.138.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php7"] [unique_id "aXktCvF8nSyBg9wOsa8l1gAAAQU"]
[Wed Jan 28 05:24:30.566852 2026] [:error] [pid 17426:tid 17511] [client 45.154.138.14:58121] [client 45.154.138.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aXktDk8zvf_03BnziRcRXgAAAJY"]
[Wed Jan 28 05:24:31.544642 2026] [:error] [pid 2454:tid 2476] [client 45.154.138.26:54945] [client 45.154.138.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aXktD5vv4I21Ywd7NNYBkAAAAZI"]
[Wed Jan 28 05:24:48.414499 2026] [autoindex:error] [pid 2454:tid 2466] [client 45.154.138.35:45615] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:06.322873 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.24:39597] [client 45.154.138.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/images/"] [unique_id "aXktMqrcODKH1Dl7aZA5VgAAAEI"]
[Wed Jan 28 05:25:09.624330 2026] [:error] [pid 17426:tid 17502] [client 45.154.138.7:33889] [client 45.154.138.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/components/"] [unique_id "aXktNU8zvf_03BnziRcTYgAAAI0"]
[Wed Jan 28 05:25:50.405888 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.27:35501] [client 45.154.138.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-stab/"] [unique_id "aXktXvF8nSyBg9wOsa8qAAAAARQ"]
[Wed Jan 28 05:26:10.834961 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.10:56157] [client 45.154.138.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/"] [unique_id "aXktcluAAQZ5AN_SnDYSIwAAAVU"]
[Wed Jan 28 05:26:15.070451 2026] [:error] [pid 17424:tid 17434] [client 45.154.138.7:24677] [client 45.154.138.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/"] [unique_id "aXktd2RvtDRvGDe-pIte3AAAAAE"]
[Wed Jan 28 05:28:02.983161 2026] [:error] [pid 17425:tid 17483] [client 45.154.138.8:33821] [client 45.154.138.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/alera/"] [unique_id "aXkt4qrcODKH1Dl7aZBB0QAAAFU"]
[Wed Jan 28 07:09:04.084340 2026] [:error] [pid 17535:tid 17555] [client 141.98.11.239:65391] [client 141.98.11.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.239, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXlFkK3QiSMgVscnN5JVyQAAANE"]
[Wed Jan 28 07:09:04.084430 2026] [:error] [pid 17535:tid 17555] [client 141.98.11.239:65391] [client 141.98.11.239] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 141.98.11.239 on wp-login.php, counter = 135"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXlFkK3QiSMgVscnN5JVyQAAANE"]
[Wed Jan 28 07:23:52.162116 2026] [:error] [pid 17424:tid 17447] [client 20.205.97.28:10881] [client 20.205.97.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/"] [unique_id "aXlJCGRvtDRvGDe-pIuEaAAAAA4"]
[Wed Jan 28 07:23:52.643349 2026] [:error] [pid 26993:tid 27018] [client 20.205.97.28:11871] [client 20.205.97.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/"] [unique_id "aXlJCGnuZQRiIvPvxUtezgAAAdU"]
[Wed Jan 28 07:23:53.119084 2026] [:error] [pid 58254:tid 58260] [client 20.205.97.28:11843] [client 20.205.97.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/"] [unique_id "aXlJCfF8nSyBg9wOsa9SzAAAAQQ"]
[Wed Jan 28 07:23:53.592833 2026] [:error] [pid 58254:tid 58271] [client 20.205.97.28:11895] [client 20.205.97.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/"] [unique_id "aXlJCfF8nSyBg9wOsa9S1gAAAQ8"]
[Wed Jan 28 07:48:05.448400 2026] [:error] [pid 26993:tid 26998] [client 134.122.11.22:62844] [client 134.122.11.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aXlOtWnuZQRiIvPvxUtnKgAAAcE"], referer: binance.com
[Wed Jan 28 07:48:37.529602 2026] [:error] [pid 26993:tid 27017] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Jan 28 07:48:39.213701 2026] [:error] [pid 26993:tid 27003] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Jan 28 07:48:40.053291 2026] [:error] [pid 26993:tid 26997] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Jan 28 07:48:40.873914 2026] [:error] [pid 26993:tid 27021] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Jan 28 07:48:42.582815 2026] [:error] [pid 26993:tid 27008] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Jan 28 07:48:43.430301 2026] [:error] [pid 26993:tid 27000] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Jan 28 07:48:44.288939 2026] [:error] [pid 26993:tid 27007] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Wed Jan 28 07:48:46.629966 2026] [:error] [pid 26993:tid 27011] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Jan 28 07:48:46.767129 2026] [:error] [pid 26993:tid 27001] [client 104.208.113.220:11103] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Jan 28 07:48:47.749865 2026] [:error] [pid 26993:tid 27014] [client 104.208.113.220:11103] [client 104.208.113.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXlO32nuZQRiIvPvxUtnRgAAAdE"]
[Wed Jan 28 07:48:48.249342 2026] [:error] [pid 58254:tid 58269] [client 104.208.113.220:24435] [client 104.208.113.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXlO4PF8nSyBg9wOsa9W1QAAAQ0"]
[Wed Jan 28 07:48:48.753337 2026] [:error] [pid 58254:tid 58270] [client 104.208.113.220:9132] [client 104.208.113.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXlO4PF8nSyBg9wOsa9W1gAAAQ4"]
[Wed Jan 28 07:48:49.251989 2026] [:error] [pid 17426:tid 17502] [client 104.208.113.220:9118] [client 104.208.113.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "aXlO4U8zvf_03BnziRdKdwAAAI0"]
[Wed Jan 28 14:53:58.210368 2026] [:error] [pid 24452:tid 24475] [client 161.118.211.239:64201] [client 161.118.211.239] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXmyhv0RQOh_GmqmVyYM4AAAAZU"]
[Wed Jan 28 14:54:01.633828 2026] [:error] [pid 42740:tid 42762] [client 161.118.211.239:53897] [client 161.118.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.211.239, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aXmyiVnjAS34srJlXgRYJQAAAJQ"]
[Wed Jan 28 14:54:01.637893 2026] [:error] [pid 42740:tid 42762] [client 161.118.211.239:53897] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Jan 28 18:59:54.227244 2026] [:error] [pid 33636:tid 33657] [client 177.200.46.163:52143] [client 177.200.46.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.200.46.163, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXnsKtIVZAudQH0BSC4k7AAAAhM"]
[Wed Jan 28 18:59:54.232512 2026] [:error] [pid 33636:tid 33657] [client 177.200.46.163:52143] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 28 23:15:50.713215 2026] [:error] [pid 24482:tid 24498] [client 213.209.159.151:45314] [client 213.209.159.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXooJqLaUZr_xWekSHPH4QAAAcw"]
[Wed Jan 28 23:16:22.728641 2026] [:error] [pid 33490:tid 33524] [client 213.209.159.151:33852] [client 213.209.159.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aXooRmjexcy58gsBPJHqYAAAAEA"]
[Thu Jan 29 02:03:36.023993 2026] [:error] [pid 30727:tid 30749] [client 167.71.209.149:62643] [client 167.71.209.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aXpPeJ6XAsWrB4DloY_NDQAAABI"]
[Thu Jan 29 03:33:22.245647 2026] [:error] [pid 16050:tid 16073] [client 47.90.227.150:33312] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXpkguFPpSEbViHfa9KP-gAAANM"]
[Thu Jan 29 03:33:22.877609 2026] [:error] [pid 15950:tid 16034] [client 47.90.227.150:37926] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXpkgoJOXwUqBC55abQrNwAAAI8"]
[Thu Jan 29 14:39:50.206287 2026] [:error] [pid 19070:tid 19113] [client 45.148.10.154:52346] [client 45.148.10.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aXsAtrou83lIon_aKgaeIwAAAEc"]
[Thu Jan 29 14:39:53.821908 2026] [:error] [pid 20486:tid 20493] [client 45.148.10.154:52362] [client 45.148.10.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/wc.db"] [unique_id "aXsAuXgqSZb6GBx5nnOlTAAAAQQ"]
[Thu Jan 29 14:39:55.543281 2026] [:error] [pid 20486:tid 20498] [client 45.148.10.154:52376] [client 45.148.10.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.svn/entries"] [unique_id "aXsAu3gqSZb6GBx5nnOlUAAAAQk"]
[Thu Jan 29 21:04:24.065050 2026] [:error] [pid 19177:tid 19195] [client 103.253.146.172:65464] [client 103.253.146.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aXta2HipGz0PT8TrQv6VggAAANA"]
[Thu Jan 29 22:28:00.267257 2026] [:error] [pid 20579:tid 20642] [client 47.90.227.150:58734] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXtucDVXNopcNyjJc9UxogAAAkE"]
[Thu Jan 29 22:28:00.905993 2026] [:error] [pid 20578:tid 20613] [client 47.90.227.150:54490] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aXtucA6UX7yOMwQFiydKHgAAAgA"]
[Fri Jan 30 00:09:39.912562 2026] [:error] [pid 39592:tid 39615] [client 38.183.50.57:36404] [client 38.183.50.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.183.50.57, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aXuGQ5lnGYODSsJUyHkkFgAAANI"]
[Fri Jan 30 00:09:39.918350 2026] [:error] [pid 39592:tid 39615] [client 38.183.50.57:36404] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Jan 30 04:42:15.194970 2026] [:error] [pid 46913:tid 46962] [client 217.154.172.107:52435] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Fri Jan 30 04:42:25.581229 2026] [:error] [pid 46914:tid 46983] [client 217.154.172.107:56872] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Fri Jan 30 04:43:00.457051 2026] [:error] [pid 47021:tid 47030] [client 217.154.172.107:58346] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Fri Jan 30 04:43:07.524834 2026] [:error] [pid 46913:tid 46969] [client 217.154.172.107:57674] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Fri Jan 30 06:28:29.628763 2026] [:error] [pid 38980:tid 38993] [client 164.90.142.198:62086] [client 164.90.142.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/"] [unique_id "aXvfDbYByxUZEaKXdHrpjAAAAgY"], referer: binance.com
[Fri Jan 30 06:28:34.282680 2026] [:error] [pid 46914:tid 47000] [client 164.90.142.198:50192] [client 164.90.142.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aXvfElgSfJ4kZxNKlb--TwAAAJY"], referer: binance.com
[Fri Jan 30 06:28:38.884946 2026] [:error] [pid 24711:tid 24731] [client 164.90.142.198:62044] [client 164.90.142.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aXvfFq5Gwh4var6T23JPLAAAAVE"], referer: binance.com
[Fri Jan 30 22:13:23.752246 2026] [:error] [pid 46913:tid 46958] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Jan 30 22:13:24.312698 2026] [:error] [pid 46913:tid 46951] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Jan 30 22:13:24.870369 2026] [:error] [pid 46913:tid 46964] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Jan 30 22:13:25.444369 2026] [:error] [pid 46913:tid 46970] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Jan 30 22:13:26.004952 2026] [:error] [pid 46913:tid 46963] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Jan 30 22:13:26.556368 2026] [:error] [pid 46913:tid 46975] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Jan 30 22:13:27.109843 2026] [:error] [pid 46913:tid 46960] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Jan 30 22:13:27.661111 2026] [:error] [pid 46913:tid 46970] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Jan 30 22:13:28.765365 2026] [:error] [pid 46913:tid 46952] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Jan 30 22:13:29.873638 2026] [:error] [pid 46913:tid 46951] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Jan 30 22:13:30.450490 2026] [:error] [pid 46913:tid 46974] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Jan 30 22:13:31.052200 2026] [:error] [pid 46913:tid 46960] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Jan 30 22:13:31.623050 2026] [:error] [pid 46913:tid 46958] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Jan 30 22:13:32.177306 2026] [:error] [pid 46913:tid 46962] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Jan 30 22:13:32.736466 2026] [:error] [pid 46913:tid 46968] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Jan 30 22:13:33.320486 2026] [:error] [pid 46913:tid 46957] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Jan 30 22:13:33.877116 2026] [:error] [pid 46913:tid 46958] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Jan 30 22:13:34.431280 2026] [:error] [pid 46913:tid 46964] [client 45.137.126.17:53225] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Jan 30 22:13:44.703174 2026] [:error] [pid 46913:tid 46969] [client 45.137.126.17:53225] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aXy8mDMWmKL8hOfC3uThPQAAAFI"]
[Fri Jan 30 22:13:47.473248 2026] [:error] [pid 24711:tid 24727] [client 45.137.126.19:53449] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aXy8m65Gwh4var6T23K6_wAAAU0"]
[Fri Jan 30 22:13:50.266875 2026] [:error] [pid 24712:tid 24742] [client 45.137.126.29:33561] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Jan 30 22:13:54.092288 2026] [:error] [pid 24712:tid 24746] [client 45.137.126.29:33561] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aXy8ooRLQrFiQF3h9-tivAAAAYU"]
[Fri Jan 30 22:13:56.311698 2026] [:error] [pid 24711:tid 24736] [client 45.137.126.20:56039] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Jan 30 22:13:56.861049 2026] [:error] [pid 24711:tid 24728] [client 45.137.126.20:56039] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aXy8pK5Gwh4var6T23K7ZQAAAU4"]
[Fri Jan 30 22:14:44.405494 2026] [:error] [pid 46913:tid 46964] [client 45.137.126.52:61725] [client 45.137.126.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/images/"] [unique_id "aXy81DMWmKL8hOfC3uTj3AAAAE0"]
[Fri Jan 30 22:45:23.960521 2026] [:error] [pid 46912:tid 46946] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/thebe.php
[Fri Jan 30 22:45:24.229756 2026] [:error] [pid 46912:tid 46945] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Fri Jan 30 22:45:24.724812 2026] [:error] [pid 46912:tid 46932] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/sanity.php
[Fri Jan 30 22:45:24.991404 2026] [:error] [pid 46912:tid 46934] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/anj.php
[Fri Jan 30 22:45:25.259299 2026] [:error] [pid 46912:tid 46940] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/baixy.php
[Fri Jan 30 22:45:25.527698 2026] [:error] [pid 46912:tid 46933] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Fri Jan 30 22:45:25.823306 2026] [:error] [pid 46912:tid 46936] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Fri Jan 30 22:45:26.090831 2026] [:error] [pid 46912:tid 46942] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Fri Jan 30 22:45:26.357988 2026] [:error] [pid 46912:tid 46943] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/zmia.php
[Fri Jan 30 22:45:26.624043 2026] [:error] [pid 46912:tid 46944] [client 20.240.47.47:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/edorxrr.php
[Fri Jan 30 22:45:26.887409 2026] [:error] [pid 46912:tid 46930] [client 20.240.47.47:29183] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doko.php"] [unique_id "aXzEBj6yiVW7A9NwFFkR0gAAAAY"]
[Fri Jan 30 22:45:29.070678 2026] [:error] [pid 47021:tid 47030] [client 20.240.47.47:55484] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doko.php"] [unique_id "aXzECdap1k13UdZUNSRvtAAAAMc"]
[Fri Jan 30 22:45:31.047379 2026] [:error] [pid 38980:tid 38987] [client 20.240.47.47:51259] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doko.php"] [unique_id "aXzEC7YByxUZEaKXdHrHdwAAAgA"]
[Fri Jan 30 22:45:32.709921 2026] [:error] [pid 38686:tid 38704] [client 20.240.47.47:51500] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doko.php"] [unique_id "aXzEDAoE8BAjgw1_sAWN7QAAAc4"]
[Fri Jan 30 22:45:44.636340 2026] [:error] [pid 47021:tid 47023] [client 20.240.47.47:35188] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sst.php"] [unique_id "aXzEGNap1k13UdZUNSRvxAAAAMA"]
[Fri Jan 30 22:45:45.828991 2026] [:error] [pid 38686:tid 38707] [client 20.240.47.47:19667] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sst.php"] [unique_id "aXzEGQoE8BAjgw1_sAWN8wAAAdE"]
[Fri Jan 30 22:45:50.020405 2026] [:error] [pid 47021:tid 47042] [client 20.240.47.47:55474] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aXzEHtap1k13UdZUNSRvyAAAANM"]
[Fri Jan 30 22:45:52.510693 2026] [:error] [pid 24681:tid 24684] [client 20.240.47.47:38424] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aXzEIIE368IXQpahn0KiqwAAAQE"]
[Fri Jan 30 22:45:55.404427 2026] [:error] [pid 38980:tid 39010] [client 20.240.47.47:45086] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aXzEI7YByxUZEaKXdHrHggAAAhc"]
[Fri Jan 30 22:46:00.133359 2026] [:error] [pid 46913:tid 46953] [client 20.240.47.47:38453] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aXzEKDMWmKL8hOfC3uTtzwAAAEI"]
[Fri Jan 30 22:46:02.074195 2026] [:error] [pid 46914:tid 47001] [client 20.240.47.47:32081] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aXzEKlgSfJ4kZxNKlb_2eAAAAJc"]
[Fri Jan 30 22:46:03.161976 2026] [:error] [pid 46914:tid 47002] [client 20.240.47.47:39609] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aXzEK1gSfJ4kZxNKlb_2eQAAAJg"]
[Fri Jan 30 22:46:09.248036 2026] [:error] [pid 38686:tid 38709] [client 20.240.47.47:28383] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aXzEMQoE8BAjgw1_sAWOBAAAAdM"]
[Fri Jan 30 22:46:10.606240 2026] [:error] [pid 46912:tid 46922] [client 20.240.47.47:43721] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aXzEMj6yiVW7A9NwFFkR-QAAAAA"]
[Fri Jan 30 22:46:14.109917 2026] [:error] [pid 46912:tid 46932] [client 20.240.47.47:45039] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aXzENj6yiVW7A9NwFFkSAgAAAAg"]
[Fri Jan 30 22:46:16.665430 2026] [:error] [pid 24711:tid 24727] [client 20.240.47.47:38369] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aXzEOK5Gwh4var6T23LPogAAAU0"]
[Fri Jan 30 22:46:20.481848 2026] [:error] [pid 47663:tid 47673] [client 20.240.47.47:44457] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aXzEPEHGTrgIKCqEYbW4OQAAAkg"]
[Fri Jan 30 22:46:21.540633 2026] [:error] [pid 24711:tid 24733] [client 20.240.47.47:35215] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aXzEPa5Gwh4var6T23LPqQAAAVM"]
[Fri Jan 30 22:46:34.025103 2026] [:error] [pid 24712:tid 24741] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Fri Jan 30 22:46:35.054042 2026] [:error] [pid 24712:tid 24741] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/icoxp.php
[Fri Jan 30 22:46:35.477479 2026] [:error] [pid 24712:tid 24756] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Fri Jan 30 22:46:35.757914 2026] [:error] [pid 24712:tid 24743] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Fri Jan 30 22:46:36.169114 2026] [:error] [pid 24712:tid 24742] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Jan 30 22:46:36.434999 2026] [:error] [pid 24712:tid 24754] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Fri Jan 30 22:46:36.699640 2026] [:error] [pid 24712:tid 24745] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/tempae.php
[Fri Jan 30 22:46:36.967181 2026] [:error] [pid 24712:tid 24752] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/drfabyqp.php
[Fri Jan 30 22:46:37.243031 2026] [:error] [pid 24712:tid 24748] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Jan 30 22:46:37.509380 2026] [:error] [pid 24712:tid 24766] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Fri Jan 30 22:46:37.838921 2026] [:error] [pid 24712:tid 24744] [client 20.240.47.47:39589] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Fri Jan 30 22:46:38.104225 2026] [:error] [pid 24712:tid 24755] [client 20.240.47.47:39589] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bayss.php"] [unique_id "aXzEToRLQrFiQF3h9-tzRgAAAY4"]
[Fri Jan 30 22:46:41.238309 2026] [:error] [pid 38686:tid 38710] [client 20.240.47.47:43717] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bayss.php"] [unique_id "aXzEUQoE8BAjgw1_sAWOIwAAAdQ"]
[Fri Jan 30 22:46:51.939543 2026] [:error] [pid 24712:tid 24756] [client 20.240.47.47:50481] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bayss.php"] [unique_id "aXzEW4RLQrFiQF3h9-tzSQAAAY8"]
[Fri Jan 30 22:47:01.535603 2026] [:error] [pid 47663:tid 47669] [client 20.240.47.47:48073] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1.php"] [unique_id "aXzEZUHGTrgIKCqEYbW4TQAAAkQ"]
[Fri Jan 30 22:47:02.986384 2026] [:error] [pid 46913:tid 46954] [client 20.240.47.47:47497] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1.php"] [unique_id "aXzEZjMWmKL8hOfC3uTt9gAAAEM"]
[Fri Jan 30 22:47:06.458076 2026] [:error] [pid 46913:tid 46972] [client 20.240.47.47:24786] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1.php"] [unique_id "aXzEajMWmKL8hOfC3uTuAAAAAFU"]
[Fri Jan 30 22:47:07.579835 2026] [:error] [pid 24681:tid 24706] [client 20.240.47.47:29568] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w1.php"] [unique_id "aXzEa4E368IXQpahn0Ki4AAAARc"]
[Fri Jan 30 22:47:21.493779 2026] [:error] [pid 46912:tid 46930] [client 20.240.47.47:29578] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dgdaolin.php"] [unique_id "aXzEeT6yiVW7A9NwFFkSRgAAAAY"]
[Fri Jan 30 22:47:35.740057 2026] [:error] [pid 24711:tid 24717] [client 20.240.47.47:43721] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrhbdzdz.php"] [unique_id "aXzEh65Gwh4var6T23LQAAAAAUM"]
[Fri Jan 30 22:47:37.576065 2026] [:error] [pid 47021:tid 47045] [client 20.240.47.47:50550] File does not exist: /usr/local/apache/htdocs/suspended-page/rrhbdzdz.php
[Fri Jan 30 22:47:37.842871 2026] [:error] [pid 47021:tid 47040] [client 20.240.47.47:50550] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Fri Jan 30 23:16:17.373373 2026] [:error] [pid 46912:tid 46930] [client 20.100.196.146:6173] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Jan 31 02:11:32.343589 2026] [:error] [pid 60001:tid 60015] [client 13.75.54.243:17505] [client 13.75.54.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "aXz0VKM2ziQ7JN4IjDxdPQAAAQw"]
[Sat Jan 31 02:11:32.813131 2026] [:error] [pid 59660:tid 59678] [client 13.75.54.243:27379] [client 13.75.54.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "aXz0VCwTX33V6TPUqxMCTgAAAA4"]
[Sat Jan 31 02:11:33.281861 2026] [:error] [pid 59660:tid 59682] [client 13.75.54.243:21828] [client 13.75.54.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "aXz0VSwTX33V6TPUqxMCUAAAABI"]
[Sat Jan 31 02:11:33.750266 2026] [:error] [pid 59660:tid 59681] [client 13.75.54.243:21833] [client 13.75.54.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "aXz0VSwTX33V6TPUqxMCVQAAABE"]
[Sat Jan 31 05:01:00.550604 2026] [:error] [pid 39339:tid 39347] [client 13.75.54.243:64653] [client 13.75.54.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aX0cDMWi-IjigR3oHY6LGgAAAMY"]
[Sat Jan 31 05:01:01.146293 2026] [:error] [pid 39243:tid 39294] [client 13.75.54.243:64759] [client 13.75.54.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aX0cDRBW1k4JK8a4v0Y9RQAAAEw"]
[Sat Jan 31 05:01:01.617032 2026] [:error] [pid 20210:tid 20223] [client 13.75.54.243:8130] [client 13.75.54.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aX0cDXKy7OGBlTY8MCeoRgAAAQs"]
[Sat Jan 31 05:01:02.087857 2026] [:error] [pid 20836:tid 20862] [client 13.75.54.243:54019] [client 13.75.54.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aX0cDoACllgWRWVrYITRCAAAAVU"]
[Sat Jan 31 05:01:02.565334 2026] [:error] [pid 20836:tid 20857] [client 13.75.54.243:64662] [client 13.75.54.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aX0cDoACllgWRWVrYITRDAAAAVA"]
[Sat Jan 31 06:14:47.882015 2026] [:error] [pid 39339:tid 39361] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/thebe.php
[Sat Jan 31 06:14:48.146953 2026] [:error] [pid 39339:tid 39359] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Sat Jan 31 06:14:48.419034 2026] [:error] [pid 39339:tid 39358] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/sanity.php
[Sat Jan 31 06:14:48.682979 2026] [:error] [pid 39339:tid 39357] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/anj.php
[Sat Jan 31 06:14:48.946980 2026] [:error] [pid 39339:tid 39344] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/baixy.php
[Sat Jan 31 06:14:49.209808 2026] [:error] [pid 39339:tid 39341] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Sat Jan 31 06:14:49.472949 2026] [:error] [pid 39339:tid 39347] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Sat Jan 31 06:14:49.735331 2026] [:error] [pid 39339:tid 39354] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Sat Jan 31 06:14:50.007799 2026] [:error] [pid 39339:tid 39365] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/zmia.php
[Sat Jan 31 06:14:50.276443 2026] [:error] [pid 39339:tid 39355] [client 20.100.196.146:25567] File does not exist: /usr/local/apache/htdocs/suspended-page/edorxrr.php
[Sat Jan 31 06:14:50.542065 2026] [:error] [pid 39339:tid 39360] [client 20.100.196.146:25567] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doko.php"] [unique_id "aX0tWsWi-IjigR3oHY6icwAAANM"]
[Sat Jan 31 06:14:51.249776 2026] [:error] [pid 20836:tid 20863] [client 20.100.196.146:32877] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doko.php"] [unique_id "aX0tW4ACllgWRWVrYITyyQAAAVY"]
[Sat Jan 31 06:14:53.155610 2026] [:error] [pid 20836:tid 20858] [client 20.100.196.146:27876] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doko.php"] [unique_id "aX0tXYACllgWRWVrYITyzQAAAVE"]
[Sat Jan 31 06:14:54.603712 2026] [:error] [pid 39339:tid 39364] [client 20.100.196.146:27847] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aX0tXsWi-IjigR3oHY6ieAAAANc"]
[Sat Jan 31 06:14:55.257078 2026] [:error] [pid 39339:tid 39356] [client 20.100.196.146:32845] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aX0tX8Wi-IjigR3oHY6iegAAAM8"]
[Sat Jan 31 06:14:56.273430 2026] [:error] [pid 39242:tid 39264] [client 20.100.196.146:2129] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aX0tYNOgXnkKGGSSCIN2fAAAAAo"]
[Sat Jan 31 06:14:56.990805 2026] [:error] [pid 20836:tid 20841] [client 20.100.196.146:40673] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-rss4.php"] [unique_id "aX0tYIACllgWRWVrYITyzgAAAUA"]
[Sat Jan 31 06:14:57.832217 2026] [:error] [pid 20836:tid 20862] [client 20.100.196.146:21651] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aX0tYYACllgWRWVrYITy0AAAAVU"]
[Sat Jan 31 06:14:58.841002 2026] [:error] [pid 20210:tid 20229] [client 20.100.196.146:27878] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aX0tYnKy7OGBlTY8MCfB3wAAARE"]
[Sat Jan 31 06:14:59.571274 2026] [:error] [pid 39244:tid 39312] [client 20.100.196.146:39504] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aX0tY3o-KRTvg3jHEDziSwAAAIM"]
[Sat Jan 31 06:15:00.149444 2026] [:error] [pid 39244:tid 39321] [client 20.100.196.146:39915] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nlvbr.php"] [unique_id "aX0tZHo-KRTvg3jHEDziTAAAAIs"]
[Sat Jan 31 06:15:01.137086 2026] [:error] [pid 20836:tid 20857] [client 20.100.196.146:39519] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aX0tZYACllgWRWVrYITy0wAAAVA"]
[Sat Jan 31 06:15:01.660387 2026] [:error] [pid 20210:tid 20226] [client 20.100.196.146:24309] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-set.php"] [unique_id "aX0tZXKy7OGBlTY8MCfB4wAAAQ4"]
[Sat Jan 31 06:15:02.210121 2026] [:error] [pid 39244:tid 39324] [client 20.100.196.146:40733] [client 20.100.196.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aX0tZno-KRTvg3jHEDziTwAAAI4"]
[Sat Jan 31 06:24:36.453288 2026] [:error] [pid 39242:tid 39265] [client 20.46.176.183:23753] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "aX0vpNOgXnkKGGSSCIN5JgAAAAs"]
[Sat Jan 31 06:24:36.910490 2026] [:error] [pid 20210:tid 20235] [client 20.46.176.183:3450] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "aX0vpHKy7OGBlTY8MCfFqgAAARc"]
[Sat Jan 31 06:24:37.368905 2026] [:error] [pid 39243:tid 39301] [client 20.46.176.183:18533] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "aX0vpRBW1k4JK8a4v0ZUfwAAAFM"]
[Sat Jan 31 06:24:37.827252 2026] [:error] [pid 39244:tid 39324] [client 20.46.176.183:26824] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "aX0vpXo-KRTvg3jHEDzlOwAAAI4"]
[Sat Jan 31 10:29:21.416960 2026] [:error] [pid 39243:tid 39302] [client 189.201.251.185:46950] [client 189.201.251.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.201.251.185, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aX1pARBW1k4JK8a4v0adfAAAAFQ"]
[Sat Jan 31 10:29:21.422445 2026] [:error] [pid 39243:tid 39302] [client 189.201.251.185:46950] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Jan 31 13:43:43.188658 2026] [:error] [pid 39242:tid 39272] [client 146.235.18.147:55148] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aX2Wj9OgXnkKGGSSCIPqzgAAABI"], referer: https://www.google.com/
[Sat Jan 31 13:43:43.193070 2026] [:error] [pid 39242:tid 39272] [client 146.235.18.147:55148] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Sat Jan 31 13:43:43.592339 2026] [:error] [pid 59582:tid 59626] [client 146.235.18.147:55357] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aX2Wj45dwpvvp1Lc6f000wAAA88"], referer: https://www.google.com/search?q=wordpress
[Sat Jan 31 13:43:43.597801 2026] [:error] [pid 59582:tid 59626] [client 146.235.18.147:55357] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/search?q=wordpress
[Sat Jan 31 13:43:44.772385 2026] [:error] [pid 39339:tid 39348] [client 146.235.18.147:55586] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aX2WkMWi-IjigR3oHY4R5QAAAMc"], referer: https://www.facebook.com/
[Sat Jan 31 13:43:44.776163 2026] [:error] [pid 39339:tid 39348] [client 146.235.18.147:55586] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.facebook.com/
[Sat Jan 31 13:43:45.159241 2026] [:error] [pid 52415:tid 52431] [client 146.235.18.147:55765] [client 146.235.18.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.235.18.147, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aX2WkZ-DUxb_li2fU6KbHgAAAY4"], referer: https://wordpress.org/
[Sat Jan 31 13:43:45.162974 2026] [:error] [pid 52415:tid 52431] [client 146.235.18.147:55765] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://wordpress.org/
[Sat Jan 31 22:38:38.300060 2026] [:error] [pid 39339:tid 39347] [client 104.28.153.27:43390] [client 104.28.153.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aX4T7sWi-IjigR3oHY6ULQAAAMY"]
[Sun Feb 01 03:21:20.015984 2026] [:error] [pid 59523:tid 59529] [client 37.139.53.198:56136] [client 37.139.53.198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "aoswa.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "aX5WMJEkxOIGmVhqUWK7cgAAAwI"]
[Sun Feb 01 03:47:50.910311 2026] [:error] [pid 50277:tid 50300] [client 104.28.214.117:64922] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Sun Feb 01 03:48:23.085471 2026] [:error] [pid 44251:tid 44325] [client 104.28.214.117:64563] [client 104.28.214.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aX5ch5Q_zmwT1jSymJEc1AAAAEM"]
[Sun Feb 01 20:58:03.713462 2026] [:error] [pid 10506:tid 10537] [client 187.181.224.158:59185] [client 187.181.224.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.181.224.158, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aX9N2632IC2Db4uwFyOwEQAAABU"]
[Sun Feb 01 20:58:03.718806 2026] [:error] [pid 10506:tid 10537] [client 187.181.224.158:59185] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 02 04:47:19.835260 2026] [:error] [pid 63153:tid 63180] [client 45.130.83.167:23461] [client 45.130.83.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.167, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aX-713C9GXHnmLkdgdmijAAAANM"]
[Mon Feb 02 04:47:19.839109 2026] [:error] [pid 63153:tid 63180] [client 45.130.83.167:23461] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 02 04:47:22.025775 2026] [:error] [pid 63153:tid 63180] [client 45.130.83.167:23461] [client 45.130.83.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "aX-72nC9GXHnmLkdgdmimQAAANM"]
[Mon Feb 02 09:15:02.424494 2026] [:error] [pid 46008:tid 46027] [client 20.89.41.232:6320] [client 20.89.41.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aX_6liRa52iYn7SlSMkSmAAAAVA"]
[Mon Feb 02 09:15:02.681919 2026] [:error] [pid 63034:tid 63126] [client 20.89.41.232:6976] [client 20.89.41.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aX_6luKXlgw75_wfbHpPxAAAAIg"]
[Mon Feb 02 09:15:02.920746 2026] [:error] [pid 46008:tid 46022] [client 20.89.41.232:6299] [client 20.89.41.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aX_6liRa52iYn7SlSMkSnQAAAUs"]
[Mon Feb 02 09:15:03.160853 2026] [:error] [pid 63034:tid 63127] [client 20.89.41.232:39595] [client 20.89.41.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aX_6l-KXlgw75_wfbHpPxgAAAIk"]
[Mon Feb 02 11:49:13.699272 2026] [:error] [pid 57021:tid 57038] [client 185.241.211.8:64353] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYAeuf7AEpx7VcmYK3GoKwAAAk0"]
[Mon Feb 02 11:49:14.133225 2026] [:error] [pid 56989:tid 56998] [client 185.241.211.8:64522] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYAeukp44HnChN-GZlhuMgAAAgc"]
[Mon Feb 02 11:49:14.562250 2026] [:error] [pid 57022:tid 57071] [client 185.241.211.8:64710] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYAeuhnEgLMzfcurxfn0WwAAApM"]
[Mon Feb 02 11:49:15.030633 2026] [:error] [pid 57022:tid 57065] [client 185.241.211.8:64911] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYAeuhnEgLMzfcurxfn0awAAAo0"]
[Mon Feb 02 11:49:15.464874 2026] [:error] [pid 63032:tid 63077] [client 185.241.211.8:65097] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYAeu3yEQ1PkpebvdRh5rQAAAA4"]
[Mon Feb 02 13:44:56.804440 2026] [:error] [pid 33612:tid 33630] [client 136.144.33.251:41687] [client 136.144.33.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.251, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aYA52MtFn80qQEmo5Qq8pAAAARA"]
[Mon Feb 02 13:44:56.810048 2026] [:error] [pid 33612:tid 33630] [client 136.144.33.251:41687] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Feb 02 18:23:43.506421 2026] [:error] [pid 46008:tid 46019] [client 104.28.153.27:44056] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Mon Feb 02 18:24:39.414359 2026] [:error] [pid 33612:tid 33618] [client 104.28.153.27:42912] [client 104.28.153.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aYB7Z8tFn80qQEmo5QrvWQAAAQQ"]
[Mon Feb 02 18:25:01.247710 2026] [:error] [pid 63032:tid 63067] [client 104.28.153.27:43506] [client 104.28.153.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aYB7fXyEQ1PkpebvdRjNCAAAAAQ"]
[Mon Feb 02 18:25:25.822170 2026] [:error] [pid 57021:tid 57041] [client 104.28.153.27:43679] [client 104.28.153.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aYB7lf7AEpx7VcmYK3HpqAAAAlA"]
[Mon Feb 02 18:26:21.887130 2026] [:error] [pid 57021:tid 57029] [client 104.28.153.27:42668] [client 104.28.153.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/txets.php"] [unique_id "aYB7zf7AEpx7VcmYK3HpxAAAAkQ"]
[Mon Feb 02 18:26:48.338656 2026] [:error] [pid 33612:tid 33626] [client 104.28.153.27:44959] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Mon Feb 02 18:27:14.273529 2026] [:error] [pid 57080:tid 57103] [client 104.28.153.27:45055] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Tue Feb 03 00:23:47.424040 2026] [:error] [pid 46008:tid 46032] [client 193.36.225.24:41457] [client 193.36.225.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.24, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aYDPkyRa52iYn7SlSMnMwQAAAVU"]
[Tue Feb 03 00:23:47.429906 2026] [:error] [pid 46008:tid 46032] [client 193.36.225.24:41457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Feb 03 04:48:50.686600 2026] [:error] [pid 43028:tid 43043] [client 119.156.106.245:58590] [client 119.156.106.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.156.106.245, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYENslnHWnJD4cJC5DtqTQAAAM0"]
[Tue Feb 03 04:48:50.691511 2026] [:error] [pid 43028:tid 43043] [client 119.156.106.245:58590] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Feb 03 12:07:55.434775 2026] [:error] [pid 28720:tid 28723] [client 37.27.119.185:61355] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYF0m2mRXm2bmr_sYiZGggAAAQE"], referer: https://www.netflix.com
[Tue Feb 03 12:07:56.083880 2026] [:error] [pid 42920:tid 42938] [client 37.27.119.185:61833] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYF0nCix3YKltG4EU0kCEAAAAAk"], referer: https://www.reddit.com/r/worldnews
[Tue Feb 03 18:00:09.900373 2026] [:error] [pid 42921:tid 42982] [client 20.205.110.134:22042] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Feb 03 18:01:20.020973 2026] [:error] [pid 43028:tid 43034] [client 20.212.208.117:20121] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Feb 03 19:01:33.898352 2026] [:error] [pid 42922:tid 43001] [client 185.194.178.47:24735] [client 185.194.178.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.47, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aYHVjWazX4WPS_dQRkh8RgAAAJA"]
[Tue Feb 03 19:01:33.902233 2026] [:error] [pid 42922:tid 43001] [client 185.194.178.47:24735] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Feb 03 19:26:53.956223 2026] [:error] [pid 42920:tid 42949] [client 103.65.236.149:61564] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aYHbfSix3YKltG4EU0lsfAAAABQ"]
[Wed Feb 04 00:39:44.475336 2026] [:error] [pid 43028:tid 43043] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Wed Feb 04 00:39:44.623893 2026] [:error] [pid 43028:tid 43030] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/\xe8\x93\x9d\xe7\x99\xbd\xe9\x93\xbe\xe6\x8e\xa5.php
[Wed Feb 04 00:39:44.773674 2026] [:error] [pid 43028:tid 43052] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/a1vx.php
[Wed Feb 04 00:39:45.199592 2026] [:error] [pid 43028:tid 43051] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/ii5file.php
[Wed Feb 04 00:39:45.365029 2026] [:error] [pid 43028:tid 43039] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Wed Feb 04 00:39:45.511730 2026] [:error] [pid 43028:tid 43049] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/321.php
[Wed Feb 04 00:39:45.652685 2026] [:error] [pid 43028:tid 43032] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/w3.php
[Wed Feb 04 00:39:45.849752 2026] [:error] [pid 43028:tid 43054] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/vdb.php
[Wed Feb 04 00:39:45.996793 2026] [:error] [pid 43028:tid 43048] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Wed Feb 04 00:39:46.174778 2026] [:error] [pid 43028:tid 43043] [client 20.198.88.1:63231] File does not exist: /usr/local/apache/htdocs/suspended-page/system_core.php
[Wed Feb 04 00:39:46.325263 2026] [:error] [pid 43028:tid 43053] [client 20.198.88.1:63231] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aYIk0lnHWnJD4cJC5DsFIwAAANc"]
[Wed Feb 04 00:39:46.920715 2026] [:error] [pid 5229:tid 5233] [client 20.198.88.1:6641] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aYIk0kKmEgmJub93yUpKDQAAAYI"]
[Wed Feb 04 00:39:47.503205 2026] [:error] [pid 43028:tid 43045] [client 20.198.88.1:6617] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aYIk01nHWnJD4cJC5DsFKAAAAM8"]
[Wed Feb 04 00:39:49.297567 2026] [:error] [pid 42922:tid 43006] [client 20.198.88.1:63706] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aYIk1WazX4WPS_dQRkjXRQAAAJU"]
[Wed Feb 04 00:39:50.210041 2026] [:error] [pid 42921:tid 42969] [client 20.198.88.1:6655] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aYIk1oblShffGl-01oe0-wAAAEs"]
[Wed Feb 04 00:39:51.070834 2026] [:error] [pid 5229:tid 5254] [client 20.198.88.1:63689] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aYIk10KmEgmJub93yUpKEQAAAZc"]
[Wed Feb 04 00:39:52.047442 2026] [:error] [pid 5148:tid 5175] [client 20.198.88.1:6426] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aYIk2L83HCHLtUIbS7IpyQAAAVg"]
[Wed Feb 04 00:39:52.891525 2026] [:error] [pid 5148:tid 5170] [client 20.198.88.1:63739] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aYIk2L83HCHLtUIbS7IpzAAAAVM"]
[Wed Feb 04 00:39:53.258160 2026] [:error] [pid 43028:tid 43037] [client 20.198.88.1:63223] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ck.php"] [unique_id "aYIk2VnHWnJD4cJC5DsFNAAAAMc"]
[Wed Feb 04 00:39:53.852661 2026] [:error] [pid 5229:tid 5249] [client 20.198.88.1:63216] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ck.php"] [unique_id "aYIk2UKmEgmJub93yUpKFgAAAZI"]
[Wed Feb 04 00:39:54.733383 2026] [:error] [pid 43028:tid 43045] [client 20.198.88.1:63220] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ck.php"] [unique_id "aYIk2lnHWnJD4cJC5DsFSAAAAM8"]
[Wed Feb 04 00:39:55.594114 2026] [:error] [pid 28720:tid 28737] [client 20.198.88.1:6419] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ck.php"] [unique_id "aYIk22mRXm2bmr_sYiYL9wAAAQ8"]
[Wed Feb 04 00:39:56.384313 2026] [:error] [pid 42920:tid 42929] [client 20.198.88.1:50188] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aYIk3Cix3YKltG4EU0m-zAAAAAA"]
[Wed Feb 04 00:39:57.420608 2026] [:error] [pid 5148:tid 5152] [client 20.198.88.1:63221] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aYIk3b83HCHLtUIbS7Ip4wAAAUE"]
[Wed Feb 04 00:39:58.287004 2026] [:error] [pid 42920:tid 42941] [client 20.198.88.1:6437] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aYIk3iix3YKltG4EU0m-zgAAAAw"]
[Wed Feb 04 00:39:58.892404 2026] [:error] [pid 42921:tid 42960] [client 20.198.88.1:63229] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aYIk3oblShffGl-01oe1EwAAAEI"]
[Wed Feb 04 00:39:59.487826 2026] [:error] [pid 5148:tid 5169] [client 20.198.88.1:63217] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anna.php"] [unique_id "aYIk3783HCHLtUIbS7Ip8AAAAVI"]
[Wed Feb 04 00:40:00.111878 2026] [:error] [pid 43028:tid 43040] [client 20.198.88.1:6421] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anna.php"] [unique_id "aYIk4FnHWnJD4cJC5DsFewAAAMo"]
[Wed Feb 04 00:40:00.912099 2026] [:error] [pid 5229:tid 5252] [client 20.198.88.1:63194] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anna.php"] [unique_id "aYIk4EKmEgmJub93yUpKHwAAAZU"]
[Wed Feb 04 00:40:01.486941 2026] [:error] [pid 5229:tid 5245] [client 20.198.88.1:63192] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anna.php"] [unique_id "aYIk4UKmEgmJub93yUpKIAAAAY4"]
[Wed Feb 04 00:40:02.060034 2026] [:error] [pid 5148:tid 5157] [client 20.198.88.1:6159] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aYIk4r83HCHLtUIbS7Ip9QAAAUY"]
[Wed Feb 04 00:40:02.930019 2026] [:error] [pid 5229:tid 5235] [client 20.198.88.1:63711] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aYIk4kKmEgmJub93yUpKJAAAAYQ"]
[Wed Feb 04 00:40:04.171235 2026] [:error] [pid 42922:tid 42997] [client 20.198.88.1:63722] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aYIk5GazX4WPS_dQRkjXXQAAAIw"]
[Wed Feb 04 00:40:04.912303 2026] [:error] [pid 42920:tid 42945] [client 20.198.88.1:6592] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aYIk5Cix3YKltG4EU0m-0gAAABA"]
[Wed Feb 04 00:40:05.927412 2026] [:error] [pid 43028:tid 43045] [client 20.198.88.1:63701] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qasu.php"] [unique_id "aYIk5VnHWnJD4cJC5DsFgQAAAM8"]
[Wed Feb 04 00:40:06.485214 2026] [:error] [pid 43028:tid 43031] [client 20.198.88.1:6471] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qasu.php"] [unique_id "aYIk5lnHWnJD4cJC5DsFggAAAME"]
[Wed Feb 04 00:40:07.245284 2026] [:error] [pid 5229:tid 5238] [client 20.198.88.1:63680] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qasu.php"] [unique_id "aYIk50KmEgmJub93yUpKMgAAAYc"]
[Wed Feb 04 00:40:08.316464 2026] [:error] [pid 42921:tid 42963] [client 20.198.88.1:50194] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qasu.php"] [unique_id "aYIk6IblShffGl-01oe1HwAAAEU"]
[Wed Feb 04 00:40:08.762787 2026] [:error] [pid 43028:tid 43034] [client 20.198.88.1:63204] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Gi8.php"] [unique_id "aYIk6FnHWnJD4cJC5DsFhwAAAMQ"]
[Wed Feb 04 00:40:09.671866 2026] [:error] [pid 5229:tid 5239] [client 20.198.88.1:63698] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Gi8.php"] [unique_id "aYIk6UKmEgmJub93yUpKNAAAAYg"]
[Wed Feb 04 00:40:10.375313 2026] [:error] [pid 5229:tid 5253] [client 20.198.88.1:56015] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Gi8.php"] [unique_id "aYIk6kKmEgmJub93yUpKNgAAAZY"]
[Wed Feb 04 00:40:10.927443 2026] [:error] [pid 28720:tid 28735] [client 20.198.88.1:63224] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Gi8.php"] [unique_id "aYIk6mmRXm2bmr_sYiYMBAAAAQ0"]
[Wed Feb 04 00:40:11.429510 2026] [:error] [pid 5229:tid 5255] [client 20.198.88.1:63214] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aYIk60KmEgmJub93yUpKOQAAAZg"]
[Wed Feb 04 00:40:12.528074 2026] [:error] [pid 42922:tid 42985] [client 20.198.88.1:50185] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aYIk7GazX4WPS_dQRkjXZwAAAIA"]
[Wed Feb 04 00:40:13.178242 2026] [:error] [pid 42920:tid 42929] [client 20.198.88.1:63228] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aYIk7Six3YKltG4EU0m-1gAAAAA"]
[Wed Feb 04 00:40:13.933030 2026] [:error] [pid 5229:tid 5249] [client 20.198.88.1:63184] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aYIk7UKmEgmJub93yUpKPQAAAZI"]
[Wed Feb 04 00:40:14.445916 2026] [:error] [pid 5148:tid 5160] [client 20.198.88.1:50198] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aYIk7r83HCHLtUIbS7Ip_gAAAUk"]
[Wed Feb 04 00:40:15.654399 2026] [:error] [pid 43028:tid 43035] [client 20.198.88.1:6599] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aYIk71nHWnJD4cJC5DsFigAAAMU"]
[Wed Feb 04 00:40:16.146949 2026] [:error] [pid 28720:tid 28729] [client 20.198.88.1:6637] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aYIk8GmRXm2bmr_sYiYMCwAAAQc"]
[Wed Feb 04 00:40:16.721726 2026] [:error] [pid 5229:tid 5232] [client 20.198.88.1:6434] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aYIk8EKmEgmJub93yUpKRQAAAYE"]
[Wed Feb 04 00:40:17.482170 2026] [:error] [pid 43028:tid 43039] [client 20.198.88.1:6627] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aYIk8VnHWnJD4cJC5DsFjQAAAMk"]
[Wed Feb 04 00:40:18.414349 2026] [:error] [pid 5148:tid 5151] [client 20.198.88.1:50179] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aYIk8r83HCHLtUIbS7IqAgAAAUA"]
[Wed Feb 04 00:40:19.102911 2026] [:error] [pid 43028:tid 43034] [client 20.198.88.1:63207] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aYIk81nHWnJD4cJC5DsFkQAAAMQ"]
[Wed Feb 04 00:40:20.057870 2026] [:error] [pid 5229:tid 5244] [client 20.198.88.1:63213] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jmfi2.php"] [unique_id "aYIk9EKmEgmJub93yUpKRwAAAY0"]
[Wed Feb 04 00:40:21.639470 2026] [:error] [pid 28720:tid 28736] [client 20.198.88.1:63714] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ez.php"] [unique_id "aYIk9WmRXm2bmr_sYiYMEAAAAQ4"]
[Wed Feb 04 00:40:22.264624 2026] [:error] [pid 42921:tid 42970] [client 20.198.88.1:6593] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ez.php"] [unique_id "aYIk9oblShffGl-01oe1SwAAAEw"]
[Wed Feb 04 00:40:22.753764 2026] [:error] [pid 5229:tid 5240] [client 20.198.88.1:63284] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ez.php"] [unique_id "aYIk9kKmEgmJub93yUpKSAAAAYk"]
[Wed Feb 04 00:40:23.492993 2026] [:error] [pid 5229:tid 5235] [client 20.198.88.1:6461] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ez.php"] [unique_id "aYIk90KmEgmJub93yUpKSgAAAYQ"]
[Wed Feb 04 00:40:24.210484 2026] [:error] [pid 42921:tid 42982] [client 20.198.88.1:6459] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aYIk-IblShffGl-01oe1VAAAAFg"]
[Wed Feb 04 00:40:24.969184 2026] [:error] [pid 28720:tid 28735] [client 20.198.88.1:6603] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aYIk-GmRXm2bmr_sYiYMFQAAAQ0"]
[Wed Feb 04 00:40:26.261177 2026] [:error] [pid 42920:tid 42934] [client 20.198.88.1:63245] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aYIk-iix3YKltG4EU0m-4gAAAAU"]
[Wed Feb 04 00:40:27.214531 2026] [:error] [pid 42920:tid 42947] [client 20.198.88.1:63695] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aYIk-yix3YKltG4EU0m-5QAAABI"]
[Wed Feb 04 00:40:28.194612 2026] [:error] [pid 42920:tid 42946] [client 20.198.88.1:63692] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIk_Cix3YKltG4EU0m-5wAAABE"]
[Wed Feb 04 00:40:28.800422 2026] [:error] [pid 5229:tid 5245] [client 20.198.88.1:6433] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIk_EKmEgmJub93yUpKUwAAAY4"]
[Wed Feb 04 00:40:29.275501 2026] [:error] [pid 5229:tid 5234] [client 20.198.88.1:6505] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIk_UKmEgmJub93yUpKVgAAAYM"]
[Wed Feb 04 00:40:29.843994 2026] [:error] [pid 42921:tid 42977] [client 20.198.88.1:6422] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIk_YblShffGl-01oe1XwAAAFM"]
[Wed Feb 04 00:40:30.700938 2026] [:error] [pid 42922:tid 42998] [client 20.198.88.1:6651] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aYIk_mazX4WPS_dQRkjXdAAAAI0"]
[Wed Feb 04 00:40:31.289912 2026] [:error] [pid 28720:tid 28745] [client 20.198.88.1:6604] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aYIk_2mRXm2bmr_sYiYMHQAAARc"]
[Wed Feb 04 00:40:32.002324 2026] [:error] [pid 42921:tid 42978] [client 20.198.88.1:63737] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aYIlAIblShffGl-01oe1ZAAAAFQ"]
[Wed Feb 04 00:40:32.822703 2026] [:error] [pid 28720:tid 28724] [client 20.198.88.1:63281] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aYIlAGmRXm2bmr_sYiYMIAAAAQI"]
[Wed Feb 04 00:40:33.562655 2026] [:error] [pid 5148:tid 5169] [client 20.198.88.1:6634] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aYIlAb83HCHLtUIbS7IqCwAAAVI"]
[Wed Feb 04 00:40:34.066643 2026] [:error] [pid 5229:tid 5241] [client 20.198.88.1:6301] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aYIlAkKmEgmJub93yUpKWQAAAYo"]
[Wed Feb 04 00:40:34.889325 2026] [:error] [pid 42921:tid 42972] [client 20.198.88.1:63268] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aYIlAoblShffGl-01oe1agAAAE4"]
[Wed Feb 04 00:40:35.490208 2026] [:error] [pid 42921:tid 42971] [client 20.198.88.1:63715] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cfile.php"] [unique_id "aYIlA4blShffGl-01oe1bAAAAE0"]
[Wed Feb 04 00:40:36.544953 2026] [:error] [pid 42922:tid 42990] [client 20.198.88.1:6272] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aYIlBGazX4WPS_dQRkjXeAAAAIU"]
[Wed Feb 04 00:40:37.479656 2026] [:error] [pid 42922:tid 43005] [client 20.198.88.1:6331] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aYIlBWazX4WPS_dQRkjXfAAAAJQ"]
[Wed Feb 04 00:40:38.561758 2026] [:error] [pid 42922:tid 42985] [client 20.198.88.1:63700] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aYIlBmazX4WPS_dQRkjXfgAAAIA"]
[Wed Feb 04 00:40:39.568243 2026] [:error] [pid 42922:tid 43004] [client 20.198.88.1:63690] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aYIlB2azX4WPS_dQRkjXfwAAAJM"]
[Wed Feb 04 00:40:40.702729 2026] [:error] [pid 28720:tid 28745] [client 20.198.88.1:63691] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aYIlCGmRXm2bmr_sYiYMJgAAARc"]
[Wed Feb 04 00:40:41.287163 2026] [:error] [pid 28720:tid 28736] [client 20.198.88.1:6648] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aYIlCWmRXm2bmr_sYiYMJwAAAQ4"]
[Wed Feb 04 00:40:41.961463 2026] [:error] [pid 42922:tid 43009] [client 20.198.88.1:6324] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aYIlCWazX4WPS_dQRkjXgwAAAJg"]
[Wed Feb 04 00:40:42.689323 2026] [:error] [pid 42922:tid 42988] [client 20.198.88.1:63249] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aYIlCmazX4WPS_dQRkjXhQAAAIM"]
[Wed Feb 04 00:40:43.359547 2026] [:error] [pid 28720:tid 28724] [client 20.198.88.1:6279] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIlC2mRXm2bmr_sYiYMLQAAAQI"]
[Wed Feb 04 00:40:44.162102 2026] [:error] [pid 5229:tid 5253] [client 20.198.88.1:6411] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIlDEKmEgmJub93yUpKYAAAAZY"]
[Wed Feb 04 00:40:44.839874 2026] [:error] [pid 42922:tid 42985] [client 20.198.88.1:50179] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIlDGazX4WPS_dQRkjXiQAAAIA"]
[Wed Feb 04 00:40:45.776355 2026] [:error] [pid 42922:tid 42993] [client 20.198.88.1:6454] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aYIlDWazX4WPS_dQRkjXiwAAAIg"]
[Wed Feb 04 00:40:46.625202 2026] [:error] [pid 5148:tid 5153] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Wed Feb 04 00:40:46.766592 2026] [:error] [pid 5148:tid 5169] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Feb 04 00:40:46.909870 2026] [:error] [pid 5148:tid 5154] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/style2.php
[Wed Feb 04 00:40:47.049567 2026] [:error] [pid 5148:tid 5157] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Wed Feb 04 00:40:47.197084 2026] [:error] [pid 5148:tid 5172] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Feb 04 00:40:47.342810 2026] [:error] [pid 5148:tid 5163] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/wsback.php
[Wed Feb 04 00:40:47.483491 2026] [:error] [pid 5148:tid 5155] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/pm.php
[Wed Feb 04 00:40:47.627996 2026] [:error] [pid 5148:tid 5166] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/karak.php
[Wed Feb 04 00:40:47.938448 2026] [:error] [pid 5148:tid 5158] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/trd.php
[Wed Feb 04 00:40:48.095166 2026] [:error] [pid 5148:tid 5164] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php
[Wed Feb 04 00:40:48.235426 2026] [:error] [pid 5148:tid 5156] [client 20.198.88.1:6306] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Wed Feb 04 00:40:48.396408 2026] [:error] [pid 5148:tid 5161] [client 20.198.88.1:6306] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aYIlEL83HCHLtUIbS7IqIgAAAUo"]
[Wed Feb 04 00:40:49.200923 2026] [:error] [pid 43028:tid 43030] [client 20.198.88.1:63177] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aYIlEVnHWnJD4cJC5DsFuAAAAMA"]
[Wed Feb 04 00:40:49.934277 2026] [:error] [pid 5229:tid 5252] [client 20.198.88.1:6300] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aYIlEUKmEgmJub93yUpKaAAAAZU"]
[Wed Feb 04 00:40:50.599389 2026] [:error] [pid 43028:tid 43031] [client 20.198.88.1:6309] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aYIlElnHWnJD4cJC5DsFvwAAAME"]
[Wed Feb 04 00:40:51.598899 2026] [:error] [pid 43028:tid 43054] [client 20.198.88.1:6334] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aYIlE1nHWnJD4cJC5DsFwQAAANg"]
[Wed Feb 04 00:40:52.177613 2026] [:error] [pid 5229:tid 5248] [client 20.198.88.1:6452] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aYIlFEKmEgmJub93yUpKbAAAAZE"]
[Wed Feb 04 00:40:53.400311 2026] [:error] [pid 43028:tid 43030] [client 20.198.88.1:6322] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aYIlFVnHWnJD4cJC5DsFxgAAAMA"]
[Wed Feb 04 00:40:54.069670 2026] [:error] [pid 43028:tid 43044] [client 20.198.88.1:6288] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin.php"] [unique_id "aYIlFlnHWnJD4cJC5DsFxwAAAM4"]
[Wed Feb 04 00:40:54.543437 2026] [:error] [pid 5148:tid 5162] [client 20.198.88.1:63705] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIlFr83HCHLtUIbS7IqKwAAAUs"]
[Wed Feb 04 00:40:55.325835 2026] [:error] [pid 43028:tid 43041] [client 20.198.88.1:6525] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIlF1nHWnJD4cJC5DsFzAAAAMs"]
[Wed Feb 04 00:40:56.821098 2026] [:error] [pid 43028:tid 43051] [client 20.198.88.1:63255] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIlGFnHWnJD4cJC5DsF0QAAANU"]
[Wed Feb 04 00:40:58.265747 2026] [:error] [pid 5229:tid 5237] [client 20.198.88.1:63719] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIlGkKmEgmJub93yUpKegAAAYY"]
[Wed Feb 04 00:40:58.909010 2026] [:error] [pid 28720:tid 28746] [client 20.198.88.1:50226] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cron.php"] [unique_id "aYIlGmmRXm2bmr_sYiYMOgAAARg"]
[Wed Feb 04 00:40:59.568951 2026] [:error] [pid 43028:tid 43041] [client 20.198.88.1:6294] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cron.php"] [unique_id "aYIlG1nHWnJD4cJC5DsF0wAAAMs"]
[Wed Feb 04 00:41:00.630930 2026] [:error] [pid 43028:tid 43052] [client 20.198.88.1:63727] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cron.php"] [unique_id "aYIlHFnHWnJD4cJC5DsF1gAAANY"]
[Wed Feb 04 00:41:01.360120 2026] [:error] [pid 43028:tid 43042] [client 20.198.88.1:63264] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cron.php"] [unique_id "aYIlHVnHWnJD4cJC5DsF2AAAAMw"]
[Wed Feb 04 00:41:02.507515 2026] [:error] [pid 42922:tid 43004] [client 20.198.88.1:6296] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/super.php"] [unique_id "aYIlHmazX4WPS_dQRkjXnQAAAJM"]
[Wed Feb 04 00:41:03.338100 2026] [:error] [pid 5229:tid 5242] [client 20.198.88.1:6310] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/super.php"] [unique_id "aYIlH0KmEgmJub93yUpKfQAAAYs"]
[Wed Feb 04 00:41:04.626979 2026] [:error] [pid 28720:tid 28733] [client 20.198.88.1:6404] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/super.php"] [unique_id "aYIlIGmRXm2bmr_sYiYMRQAAAQs"]
[Wed Feb 04 00:41:05.343661 2026] [:error] [pid 42922:tid 42993] [client 20.198.88.1:6282] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/super.php"] [unique_id "aYIlIWazX4WPS_dQRkjXnwAAAIg"]
[Wed Feb 04 00:41:06.035817 2026] [:error] [pid 5148:tid 5175] [client 20.198.88.1:6413] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aYIlIr83HCHLtUIbS7IqMwAAAVg"]
[Wed Feb 04 00:41:06.824977 2026] [:error] [pid 42920:tid 42933] [client 20.198.88.1:6446] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aYIlIiix3YKltG4EU0m_AgAAAAQ"]
[Wed Feb 04 00:41:07.706936 2026] [:error] [pid 28720:tid 28724] [client 20.198.88.1:63685] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aYIlI2mRXm2bmr_sYiYMUQAAAQI"]
[Wed Feb 04 00:41:08.232467 2026] [:error] [pid 43028:tid 43049] [client 20.198.88.1:63709] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aYIlJFnHWnJD4cJC5DsF3QAAANM"]
[Wed Feb 04 00:41:08.889084 2026] [:error] [pid 42921:tid 42979] [client 20.198.88.1:63188] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aYIlJIblShffGl-01oe1ewAAAFU"]
[Wed Feb 04 00:41:09.910941 2026] [:error] [pid 42920:tid 42931] [client 20.198.88.1:6403] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aYIlJSix3YKltG4EU0m_BQAAAAI"]
[Wed Feb 04 00:41:10.713710 2026] [:error] [pid 5148:tid 5171] [client 20.198.88.1:6424] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aYIlJr83HCHLtUIbS7IqOAAAAVQ"]
[Wed Feb 04 00:41:11.822678 2026] [:error] [pid 43028:tid 43047] [client 20.198.88.1:6460] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aYIlJ1nHWnJD4cJC5DsF6gAAANE"]
[Wed Feb 04 00:41:12.953426 2026] [:error] [pid 42921:tid 42970] [client 20.198.88.1:63721] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aYIlKIblShffGl-01oe1fQAAAEw"]
[Wed Feb 04 00:41:13.820567 2026] [:error] [pid 42920:tid 42937] [client 20.198.88.1:6328] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aYIlKSix3YKltG4EU0m_BwAAAAg"]
[Wed Feb 04 00:41:14.738012 2026] [:error] [pid 43028:tid 43050] [client 20.198.88.1:63282] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aYIlKlnHWnJD4cJC5DsF8QAAANQ"]
[Wed Feb 04 00:41:15.251311 2026] [:error] [pid 43028:tid 43046] [client 20.198.88.1:63175] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aYIlK1nHWnJD4cJC5DsF8gAAANA"]
[Wed Feb 04 00:41:16.064021 2026] [:error] [pid 42921:tid 42964] [client 20.198.88.1:6510] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aYIlLIblShffGl-01oe1hAAAAEY"]
[Wed Feb 04 00:41:17.396128 2026] [:error] [pid 5148:tid 5159] [client 20.198.88.1:6423] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aYIlLb83HCHLtUIbS7IqQQAAAUg"]
[Wed Feb 04 00:41:18.574457 2026] [:error] [pid 28720:tid 28743] [client 20.198.88.1:63251] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aYIlLmmRXm2bmr_sYiYMYAAAARU"]
[Wed Feb 04 00:41:20.936285 2026] [:error] [pid 42921:tid 42970] [client 20.198.88.1:63187] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aYIlMIblShffGl-01oe1hgAAAEw"]
[Wed Feb 04 00:41:22.019987 2026] [:error] [pid 5229:tid 5231] [client 20.198.88.1:63241] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aYIlMkKmEgmJub93yUpKkwAAAYA"]
[Wed Feb 04 00:41:23.720487 2026] [:error] [pid 5229:tid 5251] [client 20.198.88.1:6440] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aYIlM0KmEgmJub93yUpKmgAAAZQ"]
[Wed Feb 04 00:41:24.924892 2026] [:error] [pid 28720:tid 28733] [client 20.198.88.1:6406] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aYIlNGmRXm2bmr_sYiYMaQAAAQs"]
[Wed Feb 04 00:41:25.681794 2026] [:error] [pid 5229:tid 5233] [client 20.198.88.1:63186] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aYIlNUKmEgmJub93yUpKogAAAYI"]
[Wed Feb 04 00:41:26.480378 2026] [:error] [pid 42922:tid 43006] [client 20.198.88.1:6281] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aYIlNmazX4WPS_dQRkjXogAAAJU"]
[Wed Feb 04 00:41:27.134450 2026] [:error] [pid 42921:tid 42963] [client 20.198.88.1:63247] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aYIlN4blShffGl-01oe1nAAAAEU"]
[Wed Feb 04 00:41:28.379258 2026] [:error] [pid 42920:tid 42940] [client 20.198.88.1:6335] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aYIlOCix3YKltG4EU0m_DQAAAAs"]
[Wed Feb 04 00:41:29.894263 2026] [:error] [pid 5229:tid 5236] [client 20.198.88.1:64415] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aYIlOUKmEgmJub93yUpKrwAAAYU"]
[Wed Feb 04 00:41:31.263365 2026] [:error] [pid 42920:tid 42948] [client 20.198.88.1:47270] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "aYIlOyix3YKltG4EU0m_EgAAABM"]
[Wed Feb 04 00:41:31.694733 2026] [:error] [pid 42922:tid 43003] [client 20.198.88.1:7070] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "aYIlO2azX4WPS_dQRkjXqAAAAJI"]
[Wed Feb 04 00:41:32.615642 2026] [:error] [pid 28720:tid 28736] [client 20.198.88.1:6792] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "aYIlPGmRXm2bmr_sYiYMbwAAAQ4"]
[Wed Feb 04 00:41:33.963873 2026] [:error] [pid 42922:tid 42996] [client 20.198.88.1:61081] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "aYIlPWazX4WPS_dQRkjXqQAAAIs"]
[Wed Feb 04 00:41:35.264158 2026] [:error] [pid 43028:tid 43040] [client 20.198.88.1:61448] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tcp.php"] [unique_id "aYIlP1nHWnJD4cJC5DsGGAAAAMo"]
[Wed Feb 04 00:41:37.162258 2026] [:error] [pid 5229:tid 5243] [client 20.198.88.1:61120] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tcp.php"] [unique_id "aYIlQUKmEgmJub93yUpKtQAAAYw"]
[Wed Feb 04 00:41:38.833600 2026] [:error] [pid 5229:tid 5232] [client 20.198.88.1:54542] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tcp.php"] [unique_id "aYIlQkKmEgmJub93yUpKuAAAAYE"]
[Wed Feb 04 00:41:40.321436 2026] [:error] [pid 28720:tid 28742] [client 20.198.88.1:7055] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tcp.php"] [unique_id "aYIlRGmRXm2bmr_sYiYMcwAAARQ"]
[Wed Feb 04 00:41:41.623959 2026] [:error] [pid 28720:tid 28729] [client 20.198.88.1:61093] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aYIlRWmRXm2bmr_sYiYMdgAAAQc"]
[Wed Feb 04 00:41:42.547337 2026] [:error] [pid 5229:tid 5243] [client 20.198.88.1:50962] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aYIlRkKmEgmJub93yUpKvwAAAYw"]
[Wed Feb 04 00:41:44.217097 2026] [:error] [pid 5229:tid 5236] [client 20.198.88.1:6996] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aYIlSEKmEgmJub93yUpKwgAAAYU"]
[Wed Feb 04 00:41:45.445104 2026] [:error] [pid 5229:tid 5240] [client 20.198.88.1:7106] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "aYIlSUKmEgmJub93yUpKxQAAAYk"]
[Wed Feb 04 00:41:46.432880 2026] [:error] [pid 43028:tid 43054] [client 20.198.88.1:62696] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex3.php"] [unique_id "aYIlSlnHWnJD4cJC5DsGIgAAANg"]
[Wed Feb 04 00:41:48.057857 2026] [:error] [pid 5148:tid 5172] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex3.php
[Wed Feb 04 00:41:48.197320 2026] [:error] [pid 5148:tid 5152] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Feb 04 00:41:48.369243 2026] [:error] [pid 5148:tid 5154] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Wed Feb 04 00:41:48.558393 2026] [:error] [pid 5148:tid 5161] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Wed Feb 04 00:41:48.711124 2026] [:error] [pid 5148:tid 5156] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/ov.php
[Wed Feb 04 00:41:48.850721 2026] [:error] [pid 5148:tid 5159] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Feb 04 00:41:49.165774 2026] [:error] [pid 5148:tid 5173] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Feb 04 00:41:49.308229 2026] [:error] [pid 5148:tid 5167] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/weo.php
[Wed Feb 04 00:41:49.448825 2026] [:error] [pid 5148:tid 5171] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Feb 04 00:41:49.588437 2026] [:error] [pid 5148:tid 5174] [client 20.198.88.1:56078] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi2.php
[Wed Feb 04 00:41:49.724649 2026] [:error] [pid 5148:tid 5153] [client 20.198.88.1:56078] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nope.php"] [unique_id "aYIlTb83HCHLtUIbS7IqZQAAAUI"]
[Wed Feb 04 00:41:51.220454 2026] [:error] [pid 43028:tid 43053] [client 20.198.88.1:7117] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nope.php"] [unique_id "aYIlT1nHWnJD4cJC5DsGKwAAANc"]
[Wed Feb 04 00:41:52.870692 2026] [:error] [pid 43028:tid 43041] [client 20.198.88.1:62055] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nope.php"] [unique_id "aYIlUFnHWnJD4cJC5DsGLwAAAMs"]
[Wed Feb 04 00:41:54.385695 2026] [:error] [pid 42921:tid 42961] [client 20.198.88.1:59062] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nope.php"] [unique_id "aYIlUoblShffGl-01oe1uAAAAEM"]
[Wed Feb 04 00:41:55.611220 2026] [:error] [pid 43028:tid 43048] [client 20.198.88.1:7130] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aYIlU1nHWnJD4cJC5DsGOAAAANI"]
[Wed Feb 04 00:41:56.969897 2026] [:error] [pid 42920:tid 42929] [client 20.198.88.1:62678] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aYIlVCix3YKltG4EU0m_IgAAAAA"]
[Wed Feb 04 00:41:57.555741 2026] [:error] [pid 28720:tid 28729] [client 20.198.88.1:59055] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aYIlVWmRXm2bmr_sYiYMhwAAAQc"]
[Wed Feb 04 00:41:58.216634 2026] [:error] [pid 28720:tid 28744] [client 20.198.88.1:59063] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aYIlVmmRXm2bmr_sYiYMigAAARY"]
[Wed Feb 04 00:41:59.362568 2026] [:error] [pid 42920:tid 42934] [client 20.198.88.1:62024] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aYIlVyix3YKltG4EU0m_KgAAAAU"]
[Wed Feb 04 00:42:01.230181 2026] [:error] [pid 5229:tid 5243] [client 20.198.88.1:7139] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aYIlWUKmEgmJub93yUpK3wAAAYw"]
[Wed Feb 04 00:42:02.711349 2026] [:error] [pid 42920:tid 42938] [client 20.198.88.1:50886] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aYIlWiix3YKltG4EU0m_LgAAAAk"]
[Wed Feb 04 00:42:03.771966 2026] [:error] [pid 5148:tid 5172] [client 20.198.88.1:7161] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aYIlW783HCHLtUIbS7IqdQAAAVU"]
[Wed Feb 04 00:42:04.485694 2026] [:error] [pid 42920:tid 42930] [client 20.198.88.1:59040] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aYIlXCix3YKltG4EU0m_MQAAAAE"]
[Wed Feb 04 00:42:05.321474 2026] [:error] [pid 43028:tid 43036] [client 20.198.88.1:62020] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aYIlXVnHWnJD4cJC5DsGTAAAAMY"]
[Wed Feb 04 00:42:05.819428 2026] [:error] [pid 43028:tid 43032] [client 20.198.88.1:62671] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aYIlXVnHWnJD4cJC5DsGTQAAAMI"]
[Wed Feb 04 00:42:06.588416 2026] [:error] [pid 5148:tid 5151] [client 20.198.88.1:56098] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aYIlXr83HCHLtUIbS7IqewAAAUA"]
[Wed Feb 04 00:42:07.184997 2026] [:error] [pid 42922:tid 43004] [client 20.198.88.1:50901] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aYIlX2azX4WPS_dQRkjXxwAAAJM"]
[Wed Feb 04 00:42:07.820040 2026] [:error] [pid 42920:tid 42941] [client 20.198.88.1:59054] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aYIlXyix3YKltG4EU0m_NAAAAAw"]
[Wed Feb 04 00:42:08.333236 2026] [:error] [pid 43028:tid 43033] [client 20.198.88.1:59012] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aYIlYFnHWnJD4cJC5DsGUQAAAMM"]
[Wed Feb 04 00:42:09.098266 2026] [:error] [pid 43028:tid 43045] [client 20.198.88.1:56096] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aYIlYVnHWnJD4cJC5DsGUwAAAM8"]
[Wed Feb 04 00:42:09.618693 2026] [:error] [pid 5148:tid 5160] [client 20.198.88.1:59053] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aYIlYb83HCHLtUIbS7IqgAAAAUk"]
[Wed Feb 04 00:42:10.526882 2026] [:error] [pid 43028:tid 43035] [client 20.198.88.1:62679] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aYIlYlnHWnJD4cJC5DsGWAAAAMU"]
[Wed Feb 04 00:42:11.389004 2026] [:error] [pid 42921:tid 42981] [client 20.198.88.1:56118] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aYIlY4blShffGl-01oe1xAAAAFc"]
[Wed Feb 04 00:42:12.141730 2026] [:error] [pid 42922:tid 42996] [client 20.198.88.1:62078] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aYIlZGazX4WPS_dQRkjXzAAAAIs"]
[Wed Feb 04 00:42:13.886080 2026] [:error] [pid 43028:tid 43030] [client 20.198.88.1:6658] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYIlZVnHWnJD4cJC5DsGXgAAAMA"]
[Wed Feb 04 00:42:14.744047 2026] [:error] [pid 43028:tid 43047] [client 20.198.88.1:7113] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYIlZlnHWnJD4cJC5DsGYQAAANE"]
[Wed Feb 04 00:42:17.487187 2026] [:error] [pid 28720:tid 28723] [client 20.198.88.1:7116] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYIlaWmRXm2bmr_sYiYMmgAAAQE"]
[Wed Feb 04 00:42:18.061329 2026] [:error] [pid 28720:tid 28739] [client 20.198.88.1:56086] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYIlammRXm2bmr_sYiYMnAAAARE"]
[Wed Feb 04 00:42:18.910847 2026] [:error] [pid 42920:tid 42947] [client 20.198.88.1:6713] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aYIlaiix3YKltG4EU0m_QQAAABI"]
[Wed Feb 04 00:42:21.365826 2026] [:error] [pid 42920:tid 42940] [client 20.198.88.1:7128] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aYIlbSix3YKltG4EU0m_RQAAAAs"]
[Wed Feb 04 00:42:23.040991 2026] [:error] [pid 42921:tid 42973] [client 20.198.88.1:62074] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aYIlb4blShffGl-01oe1zwAAAE8"]
[Wed Feb 04 00:42:24.144397 2026] [:error] [pid 5229:tid 5246] [client 20.198.88.1:7111] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "aYIlcEKmEgmJub93yUpK_QAAAY8"]
[Wed Feb 04 00:42:26.273756 2026] [:error] [pid 43028:tid 43052] [client 20.198.88.1:6695] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aYIlclnHWnJD4cJC5DsGcgAAANY"]
[Wed Feb 04 00:42:27.453497 2026] [:error] [pid 5229:tid 5254] [client 20.198.88.1:59008] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aYIlc0KmEgmJub93yUpLAwAAAZc"]
[Wed Feb 04 00:42:28.976856 2026] [:error] [pid 42922:tid 42992] [client 20.198.88.1:6707] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aYIldGazX4WPS_dQRkjX2wAAAIc"]
[Wed Feb 04 00:42:29.594127 2026] [:error] [pid 42922:tid 42987] [client 20.198.88.1:6683] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v2.php"] [unique_id "aYIldWazX4WPS_dQRkjX3QAAAII"]
[Wed Feb 04 00:42:30.672379 2026] [:error] [pid 42922:tid 43007] [client 20.198.88.1:6209] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYIldmazX4WPS_dQRkjX5AAAAJY"]
[Wed Feb 04 00:42:31.571509 2026] [:error] [pid 28720:tid 28727] [client 20.198.88.1:6232] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYIld2mRXm2bmr_sYiYMoQAAAQU"]
[Wed Feb 04 00:42:32.332486 2026] [:error] [pid 28720:tid 28745] [client 20.198.88.1:62032] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYIleGmRXm2bmr_sYiYMowAAARc"]
[Wed Feb 04 00:42:33.065475 2026] [:error] [pid 42922:tid 42985] [client 20.198.88.1:6225] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYIleWazX4WPS_dQRkjX6AAAAIA"]
[Wed Feb 04 00:42:33.784686 2026] [:error] [pid 43028:tid 43039] [client 20.198.88.1:56079] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYIleVnHWnJD4cJC5DsGfgAAAMk"]
[Wed Feb 04 00:42:34.756353 2026] [:error] [pid 5229:tid 5251] [client 20.198.88.1:56120] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYIlekKmEgmJub93yUpLDwAAAZQ"]
[Wed Feb 04 00:42:35.627269 2026] [:error] [pid 5229:tid 5246] [client 20.198.88.1:59018] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYIle0KmEgmJub93yUpLEAAAAY8"]
[Wed Feb 04 00:42:36.827455 2026] [:error] [pid 43028:tid 43045] [client 20.198.88.1:6666] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYIlfFnHWnJD4cJC5DsGhwAAAM8"]
[Wed Feb 04 00:42:37.420521 2026] [:error] [pid 43028:tid 43048] [client 20.198.88.1:56064] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aYIlfVnHWnJD4cJC5DsGiAAAANI"]
[Wed Feb 04 00:42:37.846979 2026] [:error] [pid 43028:tid 43042] [client 20.198.88.1:56110] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aYIlfVnHWnJD4cJC5DsGigAAAMw"]
[Wed Feb 04 00:42:38.767100 2026] [:error] [pid 43028:tid 43044] [client 20.198.88.1:6262] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aYIlflnHWnJD4cJC5DsGkAAAAM4"]
[Wed Feb 04 00:42:39.386366 2026] [:error] [pid 43028:tid 43034] [client 20.198.88.1:59024] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aYIlf1nHWnJD4cJC5DsGlQAAAMQ"]
[Wed Feb 04 00:42:40.348330 2026] [:error] [pid 43028:tid 43041] [client 20.198.88.1:56105] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aYIlgFnHWnJD4cJC5DsGmgAAAMs"]
[Wed Feb 04 00:42:41.388547 2026] [:error] [pid 43028:tid 43049] [client 20.198.88.1:61563] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aYIlgVnHWnJD4cJC5DsGnwAAANM"]
[Wed Feb 04 00:42:44.573840 2026] [:error] [pid 5148:tid 5155] [client 20.198.88.1:6221] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aYIlhL83HCHLtUIbS7IqlQAAAUQ"]
[Wed Feb 04 00:42:46.041850 2026] [:error] [pid 42921:tid 42958] [client 20.198.88.1:58961] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aYIlhoblShffGl-01oe12wAAAEA"]
[Wed Feb 04 00:42:46.953903 2026] [:error] [pid 5229:tid 5252] [client 20.198.88.1:58998] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYIlhkKmEgmJub93yUpLHQAAAZU"]
[Wed Feb 04 00:42:48.953839 2026] [:error] [pid 28720:tid 28745] [client 20.198.88.1:61535] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYIliGmRXm2bmr_sYiYMrQAAARc"]
[Wed Feb 04 00:42:50.012503 2026] [:error] [pid 28720:tid 28732] [client 20.198.88.1:61552] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Feb 04 00:42:50.148926 2026] [:error] [pid 28720:tid 28737] [client 20.198.88.1:61552] [client 20.198.88.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aYIlimmRXm2bmr_sYiYMsQAAAQ8"]
[Wed Feb 04 00:42:50.819214 2026] [:error] [pid 5229:tid 5239] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Wed Feb 04 00:42:50.964889 2026] [:error] [pid 5229:tid 5255] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/Ova-Simple.php
[Wed Feb 04 00:42:51.105626 2026] [:error] [pid 5229:tid 5251] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Wed Feb 04 00:42:51.258252 2026] [:error] [pid 5229:tid 5237] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/hexx.php
[Wed Feb 04 00:42:51.398629 2026] [:error] [pid 5229:tid 5233] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/cbrfo.php
[Wed Feb 04 00:42:51.539109 2026] [:error] [pid 5229:tid 5244] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Feb 04 00:42:51.679351 2026] [:error] [pid 5229:tid 5252] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/jquery.php
[Wed Feb 04 00:42:51.819411 2026] [:error] [pid 5229:tid 5248] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Wed Feb 04 00:42:51.961631 2026] [:error] [pid 5229:tid 5241] [client 20.198.88.1:64870] File does not exist: /usr/local/apache/htdocs/suspended-page/miansha.php
[Wed Feb 04 00:42:52.115729 2026] [:error] [pid 5229:tid 5238] [client 20.198.88.1:64870] [client 20.198.88.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aYIljEKmEgmJub93yUpLLQAAAYc"]
[Wed Feb 04 00:42:56.338696 2026] [:error] [pid 42922:tid 42997] [client 20.198.88.1:61512] File does not exist: /usr/local/apache/htdocs/suspended-page/xfile25.php
[Wed Feb 04 00:42:56.477221 2026] [:error] [pid 42922:tid 42994] [client 20.198.88.1:61512] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aYIlkGazX4WPS_dQRkjX8gAAAIk"]
[Wed Feb 04 00:42:57.912225 2026] [:error] [pid 5148:tid 5156] [client 20.198.88.1:51409] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aYIlkb83HCHLtUIbS7IqngAAAUU"]
[Wed Feb 04 00:42:59.008097 2026] [:error] [pid 28720:tid 28728] [client 20.198.88.1:64847] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aYIlk2mRXm2bmr_sYiYMuwAAAQY"]
[Wed Feb 04 00:43:00.944634 2026] [:error] [pid 43028:tid 43045] [client 20.198.88.1:58980] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aYIllFnHWnJD4cJC5DsGuAAAAM8"]
[Wed Feb 04 00:43:02.054010 2026] [:error] [pid 42920:tid 42948] [client 20.198.88.1:51437] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aYIlliix3YKltG4EU0m_WQAAABM"]
[Wed Feb 04 00:43:03.618846 2026] [:error] [pid 42920:tid 42952] [client 20.198.88.1:64888] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aYIllyix3YKltG4EU0m_XQAAABc"]
[Wed Feb 04 00:43:05.562620 2026] [:error] [pid 42921:tid 42972] [client 20.198.88.1:61526] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aYIlmYblShffGl-01oe17gAAAE4"]
[Wed Feb 04 00:43:07.038290 2026] [:error] [pid 43028:tid 43037] [client 20.198.88.1:64334] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aYIlm1nHWnJD4cJC5DsGuwAAAMc"]
[Wed Feb 04 00:43:08.040824 2026] [:error] [pid 42922:tid 42994] [client 20.198.88.1:64875] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aYIlnGazX4WPS_dQRkjX_AAAAIk"]
[Wed Feb 04 00:43:09.926475 2026] [:error] [pid 28720:tid 28738] [client 20.198.88.1:64836] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aYIlnWmRXm2bmr_sYiYMxgAAARA"]
[Wed Feb 04 00:43:10.926864 2026] [:error] [pid 5148:tid 5165] [client 20.198.88.1:64351] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aYIlnr83HCHLtUIbS7IqqgAAAU4"]
[Wed Feb 04 00:43:11.822210 2026] [:error] [pid 43028:tid 43047] [client 20.198.88.1:51429] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aYIln1nHWnJD4cJC5DsG0wAAANE"]
[Wed Feb 04 00:43:13.108584 2026] [:error] [pid 5229:tid 5237] [client 20.198.88.1:51421] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aYIloUKmEgmJub93yUpLNwAAAYY"]
[Wed Feb 04 00:43:15.196768 2026] [:error] [pid 43028:tid 43036] [client 20.198.88.1:64857] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aYIlo1nHWnJD4cJC5DsG3QAAAMY"]
[Wed Feb 04 00:43:16.205776 2026] [:error] [pid 42922:tid 42987] [client 20.198.88.1:64886] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aYIlpGazX4WPS_dQRkjYAAAAAII"]
[Wed Feb 04 00:43:17.585712 2026] [:error] [pid 43028:tid 43054] [client 20.198.88.1:61527] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aYIlpVnHWnJD4cJC5DsG4gAAANg"]
[Wed Feb 04 00:43:19.701809 2026] [:error] [pid 42921:tid 42962] [client 20.198.88.1:51414] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aYIlp4blShffGl-01oe19AAAAEQ"]
[Wed Feb 04 00:43:21.481473 2026] [:error] [pid 5148:tid 5157] [client 20.198.88.1:6366] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aYIlqb83HCHLtUIbS7IqtwAAAUY"]
[Wed Feb 04 00:43:22.980358 2026] [:error] [pid 28720:tid 28738] [client 20.198.88.1:61518] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aYIlqmmRXm2bmr_sYiYM2AAAARA"]
[Wed Feb 04 00:43:24.338273 2026] [:error] [pid 5229:tid 5252] [client 20.198.88.1:6353] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aYIlrEKmEgmJub93yUpLRAAAAZU"]
[Wed Feb 04 00:43:24.925300 2026] [:error] [pid 5148:tid 5158] [client 20.198.88.1:58984] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aYIlrL83HCHLtUIbS7IqugAAAUc"]
[Wed Feb 04 00:43:26.212268 2026] [:error] [pid 42921:tid 42971] [client 20.198.88.1:51401] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aYIlroblShffGl-01oe19gAAAE0"]
[Wed Feb 04 00:43:27.103299 2026] [:error] [pid 42921:tid 42961] [client 20.198.88.1:58954] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aYIlr4blShffGl-01oe1-gAAAEM"]
[Wed Feb 04 00:43:27.991607 2026] [:error] [pid 5229:tid 5250] [client 20.198.88.1:58947] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aYIlr0KmEgmJub93yUpLSwAAAZM"]
[Wed Feb 04 00:43:29.117261 2026] [:error] [pid 5148:tid 5162] [client 20.198.88.1:6385] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aYIlsb83HCHLtUIbS7IqvAAAAUs"]
[Wed Feb 04 00:43:30.027208 2026] [:error] [pid 42920:tid 42929] [client 20.198.88.1:64861] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aYIlsiix3YKltG4EU0m_eQAAAAA"]
[Wed Feb 04 00:43:30.984034 2026] [:error] [pid 42920:tid 42950] [client 20.198.88.1:64851] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aYIlsiix3YKltG4EU0m_fAAAABU"]
[Wed Feb 04 00:43:32.038764 2026] [:error] [pid 42922:tid 42990] [client 20.198.88.1:6389] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aYIltGazX4WPS_dQRkjYCAAAAIU"]
[Wed Feb 04 00:43:32.519368 2026] [:error] [pid 42922:tid 43007] [client 20.198.88.1:58992] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thebe.php"] [unique_id "aYIltGazX4WPS_dQRkjYCQAAAJY"]
[Wed Feb 04 00:43:33.038148 2026] [:error] [pid 42922:tid 42992] [client 20.198.88.1:64873] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thebe.php"] [unique_id "aYIltWazX4WPS_dQRkjYCgAAAIc"]
[Wed Feb 04 00:43:33.622504 2026] [:error] [pid 5229:tid 5236] [client 20.198.88.1:61523] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thebe.php"] [unique_id "aYIltUKmEgmJub93yUpLUwAAAYU"]
[Wed Feb 04 00:43:34.293515 2026] [:error] [pid 28720:tid 28726] [client 20.198.88.1:58964] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thebe.php"] [unique_id "aYIltmmRXm2bmr_sYiYM3gAAAQQ"]
[Wed Feb 04 00:43:35.369763 2026] [:error] [pid 28720:tid 28741] [client 20.198.88.1:6240] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ddd.php"] [unique_id "aYIlt2mRXm2bmr_sYiYM3wAAARM"]
[Wed Feb 04 00:43:36.268440 2026] [:error] [pid 42920:tid 42945] [client 20.198.88.1:51407] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ddd.php"] [unique_id "aYIluCix3YKltG4EU0m_gAAAABA"]
[Wed Feb 04 00:43:37.226468 2026] [:error] [pid 42920:tid 42929] [client 20.198.88.1:51398] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ddd.php"] [unique_id "aYIluSix3YKltG4EU0m_gQAAAAA"]
[Wed Feb 04 00:43:38.541064 2026] [:error] [pid 42921:tid 42978] [client 20.198.88.1:61530] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ddd.php"] [unique_id "aYIluoblShffGl-01oe1_AAAAFQ"]
[Wed Feb 04 00:43:39.374356 2026] [:error] [pid 5229:tid 5232] [client 20.198.88.1:58991] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aYIlu0KmEgmJub93yUpLXAAAAYE"]
[Wed Feb 04 00:43:40.554007 2026] [:error] [pid 5148:tid 5155] [client 20.198.88.1:61561] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aYIlvL83HCHLtUIbS7Iq0AAAAUQ"]
[Wed Feb 04 00:43:41.407600 2026] [:error] [pid 28720:tid 28740] [client 20.198.88.1:61565] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aYIlvWmRXm2bmr_sYiYM4gAAARI"]
[Wed Feb 04 00:43:42.040397 2026] [:error] [pid 5148:tid 5154] [client 20.198.88.1:58958] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aYIlvr83HCHLtUIbS7Iq0gAAAUM"]
[Wed Feb 04 00:43:43.012273 2026] [:error] [pid 42922:tid 43002] [client 20.198.88.1:61521] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f355.php"] [unique_id "aYIlv2azX4WPS_dQRkjYEQAAAJE"]
[Wed Feb 04 00:43:44.062865 2026] [:error] [pid 5229:tid 5237] [client 20.198.88.1:6383] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f355.php"] [unique_id "aYIlwEKmEgmJub93yUpLYQAAAYY"]
[Wed Feb 04 00:43:44.825746 2026] [:error] [pid 5229:tid 5246] [client 20.198.88.1:59002] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f355.php"] [unique_id "aYIlwEKmEgmJub93yUpLZwAAAY8"]
[Wed Feb 04 00:43:45.578833 2026] [:error] [pid 5148:tid 5155] [client 20.198.88.1:64877] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f355.php"] [unique_id "aYIlwb83HCHLtUIbS7Iq2QAAAUQ"]
[Wed Feb 04 00:43:46.330813 2026] [:error] [pid 43028:tid 43045] [client 20.198.88.1:64865] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aYIlwlnHWnJD4cJC5DsG_AAAAM8"]
[Wed Feb 04 00:43:47.258194 2026] [:error] [pid 5229:tid 5253] [client 20.198.88.1:6390] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aYIlw0KmEgmJub93yUpLbgAAAZY"]
[Wed Feb 04 00:43:48.566404 2026] [:error] [pid 42922:tid 43004] [client 20.198.88.1:51397] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aYIlxGazX4WPS_dQRkjYFAAAAJM"]
[Wed Feb 04 00:43:48.982704 2026] [:error] [pid 28720:tid 28743] [client 20.198.88.1:61505] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aYIlxGmRXm2bmr_sYiYM5QAAARU"]
[Wed Feb 04 00:43:49.580280 2026] [:error] [pid 5229:tid 5234] [client 20.198.88.1:6357] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "aYIlxUKmEgmJub93yUpLcgAAAYM"]
[Wed Feb 04 00:43:50.477343 2026] [:error] [pid 5148:tid 5164] [client 20.198.88.1:58974] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "aYIlxr83HCHLtUIbS7Iq3wAAAU0"]
[Wed Feb 04 00:43:51.262448 2026] [:error] [pid 42920:tid 42953] [client 20.198.88.1:51417] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "aYIlxyix3YKltG4EU0m_iQAAABg"]
[Wed Feb 04 00:43:51.831224 2026] [:error] [pid 42920:tid 42938] [client 20.198.88.1:6365] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "aYIlxyix3YKltG4EU0m_igAAAAk"]
[Wed Feb 04 00:43:52.683710 2026] [:error] [pid 42920:tid 42946] [client 20.198.88.1:58944] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aYIlyCix3YKltG4EU0m_iwAAABE"]
[Wed Feb 04 00:43:53.171625 2026] [:error] [pid 42920:tid 42932] [client 20.198.88.1:64855] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aYIlySix3YKltG4EU0m_jAAAAAM"]
[Wed Feb 04 00:43:53.805981 2026] [:error] [pid 42920:tid 42948] [client 20.198.88.1:61559] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aYIlySix3YKltG4EU0m_jgAAABM"]
[Wed Feb 04 00:43:54.618714 2026] [:error] [pid 43028:tid 43047] [client 20.198.88.1:6347] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aYIlylnHWnJD4cJC5DsHCwAAANE"]
[Wed Feb 04 00:43:55.562167 2026] [:error] [pid 28720:tid 28741] [client 20.198.88.1:58977] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aYIly2mRXm2bmr_sYiYM6wAAARM"]
[Wed Feb 04 00:43:56.022686 2026] [:error] [pid 42922:tid 42988] [client 20.198.88.1:51402] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Wed Feb 04 00:43:56.167985 2026] [:error] [pid 42922:tid 42991] [client 20.198.88.1:51402] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Wed Feb 04 00:43:56.307116 2026] [:error] [pid 42922:tid 43005] [client 20.198.88.1:51402] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Wed Feb 04 00:43:56.447658 2026] [:error] [pid 42922:tid 43008] [client 20.198.88.1:51402] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 04 00:43:57.189502 2026] [:error] [pid 42922:tid 43007] [client 20.198.88.1:51402] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Feb 04 00:43:57.329069 2026] [:error] [pid 42922:tid 42992] [client 20.198.88.1:51402] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 04 00:43:57.620770 2026] [:error] [pid 42922:tid 42986] [client 20.198.88.1:51402] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aYIlzWazX4WPS_dQRkjYJgAAAIE"]
[Wed Feb 04 00:43:58.464656 2026] [:error] [pid 5229:tid 5235] [client 20.198.88.1:64887] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aYIlzkKmEgmJub93yUpLdQAAAYQ"]
[Wed Feb 04 00:43:59.070637 2026] [:error] [pid 5229:tid 5242] [client 20.198.88.1:64367] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aYIlz0KmEgmJub93yUpLdgAAAYs"]
[Wed Feb 04 00:43:59.476426 2026] [:error] [pid 42922:tid 42988] [client 20.198.88.1:64834] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss1.php"] [unique_id "aYIlz2azX4WPS_dQRkjYKAAAAIM"]
[Wed Feb 04 00:44:00.195762 2026] [:error] [pid 43028:tid 43040] [client 20.198.88.1:62031] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aYIl0FnHWnJD4cJC5DsHEgAAAMo"]
[Wed Feb 04 00:44:01.400522 2026] [:error] [pid 5229:tid 5237] [client 20.198.88.1:64894] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aYIl0UKmEgmJub93yUpLfAAAAYY"]
[Wed Feb 04 00:44:02.030016 2026] [:error] [pid 43028:tid 43050] [client 20.198.88.1:64863] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aYIl0lnHWnJD4cJC5DsHEwAAANQ"]
[Wed Feb 04 00:44:03.218436 2026] [:error] [pid 42922:tid 42994] [client 20.198.88.1:58963] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aYIl02azX4WPS_dQRkjYKgAAAIk"]
[Wed Feb 04 00:44:04.146666 2026] [:error] [pid 5148:tid 5174] [client 20.198.88.1:6249] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIl1L83HCHLtUIbS7Iq7QAAAVc"]
[Wed Feb 04 00:44:05.320954 2026] [:error] [pid 42922:tid 43000] [client 20.198.88.1:59022] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIl1WazX4WPS_dQRkjYLgAAAI8"]
[Wed Feb 04 00:44:05.983999 2026] [:error] [pid 5148:tid 5171] [client 20.198.88.1:51392] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIl1b83HCHLtUIbS7Iq9AAAAVQ"]
[Wed Feb 04 00:44:07.008987 2026] [:error] [pid 42921:tid 42962] [client 20.198.88.1:51413] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIl14blShffGl-01oe2FgAAAEQ"]
[Wed Feb 04 00:44:08.133192 2026] [:error] [pid 42922:tid 42986] [client 20.198.88.1:6391] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYIl2GazX4WPS_dQRkjYMgAAAIE"]
[Wed Feb 04 00:44:08.899699 2026] [:error] [pid 42922:tid 42993] [client 20.198.88.1:6399] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYIl2GazX4WPS_dQRkjYMwAAAIg"]
[Wed Feb 04 00:44:09.752634 2026] [:error] [pid 42922:tid 42991] [client 20.198.88.1:58997] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYIl2WazX4WPS_dQRkjYNQAAAIY"]
[Wed Feb 04 00:44:10.568330 2026] [:error] [pid 42922:tid 42997] [client 20.198.88.1:61556] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYIl2mazX4WPS_dQRkjYNgAAAIw"]
[Wed Feb 04 00:44:11.648259 2026] [:error] [pid 28720:tid 28746] [client 20.198.88.1:58970] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aYIl22mRXm2bmr_sYiYM-wAAARg"]
[Wed Feb 04 00:44:12.572090 2026] [:error] [pid 43028:tid 43044] [client 20.198.88.1:6686] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aYIl3FnHWnJD4cJC5DsHHAAAAM4"]
[Wed Feb 04 00:44:13.182401 2026] [:error] [pid 42920:tid 42942] [client 20.198.88.1:58989] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aYIl3Six3YKltG4EU0m_nAAAAA0"]
[Wed Feb 04 00:44:13.520316 2026] [:error] [pid 43028:tid 43030] [client 20.198.88.1:6337] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aYIl3VnHWnJD4cJC5DsHHQAAAMA"]
[Wed Feb 04 00:44:14.006175 2026] [:error] [pid 43028:tid 43050] [client 20.198.88.1:61531] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYIl3lnHWnJD4cJC5DsHHgAAANQ"]
[Wed Feb 04 00:44:14.456640 2026] [:error] [pid 42920:tid 42953] [client 20.198.88.1:51394] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYIl3iix3YKltG4EU0m_oAAAABg"]
[Wed Feb 04 00:44:15.284774 2026] [:error] [pid 5148:tid 5157] [client 20.198.88.1:61560] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYIl3783HCHLtUIbS7Iq_AAAAUY"]
[Wed Feb 04 00:44:15.885670 2026] [:error] [pid 42921:tid 42966] [client 20.198.88.1:58960] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYIl34blShffGl-01oe2IwAAAEg"]
[Wed Feb 04 00:44:16.581769 2026] [:error] [pid 5229:tid 5249] [client 20.198.88.1:58982] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYIl4EKmEgmJub93yUpLhgAAAZI"]
[Wed Feb 04 00:44:16.992206 2026] [:error] [pid 43028:tid 43039] [client 20.198.88.1:64881] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYIl4FnHWnJD4cJC5DsHJgAAAMk"]
[Wed Feb 04 00:44:18.120143 2026] [:error] [pid 42920:tid 42935] [client 20.198.88.1:51416] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYIl4iix3YKltG4EU0m_pgAAAAY"]
[Wed Feb 04 00:44:19.275415 2026] [:error] [pid 42920:tid 42944] [client 20.198.88.1:6700] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYIl4yix3YKltG4EU0m_pwAAAA8"]
[Wed Feb 04 00:44:19.719809 2026] [:error] [pid 42921:tid 42976] [client 20.198.88.1:58948] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYIl44blShffGl-01oe2KAAAAFI"]
[Wed Feb 04 00:44:20.344130 2026] [:error] [pid 42922:tid 43004] [client 20.198.88.1:61524] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYIl5GazX4WPS_dQRkjYOgAAAJM"]
[Wed Feb 04 00:44:20.851173 2026] [:error] [pid 42922:tid 42986] [client 20.198.88.1:64848] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYIl5GazX4WPS_dQRkjYPQAAAIE"]
[Wed Feb 04 00:44:21.674564 2026] [:error] [pid 42922:tid 42996] [client 20.198.88.1:6358] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYIl5WazX4WPS_dQRkjYPwAAAIs"]
[Wed Feb 04 00:44:22.483801 2026] [:error] [pid 43028:tid 43035] [client 20.198.88.1:51408] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aYIl5lnHWnJD4cJC5DsHKgAAAMU"]
[Wed Feb 04 00:44:23.327367 2026] [:error] [pid 43028:tid 43046] [client 20.198.88.1:51427] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aYIl51nHWnJD4cJC5DsHLwAAANA"]
[Wed Feb 04 00:44:24.441474 2026] [:error] [pid 43028:tid 43054] [client 20.198.88.1:59003] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aYIl6FnHWnJD4cJC5DsHNQAAANg"]
[Wed Feb 04 00:44:25.071802 2026] [:error] [pid 43028:tid 43032] [client 20.198.88.1:64843] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aYIl6VnHWnJD4cJC5DsHOAAAAMI"]
[Wed Feb 04 00:44:25.878744 2026] [:error] [pid 28720:tid 28727] [client 20.198.88.1:61532] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aYIl6WmRXm2bmr_sYiYNCQAAAQU"]
[Wed Feb 04 00:44:26.457495 2026] [:error] [pid 28720:tid 28734] [client 20.198.88.1:58953] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aYIl6mmRXm2bmr_sYiYNDAAAAQw"]
[Wed Feb 04 00:44:27.568651 2026] [:error] [pid 5229:tid 5239] [client 20.198.88.1:64840] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aYIl60KmEgmJub93yUpLlAAAAYg"]
[Wed Feb 04 00:44:28.930519 2026] [:error] [pid 42922:tid 43007] [client 20.198.88.1:6395] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aYIl7GazX4WPS_dQRkjYQQAAAJY"]
[Wed Feb 04 00:44:29.751387 2026] [:error] [pid 42920:tid 42944] [client 20.198.88.1:64832] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aYIl7Six3YKltG4EU0m_sAAAAA8"]
[Wed Feb 04 00:44:30.646515 2026] [:error] [pid 42920:tid 42949] [client 20.198.88.1:6393] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aYIl7iix3YKltG4EU0m_twAAABQ"]
[Wed Feb 04 00:44:31.871376 2026] [:error] [pid 5148:tid 5164] [client 20.198.88.1:58965] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aYIl7783HCHLtUIbS7IrDwAAAU0"]
[Wed Feb 04 00:44:33.033650 2026] [:error] [pid 5148:tid 5155] [client 20.198.88.1:64340] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aYIl8b83HCHLtUIbS7IrEgAAAUQ"]
[Wed Feb 04 00:44:34.391914 2026] [:error] [pid 43028:tid 43052] [client 20.198.88.1:61539] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aYIl8lnHWnJD4cJC5DsHQgAAANY"]
[Wed Feb 04 00:44:35.116398 2026] [:error] [pid 28720:tid 28730] [client 20.198.88.1:64842] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aYIl82mRXm2bmr_sYiYNFAAAAQg"]
[Wed Feb 04 00:44:35.865078 2026] [:error] [pid 5229:tid 5246] [client 20.198.88.1:6399] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aYIl80KmEgmJub93yUpLnAAAAY8"]
[Wed Feb 04 00:44:36.231392 2026] [:error] [pid 5148:tid 5162] [client 20.198.88.1:6256] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aYIl9L83HCHLtUIbS7IrGAAAAUs"]
[Wed Feb 04 00:44:36.852839 2026] [:error] [pid 43028:tid 43047] [client 20.198.88.1:6210] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aYIl9FnHWnJD4cJC5DsHQwAAANE"]
[Wed Feb 04 00:44:37.475560 2026] [:error] [pid 42920:tid 42946] [client 20.198.88.1:6251] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aYIl9Six3YKltG4EU0m_wQAAABE"]
[Wed Feb 04 00:44:38.049686 2026] [:error] [pid 43028:tid 43043] [client 20.198.88.1:6343] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aYIl9lnHWnJD4cJC5DsHRAAAAM0"]
[Wed Feb 04 00:44:38.532603 2026] [:error] [pid 43028:tid 43038] [client 20.198.88.1:51448] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aYIl9lnHWnJD4cJC5DsHRQAAAMg"]
[Wed Feb 04 00:44:39.331613 2026] [:error] [pid 42920:tid 42929] [client 20.198.88.1:61555] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aYIl9yix3YKltG4EU0m_wwAAAAA"]
[Wed Feb 04 00:44:40.494884 2026] [:error] [pid 42921:tid 42959] [client 20.198.88.1:6336] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aYIl-IblShffGl-01oe2OgAAAEE"]
[Wed Feb 04 00:44:41.178892 2026] [:error] [pid 43028:tid 43031] [client 20.198.88.1:58981] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aYIl-VnHWnJD4cJC5DsHRwAAAME"]
[Wed Feb 04 00:44:42.054887 2026] [:error] [pid 43028:tid 43042] [client 20.198.88.1:51405] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aYIl-lnHWnJD4cJC5DsHSQAAAMw"]
[Wed Feb 04 00:44:42.777118 2026] [:error] [pid 42922:tid 43000] [client 20.198.88.1:51430] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aYIl-mazX4WPS_dQRkjYUQAAAI8"]
[Wed Feb 04 00:44:43.426525 2026] [:error] [pid 42921:tid 42960] [client 20.198.88.1:64882] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aYIl-4blShffGl-01oe2PwAAAEI"]
[Wed Feb 04 00:44:44.051214 2026] [:error] [pid 28720:tid 28731] [client 20.198.88.1:58988] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aYIl_GmRXm2bmr_sYiYNHQAAAQk"]
[Wed Feb 04 00:44:44.893895 2026] [:error] [pid 43028:tid 43053] [client 20.198.88.1:61540] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aYIl_FnHWnJD4cJC5DsHTAAAANc"]
[Wed Feb 04 00:44:46.219427 2026] [:error] [pid 28720:tid 28725] [client 20.198.88.1:6349] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aYIl_mmRXm2bmr_sYiYNHwAAAQM"]
[Wed Feb 04 00:44:47.040196 2026] [:error] [pid 5229:tid 5237] [client 20.198.88.1:61562] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aYIl_0KmEgmJub93yUpLowAAAYY"]
[Wed Feb 04 00:44:48.026524 2026] [:error] [pid 5148:tid 5170] [client 20.198.88.1:6265] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aYImAL83HCHLtUIbS7IrIQAAAVM"]
[Wed Feb 04 00:44:48.698587 2026] [:error] [pid 42920:tid 42945] [client 20.198.88.1:61511] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aYImACix3YKltG4EU0m_1gAAABA"]
[Wed Feb 04 00:44:49.429979 2026] [:error] [pid 42920:tid 42941] [client 20.198.88.1:64862] [client 20.198.88.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aYImASix3YKltG4EU0m_1wAAAAw"]
[Wed Feb 04 00:44:50.530595 2026] [:error] [pid 5229:tid 5241] [client 20.198.88.1:64853] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYImAkKmEgmJub93yUpLpAAAAYo"]
[Wed Feb 04 00:44:51.346476 2026] [:error] [pid 42921:tid 42963] [client 20.198.88.1:58955] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYImA4blShffGl-01oe2SQAAAEU"]
[Wed Feb 04 00:44:52.886936 2026] [:error] [pid 5148:tid 5156] [client 20.198.88.1:64895] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYImBL83HCHLtUIbS7IrKQAAAUU"]
[Wed Feb 04 00:44:53.892858 2026] [:error] [pid 43028:tid 43049] [client 20.198.88.1:64860] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYImBVnHWnJD4cJC5DsHWQAAANM"]
[Wed Feb 04 00:44:55.487162 2026] [:error] [pid 43028:tid 43041] [client 20.198.88.1:64840] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jane.php"] [unique_id "aYImB1nHWnJD4cJC5DsHXAAAAMs"]
[Wed Feb 04 00:44:56.944931 2026] [:error] [pid 42922:tid 42999] [client 20.198.88.1:6218] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jane.php"] [unique_id "aYImCGazX4WPS_dQRkjYYAAAAI4"]
[Wed Feb 04 00:44:58.892773 2026] [:error] [pid 5148:tid 5174] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/jane.php
[Wed Feb 04 00:44:59.328633 2026] [:error] [pid 5148:tid 5174] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Feb 04 00:44:59.470643 2026] [:error] [pid 5148:tid 5175] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Feb 04 00:44:59.610675 2026] [:error] [pid 5148:tid 5162] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Wed Feb 04 00:44:59.810452 2026] [:error] [pid 5148:tid 5171] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Feb 04 00:45:00.155633 2026] [:error] [pid 5148:tid 5156] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Wed Feb 04 00:45:00.310546 2026] [:error] [pid 5148:tid 5160] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Feb 04 00:45:00.605118 2026] [:error] [pid 5148:tid 5158] [client 20.198.88.1:6380] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Feb 04 00:45:01.175679 2026] [:error] [pid 5148:tid 5172] [client 20.198.88.1:6380] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aYImDb83HCHLtUIbS7IrOwAAAVU"]
[Wed Feb 04 00:45:02.584140 2026] [:error] [pid 5229:tid 5247] [client 20.198.88.1:6350] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aYImDkKmEgmJub93yUpLtAAAAZA"]
[Wed Feb 04 00:45:03.652167 2026] [:error] [pid 43028:tid 43036] [client 20.198.88.1:64859] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aYImD1nHWnJD4cJC5DsHaAAAAMY"]
[Wed Feb 04 00:45:04.516262 2026] [:error] [pid 42921:tid 42976] [client 20.198.88.1:6344] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aYImEIblShffGl-01oe2VwAAAFI"]
[Wed Feb 04 00:45:05.282781 2026] [:error] [pid 5229:tid 5231] [client 20.198.88.1:64876] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aYImEUKmEgmJub93yUpLtwAAAYA"]
[Wed Feb 04 00:45:07.120767 2026] [:error] [pid 5229:tid 5237] [client 20.198.88.1:64844] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aYImE0KmEgmJub93yUpLuQAAAYY"]
[Wed Feb 04 00:45:09.458668 2026] [:error] [pid 42920:tid 42951] [client 20.198.88.1:64871] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aYImFSix3YKltG4EU0m_5AAAABY"]
[Wed Feb 04 00:45:10.902407 2026] [:error] [pid 42920:tid 42938] [client 20.198.88.1:58978] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "aYImFiix3YKltG4EU0m_5wAAAAk"]
[Wed Feb 04 00:45:11.678638 2026] [:error] [pid 5229:tid 5232] [client 20.198.88.1:6398] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYImF0KmEgmJub93yUpLvQAAAYE"]
[Wed Feb 04 00:45:12.521422 2026] [:error] [pid 43028:tid 43039] [client 20.198.88.1:58957] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYImGFnHWnJD4cJC5DsHcwAAAMk"]
[Wed Feb 04 00:45:14.059209 2026] [:error] [pid 42920:tid 42950] [client 20.198.88.1:58952] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYImGiix3YKltG4EU0m_7QAAABU"]
[Wed Feb 04 00:45:14.827178 2026] [:error] [pid 5229:tid 5250] [client 20.198.88.1:64833] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYImGkKmEgmJub93yUpLxAAAAZM"]
[Wed Feb 04 00:45:15.624998 2026] [:error] [pid 5148:tid 5167] [client 20.198.88.1:58946] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYImG783HCHLtUIbS7IrSgAAAVA"]
[Wed Feb 04 00:45:16.415491 2026] [:error] [pid 42920:tid 42945] [client 20.198.88.1:51400] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYImHCix3YKltG4EU0m_8QAAABA"]
[Wed Feb 04 00:45:17.660108 2026] [:error] [pid 5148:tid 5159] [client 20.198.88.1:61546] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYImHb83HCHLtUIbS7IrTAAAAUg"]
[Wed Feb 04 00:45:18.419361 2026] [:error] [pid 42922:tid 43000] [client 20.198.88.1:6339] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYImHmazX4WPS_dQRkjYegAAAI8"]
[Wed Feb 04 00:45:19.480616 2026] [:error] [pid 42922:tid 42986] [client 20.198.88.1:56085] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYImH2azX4WPS_dQRkjYewAAAIE"]
[Wed Feb 04 00:45:20.611506 2026] [:error] [pid 42921:tid 42981] [client 20.198.88.1:61534] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYImIIblShffGl-01oe2XQAAAFc"]
[Wed Feb 04 00:45:21.900851 2026] [:error] [pid 42921:tid 42958] [client 20.198.88.1:6376] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYImIYblShffGl-01oe2YQAAAEA"]
[Wed Feb 04 00:45:22.227198 2026] [:error] [pid 42922:tid 42997] [client 20.198.88.1:6372] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYImImazX4WPS_dQRkjYgQAAAIw"]
[Wed Feb 04 00:45:23.554152 2026] [:error] [pid 42921:tid 42961] [client 20.198.88.1:61547] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYImI4blShffGl-01oe2YwAAAEM"]
[Wed Feb 04 00:45:24.468817 2026] [:error] [pid 5148:tid 5168] [client 20.198.88.1:64869] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYImJL83HCHLtUIbS7IrVQAAAVE"]
[Wed Feb 04 00:45:25.847999 2026] [:error] [pid 43028:tid 43036] [client 20.198.88.1:6340] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYImJVnHWnJD4cJC5DsHiQAAAMY"]
[Wed Feb 04 00:45:26.656598 2026] [:error] [pid 42921:tid 42960] [client 20.198.88.1:61544] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYImJoblShffGl-01oe2ZAAAAEI"]
[Wed Feb 04 00:45:27.913412 2026] [:error] [pid 42921:tid 42978] [client 20.198.88.1:64854] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYImJ4blShffGl-01oe2ZQAAAFQ"]
[Wed Feb 04 00:45:28.723848 2026] [:error] [pid 28720:tid 28746] [client 20.198.88.1:59007] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYImKGmRXm2bmr_sYiYNRAAAARg"]
[Wed Feb 04 00:45:29.431133 2026] [:error] [pid 5148:tid 5157] [client 20.198.88.1:64878] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYImKb83HCHLtUIbS7IrXgAAAUY"]
[Wed Feb 04 00:45:31.169176 2026] [:error] [pid 28720:tid 28734] [client 20.198.88.1:6354] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYImK2mRXm2bmr_sYiYNSgAAAQw"]
[Wed Feb 04 00:45:32.555727 2026] [:error] [pid 42921:tid 42973] [client 20.198.88.1:56068] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYImLIblShffGl-01oe2ZgAAAE8"]
[Wed Feb 04 00:45:34.271287 2026] [:error] [pid 42922:tid 43007] [client 20.198.88.1:58990] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYImLmazX4WPS_dQRkjYlgAAAJY"]
[Wed Feb 04 00:45:36.138982 2026] [:error] [pid 42922:tid 42986] [client 20.198.88.1:58995] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYImMGazX4WPS_dQRkjYmgAAAIE"]
[Wed Feb 04 00:45:39.454828 2026] [:error] [pid 42922:tid 42989] [client 20.198.88.1:64858] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYImM2azX4WPS_dQRkjYnwAAAIQ"]
[Wed Feb 04 00:45:43.012852 2026] [:error] [pid 43028:tid 43033] [client 20.198.88.1:61536] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aYImN1nHWnJD4cJC5DsHogAAAMM"]
[Wed Feb 04 00:45:43.988111 2026] [:error] [pid 42921:tid 42971] [client 20.198.88.1:6237] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aYImN4blShffGl-01oe2dQAAAE0"]
[Wed Feb 04 00:45:44.586213 2026] [:error] [pid 28720:tid 28746] [client 20.198.88.1:61549] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aYImOGmRXm2bmr_sYiYNWgAAARg"]
[Wed Feb 04 00:45:45.542425 2026] [:error] [pid 42920:tid 42933] [client 20.198.88.1:6252] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aYImOSix3YKltG4EU0nABAAAAAQ"]
[Wed Feb 04 00:45:47.224150 2026] [:error] [pid 42921:tid 42964] [client 20.198.88.1:6359] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aYImO4blShffGl-01oe2eAAAAEY"]
[Wed Feb 04 00:45:48.967359 2026] [:error] [pid 43028:tid 43036] [client 20.198.88.1:64846] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aYImPFnHWnJD4cJC5DsHqQAAAMY"]
[Wed Feb 04 00:45:50.129059 2026] [:error] [pid 5148:tid 5156] [client 20.198.88.1:6338] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aYImPr83HCHLtUIbS7IrZwAAAUU"]
[Wed Feb 04 00:45:51.925376 2026] [:error] [pid 5148:tid 5164] [client 20.198.88.1:64326] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aYImP783HCHLtUIbS7IrawAAAU0"]
[Wed Feb 04 00:45:53.733873 2026] [:error] [pid 43028:tid 43032] [client 20.198.88.1:64838] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aYImQVnHWnJD4cJC5DsHsAAAAMI"]
[Wed Feb 04 00:45:55.761847 2026] [:error] [pid 28720:tid 28723] [client 20.198.88.1:61508] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aYImQ2mRXm2bmr_sYiYNZAAAAQE"]
[Wed Feb 04 00:45:57.123581 2026] [:error] [pid 42922:tid 43005] [client 20.198.88.1:6356] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aYImRWazX4WPS_dQRkjYqAAAAJQ"]
[Wed Feb 04 00:45:58.274316 2026] [:error] [pid 43028:tid 43046] [client 20.198.88.1:6701] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aYImRlnHWnJD4cJC5DsHvwAAANA"]
[Wed Feb 04 00:45:58.952671 2026] [:error] [pid 42922:tid 43000] [client 20.198.88.1:58999] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aYImRmazX4WPS_dQRkjYqQAAAI8"]
[Wed Feb 04 00:45:59.965766 2026] [:error] [pid 43028:tid 43048] [client 20.198.88.1:51395] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aYImR1nHWnJD4cJC5DsHwgAAANI"]
[Wed Feb 04 00:46:01.971534 2026] [:error] [pid 42921:tid 42962] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Feb 04 00:46:02.412866 2026] [:error] [pid 42921:tid 42981] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Feb 04 00:46:02.563824 2026] [:error] [pid 42921:tid 42971] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Wed Feb 04 00:46:02.715946 2026] [:error] [pid 42921:tid 42976] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Wed Feb 04 00:46:02.864413 2026] [:error] [pid 42921:tid 42965] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Wed Feb 04 00:46:03.192633 2026] [:error] [pid 42921:tid 42970] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/temp.php
[Wed Feb 04 00:46:03.346366 2026] [:error] [pid 42921:tid 42968] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/admins.php
[Wed Feb 04 00:46:03.508489 2026] [:error] [pid 42921:tid 42959] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Feb 04 00:46:03.664253 2026] [:error] [pid 42921:tid 42964] [client 20.198.88.1:6251] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Wed Feb 04 00:46:03.818073 2026] [:error] [pid 42921:tid 42975] [client 20.198.88.1:6251] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aYImS4blShffGl-01oe2igAAAFE"]
[Wed Feb 04 00:46:05.416185 2026] [:error] [pid 42920:tid 42932] [client 20.198.88.1:64383] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aYImTSix3YKltG4EU0nACAAAAAM"]
[Wed Feb 04 00:46:06.246207 2026] [:error] [pid 5229:tid 5241] [client 20.198.88.1:61520] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aYImTkKmEgmJub93yUpL-gAAAYo"]
[Wed Feb 04 00:46:07.619467 2026] [:error] [pid 42920:tid 42941] [client 20.198.88.1:64835] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aYImTyix3YKltG4EU0nACQAAAAw"]
[Wed Feb 04 00:46:08.986102 2026] [:error] [pid 42920:tid 42946] [client 20.198.88.1:51406] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aYImUCix3YKltG4EU0nADQAAABE"]
[Wed Feb 04 00:46:10.318176 2026] [:error] [pid 42920:tid 42947] [client 20.198.88.1:6373] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aYImUiix3YKltG4EU0nADwAAABI"]
[Wed Feb 04 00:46:11.831463 2026] [:error] [pid 42920:tid 42948] [client 20.198.88.1:64856] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aYImUyix3YKltG4EU0nAEwAAABM"]
[Wed Feb 04 00:46:13.150140 2026] [:error] [pid 42922:tid 42989] [client 20.198.88.1:6662] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aYImVWazX4WPS_dQRkjYsQAAAIQ"]
[Wed Feb 04 00:46:14.098029 2026] [:error] [pid 42922:tid 43006] [client 20.198.88.1:61564] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aYImVmazX4WPS_dQRkjYsgAAAJU"]
[Wed Feb 04 00:46:14.930968 2026] [:error] [pid 5148:tid 5157] [client 20.198.88.1:6362] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aYImVr83HCHLtUIbS7IrfwAAAUY"]
[Wed Feb 04 00:46:16.598406 2026] [:error] [pid 5148:tid 5168] [client 20.198.88.1:61558] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aYImWL83HCHLtUIbS7IrhAAAAVE"]
[Wed Feb 04 00:46:17.666892 2026] [:error] [pid 43028:tid 43030] [client 20.198.88.1:51440] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aYImWVnHWnJD4cJC5DsH2AAAAMA"]
[Wed Feb 04 00:46:18.716327 2026] [:error] [pid 28720:tid 28734] [client 20.198.88.1:6351] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYImWmmRXm2bmr_sYiYNcgAAAQw"]
[Wed Feb 04 00:46:19.259563 2026] [:error] [pid 43028:tid 43038] [client 20.198.88.1:6661] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYImW1nHWnJD4cJC5DsH2gAAAMg"]
[Wed Feb 04 00:46:25.577621 2026] [:error] [pid 5229:tid 5236] [client 20.198.88.1:62046] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYImYUKmEgmJub93yUpMCgAAAYU"]
[Wed Feb 04 00:46:25.899784 2026] [:error] [pid 42920:tid 42953] [client 20.198.88.1:58956] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYImYSix3YKltG4EU0nAHAAAABg"]
[Wed Feb 04 00:46:26.588757 2026] [:error] [pid 5229:tid 5253] [client 20.198.88.1:6214] [client 20.198.88.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aYImYkKmEgmJub93yUpMDgAAAZY"]
[Wed Feb 04 00:46:27.980244 2026] [:error] [pid 5148:tid 5163] [client 20.198.88.1:6663] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYImY783HCHLtUIbS7IrkAAAAUw"]
[Wed Feb 04 00:46:28.410239 2026] [:error] [pid 42921:tid 42964] [client 20.198.88.1:6374] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYImZIblShffGl-01oe2kQAAAEY"]
[Wed Feb 04 00:46:29.795179 2026] [:error] [pid 5148:tid 5170] [client 20.198.88.1:64341] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYImZb83HCHLtUIbS7IrlAAAAVM"]
[Wed Feb 04 00:46:31.124641 2026] [:error] [pid 42922:tid 42988] [client 20.198.88.1:6396] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYImZ2azX4WPS_dQRkjYyAAAAIM"]
[Wed Feb 04 00:46:32.850693 2026] [:error] [pid 5229:tid 5255] [client 20.198.88.1:59000] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nyan.php"] [unique_id "aYImaEKmEgmJub93yUpMGwAAAZg"]
[Wed Feb 04 00:46:34.619601 2026] [:error] [pid 42922:tid 43002] [client 20.198.88.1:6253] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nyan.php"] [unique_id "aYImamazX4WPS_dQRkjYzQAAAJE"]
[Wed Feb 04 00:46:35.552962 2026] [:error] [pid 5148:tid 5159] [client 20.198.88.1:64348] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nyan.php"] [unique_id "aYIma783HCHLtUIbS7IrmwAAAUg"]
[Wed Feb 04 00:46:37.703128 2026] [:error] [pid 43028:tid 43049] [client 20.198.88.1:6209] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nyan.php"] [unique_id "aYImbVnHWnJD4cJC5DsH-gAAANM"]
[Wed Feb 04 00:46:39.351084 2026] [:error] [pid 42920:tid 42931] [client 20.198.88.1:64344] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aYImbyix3YKltG4EU0nAKAAAAAI"]
[Wed Feb 04 00:46:40.617139 2026] [:error] [pid 43028:tid 43047] [client 20.198.88.1:51411] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aYImcFnHWnJD4cJC5DsIBAAAANE"]
[Wed Feb 04 00:46:41.706770 2026] [:error] [pid 42921:tid 42964] [client 20.198.88.1:62048] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aYImcYblShffGl-01oe2mwAAAEY"]
[Wed Feb 04 00:46:42.480705 2026] [:error] [pid 5148:tid 5167] [client 20.198.88.1:58979] [client 20.198.88.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aYImcr83HCHLtUIbS7IroQAAAVA"]
[Wed Feb 04 01:26:58.504280 2026] [:error] [pid 43028:tid 43046] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Feb 04 01:26:58.680270 2026] [:error] [pid 43028:tid 43033] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Wed Feb 04 01:26:58.808633 2026] [:error] [pid 43028:tid 43041] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/ver.php
[Wed Feb 04 01:26:58.934245 2026] [:error] [pid 43028:tid 43049] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Wed Feb 04 01:26:59.058213 2026] [:error] [pid 43028:tid 43036] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Wed Feb 04 01:26:59.182941 2026] [:error] [pid 43028:tid 43031] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Feb 04 01:26:59.520512 2026] [:error] [pid 43028:tid 43045] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Wed Feb 04 01:26:59.744652 2026] [:error] [pid 43028:tid 43044] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Feb 04 01:26:59.873471 2026] [:error] [pid 43028:tid 43032] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Feb 04 01:27:00.004559 2026] [:error] [pid 43028:tid 43054] [client 20.89.242.151:7820] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Feb 04 01:27:00.126926 2026] [:error] [pid 43028:tid 43052] [client 20.89.242.151:7820] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIv5FnHWnJD4cJC5DsiVQAAANY"]
[Wed Feb 04 01:27:03.932016 2026] [:error] [pid 42920:tid 42929] [client 20.89.242.151:7848] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIv5yix3YKltG4EU0nTFQAAAAA"]
[Wed Feb 04 01:27:05.670834 2026] [:error] [pid 43028:tid 43032] [client 20.89.242.151:11721] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIv6VnHWnJD4cJC5DsiYAAAAMI"]
[Wed Feb 04 01:27:07.331278 2026] [:error] [pid 43028:tid 43053] [client 20.89.242.151:16073] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aYIv61nHWnJD4cJC5DsiZwAAANc"]
[Wed Feb 04 01:27:10.129944 2026] [:error] [pid 28720:tid 28746] [client 20.89.242.151:11773] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYIv7mmRXm2bmr_sYiYjLAAAARg"]
[Wed Feb 04 01:27:10.939871 2026] [:error] [pid 42922:tid 42994] [client 20.89.242.151:9023] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYIv7mazX4WPS_dQRkjrnwAAAIk"]
[Wed Feb 04 01:27:12.396322 2026] [:error] [pid 43028:tid 43032] [client 20.89.242.151:10239] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYIv8FnHWnJD4cJC5DsicAAAAMI"]
[Wed Feb 04 01:27:13.233342 2026] [:error] [pid 43028:tid 43038] [client 20.89.242.151:11686] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYIv8VnHWnJD4cJC5DsicgAAAMg"]
[Wed Feb 04 01:27:15.305751 2026] [:error] [pid 28720:tid 28726] [client 20.89.242.151:18019] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aYIv82mRXm2bmr_sYiYjNQAAAQQ"]
[Wed Feb 04 01:27:20.454272 2026] [:error] [pid 42922:tid 43003] [client 20.89.242.151:10224] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aYIv-GazX4WPS_dQRkjrpQAAAJI"]
[Wed Feb 04 01:27:23.145115 2026] [:error] [pid 43028:tid 43054] [client 20.89.242.151:11179] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "aYIv-1nHWnJD4cJC5DsigwAAANg"]
[Wed Feb 04 01:27:29.799918 2026] [:error] [pid 28720:tid 28727] [client 20.89.242.151:7911] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYIwAWmRXm2bmr_sYiYjVQAAAQU"]
[Wed Feb 04 01:27:30.831540 2026] [:error] [pid 42922:tid 42998] [client 20.89.242.151:20906] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYIwAmazX4WPS_dQRkjrrgAAAI0"]
[Wed Feb 04 01:27:34.450900 2026] [:error] [pid 5148:tid 5157] [client 20.89.242.151:10207] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYIwBr83HCHLtUIbS7JA_AAAAUY"]
[Wed Feb 04 01:27:37.416352 2026] [:error] [pid 42920:tid 42934] [client 20.89.242.151:10217] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYIwCSix3YKltG4EU0nTKwAAAAU"]
[Wed Feb 04 01:27:39.170410 2026] [:error] [pid 5148:tid 5156] [client 20.89.242.151:20876] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aYIwC783HCHLtUIbS7JBAAAAAUU"]
[Wed Feb 04 01:27:40.521758 2026] [:error] [pid 5148:tid 5175] [client 20.89.242.151:11175] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aYIwDL83HCHLtUIbS7JBAgAAAVg"]
[Wed Feb 04 01:27:42.404791 2026] [:error] [pid 42920:tid 42929] [client 20.89.242.151:6741] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aYIwDiix3YKltG4EU0nTLwAAAAA"]
[Wed Feb 04 01:27:44.239821 2026] [:error] [pid 42922:tid 42987] [client 20.89.242.151:19992] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/990.php"] [unique_id "aYIwEGazX4WPS_dQRkjrtgAAAII"]
[Wed Feb 04 01:27:51.220560 2026] [:error] [pid 5229:tid 5245] [client 20.89.242.151:4029] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aYIwF0KmEgmJub93yUpkJQAAAY4"]
[Wed Feb 04 01:27:53.317162 2026] [:error] [pid 42921:tid 42965] [client 20.89.242.151:3772] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aYIwGYblShffGl-01ofJrQAAAEc"]
[Wed Feb 04 01:27:55.900701 2026] [:error] [pid 42922:tid 42991] [client 20.89.242.151:20933] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aYIwG2azX4WPS_dQRkjrvwAAAIY"]
[Wed Feb 04 01:27:58.521331 2026] [:error] [pid 43028:tid 43047] [client 20.89.242.151:14963] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aYIwHlnHWnJD4cJC5DsiuAAAANE"]
[Wed Feb 04 01:27:59.519364 2026] [:error] [pid 43028:tid 43040] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Wed Feb 04 01:27:59.643626 2026] [:error] [pid 43028:tid 43036] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Wed Feb 04 01:27:59.769251 2026] [:error] [pid 43028:tid 43041] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/data.php
[Wed Feb 04 01:27:59.905515 2026] [:error] [pid 43028:tid 43043] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/check.php
[Wed Feb 04 01:28:00.118154 2026] [:error] [pid 43028:tid 43052] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Wed Feb 04 01:28:00.245814 2026] [:error] [pid 43028:tid 43050] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header-json.php
[Wed Feb 04 01:28:00.369800 2026] [:error] [pid 43028:tid 43054] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/ultra.php
[Wed Feb 04 01:28:00.504935 2026] [:error] [pid 43028:tid 43039] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 04 01:28:00.639650 2026] [:error] [pid 43028:tid 43032] [client 20.89.242.151:7473] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Feb 04 01:28:00.797331 2026] [:error] [pid 43028:tid 43049] [client 20.89.242.151:7473] [client 20.89.242.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aYIwIFnHWnJD4cJC5DsiwwAAANM"]
[Wed Feb 04 01:28:01.576928 2026] [:error] [pid 5229:tid 5242] [client 20.89.242.151:14951] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Wed Feb 04 01:28:01.700709 2026] [:error] [pid 5229:tid 5251] [client 20.89.242.151:14951] [client 20.89.242.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aYIwIUKmEgmJub93yUpkNQAAAZQ"]
[Wed Feb 04 01:28:05.762593 2026] [:error] [pid 43028:tid 43041] [client 20.89.242.151:14948] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Wed Feb 04 01:28:05.994646 2026] [:error] [pid 43028:tid 43050] [client 20.89.242.151:14948] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aYIwJVnHWnJD4cJC5Dsi0QAAANQ"]
[Wed Feb 04 01:28:07.988841 2026] [:error] [pid 5148:tid 5166] [client 20.89.242.151:14932] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aYIwJ783HCHLtUIbS7JBEQAAAU8"]
[Wed Feb 04 01:28:10.898712 2026] [:error] [pid 5229:tid 5234] [client 20.89.242.151:14974] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aYIwKkKmEgmJub93yUpkPAAAAYM"]
[Wed Feb 04 01:28:14.343166 2026] [:error] [pid 5229:tid 5247] [client 20.89.242.151:3734] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aYIwLkKmEgmJub93yUpkRAAAAZA"]
[Wed Feb 04 01:28:15.410665 2026] [:error] [pid 42922:tid 42985] [client 20.89.242.151:8245] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aYIwL2azX4WPS_dQRkjr2wAAAIA"]
[Wed Feb 04 01:28:23.005566 2026] [:error] [pid 42922:tid 43002] [client 20.89.242.151:20233] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aYIwN2azX4WPS_dQRkjr4wAAAJE"]
[Wed Feb 04 01:28:27.184564 2026] [:error] [pid 42921:tid 42961] [client 20.89.242.151:18257] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aYIwO4blShffGl-01ofJ3AAAAEM"]
[Wed Feb 04 01:28:29.467137 2026] [:error] [pid 43028:tid 43040] [client 20.89.242.151:20071] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aYIwPVnHWnJD4cJC5Dsi5AAAAMo"]
[Wed Feb 04 01:28:30.269923 2026] [:error] [pid 28720:tid 28730] [client 20.89.242.151:18949] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aYIwPmmRXm2bmr_sYiYjwwAAAQg"]
[Wed Feb 04 01:28:38.737716 2026] [:error] [pid 42921:tid 42974] [client 20.89.242.151:20950] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aYIwRoblShffGl-01ofJ6AAAAFA"]
[Wed Feb 04 01:28:54.068008 2026] [:error] [pid 42920:tid 42933] [client 20.89.242.151:10577] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIwViix3YKltG4EU0nTdQAAAAQ"]
[Wed Feb 04 01:28:57.191999 2026] [:error] [pid 42922:tid 42996] [client 20.89.242.151:17725] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIwWWazX4WPS_dQRkjsCwAAAIs"]
[Wed Feb 04 01:28:58.144432 2026] [:error] [pid 5148:tid 5157] [client 20.89.242.151:15415] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIwWr83HCHLtUIbS7JBQQAAAUY"]
[Wed Feb 04 01:29:02.979166 2026] [:error] [pid 42921:tid 42979] [client 20.89.242.151:5276] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYIwXoblShffGl-01ofJ-QAAAFU"]
[Wed Feb 04 01:29:04.772759 2026] [:error] [pid 28720:tid 28727] [client 20.89.242.151:10903] [client 20.89.242.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYIwYGmRXm2bmr_sYiYj4AAAAQU"]
[Wed Feb 04 01:29:08.928947 2026] [:error] [pid 43028:tid 43037] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Feb 04 01:29:09.254448 2026] [:error] [pid 43028:tid 43039] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Feb 04 01:29:09.404716 2026] [:error] [pid 43028:tid 43035] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Feb 04 01:29:09.532916 2026] [:error] [pid 43028:tid 43030] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Wed Feb 04 01:29:09.805389 2026] [:error] [pid 43028:tid 43054] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/999.php
[Wed Feb 04 01:29:10.072500 2026] [:error] [pid 43028:tid 43049] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Wed Feb 04 01:29:10.217948 2026] [:error] [pid 43028:tid 43040] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Feb 04 01:29:10.548237 2026] [:error] [pid 43028:tid 43048] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Wed Feb 04 01:29:11.187126 2026] [:error] [pid 43028:tid 43034] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Feb 04 01:29:11.320167 2026] [:error] [pid 43028:tid 43037] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/re.php
[Wed Feb 04 01:29:11.448404 2026] [:error] [pid 43028:tid 43041] [client 20.89.242.151:7076] File does not exist: /usr/local/apache/htdocs/suspended-page/file56.php
[Wed Feb 04 01:59:46.921118 2026] [:error] [pid 5148:tid 5168] [client 104.208.91.171:14984] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Wed Feb 04 01:59:47.042499 2026] [:error] [pid 5148:tid 5155] [client 104.208.91.171:14984] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 04 01:59:47.411856 2026] [:error] [pid 5148:tid 5175] [client 104.208.91.171:14984] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Feb 04 01:59:47.534063 2026] [:error] [pid 5148:tid 5171] [client 104.208.91.171:14984] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Feb 04 01:59:48.000540 2026] [:error] [pid 5148:tid 5152] [client 104.208.91.171:14984] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Feb 04 01:59:48.159236 2026] [:error] [pid 5148:tid 5160] [client 104.208.91.171:14984] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Wed Feb 04 01:59:48.436002 2026] [:error] [pid 5148:tid 5170] [client 104.208.91.171:14984] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/"] [unique_id "aYI3lL83HCHLtUIbS7JKJwAAAVM"]
[Wed Feb 04 01:59:48.917486 2026] [:error] [pid 5148:tid 5169] [client 104.208.91.171:9223] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/"] [unique_id "aYI3lL83HCHLtUIbS7JKKAAAAVI"]
[Wed Feb 04 01:59:49.394375 2026] [:error] [pid 5229:tid 5247] [client 104.208.91.171:17753] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/"] [unique_id "aYI3lUKmEgmJub93yUprzAAAAZA"]
[Wed Feb 04 01:59:49.866516 2026] [:error] [pid 42922:tid 43002] [client 104.208.91.171:17738] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/"] [unique_id "aYI3lWazX4WPS_dQRkjx1wAAAJE"]
[Wed Feb 04 02:35:36.624736 2026] [:error] [pid 28720:tid 28728] [client 136.109.60.112:52351] [client 136.109.60.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.60.112, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYI_-GmRXm2bmr_sYiYw4wAAAQY"]
[Wed Feb 04 02:35:36.629093 2026] [:error] [pid 28720:tid 28728] [client 136.109.60.112:52351] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 04 02:35:38.697830 2026] [:error] [pid 28720:tid 28741] [client 136.109.60.112:52351] [client 136.109.60.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aYI_-mmRXm2bmr_sYiYw8QAAARM"]
[Wed Feb 04 02:35:39.048053 2026] [:error] [pid 43028:tid 43035] [client 136.109.60.112:56779] [client 136.109.60.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aYI_-1nHWnJD4cJC5Ds0FgAAAMU"]
[Wed Feb 04 02:35:39.399232 2026] [:error] [pid 5148:tid 5162] [client 136.109.60.112:49948] [client 136.109.60.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aYI_-783HCHLtUIbS7JVTQAAAUs"]
[Wed Feb 04 02:35:39.754888 2026] [:error] [pid 43028:tid 43046] [client 136.109.60.112:64059] [client 136.109.60.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aYI_-1nHWnJD4cJC5Ds0FwAAANA"]
[Wed Feb 04 02:35:40.110623 2026] [:error] [pid 42922:tid 42991] [client 136.109.60.112:62085] [client 136.109.60.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aYI__GazX4WPS_dQRkj4mQAAAIY"]
[Wed Feb 04 02:35:40.463270 2026] [:error] [pid 5229:tid 5253] [client 136.109.60.112:63379] [client 136.109.60.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aYI__EKmEgmJub93yUpzvQAAAZY"]
[Wed Feb 04 02:35:40.816395 2026] [:error] [pid 43028:tid 43036] [client 136.109.60.112:64992] [client 136.109.60.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aYI__FnHWnJD4cJC5Ds0GQAAAMY"]
[Wed Feb 04 03:26:25.478348 2026] [:error] [pid 16958:tid 16967] [client 193.36.225.23:58559] [client 193.36.225.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.23, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aYJL4fsRIl-kVnfUdfCDjgAAAMc"]
[Wed Feb 04 03:26:25.482209 2026] [:error] [pid 16958:tid 16967] [client 193.36.225.23:58559] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Feb 04 08:32:21.246426 2026] [:error] [pid 18816:tid 18829] [client 45.92.1.79:54279] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYKTlcszZcOol_Iv-0V8ewAAAQo"]
[Wed Feb 04 08:32:21.869356 2026] [:error] [pid 47676:tid 47699] [client 45.92.1.79:54546] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYKTlQrYSkTgZEfUDqGkUwAAANU"]
[Wed Feb 04 08:32:22.454401 2026] [:error] [pid 18816:tid 18821] [client 45.92.1.79:54878] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYKTlsszZcOol_Iv-0V8xgAAAQI"]
[Wed Feb 04 08:32:23.058457 2026] [:error] [pid 47676:tid 47681] [client 45.92.1.79:55120] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYKTlwrYSkTgZEfUDqGkcwAAAMM"]
[Wed Feb 04 08:32:23.649847 2026] [:error] [pid 18816:tid 18834] [client 45.92.1.79:55431] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYKTl8szZcOol_Iv-0V85wAAAQ8"]
[Wed Feb 04 11:30:25.189103 2026] [:error] [pid 8285:tid 8308] [client 52.230.38.36:14037] [client 52.230.38.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aYK9URpweS7ndDaunz9A4AAAAFU"]
[Wed Feb 04 11:30:25.641625 2026] [:error] [pid 8285:tid 8291] [client 52.230.38.36:7198] [client 52.230.38.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aYK9URpweS7ndDaunz9A5AAAAEQ"]
[Wed Feb 04 11:30:26.043586 2026] [:error] [pid 47500:tid 47528] [client 52.230.38.36:14435] [client 52.230.38.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aYK9UrrUat0rhPdY3A2HEQAAAVg"]
[Wed Feb 04 11:30:26.441764 2026] [:error] [pid 8285:tid 8303] [client 52.230.38.36:16922] [client 52.230.38.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "aYK9UhpweS7ndDaunz9A6gAAAFA"]
[Wed Feb 04 15:42:18.841395 2026] [:error] [pid 8285:tid 8292] [client 49.37.34.120:61651] [client 49.37.34.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.34.120, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYL4WhpweS7ndDaunz-m_gAAAEU"]
[Wed Feb 04 15:42:18.846450 2026] [:error] [pid 8285:tid 8292] [client 49.37.34.120:61651] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 05 02:56:06.782560 2026] [:error] [pid 63686:tid 63766] [client 217.77.10.74:57365] [client 217.77.10.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYOWRhyaRl9O5jmngTw04gAAARc"]
[Thu Feb 05 05:39:13.245643 2026] [:error] [pid 12189:tid 12252] [client 136.144.33.250:55825] [client 136.144.33.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.250, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aYO8gb10V_VY_a0vRT59XQAAAIE"]
[Thu Feb 05 05:39:13.250032 2026] [:error] [pid 12189:tid 12252] [client 136.144.33.250:55825] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Feb 05 10:30:53.300599 2026] [:error] [pid 31775:tid 31807] [client 45.92.1.79:62973] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYQA3RNlTj92HTKsJN1t0wAAAQI"]
[Thu Feb 05 10:30:53.942387 2026] [:error] [pid 31774:tid 31783] [client 45.92.1.79:63418] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYQA3ajDlLg1NOhSOXWAUAAAAIU"]
[Thu Feb 05 10:30:54.552258 2026] [:error] [pid 33396:tid 33407] [client 45.92.1.79:63872] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYQA3vTgp_Ev6LiSSgApigAAAMQ"]
[Thu Feb 05 10:30:55.453713 2026] [:error] [pid 33122:tid 33147] [client 45.92.1.79:64334] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYQA3_W0IebAnFB9KDCT5QAAAFc"]
[Thu Feb 05 10:30:56.213059 2026] [:error] [pid 33396:tid 33406] [client 45.92.1.79:64809] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYQA4PTgp_Ev6LiSSgAprwAAAMM"]
[Thu Feb 05 19:53:50.594046 2026] [:error] [pid 19213:tid 19223] [client 20.220.62.160:20451] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Feb 05 23:45:54.682294 2026] [:error] [pid 31833:tid 31842] [client 103.184.104.14:32656] [client 103.184.104.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.184.104.14, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYS7MhzypZt5yekRAkF-tgAAAYc"]
[Thu Feb 05 23:45:54.693415 2026] [:error] [pid 31833:tid 31842] [client 103.184.104.14:32656] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 06 02:55:17.596073 2026] [:error] [pid 11121:tid 11140] [client 217.217.250.193:60889] [client 217.217.250.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYTnlREsbmrTJ-7kOtYDnAAAAA4"]
[Fri Feb 06 02:55:18.213157 2026] [:error] [pid 64116:tid 64140] [client 217.217.250.193:62212] [client 217.217.250.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aYTnlrq-pUXYJUX2oz8mawAAANE"]
[Fri Feb 06 02:55:18.833078 2026] [:error] [pid 11122:tid 11179] [client 217.217.250.193:65288] [client 217.217.250.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aYTnlj0RBzI4cnzjYXLH6wAAAJY"]
[Fri Feb 06 02:59:47.911434 2026] [:error] [pid 11122:tid 11174] [client 20.220.62.160:42818] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Feb 06 03:07:17.234350 2026] [:error] [pid 64116:tid 64133] [client 34.56.184.135:64985] [client 34.56.184.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.56.184.135, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYTqZbq-pUXYJUX2oz8qugAAAMo"]
[Fri Feb 06 03:07:17.237872 2026] [:error] [pid 64116:tid 64133] [client 34.56.184.135:64985] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 06 03:07:20.004233 2026] [:error] [pid 64116:tid 64135] [client 34.56.184.135:64985] [client 34.56.184.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aYTqaLq-pUXYJUX2oz8qxQAAAMw"]
[Fri Feb 06 03:07:20.432434 2026] [:error] [pid 39858:tid 39881] [client 34.56.184.135:50229] [client 34.56.184.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aYTqaPNde7AItnr98t0E4gAAAVM"]
[Fri Feb 06 03:07:20.897310 2026] [:error] [pid 11121:tid 11150] [client 34.56.184.135:61065] [client 34.56.184.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aYTqaBEsbmrTJ-7kOtYGCQAAABc"]
[Fri Feb 06 03:07:21.357696 2026] [:error] [pid 11122:tid 11171] [client 34.56.184.135:52176] [client 34.56.184.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aYTqaT0RBzI4cnzjYXLKOAAAAI4"]
[Fri Feb 06 03:07:21.780367 2026] [:error] [pid 11121:tid 11137] [client 34.56.184.135:62677] [client 34.56.184.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aYTqaREsbmrTJ-7kOtYGDAAAAAs"]
[Fri Feb 06 03:07:22.267702 2026] [:error] [pid 39858:tid 39884] [client 34.56.184.135:54397] [client 34.56.184.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aYTqavNde7AItnr98t0E5QAAAVY"]
[Fri Feb 06 03:07:22.678345 2026] [:error] [pid 39858:tid 39879] [client 34.56.184.135:50916] [client 34.56.184.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aYTqavNde7AItnr98t0E5gAAAVE"]
[Fri Feb 06 07:36:07.492742 2026] [:error] [pid 1663:tid 1685] [client 20.110.58.239:4245] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Feb 06 09:09:45.880471 2026] [:error] [pid 1664:tid 1720] [client 204.10.194.20:60795] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 06 19:10:42.755860 2026] [:error] [pid 46432:tid 46453] [client 194.5.82.135:32085] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aYXMMgbwJwu_od0kZjMT-AAAAlM"]
[Fri Feb 06 19:10:43.120817 2026] [:error] [pid 36857:tid 36871] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 06 19:10:43.306002 2026] [:error] [pid 36857:tid 36861] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Fri Feb 06 19:10:43.681238 2026] [:error] [pid 36857:tid 36875] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 06 19:10:43.867943 2026] [:error] [pid 36857:tid 36869] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 06 19:10:44.052279 2026] [:error] [pid 36857:tid 36865] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Fri Feb 06 19:10:44.235130 2026] [:error] [pid 36857:tid 36864] [client 194.5.82.120:32637] [client 194.5.82.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.5.82.120, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYXMNJVQwfj7Kp4Dd0HgxAAAAYU"]
[Fri Feb 06 19:10:44.238596 2026] [:error] [pid 36857:tid 36864] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 06 19:10:44.610249 2026] [:error] [pid 36857:tid 36878] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Feb 06 19:10:44.793229 2026] [:error] [pid 36857:tid 36872] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 06 19:10:44.986675 2026] [:error] [pid 36857:tid 36880] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Feb 06 19:10:45.355122 2026] [:error] [pid 36857:tid 36882] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Feb 06 19:10:46.896995 2026] [:error] [pid 36857:tid 36859] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Feb 06 19:10:47.266316 2026] [:error] [pid 36857:tid 36863] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 06 19:10:47.450608 2026] [:error] [pid 36857:tid 36874] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Fri Feb 06 19:10:49.093400 2026] [:error] [pid 36857:tid 36868] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Fri Feb 06 19:10:49.280469 2026] [:error] [pid 36857:tid 36881] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 06 19:10:49.471674 2026] [:error] [pid 36857:tid 36877] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Fri Feb 06 19:10:49.658928 2026] [:error] [pid 36857:tid 36875] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 06 19:10:49.842396 2026] [:error] [pid 36857:tid 36869] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Fri Feb 06 19:10:50.221298 2026] [:error] [pid 36857:tid 36864] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Feb 06 19:10:50.412444 2026] [:error] [pid 36857:tid 36876] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 06 19:10:50.597148 2026] [:error] [pid 36857:tid 36878] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Feb 06 19:10:50.782662 2026] [:error] [pid 36857:tid 36872] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Feb 06 19:10:50.971057 2026] [:error] [pid 36857:tid 36880] [client 194.5.82.120:32637] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Feb 06 19:10:51.152912 2026] [:error] [pid 36857:tid 36870] [client 194.5.82.120:32637] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aYXMO5VQwfj7Kp4Dd0Hg4AAAAYs"]
[Fri Feb 06 19:10:51.701430 2026] [:error] [pid 3477:tid 3483] [client 194.5.82.113:53061] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Fri Feb 06 19:10:51.884313 2026] [:error] [pid 3477:tid 3482] [client 194.5.82.113:53061] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aYXMO7L0Hdh40C7HYgVX9wAAAMM"]
[Fri Feb 06 19:10:52.248754 2026] [:error] [pid 3381:tid 3436] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri Feb 06 19:10:52.437425 2026] [:error] [pid 3381:tid 3414] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/form.php
[Fri Feb 06 19:10:52.808606 2026] [:error] [pid 3381:tid 3430] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Feb 06 19:10:52.993178 2026] [:error] [pid 3381:tid 3424] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Feb 06 19:10:53.180678 2026] [:error] [pid 3381:tid 3417] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Feb 06 19:10:53.566466 2026] [:error] [pid 3381:tid 3421] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 06 19:10:53.760864 2026] [:error] [pid 3381:tid 3427] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 06 19:10:55.185007 2026] [:error] [pid 3381:tid 3427] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 06 19:10:55.376082 2026] [:error] [pid 3381:tid 3419] [client 194.5.82.113:65219] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Feb 06 19:10:56.852442 2026] [:error] [pid 3381:tid 3419] [client 194.5.82.113:65219] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aYXMQC81zqRg96ZREghTxAAAAEY"]
[Fri Feb 06 19:10:57.288058 2026] [:error] [pid 3477:tid 3487] [client 194.5.82.155:23337] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 06 19:10:57.471806 2026] [:error] [pid 3477:tid 3491] [client 194.5.82.155:23337] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 06 19:10:57.651893 2026] [:error] [pid 3477:tid 3483] [client 194.5.82.155:23337] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-atom.php"] [unique_id "aYXMQbL0Hdh40C7HYgVYBQAAAMQ"]
[Fri Feb 06 19:10:58.022843 2026] [:error] [pid 3477:tid 3502] [client 194.5.82.122:51927] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 06 19:10:58.217854 2026] [:error] [pid 3477:tid 3484] [client 194.5.82.122:51927] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Fri Feb 06 19:10:58.772479 2026] [:error] [pid 3477:tid 3500] [client 194.5.82.122:51927] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Fri Feb 06 19:10:59.143486 2026] [:error] [pid 3477:tid 3479] [client 194.5.82.122:51927] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php
[Fri Feb 06 19:10:59.341049 2026] [:error] [pid 3477:tid 3487] [client 194.5.82.122:51927] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aYXMQ7L0Hdh40C7HYgVYDwAAAMg"]
[Fri Feb 06 19:10:59.901917 2026] [:error] [pid 15821:tid 15843] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Fri Feb 06 19:11:00.090791 2026] [:error] [pid 15821:tid 15830] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Feb 06 19:11:00.277081 2026] [:error] [pid 15821:tid 15825] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Feb 06 19:11:00.472197 2026] [:error] [pid 15821:tid 15826] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Feb 06 19:11:00.657278 2026] [:error] [pid 15821:tid 15849] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Feb 06 19:11:00.955509 2026] [:error] [pid 15821:tid 15841] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 06 19:11:01.353428 2026] [:error] [pid 15821:tid 15845] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Feb 06 19:11:01.542097 2026] [:error] [pid 15821:tid 15848] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Feb 06 19:11:01.752811 2026] [:error] [pid 15821:tid 15837] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 06 19:11:01.941829 2026] [:error] [pid 15821:tid 15842] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Fri Feb 06 19:11:02.336839 2026] [:error] [pid 15821:tid 15829] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Feb 06 19:11:02.524150 2026] [:error] [pid 15821:tid 15838] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 06 19:11:02.730829 2026] [:error] [pid 15821:tid 15843] [client 194.5.82.169:20397] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 06 19:11:02.919923 2026] [:error] [pid 15821:tid 15830] [client 194.5.82.169:20397] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aYXMRnARQa67J4c772n5uwAAAQU"]
[Fri Feb 06 20:54:33.016668 2026] [:error] [pid 3382:tid 3445] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Fri Feb 06 20:54:33.259828 2026] [:error] [pid 3382:tid 3447] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/031.php
[Fri Feb 06 20:54:33.515772 2026] [:error] [pid 3382:tid 3463] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/ilex.php
[Fri Feb 06 20:54:33.780433 2026] [:error] [pid 3382:tid 3455] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/flex.php
[Fri Feb 06 20:54:34.022849 2026] [:error] [pid 3382:tid 3441] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/mlex.php
[Fri Feb 06 20:54:34.421652 2026] [:error] [pid 3382:tid 3452] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/wlex.php
[Fri Feb 06 20:54:34.696385 2026] [:error] [pid 3382:tid 3462] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aaa.php
[Fri Feb 06 20:54:35.121202 2026] [:error] [pid 3382:tid 3444] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/klex.php
[Fri Feb 06 20:54:35.373677 2026] [:error] [pid 3382:tid 3450] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/about3.php
[Fri Feb 06 20:54:35.623292 2026] [:error] [pid 3382:tid 3446] [client 68.221.137.26:51244] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Feb 06 20:54:35.907498 2026] [:error] [pid 3382:tid 3443] [client 68.221.137.26:51244] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aYXki8IgU1HR0rhYrE9Q8AAAAIM"]
[Fri Feb 06 20:54:36.750627 2026] [:error] [pid 15821:tid 15843] [client 68.221.137.26:51199] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aYXkjHARQa67J4c772kKzgAAARI"]
[Fri Feb 06 20:54:37.824267 2026] [:error] [pid 3513:tid 3534] [client 68.221.137.26:51544] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aYXkjTSw3-HAlzpqSxzQ7QAAAVM"]
[Fri Feb 06 20:54:39.057913 2026] [:error] [pid 3513:tid 3521] [client 68.221.137.26:51563] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "aYXkjzSw3-HAlzpqSxzQ7wAAAUY"]
[Fri Feb 06 20:54:39.951623 2026] [:error] [pid 46432:tid 46451] [client 68.221.137.26:51343] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aYXkjwbwJwu_od0kZjMnNQAAAlE"]
[Fri Feb 06 20:54:40.857561 2026] [:error] [pid 3477:tid 3495] [client 68.221.137.26:51339] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aYXkkLL0Hdh40C7HYgVv4AAAANA"]
[Fri Feb 06 20:54:41.481083 2026] [:error] [pid 36928:tid 36936] [client 68.221.137.26:51278] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aYXkkZs7fyU8D36r-OpvFQAAAcQ"]
[Fri Feb 06 20:54:42.672057 2026] [:error] [pid 15821:tid 15849] [client 68.221.137.26:51690] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aYXkknARQa67J4c772kKzwAAARg"]
[Fri Feb 06 20:54:44.027292 2026] [:error] [pid 3477:tid 3489] [client 68.221.137.26:51242] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aYXklLL0Hdh40C7HYgVv5QAAAMo"]
[Fri Feb 06 20:54:45.204786 2026] [:error] [pid 46432:tid 46454] [client 68.221.137.26:51107] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aYXklQbwJwu_od0kZjMnOAAAAlQ"]
[Fri Feb 06 20:54:45.932154 2026] [:error] [pid 3382:tid 3457] [client 68.221.137.26:51675] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aYXklcIgU1HR0rhYrE9RCgAAAJE"]
[Fri Feb 06 20:54:47.271467 2026] [:error] [pid 15821:tid 15832] [client 68.221.137.26:51550] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "aYXkl3ARQa67J4c772kK1QAAAQc"]
[Fri Feb 06 20:54:48.932209 2026] [:error] [pid 46432:tid 46456] [client 68.221.137.26:51190] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aYXkmAbwJwu_od0kZjMnPgAAAlY"]
[Fri Feb 06 20:54:49.802208 2026] [:error] [pid 46432:tid 46446] [client 68.221.137.26:51443] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aYXkmQbwJwu_od0kZjMnQgAAAkw"]
[Fri Feb 06 20:54:51.394458 2026] [:error] [pid 3477:tid 3492] [client 68.221.137.26:51758] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aYXkm7L0Hdh40C7HYgVv_QAAAM0"]
[Fri Feb 06 20:54:52.135182 2026] [:error] [pid 3513:tid 3530] [client 68.221.137.26:51354] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "aYXknDSw3-HAlzpqSxzRAwAAAU8"]
[Fri Feb 06 20:54:52.922092 2026] [:error] [pid 3477:tid 3489] [client 68.221.137.26:51281] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYXknLL0Hdh40C7HYgVwBAAAAMo"]
[Fri Feb 06 20:54:53.706437 2026] [:error] [pid 46432:tid 46457] [client 68.221.137.26:51173] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYXknQbwJwu_od0kZjMnRAAAAlc"]
[Fri Feb 06 20:54:54.237048 2026] [:error] [pid 3513:tid 3534] [client 68.221.137.26:51097] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYXknjSw3-HAlzpqSxzRCQAAAVM"]
[Fri Feb 06 20:54:55.309006 2026] [:error] [pid 3380:tid 3403] [client 68.221.137.26:51076] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYXknxFAlUvBGSBK2jdk8gAAABM"]
[Fri Feb 06 20:54:55.895515 2026] [:error] [pid 36928:tid 36945] [client 68.221.137.26:51405] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp.php"] [unique_id "aYXkn5s7fyU8D36r-OpvIQAAAc0"]
[Fri Feb 06 20:54:56.575183 2026] [:error] [pid 3477:tid 3481] [client 68.221.137.26:51102] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp.php"] [unique_id "aYXkoLL0Hdh40C7HYgVwFgAAAMI"]
[Fri Feb 06 20:54:57.511216 2026] [:error] [pid 3381:tid 3426] [client 68.221.137.26:51585] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp.php"] [unique_id "aYXkoS81zqRg96ZREghpnwAAAE0"]
[Fri Feb 06 20:54:58.355298 2026] [:error] [pid 37019:tid 37022] [client 68.221.137.26:51179] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp.php"] [unique_id "aYXkogkAjqd3bcgYBrtkDwAAAgE"]
[Fri Feb 06 20:54:59.334148 2026] [:error] [pid 3381:tid 3416] [client 68.221.137.26:51226] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aYXkoy81zqRg96ZREghpoQAAAEM"]
[Fri Feb 06 20:55:00.150610 2026] [:error] [pid 37019:tid 37021] [client 68.221.137.26:51255] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aYXkpAkAjqd3bcgYBrtkEwAAAgA"]
[Fri Feb 06 20:55:00.898246 2026] [:error] [pid 37019:tid 37029] [client 68.221.137.26:51231] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aYXkpAkAjqd3bcgYBrtkFgAAAgg"]
[Fri Feb 06 20:55:01.522513 2026] [:error] [pid 37019:tid 37040] [client 68.221.137.26:51637] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/555.php"] [unique_id "aYXkpQkAjqd3bcgYBrtkFwAAAhM"]
[Fri Feb 06 20:55:02.048824 2026] [:error] [pid 15821:tid 15849] [client 68.221.137.26:51598] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aYXkpnARQa67J4c772kK7AAAARg"]
[Fri Feb 06 20:55:02.690071 2026] [:error] [pid 15821:tid 15846] [client 68.221.137.26:51803] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aYXkpnARQa67J4c772kK7gAAARU"]
[Fri Feb 06 20:55:03.391198 2026] [:error] [pid 36857:tid 36877] [client 68.221.137.26:51622] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aYXkp5VQwfj7Kp4Dd0HvzQAAAZI"]
[Fri Feb 06 20:55:04.141209 2026] [:error] [pid 15821:tid 15825] [client 68.221.137.26:51705] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aYXkqHARQa67J4c772kK8QAAAQA"]
[Fri Feb 06 20:55:05.394587 2026] [:error] [pid 46432:tid 46443] [client 68.221.137.26:51717] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aYXkqQbwJwu_od0kZjMnTwAAAkk"]
[Fri Feb 06 20:55:06.126162 2026] [:error] [pid 3513:tid 3534] [client 68.221.137.26:51579] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aYXkqjSw3-HAlzpqSxzRFAAAAVM"]
[Fri Feb 06 20:55:06.982069 2026] [:error] [pid 3513:tid 3521] [client 68.221.137.26:51801] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aYXkqjSw3-HAlzpqSxzRFQAAAUY"]
[Fri Feb 06 20:55:08.445328 2026] [:error] [pid 3513:tid 3516] [client 68.221.137.26:51541] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "aYXkrDSw3-HAlzpqSxzRGAAAAUE"]
[Fri Feb 06 20:55:09.425295 2026] [:error] [pid 3382:tid 3446] [client 68.221.137.26:51249] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYXkrcIgU1HR0rhYrE9RHwAAAIY"]
[Fri Feb 06 20:55:10.735074 2026] [:error] [pid 37019:tid 37041] [client 68.221.137.26:51673] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYXkrgkAjqd3bcgYBrtkIwAAAhQ"]
[Fri Feb 06 20:55:11.340743 2026] [:error] [pid 3513:tid 3537] [client 68.221.137.26:51034] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYXkrzSw3-HAlzpqSxzRGgAAAVY"]
[Fri Feb 06 20:55:12.051809 2026] [:error] [pid 3513:tid 3522] [client 68.221.137.26:51465] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYXksDSw3-HAlzpqSxzRHAAAAUc"]
[Fri Feb 06 20:55:13.010737 2026] [:error] [pid 36857:tid 36859] [client 68.221.137.26:51861] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aYXksZVQwfj7Kp4Dd0Hv1wAAAYA"]
[Fri Feb 06 20:55:13.814724 2026] [:error] [pid 36857:tid 36881] [client 68.221.137.26:51440] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aYXksZVQwfj7Kp4Dd0Hv2AAAAZY"]
[Fri Feb 06 20:55:14.550065 2026] [:error] [pid 36857:tid 36868] [client 68.221.137.26:51236] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aYXkspVQwfj7Kp4Dd0Hv2QAAAYk"]
[Fri Feb 06 20:55:15.346849 2026] [:error] [pid 15821:tid 15829] [client 68.221.137.26:51220] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aYXks3ARQa67J4c772kK9gAAAQQ"]
[Fri Feb 06 20:55:15.906635 2026] [:error] [pid 3382:tid 3450] [client 68.221.137.26:51484] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aYXks8IgU1HR0rhYrE9RJQAAAIo"]
[Fri Feb 06 20:55:16.497996 2026] [:error] [pid 3380:tid 3385] [client 68.221.137.26:51429] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aYXktBFAlUvBGSBK2jdk9wAAAAE"]
[Fri Feb 06 20:55:17.064479 2026] [:error] [pid 3382:tid 3442] [client 68.221.137.26:51750] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aYXktcIgU1HR0rhYrE9RKAAAAII"]
[Fri Feb 06 20:55:17.581615 2026] [:error] [pid 3382:tid 3459] [client 68.221.137.26:51548] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file15.php"] [unique_id "aYXktcIgU1HR0rhYrE9RKQAAAJM"]
[Fri Feb 06 20:55:19.788408 2026] [:error] [pid 37019:tid 37038] [client 68.221.137.26:51214] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aYXktwkAjqd3bcgYBrtkJwAAAhE"]
[Fri Feb 06 20:55:22.221807 2026] [:error] [pid 3382:tid 3447] [client 68.221.137.26:51874] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aYXkusIgU1HR0rhYrE9RLwAAAIc"]
[Fri Feb 06 20:55:25.221753 2026] [:error] [pid 15821:tid 15836] [client 68.221.137.26:51822] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aYXkvXARQa67J4c772kK_AAAAQs"]
[Fri Feb 06 20:55:26.199215 2026] [:error] [pid 36857:tid 36876] [client 68.221.137.26:51265] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hk.php"] [unique_id "aYXkvpVQwfj7Kp4Dd0Hv4gAAAZE"]
[Fri Feb 06 20:55:27.422637 2026] [:error] [pid 36857:tid 36870] [client 68.221.137.26:51417] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aYXkv5VQwfj7Kp4Dd0Hv5AAAAYs"]
[Fri Feb 06 20:55:29.107696 2026] [:error] [pid 46432:tid 46439] [client 68.221.137.26:51832] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aYXkwQbwJwu_od0kZjMnXAAAAkU"]
[Fri Feb 06 20:55:30.590894 2026] [:error] [pid 37019:tid 37045] [client 68.221.137.26:51573] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aYXkwgkAjqd3bcgYBrtkLQAAAhg"]
[Fri Feb 06 20:55:31.271732 2026] [:error] [pid 46432:tid 46455] [client 68.221.137.26:51489] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpa.php"] [unique_id "aYXkwwbwJwu_od0kZjMnYAAAAlU"]
[Fri Feb 06 20:55:32.068308 2026] [:error] [pid 3381:tid 3421] [client 68.221.137.26:51406] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aYXkxC81zqRg96ZREghptgAAAEg"]
[Fri Feb 06 20:55:33.450846 2026] [:error] [pid 3513:tid 3539] [client 68.221.137.26:51329] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aYXkxTSw3-HAlzpqSxzRHwAAAVg"]
[Fri Feb 06 20:55:34.370465 2026] [:error] [pid 3382:tid 3463] [client 68.221.137.26:51845] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aYXkxsIgU1HR0rhYrE9RPQAAAJc"]
[Fri Feb 06 20:55:34.961134 2026] [:error] [pid 3381:tid 3415] [client 68.221.137.26:51908] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "aYXkxi81zqRg96ZREghpuwAAAEI"]
[Fri Feb 06 20:55:35.508563 2026] [:error] [pid 3382:tid 3459] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/ssss.php
[Fri Feb 06 20:55:35.761433 2026] [:error] [pid 3382:tid 3457] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/ut.php
[Fri Feb 06 20:55:36.005220 2026] [:error] [pid 3382:tid 3456] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/inde.php
[Fri Feb 06 20:55:36.292004 2026] [:error] [pid 3382:tid 3464] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Fri Feb 06 20:55:36.536214 2026] [:error] [pid 3382:tid 3458] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/030.php
[Fri Feb 06 20:55:36.780382 2026] [:error] [pid 3382:tid 3446] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/thh.php
[Fri Feb 06 20:55:37.083546 2026] [:error] [pid 3382:tid 3449] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/fffff.php
[Fri Feb 06 20:55:37.535976 2026] [:error] [pid 3382:tid 3455] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Fri Feb 06 20:55:37.777091 2026] [:error] [pid 3382:tid 3441] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/fileas.php
[Fri Feb 06 20:55:38.046524 2026] [:error] [pid 3382:tid 3443] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/yellow.php
[Fri Feb 06 20:55:38.355674 2026] [:error] [pid 3382:tid 3445] [client 68.221.137.26:51388] File does not exist: /usr/local/apache/htdocs/suspended-page/33.php
[Fri Feb 06 20:55:38.594731 2026] [:error] [pid 3382:tid 3450] [client 68.221.137.26:51388] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aYXkysIgU1HR0rhYrE9RUQAAAIo"]
[Fri Feb 06 20:55:39.211656 2026] [:error] [pid 3380:tid 3391] [client 68.221.137.26:51523] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aYXkyxFAlUvBGSBK2jdk_gAAAAc"]
[Fri Feb 06 20:55:40.140624 2026] [:error] [pid 46432:tid 46438] [client 68.221.137.26:51540] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aYXkzAbwJwu_od0kZjMnYwAAAkQ"]
[Fri Feb 06 20:55:40.867451 2026] [:error] [pid 3381:tid 3424] [client 68.221.137.26:51671] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aYXkzC81zqRg96ZREghpwQAAAEs"]
[Fri Feb 06 20:55:41.536214 2026] [:error] [pid 3382:tid 3460] [client 68.221.137.26:51865] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aYXkzcIgU1HR0rhYrE9RZAAAAJQ"]
[Fri Feb 06 20:55:42.837263 2026] [:error] [pid 3382:tid 3447] [client 68.221.137.26:51880] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aYXkzsIgU1HR0rhYrE9RcAAAAIc"]
[Fri Feb 06 20:55:43.696476 2026] [:error] [pid 3477:tid 3484] [client 68.221.137.26:51350] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aYXkz7L0Hdh40C7HYgVwKgAAAMU"]
[Fri Feb 06 20:55:45.188542 2026] [:error] [pid 46432:tid 46441] [client 68.221.137.26:51438] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aYXk0QbwJwu_od0kZjMnZAAAAkc"]
[Fri Feb 06 20:55:46.484287 2026] [:error] [pid 3382:tid 3458] [client 68.221.137.26:51506] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aYXk0sIgU1HR0rhYrE9RegAAAJI"]
[Fri Feb 06 20:55:47.886403 2026] [:error] [pid 3381:tid 3433] [client 68.221.137.26:51227] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aYXk0y81zqRg96ZREghpyAAAAFQ"]
[Fri Feb 06 20:55:49.039870 2026] [:error] [pid 3382:tid 3452] [client 68.221.137.26:51943] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aYXk1cIgU1HR0rhYrE9RhwAAAIw"]
[Fri Feb 06 20:55:49.733336 2026] [:error] [pid 3382:tid 3446] [client 68.221.137.26:52013] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thxt.php"] [unique_id "aYXk1cIgU1HR0rhYrE9RiwAAAIY"]
[Fri Feb 06 20:55:50.652500 2026] [:error] [pid 46432:tid 46454] [client 68.221.137.26:51441] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aYXk1gbwJwu_od0kZjMnaQAAAlQ"]
[Fri Feb 06 20:55:51.427904 2026] [:error] [pid 36857:tid 36868] [client 68.221.137.26:51338] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aYXk15VQwfj7Kp4Dd0Hv8AAAAYk"]
[Fri Feb 06 20:55:52.356135 2026] [:error] [pid 15821:tid 15833] [client 68.221.137.26:51837] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aYXk2HARQa67J4c772kLDgAAAQg"]
[Fri Feb 06 20:55:53.383842 2026] [:error] [pid 3380:tid 3396] [client 68.221.137.26:51611] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "aYXk2RFAlUvBGSBK2jdlAwAAAAw"]
[Fri Feb 06 20:55:54.157597 2026] [:error] [pid 3380:tid 3386] [client 68.221.137.26:51970] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aYXk2hFAlUvBGSBK2jdlBAAAAAI"]
[Fri Feb 06 20:55:54.895990 2026] [:error] [pid 46432:tid 46437] [client 68.221.137.26:51625] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aYXk2gbwJwu_od0kZjMncQAAAkM"]
[Fri Feb 06 20:55:55.531856 2026] [:error] [pid 36857:tid 36863] [client 68.221.137.26:51449] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aYXk25VQwfj7Kp4Dd0Hv8wAAAYQ"]
[Fri Feb 06 20:55:56.282784 2026] [:error] [pid 3380:tid 3404] [client 68.221.137.26:51653] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aYXk3BFAlUvBGSBK2jdlCAAAABQ"]
[Fri Feb 06 20:55:57.607195 2026] [:error] [pid 46432:tid 46450] [client 68.221.137.26:51748] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aYXk3QbwJwu_od0kZjMncwAAAlA"]
[Fri Feb 06 20:55:58.266687 2026] [:error] [pid 46432:tid 46451] [client 68.221.137.26:51364] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aYXk3gbwJwu_od0kZjMndQAAAlE"]
[Fri Feb 06 20:55:58.887743 2026] [:error] [pid 37019:tid 37036] [client 68.221.137.26:51554] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aYXk3gkAjqd3bcgYBrtkPQAAAg8"]
[Fri Feb 06 20:55:59.612825 2026] [:error] [pid 3380:tid 3402] [client 68.221.137.26:51879] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aYXk3xFAlUvBGSBK2jdlCwAAABI"]
[Fri Feb 06 20:56:00.399526 2026] [:error] [pid 3380:tid 3408] [client 68.221.137.26:51857] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYXk4BFAlUvBGSBK2jdlDAAAABg"]
[Fri Feb 06 20:56:01.236797 2026] [:error] [pid 36928:tid 36946] [client 68.221.137.26:52027] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYXk4Zs7fyU8D36r-OpvOwAAAc4"]
[Fri Feb 06 20:56:02.113244 2026] [:error] [pid 3382:tid 3440] [client 68.221.137.26:51862] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYXk4sIgU1HR0rhYrE9RlAAAAIA"]
[Fri Feb 06 20:56:03.002468 2026] [:error] [pid 36928:tid 36941] [client 68.221.137.26:51781] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYXk45s7fyU8D36r-OpvPQAAAck"]
[Fri Feb 06 20:56:03.742611 2026] [:error] [pid 36928:tid 36945] [client 68.221.137.26:52040] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aYXk45s7fyU8D36r-OpvPgAAAc0"]
[Fri Feb 06 20:56:04.550247 2026] [:error] [pid 3382:tid 3443] [client 68.221.137.26:51964] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aYXk5MIgU1HR0rhYrE9RlwAAAIM"]
[Fri Feb 06 20:56:05.299116 2026] [:error] [pid 36857:tid 36866] [client 68.221.137.26:51867] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aYXk5ZVQwfj7Kp4Dd0Hv9wAAAYc"]
[Fri Feb 06 20:56:05.804169 2026] [:error] [pid 3381:tid 3429] [client 68.221.137.26:51555] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/usep.php"] [unique_id "aYXk5S81zqRg96ZREghp0gAAAFA"]
[Fri Feb 06 20:56:06.363327 2026] [:error] [pid 3381:tid 3417] [client 68.221.137.26:52152] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aYXk5i81zqRg96ZREghp0wAAAEQ"]
[Fri Feb 06 20:56:07.152264 2026] [:error] [pid 36857:tid 36876] [client 68.221.137.26:51618] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aYXk55VQwfj7Kp4Dd0Hv-AAAAZE"]
[Fri Feb 06 20:56:10.360508 2026] [:error] [pid 3382:tid 3460] [client 68.221.137.26:51911] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aYXk6sIgU1HR0rhYrE9RnQAAAJQ"]
[Fri Feb 06 20:56:10.940085 2026] [:error] [pid 36857:tid 36862] [client 68.221.137.26:52091] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wa.php"] [unique_id "aYXk6pVQwfj7Kp4Dd0Hv-wAAAYM"]
[Fri Feb 06 20:56:11.576631 2026] [:error] [pid 3380:tid 3400] [client 68.221.137.26:51526] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aYXk6xFAlUvBGSBK2jdlEQAAABA"]
[Fri Feb 06 20:56:12.179167 2026] [:error] [pid 3382:tid 3448] [client 68.221.137.26:51757] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aYXk7MIgU1HR0rhYrE9RoAAAAIg"]
[Fri Feb 06 20:56:13.240406 2026] [:error] [pid 3382:tid 3453] [client 68.221.137.26:51858] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aYXk7cIgU1HR0rhYrE9RowAAAI0"]
[Fri Feb 06 20:56:14.203696 2026] [:error] [pid 3382:tid 3447] [client 68.221.137.26:51783] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wb.php"] [unique_id "aYXk7sIgU1HR0rhYrE9RqAAAAIc"]
[Fri Feb 06 20:56:14.902698 2026] [:error] [pid 3477:tid 3490] [client 68.221.137.26:52121] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aYXk7rL0Hdh40C7HYgVwPwAAAMs"]
[Fri Feb 06 20:56:16.906122 2026] [:error] [pid 3382:tid 3441] [client 68.221.137.26:51631] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aYXk8MIgU1HR0rhYrE9RqwAAAIE"]
[Fri Feb 06 20:56:17.801316 2026] [:error] [pid 15821:tid 15843] [client 68.221.137.26:52132] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aYXk8XARQa67J4c772kLEwAAARI"]
[Fri Feb 06 20:56:18.866380 2026] [:error] [pid 36857:tid 36878] [client 68.221.137.26:51942] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "aYXk8pVQwfj7Kp4Dd0Hv_QAAAZM"]
[Fri Feb 06 20:56:20.513666 2026] [:error] [pid 36857:tid 36868] [client 68.221.137.26:51504] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aYXk9JVQwfj7Kp4Dd0Hv_wAAAYk"]
[Fri Feb 06 20:56:21.278400 2026] [:error] [pid 3513:tid 3516] [client 68.221.137.26:52062] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aYXk9TSw3-HAlzpqSxzRMAAAAUE"]
[Fri Feb 06 20:56:22.072900 2026] [:error] [pid 46432:tid 46441] [client 68.221.137.26:52044] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aYXk9gbwJwu_od0kZjMnewAAAkc"]
[Fri Feb 06 20:56:23.812950 2026] [:error] [pid 3477:tid 3480] [client 68.221.137.26:51912] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "aYXk97L0Hdh40C7HYgVwSQAAAME"]
[Fri Feb 06 20:56:24.749406 2026] [:error] [pid 46432:tid 46447] [client 68.221.137.26:51854] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYXk-AbwJwu_od0kZjMnfwAAAk0"]
[Fri Feb 06 20:56:26.932079 2026] [:error] [pid 36857:tid 36871] [client 68.221.137.26:51921] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYXk-pVQwfj7Kp4Dd0HwBAAAAYw"]
[Fri Feb 06 20:56:28.965602 2026] [:error] [pid 37019:tid 37032] [client 68.221.137.26:51676] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYXk_AkAjqd3bcgYBrtkRwAAAgs"]
[Fri Feb 06 20:56:29.895722 2026] [:error] [pid 3381:tid 3432] [client 68.221.137.26:51946] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aYXk_S81zqRg96ZREghp4gAAAFM"]
[Fri Feb 06 20:56:30.583876 2026] [:error] [pid 15821:tid 15830] [client 68.221.137.26:51277] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aYXk_nARQa67J4c772kLHwAAAQU"]
[Fri Feb 06 20:56:31.749943 2026] [:error] [pid 36857:tid 36879] [client 68.221.137.26:51811] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aYXk_5VQwfj7Kp4Dd0HwCwAAAZQ"]
[Fri Feb 06 20:56:32.641188 2026] [:error] [pid 3381:tid 3426] [client 68.221.137.26:51681] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aYXlAC81zqRg96ZREghp5wAAAE0"]
[Fri Feb 06 20:56:33.666249 2026] [:error] [pid 3381:tid 3435] [client 68.221.137.26:51729] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aYXlAS81zqRg96ZREghp6AAAAFY"]
[Fri Feb 06 20:56:34.339347 2026] [:error] [pid 15821:tid 15838] [client 68.221.137.26:51999] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aYXlAnARQa67J4c772kLJAAAAQ0"]
[Fri Feb 06 20:56:35.176362 2026] [:error] [pid 3513:tid 3526] [client 68.221.137.26:51973] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aYXlAzSw3-HAlzpqSxzROwAAAUs"]
[Fri Feb 06 20:56:36.210269 2026] [:error] [pid 3380:tid 3400] [client 68.221.137.26:51564] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aYXlBBFAlUvBGSBK2jdlKQAAABA"]
[Fri Feb 06 20:56:37.130274 2026] [:error] [pid 36928:tid 36943] [client 68.221.137.26:34276] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aYXlBZs7fyU8D36r-OpvVAAAAcs"]
[Fri Feb 06 20:56:37.880289 2026] [:error] [pid 36857:tid 36871] [client 68.221.137.26:52137] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aYXlBZVQwfj7Kp4Dd0HwDgAAAYw"]
[Fri Feb 06 20:56:38.505810 2026] [:error] [pid 36928:tid 36949] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 06 20:56:38.751622 2026] [:error] [pid 36928:tid 36950] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Feb 06 20:56:39.183608 2026] [:error] [pid 36928:tid 36932] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Feb 06 20:56:39.475886 2026] [:error] [pid 36928:tid 36934] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 06 20:56:39.742705 2026] [:error] [pid 36928:tid 36956] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri Feb 06 20:56:39.984745 2026] [:error] [pid 36928:tid 36954] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Feb 06 20:56:40.227184 2026] [:error] [pid 36928:tid 36946] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 06 20:56:40.544935 2026] [:error] [pid 36928:tid 36952] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Fri Feb 06 20:56:40.945545 2026] [:error] [pid 36928:tid 36953] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Feb 06 20:56:41.304171 2026] [:error] [pid 36928:tid 36939] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 06 20:56:41.546535 2026] [:error] [pid 36928:tid 36949] [client 68.221.137.26:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Fri Feb 06 20:56:41.845589 2026] [:error] [pid 36928:tid 36938] [client 68.221.137.26:51842] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYXlCZs7fyU8D36r-OpvagAAAcY"]
[Fri Feb 06 20:56:42.790395 2026] [:error] [pid 3513:tid 3538] [client 68.221.137.26:51608] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYXlCjSw3-HAlzpqSxzRQwAAAVc"]
[Fri Feb 06 20:56:43.360159 2026] [:error] [pid 37019:tid 37021] [client 68.221.137.26:52097] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYXlCwkAjqd3bcgYBrtkVQAAAgA"]
[Fri Feb 06 20:56:43.867843 2026] [:error] [pid 36928:tid 36935] [client 68.221.137.26:34292] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aYXlC5s7fyU8D36r-OpvbAAAAcM"]
[Fri Feb 06 20:56:45.366380 2026] [:error] [pid 3477:tid 3496] [client 68.221.137.26:52119] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aYXlDbL0Hdh40C7HYgVwYAAAANE"]
[Fri Feb 06 20:56:45.871092 2026] [:error] [pid 46432:tid 46437] [client 68.221.137.26:51617] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aYXlDQbwJwu_od0kZjMniwAAAkM"]
[Fri Feb 06 20:56:46.509186 2026] [:error] [pid 3382:tid 3440] [client 68.221.137.26:52081] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aYXlDsIgU1HR0rhYrE9RuQAAAIA"]
[Fri Feb 06 20:56:47.043402 2026] [:error] [pid 3477:tid 3490] [client 68.221.137.26:51799] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/geck.php"] [unique_id "aYXlD7L0Hdh40C7HYgVwYgAAAMs"]
[Fri Feb 06 20:56:48.401434 2026] [:error] [pid 3380:tid 3399] [client 68.221.137.26:51290] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aYXlEBFAlUvBGSBK2jdlNgAAAA8"]
[Fri Feb 06 20:56:49.946726 2026] [:error] [pid 3381:tid 3413] [client 68.221.137.26:51827] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aYXlES81zqRg96ZREghp8QAAAEA"]
[Fri Feb 06 20:56:50.799946 2026] [:error] [pid 3477:tid 3498] [client 68.221.137.26:52145] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aYXlErL0Hdh40C7HYgVwagAAANM"]
[Fri Feb 06 20:56:52.295076 2026] [:error] [pid 3382:tid 3459] [client 68.221.137.26:51567] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "aYXlFMIgU1HR0rhYrE9R1wAAAJM"]
[Fri Feb 06 20:56:53.130423 2026] [:error] [pid 36857:tid 36877] [client 68.221.137.26:51606] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aYXlFZVQwfj7Kp4Dd0HwFwAAAZI"]
[Fri Feb 06 20:56:53.949641 2026] [:error] [pid 3477:tid 3493] [client 68.221.137.26:51532] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aYXlFbL0Hdh40C7HYgVwbwAAAM4"]
[Fri Feb 06 20:56:54.819737 2026] [:error] [pid 36928:tid 36936] [client 68.221.137.26:51784] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aYXlFps7fyU8D36r-OpvdQAAAcQ"]
[Fri Feb 06 20:56:55.789482 2026] [:error] [pid 3477:tid 3492] [client 68.221.137.26:51847] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aYXlF7L0Hdh40C7HYgVwcgAAAM0"]
[Fri Feb 06 20:56:56.521465 2026] [:error] [pid 3382:tid 3461] [client 68.221.137.26:52105] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aYXlGMIgU1HR0rhYrE9R7QAAAJU"]
[Fri Feb 06 20:56:58.243906 2026] [:error] [pid 3477:tid 3482] [client 68.221.137.26:34256] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aYXlGrL0Hdh40C7HYgVweAAAAMM"]
[Fri Feb 06 20:56:59.325860 2026] [:error] [pid 3382:tid 3444] [client 68.221.137.26:52099] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aYXlG8IgU1HR0rhYrE9R9gAAAIQ"]
[Fri Feb 06 20:57:03.666099 2026] [:error] [pid 37019:tid 37041] [client 68.221.137.26:51570] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cccc.php"] [unique_id "aYXlHwkAjqd3bcgYBrtkWwAAAhQ"]
[Fri Feb 06 20:57:07.977354 2026] [:error] [pid 36857:tid 36861] [client 68.221.137.26:51651] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aYXlI5VQwfj7Kp4Dd0HwGgAAAYI"]
[Fri Feb 06 20:57:09.819873 2026] [:error] [pid 3477:tid 3499] [client 68.221.137.26:52147] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aYXlJbL0Hdh40C7HYgVwqAAAANQ"]
[Fri Feb 06 20:57:11.994842 2026] [:error] [pid 3382:tid 3451] [client 68.221.137.26:52208] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aYXlJ8IgU1HR0rhYrE9SBQAAAIs"]
[Fri Feb 06 20:57:12.871624 2026] [:error] [pid 3513:tid 3520] [client 68.221.137.26:34257] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file4.php"] [unique_id "aYXlKDSw3-HAlzpqSxzRTgAAAUU"]
[Fri Feb 06 20:57:14.162657 2026] [:error] [pid 3380:tid 3403] [client 68.221.137.26:51828] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aYXlKhFAlUvBGSBK2jdlOgAAABM"]
[Fri Feb 06 20:57:15.508594 2026] [:error] [pid 36857:tid 36862] [client 68.221.137.26:51778] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aYXlK5VQwfj7Kp4Dd0HwHQAAAYM"]
[Fri Feb 06 20:57:16.518410 2026] [:error] [pid 36928:tid 36954] [client 68.221.137.26:52003] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aYXlLJs7fyU8D36r-OpvhwAAAdY"]
[Fri Feb 06 20:57:17.494520 2026] [:error] [pid 36857:tid 36868] [client 68.221.137.26:51965] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aYXlLZVQwfj7Kp4Dd0HwIAAAAYk"]
[Fri Feb 06 20:57:18.856183 2026] [:error] [pid 46432:tid 46442] [client 68.221.137.26:34294] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aYXlLgbwJwu_od0kZjMnpQAAAkg"]
[Fri Feb 06 20:57:20.027396 2026] [:error] [pid 3382:tid 3441] [client 68.221.137.26:52185] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aYXlMMIgU1HR0rhYrE9SCAAAAIE"]
[Fri Feb 06 20:57:20.996385 2026] [:error] [pid 36928:tid 36945] [client 68.221.137.26:52036] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aYXlMJs7fyU8D36r-OpvjAAAAc0"]
[Fri Feb 06 20:57:22.024277 2026] [:error] [pid 3477:tid 3492] [client 68.221.137.26:52024] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CLA.php"] [unique_id "aYXlMrL0Hdh40C7HYgVwtAAAAM0"]
[Fri Feb 06 20:57:23.331728 2026] [:error] [pid 3380:tid 3407] [client 68.221.137.26:52300] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aYXlMxFAlUvBGSBK2jdlQAAAABc"]
[Fri Feb 06 20:57:24.341098 2026] [:error] [pid 46432:tid 46450] [client 68.221.137.26:34288] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aYXlNAbwJwu_od0kZjMnqQAAAlA"]
[Fri Feb 06 20:57:25.532232 2026] [:error] [pid 3513:tid 3520] [client 68.221.137.26:51751] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aYXlNTSw3-HAlzpqSxzRXAAAAUU"]
[Fri Feb 06 20:57:26.834040 2026] [:error] [pid 3381:tid 3423] [client 68.221.137.26:52299] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "aYXlNi81zqRg96ZREghqCwAAAEo"]
[Fri Feb 06 20:57:28.358565 2026] [:error] [pid 3382:tid 3453] [client 68.221.137.26:52285] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aYXlOMIgU1HR0rhYrE9SDQAAAI0"]
[Fri Feb 06 20:57:29.591296 2026] [:error] [pid 46432:tid 46434] [client 68.221.137.26:52048] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aYXlOQbwJwu_od0kZjMnrQAAAkA"]
[Fri Feb 06 20:57:31.678559 2026] [:error] [pid 3380:tid 3388] [client 68.221.137.26:52180] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aYXlOxFAlUvBGSBK2jdlRgAAAAQ"]
[Fri Feb 06 20:57:32.452293 2026] [:error] [pid 3513:tid 3517] [client 68.221.137.26:52412] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "aYXlPDSw3-HAlzpqSxzRZQAAAUI"]
[Fri Feb 06 20:57:33.269000 2026] [:error] [pid 3381:tid 3432] [client 68.221.137.26:52111] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYXlPS81zqRg96ZREghqEwAAAFM"]
[Fri Feb 06 20:57:34.117439 2026] [:error] [pid 46432:tid 46456] [client 68.221.137.26:34263] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYXlPgbwJwu_od0kZjMnsgAAAlY"]
[Fri Feb 06 20:57:35.136759 2026] [:error] [pid 3477:tid 3484] [client 68.221.137.26:52441] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYXlP7L0Hdh40C7HYgVwxgAAAMU"]
[Fri Feb 06 20:57:36.129323 2026] [:error] [pid 36857:tid 36869] [client 68.221.137.26:52163] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYXlQJVQwfj7Kp4Dd0HwKQAAAYo"]
[Fri Feb 06 20:57:37.545621 2026] [:error] [pid 36857:tid 36868] [client 68.221.137.26:52194] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYXlQZVQwfj7Kp4Dd0HwKwAAAYk"]
[Fri Feb 06 20:57:39.059694 2026] [:error] [pid 46432:tid 46454] [client 68.221.137.26:52294] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYXlQwbwJwu_od0kZjMntgAAAlQ"]
[Fri Feb 06 20:57:40.807380 2026] [:error] [pid 3380:tid 3388] [client 68.221.137.26:52384] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYXlRBFAlUvBGSBK2jdlTgAAAAQ"]
[Fri Feb 06 20:57:41.619325 2026] [:error] [pid 36928:tid 36946] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 06 20:57:41.862001 2026] [:error] [pid 36928:tid 36952] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Fri Feb 06 20:57:42.143546 2026] [:error] [pid 36928:tid 36955] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Fri Feb 06 20:57:42.569450 2026] [:error] [pid 36928:tid 36942] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex3.php
[Fri Feb 06 20:57:42.810075 2026] [:error] [pid 36928:tid 36953] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/des.php
[Fri Feb 06 20:57:43.053052 2026] [:error] [pid 36928:tid 36944] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Fri Feb 06 20:57:43.295670 2026] [:error] [pid 36928:tid 36940] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Feb 06 20:57:43.551744 2026] [:error] [pid 36928:tid 36937] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Fri Feb 06 20:57:43.803213 2026] [:error] [pid 36928:tid 36939] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/efile.php
[Fri Feb 06 20:57:44.398807 2026] [:error] [pid 36928:tid 36933] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/afile.php
[Fri Feb 06 20:57:44.640538 2026] [:error] [pid 36928:tid 36932] [client 68.221.137.26:52162] File does not exist: /usr/local/apache/htdocs/suspended-page/errorfile.php
[Fri Feb 06 20:57:44.881265 2026] [:error] [pid 36928:tid 36936] [client 68.221.137.26:52162] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aYXlSJs7fyU8D36r-OpvpQAAAcQ"]
[Fri Feb 06 20:57:46.066558 2026] [:error] [pid 3477:tid 3493] [client 68.221.137.26:52275] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aYXlSrL0Hdh40C7HYgVw2wAAAM4"]
[Fri Feb 06 20:57:47.687357 2026] [:error] [pid 3382:tid 3462] [client 68.221.137.26:34269] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aYXlS8IgU1HR0rhYrE9SHQAAAJY"]
[Fri Feb 06 20:57:48.998597 2026] [:error] [pid 3513:tid 3533] [client 68.221.137.26:52387] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aYXlTDSw3-HAlzpqSxzRbwAAAVI"]
[Fri Feb 06 20:57:50.214897 2026] [:error] [pid 3477:tid 3491] [client 68.221.137.26:52407] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aYXlTrL0Hdh40C7HYgVw8gAAAMw"]
[Fri Feb 06 20:57:50.957085 2026] [:error] [pid 3381:tid 3422] [client 68.221.137.26:52209] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aYXlTi81zqRg96ZREghqJgAAAEk"]
[Fri Feb 06 20:57:51.587679 2026] [:error] [pid 3381:tid 3428] [client 68.221.137.26:51694] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aYXlTy81zqRg96ZREghqJwAAAE8"]
[Fri Feb 06 20:57:52.717874 2026] [:error] [pid 3381:tid 3430] [client 68.221.137.26:52054] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aYXlUC81zqRg96ZREghqKgAAAFE"]
[Fri Feb 06 20:57:53.355300 2026] [:error] [pid 46432:tid 46456] [client 68.221.137.26:52262] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haikh.php"] [unique_id "aYXlUQbwJwu_od0kZjMnwwAAAlY"]
[Fri Feb 06 20:57:54.067594 2026] [:error] [pid 15821:tid 15825] [client 68.221.137.26:52265] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haikh.php"] [unique_id "aYXlUnARQa67J4c772kLUAAAAQA"]
[Fri Feb 06 20:57:55.085364 2026] [:error] [pid 3380:tid 3386] [client 68.221.137.26:51876] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haikh.php"] [unique_id "aYXlUxFAlUvBGSBK2jdlVQAAAAI"]
[Fri Feb 06 20:57:56.090614 2026] [:error] [pid 3513:tid 3517] [client 68.221.137.26:51235] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haikh.php"] [unique_id "aYXlVDSw3-HAlzpqSxzRdQAAAUI"]
[Fri Feb 06 20:57:56.979804 2026] [:error] [pid 36928:tid 36954] [client 68.221.137.26:52272] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/135.php"] [unique_id "aYXlVJs7fyU8D36r-OpvqQAAAdY"]
[Fri Feb 06 20:57:58.745356 2026] [:error] [pid 3477:tid 3496] [client 68.221.137.26:51105] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/135.php"] [unique_id "aYXlVrL0Hdh40C7HYgVxBQAAANE"]
[Fri Feb 06 20:58:00.345103 2026] [:error] [pid 15821:tid 15847] [client 68.221.137.26:52304] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/135.php"] [unique_id "aYXlWHARQa67J4c772kLYQAAARY"]
[Fri Feb 06 20:58:02.548636 2026] [:error] [pid 3382:tid 3446] [client 68.221.137.26:51377] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/135.php"] [unique_id "aYXlWsIgU1HR0rhYrE9SNgAAAIY"]
[Fri Feb 06 20:58:04.072413 2026] [:error] [pid 36928:tid 36953] [client 68.221.137.26:52362] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aYXlXJs7fyU8D36r-OpvrAAAAdU"]
[Fri Feb 06 20:58:05.499658 2026] [:error] [pid 3513:tid 3533] [client 68.221.137.26:52302] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aYXlXTSw3-HAlzpqSxzRegAAAVI"]
[Fri Feb 06 20:58:07.344613 2026] [:error] [pid 3380:tid 3408] [client 68.221.137.26:52266] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aYXlXxFAlUvBGSBK2jdlWgAAABg"]
[Fri Feb 06 20:58:08.665255 2026] [:error] [pid 36857:tid 36862] [client 68.221.137.26:52023] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "aYXlYJVQwfj7Kp4Dd0HwRAAAAYM"]
[Fri Feb 06 20:58:09.872025 2026] [:error] [pid 3382:tid 3456] [client 68.221.137.26:34295] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYXlYcIgU1HR0rhYrE9SOQAAAJA"]
[Fri Feb 06 20:58:13.015244 2026] [:error] [pid 3477:tid 3500] [client 68.221.137.26:52599] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYXlZbL0Hdh40C7HYgVxDQAAANU"]
[Fri Feb 06 20:58:13.840933 2026] [:error] [pid 36928:tid 36945] [client 68.221.137.26:52564] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYXlZZs7fyU8D36r-OpvrgAAAc0"]
[Fri Feb 06 20:58:16.719781 2026] [:error] [pid 3380:tid 3408] [client 68.221.137.26:52175] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aYXlaBFAlUvBGSBK2jdlZwAAABg"]
[Fri Feb 06 20:58:18.159398 2026] [:error] [pid 3381:tid 3416] [client 68.221.137.26:52381] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYXlai81zqRg96ZREghqNgAAAEM"]
[Fri Feb 06 20:58:19.690491 2026] [:error] [pid 3477:tid 3484] [client 68.221.137.26:34302] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYXla7L0Hdh40C7HYgVxFgAAAMU"]
[Fri Feb 06 20:58:21.588378 2026] [:error] [pid 3380:tid 3401] [client 68.221.137.26:52227] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYXlbRFAlUvBGSBK2jdlbQAAABE"]
[Fri Feb 06 20:58:22.595456 2026] [:error] [pid 3382:tid 3448] [client 68.221.137.26:52532] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYXlbsIgU1HR0rhYrE9SQwAAAIg"]
[Fri Feb 06 20:58:23.441425 2026] [:error] [pid 3381:tid 3423] [client 68.221.137.26:52510] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYXlby81zqRg96ZREghqOgAAAEo"]
[Fri Feb 06 20:58:24.392307 2026] [:error] [pid 3513:tid 3517] [client 68.221.137.26:51993] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYXlcDSw3-HAlzpqSxzRhwAAAUI"]
[Fri Feb 06 20:58:26.014921 2026] [:error] [pid 3381:tid 3425] [client 68.221.137.26:52322] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYXlci81zqRg96ZREghqPQAAAEw"]
[Fri Feb 06 20:58:26.921095 2026] [:error] [pid 36928:tid 36946] [client 68.221.137.26:52571] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYXlcps7fyU8D36r-OpvuAAAAc4"]
[Fri Feb 06 20:58:28.641276 2026] [:error] [pid 3477:tid 3490] [client 68.221.137.26:52463] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYXldLL0Hdh40C7HYgVxJwAAAMs"]
[Fri Feb 06 20:58:31.550124 2026] [:error] [pid 36928:tid 36932] [client 68.221.137.26:51981] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYXld5s7fyU8D36r-OpvuwAAAcA"]
[Fri Feb 06 20:58:33.089876 2026] [:error] [pid 36928:tid 36948] [client 68.221.137.26:34300] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYXleZs7fyU8D36r-OpvvAAAAdA"]
[Fri Feb 06 20:58:34.155744 2026] [:error] [pid 3477:tid 3482] [client 68.221.137.26:52251] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "aYXlerL0Hdh40C7HYgVxLQAAAMM"]
[Fri Feb 06 20:58:35.054078 2026] [:error] [pid 3513:tid 3519] [client 68.221.137.26:52461] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYXlezSw3-HAlzpqSxzRlAAAAUQ"]
[Fri Feb 06 20:58:36.020301 2026] [:error] [pid 3477:tid 3501] [client 68.221.137.26:52350] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYXlfLL0Hdh40C7HYgVxMwAAANY"]
[Fri Feb 06 20:58:37.889124 2026] [:error] [pid 46432:tid 46458] [client 68.221.137.26:52645] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYXlfQbwJwu_od0kZjMn5wAAAlg"]
[Fri Feb 06 20:58:38.818185 2026] [:error] [pid 3381:tid 3420] [client 68.221.137.26:52414] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYXlfi81zqRg96ZREghqSQAAAEc"]
[Fri Feb 06 20:58:39.866989 2026] [:error] [pid 46432:tid 46447] [client 68.221.137.26:52344] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aYXlfwbwJwu_od0kZjMn6QAAAk0"]
[Fri Feb 06 20:58:41.248890 2026] [:error] [pid 15821:tid 15826] [client 68.221.137.26:52124] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aYXlgXARQa67J4c772kLcgAAAQE"]
[Fri Feb 06 20:58:43.133008 2026] [:error] [pid 15821:tid 15848] [client 68.221.137.26:52396] [client 68.221.137.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aYXlg3ARQa67J4c772kLdwAAARc"]
[Fri Feb 06 20:58:44.420785 2026] [:error] [pid 3382:tid 3453] [client 68.221.137.26:52101] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Fri Feb 06 20:58:44.672953 2026] [:error] [pid 3382:tid 3444] [client 68.221.137.26:52101] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Fri Feb 06 20:58:44.914785 2026] [:error] [pid 3382:tid 3460] [client 68.221.137.26:52101] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Fri Feb 06 20:58:45.171953 2026] [:error] [pid 3382:tid 3449] [client 68.221.137.26:52101] File does not exist: /usr/local/apache/htdocs/suspended-page/size.php
[Fri Feb 06 20:58:45.739183 2026] [:error] [pid 3382:tid 3442] [client 68.221.137.26:52101] File does not exist: /usr/local/apache/htdocs/suspended-page/mpxct.php
[Fri Feb 06 21:07:59.306191 2026] [:error] [pid 3477:tid 3490] [client 94.247.172.129:55853] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.aoswa.com.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "aYXnr7L0Hdh40C7HYgVzaAAAAMs"]
[Fri Feb 06 21:54:41.216330 2026] [:error] [pid 36857:tid 36881] [client 146.70.250.132:57250] [client 146.70.250.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYXyoZVQwfj7Kp4Dd0H4bAAAAZY"]
[Sat Feb 07 05:16:23.982402 2026] [:error] [pid 50673:tid 50755] [client 87.106.209.183:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Sat Feb 07 05:16:27.857000 2026] [:error] [pid 50780:tid 50801] [client 87.106.209.183:55270] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Sat Feb 07 05:17:13.040889 2026] [:error] [pid 55157:tid 55180] [client 87.106.209.183:55439] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Sat Feb 07 05:17:25.833696 2026] [:error] [pid 50672:tid 50728] [client 87.106.209.183:60992] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Sat Feb 07 11:57:41.604502 2026] [:error] [pid 50780:tid 50790] [client 138.197.191.146:52167] [client 138.197.191.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.191.146, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aYa4NetUmIu2JHM2CrsNWQAAAMg"]
[Sat Feb 07 11:57:41.608195 2026] [:error] [pid 50780:tid 50790] [client 138.197.191.146:52167] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 07 13:07:01.388991 2026] [:error] [pid 55157:tid 55178] [client 3.81.233.23:55178] [client 3.81.233.23] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aYbIdX36JdtTn2bTEoxi6gAAARA"]
[Sat Feb 07 14:45:17.079249 2026] [:error] [pid 55157:tid 55174] [client 3.81.233.23:46914] [client 3.81.233.23] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYbffX36JdtTn2bTEox5-wAAAQw"]
[Sat Feb 07 22:08:08.626496 2026] [:error] [pid 55157:tid 55174] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Feb 07 22:08:09.116276 2026] [:error] [pid 55157:tid 55162] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 07 22:08:09.596033 2026] [:error] [pid 55157:tid 55168] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Feb 07 22:08:10.079806 2026] [:error] [pid 55157:tid 55170] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Feb 07 22:08:10.555359 2026] [:error] [pid 55157:tid 55171] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 07 22:08:11.027967 2026] [:error] [pid 55157:tid 55181] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Feb 07 22:08:11.511751 2026] [:error] [pid 55157:tid 55178] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 07 22:08:12.005686 2026] [:error] [pid 55157:tid 55176] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 07 22:08:12.972841 2026] [:error] [pid 55157:tid 55170] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Feb 07 22:08:13.932958 2026] [:error] [pid 55157:tid 55174] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Feb 07 22:08:14.416761 2026] [:error] [pid 55157:tid 55162] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Feb 07 22:08:14.903096 2026] [:error] [pid 55157:tid 55184] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 07 22:08:15.376604 2026] [:error] [pid 55157:tid 55168] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Feb 07 22:08:15.852022 2026] [:error] [pid 55157:tid 55175] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Feb 07 22:08:16.332517 2026] [:error] [pid 55157:tid 55172] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Feb 07 22:08:16.832688 2026] [:error] [pid 55157:tid 55185] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Feb 07 22:08:17.302976 2026] [:error] [pid 55157:tid 55178] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Feb 07 22:08:17.779368 2026] [:error] [pid 55157:tid 55166] [client 31.171.130.163:34841] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 07 22:08:21.594654 2026] [:error] [pid 55157:tid 55165] [client 31.171.130.163:34841] [client 31.171.130.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/upload.php"] [unique_id "aYdHVX36JdtTn2bTEozjywAAAQM"]
[Sat Feb 07 22:08:25.409879 2026] [:error] [pid 55157:tid 55168] [client 31.171.130.108:32747] [client 31.171.130.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aYdHWX36JdtTn2bTEozj6AAAAQY"]
[Sat Feb 07 22:08:27.850333 2026] [:error] [pid 50673:tid 50749] [client 31.171.130.109:20569] [client 31.171.130.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aYdHW2VwLsaZ7aKO2ckq0wAAAI4"]
[Sat Feb 07 22:08:30.261439 2026] [:error] [pid 50780:tid 50801] [client 31.171.130.121:31639] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Feb 07 22:08:31.686184 2026] [:error] [pid 50780:tid 50796] [client 31.171.130.121:31639] [client 31.171.130.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aYdHX-tUmIu2JHM2CrvZxgAAAM4"]
[Sat Feb 07 22:08:33.622879 2026] [:error] [pid 30684:tid 30710] [client 31.171.130.113:35615] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 07 22:08:34.095975 2026] [:error] [pid 30684:tid 30696] [client 31.171.130.113:35615] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aYdHYrqwdxwowLt-_LwqSAAAAck"]
[Sat Feb 07 22:08:35.513068 2026] [:error] [pid 50671:tid 50695] [client 31.171.130.107:30955] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Feb 07 22:08:37.973331 2026] [:error] [pid 50671:tid 50689] [client 31.171.130.107:30955] [client 31.171.130.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aYdHZbvqLohWBI_mqBO-VgAAAAk"]
[Sat Feb 07 22:08:39.420227 2026] [:error] [pid 58058:tid 58061] [client 31.171.130.119:22397] [client 31.171.130.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aYdHZ7z-Qlvs65S4DP8-XQAAAYA"]
[Sat Feb 07 22:08:40.380036 2026] [:error] [pid 50671:tid 50695] [client 31.171.130.164:58399] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aYdHaLvqLohWBI_mqBO-ZgAAAA8"]
[Sat Feb 07 22:08:41.352581 2026] [:error] [pid 50673:tid 50737] [client 31.171.130.134:58753] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aYdHaWVwLsaZ7aKO2ckrRQAAAII"]
[Sat Feb 07 22:08:42.298483 2026] [:error] [pid 30684:tid 30700] [client 31.171.130.136:45601] [client 31.171.130.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aYdHarqwdxwowLt-_LwqgwAAAc0"]
[Sat Feb 07 22:08:43.249467 2026] [:error] [pid 30684:tid 30694] [client 31.171.130.161:25863] [client 31.171.130.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aYdHa7qwdxwowLt-_LwqigAAAcc"]
[Sat Feb 07 22:08:44.697407 2026] [:error] [pid 50780:tid 50804] [client 31.171.130.147:39321] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aYdHbOtUmIu2JHM2CrvaQQAAANY"]
[Sat Feb 07 22:08:45.678789 2026] [:error] [pid 30684:tid 30704] [client 31.171.130.136:58723] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Feb 07 22:08:46.692430 2026] [:error] [pid 30684:tid 30688] [client 31.171.130.136:58723] [client 31.171.130.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aYdHbrqwdxwowLt-_LwqpwAAAcE"]
[Sat Feb 07 22:08:48.581870 2026] [:error] [pid 50780:tid 50804] [client 31.171.130.160:40679] [client 31.171.130.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aYdHcOtUmIu2JHM2CrvaaAAAANY"]
[Sat Feb 07 22:08:50.004820 2026] [:error] [pid 50780:tid 50786] [client 31.171.130.152:42217] [client 31.171.130.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aYdHcutUmIu2JHM2CrvaeAAAAMQ"]
[Sat Feb 07 22:08:50.952976 2026] [:error] [pid 58058:tid 58070] [client 31.171.130.162:33763] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Feb 07 22:08:51.425401 2026] [:error] [pid 58058:tid 58063] [client 31.171.130.162:33763] [client 31.171.130.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aYdHc7z-Qlvs65S4DP8-twAAAYI"]
[Sat Feb 07 22:08:52.395745 2026] [:error] [pid 50673:tid 50738] [client 31.171.130.113:29887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Feb 07 22:08:53.818050 2026] [:error] [pid 50673:tid 50748] [client 31.171.130.113:29887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Feb 07 22:08:55.256261 2026] [:error] [pid 50673:tid 50749] [client 31.171.130.113:29887] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aYdHd2VwLsaZ7aKO2ckr9AAAAI4"]
[Sat Feb 07 22:08:56.200087 2026] [:error] [pid 50672:tid 50729] [client 31.171.130.132:25521] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sat Feb 07 22:08:56.684239 2026] [:error] [pid 50672:tid 50732] [client 31.171.130.132:25521] [client 31.171.130.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aYdHeA9o0jq1XS8Nv7NgogAAAFg"]
[Sat Feb 07 22:08:57.635610 2026] [:error] [pid 50673:tid 50756] [client 31.171.130.161:20039] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Feb 07 22:08:58.591289 2026] [:error] [pid 50673:tid 50740] [client 31.171.130.161:20039] [client 31.171.130.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aYdHemVwLsaZ7aKO2cksJgAAAIU"]
[Sat Feb 07 22:09:00.015274 2026] [:error] [pid 30684:tid 30707] [client 31.171.130.137:26027] [client 31.171.130.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aYdHfLqwdxwowLt-_LwrEAAAAdQ"]
[Sat Feb 07 22:09:01.512584 2026] [:error] [pid 58058:tid 58084] [client 31.171.130.162:65403] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sat Feb 07 22:09:01.993783 2026] [:error] [pid 58058:tid 58074] [client 31.171.130.162:65403] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Feb 07 22:09:02.934290 2026] [:error] [pid 58058:tid 58076] [client 31.171.130.162:65403] [client 31.171.130.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aYdHfrz-Qlvs65S4DP8_GAAAAY8"]
[Sat Feb 07 22:09:04.363304 2026] [:error] [pid 50780:tid 50793] [client 31.171.130.109:40379] [client 31.171.130.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aYdHgOtUmIu2JHM2CrvbDAAAAMs"]
[Sat Feb 07 22:09:05.788296 2026] [:error] [pid 58058:tid 58081] [client 31.171.130.135:27127] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aYdHgbz-Qlvs65S4DP8_KAAAAZQ"]
[Sat Feb 07 22:09:06.723260 2026] [:error] [pid 50673:tid 50756] [client 31.171.130.136:59403] [client 31.171.130.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aYdHgmVwLsaZ7aKO2cksagAAAJU"]
[Sat Feb 07 22:09:07.660910 2026] [:error] [pid 55157:tid 55181] [client 31.171.130.137:31119] [client 31.171.130.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYdHg336JdtTn2bTEozkzQAAARM"]
[Sat Feb 07 22:09:09.812727 2026] [:error] [pid 50780:tid 50799] [client 31.171.130.110:65215] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sat Feb 07 22:09:10.283116 2026] [:error] [pid 50780:tid 50806] [client 31.171.130.110:65215] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aYdHhutUmIu2JHM2CrvbOAAAANg"]
[Sat Feb 07 22:09:11.246101 2026] [:error] [pid 30684:tid 30708] [client 31.171.130.154:63387] [client 31.171.130.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aYdHh7qwdxwowLt-_LwrbQAAAdU"]
[Sun Feb 08 00:12:26.399241 2026] [:error] [pid 50673:tid 50749] [client 103.77.107.178:64605] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aYdkamVwLsaZ7aKO2clVsQAAAI4"]
[Sun Feb 08 00:39:34.132042 2026] [:error] [pid 16829:tid 16854] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Feb 08 00:39:34.652753 2026] [:error] [pid 16829:tid 16851] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sun Feb 08 00:39:34.922945 2026] [:error] [pid 16829:tid 16859] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Feb 08 00:39:35.183614 2026] [:error] [pid 16829:tid 16843] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Feb 08 00:39:35.435896 2026] [:error] [pid 16829:tid 16844] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sun Feb 08 00:39:35.691122 2026] [:error] [pid 16829:tid 16862] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sun Feb 08 00:39:35.972234 2026] [:error] [pid 16829:tid 16846] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Feb 08 00:39:36.515306 2026] [:error] [pid 16829:tid 16849] [client 20.123.25.77:58544] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Feb 08 00:39:36.951320 2026] [:error] [pid 16829:tid 16849] [client 20.123.25.77:58544] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aYdqyAQFls00VxRngXualQAAAUg"]
[Sun Feb 08 00:39:37.693761 2026] [:error] [pid 16829:tid 16845] [client 20.123.25.77:58099] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aYdqyQQFls00VxRngXualwAAAUQ"]
[Sun Feb 08 00:39:38.370101 2026] [:error] [pid 62641:tid 62652] [client 20.123.25.77:58512] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aYdqyi_seVuUK_C4AppacgAAAMk"]
[Sun Feb 08 00:39:39.653402 2026] [:error] [pid 46302:tid 46363] [client 20.123.25.77:57164] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aYdqy-Lz0c8aDYK5YhbCrwAAAQw"]
[Sun Feb 08 00:39:40.663803 2026] [:error] [pid 62641:tid 62648] [client 20.123.25.77:58040] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aYdqzC_seVuUK_C4AppadgAAAMU"]
[Sun Feb 08 00:39:41.218503 2026] [:error] [pid 17001:tid 17027] [client 20.123.25.77:58562] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aYdqzd0X31QDRSlPKmRcggAAAYs"]
[Sun Feb 08 00:39:41.772946 2026] [:error] [pid 46302:tid 46355] [client 20.123.25.77:58070] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aYdqzeLz0c8aDYK5YhbCtAAAAQU"]
[Sun Feb 08 00:39:42.397065 2026] [:error] [pid 62641:tid 62651] [client 20.123.25.77:58504] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aYdqzi_seVuUK_C4AppaewAAAMg"]
[Sun Feb 08 00:39:42.917218 2026] [:error] [pid 62340:tid 62377] [client 20.123.25.77:58583] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aYdqzgp6H49g9bqshit8lwAAAAI"]
[Sun Feb 08 00:39:43.454975 2026] [:error] [pid 17001:tid 17016] [client 20.123.25.77:57487] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aYdqz90X31QDRSlPKmRchgAAAYA"]
[Sun Feb 08 00:39:44.045337 2026] [:error] [pid 62340:tid 62379] [client 20.123.25.77:57189] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aYdq0Ap6H49g9bqshit8nAAAAAQ"]
[Sun Feb 08 00:39:44.569323 2026] [:error] [pid 46302:tid 46369] [client 20.123.25.77:58524] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aYdq0OLz0c8aDYK5YhbCuwAAARI"]
[Sun Feb 08 00:39:45.130733 2026] [:error] [pid 46302:tid 46361] [client 20.123.25.77:57534] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aYdq0eLz0c8aDYK5YhbCvQAAAQo"]
[Sun Feb 08 00:39:45.720748 2026] [:error] [pid 46302:tid 46372] [client 20.123.25.77:57161] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aYdq0eLz0c8aDYK5YhbCwQAAARU"]
[Sun Feb 08 00:39:46.296467 2026] [:error] [pid 62340:tid 62389] [client 20.123.25.77:58004] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aYdq0gp6H49g9bqshit8nQAAAA4"]
[Sun Feb 08 00:39:46.927004 2026] [:error] [pid 17001:tid 17020] [client 20.123.25.77:57110] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aYdq0t0X31QDRSlPKmRcjwAAAYQ"]
[Sun Feb 08 00:39:47.438687 2026] [:error] [pid 62641:tid 62645] [client 20.123.25.77:58101] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aYdq0y_seVuUK_C4AppagQAAAMI"]
[Sun Feb 08 00:39:47.960335 2026] [:error] [pid 16829:tid 16852] [client 20.123.25.77:58069] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aYdq0wQFls00VxRngXuaqAAAAUs"]
[Sun Feb 08 00:39:48.580676 2026] [:error] [pid 17001:tid 17017] [client 20.123.25.77:58019] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aYdq1N0X31QDRSlPKmRclAAAAYE"]
[Sun Feb 08 00:39:49.328860 2026] [:error] [pid 62342:tid 62439] [client 20.123.25.77:57554] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aYdq1ewzANoqjscwU_64KwAAAIo"]
[Sun Feb 08 00:39:50.205246 2026] [:error] [pid 62341:tid 62410] [client 20.123.25.77:58557] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aYdq1p-t2yekx5OosV4ZaAAAAEg"]
[Sun Feb 08 00:39:50.951932 2026] [:error] [pid 62341:tid 62413] [client 20.123.25.77:57529] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aYdq1p-t2yekx5OosV4ZbAAAAEs"]
[Sun Feb 08 00:39:51.711336 2026] [:error] [pid 62341:tid 62415] [client 20.123.25.77:58020] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aYdq15-t2yekx5OosV4ZbwAAAE0"]
[Sun Feb 08 00:39:52.893128 2026] [:error] [pid 16829:tid 16862] [client 20.123.25.77:57496] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aYdq2AQFls00VxRngXuarwAAAVU"]
[Sun Feb 08 00:39:53.583420 2026] [:error] [pid 62340:tid 62396] [client 20.123.25.77:58938] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aYdq2Qp6H49g9bqshit8qAAAABU"]
[Sun Feb 08 00:39:54.318398 2026] [:error] [pid 62340:tid 62386] [client 20.123.25.77:58098] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aYdq2gp6H49g9bqshit8rQAAAAs"]
[Sun Feb 08 00:39:55.058931 2026] [:error] [pid 16829:tid 16855] [client 20.123.25.77:58598] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aYdq2wQFls00VxRngXuasgAAAU4"]
[Sun Feb 08 00:39:55.591715 2026] [:error] [pid 46302:tid 46360] [client 20.123.25.77:58074] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aYdq2-Lz0c8aDYK5YhbC3wAAAQk"]
[Sun Feb 08 00:39:56.242913 2026] [:error] [pid 62340:tid 62380] [client 20.123.25.77:58014] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYdq3Ap6H49g9bqshit8tAAAAAU"]
[Sun Feb 08 00:39:56.764334 2026] [:error] [pid 62342:tid 62435] [client 20.123.25.77:58935] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYdq3OwzANoqjscwU_64PgAAAIY"]
[Sun Feb 08 00:39:57.416930 2026] [:error] [pid 62340:tid 62379] [client 20.123.25.77:58885] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYdq3Qp6H49g9bqshit8uQAAAAQ"]
[Sun Feb 08 00:39:58.193707 2026] [:error] [pid 62342:tid 62445] [client 20.123.25.77:57596] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aYdq3uwzANoqjscwU_64QQAAAJA"]
[Sun Feb 08 00:39:58.816425 2026] [:error] [pid 17001:tid 17022] [client 20.123.25.77:58584] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aYdq3t0X31QDRSlPKmRcsAAAAYY"]
[Sun Feb 08 00:39:59.330901 2026] [:error] [pid 62340:tid 62376] [client 20.123.25.77:57171] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aYdq3wp6H49g9bqshit8vAAAAAE"]
[Sun Feb 08 00:39:59.988145 2026] [:error] [pid 16829:tid 16861] [client 20.123.25.77:57546] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aYdq3wQFls00VxRngXuauwAAAVQ"]
[Sun Feb 08 00:40:00.641640 2026] [:error] [pid 62341:tid 62403] [client 20.123.25.77:58546] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aYdq4J-t2yekx5OosV4ZfwAAAEE"]
[Sun Feb 08 00:40:01.205725 2026] [:error] [pid 17001:tid 17036] [client 20.123.25.77:57483] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aYdq4d0X31QDRSlPKmRcuAAAAZQ"]
[Sun Feb 08 00:40:01.715612 2026] [:error] [pid 62342:tid 62441] [client 20.123.25.77:58944] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aYdq4ewzANoqjscwU_64TAAAAIw"]
[Sun Feb 08 00:40:02.227337 2026] [:error] [pid 16829:tid 16851] [client 20.123.25.77:58978] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aYdq4gQFls00VxRngXuawQAAAUo"]
[Sun Feb 08 00:40:02.836788 2026] [:error] [pid 46302:tid 46352] [client 20.123.25.77:58586] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aYdq4uLz0c8aDYK5YhbC6QAAAQI"]
[Sun Feb 08 00:40:03.452724 2026] [:error] [pid 62342:tid 62430] [client 20.123.25.77:58966] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYdq4-wzANoqjscwU_64TwAAAIE"]
[Sun Feb 08 00:40:04.052477 2026] [:error] [pid 17001:tid 17032] [client 20.123.25.77:58542] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYdq5N0X31QDRSlPKmRcvAAAAZA"]
[Sun Feb 08 00:40:04.637747 2026] [:error] [pid 62340:tid 62389] [client 20.123.25.77:57201] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYdq5Ap6H49g9bqshit8xAAAAA4"]
[Sun Feb 08 00:40:05.165115 2026] [:error] [pid 62342:tid 62448] [client 20.123.25.77:58024] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aYdq5ewzANoqjscwU_64UgAAAJM"]
[Sun Feb 08 00:40:05.688448 2026] [:error] [pid 62342:tid 62450] [client 20.123.25.77:58579] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aYdq5ewzANoqjscwU_64UwAAAJU"]
[Sun Feb 08 00:40:06.294228 2026] [:error] [pid 62342:tid 62435] [client 20.123.25.77:58992] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aYdq5uwzANoqjscwU_64VgAAAIY"]
[Sun Feb 08 00:40:06.804374 2026] [:error] [pid 17001:tid 17028] [client 20.123.25.77:58926] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aYdq5t0X31QDRSlPKmRcxQAAAYw"]
[Sun Feb 08 00:40:07.380133 2026] [:error] [pid 62641:tid 62645] [client 20.123.25.77:58078] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aYdq5y_seVuUK_C4AppalQAAAMI"]
[Sun Feb 08 00:40:08.162397 2026] [:error] [pid 62340:tid 62389] [client 20.123.25.77:58594] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aYdq6Ap6H49g9bqshit8zgAAAA4"]
[Sun Feb 08 00:40:08.751284 2026] [:error] [pid 16829:tid 16859] [client 20.123.25.77:58888] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aYdq6AQFls00VxRngXuayQAAAVI"]
[Sun Feb 08 00:40:09.424434 2026] [:error] [pid 62340:tid 62375] [client 20.123.25.77:57530] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aYdq6Qp6H49g9bqshit80gAAAAA"]
[Sun Feb 08 00:40:09.941722 2026] [:error] [pid 62641:tid 62646] [client 20.123.25.77:57203] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aYdq6S_seVuUK_C4AppamAAAAMM"]
[Sun Feb 08 00:40:10.634491 2026] [:error] [pid 62341:tid 62424] [client 20.123.25.77:58948] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aYdq6p-t2yekx5OosV4ZlAAAAFY"]
[Sun Feb 08 00:40:11.150446 2026] [:error] [pid 46302:tid 46372] [client 20.123.25.77:58009] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aYdq6-Lz0c8aDYK5YhbC9AAAARU"]
[Sun Feb 08 00:40:11.674955 2026] [:error] [pid 62340:tid 62384] [client 20.123.25.77:58950] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aYdq6wp6H49g9bqshit82QAAAAk"]
[Sun Feb 08 00:40:12.252770 2026] [:error] [pid 46302:tid 46364] [client 20.123.25.77:58030] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aYdq7OLz0c8aDYK5YhbC9wAAAQ0"]
[Sun Feb 08 00:40:12.885029 2026] [:error] [pid 17001:tid 17032] [client 20.123.25.77:55327] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aYdq7N0X31QDRSlPKmRc1wAAAZA"]
[Sun Feb 08 00:40:13.468360 2026] [:error] [pid 17001:tid 17031] [client 20.123.25.77:57480] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aYdq7d0X31QDRSlPKmRc2QAAAY8"]
[Sun Feb 08 00:40:14.256163 2026] [:error] [pid 62340:tid 62393] [client 20.123.25.77:57586] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aYdq7gp6H49g9bqshit85QAAABI"]
[Sun Feb 08 00:40:14.827896 2026] [:error] [pid 17001:tid 17028] [client 20.123.25.77:57584] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aYdq7t0X31QDRSlPKmRc2wAAAYw"]
[Sun Feb 08 00:40:15.371257 2026] [:error] [pid 16829:tid 16845] [client 20.123.25.77:57533] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aYdq7wQFls00VxRngXua0AAAAUQ"]
[Sun Feb 08 00:40:16.012164 2026] [:error] [pid 62340:tid 62381] [client 20.123.25.77:57172] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aYdq8Ap6H49g9bqshit86QAAAAY"]
[Sun Feb 08 00:40:16.593840 2026] [:error] [pid 62641:tid 62645] [client 20.123.25.77:57174] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aYdq8C_seVuUK_C4AppanwAAAMI"]
[Sun Feb 08 00:40:17.163280 2026] [:error] [pid 62641:tid 62646] [client 20.123.25.77:58572] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aYdq8S_seVuUK_C4AppaowAAAMM"]
[Sun Feb 08 00:40:17.674705 2026] [:error] [pid 16829:tid 16865] [client 20.123.25.77:58553] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aYdq8QQFls00VxRngXua2QAAAVg"]
[Sun Feb 08 00:40:18.215354 2026] [:error] [pid 62340:tid 62395] [client 20.123.25.77:58509] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aYdq8gp6H49g9bqshit87QAAABQ"]
[Sun Feb 08 00:40:19.651265 2026] [:error] [pid 62341:tid 62426] [client 20.123.25.77:57487] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aYdq85-t2yekx5OosV4ZmgAAAFg"]
[Sun Feb 08 00:40:20.240615 2026] [:error] [pid 62340:tid 62399] [client 20.123.25.77:58933] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aYdq9Ap6H49g9bqshit89AAAABg"]
[Sun Feb 08 00:40:20.754722 2026] [:error] [pid 17001:tid 17017] [client 20.123.25.77:58958] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdq9N0X31QDRSlPKmRc6gAAAYE"]
[Sun Feb 08 00:40:21.262010 2026] [:error] [pid 62340:tid 62386] [client 20.123.25.77:58606] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdq9Qp6H49g9bqshit8-QAAAAs"]
[Sun Feb 08 00:40:21.797355 2026] [:error] [pid 46302:tid 46353] [client 20.123.25.77:57999] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdq9eLz0c8aDYK5YhbDAQAAAQM"]
[Sun Feb 08 00:40:22.385981 2026] [:error] [pid 62340:tid 62393] [client 20.123.25.77:58534] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdq9gp6H49g9bqshit8_QAAABI"]
[Sun Feb 08 00:40:22.908930 2026] [:error] [pid 62340:tid 62385] [client 20.123.25.77:58023] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYdq9gp6H49g9bqshit9AAAAAAo"]
[Sun Feb 08 00:40:23.497633 2026] [:error] [pid 46302:tid 46368] [client 20.123.25.77:57568] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYdq9-Lz0c8aDYK5YhbDBQAAARE"]
[Sun Feb 08 00:40:24.251715 2026] [:error] [pid 17001:tid 17028] [client 20.123.25.77:58618] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYdq-N0X31QDRSlPKmRc-AAAAYw"]
[Sun Feb 08 00:40:24.962416 2026] [:error] [pid 46302:tid 46356] [client 20.123.25.77:56592] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYdq-OLz0c8aDYK5YhbDCwAAAQY"]
[Sun Feb 08 00:40:25.575124 2026] [:error] [pid 62641:tid 62646] [client 20.123.25.77:54631] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aYdq-S_seVuUK_C4AppaqQAAAMM"]
[Sun Feb 08 00:40:26.570683 2026] [:error] [pid 46302:tid 46373] [client 20.123.25.77:58986] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aYdq-uLz0c8aDYK5YhbDEAAAARY"]
[Sun Feb 08 00:40:27.360451 2026] [:error] [pid 62341:tid 62410] [client 20.123.25.77:54605] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aYdq-5-t2yekx5OosV4ZpQAAAEg"]
[Sun Feb 08 00:40:28.101727 2026] [:error] [pid 62340:tid 62388] [client 20.123.25.77:58935] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aYdq_Ap6H49g9bqshit9DQAAAA0"]
[Sun Feb 08 00:40:29.064771 2026] [:error] [pid 17001:tid 17028] [client 20.123.25.77:56150] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aYdq_d0X31QDRSlPKmRdBwAAAYw"]
[Sun Feb 08 00:40:29.642157 2026] [:error] [pid 16829:tid 16846] [client 20.123.25.77:58564] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aYdq_QQFls00VxRngXua7AAAAUU"]
[Sun Feb 08 00:40:30.771280 2026] [:error] [pid 17001:tid 17033] [client 20.123.25.77:57107] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aYdq_t0X31QDRSlPKmRdDwAAAZE"]
[Sun Feb 08 00:40:31.435950 2026] [:error] [pid 62342:tid 62453] [client 20.123.25.77:58539] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aYdq_-wzANoqjscwU_64ggAAAJg"]
[Sun Feb 08 00:40:32.219766 2026] [:error] [pid 62341:tid 62409] [client 20.123.25.77:58515] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aYdrAJ-t2yekx5OosV4ZqQAAAEc"]
[Sun Feb 08 00:40:33.222891 2026] [:error] [pid 62641:tid 62650] [client 20.123.25.77:57535] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aYdrAS_seVuUK_C4AppatAAAAMc"]
[Sun Feb 08 00:40:33.963053 2026] [:error] [pid 17001:tid 17026] [client 20.123.25.77:58964] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aYdrAd0X31QDRSlPKmRdGQAAAYo"]
[Sun Feb 08 00:40:34.918218 2026] [:error] [pid 62340:tid 62386] [client 20.123.25.77:57543] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aYdrAgp6H49g9bqshit9FQAAAAs"]
[Sun Feb 08 00:40:35.878418 2026] [:error] [pid 16829:tid 16855] [client 20.123.25.77:58941] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aYdrAwQFls00VxRngXua9AAAAU4"]
[Sun Feb 08 00:40:36.793426 2026] [:error] [pid 46302:tid 46374] [client 20.123.25.77:57592] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Feb 08 00:40:37.046759 2026] [:error] [pid 46302:tid 46366] [client 20.123.25.77:57592] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Feb 08 00:40:37.319690 2026] [:error] [pid 46302:tid 46359] [client 20.123.25.77:57592] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Feb 08 00:40:37.719379 2026] [:error] [pid 46302:tid 46361] [client 20.123.25.77:57592] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aYdrBeLz0c8aDYK5YhbDIAAAAQo"]
[Sun Feb 08 00:40:38.257344 2026] [:error] [pid 62341:tid 62404] [client 20.123.25.77:58021] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Feb 08 00:40:38.520583 2026] [:error] [pid 62341:tid 62413] [client 20.123.25.77:58021] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sun Feb 08 00:40:38.781341 2026] [:error] [pid 62341:tid 62412] [client 20.123.25.77:58021] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Feb 08 00:40:39.033772 2026] [:error] [pid 62341:tid 62426] [client 20.123.25.77:58021] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sun Feb 08 00:40:39.347690 2026] [:error] [pid 62341:tid 62411] [client 20.123.25.77:58021] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Feb 08 00:40:39.621299 2026] [:error] [pid 62341:tid 62417] [client 20.123.25.77:58021] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Feb 08 00:40:40.282223 2026] [:error] [pid 62341:tid 62416] [client 20.123.25.77:58021] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Feb 08 00:40:40.538037 2026] [:error] [pid 62341:tid 62424] [client 20.123.25.77:58021] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYdrCJ-t2yekx5OosV4ZxQAAAFY"]
[Sun Feb 08 00:40:41.230118 2026] [:error] [pid 17001:tid 17028] [client 20.123.25.77:58044] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYdrCd0X31QDRSlPKmRdLgAAAYw"]
[Sun Feb 08 00:40:42.038597 2026] [:error] [pid 46302:tid 46366] [client 20.123.25.77:59421] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYdrCuLz0c8aDYK5YhbDKgAAAQ8"]
[Sun Feb 08 00:40:42.761422 2026] [:error] [pid 62641:tid 62654] [client 20.123.25.77:58917] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYdrCi_seVuUK_C4AppawAAAAMs"]
[Sun Feb 08 00:40:43.373735 2026] [:error] [pid 62641:tid 62651] [client 20.123.25.77:57539] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYdrCy_seVuUK_C4AppawgAAAMg"]
[Sun Feb 08 00:40:44.216525 2026] [:error] [pid 62342:tid 62445] [client 20.123.25.77:58105] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYdrDOwzANoqjscwU_64ogAAAJA"]
[Sun Feb 08 00:40:44.781819 2026] [:error] [pid 16829:tid 16860] [client 20.123.25.77:58928] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYdrDAQFls00VxRngXubAAAAAVM"]
[Sun Feb 08 00:40:45.406584 2026] [:error] [pid 46302:tid 46366] [client 20.123.25.77:57478] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aYdrDeLz0c8aDYK5YhbDMQAAAQ8"]
[Sun Feb 08 00:40:45.914753 2026] [:error] [pid 16829:tid 16855] [client 20.123.25.77:57593] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aYdrDQQFls00VxRngXubAQAAAU4"]
[Sun Feb 08 00:40:46.533207 2026] [:error] [pid 17001:tid 17028] [client 20.123.25.77:58092] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aYdrDt0X31QDRSlPKmRdOwAAAYw"]
[Sun Feb 08 00:40:47.102226 2026] [:error] [pid 17001:tid 17020] [client 20.123.25.77:58570] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aYdrD90X31QDRSlPKmRdPgAAAYQ"]
[Sun Feb 08 00:40:47.737626 2026] [:error] [pid 17001:tid 17019] [client 20.123.25.77:58516] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aYdrD90X31QDRSlPKmRdQAAAAYM"]
[Sun Feb 08 00:40:48.351474 2026] [:error] [pid 62341:tid 62419] [client 20.123.25.77:58597] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aYdrEJ-t2yekx5OosV4Z0gAAAFE"]
[Sun Feb 08 00:40:48.987746 2026] [:error] [pid 46302:tid 46375] [client 20.123.25.77:58907] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aYdrEOLz0c8aDYK5YhbDOQAAARg"]
[Sun Feb 08 00:40:49.508109 2026] [:error] [pid 46302:tid 46374] [client 20.123.25.77:58029] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aYdrEeLz0c8aDYK5YhbDOwAAARc"]
[Sun Feb 08 00:40:50.062650 2026] [:error] [pid 62342:tid 62440] [client 20.123.25.77:58089] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aYdrEuwzANoqjscwU_64rgAAAIs"]
[Sun Feb 08 00:40:50.713189 2026] [:error] [pid 62340:tid 62398] [client 20.123.25.77:58001] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aYdrEgp6H49g9bqshit9OAAAABc"]
[Sun Feb 08 00:40:51.358094 2026] [:error] [pid 17001:tid 17027] [client 20.123.25.77:59499] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aYdrE90X31QDRSlPKmRdTgAAAYs"]
[Sun Feb 08 00:40:51.942953 2026] [:error] [pid 62341:tid 62414] [client 20.123.25.77:57474] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aYdrE5-t2yekx5OosV4Z2wAAAEw"]
[Sun Feb 08 00:40:52.592175 2026] [:error] [pid 46302:tid 46371] [client 20.123.25.77:59481] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aYdrFOLz0c8aDYK5YhbDQAAAARQ"]
[Sun Feb 08 00:40:53.177590 2026] [:error] [pid 62342:tid 62438] [client 20.123.25.77:58053] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYdrFewzANoqjscwU_64tAAAAIk"]
[Sun Feb 08 00:40:53.678790 2026] [:error] [pid 62641:tid 62659] [client 20.123.25.77:58017] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYdrFS_seVuUK_C4AppazgAAANA"]
[Sun Feb 08 00:40:54.220686 2026] [:error] [pid 62341:tid 62418] [client 20.123.25.77:59407] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYdrFp-t2yekx5OosV4Z4QAAAFA"]
[Sun Feb 08 00:40:54.847342 2026] [:error] [pid 17001:tid 17027] [client 20.123.25.77:57575] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aYdrFt0X31QDRSlPKmRdWgAAAYs"]
[Sun Feb 08 00:40:55.704196 2026] [:error] [pid 17001:tid 17021] [client 20.123.25.77:56683] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrF90X31QDRSlPKmRdYQAAAYU"]
[Sun Feb 08 00:40:56.538618 2026] [:error] [pid 17001:tid 17026] [client 20.123.25.77:56628] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrGN0X31QDRSlPKmRdaAAAAYo"]
[Sun Feb 08 00:40:57.143584 2026] [:error] [pid 62342:tid 62430] [client 20.123.25.77:58612] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrGewzANoqjscwU_64vQAAAIE"]
[Sun Feb 08 00:40:57.888941 2026] [:error] [pid 46302:tid 46354] [client 20.123.25.77:59474] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrGeLz0c8aDYK5YhbDSgAAAQQ"]
[Sun Feb 08 00:40:58.804677 2026] [:error] [pid 17001:tid 17039] [client 20.123.25.77:58589] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aYdrGt0X31QDRSlPKmRdgQAAAZc"]
[Sun Feb 08 00:40:59.672157 2026] [:error] [pid 46302:tid 46366] [client 20.123.25.77:59000] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aYdrG-Lz0c8aDYK5YhbDTgAAAQ8"]
[Sun Feb 08 00:41:00.250098 2026] [:error] [pid 62341:tid 62414] [client 20.123.25.77:58976] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aYdrHJ-t2yekx5OosV4Z6QAAAEw"]
[Sun Feb 08 00:41:00.839978 2026] [:error] [pid 17001:tid 17040] [client 20.123.25.77:58587] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aYdrHN0X31QDRSlPKmRdhgAAAZg"]
[Sun Feb 08 00:41:01.437008 2026] [:error] [pid 62342:tid 62437] [client 20.123.25.77:57597] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdrHewzANoqjscwU_64wAAAAIg"]
[Sun Feb 08 00:41:01.948032 2026] [:error] [pid 62641:tid 62661] [client 20.123.25.77:58603] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdrHS_seVuUK_C4Appa3AAAANI"]
[Sun Feb 08 00:41:02.644726 2026] [:error] [pid 62340:tid 62378] [client 20.123.25.77:58035] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdrHgp6H49g9bqshit9WQAAAAM"]
[Sun Feb 08 00:41:03.230165 2026] [:error] [pid 62341:tid 62416] [client 20.123.25.77:58528] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdrH5-t2yekx5OosV4Z8AAAAE4"]
[Sun Feb 08 00:41:03.765907 2026] [:error] [pid 62641:tid 62652] [client 20.123.25.77:57152] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYdrHy_seVuUK_C4Appa3QAAAMk"]
[Sun Feb 08 00:41:04.327215 2026] [:error] [pid 46302:tid 46354] [client 20.123.25.77:58982] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYdrIOLz0c8aDYK5YhbDVgAAAQQ"]
[Sun Feb 08 00:41:04.924317 2026] [:error] [pid 62342:tid 62445] [client 20.123.25.77:59451] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYdrIOwzANoqjscwU_64yAAAAJA"]
[Sun Feb 08 00:41:06.146241 2026] [:error] [pid 62340:tid 62394] [client 20.123.25.77:59763] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aYdrIgp6H49g9bqshit9YAAAABM"]
[Sun Feb 08 00:41:07.579392 2026] [:error] [pid 46302:tid 46352] [client 20.123.25.77:57988] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYdrI-Lz0c8aDYK5YhbDXgAAAQI"]
[Sun Feb 08 00:41:08.289251 2026] [:error] [pid 62341:tid 62420] [client 20.123.25.77:57111] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYdrJJ-t2yekx5OosV4Z-QAAAFI"]
[Sun Feb 08 00:41:08.994411 2026] [:error] [pid 46302:tid 46368] [client 20.123.25.77:58502] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYdrJOLz0c8aDYK5YhbDYwAAARE"]
[Sun Feb 08 00:41:09.652484 2026] [:error] [pid 46302:tid 46353] [client 20.123.25.77:59749] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYdrJeLz0c8aDYK5YhbDZAAAAQM"]
[Sun Feb 08 00:41:10.219321 2026] [:error] [pid 16829:tid 16860] [client 20.123.25.77:57117] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYdrJgQFls00VxRngXubNgAAAVM"]
[Sun Feb 08 00:41:10.775175 2026] [:error] [pid 17001:tid 17040] [client 20.123.25.77:58578] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYdrJt0X31QDRSlPKmRdrQAAAZg"]
[Sun Feb 08 00:41:11.393458 2026] [:error] [pid 62341:tid 62422] [client 20.123.25.77:58995] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYdrJ5-t2yekx5OosV4Z_QAAAFQ"]
[Sun Feb 08 00:41:12.036529 2026] [:error] [pid 62341:tid 62425] [client 20.123.25.77:57989] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aYdrKJ-t2yekx5OosV4Z_gAAAFc"]
[Sun Feb 08 00:41:12.576474 2026] [:error] [pid 62342:tid 62432] [client 20.123.25.77:58499] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aYdrKOwzANoqjscwU_643wAAAIM"]
[Sun Feb 08 00:41:13.203168 2026] [:error] [pid 62641:tid 62654] [client 20.123.25.77:58890] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aYdrKS_seVuUK_C4Appa8AAAAMs"]
[Sun Feb 08 00:41:13.714231 2026] [:error] [pid 62342:tid 62433] [client 20.123.25.77:59410] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aYdrKewzANoqjscwU_644gAAAIQ"]
[Sun Feb 08 00:41:14.288440 2026] [:error] [pid 62340:tid 62376] [client 20.123.25.77:58543] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aYdrKgp6H49g9bqshit9bAAAAAE"]
[Sun Feb 08 00:41:15.284947 2026] [:error] [pid 46302:tid 46352] [client 20.123.25.77:55386] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aYdrK-Lz0c8aDYK5YhbDaQAAAQI"]
[Sun Feb 08 00:41:15.946394 2026] [:error] [pid 62641:tid 62664] [client 20.123.25.77:58005] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aYdrKy_seVuUK_C4Appa9gAAANU"]
[Sun Feb 08 00:41:16.634816 2026] [:error] [pid 16829:tid 16863] [client 20.123.25.77:58588] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aYdrLAQFls00VxRngXubQgAAAVY"]
[Sun Feb 08 00:41:17.155993 2026] [:error] [pid 62340:tid 62399] [client 20.123.25.77:57507] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aYdrLQp6H49g9bqshit9bwAAABg"]
[Sun Feb 08 00:41:17.821237 2026] [:error] [pid 62341:tid 62426] [client 20.123.25.77:59459] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aYdrLZ-t2yekx5OosV4aBQAAAFg"]
[Sun Feb 08 00:41:18.326201 2026] [:error] [pid 62342:tid 62430] [client 20.123.25.77:58048] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aYdrLuwzANoqjscwU_646gAAAIE"]
[Sun Feb 08 00:41:18.871415 2026] [:error] [pid 62340:tid 62396] [client 20.123.25.77:58904] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aYdrLgp6H49g9bqshit9cAAAABU"]
[Sun Feb 08 00:41:19.389135 2026] [:error] [pid 62341:tid 62416] [client 20.123.25.77:58530] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aYdrL5-t2yekx5OosV4aCQAAAE4"]
[Sun Feb 08 00:41:19.896472 2026] [:error] [pid 62341:tid 62424] [client 20.123.25.77:58010] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aYdrL5-t2yekx5OosV4aCgAAAFY"]
[Sun Feb 08 00:41:20.429174 2026] [:error] [pid 62340:tid 62386] [client 20.123.25.77:56609] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aYdrMAp6H49g9bqshit9cgAAAAs"]
[Sun Feb 08 00:41:21.145486 2026] [:error] [pid 62641:tid 62653] [client 20.123.25.77:59454] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aYdrMS_seVuUK_C4Appa_AAAAMo"]
[Sun Feb 08 00:41:21.737079 2026] [:error] [pid 46302:tid 46368] [client 20.123.25.77:59483] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aYdrMeLz0c8aDYK5YhbDcQAAARE"]
[Sun Feb 08 00:41:22.320444 2026] [:error] [pid 62342:tid 62431] [client 20.123.25.77:58541] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdrMuwzANoqjscwU_647QAAAII"]
[Sun Feb 08 00:41:22.842347 2026] [:error] [pid 62340:tid 62383] [client 20.123.25.77:59394] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdrMgp6H49g9bqshit9dwAAAAg"]
[Sun Feb 08 00:41:23.506648 2026] [:error] [pid 17001:tid 17037] [client 20.123.25.77:58911] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdrM90X31QDRSlPKmRd3AAAAZU"]
[Sun Feb 08 00:41:24.347441 2026] [:error] [pid 17001:tid 17018] [client 20.123.25.77:58496] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdrNN0X31QDRSlPKmRd4QAAAYI"]
[Sun Feb 08 00:41:24.992406 2026] [:error] [pid 62340:tid 62376] [client 20.123.25.77:57525] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aYdrNAp6H49g9bqshit9egAAAAE"]
[Sun Feb 08 00:41:25.551602 2026] [:error] [pid 46302:tid 46359] [client 20.123.25.77:59743] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aYdrNeLz0c8aDYK5YhbDdAAAAQg"]
[Sun Feb 08 00:41:26.092889 2026] [:error] [pid 62340:tid 62378] [client 20.123.25.77:59696] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aYdrNgp6H49g9bqshit9gAAAAAM"]
[Sun Feb 08 00:41:26.636830 2026] [:error] [pid 16829:tid 16841] [client 20.123.25.77:59662] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aYdrNgQFls00VxRngXubWAAAAUA"]
[Sun Feb 08 00:41:27.714109 2026] [:error] [pid 17001:tid 17022] [client 20.123.25.77:59482] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYdrN90X31QDRSlPKmRd7AAAAYY"]
[Sun Feb 08 00:41:28.660292 2026] [:error] [pid 62340:tid 62379] [client 20.123.25.77:59695] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYdrOAp6H49g9bqshit9hAAAAAQ"]
[Sun Feb 08 00:41:29.443546 2026] [:error] [pid 17001:tid 17037] [client 20.123.25.77:57165] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYdrOd0X31QDRSlPKmRd9gAAAZU"]
[Sun Feb 08 00:41:29.963205 2026] [:error] [pid 46302:tid 46365] [client 20.123.25.77:58913] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYdrOeLz0c8aDYK5YhbDeAAAAQ4"]
[Sun Feb 08 00:41:30.467184 2026] [:error] [pid 62342:tid 62440] [client 20.123.25.77:58957] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrOuwzANoqjscwU_64_wAAAIs"]
[Sun Feb 08 00:41:30.972911 2026] [:error] [pid 62641:tid 62656] [client 20.123.25.77:59399] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrOi_seVuUK_C4AppbFAAAAM0"]
[Sun Feb 08 00:41:31.567425 2026] [:error] [pid 62641:tid 62667] [client 20.123.25.77:58577] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrOy_seVuUK_C4AppbFgAAANg"]
[Sun Feb 08 00:41:32.307909 2026] [:error] [pid 17001:tid 17021] [client 20.123.25.77:59649] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aYdrPN0X31QDRSlPKmReAAAAAYU"]
[Sun Feb 08 00:41:32.854948 2026] [:error] [pid 46302:tid 46364] [client 20.123.25.77:58895] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYdrPOLz0c8aDYK5YhbDgwAAAQ0"]
[Sun Feb 08 00:41:33.420048 2026] [:error] [pid 62341:tid 62411] [client 20.123.25.77:59750] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYdrPZ-t2yekx5OosV4aHgAAAEk"]
[Sun Feb 08 00:41:34.590323 2026] [:error] [pid 62342:tid 62447] [client 20.123.25.77:58620] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYdrPuwzANoqjscwU_65DAAAAJI"]
[Sun Feb 08 00:41:35.830153 2026] [:error] [pid 16829:tid 16861] [client 20.123.25.77:58947] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aYdrPwQFls00VxRngXubZQAAAVQ"]
[Sun Feb 08 00:41:36.474043 2026] [:error] [pid 62340:tid 62380] [client 20.123.25.77:58892] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aYdrQAp6H49g9bqshit9lgAAAAU"]
[Sun Feb 08 00:41:37.156956 2026] [:error] [pid 46302:tid 46353] [client 20.123.25.77:58943] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aYdrQeLz0c8aDYK5YhbDkAAAAQM"]
[Sun Feb 08 00:41:37.704450 2026] [:error] [pid 46302:tid 46354] [client 20.123.25.77:59416] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aYdrQeLz0c8aDYK5YhbDlAAAAQQ"]
[Sun Feb 08 00:41:38.329162 2026] [:error] [pid 62342:tid 62433] [client 20.123.25.77:58055] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aYdrQuwzANoqjscwU_65GAAAAIQ"]
[Sun Feb 08 00:41:38.884765 2026] [:error] [pid 16829:tid 16852] [client 20.123.25.77:58097] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aYdrQgQFls00VxRngXubaAAAAUs"]
[Sun Feb 08 00:41:39.500408 2026] [:error] [pid 46302:tid 46367] [client 20.123.25.77:58991] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aYdrQ-Lz0c8aDYK5YhbDmQAAARA"]
[Sun Feb 08 00:41:40.366811 2026] [:error] [pid 17001:tid 17019] [client 20.123.25.77:58608] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Feb 08 00:41:41.457974 2026] [:error] [pid 17001:tid 17022] [client 20.123.25.77:58608] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Sun Feb 08 00:41:41.805384 2026] [:error] [pid 17001:tid 17024] [client 20.123.25.77:58608] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYdrRd0X31QDRSlPKmReGQAAAYg"]
[Sun Feb 08 00:41:43.353222 2026] [:error] [pid 17001:tid 17037] [client 20.123.25.77:58081] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aYdrR90X31QDRSlPKmReHwAAAZU"]
[Sun Feb 08 00:41:45.581714 2026] [:error] [pid 62342:tid 62443] [client 20.123.25.77:58903] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aYdrSewzANoqjscwU_65JgAAAI4"]
[Sun Feb 08 00:41:47.180174 2026] [:error] [pid 62341:tid 62421] [client 20.123.25.77:59493] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aYdrS5-t2yekx5OosV4aNAAAAFM"]
[Sun Feb 08 00:41:47.873837 2026] [:error] [pid 16829:tid 16842] [client 20.123.25.77:59425] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aYdrSwQFls00VxRngXubdQAAAUE"]
[Sun Feb 08 00:41:48.703951 2026] [:error] [pid 62641:tid 62659] [client 20.123.25.77:59720] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aYdrTC_seVuUK_C4AppbJwAAANA"]
[Sun Feb 08 00:41:49.296349 2026] [:error] [pid 16829:tid 16856] [client 20.123.25.77:59502] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aYdrTQQFls00VxRngXubfQAAAU8"]
[Sun Feb 08 00:41:49.968036 2026] [:error] [pid 62342:tid 62449] [client 20.123.25.77:59458] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aYdrTewzANoqjscwU_65KwAAAJQ"]
[Sun Feb 08 00:41:51.041088 2026] [:error] [pid 62342:tid 62447] [client 20.123.25.77:60221] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aYdrT-wzANoqjscwU_65LQAAAJI"]
[Sun Feb 08 00:41:51.744709 2026] [:error] [pid 62342:tid 62437] [client 20.123.25.77:58979] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aYdrT-wzANoqjscwU_65LgAAAIg"]
[Sun Feb 08 00:41:52.593745 2026] [:error] [pid 62340:tid 62388] [client 20.123.25.77:59415] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aYdrUAp6H49g9bqshit9qQAAAA0"]
[Sun Feb 08 00:41:53.303324 2026] [:error] [pid 16829:tid 16848] [client 20.123.25.77:58593] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aYdrUQQFls00VxRngXubhgAAAUc"]
[Sun Feb 08 00:41:54.172397 2026] [:error] [pid 46302:tid 46364] [client 20.123.25.77:60202] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYdrUuLz0c8aDYK5YhbDnQAAAQ0"]
[Sun Feb 08 00:41:55.169525 2026] [:error] [pid 46302:tid 46369] [client 20.123.25.77:59735] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYdrU-Lz0c8aDYK5YhbDnwAAARI"]
[Sun Feb 08 00:41:56.015489 2026] [:error] [pid 17001:tid 17037] [client 20.123.25.77:58956] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYdrVN0X31QDRSlPKmReQwAAAZU"]
[Sun Feb 08 00:41:57.065608 2026] [:error] [pid 16829:tid 16843] [client 20.123.25.77:58501] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aYdrVQQFls00VxRngXubigAAAUI"]
[Sun Feb 08 00:41:58.818916 2026] [:error] [pid 17001:tid 17024] [client 20.123.25.77:59408] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYdrVt0X31QDRSlPKmReTQAAAYg"]
[Sun Feb 08 00:41:59.817404 2026] [:error] [pid 46302:tid 46363] [client 20.123.25.77:60239] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYdrV-Lz0c8aDYK5YhbDqQAAAQw"]
[Sun Feb 08 00:42:00.577634 2026] [:error] [pid 62641:tid 62650] [client 20.123.25.77:58582] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYdrWC_seVuUK_C4AppbKwAAAMc"]
[Sun Feb 08 00:42:01.455943 2026] [:error] [pid 46302:tid 46356] [client 20.123.25.77:59715] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYdrWeLz0c8aDYK5YhbDrgAAAQY"]
[Sun Feb 08 00:42:02.142053 2026] [:error] [pid 62342:tid 62446] [client 20.123.25.77:60178] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aYdrWuwzANoqjscwU_65NgAAAJE"]
[Sun Feb 08 00:42:02.731231 2026] [:error] [pid 62641:tid 62655] [client 20.123.25.77:58880] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aYdrWi_seVuUK_C4AppbLAAAAMw"]
[Sun Feb 08 00:42:03.320559 2026] [:error] [pid 62641:tid 62652] [client 20.123.25.77:60164] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aYdrWy_seVuUK_C4AppbLQAAAMk"]
[Sun Feb 08 00:42:03.861403 2026] [:error] [pid 16829:tid 16862] [client 20.123.25.77:59485] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aYdrWwQFls00VxRngXubkgAAAVU"]
[Sun Feb 08 00:42:04.493451 2026] [:error] [pid 62341:tid 62406] [client 20.123.25.77:59713] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aYdrXJ-t2yekx5OosV4aRgAAAEQ"]
[Sun Feb 08 00:42:05.240442 2026] [:error] [pid 62641:tid 62645] [client 20.123.25.77:59001] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aYdrXS_seVuUK_C4AppbMAAAAMI"]
[Sun Feb 08 00:42:06.157871 2026] [:error] [pid 62641:tid 62643] [client 20.123.25.77:58977] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aYdrXi_seVuUK_C4AppbMQAAAMA"]
[Sun Feb 08 00:42:06.843441 2026] [:error] [pid 16829:tid 16865] [client 20.123.25.77:59725] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aYdrXgQFls00VxRngXubnAAAAVg"]
[Sun Feb 08 00:42:07.546009 2026] [:error] [pid 62641:tid 62647] [client 20.123.25.77:58981] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aYdrXy_seVuUK_C4AppbNAAAAMQ"]
[Sun Feb 08 00:42:08.267485 2026] [:error] [pid 62340:tid 62391] [client 20.123.25.77:60194] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aYdrYAp6H49g9bqshit9wwAAABA"]
[Sun Feb 08 00:42:08.816431 2026] [:error] [pid 62340:tid 62375] [client 20.123.25.77:57587] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aYdrYAp6H49g9bqshit9xAAAAAA"]
[Sun Feb 08 00:42:09.383381 2026] [:error] [pid 17001:tid 17020] [client 20.123.25.77:60177] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aYdrYd0X31QDRSlPKmRecgAAAYQ"]
[Sun Feb 08 00:42:10.079895 2026] [:error] [pid 62340:tid 62388] [client 20.123.25.77:58071] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aYdrYgp6H49g9bqshit9xgAAAA0"]
[Sun Feb 08 00:42:10.641398 2026] [:error] [pid 46302:tid 46374] [client 20.123.25.77:60192] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aYdrYuLz0c8aDYK5YhbDtgAAARc"]
[Sun Feb 08 00:42:11.370112 2026] [:error] [pid 62342:tid 62436] [client 20.123.25.77:58522] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aYdrY-wzANoqjscwU_65QwAAAIc"]
[Sun Feb 08 00:42:12.031223 2026] [:error] [pid 62340:tid 62398] [client 20.123.25.77:57097] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aYdrZAp6H49g9bqshit9zQAAABc"]
[Sun Feb 08 00:42:13.133284 2026] [:error] [pid 62340:tid 62390] [client 20.123.25.77:60180] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aYdrZQp6H49g9bqshit90QAAAA8"]
[Sun Feb 08 00:42:13.742100 2026] [:error] [pid 16829:tid 16850] [client 20.123.25.77:59445] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aYdrZQQFls00VxRngXubpgAAAUk"]
[Sun Feb 08 00:42:14.277412 2026] [:error] [pid 62641:tid 62645] [client 20.123.25.77:60251] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aYdrZi_seVuUK_C4AppbQwAAAMI"]
[Sun Feb 08 00:42:14.854238 2026] [:error] [pid 62342:tid 62431] [client 20.123.25.77:57990] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aYdrZuwzANoqjscwU_65SwAAAII"]
[Sun Feb 08 00:42:15.368842 2026] [:error] [pid 62341:tid 62414] [client 20.123.25.77:58972] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aYdrZ5-t2yekx5OosV4aVgAAAEw"]
[Sun Feb 08 00:42:15.947530 2026] [:error] [pid 62641:tid 62663] [client 20.123.25.77:58906] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aYdrZy_seVuUK_C4AppbSAAAANQ"]
[Sun Feb 08 00:42:16.469282 2026] [:error] [pid 62341:tid 62409] [client 20.123.25.77:57510] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aYdraJ-t2yekx5OosV4aWgAAAEc"]
[Sun Feb 08 00:42:17.039761 2026] [:error] [pid 16829:tid 16849] [client 20.123.25.77:58080] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aYdraQQFls00VxRngXubqwAAAUg"]
[Sun Feb 08 00:42:17.637427 2026] [:error] [pid 62340:tid 62397] [client 20.123.25.77:57995] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aYdraQp6H49g9bqshit90wAAABY"]
[Sun Feb 08 00:42:18.288328 2026] [:error] [pid 16829:tid 16864] [client 20.123.25.77:56674] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aYdragQFls00VxRngXubrQAAAVc"]
[Sun Feb 08 00:42:18.976382 2026] [:error] [pid 16829:tid 16842] [client 20.123.25.77:58898] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aYdragQFls00VxRngXubrwAAAUE"]
[Sun Feb 08 00:42:19.550120 2026] [:error] [pid 62340:tid 62379] [client 20.123.25.77:59670] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aYdrawp6H49g9bqshit91AAAAAQ"]
[Sun Feb 08 00:42:25.880356 2026] [:error] [pid 62340:tid 62386] [client 20.123.25.77:59665] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aYdrcQp6H49g9bqshit92QAAAAs"]
[Sun Feb 08 00:42:26.495035 2026] [:error] [pid 17001:tid 17037] [client 20.123.25.77:57156] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYdrct0X31QDRSlPKmRelgAAAZU"]
[Sun Feb 08 00:42:27.341668 2026] [:error] [pid 46302:tid 46367] [client 20.123.25.77:60734] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYdrc-Lz0c8aDYK5YhbD3QAAARA"]
[Sun Feb 08 00:42:27.935838 2026] [:error] [pid 17001:tid 17023] [client 20.123.25.77:60232] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYdrc90X31QDRSlPKmRenwAAAYc"]
[Sun Feb 08 00:42:28.792529 2026] [:error] [pid 17001:tid 17033] [client 20.123.25.77:60267] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aYdrdN0X31QDRSlPKmReogAAAZE"]
[Sun Feb 08 00:42:29.824605 2026] [:error] [pid 17001:tid 17038] [client 20.123.25.77:59705] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYdrdd0X31QDRSlPKmReqgAAAZY"]
[Sun Feb 08 00:42:30.511788 2026] [:error] [pid 46302:tid 46350] [client 20.123.25.77:60252] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYdrduLz0c8aDYK5YhbD4QAAAQA"]
[Sun Feb 08 00:42:31.371610 2026] [:error] [pid 46302:tid 46365] [client 20.123.25.77:60249] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYdrd-Lz0c8aDYK5YhbD6AAAAQ4"]
[Sun Feb 08 00:42:32.008396 2026] [:error] [pid 46302:tid 46367] [client 20.123.25.77:60278] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aYdreOLz0c8aDYK5YhbD6QAAARA"]
[Sun Feb 08 00:42:33.486504 2026] [:error] [pid 17001:tid 17021] [client 20.123.25.77:59686] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aYdred0X31QDRSlPKmResAAAAYU"]
[Sun Feb 08 00:42:36.052359 2026] [:error] [pid 62340:tid 62389] [client 20.123.25.77:58968] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aYdrfAp6H49g9bqshit94wAAAA4"]
[Sun Feb 08 00:42:37.150097 2026] [:error] [pid 62340:tid 62380] [client 20.123.25.77:60168] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aYdrfQp6H49g9bqshit95AAAAAU"]
[Sun Feb 08 00:42:38.083527 2026] [:error] [pid 46302:tid 46366] [client 20.123.25.77:60685] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aYdrfuLz0c8aDYK5YhbD9gAAAQ8"]
[Sun Feb 08 00:42:38.831633 2026] [:error] [pid 17001:tid 17022] [client 20.123.25.77:60241] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aYdrft0X31QDRSlPKmRevgAAAYY"]
[Sun Feb 08 00:42:39.498943 2026] [:error] [pid 62342:tid 62429] [client 20.123.25.77:60191] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aYdrf-wzANoqjscwU_65bAAAAIA"]
[Sun Feb 08 00:42:40.096094 2026] [:error] [pid 16829:tid 16853] [client 20.123.25.77:60229] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aYdrgAQFls00VxRngXub1wAAAUw"]
[Sun Feb 08 00:42:40.711992 2026] [:error] [pid 46302:tid 46363] [client 20.123.25.77:60774] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aYdrgOLz0c8aDYK5YhbD-AAAAQw"]
[Sun Feb 08 00:42:41.564155 2026] [:error] [pid 62342:tid 62448] [client 20.123.25.77:60750] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aYdrgewzANoqjscwU_65cQAAAJM"]
[Sun Feb 08 00:42:42.304612 2026] [:error] [pid 17001:tid 17039] [client 20.123.25.77:59489] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aYdrgt0X31QDRSlPKmRexgAAAZc"]
[Sun Feb 08 00:42:43.624391 2026] [:error] [pid 16829:tid 16865] [client 20.123.25.77:60176] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aYdrgwQFls00VxRngXub2wAAAVg"]
[Sun Feb 08 00:42:44.656379 2026] [:error] [pid 16829:tid 16846] [client 20.123.25.77:60740] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aYdrhAQFls00VxRngXub3wAAAUU"]
[Sun Feb 08 00:42:45.409420 2026] [:error] [pid 62342:tid 62430] [client 20.123.25.77:60724] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aYdrhewzANoqjscwU_65egAAAIE"]
[Sun Feb 08 00:42:46.399431 2026] [:error] [pid 62641:tid 62649] [client 20.123.25.77:60262] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Feb 08 00:42:46.652856 2026] [:error] [pid 62641:tid 62666] [client 20.123.25.77:60262] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Sun Feb 08 00:42:46.904911 2026] [:error] [pid 62641:tid 62643] [client 20.123.25.77:60262] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aYdrhi_seVuUK_C4AppbeAAAAMA"]
[Sun Feb 08 00:42:47.580118 2026] [:error] [pid 17001:tid 17035] [client 20.123.25.77:58920] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aYdrh90X31QDRSlPKmRe2AAAAZM"]
[Sun Feb 08 00:42:48.497280 2026] [:error] [pid 62641:tid 62652] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Feb 08 00:42:49.609736 2026] [:error] [pid 62641:tid 62652] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Sun Feb 08 00:42:49.893807 2026] [:error] [pid 62641:tid 62650] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Sun Feb 08 00:42:50.201948 2026] [:error] [pid 62641:tid 62648] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sun Feb 08 00:42:50.467249 2026] [:error] [pid 62641:tid 62649] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sun Feb 08 00:42:50.723179 2026] [:error] [pid 62641:tid 62666] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Sun Feb 08 00:42:50.978565 2026] [:error] [pid 62641:tid 62643] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Sun Feb 08 00:42:51.259379 2026] [:error] [pid 62641:tid 62646] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun Feb 08 00:42:51.548795 2026] [:error] [pid 62641:tid 62655] [client 20.123.25.77:60710] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Sun Feb 08 00:42:51.799179 2026] [:error] [pid 62641:tid 62661] [client 20.123.25.77:60710] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aYdriy_seVuUK_C4AppbjAAAANI"]
[Sun Feb 08 00:42:53.219886 2026] [:error] [pid 16829:tid 16848] [client 20.123.25.77:58884] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aYdrjQQFls00VxRngXub7QAAAUc"]
[Sun Feb 08 00:42:54.225369 2026] [:error] [pid 62340:tid 62394] [client 20.123.25.77:59466] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aYdrjgp6H49g9bqshit-BAAAABM"]
[Sun Feb 08 00:42:55.713492 2026] [:error] [pid 46302:tid 46350] [client 20.123.25.77:59435] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aYdrj-Lz0c8aDYK5YhbECwAAAQA"]
[Sun Feb 08 00:42:57.302239 2026] [:error] [pid 17001:tid 17026] [client 20.123.25.77:58503] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aYdrkd0X31QDRSlPKmRe8QAAAYo"]
[Sun Feb 08 00:42:58.515800 2026] [:error] [pid 17001:tid 17016] [client 20.123.25.77:57140] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aYdrkt0X31QDRSlPKmRe-AAAAYA"]
[Sun Feb 08 00:42:59.717822 2026] [:error] [pid 62342:tid 62439] [client 20.123.25.77:58930] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aYdrk-wzANoqjscwU_65hQAAAIo"]
[Sun Feb 08 00:43:01.623947 2026] [:error] [pid 62342:tid 62436] [client 20.123.25.77:60224] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aYdrlewzANoqjscwU_65iAAAAIc"]
[Sun Feb 08 00:43:03.102564 2026] [:error] [pid 62342:tid 62452] [client 20.123.25.77:59427] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYdrl-wzANoqjscwU_65jQAAAJc"]
[Sun Feb 08 00:43:04.102848 2026] [:error] [pid 62641:tid 62647] [client 20.123.25.77:59774] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYdrmC_seVuUK_C4AppbpQAAAMQ"]
[Sun Feb 08 00:43:05.077517 2026] [:error] [pid 46302:tid 46352] [client 20.123.25.77:58038] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYdrmeLz0c8aDYK5YhbEFgAAAQI"]
[Sun Feb 08 00:43:05.797429 2026] [:error] [pid 17001:tid 17019] [client 20.123.25.77:60284] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aYdrmd0X31QDRSlPKmRfCgAAAYM"]
[Sun Feb 08 00:43:06.530474 2026] [:error] [pid 16829:tid 16856] [client 20.123.25.77:60751] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYdrmgQFls00VxRngXub-wAAAU8"]
[Sun Feb 08 00:43:07.315866 2026] [:error] [pid 62641:tid 62665] [client 20.123.25.77:60183] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYdrmy_seVuUK_C4AppbrQAAANY"]
[Sun Feb 08 00:43:08.152442 2026] [:error] [pid 62341:tid 62409] [client 20.123.25.77:59654] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYdrnJ-t2yekx5OosV4amAAAAEc"]
[Sun Feb 08 00:43:08.885564 2026] [:error] [pid 62341:tid 62408] [client 20.123.25.77:60223] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aYdrnJ-t2yekx5OosV4amQAAAEY"]
[Sun Feb 08 00:43:09.901467 2026] [:error] [pid 16829:tid 16864] [client 20.123.25.77:60728] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYdrnQQFls00VxRngXucBAAAAVc"]
[Sun Feb 08 00:43:10.678582 2026] [:error] [pid 62340:tid 62385] [client 20.123.25.77:59753] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYdrngp6H49g9bqshit-GgAAAAo"]
[Sun Feb 08 00:43:11.803094 2026] [:error] [pid 17001:tid 17022] [client 20.123.25.77:59498] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYdrn90X31QDRSlPKmRfGwAAAYY"]
[Sun Feb 08 00:43:12.415374 2026] [:error] [pid 62641:tid 62658] [client 20.123.25.77:59500] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aYdroC_seVuUK_C4AppbsgAAAM8"]
[Sun Feb 08 00:43:13.201911 2026] [:error] [pid 46302:tid 46362] [client 20.123.25.77:59471] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aYdroeLz0c8aDYK5YhbEKAAAAQs"]
[Sun Feb 08 00:43:13.951411 2026] [:error] [pid 62341:tid 62407] [client 20.123.25.77:59747] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aYdroZ-t2yekx5OosV4aowAAAEU"]
[Sun Feb 08 00:43:14.978295 2026] [:error] [pid 46302:tid 46359] [client 20.123.25.77:59393] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aYdrouLz0c8aDYK5YhbEKQAAAQg"]
[Sun Feb 08 00:43:15.773992 2026] [:error] [pid 62342:tid 62450] [client 20.123.25.77:58077] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aYdro-wzANoqjscwU_65pAAAAJU"]
[Sun Feb 08 00:43:16.556809 2026] [:error] [pid 17001:tid 17029] [client 20.123.25.77:59728] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aYdrpN0X31QDRSlPKmRfIwAAAY0"]
[Sun Feb 08 00:43:17.216974 2026] [:error] [pid 62341:tid 62422] [client 20.123.25.77:60790] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aYdrpZ-t2yekx5OosV4aqwAAAFQ"]
[Sun Feb 08 00:43:18.014182 2026] [:error] [pid 62641:tid 62666] [client 20.123.25.77:60758] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aYdrpi_seVuUK_C4AppbuAAAANc"]
[Sun Feb 08 00:43:18.764631 2026] [:error] [pid 62341:tid 62413] [client 20.123.25.77:57125] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aYdrpp-t2yekx5OosV4argAAAEs"]
[Sun Feb 08 00:43:19.816917 2026] [:error] [pid 62340:tid 62393] [client 20.123.25.77:60760] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aYdrpwp6H49g9bqshit-IAAAABI"]
[Sun Feb 08 00:43:21.185528 2026] [:error] [pid 46302:tid 46371] [client 20.123.25.77:57113] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aYdrqeLz0c8aDYK5YhbENwAAARQ"]
[Sun Feb 08 00:43:22.551134 2026] [:error] [pid 62641:tid 62653] [client 20.123.25.77:60228] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aYdrqi_seVuUK_C4AppbvwAAAMo"]
[Sun Feb 08 00:43:23.557300 2026] [:error] [pid 16829:tid 16859] [client 20.123.25.77:55302] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aYdrqwQFls00VxRngXucEQAAAVI"]
[Sun Feb 08 00:43:24.528125 2026] [:error] [pid 16829:tid 16856] [client 20.123.25.77:59455] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aYdrrAQFls00VxRngXucFQAAAU8"]
[Sun Feb 08 00:43:25.199485 2026] [:error] [pid 62341:tid 62409] [client 20.123.25.77:59519] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aYdrrZ-t2yekx5OosV4atgAAAEc"]
[Sun Feb 08 00:43:25.844904 2026] [:error] [pid 62340:tid 62390] [client 20.123.25.77:61344] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aYdrrQp6H49g9bqshit-KQAAAA8"]
[Sun Feb 08 00:43:26.647514 2026] [:error] [pid 62342:tid 62438] [client 20.123.25.77:59397] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aYdrruwzANoqjscwU_65tQAAAIk"]
[Sun Feb 08 00:43:27.275267 2026] [:error] [pid 17001:tid 17018] [client 20.123.25.77:59429] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aYdrr90X31QDRSlPKmRfNwAAAYI"]
[Sun Feb 08 00:43:27.790236 2026] [:error] [pid 62342:tid 62431] [client 20.123.25.77:60236] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aYdrr-wzANoqjscwU_65tgAAAII"]
[Sun Feb 08 00:43:28.412711 2026] [:error] [pid 16829:tid 16854] [client 20.123.25.77:61335] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aYdrsAQFls00VxRngXucGwAAAU0"]
[Sun Feb 08 00:43:29.127267 2026] [:error] [pid 46302:tid 46350] [client 20.123.25.77:59441] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aYdrseLz0c8aDYK5YhbERgAAAQA"]
[Sun Feb 08 00:43:29.870978 2026] [:error] [pid 62341:tid 62424] [client 20.123.25.77:59513] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYdrsZ-t2yekx5OosV4avAAAAFY"]
[Sun Feb 08 00:43:30.674884 2026] [:error] [pid 17001:tid 17033] [client 20.123.25.77:59734] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYdrst0X31QDRSlPKmRfQAAAAZE"]
[Sun Feb 08 00:43:31.392490 2026] [:error] [pid 62342:tid 62440] [client 20.123.25.77:60711] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYdrs-wzANoqjscwU_65uwAAAIs"]
[Sun Feb 08 00:43:31.917187 2026] [:error] [pid 17001:tid 17016] [client 20.123.25.77:59680] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aYdrs90X31QDRSlPKmRfRQAAAYA"]
[Sun Feb 08 00:43:32.444753 2026] [:error] [pid 17001:tid 17021] [client 20.123.25.77:59438] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aYdrtN0X31QDRSlPKmRfSQAAAYU"]
[Sun Feb 08 00:43:33.147800 2026] [:error] [pid 46302:tid 46373] [client 20.123.25.77:60715] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aYdrteLz0c8aDYK5YhbESgAAARY"]
[Sun Feb 08 00:43:33.900638 2026] [:error] [pid 62340:tid 62386] [client 20.123.25.77:59738] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aYdrtQp6H49g9bqshit-MgAAAAs"]
[Sun Feb 08 00:43:34.766948 2026] [:error] [pid 62340:tid 62381] [client 20.123.25.77:59651] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aYdrtgp6H49g9bqshit-NgAAAAY"]
[Sun Feb 08 00:43:35.410522 2026] [:error] [pid 62340:tid 62388] [client 20.123.25.77:60737] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYdrtwp6H49g9bqshit-NwAAAA0"]
[Sun Feb 08 00:43:36.390706 2026] [:error] [pid 62641:tid 62658] [client 20.123.25.77:61361] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYdruC_seVuUK_C4Appb0QAAAM8"]
[Sun Feb 08 00:43:37.092042 2026] [:error] [pid 46302:tid 46374] [client 20.123.25.77:59484] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYdrueLz0c8aDYK5YhbEVAAAARc"]
[Sun Feb 08 00:43:37.909161 2026] [:error] [pid 62342:tid 62450] [client 20.123.25.77:60179] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYdruewzANoqjscwU_65xgAAAJU"]
[Sun Feb 08 00:43:38.730933 2026] [:error] [pid 62340:tid 62392] [client 20.123.25.77:59702] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aYdrugp6H49g9bqshit-PQAAABE"]
[Sun Feb 08 00:43:39.406319 2026] [:error] [pid 17001:tid 17032] [client 20.123.25.77:61339] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aYdru90X31QDRSlPKmRfUwAAAZA"]
[Sun Feb 08 00:43:40.027477 2026] [:error] [pid 17001:tid 17023] [client 20.123.25.77:59700] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aYdrvN0X31QDRSlPKmRfVQAAAYc"]
[Sun Feb 08 00:43:40.600341 2026] [:error] [pid 17001:tid 17038] [client 20.123.25.77:61390] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aYdrvN0X31QDRSlPKmRfWQAAAZY"]
[Sun Feb 08 00:43:41.420716 2026] [:error] [pid 62641:tid 62666] [client 20.123.25.77:59714] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aYdrvS_seVuUK_C4Appb2QAAANc"]
[Sun Feb 08 00:43:42.173428 2026] [:error] [pid 62341:tid 62413] [client 20.123.25.77:59689] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aYdrvp-t2yekx5OosV4ayQAAAEs"]
[Sun Feb 08 00:43:42.835799 2026] [:error] [pid 17001:tid 17020] [client 20.123.25.77:59433] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aYdrvt0X31QDRSlPKmRfXAAAAYQ"]
[Sun Feb 08 00:43:43.649908 2026] [:error] [pid 62340:tid 62378] [client 20.123.25.77:61355] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aYdrvwp6H49g9bqshit-TgAAAAM"]
[Sun Feb 08 00:43:44.318814 2026] [:error] [pid 62340:tid 62376] [client 20.123.25.77:60231] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aYdrwAp6H49g9bqshit-UQAAAAE"]
[Sun Feb 08 00:43:45.044957 2026] [:error] [pid 46302:tid 46356] [client 20.123.25.77:61312] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aYdrweLz0c8aDYK5YhbEXwAAAQY"]
[Sun Feb 08 00:43:45.941859 2026] [:error] [pid 62342:tid 62437] [client 20.123.25.77:59470] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aYdrwewzANoqjscwU_651gAAAIg"]
[Sun Feb 08 00:43:46.924321 2026] [:error] [pid 17001:tid 17035] [client 20.123.25.77:60754] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aYdrwt0X31QDRSlPKmRfYAAAAZM"]
[Sun Feb 08 00:43:47.718154 2026] [:error] [pid 16829:tid 16859] [client 20.123.25.77:59430] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aYdrwwQFls00VxRngXucJQAAAVI"]
[Sun Feb 08 00:43:48.501376 2026] [:error] [pid 62641:tid 62654] [client 20.123.25.77:59675] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aYdrxC_seVuUK_C4Appb6wAAAMs"]
[Sun Feb 08 00:43:49.092620 2026] [:error] [pid 62340:tid 62390] [client 20.123.25.77:60180] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aYdrxQp6H49g9bqshit-WgAAAA8"]
[Sun Feb 08 00:43:49.619401 2026] [:error] [pid 62342:tid 62452] [client 20.123.25.77:62286] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aYdrxewzANoqjscwU_653wAAAJc"]
[Sun Feb 08 00:43:50.225273 2026] [:error] [pid 62341:tid 62410] [client 20.123.25.77:59660] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aYdrxp-t2yekx5OosV4a6QAAAEg"]
[Sun Feb 08 00:43:50.949438 2026] [:error] [pid 62342:tid 62434] [client 20.123.25.77:60683] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aYdrxuwzANoqjscwU_654wAAAIU"]
[Sun Feb 08 00:43:51.700497 2026] [:error] [pid 16829:tid 16861] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Sun Feb 08 00:43:52.018433 2026] [:error] [pid 16829:tid 16858] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Sun Feb 08 00:43:52.329095 2026] [:error] [pid 16829:tid 16841] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Sun Feb 08 00:43:52.585741 2026] [:error] [pid 16829:tid 16863] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Sun Feb 08 00:43:52.890670 2026] [:error] [pid 16829:tid 16854] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sun Feb 08 00:43:53.142912 2026] [:error] [pid 16829:tid 16862] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Sun Feb 08 00:43:53.465885 2026] [:error] [pid 16829:tid 16850] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Sun Feb 08 00:43:53.721106 2026] [:error] [pid 16829:tid 16847] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sun Feb 08 00:43:54.010678 2026] [:error] [pid 16829:tid 16859] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Sun Feb 08 00:43:54.263993 2026] [:error] [pid 16829:tid 16860] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Sun Feb 08 00:43:54.522396 2026] [:error] [pid 16829:tid 16855] [client 20.123.25.77:61426] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Sun Feb 08 00:43:54.774361 2026] [:error] [pid 16829:tid 16853] [client 20.123.25.77:61426] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aYdrygQFls00VxRngXucPAAAAUw"]
[Sun Feb 08 00:43:55.418389 2026] [:error] [pid 17001:tid 17035] [client 20.123.25.77:59406] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aYdry90X31QDRSlPKmRfawAAAZM"]
[Sun Feb 08 00:43:56.224376 2026] [:error] [pid 62641:tid 62658] [client 20.123.25.77:62327] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aYdrzC_seVuUK_C4Appb8wAAAM8"]
[Sun Feb 08 00:43:56.900989 2026] [:error] [pid 46302:tid 46366] [client 20.123.25.77:57538] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aYdrzOLz0c8aDYK5YhbEfgAAAQ8"]
[Sun Feb 08 00:43:58.018690 2026] [:error] [pid 62340:tid 62399] [client 20.123.25.77:59733] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aYdrzgp6H49g9bqshit-ZgAAABg"]
[Sun Feb 08 00:43:58.940092 2026] [:error] [pid 62342:tid 62439] [client 20.123.25.77:59756] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aYdrzuwzANoqjscwU_658wAAAIo"]
[Sun Feb 08 00:43:59.635509 2026] [:error] [pid 62341:tid 62402] [client 20.123.25.77:59461] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aYdrz5-t2yekx5OosV4a-AAAAEA"]
[Sun Feb 08 00:44:00.630025 2026] [:error] [pid 62341:tid 62405] [client 20.123.25.77:61401] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aYdr0J-t2yekx5OosV4a-QAAAEM"]
[Sun Feb 08 00:44:01.251876 2026] [:error] [pid 17001:tid 17032] [client 20.123.25.77:60702] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aYdr0d0X31QDRSlPKmRfdAAAAZA"]
[Sun Feb 08 00:44:02.303586 2026] [:error] [pid 17001:tid 17022] [client 20.123.25.77:61379] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aYdr0t0X31QDRSlPKmRfegAAAYY"]
[Sun Feb 08 00:44:03.560196 2026] [:error] [pid 17001:tid 17026] [client 20.123.25.77:62315] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aYdr090X31QDRSlPKmRffgAAAYo"]
[Sun Feb 08 00:44:04.101436 2026] [:error] [pid 17001:tid 17021] [client 20.123.25.77:60235] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aYdr1N0X31QDRSlPKmRfgwAAAYU"]
[Sun Feb 08 00:44:04.615410 2026] [:error] [pid 62341:tid 62407] [client 20.123.25.77:61406] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aYdr1J-t2yekx5OosV4bAAAAAEU"]
[Sun Feb 08 00:44:05.335816 2026] [:error] [pid 62342:tid 62440] [client 20.123.25.77:60254] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aYdr1ewzANoqjscwU_65_AAAAIs"]
[Sun Feb 08 00:44:05.898113 2026] [:error] [pid 62341:tid 62422] [client 20.123.25.77:61374] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aYdr1Z-t2yekx5OosV4bAgAAAFQ"]
[Sun Feb 08 00:44:07.263175 2026] [:error] [pid 62340:tid 62378] [client 20.123.25.77:60711] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aYdr1wp6H49g9bqshit-cwAAAAM"]
[Sun Feb 08 00:44:07.909031 2026] [:error] [pid 62341:tid 62408] [client 20.123.25.77:60273] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aYdr15-t2yekx5OosV4bDAAAAEY"]
[Sun Feb 08 00:44:08.593248 2026] [:error] [pid 62340:tid 62377] [client 20.123.25.77:60791] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aYdr2Ap6H49g9bqshit-eQAAAAI"]
[Sun Feb 08 00:44:09.174039 2026] [:error] [pid 17001:tid 17024] [client 20.123.25.77:61384] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aYdr2d0X31QDRSlPKmRfiwAAAYg"]
[Sun Feb 08 00:44:09.801649 2026] [:error] [pid 16829:tid 16853] [client 20.123.25.77:58505] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aYdr2QQFls00VxRngXucTgAAAUw"]
[Sun Feb 08 00:44:10.415454 2026] [:error] [pid 62342:tid 62434] [client 20.123.25.77:59655] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aYdr2uwzANoqjscwU_65_gAAAIU"]
[Sun Feb 08 00:44:11.206664 2026] [:error] [pid 62641:tid 62658] [client 20.123.25.77:57504] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aYdr2y_seVuUK_C4AppcFQAAAM8"]
[Sun Feb 08 00:44:12.150685 2026] [:error] [pid 62340:tid 62386] [client 20.123.25.77:60282] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aYdr3Ap6H49g9bqshit-hAAAAAs"]
[Sun Feb 08 00:44:13.231419 2026] [:error] [pid 17001:tid 17030] [client 20.123.25.77:62226] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aYdr3d0X31QDRSlPKmRfkQAAAY4"]
[Sun Feb 08 00:44:13.785392 2026] [:error] [pid 17001:tid 17017] [client 20.123.25.77:61359] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aYdr3d0X31QDRSlPKmRflQAAAYE"]
[Sun Feb 08 00:44:14.429119 2026] [:error] [pid 17001:tid 17040] [client 20.123.25.77:61337] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aYdr3t0X31QDRSlPKmRfmgAAAZg"]
[Sun Feb 08 00:44:14.986492 2026] [:error] [pid 16829:tid 16846] [client 20.123.25.77:61323] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aYdr3gQFls00VxRngXucWAAAAUU"]
[Sun Feb 08 00:44:15.615507 2026] [:error] [pid 62340:tid 62389] [client 20.123.25.77:62245] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aYdr3wp6H49g9bqshit-jgAAAA4"]
[Sun Feb 08 00:44:16.374647 2026] [:error] [pid 16829:tid 16857] [client 20.123.25.77:62279] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aYdr4AQFls00VxRngXucWgAAAVA"]
[Sun Feb 08 00:44:17.425119 2026] [:error] [pid 46302:tid 46354] [client 20.123.25.77:59736] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aYdr4eLz0c8aDYK5YhbEkgAAAQQ"]
[Sun Feb 08 00:44:18.178003 2026] [:error] [pid 17001:tid 17021] [client 20.123.25.77:62278] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aYdr4t0X31QDRSlPKmRfqAAAAYU"]
[Sun Feb 08 00:44:18.848210 2026] [:error] [pid 17001:tid 17031] [client 20.123.25.77:60752] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aYdr4t0X31QDRSlPKmRfrQAAAY8"]
[Sun Feb 08 00:44:19.468708 2026] [:error] [pid 46302:tid 46368] [client 20.123.25.77:61424] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aYdr4-Lz0c8aDYK5YhbEmAAAARE"]
[Sun Feb 08 00:44:20.038339 2026] [:error] [pid 46302:tid 46352] [client 20.123.25.77:59679] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aYdr5OLz0c8aDYK5YhbEmgAAAQI"]
[Sun Feb 08 00:44:21.007566 2026] [:error] [pid 62341:tid 62403] [client 20.123.25.77:61313] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aYdr5Z-t2yekx5OosV4bIAAAAEE"]
[Sun Feb 08 00:44:21.642158 2026] [:error] [pid 62342:tid 62449] [client 20.123.25.77:60698] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aYdr5ewzANoqjscwU_66BwAAAJQ"]
[Sun Feb 08 00:44:22.809950 2026] [:error] [pid 62340:tid 62396] [client 20.123.25.77:57517] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aYdr5gp6H49g9bqshit-lAAAABU"]
[Sun Feb 08 00:44:23.348783 2026] [:error] [pid 16829:tid 16849] [client 20.123.25.77:61388] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aYdr5wQFls00VxRngXucYgAAAUg"]
[Sun Feb 08 00:44:23.895614 2026] [:error] [pid 16829:tid 16852] [client 20.123.25.77:61429] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aYdr5wQFls00VxRngXucYwAAAUs"]
[Sun Feb 08 00:44:24.443804 2026] [:error] [pid 16829:tid 16843] [client 20.123.25.77:61322] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aYdr6AQFls00VxRngXucZgAAAUI"]
[Sun Feb 08 00:44:24.982811 2026] [:error] [pid 16829:tid 16847] [client 20.123.25.77:58104] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aYdr6AQFls00VxRngXucagAAAUY"]
[Sun Feb 08 00:44:25.512563 2026] [:error] [pid 62340:tid 62380] [client 20.123.25.77:60227] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aYdr6Qp6H49g9bqshit-lgAAAAU"]
[Sun Feb 08 00:44:26.129786 2026] [:error] [pid 17001:tid 17023] [client 20.123.25.77:60785] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aYdr6t0X31QDRSlPKmRfxgAAAYc"]
[Sun Feb 08 00:44:26.877465 2026] [:error] [pid 46302:tid 46371] [client 20.123.25.77:60720] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aYdr6uLz0c8aDYK5YhbEpgAAARQ"]
[Sun Feb 08 00:44:27.437474 2026] [:error] [pid 17001:tid 17030] [client 20.123.25.77:61375] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aYdr690X31QDRSlPKmRfyQAAAY4"]
[Sun Feb 08 00:44:28.098384 2026] [:error] [pid 62341:tid 62409] [client 20.123.25.77:59688] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aYdr7J-t2yekx5OosV4bLgAAAEc"]
[Sun Feb 08 00:44:28.784479 2026] [:error] [pid 17001:tid 17022] [client 20.123.25.77:60745] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aYdr7N0X31QDRSlPKmRf0gAAAYY"]
[Sun Feb 08 00:44:29.351644 2026] [:error] [pid 62342:tid 62436] [client 20.123.25.77:62295] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aYdr7ewzANoqjscwU_66FAAAAIc"]
[Sun Feb 08 00:44:30.099366 2026] [:error] [pid 16829:tid 16842] [client 20.123.25.77:61351] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aYdr7gQFls00VxRngXucdwAAAUE"]
[Sun Feb 08 00:44:31.104861 2026] [:error] [pid 46302:tid 46368] [client 20.123.25.77:60271] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aYdr7-Lz0c8aDYK5YhbEtQAAARE"]
[Sun Feb 08 00:44:31.714640 2026] [:error] [pid 46302:tid 46371] [client 20.123.25.77:61373] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aYdr7-Lz0c8aDYK5YhbEuAAAARQ"]
[Sun Feb 08 00:44:32.323618 2026] [:error] [pid 62342:tid 62431] [client 20.123.25.77:62213] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aYdr8OwzANoqjscwU_66HgAAAII"]
[Sun Feb 08 00:44:32.869924 2026] [:error] [pid 62641:tid 62653] [client 20.123.25.77:61352] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aYdr8C_seVuUK_C4AppcMgAAAMo"]
[Sun Feb 08 00:44:33.567154 2026] [:error] [pid 62341:tid 62406] [client 20.123.25.77:60718] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aYdr8Z-t2yekx5OosV4bNQAAAEQ"]
[Sun Feb 08 00:44:34.271487 2026] [:error] [pid 62342:tid 62438] [client 20.123.25.77:60272] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aYdr8uwzANoqjscwU_66IQAAAIk"]
[Sun Feb 08 00:44:35.136017 2026] [:error] [pid 17001:tid 17027] [client 20.123.25.77:60738] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aYdr890X31QDRSlPKmRf4gAAAYs"]
[Sun Feb 08 00:44:36.319408 2026] [:error] [pid 17001:tid 17016] [client 20.123.25.77:62269] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aYdr9N0X31QDRSlPKmRf6wAAAYA"]
[Sun Feb 08 00:44:37.047091 2026] [:error] [pid 62641:tid 62658] [client 20.123.25.77:62754] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aYdr9S_seVuUK_C4AppcNgAAAM8"]
[Sun Feb 08 00:44:38.076020 2026] [:error] [pid 62641:tid 62645] [client 20.123.25.77:61385] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aYdr9i_seVuUK_C4AppcPgAAAMI"]
[Sun Feb 08 00:44:38.782155 2026] [:error] [pid 17001:tid 17018] [client 20.123.25.77:62249] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aYdr9t0X31QDRSlPKmRf8wAAAYI"]
[Sun Feb 08 00:44:39.530878 2026] [:error] [pid 62641:tid 62661] [client 20.123.25.77:60226] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aYdr9y_seVuUK_C4AppcQAAAANI"]
[Sun Feb 08 00:44:40.148246 2026] [:error] [pid 17001:tid 17028] [client 20.123.25.77:62227] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aYdr-N0X31QDRSlPKmRf-wAAAYw"]
[Sun Feb 08 00:44:40.950763 2026] [:error] [pid 62340:tid 62384] [client 20.123.25.77:60257] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aYdr-Ap6H49g9bqshit-oQAAAAk"]
[Sun Feb 08 00:44:41.707248 2026] [:error] [pid 62340:tid 62375] [client 20.123.25.77:60793] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aYdr-Qp6H49g9bqshit-pQAAAAA"]
[Sun Feb 08 00:44:42.532394 2026] [:error] [pid 62342:tid 62440] [client 20.123.25.77:60756] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aYdr-uwzANoqjscwU_66JgAAAIs"]
[Sun Feb 08 00:44:43.238261 2026] [:error] [pid 46302:tid 46354] [client 20.123.25.77:61403] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aYdr--Lz0c8aDYK5YhbEwwAAAQQ"]
[Sun Feb 08 00:44:43.921485 2026] [:error] [pid 62341:tid 62426] [client 20.123.25.77:62271] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aYdr-5-t2yekx5OosV4bSAAAAFg"]
[Sun Feb 08 00:44:44.618865 2026] [:error] [pid 62641:tid 62659] [client 20.123.25.77:60261] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aYdr_C_seVuUK_C4AppcRQAAANA"]
[Sun Feb 08 00:44:46.939861 2026] [:error] [pid 17001:tid 17023] [client 20.123.25.77:61404] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aYdr_t0X31QDRSlPKmRgBgAAAYc"]
[Sun Feb 08 00:44:48.141537 2026] [:error] [pid 62341:tid 62424] [client 20.123.25.77:60243] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aYdsAJ-t2yekx5OosV4bUQAAAFY"]
[Sun Feb 08 00:44:48.918896 2026] [:error] [pid 62641:tid 62647] [client 20.123.25.77:62769] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aYdsAC_seVuUK_C4AppcSwAAAMQ"]
[Sun Feb 08 00:44:49.760448 2026] [:error] [pid 62641:tid 62660] [client 20.123.25.77:62305] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aYdsAS_seVuUK_C4AppcTQAAANE"]
[Sun Feb 08 00:44:50.437563 2026] [:error] [pid 62342:tid 62430] [client 20.123.25.77:59697] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aYdsAuwzANoqjscwU_66MAAAAIE"]
[Sun Feb 08 00:44:51.309444 2026] [:error] [pid 62342:tid 62444] [client 20.123.25.77:59449] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aYdsA-wzANoqjscwU_66MwAAAI8"]
[Sun Feb 08 00:44:52.364917 2026] [:error] [pid 46302:tid 46365] [client 20.123.25.77:59418] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aYdsBOLz0c8aDYK5YhbEzwAAAQ4"]
[Sun Feb 08 00:44:53.459793 2026] [:error] [pid 17001:tid 17024] [client 20.123.25.77:60723] [client 20.123.25.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aYdsBd0X31QDRSlPKmRgDQAAAYg"]
[Sun Feb 08 00:44:54.603050 2026] [:error] [pid 62641:tid 62657] [client 20.123.25.77:62246] [client 20.123.25.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/upload.php"] [unique_id "aYdsBi_seVuUK_C4AppcVgAAAM4"]
[Sun Feb 08 00:44:56.434494 2026] [:error] [pid 62342:tid 62435] [client 20.123.25.77:62768] File does not exist: /usr/local/apache/htdocs/suspended-page/dapa.php
[Sun Feb 08 03:35:30.244975 2026] [:error] [pid 16509:tid 16595] [client 172.213.144.187:15341] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aYeUAu_saLSx60Yt3JuNlAAAAAk"]
[Sun Feb 08 03:35:30.710264 2026] [:error] [pid 16509:tid 16597] [client 172.213.144.187:15327] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aYeUAu_saLSx60Yt3JuNlQAAAAs"]
[Sun Feb 08 03:35:31.175463 2026] [:error] [pid 16509:tid 16598] [client 172.213.144.187:15357] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aYeUA-_saLSx60Yt3JuNlwAAAAw"]
[Sun Feb 08 03:35:31.641842 2026] [:error] [pid 16509:tid 16600] [client 172.213.144.187:15353] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aYeUA-_saLSx60Yt3JuNmAAAAA4"]
[Sun Feb 08 03:35:32.107311 2026] [:error] [pid 16510:tid 16627] [client 172.213.144.187:15299] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aYeUBOXpWuo62UOvgMUYHwAAAEI"]
[Sun Feb 08 03:35:32.572910 2026] [:error] [pid 16510:tid 16631] [client 172.213.144.187:15243] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aYeUBOXpWuo62UOvgMUYIQAAAEY"]
[Sun Feb 08 03:35:33.037780 2026] [:error] [pid 16510:tid 16634] [client 172.213.144.187:15316] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aYeUBeXpWuo62UOvgMUYJAAAAEk"]
[Sun Feb 08 03:35:33.504289 2026] [:error] [pid 16510:tid 16635] [client 172.213.144.187:15342] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aYeUBeXpWuo62UOvgMUYJQAAAEo"]
[Sun Feb 08 03:35:33.970275 2026] [:error] [pid 16510:tid 16637] [client 172.213.144.187:15318] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/;k.php"] [unique_id "aYeUBeXpWuo62UOvgMUYKAAAAEw"]
[Sun Feb 08 03:35:34.437170 2026] [:error] [pid 16510:tid 16638] [client 172.213.144.187:15235] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/;k.php"] [unique_id "aYeUBuXpWuo62UOvgMUYKQAAAE0"]
[Sun Feb 08 03:35:34.906595 2026] [:error] [pid 16510:tid 16641] [client 172.213.144.187:15343] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/;k.php"] [unique_id "aYeUBuXpWuo62UOvgMUYKgAAAFA"]
[Sun Feb 08 03:35:35.383615 2026] [:error] [pid 16510:tid 16642] [client 172.213.144.187:15232] [client 172.213.144.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/;k.php"] [unique_id "aYeUB-XpWuo62UOvgMUYKwAAAFE"]
[Sun Feb 08 04:25:36.888948 2026] [:error] [pid 24422:tid 24476] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/x9.php
[Sun Feb 08 04:25:37.128397 2026] [:error] [pid 24422:tid 24473] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sun Feb 08 04:25:37.372979 2026] [:error] [pid 24422:tid 24471] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/byel.php
[Sun Feb 08 04:25:37.612158 2026] [:error] [pid 24422:tid 24459] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/layou.php
[Sun Feb 08 04:25:37.856016 2026] [:error] [pid 24422:tid 24478] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/lgsts.php
[Sun Feb 08 04:25:38.105488 2026] [:error] [pid 24422:tid 24469] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/tourpa.php
[Sun Feb 08 04:25:38.343818 2026] [:error] [pid 24422:tid 24481] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/yvtuizub.php
[Sun Feb 08 04:25:38.584896 2026] [:error] [pid 24422:tid 24470] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/mln.php
[Sun Feb 08 04:25:38.823276 2026] [:error] [pid 24422:tid 24462] [client 20.43.35.7:27592] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Sun Feb 08 08:52:26.400873 2026] [:error] [pid 24422:tid 24480] [client 20.238.51.51:36176] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sun Feb 08 08:52:26.653769 2026] [:error] [pid 24422:tid 24471] [client 20.238.51.51:36176] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Sun Feb 08 08:52:26.906477 2026] [:error] [pid 24422:tid 24462] [client 20.238.51.51:36176] File does not exist: /usr/local/apache/htdocs/suspended-page/;k.php
[Sun Feb 08 08:57:31.781483 2026] [:error] [pid 24530:tid 24554] [client 177.203.145.75:52497] [client 177.203.145.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.203.145.75, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYffe0azNRCs1GRWrh4_LQAAANY"]
[Sun Feb 08 08:57:31.785813 2026] [:error] [pid 24530:tid 24554] [client 177.203.145.75:52497] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Feb 08 09:05:29.865390 2026] [:error] [pid 24421:tid 24445] [client 143.198.90.232:49809] [client 143.198.90.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.90.232, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYfhWap7cTzhX5M1IP951QAAAA4"]
[Sun Feb 08 09:05:29.872417 2026] [:error] [pid 24421:tid 24445] [client 143.198.90.232:49809] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Feb 08 09:05:31.784592 2026] [:error] [pid 24421:tid 24445] [client 143.198.90.232:49809] [client 143.198.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aYfhW6p7cTzhX5M1IP955AAAAA4"]
[Sun Feb 08 09:05:32.126120 2026] [:error] [pid 24422:tid 24463] [client 143.198.90.232:50252] [client 143.198.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aYfhXCNNjcLoSCLKhTfaiwAAAEU"]
[Sun Feb 08 09:05:32.466329 2026] [:error] [pid 24423:tid 24507] [client 143.198.90.232:50303] [client 143.198.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aYfhXE3f9n1Y0TpV5YbMlAAAAJY"]
[Sun Feb 08 09:23:44.682841 2026] [:error] [pid 24423:tid 24506] [client 54.90.128.13:49620] [client 54.90.128.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aYfloE3f9n1Y0TpV5YbTbwAAAJU"]
[Sun Feb 08 09:23:45.742515 2026] [:error] [pid 56906:tid 56930] [client 54.90.128.13:49624] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sun Feb 08 09:23:51.564024 2026] [:error] [pid 24530:tid 24555] [client 54.90.128.13:57732] [client 54.90.128.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aYflp0azNRCs1GRWrh5IVwAAANc"]
[Sun Feb 08 16:00:43.641195 2026] [:error] [pid 24530:tid 24537] [client 217.77.10.74:64347] [client 217.77.10.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aYhCq0azNRCs1GRWrh7ezgAAAMU"]
[Sun Feb 08 20:02:20.482942 2026] [:error] [pid 56906:tid 56924] [client 20.48.253.154:31749] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sun Feb 08 20:02:20.691637 2026] [:error] [pid 56906:tid 56915] [client 20.48.253.154:31749] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Sun Feb 08 20:02:20.899831 2026] [:error] [pid 56906:tid 56931] [client 20.48.253.154:31749] File does not exist: /usr/local/apache/htdocs/suspended-page/;k.php
[Mon Feb 09 08:33:55.619868 2026] [:error] [pid 60679:tid 60772] [client 170.64.136.134:40890] [client 170.64.136.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYkrc8ixhoT1e6Iv6g9eVAAAA1Q"]
[Mon Feb 09 08:33:55.925390 2026] [:error] [pid 18303:tid 18323] [client 170.64.136.134:34986] [client 170.64.136.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYkrc0Y7TEaZkFrGG4kbowAAARI"]
[Mon Feb 09 08:51:33.379552 2026] [:error] [pid 60619:tid 60658] [client 170.64.136.134:39428] [client 170.64.136.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYkvlXEpg0UoeR8kJ-2MpAAAAks"]
[Mon Feb 09 08:51:33.459396 2026] [:error] [pid 60679:tid 60754] [client 170.64.136.134:55904] [client 170.64.136.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYkvlcixhoT1e6Iv6g9jFwAAA0w"]
[Mon Feb 09 16:19:59.492372 2026] [:error] [pid 60619:tid 60663] [client 170.64.136.134:49380] [client 170.64.136.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYmYr3Epg0UoeR8kJ-0L8AAAAk0"]
[Mon Feb 09 16:19:59.572671 2026] [:error] [pid 60589:tid 60609] [client 170.64.136.134:36878] [client 170.64.136.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYmYrzIJyhPWC0JyMLxZqAAAAdI"]
[Mon Feb 09 20:45:24.270218 2026] [:error] [pid 60619:tid 60647] [client 103.69.29.164:58873] [client 103.69.29.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.29.164, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aYnW5HEpg0UoeR8kJ-1JaAAAAkY"]
[Mon Feb 09 20:45:24.274510 2026] [:error] [pid 60619:tid 60647] [client 103.69.29.164:58873] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Feb 10 02:07:44.061611 2026] [:error] [pid 34045:tid 34082] [client 167.86.83.231:52088] [client 167.86.83.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aYoicLYAPRwerv9YrkOYOAAAAEY"], referer: binance.com
[Tue Feb 10 02:07:49.757955 2026] [:error] [pid 34045:tid 34088] [client 167.86.83.231:63412] [client 167.86.83.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aYoidbYAPRwerv9YrkOYPwAAAEw"], referer: binance.com
[Tue Feb 10 12:11:29.172888 2026] [:error] [pid 59407:tid 59423] [client 170.64.207.74:48936] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYqv8WLlhBXE3qmX-JmqxwAAAU4"]
[Tue Feb 10 12:11:29.241147 2026] [:error] [pid 59544:tid 59562] [client 170.64.207.74:55336] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYqv8aZySR9mFY4Bail7sQAAAY4"]
[Tue Feb 10 12:32:17.867103 2026] [:error] [pid 7704:tid 7725] [client 170.64.207.74:34676] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYq00f0EcqgVBUs6CW2u_AAAAdI"]
[Tue Feb 10 12:32:22.936140 2026] [:error] [pid 47830:tid 47864] [client 170.64.207.74:36436] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYq01kco45BZs8e301DhFAAAABI"]
[Tue Feb 10 16:07:18.026287 2026] [:error] [pid 47830:tid 47857] [client 170.64.207.74:49970] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYrnNkco45BZs8e301AvmQAAAAs"]
[Tue Feb 10 16:07:18.139711 2026] [:error] [pid 47831:tid 47894] [client 170.64.207.74:36660] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYrnNidxbZYarWVkiAAbOwAAAFU"]
[Tue Feb 10 16:48:36.400743 2026] [:error] [pid 30054:tid 30069] [client 170.64.207.74:51382] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYrw5GecgOOXCu-GgYULBgAAAQ0"]
[Tue Feb 10 16:48:36.735886 2026] [:error] [pid 47830:tid 47855] [client 170.64.207.74:34268] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYrw5Eco45BZs8e301A8KgAAAAk"]
[Tue Feb 10 17:10:29.203430 2026] [:error] [pid 7704:tid 7728] [client 170.64.207.74:57646] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYr2Bf0EcqgVBUs6CW3vawAAAdU"]
[Tue Feb 10 17:10:31.094137 2026] [:error] [pid 47837:tid 47914] [client 170.64.207.74:34812] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYr2B3FY8KYFPX79Z4m3xwAAAI4"]
[Tue Feb 10 19:34:31.492468 2026] [:error] [pid 47937:tid 47957] [client 170.64.207.74:40100] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYsXx8pqXpC2CvJ3fOOlJQAAANI"]
[Tue Feb 10 19:34:37.352287 2026] [:error] [pid 47937:tid 47961] [client 170.64.207.74:54372] [client 170.64.207.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYsXzcpqXpC2CvJ3fOOlLAAAANY"]
[Wed Feb 11 02:21:23.889191 2026] [:error] [pid 14804:tid 14953] [client 209.50.164.105:54515] [client 209.50.164.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aYt3I4L4gbfzj8YFRVpDLgAAAYk"]
[Wed Feb 11 02:21:28.136365 2026] [:error] [pid 14803:tid 14928] [client 209.50.169.232:42561] [client 209.50.169.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aYt3KLwzY9_NIasL_OXcRAAAAQs"]
[Wed Feb 11 02:21:30.489717 2026] [:error] [pid 46635:tid 46640] [client 209.50.177.250:64195] [client 209.50.177.250] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aYt3KksK6EAyFtFakLpT7gAAAEM"]
[Wed Feb 11 02:21:33.574217 2026] [:error] [pid 14804:tid 14960] [client 65.111.14.61:37005] [client 65.111.14.61] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aYt3LYL4gbfzj8YFRVpDOwAAAZA"]
[Wed Feb 11 02:21:34.679310 2026] [:error] [pid 46779:tid 46841] [client 216.26.228.98:57465] [client 216.26.228.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aYt3LtZrCpVdS6yMMkdiYAAAAI0"]
[Wed Feb 11 02:21:37.336732 2026] [:error] [pid 46635:tid 46637] [client 65.111.27.239:10491] [client 65.111.27.239] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "aYt3MUsK6EAyFtFakLpT9gAAAEA"]
[Wed Feb 11 02:21:38.825897 2026] [:error] [pid 14802:tid 14894] [client 104.207.52.211:48565] [client 104.207.52.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "aYt3MiallVxgXDlFFibXkwAAAMU"]
[Wed Feb 11 02:21:41.201253 2026] [:error] [pid 46635:tid 46649] [client 104.207.60.97:54307] [client 104.207.60.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "aYt3NUsK6EAyFtFakLpT-wAAAEw"]
[Wed Feb 11 02:21:42.143525 2026] [:error] [pid 46525:tid 46595] [client 209.50.179.60:36165] [client 209.50.179.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env"] [unique_id "aYt3NglEqQj0Mpse0PlNqwAAABY"]
[Wed Feb 11 02:21:44.242290 2026] [:error] [pid 14802:tid 14899] [client 209.50.178.32:20257] [client 209.50.178.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env"] [unique_id "aYt3OCallVxgXDlFFibXmAAAAMo"]
[Wed Feb 11 02:21:45.187134 2026] [:error] [pid 46635:tid 46652] [client 209.50.163.157:53201] [client 209.50.163.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aYt3OUsK6EAyFtFakLpUAAAAAE8"]
[Wed Feb 11 02:21:47.440882 2026] [:error] [pid 46635:tid 46656] [client 104.207.36.165:61217] [client 104.207.36.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "aYt3O0sK6EAyFtFakLpUAwAAAFM"]
[Wed Feb 11 02:21:48.335119 2026] [:error] [pid 14802:tid 14910] [client 104.207.42.242:9485] [client 104.207.42.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "aYt3PCallVxgXDlFFibXnQAAANU"]
[Wed Feb 11 02:21:50.334187 2026] [:error] [pid 46525:tid 46584] [client 45.3.54.92:12449] [client 45.3.54.92] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "aYt3PglEqQj0Mpse0PlNtQAAAAs"]
[Wed Feb 11 02:21:51.638607 2026] [:error] [pid 46779:tid 46828] [client 65.111.25.107:9161] [client 65.111.25.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backend/.env"] [unique_id "aYt3P9ZrCpVdS6yMMkdigQAAAII"]
[Wed Feb 11 02:21:54.737213 2026] [:error] [pid 14803:tid 14918] [client 216.26.235.198:57713] [client 216.26.235.198] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backend/.env"] [unique_id "aYt3QrwzY9_NIasL_OXcXwAAAQE"]
[Wed Feb 11 02:21:56.656466 2026] [:error] [pid 46525:tid 46585] [client 104.207.63.60:17889] [client 104.207.63.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/frontend/.env"] [unique_id "aYt3RAlEqQj0Mpse0PlNtgAAAAw"]
[Wed Feb 11 02:21:59.833732 2026] [:error] [pid 14803:tid 14927] [client 65.111.1.144:59935] [client 65.111.1.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/frontend/.env"] [unique_id "aYt3R7wzY9_NIasL_OXcZAAAAQo"]
[Wed Feb 11 02:22:01.559853 2026] [:error] [pid 14804:tid 14963] [client 104.207.39.15:25077] [client 104.207.39.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aYt3SYL4gbfzj8YFRVpDUwAAAZM"]
[Wed Feb 11 02:22:06.181646 2026] [:error] [pid 46525:tid 46576] [client 45.3.36.39:47745] [client 45.3.36.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "aYt3TglEqQj0Mpse0PlNvwAAAAM"]
[Wed Feb 11 02:22:07.107659 2026] [:error] [pid 14803:tid 14922] [client 216.26.229.225:62707] [client 216.26.229.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aYt3T7wzY9_NIasL_OXcaQAAAQU"]
[Wed Feb 11 02:22:09.590521 2026] [:error] [pid 14804:tid 14960] [client 154.213.160.250:16423] [client 154.213.160.250] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "aYt3UYL4gbfzj8YFRVpDVQAAAZA"]
[Wed Feb 11 02:22:11.425794 2026] [:error] [pid 46779:tid 46828] [client 45.3.55.161:15425] [client 45.3.55.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYt3U9ZrCpVdS6yMMkdijwAAAII"]
[Wed Feb 11 02:22:13.492267 2026] [:error] [pid 14802:tid 14910] [client 104.207.60.222:28383] [client 104.207.60.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYt3VSallVxgXDlFFibXrQAAANU"]
[Wed Feb 11 02:22:14.427209 2026] [:error] [pid 14803:tid 14937] [client 209.50.166.142:21051] [client 209.50.166.142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/dev/.git/config"] [unique_id "aYt3VrwzY9_NIasL_OXccgAAARQ"]
[Wed Feb 11 02:22:16.807252 2026] [:error] [pid 14802:tid 14912] [client 104.207.44.131:16635] [client 104.207.44.131] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/dev/.git/config"] [unique_id "aYt3WCallVxgXDlFFibXsgAAANc"]
[Wed Feb 11 02:22:17.733079 2026] [:error] [pid 15011:tid 15014] [client 209.50.176.226:15453] [client 209.50.176.226] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.git/config"] [unique_id "aYt3WV-gTNLV94AtLrgDxwAAAcE"]
[Wed Feb 11 02:22:19.902053 2026] [:error] [pid 46779:tid 46833] [client 216.26.241.1:51657] [client 216.26.241.1] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.git/config"] [unique_id "aYt3W9ZrCpVdS6yMMkdilQAAAIY"]
[Wed Feb 11 02:22:20.799943 2026] [:error] [pid 15011:tid 15036] [client 104.207.34.108:56937] [client 104.207.34.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v2/.git/config"] [unique_id "aYt3XF-gTNLV94AtLrgDywAAAdc"]
[Wed Feb 11 02:22:22.854185 2026] [:error] [pid 14804:tid 14953] [client 209.50.167.177:13575] [client 209.50.167.177] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/v2/.git/config"] [unique_id "aYt3XoL4gbfzj8YFRVpDXwAAAYk"]
[Wed Feb 11 02:22:24.109968 2026] [:error] [pid 46779:tid 46837] [client 209.50.180.229:20259] [client 209.50.180.229] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp/.git/config"] [unique_id "aYt3YNZrCpVdS6yMMkdimgAAAIk"]
[Wed Feb 11 02:22:26.146652 2026] [:error] [pid 46779:tid 46834] [client 65.111.7.132:56099] [client 65.111.7.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/wp/.git/config"] [unique_id "aYt3YtZrCpVdS6yMMkdioAAAAIc"]
[Wed Feb 11 02:22:27.080694 2026] [:error] [pid 15011:tid 15023] [client 45.3.47.30:45885] [client 45.3.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/test/.git/config"] [unique_id "aYt3Y1-gTNLV94AtLrgD0AAAAco"]
[Wed Feb 11 02:22:30.918330 2026] [:error] [pid 46525:tid 46589] [client 104.167.25.239:47565] [client 104.167.25.239] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/test/.git/config"] [unique_id "aYt3ZglEqQj0Mpse0PlN1gAAABA"]
[Wed Feb 11 02:22:31.870268 2026] [:error] [pid 14803:tid 14937] [client 45.3.62.15:39539] [client 45.3.62.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.git/config"] [unique_id "aYt3Z7wzY9_NIasL_OXcfgAAARQ"]
[Wed Feb 11 02:22:34.524330 2026] [:error] [pid 14802:tid 14906] [client 154.213.161.178:10641] [client 154.213.161.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.git/config"] [unique_id "aYt3aiallVxgXDlFFibXwAAAANE"]
[Wed Feb 11 02:22:35.799906 2026] [:error] [pid 14803:tid 14932] [client 104.207.41.238:18865] [client 104.207.41.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backup/.git/config"] [unique_id "aYt3a7wzY9_NIasL_OXcgwAAAQ8"]
[Wed Feb 11 02:22:38.725837 2026] [:error] [pid 14803:tid 14918] [client 45.3.46.240:35445] [client 45.3.46.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backup/.git/config"] [unique_id "aYt3brwzY9_NIasL_OXchgAAAQE"]
[Wed Feb 11 02:22:39.786096 2026] [:error] [pid 46635:tid 46637] [client 65.111.24.235:63803] [client 65.111.24.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/site/.git/config"] [unique_id "aYt3b0sK6EAyFtFakLpUNQAAAEA"]
[Wed Feb 11 02:22:41.943589 2026] [:error] [pid 14803:tid 14924] [client 104.207.56.84:13541] [client 104.207.56.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/site/.git/config"] [unique_id "aYt3cbwzY9_NIasL_OXchwAAAQc"]
[Wed Feb 11 02:22:44.659162 2026] [:error] [pid 46635:tid 46639] [client 45.3.40.56:52429] [client 45.3.40.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.git/config"] [unique_id "aYt3dEsK6EAyFtFakLpUPgAAAEI"]
[Wed Feb 11 02:22:45.576334 2026] [:error] [pid 14803:tid 14938] [client 209.50.176.20:36735] [client 209.50.176.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/new/.git/config"] [unique_id "aYt3dbwzY9_NIasL_OXcjgAAARU"]
[Wed Feb 11 02:22:48.275274 2026] [:error] [pid 46525:tid 46584] [client 104.207.62.194:33729] [client 104.207.62.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/new/.git/config"] [unique_id "aYt3eAlEqQj0Mpse0PlN6AAAAAs"]
[Wed Feb 11 06:20:43.215282 2026] [:error] [pid 17401:tid 17416] [client 217.77.10.74:65106] [client 217.77.10.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aYuvOw0lHeayTY40t36mnQAAAQ0"]
[Wed Feb 11 18:39:07.481796 2026] [:error] [pid 27964:tid 27989] [client 104.131.171.243:60216] [client 104.131.171.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYxcS8p0XgWYHLcQtEi_RQAAAA4"]
[Wed Feb 11 18:39:11.007301 2026] [:error] [pid 27966:tid 28049] [client 104.131.171.243:37896] [client 104.131.171.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aYxcT18HJ9ydyf0SPu6cFAAAAJM"]
[Wed Feb 11 21:50:14.897809 2026] [:error] [pid 28073:tid 28078] [client 145.239.10.137:44657] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php, referer: http://aoswa.com.au/2.php
[Wed Feb 11 22:05:39.210629 2026] [:error] [pid 27966:tid 28030] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Feb 11 22:05:39.464154 2026] [:error] [pid 27966:tid 28044] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/.info.php
[Wed Feb 11 22:05:39.717500 2026] [:error] [pid 27966:tid 28039] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Wed Feb 11 22:05:39.971140 2026] [:error] [pid 27966:tid 28045] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Feb 11 22:05:40.230762 2026] [:error] [pid 27966:tid 28049] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Feb 11 22:05:40.485016 2026] [:error] [pid 27966:tid 28037] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Wed Feb 11 22:05:40.738165 2026] [:error] [pid 27966:tid 28052] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Feb 11 22:05:40.991614 2026] [:error] [pid 27966:tid 28050] [client 20.107.195.240:19257] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 12 02:15:29.039767 2026] [:error] [pid 49095:tid 49160] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Feb 12 02:15:29.283718 2026] [:error] [pid 49095:tid 49174] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/.info.php
[Thu Feb 12 02:15:29.523682 2026] [:error] [pid 49095:tid 49164] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Thu Feb 12 02:15:29.763827 2026] [:error] [pid 49095:tid 49177] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Feb 12 02:15:30.004356 2026] [:error] [pid 49095:tid 49162] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Feb 12 02:15:30.243343 2026] [:error] [pid 49095:tid 49168] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Thu Feb 12 02:15:30.482631 2026] [:error] [pid 49095:tid 49175] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Feb 12 02:15:30.722272 2026] [:error] [pid 49095:tid 49154] [client 20.203.132.38:17080] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 12 06:17:34.396568 2026] [:error] [pid 57533:tid 57576] [client 104.28.164.220:41404] [client 104.28.164.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aYz__sBMbk5EwuXt4ZfpkAAAAEE"]
[Thu Feb 12 09:05:07.782173 2026] [:error] [pid 50167:tid 50183] [client 20.107.217.133:17939] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 12 09:05:08.064520 2026] [:error] [pid 50167:tid 50176] [client 20.107.217.133:17939] File does not exist: /usr/local/apache/htdocs/suspended-page/.info.php
[Thu Feb 12 09:05:08.346421 2026] [:error] [pid 50167:tid 50178] [client 20.107.217.133:17939] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Feb 12 14:42:46.149198 2026] [:error] [pid 8824:tid 8851] [client 167.172.240.7:51894] [client 167.172.240.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY12ZvGtP-XDMTktFc1jRgAAAQ8"]
[Thu Feb 12 14:42:50.674373 2026] [:error] [pid 3188:tid 3196] [client 167.172.240.7:59636] [client 167.172.240.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY12asYMNJKHx_XKcXwf5QAAAIY"]
[Thu Feb 12 14:48:10.807000 2026] [:error] [pid 50169:tid 50242] [client 143.44.164.102:43934] [client 143.44.164.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.164.102, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aY13qrQmA2Sph23KFXCqUAAAAdA"]
[Thu Feb 12 14:48:10.812675 2026] [:error] [pid 50169:tid 50242] [client 143.44.164.102:43934] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 12 16:30:26.677192 2026] [:error] [pid 21434:tid 21499] [client 20.199.106.40:57848] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Thu Feb 12 16:30:28.092092 2026] [:error] [pid 21434:tid 21504] [client 20.199.106.40:57848] [client 20.199.106.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aY2PpAbL1v6OC5G-tE-FNAAAAcc"]
[Thu Feb 12 16:30:31.844629 2026] [:error] [pid 21431:tid 21439] [client 20.199.106.40:57889] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aY2Pp5gxKQsNF5X8gtR1xAAAAMM"]
[Thu Feb 12 16:30:33.425784 2026] [:error] [pid 21527:tid 21551] [client 20.199.106.40:57490] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aY2PqSaer9JPUXlMLuGirQAAABY"]
[Thu Feb 12 16:30:36.587293 2026] [:error] [pid 39777:tid 39791] [client 20.199.106.40:57807] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aY2PrFzexR6hGUkt5pPBZgAAAEw"]
[Thu Feb 12 16:30:39.068528 2026] [:error] [pid 39777:tid 39782] [client 20.199.106.40:57760] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aY2Pr1zexR6hGUkt5pPBawAAAEM"]
[Thu Feb 12 16:30:40.158494 2026] [:error] [pid 39777:tid 39784] [client 20.199.106.40:58155] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aY2PsFzexR6hGUkt5pPBbAAAAEU"]
[Thu Feb 12 16:30:41.111506 2026] [:error] [pid 21431:tid 21460] [client 20.199.106.40:57748] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aY2PsZgxKQsNF5X8gtR1yQAAANg"]
[Thu Feb 12 16:30:41.990633 2026] [:error] [pid 21431:tid 21439] [client 20.199.106.40:57916] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aY2PsZgxKQsNF5X8gtR1zgAAAMM"]
[Thu Feb 12 16:30:42.903565 2026] [:error] [pid 39777:tid 39790] [client 20.199.106.40:58096] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aY2PslzexR6hGUkt5pPBcAAAAEs"]
[Thu Feb 12 16:30:43.973395 2026] [:error] [pid 39777:tid 39791] [client 20.199.106.40:57913] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY2Ps1zexR6hGUkt5pPBcgAAAEw"]
[Thu Feb 12 16:30:45.676316 2026] [:error] [pid 21527:tid 21542] [client 20.199.106.40:58062] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY2PtSaer9JPUXlMLuGizAAAAA0"]
[Thu Feb 12 16:30:46.749929 2026] [:error] [pid 21527:tid 21544] [client 20.199.106.40:58073] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY2Ptiaer9JPUXlMLuGi0QAAAA8"]
[Thu Feb 12 16:30:47.441647 2026] [:error] [pid 21527:tid 21530] [client 20.199.106.40:57786] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY2Ptyaer9JPUXlMLuGi1gAAAAE"]
[Thu Feb 12 16:30:49.067377 2026] [:error] [pid 21431:tid 21459] [client 20.199.106.40:57712] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aY2PuZgxKQsNF5X8gtR12AAAANc"]
[Thu Feb 12 16:30:51.110459 2026] [:error] [pid 21431:tid 21447] [client 20.199.106.40:57505] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aY2Pu5gxKQsNF5X8gtR13wAAAMs"]
[Thu Feb 12 16:30:52.768713 2026] [:error] [pid 21433:tid 21491] [client 20.199.106.40:57744] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aY2PvNc_9AdG3uAKpzvZxAAAAZU"]
[Thu Feb 12 16:30:54.388665 2026] [:error] [pid 39777:tid 39792] [client 20.199.106.40:58089] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aY2PvlzexR6hGUkt5pPBhAAAAE0"]
[Thu Feb 12 16:30:55.280408 2026] [:error] [pid 39777:tid 39783] [client 20.199.106.40:57902] [client 20.199.106.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aY2Pv1zexR6hGUkt5pPBhgAAAEQ"]
[Thu Feb 12 16:30:56.065447 2026] [:error] [pid 21433:tid 21472] [client 20.199.106.40:57832] [client 20.199.106.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aY2PwNc_9AdG3uAKpzvZ0AAAAYI"]
[Thu Feb 12 16:30:58.172814 2026] [:error] [pid 21527:tid 21533] [client 20.199.106.40:57857] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aY2Pwiaer9JPUXlMLuGi6QAAAAQ"]
[Thu Feb 12 16:30:59.765001 2026] [:error] [pid 21434:tid 21521] [client 20.199.106.40:57777] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aY2PwwbL1v6OC5G-tE-FeQAAAdg"]
[Thu Feb 12 16:31:01.918026 2026] [:error] [pid 39777:tid 39781] [client 20.199.106.40:57782] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aY2PxVzexR6hGUkt5pPBjQAAAEI"]
[Thu Feb 12 16:31:05.958337 2026] [:error] [pid 21431:tid 21457] [client 20.199.106.40:57804] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aY2PyZgxKQsNF5X8gtR19QAAANU"]
[Thu Feb 12 16:31:08.645508 2026] [:error] [pid 21527:tid 21538] [client 20.199.106.40:57850] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aY2PzCaer9JPUXlMLuGi_QAAAAk"]
[Thu Feb 12 16:31:10.097715 2026] [:error] [pid 21527:tid 21534] [client 20.199.106.40:58071] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aY2Pziaer9JPUXlMLuGjAAAAAAU"]
[Thu Feb 12 16:31:11.289724 2026] [:error] [pid 39777:tid 39786] [client 20.199.106.40:57829] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aY2Pz1zexR6hGUkt5pPBnwAAAEc"]
[Thu Feb 12 16:31:11.941839 2026] [:error] [pid 39777:tid 39781] [client 20.199.106.40:58121] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aY2Pz1zexR6hGUkt5pPBogAAAEI"]
[Thu Feb 12 16:31:13.143653 2026] [:error] [pid 21434:tid 21504] [client 20.199.106.40:58134] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aY2P0QbL1v6OC5G-tE-FlgAAAcc"]
[Thu Feb 12 16:31:14.524802 2026] [:error] [pid 21431:tid 21451] [client 20.199.106.40:58050] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aY2P0pgxKQsNF5X8gtR2BwAAAM8"]
[Thu Feb 12 16:31:16.887997 2026] [:error] [pid 21431:tid 21448] [client 20.199.106.40:58081] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aY2P1JgxKQsNF5X8gtR2CQAAAMw"]
[Thu Feb 12 16:31:19.787142 2026] [:error] [pid 21431:tid 21456] [client 20.199.106.40:57481] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aY2P15gxKQsNF5X8gtR2FAAAANQ"]
[Thu Feb 12 16:31:21.093505 2026] [:error] [pid 21527:tid 21538] [client 20.199.106.40:58286] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aY2P2Saer9JPUXlMLuGjEgAAAAk"]
[Thu Feb 12 16:31:22.259598 2026] [:error] [pid 21431:tid 21458] [client 20.199.106.40:57799] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aY2P2pgxKQsNF5X8gtR2GQAAANY"]
[Thu Feb 12 16:31:23.430900 2026] [:error] [pid 21431:tid 21459] [client 20.199.106.40:58211] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aY2P25gxKQsNF5X8gtR2GgAAANc"]
[Thu Feb 12 16:31:24.539472 2026] [:error] [pid 21527:tid 21544] [client 20.199.106.40:57823] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "aY2P3Caer9JPUXlMLuGjGwAAAA8"]
[Thu Feb 12 16:31:25.668144 2026] [:error] [pid 39777:tid 39791] [client 20.199.106.40:57732] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aY2P3VzexR6hGUkt5pPBrAAAAEw"]
[Thu Feb 12 16:31:26.817864 2026] [:error] [pid 39777:tid 39784] [client 20.199.106.40:58224] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aY2P3lzexR6hGUkt5pPBsAAAAEU"]
[Thu Feb 12 16:31:27.594943 2026] [:error] [pid 21527:tid 21544] [client 20.199.106.40:58250] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aY2P3yaer9JPUXlMLuGjIgAAAA8"]
[Thu Feb 12 16:31:28.243051 2026] [:error] [pid 21433:tid 21473] [client 20.199.106.40:58146] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "aY2P4Nc_9AdG3uAKpzvaAwAAAYM"]
[Thu Feb 12 16:31:30.438075 2026] [:error] [pid 21434:tid 21497] [client 20.199.106.40:57809] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aY2P4gbL1v6OC5G-tE-FsQAAAcA"]
[Thu Feb 12 16:31:31.971760 2026] [:error] [pid 21431:tid 21454] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Thu Feb 12 16:31:32.251064 2026] [:error] [pid 21431:tid 21458] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Thu Feb 12 16:31:32.515303 2026] [:error] [pid 21431:tid 21443] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Thu Feb 12 16:31:32.790211 2026] [:error] [pid 21431:tid 21455] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Feb 12 16:31:33.062767 2026] [:error] [pid 21431:tid 21445] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Feb 12 16:31:33.327380 2026] [:error] [pid 21431:tid 21451] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Thu Feb 12 16:31:35.326541 2026] [:error] [pid 21431:tid 21439] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Thu Feb 12 16:31:35.591322 2026] [:error] [pid 21431:tid 21453] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/ave.php
[Thu Feb 12 16:31:35.874391 2026] [:error] [pid 21431:tid 21452] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Thu Feb 12 16:31:36.155332 2026] [:error] [pid 21431:tid 21456] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Thu Feb 12 16:31:36.440854 2026] [:error] [pid 21431:tid 21442] [client 20.199.106.40:57866] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Feb 12 16:31:36.759728 2026] [:error] [pid 21431:tid 21437] [client 20.199.106.40:57866] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aY2P6JgxKQsNF5X8gtR2LAAAAME"]
[Thu Feb 12 16:31:38.280032 2026] [:error] [pid 21431:tid 21450] [client 20.199.106.40:58215] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aY2P6pgxKQsNF5X8gtR2LgAAAM4"]
[Thu Feb 12 16:31:39.821241 2026] [:error] [pid 39777:tid 39799] [client 20.199.106.40:58195] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aY2P61zexR6hGUkt5pPBwwAAAFQ"]
[Thu Feb 12 16:31:40.508908 2026] [:error] [pid 39777:tid 39788] [client 20.199.106.40:58233] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aY2P7FzexR6hGUkt5pPBxAAAAEk"]
[Thu Feb 12 16:31:41.667163 2026] [:error] [pid 21527:tid 21545] [client 20.199.106.40:58228] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aY2P7Saer9JPUXlMLuGjOwAAABA"]
[Thu Feb 12 16:31:43.066403 2026] [:error] [pid 21527:tid 21536] [client 20.199.106.40:58054] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aY2P7yaer9JPUXlMLuGjRAAAAAc"]
[Thu Feb 12 16:31:43.851991 2026] [:error] [pid 21431:tid 21453] [client 20.199.106.40:58488] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aY2P75gxKQsNF5X8gtR2OAAAANE"]
[Thu Feb 12 16:31:44.529421 2026] [:error] [pid 21434:tid 21503] [client 20.199.106.40:57914] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aY2P8AbL1v6OC5G-tE-FzQAAAcY"]
[Thu Feb 12 16:31:45.280620 2026] [:error] [pid 21434:tid 21500] [client 20.199.106.40:57918] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aY2P8QbL1v6OC5G-tE-FzwAAAcM"]
[Thu Feb 12 16:31:46.437176 2026] [:error] [pid 21527:tid 21542] [client 20.199.106.40:58285] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aY2P8iaer9JPUXlMLuGjTgAAAA0"]
[Thu Feb 12 16:31:48.274924 2026] [:error] [pid 21433:tid 21479] [client 20.199.106.40:58477] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aY2P9Nc_9AdG3uAKpzvaOAAAAYk"]
[Thu Feb 12 16:31:49.213418 2026] [:error] [pid 21431:tid 21454] [client 20.199.106.40:58127] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aY2P9ZgxKQsNF5X8gtR2PAAAANI"]
[Thu Feb 12 16:31:49.937209 2026] [:error] [pid 21434:tid 21512] [client 20.199.106.40:57895] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2P9QbL1v6OC5G-tE-F1QAAAc8"]
[Thu Feb 12 16:31:50.511025 2026] [:error] [pid 39777:tid 39792] [client 20.199.106.40:58183] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2P9lzexR6hGUkt5pPB0AAAAE0"]
[Thu Feb 12 16:31:52.918503 2026] [:error] [pid 21527:tid 21546] [client 20.199.106.40:58216] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2P-Caer9JPUXlMLuGjWgAAABE"]
[Thu Feb 12 16:31:53.681064 2026] [:error] [pid 21527:tid 21538] [client 20.199.106.40:58522] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2P-Saer9JPUXlMLuGjYAAAAAk"]
[Thu Feb 12 16:31:54.505965 2026] [:error] [pid 21527:tid 21537] [client 20.199.106.40:58438] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aY2P-iaer9JPUXlMLuGjYgAAAAg"]
[Thu Feb 12 16:31:55.660186 2026] [:error] [pid 21431:tid 21450] [client 20.199.106.40:57917] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aY2P-5gxKQsNF5X8gtR2RAAAAM4"]
[Thu Feb 12 16:31:56.489728 2026] [:error] [pid 39777:tid 39795] [client 20.199.106.40:58473] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aY2P_FzexR6hGUkt5pPB1gAAAFA"]
[Thu Feb 12 16:31:57.376690 2026] [:error] [pid 21527:tid 21546] [client 20.199.106.40:58460] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aY2P_Saer9JPUXlMLuGjZwAAABE"]
[Thu Feb 12 16:31:58.195520 2026] [:error] [pid 39777:tid 39782] [client 20.199.106.40:58274] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY2P_lzexR6hGUkt5pPB2gAAAEM"]
[Thu Feb 12 16:31:59.240028 2026] [:error] [pid 39777:tid 39789] [client 20.199.106.40:58501] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY2P_1zexR6hGUkt5pPB3QAAAEo"]
[Thu Feb 12 16:32:00.895485 2026] [:error] [pid 21434:tid 21512] [client 20.199.106.40:58240] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY2QAAbL1v6OC5G-tE-F8wAAAc8"]
[Thu Feb 12 16:32:02.869033 2026] [:error] [pid 21433:tid 21490] [client 20.199.106.40:58061] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY2QAtc_9AdG3uAKpzvaTQAAAZQ"]
[Thu Feb 12 16:32:04.095859 2026] [:error] [pid 21431:tid 21455] [client 20.199.106.40:58113] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aY2QBJgxKQsNF5X8gtR2TAAAANM"]
[Thu Feb 12 16:32:04.977873 2026] [:error] [pid 21527:tid 21551] [client 20.199.106.40:57860] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aY2QBCaer9JPUXlMLuGjfgAAABY"]
[Thu Feb 12 16:32:06.767444 2026] [:error] [pid 21527:tid 21529] [client 20.199.106.40:57160] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aY2QBiaer9JPUXlMLuGjfwAAAAA"]
[Thu Feb 12 16:32:08.877321 2026] [:error] [pid 21527:tid 21532] [client 20.199.106.40:57858] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aY2QCCaer9JPUXlMLuGjhgAAAAM"]
[Thu Feb 12 16:32:10.884587 2026] [:error] [pid 39777:tid 39790] [client 20.199.106.40:58201] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aY2QClzexR6hGUkt5pPB7wAAAEs"]
[Thu Feb 12 16:32:12.239219 2026] [:error] [pid 21431:tid 21442] [client 20.199.106.40:58584] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aY2QDJgxKQsNF5X8gtR2WgAAAMY"]
[Thu Feb 12 16:32:15.799613 2026] [:error] [pid 21527:tid 21544] [client 20.199.106.40:58217] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aY2QDyaer9JPUXlMLuGjlwAAAA8"]
[Thu Feb 12 16:32:17.486566 2026] [:error] [pid 21431:tid 21452] [client 20.199.106.40:58589] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aY2QEZgxKQsNF5X8gtR2aAAAANA"]
[Thu Feb 12 16:32:19.348497 2026] [:error] [pid 21527:tid 21539] [client 20.199.106.40:58520] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY2QEyaer9JPUXlMLuGjoQAAAAo"]
[Thu Feb 12 16:32:21.030706 2026] [:error] [pid 21434:tid 21514] [client 20.199.106.40:58292] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY2QFQbL1v6OC5G-tE-GCAAAAdE"]
[Thu Feb 12 16:32:22.116312 2026] [:error] [pid 21434:tid 21503] [client 20.199.106.40:58169] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY2QFgbL1v6OC5G-tE-GCwAAAcY"]
[Thu Feb 12 16:32:23.141339 2026] [:error] [pid 21431:tid 21436] [client 20.199.106.40:58145] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY2QF5gxKQsNF5X8gtR2bgAAAMA"]
[Thu Feb 12 16:32:25.579197 2026] [:error] [pid 21433:tid 21480] [client 20.199.106.40:57432] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aY2QGdc_9AdG3uAKpzvaeQAAAYo"]
[Thu Feb 12 16:32:27.425529 2026] [:error] [pid 39777:tid 39787] [client 20.199.106.40:58558] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aY2QG1zexR6hGUkt5pPCCAAAAEg"]
[Thu Feb 12 16:32:28.996826 2026] [:error] [pid 21434:tid 21508] [client 20.199.106.40:58162] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aY2QHAbL1v6OC5G-tE-GEgAAAcs"]
[Thu Feb 12 16:32:30.128906 2026] [:error] [pid 21431:tid 21446] [client 20.199.106.40:58573] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aY2QHpgxKQsNF5X8gtR2cQAAAMo"]
[Thu Feb 12 16:32:31.578423 2026] [:error] [pid 21433:tid 21471] [client 20.199.106.40:58502] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aY2QH9c_9AdG3uAKpzvahwAAAYE"]
[Thu Feb 12 16:32:34.877143 2026] [:error] [pid 21431:tid 21443] [client 20.199.106.40:58459] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aY2QIpgxKQsNF5X8gtR2dAAAAMc"]
[Thu Feb 12 16:32:37.423884 2026] [:error] [pid 21434:tid 21505] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Thu Feb 12 16:32:37.666079 2026] [:error] [pid 21434:tid 21497] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Thu Feb 12 16:32:37.910783 2026] [:error] [pid 21434:tid 21513] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Thu Feb 12 16:32:38.241848 2026] [:error] [pid 21434:tid 21521] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Thu Feb 12 16:32:38.481993 2026] [:error] [pid 21434:tid 21501] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Thu Feb 12 16:32:38.733178 2026] [:error] [pid 21434:tid 21520] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Feb 12 16:32:38.972687 2026] [:error] [pid 21434:tid 21498] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Thu Feb 12 16:32:39.226288 2026] [:error] [pid 21434:tid 21504] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Thu Feb 12 16:32:39.465233 2026] [:error] [pid 21434:tid 21514] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Thu Feb 12 16:32:39.702170 2026] [:error] [pid 21434:tid 21507] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Thu Feb 12 16:32:39.940715 2026] [:error] [pid 21434:tid 21499] [client 20.199.106.40:58283] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Thu Feb 12 16:32:40.174713 2026] [:error] [pid 21434:tid 21511] [client 20.199.106.40:58283] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aY2QKAbL1v6OC5G-tE-GLgAAAc4"]
[Thu Feb 12 16:32:41.442766 2026] [:error] [pid 21527:tid 21539] [client 20.199.106.40:58262] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aY2QKSaer9JPUXlMLuGjwwAAAAo"]
[Thu Feb 12 16:32:42.677995 2026] [:error] [pid 21433:tid 21480] [client 20.199.106.40:58569] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aY2QKtc_9AdG3uAKpzvamwAAAYo"]
[Thu Feb 12 16:32:43.770523 2026] [:error] [pid 39777:tid 39792] [client 20.199.106.40:58548] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aY2QK1zexR6hGUkt5pPCFQAAAE0"]
[Thu Feb 12 16:32:45.696466 2026] [:error] [pid 39777:tid 39782] [client 20.199.106.40:58663] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aY2QLVzexR6hGUkt5pPCGQAAAEM"]
[Thu Feb 12 16:32:47.721658 2026] [:error] [pid 21527:tid 21533] [client 20.199.106.40:58638] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aY2QLyaer9JPUXlMLuGjywAAAAQ"]
[Thu Feb 12 16:32:49.023492 2026] [:error] [pid 21527:tid 21545] [client 20.199.106.40:58787] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aY2QMSaer9JPUXlMLuGj0AAAABA"]
[Thu Feb 12 16:32:50.655938 2026] [:error] [pid 21431:tid 21456] [client 20.199.106.40:58456] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aY2QMpgxKQsNF5X8gtR2jQAAANQ"]
[Thu Feb 12 16:32:52.504582 2026] [:error] [pid 21431:tid 21438] [client 20.199.106.40:58702] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aY2QNJgxKQsNF5X8gtR2kgAAAMI"]
[Thu Feb 12 16:32:54.054622 2026] [:error] [pid 21431:tid 21439] [client 20.199.106.40:58512] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aY2QNpgxKQsNF5X8gtR2lQAAAMM"]
[Thu Feb 12 16:32:56.246065 2026] [:error] [pid 39777:tid 39786] [client 20.199.106.40:58688] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aY2QOFzexR6hGUkt5pPCKgAAAEc"]
[Thu Feb 12 16:32:57.631330 2026] [:error] [pid 21433:tid 21488] [client 20.199.106.40:58665] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aY2QOdc_9AdG3uAKpzvapwAAAZI"]
[Thu Feb 12 16:32:59.182366 2026] [:error] [pid 39777:tid 39794] [client 20.199.106.40:58762] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aY2QO1zexR6hGUkt5pPCMAAAAE8"]
[Thu Feb 12 16:33:00.799983 2026] [:error] [pid 39777:tid 39783] [client 20.199.106.40:58278] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aY2QPFzexR6hGUkt5pPCNAAAAEQ"]
[Thu Feb 12 16:33:02.129813 2026] [:error] [pid 21433:tid 21480] [client 20.199.106.40:58246] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aY2QPtc_9AdG3uAKpzvarAAAAYo"]
[Thu Feb 12 16:33:03.503867 2026] [:error] [pid 21431:tid 21455] [client 20.199.106.40:58516] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aY2QP5gxKQsNF5X8gtR2owAAANM"]
[Thu Feb 12 16:33:04.494971 2026] [:error] [pid 21433:tid 21475] [client 20.199.106.40:58472] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aY2QQNc_9AdG3uAKpzvasQAAAYU"]
[Thu Feb 12 16:33:05.592596 2026] [:error] [pid 21434:tid 21515] [client 20.199.106.40:58287] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aY2QQQbL1v6OC5G-tE-GVAAAAdI"]
[Thu Feb 12 16:33:07.158122 2026] [:error] [pid 39777:tid 39793] [client 20.199.106.40:58176] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aY2QQ1zexR6hGUkt5pPCOgAAAE4"]
[Thu Feb 12 16:33:11.479440 2026] [:error] [pid 39777:tid 39784] [client 20.199.106.40:57814] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aY2QR1zexR6hGUkt5pPCRQAAAEU"]
[Thu Feb 12 16:33:14.008429 2026] [:error] [pid 21527:tid 21540] [client 20.199.106.40:58461] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aY2QSiaer9JPUXlMLuGkAwAAAAs"]
[Thu Feb 12 16:33:15.956452 2026] [:error] [pid 39777:tid 39795] [client 20.199.106.40:58931] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aY2QS1zexR6hGUkt5pPCRgAAAFA"]
[Thu Feb 12 16:33:17.051871 2026] [:error] [pid 21527:tid 21551] [client 20.199.106.40:58455] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aY2QTSaer9JPUXlMLuGkCwAAABY"]
[Thu Feb 12 16:33:19.640293 2026] [:error] [pid 21433:tid 21488] [client 20.199.106.40:58851] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aY2QT9c_9AdG3uAKpzvaxwAAAZI"]
[Thu Feb 12 16:33:21.562013 2026] [:error] [pid 21431:tid 21437] [client 20.199.106.40:58511] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aY2QUZgxKQsNF5X8gtR2tAAAAME"]
[Thu Feb 12 16:33:23.508309 2026] [:error] [pid 21527:tid 21553] [client 20.199.106.40:58800] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aY2QUyaer9JPUXlMLuGkHAAAABg"]
[Thu Feb 12 16:33:24.512200 2026] [:error] [pid 21434:tid 21511] [client 20.199.106.40:58851] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aY2QVAbL1v6OC5G-tE-GbgAAAc4"]
[Thu Feb 12 16:33:25.316936 2026] [:error] [pid 21433:tid 21471] [client 20.199.106.40:58928] [client 20.199.106.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aY2QVdc_9AdG3uAKpzva0AAAAYE"]
[Thu Feb 12 17:20:21.051105 2026] [:error] [pid 21434:tid 21508] [client 167.172.240.7:46020] [client 167.172.240.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY2bVQbL1v6OC5G-tE-cfQAAAcs"]
[Thu Feb 12 17:20:25.413403 2026] [:error] [pid 21434:tid 21513] [client 167.172.240.7:36960] [client 167.172.240.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY2bWQbL1v6OC5G-tE-ckwAAAdA"]
[Thu Feb 12 17:45:28.201049 2026] [:error] [pid 63416:tid 63435] [client 104.28.163.222:39923] [client 104.28.163.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aY2hOL2wmecPaCHcM29-1gAAAY4"]
[Thu Feb 12 18:27:43.190074 2026] [:error] [pid 63511:tid 63532] [client 51.120.70.159:49173] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 12 18:27:43.454048 2026] [:error] [pid 63511:tid 63535] [client 51.120.70.159:49173] File does not exist: /usr/local/apache/htdocs/suspended-page/.info.php
[Thu Feb 12 18:27:43.717589 2026] [:error] [pid 63511:tid 63523] [client 51.120.70.159:49173] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Feb 12 18:40:38.674100 2026] [:error] [pid 63511:tid 63536] [client 20.215.216.208:56275] File does not exist: /usr/local/apache/htdocs/suspended-page/ws66.php
[Thu Feb 12 18:40:38.932309 2026] [:error] [pid 63511:tid 63513] [client 20.215.216.208:56275] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Thu Feb 12 18:40:39.194124 2026] [:error] [pid 63511:tid 63523] [client 20.215.216.208:56275] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Feb 12 18:40:39.459558 2026] [:error] [pid 63511:tid 63534] [client 20.215.216.208:56275] File does not exist: /usr/local/apache/htdocs/suspended-page/h02ugyh.php
[Thu Feb 12 18:40:39.727590 2026] [:error] [pid 63511:tid 63531] [client 20.215.216.208:56275] [client 20.215.216.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aY2uJ6QCQbD5BgeyIk3g1gAAABI"]
[Thu Feb 12 18:40:42.242051 2026] [:error] [pid 63511:tid 63515] [client 20.215.216.208:46457] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Thu Feb 12 18:40:42.505096 2026] [:error] [pid 63511:tid 63520] [client 20.215.216.208:46457] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Thu Feb 12 18:40:42.767144 2026] [:error] [pid 63511:tid 63519] [client 20.215.216.208:46457] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Thu Feb 12 18:40:43.026879 2026] [:error] [pid 63511:tid 63521] [client 20.215.216.208:46457] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Thu Feb 12 18:40:43.285861 2026] [:error] [pid 63511:tid 63517] [client 20.215.216.208:46457] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Thu Feb 12 18:40:43.548143 2026] [:error] [pid 63511:tid 63536] [client 20.215.216.208:46457] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 12 18:40:43.815183 2026] [:error] [pid 63511:tid 63534] [client 20.215.216.208:46457] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aY2uK6QCQbD5BgeyIk3g3wAAABU"]
[Thu Feb 12 18:40:46.630830 2026] [:error] [pid 63416:tid 63432] [client 20.215.216.208:47225] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aY2uLr2wmecPaCHcM2-YGQAAAYs"]
[Thu Feb 12 18:40:48.041034 2026] [:error] [pid 63511:tid 63520] [client 20.215.216.208:54952] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aY2uMKQCQbD5BgeyIk3g5gAAAAc"]
[Thu Feb 12 18:40:49.188803 2026] [:error] [pid 63416:tid 63442] [client 20.215.216.208:1338] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aY2uMb2wmecPaCHcM2-YIAAAAZU"]
[Thu Feb 12 18:40:50.442386 2026] [:error] [pid 65064:tid 65085] [client 20.215.216.208:57560] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aY2uMhOvRgscTcqsMBmptAAAANI"]
[Thu Feb 12 18:40:51.648188 2026] [:error] [pid 65064:tid 65080] [client 20.215.216.208:47874] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aY2uMxOvRgscTcqsMBmptgAAAM0"]
[Thu Feb 12 18:40:52.910042 2026] [:error] [pid 63417:tid 63468] [client 20.215.216.208:54955] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aY2uNP8gSb97qRMtXCK4tAAAAFM"]
[Thu Feb 12 18:40:55.509817 2026] [:error] [pid 63418:tid 63479] [client 20.215.216.208:56854] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aY2uN9zjh-bbJnStPZKwyQAAAIM"]
[Thu Feb 12 18:40:57.546958 2026] [:error] [pid 63416:tid 63422] [client 20.215.216.208:59340] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aY2uOb2wmecPaCHcM2-YLQAAAYE"]
[Thu Feb 12 18:41:00.705280 2026] [:error] [pid 63417:tid 63467] [client 20.215.216.208:54311] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aY2uPP8gSb97qRMtXCK4wAAAAFI"]
[Thu Feb 12 18:41:03.402191 2026] [:error] [pid 63418:tid 63482] [client 20.215.216.208:57598] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aY2uP9zjh-bbJnStPZKw1AAAAIY"]
[Thu Feb 12 18:41:05.083280 2026] [:error] [pid 63417:tid 63458] [client 20.215.216.208:57661] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aY2uQf8gSb97qRMtXCK4yQAAAEk"]
[Thu Feb 12 18:41:07.278690 2026] [:error] [pid 63418:tid 63485] [client 20.215.216.208:1891] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aY2uQ9zjh-bbJnStPZKw2wAAAIk"]
[Thu Feb 12 18:41:08.438067 2026] [:error] [pid 65064:tid 65075] [client 20.215.216.208:1860] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aY2uRBOvRgscTcqsMBmp4QAAAMg"]
[Thu Feb 12 18:41:10.227728 2026] [:error] [pid 63418:tid 63477] [client 20.215.216.208:1898] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aY2uRtzjh-bbJnStPZKw4AAAAIE"]
[Thu Feb 12 18:41:12.285244 2026] [:error] [pid 63511:tid 63514] [client 20.215.216.208:57650] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aY2uSKQCQbD5BgeyIk3hCAAAAAE"]
[Thu Feb 12 18:41:14.819719 2026] [:error] [pid 63418:tid 63492] [client 20.215.216.208:1163] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aY2uStzjh-bbJnStPZKw6gAAAJA"]
[Thu Feb 12 18:41:16.152943 2026] [:error] [pid 65064:tid 65071] [client 20.215.216.208:1887] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aY2uTBOvRgscTcqsMBmp8wAAAMQ"]
[Thu Feb 12 18:41:18.311008 2026] [:error] [pid 65064:tid 65089] [client 20.215.216.208:59382] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aY2uThOvRgscTcqsMBmp_QAAANY"]
[Thu Feb 12 18:41:20.637906 2026] [:error] [pid 63417:tid 63455] [client 20.215.216.208:54327] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aY2uUP8gSb97qRMtXCK42AAAAEY"]
[Thu Feb 12 18:41:23.027745 2026] [:error] [pid 63416:tid 63436] [client 20.215.216.208:1797] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "aY2uU72wmecPaCHcM2-YUAAAAY8"]
[Thu Feb 12 18:41:26.920440 2026] [:error] [pid 65064:tid 65072] [client 20.215.216.208:1813] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "aY2uVhOvRgscTcqsMBmqDwAAAMU"]
[Thu Feb 12 18:41:31.567347 2026] [:error] [pid 63416:tid 63428] [client 20.215.216.208:57078] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "aY2uW72wmecPaCHcM2-YXQAAAYc"]
[Thu Feb 12 18:41:40.030970 2026] [:error] [pid 65064:tid 65080] [client 20.215.216.208:57602] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aY2uZBOvRgscTcqsMBmqLQAAAM0"]
[Thu Feb 12 18:41:41.064293 2026] [:error] [pid 63416:tid 63436] [client 20.215.216.208:57491] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aY2uZb2wmecPaCHcM2-YbQAAAY8"]
[Thu Feb 12 18:41:43.310691 2026] [:error] [pid 63416:tid 63430] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Thu Feb 12 18:41:43.568837 2026] [:error] [pid 63416:tid 63439] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Thu Feb 12 18:41:43.845627 2026] [:error] [pid 63416:tid 63443] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu Feb 12 18:41:44.106242 2026] [:error] [pid 63416:tid 63431] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Thu Feb 12 18:41:44.367713 2026] [:error] [pid 63416:tid 63440] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Thu Feb 12 18:41:44.884934 2026] [:error] [pid 63416:tid 63429] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/xxw.php
[Thu Feb 12 18:41:45.176638 2026] [:error] [pid 63416:tid 63441] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Thu Feb 12 18:41:45.442923 2026] [:error] [pid 63416:tid 63435] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/knmt.php
[Thu Feb 12 18:41:45.712425 2026] [:error] [pid 63416:tid 63422] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/bootstrap.php
[Thu Feb 12 18:41:45.969889 2026] [:error] [pid 63416:tid 63442] [client 20.215.216.208:56594] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Thu Feb 12 18:41:46.239639 2026] [:error] [pid 63416:tid 63436] [client 20.215.216.208:56594] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aY2uar2wmecPaCHcM2-YfwAAAY8"]
[Thu Feb 12 18:41:49.648716 2026] [:error] [pid 65064:tid 65069] [client 20.215.216.208:57261] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aY2ubROvRgscTcqsMBmqPAAAAMI"]
[Thu Feb 12 18:41:52.510274 2026] [:error] [pid 63416:tid 63432] [client 20.215.216.208:56629] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aY2ucL2wmecPaCHcM2-YhAAAAYs"]
[Thu Feb 12 18:41:56.309020 2026] [:error] [pid 63511:tid 63533] [client 20.215.216.208:48139] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aY2udKQCQbD5BgeyIk3hXQAAABQ"]
[Thu Feb 12 18:41:57.979306 2026] [:error] [pid 65064:tid 65078] [client 20.215.216.208:59005] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aY2udROvRgscTcqsMBmqUwAAAMs"]
[Thu Feb 12 18:41:59.807042 2026] [:error] [pid 65064:tid 65072] [client 20.215.216.208:48162] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aY2udxOvRgscTcqsMBmqVgAAAMU"]
[Thu Feb 12 18:42:01.752530 2026] [:error] [pid 63417:tid 63450] [client 20.215.216.208:55657] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aY2uef8gSb97qRMtXCK5CQAAAEE"]
[Thu Feb 12 18:42:03.961845 2026] [:error] [pid 63417:tid 63454] [client 20.215.216.208:57116] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aY2ue_8gSb97qRMtXCK5DAAAAEU"]
[Thu Feb 12 18:42:04.778925 2026] [:error] [pid 63418:tid 63488] [client 20.215.216.208:55635] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aY2ufNzjh-bbJnStPZKxJAAAAIw"]
[Thu Feb 12 18:42:05.725369 2026] [:error] [pid 63511:tid 63525] [client 20.215.216.208:1485] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aY2ufaQCQbD5BgeyIk3hcAAAAAw"]
[Thu Feb 12 18:42:07.046207 2026] [:error] [pid 63416:tid 63430] [client 20.215.216.208:56886] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aY2uf72wmecPaCHcM2-YjgAAAYk"]
[Thu Feb 12 18:42:07.902487 2026] [:error] [pid 63416:tid 63439] [client 20.215.216.208:57135] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aY2uf72wmecPaCHcM2-YlQAAAZI"]
[Thu Feb 12 18:42:09.234734 2026] [:error] [pid 65064:tid 65082] [client 20.215.216.208:58970] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aY2ugROvRgscTcqsMBmqXQAAAM8"]
[Thu Feb 12 18:42:11.195428 2026] [:error] [pid 63416:tid 63433] [client 20.215.216.208:1484] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aY2ug72wmecPaCHcM2-YnQAAAYw"]
[Thu Feb 12 18:42:13.668500 2026] [:error] [pid 63418:tid 63486] [client 20.215.216.208:46660] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aY2uhdzjh-bbJnStPZKxLgAAAIo"]
[Thu Feb 12 18:42:17.087936 2026] [:error] [pid 63417:tid 63468] [client 20.215.216.208:46699] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aY2uif8gSb97qRMtXCK5KwAAAFM"]
[Thu Feb 12 18:42:18.167445 2026] [:error] [pid 63417:tid 63450] [client 20.215.216.208:58448] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mcs.php"] [unique_id "aY2uiv8gSb97qRMtXCK5MQAAAEE"]
[Thu Feb 12 18:42:19.729317 2026] [:error] [pid 63511:tid 63534] [client 20.215.216.208:58376] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mcs.php"] [unique_id "aY2ui6QCQbD5BgeyIk3hogAAABU"]
[Thu Feb 12 18:42:21.593254 2026] [:error] [pid 63511:tid 63520] [client 20.215.216.208:56890] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mcs.php"] [unique_id "aY2ujaQCQbD5BgeyIk3hpgAAAAc"]
[Thu Feb 12 18:42:23.493088 2026] [:error] [pid 65064:tid 65078] [client 20.215.216.208:55900] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mcs.php"] [unique_id "aY2ujxOvRgscTcqsMBmqbgAAAMs"]
[Thu Feb 12 18:42:24.348459 2026] [:error] [pid 65064:tid 65074] [client 20.215.216.208:59225] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aY2ukBOvRgscTcqsMBmqcgAAAMc"]
[Thu Feb 12 18:42:25.272536 2026] [:error] [pid 65064:tid 65083] [client 20.215.216.208:58738] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aY2ukROvRgscTcqsMBmqcwAAANA"]
[Thu Feb 12 18:42:27.200415 2026] [:error] [pid 63417:tid 63449] [client 20.215.216.208:59204] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aY2uk_8gSb97qRMtXCK5SwAAAEA"]
[Thu Feb 12 18:42:30.522830 2026] [:error] [pid 63511:tid 63536] [client 20.215.216.208:50675] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aY2ulqQCQbD5BgeyIk3huAAAABc"]
[Thu Feb 12 18:42:34.869864 2026] [:error] [pid 65064:tid 65090] [client 20.215.216.208:48553] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aY2umhOvRgscTcqsMBmqjAAAANc"]
[Thu Feb 12 18:42:37.548281 2026] [:error] [pid 65064:tid 65076] [client 20.215.216.208:48529] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aY2unROvRgscTcqsMBmqjwAAAMk"]
[Thu Feb 12 18:42:38.987238 2026] [:error] [pid 63418:tid 63485] [client 20.215.216.208:1419] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aY2untzjh-bbJnStPZKxSwAAAIk"]
[Thu Feb 12 18:42:40.455353 2026] [:error] [pid 63417:tid 63453] [client 20.215.216.208:60228] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aY2uoP8gSb97qRMtXCK5egAAAEQ"]
[Thu Feb 12 18:42:44.962109 2026] [:error] [pid 63418:tid 63476] [client 20.215.216.208:56461] [client 20.215.216.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aY2upNzjh-bbJnStPZKxUQAAAIA"]
[Thu Feb 12 18:42:46.809025 2026] [:error] [pid 63416:tid 63433] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Thu Feb 12 18:42:47.081956 2026] [:error] [pid 63416:tid 63434] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Thu Feb 12 18:42:47.342755 2026] [:error] [pid 63416:tid 63423] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Thu Feb 12 18:42:47.601624 2026] [:error] [pid 63416:tid 63424] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Thu Feb 12 18:42:47.872182 2026] [:error] [pid 63416:tid 63425] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/to.php
[Thu Feb 12 18:42:48.142402 2026] [:error] [pid 63416:tid 63426] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Thu Feb 12 18:42:48.407283 2026] [:error] [pid 63416:tid 63444] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Thu Feb 12 18:42:48.675301 2026] [:error] [pid 63416:tid 63436] [client 20.215.216.208:1431] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Thu Feb 12 19:17:22.596123 2026] [:error] [pid 63416:tid 63431] [client 34.139.18.28:54147] [client 34.139.18.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.18.28, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aY22wr2wmecPaCHcM2-nBgAAAYo"]
[Thu Feb 12 19:17:22.600168 2026] [:error] [pid 63416:tid 63431] [client 34.139.18.28:54147] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 12 19:17:25.249503 2026] [:error] [pid 63416:tid 63430] [client 34.139.18.28:54147] [client 34.139.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aY22xb2wmecPaCHcM2-nFAAAAYk"]
[Thu Feb 12 19:17:25.678492 2026] [:error] [pid 63416:tid 63431] [client 34.139.18.28:63420] [client 34.139.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aY22xb2wmecPaCHcM2-nFwAAAYo"]
[Thu Feb 12 19:17:26.095466 2026] [:error] [pid 63417:tid 63453] [client 34.139.18.28:55964] [client 34.139.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aY22xv8gSb97qRMtXCLImgAAAEQ"]
[Thu Feb 12 19:17:26.521381 2026] [:error] [pid 65064:tid 65084] [client 34.139.18.28:50067] [client 34.139.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aY22xhOvRgscTcqsMBnBTwAAANE"]
[Thu Feb 12 19:17:26.998401 2026] [:error] [pid 63418:tid 63494] [client 34.139.18.28:57246] [client 34.139.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aY22xtzjh-bbJnStPZLBXwAAAJI"]
[Thu Feb 12 19:17:27.466510 2026] [:error] [pid 63418:tid 63493] [client 34.139.18.28:56722] [client 34.139.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aY22x9zjh-bbJnStPZLBYQAAAJE"]
[Thu Feb 12 22:20:08.381238 2026] [:error] [pid 63417:tid 63462] [client 188.166.224.152:64458] [client 188.166.224.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.224.152, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aY3hmP8gSb97qRMtXCID0AAAAE0"]
[Thu Feb 12 22:20:08.385171 2026] [:error] [pid 63417:tid 63462] [client 188.166.224.152:64458] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 12 22:20:09.472002 2026] [:error] [pid 63417:tid 63471] [client 188.166.224.152:64458] [client 188.166.224.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aY3hmf8gSb97qRMtXCID3AAAAFY"]
[Thu Feb 12 22:20:09.654020 2026] [:error] [pid 65064:tid 65074] [client 188.166.224.152:64735] [client 188.166.224.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aY3hmROvRgscTcqsMBkUkwAAAMc"]
[Thu Feb 12 22:20:09.831396 2026] [:error] [pid 63416:tid 63439] [client 188.166.224.152:64778] [client 188.166.224.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aY3hmb2wmecPaCHcM2_dHwAAAZI"]
[Thu Feb 12 22:28:15.122013 2026] [:error] [pid 63511:tid 63530] [client 104.207.36.84:30411] [client 104.207.36.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY3jf6QCQbD5BgeyIk05AQAAABE"]
[Thu Feb 12 22:28:16.235178 2026] [:error] [pid 46675:tid 46686] [client 65.111.10.225:60673] [client 65.111.10.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY3jgDuaQILPonWFiQmDzwAAAUg"]
[Thu Feb 12 22:46:34.656647 2026] [:error] [pid 63417:tid 63453] [client 103.77.107.222:53209] [client 103.77.107.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aY3nyv8gSb97qRMtXCIJ_AAAAEQ"]
[Fri Feb 13 00:15:21.933197 2026] [:error] [pid 46718:tid 46739] [client 104.207.39.246:60501] [client 104.207.39.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aY38mUdfX45LelQwruRmtAAAAdI"]
[Fri Feb 13 00:15:22.623330 2026] [:error] [pid 63418:tid 63481] [client 65.111.3.209:26513] [client 65.111.3.209] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aY38mtzjh-bbJnStPZIZywAAAIU"]
[Fri Feb 13 00:33:58.975436 2026] [:error] [pid 37512:tid 37634] [client 64.89.163.24:57804] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aY4A9tDe69znS-f6vSY1XQAAABc"]
[Fri Feb 13 00:34:00.268329 2026] [:error] [pid 37510:tid 37534] [client 64.89.163.24:58654] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aY4A-MUrqDPNSf1wYBWB3wAAAZI"]
[Fri Feb 13 00:34:02.236972 2026] [:error] [pid 37856:tid 37876] [client 64.89.163.24:49771] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aY4A-pUcWP4qWM7hWsnvtAAAANE"]
[Fri Feb 13 00:34:04.455174 2026] [:error] [pid 37510:tid 37538] [client 64.89.163.24:61325] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aY4A_MUrqDPNSf1wYBWCIwAAAZY"]
[Fri Feb 13 00:34:06.168827 2026] [:error] [pid 37856:tid 37874] [client 64.89.163.24:63664] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aY4A_pUcWP4qWM7hWsnv6wAAAM8"]
[Fri Feb 13 01:02:12.594739 2026] [:error] [pid 37512:tid 37616] [client 34.28.64.229:50652] [client 34.28.64.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.28.64.229, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aY4HlNDe69znS-f6vSZAuQAAAAc"]
[Fri Feb 13 01:02:12.598565 2026] [:error] [pid 37512:tid 37616] [client 34.28.64.229:50652] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 13 01:02:15.019289 2026] [:error] [pid 37512:tid 37611] [client 34.28.64.229:50652] [client 34.28.64.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aY4Hl9De69znS-f6vSZAyQAAAAM"]
[Fri Feb 13 01:02:15.422007 2026] [:error] [pid 37511:tid 37595] [client 34.28.64.229:56079] [client 34.28.64.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aY4Hl-8EBJ86uZdxpA10XAAAAE4"]
[Fri Feb 13 01:02:15.852798 2026] [:error] [pid 37512:tid 37632] [client 34.28.64.229:55497] [client 34.28.64.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aY4Hl9De69znS-f6vSZAywAAABU"]
[Fri Feb 13 01:02:16.277868 2026] [:error] [pid 23410:tid 23426] [client 34.28.64.229:52047] [client 34.28.64.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aY4HmBXZP6NFBacuW_0UxQAAAI4"]
[Fri Feb 13 01:02:16.676110 2026] [:error] [pid 37511:tid 37591] [client 34.28.64.229:63878] [client 34.28.64.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aY4HmO8EBJ86uZdxpA10YAAAAEo"]
[Fri Feb 13 01:02:17.108838 2026] [:error] [pid 37510:tid 37519] [client 34.28.64.229:52000] [client 34.28.64.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aY4HmcUrqDPNSf1wYBWNlAAAAYM"]
[Fri Feb 13 02:46:48.857837 2026] [:error] [pid 37510:tid 37535] [client 136.112.150.139:64235] [client 136.112.150.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.150.139, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aY4gGMUrqDPNSf1wYBWzKQAAAZM"]
[Fri Feb 13 02:46:48.861474 2026] [:error] [pid 37510:tid 37535] [client 136.112.150.139:64235] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 13 02:46:52.422899 2026] [:error] [pid 37510:tid 37526] [client 136.112.150.139:64235] [client 136.112.150.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aY4gHMUrqDPNSf1wYBWzNgAAAYo"]
[Fri Feb 13 02:46:52.887600 2026] [:error] [pid 23410:tid 23418] [client 136.112.150.139:58645] [client 136.112.150.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aY4gHBXZP6NFBacuW_1O4wAAAIY"]
[Fri Feb 13 02:46:53.345076 2026] [:error] [pid 37511:tid 37603] [client 136.112.150.139:53526] [client 136.112.150.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aY4gHe8EBJ86uZdxpA2acQAAAFY"]
[Fri Feb 13 02:46:53.778309 2026] [:error] [pid 37510:tid 37532] [client 136.112.150.139:60801] [client 136.112.150.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aY4gHcUrqDPNSf1wYBWzPQAAAZA"]
[Fri Feb 13 02:46:54.228225 2026] [:error] [pid 37510:tid 37530] [client 136.112.150.139:56699] [client 136.112.150.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aY4gHsUrqDPNSf1wYBWzPwAAAY4"]
[Fri Feb 13 02:46:54.675105 2026] [:error] [pid 23410:tid 23429] [client 136.112.150.139:49959] [client 136.112.150.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aY4gHhXZP6NFBacuW_1O7AAAAJE"]
[Fri Feb 13 03:27:33.749352 2026] [:error] [pid 45250:tid 45268] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/f.php
[Fri Feb 13 03:27:34.005119 2026] [:error] [pid 45250:tid 45274] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Fri Feb 13 03:27:34.598016 2026] [:error] [pid 45250:tid 45257] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/ftp.php
[Fri Feb 13 03:27:35.084492 2026] [:error] [pid 45250:tid 45252] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Feb 13 03:27:35.547686 2026] [:error] [pid 45250:tid 45259] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Feb 13 03:27:35.791969 2026] [:error] [pid 45250:tid 45267] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Feb 13 03:27:36.034108 2026] [:error] [pid 45250:tid 45255] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 13 03:27:36.277507 2026] [:error] [pid 45250:tid 45271] [client 68.221.137.8:23104] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 13 03:27:36.782446 2026] [:error] [pid 45250:tid 45268] [client 68.221.137.8:23104] [client 68.221.137.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/moon.php"] [unique_id "aY4pqLlDmsiM40CtoXvLAgAAANA"]
[Fri Feb 13 03:27:39.073433 2026] [:error] [pid 45136:tid 45219] [client 68.221.137.8:31547] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aY4pqxdJpxU7xQXD4-Il9wAAAIo"]
[Fri Feb 13 03:27:40.476598 2026] [:error] [pid 45130:tid 45193] [client 68.221.137.8:40351] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aY4prAExoOw92CvaDUgQxQAAAEs"]
[Fri Feb 13 03:27:41.616404 2026] [:error] [pid 45250:tid 45256] [client 68.221.137.8:23166] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aY4prblDmsiM40CtoXvLAwAAAMQ"]
[Fri Feb 13 03:27:43.177372 2026] [:error] [pid 45250:tid 45262] [client 68.221.137.8:24390] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zaa.php"] [unique_id "aY4pr7lDmsiM40CtoXvLBwAAAMo"]
[Fri Feb 13 03:27:44.963726 2026] [:error] [pid 45125:tid 45179] [client 68.221.137.8:5038] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zaa.php"] [unique_id "aY4psLCuTlTzRmD0UwxzTgAAABg"]
[Fri Feb 13 03:27:46.306508 2026] [:error] [pid 54677:tid 54688] [client 68.221.137.8:34371] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zaa.php"] [unique_id "aY4psupuQRO1XrdHFf1Q_wAAAQc"]
[Fri Feb 13 03:27:53.468877 2026] [:error] [pid 54677:tid 54693] [client 68.221.137.8:24385] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zaa.php"] [unique_id "aY4puepuQRO1XrdHFf1REgAAAQw"]
[Fri Feb 13 03:28:05.587357 2026] [:error] [pid 45250:tid 45269] [client 68.221.137.8:48432] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-miiss.php.php"] [unique_id "aY4pxblDmsiM40CtoXvLMQAAANE"]
[Fri Feb 13 03:28:07.829269 2026] [:error] [pid 54677:tid 54701] [client 68.221.137.8:24392] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-miiss.php.php"] [unique_id "aY4px-puQRO1XrdHFf1RJQAAARQ"]
[Fri Feb 13 03:28:10.432688 2026] [:error] [pid 45250:tid 45267] [client 68.221.137.8:40330] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aY4pyrlDmsiM40CtoXvLPgAAAM8"]
[Fri Feb 13 03:28:14.080515 2026] [:error] [pid 45125:tid 45161] [client 68.221.137.8:40337] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aY4pzrCuTlTzRmD0UwxzfQAAAAY"]
[Fri Feb 13 03:28:24.094564 2026] [:error] [pid 45136:tid 45233] [client 68.221.137.8:40350] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aY4p2BdJpxU7xQXD4-ImSgAAAJg"]
[Fri Feb 13 03:28:46.987402 2026] [:error] [pid 17943:tid 17992] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Fri Feb 13 03:28:47.351913 2026] [:error] [pid 17943:tid 17993] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Fri Feb 13 03:28:47.601673 2026] [:error] [pid 17943:tid 17995] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/fetch.php
[Fri Feb 13 03:28:47.853753 2026] [:error] [pid 17943:tid 17997] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Fri Feb 13 03:28:48.108861 2026] [:error] [pid 17943:tid 17999] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Fri Feb 13 03:28:50.352285 2026] [:error] [pid 17943:tid 17990] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/des.php
[Fri Feb 13 03:28:50.620820 2026] [:error] [pid 17943:tid 17987] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/mans.php
[Fri Feb 13 03:28:50.862869 2026] [:error] [pid 17943:tid 17991] [client 68.221.137.8:40336] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 13 03:28:51.602371 2026] [:error] [pid 17943:tid 17995] [client 68.221.137.8:40336] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dr.php"] [unique_id "aY4p8wCFjxXIDFSugHQgaAAAAE4"]
[Fri Feb 13 03:28:52.210510 2026] [:error] [pid 18041:tid 18063] [client 68.221.137.8:47173] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dr.php"] [unique_id "aY4p9CyER0sI-4lcaJJ2vwAAANQ"]
[Fri Feb 13 03:28:53.719782 2026] [:error] [pid 17943:tid 18005] [client 68.221.137.8:48404] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dr.php"] [unique_id "aY4p9QCFjxXIDFSugHQgbAAAAFg"]
[Fri Feb 13 03:28:54.340135 2026] [:error] [pid 17942:tid 17966] [client 68.221.137.8:23112] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dr.php"] [unique_id "aY4p9r1YyF67_WQrcB7R9AAAAA0"]
[Fri Feb 13 03:28:55.146035 2026] [:error] [pid 18041:tid 18059] [client 68.221.137.8:38117] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aY4p9yyER0sI-4lcaJJ2yAAAANA"]
[Fri Feb 13 03:28:56.424386 2026] [:error] [pid 18041:tid 18065] [client 68.221.137.8:56116] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aY4p-CyER0sI-4lcaJJ2ywAAANY"]
[Fri Feb 13 03:28:59.135581 2026] [:error] [pid 18041:tid 18059] [client 68.221.137.8:45787] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aY4p-yyER0sI-4lcaJJ20wAAANA"]
[Fri Feb 13 03:29:02.546496 2026] [:error] [pid 17944:tid 18019] [client 68.221.137.8:22422] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aY4p_k2X3dtnPWMbJQS1vAAAAIs"]
[Fri Feb 13 03:29:07.428180 2026] [:error] [pid 17944:tid 18017] [client 68.221.137.8:59524] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aY4qA02X3dtnPWMbJQS1wgAAAIk"]
[Fri Feb 13 03:29:20.052968 2026] [:error] [pid 18041:tid 18058] [client 68.221.137.8:4867] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY4qECyER0sI-4lcaJJ2_wAAAM8"]
[Fri Feb 13 03:29:25.723914 2026] [:error] [pid 17944:tid 18030] [client 68.221.137.8:21971] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY4qFU2X3dtnPWMbJQS15QAAAJY"]
[Fri Feb 13 03:29:28.630188 2026] [:error] [pid 17943:tid 17983] [client 68.221.137.8:37597] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY4qGACFjxXIDFSugHQgkAAAAEI"]
[Fri Feb 13 03:29:33.255732 2026] [:error] [pid 17944:tid 18020] [client 68.221.137.8:25626] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY4qHU2X3dtnPWMbJQS17gAAAIw"]
[Fri Feb 13 03:29:41.710818 2026] [:error] [pid 17942:tid 17964] [client 68.221.137.8:21929] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aY4qJb1YyF67_WQrcB7SRgAAAAs"]
[Fri Feb 13 03:29:43.759140 2026] [:error] [pid 17942:tid 17975] [client 68.221.137.8:22501] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aY4qJ71YyF67_WQrcB7SSQAAABY"]
[Fri Feb 13 03:29:46.641717 2026] [:error] [pid 17943:tid 17993] [client 68.221.137.8:50077] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aY4qKgCFjxXIDFSugHQgsQAAAEw"]
[Fri Feb 13 03:29:48.061948 2026] [:error] [pid 17942:tid 17955] [client 68.221.137.8:49514] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aY4qLL1YyF67_WQrcB7SUQAAAAI"]
[Fri Feb 13 03:29:53.437815 2026] [:error] [pid 17943:tid 17997] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/geck.php
[Fri Feb 13 03:29:53.681445 2026] [:error] [pid 17943:tid 17986] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/errw.php
[Fri Feb 13 03:29:53.923656 2026] [:error] [pid 17943:tid 18001] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 13 03:29:54.166019 2026] [:error] [pid 17943:tid 17982] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/jsond.php
[Fri Feb 13 03:29:54.460620 2026] [:error] [pid 17943:tid 17994] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/configuration.php
[Fri Feb 13 03:29:54.703369 2026] [:error] [pid 17943:tid 17990] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/100.kb.php
[Fri Feb 13 03:29:54.945707 2026] [:error] [pid 17943:tid 17989] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 13 03:29:55.441704 2026] [:error] [pid 17943:tid 17999] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Fri Feb 13 03:29:55.735851 2026] [:error] [pid 17943:tid 17992] [client 68.221.137.8:53170] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Fri Feb 13 03:29:55.982309 2026] [:error] [pid 17943:tid 17983] [client 68.221.137.8:53170] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lp6.php"] [unique_id "aY4qMwCFjxXIDFSugHQgyQAAAEI"]
[Fri Feb 13 03:30:00.273694 2026] [:error] [pid 17942:tid 17970] [client 68.221.137.8:33710] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lp6.php"] [unique_id "aY4qOL1YyF67_WQrcB7SXAAAABE"]
[Fri Feb 13 03:30:02.697261 2026] [:error] [pid 18041:tid 18047] [client 68.221.137.8:29569] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lp6.php"] [unique_id "aY4qOiyER0sI-4lcaJJ3VgAAAMQ"]
[Fri Feb 13 03:30:23.873452 2026] [:error] [pid 18041:tid 18065] [client 68.221.137.8:50082] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aY4qTyyER0sI-4lcaJJ3iAAAANY"]
[Fri Feb 13 03:30:26.370765 2026] [:error] [pid 18041:tid 18063] [client 68.221.137.8:26273] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aY4qUiyER0sI-4lcaJJ3lgAAANQ"]
[Fri Feb 13 03:30:30.696105 2026] [:error] [pid 18041:tid 18062] [client 68.221.137.8:53582] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bk.php"] [unique_id "aY4qViyER0sI-4lcaJJ3pQAAANM"]
[Fri Feb 13 03:30:32.373492 2026] [:error] [pid 17943:tid 18002] [client 68.221.137.8:49498] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bk.php"] [unique_id "aY4qWACFjxXIDFSugHQhQAAAAFU"]
[Fri Feb 13 03:30:36.429404 2026] [:error] [pid 18041:tid 18064] [client 68.221.137.8:53017] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bk.php"] [unique_id "aY4qXCyER0sI-4lcaJJ3ugAAANU"]
[Fri Feb 13 03:30:37.179110 2026] [:error] [pid 17943:tid 18003] [client 68.221.137.8:39207] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bk.php"] [unique_id "aY4qXQCFjxXIDFSugHQhTwAAAFY"]
[Fri Feb 13 03:30:38.383617 2026] [:error] [pid 18041:tid 18057] [client 68.221.137.8:33670] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aY4qXiyER0sI-4lcaJJ3vwAAAM4"]
[Fri Feb 13 03:30:40.610234 2026] [:error] [pid 18041:tid 18054] [client 68.221.137.8:37318] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aY4qYCyER0sI-4lcaJJ3xgAAAMs"]
[Fri Feb 13 03:30:41.731167 2026] [:error] [pid 17942:tid 17960] [client 68.221.137.8:53533] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aY4qYb1YyF67_WQrcB7SpwAAAAc"]
[Fri Feb 13 03:30:42.565181 2026] [:error] [pid 18041:tid 18065] [client 68.221.137.8:62217] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aY4qYiyER0sI-4lcaJJ3zAAAANY"]
[Fri Feb 13 03:30:43.348687 2026] [:error] [pid 18041:tid 18061] [client 68.221.137.8:32047] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY4qYyyER0sI-4lcaJJ3zgAAANI"]
[Fri Feb 13 03:30:44.143854 2026] [:error] [pid 18041:tid 18050] [client 68.221.137.8:55647] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY4qZCyER0sI-4lcaJJ30QAAAMc"]
[Fri Feb 13 03:30:45.587858 2026] [:error] [pid 17942:tid 17964] [client 68.221.137.8:37344] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY4qZb1YyF67_WQrcB7SqQAAAAs"]
[Fri Feb 13 03:30:47.203180 2026] [:error] [pid 17944:tid 18031] [client 68.221.137.8:37342] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY4qZ02X3dtnPWMbJQS2XwAAAJc"]
[Fri Feb 13 03:30:48.258256 2026] [:error] [pid 18041:tid 18056] [client 68.221.137.8:37315] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/skin/install/default/security.php"] [unique_id "aY4qaCyER0sI-4lcaJJ32AAAAM0"]
[Fri Feb 13 03:30:53.210586 2026] [:error] [pid 17943:tid 17997] [client 68.221.137.8:36841] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/skin/install/default/security.php"] [unique_id "aY4qbQCFjxXIDFSugHQhZgAAAFA"]
[Fri Feb 13 03:30:56.760831 2026] [:error] [pid 18041:tid 18054] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 13 03:30:57.020902 2026] [:error] [pid 18041:tid 18065] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/ap.php
[Fri Feb 13 03:30:57.265018 2026] [:error] [pid 18041:tid 18046] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Feb 13 03:30:57.508263 2026] [:error] [pid 18041:tid 18061] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/clasa99.php
[Fri Feb 13 03:30:57.911880 2026] [:error] [pid 18041:tid 18055] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Feb 13 03:30:58.170101 2026] [:error] [pid 18041:tid 18066] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/assacc.php
[Fri Feb 13 03:30:58.413478 2026] [:error] [pid 18041:tid 18059] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/hzz.php
[Fri Feb 13 03:31:00.355260 2026] [:error] [pid 18041:tid 18045] [client 68.221.137.8:40337] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Fri Feb 13 03:31:00.594835 2026] [:error] [pid 18041:tid 18051] [client 68.221.137.8:40337] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aY4qdCyER0sI-4lcaJJ4BwAAAMg"]
[Fri Feb 13 03:31:06.270656 2026] [:error] [pid 17942:tid 17972] [client 68.221.137.8:48717] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aY4qer1YyF67_WQrcB7SzQAAABM"]
[Fri Feb 13 03:31:10.086896 2026] [:error] [pid 17942:tid 17968] [client 68.221.137.8:4108] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aY4qfr1YyF67_WQrcB7S1QAAAA8"]
[Fri Feb 13 03:31:12.854113 2026] [:error] [pid 17944:tid 18031] [client 68.221.137.8:53042] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aY4qgE2X3dtnPWMbJQS2jgAAAJc"]
[Fri Feb 13 03:31:15.426125 2026] [:error] [pid 17944:tid 18019] [client 68.221.137.8:32105] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "aY4qg02X3dtnPWMbJQS2nAAAAIs"]
[Fri Feb 13 03:31:16.598487 2026] [:error] [pid 17942:tid 17976] [client 68.221.137.8:4764] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "aY4qhL1YyF67_WQrcB7S5QAAABc"]
[Fri Feb 13 03:31:17.691453 2026] [:error] [pid 18041:tid 18063] [client 68.221.137.8:21568] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "aY4qhSyER0sI-4lcaJJ4LgAAANQ"]
[Fri Feb 13 03:31:22.176500 2026] [:error] [pid 17942:tid 17976] [client 68.221.137.8:33703] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "aY4qir1YyF67_WQrcB7TAwAAABc"]
[Fri Feb 13 03:31:25.195241 2026] [:error] [pid 18041:tid 18046] [client 68.221.137.8:42740] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/"] [unique_id "aY4qjSyER0sI-4lcaJJ4RAAAAMM"]
[Fri Feb 13 03:31:27.555866 2026] [:error] [pid 17944:tid 18024] [client 68.221.137.8:39995] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/"] [unique_id "aY4qj02X3dtnPWMbJQS20wAAAJA"]
[Fri Feb 13 03:31:28.818562 2026] [:error] [pid 17944:tid 18014] [client 68.221.137.8:39979] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/"] [unique_id "aY4qkE2X3dtnPWMbJQS22QAAAIY"]
[Fri Feb 13 03:31:29.905479 2026] [:error] [pid 17942:tid 17954] [client 68.221.137.8:4524] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/"] [unique_id "aY4qkb1YyF67_WQrcB7TCwAAAAE"]
[Fri Feb 13 03:31:31.985476 2026] [:error] [pid 17943:tid 17998] [client 68.221.137.8:39599] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/museu/yhweq.php"] [unique_id "aY4qkwCFjxXIDFSugHQhvgAAAFE"]
[Fri Feb 13 03:31:33.986903 2026] [:error] [pid 17942:tid 17956] [client 68.221.137.8:57317] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/museu/yhweq.php"] [unique_id "aY4qlb1YyF67_WQrcB7TGgAAAAM"]
[Fri Feb 13 03:31:35.058668 2026] [:error] [pid 18041:tid 18058] [client 68.221.137.8:57300] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/museu/yhweq.php"] [unique_id "aY4qlyyER0sI-4lcaJJ4VQAAAM8"]
[Fri Feb 13 03:31:36.917402 2026] [:error] [pid 17943:tid 17985] [client 68.221.137.8:33699] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/museu/yhweq.php"] [unique_id "aY4qmACFjxXIDFSugHQhxgAAAEQ"]
[Fri Feb 13 03:31:37.844215 2026] [:error] [pid 18041:tid 18054] [client 68.221.137.8:27836] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.cache/x.php"] [unique_id "aY4qmSyER0sI-4lcaJJ4XwAAAMs"]
[Fri Feb 13 03:31:40.455141 2026] [:error] [pid 17943:tid 17989] [client 68.221.137.8:45856] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.cache/x.php"] [unique_id "aY4qnACFjxXIDFSugHQhyAAAAEg"]
[Fri Feb 13 03:31:43.460777 2026] [:error] [pid 17943:tid 17984] [client 68.221.137.8:59556] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.cache/x.php"] [unique_id "aY4qnwCFjxXIDFSugHQhygAAAEM"]
[Fri Feb 13 03:31:48.904809 2026] [:error] [pid 18041:tid 18047] [client 68.221.137.8:4440] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.cache/x.php"] [unique_id "aY4qpCyER0sI-4lcaJJ4bwAAAMQ"]
[Fri Feb 13 03:31:50.843627 2026] [:error] [pid 17943:tid 17988] [client 68.221.137.8:61956] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY4qpgCFjxXIDFSugHQh5gAAAEc"]
[Fri Feb 13 03:31:53.512249 2026] [:error] [pid 18041:tid 18061] [client 68.221.137.8:4759] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY4qqSyER0sI-4lcaJJ4cwAAANI"]
[Fri Feb 13 03:31:55.645470 2026] [:error] [pid 17944:tid 18014] [client 68.221.137.8:25055] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY4qq02X3dtnPWMbJQS3KgAAAIY"]
[Fri Feb 13 03:31:58.711038 2026] [:error] [pid 17942:tid 17969] [client 68.221.137.8:4758] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aY4qrr1YyF67_WQrcB7TRwAAABA"]
[Fri Feb 13 03:32:01.114087 2026] [:error] [pid 17943:tid 18000] [client 68.221.137.8:25076] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 13 03:32:01.357618 2026] [:error] [pid 17943:tid 17982] [client 68.221.137.8:25076] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Fri Feb 13 03:32:01.659095 2026] [:error] [pid 17943:tid 17987] [client 68.221.137.8:25076] File does not exist: /usr/local/apache/htdocs/suspended-page/nyan.php
[Fri Feb 13 03:32:02.402408 2026] [:error] [pid 17943:tid 17989] [client 68.221.137.8:25076] [client 68.221.137.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aY4qsgCFjxXIDFSugHQh_QAAAEg"]
[Fri Feb 13 03:32:05.789022 2026] [:error] [pid 17944:tid 18021] [client 68.221.137.8:4528] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Fri Feb 13 03:32:06.038425 2026] [:error] [pid 17944:tid 18023] [client 68.221.137.8:4528] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Feb 13 03:32:06.284109 2026] [:error] [pid 17944:tid 18029] [client 68.221.137.8:4528] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Fri Feb 13 03:32:06.542664 2026] [:error] [pid 17944:tid 18012] [client 68.221.137.8:4528] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Fri Feb 13 03:32:07.044547 2026] [:error] [pid 17944:tid 18022] [client 68.221.137.8:4528] File does not exist: /usr/local/apache/htdocs/suspended-page/n3.php
[Fri Feb 13 03:32:07.284905 2026] [:error] [pid 17944:tid 18014] [client 68.221.137.8:4528] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/"] [unique_id "aY4qt02X3dtnPWMbJQS3PwAAAIY"]
[Fri Feb 13 03:32:08.039563 2026] [:error] [pid 17942:tid 17971] [client 68.221.137.8:4530] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/"] [unique_id "aY4quL1YyF67_WQrcB7TUwAAABI"]
[Fri Feb 13 03:32:10.852246 2026] [:error] [pid 17944:tid 18031] [client 68.221.137.8:4459] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/"] [unique_id "aY4quk2X3dtnPWMbJQS3SwAAAJc"]
[Fri Feb 13 03:32:13.749287 2026] [:error] [pid 17944:tid 18017] [client 68.221.137.8:5098] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/"] [unique_id "aY4qvU2X3dtnPWMbJQS3YgAAAIk"]
[Fri Feb 13 03:32:22.256404 2026] [:error] [pid 17942:tid 17963] [client 68.221.137.8:61996] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aY4qxr1YyF67_WQrcB7TbAAAAAo"]
[Fri Feb 13 03:32:26.000503 2026] [:error] [pid 17942:tid 17962] [client 68.221.137.8:5100] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aY4qyb1YyF67_WQrcB7TcwAAAAk"]
[Fri Feb 13 03:32:27.254997 2026] [:error] [pid 18041:tid 18058] [client 68.221.137.8:41018] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aY4qyyyER0sI-4lcaJJ5DQAAAM8"]
[Fri Feb 13 03:32:31.381699 2026] [:error] [pid 17943:tid 17985] [client 68.221.137.8:5061] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aY4qzwCFjxXIDFSugHQiPgAAAEQ"]
[Fri Feb 13 03:32:32.597293 2026] [:error] [pid 17942:tid 17967] [client 68.221.137.8:32527] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aY4q0L1YyF67_WQrcB7TfQAAAA4"]
[Fri Feb 13 03:32:34.718503 2026] [:error] [pid 30774:tid 30797] [client 68.221.137.8:35029] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aY4q0hH-WbPjYvncUR8ADwAAARA"]
[Fri Feb 13 03:32:36.479383 2026] [:error] [pid 17943:tid 17994] [client 68.221.137.8:45294] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aY4q1ACFjxXIDFSugHQiSQAAAE0"]
[Fri Feb 13 03:32:38.042741 2026] [:error] [pid 18041:tid 18066] [client 68.221.137.8:48749] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aY4q1iyER0sI-4lcaJJ5LgAAANc"]
[Fri Feb 13 03:32:39.749961 2026] [:error] [pid 17943:tid 18002] [client 68.221.137.8:35707] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aY4q1wCFjxXIDFSugHQiUgAAAFU"]
[Fri Feb 13 03:32:43.030168 2026] [:error] [pid 17942:tid 17968] [client 68.221.137.8:20853] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aY4q271YyF67_WQrcB7TjAAAAA8"]
[Fri Feb 13 03:32:45.356909 2026] [:error] [pid 30774:tid 30803] [client 68.221.137.8:45285] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnn_.php"] [unique_id "aY4q3RH-WbPjYvncUR8ASgAAARY"]
[Fri Feb 13 03:32:47.060093 2026] [:error] [pid 30774:tid 30790] [client 68.221.137.8:32010] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aY4q3xH-WbPjYvncUR8AYQAAAQk"]
[Fri Feb 13 03:32:49.572407 2026] [:error] [pid 30774:tid 30790] [client 68.221.137.8:56760] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aY4q4RH-WbPjYvncUR8AcQAAAQk"]
[Fri Feb 13 03:32:51.775205 2026] [:error] [pid 17942:tid 17956] [client 68.221.137.8:56762] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aY4q471YyF67_WQrcB7TnwAAAAM"]
[Fri Feb 13 03:32:53.836449 2026] [:error] [pid 17943:tid 17996] [client 68.221.137.8:56709] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1337.php"] [unique_id "aY4q5QCFjxXIDFSugHQibQAAAE8"]
[Fri Feb 13 03:33:00.248808 2026] [:error] [pid 17944:tid 18029] [client 68.221.137.8:4838] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aY4q7E2X3dtnPWMbJQS3wAAAAJU"]
[Fri Feb 13 03:33:07.169758 2026] [:error] [pid 17944:tid 18021] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Feb 13 03:33:08.068120 2026] [:error] [pid 17944:tid 18031] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Fri Feb 13 03:33:08.310827 2026] [:error] [pid 17944:tid 18012] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Feb 13 03:33:08.844815 2026] [:error] [pid 17944:tid 18026] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/wqqs.php
[Fri Feb 13 03:33:09.089336 2026] [:error] [pid 17944:tid 18008] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/ole.php
[Fri Feb 13 03:33:09.702975 2026] [:error] [pid 17944:tid 18016] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Fri Feb 13 03:33:09.950247 2026] [:error] [pid 17944:tid 18027] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/ak.php
[Fri Feb 13 03:33:10.465200 2026] [:error] [pid 17944:tid 18011] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/mds.php
[Fri Feb 13 03:33:10.721336 2026] [:error] [pid 17944:tid 18014] [client 68.221.137.8:42179] File does not exist: /usr/local/apache/htdocs/suspended-page/ellv3.php
[Fri Feb 13 03:33:10.960921 2026] [:error] [pid 17944:tid 18030] [client 68.221.137.8:42179] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aY4q9k2X3dtnPWMbJQS32gAAAJY"]
[Fri Feb 13 03:33:15.306278 2026] [:error] [pid 17944:tid 18025] [client 68.221.137.8:58838] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aY4q-02X3dtnPWMbJQS34wAAAJE"]
[Fri Feb 13 03:33:25.243530 2026] [:error] [pid 30774:tid 30793] [client 68.221.137.8:4665] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aY4rBRH-WbPjYvncUR8A5gAAAQw"]
[Fri Feb 13 03:33:28.459052 2026] [:error] [pid 17944:tid 18030] [client 68.221.137.8:38651] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aY4rCE2X3dtnPWMbJQS38gAAAJY"]
[Fri Feb 13 03:33:30.399332 2026] [:error] [pid 17942:tid 17953] [client 68.221.137.8:54254] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aY4rCr1YyF67_WQrcB7T7QAAAAA"]
[Fri Feb 13 03:33:31.820168 2026] [:error] [pid 17942:tid 17958] [client 68.221.137.8:45800] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aY4rC71YyF67_WQrcB7T8QAAAAU"]
[Fri Feb 13 03:33:34.542446 2026] [:error] [pid 30774:tid 30789] [client 68.221.137.8:21126] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aY4rDhH-WbPjYvncUR8A-QAAAQg"]
[Fri Feb 13 03:33:38.636827 2026] [:error] [pid 17943:tid 17996] [client 68.221.137.8:4872] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/"] [unique_id "aY4rEgCFjxXIDFSugHQiuAAAAE8"]
[Fri Feb 13 03:33:40.795304 2026] [:error] [pid 18041:tid 18046] [client 68.221.137.8:4914] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/"] [unique_id "aY4rFCyER0sI-4lcaJJ5oAAAAMM"]
[Fri Feb 13 03:33:42.091038 2026] [:error] [pid 17944:tid 18014] [client 68.221.137.8:28393] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/"] [unique_id "aY4rFk2X3dtnPWMbJQS4CQAAAIY"]
[Fri Feb 13 03:33:47.166491 2026] [:error] [pid 17944:tid 18010] [client 68.221.137.8:32601] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/"] [unique_id "aY4rG02X3dtnPWMbJQS4EQAAAII"]
[Fri Feb 13 03:33:49.380224 2026] [:error] [pid 18041:tid 18058] [client 68.221.137.8:21975] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x_3.php"] [unique_id "aY4rHSyER0sI-4lcaJJ5qwAAAM8"]
[Fri Feb 13 03:33:54.524217 2026] [:error] [pid 17943:tid 17992] [client 68.221.137.8:23058] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x_3.php"] [unique_id "aY4rIgCFjxXIDFSugHQi1QAAAEs"]
[Fri Feb 13 03:33:55.317536 2026] [:error] [pid 17944:tid 18026] [client 68.221.137.8:39568] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x_3.php"] [unique_id "aY4rI02X3dtnPWMbJQS4KgAAAJI"]
[Fri Feb 13 03:33:59.775213 2026] [:error] [pid 18041:tid 18056] [client 68.221.137.8:38019] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x_3.php"] [unique_id "aY4rJyyER0sI-4lcaJJ5uQAAAM0"]
[Fri Feb 13 03:34:00.763435 2026] [:error] [pid 17944:tid 18023] [client 68.221.137.8:58926] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_wlx.php"] [unique_id "aY4rKE2X3dtnPWMbJQS4MQAAAI8"]
[Fri Feb 13 03:34:04.708130 2026] [:error] [pid 18041:tid 18055] [client 68.221.137.8:48406] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_wlx.php"] [unique_id "aY4rLCyER0sI-4lcaJJ5ywAAAMw"]
[Fri Feb 13 03:34:05.827503 2026] [:error] [pid 18041:tid 18067] [client 68.221.137.8:4333] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_wlx.php"] [unique_id "aY4rLSyER0sI-4lcaJJ5zQAAANg"]
[Fri Feb 13 03:34:08.016049 2026] [:error] [pid 18041:tid 18054] [client 68.221.137.8:21930] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_wlx.php"] [unique_id "aY4rMCyER0sI-4lcaJJ51wAAAMs"]
[Fri Feb 13 03:34:09.538976 2026] [:error] [pid 18041:tid 18060] [client 68.221.137.8:58919] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aY4rMSyER0sI-4lcaJJ52wAAANE"]
[Fri Feb 13 03:34:12.242494 2026] [:error] [pid 18041:tid 18065] [client 68.221.137.8:48412] [client 68.221.137.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aY4rNCyER0sI-4lcaJJ54QAAANY"]
[Fri Feb 13 03:34:22.988684 2026] [:error] [pid 30774:tid 30781] [client 68.221.137.8:21888] File does not exist: /usr/local/apache/htdocs/suspended-page/oivcl.php
[Fri Feb 13 03:34:23.499605 2026] [:error] [pid 30774:tid 30787] [client 68.221.137.8:21888] File does not exist: /usr/local/apache/htdocs/suspended-page/o.php
[Fri Feb 13 03:34:23.749167 2026] [:error] [pid 30774:tid 30785] [client 68.221.137.8:21888] File does not exist: /usr/local/apache/htdocs/suspended-page/asd67.php
[Fri Feb 13 03:34:24.255567 2026] [:error] [pid 30774:tid 30789] [client 68.221.137.8:21888] [client 68.221.137.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aY4rQBH-WbPjYvncUR8B2AAAAQg"]
[Fri Feb 13 03:34:26.039041 2026] [:error] [pid 17944:tid 18029] [client 68.221.137.8:56118] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Fri Feb 13 03:34:26.284279 2026] [:error] [pid 17944:tid 18016] [client 68.221.137.8:56118] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Fri Feb 13 03:34:26.541275 2026] [:error] [pid 17944:tid 18027] [client 68.221.137.8:56118] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Fri Feb 13 03:34:26.801406 2026] [:error] [pid 17944:tid 18019] [client 68.221.137.8:56118] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/apsarasarts/okk.php"] [unique_id "aY4rQk2X3dtnPWMbJQS4WgAAAIs"]
[Fri Feb 13 03:34:28.608505 2026] [:error] [pid 17944:tid 18029] [client 68.221.137.8:36347] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/apsarasarts/okk.php"] [unique_id "aY4rRE2X3dtnPWMbJQS4ZgAAAJU"]
[Fri Feb 13 03:34:30.182691 2026] [:error] [pid 17943:tid 18005] [client 68.221.137.8:40339] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/apsarasarts/okk.php"] [unique_id "aY4rRgCFjxXIDFSugHQjMAAAAFg"]
[Fri Feb 13 03:34:31.554968 2026] [:error] [pid 17942:tid 17969] [client 68.221.137.8:52548] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/apsarasarts/okk.php"] [unique_id "aY4rR71YyF67_WQrcB7UcgAAABA"]
[Fri Feb 13 03:34:34.838387 2026] [:error] [pid 30774:tid 30791] [client 68.221.137.8:40364] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mal.php"] [unique_id "aY4rShH-WbPjYvncUR8B7wAAAQo"]
[Fri Feb 13 03:34:36.114307 2026] [:error] [pid 17944:tid 18032] [client 68.221.137.8:22480] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mal.php"] [unique_id "aY4rTE2X3dtnPWMbJQS4fQAAAJg"]
[Fri Feb 13 03:34:38.154468 2026] [:error] [pid 17944:tid 18023] [client 68.221.137.8:39250] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mal.php"] [unique_id "aY4rTk2X3dtnPWMbJQS4ggAAAI8"]
[Fri Feb 13 03:34:39.642361 2026] [:error] [pid 30774:tid 30792] [client 68.221.137.8:52554] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mal.php"] [unique_id "aY4rTxH-WbPjYvncUR8B-gAAAQs"]
[Fri Feb 13 03:34:44.571883 2026] [:error] [pid 17943:tid 17981] [client 68.221.137.8:36811] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/wpupex.php/"] [unique_id "aY4rVACFjxXIDFSugHQjSQAAAEA"]
[Fri Feb 13 03:34:45.885628 2026] [:error] [pid 30774:tid 30792] [client 68.221.137.8:39238] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/wpupex.php/"] [unique_id "aY4rVRH-WbPjYvncUR8CCwAAAQs"]
[Fri Feb 13 03:34:48.281341 2026] [:error] [pid 30774:tid 30804] [client 68.221.137.8:29025] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/wpupex.php/"] [unique_id "aY4rWBH-WbPjYvncUR8CEQAAARc"]
[Fri Feb 13 03:34:49.388113 2026] [:error] [pid 17943:tid 17993] [client 68.221.137.8:4099] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/wpupex.php/"] [unique_id "aY4rWQCFjxXIDFSugHQjUAAAAEw"]
[Fri Feb 13 03:34:50.348563 2026] [:error] [pid 18041:tid 18058] [client 68.221.137.8:4567] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aY4rWiyER0sI-4lcaJJ6HAAAAM8"]
[Fri Feb 13 03:34:51.117988 2026] [:error] [pid 30774:tid 30787] [client 68.221.137.8:39294] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aY4rWxH-WbPjYvncUR8CHQAAAQY"]
[Fri Feb 13 03:34:53.469925 2026] [:error] [pid 17942:tid 17967] [client 68.221.137.8:54191] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aY4rXb1YyF67_WQrcB7UlgAAAA4"]
[Fri Feb 13 03:34:54.445693 2026] [:error] [pid 17944:tid 18013] [client 68.221.137.8:42233] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aY4rXk2X3dtnPWMbJQS4kwAAAIU"]
[Fri Feb 13 03:35:01.938427 2026] [:error] [pid 30774:tid 30798] [client 68.221.137.8:42232] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/deeto/login.php"] [unique_id "aY4rZRH-WbPjYvncUR8CRQAAARE"]
[Fri Feb 13 03:35:08.554420 2026] [:error] [pid 17942:tid 17975] [client 68.221.137.8:41562] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/deeto/login.php"] [unique_id "aY4rbL1YyF67_WQrcB7UwgAAABY"]
[Fri Feb 13 03:35:11.805081 2026] [:error] [pid 30774:tid 30797] [client 68.221.137.8:44267] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aY4rbxH-WbPjYvncUR8CgAAAARA"]
[Fri Feb 13 03:35:14.616627 2026] [:error] [pid 30774:tid 30793] [client 68.221.137.8:23146] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aY4rchH-WbPjYvncUR8CigAAAQw"]
[Fri Feb 13 03:35:16.998951 2026] [:error] [pid 17943:tid 17996] [client 68.221.137.8:29640] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aY4rdACFjxXIDFSugHQjigAAAE8"]
[Fri Feb 13 03:35:20.564958 2026] [:error] [pid 30774:tid 30794] [client 68.221.137.8:53368] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aY4reBH-WbPjYvncUR8CngAAAQ0"]
[Fri Feb 13 03:35:24.726694 2026] [:error] [pid 30774:tid 30784] [client 68.221.137.8:50052] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ph33w.php"] [unique_id "aY4rfBH-WbPjYvncUR8CsAAAAQM"]
[Fri Feb 13 03:35:31.510368 2026] [:error] [pid 30774:tid 30796] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/ph33w.php
[Fri Feb 13 03:35:31.763330 2026] [:error] [pid 30774:tid 30795] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/cv.php
[Fri Feb 13 03:35:32.249026 2026] [:error] [pid 30774:tid 30782] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/wp4.php
[Fri Feb 13 03:35:32.739581 2026] [:error] [pid 30774:tid 30787] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 13 03:35:33.040792 2026] [:error] [pid 30774:tid 30784] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/sxo.php
[Fri Feb 13 03:35:33.283330 2026] [:error] [pid 30774:tid 30797] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/2026.php
[Fri Feb 13 03:35:33.582370 2026] [:error] [pid 30774:tid 30796] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 13 03:35:33.826082 2026] [:error] [pid 30774:tid 30790] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/sto.php
[Fri Feb 13 03:35:34.073224 2026] [:error] [pid 30774:tid 30795] [client 68.221.137.8:44834] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Fri Feb 13 03:35:34.502182 2026] [:error] [pid 30774:tid 30780] [client 68.221.137.8:44834] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tphp.php"] [unique_id "aY4rhhH-WbPjYvncUR8C0AAAAQA"]
[Fri Feb 13 03:35:40.103285 2026] [:error] [pid 30774:tid 30798] [client 68.221.137.8:4096] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tphp.php"] [unique_id "aY4rjBH-WbPjYvncUR8C4wAAARE"]
[Fri Feb 13 03:35:41.537998 2026] [:error] [pid 17944:tid 18024] [client 68.221.137.8:39225] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tphp.php"] [unique_id "aY4rjU2X3dtnPWMbJQS5GgAAAJA"]
[Fri Feb 13 03:35:42.504292 2026] [:error] [pid 18041:tid 18044] [client 68.221.137.8:53508] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tphp.php"] [unique_id "aY4rjiyER0sI-4lcaJJ6ZwAAAME"]
[Fri Feb 13 03:35:43.835822 2026] [:error] [pid 17943:tid 17984] [client 68.221.137.8:37556] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cs.php"] [unique_id "aY4rjwCFjxXIDFSugHQjqQAAAEM"]
[Fri Feb 13 03:35:45.658900 2026] [:error] [pid 17942:tid 17966] [client 68.221.137.8:37550] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cs.php"] [unique_id "aY4rkb1YyF67_WQrcB7VEAAAAA0"]
[Fri Feb 13 03:35:47.522243 2026] [:error] [pid 17943:tid 17983] [client 68.221.137.8:39986] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cs.php"] [unique_id "aY4rkwCFjxXIDFSugHQjuQAAAEI"]
[Fri Feb 13 03:35:50.524853 2026] [:error] [pid 17944:tid 18024] [client 68.221.137.8:32057] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cs.php"] [unique_id "aY4rlk2X3dtnPWMbJQS5IwAAAJA"]
[Fri Feb 13 03:35:51.877132 2026] [:error] [pid 18041:tid 18043] [client 68.221.137.8:39975] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aY4rlyyER0sI-4lcaJJ6ewAAAMA"]
[Fri Feb 13 03:35:53.128685 2026] [:error] [pid 17944:tid 18016] [client 68.221.137.8:27342] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aY4rmU2X3dtnPWMbJQS5KwAAAIg"]
[Fri Feb 13 03:35:54.547622 2026] [:error] [pid 17943:tid 17981] [client 68.221.137.8:27328] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aY4rmgCFjxXIDFSugHQjzAAAAEA"]
[Fri Feb 13 03:35:55.470053 2026] [:error] [pid 30774:tid 30804] [client 68.221.137.8:56027] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/user.php"] [unique_id "aY4rmxH-WbPjYvncUR8DDgAAARc"]
[Fri Feb 13 03:35:57.777727 2026] [:error] [pid 17943:tid 17982] [client 68.221.137.8:32052] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aY4rnQCFjxXIDFSugHQj0QAAAEE"]
[Fri Feb 13 03:36:00.883045 2026] [:error] [pid 18041:tid 18064] [client 68.221.137.8:31580] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aY4roCyER0sI-4lcaJJ6hQAAANU"]
[Fri Feb 13 03:36:19.005731 2026] [:error] [pid 49223:tid 49237] [client 68.221.137.8:31606] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Wp-good.php"] [unique_id "aY4rsh8A_fZBamNLnfUCHgAAAAU"]
[Fri Feb 13 03:36:19.926847 2026] [:error] [pid 49225:tid 49294] [client 68.221.137.8:31603] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Wp-good.php"] [unique_id "aY4rszwH8-zGxtAd3jui0QAAAIA"]
[Fri Feb 13 03:36:21.457902 2026] [:error] [pid 49225:tid 49305] [client 68.221.137.8:5046] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Wp-good.php"] [unique_id "aY4rtTwH8-zGxtAd3jui1wAAAIs"]
[Fri Feb 13 03:36:22.431657 2026] [:error] [pid 49335:tid 49341] [client 68.221.137.8:32119] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Wp-good.php"] [unique_id "aY4rtqp--SFY2nwOiqntOwAAAMQ"]
[Fri Feb 13 03:36:24.236079 2026] [:error] [pid 49223:tid 49235] [client 68.221.137.8:27836] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aY4ruB8A_fZBamNLnfUCMQAAAAM"]
[Fri Feb 13 03:36:26.537730 2026] [:error] [pid 49225:tid 49317] [client 68.221.137.8:30245] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aY4rujwH8-zGxtAd3jui3wAAAJc"]
[Fri Feb 13 03:36:27.246872 2026] [:error] [pid 49223:tid 49237] [client 68.221.137.8:48341] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aY4rux8A_fZBamNLnfUCNQAAAAU"]
[Fri Feb 13 03:36:29.063165 2026] [:error] [pid 49224:tid 49275] [client 68.221.137.8:4781] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aY4rvdiAvPoWmw5YhwlY1wAAAEg"]
[Fri Feb 13 03:36:31.870358 2026] [:error] [pid 49335:tid 49337] [client 68.221.137.8:62531] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aY4rv6p--SFY2nwOiqntVAAAAMA"]
[Fri Feb 13 03:36:32.462600 2026] [:error] [pid 49225:tid 49314] [client 68.221.137.8:53044] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aY4rwDwH8-zGxtAd3jui6gAAAJQ"]
[Fri Feb 13 03:36:33.222888 2026] [:error] [pid 49335:tid 49349] [client 68.221.137.8:62537] [client 68.221.137.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aY4rwap--SFY2nwOiqntWgAAAMw"]
[Fri Feb 13 03:36:34.250862 2026] [:error] [pid 49224:tid 49278] [client 68.221.137.8:48337] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Feb 13 03:36:34.494078 2026] [:error] [pid 49224:tid 49288] [client 68.221.137.8:48337] File does not exist: /usr/local/apache/htdocs/suspended-page/jmfi2.php
[Fri Feb 13 03:36:34.761203 2026] [:error] [pid 49224:tid 49271] [client 68.221.137.8:48337] File does not exist: /usr/local/apache/htdocs/suspended-page/x7.php
[Fri Feb 13 03:36:35.004334 2026] [:error] [pid 49224:tid 49277] [client 68.221.137.8:48337] File does not exist: /usr/local/apache/htdocs/suspended-page/hey.php
[Fri Feb 13 03:36:36.090830 2026] [:error] [pid 49224:tid 49281] [client 68.221.137.8:48337] File does not exist: /usr/local/apache/htdocs/suspended-page/gib.php
[Fri Feb 13 03:36:36.577924 2026] [:error] [pid 49224:tid 49279] [client 68.221.137.8:48337] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Fri Feb 13 03:36:36.829125 2026] [:error] [pid 49224:tid 49284] [client 68.221.137.8:48337] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Feb 13 04:03:53.497331 2026] [:error] [pid 49225:tid 49297] [client 167.172.240.7:40140] [client 167.172.240.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY4yKTwH8-zGxtAd3juxbAAAAIM"]
[Fri Feb 13 04:03:59.446002 2026] [:error] [pid 49225:tid 49316] [client 167.172.240.7:51460] [client 167.172.240.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aY4yLzwH8-zGxtAd3juxdQAAAJY"]
[Fri Feb 13 05:20:58.003970 2026] [:error] [pid 49223:tid 49237] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Fri Feb 13 05:20:58.513332 2026] [:error] [pid 49223:tid 49253] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Fri Feb 13 05:20:58.770541 2026] [:error] [pid 49223:tid 49243] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Fri Feb 13 05:20:59.015241 2026] [:error] [pid 49223:tid 49239] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/503.php
[Fri Feb 13 05:20:59.355950 2026] [:error] [pid 49223:tid 49238] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/indeex.php
[Fri Feb 13 05:20:59.598182 2026] [:error] [pid 49223:tid 49244] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-4doption1.php
[Fri Feb 13 05:21:01.703788 2026] [:error] [pid 49223:tid 49244] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi1.php
[Fri Feb 13 05:21:01.946355 2026] [:error] [pid 49223:tid 49254] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Feb 13 05:21:02.189865 2026] [:error] [pid 49223:tid 49248] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Fri Feb 13 05:21:02.432362 2026] [:error] [pid 49223:tid 49251] [client 158.158.35.157:24495] File does not exist: /usr/local/apache/htdocs/suspended-page/Capte.php
[Fri Feb 13 05:21:02.673186 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:24495] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aY5EPh8A_fZBamNLnfUq0QAAAA4"]
[Fri Feb 13 05:21:03.596338 2026] [:error] [pid 49225:tid 49296] [client 158.158.35.157:4138] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aY5EPzwH8-zGxtAd3jvOdwAAAII"]
[Fri Feb 13 05:21:04.588344 2026] [:error] [pid 49335:tid 49361] [client 158.158.35.157:4898] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aY5EQKp--SFY2nwOiqkmhgAAANg"]
[Fri Feb 13 05:21:05.747859 2026] [:error] [pid 49335:tid 49353] [client 158.158.35.157:4097] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aY5EQap--SFY2nwOiqkmjAAAANA"]
[Fri Feb 13 05:21:06.542744 2026] [:error] [pid 49223:tid 49252] [client 158.158.35.157:28945] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aY5EQh8A_fZBamNLnfUq1AAAABQ"]
[Fri Feb 13 05:21:07.187353 2026] [:error] [pid 49335:tid 49358] [client 158.158.35.157:36029] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aY5EQ6p--SFY2nwOiqkmkgAAANU"]
[Fri Feb 13 05:21:08.046392 2026] [:error] [pid 49225:tid 49307] [client 158.158.35.157:28990] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aY5ERDwH8-zGxtAd3jvOfgAAAI0"]
[Fri Feb 13 05:21:08.989320 2026] [:error] [pid 49335:tid 49338] [client 158.158.35.157:28991] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aY5ERKp--SFY2nwOiqkmlwAAAME"]
[Fri Feb 13 05:21:10.364042 2026] [:error] [pid 49223:tid 49255] [client 158.158.35.157:33452] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aY5ERh8A_fZBamNLnfUq3wAAABc"]
[Fri Feb 13 05:21:11.420712 2026] [:error] [pid 49225:tid 49299] [client 158.158.35.157:28987] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aY5ERzwH8-zGxtAd3jvOhwAAAIU"]
[Fri Feb 13 05:21:12.388508 2026] [:error] [pid 51243:tid 51246] [client 158.158.35.157:50130] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aY5ESMim7ZTAHzi7xZu8nAAAAQE"]
[Fri Feb 13 05:21:13.302194 2026] [:error] [pid 49223:tid 49235] [client 158.158.35.157:44359] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aY5ESR8A_fZBamNLnfUq5QAAAAM"]
[Fri Feb 13 05:21:13.951252 2026] [:error] [pid 51243:tid 51256] [client 158.158.35.157:44971] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aY5EScim7ZTAHzi7xZu8uwAAAQs"]
[Fri Feb 13 05:21:14.885903 2026] [:error] [pid 49225:tid 49313] [client 158.158.35.157:33423] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aY5ESjwH8-zGxtAd3jvOjQAAAJM"]
[Fri Feb 13 05:21:15.730479 2026] [:error] [pid 51243:tid 51245] [client 158.158.35.157:44980] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aY5ES8im7ZTAHzi7xZu82QAAAQA"]
[Fri Feb 13 05:21:16.466258 2026] [:error] [pid 49225:tid 49294] [client 158.158.35.157:44391] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aY5ETDwH8-zGxtAd3jvOkQAAAIA"]
[Fri Feb 13 05:21:17.489040 2026] [:error] [pid 49223:tid 49256] [client 158.158.35.157:4910] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aY5ETR8A_fZBamNLnfUq8AAAABg"]
[Fri Feb 13 05:21:18.451205 2026] [:error] [pid 51243:tid 51246] [client 158.158.35.157:24463] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aY5ETsim7ZTAHzi7xZu84wAAAQE"]
[Fri Feb 13 05:21:19.113121 2026] [:error] [pid 49223:tid 49254] [client 158.158.35.157:35992] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aY5ETx8A_fZBamNLnfUq9AAAABY"]
[Fri Feb 13 05:21:19.850611 2026] [:error] [pid 49223:tid 49237] [client 158.158.35.157:39677] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aY5ETx8A_fZBamNLnfUq-AAAAAU"]
[Fri Feb 13 05:21:20.827161 2026] [:error] [pid 51243:tid 51262] [client 158.158.35.157:24502] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aY5EUMim7ZTAHzi7xZu85wAAARE"]
[Fri Feb 13 05:21:21.696187 2026] [:error] [pid 49335:tid 49347] [client 158.158.35.157:28930] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aY5EUap--SFY2nwOiqkmtgAAAMo"]
[Fri Feb 13 05:21:22.388887 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:36028] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aY5EUqp--SFY2nwOiqkmuAAAANM"]
[Fri Feb 13 05:21:23.261293 2026] [:error] [pid 49224:tid 49283] [client 158.158.35.157:39672] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aY5EU9iAvPoWmw5YhwmGnQAAAFA"]
[Fri Feb 13 05:21:24.102143 2026] [:error] [pid 49223:tid 49235] [client 158.158.35.157:24502] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aY5EVB8A_fZBamNLnfUrAAAAAAM"]
[Fri Feb 13 05:21:25.074257 2026] [:error] [pid 49224:tid 49268] [client 158.158.35.157:32863] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aY5EVdiAvPoWmw5YhwmGowAAAEE"]
[Fri Feb 13 05:21:25.916196 2026] [:error] [pid 49335:tid 49339] [client 158.158.35.157:44382] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aY5EVap--SFY2nwOiqkmxQAAAMI"]
[Fri Feb 13 05:21:26.672664 2026] [:error] [pid 49223:tid 49249] [client 158.158.35.157:44360] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aY5EVh8A_fZBamNLnfUrBQAAABE"]
[Fri Feb 13 05:21:27.489342 2026] [:error] [pid 49223:tid 49250] [client 158.158.35.157:32861] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aY5EVx8A_fZBamNLnfUrCAAAABI"]
[Fri Feb 13 05:21:28.672571 2026] [:error] [pid 49225:tid 49317] [client 158.158.35.157:32854] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aY5EWDwH8-zGxtAd3jvOoAAAAJc"]
[Fri Feb 13 05:21:29.564074 2026] [:error] [pid 49335:tid 49349] [client 158.158.35.157:39630] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aY5EWap--SFY2nwOiqkm1gAAAMw"]
[Fri Feb 13 05:21:30.278500 2026] [:error] [pid 49225:tid 49294] [client 158.158.35.157:56198] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aY5EWjwH8-zGxtAd3jvOogAAAIA"]
[Fri Feb 13 05:21:31.059029 2026] [:error] [pid 51243:tid 51262] [client 158.158.35.157:36012] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aY5EW8im7ZTAHzi7xZu8_gAAARE"]
[Fri Feb 13 05:21:32.101773 2026] [:error] [pid 49224:tid 49287] [client 158.158.35.157:32770] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aY5EXNiAvPoWmw5YhwmGrgAAAFQ"]
[Fri Feb 13 05:21:33.010668 2026] [:error] [pid 49224:tid 49279] [client 158.158.35.157:28943] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aY5EXdiAvPoWmw5YhwmGrwAAAEw"]
[Fri Feb 13 05:21:34.024931 2026] [:error] [pid 49225:tid 49300] [client 158.158.35.157:64758] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aY5EXjwH8-zGxtAd3jvOqAAAAIY"]
[Fri Feb 13 05:21:34.673677 2026] [:error] [pid 49223:tid 49253] [client 158.158.35.157:35984] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aY5EXh8A_fZBamNLnfUrFAAAABU"]
[Fri Feb 13 05:21:35.504567 2026] [:error] [pid 49223:tid 49250] [client 158.158.35.157:56215] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aY5EXx8A_fZBamNLnfUrFQAAABI"]
[Fri Feb 13 05:21:36.283044 2026] [:error] [pid 49335:tid 49345] [client 158.158.35.157:32882] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aY5EYKp--SFY2nwOiqkm4wAAAMg"]
[Fri Feb 13 05:21:36.903271 2026] [:error] [pid 49223:tid 49243] [client 158.158.35.157:56239] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aY5EYB8A_fZBamNLnfUrGgAAAAs"]
[Fri Feb 13 05:21:37.554051 2026] [:error] [pid 49225:tid 49295] [client 158.158.35.157:4112] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aY5EYTwH8-zGxtAd3jvOsQAAAIE"]
[Fri Feb 13 05:21:38.300680 2026] [:error] [pid 49335:tid 49354] [client 158.158.35.157:32867] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aY5EYqp--SFY2nwOiqkm5gAAANE"]
[Fri Feb 13 05:21:39.234867 2026] [:error] [pid 49335:tid 49353] [client 158.158.35.157:33481] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aY5EY6p--SFY2nwOiqkm6QAAANA"]
[Fri Feb 13 05:21:39.912157 2026] [:error] [pid 51243:tid 51250] [client 158.158.35.157:38612] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kdgok.php"] [unique_id "aY5EY8im7ZTAHzi7xZu9DQAAAQU"]
[Fri Feb 13 05:21:40.631835 2026] [:error] [pid 49223:tid 49249] [client 158.158.35.157:39637] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY5EZB8A_fZBamNLnfUrJAAAABE"]
[Fri Feb 13 05:21:41.269769 2026] [:error] [pid 49335:tid 49344] [client 158.158.35.157:33476] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY5EZap--SFY2nwOiqkm9AAAAMc"]
[Fri Feb 13 05:21:42.357609 2026] [:error] [pid 49335:tid 49345] [client 158.158.35.157:36007] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY5EZqp--SFY2nwOiqkm-QAAAMg"]
[Fri Feb 13 05:21:43.439326 2026] [:error] [pid 49223:tid 49241] [client 158.158.35.157:64735] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aY5EZx8A_fZBamNLnfUrKgAAAAk"]
[Fri Feb 13 05:21:44.231082 2026] [:error] [pid 49335:tid 49359] [client 158.158.35.157:32805] [client 158.158.35.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "aY5EaKp--SFY2nwOiqkm_AAAANY"]
[Fri Feb 13 05:21:44.852808 2026] [:error] [pid 49335:tid 49361] [client 158.158.35.157:64763] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aY5EaKp--SFY2nwOiqkm_QAAANg"]
[Fri Feb 13 05:21:45.787749 2026] [:error] [pid 49335:tid 49360] [client 158.158.35.157:33493] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aY5Eaap--SFY2nwOiqknAQAAANc"]
[Fri Feb 13 05:21:46.524750 2026] [:error] [pid 51243:tid 51245] [client 158.158.35.157:32220] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aY5Easim7ZTAHzi7xZu9HQAAAQA"]
[Fri Feb 13 05:21:47.173876 2026] [:error] [pid 49224:tid 49267] [client 158.158.35.157:4286] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aY5Ea9iAvPoWmw5YhwmGxQAAAEA"]
[Fri Feb 13 05:21:48.082225 2026] [:error] [pid 49224:tid 49289] [client 158.158.35.157:33517] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aY5EbNiAvPoWmw5YhwmGyAAAAFY"]
[Fri Feb 13 05:21:49.712804 2026] [:error] [pid 51243:tid 51267] [client 158.158.35.157:32873] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aY5Ebcim7ZTAHzi7xZu9JgAAARY"]
[Fri Feb 13 05:21:52.282967 2026] [:error] [pid 49224:tid 49285] [client 158.158.35.157:38610] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aY5EcNiAvPoWmw5YhwmG0wAAAFI"]
[Fri Feb 13 05:21:53.901898 2026] [:error] [pid 49335:tid 49353] [client 158.158.35.157:32818] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aY5Ecap--SFY2nwOiqknEQAAANA"]
[Fri Feb 13 05:21:55.398912 2026] [:error] [pid 49225:tid 49304] [client 158.158.35.157:4660] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aY5EczwH8-zGxtAd3jvOxQAAAIo"]
[Fri Feb 13 05:21:55.991907 2026] [:error] [pid 51243:tid 51256] [client 158.158.35.157:27774] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aY5Ec8im7ZTAHzi7xZu9PwAAAQs"]
[Fri Feb 13 05:21:57.109388 2026] [:error] [pid 51243:tid 51254] [client 158.158.35.157:26482] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aY5Edcim7ZTAHzi7xZu9RgAAAQk"]
[Fri Feb 13 05:21:58.073429 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:64753] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aY5Edqp--SFY2nwOiqknFAAAANM"]
[Fri Feb 13 05:21:59.090428 2026] [:error] [pid 49335:tid 49343] [client 158.158.35.157:32809] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aY5Ed6p--SFY2nwOiqknGAAAAMY"]
[Fri Feb 13 05:21:59.796739 2026] [:error] [pid 49223:tid 49233] [client 158.158.35.157:32776] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aY5Edx8A_fZBamNLnfUrRwAAAAE"]
[Fri Feb 13 05:22:00.368638 2026] [:error] [pid 49335:tid 49352] [client 158.158.35.157:64712] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aY5EeKp--SFY2nwOiqknHQAAAM8"]
[Fri Feb 13 05:22:00.986306 2026] [:error] [pid 49225:tid 49311] [client 158.158.35.157:29579] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aY5EeDwH8-zGxtAd3jvO0gAAAJE"]
[Fri Feb 13 05:22:01.542381 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:4615] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aY5Eeap--SFY2nwOiqknHwAAANM"]
[Fri Feb 13 05:22:02.705868 2026] [:error] [pid 49335:tid 49338] [client 158.158.35.157:4618] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Fri Feb 13 05:22:02.953220 2026] [:error] [pid 49335:tid 49349] [client 158.158.35.157:4618] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Feb 13 05:22:03.628107 2026] [:error] [pid 49335:tid 49337] [client 158.158.35.157:4618] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 13 05:22:04.072477 2026] [:error] [pid 49335:tid 49339] [client 158.158.35.157:4618] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Feb 13 05:22:04.334186 2026] [:error] [pid 49335:tid 49352] [client 158.158.35.157:4618] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Feb 13 05:22:04.576588 2026] [:error] [pid 49335:tid 49361] [client 158.158.35.157:4618] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 13 05:22:05.324038 2026] [:error] [pid 49335:tid 49355] [client 158.158.35.157:4618] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Feb 13 05:22:05.817056 2026] [:error] [pid 49335:tid 49343] [client 158.158.35.157:4618] [client 158.158.35.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aY5Efap--SFY2nwOiqknMwAAAMY"]
[Fri Feb 13 05:22:06.678493 2026] [:error] [pid 49335:tid 49358] [client 158.158.35.157:26461] [client 158.158.35.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aY5Efqp--SFY2nwOiqknNQAAANU"]
[Fri Feb 13 05:22:07.764426 2026] [:error] [pid 51243:tid 51248] [client 158.158.35.157:26435] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aY5Ef8im7ZTAHzi7xZu9UwAAAQM"]
[Fri Feb 13 05:22:08.778232 2026] [:error] [pid 51243:tid 51268] [client 158.158.35.157:4647] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aY5EgMim7ZTAHzi7xZu9VgAAARc"]
[Fri Feb 13 05:22:10.183210 2026] [:error] [pid 49224:tid 49287] [client 158.158.35.157:32231] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aY5EgtiAvPoWmw5YhwmG9gAAAFQ"]
[Fri Feb 13 05:22:11.574018 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:36450] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aY5Egx8A_fZBamNLnfUrWQAAAA4"]
[Fri Feb 13 05:22:12.475500 2026] [:error] [pid 49223:tid 49248] [client 158.158.35.157:64273] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aY5EhB8A_fZBamNLnfUrXAAAABA"]
[Fri Feb 13 05:22:13.993922 2026] [:error] [pid 51243:tid 51251] [client 158.158.35.157:34737] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aY5Ehcim7ZTAHzi7xZu9bQAAAQY"]
[Fri Feb 13 05:22:15.452146 2026] [:error] [pid 49225:tid 49312] [client 158.158.35.157:61040] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aY5EhzwH8-zGxtAd3jvO7gAAAJI"]
[Fri Feb 13 05:22:16.445632 2026] [:error] [pid 51243:tid 51250] [client 158.158.35.157:51357] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aY5EiMim7ZTAHzi7xZu9egAAAQU"]
[Fri Feb 13 05:22:17.805442 2026] [:error] [pid 51243:tid 51257] [client 158.158.35.157:56850] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aY5Eicim7ZTAHzi7xZu9fwAAAQw"]
[Fri Feb 13 05:22:19.959527 2026] [:error] [pid 51243:tid 51249] [client 158.158.35.157:50691] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aY5Ei8im7ZTAHzi7xZu9ggAAAQQ"]
[Fri Feb 13 05:22:20.948828 2026] [:error] [pid 51243:tid 51265] [client 158.158.35.157:24163] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aY5EjMim7ZTAHzi7xZu9hgAAARQ"]
[Fri Feb 13 05:22:22.103498 2026] [:error] [pid 51243:tid 51261] [client 158.158.35.157:24182] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aY5Ejsim7ZTAHzi7xZu9iQAAARA"]
[Fri Feb 13 05:22:23.450025 2026] [:error] [pid 49223:tid 49254] [client 158.158.35.157:48933] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aY5Ejx8A_fZBamNLnfUrfQAAABY"]
[Fri Feb 13 05:22:24.989100 2026] [:error] [pid 49225:tid 49312] [client 158.158.35.157:56268] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aY5EkDwH8-zGxtAd3jvPCQAAAJI"]
[Fri Feb 13 05:22:26.198862 2026] [:error] [pid 49335:tid 49345] [client 158.158.35.157:31549] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aY5Ekqp--SFY2nwOiqknVQAAAMg"]
[Fri Feb 13 05:22:27.077388 2026] [:error] [pid 49335:tid 49337] [client 158.158.35.157:35166] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aY5Ek6p--SFY2nwOiqknWgAAAMA"]
[Fri Feb 13 05:22:28.068352 2026] [:error] [pid 49225:tid 49311] [client 158.158.35.157:64197] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aY5ElDwH8-zGxtAd3jvPEQAAAJE"]
[Fri Feb 13 05:22:29.284781 2026] [:error] [pid 49335:tid 49340] [client 158.158.35.157:50642] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aY5Elap--SFY2nwOiqknYwAAAMM"]
[Fri Feb 13 05:22:30.498636 2026] [:error] [pid 49223:tid 49235] [client 158.158.35.157:47338] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aY5Elh8A_fZBamNLnfUrkgAAAAM"]
[Fri Feb 13 05:22:31.726182 2026] [:error] [pid 49335:tid 49354] [client 158.158.35.157:57853] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aY5El6p--SFY2nwOiqknbgAAANE"]
[Fri Feb 13 05:22:33.129801 2026] [:error] [pid 49224:tid 49288] [client 158.158.35.157:30248] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aY5EmdiAvPoWmw5YhwmHHQAAAFU"]
[Fri Feb 13 05:22:35.345238 2026] [:error] [pid 49224:tid 49286] [client 158.158.35.157:50737] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aY5Em9iAvPoWmw5YhwmHIwAAAFM"]
[Fri Feb 13 05:22:36.416278 2026] [:error] [pid 49223:tid 49251] [client 158.158.35.157:50731] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aY5EnB8A_fZBamNLnfUrpgAAABM"]
[Fri Feb 13 05:22:39.343207 2026] [:error] [pid 49224:tid 49285] [client 158.158.35.157:50684] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY5En9iAvPoWmw5YhwmHLQAAAFI"]
[Fri Feb 13 05:22:41.326752 2026] [:error] [pid 51243:tid 51251] [client 158.158.35.157:24068] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY5Eocim7ZTAHzi7xZu9pwAAAQY"]
[Fri Feb 13 05:22:42.187102 2026] [:error] [pid 49223:tid 49251] [client 158.158.35.157:4501] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY5Eoh8A_fZBamNLnfUrswAAABM"]
[Fri Feb 13 05:22:42.979391 2026] [:error] [pid 49224:tid 49267] [client 158.158.35.157:56259] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY5EotiAvPoWmw5YhwmHNwAAAEA"]
[Fri Feb 13 05:22:44.388632 2026] [:error] [pid 49224:tid 49290] [client 158.158.35.157:63078] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aY5EpNiAvPoWmw5YhwmHPgAAAFc"]
[Fri Feb 13 05:22:45.840301 2026] [:error] [pid 49224:tid 49271] [client 158.158.35.157:25129] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aY5EpdiAvPoWmw5YhwmHRwAAAEQ"]
[Fri Feb 13 05:22:47.171462 2026] [:error] [pid 49223:tid 49254] [client 158.158.35.157:24065] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aY5Epx8A_fZBamNLnfUrvQAAABY"]
[Fri Feb 13 05:22:48.660250 2026] [:error] [pid 49335:tid 49352] [client 158.158.35.157:50663] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aY5EqKp--SFY2nwOiqknoQAAAM8"]
[Fri Feb 13 05:22:49.486542 2026] [:error] [pid 49225:tid 49301] [client 158.158.35.157:63052] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aY5EqTwH8-zGxtAd3jvPJgAAAIc"]
[Fri Feb 13 05:22:50.105138 2026] [:error] [pid 49335:tid 49342] [client 158.158.35.157:57819] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aY5Eqqp--SFY2nwOiqknpAAAAMU"]
[Fri Feb 13 05:22:50.746282 2026] [:error] [pid 51243:tid 51268] [client 158.158.35.157:56286] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aY5Eqsim7ZTAHzi7xZu9sgAAARc"]
[Fri Feb 13 05:22:52.062646 2026] [:error] [pid 51243:tid 51265] [client 158.158.35.157:31492] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aY5ErMim7ZTAHzi7xZu9tQAAARQ"]
[Fri Feb 13 05:22:53.111475 2026] [:error] [pid 49223:tid 49245] [client 158.158.35.157:63099] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aY5ErR8A_fZBamNLnfUrzQAAAA0"]
[Fri Feb 13 05:22:54.187267 2026] [:error] [pid 51243:tid 51256] [client 158.158.35.157:5017] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aY5Ersim7ZTAHzi7xZu9twAAAQs"]
[Fri Feb 13 05:22:55.588075 2026] [:error] [pid 51243:tid 51257] [client 158.158.35.157:4482] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aY5Er8im7ZTAHzi7xZu9ugAAAQw"]
[Fri Feb 13 05:22:56.752038 2026] [:error] [pid 49224:tid 49273] [client 158.158.35.157:4526] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aY5EsNiAvPoWmw5YhwmHTwAAAEY"]
[Fri Feb 13 05:22:57.577128 2026] [:error] [pid 49335:tid 49350] [client 158.158.35.157:48915] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aY5Esap--SFY2nwOiqknuwAAAM0"]
[Fri Feb 13 05:22:58.805706 2026] [:error] [pid 49224:tid 49284] [client 158.158.35.157:24122] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aY5EstiAvPoWmw5YhwmHUwAAAFE"]
[Fri Feb 13 05:23:00.206132 2026] [:error] [pid 49225:tid 49315] [client 158.158.35.157:24083] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aY5EtDwH8-zGxtAd3jvPNgAAAJU"]
[Fri Feb 13 05:23:01.792945 2026] [:error] [pid 49335:tid 49337] [client 158.158.35.157:35163] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aY5Etap--SFY2nwOiqknyAAAAMA"]
[Fri Feb 13 05:23:02.871896 2026] [:error] [pid 49335:tid 49357] [client 158.158.35.157:63049] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aY5Etqp--SFY2nwOiqknzQAAANQ"]
[Fri Feb 13 05:23:03.610480 2026] [:error] [pid 49225:tid 49318] [client 158.158.35.157:57843] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aY5EtzwH8-zGxtAd3jvPPQAAAJg"]
[Fri Feb 13 05:23:04.784858 2026] [:error] [pid 49225:tid 49306] [client 158.158.35.157:5032] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aY5EuDwH8-zGxtAd3jvPQAAAAIw"]
[Fri Feb 13 05:23:06.228879 2026] [:error] [pid 49223:tid 49241] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri Feb 13 05:23:06.471671 2026] [:error] [pid 49223:tid 49245] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/bs2.php
[Fri Feb 13 05:23:07.368379 2026] [:error] [pid 49223:tid 49240] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Fri Feb 13 05:23:07.611849 2026] [:error] [pid 49223:tid 49233] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-site.php
[Fri Feb 13 05:23:07.878295 2026] [:error] [pid 49223:tid 49237] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/tmpls.php
[Fri Feb 13 05:23:08.121440 2026] [:error] [pid 49223:tid 49236] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Fri Feb 13 05:23:08.371165 2026] [:error] [pid 49223:tid 49255] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/yawa.php
[Fri Feb 13 05:23:08.619976 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/revision.php
[Fri Feb 13 05:23:08.858852 2026] [:error] [pid 49223:tid 49252] [client 158.158.35.157:31525] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aY5EvB8A_fZBamNLnfUr_QAAABQ"]
[Fri Feb 13 05:23:09.620615 2026] [:error] [pid 49223:tid 49254] [client 158.158.35.157:31506] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aY5EvR8A_fZBamNLnfUsAQAAABY"]
[Fri Feb 13 05:23:10.726712 2026] [:error] [pid 49335:tid 49342] [client 158.158.35.157:57837] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aY5Evqp--SFY2nwOiqkn4gAAAMU"]
[Fri Feb 13 05:23:11.925013 2026] [:error] [pid 51243:tid 51264] [client 158.158.35.157:34165] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aY5Ev8im7ZTAHzi7xZu92QAAARM"]
[Fri Feb 13 05:23:12.614883 2026] [:error] [pid 49335:tid 49343] [client 158.158.35.157:37315] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aY5EwKp--SFY2nwOiqkn5gAAAMY"]
[Fri Feb 13 05:23:14.082486 2026] [:error] [pid 49224:tid 49280] [client 158.158.35.157:50697] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aY5EwtiAvPoWmw5YhwmHewAAAE0"]
[Fri Feb 13 05:23:15.302994 2026] [:error] [pid 49335:tid 49337] [client 158.158.35.157:30212] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aY5Ew6p--SFY2nwOiqkn6wAAAMA"]
[Fri Feb 13 05:23:16.376763 2026] [:error] [pid 49225:tid 49314] [client 158.158.35.157:64242] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aY5ExDwH8-zGxtAd3jvPTgAAAJQ"]
[Fri Feb 13 05:23:17.322084 2026] [:error] [pid 49335:tid 49352] [client 158.158.35.157:24165] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY5Exap--SFY2nwOiqkn7wAAAM8"]
[Fri Feb 13 05:23:18.475277 2026] [:error] [pid 49225:tid 49305] [client 158.158.35.157:27017] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY5ExjwH8-zGxtAd3jvPVAAAAIs"]
[Fri Feb 13 05:23:19.312030 2026] [:error] [pid 51243:tid 51246] [client 158.158.35.157:4599] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY5Ex8im7ZTAHzi7xZu93gAAAQE"]
[Fri Feb 13 05:23:20.210198 2026] [:error] [pid 49224:tid 49290] [client 158.158.35.157:58544] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY5EyNiAvPoWmw5YhwmHlgAAAFc"]
[Fri Feb 13 05:23:21.208733 2026] [:error] [pid 49335:tid 49338] [client 158.158.35.157:32195] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aY5Eyap--SFY2nwOiqkn_QAAAME"]
[Fri Feb 13 05:23:22.471565 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:64752] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aY5Eyqp--SFY2nwOiqkoAQAAANM"]
[Fri Feb 13 05:23:23.545561 2026] [:error] [pid 49223:tid 49247] [client 158.158.35.157:33516] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aY5Eyx8A_fZBamNLnfUsGAAAAA8"]
[Fri Feb 13 05:23:24.646490 2026] [:error] [pid 49225:tid 49314] [client 158.158.35.157:4159] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aY5EzDwH8-zGxtAd3jvPWwAAAJQ"]
[Fri Feb 13 05:23:25.858785 2026] [:error] [pid 49223:tid 49232] [client 158.158.35.157:51313] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aY5EzR8A_fZBamNLnfUsGwAAAAA"]
[Fri Feb 13 05:23:27.613880 2026] [:error] [pid 49225:tid 49304] [client 158.158.35.157:24468] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aY5EzzwH8-zGxtAd3jvPaAAAAIo"]
[Fri Feb 13 05:23:28.668566 2026] [:error] [pid 51243:tid 51254] [client 158.158.35.157:38586] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aY5E0Mim7ZTAHzi7xZu9_QAAAQk"]
[Fri Feb 13 05:23:30.217387 2026] [:error] [pid 49335:tid 49338] [client 158.158.35.157:44975] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aY5E0qp--SFY2nwOiqkoFgAAAME"]
[Fri Feb 13 05:23:31.314922 2026] [:error] [pid 49335:tid 49342] [client 158.158.35.157:4880] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aY5E06p--SFY2nwOiqkoFwAAAMU"]
[Fri Feb 13 05:23:32.369862 2026] [:error] [pid 49224:tid 49270] [client 158.158.35.157:44989] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aY5E1NiAvPoWmw5YhwmHvgAAAEM"]
[Fri Feb 13 05:23:33.397735 2026] [:error] [pid 49223:tid 49239] [client 158.158.35.157:31525] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aY5E1R8A_fZBamNLnfUsKgAAAAc"]
[Fri Feb 13 05:23:34.454650 2026] [:error] [pid 49335:tid 49360] [client 158.158.35.157:44997] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aY5E1qp--SFY2nwOiqkoIAAAANc"]
[Fri Feb 13 05:23:35.504294 2026] [:error] [pid 49223:tid 49235] [client 158.158.35.157:38568] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aY5E1x8A_fZBamNLnfUsMQAAAAM"]
[Fri Feb 13 05:23:36.425459 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:38568] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aY5E2Kp--SFY2nwOiqkoKQAAANM"]
[Fri Feb 13 05:23:37.103590 2026] [:error] [pid 49225:tid 49316] [client 158.158.35.157:24488] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aY5E2TwH8-zGxtAd3jvPggAAAJY"]
[Fri Feb 13 05:23:37.907155 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:4869] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "aY5E2R8A_fZBamNLnfUsNgAAAA4"]
[Fri Feb 13 05:23:38.800039 2026] [:error] [pid 51243:tid 51256] [client 158.158.35.157:44947] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aY5E2sim7ZTAHzi7xZu-DQAAAQs"]
[Fri Feb 13 05:23:39.485637 2026] [:error] [pid 49225:tid 49294] [client 158.158.35.157:4314] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aY5E2zwH8-zGxtAd3jvPiQAAAIA"]
[Fri Feb 13 05:23:40.199663 2026] [:error] [pid 51243:tid 51267] [client 158.158.35.157:58956] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aY5E3Mim7ZTAHzi7xZu-EAAAARY"]
[Fri Feb 13 05:23:41.108074 2026] [:error] [pid 49335:tid 49346] [client 158.158.35.157:59006] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zfile.php"] [unique_id "aY5E3ap--SFY2nwOiqkoOAAAAMk"]
[Fri Feb 13 05:23:42.179275 2026] [:error] [pid 49225:tid 49299] [client 158.158.35.157:28995] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aY5E3jwH8-zGxtAd3jvPkAAAAIU"]
[Fri Feb 13 05:23:43.005785 2026] [:error] [pid 49335:tid 49345] [client 158.158.35.157:45002] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aY5E36p--SFY2nwOiqkoPgAAAMg"]
[Fri Feb 13 05:23:43.845056 2026] [:error] [pid 49225:tid 49306] [client 158.158.35.157:50141] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aY5E3zwH8-zGxtAd3jvPkwAAAIw"]
[Fri Feb 13 05:23:44.685733 2026] [:error] [pid 49335:tid 49349] [client 158.158.35.157:50164] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aY5E4Kp--SFY2nwOiqkoRQAAAMw"]
[Fri Feb 13 05:23:45.444425 2026] [:error] [pid 49224:tid 49286] [client 158.158.35.157:4296] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aY5E4diAvPoWmw5YhwmH3gAAAFM"]
[Fri Feb 13 05:23:46.220607 2026] [:error] [pid 49223:tid 49251] [client 158.158.35.157:24471] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aY5E4h8A_fZBamNLnfUsSwAAABM"]
[Fri Feb 13 05:23:47.117512 2026] [:error] [pid 49225:tid 49298] [client 158.158.35.157:51290] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aY5E4zwH8-zGxtAd3jvPnwAAAIQ"]
[Fri Feb 13 05:23:48.188401 2026] [:error] [pid 49335:tid 49349] [client 158.158.35.157:4329] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aY5E5Kp--SFY2nwOiqkoTQAAAMw"]
[Fri Feb 13 05:23:49.309125 2026] [:error] [pid 49223:tid 49254] [client 158.158.35.157:4307] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aY5E5R8A_fZBamNLnfUsUAAAABY"]
[Fri Feb 13 05:23:49.949605 2026] [:error] [pid 49225:tid 49302] [client 158.158.35.157:4875] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aY5E5TwH8-zGxtAd3jvPpwAAAIg"]
[Fri Feb 13 05:23:51.614469 2026] [:error] [pid 49223:tid 49253] [client 158.158.35.157:34054] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aY5E5x8A_fZBamNLnfUsUgAAABU"]
[Fri Feb 13 05:23:53.688986 2026] [:error] [pid 49335:tid 49351] [client 158.158.35.157:58973] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aY5E6ap--SFY2nwOiqkoWwAAAM4"]
[Fri Feb 13 05:23:59.397809 2026] [:error] [pid 49225:tid 49311] [client 158.158.35.157:29010] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aY5E7zwH8-zGxtAd3jvPtQAAAJE"]
[Fri Feb 13 05:24:01.934004 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:50129] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aY5E8ap--SFY2nwOiqkoeQAAANM"]
[Fri Feb 13 05:24:04.344823 2026] [:error] [pid 49225:tid 49314] [client 158.158.35.157:4306] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aY5E9DwH8-zGxtAd3jvPxAAAAJQ"]
[Fri Feb 13 05:24:05.733725 2026] [:error] [pid 49224:tid 49267] [client 158.158.35.157:45008] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aY5E9diAvPoWmw5YhwmIEwAAAEA"]
[Fri Feb 13 05:24:07.110451 2026] [:error] [pid 49225:tid 49300] [client 158.158.35.157:45632] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aY5E9zwH8-zGxtAd3jvPzAAAAIY"]
[Fri Feb 13 05:24:09.055288 2026] [:error] [pid 49224:tid 49283] [client 158.158.35.157:38591] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 13 05:24:09.300424 2026] [:error] [pid 49224:tid 49271] [client 158.158.35.157:38591] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 13 05:24:09.543502 2026] [:error] [pid 49224:tid 49282] [client 158.158.35.157:38591] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Feb 13 05:24:09.785102 2026] [:error] [pid 49224:tid 49278] [client 158.158.35.157:38591] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Fri Feb 13 05:24:11.021673 2026] [:error] [pid 49224:tid 49279] [client 158.158.35.157:38591] [client 158.158.35.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aY5E-9iAvPoWmw5YhwmIKgAAAEw"]
[Fri Feb 13 05:24:13.608878 2026] [:error] [pid 49225:tid 49312] [client 158.158.35.157:45022] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Feb 13 05:24:13.854487 2026] [:error] [pid 49225:tid 49295] [client 158.158.35.157:45022] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-tot.php
[Fri Feb 13 05:24:14.122225 2026] [:error] [pid 49225:tid 49317] [client 158.158.35.157:45022] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Feb 13 05:24:14.370252 2026] [:error] [pid 49225:tid 49303] [client 158.158.35.157:45022] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Feb 13 05:24:14.613487 2026] [:error] [pid 49225:tid 49308] [client 158.158.35.157:45022] File does not exist: /usr/local/apache/htdocs/suspended-page/wbbw.php
[Fri Feb 13 05:24:14.866816 2026] [:error] [pid 49225:tid 49316] [client 158.158.35.157:45022] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Fri Feb 13 05:24:15.137761 2026] [:error] [pid 49225:tid 49297] [client 158.158.35.157:45022] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aY5E_zwH8-zGxtAd3jvP7wAAAIM"]
[Fri Feb 13 05:24:16.133630 2026] [:error] [pid 49225:tid 49307] [client 158.158.35.157:51275] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aY5FADwH8-zGxtAd3jvP8gAAAI0"]
[Fri Feb 13 05:24:17.218144 2026] [:error] [pid 49223:tid 49256] [client 158.158.35.157:38532] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aY5FAR8A_fZBamNLnfUslwAAABg"]
[Fri Feb 13 05:24:19.453230 2026] [:error] [pid 49335:tid 49360] [client 158.158.35.157:51299] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acxx.php"] [unique_id "aY5FA6p--SFY2nwOiqkooAAAANc"]
[Fri Feb 13 05:24:21.072262 2026] [:error] [pid 49225:tid 49314] [client 158.158.35.157:29036] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aY5FBTwH8-zGxtAd3jvP_wAAAJQ"]
[Fri Feb 13 05:24:22.504620 2026] [:error] [pid 51243:tid 51264] [client 158.158.35.157:4302] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aY5FBsim7ZTAHzi7xZu-YAAAARM"]
[Fri Feb 13 05:24:23.613157 2026] [:error] [pid 49224:tid 49272] [client 158.158.35.157:45680] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aY5FB9iAvPoWmw5YhwmIQQAAAEU"]
[Fri Feb 13 05:24:24.309286 2026] [:error] [pid 49224:tid 49281] [client 158.158.35.157:44995] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aY5FCNiAvPoWmw5YhwmIQwAAAE4"]
[Fri Feb 13 05:24:25.434774 2026] [:error] [pid 49225:tid 49307] [client 158.158.35.157:50173] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aY5FCTwH8-zGxtAd3jvQDgAAAI0"]
[Fri Feb 13 05:24:26.206319 2026] [:error] [pid 49225:tid 49309] [client 158.158.35.157:45046] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aY5FCjwH8-zGxtAd3jvQEQAAAI8"]
[Fri Feb 13 05:24:26.867154 2026] [:error] [pid 51243:tid 51265] [client 158.158.35.157:4318] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aY5FCsim7ZTAHzi7xZu-aQAAARQ"]
[Fri Feb 13 05:24:27.425254 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:29026] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aY5FCx8A_fZBamNLnfUsoQAAAA4"]
[Fri Feb 13 05:24:28.034722 2026] [:error] [pid 49225:tid 49299] [client 158.158.35.157:45633] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY5FDDwH8-zGxtAd3jvQHwAAAIU"]
[Fri Feb 13 05:24:28.617713 2026] [:error] [pid 49225:tid 49313] [client 158.158.35.157:44955] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY5FDDwH8-zGxtAd3jvQIwAAAJM"]
[Fri Feb 13 05:24:29.402892 2026] [:error] [pid 49335:tid 49339] [client 158.158.35.157:58963] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY5FDap--SFY2nwOiqkotAAAAMI"]
[Fri Feb 13 05:24:29.950726 2026] [:error] [pid 49224:tid 49269] [client 158.158.35.157:34103] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY5FDdiAvPoWmw5YhwmITAAAAEI"]
[Fri Feb 13 05:24:30.901345 2026] [:error] [pid 51243:tid 51255] [client 158.158.35.157:58984] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY5FDsim7ZTAHzi7xZu-bQAAAQo"]
[Fri Feb 13 05:24:31.597653 2026] [:error] [pid 49223:tid 49236] [client 158.158.35.157:50161] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY5FDx8A_fZBamNLnfUspgAAAAQ"]
[Fri Feb 13 05:24:32.353620 2026] [:error] [pid 49225:tid 49318] [client 158.158.35.157:50117] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY5FEDwH8-zGxtAd3jvQLAAAAJg"]
[Fri Feb 13 05:24:32.848776 2026] [:error] [pid 49224:tid 49288] [client 158.158.35.157:34078] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aY5FENiAvPoWmw5YhwmIUwAAAFU"]
[Fri Feb 13 05:24:33.656633 2026] [:error] [pid 49335:tid 49357] [client 158.158.35.157:41325] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aY5FEap--SFY2nwOiqkoxAAAANQ"]
[Fri Feb 13 05:24:34.507471 2026] [:error] [pid 49335:tid 49360] [client 158.158.35.157:51304] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aY5FEqp--SFY2nwOiqkoyAAAANc"]
[Fri Feb 13 05:24:35.123406 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:4335] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aY5FE6p--SFY2nwOiqkozAAAANM"]
[Fri Feb 13 05:24:35.814645 2026] [:error] [pid 51243:tid 51253] [client 158.158.35.157:34056] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aY5FE8im7ZTAHzi7xZu-dgAAAQg"]
[Fri Feb 13 05:24:36.776056 2026] [:error] [pid 49223:tid 49251] [client 158.158.35.157:45014] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aY5FFB8A_fZBamNLnfUsrQAAABM"]
[Fri Feb 13 05:24:37.669843 2026] [:error] [pid 49223:tid 49237] [client 158.158.35.157:45670] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aY5FFR8A_fZBamNLnfUssgAAAAU"]
[Fri Feb 13 05:24:38.447119 2026] [:error] [pid 49223:tid 49232] [client 158.158.35.157:45637] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aY5FFh8A_fZBamNLnfUsswAAAAA"]
[Fri Feb 13 05:24:39.119976 2026] [:error] [pid 49335:tid 49358] [client 158.158.35.157:23810] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aY5FF6p--SFY2nwOiqko3wAAANU"]
[Fri Feb 13 05:24:39.821845 2026] [:error] [pid 49224:tid 49282] [client 158.158.35.157:4309] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "aY5FF9iAvPoWmw5YhwmIagAAAE8"]
[Fri Feb 13 05:24:41.014241 2026] [:error] [pid 49223:tid 49255] [client 158.158.35.157:36013] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "aY5FGR8A_fZBamNLnfUstwAAABc"]
[Fri Feb 13 05:24:41.921878 2026] [:error] [pid 49224:tid 49269] [client 158.158.35.157:38543] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "aY5FGdiAvPoWmw5YhwmIbQAAAEI"]
[Fri Feb 13 05:24:42.612189 2026] [:error] [pid 51243:tid 51263] [client 158.158.35.157:63496] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "aY5FGsim7ZTAHzi7xZu-igAAARI"]
[Fri Feb 13 05:24:43.369596 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:63521] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY5FGx8A_fZBamNLnfUsvAAAAA4"]
[Fri Feb 13 05:24:44.048898 2026] [:error] [pid 49335:tid 49348] [client 158.158.35.157:63522] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY5FHKp--SFY2nwOiqko7AAAAMs"]
[Fri Feb 13 05:24:44.676423 2026] [:error] [pid 49335:tid 49356] [client 158.158.35.157:63496] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY5FHKp--SFY2nwOiqko7wAAANM"]
[Fri Feb 13 05:24:45.290175 2026] [:error] [pid 51243:tid 51265] [client 158.158.35.157:59745] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY5FHcim7ZTAHzi7xZu-jQAAARQ"]
[Fri Feb 13 05:24:45.970574 2026] [:error] [pid 49224:tid 49274] [client 158.158.35.157:59651] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY5FHdiAvPoWmw5YhwmIcQAAAEc"]
[Fri Feb 13 05:24:46.680794 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:50211] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY5FHh8A_fZBamNLnfUsxwAAAA4"]
[Fri Feb 13 05:24:47.555957 2026] [:error] [pid 49225:tid 49313] [client 158.158.35.157:50188] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY5FHzwH8-zGxtAd3jvQWwAAAJM"]
[Fri Feb 13 05:24:48.482182 2026] [:error] [pid 49225:tid 49317] [client 158.158.35.157:40099] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY5FIDwH8-zGxtAd3jvQYwAAAJc"]
[Fri Feb 13 05:24:49.345280 2026] [:error] [pid 49224:tid 49279] [client 158.158.35.157:40108] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aY5FIdiAvPoWmw5YhwmIdgAAAEw"]
[Fri Feb 13 05:24:50.339099 2026] [:error] [pid 51243:tid 51258] [client 158.158.35.157:45625] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aY5FIsim7ZTAHzi7xZu-lAAAAQ0"]
[Fri Feb 13 05:24:51.427719 2026] [:error] [pid 51243:tid 51269] [client 158.158.35.157:46723] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aY5FI8im7ZTAHzi7xZu-mQAAARg"]
[Fri Feb 13 05:24:52.482609 2026] [:error] [pid 49223:tid 49246] [client 158.158.35.157:57781] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sim.php"] [unique_id "aY5FJB8A_fZBamNLnfUs0AAAAA4"]
[Fri Feb 13 05:24:53.212356 2026] [:error] [pid 49224:tid 49283] [client 158.158.35.157:63017] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aY5FJdiAvPoWmw5YhwmIfQAAAFA"]
[Fri Feb 13 05:24:53.781965 2026] [:error] [pid 49335:tid 49361] [client 158.158.35.157:46783] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aY5FJap--SFY2nwOiqkpCgAAANg"]
[Fri Feb 13 05:24:54.504497 2026] [:error] [pid 49335:tid 49360] [client 158.158.35.157:62977] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aY5FJqp--SFY2nwOiqkpEAAAANc"]
[Fri Feb 13 05:24:55.228430 2026] [:error] [pid 49335:tid 49339] [client 158.158.35.157:30319] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aY5FJ6p--SFY2nwOiqkpFAAAAMI"]
[Fri Feb 13 05:24:56.022981 2026] [:error] [pid 49225:tid 49305] [client 158.158.35.157:32231] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aY5FKDwH8-zGxtAd3jvQcgAAAIs"]
[Fri Feb 13 05:24:56.729481 2026] [:error] [pid 49223:tid 49250] [client 158.158.35.157:43898] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aY5FKB8A_fZBamNLnfUs1QAAABI"]
[Fri Feb 13 05:24:57.425310 2026] [:error] [pid 51243:tid 51245] [client 158.158.35.157:54931] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aY5FKcim7ZTAHzi7xZu-ogAAAQA"]
[Fri Feb 13 05:24:58.062719 2026] [:error] [pid 49225:tid 49301] [client 158.158.35.157:60520] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aY5FKjwH8-zGxtAd3jvQdwAAAIc"]
[Fri Feb 13 05:24:58.579429 2026] [:error] [pid 49335:tid 49357] [client 158.158.35.157:62990] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aY5FKqp--SFY2nwOiqkpHwAAANQ"]
[Fri Feb 13 05:24:59.395911 2026] [:error] [pid 49223:tid 49236] [client 158.158.35.157:29652] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aY5FKx8A_fZBamNLnfUs3AAAAAQ"]
[Fri Feb 13 05:24:59.987235 2026] [:error] [pid 51243:tid 51260] [client 158.158.35.157:62981] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aY5FK8im7ZTAHzi7xZu-qAAAAQ8"]
[Fri Feb 13 05:25:00.842312 2026] [:error] [pid 49335:tid 49350] [client 158.158.35.157:54388] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aY5FLKp--SFY2nwOiqkpJwAAAM0"]
[Fri Feb 13 05:25:01.453729 2026] [:error] [pid 49335:tid 49347] [client 158.158.35.157:60496] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aY5FLap--SFY2nwOiqkpKQAAAMo"]
[Fri Feb 13 05:25:01.976518 2026] [:error] [pid 51243:tid 51267] [client 158.158.35.157:58935] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aY5FLcim7ZTAHzi7xZu-rQAAARY"]
[Fri Feb 13 05:25:02.533826 2026] [:error] [pid 51243:tid 51259] [client 158.158.35.157:62660] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aY5FLsim7ZTAHzi7xZu-rgAAAQ4"]
[Fri Feb 13 05:25:03.222432 2026] [:error] [pid 49224:tid 49269] [client 158.158.35.157:63038] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aY5FL9iAvPoWmw5YhwmIigAAAEI"]
[Fri Feb 13 05:25:03.755707 2026] [:error] [pid 49224:tid 49276] [client 158.158.35.157:54370] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aY5FL9iAvPoWmw5YhwmIjgAAAEk"]
[Fri Feb 13 05:25:04.296185 2026] [:error] [pid 49335:tid 49357] [client 158.158.35.157:58583] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aY5FMKp--SFY2nwOiqkpLwAAANQ"]
[Fri Feb 13 05:25:04.903906 2026] [:error] [pid 49224:tid 49277] [client 158.158.35.157:41950] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aY5FMNiAvPoWmw5YhwmIjwAAAEo"]
[Fri Feb 13 05:25:05.599590 2026] [:error] [pid 49335:tid 49361] [client 158.158.35.157:58916] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aY5FMap--SFY2nwOiqkpNQAAANg"]
[Fri Feb 13 05:25:06.361809 2026] [:error] [pid 49225:tid 49294] [client 158.158.35.157:4696] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aY5FMjwH8-zGxtAd3jvQkwAAAIA"]
[Fri Feb 13 05:25:07.106226 2026] [:error] [pid 49223:tid 49237] [client 158.158.35.157:41966] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aY5FMx8A_fZBamNLnfUs6wAAAAU"]
[Fri Feb 13 05:25:07.806822 2026] [:error] [pid 49225:tid 49315] [client 158.158.35.157:60504] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aY5FMzwH8-zGxtAd3jvQmAAAAJU"]
[Fri Feb 13 05:25:08.584894 2026] [:error] [pid 51243:tid 51247] [client 158.158.35.157:52437] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aY5FNMim7ZTAHzi7xZu-vgAAAQI"]
[Fri Feb 13 05:25:09.168568 2026] [:error] [pid 49225:tid 49309] [client 158.158.35.157:48859] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aY5FNTwH8-zGxtAd3jvQnQAAAI8"]
[Fri Feb 13 05:25:10.433651 2026] [:error] [pid 49225:tid 49300] [client 158.158.35.157:53714] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aY5FNjwH8-zGxtAd3jvQnwAAAIY"]
[Fri Feb 13 05:25:11.387963 2026] [:error] [pid 49225:tid 49312] [client 158.158.35.157:46672] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aY5FNzwH8-zGxtAd3jvQpAAAAJI"]
[Fri Feb 13 05:25:13.194531 2026] [:error] [pid 49335:tid 49340] [client 158.158.35.157:26400] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "aY5FOap--SFY2nwOiqkpTwAAAMM"]
[Fri Feb 13 05:25:14.856294 2026] [:error] [pid 49225:tid 49297] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Fri Feb 13 05:25:15.099060 2026] [:error] [pid 49225:tid 49318] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/backup.php
[Fri Feb 13 05:25:15.342006 2026] [:error] [pid 49225:tid 49307] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Fri Feb 13 05:25:15.592853 2026] [:error] [pid 49225:tid 49304] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Fri Feb 13 05:25:15.836815 2026] [:error] [pid 49225:tid 49306] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Feb 13 05:25:16.094152 2026] [:error] [pid 49225:tid 49312] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 13 05:25:16.748260 2026] [:error] [pid 49225:tid 49302] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/styles.php
[Fri Feb 13 05:25:17.004706 2026] [:error] [pid 49225:tid 49311] [client 158.158.35.157:25820] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Feb 13 05:25:17.246812 2026] [:error] [pid 49225:tid 49315] [client 158.158.35.157:25820] [client 158.158.35.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aY5FPTwH8-zGxtAd3jvQtgAAAJU"]
[Fri Feb 13 05:25:18.474226 2026] [:error] [pid 51243:tid 51265] [client 158.158.35.157:64817] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Fri Feb 13 05:25:18.721507 2026] [:error] [pid 51243:tid 51248] [client 158.158.35.157:64817] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Fri Feb 13 05:25:19.358768 2026] [:error] [pid 51243:tid 51253] [client 158.158.35.157:64817] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aY5FP8im7ZTAHzi7xZu-0QAAAQg"]
[Fri Feb 13 05:25:20.320003 2026] [:error] [pid 49223:tid 49232] [client 158.158.35.157:4767] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aY5FQB8A_fZBamNLnfUtBwAAAAA"]
[Fri Feb 13 05:25:21.429616 2026] [:error] [pid 49335:tid 49352] [client 158.158.35.157:55620] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aY5FQap--SFY2nwOiqkpbQAAAM8"]
[Fri Feb 13 05:25:22.689708 2026] [:error] [pid 49335:tid 49347] [client 158.158.35.157:53713] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aY5FQqp--SFY2nwOiqkpcwAAAMo"]
[Fri Feb 13 05:25:24.202468 2026] [:error] [pid 49225:tid 49296] [client 158.158.35.157:52468] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aY5FRDwH8-zGxtAd3jvQxAAAAII"]
[Fri Feb 13 05:25:25.281713 2026] [:error] [pid 51243:tid 51256] [client 158.158.35.157:59177] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aY5FRcim7ZTAHzi7xZu-3wAAAQs"]
[Fri Feb 13 05:25:26.925736 2026] [:error] [pid 49223:tid 49234] [client 158.158.35.157:55645] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aY5FRh8A_fZBamNLnfUtEQAAAAI"]
[Fri Feb 13 05:25:27.798273 2026] [:error] [pid 51243:tid 51265] [client 158.158.35.157:4736] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aY5FR8im7ZTAHzi7xZu-6QAAARQ"]
[Fri Feb 13 05:25:28.734332 2026] [:error] [pid 49223:tid 49251] [client 158.158.35.157:4779] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aY5FSB8A_fZBamNLnfUtGAAAABM"]
[Fri Feb 13 05:25:29.788564 2026] [:error] [pid 49224:tid 49267] [client 158.158.35.157:62649] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aY5FSdiAvPoWmw5YhwmIyQAAAEA"]
[Fri Feb 13 05:25:31.060720 2026] [:error] [pid 49223:tid 49239] [client 158.158.35.157:55570] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aY5FSx8A_fZBamNLnfUtGwAAAAc"]
[Fri Feb 13 05:25:32.775878 2026] [:error] [pid 49335:tid 49353] [client 158.158.35.157:62626] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aY5FTKp--SFY2nwOiqkpmgAAANA"]
[Fri Feb 13 05:25:34.102937 2026] [:error] [pid 49224:tid 49291] [client 158.158.35.157:46154] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aY5FTtiAvPoWmw5YhwmI2QAAAFg"]
[Fri Feb 13 05:25:36.150094 2026] [:error] [pid 49223:tid 49250] [client 158.158.35.157:25153] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aY5FUB8A_fZBamNLnfUtKQAAABI"]
[Fri Feb 13 05:25:36.999954 2026] [:error] [pid 49335:tid 49337] [client 158.158.35.157:60974] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aY5FUKp--SFY2nwOiqkprQAAAMA"]
[Fri Feb 13 05:25:38.442074 2026] [:error] [pid 49223:tid 49243] [client 158.158.35.157:49467] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aY5FUh8A_fZBamNLnfUtMQAAAAs"]
[Fri Feb 13 05:25:40.324028 2026] [:error] [pid 51243:tid 51255] [client 158.158.35.157:27655] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aY5FVMim7ZTAHzi7xZu_CgAAAQo"]
[Fri Feb 13 05:25:41.955242 2026] [:error] [pid 51243:tid 51265] [client 158.158.35.157:60937] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aY5FVcim7ZTAHzi7xZu_DgAAARQ"]
[Fri Feb 13 05:25:43.622697 2026] [:error] [pid 51243:tid 51251] [client 158.158.35.157:32182] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aY5FV8im7ZTAHzi7xZu_EwAAAQY"]
[Fri Feb 13 05:25:44.946499 2026] [:error] [pid 49223:tid 49236] [client 158.158.35.157:25199] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aY5FWB8A_fZBamNLnfUtOwAAAAQ"]
[Fri Feb 13 05:25:45.802778 2026] [:error] [pid 49223:tid 49245] [client 158.158.35.157:32174] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aY5FWR8A_fZBamNLnfUtQwAAAA0"]
[Fri Feb 13 05:25:46.867788 2026] [:error] [pid 49224:tid 49269] [client 158.158.35.157:58149] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aY5FWtiAvPoWmw5YhwmI6gAAAEI"]
[Fri Feb 13 05:25:47.976351 2026] [:error] [pid 51243:tid 51260] [client 158.158.35.157:42507] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aY5FW8im7ZTAHzi7xZu_GQAAAQ8"]
[Fri Feb 13 05:25:49.612746 2026] [:error] [pid 51243:tid 51255] [client 158.158.35.157:49382] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aY5FXcim7ZTAHzi7xZu_HAAAAQo"]
[Fri Feb 13 05:25:50.535745 2026] [:error] [pid 49224:tid 49289] [client 158.158.35.157:4210] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aY5FXtiAvPoWmw5YhwmI7AAAAFY"]
[Fri Feb 13 05:25:51.994409 2026] [:error] [pid 49225:tid 49311] [client 158.158.35.157:53177] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aY5FXzwH8-zGxtAd3jvQ-gAAAJE"]
[Fri Feb 13 05:25:53.710086 2026] [:error] [pid 51243:tid 51247] [client 158.158.35.157:32141] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aY5FYcim7ZTAHzi7xZu_JgAAAQI"]
[Fri Feb 13 05:25:55.390202 2026] [:error] [pid 49223:tid 49249] [client 158.158.35.157:59229] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aY5FYx8A_fZBamNLnfUtVgAAABE"]
[Fri Feb 13 05:25:56.401462 2026] [:error] [pid 49335:tid 49339] [client 158.158.35.157:42538] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aY5FZKp--SFY2nwOiqkp0AAAAMI"]
[Fri Feb 13 05:25:57.404428 2026] [:error] [pid 49335:tid 49352] [client 158.158.35.157:59237] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aY5FZap--SFY2nwOiqkp0wAAAM8"]
[Fri Feb 13 05:25:58.936158 2026] [:error] [pid 49225:tid 49294] [client 158.158.35.157:4928] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aY5FZjwH8-zGxtAd3jvRCQAAAIA"]
[Fri Feb 13 05:25:59.828393 2026] [:error] [pid 49225:tid 49297] [client 158.158.35.157:41279] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aY5FZzwH8-zGxtAd3jvRCwAAAIM"]
[Fri Feb 13 05:26:00.711235 2026] [:error] [pid 51243:tid 51266] [client 158.158.35.157:58164] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aY5FaMim7ZTAHzi7xZu_KgAAARU"]
[Fri Feb 13 05:26:01.854570 2026] [:error] [pid 49335:tid 49350] [client 158.158.35.157:41218] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aY5Faap--SFY2nwOiqkp3gAAAM0"]
[Fri Feb 13 05:26:02.426941 2026] [:error] [pid 51243:tid 51259] [client 158.158.35.157:42533] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aY5Fasim7ZTAHzi7xZu_MAAAAQ4"]
[Fri Feb 13 05:26:03.188421 2026] [:error] [pid 49225:tid 49301] [client 158.158.35.157:23891] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aY5FazwH8-zGxtAd3jvREQAAAIc"]
[Fri Feb 13 05:26:03.985078 2026] [:error] [pid 49224:tid 49271] [client 158.158.35.157:59224] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aY5Fa9iAvPoWmw5YhwmJBwAAAEQ"]
[Fri Feb 13 05:26:05.087369 2026] [:error] [pid 49335:tid 49348] [client 158.158.35.157:4969] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aY5Fbap--SFY2nwOiqkp7AAAAMs"]
[Fri Feb 13 05:26:05.993625 2026] [:error] [pid 49225:tid 49308] [client 158.158.35.157:28319] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aY5FbTwH8-zGxtAd3jvRGwAAAI4"]
[Fri Feb 13 05:26:06.946568 2026] [:error] [pid 49225:tid 49303] [client 158.158.35.157:60459] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aY5FbjwH8-zGxtAd3jvRHQAAAIk"]
[Fri Feb 13 05:26:07.865697 2026] [:error] [pid 51243:tid 51268] [client 158.158.35.157:58154] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY5Fb8im7ZTAHzi7xZu_OQAAARc"]
[Fri Feb 13 05:26:08.943689 2026] [:error] [pid 49225:tid 49318] [client 158.158.35.157:49383] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY5FcDwH8-zGxtAd3jvRJgAAAJg"]
[Fri Feb 13 05:26:10.089523 2026] [:error] [pid 49223:tid 49253] [client 158.158.35.157:41256] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY5Fch8A_fZBamNLnfUtbQAAABU"]
[Fri Feb 13 05:26:12.440108 2026] [:error] [pid 51243:tid 51245] [client 158.158.35.157:23916] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aY5FdMim7ZTAHzi7xZu_QwAAAQA"]
[Fri Feb 13 05:26:13.391757 2026] [:error] [pid 49335:tid 49351] [client 158.158.35.157:43817] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aY5Fdap--SFY2nwOiqkqBgAAAM4"]
[Fri Feb 13 05:26:16.547853 2026] [:error] [pid 49224:tid 49267] [client 158.158.35.157:4930] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aY5FeNiAvPoWmw5YhwmJFwAAAEA"]
[Fri Feb 13 05:26:19.039511 2026] [:error] [pid 49225:tid 49303] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Feb 13 05:26:19.282499 2026] [:error] [pid 49225:tid 49294] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Feb 13 05:26:19.525718 2026] [:error] [pid 49225:tid 49311] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Feb 13 05:26:19.769225 2026] [:error] [pid 49225:tid 49300] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Fri Feb 13 05:26:20.012508 2026] [:error] [pid 49225:tid 49304] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Fri Feb 13 05:26:20.496279 2026] [:error] [pid 49225:tid 49307] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Fri Feb 13 05:26:20.739049 2026] [:error] [pid 49225:tid 49315] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Fri Feb 13 05:26:20.983820 2026] [:error] [pid 49225:tid 49313] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Feb 13 05:26:21.734952 2026] [:error] [pid 49225:tid 49306] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Fri Feb 13 05:26:21.994785 2026] [:error] [pid 49225:tid 49301] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Fri Feb 13 05:26:22.238275 2026] [:error] [pid 49225:tid 49295] [client 158.158.35.157:28297] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Fri Feb 13 05:26:22.479846 2026] [:error] [pid 49225:tid 49305] [client 158.158.35.157:28297] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY5FfjwH8-zGxtAd3jvRTgAAAIs"]
[Fri Feb 13 05:26:24.597617 2026] [:error] [pid 49335:tid 49360] [client 158.158.35.157:23904] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY5FgKp--SFY2nwOiqkqGgAAANc"]
[Fri Feb 13 05:26:26.623001 2026] [:error] [pid 51243:tid 51256] [client 158.158.35.157:23893] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY5Fgsim7ZTAHzi7xZu_pQAAAQs"]
[Fri Feb 13 05:26:27.607955 2026] [:error] [pid 49335:tid 49350] [client 158.158.35.157:53141] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aY5Fg6p--SFY2nwOiqkqIQAAAM0"]
[Fri Feb 13 05:26:28.673961 2026] [:error] [pid 49224:tid 49280] [client 158.158.35.157:4976] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aY5FhNiAvPoWmw5YhwmJMQAAAE0"]
[Fri Feb 13 05:26:29.228064 2026] [:error] [pid 49224:tid 49277] [client 158.158.35.157:43787] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aY5FhdiAvPoWmw5YhwmJMgAAAEo"]
[Fri Feb 13 05:26:29.851832 2026] [:error] [pid 49224:tid 49275] [client 158.158.35.157:25185] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aY5FhdiAvPoWmw5YhwmJNwAAAEg"]
[Fri Feb 13 05:26:30.564478 2026] [:error] [pid 49224:tid 49282] [client 158.158.35.157:53145] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aY5FhtiAvPoWmw5YhwmJOQAAAE8"]
[Fri Feb 13 05:26:31.418655 2026] [:error] [pid 49225:tid 49302] [client 158.158.35.157:42500] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aY5FhzwH8-zGxtAd3jvRUQAAAIg"]
[Fri Feb 13 05:26:32.333535 2026] [:error] [pid 49335:tid 49345] [client 158.158.35.157:41883] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aY5FiKp--SFY2nwOiqkqLgAAAMg"]
[Fri Feb 13 05:26:33.057512 2026] [:error] [pid 49225:tid 49311] [client 158.158.35.157:43815] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aY5FiTwH8-zGxtAd3jvRVQAAAJE"]
[Fri Feb 13 05:26:33.885244 2026] [:error] [pid 49225:tid 49304] [client 158.158.35.157:51867] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "aY5FiTwH8-zGxtAd3jvRWAAAAIo"]
[Fri Feb 13 05:26:34.887216 2026] [:error] [pid 51243:tid 51251] [client 158.158.35.157:44289] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aY5Fisim7ZTAHzi7xZu_twAAAQY"]
[Fri Feb 13 05:26:35.670265 2026] [:error] [pid 49335:tid 49348] [client 158.158.35.157:58158] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aY5Fi6p--SFY2nwOiqkqNwAAAMs"]
[Fri Feb 13 05:26:36.683834 2026] [:error] [pid 49335:tid 49344] [client 158.158.35.157:43824] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aY5FjKp--SFY2nwOiqkqPQAAAMc"]
[Fri Feb 13 05:26:37.987173 2026] [:error] [pid 51243:tid 51261] [client 158.158.35.157:51349] [client 158.158.35.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aY5Fjcim7ZTAHzi7xZu_vAAAARA"]
[Fri Feb 13 07:28:44.599523 2026] [:error] [pid 51243:tid 51267] [client 20.100.186.253:59336] File does not exist: /usr/local/apache/htdocs/suspended-page/24.php
[Fri Feb 13 09:33:02.867990 2026] [:error] [pid 49335:tid 49344] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Fri Feb 13 09:33:04.614488 2026] [:error] [pid 49335:tid 49344] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Fri Feb 13 09:33:04.857842 2026] [:error] [pid 49335:tid 49358] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Fri Feb 13 09:33:05.102813 2026] [:error] [pid 49335:tid 49359] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Feb 13 09:33:05.346315 2026] [:error] [pid 49335:tid 49351] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Feb 13 09:33:05.594921 2026] [:error] [pid 49335:tid 49338] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Feb 13 09:33:05.839277 2026] [:error] [pid 49335:tid 49361] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 13 09:33:06.084674 2026] [:error] [pid 49335:tid 49348] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Feb 13 09:33:06.336091 2026] [:error] [pid 49335:tid 49342] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Fri Feb 13 09:33:06.579301 2026] [:error] [pid 49335:tid 49340] [client 158.158.100.90:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Fri Feb 13 09:33:06.829750 2026] [:error] [pid 49335:tid 49356] [client 158.158.100.90:61393] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aY5_Uqp--SFY2nwOiqnGjwAAANM"]
[Fri Feb 13 09:33:07.999385 2026] [:error] [pid 49225:tid 49299] [client 158.158.100.90:48696] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aY5_UzwH8-zGxtAd3jtPQQAAAIU"]
[Fri Feb 13 09:33:10.900378 2026] [:error] [pid 51243:tid 51269] [client 158.158.100.90:34313] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aY5_Vsim7ZTAHzi7xZswCAAAARg"]
[Fri Feb 13 09:33:11.805055 2026] [:error] [pid 51243:tid 51261] [client 158.158.100.90:21799] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aY5_V8im7ZTAHzi7xZswEAAAARA"]
[Fri Feb 13 09:33:14.868589 2026] [:error] [pid 49335:tid 49355] [client 158.158.100.90:61426] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aY5_Wqp--SFY2nwOiqnGpgAAANI"]
[Fri Feb 13 09:33:16.412792 2026] [:error] [pid 49335:tid 49360] [client 158.158.100.90:46298] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aY5_XKp--SFY2nwOiqnGqgAAANc"]
[Fri Feb 13 09:33:18.490190 2026] [:error] [pid 49225:tid 49315] [client 158.158.100.90:36537] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aY5_XjwH8-zGxtAd3jtPfQAAAJU"]
[Fri Feb 13 09:33:22.520590 2026] [:error] [pid 51243:tid 51269] [client 158.158.100.90:48645] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aY5_Ysim7ZTAHzi7xZswHgAAARg"]
[Fri Feb 13 09:33:23.506728 2026] [:error] [pid 51243:tid 51267] [client 158.158.100.90:35485] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "aY5_Y8im7ZTAHzi7xZswIQAAARY"]
[Fri Feb 13 09:33:24.976763 2026] [:error] [pid 49335:tid 49357] [client 158.158.100.90:19687] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "aY5_ZKp--SFY2nwOiqnGxgAAANQ"]
[Fri Feb 13 09:33:25.860090 2026] [:error] [pid 49224:tid 49282] [client 158.158.100.90:21803] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "aY5_ZdiAvPoWmw5YhwkNQAAAAE8"]
[Fri Feb 13 09:33:29.224734 2026] [:error] [pid 49224:tid 49288] [client 158.158.100.90:36535] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "aY5_adiAvPoWmw5YhwkNRAAAAFU"]
[Fri Feb 13 09:33:30.732290 2026] [:error] [pid 49225:tid 49305] [client 158.158.100.90:46289] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aY5_ajwH8-zGxtAd3jtPugAAAIs"]
[Fri Feb 13 09:33:32.911386 2026] [:error] [pid 49223:tid 49232] [client 158.158.100.90:46315] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aY5_bB8A_fZBamNLnfWXtQAAAAA"]
[Fri Feb 13 09:33:34.293705 2026] [:error] [pid 49225:tid 49304] [client 158.158.100.90:62889] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aY5_bjwH8-zGxtAd3jtPxAAAAIo"]
[Fri Feb 13 09:33:35.409405 2026] [:error] [pid 49225:tid 49305] [client 158.158.100.90:19686] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aY5_bzwH8-zGxtAd3jtPywAAAIs"]
[Fri Feb 13 09:33:43.187935 2026] [:error] [pid 49225:tid 49315] [client 158.158.100.90:61379] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aY5_dzwH8-zGxtAd3jtP-QAAAJU"]
[Fri Feb 13 09:33:44.213288 2026] [:error] [pid 51243:tid 51264] [client 158.158.100.90:21784] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aY5_eMim7ZTAHzi7xZswQwAAARM"]
[Fri Feb 13 09:33:45.305201 2026] [:error] [pid 49225:tid 49304] [client 158.158.100.90:48697] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aY5_eTwH8-zGxtAd3jtQAgAAAIo"]
[Fri Feb 13 09:33:47.224289 2026] [:error] [pid 49223:tid 49244] [client 158.158.100.90:36483] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aY5_ex8A_fZBamNLnfWX3QAAAAw"]
[Fri Feb 13 09:33:48.296489 2026] [:error] [pid 49335:tid 49361] [client 158.158.100.90:31498] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aY5_fKp--SFY2nwOiqnHDwAAANg"]
[Fri Feb 13 09:33:50.458973 2026] [:error] [pid 49223:tid 49249] [client 158.158.100.90:46332] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aY5_fh8A_fZBamNLnfWX5QAAABE"]
[Fri Feb 13 09:33:53.132358 2026] [:error] [pid 51243:tid 51264] [client 158.158.100.90:48666] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aY5_gcim7ZTAHzi7xZswcQAAARM"]
[Fri Feb 13 09:33:57.451079 2026] [:error] [pid 51243:tid 51255] [client 158.158.100.90:61407] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "aY5_hcim7ZTAHzi7xZswfgAAAQo"]
[Fri Feb 13 09:33:58.538056 2026] [:error] [pid 49225:tid 49310] [client 158.158.100.90:62907] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aY5_hjwH8-zGxtAd3jtQdAAAAJA"]
[Fri Feb 13 09:34:00.761080 2026] [:error] [pid 49335:tid 49345] [client 158.158.100.90:61437] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aY5_iKp--SFY2nwOiqnHNgAAAMg"]
[Fri Feb 13 09:34:04.263854 2026] [:error] [pid 49225:tid 49311] [client 158.158.100.90:21779] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aY5_jDwH8-zGxtAd3jtQhwAAAJE"]
[Fri Feb 13 09:34:04.972485 2026] [:error] [pid 49224:tid 49274] [client 158.158.100.90:62857] [client 158.158.100.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aY5_jNiAvPoWmw5YhwkNvAAAAEc"]
[Fri Feb 13 09:34:08.352660 2026] [:error] [pid 49225:tid 49311] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 13 09:34:08.604227 2026] [:error] [pid 49225:tid 49313] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/el.php
[Fri Feb 13 09:34:08.848200 2026] [:error] [pid 49225:tid 49296] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Fri Feb 13 09:34:09.092874 2026] [:error] [pid 49225:tid 49305] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Fri Feb 13 09:34:09.336434 2026] [:error] [pid 49225:tid 49299] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Fri Feb 13 09:34:09.582845 2026] [:error] [pid 49225:tid 49317] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Fri Feb 13 09:34:09.838179 2026] [:error] [pid 49225:tid 49308] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 13 09:34:10.081509 2026] [:error] [pid 49225:tid 49316] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/ot.php
[Fri Feb 13 09:34:10.325004 2026] [:error] [pid 49225:tid 49310] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Feb 13 09:34:10.577989 2026] [:error] [pid 49225:tid 49311] [client 158.158.100.90:62859] File does not exist: /usr/local/apache/htdocs/suspended-page/pass.php
[Fri Feb 13 11:09:46.874287 2026] [:error] [pid 49223:tid 49234] [client 104.28.164.218:23075] [client 104.28.164.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aY6V-h8A_fZBamNLnfW-ngAAAAI"]
[Fri Feb 13 13:58:47.996601 2026] [:error] [pid 49335:tid 49355] [client 172.245.102.15:26147] [client 172.245.102.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.15, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aY69l6p--SFY2nwOiqkioAAAANI"]
[Fri Feb 13 13:58:48.036348 2026] [:error] [pid 49335:tid 49355] [client 172.245.102.15:26147] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 13 13:58:50.270756 2026] [:error] [pid 49224:tid 49268] [client 37.140.223.46:44953] [client 37.140.223.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.46, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aY69mtiAvPoWmw5YhwmQUQAAAEE"]
[Fri Feb 13 13:58:50.277927 2026] [:error] [pid 49224:tid 49268] [client 37.140.223.46:44953] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 13 22:03:42.980138 2026] [:error] [pid 47080:tid 47106] [client 186.121.163.135:61186] [client 186.121.163.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.121.163.135, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aY8vPkbWJwYCVF39z6tozAAAAdI"]
[Fri Feb 13 22:03:42.986010 2026] [:error] [pid 47080:tid 47106] [client 186.121.163.135:61186] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 13 23:02:05.224754 2026] [:error] [pid 46821:tid 46838] [client 134.122.45.255:49863] [client 134.122.45.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.45.255, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aY887Y6G1N5YSq0J0gcvEwAAAU8"]
[Fri Feb 13 23:02:05.228343 2026] [:error] [pid 46821:tid 46838] [client 134.122.45.255:49863] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 13 23:02:07.573439 2026] [:error] [pid 46821:tid 46837] [client 134.122.45.255:49863] [client 134.122.45.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aY88746G1N5YSq0J0gcvIAAAAU4"]
[Fri Feb 13 23:02:07.994369 2026] [:error] [pid 49335:tid 49339] [client 134.122.45.255:65291] [client 134.122.45.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aY8876p--SFY2nwOiqmISAAAAMI"]
[Fri Feb 13 23:02:08.413029 2026] [:error] [pid 47080:tid 47092] [client 134.122.45.255:60123] [client 134.122.45.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aY888EbWJwYCVF39z6t6aAAAAcQ"]
[Fri Feb 13 23:02:08.842096 2026] [:error] [pid 49225:tid 49315] [client 134.122.45.255:55271] [client 134.122.45.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aY888DwH8-zGxtAd3jsqkAAAAJU"]
[Fri Feb 13 23:02:09.279428 2026] [:error] [pid 47358:tid 47384] [client 134.122.45.255:53590] [client 134.122.45.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aY888cQFBuVVUQTESUwzBgAAApI"]
[Fri Feb 13 23:02:09.701093 2026] [:error] [pid 49223:tid 49256] [client 134.122.45.255:61180] [client 134.122.45.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aY888R8A_fZBamNLnfWIhgAAABg"]
[Fri Feb 13 23:02:10.124567 2026] [:error] [pid 47080:tid 47105] [client 134.122.45.255:63982] [client 134.122.45.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aY888kbWJwYCVF39z6t6bQAAAdE"]
[Sat Feb 14 05:18:07.642420 2026] [:error] [pid 21785:tid 21837] [client 89.187.168.122:10559] File does not exist: /usr/local/apache/htdocs/suspended-page/archivarix.cms.php, referer: http://aoswa.com.au/archivarix.cms.php
[Sat Feb 14 09:38:24.898149 2026] [:error] [pid 21752:tid 21754] [client 161.118.253.118:53620] [client 161.118.253.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.253.118, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aY_SEBOc0bldMgpeu12TLgAAAQA"], referer: https://duckduckgo.com/
[Sat Feb 14 09:38:24.903020 2026] [:error] [pid 21752:tid 21754] [client 161.118.253.118:53620] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://duckduckgo.com/
[Sat Feb 14 09:38:25.101311 2026] [:error] [pid 58882:tid 58885] [client 161.118.253.118:53637] [client 161.118.253.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.253.118, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aY_SEZ5gZqnf2Itlwap0tQAAAcE"]
[Sat Feb 14 09:38:25.107136 2026] [:error] [pid 58882:tid 58885] [client 161.118.253.118:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 14 09:38:25.693462 2026] [:error] [pid 21196:tid 21270] [client 161.118.253.118:53648] [client 161.118.253.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.253.118, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aY_SEftQbaugyUK6TM-qNwAAAIw"], referer: https://www.bing.com/
[Sat Feb 14 09:38:25.698221 2026] [:error] [pid 21196:tid 21270] [client 161.118.253.118:53648] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.bing.com/
[Sat Feb 14 09:38:25.894747 2026] [:error] [pid 21785:tid 21820] [client 161.118.253.118:53654] [client 161.118.253.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.253.118, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aY_SEQOBjP5pmZ2xNN56oQAAAYY"], referer: https://www.google.com/search?q=wordpress
[Sat Feb 14 09:38:25.898682 2026] [:error] [pid 21785:tid 21820] [client 161.118.253.118:53654] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/search?q=wordpress
[Sat Feb 14 11:38:29.242283 2026] [:error] [pid 21752:tid 21778] [client 139.59.24.163:62029] [client 139.59.24.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/"] [unique_id "aY_uNROc0bldMgpeu12uSwAAARg"], referer: binance.com
[Sat Feb 14 11:38:38.475130 2026] [:error] [pid 21195:tid 21244] [client 139.59.24.163:64353] [client 139.59.24.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/"] [unique_id "aY_uPt_2sARdLQ6dpsV7iwAAAE0"], referer: binance.com
[Sat Feb 14 11:38:45.460097 2026] [:error] [pid 7982:tid 8029] [client 139.59.24.163:50008] [client 139.59.24.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/"] [unique_id "aY_uRWLTp1DWAgIKqwSXvQAAAtI"], referer: binance.com
[Sat Feb 14 22:12:57.100895 2026] [:error] [pid 7462:tid 7473] [client 159.89.184.232:32918] [client 159.89.184.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZCC6W2K0eQbQ6nA1wO4EgAAAMg"]
[Sat Feb 14 22:13:02.194041 2026] [:error] [pid 39456:tid 39507] [client 159.89.184.232:40216] [client 159.89.184.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZCC7oKeIqKLynHIGnjv6gAAAlU"]
[Sun Feb 15 00:10:48.439386 2026] [:error] [pid 11801:tid 11810] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/88.php
[Sun Feb 15 00:10:48.691976 2026] [:error] [pid 11801:tid 11878] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Sun Feb 15 00:10:48.944762 2026] [:error] [pid 11801:tid 11867] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/php8.php
[Sun Feb 15 00:10:49.199811 2026] [:error] [pid 11801:tid 11870] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/cvtcosue.php
[Sun Feb 15 00:10:49.453496 2026] [:error] [pid 11801:tid 11813] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Feb 15 00:10:49.706399 2026] [:error] [pid 11801:tid 11880] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/1a.php
[Sun Feb 15 00:10:49.964515 2026] [:error] [pid 11801:tid 11868] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/aer.php
[Sun Feb 15 00:10:50.218926 2026] [:error] [pid 11801:tid 11812] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sun Feb 15 00:10:50.473461 2026] [:error] [pid 11801:tid 11876] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/667.php
[Sun Feb 15 00:10:50.727060 2026] [:error] [pid 11801:tid 11877] [client 52.138.250.181:7322] File does not exist: /usr/local/apache/htdocs/suspended-page/kma.php
[Sun Feb 15 00:10:50.977147 2026] [:error] [pid 11801:tid 11873] [client 52.138.250.181:7322] [client 52.138.250.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kimono.php"] [unique_id "aZCeijP96sFUu5UWagzfKAAAA44"]
[Sun Feb 15 00:10:51.485645 2026] [:error] [pid 28479:tid 28492] [client 52.138.250.181:7395] [client 52.138.250.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kimono.php"] [unique_id "aZCei4yrlZ0IAq0j37jT-wAAAAs"]
[Sun Feb 15 00:10:52.007577 2026] [:error] [pid 15923:tid 15934] [client 52.138.250.181:7103] [client 52.138.250.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kimono.php"] [unique_id "aZCejIWG-SihJvGpxeGergAAAIg"]
[Sun Feb 15 00:10:52.507524 2026] [:error] [pid 15923:tid 15927] [client 52.138.250.181:6913] [client 52.138.250.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kimono.php"] [unique_id "aZCejIWG-SihJvGpxeGerwAAAIE"]
[Sun Feb 15 03:49:23.492416 2026] [:error] [pid 46490:tid 46554] [client 159.89.184.232:58476] [client 159.89.184.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZDRw5whqNXixXBOwykSLQAAAAQ"]
[Sun Feb 15 03:49:26.690841 2026] [:error] [pid 46490:tid 46559] [client 159.89.184.232:49018] [client 159.89.184.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZDRxpwhqNXixXBOwykSNwAAAAk"]
[Sun Feb 15 05:51:59.931955 2026] [:error] [pid 45737:tid 45765] [client 167.71.214.26:56394] [client 167.71.214.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.214.26, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZDufy09hmSGkkk5TsBoQAAAAdg"]
[Sun Feb 15 05:51:59.936437 2026] [:error] [pid 45737:tid 45765] [client 167.71.214.26:56394] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Feb 15 07:14:15.974649 2026] [:error] [pid 53689:tid 53755] [client 159.89.184.232:54054] [client 159.89.184.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZEBxwdVuSk1xLp2CvBHvAAAA8k"]
[Sun Feb 15 07:14:19.211921 2026] [:error] [pid 55524:tid 55527] [client 159.89.184.232:50332] [client 159.89.184.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZEBy2LAtAbjLmS8eYQ7bgAAAEE"]
[Tue Feb 17 05:14:35.537187 2026] [:error] [pid 58551:tid 58561] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 05:14:35.804697 2026] [:error] [pid 58551:tid 58584] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 05:14:36.073000 2026] [:error] [pid 58551:tid 58573] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 05:14:36.326676 2026] [:error] [pid 58551:tid 58574] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 05:14:36.742294 2026] [:error] [pid 58551:tid 58563] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 05:14:36.997311 2026] [:error] [pid 58551:tid 58576] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 05:14:37.265771 2026] [:error] [pid 58551:tid 58575] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 05:14:37.536107 2026] [:error] [pid 58551:tid 58578] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 05:14:37.799347 2026] [:error] [pid 58551:tid 58562] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 05:14:38.091691 2026] [:error] [pid 58551:tid 58570] [client 20.238.121.35:48607] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 05:14:38.357719 2026] [:error] [pid 58551:tid 58561] [client 20.238.121.35:48607] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOIvq1t8eWr-MgFsppVxgAAAAE"]
[Tue Feb 17 05:14:42.023154 2026] [:error] [pid 32790:tid 32806] [client 20.238.121.35:48941] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOIwns3HJP9ozPHsN68ngAAAQw"]
[Tue Feb 17 05:14:46.886030 2026] [:error] [pid 58552:tid 58612] [client 20.238.121.35:48628] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOIxjBHVJP2Oz3yR5fSNAAAAFE"]
[Tue Feb 17 05:14:49.003622 2026] [:error] [pid 32790:tid 32809] [client 20.238.121.35:49836] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOIyXs3HJP9ozPHsN68rAAAAQ8"]
[Tue Feb 17 05:15:21.649636 2026] [:error] [pid 58558:tid 58625] [client 20.238.121.35:40644] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOI6SmIxlfUL2nViZyf-QAAAIM"]
[Tue Feb 17 05:15:22.973138 2026] [:error] [pid 58558:tid 58640] [client 20.238.121.35:55991] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOI6imIxlfUL2nViZyf_AAAAJI"]
[Tue Feb 17 05:15:24.259881 2026] [:error] [pid 58551:tid 58581] [client 20.238.121.35:48990] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOI7K1t8eWr-MgFsppWFgAAABU"]
[Tue Feb 17 05:15:25.021950 2026] [:error] [pid 32790:tid 32804] [client 20.238.121.35:40667] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOI7Xs3HJP9ozPHsN69BAAAAQo"]
[Tue Feb 17 05:15:25.887291 2026] [:error] [pid 58552:tid 58612] [client 20.238.121.35:49009] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aZOI7TBHVJP2Oz3yR5fSmQAAAFE"]
[Tue Feb 17 05:15:26.870402 2026] [:error] [pid 58659:tid 58677] [client 20.238.121.35:55950] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aZOI7sDX32iTEO4jt2_XWAAAANA"]
[Tue Feb 17 05:15:28.660821 2026] [:error] [pid 58552:tid 58600] [client 20.238.121.35:2877] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aZOI8DBHVJP2Oz3yR5fSnQAAAEU"]
[Tue Feb 17 05:15:34.086851 2026] [:error] [pid 58552:tid 58609] [client 20.238.121.35:38429] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aZOI9jBHVJP2Oz3yR5fSpgAAAE4"]
[Tue Feb 17 05:15:35.981613 2026] [:error] [pid 32790:tid 32818] [client 20.238.121.35:38991] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZOI93s3HJP9ozPHsN69FAAAARg"]
[Tue Feb 17 05:15:39.428953 2026] [:error] [pid 58552:tid 58602] [client 20.238.121.35:38993] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Feb 17 05:15:39.767157 2026] [:error] [pid 58552:tid 58599] [client 20.238.121.35:38993] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Feb 17 05:15:40.020050 2026] [:error] [pid 58552:tid 58601] [client 20.238.121.35:38993] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Feb 17 05:15:40.269796 2026] [:error] [pid 58552:tid 58598] [client 20.238.121.35:38993] [client 20.238.121.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZOI_DBHVJP2Oz3yR5fSwgAAAEM"]
[Tue Feb 17 05:15:42.192130 2026] [:error] [pid 58558:tid 58637] [client 20.238.121.35:48661] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 05:25:58.924150 2026] [:error] [pid 58659:tid 58668] [client 157.245.146.102:41892] [client 157.245.146.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZOLZsDX32iTEO4jt2_b7wAAAMc"]
[Tue Feb 17 07:49:56.914352 2026] [:error] [pid 58552:tid 58615] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 07:49:57.355448 2026] [:error] [pid 58552:tid 58604] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 07:49:57.619464 2026] [:error] [pid 58552:tid 58618] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 07:49:57.893612 2026] [:error] [pid 58552:tid 58616] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 07:49:58.168662 2026] [:error] [pid 58552:tid 58597] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 07:49:58.432611 2026] [:error] [pid 58552:tid 58612] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 07:49:58.712418 2026] [:error] [pid 58552:tid 58600] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 07:49:58.976377 2026] [:error] [pid 58552:tid 58610] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 07:49:59.241671 2026] [:error] [pid 58552:tid 58605] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 07:49:59.522953 2026] [:error] [pid 58552:tid 58611] [client 20.100.191.215:36975] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 07:49:59.790158 2026] [:error] [pid 58552:tid 58613] [client 20.100.191.215:36975] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOtJzBHVJP2Oz3yR5cS6AAAAFI"]
[Tue Feb 17 07:50:02.899662 2026] [:error] [pid 58552:tid 58618] [client 20.100.191.215:28222] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOtKjBHVJP2Oz3yR5cS8AAAAFc"]
[Tue Feb 17 07:50:12.026612 2026] [:error] [pid 58552:tid 58615] [client 20.100.191.215:25547] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOtNDBHVJP2Oz3yR5cS-QAAAFQ"]
[Tue Feb 17 07:50:18.778954 2026] [:error] [pid 58551:tid 58571] [client 20.100.191.215:19659] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZOtOq1t8eWr-MgFspqV_AAAAAs"]
[Tue Feb 17 07:50:21.479482 2026] [:error] [pid 58551:tid 58581] [client 20.100.191.215:16627] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZOtPa1t8eWr-MgFspqWAQAAABU"]
[Tue Feb 17 07:50:27.202431 2026] [:error] [pid 58659:tid 58664] [client 20.100.191.215:33283] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZOtQ8DX32iTEO4jt28lFgAAAMM"]
[Tue Feb 17 07:50:30.482479 2026] [:error] [pid 58558:tid 58640] [client 20.100.191.215:12879] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZOtRimIxlfUL2nViZzj-AAAAJI"]
[Tue Feb 17 07:50:49.604628 2026] [:error] [pid 32790:tid 32794] [client 20.100.191.215:13280] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOtWXs3HJP9ozPHsN4bfQAAAQA"]
[Tue Feb 17 07:50:51.395428 2026] [:error] [pid 58552:tid 58611] [client 20.100.191.215:12899] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOtWzBHVJP2Oz3yR5cTSwAAAFA"]
[Tue Feb 17 07:50:59.128512 2026] [:error] [pid 58552:tid 58602] [client 20.100.191.215:10955] File does not exist: /usr/local/apache/htdocs/suspended-page/ak.php
[Tue Feb 17 07:50:59.403703 2026] [:error] [pid 58552:tid 58613] [client 20.100.191.215:10955] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Feb 17 07:50:59.669468 2026] [:error] [pid 58552:tid 58609] [client 20.100.191.215:10955] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Feb 17 07:50:59.946855 2026] [:error] [pid 58552:tid 58617] [client 20.100.191.215:10955] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Feb 17 07:51:00.210680 2026] [:error] [pid 58552:tid 58607] [client 20.100.191.215:10955] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Feb 17 07:51:00.475666 2026] [:error] [pid 58552:tid 58605] [client 20.100.191.215:10955] [client 20.100.191.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZOtZDBHVJP2Oz3yR5cTZQAAAEo"]
[Tue Feb 17 07:51:02.393466 2026] [:error] [pid 58552:tid 58601] [client 20.100.191.215:13902] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 08:01:29.165189 2026] [:error] [pid 58552:tid 58596] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 08:01:29.427056 2026] [:error] [pid 58552:tid 58612] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 08:01:29.687161 2026] [:error] [pid 58552:tid 58609] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 08:01:29.951309 2026] [:error] [pid 58552:tid 58603] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 08:01:30.209931 2026] [:error] [pid 58552:tid 58607] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 08:01:30.469626 2026] [:error] [pid 58552:tid 58613] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 08:01:30.908265 2026] [:error] [pid 58552:tid 58611] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 08:01:31.168186 2026] [:error] [pid 58552:tid 58615] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 08:01:31.431446 2026] [:error] [pid 58552:tid 58598] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 08:01:31.697649 2026] [:error] [pid 58552:tid 58605] [client 74.248.96.218:11258] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 08:01:31.953008 2026] [:error] [pid 58552:tid 58614] [client 74.248.96.218:11258] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOv2zBHVJP2Oz3yR5cXYAAAAFM"]
[Tue Feb 17 08:01:36.850125 2026] [:error] [pid 58558:tid 58641] [client 74.248.96.218:54459] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOv4CmIxlfUL2nViZzodwAAAJM"]
[Tue Feb 17 08:01:44.083458 2026] [:error] [pid 58659:tid 58664] [client 74.248.96.218:13622] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZOv6MDX32iTEO4jt28qlQAAAMM"]
[Tue Feb 17 08:01:52.464052 2026] [:error] [pid 58659:tid 58671] [client 74.248.96.218:12030] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZOv8MDX32iTEO4jt28qngAAAMo"]
[Tue Feb 17 08:01:58.370369 2026] [:error] [pid 58551:tid 58583] [client 74.248.96.218:39126] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZOv9q1t8eWr-MgFspqaxAAAABc"]
[Tue Feb 17 08:02:13.436743 2026] [:error] [pid 58659:tid 58680] [client 74.248.96.218:12385] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZOwBcDX32iTEO4jt28qvgAAANM"]
[Tue Feb 17 08:02:14.774370 2026] [:error] [pid 58552:tid 58601] [client 74.248.96.218:22436] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZOwBjBHVJP2Oz3yR5cXoAAAAEY"]
[Tue Feb 17 08:02:16.737227 2026] [:error] [pid 32790:tid 32810] [client 74.248.96.218:9563] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZOwCHs3HJP9ozPHsN4izQAAARA"]
[Tue Feb 17 08:02:20.454660 2026] [:error] [pid 58552:tid 58610] [client 74.248.96.218:18698] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZOwDDBHVJP2Oz3yR5cXqQAAAE8"]
[Tue Feb 17 08:02:21.684114 2026] [:error] [pid 58659:tid 58676] [client 74.248.96.218:21903] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOwDcDX32iTEO4jt28qxgAAAM8"]
[Tue Feb 17 08:02:22.985236 2026] [:error] [pid 32790:tid 32794] [client 74.248.96.218:10030] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOwDns3HJP9ozPHsN4i2AAAAQA"]
[Tue Feb 17 08:02:24.632760 2026] [:error] [pid 32790:tid 32806] [client 74.248.96.218:24814] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOwEHs3HJP9ozPHsN4i3gAAAQw"]
[Tue Feb 17 08:02:25.962099 2026] [:error] [pid 58552:tid 58612] [client 74.248.96.218:6937] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOwETBHVJP2Oz3yR5cXrAAAAFE"]
[Tue Feb 17 08:02:27.777155 2026] [:error] [pid 58558:tid 58634] [client 74.248.96.218:12376] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aZOwEymIxlfUL2nViZzosgAAAIw"]
[Tue Feb 17 08:02:30.827239 2026] [:error] [pid 58558:tid 58645] [client 74.248.96.218:6197] [client 74.248.96.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "aZOwFimIxlfUL2nViZzotAAAAJc"]
[Tue Feb 17 08:02:40.957203 2026] [:error] [pid 58558:tid 58624] [client 74.248.96.218:24772] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Feb 17 08:02:41.250241 2026] [:error] [pid 58558:tid 58633] [client 74.248.96.218:24772] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Feb 17 08:02:41.516948 2026] [:error] [pid 58558:tid 58645] [client 74.248.96.218:24772] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Feb 17 08:02:41.776300 2026] [:error] [pid 58558:tid 58628] [client 74.248.96.218:24772] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Feb 17 08:02:42.044801 2026] [:error] [pid 58558:tid 58640] [client 74.248.96.218:24772] [client 74.248.96.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZOwIimIxlfUL2nViZzoyQAAAJI"]
[Tue Feb 17 08:02:43.750039 2026] [:error] [pid 32790:tid 32803] [client 74.248.96.218:39288] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 09:41:04.134047 2026] [:error] [pid 58551:tid 58582] [client 167.86.111.253:45466] File does not exist: /usr/local/apache/htdocs/suspended-page/php-info.php
[Tue Feb 17 09:41:04.433200 2026] [:error] [pid 58659:tid 58666] [client 167.86.111.253:45468] File does not exist: /usr/local/apache/htdocs/suspended-page/newinfo.php
[Tue Feb 17 09:41:10.070569 2026] [:error] [pid 58558:tid 58642] [client 167.86.111.253:45492] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php.1
[Tue Feb 17 09:41:10.934698 2026] [:error] [pid 58552:tid 58606] [client 167.86.111.253:45506] File does not exist: /usr/local/apache/htdocs/suspended-page/pageinfo.php
[Tue Feb 17 09:41:11.541379 2026] [:error] [pid 58552:tid 58615] [client 167.86.111.253:45518] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php.back
[Tue Feb 17 09:41:13.083894 2026] [:error] [pid 58551:tid 58569] [client 167.86.111.253:45544] File does not exist: /usr/local/apache/htdocs/suspended-page/release_info.php
[Tue Feb 17 09:41:18.416398 2026] [:error] [pid 58558:tid 58640] [client 167.86.111.253:42530] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Feb 17 09:41:20.366080 2026] [:error] [pid 32790:tid 32808] [client 167.86.111.253:42532] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php3"] [unique_id "aZPHQHs3HJP9ozPHsN5hwwAAAQ4"]
[Tue Feb 17 09:41:21.865021 2026] [:error] [pid 58659:tid 58671] [client 167.86.111.253:42546] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php.txt"] [unique_id "aZPHQcDX32iTEO4jt29gLgAAAMo"]
[Tue Feb 17 09:41:23.188110 2026] [:error] [pid 58551:tid 58584] [client 167.86.111.253:42550] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php.save.1"] [unique_id "aZPHQ61t8eWr-MgFsprG_gAAABg"]
[Tue Feb 17 09:41:24.749452 2026] [:error] [pid 58552:tid 58613] [client 167.86.111.253:60296] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php_"] [unique_id "aZPHRDBHVJP2Oz3yR5dFygAAAFI"]
[Tue Feb 17 09:41:26.577566 2026] [:error] [pid 58558:tid 58628] [client 167.86.111.253:60310] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/_info.php"] [unique_id "aZPHRimIxlfUL2nViZwXtQAAAIY"]
[Tue Feb 17 09:41:32.504400 2026] [:error] [pid 32790:tid 32798] [client 167.86.111.253:60316] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbinfo.php"] [unique_id "aZPHTHs3HJP9ozPHsN5h0QAAAQQ"]
[Tue Feb 17 09:41:32.794130 2026] [:error] [pid 32790:tid 32813] [client 167.86.111.253:60330] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbinfo.php"] [unique_id "aZPHTHs3HJP9ozPHsN5h0wAAARM"]
[Tue Feb 17 09:41:33.330942 2026] [:error] [pid 58551:tid 58583] [client 167.86.111.253:46778] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin_info.php"] [unique_id "aZPHTa1t8eWr-MgFsprHCwAAABc"]
[Tue Feb 17 09:41:33.922208 2026] [:error] [pid 58552:tid 58604] [client 167.86.111.253:46790] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.aws/credentials"] [unique_id "aZPHTTBHVJP2Oz3yR5dF0gAAAEk"]
[Tue Feb 17 09:41:34.494359 2026] [:error] [pid 58659:tid 58681] [client 167.86.111.253:46794] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "aZPHTsDX32iTEO4jt29gQwAAANQ"]
[Tue Feb 17 09:41:35.193807 2026] [:error] [pid 58551:tid 58571] [client 167.86.111.253:46808] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php"] [unique_id "aZPHT61t8eWr-MgFsprHDwAAAAs"]
[Tue Feb 17 09:41:35.868322 2026] [:error] [pid 58552:tid 58595] [client 167.86.111.253:46814] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php.bak"] [unique_id "aZPHTzBHVJP2Oz3yR5dF2AAAAEA"]
[Tue Feb 17 09:41:36.438480 2026] [:error] [pid 32790:tid 32815] [client 167.86.111.253:46820] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/admin_phpinfo.php4"] [unique_id "aZPHUHs3HJP9ozPHsN5h2wAAARU"]
[Tue Feb 17 09:41:37.090260 2026] [:error] [pid 58552:tid 58615] [client 167.86.111.253:46826] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pinfo.php"] [unique_id "aZPHUTBHVJP2Oz3yR5dF3AAAAFQ"]
[Tue Feb 17 09:41:37.763049 2026] [:error] [pid 58551:tid 58561] [client 167.86.111.253:46828] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "aZPHUa1t8eWr-MgFsprHFwAAAAE"]
[Tue Feb 17 09:41:38.386815 2026] [:error] [pid 58659:tid 58662] [client 167.86.111.253:46836] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aZPHUsDX32iTEO4jt29gSQAAAME"]
[Tue Feb 17 09:41:38.973807 2026] [:error] [pid 58552:tid 58604] [client 167.86.111.253:46846] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "aZPHUjBHVJP2Oz3yR5dF5gAAAEk"]
[Tue Feb 17 09:41:39.582855 2026] [:error] [pid 58558:tid 58638] [client 167.86.111.253:46862] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_sample"] [unique_id "aZPHUymIxlfUL2nViZwXwwAAAJA"]
[Tue Feb 17 09:41:40.237898 2026] [:error] [pid 32790:tid 32800] [client 167.86.111.253:46870] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "aZPHVHs3HJP9ozPHsN5h3wAAAQY"]
[Tue Feb 17 09:41:45.890525 2026] [:error] [pid 32790:tid 32816] [client 167.86.111.253:38574] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.docker/.env"] [unique_id "aZPHWXs3HJP9ozPHsN5h9wAAARY"]
[Tue Feb 17 09:41:46.166461 2026] [:error] [pid 58551:tid 58568] [client 167.86.111.253:38584] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev"] [unique_id "aZPHWq1t8eWr-MgFsprHHQAAAAg"]
[Tue Feb 17 09:41:52.421310 2026] [:error] [pid 58558:tid 58627] [client 167.86.111.253:38592] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_1"] [unique_id "aZPHYCmIxlfUL2nViZwXzgAAAIU"]
[Tue Feb 17 09:41:52.588067 2026] [:error] [pid 58659:tid 58661] [client 167.86.111.253:38606] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.stage"] [unique_id "aZPHYMDX32iTEO4jt29gXgAAAMA"]
[Tue Feb 17 09:41:53.581135 2026] [:error] [pid 32790:tid 32803] [client 167.86.111.253:54968] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.env"] [unique_id "aZPHYXs3HJP9ozPHsN5iBQAAAQk"]
[Tue Feb 17 09:41:54.677773 2026] [:error] [pid 58558:tid 58640] [client 167.86.111.253:54972] [client 167.86.111.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.pam_environment"] [unique_id "aZPHYimIxlfUL2nViZwXzwAAAJI"]
[Tue Feb 17 09:41:55.545138 2026] [:error] [pid 32790:tid 32810] [client 167.86.111.253:54978] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.environment"] [unique_id "aZPHY3s3HJP9ozPHsN5iCQAAARA"]
[Tue Feb 17 09:41:56.450137 2026] [:error] [pid 58558:tid 58646] [client 167.86.111.253:54980] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "aZPHZCmIxlfUL2nViZwX1AAAAJg"]
[Tue Feb 17 09:41:57.317677 2026] [:error] [pid 58558:tid 58641] [client 167.86.111.253:54984] [client 167.86.111.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production.local"] [unique_id "aZPHZSmIxlfUL2nViZwX1QAAAJM"]
[Tue Feb 17 10:08:05.621961 2026] [:error] [pid 58551:tid 58570] [client 172.213.16.18:21295] [client 172.213.16.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZPNha1t8eWr-MgFsprTNAAAAAo"]
[Tue Feb 17 10:08:07.052372 2026] [:error] [pid 58552:tid 58598] [client 172.213.16.18:20847] [client 172.213.16.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZPNhzBHVJP2Oz3yR5dRMQAAAEM"]
[Tue Feb 17 10:08:12.186246 2026] [:error] [pid 58552:tid 58599] [client 172.213.16.18:21732] [client 172.213.16.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZPNjDBHVJP2Oz3yR5dRQwAAAEQ"]
[Tue Feb 17 10:08:13.279926 2026] [:error] [pid 58659:tid 58664] [client 172.213.16.18:43393] [client 172.213.16.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZPNjcDX32iTEO4jt29tCgAAAMM"]
[Tue Feb 17 12:20:42.613647 2026] [:error] [pid 58558:tid 58646] [client 167.71.244.81:53558] [client 167.71.244.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aZPsmimIxlfUL2nViZxeTQAAAJg"]
[Wed Feb 18 05:48:53.749881 2026] [:error] [pid 57014:tid 57037] [client 158.158.51.6:10536] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Wed Feb 18 05:48:55.184989 2026] [:error] [pid 57014:tid 57037] [client 158.158.51.6:10536] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Wed Feb 18 05:48:55.426427 2026] [:error] [pid 57014:tid 57021] [client 158.158.51.6:10536] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Wed Feb 18 05:48:55.672339 2026] [:error] [pid 57014:tid 57028] [client 158.158.51.6:10536] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Wed Feb 18 05:48:55.914966 2026] [:error] [pid 57014:tid 57029] [client 158.158.51.6:10536] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Feb 18 05:48:56.518340 2026] [:error] [pid 57014:tid 57031] [client 158.158.51.6:10536] [client 158.158.51.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aZTiSBNZnhS5qKtVIML2ZgAAAQ4"]
[Wed Feb 18 05:48:59.585317 2026] [:error] [pid 21848:tid 21908] [client 158.158.51.6:3033] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Feb 18 05:48:59.838577 2026] [:error] [pid 21848:tid 21899] [client 158.158.51.6:3033] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aZTiS_bG91VRkVidT5cctAAAAEo"]
[Wed Feb 18 05:49:02.612399 2026] [:error] [pid 21848:tid 21904] [client 158.158.51.6:25243] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aZTiTvbG91VRkVidT5ccuAAAAE8"]
[Wed Feb 18 05:49:04.728191 2026] [:error] [pid 21849:tid 21920] [client 158.158.51.6:18896] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aZTiULx9a1XrfTYnuzJztQAAAIQ"]
[Wed Feb 18 05:49:08.038402 2026] [:error] [pid 57014:tid 57039] [client 158.158.51.6:8578] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aZTiVBNZnhS5qKtVIML2dQAAARY"]
[Wed Feb 18 05:49:12.050404 2026] [:error] [pid 5561:tid 5565] [client 158.158.51.6:10778] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aZTiWEoQssCZYQ4NexbZRAAAAUE"]
[Wed Feb 18 05:49:17.169197 2026] [:error] [pid 57014:tid 57032] [client 158.158.51.6:10546] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "aZTiXRNZnhS5qKtVIML2gAAAAQ8"]
[Wed Feb 18 05:49:30.519034 2026] [:error] [pid 57014:tid 57038] [client 158.158.51.6:14019] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aZTiahNZnhS5qKtVIML2jAAAARU"]
[Wed Feb 18 05:49:38.589230 2026] [:error] [pid 21847:tid 21870] [client 158.158.51.6:21790] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aZTicvy9A5wy4LuXmJ23UwAAAAw"]
[Wed Feb 18 05:49:41.493626 2026] [:error] [pid 21961:tid 21979] [client 158.158.51.6:10510] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aZTidcUBDt_-H0ms3gVZBwAAANA"]
[Wed Feb 18 05:49:43.875940 2026] [:error] [pid 21847:tid 21861] [client 158.158.51.6:14031] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aZTid_y9A5wy4LuXmJ23WAAAAAM"]
[Wed Feb 18 05:49:47.983434 2026] [:error] [pid 21847:tid 21870] [client 158.158.51.6:14036] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aZTie_y9A5wy4LuXmJ23XQAAAAw"]
[Wed Feb 18 05:49:54.945666 2026] [:error] [pid 21848:tid 21905] [client 158.158.51.6:10513] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aZTigvbG91VRkVidT5cc6gAAAFA"]
[Wed Feb 18 05:49:57.652852 2026] [:error] [pid 21849:tid 21934] [client 158.158.51.6:13870] [client 158.158.51.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aZTihbx9a1XrfTYnuzJz3QAAAJI"]
[Wed Feb 18 05:50:10.561161 2026] [:error] [pid 5561:tid 5585] [client 158.158.51.6:25257] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Wed Feb 18 05:50:10.803214 2026] [:error] [pid 5561:tid 5567] [client 158.158.51.6:25257] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Wed Feb 18 05:50:11.046573 2026] [:error] [pid 5561:tid 5577] [client 158.158.51.6:25257] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Feb 18 05:50:11.305339 2026] [:error] [pid 5561:tid 5569] [client 158.158.51.6:25257] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Feb 18 08:50:27.969092 2026] [:error] [pid 21849:tid 21924] [client 45.67.97.54:57081] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Feb 18 08:50:28.293892 2026] [:error] [pid 21849:tid 21931] [client 45.67.97.54:57081] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Feb 18 08:50:28.614093 2026] [:error] [pid 21849:tid 21934] [client 45.67.97.54:57081] [client 45.67.97.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aZUM1Lx9a1XrfTYnuzKwFQAAAJI"]
[Wed Feb 18 08:50:29.263843 2026] [:error] [pid 21849:tid 21918] [client 45.67.97.52:51387] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Feb 18 08:50:29.623808 2026] [:error] [pid 21849:tid 21939] [client 45.67.97.52:51387] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Feb 18 08:50:29.970386 2026] [:error] [pid 21849:tid 21938] [client 45.67.97.52:51387] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Feb 18 08:50:30.300230 2026] [:error] [pid 21849:tid 21924] [client 45.67.97.52:51387] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 18 08:50:30.638712 2026] [:error] [pid 21849:tid 21919] [client 45.67.97.52:51387] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 18 08:50:30.977255 2026] [:error] [pid 21849:tid 21934] [client 45.67.97.52:51387] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZUM1rx9a1XrfTYnuzKwJwAAAJI"]
[Wed Feb 18 08:50:37.525561 2026] [:error] [pid 57014:tid 57025] [client 176.28.143.63:27850] [client 176.28.143.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.28.143.63, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZUM3RNZnhS5qKtVIMI_rwAAAQg"]
[Wed Feb 18 08:50:37.532054 2026] [:error] [pid 57014:tid 57025] [client 176.28.143.63:27850] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 18 08:50:41.284595 2026] [:error] [pid 21847:tid 21867] [client 45.67.97.52:58697] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aZUM4fy9A5wy4LuXmJ0RmAAAAAk"]
[Wed Feb 18 08:50:42.922172 2026] [:error] [pid 21849:tid 21927] [client 45.67.97.53:58509] [client 45.67.97.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aZUM4rx9a1XrfTYnuzKwUgAAAIs"]
[Wed Feb 18 08:50:46.155751 2026] [:error] [pid 57014:tid 57034] [client 45.67.97.53:23671] [client 45.67.97.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/"] [unique_id "aZUM5hNZnhS5qKtVIMI_xAAAARE"]
[Wed Feb 18 08:50:47.696782 2026] [:error] [pid 21847:tid 21861] [client 45.67.97.54:64489] [client 45.67.97.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aZUM5_y9A5wy4LuXmJ0RywAAAAM"]
[Wed Feb 18 08:50:48.022271 2026] [:error] [pid 21847:tid 21860] [client 105.244.203.38:53814] [client 105.244.203.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.244.203.38, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZUM6Py9A5wy4LuXmJ0RzQAAAAI"]
[Wed Feb 18 08:50:48.029920 2026] [:error] [pid 21847:tid 21860] [client 105.244.203.38:53814] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 18 08:50:49.619798 2026] [:error] [pid 21961:tid 21966] [client 45.67.97.52:52501] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/"] [unique_id "aZUM6cUBDt_-H0ms3gWZTwAAAMM"]
[Wed Feb 18 08:50:51.122779 2026] [:error] [pid 21848:tid 21906] [client 45.67.97.54:45367] [client 45.67.97.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "aZUM6_bG91VRkVidT5djPwAAAFE"]
[Wed Feb 18 08:50:51.892327 2026] [:error] [pid 21961:tid 21970] [client 45.67.97.54:59147] [client 45.67.97.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "aZUM68UBDt_-H0ms3gWZVAAAAMc"]
[Wed Feb 18 08:50:53.053280 2026] [:error] [pid 5561:tid 5588] [client 45.67.97.53:59471] [client 45.67.97.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/"] [unique_id "aZUM7UoQssCZYQ4NexYYxgAAAVg"]
[Wed Feb 18 10:43:00.558424 2026] [:error] [pid 21849:tid 21931] [client 165.245.187.140:55613] [client 165.245.187.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aZUnNLx9a1XrfTYnuzLTmgAAAI8"]
[Wed Feb 18 21:26:25.596136 2026] [:error] [pid 11609:tid 11652] [client 209.87.169.98:31865] [client 209.87.169.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.98, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZW-Achm3UjgaKO2Na86mwAAAok"]
[Wed Feb 18 21:26:25.599876 2026] [:error] [pid 11609:tid 11652] [client 209.87.169.98:31865] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Feb 18 22:27:36.719723 2026] [:error] [pid 11611:tid 11710] [client 180.243.191.81:24769] [client 180.243.191.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.243.191.81, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZXMWO2m6IPN_aBZuKaA0wAAAww"]
[Wed Feb 18 22:27:36.725051 2026] [:error] [pid 11611:tid 11710] [client 180.243.191.81:24769] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 19 02:13:50.455191 2026] [:error] [pid 11548:tid 11601] [client 103.65.236.149:64166] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aZYBXjSFZiBIZZvmIlNoFwAAAhc"]
[Thu Feb 19 10:02:22.277113 2026] [:error] [pid 15513:tid 15520] [client 194.5.82.71:34429] [client 194.5.82.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aZZvLsGTRTE022JWg18HfgAAAQU"]
[Thu Feb 19 10:02:22.637359 2026] [:error] [pid 48902:tid 48957] [client 194.5.82.55:27347] [client 194.5.82.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aZZvLmcJ-6aYRpRRFsWYMwAAAFM"]
[Thu Feb 19 14:33:17.309213 2026] [:error] [pid 5580:tid 5589] [client 157.230.43.38:53385] [client 157.230.43.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aZaurYV24kZpmf6nh3C8rwAAAcY"]
[Thu Feb 19 19:58:36.710629 2026] [:error] [pid 48903:tid 48979] [client 136.109.125.83:62050] [client 136.109.125.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.125.83, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZb67I6aTgKrpAR115vn_QAAAI4"]
[Thu Feb 19 19:58:36.715790 2026] [:error] [pid 48903:tid 48979] [client 136.109.125.83:62050] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 19 19:58:38.823175 2026] [:error] [pid 48903:tid 48982] [client 136.109.125.83:62050] [client 136.109.125.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aZb67o6aTgKrpAR115voCAAAAJE"]
[Thu Feb 19 19:58:39.227489 2026] [:error] [pid 48903:tid 48977] [client 136.109.125.83:63000] [client 136.109.125.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aZb6746aTgKrpAR115voCQAAAIw"]
[Thu Feb 19 19:58:39.585290 2026] [:error] [pid 48901:tid 48914] [client 136.109.125.83:61756] [client 136.109.125.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aZb678ixYz-lHbN0WBK58AAAAAQ"]
[Thu Feb 19 19:58:39.924648 2026] [:error] [pid 15513:tid 15527] [client 136.109.125.83:56040] [client 136.109.125.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aZb678GTRTE022JWg1_cGwAAAQw"]
[Thu Feb 19 19:58:40.291477 2026] [:error] [pid 48902:tid 48956] [client 136.109.125.83:54920] [client 136.109.125.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aZb68GcJ-6aYRpRRFsUnpgAAAFI"]
[Thu Feb 19 19:58:40.681260 2026] [:error] [pid 49002:tid 49028] [client 136.109.125.83:63611] [client 136.109.125.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aZb68FfcBtQ6hSJuEQlgugAAAM4"]
[Thu Feb 19 19:58:41.036467 2026] [:error] [pid 48903:tid 48966] [client 136.109.125.83:49213] [client 136.109.125.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aZb68Y6aTgKrpAR115voDgAAAIE"]
[Thu Feb 19 23:56:53.525380 2026] [:error] [pid 15513:tid 15533] [client 193.32.176.86:33212] [client 193.32.176.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aZcyxcGTRTE022JWg18ixAAAARI"]
[Fri Feb 20 07:17:51.391370 2026] [:error] [pid 417:tid 434] [client 193.36.225.23:59535] [client 193.36.225.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.23, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZeaH2Z8vv9H56paZ2AaagAAAQ8"]
[Fri Feb 20 07:17:51.395045 2026] [:error] [pid 417:tid 434] [client 193.36.225.23:59535] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 20 15:24:50.042558 2026] [:error] [pid 46012:tid 46022] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Feb 20 15:24:50.463317 2026] [:error] [pid 46012:tid 46027] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Fri Feb 20 15:24:50.801097 2026] [:error] [pid 46012:tid 46036] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Fri Feb 20 15:24:51.023803 2026] [:error] [pid 46012:tid 46030] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 20 15:24:51.233224 2026] [:error] [pid 46012:tid 46038] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Fri Feb 20 15:24:51.496868 2026] [:error] [pid 46012:tid 46029] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Fri Feb 20 15:24:52.908349 2026] [:error] [pid 46012:tid 46029] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 20 15:24:53.327582 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:52824] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Fri Feb 20 15:24:53.533616 2026] [:error] [pid 46012:tid 46036] [client 20.220.13.222:52824] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZgMRTXz-GTvuxLwgUHLcgAAAVY"]
[Fri Feb 20 15:24:54.070396 2026] [:error] [pid 54461:tid 54498] [client 20.220.13.222:52086] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZgMRi372fkN0w39NDNkEQAAAEY"]
[Fri Feb 20 15:24:54.612403 2026] [:error] [pid 46012:tid 46038] [client 20.220.13.222:52841] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZgMRjXz-GTvuxLwgUHLdAAAAVg"]
[Fri Feb 20 15:24:55.094039 2026] [:error] [pid 54460:tid 54477] [client 20.220.13.222:47387] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZgMR8oUiaZ-Z7V-F98UPgAAAAw"]
[Fri Feb 20 15:24:55.763571 2026] [:error] [pid 54460:tid 54483] [client 20.220.13.222:62817] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZgMR8oUiaZ-Z7V-F98UPwAAABI"]
[Fri Feb 20 15:24:56.436387 2026] [:error] [pid 46012:tid 46036] [client 20.220.13.222:52056] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZgMSDXz-GTvuxLwgUHLfQAAAVY"]
[Fri Feb 20 15:24:57.175862 2026] [:error] [pid 54520:tid 54524] [client 20.220.13.222:52087] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZgMSWQaQX7QUBqXcyGWqgAAAII"]
[Fri Feb 20 15:24:57.876415 2026] [:error] [pid 54460:tid 54481] [client 20.220.13.222:47449] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZgMScoUiaZ-Z7V-F98URwAAABA"]
[Fri Feb 20 15:24:58.474356 2026] [:error] [pid 54552:tid 54563] [client 20.220.13.222:60841] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZgMSse4t0F-_sbWepba8QAAAMg"]
[Fri Feb 20 15:24:59.347658 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:62179] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZgMSzXz-GTvuxLwgUHLgAAAAVQ"]
[Fri Feb 20 15:25:00.251001 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:42906] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZgMTDXz-GTvuxLwgUHLhQAAAUM"]
[Fri Feb 20 15:25:01.605411 2026] [:error] [pid 54520:tid 54543] [client 20.220.13.222:62198] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZgMTWQaQX7QUBqXcyGWrAAAAJU"]
[Fri Feb 20 15:25:02.700147 2026] [:error] [pid 54460:tid 54485] [client 20.220.13.222:52822] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZgMTsoUiaZ-Z7V-F98UUQAAABQ"]
[Fri Feb 20 15:25:03.548679 2026] [:error] [pid 54520:tid 54524] [client 20.220.13.222:60834] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZgMT2QaQX7QUBqXcyGWrgAAAII"]
[Fri Feb 20 15:25:04.096415 2026] [:error] [pid 59127:tid 59150] [client 20.220.13.222:52860] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZgMUHSltzl55Qz-09juOgAAARU"]
[Fri Feb 20 15:25:04.649001 2026] [:error] [pid 59127:tid 59133] [client 20.220.13.222:62842] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZgMUHSltzl55Qz-09juOwAAAQQ"]
[Fri Feb 20 15:25:05.233822 2026] [:error] [pid 54552:tid 54572] [client 20.220.13.222:62835] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZgMUce4t0F-_sbWepba9gAAANE"]
[Fri Feb 20 15:25:06.191194 2026] [:error] [pid 54552:tid 54559] [client 20.220.13.222:60813] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZgMUse4t0F-_sbWepba9wAAAMQ"]
[Fri Feb 20 15:25:07.127443 2026] [:error] [pid 46012:tid 46020] [client 20.220.13.222:47438] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZgMUzXz-GTvuxLwgUHLkAAAAUY"]
[Fri Feb 20 15:25:08.833678 2026] [:error] [pid 54520:tid 54530] [client 20.220.13.222:42916] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZgMVGQaQX7QUBqXcyGWsAAAAIg"]
[Fri Feb 20 15:25:10.627060 2026] [:error] [pid 54520:tid 54544] [client 20.220.13.222:62802] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZgMVmQaQX7QUBqXcyGWtwAAAJY"]
[Fri Feb 20 15:25:11.766546 2026] [:error] [pid 54460:tid 54474] [client 20.220.13.222:60804] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZgMV8oUiaZ-Z7V-F98UXwAAAAk"]
[Fri Feb 20 15:25:12.637490 2026] [:error] [pid 59127:tid 59153] [client 20.220.13.222:62831] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZgMWHSltzl55Qz-09juQgAAARg"]
[Fri Feb 20 15:25:14.507741 2026] [:error] [pid 54552:tid 54577] [client 20.220.13.222:62165] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZgMWse4t0F-_sbWepbbAQAAANY"]
[Fri Feb 20 15:25:15.682804 2026] [:error] [pid 54520:tid 54530] [client 20.220.13.222:47427] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZgMW2QaQX7QUBqXcyGWvAAAAIg"]
[Fri Feb 20 15:25:16.709531 2026] [:error] [pid 46012:tid 46028] [client 20.220.13.222:46847] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZgMXDXz-GTvuxLwgUHLowAAAU4"]
[Fri Feb 20 15:25:17.419826 2026] [:error] [pid 46012:tid 46036] [client 20.220.13.222:47433] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZgMXTXz-GTvuxLwgUHLpQAAAVY"]
[Fri Feb 20 15:25:18.085668 2026] [:error] [pid 46012:tid 46024] [client 20.220.13.222:42882] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZgMXjXz-GTvuxLwgUHLqwAAAUo"]
[Fri Feb 20 15:25:18.686438 2026] [:error] [pid 54460:tid 54477] [client 20.220.13.222:47360] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZgMXsoUiaZ-Z7V-F98UZQAAAAw"]
[Fri Feb 20 15:25:19.519112 2026] [:error] [pid 54552:tid 54567] [client 20.220.13.222:62795] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZgMX8e4t0F-_sbWepbbBAAAAMw"]
[Fri Feb 20 15:25:20.505612 2026] [:error] [pid 54461:tid 54501] [client 20.220.13.222:47477] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZgMYC372fkN0w39NDNkGwAAAEk"]
[Fri Feb 20 15:25:21.181812 2026] [:error] [pid 54520:tid 54525] [client 20.220.13.222:47454] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZgMYWQaQX7QUBqXcyGWvgAAAIM"]
[Fri Feb 20 15:25:21.700087 2026] [:error] [pid 54460:tid 54466] [client 20.220.13.222:47375] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZgMYcoUiaZ-Z7V-F98UbQAAAAE"]
[Fri Feb 20 15:25:22.600256 2026] [:error] [pid 54520:tid 54527] [client 20.220.13.222:47478] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZgMYmQaQX7QUBqXcyGWwAAAAIU"]
[Fri Feb 20 15:25:23.238180 2026] [:error] [pid 54520:tid 54541] [client 20.220.13.222:52802] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZgMY2QaQX7QUBqXcyGWwgAAAJM"]
[Fri Feb 20 15:25:23.927636 2026] [:error] [pid 54552:tid 54558] [client 20.220.13.222:42907] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZgMY8e4t0F-_sbWepbbCAAAAMM"]
[Fri Feb 20 15:25:24.703733 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:60818] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZgMZDXz-GTvuxLwgUHLtQAAAVQ"]
[Fri Feb 20 15:25:25.158027 2026] [:error] [pid 46012:tid 46023] [client 20.220.13.222:52805] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZgMZTXz-GTvuxLwgUHLtwAAAUk"]
[Fri Feb 20 15:25:25.739564 2026] [:error] [pid 46012:tid 46029] [client 20.220.13.222:62197] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZgMZTXz-GTvuxLwgUHLuwAAAU8"]
[Fri Feb 20 15:25:26.798434 2026] [:error] [pid 54520:tid 54543] [client 20.220.13.222:52817] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZgMZmQaQX7QUBqXcyGW0QAAAJU"]
[Fri Feb 20 15:25:27.583180 2026] [:error] [pid 54520:tid 54523] [client 20.220.13.222:52827] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZgMZ2QaQX7QUBqXcyGW0wAAAIE"]
[Fri Feb 20 15:25:28.079421 2026] [:error] [pid 54460:tid 54481] [client 20.220.13.222:44948] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZgMaMoUiaZ-Z7V-F98UdAAAABA"]
[Fri Feb 20 15:25:28.623621 2026] [:error] [pid 54520:tid 54534] [client 20.220.13.222:44956] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZgMaGQaQX7QUBqXcyGW1QAAAIw"]
[Fri Feb 20 15:25:29.210711 2026] [:error] [pid 46012:tid 46021] [client 20.220.13.222:60836] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZgMaTXz-GTvuxLwgUHLwgAAAUc"]
[Fri Feb 20 15:25:29.927372 2026] [:error] [pid 59127:tid 59150] [client 20.220.13.222:8475] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZgMaXSltzl55Qz-09juVQAAARU"]
[Fri Feb 20 15:25:30.844568 2026] [:error] [pid 46012:tid 46037] [client 20.220.13.222:42880] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZgMajXz-GTvuxLwgUHLxAAAAVc"]
[Fri Feb 20 15:25:31.376947 2026] [:error] [pid 46012:tid 46024] [client 20.220.13.222:62825] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZgMazXz-GTvuxLwgUHLxQAAAUo"]
[Fri Feb 20 15:25:31.900735 2026] [:error] [pid 46012:tid 46014] [client 20.220.13.222:62154] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZgMazXz-GTvuxLwgUHLxwAAAUA"]
[Fri Feb 20 15:25:32.907881 2026] [:error] [pid 59127:tid 59129] [client 20.220.13.222:44975] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZgMbHSltzl55Qz-09juWgAAAQA"]
[Fri Feb 20 15:25:33.879658 2026] [:error] [pid 46012:tid 46032] [client 20.220.13.222:60830] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZgMbTXz-GTvuxLwgUHLygAAAVI"]
[Fri Feb 20 15:25:34.556386 2026] [:error] [pid 54460:tid 54488] [client 20.220.13.222:60814] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZgMbsoUiaZ-Z7V-F98UeAAAABc"]
[Fri Feb 20 15:25:35.577660 2026] [:error] [pid 54461:tid 54510] [client 20.220.13.222:60859] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZgMby372fkN0w39NDNkJQAAAFI"]
[Fri Feb 20 15:25:36.368457 2026] [:error] [pid 46012:tid 46022] [client 20.220.13.222:42924] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aZgMcDXz-GTvuxLwgUHLzgAAAUg"]
[Fri Feb 20 15:25:37.623304 2026] [:error] [pid 54552:tid 54559] [client 20.220.13.222:64864] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aZgMcce4t0F-_sbWepbbHAAAAMQ"]
[Fri Feb 20 15:25:38.253519 2026] [:error] [pid 54460:tid 54481] [client 20.220.13.222:40327] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aZgMcsoUiaZ-Z7V-F98UfAAAABA"]
[Fri Feb 20 15:25:39.073488 2026] [:error] [pid 54520:tid 54537] [client 20.220.13.222:8920] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aZgMc2QaQX7QUBqXcyGW5AAAAI8"]
[Fri Feb 20 15:25:39.748487 2026] [:error] [pid 54461:tid 54516] [client 20.220.13.222:42350] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZgMcy372fkN0w39NDNkLwAAAFg"]
[Fri Feb 20 15:25:40.575298 2026] [:error] [pid 59127:tid 59140] [client 20.220.13.222:8936] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZgMdHSltzl55Qz-09juYgAAAQs"]
[Fri Feb 20 15:25:41.318595 2026] [:error] [pid 59127:tid 59142] [client 20.220.13.222:44973] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZgMdXSltzl55Qz-09juZAAAAQ0"]
[Fri Feb 20 15:25:42.498645 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:42334] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZgMdjXz-GTvuxLwgUHL2AAAAUM"]
[Fri Feb 20 15:25:43.171529 2026] [:error] [pid 54461:tid 54494] [client 20.220.13.222:40354] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZgMdy372fkN0w39NDNkMQAAAEI"]
[Fri Feb 20 15:25:44.251768 2026] [:error] [pid 54460:tid 54478] [client 20.220.13.222:56750] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZgMeMoUiaZ-Z7V-F98UggAAAA0"]
[Fri Feb 20 15:25:45.095114 2026] [:error] [pid 54461:tid 54497] [client 20.220.13.222:8921] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZgMeS372fkN0w39NDNkNAAAAEU"]
[Fri Feb 20 15:25:46.347526 2026] [:error] [pid 54461:tid 54494] [client 20.220.13.222:42311] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZgMei372fkN0w39NDNkNwAAAEI"]
[Fri Feb 20 15:25:47.484602 2026] [:error] [pid 54552:tid 54574] [client 20.220.13.222:56755] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZgMe8e4t0F-_sbWepbbJgAAANM"]
[Fri Feb 20 15:25:48.245395 2026] [:error] [pid 54552:tid 54562] [client 20.220.13.222:64878] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZgMfMe4t0F-_sbWepbbKQAAAMc"]
[Fri Feb 20 15:25:48.931972 2026] [:error] [pid 46012:tid 46024] [client 20.220.13.222:64794] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZgMfDXz-GTvuxLwgUHL6QAAAUo"]
[Fri Feb 20 15:25:49.464875 2026] [:error] [pid 54520:tid 54527] [client 20.220.13.222:8507] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZgMfWQaQX7QUBqXcyGW6gAAAIU"]
[Fri Feb 20 15:25:50.330303 2026] [:error] [pid 54460:tid 54487] [client 20.220.13.222:56755] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aZgMfsoUiaZ-Z7V-F98UigAAABY"]
[Fri Feb 20 15:25:51.132145 2026] [:error] [pid 54552:tid 54563] [client 20.220.13.222:64847] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aZgMf8e4t0F-_sbWepbbLgAAAMg"]
[Fri Feb 20 15:25:51.663520 2026] [:error] [pid 54552:tid 54569] [client 20.220.13.222:8914] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aZgMf8e4t0F-_sbWepbbMAAAAM4"]
[Fri Feb 20 15:25:52.186941 2026] [:error] [pid 54520:tid 54541] [client 20.220.13.222:56741] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aZgMgGQaQX7QUBqXcyGW7AAAAJM"]
[Fri Feb 20 15:25:53.261796 2026] [:error] [pid 54460:tid 54467] [client 20.220.13.222:8919] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Fri Feb 20 15:25:53.469070 2026] [:error] [pid 54460:tid 54485] [client 20.220.13.222:8919] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 20 15:25:53.677692 2026] [:error] [pid 54460:tid 54465] [client 20.220.13.222:8919] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Feb 20 15:25:53.905136 2026] [:error] [pid 54460:tid 54489] [client 20.220.13.222:8919] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Feb 20 15:25:54.175473 2026] [:error] [pid 54460:tid 54473] [client 20.220.13.222:8919] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Feb 20 15:25:54.384016 2026] [:error] [pid 54460:tid 54484] [client 20.220.13.222:8919] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Feb 20 15:25:54.588903 2026] [:error] [pid 54460:tid 54487] [client 20.220.13.222:8919] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZgMgsoUiaZ-Z7V-F98UlgAAABY"]
[Fri Feb 20 15:25:55.293005 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:52013] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Feb 20 15:25:55.502890 2026] [:error] [pid 46012:tid 46028] [client 20.220.13.222:52013] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Fri Feb 20 15:25:55.710805 2026] [:error] [pid 46012:tid 46015] [client 20.220.13.222:52013] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri Feb 20 15:25:55.918949 2026] [:error] [pid 46012:tid 46025] [client 20.220.13.222:52013] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Fri Feb 20 15:25:56.123746 2026] [:error] [pid 46012:tid 46016] [client 20.220.13.222:52013] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZgMhDXz-GTvuxLwgUHMCQAAAUI"]
[Fri Feb 20 15:25:56.745359 2026] [:error] [pid 54552:tid 54577] [client 20.220.13.222:42306] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZgMhMe4t0F-_sbWepbbQQAAANY"]
[Fri Feb 20 15:25:57.854168 2026] [:error] [pid 54461:tid 54510] [client 20.220.13.222:52006] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZgMhS372fkN0w39NDNkUQAAAFI"]
[Fri Feb 20 15:25:58.607182 2026] [:error] [pid 46012:tid 46037] [client 20.220.13.222:56759] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZgMhjXz-GTvuxLwgUHMDQAAAVc"]
[Fri Feb 20 15:25:59.220293 2026] [:error] [pid 54460:tid 54481] [client 20.220.13.222:8949] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZgMh8oUiaZ-Z7V-F98UyAAAABA"]
[Fri Feb 20 15:25:59.759779 2026] [:error] [pid 54461:tid 54505] [client 20.220.13.222:8948] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZgMhy372fkN0w39NDNkVgAAAE0"]
[Fri Feb 20 15:26:00.404138 2026] [:error] [pid 54520:tid 54533] [client 20.220.13.222:61659] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZgMiGQaQX7QUBqXcyGW-AAAAIs"]
[Fri Feb 20 15:26:01.112900 2026] [:error] [pid 54460:tid 54476] [client 20.220.13.222:42342] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZgMicoUiaZ-Z7V-F98UywAAAAs"]
[Fri Feb 20 15:26:01.776120 2026] [:error] [pid 46012:tid 46033] [client 20.220.13.222:56744] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZgMiTXz-GTvuxLwgUHMFAAAAVM"]
[Fri Feb 20 15:26:03.044466 2026] [:error] [pid 46012:tid 46025] [client 20.220.13.222:8957] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZgMizXz-GTvuxLwgUHMGQAAAUs"]
[Fri Feb 20 15:26:03.969374 2026] [:error] [pid 54461:tid 54510] [client 20.220.13.222:56714] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZgMiy372fkN0w39NDNkXAAAAFI"]
[Fri Feb 20 15:26:04.761105 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:51996] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZgMjDXz-GTvuxLwgUHMHQAAAVQ"]
[Fri Feb 20 15:26:05.485218 2026] [:error] [pid 46012:tid 46038] [client 20.220.13.222:56754] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZgMjTXz-GTvuxLwgUHMIAAAAVg"]
[Fri Feb 20 15:26:06.254102 2026] [:error] [pid 54461:tid 54509] [client 20.220.13.222:42345] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZgMji372fkN0w39NDNkXwAAAFE"]
[Fri Feb 20 15:26:07.046341 2026] [:error] [pid 46012:tid 46018] [client 20.220.13.222:61655] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZgMjzXz-GTvuxLwgUHMKgAAAUQ"]
[Fri Feb 20 15:26:08.119626 2026] [:error] [pid 54552:tid 54574] [client 20.220.13.222:52000] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZgMkMe4t0F-_sbWepbbWAAAANM"]
[Fri Feb 20 15:26:09.042880 2026] [:error] [pid 54520:tid 54530] [client 20.220.13.222:42337] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZgMkWQaQX7QUBqXcyGXAQAAAIg"]
[Fri Feb 20 15:26:09.808511 2026] [:error] [pid 54552:tid 54569] [client 20.220.13.222:52022] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZgMkce4t0F-_sbWepbbXgAAAM4"]
[Fri Feb 20 15:26:10.444517 2026] [:error] [pid 54461:tid 54494] [client 20.220.13.222:64838] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZgMki372fkN0w39NDNkZAAAAEI"]
[Fri Feb 20 15:26:10.950980 2026] [:error] [pid 59127:tid 59148] [client 20.220.13.222:62775] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZgMknSltzl55Qz-09juqgAAARM"]
[Fri Feb 20 15:26:11.534654 2026] [:error] [pid 54461:tid 54496] [client 20.220.13.222:64860] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZgMky372fkN0w39NDNkZwAAAEQ"]
[Fri Feb 20 15:26:12.110446 2026] [:error] [pid 54520:tid 54526] [client 20.220.13.222:56766] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZgMlGQaQX7QUBqXcyGXBQAAAIQ"]
[Fri Feb 20 15:26:12.665596 2026] [:error] [pid 54520:tid 54543] [client 20.220.13.222:64892] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZgMlGQaQX7QUBqXcyGXBgAAAJU"]
[Fri Feb 20 15:26:13.108509 2026] [:error] [pid 54520:tid 54527] [client 20.220.13.222:40357] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZgMlWQaQX7QUBqXcyGXCgAAAIU"]
[Fri Feb 20 15:26:13.575234 2026] [:error] [pid 46012:tid 46020] [client 20.220.13.222:64871] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZgMlTXz-GTvuxLwgUHMMAAAAUY"]
[Fri Feb 20 15:26:14.010642 2026] [:error] [pid 46012:tid 46024] [client 20.220.13.222:64855] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZgMljXz-GTvuxLwgUHMMQAAAUo"]
[Fri Feb 20 15:26:14.691065 2026] [:error] [pid 54461:tid 54511] [client 20.220.13.222:52004] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZgMli372fkN0w39NDNkawAAAFM"]
[Fri Feb 20 15:26:15.448724 2026] [:error] [pid 59127:tid 59141] [client 20.220.13.222:61638] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZgMl3Sltzl55Qz-09jusAAAAQw"]
[Fri Feb 20 15:26:16.246433 2026] [:error] [pid 59127:tid 59136] [client 20.220.13.222:56718] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZgMmHSltzl55Qz-09jusQAAAQc"]
[Fri Feb 20 15:26:16.685290 2026] [:error] [pid 54520:tid 54530] [client 20.220.13.222:62754] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZgMmGQaQX7QUBqXcyGXDAAAAIg"]
[Fri Feb 20 15:26:17.186591 2026] [:error] [pid 54520:tid 54528] [client 20.220.13.222:56765] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZgMmWQaQX7QUBqXcyGXDQAAAIY"]
[Fri Feb 20 15:26:17.737992 2026] [:error] [pid 46012:tid 46023] [client 20.220.13.222:42339] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZgMmTXz-GTvuxLwgUHMPQAAAUk"]
[Fri Feb 20 15:26:18.189332 2026] [:error] [pid 46012:tid 46033] [client 20.220.13.222:40320] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZgMmjXz-GTvuxLwgUHMPwAAAVM"]
[Fri Feb 20 15:26:19.181315 2026] [:error] [pid 46012:tid 46025] [client 20.220.13.222:62778] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZgMmzXz-GTvuxLwgUHMQgAAAUs"]
[Fri Feb 20 15:26:19.917486 2026] [:error] [pid 54461:tid 54499] [client 20.220.13.222:64844] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZgMmy372fkN0w39NDNkcQAAAEc"]
[Fri Feb 20 15:26:20.340501 2026] [:error] [pid 46012:tid 46022] [client 20.220.13.222:37910] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZgMnDXz-GTvuxLwgUHMRgAAAUg"]
[Fri Feb 20 15:26:21.060197 2026] [:error] [pid 46012:tid 46023] [client 20.220.13.222:64889] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZgMnTXz-GTvuxLwgUHMSAAAAUk"]
[Fri Feb 20 15:26:21.769954 2026] [:error] [pid 54460:tid 54469] [client 20.220.13.222:64874] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZgMncoUiaZ-Z7V-F98U3wAAAAQ"]
[Fri Feb 20 15:26:22.318209 2026] [:error] [pid 46012:tid 46037] [client 20.220.13.222:64867] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZgMnjXz-GTvuxLwgUHMTAAAAVc"]
[Fri Feb 20 15:26:22.780685 2026] [:error] [pid 54460:tid 54479] [client 20.220.13.222:52016] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZgMnsoUiaZ-Z7V-F98U5QAAAA4"]
[Fri Feb 20 15:26:23.199868 2026] [:error] [pid 59127:tid 59131] [client 20.220.13.222:62725] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZgMn3Sltzl55Qz-09juuAAAAQI"]
[Fri Feb 20 15:26:23.615108 2026] [:error] [pid 59127:tid 59145] [client 20.220.13.222:40369] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZgMn3Sltzl55Qz-09juuQAAARA"]
[Fri Feb 20 15:26:24.155087 2026] [:error] [pid 59127:tid 59148] [client 20.220.13.222:56749] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZgMoHSltzl55Qz-09juugAAARM"]
[Fri Feb 20 15:26:24.677969 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:60820] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZgMoDXz-GTvuxLwgUHMUQAAAVQ"]
[Fri Feb 20 15:26:25.319123 2026] [:error] [pid 54461:tid 54495] [client 20.220.13.222:64852] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZgMoS372fkN0w39NDNkdgAAAEM"]
[Fri Feb 20 15:26:26.261964 2026] [:error] [pid 46012:tid 46014] [client 20.220.13.222:61649] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZgMojXz-GTvuxLwgUHMVQAAAUA"]
[Fri Feb 20 15:26:27.292311 2026] [:error] [pid 46012:tid 46036] [client 20.220.13.222:64856] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZgMozXz-GTvuxLwgUHMWQAAAVY"]
[Fri Feb 20 15:26:27.776706 2026] [:error] [pid 54461:tid 54506] [client 20.220.13.222:42343] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZgMoy372fkN0w39NDNkegAAAE4"]
[Fri Feb 20 15:26:28.288198 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:56739] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZgMpC372fkN0w39NDNkfQAAAEE"]
[Fri Feb 20 15:26:28.706685 2026] [:error] [pid 59127:tid 59141] [client 20.220.13.222:56723] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZgMpHSltzl55Qz-09juxAAAAQw"]
[Fri Feb 20 15:26:29.177886 2026] [:error] [pid 54461:tid 54510] [client 20.220.13.222:51968] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZgMpS372fkN0w39NDNkfgAAAFI"]
[Fri Feb 20 15:26:30.018639 2026] [:error] [pid 54552:tid 54564] [client 20.220.13.222:64837] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZgMpse4t0F-_sbWepbbbwAAAMk"]
[Fri Feb 20 15:26:30.605302 2026] [:error] [pid 54552:tid 54578] [client 20.220.13.222:62777] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZgMpse4t0F-_sbWepbbcQAAANc"]
[Fri Feb 20 15:26:31.244650 2026] [:error] [pid 46012:tid 46018] [client 20.220.13.222:62777] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZgMpzXz-GTvuxLwgUHMXwAAAUQ"]
[Fri Feb 20 15:26:31.722449 2026] [:error] [pid 46012:tid 46036] [client 20.220.13.222:61661] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZgMpzXz-GTvuxLwgUHMZQAAAVY"]
[Fri Feb 20 15:26:32.496916 2026] [:error] [pid 54552:tid 54579] [client 20.220.13.222:51977] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZgMqMe4t0F-_sbWepbbcgAAANg"]
[Fri Feb 20 15:26:33.130462 2026] [:error] [pid 59127:tid 59150] [client 20.220.13.222:37918] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZgMqXSltzl55Qz-09juywAAARU"]
[Fri Feb 20 15:26:33.889534 2026] [:error] [pid 46012:tid 46033] [client 20.220.13.222:40368] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZgMqTXz-GTvuxLwgUHMawAAAVM"]
[Fri Feb 20 15:26:35.033291 2026] [:error] [pid 54552:tid 54574] [client 20.220.13.222:56715] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZgMq8e4t0F-_sbWepbbdgAAANM"]
[Fri Feb 20 15:26:35.529421 2026] [:error] [pid 54520:tid 54534] [client 20.220.13.222:8941] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZgMq2QaQX7QUBqXcyGXIQAAAIw"]
[Fri Feb 20 15:26:36.153866 2026] [:error] [pid 54520:tid 54532] [client 20.220.13.222:51989] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZgMrGQaQX7QUBqXcyGXJAAAAIo"]
[Fri Feb 20 15:26:36.852009 2026] [:error] [pid 54460:tid 54477] [client 20.220.13.222:62779] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZgMrMoUiaZ-Z7V-F98U9QAAAAw"]
[Fri Feb 20 15:26:37.352771 2026] [:error] [pid 54520:tid 54529] [client 20.220.13.222:42316] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZgMrWQaQX7QUBqXcyGXJgAAAIc"]
[Fri Feb 20 15:26:37.907562 2026] [:error] [pid 54520:tid 54537] [client 20.220.13.222:64865] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZgMrWQaQX7QUBqXcyGXKwAAAI8"]
[Fri Feb 20 15:26:38.386246 2026] [:error] [pid 54461:tid 54499] [client 20.220.13.222:42340] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZgMri372fkN0w39NDNkhwAAAEc"]
[Fri Feb 20 15:26:39.278481 2026] [:error] [pid 46012:tid 46026] [client 20.220.13.222:42315] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZgMrzXz-GTvuxLwgUHMcwAAAUw"]
[Fri Feb 20 15:26:39.960340 2026] [:error] [pid 59127:tid 59140] [client 20.220.13.222:56736] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZgMr3Sltzl55Qz-09ju0wAAAQs"]
[Fri Feb 20 15:26:40.645478 2026] [:error] [pid 54552:tid 54576] [client 20.220.13.222:42357] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZgMsMe4t0F-_sbWepbbhAAAANU"]
[Fri Feb 20 15:26:41.100220 2026] [:error] [pid 46012:tid 46031] [client 20.220.13.222:62759] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZgMsTXz-GTvuxLwgUHMdwAAAVE"]
[Fri Feb 20 15:26:41.607220 2026] [:error] [pid 46012:tid 46029] [client 20.220.13.222:62732] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZgMsTXz-GTvuxLwgUHMeQAAAU8"]
[Fri Feb 20 15:26:42.622829 2026] [:error] [pid 54461:tid 54513] [client 20.220.13.222:52011] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZgMsi372fkN0w39NDNkjAAAAFU"]
[Fri Feb 20 15:26:43.160769 2026] [:error] [pid 54520:tid 54537] [client 20.220.13.222:40348] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZgMs2QaQX7QUBqXcyGXNwAAAI8"]
[Fri Feb 20 15:26:43.904533 2026] [:error] [pid 59127:tid 59148] [client 20.220.13.222:40349] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZgMs3Sltzl55Qz-09ju2AAAARM"]
[Fri Feb 20 15:26:44.370901 2026] [:error] [pid 54552:tid 54556] [client 20.220.13.222:56761] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZgMtMe4t0F-_sbWepbbiQAAAME"]
[Fri Feb 20 15:26:45.277304 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:42352] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZgMtS372fkN0w39NDNkkgAAAEE"]
[Fri Feb 20 15:26:46.190520 2026] [:error] [pid 46012:tid 46020] [client 20.220.13.222:8959] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZgMtjXz-GTvuxLwgUHMhgAAAUY"]
[Fri Feb 20 15:26:47.197873 2026] [:error] [pid 54552:tid 54560] [client 20.220.13.222:62733] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aZgMt8e4t0F-_sbWepbbkgAAAMU"]
[Fri Feb 20 15:26:48.416664 2026] [:error] [pid 59127:tid 59133] [client 20.220.13.222:42331] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aZgMuHSltzl55Qz-09ju2wAAAQQ"]
[Fri Feb 20 15:26:49.032666 2026] [:error] [pid 59127:tid 59144] [client 20.220.13.222:61636] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aZgMuXSltzl55Qz-09ju3gAAAQ8"]
[Fri Feb 20 15:26:49.833486 2026] [:error] [pid 54552:tid 54566] [client 20.220.13.222:62806] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "aZgMuce4t0F-_sbWepbblgAAAMs"]
[Fri Feb 20 15:26:50.879459 2026] [:error] [pid 54552:tid 54576] [client 20.220.13.222:62745] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZgMuse4t0F-_sbWepbbmAAAANU"]
[Fri Feb 20 15:26:51.743085 2026] [:error] [pid 59127:tid 59152] [client 20.220.13.222:40352] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZgMu3Sltzl55Qz-09ju4QAAARc"]
[Fri Feb 20 15:26:52.789876 2026] [:error] [pid 54552:tid 54565] [client 20.220.13.222:62782] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZgMvMe4t0F-_sbWepbbmwAAAMo"]
[Fri Feb 20 15:26:54.546600 2026] [:error] [pid 59127:tid 59146] [client 20.220.13.222:42884] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZgMvnSltzl55Qz-09ju5AAAARE"]
[Fri Feb 20 15:26:55.086488 2026] [:error] [pid 46012:tid 46037] [client 20.220.13.222:64771] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Fri Feb 20 15:26:55.513352 2026] [:error] [pid 46012:tid 46036] [client 20.220.13.222:64771] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 20 15:26:55.720739 2026] [:error] [pid 46012:tid 46025] [client 20.220.13.222:64771] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Feb 20 15:26:55.928827 2026] [:error] [pid 46012:tid 46030] [client 20.220.13.222:64771] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Feb 20 15:26:56.157385 2026] [:error] [pid 46012:tid 46021] [client 20.220.13.222:64771] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Feb 20 15:26:56.992189 2026] [:error] [pid 46012:tid 46032] [client 20.220.13.222:64771] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Fri Feb 20 15:26:57.196963 2026] [:error] [pid 46012:tid 46038] [client 20.220.13.222:64771] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZgMwTXz-GTvuxLwgUHMmwAAAVg"]
[Fri Feb 20 15:26:58.944113 2026] [:error] [pid 54461:tid 54503] [client 20.220.13.222:56763] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aZgMwi372fkN0w39NDNknwAAAEs"]
[Fri Feb 20 15:26:59.551128 2026] [:error] [pid 59127:tid 59138] [client 20.220.13.222:60824] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZgMw3Sltzl55Qz-09ju6gAAAQk"]
[Fri Feb 20 15:27:00.624642 2026] [:error] [pid 59127:tid 59143] [client 20.220.13.222:40331] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZgMxHSltzl55Qz-09ju7AAAAQ4"]
[Fri Feb 20 15:27:01.377372 2026] [:error] [pid 54460:tid 54467] [client 20.220.13.222:56760] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZgMxcoUiaZ-Z7V-F98VAwAAAAI"]
[Fri Feb 20 15:27:02.048597 2026] [:error] [pid 54461:tid 54496] [client 20.220.13.222:61690] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZgMxi372fkN0w39NDNkpwAAAEQ"]
[Fri Feb 20 15:27:02.915332 2026] [:error] [pid 54461:tid 54514] [client 20.220.13.222:37903] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZgMxi372fkN0w39NDNkqgAAAFY"]
[Fri Feb 20 15:27:03.683032 2026] [:error] [pid 54460:tid 54482] [client 20.220.13.222:52020] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZgMx8oUiaZ-Z7V-F98VCAAAABE"]
[Fri Feb 20 15:27:04.886134 2026] [:error] [pid 54460:tid 54476] [client 20.220.13.222:62753] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZgMyMoUiaZ-Z7V-F98VCgAAAAs"]
[Fri Feb 20 15:27:05.840463 2026] [:error] [pid 54461:tid 54514] [client 20.220.13.222:8934] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZgMyS372fkN0w39NDNksgAAAFY"]
[Fri Feb 20 15:27:06.751654 2026] [:error] [pid 54552:tid 54572] [client 20.220.13.222:62730] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZgMyse4t0F-_sbWepbbqwAAANE"]
[Fri Feb 20 15:27:07.268748 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:42351] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZgMyzXz-GTvuxLwgUHMpAAAAVQ"]
[Fri Feb 20 15:27:07.889059 2026] [:error] [pid 54460:tid 54475] [client 20.220.13.222:61639] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZgMy8oUiaZ-Z7V-F98VEAAAAAo"]
[Fri Feb 20 15:27:08.687566 2026] [:error] [pid 54520:tid 54538] [client 20.220.13.222:62760] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZgMzGQaQX7QUBqXcyGXTwAAAJA"]
[Fri Feb 20 15:27:09.512990 2026] [:error] [pid 54461:tid 54508] [client 20.220.13.222:42939] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aZgMzS372fkN0w39NDNkswAAAFA"]
[Fri Feb 20 15:27:10.947359 2026] [:error] [pid 54552:tid 54578] [client 20.220.13.222:64836] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aZgMzse4t0F-_sbWepbbsAAAANc"]
[Fri Feb 20 15:27:11.595344 2026] [:error] [pid 54460:tid 54472] [client 20.220.13.222:64861] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aZgMz8oUiaZ-Z7V-F98VFQAAAAc"]
[Fri Feb 20 15:27:12.201257 2026] [:error] [pid 46012:tid 46033] [client 20.220.13.222:40328] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aZgM0DXz-GTvuxLwgUHMqQAAAVM"]
[Fri Feb 20 15:27:12.863687 2026] [:error] [pid 46012:tid 46022] [client 20.220.13.222:51997] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aZgM0DXz-GTvuxLwgUHMqwAAAUg"]
[Fri Feb 20 15:27:13.560834 2026] [:error] [pid 54552:tid 54579] [client 20.220.13.222:8449] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZgM0ce4t0F-_sbWepbbtAAAANg"]
[Fri Feb 20 15:27:14.080920 2026] [:error] [pid 46012:tid 46029] [client 20.220.13.222:42354] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZgM0jXz-GTvuxLwgUHMrQAAAU8"]
[Fri Feb 20 15:27:14.765227 2026] [:error] [pid 54520:tid 54528] [client 20.220.13.222:62765] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZgM0mQaQX7QUBqXcyGXVwAAAIY"]
[Fri Feb 20 15:27:15.663039 2026] [:error] [pid 54520:tid 54537] [client 20.220.13.222:40332] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZgM02QaQX7QUBqXcyGXWgAAAI8"]
[Fri Feb 20 15:27:16.502403 2026] [:error] [pid 46012:tid 46016] [client 20.220.13.222:42322] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aZgM1DXz-GTvuxLwgUHMsgAAAUI"]
[Fri Feb 20 15:27:17.191575 2026] [:error] [pid 54460:tid 54465] [client 20.220.13.222:62761] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aZgM1coUiaZ-Z7V-F98VGgAAAAA"]
[Fri Feb 20 15:27:17.785580 2026] [:error] [pid 54552:tid 54564] [client 20.220.13.222:64840] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aZgM1ce4t0F-_sbWepbbuAAAAMk"]
[Fri Feb 20 15:27:19.018724 2026] [:error] [pid 54552:tid 54558] [client 20.220.13.222:40373] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aZgM18e4t0F-_sbWepbbvAAAAMM"]
[Fri Feb 20 15:27:20.305732 2026] [:error] [pid 59127:tid 59129] [client 20.220.13.222:64848] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aZgM2HSltzl55Qz-09ju_wAAAQA"]
[Fri Feb 20 15:27:20.994447 2026] [:error] [pid 59127:tid 59142] [client 20.220.13.222:56740] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aZgM2HSltzl55Qz-09jvAwAAAQ0"]
[Fri Feb 20 15:27:21.739168 2026] [:error] [pid 46012:tid 46035] [client 20.220.13.222:64848] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aZgM2TXz-GTvuxLwgUHMuAAAAVU"]
[Fri Feb 20 15:27:22.254449 2026] [:error] [pid 59127:tid 59149] [client 20.220.13.222:62740] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "aZgM2nSltzl55Qz-09jvBwAAARQ"]
[Fri Feb 20 15:27:23.191492 2026] [:error] [pid 54460:tid 54471] [client 20.220.13.222:40336] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZgM28oUiaZ-Z7V-F98VIwAAAAY"]
[Fri Feb 20 15:27:23.835131 2026] [:error] [pid 54460:tid 54470] [client 20.220.13.222:8958] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZgM28oUiaZ-Z7V-F98VJQAAAAU"]
[Fri Feb 20 15:27:24.274739 2026] [:error] [pid 59127:tid 59146] [client 20.220.13.222:61664] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZgM3HSltzl55Qz-09jvEQAAARE"]
[Fri Feb 20 15:27:25.265656 2026] [:error] [pid 46012:tid 46024] [client 20.220.13.222:64857] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZgM3TXz-GTvuxLwgUHMuwAAAUo"]
[Fri Feb 20 15:27:25.979996 2026] [:error] [pid 54552:tid 54556] [client 20.220.13.222:42358] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aZgM3ce4t0F-_sbWepbbwwAAAME"]
[Fri Feb 20 15:27:26.652831 2026] [:error] [pid 46012:tid 46021] [client 20.220.13.222:37897] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aZgM3jXz-GTvuxLwgUHMvQAAAUc"]
[Fri Feb 20 15:27:27.456236 2026] [:error] [pid 54460:tid 54465] [client 20.220.13.222:51994] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aZgM38oUiaZ-Z7V-F98VNgAAAAA"]
[Fri Feb 20 15:27:28.109320 2026] [:error] [pid 54460:tid 54476] [client 20.220.13.222:40334] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aZgM4MoUiaZ-Z7V-F98VOAAAAAs"]
[Fri Feb 20 15:27:28.915843 2026] [:error] [pid 54460:tid 54487] [client 20.220.13.222:61641] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aZgM4MoUiaZ-Z7V-F98VOwAAABY"]
[Fri Feb 20 15:27:29.450605 2026] [:error] [pid 54520:tid 54534] [client 20.220.13.222:40338] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aZgM4WQaQX7QUBqXcyGXZAAAAIw"]
[Fri Feb 20 15:27:29.934528 2026] [:error] [pid 54520:tid 54532] [client 20.220.13.222:56720] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aZgM4WQaQX7QUBqXcyGXZgAAAIo"]
[Fri Feb 20 15:27:30.651107 2026] [:error] [pid 54520:tid 54540] [client 20.220.13.222:61642] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aZgM4mQaQX7QUBqXcyGXaAAAAJI"]
[Fri Feb 20 15:27:31.177757 2026] [:error] [pid 54552:tid 54569] [client 20.220.13.222:8459] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aZgM48e4t0F-_sbWepbbxgAAAM4"]
[Fri Feb 20 15:27:31.624376 2026] [:error] [pid 54520:tid 54546] [client 20.220.13.222:52030] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aZgM42QaQX7QUBqXcyGXbAAAAJg"]
[Fri Feb 20 15:27:32.255543 2026] [:error] [pid 54520:tid 54525] [client 20.220.13.222:40363] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aZgM5GQaQX7QUBqXcyGXcAAAAIM"]
[Fri Feb 20 15:27:32.709630 2026] [:error] [pid 54460:tid 54486] [client 20.220.13.222:64769] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aZgM5MoUiaZ-Z7V-F98VQwAAABU"]
[Fri Feb 20 15:27:33.389619 2026] [:error] [pid 59127:tid 59146] [client 20.220.13.222:62735] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZgM5XSltzl55Qz-09jvGQAAARE"]
[Fri Feb 20 15:27:34.160790 2026] [:error] [pid 46012:tid 46021] [client 20.220.13.222:8912] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZgM5jXz-GTvuxLwgUHMygAAAUc"]
[Fri Feb 20 15:27:34.750962 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:62758] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZgM5i372fkN0w39NDNkxwAAAEE"]
[Fri Feb 20 15:27:35.367687 2026] [:error] [pid 54552:tid 54567] [client 20.220.13.222:42319] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZgM58e4t0F-_sbWepbbyAAAAMw"]
[Fri Feb 20 15:27:35.912684 2026] [:error] [pid 54552:tid 54572] [client 20.220.13.222:56729] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgM58e4t0F-_sbWepbbyQAAANE"]
[Fri Feb 20 15:27:36.376328 2026] [:error] [pid 54460:tid 54478] [client 20.220.13.222:64787] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgM6MoUiaZ-Z7V-F98VRwAAAA0"]
[Fri Feb 20 15:27:36.819352 2026] [:error] [pid 54461:tid 54511] [client 20.220.13.222:52013] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgM6C372fkN0w39NDNkyQAAAFM"]
[Fri Feb 20 15:27:37.264041 2026] [:error] [pid 54460:tid 54487] [client 20.220.13.222:62737] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgM6coUiaZ-Z7V-F98VSAAAABY"]
[Fri Feb 20 15:27:38.019096 2026] [:error] [pid 54520:tid 54533] [client 20.220.13.222:64873] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZgM6mQaQX7QUBqXcyGXdAAAAIs"]
[Fri Feb 20 15:27:38.925674 2026] [:error] [pid 54460:tid 54471] [client 20.220.13.222:60848] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZgM6soUiaZ-Z7V-F98VSwAAAAY"]
[Fri Feb 20 15:27:39.921017 2026] [:error] [pid 54552:tid 54576] [client 20.220.13.222:52017] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZgM68e4t0F-_sbWepbb0QAAANU"]
[Fri Feb 20 15:27:40.414488 2026] [:error] [pid 46012:tid 46038] [client 20.220.13.222:62751] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZgM7DXz-GTvuxLwgUHM0AAAAVg"]
[Fri Feb 20 15:27:41.083332 2026] [:error] [pid 54461:tid 54501] [client 20.220.13.222:62749] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZgM7S372fkN0w39NDNk0wAAAEk"]
[Fri Feb 20 15:27:41.847133 2026] [:error] [pid 54520:tid 54530] [client 20.220.13.222:37940] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aZgM7WQaQX7QUBqXcyGXdgAAAIg"]
[Fri Feb 20 15:27:42.455958 2026] [:error] [pid 54461:tid 54511] [client 20.220.13.222:64849] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aZgM7i372fkN0w39NDNk1gAAAFM"]
[Fri Feb 20 15:27:42.997673 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:42355] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aZgM7jXz-GTvuxLwgUHM1QAAAUM"]
[Fri Feb 20 15:27:43.792430 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:8497] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aZgM7zXz-GTvuxLwgUHM2AAAAVQ"]
[Fri Feb 20 15:27:44.557179 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:62763] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZgM8C372fkN0w39NDNk4AAAAEE"]
[Fri Feb 20 15:27:45.115047 2026] [:error] [pid 46012:tid 46024] [client 20.220.13.222:56705] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZgM8TXz-GTvuxLwgUHM3QAAAUo"]
[Fri Feb 20 15:27:46.251452 2026] [:error] [pid 46012:tid 46022] [client 20.220.13.222:40335] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZgM8jXz-GTvuxLwgUHM4gAAAUg"]
[Fri Feb 20 15:27:46.783979 2026] [:error] [pid 54552:tid 54579] [client 20.220.13.222:60846] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZgM8se4t0F-_sbWepbb0wAAANg"]
[Fri Feb 20 15:27:47.390015 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:62846] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZgM8y372fkN0w39NDNk6QAAAEE"]
[Fri Feb 20 15:27:48.397324 2026] [:error] [pid 46012:tid 46015] [client 20.220.13.222:8899] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZgM9DXz-GTvuxLwgUHM5QAAAUE"]
[Fri Feb 20 15:27:48.999709 2026] [:error] [pid 54552:tid 54577] [client 20.220.13.222:40333] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZgM9Me4t0F-_sbWepbb2AAAANY"]
[Fri Feb 20 15:27:49.867877 2026] [:error] [pid 54460:tid 54489] [client 20.220.13.222:37909] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZgM9coUiaZ-Z7V-F98VYAAAABg"]
[Fri Feb 20 15:27:50.733104 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:42323] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZgM9i372fkN0w39NDNk7wAAAEE"]
[Fri Feb 20 15:27:51.506076 2026] [:error] [pid 46012:tid 46025] [client 20.220.13.222:62722] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZgM9zXz-GTvuxLwgUHM6QAAAUs"]
[Fri Feb 20 15:27:52.068099 2026] [:error] [pid 54461:tid 54504] [client 20.220.13.222:8907] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZgM-C372fkN0w39NDNk8QAAAEw"]
[Fri Feb 20 15:27:52.572983 2026] [:error] [pid 54552:tid 54563] [client 20.220.13.222:40344] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZgM-Me4t0F-_sbWepbb3AAAAMg"]
[Fri Feb 20 15:27:53.693432 2026] [:error] [pid 54552:tid 54578] [client 20.220.13.222:61688] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZgM-ce4t0F-_sbWepbb3QAAANc"]
[Fri Feb 20 15:27:54.291473 2026] [:error] [pid 59127:tid 59153] [client 20.220.13.222:62727] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZgM-nSltzl55Qz-09jvKQAAARg"]
[Fri Feb 20 15:27:54.883322 2026] [:error] [pid 59127:tid 59133] [client 20.220.13.222:56722] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZgM-nSltzl55Qz-09jvKgAAAQQ"]
[Fri Feb 20 15:27:55.543512 2026] [:error] [pid 54461:tid 54516] [client 20.220.13.222:62734] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZgM-y372fkN0w39NDNk9wAAAFg"]
[Fri Feb 20 15:27:56.101844 2026] [:error] [pid 54460:tid 54482] [client 20.220.13.222:8902] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZgM_MoUiaZ-Z7V-F98VZAAAABE"]
[Fri Feb 20 15:27:56.867456 2026] [:error] [pid 54461:tid 54501] [client 20.220.13.222:56725] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZgM_C372fkN0w39NDNk-gAAAEk"]
[Fri Feb 20 15:27:57.485013 2026] [:error] [pid 59127:tid 59138] [client 20.220.13.222:44939] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZgM_XSltzl55Qz-09jvLwAAAQk"]
[Fri Feb 20 15:27:58.581148 2026] [:error] [pid 46012:tid 46027] [client 20.220.13.222:51993] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 20 15:27:58.789046 2026] [:error] [pid 46012:tid 46020] [client 20.220.13.222:51993] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Fri Feb 20 15:27:58.994194 2026] [:error] [pid 46012:tid 46014] [client 20.220.13.222:51993] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZgM_jXz-GTvuxLwgUHM9AAAAUA"]
[Fri Feb 20 15:27:59.527261 2026] [:error] [pid 54460:tid 54487] [client 20.220.13.222:44991] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aZgM_8oUiaZ-Z7V-F98VZQAAABY"]
[Fri Feb 20 15:28:00.109343 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:61680] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Feb 20 15:28:00.428858 2026] [:error] [pid 46012:tid 46031] [client 20.220.13.222:61680] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Fri Feb 20 15:28:00.639814 2026] [:error] [pid 46012:tid 46018] [client 20.220.13.222:61680] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Fri Feb 20 15:28:00.851891 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:61680] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Fri Feb 20 15:28:01.060817 2026] [:error] [pid 46012:tid 46019] [client 20.220.13.222:61680] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Fri Feb 20 15:28:01.270012 2026] [:error] [pid 46012:tid 46035] [client 20.220.13.222:61680] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Fri Feb 20 15:28:01.485857 2026] [:error] [pid 46012:tid 46030] [client 20.220.13.222:61680] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Fri Feb 20 15:28:01.691795 2026] [:error] [pid 46012:tid 46023] [client 20.220.13.222:61680] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aZgNATXz-GTvuxLwgUHM_gAAAUk"]
[Fri Feb 20 15:28:02.488097 2026] [:error] [pid 59127:tid 59139] [client 20.220.13.222:37942] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aZgNAnSltzl55Qz-09jvNQAAAQo"]
[Fri Feb 20 15:28:03.008783 2026] [:error] [pid 54520:tid 54528] [client 20.220.13.222:61645] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aZgNA2QaQX7QUBqXcyGXkQAAAIY"]
[Fri Feb 20 15:28:03.560083 2026] [:error] [pid 54460:tid 54471] [client 20.220.13.222:37927] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "aZgNA8oUiaZ-Z7V-F98VaAAAAAY"]
[Fri Feb 20 15:28:04.116538 2026] [:error] [pid 54460:tid 54488] [client 20.220.13.222:37919] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aZgNBMoUiaZ-Z7V-F98VbAAAABc"]
[Fri Feb 20 15:28:04.942362 2026] [:error] [pid 54461:tid 54506] [client 20.220.13.222:60839] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aZgNBC372fkN0w39NDNk_gAAAE4"]
[Fri Feb 20 15:28:05.720234 2026] [:error] [pid 54461:tid 54499] [client 20.220.13.222:40381] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aZgNBS372fkN0w39NDNk_wAAAEc"]
[Fri Feb 20 15:28:06.310121 2026] [:error] [pid 54460:tid 54472] [client 20.220.13.222:56711] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "aZgNBsoUiaZ-Z7V-F98VcAAAAAc"]
[Fri Feb 20 15:28:06.740323 2026] [:error] [pid 54461:tid 54502] [client 20.220.13.222:64884] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aZgNBi372fkN0w39NDNlAAAAAEo"]
[Fri Feb 20 15:28:07.336245 2026] [:error] [pid 54552:tid 54563] [client 20.220.13.222:37888] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aZgNB8e4t0F-_sbWepbb6QAAAMg"]
[Fri Feb 20 15:28:07.801150 2026] [:error] [pid 54461:tid 54507] [client 20.220.13.222:61675] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aZgNBy372fkN0w39NDNlAgAAAE8"]
[Fri Feb 20 15:28:08.282251 2026] [:error] [pid 54552:tid 54569] [client 20.220.13.222:40335] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "aZgNCMe4t0F-_sbWepbb6gAAAM4"]
[Fri Feb 20 15:28:09.103042 2026] [:error] [pid 54552:tid 54559] [client 20.220.13.222:64835] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZgNCce4t0F-_sbWepbb7AAAAMQ"]
[Fri Feb 20 15:28:09.594442 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:61691] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZgNCTXz-GTvuxLwgUHNAwAAAVQ"]
[Fri Feb 20 15:28:10.070087 2026] [:error] [pid 46012:tid 46032] [client 20.220.13.222:51980] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZgNCjXz-GTvuxLwgUHNBQAAAVI"]
[Fri Feb 20 15:28:10.626276 2026] [:error] [pid 59127:tid 59150] [client 20.220.13.222:8924] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZgNCnSltzl55Qz-09jvPAAAARU"]
[Fri Feb 20 15:28:11.655028 2026] [:error] [pid 54460:tid 54479] [client 20.220.13.222:37930] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZgNC8oUiaZ-Z7V-F98VdQAAAA4"]
[Fri Feb 20 15:28:12.233618 2026] [:error] [pid 54520:tid 54540] [client 20.220.13.222:64826] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZgNDGQaQX7QUBqXcyGXlgAAAJI"]
[Fri Feb 20 15:28:13.067492 2026] [:error] [pid 54520:tid 54536] [client 20.220.13.222:37908] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZgNDWQaQX7QUBqXcyGXmgAAAI4"]
[Fri Feb 20 15:28:13.628904 2026] [:error] [pid 59127:tid 59151] [client 20.220.13.222:40330] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZgNDXSltzl55Qz-09jvPgAAARY"]
[Fri Feb 20 15:28:14.189619 2026] [:error] [pid 54461:tid 54507] [client 20.220.13.222:64774] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aZgNDi372fkN0w39NDNlDQAAAE8"]
[Fri Feb 20 15:28:15.243292 2026] [:error] [pid 59127:tid 59130] [client 20.220.13.222:62757] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aZgND3Sltzl55Qz-09jvRQAAAQE"]
[Fri Feb 20 15:28:15.926707 2026] [:error] [pid 54461:tid 54497] [client 20.220.13.222:42308] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aZgNDy372fkN0w39NDNlEgAAAEU"]
[Fri Feb 20 15:28:16.545775 2026] [:error] [pid 59127:tid 59132] [client 20.220.13.222:42365] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aZgNEHSltzl55Qz-09jvRgAAAQM"]
[Fri Feb 20 15:28:17.106812 2026] [:error] [pid 54460:tid 54476] [client 20.220.13.222:56719] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aZgNEcoUiaZ-Z7V-F98VjAAAAAs"]
[Fri Feb 20 15:28:17.740386 2026] [:error] [pid 54461:tid 54508] [client 20.220.13.222:37933] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aZgNES372fkN0w39NDNlEwAAAFA"]
[Fri Feb 20 15:28:18.299378 2026] [:error] [pid 54552:tid 54558] [client 20.220.13.222:52842] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aZgNEse4t0F-_sbWepbb9gAAAMM"]
[Fri Feb 20 15:28:18.865963 2026] [:error] [pid 59127:tid 59149] [client 20.220.13.222:64869] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "aZgNEnSltzl55Qz-09jvSAAAARQ"]
[Fri Feb 20 15:28:19.406619 2026] [:error] [pid 54460:tid 54489] [client 20.220.13.222:42346] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZgNE8oUiaZ-Z7V-F98VkAAAABg"]
[Fri Feb 20 15:28:20.075983 2026] [:error] [pid 54520:tid 54537] [client 20.220.13.222:44943] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZgNFGQaQX7QUBqXcyGXrAAAAI8"]
[Fri Feb 20 15:28:20.674818 2026] [:error] [pid 54520:tid 54535] [client 20.220.13.222:40378] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZgNFGQaQX7QUBqXcyGXrQAAAI0"]
[Fri Feb 20 15:28:21.098932 2026] [:error] [pid 59127:tid 59144] [client 20.220.13.222:56757] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZgNFXSltzl55Qz-09jvSwAAAQ8"]
[Fri Feb 20 15:28:21.554088 2026] [:error] [pid 54552:tid 54574] [client 20.220.13.222:52817] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZgNFce4t0F-_sbWepbb-gAAANM"]
[Fri Feb 20 15:28:21.980373 2026] [:error] [pid 54460:tid 54484] [client 20.220.13.222:8955] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZgNFcoUiaZ-Z7V-F98VlgAAABM"]
[Fri Feb 20 15:28:22.492722 2026] [:error] [pid 54460:tid 54479] [client 20.220.13.222:40325] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZgNFsoUiaZ-Z7V-F98VlwAAAA4"]
[Fri Feb 20 15:28:22.951548 2026] [:error] [pid 46012:tid 46030] [client 20.220.13.222:64882] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZgNFjXz-GTvuxLwgUHNEQAAAVA"]
[Fri Feb 20 15:28:23.679412 2026] [:error] [pid 46012:tid 46022] [client 20.220.13.222:42304] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZgNFzXz-GTvuxLwgUHNFAAAAUg"]
[Fri Feb 20 15:28:24.675426 2026] [:error] [pid 54520:tid 54540] [client 20.220.13.222:56737] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZgNGGQaQX7QUBqXcyGXswAAAJI"]
[Fri Feb 20 15:28:25.646634 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:37899] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZgNGTXz-GTvuxLwgUHNGAAAAUM"]
[Fri Feb 20 15:28:26.239497 2026] [:error] [pid 59127:tid 59150] [client 20.220.13.222:52018] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZgNGnSltzl55Qz-09jvVAAAARU"]
[Fri Feb 20 15:28:26.743938 2026] [:error] [pid 46012:tid 46031] [client 20.220.13.222:37929] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZgNGjXz-GTvuxLwgUHNGgAAAVE"]
[Fri Feb 20 15:28:27.451502 2026] [:error] [pid 46012:tid 46015] [client 20.220.13.222:42366] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZgNGzXz-GTvuxLwgUHNHQAAAUE"]
[Fri Feb 20 15:28:27.946212 2026] [:error] [pid 59127:tid 59140] [client 20.220.13.222:56742] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZgNG3Sltzl55Qz-09jvVwAAAQs"]
[Fri Feb 20 15:28:28.766789 2026] [:error] [pid 54552:tid 54575] [client 20.220.13.222:56752] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZgNHMe4t0F-_sbWepbb_wAAANQ"]
[Fri Feb 20 15:28:29.369371 2026] [:error] [pid 59127:tid 59149] [client 20.220.13.222:8923] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZgNHXSltzl55Qz-09jvWQAAARQ"]
[Fri Feb 20 15:28:30.025780 2026] [:error] [pid 46012:tid 46031] [client 20.220.13.222:37914] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZgNHjXz-GTvuxLwgUHNIQAAAVE"]
[Fri Feb 20 15:28:30.513021 2026] [:error] [pid 54461:tid 54501] [client 20.220.13.222:37928] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZgNHi372fkN0w39NDNlHAAAAEk"]
[Fri Feb 20 15:28:31.343149 2026] [:error] [pid 54461:tid 54508] [client 20.220.13.222:62766] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZgNHy372fkN0w39NDNlHwAAAFA"]
[Fri Feb 20 15:28:31.775337 2026] [:error] [pid 54461:tid 54512] [client 20.220.13.222:44961] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZgNHy372fkN0w39NDNlIQAAAFQ"]
[Fri Feb 20 15:28:32.281947 2026] [:error] [pid 54461:tid 54515] [client 20.220.13.222:40380] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZgNIC372fkN0w39NDNlJAAAAFc"]
[Fri Feb 20 15:28:32.852230 2026] [:error] [pid 54552:tid 54577] [client 20.220.13.222:56713] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZgNIMe4t0F-_sbWepbcBQAAANY"]
[Fri Feb 20 15:28:33.299212 2026] [:error] [pid 54552:tid 54573] [client 20.220.13.222:40356] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZgNIce4t0F-_sbWepbcBwAAANI"]
[Fri Feb 20 15:28:34.035564 2026] [:error] [pid 54461:tid 54497] [client 20.220.13.222:64778] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZgNIi372fkN0w39NDNlJgAAAEU"]
[Fri Feb 20 15:28:34.756184 2026] [:error] [pid 54461:tid 54492] [client 20.220.13.222:51968] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZgNIi372fkN0w39NDNlJwAAAEA"]
[Fri Feb 20 15:28:35.255900 2026] [:error] [pid 54552:tid 54559] [client 20.220.13.222:40353] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZgNI8e4t0F-_sbWepbcEAAAAMQ"]
[Fri Feb 20 15:28:35.902222 2026] [:error] [pid 46012:tid 46037] [client 20.220.13.222:52806] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZgNIzXz-GTvuxLwgUHNJgAAAVc"]
[Fri Feb 20 15:28:36.653634 2026] [:error] [pid 54461:tid 54496] [client 20.220.13.222:56753] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZgNJC372fkN0w39NDNlKAAAAEQ"]
[Fri Feb 20 15:28:37.312676 2026] [:error] [pid 54552:tid 54565] [client 20.220.13.222:64862] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZgNJce4t0F-_sbWepbcEwAAAMo"]
[Fri Feb 20 15:28:37.814097 2026] [:error] [pid 46012:tid 46025] [client 20.220.13.222:64881] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZgNJTXz-GTvuxLwgUHNKQAAAUs"]
[Fri Feb 20 15:28:38.275317 2026] [:error] [pid 46012:tid 46034] [client 20.220.13.222:8926] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZgNJjXz-GTvuxLwgUHNKgAAAVQ"]
[Fri Feb 20 15:28:38.835783 2026] [:error] [pid 46012:tid 46035] [client 20.220.13.222:44989] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZgNJjXz-GTvuxLwgUHNMAAAAVU"]
[Fri Feb 20 15:28:39.307123 2026] [:error] [pid 54461:tid 54506] [client 20.220.13.222:37920] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZgNJy372fkN0w39NDNlLwAAAE4"]
[Fri Feb 20 15:28:39.790254 2026] [:error] [pid 54460:tid 54472] [client 20.220.13.222:40323] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZgNJ8oUiaZ-Z7V-F98VoQAAAAc"]
[Fri Feb 20 15:28:40.263672 2026] [:error] [pid 54460:tid 54483] [client 20.220.13.222:37924] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZgNKMoUiaZ-Z7V-F98VowAAABI"]
[Fri Feb 20 15:28:40.794194 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:56717] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZgNKC372fkN0w39NDNlMAAAAEE"]
[Fri Feb 20 15:28:41.509387 2026] [:error] [pid 54460:tid 54489] [client 20.220.13.222:8915] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZgNKcoUiaZ-Z7V-F98VpwAAABg"]
[Fri Feb 20 15:28:41.994496 2026] [:error] [pid 54460:tid 54465] [client 20.220.13.222:52019] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZgNKcoUiaZ-Z7V-F98VqQAAAAA"]
[Fri Feb 20 15:28:42.879057 2026] [:error] [pid 46012:tid 46015] [client 20.220.13.222:37947] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZgNKjXz-GTvuxLwgUHNOwAAAUE"]
[Fri Feb 20 15:28:43.634183 2026] [:error] [pid 54552:tid 54556] [client 20.220.13.222:37894] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZgNK8e4t0F-_sbWepbcFwAAAME"]
[Fri Feb 20 15:28:44.233864 2026] [:error] [pid 54520:tid 54534] [client 20.220.13.222:61695] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZgNLGQaQX7QUBqXcyGXvAAAAIw"]
[Fri Feb 20 15:28:45.066223 2026] [:error] [pid 46012:tid 46016] [client 20.220.13.222:37917] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZgNLTXz-GTvuxLwgUHNQAAAAUI"]
[Fri Feb 20 15:28:45.891503 2026] [:error] [pid 54520:tid 54539] [client 20.220.13.222:61683] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZgNLWQaQX7QUBqXcyGXwAAAAJE"]
[Fri Feb 20 15:28:46.896381 2026] [:error] [pid 54460:tid 54468] [client 20.220.13.222:52026] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZgNLsoUiaZ-Z7V-F98VsAAAAAM"]
[Fri Feb 20 15:28:47.545270 2026] [:error] [pid 54460:tid 54487] [client 20.220.13.222:64858] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZgNL8oUiaZ-Z7V-F98VsQAAABY"]
[Fri Feb 20 15:28:48.215646 2026] [:error] [pid 54460:tid 54486] [client 20.220.13.222:8462] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZgNMMoUiaZ-Z7V-F98VsgAAABU"]
[Fri Feb 20 15:28:48.743847 2026] [:error] [pid 54460:tid 54474] [client 20.220.13.222:44976] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZgNMMoUiaZ-Z7V-F98VswAAAAk"]
[Fri Feb 20 15:28:49.628692 2026] [:error] [pid 54460:tid 54471] [client 20.220.13.222:56747] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aZgNMcoUiaZ-Z7V-F98VtgAAAAY"]
[Fri Feb 20 15:28:50.547332 2026] [:error] [pid 54520:tid 54522] [client 20.220.13.222:44949] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aZgNMmQaQX7QUBqXcyGXyQAAAIA"]
[Fri Feb 20 15:28:51.345565 2026] [:error] [pid 46012:tid 46028] [client 20.220.13.222:51969] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aZgNMzXz-GTvuxLwgUHNRQAAAU4"]
[Fri Feb 20 15:28:51.877615 2026] [:error] [pid 54461:tid 54514] [client 20.220.13.222:60808] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aZgNMy372fkN0w39NDNlPAAAAFY"]
[Fri Feb 20 15:28:52.489064 2026] [:error] [pid 46012:tid 46037] [client 20.220.13.222:42898] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZgNNDXz-GTvuxLwgUHNSAAAAVc"]
[Fri Feb 20 15:28:52.980927 2026] [:error] [pid 46012:tid 46024] [client 20.220.13.222:51972] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZgNNDXz-GTvuxLwgUHNSQAAAUo"]
[Fri Feb 20 15:28:53.470836 2026] [:error] [pid 54461:tid 54511] [client 20.220.13.222:64853] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZgNNS372fkN0w39NDNlQAAAAFM"]
[Fri Feb 20 15:28:54.046706 2026] [:error] [pid 59127:tid 59142] [client 20.220.13.222:42361] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZgNNnSltzl55Qz-09jvagAAAQ0"]
[Fri Feb 20 15:28:54.536243 2026] [:error] [pid 46012:tid 46015] [client 20.220.13.222:64811] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZgNNjXz-GTvuxLwgUHNTgAAAUE"]
[Fri Feb 20 15:28:54.982503 2026] [:error] [pid 59127:tid 59132] [client 20.220.13.222:64802] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZgNNnSltzl55Qz-09jvbAAAAQM"]
[Fri Feb 20 15:28:55.751045 2026] [:error] [pid 54460:tid 54466] [client 20.220.13.222:61674] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZgNN8oUiaZ-Z7V-F98VuwAAAAE"]
[Fri Feb 20 15:28:56.254664 2026] [:error] [pid 59127:tid 59148] [client 20.220.13.222:61666] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZgNOHSltzl55Qz-09jvbwAAARM"]
[Fri Feb 20 15:28:56.924755 2026] [:error] [pid 54460:tid 54480] [client 20.220.13.222:40383] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aZgNOMoUiaZ-Z7V-F98VvgAAAA8"]
[Fri Feb 20 15:28:57.422071 2026] [:error] [pid 59127:tid 59143] [client 20.220.13.222:52021] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aZgNOXSltzl55Qz-09jvcQAAAQ4"]
[Fri Feb 20 15:28:57.908649 2026] [:error] [pid 46012:tid 46021] [client 20.220.13.222:8483] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aZgNOTXz-GTvuxLwgUHNWAAAAUc"]
[Fri Feb 20 15:28:58.491666 2026] [:error] [pid 54460:tid 54485] [client 20.220.13.222:52002] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "aZgNOsoUiaZ-Z7V-F98VvwAAABQ"]
[Fri Feb 20 15:28:59.413113 2026] [:error] [pid 54460:tid 54483] [client 20.220.13.222:61672] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZgNO8oUiaZ-Z7V-F98VxQAAABI"]
[Fri Feb 20 15:28:59.949796 2026] [:error] [pid 54460:tid 54481] [client 20.220.13.222:44942] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZgNO8oUiaZ-Z7V-F98VxgAAABA"]
[Fri Feb 20 15:29:00.689862 2026] [:error] [pid 54461:tid 54509] [client 20.220.13.222:62786] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZgNPC372fkN0w39NDNlSAAAAFE"]
[Fri Feb 20 15:29:01.135982 2026] [:error] [pid 54461:tid 54505] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Feb 20 15:29:01.412184 2026] [:error] [pid 54461:tid 54492] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Fri Feb 20 15:29:01.621101 2026] [:error] [pid 54461:tid 54516] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Fri Feb 20 15:29:01.831752 2026] [:error] [pid 54461:tid 54500] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Fri Feb 20 15:29:02.047793 2026] [:error] [pid 54461:tid 54513] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Fri Feb 20 15:29:02.257368 2026] [:error] [pid 54461:tid 54503] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Fri Feb 20 15:29:02.466900 2026] [:error] [pid 54461:tid 54504] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Fri Feb 20 15:29:02.783337 2026] [:error] [pid 54461:tid 54514] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Fri Feb 20 15:29:02.996800 2026] [:error] [pid 54461:tid 54501] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Fri Feb 20 15:29:03.205893 2026] [:error] [pid 54461:tid 54497] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Feb 20 15:29:03.415778 2026] [:error] [pid 54461:tid 54495] [client 20.220.13.222:44977] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Fri Feb 20 15:29:03.620888 2026] [:error] [pid 54461:tid 54499] [client 20.220.13.222:44977] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZgNPy372fkN0w39NDNlWQAAAEc"]
[Fri Feb 20 15:29:04.217027 2026] [:error] [pid 59127:tid 59134] [client 20.220.13.222:42320] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZgNQHSltzl55Qz-09jvegAAAQU"]
[Fri Feb 20 15:29:04.898804 2026] [:error] [pid 54552:tid 54559] [client 20.220.13.222:8451] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZgNQMe4t0F-_sbWepbcJQAAAMQ"]
[Fri Feb 20 15:29:05.383798 2026] [:error] [pid 46012:tid 46025] [client 20.220.13.222:37935] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZgNQTXz-GTvuxLwgUHNYwAAAUs"]
[Fri Feb 20 15:29:05.895219 2026] [:error] [pid 54552:tid 54579] [client 20.220.13.222:60832] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZgNQce4t0F-_sbWepbcKQAAANg"]
[Fri Feb 20 15:29:06.387788 2026] [:error] [pid 54461:tid 54505] [client 20.220.13.222:44932] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZgNQi372fkN0w39NDNlWgAAAE0"]
[Fri Feb 20 15:29:06.827077 2026] [:error] [pid 46012:tid 46019] [client 20.220.13.222:61694] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZgNQjXz-GTvuxLwgUHNZQAAAUU"]
[Fri Feb 20 15:29:07.498760 2026] [:error] [pid 46012:tid 46028] [client 20.220.13.222:42348] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZgNQzXz-GTvuxLwgUHNagAAAU4"]
[Fri Feb 20 15:29:08.024469 2026] [:error] [pid 54460:tid 54466] [client 20.220.13.222:42889] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZgNRMoUiaZ-Z7V-F98V0wAAAAE"]
[Fri Feb 20 15:29:08.546703 2026] [:error] [pid 54552:tid 54567] [client 20.220.13.222:37900] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZgNRMe4t0F-_sbWepbcLQAAAMw"]
[Fri Feb 20 15:29:09.049242 2026] [:error] [pid 54520:tid 54524] [client 20.220.13.222:62785] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZgNRWQaQX7QUBqXcyGX2AAAAII"]
[Fri Feb 20 15:29:09.592238 2026] [:error] [pid 54552:tid 54572] [client 20.220.13.222:52854] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZgNRce4t0F-_sbWepbcMwAAANE"]
[Fri Feb 20 15:29:10.371837 2026] [:error] [pid 54552:tid 54577] [client 20.220.13.222:62784] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZgNRse4t0F-_sbWepbcNQAAANY"]
[Fri Feb 20 15:29:10.955659 2026] [:error] [pid 54520:tid 54529] [client 20.220.13.222:8473] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZgNRmQaQX7QUBqXcyGX2gAAAIc"]
[Fri Feb 20 15:29:11.594136 2026] [:error] [pid 54461:tid 54496] [client 20.220.13.222:61677] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZgNRy372fkN0w39NDNlXwAAAEQ"]
[Fri Feb 20 15:29:12.768764 2026] [:error] [pid 59127:tid 59136] [client 20.220.13.222:62747] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZgNSHSltzl55Qz-09jvhAAAAQc"]
[Fri Feb 20 15:29:13.356466 2026] [:error] [pid 54520:tid 54542] [client 20.220.13.222:52821] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZgNSWQaQX7QUBqXcyGX3AAAAJQ"]
[Fri Feb 20 15:29:13.977859 2026] [:error] [pid 46012:tid 46027] [client 20.220.13.222:52803] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZgNSTXz-GTvuxLwgUHNdgAAAU0"]
[Fri Feb 20 15:29:15.348210 2026] [:error] [pid 54461:tid 54500] [client 20.220.13.222:62755] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZgNSy372fkN0w39NDNlYwAAAEg"]
[Fri Feb 20 15:29:15.891605 2026] [:error] [pid 46012:tid 46016] [client 20.220.13.222:42356] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZgNSzXz-GTvuxLwgUHNfAAAAUI"]
[Fri Feb 20 15:29:16.444895 2026] [:error] [pid 59127:tid 59135] [client 20.220.13.222:8492] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aZgNTHSltzl55Qz-09jviAAAAQY"]
[Fri Feb 20 15:29:16.940266 2026] [:error] [pid 54461:tid 54493] [client 20.220.13.222:44971] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZgNTC372fkN0w39NDNlZgAAAEE"]
[Fri Feb 20 15:29:17.470310 2026] [:error] [pid 59127:tid 59153] [client 20.220.13.222:56716] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZgNTXSltzl55Qz-09jvigAAARg"]
[Fri Feb 20 15:29:18.293275 2026] [:error] [pid 46012:tid 46023] [client 20.220.13.222:37936] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZgNTjXz-GTvuxLwgUHNfwAAAUk"]
[Fri Feb 20 15:29:18.905566 2026] [:error] [pid 54461:tid 54512] [client 20.220.13.222:42927] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZgNTi372fkN0w39NDNlbAAAAFQ"]
[Fri Feb 20 15:29:19.488040 2026] [:error] [pid 54461:tid 54505] [client 20.220.13.222:56704] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aZgNTy372fkN0w39NDNlbwAAAE0"]
[Fri Feb 20 15:29:20.193082 2026] [:error] [pid 59127:tid 59151] [client 20.220.13.222:40358] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aZgNUHSltzl55Qz-09jvjgAAARY"]
[Fri Feb 20 15:29:20.670975 2026] [:error] [pid 54461:tid 54500] [client 20.220.13.222:8461] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aZgNUC372fkN0w39NDNlcgAAAEg"]
[Fri Feb 20 15:29:21.438789 2026] [:error] [pid 59127:tid 59133] [client 20.220.13.222:61634] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/spip.php"] [unique_id "aZgNUXSltzl55Qz-09jvkQAAAQQ"]
[Fri Feb 20 15:29:22.114125 2026] [:error] [pid 59127:tid 59131] [client 20.220.13.222:62728] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aZgNUnSltzl55Qz-09jvkgAAAQI"]
[Fri Feb 20 15:29:22.714455 2026] [:error] [pid 54520:tid 54522] [client 20.220.13.222:62776] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aZgNUmQaQX7QUBqXcyGX5AAAAIA"]
[Fri Feb 20 15:29:23.245734 2026] [:error] [pid 54461:tid 54512] [client 20.220.13.222:60813] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aZgNUy372fkN0w39NDNleAAAAFQ"]
[Fri Feb 20 15:29:24.077900 2026] [:error] [pid 54552:tid 54555] [client 20.220.13.222:51984] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aZgNVMe4t0F-_sbWepbcQwAAAMA"]
[Fri Feb 20 15:29:24.680073 2026] [:error] [pid 54520:tid 54533] [client 20.220.13.222:44963] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZgNVGQaQX7QUBqXcyGX5wAAAIs"]
[Fri Feb 20 15:29:25.269672 2026] [:error] [pid 54520:tid 54526] [client 20.220.13.222:8896] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZgNVWQaQX7QUBqXcyGX6wAAAIQ"]
[Fri Feb 20 15:29:26.345838 2026] [:error] [pid 46012:tid 46028] [client 20.220.13.222:52001] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZgNVjXz-GTvuxLwgUHNjAAAAU4"]
[Fri Feb 20 15:29:27.223623 2026] [:error] [pid 46012:tid 46031] [client 20.220.13.222:44957] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZgNVzXz-GTvuxLwgUHNjgAAAVE"]
[Fri Feb 20 15:29:27.725537 2026] [:error] [pid 54552:tid 54576] [client 20.220.13.222:52040] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aZgNV8e4t0F-_sbWepbcRgAAANU"]
[Fri Feb 20 15:29:28.355303 2026] [:error] [pid 54552:tid 54573] [client 20.220.13.222:62831] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aZgNWMe4t0F-_sbWepbcSgAAANI"]
[Fri Feb 20 15:29:28.925970 2026] [:error] [pid 54520:tid 54522] [client 20.220.13.222:47414] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aZgNWGQaQX7QUBqXcyGX8AAAAIA"]
[Fri Feb 20 15:29:29.485352 2026] [:error] [pid 54520:tid 54530] [client 20.220.13.222:64895] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ho/wpup.php"] [unique_id "aZgNWWQaQX7QUBqXcyGX8wAAAIg"]
[Fri Feb 20 15:29:30.380398 2026] [:error] [pid 54460:tid 54477] [client 20.220.13.222:44973] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aZgNWsoUiaZ-Z7V-F98V5gAAAAw"]
[Fri Feb 20 15:29:31.850674 2026] [:error] [pid 46012:tid 46014] [client 20.220.13.222:42933] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aZgNWzXz-GTvuxLwgUHNmgAAAUA"]
[Fri Feb 20 15:29:32.325790 2026] [:error] [pid 59127:tid 59153] [client 20.220.13.222:64776] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aZgNXHSltzl55Qz-09jvmgAAARg"]
[Fri Feb 20 15:29:33.367142 2026] [:error] [pid 46012:tid 46030] [client 20.220.13.222:42305] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aZgNXTXz-GTvuxLwgUHNngAAAVA"]
[Fri Feb 20 15:29:34.379044 2026] [:error] [pid 54461:tid 54507] [client 20.220.13.222:52836] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZgNXi372fkN0w39NDNlggAAAE8"]
[Fri Feb 20 15:29:35.090863 2026] [:error] [pid 54460:tid 54479] [client 20.220.13.222:42335] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZgNX8oUiaZ-Z7V-F98V7wAAAA4"]
[Fri Feb 20 15:29:35.699347 2026] [:error] [pid 54552:tid 54558] [client 20.220.13.222:61681] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZgNX8e4t0F-_sbWepbcUgAAAMM"]
[Fri Feb 20 15:29:36.423832 2026] [:error] [pid 54460:tid 54482] [client 20.220.13.222:64890] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZgNYMoUiaZ-Z7V-F98V8QAAABE"]
[Fri Feb 20 15:29:37.121406 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:52830] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aZgNYTXz-GTvuxLwgUHNpwAAAUM"]
[Fri Feb 20 15:29:37.746425 2026] [:error] [pid 59127:tid 59129] [client 20.220.13.222:8897] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aZgNYXSltzl55Qz-09jvogAAAQA"]
[Fri Feb 20 15:29:38.338108 2026] [:error] [pid 54460:tid 54476] [client 20.220.13.222:62772] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aZgNYsoUiaZ-Z7V-F98V9AAAAAs"]
[Fri Feb 20 15:29:38.851682 2026] [:error] [pid 59127:tid 59140] [client 20.220.13.222:37935] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "aZgNYnSltzl55Qz-09jvpQAAAQs"]
[Fri Feb 20 15:29:39.410616 2026] [:error] [pid 54460:tid 54475] [client 20.220.13.222:60861] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aZgNY8oUiaZ-Z7V-F98V9wAAAAo"]
[Fri Feb 20 15:29:39.992655 2026] [:error] [pid 54520:tid 54538] [client 20.220.13.222:62153] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aZgNY2QaQX7QUBqXcyGX9wAAAJA"]
[Fri Feb 20 15:29:40.420897 2026] [:error] [pid 54520:tid 54528] [client 20.220.13.222:61633] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aZgNZGQaQX7QUBqXcyGX-gAAAIY"]
[Fri Feb 20 15:29:40.905989 2026] [:error] [pid 59127:tid 59134] [client 20.220.13.222:40367] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/halo.php"] [unique_id "aZgNZHSltzl55Qz-09jvqgAAAQU"]
[Fri Feb 20 15:29:41.358431 2026] [:error] [pid 59127:tid 59151] [client 20.220.13.222:37892] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZgNZXSltzl55Qz-09jvrAAAARY"]
[Fri Feb 20 15:29:41.900692 2026] [:error] [pid 54460:tid 54473] [client 20.220.13.222:8458] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZgNZcoUiaZ-Z7V-F98V-gAAAAg"]
[Fri Feb 20 15:29:42.416074 2026] [:error] [pid 46012:tid 46017] [client 20.220.13.222:61646] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZgNZjXz-GTvuxLwgUHNrQAAAUM"]
[Fri Feb 20 15:29:42.978079 2026] [:error] [pid 54460:tid 54480] [client 20.220.13.222:44935] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZgNZsoUiaZ-Z7V-F98V_QAAAA8"]
[Fri Feb 20 15:29:43.466324 2026] [:error] [pid 46012:tid 46031] [client 20.220.13.222:64783] [client 20.220.13.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/upload.php"] [unique_id "aZgNZzXz-GTvuxLwgUHNrwAAAVE"]
[Fri Feb 20 15:29:44.001007 2026] [:error] [pid 59127:tid 59150] [client 20.220.13.222:52855] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZgNaHSltzl55Qz-09jvrgAAARU"]
[Fri Feb 20 15:29:44.539444 2026] [:error] [pid 46012:tid 46033] [client 20.220.13.222:64868] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZgNaDXz-GTvuxLwgUHNsQAAAVM"]
[Fri Feb 20 15:29:45.095267 2026] [:error] [pid 54520:tid 54530] [client 20.220.13.222:40350] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZgNaWQaQX7QUBqXcyGYAQAAAIg"]
[Fri Feb 20 15:29:45.618069 2026] [:error] [pid 54520:tid 54525] [client 20.220.13.222:64870] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZgNaWQaQX7QUBqXcyGYAwAAAIM"]
[Fri Feb 20 15:29:46.078334 2026] [:error] [pid 59127:tid 59130] [client 20.220.13.222:42317] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgNanSltzl55Qz-09jvsQAAAQE"]
[Fri Feb 20 15:29:46.553318 2026] [:error] [pid 59127:tid 59137] [client 20.220.13.222:60800] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgNanSltzl55Qz-09jvtAAAAQg"]
[Fri Feb 20 15:29:47.198327 2026] [:error] [pid 54520:tid 54523] [client 20.220.13.222:8931] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgNa2QaQX7QUBqXcyGYBwAAAIE"]
[Fri Feb 20 15:29:47.846632 2026] [:error] [pid 54461:tid 54506] [client 20.220.13.222:56730] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZgNay372fkN0w39NDNlhgAAAE4"]
[Fri Feb 20 15:29:48.386221 2026] [:error] [pid 59127:tid 59149] [client 20.220.13.222:56748] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dapa.php"] [unique_id "aZgNbHSltzl55Qz-09jvvAAAARQ"]
[Fri Feb 20 15:29:48.885889 2026] [:error] [pid 54461:tid 54502] [client 20.220.13.222:56726] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dapa.php"] [unique_id "aZgNbC372fkN0w39NDNliAAAAEo"]
[Fri Feb 20 15:29:49.445321 2026] [:error] [pid 54552:tid 54569] [client 20.220.13.222:56756] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dapa.php"] [unique_id "aZgNbce4t0F-_sbWepbcVgAAAM4"]
[Fri Feb 20 15:29:49.973677 2026] [:error] [pid 54520:tid 54543] [client 20.220.13.222:42318] [client 20.220.13.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dapa.php"] [unique_id "aZgNbWQaQX7QUBqXcyGYCgAAAJU"]
[Fri Feb 20 17:17:20.480693 2026] [:error] [pid 54461:tid 54513] [client 167.99.180.251:60779] [client 167.99.180.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.180.251, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZgmoC372fkN0w39NDOGcQAAAFU"]
[Fri Feb 20 17:17:20.484259 2026] [:error] [pid 54461:tid 54513] [client 167.99.180.251:60779] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 20 17:17:22.830647 2026] [:error] [pid 54461:tid 54513] [client 167.99.180.251:60779] [client 167.99.180.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aZgmoi372fkN0w39NDOGfgAAAFU"]
[Fri Feb 20 17:17:23.263127 2026] [:error] [pid 54552:tid 54576] [client 167.99.180.251:58036] [client 167.99.180.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aZgmo8e4t0F-_sbWepb9KwAAANU"]
[Fri Feb 20 17:17:23.680149 2026] [:error] [pid 54520:tid 54544] [client 167.99.180.251:64011] [client 167.99.180.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aZgmo2QaQX7QUBqXcyG4LgAAAJY"]
[Fri Feb 20 17:17:24.097395 2026] [:error] [pid 54552:tid 54575] [client 167.99.180.251:57964] [client 167.99.180.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aZgmpMe4t0F-_sbWepb9MAAAANQ"]
[Fri Feb 20 17:17:24.516861 2026] [:error] [pid 46012:tid 46021] [client 167.99.180.251:52962] [client 167.99.180.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aZgmpDXz-GTvuxLwgUEBIAAAAUc"]
[Fri Feb 20 17:17:24.933797 2026] [:error] [pid 54460:tid 54482] [client 167.99.180.251:55924] [client 167.99.180.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aZgmpMoUiaZ-Z7V-F984tAAAABE"]
[Fri Feb 20 17:17:25.349960 2026] [:error] [pid 54461:tid 54504] [client 167.99.180.251:65187] [client 167.99.180.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aZgmpS372fkN0w39NDOGgQAAAEw"]
[Fri Feb 20 23:50:41.511383 2026] [:error] [pid 46012:tid 46037] [client 3.131.159.45:55576] [client 3.131.159.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aZiC0TXz-GTvuxLwgUGRnAAAAVc"]
[Fri Feb 20 23:50:42.035841 2026] [:error] [pid 46012:tid 46035] [client 3.131.159.45:51693] [client 3.131.159.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aZiC0jXz-GTvuxLwgUGRnQAAAVU"]
[Fri Feb 20 23:50:42.445171 2026] [:error] [pid 54461:tid 54515] [client 3.131.159.45:54222] [client 3.131.159.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aZiC0i372fkN0w39NDP6sgAAAFc"]
[Sat Feb 21 05:03:52.423983 2026] [:error] [pid 40871:tid 40894] [client 169.150.203.195:37962] [client 169.150.203.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.195, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZjMODqDikjdiOZeJyWliQAAANU"]
[Sat Feb 21 05:03:52.429256 2026] [:error] [pid 40871:tid 40894] [client 169.150.203.195:37962] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 21 05:03:54.213247 2026] [:error] [pid 40871:tid 40884] [client 169.150.203.195:37962] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aZjMOjqDikjdiOZeJyWllQAAAMs"]
[Sat Feb 21 05:03:54.523351 2026] [:error] [pid 40871:tid 40880] [client 169.150.203.195:4797] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aZjMOjqDikjdiOZeJyWllgAAAMc"]
[Sat Feb 21 05:03:54.834214 2026] [:error] [pid 40871:tid 40893] [client 169.150.203.195:48978] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aZjMOjqDikjdiOZeJyWllwAAANQ"]
[Sat Feb 21 05:03:55.143886 2026] [:error] [pid 40871:tid 40890] [client 169.150.203.195:11723] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aZjMOzqDikjdiOZeJyWlmQAAANE"]
[Sat Feb 21 05:03:55.454707 2026] [:error] [pid 40758:tid 40837] [client 169.150.203.195:49002] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aZjMO0BAHxvBM3i9iKGKfwAAAI8"]
[Sat Feb 21 05:03:55.764293 2026] [:error] [pid 22558:tid 22565] [client 169.150.203.195:41922] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aZjMOyrVaIb2gXsVbDoOnwAAAQU"]
[Sat Feb 21 05:03:56.074316 2026] [:error] [pid 40756:tid 40780] [client 169.150.203.195:49014] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aZjMPANlDP60sLYgqXK9uAAAAA4"]
[Sat Feb 21 07:57:48.834269 2026] [:error] [pid 40758:tid 40823] [client 20.205.3.49:4374] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aZj0_EBAHxvBM3i9iKHQHwAAAIE"]
[Sat Feb 21 07:57:52.743593 2026] [:error] [pid 40756:tid 40789] [client 20.205.3.49:50635] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Feb 21 07:57:52.870535 2026] [:error] [pid 40756:tid 40770] [client 20.205.3.49:50635] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Feb 21 07:57:53.738616 2026] [:error] [pid 40756:tid 40770] [client 20.205.3.49:50635] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Feb 21 07:57:53.984108 2026] [:error] [pid 40756:tid 40785] [client 20.205.3.49:50635] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Sat Feb 21 07:57:54.117390 2026] [:error] [pid 40756:tid 40775] [client 20.205.3.49:50635] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Sat Feb 21 07:57:54.243580 2026] [:error] [pid 40756:tid 40784] [client 20.205.3.49:50635] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zqhfn.php"] [unique_id "aZj1AgNlDP60sLYgqXIAMAAAABI"]
[Sat Feb 21 07:57:56.012139 2026] [:error] [pid 40758:tid 40843] [client 20.205.3.49:19007] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zqhfn.php"] [unique_id "aZj1BEBAHxvBM3i9iKHQMQAAAJU"]
[Sat Feb 21 07:57:56.722499 2026] [:error] [pid 40757:tid 40801] [client 20.205.3.49:22576] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zqhfn.php"] [unique_id "aZj1BKg_MKVL7zhH7dxdcQAAAEY"]
[Sat Feb 21 07:57:59.782854 2026] [:error] [pid 40757:tid 40816] [client 20.205.3.49:34500] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zqhfn.php"] [unique_id "aZj1B6g_MKVL7zhH7dxdeQAAAFU"]
[Sat Feb 21 07:58:01.227215 2026] [:error] [pid 40758:tid 40824] [client 20.205.3.49:18955] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aZj1CUBAHxvBM3i9iKHQQAAAAII"]
[Sat Feb 21 07:58:07.513169 2026] [:error] [pid 40758:tid 40824] [client 20.205.3.49:18955] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aZj1D0BAHxvBM3i9iKHQSAAAAII"]
[Sat Feb 21 07:58:17.494022 2026] [:error] [pid 40756:tid 40774] [client 20.205.3.49:13409] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZj1GQNlDP60sLYgqXIAawAAAAg"]
[Sat Feb 21 07:58:22.420514 2026] [:error] [pid 40756:tid 40789] [client 20.205.3.49:4361] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZj1HgNlDP60sLYgqXIAgwAAABc"]
[Sat Feb 21 07:58:23.662782 2026] [:error] [pid 40756:tid 40786] [client 20.205.3.49:50637] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZj1HwNlDP60sLYgqXIAkQAAABQ"]
[Sat Feb 21 07:58:25.832726 2026] [:error] [pid 22558:tid 22566] [client 20.205.3.49:22569] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZj1ISrVaIb2gXsVbDpnGQAAAQY"]
[Sat Feb 21 07:58:28.582335 2026] [:error] [pid 22558:tid 22573] [client 20.205.3.49:15646] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aZj1JCrVaIb2gXsVbDpnHgAAAQ0"]
[Sat Feb 21 07:58:30.160560 2026] [:error] [pid 22558:tid 22566] [client 20.205.3.49:4740] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aZj1JirVaIb2gXsVbDpnJwAAAQY"]
[Sat Feb 21 07:58:30.962860 2026] [:error] [pid 40757:tid 40810] [client 20.205.3.49:13773] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aZj1Jqg_MKVL7zhH7dxdywAAAE8"]
[Sat Feb 21 07:58:32.301135 2026] [:error] [pid 22558:tid 22582] [client 20.205.3.49:61327] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aZj1KCrVaIb2gXsVbDpnLAAAARY"]
[Sat Feb 21 07:58:34.060629 2026] [:error] [pid 40756:tid 40774] [client 20.205.3.49:18189] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZj1KgNlDP60sLYgqXIA6gAAAAg"]
[Sat Feb 21 07:58:34.587048 2026] [:error] [pid 40756:tid 40768] [client 20.205.3.49:4961] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZj1KgNlDP60sLYgqXIA8QAAAAI"]
[Sat Feb 21 07:58:36.010715 2026] [:error] [pid 40758:tid 40832] [client 20.205.3.49:18273] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZj1LEBAHxvBM3i9iKHQqwAAAIo"]
[Sat Feb 21 07:58:39.939343 2026] [:error] [pid 40871:tid 40882] [client 20.205.3.49:45413] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZj1LzqDikjdiOZeJyX2bAAAAMk"]
[Sat Feb 21 07:58:42.518160 2026] [:error] [pid 40757:tid 40811] [client 20.205.3.49:48920] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fimai.php"] [unique_id "aZj1Mqg_MKVL7zhH7dxd5QAAAFA"]
[Sat Feb 21 07:58:44.149358 2026] [:error] [pid 40758:tid 40846] [client 20.205.3.49:63112] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fimai.php"] [unique_id "aZj1NEBAHxvBM3i9iKHQtQAAAJg"]
[Sat Feb 21 07:58:47.565963 2026] [:error] [pid 40757:tid 40808] [client 20.205.3.49:36408] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fimai.php"] [unique_id "aZj1N6g_MKVL7zhH7dxd7AAAAE0"]
[Sat Feb 21 07:58:48.936255 2026] [:error] [pid 40758:tid 40832] [client 20.205.3.49:25264] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fimai.php"] [unique_id "aZj1OEBAHxvBM3i9iKHQvwAAAIo"]
[Sat Feb 21 07:58:49.840005 2026] [:error] [pid 40756:tid 40789] [client 20.205.3.49:24374] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "aZj1OQNlDP60sLYgqXIBKwAAABc"]
[Sat Feb 21 07:58:54.432915 2026] [:error] [pid 22558:tid 22562] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/maul.php
[Sat Feb 21 07:58:54.553441 2026] [:error] [pid 22558:tid 22569] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sat Feb 21 07:58:54.674636 2026] [:error] [pid 22558:tid 22572] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Sat Feb 21 07:58:55.631954 2026] [:error] [pid 22558:tid 22565] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Feb 21 07:58:55.852731 2026] [:error] [pid 22558:tid 22579] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/orouu.php
[Sat Feb 21 07:58:55.974381 2026] [:error] [pid 22558:tid 22573] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Feb 21 07:58:56.295001 2026] [:error] [pid 22558:tid 22568] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sat Feb 21 07:58:56.487403 2026] [:error] [pid 22558:tid 22575] [client 20.205.3.49:36427] File does not exist: /usr/local/apache/htdocs/suspended-page/55b76.php
[Sat Feb 21 07:58:56.604731 2026] [:error] [pid 22558:tid 22576] [client 20.205.3.49:36427] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZj1QCrVaIb2gXsVbDpnXAAAARA"]
[Sat Feb 21 07:58:57.784895 2026] [:error] [pid 40758:tid 40838] [client 20.205.3.49:21048] File does not exist: /usr/local/apache/htdocs/suspended-page/kalso.php
[Sat Feb 21 07:58:57.901907 2026] [:error] [pid 40758:tid 40830] [client 20.205.3.49:21048] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aZj1QUBAHxvBM3i9iKHQ2gAAAIg"]
[Sat Feb 21 07:59:07.493909 2026] [:error] [pid 40758:tid 40826] [client 20.205.3.49:33039] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aZj1S0BAHxvBM3i9iKHQ9AAAAIQ"]
[Sat Feb 21 07:59:08.694041 2026] [:error] [pid 40757:tid 40801] [client 20.205.3.49:4868] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "aZj1TKg_MKVL7zhH7dxeHwAAAEY"]
[Sat Feb 21 07:59:14.199410 2026] [:error] [pid 40871:tid 40890] [client 20.205.3.49:22500] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aZj1UjqDikjdiOZeJyX3HAAAANE"]
[Sat Feb 21 07:59:15.622667 2026] [:error] [pid 22558:tid 22562] [client 20.205.3.49:30710] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aZj1UyrVaIb2gXsVbDpnkwAAAQI"]
[Sat Feb 21 07:59:17.943760 2026] [:error] [pid 40871:tid 40881] [client 20.205.3.49:21774] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aZj1VTqDikjdiOZeJyX3NAAAAMg"]
[Sat Feb 21 07:59:23.294113 2026] [:error] [pid 40871:tid 40876] [client 20.205.3.49:23774] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "aZj1WzqDikjdiOZeJyX3SwAAAMM"]
[Sat Feb 21 07:59:23.768706 2026] [:error] [pid 40758:tid 40846] [client 20.205.3.49:16059] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aZj1W0BAHxvBM3i9iKHRDwAAAJg"]
[Sat Feb 21 07:59:28.067495 2026] [:error] [pid 40756:tid 40766] [client 20.205.3.49:61173] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aZj1YANlDP60sLYgqXIBewAAAAA"]
[Sat Feb 21 07:59:29.381690 2026] [:error] [pid 22558:tid 22560] [client 20.205.3.49:27561] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aZj1YSrVaIb2gXsVbDpnsgAAAQA"]
[Sat Feb 21 07:59:29.883898 2026] [:error] [pid 40756:tid 40774] [client 20.205.3.49:44912] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system.php"] [unique_id "aZj1YQNlDP60sLYgqXIBfgAAAAg"]
[Sat Feb 21 07:59:38.353308 2026] [:error] [pid 40757:tid 40814] [client 20.205.3.49:42905] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aZj1aqg_MKVL7zhH7dxeRwAAAFM"]
[Sat Feb 21 07:59:41.783372 2026] [:error] [pid 22558:tid 22575] [client 20.205.3.49:27558] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aZj1bSrVaIb2gXsVbDpnywAAAQ8"]
[Sat Feb 21 07:59:47.439249 2026] [:error] [pid 40758:tid 40834] [client 20.205.3.49:22189] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aZj1c0BAHxvBM3i9iKHRUQAAAIw"]
[Sat Feb 21 07:59:56.430357 2026] [:error] [pid 40757:tid 40797] [client 20.205.3.49:19010] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aZj1fKg_MKVL7zhH7dxeYgAAAEI"]
[Sat Feb 21 07:59:59.615540 2026] [:error] [pid 40757:tid 40802] [client 20.205.3.49:20278] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZj1f6g_MKVL7zhH7dxeZQAAAEc"]
[Sat Feb 21 08:00:01.791254 2026] [:error] [pid 40871:tid 40891] [client 20.205.3.49:23859] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sat Feb 21 08:00:01.921331 2026] [:error] [pid 40871:tid 40890] [client 20.205.3.49:23859] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Sat Feb 21 08:00:02.052136 2026] [:error] [pid 40871:tid 40881] [client 20.205.3.49:23859] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Sat Feb 21 08:00:02.181325 2026] [:error] [pid 40871:tid 40889] [client 20.205.3.49:23859] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Feb 21 08:00:02.307699 2026] [:error] [pid 40871:tid 40894] [client 20.205.3.49:23859] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Feb 21 08:00:02.425143 2026] [:error] [pid 40871:tid 40884] [client 20.205.3.49:23859] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aZj1gjqDikjdiOZeJyX3-QAAAMs"]
[Sat Feb 21 08:00:03.839701 2026] [:error] [pid 40757:tid 40809] [client 20.205.3.49:36463] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-104.php
[Sat Feb 21 08:00:03.966742 2026] [:error] [pid 40757:tid 40797] [client 20.205.3.49:36463] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aZj1g6g_MKVL7zhH7dxebgAAAEI"]
[Sat Feb 21 08:00:08.273667 2026] [:error] [pid 40871:tid 40877] [client 20.205.3.49:33416] File does not exist: /usr/local/apache/htdocs/suspended-page/6kDPjgFTmvS.php
[Sat Feb 21 08:00:08.409593 2026] [:error] [pid 40871:tid 40892] [client 20.205.3.49:33416] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Sat Feb 21 08:00:08.657161 2026] [:error] [pid 40871:tid 40888] [client 20.205.3.49:33416] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Feb 21 08:00:08.775120 2026] [:error] [pid 40871:tid 40882] [client 20.205.3.49:33416] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aZj1iDqDikjdiOZeJyX4BwAAAMk"]
[Sat Feb 21 08:00:09.397101 2026] [:error] [pid 40871:tid 40878] [client 20.205.3.49:36464] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aZj1iTqDikjdiOZeJyX4CAAAAMU"]
[Sat Feb 21 08:00:10.809041 2026] [:error] [pid 22558:tid 22581] [client 20.205.3.49:21696] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/function.php"] [unique_id "aZj1iirVaIb2gXsVbDpn-wAAARU"]
[Sat Feb 21 08:00:12.659691 2026] [:error] [pid 40758:tid 40846] [client 20.205.3.49:22869] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/function.php"] [unique_id "aZj1jEBAHxvBM3i9iKHRfgAAAJg"]
[Sat Feb 21 08:00:19.238806 2026] [:error] [pid 40757:tid 40806] [client 20.205.3.49:14177] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/function.php"] [unique_id "aZj1k6g_MKVL7zhH7dxedAAAAEs"]
[Sat Feb 21 08:00:21.713936 2026] [:error] [pid 40871:tid 40889] [client 20.205.3.49:19582] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/function.php"] [unique_id "aZj1lTqDikjdiOZeJyX4EAAAANA"]
[Sat Feb 21 08:00:22.676311 2026] [:error] [pid 40871:tid 40894] [client 20.205.3.49:19016] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aZj1ljqDikjdiOZeJyX4EgAAANU"]
[Sat Feb 21 08:00:25.274756 2026] [:error] [pid 40871:tid 40877] [client 20.205.3.49:23870] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aZj1mTqDikjdiOZeJyX4FwAAAMQ"]
[Sat Feb 21 08:00:26.365172 2026] [:error] [pid 40758:tid 40822] [client 20.205.3.49:17207] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aZj1mkBAHxvBM3i9iKHRjgAAAIA"]
[Sat Feb 21 08:00:37.731423 2026] [:error] [pid 40758:tid 40846] [client 20.205.3.49:33428] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aZj1pUBAHxvBM3i9iKHRlAAAAJg"]
[Sat Feb 21 08:00:39.794020 2026] [:error] [pid 22558:tid 22571] [client 20.205.3.49:38476] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aZj1pyrVaIb2gXsVbDpoIgAAAQs"]
[Sat Feb 21 08:00:50.693005 2026] [:error] [pid 40871:tid 40881] [client 20.205.3.49:36392] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aZj1sjqDikjdiOZeJyX4PQAAAMg"]
[Sat Feb 21 08:00:52.319850 2026] [:error] [pid 40757:tid 40817] [client 20.205.3.49:45347] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aZj1tKg_MKVL7zhH7dxekAAAAFY"]
[Sat Feb 21 08:00:57.096750 2026] [:error] [pid 40758:tid 40822] [client 20.205.3.49:44828] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZj1uUBAHxvBM3i9iKHRpwAAAIA"]
[Sat Feb 21 08:00:59.977171 2026] [:error] [pid 40757:tid 40805] [client 20.205.3.49:16386] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZj1u6g_MKVL7zhH7dxemAAAAEo"]
[Sat Feb 21 08:01:01.213374 2026] [:error] [pid 22558:tid 22574] [client 20.205.3.49:17605] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZj1vSrVaIb2gXsVbDpoRAAAAQ4"]
[Sat Feb 21 08:01:01.891097 2026] [:error] [pid 40756:tid 40779] [client 20.205.3.49:38407] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZj1vQNlDP60sLYgqXIB1QAAAA0"]
[Sat Feb 21 08:01:05.331246 2026] [:error] [pid 40871:tid 40882] [client 20.205.3.49:17623] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "aZj1wTqDikjdiOZeJyX4SgAAAMk"]
[Sat Feb 21 08:01:07.280501 2026] [:error] [pid 40757:tid 40817] [client 20.205.3.49:25671] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "aZj1w6g_MKVL7zhH7dxezAAAAFY"]
[Sat Feb 21 08:01:08.348327 2026] [:error] [pid 40756:tid 40782] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Sat Feb 21 08:01:08.470861 2026] [:error] [pid 40756:tid 40786] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/favicon.php
[Sat Feb 21 08:01:08.593197 2026] [:error] [pid 40756:tid 40785] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 21 08:01:09.208277 2026] [:error] [pid 40756:tid 40772] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/rzki.php
[Sat Feb 21 08:01:09.352905 2026] [:error] [pid 40756:tid 40777] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Feb 21 08:01:09.473873 2026] [:error] [pid 40756:tid 40784] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Feb 21 08:01:09.597071 2026] [:error] [pid 40756:tid 40781] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 21 08:01:09.989035 2026] [:error] [pid 40756:tid 40776] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sat Feb 21 08:01:10.127502 2026] [:error] [pid 40756:tid 40788] [client 20.205.3.49:38461] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Sat Feb 21 08:01:10.272418 2026] [:error] [pid 40756:tid 40789] [client 20.205.3.49:38461] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aZj1xgNlDP60sLYgqXIB_wAAABc"]
[Sat Feb 21 08:01:12.246125 2026] [:error] [pid 40871:tid 40877] [client 20.205.3.49:17646] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aZj1yDqDikjdiOZeJyX4VgAAAMQ"]
[Sat Feb 21 08:01:18.782209 2026] [:error] [pid 40758:tid 40838] [client 20.205.3.49:25721] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aZj1zkBAHxvBM3i9iKHRtwAAAJA"]
[Sat Feb 21 08:01:21.527648 2026] [:error] [pid 40758:tid 40846] [client 20.205.3.49:20323] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aZj10UBAHxvBM3i9iKHRugAAAJg"]
[Sat Feb 21 08:01:32.501448 2026] [:error] [pid 40871:tid 40875] [client 20.205.3.49:25157] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZj13DqDikjdiOZeJyX4bQAAAMI"]
[Sat Feb 21 08:01:34.364912 2026] [:error] [pid 40757:tid 40819] [client 20.205.3.49:49661] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZj13qg_MKVL7zhH7dxe5wAAAFg"]
[Sat Feb 21 08:01:36.253726 2026] [:error] [pid 22558:tid 22560] [client 20.205.3.49:30124] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZj14CrVaIb2gXsVbDpojwAAAQA"]
[Sat Feb 21 08:01:37.640261 2026] [:error] [pid 40757:tid 40795] [client 20.205.3.49:25156] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aZj14ag_MKVL7zhH7dxe6wAAAEA"]
[Sat Feb 21 08:01:38.363235 2026] [:error] [pid 22558:tid 22561] [client 20.205.3.49:25177] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aZj14irVaIb2gXsVbDpolgAAAQE"]
[Sat Feb 21 08:01:39.510220 2026] [:error] [pid 40871:tid 40875] [client 20.205.3.49:35696] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aZj14zqDikjdiOZeJyX4eQAAAMI"]
[Sat Feb 21 08:01:41.754727 2026] [:error] [pid 40758:tid 40842] [client 20.205.3.49:37100] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aZj15UBAHxvBM3i9iKHRxwAAAJQ"]
[Sat Feb 21 08:01:43.574614 2026] [:error] [pid 22558:tid 22563] [client 20.205.3.49:61390] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZj15yrVaIb2gXsVbDpongAAAQM"]
[Sat Feb 21 08:01:45.139418 2026] [:error] [pid 40871:tid 40885] [client 20.205.3.49:35704] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZj16TqDikjdiOZeJyX4fQAAAMw"]
[Sat Feb 21 08:01:50.473634 2026] [:error] [pid 22558:tid 22562] [client 20.205.3.49:29440] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZj17irVaIb2gXsVbDpopQAAAQI"]
[Sat Feb 21 08:01:51.134944 2026] [:error] [pid 40871:tid 40894] [client 20.205.3.49:25191] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aZj17zqDikjdiOZeJyX4hgAAANU"]
[Sat Feb 21 08:01:52.709252 2026] [:error] [pid 40757:tid 40815] [client 20.205.3.49:61393] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZj18Kg_MKVL7zhH7dxfCAAAAFQ"]
[Sat Feb 21 08:01:53.949656 2026] [:error] [pid 40756:tid 40776] [client 20.205.3.49:29503] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZj18QNlDP60sLYgqXICIgAAAAo"]
[Sat Feb 21 08:01:56.339944 2026] [:error] [pid 40871:tid 40897] [client 20.205.3.49:26058] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZj19DqDikjdiOZeJyX4jwAAANg"]
[Sat Feb 21 08:01:58.618683 2026] [:error] [pid 40871:tid 40896] [client 20.205.3.49:15251] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZj19jqDikjdiOZeJyX4lwAAANc"]
[Sat Feb 21 08:02:00.398547 2026] [:error] [pid 40757:tid 40798] [client 20.205.3.49:43535] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZj1-Kg_MKVL7zhH7dxfDAAAAEM"]
[Sat Feb 21 08:02:01.807331 2026] [:error] [pid 40871:tid 40874] [client 20.205.3.49:19864] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZj1-TqDikjdiOZeJyX4owAAAME"]
[Sat Feb 21 08:02:04.337503 2026] [:error] [pid 40758:tid 40843] [client 20.205.3.49:49632] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZj1_EBAHxvBM3i9iKHR7AAAAJU"]
[Sat Feb 21 08:02:06.808071 2026] [:error] [pid 40758:tid 40824] [client 20.205.3.49:35659] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZj1_kBAHxvBM3i9iKHR8AAAAII"]
[Sat Feb 21 08:02:08.142608 2026] [:error] [pid 40871:tid 40886] [client 20.205.3.49:30108] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/wp-login.php"] [unique_id "aZj2ADqDikjdiOZeJyX4swAAAM0"]
[Sat Feb 21 08:02:11.934326 2026] [:error] [pid 40757:tid 40803] [client 20.205.3.49:25205] [client 20.205.3.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.3.49, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/wp-login.php"] [unique_id "aZj2A6g_MKVL7zhH7dxfEwAAAEg"]
[Sat Feb 21 08:02:12.514641 2026] [:error] [pid 40757:tid 40804] [client 20.205.3.49:25205] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Sat Feb 21 08:02:12.649617 2026] [:error] [pid 40757:tid 40802] [client 20.205.3.49:25205] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Feb 21 08:02:12.968363 2026] [:error] [pid 40757:tid 40800] [client 20.205.3.49:25205] [client 20.205.3.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.3.49, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aZj2BKg_MKVL7zhH7dxfHAAAAEU"]
[Sat Feb 21 08:02:13.335565 2026] [:error] [pid 40757:tid 40818] [client 20.205.3.49:25205] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sat Feb 21 08:02:13.497252 2026] [:error] [pid 40757:tid 40817] [client 20.205.3.49:25205] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Feb 21 08:02:13.619754 2026] [:error] [pid 40757:tid 40814] [client 20.205.3.49:25205] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Feb 21 08:02:13.740651 2026] [:error] [pid 40757:tid 40797] [client 20.205.3.49:25205] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZj2Bag_MKVL7zhH7dxfIwAAAEI"]
[Sat Feb 21 08:02:15.645825 2026] [:error] [pid 22558:tid 22575] [client 20.205.3.49:29450] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZj2ByrVaIb2gXsVbDpovAAAAQ8"]
[Sat Feb 21 08:02:17.098265 2026] [:error] [pid 40871:tid 40892] [client 20.205.3.49:49635] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZj2CTqDikjdiOZeJyX4wQAAANM"]
[Sat Feb 21 08:02:18.214795 2026] [:error] [pid 40756:tid 40771] [client 20.205.3.49:30019] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZj2CgNlDP60sLYgqXICPwAAAAU"]
[Sat Feb 21 08:02:18.649157 2026] [:error] [pid 40871:tid 40893] [client 20.205.3.49:37115] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZj2CjqDikjdiOZeJyX4ywAAANQ"]
[Sat Feb 21 08:02:19.261572 2026] [:error] [pid 40871:tid 40882] [client 20.205.3.49:32357] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZj2CzqDikjdiOZeJyX4zgAAAMk"]
[Sat Feb 21 08:02:20.134211 2026] [:error] [pid 22558:tid 22581] [client 20.205.3.49:50571] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZj2DCrVaIb2gXsVbDpovwAAARU"]
[Sat Feb 21 08:02:22.943469 2026] [:error] [pid 40871:tid 40874] [client 20.205.3.49:50570] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZj2DjqDikjdiOZeJyX46AAAAME"]
[Sat Feb 21 08:02:23.778792 2026] [:error] [pid 22558:tid 22583] [client 20.205.3.49:37090] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h.php"] [unique_id "aZj2DyrVaIb2gXsVbDpo0AAAARc"]
[Sat Feb 21 08:02:27.305498 2026] [:error] [pid 22558:tid 22572] [client 20.205.3.49:13023] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h.php"] [unique_id "aZj2EyrVaIb2gXsVbDpo1AAAAQw"]
[Sat Feb 21 08:02:27.846938 2026] [:error] [pid 40871:tid 40893] [client 20.205.3.49:16108] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h.php"] [unique_id "aZj2EzqDikjdiOZeJyX49wAAANQ"]
[Sat Feb 21 08:02:30.830018 2026] [:error] [pid 40757:tid 40809] [client 20.205.3.49:13010] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h.php"] [unique_id "aZj2Fqg_MKVL7zhH7dxfMAAAAE4"]
[Sat Feb 21 08:02:32.054738 2026] [:error] [pid 40871:tid 40873] [client 20.205.3.49:14106] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aZj2GDqDikjdiOZeJyX5AQAAAMA"]
[Sat Feb 21 08:02:35.205941 2026] [:error] [pid 40871:tid 40880] [client 20.205.3.49:22586] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aZj2GzqDikjdiOZeJyX5BwAAAMc"]
[Sat Feb 21 08:02:36.509613 2026] [:error] [pid 22558:tid 22571] [client 20.205.3.49:18649] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aZj2HCrVaIb2gXsVbDpo4gAAAQs"]
[Sat Feb 21 08:02:40.879090 2026] [:error] [pid 40758:tid 40836] [client 20.205.3.49:13795] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "aZj2IEBAHxvBM3i9iKHSHAAAAI4"]
[Sat Feb 21 08:02:42.428921 2026] [:error] [pid 40871:tid 40874] [client 20.205.3.49:37688] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user-new.php"] [unique_id "aZj2IjqDikjdiOZeJyX5FAAAAME"]
[Sat Feb 21 08:02:43.183121 2026] [:error] [pid 40757:tid 40814] [client 20.205.3.49:14862] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user-new.php"] [unique_id "aZj2I6g_MKVL7zhH7dxfUAAAAFM"]
[Sat Feb 21 08:02:45.955667 2026] [:error] [pid 40871:tid 40878] [client 20.205.3.49:19183] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user-new.php"] [unique_id "aZj2JTqDikjdiOZeJyX5HAAAAMU"]
[Sat Feb 21 08:02:46.960547 2026] [:error] [pid 40758:tid 40844] [client 20.205.3.49:14973] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user-new.php"] [unique_id "aZj2JkBAHxvBM3i9iKHSMgAAAJY"]
[Sat Feb 21 08:02:50.654366 2026] [:error] [pid 40871:tid 40880] [client 20.205.3.49:37680] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aZj2KjqDikjdiOZeJyX5KAAAAMc"]
[Sat Feb 21 08:02:51.842513 2026] [:error] [pid 40757:tid 40804] [client 20.205.3.49:4576] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aZj2K6g_MKVL7zhH7dxfWgAAAEk"]
[Sat Feb 21 08:02:55.109806 2026] [:error] [pid 40756:tid 40768] [client 20.205.3.49:38946] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aZj2LwNlDP60sLYgqXICjgAAAAI"]
[Sat Feb 21 08:02:56.226019 2026] [:error] [pid 40756:tid 40772] [client 20.205.3.49:28761] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i.php"] [unique_id "aZj2MANlDP60sLYgqXICkQAAAAY"]
[Sat Feb 21 08:02:57.830486 2026] [:error] [pid 40757:tid 40816] [client 20.205.3.49:38958] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "aZj2Mag_MKVL7zhH7dxfZQAAAFU"]
[Sat Feb 21 08:02:59.904666 2026] [:error] [pid 22558:tid 22570] [client 20.205.3.49:14933] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "aZj2MyrVaIb2gXsVbDppDgAAAQo"]
[Sat Feb 21 08:03:00.629943 2026] [:error] [pid 22558:tid 22574] [client 20.205.3.49:14932] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "aZj2NCrVaIb2gXsVbDppFQAAAQ4"]
[Sat Feb 21 08:03:01.157807 2026] [:error] [pid 40756:tid 40779] [client 20.205.3.49:62191] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "aZj2NQNlDP60sLYgqXICkwAAAA0"]
[Sat Feb 21 08:03:01.768670 2026] [:error] [pid 40871:tid 40892] [client 20.205.3.49:18260] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aZj2NTqDikjdiOZeJyX5NwAAANM"]
[Sat Feb 21 08:03:03.123339 2026] [:error] [pid 22558:tid 22570] [client 20.205.3.49:22932] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aZj2NyrVaIb2gXsVbDppGwAAAQo"]
[Sat Feb 21 08:03:04.632286 2026] [:error] [pid 40757:tid 40795] [client 20.205.3.49:37650] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aZj2OKg_MKVL7zhH7dxfawAAAEA"]
[Sat Feb 21 08:03:05.666270 2026] [:error] [pid 40756:tid 40788] [client 20.205.3.49:18278] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "aZj2OQNlDP60sLYgqXICmgAAABY"]
[Sat Feb 21 08:03:08.583046 2026] [:error] [pid 40871:tid 40876] [client 20.205.3.49:14874] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen/function.php"] [unique_id "aZj2PDqDikjdiOZeJyX5QQAAAMM"]
[Sat Feb 21 08:03:09.710471 2026] [:error] [pid 22558:tid 22567] [client 20.205.3.49:13396] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen/function.php"] [unique_id "aZj2PSrVaIb2gXsVbDppJwAAAQc"]
[Sat Feb 21 08:03:11.445712 2026] [:error] [pid 22558:tid 22570] [client 20.205.3.49:13414] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen/function.php"] [unique_id "aZj2PyrVaIb2gXsVbDppKQAAAQo"]
[Sat Feb 21 08:03:16.314544 2026] [:error] [pid 40756:tid 40767] [client 20.205.3.49:30759] File does not exist: /usr/local/apache/htdocs/suspended-page/xxzdc.php
[Sat Feb 21 08:03:16.443564 2026] [:error] [pid 40756:tid 40781] [client 20.205.3.49:30759] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Sat Feb 21 08:03:16.565665 2026] [:error] [pid 40756:tid 40775] [client 20.205.3.49:30759] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sat Feb 21 08:03:16.685610 2026] [:error] [pid 40756:tid 40771] [client 20.205.3.49:30759] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Sat Feb 21 08:03:16.963870 2026] [:error] [pid 40756:tid 40783] [client 20.205.3.49:30759] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conf.php
[Sat Feb 21 08:03:17.085034 2026] [:error] [pid 40756:tid 40770] [client 20.205.3.49:30759] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aZj2RQNlDP60sLYgqXICsQAAAAQ"]
[Sat Feb 21 08:03:18.010858 2026] [:error] [pid 40756:tid 40776] [client 20.205.3.49:14147] File does not exist: /usr/local/apache/htdocs/suspended-page/lm15.php
[Sat Feb 21 08:03:18.132471 2026] [:error] [pid 40756:tid 40778] [client 20.205.3.49:14147] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 21 08:03:18.497437 2026] [:error] [pid 40756:tid 40787] [client 20.205.3.49:14147] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aZj2RgNlDP60sLYgqXICtwAAABU"]
[Sat Feb 21 08:03:21.744589 2026] [:error] [pid 40757:tid 40797] [client 20.205.3.49:4651] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aZj2Sag_MKVL7zhH7dxfiwAAAEI"]
[Sat Feb 21 08:03:22.945112 2026] [:error] [pid 22558:tid 22569] [client 20.205.3.49:34449] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aZj2SirVaIb2gXsVbDppRQAAAQk"]
[Sat Feb 21 08:03:26.506348 2026] [:error] [pid 40756:tid 40782] [client 20.205.3.49:25781] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "aZj2TgNlDP60sLYgqXICyAAAABA"]
[Sat Feb 21 08:03:29.331134 2026] [:error] [pid 22558:tid 22581] [client 20.205.3.49:33974] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aZj2USrVaIb2gXsVbDppUQAAARU"]
[Sat Feb 21 08:03:33.443821 2026] [:error] [pid 40871:tid 40874] [client 20.205.3.49:4611] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aZj2VTqDikjdiOZeJyX5fgAAAME"]
[Sat Feb 21 08:03:35.524433 2026] [:error] [pid 22558:tid 22571] [client 20.205.3.49:4624] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aZj2VyrVaIb2gXsVbDppWQAAAQs"]
[Sat Feb 21 08:03:36.711880 2026] [:error] [pid 40756:tid 40790] [client 20.205.3.49:28179] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "aZj2WANlDP60sLYgqXIC2AAAABg"]
[Sat Feb 21 08:03:45.446097 2026] [:error] [pid 40758:tid 40822] [client 20.205.3.49:25790] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aZj2YUBAHxvBM3i9iKHSfQAAAIA"]
[Sat Feb 21 08:03:47.272513 2026] [:error] [pid 22558:tid 22578] [client 20.205.3.49:39516] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aZj2YyrVaIb2gXsVbDppZQAAARI"]
[Sat Feb 21 08:03:51.160445 2026] [:error] [pid 40871:tid 40893] [client 20.205.3.49:15351] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aZj2ZzqDikjdiOZeJyX5pwAAANQ"]
[Sat Feb 21 08:03:59.815165 2026] [:error] [pid 40871:tid 40877] [client 20.205.3.49:31336] [client 20.205.3.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aZj2bzqDikjdiOZeJyX5sgAAAMQ"]
[Sat Feb 21 08:04:07.137270 2026] [:error] [pid 40756:tid 40769] [client 20.205.3.49:17538] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZj2dwNlDP60sLYgqXIC9wAAAAM"]
[Sat Feb 21 08:04:10.189504 2026] [:error] [pid 40756:tid 40785] [client 20.205.3.49:44865] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZj2egNlDP60sLYgqXIC_gAAABM"]
[Sat Feb 21 08:04:14.634136 2026] [:error] [pid 40757:tid 40809] [client 20.205.3.49:50106] [client 20.205.3.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZj2fqg_MKVL7zhH7dxf0gAAAE4"]
[Sat Feb 21 08:04:22.446059 2026] [:error] [pid 40871:tid 40895] [client 20.205.3.49:42997] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Sat Feb 21 08:04:22.573001 2026] [:error] [pid 40871:tid 40879] [client 20.205.3.49:42997] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Sat Feb 21 08:04:22.696670 2026] [:error] [pid 40871:tid 40877] [client 20.205.3.49:42997] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sat Feb 21 08:07:49.160882 2026] [:error] [pid 40756:tid 40767] [client 3.131.159.45:49301] [client 3.131.159.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aZj3VQNlDP60sLYgqXIEZwAAAAE"]
[Sat Feb 21 08:07:49.564988 2026] [:error] [pid 40757:tid 40802] [client 3.131.159.45:54375] [client 3.131.159.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aZj3Vag_MKVL7zhH7dxhAwAAAEc"]
[Sat Feb 21 08:07:49.954957 2026] [:error] [pid 40757:tid 40808] [client 3.131.159.45:63718] [client 3.131.159.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aZj3Vag_MKVL7zhH7dxhBAAAAE0"]
[Sat Feb 21 09:08:41.973453 2026] [:error] [pid 40758:tid 40839] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Sat Feb 21 09:08:42.104751 2026] [:error] [pid 40758:tid 40829] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/70.php
[Sat Feb 21 09:08:42.221434 2026] [:error] [pid 40758:tid 40837] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Sat Feb 21 09:08:42.353274 2026] [:error] [pid 40758:tid 40833] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Sat Feb 21 09:08:42.469808 2026] [:error] [pid 40758:tid 40840] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Sat Feb 21 09:08:42.586352 2026] [:error] [pid 40758:tid 40830] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/86.php
[Sat Feb 21 09:08:42.723168 2026] [:error] [pid 40758:tid 40823] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/v.php
[Sat Feb 21 09:08:42.998532 2026] [:error] [pid 40758:tid 40838] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sat Feb 21 09:08:43.115165 2026] [:error] [pid 40758:tid 40842] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sat Feb 21 09:08:43.239788 2026] [:error] [pid 40758:tid 40845] [client 20.89.58.48:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sat Feb 21 09:08:43.353982 2026] [:error] [pid 40758:tid 40822] [client 20.89.58.48:21211] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aZkFm0BAHxvBM3i9iKHmPgAAAIA"]
[Sat Feb 21 09:08:45.356765 2026] [:error] [pid 22558:tid 22580] [client 20.89.58.48:29096] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aZkFnSrVaIb2gXsVbDp63gAAARQ"]
[Sat Feb 21 09:08:47.214620 2026] [:error] [pid 11941:tid 11967] [client 20.89.58.48:37900] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aZkFn3TUkHs3EVWllKkKDgAAAZg"]
[Sat Feb 21 09:08:50.837240 2026] [:error] [pid 22558:tid 22569] [client 20.89.58.48:21213] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aZkFoirVaIb2gXsVbDp65wAAAQk"]
[Sat Feb 21 09:08:58.264976 2026] [:error] [pid 11743:tid 11755] [client 20.89.58.48:24661] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aZkFqgALoZZjiTbGvqWErAAAAUo"]
[Sat Feb 21 09:09:01.051056 2026] [:error] [pid 11941:tid 11965] [client 20.89.58.48:21192] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aZkFrXTUkHs3EVWllKkKHgAAAZY"]
[Sat Feb 21 09:09:04.300717 2026] [:error] [pid 40757:tid 40797] [client 20.89.58.48:7657] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aZkFsKg_MKVL7zhH7dx0ggAAAEI"]
[Sat Feb 21 09:09:17.669265 2026] [:error] [pid 22558:tid 22582] [client 20.89.58.48:29079] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5.php"] [unique_id "aZkFvSrVaIb2gXsVbDp6_gAAARY"]
[Sat Feb 21 09:09:19.000502 2026] [:error] [pid 22558:tid 22564] [client 20.89.58.48:7889] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5.php"] [unique_id "aZkFvirVaIb2gXsVbDp6_wAAAQQ"]
[Sat Feb 21 09:09:21.218114 2026] [:error] [pid 11941:tid 11962] [client 20.89.58.48:29097] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5.php"] [unique_id "aZkFwXTUkHs3EVWllKkKOAAAAZM"]
[Sat Feb 21 19:26:39.850923 2026] [:error] [pid 36509:tid 36514] [client 209.38.88.123:64392] [client 209.38.88.123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aZmWbzG8U28d2EFbEqWb6wAAAcM"]
[Sat Feb 21 19:26:39.882323 2026] [:error] [pid 53976:tid 54007] [client 209.38.88.123:64422] [client 209.38.88.123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZmWb9BEV5I20TLqUt6wegAAAoA"]
[Sat Feb 21 19:37:05.730269 2026] [:error] [pid 36509:tid 36535] [client 203.189.134.85:56676] [client 203.189.134.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.189.134.85, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZmY4TG8U28d2EFbEqWesAAAAdg"]
[Sat Feb 21 19:37:05.735169 2026] [:error] [pid 36509:tid 36535] [client 203.189.134.85:56676] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 21 23:54:27.405619 2026] [:error] [pid 40756:tid 40789] [client 172.245.102.49:60193] [client 172.245.102.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.49, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZnVMwNlDP60sLYgqXL4XwAAABc"]
[Sat Feb 21 23:54:27.411338 2026] [:error] [pid 40756:tid 40789] [client 172.245.102.49:60193] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Feb 22 00:05:46.759656 2026] [:error] [pid 11941:tid 11943] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sun Feb 22 00:05:48.214198 2026] [:error] [pid 11941:tid 11943] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/sc.php
[Sun Feb 22 00:05:48.331584 2026] [:error] [pid 11941:tid 11962] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sun Feb 22 00:05:48.451957 2026] [:error] [pid 11941:tid 11960] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/zu.php
[Sun Feb 22 00:05:48.737515 2026] [:error] [pid 11941:tid 11967] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Sun Feb 22 00:05:48.940085 2026] [:error] [pid 11941:tid 11961] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/sty.php
[Sun Feb 22 00:05:49.060938 2026] [:error] [pid 11941:tid 11951] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/wwx.php
[Sun Feb 22 00:05:49.179123 2026] [:error] [pid 11941:tid 11955] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/tevkb.php
[Sun Feb 22 00:05:49.304690 2026] [:error] [pid 11941:tid 11952] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/atmaca.php
[Sun Feb 22 00:05:49.575699 2026] [:error] [pid 11941:tid 11958] [client 20.48.26.117:26982] File does not exist: /usr/local/apache/htdocs/suspended-page/vr.php
[Sun Feb 22 00:05:49.747721 2026] [:error] [pid 11941:tid 11948] [client 20.48.26.117:26982] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/liebert.php"] [unique_id "aZnX3XTUkHs3EVWllKkCyQAAAYU"]
[Sun Feb 22 00:05:50.170138 2026] [:error] [pid 36509:tid 36526] [client 20.48.26.117:7934] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/liebert.php"] [unique_id "aZnX3jG8U28d2EFbEqXsogAAAc8"]
[Sun Feb 22 00:05:50.693655 2026] [:error] [pid 40871:tid 40890] [client 20.48.26.117:26951] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/liebert.php"] [unique_id "aZnX3jqDikjdiOZeJyXBpgAAANE"]
[Sun Feb 22 00:05:50.996740 2026] [:error] [pid 11743:tid 11750] [client 20.48.26.117:27000] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/liebert.php"] [unique_id "aZnX3gALoZZjiTbGvqVc4gAAAUU"]
[Sun Feb 22 00:05:51.736085 2026] [:error] [pid 40871:tid 40889] [client 20.48.26.117:47559] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aZnX3zqDikjdiOZeJyXBqQAAANA"]
[Sun Feb 22 00:05:52.424615 2026] [:error] [pid 22558:tid 22579] [client 20.48.26.117:47581] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aZnX4CrVaIb2gXsVbDpLtQAAARM"]
[Sun Feb 22 00:05:53.035358 2026] [:error] [pid 22558:tid 22564] [client 20.48.26.117:47582] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aZnX4SrVaIb2gXsVbDpLuAAAAQQ"]
[Sun Feb 22 00:05:53.517949 2026] [:error] [pid 11941:tid 11954] [client 20.48.26.117:34637] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "aZnX4XTUkHs3EVWllKkCzQAAAYs"]
[Sun Feb 22 00:05:53.940563 2026] [:error] [pid 53976:tid 54030] [client 20.48.26.117:36346] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZnX4dBEV5I20TLqUt7jxQAAApc"]
[Sun Feb 22 00:05:54.414196 2026] [:error] [pid 11941:tid 11956] [client 20.48.26.117:36240] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZnX4nTUkHs3EVWllKkCzgAAAY0"]
[Sun Feb 22 00:05:54.683697 2026] [:error] [pid 40871:tid 40881] [client 20.48.26.117:12003] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZnX4jqDikjdiOZeJyXBrQAAAMg"]
[Sun Feb 22 00:05:54.969049 2026] [:error] [pid 11743:tid 11761] [client 20.48.26.117:31744] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZnX4gALoZZjiTbGvqVc5QAAAVA"]
[Sun Feb 22 00:05:55.269001 2026] [:error] [pid 11941:tid 11962] [client 20.48.26.117:31788] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aZnX43TUkHs3EVWllKkC0AAAAZM"]
[Sun Feb 22 00:05:55.791275 2026] [:error] [pid 22558:tid 22565] [client 20.48.26.117:3340] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aZnX4yrVaIb2gXsVbDpLuQAAAQU"]
[Sun Feb 22 00:05:56.205241 2026] [:error] [pid 22558:tid 22561] [client 20.48.26.117:47564] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aZnX5CrVaIb2gXsVbDpLvAAAAQE"]
[Sun Feb 22 00:05:56.893521 2026] [:error] [pid 40871:tid 40874] [client 20.48.26.117:3946] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ze.php"] [unique_id "aZnX5DqDikjdiOZeJyXBrgAAAME"]
[Sun Feb 22 00:05:57.296145 2026] [:error] [pid 40756:tid 40788] [client 20.48.26.117:3374] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZnX5QNlDP60sLYgqXL6bgAAABY"]
[Sun Feb 22 00:05:57.641462 2026] [:error] [pid 36509:tid 36515] [client 20.48.26.117:6555] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZnX5TG8U28d2EFbEqXsrgAAAcQ"]
[Sun Feb 22 00:05:58.267359 2026] [:error] [pid 22558:tid 22562] [client 20.48.26.117:7885] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZnX5irVaIb2gXsVbDpLwAAAAQI"]
[Sun Feb 22 00:05:58.917220 2026] [:error] [pid 53976:tid 54015] [client 20.48.26.117:3682] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZnX5tBEV5I20TLqUt7jxwAAAog"]
[Sun Feb 22 00:05:59.966507 2026] [:error] [pid 36509:tid 36512] [client 20.48.26.117:51252] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aZnX5zG8U28d2EFbEqXssQAAAcE"]
[Sun Feb 22 00:06:00.670861 2026] [:error] [pid 11743:tid 11751] [client 20.48.26.117:3448] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aZnX6AALoZZjiTbGvqVc7AAAAUY"]
[Sun Feb 22 00:06:01.519913 2026] [:error] [pid 53976:tid 54031] [client 20.48.26.117:34659] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aZnX6dBEV5I20TLqUt7jygAAApg"]
[Sun Feb 22 00:06:02.321722 2026] [:error] [pid 53975:tid 53999] [client 20.48.26.117:3332] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aZnX6teFesAKjJ7sq3GsJgAAAlM"]
[Sun Feb 22 00:06:03.256493 2026] [:error] [pid 11743:tid 11760] [client 20.48.26.117:36338] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZnX6wALoZZjiTbGvqVc8gAAAU8"]
[Sun Feb 22 00:06:03.925697 2026] [:error] [pid 11941:tid 11962] [client 20.48.26.117:36238] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZnX63TUkHs3EVWllKkC2AAAAZM"]
[Sun Feb 22 00:06:05.129647 2026] [:error] [pid 11941:tid 11946] [client 20.48.26.117:5809] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZnX7XTUkHs3EVWllKkC2wAAAYM"]
[Sun Feb 22 00:06:06.297846 2026] [:error] [pid 36509:tid 36515] [client 20.48.26.117:5411] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZnX7jG8U28d2EFbEqXstAAAAcQ"]
[Sun Feb 22 00:06:07.646467 2026] [:error] [pid 11941:tid 11964] [client 20.48.26.117:3433] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZnX73TUkHs3EVWllKkC4AAAAZU"]
[Sun Feb 22 00:06:08.363427 2026] [:error] [pid 11941:tid 11959] [client 20.48.26.117:55517] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZnX8HTUkHs3EVWllKkC4wAAAZA"]
[Sun Feb 22 00:06:09.579500 2026] [:error] [pid 11941:tid 11960] [client 20.48.26.117:1422] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZnX8XTUkHs3EVWllKkC5wAAAZE"]
[Sun Feb 22 00:06:10.185802 2026] [:error] [pid 53975:tid 53982] [client 20.48.26.117:34658] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZnX8teFesAKjJ7sq3GsMAAAAkI"]
[Sun Feb 22 00:06:10.769174 2026] [:error] [pid 53975:tid 54004] [client 20.48.26.117:36242] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZnX8teFesAKjJ7sq3GsMgAAAlg"]
[Sun Feb 22 00:06:11.253473 2026] [:error] [pid 53975:tid 53989] [client 20.48.26.117:55528] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZnX89eFesAKjJ7sq3GsMwAAAkk"]
[Sun Feb 22 00:06:11.614009 2026] [:error] [pid 40757:tid 40797] [client 20.48.26.117:25509] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZnX86g_MKVL7zhH7dxVkQAAAEI"]
[Sun Feb 22 00:06:12.846605 2026] [:error] [pid 11743:tid 11749] [client 20.48.26.117:26966] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZnX9AALoZZjiTbGvqVc-AAAAUQ"]
[Sun Feb 22 00:06:13.245860 2026] [:error] [pid 40756:tid 40785] [client 20.48.26.117:25511] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZnX9QNlDP60sLYgqXL6egAAABM"]
[Sun Feb 22 00:06:13.532940 2026] [:error] [pid 40758:tid 40842] [client 20.48.26.117:3401] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZnX9UBAHxvBM3i9iKGhJAAAAJQ"]
[Sun Feb 22 00:06:13.814344 2026] [:error] [pid 53975:tid 53981] [client 20.48.26.117:5808] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZnX9deFesAKjJ7sq3GsNgAAAkE"]
[Sun Feb 22 00:06:14.254828 2026] [:error] [pid 40756:tid 40788] [client 20.48.26.117:36307] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZnX9gNlDP60sLYgqXL6fgAAABY"]
[Sun Feb 22 00:06:14.994382 2026] [:error] [pid 22558:tid 22578] [client 20.48.26.117:36237] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aZnX9irVaIb2gXsVbDpLwgAAARI"]
[Sun Feb 22 00:06:15.351639 2026] [:error] [pid 53976:tid 54029] [client 20.48.26.117:3415] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aZnX99BEV5I20TLqUt7j0gAAApY"]
[Sun Feb 22 00:06:16.748163 2026] [:error] [pid 36509:tid 36531] [client 20.48.26.117:3413] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aZnX-DG8U28d2EFbEqXsvAAAAdQ"]
[Sun Feb 22 00:06:17.279292 2026] [:error] [pid 36509:tid 36526] [client 20.48.26.117:26980] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aZnX-TG8U28d2EFbEqXsvwAAAc8"]
[Sun Feb 22 00:06:17.657804 2026] [:error] [pid 11941:tid 11946] [client 20.48.26.117:26999] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZnX-XTUkHs3EVWllKkC7gAAAYM"]
[Sun Feb 22 00:06:18.008980 2026] [:error] [pid 22558:tid 22574] [client 20.48.26.117:5384] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZnX-irVaIb2gXsVbDpLxAAAAQ4"]
[Sun Feb 22 00:06:18.251706 2026] [:error] [pid 36509:tid 36514] [client 20.48.26.117:7004] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZnX-jG8U28d2EFbEqXs1AAAAcM"]
[Sun Feb 22 00:06:18.884522 2026] [:error] [pid 36509:tid 36531] [client 20.48.26.117:36225] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZnX-jG8U28d2EFbEqXs5AAAAdQ"]
[Sun Feb 22 00:06:19.378795 2026] [:error] [pid 36509:tid 36528] [client 20.48.26.117:29345] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZnX-zG8U28d2EFbEqXs8AAAAdE"]
[Sun Feb 22 00:06:20.316485 2026] [:error] [pid 53975:tid 53987] [client 20.48.26.117:5806] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZnX_NeFesAKjJ7sq3GsOgAAAkc"]
[Sun Feb 22 00:06:20.723732 2026] [:error] [pid 53976:tid 54030] [client 20.48.26.117:34685] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZnX_NBEV5I20TLqUt7j2wAAApc"]
[Sun Feb 22 00:06:21.191267 2026] [:error] [pid 36509:tid 36514] [client 20.48.26.117:37775] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZnX_TG8U28d2EFbEqXtFgAAAcM"]
[Sun Feb 22 00:06:21.916443 2026] [:error] [pid 11941:tid 11954] [client 20.48.26.117:5804] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aZnX_XTUkHs3EVWllKkC8gAAAYs"]
[Sun Feb 22 00:06:23.328743 2026] [:error] [pid 40757:tid 40813] [client 20.48.26.117:25490] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aZnX_6g_MKVL7zhH7dxVmAAAAFI"]
[Sun Feb 22 00:06:24.024500 2026] [:error] [pid 53976:tid 54027] [client 20.48.26.117:1410] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aZnYANBEV5I20TLqUt7j3wAAApQ"]
[Sun Feb 22 00:06:24.626254 2026] [:error] [pid 40757:tid 40803] [client 20.48.26.117:30004] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aZnYAKg_MKVL7zhH7dxVmQAAAEg"]
[Sun Feb 22 00:06:25.164644 2026] [:error] [pid 11941:tid 11955] [client 20.48.26.117:10592] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aZnYAXTUkHs3EVWllKkC9AAAAYw"]
[Sun Feb 22 00:06:25.823343 2026] [:error] [pid 11743:tid 11745] [client 20.48.26.117:3430] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aZnYAQALoZZjiTbGvqVdGQAAAUA"]
[Sun Feb 22 00:06:26.309606 2026] [:error] [pid 40871:tid 40895] [client 20.48.26.117:30842] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aZnYAjqDikjdiOZeJyXBtgAAANY"]
[Sun Feb 22 00:06:27.119358 2026] [:error] [pid 11743:tid 11769] [client 20.48.26.117:2393] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aZnYAwALoZZjiTbGvqVdGwAAAVg"]
[Sun Feb 22 00:06:28.419645 2026] [:error] [pid 11743:tid 11763] [client 20.48.26.117:37791] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aZnYBAALoZZjiTbGvqVdHAAAAVI"]
[Sun Feb 22 00:06:28.939883 2026] [:error] [pid 11941:tid 11959] [client 20.48.26.117:55522] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aZnYBHTUkHs3EVWllKkC-AAAAZA"]
[Sun Feb 22 00:06:29.520540 2026] [:error] [pid 40757:tid 40800] [client 20.48.26.117:17545] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aZnYBag_MKVL7zhH7dxVoQAAAEU"]
[Sun Feb 22 00:06:30.719873 2026] [:error] [pid 53975:tid 53987] [client 20.48.26.117:28338] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aZnYBteFesAKjJ7sq3GsQgAAAkc"]
[Sun Feb 22 00:06:31.411395 2026] [:error] [pid 22558:tid 22568] [client 20.48.26.117:30007] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aZnYByrVaIb2gXsVbDpLywAAAQg"]
[Sun Feb 22 00:06:34.176933 2026] [:error] [pid 53976:tid 54014] [client 20.48.26.117:2230] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aZnYCtBEV5I20TLqUt7j4wAAAoc"]
[Sun Feb 22 00:06:35.128288 2026] [:error] [pid 40871:tid 40890] [client 20.48.26.117:5841] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aZnYCzqDikjdiOZeJyXBvwAAANE"]
[Sun Feb 22 00:06:35.427883 2026] [:error] [pid 36509:tid 36523] [client 20.48.26.117:53103] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aZnYCzG8U28d2EFbEqXtNQAAAcw"]
[Sun Feb 22 00:06:36.027140 2026] [:error] [pid 53976:tid 54015] [client 20.48.26.117:28310] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZnYDNBEV5I20TLqUt7j5wAAAog"]
[Sun Feb 22 00:06:37.247637 2026] [:error] [pid 22558:tid 22582] [client 20.48.26.117:18122] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZnYDSrVaIb2gXsVbDpLzwAAARY"]
[Sun Feb 22 00:06:37.659620 2026] [:error] [pid 36509:tid 36535] [client 20.48.26.117:53108] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZnYDTG8U28d2EFbEqXtOAAAAdg"]
[Sun Feb 22 00:06:38.155682 2026] [:error] [pid 53976:tid 54023] [client 20.48.26.117:23082] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZnYDtBEV5I20TLqUt7j6QAAApA"]
[Sun Feb 22 00:06:39.021406 2026] [:error] [pid 40758:tid 40822] [client 20.48.26.117:2824] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZnYD0BAHxvBM3i9iKGhKgAAAIA"]
[Sun Feb 22 00:06:39.551604 2026] [:error] [pid 36509:tid 36512] [client 20.48.26.117:2227] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZnYDzG8U28d2EFbEqXtOgAAAcE"]
[Sun Feb 22 00:06:39.946082 2026] [:error] [pid 40871:tid 40887] [client 20.48.26.117:47515] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZnYDzqDikjdiOZeJyXBwAAAAM4"]
[Sun Feb 22 00:06:40.938156 2026] [:error] [pid 53975:tid 53986] [client 20.48.26.117:28301] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZnYENeFesAKjJ7sq3GsSAAAAkY"]
[Sun Feb 22 00:06:41.458779 2026] [:error] [pid 22558:tid 22583] [client 20.48.26.117:2854] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZnYESrVaIb2gXsVbDpL1gAAARc"]
[Sun Feb 22 00:06:42.440793 2026] [:error] [pid 40758:tid 40833] [client 20.48.26.117:11575] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZnYEkBAHxvBM3i9iKGhLAAAAIs"]
[Sun Feb 22 00:06:42.989802 2026] [:error] [pid 36509:tid 36523] [client 20.48.26.117:18168] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZnYEjG8U28d2EFbEqXtQQAAAcw"]
[Sun Feb 22 00:06:43.312201 2026] [:error] [pid 22558:tid 22568] [client 20.48.26.117:5874] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZnYEyrVaIb2gXsVbDpL2AAAAQg"]
[Sun Feb 22 00:06:43.837739 2026] [:error] [pid 22558:tid 22567] [client 20.48.26.117:42509] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "aZnYEyrVaIb2gXsVbDpL2QAAAQc"]
[Sun Feb 22 00:06:44.449562 2026] [:error] [pid 53975:tid 53989] [client 20.48.26.117:18150] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "aZnYFNeFesAKjJ7sq3GsTAAAAkk"]
[Sun Feb 22 00:06:45.483351 2026] [:error] [pid 22558:tid 22575] [client 20.48.26.117:49857] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "aZnYFSrVaIb2gXsVbDpL3QAAAQ8"]
[Sun Feb 22 00:06:46.133959 2026] [:error] [pid 53975:tid 53997] [client 20.48.26.117:42543] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "aZnYFteFesAKjJ7sq3GsUAAAAlE"]
[Sun Feb 22 00:06:46.676467 2026] [:error] [pid 53976:tid 54007] [client 20.48.26.117:11540] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZnYFtBEV5I20TLqUt7j7QAAAoA"]
[Sun Feb 22 00:06:47.274259 2026] [:error] [pid 53975:tid 53983] [client 20.48.26.117:11570] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZnYF9eFesAKjJ7sq3GsUwAAAkM"]
[Sun Feb 22 00:06:48.222010 2026] [:error] [pid 40758:tid 40836] [client 20.48.26.117:13737] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZnYGEBAHxvBM3i9iKGhLwAAAI4"]
[Sun Feb 22 00:06:48.676696 2026] [:error] [pid 53975:tid 53984] [client 20.48.26.117:18172] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZnYGNeFesAKjJ7sq3GsWAAAAkQ"]
[Sun Feb 22 00:06:49.038895 2026] [:error] [pid 53975:tid 53982] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sun Feb 22 00:06:49.156130 2026] [:error] [pid 53975:tid 54003] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/un.php
[Sun Feb 22 00:06:49.286612 2026] [:error] [pid 53975:tid 53987] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Sun Feb 22 00:06:50.807011 2026] [:error] [pid 53975:tid 53987] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Sun Feb 22 00:06:50.970278 2026] [:error] [pid 53975:tid 53995] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/login8.php
[Sun Feb 22 00:06:51.243041 2026] [:error] [pid 53975:tid 54001] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Sun Feb 22 00:06:51.413257 2026] [:error] [pid 53975:tid 53988] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/lul.php
[Sun Feb 22 00:06:51.588793 2026] [:error] [pid 53975:tid 53992] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Sun Feb 22 00:06:51.709945 2026] [:error] [pid 53975:tid 53991] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun Feb 22 00:06:51.826378 2026] [:error] [pid 53975:tid 54000] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/ya.php
[Sun Feb 22 00:06:52.004949 2026] [:error] [pid 53975:tid 53982] [client 20.48.26.117:26919] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sun Feb 22 00:06:52.119089 2026] [:error] [pid 53975:tid 54003] [client 20.48.26.117:26919] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aZnYHNeFesAKjJ7sq3GsaAAAAlc"]
[Sun Feb 22 00:06:53.287006 2026] [:error] [pid 36509:tid 36517] [client 20.48.26.117:49914] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aZnYHTG8U28d2EFbEqXtRwAAAcY"]
[Sun Feb 22 00:06:54.460976 2026] [:error] [pid 11743:tid 11747] [client 20.48.26.117:5826] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aZnYHgALoZZjiTbGvqVdPwAAAUI"]
[Sun Feb 22 00:06:55.175925 2026] [:error] [pid 22558:tid 22576] [client 20.48.26.117:23097] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aZnYHyrVaIb2gXsVbDpL4wAAARA"]
[Sun Feb 22 00:06:55.726678 2026] [:error] [pid 53975:tid 53985] [client 20.48.26.117:22428] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aZnYH9eFesAKjJ7sq3GsbQAAAkU"]
[Sun Feb 22 00:06:57.130959 2026] [:error] [pid 40871:tid 40883] [client 20.48.26.117:24658] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aZnYITqDikjdiOZeJyXBxwAAAMo"]
[Sun Feb 22 00:06:58.026445 2026] [:error] [pid 40758:tid 40838] [client 20.48.26.117:5879] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aZnYIkBAHxvBM3i9iKGhMwAAAJA"]
[Sun Feb 22 00:06:58.784844 2026] [:error] [pid 53976:tid 54011] [client 20.48.26.117:56706] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aZnYItBEV5I20TLqUt7j7wAAAoQ"]
[Sun Feb 22 00:06:59.434207 2026] [:error] [pid 53975:tid 54003] [client 20.48.26.117:26880] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aZnYI9eFesAKjJ7sq3GscQAAAlc"]
[Sun Feb 22 00:06:59.943438 2026] [:error] [pid 40871:tid 40888] [client 20.48.26.117:53105] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aZnYIzqDikjdiOZeJyXByQAAAM8"]
[Sun Feb 22 00:07:00.257922 2026] [:error] [pid 53975:tid 53986] [client 20.48.26.117:24648] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aZnYJNeFesAKjJ7sq3GsdAAAAkY"]
[Sun Feb 22 00:07:00.807842 2026] [:error] [pid 53975:tid 53981] [client 20.48.26.117:42506] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aZnYJNeFesAKjJ7sq3GsdwAAAkE"]
[Sun Feb 22 00:07:01.178151 2026] [:error] [pid 11743:tid 11758] [client 20.48.26.117:53081] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZnYJQALoZZjiTbGvqVdRAAAAU0"]
[Sun Feb 22 00:07:01.477610 2026] [:error] [pid 11941:tid 11944] [client 20.48.26.117:24691] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZnYJXTUkHs3EVWllKkDCQAAAYE"]
[Sun Feb 22 00:07:01.733166 2026] [:error] [pid 53975:tid 53999] [client 20.48.26.117:49879] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZnYJdeFesAKjJ7sq3GsegAAAlM"]
[Sun Feb 22 00:07:02.600148 2026] [:error] [pid 40758:tid 40830] [client 20.48.26.117:49918] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZnYJkBAHxvBM3i9iKGhOAAAAIg"]
[Sun Feb 22 00:07:03.587287 2026] [:error] [pid 11941:tid 11945] [client 20.48.26.117:5879] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aZnYJ3TUkHs3EVWllKkDCwAAAYI"]
[Sun Feb 22 00:07:04.440489 2026] [:error] [pid 53976:tid 54021] [client 20.48.26.117:3844] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aZnYKNBEV5I20TLqUt7j9gAAAo4"]
[Sun Feb 22 00:07:04.906865 2026] [:error] [pid 11743:tid 11769] [client 20.48.26.117:42530] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aZnYKAALoZZjiTbGvqVdRwAAAVg"]
[Sun Feb 22 00:07:05.187647 2026] [:error] [pid 40756:tid 40789] [client 20.48.26.117:2333] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aZnYKQNlDP60sLYgqXL6kwAAABc"]
[Sun Feb 22 00:07:05.808274 2026] [:error] [pid 40756:tid 40773] [client 20.48.26.117:26926] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/06.php"] [unique_id "aZnYKQNlDP60sLYgqXL6lAAAAAc"]
[Sun Feb 22 00:07:06.169670 2026] [:error] [pid 40871:tid 40891] [client 20.48.26.117:24671] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/06.php"] [unique_id "aZnYKjqDikjdiOZeJyXBzQAAANI"]
[Sun Feb 22 00:07:06.555709 2026] [:error] [pid 53975:tid 53996] [client 20.48.26.117:13731] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/06.php"] [unique_id "aZnYKteFesAKjJ7sq3GsfQAAAlA"]
[Sun Feb 22 00:07:06.893051 2026] [:error] [pid 53976:tid 54013] [client 20.48.26.117:56721] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/06.php"] [unique_id "aZnYKtBEV5I20TLqUt7j-AAAAoY"]
[Sun Feb 22 00:07:07.489902 2026] [:error] [pid 11743:tid 11750] [client 20.48.26.117:49889] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aZnYKwALoZZjiTbGvqVdSQAAAUU"]
[Sun Feb 22 00:07:07.962274 2026] [:error] [pid 40756:tid 40783] [client 20.48.26.117:6594] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aZnYKwNlDP60sLYgqXL6mQAAABE"]
[Sun Feb 22 00:07:08.495770 2026] [:error] [pid 40756:tid 40779] [client 20.48.26.117:26900] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aZnYLANlDP60sLYgqXL6nAAAAA0"]
[Sun Feb 22 00:07:08.881986 2026] [:error] [pid 11941:tid 11956] [client 20.48.26.117:49873] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aZnYLHTUkHs3EVWllKkDDwAAAY0"]
[Sun Feb 22 00:07:09.179896 2026] [:error] [pid 11743:tid 11758] [client 20.48.26.117:42499] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fot.php"] [unique_id "aZnYLQALoZZjiTbGvqVdUAAAAU0"]
[Sun Feb 22 00:07:09.507980 2026] [:error] [pid 11743:tid 11760] [client 20.48.26.117:2139] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fot.php"] [unique_id "aZnYLQALoZZjiTbGvqVdUQAAAU8"]
[Sun Feb 22 00:07:10.063674 2026] [:error] [pid 40756:tid 40788] [client 20.48.26.117:56731] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fot.php"] [unique_id "aZnYLgNlDP60sLYgqXL6nwAAABY"]
[Sun Feb 22 00:07:10.494191 2026] [:error] [pid 40871:tid 40893] [client 20.48.26.117:2124] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fot.php"] [unique_id "aZnYLjqDikjdiOZeJyXB0AAAANQ"]
[Sun Feb 22 00:07:10.809428 2026] [:error] [pid 11941:tid 11965] [client 20.48.26.117:2318] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZnYLnTUkHs3EVWllKkDEwAAAZY"]
[Sun Feb 22 00:07:11.055314 2026] [:error] [pid 36509:tid 36519] [client 20.48.26.117:2334] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZnYLzG8U28d2EFbEqXtVAAAAcg"]
[Sun Feb 22 00:07:11.310185 2026] [:error] [pid 22558:tid 22562] [client 20.48.26.117:2760] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZnYLyrVaIb2gXsVbDpL5wAAAQI"]
[Sun Feb 22 00:07:11.699281 2026] [:error] [pid 40871:tid 40888] [client 20.48.26.117:26916] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZnYLzqDikjdiOZeJyXB1AAAAM8"]
[Sun Feb 22 00:07:12.198330 2026] [:error] [pid 40871:tid 40892] [client 20.48.26.117:14737] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZnYMDqDikjdiOZeJyXB1gAAANM"]
[Sun Feb 22 00:07:12.525350 2026] [:error] [pid 22558:tid 22569] [client 20.48.26.117:3877] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZnYMCrVaIb2gXsVbDpL6AAAAQk"]
[Sun Feb 22 00:07:12.886671 2026] [:error] [pid 11941:tid 11951] [client 20.48.26.117:12885] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZnYMHTUkHs3EVWllKkDFAAAAYg"]
[Sun Feb 22 00:07:13.342935 2026] [:error] [pid 11743:tid 11749] [client 20.48.26.117:2356] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZnYMQALoZZjiTbGvqVdUwAAAUQ"]
[Sun Feb 22 00:07:13.707931 2026] [:error] [pid 11941:tid 11952] [client 20.48.26.117:2776] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZnYMXTUkHs3EVWllKkDFQAAAYk"]
[Sun Feb 22 00:07:13.955065 2026] [:error] [pid 11743:tid 11745] [client 20.48.26.117:3860] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZnYMQALoZZjiTbGvqVdVQAAAUA"]
[Sun Feb 22 00:07:14.345541 2026] [:error] [pid 40871:tid 40887] [client 20.48.26.117:12884] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZnYMjqDikjdiOZeJyXB2QAAAM4"]
[Sun Feb 22 00:07:14.810941 2026] [:error] [pid 53975:tid 53987] [client 20.48.26.117:12923] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZnYMteFesAKjJ7sq3GsfwAAAkc"]
[Sun Feb 22 00:07:15.062481 2026] [:error] [pid 22558:tid 22568] [client 20.48.26.117:2317] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZnYMyrVaIb2gXsVbDpL7AAAAQg"]
[Sun Feb 22 00:07:15.369338 2026] [:error] [pid 11743:tid 11764] [client 20.48.26.117:2787] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZnYMwALoZZjiTbGvqVdVwAAAVM"]
[Sun Feb 22 00:07:15.906797 2026] [:error] [pid 11743:tid 11751] [client 20.48.26.117:14740] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZnYMwALoZZjiTbGvqVdWAAAAUY"]
[Sun Feb 22 00:07:16.317664 2026] [:error] [pid 53975:tid 53997] [client 20.48.26.117:42556] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZnYNNeFesAKjJ7sq3GsgAAAAlE"]
[Sun Feb 22 00:07:16.683993 2026] [:error] [pid 11743:tid 11747] [client 20.48.26.117:56756] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZnYNAALoZZjiTbGvqVdWQAAAUI"]
[Sun Feb 22 00:07:17.267483 2026] [:error] [pid 53975:tid 53985] [client 20.48.26.117:6331] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZnYNdeFesAKjJ7sq3GsgQAAAkU"]
[Sun Feb 22 00:07:17.710722 2026] [:error] [pid 40758:tid 40845] [client 20.48.26.117:53118] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZnYNUBAHxvBM3i9iKGhPQAAAJc"]
[Sun Feb 22 00:07:18.146950 2026] [:error] [pid 11743:tid 11759] [client 20.48.26.117:22408] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZnYNgALoZZjiTbGvqVdXwAAAU4"]
[Sun Feb 22 00:07:18.591832 2026] [:error] [pid 36509:tid 36526] [client 20.48.26.117:49895] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aZnYNjG8U28d2EFbEqXtXQAAAc8"]
[Sun Feb 22 00:07:18.979491 2026] [:error] [pid 11941:tid 11964] [client 20.48.26.117:2163] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aZnYNnTUkHs3EVWllKkDFwAAAZU"]
[Sun Feb 22 00:07:19.558578 2026] [:error] [pid 11743:tid 11754] [client 20.48.26.117:8360] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aZnYNwALoZZjiTbGvqVdYAAAAUk"]
[Sun Feb 22 00:07:20.321415 2026] [:error] [pid 40758:tid 40822] [client 20.48.26.117:12906] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admiin.php"] [unique_id "aZnYOEBAHxvBM3i9iKGhPwAAAIA"]
[Sun Feb 22 00:07:20.965429 2026] [:error] [pid 53976:tid 54012] [client 20.48.26.117:26927] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aZnYONBEV5I20TLqUt7j-wAAAoU"]
[Sun Feb 22 00:07:21.743013 2026] [:error] [pid 53976:tid 54021] [client 20.48.26.117:24697] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aZnYOdBEV5I20TLqUt7j_AAAAo4"]
[Sun Feb 22 00:07:22.213842 2026] [:error] [pid 11941:tid 11962] [client 20.48.26.117:13745] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aZnYOnTUkHs3EVWllKkDGgAAAZM"]
[Sun Feb 22 00:07:23.161724 2026] [:error] [pid 53975:tid 53988] [client 20.48.26.117:6046] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aZnYO9eFesAKjJ7sq3GshwAAAkg"]
[Sun Feb 22 00:07:23.693345 2026] [:error] [pid 11743:tid 11747] [client 20.48.26.117:2759] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aZnYOwALoZZjiTbGvqVdZAAAAUI"]
[Sun Feb 22 00:07:23.964283 2026] [:error] [pid 22558:tid 22578] [client 20.48.26.117:42553] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aZnYOyrVaIb2gXsVbDpL7gAAARI"]
[Sun Feb 22 00:07:24.301221 2026] [:error] [pid 22558:tid 22564] [client 20.48.26.117:22453] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aZnYPCrVaIb2gXsVbDpL7wAAAQQ"]
[Sun Feb 22 00:07:24.664042 2026] [:error] [pid 11941:tid 11965] [client 20.48.26.117:14773] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "aZnYPHTUkHs3EVWllKkDHgAAAZY"]
[Sun Feb 22 00:07:25.076827 2026] [:error] [pid 11941:tid 11967] [client 20.48.26.117:8363] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYPXTUkHs3EVWllKkDHwAAAZg"]
[Sun Feb 22 00:07:25.599537 2026] [:error] [pid 36509:tid 36530] [client 20.48.26.117:14762] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYPTG8U28d2EFbEqXtZQAAAdM"]
[Sun Feb 22 00:07:26.723037 2026] [:error] [pid 53975:tid 54001] [client 20.48.26.117:57744] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYPteFesAKjJ7sq3GskAAAAlU"]
[Sun Feb 22 00:07:27.199058 2026] [:error] [pid 40756:tid 40781] [client 20.48.26.117:3867] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYPwNlDP60sLYgqXL6pwAAAA8"]
[Sun Feb 22 00:07:27.556026 2026] [:error] [pid 53975:tid 53991] [client 20.48.26.117:2161] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aZnYP9eFesAKjJ7sq3GskgAAAks"]
[Sun Feb 22 00:07:28.573174 2026] [:error] [pid 36509:tid 36512] [client 20.48.26.117:8373] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aZnYQDG8U28d2EFbEqXtbAAAAcE"]
[Sun Feb 22 00:07:29.955187 2026] [:error] [pid 36509:tid 36511] [client 20.48.26.117:2315] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aZnYQTG8U28d2EFbEqXtcQAAAcA"]
[Sun Feb 22 00:07:31.028018 2026] [:error] [pid 40871:tid 40882] [client 20.48.26.117:42550] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aZnYQzqDikjdiOZeJyXB3QAAAMk"]
[Sun Feb 22 00:07:31.405461 2026] [:error] [pid 40757:tid 40796] [client 20.48.26.117:57740] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aZnYQ6g_MKVL7zhH7dxVswAAAEE"]
[Sun Feb 22 00:07:31.832398 2026] [:error] [pid 11941:tid 11962] [client 20.48.26.117:12901] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aZnYQ3TUkHs3EVWllKkDIwAAAZM"]
[Sun Feb 22 00:07:32.209352 2026] [:error] [pid 36509:tid 36524] [client 20.48.26.117:6600] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aZnYRDG8U28d2EFbEqXtewAAAc0"]
[Sun Feb 22 00:07:32.706055 2026] [:error] [pid 36509:tid 36532] [client 20.48.26.117:50589] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aZnYRDG8U28d2EFbEqXtfQAAAdU"]
[Sun Feb 22 00:07:33.132414 2026] [:error] [pid 53975:tid 53981] [client 20.48.26.117:6061] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aZnYRdeFesAKjJ7sq3GslAAAAkE"]
[Sun Feb 22 00:07:33.411629 2026] [:error] [pid 11743:tid 11750] [client 20.48.26.117:57756] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aZnYRQALoZZjiTbGvqVddQAAAUU"]
[Sun Feb 22 00:07:33.805244 2026] [:error] [pid 11743:tid 11767] [client 20.48.26.117:2354] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aZnYRQALoZZjiTbGvqVddgAAAVY"]
[Sun Feb 22 00:07:34.680377 2026] [:error] [pid 36509:tid 36513] [client 20.48.26.117:57754] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aZnYRjG8U28d2EFbEqXtgAAAAcI"]
[Sun Feb 22 00:07:35.115502 2026] [:error] [pid 22558:tid 22571] [client 20.48.26.117:6054] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYRyrVaIb2gXsVbDpL-QAAAQs"]
[Sun Feb 22 00:07:35.945900 2026] [:error] [pid 40757:tid 40803] [client 20.48.26.117:1182] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYR6g_MKVL7zhH7dxVtQAAAEg"]
[Sun Feb 22 00:07:36.572656 2026] [:error] [pid 40757:tid 40812] [client 20.48.26.117:6633] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYSKg_MKVL7zhH7dxVuAAAAFE"]
[Sun Feb 22 00:07:37.511122 2026] [:error] [pid 22558:tid 22577] [client 20.48.26.117:2782] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aZnYSSrVaIb2gXsVbDpMAgAAARE"]
[Sun Feb 22 00:07:38.109372 2026] [:error] [pid 40757:tid 40800] [client 20.48.26.117:6063] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aZnYSqg_MKVL7zhH7dxVugAAAEU"]
[Sun Feb 22 00:07:38.455054 2026] [:error] [pid 40758:tid 40841] [client 20.48.26.117:11960] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aZnYSkBAHxvBM3i9iKGhQQAAAJM"]
[Sun Feb 22 00:07:39.038291 2026] [:error] [pid 40757:tid 40810] [client 20.48.26.117:2141] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aZnYS6g_MKVL7zhH7dxVvAAAAE8"]
[Sun Feb 22 00:07:39.662915 2026] [:error] [pid 11743:tid 11766] [client 20.48.26.117:2771] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aZnYSwALoZZjiTbGvqVdeAAAAVU"]
[Sun Feb 22 00:07:39.938410 2026] [:error] [pid 40758:tid 40832] [client 20.48.26.117:11916] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aZnYS0BAHxvBM3i9iKGhRAAAAIo"]
[Sun Feb 22 00:07:40.212255 2026] [:error] [pid 40757:tid 40801] [client 20.48.26.117:12909] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aZnYTKg_MKVL7zhH7dxVwAAAAEY"]
[Sun Feb 22 00:07:40.665404 2026] [:error] [pid 40757:tid 40796] [client 20.48.26.117:6044] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aZnYTKg_MKVL7zhH7dxVxAAAAEE"]
[Sun Feb 22 00:07:41.098076 2026] [:error] [pid 40757:tid 40803] [client 20.48.26.117:1184] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aZnYTag_MKVL7zhH7dxVxwAAAEg"]
[Sun Feb 22 00:07:41.416725 2026] [:error] [pid 53976:tid 54015] [client 20.48.26.117:6025] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aZnYTdBEV5I20TLqUt7j_QAAAog"]
[Sun Feb 22 00:07:42.134414 2026] [:error] [pid 36509:tid 36517] [client 20.48.26.117:56765] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aZnYTjG8U28d2EFbEqXthQAAAcY"]
[Sun Feb 22 00:07:42.589841 2026] [:error] [pid 11743:tid 11761] [client 20.48.26.117:11952] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aZnYTgALoZZjiTbGvqVdeQAAAVA"]
[Sun Feb 22 00:07:43.134931 2026] [:error] [pid 40757:tid 40816] [client 20.48.26.117:14731] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aZnYT6g_MKVL7zhH7dxVygAAAFU"]
[Sun Feb 22 00:07:43.697663 2026] [:error] [pid 40757:tid 40804] [client 20.48.26.117:8323] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aZnYT6g_MKVL7zhH7dxVzAAAAEk"]
[Sun Feb 22 00:07:44.231762 2026] [:error] [pid 11743:tid 11757] [client 20.48.26.117:12891] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aZnYUAALoZZjiTbGvqVdfAAAAUw"]
[Sun Feb 22 00:07:45.885328 2026] [:error] [pid 11941:tid 11967] [client 20.48.26.117:50628] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aZnYUXTUkHs3EVWllKkDKAAAAZg"]
[Sun Feb 22 00:07:46.230418 2026] [:error] [pid 40756:tid 40781] [client 20.48.26.117:50578] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "aZnYUgNlDP60sLYgqXL6sgAAAA8"]
[Sun Feb 22 00:07:47.066802 2026] [:error] [pid 11941:tid 11961] [client 20.48.26.117:56753] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aZnYU3TUkHs3EVWllKkDKQAAAZI"]
[Sun Feb 22 00:07:48.731953 2026] [:error] [pid 11743:tid 11768] [client 20.48.26.117:14266] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aZnYVAALoZZjiTbGvqVdgwAAAVc"]
[Sun Feb 22 00:07:49.950359 2026] [:error] [pid 11743:tid 11753] [client 20.48.26.117:20734] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aZnYVQALoZZjiTbGvqVdhgAAAUg"]
[Sun Feb 22 00:07:50.453797 2026] [:error] [pid 53975:tid 54002] [client 20.48.26.117:2349] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/karak.php"] [unique_id "aZnYVteFesAKjJ7sq3GsnAAAAlY"]
[Sun Feb 22 00:07:50.848740 2026] [:error] [pid 40871:tid 40874] [client 20.48.26.117:2162] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "aZnYVjqDikjdiOZeJyXB3wAAAME"]
[Sun Feb 22 00:07:51.376267 2026] [:error] [pid 11941:tid 11955] [client 20.48.26.117:6018] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "aZnYV3TUkHs3EVWllKkDKgAAAYw"]
[Sun Feb 22 00:07:52.264368 2026] [:error] [pid 53976:tid 54007] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Sun Feb 22 00:07:52.440481 2026] [:error] [pid 53976:tid 54009] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sun Feb 22 00:07:52.613506 2026] [:error] [pid 53976:tid 54031] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sun Feb 22 00:07:52.758455 2026] [:error] [pid 53976:tid 54028] [client 20.48.26.117:2114] [client 20.48.26.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.48.26.117, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZnYWNBEV5I20TLqUt7kBQAAApU"]
[Sun Feb 22 00:07:52.761743 2026] [:error] [pid 53976:tid 54028] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Feb 22 00:07:52.922865 2026] [:error] [pid 53976:tid 54011] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/aw.php
[Sun Feb 22 00:07:53.041116 2026] [:error] [pid 53976:tid 54019] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Sun Feb 22 00:07:53.168254 2026] [:error] [pid 53976:tid 54020] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Feb 22 00:07:53.288408 2026] [:error] [pid 53976:tid 54030] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Sun Feb 22 00:07:53.625931 2026] [:error] [pid 53976:tid 54022] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun Feb 22 00:07:53.743695 2026] [:error] [pid 53976:tid 54008] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/tcp.php
[Sun Feb 22 00:07:53.863565 2026] [:error] [pid 53976:tid 54012] [client 20.48.26.117:2114] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Feb 22 00:07:53.977464 2026] [:error] [pid 53976:tid 54021] [client 20.48.26.117:2114] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZnYWdBEV5I20TLqUt7kDgAAAo4"]
[Sun Feb 22 00:07:54.777931 2026] [:error] [pid 40758:tid 40826] [client 20.48.26.117:14781] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZnYWkBAHxvBM3i9iKGhSAAAAIQ"]
[Sun Feb 22 00:07:55.096373 2026] [:error] [pid 40756:tid 40770] [client 20.48.26.117:2312] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZnYWwNlDP60sLYgqXL6uQAAAAQ"]
[Sun Feb 22 00:07:55.558243 2026] [:error] [pid 53976:tid 54026] [client 20.48.26.117:30057] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZnYW9BEV5I20TLqUt7kDwAAApM"]
[Sun Feb 22 00:07:56.305639 2026] [:error] [pid 53976:tid 54025] [client 20.48.26.117:27000] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZnYXNBEV5I20TLqUt7kEQAAApI"]
[Sun Feb 22 00:07:56.837639 2026] [:error] [pid 53976:tid 54027] [client 20.48.26.117:12896] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZnYXNBEV5I20TLqUt7kEwAAApQ"]
[Sun Feb 22 00:07:57.281782 2026] [:error] [pid 36509:tid 36512] [client 20.48.26.117:2790] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZnYXTG8U28d2EFbEqXtkgAAAcE"]
[Sun Feb 22 00:07:57.914036 2026] [:error] [pid 22558:tid 22562] [client 20.48.26.117:57758] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZnYXSrVaIb2gXsVbDpMCwAAAQI"]
[Sun Feb 22 00:07:58.408742 2026] [:error] [pid 53976:tid 54016] [client 20.48.26.117:8328] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aZnYXtBEV5I20TLqUt7kGAAAAok"]
[Sun Feb 22 00:07:58.959891 2026] [:error] [pid 53976:tid 54009] [client 20.48.26.117:45042] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aZnYXtBEV5I20TLqUt7kGgAAAoI"]
[Sun Feb 22 00:07:59.529433 2026] [:error] [pid 11941:tid 11965] [client 20.48.26.117:12867] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aZnYX3TUkHs3EVWllKkDNAAAAZY"]
[Sun Feb 22 00:07:59.951875 2026] [:error] [pid 40758:tid 40836] [client 20.48.26.117:50568] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aZnYX0BAHxvBM3i9iKGhTQAAAI4"]
[Sun Feb 22 00:08:00.407507 2026] [:error] [pid 22558:tid 22561] [client 20.48.26.117:1497] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aZnYYCrVaIb2gXsVbDpMEAAAAQE"]
[Sun Feb 22 00:08:00.961847 2026] [:error] [pid 36509:tid 36532] [client 20.48.26.117:50672] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aZnYYDG8U28d2EFbEqXtlQAAAdU"]
[Sun Feb 22 00:08:01.286688 2026] [:error] [pid 11941:tid 11951] [client 20.48.26.117:50670] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aZnYYXTUkHs3EVWllKkDNgAAAYg"]
[Sun Feb 22 00:08:01.698951 2026] [:error] [pid 40758:tid 40823] [client 20.48.26.117:39361] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aZnYYUBAHxvBM3i9iKGhTwAAAIE"]
[Sun Feb 22 00:08:02.046684 2026] [:error] [pid 40871:tid 40875] [client 20.48.26.117:12882] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZnYYjqDikjdiOZeJyXB9QAAAMI"]
[Sun Feb 22 00:08:02.411347 2026] [:error] [pid 11743:tid 11754] [client 20.48.26.117:11912] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZnYYgALoZZjiTbGvqVdiwAAAUk"]
[Sun Feb 22 00:08:03.796942 2026] [:error] [pid 53976:tid 54017] [client 20.48.26.117:50562] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZnYY9BEV5I20TLqUt7kJQAAAoo"]
[Sun Feb 22 00:08:04.811324 2026] [:error] [pid 22558:tid 22566] [client 20.48.26.117:2763] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZnYZCrVaIb2gXsVbDpMEwAAAQY"]
[Sun Feb 22 00:08:05.133513 2026] [:error] [pid 40871:tid 40879] [client 20.48.26.117:3895] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aZnYZTqDikjdiOZeJyXB9wAAAMY"]
[Sun Feb 22 00:08:05.882282 2026] [:error] [pid 36509:tid 36514] [client 20.48.26.117:1179] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aZnYZTG8U28d2EFbEqXtmQAAAcM"]
[Sun Feb 22 00:08:06.609771 2026] [:error] [pid 53976:tid 54015] [client 20.48.26.117:14779] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aZnYZtBEV5I20TLqUt7kLgAAAog"]
[Sun Feb 22 00:08:06.881414 2026] [:error] [pid 53976:tid 54013] [client 20.48.26.117:12876] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aZnYZtBEV5I20TLqUt7kMAAAAoY"]
[Sun Feb 22 00:08:07.564810 2026] [:error] [pid 53976:tid 54020] [client 20.48.26.117:6039] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aZnYZ9BEV5I20TLqUt7kNgAAAo0"]
[Sun Feb 22 00:08:07.927625 2026] [:error] [pid 53976:tid 54031] [client 20.48.26.117:8362] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aZnYZ9BEV5I20TLqUt7kNwAAApg"]
[Sun Feb 22 00:08:08.300124 2026] [:error] [pid 53976:tid 54019] [client 20.48.26.117:57769] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aZnYaNBEV5I20TLqUt7kOAAAAow"]
[Sun Feb 22 00:08:09.011191 2026] [:error] [pid 11743:tid 11769] [client 20.48.26.117:57771] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aZnYaQALoZZjiTbGvqVdkAAAAVg"]
[Sun Feb 22 00:08:09.714429 2026] [:error] [pid 40871:tid 40876] [client 20.48.26.117:50678] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZnYaTqDikjdiOZeJyXB-wAAAMM"]
[Sun Feb 22 00:08:10.404114 2026] [:error] [pid 11743:tid 11767] [client 20.48.26.117:17081] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZnYagALoZZjiTbGvqVdkwAAAVY"]
[Sun Feb 22 00:08:10.945096 2026] [:error] [pid 11743:tid 11755] [client 20.48.26.117:57687] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZnYagALoZZjiTbGvqVdlQAAAUo"]
[Sun Feb 22 00:08:11.507418 2026] [:error] [pid 40756:tid 40787] [client 20.48.26.117:57676] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZnYawNlDP60sLYgqXL6vQAAABU"]
[Sun Feb 22 00:08:11.910100 2026] [:error] [pid 22558:tid 22564] [client 20.48.26.117:57696] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aZnYayrVaIb2gXsVbDpMGwAAAQQ"]
[Sun Feb 22 00:08:12.352133 2026] [:error] [pid 22558:tid 22578] [client 20.48.26.117:2785] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aZnYbCrVaIb2gXsVbDpMHAAAARI"]
[Sun Feb 22 00:08:12.676781 2026] [:error] [pid 53976:tid 54016] [client 20.48.26.117:8324] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aZnYbNBEV5I20TLqUt7kPAAAAok"]
[Sun Feb 22 00:08:13.165206 2026] [:error] [pid 40758:tid 40837] [client 20.48.26.117:19571] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.1.php"] [unique_id "aZnYbUBAHxvBM3i9iKGhWQAAAI8"]
[Sun Feb 22 00:08:13.886712 2026] [:error] [pid 53975:tid 53994] [client 20.48.26.117:8379] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aZnYbdeFesAKjJ7sq3GsoAAAAk4"]
[Sun Feb 22 00:08:15.224649 2026] [:error] [pid 53975:tid 53998] [client 20.48.26.117:8320] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aZnYb9eFesAKjJ7sq3GsowAAAlI"]
[Sun Feb 22 00:08:15.690601 2026] [:error] [pid 11941:tid 11950] [client 20.48.26.117:20688] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aZnYb3TUkHs3EVWllKkDRQAAAYc"]
[Sun Feb 22 00:08:16.031522 2026] [:error] [pid 40756:tid 40772] [client 20.48.26.117:12864] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/async.php"] [unique_id "aZnYcANlDP60sLYgqXL6wAAAAAY"]
[Sun Feb 22 00:08:16.474884 2026] [:error] [pid 40757:tid 40804] [client 20.48.26.117:11955] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZnYcKg_MKVL7zhH7dxV0wAAAEk"]
[Sun Feb 22 00:08:16.726963 2026] [:error] [pid 11941:tid 11956] [client 20.48.26.117:8827] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZnYcHTUkHs3EVWllKkDRwAAAY0"]
[Sun Feb 22 00:08:17.303290 2026] [:error] [pid 40871:tid 40890] [client 20.48.26.117:2790] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZnYcTqDikjdiOZeJyXB_wAAANE"]
[Sun Feb 22 00:08:17.634192 2026] [:error] [pid 40871:tid 40877] [client 20.48.26.117:6374] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff.php"] [unique_id "aZnYcTqDikjdiOZeJyXCAAAAAMQ"]
[Sun Feb 22 00:08:17.983359 2026] [:error] [pid 53976:tid 54023] [client 20.48.26.117:8359] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZnYcdBEV5I20TLqUt7kPwAAApA"]
[Sun Feb 22 00:08:18.309855 2026] [:error] [pid 40756:tid 40785] [client 20.48.26.117:20696] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZnYcgNlDP60sLYgqXL6xQAAABM"]
[Sun Feb 22 00:08:19.332880 2026] [:error] [pid 40757:tid 40817] [client 20.48.26.117:12871] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZnYc6g_MKVL7zhH7dxV1wAAAFY"]
[Sun Feb 22 00:08:19.893023 2026] [:error] [pid 40758:tid 40829] [client 20.48.26.117:2815] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZnYc0BAHxvBM3i9iKGhYQAAAIc"]
[Sun Feb 22 00:08:20.254291 2026] [:error] [pid 40756:tid 40770] [client 20.48.26.117:8998] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZnYdANlDP60sLYgqXL6xgAAAAQ"]
[Sun Feb 22 00:08:20.588807 2026] [:error] [pid 11743:tid 11763] [client 20.48.26.117:42543] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZnYdAALoZZjiTbGvqVdnQAAAVI"]
[Sun Feb 22 00:08:21.090290 2026] [:error] [pid 40871:tid 40897] [client 20.48.26.117:26167] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZnYdTqDikjdiOZeJyXCBAAAANg"]
[Sun Feb 22 00:08:21.487140 2026] [:error] [pid 22558:tid 22565] [client 20.48.26.117:18078] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "aZnYdSrVaIb2gXsVbDpMJAAAAQU"]
[Sun Feb 22 00:08:21.949519 2026] [:error] [pid 40871:tid 40893] [client 20.48.26.117:12915] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aZnYdTqDikjdiOZeJyXCBQAAANQ"]
[Sun Feb 22 00:08:22.697491 2026] [:error] [pid 40758:tid 40822] [client 20.48.26.117:52127] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aZnYdkBAHxvBM3i9iKGhYwAAAIA"]
[Sun Feb 22 00:08:23.592142 2026] [:error] [pid 40756:tid 40779] [client 20.48.26.117:57757] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aZnYdwNlDP60sLYgqXL6ywAAAA0"]
[Sun Feb 22 00:08:24.100886 2026] [:error] [pid 53976:tid 54015] [client 20.48.26.117:20709] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aZnYeNBEV5I20TLqUt7kSgAAAog"]
[Sun Feb 22 00:08:24.528119 2026] [:error] [pid 53976:tid 54007] [client 20.48.26.117:45001] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZnYeNBEV5I20TLqUt7kSwAAAoA"]
[Sun Feb 22 00:08:24.911560 2026] [:error] [pid 36509:tid 36535] [client 20.48.26.117:26141] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZnYeDG8U28d2EFbEqXtnAAAAdg"]
[Sun Feb 22 00:08:26.448884 2026] [:error] [pid 36509:tid 36516] [client 20.48.26.117:1215] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZnYejG8U28d2EFbEqXtnwAAAcU"]
[Sun Feb 22 00:08:27.067405 2026] [:error] [pid 22558:tid 22568] [client 20.48.26.117:26171] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZnYeyrVaIb2gXsVbDpMKwAAAQg"]
[Sun Feb 22 00:08:27.383612 2026] [:error] [pid 40871:tid 40881] [client 20.48.26.117:57766] [client 20.48.26.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aZnYezqDikjdiOZeJyXCCQAAAMg"]
[Sun Feb 22 00:08:27.910184 2026] [:error] [pid 53975:tid 53998] [client 20.48.26.117:57791] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aZnYe9eFesAKjJ7sq3GsrAAAAlI"]
[Sun Feb 22 00:08:28.397994 2026] [:error] [pid 40756:tid 40781] [client 20.48.26.117:12875] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aZnYfANlDP60sLYgqXL6zQAAAA8"]
[Sun Feb 22 00:08:28.999657 2026] [:error] [pid 11743:tid 11757] [client 20.48.26.117:3892] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aZnYfAALoZZjiTbGvqVdowAAAUw"]
[Sun Feb 22 00:08:29.754825 2026] [:error] [pid 40758:tid 40844] [client 20.48.26.117:1188] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aZnYfUBAHxvBM3i9iKGhaQAAAJY"]
[Sun Feb 22 00:08:30.284135 2026] [:error] [pid 53975:tid 53999] [client 20.48.26.117:2813] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cbrfo.php"] [unique_id "aZnYfteFesAKjJ7sq3GsrgAAAlM"]
[Sun Feb 22 00:08:31.266305 2026] [:error] [pid 40756:tid 40777] [client 20.48.26.117:1206] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cbrfo.php"] [unique_id "aZnYfwNlDP60sLYgqXL60gAAAAs"]
[Sun Feb 22 00:08:31.631374 2026] [:error] [pid 53976:tid 54013] [client 20.48.26.117:18054] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cbrfo.php"] [unique_id "aZnYf9BEV5I20TLqUt7kUwAAAoY"]
[Sun Feb 22 00:08:32.119368 2026] [:error] [pid 53976:tid 54010] [client 20.48.26.117:18814] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cbrfo.php"] [unique_id "aZnYgNBEV5I20TLqUt7kVQAAAoM"]
[Sun Feb 22 00:08:32.526875 2026] [:error] [pid 11743:tid 11759] [client 20.48.26.117:45051] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aZnYgAALoZZjiTbGvqVdpQAAAU4"]
[Sun Feb 22 00:08:33.063417 2026] [:error] [pid 40758:tid 40840] [client 20.48.26.117:1516] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aZnYgUBAHxvBM3i9iKGhcAAAAJI"]
[Sun Feb 22 00:08:33.463903 2026] [:error] [pid 40758:tid 40845] [client 20.48.26.117:1533] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aZnYgUBAHxvBM3i9iKGhcQAAAJc"]
[Sun Feb 22 00:08:33.853815 2026] [:error] [pid 22558:tid 22573] [client 20.48.26.117:5354] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inc.php"] [unique_id "aZnYgSrVaIb2gXsVbDpMMAAAAQ0"]
[Sun Feb 22 00:08:34.647977 2026] [:error] [pid 36509:tid 36528] [client 20.48.26.117:32365] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZnYgjG8U28d2EFbEqXtowAAAdE"]
[Sun Feb 22 00:08:35.201741 2026] [:error] [pid 40758:tid 40823] [client 20.48.26.117:12524] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZnYg0BAHxvBM3i9iKGhdwAAAIE"]
[Sun Feb 22 00:08:35.624713 2026] [:error] [pid 36509:tid 36533] [client 20.48.26.117:39374] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZnYgzG8U28d2EFbEqXtpwAAAdY"]
[Sun Feb 22 00:08:36.670924 2026] [:error] [pid 11941:tid 11958] [client 20.48.26.117:6071] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZnYhHTUkHs3EVWllKkDUQAAAY8"]
[Sun Feb 22 00:08:37.118770 2026] [:error] [pid 36509:tid 36535] [client 20.48.26.117:39422] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aZnYhTG8U28d2EFbEqXtqQAAAdg"]
[Sun Feb 22 00:08:37.678415 2026] [:error] [pid 22558:tid 22566] [client 20.48.26.117:12922] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aZnYhSrVaIb2gXsVbDpMMgAAAQY"]
[Sun Feb 22 00:08:38.015873 2026] [:error] [pid 40871:tid 40884] [client 20.48.26.117:8370] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aZnYhjqDikjdiOZeJyXCCwAAAMs"]
[Sun Feb 22 00:08:38.444005 2026] [:error] [pid 53975:tid 53989] [client 20.48.26.117:18055] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aZnYhteFesAKjJ7sq3GssgAAAkk"]
[Sun Feb 22 00:08:39.058712 2026] [:error] [pid 11941:tid 11965] [client 20.48.26.117:1196] [client 20.48.26.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aZnYh3TUkHs3EVWllKkDUgAAAZY"]
[Sun Feb 22 00:08:39.600893 2026] [:error] [pid 22558:tid 22581] [client 20.48.26.117:6051] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZnYhyrVaIb2gXsVbDpMNgAAARU"]
[Sun Feb 22 00:08:40.242142 2026] [:error] [pid 40757:tid 40813] [client 20.48.26.117:8354] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZnYiKg_MKVL7zhH7dxV3QAAAFI"]
[Sun Feb 22 00:08:40.607348 2026] [:error] [pid 11941:tid 11954] [client 20.48.26.117:26112] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZnYiHTUkHs3EVWllKkDVQAAAYs"]
[Sun Feb 22 00:08:40.939017 2026] [:error] [pid 53975:tid 53986] [client 20.48.26.117:8399] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZnYiNeFesAKjJ7sq3GstwAAAkY"]
[Sun Feb 22 00:08:41.553023 2026] [:error] [pid 36509:tid 36511] [client 20.48.26.117:2767] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aZnYiTG8U28d2EFbEqXtqgAAAcA"]
[Sun Feb 22 00:08:42.143769 2026] [:error] [pid 11743:tid 11748] [client 20.48.26.117:26134] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aZnYigALoZZjiTbGvqVdrAAAAUM"]
[Sun Feb 22 00:08:43.028515 2026] [:error] [pid 40757:tid 40817] [client 20.48.26.117:57739] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aZnYi6g_MKVL7zhH7dxV3gAAAFY"]
[Sun Feb 22 00:08:43.858211 2026] [:error] [pid 53975:tid 54003] [client 20.48.26.117:50665] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aZnYi9eFesAKjJ7sq3GsuQAAAlc"]
[Sun Feb 22 00:08:44.365365 2026] [:error] [pid 11941:tid 11967] [client 20.48.26.117:1172] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aZnYjHTUkHs3EVWllKkDWwAAAZg"]
[Sun Feb 22 00:08:44.782632 2026] [:error] [pid 11941:tid 11943] [client 20.48.26.117:8356] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aZnYjHTUkHs3EVWllKkDXQAAAYA"]
[Sun Feb 22 00:08:45.085353 2026] [:error] [pid 22558:tid 22567] [client 20.48.26.117:1502] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aZnYjSrVaIb2gXsVbDpMPQAAAQc"]
[Sun Feb 22 00:08:45.654133 2026] [:error] [pid 11941:tid 11965] [client 20.48.26.117:45033] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aZnYjXTUkHs3EVWllKkDXwAAAZY"]
[Sun Feb 22 00:08:45.927478 2026] [:error] [pid 53975:tid 53992] [client 20.48.26.117:26118] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aZnYjdeFesAKjJ7sq3GsvQAAAkw"]
[Sun Feb 22 00:08:46.204170 2026] [:error] [pid 40758:tid 40831] [client 20.48.26.117:50569] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aZnYjkBAHxvBM3i9iKGhhwAAAIk"]
[Sun Feb 22 00:08:46.525051 2026] [:error] [pid 11941:tid 11960] [client 20.48.26.117:18805] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aZnYjnTUkHs3EVWllKkDYgAAAZE"]
[Sun Feb 22 00:08:46.824049 2026] [:error] [pid 53976:tid 54008] [client 20.48.26.117:6064] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aZnYjtBEV5I20TLqUt7kWQAAAoE"]
[Sun Feb 22 00:08:47.877686 2026] [:error] [pid 40758:tid 40835] [client 20.48.26.117:26132] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aZnYj0BAHxvBM3i9iKGhjQAAAI0"]
[Sun Feb 22 00:08:48.482304 2026] [:error] [pid 53975:tid 53984] [client 20.48.26.117:45048] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aZnYkNeFesAKjJ7sq3GswAAAAkQ"]
[Sun Feb 22 00:08:49.033873 2026] [:error] [pid 53976:tid 54019] [client 20.48.26.117:10553] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aZnYkdBEV5I20TLqUt7kWwAAAow"]
[Sun Feb 22 00:08:49.451998 2026] [:error] [pid 36509:tid 36522] [client 20.48.26.117:1176] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aZnYkTG8U28d2EFbEqXtrQAAAcs"]
[Sun Feb 22 00:08:49.969934 2026] [:error] [pid 11743:tid 11752] [client 20.48.26.117:39405] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aZnYkQALoZZjiTbGvqVdsgAAAUc"]
[Sun Feb 22 00:08:50.599521 2026] [:error] [pid 36509:tid 36534] [client 20.48.26.117:50582] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aZnYkjG8U28d2EFbEqXtsQAAAdc"]
[Sun Feb 22 00:08:51.046421 2026] [:error] [pid 11941:tid 11967] [client 20.48.26.117:2791] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aZnYk3TUkHs3EVWllKkDZQAAAZg"]
[Sun Feb 22 00:08:51.859445 2026] [:error] [pid 11743:tid 11754] [client 20.48.26.117:39412] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aZnYkwALoZZjiTbGvqVdtAAAAUk"]
[Sun Feb 22 00:08:52.716411 2026] [:error] [pid 53975:tid 53993] [client 20.48.26.117:2770] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aZnYlNeFesAKjJ7sq3GswgAAAk0"]
[Sun Feb 22 00:08:53.228769 2026] [:error] [pid 40756:tid 40770] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/x7.php
[Sun Feb 22 00:08:53.366349 2026] [:error] [pid 40756:tid 40769] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/thebe.php
[Sun Feb 22 00:08:54.881615 2026] [:error] [pid 40756:tid 40769] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Sun Feb 22 00:08:55.107428 2026] [:error] [pid 40756:tid 40775] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun Feb 22 00:08:55.247248 2026] [:error] [pid 40756:tid 40784] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Sun Feb 22 00:08:55.379374 2026] [:error] [pid 40756:tid 40779] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Sun Feb 22 00:08:55.508045 2026] [:error] [pid 40756:tid 40766] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Sun Feb 22 00:08:55.667939 2026] [:error] [pid 40756:tid 40772] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Sun Feb 22 00:08:55.784869 2026] [:error] [pid 40756:tid 40780] [client 20.48.26.117:18766] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Feb 22 00:08:56.325072 2026] [:error] [pid 40756:tid 40786] [client 20.48.26.117:18766] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYmANlDP60sLYgqXL66wAAABQ"]
[Sun Feb 22 00:08:57.094601 2026] [:error] [pid 11743:tid 11759] [client 20.48.26.117:17117] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYmQALoZZjiTbGvqVdugAAAU4"]
[Sun Feb 22 00:08:57.529100 2026] [:error] [pid 22558:tid 22564] [client 20.48.26.117:52104] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYmSrVaIb2gXsVbDpMQwAAAQQ"]
[Sun Feb 22 00:08:58.002071 2026] [:error] [pid 11743:tid 11767] [client 20.48.26.117:18781] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYmgALoZZjiTbGvqVdvAAAAVY"]
[Sun Feb 22 00:08:58.466082 2026] [:error] [pid 53975:tid 53996] [client 20.48.26.117:52149] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYmteFesAKjJ7sq3GsyAAAAlA"]
[Sun Feb 22 00:08:59.436110 2026] [:error] [pid 40757:tid 40802] [client 20.48.26.117:1557] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYm6g_MKVL7zhH7dxV5QAAAEc"]
[Sun Feb 22 00:08:59.686472 2026] [:error] [pid 53976:tid 54017] [client 20.48.26.117:45021] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYm9BEV5I20TLqUt7kYgAAAoo"]
[Sun Feb 22 00:09:00.098096 2026] [:error] [pid 22558:tid 22578] [client 20.48.26.117:18076] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aZnYnCrVaIb2gXsVbDpMRgAAARI"]
[Sun Feb 22 00:09:00.457836 2026] [:error] [pid 11941:tid 11961] [client 20.48.26.117:3807] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZnYnHTUkHs3EVWllKkDagAAAZI"]
[Sun Feb 22 00:09:00.839399 2026] [:error] [pid 36509:tid 36521] [client 20.48.26.117:39372] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZnYnDG8U28d2EFbEqXtvAAAAco"]
[Sun Feb 22 00:09:01.690662 2026] [:error] [pid 53975:tid 53990] [client 20.48.26.117:18767] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZnYndeFesAKjJ7sq3GsygAAAko"]
[Sun Feb 22 00:09:02.229217 2026] [:error] [pid 40757:tid 40795] [client 20.48.26.117:6326] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZnYnqg_MKVL7zhH7dxV6AAAAEA"]
[Sun Feb 22 00:09:02.596198 2026] [:error] [pid 40871:tid 40874] [client 20.48.26.117:18757] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZnYnjqDikjdiOZeJyXCHgAAAME"]
[Sun Feb 22 00:09:03.177017 2026] [:error] [pid 36509:tid 36512] [client 20.48.26.117:52146] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZnYnzG8U28d2EFbEqXtvwAAAcE"]
[Sun Feb 22 00:09:03.807276 2026] [:error] [pid 53975:tid 54001] [client 20.48.26.117:52182] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZnYn9eFesAKjJ7sq3GszgAAAlU"]
[Sun Feb 22 00:09:04.329990 2026] [:error] [pid 53975:tid 53985] [client 20.48.26.117:6075] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZnYoNeFesAKjJ7sq3Gs0AAAAkU"]
[Sun Feb 22 00:09:05.948282 2026] [:error] [pid 53976:tid 54024] [client 20.48.26.117:11955] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aZnYodBEV5I20TLqUt7kagAAApE"]
[Sun Feb 22 00:09:06.519287 2026] [:error] [pid 11941:tid 11945] [client 20.48.26.117:26114] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aZnYonTUkHs3EVWllKkDcQAAAYI"]
[Sun Feb 22 00:09:07.759397 2026] [:error] [pid 22558:tid 22583] [client 20.48.26.117:11097] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aZnYoyrVaIb2gXsVbDpMTQAAARc"]
[Sun Feb 22 00:09:08.171227 2026] [:error] [pid 11743:tid 11757] [client 20.48.26.117:1494] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aZnYpAALoZZjiTbGvqVdwQAAAUw"]
[Sun Feb 22 00:09:08.510347 2026] [:error] [pid 11743:tid 11755] [client 20.48.26.117:1479] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZnYpAALoZZjiTbGvqVdwgAAAUo"]
[Sun Feb 22 00:09:08.920852 2026] [:error] [pid 11941:tid 11963] [client 20.48.26.117:15199] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZnYpHTUkHs3EVWllKkDcwAAAZQ"]
[Sun Feb 22 00:09:09.690269 2026] [:error] [pid 40871:tid 40891] [client 20.48.26.117:11920] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZnYpTqDikjdiOZeJyXCIQAAANI"]
[Sun Feb 22 00:09:11.380714 2026] [:error] [pid 11941:tid 11949] [client 20.48.26.117:4085] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZnYp3TUkHs3EVWllKkDdgAAAYY"]
[Sun Feb 22 00:09:12.804095 2026] [:error] [pid 40757:tid 40799] [client 20.48.26.117:42582] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aZnYqKg_MKVL7zhH7dxV6gAAAEQ"]
[Sun Feb 22 00:09:13.162935 2026] [:error] [pid 53976:tid 54031] [client 20.48.26.117:3503] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aZnYqdBEV5I20TLqUt7kcQAAApg"]
[Sun Feb 22 00:09:14.117168 2026] [:error] [pid 36509:tid 36514] [client 20.48.26.117:3494] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aZnYqjG8U28d2EFbEqXtxAAAAcM"]
[Sun Feb 22 00:09:14.852142 2026] [:error] [pid 36509:tid 36533] [client 20.48.26.117:39414] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aZnYqjG8U28d2EFbEqXtxQAAAdY"]
[Sun Feb 22 00:09:15.349452 2026] [:error] [pid 11941:tid 11948] [client 20.48.26.117:3491] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZnYq3TUkHs3EVWllKkDfgAAAYU"]
[Sun Feb 22 00:09:15.730524 2026] [:error] [pid 36509:tid 36519] [client 20.48.26.117:17600] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZnYqzG8U28d2EFbEqXtyAAAAcg"]
[Sun Feb 22 00:09:16.012391 2026] [:error] [pid 53975:tid 53995] [client 20.48.26.117:39305] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZnYrNeFesAKjJ7sq3Gs3gAAAk8"]
[Sun Feb 22 00:09:17.001939 2026] [:error] [pid 53975:tid 53989] [client 20.48.26.117:26175] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZnYrdeFesAKjJ7sq3Gs3wAAAkk"]
[Sun Feb 22 00:09:18.472742 2026] [:error] [pid 40756:tid 40788] [client 20.48.26.117:11926] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZnYrgNlDP60sLYgqXL69gAAABY"]
[Sun Feb 22 00:09:18.846428 2026] [:error] [pid 40757:tid 40798] [client 20.48.26.117:18060] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZnYrqg_MKVL7zhH7dxV8QAAAEM"]
[Sun Feb 22 00:09:19.163703 2026] [:error] [pid 36509:tid 36535] [client 20.48.26.117:18756] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZnYrzG8U28d2EFbEqXtzAAAAdg"]
[Sun Feb 22 00:09:20.104837 2026] [:error] [pid 40871:tid 40875] [client 20.48.26.117:1646] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aZnYsDqDikjdiOZeJyXCKQAAAMI"]
[Sun Feb 22 00:09:21.294358 2026] [:error] [pid 36509:tid 36533] [client 20.48.26.117:3981] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZnYsTG8U28d2EFbEqXt0QAAAdY"]
[Sun Feb 22 00:09:22.284023 2026] [:error] [pid 53976:tid 54020] [client 20.48.26.117:2675] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZnYstBEV5I20TLqUt7kdAAAAo0"]
[Sun Feb 22 00:09:22.774296 2026] [:error] [pid 36509:tid 36517] [client 20.48.26.117:18778] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZnYsjG8U28d2EFbEqXt0gAAAcY"]
[Sun Feb 22 00:09:23.153362 2026] [:error] [pid 40757:tid 40812] [client 20.48.26.117:18058] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZnYs6g_MKVL7zhH7dxV9wAAAFE"]
[Sun Feb 22 00:09:23.511740 2026] [:error] [pid 11743:tid 11761] [client 20.48.26.117:1601] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aZnYswALoZZjiTbGvqVdyQAAAVA"]
[Sun Feb 22 00:09:23.864717 2026] [:error] [pid 11743:tid 11765] [client 20.48.26.117:4020] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aZnYswALoZZjiTbGvqVdygAAAVQ"]
[Sun Feb 22 00:09:24.492863 2026] [:error] [pid 40758:tid 40830] [client 20.48.26.117:52110] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aZnYtEBAHxvBM3i9iKGhpwAAAIg"]
[Sun Feb 22 00:09:24.849742 2026] [:error] [pid 40756:tid 40784] [client 20.48.26.117:39403] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aZnYtANlDP60sLYgqXL6-wAAABI"]
[Sun Feb 22 00:09:25.291304 2026] [:error] [pid 36509:tid 36525] [client 20.48.26.117:2908] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aZnYtTG8U28d2EFbEqXt0wAAAc4"]
[Sun Feb 22 00:09:26.150855 2026] [:error] [pid 22558:tid 22563] [client 20.48.26.117:11085] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aZnYtirVaIb2gXsVbDpMVgAAAQM"]
[Sun Feb 22 00:09:26.538645 2026] [:error] [pid 36509:tid 36521] [client 20.48.26.117:26164] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aZnYtjG8U28d2EFbEqXt1QAAAco"]
[Sun Feb 22 00:09:27.354333 2026] [:error] [pid 40758:tid 40827] [client 20.48.26.117:29385] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "aZnYt0BAHxvBM3i9iKGhqwAAAIU"]
[Sun Feb 22 00:09:27.704234 2026] [:error] [pid 11743:tid 11759] [client 20.48.26.117:29429] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aZnYtwALoZZjiTbGvqVdzgAAAU4"]
[Sun Feb 22 00:09:28.071046 2026] [:error] [pid 40756:tid 40776] [client 20.48.26.117:7261] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aZnYuANlDP60sLYgqXL6_gAAAAo"]
[Sun Feb 22 00:09:28.441950 2026] [:error] [pid 40757:tid 40808] [client 20.48.26.117:26158] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aZnYuKg_MKVL7zhH7dxV-wAAAE0"]
[Sun Feb 22 00:09:28.679508 2026] [:error] [pid 40871:tid 40885] [client 20.48.26.117:39385] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aZnYuDqDikjdiOZeJyXCKwAAAMw"]
[Sun Feb 22 00:09:29.029020 2026] [:error] [pid 53976:tid 54022] [client 20.48.26.117:45017] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aZnYudBEV5I20TLqUt7kegAAAo8"]
[Sun Feb 22 00:09:29.343886 2026] [:error] [pid 11941:tid 11945] [client 20.48.26.117:6962] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aZnYuXTUkHs3EVWllKkDhAAAAYI"]
[Sun Feb 22 00:09:29.965515 2026] [:error] [pid 40756:tid 40778] [client 20.48.26.117:3635] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aZnYuQNlDP60sLYgqXL6_wAAAAw"]
[Sun Feb 22 00:09:30.407202 2026] [:error] [pid 40757:tid 40809] [client 20.48.26.117:14271] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aZnYuqg_MKVL7zhH7dxV_AAAAE4"]
[Sun Feb 22 00:09:30.788697 2026] [:error] [pid 40757:tid 40817] [client 20.48.26.117:19501] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aZnYuqg_MKVL7zhH7dxV_gAAAFY"]
[Sun Feb 22 00:09:31.265157 2026] [:error] [pid 11941:tid 11951] [client 20.48.26.117:52139] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aZnYu3TUkHs3EVWllKkDhwAAAYg"]
[Sun Feb 22 00:09:33.055620 2026] [:error] [pid 22558:tid 22569] [client 20.48.26.117:23766] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aZnYvSrVaIb2gXsVbDpMWwAAAQk"]
[Sun Feb 22 00:09:33.379091 2026] [:error] [pid 40756:tid 40770] [client 20.48.26.117:39329] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aZnYvQNlDP60sLYgqXL7BAAAAAQ"]
[Sun Feb 22 00:09:33.692634 2026] [:error] [pid 36509:tid 36521] [client 20.48.26.117:14244] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aZnYvTG8U28d2EFbEqXt4gAAAco"]
[Sun Feb 22 00:09:34.238916 2026] [:error] [pid 40758:tid 40838] [client 20.48.26.117:18109] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aZnYvkBAHxvBM3i9iKGhtAAAAJA"]
[Sun Feb 22 00:09:35.169682 2026] [:error] [pid 40871:tid 40888] [client 20.48.26.117:39328] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aZnYvzqDikjdiOZeJyXCMQAAAM8"]
[Sun Feb 22 00:09:35.899667 2026] [:error] [pid 53975:tid 53991] [client 20.48.26.117:18795] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aZnYv9eFesAKjJ7sq3Gs7gAAAks"]
[Sun Feb 22 00:09:36.368703 2026] [:error] [pid 11941:tid 11953] [client 20.48.26.117:3600] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aZnYwHTUkHs3EVWllKkDjQAAAYo"]
[Sun Feb 22 00:09:37.660491 2026] [:error] [pid 11743:tid 11757] [client 20.48.26.117:18100] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aZnYwQALoZZjiTbGvqVd2gAAAUw"]
[Sun Feb 22 00:09:39.183000 2026] [:error] [pid 22558:tid 22570] [client 20.48.26.117:3208] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aZnYwyrVaIb2gXsVbDpMXAAAAQo"]
[Sun Feb 22 00:09:39.798188 2026] [:error] [pid 36509:tid 36518] [client 20.48.26.117:8166] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aZnYwzG8U28d2EFbEqXt7QAAAcc"]
[Sun Feb 22 00:09:40.350493 2026] [:error] [pid 11743:tid 11768] [client 20.48.26.117:18087] [client 20.48.26.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aZnYxAALoZZjiTbGvqVd3QAAAVc"]
[Sun Feb 22 00:09:40.905731 2026] [:error] [pid 40756:tid 40778] [client 20.48.26.117:2732] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZnYxANlDP60sLYgqXL7CQAAAAw"]
[Sun Feb 22 00:09:41.678226 2026] [:error] [pid 40871:tid 40880] [client 20.48.26.117:18810] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZnYxTqDikjdiOZeJyXCNAAAAMc"]
[Sun Feb 22 00:09:42.000255 2026] [:error] [pid 11743:tid 11760] [client 20.48.26.117:8178] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZnYxQALoZZjiTbGvqVd3gAAAU8"]
[Sun Feb 22 00:09:42.678152 2026] [:error] [pid 36509:tid 36516] [client 20.48.26.117:2587] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZnYxjG8U28d2EFbEqXt8AAAAcU"]
[Sun Feb 22 00:09:43.119436 2026] [:error] [pid 11941:tid 11951] [client 20.48.26.117:5497] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jane.php"] [unique_id "aZnYx3TUkHs3EVWllKkDkwAAAYg"]
[Sun Feb 22 00:09:44.016587 2026] [:error] [pid 53975:tid 53998] [client 20.48.26.117:2594] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jane.php"] [unique_id "aZnYyNeFesAKjJ7sq3Gs9wAAAlI"]
[Sun Feb 22 00:09:44.303480 2026] [:error] [pid 36509:tid 36529] [client 20.48.26.117:2567] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jane.php"] [unique_id "aZnYyDG8U28d2EFbEqXt8wAAAdI"]
[Sun Feb 22 00:09:44.828954 2026] [:error] [pid 36509:tid 36517] [client 20.48.26.117:3232] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jane.php"] [unique_id "aZnYyDG8U28d2EFbEqXt9QAAAcY"]
[Sun Feb 22 00:09:45.803622 2026] [:error] [pid 36509:tid 36534] [client 20.48.26.117:13823] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZnYyTG8U28d2EFbEqXt_AAAAdc"]
[Sun Feb 22 00:09:46.366098 2026] [:error] [pid 40871:tid 40873] [client 20.48.26.117:5499] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZnYyjqDikjdiOZeJyXCNgAAAMA"]
[Sun Feb 22 00:09:46.771260 2026] [:error] [pid 40756:tid 40769] [client 20.48.26.117:13761] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZnYygNlDP60sLYgqXL7DAAAAAM"]
[Sun Feb 22 00:09:47.427746 2026] [:error] [pid 11941:tid 11952] [client 20.48.26.117:14319] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZnYy3TUkHs3EVWllKkDlQAAAYk"]
[Sun Feb 22 00:09:48.273906 2026] [:error] [pid 53975:tid 53982] [client 20.48.26.117:31858] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZnYzNeFesAKjJ7sq3Gs-gAAAkI"]
[Sun Feb 22 00:09:48.907865 2026] [:error] [pid 40757:tid 40805] [client 20.48.26.117:54931] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZnYzKg_MKVL7zhH7dxWBQAAAEo"]
[Sun Feb 22 00:09:49.187028 2026] [:error] [pid 11941:tid 11965] [client 20.48.26.117:39347] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZnYzXTUkHs3EVWllKkDlgAAAZY"]
[Sun Feb 22 00:09:49.704403 2026] [:error] [pid 11941:tid 11958] [client 20.48.26.117:44164] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZnYzXTUkHs3EVWllKkDlwAAAY8"]
[Sun Feb 22 00:09:50.285751 2026] [:error] [pid 11743:tid 11757] [client 20.48.26.117:8794] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZnYzgALoZZjiTbGvqVd4wAAAUw"]
[Sun Feb 22 00:09:50.715794 2026] [:error] [pid 40756:tid 40789] [client 20.48.26.117:14332] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZnYzgNlDP60sLYgqXL7DwAAABc"]
[Sun Feb 22 00:09:51.042522 2026] [:error] [pid 40756:tid 40779] [client 20.48.26.117:38659] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZnYzwNlDP60sLYgqXL7EQAAAA0"]
[Sun Feb 22 00:09:51.412322 2026] [:error] [pid 40758:tid 40838] [client 20.48.26.117:31809] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZnYz0BAHxvBM3i9iKGhvAAAAJA"]
[Sun Feb 22 00:09:52.209302 2026] [:error] [pid 11941:tid 11955] [client 20.48.26.117:44196] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZnY0HTUkHs3EVWllKkDmwAAAYw"]
[Sun Feb 22 00:09:52.756932 2026] [:error] [pid 53975:tid 53989] [client 20.48.26.117:2566] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZnY0NeFesAKjJ7sq3Gs_QAAAkk"]
[Sun Feb 22 00:09:53.404819 2026] [:error] [pid 40871:tid 40881] [client 20.48.26.117:51298] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZnY0TqDikjdiOZeJyXCPQAAAMg"]
[Sun Feb 22 00:09:54.214610 2026] [:error] [pid 53975:tid 53984] [client 20.48.26.117:38688] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aZnY0teFesAKjJ7sq3GtAgAAAkQ"]
[Sun Feb 22 00:09:54.688764 2026] [:error] [pid 11743:tid 11751] [client 20.48.26.117:27539] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aZnY0gALoZZjiTbGvqVd6AAAAUY"]
[Sun Feb 22 00:09:55.365539 2026] [:error] [pid 53976:tid 54012] [client 20.48.26.117:51309] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aZnY09BEV5I20TLqUt7kjAAAAoU"]
[Sun Feb 22 00:09:55.778032 2026] [:error] [pid 11941:tid 11943] [client 20.48.26.117:12497] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxxx.php"] [unique_id "aZnY03TUkHs3EVWllKkDnwAAAYA"]
[Sun Feb 22 00:09:56.155449 2026] [:error] [pid 36509:tid 36522] [client 20.48.26.117:3531] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sun Feb 22 00:09:56.271289 2026] [:error] [pid 36509:tid 36524] [client 20.48.26.117:3531] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Feb 22 00:09:56.387766 2026] [:error] [pid 36509:tid 36512] [client 20.48.26.117:3531] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Feb 22 00:09:57.071360 2026] [:error] [pid 36509:tid 36518] [client 20.48.26.117:3531] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sun Feb 22 00:09:57.250113 2026] [:error] [pid 36509:tid 36520] [client 20.48.26.117:3531] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs18.php
[Sun Feb 22 00:09:57.917402 2026] [:error] [pid 36509:tid 36518] [client 20.48.26.117:3531] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZnY1TG8U28d2EFbEqXudwAAAcc"]
[Sun Feb 22 00:09:58.892051 2026] [:error] [pid 11743:tid 11761] [client 20.48.26.117:12514] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZnY1gALoZZjiTbGvqVd6wAAAVA"]
[Sun Feb 22 00:09:59.632471 2026] [:error] [pid 11743:tid 11748] [client 20.48.26.117:8826] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZnY1wALoZZjiTbGvqVd7AAAAUM"]
[Sun Feb 22 00:10:00.099234 2026] [:error] [pid 40757:tid 40808] [client 20.48.26.117:39338] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZnY2Kg_MKVL7zhH7dxWEAAAAE0"]
[Sun Feb 22 00:10:00.667176 2026] [:error] [pid 40756:tid 40770] [client 20.48.26.117:54862] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZnY2ANlDP60sLYgqXL7GAAAAAQ"]
[Sun Feb 22 00:10:01.207095 2026] [:error] [pid 11941:tid 11949] [client 20.48.26.117:3563] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZnY2XTUkHs3EVWllKkDogAAAYY"]
[Sun Feb 22 00:10:02.525388 2026] [:error] [pid 53975:tid 53985] [client 20.48.26.117:5276] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZnY2teFesAKjJ7sq3GtCAAAAkU"]
[Sun Feb 22 00:10:02.984881 2026] [:error] [pid 53975:tid 53980] [client 20.48.26.117:14279] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZnY2teFesAKjJ7sq3GtCQAAAkA"]
[Sun Feb 22 00:10:03.541635 2026] [:error] [pid 40757:tid 40797] [client 20.48.26.117:19969] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZnY26g_MKVL7zhH7dxWEgAAAEI"]
[Sun Feb 22 00:10:03.847128 2026] [:error] [pid 40756:tid 40767] [client 20.48.26.117:12461] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZnY2wNlDP60sLYgqXL7GgAAAAE"]
[Sun Feb 22 00:10:04.539918 2026] [:error] [pid 40756:tid 40789] [client 20.48.26.117:3415] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZnY3ANlDP60sLYgqXL7GwAAABc"]
[Sun Feb 22 00:10:05.366279 2026] [:error] [pid 53975:tid 54000] [client 20.48.26.117:14304] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aZnY3deFesAKjJ7sq3GtDQAAAlQ"]
[Sun Feb 22 00:10:05.988934 2026] [:error] [pid 40871:tid 40894] [client 20.48.26.117:3168] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZnY3TqDikjdiOZeJyXCQQAAANU"]
[Sun Feb 22 00:10:07.208280 2026] [:error] [pid 53975:tid 53990] [client 20.48.26.117:54865] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZnY39eFesAKjJ7sq3GtDgAAAko"]
[Sun Feb 22 00:10:08.625647 2026] [:error] [pid 53976:tid 54027] [client 20.48.26.117:12431] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZnY4NBEV5I20TLqUt7klwAAApQ"]
[Sun Feb 22 00:10:09.012213 2026] [:error] [pid 40871:tid 40892] [client 20.48.26.117:1910] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "aZnY4TqDikjdiOZeJyXCQwAAANM"]
[Sun Feb 22 00:10:09.561966 2026] [:error] [pid 36509:tid 36531] [client 20.48.26.117:10347] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZnY4TG8U28d2EFbEqXu2gAAAdQ"]
[Sun Feb 22 00:10:09.833755 2026] [:error] [pid 11941:tid 11947] [client 20.48.26.117:47593] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZnY4XTUkHs3EVWllKkDpwAAAYQ"]
[Sun Feb 22 00:10:10.552465 2026] [:error] [pid 11941:tid 11951] [client 20.48.26.117:31793] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZnY4nTUkHs3EVWllKkDqQAAAYg"]
[Sun Feb 22 00:10:11.192085 2026] [:error] [pid 53976:tid 54021] [client 20.48.26.117:7536] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aZnY49BEV5I20TLqUt7kmwAAAo4"]
[Sun Feb 22 00:10:11.640173 2026] [:error] [pid 40871:tid 40878] [client 20.48.26.117:1701] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aZnY4zqDikjdiOZeJyXCRgAAAMU"]
[Sun Feb 22 00:10:12.176198 2026] [:error] [pid 11743:tid 11758] [client 20.48.26.117:47560] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aZnY5AALoZZjiTbGvqVd8QAAAU0"]
[Sun Feb 22 00:10:12.916408 2026] [:error] [pid 11743:tid 11745] [client 20.48.26.117:51220] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aZnY5AALoZZjiTbGvqVd8gAAAUA"]
[Sun Feb 22 00:10:13.712861 2026] [:error] [pid 36509:tid 36519] [client 20.48.26.117:10538] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aZnY5TG8U28d2EFbEqXu3QAAAcg"]
[Sun Feb 22 00:10:13.996238 2026] [:error] [pid 53975:tid 53985] [client 20.48.26.117:3175] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZnY5deFesAKjJ7sq3GtEwAAAkU"]
[Sun Feb 22 00:10:14.367162 2026] [:error] [pid 40757:tid 40795] [client 20.48.26.117:20020] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZnY5qg_MKVL7zhH7dxWFQAAAEA"]
[Sun Feb 22 00:10:16.287703 2026] [:error] [pid 36509:tid 36526] [client 20.48.26.117:3376] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZnY6DG8U28d2EFbEqXu4AAAAc8"]
[Sun Feb 22 00:10:16.872130 2026] [:error] [pid 36509:tid 36511] [client 20.48.26.117:7502] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aZnY6DG8U28d2EFbEqXu4QAAAcA"]
[Sun Feb 22 00:10:17.560922 2026] [:error] [pid 40871:tid 40885] [client 20.48.26.117:51227] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aZnY6TqDikjdiOZeJyXCSwAAAMw"]
[Sun Feb 22 00:10:18.120505 2026] [:error] [pid 22558:tid 22567] [client 20.48.26.117:32315] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aZnY6irVaIb2gXsVbDpMcAAAAQc"]
[Sun Feb 22 00:10:18.832320 2026] [:error] [pid 36509:tid 36523] [client 20.48.26.117:10346] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aZnY6jG8U28d2EFbEqXu4gAAAcw"]
[Sun Feb 22 00:10:19.449823 2026] [:error] [pid 11743:tid 11754] [client 20.48.26.117:3145] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aZnY6wALoZZjiTbGvqVd_QAAAUk"]
[Sun Feb 22 00:10:19.772875 2026] [:error] [pid 36509:tid 36533] [client 20.48.26.117:22497] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aZnY6zG8U28d2EFbEqXu9QAAAdY"]
[Sun Feb 22 00:10:20.127436 2026] [:error] [pid 11743:tid 11751] [client 20.48.26.117:51204] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aZnY7AALoZZjiTbGvqVeBgAAAUY"]
[Sun Feb 22 00:10:21.054544 2026] [:error] [pid 22558:tid 22568] [client 20.48.26.117:3170] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aZnY7SrVaIb2gXsVbDpMcwAAAQg"]
[Sun Feb 22 00:10:21.615877 2026] [:error] [pid 11743:tid 11768] [client 20.48.26.117:32299] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aZnY7QALoZZjiTbGvqVeCQAAAVc"]
[Sun Feb 22 00:10:22.680622 2026] [:error] [pid 11743:tid 11765] [client 20.48.26.117:36349] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZnY7gALoZZjiTbGvqVeCgAAAVQ"]
[Sun Feb 22 00:10:23.219402 2026] [:error] [pid 22558:tid 22562] [client 20.48.26.117:7546] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZnY7yrVaIb2gXsVbDpMdQAAAQI"]
[Sun Feb 22 00:10:23.575458 2026] [:error] [pid 40757:tid 40798] [client 20.48.26.117:2501] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZnY76g_MKVL7zhH7dxWHgAAAEM"]
[Sun Feb 22 00:10:24.375669 2026] [:error] [pid 11941:tid 11958] [client 20.48.26.117:2472] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZnY8HTUkHs3EVWllKkDtwAAAY8"]
[Sun Feb 22 00:10:24.620211 2026] [:error] [pid 11941:tid 11965] [client 20.48.26.117:9013] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aZnY8HTUkHs3EVWllKkDuQAAAZY"]
[Sun Feb 22 00:10:26.027244 2026] [:error] [pid 36509:tid 36514] [client 20.48.26.117:9023] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aZnY8jG8U28d2EFbEqXvAQAAAcM"]
[Sun Feb 22 00:10:27.744378 2026] [:error] [pid 11941:tid 11947] [client 20.48.26.117:3325] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aZnY83TUkHs3EVWllKkDvAAAAYQ"]
[Sun Feb 22 00:10:29.306565 2026] [:error] [pid 40756:tid 40790] [client 20.48.26.117:53022] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "aZnY9QNlDP60sLYgqXL7MgAAABg"]
[Sun Feb 22 00:10:30.866124 2026] [:error] [pid 11743:tid 11752] [client 20.48.26.117:1923] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZnY9gALoZZjiTbGvqVeDwAAAUc"]
[Sun Feb 22 00:10:31.365205 2026] [:error] [pid 40758:tid 40844] [client 20.48.26.117:8119] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZnY90BAHxvBM3i9iKGh0QAAAJY"]
[Sun Feb 22 00:10:32.214977 2026] [:error] [pid 40756:tid 40784] [client 20.48.26.117:34632] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZnY-ANlDP60sLYgqXL7NAAAABI"]
[Sun Feb 22 00:10:33.410140 2026] [:error] [pid 40758:tid 40838] [client 20.48.26.117:17135] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZnY-UBAHxvBM3i9iKGh0gAAAJA"]
[Sun Feb 22 00:10:34.614749 2026] [:error] [pid 40758:tid 40831] [client 20.48.26.117:30808] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aZnY-kBAHxvBM3i9iKGh1AAAAIk"]
[Sun Feb 22 00:10:37.733826 2026] [:error] [pid 40757:tid 40799] [client 20.48.26.117:29362] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aZnY_ag_MKVL7zhH7dxWKAAAAEQ"]
[Sun Feb 22 00:10:38.166664 2026] [:error] [pid 40757:tid 40802] [client 20.48.26.117:36231] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aZnY_qg_MKVL7zhH7dxWKQAAAEc"]
[Sun Feb 22 00:10:38.750811 2026] [:error] [pid 11941:tid 11967] [client 20.48.26.117:29993] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aZnY_nTUkHs3EVWllKkDxgAAAZg"]
[Sun Feb 22 00:10:39.407746 2026] [:error] [pid 40756:tid 40767] [client 20.48.26.117:25498] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aZnY_wNlDP60sLYgqXL7OQAAAAE"]
[Sun Feb 22 00:10:39.784887 2026] [:error] [pid 40756:tid 40775] [client 20.48.26.117:29368] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aZnY_wNlDP60sLYgqXL7OwAAAAk"]
[Sun Feb 22 00:10:40.479801 2026] [:error] [pid 40756:tid 40786] [client 20.48.26.117:17112] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aZnZAANlDP60sLYgqXL7PQAAABQ"]
[Sun Feb 22 00:10:41.025766 2026] [:error] [pid 53976:tid 54018] [client 20.48.26.117:55523] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aZnZAdBEV5I20TLqUt7ktQAAAos"]
[Sun Feb 22 00:10:41.955680 2026] [:error] [pid 22558:tid 22584] [client 20.48.26.117:2419] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aZnZASrVaIb2gXsVbDpMgAAAARg"]
[Sun Feb 22 00:10:42.449739 2026] [:error] [pid 36509:tid 36532] [client 20.48.26.117:30838] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aZnZAjG8U28d2EFbEqXvDgAAAdU"]
[Sun Feb 22 00:10:42.892879 2026] [:error] [pid 11941:tid 11945] [client 20.48.26.117:5792] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aZnZAnTUkHs3EVWllKkDywAAAYI"]
[Sun Feb 22 00:10:43.909328 2026] [:error] [pid 11941:tid 11957] [client 20.48.26.117:3450] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aZnZA3TUkHs3EVWllKkDzgAAAY4"]
[Sun Feb 22 00:10:44.388368 2026] [:error] [pid 40758:tid 40824] [client 20.48.26.117:6369] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aZnZBEBAHxvBM3i9iKGh2gAAAII"]
[Sun Feb 22 00:10:45.227745 2026] [:error] [pid 40757:tid 40795] [client 20.48.26.117:25482] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aZnZBag_MKVL7zhH7dxWLAAAAEA"]
[Sun Feb 22 00:10:45.672483 2026] [:error] [pid 36509:tid 36527] [client 20.48.26.117:17572] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aZnZBTG8U28d2EFbEqXvEQAAAdA"]
[Sun Feb 22 00:10:46.905512 2026] [:error] [pid 11941:tid 11943] [client 20.48.26.117:55491] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aZnZBnTUkHs3EVWllKkD0gAAAYA"]
[Sun Feb 22 00:10:47.880465 2026] [:error] [pid 11941:tid 11963] [client 20.48.26.117:17596] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aZnZB3TUkHs3EVWllKkD1QAAAZQ"]
[Sun Feb 22 00:10:48.397035 2026] [:error] [pid 11941:tid 11945] [client 20.48.26.117:10293] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aZnZCHTUkHs3EVWllKkD1wAAAYI"]
[Sun Feb 22 00:10:51.755956 2026] [:error] [pid 22558:tid 22580] [client 20.48.26.117:55520] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aZnZCyrVaIb2gXsVbDpMiwAAARQ"]
[Sun Feb 22 00:10:52.637814 2026] [:error] [pid 40871:tid 40892] [client 20.48.26.117:47507] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aZnZDDqDikjdiOZeJyXCWAAAANM"]
[Sun Feb 22 00:10:53.420897 2026] [:error] [pid 53975:tid 53981] [client 20.48.26.117:2425] [client 20.48.26.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aZnZDdeFesAKjJ7sq3GtGgAAAkE"]
[Sun Feb 22 00:10:57.327224 2026] [:error] [pid 36509:tid 36518] [client 20.48.26.117:29952] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Sun Feb 22 00:10:57.444003 2026] [:error] [pid 36509:tid 36530] [client 20.48.26.117:29952] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Sun Feb 22 00:10:57.557734 2026] [:error] [pid 36509:tid 36522] [client 20.48.26.117:29952] [client 20.48.26.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZnZETG8U28d2EFbEqXvKQAAAcs"]
[Sun Feb 22 00:10:59.502427 2026] [:error] [pid 53975:tid 53999] [client 20.48.26.117:3750] File does not exist: /usr/local/apache/htdocs/suspended-page/jsond.php
[Sun Feb 22 03:46:18.860491 2026] [:error] [pid 44487:tid 44489] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/meew.php
[Sun Feb 22 03:46:18.920615 2026] [:error] [pid 44487:tid 44503] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/add.php
[Sun Feb 22 03:46:18.939717 2026] [:error] [pid 44487:tid 44490] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sun Feb 22 03:46:18.967728 2026] [:error] [pid 44487:tid 44496] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sun Feb 22 03:46:18.991177 2026] [:error] [pid 44487:tid 44495] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Sun Feb 22 03:46:19.011946 2026] [:error] [pid 44487:tid 44497] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Sun Feb 22 03:46:19.031037 2026] [:error] [pid 44487:tid 44498] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Feb 22 03:46:19.075162 2026] [:error] [pid 44487:tid 44492] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/71.php
[Sun Feb 22 03:46:19.094256 2026] [:error] [pid 44487:tid 44502] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Feb 22 03:46:19.323981 2026] [:error] [pid 44487:tid 44513] [client 20.191.226.90:10359] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Feb 22 03:46:19.341090 2026] [:error] [pid 44487:tid 44510] [client 20.191.226.90:10359] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "aZoLi0ySTfV_XubT-EPALwAAANU"]
[Sun Feb 22 03:46:20.260346 2026] [:error] [pid 44393:tid 44482] [client 20.191.226.90:28870] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "aZoLjMYob2HwYiB2tDCfmQAAAJc"]
[Sun Feb 22 03:46:20.841806 2026] [:error] [pid 44487:tid 44490] [client 20.191.226.90:12385] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "aZoLjEySTfV_XubT-EPANAAAAME"]
[Sun Feb 22 03:46:21.390083 2026] [:error] [pid 44392:tid 44452] [client 20.191.226.90:15251] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "aZoLjSMeNHF38yLF2roiYgAAAFQ"]
[Sun Feb 22 03:46:22.340745 2026] [:error] [pid 44393:tid 44480] [client 20.191.226.90:22927] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZoLjsYob2HwYiB2tDCfoAAAAJU"]
[Sun Feb 22 03:46:22.943690 2026] [:error] [pid 44391:tid 44420] [client 20.191.226.90:8968] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZoLjvUOoIcSJTCiBzltfgAAABE"]
[Sun Feb 22 03:46:23.584666 2026] [:error] [pid 44391:tid 44423] [client 20.191.226.90:21342] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZoLj_UOoIcSJTCiBzltgAAAABQ"]
[Sun Feb 22 03:46:24.237397 2026] [:error] [pid 44391:tid 44403] [client 20.191.226.90:11363] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZoLkPUOoIcSJTCiBzltggAAAAA"]
[Sun Feb 22 03:46:24.916833 2026] [:error] [pid 44392:tid 44433] [client 20.191.226.90:15267] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aZoLkCMeNHF38yLF2roiZwAAAEE"]
[Sun Feb 22 03:46:25.854514 2026] [:error] [pid 44393:tid 44478] [client 20.191.226.90:7192] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aZoLkcYob2HwYiB2tDCfqQAAAJM"]
[Sun Feb 22 03:46:26.390132 2026] [:error] [pid 44487:tid 44497] [client 20.191.226.90:22955] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aZoLkkySTfV_XubT-EPAPwAAAMg"]
[Sun Feb 22 03:46:27.200183 2026] [:error] [pid 44392:tid 44448] [client 20.191.226.90:7228] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aZoLkyMeNHF38yLF2roiawAAAFA"]
[Sun Feb 22 03:46:28.035831 2026] [:error] [pid 44391:tid 44411] [client 20.191.226.90:15280] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aZoLlPUOoIcSJTCiBzltigAAAAg"]
[Sun Feb 22 03:46:28.911749 2026] [:error] [pid 44391:tid 44408] [client 20.191.226.90:8961] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aZoLlPUOoIcSJTCiBzltjQAAAAU"]
[Sun Feb 22 03:46:30.596544 2026] [:error] [pid 44487:tid 44496] [client 20.191.226.90:31916] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aZoLlkySTfV_XubT-EPATwAAAMc"]
[Sun Feb 22 03:46:31.421462 2026] [:error] [pid 44393:tid 44474] [client 20.191.226.90:19865] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aZoLl8Yob2HwYiB2tDCfrgAAAI8"]
[Sun Feb 22 03:46:32.666454 2026] [:error] [pid 44487:tid 44501] [client 20.191.226.90:14796] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aZoLmEySTfV_XubT-EPAVQAAAMw"]
[Sun Feb 22 03:46:33.245261 2026] [:error] [pid 44393:tid 44481] [client 20.191.226.90:22970] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aZoLmcYob2HwYiB2tDCfswAAAJY"]
[Sun Feb 22 03:46:34.369775 2026] [:error] [pid 44393:tid 44473] [client 20.191.226.90:19175] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aZoLmsYob2HwYiB2tDCftgAAAI4"]
[Sun Feb 22 03:46:34.943491 2026] [:error] [pid 44393:tid 44459] [client 20.191.226.90:17267] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aZoLmsYob2HwYiB2tDCftwAAAIA"]
[Sun Feb 22 03:46:35.456279 2026] [:error] [pid 44393:tid 44467] [client 20.191.226.90:22942] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZoLm8Yob2HwYiB2tDCfuQAAAIg"]
[Sun Feb 22 03:46:36.369299 2026] [:error] [pid 44487:tid 44489] [client 20.191.226.90:14172] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZoLnEySTfV_XubT-EPAYQAAAMA"]
[Sun Feb 22 03:46:37.360794 2026] [:error] [pid 44487:tid 44512] [client 20.191.226.90:17275] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZoLnUySTfV_XubT-EPAZQAAANc"]
[Sun Feb 22 03:46:37.926199 2026] [:error] [pid 44391:tid 44419] [client 20.191.226.90:20111] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aZoLnfUOoIcSJTCiBzltmQAAABA"]
[Sun Feb 22 03:46:38.311997 2026] [:error] [pid 44391:tid 44403] [client 20.191.226.90:18827] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "aZoLnvUOoIcSJTCiBzltmwAAAAA"]
[Sun Feb 22 03:46:38.642611 2026] [:error] [pid 44487:tid 44492] [client 20.191.226.90:14153] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "aZoLnkySTfV_XubT-EPAaAAAAMM"]
[Sun Feb 22 03:46:39.035792 2026] [:error] [pid 44392:tid 44453] [client 20.191.226.90:13618] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "aZoLnyMeNHF38yLF2roiewAAAFU"]
[Sun Feb 22 03:46:39.759019 2026] [:error] [pid 44487:tid 44510] [client 20.191.226.90:19105] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "aZoLn0ySTfV_XubT-EPAbgAAANU"]
[Sun Feb 22 03:46:39.908177 2026] [:error] [pid 44391:tid 44424] [client 20.191.226.90:14146] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-head.php"] [unique_id "aZoLn_UOoIcSJTCiBzltpQAAABU"]
[Sun Feb 22 03:46:40.029403 2026] [:error] [pid 44392:tid 44438] [client 20.191.226.90:16727] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-head.php"] [unique_id "aZoLoCMeNHF38yLF2roifAAAAEY"]
[Sun Feb 22 03:46:40.087101 2026] [:error] [pid 44391:tid 44409] [client 20.191.226.90:14807] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-head.php"] [unique_id "aZoLoPUOoIcSJTCiBzltpgAAAAY"]
[Sun Feb 22 03:46:40.242447 2026] [:error] [pid 44391:tid 44403] [client 20.191.226.90:16765] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/options-head.php"] [unique_id "aZoLoPUOoIcSJTCiBzltqQAAAAA"]
[Sun Feb 22 03:46:40.984847 2026] [:error] [pid 44391:tid 44415] [client 20.191.226.90:16725] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aZoLoPUOoIcSJTCiBzltswAAAAw"]
[Sun Feb 22 03:46:41.104349 2026] [:error] [pid 44391:tid 44423] [client 20.191.226.90:20101] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aZoLofUOoIcSJTCiBzlttQAAABQ"]
[Sun Feb 22 03:46:41.323182 2026] [:error] [pid 44391:tid 44424] [client 20.191.226.90:2087] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aZoLofUOoIcSJTCiBzlttgAAABU"]
[Sun Feb 22 03:46:41.586241 2026] [:error] [pid 44487:tid 44509] [client 20.191.226.90:28866] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aZoLoUySTfV_XubT-EPAcgAAANQ"]
[Sun Feb 22 03:46:41.695451 2026] [:error] [pid 44392:tid 44455] [client 20.191.226.90:25714] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cmdo.php"] [unique_id "aZoLoSMeNHF38yLF2roifwAAAFc"]
[Sun Feb 22 03:46:41.938466 2026] [:error] [pid 44392:tid 44448] [client 20.191.226.90:13602] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cmdo.php"] [unique_id "aZoLoSMeNHF38yLF2roigAAAAFA"]
[Sun Feb 22 03:46:42.154258 2026] [:error] [pid 44393:tid 44472] [client 20.191.226.90:18850] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cmdo.php"] [unique_id "aZoLosYob2HwYiB2tDCfzwAAAI0"]
[Sun Feb 22 03:46:42.478826 2026] [:error] [pid 44393:tid 44478] [client 20.191.226.90:16739] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cmdo.php"] [unique_id "aZoLosYob2HwYiB2tDCf0QAAAJM"]
[Sun Feb 22 03:46:43.057179 2026] [:error] [pid 44391:tid 44419] [client 20.191.226.90:17951] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aZoLo_UOoIcSJTCiBzltuwAAABA"]
[Sun Feb 22 03:46:43.495401 2026] [:error] [pid 44393:tid 44463] [client 20.191.226.90:19587] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aZoLo8Yob2HwYiB2tDCf0gAAAIQ"]
[Sun Feb 22 03:46:44.165950 2026] [:error] [pid 44487:tid 44506] [client 20.191.226.90:9230] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aZoLpEySTfV_XubT-EPAegAAANE"]
[Sun Feb 22 03:46:45.321882 2026] [:error] [pid 44393:tid 44459] [client 20.191.226.90:12898] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aZoLpcYob2HwYiB2tDCf1QAAAIA"]
[Sun Feb 22 03:46:46.118329 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:12870] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Capte.php"] [unique_id "aZoLpkySTfV_XubT-EPAgwAAANI"]
[Sun Feb 22 03:46:46.743239 2026] [:error] [pid 44487:tid 44501] [client 20.191.226.90:28924] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Capte.php"] [unique_id "aZoLpkySTfV_XubT-EPAhwAAAMw"]
[Sun Feb 22 03:46:47.494608 2026] [:error] [pid 44487:tid 44493] [client 20.191.226.90:21833] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Capte.php"] [unique_id "aZoLp0ySTfV_XubT-EPAiAAAAMQ"]
[Sun Feb 22 03:46:49.019564 2026] [:error] [pid 44393:tid 44463] [client 20.191.226.90:21873] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Capte.php"] [unique_id "aZoLqcYob2HwYiB2tDCf2gAAAIQ"]
[Sun Feb 22 03:46:49.601158 2026] [:error] [pid 44392:tid 44452] [client 20.191.226.90:21182] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZoLqSMeNHF38yLF2roiiQAAAFQ"]
[Sun Feb 22 03:46:50.939336 2026] [:error] [pid 44391:tid 44422] [client 20.191.226.90:18927] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZoLqvUOoIcSJTCiBzltyAAAABM"]
[Sun Feb 22 03:46:51.846188 2026] [:error] [pid 44392:tid 44447] [client 20.191.226.90:17069] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZoLqyMeNHF38yLF2roijQAAAE8"]
[Sun Feb 22 03:46:52.320798 2026] [:error] [pid 44487:tid 44512] [client 20.191.226.90:18255] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aZoLrEySTfV_XubT-EPAlgAAANc"]
[Sun Feb 22 03:46:53.057362 2026] [:error] [pid 44393:tid 44459] [client 20.191.226.90:15812] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/503.php"] [unique_id "aZoLrcYob2HwYiB2tDCf3QAAAIA"]
[Sun Feb 22 03:46:53.887938 2026] [:error] [pid 44487:tid 44503] [client 20.191.226.90:16086] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/503.php"] [unique_id "aZoLrUySTfV_XubT-EPAmwAAAM4"]
[Sun Feb 22 03:46:54.484880 2026] [:error] [pid 44391:tid 44410] [client 20.191.226.90:18922] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/503.php"] [unique_id "aZoLrvUOoIcSJTCiBzlt0gAAAAc"]
[Sun Feb 22 03:46:54.713902 2026] [:error] [pid 44392:tid 44445] [client 20.191.226.90:11633] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/503.php"] [unique_id "aZoLriMeNHF38yLF2roikwAAAE0"]
[Sun Feb 22 03:46:55.910180 2026] [:error] [pid 44393:tid 44472] [client 20.191.226.90:17931] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZoLr8Yob2HwYiB2tDCf4QAAAI0"]
[Sun Feb 22 03:46:56.973672 2026] [:error] [pid 44487:tid 44492] [client 20.191.226.90:11587] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZoLsEySTfV_XubT-EPApwAAAMM"]
[Sun Feb 22 03:46:58.920604 2026] [:error] [pid 44391:tid 44406] [client 20.191.226.90:2221] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZoLsvUOoIcSJTCiBzlt2AAAAAM"]
[Sun Feb 22 03:46:59.619391 2026] [:error] [pid 44393:tid 44461] [client 20.191.226.90:30708] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZoLs8Yob2HwYiB2tDCf6gAAAII"]
[Sun Feb 22 03:47:00.824267 2026] [:error] [pid 44392:tid 44444] [client 20.191.226.90:34874] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZoLtCMeNHF38yLF2roingAAAEw"]
[Sun Feb 22 03:47:01.540579 2026] [:error] [pid 44393:tid 44470] [client 20.191.226.90:34854] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZoLtcYob2HwYiB2tDCf8gAAAIs"]
[Sun Feb 22 03:47:02.674838 2026] [:error] [pid 44391:tid 44407] [client 20.191.226.90:10099] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZoLtvUOoIcSJTCiBzlt4AAAAAQ"]
[Sun Feb 22 03:47:03.772430 2026] [:error] [pid 44487:tid 44492] [client 20.191.226.90:11541] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aZoLt0ySTfV_XubT-EPAuwAAAMM"]
[Sun Feb 22 03:47:04.654868 2026] [:error] [pid 44391:tid 44409] [client 20.191.226.90:14485] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZoLuPUOoIcSJTCiBzlt5AAAAAY"]
[Sun Feb 22 03:47:05.103964 2026] [:error] [pid 44393:tid 44465] [client 20.191.226.90:14487] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZoLucYob2HwYiB2tDCf9gAAAIY"]
[Sun Feb 22 03:47:05.794097 2026] [:error] [pid 44391:tid 44413] [client 20.191.226.90:2194] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZoLufUOoIcSJTCiBzlt5gAAAAo"]
[Sun Feb 22 03:47:05.954215 2026] [:error] [pid 44487:tid 44501] [client 20.191.226.90:24163] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZoLuUySTfV_XubT-EPAxAAAAMw"]
[Sun Feb 22 03:47:06.264024 2026] [:error] [pid 44391:tid 44411] [client 20.191.226.90:30701] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aZoLuvUOoIcSJTCiBzlt5wAAAAg"]
[Sun Feb 22 03:47:07.089384 2026] [:error] [pid 44392:tid 44446] [client 20.191.226.90:24146] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aZoLuyMeNHF38yLF2roipgAAAE4"]
[Sun Feb 22 03:47:08.927169 2026] [:error] [pid 44487:tid 44505] [client 20.191.226.90:19421] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aZoLvEySTfV_XubT-EPAywAAANA"]
[Sun Feb 22 03:47:09.722975 2026] [:error] [pid 44487:tid 44499] [client 20.191.226.90:12407] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aZoLvUySTfV_XubT-EPAzwAAAMo"]
[Sun Feb 22 03:47:10.650429 2026] [:error] [pid 44487:tid 44509] [client 20.191.226.90:12398] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZoLvkySTfV_XubT-EPA0gAAANQ"]
[Sun Feb 22 03:47:10.974733 2026] [:error] [pid 44487:tid 44491] [client 20.191.226.90:13673] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZoLvkySTfV_XubT-EPA1AAAAMI"]
[Sun Feb 22 03:47:11.762218 2026] [:error] [pid 44487:tid 44498] [client 20.191.226.90:30684] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZoLv0ySTfV_XubT-EPA2AAAAMk"]
[Sun Feb 22 03:47:12.597757 2026] [:error] [pid 44487:tid 44502] [client 20.191.226.90:8785] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZoLwEySTfV_XubT-EPA2wAAAM0"]
[Sun Feb 22 03:47:12.896642 2026] [:error] [pid 44391:tid 44403] [client 20.191.226.90:30020] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZoLwPUOoIcSJTCiBzlt8gAAAAA"]
[Sun Feb 22 03:47:13.382882 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:20164] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZoLwUySTfV_XubT-EPA4AAAANI"]
[Sun Feb 22 03:47:14.156326 2026] [:error] [pid 44391:tid 44415] [client 20.191.226.90:14530] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZoLwvUOoIcSJTCiBzlt9AAAAAw"]
[Sun Feb 22 03:47:17.478029 2026] [:error] [pid 44393:tid 44479] [client 20.191.226.90:19371] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZoLxcYob2HwYiB2tDCgEgAAAJQ"]
[Sun Feb 22 03:47:17.687958 2026] [:error] [pid 44393:tid 44469] [client 20.191.226.90:10270] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aZoLxcYob2HwYiB2tDCgFAAAAIo"]
[Sun Feb 22 03:47:18.254125 2026] [:error] [pid 44487:tid 44489] [client 20.191.226.90:11064] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aZoLxkySTfV_XubT-EPA5QAAAMA"]
[Sun Feb 22 03:47:18.649875 2026] [:error] [pid 44393:tid 44480] [client 20.191.226.90:8789] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/environment.php"] [unique_id "aZoLxsYob2HwYiB2tDCgFgAAAJU"]
[Sun Feb 22 03:47:19.769102 2026] [:error] [pid 44392:tid 44438] [client 20.191.226.90:11532] File does not exist: /usr/local/apache/htdocs/suspended-page/environment.php
[Sun Feb 22 03:47:19.791616 2026] [:error] [pid 44392:tid 44433] [client 20.191.226.90:11532] File does not exist: /usr/local/apache/htdocs/suspended-page/styles.php
[Sun Feb 22 03:47:19.819234 2026] [:error] [pid 44392:tid 44443] [client 20.191.226.90:11532] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-4doption1.php
[Sun Feb 22 03:47:19.894092 2026] [:error] [pid 44392:tid 44453] [client 20.191.226.90:11532] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Feb 22 03:47:19.931644 2026] [:error] [pid 44392:tid 44437] [client 20.191.226.90:11532] [client 20.191.226.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "aZoLxyMeNHF38yLF2roixQAAAEU"]
[Sun Feb 22 03:47:21.173856 2026] [:error] [pid 44391:tid 44420] [client 20.191.226.90:11540] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Feb 22 03:47:22.237211 2026] [:error] [pid 44391:tid 44421] [client 20.191.226.90:11540] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Sun Feb 22 03:47:22.261107 2026] [:error] [pid 44391:tid 44416] [client 20.191.226.90:11540] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Feb 22 03:47:22.297774 2026] [:error] [pid 44391:tid 44405] [client 20.191.226.90:11540] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Sun Feb 22 03:47:22.759418 2026] [:error] [pid 44391:tid 44409] [client 20.191.226.90:11540] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Feb 22 03:47:22.793661 2026] [:error] [pid 44391:tid 44411] [client 20.191.226.90:11540] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "aZoLyvUOoIcSJTCiBzluDQAAAAg"]
[Sun Feb 22 03:47:26.354361 2026] [:error] [pid 44391:tid 44412] [client 20.191.226.90:19398] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "aZoLzvUOoIcSJTCiBzluFgAAAAk"]
[Sun Feb 22 03:47:27.707610 2026] [:error] [pid 44391:tid 44424] [client 20.191.226.90:12582] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "aZoLz_UOoIcSJTCiBzluGgAAABU"]
[Sun Feb 22 03:47:29.858268 2026] [:error] [pid 44391:tid 44422] [client 20.191.226.90:23309] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "aZoL0fUOoIcSJTCiBzluIAAAABM"]
[Sun Feb 22 03:47:30.404713 2026] [:error] [pid 44487:tid 44497] [client 20.191.226.90:14570] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aZoL0kySTfV_XubT-EPA8wAAAMg"]
[Sun Feb 22 03:47:32.134173 2026] [:error] [pid 44487:tid 44497] [client 20.191.226.90:12603] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aZoL1EySTfV_XubT-EPBBwAAAMg"]
[Sun Feb 22 03:47:34.339161 2026] [:error] [pid 44391:tid 44413] [client 20.191.226.90:9794] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aZoL1vUOoIcSJTCiBzluKwAAAAo"]
[Sun Feb 22 03:47:35.973408 2026] [:error] [pid 44487:tid 44508] [client 20.191.226.90:9063] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/radio.php"] [unique_id "aZoL10ySTfV_XubT-EPBFAAAANM"]
[Sun Feb 22 03:47:36.285075 2026] [:error] [pid 44392:tid 44443] [client 20.191.226.90:34866] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/retu11.PhP7"] [unique_id "aZoL2CMeNHF38yLF2roi3AAAAEs"]
[Sun Feb 22 03:47:36.974456 2026] [:error] [pid 44391:tid 44420] [client 20.191.226.90:30037] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/retu11.PhP7"] [unique_id "aZoL2PUOoIcSJTCiBzluLgAAABE"]
[Sun Feb 22 03:47:37.471034 2026] [:error] [pid 44487:tid 44499] [client 20.191.226.90:14544] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/retu11.PhP7"] [unique_id "aZoL2UySTfV_XubT-EPBGQAAAMo"]
[Sun Feb 22 03:47:38.118509 2026] [:error] [pid 44487:tid 44509] [client 20.191.226.90:2204] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/retu11.PhP7"] [unique_id "aZoL2kySTfV_XubT-EPBHQAAANQ"]
[Sun Feb 22 03:47:38.453872 2026] [:error] [pid 44487:tid 44496] [client 20.191.226.90:8788] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZoL2kySTfV_XubT-EPBHgAAAMc"]
[Sun Feb 22 03:47:39.059364 2026] [:error] [pid 44487:tid 44513] [client 20.191.226.90:2185] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZoL20ySTfV_XubT-EPBIQAAANg"]
[Sun Feb 22 03:47:39.712866 2026] [:error] [pid 44487:tid 44505] [client 20.191.226.90:12362] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZoL20ySTfV_XubT-EPBJAAAANA"]
[Sun Feb 22 03:47:40.297533 2026] [:error] [pid 44487:tid 44493] [client 20.191.226.90:2235] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZoL3EySTfV_XubT-EPBJwAAAMQ"]
[Sun Feb 22 03:47:40.590278 2026] [:error] [pid 44487:tid 44506] [client 20.191.226.90:9074] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZoL3EySTfV_XubT-EPBKAAAANE"]
[Sun Feb 22 03:47:40.629860 2026] [:error] [pid 44487:tid 44499] [client 20.191.226.90:11558] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZoL3EySTfV_XubT-EPBKQAAAMo"]
[Sun Feb 22 03:47:40.666858 2026] [:error] [pid 44391:tid 44412] [client 20.191.226.90:19423] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZoL3PUOoIcSJTCiBzluNwAAAAk"]
[Sun Feb 22 03:47:40.713316 2026] [:error] [pid 44392:tid 44451] [client 20.191.226.90:13642] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZoL3CMeNHF38yLF2roi3gAAAFM"]
[Sun Feb 22 03:47:41.174123 2026] [:error] [pid 44392:tid 44450] [client 20.191.226.90:30695] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aZoL3SMeNHF38yLF2roi3wAAAFI"]
[Sun Feb 22 03:47:41.848064 2026] [:error] [pid 44487:tid 44498] [client 20.191.226.90:16403] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aZoL3UySTfV_XubT-EPBMAAAAMk"]
[Sun Feb 22 03:47:42.956136 2026] [:error] [pid 44487:tid 44502] [client 20.191.226.90:30705] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aZoL3kySTfV_XubT-EPBNAAAAM0"]
[Sun Feb 22 03:47:43.536598 2026] [:error] [pid 44487:tid 44501] [client 20.191.226.90:12399] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mode.php"] [unique_id "aZoL30ySTfV_XubT-EPBOAAAAMw"]
[Sun Feb 22 03:47:44.721483 2026] [:error] [pid 44393:tid 44479] [client 20.191.226.90:13175] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aZoL4MYob2HwYiB2tDCgOgAAAJQ"]
[Sun Feb 22 03:47:45.637751 2026] [:error] [pid 44487:tid 44512] [client 20.191.226.90:11861] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aZoL4UySTfV_XubT-EPBQAAAANc"]
[Sun Feb 22 03:47:47.154855 2026] [:error] [pid 44487:tid 44503] [client 20.191.226.90:30698] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aZoL40ySTfV_XubT-EPBQwAAAM4"]
[Sun Feb 22 03:47:47.453803 2026] [:error] [pid 44487:tid 44505] [client 20.191.226.90:11892] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "aZoL40ySTfV_XubT-EPBRAAAANA"]
[Sun Feb 22 03:47:47.772311 2026] [:error] [pid 44487:tid 44502] [client 20.191.226.90:30696] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aZoL40ySTfV_XubT-EPBRwAAAM0"]
[Sun Feb 22 03:47:49.249293 2026] [:error] [pid 44487:tid 44496] [client 20.191.226.90:11556] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aZoL5UySTfV_XubT-EPBTAAAAMc"]
[Sun Feb 22 03:47:50.660673 2026] [:error] [pid 44487:tid 44495] [client 20.191.226.90:13639] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aZoL5kySTfV_XubT-EPBUgAAAMY"]
[Sun Feb 22 03:47:51.515441 2026] [:error] [pid 44393:tid 44480] [client 20.191.226.90:11573] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "aZoL58Yob2HwYiB2tDCgSQAAAJU"]
[Sun Feb 22 03:47:53.104352 2026] [:error] [pid 44393:tid 44465] [client 20.191.226.90:12361] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZoL6cYob2HwYiB2tDCgTAAAAIY"]
[Sun Feb 22 03:47:53.931734 2026] [:error] [pid 44392:tid 44445] [client 20.191.226.90:13683] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZoL6SMeNHF38yLF2roi6QAAAE0"]
[Sun Feb 22 03:47:54.395710 2026] [:error] [pid 44391:tid 44409] [client 20.191.226.90:39882] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZoL6vUOoIcSJTCiBzluQgAAAAY"]
[Sun Feb 22 03:47:54.549265 2026] [:error] [pid 44392:tid 44435] [client 20.191.226.90:30666] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aZoL6iMeNHF38yLF2roi7gAAAEM"]
[Sun Feb 22 03:47:55.191009 2026] [:error] [pid 44393:tid 44459] [client 20.191.226.90:34864] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yawa.php"] [unique_id "aZoL68Yob2HwYiB2tDCgTQAAAIA"]
[Sun Feb 22 03:47:56.680292 2026] [:error] [pid 44487:tid 44497] [client 20.191.226.90:19409] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yawa.php"] [unique_id "aZoL7EySTfV_XubT-EPBZAAAAMg"]
[Sun Feb 22 03:47:57.477913 2026] [:error] [pid 44391:tid 44425] [client 20.191.226.90:8062] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yawa.php"] [unique_id "aZoL7fUOoIcSJTCiBzluRQAAABY"]
[Sun Feb 22 03:47:58.716713 2026] [:error] [pid 44393:tid 44473] [client 20.191.226.90:16905] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yawa.php"] [unique_id "aZoL7sYob2HwYiB2tDCgUQAAAI4"]
[Sun Feb 22 03:47:59.309742 2026] [:error] [pid 44393:tid 44461] [client 20.191.226.90:8816] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZoL78Yob2HwYiB2tDCgUgAAAII"]
[Sun Feb 22 03:47:59.727120 2026] [:error] [pid 44487:tid 44498] [client 20.191.226.90:8058] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZoL70ySTfV_XubT-EPBbgAAAMk"]
[Sun Feb 22 03:48:00.711888 2026] [:error] [pid 44393:tid 44464] [client 20.191.226.90:8032] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZoL8MYob2HwYiB2tDCgVQAAAIU"]
[Sun Feb 22 03:48:01.408499 2026] [:error] [pid 44392:tid 44438] [client 20.191.226.90:9042] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aZoL8SMeNHF38yLF2roi-AAAAEY"]
[Sun Feb 22 03:48:01.724382 2026] [:error] [pid 44392:tid 44455] [client 20.191.226.90:8002] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZoL8SMeNHF38yLF2roi-QAAAFc"]
[Sun Feb 22 03:48:01.957857 2026] [:error] [pid 44393:tid 44467] [client 20.191.226.90:8011] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZoL8cYob2HwYiB2tDCgVwAAAIg"]
[Sun Feb 22 03:48:01.992071 2026] [:error] [pid 44391:tid 44412] [client 20.191.226.90:39916] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZoL8fUOoIcSJTCiBzluSgAAAAk"]
[Sun Feb 22 03:48:02.193194 2026] [:error] [pid 44391:tid 44413] [client 20.191.226.90:39893] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZoL8vUOoIcSJTCiBzluSwAAAAo"]
[Sun Feb 22 03:48:02.383095 2026] [:error] [pid 44391:tid 44417] [client 20.191.226.90:17528] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZoL8vUOoIcSJTCiBzluTAAAAA4"]
[Sun Feb 22 03:48:02.460228 2026] [:error] [pid 44393:tid 44477] [client 20.191.226.90:11898] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZoL8sYob2HwYiB2tDCgWgAAAJI"]
[Sun Feb 22 03:48:02.561819 2026] [:error] [pid 44391:tid 44415] [client 20.191.226.90:11845] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZoL8vUOoIcSJTCiBzluTwAAAAw"]
[Sun Feb 22 03:48:03.083391 2026] [:error] [pid 44393:tid 44475] [client 20.191.226.90:19396] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aZoL88Yob2HwYiB2tDCgWwAAAJA"]
[Sun Feb 22 03:48:03.940324 2026] [:error] [pid 44393:tid 44478] [client 20.191.226.90:39913] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZoL88Yob2HwYiB2tDCgXQAAAJM"]
[Sun Feb 22 03:48:04.566400 2026] [:error] [pid 44393:tid 44473] [client 20.191.226.90:17487] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZoL9MYob2HwYiB2tDCgXwAAAI4"]
[Sun Feb 22 03:48:05.253076 2026] [:error] [pid 44487:tid 44503] [client 20.191.226.90:11554] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZoL9UySTfV_XubT-EPBfwAAAM4"]
[Sun Feb 22 03:48:06.631758 2026] [:error] [pid 44392:tid 44441] [client 20.191.226.90:25456] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aZoL9iMeNHF38yLF2roi_QAAAEk"]
[Sun Feb 22 03:48:08.774324 2026] [:error] [pid 44392:tid 44433] [client 20.191.226.90:14568] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aZoL-CMeNHF38yLF2rojAgAAAEE"]
[Sun Feb 22 03:48:10.680289 2026] [:error] [pid 44392:tid 44455] [client 20.191.226.90:11562] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aZoL-iMeNHF38yLF2rojBQAAAFc"]
[Sun Feb 22 03:48:13.059325 2026] [:error] [pid 44392:tid 44456] [client 20.191.226.90:13658] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aZoL_SMeNHF38yLF2rojCgAAAFg"]
[Sun Feb 22 03:48:14.410053 2026] [:error] [pid 44393:tid 44466] [client 20.191.226.90:16903] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "aZoL_sYob2HwYiB2tDCgdwAAAIc"]
[Sun Feb 22 03:48:15.475713 2026] [:error] [pid 44392:tid 44451] [client 20.191.226.90:11888] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aZoL_yMeNHF38yLF2rojDQAAAFM"]
[Sun Feb 22 03:48:16.716187 2026] [:error] [pid 44393:tid 44474] [client 20.191.226.90:19449] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aZoMAMYob2HwYiB2tDCggQAAAI8"]
[Sun Feb 22 03:48:17.847788 2026] [:error] [pid 44393:tid 44471] [client 20.191.226.90:8053] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aZoMAcYob2HwYiB2tDCgiAAAAIw"]
[Sun Feb 22 03:48:18.552873 2026] [:error] [pid 44393:tid 44481] [client 20.191.226.90:10860] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aZoMAsYob2HwYiB2tDCgiwAAAJY"]
[Sun Feb 22 03:48:19.009388 2026] [:error] [pid 44392:tid 44441] [client 20.191.226.90:17506] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZoMAyMeNHF38yLF2rojFAAAAEk"]
[Sun Feb 22 03:48:20.222129 2026] [:error] [pid 44487:tid 44490] [client 20.191.226.90:8744] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZoMBEySTfV_XubT-EPBmgAAAME"]
[Sun Feb 22 03:48:21.483890 2026] [:error] [pid 44487:tid 44511] [client 20.191.226.90:13857] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZoMBUySTfV_XubT-EPBoAAAANY"]
[Sun Feb 22 03:48:22.702586 2026] [:error] [pid 44391:tid 44403] [client 20.191.226.90:8710] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Feb 22 03:48:22.732325 2026] [:error] [pid 44391:tid 44425] [client 20.191.226.90:8710] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Sun Feb 22 03:48:22.750887 2026] [:error] [pid 44391:tid 44426] [client 20.191.226.90:8710] File does not exist: /usr/local/apache/htdocs/suspended-page/backup.php
[Sun Feb 22 03:48:22.785117 2026] [:error] [pid 44391:tid 44418] [client 20.191.226.90:8710] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Sun Feb 22 03:48:22.852583 2026] [:error] [pid 44391:tid 44404] [client 20.191.226.90:8710] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Feb 22 03:48:22.870679 2026] [:error] [pid 44391:tid 44416] [client 20.191.226.90:8710] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sun Feb 22 03:48:23.583432 2026] [:error] [pid 44391:tid 44422] [client 20.191.226.90:8710] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Feb 22 03:48:23.601334 2026] [:error] [pid 44391:tid 44412] [client 20.191.226.90:8710] [client 20.191.226.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aZoMB_UOoIcSJTCiBzluawAAAAk"]
[Sun Feb 22 03:48:24.466803 2026] [:error] [pid 44392:tid 44444] [client 20.191.226.90:19430] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sun Feb 22 03:48:24.494149 2026] [:error] [pid 44392:tid 44439] [client 20.191.226.90:19430] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Feb 22 03:48:24.512134 2026] [:error] [pid 44392:tid 44448] [client 20.191.226.90:19430] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sun Feb 22 03:48:24.527393 2026] [:error] [pid 44392:tid 44438] [client 20.191.226.90:19430] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZoMCCMeNHF38yLF2rojJwAAAEY"]
[Sun Feb 22 03:48:25.971459 2026] [:error] [pid 44487:tid 44489] [client 20.191.226.90:16944] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZoMCUySTfV_XubT-EPBogAAAMA"]
[Sun Feb 22 03:48:28.962517 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:8036] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZoMDEySTfV_XubT-EPBqAAAANI"]
[Sun Feb 22 03:48:31.478596 2026] [:error] [pid 44393:tid 44483] [client 20.191.226.90:39901] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZoMD8Yob2HwYiB2tDCgngAAAJg"]
[Sun Feb 22 03:48:35.249477 2026] [:error] [pid 44391:tid 44413] [client 20.191.226.90:8022] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aZoME_UOoIcSJTCiBzlufwAAAAo"]
[Sun Feb 22 03:48:37.179316 2026] [:error] [pid 44392:tid 44443] [client 20.191.226.90:24768] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aZoMFSMeNHF38yLF2rojOgAAAEs"]
[Sun Feb 22 03:48:37.815228 2026] [:error] [pid 44393:tid 44481] [client 20.191.226.90:11789] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aZoMFcYob2HwYiB2tDCgpgAAAJY"]
[Sun Feb 22 03:48:39.580632 2026] [:error] [pid 44391:tid 44421] [client 20.191.226.90:8044] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w3lls.php7"] [unique_id "aZoMF_UOoIcSJTCiBzluhgAAABI"]
[Sun Feb 22 03:48:40.602230 2026] [:error] [pid 44391:tid 44404] [client 20.191.226.90:19397] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZoMGPUOoIcSJTCiBzluhwAAAAE"]
[Sun Feb 22 03:48:41.492250 2026] [:error] [pid 44392:tid 44433] [client 20.191.226.90:39909] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZoMGSMeNHF38yLF2rojPQAAAEE"]
[Sun Feb 22 03:48:41.794331 2026] [:error] [pid 44487:tid 44501] [client 20.191.226.90:11863] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZoMGUySTfV_XubT-EPB7gAAAMw"]
[Sun Feb 22 03:48:42.284043 2026] [:error] [pid 44393:tid 44482] [client 20.191.226.90:13906] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZoMGsYob2HwYiB2tDCgrwAAAJc"]
[Sun Feb 22 03:48:42.580554 2026] [:error] [pid 44487:tid 44500] [client 20.191.226.90:8798] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aZoMGkySTfV_XubT-EPB8QAAAMs"]
[Sun Feb 22 03:48:42.904562 2026] [:error] [pid 44391:tid 44414] [client 20.191.226.90:39899] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aZoMGvUOoIcSJTCiBzluigAAAAs"]
[Sun Feb 22 03:48:43.905814 2026] [:error] [pid 44393:tid 44479] [client 20.191.226.90:10879] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aZoMG8Yob2HwYiB2tDCgsAAAAJQ"]
[Sun Feb 22 03:48:45.027260 2026] [:error] [pid 44487:tid 44511] [client 20.191.226.90:39896] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aZoMHUySTfV_XubT-EPCAgAAANY"]
[Sun Feb 22 03:48:45.286704 2026] [:error] [pid 44487:tid 44504] [client 20.191.226.90:24122] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aZoMHUySTfV_XubT-EPCBAAAAM8"]
[Sun Feb 22 03:48:45.333298 2026] [:error] [pid 44393:tid 44464] [client 20.191.226.90:9332] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aZoMHcYob2HwYiB2tDCgtAAAAIU"]
[Sun Feb 22 03:48:45.502964 2026] [:error] [pid 44487:tid 44496] [client 20.191.226.90:9341] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aZoMHUySTfV_XubT-EPCBgAAAMc"]
[Sun Feb 22 03:48:45.984713 2026] [:error] [pid 44487:tid 44500] [client 20.191.226.90:18397] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bugger.php"] [unique_id "aZoMHUySTfV_XubT-EPCCQAAAMs"]
[Sun Feb 22 03:48:46.742364 2026] [:error] [pid 44487:tid 44510] [client 20.191.226.90:9774] [client 20.191.226.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZoMHkySTfV_XubT-EPCDgAAANU"]
[Sun Feb 22 03:48:48.046059 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:51640] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aZoMIEySTfV_XubT-EPCEgAAANI"]
[Sun Feb 22 03:48:48.569510 2026] [:error] [pid 44391:tid 44415] [client 20.191.226.90:13946] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aZoMIPUOoIcSJTCiBzlukgAAAAw"]
[Sun Feb 22 03:48:48.628382 2026] [:error] [pid 44487:tid 44512] [client 20.191.226.90:47007] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aZoMIEySTfV_XubT-EPCEwAAANc"]
[Sun Feb 22 03:48:49.130218 2026] [:error] [pid 44487:tid 44499] [client 20.191.226.90:47003] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aZoMIUySTfV_XubT-EPCFQAAAMo"]
[Sun Feb 22 03:48:50.331122 2026] [:error] [pid 44391:tid 44426] [client 20.191.226.90:18412] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZoMIvUOoIcSJTCiBzlumAAAABc"]
[Sun Feb 22 03:48:51.017952 2026] [:error] [pid 44393:tid 44480] [client 20.191.226.90:9751] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZoMI8Yob2HwYiB2tDCgvQAAAJU"]
[Sun Feb 22 03:48:53.130521 2026] [:error] [pid 44392:tid 44450] [client 20.191.226.90:8060] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZoMJSMeNHF38yLF2rojWQAAAFI"]
[Sun Feb 22 03:48:54.272772 2026] [:error] [pid 44392:tid 44455] [client 20.191.226.90:39927] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZoMJiMeNHF38yLF2rojYAAAAFc"]
[Sun Feb 22 03:48:56.806142 2026] [:error] [pid 44391:tid 44407] [client 20.191.226.90:55336] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aZoMKPUOoIcSJTCiBzluowAAAAQ"]
[Sun Feb 22 03:48:57.608371 2026] [:error] [pid 44487:tid 44503] [client 20.191.226.90:9732] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aZoMKUySTfV_XubT-EPCMQAAAM4"]
[Sun Feb 22 03:48:58.912784 2026] [:error] [pid 44487:tid 44496] [client 20.191.226.90:24394] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aZoMKkySTfV_XubT-EPCNAAAAMc"]
[Sun Feb 22 03:48:59.677211 2026] [:error] [pid 44393:tid 44466] [client 20.191.226.90:46976] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aZoMK8Yob2HwYiB2tDCgxwAAAIc"]
[Sun Feb 22 03:49:00.137717 2026] [:error] [pid 44393:tid 44477] [client 20.191.226.90:13870] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZoMLMYob2HwYiB2tDCgyAAAAJI"]
[Sun Feb 22 03:49:00.372273 2026] [:error] [pid 44393:tid 44472] [client 20.191.226.90:17982] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZoMLMYob2HwYiB2tDCgywAAAI0"]
[Sun Feb 22 03:49:00.735479 2026] [:error] [pid 44393:tid 44463] [client 20.191.226.90:24120] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZoMLMYob2HwYiB2tDCgzQAAAIQ"]
[Sun Feb 22 03:49:01.013785 2026] [:error] [pid 44393:tid 44480] [client 20.191.226.90:2397] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZoMLcYob2HwYiB2tDCgzgAAAJU"]
[Sun Feb 22 03:49:01.413415 2026] [:error] [pid 44487:tid 44505] [client 20.191.226.90:6971] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZoMLUySTfV_XubT-EPCOgAAANA"]
[Sun Feb 22 03:49:01.718479 2026] [:error] [pid 44391:tid 44411] [client 20.191.226.90:39911] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZoMLfUOoIcSJTCiBzlurQAAAAg"]
[Sun Feb 22 03:49:02.151391 2026] [:error] [pid 44487:tid 44508] [client 20.191.226.90:10845] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZoMLkySTfV_XubT-EPCPAAAANM"]
[Sun Feb 22 03:49:02.734636 2026] [:error] [pid 44391:tid 44423] [client 20.191.226.90:39914] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aZoMLvUOoIcSJTCiBzlurwAAABQ"]
[Sun Feb 22 03:49:02.878336 2026] [:error] [pid 44392:tid 44444] [client 20.191.226.90:15053] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aZoMLiMeNHF38yLF2rojdgAAAEw"]
[Sun Feb 22 03:49:02.916994 2026] [:error] [pid 44391:tid 44419] [client 20.191.226.90:16896] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aZoMLvUOoIcSJTCiBzlusAAAABA"]
[Sun Feb 22 03:49:03.028147 2026] [:error] [pid 44393:tid 44459] [client 20.191.226.90:15080] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aZoML8Yob2HwYiB2tDCg1wAAAIA"]
[Sun Feb 22 03:49:03.308958 2026] [:error] [pid 44393:tid 44464] [client 20.191.226.90:24403] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "aZoML8Yob2HwYiB2tDCg2AAAAIU"]
[Sun Feb 22 03:49:03.822290 2026] [:error] [pid 44391:tid 44421] [client 20.191.226.90:9289] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZoML_UOoIcSJTCiBzlusgAAABI"]
[Sun Feb 22 03:49:04.195796 2026] [:error] [pid 44393:tid 44483] [client 20.191.226.90:6912] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZoMMMYob2HwYiB2tDCg3gAAAJg"]
[Sun Feb 22 03:49:04.491534 2026] [:error] [pid 44393:tid 44471] [client 20.191.226.90:9735] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZoMMMYob2HwYiB2tDCg4AAAAIw"]
[Sun Feb 22 03:49:04.836821 2026] [:error] [pid 44393:tid 44461] [client 20.191.226.90:16031] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZoMMMYob2HwYiB2tDCg4gAAAII"]
[Sun Feb 22 03:49:05.737163 2026] [:error] [pid 44393:tid 44468] [client 20.191.226.90:15084] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZoMMcYob2HwYiB2tDCg4wAAAIk"]
[Sun Feb 22 03:49:06.059336 2026] [:error] [pid 44393:tid 44474] [client 20.191.226.90:16403] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZoMMsYob2HwYiB2tDCg5AAAAI8"]
[Sun Feb 22 03:49:06.392362 2026] [:error] [pid 44487:tid 44506] [client 20.191.226.90:9740] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZoMMkySTfV_XubT-EPCRQAAANE"]
[Sun Feb 22 03:49:06.996565 2026] [:error] [pid 44487:tid 44511] [client 20.191.226.90:6948] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZoMMkySTfV_XubT-EPCSQAAANY"]
[Sun Feb 22 03:49:09.311459 2026] [:error] [pid 44393:tid 44470] [client 20.191.226.90:15798] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZoMNcYob2HwYiB2tDCg6AAAAIs"]
[Sun Feb 22 03:49:10.521542 2026] [:error] [pid 44487:tid 44505] [client 20.191.226.90:21405] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZoMNkySTfV_XubT-EPCVAAAANA"]
[Sun Feb 22 03:49:11.067811 2026] [:error] [pid 44393:tid 44480] [client 20.191.226.90:2881] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZoMN8Yob2HwYiB2tDCg6gAAAJU"]
[Sun Feb 22 03:49:11.496770 2026] [:error] [pid 44392:tid 44451] [client 20.191.226.90:8464] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZoMNyMeNHF38yLF2rojigAAAFM"]
[Sun Feb 22 03:49:11.812871 2026] [:error] [pid 44487:tid 44491] [client 20.191.226.90:2924] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "aZoMN0ySTfV_XubT-EPCWQAAAMI"]
[Sun Feb 22 03:49:12.142221 2026] [:error] [pid 44393:tid 44471] [client 20.191.226.90:12295] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "aZoMOMYob2HwYiB2tDCg7gAAAIw"]
[Sun Feb 22 03:49:12.635236 2026] [:error] [pid 44487:tid 44504] [client 20.191.226.90:23562] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "aZoMOEySTfV_XubT-EPCWwAAAM8"]
[Sun Feb 22 03:49:12.949149 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:8297] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "aZoMOEySTfV_XubT-EPCXQAAANI"]
[Sun Feb 22 03:49:14.038316 2026] [:error] [pid 44487:tid 44509] [client 20.191.226.90:8518] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aZoMOkySTfV_XubT-EPCYQAAANQ"]
[Sun Feb 22 03:49:15.116585 2026] [:error] [pid 44393:tid 44465] [client 20.191.226.90:16662] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aZoMO8Yob2HwYiB2tDCg-AAAAIY"]
[Sun Feb 22 03:49:16.834652 2026] [:error] [pid 44392:tid 44455] [client 20.191.226.90:26738] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aZoMPCMeNHF38yLF2rojiwAAAFc"]
[Sun Feb 22 03:49:17.448166 2026] [:error] [pid 44391:tid 44416] [client 20.191.226.90:2906] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aZoMPfUOoIcSJTCiBzluxgAAAA0"]
[Sun Feb 22 03:49:17.946897 2026] [:error] [pid 44391:tid 44411] [client 20.191.226.90:15013] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aZoMPfUOoIcSJTCiBzluyAAAAAg"]
[Sun Feb 22 03:49:19.145622 2026] [:error] [pid 44487:tid 44494] [client 20.191.226.90:16038] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aZoMP0ySTfV_XubT-EPCawAAAMU"]
[Sun Feb 22 03:49:19.880792 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:8508] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aZoMP0ySTfV_XubT-EPCcQAAANI"]
[Sun Feb 22 03:49:20.749974 2026] [:error] [pid 44487:tid 44513] [client 20.191.226.90:8520] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aZoMQEySTfV_XubT-EPCdAAAANg"]
[Sun Feb 22 03:49:22.901579 2026] [:error] [pid 44393:tid 44470] [client 20.191.226.90:8514] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aZoMQsYob2HwYiB2tDCg_wAAAIs"]
[Sun Feb 22 03:49:24.188694 2026] [:error] [pid 44391:tid 44411] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Feb 22 03:49:24.208066 2026] [:error] [pid 44391:tid 44427] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/tmpls.php
[Sun Feb 22 03:49:24.226985 2026] [:error] [pid 44391:tid 44409] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Sun Feb 22 03:49:24.247927 2026] [:error] [pid 44391:tid 44424] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sun Feb 22 03:49:24.267801 2026] [:error] [pid 44391:tid 44406] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sun Feb 22 03:49:24.317911 2026] [:error] [pid 44391:tid 44412] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Feb 22 03:49:24.968945 2026] [:error] [pid 44391:tid 44415] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Sun Feb 22 03:49:25.012809 2026] [:error] [pid 44391:tid 44413] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sun Feb 22 03:49:25.031418 2026] [:error] [pid 44391:tid 44404] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Sun Feb 22 03:49:25.570143 2026] [:error] [pid 44391:tid 44417] [client 20.191.226.90:15021] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sun Feb 22 03:49:27.287197 2026] [:error] [pid 44391:tid 44417] [client 20.191.226.90:15021] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZoMR_UOoIcSJTCiBzlu4wAAAA4"]
[Sun Feb 22 03:49:29.026294 2026] [:error] [pid 44487:tid 44503] [client 20.191.226.90:8565] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZoMSUySTfV_XubT-EPCfQAAAM4"]
[Sun Feb 22 03:49:30.262808 2026] [:error] [pid 44487:tid 44508] [client 20.191.226.90:2901] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZoMSkySTfV_XubT-EPCgwAAANM"]
[Sun Feb 22 03:49:31.221968 2026] [:error] [pid 44392:tid 44455] [client 20.191.226.90:8289] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZoMSyMeNHF38yLF2rojnwAAAFc"]
[Sun Feb 22 03:49:32.559014 2026] [:error] [pid 44391:tid 44419] [client 20.191.226.90:12349] [client 20.191.226.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZoMTPUOoIcSJTCiBzlu5wAAABA"]
[Sun Feb 22 03:49:33.491334 2026] [:error] [pid 44391:tid 44427] [client 20.191.226.90:2896] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aZoMTfUOoIcSJTCiBzlu6gAAABg"]
[Sun Feb 22 03:49:34.704439 2026] [:error] [pid 44487:tid 44508] [client 20.191.226.90:8485] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aZoMTkySTfV_XubT-EPCjgAAANM"]
[Sun Feb 22 03:49:37.695528 2026] [:error] [pid 44487:tid 44498] [client 20.191.226.90:21386] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aZoMUUySTfV_XubT-EPClQAAAMk"]
[Sun Feb 22 03:49:40.010398 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:16057] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aZoMVEySTfV_XubT-EPCnQAAANI"]
[Sun Feb 22 03:49:42.036332 2026] [:error] [pid 44391:tid 44409] [client 20.191.226.90:16648] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZoMVvUOoIcSJTCiBzlu8wAAAAY"]
[Sun Feb 22 03:49:47.723411 2026] [:error] [pid 44392:tid 44449] [client 20.191.226.90:23538] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZoMWyMeNHF38yLF2rojsgAAAFE"]
[Sun Feb 22 03:49:51.193618 2026] [:error] [pid 44393:tid 44471] [client 20.191.226.90:23590] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZoMX8Yob2HwYiB2tDChJAAAAIw"]
[Sun Feb 22 03:50:02.932331 2026] [:error] [pid 44391:tid 44408] [client 20.191.226.90:23568] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aZoMavUOoIcSJTCiBzlvDwAAAAU"]
[Sun Feb 22 03:50:06.886089 2026] [:error] [pid 44393:tid 44476] [client 20.191.226.90:21390] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aZoMbsYob2HwYiB2tDChNQAAAJE"]
[Sun Feb 22 03:50:07.695766 2026] [:error] [pid 44487:tid 44513] [client 20.191.226.90:46982] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aZoMb0ySTfV_XubT-EPCwwAAANg"]
[Sun Feb 22 03:50:09.132214 2026] [:error] [pid 44487:tid 44496] [client 20.191.226.90:8486] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/siteheads.php"] [unique_id "aZoMcUySTfV_XubT-EPCyQAAAMc"]
[Sun Feb 22 03:50:09.963040 2026] [:error] [pid 44487:tid 44490] [client 20.191.226.90:8283] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZoMcUySTfV_XubT-EPCzAAAAME"]
[Sun Feb 22 03:50:10.775486 2026] [:error] [pid 44391:tid 44413] [client 20.191.226.90:14991] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZoMcvUOoIcSJTCiBzlvIQAAAAo"]
[Sun Feb 22 03:50:11.463466 2026] [:error] [pid 44391:tid 44407] [client 20.191.226.90:15039] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZoMc_UOoIcSJTCiBzlvJAAAAAQ"]
[Sun Feb 22 03:50:11.732267 2026] [:error] [pid 44391:tid 44404] [client 20.191.226.90:16703] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZoMc_UOoIcSJTCiBzlvJQAAAAE"]
[Sun Feb 22 03:50:12.628766 2026] [:error] [pid 44392:tid 44448] [client 20.191.226.90:12060] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZoMdCMeNHF38yLF2rojzAAAAFA"]
[Sun Feb 22 03:50:12.750783 2026] [:error] [pid 44392:tid 44437] [client 20.191.226.90:8516] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZoMdCMeNHF38yLF2rojzQAAAEU"]
[Sun Feb 22 03:50:13.804101 2026] [:error] [pid 44393:tid 44464] [client 20.191.226.90:8547] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZoMdcYob2HwYiB2tDChPgAAAIU"]
[Sun Feb 22 03:50:15.038526 2026] [:error] [pid 44487:tid 44495] [client 20.191.226.90:51640] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZoMd0ySTfV_XubT-EPC1wAAAMY"]
[Sun Feb 22 03:50:15.419564 2026] [:error] [pid 44392:tid 44441] [client 20.191.226.90:23560] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aZoMdyMeNHF38yLF2roj0gAAAEk"]
[Sun Feb 22 03:50:16.364628 2026] [:error] [pid 44393:tid 44469] [client 20.191.226.90:2907] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aZoMeMYob2HwYiB2tDChRQAAAIo"]
[Sun Feb 22 03:50:16.862100 2026] [:error] [pid 44391:tid 44421] [client 20.191.226.90:35181] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aZoMePUOoIcSJTCiBzlvLgAAABI"]
[Sun Feb 22 03:50:17.110540 2026] [:error] [pid 44487:tid 44491] [client 20.191.226.90:8528] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aZoMeUySTfV_XubT-EPC2AAAAMI"]
[Sun Feb 22 03:50:17.455581 2026] [:error] [pid 44393:tid 44468] [client 20.191.226.90:35155] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aZoMecYob2HwYiB2tDChSQAAAIk"]
[Sun Feb 22 03:50:18.131086 2026] [:error] [pid 44392:tid 44439] [client 20.191.226.90:24404] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aZoMeiMeNHF38yLF2roj2QAAAEc"]
[Sun Feb 22 03:50:18.357094 2026] [:error] [pid 44487:tid 44506] [client 20.191.226.90:15034] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aZoMekySTfV_XubT-EPC2gAAANE"]
[Sun Feb 22 03:50:19.079103 2026] [:error] [pid 44391:tid 44424] [client 20.191.226.90:17188] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aZoMe_UOoIcSJTCiBzlvMgAAABU"]
[Sun Feb 22 03:50:20.464324 2026] [:error] [pid 44487:tid 44513] [client 20.191.226.90:23577] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aZoMfEySTfV_XubT-EPC3gAAANg"]
[Sun Feb 22 03:50:21.582003 2026] [:error] [pid 44393:tid 44467] [client 20.191.226.90:26709] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aZoMfcYob2HwYiB2tDChTQAAAIg"]
[Sun Feb 22 03:50:22.288995 2026] [:error] [pid 44393:tid 44464] [client 20.191.226.90:8505] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aZoMfsYob2HwYiB2tDChTwAAAIU"]
[Sun Feb 22 03:50:22.938431 2026] [:error] [pid 44487:tid 44507] [client 20.191.226.90:8282] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aZoMfkySTfV_XubT-EPC5AAAANI"]
[Sun Feb 22 03:50:23.836693 2026] [:error] [pid 44391:tid 44410] [client 20.191.226.90:19671] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZoMf_UOoIcSJTCiBzlvOgAAAAc"]
[Sun Feb 22 03:50:24.555667 2026] [:error] [pid 44392:tid 44436] [client 20.191.226.90:35154] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZoMgCMeNHF38yLF2roj4QAAAEQ"]
[Sun Feb 22 03:50:24.822454 2026] [:error] [pid 44391:tid 44404] [client 20.191.226.90:8497] [client 20.191.226.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZoMgPUOoIcSJTCiBzlvQAAAAAE"]
[Sun Feb 22 03:50:25.526745 2026] [:error] [pid 44487:tid 44502] [client 20.191.226.90:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Feb 22 03:50:25.572123 2026] [:error] [pid 44487:tid 44509] [client 20.191.226.90:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Feb 22 03:50:25.610257 2026] [:error] [pid 44487:tid 44504] [client 20.191.226.90:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Feb 22 03:50:25.645389 2026] [:error] [pid 44487:tid 44494] [client 20.191.226.90:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun Feb 22 08:14:39.844882 2026] [:error] [pid 9587:tid 9612] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sing.php
[Sun Feb 22 08:14:39.970620 2026] [:error] [pid 9587:tid 9599] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sun Feb 22 08:14:40.093625 2026] [:error] [pid 9587:tid 9611] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Feb 22 08:14:40.218378 2026] [:error] [pid 9587:tid 9606] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xml.php
[Sun Feb 22 08:14:40.342787 2026] [:error] [pid 9587:tid 9600] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Feb 22 08:14:40.480575 2026] [:error] [pid 9587:tid 9618] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Feb 22 08:14:40.606137 2026] [:error] [pid 9587:tid 9604] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Feb 22 08:14:40.731231 2026] [:error] [pid 9587:tid 9613] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/wpc.php
[Sun Feb 22 08:14:40.859897 2026] [:error] [pid 9587:tid 9617] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Feb 22 08:14:40.985657 2026] [:error] [pid 9587:tid 9620] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Feb 22 08:14:41.109981 2026] [:error] [pid 9587:tid 9608] [client 20.189.202.58:11972] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Feb 22 08:14:41.259054 2026] [:error] [pid 9587:tid 9609] [client 20.189.202.58:11972] [client 20.189.202.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZpKcehqt7NXCp-NupEnPQAAAA0"]
[Sun Feb 22 08:14:41.771625 2026] [:error] [pid 12501:tid 12510] [client 20.189.202.58:9174] [client 20.189.202.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZpKcZicztrbvinWGXMCRwAAAUc"]
[Sun Feb 22 08:14:42.312054 2026] [:error] [pid 9589:tid 9667] [client 20.189.202.58:9161] [client 20.189.202.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZpKctr-1mylR_FoXQVgDgAAAJA"]
[Sun Feb 22 08:14:42.817666 2026] [:error] [pid 9589:tid 9660] [client 20.189.202.58:12599] [client 20.189.202.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZpKctr-1mylR_FoXQVgEwAAAIk"]
[Sun Feb 22 09:10:12.366977 2026] [:error] [pid 12501:tid 12512] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Feb 22 09:10:12.607293 2026] [:error] [pid 12501:tid 12507] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/ws58.php
[Sun Feb 22 09:10:12.847148 2026] [:error] [pid 12501:tid 12522] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sun Feb 22 09:10:13.087095 2026] [:error] [pid 12501:tid 12517] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sun Feb 22 09:10:13.326151 2026] [:error] [pid 12501:tid 12521] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/ckk.php
[Sun Feb 22 09:10:13.564655 2026] [:error] [pid 12501:tid 12525] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Feb 22 09:10:13.803887 2026] [:error] [pid 12501:tid 12520] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Sun Feb 22 09:10:14.042758 2026] [:error] [pid 12501:tid 12515] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Sun Feb 22 09:10:14.281140 2026] [:error] [pid 12501:tid 12507] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Sun Feb 22 09:10:14.520270 2026] [:error] [pid 12501:tid 12517] [client 20.199.109.98:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Sun Feb 22 09:10:14.757398 2026] [:error] [pid 12501:tid 12511] [client 20.199.109.98:8942] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aZpXdpicztrbvinWGXMZgQAAAUg"]
[Sun Feb 22 09:10:15.228482 2026] [:error] [pid 9589:tid 9660] [client 20.199.109.98:8959] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aZpXd9r-1mylR_FoXQV6fgAAAIk"]
[Sun Feb 22 09:10:15.700578 2026] [:error] [pid 9587:tid 9607] [client 20.199.109.98:9116] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZpXd-hqt7NXCp-NupE7YAAAAAs"]
[Sun Feb 22 09:10:16.169597 2026] [:error] [pid 9588:tid 9634] [client 20.199.109.98:32635] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZpXeGjNBsxseiTcElmxnAAAAEo"]
[Sun Feb 22 09:10:16.640397 2026] [:error] [pid 10537:tid 10539] [client 20.199.109.98:21335] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZpXeLgCiSojLQQBckhRNAAAAQA"]
[Sun Feb 22 09:10:17.110536 2026] [:error] [pid 9587:tid 9610] [client 20.199.109.98:20014] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZpXeehqt7NXCp-NupE7YwAAAA4"]
[Sun Feb 22 09:10:17.583155 2026] [:error] [pid 9695:tid 9712] [client 20.199.109.98:9139] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zu.php"] [unique_id "aZpXeVpPqolBNLmJ4eqbggAAAM8"]
[Sun Feb 22 09:10:18.054639 2026] [:error] [pid 9695:tid 9707] [client 20.199.109.98:14121] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zu.php"] [unique_id "aZpXelpPqolBNLmJ4eqbhAAAAMo"]
[Sun Feb 22 09:10:18.524071 2026] [:error] [pid 9588:tid 9626] [client 20.199.109.98:24826] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zu.php"] [unique_id "aZpXemjNBsxseiTcElmxoAAAAEI"]
[Sun Feb 22 09:10:18.995766 2026] [:error] [pid 9587:tid 9599] [client 20.199.109.98:37248] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zu.php"] [unique_id "aZpXeuhqt7NXCp-NupE7ZgAAAAM"]
[Sun Feb 22 09:10:19.467049 2026] [:error] [pid 9587:tid 9615] [client 20.199.109.98:29857] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kbfr.php"] [unique_id "aZpXe-hqt7NXCp-NupE7aAAAABM"]
[Sun Feb 22 09:10:19.938336 2026] [:error] [pid 10537:tid 10553] [client 20.199.109.98:24257] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kbfr.php"] [unique_id "aZpXe7gCiSojLQQBckhROAAAAQ4"]
[Sun Feb 22 09:10:20.407581 2026] [:error] [pid 9589:tid 9667] [client 20.199.109.98:1321] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kbfr.php"] [unique_id "aZpXfNr-1mylR_FoXQV6rwAAAJA"]
[Sun Feb 22 09:10:20.881746 2026] [:error] [pid 9589:tid 9668] [client 20.199.109.98:56882] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kbfr.php"] [unique_id "aZpXfNr-1mylR_FoXQV6tQAAAJE"]
[Sun Feb 22 09:10:21.352303 2026] [:error] [pid 9589:tid 9652] [client 20.199.109.98:1285] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aZpXfdr-1mylR_FoXQV6ugAAAIE"]
[Sun Feb 22 09:10:21.821307 2026] [:error] [pid 12501:tid 12526] [client 20.199.109.98:24782] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aZpXfZicztrbvinWGXMZoQAAAVc"]
[Sun Feb 22 09:10:22.297993 2026] [:error] [pid 10537:tid 10561] [client 20.199.109.98:14138] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aZpXfrgCiSojLQQBckhROQAAARY"]
[Sun Feb 22 09:10:22.770394 2026] [:error] [pid 9587:tid 9604] [client 20.199.109.98:37280] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aZpXfuhqt7NXCp-NupE7cQAAAAg"]
[Sun Feb 22 09:10:23.250031 2026] [:error] [pid 12501:tid 12518] [client 20.199.109.98:24828] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/click.php"] [unique_id "aZpXf5icztrbvinWGXMZpwAAAU8"]
[Sun Feb 22 09:10:23.721719 2026] [:error] [pid 9587:tid 9606] [client 20.199.109.98:56833] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/click.php"] [unique_id "aZpXf-hqt7NXCp-NupE7cwAAAAo"]
[Sun Feb 22 09:10:24.251369 2026] [:error] [pid 10537:tid 10552] [client 20.199.109.98:22714] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f2.php"] [unique_id "aZpXgLgCiSojLQQBckhRQQAAAQ0"]
[Sun Feb 22 09:10:24.724857 2026] [:error] [pid 9587:tid 9615] [client 20.199.109.98:24777] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inege.php"] [unique_id "aZpXgOhqt7NXCp-NupE7dgAAABM"]
[Sun Feb 22 09:10:25.195154 2026] [:error] [pid 9587:tid 9611] [client 20.199.109.98:30307] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inege.php"] [unique_id "aZpXgehqt7NXCp-NupE7dwAAAA8"]
[Sun Feb 22 09:10:25.663912 2026] [:error] [pid 10537:tid 10549] [client 20.199.109.98:56868] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inege.php"] [unique_id "aZpXgbgCiSojLQQBckhRSAAAAQo"]
[Sun Feb 22 09:10:26.135508 2026] [:error] [pid 10537:tid 10546] [client 20.199.109.98:32787] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aZpXgrgCiSojLQQBckhRSQAAAQc"]
[Sun Feb 22 09:10:26.606139 2026] [:error] [pid 9588:tid 9648] [client 20.199.109.98:23781] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aZpXgmjNBsxseiTcElmxtQAAAFg"]
[Sun Feb 22 09:10:27.078495 2026] [:error] [pid 9588:tid 9634] [client 20.199.109.98:23291] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/selesai.php"] [unique_id "aZpXg2jNBsxseiTcElmxtwAAAEo"]
[Sun Feb 22 09:10:27.550012 2026] [:error] [pid 12501:tid 12504] [client 20.199.109.98:24278] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/selesai.php"] [unique_id "aZpXg5icztrbvinWGXMZsQAAAUE"]
[Sun Feb 22 09:10:28.021141 2026] [:error] [pid 9589:tid 9656] [client 20.199.109.98:28903] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/selesai.php"] [unique_id "aZpXhNr-1mylR_FoXQV61wAAAIU"]
[Sun Feb 22 09:10:28.492165 2026] [:error] [pid 10537:tid 10541] [client 20.199.109.98:22940] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/selesai.php"] [unique_id "aZpXhLgCiSojLQQBckhRUwAAAQI"]
[Sun Feb 22 09:10:28.961455 2026] [:error] [pid 9588:tid 9628] [client 20.199.109.98:22644] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZpXhGjNBsxseiTcElmxuAAAAEQ"]
[Sun Feb 22 09:10:29.431522 2026] [:error] [pid 9587:tid 9620] [client 20.199.109.98:32603] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZpXhehqt7NXCp-NupE7fAAAABg"]
[Sun Feb 22 09:10:29.901759 2026] [:error] [pid 9587:tid 9611] [client 20.199.109.98:1278] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZpXhehqt7NXCp-NupE7fgAAAA8"]
[Sun Feb 22 09:10:30.372914 2026] [:error] [pid 9587:tid 9601] [client 20.199.109.98:29332] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZpXhuhqt7NXCp-NupE7ggAAAAU"]
[Sun Feb 22 09:10:30.844416 2026] [:error] [pid 10537:tid 10549] [client 20.199.109.98:26474] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZpXhrgCiSojLQQBckhRVAAAAQo"]
[Sun Feb 22 09:10:31.330212 2026] [:error] [pid 9588:tid 9641] [client 20.199.109.98:35873] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ak.php"] [unique_id "aZpXh2jNBsxseiTcElmxvgAAAFE"]
[Sun Feb 22 09:10:31.811631 2026] [:error] [pid 9695:tid 9703] [client 20.199.109.98:29317] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZpXh1pPqolBNLmJ4eqbpAAAAMY"]
[Sun Feb 22 09:10:32.281152 2026] [:error] [pid 12501:tid 12510] [client 20.199.109.98:22628] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZpXiJicztrbvinWGXMZuQAAAUc"]
[Sun Feb 22 09:10:32.751663 2026] [:error] [pid 9587:tid 9596] [client 20.199.109.98:22715] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZpXiOhqt7NXCp-NupE7iQAAAAA"]
[Sun Feb 22 09:10:33.222872 2026] [:error] [pid 9587:tid 9597] [client 20.199.109.98:26495] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZpXiehqt7NXCp-NupE7iwAAAAE"]
[Sun Feb 22 09:10:33.703716 2026] [:error] [pid 12501:tid 12515] [client 20.199.109.98:26054] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/35.php"] [unique_id "aZpXiZicztrbvinWGXMZvAAAAUw"]
[Sun Feb 22 09:10:34.173499 2026] [:error] [pid 9695:tid 9710] [client 20.199.109.98:14371] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/35.php"] [unique_id "aZpXilpPqolBNLmJ4eqbsAAAAM0"]
[Sun Feb 22 09:10:34.643362 2026] [:error] [pid 9589:tid 9656] [client 20.199.109.98:15173] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/35.php"] [unique_id "aZpXitr-1mylR_FoXQV65wAAAIU"]
[Sun Feb 22 09:10:35.114404 2026] [:error] [pid 9587:tid 9608] [client 20.199.109.98:23505] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/35.php"] [unique_id "aZpXi-hqt7NXCp-NupE7kAAAAAw"]
[Sun Feb 22 09:10:35.584419 2026] [:error] [pid 10537:tid 10561] [client 20.199.109.98:26712] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZpXi7gCiSojLQQBckhRXQAAARY"]
[Sun Feb 22 09:10:36.054930 2026] [:error] [pid 12501:tid 12506] [client 20.199.109.98:16693] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZpXjJicztrbvinWGXMZwAAAAUM"]
[Sun Feb 22 09:10:36.527654 2026] [:error] [pid 9588:tid 9648] [client 20.199.109.98:26075] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZpXjGjNBsxseiTcElmxyQAAAFg"]
[Sun Feb 22 09:10:37.005660 2026] [:error] [pid 9588:tid 9635] [client 20.199.109.98:19483] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZpXjWjNBsxseiTcElmxzgAAAEs"]
[Sun Feb 22 09:10:37.476708 2026] [:error] [pid 9587:tid 9602] [client 20.199.109.98:26092] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/knmt.php"] [unique_id "aZpXjehqt7NXCp-NupE7mAAAAAY"]
[Sun Feb 22 09:10:37.976359 2026] [:error] [pid 12501:tid 12513] [client 20.199.109.98:16684] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cc13.php"] [unique_id "aZpXjZicztrbvinWGXMZwwAAAUo"]
[Sun Feb 22 09:10:38.445616 2026] [:error] [pid 9695:tid 9718] [client 20.199.109.98:19497] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cc13.php"] [unique_id "aZpXjlpPqolBNLmJ4eqbtAAAANU"]
[Sun Feb 22 09:10:38.922246 2026] [:error] [pid 9587:tid 9604] [client 20.199.109.98:26158] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cc13.php"] [unique_id "aZpXjuhqt7NXCp-NupE7mQAAAAg"]
[Sun Feb 22 09:10:39.408119 2026] [:error] [pid 9589:tid 9664] [client 20.199.109.98:18266] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xxw.php"] [unique_id "aZpXj9r-1mylR_FoXQV6-wAAAI0"]
[Sun Feb 22 09:10:39.893372 2026] [:error] [pid 10537:tid 10558] [client 20.199.109.98:26067] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZpXj7gCiSojLQQBckhRZQAAARM"]
[Sun Feb 22 09:10:40.363797 2026] [:error] [pid 12501:tid 12508] [client 20.199.109.98:26114] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZpXkJicztrbvinWGXMZyQAAAUU"]
[Sun Feb 22 09:10:40.839150 2026] [:error] [pid 12501:tid 12515] [client 20.199.109.98:26693] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZpXkJicztrbvinWGXMZzQAAAUw"]
[Sun Feb 22 09:10:41.311530 2026] [:error] [pid 9588:tid 9633] [client 20.199.109.98:11483] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZpXkWjNBsxseiTcElmx3AAAAEk"]
[Sun Feb 22 09:10:41.782049 2026] [:error] [pid 9587:tid 9613] [client 20.199.109.98:26051] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zxekqlxb.php"] [unique_id "aZpXkehqt7NXCp-NupE7oAAAABE"]
[Sun Feb 22 09:10:42.262302 2026] [:error] [pid 9589:tid 9675] [client 20.199.109.98:38461] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zxekqlxb.php"] [unique_id "aZpXktr-1mylR_FoXQV7AwAAAJg"]
[Sun Feb 22 09:10:42.751059 2026] [:error] [pid 12501:tid 12515] [client 20.199.109.98:8613] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZpXkpicztrbvinWGXMZ2wAAAUw"]
[Sun Feb 22 09:10:43.221965 2026] [:error] [pid 9589:tid 9663] [client 20.199.109.98:26135] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZpXk9r-1mylR_FoXQV7CgAAAIw"]
[Sun Feb 22 09:10:43.692253 2026] [:error] [pid 9587:tid 9618] [client 20.199.109.98:26739] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZpXk-hqt7NXCp-NupE7pQAAABY"]
[Sun Feb 22 09:10:44.163317 2026] [:error] [pid 12501:tid 12525] [client 20.199.109.98:26141] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZpXlJicztrbvinWGXMZ4wAAAVY"]
[Sun Feb 22 09:10:44.633523 2026] [:error] [pid 10537:tid 10550] [client 20.199.109.98:26147] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/amp.php"] [unique_id "aZpXlLgCiSojLQQBckhRawAAAQs"]
[Sun Feb 22 09:10:45.103178 2026] [:error] [pid 12501:tid 12507] [client 20.199.109.98:38433] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/amp.php"] [unique_id "aZpXlZicztrbvinWGXMZ7wAAAUQ"]
[Sun Feb 22 09:10:45.574407 2026] [:error] [pid 9589:tid 9662] [client 20.199.109.98:16957] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZpXldr-1mylR_FoXQV7EQAAAIs"]
[Sun Feb 22 09:10:46.044491 2026] [:error] [pid 9587:tid 9614] [client 20.199.109.98:26170] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZpXluhqt7NXCp-NupE7qQAAABI"]
[Sun Feb 22 09:10:46.514362 2026] [:error] [pid 10537:tid 10560] [client 20.199.109.98:15916] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZpXlrgCiSojLQQBckhRcAAAARU"]
[Sun Feb 22 09:10:46.986622 2026] [:error] [pid 12501:tid 12508] [client 20.199.109.98:26160] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZpXlpicztrbvinWGXMZ-AAAAUU"]
[Sun Feb 22 09:10:47.457349 2026] [:error] [pid 9588:tid 9646] [client 20.199.109.98:33116] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZpXl2jNBsxseiTcElmx5wAAAFY"]
[Sun Feb 22 09:10:47.930628 2026] [:error] [pid 9695:tid 9703] [client 20.199.109.98:33118] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZpXl1pPqolBNLmJ4eqbxgAAAMY"]
[Sun Feb 22 09:10:48.402008 2026] [:error] [pid 9588:tid 9639] [client 20.199.109.98:38827] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZpXmGjNBsxseiTcElmx6AAAAE8"]
[Sun Feb 22 09:10:48.879828 2026] [:error] [pid 9695:tid 9720] [client 20.199.109.98:14892] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZpXmFpPqolBNLmJ4eqbywAAANc"]
[Sun Feb 22 09:10:49.357459 2026] [:error] [pid 9695:tid 9697] [client 20.199.109.98:19231] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aZpXmVpPqolBNLmJ4eqb0AAAAMA"]
[Sun Feb 22 09:10:49.833610 2026] [:error] [pid 9695:tid 9709] [client 20.199.109.98:27558] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aZpXmVpPqolBNLmJ4eqb1QAAAMw"]
[Sun Feb 22 09:10:50.304738 2026] [:error] [pid 12501:tid 12505] [client 20.199.109.98:18245] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aZpXmpicztrbvinWGXMaDwAAAUI"]
[Sun Feb 22 09:10:50.782462 2026] [:error] [pid 9587:tid 9609] [client 20.199.109.98:36501] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ccs.php"] [unique_id "aZpXmuhqt7NXCp-NupE7rgAAAA0"]
[Sun Feb 22 09:10:51.254130 2026] [:error] [pid 9695:tid 9698] [client 20.199.109.98:16482] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ccs.php"] [unique_id "aZpXm1pPqolBNLmJ4eqb2wAAAME"]
[Sun Feb 22 09:10:51.726209 2026] [:error] [pid 9695:tid 9714] [client 20.199.109.98:11792] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ccs.php"] [unique_id "aZpXm1pPqolBNLmJ4eqb3QAAANE"]
[Sun Feb 22 09:10:52.199479 2026] [:error] [pid 9695:tid 9716] [client 20.199.109.98:13666] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mini.php"] [unique_id "aZpXnFpPqolBNLmJ4eqb3gAAANM"]
[Sun Feb 22 09:10:52.669369 2026] [:error] [pid 9588:tid 9648] [client 20.199.109.98:21269] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mini.php"] [unique_id "aZpXnGjNBsxseiTcElmx8QAAAFg"]
[Sun Feb 22 09:10:53.140429 2026] [:error] [pid 9588:tid 9638] [client 20.199.109.98:33106] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mini.php"] [unique_id "aZpXnWjNBsxseiTcElmx8wAAAE4"]
[Sun Feb 22 09:10:53.611055 2026] [:error] [pid 10537:tid 10546] [client 20.199.109.98:21280] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mini.php"] [unique_id "aZpXnbgCiSojLQQBckhRewAAAQc"]
[Sun Feb 22 09:10:54.082979 2026] [:error] [pid 9588:tid 9641] [client 20.199.109.98:1572] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xr.php"] [unique_id "aZpXnmjNBsxseiTcElmx9gAAAFE"]
[Sun Feb 22 09:10:54.553117 2026] [:error] [pid 9695:tid 9707] [client 20.199.109.98:1557] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xr.php"] [unique_id "aZpXnlpPqolBNLmJ4eqb8QAAAMo"]
[Sun Feb 22 09:10:55.023801 2026] [:error] [pid 10537:tid 10563] [client 20.199.109.98:23022] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xr.php"] [unique_id "aZpXn7gCiSojLQQBckhRfQAAARg"]
[Sun Feb 22 09:10:55.495913 2026] [:error] [pid 9587:tid 9612] [client 20.199.109.98:21254] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xr.php"] [unique_id "aZpXn-hqt7NXCp-NupE7ugAAABA"]
[Sun Feb 22 09:10:55.972762 2026] [:error] [pid 12501:tid 12508] [client 20.199.109.98:16489] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cytyr.php"] [unique_id "aZpXn5icztrbvinWGXMaJQAAAUU"]
[Sun Feb 22 09:10:56.454057 2026] [:error] [pid 10537:tid 10545] [client 20.199.109.98:1979] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cytyr.php"] [unique_id "aZpXoLgCiSojLQQBckhRgwAAAQY"]
[Sun Feb 22 09:10:56.926305 2026] [:error] [pid 9695:tid 9704] [client 20.199.109.98:1912] [client 20.199.109.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cytyr.php"] [unique_id "aZpXoFpPqolBNLmJ4eqb9gAAAMc"]
[Sun Feb 22 10:56:24.047421 2026] [:error] [pid 9587:tid 9611] [client 62.28.117.90:59474] [client 62.28.117.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.28.117.90, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZpwWOhqt7NXCp-NupFedQAAAA8"]
[Sun Feb 22 10:56:24.052226 2026] [:error] [pid 9587:tid 9611] [client 62.28.117.90:59474] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Feb 22 23:34:02.948313 2026] [:error] [pid 2629:tid 2668] [client 185.137.164.15:23903] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Feb 22 23:34:03.250727 2026] [:error] [pid 2629:tid 2681] [client 185.137.164.15:23903] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Feb 22 23:34:03.515883 2026] [:error] [pid 2629:tid 2668] [client 185.137.164.15:23903] [client 185.137.164.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aZsh6wlsXSV5M4mfwZ9bPgAAAUo"]
[Sun Feb 22 23:34:04.149793 2026] [:error] [pid 2474:tid 2526] [client 185.137.164.18:47667] [client 185.137.164.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/O-Simple.php"] [unique_id "aZsh7PhvE7P5hX_xKnS4_QAAAEs"]
[Sun Feb 22 23:34:04.721780 2026] [:error] [pid 2628:tid 2631] [client 185.137.164.19:42463] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Feb 22 23:34:04.978724 2026] [:error] [pid 2628:tid 2654] [client 185.137.164.19:42463] [client 185.137.164.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZsh7LK4woMTeUPH2ns80AAAARc"]
[Sun Feb 22 23:34:05.524575 2026] [:error] [pid 2473:tid 2489] [client 185.137.164.16:53017] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZsh7XptAeV7-XzzNzg-UQAAAAw"]
[Sun Feb 22 23:34:06.103740 2026] [:error] [pid 2474:tid 2513] [client 185.137.164.14:20255] [client 185.137.164.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZsh7vhvE7P5hX_xKnS5EgAAAEQ"]
[Sun Feb 22 23:34:06.697121 2026] [:error] [pid 2628:tid 2632] [client 185.137.164.20:22827] [client 185.137.164.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZsh7rK4woMTeUPH2ns83gAAAQE"]
[Sun Feb 22 23:34:07.215867 2026] [:error] [pid 3103:tid 3123] [client 185.137.164.13:47545] [client 185.137.164.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZsh75fzX5hBIaQY93OAJQAAAZE"]
[Sun Feb 22 23:34:08.353849 2026] [:error] [pid 2574:tid 2586] [client 185.137.164.20:28375] [client 185.137.164.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aZsh8MkPV7h4nTf-jiTnTAAAAMU"]
[Sun Feb 22 23:34:09.034114 2026] [:error] [pid 2475:tid 2527] [client 185.137.164.18:64511] [client 185.137.164.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aZsh8Sdme8TSKYpXujdxygAAAII"]
[Sun Feb 22 23:34:09.586818 2026] [:error] [pid 2629:tid 2678] [client 185.137.164.20:52425] [client 185.137.164.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aZsh8QlsXSV5M4mfwZ9bbwAAAVQ"]
[Sun Feb 22 23:34:10.116670 2026] [:error] [pid 2629:tid 2659] [client 185.137.164.16:43497] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aZsh8glsXSV5M4mfwZ9begAAAUE"]
[Sun Feb 22 23:34:10.761738 2026] [:error] [pid 2628:tid 2653] [client 185.137.164.16:30405] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aZsh8rK4woMTeUPH2ns9BAAAARY"]
[Mon Feb 23 00:20:24.598283 2026] [:error] [pid 28424:tid 28449] [client 217.165.41.179:60622] [client 217.165.41.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.165.41.179, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZssyABAZT_BJOxE-Z4TxgAAABU"]
[Mon Feb 23 00:20:24.603649 2026] [:error] [pid 28424:tid 28449] [client 217.165.41.179:60622] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 23 00:21:00.032983 2026] [:error] [pid 28424:tid 28451] [client 103.211.132.233:12087] [client 103.211.132.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.211.132.233, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZss7ABAZT_BJOxE-Z4UGQAAABc"]
[Mon Feb 23 00:21:00.038822 2026] [:error] [pid 28424:tid 28451] [client 103.211.132.233:12087] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 23 00:49:09.450589 2026] [:error] [pid 28558:tid 28570] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Mon Feb 23 00:49:09.551175 2026] [:error] [pid 28558:tid 28573] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Feb 23 00:49:09.664788 2026] [:error] [pid 28558:tid 28577] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Mon Feb 23 00:49:09.803847 2026] [:error] [pid 28558:tid 28567] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Feb 23 00:49:09.934856 2026] [:error] [pid 28558:tid 28561] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Feb 23 00:49:10.045191 2026] [:error] [pid 28558:tid 28569] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Feb 23 00:49:10.166862 2026] [:error] [pid 28558:tid 28572] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Feb 23 00:49:10.265697 2026] [:error] [pid 28558:tid 28568] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Feb 23 00:49:10.459767 2026] [:error] [pid 28558:tid 28571] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Mon Feb 23 00:49:10.652523 2026] [:error] [pid 28558:tid 28565] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Mon Feb 23 00:49:10.767637 2026] [:error] [pid 28558:tid 28578] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Mon Feb 23 00:49:10.863669 2026] [:error] [pid 28558:tid 28580] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Feb 23 00:49:11.004633 2026] [:error] [pid 28558:tid 28562] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Mon Feb 23 00:49:11.132913 2026] [:error] [pid 28558:tid 28574] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Feb 23 00:49:11.247963 2026] [:error] [pid 28558:tid 28583] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Mon Feb 23 00:49:11.357710 2026] [:error] [pid 28558:tid 28575] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Mon Feb 23 00:49:11.455105 2026] [:error] [pid 28558:tid 28563] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Feb 23 00:49:11.548575 2026] [:error] [pid 28558:tid 28581] [client 173.239.196.29:29539] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Feb 23 00:49:13.089797 2026] [:error] [pid 28558:tid 28580] [client 173.239.196.29:29539] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aZsziSdFHR5e1Gd10vd0EAAAANQ"]
[Mon Feb 23 00:49:13.667801 2026] [:error] [pid 28426:tid 28541] [client 173.239.196.25:65051] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aZsziWgbPVf4pO12NZnGjAAAAJM"]
[Mon Feb 23 00:49:14.185147 2026] [:error] [pid 28424:tid 28441] [client 173.239.196.24:25529] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Feb 23 00:49:14.495862 2026] [:error] [pid 28424:tid 28452] [client 173.239.196.24:25529] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aZszigBAZT_BJOxE-Z4f5gAAABg"]
[Mon Feb 23 00:49:14.890845 2026] [:error] [pid 4806:tid 4828] [client 173.239.196.30:47701] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon Feb 23 00:49:14.980231 2026] [:error] [pid 4806:tid 4817] [client 173.239.196.30:47701] [client 173.239.196.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aZszivFTHI_ud-cTYbTmOQAAAQk"]
[Mon Feb 23 00:49:15.284349 2026] [:error] [pid 28425:tid 28504] [client 173.239.196.31:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Mon Feb 23 00:49:15.788398 2026] [:error] [pid 28425:tid 28510] [client 173.239.196.31:29183] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aZszizO7QIkwG1UqFGzflwAAAFE"]
[Mon Feb 23 00:49:17.189365 2026] [:error] [pid 4806:tid 4822] [client 173.239.196.27:54995] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aZszjfFTHI_ud-cTYbTmPgAAAQ4"]
[Mon Feb 23 00:49:17.379250 2026] [:error] [pid 4806:tid 4824] [client 173.239.196.29:44417] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aZszjfFTHI_ud-cTYbTmPwAAARA"]
[Mon Feb 23 00:49:17.667282 2026] [:error] [pid 28558:tid 28572] [client 173.239.196.31:28285] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aZszjSdFHR5e1Gd10vd0GQAAAMw"]
[Mon Feb 23 00:49:17.878269 2026] [:error] [pid 28558:tid 28571] [client 173.239.196.27:26417] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aZszjSdFHR5e1Gd10vd0GgAAAMs"]
[Mon Feb 23 00:49:18.066725 2026] [:error] [pid 28558:tid 28565] [client 173.239.196.30:20619] [client 173.239.196.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aZszjidFHR5e1Gd10vd0GwAAAMU"]
[Mon Feb 23 00:49:18.346682 2026] [:error] [pid 28425:tid 28494] [client 173.239.196.29:30173] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aZszjjO7QIkwG1UqFGzfnQAAAEE"]
[Mon Feb 23 00:49:18.599583 2026] [:error] [pid 4806:tid 4819] [client 173.239.196.27:65091] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Mon Feb 23 00:49:18.811088 2026] [:error] [pid 4806:tid 4809] [client 173.239.196.27:65091] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aZszjvFTHI_ud-cTYbTmQwAAAQE"]
[Mon Feb 23 00:49:19.266837 2026] [:error] [pid 4806:tid 4825] [client 173.239.196.31:63059] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aZszj_FTHI_ud-cTYbTmRgAAARE"]
[Mon Feb 23 00:49:19.544157 2026] [:error] [pid 28558:tid 28581] [client 173.239.196.26:58619] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aZszjydFHR5e1Gd10vd0HwAAANU"]
[Mon Feb 23 00:49:19.745054 2026] [:error] [pid 28425:tid 28511] [client 173.239.196.26:53211] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Mon Feb 23 00:49:19.876669 2026] [:error] [pid 28425:tid 28501] [client 173.239.196.26:53211] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aZszjzO7QIkwG1UqFGzfoAAAAEg"]
[Mon Feb 23 00:49:20.070257 2026] [:error] [pid 28425:tid 28514] [client 173.239.196.24:32001] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Mon Feb 23 00:49:20.365706 2026] [:error] [pid 28425:tid 28504] [client 173.239.196.24:32001] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Mon Feb 23 00:49:20.660216 2026] [:error] [pid 28425:tid 28505] [client 173.239.196.24:32001] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aZszkDO7QIkwG1UqFGzfpwAAAEw"]
[Mon Feb 23 00:49:20.841563 2026] [:error] [pid 28558:tid 28583] [client 173.239.196.25:38679] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Mon Feb 23 00:49:20.931408 2026] [:error] [pid 28558:tid 28561] [client 173.239.196.25:38679] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aZszkCdFHR5e1Gd10vd0IwAAAME"]
[Mon Feb 23 00:49:21.151054 2026] [:error] [pid 4806:tid 4829] [client 173.239.196.26:51749] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Mon Feb 23 00:49:21.340478 2026] [:error] [pid 4806:tid 4813] [client 173.239.196.26:51749] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aZszkfFTHI_ud-cTYbTmSwAAAQU"]
[Mon Feb 23 00:49:21.636587 2026] [:error] [pid 28558:tid 28579] [client 173.239.196.29:29679] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aZszkSdFHR5e1Gd10vd0JQAAANM"]
[Mon Feb 23 00:49:21.922625 2026] [:error] [pid 28424:tid 28438] [client 173.239.196.24:64727] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Mon Feb 23 00:49:22.013709 2026] [:error] [pid 28424:tid 28443] [client 173.239.196.24:64727] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Mon Feb 23 00:49:22.210972 2026] [:error] [pid 28424:tid 28428] [client 173.239.196.24:64727] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aZszkgBAZT_BJOxE-Z4f8AAAAAA"]
[Mon Feb 23 00:49:22.503133 2026] [:error] [pid 28558:tid 28566] [client 173.239.196.28:65117] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aZszkidFHR5e1Gd10vd0KQAAAMY"]
[Mon Feb 23 00:49:22.789379 2026] [:error] [pid 28424:tid 28429] [client 173.239.196.29:64735] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aZszkgBAZT_BJOxE-Z4f8wAAAAE"]
[Mon Feb 23 00:49:22.970282 2026] [:error] [pid 4806:tid 4820] [client 173.239.196.26:29081] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aZszkvFTHI_ud-cTYbTmTQAAAQw"]
[Mon Feb 23 00:49:23.226676 2026] [:error] [pid 28558:tid 28578] [client 173.239.196.30:35901] [client 173.239.196.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZszkydFHR5e1Gd10vd0KgAAANI"]
[Mon Feb 23 00:49:23.632122 2026] [:error] [pid 4806:tid 4826] [client 173.239.196.25:64539] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Mon Feb 23 00:49:23.739600 2026] [:error] [pid 4806:tid 4832] [client 173.239.196.25:64539] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aZszk_FTHI_ud-cTYbTmUwAAARg"]
[Mon Feb 23 00:49:23.954815 2026] [:error] [pid 28424:tid 28450] [client 173.239.196.25:45981] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aZszkwBAZT_BJOxE-Z4f9AAAABY"]
[Mon Feb 23 00:49:24.254734 2026] [:error] [pid 28558:tid 28581] [client 173.239.196.27:65103] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZszlCdFHR5e1Gd10vd0LAAAANU"]
[Mon Feb 23 00:49:24.662865 2026] [:error] [pid 28424:tid 28435] [client 173.239.196.26:65397] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Mon Feb 23 00:49:24.881196 2026] [:error] [pid 28424:tid 28431] [client 173.239.196.26:65397] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Mon Feb 23 00:49:25.272214 2026] [:error] [pid 28424:tid 28443] [client 173.239.196.26:65397] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aZszlQBAZT_BJOxE-Z4f_wAAAA8"]
[Mon Feb 23 00:49:25.826775 2026] [:error] [pid 28424:tid 28441] [client 173.239.196.29:41717] [client 173.239.196.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.196.29, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aZszlQBAZT_BJOxE-Z4gBAAAAA0"]
[Mon Feb 23 00:49:25.926201 2026] [:error] [pid 28424:tid 28429] [client 173.239.196.29:41717] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Mon Feb 23 00:49:26.435009 2026] [:error] [pid 28424:tid 28451] [client 173.239.196.29:41717] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Mon Feb 23 00:49:26.528495 2026] [:error] [pid 28424:tid 28442] [client 173.239.196.29:41717] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Mon Feb 23 00:49:27.011535 2026] [:error] [pid 28424:tid 28430] [client 173.239.196.29:41717] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aZszlwBAZT_BJOxE-Z4gEAAAAAI"]
[Mon Feb 23 00:49:27.293217 2026] [:error] [pid 28426:tid 28542] [client 173.239.196.27:52495] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Mon Feb 23 00:49:27.401116 2026] [:error] [pid 28426:tid 28538] [client 173.239.196.27:52495] [client 173.239.196.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.196.27, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aZszl2gbPVf4pO12NZnGogAAAJA"]
[Mon Feb 23 00:49:27.641786 2026] [:error] [pid 28426:tid 28522] [client 173.239.196.27:52495] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aZszl2gbPVf4pO12NZnGpQAAAIE"]
[Mon Feb 23 00:49:28.294002 2026] [:error] [pid 4806:tid 4815] [client 173.239.196.28:26563] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon Feb 23 00:49:28.480163 2026] [:error] [pid 4806:tid 4818] [client 173.239.196.28:26563] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Mon Feb 23 00:49:28.703706 2026] [:error] [pid 4806:tid 4809] [client 173.239.196.28:26563] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aZszmPFTHI_ud-cTYbTmYQAAAQE"]
[Mon Feb 23 00:49:28.928012 2026] [:error] [pid 4806:tid 4832] [client 173.239.196.24:64071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Mon Feb 23 00:49:29.260023 2026] [:error] [pid 4806:tid 4823] [client 173.239.196.24:64071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Mon Feb 23 00:49:29.463687 2026] [:error] [pid 4806:tid 4831] [client 173.239.196.24:64071] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Mon Feb 23 00:49:29.672616 2026] [:error] [pid 4806:tid 4813] [client 173.239.196.24:64071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Mon Feb 23 00:49:29.804957 2026] [:error] [pid 4806:tid 4829] [client 173.239.196.24:64071] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aZszmfFTHI_ud-cTYbTmbQAAARU"]
[Mon Feb 23 00:49:30.009524 2026] [:error] [pid 4806:tid 4820] [client 173.239.196.28:32105] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Mon Feb 23 00:49:30.107242 2026] [:error] [pid 4806:tid 4811] [client 173.239.196.28:32105] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Mon Feb 23 00:49:30.198433 2026] [:error] [pid 4806:tid 4815] [client 173.239.196.28:32105] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aZszmvFTHI_ud-cTYbTmcAAAAQc"]
[Mon Feb 23 00:49:30.497698 2026] [:error] [pid 28425:tid 28514] [client 173.239.196.27:44165] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Mon Feb 23 00:49:30.681626 2026] [:error] [pid 28425:tid 28502] [client 173.239.196.27:44165] [client 173.239.196.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.196.27, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aZszmjO7QIkwG1UqFGzfsgAAAEk"]
[Mon Feb 23 00:49:30.785479 2026] [:error] [pid 28425:tid 28493] [client 173.239.196.27:44165] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aZszmjO7QIkwG1UqFGzfswAAAEA"]
[Mon Feb 23 00:49:33.203408 2026] [:error] [pid 28425:tid 28509] [client 173.239.196.28:50391] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Mon Feb 23 00:49:33.957602 2026] [:error] [pid 28425:tid 28502] [client 173.239.196.28:50391] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Mon Feb 23 00:49:34.058474 2026] [:error] [pid 28425:tid 28501] [client 173.239.196.28:50391] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aZsznjO7QIkwG1UqFGzfxgAAAEg"]
[Mon Feb 23 00:49:34.247845 2026] [:error] [pid 28426:tid 28533] [client 173.239.196.24:22375] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Mon Feb 23 00:49:34.546245 2026] [:error] [pid 28426:tid 28521] [client 173.239.196.24:22375] [client 173.239.196.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.196.24, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aZsznmgbPVf4pO12NZnGrAAAAIA"]
[Mon Feb 23 00:49:34.646406 2026] [:error] [pid 28426:tid 28539] [client 173.239.196.24:22375] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Mon Feb 23 00:49:34.738036 2026] [:error] [pid 28426:tid 28534] [client 173.239.196.24:22375] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Mon Feb 23 00:49:34.833841 2026] [:error] [pid 28426:tid 28525] [client 173.239.196.24:22375] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Mon Feb 23 00:49:34.984637 2026] [:error] [pid 28426:tid 28526] [client 173.239.196.24:22375] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aZsznmgbPVf4pO12NZnGsQAAAIU"]
[Mon Feb 23 00:49:35.215353 2026] [:error] [pid 28425:tid 28493] [client 173.239.196.25:58579] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Mon Feb 23 00:49:35.315180 2026] [:error] [pid 28425:tid 28504] [client 173.239.196.25:58579] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aZsznzO7QIkwG1UqFGzfyAAAAEs"]
[Mon Feb 23 00:49:35.599795 2026] [:error] [pid 28424:tid 28431] [client 173.239.196.25:43969] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Mon Feb 23 00:49:35.689494 2026] [:error] [pid 28424:tid 28445] [client 173.239.196.25:43969] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aZsznwBAZT_BJOxE-Z4gHQAAABE"]
[Mon Feb 23 00:49:36.102015 2026] [:error] [pid 4806:tid 4810] [client 173.239.196.26:27091] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Mon Feb 23 00:49:36.198430 2026] [:error] [pid 4806:tid 4812] [client 173.239.196.26:27091] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aZszoPFTHI_ud-cTYbTmeAAAAQQ"]
[Mon Feb 23 00:49:36.383679 2026] [:error] [pid 4806:tid 4829] [client 173.239.196.29:39289] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aZszoPFTHI_ud-cTYbTmegAAARU"]
[Mon Feb 23 00:49:36.654829 2026] [:error] [pid 28558:tid 28582] [client 173.239.196.31:47231] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Mon Feb 23 00:49:36.755827 2026] [:error] [pid 28558:tid 28570] [client 173.239.196.31:47231] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Mon Feb 23 00:49:37.144785 2026] [:error] [pid 28558:tid 28567] [client 173.239.196.31:47231] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aZszoSdFHR5e1Gd10vd0PgAAAMc"]
[Mon Feb 23 00:49:37.498201 2026] [:error] [pid 28425:tid 28508] [client 173.239.196.31:52801] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aZszoTO7QIkwG1UqFGzfywAAAE8"]
[Mon Feb 23 00:49:38.088182 2026] [:error] [pid 28558:tid 28579] [client 173.239.196.25:50689] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aZszoidFHR5e1Gd10vd0RAAAANM"]
[Mon Feb 23 00:49:38.312529 2026] [:error] [pid 4806:tid 4815] [client 173.239.196.30:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Mon Feb 23 00:49:39.756615 2026] [:error] [pid 4806:tid 4819] [client 173.239.196.30:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Mon Feb 23 00:49:39.878011 2026] [:error] [pid 4806:tid 4825] [client 173.239.196.30:65289] [client 173.239.196.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aZszo_FTHI_ud-cTYbTmgwAAARE"]
[Mon Feb 23 00:49:40.057402 2026] [:error] [pid 4806:tid 4817] [client 173.239.196.28:31249] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Mon Feb 23 00:49:40.276808 2026] [:error] [pid 4806:tid 4828] [client 173.239.196.28:31249] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aZszpPFTHI_ud-cTYbTmiAAAARQ"]
[Mon Feb 23 00:49:40.804835 2026] [:error] [pid 4806:tid 4821] [client 173.239.196.25:40815] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aZszpPFTHI_ud-cTYbTmjAAAAQ0"]
[Mon Feb 23 00:49:41.102997 2026] [:error] [pid 4806:tid 4818] [client 173.239.196.28:48225] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Mon Feb 23 00:49:41.415028 2026] [:error] [pid 4806:tid 4823] [client 173.239.196.28:48225] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Mon Feb 23 00:49:41.631716 2026] [:error] [pid 4806:tid 4810] [client 173.239.196.28:48225] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Mon Feb 23 00:49:41.752015 2026] [:error] [pid 4806:tid 4812] [client 173.239.196.28:48225] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aZszpfFTHI_ud-cTYbTmlwAAAQQ"]
[Mon Feb 23 00:49:41.977770 2026] [:error] [pid 4806:tid 4824] [client 173.239.196.29:59849] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aZszpfFTHI_ud-cTYbTmmAAAARA"]
[Mon Feb 23 00:49:42.158861 2026] [:error] [pid 4806:tid 4820] [client 173.239.196.27:49203] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aZszpvFTHI_ud-cTYbTmmQAAAQw"]
[Mon Feb 23 00:49:42.393766 2026] [:error] [pid 4806:tid 4821] [client 173.239.196.31:42767] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aZszpvFTHI_ud-cTYbTmmwAAAQ0"]
[Mon Feb 23 00:49:42.595615 2026] [:error] [pid 28426:tid 28534] [client 173.239.196.24:32147] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Mon Feb 23 00:49:42.699208 2026] [:error] [pid 28426:tid 28525] [client 173.239.196.24:32147] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aZszpmgbPVf4pO12NZnGvAAAAIQ"]
[Mon Feb 23 00:49:42.910059 2026] [:error] [pid 4806:tid 4819] [client 173.239.196.31:21023] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZszpvFTHI_ud-cTYbTmnAAAAQs"]
[Mon Feb 23 00:49:43.099209 2026] [:error] [pid 28558:tid 28577] [client 173.239.196.27:57491] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Mon Feb 23 00:49:43.341142 2026] [:error] [pid 28558:tid 28570] [client 173.239.196.27:57491] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aZszpydFHR5e1Gd10vd0SQAAAMo"]
[Mon Feb 23 00:49:43.601371 2026] [:error] [pid 4806:tid 4825] [client 173.239.196.28:50191] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aZszp_FTHI_ud-cTYbTmngAAARE"]
[Mon Feb 23 00:49:43.783721 2026] [:error] [pid 4806:tid 4816] [client 173.239.196.24:54375] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aZszp_FTHI_ud-cTYbTmnwAAAQg"]
[Mon Feb 23 00:49:44.042506 2026] [:error] [pid 28426:tid 28535] [client 173.239.196.24:65367] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aZszqGgbPVf4pO12NZnGvgAAAI0"]
[Mon Feb 23 00:49:44.351372 2026] [:error] [pid 28426:tid 28540] [client 173.239.196.28:41609] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aZszqGgbPVf4pO12NZnGwAAAAJI"]
[Mon Feb 23 00:49:44.762352 2026] [:error] [pid 28426:tid 28536] [client 173.239.196.27:20789] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aZszqGgbPVf4pO12NZnGwwAAAI4"]
[Mon Feb 23 00:49:44.959644 2026] [:error] [pid 4806:tid 4810] [client 173.239.196.28:51371] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Mon Feb 23 00:49:45.303706 2026] [:error] [pid 4806:tid 4830] [client 173.239.196.28:51371] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Mon Feb 23 00:49:45.428349 2026] [:error] [pid 4806:tid 4831] [client 173.239.196.28:51371] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aZszqfFTHI_ud-cTYbTmpgAAARc"]
[Mon Feb 23 00:49:45.744266 2026] [:error] [pid 28425:tid 28506] [client 173.239.196.26:57935] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Mon Feb 23 00:49:45.839458 2026] [:error] [pid 28425:tid 28513] [client 173.239.196.26:57935] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Mon Feb 23 00:49:46.359853 2026] [:error] [pid 28425:tid 28503] [client 173.239.196.26:57935] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aZszqjO7QIkwG1UqFGzf1AAAAEo"]
[Mon Feb 23 00:49:46.833660 2026] [:error] [pid 4806:tid 4818] [client 173.239.196.26:25389] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aZszqvFTHI_ud-cTYbTmqwAAAQo"]
[Mon Feb 23 00:49:47.056363 2026] [:error] [pid 4806:tid 4823] [client 173.239.196.25:53351] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aZszq_FTHI_ud-cTYbTmrAAAAQ8"]
[Mon Feb 23 00:49:47.627800 2026] [:error] [pid 28425:tid 28515] [client 173.239.196.25:34009] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZszqzO7QIkwG1UqFGzf2QAAAFY"]
[Mon Feb 23 00:49:48.049800 2026] [:error] [pid 28424:tid 28429] [client 173.239.196.28:27699] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Mon Feb 23 00:49:48.152733 2026] [:error] [pid 28424:tid 28451] [client 173.239.196.28:27699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Mon Feb 23 00:49:48.268888 2026] [:error] [pid 28424:tid 28442] [client 173.239.196.28:27699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Mon Feb 23 00:49:48.366384 2026] [:error] [pid 28424:tid 28452] [client 173.239.196.28:27699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Mon Feb 23 00:49:48.951437 2026] [:error] [pid 28424:tid 28430] [client 173.239.196.28:27699] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZszrABAZT_BJOxE-Z4gLAAAAAI"]
[Mon Feb 23 00:49:49.208871 2026] [:error] [pid 28558:tid 28577] [client 173.239.196.25:65123] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aZszrSdFHR5e1Gd10vd0UgAAANE"]
[Mon Feb 23 00:49:49.409760 2026] [:error] [pid 28425:tid 28508] [client 173.239.196.31:48963] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aZszrTO7QIkwG1UqFGzf3QAAAE8"]
[Mon Feb 23 00:49:49.650326 2026] [:error] [pid 28426:tid 28544] [client 173.239.196.24:40487] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aZszrWgbPVf4pO12NZnGyAAAAJY"]
[Mon Feb 23 00:49:49.835317 2026] [:error] [pid 28425:tid 28499] [client 173.239.196.31:30321] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aZszrTO7QIkwG1UqFGzf3gAAAEY"]
[Mon Feb 23 00:49:50.044984 2026] [:error] [pid 28424:tid 28431] [client 173.239.196.25:34981] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aZszrgBAZT_BJOxE-Z4gLQAAAAM"]
[Mon Feb 23 00:49:50.343866 2026] [:error] [pid 28558:tid 28561] [client 173.239.196.30:25821] [client 173.239.196.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aZszridFHR5e1Gd10vd0WAAAAME"]
[Mon Feb 23 00:49:50.538794 2026] [:error] [pid 28425:tid 28516] [client 173.239.196.31:64691] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aZszrjO7QIkwG1UqFGzf4AAAAFc"]
[Mon Feb 23 00:49:50.748022 2026] [:error] [pid 28558:tid 28569] [client 173.239.196.31:47559] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aZszridFHR5e1Gd10vd0WQAAAMk"]
[Mon Feb 23 00:49:50.968489 2026] [:error] [pid 28558:tid 28579] [client 173.239.196.25:21243] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aZszridFHR5e1Gd10vd0WgAAANM"]
[Mon Feb 23 00:49:51.427595 2026] [:error] [pid 28558:tid 28564] [client 173.239.196.30:60633] [client 173.239.196.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aZszrydFHR5e1Gd10vd0XgAAAMQ"]
[Mon Feb 23 00:49:51.740856 2026] [:error] [pid 28558:tid 28584] [client 173.239.196.26:41803] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aZszrydFHR5e1Gd10vd0YAAAANg"]
[Mon Feb 23 00:49:51.935531 2026] [:error] [pid 28424:tid 28428] [client 173.239.196.24:64185] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Mon Feb 23 00:49:52.128449 2026] [:error] [pid 28424:tid 28440] [client 173.239.196.24:64185] [client 173.239.196.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aZszsABAZT_BJOxE-Z4gMgAAAAw"]
[Mon Feb 23 00:49:52.572359 2026] [:error] [pid 28425:tid 28494] [client 173.239.196.29:48687] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aZszsDO7QIkwG1UqFGzf4wAAAEE"]
[Mon Feb 23 00:49:53.080530 2026] [:error] [pid 28558:tid 28560] [client 173.239.196.28:45401] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Mon Feb 23 00:49:53.173477 2026] [:error] [pid 28558:tid 28573] [client 173.239.196.28:45401] [client 173.239.196.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aZszsSdFHR5e1Gd10vd0ZQAAAM0"]
[Mon Feb 23 00:49:53.465002 2026] [:error] [pid 4806:tid 4824] [client 173.239.196.25:34669] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Mon Feb 23 00:49:53.563093 2026] [:error] [pid 4806:tid 4831] [client 173.239.196.25:34669] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Mon Feb 23 00:49:53.656541 2026] [:error] [pid 4806:tid 4832] [client 173.239.196.25:34669] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Mon Feb 23 00:49:53.744889 2026] [:error] [pid 4806:tid 4820] [client 173.239.196.25:34669] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aZszsfFTHI_ud-cTYbTmtAAAAQw"]
[Mon Feb 23 00:49:53.949080 2026] [:error] [pid 4806:tid 4821] [client 173.239.196.30:62887] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Mon Feb 23 00:49:54.074185 2026] [:error] [pid 4806:tid 4815] [client 173.239.196.30:62887] [client 173.239.196.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aZszsvFTHI_ud-cTYbTmuAAAAQc"]
[Mon Feb 23 00:49:54.457345 2026] [:error] [pid 4806:tid 4811] [client 173.239.196.27:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Feb 23 00:49:55.815009 2026] [:error] [pid 4806:tid 4811] [client 173.239.196.27:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Mon Feb 23 00:49:55.910330 2026] [:error] [pid 4806:tid 4817] [client 173.239.196.27:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Mon Feb 23 00:49:56.480276 2026] [:error] [pid 4806:tid 4832] [client 173.239.196.27:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Feb 23 00:49:56.582722 2026] [:error] [pid 4806:tid 4820] [client 173.239.196.27:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Mon Feb 23 00:49:56.790443 2026] [:error] [pid 4806:tid 4813] [client 173.239.196.27:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Mon Feb 23 00:49:57.103824 2026] [:error] [pid 4806:tid 4830] [client 173.239.196.27:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Mon Feb 23 00:49:57.205660 2026] [:error] [pid 4806:tid 4822] [client 173.239.196.27:49331] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aZsztfFTHI_ud-cTYbTmzAAAAQ4"]
[Mon Feb 23 00:49:57.395311 2026] [:error] [pid 28558:tid 28570] [client 173.239.196.27:42509] [client 173.239.196.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aZsztSdFHR5e1Gd10vd0cAAAAMo"]
[Mon Feb 23 00:49:57.578885 2026] [:error] [pid 28424:tid 28434] [client 173.239.196.26:32497] [client 173.239.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.196.26, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZsztQBAZT_BJOxE-Z4gOAAAAAY"]
[Mon Feb 23 00:49:57.583656 2026] [:error] [pid 28424:tid 28434] [client 173.239.196.26:32497] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Feb 23 00:49:57.728534 2026] [:error] [pid 28424:tid 28430] [client 173.239.196.26:32497] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Mon Feb 23 00:49:57.841850 2026] [:error] [pid 28424:tid 28438] [client 173.239.196.26:32497] [client 173.239.196.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aZsztQBAZT_BJOxE-Z4gOwAAAAo"]
[Mon Feb 23 00:49:58.169532 2026] [:error] [pid 28425:tid 28493] [client 173.239.196.31:50861] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Feb 23 00:49:58.263274 2026] [:error] [pid 28425:tid 28504] [client 173.239.196.31:50861] [client 173.239.196.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aZsztjO7QIkwG1UqFGzf6QAAAEs"]
[Mon Feb 23 00:49:58.474272 2026] [:error] [pid 28424:tid 28428] [client 173.239.196.29:42657] [client 173.239.196.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aZsztgBAZT_BJOxE-Z4gPAAAAAA"]
[Mon Feb 23 00:49:59.175848 2026] [:error] [pid 28425:tid 28499] [client 173.239.196.25:59275] [client 173.239.196.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aZsztzO7QIkwG1UqFGzf7gAAAEY"]
[Mon Feb 23 02:36:55.421026 2026] [:error] [pid 28426:tid 28536] [client 52.236.62.204:61861] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Mon Feb 23 07:42:05.828613 2026] [:error] [pid 25295:tid 25357] [client 16.171.160.156:51301] [client 16.171.160.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZuUTY2Av4J1Jnqi7yJ_ywAAAJI"]
[Mon Feb 23 07:42:07.477290 2026] [:error] [pid 25294:tid 25372] [client 16.171.160.156:60968] [client 16.171.160.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZuUTyRCFB3CqIo_jfY8FAAAAFM"]
[Mon Feb 23 08:42:37.650082 2026] [:error] [pid 39640:tid 39689] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Mon Feb 23 08:42:37.767736 2026] [:error] [pid 39640:tid 39684] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Feb 23 08:42:37.888180 2026] [:error] [pid 39640:tid 39686] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon Feb 23 08:42:38.005331 2026] [:error] [pid 39640:tid 39678] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon Feb 23 08:42:38.122405 2026] [:error] [pid 39640:tid 39690] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Mon Feb 23 08:42:38.236466 2026] [:error] [pid 39640:tid 39691] [client 20.89.58.13:12324] [client 20.89.58.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.89.58.13, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZuiftsK--eVCgzvvuch1wAAApU"]
[Mon Feb 23 08:42:38.241673 2026] [:error] [pid 39640:tid 39691] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 23 08:42:38.358766 2026] [:error] [pid 39640:tid 39674] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Feb 23 08:42:38.475834 2026] [:error] [pid 39640:tid 39694] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Feb 23 08:42:38.612103 2026] [:error] [pid 39640:tid 39693] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon Feb 23 08:42:38.730403 2026] [:error] [pid 39640:tid 39679] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Feb 23 08:42:38.849765 2026] [:error] [pid 39640:tid 39675] [client 20.89.58.13:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Mon Feb 23 08:42:38.963235 2026] [:error] [pid 39640:tid 39680] [client 20.89.58.13:12324] [client 20.89.58.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZuiftsK--eVCgzvvuch3QAAAoo"]
[Mon Feb 23 08:42:39.432884 2026] [:error] [pid 25380:tid 25405] [client 20.89.58.13:10042] [client 20.89.58.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZuif6Krc8yFQ8fy78oanAAAANc"]
[Mon Feb 23 08:42:39.893175 2026] [:error] [pid 39538:tid 39551] [client 20.89.58.13:9996] [client 20.89.58.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZuify4Zk8-cQOG3ZnoVyAAAAYk"]
[Mon Feb 23 08:42:40.373162 2026] [:error] [pid 39504:tid 39512] [client 20.89.58.13:19510] [client 20.89.58.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aZuigHLcHpOlI9gwwJrZIQAAAUY"]
[Mon Feb 23 14:51:32.654860 2026] [:error] [pid 25295:tid 25363] [client 77.81.161.21:7174] [client 77.81.161.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.81.161.21, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZv49I2Av4J1Jnqi7yKvvwAAAJU"]
[Mon Feb 23 14:51:32.659550 2026] [:error] [pid 25295:tid 25363] [client 77.81.161.21:7174] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 23 19:44:19.208242 2026] [:error] [pid 39538:tid 39542] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Mon Feb 23 19:44:19.816017 2026] [:error] [pid 39538:tid 39542] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/bootstrap.php
[Mon Feb 23 19:44:21.371560 2026] [:error] [pid 39538:tid 39542] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/f2.php
[Mon Feb 23 19:44:21.631161 2026] [:error] [pid 39538:tid 39563] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/to.php
[Mon Feb 23 19:44:21.889188 2026] [:error] [pid 39538:tid 39557] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/a332.php
[Mon Feb 23 19:44:22.146776 2026] [:error] [pid 39538:tid 39551] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Mon Feb 23 19:44:22.407517 2026] [:error] [pid 39538:tid 39562] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/thui.php
[Mon Feb 23 19:44:22.666771 2026] [:error] [pid 39538:tid 39545] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Mon Feb 23 19:44:22.938049 2026] [:error] [pid 39538:tid 39558] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/fresh3.php
[Mon Feb 23 19:44:23.195920 2026] [:error] [pid 39538:tid 39560] [client 74.248.144.152:35733] File does not exist: /usr/local/apache/htdocs/suspended-page/selesai.php
[Mon Feb 23 19:44:23.450869 2026] [:error] [pid 39538:tid 39548] [client 74.248.144.152:35733] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aZw9ly4Zk8-cQOG3Znpq5AAAAYY"]
[Mon Feb 23 19:44:24.053173 2026] [:error] [pid 39504:tid 39506] [client 74.248.144.152:34576] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aZw9mHLcHpOlI9gwwJoW7gAAAUA"]
[Mon Feb 23 19:44:24.642629 2026] [:error] [pid 25294:tid 25366] [client 74.248.144.152:39752] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aZw9mCRCFB3CqIo_jfbc3wAAAFA"]
[Mon Feb 23 19:44:25.203328 2026] [:error] [pid 39504:tid 39507] [client 74.248.144.152:39755] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aZw9mXLcHpOlI9gwwJoW8wAAAUE"]
[Mon Feb 23 19:44:25.864683 2026] [:error] [pid 39540:tid 39571] [client 74.248.144.152:39784] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZw9mbsgm9aTWhlRScKnwgAAAcI"]
[Mon Feb 23 19:44:26.491234 2026] [:error] [pid 25294:tid 25360] [client 74.248.144.152:29863] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZw9miRCFB3CqIo_jfbc5QAAAE0"]
[Mon Feb 23 19:44:27.022649 2026] [:error] [pid 25294:tid 25375] [client 74.248.144.152:39783] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZw9myRCFB3CqIo_jfbc6AAAAFY"]
[Mon Feb 23 19:44:27.539700 2026] [:error] [pid 25294:tid 25377] [client 74.248.144.152:35929] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maraz.php"] [unique_id "aZw9myRCFB3CqIo_jfbc6gAAAFg"]
[Mon Feb 23 19:44:28.052676 2026] [:error] [pid 25294:tid 25373] [client 74.248.144.152:29884] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZw9nCRCFB3CqIo_jfbc7gAAAFQ"]
[Mon Feb 23 19:44:28.562257 2026] [:error] [pid 25294:tid 25343] [client 74.248.144.152:50886] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZw9nCRCFB3CqIo_jfbc7wAAAEU"]
[Mon Feb 23 19:44:29.092785 2026] [:error] [pid 25294:tid 25374] [client 74.248.144.152:32759] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZw9nSRCFB3CqIo_jfbc8wAAAFU"]
[Mon Feb 23 19:44:29.602990 2026] [:error] [pid 39540:tid 39593] [client 74.248.144.152:35921] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aZw9nbsgm9aTWhlRScKnwwAAAdg"]
[Mon Feb 23 19:44:30.114475 2026] [:error] [pid 25380:tid 25406] [client 74.248.144.152:39748] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZw9nqKrc8yFQ8fy78otmwAAANg"]
[Mon Feb 23 19:44:30.628239 2026] [:error] [pid 39639:tid 39662] [client 74.248.144.152:39807] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZw9nhpFkMoMi8uTUUO5iwAAAlM"]
[Mon Feb 23 19:44:31.140006 2026] [:error] [pid 25380:tid 25400] [client 74.248.144.152:25965] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZw9n6Krc8yFQ8fy78otnwAAANI"]
[Mon Feb 23 19:44:31.650322 2026] [:error] [pid 25380:tid 25393] [client 74.248.144.152:35934] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aZw9n6Krc8yFQ8fy78otoAAAAMs"]
[Mon Feb 23 19:44:32.182469 2026] [:error] [pid 25295:tid 25335] [client 74.248.144.152:35939] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "aZw9oI2Av4J1Jnqi7yLAogAAAIQ"]
[Mon Feb 23 19:44:32.709983 2026] [:error] [pid 29909:tid 29915] [client 74.248.144.152:35747] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "aZw9oD9oc2QzltksUk7Y0gAAAQQ"]
[Mon Feb 23 19:44:33.233718 2026] [:error] [pid 39540:tid 39578] [client 74.248.144.152:25923] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "aZw9obsgm9aTWhlRScKnxQAAAck"]
[Mon Feb 23 19:44:33.756299 2026] [:error] [pid 39540:tid 39579] [client 74.248.144.152:50933] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "aZw9obsgm9aTWhlRScKnyQAAAco"]
[Mon Feb 23 19:44:34.266352 2026] [:error] [pid 39504:tid 39522] [client 74.248.144.152:35753] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bzjdlofz.php"] [unique_id "aZw9onLcHpOlI9gwwJoW_wAAAVA"]
[Mon Feb 23 19:44:34.789608 2026] [:error] [pid 29909:tid 29912] [client 74.248.144.152:39789] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bzjdlofz.php"] [unique_id "aZw9oj9oc2QzltksUk7Y1AAAAQE"]
[Mon Feb 23 19:44:35.337749 2026] [:error] [pid 29909:tid 29918] [client 74.248.144.152:21089] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bzjdlofz.php"] [unique_id "aZw9oz9oc2QzltksUk7Y1wAAAQc"]
[Mon Feb 23 19:44:35.872281 2026] [:error] [pid 39540:tid 39586] [client 74.248.144.152:32746] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bzjdlofz.php"] [unique_id "aZw9o7sgm9aTWhlRScKnzAAAAdE"]
[Mon Feb 23 19:44:36.384137 2026] [:error] [pid 39640:tid 39690] [client 74.248.144.152:28624] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZw9pNsK--eVCgzvvufYGQAAApQ"]
[Mon Feb 23 19:44:36.896961 2026] [:error] [pid 25380:tid 25401] [client 74.248.144.152:28235] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZw9pKKrc8yFQ8fy78otrQAAANM"]
[Mon Feb 23 19:44:37.438688 2026] [:error] [pid 39640:tid 39685] [client 74.248.144.152:32713] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZw9pdsK--eVCgzvvufYGwAAAo8"]
[Mon Feb 23 19:44:37.949300 2026] [:error] [pid 25380:tid 25393] [client 74.248.144.152:28283] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aZw9paKrc8yFQ8fy78otsQAAAMs"]
[Mon Feb 23 19:44:38.505302 2026] [:error] [pid 25380:tid 25396] [client 74.248.144.152:25981] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aZw9pqKrc8yFQ8fy78otswAAAM4"]
[Mon Feb 23 19:44:39.021211 2026] [:error] [pid 39640:tid 39680] [client 74.248.144.152:29851] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aZw9p9sK--eVCgzvvufYIQAAAoo"]
[Mon Feb 23 19:44:39.571612 2026] [:error] [pid 25293:tid 25318] [client 74.248.144.152:28635] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aZw9p-L9XfBf66iHi_ep5wAAABM"]
[Mon Feb 23 19:44:40.106565 2026] [:error] [pid 39540:tid 39571] [client 74.248.144.152:35775] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "aZw9qLsgm9aTWhlRScKn1QAAAcI"]
[Mon Feb 23 19:44:40.636726 2026] [:error] [pid 25380:tid 25392] [client 74.248.144.152:39721] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw9qKKrc8yFQ8fy78ottQAAAMo"]
[Mon Feb 23 19:44:41.155997 2026] [:error] [pid 39639:tid 39655] [client 74.248.144.152:32741] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw9qRpFkMoMi8uTUUO5jwAAAkw"]
[Mon Feb 23 19:44:41.674896 2026] [:error] [pid 39540:tid 39592] [client 74.248.144.152:25974] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw9qbsgm9aTWhlRScKn2gAAAdc"]
[Mon Feb 23 19:44:42.204853 2026] [:error] [pid 39640:tid 39683] [client 74.248.144.152:32710] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw9qtsK--eVCgzvvufYJgAAAo0"]
[Mon Feb 23 19:44:42.723562 2026] [:error] [pid 39639:tid 39667] [client 74.248.144.152:29862] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aZw9qhpFkMoMi8uTUUO5kAAAAlg"]
[Mon Feb 23 19:44:43.237068 2026] [:error] [pid 39540:tid 39591] [client 74.248.144.152:31311] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aZw9q7sgm9aTWhlRScKn2wAAAdY"]
[Mon Feb 23 19:44:43.749631 2026] [:error] [pid 39540:tid 39587] [client 74.248.144.152:34589] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aZw9q7sgm9aTWhlRScKn3QAAAdI"]
[Mon Feb 23 19:44:44.259755 2026] [:error] [pid 25293:tid 25306] [client 74.248.144.152:38806] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aZw9rOL9XfBf66iHi_ep6AAAAAc"]
[Mon Feb 23 19:44:44.770758 2026] [:error] [pid 39639:tid 39660] [client 74.248.144.152:38802] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "aZw9rBpFkMoMi8uTUUO5lQAAAlE"]
[Mon Feb 23 19:44:45.280887 2026] [:error] [pid 39639:tid 39651] [client 74.248.144.152:32755] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "aZw9rRpFkMoMi8uTUUO5lwAAAkg"]
[Mon Feb 23 19:44:45.791708 2026] [:error] [pid 39538:tid 39545] [client 74.248.144.152:28645] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "aZw9rS4Zk8-cQOG3Znpq7AAAAYM"]
[Mon Feb 23 19:44:46.310722 2026] [:error] [pid 39639:tid 39646] [client 74.248.144.152:38845] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "aZw9rhpFkMoMi8uTUUO5mQAAAkM"]
[Mon Feb 23 19:44:46.821416 2026] [:error] [pid 39540:tid 39584] [client 74.248.144.152:50938] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php"] [unique_id "aZw9rrsgm9aTWhlRScKn3wAAAc8"]
[Mon Feb 23 19:44:47.333267 2026] [:error] [pid 25380:tid 25401] [client 74.248.144.152:38793] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php"] [unique_id "aZw9r6Krc8yFQ8fy78otugAAANM"]
[Mon Feb 23 19:44:47.848218 2026] [:error] [pid 25295:tid 25342] [client 74.248.144.152:34561] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php"] [unique_id "aZw9r42Av4J1Jnqi7yLApQAAAIo"]
[Mon Feb 23 19:44:48.364278 2026] [:error] [pid 39538:tid 39548] [client 74.248.144.152:25693] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ak.php"] [unique_id "aZw9sC4Zk8-cQOG3Znpq7wAAAYY"]
[Mon Feb 23 19:44:48.877076 2026] [:error] [pid 39639:tid 39665] [client 74.248.144.152:35727] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-style.php"] [unique_id "aZw9sBpFkMoMi8uTUUO5nQAAAlY"]
[Mon Feb 23 19:44:49.402511 2026] [:error] [pid 39639:tid 39667] [client 74.248.144.152:29887] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-style.php"] [unique_id "aZw9sRpFkMoMi8uTUUO5ngAAAlg"]
[Mon Feb 23 19:44:49.914562 2026] [:error] [pid 25380:tid 25390] [client 74.248.144.152:34613] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-style.php"] [unique_id "aZw9saKrc8yFQ8fy78otwQAAAMg"]
[Mon Feb 23 19:44:50.425485 2026] [:error] [pid 39538:tid 39547] [client 74.248.144.152:34610] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-style.php"] [unique_id "aZw9si4Zk8-cQOG3Znpq8AAAAYU"]
[Mon Feb 23 19:44:50.935599 2026] [:error] [pid 39639:tid 39658] [client 74.248.144.152:34567] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aZw9shpFkMoMi8uTUUO5oQAAAk8"]
[Mon Feb 23 19:44:51.447243 2026] [:error] [pid 39538:tid 39559] [client 74.248.144.152:35734] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aZw9sy4Zk8-cQOG3Znpq8gAAAZE"]
[Mon Feb 23 19:44:51.957791 2026] [:error] [pid 25380:tid 25405] [client 74.248.144.152:34566] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aZw9s6Krc8yFQ8fy78otxgAAANc"]
[Mon Feb 23 19:44:52.468254 2026] [:error] [pid 25380:tid 25406] [client 74.248.144.152:21117] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x0x.php"] [unique_id "aZw9tKKrc8yFQ8fy78otzQAAANg"]
[Mon Feb 23 19:44:52.996512 2026] [:error] [pid 25380:tid 25385] [client 74.248.144.152:28242] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0byte.php"] [unique_id "aZw9tKKrc8yFQ8fy78ot0gAAAMM"]
[Mon Feb 23 19:44:53.506858 2026] [:error] [pid 25293:tid 25301] [client 74.248.144.152:39716] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0byte.php"] [unique_id "aZw9teL9XfBf66iHi_ep7QAAAAI"]
[Mon Feb 23 19:44:54.021520 2026] [:error] [pid 39639:tid 39662] [client 74.248.144.152:34620] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0byte.php"] [unique_id "aZw9thpFkMoMi8uTUUO5rAAAAlM"]
[Mon Feb 23 19:44:54.557531 2026] [:error] [pid 25294:tid 25348] [client 74.248.144.152:29171] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0byte.php"] [unique_id "aZw9tiRCFB3CqIo_jfbdFAAAAEc"]
[Mon Feb 23 19:44:55.067611 2026] [:error] [pid 25380:tid 25405] [client 74.248.144.152:39803] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "aZw9t6Krc8yFQ8fy78ot1wAAANc"]
[Mon Feb 23 19:44:55.598320 2026] [:error] [pid 39639:tid 39652] [client 74.248.144.152:34618] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "aZw9txpFkMoMi8uTUUO5rwAAAkk"]
[Mon Feb 23 19:44:56.112616 2026] [:error] [pid 39639:tid 39656] [client 74.248.144.152:33534] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "aZw9uBpFkMoMi8uTUUO5sgAAAk0"]
[Mon Feb 23 19:44:56.651322 2026] [:error] [pid 39639:tid 39643] [client 74.248.144.152:23557] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "aZw9uBpFkMoMi8uTUUO5tgAAAkA"]
[Mon Feb 23 19:44:57.198307 2026] [:error] [pid 39540:tid 39592] [client 74.248.144.152:33479] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZw9ubsgm9aTWhlRScKn5gAAAdc"]
[Mon Feb 23 19:44:57.718546 2026] [:error] [pid 39639:tid 39647] [client 74.248.144.152:21081] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZw9uRpFkMoMi8uTUUO5uAAAAkQ"]
[Mon Feb 23 19:44:58.228977 2026] [:error] [pid 25380:tid 25398] [client 74.248.144.152:33485] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZw9uqKrc8yFQ8fy78ot3AAAANA"]
[Mon Feb 23 19:44:58.772460 2026] [:error] [pid 39540:tid 39586] [client 74.248.144.152:34616] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logs1.php"] [unique_id "aZw9ursgm9aTWhlRScKn6gAAAdE"]
[Mon Feb 23 19:44:59.293782 2026] [:error] [pid 25380:tid 25406] [client 74.248.144.152:28245] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/35.php"] [unique_id "aZw9u6Krc8yFQ8fy78ot4wAAANg"]
[Mon Feb 23 19:44:59.808723 2026] [:error] [pid 25380:tid 25399] [client 74.248.144.152:28253] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/35.php"] [unique_id "aZw9u6Krc8yFQ8fy78ot5QAAANE"]
[Mon Feb 23 19:45:00.322990 2026] [:error] [pid 25380:tid 25389] [client 74.248.144.152:23577] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/35.php"] [unique_id "aZw9vKKrc8yFQ8fy78ot5wAAAMc"]
[Mon Feb 23 19:45:00.833713 2026] [:error] [pid 25380:tid 25392] [client 74.248.144.152:21063] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/35.php"] [unique_id "aZw9vKKrc8yFQ8fy78ot7AAAAMo"]
[Mon Feb 23 19:45:01.386437 2026] [:error] [pid 25380:tid 25394] [client 74.248.144.152:38817] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZw9vaKrc8yFQ8fy78ot8AAAAMw"]
[Mon Feb 23 19:45:01.902955 2026] [:error] [pid 25380:tid 25402] [client 74.248.144.152:33535] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZw9vaKrc8yFQ8fy78ot8gAAANQ"]
[Mon Feb 23 19:45:02.434670 2026] [:error] [pid 39538:tid 39550] [client 74.248.144.152:30892] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZw9vi4Zk8-cQOG3Znpq9wAAAYg"]
[Mon Feb 23 19:45:02.965661 2026] [:error] [pid 25380:tid 25396] [client 74.248.144.152:25723] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lanka.php"] [unique_id "aZw9vqKrc8yFQ8fy78ot9wAAAM4"]
[Mon Feb 23 19:45:03.490337 2026] [:error] [pid 25380:tid 25393] [client 74.248.144.152:30894] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/knmt.php"] [unique_id "aZw9v6Krc8yFQ8fy78ot_AAAAMs"]
[Mon Feb 23 19:45:04.051082 2026] [:error] [pid 25294:tid 25351] [client 74.248.144.152:39687] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/knmt.php"] [unique_id "aZw9wCRCFB3CqIo_jfbdGwAAAEk"]
[Mon Feb 23 19:45:04.593879 2026] [:error] [pid 25380:tid 25400] [client 74.248.144.152:34581] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/knmt.php"] [unique_id "aZw9wKKrc8yFQ8fy78ouBQAAANI"]
[Mon Feb 23 19:45:05.103571 2026] [:error] [pid 39540:tid 39593] [client 74.248.144.152:23564] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/knmt.php"] [unique_id "aZw9wbsgm9aTWhlRScKn8gAAAdg"]
[Mon Feb 23 19:45:05.635250 2026] [:error] [pid 25380:tid 25392] [client 74.248.144.152:39724] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZw9waKrc8yFQ8fy78ouCwAAAMo"]
[Mon Feb 23 19:45:06.155009 2026] [:error] [pid 25295:tid 25337] [client 74.248.144.152:21155] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZw9wo2Av4J1Jnqi7yLAsAAAAIY"]
[Mon Feb 23 19:45:06.683659 2026] [:error] [pid 39639:tid 39651] [client 74.248.144.152:39695] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZw9whpFkMoMi8uTUUO5xQAAAkg"]
[Mon Feb 23 19:45:07.231926 2026] [:error] [pid 39639:tid 39644] [client 74.248.144.152:33483] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aZw9wxpFkMoMi8uTUUO5yAAAAkE"]
[Mon Feb 23 19:45:07.771551 2026] [:error] [pid 25380:tid 25400] [client 74.248.144.152:21182] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lkui.php"] [unique_id "aZw9w6Krc8yFQ8fy78ouFgAAANI"]
[Mon Feb 23 19:45:08.322594 2026] [:error] [pid 25380:tid 25396] [client 74.248.144.152:30879] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lkui.php"] [unique_id "aZw9xKKrc8yFQ8fy78ouGwAAAM4"]
[Mon Feb 23 19:45:08.876100 2026] [:error] [pid 25294:tid 25375] [client 74.248.144.152:39688] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lkui.php"] [unique_id "aZw9xCRCFB3CqIo_jfbdIgAAAFY"]
[Mon Feb 23 19:45:09.411653 2026] [:error] [pid 39639:tid 39654] [client 74.248.144.152:21120] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lkui.php"] [unique_id "aZw9xRpFkMoMi8uTUUO5ywAAAks"]
[Mon Feb 23 19:45:09.975972 2026] [:error] [pid 39639:tid 39661] [client 74.248.144.152:30853] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aZw9xRpFkMoMi8uTUUO5zwAAAlI"]
[Mon Feb 23 19:45:10.515015 2026] [:error] [pid 39540:tid 39573] [client 74.248.144.152:30863] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aZw9xrsgm9aTWhlRScKoAwAAAcQ"]
[Mon Feb 23 19:45:11.026211 2026] [:error] [pid 39540:tid 39574] [client 74.248.144.152:30871] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aZw9x7sgm9aTWhlRScKoCQAAAcU"]
[Mon Feb 23 19:45:11.704590 2026] [:error] [pid 39540:tid 39571] [client 74.248.144.152:23594] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aZw9x7sgm9aTWhlRScKoDQAAAcI"]
[Mon Feb 23 19:45:12.248299 2026] [:error] [pid 39540:tid 39575] [client 74.248.144.152:25682] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aZw9yLsgm9aTWhlRScKoEAAAAcY"]
[Mon Feb 23 19:45:12.770722 2026] [:error] [pid 25380:tid 25395] [client 74.248.144.152:38827] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aZw9yKKrc8yFQ8fy78ouNgAAAM0"]
[Mon Feb 23 19:45:13.288437 2026] [:error] [pid 39540:tid 39584] [client 74.248.144.152:33488] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aZw9ybsgm9aTWhlRScKoEwAAAc8"]
[Mon Feb 23 19:45:13.806365 2026] [:error] [pid 39504:tid 39523] [client 74.248.144.152:38829] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aZw9yXLcHpOlI9gwwJoXFwAAAVE"]
[Mon Feb 23 19:45:14.379308 2026] [:error] [pid 25294:tid 25370] [client 74.248.144.152:33525] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "aZw9yiRCFB3CqIo_jfbdLQAAAFI"]
[Mon Feb 23 19:45:14.888662 2026] [:error] [pid 39639:tid 39665] [client 74.248.144.152:25187] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "aZw9yhpFkMoMi8uTUUO50AAAAlY"]
[Mon Feb 23 19:45:15.401884 2026] [:error] [pid 39639:tid 39660] [client 74.248.144.152:21131] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "aZw9yxpFkMoMi8uTUUO50wAAAlE"]
[Mon Feb 23 19:45:15.912991 2026] [:error] [pid 39504:tid 39520] [client 74.248.144.152:28228] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "aZw9y3LcHpOlI9gwwJoXGgAAAU4"]
[Mon Feb 23 19:45:16.424904 2026] [:error] [pid 39540:tid 39579] [client 74.248.144.152:38826] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aZw9zLsgm9aTWhlRScKoHAAAAco"]
[Mon Feb 23 19:45:16.938941 2026] [:error] [pid 25294:tid 25360] [client 74.248.144.152:25172] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aZw9zCRCFB3CqIo_jfbdMAAAAE0"]
[Mon Feb 23 19:45:17.483603 2026] [:error] [pid 25293:tid 25302] [client 74.248.144.152:25690] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aZw9zeL9XfBf66iHi_ep8wAAAAM"]
[Mon Feb 23 19:45:18.008049 2026] [:error] [pid 39640:tid 39672] [client 74.248.144.152:33510] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/easy.php"] [unique_id "aZw9ztsK--eVCgzvvufYMQAAAoI"]
[Mon Feb 23 19:45:18.519524 2026] [:error] [pid 25294:tid 25350] [client 74.248.144.152:33477] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aZw9ziRCFB3CqIo_jfbdNAAAAEg"]
[Mon Feb 23 19:45:19.030536 2026] [:error] [pid 39538:tid 39560] [client 74.248.144.152:25707] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aZw9zy4Zk8-cQOG3Znpq-wAAAZI"]
[Mon Feb 23 19:45:19.559346 2026] [:error] [pid 39538:tid 39547] [client 74.248.144.152:25188] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aZw9zy4Zk8-cQOG3Znpq_gAAAYU"]
[Mon Feb 23 19:45:20.068339 2026] [:error] [pid 25293:tid 25318] [client 74.248.144.152:50826] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s1.php"] [unique_id "aZw90OL9XfBf66iHi_ep9gAAABM"]
[Mon Feb 23 19:45:20.577869 2026] [:error] [pid 25380:tid 25400] [client 74.248.144.152:24474] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "aZw90KKrc8yFQ8fy78ouWQAAANI"]
[Mon Feb 23 19:45:21.126102 2026] [:error] [pid 39538:tid 39566] [client 74.248.144.152:36312] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "aZw90S4Zk8-cQOG3ZnprAgAAAZg"]
[Mon Feb 23 19:45:21.717553 2026] [:error] [pid 39640:tid 39674] [client 74.248.144.152:24453] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "aZw90dsK--eVCgzvvufYNQAAAoQ"]
[Mon Feb 23 19:45:22.245423 2026] [:error] [pid 39640:tid 39676] [client 74.248.144.152:35659] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "aZw90tsK--eVCgzvvufYOAAAAoY"]
[Mon Feb 23 19:45:22.806491 2026] [:error] [pid 25294:tid 25366] [client 74.248.144.152:23504] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/06.php"] [unique_id "aZw90iRCFB3CqIo_jfbdNwAAAFA"]
[Mon Feb 23 19:45:23.350860 2026] [:error] [pid 39640:tid 39682] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Mon Feb 23 19:45:23.608915 2026] [:error] [pid 39640:tid 39687] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Mon Feb 23 19:45:23.870659 2026] [:error] [pid 39640:tid 39691] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Mon Feb 23 19:45:24.131185 2026] [:error] [pid 39640:tid 39673] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/xxw.php
[Mon Feb 23 19:45:24.392510 2026] [:error] [pid 39640:tid 39692] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Mon Feb 23 19:45:24.653778 2026] [:error] [pid 39640:tid 39681] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Mon Feb 23 19:45:24.915918 2026] [:error] [pid 39640:tid 39690] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon Feb 23 19:45:25.244588 2026] [:error] [pid 39640:tid 39671] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Mon Feb 23 19:45:25.503658 2026] [:error] [pid 39640:tid 39670] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/ccu.php
[Mon Feb 23 19:45:25.773135 2026] [:error] [pid 39640:tid 39684] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Mon Feb 23 19:45:26.049018 2026] [:error] [pid 39640:tid 39682] [client 74.248.144.152:27928] File does not exist: /usr/local/apache/htdocs/suspended-page/xsox.php
[Mon Feb 23 19:45:26.321767 2026] [:error] [pid 39640:tid 39687] [client 74.248.144.152:27928] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZw91tsK--eVCgzvvufYTAAAApE"]
[Mon Feb 23 19:45:26.872621 2026] [:error] [pid 39504:tid 39519] [client 74.248.144.152:21248] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZw91nLcHpOlI9gwwJoXIAAAAU0"]
[Mon Feb 23 19:45:27.428378 2026] [:error] [pid 25294:tid 25343] [client 74.248.144.152:23589] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZw91yRCFB3CqIo_jfbdOgAAAEU"]
[Mon Feb 23 19:45:28.003598 2026] [:error] [pid 25294:tid 25370] [client 74.248.144.152:30884] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "aZw92CRCFB3CqIo_jfbdPAAAAFI"]
[Mon Feb 23 19:45:28.528329 2026] [:error] [pid 29909:tid 29923] [client 74.248.144.152:26743] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aZw92D9oc2QzltksUk7ZQAAAAQw"]
[Mon Feb 23 19:45:29.070442 2026] [:error] [pid 39504:tid 39512] [client 74.248.144.152:35675] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aZw92XLcHpOlI9gwwJoXIQAAAUY"]
[Mon Feb 23 19:45:29.595808 2026] [:error] [pid 39538:tid 39561] [client 74.248.144.152:50831] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aZw92S4Zk8-cQOG3ZnprCQAAAZM"]
[Mon Feb 23 19:45:30.106456 2026] [:error] [pid 25294:tid 25364] [client 74.248.144.152:25200] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aZw92iRCFB3CqIo_jfbdQAAAAE8"]
[Mon Feb 23 19:45:30.637402 2026] [:error] [pid 39504:tid 39528] [client 74.248.144.152:24508] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "aZw92nLcHpOlI9gwwJoXJQAAAVY"]
[Mon Feb 23 19:45:31.157302 2026] [:error] [pid 25294:tid 25334] [client 74.248.144.152:30895] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "aZw92yRCFB3CqIo_jfbdQgAAAEM"]
[Mon Feb 23 19:45:31.670542 2026] [:error] [pid 25294:tid 25362] [client 74.248.144.152:25715] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "aZw92yRCFB3CqIo_jfbdRQAAAE4"]
[Mon Feb 23 19:45:32.215961 2026] [:error] [pid 25294:tid 25351] [client 74.248.144.152:23490] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "aZw93CRCFB3CqIo_jfbdSAAAAEk"]
[Mon Feb 23 19:45:32.743212 2026] [:error] [pid 39540:tid 39575] [client 74.248.144.152:50855] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZw93Lsgm9aTWhlRScKoKAAAAcY"]
[Mon Feb 23 19:45:33.286012 2026] [:error] [pid 39640:tid 39691] [client 74.248.144.152:21306] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZw93dsK--eVCgzvvufYTQAAApU"]
[Mon Feb 23 19:45:33.797532 2026] [:error] [pid 39538:tid 39542] [client 74.248.144.152:25165] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZw93S4Zk8-cQOG3ZnprDgAAAYA"]
[Mon Feb 23 19:45:34.325073 2026] [:error] [pid 39540:tid 39585] [client 74.248.144.152:25192] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoo.php"] [unique_id "aZw93rsgm9aTWhlRScKoKwAAAdA"]
[Mon Feb 23 19:45:34.843579 2026] [:error] [pid 25295:tid 25359] [client 74.248.144.152:27925] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxekqlxb.php"] [unique_id "aZw93o2Av4J1Jnqi7yLAtAAAAJM"]
[Mon Feb 23 19:45:35.415374 2026] [:error] [pid 39538:tid 39550] [client 74.248.144.152:24486] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxekqlxb.php"] [unique_id "aZw93y4Zk8-cQOG3ZnprDwAAAYg"]
[Mon Feb 23 19:45:35.944064 2026] [:error] [pid 25295:tid 25353] [client 74.248.144.152:20506] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxekqlxb.php"] [unique_id "aZw9342Av4J1Jnqi7yLAtgAAAJA"]
[Mon Feb 23 19:45:36.524146 2026] [:error] [pid 39640:tid 39673] [client 74.248.144.152:50852] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxekqlxb.php"] [unique_id "aZw94NsK--eVCgzvvufYTwAAAoM"]
[Mon Feb 23 19:45:37.111874 2026] [:error] [pid 39639:tid 39655] [client 74.248.144.152:50843] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scr1pts.php"] [unique_id "aZw94RpFkMoMi8uTUUO56wAAAkw"]
[Mon Feb 23 19:45:37.682630 2026] [:error] [pid 25294:tid 25351] [client 74.248.144.152:30022] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scr1pts.php"] [unique_id "aZw94SRCFB3CqIo_jfbdVAAAAEk"]
[Mon Feb 23 19:45:38.357176 2026] [:error] [pid 39504:tid 39506] [client 74.248.144.152:49527] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scr1pts.php"] [unique_id "aZw94nLcHpOlI9gwwJoXKAAAAUA"]
[Mon Feb 23 19:45:38.900410 2026] [:error] [pid 25295:tid 25339] [client 74.248.144.152:36169] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scr1pts.php"] [unique_id "aZw94o2Av4J1Jnqi7yLAugAAAIg"]
[Mon Feb 23 19:45:39.542066 2026] [:error] [pid 39538:tid 39543] [client 74.248.144.152:36215] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "aZw94y4Zk8-cQOG3ZnprFQAAAYE"]
[Mon Feb 23 19:45:40.143454 2026] [:error] [pid 39538:tid 39556] [client 74.248.144.152:36202] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "aZw95C4Zk8-cQOG3ZnprGgAAAY4"]
[Mon Feb 23 19:45:40.809940 2026] [:error] [pid 39639:tid 39659] [client 74.248.144.152:37097] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "aZw95BpFkMoMi8uTUUO57wAAAlA"]
[Mon Feb 23 19:45:41.347528 2026] [:error] [pid 39639:tid 39650] [client 74.248.144.152:23530] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "aZw95RpFkMoMi8uTUUO59AAAAkc"]
[Mon Feb 23 19:45:41.891323 2026] [:error] [pid 25294:tid 25345] [client 74.248.144.152:37086] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZw95SRCFB3CqIo_jfbdXAAAAEY"]
[Mon Feb 23 19:45:42.441265 2026] [:error] [pid 25295:tid 25338] [client 74.248.144.152:24755] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZw95o2Av4J1Jnqi7yLAvgAAAIc"]
[Mon Feb 23 19:45:43.007755 2026] [:error] [pid 25294:tid 25362] [client 74.248.144.152:37085] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZw95yRCFB3CqIo_jfbdYgAAAE4"]
[Mon Feb 23 19:45:43.552322 2026] [:error] [pid 39640:tid 39674] [client 74.248.144.152:24753] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aZw959sK--eVCgzvvufYVAAAAoQ"]
[Mon Feb 23 19:45:44.084834 2026] [:error] [pid 25294:tid 25360] [client 74.248.144.152:21264] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aZw96CRCFB3CqIo_jfbdbQAAAE0"]
[Mon Feb 23 19:45:44.600483 2026] [:error] [pid 25380:tid 25404] [client 74.248.144.152:26738] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aZw96KKrc8yFQ8fy78oufQAAANY"]
[Mon Feb 23 19:45:45.125007 2026] [:error] [pid 25294:tid 25351] [client 74.248.144.152:30118] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aZw96SRCFB3CqIo_jfbdcwAAAEk"]
[Mon Feb 23 19:45:45.647243 2026] [:error] [pid 25294:tid 25356] [client 74.248.144.152:24731] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "aZw96SRCFB3CqIo_jfbdeAAAAEs"]
[Mon Feb 23 19:45:46.176026 2026] [:error] [pid 25380:tid 25403] [client 74.248.144.152:26700] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6bcwiqwj.php"] [unique_id "aZw96qKrc8yFQ8fy78ougAAAANU"]
[Mon Feb 23 19:45:46.765245 2026] [:error] [pid 25294:tid 25376] [client 74.248.144.152:49481] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6bcwiqwj.php"] [unique_id "aZw96iRCFB3CqIo_jfbdewAAAFc"]
[Mon Feb 23 19:45:47.328598 2026] [:error] [pid 29909:tid 29917] [client 74.248.144.152:36183] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6bcwiqwj.php"] [unique_id "aZw96z9oc2QzltksUk7ZXAAAAQY"]
[Mon Feb 23 19:45:47.851560 2026] [:error] [pid 39639:tid 39662] [client 74.248.144.152:30086] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6bcwiqwj.php"] [unique_id "aZw96xpFkMoMi8uTUUO6BwAAAlM"]
[Mon Feb 23 19:45:48.438073 2026] [:error] [pid 39640:tid 39686] [client 74.248.144.152:24732] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aZw97NsK--eVCgzvvufYWgAAApA"]
[Mon Feb 23 19:45:49.004256 2026] [:error] [pid 39538:tid 39557] [client 74.248.144.152:35145] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aZw97S4Zk8-cQOG3ZnprHgAAAY8"]
[Mon Feb 23 19:45:49.535422 2026] [:error] [pid 25295:tid 25365] [client 74.248.144.152:25276] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aZw97Y2Av4J1Jnqi7yLAwQAAAJY"]
[Mon Feb 23 19:45:50.065021 2026] [:error] [pid 25380:tid 25398] [client 74.248.144.152:37068] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mar.php"] [unique_id "aZw97qKrc8yFQ8fy78ougQAAANA"]
[Mon Feb 23 19:45:50.581720 2026] [:error] [pid 39538:tid 39545] [client 74.248.144.152:24749] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZw97i4Zk8-cQOG3ZnprIAAAAYM"]
[Mon Feb 23 19:45:51.101118 2026] [:error] [pid 39504:tid 39516] [client 74.248.144.152:34525] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZw973LcHpOlI9gwwJoXNAAAAUo"]
[Mon Feb 23 19:45:51.717861 2026] [:error] [pid 39540:tid 39584] [client 74.248.144.152:20367] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZw977sgm9aTWhlRScKoPAAAAc8"]
[Mon Feb 23 19:45:52.244643 2026] [:error] [pid 39504:tid 39509] [client 74.248.144.152:37969] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws69.php"] [unique_id "aZw98HLcHpOlI9gwwJoXOAAAAUM"]
[Mon Feb 23 19:45:52.784560 2026] [:error] [pid 39639:tid 39648] [client 74.248.144.152:37983] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "aZw98BpFkMoMi8uTUUO6DAAAAkU"]
[Mon Feb 23 19:45:53.336897 2026] [:error] [pid 39639:tid 39660] [client 74.248.144.152:37731] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "aZw98RpFkMoMi8uTUUO6DwAAAlE"]
[Mon Feb 23 19:45:53.866572 2026] [:error] [pid 25293:tid 25312] [client 74.248.144.152:20411] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "aZw98eL9XfBf66iHi_ep_gAAAA0"]
[Mon Feb 23 19:45:54.403214 2026] [:error] [pid 29909:tid 29934] [client 74.248.144.152:37980] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "aZw98j9oc2QzltksUk7ZYgAAARc"]
[Mon Feb 23 19:45:54.953953 2026] [:error] [pid 25295:tid 25347] [client 74.248.144.152:20386] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZw98o2Av4J1Jnqi7yLAygAAAI0"]
[Mon Feb 23 19:45:55.494433 2026] [:error] [pid 25295:tid 25335] [client 74.248.144.152:20662] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZw9842Av4J1Jnqi7yLA0AAAAIQ"]
[Mon Feb 23 19:45:56.019011 2026] [:error] [pid 25380:tid 25404] [client 74.248.144.152:38000] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZw99KKrc8yFQ8fy78oujAAAANY"]
[Mon Feb 23 19:45:56.558048 2026] [:error] [pid 25295:tid 25357] [client 74.248.144.152:33042] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aZw99I2Av4J1Jnqi7yLA0gAAAJI"]
[Mon Feb 23 19:45:57.086922 2026] [:error] [pid 39540:tid 39591] [client 74.248.144.152:25228] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZw99bsgm9aTWhlRScKoQAAAAdY"]
[Mon Feb 23 19:45:57.601910 2026] [:error] [pid 39639:tid 39656] [client 74.248.144.152:36717] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZw99RpFkMoMi8uTUUO6FQAAAk0"]
[Mon Feb 23 19:45:58.124663 2026] [:error] [pid 29909:tid 29927] [client 74.248.144.152:36513] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZw99j9oc2QzltksUk7ZaQAAARA"]
[Mon Feb 23 19:45:58.653920 2026] [:error] [pid 39504:tid 39524] [client 74.248.144.152:35880] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aZw99nLcHpOlI9gwwJoXPAAAAVI"]
[Mon Feb 23 19:45:59.170614 2026] [:error] [pid 25294:tid 25364] [client 74.248.144.152:35893] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZw99yRCFB3CqIo_jfbdfwAAAE8"]
[Mon Feb 23 19:45:59.692989 2026] [:error] [pid 39639:tid 39660] [client 74.248.144.152:36536] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZw99xpFkMoMi8uTUUO6HgAAAlE"]
[Mon Feb 23 19:46:00.202736 2026] [:error] [pid 25295:tid 25359] [client 74.248.144.152:36540] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZw9-I2Av4J1Jnqi7yLA1QAAAJM"]
[Mon Feb 23 19:46:00.712649 2026] [:error] [pid 29909:tid 29929] [client 74.248.144.152:26146] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZw9-D9oc2QzltksUk7ZawAAARI"]
[Mon Feb 23 19:46:01.243866 2026] [:error] [pid 29909:tid 29922] [client 74.248.144.152:23946] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-link10.php"] [unique_id "aZw9-T9oc2QzltksUk7ZbQAAAQs"]
[Mon Feb 23 19:46:01.771503 2026] [:error] [pid 39540:tid 39572] [client 74.248.144.152:23941] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-link10.php"] [unique_id "aZw9-bsgm9aTWhlRScKoRQAAAcM"]
[Mon Feb 23 19:46:02.303307 2026] [:error] [pid 39639:tid 39663] [client 74.248.144.152:28475] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-link10.php"] [unique_id "aZw9-hpFkMoMi8uTUUO6IgAAAlQ"]
[Mon Feb 23 19:46:02.838500 2026] [:error] [pid 25294:tid 25330] [client 74.248.144.152:26148] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-link10.php"] [unique_id "aZw9-iRCFB3CqIo_jfbdgwAAAEE"]
[Mon Feb 23 19:46:03.361293 2026] [:error] [pid 39540:tid 39578] [client 74.248.144.152:33555] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZw9-7sgm9aTWhlRScKoSgAAAck"]
[Mon Feb 23 19:46:03.885006 2026] [:error] [pid 39540:tid 39592] [client 74.248.144.152:28436] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZw9-7sgm9aTWhlRScKoTAAAAdc"]
[Mon Feb 23 19:46:04.543659 2026] [:error] [pid 39540:tid 39569] [client 74.248.144.152:34138] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZw9_Lsgm9aTWhlRScKoUQAAAcA"]
[Mon Feb 23 19:46:05.121121 2026] [:error] [pid 29909:tid 29914] [client 74.248.144.152:47302] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZw9_T9oc2QzltksUk7ZdQAAAQM"]
[Mon Feb 23 19:46:05.687294 2026] [:error] [pid 25295:tid 25355] [client 74.248.144.152:38217] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZw9_Y2Av4J1Jnqi7yLA3QAAAJE"]
[Mon Feb 23 19:46:06.220058 2026] [:error] [pid 39639:tid 39656] [client 74.248.144.152:20842] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZw9_hpFkMoMi8uTUUO6JAAAAk0"]
[Mon Feb 23 19:46:06.830010 2026] [:error] [pid 25295:tid 25339] [client 74.248.144.152:28877] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZw9_o2Av4J1Jnqi7yLA4AAAAIg"]
[Mon Feb 23 19:46:07.439495 2026] [:error] [pid 25295:tid 25337] [client 74.248.144.152:33297] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aZw9_42Av4J1Jnqi7yLA5AAAAIY"]
[Mon Feb 23 19:46:08.003584 2026] [:error] [pid 29909:tid 29921] [client 74.248.144.152:26900] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aZw-AD9oc2QzltksUk7ZeQAAAQo"]
[Mon Feb 23 19:46:08.666216 2026] [:error] [pid 39639:tid 39658] [client 74.248.144.152:26934] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aZw-ABpFkMoMi8uTUUO6MwAAAk8"]
[Mon Feb 23 19:46:09.288263 2026] [:error] [pid 39639:tid 39653] [client 74.248.144.152:33295] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aZw-ARpFkMoMi8uTUUO6NwAAAko"]
[Mon Feb 23 19:46:09.885665 2026] [:error] [pid 39639:tid 39647] [client 74.248.144.152:35261] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aZw-ARpFkMoMi8uTUUO6OgAAAkQ"]
[Mon Feb 23 19:46:10.433323 2026] [:error] [pid 39639:tid 39644] [client 74.248.144.152:33328] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aZw-AhpFkMoMi8uTUUO6PwAAAkE"]
[Mon Feb 23 19:46:11.025047 2026] [:error] [pid 39639:tid 39649] [client 74.248.144.152:28871] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aZw-AxpFkMoMi8uTUUO6RgAAAkY"]
[Mon Feb 23 19:46:11.642294 2026] [:error] [pid 39540:tid 39593] [client 74.248.144.152:37179] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aZw-A7sgm9aTWhlRScKoVQAAAdg"]
[Mon Feb 23 19:46:12.333388 2026] [:error] [pid 25294:tid 25345] [client 74.248.144.152:35262] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "aZw-BCRCFB3CqIo_jfbdjAAAAEY"]
[Mon Feb 23 19:46:12.996194 2026] [:error] [pid 39639:tid 39653] [client 74.248.144.152:23070] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aZw-BBpFkMoMi8uTUUO6UwAAAko"]
[Mon Feb 23 19:46:13.619562 2026] [:error] [pid 39540:tid 39571] [client 74.248.144.152:34134] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aZw-Bbsgm9aTWhlRScKoVgAAAcI"]
[Mon Feb 23 19:46:14.175472 2026] [:error] [pid 39540:tid 39582] [client 74.248.144.152:40793] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aZw-Brsgm9aTWhlRScKoWwAAAc0"]
[Mon Feb 23 19:46:14.717802 2026] [:error] [pid 39540:tid 39569] [client 74.248.144.152:35233] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aZw-Brsgm9aTWhlRScKoYwAAAcA"]
[Mon Feb 23 19:46:15.295451 2026] [:error] [pid 39639:tid 39653] [client 74.248.144.152:31986] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xr.php"] [unique_id "aZw-BxpFkMoMi8uTUUO6YwAAAko"]
[Mon Feb 23 19:46:15.862166 2026] [:error] [pid 39640:tid 39675] [client 74.248.144.152:38571] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xr.php"] [unique_id "aZw-B9sK--eVCgzvvufYYgAAAoU"]
[Mon Feb 23 19:46:16.426792 2026] [:error] [pid 39504:tid 39528] [client 74.248.144.152:27989] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xr.php"] [unique_id "aZw-CHLcHpOlI9gwwJoXQAAAAVY"]
[Mon Feb 23 19:46:16.967016 2026] [:error] [pid 39639:tid 39659] [client 74.248.144.152:31980] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xr.php"] [unique_id "aZw-CBpFkMoMi8uTUUO6cwAAAlA"]
[Mon Feb 23 19:46:17.490676 2026] [:error] [pid 39504:tid 39523] [client 74.248.144.152:33331] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZw-CXLcHpOlI9gwwJoXQgAAAVE"]
[Mon Feb 23 19:46:18.010020 2026] [:error] [pid 29909:tid 29924] [client 74.248.144.152:37135] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZw-Cj9oc2QzltksUk7ZfAAAAQ0"]
[Mon Feb 23 19:46:18.639560 2026] [:error] [pid 39639:tid 39654] [client 74.248.144.152:37287] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZw-ChpFkMoMi8uTUUO6ewAAAks"]
[Mon Feb 23 19:46:19.214471 2026] [:error] [pid 39639:tid 39660] [client 74.248.144.152:37159] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "aZw-CxpFkMoMi8uTUUO6ggAAAlE"]
[Mon Feb 23 19:46:19.825740 2026] [:error] [pid 25380:tid 25386] [client 74.248.144.152:37175] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aZw-C6Krc8yFQ8fy78ouoAAAAMQ"]
[Mon Feb 23 19:46:20.445263 2026] [:error] [pid 39538:tid 39566] [client 74.248.144.152:37305] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aZw-DC4Zk8-cQOG3ZnprOAAAAZg"]
[Mon Feb 23 19:46:20.969875 2026] [:error] [pid 25294:tid 25356] [client 74.248.144.152:20685] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aZw-DCRCFB3CqIo_jfbdlAAAAEs"]
[Mon Feb 23 19:46:21.568182 2026] [:error] [pid 29909:tid 29933] [client 74.248.144.152:34238] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aZw-DT9oc2QzltksUk7ZgwAAARY"]
[Mon Feb 23 19:46:22.103977 2026] [:error] [pid 25380:tid 25402] [client 74.248.144.152:30494] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZw-DqKrc8yFQ8fy78ouowAAANQ"]
[Mon Feb 23 19:46:22.648181 2026] [:error] [pid 29909:tid 29931] [client 74.248.144.152:25473] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZw-Dj9oc2QzltksUk7ZhAAAARQ"]
[Mon Feb 23 19:46:23.261502 2026] [:error] [pid 39640:tid 39689] [client 74.248.144.152:20719] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZw-D9sK--eVCgzvvufYaQAAApM"]
[Mon Feb 23 19:46:23.820947 2026] [:error] [pid 39504:tid 39526] [client 74.248.144.152:37803] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aZw-D3LcHpOlI9gwwJoXSAAAAVQ"]
[Mon Feb 23 19:46:24.503461 2026] [:error] [pid 39640:tid 39691] [client 74.248.144.152:32800] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2a2ck.php"] [unique_id "aZw-ENsK--eVCgzvvufYcAAAApU"]
[Mon Feb 23 19:46:25.074626 2026] [:error] [pid 25295:tid 25355] [client 74.248.144.152:31165] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2a2ck.php"] [unique_id "aZw-EY2Av4J1Jnqi7yLA6wAAAJE"]
[Mon Feb 23 19:46:25.675555 2026] [:error] [pid 25295:tid 25347] [client 74.248.144.152:30491] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2a2ck.php"] [unique_id "aZw-EY2Av4J1Jnqi7yLA7AAAAI0"]
[Mon Feb 23 19:46:26.348036 2026] [:error] [pid 39639:tid 39648] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/h2a2ck.php
[Mon Feb 23 19:46:26.624940 2026] [:error] [pid 39639:tid 39646] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/cytyr.php
[Mon Feb 23 19:46:26.901152 2026] [:error] [pid 39639:tid 39667] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/h02ugyh.php
[Mon Feb 23 19:46:27.170997 2026] [:error] [pid 39639:tid 39655] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Mon Feb 23 19:46:27.426822 2026] [:error] [pid 39639:tid 39643] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Mon Feb 23 19:46:27.753920 2026] [:error] [pid 39639:tid 39659] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/ava.php
[Mon Feb 23 19:46:28.932847 2026] [:error] [pid 39639:tid 39659] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/balin.php
[Mon Feb 23 19:46:29.190451 2026] [:error] [pid 39639:tid 39654] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/0x19493QU8ZQ.php
[Mon Feb 23 19:46:29.447754 2026] [:error] [pid 39639:tid 39664] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/13ede.php
[Mon Feb 23 19:46:29.704757 2026] [:error] [pid 39639:tid 39643] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/akhvg.php
[Mon Feb 23 19:46:29.963509 2026] [:error] [pid 39639:tid 39656] [client 74.248.144.152:36786] File does not exist: /usr/local/apache/htdocs/suspended-page/assacc.php
[Mon Feb 23 19:46:30.218092 2026] [:error] [pid 39639:tid 39645] [client 74.248.144.152:36786] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xy.php"] [unique_id "aZw-FhpFkMoMi8uTUUO6qwAAAkI"]
[Mon Feb 23 19:46:30.782720 2026] [:error] [pid 25380:tid 25398] [client 74.248.144.152:30502] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xy.php"] [unique_id "aZw-FqKrc8yFQ8fy78ousgAAANA"]
[Mon Feb 23 19:46:31.427911 2026] [:error] [pid 39640:tid 39677] [client 74.248.144.152:36757] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xy.php"] [unique_id "aZw-F9sK--eVCgzvvufYfwAAAoc"]
[Mon Feb 23 19:46:31.978907 2026] [:error] [pid 39639:tid 39661] [client 74.248.144.152:37783] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xy.php"] [unique_id "aZw-FxpFkMoMi8uTUUO6rwAAAlI"]
[Mon Feb 23 19:46:32.585886 2026] [:error] [pid 25294:tid 25364] [client 74.248.144.152:31167] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aZw-GCRCFB3CqIo_jfbdnQAAAE8"]
[Mon Feb 23 19:46:33.176531 2026] [:error] [pid 25380:tid 25383] [client 74.248.144.152:30815] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aZw-GaKrc8yFQ8fy78outgAAAME"]
[Mon Feb 23 19:46:33.802477 2026] [:error] [pid 39639:tid 39655] [client 74.248.144.152:37793] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aZw-GRpFkMoMi8uTUUO6tQAAAkw"]
[Mon Feb 23 19:46:34.473298 2026] [:error] [pid 39504:tid 39529] [client 74.248.144.152:30787] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "aZw-GnLcHpOlI9gwwJoXSwAAAVc"]
[Mon Feb 23 19:46:35.113468 2026] [:error] [pid 25293:tid 25320] [client 74.248.144.152:22671] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw-G-L9XfBf66iHi_eqCQAAABU"]
[Mon Feb 23 19:46:35.707458 2026] [:error] [pid 39540:tid 39573] [client 74.248.144.152:35283] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw-G7sgm9aTWhlRScKooAAAAcQ"]
[Mon Feb 23 19:46:36.244652 2026] [:error] [pid 39639:tid 39656] [client 74.248.144.152:37191] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw-HBpFkMoMi8uTUUO6uAAAAk0"]
[Mon Feb 23 19:46:36.867093 2026] [:error] [pid 39640:tid 39679] [client 74.248.144.152:22688] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aZw-HNsK--eVCgzvvufYhgAAAok"]
[Mon Feb 23 19:46:37.491152 2026] [:error] [pid 39538:tid 39542] [client 74.248.144.152:20555] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jnhddqyz.php"] [unique_id "aZw-HS4Zk8-cQOG3ZnprRAAAAYA"]
[Mon Feb 23 19:46:38.126976 2026] [:error] [pid 39540:tid 39591] [client 74.248.144.152:30817] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jnhddqyz.php"] [unique_id "aZw-Hrsgm9aTWhlRScKopQAAAdY"]
[Mon Feb 23 19:46:38.685720 2026] [:error] [pid 39540:tid 39582] [client 74.248.144.152:30840] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jnhddqyz.php"] [unique_id "aZw-Hrsgm9aTWhlRScKoqgAAAc0"]
[Mon Feb 23 19:46:39.258572 2026] [:error] [pid 39540:tid 39588] [client 74.248.144.152:31122] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jnhddqyz.php"] [unique_id "aZw-H7sgm9aTWhlRScKorQAAAdM"]
[Mon Feb 23 19:46:39.883709 2026] [:error] [pid 25380:tid 25391] [client 74.248.144.152:37765] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin_bkp.php"] [unique_id "aZw-H6Krc8yFQ8fy78ouywAAAMk"]
[Mon Feb 23 19:46:40.442818 2026] [:error] [pid 39640:tid 39685] [client 74.248.144.152:31138] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin_bkp.php"] [unique_id "aZw-INsK--eVCgzvvufYiQAAAo8"]
[Mon Feb 23 19:46:41.113077 2026] [:error] [pid 25380:tid 25386] [client 74.248.144.152:25495] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin_bkp.php"] [unique_id "aZw-IaKrc8yFQ8fy78ou0AAAAMQ"]
[Mon Feb 23 19:46:41.626728 2026] [:error] [pid 39540:tid 39592] [client 74.248.144.152:26393] [client 74.248.144.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin_bkp.php"] [unique_id "aZw-Ibsgm9aTWhlRScKouwAAAdc"]
[Mon Feb 23 21:28:31.591709 2026] [:error] [pid 39640:tid 39675] [client 31.184.236.37:32796] [client 31.184.236.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "aZxV_9sK--eVCgzvvufoRAAAAoU"]
[Tue Feb 24 03:38:45.867747 2026] [:error] [pid 60063:tid 60069] [client 49.207.60.182:33177] [client 49.207.60.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.60.182, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZysxU_6t1uQomVVdUOpFgAAAQQ"]
[Tue Feb 24 03:38:45.873039 2026] [:error] [pid 60063:tid 60069] [client 49.207.60.182:33177] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Feb 24 07:35:40.417711 2026] [:error] [pid 41188:tid 41201] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Tue Feb 24 07:35:40.636260 2026] [:error] [pid 41188:tid 41196] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Feb 24 07:35:41.066881 2026] [:error] [pid 41188:tid 41194] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Tue Feb 24 07:35:41.276854 2026] [:error] [pid 41188:tid 41206] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Tue Feb 24 07:35:41.608362 2026] [:error] [pid 41188:tid 41199] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Feb 24 07:35:41.819135 2026] [:error] [pid 41188:tid 41198] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Feb 24 07:35:42.280404 2026] [:error] [pid 41188:tid 41207] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Tue Feb 24 07:35:42.702495 2026] [:error] [pid 41188:tid 41208] [client 20.104.114.39:41665] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Feb 24 07:35:42.930926 2026] [:error] [pid 41188:tid 41197] [client 20.104.114.39:41665] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZzkTgWRg7szIRhA0WiMyAAAAUY"]
[Tue Feb 24 07:35:44.890945 2026] [:error] [pid 37540:tid 37606] [client 20.104.114.39:17866] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZzkUCahRAUBJS8hpJWJJAAAAIQ"]
[Tue Feb 24 07:35:46.142510 2026] [:error] [pid 41188:tid 41209] [client 20.104.114.39:41618] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZzkUgWRg7szIRhA0WiMyQAAAVI"]
[Tue Feb 24 07:35:47.504799 2026] [:error] [pid 37644:tid 37649] [client 20.104.114.39:41716] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aZzkU0LaEhVDwBRydH18EAAAAMM"]
[Tue Feb 24 07:35:48.432155 2026] [:error] [pid 11672:tid 11693] [client 20.104.114.39:17878] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZzkVPa0fhnmfPYq92vHoQAAARM"]
[Tue Feb 24 07:35:49.651658 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:41640] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZzkVSahRAUBJS8hpJWJMQAAAI8"]
[Tue Feb 24 07:35:50.689198 2026] [:error] [pid 41188:tid 41205] [client 20.104.114.39:41626] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZzkVgWRg7szIRhA0WiM2gAAAU4"]
[Tue Feb 24 07:35:51.420097 2026] [:error] [pid 37538:tid 37562] [client 20.104.114.39:17496] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aZzkVyynTiHZ9J0Y2nZ02AAAAA4"]
[Tue Feb 24 07:35:52.335533 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17531] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZzkWCahRAUBJS8hpJWJOgAAAIs"]
[Tue Feb 24 07:35:53.475731 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:41645] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZzkWSahRAUBJS8hpJWJQAAAAJQ"]
[Tue Feb 24 07:35:54.237963 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:41708] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZzkWkLaEhVDwBRydH18FAAAAMo"]
[Tue Feb 24 07:35:54.912489 2026] [:error] [pid 37540:tid 37626] [client 20.104.114.39:17864] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aZzkWiahRAUBJS8hpJWJQwAAAJg"]
[Tue Feb 24 07:35:55.608130 2026] [:error] [pid 37539:tid 37587] [client 20.104.114.39:41700] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZzkW3Enr46jUQep9z_iMgAAAEw"]
[Tue Feb 24 07:35:56.412932 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:41677] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZzkXCahRAUBJS8hpJWJRwAAAIw"]
[Tue Feb 24 07:35:57.312089 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:17911] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZzkXSahRAUBJS8hpJWJSwAAAJQ"]
[Tue Feb 24 07:35:58.022912 2026] [:error] [pid 37540:tid 37618] [client 20.104.114.39:41714] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aZzkXiahRAUBJS8hpJWJTgAAAJA"]
[Tue Feb 24 07:35:59.165803 2026] [:error] [pid 37539:tid 37577] [client 20.104.114.39:41705] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZzkX3Enr46jUQep9z_iNAAAAEI"]
[Tue Feb 24 07:36:00.966188 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:41613] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZzkYCahRAUBJS8hpJWJVgAAAI0"]
[Tue Feb 24 07:36:02.995203 2026] [:error] [pid 41188:tid 41200] [client 20.104.114.39:41715] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZzkYgWRg7szIRhA0WiM-AAAAUk"]
[Tue Feb 24 07:36:04.459510 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:41691] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aZzkZCahRAUBJS8hpJWJWQAAAIU"]
[Tue Feb 24 07:36:06.178113 2026] [:error] [pid 41188:tid 41208] [client 20.104.114.39:17919] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZzkZgWRg7szIRhA0WiNBgAAAVE"]
[Tue Feb 24 07:36:07.641726 2026] [:error] [pid 37540:tid 37624] [client 20.104.114.39:17564] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZzkZyahRAUBJS8hpJWJYQAAAJY"]
[Tue Feb 24 07:36:08.975081 2026] [:error] [pid 37538:tid 37552] [client 20.104.114.39:17896] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZzkaCynTiHZ9J0Y2nZ02wAAAAQ"]
[Tue Feb 24 07:36:10.141008 2026] [:error] [pid 11672:tid 11674] [client 20.104.114.39:17480] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aZzkava0fhnmfPYq92vHwQAAAQA"]
[Tue Feb 24 07:36:10.706655 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:17872] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZzkaiahRAUBJS8hpJWJawAAAJU"]
[Tue Feb 24 07:36:13.235311 2026] [:error] [pid 37540:tid 37618] [client 20.104.114.39:41619] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZzkbSahRAUBJS8hpJWJdQAAAJA"]
[Tue Feb 24 07:36:13.773237 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:17497] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZzkbSahRAUBJS8hpJWJeQAAAJQ"]
[Tue Feb 24 07:36:14.923194 2026] [:error] [pid 37539:tid 37595] [client 20.104.114.39:17879] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aZzkbnEnr46jUQep9z_iOgAAAFQ"]
[Tue Feb 24 07:36:15.720980 2026] [:error] [pid 37539:tid 37594] [client 20.104.114.39:41620] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZzkb3Enr46jUQep9z_iPQAAAFM"]
[Tue Feb 24 07:36:16.583433 2026] [:error] [pid 37644:tid 37662] [client 20.104.114.39:17527] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZzkcELaEhVDwBRydH18YgAAANA"]
[Tue Feb 24 07:36:18.372031 2026] [:error] [pid 41188:tid 41209] [client 20.104.114.39:17525] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZzkcgWRg7szIRhA0WiNDgAAAVI"]
[Tue Feb 24 07:36:20.570477 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:41711] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aZzkdCahRAUBJS8hpJWJmQAAAJQ"]
[Tue Feb 24 07:36:21.471855 2026] [:error] [pid 37539:tid 37576] [client 20.104.114.39:17494] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZzkdXEnr46jUQep9z_iQAAAAEE"]
[Tue Feb 24 07:36:22.198948 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:17870] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZzkdiahRAUBJS8hpJWJngAAAIw"]
[Tue Feb 24 07:36:23.492260 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:41633] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZzkdyahRAUBJS8hpJWJoQAAAJc"]
[Tue Feb 24 07:36:24.792797 2026] [:error] [pid 37540:tid 37619] [client 20.104.114.39:17502] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aZzkeCahRAUBJS8hpJWJqAAAAJE"]
[Tue Feb 24 07:36:27.170798 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:41710] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZzkeyahRAUBJS8hpJWJrgAAAII"]
[Tue Feb 24 07:36:28.123626 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:17917] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZzkfCahRAUBJS8hpJWJswAAAJQ"]
[Tue Feb 24 07:36:28.884156 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:17533] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZzkfCahRAUBJS8hpJWJtgAAAIY"]
[Tue Feb 24 07:36:29.666605 2026] [:error] [pid 37644:tid 37664] [client 20.104.114.39:41654] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aZzkfULaEhVDwBRydH18aAAAANI"]
[Tue Feb 24 07:36:30.554339 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:17536] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZzkfiahRAUBJS8hpJWJuAAAAJQ"]
[Tue Feb 24 07:36:31.534004 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:18371] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZzkfyahRAUBJS8hpJWJvwAAAJU"]
[Tue Feb 24 07:36:32.451741 2026] [:error] [pid 37540:tid 37602] [client 20.104.114.39:17490] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZzkgCahRAUBJS8hpJWJxAAAAIA"]
[Tue Feb 24 07:36:33.447958 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:17513] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aZzkgSahRAUBJS8hpJWJxwAAAIE"]
[Tue Feb 24 07:36:35.004383 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:41680] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZzkgyahRAUBJS8hpJWJywAAAI8"]
[Tue Feb 24 07:36:35.599623 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:17485] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZzkgyahRAUBJS8hpJWJzgAAAIU"]
[Tue Feb 24 07:36:36.272636 2026] [:error] [pid 37540:tid 37606] [client 20.104.114.39:41643] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZzkhCahRAUBJS8hpJWJ0wAAAIQ"]
[Tue Feb 24 07:36:37.133906 2026] [:error] [pid 37538:tid 37564] [client 20.104.114.39:41632] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aZzkhSynTiHZ9J0Y2nZ07QAAABA"]
[Tue Feb 24 07:36:37.678502 2026] [:error] [pid 37644:tid 37648] [client 20.104.114.39:41672] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZzkhULaEhVDwBRydH18agAAAMI"]
[Tue Feb 24 07:36:38.775582 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17491] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZzkhiahRAUBJS8hpJWJ5QAAAIs"]
[Tue Feb 24 07:36:39.639342 2026] [:error] [pid 37539:tid 37597] [client 20.104.114.39:17916] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZzkh3Enr46jUQep9z_iRgAAAFY"]
[Tue Feb 24 07:36:40.560992 2026] [:error] [pid 41188:tid 41209] [client 20.104.114.39:17907] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aZzkiAWRg7szIRhA0WiNRQAAAVI"]
[Tue Feb 24 07:36:41.732099 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:17499] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "aZzkiSahRAUBJS8hpJWJ6gAAAJU"]
[Tue Feb 24 07:36:42.341780 2026] [:error] [pid 37539:tid 37579] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Tue Feb 24 07:36:42.563062 2026] [:error] [pid 37539:tid 37585] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Tue Feb 24 07:36:42.927162 2026] [:error] [pid 37539:tid 37576] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Tue Feb 24 07:36:43.147280 2026] [:error] [pid 37539:tid 37596] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Feb 24 07:36:43.856881 2026] [:error] [pid 37539:tid 37586] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Feb 24 07:36:44.088366 2026] [:error] [pid 37539:tid 37583] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Feb 24 07:36:44.308627 2026] [:error] [pid 37539:tid 37581] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Feb 24 07:36:44.529746 2026] [:error] [pid 37539:tid 37589] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Feb 24 07:36:44.759614 2026] [:error] [pid 37539:tid 37598] [client 20.104.114.39:41670] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Feb 24 07:36:44.982271 2026] [:error] [pid 37539:tid 37580] [client 20.104.114.39:41670] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzkjHEnr46jUQep9z_iVQAAAEU"]
[Tue Feb 24 07:36:45.816837 2026] [:error] [pid 37538:tid 37555] [client 20.104.114.39:41610] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzkjSynTiHZ9J0Y2nZ08wAAAAc"]
[Tue Feb 24 07:36:46.658055 2026] [:error] [pid 41188:tid 41209] [client 20.104.114.39:41642] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzkjgWRg7szIRhA0WiNVQAAAVI"]
[Tue Feb 24 07:36:47.530857 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:41602] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzkjyahRAUBJS8hpJWJ-QAAAIY"]
[Tue Feb 24 07:36:48.389635 2026] [:error] [pid 37538:tid 37558] [client 20.104.114.39:17504] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZzkkCynTiHZ9J0Y2nZ0-AAAAAo"]
[Tue Feb 24 07:36:49.860944 2026] [:error] [pid 37538:tid 37564] [client 20.104.114.39:41686] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzkkSynTiHZ9J0Y2nZ0-QAAABA"]
[Tue Feb 24 07:36:50.707422 2026] [:error] [pid 41188:tid 41212] [client 20.104.114.39:41689] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzkkgWRg7szIRhA0WiNXAAAAVU"]
[Tue Feb 24 07:36:51.583972 2026] [:error] [pid 41188:tid 41206] [client 20.104.114.39:17550] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzkkwWRg7szIRhA0WiNXQAAAU8"]
[Tue Feb 24 07:36:52.225525 2026] [:error] [pid 37540:tid 37612] [client 20.104.114.39:41601] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "aZzklCahRAUBJS8hpJWJ-wAAAIo"]
[Tue Feb 24 07:36:53.698798 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:41638] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aZzklSahRAUBJS8hpJWJ_QAAAIc"]
[Tue Feb 24 07:36:54.971831 2026] [:error] [pid 41188:tid 41198] [client 20.104.114.39:17477] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aZzklgWRg7szIRhA0WiNaAAAAUc"]
[Tue Feb 24 07:36:56.116344 2026] [:error] [pid 11672:tid 11678] [client 20.104.114.39:17905] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aZzkmPa0fhnmfPYq92vH8AAAAQQ"]
[Tue Feb 24 07:36:56.926559 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:41609] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "aZzkmCahRAUBJS8hpJWKBwAAAI8"]
[Tue Feb 24 07:36:57.659293 2026] [:error] [pid 37540:tid 37618] [client 20.104.114.39:17508] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZzkmSahRAUBJS8hpJWKDAAAAJA"]
[Tue Feb 24 07:36:58.717031 2026] [:error] [pid 41188:tid 41191] [client 20.104.114.39:17519] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZzkmgWRg7szIRhA0WiNbQAAAUA"]
[Tue Feb 24 07:36:59.256450 2026] [:error] [pid 41188:tid 41207] [client 20.104.114.39:17887] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZzkmwWRg7szIRhA0WiNbgAAAVA"]
[Tue Feb 24 07:36:59.981638 2026] [:error] [pid 41188:tid 41204] [client 20.104.114.39:41674] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aZzkmwWRg7szIRhA0WiNcgAAAU0"]
[Tue Feb 24 07:37:00.525490 2026] [:error] [pid 37539:tid 37575] [client 20.104.114.39:17862] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZzknHEnr46jUQep9z_iXAAAAEA"]
[Tue Feb 24 07:37:01.258647 2026] [:error] [pid 37539:tid 37589] [client 20.104.114.39:17817] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZzknXEnr46jUQep9z_iYQAAAE4"]
[Tue Feb 24 07:37:01.801337 2026] [:error] [pid 41188:tid 41214] [client 20.104.114.39:17577] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZzknQWRg7szIRhA0WiNdwAAAVc"]
[Tue Feb 24 07:37:02.404679 2026] [:error] [pid 41188:tid 41195] [client 20.104.114.39:41709] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aZzkngWRg7szIRhA0WiNewAAAUQ"]
[Tue Feb 24 07:37:03.199474 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:17915] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aZzknyahRAUBJS8hpJWKGAAAAJc"]
[Tue Feb 24 07:37:04.065432 2026] [:error] [pid 37539:tid 37594] [client 20.104.114.39:41695] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aZzkoHEnr46jUQep9z_iZQAAAFM"]
[Tue Feb 24 07:37:04.952315 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:17918] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aZzkoCahRAUBJS8hpJWKHgAAAI8"]
[Tue Feb 24 07:37:06.240195 2026] [:error] [pid 11672:tid 11681] [client 20.104.114.39:41629] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "aZzkova0fhnmfPYq92vH9AAAAQc"]
[Tue Feb 24 07:37:07.243007 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:17897] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZzkoyahRAUBJS8hpJWKLgAAAI0"]
[Tue Feb 24 07:37:08.023646 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:17891] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZzkpCahRAUBJS8hpJWKMgAAAIk"]
[Tue Feb 24 07:37:08.882112 2026] [:error] [pid 37540:tid 37619] [client 20.104.114.39:41634] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZzkpCahRAUBJS8hpJWKOAAAAJE"]
[Tue Feb 24 07:37:09.508029 2026] [:error] [pid 37539:tid 37588] [client 20.104.114.39:17474] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aZzkpXEnr46jUQep9z_iiwAAAE0"]
[Tue Feb 24 07:37:10.230942 2026] [:error] [pid 37540:tid 37626] [client 20.104.114.39:17912] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZzkpiahRAUBJS8hpJWKRgAAAJg"]
[Tue Feb 24 07:37:11.003148 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:41622] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZzkpyahRAUBJS8hpJWKUQAAAIc"]
[Tue Feb 24 07:37:11.548178 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:41693] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZzkpyahRAUBJS8hpJWKUgAAAIw"]
[Tue Feb 24 07:37:12.233222 2026] [:error] [pid 41188:tid 41212] [client 20.104.114.39:18369] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aZzkqAWRg7szIRhA0WiNgQAAAVU"]
[Tue Feb 24 07:37:13.236118 2026] [:error] [pid 41188:tid 41210] [client 20.104.114.39:17524] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZzkqQWRg7szIRhA0WiNgwAAAVM"]
[Tue Feb 24 07:37:13.892131 2026] [:error] [pid 37644:tid 37651] [client 20.104.114.39:17581] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZzkqULaEhVDwBRydH18iwAAAMU"]
[Tue Feb 24 07:37:15.194116 2026] [:error] [pid 37539:tid 37598] [client 20.104.114.39:17903] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZzkq3Enr46jUQep9z_ioQAAAFc"]
[Tue Feb 24 07:37:16.136292 2026] [:error] [pid 37539:tid 37590] [client 20.104.114.39:17884] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aZzkrHEnr46jUQep9z_iowAAAE8"]
[Tue Feb 24 07:37:16.747472 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:41722] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZzkrCahRAUBJS8hpJWKXgAAAJc"]
[Tue Feb 24 07:37:17.374513 2026] [:error] [pid 37540:tid 37610] [client 20.104.114.39:17530] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZzkrSahRAUBJS8hpJWKYgAAAIg"]
[Tue Feb 24 07:37:18.509868 2026] [:error] [pid 41188:tid 41215] [client 20.104.114.39:41631] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZzkrgWRg7szIRhA0WiNlAAAAVg"]
[Tue Feb 24 07:37:19.295935 2026] [:error] [pid 41188:tid 41207] [client 20.104.114.39:17473] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aZzkrwWRg7szIRhA0WiNnAAAAVA"]
[Tue Feb 24 07:37:20.261645 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:17482] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZzksCahRAUBJS8hpJWKawAAAI8"]
[Tue Feb 24 07:37:21.318220 2026] [:error] [pid 11672:tid 11680] [client 20.104.114.39:41627] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZzksfa0fhnmfPYq92vIGwAAAQY"]
[Tue Feb 24 07:37:21.859988 2026] [:error] [pid 37644:tid 37655] [client 20.104.114.39:41646] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZzksULaEhVDwBRydH18kgAAAMk"]
[Tue Feb 24 07:37:22.707361 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:17515] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZzksiahRAUBJS8hpJWKcQAAAIM"]
[Tue Feb 24 07:37:23.592851 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:41678] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZzksyahRAUBJS8hpJWKdgAAAII"]
[Tue Feb 24 07:37:24.447043 2026] [:error] [pid 37539:tid 37594] [client 20.104.114.39:18420] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZzktHEnr46jUQep9z_ipAAAAFM"]
[Tue Feb 24 07:37:25.270356 2026] [:error] [pid 37644:tid 37646] [client 20.104.114.39:17518] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZzktULaEhVDwBRydH18lQAAAMA"]
[Tue Feb 24 07:37:25.971129 2026] [:error] [pid 37644:tid 37665] [client 20.104.114.39:18043] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aZzktULaEhVDwBRydH18nQAAANM"]
[Tue Feb 24 07:37:26.645767 2026] [:error] [pid 37644:tid 37669] [client 20.104.114.39:41697] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZzktkLaEhVDwBRydH18ogAAANc"]
[Tue Feb 24 07:37:27.523960 2026] [:error] [pid 41188:tid 41200] [client 20.104.114.39:17483] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZzktwWRg7szIRhA0WiNrgAAAUk"]
[Tue Feb 24 07:37:28.394608 2026] [:error] [pid 37538:tid 37556] [client 20.104.114.39:41676] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZzkuCynTiHZ9J0Y2nZ1CwAAAAg"]
[Tue Feb 24 07:37:28.815132 2026] [:error] [pid 37538:tid 37572] [client 20.104.114.39:17904] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aZzkuCynTiHZ9J0Y2nZ1DAAAABg"]
[Tue Feb 24 07:37:29.475426 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:17548] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZzkuSahRAUBJS8hpJWKegAAAI4"]
[Tue Feb 24 07:37:30.205355 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:41644] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZzkuiahRAUBJS8hpJWKfAAAAJQ"]
[Tue Feb 24 07:37:30.980013 2026] [:error] [pid 41188:tid 41203] [client 20.104.114.39:17883] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZzkugWRg7szIRhA0WiNvAAAAUw"]
[Tue Feb 24 07:37:31.681118 2026] [:error] [pid 37644:tid 37659] [client 20.104.114.39:41636] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZzku0LaEhVDwBRydH18qAAAAM0"]
[Tue Feb 24 07:37:32.149049 2026] [:error] [pid 11672:tid 11682] [client 20.104.114.39:41723] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZzkvPa0fhnmfPYq92vIIAAAAQg"]
[Tue Feb 24 07:37:32.721752 2026] [:error] [pid 37538:tid 37558] [client 20.104.114.39:17522] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZzkvCynTiHZ9J0Y2nZ1DwAAAAo"]
[Tue Feb 24 07:37:33.357020 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:41635] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZzkvSahRAUBJS8hpJWKgQAAAIY"]
[Tue Feb 24 07:37:33.964034 2026] [:error] [pid 37538:tid 37550] [client 20.104.114.39:17893] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aZzkvSynTiHZ9J0Y2nZ1EwAAAAI"]
[Tue Feb 24 07:37:34.598482 2026] [:error] [pid 11672:tid 11695] [client 20.104.114.39:41698] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZzkvva0fhnmfPYq92vIIwAAARU"]
[Tue Feb 24 07:37:35.566597 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:17553] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZzkvyahRAUBJS8hpJWKiQAAAIc"]
[Tue Feb 24 07:37:36.197034 2026] [:error] [pid 41188:tid 41202] [client 20.104.114.39:17888] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZzkwAWRg7szIRhA0WiNwwAAAUs"]
[Tue Feb 24 07:37:36.823993 2026] [:error] [pid 37538:tid 37569] [client 20.104.114.39:17868] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aZzkwCynTiHZ9J0Y2nZ1HQAAABU"]
[Tue Feb 24 07:37:37.290573 2026] [:error] [pid 41188:tid 41203] [client 20.104.114.39:17495] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkwQWRg7szIRhA0WiNxAAAAUw"]
[Tue Feb 24 07:37:37.814010 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:41685] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkwULaEhVDwBRydH18rwAAANg"]
[Tue Feb 24 07:37:38.624587 2026] [:error] [pid 37644:tid 37646] [client 20.104.114.39:17800] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkwkLaEhVDwBRydH18sQAAAMA"]
[Tue Feb 24 07:37:39.240461 2026] [:error] [pid 37644:tid 37648] [client 20.104.114.39:17574] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkw0LaEhVDwBRydH18sgAAAMI"]
[Tue Feb 24 07:37:40.256049 2026] [:error] [pid 37540:tid 37621] [client 20.104.114.39:41694] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzkxCahRAUBJS8hpJWKlQAAAJM"]
[Tue Feb 24 07:37:40.735253 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:41727] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzkxCahRAUBJS8hpJWKlwAAAJU"]
[Tue Feb 24 07:37:41.267227 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:41701] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzkxSahRAUBJS8hpJWKngAAAIk"]
[Tue Feb 24 07:37:42.090017 2026] [:error] [pid 37538:tid 37552] [client 20.104.114.39:17986] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzkxiynTiHZ9J0Y2nZ1HgAAAAQ"]
[Tue Feb 24 07:37:42.759049 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17578] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZzkxiahRAUBJS8hpJWKpAAAAIs"]
[Tue Feb 24 07:37:43.376809 2026] [:error] [pid 41188:tid 41208] [client 20.104.114.39:17894] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZzkxwWRg7szIRhA0WiN0QAAAVE"]
[Tue Feb 24 07:37:44.940808 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:17856] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Feb 24 07:37:45.150052 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:17856] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Feb 24 07:37:46.835022 2026] [:error] [pid 37540:tid 37624] [client 20.104.114.39:17856] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Feb 24 07:37:47.048869 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:17856] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Tue Feb 24 07:37:47.598695 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:17856] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Tue Feb 24 07:37:48.018564 2026] [:error] [pid 37540:tid 37612] [client 20.104.114.39:17856] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkzCahRAUBJS8hpJWKuwAAAIo"]
[Tue Feb 24 07:37:48.772695 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17523] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkzCahRAUBJS8hpJWKvQAAAIs"]
[Tue Feb 24 07:37:49.694089 2026] [:error] [pid 11672:tid 11686] [client 20.104.114.39:18392] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkzfa0fhnmfPYq92vIKQAAAQw"]
[Tue Feb 24 07:37:50.338470 2026] [:error] [pid 11672:tid 11676] [client 20.104.114.39:17538] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aZzkzva0fhnmfPYq92vILQAAAQI"]
[Tue Feb 24 07:37:51.337160 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:17516] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aZzkzyahRAUBJS8hpJWKwAAAAI8"]
[Tue Feb 24 07:37:52.740175 2026] [:error] [pid 37539:tid 37594] [client 20.104.114.39:41706] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aZzk0HEnr46jUQep9z_isAAAAFM"]
[Tue Feb 24 07:37:54.100729 2026] [:error] [pid 37644:tid 37646] [client 20.104.114.39:41637] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aZzk0kLaEhVDwBRydH182AAAAMA"]
[Tue Feb 24 07:37:55.528028 2026] [:error] [pid 37539:tid 37583] [client 20.104.114.39:17506] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aZzk03Enr46jUQep9z_itgAAAEg"]
[Tue Feb 24 07:37:56.174481 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:41724] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aZzk1CahRAUBJS8hpJWKxAAAAIc"]
[Tue Feb 24 07:37:56.780896 2026] [:error] [pid 37540:tid 37619] [client 20.104.114.39:18393] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aZzk1CahRAUBJS8hpJWKyAAAAJE"]
[Tue Feb 24 07:37:57.455156 2026] [:error] [pid 37539:tid 37581] [client 20.104.114.39:18378] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aZzk1XEnr46jUQep9z_iuwAAAEY"]
[Tue Feb 24 07:37:58.593706 2026] [:error] [pid 41188:tid 41205] [client 20.104.114.39:41726] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aZzk1gWRg7szIRhA0WiN5QAAAU4"]
[Tue Feb 24 07:37:59.271019 2026] [:error] [pid 11672:tid 11676] [client 20.104.114.39:17509] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZzk1_a0fhnmfPYq92vIOwAAAQI"]
[Tue Feb 24 07:38:00.706518 2026] [:error] [pid 11672:tid 11694] [client 20.104.114.39:17547] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZzk2Pa0fhnmfPYq92vIPQAAARQ"]
[Tue Feb 24 07:38:01.461333 2026] [:error] [pid 11672:tid 11682] [client 20.104.114.39:17854] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZzk2fa0fhnmfPYq92vIQAAAAQg"]
[Tue Feb 24 07:38:02.312641 2026] [:error] [pid 41188:tid 41208] [client 20.104.114.39:41639] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aZzk2gWRg7szIRhA0WiN6AAAAVE"]
[Tue Feb 24 07:38:03.015666 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:17541] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aZzk2yahRAUBJS8hpJWKzAAAAIY"]
[Tue Feb 24 07:38:04.106660 2026] [:error] [pid 37538:tid 37551] [client 20.104.114.39:17521] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aZzk3CynTiHZ9J0Y2nZ1NwAAAAM"]
[Tue Feb 24 07:38:04.959902 2026] [:error] [pid 37538:tid 37562] [client 20.104.114.39:17583] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aZzk3CynTiHZ9J0Y2nZ1OgAAAA4"]
[Tue Feb 24 07:38:05.758976 2026] [:error] [pid 37644:tid 37650] [client 20.104.114.39:41614] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aZzk3ULaEhVDwBRydH185AAAAMQ"]
[Tue Feb 24 07:38:06.927061 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:41725] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzk3kLaEhVDwBRydH185gAAAMg"]
[Tue Feb 24 07:38:07.786678 2026] [:error] [pid 37644:tid 37659] [client 20.104.114.39:17591] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzk30LaEhVDwBRydH186AAAAM0"]
[Tue Feb 24 07:38:08.356059 2026] [:error] [pid 37538:tid 37550] [client 20.104.114.39:41701] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzk4CynTiHZ9J0Y2nZ1PgAAAAI"]
[Tue Feb 24 07:38:08.952544 2026] [:error] [pid 37538:tid 37563] [client 20.104.114.39:17573] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzk4CynTiHZ9J0Y2nZ1QgAAAA8"]
[Tue Feb 24 07:38:09.596530 2026] [:error] [pid 37644:tid 37658] [client 20.104.114.39:17534] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aZzk4ULaEhVDwBRydH188AAAAMw"]
[Tue Feb 24 07:38:10.254898 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:41661] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aZzk4kLaEhVDwBRydH189gAAAMg"]
[Tue Feb 24 07:38:10.794535 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:17899] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aZzk4iahRAUBJS8hpJWK0wAAAJc"]
[Tue Feb 24 07:38:11.892028 2026] [:error] [pid 37540:tid 37619] [client 20.104.114.39:17857] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aZzk4yahRAUBJS8hpJWK1AAAAJE"]
[Tue Feb 24 07:38:12.947095 2026] [:error] [pid 37644:tid 37665] [client 20.104.114.39:17507] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aZzk5ELaEhVDwBRydH18_AAAANM"]
[Tue Feb 24 07:38:14.071001 2026] [:error] [pid 37540:tid 37626] [client 20.104.114.39:41719] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aZzk5iahRAUBJS8hpJWK2gAAAJg"]
[Tue Feb 24 07:38:15.070812 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:41650] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aZzk5yahRAUBJS8hpJWK4AAAAII"]
[Tue Feb 24 07:38:16.013066 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:41647] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "aZzk6CahRAUBJS8hpJWK5gAAAIU"]
[Tue Feb 24 07:38:17.315626 2026] [:error] [pid 37538:tid 37553] [client 20.104.114.39:17910] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZzk6SynTiHZ9J0Y2nZ1WwAAAAU"]
[Tue Feb 24 07:38:18.045493 2026] [:error] [pid 41188:tid 41204] [client 20.104.114.39:17881] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZzk6gWRg7szIRhA0WiN9gAAAU0"]
[Tue Feb 24 07:38:19.092179 2026] [:error] [pid 41188:tid 41192] [client 20.104.114.39:41607] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZzk6wWRg7szIRhA0WiN-gAAAUE"]
[Tue Feb 24 07:38:19.666983 2026] [:error] [pid 37538:tid 37550] [client 20.104.114.39:17568] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZzk6yynTiHZ9J0Y2nZ1XQAAAAI"]
[Tue Feb 24 07:38:20.246215 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:17535] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aZzk7ELaEhVDwBRydH19DQAAANg"]
[Tue Feb 24 07:38:21.221742 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:17540] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aZzk7SahRAUBJS8hpJWK7QAAAI0"]
[Tue Feb 24 07:38:22.292037 2026] [:error] [pid 37540:tid 37602] [client 20.104.114.39:17858] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZzk7iahRAUBJS8hpJWK8AAAAIA"]
[Tue Feb 24 07:38:22.871110 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:17810] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZzk7iahRAUBJS8hpJWK9gAAAIc"]
[Tue Feb 24 07:38:23.840898 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:17560] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZzk70LaEhVDwBRydH19EgAAAMg"]
[Tue Feb 24 07:38:24.922037 2026] [:error] [pid 11672:tid 11698] [client 20.104.114.39:17599] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aZzk8Pa0fhnmfPYq92vIlgAAARg"]
[Tue Feb 24 07:38:25.750151 2026] [:error] [pid 11672:tid 11674] [client 20.104.114.39:41664] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZzk8fa0fhnmfPYq92vImQAAAQA"]
[Tue Feb 24 07:38:26.784100 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:41656] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZzk8iahRAUBJS8hpJWLBAAAAIE"]
[Tue Feb 24 07:38:28.085326 2026] [:error] [pid 41188:tid 41211] [client 20.104.114.39:41612] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZzk9AWRg7szIRhA0WiOBQAAAVQ"]
[Tue Feb 24 07:38:28.876707 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17875] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aZzk9CahRAUBJS8hpJWLBQAAAIs"]
[Tue Feb 24 07:38:30.211642 2026] [:error] [pid 41188:tid 41201] [client 20.104.114.39:18372] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZzk9gWRg7szIRhA0WiOCgAAAUo"]
[Tue Feb 24 07:38:31.605280 2026] [:error] [pid 37539:tid 37597] [client 20.104.114.39:17802] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZzk93Enr46jUQep9z_i3gAAAFY"]
[Tue Feb 24 07:38:32.468353 2026] [:error] [pid 41188:tid 41209] [client 20.104.114.39:41684] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZzk-AWRg7szIRhA0WiOFQAAAVI"]
[Tue Feb 24 07:38:34.176894 2026] [:error] [pid 37539:tid 37592] [client 20.104.114.39:41707] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZzk-nEnr46jUQep9z_i4QAAAFE"]
[Tue Feb 24 07:38:35.324403 2026] [:error] [pid 11672:tid 11689] [client 20.104.114.39:18389] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aZzk-_a0fhnmfPYq92vIpgAAAQ8"]
[Tue Feb 24 07:38:35.939947 2026] [:error] [pid 11672:tid 11684] [client 20.104.114.39:17832] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aZzk-_a0fhnmfPYq92vIqAAAAQo"]
[Tue Feb 24 07:38:36.534946 2026] [:error] [pid 37644:tid 37650] [client 20.104.114.39:17987] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aZzk_ELaEhVDwBRydH19KwAAAMQ"]
[Tue Feb 24 07:38:37.756694 2026] [:error] [pid 37540:tid 37602] [client 20.104.114.39:17584] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aZzk_SahRAUBJS8hpJWLGQAAAIA"]
[Tue Feb 24 07:38:38.554776 2026] [:error] [pid 37540:tid 37626] [client 20.104.114.39:41687] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZzk_iahRAUBJS8hpJWLHQAAAJg"]
[Tue Feb 24 07:38:39.321902 2026] [:error] [pid 37538:tid 37567] [client 20.104.114.39:17873] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZzk_yynTiHZ9J0Y2nZ1ZwAAABM"]
[Tue Feb 24 07:38:40.115988 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:17841] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZzlAELaEhVDwBRydH19LwAAAMo"]
[Tue Feb 24 07:38:41.290958 2026] [:error] [pid 41188:tid 41207] [client 20.104.114.39:18003] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aZzlAQWRg7szIRhA0WiOIwAAAVA"]
[Tue Feb 24 07:38:42.272943 2026] [:error] [pid 37644:tid 37668] [client 20.104.114.39:17475] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aZzlAkLaEhVDwBRydH19MwAAANY"]
[Tue Feb 24 07:38:43.301780 2026] [:error] [pid 41188:tid 41191] [client 20.104.114.39:17592] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aZzlAwWRg7szIRhA0WiOJwAAAUA"]
[Tue Feb 24 07:38:44.096827 2026] [:error] [pid 11672:tid 11674] [client 20.104.114.39:17587] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aZzlBPa0fhnmfPYq92vIsQAAAQA"]
[Tue Feb 24 07:38:45.115694 2026] [:error] [pid 37538:tid 37553] [client 20.104.114.39:41668] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aZzlBSynTiHZ9J0Y2nZ1agAAAAU"]
[Tue Feb 24 07:38:46.304361 2026] [:error] [pid 37539:tid 37597] [client 20.104.114.39:17512] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "aZzlBnEnr46jUQep9z_i7gAAAFY"]
[Tue Feb 24 07:38:49.302872 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:17846] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Feb 24 07:38:49.727365 2026] [:error] [pid 37644:tid 37657] [client 20.104.114.39:17846] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Tue Feb 24 07:38:50.574005 2026] [:error] [pid 37644:tid 37653] [client 20.104.114.39:17846] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZzlCkLaEhVDwBRydH19TAAAAMc"]
[Tue Feb 24 07:38:51.994460 2026] [:error] [pid 11672:tid 11674] [client 20.104.114.39:17804] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZzlC_a0fhnmfPYq92vIvwAAAQA"]
[Tue Feb 24 07:38:53.218945 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:18419] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZzlDSahRAUBJS8hpJWLLwAAAJU"]
[Tue Feb 24 07:38:53.985404 2026] [:error] [pid 37540:tid 37624] [client 20.104.114.39:17552] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZzlDSahRAUBJS8hpJWLNAAAAJY"]
[Tue Feb 24 07:38:54.824039 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:41702] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aZzlDiahRAUBJS8hpJWLOQAAAI4"]
[Tue Feb 24 07:38:56.231519 2026] [:error] [pid 37540:tid 37612] [client 20.104.114.39:41600] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZzlECahRAUBJS8hpJWLSgAAAIo"]
[Tue Feb 24 07:38:57.612311 2026] [:error] [pid 37540:tid 37606] [client 20.104.114.39:17545] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZzlESahRAUBJS8hpJWLagAAAIQ"]
[Tue Feb 24 07:38:59.401995 2026] [:error] [pid 37540:tid 37620] [client 20.104.114.39:18385] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZzlEyahRAUBJS8hpJWLbgAAAJI"]
[Tue Feb 24 07:39:00.440614 2026] [:error] [pid 41188:tid 41214] [client 20.104.114.39:41628] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZzlFAWRg7szIRhA0WiOMwAAAVc"]
[Tue Feb 24 07:39:01.709917 2026] [:error] [pid 41188:tid 41191] [client 20.104.114.39:17505] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZzlFQWRg7szIRhA0WiONAAAAUA"]
[Tue Feb 24 07:39:04.658150 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:17871] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZzlGCahRAUBJS8hpJWLhwAAAIk"]
[Tue Feb 24 07:39:06.062488 2026] [:error] [pid 37538:tid 37559] [client 20.104.114.39:41615] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZzlGiynTiHZ9J0Y2nZ1eAAAAAs"]
[Tue Feb 24 07:39:08.114926 2026] [:error] [pid 37644:tid 37663] [client 20.104.114.39:17906] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZzlHELaEhVDwBRydH19bQAAANE"]
[Tue Feb 24 07:39:09.196278 2026] [:error] [pid 37539:tid 37580] [client 20.104.114.39:17842] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aZzlHXEnr46jUQep9z_i-wAAAEU"]
[Tue Feb 24 07:39:10.407456 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:17843] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aZzlHiahRAUBJS8hpJWLmgAAAI4"]
[Tue Feb 24 07:39:11.820462 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:41651] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aZzlHyahRAUBJS8hpJWLnAAAAIw"]
[Tue Feb 24 07:39:12.863771 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:18040] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aZzlICahRAUBJS8hpJWLnwAAAJc"]
[Tue Feb 24 07:39:14.094927 2026] [:error] [pid 37644:tid 37649] [client 20.104.114.39:17833] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZzlIkLaEhVDwBRydH19dAAAAMM"]
[Tue Feb 24 07:39:15.198866 2026] [:error] [pid 41188:tid 41200] [client 20.104.114.39:41696] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZzlIwWRg7szIRhA0WiOQAAAAUk"]
[Tue Feb 24 07:39:16.360191 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:18374] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZzlJELaEhVDwBRydH19fgAAANg"]
[Tue Feb 24 07:39:17.464377 2026] [:error] [pid 37538:tid 37556] [client 20.104.114.39:17503] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aZzlJSynTiHZ9J0Y2nZ1ewAAAAg"]
[Tue Feb 24 07:39:18.179980 2026] [:error] [pid 37538:tid 37549] [client 20.104.114.39:41713] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aZzlJiynTiHZ9J0Y2nZ1fAAAAAE"]
[Tue Feb 24 07:39:18.873749 2026] [:error] [pid 41188:tid 41191] [client 20.104.114.39:43726] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aZzlJgWRg7szIRhA0WiOQgAAAUA"]
[Tue Feb 24 07:39:20.321508 2026] [:error] [pid 37538:tid 37570] [client 20.104.114.39:17528] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aZzlKCynTiHZ9J0Y2nZ1fQAAABY"]
[Tue Feb 24 07:39:21.636175 2026] [:error] [pid 37539:tid 37590] [client 20.104.114.39:18423] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "aZzlKXEnr46jUQep9z_jAgAAAE8"]
[Tue Feb 24 07:39:24.080642 2026] [:error] [pid 11672:tid 11688] [client 20.104.114.39:41675] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZzlLPa0fhnmfPYq92vI1gAAAQ4"]
[Tue Feb 24 07:39:25.681126 2026] [:error] [pid 37538:tid 37550] [client 20.104.114.39:17821] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aZzlLSynTiHZ9J0Y2nZ1gwAAAAI"]
[Tue Feb 24 07:39:27.181329 2026] [:error] [pid 41188:tid 41193] [client 20.104.114.39:17837] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZzlLwWRg7szIRhA0WiOVAAAAUI"]
[Tue Feb 24 07:39:28.443233 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:18416] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZzlMCahRAUBJS8hpJWLuAAAAIU"]
[Tue Feb 24 07:39:29.363454 2026] [:error] [pid 41188:tid 41210] [client 20.104.114.39:17529] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZzlMQWRg7szIRhA0WiOVQAAAVM"]
[Tue Feb 24 07:39:31.226303 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17873] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aZzlMyahRAUBJS8hpJWLyQAAAIs"]
[Tue Feb 24 07:39:33.230299 2026] [:error] [pid 11672:tid 11696] [client 20.104.114.39:17562] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZzlNfa0fhnmfPYq92vI5AAAARY"]
[Tue Feb 24 07:39:34.443259 2026] [:error] [pid 11672:tid 11684] [client 20.104.114.39:18368] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZzlNva0fhnmfPYq92vI5QAAAQo"]
[Tue Feb 24 07:39:35.526655 2026] [:error] [pid 37540:tid 37610] [client 20.104.114.39:41712] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZzlNyahRAUBJS8hpJWL2gAAAIg"]
[Tue Feb 24 07:39:37.022026 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:18400] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aZzlOSahRAUBJS8hpJWL4AAAAIk"]
[Tue Feb 24 07:39:39.392933 2026] [:error] [pid 37538:tid 37552] [client 20.104.114.39:41720] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aZzlOyynTiHZ9J0Y2nZ1kAAAAAQ"]
[Tue Feb 24 07:39:40.493651 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:17845] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aZzlPCahRAUBJS8hpJWL8gAAAII"]
[Tue Feb 24 07:39:42.572185 2026] [:error] [pid 41188:tid 41215] [client 20.104.114.39:41666] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aZzlPgWRg7szIRhA0WiOYwAAAVg"]
[Tue Feb 24 07:39:43.521030 2026] [:error] [pid 37539:tid 37578] [client 20.104.114.39:17544] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aZzlP3Enr46jUQep9z_jCAAAAEM"]
[Tue Feb 24 07:39:44.721224 2026] [:error] [pid 11672:tid 11683] [client 20.104.114.39:17563] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aZzlQPa0fhnmfPYq92vI6gAAAQk"]
[Tue Feb 24 07:39:46.042039 2026] [:error] [pid 37644:tid 37652] [client 20.104.114.39:18375] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aZzlQkLaEhVDwBRydH19pwAAAMY"]
[Tue Feb 24 07:39:46.814026 2026] [:error] [pid 11672:tid 11690] [client 20.104.114.39:17822] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aZzlQva0fhnmfPYq92vI6wAAARA"]
[Tue Feb 24 07:39:48.454897 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:17816] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aZzlRCahRAUBJS8hpJWMAgAAAI4"]
[Tue Feb 24 07:39:49.641036 2026] [:error] [pid 37538:tid 37554] [client 20.104.114.39:18390] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ha.php"] [unique_id "aZzlRSynTiHZ9J0Y2nZ1lAAAAAY"]
[Tue Feb 24 07:39:51.167983 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Tue Feb 24 07:39:51.376215 2026] [:error] [pid 37540:tid 37626] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Tue Feb 24 07:39:52.251122 2026] [:error] [pid 37540:tid 37602] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Tue Feb 24 07:39:52.471054 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Tue Feb 24 07:39:52.695015 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Tue Feb 24 07:39:52.902730 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Tue Feb 24 07:39:53.114561 2026] [:error] [pid 37540:tid 37612] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Tue Feb 24 07:39:53.325820 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Feb 24 07:39:53.534600 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Tue Feb 24 07:39:53.774404 2026] [:error] [pid 37540:tid 37624] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Tue Feb 24 07:39:53.996134 2026] [:error] [pid 37540:tid 37618] [client 20.104.114.39:18255] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Tue Feb 24 07:39:54.201506 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:18255] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZzlSiahRAUBJS8hpJWMJwAAAIs"]
[Tue Feb 24 07:39:55.744954 2026] [:error] [pid 41188:tid 41201] [client 20.104.114.39:17825] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZzlSwWRg7szIRhA0WiOjwAAAUo"]
[Tue Feb 24 07:39:57.071041 2026] [:error] [pid 37538:tid 37562] [client 20.104.114.39:18387] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZzlTSynTiHZ9J0Y2nZ1mgAAAA4"]
[Tue Feb 24 07:39:58.247091 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:18384] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "aZzlTiahRAUBJS8hpJWMNAAAAIY"]
[Tue Feb 24 07:39:59.403488 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:18257] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZzlTyahRAUBJS8hpJWMNwAAAI8"]
[Tue Feb 24 07:40:00.592605 2026] [:error] [pid 41188:tid 41213] [client 20.104.114.39:17585] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZzlUAWRg7szIRhA0WiOsQAAAVY"]
[Tue Feb 24 07:40:01.710722 2026] [:error] [pid 37644:tid 37649] [client 20.104.114.39:41665] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZzlUULaEhVDwBRydH19wAAAAMM"]
[Tue Feb 24 07:40:04.935421 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:17886] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "aZzlVCahRAUBJS8hpJWMQgAAAIk"]
[Tue Feb 24 07:40:06.010777 2026] [:error] [pid 41188:tid 41209] [client 20.104.114.39:18416] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZzlVgWRg7szIRhA0WiOuQAAAVI"]
[Tue Feb 24 07:40:07.414592 2026] [:error] [pid 11672:tid 11679] [client 20.104.114.39:17853] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZzlV_a0fhnmfPYq92vI9gAAAQU"]
[Tue Feb 24 07:40:09.268801 2026] [:error] [pid 37540:tid 37606] [client 20.104.114.39:41703] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZzlWSahRAUBJS8hpJWMSwAAAIQ"]
[Tue Feb 24 07:40:10.145785 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:17511] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "aZzlWiahRAUBJS8hpJWMTwAAAI0"]
[Tue Feb 24 07:40:12.101080 2026] [:error] [pid 37539:tid 37582] [client 20.104.114.39:17589] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZzlXHEnr46jUQep9z_jGgAAAEc"]
[Tue Feb 24 07:40:13.183186 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:18415] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZzlXULaEhVDwBRydH19xQAAANQ"]
[Tue Feb 24 07:40:14.500482 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:17895] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZzlXkLaEhVDwBRydH19xgAAANg"]
[Tue Feb 24 07:40:15.892095 2026] [:error] [pid 11672:tid 11687] [client 20.104.114.39:41681] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "aZzlX_a0fhnmfPYq92vI-wAAAQ0"]
[Tue Feb 24 07:40:17.465639 2026] [:error] [pid 37539:tid 37577] [client 20.104.114.39:41682] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZzlYXEnr46jUQep9z_jHwAAAEI"]
[Tue Feb 24 07:40:18.235426 2026] [:error] [pid 11672:tid 11695] [client 20.104.114.39:17852] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZzlYva0fhnmfPYq92vI_gAAARU"]
[Tue Feb 24 07:40:19.711239 2026] [:error] [pid 37644:tid 37668] [client 20.104.114.39:17476] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZzlY0LaEhVDwBRydH19zgAAANY"]
[Tue Feb 24 07:40:20.905879 2026] [:error] [pid 37539:tid 37589] [client 20.104.114.39:18425] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "aZzlZHEnr46jUQep9z_jMwAAAE4"]
[Tue Feb 24 07:40:22.612681 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:18250] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZzlZiahRAUBJS8hpJWMcQAAAII"]
[Tue Feb 24 07:40:23.634134 2026] [:error] [pid 11672:tid 11696] [client 20.104.114.39:41669] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZzlZ_a0fhnmfPYq92vJAAAAARY"]
[Tue Feb 24 07:40:24.246566 2026] [:error] [pid 41188:tid 41201] [client 20.104.114.39:41683] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZzlaAWRg7szIRhA0WiO-gAAAUo"]
[Tue Feb 24 07:40:25.478269 2026] [:error] [pid 37539:tid 37588] [client 20.104.114.39:41641] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "aZzlaXEnr46jUQep9z_jPAAAAE0"]
[Tue Feb 24 07:40:26.549353 2026] [:error] [pid 41188:tid 41208] [client 20.104.114.39:18044] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZzlagWRg7szIRhA0WiPAAAAAVE"]
[Tue Feb 24 07:40:27.485833 2026] [:error] [pid 41188:tid 41193] [client 20.104.114.39:17531] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZzlawWRg7szIRhA0WiPAQAAAUI"]
[Tue Feb 24 07:40:28.712372 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:17565] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZzlbCahRAUBJS8hpJWMjgAAAI0"]
[Tue Feb 24 07:40:29.941344 2026] [:error] [pid 41188:tid 41201] [client 20.104.114.39:18395] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aZzlbQWRg7szIRhA0WiPCAAAAUo"]
[Tue Feb 24 07:40:30.566768 2026] [:error] [pid 11672:tid 11697] [client 20.104.114.39:17501] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZzlbva0fhnmfPYq92vJBgAAARc"]
[Tue Feb 24 07:40:31.046291 2026] [:error] [pid 37539:tid 37589] [client 20.104.114.39:41688] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZzlb3Enr46jUQep9z_jQgAAAE4"]
[Tue Feb 24 07:40:31.789121 2026] [:error] [pid 41188:tid 41196] [client 20.104.114.39:17566] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZzlbwWRg7szIRhA0WiPEQAAAUU"]
[Tue Feb 24 07:40:32.678842 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:17514] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZzlcCahRAUBJS8hpJWMmQAAAIk"]
[Tue Feb 24 07:40:33.326478 2026] [:error] [pid 11672:tid 11691] [client 20.104.114.39:17579] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZzlcfa0fhnmfPYq92vJCQAAARE"]
[Tue Feb 24 07:40:33.966270 2026] [:error] [pid 37539:tid 37575] [client 20.104.114.39:18042] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZzlcXEnr46jUQep9z_jRgAAAEA"]
[Tue Feb 24 07:40:34.588611 2026] [:error] [pid 11672:tid 11694] [client 20.104.114.39:17861] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZzlcva0fhnmfPYq92vJDAAAARQ"]
[Tue Feb 24 07:40:36.081690 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:17806] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "aZzldCahRAUBJS8hpJWMmwAAAI8"]
[Tue Feb 24 07:40:36.881254 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:17859] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZzldCahRAUBJS8hpJWMnwAAAII"]
[Tue Feb 24 07:40:37.519529 2026] [:error] [pid 37538:tid 37566] [client 20.104.114.39:18006] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZzldSynTiHZ9J0Y2nZ1uQAAABI"]
[Tue Feb 24 07:40:38.627048 2026] [:error] [pid 11672:tid 11688] [client 20.104.114.39:41701] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZzldva0fhnmfPYq92vJDgAAAQ4"]
[Tue Feb 24 07:40:39.997889 2026] [:error] [pid 41188:tid 41215] [client 20.104.114.39:41721] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "aZzldwWRg7szIRhA0WiPIAAAAVg"]
[Tue Feb 24 07:40:41.411223 2026] [:error] [pid 41188:tid 41191] [client 20.104.114.39:17539] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZzleQWRg7szIRhA0WiPIwAAAUA"]
[Tue Feb 24 07:40:42.191044 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:41617] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZzleiahRAUBJS8hpJWMsAAAAI4"]
[Tue Feb 24 07:40:43.486386 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:17863] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZzle0LaEhVDwBRydH195QAAAMo"]
[Tue Feb 24 07:40:44.986890 2026] [:error] [pid 37644:tid 37646] [client 20.104.114.39:17558] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aZzlfELaEhVDwBRydH196QAAAMA"]
[Tue Feb 24 07:40:46.332243 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:17869] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZzlfiahRAUBJS8hpJWMuAAAAIU"]
[Tue Feb 24 07:40:47.501666 2026] [:error] [pid 11672:tid 11692] [client 20.104.114.39:18002] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZzlf_a0fhnmfPYq92vJGQAAARI"]
[Tue Feb 24 07:40:48.963806 2026] [:error] [pid 37540:tid 37620] [client 20.104.114.39:18041] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZzlgCahRAUBJS8hpJWMvQAAAJI"]
[Tue Feb 24 07:40:50.862835 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:17876] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "aZzlgiahRAUBJS8hpJWMwwAAAIU"]
[Tue Feb 24 07:40:51.493154 2026] [:error] [pid 37540:tid 37604] [client 20.104.114.39:41691] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aZzlgyahRAUBJS8hpJWMxgAAAII"]
[Tue Feb 24 07:40:52.679127 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:17494] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "aZzlhCahRAUBJS8hpJWMzgAAAIw"]
[Tue Feb 24 07:40:53.471359 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Tue Feb 24 07:40:53.697079 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Tue Feb 24 07:40:53.907535 2026] [:error] [pid 37540:tid 37602] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Tue Feb 24 07:40:54.127884 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Tue Feb 24 07:40:54.959757 2026] [:error] [pid 37540:tid 37612] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Tue Feb 24 07:40:55.200078 2026] [:error] [pid 37540:tid 37618] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Tue Feb 24 07:40:55.620522 2026] [:error] [pid 37540:tid 37620] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Tue Feb 24 07:40:56.864054 2026] [:error] [pid 37540:tid 37620] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Tue Feb 24 07:40:57.104062 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Tue Feb 24 07:40:57.603891 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Tue Feb 24 07:40:57.814062 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:18426] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Tue Feb 24 07:40:58.023273 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:18426] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aZzliiahRAUBJS8hpJWM3gAAAIc"]
[Tue Feb 24 07:40:59.048054 2026] [:error] [pid 41188:tid 41204] [client 20.104.114.39:41649] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aZzliwWRg7szIRhA0WiPQAAAAU0"]
[Tue Feb 24 07:41:00.106959 2026] [:error] [pid 41188:tid 41211] [client 20.104.114.39:41680] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aZzljAWRg7szIRhA0WiPQwAAAVQ"]
[Tue Feb 24 07:41:01.455032 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:41672] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up4.php"] [unique_id "aZzljULaEhVDwBRydH19-QAAANQ"]
[Tue Feb 24 07:41:02.223050 2026] [:error] [pid 37540:tid 37602] [client 20.104.114.39:41645] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aZzljiahRAUBJS8hpJWM5gAAAIA"]
[Tue Feb 24 07:41:03.853746 2026] [:error] [pid 37644:tid 37657] [client 20.104.114.39:41705] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aZzlj0LaEhVDwBRydH19_QAAAMs"]
[Tue Feb 24 07:41:04.764442 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:41671] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aZzlkCahRAUBJS8hpJWM7gAAAIk"]
[Tue Feb 24 07:41:06.180186 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17486] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "aZzlkiahRAUBJS8hpJWM8gAAAIs"]
[Tue Feb 24 07:41:08.944022 2026] [:error] [pid 37644:tid 37669] [client 20.104.114.39:17867] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aZzllELaEhVDwBRydH1-AwAAANc"]
[Tue Feb 24 07:41:11.464915 2026] [:error] [pid 37644:tid 37651] [client 20.104.114.39:17496] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aZzll0LaEhVDwBRydH1-BQAAAMU"]
[Tue Feb 24 07:41:14.045320 2026] [:error] [pid 37538:tid 37569] [client 20.104.114.39:17865] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aZzlmiynTiHZ9J0Y2nZ1xgAAABU"]
[Tue Feb 24 07:41:15.324061 2026] [:error] [pid 41188:tid 41213] [client 20.104.114.39:17814] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/elp.php"] [unique_id "aZzlmwWRg7szIRhA0WiPSQAAAVY"]
[Tue Feb 24 07:41:16.907736 2026] [:error] [pid 37644:tid 37663] [client 20.104.114.39:17537] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aZzlnELaEhVDwBRydH1-DAAAANE"]
[Tue Feb 24 07:41:17.908623 2026] [:error] [pid 37644:tid 37662] [client 20.104.114.39:41715] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aZzlnULaEhVDwBRydH1-EAAAANA"]
[Tue Feb 24 07:41:18.872064 2026] [:error] [pid 37644:tid 37668] [client 20.104.114.39:17870] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aZzlnkLaEhVDwBRydH1-EQAAANY"]
[Tue Feb 24 07:41:19.824579 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:17542] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtz.php"] [unique_id "aZzlnyahRAUBJS8hpJWNBwAAAIc"]
[Tue Feb 24 07:41:20.822032 2026] [:error] [pid 41188:tid 41191] [client 20.104.114.39:17517] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZzloAWRg7szIRhA0WiPVgAAAUA"]
[Tue Feb 24 07:41:21.653343 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:17493] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZzloSahRAUBJS8hpJWNCgAAAIw"]
[Tue Feb 24 07:41:22.778865 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:17519] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZzloiahRAUBJS8hpJWNDgAAAIs"]
[Tue Feb 24 07:41:24.061141 2026] [:error] [pid 37644:tid 37658] [client 20.104.114.39:41608] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/galex.php"] [unique_id "aZzlpELaEhVDwBRydH1-FQAAAMw"]
[Tue Feb 24 07:41:25.169146 2026] [:error] [pid 11672:tid 11682] [client 20.104.114.39:17533] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZzlpfa0fhnmfPYq92vJLwAAAQg"]
[Tue Feb 24 07:41:25.838838 2026] [:error] [pid 11672:tid 11692] [client 20.104.114.39:18373] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZzlpfa0fhnmfPYq92vJMAAAARI"]
[Tue Feb 24 07:41:26.488149 2026] [:error] [pid 37540:tid 37626] [client 20.104.114.39:18045] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZzlpiahRAUBJS8hpJWNGwAAAJg"]
[Tue Feb 24 07:41:27.271193 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:18375] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "aZzlp0LaEhVDwBRydH1-HAAAAMo"]
[Tue Feb 24 07:41:28.715746 2026] [:error] [pid 37538:tid 37570] [client 20.104.114.39:18038] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZzlqCynTiHZ9J0Y2nZ10wAAABY"]
[Tue Feb 24 07:41:29.539253 2026] [:error] [pid 41188:tid 41207] [client 20.104.114.39:41602] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZzlqQWRg7szIRhA0WiPawAAAVA"]
[Tue Feb 24 07:41:30.682603 2026] [:error] [pid 37539:tid 37577] [client 20.104.114.39:17555] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZzlqnEnr46jUQep9z_jhwAAAEI"]
[Tue Feb 24 07:41:31.853827 2026] [:error] [pid 37644:tid 37659] [client 20.104.114.39:18398] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova.php"] [unique_id "aZzlq0LaEhVDwBRydH1-KQAAAM0"]
[Tue Feb 24 07:41:33.008377 2026] [:error] [pid 41188:tid 41200] [client 20.104.114.39:41679] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZzlrQWRg7szIRhA0WiPbwAAAUk"]
[Tue Feb 24 07:41:33.711076 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:17803] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZzlrSahRAUBJS8hpJWNJwAAAIc"]
[Tue Feb 24 07:41:34.918911 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:17880] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZzlriahRAUBJS8hpJWNKgAAAIw"]
[Tue Feb 24 07:41:36.087248 2026] [:error] [pid 37644:tid 37664] [client 20.104.114.39:17510] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aZzlsELaEhVDwBRydH1-MQAAANI"]
[Tue Feb 24 07:41:36.745119 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:17831] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZzlsCahRAUBJS8hpJWNNAAAAI8"]
[Tue Feb 24 07:41:37.958926 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:17577] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZzlsSahRAUBJS8hpJWNOgAAAIY"]
[Tue Feb 24 07:41:39.112537 2026] [:error] [pid 41188:tid 41200] [client 20.104.114.39:41655] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZzlswWRg7szIRhA0WiPfgAAAUk"]
[Tue Feb 24 07:41:40.051082 2026] [:error] [pid 41188:tid 41205] [client 20.104.114.39:17491] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "aZzltAWRg7szIRhA0WiPgwAAAU4"]
[Tue Feb 24 10:41:44.270089 2026] [:error] [pid 41188:tid 41193] [client 195.178.110.159:38978] [client 195.178.110.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZ0P6AWRg7szIRhA0WjdTgAAAUI"]
[Tue Feb 24 18:14:23.260949 2026] [:error] [pid 34839:tid 34858] [client 200.216.130.186:64519] [client 200.216.130.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.216.130.186, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ15_2Lpm0-tb2ey61HKJQAAABE"]
[Tue Feb 24 18:14:23.265761 2026] [:error] [pid 34839:tid 34858] [client 200.216.130.186:64519] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Feb 24 19:44:23.602973 2026] [:error] [pid 16867:tid 16887] [client 103.77.107.57:57664] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aZ2PF9Tc72Oc9LHzeyJzmQAAA5E"]
[Wed Feb 25 03:39:04.734223 2026] [:error] [pid 20659:tid 20695] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Wed Feb 25 03:39:05.678229 2026] [:error] [pid 20659:tid 20715] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Wed Feb 25 03:39:05.783498 2026] [:error] [pid 20659:tid 20697] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Feb 25 03:39:05.874748 2026] [:error] [pid 20659:tid 20703] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Feb 25 03:39:05.997213 2026] [:error] [pid 20659:tid 20699] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Wed Feb 25 03:39:06.089671 2026] [:error] [pid 20659:tid 20704] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Wed Feb 25 03:39:06.181606 2026] [:error] [pid 20659:tid 20700] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 25 03:39:06.274146 2026] [:error] [pid 20659:tid 20698] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Wed Feb 25 03:39:06.365649 2026] [:error] [pid 20659:tid 20701] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Wed Feb 25 03:39:06.458268 2026] [:error] [pid 20659:tid 20706] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Feb 25 03:39:06.549543 2026] [:error] [pid 20659:tid 20705] [client 4.193.97.168:4096] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko-new.php
[Wed Feb 25 03:39:06.637513 2026] [:error] [pid 20659:tid 20710] [client 4.193.97.168:4096] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cookie.php"] [unique_id "aZ3-Wj_THK_HtK-Q44K_VQAAAE8"]
[Wed Feb 25 03:39:06.996329 2026] [:error] [pid 20763:tid 20769] [client 4.193.97.168:14905] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cookie.php"] [unique_id "aZ3-Wk0w_zc13OX-xia1zQAAAMQ"]
[Wed Feb 25 03:39:07.354537 2026] [:error] [pid 20659:tid 20719] [client 4.193.97.168:4737] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cookie.php"] [unique_id "aZ3-Wz_THK_HtK-Q44K_WQAAAFg"]
[Wed Feb 25 03:39:07.710733 2026] [:error] [pid 20659:tid 20714] [client 4.193.97.168:4776] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cookie.php"] [unique_id "aZ3-Wz_THK_HtK-Q44K_WwAAAFM"]
[Wed Feb 25 06:20:50.228671 2026] [:error] [pid 20658:tid 20686] [client 141.98.11.189:60382] [client 141.98.11.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.189, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZ4kQuu8cohhPfsAIFmucwAAABM"], referer: https://www.facebook.com/
[Wed Feb 25 06:20:50.234945 2026] [:error] [pid 20658:tid 20686] [client 141.98.11.189:60382] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.facebook.com/
[Wed Feb 25 06:20:50.792201 2026] [:error] [pid 20658:tid 20685] [client 141.98.11.189:60489] [client 141.98.11.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.189, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZ4kQuu8cohhPfsAIFmudAAAABI"], referer: https://www.google.com/search?q=wordpress
[Wed Feb 25 06:20:50.796761 2026] [:error] [pid 20658:tid 20685] [client 141.98.11.189:60489] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/search?q=wordpress
[Wed Feb 25 06:49:36.997812 2026] [:error] [pid 5620:tid 5664] [client 49.43.43.17:54820] [client 49.43.43.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.43.17, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ4rAIY2LQjtieeRkobn6AAAAwI"]
[Wed Feb 25 06:49:37.002489 2026] [:error] [pid 5620:tid 5664] [client 49.43.43.17:54820] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 25 11:16:34.839090 2026] [:error] [pid 5556:tid 5608] [client 165.227.53.4:56535] [client 165.227.53.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/services.yml" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/config/services.yml"] [unique_id "aZ5pkqOrYeaTyh7lGRWPRwAAAdU"]
[Wed Feb 25 11:18:39.480835 2026] [:error] [pid 5556:tid 5610] [client 165.227.53.4:57338] [client 165.227.53.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/services.yml" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/src/Resources/config/services.yml"] [unique_id "aZ5qD6OrYeaTyh7lGRWQUQAAAdc"]
[Wed Feb 25 11:18:54.818748 2026] [:error] [pid 20659:tid 20696] [client 165.227.53.4:58164] [client 165.227.53.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/config/parameters.yml" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/parameters.yml"] [unique_id "aZ5qHj_THK_HtK-Q44JsWAAAAEE"]
[Wed Feb 25 11:18:57.875944 2026] [:error] [pid 60500:tid 60603] [client 165.227.53.4:59127] File does not exist: /usr/local/apache/htdocs/suspended-page/app_dev.php
[Wed Feb 25 11:19:05.363580 2026] [:error] [pid 60500:tid 60584] [client 165.227.53.4:59127] [client 165.227.53.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web/debug/default/view"] [unique_id "aZ5qKfY9avxuno9KAT8dMAAAA0M"]
[Wed Feb 25 11:19:08.097917 2026] [:error] [pid 60498:tid 60519] [client 165.227.53.4:59752] [client 165.227.53.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web/debug/default/view"] [unique_id "aZ5qLCFCVhQ3ffus0uK5PAAAAs4"]
[Wed Feb 25 12:14:53.079816 2026] [:error] [pid 20658:tid 20672] [client 34.227.99.251:53372] [client 34.227.99.251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZ53Peu8cohhPfsAIFnQyQAAAAU"]
[Wed Feb 25 12:14:54.149558 2026] [:error] [pid 5556:tid 5597] [client 34.227.99.251:53446] [client 34.227.99.251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aZ53PqOrYeaTyh7lGRWeNgAAAco"]
[Wed Feb 25 14:39:02.931863 2026] [:error] [pid 5556:tid 5592] [client 104.28.153.26:26431] [client 104.28.153.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aZ6ZBqOrYeaTyh7lGRXLDAAAAcU"]
[Wed Feb 25 17:08:37.323801 2026] [:error] [pid 20763:tid 20782] [client 77.137.66.11:49223] [client 77.137.66.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.137.66.11, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ68FU0w_zc13OX-xiYTqgAAANE"]
[Wed Feb 25 17:08:37.328985 2026] [:error] [pid 20763:tid 20782] [client 77.137.66.11:49223] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 25 17:11:33.907086 2026] [:error] [pid 20763:tid 20784] [client 165.232.171.245:51456] [client 165.232.171.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.232.171.245, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aZ68xU0w_zc13OX-xiYT1AAAANM"]
[Wed Feb 25 17:11:33.910496 2026] [:error] [pid 20763:tid 20784] [client 165.232.171.245:51456] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Feb 25 20:59:17.301697 2026] [:error] [pid 5556:tid 5607] [client 35.203.174.33:49885] [client 35.203.174.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.174.33, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ7yJaOrYeaTyh7lGRVpwgAAAdQ"]
[Wed Feb 25 20:59:17.307404 2026] [:error] [pid 5556:tid 5607] [client 35.203.174.33:49885] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 25 20:59:20.759234 2026] [:error] [pid 5556:tid 5595] [client 35.203.174.33:49885] [client 35.203.174.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aZ7yKKOrYeaTyh7lGRVp1QAAAcg"]
[Wed Feb 25 20:59:21.125865 2026] [:error] [pid 60498:tid 60515] [client 35.203.174.33:49806] [client 35.203.174.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aZ7yKSFCVhQ3ffus0uIy4wAAAso"]
[Wed Feb 25 20:59:21.532598 2026] [:error] [pid 5619:tid 5646] [client 35.203.174.33:52338] [client 35.203.174.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aZ7yKZFUzdv-0L_F4ftQnQAAAgs"]
[Wed Feb 25 20:59:21.893960 2026] [:error] [pid 60387:tid 60494] [client 35.203.174.33:64401] [client 35.203.174.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aZ7yKYHL0QH7Sr13X0J-FQAAApY"]
[Wed Feb 25 20:59:22.262205 2026] [:error] [pid 20763:tid 20776] [client 35.203.174.33:64930] [client 35.203.174.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aZ7yKk0w_zc13OX-xiYkuQAAAMs"]
[Wed Feb 25 20:59:22.612751 2026] [:error] [pid 5619:tid 5653] [client 35.203.174.33:62497] [client 35.203.174.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aZ7yKpFUzdv-0L_F4ftQrwAAAhI"]
[Wed Feb 25 20:59:22.982728 2026] [:error] [pid 20763:tid 20767] [client 35.203.174.33:56519] [client 35.203.174.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aZ7yKk0w_zc13OX-xiYkugAAAMI"]
[Wed Feb 25 21:07:28.749034 2026] [:error] [pid 60500:tid 60602] [client 139.59.24.163:59068] [client 139.59.24.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/"] [unique_id "aZ70EPY9avxuno9KAT9XVgAAA08"], referer: binance.com
[Wed Feb 25 21:32:43.675641 2026] [:error] [pid 60498:tid 60515] [client 74.244.89.91:38750] [client 74.244.89.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.89.91, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ75-yFCVhQ3ffus0uI55AAAAso"]
[Wed Feb 25 21:32:43.691331 2026] [:error] [pid 60498:tid 60515] [client 74.244.89.91:38750] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 25 21:52:49.622962 2026] [:error] [pid 5556:tid 5591] [client 34.44.108.106:64654] [client 34.44.108.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.44.108.106, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ7-saOrYeaTyh7lGRWCHwAAAcQ"]
[Wed Feb 25 21:52:49.625874 2026] [:error] [pid 5556:tid 5591] [client 34.44.108.106:64654] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 25 21:52:52.002525 2026] [:error] [pid 5556:tid 5597] [client 34.44.108.106:64654] [client 34.44.108.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aZ7-tKOrYeaTyh7lGRWCNAAAAco"]
[Wed Feb 25 21:52:52.469264 2026] [:error] [pid 60500:tid 60609] [client 34.44.108.106:54954] [client 34.44.108.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aZ7-tPY9avxuno9KAT9cyAAAA1Y"]
[Wed Feb 25 21:52:52.999209 2026] [:error] [pid 5556:tid 5587] [client 34.44.108.106:53919] [client 34.44.108.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aZ7-tKOrYeaTyh7lGRWCOAAAAcA"]
[Wed Feb 25 21:52:53.452065 2026] [:error] [pid 60500:tid 60590] [client 34.44.108.106:54190] [client 34.44.108.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aZ7-tfY9avxuno9KAT9cyQAAA0g"]
[Wed Feb 25 21:52:53.896750 2026] [:error] [pid 5619:tid 5645] [client 34.44.108.106:60610] [client 34.44.108.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aZ7-tZFUzdv-0L_F4ftYggAAAgo"]
[Wed Feb 25 21:52:54.421037 2026] [:error] [pid 5556:tid 5600] [client 34.44.108.106:57191] [client 34.44.108.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aZ7-tqOrYeaTyh7lGRWCPQAAAc0"]
[Wed Feb 25 21:52:54.860015 2026] [:error] [pid 60498:tid 60521] [client 34.44.108.106:62329] [client 34.44.108.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aZ7-tiFCVhQ3ffus0uI9_QAAAtA"]
[Wed Feb 25 22:47:46.893995 2026] [:error] [pid 20659:tid 20704] [client 87.106.209.183:57618] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Wed Feb 25 22:48:07.108611 2026] [:error] [pid 20659:tid 20698] [client 87.106.209.183:51807] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Wed Feb 25 22:48:23.718674 2026] [:error] [pid 5556:tid 5607] [client 87.106.209.183:51435] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Wed Feb 25 22:48:38.533482 2026] [:error] [pid 60498:tid 60510] [client 87.106.209.183:51739] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Thu Feb 26 03:36:21.924600 2026] [:error] [pid 9587:tid 9617] [client 20.104.251.200:44422] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9PNfiLfyuakov_VlAPWQAAABQ"]
[Thu Feb 26 03:36:22.666188 2026] [:error] [pid 9589:tid 9668] [client 20.104.251.200:44423] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9PNqBuBxYiI1p-njSHpAAAAI8"]
[Thu Feb 26 03:36:23.282157 2026] [:error] [pid 9589:tid 9653] [client 20.104.251.200:44418] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9PN6BuBxYiI1p-njSHqAAAAIA"]
[Thu Feb 26 03:36:23.775778 2026] [:error] [pid 9702:tid 9728] [client 20.104.251.200:44178] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9PN5vL1wp7EOGdesz79gAAANY"]
[Thu Feb 26 11:19:14.728330 2026] [:error] [pid 55618:tid 55643] [client 174.101.152.17:51517] [client 174.101.152.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.101.152.17, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ-7sh61Vrh12f_8oWRFCwAAARY"]
[Thu Feb 26 11:19:14.733006 2026] [:error] [pid 55618:tid 55643] [client 174.101.152.17:51517] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 26 12:42:07.900756 2026] [:error] [pid 55618:tid 55644] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Thu Feb 26 12:42:08.112006 2026] [:error] [pid 55618:tid 55643] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/work.php
[Thu Feb 26 12:42:08.322537 2026] [:error] [pid 55618:tid 55621] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/C.php
[Thu Feb 26 12:42:08.532563 2026] [:error] [pid 55618:tid 55631] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/ze.php
[Thu Feb 26 12:42:08.741372 2026] [:error] [pid 55618:tid 55623] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Feb 26 12:42:08.951755 2026] [:error] [pid 55618:tid 55637] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/sc.php
[Thu Feb 26 12:42:09.160914 2026] [:error] [pid 55618:tid 55626] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/pouhg.php
[Thu Feb 26 12:42:09.374946 2026] [:error] [pid 55618:tid 55645] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/vgtyu.php
[Thu Feb 26 12:42:09.585828 2026] [:error] [pid 55618:tid 55627] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Thu Feb 26 12:42:09.839233 2026] [:error] [pid 55618:tid 55636] [client 4.204.200.32:36736] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Thu Feb 26 12:42:10.044722 2026] [:error] [pid 55618:tid 55622] [client 4.204.200.32:36736] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x123.php"] [unique_id "aZ_PIh61Vrh12f_8oWRnXAAAAQE"]
[Thu Feb 26 12:42:10.461763 2026] [:error] [pid 55122:tid 55139] [client 4.204.200.32:36801] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x123.php"] [unique_id "aZ_PIoLiR0OfjFxvcN-zGQAAAM8"]
[Thu Feb 26 12:42:10.877749 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36800] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x123.php"] [unique_id "aZ_PItfdM__yZAgJFSuzMwAAAYg"]
[Thu Feb 26 12:42:11.313679 2026] [:error] [pid 3883:tid 3909] [client 4.204.200.32:36858] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x123.php"] [unique_id "aZ_PI-A33x90V6yYHahKcwAAAVc"]
[Thu Feb 26 12:42:11.727331 2026] [:error] [pid 3883:tid 3901] [client 4.204.200.32:36848] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZ_PI-A33x90V6yYHahKdgAAAU8"]
[Thu Feb 26 12:42:12.143919 2026] [:error] [pid 25311:tid 25330] [client 4.204.200.32:36804] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZ_PJNfdM__yZAgJFSuzQAAAAZA"]
[Thu Feb 26 12:42:12.655471 2026] [:error] [pid 3883:tid 3888] [client 4.204.200.32:36808] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZ_PJOA33x90V6yYHahKeQAAAUI"]
[Thu Feb 26 12:42:13.084238 2026] [:error] [pid 3883:tid 3891] [client 4.204.200.32:36743] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aZ_PJeA33x90V6yYHahKewAAAUU"]
[Thu Feb 26 12:42:13.498867 2026] [:error] [pid 25311:tid 25318] [client 4.204.200.32:36838] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moshou.php"] [unique_id "aZ_PJdfdM__yZAgJFSuzRQAAAYQ"]
[Thu Feb 26 12:42:13.922561 2026] [:error] [pid 55618:tid 55644] [client 4.204.200.32:36857] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moshou.php"] [unique_id "aZ_PJR61Vrh12f_8oWRnXgAAARc"]
[Thu Feb 26 12:42:14.366090 2026] [:error] [pid 54991:tid 55033] [client 4.204.200.32:36738] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moshou.php"] [unique_id "aZ_PJt4Zx-mJ8gbRB2iGZwAAAE0"]
[Thu Feb 26 12:42:14.795286 2026] [:error] [pid 55618:tid 55632] [client 4.204.200.32:36825] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moshou.php"] [unique_id "aZ_PJh61Vrh12f_8oWRnYQAAAQs"]
[Thu Feb 26 12:42:15.238172 2026] [:error] [pid 25311:tid 25332] [client 4.204.200.32:36803] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZ_PJ9fdM__yZAgJFSuzSgAAAZI"]
[Thu Feb 26 12:42:15.648152 2026] [:error] [pid 25311:tid 25330] [client 4.204.200.32:36677] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZ_PJ9fdM__yZAgJFSuzSwAAAZA"]
[Thu Feb 26 12:42:16.068802 2026] [:error] [pid 25311:tid 25326] [client 4.204.200.32:36754] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZ_PKNfdM__yZAgJFSuzUAAAAYw"]
[Thu Feb 26 12:42:16.488370 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36842] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aZ_PKNfdM__yZAgJFSuzVAAAAYg"]
[Thu Feb 26 12:42:16.902965 2026] [:error] [pid 25311:tid 25327] [client 4.204.200.32:36847] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aZ_PKNfdM__yZAgJFSuzWAAAAY0"]
[Thu Feb 26 12:42:17.317282 2026] [:error] [pid 3883:tid 3889] [client 4.204.200.32:36753] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aZ_PKeA33x90V6yYHahKkwAAAUM"]
[Thu Feb 26 12:42:17.736146 2026] [:error] [pid 55618:tid 55626] [client 4.204.200.32:36783] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aZ_PKR61Vrh12f_8oWRnZwAAAQU"]
[Thu Feb 26 12:42:18.161912 2026] [:error] [pid 55618:tid 55627] [client 4.204.200.32:36741] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aZ_PKh61Vrh12f_8oWRnaAAAAQY"]
[Thu Feb 26 12:42:18.584972 2026] [:error] [pid 55618:tid 55639] [client 4.204.200.32:36826] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws60.php"] [unique_id "aZ_PKh61Vrh12f_8oWRnbQAAARI"]
[Thu Feb 26 12:42:18.994748 2026] [:error] [pid 25311:tid 25317] [client 4.204.200.32:36817] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws60.php"] [unique_id "aZ_PKtfdM__yZAgJFSuzYQAAAYM"]
[Thu Feb 26 12:42:19.421152 2026] [:error] [pid 55618:tid 55621] [client 4.204.200.32:36837] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws60.php"] [unique_id "aZ_PKx61Vrh12f_8oWRncQAAAQA"]
[Thu Feb 26 12:42:19.838089 2026] [:error] [pid 3883:tid 3892] [client 4.204.200.32:36791] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws60.php"] [unique_id "aZ_PK-A33x90V6yYHahKnAAAAUY"]
[Thu Feb 26 12:42:20.279604 2026] [:error] [pid 3883:tid 3904] [client 4.204.200.32:36774] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/samiri.php"] [unique_id "aZ_PLOA33x90V6yYHahKnwAAAVI"]
[Thu Feb 26 12:42:20.692765 2026] [:error] [pid 3883:tid 3887] [client 4.204.200.32:36834] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/samiri.php"] [unique_id "aZ_PLOA33x90V6yYHahKogAAAUE"]
[Thu Feb 26 12:42:21.110743 2026] [:error] [pid 55122:tid 55127] [client 4.204.200.32:36831] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/samiri.php"] [unique_id "aZ_PLYLiR0OfjFxvcN-zHAAAAMM"]
[Thu Feb 26 12:42:21.532868 2026] [:error] [pid 3883:tid 3890] [client 4.204.200.32:36821] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/samiri.php"] [unique_id "aZ_PLeA33x90V6yYHahKpgAAAUQ"]
[Thu Feb 26 12:42:21.955368 2026] [:error] [pid 55051:tid 55054] [client 4.204.200.32:36751] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZ_PLQmK1w2kZvh5eLHbQwAAAIA"]
[Thu Feb 26 12:42:22.378856 2026] [:error] [pid 3883:tid 3894] [client 4.204.200.32:36681] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZ_PLuA33x90V6yYHahKqgAAAUg"]
[Thu Feb 26 12:42:22.791432 2026] [:error] [pid 55618:tid 55645] [client 4.204.200.32:36745] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZ_PLh61Vrh12f_8oWRnjwAAARg"]
[Thu Feb 26 12:42:23.214835 2026] [:error] [pid 55618:tid 55634] [client 4.204.200.32:36787] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aZ_PLx61Vrh12f_8oWRnkQAAAQ0"]
[Thu Feb 26 12:42:23.627318 2026] [:error] [pid 25311:tid 25330] [client 4.204.200.32:36813] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZ_PL9fdM__yZAgJFSuzagAAAZA"]
[Thu Feb 26 12:42:24.049890 2026] [:error] [pid 55618:tid 55637] [client 4.204.200.32:36841] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZ_PMB61Vrh12f_8oWRnlgAAARA"]
[Thu Feb 26 12:42:24.461899 2026] [:error] [pid 55618:tid 55621] [client 4.204.200.32:36752] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZ_PMB61Vrh12f_8oWRnmQAAAQA"]
[Thu Feb 26 12:42:24.896751 2026] [:error] [pid 25311:tid 25338] [client 4.204.200.32:36862] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xoot.php"] [unique_id "aZ_PMNfdM__yZAgJFSuzbgAAAZg"]
[Thu Feb 26 12:42:25.315914 2026] [:error] [pid 25311:tid 25324] [client 4.204.200.32:36757] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aZ_PMdfdM__yZAgJFSuzcAAAAYo"]
[Thu Feb 26 12:42:25.730578 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36769] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aZ_PMdfdM__yZAgJFSuzcwAAAYg"]
[Thu Feb 26 12:42:26.143037 2026] [:error] [pid 54990:tid 55017] [client 4.204.200.32:36839] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aZ_PMntr2qmt_mBhH2zYcAAAABg"]
[Thu Feb 26 12:42:26.555399 2026] [:error] [pid 54991:tid 55031] [client 4.204.200.32:36771] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aZ_PMt4Zx-mJ8gbRB2iGbgAAAEs"]
[Thu Feb 26 12:42:26.975038 2026] [:error] [pid 54990:tid 54996] [client 4.204.200.32:36740] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aZ_PMntr2qmt_mBhH2zYcQAAAAM"]
[Thu Feb 26 12:42:27.404933 2026] [:error] [pid 55122:tid 55134] [client 4.204.200.32:36812] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aZ_PM4LiR0OfjFxvcN-zJAAAAMo"]
[Thu Feb 26 12:42:27.823051 2026] [:error] [pid 55122:tid 55147] [client 4.204.200.32:36852] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aZ_PM4LiR0OfjFxvcN-zJwAAANc"]
[Thu Feb 26 12:42:28.248262 2026] [:error] [pid 54991:tid 55021] [client 4.204.200.32:36782] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aZ_PNN4Zx-mJ8gbRB2iGbwAAAEE"]
[Thu Feb 26 12:42:28.666650 2026] [:error] [pid 55051:tid 55068] [client 4.204.200.32:36828] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file59.php"] [unique_id "aZ_PNAmK1w2kZvh5eLHbRgAAAI4"]
[Thu Feb 26 12:42:29.077586 2026] [:error] [pid 55051:tid 55055] [client 4.204.200.32:36756] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file59.php"] [unique_id "aZ_PNQmK1w2kZvh5eLHbRwAAAIE"]
[Thu Feb 26 12:42:29.507531 2026] [:error] [pid 54991:tid 55032] [client 4.204.200.32:36836] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file59.php"] [unique_id "aZ_PNd4Zx-mJ8gbRB2iGcgAAAEw"]
[Thu Feb 26 12:42:29.936587 2026] [:error] [pid 25311:tid 25326] [client 4.204.200.32:36675] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file59.php"] [unique_id "aZ_PNdfdM__yZAgJFSuzegAAAYw"]
[Thu Feb 26 12:42:30.353514 2026] [:error] [pid 3883:tid 3899] [client 4.204.200.32:36824] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ_PNuA33x90V6yYHahKwwAAAU0"]
[Thu Feb 26 12:42:30.795028 2026] [:error] [pid 55122:tid 55135] [client 4.204.200.32:36832] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ_PNoLiR0OfjFxvcN-zLAAAAMs"]
[Thu Feb 26 12:42:31.220402 2026] [:error] [pid 55618:tid 55630] [client 4.204.200.32:36761] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ_PNx61Vrh12f_8oWRnuAAAAQk"]
[Thu Feb 26 12:42:31.647332 2026] [:error] [pid 55618:tid 55629] [client 4.204.200.32:36850] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ_PNx61Vrh12f_8oWRnvAAAAQg"]
[Thu Feb 26 12:42:32.087232 2026] [:error] [pid 3883:tid 3901] [client 4.204.200.32:36809] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/shas.php"] [unique_id "aZ_POOA33x90V6yYHahKygAAAU8"]
[Thu Feb 26 12:42:32.509586 2026] [:error] [pid 55051:tid 55061] [client 4.204.200.32:36768] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/shas.php"] [unique_id "aZ_POAmK1w2kZvh5eLHbTwAAAIc"]
[Thu Feb 26 12:42:32.966249 2026] [:error] [pid 55618:tid 55639] [client 4.204.200.32:36777] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/shas.php"] [unique_id "aZ_POB61Vrh12f_8oWRnxQAAARI"]
[Thu Feb 26 12:42:33.421292 2026] [:error] [pid 25311:tid 25327] [client 4.204.200.32:36691] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/shas.php"] [unique_id "aZ_POdfdM__yZAgJFSuziAAAAY0"]
[Thu Feb 26 12:42:33.847425 2026] [:error] [pid 55618:tid 55625] [client 4.204.200.32:36860] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aZ_POR61Vrh12f_8oWRnygAAAQQ"]
[Thu Feb 26 12:42:34.265956 2026] [:error] [pid 25311:tid 25321] [client 4.204.200.32:36748] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aZ_POtfdM__yZAgJFSuzjAAAAYc"]
[Thu Feb 26 12:42:34.687613 2026] [:error] [pid 3883:tid 3909] [client 4.204.200.32:36845] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aZ_POuA33x90V6yYHahKzgAAAVc"]
[Thu Feb 26 12:42:35.097690 2026] [:error] [pid 25311:tid 25327] [client 4.204.200.32:36792] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aZ_PO9fdM__yZAgJFSuzkgAAAY0"]
[Thu Feb 26 12:42:35.510924 2026] [:error] [pid 25311:tid 25318] [client 4.204.200.32:36795] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xda.php"] [unique_id "aZ_PO9fdM__yZAgJFSuzlgAAAYQ"]
[Thu Feb 26 12:42:35.973981 2026] [:error] [pid 3883:tid 3905] [client 4.204.200.32:36776] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xda.php"] [unique_id "aZ_PO-A33x90V6yYHahK0gAAAVM"]
[Thu Feb 26 12:42:36.385667 2026] [:error] [pid 3883:tid 3887] [client 4.204.200.32:36859] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xda.php"] [unique_id "aZ_PPOA33x90V6yYHahK0wAAAUE"]
[Thu Feb 26 12:42:36.795636 2026] [:error] [pid 3883:tid 3896] [client 4.204.200.32:36762] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xda.php"] [unique_id "aZ_PPOA33x90V6yYHahK1AAAAUo"]
[Thu Feb 26 12:42:37.213966 2026] [:error] [pid 25311:tid 25325] [client 4.204.200.32:36760] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/er.php"] [unique_id "aZ_PPdfdM__yZAgJFSuzpQAAAYs"]
[Thu Feb 26 12:42:37.629878 2026] [:error] [pid 25311:tid 25337] [client 4.204.200.32:36742] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/er.php"] [unique_id "aZ_PPdfdM__yZAgJFSuzpgAAAZc"]
[Thu Feb 26 12:42:38.080879 2026] [:error] [pid 3883:tid 3889] [client 4.204.200.32:36822] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/er.php"] [unique_id "aZ_PPuA33x90V6yYHahK2gAAAUM"]
[Thu Feb 26 12:42:38.534433 2026] [:error] [pid 3883:tid 3898] [client 4.204.200.32:36861] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/er.php"] [unique_id "aZ_PPuA33x90V6yYHahK2wAAAUw"]
[Thu Feb 26 12:42:38.961644 2026] [:error] [pid 55051:tid 55072] [client 4.204.200.32:36763] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fault.php"] [unique_id "aZ_PPgmK1w2kZvh5eLHbUQAAAJI"]
[Thu Feb 26 12:42:39.380635 2026] [:error] [pid 54991:tid 55044] [client 4.204.200.32:36747] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fault.php"] [unique_id "aZ_PP94Zx-mJ8gbRB2iGdAAAAFg"]
[Thu Feb 26 12:42:39.814481 2026] [:error] [pid 3883:tid 3891] [client 4.204.200.32:36732] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fault.php"] [unique_id "aZ_PP-A33x90V6yYHahK4AAAAUU"]
[Thu Feb 26 12:42:40.242076 2026] [:error] [pid 3883:tid 3907] [client 4.204.200.32:36786] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fault.php"] [unique_id "aZ_PQOA33x90V6yYHahK4wAAAVU"]
[Thu Feb 26 12:42:40.658384 2026] [:error] [pid 3883:tid 3887] [client 4.204.200.32:36829] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aZ_PQOA33x90V6yYHahK5QAAAUE"]
[Thu Feb 26 12:42:41.088026 2026] [:error] [pid 55618:tid 55638] [client 4.204.200.32:36676] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aZ_PQR61Vrh12f_8oWRn4gAAARE"]
[Thu Feb 26 12:42:41.512153 2026] [:error] [pid 3883:tid 3894] [client 4.204.200.32:36835] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aZ_PQeA33x90V6yYHahK7AAAAUg"]
[Thu Feb 26 12:42:41.925253 2026] [:error] [pid 25311:tid 25325] [client 4.204.200.32:36775] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aZ_PQdfdM__yZAgJFSuztAAAAYs"]
[Thu Feb 26 12:42:42.361071 2026] [:error] [pid 3883:tid 3892] [client 4.204.200.32:36737] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aZ_PQuA33x90V6yYHahK8AAAAUY"]
[Thu Feb 26 12:42:42.786593 2026] [:error] [pid 3883:tid 3887] [client 4.204.200.32:36851] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aZ_PQuA33x90V6yYHahK9QAAAUE"]
[Thu Feb 26 12:42:43.201993 2026] [:error] [pid 55051:tid 55078] [client 4.204.200.32:36840] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aZ_PQwmK1w2kZvh5eLHbVAAAAJg"]
[Thu Feb 26 12:42:43.617768 2026] [:error] [pid 25311:tid 25334] [client 4.204.200.32:36608] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aZ_PQ9fdM__yZAgJFSuzuAAAAZQ"]
[Thu Feb 26 12:42:44.059306 2026] [:error] [pid 55618:tid 55633] [client 4.204.200.32:36863] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZ_PRB61Vrh12f_8oWRn7wAAAQw"]
[Thu Feb 26 12:42:44.479527 2026] [:error] [pid 25311:tid 25335] [client 4.204.200.32:36818] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZ_PRNfdM__yZAgJFSuzvAAAAZU"]
[Thu Feb 26 12:42:44.926187 2026] [:error] [pid 3883:tid 3893] [client 4.204.200.32:36683] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZ_PROA33x90V6yYHahK_QAAAUc"]
[Thu Feb 26 12:42:45.377908 2026] [:error] [pid 25311:tid 25327] [client 4.204.200.32:36616] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/leuk.php"] [unique_id "aZ_PRdfdM__yZAgJFSuzvgAAAY0"]
[Thu Feb 26 12:42:45.819056 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36833] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZ_PRdfdM__yZAgJFSuzwAAAAYg"]
[Thu Feb 26 12:42:46.245045 2026] [:error] [pid 25311:tid 25325] [client 4.204.200.32:36797] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZ_PRtfdM__yZAgJFSuzwwAAAYs"]
[Thu Feb 26 12:42:46.678842 2026] [:error] [pid 25311:tid 25326] [client 4.204.200.32:36749] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZ_PRtfdM__yZAgJFSuzxgAAAYw"]
[Thu Feb 26 12:42:47.122117 2026] [:error] [pid 55051:tid 55068] [client 4.204.200.32:36827] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aZ_PRwmK1w2kZvh5eLHbVQAAAI4"]
[Thu Feb 26 12:42:47.595078 2026] [:error] [pid 55618:tid 55632] [client 4.204.200.32:36692] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZ_PRx61Vrh12f_8oWRn-gAAAQs"]
[Thu Feb 26 12:42:48.010555 2026] [:error] [pid 55618:tid 55644] [client 4.204.200.32:36685] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZ_PSB61Vrh12f_8oWRn_QAAARc"]
[Thu Feb 26 12:42:48.439071 2026] [:error] [pid 25311:tid 25334] [client 4.204.200.32:36798] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZ_PSNfdM__yZAgJFSuzygAAAZQ"]
[Thu Feb 26 12:42:48.868358 2026] [:error] [pid 55618:tid 55633] [client 4.204.200.32:36802] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kolda.php"] [unique_id "aZ_PSB61Vrh12f_8oWRoAwAAAQw"]
[Thu Feb 26 12:42:49.291647 2026] [:error] [pid 55122:tid 55134] [client 4.204.200.32:36688] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nw.php"] [unique_id "aZ_PSYLiR0OfjFxvcN-zMQAAAMo"]
[Thu Feb 26 12:42:49.722442 2026] [:error] [pid 25311:tid 25332] [client 4.204.200.32:36814] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nw.php"] [unique_id "aZ_PSdfdM__yZAgJFSuzzgAAAZI"]
[Thu Feb 26 12:42:50.145141 2026] [:error] [pid 55051:tid 55077] [client 4.204.200.32:36788] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nw.php"] [unique_id "aZ_PSgmK1w2kZvh5eLHbVwAAAJc"]
[Thu Feb 26 12:42:50.625052 2026] [:error] [pid 25311:tid 25337] [client 4.204.200.32:36856] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nw.php"] [unique_id "aZ_PStfdM__yZAgJFSuz0wAAAZc"]
[Thu Feb 26 12:42:51.056177 2026] [:error] [pid 25311:tid 25318] [client 4.204.200.32:36755] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aZ_PS9fdM__yZAgJFSuz1wAAAYQ"]
[Thu Feb 26 12:42:51.581327 2026] [:error] [pid 25311:tid 25334] [client 4.204.200.32:36696] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aZ_PS9fdM__yZAgJFSuz2gAAAZQ"]
[Thu Feb 26 12:42:52.086848 2026] [:error] [pid 55051:tid 55065] [client 4.204.200.32:36750] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aZ_PTAmK1w2kZvh5eLHbWgAAAIs"]
[Thu Feb 26 12:42:52.543434 2026] [:error] [pid 55618:tid 55643] [client 4.204.200.32:36789] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aZ_PTB61Vrh12f_8oWRoEwAAARY"]
[Thu Feb 26 12:42:52.967052 2026] [:error] [pid 55618:tid 55633] [client 4.204.200.32:36693] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aZ_PTB61Vrh12f_8oWRoFwAAAQw"]
[Thu Feb 26 12:42:53.399484 2026] [:error] [pid 55051:tid 55059] [client 4.204.200.32:36744] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aZ_PTQmK1w2kZvh5eLHbWwAAAIU"]
[Thu Feb 26 12:42:53.821116 2026] [:error] [pid 55051:tid 55063] [client 4.204.200.32:36843] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aZ_PTQmK1w2kZvh5eLHbXAAAAIk"]
[Thu Feb 26 12:42:54.238474 2026] [:error] [pid 55618:tid 55636] [client 4.204.200.32:36680] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aZ_PTh61Vrh12f_8oWRoIAAAAQ8"]
[Thu Feb 26 12:42:54.655697 2026] [:error] [pid 3883:tid 3887] [client 4.204.200.32:36647] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aZ_PTuA33x90V6yYHahLDAAAAUE"]
[Thu Feb 26 12:42:55.080328 2026] [:error] [pid 3883:tid 3891] [client 4.204.200.32:36793] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aZ_PT-A33x90V6yYHahLDQAAAUU"]
[Thu Feb 26 12:42:55.531211 2026] [:error] [pid 3883:tid 3886] [client 4.204.200.32:36678] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aZ_PT-A33x90V6yYHahLEQAAAUA"]
[Thu Feb 26 12:42:55.952353 2026] [:error] [pid 55122:tid 55136] [client 4.204.200.32:36679] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aZ_PT4LiR0OfjFxvcN-zPAAAAMw"]
[Thu Feb 26 12:42:56.372854 2026] [:error] [pid 3883:tid 3890] [client 4.204.200.32:36684] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aZ_PUOA33x90V6yYHahLFQAAAUQ"]
[Thu Feb 26 12:42:56.810120 2026] [:error] [pid 55051:tid 55074] [client 4.204.200.32:36766] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aZ_PUAmK1w2kZvh5eLHbXQAAAJQ"]
[Thu Feb 26 12:42:57.224976 2026] [:error] [pid 3883:tid 3899] [client 4.204.200.32:36739] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aZ_PUeA33x90V6yYHahLGQAAAU0"]
[Thu Feb 26 12:42:57.650037 2026] [:error] [pid 3883:tid 3887] [client 4.204.200.32:36796] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aZ_PUeA33x90V6yYHahLHgAAAUE"]
[Thu Feb 26 12:42:58.083083 2026] [:error] [pid 3883:tid 3891] [client 4.204.200.32:36819] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aZ_PUuA33x90V6yYHahLIAAAAUU"]
[Thu Feb 26 12:42:58.505191 2026] [:error] [pid 3883:tid 3886] [client 4.204.200.32:36729] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aZ_PUuA33x90V6yYHahLIgAAAUA"]
[Thu Feb 26 12:42:58.933547 2026] [:error] [pid 3883:tid 3906] [client 4.204.200.32:36767] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aZ_PUuA33x90V6yYHahLJAAAAVQ"]
[Thu Feb 26 12:42:59.376823 2026] [:error] [pid 55618:tid 55632] [client 4.204.200.32:36790] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aZ_PUx61Vrh12f_8oWRoLwAAAQs"]
[Thu Feb 26 12:42:59.797602 2026] [:error] [pid 55122:tid 55136] [client 4.204.200.32:36786] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aZ_PU4LiR0OfjFxvcN-zUQAAAMw"]
[Thu Feb 26 12:43:00.219605 2026] [:error] [pid 3883:tid 3907] [client 4.204.200.32:36619] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aZ_PVOA33x90V6yYHahLKgAAAVU"]
[Thu Feb 26 12:43:00.635600 2026] [:error] [pid 3883:tid 3899] [client 4.204.200.32:36785] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aZ_PVOA33x90V6yYHahLKwAAAU0"]
[Thu Feb 26 12:43:01.086930 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36674] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aZ_PVdfdM__yZAgJFSuz5wAAAYg"]
[Thu Feb 26 12:43:01.507320 2026] [:error] [pid 3883:tid 3892] [client 4.204.200.32:36728] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/login8.php"] [unique_id "aZ_PVeA33x90V6yYHahLLwAAAUY"]
[Thu Feb 26 12:43:01.922975 2026] [:error] [pid 3883:tid 3894] [client 4.204.200.32:36759] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/login8.php"] [unique_id "aZ_PVeA33x90V6yYHahLNAAAAUg"]
[Thu Feb 26 12:43:02.349729 2026] [:error] [pid 3883:tid 3900] [client 4.204.200.32:36746] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/login8.php"] [unique_id "aZ_PVuA33x90V6yYHahLNwAAAU4"]
[Thu Feb 26 12:43:02.778500 2026] [:error] [pid 25311:tid 25338] [client 4.204.200.32:36698] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/login8.php"] [unique_id "aZ_PVtfdM__yZAgJFSuz7AAAAZg"]
[Thu Feb 26 12:43:03.232209 2026] [:error] [pid 3883:tid 3898] [client 4.204.200.32:36682] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aZ_PV-A33x90V6yYHahLPwAAAUw"]
[Thu Feb 26 12:43:03.652935 2026] [:error] [pid 3883:tid 3908] [client 4.204.200.32:36780] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aZ_PV-A33x90V6yYHahLQgAAAVY"]
[Thu Feb 26 12:43:04.157249 2026] [:error] [pid 25311:tid 25323] [client 4.204.200.32:36805] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aZ_PWNfdM__yZAgJFSuz8QAAAYk"]
[Thu Feb 26 12:43:04.593179 2026] [:error] [pid 55618:tid 55633] [client 4.204.200.32:36730] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aZ_PWB61Vrh12f_8oWRoOAAAAQw"]
[Thu Feb 26 12:43:05.021353 2026] [:error] [pid 3883:tid 3906] [client 4.204.200.32:36810] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aZ_PWeA33x90V6yYHahLSQAAAVQ"]
[Thu Feb 26 12:43:05.454020 2026] [:error] [pid 3883:tid 3898] [client 4.204.200.32:36816] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aZ_PWeA33x90V6yYHahLSwAAAUw"]
[Thu Feb 26 12:43:05.881778 2026] [:error] [pid 3883:tid 3907] [client 4.204.200.32:36716] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aZ_PWeA33x90V6yYHahLTgAAAVU"]
[Thu Feb 26 12:43:06.366617 2026] [:error] [pid 55618:tid 55627] [client 4.204.200.32:36701] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aZ_PWh61Vrh12f_8oWRoOwAAAQY"]
[Thu Feb 26 12:43:06.794631 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:36717] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lul.php"] [unique_id "aZ_PWuA33x90V6yYHahLUgAAAVg"]
[Thu Feb 26 12:43:07.219167 2026] [:error] [pid 55122:tid 55137] [client 4.204.200.32:36815] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lul.php"] [unique_id "aZ_PW4LiR0OfjFxvcN-zaAAAAM0"]
[Thu Feb 26 12:43:07.678536 2026] [:error] [pid 54991:tid 55044] [client 4.204.200.32:36781] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lul.php"] [unique_id "aZ_PW94Zx-mJ8gbRB2iGhwAAAFg"]
[Thu Feb 26 12:43:08.151965 2026] [:error] [pid 55618:tid 55632] [client 4.204.200.32:36615] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lul.php"] [unique_id "aZ_PXB61Vrh12f_8oWRoQAAAAQs"]
[Thu Feb 26 12:43:08.572117 2026] [:error] [pid 55618:tid 55626] [client 4.204.200.32:36713] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0.php"] [unique_id "aZ_PXB61Vrh12f_8oWRoQgAAAQU"]
[Thu Feb 26 12:43:09.023722 2026] [:error] [pid 55618:tid 55631] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Thu Feb 26 12:43:09.255151 2026] [:error] [pid 55618:tid 55636] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Feb 26 12:43:09.467794 2026] [:error] [pid 55618:tid 55634] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/ya.php
[Thu Feb 26 12:43:09.679781 2026] [:error] [pid 55618:tid 55640] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Thu Feb 26 12:43:09.896979 2026] [:error] [pid 55618:tid 55644] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Feb 26 12:43:10.143184 2026] [:error] [pid 55618:tid 55642] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Thu Feb 26 12:43:10.363918 2026] [:error] [pid 55618:tid 55628] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/a1vx.php
[Thu Feb 26 12:43:10.605878 2026] [:error] [pid 55618:tid 55633] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Thu Feb 26 12:43:10.850623 2026] [:error] [pid 55618:tid 55637] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Feb 26 12:43:11.067602 2026] [:error] [pid 55618:tid 55624] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Thu Feb 26 12:43:11.280248 2026] [:error] [pid 55618:tid 55627] [client 4.204.200.32:36849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Thu Feb 26 12:43:11.497619 2026] [:error] [pid 55618:tid 55623] [client 4.204.200.32:36849] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aZ_PXx61Vrh12f_8oWRoUwAAAQI"]
[Thu Feb 26 12:43:11.981805 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36718] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aZ_PX9fdM__yZAgJFSu0BAAAAYg"]
[Thu Feb 26 12:43:12.516257 2026] [:error] [pid 55618:tid 55645] [client 4.204.200.32:36844] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aZ_PYB61Vrh12f_8oWRoVgAAARg"]
[Thu Feb 26 12:43:13.196996 2026] [:error] [pid 3883:tid 3892] [client 4.204.200.32:36710] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aZ_PYeA33x90V6yYHahLZwAAAUY"]
[Thu Feb 26 12:43:13.683738 2026] [:error] [pid 3883:tid 3901] [client 4.204.200.32:36705] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZ_PYeA33x90V6yYHahLaQAAAU8"]
[Thu Feb 26 12:43:14.210406 2026] [:error] [pid 3883:tid 3905] [client 4.204.200.32:36734] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZ_PYuA33x90V6yYHahLcAAAAVM"]
[Thu Feb 26 12:43:14.702539 2026] [:error] [pid 25311:tid 25323] [client 4.204.200.32:36720] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZ_PYtfdM__yZAgJFSu0CAAAAYk"]
[Thu Feb 26 12:43:15.165472 2026] [:error] [pid 25311:tid 25335] [client 4.204.200.32:36820] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aZ_PY9fdM__yZAgJFSu0CQAAAZU"]
[Thu Feb 26 12:43:15.731993 2026] [:error] [pid 55051:tid 55060] [client 4.204.200.32:36609] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZ_PYwmK1w2kZvh5eLHbbwAAAIY"]
[Thu Feb 26 12:43:16.219926 2026] [:error] [pid 25311:tid 25337] [client 4.204.200.32:36690] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZ_PZNfdM__yZAgJFSu0DQAAAZc"]
[Thu Feb 26 12:43:16.766863 2026] [:error] [pid 55618:tid 55633] [client 4.204.200.32:36806] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZ_PZB61Vrh12f_8oWRoXQAAAQw"]
[Thu Feb 26 12:43:17.248524 2026] [:error] [pid 3883:tid 3901] [client 4.204.200.32:36764] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aZ_PZeA33x90V6yYHahLfQAAAU8"]
[Thu Feb 26 12:43:17.870452 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36811] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aZ_PZdfdM__yZAgJFSu0EwAAAYg"]
[Thu Feb 26 12:43:18.328961 2026] [:error] [pid 55051:tid 55071] [client 4.204.200.32:36847] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aZ_PZgmK1w2kZvh5eLHbcQAAAJE"]
[Thu Feb 26 12:43:18.840044 2026] [:error] [pid 55122:tid 55133] [client 4.204.200.32:36644] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aZ_PZoLiR0OfjFxvcN-znQAAAMk"]
[Thu Feb 26 12:43:19.358049 2026] [:error] [pid 3883:tid 3888] [client 4.204.200.32:36545] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aZ_PZ-A33x90V6yYHahLhQAAAUI"]
[Thu Feb 26 12:43:19.801558 2026] [:error] [pid 55618:tid 55626] [client 4.204.200.32:36702] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZ_PZx61Vrh12f_8oWRoZwAAAQU"]
[Thu Feb 26 12:43:20.240847 2026] [:error] [pid 25311:tid 25327] [client 4.204.200.32:36853] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZ_PaNfdM__yZAgJFSu0FwAAAY0"]
[Thu Feb 26 12:43:20.677466 2026] [:error] [pid 55051:tid 55069] [client 4.204.200.32:36686] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZ_PaAmK1w2kZvh5eLHbcwAAAI8"]
[Thu Feb 26 12:43:21.138429 2026] [:error] [pid 25311:tid 25336] [client 4.204.200.32:36611] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev1s.php"] [unique_id "aZ_PadfdM__yZAgJFSu0HAAAAZY"]
[Thu Feb 26 12:43:21.574064 2026] [:error] [pid 25311:tid 25322] [client 4.204.200.32:36573] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZ_PadfdM__yZAgJFSu0HwAAAYg"]
[Thu Feb 26 12:43:22.071575 2026] [:error] [pid 55051:tid 55070] [client 4.204.200.32:36765] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZ_PagmK1w2kZvh5eLHbdAAAAJA"]
[Thu Feb 26 12:43:22.494956 2026] [:error] [pid 55618:tid 55635] [client 4.204.200.32:36722] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZ_Pah61Vrh12f_8oWRobQAAAQ4"]
[Thu Feb 26 12:43:22.937155 2026] [:error] [pid 55618:tid 55640] [client 4.204.200.32:36610] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ffd.php"] [unique_id "aZ_Pah61Vrh12f_8oWRocgAAARM"]
[Thu Feb 26 14:47:50.447662 2026] [:error] [pid 54990:tid 55007] [client 103.186.30.186:50907] [client 103.186.30.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aZ_slntr2qmt_mBhH2zlZQAAAA4"]
[Thu Feb 26 15:01:07.732153 2026] [:error] [pid 3883:tid 3890] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Feb 26 15:01:07.855932 2026] [:error] [pid 3883:tid 3892] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Feb 26 15:01:07.979458 2026] [:error] [pid 3883:tid 3888] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Feb 26 15:01:08.110322 2026] [:error] [pid 3883:tid 3905] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Feb 26 15:01:08.231277 2026] [:error] [pid 3883:tid 3908] [client 20.89.254.160:17010] [client 20.89.254.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.89.254.160, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aZ_vtOA33x90V6yYHaiTKgAAAVY"]
[Thu Feb 26 15:01:08.236462 2026] [:error] [pid 3883:tid 3908] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 26 15:01:08.359797 2026] [:error] [pid 3883:tid 3902] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Feb 26 15:01:08.484900 2026] [:error] [pid 3883:tid 3896] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Feb 26 15:01:08.607977 2026] [:error] [pid 3883:tid 3894] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Thu Feb 26 15:01:08.731006 2026] [:error] [pid 3883:tid 3910] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Feb 26 15:01:08.855065 2026] [:error] [pid 3883:tid 3906] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Thu Feb 26 15:01:08.978689 2026] [:error] [pid 3883:tid 3897] [client 20.89.254.160:17010] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Thu Feb 26 15:01:09.098161 2026] [:error] [pid 3883:tid 3889] [client 20.89.254.160:17010] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZ_vteA33x90V6yYHaiTMQAAAUM"]
[Thu Feb 26 15:01:09.612300 2026] [:error] [pid 54991:tid 55021] [client 20.89.254.160:9580] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZ_vtd4Zx-mJ8gbRB2iYXgAAAEE"]
[Thu Feb 26 15:01:10.095007 2026] [:error] [pid 54991:tid 55026] [client 20.89.254.160:13617] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZ_vtt4Zx-mJ8gbRB2iYYgAAAEY"]
[Thu Feb 26 15:01:10.596555 2026] [:error] [pid 20419:tid 20432] [client 20.89.254.160:1461] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aZ_vtu3DVDvMfTYYUBW9pgAAAco"]
[Thu Feb 26 18:10:11.423797 2026] [:error] [pid 20419:tid 20425] [client 20.89.52.173:5003] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Feb 26 18:10:11.539902 2026] [:error] [pid 20419:tid 20422] [client 20.89.52.173:5003] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/autoload_classmap.php
[Thu Feb 26 18:10:11.657742 2026] [:error] [pid 20419:tid 20443] [client 20.89.52.173:5003] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Thu Feb 26 18:10:12.356935 2026] [:error] [pid 20419:tid 20434] [client 20.89.52.173:5003] [client 20.89.52.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaAcBO3DVDvMfTYYUBUAnAAAAcw"]
[Thu Feb 26 18:10:12.810181 2026] [:error] [pid 25311:tid 25317] [client 20.89.52.173:4716] [client 20.89.52.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaAcBNfdM__yZAgJFStpvAAAAYM"]
[Thu Feb 26 18:10:13.263608 2026] [:error] [pid 55051:tid 55059] [client 20.89.52.173:5000] [client 20.89.52.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaAcBQmK1w2kZvh5eLE_OwAAAIU"]
[Thu Feb 26 18:10:13.723363 2026] [:error] [pid 3883:tid 3903] [client 20.89.52.173:5008] [client 20.89.52.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaAcBeA33x90V6yYHageEgAAAVE"]
[Thu Feb 26 18:58:40.734112 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Feb 26 18:58:40.913857 2026] [:error] [pid 55618:tid 55632] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Feb 26 18:58:41.070331 2026] [:error] [pid 55618:tid 55639] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Feb 26 18:58:41.211785 2026] [:error] [pid 55618:tid 55636] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Feb 26 18:58:41.366758 2026] [:error] [pid 55618:tid 55627] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Feb 26 18:58:41.512705 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Feb 26 18:58:41.656269 2026] [:error] [pid 55618:tid 55625] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Feb 26 18:58:41.820705 2026] [:error] [pid 55618:tid 55631] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Feb 26 18:58:42.454304 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Feb 26 18:58:42.802752 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Feb 26 18:58:42.937881 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Feb 26 18:58:43.098471 2026] [:error] [pid 55618:tid 55628] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Feb 26 18:58:43.257229 2026] [:error] [pid 55618:tid 55637] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Feb 26 18:58:43.692652 2026] [:error] [pid 55618:tid 55639] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Feb 26 18:58:43.893662 2026] [:error] [pid 55618:tid 55633] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Feb 26 18:58:44.120073 2026] [:error] [pid 55618:tid 55627] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Feb 26 18:58:44.253301 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Feb 26 18:58:45.033225 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.39:48483] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Feb 26 18:58:47.558781 2026] [:error] [pid 55618:tid 55627] [client 193.37.32.39:48483] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaAnZx61Vrh12f_8oWTpiAAAAQY"]
[Thu Feb 26 18:58:48.564623 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.4:43735] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaAnaNfdM__yZAgJFSudoAAAAYg"]
[Thu Feb 26 18:58:49.552061 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.5:64293] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Feb 26 18:58:50.023202 2026] [:error] [pid 55618:tid 55629] [client 193.37.32.5:64293] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaAnah61Vrh12f_8oWTpmgAAAQg"]
[Thu Feb 26 18:58:50.642416 2026] [:error] [pid 54990:tid 55016] [client 193.37.32.48:29183] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Feb 26 18:58:50.803845 2026] [:error] [pid 54990:tid 55008] [client 193.37.32.48:29183] [client 193.37.32.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaAnantr2qmt_mBhH2wVPwAAAA8"]
[Thu Feb 26 18:58:51.210268 2026] [:error] [pid 44444:tid 44468] [client 193.37.32.41:55345] [client 193.37.32.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaAna22sMNmj-yekUk25_wAAAhI"]
[Thu Feb 26 18:58:51.526201 2026] [:error] [pid 25311:tid 25335] [client 193.37.32.25:58577] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Feb 26 18:58:52.615885 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.25:58577] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaAnbNfdM__yZAgJFSud0AAAAYs"]
[Thu Feb 26 18:58:53.090196 2026] [:error] [pid 55618:tid 55637] [client 193.37.32.42:25535] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaAnbR61Vrh12f_8oWTptgAAARA"]
[Thu Feb 26 18:58:53.334796 2026] [:error] [pid 54991:tid 55033] [client 193.37.32.9:26989] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaAnbd4Zx-mJ8gbRB2jPfQAAAE0"]
[Thu Feb 26 18:58:53.662557 2026] [:error] [pid 54991:tid 55039] [client 193.37.32.5:47779] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaAnbd4Zx-mJ8gbRB2jPfwAAAFM"]
[Thu Feb 26 18:58:53.948769 2026] [:error] [pid 54990:tid 55005] [client 193.37.32.46:54931] [client 193.37.32.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaAnbXtr2qmt_mBhH2wVXAAAAAw"]
[Thu Feb 26 18:58:54.430244 2026] [:error] [pid 54991:tid 55036] [client 193.37.32.19:26679] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaAnbt4Zx-mJ8gbRB2jPhQAAAFA"]
[Thu Feb 26 18:58:54.892709 2026] [:error] [pid 44444:tid 44466] [client 193.37.32.39:42255] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaAnbm2sMNmj-yekUk26HwAAAhA"]
[Thu Feb 26 18:58:55.226221 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.9:64163] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Feb 26 18:58:56.199195 2026] [:error] [pid 3883:tid 3889] [client 193.37.32.9:64163] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aaAncOA33x90V6yYHahoegAAAUM"]
[Thu Feb 26 18:58:56.938100 2026] [:error] [pid 20419:tid 20441] [client 193.37.32.26:33085] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaAncO3DVDvMfTYYUBUq1gAAAdM"]
[Thu Feb 26 18:58:57.777245 2026] [:error] [pid 25311:tid 25327] [client 193.37.32.22:55575] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaAncdfdM__yZAgJFSud_QAAAY0"]
[Thu Feb 26 18:58:58.058920 2026] [:error] [pid 55618:tid 55622] [client 193.37.32.7:24291] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Feb 26 18:58:58.238409 2026] [:error] [pid 55618:tid 55632] [client 193.37.32.7:24291] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaAnch61Vrh12f_8oWTp6wAAAQs"]
[Thu Feb 26 18:58:58.576506 2026] [:error] [pid 55122:tid 55135] [client 193.37.32.38:35477] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Feb 26 18:58:59.891090 2026] [:error] [pid 55122:tid 55136] [client 193.37.32.38:35477] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Feb 26 18:59:00.378324 2026] [:error] [pid 55122:tid 55137] [client 193.37.32.38:35477] [client 193.37.32.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaAndILiR0OfjFxvcN8VEAAAAM0"]
[Thu Feb 26 18:59:01.398682 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.43:31371] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Feb 26 18:59:01.582091 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.43:31371] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaAndeA33x90V6yYHahopAAAAU8"]
[Thu Feb 26 18:59:02.015613 2026] [:error] [pid 44444:tid 44467] [client 193.37.32.9:27359] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Feb 26 18:59:02.382313 2026] [:error] [pid 44444:tid 44452] [client 193.37.32.9:27359] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaAndm2sMNmj-yekUk26ggAAAgI"]
[Thu Feb 26 18:59:03.037858 2026] [:error] [pid 44444:tid 44465] [client 193.37.32.44:22295] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaAnd22sMNmj-yekUk26hwAAAg8"]
[Thu Feb 26 18:59:03.385511 2026] [:error] [pid 54990:tid 54993] [client 193.37.32.19:37337] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Feb 26 18:59:03.512131 2026] [:error] [pid 54990:tid 55000] [client 193.37.32.19:37337] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Feb 26 18:59:03.790168 2026] [:error] [pid 54990:tid 55007] [client 193.37.32.19:37337] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaAnd3tr2qmt_mBhH2wVtQAAAA4"]
[Thu Feb 26 18:59:04.208201 2026] [:error] [pid 54991:tid 55034] [client 193.37.32.35:60149] [client 193.37.32.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaAneN4Zx-mJ8gbRB2jP1wAAAE4"]
[Thu Feb 26 18:59:04.650575 2026] [:error] [pid 44444:tid 44474] [client 193.37.32.29:35129] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaAneG2sMNmj-yekUk26mQAAAhg"]
[Thu Feb 26 18:59:09.098221 2026] [:error] [pid 3883:tid 3890] [client 193.37.32.16:53429] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaAnfeA33x90V6yYHahpLAAAAUQ"]
[Thu Feb 26 18:59:09.804142 2026] [:error] [pid 20419:tid 20436] [client 193.37.32.6:47495] [client 193.37.32.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaAnfe3DVDvMfTYYUBUrZAAAAc4"]
[Thu Feb 26 18:59:11.739259 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.8:23925] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Feb 26 18:59:11.894176 2026] [:error] [pid 55618:tid 55623] [client 193.37.32.8:23925] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaAnfx61Vrh12f_8oWTqfAAAAQI"]
[Thu Feb 26 18:59:12.207695 2026] [:error] [pid 54990:tid 55010] [client 193.37.32.26:43057] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaAngHtr2qmt_mBhH2wV6QAAABE"]
[Thu Feb 26 18:59:12.630990 2026] [:error] [pid 55122:tid 55125] [client 193.37.32.40:44867] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaAngILiR0OfjFxvcN8VaAAAAME"]
[Thu Feb 26 18:59:13.453895 2026] [:error] [pid 54991:tid 55033] [client 193.37.32.51:25827] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Feb 26 18:59:13.824012 2026] [:error] [pid 54991:tid 55042] [client 193.37.32.51:25827] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Feb 26 18:59:15.982960 2026] [:error] [pid 54991:tid 55044] [client 193.37.32.51:25827] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaAng94Zx-mJ8gbRB2jQPwAAAFg"]
[Thu Feb 26 18:59:18.067799 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.18:64797] [client 193.37.32.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.18, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaAnhuA33x90V6yYHahpxAAAAUw"]
[Thu Feb 26 18:59:18.215189 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.18:64797] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Feb 26 18:59:19.452568 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.18:64797] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Feb 26 18:59:19.656025 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.18:64797] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Feb 26 18:59:20.593234 2026] [:error] [pid 3883:tid 3893] [client 193.37.32.18:64797] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaAniOA33x90V6yYHahqBwAAAUc"]
[Thu Feb 26 18:59:21.080670 2026] [:error] [pid 54991:tid 55021] [client 193.37.32.10:20693] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Feb 26 18:59:21.508956 2026] [:error] [pid 54991:tid 55033] [client 193.37.32.10:20693] [client 193.37.32.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.10, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaAnid4Zx-mJ8gbRB2jQcgAAAE0"]
[Thu Feb 26 18:59:22.802355 2026] [:error] [pid 54991:tid 55026] [client 193.37.32.10:20693] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aaAnit4Zx-mJ8gbRB2jQfQAAAEY"]
[Thu Feb 26 18:59:24.010112 2026] [:error] [pid 44444:tid 44461] [client 193.37.32.50:41559] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Feb 26 18:59:24.331768 2026] [:error] [pid 44444:tid 44451] [client 193.37.32.50:41559] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Feb 26 18:59:25.023778 2026] [:error] [pid 44444:tid 44472] [client 193.37.32.50:41559] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaAnjW2sMNmj-yekUk27tQAAAhY"]
[Thu Feb 26 18:59:25.477307 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.13:60253] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Feb 26 18:59:25.944781 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.13:60253] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Feb 26 18:59:26.222831 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.13:60253] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Feb 26 18:59:26.542857 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.13:60253] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Feb 26 18:59:26.686084 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.13:60253] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaAnjuA33x90V6yYHahqbQAAAU4"]
[Thu Feb 26 18:59:27.019829 2026] [:error] [pid 54991:tid 55035] [client 193.37.32.14:51629] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Feb 26 18:59:27.171790 2026] [:error] [pid 54991:tid 55028] [client 193.37.32.14:51629] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Feb 26 18:59:27.320926 2026] [:error] [pid 54991:tid 55030] [client 193.37.32.14:51629] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaAnj94Zx-mJ8gbRB2jQowAAAEo"]
[Thu Feb 26 18:59:28.814945 2026] [:error] [pid 20419:tid 20436] [client 193.37.32.50:25649] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Feb 26 18:59:29.102288 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.50:25649] [client 193.37.32.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.50, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaAnke3DVDvMfTYYUBUsKgAAAcQ"]
[Thu Feb 26 18:59:29.260749 2026] [:error] [pid 20419:tid 20429] [client 193.37.32.50:25649] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaAnke3DVDvMfTYYUBUsKwAAAcc"]
[Thu Feb 26 18:59:32.559695 2026] [:error] [pid 3883:tid 3899] [client 193.37.32.21:34895] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Feb 26 18:59:34.047050 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.21:34895] [client 193.37.32.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaAnluA33x90V6yYHahrOAAAAVc"]
[Thu Feb 26 18:59:34.643165 2026] [:error] [pid 54990:tid 55006] [client 193.37.32.40:61007] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Feb 26 18:59:34.782254 2026] [:error] [pid 54990:tid 55011] [client 193.37.32.40:61007] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaAnlntr2qmt_mBhH2wWjAAAABI"]
[Thu Feb 26 18:59:35.062687 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.42:54079] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Feb 26 18:59:35.515954 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.42:54079] [client 193.37.32.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.42, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaAnl-A33x90V6yYHahrWwAAAUA"]
[Thu Feb 26 18:59:35.665897 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.42:54079] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Feb 26 18:59:35.828939 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.42:54079] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Feb 26 18:59:36.008752 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.42:54079] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Feb 26 18:59:36.166207 2026] [:error] [pid 3883:tid 3897] [client 193.37.32.42:54079] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaAnmOA33x90V6yYHahrawAAAUs"]
[Thu Feb 26 18:59:36.514296 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.51:38639] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Feb 26 18:59:36.962174 2026] [:error] [pid 3883:tid 3910] [client 193.37.32.51:38639] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aaAnmOA33x90V6yYHahrfAAAAVg"]
[Thu Feb 26 18:59:37.508211 2026] [:error] [pid 55618:tid 55632] [client 193.37.32.130:42249] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Feb 26 18:59:37.655565 2026] [:error] [pid 55618:tid 55625] [client 193.37.32.130:42249] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaAnmR61Vrh12f_8oWTrHwAAAQQ"]
[Thu Feb 26 18:59:38.304011 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.48:20281] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Feb 26 18:59:38.579277 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.48:20281] [client 193.37.32.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaAnmuA33x90V6yYHahrqAAAAUA"]
[Thu Feb 26 18:59:40.078486 2026] [:error] [pid 3883:tid 3905] [client 193.37.32.31:33457] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaAnnOA33x90V6yYHahruAAAAVM"]
[Thu Feb 26 18:59:40.775534 2026] [:error] [pid 54991:tid 55023] [client 193.37.32.52:65159] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Feb 26 18:59:40.967337 2026] [:error] [pid 54991:tid 55030] [client 193.37.32.52:65159] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Feb 26 18:59:41.915085 2026] [:error] [pid 54991:tid 55038] [client 193.37.32.52:65159] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaAnnd4Zx-mJ8gbRB2jQ-AAAAFI"]
[Thu Feb 26 18:59:42.338722 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.23:61047] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaAnntfdM__yZAgJFSufiAAAAYQ"]
[Thu Feb 26 18:59:43.144974 2026] [:error] [pid 54990:tid 55007] [client 193.37.32.52:47281] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aaAnn3tr2qmt_mBhH2wW-gAAAA4"]
[Thu Feb 26 18:59:43.476790 2026] [:error] [pid 54990:tid 55005] [client 193.37.32.14:57945] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Feb 26 18:59:43.799615 2026] [:error] [pid 54990:tid 54996] [client 193.37.32.14:57945] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Feb 26 18:59:43.931207 2026] [:error] [pid 54990:tid 54993] [client 193.37.32.14:57945] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaAnn3tr2qmt_mBhH2wXBAAAAAA"]
[Thu Feb 26 18:59:44.218556 2026] [:error] [pid 20419:tid 20429] [client 193.37.32.36:28043] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Feb 26 18:59:44.513873 2026] [:error] [pid 20419:tid 20423] [client 193.37.32.36:28043] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aaAnoO3DVDvMfTYYUBUsdgAAAcE"]
[Thu Feb 26 18:59:45.324807 2026] [:error] [pid 55618:tid 55630] [client 193.37.32.17:35697] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaAnoR61Vrh12f_8oWTrWwAAAQk"]
[Thu Feb 26 18:59:45.986137 2026] [:error] [pid 44444:tid 44463] [client 193.37.32.53:49033] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Feb 26 18:59:46.800253 2026] [:error] [pid 44444:tid 44459] [client 193.37.32.53:49033] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Feb 26 18:59:47.158900 2026] [:error] [pid 44444:tid 44463] [client 193.37.32.53:49033] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Feb 26 18:59:47.312360 2026] [:error] [pid 44444:tid 44464] [client 193.37.32.53:49033] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaAno22sMNmj-yekUk29QwAAAg4"]
[Thu Feb 26 18:59:48.674558 2026] [:error] [pid 55122:tid 55145] [client 193.37.32.31:65039] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaAnpILiR0OfjFxvcN8XSQAAANU"]
[Thu Feb 26 18:59:48.907055 2026] [:error] [pid 55122:tid 55136] [client 193.37.32.6:63989] [client 193.37.32.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaAnpILiR0OfjFxvcN8XTwAAAMw"]
[Thu Feb 26 18:59:49.248407 2026] [:error] [pid 20419:tid 20431] [client 193.37.32.23:26711] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaAnpe3DVDvMfTYYUBUsqAAAAck"]
[Thu Feb 26 18:59:50.178694 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.50:35015] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Feb 26 18:59:52.993010 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.50:35015] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaAnqNfdM__yZAgJFSugPAAAAYs"]
[Thu Feb 26 18:59:53.302723 2026] [:error] [pid 3883:tid 3899] [client 193.37.32.27:25037] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaAnqeA33x90V6yYHahsXQAAAU0"]
[Thu Feb 26 18:59:53.595340 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.36:46343] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Feb 26 18:59:53.941443 2026] [:error] [pid 3883:tid 3899] [client 193.37.32.36:46343] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaAnqeA33x90V6yYHahscQAAAU0"]
[Thu Feb 26 18:59:54.289463 2026] [:error] [pid 55618:tid 55636] [client 193.37.32.31:63093] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaAnqh61Vrh12f_8oWTrngAAAQ8"]
[Thu Feb 26 18:59:54.591096 2026] [:error] [pid 55051:tid 55063] [client 193.37.32.31:40767] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaAnqgmK1w2kZvh5eLF4YgAAAIk"]
[Thu Feb 26 18:59:55.310451 2026] [:error] [pid 3883:tid 3902] [client 193.37.32.29:64935] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaAnq-A33x90V6yYHahsjAAAAVA"]
[Thu Feb 26 18:59:55.823894 2026] [:error] [pid 20419:tid 20440] [client 193.37.32.23:48841] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaAnq-3DVDvMfTYYUBUs8QAAAdI"]
[Thu Feb 26 18:59:56.853959 2026] [:error] [pid 54990:tid 55006] [client 193.37.32.32:21171] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaAnrHtr2qmt_mBhH2wXfAAAAA0"]
[Thu Feb 26 18:59:57.131239 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.31:54305] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Feb 26 18:59:57.716005 2026] [:error] [pid 25311:tid 25327] [client 193.37.32.31:54305] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Feb 26 18:59:57.947324 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.31:54305] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaAnrdfdM__yZAgJFSugjwAAAY8"]
[Thu Feb 26 18:59:58.513154 2026] [:error] [pid 54990:tid 55008] [client 193.37.32.52:57807] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Feb 26 18:59:58.653887 2026] [:error] [pid 54990:tid 55013] [client 193.37.32.52:57807] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Feb 26 18:59:59.578973 2026] [:error] [pid 54990:tid 54997] [client 193.37.32.52:57807] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaAnr3tr2qmt_mBhH2wXrQAAAAQ"]
[Thu Feb 26 19:00:00.413976 2026] [:error] [pid 3883:tid 3889] [client 193.37.32.24:38493] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaAnsOA33x90V6yYHahs1QAAAUM"]
[Thu Feb 26 19:00:00.731408 2026] [:error] [pid 54991:tid 55035] [client 193.37.32.27:20615] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaAnsN4Zx-mJ8gbRB2jRdQAAAE8"]
[Thu Feb 26 19:00:01.874022 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.9:29213] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaAnsdfdM__yZAgJFSugxQAAAYM"]
[Thu Feb 26 19:00:03.132929 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.30:59167] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Feb 26 19:00:03.337028 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.30:59167] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Feb 26 19:00:03.575197 2026] [:error] [pid 25311:tid 25323] [client 193.37.32.30:59167] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Feb 26 19:00:03.747913 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.30:59167] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Feb 26 19:00:06.120283 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.30:59167] [client 193.37.32.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaAnttfdM__yZAgJFSug_QAAAYQ"]
[Thu Feb 26 19:00:06.426157 2026] [:error] [pid 25311:tid 25314] [client 193.37.32.37:44087] [client 193.37.32.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaAnttfdM__yZAgJFSug_wAAAYA"]
[Thu Feb 26 19:00:06.911453 2026] [:error] [pid 3883:tid 3905] [client 193.37.32.50:22791] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaAntuA33x90V6yYHahtKAAAAVM"]
[Thu Feb 26 19:00:08.248544 2026] [:error] [pid 25311:tid 25314] [client 193.37.32.16:60397] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaAnuNfdM__yZAgJFSuhDQAAAYA"]
[Thu Feb 26 19:00:08.562192 2026] [:error] [pid 54991:tid 55025] [client 193.37.32.18:46353] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaAnuN4Zx-mJ8gbRB2jRzQAAAEU"]
[Thu Feb 26 19:00:08.853829 2026] [:error] [pid 54990:tid 55003] [client 193.37.32.130:34087] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaAnuHtr2qmt_mBhH2wYAQAAAAo"]
[Thu Feb 26 19:00:09.446272 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.32:59881] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaAnueA33x90V6yYHahtTAAAAVU"]
[Thu Feb 26 19:00:10.346035 2026] [:error] [pid 54991:tid 55022] [client 193.37.32.27:51563] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaAnut4Zx-mJ8gbRB2jR3QAAAEI"]
[Thu Feb 26 19:00:10.706286 2026] [:error] [pid 54991:tid 55030] [client 193.37.32.31:25209] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaAnut4Zx-mJ8gbRB2jR4wAAAEo"]
[Thu Feb 26 19:00:10.986007 2026] [:error] [pid 20419:tid 20428] [client 193.37.32.52:52113] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaAnuu3DVDvMfTYYUBUtgwAAAcY"]
[Thu Feb 26 19:00:11.715465 2026] [:error] [pid 44444:tid 44472] [client 193.37.32.24:57847] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaAnu22sMNmj-yekUk2-VQAAAhY"]
[Thu Feb 26 19:00:12.770133 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.15:63097] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaAnvNfdM__yZAgJFSuhRAAAAYg"]
[Thu Feb 26 19:00:13.077032 2026] [:error] [pid 55051:tid 55068] [client 193.37.32.46:51233] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Feb 26 19:00:13.413085 2026] [:error] [pid 55051:tid 55060] [client 193.37.32.46:51233] [client 193.37.32.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaAnvQmK1w2kZvh5eLF5BQAAAIY"]
[Thu Feb 26 19:00:14.055368 2026] [:error] [pid 54991:tid 55031] [client 193.37.32.39:27695] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaAnvt4Zx-mJ8gbRB2jR9wAAAEs"]
[Thu Feb 26 19:00:14.616815 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.17:52537] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Feb 26 19:00:14.833999 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.17:52537] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaAnvuA33x90V6yYHahtvwAAAUo"]
[Thu Feb 26 19:00:15.344921 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.31:21609] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Feb 26 19:00:15.500206 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.31:21609] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Feb 26 19:00:15.666698 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.31:21609] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Feb 26 19:00:15.802077 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.31:21609] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaAnv-A33x90V6yYHaht3QAAAUo"]
[Thu Feb 26 19:00:16.106841 2026] [:error] [pid 20419:tid 20425] [client 193.37.32.39:27587] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Feb 26 19:00:16.259138 2026] [:error] [pid 20419:tid 20446] [client 193.37.32.39:27587] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaAnwO3DVDvMfTYYUBUtqQAAAdg"]
[Thu Feb 26 19:00:17.073410 2026] [:error] [pid 55122:tid 55125] [client 193.37.32.32:46649] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Feb 26 19:00:17.500181 2026] [:error] [pid 55122:tid 55135] [client 193.37.32.32:46649] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Feb 26 19:00:17.676805 2026] [:error] [pid 55122:tid 55139] [client 193.37.32.32:46649] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Feb 26 19:00:18.610681 2026] [:error] [pid 55122:tid 55126] [client 193.37.32.32:46649] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Feb 26 19:00:19.077142 2026] [:error] [pid 55122:tid 55131] [client 193.37.32.32:46649] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Feb 26 19:00:19.425682 2026] [:error] [pid 55122:tid 55138] [client 193.37.32.32:46649] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Feb 26 19:00:19.908577 2026] [:error] [pid 55122:tid 55135] [client 193.37.32.32:46649] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Feb 26 19:00:20.066308 2026] [:error] [pid 55122:tid 55139] [client 193.37.32.32:46649] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaAnxILiR0OfjFxvcN8YrgAAAM8"]
[Thu Feb 26 19:00:20.353634 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.15:64149] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaAnxAmK1w2kZvh5eLF5XwAAAIU"]
[Thu Feb 26 19:00:20.687307 2026] [:error] [pid 44444:tid 44467] [client 193.37.32.9:20039] [client 193.37.32.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.9, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaAnxG2sMNmj-yekUk2-yQAAAhE"]
[Thu Feb 26 19:00:20.691228 2026] [:error] [pid 44444:tid 44467] [client 193.37.32.9:20039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Feb 26 19:00:20.964368 2026] [:error] [pid 44444:tid 44471] [client 193.37.32.9:20039] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Feb 26 19:00:21.161306 2026] [:error] [pid 44444:tid 44461] [client 193.37.32.9:20039] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaAnxW2sMNmj-yekUk2-zQAAAgs"]
[Thu Feb 26 19:00:21.720117 2026] [:error] [pid 55051:tid 55060] [client 193.37.32.50:35447] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Feb 26 19:00:21.864287 2026] [:error] [pid 55051:tid 55077] [client 193.37.32.50:35447] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaAnxQmK1w2kZvh5eLF5bAAAAJc"]
[Thu Feb 26 19:00:22.170523 2026] [:error] [pid 55051:tid 55058] [client 193.37.32.129:49403] [client 193.37.32.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaAnxgmK1w2kZvh5eLF5cgAAAIQ"]
[Thu Feb 26 19:00:23.669959 2026] [:error] [pid 55122:tid 55146] [client 193.37.32.15:60305] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaAnx4LiR0OfjFxvcN8YzwAAANY"]
[Thu Feb 26 19:00:23.988134 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.42:29511] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaAnx-A33x90V6yYHahurwAAAUY"]
[Thu Feb 26 19:00:24.774256 2026] [:error] [pid 3883:tid 3905] [client 193.37.32.15:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Feb 26 19:00:25.468169 2026] [:error] [pid 3883:tid 3908] [client 193.37.32.15:27953] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaAnyeA33x90V6yYHahu4wAAAVY"]
[Thu Feb 26 19:00:26.672653 2026] [:error] [pid 25311:tid 25323] [client 193.37.32.20:20691] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Feb 26 19:00:26.969612 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.20:20691] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aaAnytfdM__yZAgJFSuhrwAAAY8"]
[Thu Feb 26 19:00:27.437024 2026] [:error] [pid 3883:tid 3895] [client 193.37.32.11:20605] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaAny-A33x90V6yYHahu-AAAAUk"]
[Thu Feb 26 19:00:27.994723 2026] [:error] [pid 20419:tid 20446] [client 193.37.32.44:30467] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Feb 26 19:00:28.334059 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.44:30467] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaAnzO3DVDvMfTYYUBUuFQAAAdU"]
[Thu Feb 26 19:00:28.614522 2026] [:error] [pid 54991:tid 55028] [client 193.37.32.53:51725] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaAnzN4Zx-mJ8gbRB2jShwAAAEg"]
[Thu Feb 26 19:00:30.438094 2026] [:error] [pid 44444:tid 44456] [client 193.37.32.12:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Feb 26 19:00:30.577399 2026] [:error] [pid 44444:tid 44467] [client 193.37.32.12:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Feb 26 19:00:31.001275 2026] [:error] [pid 44444:tid 44461] [client 193.37.32.12:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Feb 26 19:00:31.343207 2026] [:error] [pid 44444:tid 44459] [client 193.37.32.12:63015] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaAnz22sMNmj-yekUk2_GQAAAgk"]
[Thu Feb 26 19:00:31.645465 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.22:34347] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaAnz-A33x90V6yYHahvKgAAAUg"]
[Thu Feb 26 19:00:32.726237 2026] [:error] [pid 25311:tid 25314] [client 193.37.32.27:44411] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Feb 26 19:00:32.871054 2026] [:error] [pid 25311:tid 25334] [client 193.37.32.27:44411] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aaAn0NfdM__yZAgJFSuh_QAAAZQ"]
[Thu Feb 26 19:00:33.189291 2026] [:error] [pid 44444:tid 44453] [client 193.37.32.40:21931] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaAn0W2sMNmj-yekUk2_HgAAAgM"]
[Thu Feb 26 19:00:33.563685 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.41:32347] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaAn0eA33x90V6yYHahvcwAAAUg"]
[Thu Feb 26 19:00:35.247074 2026] [:error] [pid 44444:tid 44474] [client 193.37.32.32:62779] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Feb 26 19:00:35.485963 2026] [:error] [pid 44444:tid 44455] [client 193.37.32.32:62779] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaAn022sMNmj-yekUk2_QQAAAgU"]
[Thu Feb 26 19:00:36.390208 2026] [:error] [pid 55051:tid 55078] [client 193.37.32.34:45259] [client 193.37.32.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaAn1AmK1w2kZvh5eLF56AAAAJg"]
[Thu Feb 26 19:00:36.696053 2026] [:error] [pid 55051:tid 55069] [client 193.37.32.27:39735] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Feb 26 19:00:36.856908 2026] [:error] [pid 55051:tid 55071] [client 193.37.32.27:39735] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Feb 26 19:00:37.491993 2026] [:error] [pid 55051:tid 55060] [client 193.37.32.27:39735] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Feb 26 19:00:41.912701 2026] [:error] [pid 55051:tid 55064] [client 193.37.32.27:39735] [client 193.37.32.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.27, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aaAn2QmK1w2kZvh5eLF5_wAAAIo"]
[Thu Feb 26 19:00:43.701700 2026] [:error] [pid 55051:tid 55069] [client 193.37.32.27:39735] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Feb 26 19:00:43.852266 2026] [:error] [pid 55051:tid 55071] [client 193.37.32.27:39735] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Feb 26 19:00:44.017548 2026] [:error] [pid 55051:tid 55067] [client 193.37.32.27:39735] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Feb 26 19:00:44.320040 2026] [:error] [pid 55051:tid 55078] [client 193.37.32.27:39735] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaAn3AmK1w2kZvh5eLF6EQAAAJg"]
[Thu Feb 26 19:00:44.645250 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.4:28397] [client 193.37.32.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.4, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaAn3OA33x90V6yYHahv8wAAAUY"]
[Thu Feb 26 19:00:45.564310 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.4:28397] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Feb 26 19:00:45.710555 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.4:28397] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Feb 26 19:00:46.011149 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.4:28397] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Feb 26 19:00:46.366707 2026] [:error] [pid 3883:tid 3903] [client 193.37.32.4:28397] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Feb 26 19:00:46.787355 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.4:28397] [client 193.37.32.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/defaults.php"] [unique_id "aaAn3uA33x90V6yYHahwJAAAAU8"]
[Thu Feb 26 19:00:47.443331 2026] [:error] [pid 54991:tid 55038] [client 193.37.32.52:24691] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Feb 26 19:00:48.876995 2026] [:error] [pid 54991:tid 55023] [client 193.37.32.52:24691] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 26 19:00:49.069583 2026] [:error] [pid 54991:tid 55027] [client 193.37.32.52:24691] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Feb 26 19:00:49.882132 2026] [:error] [pid 54991:tid 55020] [client 193.37.32.52:24691] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Feb 26 19:00:50.479200 2026] [:error] [pid 54991:tid 55036] [client 193.37.32.52:24691] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaAn4t4Zx-mJ8gbRB2jTFgAAAFA"]
[Thu Feb 26 19:00:51.097833 2026] [:error] [pid 55122:tid 55128] [client 193.37.32.51:47033] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Feb 26 19:00:51.232305 2026] [:error] [pid 55122:tid 55142] [client 193.37.32.51:47033] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaAn44LiR0OfjFxvcN8ZkQAAANI"]
[Thu Feb 26 19:00:51.846464 2026] [:error] [pid 55051:tid 55074] [client 193.37.32.14:35333] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Feb 26 19:00:52.091848 2026] [:error] [pid 55051:tid 55071] [client 193.37.32.14:35333] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaAn5AmK1w2kZvh5eLF6OgAAAJE"]
[Thu Feb 26 19:00:52.874154 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.33:59073] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Feb 26 19:00:53.468534 2026] [:error] [pid 55051:tid 55055] [client 193.37.32.33:59073] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Feb 26 19:00:53.819617 2026] [:error] [pid 55051:tid 55063] [client 193.37.32.33:59073] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Feb 26 19:00:53.963515 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.33:59073] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Thu Feb 26 19:00:54.299307 2026] [:error] [pid 55051:tid 55066] [client 193.37.32.33:59073] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaAn5gmK1w2kZvh5eLF6VwAAAIw"]
[Thu Feb 26 19:00:55.119659 2026] [:error] [pid 25311:tid 25335] [client 193.37.32.18:38727] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Feb 26 19:00:55.410125 2026] [:error] [pid 25311:tid 25331] [client 193.37.32.18:38727] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Feb 26 19:00:55.578693 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.18:38727] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaAn59fdM__yZAgJFSui7wAAAZM"]
[Thu Feb 26 19:00:56.091318 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.52:30823] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaAn6B61Vrh12f_8oWTt6gAAAQU"]
[Thu Feb 26 19:00:56.555797 2026] [:error] [pid 3883:tid 3890] [client 193.37.32.34:28651] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Feb 26 19:00:57.100726 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.34:28651] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Thu Feb 26 19:00:57.262715 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.34:28651] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Feb 26 19:00:57.413651 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.34:28651] [client 193.37.32.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaAn6eA33x90V6yYHahwsQAAAUg"]
[Thu Feb 26 19:00:57.740684 2026] [:error] [pid 20419:tid 20434] [client 193.37.32.33:45843] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaAn6e3DVDvMfTYYUBUu3AAAAcw"]
[Thu Feb 26 19:00:59.605861 2026] [:error] [pid 55618:tid 55629] [client 193.37.32.43:28923] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Feb 26 19:00:59.943315 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.43:28923] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaAn6x61Vrh12f_8oWTuCwAAAQU"]
[Thu Feb 26 19:01:00.411279 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.16:63263] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaAn7B61Vrh12f_8oWTuEgAAAQ0"]
[Thu Feb 26 19:01:01.143219 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.8:43419] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Feb 26 19:01:01.384285 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.8:43419] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Feb 26 19:01:01.544289 2026] [:error] [pid 55051:tid 55061] [client 193.37.32.8:43419] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaAn7QmK1w2kZvh5eLF6igAAAIc"]
[Thu Feb 26 19:01:02.071546 2026] [:error] [pid 25311:tid 25320] [client 193.37.32.129:57371] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Feb 26 19:01:02.247767 2026] [:error] [pid 25311:tid 25335] [client 193.37.32.129:57371] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Thu Feb 26 19:01:02.639877 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.129:57371] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Feb 26 19:01:02.808955 2026] [:error] [pid 25311:tid 25314] [client 193.37.32.129:57371] [client 193.37.32.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/glex.php"] [unique_id "aaAn7tfdM__yZAgJFSujYAAAAYA"]
[Thu Feb 26 19:01:03.653524 2026] [:error] [pid 44444:tid 44457] [client 193.37.32.14:38755] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaAn722sMNmj-yekUk3AuwAAAgc"]
[Thu Feb 26 19:01:03.947207 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.25:30081] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Thu Feb 26 19:01:04.393076 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.25:30081] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaAn8OA33x90V6yYHahw8AAAAUw"]
[Thu Feb 26 19:01:04.888632 2026] [:error] [pid 44444:tid 44455] [client 193.37.32.43:64973] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Thu Feb 26 19:01:05.268558 2026] [:error] [pid 44444:tid 44469] [client 193.37.32.43:64973] [client 193.37.32.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aaAn8W2sMNmj-yekUk3BBgAAAhM"]
[Thu Feb 26 19:01:05.769628 2026] [:error] [pid 44444:tid 44454] [client 193.37.32.32:49881] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Thu Feb 26 19:01:05.909648 2026] [:error] [pid 44444:tid 44451] [client 193.37.32.32:49881] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Thu Feb 26 19:01:06.223721 2026] [:error] [pid 44444:tid 44462] [client 193.37.32.32:49881] [client 193.37.32.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.32, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaAn8m2sMNmj-yekUk3BNgAAAgw"]
[Thu Feb 26 19:01:07.339226 2026] [:error] [pid 44444:tid 44457] [client 193.37.32.32:49881] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaAn822sMNmj-yekUk3BSwAAAgc"]
[Thu Feb 26 19:01:07.623475 2026] [:error] [pid 54990:tid 55015] [client 193.37.32.19:26581] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Thu Feb 26 19:01:07.841760 2026] [:error] [pid 54990:tid 55012] [client 193.37.32.19:26581] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaAn83tr2qmt_mBhH2wZEgAAABM"]
[Thu Feb 26 19:01:08.207139 2026] [:error] [pid 54991:tid 55030] [client 193.37.32.36:49979] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Thu Feb 26 19:01:08.517996 2026] [:error] [pid 54991:tid 55031] [client 193.37.32.36:49979] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Feb 26 19:01:09.431704 2026] [:error] [pid 54991:tid 55040] [client 193.37.32.36:49979] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaAn9d4Zx-mJ8gbRB2jTgAAAAFQ"]
[Thu Feb 26 19:01:10.590733 2026] [:error] [pid 55122:tid 55144] [client 193.37.32.21:26035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Thu Feb 26 19:01:10.767300 2026] [:error] [pid 55122:tid 55132] [client 193.37.32.21:26035] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Feb 26 19:01:11.407222 2026] [:error] [pid 55122:tid 55136] [client 193.37.32.21:26035] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaAn94LiR0OfjFxvcN8aQgAAAMw"]
[Thu Feb 26 19:01:12.112222 2026] [:error] [pid 55122:tid 55128] [client 193.37.32.5:37551] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaAn-ILiR0OfjFxvcN8aUQAAAMQ"]
[Thu Feb 26 19:01:12.413452 2026] [:error] [pid 55122:tid 55144] [client 193.37.32.50:37429] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Thu Feb 26 19:01:12.624309 2026] [:error] [pid 55122:tid 55146] [client 193.37.32.50:37429] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Thu Feb 26 19:01:12.965909 2026] [:error] [pid 55122:tid 55146] [client 193.37.32.50:37429] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaAn-ILiR0OfjFxvcN8acQAAANY"]
[Thu Feb 26 19:01:13.371986 2026] [:error] [pid 3883:tid 3891] [client 193.37.32.9:53339] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Thu Feb 26 19:01:14.192924 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.9:53339] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Thu Feb 26 19:01:14.348122 2026] [:error] [pid 3883:tid 3893] [client 193.37.32.9:53339] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaAn-uA33x90V6yYHahxiQAAAUc"]
[Thu Feb 26 19:01:14.827653 2026] [:error] [pid 44444:tid 44458] [client 193.37.32.28:38827] [client 193.37.32.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aaAn-m2sMNmj-yekUk3BhgAAAgg"]
[Thu Feb 26 19:01:15.637220 2026] [:error] [pid 44444:tid 44450] [client 193.37.32.35:23031] [client 193.37.32.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaAn-22sMNmj-yekUk3BiQAAAgA"]
[Thu Feb 26 19:01:16.001906 2026] [:error] [pid 54990:tid 55016] [client 193.37.32.25:46257] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaAn_Htr2qmt_mBhH2wZLgAAABc"]
[Thu Feb 26 19:01:16.306654 2026] [:error] [pid 3883:tid 3910] [client 193.37.32.12:36687] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaAn_OA33x90V6yYHahxpgAAAVg"]
[Thu Feb 26 19:01:17.029337 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.17:46711] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaAn_QmK1w2kZvh5eLF66QAAAIg"]
[Thu Feb 26 19:01:19.988148 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.33:57029] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaAn_wmK1w2kZvh5eLF7AQAAAJY"]
[Thu Feb 26 19:01:20.639997 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.44:39785] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaAoAAmK1w2kZvh5eLF7CwAAAIg"]
[Thu Feb 26 19:01:20.957513 2026] [:error] [pid 54991:tid 55020] [client 193.37.32.25:22379] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaAoAN4Zx-mJ8gbRB2jTrwAAAEA"]
[Thu Feb 26 19:01:21.225806 2026] [:error] [pid 55122:tid 55131] [client 193.37.32.10:56753] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaAoAYLiR0OfjFxvcN8a1wAAAMc"]
[Thu Feb 26 19:01:21.836095 2026] [:error] [pid 54991:tid 55026] [client 193.37.32.45:21369] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaAoAd4Zx-mJ8gbRB2jTtgAAAEY"]
[Thu Feb 26 19:01:22.428687 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.20:32295] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaAoAuA33x90V6yYHahyMQAAAVU"]
[Thu Feb 26 19:01:22.832405 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.6:33281] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Thu Feb 26 19:01:23.828117 2026] [:error] [pid 55618:tid 55643] [client 193.37.32.6:33281] [client 193.37.32.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.6, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaAoAx61Vrh12f_8oWTukAAAARY"]
[Thu Feb 26 19:01:24.705819 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.6:33281] [client 193.37.32.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaAoBB61Vrh12f_8oWTupQAAAQ0"]
[Thu Feb 26 19:01:25.107479 2026] [:error] [pid 54990:tid 54995] [client 193.37.32.45:23397] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaAoBXtr2qmt_mBhH2wZWQAAAAI"]
[Thu Feb 26 19:01:25.862124 2026] [:error] [pid 25311:tid 25314] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Feb 26 19:01:26.064577 2026] [:error] [pid 25311:tid 25337] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Thu Feb 26 19:01:26.686486 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Thu Feb 26 19:01:26.853056 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Thu Feb 26 19:01:27.527901 2026] [:error] [pid 25311:tid 25337] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Thu Feb 26 19:01:27.668600 2026] [:error] [pid 25311:tid 25328] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Thu Feb 26 19:01:27.839871 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Feb 26 19:01:27.990667 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.49:38779] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Thu Feb 26 19:01:28.171388 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.49:38779] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaAoCNfdM__yZAgJFSukNQAAAZY"]
[Thu Feb 26 19:01:28.467329 2026] [:error] [pid 44444:tid 44450] [client 193.37.32.12:64147] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaAoCG2sMNmj-yekUk3CaAAAAgA"]
[Thu Feb 26 19:01:28.810906 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.41:32523] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaAoCNfdM__yZAgJFSukNgAAAY8"]
[Thu Feb 26 19:01:29.347344 2026] [:error] [pid 44444:tid 44451] [client 193.37.32.28:23897] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Thu Feb 26 19:01:29.663102 2026] [:error] [pid 44444:tid 44451] [client 193.37.32.28:23897] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Thu Feb 26 19:01:29.977728 2026] [:error] [pid 44444:tid 44468] [client 193.37.32.28:23897] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Thu Feb 26 19:01:30.283205 2026] [:error] [pid 44444:tid 44469] [client 193.37.32.28:23897] [client 193.37.32.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaAoCm2sMNmj-yekUk3CugAAAhM"]
[Thu Feb 26 19:01:30.903898 2026] [:error] [pid 54991:tid 55039] [client 193.37.32.41:23167] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaAoCt4Zx-mJ8gbRB2jUKgAAAFM"]
[Thu Feb 26 19:01:35.194548 2026] [:error] [pid 20419:tid 20444] [client 193.37.32.29:35591] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaAoD-3DVDvMfTYYUBUv3QAAAdY"]
[Thu Feb 26 19:01:36.154228 2026] [:error] [pid 55122:tid 55135] [client 193.37.32.45:36581] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaAoEILiR0OfjFxvcN8bNAAAAMs"]
[Thu Feb 26 19:01:36.824933 2026] [:error] [pid 20419:tid 20425] [client 193.37.32.14:42099] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaAoEO3DVDvMfTYYUBUv5AAAAcM"]
[Thu Feb 26 19:01:38.681050 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.24:48291] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaAoEtfdM__yZAgJFSukiQAAAY8"]
[Thu Feb 26 19:01:41.014267 2026] [:error] [pid 3883:tid 3891] [client 193.37.32.20:51073] [client 193.37.32.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "aaAoFeA33x90V6yYHahy5gAAAUU"]
[Thu Feb 26 19:01:42.081288 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.11:56255] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaAoFgmK1w2kZvh5eLF7gAAAAJY"]
[Thu Feb 26 19:01:42.417115 2026] [:error] [pid 55618:tid 55629] [client 193.37.32.8:55753] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Thu Feb 26 19:01:42.695306 2026] [:error] [pid 55618:tid 55645] [client 193.37.32.8:55753] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aaAoFh61Vrh12f_8oWTvUwAAARg"]
[Thu Feb 26 19:01:43.444538 2026] [:error] [pid 54991:tid 55022] [client 193.37.32.33:58537] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Thu Feb 26 19:01:44.277608 2026] [:error] [pid 54991:tid 55026] [client 193.37.32.33:58537] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Feb 26 19:01:44.427022 2026] [:error] [pid 54991:tid 55032] [client 193.37.32.33:58537] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaAoGN4Zx-mJ8gbRB2jUlwAAAEw"]
[Thu Feb 26 19:01:45.226095 2026] [:error] [pid 55122:tid 55143] [client 193.37.32.43:21737] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaAoGYLiR0OfjFxvcN8bigAAANM"]
[Thu Feb 26 19:01:46.623202 2026] [:error] [pid 54991:tid 55034] [client 193.37.32.49:47185] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaAoGt4Zx-mJ8gbRB2jUngAAAE4"]
[Thu Feb 26 19:01:47.900194 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.130:48039] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaAoGwmK1w2kZvh5eLF7sAAAAJY"]
[Thu Feb 26 19:01:48.369301 2026] [:error] [pid 44444:tid 44453] [client 193.37.32.16:47353] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Feb 26 19:01:48.745060 2026] [:error] [pid 44444:tid 44457] [client 193.37.32.16:47353] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaAoHG2sMNmj-yekUk3D5wAAAgc"]
[Thu Feb 26 19:01:49.170338 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.22:44951] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaAoHdfdM__yZAgJFSuk8wAAAYs"]
[Thu Feb 26 19:01:50.438941 2026] [:error] [pid 44444:tid 44467] [client 193.37.32.9:31805] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaAoHm2sMNmj-yekUk3EBgAAAhE"]
[Thu Feb 26 19:01:50.774780 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.23:20045] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Feb 26 19:01:51.379137 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.23:20045] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Thu Feb 26 19:01:51.527420 2026] [:error] [pid 25311:tid 25326] [client 193.37.32.23:20045] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaAoH9fdM__yZAgJFSulFAAAAYw"]
[Thu Feb 26 19:01:52.201982 2026] [:error] [pid 54990:tid 54998] [client 193.37.32.30:48783] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Thu Feb 26 19:01:53.667136 2026] [:error] [pid 54990:tid 54995] [client 193.37.32.30:48783] [client 193.37.32.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaAoIXtr2qmt_mBhH2wZ1gAAAAI"]
[Thu Feb 26 19:01:54.014013 2026] [:error] [pid 55122:tid 55127] [client 193.37.32.9:63229] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaAoIoLiR0OfjFxvcN8byAAAAMM"]
[Thu Feb 26 19:01:55.094240 2026] [:error] [pid 55051:tid 55075] [client 193.37.32.45:63335] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaAoIwmK1w2kZvh5eLF7_AAAAJU"]
[Thu Feb 26 19:01:55.966184 2026] [:error] [pid 54990:tid 55005] [client 193.37.32.25:62035] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaAoI3tr2qmt_mBhH2wZ5wAAAAw"]
[Thu Feb 26 19:01:56.376960 2026] [:error] [pid 55122:tid 55127] [client 193.37.32.29:54517] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaAoJILiR0OfjFxvcN8b1AAAAMM"]
[Thu Feb 26 19:01:57.056172 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.43:60571] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Thu Feb 26 19:01:57.875459 2026] [:error] [pid 55051:tid 55073] [client 193.37.32.43:60571] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaAoJQmK1w2kZvh5eLF8HwAAAJM"]
[Thu Feb 26 19:01:58.697779 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.28:47149] [client 193.37.32.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaAoJu3DVDvMfTYYUBUwjwAAAc8"]
[Thu Feb 26 19:01:59.026019 2026] [:error] [pid 55051:tid 55055] [client 193.37.32.37:23717] [client 193.37.32.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaAoJwmK1w2kZvh5eLF8KwAAAIE"]
[Thu Feb 26 19:01:59.941235 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.22:26069] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Feb 26 19:02:00.088320 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.22:26069] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaAoKNfdM__yZAgJFSulcQAAAZY"]
[Thu Feb 26 19:02:00.610969 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.45:61767] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaAoKB61Vrh12f_8oWTwBQAAARc"]
[Thu Feb 26 19:02:02.124583 2026] [:error] [pid 54990:tid 54996] [client 193.37.32.50:35763] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaAoKntr2qmt_mBhH2waFQAAAAM"]
[Thu Feb 26 19:02:02.640310 2026] [:error] [pid 20419:tid 20442] [client 193.37.32.45:26193] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Thu Feb 26 19:02:02.801170 2026] [:error] [pid 20419:tid 20430] [client 193.37.32.45:26193] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaAoKu3DVDvMfTYYUBUwpwAAAcg"]
[Thu Feb 26 19:02:07.067950 2026] [:error] [pid 55051:tid 55057] [client 193.37.32.36:64393] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaAoLwmK1w2kZvh5eLF8igAAAIM"]
[Thu Feb 26 19:02:07.505544 2026] [:error] [pid 25311:tid 25338] [client 193.37.32.31:25779] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aaAoL9fdM__yZAgJFSumCgAAAZg"]
[Thu Feb 26 19:02:07.971732 2026] [:error] [pid 55051:tid 55061] [client 193.37.32.36:57113] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaAoLwmK1w2kZvh5eLF8nwAAAIc"]
[Thu Feb 26 19:02:08.407907 2026] [:error] [pid 54990:tid 54998] [client 193.37.32.40:30907] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aaAoMHtr2qmt_mBhH2waIQAAAAU"]
[Thu Feb 26 19:02:08.756577 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.41:25953] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaAoMNfdM__yZAgJFSumJwAAAYg"]
[Thu Feb 26 19:02:10.445242 2026] [:error] [pid 3883:tid 3897] [client 193.37.32.37:34803] [client 193.37.32.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaAoMuA33x90V6yYHah0FQAAAUs"]
[Thu Feb 26 19:02:11.258680 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.32:22121] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaAoM-A33x90V6yYHah0MgAAAUw"]
[Thu Feb 26 19:02:12.409987 2026] [:error] [pid 44444:tid 44450] [client 193.37.32.15:57105] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Feb 26 19:02:12.577249 2026] [:error] [pid 44444:tid 44470] [client 193.37.32.15:57105] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaAoNG2sMNmj-yekUk3E1gAAAhQ"]
[Thu Feb 26 19:02:13.293682 2026] [:error] [pid 55051:tid 55077] [client 193.37.32.43:38271] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaAoNQmK1w2kZvh5eLF88QAAAJc"]
[Thu Feb 26 19:02:14.763466 2026] [:error] [pid 54991:tid 55020] [client 193.37.32.4:46671] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Feb 26 19:02:17.950881 2026] [:error] [pid 54991:tid 55039] [client 193.37.32.4:46671] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaAoOd4Zx-mJ8gbRB2jVIAAAAFM"]
[Thu Feb 26 19:02:18.375771 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.10:58991] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaAoOuA33x90V6yYHah0uAAAAU4"]
[Thu Feb 26 19:02:18.883077 2026] [:error] [pid 55618:tid 55622] [client 193.37.32.21:30137] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaAoOh61Vrh12f_8oWTwbAAAAQE"]
[Thu Feb 26 19:02:19.460489 2026] [:error] [pid 55618:tid 55625] [client 193.37.32.13:46961] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaAoOx61Vrh12f_8oWTwcQAAAQQ"]
[Thu Feb 26 19:02:22.207408 2026] [:error] [pid 55122:tid 55125] [client 193.37.32.15:58729] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaAoPoLiR0OfjFxvcN8cLAAAAME"]
[Thu Feb 26 19:02:22.503537 2026] [:error] [pid 44444:tid 44463] [client 193.37.32.26:63231] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaAoPm2sMNmj-yekUk3FMAAAAg0"]
[Thu Feb 26 19:02:23.281139 2026] [:error] [pid 44444:tid 44468] [client 193.37.32.41:30395] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaAoP22sMNmj-yekUk3FRgAAAhI"]
[Thu Feb 26 19:02:23.597622 2026] [:error] [pid 44444:tid 44465] [client 193.37.32.12:30801] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaAoP22sMNmj-yekUk3FSgAAAg8"]
[Thu Feb 26 19:02:24.303319 2026] [:error] [pid 44444:tid 44451] [client 193.37.32.50:41609] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaAoQG2sMNmj-yekUk3FVAAAAgE"]
[Thu Feb 26 19:02:24.606277 2026] [:error] [pid 54990:tid 55016] [client 193.37.32.27:33955] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaAoQHtr2qmt_mBhH2waagAAABc"]
[Thu Feb 26 19:02:24.902189 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.19:54751] [client 193.37.32.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.19, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaAoQNfdM__yZAgJFSumlQAAAYg"]
[Thu Feb 26 19:02:24.905644 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.19:54751] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Thu Feb 26 19:02:25.121191 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.19:54751] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaAoQdfdM__yZAgJFSumlwAAAZY"]
[Thu Feb 26 19:02:25.762059 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.7:23561] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Feb 26 19:02:26.000089 2026] [:error] [pid 25311:tid 25334] [client 193.37.32.7:23561] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaAoQdfdM__yZAgJFSumnwAAAZQ"]
[Thu Feb 26 19:02:26.260374 2026] [:error] [pid 25311:tid 25335] [client 193.37.32.7:65141] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aaAoQtfdM__yZAgJFSumpQAAAZU"]
[Thu Feb 26 19:02:27.583211 2026] [:error] [pid 20419:tid 20435] [client 193.37.32.11:31507] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Thu Feb 26 19:02:28.773021 2026] [:error] [pid 20419:tid 20439] [client 193.37.32.11:31507] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaAoRO3DVDvMfTYYUBUxawAAAdE"]
[Thu Feb 26 19:02:29.050951 2026] [:error] [pid 25311:tid 25332] [client 193.37.32.7:36319] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaAoRdfdM__yZAgJFSumwQAAAZI"]
[Thu Feb 26 19:02:30.150732 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.52:35377] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaAoRgmK1w2kZvh5eLF9lwAAAJY"]
[Thu Feb 26 19:02:30.474632 2026] [:error] [pid 20419:tid 20440] [client 193.37.32.39:57537] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaAoRu3DVDvMfTYYUBUxhQAAAdI"]
[Thu Feb 26 19:02:30.897548 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.51:43695] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Thu Feb 26 19:02:31.472817 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.51:43695] [client 193.37.32.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.51, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaAoR9fdM__yZAgJFSum4gAAAZM"]
[Thu Feb 26 19:02:31.723331 2026] [:error] [pid 25311:tid 25338] [client 193.37.32.51:43695] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaAoR9fdM__yZAgJFSum6AAAAZg"]
[Thu Feb 26 19:02:33.893941 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.20:34053] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaAoSeA33x90V6yYHah1HwAAAUA"]
[Thu Feb 26 19:02:34.142737 2026] [:error] [pid 3883:tid 3904] [client 193.37.32.40:39087] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Feb 26 19:02:34.281285 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.40:39087] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaAoSuA33x90V6yYHah1KQAAAUY"]
[Thu Feb 26 19:02:34.612291 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.20:63195] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaAoSu3DVDvMfTYYUBUxywAAAcQ"]
[Thu Feb 26 19:02:35.343976 2026] [:error] [pid 3883:tid 3891] [client 193.37.32.44:52423] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Thu Feb 26 19:02:35.780331 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.44:52423] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaAoS-A33x90V6yYHah1RAAAAU8"]
[Thu Feb 26 19:02:36.472520 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.5:50675] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaAoTOA33x90V6yYHah1VAAAAVc"]
[Thu Feb 26 19:02:36.795525 2026] [:error] [pid 3883:tid 3895] [client 193.37.32.15:57461] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Feb 26 19:02:37.257544 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.15:57461] [client 193.37.32.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "aaAoTeA33x90V6yYHah1aAAAAUA"]
[Thu Feb 26 19:02:37.653159 2026] [:error] [pid 20419:tid 20442] [client 193.37.32.7:35637] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Feb 26 19:02:37.969260 2026] [:error] [pid 20419:tid 20435] [client 193.37.32.7:35637] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaAoTe3DVDvMfTYYUBUyJQAAAc0"]
[Thu Feb 26 19:02:39.280298 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.30:28093] [client 193.37.32.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaAoT9fdM__yZAgJFSunGgAAAY8"]
[Thu Feb 26 19:02:39.856373 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.130:33205] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aaAoT9fdM__yZAgJFSunKgAAAYQ"]
[Thu Feb 26 19:02:40.207245 2026] [:error] [pid 20419:tid 20430] [client 193.37.32.47:42187] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Thu Feb 26 19:02:41.183938 2026] [:error] [pid 20419:tid 20440] [client 193.37.32.47:42187] [client 193.37.32.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaAoUe3DVDvMfTYYUBUyVQAAAdI"]
[Thu Feb 26 19:02:42.190528 2026] [:error] [pid 54990:tid 55011] [client 193.37.32.9:21911] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aaAoUntr2qmt_mBhH2waoAAAABI"]
[Thu Feb 26 19:02:42.334581 2026] [:error] [pid 54990:tid 54993] [client 193.37.32.9:21911] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaAoUntr2qmt_mBhH2waoQAAAAA"]
[Thu Feb 26 19:02:43.021781 2026] [:error] [pid 25311:tid 25319] [client 193.37.32.8:45301] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaAoU9fdM__yZAgJFSunZQAAAYU"]
[Thu Feb 26 19:02:43.295207 2026] [:error] [pid 54991:tid 55040] [client 193.37.32.24:64953] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaAoU94Zx-mJ8gbRB2jVmgAAAFQ"]
[Thu Feb 26 19:02:44.235813 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.26:54013] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Feb 26 19:02:45.023002 2026] [:error] [pid 3883:tid 3890] [client 193.37.32.26:54013] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaAoVeA33x90V6yYHah1wgAAAUQ"]
[Thu Feb 26 19:02:45.764994 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.45:56289] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaAoVe3DVDvMfTYYUBUyhwAAAdU"]
[Thu Feb 26 19:02:47.687459 2026] [:error] [pid 20419:tid 20434] [client 193.37.32.38:25249] [client 193.37.32.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaAoV-3DVDvMfTYYUBUyqAAAAcw"]
[Thu Feb 26 19:02:48.104175 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.51:20909] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Thu Feb 26 19:02:48.964409 2026] [:error] [pid 20419:tid 20428] [client 193.37.32.51:20909] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaAoWO3DVDvMfTYYUBUywgAAAcY"]
[Thu Feb 26 19:02:49.491465 2026] [:error] [pid 3883:tid 3902] [client 193.37.32.33:39957] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aaAoWeA33x90V6yYHah2AgAAAVA"]
[Thu Feb 26 19:02:50.428245 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.24:30687] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Feb 26 19:02:50.640214 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.24:30687] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaAoWuA33x90V6yYHah2IwAAAVc"]
[Thu Feb 26 19:02:50.929686 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.22:37633] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaAoWuA33x90V6yYHah2LwAAAVU"]
[Thu Feb 26 19:02:52.611076 2026] [:error] [pid 55618:tid 55641] [client 193.37.32.39:35379] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaAoXB61Vrh12f_8oWTxDQAAARQ"]
[Thu Feb 26 19:02:53.526914 2026] [:error] [pid 44444:tid 44472] [client 193.37.32.20:54931] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Thu Feb 26 19:02:53.642191 2026] [:error] [pid 44444:tid 44474] [client 193.37.32.20:54931] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaAoXW2sMNmj-yekUk3GKgAAAhg"]
[Thu Feb 26 19:02:53.937133 2026] [:error] [pid 55618:tid 55631] [client 193.37.32.27:65373] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaAoXR61Vrh12f_8oWTxHAAAAQo"]
[Thu Feb 26 19:02:55.219953 2026] [:error] [pid 20419:tid 20429] [client 193.37.32.9:55907] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaAoX-3DVDvMfTYYUBUzAgAAAcc"]
[Thu Feb 26 19:02:55.814469 2026] [:error] [pid 55051:tid 55063] [client 193.37.32.12:61115] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaAoXwmK1w2kZvh5eLF-IQAAAIk"]
[Thu Feb 26 19:02:56.364230 2026] [:error] [pid 55122:tid 55130] [client 193.37.32.23:59521] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Thu Feb 26 19:02:57.070293 2026] [:error] [pid 55122:tid 55134] [client 193.37.32.23:59521] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaAoYYLiR0OfjFxvcN8cvgAAAMo"]
[Thu Feb 26 19:02:57.420270 2026] [:error] [pid 20419:tid 20432] [client 193.37.32.4:31075] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaAoYe3DVDvMfTYYUBUzIAAAAco"]
[Thu Feb 26 19:02:57.878154 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.26:64471] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaAoYR61Vrh12f_8oWTxNgAAAQ0"]
[Thu Feb 26 19:02:58.228885 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.5:52057] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Thu Feb 26 19:02:58.625228 2026] [:error] [pid 25311:tid 25328] [client 193.37.32.5:52057] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaAoYtfdM__yZAgJFSunygAAAY4"]
[Thu Feb 26 19:02:58.926534 2026] [:error] [pid 55122:tid 55140] [client 193.37.32.37:48041] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Thu Feb 26 19:02:59.219095 2026] [:error] [pid 55122:tid 55124] [client 193.37.32.37:48041] [client 193.37.32.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaAoY4LiR0OfjFxvcN8czAAAAMA"]
[Thu Feb 26 19:02:59.536592 2026] [:error] [pid 55618:tid 55640] [client 193.37.32.40:60085] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaAoYx61Vrh12f_8oWTxPgAAARM"]
[Thu Feb 26 19:03:00.244728 2026] [:error] [pid 25311:tid 25326] [client 193.37.32.28:57049] [client 193.37.32.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaAoZNfdM__yZAgJFSun2AAAAYw"]
[Thu Feb 26 19:03:01.722367 2026] [:error] [pid 55051:tid 55060] [client 193.37.32.42:49387] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaAoZQmK1w2kZvh5eLF-RgAAAIY"]
[Thu Feb 26 19:03:02.836257 2026] [:error] [pid 54991:tid 55036] [client 193.37.32.129:35683] [client 193.37.32.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaAoZt4Zx-mJ8gbRB2jV3AAAAFA"]
[Thu Feb 26 19:03:03.433008 2026] [:error] [pid 54991:tid 55024] [client 193.37.32.10:23857] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaAoZ94Zx-mJ8gbRB2jV3wAAAEQ"]
[Thu Feb 26 19:03:03.748977 2026] [:error] [pid 55618:tid 55636] [client 193.37.32.40:41919] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaAoZx61Vrh12f_8oWTxUQAAAQ8"]
[Thu Feb 26 19:03:04.144939 2026] [:error] [pid 25311:tid 25331] [client 193.37.32.32:38869] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaAoaNfdM__yZAgJFSun9QAAAZE"]
[Thu Feb 26 19:03:05.261995 2026] [:error] [pid 54991:tid 55040] [client 193.37.32.29:22521] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaAoad4Zx-mJ8gbRB2jV6QAAAFQ"]
[Thu Feb 26 19:03:05.917637 2026] [:error] [pid 44444:tid 44466] [client 193.37.32.39:60091] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaAoaW2sMNmj-yekUk3GXQAAAhA"]
[Thu Feb 26 19:03:06.588031 2026] [:error] [pid 54991:tid 55039] [client 193.37.32.17:26955] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaAoat4Zx-mJ8gbRB2jV8gAAAFM"]
[Thu Feb 26 19:03:07.033923 2026] [:error] [pid 55051:tid 55061] [client 193.37.32.16:22067] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaAoawmK1w2kZvh5eLF-gAAAAIc"]
[Thu Feb 26 19:03:07.684189 2026] [:error] [pid 54990:tid 55000] [client 193.37.32.45:50129] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Thu Feb 26 19:03:08.391106 2026] [:error] [pid 54990:tid 55016] [client 193.37.32.45:50129] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaAobHtr2qmt_mBhH2wbAwAAABc"]
[Thu Feb 26 19:03:08.717312 2026] [:error] [pid 55618:tid 55636] [client 193.37.32.40:23239] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaAobB61Vrh12f_8oWTxbwAAAQ8"]
[Thu Feb 26 19:03:09.213732 2026] [:error] [pid 44444:tid 44468] [client 193.37.32.14:20577] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Thu Feb 26 19:03:09.377288 2026] [:error] [pid 44444:tid 44472] [client 193.37.32.14:20577] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaAobW2sMNmj-yekUk3GbwAAAhY"]
[Thu Feb 26 19:03:10.888452 2026] [:error] [pid 44444:tid 44451] [client 193.37.32.45:21787] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaAobm2sMNmj-yekUk3GeQAAAgE"]
[Thu Feb 26 19:03:11.379516 2026] [:error] [pid 44444:tid 44453] [client 193.37.32.20:59565] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Thu Feb 26 19:03:11.567870 2026] [:error] [pid 44444:tid 44454] [client 193.37.32.20:59565] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaAob22sMNmj-yekUk3GjgAAAgQ"]
[Thu Feb 26 19:03:12.269841 2026] [:error] [pid 44444:tid 44457] [client 193.37.32.9:57147] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaAocG2sMNmj-yekUk3GowAAAgc"]
[Thu Feb 26 19:03:12.554898 2026] [:error] [pid 44444:tid 44457] [client 193.37.32.48:50129] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Thu Feb 26 19:03:12.692993 2026] [:error] [pid 44444:tid 44468] [client 193.37.32.48:50129] [client 193.37.32.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaAocG2sMNmj-yekUk3GsgAAAhI"]
[Thu Feb 26 19:03:14.194209 2026] [:error] [pid 20419:tid 20425] [client 193.37.32.52:24795] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaAocu3DVDvMfTYYUBUzugAAAcM"]
[Thu Feb 26 19:03:15.791155 2026] [:error] [pid 25311:tid 25321] [client 193.37.32.17:45595] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Thu Feb 26 19:03:15.962965 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.17:45595] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaAoc9fdM__yZAgJFSuoWQAAAZA"]
[Thu Feb 26 19:03:17.470009 2026] [:error] [pid 44444:tid 44467] [client 193.37.32.33:58919] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaAodW2sMNmj-yekUk3HCgAAAhE"]
[Thu Feb 26 19:03:17.875762 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.53:56819] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Thu Feb 26 19:03:18.022142 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.53:56819] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaAoduA33x90V6yYHah38gAAAUE"]
[Thu Feb 26 19:03:18.375230 2026] [:error] [pid 54990:tid 54994] [client 193.37.32.40:56433] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaAodntr2qmt_mBhH2wbNQAAAAE"]
[Thu Feb 26 19:03:19.258293 2026] [:error] [pid 54991:tid 55028] [client 193.37.32.26:29839] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Thu Feb 26 19:03:19.593016 2026] [:error] [pid 54991:tid 55031] [client 193.37.32.26:29839] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaAod94Zx-mJ8gbRB2jWMQAAAEs"]
[Thu Feb 26 19:03:19.875973 2026] [:error] [pid 55051:tid 55070] [client 193.37.32.34:47401] [client 193.37.32.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaAodwmK1w2kZvh5eLF-9gAAAJA"]
[Thu Feb 26 19:03:24.746562 2026] [:error] [pid 54990:tid 55001] [client 193.37.32.19:42093] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaAofHtr2qmt_mBhH2wbUgAAAAg"]
[Thu Feb 26 19:03:25.038549 2026] [:error] [pid 55051:tid 55063] [client 193.37.32.29:51697] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaAofQmK1w2kZvh5eLF_KwAAAIk"]
[Thu Feb 26 19:03:25.635115 2026] [:error] [pid 20419:tid 20432] [client 193.37.32.44:56755] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aaAofe3DVDvMfTYYUBUz8AAAAco"]
[Thu Feb 26 19:03:26.070405 2026] [:error] [pid 44444:tid 44457] [client 193.37.32.12:57479] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaAofm2sMNmj-yekUk3HSQAAAgc"]
[Thu Feb 26 19:03:26.374135 2026] [:error] [pid 55051:tid 55055] [client 193.37.32.20:43769] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaAofgmK1w2kZvh5eLF_NAAAAIE"]
[Thu Feb 26 19:03:26.652055 2026] [:error] [pid 25311:tid 25321] [client 193.37.32.14:51841] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aaAoftfdM__yZAgJFSuoswAAAYc"]
[Thu Feb 26 19:03:27.653802 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.25:42739] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaAof-A33x90V6yYHah4NwAAAU4"]
[Thu Feb 26 19:03:27.972593 2026] [:error] [pid 55122:tid 55143] [client 193.37.32.129:51151] [client 193.37.32.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aaAof4LiR0OfjFxvcN8dNwAAANM"]
[Thu Feb 26 19:03:29.484442 2026] [:error] [pid 55618:tid 55625] [client 193.37.32.17:46503] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Thu Feb 26 19:03:29.912259 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.17:46503] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaAogR61Vrh12f_8oWTyAwAAARU"]
[Thu Feb 26 19:03:30.233594 2026] [:error] [pid 55051:tid 55067] [client 193.37.32.51:60549] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaAoggmK1w2kZvh5eLF_SQAAAI0"]
[Thu Feb 26 19:03:30.988532 2026] [:error] [pid 25311:tid 25327] [client 193.37.32.31:31471] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aaAogtfdM__yZAgJFSuo0QAAAY0"]
[Thu Feb 26 19:03:31.316466 2026] [:error] [pid 25311:tid 25314] [client 193.37.32.44:33605] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaAog9fdM__yZAgJFSuo0gAAAYA"]
[Thu Feb 26 19:03:33.253355 2026] [:error] [pid 20419:tid 20434] [client 193.37.32.43:20869] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aaAohe3DVDvMfTYYUBU0MgAAAcw"]
[Thu Feb 26 19:03:33.600285 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.6:60639] [client 193.37.32.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaAohdfdM__yZAgJFSuo7QAAAYI"]
[Thu Feb 26 19:03:34.444329 2026] [:error] [pid 25311:tid 25327] [client 193.37.32.18:58251] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aaAohtfdM__yZAgJFSuo-QAAAY0"]
[Thu Feb 26 19:03:34.945014 2026] [:error] [pid 55122:tid 55147] [client 193.37.32.25:53945] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaAohoLiR0OfjFxvcN8dWwAAANc"]
[Thu Feb 26 19:03:35.219460 2026] [:error] [pid 54990:tid 55001] [client 193.37.32.29:36849] [client 193.37.32.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/worm0.PhP7"] [unique_id "aaAoh3tr2qmt_mBhH2wbhgAAAAg"]
[Thu Feb 26 19:03:35.681918 2026] [:error] [pid 55618:tid 55645] [client 193.37.32.6:43693] [client 193.37.32.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aaAohx61Vrh12f_8oWTyRQAAARg"]
[Thu Feb 26 19:03:35.955662 2026] [:error] [pid 55618:tid 55630] [client 193.37.32.38:22891] [client 193.37.32.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaAohx61Vrh12f_8oWTyRwAAAQk"]
[Thu Feb 26 19:03:36.990426 2026] [:error] [pid 55051:tid 55065] [client 193.37.32.22:36101] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaAoiAmK1w2kZvh5eLF_ewAAAIs"]
[Thu Feb 26 19:03:38.179864 2026] [:error] [pid 55051:tid 55070] [client 193.37.32.12:60173] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaAoigmK1w2kZvh5eLF_ggAAAJA"]
[Thu Feb 26 19:03:39.509324 2026] [:error] [pid 20419:tid 20428] [client 193.37.32.42:37799] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Thu Feb 26 19:03:39.709176 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.42:37799] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaAoi-3DVDvMfTYYUBU0dQAAAc8"]
[Thu Feb 26 19:03:40.332122 2026] [:error] [pid 55051:tid 55069] [client 193.37.32.27:42973] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Thu Feb 26 19:03:40.459507 2026] [:error] [pid 55051:tid 55055] [client 193.37.32.27:42973] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaAojAmK1w2kZvh5eLF_lQAAAIE"]
[Thu Feb 26 19:03:40.756585 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.17:46063] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaAojOA33x90V6yYHah4mwAAAUE"]
[Thu Feb 26 19:03:41.497944 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.10:47855] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaAojeA33x90V6yYHah4qAAAAU8"]
[Thu Feb 26 19:03:43.082878 2026] [:error] [pid 55051:tid 55055] [client 193.37.32.10:60959] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Feb 26 19:03:43.894591 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.10:60959] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aaAojwmK1w2kZvh5eLF_wQAAAJY"]
[Thu Feb 26 19:03:44.207810 2026] [:error] [pid 3883:tid 3888] [client 193.37.32.40:50769] [client 193.37.32.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-library.php%20"] [unique_id "aaAokOA33x90V6yYHah44AAAAUI"]
[Thu Feb 26 19:03:44.740569 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.22:53869] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaAokOA33x90V6yYHah47QAAAUg"]
[Thu Feb 26 19:03:45.517282 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.39:25483] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaAokeA33x90V6yYHah5BAAAAUg"]
[Thu Feb 26 19:03:45.792996 2026] [:error] [pid 3883:tid 3903] [client 193.37.32.38:32331] [client 193.37.32.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaAokeA33x90V6yYHah5EAAAAVE"]
[Thu Feb 26 19:03:46.086025 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.26:54839] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaAokuA33x90V6yYHah5GwAAAVU"]
[Thu Feb 26 19:14:55.803017 2026] [:error] [pid 3883:tid 3901] [client 2.58.56.91:56897] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Thu Feb 26 19:14:56.824199 2026] [:error] [pid 25311:tid 25316] [client 2.58.56.91:63374] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aaArMNfdM__yZAgJFSu0rgAAAYI"]
[Thu Feb 26 19:14:57.340923 2026] [:error] [pid 25311:tid 25332] [client 2.58.56.91:49730] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aaArMdfdM__yZAgJFSu0swAAAZI"]
[Thu Feb 26 19:14:57.841502 2026] [:error] [pid 25311:tid 25329] [client 2.58.56.91:50473] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aaArMdfdM__yZAgJFSu0tgAAAY8"]
[Thu Feb 26 19:14:58.850757 2026] [:error] [pid 44444:tid 44452] [client 2.58.56.91:58475] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/txets.php"] [unique_id "aaArMm2sMNmj-yekUk3WPQAAAgI"]
[Thu Feb 26 19:14:59.361211 2026] [:error] [pid 3883:tid 3900] [client 2.58.56.91:64848] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Thu Feb 26 19:14:59.874776 2026] [:error] [pid 44444:tid 44465] [client 2.58.56.91:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Thu Feb 26 21:18:37.083610 2026] [:error] [pid 44444:tid 44452] [client 183.82.102.183:24826] [client 183.82.102.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.102.183, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaBILW2sMNmj-yekUk0gVgAAAgI"]
[Thu Feb 26 21:18:37.088920 2026] [:error] [pid 44444:tid 44452] [client 183.82.102.183:24826] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 26 21:57:01.007131 2026] [:error] [pid 20419:tid 20435] [client 195.178.110.28:59002] [client 195.178.110.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aaBRLe3DVDvMfTYYUBVfvQAAAc0"]
[Thu Feb 26 22:01:07.969736 2026] [:error] [pid 55051:tid 55067] [client 157.245.196.99:65404] [client 157.245.196.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aaBSIwmK1w2kZvh5eLHB3wAAAI0"]
[Thu Feb 26 23:55:01.902680 2026] [:error] [pid 44444:tid 44463] [client 134.209.108.57:53706] [client 134.209.108.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.209.108.57, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaBs1W2sMNmj-yekUk2JLQAAAg0"]
[Thu Feb 26 23:55:01.906911 2026] [:error] [pid 44444:tid 44463] [client 134.209.108.57:53706] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Feb 26 23:57:47.437772 2026] [:error] [pid 55051:tid 55061] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Thu Feb 26 23:57:47.644957 2026] [:error] [pid 55051:tid 55063] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Thu Feb 26 23:57:47.852111 2026] [:error] [pid 55051:tid 55073] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Thu Feb 26 23:57:48.059624 2026] [:error] [pid 55051:tid 55062] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Thu Feb 26 23:57:48.269847 2026] [:error] [pid 55051:tid 55068] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Thu Feb 26 23:57:48.476907 2026] [:error] [pid 55051:tid 55072] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Feb 26 23:57:48.686575 2026] [:error] [pid 55051:tid 55058] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Thu Feb 26 23:57:48.894344 2026] [:error] [pid 55051:tid 55078] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Feb 26 23:57:49.103185 2026] [:error] [pid 55051:tid 55057] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Thu Feb 26 23:57:49.314843 2026] [:error] [pid 55051:tid 55076] [client 20.220.189.106:7105] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Thu Feb 26 23:57:49.519316 2026] [:error] [pid 55051:tid 55069] [client 20.220.189.106:7105] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaBtfQmK1w2kZvh5eLH8MgAAAI8"]
[Thu Feb 26 23:57:49.937229 2026] [:error] [pid 54991:tid 55041] [client 20.220.189.106:7055] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaBtfd4Zx-mJ8gbRB2gguAAAAFU"]
[Thu Feb 26 23:57:50.368805 2026] [:error] [pid 44444:tid 44450] [client 20.220.189.106:7057] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaBtfm2sMNmj-yekUk2LhQAAAgA"]
[Thu Feb 26 23:57:50.803292 2026] [:error] [pid 44444:tid 44472] [client 20.220.189.106:7052] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaBtfm2sMNmj-yekUk2LiAAAAhY"]
[Thu Feb 26 23:57:51.232663 2026] [:error] [pid 44444:tid 44454] [client 20.220.189.106:7047] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaBtf22sMNmj-yekUk2LjAAAAgQ"]
[Thu Feb 26 23:57:51.658265 2026] [:error] [pid 44444:tid 44459] [client 20.220.189.106:7161] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaBtf22sMNmj-yekUk2LkAAAAgk"]
[Thu Feb 26 23:57:52.073572 2026] [:error] [pid 54990:tid 54997] [client 20.220.189.106:7115] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaBtgHtr2qmt_mBhH2w49gAAAAQ"]
[Thu Feb 26 23:57:52.486546 2026] [:error] [pid 44444:tid 44450] [client 20.220.189.106:7150] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaBtgG2sMNmj-yekUk2LlgAAAgA"]
[Thu Feb 26 23:57:52.900862 2026] [:error] [pid 44444:tid 44465] [client 20.220.189.106:7117] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaBtgG2sMNmj-yekUk2LmAAAAg8"]
[Thu Feb 26 23:57:53.354629 2026] [:error] [pid 54990:tid 54998] [client 20.220.189.106:7127] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaBtgXtr2qmt_mBhH2w49wAAAAU"]
[Thu Feb 26 23:57:53.777759 2026] [:error] [pid 55122:tid 55129] [client 20.220.189.106:7160] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaBtgYLiR0OfjFxvcN9BTwAAAMU"]
[Thu Feb 26 23:57:54.187429 2026] [:error] [pid 44444:tid 44466] [client 20.220.189.106:7126] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaBtgm2sMNmj-yekUk2LnwAAAhA"]
[Thu Feb 26 23:57:54.642662 2026] [:error] [pid 55618:tid 55637] [client 20.220.189.106:7106] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aaBtgh61Vrh12f_8oWQjEAAAARA"]
[Thu Feb 26 23:57:55.076083 2026] [:error] [pid 25311:tid 25325] [client 20.220.189.106:7144] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aaBtg9fdM__yZAgJFSv7BAAAAYs"]
[Thu Feb 26 23:57:55.500070 2026] [:error] [pid 25311:tid 25336] [client 20.220.189.106:6986] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aaBtg9fdM__yZAgJFSv7BgAAAZY"]
[Thu Feb 26 23:57:55.930753 2026] [:error] [pid 25311:tid 25331] [client 20.220.189.106:7048] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/666.php"] [unique_id "aaBtg9fdM__yZAgJFSv7CAAAAZE"]
[Thu Feb 26 23:57:56.359715 2026] [:error] [pid 25311:tid 25327] [client 20.220.189.106:7104] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaBthNfdM__yZAgJFSv7CwAAAY0"]
[Thu Feb 26 23:57:56.797027 2026] [:error] [pid 44444:tid 44467] [client 20.220.189.106:7099] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaBthG2sMNmj-yekUk2LrwAAAhE"]
[Thu Feb 26 23:57:57.229217 2026] [:error] [pid 44444:tid 44470] [client 20.220.189.106:7050] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaBthW2sMNmj-yekUk2LsgAAAhQ"]
[Thu Feb 26 23:57:57.652437 2026] [:error] [pid 25311:tid 25314] [client 20.220.189.106:7157] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaBthdfdM__yZAgJFSv7DwAAAYA"]
[Thu Feb 26 23:57:58.079305 2026] [:error] [pid 54990:tid 55014] [client 20.220.189.106:7132] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaBthntr2qmt_mBhH2w4-gAAABU"]
[Thu Feb 26 23:57:58.534710 2026] [:error] [pid 54991:tid 55020] [client 20.220.189.106:7059] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaBtht4Zx-mJ8gbRB2ggygAAAEA"]
[Thu Feb 26 23:57:58.964584 2026] [:error] [pid 25311:tid 25323] [client 20.220.189.106:7166] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaBthtfdM__yZAgJFSv7FwAAAYk"]
[Thu Feb 26 23:57:59.414693 2026] [:error] [pid 54991:tid 55041] [client 20.220.189.106:7163] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaBth94Zx-mJ8gbRB2ggzAAAAFU"]
[Thu Feb 26 23:57:59.845303 2026] [:error] [pid 44444:tid 44472] [client 20.220.189.106:7143] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaBth22sMNmj-yekUk2LwgAAAhY"]
[Thu Feb 26 23:58:00.268861 2026] [:error] [pid 44444:tid 44463] [client 20.220.189.106:7113] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaBtiG2sMNmj-yekUk2LxwAAAg0"]
[Thu Feb 26 23:58:00.688155 2026] [:error] [pid 44444:tid 44451] [client 20.220.189.106:7121] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaBtiG2sMNmj-yekUk2LzAAAAgE"]
[Thu Feb 26 23:58:01.144947 2026] [:error] [pid 55051:tid 55054] [client 20.220.189.106:6995] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaBtiQmK1w2kZvh5eLH8NwAAAIA"]
[Thu Feb 26 23:58:01.565308 2026] [:error] [pid 44444:tid 44465] [client 20.220.189.106:7044] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaBtiW2sMNmj-yekUk2L0QAAAg8"]
[Thu Feb 26 23:58:02.024185 2026] [:error] [pid 20419:tid 20422] [client 20.220.189.106:7124] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaBtiu3DVDvMfTYYUBWBGgAAAcA"]
[Thu Feb 26 23:58:02.470339 2026] [:error] [pid 54991:tid 55043] [client 20.220.189.106:7137] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaBtit4Zx-mJ8gbRB2ggzgAAAFc"]
[Thu Feb 26 23:58:02.883594 2026] [:error] [pid 20419:tid 20424] [client 20.220.189.106:7164] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaBtiu3DVDvMfTYYUBWBHAAAAcI"]
[Thu Feb 26 23:58:03.358803 2026] [:error] [pid 54991:tid 55037] [client 20.220.189.106:7043] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaBti94Zx-mJ8gbRB2gg0QAAAFE"]
[Thu Feb 26 23:58:03.794048 2026] [:error] [pid 54991:tid 55044] [client 20.220.189.106:7128] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaBti94Zx-mJ8gbRB2gg0wAAAFg"]
[Thu Feb 26 23:58:04.233601 2026] [:error] [pid 44444:tid 44463] [client 20.220.189.106:7131] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaBtjG2sMNmj-yekUk2L2AAAAg0"]
[Thu Feb 26 23:58:04.658063 2026] [:error] [pid 44444:tid 44460] [client 20.220.189.106:7119] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaBtjG2sMNmj-yekUk2L2wAAAgo"]
[Thu Feb 26 23:58:05.097489 2026] [:error] [pid 55122:tid 55126] [client 20.220.189.106:7020] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaBtjYLiR0OfjFxvcN9BVQAAAMI"]
[Thu Feb 26 23:58:05.529302 2026] [:error] [pid 54990:tid 55017] [client 20.220.189.106:7112] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaBtjXtr2qmt_mBhH2w4_QAAABg"]
[Thu Feb 26 23:58:05.960538 2026] [:error] [pid 3883:tid 3909] [client 20.220.189.106:7075] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaBtjeA33x90V6yYHagKRAAAAVc"]
[Thu Feb 26 23:58:06.398677 2026] [:error] [pid 55051:tid 55061] [client 20.220.189.106:7109] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaBtjgmK1w2kZvh5eLH8SgAAAIc"]
[Thu Feb 26 23:58:06.825128 2026] [:error] [pid 55051:tid 55070] [client 20.220.189.106:7058] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaBtjgmK1w2kZvh5eLH8TQAAAJA"]
[Thu Feb 26 23:58:07.244856 2026] [:error] [pid 55051:tid 55066] [client 20.220.189.106:7041] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaBtjwmK1w2kZvh5eLH8TwAAAIw"]
[Thu Feb 26 23:58:07.674054 2026] [:error] [pid 55051:tid 55055] [client 20.220.189.106:7061] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaBtjwmK1w2kZvh5eLH8UwAAAIE"]
[Thu Feb 26 23:58:08.110950 2026] [:error] [pid 54990:tid 55011] [client 20.220.189.106:7125] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaBtkHtr2qmt_mBhH2w4_wAAABI"]
[Thu Feb 26 23:58:08.537815 2026] [:error] [pid 3883:tid 3903] [client 20.220.189.106:7068] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaBtkOA33x90V6yYHagKRQAAAVE"]
[Thu Feb 26 23:58:08.954763 2026] [:error] [pid 55051:tid 55076] [client 20.220.189.106:7148] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaBtkAmK1w2kZvh5eLH8WQAAAJY"]
[Thu Feb 26 23:58:09.369773 2026] [:error] [pid 54991:tid 55030] [client 20.220.189.106:7140] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaBtkd4Zx-mJ8gbRB2gg1QAAAEo"]
[Thu Feb 26 23:58:09.792716 2026] [:error] [pid 20419:tid 20446] [client 20.220.189.106:7160] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaBtke3DVDvMfTYYUBWBIAAAAdg"]
[Thu Feb 26 23:58:10.245134 2026] [:error] [pid 20419:tid 20431] [client 20.220.189.106:7158] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaBtku3DVDvMfTYYUBWBIQAAAck"]
[Thu Feb 26 23:58:10.656128 2026] [:error] [pid 55618:tid 55623] [client 20.220.189.106:7074] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaBtkh61Vrh12f_8oWQjFAAAAQI"]
[Thu Feb 26 23:58:11.078406 2026] [:error] [pid 54991:tid 55029] [client 20.220.189.106:7049] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaBtk94Zx-mJ8gbRB2gg1wAAAEk"]
[Thu Feb 26 23:58:11.493693 2026] [:error] [pid 55051:tid 55073] [client 20.220.189.106:7063] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaBtkwmK1w2kZvh5eLH8ZQAAAJM"]
[Thu Feb 26 23:58:11.909800 2026] [:error] [pid 55051:tid 55059] [client 20.220.189.106:7054] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/work.php"] [unique_id "aaBtkwmK1w2kZvh5eLH8aAAAAIU"]
[Thu Feb 26 23:58:12.320387 2026] [:error] [pid 20419:tid 20438] [client 20.220.189.106:7130] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/work.php"] [unique_id "aaBtlO3DVDvMfTYYUBWBJAAAAdA"]
[Thu Feb 26 23:58:12.756758 2026] [:error] [pid 55051:tid 55058] [client 20.220.189.106:6988] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/work.php"] [unique_id "aaBtlAmK1w2kZvh5eLH8bQAAAIQ"]
[Thu Feb 26 23:58:13.173477 2026] [:error] [pid 3883:tid 3899] [client 20.220.189.106:7155] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/work.php"] [unique_id "aaBtleA33x90V6yYHagKSAAAAU0"]
[Thu Feb 26 23:58:13.623573 2026] [:error] [pid 44444:tid 44460] [client 20.220.189.106:7071] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/06.php"] [unique_id "aaBtlW2sMNmj-yekUk2L7wAAAgo"]
[Thu Feb 26 23:58:14.080739 2026] [:error] [pid 25311:tid 25326] [client 20.220.189.106:7151] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/06.php"] [unique_id "aaBtltfdM__yZAgJFSv7HwAAAYw"]
[Thu Feb 26 23:58:14.549344 2026] [:error] [pid 55122:tid 55141] [client 20.220.189.106:7122] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/06.php"] [unique_id "aaBtloLiR0OfjFxvcN9BWgAAANE"]
[Thu Feb 26 23:58:14.975584 2026] [:error] [pid 55122:tid 55134] [client 20.220.189.106:7141] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/06.php"] [unique_id "aaBtloLiR0OfjFxvcN9BWwAAAMo"]
[Thu Feb 26 23:58:15.402322 2026] [:error] [pid 55051:tid 55076] [client 20.220.189.106:6991] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaBtlwmK1w2kZvh5eLH8cAAAAJY"]
[Thu Feb 26 23:58:15.832847 2026] [:error] [pid 3883:tid 3895] [client 20.220.189.106:7154] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaBtl-A33x90V6yYHagKSgAAAUk"]
[Thu Feb 26 23:58:16.264615 2026] [:error] [pid 55122:tid 55145] [client 20.220.189.106:7098] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaBtmILiR0OfjFxvcN9BXgAAANU"]
[Thu Feb 26 23:58:16.715392 2026] [:error] [pid 25311:tid 25332] [client 20.220.189.106:7084] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaBtmNfdM__yZAgJFSv7IgAAAZI"]
[Thu Feb 26 23:58:17.191976 2026] [:error] [pid 55618:tid 55643] [client 20.220.189.106:7006] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aaBtmR61Vrh12f_8oWQjGgAAARY"]
[Thu Feb 26 23:58:17.682491 2026] [:error] [pid 55122:tid 55128] [client 20.220.189.106:7087] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aaBtmYLiR0OfjFxvcN9BXwAAAMQ"]
[Thu Feb 26 23:58:18.141347 2026] [:error] [pid 55618:tid 55645] [client 20.220.189.106:7056] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aaBtmh61Vrh12f_8oWQjGwAAARg"]
[Thu Feb 26 23:58:18.634553 2026] [:error] [pid 25311:tid 25321] [client 20.220.189.106:7123] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X57.php"] [unique_id "aaBtmtfdM__yZAgJFSv7JgAAAYc"]
[Thu Feb 26 23:58:19.059617 2026] [:error] [pid 55122:tid 55148] [client 20.220.189.106:7014] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaBtm4LiR0OfjFxvcN9BaAAAANg"]
[Thu Feb 26 23:58:19.556045 2026] [:error] [pid 25311:tid 25325] [client 20.220.189.106:7005] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaBtm9fdM__yZAgJFSv7JwAAAYs"]
[Thu Feb 26 23:58:19.985804 2026] [:error] [pid 20419:tid 20442] [client 20.220.189.106:7073] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaBtm-3DVDvMfTYYUBWBMQAAAdQ"]
[Thu Feb 26 23:58:20.585448 2026] [:error] [pid 55122:tid 55138] [client 20.220.189.106:7042] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaBtnILiR0OfjFxvcN9BagAAAM4"]
[Thu Feb 26 23:58:21.010498 2026] [:error] [pid 55051:tid 55074] [client 20.220.189.106:6989] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaBtnQmK1w2kZvh5eLH8dgAAAJQ"]
[Thu Feb 26 23:58:21.470088 2026] [:error] [pid 55122:tid 55134] [client 20.220.189.106:7120] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaBtnYLiR0OfjFxvcN9BbAAAAMo"]
[Thu Feb 26 23:58:21.909377 2026] [:error] [pid 55122:tid 55147] [client 20.220.189.106:7095] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaBtnYLiR0OfjFxvcN9BbgAAANc"]
[Thu Feb 26 23:58:22.329078 2026] [:error] [pid 44444:tid 44470] [client 20.220.189.106:6929] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaBtnm2sMNmj-yekUk2MGAAAAhQ"]
[Thu Feb 26 23:58:22.778699 2026] [:error] [pid 55618:tid 55629] [client 20.220.189.106:6977] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBtnh61Vrh12f_8oWQjHAAAAQg"]
[Thu Feb 26 23:58:23.217343 2026] [:error] [pid 44444:tid 44457] [client 20.220.189.106:7100] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBtn22sMNmj-yekUk2MHAAAAgc"]
[Thu Feb 26 23:58:23.656109 2026] [:error] [pid 44444:tid 44451] [client 20.220.189.106:7135] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBtn22sMNmj-yekUk2MHgAAAgE"]
[Thu Feb 26 23:58:24.085182 2026] [:error] [pid 44444:tid 44461] [client 20.220.189.106:7129] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBtoG2sMNmj-yekUk2MIgAAAgs"]
[Thu Feb 26 23:58:24.507527 2026] [:error] [pid 44444:tid 44456] [client 20.220.189.106:6994] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaBtoG2sMNmj-yekUk2MJgAAAgY"]
[Thu Feb 26 23:58:24.960522 2026] [:error] [pid 25311:tid 25335] [client 20.220.189.106:7165] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaBtoNfdM__yZAgJFSv7LAAAAZU"]
[Thu Feb 26 23:58:25.375669 2026] [:error] [pid 55618:tid 55640] [client 20.220.189.106:7118] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaBtoR61Vrh12f_8oWQjHQAAARM"]
[Thu Feb 26 23:58:25.882439 2026] [:error] [pid 44444:tid 44461] [client 20.220.189.106:7010] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaBtoW2sMNmj-yekUk2MNgAAAgs"]
[Thu Feb 26 23:58:26.319329 2026] [:error] [pid 44444:tid 44459] [client 20.220.189.106:7142] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaBtom2sMNmj-yekUk2MOwAAAgk"]
[Thu Feb 26 23:58:26.767531 2026] [:error] [pid 44444:tid 44470] [client 20.220.189.106:7152] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaBtom2sMNmj-yekUk2MQAAAAhQ"]
[Thu Feb 26 23:58:27.202031 2026] [:error] [pid 44444:tid 44468] [client 20.220.189.106:7066] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaBto22sMNmj-yekUk2MRwAAAhI"]
[Thu Feb 26 23:58:27.635357 2026] [:error] [pid 44444:tid 44450] [client 20.220.189.106:6992] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaBto22sMNmj-yekUk2MTAAAAgA"]
[Thu Feb 26 23:58:28.055753 2026] [:error] [pid 25311:tid 25319] [client 20.220.189.106:7033] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aaBtpNfdM__yZAgJFSv7LwAAAYU"]
[Thu Feb 26 23:58:28.466305 2026] [:error] [pid 55618:tid 55636] [client 20.220.189.106:7136] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aaBtpB61Vrh12f_8oWQjIAAAAQ8"]
[Thu Feb 26 23:58:28.917477 2026] [:error] [pid 55051:tid 55068] [client 20.220.189.106:7153] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aaBtpAmK1w2kZvh5eLH8egAAAI4"]
[Thu Feb 26 23:58:29.333860 2026] [:error] [pid 3883:tid 3902] [client 20.220.189.106:7108] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/un.php"] [unique_id "aaBtpeA33x90V6yYHagKTwAAAVA"]
[Thu Feb 26 23:58:29.758932 2026] [:error] [pid 25311:tid 25332] [client 20.220.189.106:7004] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaBtpdfdM__yZAgJFSv7NAAAAZI"]
[Thu Feb 26 23:58:30.202210 2026] [:error] [pid 55122:tid 55148] [client 20.220.189.106:7016] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaBtpoLiR0OfjFxvcN9BcwAAANg"]
[Thu Feb 26 23:58:30.655486 2026] [:error] [pid 54991:tid 55021] [client 20.220.189.106:7145] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaBtpt4Zx-mJ8gbRB2gg3QAAAEE"]
[Thu Feb 26 23:58:31.072905 2026] [:error] [pid 25311:tid 25321] [client 20.220.189.106:7146] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaBtp9fdM__yZAgJFSv7OAAAAYc"]
[Thu Feb 26 23:58:31.480923 2026] [:error] [pid 44444:tid 44450] [client 20.220.189.106:6993] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aaBtp22sMNmj-yekUk2MWQAAAgA"]
[Thu Feb 26 23:58:31.900286 2026] [:error] [pid 44444:tid 44462] [client 20.220.189.106:7062] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aaBtp22sMNmj-yekUk2MXAAAAgw"]
[Thu Feb 26 23:58:32.309426 2026] [:error] [pid 54991:tid 55043] [client 20.220.189.106:7156] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aaBtqN4Zx-mJ8gbRB2gg3gAAAFc"]
[Thu Feb 26 23:58:32.747203 2026] [:error] [pid 54991:tid 55025] [client 20.220.189.106:6998] [client 20.220.189.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fot.php"] [unique_id "aaBtqN4Zx-mJ8gbRB2gg4AAAAEU"]
[Fri Feb 27 00:29:11.786895 2026] [:error] [pid 18818:tid 18896] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Fri Feb 27 00:29:11.995553 2026] [:error] [pid 18818:tid 18906] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/old.php
[Fri Feb 27 00:29:12.203814 2026] [:error] [pid 18818:tid 18891] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Fri Feb 27 00:29:12.446021 2026] [:error] [pid 18818:tid 18907] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/ultra.php
[Fri Feb 27 00:29:12.780350 2026] [:error] [pid 18818:tid 18884] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Fri Feb 27 00:29:12.995033 2026] [:error] [pid 18818:tid 18901] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 27 00:29:13.218332 2026] [:error] [pid 18818:tid 18897] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Fri Feb 27 00:29:13.426927 2026] [:error] [pid 18818:tid 18903] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Feb 27 00:29:13.648784 2026] [:error] [pid 18818:tid 18886] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Feb 27 00:29:13.873792 2026] [:error] [pid 18818:tid 18904] [client 20.104.19.195:28948] File does not exist: /usr/local/apache/htdocs/suspended-page/check.php
[Fri Feb 27 00:29:14.205460 2026] [:error] [pid 18818:tid 18904] [client 20.104.19.195:28948] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aaB02hhPgqk2SeS_W82wMwAAABQ"]
[Fri Feb 27 00:29:15.222251 2026] [:error] [pid 18843:tid 18945] [client 20.104.19.195:28963] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aaB02yuD2bhSYSowPs3kVwAAAQU"]
[Fri Feb 27 00:29:15.824932 2026] [:error] [pid 18818:tid 18885] [client 20.104.19.195:28991] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aaB02xhPgqk2SeS_W82wNQAAAAE"]
[Fri Feb 27 00:29:16.753975 2026] [:error] [pid 19020:tid 19039] [client 20.104.19.195:28932] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aaB03LN3kp7wL6QzPnX9pAAAAVE"]
[Fri Feb 27 00:29:18.544551 2026] [:error] [pid 20059:tid 20121] [client 20.104.19.195:28951] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inject.php"] [unique_id "aaB03pZBS5wIa_NsqsjQIAAAAdM"]
[Fri Feb 27 00:29:19.329432 2026] [:error] [pid 19020:tid 19037] [client 20.104.19.195:28944] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inject.php"] [unique_id "aaB037N3kp7wL6QzPnX9pwAAAU8"]
[Fri Feb 27 00:29:20.725151 2026] [:error] [pid 18843:tid 18946] [client 20.104.19.195:28688] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inject.php"] [unique_id "aaB04CuD2bhSYSowPs3kXgAAAQY"]
[Fri Feb 27 00:29:21.467093 2026] [:error] [pid 18831:tid 18933] [client 20.104.19.195:28985] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inject.php"] [unique_id "aaB04f5KHTHUIuWRG2a0PAAAAFQ"]
[Fri Feb 27 00:29:22.259651 2026] [:error] [pid 18831:tid 18916] [client 20.104.19.195:28678] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aaB04v5KHTHUIuWRG2a0SgAAAEM"]
[Fri Feb 27 00:29:23.558633 2026] [:error] [pid 19020:tid 19042] [client 20.104.19.195:28961] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aaB047N3kp7wL6QzPnX9yAAAAVQ"]
[Fri Feb 27 00:29:25.025926 2026] [:error] [pid 18831:tid 18913] [client 20.104.19.195:28960] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aaB05f5KHTHUIuWRG2a0VQAAAEA"]
[Fri Feb 27 00:29:26.182734 2026] [:error] [pid 19020:tid 19027] [client 20.104.19.195:28928] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "aaB05rN3kp7wL6QzPnX9zAAAAUU"]
[Fri Feb 27 00:29:27.098162 2026] [:error] [pid 19020:tid 19032] [client 20.104.19.195:29005] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aaB057N3kp7wL6QzPnX9zgAAAUo"]
[Fri Feb 27 00:29:28.620424 2026] [:error] [pid 18831:tid 18924] [client 20.104.19.195:28989] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aaB06P5KHTHUIuWRG2a0WQAAAEs"]
[Fri Feb 27 00:29:31.386259 2026] [:error] [pid 18818:tid 18899] [client 20.104.19.195:28930] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aaB06xhPgqk2SeS_W82wPwAAAA8"]
[Fri Feb 27 00:29:32.027715 2026] [:error] [pid 19020:tid 19037] [client 20.104.19.195:28733] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pro.php"] [unique_id "aaB07LN3kp7wL6QzPnX94wAAAU8"]
[Fri Feb 27 00:29:32.969604 2026] [:error] [pid 19020:tid 19043] [client 20.104.19.195:28683] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aaB07LN3kp7wL6QzPnX95QAAAVU"]
[Fri Feb 27 00:29:34.946487 2026] [:error] [pid 18818:tid 18901] [client 20.104.19.195:28723] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aaB07hhPgqk2SeS_W82wTQAAABE"]
[Fri Feb 27 00:29:35.902561 2026] [:error] [pid 18843:tid 18947] [client 20.104.19.195:28929] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aaB07yuD2bhSYSowPs3kfwAAAQc"]
[Fri Feb 27 00:29:36.709773 2026] [:error] [pid 18843:tid 18949] [client 20.104.19.195:28943] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e.php"] [unique_id "aaB08CuD2bhSYSowPs3kgQAAAQk"]
[Fri Feb 27 00:29:37.825097 2026] [:error] [pid 20059:tid 20120] [client 20.104.19.195:28692] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d.php"] [unique_id "aaB08ZZBS5wIa_NsqsjQKgAAAdI"]
[Fri Feb 27 00:29:39.375085 2026] [:error] [pid 19020:tid 19046] [client 20.104.19.195:28684] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d.php"] [unique_id "aaB087N3kp7wL6QzPnX98gAAAVg"]
[Fri Feb 27 00:29:41.133893 2026] [:error] [pid 18843:tid 18952] [client 20.104.19.195:28940] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d.php"] [unique_id "aaB09SuD2bhSYSowPs3kigAAAQw"]
[Fri Feb 27 00:29:42.303797 2026] [:error] [pid 18831:tid 18933] [client 20.104.19.195:28942] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d.php"] [unique_id "aaB09v5KHTHUIuWRG2a0YwAAAFQ"]
[Fri Feb 27 00:29:43.247054 2026] [:error] [pid 18831:tid 18913] [client 20.104.19.195:28958] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php"] [unique_id "aaB09_5KHTHUIuWRG2a0ZAAAAEA"]
[Fri Feb 27 00:29:44.884382 2026] [:error] [pid 19020:tid 19030] [client 20.104.19.195:28689] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php"] [unique_id "aaB0-LN3kp7wL6QzPnX9_QAAAUg"]
[Fri Feb 27 00:29:46.370830 2026] [:error] [pid 19020:tid 19027] [client 20.104.19.195:29033] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php"] [unique_id "aaB0-rN3kp7wL6QzPnX-AgAAAUU"]
[Fri Feb 27 00:29:47.283857 2026] [:error] [pid 19020:tid 19026] [client 20.104.19.195:28965] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpinfo.php"] [unique_id "aaB0-7N3kp7wL6QzPnX-BgAAAUQ"]
[Fri Feb 27 00:29:48.416032 2026] [:error] [pid 18843:tid 18948] [client 20.104.19.195:28983] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaB0_CuD2bhSYSowPs3klgAAAQg"]
[Fri Feb 27 00:29:50.111085 2026] [:error] [pid 20059:tid 20120] [client 20.104.19.195:28724] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaB0_pZBS5wIa_NsqsjQNgAAAdI"]
[Fri Feb 27 00:29:51.676360 2026] [:error] [pid 19020:tid 19031] [client 20.104.19.195:28955] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaB0_7N3kp7wL6QzPnX-CwAAAUk"]
[Fri Feb 27 00:29:52.952450 2026] [:error] [pid 19020:tid 19027] [client 20.104.19.195:28729] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaB1ALN3kp7wL6QzPnX-EQAAAUU"]
[Fri Feb 27 00:29:53.630368 2026] [:error] [pid 19020:tid 19041] [client 20.104.19.195:28952] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aaB1AbN3kp7wL6QzPnX-FAAAAVM"]
[Fri Feb 27 00:29:54.989789 2026] [:error] [pid 20059:tid 20115] [client 20.104.19.195:28674] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aaB1ApZBS5wIa_NsqsjQRQAAAc0"]
[Fri Feb 27 00:29:55.947334 2026] [:error] [pid 19020:tid 19033] [client 20.104.19.195:28680] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aaB1A7N3kp7wL6QzPnX-GQAAAUs"]
[Fri Feb 27 00:29:56.958811 2026] [:error] [pid 18843:tid 18951] [client 20.104.19.195:28720] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aaB1BCuD2bhSYSowPs3koQAAAQs"]
[Fri Feb 27 00:29:57.917701 2026] [:error] [pid 20059:tid 20104] [client 20.104.19.195:28715] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aaB1BZZBS5wIa_NsqsjQTAAAAcI"]
[Fri Feb 27 00:29:59.115898 2026] [:error] [pid 18818:tid 18904] [client 20.104.19.195:28937] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aaB1BxhPgqk2SeS_W82wYgAAABQ"]
[Fri Feb 27 00:29:59.706517 2026] [:error] [pid 18818:tid 18888] [client 20.104.19.195:29025] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aaB1BxhPgqk2SeS_W82wZQAAAAQ"]
[Fri Feb 27 00:30:00.493597 2026] [:error] [pid 18831:tid 18914] [client 20.104.19.195:28935] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "aaB1CP5KHTHUIuWRG2a0dAAAAEE"]
[Fri Feb 27 00:30:02.371824 2026] [:error] [pid 18843:tid 18953] [client 20.104.19.195:28936] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaB1CiuD2bhSYSowPs3kowAAAQ0"]
[Fri Feb 27 00:30:04.355157 2026] [:error] [pid 18843:tid 18948] [client 20.104.19.195:28975] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaB1DCuD2bhSYSowPs3kpgAAAQg"]
[Fri Feb 27 00:30:05.837783 2026] [:error] [pid 20059:tid 20126] [client 20.104.19.195:28982] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaB1DZZBS5wIa_NsqsjQXQAAAdg"]
[Fri Feb 27 00:30:07.151762 2026] [:error] [pid 20059:tid 20116] [client 20.104.19.195:28990] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaB1D5ZBS5wIa_NsqsjQZQAAAc4"]
[Fri Feb 27 00:30:07.918841 2026] [:error] [pid 20059:tid 20119] [client 20.104.19.195:28677] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaB1D5ZBS5wIa_NsqsjQaQAAAdE"]
[Fri Feb 27 00:30:09.105509 2026] [:error] [pid 18843:tid 18950] [client 20.104.19.195:28950] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaB1ESuD2bhSYSowPs3krAAAAQo"]
[Fri Feb 27 00:30:09.948213 2026] [:error] [pid 20059:tid 20105] [client 20.104.19.195:28933] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaB1EZZBS5wIa_NsqsjQcQAAAcM"]
[Fri Feb 27 00:30:10.541273 2026] [:error] [pid 20059:tid 20111] [client 20.104.19.195:28686] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaB1EpZBS5wIa_NsqsjQcwAAAck"]
[Fri Feb 27 00:30:11.135507 2026] [:error] [pid 18831:tid 18924] [client 20.104.19.195:28676] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aaB1E_5KHTHUIuWRG2a0eAAAAEs"]
[Fri Feb 27 00:30:12.257762 2026] [:error] [pid 20059:tid 20125] [client 20.104.19.195:28972] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "aaB1FJZBS5wIa_NsqsjQdwAAAdc"]
[Fri Feb 27 00:30:13.099943 2026] [:error] [pid 20059:tid 20104] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Fri Feb 27 00:30:13.309487 2026] [:error] [pid 20059:tid 20107] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/debug.php
[Fri Feb 27 00:30:13.827798 2026] [:error] [pid 20059:tid 20112] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Fri Feb 27 00:30:14.048454 2026] [:error] [pid 20059:tid 20124] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Feb 27 00:30:14.269444 2026] [:error] [pid 20059:tid 20123] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/999.php
[Fri Feb 27 00:30:14.700908 2026] [:error] [pid 20059:tid 20108] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Fri Feb 27 00:30:14.910992 2026] [:error] [pid 20059:tid 20118] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/data.php
[Fri Feb 27 00:30:15.125102 2026] [:error] [pid 20059:tid 20109] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Feb 27 00:30:15.345645 2026] [:error] [pid 20059:tid 20125] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Feb 27 00:30:15.557455 2026] [:error] [pid 20059:tid 20115] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Feb 27 00:30:15.845708 2026] [:error] [pid 20059:tid 20117] [client 20.104.19.195:28700] File does not exist: /usr/local/apache/htdocs/suspended-page/backup.php
[Fri Feb 27 00:30:16.055826 2026] [:error] [pid 20059:tid 20108] [client 20.104.19.195:28700] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaB1GJZBS5wIa_NsqsjQmgAAAcY"]
[Fri Feb 27 00:30:17.268133 2026] [:error] [pid 19020:tid 19028] [client 20.104.19.195:28988] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaB1GbN3kp7wL6QzPnX-LAAAAUY"]
[Fri Feb 27 00:30:17.964365 2026] [:error] [pid 20059:tid 20108] [client 20.104.19.195:28931] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaB1GZZBS5wIa_NsqsjQpgAAAcY"]
[Fri Feb 27 00:30:18.736047 2026] [:error] [pid 20059:tid 20121] [client 20.104.19.195:28976] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaB1GpZBS5wIa_NsqsjQqQAAAdM"]
[Fri Feb 27 00:30:19.750588 2026] [:error] [pid 19020:tid 19045] [client 20.104.19.195:28704] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aaB1G7N3kp7wL6QzPnX-LwAAAVc"]
[Fri Feb 27 00:30:20.560357 2026] [:error] [pid 18818:tid 18897] [client 20.104.19.195:28728] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aaB1HBhPgqk2SeS_W82wfQAAAA0"]
[Fri Feb 27 00:30:21.771800 2026] [:error] [pid 19020:tid 19038] [client 20.104.19.195:28939] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aaB1HbN3kp7wL6QzPnX-MwAAAVA"]
[Fri Feb 27 00:30:23.067081 2026] [:error] [pid 18831:tid 18934] [client 20.104.19.195:28679] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "aaB1H_5KHTHUIuWRG2a0gwAAAFU"]
[Fri Feb 27 00:30:23.819673 2026] [:error] [pid 19020:tid 19033] [client 20.104.19.195:28993] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aaB1H7N3kp7wL6QzPnX-NwAAAUs"]
[Fri Feb 27 00:30:24.576178 2026] [:error] [pid 18831:tid 18927] [client 20.104.19.195:28997] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aaB1IP5KHTHUIuWRG2a0hQAAAE4"]
[Fri Feb 27 00:30:25.388397 2026] [:error] [pid 18818:tid 18885] [client 20.104.19.195:28691] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aaB1IRhPgqk2SeS_W82whwAAAAE"]
[Fri Feb 27 00:30:26.495698 2026] [:error] [pid 19020:tid 19044] [client 20.104.19.195:28987] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "aaB1IrN3kp7wL6QzPnX-RQAAAVY"]
[Fri Feb 27 00:30:27.632226 2026] [:error] [pid 18818:tid 18900] [client 20.104.19.195:28699] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aaB1IxhPgqk2SeS_W82wiwAAABA"]
[Fri Feb 27 00:30:28.379999 2026] [:error] [pid 19020:tid 19046] [client 20.104.19.195:29002] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aaB1JLN3kp7wL6QzPnX-SAAAAVg"]
[Fri Feb 27 00:30:29.205825 2026] [:error] [pid 18831:tid 18937] [client 20.104.19.195:28996] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aaB1Jf5KHTHUIuWRG2a0iAAAAFg"]
[Fri Feb 27 00:30:29.936688 2026] [:error] [pid 19020:tid 19026] [client 20.104.19.195:28969] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "aaB1JbN3kp7wL6QzPnX-TQAAAUQ"]
[Fri Feb 27 00:30:30.939198 2026] [:error] [pid 18831:tid 18925] [client 20.104.19.195:29012] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aaB1Jv5KHTHUIuWRG2a0iwAAAEw"]
[Fri Feb 27 00:30:31.765705 2026] [:error] [pid 18831:tid 18931] [client 20.104.19.195:28966] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aaB1J_5KHTHUIuWRG2a0jQAAAFI"]
[Fri Feb 27 00:30:32.494853 2026] [:error] [pid 20059:tid 20111] [client 20.104.19.195:28979] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aaB1KJZBS5wIa_NsqsjQxwAAAck"]
[Fri Feb 27 00:30:34.497170 2026] [:error] [pid 20059:tid 20109] [client 20.104.19.195:28938] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "aaB1KpZBS5wIa_NsqsjQ2AAAAcc"]
[Fri Feb 27 00:30:35.876633 2026] [:error] [pid 18843:tid 18943] [client 20.104.19.195:28719] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aaB1KyuD2bhSYSowPs3kwAAAAQM"]
[Fri Feb 27 00:30:36.749299 2026] [:error] [pid 18843:tid 18960] [client 20.104.19.195:28695] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aaB1LCuD2bhSYSowPs3kwgAAARQ"]
[Fri Feb 27 00:30:37.852887 2026] [:error] [pid 20059:tid 20117] [client 20.104.19.195:29010] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aaB1LZZBS5wIa_NsqsjQ4QAAAc8"]
[Fri Feb 27 00:30:38.826718 2026] [:error] [pid 20059:tid 20113] [client 20.104.19.195:28978] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c.php"] [unique_id "aaB1LpZBS5wIa_NsqsjQ5gAAAcs"]
[Fri Feb 27 00:30:40.191578 2026] [:error] [pid 18831:tid 18931] [client 20.104.19.195:28706] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaB1MP5KHTHUIuWRG2a0rAAAAFI"]
[Fri Feb 27 00:30:40.798081 2026] [:error] [pid 20059:tid 20123] [client 20.104.19.195:28968] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaB1MJZBS5wIa_NsqsjQ7wAAAdU"]
[Fri Feb 27 00:30:41.817311 2026] [:error] [pid 20059:tid 20118] [client 20.104.19.195:28673] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaB1MZZBS5wIa_NsqsjQ8wAAAdA"]
[Fri Feb 27 00:30:42.736202 2026] [:error] [pid 18843:tid 18949] [client 20.104.19.195:28984] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaB1MiuD2bhSYSowPs3k8QAAAQk"]
[Fri Feb 27 00:30:43.490001 2026] [:error] [pid 20059:tid 20117] [client 20.104.19.195:28953] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aaB1M5ZBS5wIa_NsqsjRBAAAAc8"]
[Fri Feb 27 00:30:44.856142 2026] [:error] [pid 18831:tid 18919] [client 20.104.19.195:28735] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aaB1NP5KHTHUIuWRG2a0wgAAAEY"]
[Fri Feb 27 00:30:45.542216 2026] [:error] [pid 18831:tid 18927] [client 20.104.19.195:29051] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aaB1Nf5KHTHUIuWRG2a0xgAAAE4"]
[Fri Feb 27 00:30:46.608721 2026] [:error] [pid 18843:tid 18947] [client 20.104.19.195:29052] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/db.php"] [unique_id "aaB1NiuD2bhSYSowPs3lAwAAAQc"]
[Fri Feb 27 00:30:47.695712 2026] [:error] [pid 19020:tid 19027] [client 20.104.19.195:28959] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/u.php"] [unique_id "aaB1N7N3kp7wL6QzPnX-YwAAAUU"]
[Fri Feb 27 00:30:48.910885 2026] [:error] [pid 18843:tid 18961] [client 20.104.19.195:28962] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/u.php"] [unique_id "aaB1OCuD2bhSYSowPs3lDAAAARU"]
[Fri Feb 27 00:30:50.818002 2026] [:error] [pid 20059:tid 20116] [client 20.104.19.195:28693] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/u.php"] [unique_id "aaB1OpZBS5wIa_NsqsjRTQAAAc4"]
[Fri Feb 27 00:30:51.783763 2026] [:error] [pid 20059:tid 20115] [client 20.104.19.195:28672] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/u.php"] [unique_id "aaB1O5ZBS5wIa_NsqsjRVQAAAc0"]
[Fri Feb 27 00:30:52.640433 2026] [:error] [pid 20059:tid 20107] [client 20.104.19.195:29054] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaB1PJZBS5wIa_NsqsjRXgAAAcU"]
[Fri Feb 27 00:30:53.496126 2026] [:error] [pid 20059:tid 20115] [client 20.104.19.195:28994] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaB1PZZBS5wIa_NsqsjRaAAAAc0"]
[Fri Feb 27 00:30:54.622152 2026] [:error] [pid 20059:tid 20116] [client 20.104.19.195:28941] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaB1PpZBS5wIa_NsqsjRdAAAAc4"]
[Fri Feb 27 00:30:56.226331 2026] [:error] [pid 20059:tid 20112] [client 20.104.19.195:28945] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaB1QJZBS5wIa_NsqsjRgwAAAco"]
[Fri Feb 27 00:30:58.412142 2026] [:error] [pid 20059:tid 20107] [client 20.104.19.195:28697] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aaB1QpZBS5wIa_NsqsjRlgAAAcU"]
[Fri Feb 27 00:30:59.173697 2026] [:error] [pid 19020:tid 19029] [client 20.104.19.195:28690] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aaB1Q7N3kp7wL6QzPnX-hwAAAUc"]
[Fri Feb 27 00:30:59.853987 2026] [:error] [pid 20059:tid 20122] [client 20.104.19.195:28685] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aaB1Q5ZBS5wIa_NsqsjRpgAAAdQ"]
[Fri Feb 27 00:31:00.911263 2026] [:error] [pid 18818:tid 18895] [client 20.104.19.195:28682] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file3.php"] [unique_id "aaB1RBhPgqk2SeS_W82wrgAAAAs"]
[Fri Feb 27 00:31:01.674776 2026] [:error] [pid 20059:tid 20113] [client 20.104.19.195:28934] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aaB1RZZBS5wIa_NsqsjRqgAAAcs"]
[Fri Feb 27 00:31:02.633317 2026] [:error] [pid 18831:tid 18937] [client 20.104.19.195:28980] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aaB1Rv5KHTHUIuWRG2a1GwAAAFg"]
[Fri Feb 27 00:31:04.062140 2026] [:error] [pid 18831:tid 18932] [client 20.104.19.195:28956] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aaB1SP5KHTHUIuWRG2a1IwAAAFM"]
[Fri Feb 27 00:31:07.709440 2026] [:error] [pid 18818:tid 18893] [client 20.104.19.195:28992] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file5.php"] [unique_id "aaB1SxhPgqk2SeS_W82wtAAAAAk"]
[Fri Feb 27 00:31:10.793770 2026] [:error] [pid 19020:tid 19039] [client 20.104.19.195:29023] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/law.php"] [unique_id "aaB1TrN3kp7wL6QzPnX-mAAAAVE"]
[Fri Feb 27 00:31:12.669957 2026] [:error] [pid 19020:tid 19028] [client 20.104.19.195:28949] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/law.php"] [unique_id "aaB1ULN3kp7wL6QzPnX-nAAAAUY"]
[Fri Feb 27 00:31:14.851554 2026] [:error] [pid 18818:tid 18896] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Fri Feb 27 00:31:15.062311 2026] [:error] [pid 18818:tid 18885] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Fri Feb 27 00:31:15.296517 2026] [:error] [pid 18818:tid 18903] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Fri Feb 27 00:31:15.504647 2026] [:error] [pid 18818:tid 18891] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Feb 27 00:31:15.713750 2026] [:error] [pid 18818:tid 18886] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Fri Feb 27 00:31:15.928661 2026] [:error] [pid 18818:tid 18899] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Fri Feb 27 00:31:16.151360 2026] [:error] [pid 18818:tid 18902] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/dejavu.php
[Fri Feb 27 00:31:16.360600 2026] [:error] [pid 18818:tid 18892] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Fri Feb 27 00:31:17.060985 2026] [:error] [pid 18818:tid 18884] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 27 00:31:18.526603 2026] [:error] [pid 18818:tid 18884] [client 20.104.19.195:28954] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Fri Feb 27 00:31:18.731901 2026] [:error] [pid 18818:tid 18897] [client 20.104.19.195:28954] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aaB1VhhPgqk2SeS_W82wyQAAAA0"]
[Fri Feb 27 00:31:20.151780 2026] [:error] [pid 20059:tid 20124] [client 20.104.19.195:29009] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aaB1WJZBS5wIa_NsqsjRxQAAAdY"]
[Fri Feb 27 00:31:22.000271 2026] [:error] [pid 18831:tid 18920] [client 20.104.19.195:28694] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aaB1Wf5KHTHUIuWRG2a1WQAAAEc"]
[Fri Feb 27 00:31:22.843595 2026] [:error] [pid 18831:tid 18922] [client 20.104.19.195:28981] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "aaB1Wv5KHTHUIuWRG2a1XwAAAEk"]
[Fri Feb 27 00:31:23.922938 2026] [:error] [pid 18843:tid 18949] [client 20.104.19.195:28964] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7309/index.php"] [unique_id "aaB1WyuD2bhSYSowPs3lPwAAAQk"]
[Fri Feb 27 00:31:24.621241 2026] [:error] [pid 20059:tid 20103] [client 20.104.19.195:29020] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7309/index.php"] [unique_id "aaB1XJZBS5wIa_NsqsjRzgAAAcE"]
[Fri Feb 27 00:31:25.666718 2026] [:error] [pid 18831:tid 18918] [client 20.104.19.195:29001] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7309/index.php"] [unique_id "aaB1Xf5KHTHUIuWRG2a1ZQAAAEU"]
[Fri Feb 27 00:31:26.443319 2026] [:error] [pid 20059:tid 20124] [client 20.104.19.195:29038] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7309/index.php"] [unique_id "aaB1XpZBS5wIa_NsqsjR1AAAAdY"]
[Fri Feb 27 00:31:27.665219 2026] [:error] [pid 18831:tid 18915] [client 20.104.19.195:28727] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aaB1X_5KHTHUIuWRG2a1ZwAAAEI"]
[Fri Feb 27 00:31:28.625537 2026] [:error] [pid 18818:tid 18895] [client 20.104.19.195:28702] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aaB1YBhPgqk2SeS_W82w1AAAAAs"]
[Fri Feb 27 00:31:29.551615 2026] [:error] [pid 18843:tid 18942] [client 20.104.19.195:28998] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aaB1YSuD2bhSYSowPs3lRQAAAQI"]
[Fri Feb 27 00:31:31.028813 2026] [:error] [pid 18843:tid 18961] [client 20.104.19.195:28726] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "aaB1YyuD2bhSYSowPs3lSQAAARU"]
[Fri Feb 27 00:31:32.281017 2026] [:error] [pid 18818:tid 18905] [client 20.104.19.195:28731] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaB1ZBhPgqk2SeS_W82w1wAAABU"]
[Fri Feb 27 00:31:33.951067 2026] [:error] [pid 20059:tid 20109] [client 20.104.19.195:29015] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaB1ZZZBS5wIa_NsqsjR5QAAAcc"]
[Fri Feb 27 00:31:35.384120 2026] [:error] [pid 18831:tid 18923] [client 20.104.19.195:29006] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaB1Z_5KHTHUIuWRG2a1awAAAEo"]
[Fri Feb 27 00:31:36.329192 2026] [:error] [pid 19020:tid 19025] [client 20.104.19.195:28681] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaB1aLN3kp7wL6QzPnX-vAAAAUM"]
[Fri Feb 27 00:31:36.973364 2026] [:error] [pid 20059:tid 20124] [client 20.104.19.195:28995] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aaB1aJZBS5wIa_NsqsjR8AAAAdY"]
[Fri Feb 27 00:31:37.567651 2026] [:error] [pid 19020:tid 19034] [client 20.104.19.195:28708] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aaB1abN3kp7wL6QzPnX-vQAAAUw"]
[Fri Feb 27 00:31:38.770643 2026] [:error] [pid 18831:tid 18924] [client 20.104.19.195:28974] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aaB1av5KHTHUIuWRG2a1dAAAAEs"]
[Fri Feb 27 00:31:39.701383 2026] [:error] [pid 19020:tid 19023] [client 20.104.19.195:28957] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file17.php"] [unique_id "aaB1a7N3kp7wL6QzPnX-1AAAAUE"]
[Fri Feb 27 00:31:41.206721 2026] [:error] [pid 20059:tid 20121] [client 20.104.19.195:28717] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/footer.php"] [unique_id "aaB1bZZBS5wIa_NsqsjSFAAAAdM"]
[Fri Feb 27 00:31:42.291144 2026] [:error] [pid 20059:tid 20104] [client 20.104.19.195:29048] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/footer.php"] [unique_id "aaB1bpZBS5wIa_NsqsjSIQAAAcI"]
[Fri Feb 27 00:31:43.004654 2026] [:error] [pid 18818:tid 18894] [client 20.104.19.195:29040] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/footer.php"] [unique_id "aaB1bxhPgqk2SeS_W82w3QAAAAo"]
[Fri Feb 27 00:31:43.974718 2026] [:error] [pid 18818:tid 18908] [client 20.104.19.195:29008] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/footer.php"] [unique_id "aaB1bxhPgqk2SeS_W82w3wAAABg"]
[Fri Feb 27 00:31:44.706118 2026] [:error] [pid 18831:tid 18919] [client 20.104.19.195:28709] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aaB1cP5KHTHUIuWRG2a1hwAAAEY"]
[Fri Feb 27 00:31:45.308664 2026] [:error] [pid 19020:tid 19026] [client 20.104.19.195:28947] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aaB1cbN3kp7wL6QzPnX-7wAAAUQ"]
[Fri Feb 27 00:31:46.227015 2026] [:error] [pid 18843:tid 18940] [client 20.104.19.195:28718] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aaB1ciuD2bhSYSowPs3lYwAAAQA"]
[Fri Feb 27 00:31:47.014905 2026] [:error] [pid 19020:tid 19022] [client 20.104.19.195:28714] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file8.php"] [unique_id "aaB1c7N3kp7wL6QzPnX-9wAAAUA"]
[Fri Feb 27 00:31:48.426627 2026] [:error] [pid 18818:tid 18900] [client 20.104.19.195:29145] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaB1dBhPgqk2SeS_W82w4wAAABA"]
[Fri Feb 27 00:31:49.459365 2026] [:error] [pid 18843:tid 18964] [client 20.104.19.195:28716] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaB1dSuD2bhSYSowPs3lZgAAARg"]
[Fri Feb 27 00:31:50.840252 2026] [:error] [pid 20059:tid 20119] [client 20.104.19.195:29035] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaB1dpZBS5wIa_NsqsjSOQAAAdE"]
[Fri Feb 27 00:31:51.614278 2026] [:error] [pid 18818:tid 18895] [client 20.104.19.195:29122] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaB1dxhPgqk2SeS_W82w5QAAAAs"]
[Fri Feb 27 00:31:52.346353 2026] [:error] [pid 18843:tid 18957] [client 20.104.19.195:28973] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaB1eCuD2bhSYSowPs3lagAAARE"]
[Fri Feb 27 00:31:53.768701 2026] [:error] [pid 18843:tid 18943] [client 20.104.19.195:29000] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaB1eSuD2bhSYSowPs3lbgAAAQM"]
[Fri Feb 27 00:31:54.578028 2026] [:error] [pid 19020:tid 19037] [client 20.104.19.195:29155] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaB1erN3kp7wL6QzPnX_BQAAAU8"]
[Fri Feb 27 00:31:56.474581 2026] [:error] [pid 20059:tid 20123] [client 20.104.19.195:28696] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaB1fJZBS5wIa_NsqsjSSQAAAdU"]
[Fri Feb 27 00:31:57.440621 2026] [:error] [pid 18818:tid 18893] [client 20.104.19.195:29013] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaB1fRhPgqk2SeS_W82w7AAAAAk"]
[Fri Feb 27 00:31:59.150039 2026] [:error] [pid 20059:tid 20118] [client 20.104.19.195:29131] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaB1f5ZBS5wIa_NsqsjSUAAAAdA"]
[Fri Feb 27 00:32:00.942087 2026] [:error] [pid 18818:tid 18900] [client 20.104.19.195:28722] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaB1gBhPgqk2SeS_W82w9AAAABA"]
[Fri Feb 27 00:32:01.901181 2026] [:error] [pid 19020:tid 19040] [client 20.104.19.195:28698] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaB1gbN3kp7wL6QzPnX_DgAAAVI"]
[Fri Feb 27 00:32:03.406179 2026] [:error] [pid 20059:tid 20122] [client 20.104.19.195:28710] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1g5ZBS5wIa_NsqsjSXAAAAdQ"]
[Fri Feb 27 00:32:04.700617 2026] [:error] [pid 18831:tid 18929] [client 20.104.19.195:28971] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1hP5KHTHUIuWRG2a1kgAAAFA"]
[Fri Feb 27 00:32:06.297122 2026] [:error] [pid 20059:tid 20102] [client 20.104.19.195:29044] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1hpZBS5wIa_NsqsjSYgAAAcA"]
[Fri Feb 27 00:32:07.193184 2026] [:error] [pid 20059:tid 20114] [client 20.104.19.195:29024] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1h5ZBS5wIa_NsqsjSZAAAAcw"]
[Fri Feb 27 00:32:08.020799 2026] [:error] [pid 20059:tid 20107] [client 20.104.19.195:28701] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aaB1iJZBS5wIa_NsqsjSZgAAAcU"]
[Fri Feb 27 00:32:09.361038 2026] [:error] [pid 19020:tid 19040] [client 20.104.19.195:29134] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aaB1ibN3kp7wL6QzPnX_HQAAAVI"]
[Fri Feb 27 00:32:10.607893 2026] [:error] [pid 19020:tid 19039] [client 20.104.19.195:28999] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aaB1irN3kp7wL6QzPnX_IAAAAVE"]
[Fri Feb 27 00:32:11.728134 2026] [:error] [pid 18818:tid 18893] [client 20.104.19.195:29147] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lc.php"] [unique_id "aaB1ixhPgqk2SeS_W82w_gAAAAk"]
[Fri Feb 27 00:32:12.935110 2026] [:error] [pid 18831:tid 18917] [client 20.104.19.195:29141] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaB1jP5KHTHUIuWRG2a1lwAAAEQ"]
[Fri Feb 27 00:32:14.230258 2026] [:error] [pid 18818:tid 18887] [client 20.104.19.195:29168] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaB1jhhPgqk2SeS_W82xAAAAAAM"]
[Fri Feb 27 00:32:15.668823 2026] [:error] [pid 18831:tid 18921] [client 20.104.19.195:29034] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaB1j_5KHTHUIuWRG2a1owAAAEg"]
[Fri Feb 27 00:32:17.625984 2026] [:error] [pid 19020:tid 19037] [client 20.104.19.195:29184] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaB1kbN3kp7wL6QzPnX_MAAAAU8"]
[Fri Feb 27 00:32:18.722793 2026] [:error] [pid 18843:tid 18958] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Feb 27 00:32:18.945902 2026] [:error] [pid 18843:tid 18941] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php
[Fri Feb 27 00:32:19.154379 2026] [:error] [pid 18843:tid 18944] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/hoot.php
[Fri Feb 27 00:32:19.364335 2026] [:error] [pid 18843:tid 18949] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 27 00:32:19.578397 2026] [:error] [pid 18843:tid 18951] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Fri Feb 27 00:32:19.801559 2026] [:error] [pid 18843:tid 18957] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/golden.php
[Fri Feb 27 00:32:20.019657 2026] [:error] [pid 18843:tid 18955] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Feb 27 00:32:20.252838 2026] [:error] [pid 18843:tid 18943] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Feb 27 00:32:20.479719 2026] [:error] [pid 18843:tid 18960] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Fri Feb 27 00:32:20.687907 2026] [:error] [pid 18843:tid 18962] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Fri Feb 27 00:32:20.911736 2026] [:error] [pid 18843:tid 18950] [client 20.104.19.195:28713] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 00:32:21.126314 2026] [:error] [pid 18843:tid 18942] [client 20.104.19.195:28713] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aaB1lSuD2bhSYSowPs3lkAAAAQI"]
[Fri Feb 27 00:32:22.150279 2026] [:error] [pid 19020:tid 19028] [client 20.104.19.195:29127] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aaB1lrN3kp7wL6QzPnX_NgAAAUY"]
[Fri Feb 27 00:32:23.456223 2026] [:error] [pid 19020:tid 19034] [client 20.104.19.195:29139] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aaB1l7N3kp7wL6QzPnX_OwAAAUw"]
[Fri Feb 27 00:32:24.262490 2026] [:error] [pid 18843:tid 18947] [client 20.104.19.195:29046] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "aaB1mCuD2bhSYSowPs3lkgAAAQc"]
[Fri Feb 27 00:32:25.225923 2026] [:error] [pid 19020:tid 19025] [client 20.104.19.195:29017] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/news.php"] [unique_id "aaB1mbN3kp7wL6QzPnX_PwAAAUM"]
[Fri Feb 27 00:32:26.316068 2026] [:error] [pid 19020:tid 19027] [client 20.104.19.195:28711] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/news.php"] [unique_id "aaB1mrN3kp7wL6QzPnX_QwAAAUU"]
[Fri Feb 27 00:32:26.980066 2026] [:error] [pid 20059:tid 20115] [client 20.104.19.195:28707] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/news.php"] [unique_id "aaB1mpZBS5wIa_NsqsjShAAAAc0"]
[Fri Feb 27 00:32:27.892907 2026] [:error] [pid 18831:tid 18922] [client 20.104.19.195:29180] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/news.php"] [unique_id "aaB1m_5KHTHUIuWRG2a1rwAAAEk"]
[Fri Feb 27 00:32:29.137088 2026] [:error] [pid 18843:tid 18963] [client 20.104.19.195:28734] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaB1nSuD2bhSYSowPs3lmAAAARc"]
[Fri Feb 27 00:32:30.230183 2026] [:error] [pid 18818:tid 18903] [client 20.104.19.195:29011] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaB1nhhPgqk2SeS_W82xBQAAABM"]
[Fri Feb 27 00:32:31.030453 2026] [:error] [pid 18843:tid 18942] [client 20.104.19.195:28977] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaB1nyuD2bhSYSowPs3lnwAAAQI"]
[Fri Feb 27 00:32:31.579168 2026] [:error] [pid 18843:tid 18946] [client 20.104.19.195:29003] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaB1nyuD2bhSYSowPs3loAAAAQY"]
[Fri Feb 27 00:32:32.471089 2026] [:error] [pid 19020:tid 19025] [client 20.104.19.195:29028] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aaB1oLN3kp7wL6QzPnX_SwAAAUM"]
[Fri Feb 27 00:32:33.291074 2026] [:error] [pid 19020:tid 19027] [client 20.104.19.195:29031] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aaB1obN3kp7wL6QzPnX_TgAAAUU"]
[Fri Feb 27 00:32:34.567525 2026] [:error] [pid 20059:tid 20120] [client 20.104.19.195:29146] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aaB1opZBS5wIa_NsqsjSkgAAAdI"]
[Fri Feb 27 00:32:35.535252 2026] [:error] [pid 18831:tid 18926] [client 20.104.19.195:28687] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "aaB1o_5KHTHUIuWRG2a1tgAAAE0"]
[Fri Feb 27 00:32:36.335199 2026] [:error] [pid 19020:tid 19044] [client 20.104.19.195:29029] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aaB1pLN3kp7wL6QzPnX_UwAAAVY"]
[Fri Feb 27 00:32:36.869434 2026] [:error] [pid 18843:tid 18951] [client 20.104.19.195:28946] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aaB1pCuD2bhSYSowPs3lpwAAAQs"]
[Fri Feb 27 00:32:37.475876 2026] [:error] [pid 19020:tid 19046] [client 20.104.19.195:29037] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aaB1pbN3kp7wL6QzPnX_WQAAAVg"]
[Fri Feb 27 00:32:38.136934 2026] [:error] [pid 19020:tid 19041] [client 20.104.19.195:29137] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "aaB1prN3kp7wL6QzPnX_XQAAAVM"]
[Fri Feb 27 00:32:38.754536 2026] [:error] [pid 20059:tid 20109] [client 20.104.19.195:28725] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aaB1ppZBS5wIa_NsqsjSmAAAAcc"]
[Fri Feb 27 00:32:39.438750 2026] [:error] [pid 20059:tid 20118] [client 20.104.19.195:29148] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aaB1p5ZBS5wIa_NsqsjSmwAAAdA"]
[Fri Feb 27 00:32:40.180063 2026] [:error] [pid 18843:tid 18952] [client 20.104.19.195:28967] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aaB1qCuD2bhSYSowPs3lqgAAAQw"]
[Fri Feb 27 00:32:41.013306 2026] [:error] [pid 20059:tid 20106] [client 20.104.19.195:29036] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "aaB1qZZBS5wIa_NsqsjSngAAAcQ"]
[Fri Feb 27 00:32:42.058406 2026] [:error] [pid 20059:tid 20107] [client 20.104.19.195:28696] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "aaB1qpZBS5wIa_NsqsjSpwAAAcU"]
[Fri Feb 27 00:32:42.964307 2026] [:error] [pid 19020:tid 19027] [client 20.104.19.195:29030] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "aaB1qrN3kp7wL6QzPnX_bQAAAUU"]
[Fri Feb 27 00:32:43.639479 2026] [:error] [pid 18843:tid 18953] [client 20.104.19.195:29124] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "aaB1qyuD2bhSYSowPs3lrgAAAQ0"]
[Fri Feb 27 00:32:44.360947 2026] [:error] [pid 20059:tid 20110] [client 20.104.19.195:29182] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "aaB1rJZBS5wIa_NsqsjSsQAAAcg"]
[Fri Feb 27 00:32:45.111725 2026] [:error] [pid 19020:tid 19026] [client 20.104.19.195:29026] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1rbN3kp7wL6QzPnX_bwAAAUQ"]
[Fri Feb 27 00:32:45.939124 2026] [:error] [pid 20059:tid 20112] [client 20.104.19.195:29045] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1rZZBS5wIa_NsqsjStAAAAco"]
[Fri Feb 27 00:32:46.969882 2026] [:error] [pid 19020:tid 19030] [client 20.104.19.195:29047] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1rrN3kp7wL6QzPnX_dAAAAUg"]
[Fri Feb 27 00:32:47.973369 2026] [:error] [pid 18831:tid 18929] [client 20.104.19.195:29166] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "aaB1r_5KHTHUIuWRG2a1ugAAAFA"]
[Fri Feb 27 00:32:48.610473 2026] [:error] [pid 19020:tid 19045] [client 20.104.19.195:29129] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aaB1sLN3kp7wL6QzPnX_dwAAAVc"]
[Fri Feb 27 00:32:49.331484 2026] [:error] [pid 19020:tid 19037] [client 20.104.19.195:29178] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aaB1sbN3kp7wL6QzPnX_eAAAAU8"]
[Fri Feb 27 00:32:50.096253 2026] [:error] [pid 19020:tid 19035] [client 20.104.19.195:29043] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aaB1srN3kp7wL6QzPnX_fQAAAU0"]
[Fri Feb 27 00:32:50.934209 2026] [:error] [pid 19020:tid 19024] [client 20.104.19.195:29050] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/fm.php"] [unique_id "aaB1srN3kp7wL6QzPnX_gQAAAUI"]
[Fri Feb 27 00:32:52.332581 2026] [:error] [pid 18843:tid 18948] [client 20.104.19.195:29049] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aaB1tCuD2bhSYSowPs3luQAAAQg"]
[Fri Feb 27 00:32:53.607222 2026] [:error] [pid 19020:tid 19023] [client 20.104.19.195:29199] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aaB1tbN3kp7wL6QzPnX_hwAAAUE"]
[Fri Feb 27 00:32:54.393462 2026] [:error] [pid 19020:tid 19043] [client 20.104.19.195:29138] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aaB1trN3kp7wL6QzPnX_jQAAAVU"]
[Fri Feb 27 00:32:55.358202 2026] [:error] [pid 18818:tid 18898] [client 20.104.19.195:28703] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aaB1txhPgqk2SeS_W82xDAAAAA4"]
[Fri Feb 27 00:32:57.033922 2026] [:error] [pid 18818:tid 18884] [client 20.104.19.195:29641] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaB1uRhPgqk2SeS_W82xDQAAAAA"]
[Fri Feb 27 00:32:57.885476 2026] [:error] [pid 18818:tid 18887] [client 20.104.19.195:29159] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaB1uRhPgqk2SeS_W82xDwAAAAM"]
[Fri Feb 27 00:32:58.593517 2026] [:error] [pid 18831:tid 18915] [client 20.104.19.195:29123] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaB1uv5KHTHUIuWRG2a1xgAAAEI"]
[Fri Feb 27 00:32:59.855060 2026] [:error] [pid 18831:tid 18934] [client 20.104.19.195:29004] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaB1u_5KHTHUIuWRG2a1yAAAAFU"]
[Fri Feb 27 00:33:02.951958 2026] [:error] [pid 19020:tid 19030] [client 20.104.19.195:29157] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aaB1vrN3kp7wL6QzPnX_ngAAAUg"]
[Fri Feb 27 00:33:06.432998 2026] [:error] [pid 18843:tid 18944] [client 20.104.19.195:29181] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aaB1wiuD2bhSYSowPs3l0AAAAQQ"]
[Fri Feb 27 00:33:11.302262 2026] [:error] [pid 20059:tid 20125] [client 20.104.19.195:29140] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aaB1x5ZBS5wIa_NsqsjS0QAAAdc"]
[Fri Feb 27 00:33:16.135157 2026] [:error] [pid 19020:tid 19031] [client 20.104.19.195:29162] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaB1zLN3kp7wL6QzPnX_uQAAAUk"]
[Fri Feb 27 00:33:17.225281 2026] [:error] [pid 19020:tid 19044] [client 20.104.19.195:29133] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaB1zbN3kp7wL6QzPnX_ugAAAVY"]
[Fri Feb 27 00:33:18.960245 2026] [:error] [pid 18818:tid 18908] [client 20.104.19.195:29216] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaB1zhhPgqk2SeS_W82xGwAAABg"]
[Fri Feb 27 00:33:22.252157 2026] [:error] [pid 19020:tid 19041] [client 20.104.19.195:29019] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 27 00:33:22.462794 2026] [:error] [pid 19020:tid 19036] [client 20.104.19.195:29019] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Fri Feb 27 00:33:22.753496 2026] [:error] [pid 19020:tid 19029] [client 20.104.19.195:29019] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 00:33:22.996293 2026] [:error] [pid 19020:tid 19035] [client 20.104.19.195:29019] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Fri Feb 27 00:33:23.244871 2026] [:error] [pid 19020:tid 19037] [client 20.104.19.195:29019] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 02:34:49.087182 2026] [:error] [pid 18818:tid 18906] [client 4.205.37.160:10217] File does not exist: /usr/local/apache/htdocs/suspended-page/class3.php
[Fri Feb 27 02:34:49.303565 2026] [:error] [pid 18818:tid 18895] [client 4.205.37.160:10217] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 04:30:33.427542 2026] [:error] [pid 3975:tid 4031] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Feb 27 04:30:33.661145 2026] [:error] [pid 3975:tid 4016] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 04:30:33.949211 2026] [:error] [pid 3975:tid 4018] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Feb 27 04:30:34.222720 2026] [:error] [pid 3975:tid 4013] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Feb 27 04:30:34.514651 2026] [:error] [pid 3975:tid 4010] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Feb 27 04:30:34.767035 2026] [:error] [pid 3975:tid 4020] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 27 04:30:35.050435 2026] [:error] [pid 3975:tid 4031] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 27 04:30:35.313881 2026] [:error] [pid 3975:tid 4016] [client 173.239.214.11:21777] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 04:30:35.596013 2026] [:error] [pid 3975:tid 4027] [client 173.239.214.11:21777] [client 173.239.214.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/login.php"] [unique_id "aaCtaxMVp0-T2hD76b24HQAAAJE"]
[Fri Feb 27 04:30:36.455074 2026] [:error] [pid 42435:tid 42442] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Feb 27 04:30:36.924284 2026] [:error] [pid 42435:tid 42451] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Feb 27 04:30:37.202768 2026] [:error] [pid 42435:tid 42462] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Feb 27 04:30:37.493759 2026] [:error] [pid 42435:tid 42458] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 04:30:37.735732 2026] [:error] [pid 42435:tid 42449] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Feb 27 04:30:38.006188 2026] [:error] [pid 42435:tid 42448] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 04:30:38.276853 2026] [:error] [pid 42435:tid 42458] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Feb 27 04:30:38.540823 2026] [:error] [pid 42435:tid 42446] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Feb 27 04:30:38.786592 2026] [:error] [pid 42435:tid 42458] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Feb 27 04:30:39.060016 2026] [:error] [pid 42435:tid 42448] [client 173.239.214.5:21045] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Feb 27 04:30:42.827310 2026] [:error] [pid 42435:tid 42459] [client 173.239.214.5:21045] [client 173.239.214.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaCtch5hHLnaukp_y991gAAAAZM"]
[Fri Feb 27 04:30:44.146698 2026] [:error] [pid 3973:tid 4003] [client 209.87.169.176:51793] [client 209.87.169.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaCtdIJZsftwqmUaaLP0yAAAABQ"]
[Fri Feb 27 04:30:45.480301 2026] [:error] [pid 3974:tid 4055] [client 185.198.240.150:20249] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Feb 27 04:30:46.365856 2026] [:error] [pid 3974:tid 4040] [client 185.198.240.150:20249] [client 185.198.240.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaCtdnp-fQtdOYjkuFvWNAAAAEM"]
[Fri Feb 27 04:30:47.467498 2026] [:error] [pid 42563:tid 42575] [client 185.198.240.137:33473] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 04:30:47.815200 2026] [:error] [pid 42563:tid 42568] [client 185.198.240.137:33473] [client 185.198.240.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaCtd3KL5BclZy73IRGmbwAAAcA"]
[Fri Feb 27 04:30:48.653103 2026] [:error] [pid 42563:tid 42589] [client 185.198.240.141:51431] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Feb 27 04:30:50.374948 2026] [:error] [pid 42563:tid 42589] [client 185.198.240.141:51431] [client 185.198.240.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaCtenKL5BclZy73IRGmmQAAAdM"]
[Fri Feb 27 04:30:51.279223 2026] [:error] [pid 42563:tid 42577] [client 185.198.240.149:27575] [client 185.198.240.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaCte3KL5BclZy73IRGmuQAAAcg"]
[Fri Feb 27 04:30:51.825844 2026] [:error] [pid 3973:tid 3986] [client 185.198.240.154:23929] [client 185.198.240.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaCte4JZsftwqmUaaLP1WgAAAAM"]
[Fri Feb 27 04:30:52.373506 2026] [:error] [pid 42563:tid 42594] [client 209.87.169.175:25505] [client 209.87.169.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaCtfHKL5BclZy73IRGm1wAAAdg"]
[Fri Feb 27 04:30:53.049506 2026] [:error] [pid 42563:tid 42594] [client 173.239.214.2:35165] [client 173.239.214.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaCtfHKL5BclZy73IRGm5QAAAdg"]
[Fri Feb 27 04:30:54.665140 2026] [:error] [pid 42563:tid 42592] [client 185.198.240.150:62473] [client 185.198.240.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaCtfnKL5BclZy73IRGnDwAAAdY"]
[Fri Feb 27 04:30:55.474819 2026] [:error] [pid 3975:tid 4014] [client 173.239.214.20:24095] [client 173.239.214.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaCtfxMVp0-T2hD76b25BwAAAIQ"]
[Fri Feb 27 04:30:57.122322 2026] [:error] [pid 3975:tid 4019] [client 185.198.240.135:27725] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Feb 27 04:30:57.606111 2026] [:error] [pid 3975:tid 4024] [client 185.198.240.135:27725] [client 185.198.240.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aaCtgRMVp0-T2hD76b25EgAAAI4"]
[Fri Feb 27 04:30:58.999478 2026] [:error] [pid 5365:tid 5382] [client 173.239.214.20:29921] [client 173.239.214.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaCtgpYAa8J3tYxdG3z_AQAAAQ8"]
[Fri Feb 27 04:30:59.811019 2026] [:error] [pid 5365:tid 5382] [client 173.239.214.21:49007] [client 173.239.214.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaCtg5YAa8J3tYxdG3z_IgAAAQ8"]
[Fri Feb 27 04:31:00.393702 2026] [:error] [pid 3973:tid 4007] [client 173.239.214.11:27675] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Feb 27 04:31:00.655509 2026] [:error] [pid 3973:tid 4004] [client 173.239.214.11:27675] [client 173.239.214.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaCthIJZsftwqmUaaLP14gAAABU"]
[Fri Feb 27 04:31:01.225987 2026] [:error] [pid 3974:tid 4045] [client 173.239.214.10:52277] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Feb 27 04:31:03.253808 2026] [:error] [pid 3974:tid 4051] [client 173.239.214.10:52277] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Feb 27 04:31:04.190973 2026] [:error] [pid 3974:tid 4038] [client 173.239.214.10:52277] [client 173.239.214.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaCtiHp-fQtdOYjkuFvXFQAAAEI"]
[Fri Feb 27 04:31:04.911588 2026] [:error] [pid 42563:tid 42569] [client 173.239.214.26:25973] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Fri Feb 27 04:31:05.254410 2026] [:error] [pid 42563:tid 42586] [client 173.239.214.26:25973] [client 173.239.214.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaCtiXKL5BclZy73IRGn1AAAAdA"]
[Fri Feb 27 04:31:05.877454 2026] [:error] [pid 5365:tid 5376] [client 185.198.240.141:29445] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Feb 27 04:31:06.478525 2026] [:error] [pid 5365:tid 5376] [client 185.198.240.141:29445] [client 185.198.240.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaCtipYAa8J3tYxdG3z_zQAAAQk"]
[Fri Feb 27 04:31:07.267236 2026] [:error] [pid 21329:tid 21403] [client 173.239.214.16:60673] [client 173.239.214.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaCti5vQWnde-MjcQ1FOvAAAAVQ"]
[Fri Feb 27 04:31:08.154452 2026] [:error] [pid 42563:tid 42580] [client 173.239.214.24:56839] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Fri Feb 27 04:31:08.548336 2026] [:error] [pid 42563:tid 42579] [client 173.239.214.24:56839] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Feb 27 04:31:09.109756 2026] [:error] [pid 42563:tid 42574] [client 173.239.214.24:56839] [client 173.239.214.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaCtjXKL5BclZy73IRGn6gAAAcY"]
[Fri Feb 27 04:31:09.647733 2026] [:error] [pid 3974:tid 4043] [client 173.239.214.14:33871] [client 173.239.214.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aaCtjXp-fQtdOYjkuFvXUAAAAEY"]
[Fri Feb 27 04:31:10.502240 2026] [:error] [pid 42563:tid 42592] [client 185.198.240.143:48351] [client 185.198.240.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaCtjnKL5BclZy73IRGn9AAAAdY"]
[Fri Feb 27 04:31:11.286555 2026] [:error] [pid 5365:tid 5386] [client 185.198.240.135:62593] [client 185.198.240.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaCtj5YAa8J3tYxdG3wAVAAAARM"]
[Fri Feb 27 04:31:11.842134 2026] [:error] [pid 3975:tid 4028] [client 185.198.240.145:41181] [client 185.198.240.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaCtjxMVp0-T2hD76b25ZAAAAJI"]
[Fri Feb 27 04:31:12.340643 2026] [:error] [pid 3974:tid 4054] [client 185.198.240.146:36375] [client 185.198.240.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaCtkHp-fQtdOYjkuFvXYQAAAFE"]
[Fri Feb 27 04:31:14.493847 2026] [:error] [pid 5365:tid 5383] [client 185.198.240.147:34979] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Feb 27 04:31:14.756153 2026] [:error] [pid 5365:tid 5383] [client 185.198.240.147:34979] [client 185.198.240.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaCtkpYAa8J3tYxdG3wAxgAAARA"]
[Fri Feb 27 04:31:16.409091 2026] [:error] [pid 3975:tid 4036] [client 173.239.214.24:63903] [client 173.239.214.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaCtlBMVp0-T2hD76b25gAAAAJc"]
[Fri Feb 27 04:31:16.891663 2026] [:error] [pid 42563:tid 42592] [client 185.198.240.152:56723] [client 185.198.240.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaCtlHKL5BclZy73IRGoIAAAAdY"]
[Fri Feb 27 04:31:18.103063 2026] [:error] [pid 42658:tid 42684] [client 185.198.240.151:40135] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 27 04:31:18.738201 2026] [:error] [pid 42658:tid 42677] [client 185.198.240.151:40135] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Feb 27 04:31:19.902165 2026] [:error] [pid 42658:tid 42667] [client 185.198.240.151:40135] [client 185.198.240.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaCtl4zcoYl3nRbu1jZASAAAAgc"]
[Fri Feb 27 04:31:21.663954 2026] [:error] [pid 21329:tid 21394] [client 185.198.240.140:51965] [client 185.198.240.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.140, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaCtmZvQWnde-MjcQ1FPYgAAAUs"]
[Fri Feb 27 04:31:21.952666 2026] [:error] [pid 21329:tid 21400] [client 185.198.240.140:51965] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 27 04:31:23.451616 2026] [:error] [pid 21329:tid 21384] [client 185.198.240.140:51965] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Feb 27 04:31:23.817201 2026] [:error] [pid 21329:tid 21405] [client 185.198.240.140:51965] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 04:31:25.194912 2026] [:error] [pid 21329:tid 21406] [client 185.198.240.140:51965] [client 185.198.240.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaCtnZvQWnde-MjcQ1FPoQAAAVc"]
[Fri Feb 27 04:31:26.012543 2026] [:error] [pid 4081:tid 4083] [client 185.198.240.153:39261] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Fri Feb 27 04:31:26.267938 2026] [:error] [pid 4081:tid 4091] [client 185.198.240.153:39261] [client 185.198.240.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.153, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaCtng55mnr35z8h7t3ZLQAAAMg"]
[Fri Feb 27 04:31:26.839988 2026] [:error] [pid 4081:tid 4084] [client 185.198.240.153:39261] [client 185.198.240.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aaCtng55mnr35z8h7t3ZMgAAAME"]
[Fri Feb 27 04:31:28.551549 2026] [:error] [pid 4081:tid 4083] [client 173.239.214.8:22887] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 04:31:29.090833 2026] [:error] [pid 4081:tid 4087] [client 173.239.214.8:22887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Fri Feb 27 04:31:29.630834 2026] [:error] [pid 4081:tid 4086] [client 173.239.214.8:22887] [client 173.239.214.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaCtoQ55mnr35z8h7t3ZVwAAAMM"]
[Fri Feb 27 04:31:30.128829 2026] [:error] [pid 42658:tid 42677] [client 209.87.169.175:57785] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 27 04:31:30.938557 2026] [:error] [pid 42658:tid 42674] [client 209.87.169.175:57785] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Fri Feb 27 04:31:31.230688 2026] [:error] [pid 42658:tid 42675] [client 209.87.169.175:57785] [client 209.87.169.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aaCto4zcoYl3nRbu1jZA2gAAAg8"]
[Fri Feb 27 04:31:32.003137 2026] [:error] [pid 21329:tid 21397] [client 185.198.240.151:31891] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Fri Feb 27 04:31:32.662761 2026] [:error] [pid 21329:tid 21384] [client 185.198.240.151:31891] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Feb 27 04:31:32.940142 2026] [:error] [pid 21329:tid 21392] [client 185.198.240.151:31891] [client 185.198.240.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaCtpJvQWnde-MjcQ1FP-AAAAUk"]
[Fri Feb 27 04:31:33.466379 2026] [:error] [pid 42658:tid 42665] [client 173.239.214.25:60369] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Feb 27 04:31:34.047367 2026] [:error] [pid 42658:tid 42680] [client 173.239.214.25:60369] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Feb 27 04:31:34.312075 2026] [:error] [pid 42658:tid 42678] [client 173.239.214.25:60369] [client 173.239.214.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaCtpozcoYl3nRbu1jZBCAAAAhI"]
[Fri Feb 27 04:31:35.179235 2026] [:error] [pid 4081:tid 4094] [client 173.239.214.27:32009] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Feb 27 04:31:35.786652 2026] [:error] [pid 4081:tid 4099] [client 173.239.214.27:32009] [client 173.239.214.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.27, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaCtpw55mnr35z8h7t3ZjwAAANA"]
[Fri Feb 27 04:31:36.159148 2026] [:error] [pid 4081:tid 4096] [client 173.239.214.27:32009] [client 173.239.214.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaCtqA55mnr35z8h7t3ZkAAAAM0"]
[Fri Feb 27 04:31:39.768693 2026] [:error] [pid 21329:tid 21391] [client 45.131.195.208:39767] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Fri Feb 27 04:31:41.609729 2026] [:error] [pid 21329:tid 21404] [client 45.131.195.208:39767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Feb 27 04:31:41.879122 2026] [:error] [pid 21329:tid 21386] [client 45.131.195.208:39767] [client 45.131.195.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaCtrZvQWnde-MjcQ1FQdwAAAUM"]
[Fri Feb 27 04:31:42.428814 2026] [:error] [pid 3974:tid 4048] [client 173.239.214.11:28181] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Feb 27 04:31:43.289241 2026] [:error] [pid 3974:tid 4051] [client 173.239.214.11:28181] [client 173.239.214.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.11, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaCtr3p-fQtdOYjkuFvYJwAAAE4"]
[Fri Feb 27 04:31:43.568231 2026] [:error] [pid 3974:tid 4054] [client 173.239.214.11:28181] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Feb 27 04:31:43.891184 2026] [:error] [pid 3974:tid 4057] [client 173.239.214.11:28181] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Fri Feb 27 04:31:44.158460 2026] [:error] [pid 3974:tid 4049] [client 173.239.214.11:28181] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Fri Feb 27 04:31:44.420307 2026] [:error] [pid 3974:tid 4040] [client 173.239.214.11:28181] [client 173.239.214.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaCtsHp-fQtdOYjkuFvYLQAAAEM"]
[Fri Feb 27 04:31:45.044679 2026] [:error] [pid 5365:tid 5386] [client 185.198.240.146:49005] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Feb 27 04:31:45.296213 2026] [:error] [pid 5365:tid 5372] [client 185.198.240.146:49005] [client 185.198.240.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aaCtsZYAa8J3tYxdG3wDMAAAAQU"]
[Fri Feb 27 04:31:46.192495 2026] [:error] [pid 21329:tid 21392] [client 173.239.214.24:30925] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Feb 27 04:31:46.490306 2026] [:error] [pid 21329:tid 21396] [client 173.239.214.24:30925] [client 173.239.214.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaCtspvQWnde-MjcQ1FQrQAAAU0"]
[Fri Feb 27 04:31:47.904779 2026] [:error] [pid 42658:tid 42660] [client 185.198.240.140:60183] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Fri Feb 27 04:31:48.188487 2026] [:error] [pid 42658:tid 42667] [client 185.198.240.140:60183] [client 185.198.240.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaCttIzcoYl3nRbu1jZBtwAAAgc"]
[Fri Feb 27 04:31:51.725529 2026] [:error] [pid 42658:tid 42675] [client 173.239.214.15:42871] [client 173.239.214.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaCtt4zcoYl3nRbu1jZB4AAAAg8"]
[Fri Feb 27 04:31:52.279025 2026] [:error] [pid 5365:tid 5378] [client 209.87.169.176:58425] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Feb 27 04:31:52.598431 2026] [:error] [pid 5365:tid 5389] [client 209.87.169.176:58425] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Fri Feb 27 04:31:53.784155 2026] [:error] [pid 5365:tid 5374] [client 209.87.169.176:58425] [client 209.87.169.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaCtuZYAa8J3tYxdG3wD7gAAAQc"]
[Fri Feb 27 04:31:54.598693 2026] [:error] [pid 5365:tid 5370] [client 45.131.195.210:62381] [client 45.131.195.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaCtupYAa8J3tYxdG3wEBQAAAQM"]
[Fri Feb 27 04:31:56.261944 2026] [:error] [pid 42563:tid 42581] [client 173.239.214.7:65317] [client 173.239.214.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aaCtvHKL5BclZy73IRGpmgAAAcs"]
[Fri Feb 27 04:31:56.901213 2026] [:error] [pid 5365:tid 5381] [client 173.239.214.11:55573] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Fri Feb 27 04:31:57.438273 2026] [:error] [pid 5365:tid 5372] [client 173.239.214.11:55573] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Feb 27 04:31:57.769950 2026] [:error] [pid 5365:tid 5370] [client 173.239.214.11:55573] [client 173.239.214.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaCtvZYAa8J3tYxdG3wEWgAAAQM"]
[Fri Feb 27 04:31:58.313759 2026] [:error] [pid 42658:tid 42667] [client 173.239.214.15:61489] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 27 04:31:58.926398 2026] [:error] [pid 42658:tid 42668] [client 173.239.214.15:61489] [client 173.239.214.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aaCtvozcoYl3nRbu1jZCRAAAAgg"]
[Fri Feb 27 04:32:05.076660 2026] [:error] [pid 42435:tid 42453] [client 185.198.240.145:51695] [client 185.198.240.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaCtxR5hHLnaukp_y994CAAAAY0"]
[Fri Feb 27 04:32:05.948010 2026] [:error] [pid 42658:tid 42684] [client 185.198.240.150:65163] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Feb 27 04:32:06.816684 2026] [:error] [pid 42658:tid 42673] [client 185.198.240.150:65163] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Fri Feb 27 04:32:07.334554 2026] [:error] [pid 42658:tid 42660] [client 185.198.240.150:65163] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Feb 27 04:32:07.593189 2026] [:error] [pid 42658:tid 42663] [client 185.198.240.150:65163] [client 185.198.240.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaCtx4zcoYl3nRbu1jZCwQAAAgM"]
[Fri Feb 27 04:32:08.130190 2026] [:error] [pid 21329:tid 21384] [client 173.239.214.4:21029] [client 173.239.214.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaCtyJvQWnde-MjcQ1FR8AAAAUE"]
[Fri Feb 27 04:32:08.624535 2026] [:error] [pid 21329:tid 21407] [client 173.239.214.5:36275] [client 173.239.214.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaCtyJvQWnde-MjcQ1FR9wAAAVg"]
[Fri Feb 27 04:32:09.132314 2026] [:error] [pid 5365:tid 5383] [client 185.198.240.141:48325] [client 185.198.240.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaCtyZYAa8J3tYxdG3wFNQAAARA"]
[Fri Feb 27 04:32:37.909470 2026] [:error] [pid 3973:tid 3995] [client 185.198.240.144:21441] [client 185.198.240.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/meta/"] [unique_id "aaCt5YJZsftwqmUaaLP4NQAAAAw"]
[Fri Feb 27 05:08:54.303109 2026] [:error] [pid 5365:tid 5387] [client 20.104.78.143:18537] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 05:08:54.512453 2026] [:error] [pid 5365:tid 5369] [client 20.104.78.143:18537] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 05:08:54.961339 2026] [:error] [pid 5365:tid 5391] [client 20.104.78.143:18537] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 27 05:08:55.172306 2026] [:error] [pid 5365:tid 5378] [client 20.104.78.143:18537] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 05:08:55.629374 2026] [:error] [pid 5365:tid 5385] [client 20.104.78.143:18537] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 27 05:08:55.839663 2026] [:error] [pid 5365:tid 5373] [client 20.104.78.143:18537] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 05:08:56.048950 2026] [:error] [pid 5365:tid 5372] [client 20.104.78.143:18537] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Feb 27 05:08:56.476286 2026] [:error] [pid 5365:tid 5390] [client 20.104.78.143:18537] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaC2aJYAa8J3tYxdG3wwlAAAARc"]
[Fri Feb 27 05:08:57.365469 2026] [:error] [pid 42658:tid 42677] [client 20.104.78.143:18516] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaC2aYzcoYl3nRbu1jZltwAAAhE"]
[Fri Feb 27 05:08:58.256039 2026] [:error] [pid 42435:tid 42454] [client 20.104.78.143:18524] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaC2ah5hHLnaukp_y9-IXgAAAY4"]
[Fri Feb 27 05:08:59.109574 2026] [:error] [pid 42658:tid 42660] [client 20.104.78.143:18498] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaC2a4zcoYl3nRbu1jZlvgAAAgA"]
[Fri Feb 27 05:20:09.588960 2026] [:error] [pid 5365:tid 5385] [client 103.253.27.75:52254] [client 103.253.27.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.253.27.75, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaC5CZYAa8J3tYxdG3w1vgAAARI"]
[Fri Feb 27 05:20:09.592967 2026] [:error] [pid 5365:tid 5385] [client 103.253.27.75:52254] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 05:20:11.100774 2026] [:error] [pid 5365:tid 5383] [client 103.253.27.75:52254] [client 103.253.27.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaC5C5YAa8J3tYxdG3w1yQAAARA"]
[Fri Feb 27 05:20:11.744514 2026] [:error] [pid 42435:tid 42448] [client 103.253.27.75:53398] [client 103.253.27.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaC5Cx5hHLnaukp_y9-LIwAAAYg"]
[Fri Feb 27 05:20:12.155499 2026] [:error] [pid 4081:tid 4099] [client 103.253.27.75:53550] [client 103.253.27.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaC5DA55mnr35z8h7t3jYwAAANA"]
[Fri Feb 27 05:20:12.330821 2026] [:error] [pid 3974:tid 4042] [client 103.253.27.75:53659] [client 103.253.27.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaC5DHp-fQtdOYjkuFveMwAAAEU"]
[Fri Feb 27 05:31:11.472930 2026] [:error] [pid 3975:tid 4032] [client 20.219.8.79:4615] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Feb 27 05:31:11.919793 2026] [:error] [pid 3975:tid 4025] [client 20.219.8.79:4615] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Fri Feb 27 05:31:12.261769 2026] [:error] [pid 3975:tid 4029] [client 20.219.8.79:4615] [client 20.219.8.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/"] [unique_id "aaC7oBMVp0-T2hD76b3AAwAAAJM"]
[Fri Feb 27 05:31:12.882565 2026] [:error] [pid 42658:tid 42675] [client 20.219.8.79:4669] [client 20.219.8.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/"] [unique_id "aaC7oIzcoYl3nRbu1jZtSAAAAg8"]
[Fri Feb 27 05:31:13.478194 2026] [:error] [pid 21329:tid 21385] [client 20.219.8.79:2311] [client 20.219.8.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/"] [unique_id "aaC7oZvQWnde-MjcQ1FgrgAAAUI"]
[Fri Feb 27 05:31:14.080532 2026] [:error] [pid 42658:tid 42668] [client 20.219.8.79:4660] [client 20.219.8.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/"] [unique_id "aaC7oozcoYl3nRbu1jZtSQAAAgg"]
[Fri Feb 27 05:46:33.552460 2026] [:error] [pid 5365:tid 5391] [client 20.220.165.49:44125] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 07:06:44.857894 2026] [:error] [pid 5365:tid 5377] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 07:06:45.069845 2026] [:error] [pid 5365:tid 5389] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 07:06:45.284420 2026] [:error] [pid 5365:tid 5368] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 07:06:45.496301 2026] [:error] [pid 5365:tid 5369] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 07:06:45.708938 2026] [:error] [pid 5365:tid 5367] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 07:06:45.926930 2026] [:error] [pid 5365:tid 5379] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 07:06:46.352377 2026] [:error] [pid 5365:tid 5373] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 27 07:06:46.565877 2026] [:error] [pid 5365:tid 5384] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Feb 27 07:06:46.779437 2026] [:error] [pid 5365:tid 5387] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 07:06:46.993527 2026] [:error] [pid 5365:tid 5380] [client 20.104.78.143:19237] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 07:06:47.222448 2026] [:error] [pid 5365:tid 5391] [client 20.104.78.143:19237] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaDSB5YAa8J3tYxdG3x1nQAAARg"]
[Fri Feb 27 07:06:48.091350 2026] [:error] [pid 4081:tid 4084] [client 20.104.78.143:18441] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaDSCA55mnr35z8h7t3w1AAAAME"]
[Fri Feb 27 07:06:48.944153 2026] [:error] [pid 5365:tid 5381] [client 20.104.78.143:19233] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaDSCJYAa8J3tYxdG3x1pgAAAQ4"]
[Fri Feb 27 07:06:49.781232 2026] [:error] [pid 42435:tid 42464] [client 20.104.78.143:18451] [client 20.104.78.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaDSCR5hHLnaukp_y9-iIgAAAZg"]
[Fri Feb 27 09:33:15.224714 2026] [:error] [pid 56075:tid 56084] [client 40.80.89.74:4586] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 09:33:15.368260 2026] [:error] [pid 56075:tid 56088] [client 40.80.89.74:4586] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 09:33:15.664125 2026] [:error] [pid 56075:tid 56092] [client 40.80.89.74:4586] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 27 09:33:15.806774 2026] [:error] [pid 56075:tid 56091] [client 40.80.89.74:4586] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 09:33:16.091853 2026] [:error] [pid 56075:tid 56081] [client 40.80.89.74:4586] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 27 09:33:16.234989 2026] [:error] [pid 56075:tid 56099] [client 40.80.89.74:4586] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 09:33:16.378402 2026] [:error] [pid 56075:tid 56079] [client 40.80.89.74:4586] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Feb 27 09:33:16.674019 2026] [:error] [pid 56075:tid 56077] [client 40.80.89.74:4586] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaD0XMKBhrfI6KNv9RgxaAAAAAA"]
[Fri Feb 27 09:33:17.277705 2026] [:error] [pid 62998:tid 63018] [client 40.80.89.74:4362] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaD0XVQeueXZDUmoLonhKAAAARA"]
[Fri Feb 27 09:33:17.853858 2026] [:error] [pid 54103:tid 54172] [client 40.80.89.74:4545] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaD0XevG4MPCmE0B2sD7TQAAAME"]
[Fri Feb 27 09:33:18.426285 2026] [:error] [pid 54231:tid 54252] [client 40.80.89.74:4400] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaD0XuTvb5AeyJCdY7A0nQAAAFI"]
[Fri Feb 27 10:12:56.938894 2026] [:error] [pid 62998:tid 63011] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Feb 27 10:12:57.095695 2026] [:error] [pid 62998:tid 63021] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 27 10:12:57.264873 2026] [:error] [pid 62998:tid 63023] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 10:12:57.424768 2026] [:error] [pid 62998:tid 63007] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 10:12:57.578115 2026] [:error] [pid 62998:tid 63024] [client 20.89.254.160:1653] [client 20.89.254.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.89.254.160, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaD9qVQeueXZDUmoLokESQAAARY"]
[Fri Feb 27 10:12:57.582195 2026] [:error] [pid 62998:tid 63024] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 10:12:57.746201 2026] [:error] [pid 62998:tid 63019] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 10:12:57.903218 2026] [:error] [pid 62998:tid 63004] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 10:12:58.066083 2026] [:error] [pid 62998:tid 63001] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Fri Feb 27 10:12:58.222605 2026] [:error] [pid 62998:tid 63005] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 10:12:58.380383 2026] [:error] [pid 62998:tid 63014] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Fri Feb 27 10:12:59.880631 2026] [:error] [pid 62998:tid 63008] [client 20.89.254.160:1653] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 27 10:13:00.060008 2026] [:error] [pid 62998:tid 63017] [client 20.89.254.160:1653] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaD9rFQeueXZDUmoLokEUAAAAQ8"]
[Fri Feb 27 10:13:00.553537 2026] [:error] [pid 56075:tid 56083] [client 20.89.254.160:15412] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaD9rMKBhrfI6KNv9RhJ1wAAAAY"]
[Fri Feb 27 10:13:01.176618 2026] [:error] [pid 54102:tid 54152] [client 20.89.254.160:1609] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaD9rXi74D4fiYUm_GfnBAAAAIg"]
[Fri Feb 27 10:13:01.677291 2026] [:error] [pid 54101:tid 54125] [client 20.89.254.160:15393] [client 20.89.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaD9rVY5qgRktcYTGFvJjAAAAdE"]
[Fri Feb 27 10:28:49.620280 2026] [:error] [pid 54231:tid 54235] [client 20.48.233.148:24316] [client 20.48.233.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaEBYeTvb5AeyJCdY7BLKQAAAEE"]
[Fri Feb 27 10:28:50.731418 2026] [:error] [pid 54231:tid 54254] [client 20.48.233.148:59971] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Feb 27 10:28:50.941976 2026] [:error] [pid 54231:tid 54241] [client 20.48.233.148:59971] File does not exist: /usr/local/apache/htdocs/suspended-page/depotcv.php
[Fri Feb 27 10:28:51.151921 2026] [:error] [pid 54231:tid 54258] [client 20.48.233.148:59971] File does not exist: /usr/local/apache/htdocs/suspended-page/google.php
[Fri Feb 27 10:28:51.453671 2026] [:error] [pid 54231:tid 54236] [client 20.48.233.148:59971] File does not exist: /usr/local/apache/htdocs/suspended-page/fi2.php
[Fri Feb 27 10:28:51.663947 2026] [:error] [pid 54231:tid 54245] [client 20.48.233.148:59971] File does not exist: /usr/local/apache/htdocs/suspended-page/n.php
[Fri Feb 27 10:28:51.907011 2026] [:error] [pid 54231:tid 54238] [client 20.48.233.148:59971] File does not exist: /usr/local/apache/htdocs/suspended-page/colors.php
[Fri Feb 27 10:28:52.112157 2026] [:error] [pid 54231:tid 54255] [client 20.48.233.148:59971] [client 20.48.233.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaEBZOTvb5AeyJCdY7BLMgAAAFU"]
[Fri Feb 27 10:28:54.173057 2026] [:error] [pid 54102:tid 54147] [client 20.48.233.148:24268] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwsi.php
[Fri Feb 27 10:28:54.640446 2026] [:error] [pid 54102:tid 54168] [client 20.48.233.148:24268] [client 20.48.233.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aaEBZni74D4fiYUm_GfpvQAAAJc"]
[Fri Feb 27 10:28:56.019841 2026] [:error] [pid 54103:tid 54175] [client 20.48.233.148:59969] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Fri Feb 27 10:28:56.438364 2026] [:error] [pid 54103:tid 54177] [client 20.48.233.148:59969] File does not exist: /usr/local/apache/htdocs/suspended-page/contact_tpl.php
[Fri Feb 27 10:28:56.684640 2026] [:error] [pid 54103:tid 54192] [client 20.48.233.148:59969] [client 20.48.233.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MYK4TJEfFvO.php"] [unique_id "aaEBaOvG4MPCmE0B2sAK6AAAANU"]
[Fri Feb 27 10:28:58.616356 2026] [:error] [pid 62998:tid 63025] [client 20.48.233.148:56382] [client 20.48.233.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MYK4TJEfFvO.php"] [unique_id "aaEBalQeueXZDUmoLokRDAAAARc"]
[Fri Feb 27 10:29:00.064707 2026] [:error] [pid 54101:tid 54115] [client 20.48.233.148:56324] [client 20.48.233.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MYK4TJEfFvO.php"] [unique_id "aaEBbFY5qgRktcYTGFvLdAAAAcc"]
[Fri Feb 27 10:29:02.136811 2026] [:error] [pid 54231:tid 54237] [client 20.48.233.148:56346] [client 20.48.233.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MYK4TJEfFvO.php"] [unique_id "aaEBbuTvb5AeyJCdY7BLRAAAAEM"]
[Fri Feb 27 10:32:12.109301 2026] [:error] [pid 56075:tid 56079] [client 145.239.10.137:40666] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php, referer: http://aoswa.com.au/k.php
[Fri Feb 27 11:15:05.177469 2026] [:error] [pid 54102:tid 54168] [client 64.64.108.34:38687] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Feb 27 11:15:06.347370 2026] [:error] [pid 54102:tid 54166] [client 64.64.108.34:38687] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 11:15:06.954672 2026] [:error] [pid 54102:tid 54146] [client 64.64.108.34:38687] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 27 11:15:07.440615 2026] [:error] [pid 54102:tid 54161] [client 64.64.108.34:38687] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Feb 27 11:15:07.921750 2026] [:error] [pid 54102:tid 54164] [client 64.64.108.34:38687] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Feb 27 11:15:08.359651 2026] [:error] [pid 54102:tid 54154] [client 64.64.108.34:38687] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Feb 27 11:15:08.835653 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.34:38687] [client 64.64.108.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aaEMPHi74D4fiYUm_GcQHwAAAJA"]
[Fri Feb 27 11:15:09.867340 2026] [:error] [pid 56075:tid 56078] [client 64.64.108.44:29977] [client 64.64.108.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aaEMPcKBhrfI6KNv9RiLSgAAAAE"]
[Fri Feb 27 11:15:10.810831 2026] [:error] [pid 56075:tid 56095] [client 64.64.108.27:20297] [client 64.64.108.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aaEMPsKBhrfI6KNv9RiLTQAAABE"]
[Fri Feb 27 11:15:12.561099 2026] [:error] [pid 56075:tid 56091] [client 64.64.108.40:39435] [client 64.64.108.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaEMQMKBhrfI6KNv9RiLYQAAAA0"]
[Fri Feb 27 11:15:13.673410 2026] [:error] [pid 62998:tid 63025] [client 64.64.108.23:56363] [client 64.64.108.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaEMQVQeueXZDUmoLolpuAAAARc"]
[Fri Feb 27 11:15:15.855595 2026] [:error] [pid 62998:tid 63005] [client 64.64.108.31:35743] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Feb 27 11:15:17.545275 2026] [:error] [pid 62998:tid 63010] [client 64.64.108.31:35743] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 27 11:15:18.054481 2026] [:error] [pid 62998:tid 63018] [client 64.64.108.31:35743] [client 64.64.108.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaEMRlQeueXZDUmoLolqDgAAARA"]
[Fri Feb 27 11:15:19.293429 2026] [:error] [pid 56075:tid 56083] [client 64.64.108.33:56691] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaEMR8KBhrfI6KNv9RiLkgAAAAY"]
[Fri Feb 27 11:15:21.062583 2026] [:error] [pid 54102:tid 54149] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Fri Feb 27 11:15:21.945208 2026] [:error] [pid 54102:tid 54145] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Fri Feb 27 11:15:22.388704 2026] [:error] [pid 54102:tid 54165] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Feb 27 11:15:23.135847 2026] [:error] [pid 54102:tid 54152] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Feb 27 11:15:23.851047 2026] [:error] [pid 54102:tid 54154] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Fri Feb 27 11:15:24.341660 2026] [:error] [pid 54102:tid 54164] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Fri Feb 27 11:15:24.834148 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Fri Feb 27 11:15:25.336454 2026] [:error] [pid 54102:tid 54152] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Feb 27 11:15:25.846600 2026] [:error] [pid 54102:tid 54158] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Fri Feb 27 11:15:26.251803 2026] [:error] [pid 54102:tid 54161] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Feb 27 11:15:26.657379 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Fri Feb 27 11:15:27.258798 2026] [:error] [pid 54102:tid 54144] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 27 11:15:27.844115 2026] [:error] [pid 54102:tid 54169] [client 64.64.108.23:39809] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Feb 27 11:15:28.542697 2026] [:error] [pid 54102:tid 54147] [client 64.64.108.23:39809] [client 64.64.108.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-activate.php"] [unique_id "aaEMUHi74D4fiYUm_GcQvgAAAIM"]
[Fri Feb 27 11:15:29.678955 2026] [:error] [pid 56075:tid 56091] [client 64.64.108.33:31811] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Fri Feb 27 11:15:30.244240 2026] [:error] [pid 56075:tid 56087] [client 64.64.108.33:31811] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Fri Feb 27 11:15:30.758935 2026] [:error] [pid 56075:tid 56088] [client 64.64.108.33:31811] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Feb 27 11:15:31.293713 2026] [:error] [pid 56075:tid 56088] [client 64.64.108.33:31811] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Fri Feb 27 11:15:32.640910 2026] [:error] [pid 56075:tid 56093] [client 64.64.108.33:31811] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Feb 27 11:15:33.266247 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.33:31811] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Fri Feb 27 11:15:33.765655 2026] [:error] [pid 56075:tid 56099] [client 64.64.108.33:31811] [client 64.64.108.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaEMVcKBhrfI6KNv9RiMRgAAABU"]
[Fri Feb 27 11:15:34.786654 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Feb 27 11:15:35.354922 2026] [:error] [pid 54102:tid 54153] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Fri Feb 27 11:15:35.842369 2026] [:error] [pid 54102:tid 54147] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 11:15:36.490852 2026] [:error] [pid 54102:tid 54165] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Fri Feb 27 11:15:37.082894 2026] [:error] [pid 54102:tid 54166] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Feb 27 11:15:37.560637 2026] [:error] [pid 54102:tid 54146] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Feb 27 11:15:38.043403 2026] [:error] [pid 54102:tid 54147] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Fri Feb 27 11:15:38.575965 2026] [:error] [pid 54102:tid 54165] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Feb 27 11:15:39.067074 2026] [:error] [pid 54102:tid 54166] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Fri Feb 27 11:15:39.736081 2026] [:error] [pid 54102:tid 54153] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Fri Feb 27 11:15:40.235030 2026] [:error] [pid 54102:tid 54158] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Fri Feb 27 11:15:40.742306 2026] [:error] [pid 54102:tid 54165] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Fri Feb 27 11:15:41.346076 2026] [:error] [pid 54102:tid 54169] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Fri Feb 27 11:15:41.857877 2026] [:error] [pid 54102:tid 54153] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 27 11:15:42.348172 2026] [:error] [pid 54102:tid 54154] [client 64.64.108.42:22837] [client 64.64.108.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.42, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaEMXni74D4fiYUm_GcRKgAAAIo"]
[Fri Feb 27 11:15:42.351767 2026] [:error] [pid 54102:tid 54154] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 27 11:15:43.544367 2026] [:error] [pid 54102:tid 54162] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Fri Feb 27 11:15:44.035667 2026] [:error] [pid 54102:tid 54166] [client 64.64.108.42:22837] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Fri Feb 27 11:15:44.466757 2026] [:error] [pid 54102:tid 54158] [client 64.64.108.42:22837] [client 64.64.108.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aaEMYHi74D4fiYUm_GcROQAAAI4"]
[Fri Feb 27 11:15:45.594543 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Fri Feb 27 11:15:46.138486 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Fri Feb 27 11:15:47.150234 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Fri Feb 27 11:15:47.650949 2026] [:error] [pid 52073:tid 52082] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Fri Feb 27 11:15:48.140579 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Fri Feb 27 11:15:48.657566 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Fri Feb 27 11:15:49.159255 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Fri Feb 27 11:15:49.737956 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Fri Feb 27 11:15:50.348890 2026] [:error] [pid 52073:tid 52076] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Fri Feb 27 11:15:50.854933 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Fri Feb 27 11:15:51.348244 2026] [:error] [pid 52073:tid 52090] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Fri Feb 27 11:15:53.545752 2026] [:error] [pid 52073:tid 52093] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Fri Feb 27 11:15:54.053160 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Fri Feb 27 11:15:54.545919 2026] [:error] [pid 52073:tid 52081] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Fri Feb 27 11:15:56.240178 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Fri Feb 27 11:15:56.660466 2026] [:error] [pid 52073:tid 52093] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Fri Feb 27 11:15:57.070830 2026] [:error] [pid 52073:tid 52091] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Fri Feb 27 11:15:57.650057 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Fri Feb 27 11:15:58.644968 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Fri Feb 27 11:15:59.061348 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Fri Feb 27 11:15:59.463137 2026] [:error] [pid 52073:tid 52086] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Fri Feb 27 11:16:00.647042 2026] [:error] [pid 52073:tid 52086] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Fri Feb 27 11:16:01.160010 2026] [:error] [pid 52073:tid 52083] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Fri Feb 27 11:16:02.265646 2026] [:error] [pid 52073:tid 52081] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Fri Feb 27 11:16:02.851765 2026] [:error] [pid 52073:tid 52082] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Fri Feb 27 11:16:03.443243 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Fri Feb 27 11:16:04.020015 2026] [:error] [pid 52073:tid 52085] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Fri Feb 27 11:16:04.537468 2026] [:error] [pid 52073:tid 52090] [client 64.64.108.62:40609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Fri Feb 27 11:16:05.754084 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.62:40609] [client 64.64.108.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/lx.php"] [unique_id "aaEMdYa650YPyxXVeRZtVQAAAZM"]
[Fri Feb 27 11:16:09.058199 2026] [:error] [pid 52073:tid 52091] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Fri Feb 27 11:16:09.540723 2026] [:error] [pid 52073:tid 52099] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Fri Feb 27 11:16:10.068017 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Fri Feb 27 11:16:10.561158 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Fri Feb 27 11:16:11.139170 2026] [:error] [pid 52073:tid 52088] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Fri Feb 27 11:16:11.793888 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Fri Feb 27 11:16:12.252628 2026] [:error] [pid 52073:tid 52097] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Fri Feb 27 11:16:12.988598 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Fri Feb 27 11:16:13.484759 2026] [:error] [pid 52073:tid 52080] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Fri Feb 27 11:16:14.023650 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Fri Feb 27 11:16:17.738838 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 27 11:16:18.965082 2026] [:error] [pid 52073:tid 52097] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Fri Feb 27 11:16:19.575194 2026] [:error] [pid 52073:tid 52085] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Fri Feb 27 11:16:20.099103 2026] [:error] [pid 52073:tid 52082] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Fri Feb 27 11:16:20.643613 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Fri Feb 27 11:16:21.143617 2026] [:error] [pid 52073:tid 52085] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Fri Feb 27 11:16:21.643709 2026] [:error] [pid 52073:tid 52085] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Fri Feb 27 11:16:22.749922 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Fri Feb 27 11:16:23.242203 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Fri Feb 27 11:16:23.737995 2026] [:error] [pid 52073:tid 52082] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Fri Feb 27 11:16:24.270293 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Fri Feb 27 11:16:24.855879 2026] [:error] [pid 52073:tid 52088] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Feb 27 11:16:25.448695 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Fri Feb 27 11:16:25.932613 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Fri Feb 27 11:16:26.386692 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Fri Feb 27 11:16:26.940841 2026] [:error] [pid 52073:tid 52082] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Feb 27 11:16:27.678929 2026] [:error] [pid 52073:tid 52082] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Fri Feb 27 11:16:28.250546 2026] [:error] [pid 52073:tid 52097] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Feb 27 11:16:28.678419 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Fri Feb 27 11:16:29.737958 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Fri Feb 27 11:16:30.253271 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Fri Feb 27 11:16:30.942401 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Fri Feb 27 11:16:31.945574 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Fri Feb 27 11:16:35.740956 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Feb 27 11:16:36.268555 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Fri Feb 27 11:16:36.838857 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Fri Feb 27 11:16:37.356682 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.45:61863] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Fri Feb 27 11:16:37.751362 2026] [:error] [pid 52073:tid 52079] [client 64.64.108.45:61863] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaEMlYa650YPyxXVeRZujQAAAYM"]
[Fri Feb 27 11:16:38.679030 2026] [:error] [pid 49306:tid 49331] [client 64.64.108.45:20841] [client 64.64.108.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.64.108.45, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaEMlvnSUDZue59Px9t3VQAAAVc"]
[Fri Feb 27 11:16:38.683940 2026] [:error] [pid 49306:tid 49331] [client 64.64.108.45:20841] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 11:16:39.254231 2026] [:error] [pid 49306:tid 49320] [client 64.64.108.45:20841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Fri Feb 27 11:16:40.337308 2026] [:error] [pid 49306:tid 49317] [client 64.64.108.45:20841] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaEMmPnSUDZue59Px9t3awAAAUk"]
[Fri Feb 27 11:16:41.601924 2026] [:error] [pid 62998:tid 63021] [client 64.64.108.52:27659] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Fri Feb 27 11:16:44.351710 2026] [:error] [pid 62998:tid 63013] [client 64.64.108.52:27659] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Feb 27 11:16:45.453381 2026] [:error] [pid 62998:tid 63024] [client 64.64.108.52:27659] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Feb 27 11:16:45.956679 2026] [:error] [pid 62998:tid 63014] [client 64.64.108.52:27659] [client 64.64.108.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaEMnVQeueXZDUmoLolwtgAAAQw"]
[Fri Feb 27 11:16:48.106308 2026] [:error] [pid 52073:tid 52077] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Fri Feb 27 11:16:48.657138 2026] [:error] [pid 52073:tid 52099] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Fri Feb 27 11:16:49.248690 2026] [:error] [pid 52073:tid 52079] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Fri Feb 27 11:16:51.452664 2026] [:error] [pid 52073:tid 52094] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Fri Feb 27 11:16:51.959798 2026] [:error] [pid 52073:tid 52096] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Feb 27 11:16:52.565882 2026] [:error] [pid 52073:tid 52076] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Feb 27 11:16:53.073779 2026] [:error] [pid 52073:tid 52094] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Fri Feb 27 11:16:55.355318 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.24:21779] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Feb 27 11:16:56.351938 2026] [:error] [pid 52073:tid 52079] [client 64.64.108.24:21779] [client 64.64.108.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaEMqIa650YPyxXVeRZvYQAAAYM"]
[Fri Feb 27 11:16:57.483974 2026] [:error] [pid 62998:tid 63013] [client 64.64.108.44:23315] [client 64.64.108.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaEMqVQeueXZDUmoLolxRwAAAQs"]
[Fri Feb 27 11:16:58.589039 2026] [:error] [pid 54102:tid 54152] [client 64.64.108.37:24847] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaEMqni74D4fiYUm_GcUBAAAAIg"]
[Fri Feb 27 11:16:59.583464 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.36:23441] [client 64.64.108.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaEMq3i74D4fiYUm_GcUEgAAAJA"]
[Fri Feb 27 11:17:00.578508 2026] [:error] [pid 56075:tid 56077] [client 64.64.108.41:28051] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Fri Feb 27 11:17:01.251137 2026] [:error] [pid 56075:tid 56102] [client 64.64.108.41:28051] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Fri Feb 27 11:17:02.787001 2026] [:error] [pid 56075:tid 56091] [client 64.64.108.41:28051] [client 64.64.108.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.41, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aaEMrsKBhrfI6KNv9RiPgQAAAA0"]
[Fri Feb 27 11:17:06.863557 2026] [:error] [pid 56075:tid 56096] [client 64.64.108.41:28051] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Feb 27 11:17:07.850667 2026] [:error] [pid 56075:tid 56086] [client 64.64.108.41:28051] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Feb 27 11:17:10.935690 2026] [:error] [pid 56075:tid 56090] [client 64.64.108.41:28051] [client 64.64.108.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaEMtsKBhrfI6KNv9RiP4AAAAAw"]
[Fri Feb 27 11:17:12.079546 2026] [:error] [pid 52073:tid 52087] [client 64.64.108.31:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Fri Feb 27 11:17:13.736262 2026] [:error] [pid 52073:tid 52090] [client 64.64.108.31:44321] [client 64.64.108.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.31, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaEMuYa650YPyxXVeRZwMgAAAY4"]
[Fri Feb 27 11:17:14.347409 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.31:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Fri Feb 27 11:17:16.248731 2026] [:error] [pid 52073:tid 52081] [client 64.64.108.31:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Feb 27 11:17:16.760221 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.31:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Fri Feb 27 11:17:17.742487 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.31:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Feb 27 11:17:18.241099 2026] [:error] [pid 52073:tid 52093] [client 64.64.108.31:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Feb 27 11:17:18.735368 2026] [:error] [pid 52073:tid 52090] [client 64.64.108.31:44321] [client 64.64.108.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aaEMvoa650YPyxXVeRZwdQAAAY4"]
[Fri Feb 27 11:17:19.770216 2026] [:error] [pid 56075:tid 56092] [client 64.64.108.54:40837] [client 64.64.108.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aaEMv8KBhrfI6KNv9RiQPgAAAA4"]
[Fri Feb 27 11:17:20.798551 2026] [:error] [pid 49306:tid 49320] [client 64.64.108.50:24623] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Fri Feb 27 11:17:21.255368 2026] [:error] [pid 49306:tid 49329] [client 64.64.108.50:24623] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Fri Feb 27 11:17:21.757070 2026] [:error] [pid 49306:tid 49331] [client 64.64.108.50:24623] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Feb 27 11:17:23.858727 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.50:24623] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Fri Feb 27 11:17:29.636995 2026] [:error] [pid 49306:tid 49308] [client 64.64.108.50:24623] [client 64.64.108.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaEMyfnSUDZue59Px9t6WgAAAUA"]
[Fri Feb 27 11:17:30.700265 2026] [:error] [pid 49306:tid 49324] [client 64.64.108.45:63215] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Feb 27 11:17:31.260121 2026] [:error] [pid 49306:tid 49332] [client 64.64.108.45:63215] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Fri Feb 27 11:17:32.340300 2026] [:error] [pid 49306:tid 49308] [client 64.64.108.45:63215] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaEMzPnSUDZue59Px9t6hAAAAUA"]
[Fri Feb 27 11:17:35.467939 2026] [:error] [pid 54102:tid 54166] [client 64.64.108.43:37037] [client 64.64.108.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bak.php"] [unique_id "aaEMz3i74D4fiYUm_GcVWgAAAJY"]
[Fri Feb 27 11:17:36.626257 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.42:37783] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Feb 27 11:17:37.150981 2026] [:error] [pid 49306:tid 49313] [client 64.64.108.42:37783] [client 64.64.108.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaEM0fnSUDZue59Px9t62QAAAUU"]
[Fri Feb 27 11:17:39.305193 2026] [:error] [pid 56075:tid 56096] [client 64.64.108.37:49187] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Fri Feb 27 11:17:40.438790 2026] [:error] [pid 56075:tid 56080] [client 64.64.108.37:49187] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Feb 27 11:17:41.543349 2026] [:error] [pid 56075:tid 56080] [client 64.64.108.37:49187] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaEM1cKBhrfI6KNv9RiRQwAAAAM"]
[Fri Feb 27 11:17:42.490461 2026] [:error] [pid 62998:tid 63020] [client 64.64.108.24:45803] [client 64.64.108.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaEM1lQeueXZDUmoLolzHwAAARI"]
[Fri Feb 27 11:17:43.670678 2026] [:error] [pid 54102:tid 54148] [client 64.64.108.57:31667] [client 64.64.108.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.57, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aaEM13i74D4fiYUm_GcVjwAAAIQ"]
[Fri Feb 27 11:17:44.234588 2026] [:error] [pid 54102:tid 54161] [client 64.64.108.57:31667] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Fri Feb 27 11:17:45.242176 2026] [:error] [pid 54102:tid 54166] [client 64.64.108.57:31667] [client 64.64.108.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/themes.php"] [unique_id "aaEM2Xi74D4fiYUm_GcVnQAAAJY"]
[Fri Feb 27 11:17:46.093682 2026] [:error] [pid 62998:tid 63018] [client 64.64.108.16:64433] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 27 11:17:48.260321 2026] [:error] [pid 49306:tid 49315] [client 64.64.108.42:47427] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Fri Feb 27 11:17:50.192888 2026] [:error] [pid 49306:tid 49324] [client 64.64.108.42:47427] [client 64.64.108.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aaEM3vnSUDZue59Px9t72wAAAVA"]
[Fri Feb 27 11:17:51.378770 2026] [:error] [pid 54101:tid 54127] [client 64.64.108.60:29057] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Feb 27 11:17:52.346257 2026] [:error] [pid 54101:tid 54108] [client 64.64.108.60:29057] [client 64.64.108.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aaEM4FY5qgRktcYTGFvztgAAAcA"]
[Fri Feb 27 11:17:54.155864 2026] [:error] [pid 52073:tid 52080] [client 64.64.108.22:46973] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Fri Feb 27 11:17:54.844861 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.22:46973] [client 64.64.108.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aaEM4oa650YPyxXVeRZyZwAAAZM"]
[Fri Feb 27 11:17:57.182573 2026] [:error] [pid 49306:tid 49310] [client 64.64.108.55:27951] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Fri Feb 27 11:17:58.749058 2026] [:error] [pid 49306:tid 49315] [client 64.64.108.55:27951] [client 64.64.108.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.55, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aaEM5vnSUDZue59Px9t8ZgAAAUc"]
[Fri Feb 27 11:18:01.436177 2026] [:error] [pid 49306:tid 49324] [client 64.64.108.55:27951] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aaEM6fnSUDZue59Px9t8kAAAAVA"]
[Fri Feb 27 11:18:02.474638 2026] [:error] [pid 54102:tid 54144] [client 64.64.108.64:58503] [client 64.64.108.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaEM6ni74D4fiYUm_GcV9AAAAIA"]
[Fri Feb 27 11:18:04.265432 2026] [:error] [pid 54231:tid 54255] [client 64.64.108.62:38001] [client 64.64.108.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/autoload_classmap.php"] [unique_id "aaEM7OTvb5AeyJCdY7B--wAAAFU"]
[Fri Feb 27 11:18:06.451846 2026] [:error] [pid 54231:tid 54252] [client 64.64.108.65:51259] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Fri Feb 27 11:18:07.970408 2026] [:error] [pid 54231:tid 54251] [client 64.64.108.65:51259] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Fri Feb 27 11:18:08.860297 2026] [:error] [pid 54231:tid 54254] [client 64.64.108.65:51259] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Feb 27 11:18:09.448665 2026] [:error] [pid 54231:tid 54256] [client 64.64.108.65:51259] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Fri Feb 27 11:18:10.455532 2026] [:error] [pid 54231:tid 54247] [client 64.64.108.65:51259] [client 64.64.108.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaEM8uTvb5AeyJCdY7B_TgAAAE0"]
[Fri Feb 27 11:18:12.455357 2026] [:error] [pid 54231:tid 54240] [client 64.64.108.52:48981] [client 64.64.108.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaEM9OTvb5AeyJCdY7B_ZQAAAEY"]
[Fri Feb 27 11:18:13.412824 2026] [:error] [pid 54101:tid 54131] [client 64.64.108.55:53327] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aaEM9VY5qgRktcYTGFv0NQAAAdc"]
[Fri Feb 27 11:18:14.277341 2026] [:error] [pid 62998:tid 63021] [client 64.64.108.27:60161] [client 64.64.108.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aaEM9lQeueXZDUmoLol0fQAAARM"]
[Fri Feb 27 11:18:15.282631 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.48:63947] [client 64.64.108.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaEM9_nSUDZue59Px9t9ZgAAAVY"]
[Fri Feb 27 11:18:18.739717 2026] [:error] [pid 54101:tid 54109] [client 64.64.108.30:31519] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Fri Feb 27 11:18:19.345826 2026] [:error] [pid 54101:tid 54121] [client 64.64.108.30:31519] [client 64.64.108.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aaEM-1Y5qgRktcYTGFv0XwAAAc0"]
[Fri Feb 27 11:18:20.885093 2026] [:error] [pid 62998:tid 63010] [client 64.64.108.36:57381] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Feb 27 11:18:21.493688 2026] [:error] [pid 62998:tid 63005] [client 64.64.108.36:57381] File does not exist: /usr/local/apache/htdocs/suspended-page/rcc.php
[Fri Feb 27 11:18:22.051334 2026] [:error] [pid 62998:tid 63009] [client 64.64.108.36:57381] [client 64.64.108.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaEM_lQeueXZDUmoLol06QAAAQc"]
[Fri Feb 27 11:18:23.006874 2026] [:error] [pid 62998:tid 63010] [client 64.64.108.37:45523] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Feb 27 11:18:23.647146 2026] [:error] [pid 62998:tid 63008] [client 64.64.108.37:45523] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Fri Feb 27 11:18:24.173727 2026] [:error] [pid 62998:tid 63016] [client 64.64.108.37:45523] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaENAFQeueXZDUmoLol1CgAAAQ4"]
[Fri Feb 27 11:18:25.181790 2026] [:error] [pid 54103:tid 54187] [client 64.64.108.35:55617] File does not exist: /usr/local/apache/htdocs/suspended-page/history.php
[Fri Feb 27 11:18:25.644353 2026] [:error] [pid 54103:tid 54178] [client 64.64.108.35:55617] [client 64.64.108.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aaENAevG4MPCmE0B2sA6jwAAAMc"]
[Fri Feb 27 11:18:29.250068 2026] [:error] [pid 54103:tid 54195] [client 64.64.108.34:40551] [client 64.64.108.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaENBevG4MPCmE0B2sA6rQAAANg"]
[Fri Feb 27 11:18:30.181098 2026] [:error] [pid 54101:tid 54127] [client 64.64.108.27:61441] [client 64.64.108.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aaENBlY5qgRktcYTGFv0tAAAAdM"]
[Fri Feb 27 11:18:31.736937 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.35:33037] [client 64.64.108.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaENB4a650YPyxXVeRZ0UwAAAYg"]
[Fri Feb 27 11:18:32.582866 2026] [:error] [pid 49306:tid 49323] [client 64.64.108.49:40909] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 27 11:18:33.637590 2026] [:error] [pid 49306:tid 49327] [client 64.64.108.49:40909] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Feb 27 11:18:34.135111 2026] [:error] [pid 49306:tid 49312] [client 64.64.108.49:40909] [client 64.64.108.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.49, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aaENCvnSUDZue59Px9t-QwAAAUQ"]
[Fri Feb 27 11:18:35.044629 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.49:40909] [client 64.64.108.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aaENC_nSUDZue59Px9t-TAAAAUo"]
[Fri Feb 27 11:18:36.392309 2026] [:error] [pid 62998:tid 63004] [client 64.64.108.36:44945] [client 64.64.108.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aaENDFQeueXZDUmoLol1wgAAAQI"]
[Fri Feb 27 11:18:37.300604 2026] [:error] [pid 62998:tid 63007] [client 64.64.108.53:44943] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Fri Feb 27 11:18:37.755602 2026] [:error] [pid 62998:tid 63008] [client 64.64.108.53:44943] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Feb 27 11:18:39.747530 2026] [:error] [pid 62998:tid 63006] [client 64.64.108.53:44943] File does not exist: /usr/local/apache/htdocs/suspended-page/login.php
[Fri Feb 27 11:18:41.349891 2026] [:error] [pid 62998:tid 63017] [client 64.64.108.53:44943] [client 64.64.108.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.53, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aaENEVQeueXZDUmoLol2HQAAAQ8"]
[Fri Feb 27 11:18:41.839116 2026] [:error] [pid 62998:tid 63001] [client 64.64.108.53:44943] [client 64.64.108.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaENEVQeueXZDUmoLol2JQAAAQA"]
[Fri Feb 27 11:18:42.770270 2026] [:error] [pid 54103:tid 54174] [client 64.64.108.29:51155] [client 64.64.108.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aaENEuvG4MPCmE0B2sA7NAAAAMM"]
[Fri Feb 27 11:18:43.967358 2026] [:error] [pid 62998:tid 63007] [client 64.64.108.20:27181] [client 64.64.108.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aaENE1QeueXZDUmoLol2SwAAAQU"]
[Fri Feb 27 11:18:46.535960 2026] [:error] [pid 54101:tid 54127] [client 64.64.108.53:64375] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Fri Feb 27 11:18:47.039965 2026] [:error] [pid 54101:tid 54130] [client 64.64.108.53:64375] [client 64.64.108.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aaENF1Y5qgRktcYTGFv1UgAAAdY"]
[Fri Feb 27 11:18:48.551327 2026] [:error] [pid 54103:tid 54182] [client 64.64.108.29:53705] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Fri Feb 27 11:18:50.839999 2026] [:error] [pid 54103:tid 54186] [client 64.64.108.29:53705] [client 64.64.108.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaENGuvG4MPCmE0B2sA7cgAAAM8"]
[Fri Feb 27 11:18:52.236539 2026] [:error] [pid 56075:tid 56090] [client 64.64.108.25:35987] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Feb 27 11:18:53.752327 2026] [:error] [pid 56075:tid 56087] [client 64.64.108.25:35987] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Fri Feb 27 11:18:54.155232 2026] [:error] [pid 56075:tid 56094] [client 64.64.108.25:35987] [client 64.64.108.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaENHsKBhrfI6KNv9RiUawAAABA"]
[Fri Feb 27 11:18:55.662189 2026] [:error] [pid 62998:tid 63026] [client 64.64.108.22:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Fri Feb 27 11:18:56.650260 2026] [:error] [pid 62998:tid 63002] [client 64.64.108.22:49085] [client 64.64.108.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaENIFQeueXZDUmoLol3QgAAAQE"]
[Fri Feb 27 11:19:02.147331 2026] [:error] [pid 54103:tid 54172] [client 64.64.108.33:27175] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Feb 27 11:19:03.657510 2026] [:error] [pid 54103:tid 54174] [client 64.64.108.33:27175] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaENJ-vG4MPCmE0B2sA72wAAAMM"]
[Fri Feb 27 11:19:05.257720 2026] [:error] [pid 49306:tid 49327] [client 64.64.108.53:52785] [client 64.64.108.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaENKfnSUDZue59Px9t_kQAAAVM"]
[Fri Feb 27 11:19:06.183022 2026] [:error] [pid 56075:tid 56098] [client 64.64.108.43:39841] [client 64.64.108.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aaENKsKBhrfI6KNv9RiUzgAAABQ"]
[Fri Feb 27 11:19:07.186342 2026] [:error] [pid 54103:tid 54180] [client 64.64.108.64:29065] [client 64.64.108.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaENK-vG4MPCmE0B2sA79gAAAMk"]
[Fri Feb 27 11:19:09.088992 2026] [:error] [pid 62998:tid 63004] [client 64.64.108.40:35227] [client 64.64.108.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaENLVQeueXZDUmoLol31wAAAQI"]
[Fri Feb 27 11:19:10.538516 2026] [:error] [pid 54103:tid 54176] [client 64.64.108.36:51573] [client 64.64.108.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaENLuvG4MPCmE0B2sA8GwAAAMU"]
[Fri Feb 27 11:19:12.573905 2026] [:error] [pid 62998:tid 63020] [client 64.64.108.65:32373] [client 64.64.108.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaENMFQeueXZDUmoLol3_AAAARI"]
[Fri Feb 27 11:19:14.253942 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.55:42639] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Feb 27 11:19:15.178832 2026] [:error] [pid 52073:tid 52088] [client 64.64.108.55:42639] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaENM4a650YPyxXVeRZ2OQAAAYw"]
[Fri Feb 27 11:19:16.974374 2026] [:error] [pid 54101:tid 54118] [client 64.64.108.47:51595] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Fri Feb 27 11:19:17.742319 2026] [:error] [pid 54101:tid 54108] [client 64.64.108.47:51595] File does not exist: /usr/local/apache/htdocs/suspended-page/conf_upload.php
[Fri Feb 27 11:19:18.247635 2026] [:error] [pid 54101:tid 54131] [client 64.64.108.47:51595] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaENNlY5qgRktcYTGFv2wgAAAdc"]
[Fri Feb 27 11:19:20.737677 2026] [:error] [pid 49306:tid 49309] [client 64.64.108.47:45509] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaENOPnSUDZue59Px9uAgAAAAUE"]
[Fri Feb 27 11:19:21.795546 2026] [:error] [pid 54102:tid 54146] [client 64.64.108.37:52551] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Fri Feb 27 11:19:23.560898 2026] [:error] [pid 54102:tid 54146] [client 64.64.108.37:52551] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Feb 27 11:19:24.045279 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.37:52551] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aaENPHi74D4fiYUm_GcYzwAAAJA"]
[Fri Feb 27 11:19:25.458818 2026] [:error] [pid 54103:tid 54189] [client 64.64.108.39:30181] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Feb 27 11:19:26.461849 2026] [:error] [pid 54103:tid 54191] [client 64.64.108.39:30181] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Fri Feb 27 11:19:27.040860 2026] [:error] [pid 54103:tid 54194] [client 64.64.108.39:30181] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Fri Feb 27 11:19:28.441953 2026] [:error] [pid 54103:tid 54185] [client 64.64.108.39:30181] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Fri Feb 27 11:19:28.943949 2026] [:error] [pid 54103:tid 54183] [client 64.64.108.39:30181] [client 64.64.108.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaENQOvG4MPCmE0B2sA84AAAAMw"]
[Fri Feb 27 11:19:31.443690 2026] [:error] [pid 62998:tid 63015] [client 64.64.108.55:51391] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Fri Feb 27 11:19:31.945905 2026] [:error] [pid 62998:tid 63012] [client 64.64.108.55:51391] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aaENQ1QeueXZDUmoLol4qAAAAQo"]
[Fri Feb 27 11:19:33.188126 2026] [:error] [pid 54103:tid 54195] [client 64.64.108.26:47835] [client 64.64.108.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aaENRevG4MPCmE0B2sA9AgAAANg"]
[Fri Feb 27 11:19:34.198301 2026] [:error] [pid 49306:tid 49316] [client 64.64.108.58:43101] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 11:19:34.743282 2026] [:error] [pid 49306:tid 49313] [client 64.64.108.58:43101] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Feb 27 11:19:35.356244 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.58:43101] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 27 11:19:35.940784 2026] [:error] [pid 49306:tid 49313] [client 64.64.108.58:43101] [client 64.64.108.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aaENR_nSUDZue59Px9uBXQAAAUU"]
[Fri Feb 27 11:19:36.884091 2026] [:error] [pid 62998:tid 63004] [client 64.64.108.63:55437] [client 64.64.108.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaENSFQeueXZDUmoLol43AAAAQI"]
[Fri Feb 27 11:19:37.975652 2026] [:error] [pid 52073:tid 52086] [client 64.64.108.53:47099] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Feb 27 11:19:38.544144 2026] [:error] [pid 52073:tid 52080] [client 64.64.108.53:47099] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Fri Feb 27 11:19:39.040940 2026] [:error] [pid 52073:tid 52078] [client 64.64.108.53:47099] File does not exist: /usr/local/apache/htdocs/suspended-page/sck.php
[Fri Feb 27 11:19:39.530283 2026] [:error] [pid 52073:tid 52076] [client 64.64.108.53:47099] [client 64.64.108.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaENS4a650YPyxXVeRZ3YQAAAYA"]
[Fri Feb 27 11:19:40.944234 2026] [:error] [pid 54101:tid 54120] [client 64.64.108.42:57231] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Fri Feb 27 11:19:41.538079 2026] [:error] [pid 54101:tid 54114] [client 64.64.108.42:57231] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 27 11:19:42.042976 2026] [:error] [pid 54101:tid 54115] [client 64.64.108.42:57231] [client 64.64.108.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaENTlY5qgRktcYTGFv3kAAAAcc"]
[Fri Feb 27 11:19:43.537405 2026] [:error] [pid 62998:tid 63001] [client 64.64.108.50:32423] [client 64.64.108.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.50, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaENT1QeueXZDUmoLol5IgAAAQA"]
[Fri Feb 27 11:19:44.174734 2026] [:error] [pid 62998:tid 63017] [client 64.64.108.50:32423] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Fri Feb 27 11:19:45.825645 2026] [:error] [pid 54102:tid 54148] [client 64.64.108.53:50579] [client 64.64.108.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaENUXi74D4fiYUm_GcZ-AAAAIQ"]
[Fri Feb 27 11:19:46.906882 2026] [:error] [pid 49306:tid 49323] [client 64.64.108.32:31769] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaENUvnSUDZue59Px9uCJwAAAU8"]
[Fri Feb 27 11:19:52.197249 2026] [:error] [pid 54231:tid 54244] [client 64.64.108.44:37159] [client 64.64.108.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aaENWOTvb5AeyJCdY7CDEwAAAEo"]
[Fri Feb 27 11:19:53.276726 2026] [:error] [pid 49306:tid 49315] [client 64.64.108.63:28349] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 27 11:19:53.846842 2026] [:error] [pid 49306:tid 49316] [client 64.64.108.63:28349] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Fri Feb 27 11:19:54.337661 2026] [:error] [pid 49306:tid 49320] [client 64.64.108.63:28349] [client 64.64.108.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aaENWvnSUDZue59Px9uCywAAAUw"]
[Fri Feb 27 11:19:55.277638 2026] [:error] [pid 54102:tid 54158] [client 64.64.108.25:62765] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Fri Feb 27 11:19:55.946637 2026] [:error] [pid 54102:tid 54157] [client 64.64.108.25:62765] [client 64.64.108.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaENW3i74D4fiYUm_GcaVgAAAI0"]
[Fri Feb 27 11:19:57.345699 2026] [:error] [pid 49306:tid 49317] [client 64.64.108.52:57971] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Feb 27 11:19:57.860723 2026] [:error] [pid 49306:tid 49317] [client 64.64.108.52:57971] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Fri Feb 27 11:20:00.444564 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.52:57971] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Fri Feb 27 11:20:01.353738 2026] [:error] [pid 49306:tid 49320] [client 64.64.108.52:57971] [client 64.64.108.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaENYfnSUDZue59Px9uDcgAAAUw"]
[Fri Feb 27 11:20:02.516787 2026] [:error] [pid 56075:tid 56102] [client 64.64.108.37:50939] File does not exist: /usr/local/apache/htdocs/suspended-page/base.php
[Fri Feb 27 11:20:03.551627 2026] [:error] [pid 56075:tid 56083] [client 64.64.108.37:50939] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Fri Feb 27 11:20:04.153147 2026] [:error] [pid 56075:tid 56095] [client 64.64.108.37:50939] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Feb 27 11:20:05.763902 2026] [:error] [pid 56075:tid 56083] [client 64.64.108.37:50939] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Fri Feb 27 11:20:06.348151 2026] [:error] [pid 56075:tid 56088] [client 64.64.108.37:50939] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 11:20:07.380986 2026] [:error] [pid 56075:tid 56083] [client 64.64.108.37:50939] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mah.php"] [unique_id "aaENZ8KBhrfI6KNv9RiW4AAAAAY"]
[Fri Feb 27 11:20:08.507096 2026] [:error] [pid 54102:tid 54148] [client 64.64.108.18:44121] [client 64.64.108.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.18, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aaENaHi74D4fiYUm_Gca3wAAAIQ"]
[Fri Feb 27 11:20:09.030456 2026] [:error] [pid 54102:tid 54163] [client 64.64.108.18:44121] [client 64.64.108.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aaENaXi74D4fiYUm_Gca7gAAAJM"]
[Fri Feb 27 11:20:13.071626 2026] [:error] [pid 54102:tid 54162] [client 64.64.108.57:61419] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Feb 27 11:20:14.247987 2026] [:error] [pid 54102:tid 54144] [client 64.64.108.57:61419] [client 64.64.108.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaENbni74D4fiYUm_GcbQAAAAIA"]
[Fri Feb 27 11:20:15.758508 2026] [:error] [pid 54231:tid 54242] [client 64.64.108.25:59123] [client 64.64.108.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.25, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aaENb-Tvb5AeyJCdY7CDsgAAAEg"]
[Fri Feb 27 11:20:17.181493 2026] [:error] [pid 54231:tid 54247] [client 64.64.108.25:59123] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Fri Feb 27 11:20:17.763899 2026] [:error] [pid 54231:tid 54250] [client 64.64.108.25:59123] File does not exist: /usr/local/apache/htdocs/suspended-page/bulk.php
[Fri Feb 27 11:20:18.237405 2026] [:error] [pid 54231:tid 54257] [client 64.64.108.25:59123] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Fri Feb 27 11:20:19.357630 2026] [:error] [pid 54231:tid 54238] [client 64.64.108.25:59123] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logout.php
[Fri Feb 27 11:20:19.846815 2026] [:error] [pid 54231:tid 54254] [client 64.64.108.25:59123] [client 64.64.108.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aaENc-Tvb5AeyJCdY7CD4QAAAFQ"]
[Fri Feb 27 11:20:22.049206 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.55:23043] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/packed.php"] [unique_id "aaENdoa650YPyxXVeRZ5cQAAAZY"]
[Fri Feb 27 11:20:29.486745 2026] [:error] [pid 54101:tid 54117] [client 64.64.108.49:51579] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Feb 27 11:20:29.956882 2026] [:error] [pid 54101:tid 54118] [client 64.64.108.49:51579] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Fri Feb 27 11:20:31.547313 2026] [:error] [pid 54101:tid 54132] [client 64.64.108.49:51579] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Fri Feb 27 11:20:32.138082 2026] [:error] [pid 54101:tid 54126] [client 64.64.108.49:51579] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-simple.php
[Fri Feb 27 11:20:34.050851 2026] [:error] [pid 54101:tid 54113] [client 64.64.108.49:51579] [client 64.64.108.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aaENglY5qgRktcYTGFv5kAAAAcU"]
[Fri Feb 27 11:20:35.637090 2026] [:error] [pid 49306:tid 49310] [client 64.64.108.33:62885] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaENg_nSUDZue59Px9uEuwAAAUI"]
[Fri Feb 27 11:20:37.247159 2026] [:error] [pid 54102:tid 54158] [client 64.64.108.41:56803] [client 64.64.108.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aaENhXi74D4fiYUm_GccCwAAAI4"]
[Fri Feb 27 11:20:38.390529 2026] [:error] [pid 54101:tid 54109] [client 64.64.108.66:34595] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Fri Feb 27 11:20:40.457158 2026] [:error] [pid 54101:tid 54120] [client 64.64.108.66:34595] [client 64.64.108.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.66, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aaENiFY5qgRktcYTGFv57QAAAcw"]
[Fri Feb 27 11:20:40.939220 2026] [:error] [pid 54101:tid 54113] [client 64.64.108.66:34595] [client 64.64.108.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaENiFY5qgRktcYTGFv5-AAAAcU"]
[Fri Feb 27 11:20:47.581135 2026] [:error] [pid 54231:tid 54245] [client 64.64.108.23:38419] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Fri Feb 27 11:20:48.095286 2026] [:error] [pid 54231:tid 54254] [client 64.64.108.23:38419] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Fri Feb 27 11:20:49.357806 2026] [:error] [pid 54231:tid 54254] [client 64.64.108.23:38419] [client 64.64.108.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaENkeTvb5AeyJCdY7CFFQAAAFQ"]
[Fri Feb 27 11:20:50.420863 2026] [:error] [pid 62998:tid 63019] [client 64.64.108.22:24885] [client 64.64.108.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aaENklQeueXZDUmoLol7RwAAARE"]
[Fri Feb 27 11:20:51.635670 2026] [:error] [pid 56075:tid 56097] [client 64.64.108.34:60487] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Fri Feb 27 11:20:55.353662 2026] [:error] [pid 56075:tid 56087] [client 64.64.108.34:60487] [client 64.64.108.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aaENl8KBhrfI6KNv9RiYgQAAAAo"]
[Fri Feb 27 11:20:56.602698 2026] [:error] [pid 56075:tid 56088] [client 64.64.108.37:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 27 11:20:57.063188 2026] [:error] [pid 56075:tid 56082] [client 64.64.108.37:29797] [client 64.64.108.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sym.php"] [unique_id "aaENmcKBhrfI6KNv9RiYnAAAAAU"]
[Fri Feb 27 11:20:58.000709 2026] [:error] [pid 49306:tid 49326] [client 64.64.108.35:65169] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Fri Feb 27 11:20:59.047234 2026] [:error] [pid 49306:tid 49327] [client 64.64.108.35:65169] [client 64.64.108.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/votes.php"] [unique_id "aaENm_nSUDZue59Px9uFtgAAAVM"]
[Fri Feb 27 11:21:02.146724 2026] [:error] [pid 54103:tid 54184] [client 64.64.108.25:40593] File does not exist: /usr/local/apache/htdocs/suspended-page/sk.php
[Fri Feb 27 11:21:03.348840 2026] [:error] [pid 54103:tid 54173] [client 64.64.108.25:40593] [client 64.64.108.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/about.php"] [unique_id "aaENn-vG4MPCmE0B2sBAFwAAAMI"]
[Fri Feb 27 11:21:04.846205 2026] [:error] [pid 49306:tid 49326] [client 64.64.108.27:63531] [client 64.64.108.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "aaENoPnSUDZue59Px9uGDAAAAVI"]
[Fri Feb 27 11:21:07.944565 2026] [:error] [pid 62998:tid 63026] [client 64.64.108.18:36445] [client 64.64.108.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aaENo1QeueXZDUmoLol8GQAAARg"]
[Fri Feb 27 11:21:10.656585 2026] [:error] [pid 54231:tid 54240] [client 64.64.108.62:29733] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Fri Feb 27 11:21:12.045446 2026] [:error] [pid 54231:tid 54257] [client 64.64.108.62:29733] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Fri Feb 27 11:21:12.535312 2026] [:error] [pid 54231:tid 54247] [client 64.64.108.62:29733] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Fri Feb 27 11:21:13.044134 2026] [:error] [pid 54231:tid 54250] [client 64.64.108.62:29733] [client 64.64.108.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aaENqeTvb5AeyJCdY7CGQgAAAFA"]
[Fri Feb 27 11:21:14.096772 2026] [:error] [pid 52073:tid 52096] [client 64.64.108.20:33835] File does not exist: /usr/local/apache/htdocs/suspended-page/fm1.php
[Fri Feb 27 11:21:15.564309 2026] [:error] [pid 52073:tid 52087] [client 64.64.108.20:33835] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Fri Feb 27 11:21:16.045115 2026] [:error] [pid 52073:tid 52079] [client 64.64.108.20:33835] [client 64.64.108.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaENrIa650YPyxXVeRZ8JAAAAYM"]
[Fri Feb 27 11:21:16.986410 2026] [:error] [pid 54101:tid 54119] [client 64.64.108.43:34041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Fri Feb 27 11:21:17.537334 2026] [:error] [pid 54101:tid 54116] [client 64.64.108.43:34041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Fri Feb 27 11:21:18.053861 2026] [:error] [pid 54101:tid 54127] [client 64.64.108.43:34041] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Fri Feb 27 11:21:19.146196 2026] [:error] [pid 54101:tid 54113] [client 64.64.108.43:34041] [client 64.64.108.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi01.php"] [unique_id "aaENr1Y5qgRktcYTGFv7VQAAAcU"]
[Fri Feb 27 11:21:20.176617 2026] [:error] [pid 52073:tid 52087] [client 64.64.108.64:34231] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi01.php
[Fri Feb 27 11:21:21.658960 2026] [:error] [pid 52073:tid 52090] [client 64.64.108.64:34231] [client 64.64.108.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/item.php"] [unique_id "aaENsYa650YPyxXVeRZ8XwAAAY4"]
[Fri Feb 27 11:21:25.634826 2026] [:error] [pid 54231:tid 54252] [client 64.64.108.46:35355] [client 64.64.108.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.46, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aaENteTvb5AeyJCdY7CGqwAAAFI"]
[Fri Feb 27 11:21:26.156767 2026] [:error] [pid 54231:tid 54253] [client 64.64.108.46:35355] [client 64.64.108.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.46, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aaENtuTvb5AeyJCdY7CGrgAAAFM"]
[Fri Feb 27 11:21:26.630334 2026] [:error] [pid 54231:tid 54242] [client 64.64.108.46:35355] [client 64.64.108.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/mani.php"] [unique_id "aaENtuTvb5AeyJCdY7CGrwAAAEg"]
[Fri Feb 27 11:21:27.492704 2026] [:error] [pid 54101:tid 54108] [client 64.64.108.53:24491] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Feb 27 11:21:31.354170 2026] [:error] [pid 54101:tid 54129] [client 64.64.108.53:24491] [client 64.64.108.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aaENu1Y5qgRktcYTGFv7rQAAAdU"]
[Fri Feb 27 11:21:32.331811 2026] [:error] [pid 54103:tid 54191] [client 64.64.108.24:24147] File does not exist: /usr/local/apache/htdocs/suspended-page/images.php
[Fri Feb 27 11:21:32.933605 2026] [:error] [pid 54103:tid 54186] [client 64.64.108.24:24147] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aespa.php
[Fri Feb 27 11:21:33.356154 2026] [:error] [pid 54103:tid 54172] [client 64.64.108.24:24147] [client 64.64.108.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaENvevG4MPCmE0B2sBAnwAAAME"]
[Fri Feb 27 11:21:38.360405 2026] [:error] [pid 62998:tid 63015] [client 64.64.108.30:33237] [client 64.64.108.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aaENwlQeueXZDUmoLol9rgAAAQ0"]
[Fri Feb 27 11:21:39.945954 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.33:38543] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Fri Feb 27 11:21:42.335548 2026] [:error] [pid 54102:tid 54147] [client 64.64.108.33:38543] [client 64.64.108.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.33, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-login.php"] [unique_id "aaENxni74D4fiYUm_GceXQAAAIM"]
[Fri Feb 27 11:21:44.334692 2026] [:error] [pid 54102:tid 54151] [client 64.64.108.33:38543] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aaENyHi74D4fiYUm_GcecgAAAIc"]
[Fri Feb 27 11:21:45.375756 2026] [:error] [pid 54102:tid 54152] [client 64.64.108.33:40435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Feb 27 11:21:45.859203 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.33:40435] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aaENyXi74D4fiYUm_GcegAAAAJA"]
[Fri Feb 27 11:21:46.782865 2026] [:error] [pid 52073:tid 52091] [client 64.64.108.24:47997] [client 64.64.108.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaENyoa650YPyxXVeRZ9mQAAAY8"]
[Fri Feb 27 11:21:48.240771 2026] [:error] [pid 52073:tid 52090] [client 64.64.108.49:37841] [client 64.64.108.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaENzIa650YPyxXVeRZ9uAAAAY4"]
[Fri Feb 27 11:21:52.332526 2026] [:error] [pid 54101:tid 54117] [client 64.64.108.28:49015] [client 64.64.108.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aaEN0FY5qgRktcYTGFv8NAAAAck"]
[Fri Feb 27 11:21:53.845255 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.22:37029] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Fri Feb 27 11:21:55.953665 2026] [:error] [pid 49306:tid 49322] [client 64.64.108.22:37029] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Fri Feb 27 11:21:56.449663 2026] [:error] [pid 49306:tid 49311] [client 64.64.108.22:37029] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Fri Feb 27 11:21:57.050431 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.22:37029] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Fri Feb 27 11:21:57.734906 2026] [:error] [pid 49306:tid 49312] [client 64.64.108.22:37029] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Fri Feb 27 11:21:58.561970 2026] [:error] [pid 49306:tid 49331] [client 64.64.108.22:37029] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Feb 27 11:22:00.037868 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.22:37029] [client 64.64.108.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/radio.php"] [unique_id "aaEN2PnSUDZue59Px9uIRQAAAVY"]
[Fri Feb 27 11:22:01.756401 2026] [:error] [pid 54102:tid 54159] [client 64.64.108.52:57423] File does not exist: /usr/local/apache/htdocs/suspended-page/payout.php
[Fri Feb 27 11:22:02.260472 2026] [:error] [pid 54102:tid 54148] [client 64.64.108.52:57423] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Feb 27 11:22:02.750213 2026] [:error] [pid 54102:tid 54159] [client 64.64.108.52:57423] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Feb 27 11:22:03.262108 2026] [:error] [pid 54102:tid 54168] [client 64.64.108.52:57423] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Fri Feb 27 11:22:04.245082 2026] [:error] [pid 54102:tid 54157] [client 64.64.108.52:57423] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Fri Feb 27 11:22:04.747318 2026] [:error] [pid 54102:tid 54152] [client 64.64.108.52:57423] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Fri Feb 27 11:22:05.755863 2026] [:error] [pid 54102:tid 54151] [client 64.64.108.52:57423] [client 64.64.108.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aaEN3Xi74D4fiYUm_GcfNQAAAIc"]
[Fri Feb 27 11:22:11.270182 2026] [:error] [pid 54102:tid 54148] [client 64.64.108.65:51089] [client 64.64.108.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaEN43i74D4fiYUm_GcfhwAAAIQ"]
[Fri Feb 27 11:22:12.952534 2026] [:error] [pid 54103:tid 54190] [client 64.64.108.51:34941] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Feb 27 11:22:13.449807 2026] [:error] [pid 54103:tid 54193] [client 64.64.108.51:34941] File does not exist: /usr/local/apache/htdocs/suspended-page/fox.php
[Fri Feb 27 11:22:14.748920 2026] [:error] [pid 54103:tid 54183] [client 64.64.108.51:34941] File does not exist: /usr/local/apache/htdocs/suspended-page/google.php
[Fri Feb 27 11:22:15.758735 2026] [:error] [pid 54103:tid 54183] [client 64.64.108.51:34941] File does not exist: /usr/local/apache/htdocs/suspended-page/ovatools.php
[Fri Feb 27 11:22:16.333826 2026] [:error] [pid 54103:tid 54193] [client 64.64.108.51:34941] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwso.php
[Fri Feb 27 11:22:16.945686 2026] [:error] [pid 54103:tid 54173] [client 64.64.108.51:34941] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Fri Feb 27 11:22:17.457037 2026] [:error] [pid 54103:tid 54180] [client 64.64.108.51:34941] [client 64.64.108.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaEN6evG4MPCmE0B2sBB5gAAAMk"]
[Fri Feb 27 11:22:19.657601 2026] [:error] [pid 56075:tid 56080] [client 64.64.108.45:37413] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aaEN68KBhrfI6KNv9RibnwAAAAM"]
[Fri Feb 27 11:22:21.863125 2026] [:error] [pid 54101:tid 54115] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Fri Feb 27 11:22:22.358727 2026] [:error] [pid 54101:tid 54108] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Fri Feb 27 11:22:22.862606 2026] [:error] [pid 54101:tid 54115] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/style2.php
[Fri Feb 27 11:22:23.677977 2026] [:error] [pid 54101:tid 54113] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scripts.php
[Fri Feb 27 11:22:24.165316 2026] [:error] [pid 54101:tid 54114] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 11:22:24.665806 2026] [:error] [pid 54101:tid 54118] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Fri Feb 27 11:22:25.175295 2026] [:error] [pid 54101:tid 54114] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/comfunctions.php
[Fri Feb 27 11:22:25.664624 2026] [:error] [pid 54101:tid 54123] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Fri Feb 27 11:22:26.158541 2026] [:error] [pid 54101:tid 54127] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Fri Feb 27 11:22:26.748607 2026] [:error] [pid 54101:tid 54108] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Fri Feb 27 11:22:30.506634 2026] [:error] [pid 54101:tid 54108] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/hinfofuns.php
[Fri Feb 27 11:22:31.196045 2026] [:error] [pid 54101:tid 54129] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/qfunctions.php
[Fri Feb 27 11:22:31.677129 2026] [:error] [pid 54101:tid 54111] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/qinfofuns.php
[Fri Feb 27 11:22:32.176506 2026] [:error] [pid 54101:tid 54125] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Fri Feb 27 11:22:32.950795 2026] [:error] [pid 54101:tid 54108] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Fri Feb 27 11:22:33.484838 2026] [:error] [pid 54101:tid 54129] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php
[Fri Feb 27 11:22:33.945294 2026] [:error] [pid 54101:tid 54132] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Fri Feb 27 11:22:34.366164 2026] [:error] [pid 54101:tid 54114] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Fri Feb 27 11:22:34.856926 2026] [:error] [pid 54101:tid 54125] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/my-sites.php
[Fri Feb 27 11:22:35.372321 2026] [:error] [pid 54101:tid 54121] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Fri Feb 27 11:22:35.768908 2026] [:error] [pid 54101:tid 54122] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/nav-menus.php
[Fri Feb 27 11:22:36.268613 2026] [:error] [pid 54101:tid 54131] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Fri Feb 27 11:22:36.756289 2026] [:error] [pid 54101:tid 54125] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Fri Feb 27 11:22:37.256887 2026] [:error] [pid 54101:tid 54129] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/revision.php
[Fri Feb 27 11:22:43.747511 2026] [:error] [pid 54101:tid 54129] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Fri Feb 27 11:22:44.255677 2026] [:error] [pid 54101:tid 54131] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Feb 27 11:22:44.755278 2026] [:error] [pid 54101:tid 54132] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Fri Feb 27 11:22:45.352123 2026] [:error] [pid 54101:tid 54114] [client 64.64.108.60:55599] File does not exist: /usr/local/apache/htdocs/suspended-page/moded.php
[Fri Feb 27 11:22:45.951054 2026] [:error] [pid 54101:tid 54124] [client 64.64.108.60:55599] [client 64.64.108.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaEOBVY5qgRktcYTGFv9YgAAAdA"]
[Fri Feb 27 11:22:46.813822 2026] [:error] [pid 52073:tid 52096] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/upgrade.php
[Fri Feb 27 11:22:47.446523 2026] [:error] [pid 52073:tid 52093] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/gh.php
[Fri Feb 27 11:22:47.964125 2026] [:error] [pid 52073:tid 52081] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/version.php
[Fri Feb 27 11:22:48.549050 2026] [:error] [pid 52073:tid 52093] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/head.php
[Fri Feb 27 11:22:49.048767 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Fri Feb 27 11:22:49.650173 2026] [:error] [pid 52073:tid 52078] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/theme-insqbzk.php
[Fri Feb 27 11:22:50.155852 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Fri Feb 27 11:22:51.355261 2026] [:error] [pid 52073:tid 52086] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Fri Feb 27 11:22:52.167480 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.24:33739] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Fri Feb 27 11:22:52.564910 2026] [:error] [pid 52073:tid 52085] [client 64.64.108.24:33739] [client 64.64.108.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "aaEODIa650YPyxXVeRaAugAAAYk"]
[Fri Feb 27 11:22:55.047270 2026] [:error] [pid 54231:tid 54238] [client 64.64.108.35:34305] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Fri Feb 27 11:22:59.655957 2026] [:error] [pid 54231:tid 54257] [client 64.64.108.35:34305] [client 64.64.108.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aaEOE-Tvb5AeyJCdY7CJuAAAAFc"]
[Fri Feb 27 11:23:00.776528 2026] [:error] [pid 54231:tid 54255] [client 64.64.108.37:31647] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aaEOFOTvb5AeyJCdY7CJwQAAAFU"]
[Fri Feb 27 11:23:02.748971 2026] [:error] [pid 54231:tid 54258] [client 64.64.108.42:24229] [client 64.64.108.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aaEOFuTvb5AeyJCdY7CJ6AAAAFg"]
[Fri Feb 27 11:23:04.259953 2026] [:error] [pid 54231:tid 54234] [client 64.64.108.61:64139] [client 64.64.108.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/repeater.php"] [unique_id "aaEOGOTvb5AeyJCdY7CJ_QAAAEA"]
[Fri Feb 27 11:23:07.148894 2026] [:error] [pid 49306:tid 49314] [client 64.64.108.58:50265] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php
[Fri Feb 27 11:23:07.640356 2026] [:error] [pid 49306:tid 49317] [client 64.64.108.58:50265] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php
[Fri Feb 27 11:23:14.072420 2026] [:error] [pid 49306:tid 49315] [client 64.64.108.58:50265] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php
[Fri Feb 27 11:23:18.244148 2026] [:error] [pid 49306:tid 49314] [client 64.64.108.58:50265] [client 64.64.108.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aaEOJvnSUDZue59Px9uLMQAAAUY"]
[Fri Feb 27 11:23:19.185793 2026] [:error] [pid 54101:tid 54114] [client 64.64.108.34:36761] [client 64.64.108.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aaEOJ1Y5qgRktcYTGFv-GQAAAcY"]
[Fri Feb 27 11:23:23.071771 2026] [:error] [pid 52073:tid 52091] [client 64.64.108.16:52779] [client 64.64.108.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/options.php"] [unique_id "aaEOKoa650YPyxXVeRaBrQAAAY8"]
[Fri Feb 27 11:23:24.082531 2026] [:error] [pid 54103:tid 54170] [client 64.64.108.46:64083] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Fri Feb 27 11:23:25.242689 2026] [:error] [pid 54103:tid 54179] [client 64.64.108.46:64083] [client 64.64.108.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aaEOLevG4MPCmE0B2sBDtwAAAMg"]
[Fri Feb 27 11:23:26.412522 2026] [:error] [pid 54101:tid 54131] [client 64.64.108.65:60483] [client 64.64.108.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aaEOLlY5qgRktcYTGFv-TQAAAdc"]
[Fri Feb 27 11:23:28.355067 2026] [:error] [pid 56075:tid 56080] [client 64.64.108.54:36365] [client 64.64.108.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.54, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/images/wp-login.php"] [unique_id "aaEOMMKBhrfI6KNv9Rid3QAAAAM"]
[Fri Feb 27 11:23:28.943291 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.54:36365] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Fri Feb 27 11:23:30.533594 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.54:36365] [client 64.64.108.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aaEOMsKBhrfI6KNv9Rid7wAAAAI"]
[Fri Feb 27 11:23:31.699369 2026] [:error] [pid 62998:tid 63011] [client 64.64.108.45:29591] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads-config.php
[Fri Feb 27 11:23:34.439828 2026] [:error] [pid 62998:tid 63019] [client 64.64.108.45:29591] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aaEONlQeueXZDUmoLomEKQAAARE"]
[Fri Feb 27 11:23:35.395132 2026] [:error] [pid 62998:tid 63026] [client 64.64.108.29:29835] [client 64.64.108.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aaEON1QeueXZDUmoLomEPQAAARg"]
[Fri Feb 27 11:23:36.476910 2026] [:error] [pid 56075:tid 56101] [client 64.64.108.26:31821] [client 64.64.108.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.26, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aaEOOMKBhrfI6KNv9RieEgAAABc"]
[Fri Feb 27 11:23:36.954449 2026] [:error] [pid 56075:tid 56082] [client 64.64.108.26:31821] [client 64.64.108.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aaEOOMKBhrfI6KNv9RieFQAAAAU"]
[Fri Feb 27 11:23:40.980072 2026] [:error] [pid 54102:tid 54160] [client 64.64.108.21:47131] File does not exist: /usr/local/apache/htdocs/suspended-page/indeex.php
[Fri Feb 27 11:23:41.457883 2026] [:error] [pid 54102:tid 54144] [client 64.64.108.21:47131] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 27 11:23:43.038791 2026] [:error] [pid 54102:tid 54155] [client 64.64.108.21:47131] [client 64.64.108.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aaEOP3i74D4fiYUm_Gch6QAAAIs"]
[Fri Feb 27 11:23:44.091451 2026] [:error] [pid 54103:tid 54182] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Fri Feb 27 11:23:45.059108 2026] [:error] [pid 54103:tid 54192] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/credits.php
[Fri Feb 27 11:23:45.559282 2026] [:error] [pid 54103:tid 54193] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-comments.php
[Fri Feb 27 11:23:46.235303 2026] [:error] [pid 54103:tid 54192] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Fri Feb 27 11:23:46.739589 2026] [:error] [pid 54103:tid 54184] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Fri Feb 27 11:23:48.047913 2026] [:error] [pid 54103:tid 54188] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Fri Feb 27 11:23:48.537359 2026] [:error] [pid 54103:tid 54192] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/load-scripts.php
[Fri Feb 27 11:23:49.059039 2026] [:error] [pid 54103:tid 54176] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/load-styles.php
[Fri Feb 27 11:23:49.738159 2026] [:error] [pid 54103:tid 54192] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/options-discussion.php
[Fri Feb 27 11:23:50.347718 2026] [:error] [pid 54103:tid 54176] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/options-general.php
[Fri Feb 27 11:23:51.038597 2026] [:error] [pid 54103:tid 54172] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/options-permalink.php
[Fri Feb 27 11:23:51.540721 2026] [:error] [pid 54103:tid 54192] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/options-privacy.php
[Fri Feb 27 11:23:52.437302 2026] [:error] [pid 54103:tid 54179] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Fri Feb 27 11:23:52.945236 2026] [:error] [pid 54103:tid 54184] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Fri Feb 27 11:23:53.455971 2026] [:error] [pid 54103:tid 54193] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/post-new.php
[Fri Feb 27 11:23:53.960307 2026] [:error] [pid 54103:tid 54192] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Fri Feb 27 11:23:54.444326 2026] [:error] [pid 54103:tid 54184] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Fri Feb 27 11:23:54.850764 2026] [:error] [pid 54103:tid 54172] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/site-health.php
[Fri Feb 27 11:23:55.450742 2026] [:error] [pid 54103:tid 54177] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Fri Feb 27 11:23:56.161562 2026] [:error] [pid 54103:tid 54178] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Fri Feb 27 11:23:56.763930 2026] [:error] [pid 54103:tid 54170] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/user-edit.php
[Fri Feb 27 11:23:57.450267 2026] [:error] [pid 54103:tid 54189] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/user-new.php
[Fri Feb 27 11:23:57.946341 2026] [:error] [pid 54103:tid 54178] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/bar.php
[Fri Feb 27 11:23:58.439594 2026] [:error] [pid 54103:tid 54175] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Fri Feb 27 11:24:03.242149 2026] [:error] [pid 54103:tid 54175] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Fri Feb 27 11:24:03.768272 2026] [:error] [pid 54103:tid 54191] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Feb 27 11:24:04.270121 2026] [:error] [pid 54103:tid 54182] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Fri Feb 27 11:24:04.840939 2026] [:error] [pid 54103:tid 54187] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/km.php
[Fri Feb 27 11:24:05.294230 2026] [:error] [pid 54103:tid 54178] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/LA.php
[Fri Feb 27 11:24:05.742236 2026] [:error] [pid 54103:tid 54191] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 11:24:06.345599 2026] [:error] [pid 54103:tid 54175] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ldd.php
[Fri Feb 27 11:24:06.868101 2026] [:error] [pid 54103:tid 54187] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/sgd.php
[Fri Feb 27 11:24:07.367669 2026] [:error] [pid 54103:tid 54178] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/wzy.php
[Fri Feb 27 11:24:08.852007 2026] [:error] [pid 54103:tid 54182] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 27 11:24:09.940852 2026] [:error] [pid 54103:tid 54180] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Feb 27 11:24:11.547027 2026] [:error] [pid 54103:tid 54193] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 11:24:12.033811 2026] [:error] [pid 54103:tid 54188] [client 64.64.108.43:27179] [client 64.64.108.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.43, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aaEOXOvG4MPCmE0B2sBFnAAAANE"]
[Fri Feb 27 11:24:12.503987 2026] [:error] [pid 54103:tid 54179] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Fri Feb 27 11:24:14.242568 2026] [:error] [pid 54103:tid 54193] [client 64.64.108.43:27179] [client 64.64.108.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.43, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.tmb/wp-login.php"] [unique_id "aaEOXuvG4MPCmE0B2sBFtQAAANY"]
[Fri Feb 27 11:24:15.451401 2026] [:error] [pid 54103:tid 54175] [client 64.64.108.43:27179] File does not exist: /usr/local/apache/htdocs/suspended-page/FroggBaba.php
[Fri Feb 27 11:24:15.949868 2026] [:error] [pid 54103:tid 54174] [client 64.64.108.43:27179] [client 64.64.108.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aaEOX-vG4MPCmE0B2sBFyQAAAMM"]
[Fri Feb 27 11:24:16.880023 2026] [:error] [pid 52073:tid 52078] [client 64.64.108.18:20239] [client 64.64.108.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aaEOYIa650YPyxXVeRaDuwAAAYI"]
[Fri Feb 27 11:24:17.893761 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.17:52683] [client 64.64.108.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aaEOYcKBhrfI6KNv9RietAAAAAI"]
[Fri Feb 27 11:24:18.794468 2026] [:error] [pid 49306:tid 49331] [client 64.64.108.28:32263] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Fri Feb 27 11:24:23.539965 2026] [:error] [pid 49306:tid 49321] [client 64.64.108.28:32263] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Fri Feb 27 11:24:24.056912 2026] [:error] [pid 49306:tid 49314] [client 64.64.108.28:32263] File does not exist: /usr/local/apache/htdocs/suspended-page/GA13.php
[Fri Feb 27 11:24:26.236617 2026] [:error] [pid 49306:tid 49316] [client 64.64.108.28:32263] [client 64.64.108.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.28, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aaEOavnSUDZue59Px9uMxAAAAUg"]
[Fri Feb 27 11:24:26.750994 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.28:32263] [client 64.64.108.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaEOavnSUDZue59Px9uMxgAAAVY"]
[Fri Feb 27 11:24:28.351975 2026] [:error] [pid 49306:tid 49314] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/crop.php
[Fri Feb 27 11:24:28.845445 2026] [:error] [pid 49306:tid 49321] [client 64.64.108.29:32229] [client 64.64.108.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.29, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaEObPnSUDZue59Px9uM5AAAAU0"]
[Fri Feb 27 11:24:29.851782 2026] [:error] [pid 49306:tid 49314] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/gali.php
[Fri Feb 27 11:24:31.654561 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Fri Feb 27 11:24:32.278884 2026] [:error] [pid 49306:tid 49326] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/dirs.php
[Fri Feb 27 11:24:32.862308 2026] [:error] [pid 49306:tid 49312] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/abouts.php
[Fri Feb 27 11:24:33.365584 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/malls.php
[Fri Feb 27 11:24:33.872848 2026] [:error] [pid 49306:tid 49309] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/liefs.php
[Fri Feb 27 11:24:34.465411 2026] [:error] [pid 49306:tid 49310] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/uc.php
[Fri Feb 27 11:24:34.876919 2026] [:error] [pid 49306:tid 49312] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/locks.php
[Fri Feb 27 11:24:37.913312 2026] [:error] [pid 49306:tid 49312] [client 64.64.108.29:32229] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-dsdd.php
[Fri Feb 27 11:24:40.169403 2026] [:error] [pid 49306:tid 49309] [client 64.64.108.29:32229] [client 64.64.108.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aaEOePnSUDZue59Px9uNQgAAAUE"]
[Fri Feb 27 11:24:41.482467 2026] [:error] [pid 54231:tid 54250] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Fri Feb 27 11:24:41.951890 2026] [:error] [pid 54231:tid 54238] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Fri Feb 27 11:24:42.458856 2026] [:error] [pid 54231:tid 54246] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Fri Feb 27 11:24:43.053881 2026] [:error] [pid 54231:tid 54250] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Fri Feb 27 11:24:43.546986 2026] [:error] [pid 54231:tid 54244] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/stindex.php
[Fri Feb 27 11:24:44.042554 2026] [:error] [pid 54231:tid 54256] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Fri Feb 27 11:24:45.259490 2026] [:error] [pid 54231:tid 54246] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/exit.php
[Fri Feb 27 11:24:45.747791 2026] [:error] [pid 54231:tid 54239] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 27 11:24:46.233320 2026] [:error] [pid 54231:tid 54249] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Fri Feb 27 11:24:46.755559 2026] [:error] [pid 54231:tid 54234] [client 64.64.108.36:39813] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Fri Feb 27 11:24:47.252988 2026] [:error] [pid 54231:tid 54257] [client 64.64.108.36:39813] [client 64.64.108.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaEOf-Tvb5AeyJCdY7CNEwAAAFc"]
[Fri Feb 27 11:24:48.181399 2026] [:error] [pid 54103:tid 54181] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 27 11:24:49.845350 2026] [:error] [pid 54103:tid 54180] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/shellv3.php
[Fri Feb 27 11:24:50.352630 2026] [:error] [pid 54103:tid 54181] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/sh.php
[Fri Feb 27 11:24:52.043596 2026] [:error] [pid 54103:tid 54179] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Feb 27 11:24:52.538836 2026] [:error] [pid 54103:tid 54188] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Fri Feb 27 11:24:53.059646 2026] [:error] [pid 54103:tid 54183] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/delete3.php
[Fri Feb 27 11:24:53.861963 2026] [:error] [pid 54103:tid 54188] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/mm.php
[Fri Feb 27 11:24:54.843346 2026] [:error] [pid 54103:tid 54179] [client 64.64.108.57:28469] [client 64.64.108.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.57, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaEOhuvG4MPCmE0B2sBHbwAAAMg"]
[Fri Feb 27 11:24:55.293204 2026] [:error] [pid 54103:tid 54180] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Fri Feb 27 11:24:56.448760 2026] [:error] [pid 54103:tid 54176] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/mailer.php
[Fri Feb 27 11:24:56.946038 2026] [:error] [pid 54103:tid 54194] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/www.php
[Fri Feb 27 11:24:57.949248 2026] [:error] [pid 54103:tid 54192] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 27 11:24:59.349809 2026] [:error] [pid 54103:tid 54188] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Fri Feb 27 11:25:00.367628 2026] [:error] [pid 54103:tid 54180] [client 64.64.108.57:28469] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Fri Feb 27 11:25:38.956401 2026] [:error] [pid 54103:tid 54180] [client 64.64.108.57:28469] [client 64.64.108.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "aaEOsuvG4MPCmE0B2sBI0gAAAMk"]
[Fri Feb 27 12:24:05.248019 2026] [:error] [pid 62998:tid 63006] [client 68.183.194.94:64315] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 27 12:24:08.966712 2026] [:error] [pid 62998:tid 63009] [client 68.183.194.94:64315] File does not exist: /usr/local/apache/htdocs/suspended-page/server-info.php
[Fri Feb 27 12:27:09.257043 2026] [:error] [pid 52073:tid 52079] [client 68.183.194.94:65471] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Feb 27 12:27:17.577162 2026] [:error] [pid 54231:tid 54244] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Fri Feb 27 12:27:19.489664 2026] [:error] [pid 54231:tid 54255] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/php_info.php
[Fri Feb 27 12:27:20.616083 2026] [:error] [pid 54231:tid 54257] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/phpversion.php
[Fri Feb 27 12:27:22.534183 2026] [:error] [pid 54231:tid 54251] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinf.php
[Fri Feb 27 12:27:24.398859 2026] [:error] [pid 54231:tid 54236] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/status.php
[Fri Feb 27 12:27:26.369632 2026] [:error] [pid 54231:tid 54252] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Fri Feb 27 12:27:29.151075 2026] [:error] [pid 54231:tid 54245] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Feb 27 12:27:31.109019 2026] [:error] [pid 54231:tid 54249] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Fri Feb 27 12:27:32.988448 2026] [:error] [pid 54231:tid 54242] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Feb 27 12:27:34.805919 2026] [:error] [pid 54231:tid 54241] [client 68.183.194.94:49460] File does not exist: /usr/local/apache/htdocs/suspended-page/settings.php
[Fri Feb 27 12:27:36.690437 2026] [:error] [pid 54231:tid 54238] [client 68.183.194.94:49460] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/_profiler/"] [unique_id "aaEdOOTvb5AeyJCdY7Cj6gAAAEQ"]
[Fri Feb 27 12:27:37.924315 2026] [:error] [pid 49306:tid 49316] [client 68.183.194.94:50631] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/_profiler/"] [unique_id "aaEdOfnSUDZue59Px9vW2AAAAUg"]
[Fri Feb 27 12:27:44.696425 2026] [:error] [pid 52073:tid 52091] [client 68.183.194.94:50796] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/debug/"] [unique_id "aaEdQIa650YPyxXVeRbOmgAAAY8"]
[Fri Feb 27 12:27:51.187252 2026] [:error] [pid 52073:tid 52097] [client 68.183.194.94:51188] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tmp/phpinfo.php"] [unique_id "aaEdR4a650YPyxXVeRbOogAAAZU"]
[Fri Feb 27 12:27:54.829835 2026] [:error] [pid 52073:tid 52084] [client 68.183.194.94:51444] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tmp/phpinfo.php"] [unique_id "aaEdSoa650YPyxXVeRbOrAAAAYg"]
[Fri Feb 27 12:27:57.519635 2026] [:error] [pid 54101:tid 54130] [client 68.183.194.94:51601] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update.php"] [unique_id "aaEdTVY5qgRktcYTGFsKFAAAAdY"]
[Fri Feb 27 12:27:59.279806 2026] [:error] [pid 49306:tid 49314] [client 68.183.194.94:51732] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update.php"] [unique_id "aaEdT_nSUDZue59Px9vXTQAAAUY"]
[Fri Feb 27 12:28:03.061311 2026] [:error] [pid 54231:tid 54249] [client 68.183.194.94:51854] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaEdU-Tvb5AeyJCdY7Cj9QAAAE8"]
[Fri Feb 27 12:28:07.561245 2026] [:error] [pid 52073:tid 52093] [client 68.183.194.94:52087] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaEdV4a650YPyxXVeRbOvgAAAZE"]
[Fri Feb 27 12:28:10.258599 2026] [:error] [pid 52073:tid 52086] [client 68.183.194.94:52241] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/setup.php"] [unique_id "aaEdWoa650YPyxXVeRbOxAAAAYo"]
[Fri Feb 27 12:28:12.095655 2026] [:error] [pid 54231:tid 54238] [client 68.183.194.94:52403] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/setup.php"] [unique_id "aaEdXOTvb5AeyJCdY7Cj-wAAAEQ"]
[Fri Feb 27 12:28:14.676273 2026] [:error] [pid 52073:tid 52088] [client 68.183.194.94:52478] [client 68.183.194.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/setup.php"] [unique_id "aaEdXoa650YPyxXVeRbOzAAAAYw"]
[Fri Feb 27 13:49:24.259047 2026] [:error] [pid 56075:tid 56102] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Fri Feb 27 13:49:24.483231 2026] [:error] [pid 56075:tid 56083] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/work.php
[Fri Feb 27 13:49:24.734169 2026] [:error] [pid 56075:tid 56078] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/C.php
[Fri Feb 27 13:49:24.954504 2026] [:error] [pid 56075:tid 56095] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/ze.php
[Fri Feb 27 13:49:25.180086 2026] [:error] [pid 56075:tid 56084] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Fri Feb 27 13:49:25.398292 2026] [:error] [pid 56075:tid 56077] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/sc.php
[Fri Feb 27 13:49:25.617974 2026] [:error] [pid 56075:tid 56097] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/pouhg.php
[Fri Feb 27 13:49:25.847180 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/vgtyu.php
[Fri Feb 27 13:49:26.073348 2026] [:error] [pid 56075:tid 56100] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Fri Feb 27 13:49:26.291426 2026] [:error] [pid 56075:tid 56080] [client 4.204.200.32:60360] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Fri Feb 27 13:49:26.516016 2026] [:error] [pid 56075:tid 56093] [client 4.204.200.32:60360] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123.php"] [unique_id "aaEwZsKBhrfI6KNv9RjuxwAAAA8"]
[Fri Feb 27 13:49:27.311723 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:60412] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123.php"] [unique_id "aaEwZ4a650YPyxXVeRb7_gAAAYo"]
[Fri Feb 27 13:49:28.280189 2026] [:error] [pid 52073:tid 52099] [client 4.204.200.32:60318] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123.php"] [unique_id "aaEwaIa650YPyxXVeRb8AgAAAZc"]
[Fri Feb 27 13:49:29.214911 2026] [:error] [pid 49306:tid 49309] [client 4.204.200.32:60404] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123.php"] [unique_id "aaEwafnSUDZue59Px9sYJQAAAUE"]
[Fri Feb 27 13:49:30.129939 2026] [:error] [pid 49306:tid 49308] [client 4.204.200.32:60362] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaEwavnSUDZue59Px9sYKQAAAUA"]
[Fri Feb 27 13:49:30.951804 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:60357] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaEwavnSUDZue59Px9sYLgAAAVY"]
[Fri Feb 27 13:49:31.593299 2026] [:error] [pid 54103:tid 54195] [client 4.204.200.32:60413] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaEwa-vG4MPCmE0B2sBfgwAAANg"]
[Fri Feb 27 13:49:32.155656 2026] [:error] [pid 56075:tid 56080] [client 4.204.200.32:60405] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaEwbMKBhrfI6KNv9Rju2AAAAAM"]
[Fri Feb 27 13:49:33.000595 2026] [:error] [pid 56075:tid 56100] [client 4.204.200.32:60305] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaEwbMKBhrfI6KNv9Rju6AAAABY"]
[Fri Feb 27 13:49:34.416966 2026] [:error] [pid 54231:tid 54256] [client 4.204.200.32:60323] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaEwbuTvb5AeyJCdY7CyMgAAAFY"]
[Fri Feb 27 13:49:35.171832 2026] [:error] [pid 54231:tid 54239] [client 4.204.200.32:60373] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaEwb-Tvb5AeyJCdY7CyNAAAAEU"]
[Fri Feb 27 13:49:36.967570 2026] [:error] [pid 62998:tid 63017] [client 4.204.200.32:60321] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaEwcFQeueXZDUmoLonH_gAAAQ8"]
[Fri Feb 27 13:49:37.796438 2026] [:error] [pid 52073:tid 52076] [client 4.204.200.32:60376] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaEwcYa650YPyxXVeRb8GQAAAYA"]
[Fri Feb 27 13:49:38.948256 2026] [:error] [pid 49306:tid 49319] [client 4.204.200.32:60365] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaEwcvnSUDZue59Px9sYSAAAAUs"]
[Fri Feb 27 13:49:39.670764 2026] [:error] [pid 52073:tid 52100] [client 4.204.200.32:60306] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaEwc4a650YPyxXVeRb8IAAAAZg"]
[Fri Feb 27 13:49:40.863658 2026] [:error] [pid 56075:tid 56087] [client 4.204.200.32:60319] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seetox.php"] [unique_id "aaEwdMKBhrfI6KNv9Rju-AAAAAo"]
[Fri Feb 27 13:49:42.062892 2026] [:error] [pid 52073:tid 52077] [client 4.204.200.32:60375] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaEwdoa650YPyxXVeRb8JAAAAYE"]
[Fri Feb 27 13:49:43.043827 2026] [:error] [pid 52073:tid 52100] [client 4.204.200.32:60395] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaEwd4a650YPyxXVeRb8KwAAAZg"]
[Fri Feb 27 13:49:44.187733 2026] [:error] [pid 52073:tid 52084] [client 4.204.200.32:60352] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaEweIa650YPyxXVeRb8LwAAAYg"]
[Fri Feb 27 13:49:45.092153 2026] [:error] [pid 56075:tid 56080] [client 4.204.200.32:60299] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaEwecKBhrfI6KNv9RjvAgAAAAM"]
[Fri Feb 27 13:49:45.868349 2026] [:error] [pid 56075:tid 56084] [client 4.204.200.32:60300] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "aaEwecKBhrfI6KNv9RjvBAAAAAc"]
[Fri Feb 27 13:49:46.907131 2026] [:error] [pid 56075:tid 56094] [client 4.204.200.32:60297] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "aaEwesKBhrfI6KNv9RjvBQAAABA"]
[Fri Feb 27 13:49:47.666293 2026] [:error] [pid 56075:tid 56077] [client 4.204.200.32:60326] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "aaEwe8KBhrfI6KNv9RjvCAAAAAA"]
[Fri Feb 27 13:49:48.637704 2026] [:error] [pid 54231:tid 54241] [client 4.204.200.32:60294] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "aaEwfOTvb5AeyJCdY7CyPgAAAEc"]
[Fri Feb 27 13:49:49.678286 2026] [:error] [pid 54101:tid 54119] [client 4.204.200.32:60371] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samiri.php"] [unique_id "aaEwfVY5qgRktcYTGFsRLwAAAcs"]
[Fri Feb 27 13:49:50.656743 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:60370] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samiri.php"] [unique_id "aaEwfoa650YPyxXVeRb8OAAAAYo"]
[Fri Feb 27 13:49:51.307340 2026] [:error] [pid 56075:tid 56081] [client 4.204.200.32:60295] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samiri.php"] [unique_id "aaEwf8KBhrfI6KNv9RjvDAAAAAQ"]
[Fri Feb 27 13:49:52.458579 2026] [:error] [pid 54103:tid 54175] [client 4.204.200.32:60383] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samiri.php"] [unique_id "aaEwgOvG4MPCmE0B2sBfigAAAMQ"]
[Fri Feb 27 13:49:53.137364 2026] [:error] [pid 52073:tid 52084] [client 4.204.200.32:60344] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaEwgYa650YPyxXVeRb8OwAAAYg"]
[Fri Feb 27 13:49:54.673210 2026] [:error] [pid 54103:tid 54188] [client 4.204.200.32:60409] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaEwguvG4MPCmE0B2sBfjAAAANE"]
[Fri Feb 27 13:49:55.389157 2026] [:error] [pid 49306:tid 49319] [client 4.204.200.32:60336] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaEwg_nSUDZue59Px9sYYgAAAUs"]
[Fri Feb 27 13:49:56.097147 2026] [:error] [pid 56075:tid 56096] [client 4.204.200.32:60401] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaEwhMKBhrfI6KNv9RjvFAAAABI"]
[Fri Feb 27 13:49:57.949775 2026] [:error] [pid 54231:tid 54253] [client 4.204.200.32:60358] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aaEwheTvb5AeyJCdY7CyQQAAAFM"]
[Fri Feb 27 13:49:59.419153 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:60384] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aaEwh_nSUDZue59Px9sYcAAAAVY"]
[Fri Feb 27 13:50:00.604779 2026] [:error] [pid 49306:tid 49318] [client 4.204.200.32:60380] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aaEwiPnSUDZue59Px9sYdAAAAUo"]
[Fri Feb 27 13:50:01.308015 2026] [:error] [pid 54103:tid 54187] [client 4.204.200.32:60411] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "aaEwievG4MPCmE0B2sBfkQAAANA"]
[Fri Feb 27 13:50:02.335894 2026] [:error] [pid 49306:tid 49321] [client 4.204.200.32:60342] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaEwivnSUDZue59Px9sYewAAAU0"]
[Fri Feb 27 13:50:03.113705 2026] [:error] [pid 56075:tid 56099] [client 4.204.200.32:60369] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaEwi8KBhrfI6KNv9RjvJwAAABU"]
[Fri Feb 27 13:50:04.067758 2026] [:error] [pid 56075:tid 56090] [client 4.204.200.32:60400] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaEwjMKBhrfI6KNv9RjvMAAAAAw"]
[Fri Feb 27 13:50:04.885593 2026] [:error] [pid 49306:tid 49329] [client 4.204.200.32:60399] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaEwjPnSUDZue59Px9sYgAAAAVU"]
[Fri Feb 27 13:50:05.514213 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:64317] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aaEwjcKBhrfI6KNv9RjvOgAAAAg"]
[Fri Feb 27 13:50:06.728708 2026] [:error] [pid 62998:tid 63006] [client 4.204.200.32:60386] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aaEwjlQeueXZDUmoLonIFAAAAQQ"]
[Fri Feb 27 13:50:07.221743 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:48066] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aaEwj_nSUDZue59Px9sYjAAAAVY"]
[Fri Feb 27 13:50:08.523522 2026] [:error] [pid 62998:tid 63002] [client 4.204.200.32:60363] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "aaEwkFQeueXZDUmoLonIFQAAAQE"]
[Fri Feb 27 13:50:10.010506 2026] [:error] [pid 54102:tid 54144] [client 4.204.200.32:48095] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaEwkni74D4fiYUm_Gc2UgAAAIA"]
[Fri Feb 27 13:50:12.098163 2026] [:error] [pid 62998:tid 63023] [client 4.204.200.32:60396] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaEwlFQeueXZDUmoLonIGQAAARU"]
[Fri Feb 27 13:50:12.970866 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:60381] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaEwlPnSUDZue59Px9sYowAAAVY"]
[Fri Feb 27 13:50:14.263536 2026] [:error] [pid 49306:tid 49317] [client 4.204.200.32:60387] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaEwlvnSUDZue59Px9sYqAAAAUk"]
[Fri Feb 27 13:50:14.730810 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:60316] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaEwloa650YPyxXVeRb8YAAAAZE"]
[Fri Feb 27 13:50:15.524193 2026] [:error] [pid 52073:tid 52083] [client 4.204.200.32:60392] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaEwl4a650YPyxXVeRb8YQAAAYc"]
[Fri Feb 27 13:50:16.871965 2026] [:error] [pid 52073:tid 52090] [client 4.204.200.32:60406] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaEwmIa650YPyxXVeRb8ZQAAAY4"]
[Fri Feb 27 13:50:18.050285 2026] [:error] [pid 52073:tid 52088] [client 4.204.200.32:60291] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaEwmoa650YPyxXVeRb8agAAAYw"]
[Fri Feb 27 13:50:20.595000 2026] [:error] [pid 52073:tid 52079] [client 4.204.200.32:60407] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shas.php"] [unique_id "aaEwnIa650YPyxXVeRb8jAAAAYM"]
[Fri Feb 27 13:50:21.377121 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:60394] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shas.php"] [unique_id "aaEwncKBhrfI6KNv9RjvUgAAAAg"]
[Fri Feb 27 13:50:22.392092 2026] [:error] [pid 49306:tid 49327] [client 4.204.200.32:60334] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shas.php"] [unique_id "aaEwnvnSUDZue59Px9sYrgAAAVM"]
[Fri Feb 27 13:50:24.656248 2026] [:error] [pid 62998:tid 63018] [client 4.204.200.32:64266] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shas.php"] [unique_id "aaEwoFQeueXZDUmoLonIIAAAARA"]
[Fri Feb 27 13:50:27.286814 2026] [:error] [pid 49306:tid 49332] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Fri Feb 27 13:50:27.508943 2026] [:error] [pid 49306:tid 49327] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Fri Feb 27 13:50:27.726740 2026] [:error] [pid 49306:tid 49318] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/er.php
[Fri Feb 27 13:50:27.934474 2026] [:error] [pid 49306:tid 49325] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/fault.php
[Fri Feb 27 13:50:28.145779 2026] [:error] [pid 49306:tid 49323] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Feb 27 13:50:28.354956 2026] [:error] [pid 49306:tid 49312] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Fri Feb 27 13:50:28.563530 2026] [:error] [pid 49306:tid 49321] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/leuk.php
[Fri Feb 27 13:50:28.785346 2026] [:error] [pid 49306:tid 49311] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Fri Feb 27 13:50:28.996991 2026] [:error] [pid 49306:tid 49328] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/kolda.php
[Fri Feb 27 13:50:29.206735 2026] [:error] [pid 49306:tid 49329] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Fri Feb 27 13:50:29.416997 2026] [:error] [pid 49306:tid 49313] [client 4.204.200.32:60391] File does not exist: /usr/local/apache/htdocs/suspended-page/god.php
[Fri Feb 27 13:50:29.743842 2026] [:error] [pid 49306:tid 49310] [client 4.204.200.32:60391] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aaEwpfnSUDZue59Px9sYygAAAUI"]
[Fri Feb 27 13:50:30.397780 2026] [:error] [pid 56075:tid 56092] [client 4.204.200.32:60298] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aaEwpsKBhrfI6KNv9RjvWAAAAA4"]
[Fri Feb 27 13:50:31.205399 2026] [:error] [pid 49306:tid 49318] [client 4.204.200.32:60382] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aaEwp_nSUDZue59Px9sYzgAAAUo"]
[Fri Feb 27 13:50:32.012828 2026] [:error] [pid 62998:tid 63007] [client 4.204.200.32:64287] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "aaEwqFQeueXZDUmoLonILAAAAQU"]
[Fri Feb 27 13:50:32.737991 2026] [:error] [pid 56075:tid 56102] [client 4.204.200.32:60315] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaEwqMKBhrfI6KNv9RjvWwAAABg"]
[Fri Feb 27 13:50:33.583556 2026] [:error] [pid 56075:tid 56090] [client 4.204.200.32:60324] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaEwqcKBhrfI6KNv9RjvXAAAAAw"]
[Fri Feb 27 13:50:34.366264 2026] [:error] [pid 54231:tid 54257] [client 4.204.200.32:60301] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaEwquTvb5AeyJCdY7CyUwAAAFc"]
[Fri Feb 27 13:50:35.615074 2026] [:error] [pid 49306:tid 49329] [client 4.204.200.32:60364] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaEwq_nSUDZue59Px9sY1AAAAVU"]
[Fri Feb 27 13:50:37.097987 2026] [:error] [pid 62998:tid 63018] [client 4.204.200.32:60307] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaEwrVQeueXZDUmoLonIRgAAARA"]
[Fri Feb 27 13:50:37.780410 2026] [:error] [pid 62998:tid 63011] [client 4.204.200.32:64296] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaEwrVQeueXZDUmoLonISwAAAQk"]
[Fri Feb 27 13:50:38.627715 2026] [:error] [pid 49306:tid 49308] [client 4.204.200.32:64295] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaEwrvnSUDZue59Px9sY5wAAAUA"]
[Fri Feb 27 13:50:39.920138 2026] [:error] [pid 52073:tid 52084] [client 4.204.200.32:64281] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaEwr4a650YPyxXVeRb8vgAAAYg"]
[Fri Feb 27 13:50:40.985170 2026] [:error] [pid 62998:tid 63015] [client 4.204.200.32:60402] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaEwsFQeueXZDUmoLonIWQAAAQ0"]
[Fri Feb 27 13:50:41.953756 2026] [:error] [pid 49306:tid 49320] [client 4.204.200.32:60325] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaEwsfnSUDZue59Px9sY6wAAAUw"]
[Fri Feb 27 13:50:42.944921 2026] [:error] [pid 52073:tid 52080] [client 4.204.200.32:60385] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaEwsoa650YPyxXVeRb8wQAAAYQ"]
[Fri Feb 27 13:50:43.843800 2026] [:error] [pid 56075:tid 56088] [client 4.204.200.32:60408] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaEws8KBhrfI6KNv9RjvfQAAAAs"]
[Fri Feb 27 13:50:45.184844 2026] [:error] [pid 56075:tid 56090] [client 4.204.200.32:64277] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaEwtcKBhrfI6KNv9RjvfwAAAAw"]
[Fri Feb 27 13:50:45.952214 2026] [:error] [pid 49306:tid 49309] [client 4.204.200.32:64274] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaEwtfnSUDZue59Px9sY9QAAAUE"]
[Fri Feb 27 13:50:46.738211 2026] [:error] [pid 56075:tid 56094] [client 4.204.200.32:60296] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaEwtsKBhrfI6KNv9RjvggAAABA"]
[Fri Feb 27 13:50:47.631894 2026] [:error] [pid 56075:tid 56087] [client 4.204.200.32:60309] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaEwt8KBhrfI6KNv9RjvhgAAAAo"]
[Fri Feb 27 13:50:48.996616 2026] [:error] [pid 56075:tid 56097] [client 4.204.200.32:60308] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/login8.php"] [unique_id "aaEwuMKBhrfI6KNv9RjvigAAABM"]
[Fri Feb 27 13:50:50.424085 2026] [:error] [pid 49306:tid 49331] [client 4.204.200.32:60374] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/login8.php"] [unique_id "aaEwuvnSUDZue59Px9sZAwAAAVc"]
[Fri Feb 27 13:50:51.537210 2026] [:error] [pid 54231:tid 54254] [client 4.204.200.32:60393] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/login8.php"] [unique_id "aaEwu-Tvb5AeyJCdY7CyXAAAAFQ"]
[Fri Feb 27 13:50:52.183198 2026] [:error] [pid 54231:tid 54253] [client 4.204.200.32:60377] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/login8.php"] [unique_id "aaEwvOTvb5AeyJCdY7CyXwAAAFM"]
[Fri Feb 27 13:50:52.816743 2026] [:error] [pid 52073:tid 52100] [client 4.204.200.32:60341] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aaEwvIa650YPyxXVeRb8xgAAAZg"]
[Fri Feb 27 13:50:53.697822 2026] [:error] [pid 52073:tid 52081] [client 4.204.200.32:64302] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aaEwvYa650YPyxXVeRb8xwAAAYU"]
[Fri Feb 27 13:50:54.555286 2026] [:error] [pid 62998:tid 63006] [client 4.204.200.32:60348] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aaEwvlQeueXZDUmoLonIcwAAAQQ"]
[Fri Feb 27 13:50:55.283411 2026] [:error] [pid 62998:tid 63008] [client 4.204.200.32:48098] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nnyvn.php"] [unique_id "aaEwv1QeueXZDUmoLonIdAAAAQY"]
[Fri Feb 27 13:50:55.870408 2026] [:error] [pid 49306:tid 49316] [client 4.204.200.32:60338] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaEwv_nSUDZue59Px9sZDAAAAUg"]
[Fri Feb 27 13:50:56.806900 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:60361] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaEwwPnSUDZue59Px9sZDwAAAVY"]
[Fri Feb 27 13:50:57.880597 2026] [:error] [pid 62998:tid 63023] [client 4.204.200.32:60333] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaEwwVQeueXZDUmoLonIdwAAARU"]
[Fri Feb 27 13:50:58.498936 2026] [:error] [pid 49306:tid 49326] [client 4.204.200.32:60302] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaEwwvnSUDZue59Px9sZFQAAAVI"]
[Fri Feb 27 13:50:59.210358 2026] [:error] [pid 49306:tid 49325] [client 4.204.200.32:60356] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lul.php"] [unique_id "aaEww_nSUDZue59Px9sZGQAAAVE"]
[Fri Feb 27 13:50:59.979623 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:60312] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lul.php"] [unique_id "aaEww4a650YPyxXVeRb81QAAAYo"]
[Fri Feb 27 13:51:00.903333 2026] [:error] [pid 52073:tid 52081] [client 4.204.200.32:60354] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lul.php"] [unique_id "aaEwxIa650YPyxXVeRb82AAAAYU"]
[Fri Feb 27 13:51:01.651637 2026] [:error] [pid 62998:tid 63018] [client 4.204.200.32:64263] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lul.php"] [unique_id "aaEwxVQeueXZDUmoLonIegAAARA"]
[Fri Feb 27 13:51:02.529828 2026] [:error] [pid 62998:tid 63017] [client 4.204.200.32:64306] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaEwxlQeueXZDUmoLonIgAAAAQ8"]
[Fri Feb 27 13:51:03.278334 2026] [:error] [pid 52073:tid 52089] [client 4.204.200.32:60379] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaEwx4a650YPyxXVeRb82wAAAY0"]
[Fri Feb 27 13:51:04.145747 2026] [:error] [pid 52073:tid 52084] [client 4.204.200.32:60355] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaEwyIa650YPyxXVeRb84QAAAYg"]
[Fri Feb 27 13:51:04.978324 2026] [:error] [pid 56075:tid 56097] [client 4.204.200.32:60343] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaEwyMKBhrfI6KNv9RjvlwAAABM"]
[Fri Feb 27 13:51:05.887012 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:60335] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaEwyYa650YPyxXVeRb85wAAAZU"]
[Fri Feb 27 13:51:06.481604 2026] [:error] [pid 52073:tid 52076] [client 4.204.200.32:64310] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaEwyoa650YPyxXVeRb87wAAAYA"]
[Fri Feb 27 13:51:07.227506 2026] [:error] [pid 52073:tid 52087] [client 4.204.200.32:64260] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaEwy4a650YPyxXVeRb89gAAAYs"]
[Fri Feb 27 13:51:08.107158 2026] [:error] [pid 52073:tid 52077] [client 4.204.200.32:64289] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaEwzIa650YPyxXVeRb8-AAAAYE"]
[Fri Feb 27 13:51:09.322729 2026] [:error] [pid 52073:tid 52088] [client 4.204.200.32:48123] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ya.php"] [unique_id "aaEwzYa650YPyxXVeRb9AgAAAYw"]
[Fri Feb 27 13:51:09.961709 2026] [:error] [pid 52073:tid 52082] [client 4.204.200.32:60332] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ya.php"] [unique_id "aaEwzYa650YPyxXVeRb9CAAAAYY"]
[Fri Feb 27 13:51:10.561262 2026] [:error] [pid 62998:tid 63018] [client 4.204.200.32:48053] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ya.php"] [unique_id "aaEwzlQeueXZDUmoLonIjAAAARA"]
[Fri Feb 27 13:51:11.276994 2026] [:error] [pid 49306:tid 49328] [client 4.204.200.32:64309] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ya.php"] [unique_id "aaEwz_nSUDZue59Px9sZJgAAAVQ"]
[Fri Feb 27 13:51:12.146744 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:60289] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaEw0MKBhrfI6KNv9RjvmwAAAAg"]
[Fri Feb 27 13:51:13.137515 2026] [:error] [pid 54101:tid 54109] [client 4.204.200.32:64300] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaEw0VY5qgRktcYTGFsRPAAAAcE"]
[Fri Feb 27 13:51:13.894599 2026] [:error] [pid 54231:tid 54237] [client 4.204.200.32:60403] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaEw0eTvb5AeyJCdY7CyZwAAAEM"]
[Fri Feb 27 13:51:14.614975 2026] [:error] [pid 49306:tid 49313] [client 4.204.200.32:60410] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaEw0vnSUDZue59Px9sZKQAAAUU"]
[Fri Feb 27 13:51:15.352001 2026] [:error] [pid 49306:tid 49327] [client 4.204.200.32:60322] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaEw0_nSUDZue59Px9sZLQAAAVM"]
[Fri Feb 27 13:51:16.468698 2026] [:error] [pid 49306:tid 49328] [client 4.204.200.32:60317] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaEw1PnSUDZue59Px9sZMgAAAVQ"]
[Fri Feb 27 13:51:18.450284 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:60314] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaEw1oa650YPyxXVeRb9FQAAAYo"]
[Fri Feb 27 13:51:19.110658 2026] [:error] [pid 54103:tid 54192] [client 4.204.200.32:60328] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaEw1-vG4MPCmE0B2sBfrAAAANU"]
[Fri Feb 27 13:51:19.682678 2026] [:error] [pid 54231:tid 54247] [client 4.204.200.32:48084] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaEw1-Tvb5AeyJCdY7CyawAAAE0"]
[Fri Feb 27 13:51:20.432970 2026] [:error] [pid 49306:tid 49332] [client 4.204.200.32:48097] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaEw2PnSUDZue59Px9sZNgAAAVg"]
[Fri Feb 27 13:51:21.323600 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:64311] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaEw2fnSUDZue59Px9sZOgAAAVY"]
[Fri Feb 27 13:51:22.125306 2026] [:error] [pid 49306:tid 49329] [client 4.204.200.32:60290] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaEw2vnSUDZue59Px9sZRwAAAVU"]
[Fri Feb 27 13:51:22.818133 2026] [:error] [pid 54102:tid 54144] [client 4.204.200.32:48075] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaEw2ni74D4fiYUm_Gc2bwAAAIA"]
[Fri Feb 27 13:51:23.405824 2026] [:error] [pid 49306:tid 49323] [client 4.204.200.32:60368] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaEw2_nSUDZue59Px9sZTAAAAU8"]
[Fri Feb 27 13:51:24.013139 2026] [:error] [pid 62998:tid 63007] [client 4.204.200.32:64292] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaEw3FQeueXZDUmoLonIkQAAAQU"]
[Fri Feb 27 13:51:24.802301 2026] [:error] [pid 54101:tid 54113] [client 4.204.200.32:60303] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaEw3FY5qgRktcYTGFsRQgAAAcU"]
[Fri Feb 27 13:51:26.291222 2026] [:error] [pid 52073:tid 52078] [client 4.204.200.32:60313] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaEw3oa650YPyxXVeRb9PAAAAYI"]
[Fri Feb 27 13:51:27.374581 2026] [:error] [pid 62998:tid 63020] [client 4.204.200.32:64286] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaEw31QeueXZDUmoLonImQAAARI"]
[Fri Feb 27 13:51:27.954948 2026] [:error] [pid 56075:tid 56081] [client 4.204.200.32:60292] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaEw38KBhrfI6KNv9RjvpwAAAAQ"]
[Fri Feb 27 13:51:28.826720 2026] [:error] [pid 52073:tid 52082] [client 4.204.200.32:60304] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaEw4Ia650YPyxXVeRb9QwAAAYY"]
[Fri Feb 27 13:51:29.597956 2026] [:error] [pid 56075:tid 56092] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Feb 27 13:51:29.889158 2026] [:error] [pid 56075:tid 56088] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Fri Feb 27 13:51:30.265810 2026] [:error] [pid 56075:tid 56099] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Fri Feb 27 13:51:30.473283 2026] [:error] [pid 56075:tid 56102] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/fot.php
[Fri Feb 27 13:51:30.698072 2026] [:error] [pid 56075:tid 56095] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Fri Feb 27 13:51:30.905554 2026] [:error] [pid 56075:tid 56084] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Fri Feb 27 13:51:31.113077 2026] [:error] [pid 56075:tid 56094] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Fri Feb 27 13:51:31.837515 2026] [:error] [pid 56075:tid 56090] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Fri Feb 27 13:51:32.044966 2026] [:error] [pid 56075:tid 56100] [client 4.204.200.32:64257] File does not exist: /usr/local/apache/htdocs/suspended-page/ffd.php
[Fri Feb 27 15:46:13.652107 2026] [:error] [pid 49306:tid 49319] [client 103.156.164.118:633] [client 103.156.164.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.156.164.118, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaFLxfnSUDZue59Px9tpcAAAAUs"]
[Fri Feb 27 15:46:13.657483 2026] [:error] [pid 49306:tid 49319] [client 103.156.164.118:633] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 15:52:04.529657 2026] [:error] [pid 56075:tid 56084] [client 4.204.192.31:20465] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 17:33:21.114673 2026] [:error] [pid 49306:tid 49328] [client 20.53.240.38:10161] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Feb 27 17:33:21.128445 2026] [:error] [pid 49306:tid 49321] [client 20.53.240.38:10161] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Cookie/cloud.php"] [unique_id "aaFk4fnSUDZue59Px9ubWwAAAU0"]
[Fri Feb 27 17:33:21.228255 2026] [:error] [pid 49306:tid 49325] [client 20.53.240.38:9899] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/functions.php"] [unique_id "aaFk4fnSUDZue59Px9ubXgAAAVE"]
[Fri Feb 27 17:33:21.351596 2026] [:error] [pid 49306:tid 49317] [client 20.53.240.38:12050] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Feb 27 17:33:21.388592 2026] [:error] [pid 49306:tid 49315] [client 20.53.240.38:12050] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/flower.php"] [unique_id "aaFk4fnSUDZue59Px9ubZAAAAUc"]
[Fri Feb 27 17:33:21.472116 2026] [:error] [pid 49306:tid 49316] [client 20.53.240.38:25581] File does not exist: /usr/local/apache/htdocs/suspended-page/classsmtps.php
[Fri Feb 27 17:33:21.486192 2026] [:error] [pid 49306:tid 49322] [client 20.53.240.38:25581] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/block-bindings.php"] [unique_id "aaFk4fnSUDZue59Px9ubZwAAAU4"]
[Fri Feb 27 17:33:21.594141 2026] [:error] [pid 54231:tid 54238] [client 20.53.240.38:13582] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/root.php"] [unique_id "aaFk4eTvb5AeyJCdY7DasgAAAEQ"]
[Fri Feb 27 17:33:21.667208 2026] [:error] [pid 62998:tid 63007] [client 20.53.240.38:13589] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/xmrlpc.php
[Fri Feb 27 17:33:21.681400 2026] [:error] [pid 62998:tid 63010] [client 20.53.240.38:13589] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/index.php"] [unique_id "aaFk4VQeueXZDUmoLon_BAAAAQg"]
[Fri Feb 27 17:33:21.751442 2026] [:error] [pid 54103:tid 54186] [client 20.53.240.38:1370] [client 20.53.240.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaFk4evG4MPCmE0B2sB99AAAAM8"]
[Fri Feb 27 17:33:21.831037 2026] [:error] [pid 54102:tid 54155] [client 20.53.240.38:25949] [client 20.53.240.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaFk4Xi74D4fiYUm_GdPRgAAAIs"]
[Fri Feb 27 17:33:21.942839 2026] [:error] [pid 62998:tid 63008] [client 20.53.240.38:9898] [client 20.53.240.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaFk4VQeueXZDUmoLon_BQAAAQY"]
[Fri Feb 27 17:33:22.005644 2026] [:error] [pid 54103:tid 54195] [client 20.53.240.38:25957] [client 20.53.240.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaFk4uvG4MPCmE0B2sB99QAAANg"]
[Fri Feb 27 18:20:10.715857 2026] [:error] [pid 49306:tid 49325] [client 91.122.53.173:43620] [client 91.122.53.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "aaFv2vnSUDZue59Px9u1nAAAAVE"]
[Fri Feb 27 19:15:38.633583 2026] [:error] [pid 49306:tid 49308] [client 4.204.192.31:25571] [client 4.204.192.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asc.php"] [unique_id "aaF82vnSUDZue59Px9vVRAAAAUA"]
[Fri Feb 27 19:20:56.006447 2026] [:error] [pid 49306:tid 49313] [client 4.204.192.31:32531] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 20:23:21.015660 2026] [:error] [pid 56075:tid 56087] [client 20.220.8.221:46848] File does not exist: /usr/local/apache/htdocs/suspended-page/f.php
[Fri Feb 27 20:23:21.239470 2026] [:error] [pid 56075:tid 56101] [client 20.220.8.221:46848] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 20:23:21.653489 2026] [:error] [pid 56075:tid 56092] [client 20.220.8.221:46848] [client 20.220.8.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaGMucKBhrfI6KNv9RiTWAAAAA4"]
[Fri Feb 27 20:23:22.899755 2026] [:error] [pid 56075:tid 56078] [client 20.220.8.221:46496] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 20:23:23.318036 2026] [:error] [pid 56075:tid 56088] [client 20.220.8.221:46496] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Feb 27 20:23:23.939934 2026] [:error] [pid 56075:tid 56080] [client 20.220.8.221:46496] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaGMu8KBhrfI6KNv9RiTcQAAAAM"]
[Fri Feb 27 20:23:24.778174 2026] [:error] [pid 52073:tid 52079] [client 20.220.8.221:46520] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaGMvIa650YPyxXVeRYk_wAAAYM"]
[Fri Feb 27 20:23:25.614358 2026] [:error] [pid 52073:tid 52088] [client 20.220.8.221:46512] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaGMvYa650YPyxXVeRYlAQAAAYw"]
[Fri Feb 27 20:23:26.462730 2026] [:error] [pid 49306:tid 49328] [client 20.220.8.221:46503] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaGMvvnSUDZue59Px9v3rQAAAVQ"]
[Fri Feb 27 20:25:02.263006 2026] [:error] [pid 54102:tid 54161] [client 145.239.10.137:36226] File does not exist: /usr/local/apache/htdocs/suspended-page/n.php, referer: http://aoswa.com.au/n.php
[Fri Feb 27 20:25:04.633001 2026] [:error] [pid 56075:tid 56101] [client 145.239.10.137:48725] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php, referer: http://aoswa.com.au/s.php
[Fri Feb 27 21:33:12.006459 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.81:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Feb 27 21:33:12.237519 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.81:55401] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 21:33:12.801425 2026] [:error] [pid 56075:tid 56085] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Feb 27 21:33:13.017868 2026] [:error] [pid 56075:tid 56080] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Feb 27 21:33:13.236036 2026] [:error] [pid 56075:tid 56084] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Feb 27 21:33:13.476408 2026] [:error] [pid 56075:tid 56084] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 27 21:33:13.711585 2026] [:error] [pid 56075:tid 56083] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 27 21:33:13.947335 2026] [:error] [pid 56075:tid 56090] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 21:33:14.508865 2026] [:error] [pid 56075:tid 56087] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Feb 27 21:33:14.976836 2026] [:error] [pid 56075:tid 56082] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Feb 27 21:33:15.227111 2026] [:error] [pid 56075:tid 56082] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Feb 27 21:33:15.454820 2026] [:error] [pid 56075:tid 56082] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 21:33:15.851241 2026] [:error] [pid 56075:tid 56082] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Feb 27 21:33:16.144145 2026] [:error] [pid 56075:tid 56099] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 21:33:16.431546 2026] [:error] [pid 56075:tid 56090] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Feb 27 21:33:16.713273 2026] [:error] [pid 56075:tid 56090] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Feb 27 21:33:17.011408 2026] [:error] [pid 56075:tid 56078] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Feb 27 21:33:17.267008 2026] [:error] [pid 56075:tid 56097] [client 209.87.169.174:36163] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Feb 27 21:33:20.739218 2026] [:error] [pid 56075:tid 56087] [client 209.87.169.174:36163] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaGdIMKBhrfI6KNv9RjhiwAAAAo"]
[Fri Feb 27 21:33:21.441844 2026] [:error] [pid 54102:tid 54147] [client 45.131.195.249:60857] [client 45.131.195.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/admin.php"] [unique_id "aaGdIXi74D4fiYUm_Gd48QAAAIM"]
[Fri Feb 27 21:33:22.447168 2026] [:error] [pid 54103:tid 54175] [client 45.131.195.57:59349] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaGdIuvG4MPCmE0B2sCutwAAAMQ"]
[Fri Feb 27 21:33:23.757557 2026] [:error] [pid 54231:tid 54255] [client 45.131.195.72:61821] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Feb 27 21:33:24.517896 2026] [:error] [pid 54231:tid 54235] [client 45.131.195.72:61821] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaGdJOTvb5AeyJCdY7AcNQAAAEE"]
[Fri Feb 27 21:33:25.524570 2026] [:error] [pid 54231:tid 54240] [client 45.131.195.58:46893] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 21:33:25.750109 2026] [:error] [pid 54231:tid 54254] [client 45.131.195.58:46893] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaGdJeTvb5AeyJCdY7AcRgAAAFQ"]
[Fri Feb 27 21:33:26.452697 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.104:53767] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Feb 27 21:33:27.652231 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.104:53767] [client 45.131.195.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaGdJ8KBhrfI6KNv9RjiLwAAABA"]
[Fri Feb 27 21:33:28.393566 2026] [:error] [pid 49306:tid 49329] [client 45.131.195.62:20547] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaGdKPnSUDZue59Px9soDQAAAVU"]
[Fri Feb 27 21:33:28.855959 2026] [:error] [pid 52073:tid 52100] [client 45.131.195.109:50131] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaGdKIa650YPyxXVeRZtVwAAAZg"]
[Fri Feb 27 21:33:29.322097 2026] [:error] [pid 52073:tid 52097] [client 45.131.195.62:30461] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaGdKYa650YPyxXVeRZtZAAAAZU"]
[Fri Feb 27 21:33:29.743942 2026] [:error] [pid 54103:tid 54184] [client 45.131.195.99:50905] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaGdKevG4MPCmE0B2sCvAQAAAM0"]
[Fri Feb 27 21:33:31.289364 2026] [:error] [pid 54102:tid 54160] [client 45.131.195.60:51629] [client 45.131.195.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaGdK3i74D4fiYUm_Gd5egAAAJA"]
[Fri Feb 27 21:33:31.984152 2026] [:error] [pid 54103:tid 54170] [client 45.131.195.55:38607] [client 45.131.195.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaGdK-vG4MPCmE0B2sCvHQAAAMA"]
[Fri Feb 27 21:33:32.430501 2026] [:error] [pid 56075:tid 56084] [client 45.131.195.84:29769] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Feb 27 21:33:32.916766 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.84:29769] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aaGdLMKBhrfI6KNv9RjilwAAAA0"]
[Fri Feb 27 21:33:33.825300 2026] [:error] [pid 54103:tid 54185] [client 45.131.195.85:40521] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaGdLevG4MPCmE0B2sCvNgAAAM4"]
[Fri Feb 27 21:33:34.664272 2026] [:error] [pid 54103:tid 54184] [client 45.131.195.63:54809] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaGdLuvG4MPCmE0B2sCvPQAAAM0"]
[Fri Feb 27 21:33:35.168629 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.59:57153] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Feb 27 21:33:35.408233 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.59:57153] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaGdL8KBhrfI6KNv9RjiygAAAA0"]
[Fri Feb 27 21:33:35.882967 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.56:38685] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Feb 27 21:33:36.598613 2026] [:error] [pid 56075:tid 56088] [client 45.131.195.56:38685] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Feb 27 21:33:37.320261 2026] [:error] [pid 56075:tid 56078] [client 45.131.195.56:38685] [client 45.131.195.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaGdMcKBhrfI6KNv9Rji6gAAAAE"]
[Fri Feb 27 21:33:37.766009 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.106:29385] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Fri Feb 27 21:33:38.115311 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.106:29385] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaGdMoa650YPyxXVeRZuBwAAAZA"]
[Fri Feb 27 21:33:38.632970 2026] [:error] [pid 54231:tid 54237] [client 45.131.195.52:58571] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Feb 27 21:33:39.101299 2026] [:error] [pid 54231:tid 54242] [client 45.131.195.52:58571] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaGdM-Tvb5AeyJCdY7AcmwAAAEg"]
[Fri Feb 27 21:33:39.902220 2026] [:error] [pid 62998:tid 63013] [client 45.131.195.78:25613] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaGdM1QeueXZDUmoLolWHgAAAQs"]
[Fri Feb 27 21:33:40.563784 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.105:32753] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Fri Feb 27 21:33:40.797200 2026] [:error] [pid 56075:tid 56092] [client 45.131.195.105:32753] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Feb 27 21:33:41.287798 2026] [:error] [pid 56075:tid 56096] [client 45.131.195.105:32753] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaGdNcKBhrfI6KNv9RjjQQAAABI"]
[Fri Feb 27 21:33:41.999183 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.72:36691] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaGdNYa650YPyxXVeRZuPAAAAZI"]
[Fri Feb 27 21:33:42.793244 2026] [:error] [pid 49306:tid 49326] [client 45.131.195.105:31823] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaGdNvnSUDZue59Px9sovAAAAVI"]
[Fri Feb 27 21:33:43.248342 2026] [:error] [pid 52073:tid 52094] [client 209.87.169.174:37539] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaGdN4a650YPyxXVeRZuUQAAAZI"]
[Fri Feb 27 21:33:43.712184 2026] [:error] [pid 54101:tid 54129] [client 45.131.195.82:40337] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaGdN1Y5qgRktcYTGFtKuwAAAdU"]
[Fri Feb 27 21:33:49.054155 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.100:28165] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Feb 27 21:33:49.271533 2026] [:error] [pid 56075:tid 56097] [client 45.131.195.100:28165] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaGdPcKBhrfI6KNv9RjjrgAAABM"]
[Fri Feb 27 21:33:49.850196 2026] [:error] [pid 54103:tid 54181] [client 45.131.195.79:37623] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaGdPevG4MPCmE0B2sCv6wAAAMo"]
[Fri Feb 27 21:33:50.412188 2026] [:error] [pid 52073:tid 52089] [client 45.131.195.69:60657] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaGdPoa650YPyxXVeRZuvQAAAY0"]
[Fri Feb 27 21:33:51.312887 2026] [:error] [pid 56075:tid 56090] [client 45.131.195.80:40861] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 27 21:33:51.803559 2026] [:error] [pid 56075:tid 56093] [client 45.131.195.80:40861] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Feb 27 21:33:52.765815 2026] [:error] [pid 56075:tid 56081] [client 45.131.195.80:40861] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaGdQMKBhrfI6KNv9Rjj-QAAAAQ"]
[Fri Feb 27 21:33:54.006218 2026] [:error] [pid 52073:tid 52088] [client 45.131.195.60:44735] [client 45.131.195.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.60, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaGdQoa650YPyxXVeRZu9AAAAYw"]
[Fri Feb 27 21:33:54.274594 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.60:44735] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 27 21:33:55.487646 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.60:44735] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Feb 27 21:33:55.720846 2026] [:error] [pid 52073:tid 52093] [client 45.131.195.60:44735] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 21:33:56.919455 2026] [:error] [pid 52073:tid 52100] [client 45.131.195.60:44735] [client 45.131.195.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaGdRIa650YPyxXVeRZvFwAAAZg"]
[Fri Feb 27 21:33:57.690403 2026] [:error] [pid 56075:tid 56101] [client 45.131.195.80:36685] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Fri Feb 27 21:33:57.910190 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.80:36685] [client 45.131.195.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.80, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaGdRcKBhrfI6KNv9RjkYAAAAA0"]
[Fri Feb 27 21:33:58.402947 2026] [:error] [pid 56075:tid 56088] [client 45.131.195.80:36685] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aaGdRsKBhrfI6KNv9RjkbAAAAAs"]
[Fri Feb 27 21:33:59.900869 2026] [:error] [pid 56075:tid 56081] [client 45.131.195.90:34619] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 21:34:00.345262 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.90:34619] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Fri Feb 27 21:34:00.935084 2026] [:error] [pid 56075:tid 56100] [client 45.131.195.90:34619] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaGdSMKBhrfI6KNv9RjkpQAAABY"]
[Fri Feb 27 21:34:01.410771 2026] [:error] [pid 54101:tid 54120] [client 45.131.195.71:58493] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 27 21:34:02.320925 2026] [:error] [pid 54101:tid 54116] [client 45.131.195.71:58493] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Fri Feb 27 21:34:02.911351 2026] [:error] [pid 54101:tid 54120] [client 45.131.195.71:58493] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Fri Feb 27 21:34:03.428272 2026] [:error] [pid 54101:tid 54110] [client 45.131.195.71:58493] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Feb 27 21:34:03.667000 2026] [:error] [pid 54101:tid 54127] [client 45.131.195.71:58493] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaGdS1Y5qgRktcYTGFtLgAAAAdM"]
[Fri Feb 27 21:34:04.145625 2026] [:error] [pid 54103:tid 54190] [client 45.131.195.79:31049] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Feb 27 21:34:04.397455 2026] [:error] [pid 54103:tid 54187] [client 45.131.195.79:31049] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Feb 27 21:34:04.637677 2026] [:error] [pid 54103:tid 54179] [client 45.131.195.79:31049] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaGdTOvG4MPCmE0B2sCwSwAAAMg"]
[Fri Feb 27 21:34:05.350578 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.104:64237] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Feb 27 21:34:05.842240 2026] [:error] [pid 49306:tid 49317] [client 45.131.195.104:64237] [client 45.131.195.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.104, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaGdTfnSUDZue59Px9sp9gAAAUk"]
[Fri Feb 27 21:34:06.293501 2026] [:error] [pid 49306:tid 49328] [client 45.131.195.104:64237] [client 45.131.195.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaGdTvnSUDZue59Px9sp_gAAAVQ"]
[Fri Feb 27 21:34:10.568015 2026] [:error] [pid 54231:tid 54249] [client 45.131.195.65:27909] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Fri Feb 27 21:34:12.037080 2026] [:error] [pid 54231:tid 54242] [client 45.131.195.65:27909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Feb 27 21:34:12.303277 2026] [:error] [pid 54231:tid 54236] [client 45.131.195.65:27909] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaGdVOTvb5AeyJCdY7AdlwAAAEI"]
[Fri Feb 27 21:34:12.801631 2026] [:error] [pid 52073:tid 52090] [client 45.131.195.56:52223] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Feb 27 21:34:13.460147 2026] [:error] [pid 52073:tid 52100] [client 45.131.195.56:52223] [client 45.131.195.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.56, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaGdVYa650YPyxXVeRZv4QAAAZg"]
[Fri Feb 27 21:34:13.738560 2026] [:error] [pid 52073:tid 52076] [client 45.131.195.56:52223] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Feb 27 21:34:13.972741 2026] [:error] [pid 52073:tid 52089] [client 45.131.195.56:52223] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Fri Feb 27 21:34:14.217823 2026] [:error] [pid 52073:tid 52090] [client 45.131.195.56:52223] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Fri Feb 27 21:34:14.443291 2026] [:error] [pid 52073:tid 52088] [client 45.131.195.56:52223] [client 45.131.195.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaGdVoa650YPyxXVeRZv6wAAAYw"]
[Fri Feb 27 21:34:14.915375 2026] [:error] [pid 54101:tid 54114] [client 45.131.195.55:45671] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Feb 27 21:34:15.140305 2026] [:error] [pid 54101:tid 54125] [client 45.131.195.55:45671] [client 45.131.195.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aaGdV1Y5qgRktcYTGFtL0wAAAdE"]
[Fri Feb 27 21:34:15.820648 2026] [:error] [pid 62998:tid 63015] [client 45.131.195.59:31915] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Feb 27 21:34:16.042894 2026] [:error] [pid 62998:tid 63008] [client 45.131.195.59:31915] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaGdWFQeueXZDUmoLolX-gAAAQY"]
[Fri Feb 27 21:34:17.006800 2026] [:error] [pid 52073:tid 52082] [client 45.131.195.248:21621] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Fri Feb 27 21:34:17.239109 2026] [:error] [pid 52073:tid 52084] [client 45.131.195.248:21621] [client 45.131.195.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaGdWYa650YPyxXVeRZwIAAAAYg"]
[Fri Feb 27 21:34:17.675069 2026] [:error] [pid 54103:tid 54187] [client 45.131.195.75:59393] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaGdWevG4MPCmE0B2sCwlgAAANA"]
[Fri Feb 27 21:34:18.134311 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.111:53091] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Feb 27 21:34:18.366162 2026] [:error] [pid 52073:tid 52089] [client 45.131.195.111:53091] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Fri Feb 27 21:34:19.366507 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.111:53091] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaGdW4a650YPyxXVeRZwOAAAAZI"]
[Fri Feb 27 21:34:20.045718 2026] [:error] [pid 49306:tid 49319] [client 45.131.195.95:21239] [client 45.131.195.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaGdXPnSUDZue59Px9sqgwAAAUs"]
[Fri Feb 27 21:34:21.202128 2026] [:error] [pid 49306:tid 49319] [client 45.131.195.67:61359] [client 45.131.195.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aaGdXfnSUDZue59Px9sqpQAAAUs"]
[Fri Feb 27 21:34:21.668708 2026] [:error] [pid 54103:tid 54189] [client 45.131.195.78:57209] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Fri Feb 27 21:34:22.137826 2026] [:error] [pid 54103:tid 54182] [client 45.131.195.78:57209] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Feb 27 21:34:22.386945 2026] [:error] [pid 54103:tid 54177] [client 45.131.195.78:57209] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaGdXuvG4MPCmE0B2sCw0AAAAMY"]
[Fri Feb 27 21:34:22.855312 2026] [:error] [pid 62998:tid 63001] [client 45.131.195.95:56039] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 27 21:34:23.374265 2026] [:error] [pid 62998:tid 63019] [client 45.131.195.95:56039] [client 45.131.195.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aaGdX1QeueXZDUmoLolYJQAAARE"]
[Fri Feb 27 21:34:24.490633 2026] [:error] [pid 54231:tid 54243] [client 45.131.195.67:23135] [client 45.131.195.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaGdYOTvb5AeyJCdY7AeAwAAAEk"]
[Fri Feb 27 21:34:25.260843 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.61:58997] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Feb 27 21:34:25.941658 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.61:58997] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Fri Feb 27 21:34:26.544356 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.61:58997] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Feb 27 21:34:26.767181 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.61:58997] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaGdYoa650YPyxXVeRZwkgAAAYU"]
[Fri Feb 27 21:34:27.247779 2026] [:error] [pid 62998:tid 63011] [client 45.131.195.85:57543] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaGdY1QeueXZDUmoLolYUAAAAQk"]
[Fri Feb 27 21:34:27.703448 2026] [:error] [pid 56075:tid 56092] [client 45.131.195.248:39105] [client 45.131.195.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaGdY8KBhrfI6KNv9RjmDgAAAA4"]
[Fri Feb 27 21:34:28.138249 2026] [:error] [pid 54231:tid 54240] [client 45.131.195.65:45201] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaGdZOTvb5AeyJCdY7AeHwAAAEY"]
[Fri Feb 27 21:34:28.581115 2026] [:error] [pid 49306:tid 49322] [client 45.131.195.79:49465] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Fri Feb 27 21:34:28.801618 2026] [:error] [pid 49306:tid 49320] [client 45.131.195.79:49465] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaGdZPnSUDZue59Px9srBgAAAUw"]
[Fri Feb 27 21:34:29.240124 2026] [:error] [pid 54231:tid 54251] [client 45.131.195.60:38311] [client 45.131.195.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaGdZeTvb5AeyJCdY7AeLgAAAFE"]
[Fri Feb 27 21:34:29.702657 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.54:53183] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Fri Feb 27 21:34:30.229404 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.54:53183] [client 45.131.195.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaGdZoa650YPyxXVeRZwzwAAAYs"]
[Fri Feb 27 21:34:30.664200 2026] [:error] [pid 54101:tid 54109] [client 45.131.195.52:57701] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaGdZlY5qgRktcYTGFtMDQAAAcE"]
[Fri Feb 27 21:34:31.303644 2026] [:error] [pid 54102:tid 54147] [client 45.131.195.72:35793] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaGdZ3i74D4fiYUm_Gd7gQAAAIM"]
[Fri Feb 27 21:34:31.771852 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.74:25949] [client 45.131.195.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaGdZ4a650YPyxXVeRZw4wAAAYo"]
[Fri Feb 27 21:34:32.463243 2026] [:error] [pid 52073:tid 52099] [client 45.131.195.53:31747] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaGdaIa650YPyxXVeRZw8wAAAZc"]
[Fri Feb 27 21:34:33.410641 2026] [:error] [pid 62998:tid 63021] [client 45.131.195.65:30677] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaGdaVQeueXZDUmoLolYkwAAARM"]
[Fri Feb 27 21:34:33.867717 2026] [:error] [pid 52073:tid 52088] [client 45.131.195.101:34521] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Feb 27 21:34:34.554047 2026] [:error] [pid 52073:tid 52076] [client 45.131.195.101:34521] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Fri Feb 27 21:34:34.784336 2026] [:error] [pid 52073:tid 52084] [client 45.131.195.101:34521] [client 45.131.195.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaGdaoa650YPyxXVeRZxGwAAAYg"]
[Fri Feb 27 21:34:35.636587 2026] [:error] [pid 56075:tid 56093] [client 45.131.195.77:33745] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Fri Feb 27 21:34:35.888427 2026] [:error] [pid 56075:tid 56099] [client 45.131.195.77:33745] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Feb 27 21:34:37.141228 2026] [:error] [pid 56075:tid 56087] [client 45.131.195.77:33745] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaGdbcKBhrfI6KNv9RjmewAAAAo"]
[Fri Feb 27 21:34:38.338411 2026] [:error] [pid 56075:tid 56083] [client 45.131.195.78:53949] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaGdbsKBhrfI6KNv9RjmkgAAAAY"]
[Fri Feb 27 21:34:38.824597 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.58:39627] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaGdboa650YPyxXVeRZxeQAAAYo"]
[Fri Feb 27 21:34:40.349203 2026] [:error] [pid 62998:tid 63018] [client 45.131.195.53:54333] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaGdcFQeueXZDUmoLolYrQAAARA"]
[Fri Feb 27 21:34:41.424516 2026] [:error] [pid 54103:tid 54178] [client 45.131.195.76:60759] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Fri Feb 27 21:34:41.645996 2026] [:error] [pid 54103:tid 54185] [client 45.131.195.76:60759] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Fri Feb 27 21:34:41.902490 2026] [:error] [pid 54103:tid 54191] [client 45.131.195.76:60759] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Fri Feb 27 21:34:42.137981 2026] [:error] [pid 54103:tid 54187] [client 45.131.195.76:60759] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Fri Feb 27 21:34:43.311332 2026] [:error] [pid 54103:tid 54178] [client 45.131.195.76:60759] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaGdc-vG4MPCmE0B2sCxiQAAAMc"]
[Fri Feb 27 21:34:43.742216 2026] [:error] [pid 62998:tid 63011] [client 45.131.195.65:26079] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaGdc1QeueXZDUmoLolYzQAAAQk"]
[Fri Feb 27 21:34:44.240886 2026] [:error] [pid 62998:tid 63002] [client 45.131.195.62:36209] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaGddFQeueXZDUmoLolY0wAAAQE"]
[Fri Feb 27 21:34:44.681235 2026] [:error] [pid 49306:tid 49324] [client 45.131.195.82:24877] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaGddPnSUDZue59Px9srmwAAAVA"]
[Fri Feb 27 21:34:45.122625 2026] [:error] [pid 49306:tid 49319] [client 45.131.195.89:21299] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaGddfnSUDZue59Px9srowAAAUs"]
[Fri Feb 27 21:34:45.699464 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.73:31849] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaGddYa650YPyxXVeRZxxgAAAZA"]
[Fri Feb 27 21:34:46.338458 2026] [:error] [pid 54102:tid 54159] [client 45.131.195.91:24249] [client 45.131.195.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaGddni74D4fiYUm_Gd7wgAAAI8"]
[Fri Feb 27 21:34:46.827903 2026] [:error] [pid 54103:tid 54176] [client 45.131.195.249:64523] [client 45.131.195.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaGdduvG4MPCmE0B2sCxrAAAAMU"]
[Fri Feb 27 21:34:47.268689 2026] [:error] [pid 54102:tid 54149] [client 45.131.195.55:63333] [client 45.131.195.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaGdd3i74D4fiYUm_Gd7ygAAAIU"]
[Fri Feb 27 21:34:47.770909 2026] [:error] [pid 62998:tid 63013] [client 45.131.195.73:41647] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaGdd1QeueXZDUmoLolY7QAAAQs"]
[Fri Feb 27 21:34:48.817694 2026] [:error] [pid 62998:tid 63017] [client 45.131.195.248:37229] [client 45.131.195.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaGdeFQeueXZDUmoLolZBQAAAQ8"]
[Fri Feb 27 21:34:49.554952 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.109:60167] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaGdefnSUDZue59Px9sr8gAAAUU"]
[Fri Feb 27 21:34:50.008458 2026] [:error] [pid 49306:tid 49312] [client 45.131.195.90:62809] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Feb 27 21:34:50.466555 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.90:62809] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaGdevnSUDZue59Px9ssFgAAAUE"]
[Fri Feb 27 21:34:51.536353 2026] [:error] [pid 62998:tid 63024] [client 45.131.195.75:60055] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaGde1QeueXZDUmoLolZIwAAARY"]
[Fri Feb 27 21:34:52.606785 2026] [:error] [pid 54231:tid 54253] [client 45.131.195.53:43347] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Feb 27 21:34:52.837082 2026] [:error] [pid 54231:tid 54249] [client 45.131.195.53:43347] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaGdfOTvb5AeyJCdY7Ae5AAAAE8"]
[Fri Feb 27 21:34:53.782750 2026] [:error] [pid 54231:tid 54242] [client 45.131.195.85:27047] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Fri Feb 27 21:34:54.011333 2026] [:error] [pid 54231:tid 54234] [client 45.131.195.85:27047] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Fri Feb 27 21:34:54.258527 2026] [:error] [pid 54231:tid 54256] [client 45.131.195.85:27047] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Fri Feb 27 21:34:54.500278 2026] [:error] [pid 54231:tid 54235] [client 45.131.195.85:27047] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaGdfuTvb5AeyJCdY7Ae9QAAAEE"]
[Fri Feb 27 21:34:54.959243 2026] [:error] [pid 54102:tid 54163] [client 45.131.195.64:64297] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Feb 27 21:34:55.183817 2026] [:error] [pid 54102:tid 54168] [client 45.131.195.64:64297] [client 45.131.195.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaGdf3i74D4fiYUm_Gd8CQAAAJc"]
[Fri Feb 27 21:34:58.900905 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.85:38173] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 21:34:59.156098 2026] [:error] [pid 49306:tid 49314] [client 45.131.195.85:38173] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 27 21:34:59.403575 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.85:38173] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Fri Feb 27 21:35:00.891627 2026] [:error] [pid 49306:tid 49323] [client 45.131.195.85:38173] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Feb 27 21:35:01.142258 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.85:38173] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Fri Feb 27 21:35:01.979793 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.85:38173] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Fri Feb 27 21:35:03.595301 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.85:38173] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Feb 27 21:35:03.919717 2026] [:error] [pid 49306:tid 49329] [client 45.131.195.85:38173] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaGdh_nSUDZue59Px9sspQAAAVU"]
[Fri Feb 27 21:35:04.469157 2026] [:error] [pid 52073:tid 52082] [client 45.131.195.82:44263] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaGdiIa650YPyxXVeRZyygAAAYY"]
[Fri Feb 27 21:35:05.026805 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.70:41039] [client 45.131.195.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.70, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaGdiYa650YPyxXVeRZy2wAAAYE"]
[Fri Feb 27 21:35:05.031706 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.70:41039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 27 21:35:05.278448 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.70:41039] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Fri Feb 27 21:35:05.528141 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.70:41039] [client 45.131.195.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaGdiYa650YPyxXVeRZy7gAAAYM"]
[Fri Feb 27 21:35:06.345829 2026] [:error] [pid 54102:tid 54146] [client 45.131.195.73:36635] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Feb 27 21:35:06.579102 2026] [:error] [pid 54102:tid 54164] [client 45.131.195.73:36635] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaGdini74D4fiYUm_Gd8ZAAAAJQ"]
[Fri Feb 27 21:35:07.012047 2026] [:error] [pid 56075:tid 56095] [client 45.131.195.65:39603] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaGdi8KBhrfI6KNv9Rjn3AAAABE"]
[Fri Feb 27 21:35:08.433706 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.86:20705] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaGdjMKBhrfI6KNv9RjoCgAAABA"]
[Fri Feb 27 21:35:08.893306 2026] [:error] [pid 54103:tid 54195] [client 45.131.195.74:41013] [client 45.131.195.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaGdjOvG4MPCmE0B2sCyYwAAANg"]
[Fri Feb 27 21:35:10.040769 2026] [:error] [pid 56075:tid 56100] [client 45.131.195.106:23875] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Fri Feb 27 21:35:10.525901 2026] [:error] [pid 56075:tid 56092] [client 45.131.195.106:23875] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaGdjsKBhrfI6KNv9RjoSQAAAA4"]
[Fri Feb 27 21:35:11.398236 2026] [:error] [pid 54103:tid 54191] [client 45.131.195.64:21407] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Fri Feb 27 21:35:11.887039 2026] [:error] [pid 54103:tid 54195] [client 45.131.195.64:21407] [client 45.131.195.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aaGdj-vG4MPCmE0B2sCymAAAANg"]
[Fri Feb 27 21:35:12.344155 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.62:51919] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaGdkIa650YPyxXVeRZzMQAAAYE"]
[Fri Feb 27 21:35:13.054650 2026] [:error] [pid 54102:tid 54158] [client 45.131.195.81:63981] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Fri Feb 27 21:35:13.312503 2026] [:error] [pid 54102:tid 54150] [client 45.131.195.81:63981] [client 45.131.195.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaGdkXi74D4fiYUm_Gd8gAAAAIY"]
[Fri Feb 27 21:35:13.765276 2026] [:error] [pid 54103:tid 54183] [client 45.131.195.59:41757] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaGdkevG4MPCmE0B2sCytgAAAMw"]
[Fri Feb 27 21:35:14.735677 2026] [:error] [pid 62998:tid 63013] [client 209.87.169.174:33291] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Fri Feb 27 21:35:14.971742 2026] [:error] [pid 62998:tid 63025] [client 209.87.169.174:33291] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Fri Feb 27 21:35:15.458110 2026] [:error] [pid 62998:tid 63026] [client 209.87.169.174:33291] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Fri Feb 27 21:35:16.025730 2026] [:error] [pid 62998:tid 63019] [client 209.87.169.174:33291] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaGdlFQeueXZDUmoLolZ8AAAARE"]
[Fri Feb 27 21:35:16.465658 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.95:65185] [client 45.131.195.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaGdlIa650YPyxXVeRZzYgAAAYM"]
[Fri Feb 27 21:35:17.738492 2026] [:error] [pid 54101:tid 54130] [client 45.131.195.63:45159] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 21:35:17.960201 2026] [:error] [pid 54101:tid 54126] [client 45.131.195.63:45159] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aaGdlVY5qgRktcYTGFtM4wAAAdI"]
[Fri Feb 27 21:35:21.274217 2026] [:error] [pid 52073:tid 52084] [client 45.131.195.61:61859] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaGdmYa650YPyxXVeRZzjQAAAYg"]
[Fri Feb 27 21:35:21.766226 2026] [:error] [pid 62998:tid 63002] [client 209.87.169.174:53777] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaGdmVQeueXZDUmoLolaQAAAAQE"]
[Fri Feb 27 21:35:23.273276 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.106:32403] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Fri Feb 27 21:35:23.487015 2026] [:error] [pid 52073:tid 52085] [client 45.131.195.106:32403] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaGdm4a650YPyxXVeRZzpwAAAYk"]
[Fri Feb 27 21:35:24.424177 2026] [:error] [pid 54231:tid 54248] [client 45.131.195.63:56235] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaGdnOTvb5AeyJCdY7Af7QAAAE4"]
[Fri Feb 27 21:35:24.868271 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.71:59259] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Feb 27 21:35:25.126090 2026] [:error] [pid 56075:tid 56098] [client 45.131.195.71:59259] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Fri Feb 27 21:35:25.570654 2026] [:error] [pid 56075:tid 56102] [client 45.131.195.71:59259] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Fri Feb 27 21:35:26.515166 2026] [:error] [pid 56075:tid 56092] [client 45.131.195.71:59259] [client 45.131.195.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.71, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aaGdnsKBhrfI6KNv9RjpFgAAAA4"]
[Fri Feb 27 21:35:27.110425 2026] [:error] [pid 56075:tid 56099] [client 45.131.195.71:59259] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Fri Feb 27 21:35:27.354798 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.71:59259] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Fri Feb 27 21:35:27.650779 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.71:59259] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Fri Feb 27 21:35:30.428242 2026] [:error] [pid 56075:tid 56080] [client 45.131.195.71:59259] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaGdosKBhrfI6KNv9RjpWwAAAAM"]
[Fri Feb 27 21:35:30.917192 2026] [:error] [pid 49306:tid 49323] [client 45.131.195.61:63129] [client 45.131.195.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.61, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaGdovnSUDZue59Px9st3gAAAU8"]
[Fri Feb 27 21:35:31.698888 2026] [:error] [pid 49306:tid 49326] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Feb 27 21:35:31.939616 2026] [:error] [pid 49306:tid 49310] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Fri Feb 27 21:35:32.438299 2026] [:error] [pid 49306:tid 49325] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Fri Feb 27 21:35:32.878007 2026] [:error] [pid 49306:tid 49308] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Feb 27 21:35:33.615198 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Fri Feb 27 21:35:35.378069 2026] [:error] [pid 49306:tid 49329] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 27 21:35:35.591697 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Fri Feb 27 21:35:39.569380 2026] [:error] [pid 49306:tid 49325] [client 45.131.195.61:63129] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Feb 27 21:35:40.111954 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.61:63129] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaGdrPnSUDZue59Px9sukgAAAU0"]
[Fri Feb 27 21:35:41.075769 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.106:32231] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Fri Feb 27 21:35:41.369266 2026] [:error] [pid 56075:tid 56087] [client 45.131.195.106:32231] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaGdrcKBhrfI6KNv9RjpuAAAAAo"]
[Fri Feb 27 21:35:42.065780 2026] [:error] [pid 56075:tid 56083] [client 45.131.195.101:48013] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Fri Feb 27 21:35:42.279694 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.101:48013] [client 45.131.195.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaGdrsKBhrfI6KNv9RjpzwAAAA0"]
[Fri Feb 27 21:35:43.277252 2026] [:error] [pid 56075:tid 56081] [client 45.131.195.62:22525] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Fri Feb 27 21:35:43.828533 2026] [:error] [pid 56075:tid 56102] [client 45.131.195.62:22525] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Fri Feb 27 21:35:44.264024 2026] [:error] [pid 56075:tid 56084] [client 45.131.195.62:22525] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Fri Feb 27 21:35:44.538772 2026] [:error] [pid 56075:tid 56092] [client 45.131.195.62:22525] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Fri Feb 27 21:35:45.126004 2026] [:error] [pid 56075:tid 56079] [client 45.131.195.62:22525] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaGdscKBhrfI6KNv9RjqGgAAAAI"]
[Fri Feb 27 21:35:45.559651 2026] [:error] [pid 49306:tid 49314] [client 45.131.195.54:21181] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Fri Feb 27 21:35:45.795626 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.54:21181] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Fri Feb 27 21:35:46.025212 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.54:21181] [client 45.131.195.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaGdsvnSUDZue59Px9su9QAAAUE"]
[Fri Feb 27 21:35:46.681219 2026] [:error] [pid 62998:tid 63015] [client 45.131.195.82:61113] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaGdslQeueXZDUmoLolbWQAAAQ0"]
[Fri Feb 27 21:35:47.406295 2026] [:error] [pid 62998:tid 63014] [client 45.131.195.110:52089] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Feb 27 21:35:48.220902 2026] [:error] [pid 62998:tid 63026] [client 45.131.195.110:52089] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Fri Feb 27 21:35:48.476569 2026] [:error] [pid 62998:tid 63023] [client 45.131.195.110:52089] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Fri Feb 27 21:35:48.771291 2026] [:error] [pid 62998:tid 63012] [client 45.131.195.110:52089] [client 45.131.195.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaGdtFQeueXZDUmoLolbbwAAAQo"]
[Fri Feb 27 21:35:49.216892 2026] [:error] [pid 54101:tid 54110] [client 45.131.195.53:29745] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaGdtVY5qgRktcYTGFtNtwAAAcI"]
[Fri Feb 27 21:35:50.932405 2026] [:error] [pid 54102:tid 54162] [client 45.131.195.73:32389] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Fri Feb 27 21:35:51.385024 2026] [:error] [pid 54102:tid 54159] [client 45.131.195.73:32389] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaGdt3i74D4fiYUm_Gd9rwAAAI8"]
[Fri Feb 27 21:35:52.157147 2026] [:error] [pid 56075:tid 56082] [client 45.131.195.100:25001] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaGduMKBhrfI6KNv9RjqcwAAAAU"]
[Fri Feb 27 21:35:54.828694 2026] [:error] [pid 49306:tid 49325] [client 45.131.195.82:22425] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 21:35:55.044998 2026] [:error] [pid 49306:tid 49317] [client 45.131.195.82:22425] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Fri Feb 27 21:35:55.268314 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.82:22425] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaGdu_nSUDZue59Px9svUQAAAU0"]
[Fri Feb 27 21:35:56.061211 2026] [:error] [pid 54231:tid 54235] [client 45.131.195.72:25261] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Fri Feb 27 21:35:56.322848 2026] [:error] [pid 54231:tid 54245] [client 45.131.195.72:25261] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Fri Feb 27 21:35:56.831901 2026] [:error] [pid 54231:tid 54253] [client 45.131.195.72:25261] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Feb 27 21:35:57.673360 2026] [:error] [pid 54231:tid 54241] [client 45.131.195.72:25261] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaGdveTvb5AeyJCdY7Ah6gAAAEc"]
[Fri Feb 27 21:35:58.145112 2026] [:error] [pid 56075:tid 56079] [client 45.131.195.100:22873] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Fri Feb 27 21:35:58.845028 2026] [:error] [pid 56075:tid 56087] [client 45.131.195.100:22873] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaGdvsKBhrfI6KNv9Rjq4QAAAAo"]
[Fri Feb 27 21:35:59.577422 2026] [:error] [pid 54102:tid 54150] [client 45.131.195.69:64295] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Fri Feb 27 21:36:00.263733 2026] [:error] [pid 54102:tid 54156] [client 45.131.195.69:64295] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Fri Feb 27 21:36:00.482530 2026] [:error] [pid 54102:tid 54168] [client 45.131.195.69:64295] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Feb 27 21:36:01.035527 2026] [:error] [pid 54102:tid 54164] [client 45.131.195.69:64295] [client 45.131.195.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.69, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaGdwXi74D4fiYUm_Gd99gAAAJQ"]
[Fri Feb 27 21:36:02.249532 2026] [:error] [pid 54102:tid 54151] [client 45.131.195.69:64295] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaGdwni74D4fiYUm_Gd9_AAAAIc"]
[Fri Feb 27 21:36:02.724469 2026] [:error] [pid 56075:tid 56095] [client 45.131.195.71:27741] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Fri Feb 27 21:36:02.969076 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.71:27741] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaGdwsKBhrfI6KNv9RjrJwAAABA"]
[Fri Feb 27 21:36:03.460876 2026] [:error] [pid 56075:tid 56078] [client 45.131.195.248:22793] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Fri Feb 27 21:36:03.978485 2026] [:error] [pid 56075:tid 56101] [client 45.131.195.248:22793] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Fri Feb 27 21:36:04.435209 2026] [:error] [pid 56075:tid 56101] [client 45.131.195.248:22793] [client 45.131.195.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaGdxMKBhrfI6KNv9RjrXAAAABc"]
[Fri Feb 27 21:36:05.096005 2026] [:error] [pid 62998:tid 63017] [client 45.131.195.75:54539] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Fri Feb 27 21:36:05.433217 2026] [:error] [pid 62998:tid 63005] [client 45.131.195.75:54539] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Fri Feb 27 21:36:05.872292 2026] [:error] [pid 62998:tid 63019] [client 45.131.195.75:54539] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaGdxVQeueXZDUmoLolcRAAAARE"]
[Fri Feb 27 21:36:06.540087 2026] [:error] [pid 54103:tid 54187] [client 45.131.195.77:49017] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaGdxuvG4MPCmE0B2sCz6wAAANA"]
[Fri Feb 27 21:36:07.169203 2026] [:error] [pid 54231:tid 54235] [client 45.131.195.78:35455] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Fri Feb 27 21:36:07.436216 2026] [:error] [pid 54231:tid 54258] [client 45.131.195.78:35455] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Fri Feb 27 21:36:07.912933 2026] [:error] [pid 54231:tid 54254] [client 45.131.195.78:35455] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaGdx-Tvb5AeyJCdY7AiXwAAAFQ"]
[Fri Feb 27 21:36:08.365059 2026] [:error] [pid 49306:tid 49332] [client 45.131.195.61:50961] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Fri Feb 27 21:36:08.810705 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.61:50961] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Fri Feb 27 21:36:09.081588 2026] [:error] [pid 49306:tid 49308] [client 45.131.195.61:50961] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaGdyfnSUDZue59Px9sv-QAAAUA"]
[Fri Feb 27 21:36:10.010231 2026] [:error] [pid 54101:tid 54123] [client 45.131.195.84:58759] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aaGdylY5qgRktcYTGFtOMQAAAc8"]
[Fri Feb 27 21:36:10.427776 2026] [:error] [pid 62998:tid 63010] [client 45.131.195.101:28633] [client 45.131.195.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaGdylQeueXZDUmoLolcWwAAAQg"]
[Fri Feb 27 21:36:10.975571 2026] [:error] [pid 54101:tid 54127] [client 45.131.195.66:37439] [client 45.131.195.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaGdylY5qgRktcYTGFtOPQAAAdM"]
[Fri Feb 27 21:36:11.423850 2026] [:error] [pid 54103:tid 54183] [client 45.131.195.53:62591] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaGdy-vG4MPCmE0B2sC0BgAAAMw"]
[Fri Feb 27 21:36:11.891361 2026] [:error] [pid 54103:tid 54182] [client 45.131.195.76:47429] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaGdy-vG4MPCmE0B2sC0FQAAAMs"]
[Fri Feb 27 21:36:12.547099 2026] [:error] [pid 52073:tid 52082] [client 45.131.195.63:58247] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaGdzIa650YPyxXVeRZ1ugAAAYY"]
[Fri Feb 27 21:36:13.586678 2026] [:error] [pid 54101:tid 54132] [client 45.131.195.78:30315] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaGdzVY5qgRktcYTGFtOVgAAAdg"]
[Fri Feb 27 21:36:14.000435 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.91:49831] [client 45.131.195.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaGdzYa650YPyxXVeRZ1wgAAAYE"]
[Fri Feb 27 21:36:14.424245 2026] [:error] [pid 54101:tid 54117] [client 45.131.195.71:62039] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaGdzlY5qgRktcYTGFtOWwAAAck"]
[Fri Feb 27 21:36:15.180029 2026] [:error] [pid 54101:tid 54121] [client 45.131.195.52:28801] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaGdz1Y5qgRktcYTGFtOZAAAAc0"]
[Fri Feb 27 21:36:16.109721 2026] [:error] [pid 52073:tid 52088] [client 45.131.195.75:27527] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaGd0Ia650YPyxXVeRZ12AAAAYw"]
[Fri Feb 27 21:36:17.550063 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.82:60211] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Fri Feb 27 21:36:20.918131 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.82:60211] [client 45.131.195.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.82, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaGd1PnSUDZue59Px9swfwAAAU0"]
[Fri Feb 27 21:36:22.473297 2026] [:error] [pid 49306:tid 49318] [client 45.131.195.82:60211] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaGd1vnSUDZue59Px9swmQAAAUo"]
[Fri Feb 27 21:36:22.904954 2026] [:error] [pid 52073:tid 52099] [client 45.131.195.63:23301] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaGd1oa650YPyxXVeRZ2MQAAAZc"]
[Fri Feb 27 21:36:24.045310 2026] [:error] [pid 52073:tid 52098] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Fri Feb 27 21:36:24.290478 2026] [:error] [pid 52073:tid 52080] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Fri Feb 27 21:36:25.246745 2026] [:error] [pid 52073:tid 52078] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Fri Feb 27 21:36:25.490754 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Fri Feb 27 21:36:26.407559 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Fri Feb 27 21:36:26.621179 2026] [:error] [pid 52073:tid 52078] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Fri Feb 27 21:36:26.889441 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Fri Feb 27 21:36:27.215676 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.96:31539] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Fri Feb 27 21:36:27.491930 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.96:31539] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaGd24a650YPyxXVeRZ2fAAAAYc"]
[Fri Feb 27 21:36:27.911058 2026] [:error] [pid 56075:tid 56087] [client 45.131.195.109:25787] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaGd28KBhrfI6KNv9Rjs3QAAAAo"]
[Fri Feb 27 21:36:28.371984 2026] [:error] [pid 62998:tid 63024] [client 45.131.195.82:53137] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaGd3FQeueXZDUmoLoldpwAAARY"]
[Fri Feb 27 21:36:29.212263 2026] [:error] [pid 54103:tid 54194] [client 45.131.195.248:38813] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Fri Feb 27 21:36:29.453333 2026] [:error] [pid 54103:tid 54174] [client 45.131.195.248:38813] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Fri Feb 27 21:36:29.961207 2026] [:error] [pid 54103:tid 54188] [client 45.131.195.248:38813] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Fri Feb 27 21:36:30.480968 2026] [:error] [pid 54103:tid 54190] [client 45.131.195.248:38813] [client 45.131.195.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaGd3uvG4MPCmE0B2sC0hQAAANM"]
[Fri Feb 27 21:36:31.083297 2026] [:error] [pid 54102:tid 54156] [client 45.131.195.106:65535] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaGd33i74D4fiYUm_Gd-awAAAIw"]
[Fri Feb 27 21:36:31.539326 2026] [:error] [pid 54231:tid 54250] [client 45.131.195.111:59877] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaGd3-Tvb5AeyJCdY7AjNAAAAFA"]
[Fri Feb 27 21:36:32.985138 2026] [:error] [pid 54102:tid 54168] [client 45.131.195.85:60567] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaGd4Hi74D4fiYUm_Gd-gAAAAJc"]
[Fri Feb 27 21:36:33.793057 2026] [:error] [pid 54101:tid 54129] [client 45.131.195.75:22627] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaGd4VY5qgRktcYTGFtOhAAAAdU"]
[Fri Feb 27 21:36:34.883765 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.95:48277] [client 45.131.195.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaGd4oa650YPyxXVeRZ2vgAAAYE"]
[Fri Feb 27 21:36:38.043274 2026] [:error] [pid 52073:tid 52099] [client 45.131.195.77:48979] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaGd5oa650YPyxXVeRZ3BQAAAZc"]
[Fri Feb 27 21:36:38.486770 2026] [:error] [pid 54102:tid 54147] [client 45.131.195.77:44449] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Fri Feb 27 21:36:39.021620 2026] [:error] [pid 54102:tid 54151] [client 45.131.195.77:44449] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aaGd53i74D4fiYUm_Gd-mAAAAIc"]
[Fri Feb 27 21:36:39.920088 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.57:36421] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Fri Feb 27 21:36:40.621528 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.57:36421] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Feb 27 21:36:40.913246 2026] [:error] [pid 52073:tid 52080] [client 45.131.195.57:36421] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaGd6Ia650YPyxXVeRZ3VgAAAYQ"]
[Fri Feb 27 21:36:41.905120 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.70:46231] [client 45.131.195.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaGd6Ya650YPyxXVeRZ3ZwAAAYM"]
[Fri Feb 27 21:36:44.892505 2026] [:error] [pid 54102:tid 54166] [client 45.131.195.90:63605] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaGd7Hi74D4fiYUm_Gd-rAAAAJY"]
[Fri Feb 27 21:36:46.717882 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.77:63835] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaGd7vnSUDZue59Px9sx4QAAAUU"]
[Fri Feb 27 21:36:47.436755 2026] [:error] [pid 49306:tid 49327] [client 45.131.195.57:53017] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Fri Feb 27 21:36:47.657028 2026] [:error] [pid 49306:tid 49332] [client 45.131.195.57:53017] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaGd7_nSUDZue59Px9sx-wAAAVg"]
[Fri Feb 27 21:36:48.115409 2026] [:error] [pid 54101:tid 54108] [client 45.131.195.111:32439] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaGd8FY5qgRktcYTGFtOnAAAAcA"]
[Fri Feb 27 21:36:49.846222 2026] [:error] [pid 54103:tid 54173] [client 45.131.195.71:30113] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaGd8evG4MPCmE0B2sC00gAAAMI"]
[Fri Feb 27 21:36:50.348320 2026] [:error] [pid 62998:tid 63002] [client 45.131.195.64:36737] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Fri Feb 27 21:36:51.515551 2026] [:error] [pid 62998:tid 63018] [client 45.131.195.64:36737] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Fri Feb 27 21:36:51.764872 2026] [:error] [pid 62998:tid 63022] [client 45.131.195.64:36737] [client 45.131.195.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaGd81QeueXZDUmoLole_AAAARQ"]
[Fri Feb 27 21:36:52.786577 2026] [:error] [pid 56075:tid 56100] [client 45.131.195.100:38177] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Fri Feb 27 21:36:53.217151 2026] [:error] [pid 56075:tid 56083] [client 45.131.195.100:38177] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaGd9cKBhrfI6KNv9Rju5AAAAAY"]
[Fri Feb 27 21:36:53.732860 2026] [:error] [pid 54101:tid 54126] [client 45.131.195.73:26475] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaGd9VY5qgRktcYTGFtOpQAAAdI"]
[Fri Feb 27 21:36:54.624644 2026] [:error] [pid 56075:tid 56100] [client 45.131.195.63:61075] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaGd9sKBhrfI6KNv9Rju9gAAABY"]
[Fri Feb 27 21:36:55.815946 2026] [:error] [pid 49306:tid 49315] [client 45.131.195.79:64051] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaGd9_nSUDZue59Px9sybQAAAUc"]
[Fri Feb 27 21:36:56.348236 2026] [:error] [pid 54103:tid 54172] [client 45.131.195.65:64951] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaGd-OvG4MPCmE0B2sC08gAAAME"]
[Fri Feb 27 21:36:57.088589 2026] [:error] [pid 54231:tid 54246] [client 45.131.195.86:36563] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Fri Feb 27 21:36:58.412126 2026] [:error] [pid 54231:tid 54249] [client 45.131.195.86:36563] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaGd-uTvb5AeyJCdY7AkEwAAAE8"]
[Fri Feb 27 21:36:59.384077 2026] [:error] [pid 54103:tid 54170] [client 45.131.195.79:63373] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaGd--vG4MPCmE0B2sC1EwAAAMA"]
[Fri Feb 27 21:37:03.172107 2026] [:error] [pid 62998:tid 63020] [client 45.131.195.106:35823] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaGd_1QeueXZDUmoLolfsAAAARI"]
[Fri Feb 27 21:37:03.929194 2026] [:error] [pid 56075:tid 56095] [client 45.131.195.72:55301] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Fri Feb 27 21:37:04.141862 2026] [:error] [pid 56075:tid 56079] [client 45.131.195.72:55301] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaGeAMKBhrfI6KNv9RjvbAAAAAI"]
[Fri Feb 27 21:37:04.808044 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.63:48629] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaGeAIa650YPyxXVeRZ4oQAAAYo"]
[Fri Feb 27 21:37:06.560553 2026] [:error] [pid 56075:tid 56083] [client 45.131.195.106:24095] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaGeAsKBhrfI6KNv9RjvkQAAAAY"]
[Fri Feb 27 21:37:07.237125 2026] [:error] [pid 56075:tid 56101] [client 45.131.195.99:30009] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Fri Feb 27 21:37:07.522348 2026] [:error] [pid 56075:tid 56088] [client 45.131.195.99:30009] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaGeA8KBhrfI6KNv9RjvpQAAAAs"]
[Fri Feb 27 21:37:08.554073 2026] [:error] [pid 49306:tid 49316] [client 45.131.195.86:56677] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaGeBPnSUDZue59Px9syvAAAAUg"]
[Fri Feb 27 21:37:09.316138 2026] [:error] [pid 49306:tid 49326] [client 45.131.195.106:44443] [client 45.131.195.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aaGeBfnSUDZue59Px9sy0gAAAVI"]
[Fri Feb 27 21:37:10.052305 2026] [:error] [pid 49306:tid 49311] [client 45.131.195.73:31225] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaGeBvnSUDZue59Px9sy6QAAAUM"]
[Fri Feb 27 21:37:10.499911 2026] [:error] [pid 56075:tid 56084] [client 45.131.195.82:41203] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aaGeBsKBhrfI6KNv9RjvugAAAAc"]
[Fri Feb 27 21:37:10.965074 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.105:22805] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaGeBoa650YPyxXVeRZ40gAAAZQ"]
[Fri Feb 27 21:37:13.055491 2026] [:error] [pid 54231:tid 54241] [client 209.87.169.174:42435] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaGeCeTvb5AeyJCdY7AkZgAAAEc"]
[Fri Feb 27 21:37:14.232092 2026] [:error] [pid 62998:tid 63009] [client 45.131.195.53:45431] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaGeClQeueXZDUmoLolgDgAAAQc"]
[Fri Feb 27 21:37:16.377199 2026] [:error] [pid 54103:tid 54184] [client 45.131.195.57:24471] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Fri Feb 27 21:37:16.614574 2026] [:error] [pid 54103:tid 54177] [client 45.131.195.57:24471] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaGeDOvG4MPCmE0B2sC1lwAAAMY"]
[Fri Feb 27 21:37:17.841253 2026] [:error] [pid 49306:tid 49314] [client 45.131.195.249:29511] [client 45.131.195.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaGeDfnSUDZue59Px9szagAAAUY"]
[Fri Feb 27 21:37:18.269806 2026] [:error] [pid 56075:tid 56102] [client 45.131.195.111:46187] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Fri Feb 27 21:37:19.734683 2026] [:error] [pid 56075:tid 56096] [client 45.131.195.111:46187] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaGeD8KBhrfI6KNv9RjwCwAAABI"]
[Fri Feb 27 21:37:20.365166 2026] [:error] [pid 49306:tid 49316] [client 45.131.195.62:47463] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaGeEPnSUDZue59Px9szlQAAAUg"]
[Fri Feb 27 21:37:21.255519 2026] [:error] [pid 56075:tid 56088] [client 45.131.195.57:32247] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaGeEcKBhrfI6KNv9RjwHAAAAAs"]
[Fri Feb 27 21:37:22.287745 2026] [:error] [pid 62998:tid 63002] [client 45.131.195.57:34491] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaGeElQeueXZDUmoLolgTwAAAQE"]
[Fri Feb 27 21:37:24.757884 2026] [:error] [pid 49306:tid 49319] [client 45.131.195.52:45439] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaGeFPnSUDZue59Px9szygAAAUs"]
[Fri Feb 27 21:37:25.239994 2026] [:error] [pid 52073:tid 52085] [client 45.131.195.58:58983] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaGeFYa650YPyxXVeRZ5qAAAAYk"]
[Fri Feb 27 21:37:26.543472 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.80:25817] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaGeFvnSUDZue59Px9sz4wAAAU0"]
[Fri Feb 27 21:37:27.035717 2026] [:error] [pid 62998:tid 63011] [client 45.131.195.54:41199] [client 45.131.195.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaGeF1QeueXZDUmoLolgdAAAAQk"]
[Fri Feb 27 21:37:27.907307 2026] [:error] [pid 54231:tid 54235] [client 45.131.195.89:59761] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaGeF-Tvb5AeyJCdY7AkrAAAAEE"]
[Fri Feb 27 21:37:28.361080 2026] [:error] [pid 62998:tid 63020] [client 45.131.195.66:47267] [client 45.131.195.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaGeGFQeueXZDUmoLolgfAAAARI"]
[Fri Feb 27 21:37:28.816000 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.60:62961] [client 45.131.195.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.60, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaGeGIa650YPyxXVeRZ5-gAAAYs"]
[Fri Feb 27 21:37:28.820821 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.60:62961] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Fri Feb 27 21:37:29.039183 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.60:62961] [client 45.131.195.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaGeGYa650YPyxXVeRZ6BQAAAZM"]
[Fri Feb 27 21:37:29.996100 2026] [:error] [pid 56075:tid 56093] [client 45.131.195.54:50235] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Feb 27 21:37:30.225597 2026] [:error] [pid 56075:tid 56088] [client 45.131.195.54:50235] [client 45.131.195.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaGeGsKBhrfI6KNv9RjwjQAAAAs"]
[Fri Feb 27 21:37:30.793311 2026] [:error] [pid 54231:tid 54236] [client 45.131.195.110:55285] [client 45.131.195.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aaGeGuTvb5AeyJCdY7AkuAAAAEI"]
[Fri Feb 27 21:37:31.273471 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.52:30691] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Fri Feb 27 21:37:33.007980 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.52:30691] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaGeHYa650YPyxXVeRZ6jwAAAZA"]
[Fri Feb 27 21:37:33.492758 2026] [:error] [pid 54231:tid 54243] [client 45.131.195.53:55791] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaGeHeTvb5AeyJCdY7Ak1AAAAEk"]
[Fri Feb 27 21:37:34.360764 2026] [:error] [pid 62998:tid 63007] [client 45.131.195.73:38277] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaGeHlQeueXZDUmoLolglQAAAQU"]
[Fri Feb 27 21:37:34.811435 2026] [:error] [pid 56075:tid 56079] [client 45.131.195.96:21949] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaGeHsKBhrfI6KNv9RjwrQAAAAI"]
[Fri Feb 27 21:37:35.277212 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.105:23317] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Fri Feb 27 21:37:35.597257 2026] [:error] [pid 52073:tid 52098] [client 45.131.195.105:23317] [client 45.131.195.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.105, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaGeH4a650YPyxXVeRZ6twAAAZY"]
[Fri Feb 27 21:37:36.080121 2026] [:error] [pid 52073:tid 52080] [client 45.131.195.105:23317] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaGeIIa650YPyxXVeRZ6xgAAAYQ"]
[Fri Feb 27 21:37:37.428362 2026] [:error] [pid 56075:tid 56080] [client 45.131.195.66:49493] [client 45.131.195.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaGeIcKBhrfI6KNv9RjwzAAAAAM"]
[Fri Feb 27 21:37:37.964992 2026] [:error] [pid 52073:tid 52080] [client 45.131.195.249:65171] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Fri Feb 27 21:37:38.174843 2026] [:error] [pid 52073:tid 52082] [client 45.131.195.249:65171] [client 45.131.195.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaGeIoa650YPyxXVeRZ66gAAAYY"]
[Fri Feb 27 21:37:40.904631 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.248:21961] [client 45.131.195.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaGeJIa650YPyxXVeRZ7FQAAAY8"]
[Fri Feb 27 21:37:41.474505 2026] [:error] [pid 54103:tid 54195] [client 45.131.195.249:50959] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Fri Feb 27 21:37:42.191017 2026] [:error] [pid 54103:tid 54178] [client 45.131.195.249:50959] [client 45.131.195.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaGeJuvG4MPCmE0B2sC15AAAAMc"]
[Fri Feb 27 21:37:43.143445 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.91:25887] [client 45.131.195.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaGeJ4a650YPyxXVeRZ7OAAAAYs"]
[Fri Feb 27 21:37:43.594939 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.89:22071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Fri Feb 27 21:37:44.087044 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.89:22071] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Feb 27 21:37:44.602946 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.89:22071] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaGeKIa650YPyxXVeRZ7TwAAAZQ"]
[Fri Feb 27 21:37:45.156945 2026] [:error] [pid 52073:tid 52097] [client 45.131.195.82:25307] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaGeKYa650YPyxXVeRZ7UQAAAZU"]
[Fri Feb 27 21:37:45.856899 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.72:28601] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aaGeKYa650YPyxXVeRZ7XQAAAZQ"]
[Fri Feb 27 21:37:46.310840 2026] [:error] [pid 49306:tid 49314] [client 45.131.195.59:53269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Fri Feb 27 21:37:47.712999 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.59:53269] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaGeK_nSUDZue59Px9s0sgAAAUU"]
[Fri Feb 27 21:37:48.714322 2026] [:error] [pid 52073:tid 52089] [client 45.131.195.86:64339] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aaGeLIa650YPyxXVeRZ7hAAAAY0"]
[Fri Feb 27 21:37:48.932271 2026] [:error] [pid 52073:tid 52093] [client 45.131.195.86:64339] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaGeLIa650YPyxXVeRZ7iAAAAZE"]
[Fri Feb 27 21:37:50.016674 2026] [:error] [pid 56075:tid 56101] [client 45.131.195.94:33771] [client 45.131.195.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaGeLsKBhrfI6KNv9RjxjAAAABc"]
[Fri Feb 27 21:37:50.488900 2026] [:error] [pid 54231:tid 54251] [client 45.131.195.73:25021] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaGeLuTvb5AeyJCdY7AlewAAAFE"]
[Fri Feb 27 21:37:51.435559 2026] [:error] [pid 54231:tid 54255] [client 45.131.195.75:40391] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Fri Feb 27 21:37:52.398277 2026] [:error] [pid 54231:tid 54251] [client 45.131.195.75:40391] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaGeMOTvb5AeyJCdY7AljAAAAFE"]
[Fri Feb 27 21:37:53.357875 2026] [:error] [pid 56075:tid 56097] [client 45.131.195.73:50723] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaGeMcKBhrfI6KNv9Rjx3AAAABM"]
[Fri Feb 27 21:37:54.101142 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.71:47811] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaGeMoa650YPyxXVeRZ72AAAAYo"]
[Fri Feb 27 21:37:54.621459 2026] [:error] [pid 49306:tid 49316] [client 45.131.195.73:54537] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Fri Feb 27 21:37:55.894043 2026] [:error] [pid 49306:tid 49312] [client 45.131.195.73:54537] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaGeM_nSUDZue59Px9s1BwAAAUQ"]
[Fri Feb 27 21:37:56.606845 2026] [:error] [pid 54103:tid 54194] [client 45.131.195.55:63399] [client 45.131.195.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aaGeNOvG4MPCmE0B2sC2HgAAANc"]
[Fri Feb 27 21:37:57.066457 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.85:31517] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Feb 27 21:37:57.323555 2026] [:error] [pid 52073:tid 52076] [client 45.131.195.85:31517] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaGeNYa650YPyxXVeRZ8JgAAAYA"]
[Fri Feb 27 21:37:57.741993 2026] [:error] [pid 52073:tid 52076] [client 45.131.195.67:30575] [client 45.131.195.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaGeNYa650YPyxXVeRZ8LwAAAYA"]
[Fri Feb 27 21:37:58.673913 2026] [:error] [pid 52073:tid 52100] [client 45.131.195.99:26499] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaGeNoa650YPyxXVeRZ8TgAAAZg"]
[Fri Feb 27 21:37:59.863814 2026] [:error] [pid 52073:tid 52100] [client 45.131.195.85:32043] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Fri Feb 27 21:38:00.077199 2026] [:error] [pid 52073:tid 52085] [client 45.131.195.85:32043] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaGeOIa650YPyxXVeRZ8ggAAAYk"]
[Fri Feb 27 21:38:00.507802 2026] [:error] [pid 54231:tid 54238] [client 45.131.195.100:27105] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaGeOOTvb5AeyJCdY7AlnAAAAEQ"]
[Fri Feb 27 21:38:02.455959 2026] [:error] [pid 52073:tid 52090] [client 45.131.195.52:41103] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaGeOoa650YPyxXVeRZ8ygAAAY4"]
[Fri Feb 27 21:38:03.644452 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.89:34141] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaGeO4a650YPyxXVeRZ87QAAAYU"]
[Fri Feb 27 21:38:04.086149 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.94:47381] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Fri Feb 27 21:38:04.869205 2026] [:error] [pid 56075:tid 56093] [client 45.131.195.94:47381] [client 45.131.195.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaGePMKBhrfI6KNv9RjyRAAAAA8"]
[Fri Feb 27 21:38:05.335534 2026] [:error] [pid 49306:tid 49314] [client 45.131.195.78:56673] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaGePfnSUDZue59Px9s1RgAAAUY"]
[Fri Feb 27 21:38:06.145859 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.80:46191] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaGePsKBhrfI6KNv9RjyWwAAAAA"]
[Fri Feb 27 21:38:06.652036 2026] [:error] [pid 49306:tid 49311] [client 45.131.195.69:43491] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Fri Feb 27 21:38:07.083639 2026] [:error] [pid 49306:tid 49326] [client 45.131.195.69:43491] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaGeP_nSUDZue59Px9s1aQAAAVI"]
[Fri Feb 27 21:38:07.668246 2026] [:error] [pid 62998:tid 63018] [client 45.131.195.114:30669] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Fri Feb 27 21:38:08.220462 2026] [:error] [pid 62998:tid 63001] [client 45.131.195.114:30669] [client 45.131.195.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaGeQFQeueXZDUmoLolhHQAAAQA"]
[Fri Feb 27 21:38:08.744324 2026] [:error] [pid 52073:tid 52084] [client 45.131.195.84:20719] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaGeQIa650YPyxXVeRZ9NwAAAYg"]
[Fri Feb 27 21:38:09.464210 2026] [:error] [pid 62998:tid 63014] [client 45.131.195.55:63455] [client 45.131.195.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaGeQVQeueXZDUmoLolhIgAAAQw"]
[Fri Feb 27 21:38:11.061480 2026] [:error] [pid 56075:tid 56087] [client 45.131.195.74:38309] [client 45.131.195.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaGeQ8KBhrfI6KNv9RjypAAAAAo"]
[Fri Feb 27 21:38:12.030139 2026] [:error] [pid 52073:tid 52076] [client 45.131.195.69:32063] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaGeRIa650YPyxXVeRZ9aQAAAYA"]
[Fri Feb 27 21:38:12.717188 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.75:55915] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaGeRMKBhrfI6KNv9RjytgAAAAA"]
[Fri Feb 27 21:38:13.190383 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.90:64287] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaGeRYa650YPyxXVeRZ9cgAAAYo"]
[Fri Feb 27 21:38:13.635579 2026] [:error] [pid 52073:tid 52084] [client 45.131.195.111:29681] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaGeRYa650YPyxXVeRZ9ewAAAYg"]
[Fri Feb 27 21:38:14.846687 2026] [:error] [pid 54103:tid 54195] [client 45.131.195.64:51489] [client 45.131.195.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaGeRuvG4MPCmE0B2sC2UQAAANg"]
[Fri Feb 27 21:38:15.806778 2026] [:error] [pid 54103:tid 54189] [client 45.131.195.80:22547] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaGeR-vG4MPCmE0B2sC2VQAAANI"]
[Fri Feb 27 21:38:16.565585 2026] [:error] [pid 52073:tid 52097] [client 45.131.195.71:36867] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaGeSIa650YPyxXVeRZ9qAAAAZU"]
[Fri Feb 27 21:38:17.234271 2026] [:error] [pid 56075:tid 56099] [client 209.87.169.174:34121] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaGeScKBhrfI6KNv9Rjy4QAAABU"]
[Fri Feb 27 21:38:18.187655 2026] [:error] [pid 56075:tid 56078] [client 45.131.195.69:53449] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Fri Feb 27 21:38:19.734058 2026] [:error] [pid 56075:tid 56095] [client 45.131.195.69:53449] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaGeS8KBhrfI6KNv9RjzBgAAABE"]
[Fri Feb 27 21:38:20.180089 2026] [:error] [pid 54102:tid 54164] [client 45.131.195.77:54447] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaGeTHi74D4fiYUm_Gd_lAAAAJQ"]
[Fri Feb 27 21:38:20.884567 2026] [:error] [pid 54231:tid 54252] [client 45.131.195.76:21211] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Fri Feb 27 21:38:21.103400 2026] [:error] [pid 54231:tid 54241] [client 45.131.195.76:21211] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaGeTeTvb5AeyJCdY7Al2wAAAEc"]
[Fri Feb 27 21:38:23.573967 2026] [:error] [pid 52073:tid 52089] [client 45.131.195.71:45851] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaGeT4a650YPyxXVeRZ9-AAAAY0"]
[Fri Feb 27 21:38:24.234501 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.90:51349] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Fri Feb 27 21:38:24.451051 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.90:51349] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaGeUIa650YPyxXVeRZ-EAAAAZQ"]
[Fri Feb 27 21:38:25.388212 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.53:36565] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaGeUYa650YPyxXVeRZ-KwAAAZM"]
[Fri Feb 27 21:38:25.841228 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.78:45785] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Feb 27 21:38:26.067820 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.78:45785] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaGeUoa650YPyxXVeRZ-OgAAAYM"]
[Fri Feb 27 21:38:26.764906 2026] [:error] [pid 49306:tid 49322] [client 45.131.195.100:42075] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaGeUvnSUDZue59Px9s2iwAAAU4"]
[Fri Feb 27 21:38:27.944905 2026] [:error] [pid 49306:tid 49322] [client 45.131.195.56:43501] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Fri Feb 27 21:38:28.202363 2026] [:error] [pid 49306:tid 49323] [client 45.131.195.56:43501] [client 45.131.195.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaGeVPnSUDZue59Px9s2sQAAAU8"]
[Fri Feb 27 21:38:30.648666 2026] [:error] [pid 52073:tid 52082] [client 45.131.195.57:51183] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaGeVoa650YPyxXVeRZ-iwAAAYY"]
[Fri Feb 27 21:38:31.172131 2026] [:error] [pid 56075:tid 56096] [client 45.131.195.104:31685] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Fri Feb 27 21:38:31.394725 2026] [:error] [pid 56075:tid 56081] [client 45.131.195.104:31685] [client 45.131.195.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaGeV8KBhrfI6KNv9RjznwAAAAQ"]
[Fri Feb 27 21:38:31.868864 2026] [:error] [pid 56075:tid 56097] [client 45.131.195.75:59857] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaGeV8KBhrfI6KNv9RjzrQAAABM"]
[Fri Feb 27 21:38:32.373255 2026] [:error] [pid 56075:tid 56099] [client 45.131.195.53:50815] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Fri Feb 27 21:38:32.936165 2026] [:error] [pid 56075:tid 56091] [client 45.131.195.53:50815] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaGeWMKBhrfI6KNv9RjzzAAAAA0"]
[Fri Feb 27 21:38:33.465862 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.69:31449] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaGeWYa650YPyxXVeRZ-swAAAYU"]
[Fri Feb 27 21:38:35.461499 2026] [:error] [pid 52073:tid 52094] [client 209.87.169.174:45081] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaGeW4a650YPyxXVeRZ-5gAAAZI"]
[Fri Feb 27 21:38:35.893673 2026] [:error] [pid 56075:tid 56081] [client 45.131.195.110:47883] [client 45.131.195.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaGeW8KBhrfI6KNv9Rj0CAAAAAQ"]
[Fri Feb 27 21:38:36.615324 2026] [:error] [pid 54231:tid 54249] [client 45.131.195.111:42697] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aaGeXOTvb5AeyJCdY7Al-gAAAE8"]
[Fri Feb 27 21:38:37.043298 2026] [:error] [pid 49306:tid 49317] [client 45.131.195.74:25311] [client 45.131.195.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaGeXfnSUDZue59Px9s24AAAAUk"]
[Fri Feb 27 21:38:37.533798 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.55:47939] [client 45.131.195.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaGeXfnSUDZue59Px9s24QAAAU0"]
[Fri Feb 27 21:38:37.987434 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.72:39421] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aaGeXfnSUDZue59Px9s24wAAAUE"]
[Fri Feb 27 21:38:39.503087 2026] [:error] [pid 54231:tid 54240] [client 45.131.195.110:48131] [client 45.131.195.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaGeX-Tvb5AeyJCdY7AmFwAAAEY"]
[Fri Feb 27 21:38:39.960353 2026] [:error] [pid 49306:tid 49315] [client 45.131.195.69:27131] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aaGeX_nSUDZue59Px9s26wAAAUc"]
[Fri Feb 27 21:38:40.609474 2026] [:error] [pid 62998:tid 63007] [client 45.131.195.78:43329] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Fri Feb 27 21:38:40.834593 2026] [:error] [pid 62998:tid 63017] [client 45.131.195.78:43329] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaGeYFQeueXZDUmoLoliXQAAAQ8"]
[Fri Feb 27 21:38:41.273152 2026] [:error] [pid 62998:tid 63005] [client 45.131.195.90:25417] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaGeYVQeueXZDUmoLoliXgAAAQM"]
[Fri Feb 27 21:38:42.181226 2026] [:error] [pid 52073:tid 52098] [client 45.131.195.66:55537] [client 45.131.195.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aaGeYoa650YPyxXVeRZ_CwAAAZY"]
[Fri Feb 27 21:38:42.630094 2026] [:error] [pid 49306:tid 49324] [client 45.131.195.78:51443] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaGeYvnSUDZue59Px9s3AAAAAVA"]
[Fri Feb 27 21:38:44.790744 2026] [:error] [pid 49306:tid 49332] [client 45.131.195.61:59999] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aaGeZPnSUDZue59Px9s3GQAAAVg"]
[Fri Feb 27 21:38:45.260216 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.59:27901] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaGeZYa650YPyxXVeRZ_KQAAAYM"]
[Fri Feb 27 21:38:46.142326 2026] [:error] [pid 52073:tid 52090] [client 45.131.195.64:28147] [client 45.131.195.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aaGeZoa650YPyxXVeRZ_OQAAAY4"]
[Fri Feb 27 21:38:47.051935 2026] [:error] [pid 54231:tid 54246] [client 45.131.195.99:27751] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaGeZ-Tvb5AeyJCdY7AmSgAAAEw"]
[Fri Feb 27 21:38:47.713031 2026] [:error] [pid 49306:tid 49319] [client 45.131.195.61:64529] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aaGeZ_nSUDZue59Px9s3MQAAAUs"]
[Fri Feb 27 21:38:48.229829 2026] [:error] [pid 56075:tid 56084] [client 45.131.195.62:43463] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaGeaMKBhrfI6KNv9Rj1CwAAAAc"]
[Fri Feb 27 21:38:48.665557 2026] [:error] [pid 54231:tid 54236] [client 45.131.195.110:21261] [client 45.131.195.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaGeaOTvb5AeyJCdY7AmUwAAAEI"]
[Fri Feb 27 21:38:49.936640 2026] [:error] [pid 54231:tid 54256] [client 45.131.195.73:26329] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaGeaeTvb5AeyJCdY7AmYQAAAFY"]
[Fri Feb 27 21:38:50.366636 2026] [:error] [pid 56075:tid 56100] [client 209.87.169.174:42521] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Fri Feb 27 21:38:50.597559 2026] [:error] [pid 56075:tid 56095] [client 209.87.169.174:42521] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaGeasKBhrfI6KNv9Rj1UwAAABE"]
[Fri Feb 27 21:38:51.604568 2026] [:error] [pid 56075:tid 56098] [client 45.131.195.90:52625] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Fri Feb 27 21:38:51.814586 2026] [:error] [pid 56075:tid 56093] [client 45.131.195.90:52625] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaGea8KBhrfI6KNv9Rj1dwAAAA8"]
[Fri Feb 27 21:38:52.267482 2026] [:error] [pid 56075:tid 56096] [client 45.131.195.105:45303] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaGebMKBhrfI6KNv9Rj1hAAAABI"]
[Fri Feb 27 21:38:53.119079 2026] [:error] [pid 56075:tid 56095] [client 45.131.195.100:49931] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaGebcKBhrfI6KNv9Rj1mAAAABE"]
[Fri Feb 27 21:38:54.721917 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.78:43883] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Fri Feb 27 21:38:57.267273 2026] [:error] [pid 49306:tid 49327] [client 45.131.195.78:43883] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aaGecfnSUDZue59Px9s3hgAAAVM"]
[Fri Feb 27 21:38:58.016354 2026] [:error] [pid 62998:tid 63022] [client 45.131.195.78:52279] [client 45.131.195.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaGeclQeueXZDUmoLolitQAAARQ"]
[Fri Feb 27 21:38:58.946796 2026] [:error] [pid 54103:tid 54173] [client 45.131.195.85:30737] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaGecuvG4MPCmE0B2sC2lQAAAMI"]
[Fri Feb 27 21:38:59.361222 2026] [:error] [pid 54231:tid 54249] [client 45.131.195.58:64185] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaGec-Tvb5AeyJCdY7AmqAAAAE8"]
[Fri Feb 27 21:38:59.796053 2026] [:error] [pid 62998:tid 63022] [client 45.131.195.58:25217] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaGec1QeueXZDUmoLolixAAAARQ"]
[Fri Feb 27 22:04:33.840953 2026] [:error] [pid 49306:tid 49324] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Fri Feb 27 22:04:34.050871 2026] [:error] [pid 49306:tid 49329] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/tews.php
[Fri Feb 27 22:04:34.260972 2026] [:error] [pid 49306:tid 49308] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/wpp.php
[Fri Feb 27 22:04:34.472216 2026] [:error] [pid 49306:tid 49332] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/wc49.php
[Fri Feb 27 22:04:34.682217 2026] [:error] [pid 49306:tid 49327] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/TL.php
[Fri Feb 27 22:04:34.890136 2026] [:error] [pid 49306:tid 49317] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Fri Feb 27 22:04:35.101248 2026] [:error] [pid 49306:tid 49326] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/fck.php
[Fri Feb 27 22:04:35.313177 2026] [:error] [pid 49306:tid 49314] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Fri Feb 27 22:04:35.522804 2026] [:error] [pid 49306:tid 49313] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Fri Feb 27 22:04:35.736595 2026] [:error] [pid 49306:tid 49312] [client 20.63.97.65:26480] File does not exist: /usr/local/apache/htdocs/suspended-page/nw2.php
[Fri Feb 27 22:04:35.946837 2026] [:error] [pid 49306:tid 49323] [client 20.63.97.65:26480] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaGkc_nSUDZue59Px9tKLwAAAU8"]
[Fri Feb 27 22:04:36.457377 2026] [:error] [pid 62998:tid 63002] [client 20.63.97.65:26483] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaGkdFQeueXZDUmoLolvmAAAAQE"]
[Fri Feb 27 22:04:36.945717 2026] [:error] [pid 56075:tid 56080] [client 20.63.97.65:37445] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaGkdMKBhrfI6KNv9RgeLAAAAAM"]
[Fri Feb 27 22:04:37.392824 2026] [:error] [pid 56075:tid 56079] [client 20.63.97.65:33960] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaGkdcKBhrfI6KNv9RgeMQAAAAI"]
[Fri Feb 27 22:04:37.826066 2026] [:error] [pid 52073:tid 52093] [client 20.63.97.65:26433] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaGkdYa650YPyxXVeRaehQAAAZE"]
[Fri Feb 27 22:04:38.375001 2026] [:error] [pid 54103:tid 54189] [client 20.63.97.65:26432] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaGkduvG4MPCmE0B2sC9hQAAANI"]
[Fri Feb 27 22:04:38.903420 2026] [:error] [pid 54102:tid 54153] [client 20.63.97.65:26264] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaGkdni74D4fiYUm_GeE1QAAAIk"]
[Fri Feb 27 22:04:39.318213 2026] [:error] [pid 54102:tid 54149] [client 20.63.97.65:26488] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaGkd3i74D4fiYUm_GeE1gAAAIU"]
[Fri Feb 27 22:04:39.731422 2026] [:error] [pid 62998:tid 63007] [client 20.63.97.65:33951] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaGkd1QeueXZDUmoLolvmwAAAQU"]
[Fri Feb 27 22:04:40.153903 2026] [:error] [pid 52073:tid 52096] [client 20.63.97.65:48812] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaGkeIa650YPyxXVeRaelwAAAZQ"]
[Fri Feb 27 22:04:40.562809 2026] [:error] [pid 49306:tid 49320] [client 20.63.97.65:26252] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaGkePnSUDZue59Px9tKQAAAAUw"]
[Fri Feb 27 22:04:40.982909 2026] [:error] [pid 52073:tid 52080] [client 20.63.97.65:33982] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaGkeIa650YPyxXVeRaemwAAAYQ"]
[Fri Feb 27 22:04:41.397658 2026] [:error] [pid 56075:tid 56083] [client 20.63.97.65:33949] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaGkecKBhrfI6KNv9RgePAAAAAY"]
[Fri Feb 27 22:04:41.810838 2026] [:error] [pid 52073:tid 52094] [client 20.63.97.65:26450] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaGkeYa650YPyxXVeRaenwAAAZI"]
[Fri Feb 27 22:04:42.226804 2026] [:error] [pid 52073:tid 52083] [client 20.63.97.65:37476] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaGkeoa650YPyxXVeRaeoQAAAYc"]
[Fri Feb 27 22:04:42.644849 2026] [:error] [pid 56075:tid 56093] [client 20.63.97.65:48778] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaGkesKBhrfI6KNv9RgeRQAAAA8"]
[Fri Feb 27 22:04:43.070610 2026] [:error] [pid 56075:tid 56099] [client 20.63.97.65:26281] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaGke8KBhrfI6KNv9RgeTQAAABU"]
[Fri Feb 27 22:04:43.507048 2026] [:error] [pid 56075:tid 56093] [client 20.63.97.65:26302] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaGke8KBhrfI6KNv9RgeUgAAAA8"]
[Fri Feb 27 22:04:43.920460 2026] [:error] [pid 56075:tid 56082] [client 20.63.97.65:48800] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaGke8KBhrfI6KNv9RgeVgAAAAU"]
[Fri Feb 27 22:04:44.342736 2026] [:error] [pid 56075:tid 56087] [client 20.63.97.65:33950] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaGkfMKBhrfI6KNv9RgeWwAAAAo"]
[Fri Feb 27 22:04:44.779135 2026] [:error] [pid 56075:tid 56082] [client 20.63.97.65:48781] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaGkfMKBhrfI6KNv9RgeZAAAAAU"]
[Fri Feb 27 22:04:45.208138 2026] [:error] [pid 56075:tid 56094] [client 20.63.97.65:25728] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaGkfcKBhrfI6KNv9RgeawAAABA"]
[Fri Feb 27 22:04:45.632960 2026] [:error] [pid 62998:tid 63015] [client 20.63.97.65:48776] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaGkfVQeueXZDUmoLolvnwAAAQ0"]
[Fri Feb 27 22:04:46.043537 2026] [:error] [pid 56075:tid 56088] [client 20.63.97.65:33932] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaGkfsKBhrfI6KNv9RgedQAAAAs"]
[Fri Feb 27 22:04:46.456667 2026] [:error] [pid 52073:tid 52092] [client 20.63.97.65:33976] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaGkfoa650YPyxXVeRaesAAAAZA"]
[Fri Feb 27 22:04:46.869040 2026] [:error] [pid 62998:tid 63014] [client 20.63.97.65:33923] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaGkflQeueXZDUmoLolvoAAAAQw"]
[Fri Feb 27 22:04:47.298124 2026] [:error] [pid 54102:tid 54145] [client 20.63.97.65:26257] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaGkf3i74D4fiYUm_GeE2QAAAIE"]
[Fri Feb 27 22:04:47.711331 2026] [:error] [pid 54102:tid 54152] [client 20.63.97.65:45352] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaGkf3i74D4fiYUm_GeE2gAAAIg"]
[Fri Feb 27 22:04:48.120300 2026] [:error] [pid 54101:tid 54132] [client 20.63.97.65:45360] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaGkgFY5qgRktcYTGFtTjQAAAdg"]
[Fri Feb 27 22:04:48.544007 2026] [:error] [pid 49306:tid 49326] [client 20.63.97.65:45358] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaGkgPnSUDZue59Px9tKRgAAAVI"]
[Fri Feb 27 22:04:48.958273 2026] [:error] [pid 54102:tid 54146] [client 20.63.97.65:26272] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaGkgHi74D4fiYUm_GeE3QAAAII"]
[Fri Feb 27 22:04:49.385077 2026] [:error] [pid 56075:tid 56085] [client 20.63.97.65:45368] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaGkgcKBhrfI6KNv9RgegQAAAAg"]
[Fri Feb 27 22:04:49.804147 2026] [:error] [pid 54103:tid 54180] [client 20.63.97.65:37450] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaGkgevG4MPCmE0B2sC9kQAAAMk"]
[Fri Feb 27 22:04:50.224705 2026] [:error] [pid 54231:tid 54243] [client 20.63.97.65:26292] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaGkguTvb5AeyJCdY7AvzwAAAEk"]
[Fri Feb 27 22:04:50.710700 2026] [:error] [pid 56075:tid 56078] [client 20.63.97.65:26266] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaGkgsKBhrfI6KNv9RgeigAAAAE"]
[Fri Feb 27 22:04:51.122870 2026] [:error] [pid 56075:tid 56098] [client 20.63.97.65:26446] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaGkg8KBhrfI6KNv9RgekAAAABQ"]
[Fri Feb 27 22:04:51.536370 2026] [:error] [pid 56075:tid 56079] [client 20.63.97.65:26462] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaGkg8KBhrfI6KNv9RgelgAAAAI"]
[Fri Feb 27 22:04:51.955113 2026] [:error] [pid 49306:tid 49324] [client 20.63.97.65:39347] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaGkg_nSUDZue59Px9tKUAAAAVA"]
[Fri Feb 27 22:04:52.367532 2026] [:error] [pid 56075:tid 56091] [client 20.63.97.65:45323] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaGkhMKBhrfI6KNv9RgemwAAAA0"]
[Fri Feb 27 22:04:52.778963 2026] [:error] [pid 56075:tid 56083] [client 20.63.97.65:48819] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaGkhMKBhrfI6KNv9RgenQAAAAY"]
[Fri Feb 27 22:04:53.191556 2026] [:error] [pid 54231:tid 54239] [client 20.63.97.65:25687] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaGkheTvb5AeyJCdY7Av2AAAAEU"]
[Fri Feb 27 22:04:53.615562 2026] [:error] [pid 54231:tid 54235] [client 20.63.97.65:45350] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaGkheTvb5AeyJCdY7Av2wAAAEE"]
[Fri Feb 27 22:04:54.028170 2026] [:error] [pid 54231:tid 54257] [client 20.63.97.65:33967] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaGkhuTvb5AeyJCdY7Av3AAAAFc"]
[Fri Feb 27 22:04:54.456895 2026] [:error] [pid 56075:tid 56099] [client 20.63.97.65:37455] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaGkhsKBhrfI6KNv9RgepQAAABU"]
[Fri Feb 27 22:04:54.964346 2026] [:error] [pid 56075:tid 56081] [client 20.63.97.65:26448] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaGkhsKBhrfI6KNv9RgerAAAAAQ"]
[Fri Feb 27 22:04:55.398263 2026] [:error] [pid 54231:tid 54234] [client 20.63.97.65:26284] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaGkh-Tvb5AeyJCdY7Av4QAAAEA"]
[Fri Feb 27 22:04:55.820860 2026] [:error] [pid 54231:tid 54253] [client 20.63.97.65:37463] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaGkh-Tvb5AeyJCdY7Av4wAAAFM"]
[Fri Feb 27 22:04:56.236627 2026] [:error] [pid 62998:tid 63009] [client 20.63.97.65:45354] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaGkiFQeueXZDUmoLolvpAAAAQc"]
[Fri Feb 27 22:04:56.657073 2026] [:error] [pid 54231:tid 54236] [client 20.63.97.65:37499] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaGkiOTvb5AeyJCdY7Av6AAAAEI"]
[Fri Feb 27 22:04:57.089322 2026] [:error] [pid 54103:tid 54189] [client 20.63.97.65:37448] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaGkievG4MPCmE0B2sC9mgAAANI"]
[Fri Feb 27 22:04:57.554317 2026] [:error] [pid 54102:tid 54156] [client 20.63.97.65:26259] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaGkiXi74D4fiYUm_GeE_wAAAIw"]
[Fri Feb 27 22:04:57.965679 2026] [:error] [pid 56075:tid 56102] [client 20.63.97.65:25708] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaGkicKBhrfI6KNv9RgevwAAABg"]
[Fri Feb 27 22:04:58.375571 2026] [:error] [pid 54102:tid 54159] [client 20.63.97.65:37449] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaGkini74D4fiYUm_GeFBAAAAI8"]
[Fri Feb 27 22:04:58.788489 2026] [:error] [pid 62998:tid 63023] [client 20.63.97.65:45355] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaGkilQeueXZDUmoLolvpQAAARU"]
[Fri Feb 27 22:04:59.204269 2026] [:error] [pid 54231:tid 54256] [client 20.63.97.65:33928] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaGki-Tvb5AeyJCdY7Av6QAAAFY"]
[Fri Feb 27 22:04:59.623490 2026] [:error] [pid 52073:tid 52094] [client 20.63.97.65:26256] [client 20.63.97.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaGki4a650YPyxXVeRaevwAAAZI"]
[Fri Feb 27 22:12:12.083030 2026] [:error] [pid 54231:tid 54253] [client 217.165.0.169:55392] [client 217.165.0.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.165.0.169, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaGmPOTvb5AeyJCdY7AxqgAAAFM"]
[Fri Feb 27 22:12:12.089304 2026] [:error] [pid 54231:tid 54253] [client 217.165.0.169:55392] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 23:24:22.547361 2026] [:error] [pid 52073:tid 52079] [client 20.220.221.45:1508] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG3Joa650YPyxXVeRbWwgAAAYM"]
[Fri Feb 27 23:24:23.359897 2026] [:error] [pid 56075:tid 56093] [client 20.220.221.45:54594] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG3J8KBhrfI6KNv9RhnoQAAAA8"]
[Fri Feb 27 23:24:24.085749 2026] [:error] [pid 52073:tid 52077] [client 20.220.221.45:1513] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG3KIa650YPyxXVeRbWxgAAAYE"]
[Fri Feb 27 23:24:24.762056 2026] [:error] [pid 56075:tid 56083] [client 20.220.221.45:63820] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG3KMKBhrfI6KNv9RhnpwAAAAY"]
[Fri Feb 27 23:41:27.122693 2026] [:error] [pid 52073:tid 52078] [client 40.80.89.74:4800] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 23:41:27.279325 2026] [:error] [pid 52073:tid 52082] [client 40.80.89.74:4800] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 23:41:27.563704 2026] [:error] [pid 52073:tid 52100] [client 40.80.89.74:4800] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 27 23:41:27.705071 2026] [:error] [pid 52073:tid 52094] [client 40.80.89.74:4800] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 23:41:27.996741 2026] [:error] [pid 52073:tid 52098] [client 40.80.89.74:4800] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 27 23:41:28.138345 2026] [:error] [pid 52073:tid 52091] [client 40.80.89.74:4800] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 23:41:28.281681 2026] [:error] [pid 52073:tid 52083] [client 40.80.89.74:4800] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Feb 27 23:41:28.561073 2026] [:error] [pid 52073:tid 52077] [client 40.80.89.74:4800] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaG7KIa650YPyxXVeRbisgAAAYE"]
[Fri Feb 27 23:41:29.131905 2026] [:error] [pid 52073:tid 52099] [client 40.80.89.74:4240] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaG7KYa650YPyxXVeRbiugAAAZc"]
[Fri Feb 27 23:41:29.689245 2026] [:error] [pid 54231:tid 54239] [client 40.80.89.74:4265] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaG7KeTvb5AeyJCdY7BOmgAAAEU"]
[Fri Feb 27 23:41:30.275358 2026] [:error] [pid 52073:tid 52091] [client 40.80.89.74:5071] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaG7Koa650YPyxXVeRbiwQAAAY8"]
[Sat Feb 28 00:07:24.544749 2026] [:error] [pid 56075:tid 56083] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Sat Feb 28 00:07:24.753606 2026] [:error] [pid 56075:tid 56102] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sat Feb 28 00:07:25.041910 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Sat Feb 28 00:07:25.251846 2026] [:error] [pid 56075:tid 56095] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/X57.php
[Sat Feb 28 00:07:25.461941 2026] [:error] [pid 56075:tid 56082] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/wpver.php
[Sat Feb 28 00:07:25.994943 2026] [:error] [pid 56075:tid 56094] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sat Feb 28 00:07:26.220001 2026] [:error] [pid 56075:tid 56084] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sat Feb 28 00:07:26.468189 2026] [:error] [pid 56075:tid 56091] [client 4.204.200.32:64382] File does not exist: /usr/local/apache/htdocs/suspended-page/wqqs.php
[Sat Feb 28 00:07:27.106297 2026] [:error] [pid 56075:tid 56100] [client 4.204.200.32:64382] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-318.php"] [unique_id "aaHBP8KBhrfI6KNv9RiMhAAAABY"]
[Sat Feb 28 00:07:28.001839 2026] [:error] [pid 49306:tid 49310] [client 4.204.200.32:28382] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-318.php"] [unique_id "aaHBQPnSUDZue59Px9uJ4gAAAUI"]
[Sat Feb 28 00:07:29.679492 2026] [:error] [pid 54231:tid 54247] [client 4.204.200.32:28377] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-318.php"] [unique_id "aaHBQeTvb5AeyJCdY7BV-AAAAE0"]
[Sat Feb 28 00:07:30.574525 2026] [:error] [pid 52073:tid 52081] [client 4.204.200.32:28401] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-318.php"] [unique_id "aaHBQoa650YPyxXVeRb8CAAAAYU"]
[Sat Feb 28 00:07:32.413573 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:64365] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHBRPnSUDZue59Px9uKBwAAAVY"]
[Sat Feb 28 00:07:39.064748 2026] [:error] [pid 49306:tid 49317] [client 4.204.200.32:28389] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHBS_nSUDZue59Px9uKDgAAAUk"]
[Sat Feb 28 00:07:42.721889 2026] [:error] [pid 54102:tid 54168] [client 4.204.200.32:64358] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHBTni74D4fiYUm_GedSgAAAJc"]
[Sat Feb 28 00:07:45.462993 2026] [:error] [pid 62998:tid 63007] [client 4.204.200.32:28567] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHBUVQeueXZDUmoLomcfAAAAQU"]
[Sat Feb 28 00:07:47.065464 2026] [:error] [pid 62998:tid 63014] [client 4.204.200.32:27667] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaHBU1QeueXZDUmoLomcggAAAQw"]
[Sat Feb 28 00:07:48.511695 2026] [:error] [pid 62998:tid 63005] [client 4.204.200.32:27695] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaHBVFQeueXZDUmoLomciAAAAQM"]
[Sat Feb 28 00:07:49.866981 2026] [:error] [pid 54102:tid 54147] [client 4.204.200.32:28564] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaHBVXi74D4fiYUm_GedUQAAAIM"]
[Sat Feb 28 00:07:52.655578 2026] [:error] [pid 54103:tid 54188] [client 4.204.200.32:28406] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dom.php"] [unique_id "aaHBWOvG4MPCmE0B2sDbSQAAANE"]
[Sat Feb 28 00:07:53.780476 2026] [:error] [pid 49306:tid 49319] [client 4.204.200.32:27701] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rxzx.php"] [unique_id "aaHBWfnSUDZue59Px9uKPAAAAUs"]
[Sat Feb 28 00:07:55.646567 2026] [:error] [pid 56075:tid 56082] [client 4.204.200.32:28366] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rxzx.php"] [unique_id "aaHBW8KBhrfI6KNv9RiMxQAAAAU"]
[Sat Feb 28 00:07:57.134511 2026] [:error] [pid 56075:tid 56091] [client 4.204.200.32:27650] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rxzx.php"] [unique_id "aaHBXcKBhrfI6KNv9RiMygAAAA0"]
[Sat Feb 28 00:07:57.966170 2026] [:error] [pid 62998:tid 63019] [client 4.204.200.32:28376] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rxzx.php"] [unique_id "aaHBXVQeueXZDUmoLomclwAAARE"]
[Sat Feb 28 00:08:01.145298 2026] [:error] [pid 54101:tid 54130] [client 4.204.200.32:64334] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaHBYVY5qgRktcYTGFtnoQAAAdY"]
[Sat Feb 28 00:08:02.141345 2026] [:error] [pid 52073:tid 52083] [client 4.204.200.32:64346] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaHBYoa650YPyxXVeRb8aQAAAYc"]
[Sat Feb 28 00:08:05.913527 2026] [:error] [pid 52073:tid 52091] [client 4.204.200.32:27669] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaHBZYa650YPyxXVeRb8cwAAAY8"]
[Sat Feb 28 00:08:07.393609 2026] [:error] [pid 54101:tid 54117] [client 4.204.200.32:27655] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaHBZ1Y5qgRktcYTGFtnsAAAAck"]
[Sat Feb 28 00:08:08.973924 2026] [:error] [pid 49306:tid 49329] [client 4.204.200.32:64369] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaHBaPnSUDZue59Px9uKdAAAAVU"]
[Sat Feb 28 00:08:11.038071 2026] [:error] [pid 52073:tid 52092] [client 4.204.200.32:28561] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaHBa4a650YPyxXVeRb8gAAAAZA"]
[Sat Feb 28 00:08:13.118454 2026] [:error] [pid 52073:tid 52091] [client 4.204.200.32:27697] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaHBbYa650YPyxXVeRb8jwAAAY8"]
[Sat Feb 28 00:08:14.309185 2026] [:error] [pid 54231:tid 54235] [client 4.204.200.32:64370] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaHBbuTvb5AeyJCdY7BWBgAAAEE"]
[Sat Feb 28 00:08:17.424324 2026] [:error] [pid 54103:tid 54187] [client 4.204.200.32:28379] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thui.php"] [unique_id "aaHBcevG4MPCmE0B2sDbWwAAANA"]
[Sat Feb 28 00:08:18.595480 2026] [:error] [pid 62998:tid 63016] [client 4.204.200.32:28407] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thui.php"] [unique_id "aaHBclQeueXZDUmoLomcugAAAQ4"]
[Sat Feb 28 00:08:20.509840 2026] [:error] [pid 52073:tid 52080] [client 4.204.200.32:64375] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thui.php"] [unique_id "aaHBdIa650YPyxXVeRb8rgAAAYQ"]
[Sat Feb 28 00:08:21.685563 2026] [:error] [pid 52073:tid 52085] [client 4.204.200.32:27675] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thui.php"] [unique_id "aaHBdYa650YPyxXVeRb8swAAAYk"]
[Sat Feb 28 00:08:23.027036 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:64341] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ebahvhhh.php"] [unique_id "aaHBd4a650YPyxXVeRb8wgAAAZE"]
[Sat Feb 28 00:08:24.931846 2026] [:error] [pid 49306:tid 49314] [client 4.204.200.32:28353] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ebahvhhh.php"] [unique_id "aaHBePnSUDZue59Px9uKlwAAAUY"]
[Sat Feb 28 00:08:26.242174 2026] [:error] [pid 52073:tid 52084] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/ebahvhhh.php
[Sat Feb 28 00:08:26.459917 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/snq.php
[Sat Feb 28 00:08:26.675171 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/mcs.php
[Sat Feb 28 00:08:27.036246 2026] [:error] [pid 52073:tid 52095] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sat Feb 28 00:08:27.612211 2026] [:error] [pid 52073:tid 52100] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sat Feb 28 00:08:28.087912 2026] [:error] [pid 52073:tid 52082] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Sat Feb 28 00:08:28.363667 2026] [:error] [pid 52073:tid 52076] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sat Feb 28 00:08:28.576451 2026] [:error] [pid 52073:tid 52084] [client 4.204.200.32:64350] File does not exist: /usr/local/apache/htdocs/suspended-page/tmpls.php
[Sat Feb 28 00:08:29.030010 2026] [:error] [pid 52073:tid 52087] [client 4.204.200.32:64350] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaHBfYa650YPyxXVeRb89wAAAYs"]
[Sat Feb 28 00:08:31.296474 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:62632] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaHBf4a650YPyxXVeRb8_gAAAYo"]
[Sat Feb 28 00:08:35.877061 2026] [:error] [pid 56075:tid 56088] [client 4.204.200.32:27703] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaHBg8KBhrfI6KNv9RiNAwAAAAs"]
[Sat Feb 28 00:08:36.411557 2026] [:error] [pid 62998:tid 63005] [client 4.204.200.32:27680] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaHBhFQeueXZDUmoLomcyQAAAQM"]
[Sat Feb 28 00:08:38.275027 2026] [:error] [pid 54231:tid 54238] [client 4.204.200.32:27652] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaHBhuTvb5AeyJCdY7BWEgAAAEQ"]
[Sat Feb 28 00:08:39.531630 2026] [:error] [pid 52073:tid 52100] [client 4.204.200.32:28354] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaHBh4a650YPyxXVeRb9HAAAAZg"]
[Sat Feb 28 00:08:41.801645 2026] [:error] [pid 49306:tid 49331] [client 4.204.200.32:64352] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaHBifnSUDZue59Px9uKrQAAAVc"]
[Sat Feb 28 00:08:43.437583 2026] [:error] [pid 62998:tid 63014] [client 4.204.200.32:28378] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaHBi1QeueXZDUmoLomc2wAAAQw"]
[Sat Feb 28 00:08:50.745821 2026] [:error] [pid 62998:tid 63001] [client 4.204.200.32:27702] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaHBklQeueXZDUmoLomc6gAAAQA"]
[Sat Feb 28 00:08:52.708263 2026] [:error] [pid 56075:tid 56077] [client 4.204.200.32:64335] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaHBlMKBhrfI6KNv9RiNTAAAAAA"]
[Sat Feb 28 00:08:57.167449 2026] [:error] [pid 62998:tid 63025] [client 4.204.200.32:28560] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaHBmVQeueXZDUmoLomc7wAAARc"]
[Sat Feb 28 00:09:00.630248 2026] [:error] [pid 52073:tid 52091] [client 4.204.200.32:28583] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app"] [unique_id "aaHBnIa650YPyxXVeRb-IAAAAY8"]
[Sat Feb 28 00:09:04.152767 2026] [:error] [pid 52073:tid 52088] [client 4.204.200.32:27656] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app"] [unique_id "aaHBoIa650YPyxXVeRb-QwAAAYw"]
[Sat Feb 28 00:09:05.873727 2026] [:error] [pid 52073:tid 52095] [client 4.204.200.32:27692] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app"] [unique_id "aaHBoYa650YPyxXVeRb-TgAAAZM"]
[Sat Feb 28 00:09:06.687406 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:28568] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app"] [unique_id "aaHBooa650YPyxXVeRb-WgAAAYo"]
[Sat Feb 28 00:09:07.639295 2026] [:error] [pid 62998:tid 63015] [client 4.204.200.32:27699] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws59.php"] [unique_id "aaHBo1QeueXZDUmoLomc-AAAAQ0"]
[Sat Feb 28 00:09:09.280339 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:27683] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws59.php"] [unique_id "aaHBpcKBhrfI6KNv9RiNcAAAAAg"]
[Sat Feb 28 00:09:10.154652 2026] [:error] [pid 49306:tid 49328] [client 4.204.200.32:28374] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws59.php"] [unique_id "aaHBpvnSUDZue59Px9uK-wAAAVQ"]
[Sat Feb 28 00:09:11.191276 2026] [:error] [pid 62998:tid 63016] [client 4.204.200.32:27668] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws59.php"] [unique_id "aaHBp1QeueXZDUmoLomdBAAAAQ4"]
[Sat Feb 28 00:09:12.367057 2026] [:error] [pid 62998:tid 63015] [client 4.204.200.32:64343] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaHBqFQeueXZDUmoLomdDAAAAQ0"]
[Sat Feb 28 00:09:13.962175 2026] [:error] [pid 56075:tid 56099] [client 4.204.200.32:64354] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaHBqcKBhrfI6KNv9RiNlQAAABU"]
[Sat Feb 28 00:09:15.713000 2026] [:error] [pid 52073:tid 52087] [client 4.204.200.32:63886] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaHBq4a650YPyxXVeRb-gwAAAYs"]
[Sat Feb 28 00:09:17.207437 2026] [:error] [pid 49306:tid 49317] [client 4.204.200.32:27665] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaHBrfnSUDZue59Px9uLCwAAAUk"]
[Sat Feb 28 00:09:19.181642 2026] [:error] [pid 52073:tid 52089] [client 4.204.200.32:28555] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mamzi.php"] [unique_id "aaHBr4a650YPyxXVeRb-kwAAAY0"]
[Sat Feb 28 00:09:20.021068 2026] [:error] [pid 56075:tid 56095] [client 4.204.200.32:28412] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mamzi.php"] [unique_id "aaHBsMKBhrfI6KNv9RiNvgAAABE"]
[Sat Feb 28 00:09:21.211566 2026] [:error] [pid 52073:tid 52100] [client 4.204.200.32:28391] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mamzi.php"] [unique_id "aaHBsYa650YPyxXVeRb-mQAAAZg"]
[Sat Feb 28 00:09:22.338178 2026] [:error] [pid 52073:tid 52091] [client 4.204.200.32:28403] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mamzi.php"] [unique_id "aaHBsoa650YPyxXVeRb-oQAAAY8"]
[Sat Feb 28 00:09:23.661658 2026] [:error] [pid 62998:tid 63020] [client 4.204.200.32:27682] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaHBs1QeueXZDUmoLomdOQAAARI"]
[Sat Feb 28 00:09:24.801119 2026] [:error] [pid 52073:tid 52098] [client 4.204.200.32:64376] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaHBtIa650YPyxXVeRb-sQAAAZY"]
[Sat Feb 28 00:09:26.224720 2026] [:error] [pid 52073:tid 52078] [client 4.204.200.32:64372] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaHBtoa650YPyxXVeRb-vAAAAYI"]
[Sat Feb 28 00:09:27.482959 2026] [:error] [pid 54231:tid 54254] [client 4.204.200.32:28395] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaHBt-Tvb5AeyJCdY7BWTwAAAFQ"]
[Sat Feb 28 00:09:30.133645 2026] [:error] [pid 56075:tid 56087] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Sat Feb 28 00:09:30.343016 2026] [:error] [pid 56075:tid 56081] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Sat Feb 28 00:09:30.551318 2026] [:error] [pid 56075:tid 56093] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Sat Feb 28 00:09:31.033508 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Sat Feb 28 00:09:31.240531 2026] [:error] [pid 56075:tid 56077] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/bb.php
[Sat Feb 28 00:09:31.661128 2026] [:error] [pid 56075:tid 56095] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/dsd.php
[Sat Feb 28 00:09:31.870524 2026] [:error] [pid 56075:tid 56093] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/guk.php
[Sat Feb 28 00:09:32.322503 2026] [:error] [pid 56075:tid 56081] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/ze.php
[Sat Feb 28 00:09:32.544755 2026] [:error] [pid 56075:tid 56092] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/file52.php
[Sat Feb 28 00:09:32.753455 2026] [:error] [pid 56075:tid 56077] [client 4.204.200.32:27698] File does not exist: /usr/local/apache/htdocs/suspended-page/tax.php
[Sat Feb 28 00:09:32.967918 2026] [:error] [pid 56075:tid 56096] [client 4.204.200.32:27698] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaHBvMKBhrfI6KNv9RiOMAAAABI"]
[Sat Feb 28 00:09:33.672957 2026] [:error] [pid 54103:tid 54178] [client 4.204.200.32:27681] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaHBvevG4MPCmE0B2sDblAAAAMc"]
[Sat Feb 28 00:09:36.363696 2026] [:error] [pid 54231:tid 54254] [client 4.204.200.32:64368] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaHBwOTvb5AeyJCdY7BWWwAAAFQ"]
[Sat Feb 28 00:09:37.704684 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:64364] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaHBwYa650YPyxXVeRb-8wAAAZE"]
[Sat Feb 28 00:09:39.013660 2026] [:error] [pid 56075:tid 56087] [client 4.204.200.32:64325] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aaHBw8KBhrfI6KNv9RiOSgAAAAo"]
[Sat Feb 28 00:09:40.193307 2026] [:error] [pid 56075:tid 56098] [client 4.204.200.32:28387] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aaHBxMKBhrfI6KNv9RiOVwAAABQ"]
[Sat Feb 28 00:09:41.277825 2026] [:error] [pid 54231:tid 54257] [client 4.204.200.32:28593] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aaHBxeTvb5AeyJCdY7BWXgAAAFc"]
[Sat Feb 28 00:09:42.657580 2026] [:error] [pid 54231:tid 54238] [client 4.204.200.32:28410] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ty.php"] [unique_id "aaHBxuTvb5AeyJCdY7BWYgAAAEQ"]
[Sat Feb 28 00:09:43.503231 2026] [:error] [pid 56075:tid 56097] [client 4.204.200.32:27673] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brc.php"] [unique_id "aaHBx8KBhrfI6KNv9RiOawAAABM"]
[Sat Feb 28 00:09:44.396476 2026] [:error] [pid 49306:tid 49326] [client 4.204.200.32:28563] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brc.php"] [unique_id "aaHByPnSUDZue59Px9uLTwAAAVI"]
[Sat Feb 28 00:09:45.393196 2026] [:error] [pid 49306:tid 49328] [client 4.204.200.32:27708] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brc.php"] [unique_id "aaHByfnSUDZue59Px9uLUwAAAVQ"]
[Sat Feb 28 00:09:47.643320 2026] [:error] [pid 54101:tid 54128] [client 4.204.200.32:28552] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/brc.php"] [unique_id "aaHBy1Y5qgRktcYTGFtnxgAAAdQ"]
[Sat Feb 28 00:09:49.318947 2026] [:error] [pid 56075:tid 56078] [client 4.204.200.32:28388] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHBzcKBhrfI6KNv9RiOkQAAAAE"]
[Sat Feb 28 00:09:50.892171 2026] [:error] [pid 56075:tid 56097] [client 4.204.200.32:62611] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHBzsKBhrfI6KNv9RiOmwAAABM"]
[Sat Feb 28 00:09:51.672920 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:28357] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHBz4a650YPyxXVeRb_EgAAAZU"]
[Sat Feb 28 00:09:52.661196 2026] [:error] [pid 62998:tid 63004] [client 4.204.200.32:54617] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHB0FQeueXZDUmoLomdTwAAAQI"]
[Sat Feb 28 00:09:57.498519 2026] [:error] [pid 52073:tid 52083] [client 4.204.200.32:28393] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaHB1Ya650YPyxXVeRb_JgAAAYc"]
[Sat Feb 28 00:10:00.560265 2026] [:error] [pid 52073:tid 52099] [client 4.204.200.32:64336] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaHB2Ia650YPyxXVeRb_LQAAAZc"]
[Sat Feb 28 00:10:01.794564 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:63875] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaHB2Ya650YPyxXVeRb_MwAAAZU"]
[Sat Feb 28 00:10:03.876736 2026] [:error] [pid 49306:tid 49321] [client 4.204.200.32:28414] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaHB2_nSUDZue59Px9uLawAAAU0"]
[Sat Feb 28 00:10:06.412640 2026] [:error] [pid 54102:tid 54158] [client 4.204.200.32:27658] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaHB3ni74D4fiYUm_GeddgAAAI4"]
[Sat Feb 28 00:10:08.161819 2026] [:error] [pid 56075:tid 56091] [client 4.204.200.32:28576] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaHB4MKBhrfI6KNv9RiPAAAAAA0"]
[Sat Feb 28 00:10:09.217126 2026] [:error] [pid 56075:tid 56101] [client 4.204.200.32:27686] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaHB4cKBhrfI6KNv9RiPBwAAABc"]
[Sat Feb 28 00:10:10.559927 2026] [:error] [pid 54103:tid 54170] [client 4.204.200.32:64363] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaHB4uvG4MPCmE0B2sDbpgAAAMA"]
[Sat Feb 28 00:10:11.650998 2026] [:error] [pid 54231:tid 54239] [client 4.204.200.32:27706] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaHB4-Tvb5AeyJCdY7BWkQAAAEU"]
[Sat Feb 28 00:10:13.111584 2026] [:error] [pid 52073:tid 52081] [client 4.204.200.32:28558] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaHB5Ya650YPyxXVeRb_eAAAAYU"]
[Sat Feb 28 00:10:13.834010 2026] [:error] [pid 56075:tid 56080] [client 4.204.200.32:62628] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaHB5cKBhrfI6KNv9RiPEQAAAAM"]
[Sat Feb 28 00:10:14.503224 2026] [:error] [pid 62998:tid 63002] [client 4.204.200.32:27696] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaHB5lQeueXZDUmoLomdXwAAAQE"]
[Sat Feb 28 00:10:15.702258 2026] [:error] [pid 56075:tid 56095] [client 4.204.200.32:27651] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aaHB58KBhrfI6KNv9RiPGAAAABE"]
[Sat Feb 28 00:10:16.584096 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:62592] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aaHB6MKBhrfI6KNv9RiPHQAAAAg"]
[Sat Feb 28 00:10:17.645061 2026] [:error] [pid 54102:tid 54161] [client 4.204.200.32:28402] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aaHB6Xi74D4fiYUm_GedewAAAJE"]
[Sat Feb 28 00:10:19.255881 2026] [:error] [pid 52073:tid 52077] [client 4.204.200.32:28397] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gool.php"] [unique_id "aaHB64a650YPyxXVeRb_lQAAAYE"]
[Sat Feb 28 00:10:20.509831 2026] [:error] [pid 56075:tid 56083] [client 4.204.200.32:28595] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaHB7MKBhrfI6KNv9RiPMwAAAAY"]
[Sat Feb 28 00:10:21.463972 2026] [:error] [pid 49306:tid 49324] [client 4.204.200.32:27670] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaHB7fnSUDZue59Px9uLqgAAAVA"]
[Sat Feb 28 00:10:22.786674 2026] [:error] [pid 49306:tid 49321] [client 4.204.200.32:27704] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaHB7vnSUDZue59Px9uLsQAAAU0"]
[Sat Feb 28 00:10:23.560353 2026] [:error] [pid 52073:tid 52087] [client 4.204.200.32:27648] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaHB74a650YPyxXVeRb_tgAAAYs"]
[Sat Feb 28 00:10:24.906499 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:28360] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aaHB8MKBhrfI6KNv9RiPPwAAAAg"]
[Sat Feb 28 00:10:25.755814 2026] [:error] [pid 56075:tid 56083] [client 4.204.200.32:28580] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aaHB8cKBhrfI6KNv9RiPRgAAAAY"]
[Sat Feb 28 00:10:26.710676 2026] [:error] [pid 52073:tid 52092] [client 4.204.200.32:27705] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aaHB8oa650YPyxXVeRb_zAAAAZA"]
[Sat Feb 28 00:10:27.660117 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:64329] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mans.php"] [unique_id "aaHB84a650YPyxXVeRb_0gAAAZU"]
[Sat Feb 28 00:10:28.775928 2026] [:error] [pid 52073:tid 52091] [client 4.204.200.32:28546] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rum.php"] [unique_id "aaHB9Ia650YPyxXVeRb_1wAAAY8"]
[Sat Feb 28 00:10:29.550159 2026] [:error] [pid 62998:tid 63017] [client 4.204.200.32:28550] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rum.php"] [unique_id "aaHB9VQeueXZDUmoLomdfwAAAQ8"]
[Sat Feb 28 00:10:30.255111 2026] [:error] [pid 49306:tid 49311] [client 4.204.200.32:28398] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rum.php"] [unique_id "aaHB9vnSUDZue59Px9uLwgAAAUM"]
[Sat Feb 28 00:10:31.318130 2026] [:error] [pid 62998:tid 63016] [client 4.204.200.32:54600] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rum.php"] [unique_id "aaHB91QeueXZDUmoLomdhQAAAQ4"]
[Sat Feb 28 00:10:31.890887 2026] [:error] [pid 54102:tid 54159] [client 4.204.200.32:28355] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaHB93i74D4fiYUm_GedngAAAI8"]
[Sat Feb 28 00:10:33.679974 2026] [:error] [pid 52073:tid 52084] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Sat Feb 28 00:10:33.895578 2026] [:error] [pid 52073:tid 52089] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/wio.php
[Sat Feb 28 00:10:34.108789 2026] [:error] [pid 52073:tid 52083] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/clasa99.php
[Sat Feb 28 00:10:35.875033 2026] [:error] [pid 52073:tid 52090] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/ws62.php
[Sat Feb 28 00:10:36.159632 2026] [:error] [pid 52073:tid 52083] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sat Feb 28 00:10:36.369355 2026] [:error] [pid 52073:tid 52082] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sat Feb 28 00:10:36.577586 2026] [:error] [pid 52073:tid 52080] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Sat Feb 28 00:10:36.796044 2026] [:error] [pid 52073:tid 52085] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/cxc.php
[Sat Feb 28 00:10:37.007570 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/gjm.php
[Sat Feb 28 00:10:37.217286 2026] [:error] [pid 52073:tid 52092] [client 4.204.200.32:64366] File does not exist: /usr/local/apache/htdocs/suspended-page/ex.php
[Sat Feb 28 00:10:37.423996 2026] [:error] [pid 52073:tid 52089] [client 4.204.200.32:64366] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aaHB_Ya650YPyxXVeRYACgAAAY0"]
[Sat Feb 28 00:10:38.568121 2026] [:error] [pid 54231:tid 54235] [client 4.204.200.32:27684] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aaHB_uTvb5AeyJCdY7BWpAAAAEE"]
[Sat Feb 28 00:10:39.681116 2026] [:error] [pid 56075:tid 56098] [client 4.204.200.32:27649] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aaHB_8KBhrfI6KNv9RiPfgAAABQ"]
[Sat Feb 28 00:10:40.602118 2026] [:error] [pid 62998:tid 63005] [client 4.204.200.32:27672] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/post.php"] [unique_id "aaHCAFQeueXZDUmoLomdlgAAAQM"]
[Sat Feb 28 00:10:41.410186 2026] [:error] [pid 62998:tid 63018] [client 4.204.200.32:28548] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaHCAVQeueXZDUmoLomdnAAAARA"]
[Sat Feb 28 00:10:43.132312 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:64381] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaHCA4a650YPyxXVeRYAEwAAAZU"]
[Sat Feb 28 00:10:44.495195 2026] [:error] [pid 49306:tid 49313] [client 4.204.200.32:64374] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaHCBPnSUDZue59Px9uL3AAAAUU"]
[Sat Feb 28 00:10:45.665844 2026] [:error] [pid 52073:tid 52087] [client 4.204.200.32:27660] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaHCBYa650YPyxXVeRYAKgAAAYs"]
[Sat Feb 28 00:10:47.571863 2026] [:error] [pid 62998:tid 63006] [client 4.204.200.32:28383] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jq.php"] [unique_id "aaHCB1QeueXZDUmoLomdpQAAAQQ"]
[Sat Feb 28 00:10:49.334339 2026] [:error] [pid 52073:tid 52091] [client 4.204.200.32:63929] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jq.php"] [unique_id "aaHCCYa650YPyxXVeRYARwAAAY8"]
[Sat Feb 28 00:10:51.266589 2026] [:error] [pid 49306:tid 49329] [client 4.204.200.32:62637] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jq.php"] [unique_id "aaHCC_nSUDZue59Px9uL5gAAAVU"]
[Sat Feb 28 00:10:52.988541 2026] [:error] [pid 54102:tid 54144] [client 4.204.200.32:63891] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jq.php"] [unique_id "aaHCDHi74D4fiYUm_GeduQAAAIA"]
[Sat Feb 28 00:10:54.052115 2026] [:error] [pid 49306:tid 49332] [client 4.204.200.32:28385] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaHCDvnSUDZue59Px9uL8gAAAVg"]
[Sat Feb 28 00:10:55.390279 2026] [:error] [pid 49306:tid 49310] [client 4.204.200.32:62618] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaHCD_nSUDZue59Px9uMBAAAAUI"]
[Sat Feb 28 00:10:57.032833 2026] [:error] [pid 49306:tid 49332] [client 4.204.200.32:64330] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaHCEfnSUDZue59Px9uMEwAAAVg"]
[Sat Feb 28 00:10:57.968326 2026] [:error] [pid 54103:tid 54194] [client 4.204.200.32:64361] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaHCEevG4MPCmE0B2sDb5gAAANc"]
[Sat Feb 28 00:10:59.337913 2026] [:error] [pid 62998:tid 63019] [client 4.204.200.32:62619] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bes.php"] [unique_id "aaHCE1QeueXZDUmoLomdxwAAARE"]
[Sat Feb 28 00:11:01.170990 2026] [:error] [pid 49306:tid 49320] [client 4.204.200.32:27709] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bes.php"] [unique_id "aaHCFfnSUDZue59Px9uMKQAAAUw"]
[Sat Feb 28 00:11:02.041580 2026] [:error] [pid 56075:tid 56084] [client 4.204.200.32:28369] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bes.php"] [unique_id "aaHCFsKBhrfI6KNv9RiP0AAAAAc"]
[Sat Feb 28 00:11:02.765218 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:28603] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bes.php"] [unique_id "aaHCFoa650YPyxXVeRYAawAAAYo"]
[Sat Feb 28 00:11:03.864323 2026] [:error] [pid 56075:tid 56094] [client 4.204.200.32:64342] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaHCF8KBhrfI6KNv9RiP7AAAABA"]
[Sat Feb 28 00:11:05.172924 2026] [:error] [pid 56075:tid 56092] [client 4.204.200.32:28380] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaHCGcKBhrfI6KNv9RiQAgAAAA4"]
[Sat Feb 28 00:11:06.734125 2026] [:error] [pid 56075:tid 56077] [client 4.204.200.32:28553] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaHCGsKBhrfI6KNv9RiQGQAAAAA"]
[Sat Feb 28 00:11:07.421193 2026] [:error] [pid 62998:tid 63015] [client 4.204.200.32:63928] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaHCG1QeueXZDUmoLomd1wAAAQ0"]
[Sat Feb 28 00:11:08.712271 2026] [:error] [pid 52073:tid 52085] [client 4.204.200.32:63878] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaHCHIa650YPyxXVeRYAbQAAAYk"]
[Sat Feb 28 00:11:09.486336 2026] [:error] [pid 52073:tid 52081] [client 4.204.200.32:27662] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaHCHYa650YPyxXVeRYAdAAAAYU"]
[Sat Feb 28 00:11:10.465883 2026] [:error] [pid 62998:tid 63012] [client 4.204.200.32:28594] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaHCHlQeueXZDUmoLomd3AAAAQo"]
[Sat Feb 28 00:11:13.420865 2026] [:error] [pid 52073:tid 52087] [client 4.204.200.32:64348] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaHCIYa650YPyxXVeRYAmwAAAYs"]
[Sat Feb 28 00:11:14.361989 2026] [:error] [pid 52073:tid 52078] [client 4.204.200.32:28368] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaHCIoa650YPyxXVeRYApAAAAYI"]
[Sat Feb 28 00:11:15.308451 2026] [:error] [pid 56075:tid 56086] [client 4.204.200.32:28606] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaHCI8KBhrfI6KNv9RiQOAAAAAk"]
[Sat Feb 28 00:11:17.260057 2026] [:error] [pid 52073:tid 52077] [client 4.204.200.32:63901] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaHCJYa650YPyxXVeRYAsAAAAYE"]
[Sat Feb 28 00:11:18.416699 2026] [:error] [pid 56075:tid 56078] [client 4.204.200.32:63872] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaHCJsKBhrfI6KNv9RiQTgAAAAE"]
[Sat Feb 28 00:11:19.001717 2026] [:error] [pid 52073:tid 52099] [client 4.204.200.32:64347] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaHCJ4a650YPyxXVeRYAtQAAAZc"]
[Sat Feb 28 00:11:20.183816 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:27666] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaHCKMKBhrfI6KNv9RiQVgAAAAg"]
[Sat Feb 28 00:11:22.071241 2026] [:error] [pid 56075:tid 56086] [client 4.204.200.32:64332] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaHCKsKBhrfI6KNv9RiQaAAAAAk"]
[Sat Feb 28 00:11:22.871887 2026] [:error] [pid 62998:tid 63021] [client 4.204.200.32:27664] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "aaHCKlQeueXZDUmoLomd6gAAARM"]
[Sat Feb 28 00:11:24.140202 2026] [:error] [pid 54101:tid 54110] [client 4.204.200.32:28363] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c4.php"] [unique_id "aaHCLFY5qgRktcYTGFtn8QAAAcI"]
[Sat Feb 28 00:11:25.084855 2026] [:error] [pid 54231:tid 54249] [client 4.204.200.32:63889] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c4.php"] [unique_id "aaHCLeTvb5AeyJCdY7BW4AAAAE8"]
[Sat Feb 28 00:11:26.035039 2026] [:error] [pid 49306:tid 49317] [client 4.204.200.32:27659] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c4.php"] [unique_id "aaHCLvnSUDZue59Px9uMZAAAAUk"]
[Sat Feb 28 00:11:26.858248 2026] [:error] [pid 56075:tid 56091] [client 4.204.200.32:28579] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c4.php"] [unique_id "aaHCLsKBhrfI6KNv9RiQhAAAAA0"]
[Sat Feb 28 00:11:29.454720 2026] [:error] [pid 62998:tid 63011] [client 4.204.200.32:27711] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaHCMVQeueXZDUmoLomd7gAAAQk"]
[Sat Feb 28 00:11:30.768244 2026] [:error] [pid 62998:tid 63001] [client 4.204.200.32:62593] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaHCMlQeueXZDUmoLomd8QAAAQA"]
[Sat Feb 28 00:11:32.060624 2026] [:error] [pid 52073:tid 52088] [client 4.204.200.32:64373] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaHCNIa650YPyxXVeRYA-AAAAYw"]
[Sat Feb 28 00:11:33.395495 2026] [:error] [pid 62998:tid 63015] [client 4.204.200.32:54598] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaHCNVQeueXZDUmoLomd9gAAAQ0"]
[Sat Feb 28 00:11:35.368125 2026] [:error] [pid 56075:tid 56078] [client 4.204.200.32:28367] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fasx.php"] [unique_id "aaHCN8KBhrfI6KNv9RiQtgAAAAE"]
[Sat Feb 28 00:11:35.989267 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:28415] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fasx.php"] [unique_id "aaHCN4a650YPyxXVeRYBEwAAAYo"]
[Sat Feb 28 00:11:36.877727 2026] [:error] [pid 52073:tid 52100] [client 4.204.200.32:28409] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fasx.php"] [unique_id "aaHCOIa650YPyxXVeRYBFwAAAZg"]
[Sat Feb 28 00:11:38.045253 2026] [:error] [pid 49306:tid 49324] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/fasx.php
[Sat Feb 28 00:11:38.569482 2026] [:error] [pid 49306:tid 49313] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Sat Feb 28 00:11:38.969068 2026] [:error] [pid 49306:tid 49327] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/nzv.php
[Sat Feb 28 00:11:39.212210 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sat Feb 28 00:11:39.457237 2026] [:error] [pid 49306:tid 49314] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Sat Feb 28 00:11:39.673679 2026] [:error] [pid 49306:tid 49332] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/nhr.php
[Sat Feb 28 00:11:39.914854 2026] [:error] [pid 49306:tid 49323] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sat Feb 28 00:11:40.167028 2026] [:error] [pid 49306:tid 49315] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/ws79.php
[Sat Feb 28 00:11:40.385629 2026] [:error] [pid 49306:tid 49309] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/1061.php
[Sat Feb 28 00:11:40.643349 2026] [:error] [pid 49306:tid 49319] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq13.php
[Sat Feb 28 00:11:40.971219 2026] [:error] [pid 49306:tid 49321] [client 4.204.200.32:28544] File does not exist: /usr/local/apache/htdocs/suspended-page/hello.php
[Sat Feb 28 00:11:41.177134 2026] [:error] [pid 49306:tid 49308] [client 4.204.200.32:28544] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/05.php"] [unique_id "aaHCPfnSUDZue59Px9uMiQAAAUA"]
[Sat Feb 28 00:11:42.527074 2026] [:error] [pid 62998:tid 63018] [client 4.204.200.32:54604] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/05.php"] [unique_id "aaHCPlQeueXZDUmoLomeAAAAARA"]
[Sat Feb 28 00:11:45.505144 2026] [:error] [pid 52073:tid 52080] [client 4.204.200.32:64322] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/05.php"] [unique_id "aaHCQYa650YPyxXVeRYBSAAAAYQ"]
[Sat Feb 28 00:11:46.432560 2026] [:error] [pid 54101:tid 54119] [client 4.204.200.32:64371] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/05.php"] [unique_id "aaHCQlY5qgRktcYTGFtn_AAAAcs"]
[Sat Feb 28 00:11:51.821616 2026] [:error] [pid 62998:tid 63004] [client 4.204.200.32:64338] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aaHCR1QeueXZDUmoLomeGwAAAQI"]
[Sat Feb 28 00:11:52.826650 2026] [:error] [pid 54101:tid 54114] [client 4.204.200.32:63900] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aaHCSFY5qgRktcYTGFtoAQAAAcY"]
[Sat Feb 28 00:11:54.847027 2026] [:error] [pid 56075:tid 56102] [client 4.204.200.32:64383] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aaHCSsKBhrfI6KNv9RiRFAAAABg"]
[Sat Feb 28 00:11:56.331738 2026] [:error] [pid 56075:tid 56085] [client 4.204.200.32:64333] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "aaHCTMKBhrfI6KNv9RiRGwAAAAg"]
[Sat Feb 28 00:11:58.357060 2026] [:error] [pid 62998:tid 63013] [client 4.204.200.32:28401] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaHCTlQeueXZDUmoLomeNgAAAQs"]
[Sat Feb 28 00:11:59.349157 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:27674] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaHCT4a650YPyxXVeRYBXQAAAYo"]
[Sat Feb 28 00:12:00.966037 2026] [:error] [pid 56075:tid 56079] [client 4.204.200.32:63874] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaHCUMKBhrfI6KNv9RiRMQAAAAI"]
[Sat Feb 28 00:12:02.078329 2026] [:error] [pid 49306:tid 49317] [client 4.204.200.32:28566] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaHCUvnSUDZue59Px9uMzgAAAUk"]
[Sat Feb 28 00:12:04.622542 2026] [:error] [pid 54102:tid 54153] [client 4.204.200.32:63924] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aaHCVHi74D4fiYUm_Ged8AAAAIk"]
[Sat Feb 28 00:12:05.228108 2026] [:error] [pid 54231:tid 54236] [client 4.204.200.32:63922] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aaHCVeTvb5AeyJCdY7BXCQAAAEI"]
[Sat Feb 28 00:12:06.498065 2026] [:error] [pid 54231:tid 54246] [client 4.204.200.32:28389] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aaHCVuTvb5AeyJCdY7BXFwAAAEw"]
[Sat Feb 28 00:12:07.434480 2026] [:error] [pid 52073:tid 52081] [client 4.204.200.32:63877] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "aaHCV4a650YPyxXVeRYBcwAAAYU"]
[Sat Feb 28 00:12:09.131539 2026] [:error] [pid 54101:tid 54126] [client 4.204.200.32:64326] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aaHCWVY5qgRktcYTGFtoEAAAAdI"]
[Sat Feb 28 00:12:10.193720 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:28376] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aaHCWoa650YPyxXVeRYBhQAAAZE"]
[Sat Feb 28 00:12:12.063117 2026] [:error] [pid 56075:tid 56083] [client 4.204.200.32:62615] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aaHCXMKBhrfI6KNv9RiRaQAAAAY"]
[Sat Feb 28 00:12:12.637600 2026] [:error] [pid 56075:tid 56090] [client 4.204.200.32:28365] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aaHCXMKBhrfI6KNv9RiRawAAAAw"]
[Sat Feb 28 00:12:13.949448 2026] [:error] [pid 56075:tid 56100] [client 4.204.200.32:28411] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iko.php"] [unique_id "aaHCXcKBhrfI6KNv9RiRcAAAABY"]
[Sat Feb 28 00:12:15.077285 2026] [:error] [pid 56075:tid 56077] [client 4.204.200.32:62601] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iko.php"] [unique_id "aaHCX8KBhrfI6KNv9RiRfQAAAAA"]
[Sat Feb 28 00:12:15.934609 2026] [:error] [pid 49306:tid 49309] [client 4.204.200.32:63876] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iko.php"] [unique_id "aaHCX_nSUDZue59Px9uM7gAAAUE"]
[Sat Feb 28 00:12:16.687522 2026] [:error] [pid 56075:tid 56091] [client 4.204.200.32:63903] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iko.php"] [unique_id "aaHCYMKBhrfI6KNv9RiRiwAAAA0"]
[Sat Feb 28 00:12:17.532073 2026] [:error] [pid 56075:tid 56087] [client 4.204.200.32:64359] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmy.php"] [unique_id "aaHCYcKBhrfI6KNv9RiRlQAAAAo"]
[Sat Feb 28 00:12:18.367714 2026] [:error] [pid 56075:tid 56086] [client 4.204.200.32:54612] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmy.php"] [unique_id "aaHCYsKBhrfI6KNv9RiRmwAAAAk"]
[Sat Feb 28 00:12:20.101019 2026] [:error] [pid 52073:tid 52094] [client 4.204.200.32:63890] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmy.php"] [unique_id "aaHCZIa650YPyxXVeRYBugAAAZI"]
[Sat Feb 28 00:12:21.222502 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:28371] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmy.php"] [unique_id "aaHCZYa650YPyxXVeRYBwgAAAZE"]
[Sat Feb 28 00:12:22.112714 2026] [:error] [pid 49306:tid 49312] [client 4.204.200.32:28547] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fun.php"] [unique_id "aaHCZvnSUDZue59Px9uM-wAAAUQ"]
[Sat Feb 28 00:12:24.663275 2026] [:error] [pid 49306:tid 49318] [client 4.204.200.32:62636] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fun.php"] [unique_id "aaHCaPnSUDZue59Px9uNCQAAAUo"]
[Sat Feb 28 00:12:25.798985 2026] [:error] [pid 52073:tid 52080] [client 4.204.200.32:28386] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fun.php"] [unique_id "aaHCaYa650YPyxXVeRYB0wAAAYQ"]
[Sat Feb 28 00:12:26.472030 2026] [:error] [pid 49306:tid 49316] [client 4.204.200.32:27707] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fun.php"] [unique_id "aaHCavnSUDZue59Px9uNDQAAAUg"]
[Sat Feb 28 00:12:27.507254 2026] [:error] [pid 62998:tid 63025] [client 4.204.200.32:27678] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/end.php"] [unique_id "aaHCa1QeueXZDUmoLomesgAAARc"]
[Sat Feb 28 00:12:28.293748 2026] [:error] [pid 49306:tid 49327] [client 4.204.200.32:64375] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/end.php"] [unique_id "aaHCbPnSUDZue59Px9uNEQAAAVM"]
[Sat Feb 28 00:12:29.306501 2026] [:error] [pid 62998:tid 63015] [client 4.204.200.32:64345] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/end.php"] [unique_id "aaHCbVQeueXZDUmoLometwAAAQ0"]
[Sat Feb 28 00:12:30.392994 2026] [:error] [pid 56075:tid 56099] [client 4.204.200.32:28394] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/end.php"] [unique_id "aaHCbsKBhrfI6KNv9RiR3gAAABU"]
[Sat Feb 28 00:12:31.484053 2026] [:error] [pid 56075:tid 56088] [client 4.204.200.32:54596] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaHCb8KBhrfI6KNv9RiR5gAAAAs"]
[Sat Feb 28 00:12:32.372892 2026] [:error] [pid 56075:tid 56100] [client 4.204.200.32:62613] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaHCcMKBhrfI6KNv9RiR7wAAABY"]
[Sat Feb 28 00:12:36.800601 2026] [:error] [pid 54231:tid 54243] [client 4.204.200.32:28556] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaHCdOTvb5AeyJCdY7BXUgAAAEk"]
[Sat Feb 28 00:12:38.773600 2026] [:error] [pid 54231:tid 54242] [client 4.204.200.32:54644] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaHCduTvb5AeyJCdY7BXUwAAAEg"]
[Sat Feb 28 00:12:40.732072 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/error1.php
[Sat Feb 28 00:12:41.007964 2026] [:error] [pid 52073:tid 52095] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/thui.php
[Sat Feb 28 00:12:41.427309 2026] [:error] [pid 52073:tid 52082] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Sat Feb 28 00:12:42.119002 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sat Feb 28 00:12:42.813653 2026] [:error] [pid 52073:tid 52080] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Feb 28 00:12:43.026988 2026] [:error] [pid 52073:tid 52077] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/rpk.php
[Sat Feb 28 00:12:43.514954 2026] [:error] [pid 52073:tid 52094] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Sat Feb 28 00:12:43.729995 2026] [:error] [pid 52073:tid 52099] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Sat Feb 28 00:12:43.945252 2026] [:error] [pid 52073:tid 52097] [client 4.204.200.32:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Sat Feb 28 00:12:44.291516 2026] [:error] [pid 52073:tid 52089] [client 4.204.200.32:54625] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aaHCfIa650YPyxXVeRYCFAAAAY0"]
[Sat Feb 28 00:12:45.513017 2026] [:error] [pid 62998:tid 63021] [client 4.204.200.32:28366] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aaHCfVQeueXZDUmoLome2AAAARM"]
[Sat Feb 28 00:12:48.319954 2026] [:error] [pid 54231:tid 54248] [client 4.204.200.32:27661] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aaHCgOTvb5AeyJCdY7BXZQAAAE4"]
[Sat Feb 28 00:12:49.796079 2026] [:error] [pid 52073:tid 52087] [client 4.204.200.32:63910] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aaHCgYa650YPyxXVeRYCIwAAAYs"]
[Sat Feb 28 00:12:51.258004 2026] [:error] [pid 52073:tid 52089] [client 4.204.200.32:64337] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aaHCg4a650YPyxXVeRYCNAAAAY0"]
[Sat Feb 28 00:12:53.031580 2026] [:error] [pid 52073:tid 52098] [client 4.204.200.32:64380] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aaHChYa650YPyxXVeRYCRQAAAZY"]
[Sat Feb 28 00:12:54.002368 2026] [:error] [pid 49306:tid 49330] [client 4.204.200.32:28382] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aaHChvnSUDZue59Px9uNOAAAAVY"]
[Sat Feb 28 00:12:55.417710 2026] [:error] [pid 49306:tid 49326] [client 4.204.200.32:28390] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7x.php"] [unique_id "aaHCh_nSUDZue59Px9uNOgAAAVI"]
[Sat Feb 28 00:12:57.129014 2026] [:error] [pid 54231:tid 54254] [client 4.204.200.32:28564] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHCieTvb5AeyJCdY7BXbwAAAFQ"]
[Sat Feb 28 00:12:57.959494 2026] [:error] [pid 54231:tid 54247] [client 4.204.200.32:27654] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHCieTvb5AeyJCdY7BXdQAAAE0"]
[Sat Feb 28 00:12:58.642794 2026] [:error] [pid 56075:tid 56102] [client 4.204.200.32:27653] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHCisKBhrfI6KNv9RiSXgAAABg"]
[Sat Feb 28 00:13:00.463652 2026] [:error] [pid 49306:tid 49319] [client 4.204.200.32:64356] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHCjPnSUDZue59Px9uNPAAAAUs"]
[Sat Feb 28 00:13:01.303770 2026] [:error] [pid 52073:tid 52099] [client 4.204.200.32:62621] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aaHCjYa650YPyxXVeRYCXQAAAZc"]
[Sat Feb 28 00:13:02.213782 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:28405] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aaHCjoa650YPyxXVeRYCYgAAAZE"]
[Sat Feb 28 00:13:03.012387 2026] [:error] [pid 52073:tid 52083] [client 4.204.200.32:28560] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aaHCj4a650YPyxXVeRYCZgAAAYc"]
[Sat Feb 28 00:13:04.676788 2026] [:error] [pid 49306:tid 49318] [client 4.204.200.32:27685] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/get.php"] [unique_id "aaHCkPnSUDZue59Px9uNQwAAAUo"]
[Sat Feb 28 00:13:05.326030 2026] [:error] [pid 52073:tid 52096] [client 4.204.200.32:28549] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHCkYa650YPyxXVeRYCdAAAAZQ"]
[Sat Feb 28 00:13:06.386207 2026] [:error] [pid 62998:tid 63025] [client 4.204.200.32:64341] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHCklQeueXZDUmoLome7wAAARc"]
[Sat Feb 28 00:13:07.446687 2026] [:error] [pid 56075:tid 56083] [client 4.204.200.32:64370] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHCk8KBhrfI6KNv9RiSdQAAAAY"]
[Sat Feb 28 00:13:08.052496 2026] [:error] [pid 56075:tid 56101] [client 4.204.200.32:28381] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaHClMKBhrfI6KNv9RiSfAAAABc"]
[Sat Feb 28 00:13:09.350219 2026] [:error] [pid 54231:tid 54253] [client 4.204.200.32:28572] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaHCleTvb5AeyJCdY7BXgAAAAFM"]
[Sat Feb 28 00:13:10.669314 2026] [:error] [pid 54102:tid 54157] [client 4.204.200.32:27676] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaHClni74D4fiYUm_GeeLQAAAI0"]
[Sat Feb 28 00:13:11.896948 2026] [:error] [pid 62998:tid 63016] [client 4.204.200.32:27703] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaHCl1QeueXZDUmoLome_gAAAQ4"]
[Sat Feb 28 00:13:14.833798 2026] [:error] [pid 49306:tid 49317] [client 4.204.200.32:27687] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaHCmvnSUDZue59Px9uNVQAAAUk"]
[Sat Feb 28 00:13:18.304553 2026] [:error] [pid 49306:tid 49320] [client 4.204.200.32:54595] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaHCnvnSUDZue59Px9uNbQAAAUw"]
[Sat Feb 28 00:13:19.520924 2026] [:error] [pid 56075:tid 56087] [client 4.204.200.32:54610] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaHCn8KBhrfI6KNv9RiSpwAAAAo"]
[Sat Feb 28 00:13:21.081405 2026] [:error] [pid 52073:tid 52092] [client 4.204.200.32:27667] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaHCoYa650YPyxXVeRYCkwAAAZA"]
[Sat Feb 28 00:13:22.892990 2026] [:error] [pid 52073:tid 52094] [client 4.204.200.32:28551] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaHCooa650YPyxXVeRYCogAAAZI"]
[Sat Feb 28 00:13:23.646882 2026] [:error] [pid 49306:tid 49308] [client 4.204.200.32:28570] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/raw.php"] [unique_id "aaHCo_nSUDZue59Px9uNhAAAAUA"]
[Sat Feb 28 00:13:24.967607 2026] [:error] [pid 49306:tid 49314] [client 4.204.200.32:28567] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/raw.php"] [unique_id "aaHCpPnSUDZue59Px9uNigAAAUY"]
[Sat Feb 28 00:13:27.444120 2026] [:error] [pid 54231:tid 54246] [client 4.204.200.32:62609] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/raw.php"] [unique_id "aaHCp-Tvb5AeyJCdY7BXlgAAAEw"]
[Sat Feb 28 00:13:29.160112 2026] [:error] [pid 56075:tid 56091] [client 4.204.200.32:64355] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/raw.php"] [unique_id "aaHCqcKBhrfI6KNv9RiSswAAAA0"]
[Sat Feb 28 00:13:30.791417 2026] [:error] [pid 54231:tid 54252] [client 4.204.200.32:28391] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaHCquTvb5AeyJCdY7BXmQAAAFI"]
[Sat Feb 28 00:13:32.429906 2026] [:error] [pid 54103:tid 54172] [client 4.204.200.32:27697] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaHCrOvG4MPCmE0B2sDclAAAAME"]
[Sat Feb 28 00:13:33.349997 2026] [:error] [pid 56075:tid 56098] [client 4.204.200.32:28559] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaHCrcKBhrfI6KNv9RiS0AAAABQ"]
[Sat Feb 28 00:13:34.536225 2026] [:error] [pid 49306:tid 49317] [client 4.204.200.32:63927] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "aaHCrvnSUDZue59Px9uNrgAAAUk"]
[Sat Feb 28 00:13:36.554447 2026] [:error] [pid 62998:tid 63025] [client 4.204.200.32:28361] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aaHCsFQeueXZDUmoLomfMQAAARc"]
[Sat Feb 28 00:13:37.836844 2026] [:error] [pid 52073:tid 52086] [client 4.204.200.32:28358] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aaHCsYa650YPyxXVeRYC6AAAAYo"]
[Sat Feb 28 00:13:38.979012 2026] [:error] [pid 54103:tid 54172] [client 4.204.200.32:62597] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aaHCsuvG4MPCmE0B2sDcoQAAAME"]
[Sat Feb 28 00:13:41.321473 2026] [:error] [pid 49306:tid 49332] [client 4.204.200.32:28384] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rtx.php"] [unique_id "aaHCtfnSUDZue59Px9uNwAAAAVg"]
[Sat Feb 28 00:13:42.778579 2026] [:error] [pid 62998:tid 63010] [client 4.204.200.32:64377] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "aaHCtlQeueXZDUmoLomfPgAAAQg"]
[Sat Feb 28 00:13:43.719637 2026] [:error] [pid 54101:tid 54124] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Sat Feb 28 00:13:44.007468 2026] [:error] [pid 54101:tid 54110] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 00:13:44.254015 2026] [:error] [pid 54101:tid 54123] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Sat Feb 28 00:13:44.465959 2026] [:error] [pid 54101:tid 54132] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Feb 28 00:13:44.675797 2026] [:error] [pid 54101:tid 54112] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sat Feb 28 00:13:44.897964 2026] [:error] [pid 54101:tid 54130] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/gec.php
[Sat Feb 28 00:13:45.162761 2026] [:error] [pid 54101:tid 54121] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/sxdfrt.php
[Sat Feb 28 00:13:45.677238 2026] [:error] [pid 54101:tid 54122] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Sat Feb 28 00:13:45.894273 2026] [:error] [pid 54101:tid 54115] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sat Feb 28 00:13:46.103552 2026] [:error] [pid 54101:tid 54111] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sat Feb 28 00:13:46.313011 2026] [:error] [pid 54101:tid 54127] [client 4.204.200.32:28400] File does not exist: /usr/local/apache/htdocs/suspended-page/ocxla.php
[Sat Feb 28 00:13:46.522308 2026] [:error] [pid 54101:tid 54131] [client 4.204.200.32:28400] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/god.php"] [unique_id "aaHCulY5qgRktcYTGFtoUQAAAdc"]
[Sat Feb 28 00:13:48.578180 2026] [:error] [pid 56075:tid 56087] [client 4.204.200.32:28582] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/god.php"] [unique_id "aaHCvMKBhrfI6KNv9RiTBwAAAAo"]
[Sat Feb 28 00:13:50.808574 2026] [:error] [pid 52073:tid 52088] [client 4.204.200.32:27698] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/god.php"] [unique_id "aaHCvoa650YPyxXVeRYDBAAAAYw"]
[Sat Feb 28 00:13:51.991462 2026] [:error] [pid 52073:tid 52083] [client 4.204.200.32:28593] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/god.php"] [unique_id "aaHCv4a650YPyxXVeRYDEAAAAYc"]
[Sat Feb 28 00:13:53.912508 2026] [:error] [pid 56075:tid 56101] [client 4.204.200.32:64379] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaHCwcKBhrfI6KNv9RiTHQAAABc"]
[Sat Feb 28 00:13:55.926586 2026] [:error] [pid 56075:tid 56079] [client 4.204.200.32:28403] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaHCw8KBhrfI6KNv9RiTMQAAAAI"]
[Sat Feb 28 00:13:57.483181 2026] [:error] [pid 56075:tid 56083] [client 4.204.200.32:28563] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaHCxcKBhrfI6KNv9RiTPwAAAAY"]
[Sat Feb 28 00:13:59.190608 2026] [:error] [pid 56075:tid 56086] [client 4.204.200.32:63914] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "aaHCx8KBhrfI6KNv9RiTUgAAAAk"]
[Sat Feb 28 00:14:01.588492 2026] [:error] [pid 52073:tid 52093] [client 4.204.200.32:28352] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "aaHCyYa650YPyxXVeRYDFgAAAZE"]
[Sat Feb 28 00:14:03.442898 2026] [:error] [pid 52073:tid 52080] [client 4.204.200.32:27710] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "aaHCy4a650YPyxXVeRYDIAAAAYQ"]
[Sat Feb 28 00:14:05.833953 2026] [:error] [pid 56075:tid 56100] [client 4.204.200.32:28387] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "aaHCzcKBhrfI6KNv9RiTdQAAABY"]
[Sat Feb 28 00:14:07.868785 2026] [:error] [pid 56075:tid 56088] [client 4.204.200.32:28396] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "aaHCz8KBhrfI6KNv9RiTiQAAAAs"]
[Sat Feb 28 00:14:08.454976 2026] [:error] [pid 54101:tid 54125] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sat Feb 28 00:14:08.472228 2026] [:error] [pid 54101:tid 54108] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 28 00:14:08.507517 2026] [:error] [pid 54101:tid 54122] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sat Feb 28 00:14:08.524979 2026] [:error] [pid 54101:tid 54115] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Feb 28 00:14:08.543072 2026] [:error] [pid 54101:tid 54111] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 00:14:08.561727 2026] [:error] [pid 54101:tid 54127] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sat Feb 28 00:14:08.579026 2026] [:error] [pid 54101:tid 54131] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sat Feb 28 00:14:08.616881 2026] [:error] [pid 54101:tid 54120] [client 4.197.75.18:3808] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sat Feb 28 00:14:08.633621 2026] [:error] [pid 54101:tid 54113] [client 4.197.75.18:3808] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaHC0FY5qgRktcYTGFtoZAAAAcU"]
[Sat Feb 28 00:14:08.661146 2026] [:error] [pid 52073:tid 52094] [client 4.197.75.18:3804] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaHC0Ia650YPyxXVeRYDMgAAAZI"]
[Sat Feb 28 00:14:08.688973 2026] [:error] [pid 52073:tid 52080] [client 4.197.75.18:3853] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaHC0Ia650YPyxXVeRYDMwAAAYQ"]
[Sat Feb 28 00:14:08.717060 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:3789] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaHC0MKBhrfI6KNv9RiTjgAAABg"]
[Sat Feb 28 00:14:08.744842 2026] [:error] [pid 56075:tid 56085] [client 4.197.75.18:3822] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaHC0MKBhrfI6KNv9RiTjwAAAAg"]
[Sat Feb 28 00:14:08.795167 2026] [:error] [pid 56075:tid 56092] [client 4.197.75.18:3849] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaHC0MKBhrfI6KNv9RiTkAAAAA4"]
[Sat Feb 28 00:14:08.834821 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:3791] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaHC0MKBhrfI6KNv9RiTkgAAAAE"]
[Sat Feb 28 00:14:08.864361 2026] [:error] [pid 56075:tid 56091] [client 4.197.75.18:3852] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaHC0MKBhrfI6KNv9RiTkwAAAA0"]
[Sat Feb 28 00:14:08.894511 2026] [:error] [pid 56075:tid 56083] [client 4.197.75.18:3856] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaHC0MKBhrfI6KNv9RiTlAAAAAY"]
[Sat Feb 28 00:14:08.922655 2026] [:error] [pid 62998:tid 63009] [client 4.197.75.18:3826] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaHC0FQeueXZDUmoLomfUQAAAQc"]
[Sat Feb 28 00:14:08.950631 2026] [:error] [pid 54231:tid 54244] [client 4.197.75.18:3783] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaHC0OTvb5AeyJCdY7BXuwAAAEo"]
[Sat Feb 28 00:14:08.978260 2026] [:error] [pid 54103:tid 54191] [client 4.197.75.18:3788] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaHC0OvG4MPCmE0B2sDcsAAAANQ"]
[Sat Feb 28 00:14:09.009457 2026] [:error] [pid 49306:tid 49326] [client 4.197.75.18:3823] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaHC0fnSUDZue59Px9uN3QAAAVI"]
[Sat Feb 28 00:14:09.039659 2026] [:error] [pid 54231:tid 54237] [client 4.197.75.18:3861] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaHC0eTvb5AeyJCdY7BXvAAAAEM"]
[Sat Feb 28 00:14:09.082316 2026] [:error] [pid 54102:tid 54163] [client 4.197.75.18:3821] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaHC0Xi74D4fiYUm_GeeTwAAAJM"]
[Sat Feb 28 00:14:09.109987 2026] [:error] [pid 52073:tid 52084] [client 4.197.75.18:3776] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaHC0Ya650YPyxXVeRYDNgAAAYg"]
[Sat Feb 28 00:14:09.139135 2026] [:error] [pid 49306:tid 49321] [client 4.197.75.18:3868] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaHC0fnSUDZue59Px9uN3wAAAU0"]
[Sat Feb 28 00:14:09.168097 2026] [:error] [pid 52073:tid 52077] [client 4.197.75.18:3833] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaHC0Ya650YPyxXVeRYDNwAAAYE"]
[Sat Feb 28 00:14:09.196292 2026] [:error] [pid 56075:tid 56081] [client 4.197.75.18:3494] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaHC0cKBhrfI6KNv9RiTlQAAAAQ"]
[Sat Feb 28 00:14:09.225008 2026] [:error] [pid 56075:tid 56079] [client 4.197.75.18:3870] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaHC0cKBhrfI6KNv9RiTlwAAAAI"]
[Sat Feb 28 00:14:09.253558 2026] [:error] [pid 49306:tid 49323] [client 4.197.75.18:3832] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaHC0fnSUDZue59Px9uN4QAAAU8"]
[Sat Feb 28 00:14:09.281406 2026] [:error] [pid 52073:tid 52088] [client 4.197.75.18:3782] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaHC0Ya650YPyxXVeRYDOQAAAYw"]
[Sat Feb 28 00:14:09.310252 2026] [:error] [pid 52073:tid 52092] [client 4.197.75.18:3790] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaHC0Ya650YPyxXVeRYDOgAAAZA"]
[Sat Feb 28 00:14:09.344929 2026] [:error] [pid 49306:tid 49331] [client 4.197.75.18:3842] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaHC0fnSUDZue59Px9uN5AAAAVc"]
[Sat Feb 28 00:14:09.374803 2026] [:error] [pid 49306:tid 49329] [client 4.197.75.18:3813] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaHC0fnSUDZue59Px9uN5QAAAVU"]
[Sat Feb 28 00:14:09.411356 2026] [:error] [pid 49306:tid 49312] [client 4.197.75.18:3866] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaHC0fnSUDZue59Px9uN5gAAAUQ"]
[Sat Feb 28 00:14:09.441126 2026] [:error] [pid 54102:tid 54151] [client 4.197.75.18:3864] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaHC0Xi74D4fiYUm_GeeUAAAAIc"]
[Sat Feb 28 00:14:09.468900 2026] [:error] [pid 49306:tid 49316] [client 4.197.75.18:3785] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaHC0fnSUDZue59Px9uN5wAAAUg"]
[Sat Feb 28 00:14:09.497820 2026] [:error] [pid 49306:tid 49308] [client 4.197.75.18:3807] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaHC0fnSUDZue59Px9uN6QAAAUA"]
[Sat Feb 28 00:14:09.530176 2026] [:error] [pid 54102:tid 54165] [client 4.197.75.18:3841] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaHC0Xi74D4fiYUm_GeeUQAAAJU"]
[Sat Feb 28 00:14:09.558293 2026] [:error] [pid 52073:tid 52098] [client 4.197.75.18:3471] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaHC0Ya650YPyxXVeRYDOwAAAZY"]
[Sat Feb 28 00:14:09.588180 2026] [:error] [pid 49306:tid 49315] [client 4.197.75.18:3829] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaHC0fnSUDZue59Px9uN6gAAAUc"]
[Sat Feb 28 00:14:09.619711 2026] [:error] [pid 52073:tid 52096] [client 4.197.75.18:3802] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaHC0Ya650YPyxXVeRYDPQAAAZQ"]
[Sat Feb 28 00:14:09.650903 2026] [:error] [pid 52073:tid 52079] [client 4.197.75.18:3806] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaHC0Ya650YPyxXVeRYDPgAAAYM"]
[Sat Feb 28 00:14:09.680029 2026] [:error] [pid 52073:tid 52090] [client 4.197.75.18:3831] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaHC0Ya650YPyxXVeRYDPwAAAY4"]
[Sat Feb 28 00:14:09.709024 2026] [:error] [pid 56075:tid 56097] [client 4.197.75.18:3830] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaHC0cKBhrfI6KNv9RiTmAAAABM"]
[Sat Feb 28 00:14:09.745301 2026] [:error] [pid 52073:tid 52081] [client 4.197.75.18:3468] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaHC0Ya650YPyxXVeRYDQAAAAYU"]
[Sat Feb 28 00:14:09.773507 2026] [:error] [pid 52073:tid 52095] [client 4.197.75.18:3839] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaHC0Ya650YPyxXVeRYDQQAAAZM"]
[Sat Feb 28 00:14:09.801476 2026] [:error] [pid 52073:tid 52091] [client 4.197.75.18:3461] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaHC0Ya650YPyxXVeRYDQgAAAY8"]
[Sat Feb 28 00:14:09.829061 2026] [:error] [pid 52073:tid 52078] [client 4.197.75.18:3781] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaHC0Ya650YPyxXVeRYDRQAAAYI"]
[Sat Feb 28 00:14:09.856938 2026] [:error] [pid 52073:tid 52085] [client 4.197.75.18:3854] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaHC0Ya650YPyxXVeRYDRgAAAYk"]
[Sat Feb 28 00:14:09.885454 2026] [:error] [pid 52073:tid 52094] [client 4.197.75.18:3903] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaHC0Ya650YPyxXVeRYDRwAAAZI"]
[Sat Feb 28 00:14:09.921756 2026] [:error] [pid 52073:tid 52080] [client 4.197.75.18:3504] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaHC0Ya650YPyxXVeRYDSAAAAYQ"]
[Sat Feb 28 00:14:09.954580 2026] [:error] [pid 52073:tid 52076] [client 4.197.75.18:3490] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaHC0Ya650YPyxXVeRYDSQAAAYA"]
[Sat Feb 28 00:14:09.987805 2026] [:error] [pid 52073:tid 52077] [client 4.197.75.18:3463] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaHC0Ya650YPyxXVeRYDSgAAAYE"]
[Sat Feb 28 00:14:10.017334 2026] [:error] [pid 52073:tid 52086] [client 4.197.75.18:3835] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaHC0oa650YPyxXVeRYDSwAAAYo"]
[Sat Feb 28 00:14:10.046786 2026] [:error] [pid 52073:tid 52092] [client 4.197.75.18:3880] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaHC0oa650YPyxXVeRYDTQAAAZA"]
[Sat Feb 28 00:14:10.109166 2026] [:error] [pid 62998:tid 63004] [client 4.197.75.18:3869] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaHC0lQeueXZDUmoLomfUwAAAQI"]
[Sat Feb 28 00:14:10.137996 2026] [:error] [pid 52073:tid 52098] [client 4.197.75.18:3467] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaHC0oa650YPyxXVeRYDTwAAAZY"]
[Sat Feb 28 00:14:10.165607 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:3879] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaHC0sKBhrfI6KNv9RiTmQAAABc"]
[Sat Feb 28 00:14:10.204875 2026] [:error] [pid 52073:tid 52099] [client 4.197.75.18:3885] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaHC0oa650YPyxXVeRYDUAAAAZc"]
[Sat Feb 28 00:14:10.234219 2026] [:error] [pid 49306:tid 49310] [client 4.197.75.18:3882] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaHC0vnSUDZue59Px9uN6wAAAUI"]
[Sat Feb 28 00:14:10.265501 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:3828] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/z60.php"] [unique_id "aaHC0sKBhrfI6KNv9RiTmgAAABQ"]
[Sat Feb 28 00:14:10.292763 2026] [:error] [pid 62998:tid 63025] [client 4.197.75.18:3792] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/z60.php"] [unique_id "aaHC0lQeueXZDUmoLomfVAAAARc"]
[Sat Feb 28 00:14:10.329189 2026] [:error] [pid 56075:tid 56099] [client 4.197.75.18:3848] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/z60.php"] [unique_id "aaHC0sKBhrfI6KNv9RiTnAAAABU"]
[Sat Feb 28 00:14:10.357051 2026] [:error] [pid 49306:tid 49314] [client 4.197.75.18:3793] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/z60.php"] [unique_id "aaHC0vnSUDZue59Px9uN7QAAAUY"]
[Sat Feb 28 00:14:10.386708 2026] [:error] [pid 54231:tid 54251] [client 4.197.75.18:3780] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC0uTvb5AeyJCdY7BXvgAAAFE"]
[Sat Feb 28 00:14:10.414712 2026] [:error] [pid 56075:tid 56096] [client 4.197.75.18:3816] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC0sKBhrfI6KNv9RiTnQAAABI"]
[Sat Feb 28 00:14:10.449555 2026] [:error] [pid 54231:tid 54257] [client 4.197.75.18:3796] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC0uTvb5AeyJCdY7BXvwAAAFc"]
[Sat Feb 28 00:14:10.477481 2026] [:error] [pid 49306:tid 49317] [client 4.197.75.18:3784] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC0vnSUDZue59Px9uN7gAAAUk"]
[Sat Feb 28 00:14:10.506720 2026] [:error] [pid 54231:tid 54252] [client 4.197.75.18:3498] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/m.php"] [unique_id "aaHC0uTvb5AeyJCdY7BXwAAAAFI"]
[Sat Feb 28 00:14:10.537774 2026] [:error] [pid 54103:tid 54190] [client 4.197.75.18:3801] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/m.php"] [unique_id "aaHC0uvG4MPCmE0B2sDcsQAAANM"]
[Sat Feb 28 00:14:10.565317 2026] [:error] [pid 54102:tid 54144] [client 4.197.75.18:3818] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/m.php"] [unique_id "aaHC0ni74D4fiYUm_GeeUgAAAIA"]
[Sat Feb 28 00:14:10.595120 2026] [:error] [pid 54103:tid 54192] [client 4.197.75.18:3862] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/m.php"] [unique_id "aaHC0uvG4MPCmE0B2sDcsgAAANU"]
[Sat Feb 28 00:14:10.631650 2026] [:error] [pid 62998:tid 63022] [client 4.197.75.18:3472] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes.php"] [unique_id "aaHC0lQeueXZDUmoLomfVgAAARQ"]
[Sat Feb 28 00:14:10.662054 2026] [:error] [pid 62998:tid 63013] [client 4.197.75.18:3827] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes.php"] [unique_id "aaHC0lQeueXZDUmoLomfVwAAAQs"]
[Sat Feb 28 00:14:10.691272 2026] [:error] [pid 54103:tid 54182] [client 4.197.75.18:3794] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes.php"] [unique_id "aaHC0uvG4MPCmE0B2sDcswAAAMs"]
[Sat Feb 28 00:14:10.719644 2026] [:error] [pid 54102:tid 54160] [client 4.197.75.18:3867] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes.php"] [unique_id "aaHC0ni74D4fiYUm_GeeUwAAAJA"]
[Sat Feb 28 00:14:10.747352 2026] [:error] [pid 54103:tid 54174] [client 4.197.75.18:3795] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaHC0uvG4MPCmE0B2sDctAAAAMM"]
[Sat Feb 28 00:14:10.800680 2026] [:error] [pid 54102:tid 54161] [client 4.197.75.18:3815] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaHC0ni74D4fiYUm_GeeVAAAAJE"]
[Sat Feb 28 00:14:10.828268 2026] [:error] [pid 62998:tid 63016] [client 4.197.75.18:3857] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaHC0lQeueXZDUmoLomfWAAAAQ4"]
[Sat Feb 28 00:14:10.855978 2026] [:error] [pid 49306:tid 49318] [client 4.197.75.18:3877] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaHC0vnSUDZue59Px9uN8AAAAUo"]
[Sat Feb 28 00:14:10.888189 2026] [:error] [pid 49306:tid 49330] [client 4.197.75.18:3872] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaHC0vnSUDZue59Px9uN8QAAAVY"]
[Sat Feb 28 00:14:10.916263 2026] [:error] [pid 56075:tid 56090] [client 4.197.75.18:3846] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaHC0sKBhrfI6KNv9RiTnwAAAAw"]
[Sat Feb 28 00:14:10.945198 2026] [:error] [pid 52073:tid 52082] [client 4.197.75.18:3884] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaHC0oa650YPyxXVeRYDVAAAAYY"]
[Sat Feb 28 00:14:10.980704 2026] [:error] [pid 52073:tid 52081] [client 4.197.75.18:3883] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaHC0oa650YPyxXVeRYDVQAAAYU"]
[Sat Feb 28 00:14:11.008305 2026] [:error] [pid 52073:tid 52095] [client 4.197.75.18:3800] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/click.php"] [unique_id "aaHC04a650YPyxXVeRYDVgAAAZM"]
[Sat Feb 28 00:14:11.036503 2026] [:error] [pid 52073:tid 52091] [client 4.197.75.18:3810] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/click.php"] [unique_id "aaHC04a650YPyxXVeRYDVwAAAY8"]
[Sat Feb 28 00:14:11.066837 2026] [:error] [pid 49306:tid 49309] [client 4.197.75.18:3478] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/click.php"] [unique_id "aaHC0_nSUDZue59Px9uN8gAAAUE"]
[Sat Feb 28 00:14:11.122051 2026] [:error] [pid 49306:tid 49311] [client 4.197.75.18:3809] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/click.php"] [unique_id "aaHC0_nSUDZue59Px9uN8wAAAUM"]
[Sat Feb 28 00:14:11.152024 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:3511] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/install.php"] [unique_id "aaHC08KBhrfI6KNv9RiToAAAABg"]
[Sat Feb 28 00:14:11.180863 2026] [:error] [pid 56075:tid 56085] [client 4.197.75.18:3812] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/install.php"] [unique_id "aaHC08KBhrfI6KNv9RiToQAAAAg"]
[Sat Feb 28 00:14:11.210845 2026] [:error] [pid 56075:tid 56092] [client 4.197.75.18:3778] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/install.php"] [unique_id "aaHC08KBhrfI6KNv9RiTogAAAA4"]
[Sat Feb 28 00:14:11.242749 2026] [:error] [pid 62998:tid 63023] [client 4.197.75.18:3893] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/install.php"] [unique_id "aaHC01QeueXZDUmoLomfWwAAARU"]
[Sat Feb 28 00:14:11.276011 2026] [:error] [pid 62998:tid 63026] [client 4.197.75.18:3817] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lv.php"] [unique_id "aaHC01QeueXZDUmoLomfXAAAARg"]
[Sat Feb 28 00:14:11.304763 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:3874] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lv.php"] [unique_id "aaHC08KBhrfI6KNv9RiTowAAAAE"]
[Sat Feb 28 00:14:11.342141 2026] [:error] [pid 54103:tid 54177] [client 4.197.75.18:3469] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lv.php"] [unique_id "aaHC0-vG4MPCmE0B2sDctgAAAMY"]
[Sat Feb 28 00:14:11.370219 2026] [:error] [pid 54103:tid 54193] [client 4.197.75.18:3512] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lv.php"] [unique_id "aaHC0-vG4MPCmE0B2sDctwAAANY"]
[Sat Feb 28 00:14:11.398016 2026] [:error] [pid 54103:tid 54186] [client 4.197.75.18:3811] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/simple.php"] [unique_id "aaHC0-vG4MPCmE0B2sDcuAAAAM8"]
[Sat Feb 28 00:14:11.425605 2026] [:error] [pid 54103:tid 54194] [client 4.197.75.18:3787] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/simple.php"] [unique_id "aaHC0-vG4MPCmE0B2sDcuQAAANc"]
[Sat Feb 28 00:14:11.464593 2026] [:error] [pid 54101:tid 54124] [client 4.197.75.18:3998] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/simple.php"] [unique_id "aaHC01Y5qgRktcYTGFtoaAAAAdA"]
[Sat Feb 28 00:14:11.493543 2026] [:error] [pid 54103:tid 54180] [client 4.197.75.18:3897] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/simple.php"] [unique_id "aaHC0-vG4MPCmE0B2sDcugAAAMk"]
[Sat Feb 28 00:14:11.523872 2026] [:error] [pid 54101:tid 54126] [client 4.197.75.18:3860] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC01Y5qgRktcYTGFtoaQAAAdI"]
[Sat Feb 28 00:14:11.553157 2026] [:error] [pid 54101:tid 54110] [client 4.197.75.18:3969] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC01Y5qgRktcYTGFtoagAAAcI"]
[Sat Feb 28 00:14:11.581223 2026] [:error] [pid 54101:tid 54114] [client 4.197.75.18:3863] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC01Y5qgRktcYTGFtoawAAAcY"]
[Sat Feb 28 00:14:11.610851 2026] [:error] [pid 49306:tid 49313] [client 4.197.75.18:3844] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC0_nSUDZue59Px9uN9QAAAUU"]
[Sat Feb 28 00:14:11.640639 2026] [:error] [pid 54101:tid 54123] [client 4.197.75.18:3890] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaHC01Y5qgRktcYTGFtobAAAAc8"]
[Sat Feb 28 00:14:11.687917 2026] [:error] [pid 62998:tid 63024] [client 4.197.75.18:3777] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaHC01QeueXZDUmoLomfXQAAARY"]
[Sat Feb 28 00:14:11.728738 2026] [:error] [pid 62998:tid 63018] [client 4.197.75.18:3824] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaHC01QeueXZDUmoLomfXgAAARA"]
[Sat Feb 28 00:14:11.786047 2026] [:error] [pid 54103:tid 54183] [client 4.197.75.18:3970] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaHC0-vG4MPCmE0B2sDcuwAAAMw"]
[Sat Feb 28 00:14:11.819946 2026] [:error] [pid 54231:tid 54250] [client 4.197.75.18:3871] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaHC0-Tvb5AeyJCdY7BXwQAAAFA"]
[Sat Feb 28 00:14:11.831930 2026] [:error] [pid 54103:tid 54187] [client 4.204.200.32:63917] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaHC0-vG4MPCmE0B2sDcvAAAANA"]
[Sat Feb 28 00:14:11.853740 2026] [:error] [pid 52073:tid 52094] [client 4.197.75.18:3499] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaHC04a650YPyxXVeRYDWQAAAZI"]
[Sat Feb 28 00:14:11.896123 2026] [:error] [pid 54231:tid 54243] [client 4.197.75.18:3476] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaHC0-Tvb5AeyJCdY7BXwwAAAEk"]
[Sat Feb 28 00:14:11.928579 2026] [:error] [pid 54102:tid 54169] [client 4.197.75.18:3493] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaHC03i74D4fiYUm_GeeWAAAAJg"]
[Sat Feb 28 00:14:11.960321 2026] [:error] [pid 54102:tid 54155] [client 4.197.75.18:3840] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaHC03i74D4fiYUm_GeeWQAAAIs"]
[Sat Feb 28 00:14:11.996598 2026] [:error] [pid 54103:tid 54181] [client 4.197.75.18:3458] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaHC0-vG4MPCmE0B2sDcvQAAAMo"]
[Sat Feb 28 00:14:12.024297 2026] [:error] [pid 52073:tid 52083] [client 4.197.75.18:3987] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaHC1Ia650YPyxXVeRYDWwAAAYc"]
[Sat Feb 28 00:14:12.055649 2026] [:error] [pid 54103:tid 54185] [client 4.197.75.18:3460] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaHC1OvG4MPCmE0B2sDcvgAAAM4"]
[Sat Feb 28 00:14:12.083919 2026] [:error] [pid 62998:tid 63001] [client 4.197.75.18:3506] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1FQeueXZDUmoLomfYQAAAQA"]
[Sat Feb 28 00:14:12.116300 2026] [:error] [pid 52073:tid 52076] [client 4.197.75.18:3891] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1Ia650YPyxXVeRYDXAAAAYA"]
[Sat Feb 28 00:14:12.157129 2026] [:error] [pid 54102:tid 54166] [client 4.197.75.18:3858] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1Hi74D4fiYUm_GeeWwAAAJY"]
[Sat Feb 28 00:14:12.189343 2026] [:error] [pid 62998:tid 63017] [client 4.197.75.18:3505] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1FQeueXZDUmoLomfYwAAAQ8"]
[Sat Feb 28 00:14:12.219858 2026] [:error] [pid 49306:tid 49321] [client 4.197.75.18:3973] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaHC1PnSUDZue59Px9uN9wAAAU0"]
[Sat Feb 28 00:14:12.254125 2026] [:error] [pid 62998:tid 63007] [client 4.197.75.18:3513] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaHC1FQeueXZDUmoLomfZQAAAQU"]
[Sat Feb 28 00:14:12.282688 2026] [:error] [pid 62998:tid 63010] [client 4.197.75.18:3502] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaHC1FQeueXZDUmoLomfZgAAAQg"]
[Sat Feb 28 00:14:12.312950 2026] [:error] [pid 49306:tid 49323] [client 4.197.75.18:3887] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaHC1PnSUDZue59Px9uN-AAAAU8"]
[Sat Feb 28 00:14:12.341059 2026] [:error] [pid 56075:tid 56091] [client 4.197.75.18:3501] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaHC1MKBhrfI6KNv9RiTpQAAAA0"]
[Sat Feb 28 00:14:12.378245 2026] [:error] [pid 62998:tid 63019] [client 4.197.75.18:3837] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaHC1FQeueXZDUmoLomfaAAAARE"]
[Sat Feb 28 00:14:12.408101 2026] [:error] [pid 54231:tid 54253] [client 4.197.75.18:3483] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaHC1OTvb5AeyJCdY7BXxAAAAFM"]
[Sat Feb 28 00:14:12.435719 2026] [:error] [pid 54103:tid 54195] [client 4.197.75.18:3895] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaHC1OvG4MPCmE0B2sDcwAAAANg"]
[Sat Feb 28 00:14:12.476537 2026] [:error] [pid 54103:tid 54175] [client 4.197.75.18:3843] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC1OvG4MPCmE0B2sDcwQAAAMQ"]
[Sat Feb 28 00:14:12.512777 2026] [:error] [pid 54102:tid 54156] [client 4.197.75.18:3820] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC1Hi74D4fiYUm_GeeXAAAAIw"]
[Sat Feb 28 00:14:12.541355 2026] [:error] [pid 54103:tid 54170] [client 4.197.75.18:3779] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC1OvG4MPCmE0B2sDcwwAAAMA"]
[Sat Feb 28 00:14:12.570214 2026] [:error] [pid 54102:tid 54153] [client 4.197.75.18:3488] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaHC1Hi74D4fiYUm_GeeXQAAAIk"]
[Sat Feb 28 00:14:12.599535 2026] [:error] [pid 54101:tid 54130] [client 4.197.75.18:3836] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaHC1FY5qgRktcYTGFtobwAAAdY"]
[Sat Feb 28 00:14:12.628487 2026] [:error] [pid 54231:tid 54258] [client 4.197.75.18:3873] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaHC1OTvb5AeyJCdY7BXxgAAAFg"]
[Sat Feb 28 00:14:12.665629 2026] [:error] [pid 54102:tid 54159] [client 4.197.75.18:3798] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaHC1Hi74D4fiYUm_GeeXgAAAI8"]
[Sat Feb 28 00:14:12.695559 2026] [:error] [pid 54102:tid 54147] [client 4.197.75.18:3901] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaHC1Hi74D4fiYUm_GeeXwAAAIM"]
[Sat Feb 28 00:14:12.724975 2026] [:error] [pid 56075:tid 56083] [client 4.197.75.18:3486] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaHC1MKBhrfI6KNv9RiTpgAAAAY"]
[Sat Feb 28 00:14:12.753657 2026] [:error] [pid 54102:tid 54150] [client 4.197.75.18:4031] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaHC1Hi74D4fiYUm_GeeYAAAAIY"]
[Sat Feb 28 00:14:12.788922 2026] [:error] [pid 54231:tid 54238] [client 4.197.75.18:3495] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaHC1OTvb5AeyJCdY7BXxwAAAEQ"]
[Sat Feb 28 00:14:12.824836 2026] [:error] [pid 54103:tid 54189] [client 4.197.75.18:3889] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaHC1OvG4MPCmE0B2sDcxAAAANI"]
[Sat Feb 28 00:14:12.864531 2026] [:error] [pid 54101:tid 54125] [client 4.197.75.18:3834] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaHC1FY5qgRktcYTGFtocAAAAdE"]
[Sat Feb 28 00:14:12.892703 2026] [:error] [pid 49306:tid 49332] [client 4.197.75.18:3894] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaHC1PnSUDZue59Px9uN-gAAAVg"]
[Sat Feb 28 00:14:12.922595 2026] [:error] [pid 54102:tid 54164] [client 4.204.200.32:64321] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaHC1Hi74D4fiYUm_GeeYgAAAJQ"]
[Sat Feb 28 00:14:12.934455 2026] [:error] [pid 54103:tid 54176] [client 4.197.75.18:3485] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaHC1OvG4MPCmE0B2sDcxQAAAMU"]
[Sat Feb 28 00:14:12.962800 2026] [:error] [pid 54101:tid 54109] [client 4.197.75.18:3845] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaHC1FY5qgRktcYTGFtocQAAAcE"]
[Sat Feb 28 00:14:12.990398 2026] [:error] [pid 62998:tid 63006] [client 4.197.75.18:3859] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaHC1FQeueXZDUmoLomfcAAAAQQ"]
[Sat Feb 28 00:14:13.028306 2026] [:error] [pid 62998:tid 63011] [client 4.197.75.18:3457] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaHC1VQeueXZDUmoLomfcQAAAQk"]
[Sat Feb 28 00:14:13.056121 2026] [:error] [pid 54102:tid 54158] [client 4.197.75.18:3484] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaHC1Xi74D4fiYUm_GeeYwAAAI4"]
[Sat Feb 28 00:14:13.088480 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:3819] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTpwAAAAk"]
[Sat Feb 28 00:14:13.118623 2026] [:error] [pid 54101:tid 54122] [client 4.197.75.18:3847] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaHC1VY5qgRktcYTGFtocgAAAc4"]
[Sat Feb 28 00:14:13.170193 2026] [:error] [pid 56075:tid 56079] [client 4.197.75.18:3462] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTqAAAAAI"]
[Sat Feb 28 00:14:13.205917 2026] [:error] [pid 56075:tid 56093] [client 4.197.75.18:3456] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTqQAAAA8"]
[Sat Feb 28 00:14:13.236257 2026] [:error] [pid 56075:tid 56100] [client 4.197.75.18:3491] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTqgAAABY"]
[Sat Feb 28 00:14:13.264152 2026] [:error] [pid 56075:tid 56082] [client 4.197.75.18:3900] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTqwAAAAU"]
[Sat Feb 28 00:14:13.292523 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:3989] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTrAAAAAs"]
[Sat Feb 28 00:14:13.322062 2026] [:error] [pid 56075:tid 56097] [client 4.197.75.18:3990] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTrQAAABM"]
[Sat Feb 28 00:14:13.349914 2026] [:error] [pid 56075:tid 56084] [client 4.197.75.18:4009] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTrgAAAAc"]
[Sat Feb 28 00:14:13.399838 2026] [:error] [pid 54101:tid 54115] [client 4.197.75.18:3814] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaHC1VY5qgRktcYTGFtodAAAAcc"]
[Sat Feb 28 00:14:13.429597 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:3481] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTrwAAABQ"]
[Sat Feb 28 00:14:13.458076 2026] [:error] [pid 54231:tid 54239] [client 4.197.75.18:3902] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaHC1eTvb5AeyJCdY7BXywAAAEU"]
[Sat Feb 28 00:14:13.488456 2026] [:error] [pid 56075:tid 56099] [client 4.197.75.18:3799] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTsQAAABU"]
[Sat Feb 28 00:14:13.526232 2026] [:error] [pid 56075:tid 56095] [client 4.197.75.18:3982] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTsgAAABE"]
[Sat Feb 28 00:14:13.557458 2026] [:error] [pid 56075:tid 56077] [client 4.197.75.18:3979] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTswAAAAA"]
[Sat Feb 28 00:14:13.586643 2026] [:error] [pid 56075:tid 56090] [client 4.197.75.18:3480] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTtAAAAAw"]
[Sat Feb 28 00:14:13.615862 2026] [:error] [pid 54101:tid 54127] [client 4.197.75.18:3999] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaHC1VY5qgRktcYTGFtodQAAAdM"]
[Sat Feb 28 00:14:13.647106 2026] [:error] [pid 49306:tid 49329] [client 4.197.75.18:3855] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaHC1fnSUDZue59Px9uN-wAAAVU"]
[Sat Feb 28 00:14:13.676723 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:3510] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTtwAAABg"]
[Sat Feb 28 00:14:13.726283 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:3459] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTuAAAAAE"]
[Sat Feb 28 00:14:13.754327 2026] [:error] [pid 56075:tid 56087] [client 4.197.75.18:3402] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTuQAAAAo"]
[Sat Feb 28 00:14:13.783715 2026] [:error] [pid 56075:tid 56091] [client 4.197.75.18:3997] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTugAAAA0"]
[Sat Feb 28 00:14:13.817660 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:3470] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTuwAAAAk"]
[Sat Feb 28 00:14:13.847470 2026] [:error] [pid 54103:tid 54172] [client 4.197.75.18:3803] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC1evG4MPCmE0B2sDcxwAAAME"]
[Sat Feb 28 00:14:13.874576 2026] [:error] [pid 56075:tid 56100] [client 4.197.75.18:3896] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTvgAAABY"]
[Sat Feb 28 00:14:13.902941 2026] [:error] [pid 56075:tid 56082] [client 4.197.75.18:3515] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTvwAAAAU"]
[Sat Feb 28 00:14:13.930717 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:3825] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTwAAAAAs"]
[Sat Feb 28 00:14:13.958119 2026] [:error] [pid 56075:tid 56084] [client 4.197.75.18:3981] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTwQAAAAc"]
[Sat Feb 28 00:14:13.987047 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:3892] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaHC1cKBhrfI6KNv9RiTwwAAABQ"]
[Sat Feb 28 00:14:14.014216 2026] [:error] [pid 56075:tid 56095] [client 4.197.75.18:3395] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaHC1sKBhrfI6KNv9RiTxQAAABE"]
[Sat Feb 28 00:14:14.043293 2026] [:error] [pid 49306:tid 49312] [client 4.197.75.18:3974] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaHC1vnSUDZue59Px9uN_AAAAUQ"]
[Sat Feb 28 00:14:14.079969 2026] [:error] [pid 62998:tid 63018] [client 4.197.75.18:3977] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaHC1lQeueXZDUmoLomfdQAAARA"]
[Sat Feb 28 00:14:14.108762 2026] [:error] [pid 52073:tid 52099] [client 4.197.75.18:3786] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaHC1oa650YPyxXVeRYDXwAAAZc"]
[Sat Feb 28 00:14:14.139001 2026] [:error] [pid 52073:tid 52100] [client 4.197.75.18:3487] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaHC1oa650YPyxXVeRYDYAAAAZg"]
[Sat Feb 28 00:14:14.198802 2026] [:error] [pid 52073:tid 52093] [client 4.197.75.18:3473] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaHC1oa650YPyxXVeRYDYQAAAZE"]
[Sat Feb 28 00:14:14.227678 2026] [:error] [pid 54103:tid 54190] [client 4.197.75.18:3985] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaHC1uvG4MPCmE0B2sDcyQAAANM"]
[Sat Feb 28 00:14:14.257149 2026] [:error] [pid 54231:tid 54248] [client 4.197.75.18:3475] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaHC1uTvb5AeyJCdY7BXzQAAAE4"]
[Sat Feb 28 00:14:14.284574 2026] [:error] [pid 54103:tid 54192] [client 4.197.75.18:3517] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaHC1uvG4MPCmE0B2sDcygAAANU"]
[Sat Feb 28 00:14:14.318421 2026] [:error] [pid 56075:tid 56081] [client 4.197.75.18:3424] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaHC1sKBhrfI6KNv9RiTyQAAAAQ"]
[Sat Feb 28 00:14:14.346139 2026] [:error] [pid 54103:tid 54182] [client 4.197.75.18:3437] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaHC1uvG4MPCmE0B2sDcywAAAMs"]
[Sat Feb 28 00:14:14.374423 2026] [:error] [pid 52073:tid 52079] [client 4.197.75.18:4022] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaHC1oa650YPyxXVeRYDYgAAAYM"]
[Sat Feb 28 00:14:14.404230 2026] [:error] [pid 54231:tid 54256] [client 4.197.75.18:3805] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/manager.php"] [unique_id "aaHC1uTvb5AeyJCdY7BXzwAAAFY"]
[Sat Feb 28 00:14:14.433310 2026] [:error] [pid 49306:tid 49310] [client 4.197.75.18:3899] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/manager.php"] [unique_id "aaHC1vnSUDZue59Px9uOAQAAAUI"]
[Sat Feb 28 00:14:14.463164 2026] [:error] [pid 49306:tid 49320] [client 4.197.75.18:3474] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/manager.php"] [unique_id "aaHC1vnSUDZue59Px9uOAgAAAUw"]
[Sat Feb 28 00:14:14.490564 2026] [:error] [pid 49306:tid 49317] [client 4.197.75.18:3466] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/manager.php"] [unique_id "aaHC1vnSUDZue59Px9uOBAAAAUk"]
[Sat Feb 28 00:14:14.526349 2026] [:error] [pid 49306:tid 49324] [client 4.197.75.18:3975] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/item.php"] [unique_id "aaHC1vnSUDZue59Px9uOBgAAAVA"]
[Sat Feb 28 00:14:14.553919 2026] [:error] [pid 49306:tid 49328] [client 4.197.75.18:3971] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/item.php"] [unique_id "aaHC1vnSUDZue59Px9uOBwAAAVQ"]
[Sat Feb 28 00:14:14.584703 2026] [:error] [pid 49306:tid 49330] [client 4.197.75.18:3477] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/item.php"] [unique_id "aaHC1vnSUDZue59Px9uOCAAAAVY"]
[Sat Feb 28 00:14:14.619940 2026] [:error] [pid 49306:tid 49311] [client 4.197.75.18:3995] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/item.php"] [unique_id "aaHC1vnSUDZue59Px9uOCQAAAUM"]
[Sat Feb 28 00:14:14.649694 2026] [:error] [pid 49306:tid 49326] [client 4.204.200.32:28597] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaHC1vnSUDZue59Px9uOCgAAAVI"]
[Sat Feb 28 00:14:14.664894 2026] [:error] [pid 49306:tid 49313] [client 4.197.75.18:3888] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaHC1vnSUDZue59Px9uODAAAAUU"]
[Sat Feb 28 00:14:14.702349 2026] [:error] [pid 49306:tid 49325] [client 4.197.75.18:3509] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaHC1vnSUDZue59Px9uODQAAAVE"]
[Sat Feb 28 00:14:14.730067 2026] [:error] [pid 49306:tid 49323] [client 4.197.75.18:3421] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaHC1vnSUDZue59Px9uODgAAAU8"]
[Sat Feb 28 00:14:14.759813 2026] [:error] [pid 52073:tid 52082] [client 4.197.75.18:4015] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaHC1oa650YPyxXVeRYDYwAAAYY"]
[Sat Feb 28 00:14:14.788755 2026] [:error] [pid 49306:tid 49332] [client 4.197.75.18:3497] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1vnSUDZue59Px9uOEAAAAVg"]
[Sat Feb 28 00:14:14.825015 2026] [:error] [pid 49306:tid 49329] [client 4.197.75.18:3400] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1vnSUDZue59Px9uOEQAAAVU"]
[Sat Feb 28 00:14:14.854940 2026] [:error] [pid 49306:tid 49312] [client 4.197.75.18:3878] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1vnSUDZue59Px9uOEgAAAUQ"]
[Sat Feb 28 00:14:14.884014 2026] [:error] [pid 54102:tid 54162] [client 4.197.75.18:4012] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaHC1ni74D4fiYUm_GeeZQAAAJI"]
[Sat Feb 28 00:14:14.912680 2026] [:error] [pid 49306:tid 49316] [client 4.197.75.18:3405] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mail.php"] [unique_id "aaHC1vnSUDZue59Px9uOFQAAAUg"]
[Sat Feb 28 00:14:14.940942 2026] [:error] [pid 49306:tid 49327] [client 4.197.75.18:3983] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mail.php"] [unique_id "aaHC1vnSUDZue59Px9uOFgAAAVM"]
[Sat Feb 28 00:14:14.968672 2026] [:error] [pid 49306:tid 49320] [client 4.197.75.18:3978] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mail.php"] [unique_id "aaHC1vnSUDZue59Px9uOGAAAAUw"]
[Sat Feb 28 00:14:14.997123 2026] [:error] [pid 49306:tid 49314] [client 4.197.75.18:3401] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mail.php"] [unique_id "aaHC1vnSUDZue59Px9uOGgAAAUY"]
[Sat Feb 28 00:14:15.024887 2026] [:error] [pid 49306:tid 49322] [client 4.197.75.18:3445] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaHC1_nSUDZue59Px9uOHAAAAU4"]
[Sat Feb 28 00:14:15.057285 2026] [:error] [pid 49306:tid 49324] [client 4.197.75.18:3994] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaHC1_nSUDZue59Px9uOHQAAAVA"]
[Sat Feb 28 00:14:15.091458 2026] [:error] [pid 49306:tid 49328] [client 4.197.75.18:3418] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaHC1_nSUDZue59Px9uOHgAAAVQ"]
[Sat Feb 28 00:14:15.122269 2026] [:error] [pid 49306:tid 49330] [client 4.197.75.18:3797] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaHC1_nSUDZue59Px9uOHwAAAVY"]
[Sat Feb 28 00:14:15.151012 2026] [:error] [pid 52073:tid 52081] [client 4.197.75.18:3838] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaHC14a650YPyxXVeRYDZAAAAYU"]
[Sat Feb 28 00:14:15.180681 2026] [:error] [pid 49306:tid 49326] [client 4.197.75.18:3409] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaHC1_nSUDZue59Px9uOIQAAAVI"]
[Sat Feb 28 00:14:15.229940 2026] [:error] [pid 54102:tid 54146] [client 4.197.75.18:4005] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaHC13i74D4fiYUm_GeeZgAAAII"]
[Sat Feb 28 00:14:15.257686 2026] [:error] [pid 49306:tid 49325] [client 4.197.75.18:3993] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaHC1_nSUDZue59Px9uOIgAAAVE"]
[Sat Feb 28 00:14:15.287897 2026] [:error] [pid 52073:tid 52095] [client 4.197.75.18:3442] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaHC14a650YPyxXVeRYDZQAAAZM"]
[Sat Feb 28 00:14:15.326486 2026] [:error] [pid 49306:tid 49323] [client 4.197.75.18:4006] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaHC1_nSUDZue59Px9uOIwAAAU8"]
[Sat Feb 28 00:14:15.356027 2026] [:error] [pid 49306:tid 49332] [client 4.197.75.18:3986] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaHC1_nSUDZue59Px9uOJQAAAVg"]
[Sat Feb 28 00:14:15.387692 2026] [:error] [pid 49306:tid 49312] [client 4.197.75.18:3598] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaHC1_nSUDZue59Px9uOJwAAAUQ"]
[Sat Feb 28 00:14:15.434211 2026] [:error] [pid 49306:tid 49319] [client 4.197.75.18:3489] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC1_nSUDZue59Px9uOKQAAAUs"]
[Sat Feb 28 00:14:15.462316 2026] [:error] [pid 49306:tid 49327] [client 4.197.75.18:3432] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC1_nSUDZue59Px9uOKwAAAVM"]
[Sat Feb 28 00:14:15.491752 2026] [:error] [pid 52073:tid 52091] [client 4.197.75.18:3482] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC14a650YPyxXVeRYDZgAAAY8"]
[Sat Feb 28 00:14:15.521798 2026] [:error] [pid 52073:tid 52089] [client 4.197.75.18:3507] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaHC14a650YPyxXVeRYDZwAAAY0"]
[Sat Feb 28 00:14:15.559478 2026] [:error] [pid 52073:tid 52087] [client 4.197.75.18:3399] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaHC14a650YPyxXVeRYDaQAAAYs"]
[Sat Feb 28 00:14:15.590203 2026] [:error] [pid 54101:tid 54128] [client 4.197.75.18:3417] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaHC11Y5qgRktcYTGFtodgAAAdQ"]
[Sat Feb 28 00:14:15.624774 2026] [:error] [pid 52073:tid 52094] [client 4.197.75.18:4023] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaHC14a650YPyxXVeRYDagAAAZI"]
[Sat Feb 28 00:14:15.655067 2026] [:error] [pid 54102:tid 54163] [client 4.197.75.18:3465] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaHC13i74D4fiYUm_GeeaAAAAJM"]
[Sat Feb 28 00:14:15.683663 2026] [:error] [pid 52073:tid 52083] [client 4.197.75.18:3438] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaHC14a650YPyxXVeRYDawAAAYc"]
[Sat Feb 28 00:14:15.718040 2026] [:error] [pid 52073:tid 52085] [client 4.197.75.18:3850] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaHC14a650YPyxXVeRYDbAAAAYk"]
[Sat Feb 28 00:14:15.748319 2026] [:error] [pid 49306:tid 49310] [client 4.197.75.18:3492] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaHC1_nSUDZue59Px9uOLQAAAUI"]
[Sat Feb 28 00:14:15.782743 2026] [:error] [pid 49306:tid 49320] [client 4.197.75.18:3406] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaHC1_nSUDZue59Px9uOLgAAAUw"]
[Sat Feb 28 00:14:15.811313 2026] [:error] [pid 49306:tid 49314] [client 4.197.75.18:4011] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaHC1_nSUDZue59Px9uOLwAAAUY"]
[Sat Feb 28 00:14:15.845827 2026] [:error] [pid 56075:tid 56087] [client 4.197.75.18:3996] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaHC18KBhrfI6KNv9RiTzAAAAAo"]
[Sat Feb 28 00:14:15.879869 2026] [:error] [pid 54103:tid 54177] [client 4.197.75.18:3415] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaHC1-vG4MPCmE0B2sDczQAAAMY"]
[Sat Feb 28 00:14:15.909729 2026] [:error] [pid 52073:tid 52077] [client 4.197.75.18:4028] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaHC14a650YPyxXVeRYDbgAAAYE"]
[Sat Feb 28 00:14:15.938332 2026] [:error] [pid 54103:tid 54186] [client 4.197.75.18:3898] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaHC1-vG4MPCmE0B2sDczgAAAM8"]
[Sat Feb 28 00:14:15.965990 2026] [:error] [pid 56075:tid 56093] [client 4.197.75.18:3875] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaHC18KBhrfI6KNv9RiTzgAAAA8"]
[Sat Feb 28 00:14:15.994640 2026] [:error] [pid 56075:tid 56082] [client 4.197.75.18:3617] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaHC18KBhrfI6KNv9RiTzwAAAAU"]
[Sat Feb 28 00:14:16.022646 2026] [:error] [pid 54102:tid 54151] [client 4.197.75.18:3992] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaHC2Hi74D4fiYUm_GeeaQAAAIc"]
[Sat Feb 28 00:14:16.051482 2026] [:error] [pid 52073:tid 52092] [client 4.197.75.18:3420] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaHC2Ia650YPyxXVeRYDcQAAAZA"]
[Sat Feb 28 00:14:16.079313 2026] [:error] [pid 56075:tid 56084] [client 4.197.75.18:4001] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaHC2MKBhrfI6KNv9RiT0QAAAAc"]
[Sat Feb 28 00:14:16.109214 2026] [:error] [pid 54102:tid 54165] [client 4.197.75.18:3632] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaHC2Hi74D4fiYUm_GeeagAAAJU"]
[Sat Feb 28 00:14:16.136930 2026] [:error] [pid 52073:tid 52099] [client 4.197.75.18:4003] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaHC2Ia650YPyxXVeRYDcwAAAZc"]
[Sat Feb 28 00:14:16.164712 2026] [:error] [pid 52073:tid 52093] [client 4.197.75.18:4024] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaHC2Ia650YPyxXVeRYDdAAAAZE"]
[Sat Feb 28 00:14:16.194187 2026] [:error] [pid 52073:tid 52084] [client 4.197.75.18:3436] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaHC2Ia650YPyxXVeRYDdQAAAYg"]
[Sat Feb 28 00:14:16.265317 2026] [:error] [pid 54101:tid 54120] [client 4.197.75.18:4016] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaHC2FY5qgRktcYTGFtodwAAAcw"]
[Sat Feb 28 00:14:16.295906 2026] [:error] [pid 54102:tid 54160] [client 4.197.75.18:4030] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaHC2Hi74D4fiYUm_GeebAAAAJA"]
[Sat Feb 28 00:14:16.324058 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:3426] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaHC2MKBhrfI6KNv9RiT0wAAABc"]
[Sat Feb 28 00:14:16.361957 2026] [:error] [pid 62998:tid 63014] [client 4.197.75.18:4018] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaHC2FQeueXZDUmoLomfdwAAAQw"]
[Sat Feb 28 00:14:16.377856 2026] [:error] [pid 62998:tid 63001] [client 4.204.200.32:28591] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaHC2FQeueXZDUmoLomfeAAAAQA"]
[Sat Feb 28 00:14:16.389987 2026] [:error] [pid 62998:tid 63021] [client 4.197.75.18:3411] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaHC2FQeueXZDUmoLomfeQAAARM"]
[Sat Feb 28 00:14:16.420045 2026] [:error] [pid 62998:tid 63017] [client 4.197.75.18:3991] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaHC2FQeueXZDUmoLomfegAAAQ8"]
[Sat Feb 28 00:14:16.460010 2026] [:error] [pid 54231:tid 54237] [client 4.197.75.18:3588] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaHC2OTvb5AeyJCdY7BX0AAAAEM"]
[Sat Feb 28 00:14:16.489674 2026] [:error] [pid 49306:tid 49324] [client 4.197.75.18:4000] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaHC2PnSUDZue59Px9uOMgAAAVA"]
[Sat Feb 28 00:14:16.520637 2026] [:error] [pid 52073:tid 52095] [client 4.197.75.18:3433] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaHC2Ia650YPyxXVeRYDeQAAAZM"]
[Sat Feb 28 00:14:16.548913 2026] [:error] [pid 54101:tid 54113] [client 4.197.75.18:3407] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaHC2FY5qgRktcYTGFtoeAAAAcU"]
[Sat Feb 28 00:14:16.577252 2026] [:error] [pid 52073:tid 52091] [client 4.197.75.18:3980] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aaHC2Ia650YPyxXVeRYDegAAAY8"]
[Sat Feb 28 00:14:16.605510 2026] [:error] [pid 52073:tid 52097] [client 4.197.75.18:3881] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaHC2Ia650YPyxXVeRYDewAAAZU"]
[Sat Feb 28 00:14:16.634537 2026] [:error] [pid 56075:tid 56083] [client 4.197.75.18:3425] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaHC2MKBhrfI6KNv9RiT1AAAAAY"]
[Sat Feb 28 00:14:16.663267 2026] [:error] [pid 49306:tid 49328] [client 4.197.75.18:3394] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaHC2PnSUDZue59Px9uOMwAAAVQ"]
[Sat Feb 28 00:14:16.698294 2026] [:error] [pid 49306:tid 49311] [client 4.197.75.18:3422] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaHC2PnSUDZue59Px9uONAAAAUM"]
[Sat Feb 28 00:14:16.727154 2026] [:error] [pid 54101:tid 54119] [client 4.197.75.18:3428] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaHC2FY5qgRktcYTGFtoegAAAcs"]
[Sat Feb 28 00:14:16.756897 2026] [:error] [pid 52073:tid 52087] [client 4.197.75.18:3404] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaHC2Ia650YPyxXVeRYDfAAAAYs"]
[Sat Feb 28 00:14:16.785682 2026] [:error] [pid 49306:tid 49313] [client 4.197.75.18:3412] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaHC2PnSUDZue59Px9uONgAAAUU"]
[Sat Feb 28 00:14:16.813567 2026] [:error] [pid 62998:tid 63008] [client 4.197.75.18:3968] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaHC2FQeueXZDUmoLomfewAAAQY"]
[Sat Feb 28 00:14:16.842677 2026] [:error] [pid 54231:tid 54251] [client 4.197.75.18:3637] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaHC2OTvb5AeyJCdY7BX0QAAAFE"]
[Sat Feb 28 00:14:16.872090 2026] [:error] [pid 54101:tid 54118] [client 4.197.75.18:3429] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaHC2FY5qgRktcYTGFtoewAAAco"]
[Sat Feb 28 00:14:16.899687 2026] [:error] [pid 62998:tid 63010] [client 4.197.75.18:3447] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaHC2FQeueXZDUmoLomffAAAAQg"]
[Sat Feb 28 00:14:16.929015 2026] [:error] [pid 49306:tid 49325] [client 4.197.75.18:3596] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaHC2PnSUDZue59Px9uONwAAAVE"]
[Sat Feb 28 00:14:16.958915 2026] [:error] [pid 56075:tid 56092] [client 4.197.75.18:4019] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaHC2MKBhrfI6KNv9RiT2AAAAA4"]
[Sat Feb 28 00:14:16.986834 2026] [:error] [pid 62998:tid 63002] [client 4.197.75.18:3587] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaHC2FQeueXZDUmoLomffQAAAQE"]
[Sat Feb 28 00:14:17.014673 2026] [:error] [pid 52073:tid 52094] [client 4.197.75.18:3414] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaHC2Ya650YPyxXVeRYDfgAAAZI"]
[Sat Feb 28 00:14:17.043922 2026] [:error] [pid 54231:tid 54257] [client 4.197.75.18:3601] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaHC2eTvb5AeyJCdY7BX0gAAAFc"]
[Sat Feb 28 00:14:17.075456 2026] [:error] [pid 52073:tid 52083] [client 4.197.75.18:4007] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaHC2Ya650YPyxXVeRYDfwAAAYc"]
[Sat Feb 28 00:14:17.104101 2026] [:error] [pid 52073:tid 52085] [client 4.197.75.18:3453] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaHC2Ya650YPyxXVeRYDgAAAAYk"]
[Sat Feb 28 00:14:17.138026 2026] [:error] [pid 52073:tid 52076] [client 4.197.75.18:3605] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaHC2Ya650YPyxXVeRYDgQAAAYA"]
[Sat Feb 28 00:14:17.167577 2026] [:error] [pid 52073:tid 52086] [client 4.197.75.18:3516] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aaHC2Ya650YPyxXVeRYDggAAAYo"]
[Sat Feb 28 00:14:17.195472 2026] [:error] [pid 62998:tid 63012] [client 4.197.75.18:3636] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ww1.php"] [unique_id "aaHC2VQeueXZDUmoLomffwAAAQo"]
[Sat Feb 28 00:14:17.224834 2026] [:error] [pid 62998:tid 63019] [client 4.197.75.18:3435] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ww1.php"] [unique_id "aaHC2VQeueXZDUmoLomfgAAAARE"]
[Sat Feb 28 00:14:17.275553 2026] [:error] [pid 52073:tid 52080] [client 4.197.75.18:3600] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ww1.php"] [unique_id "aaHC2Ya650YPyxXVeRYDgwAAAYQ"]
[Sat Feb 28 00:14:17.303738 2026] [:error] [pid 56075:tid 56096] [client 4.197.75.18:3503] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about/function.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT2wAAABI"]
[Sat Feb 28 00:14:17.331891 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:3119] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about/function.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT3AAAABg"]
[Sat Feb 28 00:14:17.372761 2026] [:error] [pid 49306:tid 49318] [client 4.197.75.18:3403] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about/function.php"] [unique_id "aaHC2fnSUDZue59Px9uOOQAAAUo"]
[Sat Feb 28 00:14:17.403340 2026] [:error] [pid 56075:tid 56100] [client 4.197.75.18:3479] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about/function.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT3QAAABY"]
[Sat Feb 28 00:14:17.432674 2026] [:error] [pid 62998:tid 63005] [client 4.197.75.18:3624] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aaHC2VQeueXZDUmoLomfgQAAAQM"]
[Sat Feb 28 00:14:17.461079 2026] [:error] [pid 56075:tid 56094] [client 4.197.75.18:4020] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT3gAAABA"]
[Sat Feb 28 00:14:17.489727 2026] [:error] [pid 49306:tid 49315] [client 4.197.75.18:4008] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aaHC2fnSUDZue59Px9uOOgAAAUc"]
[Sat Feb 28 00:14:17.519491 2026] [:error] [pid 62998:tid 63022] [client 4.197.75.18:3886] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aaHC2VQeueXZDUmoLomfgwAAARQ"]
[Sat Feb 28 00:14:17.558442 2026] [:error] [pid 56075:tid 56087] [client 4.197.75.18:3398] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT3wAAAAo"]
[Sat Feb 28 00:14:17.591942 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:4013] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT4AAAAAE"]
[Sat Feb 28 00:14:17.621698 2026] [:error] [pid 52073:tid 52088] [client 4.197.75.18:3508] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaHC2Ya650YPyxXVeRYDhQAAAYw"]
[Sat Feb 28 00:14:17.651105 2026] [:error] [pid 54101:tid 54126] [client 4.197.75.18:3441] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaHC2VY5qgRktcYTGFtofQAAAdI"]
[Sat Feb 28 00:14:17.681532 2026] [:error] [pid 49306:tid 49329] [client 4.197.75.18:3102] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaHC2fnSUDZue59Px9uOOwAAAVU"]
[Sat Feb 28 00:14:17.717508 2026] [:error] [pid 62998:tid 63013] [client 4.197.75.18:4014] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaHC2VQeueXZDUmoLomfhAAAAQs"]
[Sat Feb 28 00:14:17.744960 2026] [:error] [pid 62998:tid 63011] [client 4.197.75.18:4025] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaHC2VQeueXZDUmoLomfhQAAAQk"]
[Sat Feb 28 00:14:17.755027 2026] [:error] [pid 62998:tid 63023] [client 4.204.200.32:63908] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdsa.php"] [unique_id "aaHC2VQeueXZDUmoLomfhgAAARU"]
[Sat Feb 28 00:14:17.774443 2026] [:error] [pid 62998:tid 63026] [client 4.197.75.18:3464] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaHC2VQeueXZDUmoLomfiAAAARg"]
[Sat Feb 28 00:14:17.810628 2026] [:error] [pid 62998:tid 63009] [client 4.197.75.18:3633] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/security.php"] [unique_id "aaHC2VQeueXZDUmoLomfiQAAAQc"]
[Sat Feb 28 00:14:17.838400 2026] [:error] [pid 62998:tid 63018] [client 4.197.75.18:3449] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/security.php"] [unique_id "aaHC2VQeueXZDUmoLomfigAAARA"]
[Sat Feb 28 00:14:17.867329 2026] [:error] [pid 62998:tid 63020] [client 4.197.75.18:3608] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/security.php"] [unique_id "aaHC2VQeueXZDUmoLomfiwAAARI"]
[Sat Feb 28 00:14:17.897223 2026] [:error] [pid 62998:tid 63014] [client 4.197.75.18:4004] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/security.php"] [unique_id "aaHC2VQeueXZDUmoLomfjAAAAQw"]
[Sat Feb 28 00:14:17.931259 2026] [:error] [pid 62998:tid 63001] [client 4.197.75.18:3603] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaHC2VQeueXZDUmoLomfjQAAAQA"]
[Sat Feb 28 00:14:17.963179 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:3976] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT4gAAAAk"]
[Sat Feb 28 00:14:17.990834 2026] [:error] [pid 56075:tid 56093] [client 4.197.75.18:3518] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaHC2cKBhrfI6KNv9RiT4wAAAA8"]
[Sat Feb 28 00:14:18.018627 2026] [:error] [pid 56075:tid 56082] [client 4.197.75.18:3396] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT5AAAAAU"]
[Sat Feb 28 00:14:18.052862 2026] [:error] [pid 49306:tid 49316] [client 4.197.75.18:3614] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaHC2vnSUDZue59Px9uOPAAAAUg"]
[Sat Feb 28 00:14:18.081121 2026] [:error] [pid 49306:tid 49327] [client 4.197.75.18:3599] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaHC2vnSUDZue59Px9uOPQAAAVM"]
[Sat Feb 28 00:14:18.111631 2026] [:error] [pid 49306:tid 49308] [client 4.197.75.18:3642] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaHC2vnSUDZue59Px9uOPgAAAUA"]
[Sat Feb 28 00:14:18.146492 2026] [:error] [pid 49306:tid 49310] [client 4.197.75.18:4037] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaHC2vnSUDZue59Px9uOQAAAAUI"]
[Sat Feb 28 00:14:18.174792 2026] [:error] [pid 49306:tid 49320] [client 4.197.75.18:3439] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaHC2vnSUDZue59Px9uOQQAAAUw"]
[Sat Feb 28 00:14:18.203188 2026] [:error] [pid 49306:tid 49314] [client 4.197.75.18:3590] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaHC2vnSUDZue59Px9uOQgAAAUY"]
[Sat Feb 28 00:14:18.230721 2026] [:error] [pid 49306:tid 49317] [client 4.197.75.18:3410] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaHC2vnSUDZue59Px9uOQwAAAUk"]
[Sat Feb 28 00:14:18.285200 2026] [:error] [pid 62998:tid 63017] [client 4.197.75.18:3430] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaHC2lQeueXZDUmoLomfjwAAAQ8"]
[Sat Feb 28 00:14:18.314009 2026] [:error] [pid 49306:tid 49328] [client 4.197.75.18:4021] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaHC2vnSUDZue59Px9uORgAAAVQ"]
[Sat Feb 28 00:14:18.342069 2026] [:error] [pid 49306:tid 49311] [client 4.197.75.18:3630] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aaHC2vnSUDZue59Px9uORwAAAUM"]
[Sat Feb 28 00:14:18.370160 2026] [:error] [pid 52073:tid 52084] [client 4.197.75.18:3988] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aaHC2oa650YPyxXVeRYDhwAAAYg"]
[Sat Feb 28 00:14:18.403752 2026] [:error] [pid 54231:tid 54250] [client 4.197.75.18:3584] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "aaHC2uTvb5AeyJCdY7BX1AAAAFA"]
[Sat Feb 28 00:14:18.435348 2026] [:error] [pid 49306:tid 49325] [client 4.197.75.18:3519] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaHC2vnSUDZue59Px9uOSQAAAVE"]
[Sat Feb 28 00:14:18.463348 2026] [:error] [pid 49306:tid 49321] [client 4.197.75.18:3593] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaHC2vnSUDZue59Px9uOSgAAAU0"]
[Sat Feb 28 00:14:18.498423 2026] [:error] [pid 54101:tid 54114] [client 4.197.75.18:3647] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaHC2lY5qgRktcYTGFtofgAAAcY"]
[Sat Feb 28 00:14:18.527336 2026] [:error] [pid 54231:tid 54245] [client 4.197.75.18:3455] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaHC2uTvb5AeyJCdY7BX1QAAAEs"]
[Sat Feb 28 00:14:18.559961 2026] [:error] [pid 54101:tid 54123] [client 4.197.75.18:3865] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aaHC2lY5qgRktcYTGFtofwAAAc8"]
[Sat Feb 28 00:14:18.593000 2026] [:error] [pid 54101:tid 54116] [client 4.197.75.18:3585] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aaHC2lY5qgRktcYTGFtogAAAAcg"]
[Sat Feb 28 00:14:18.624938 2026] [:error] [pid 49306:tid 49332] [client 4.197.75.18:4002] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aaHC2vnSUDZue59Px9uOSwAAAVg"]
[Sat Feb 28 00:14:18.655348 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:3443] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT5wAAABc"]
[Sat Feb 28 00:14:18.683858 2026] [:error] [pid 56075:tid 56095] [client 4.197.75.18:3085] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT6AAAABE"]
[Sat Feb 28 00:14:18.723180 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:3984] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT6QAAABQ"]
[Sat Feb 28 00:14:18.770145 2026] [:error] [pid 54103:tid 54180] [client 4.197.75.18:4017] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaHC2uvG4MPCmE0B2sDc0AAAAMk"]
[Sat Feb 28 00:14:18.798204 2026] [:error] [pid 54103:tid 54183] [client 4.197.75.18:3431] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaHC2uvG4MPCmE0B2sDc0QAAAMw"]
[Sat Feb 28 00:14:18.834133 2026] [:error] [pid 62998:tid 63002] [client 4.197.75.18:4026] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaHC2lQeueXZDUmoLomfkQAAAQE"]
[Sat Feb 28 00:14:18.863601 2026] [:error] [pid 56075:tid 56090] [client 4.197.75.18:3392] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT6wAAAAw"]
[Sat Feb 28 00:14:18.891442 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:4033] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT7AAAABg"]
[Sat Feb 28 00:14:18.925269 2026] [:error] [pid 56075:tid 56099] [client 4.197.75.18:3393] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT7QAAABU"]
[Sat Feb 28 00:14:18.954773 2026] [:error] [pid 56075:tid 56100] [client 4.197.75.18:3423] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT7gAAABY"]
[Sat Feb 28 00:14:18.985182 2026] [:error] [pid 56075:tid 56094] [client 4.197.75.18:3103] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaHC2sKBhrfI6KNv9RiT7wAAABA"]
[Sat Feb 28 00:14:19.016119 2026] [:error] [pid 62998:tid 63019] [client 4.197.75.18:4038] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaHC21QeueXZDUmoLomfkwAAARE"]
[Sat Feb 28 00:14:19.050483 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:3851] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaHC28KBhrfI6KNv9RiT8AAAAAE"]
[Sat Feb 28 00:14:19.087639 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:3643] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaHC28KBhrfI6KNv9RiT8QAAAAk"]
[Sat Feb 28 00:14:19.121191 2026] [:error] [pid 62998:tid 63007] [client 4.197.75.18:3595] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaHC21QeueXZDUmoLomflAAAAQU"]
[Sat Feb 28 00:14:19.151331 2026] [:error] [pid 62998:tid 63025] [client 4.197.75.18:3638] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaHC21QeueXZDUmoLomflQAAARc"]
[Sat Feb 28 00:14:19.189786 2026] [:error] [pid 52073:tid 52091] [client 4.197.75.18:3514] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaHC24a650YPyxXVeRYDigAAAY8"]
[Sat Feb 28 00:14:19.191947 2026] [:error] [pid 49306:tid 49316] [client 4.204.200.32:64334] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdsa.php"] [unique_id "aaHC2_nSUDZue59Px9uOTgAAAUg"]
[Sat Feb 28 00:14:19.229935 2026] [:error] [pid 62998:tid 63005] [client 4.197.75.18:3451] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaHC21QeueXZDUmoLomflgAAAQM"]
[Sat Feb 28 00:14:19.304114 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:3592] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaHC28KBhrfI6KNv9RiT8wAAAAs"]
[Sat Feb 28 00:14:19.332059 2026] [:error] [pid 52073:tid 52089] [client 4.197.75.18:3452] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaHC24a650YPyxXVeRYDiwAAAY0"]
[Sat Feb 28 00:14:19.360439 2026] [:error] [pid 52073:tid 52097] [client 4.197.75.18:3627] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaHC24a650YPyxXVeRYDjAAAAZU"]
[Sat Feb 28 00:14:19.391591 2026] [:error] [pid 52073:tid 52087] [client 4.197.75.18:3634] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaHC24a650YPyxXVeRYDjQAAAYs"]
[Sat Feb 28 00:14:19.426218 2026] [:error] [pid 52073:tid 52081] [client 4.197.75.18:3413] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaHC24a650YPyxXVeRYDjgAAAYU"]
[Sat Feb 28 00:14:19.456841 2026] [:error] [pid 52073:tid 52094] [client 4.197.75.18:3500] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaHC24a650YPyxXVeRYDjwAAAZI"]
[Sat Feb 28 00:14:19.484657 2026] [:error] [pid 52073:tid 52083] [client 4.197.75.18:3084] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaHC24a650YPyxXVeRYDkAAAAYc"]
[Sat Feb 28 00:14:19.511892 2026] [:error] [pid 52073:tid 52078] [client 4.197.75.18:3613] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaHC24a650YPyxXVeRYDkQAAAYI"]
[Sat Feb 28 00:14:19.541165 2026] [:error] [pid 52073:tid 52076] [client 4.197.75.18:3114] [client 4.197.75.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaHC24a650YPyxXVeRYDkgAAAYA"]
[Sat Feb 28 00:14:19.572129 2026] [:error] [pid 52073:tid 52092] [client 4.197.75.18:3427] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaHC24a650YPyxXVeRYDkwAAAZA"]
[Sat Feb 28 00:14:19.602026 2026] [:error] [pid 52073:tid 52098] [client 4.197.75.18:3626] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaHC24a650YPyxXVeRYDlAAAAZY"]
[Sat Feb 28 00:14:19.632795 2026] [:error] [pid 52073:tid 52077] [client 4.197.75.18:3876] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaHC24a650YPyxXVeRYDlgAAAYE"]
[Sat Feb 28 00:14:19.667724 2026] [:error] [pid 52073:tid 52088] [client 4.197.75.18:3122] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aaHC24a650YPyxXVeRYDlwAAAYw"]
[Sat Feb 28 00:14:19.701000 2026] [:error] [pid 52073:tid 52099] [client 4.197.75.18:4055] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aaHC24a650YPyxXVeRYDmQAAAZc"]
[Sat Feb 28 00:14:19.732424 2026] [:error] [pid 52073:tid 52090] [client 4.197.75.18:3450] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aaHC24a650YPyxXVeRYDmwAAAY4"]
[Sat Feb 28 00:14:19.762894 2026] [:error] [pid 62998:tid 63022] [client 4.197.75.18:3604] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "aaHC21QeueXZDUmoLomflwAAARQ"]
[Sat Feb 28 00:14:19.793976 2026] [:error] [pid 49306:tid 49331] [client 4.197.75.18:3609] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaHC2_nSUDZue59Px9uOUQAAAVc"]
[Sat Feb 28 00:14:19.825726 2026] [:error] [pid 49306:tid 49314] [client 4.197.75.18:3607] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaHC2_nSUDZue59Px9uOUgAAAUY"]
[Sat Feb 28 00:14:19.856301 2026] [:error] [pid 52073:tid 52084] [client 4.197.75.18:3606] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaHC24a650YPyxXVeRYDnAAAAYg"]
[Sat Feb 28 00:14:19.890022 2026] [:error] [pid 52073:tid 52096] [client 4.197.75.18:3096] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaHC24a650YPyxXVeRYDnQAAAZQ"]
[Sat Feb 28 00:14:19.920907 2026] [:error] [pid 52073:tid 52082] [client 4.197.75.18:3115] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaHC24a650YPyxXVeRYDngAAAYY"]
[Sat Feb 28 00:14:19.950262 2026] [:error] [pid 54231:tid 54258] [client 4.197.75.18:3639] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaHC2-Tvb5AeyJCdY7BX2gAAAFg"]
[Sat Feb 28 00:14:19.980719 2026] [:error] [pid 52073:tid 52095] [client 4.197.75.18:3602] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaHC24a650YPyxXVeRYDnwAAAZM"]
[Sat Feb 28 00:14:20.012172 2026] [:error] [pid 52073:tid 52091] [client 4.197.75.18:4060] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaHC3Ia650YPyxXVeRYDoAAAAY8"]
[Sat Feb 28 00:14:20.058960 2026] [:error] [pid 52073:tid 52089] [client 4.197.75.18:4010] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaHC3Ia650YPyxXVeRYDoQAAAY0"]
[Sat Feb 28 00:14:20.091485 2026] [:error] [pid 52073:tid 52097] [client 4.197.75.18:3621] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaHC3Ia650YPyxXVeRYDogAAAZU"]
[Sat Feb 28 00:14:20.127034 2026] [:error] [pid 52073:tid 52087] [client 4.197.75.18:3077] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaHC3Ia650YPyxXVeRYDowAAAYs"]
[Sat Feb 28 00:14:20.156747 2026] [:error] [pid 52073:tid 52094] [client 4.197.75.18:3074] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaHC3Ia650YPyxXVeRYDpQAAAZI"]
[Sat Feb 28 00:14:20.187004 2026] [:error] [pid 52073:tid 52083] [client 4.197.75.18:4027] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaHC3Ia650YPyxXVeRYDpgAAAYc"]
[Sat Feb 28 00:14:20.193048 2026] [:error] [pid 52073:tid 52078] [client 4.204.200.32:64335] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdsa.php"] [unique_id "aaHC3Ia650YPyxXVeRYDpwAAAYI"]
[Sat Feb 28 00:14:20.216763 2026] [:error] [pid 52073:tid 52085] [client 4.197.75.18:3635] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaHC3Ia650YPyxXVeRYDqAAAAYk"]
[Sat Feb 28 00:14:20.261451 2026] [:error] [pid 52073:tid 52076] [client 4.197.75.18:3118] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaHC3Ia650YPyxXVeRYDqQAAAYA"]
[Sat Feb 28 00:14:20.346739 2026] [:error] [pid 52073:tid 52086] [client 4.197.75.18:3110] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaHC3Ia650YPyxXVeRYDqgAAAYo"]
[Sat Feb 28 00:14:20.396901 2026] [:error] [pid 52073:tid 52092] [client 4.197.75.18:3081] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaHC3Ia650YPyxXVeRYDrAAAAZA"]
[Sat Feb 28 00:14:20.455173 2026] [:error] [pid 54231:tid 54247] [client 4.197.75.18:3095] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaHC3OTvb5AeyJCdY7BX3AAAAE0"]
[Sat Feb 28 00:14:20.509887 2026] [:error] [pid 54101:tid 54130] [client 4.197.75.18:3129] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaHC3FY5qgRktcYTGFtoggAAAdY"]
[Sat Feb 28 00:14:20.573866 2026] [:error] [pid 54101:tid 54121] [client 4.197.75.18:3072] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaHC3FY5qgRktcYTGFtogwAAAc0"]
[Sat Feb 28 00:14:20.629313 2026] [:error] [pid 54101:tid 54125] [client 4.197.75.18:3105] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/04.php"] [unique_id "aaHC3FY5qgRktcYTGFtohAAAAdE"]
[Sat Feb 28 00:14:20.702131 2026] [:error] [pid 54101:tid 54122] [client 4.197.75.18:3972] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/04.php"] [unique_id "aaHC3FY5qgRktcYTGFtohgAAAc4"]
[Sat Feb 28 00:14:20.749140 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:3597] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/04.php"] [unique_id "aaHC3MKBhrfI6KNv9RiT9wAAABc"]
[Sat Feb 28 00:14:20.807484 2026] [:error] [pid 52073:tid 52080] [client 4.197.75.18:3098] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/04.php"] [unique_id "aaHC3Ia650YPyxXVeRYDrQAAAYQ"]
[Sat Feb 28 00:14:20.858748 2026] [:error] [pid 54102:tid 54166] [client 4.197.75.18:3646] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/333.php"] [unique_id "aaHC3Hi74D4fiYUm_GeebgAAAJY"]
[Sat Feb 28 00:14:20.887613 2026] [:error] [pid 62998:tid 63023] [client 4.197.75.18:3112] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/333.php"] [unique_id "aaHC3FQeueXZDUmoLomfmQAAARU"]
[Sat Feb 28 00:14:20.931868 2026] [:error] [pid 62998:tid 63015] [client 4.197.75.18:3594] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/333.php"] [unique_id "aaHC3FQeueXZDUmoLomfmgAAAQ0"]
[Sat Feb 28 00:14:20.990839 2026] [:error] [pid 52073:tid 52088] [client 4.197.75.18:3444] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/333.php"] [unique_id "aaHC3Ia650YPyxXVeRYDrwAAAYw"]
[Sat Feb 28 00:14:21.075081 2026] [:error] [pid 54101:tid 54115] [client 4.197.75.18:3397] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/520.php"] [unique_id "aaHC3VY5qgRktcYTGFtoiQAAAcc"]
[Sat Feb 28 00:14:21.151224 2026] [:error] [pid 54101:tid 54112] [client 4.197.75.18:4053] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/520.php"] [unique_id "aaHC3VY5qgRktcYTGFtojAAAAcQ"]
[Sat Feb 28 00:14:21.178975 2026] [:error] [pid 54231:tid 54239] [client 4.197.75.18:3075] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/520.php"] [unique_id "aaHC3eTvb5AeyJCdY7BX3gAAAEU"]
[Sat Feb 28 00:14:21.207415 2026] [:error] [pid 52073:tid 52099] [client 4.197.75.18:3131] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/520.php"] [unique_id "aaHC3Ya650YPyxXVeRYDsAAAAZc"]
[Sat Feb 28 00:14:21.246070 2026] [:error] [pid 52073:tid 52093] [client 4.197.75.18:3082] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ar.php"] [unique_id "aaHC3Ya650YPyxXVeRYDsQAAAZE"]
[Sat Feb 28 00:14:21.286712 2026] [:error] [pid 56075:tid 56083] [client 4.197.75.18:3419] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ar.php"] [unique_id "aaHC3cKBhrfI6KNv9RiT-QAAAAY"]
[Sat Feb 28 00:14:21.316682 2026] [:error] [pid 52073:tid 52090] [client 4.197.75.18:3089] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ar.php"] [unique_id "aaHC3Ya650YPyxXVeRYDsgAAAY4"]
[Sat Feb 28 00:14:21.362575 2026] [:error] [pid 54231:tid 54246] [client 4.197.75.18:3097] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ar.php"] [unique_id "aaHC3eTvb5AeyJCdY7BX3wAAAEw"]
[Sat Feb 28 00:14:21.393016 2026] [:error] [pid 54103:tid 54181] [client 4.197.75.18:4077] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x.php"] [unique_id "aaHC3evG4MPCmE0B2sDc0wAAAMo"]
[Sat Feb 28 00:14:21.422011 2026] [:error] [pid 54102:tid 54156] [client 4.197.75.18:3644] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x.php"] [unique_id "aaHC3Xi74D4fiYUm_GeecAAAAIw"]
[Sat Feb 28 00:14:21.453238 2026] [:error] [pid 52073:tid 52084] [client 4.197.75.18:3080] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x.php"] [unique_id "aaHC3Ya650YPyxXVeRYDswAAAYg"]
[Sat Feb 28 00:14:21.502093 2026] [:error] [pid 54103:tid 54185] [client 4.197.75.18:3440] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x.php"] [unique_id "aaHC3evG4MPCmE0B2sDc1AAAAM4"]
[Sat Feb 28 00:14:21.529879 2026] [:error] [pid 56075:tid 56077] [client 4.197.75.18:3610] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xx.php"] [unique_id "aaHC3cKBhrfI6KNv9RiT_AAAAAA"]
[Sat Feb 28 00:14:21.559701 2026] [:error] [pid 56075:tid 56090] [client 4.197.75.18:3073] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xx.php"] [unique_id "aaHC3cKBhrfI6KNv9RiT_QAAAAw"]
[Sat Feb 28 00:14:21.587037 2026] [:error] [pid 56075:tid 56096] [client 4.197.75.18:3100] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xx.php"] [unique_id "aaHC3cKBhrfI6KNv9RiT_gAAABI"]
[Sat Feb 28 00:14:21.614464 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:4074] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xx.php"] [unique_id "aaHC3cKBhrfI6KNv9RiT_wAAABg"]
[Sat Feb 28 00:14:21.642131 2026] [:error] [pid 52073:tid 52096] [client 4.197.75.18:3618] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aaHC3Ya650YPyxXVeRYDtQAAAZQ"]
[Sat Feb 28 00:14:21.682317 2026] [:error] [pid 54102:tid 54147] [client 4.197.75.18:3093] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aaHC3Xi74D4fiYUm_GeecgAAAIM"]
[Sat Feb 28 00:14:21.709868 2026] [:error] [pid 54102:tid 54150] [client 4.197.75.18:4036] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aaHC3Xi74D4fiYUm_GeecwAAAIY"]
[Sat Feb 28 00:14:21.739438 2026] [:error] [pid 54101:tid 54128] [client 4.197.75.18:3408] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "aaHC3VY5qgRktcYTGFtojgAAAdQ"]
[Sat Feb 28 00:14:21.774014 2026] [:error] [pid 54102:tid 54168] [client 4.197.75.18:3127] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2clas.php"] [unique_id "aaHC3Xi74D4fiYUm_GeedAAAAJc"]
[Sat Feb 28 00:14:21.805029 2026] [:error] [pid 54101:tid 54120] [client 4.197.75.18:3298] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2clas.php"] [unique_id "aaHC3VY5qgRktcYTGFtojwAAAcw"]
[Sat Feb 28 00:14:21.835202 2026] [:error] [pid 54103:tid 54184] [client 4.197.75.18:3316] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2clas.php"] [unique_id "aaHC3evG4MPCmE0B2sDc1QAAAM0"]
[Sat Feb 28 00:14:21.863339 2026] [:error] [pid 62998:tid 63009] [client 4.197.75.18:4040] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2clas.php"] [unique_id "aaHC3VQeueXZDUmoLomfnAAAAQc"]
[Sat Feb 28 00:14:21.891727 2026] [:error] [pid 54103:tid 54175] [client 4.197.75.18:3106] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ave.php"] [unique_id "aaHC3evG4MPCmE0B2sDc1wAAAMQ"]
[Sat Feb 28 00:14:21.922670 2026] [:error] [pid 52073:tid 52091] [client 4.197.75.18:3631] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ave.php"] [unique_id "aaHC3Ya650YPyxXVeRYDtgAAAY8"]
[Sat Feb 28 00:14:21.952282 2026] [:error] [pid 62998:tid 63018] [client 4.197.75.18:3628] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ave.php"] [unique_id "aaHC3VQeueXZDUmoLomfnQAAARA"]
[Sat Feb 28 00:14:21.984271 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:3586] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ave.php"] [unique_id "aaHC3cKBhrfI6KNv9RiUAwAAAAk"]
[Sat Feb 28 00:14:22.007382 2026] [:error] [pid 56075:tid 56093] [client 4.204.200.32:27665] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdsa.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUBAAAAA8"]
[Sat Feb 28 00:14:22.013308 2026] [:error] [pid 56075:tid 56082] [client 4.197.75.18:3091] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wrt.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUBQAAAAU"]
[Sat Feb 28 00:14:22.048271 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:3446] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wrt.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUBwAAAAs"]
[Sat Feb 28 00:14:22.085672 2026] [:error] [pid 56075:tid 56079] [client 4.197.75.18:3416] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wrt.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUCQAAAAI"]
[Sat Feb 28 00:14:22.121942 2026] [:error] [pid 56075:tid 56084] [client 4.197.75.18:3612] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wrt.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUCwAAAAc"]
[Sat Feb 28 00:14:22.149699 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:3619] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bibil.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUDAAAABc"]
[Sat Feb 28 00:14:22.179002 2026] [:error] [pid 56075:tid 56083] [client 4.197.75.18:3108] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bibil.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUDQAAAAY"]
[Sat Feb 28 00:14:22.207956 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:3266] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bibil.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUDwAAABQ"]
[Sat Feb 28 00:14:22.237992 2026] [:error] [pid 56075:tid 56077] [client 4.197.75.18:3078] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bibil.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUEAAAAAA"]
[Sat Feb 28 00:14:22.269159 2026] [:error] [pid 56075:tid 56090] [client 4.197.75.18:4029] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUEQAAAAw"]
[Sat Feb 28 00:14:22.310171 2026] [:error] [pid 56075:tid 56096] [client 4.197.75.18:4039] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUEgAAABI"]
[Sat Feb 28 00:14:22.338039 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:3629] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUEwAAABg"]
[Sat Feb 28 00:14:22.394830 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:3496] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUFgAAAAk"]
[Sat Feb 28 00:14:22.422491 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:3623] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUFwAAAAE"]
[Sat Feb 28 00:14:22.469979 2026] [:error] [pid 56075:tid 56093] [client 4.197.75.18:4085] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUGAAAAA8"]
[Sat Feb 28 00:14:22.499975 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:4051] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUGwAAAAs"]
[Sat Feb 28 00:14:22.532066 2026] [:error] [pid 56075:tid 56100] [client 4.197.75.18:3641] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUHQAAABY"]
[Sat Feb 28 00:14:22.562999 2026] [:error] [pid 56075:tid 56079] [client 4.197.75.18:3324] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUHgAAAAI"]
[Sat Feb 28 00:14:22.591752 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:4049] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUIAAAABc"]
[Sat Feb 28 00:14:22.620817 2026] [:error] [pid 56075:tid 56095] [client 4.197.75.18:3620] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUIgAAABE"]
[Sat Feb 28 00:14:22.652320 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:4090] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUIwAAABQ"]
[Sat Feb 28 00:14:22.682849 2026] [:error] [pid 49306:tid 49311] [client 4.197.75.18:4063] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaHC3vnSUDZue59Px9uOVAAAAUM"]
[Sat Feb 28 00:14:22.716358 2026] [:error] [pid 56075:tid 56080] [client 4.197.75.18:3645] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUJAAAAAM"]
[Sat Feb 28 00:14:22.751699 2026] [:error] [pid 49306:tid 49313] [client 4.197.75.18:3104] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaHC3vnSUDZue59Px9uOVQAAAUU"]
[Sat Feb 28 00:14:22.780934 2026] [:error] [pid 49306:tid 49325] [client 4.197.75.18:3134] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaHC3vnSUDZue59Px9uOVgAAAVE"]
[Sat Feb 28 00:14:22.814183 2026] [:error] [pid 54102:tid 54164] [client 4.197.75.18:3079] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaHC3ni74D4fiYUm_GeedQAAAJQ"]
[Sat Feb 28 00:14:22.843563 2026] [:error] [pid 54101:tid 54119] [client 4.197.75.18:4084] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaHC3lY5qgRktcYTGFtokAAAAcs"]
[Sat Feb 28 00:14:22.872407 2026] [:error] [pid 49306:tid 49323] [client 4.197.75.18:3615] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaHC3vnSUDZue59Px9uOVwAAAU8"]
[Sat Feb 28 00:14:22.906459 2026] [:error] [pid 49306:tid 49321] [client 4.197.75.18:3088] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaHC3vnSUDZue59Px9uOWAAAAU0"]
[Sat Feb 28 00:14:22.937699 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:4083] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaHC3sKBhrfI6KNv9RiUKQAAABg"]
[Sat Feb 28 00:14:22.966958 2026] [:error] [pid 49306:tid 49319] [client 4.197.75.18:3270] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaHC3vnSUDZue59Px9uOWQAAAUs"]
[Sat Feb 28 00:14:22.998486 2026] [:error] [pid 54102:tid 54158] [client 4.197.75.18:3625] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaHC3ni74D4fiYUm_GeedgAAAI4"]
[Sat Feb 28 00:14:23.035223 2026] [:error] [pid 54101:tid 54118] [client 4.197.75.18:4067] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaHC31Y5qgRktcYTGFtokQAAAco"]
[Sat Feb 28 00:14:23.063898 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:4062] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaHC38KBhrfI6KNv9RiULAAAAAs"]
[Sat Feb 28 00:14:23.094700 2026] [:error] [pid 56075:tid 56100] [client 4.197.75.18:3299] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaHC38KBhrfI6KNv9RiULQAAABY"]
[Sat Feb 28 00:14:23.148850 2026] [:error] [pid 56075:tid 56079] [client 4.197.75.18:3311] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaHC38KBhrfI6KNv9RiULgAAAAI"]
[Sat Feb 28 00:14:23.183953 2026] [:error] [pid 56075:tid 56085] [client 4.197.75.18:4056] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaHC38KBhrfI6KNv9RiULwAAAAg"]
[Sat Feb 28 00:14:23.217658 2026] [:error] [pid 49306:tid 49332] [client 4.197.75.18:4091] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aaHC3_nSUDZue59Px9uOWgAAAVg"]
[Sat Feb 28 00:14:23.253495 2026] [:error] [pid 49306:tid 49318] [client 4.197.75.18:3278] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aaHC3_nSUDZue59Px9uOWwAAAUo"]
[Sat Feb 28 00:14:23.284753 2026] [:error] [pid 49306:tid 49312] [client 4.197.75.18:3111] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aaHC3_nSUDZue59Px9uOXAAAAUQ"]
[Sat Feb 28 00:14:23.318348 2026] [:error] [pid 49306:tid 49329] [client 4.197.75.18:3133] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aaHC3_nSUDZue59Px9uOXQAAAVU"]
[Sat Feb 28 00:14:23.347761 2026] [:error] [pid 49306:tid 49316] [client 4.197.75.18:3591] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class9.php"] [unique_id "aaHC3_nSUDZue59Px9uOXgAAAUg"]
[Sat Feb 28 00:14:23.407028 2026] [:error] [pid 54231:tid 54248] [client 4.197.75.18:3094] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class9.php"] [unique_id "aaHC3-Tvb5AeyJCdY7BX4AAAAE4"]
[Sat Feb 28 00:14:23.434592 2026] [:error] [pid 49306:tid 49327] [client 4.197.75.18:3279] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class9.php"] [unique_id "aaHC3_nSUDZue59Px9uOYAAAAVM"]
[Sat Feb 28 00:14:23.462759 2026] [:error] [pid 49306:tid 49314] [client 4.197.75.18:3454] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class9.php"] [unique_id "aaHC3_nSUDZue59Px9uOYgAAAUY"]
[Sat Feb 28 00:14:23.491311 2026] [:error] [pid 49306:tid 49308] [client 4.197.75.18:3267] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/la.php"] [unique_id "aaHC3_nSUDZue59Px9uOYwAAAUA"]
[Sat Feb 28 00:14:23.529474 2026] [:error] [pid 56075:tid 56096] [client 4.197.75.18:4054] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/la.php"] [unique_id "aaHC38KBhrfI6KNv9RiUNAAAABI"]
[Sat Feb 28 00:14:23.557310 2026] [:error] [pid 56075:tid 56087] [client 4.197.75.18:4065] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/la.php"] [unique_id "aaHC38KBhrfI6KNv9RiUNQAAAAo"]
[Sat Feb 28 00:14:23.562434 2026] [:error] [pid 56075:tid 56102] [client 4.204.200.32:28491] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaHC38KBhrfI6KNv9RiUNgAAABg"]
[Sat Feb 28 00:14:23.586617 2026] [:error] [pid 56075:tid 56099] [client 4.197.75.18:3611] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/la.php"] [unique_id "aaHC38KBhrfI6KNv9RiUNwAAABU"]
[Sat Feb 28 00:14:23.614775 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:3125] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless11.php"] [unique_id "aaHC38KBhrfI6KNv9RiUOAAAAAE"]
[Sat Feb 28 00:14:23.644830 2026] [:error] [pid 56075:tid 56082] [client 4.197.75.18:3121] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless11.php"] [unique_id "aaHC38KBhrfI6KNv9RiUOQAAAAU"]
[Sat Feb 28 00:14:23.674457 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:3308] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless11.php"] [unique_id "aaHC38KBhrfI6KNv9RiUOgAAAAs"]
[Sat Feb 28 00:14:23.705878 2026] [:error] [pid 56075:tid 56079] [client 4.197.75.18:3128] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless11.php"] [unique_id "aaHC38KBhrfI6KNv9RiUOwAAAAI"]
[Sat Feb 28 00:14:23.739595 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:3113] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHC38KBhrfI6KNv9RiUPQAAABc"]
[Sat Feb 28 00:14:23.774515 2026] [:error] [pid 52073:tid 52081] [client 4.197.75.18:3296] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHC34a650YPyxXVeRYDtwAAAYU"]
[Sat Feb 28 00:14:23.811072 2026] [:error] [pid 56075:tid 56095] [client 4.197.75.18:4032] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHC38KBhrfI6KNv9RiUPgAAABE"]
[Sat Feb 28 00:14:23.845404 2026] [:error] [pid 52073:tid 52083] [client 4.197.75.18:3310] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ccou.php"] [unique_id "aaHC34a650YPyxXVeRYDuAAAAYc"]
[Sat Feb 28 00:14:23.873133 2026] [:error] [pid 52073:tid 52085] [client 4.197.75.18:3802] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ton.php"] [unique_id "aaHC34a650YPyxXVeRYDugAAAYk"]
[Sat Feb 28 00:14:23.900963 2026] [:error] [pid 54102:tid 54152] [client 4.197.75.18:3117] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ton.php"] [unique_id "aaHC33i74D4fiYUm_GeedwAAAIg"]
[Sat Feb 28 00:14:23.955165 2026] [:error] [pid 54102:tid 54162] [client 4.197.75.18:4064] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ton.php"] [unique_id "aaHC33i74D4fiYUm_GeeeAAAAJI"]
[Sat Feb 28 00:14:23.983778 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:3289] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ton.php"] [unique_id "aaHC38KBhrfI6KNv9RiUPwAAABQ"]
[Sat Feb 28 00:14:24.011268 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:4045] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUQgAAAAk"]
[Sat Feb 28 00:14:24.039360 2026] [:error] [pid 56075:tid 56084] [client 4.197.75.18:4041] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUQwAAAAc"]
[Sat Feb 28 00:14:24.069405 2026] [:error] [pid 56075:tid 56077] [client 4.197.75.18:3297] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC4MKBhrfI6KNv9RiURAAAAAA"]
[Sat Feb 28 00:14:24.098840 2026] [:error] [pid 56075:tid 56096] [client 4.197.75.18:4043] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/403.php"] [unique_id "aaHC4MKBhrfI6KNv9RiURQAAABI"]
[Sat Feb 28 00:14:24.128521 2026] [:error] [pid 56075:tid 56087] [client 4.197.75.18:4034] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file9.php"] [unique_id "aaHC4MKBhrfI6KNv9RiURgAAAAo"]
[Sat Feb 28 00:14:24.168763 2026] [:error] [pid 62998:tid 63001] [client 4.197.75.18:3136] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file9.php"] [unique_id "aaHC4FQeueXZDUmoLomfoAAAAQA"]
[Sat Feb 28 00:14:24.198590 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:4044] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file9.php"] [unique_id "aaHC4MKBhrfI6KNv9RiURwAAABg"]
[Sat Feb 28 00:14:24.227112 2026] [:error] [pid 56075:tid 56099] [client 4.197.75.18:3264] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file9.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUSAAAABU"]
[Sat Feb 28 00:14:24.257270 2026] [:error] [pid 54101:tid 54126] [client 4.197.75.18:3869] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ac.php"] [unique_id "aaHC4FY5qgRktcYTGFtokgAAAdI"]
[Sat Feb 28 00:14:24.295963 2026] [:error] [pid 56075:tid 56093] [client 4.197.75.18:3305] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ac.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUSwAAAA8"]
[Sat Feb 28 00:14:24.328855 2026] [:error] [pid 54103:tid 54189] [client 4.197.75.18:3327] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ac.php"] [unique_id "aaHC4OvG4MPCmE0B2sDc2AAAANI"]
[Sat Feb 28 00:14:24.363998 2026] [:error] [pid 54103:tid 54178] [client 4.197.75.18:3092] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ac.php"] [unique_id "aaHC4OvG4MPCmE0B2sDc2QAAAMc"]
[Sat Feb 28 00:14:24.435843 2026] [:error] [pid 62998:tid 63017] [client 4.197.75.18:3135] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaHC4FQeueXZDUmoLomfogAAAQ8"]
[Sat Feb 28 00:14:24.463719 2026] [:error] [pid 49306:tid 49317] [client 4.197.75.18:3640] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaHC4PnSUDZue59Px9uOZQAAAUk"]
[Sat Feb 28 00:14:24.491142 2026] [:error] [pid 56075:tid 56088] [client 4.197.75.18:3175] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUTQAAAAs"]
[Sat Feb 28 00:14:24.527766 2026] [:error] [pid 49306:tid 49324] [client 4.197.75.18:3448] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new4.php"] [unique_id "aaHC4PnSUDZue59Px9uOZgAAAVA"]
[Sat Feb 28 00:14:24.565282 2026] [:error] [pid 56075:tid 56085] [client 4.197.75.18:4076] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pop.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUTwAAAAg"]
[Sat Feb 28 00:14:24.600181 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:4068] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pop.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUUAAAABc"]
[Sat Feb 28 00:14:24.628833 2026] [:error] [pid 49306:tid 49309] [client 4.197.75.18:3325] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pop.php"] [unique_id "aaHC4PnSUDZue59Px9uOZwAAAUE"]
[Sat Feb 28 00:14:24.662259 2026] [:error] [pid 56075:tid 56097] [client 4.197.75.18:3083] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pop.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUUQAAABM"]
[Sat Feb 28 00:14:24.691542 2026] [:error] [pid 54103:tid 54176] [client 4.197.75.18:3321] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaHC4OvG4MPCmE0B2sDc2gAAAMU"]
[Sat Feb 28 00:14:24.720453 2026] [:error] [pid 49306:tid 49322] [client 4.197.75.18:4035] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaHC4PnSUDZue59Px9uOaAAAAU4"]
[Sat Feb 28 00:14:24.758778 2026] [:error] [pid 62998:tid 63024] [client 4.197.75.18:4088] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaHC4FQeueXZDUmoLomfpAAAARY"]
[Sat Feb 28 00:14:24.788095 2026] [:error] [pid 49306:tid 49328] [client 4.197.75.18:3616] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaHC4PnSUDZue59Px9uOaQAAAVQ"]
[Sat Feb 28 00:14:24.817507 2026] [:error] [pid 54101:tid 54123] [client 4.197.75.18:3526] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaHC4FY5qgRktcYTGFtolQAAAc8"]
[Sat Feb 28 00:14:24.845641 2026] [:error] [pid 54101:tid 54110] [client 4.197.75.18:4050] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaHC4FY5qgRktcYTGFtolgAAAcI"]
[Sat Feb 28 00:14:24.881914 2026] [:error] [pid 54103:tid 54172] [client 4.197.75.18:4071] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaHC4OvG4MPCmE0B2sDc3AAAAME"]
[Sat Feb 28 00:14:24.911350 2026] [:error] [pid 49306:tid 49330] [client 4.197.75.18:3123] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaHC4PnSUDZue59Px9uOagAAAVY"]
[Sat Feb 28 00:14:24.940514 2026] [:error] [pid 62998:tid 63012] [client 4.197.75.18:4066] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaHC4FQeueXZDUmoLomfpgAAAQo"]
[Sat Feb 28 00:14:24.985674 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:4080] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaHC4MKBhrfI6KNv9RiUUwAAABQ"]
[Sat Feb 28 00:14:25.018809 2026] [:error] [pid 56075:tid 56092] [client 4.204.200.32:62632] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUVAAAAA4"]
[Sat Feb 28 00:14:25.019216 2026] [:error] [pid 56075:tid 56086] [client 4.197.75.18:3883] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUVQAAAAk"]
[Sat Feb 28 00:14:25.047192 2026] [:error] [pid 56075:tid 56084] [client 4.197.75.18:3800] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUVgAAAAc"]
[Sat Feb 28 00:14:25.075089 2026] [:error] [pid 56075:tid 56080] [client 4.197.75.18:4082] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUVwAAAAM"]
[Sat Feb 28 00:14:25.104678 2026] [:error] [pid 52073:tid 52076] [client 4.197.75.18:3271] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaHC4Ya650YPyxXVeRYDvAAAAYA"]
[Sat Feb 28 00:14:25.139226 2026] [:error] [pid 54103:tid 54188] [client 4.197.75.18:3149] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaHC4evG4MPCmE0B2sDc3QAAANE"]
[Sat Feb 28 00:14:25.170002 2026] [:error] [pid 56075:tid 56096] [client 4.197.75.18:3622] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUWQAAABI"]
[Sat Feb 28 00:14:25.198246 2026] [:error] [pid 56075:tid 56087] [client 4.197.75.18:3290] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUWgAAAAo"]
[Sat Feb 28 00:14:25.226129 2026] [:error] [pid 56075:tid 56100] [client 4.197.75.18:4073] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUWwAAABY"]
[Sat Feb 28 00:14:25.254554 2026] [:error] [pid 56075:tid 56102] [client 4.197.75.18:3076] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUXAAAABg"]
[Sat Feb 28 00:14:25.284298 2026] [:error] [pid 56075:tid 56094] [client 4.197.75.18:3087] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUXQAAABA"]
[Sat Feb 28 00:14:25.328796 2026] [:error] [pid 56075:tid 56099] [client 4.197.75.18:4094] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUXgAAABU"]
[Sat Feb 28 00:14:25.356844 2026] [:error] [pid 56075:tid 56090] [client 4.197.75.18:3143] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUXwAAAAw"]
[Sat Feb 28 00:14:25.384930 2026] [:error] [pid 56075:tid 56078] [client 4.197.75.18:3158] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUYAAAAAE"]
[Sat Feb 28 00:14:25.437118 2026] [:error] [pid 56075:tid 56081] [client 4.197.75.18:3589] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUYgAAAAQ"]
[Sat Feb 28 00:14:25.464964 2026] [:error] [pid 49306:tid 49331] [client 4.197.75.18:4086] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaHC4fnSUDZue59Px9uOawAAAVc"]
[Sat Feb 28 00:14:25.494460 2026] [:error] [pid 56075:tid 56091] [client 4.197.75.18:3273] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUZAAAAA0"]
[Sat Feb 28 00:14:25.522671 2026] [:error] [pid 62998:tid 63005] [client 4.197.75.18:3139] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaHC4VQeueXZDUmoLomfqQAAAQM"]
[Sat Feb 28 00:14:25.564028 2026] [:error] [pid 62998:tid 63021] [client 4.197.75.18:3268] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaHC4VQeueXZDUmoLomfqgAAARM"]
[Sat Feb 28 00:14:25.593920 2026] [:error] [pid 56075:tid 56079] [client 4.197.75.18:3283] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUZgAAAAI"]
[Sat Feb 28 00:14:25.623923 2026] [:error] [pid 56075:tid 56101] [client 4.197.75.18:4093] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUZwAAABc"]
[Sat Feb 28 00:14:25.661744 2026] [:error] [pid 49306:tid 49313] [client 4.197.75.18:3318] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaHC4fnSUDZue59Px9uObQAAAUU"]
[Sat Feb 28 00:14:25.692250 2026] [:error] [pid 49306:tid 49325] [client 4.197.75.18:3304] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaHC4fnSUDZue59Px9uObgAAAVE"]
[Sat Feb 28 00:14:25.721767 2026] [:error] [pid 56075:tid 56097] [client 4.197.75.18:3286] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUaAAAABM"]
[Sat Feb 28 00:14:25.751018 2026] [:error] [pid 62998:tid 63022] [client 4.197.75.18:3126] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaHC4VQeueXZDUmoLomfqwAAARQ"]
[Sat Feb 28 00:14:25.785513 2026] [:error] [pid 49306:tid 49321] [client 4.197.75.18:3529] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaHC4fnSUDZue59Px9uObwAAAU0"]
[Sat Feb 28 00:14:25.815572 2026] [:error] [pid 56075:tid 56095] [client 4.197.75.18:3141] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUagAAABE"]
[Sat Feb 28 00:14:25.844664 2026] [:error] [pid 49306:tid 49319] [client 4.197.75.18:4042] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaHC4fnSUDZue59Px9uOcAAAAUs"]
[Sat Feb 28 00:14:25.872520 2026] [:error] [pid 56075:tid 56098] [client 4.197.75.18:3120] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUawAAABQ"]
[Sat Feb 28 00:14:25.905159 2026] [:error] [pid 49306:tid 49332] [client 4.197.75.18:3319] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaHC4fnSUDZue59Px9uOcQAAAVg"]
[Sat Feb 28 00:14:25.940632 2026] [:error] [pid 54231:tid 54244] [client 4.197.75.18:3840] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaHC4eTvb5AeyJCdY7BX4QAAAEo"]
[Sat Feb 28 00:14:25.974796 2026] [:error] [pid 56075:tid 56083] [client 4.197.75.18:3306] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaHC4cKBhrfI6KNv9RiUbgAAAAY"]
[Sat Feb 28 00:14:26.007004 2026] [:error] [pid 56075:tid 56084] [client 4.197.75.18:3274] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaHC4sKBhrfI6KNv9RiUbwAAAAc"]
[Sat Feb 28 00:14:26.034459 2026] [:error] [pid 56075:tid 56080] [client 4.197.75.18:3506] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaHC4sKBhrfI6KNv9RiUcAAAAAM"]
[Sat Feb 28 00:14:26.061914 2026] [:error] [pid 56075:tid 56077] [client 4.197.75.18:3326] [client 4.197.75.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaHC4sKBhrfI6KNv9RiUcQAAAAA"]
[Sat Feb 28 00:14:26.207182 2026] [:error] [pid 54101:tid 54109] [client 4.204.200.32:28568] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaHC4lY5qgRktcYTGFtomAAAAcE"]
[Sat Feb 28 00:14:27.889444 2026] [:error] [pid 62998:tid 63009] [client 4.204.200.32:64320] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaHC41QeueXZDUmoLomfsAAAAQc"]
[Sat Feb 28 00:14:28.949009 2026] [:error] [pid 54103:tid 54192] [client 4.204.200.32:64351] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaHC5OvG4MPCmE0B2sDc3wAAANU"]
[Sat Feb 28 00:14:30.760465 2026] [:error] [pid 56075:tid 56081] [client 4.204.200.32:64340] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaHC5sKBhrfI6KNv9RiUgAAAAAQ"]
[Sat Feb 28 00:14:31.718645 2026] [:error] [pid 54103:tid 54173] [client 4.204.200.32:54636] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaHC5-vG4MPCmE0B2sDc4wAAAMI"]
[Sat Feb 28 00:14:32.940667 2026] [:error] [pid 54102:tid 54154] [client 4.204.200.32:64376] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conflg.php"] [unique_id "aaHC6Hi74D4fiYUm_GeegQAAAIo"]
[Sat Feb 28 00:14:33.818705 2026] [:error] [pid 54231:tid 54243] [client 4.204.200.32:63873] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaHC6eTvb5AeyJCdY7BX6wAAAEk"]
[Sat Feb 28 00:14:34.934493 2026] [:error] [pid 56075:tid 56101] [client 4.204.200.32:28583] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaHC6sKBhrfI6KNv9RiUkwAAABc"]
[Sat Feb 28 00:14:36.142182 2026] [:error] [pid 54102:tid 54147] [client 4.204.200.32:62647] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaHC7Hi74D4fiYUm_GeehgAAAIM"]
[Sat Feb 28 00:14:37.853371 2026] [:error] [pid 49306:tid 49308] [client 4.204.200.32:62626] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "aaHC7fnSUDZue59Px9uOigAAAUA"]
[Sat Feb 28 00:14:41.326152 2026] [:error] [pid 56075:tid 56091] [client 4.204.200.32:63933] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.kb.php"] [unique_id "aaHC8cKBhrfI6KNv9RiUsQAAAA0"]
[Sat Feb 28 00:14:42.374877 2026] [:error] [pid 56075:tid 56099] [client 4.204.200.32:28379] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.kb.php"] [unique_id "aaHC8sKBhrfI6KNv9RiUwgAAABU"]
[Sat Feb 28 00:14:43.491318 2026] [:error] [pid 62998:tid 63006] [client 4.204.200.32:28589] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.kb.php"] [unique_id "aaHC81QeueXZDUmoLomf4QAAAQQ"]
[Sat Feb 28 00:14:44.626198 2026] [:error] [pid 52073:tid 52091] [client 4.204.200.32:63934] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.kb.php"] [unique_id "aaHC9Ia650YPyxXVeRYD6wAAAY8"]
[Sat Feb 28 00:14:47.268259 2026] [:error] [pid 62998:tid 63020] [client 4.204.200.32:28605] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sat Feb 28 00:22:03.641607 2026] [:error] [pid 15240:tid 15246] [client 143.198.86.151:54523] [client 143.198.86.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.86.151, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaHEqy1iKL_41Rk9A9NFxQAAAAQ"], referer: https://aoscycleteam.sport.blog//wp-login.php
[Sat Feb 28 00:22:03.648127 2026] [:error] [pid 15240:tid 15246] [client 143.198.86.151:54523] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://aoscycleteam.sport.blog//wp-login.php
[Sat Feb 28 01:07:42.639853 2026] [:error] [pid 38620:tid 38622] [client 20.151.128.128:4094] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaHPXgP6I7SRqrhh7RrtygAAAUA"]
[Sat Feb 28 01:21:09.679364 2026] [:error] [pid 38586:tid 38609] [client 20.78.129.228:6560] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 28 01:21:09.811691 2026] [:error] [pid 38586:tid 38610] [client 20.78.129.228:6560] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 01:21:10.072580 2026] [:error] [pid 38586:tid 38591] [client 20.78.129.228:6560] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Feb 28 01:21:10.197056 2026] [:error] [pid 38586:tid 38589] [client 20.78.129.228:6560] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 01:21:10.471152 2026] [:error] [pid 38586:tid 38590] [client 20.78.129.228:6560] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat Feb 28 01:21:10.610763 2026] [:error] [pid 38586:tid 38605] [client 20.78.129.228:6560] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 28 01:21:10.733289 2026] [:error] [pid 38586:tid 38602] [client 20.78.129.228:6560] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Feb 28 01:21:11.000639 2026] [:error] [pid 38586:tid 38592] [client 20.78.129.228:6560] [client 20.78.129.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaHShr_i6nvKNhjFW7VA4gAAAQM"]
[Sat Feb 28 01:21:11.516209 2026] [:error] [pid 38620:tid 38625] [client 20.78.129.228:1333] [client 20.78.129.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaHShwP6I7SRqrhh7RoC4wAAAUM"]
[Sat Feb 28 01:21:12.008850 2026] [:error] [pid 15098:tid 15123] [client 20.78.129.228:5820] [client 20.78.129.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaHSiMkFqny8dQQbmTkkBgAAAJE"]
[Sat Feb 28 01:21:12.491351 2026] [:error] [pid 15098:tid 15129] [client 20.78.129.228:20994] [client 20.78.129.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaHSiMkFqny8dQQbmTkkCAAAAJc"]
[Sat Feb 28 01:45:40.412175 2026] [:error] [pid 38620:tid 38642] [client 20.220.8.221:46194] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Sat Feb 28 01:45:40.621940 2026] [:error] [pid 38620:tid 38633] [client 20.220.8.221:46194] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Sat Feb 28 01:45:41.267502 2026] [:error] [pid 38620:tid 38624] [client 20.220.8.221:46194] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sat Feb 28 01:45:41.685384 2026] [:error] [pid 38620:tid 38633] [client 20.220.8.221:46194] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Sat Feb 28 01:45:42.102639 2026] [:error] [pid 38620:tid 38628] [client 20.220.8.221:46194] [client 20.220.8.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaHYRgP6I7SRqrhh7RohIAAAAUY"]
[Sat Feb 28 01:45:43.562266 2026] [:error] [pid 38620:tid 38646] [client 20.220.8.221:46528] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaHYRwP6I7SRqrhh7RohPwAAAVg"]
[Sat Feb 28 01:45:44.404647 2026] [:error] [pid 38620:tid 38634] [client 20.220.8.221:46530] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaHYSAP6I7SRqrhh7RohSQAAAUw"]
[Sat Feb 28 01:45:45.227258 2026] [:error] [pid 15100:tid 15183] [client 20.220.8.221:46151] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaHYSUOEbzcINan_ctLMUwAAAFc"]
[Sat Feb 28 01:45:46.052298 2026] [:error] [pid 38586:tid 38600] [client 20.220.8.221:46191] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buy.php"] [unique_id "aaHYSr_i6nvKNhjFW7VXQgAAAQs"]
[Sat Feb 28 03:16:48.356271 2026] [:error] [pid 15099:tid 15146] [client 146.190.160.27:50486] [client 146.190.160.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.160.27, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaHtoOnvP2vtPjYDq_hVBgAAAM0"]
[Sat Feb 28 03:16:48.359917 2026] [:error] [pid 15099:tid 15146] [client 146.190.160.27:50486] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 03:16:50.686234 2026] [:error] [pid 15099:tid 15156] [client 146.190.160.27:50486] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaHtounvP2vtPjYDq_hVEQAAANc"]
[Sat Feb 28 03:16:51.027038 2026] [:error] [pid 38620:tid 38646] [client 146.190.160.27:57810] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaHtowP6I7SRqrhh7RpzKwAAAVg"]
[Sat Feb 28 03:16:51.444866 2026] [:error] [pid 38586:tid 38599] [client 146.190.160.27:58699] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaHto7_i6nvKNhjFW7WeJAAAAQo"]
[Sat Feb 28 03:16:51.812245 2026] [:error] [pid 38620:tid 38636] [client 146.190.160.27:59503] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaHtowP6I7SRqrhh7RpzLwAAAU4"]
[Sat Feb 28 03:16:52.275121 2026] [:error] [pid 38586:tid 38602] [client 146.190.160.27:60471] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaHtpL_i6nvKNhjFW7WeKgAAAQ0"]
[Sat Feb 28 03:16:52.689161 2026] [:error] [pid 19669:tid 19690] [client 146.190.160.27:61300] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaHtpEy98E5mX0pQrMpItQAAAZI"]
[Sat Feb 28 03:16:53.100933 2026] [:error] [pid 38586:tid 38598] [client 146.190.160.27:62321] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaHtpb_i6nvKNhjFW7WeLwAAAQk"]
[Sat Feb 28 04:25:44.246843 2026] [:error] [pid 11791:tid 11802] [client 20.53.240.38:3344] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Feb 28 04:25:44.264937 2026] [:error] [pid 11791:tid 11807] [client 20.53.240.38:3344] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Cookie/cloud.php"] [unique_id "aaH9yGuX5e1Q32gqxH1QmAAAAQ4"]
[Sat Feb 28 04:25:44.380466 2026] [:error] [pid 11791:tid 11806] [client 20.53.240.38:24753] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/functions.php"] [unique_id "aaH9yGuX5e1Q32gqxH1QpAAAAQ0"]
[Sat Feb 28 04:25:44.499963 2026] [:error] [pid 11791:tid 11807] [client 20.53.240.38:23206] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 28 04:25:44.533428 2026] [:error] [pid 11791:tid 11797] [client 20.53.240.38:23206] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/flower.php"] [unique_id "aaH9yGuX5e1Q32gqxH1QqQAAAQQ"]
[Sat Feb 28 04:25:44.637093 2026] [:error] [pid 39185:tid 39263] [client 20.53.240.38:8564] File does not exist: /usr/local/apache/htdocs/suspended-page/classsmtps.php
[Sat Feb 28 04:25:44.652157 2026] [:error] [pid 39185:tid 39253] [client 20.53.240.38:8564] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/block-bindings.php"] [unique_id "aaH9yBVE-FfM89u7BQYUbAAAAIc"]
[Sat Feb 28 04:25:44.714785 2026] [:error] [pid 39185:tid 39269] [client 20.53.240.38:22300] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/root.php"] [unique_id "aaH9yBVE-FfM89u7BQYUbQAAAJc"]
[Sat Feb 28 04:25:44.830943 2026] [:error] [pid 39185:tid 39262] [client 20.53.240.38:13388] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/xmrlpc.php
[Sat Feb 28 04:25:44.846019 2026] [:error] [pid 39185:tid 39268] [client 20.53.240.38:13388] [client 20.53.240.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/index.php"] [unique_id "aaH9yBVE-FfM89u7BQYUbwAAAJY"]
[Sat Feb 28 04:25:44.907053 2026] [:error] [pid 11791:tid 11806] [client 20.53.240.38:8525] [client 20.53.240.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaH9yGuX5e1Q32gqxH1QrQAAAQ0"]
[Sat Feb 28 04:25:44.969585 2026] [:error] [pid 39185:tid 39264] [client 20.53.240.38:4932] [client 20.53.240.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaH9yBVE-FfM89u7BQYUcQAAAJI"]
[Sat Feb 28 04:25:45.061464 2026] [:error] [pid 39292:tid 39296] [client 20.53.240.38:20996] [client 20.53.240.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaH9yaIAO5fN7BxyqcHyAQAAAMI"]
[Sat Feb 28 04:51:46.536955 2026] [:error] [pid 39292:tid 39307] [client 150.107.42.136:59942] [client 150.107.42.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.107.42.136, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaID4qIAO5fN7BxyqcEEpgAAAM0"]
[Sat Feb 28 04:51:46.542399 2026] [:error] [pid 39292:tid 39307] [client 150.107.42.136:59942] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 06:00:21.863884 2026] [:error] [pid 22194:tid 22203] [client 20.220.212.70:39468] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aaIT9X6mbajs3bzQGyvshgAAAUc"]
[Sat Feb 28 06:00:22.695428 2026] [:error] [pid 22194:tid 22202] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Feb 28 06:00:22.904307 2026] [:error] [pid 22194:tid 22204] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 28 06:00:23.113917 2026] [:error] [pid 22194:tid 22212] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 28 06:00:23.322663 2026] [:error] [pid 22194:tid 22208] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 06:00:23.530816 2026] [:error] [pid 22194:tid 22220] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 06:00:23.738899 2026] [:error] [pid 22194:tid 22210] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Feb 28 06:00:24.155814 2026] [:error] [pid 22194:tid 22219] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Feb 28 06:00:24.364730 2026] [:error] [pid 22194:tid 22201] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Feb 28 06:00:24.575077 2026] [:error] [pid 22194:tid 22205] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Feb 28 06:00:24.784011 2026] [:error] [pid 22194:tid 22202] [client 20.220.212.70:39465] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Feb 28 06:00:24.994579 2026] [:error] [pid 22194:tid 22197] [client 20.220.212.70:39465] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaIT-H6mbajs3bzQGyvsmwAAAUE"]
[Sat Feb 28 06:00:25.818951 2026] [:error] [pid 39183:tid 39194] [client 20.220.212.70:39455] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaIT-RCf4HvhVePw3LZmLgAAAAI"]
[Sat Feb 28 06:00:26.657686 2026] [:error] [pid 39184:tid 39241] [client 20.220.212.70:39048] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaIT-ltZF9Zd_U7easAxNwAAAFY"]
[Sat Feb 28 06:00:27.488324 2026] [:error] [pid 39292:tid 39312] [client 20.220.212.70:39478] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaIT-6IAO5fN7BxyqcFKEQAAANI"]
[Sat Feb 28 06:53:55.394078 2026] [:error] [pid 39292:tid 39307] [client 193.36.225.184:64971] [client 193.36.225.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.184, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaIgg6IAO5fN7BxyqcF-sAAAAM0"]
[Sat Feb 28 06:53:55.397998 2026] [:error] [pid 39292:tid 39307] [client 193.36.225.184:64971] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 28 07:48:44.978818 2026] [:error] [pid 22194:tid 22197] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/yo.php
[Sat Feb 28 07:48:45.187862 2026] [:error] [pid 22194:tid 22219] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Feb 28 07:48:45.395487 2026] [:error] [pid 22194:tid 22206] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sat Feb 28 07:48:45.609241 2026] [:error] [pid 22194:tid 22220] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/ba.php
[Sat Feb 28 07:48:45.816573 2026] [:error] [pid 22194:tid 22211] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/ym.php
[Sat Feb 28 07:48:46.023187 2026] [:error] [pid 22194:tid 22210] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sat Feb 28 07:48:46.243113 2026] [:error] [pid 22194:tid 22201] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Sat Feb 28 07:48:46.468424 2026] [:error] [pid 22194:tid 22202] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Feb 28 07:48:46.689355 2026] [:error] [pid 22194:tid 22215] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Sat Feb 28 07:48:46.896335 2026] [:error] [pid 22194:tid 22213] [client 20.220.61.156:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Sat Feb 28 07:48:47.100311 2026] [:error] [pid 22194:tid 22205] [client 20.220.61.156:13273] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aaItX36mbajs3bzQGys4HAAAAUk"]
[Sat Feb 28 07:48:47.691443 2026] [:error] [pid 39185:tid 39269] [client 20.220.61.156:13307] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aaItXxVE-FfM89u7BQZrKgAAAJc"]
[Sat Feb 28 07:48:48.619632 2026] [:error] [pid 22194:tid 22198] [client 20.220.61.156:13256] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aaItYH6mbajs3bzQGys4IQAAAUI"]
[Sat Feb 28 07:48:49.219244 2026] [:error] [pid 39185:tid 39265] [client 20.220.61.156:13274] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "aaItYRVE-FfM89u7BQZrLwAAAJM"]
[Sat Feb 28 07:48:50.059291 2026] [:error] [pid 11791:tid 11809] [client 20.220.61.156:13268] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaItYmuX5e1Q32gqxH3SxwAAARA"]
[Sat Feb 28 07:48:50.888886 2026] [:error] [pid 39292:tid 39302] [client 20.220.61.156:13266] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaItYqIAO5fN7BxyqcG40QAAAMg"]
[Sat Feb 28 07:48:52.506014 2026] [:error] [pid 11791:tid 11794] [client 20.220.61.156:13276] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaItZGuX5e1Q32gqxH3S1AAAAQE"]
[Sat Feb 28 07:48:55.070915 2026] [:error] [pid 22194:tid 22220] [client 20.220.61.156:13255] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaItZ36mbajs3bzQGys4LgAAAVg"]
[Sat Feb 28 07:48:56.682682 2026] [:error] [pid 22194:tid 22215] [client 20.220.61.156:13194] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaItaH6mbajs3bzQGys4OwAAAVM"]
[Sat Feb 28 07:48:57.956726 2026] [:error] [pid 39183:tid 39214] [client 20.220.61.156:13267] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaItaRCf4HvhVePw3LaBVgAAABY"]
[Sat Feb 28 07:48:59.929549 2026] [:error] [pid 11791:tid 11817] [client 20.220.61.156:13197] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaIta2uX5e1Q32gqxH3S5AAAARg"]
[Sat Feb 28 07:49:02.926016 2026] [:error] [pid 39292:tid 39313] [client 20.220.61.156:13310] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaItbqIAO5fN7BxyqcG49QAAANM"]
[Sat Feb 28 07:49:04.470695 2026] [:error] [pid 39292:tid 39302] [client 20.220.61.156:13280] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaItcKIAO5fN7BxyqcG5BwAAAMg"]
[Sat Feb 28 07:49:05.892826 2026] [:error] [pid 39292:tid 39308] [client 20.220.61.156:13191] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaItcaIAO5fN7BxyqcG5GAAAAM4"]
[Sat Feb 28 07:49:07.135330 2026] [:error] [pid 39292:tid 39310] [client 20.220.61.156:13272] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaItc6IAO5fN7BxyqcG5JwAAANA"]
[Sat Feb 28 07:49:08.742004 2026] [:error] [pid 39292:tid 39298] [client 20.220.61.156:13248] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaItdKIAO5fN7BxyqcG5MgAAAMQ"]
[Sat Feb 28 07:49:09.504897 2026] [:error] [pid 39292:tid 39308] [client 20.220.61.156:13285] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaItdaIAO5fN7BxyqcG5PAAAAM4"]
[Sat Feb 28 07:49:10.855480 2026] [:error] [pid 22194:tid 22220] [client 20.220.61.156:13274] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaItdn6mbajs3bzQGys4agAAAVg"]
[Sat Feb 28 07:49:11.848451 2026] [:error] [pid 11791:tid 11809] [client 20.220.61.156:13190] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaItd2uX5e1Q32gqxH3TBgAAARA"]
[Sat Feb 28 07:49:14.029652 2026] [:error] [pid 22194:tid 22220] [client 20.220.61.156:13296] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaIten6mbajs3bzQGys4eAAAAVg"]
[Sat Feb 28 07:49:16.428078 2026] [:error] [pid 11791:tid 11816] [client 20.220.61.156:13301] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaItfGuX5e1Q32gqxH3THgAAARc"]
[Sat Feb 28 07:49:18.314487 2026] [:error] [pid 11791:tid 11807] [client 20.220.61.156:13289] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaItfmuX5e1Q32gqxH3TIQAAAQ4"]
[Sat Feb 28 07:49:19.275506 2026] [:error] [pid 39184:tid 39229] [client 20.220.61.156:13121] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaItf1tZF9Zd_U7easBT0gAAAEo"]
[Sat Feb 28 07:49:20.295481 2026] [:error] [pid 22194:tid 22209] [client 20.220.61.156:13277] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaItgH6mbajs3bzQGys4hAAAAU0"]
[Sat Feb 28 07:49:21.189726 2026] [:error] [pid 39184:tid 39222] [client 20.220.61.156:13204] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaItgVtZF9Zd_U7easBT2AAAAEM"]
[Sat Feb 28 07:49:22.355279 2026] [:error] [pid 39183:tid 39193] [client 20.220.61.156:13253] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaItghCf4HvhVePw3LaBawAAAAE"]
[Sat Feb 28 07:49:23.157308 2026] [:error] [pid 39292:tid 39309] [client 20.220.61.156:13131] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaItg6IAO5fN7BxyqcG5YQAAAM8"]
[Sat Feb 28 07:49:24.024601 2026] [:error] [pid 39292:tid 39300] [client 20.220.61.156:13250] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaIthKIAO5fN7BxyqcG5aAAAAMY"]
[Sat Feb 28 07:49:25.246721 2026] [:error] [pid 22194:tid 22212] [client 20.220.61.156:13282] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaIthX6mbajs3bzQGys4lAAAAVA"]
[Sat Feb 28 07:49:26.095194 2026] [:error] [pid 22194:tid 22215] [client 20.220.61.156:13212] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaIthn6mbajs3bzQGys4mgAAAVM"]
[Sat Feb 28 07:49:26.801406 2026] [:error] [pid 22194:tid 22196] [client 20.220.61.156:13311] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaIthn6mbajs3bzQGys4ngAAAUA"]
[Sat Feb 28 07:49:27.435036 2026] [:error] [pid 22194:tid 22218] [client 20.220.61.156:13297] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaIth36mbajs3bzQGys4owAAAVY"]
[Sat Feb 28 07:49:28.388274 2026] [:error] [pid 39184:tid 39243] [client 20.220.61.156:13304] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaItiFtZF9Zd_U7easBT4QAAAFg"]
[Sat Feb 28 07:49:28.924966 2026] [:error] [pid 39184:tid 39224] [client 20.220.61.156:13258] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaItiFtZF9Zd_U7easBT5AAAAEU"]
[Sat Feb 28 07:49:29.632910 2026] [:error] [pid 22194:tid 22211] [client 20.220.61.156:13184] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaItiX6mbajs3bzQGys4qgAAAU8"]
[Sat Feb 28 07:49:30.114289 2026] [:error] [pid 22194:tid 22204] [client 20.220.61.156:13298] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaItin6mbajs3bzQGys4rAAAAUg"]
[Sat Feb 28 07:49:30.713786 2026] [:error] [pid 39183:tid 39206] [client 20.220.61.156:13259] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaItihCf4HvhVePw3LaBfQAAAA4"]
[Sat Feb 28 07:49:31.694236 2026] [:error] [pid 39183:tid 39197] [client 20.220.61.156:13219] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaItixCf4HvhVePw3LaBgAAAAAU"]
[Sat Feb 28 07:49:32.805907 2026] [:error] [pid 11791:tid 11811] [client 20.220.61.156:13265] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaItjGuX5e1Q32gqxH3TPwAAARI"]
[Sat Feb 28 07:49:33.646140 2026] [:error] [pid 39184:tid 39235] [client 20.220.61.156:13263] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaItjVtZF9Zd_U7easBT-AAAAFA"]
[Sat Feb 28 07:49:34.361485 2026] [:error] [pid 11791:tid 11806] [client 20.220.61.156:13270] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaItjmuX5e1Q32gqxH3TRAAAAQ0"]
[Sat Feb 28 07:49:35.276799 2026] [:error] [pid 11791:tid 11794] [client 20.220.61.156:13206] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaItj2uX5e1Q32gqxH3TSAAAAQE"]
[Sat Feb 28 07:49:36.108482 2026] [:error] [pid 11791:tid 11804] [client 20.220.61.156:13275] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaItkGuX5e1Q32gqxH3TSgAAAQs"]
[Sat Feb 28 07:49:37.041696 2026] [:error] [pid 11791:tid 11805] [client 20.220.61.156:13290] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaItkWuX5e1Q32gqxH3TTwAAAQw"]
[Sat Feb 28 07:49:38.019868 2026] [:error] [pid 39292:tid 39300] [client 20.220.61.156:13225] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaItkqIAO5fN7BxyqcG5mAAAAMY"]
[Sat Feb 28 07:49:39.362885 2026] [:error] [pid 22194:tid 22201] [client 20.220.61.156:13133] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaItk36mbajs3bzQGys48QAAAUU"]
[Sat Feb 28 07:49:40.103211 2026] [:error] [pid 39185:tid 39254] [client 20.220.61.156:13306] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaItlBVE-FfM89u7BQZrZAAAAIg"]
[Sat Feb 28 07:49:41.207579 2026] [:error] [pid 11791:tid 11804] [client 20.220.61.156:13205] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaItlWuX5e1Q32gqxH3TWwAAAQs"]
[Sat Feb 28 07:49:42.617772 2026] [:error] [pid 11791:tid 11808] [client 20.220.61.156:13291] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f7.php"] [unique_id "aaItlmuX5e1Q32gqxH3TZgAAAQ8"]
[Sat Feb 28 07:49:43.526010 2026] [:error] [pid 39184:tid 39229] [client 20.220.61.156:13213] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f7.php"] [unique_id "aaItl1tZF9Zd_U7easBUCAAAAEo"]
[Sat Feb 28 07:49:44.617943 2026] [:error] [pid 39292:tid 39302] [client 20.220.61.156:13309] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f7.php"] [unique_id "aaItmKIAO5fN7BxyqcG5rgAAAMg"]
[Sat Feb 28 07:49:46.924351 2026] [:error] [pid 39292:tid 39300] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/f7.php
[Sat Feb 28 07:49:47.134541 2026] [:error] [pid 39292:tid 39308] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/an7.php
[Sat Feb 28 07:49:47.345536 2026] [:error] [pid 39292:tid 39295] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/byp7.php
[Sat Feb 28 07:49:47.578984 2026] [:error] [pid 39292:tid 39318] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/C1.php
[Sat Feb 28 07:49:48.191775 2026] [:error] [pid 39292:tid 39312] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/clcdu.php
[Sat Feb 28 07:49:48.486363 2026] [:error] [pid 39292:tid 39294] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/ffbsq.php
[Sat Feb 28 07:49:48.708977 2026] [:error] [pid 39292:tid 39298] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/resp.php
[Sat Feb 28 07:49:48.918362 2026] [:error] [pid 39292:tid 39296] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sat Feb 28 07:49:49.156618 2026] [:error] [pid 39292:tid 39311] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sat Feb 28 07:49:49.366642 2026] [:error] [pid 39292:tid 39314] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/kma.php
[Sat Feb 28 07:49:49.576246 2026] [:error] [pid 39292:tid 39309] [client 20.220.61.156:13189] File does not exist: /usr/local/apache/htdocs/suspended-page/wpls.php
[Sat Feb 28 07:49:49.782711 2026] [:error] [pid 39292:tid 39302] [client 20.220.61.156:13189] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaItnaIAO5fN7BxyqcG5zQAAAMg"]
[Sat Feb 28 07:49:51.005197 2026] [:error] [pid 11791:tid 11816] [client 20.220.61.156:13207] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaItn2uX5e1Q32gqxH3TeAAAARc"]
[Sat Feb 28 07:49:52.263601 2026] [:error] [pid 39292:tid 39299] [client 20.220.61.156:13243] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaItoKIAO5fN7BxyqcG53QAAAMU"]
[Sat Feb 28 07:49:56.700736 2026] [:error] [pid 39292:tid 39305] [client 20.220.61.156:13308] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaItpKIAO5fN7BxyqcG58wAAAMs"]
[Sat Feb 28 07:49:59.458123 2026] [:error] [pid 11791:tid 11813] [client 20.220.61.156:13192] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaItp2uX5e1Q32gqxH3ThwAAARQ"]
[Sat Feb 28 07:50:03.339931 2026] [:error] [pid 39183:tid 39204] [client 20.220.61.156:13229] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaItqxCf4HvhVePw3LaBpAAAAAw"]
[Sat Feb 28 07:50:06.483526 2026] [:error] [pid 39292:tid 39308] [client 20.220.61.156:13199] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaItrqIAO5fN7BxyqcG6LQAAAM4"]
[Sat Feb 28 07:50:08.012837 2026] [:error] [pid 39185:tid 39247] [client 20.220.61.156:13185] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaItsBVE-FfM89u7BQZrkgAAAIE"]
[Sat Feb 28 07:50:10.028663 2026] [:error] [pid 22194:tid 22211] [client 20.220.61.156:13260] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaItsn6mbajs3bzQGys5WgAAAU8"]
[Sat Feb 28 07:50:12.041963 2026] [:error] [pid 39184:tid 39225] [client 20.220.61.156:13127] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaIttFtZF9Zd_U7easBUIAAAAEY"]
[Sat Feb 28 07:50:14.075303 2026] [:error] [pid 22194:tid 22207] [client 20.220.61.156:13070] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaIttn6mbajs3bzQGys5YAAAAUs"]
[Sat Feb 28 07:50:14.594020 2026] [:error] [pid 22194:tid 22215] [client 20.220.61.156:13157] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaIttn6mbajs3bzQGys5ZAAAAVM"]
[Sat Feb 28 07:50:15.525086 2026] [:error] [pid 11791:tid 11816] [client 20.220.61.156:13187] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaItt2uX5e1Q32gqxH3TlwAAARc"]
[Sat Feb 28 07:50:16.873083 2026] [:error] [pid 11791:tid 11814] [client 20.220.61.156:13293] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaItuGuX5e1Q32gqxH3TmwAAARU"]
[Sat Feb 28 07:50:18.030563 2026] [:error] [pid 22194:tid 22196] [client 20.220.61.156:13135] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaItun6mbajs3bzQGys5dgAAAUA"]
[Sat Feb 28 07:50:19.560140 2026] [:error] [pid 39184:tid 39242] [client 20.220.61.156:13141] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaItu1tZF9Zd_U7easBUJwAAAFc"]
[Sat Feb 28 07:50:21.305792 2026] [:error] [pid 39292:tid 39309] [client 20.220.61.156:13200] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaItvaIAO5fN7BxyqcG6bwAAAM8"]
[Sat Feb 28 07:50:22.598541 2026] [:error] [pid 39185:tid 39248] [client 20.220.61.156:13279] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaItvhVE-FfM89u7BQZrowAAAII"]
[Sat Feb 28 07:50:23.644828 2026] [:error] [pid 22194:tid 22208] [client 20.220.61.156:13244] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaItv36mbajs3bzQGys5jQAAAUw"]
[Sat Feb 28 07:50:24.699756 2026] [:error] [pid 39292:tid 39301] [client 20.220.61.156:13156] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaItwKIAO5fN7BxyqcG6fgAAAMc"]
[Sat Feb 28 07:50:25.423603 2026] [:error] [pid 39184:tid 39225] [client 20.220.61.156:13286] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaItwVtZF9Zd_U7easBUNQAAAEY"]
[Sat Feb 28 07:50:26.093774 2026] [:error] [pid 39184:tid 39220] [client 20.220.61.156:13195] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaItwltZF9Zd_U7easBUNwAAAEE"]
[Sat Feb 28 07:50:27.558259 2026] [:error] [pid 39184:tid 39226] [client 20.220.61.156:13262] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaItw1tZF9Zd_U7easBUQgAAAEc"]
[Sat Feb 28 07:50:29.642404 2026] [:error] [pid 22194:tid 22203] [client 20.220.61.156:13233] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaItxX6mbajs3bzQGys5owAAAUc"]
[Sat Feb 28 07:50:33.368849 2026] [:error] [pid 39292:tid 39294] [client 20.220.61.156:13254] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaItyaIAO5fN7BxyqcG6nAAAAMA"]
[Sat Feb 28 07:50:36.504559 2026] [:error] [pid 39292:tid 39304] [client 20.220.61.156:13123] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaItzKIAO5fN7BxyqcG6qgAAAMo"]
[Sat Feb 28 07:50:38.987434 2026] [:error] [pid 11791:tid 11798] [client 20.220.61.156:13269] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaItzmuX5e1Q32gqxH3TygAAAQU"]
[Sat Feb 28 07:50:43.020785 2026] [:error] [pid 39183:tid 39195] [client 20.220.61.156:13245] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaIt0xCf4HvhVePw3LaB3AAAAAM"]
[Sat Feb 28 07:50:45.915244 2026] [:error] [pid 39183:tid 39206] [client 20.220.61.156:13218] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaIt1RCf4HvhVePw3LaB3wAAAA4"]
[Sat Feb 28 07:50:48.904163 2026] [:error] [pid 22194:tid 22205] [client 20.220.61.156:13271] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaIt2H6mbajs3bzQGys51wAAAUk"]
[Sat Feb 28 07:50:50.705059 2026] [:error] [pid 39292:tid 39312] [client 20.220.61.156:13303] File does not exist: /usr/local/apache/htdocs/suspended-page/re.php
[Sat Feb 28 08:27:21.563831 2026] [:error] [pid 39185:tid 39250] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Feb 28 08:27:22.002171 2026] [:error] [pid 39185:tid 39246] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 28 08:27:22.441210 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Feb 28 08:27:22.890562 2026] [:error] [pid 39185:tid 39255] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Feb 28 08:27:23.329269 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 28 08:27:23.776532 2026] [:error] [pid 39185:tid 39246] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Feb 28 08:27:24.217039 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 28 08:27:24.681190 2026] [:error] [pid 39185:tid 39266] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 08:27:25.561895 2026] [:error] [pid 39185:tid 39256] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Feb 28 08:27:26.439546 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Feb 28 08:27:26.907014 2026] [:error] [pid 39185:tid 39252] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Feb 28 08:27:27.394687 2026] [:error] [pid 39185:tid 39258] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 28 08:27:27.832296 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.20:58409] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Feb 28 08:27:28.266600 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.20:58409] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaI2cBVE-FfM89u7BQZ86wAAAIM"]
[Sat Feb 28 08:27:29.150289 2026] [:error] [pid 39185:tid 39252] [client 173.244.55.23:44309] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Feb 28 08:27:29.592377 2026] [:error] [pid 39185:tid 39257] [client 173.244.55.23:44309] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Feb 28 08:27:30.047936 2026] [:error] [pid 39185:tid 39253] [client 173.244.55.23:44309] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Feb 28 08:27:30.495243 2026] [:error] [pid 39185:tid 39257] [client 173.244.55.23:44309] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Feb 28 08:27:30.970338 2026] [:error] [pid 39185:tid 39269] [client 173.244.55.23:44309] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 28 08:27:37.337181 2026] [:error] [pid 39185:tid 39260] [client 173.244.55.23:44309] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaI2eRVE-FfM89u7BQZ9gwAAAI4"]
[Sat Feb 28 08:27:39.727946 2026] [:error] [pid 11791:tid 11802] [client 173.244.55.26:21859] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaI2e2uX5e1Q32gqxH3rUQAAAQk"]
[Sat Feb 28 08:27:41.972906 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.22:51083] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Feb 28 08:27:43.353136 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.22:51083] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaI2f6IAO5fN7BxyqcHtXgAAAMw"]
[Sat Feb 28 08:27:45.216642 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.31:32807] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 28 08:27:45.675286 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.31:32807] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaI2gaIAO5fN7BxyqcHtowAAAMo"]
[Sat Feb 28 08:27:46.593567 2026] [:error] [pid 39183:tid 39208] [client 173.244.55.28:61185] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/item.php"] [unique_id "aaI2ghCf4HvhVePw3LaK9wAAABA"]
[Sat Feb 28 08:27:48.013106 2026] [:error] [pid 22194:tid 22198] [client 173.244.55.31:40773] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Feb 28 08:27:50.386900 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.31:40773] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaI2hn6mbajs3bzQGytdLwAAAUQ"]
[Sat Feb 28 08:27:51.772140 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.30:22073] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaI2h6IAO5fN7BxyqcHuAwAAAM4"]
[Sat Feb 28 08:27:52.703622 2026] [:error] [pid 11791:tid 11802] [client 173.244.55.31:49141] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaI2iGuX5e1Q32gqxH3ryAAAAQk"]
[Sat Feb 28 08:27:53.654658 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.21:48113] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaI2iWuX5e1Q32gqxH3r1wAAARQ"]
[Sat Feb 28 08:27:54.594641 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.25:30537] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaI2iqIAO5fN7BxyqcHuIgAAAMQ"]
[Sat Feb 28 08:27:55.545623 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.20:48483] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaI2ixVE-FfM89u7BQZ-JgAAAII"]
[Sat Feb 28 08:27:56.899006 2026] [:error] [pid 22194:tid 22212] [client 173.244.55.26:51667] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaI2jH6mbajs3bzQGytdeAAAAVA"]
[Sat Feb 28 08:27:57.825934 2026] [:error] [pid 39185:tid 39246] [client 173.244.55.30:49191] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Feb 28 08:27:58.797894 2026] [:error] [pid 39185:tid 39269] [client 173.244.55.30:49191] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aaI2jhVE-FfM89u7BQZ-SwAAAJc"]
[Sat Feb 28 08:28:00.589451 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.20:60753] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaI2kFtZF9Zd_U7easBh9gAAAEo"]
[Sat Feb 28 08:28:01.930567 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.28:24009] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaI2kaIAO5fN7BxyqcHujAAAAMg"]
[Sat Feb 28 08:28:02.818570 2026] [:error] [pid 11791:tid 11800] [client 173.244.55.29:42785] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Feb 28 08:28:03.259152 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.29:42785] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaI2k2uX5e1Q32gqxH3sOQAAAQA"]
[Sat Feb 28 08:28:04.159569 2026] [:error] [pid 11791:tid 11794] [client 173.244.55.23:39063] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Feb 28 08:28:05.492628 2026] [:error] [pid 11791:tid 11803] [client 173.244.55.23:39063] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Feb 28 08:28:06.845039 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.23:39063] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaI2lmuX5e1Q32gqxH3sbAAAARQ"]
[Sat Feb 28 08:28:07.740196 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.28:46981] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-l0gin.php"] [unique_id "aaI2lxVE-FfM89u7BQZ-twAAAIM"]
[Sat Feb 28 08:28:08.661208 2026] [:error] [pid 39185:tid 39255] [client 173.244.55.26:61745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sat Feb 28 08:28:09.103899 2026] [:error] [pid 39185:tid 39250] [client 173.244.55.26:61745] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaI2mRVE-FfM89u7BQZ-ywAAAIQ"]
[Sat Feb 28 08:28:10.023882 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.22:25929] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Feb 28 08:28:10.950406 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.22:25929] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaI2mqIAO5fN7BxyqcHvOgAAAM4"]
[Sat Feb 28 08:28:12.321590 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.20:54853] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaI2nH6mbajs3bzQGyteSQAAAU8"]
[Sat Feb 28 08:28:13.667988 2026] [:error] [pid 11791:tid 11800] [client 173.244.55.29:62035] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sat Feb 28 08:28:14.109917 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.29:62035] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Feb 28 08:28:15.035854 2026] [:error] [pid 11791:tid 11795] [client 173.244.55.29:62035] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaI2n2uX5e1Q32gqxH3suAAAAQI"]
[Sat Feb 28 08:28:16.417109 2026] [:error] [pid 39185:tid 39264] [client 173.244.55.22:25321] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaI2oBVE-FfM89u7BQZ_AQAAAJI"]
[Sat Feb 28 08:28:17.869296 2026] [:error] [pid 11791:tid 11799] [client 173.244.55.29:64341] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaI2oWuX5e1Q32gqxH3sywAAAQY"]
[Sat Feb 28 08:28:18.750337 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.23:64793] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaI2on6mbajs3bzQGytelgAAAUY"]
[Sat Feb 28 08:28:19.640211 2026] [:error] [pid 39292:tid 39318] [client 173.244.55.26:64205] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaI2o6IAO5fN7BxyqcHv3AAAANg"]
[Sat Feb 28 08:28:21.436811 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.25:61609] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sat Feb 28 08:28:21.875554 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.25:61609] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaI2pWuX5e1Q32gqxH3s_QAAAQA"]
[Sat Feb 28 08:28:22.755656 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.30:31397] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaI2pn6mbajs3bzQGyteuAAAAVE"]
[Sat Feb 28 08:28:23.646466 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.29:33417] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaI2p6IAO5fN7BxyqcHwKwAAANQ"]
[Sat Feb 28 08:28:25.453559 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.30:24651] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sat Feb 28 08:28:27.964208 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.30:24651] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Feb 28 08:28:29.731633 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.30:24651] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaI2rX6mbajs3bzQGytfJgAAAUM"]
[Sat Feb 28 08:28:31.981115 2026] [:error] [pid 11791:tid 11801] [client 173.244.55.22:36997] [client 173.244.55.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.22, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaI2r2uX5e1Q32gqxH3tcAAAAQg"]
[Sat Feb 28 08:28:32.424674 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.22:36997] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Feb 28 08:28:34.680024 2026] [:error] [pid 11791:tid 11800] [client 173.244.55.22:36997] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaI2smuX5e1Q32gqxH3tmgAAAQc"]
[Sat Feb 28 08:28:35.565960 2026] [:error] [pid 22194:tid 22210] [client 173.244.55.29:50929] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaI2s36mbajs3bzQGytfdAAAAU4"]
[Sat Feb 28 08:28:36.453858 2026] [:error] [pid 39183:tid 39198] [client 173.244.55.25:21855] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaI2tBCf4HvhVePw3LaLogAAAAY"]
[Sat Feb 28 08:28:37.348538 2026] [:error] [pid 39185:tid 39270] [client 173.244.55.28:34535] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sat Feb 28 08:28:37.839131 2026] [:error] [pid 39185:tid 39252] [client 173.244.55.28:34535] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Feb 28 08:28:40.097134 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.28:34535] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaI2uBVE-FfM89u7BQZ_qwAAAJY"]
[Sat Feb 28 08:28:41.467101 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.20:61879] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sat Feb 28 08:28:41.917340 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.20:61879] [client 173.244.55.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.20, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaI2uaIAO5fN7BxyqcHxYwAAAMk"]
[Sat Feb 28 08:28:42.814119 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.20:61879] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aaI2uqIAO5fN7BxyqcHxdgAAAMk"]
[Sat Feb 28 08:28:45.476674 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.29:42321] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Feb 28 08:28:46.379998 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.29:42321] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sat Feb 28 08:28:47.262429 2026] [:error] [pid 22194:tid 22209] [client 173.244.55.29:42321] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaI2v36mbajs3bzQGytgCgAAAU0"]
[Sat Feb 28 08:28:48.147616 2026] [:error] [pid 11791:tid 11807] [client 173.244.55.28:26279] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Feb 28 08:28:49.498404 2026] [:error] [pid 11791:tid 11800] [client 173.244.55.28:26279] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sat Feb 28 08:28:50.413889 2026] [:error] [pid 11791:tid 11801] [client 173.244.55.28:26279] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sat Feb 28 08:28:51.305158 2026] [:error] [pid 11791:tid 11811] [client 173.244.55.28:26279] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Feb 28 08:28:51.747001 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.28:26279] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaI2w2uX5e1Q32gqxH3uRAAAARQ"]
[Sat Feb 28 08:28:52.634052 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.21:47795] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Feb 28 08:28:53.076749 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.21:47795] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Feb 28 08:28:53.535408 2026] [:error] [pid 22194:tid 22217] [client 173.244.55.21:47795] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaI2xX6mbajs3bzQGytgkAAAAVU"]
[Sat Feb 28 08:28:54.869190 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.23:51965] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sat Feb 28 08:28:55.750025 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.23:51965] [client 173.244.55.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.23, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaI2x6IAO5fN7BxyqcHyVAAAAM0"]
[Sat Feb 28 08:28:56.190133 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.23:51965] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaI2yKIAO5fN7BxyqcHyWwAAAMQ"]
[Sat Feb 28 08:29:01.064571 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.26:62159] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "aaI2zaIAO5fN7BxyqcHyugAAAM4"]
[Sat Feb 28 08:29:02.424544 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.25:22391] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sat Feb 28 08:29:05.294114 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.25:22391] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Feb 28 08:29:05.736853 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.25:22391] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaI20aIAO5fN7BxyqcHzDgAAANY"]
[Sat Feb 28 08:29:06.654650 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.28:41651] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Feb 28 08:29:07.548511 2026] [:error] [pid 39292:tid 39313] [client 173.244.55.28:41651] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aaI206IAO5fN7BxyqcHzPAAAANM"]
[Sat Feb 28 08:29:08.868929 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.20:64119] [client 173.244.55.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.20, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaI21H6mbajs3bzQGythOgAAAU8"]
[Sat Feb 28 08:29:09.319455 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.20:64119] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Feb 28 08:29:09.764264 2026] [:error] [pid 22194:tid 22196] [client 173.244.55.20:64119] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sat Feb 28 08:29:10.264602 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.20:64119] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-themes.php"] [unique_id "aaI21n6mbajs3bzQGythUQAAAVY"]
[Sat Feb 28 08:29:11.155652 2026] [:error] [pid 39184:tid 39219] [client 173.244.55.28:28665] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sat Feb 28 08:29:11.595014 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.28:28665] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaI211tZF9Zd_U7easBj7QAAAEo"]
[Sat Feb 28 08:29:12.486435 2026] [:error] [pid 11791:tid 11810] [client 173.244.55.28:31541] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaI22GuX5e1Q32gqxH3vGwAAARE"]
[Sat Feb 28 08:29:13.488553 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.25:36603] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sat Feb 28 08:29:13.922401 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.25:36603] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aaI22aIAO5fN7BxyqcHzuAAAANY"]
[Sat Feb 28 08:29:15.326620 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.23:64725] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Feb 28 08:29:15.769377 2026] [:error] [pid 39292:tid 39305] [client 173.244.55.23:64725] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaI226IAO5fN7BxyqcHz-gAAAMs"]
[Sat Feb 28 08:29:17.088296 2026] [:error] [pid 39185:tid 39246] [client 173.244.55.31:43339] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/index22.php"] [unique_id "aaI23RVE-FfM89u7BQaAoQAAAIA"]
[Sat Feb 28 08:29:18.424743 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.26:55341] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sat Feb 28 08:29:18.863365 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.26:55341] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaI23qIAO5fN7BxyqcH0QgAAAMQ"]
[Sat Feb 28 08:29:19.739403 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.29:25361] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaI236IAO5fN7BxyqcH0YAAAANE"]
[Sat Feb 28 08:29:20.631330 2026] [:error] [pid 39292:tid 39312] [client 173.244.55.20:39237] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Feb 28 08:29:21.072180 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.20:39237] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sat Feb 28 08:29:22.859207 2026] [:error] [pid 39292:tid 39317] [client 173.244.55.20:39237] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaI24qIAO5fN7BxyqcH0yAAAANc"]
[Sat Feb 28 08:29:23.762797 2026] [:error] [pid 39183:tid 39211] [client 173.244.55.21:36091] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "aaI24xCf4HvhVePw3LaMtwAAABM"]
[Sat Feb 28 08:29:25.150020 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.28:55135] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaI25RVE-FfM89u7BQaAwAAAAJY"]
[Sat Feb 28 08:29:27.401053 2026] [:error] [pid 39185:tid 39256] [client 173.244.55.21:27109] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aaI25xVE-FfM89u7BQaAzAAAAIo"]
[Sat Feb 28 08:29:28.283649 2026] [:error] [pid 39292:tid 39305] [client 173.244.55.30:37315] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sat Feb 28 08:29:29.167440 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.30:37315] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sat Feb 28 08:29:29.614730 2026] [:error] [pid 39292:tid 39297] [client 173.244.55.30:37315] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaI26aIAO5fN7BxyqcH1MAAAAMM"]
[Sat Feb 28 08:29:30.505279 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.25:56111] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Feb 28 08:29:30.992283 2026] [:error] [pid 11791:tid 11815] [client 173.244.55.25:56111] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/admin.php"] [unique_id "aaI26muX5e1Q32gqxH3wDAAAARY"]
[Sat Feb 28 08:29:32.388209 2026] [:error] [pid 22194:tid 22196] [client 173.244.55.28:25345] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aaI27H6mbajs3bzQGytiZQAAAUA"]
[Sat Feb 28 08:29:33.747747 2026] [:error] [pid 39183:tid 39213] [client 173.244.55.23:35009] [client 173.244.55.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "aaI27RCf4HvhVePw3LaM6wAAABU"]
[Sat Feb 28 08:29:35.571825 2026] [:error] [pid 39184:tid 39228] [client 173.244.55.28:33363] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaI271tZF9Zd_U7easBkYAAAAEk"]
[Sat Feb 28 08:29:36.490831 2026] [:error] [pid 39183:tid 39197] [client 173.244.55.28:29035] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aaI28BCf4HvhVePw3LaNDAAAAAU"]
[Sat Feb 28 08:29:37.818840 2026] [:error] [pid 39185:tid 39265] [client 173.244.55.20:35697] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Feb 28 08:29:38.274897 2026] [:error] [pid 39185:tid 39256] [client 173.244.55.20:35697] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/WordPressCore/index.php"] [unique_id "aaI28hVE-FfM89u7BQaBJQAAAIo"]
[Sat Feb 28 08:29:40.953483 2026] [:error] [pid 39292:tid 39296] [client 173.244.55.21:49031] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sat Feb 28 08:29:41.857403 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.21:49031] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Feb 28 08:29:42.300120 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.21:49031] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaI29qIAO5fN7BxyqcH2HwAAAMo"]
[Sat Feb 28 08:29:43.185446 2026] [:error] [pid 39183:tid 39194] [client 173.244.55.21:41839] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaI29xCf4HvhVePw3LaNUwAAAAI"]
[Sat Feb 28 08:29:44.061000 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.31:46625] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaI2-H6mbajs3bzQGyti2gAAAVc"]
[Sat Feb 28 08:29:44.948524 2026] [:error] [pid 39184:tid 39232] [client 173.244.55.29:60659] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaI2-FtZF9Zd_U7easBkqwAAAE0"]
[Sat Feb 28 08:29:45.839300 2026] [:error] [pid 39292:tid 39315] [client 173.244.55.25:24675] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sat Feb 28 08:29:46.294321 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.25:24675] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaI2-qIAO5fN7BxyqcH2VwAAAMU"]
[Sat Feb 28 08:29:47.163550 2026] [:error] [pid 39183:tid 39203] [client 173.244.55.30:23573] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaI2-xCf4HvhVePw3LaNZQAAAAs"]
[Sat Feb 28 08:29:48.047683 2026] [:error] [pid 39184:tid 39236] [client 173.244.55.31:20541] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sat Feb 28 08:29:48.481959 2026] [:error] [pid 39184:tid 39240] [client 173.244.55.31:20541] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/as.php"] [unique_id "aaI2_FtZF9Zd_U7easBkwgAAAFU"]
[Sat Feb 28 08:29:49.353012 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.31:36705] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/as.php"] [unique_id "aaI2_WuX5e1Q32gqxH3xAQAAAQA"]
[Sat Feb 28 08:29:50.674729 2026] [:error] [pid 39183:tid 39196] [client 173.244.55.22:29847] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaI2_hCf4HvhVePw3LaNmAAAAAQ"]
[Sat Feb 28 08:29:51.564071 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.31:54381] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaI2_36mbajs3bzQGytjUwAAAVY"]
[Sat Feb 28 08:29:52.467609 2026] [:error] [pid 11791:tid 11803] [client 173.244.55.25:51809] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaI3AGuX5e1Q32gqxH3xIgAAAQo"]
[Sat Feb 28 08:29:53.349046 2026] [:error] [pid 22194:tid 22198] [client 173.244.55.31:38797] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaI3AX6mbajs3bzQGytjdAAAAUI"]
[Sat Feb 28 08:29:54.665190 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.23:26889] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaI3AqIAO5fN7BxyqcH2yQAAAMw"]
[Sat Feb 28 08:29:56.448441 2026] [:error] [pid 39185:tid 39263] [client 173.244.55.21:56963] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaI3BBVE-FfM89u7BQaBuwAAAJE"]
[Sat Feb 28 08:29:57.343473 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.26:26205] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Feb 28 08:29:57.783053 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.26:26205] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaI3BX6mbajs3bzQGytjxAAAAUU"]
[Sat Feb 28 08:29:59.574991 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.31:49807] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sat Feb 28 08:30:00.020008 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.31:49807] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaI3CH6mbajs3bzQGytj3AAAAVI"]
[Sat Feb 28 08:30:01.387669 2026] [:error] [pid 39292:tid 39296] [client 173.244.55.23:63119] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sat Feb 28 08:30:01.836326 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.23:63119] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sat Feb 28 08:30:02.284956 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.23:63119] [client 173.244.55.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/xleet.php"] [unique_id "aaI3CqIAO5fN7BxyqcH3FgAAANQ"]
[Sat Feb 28 08:30:05.007406 2026] [:error] [pid 39292:tid 39301] [client 173.244.55.28:52755] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaI3DaIAO5fN7BxyqcH3PwAAAMc"]
[Sat Feb 28 08:30:06.348990 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.26:63003] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/file.php"] [unique_id "aaI3DqIAO5fN7BxyqcH3WwAAAMo"]
[Sat Feb 28 08:30:08.100961 2026] [:error] [pid 39292:tid 39317] [client 173.244.55.31:60553] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaI3EKIAO5fN7BxyqcH3ewAAANc"]
[Sat Feb 28 08:30:08.988183 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.22:58469] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaI3EFtZF9Zd_U7easBlcwAAAEw"]
[Sat Feb 28 08:30:10.316150 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.23:53285] [client 173.244.55.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/warm.PhP7"] [unique_id "aaI3EqIAO5fN7BxyqcH3qwAAAMo"]
[Sat Feb 28 08:30:12.533629 2026] [:error] [pid 39185:tid 39263] [client 173.244.55.21:47827] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaI3FBVE-FfM89u7BQaCOwAAAJE"]
[Sat Feb 28 08:30:13.428774 2026] [:error] [pid 11791:tid 11807] [client 173.244.55.21:30867] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/ioxi/ioxiworm.php"] [unique_id "aaI3FWuX5e1Q32gqxH3x6wAAAQ4"]
[Sat Feb 28 08:30:14.754928 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.22:35211] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/wp-content/about.php"] [unique_id "aaI3Fn6mbajs3bzQGytkwwAAAUo"]
[Sat Feb 28 08:30:16.089901 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.31:63469] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sat Feb 28 08:30:16.539712 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.31:63469] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sat Feb 28 08:30:16.988971 2026] [:error] [pid 39292:tid 39310] [client 173.244.55.31:63469] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sat Feb 28 08:30:17.441572 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.31:63469] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sat Feb 28 08:30:17.888823 2026] [:error] [pid 39292:tid 39315] [client 173.244.55.31:63469] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aaI3GaIAO5fN7BxyqcH4bQAAANU"]
[Sat Feb 28 08:30:18.767304 2026] [:error] [pid 39292:tid 39305] [client 173.244.55.25:40841] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aaI3GqIAO5fN7BxyqcH4gAAAAMs"]
[Sat Feb 28 08:30:19.650705 2026] [:error] [pid 22194:tid 22217] [client 173.244.55.31:24281] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aaI3G36mbajs3bzQGytk8wAAAVU"]
[Sat Feb 28 08:30:22.334707 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.22:33649] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaI3Hn6mbajs3bzQGytlIwAAAUo"]
[Sat Feb 28 08:30:23.251573 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.26:42031] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaI3H36mbajs3bzQGytlMgAAAUY"]
[Sat Feb 28 08:30:24.130145 2026] [:error] [pid 11791:tid 11809] [client 173.244.55.28:28783] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaI3IGuX5e1Q32gqxH3yjAAAARA"]
[Sat Feb 28 08:30:25.003491 2026] [:error] [pid 11791:tid 11803] [client 173.244.55.28:35653] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaI3IWuX5e1Q32gqxH3ynwAAAQo"]
[Sat Feb 28 08:30:25.890271 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.28:47789] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaI3IWuX5e1Q32gqxH3yqwAAARU"]
[Sat Feb 28 08:30:26.778659 2026] [:error] [pid 22194:tid 22205] [client 173.244.55.30:29311] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaI3In6mbajs3bzQGytlkAAAAUk"]
[Sat Feb 28 08:30:28.101261 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.31:61983] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaI3JKIAO5fN7BxyqcH4_wAAAMw"]
[Sat Feb 28 08:30:28.983038 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.26:34489] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaI3JH6mbajs3bzQGytlugAAAUQ"]
[Sat Feb 28 08:30:29.869683 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.28:26055] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaI3JaIAO5fN7BxyqcH5IQAAAMk"]
[Sat Feb 28 08:30:30.751246 2026] [:error] [pid 39185:tid 39265] [client 173.244.55.28:54813] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaI3JhVE-FfM89u7BQaCrAAAAJM"]
[Sat Feb 28 08:30:32.099473 2026] [:error] [pid 39292:tid 39312] [client 173.244.55.23:28851] [client 173.244.55.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aaI3KKIAO5fN7BxyqcH5WQAAANI"]
[Sat Feb 28 08:30:33.414939 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.26:64425] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaI3KX6mbajs3bzQGytmCAAAAUs"]
[Sat Feb 28 08:30:34.757497 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.30:46251] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaI3KqIAO5fN7BxyqcH5ggAAANQ"]
[Sat Feb 28 08:30:35.643798 2026] [:error] [pid 11791:tid 11807] [client 173.244.55.20:24597] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Feb 28 08:30:36.535168 2026] [:error] [pid 11791:tid 11803] [client 173.244.55.20:24597] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaI3LGuX5e1Q32gqxH3zUAAAAQo"]
[Sat Feb 28 08:30:37.411527 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.22:55085] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog/wp-admin/about.php"] [unique_id "aaI3LRVE-FfM89u7BQaC7AAAAJY"]
[Sat Feb 28 08:30:39.207524 2026] [:error] [pid 39183:tid 39206] [client 173.244.55.28:56031] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaI3LxCf4HvhVePw3LaOeAAAAA4"]
[Sat Feb 28 08:30:40.093876 2026] [:error] [pid 22194:tid 22210] [client 173.244.55.28:32215] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/install.php"] [unique_id "aaI3MH6mbajs3bzQGytmZwAAAU4"]
[Sat Feb 28 08:30:41.901226 2026] [:error] [pid 39184:tid 39238] [client 173.244.55.23:31843] [client 173.244.55.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.api.php"] [unique_id "aaI3MVtZF9Zd_U7easBmIwAAAFM"]
[Sat Feb 28 08:30:42.783615 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.26:39517] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sat Feb 28 08:30:43.226226 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.26:39517] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaI3M36mbajs3bzQGytmpQAAAUY"]
[Sat Feb 28 08:30:44.542643 2026] [:error] [pid 22194:tid 22216] [client 173.244.55.31:47663] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aaI3NH6mbajs3bzQGytmuAAAAVQ"]
[Sat Feb 28 08:30:45.428399 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.31:40717] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "aaI3NaIAO5fN7BxyqcH6HQAAAME"]
[Sat Feb 28 08:30:46.302603 2026] [:error] [pid 39184:tid 39219] [client 173.244.55.26:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sat Feb 28 08:30:46.744616 2026] [:error] [pid 39184:tid 39239] [client 173.244.55.26:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sat Feb 28 08:30:47.183120 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.26:62903] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "aaI3N1tZF9Zd_U7easBmRQAAAEo"]
[Sat Feb 28 08:30:48.070042 2026] [:error] [pid 39183:tid 39204] [client 173.244.55.29:31231] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sat Feb 28 08:30:48.507268 2026] [:error] [pid 39183:tid 39199] [client 173.244.55.29:31231] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaI3OBCf4HvhVePw3LaOywAAAAc"]
[Sat Feb 28 08:30:49.422451 2026] [:error] [pid 11791:tid 11801] [client 173.244.55.26:30459] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Feb 28 08:30:49.859295 2026] [:error] [pid 11791:tid 11794] [client 173.244.55.26:30459] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaI3OWuX5e1Q32gqxH3z0gAAAQE"]
[Sat Feb 28 08:30:50.737556 2026] [:error] [pid 39183:tid 39201] [client 173.244.55.28:27919] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aaI3OhCf4HvhVePw3LaO3AAAAAk"]
[Sat Feb 28 08:30:52.500754 2026] [:error] [pid 11791:tid 11795] [client 173.244.55.30:37753] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 08:30:52.943322 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.30:37753] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Feb 28 08:30:53.387040 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.30:37753] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sat Feb 28 08:30:55.625804 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.30:37753] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aaI3P2uX5e1Q32gqxH30AgAAAQU"]
[Sat Feb 28 08:30:56.540486 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.20:24509] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Feb 28 08:30:56.986135 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.20:24509] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sat Feb 28 08:30:57.891514 2026] [:error] [pid 11791:tid 11806] [client 173.244.55.20:24509] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sat Feb 28 08:30:58.334563 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.20:24509] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaI3QmuX5e1Q32gqxH30JwAAAQM"]
[Sat Feb 28 08:31:00.137309 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.30:26507] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat Feb 28 08:31:00.577891 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.30:26507] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaI3RH6mbajs3bzQGytoJAAAAVY"]
[Sat Feb 28 08:31:01.473252 2026] [:error] [pid 39184:tid 39221] [client 173.244.55.31:40691] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaI3RVtZF9Zd_U7easBmpgAAAEI"]
[Sat Feb 28 08:31:02.362159 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.28:51503] [client 173.244.55.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.28, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaI3RmuX5e1Q32gqxH30XAAAAQA"]
[Sat Feb 28 08:31:02.368483 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.28:51503] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 28 08:31:02.812814 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.28:51503] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sat Feb 28 08:31:03.257897 2026] [:error] [pid 11791:tid 11809] [client 173.244.55.28:51503] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaI3R2uX5e1Q32gqxH30YwAAARA"]
[Sat Feb 28 08:31:04.144508 2026] [:error] [pid 39185:tid 39266] [client 173.244.55.26:24601] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaI3SBVE-FfM89u7BQaDzgAAAJQ"]
[Sat Feb 28 08:31:05.480944 2026] [:error] [pid 39292:tid 39313] [client 173.244.55.28:32799] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Feb 28 08:31:05.924439 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.28:32799] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaI3SaIAO5fN7BxyqcH7LAAAAMA"]
[Sat Feb 28 08:31:06.815683 2026] [:error] [pid 39184:tid 39222] [client 173.244.55.30:52147] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaI3SltZF9Zd_U7easBm6AAAAEM"]
[Sat Feb 28 08:31:08.617515 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.21:23881] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aaI3TKIAO5fN7BxyqcH7UwAAAM0"]
[Sat Feb 28 08:31:09.523211 2026] [:error] [pid 39183:tid 39214] [client 173.244.55.25:56581] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aaI3TRCf4HvhVePw3LaPIAAAABY"]
[Sat Feb 28 08:31:11.334670 2026] [:error] [pid 11791:tid 11815] [client 173.244.55.26:34353] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaI3T2uX5e1Q32gqxH30rAAAARY"]
[Sat Feb 28 08:31:12.224480 2026] [:error] [pid 39183:tid 39209] [client 173.244.55.28:27937] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaI3UBCf4HvhVePw3LaPJAAAABE"]
[Sat Feb 28 08:31:14.434805 2026] [:error] [pid 39183:tid 39192] [client 173.244.55.25:59159] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sat Feb 28 08:31:15.316145 2026] [:error] [pid 39183:tid 39194] [client 173.244.55.25:59159] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaI3UxCf4HvhVePw3LaPOQAAAAI"]
[Sat Feb 28 08:31:17.134261 2026] [:error] [pid 39292:tid 39300] [client 173.244.55.21:25041] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/atomlib.php"] [unique_id "aaI3VaIAO5fN7BxyqcH7_wAAAMY"]
[Sat Feb 28 08:31:18.023117 2026] [:error] [pid 39183:tid 39216] [client 173.244.55.31:40905] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sat Feb 28 08:31:20.848023 2026] [:error] [pid 39183:tid 39199] [client 173.244.55.31:40905] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aaI3WBCf4HvhVePw3LaPVAAAAAc"]
[Sat Feb 28 08:31:21.754573 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.20:52465] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaI3WX6mbajs3bzQGytpKwAAAVc"]
[Sat Feb 28 08:31:23.089864 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.23:30627] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sat Feb 28 08:31:23.553608 2026] [:error] [pid 39292:tid 39297] [client 173.244.55.23:30627] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaI3W6IAO5fN7BxyqcH8hgAAAMM"]
[Sat Feb 28 08:31:24.449131 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.20:28757] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaI3XKIAO5fN7BxyqcH8mgAAAMo"]
[Sat Feb 28 08:31:26.201672 2026] [:error] [pid 39184:tid 39221] [client 173.244.55.21:61037] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sat Feb 28 08:31:26.640337 2026] [:error] [pid 39184:tid 39243] [client 173.244.55.21:61037] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sat Feb 28 08:31:27.082820 2026] [:error] [pid 39184:tid 39239] [client 173.244.55.21:61037] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "aaI3X1tZF9Zd_U7easBnxQAAAFQ"]
[Sat Feb 28 08:31:27.965911 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.21:31457] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "aaI3X2uX5e1Q32gqxH31XAAAAQw"]
[Sat Feb 28 08:31:29.287291 2026] [:error] [pid 39292:tid 39318] [client 173.244.55.30:31791] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sat Feb 28 08:31:30.182618 2026] [:error] [pid 39292:tid 39310] [client 173.244.55.30:31791] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaI3YqIAO5fN7BxyqcH8_wAAANA"]
[Sat Feb 28 08:31:31.073996 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.21:62883] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaI3YxVE-FfM89u7BQaE6wAAAIM"]
[Sat Feb 28 08:31:33.280071 2026] [:error] [pid 39292:tid 39318] [client 173.244.55.25:21447] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Feb 28 08:31:33.722221 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.25:21447] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aaI3ZaIAO5fN7BxyqcH9MAAAAMU"]
[Sat Feb 28 08:31:34.606155 2026] [:error] [pid 39184:tid 39238] [client 173.244.55.26:28699] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaI3ZltZF9Zd_U7easBn_wAAAFM"]
[Sat Feb 28 08:31:35.485130 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.22:43627] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaI3Z2uX5e1Q32gqxH31jgAAARQ"]
[Sat Feb 28 08:31:37.716551 2026] [:error] [pid 11791:tid 11808] [client 173.244.55.22:24171] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fonts/database.php"] [unique_id "aaI3aWuX5e1Q32gqxH31sQAAAQ8"]
[Sat Feb 28 08:31:39.032360 2026] [:error] [pid 39185:tid 39261] [client 173.244.55.30:44729] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sat Feb 28 08:31:39.477749 2026] [:error] [pid 39185:tid 39250] [client 173.244.55.30:44729] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaI3axVE-FfM89u7BQaFWgAAAIQ"]
[Sat Feb 28 08:31:40.810109 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.25:26999] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaI3bGuX5e1Q32gqxH311QAAARU"]
[Sat Feb 28 08:31:41.680597 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.30:55553] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaI3baIAO5fN7BxyqcH9lwAAAMA"]
[Sat Feb 28 08:31:42.576869 2026] [:error] [pid 39184:tid 39236] [client 173.244.55.29:37919] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Feb 28 08:31:43.021022 2026] [:error] [pid 39184:tid 39226] [client 173.244.55.29:37919] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sat Feb 28 08:31:43.919188 2026] [:error] [pid 39184:tid 39235] [client 173.244.55.29:37919] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sat Feb 28 08:31:45.720284 2026] [:error] [pid 39184:tid 39228] [client 173.244.55.29:37919] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aaI3cVtZF9Zd_U7easBoSAAAAEk"]
[Sat Feb 28 08:31:46.601937 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.23:45029] [client 173.244.55.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.23, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aaI3cn6mbajs3bzQGytqjwAAAUo"]
[Sat Feb 28 08:31:47.508860 2026] [:error] [pid 22194:tid 22198] [client 173.244.55.23:45029] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sat Feb 28 08:31:47.953691 2026] [:error] [pid 22194:tid 22212] [client 173.244.55.23:45029] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sat Feb 28 08:31:48.402811 2026] [:error] [pid 22194:tid 22208] [client 173.244.55.23:45029] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sat Feb 28 08:31:49.365289 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.23:45029] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaI3dX6mbajs3bzQGytqqQAAAUM"]
[Sat Feb 28 08:31:50.254782 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.22:54155] [client 173.244.55.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.22, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaI3dhVE-FfM89u7BQaFqQAAAIU"]
[Sat Feb 28 08:31:51.588643 2026] [:error] [pid 39185:tid 39255] [client 173.244.55.22:54155] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaI3dxVE-FfM89u7BQaFswAAAIk"]
[Sat Feb 28 08:31:52.460782 2026] [:error] [pid 22194:tid 22215] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sat Feb 28 08:31:54.293189 2026] [:error] [pid 22194:tid 22215] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sat Feb 28 08:31:55.181325 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sat Feb 28 08:31:56.062629 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Feb 28 08:31:57.384072 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sat Feb 28 08:32:00.472658 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Feb 28 08:32:00.915536 2026] [:error] [pid 22194:tid 22217] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sat Feb 28 08:32:03.136593 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.31:42791] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sat Feb 28 08:32:03.571832 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.31:42791] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/content.php"] [unique_id "aaI3g36mbajs3bzQGytrbwAAAUQ"]
[Sat Feb 28 08:32:04.893331 2026] [:error] [pid 39292:tid 39300] [client 173.244.55.29:47683] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaI3hKIAO5fN7BxyqcH_kgAAAMY"]
[Sat Feb 28 08:32:06.668753 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.31:27421] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sat Feb 28 08:32:07.113171 2026] [:error] [pid 22194:tid 22203] [client 173.244.55.31:27421] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaI3h36mbajs3bzQGytrrgAAAUc"]
[Sat Feb 28 08:32:08.428811 2026] [:error] [pid 39292:tid 39301] [client 173.244.55.22:28165] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sat Feb 28 08:32:08.866789 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.22:28165] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaI3iKIAO5fN7BxyqcH_xQAAAMU"]
[Sat Feb 28 08:32:10.195570 2026] [:error] [pid 22194:tid 22215] [client 173.244.55.29:26587] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/phpmailer/updates.php"] [unique_id "aaI3in6mbajs3bzQGytr6wAAAVM"]
[Sat Feb 28 08:32:11.543710 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.21:62077] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sat Feb 28 08:32:12.432763 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.21:62077] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sat Feb 28 08:32:13.328788 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.21:62077] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sat Feb 28 08:32:13.772032 2026] [:error] [pid 11791:tid 11797] [client 173.244.55.21:62077] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sat Feb 28 08:32:14.659889 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.21:62077] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaI3jmuX5e1Q32gqxH33GgAAARU"]
[Sat Feb 28 08:32:15.533635 2026] [:error] [pid 39184:tid 39239] [client 173.244.55.26:63543] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sat Feb 28 08:32:15.971274 2026] [:error] [pid 39184:tid 39223] [client 173.244.55.26:63543] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sat Feb 28 08:32:16.406982 2026] [:error] [pid 39184:tid 39221] [client 173.244.55.26:63543] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaI3kFtZF9Zd_U7easBpAAAAAEI"]
[Sat Feb 28 08:32:17.725998 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.23:21859] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaI3kaIAO5fN7BxyqcEAJgAAAMw"]
[Sat Feb 28 08:32:19.042169 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.25:43507] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Feb 28 08:32:20.357741 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.25:43507] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sat Feb 28 08:32:20.797001 2026] [:error] [pid 39292:tid 39296] [client 173.244.55.25:43507] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sat Feb 28 08:32:21.231209 2026] [:error] [pid 39292:tid 39312] [client 173.244.55.25:43507] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaI3laIAO5fN7BxyqcEAXgAAANI"]
[Sat Feb 28 08:32:22.139940 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.23:44455] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaI3lmuX5e1Q32gqxH33hwAAAQU"]
[Sat Feb 28 08:32:25.229168 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.20:56229] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sat Feb 28 08:32:26.106022 2026] [:error] [pid 39185:tid 39259] [client 173.244.55.20:56229] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaI3mhVE-FfM89u7BQaGdQAAAI0"]
[Sat Feb 28 08:32:27.425712 2026] [:error] [pid 39184:tid 39237] [client 173.244.55.29:26057] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaI3m1tZF9Zd_U7easBpIgAAAFI"]
[Sat Feb 28 08:32:28.760850 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.29:43451] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 28 08:32:29.207083 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.29:43451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sat Feb 28 08:32:29.650403 2026] [:error] [pid 39292:tid 39317] [client 173.244.55.29:43451] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaI3naIAO5fN7BxyqcEBWgAAANc"]
[Sat Feb 28 08:32:30.987544 2026] [:error] [pid 39185:tid 39264] [client 173.244.55.30:47451] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sat Feb 28 08:32:31.435877 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.30:47451] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sat Feb 28 08:32:32.333109 2026] [:error] [pid 39185:tid 39267] [client 173.244.55.30:47451] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sat Feb 28 08:32:34.974754 2026] [:error] [pid 39185:tid 39263] [client 173.244.55.30:47451] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "aaI3ohVE-FfM89u7BQaGtAAAAJE"]
[Sat Feb 28 08:32:36.311805 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.31:35899] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaI3pKIAO5fN7BxyqcEBtQAAAMk"]
[Sat Feb 28 08:32:37.201921 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.20:25081] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sat Feb 28 08:32:38.521243 2026] [:error] [pid 39292:tid 39317] [client 173.244.55.20:25081] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaI3pqIAO5fN7BxyqcEB6QAAANc"]
[Sat Feb 28 08:32:39.873455 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.22:53581] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sat Feb 28 08:32:41.212139 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.22:53581] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sat Feb 28 08:32:41.667086 2026] [:error] [pid 39292:tid 39317] [client 173.244.55.22:53581] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sat Feb 28 08:32:42.555915 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.22:53581] [client 173.244.55.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.22, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaI3qqIAO5fN7BxyqcECSQAAANE"]
[Sat Feb 28 08:32:44.785935 2026] [:error] [pid 39292:tid 39312] [client 173.244.55.22:53581] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaI3rKIAO5fN7BxyqcECZgAAANI"]
[Sat Feb 28 08:32:45.658086 2026] [:error] [pid 22194:tid 22215] [client 173.244.55.25:20865] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/small.php"] [unique_id "aaI3rX6mbajs3bzQGytuIQAAAVM"]
[Sat Feb 28 08:32:46.544776 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.20:55629] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sat Feb 28 08:32:47.004540 2026] [:error] [pid 22194:tid 22217] [client 173.244.55.20:55629] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaI3r36mbajs3bzQGytuRgAAAVU"]
[Sat Feb 28 08:32:47.912577 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.21:22071] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sat Feb 28 08:32:48.809675 2026] [:error] [pid 22194:tid 22198] [client 173.244.55.21:22071] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aaI3sH6mbajs3bzQGytueQAAAUI"]
[Sat Feb 28 08:32:49.711974 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.30:48461] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aaI3sWuX5e1Q32gqxH34kAAAARU"]
[Sat Feb 28 08:32:50.607661 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.25:44441] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "aaI3sn6mbajs3bzQGytuowAAAUo"]
[Sat Feb 28 08:32:51.481968 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.20:59847] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sat Feb 28 08:32:52.358907 2026] [:error] [pid 11791:tid 11816] [client 173.244.55.20:59847] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaI3tGuX5e1Q32gqxH34ugAAARc"]
[Sat Feb 28 08:32:53.695927 2026] [:error] [pid 39185:tid 39254] [client 173.244.55.28:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sat Feb 28 08:32:54.139507 2026] [:error] [pid 39185:tid 39260] [client 173.244.55.28:39317] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sat Feb 28 08:32:55.028243 2026] [:error] [pid 39185:tid 39255] [client 173.244.55.28:39317] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaI3txVE-FfM89u7BQaG6gAAAIk"]
[Sat Feb 28 08:32:56.346742 2026] [:error] [pid 39292:tid 39315] [client 173.244.55.20:50139] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaI3uKIAO5fN7BxyqcEDHAAAANU"]
[Sat Feb 28 08:32:57.225716 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.30:61327] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sat Feb 28 08:32:57.664041 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.30:61327] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sat Feb 28 08:32:58.545125 2026] [:error] [pid 39292:tid 39296] [client 173.244.55.30:61327] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaI3uqIAO5fN7BxyqcEDbgAAAMI"]
[Sat Feb 28 08:32:59.433177 2026] [:error] [pid 22194:tid 22210] [client 173.244.55.20:21165] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sat Feb 28 08:33:00.334663 2026] [:error] [pid 22194:tid 22210] [client 173.244.55.20:21165] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sat Feb 28 08:33:00.775503 2026] [:error] [pid 22194:tid 22208] [client 173.244.55.20:21165] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaI3vH6mbajs3bzQGytvYAAAAUw"]
[Sat Feb 28 08:33:02.096518 2026] [:error] [pid 22194:tid 22215] [client 173.244.55.25:42911] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aaI3vn6mbajs3bzQGytvdgAAAVM"]
[Sat Feb 28 08:33:02.984816 2026] [:error] [pid 39184:tid 39240] [client 173.244.55.30:49181] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaI3vltZF9Zd_U7easBqFgAAAFU"]
[Sat Feb 28 08:33:03.854773 2026] [:error] [pid 11791:tid 11816] [client 173.244.55.20:36145] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaI3v2uX5e1Q32gqxH35RQAAARc"]
[Sat Feb 28 08:33:04.735196 2026] [:error] [pid 22194:tid 22216] [client 173.244.55.31:62789] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaI3wH6mbajs3bzQGytvjQAAAVQ"]
[Sat Feb 28 08:33:05.627245 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.26:30393] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaI3wWuX5e1Q32gqxH35VgAAAQA"]
[Sat Feb 28 08:33:06.513653 2026] [:error] [pid 39292:tid 39296] [client 173.244.55.22:55033] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaI3wqIAO5fN7BxyqcEEFgAAAMI"]
[Sat Feb 28 08:33:07.390519 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.25:35685] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager/tinyfilemanager.php"] [unique_id "aaI3w6IAO5fN7BxyqcEEKAAAAMA"]
[Sat Feb 28 08:33:09.141283 2026] [:error] [pid 39185:tid 39258] [client 173.244.55.22:24887] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaI3xRVE-FfM89u7BQaHLgAAAIw"]
[Sat Feb 28 08:33:10.015610 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.31:30767] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaI3xqIAO5fN7BxyqcEEdQAAAMo"]
[Sat Feb 28 08:33:10.893808 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.22:31267] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaI3xqIAO5fN7BxyqcEElwAAANE"]
[Sat Feb 28 08:33:11.763315 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.22:24603] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fog/management/index.php"] [unique_id "aaI3xxVE-FfM89u7BQaHOgAAAII"]
[Sat Feb 28 08:33:13.086154 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.29:55973] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaI3yaIAO5fN7BxyqcEE1wAAAM8"]
[Sat Feb 28 08:33:13.968788 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.20:60235] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/components/com_newsfeeds/models/indexx.php"] [unique_id "aaI3yVtZF9Zd_U7easBqSQAAAEw"]
[Sat Feb 28 08:33:15.769513 2026] [:error] [pid 22194:tid 22220] [client 173.244.55.26:43767] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaI3y36mbajs3bzQGytwKQAAAVg"]
[Sat Feb 28 08:33:16.670792 2026] [:error] [pid 39184:tid 39226] [client 173.244.55.25:51791] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sat Feb 28 08:33:18.456177 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.25:51791] [client 173.244.55.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.25, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaI3zltZF9Zd_U7easBqcwAAAEo"]
[Sat Feb 28 08:33:19.348942 2026] [:error] [pid 39184:tid 39233] [client 173.244.55.25:51791] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "aaI3z1tZF9Zd_U7easBqgAAAAE4"]
[Sat Feb 28 08:33:20.689804 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.28:34275] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/class-core-upgrader-first.php"] [unique_id "aaI30KIAO5fN7BxyqcEFcQAAAMk"]
[Sat Feb 28 08:33:22.465245 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.26:30789] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/save.php"] [unique_id "aaI30qIAO5fN7BxyqcEFtQAAAMg"]
[Sat Feb 28 08:33:23.802240 2026] [:error] [pid 39183:tid 39199] [client 173.244.55.31:22783] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaI30xCf4HvhVePw3LaRBQAAAAc"]
[Sat Feb 28 08:33:24.696443 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.29:24671] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaI31H6mbajs3bzQGytw9wAAAUU"]
[Sat Feb 28 08:33:26.917324 2026] [:error] [pid 22194:tid 22216] [client 173.244.55.21:40951] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sat Feb 28 08:33:28.833491 2026] [:error] [pid 22194:tid 22216] [client 173.244.55.21:40951] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sat Feb 28 08:33:30.644264 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.21:40951] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sat Feb 28 08:33:31.087295 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.21:40951] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sat Feb 28 08:33:32.906254 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.21:40951] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sat Feb 28 08:33:33.357671 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.21:40951] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sat Feb 28 08:33:33.798490 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.21:40951] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsad.php"] [unique_id "aaI33X6mbajs3bzQGytxpAAAAUg"]
[Sat Feb 28 08:33:34.690223 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.25:63255] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sat Feb 28 08:33:35.133349 2026] [:error] [pid 39185:tid 39258] [client 173.244.55.25:63255] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sat Feb 28 08:33:35.575086 2026] [:error] [pid 39185:tid 39250] [client 173.244.55.25:63255] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaI33xVE-FfM89u7BQaHjwAAAIQ"]
[Sat Feb 28 08:33:36.457439 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.25:51623] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaI34H6mbajs3bzQGytxwQAAAU8"]
[Sat Feb 28 08:33:37.336771 2026] [:error] [pid 39184:tid 39225] [client 173.244.55.29:43011] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaI34VtZF9Zd_U7easBrMAAAAEY"]
[Sat Feb 28 08:33:38.654204 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.26:43775] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sat Feb 28 08:33:39.093120 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.26:43775] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sat Feb 28 08:33:39.967299 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.26:43775] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sat Feb 28 08:33:40.402051 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.26:43775] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/ubh/install.php"] [unique_id "aaI35KIAO5fN7BxyqcEHJwAAAM4"]
[Sat Feb 28 08:33:41.720180 2026] [:error] [pid 39183:tid 39205] [client 173.244.55.31:43603] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaI35RCf4HvhVePw3LaRYwAAAA0"]
[Sat Feb 28 08:33:42.606386 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.31:43067] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaI35hVE-FfM89u7BQaHtgAAAIU"]
[Sat Feb 28 08:33:43.488709 2026] [:error] [pid 39185:tid 39255] [client 173.244.55.28:60441] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaI35xVE-FfM89u7BQaHvwAAAIk"]
[Sat Feb 28 08:33:46.160070 2026] [:error] [pid 39292:tid 39317] [client 173.244.55.20:27331] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaI36qIAO5fN7BxyqcEHrwAAANc"]
[Sat Feb 28 08:33:47.490331 2026] [:error] [pid 39184:tid 39222] [client 173.244.55.21:40737] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaI361tZF9Zd_U7easBrmAAAAEM"]
[Sat Feb 28 08:33:49.273176 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.29:27493] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaI37RVE-FfM89u7BQaIAQAAAJY"]
[Sat Feb 28 08:33:53.710408 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.21:43291] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/anas.php"] [unique_id "aaI38aIAO5fN7BxyqcEILQAAAMo"]
[Sat Feb 28 08:33:55.905072 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.25:48957] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaI386IAO5fN7BxyqcEIVgAAAME"]
[Sat Feb 28 08:33:56.792237 2026] [:error] [pid 39292:tid 39318] [client 173.244.55.30:59357] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sat Feb 28 08:33:57.234910 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.30:59357] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar/wp-content/themes/pridmag/db.php"] [unique_id "aaI39aIAO5fN7BxyqcEIfwAAANY"]
[Sat Feb 28 08:33:58.123208 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.21:50195] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar/wp-content/themes/pridmag/db.php"] [unique_id "aaI39muX5e1Q32gqxH36vQAAARg"]
[Sat Feb 28 08:33:59.433843 2026] [:error] [pid 39184:tid 39227] [client 173.244.55.26:58513] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aaI391tZF9Zd_U7easBr7gAAAEg"]
[Sat Feb 28 08:34:01.218673 2026] [:error] [pid 39184:tid 39243] [client 173.244.55.28:36053] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sat Feb 28 08:34:02.101497 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.28:36053] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/wp-conflg.php"] [unique_id "aaI3-ltZF9Zd_U7easBsAgAAAEw"]
[Sat Feb 28 08:34:03.414961 2026] [:error] [pid 39183:tid 39195] [client 173.244.55.21:41333] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sat Feb 28 08:34:03.849911 2026] [:error] [pid 39183:tid 39205] [client 173.244.55.21:41333] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaI3-xCf4HvhVePw3LaRtgAAAA0"]
[Sat Feb 28 08:34:05.635095 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.28:65239] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaI3_aIAO5fN7BxyqcEI-wAAAMg"]
[Sat Feb 28 08:34:08.298986 2026] [:error] [pid 39292:tid 39301] [client 173.244.55.20:30709] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaI4AKIAO5fN7BxyqcEJFgAAAMc"]
[Sat Feb 28 08:34:10.972841 2026] [:error] [pid 39184:tid 39220] [client 173.244.55.25:37273] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/user_data.php"] [unique_id "aaI4AltZF9Zd_U7easBsJwAAAEE"]
[Sat Feb 28 08:34:12.283677 2026] [:error] [pid 22194:tid 22196] [client 173.244.55.20:54237] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaI4BH6mbajs3bzQGytzIwAAAUA"]
[Sat Feb 28 08:34:13.613005 2026] [:error] [pid 22194:tid 22212] [client 173.244.55.25:33563] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Feb 28 08:34:14.047550 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.25:33563] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaI4Bn6mbajs3bzQGytzNwAAAVc"]
[Sat Feb 28 08:34:14.923078 2026] [:error] [pid 39184:tid 39237] [client 173.244.55.30:51961] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaI4BltZF9Zd_U7easBsMwAAAFI"]
[Sat Feb 28 08:34:18.031235 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.26:33703] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaI4ChVE-FfM89u7BQaI6QAAAIE"]
[Sat Feb 28 08:34:18.926475 2026] [:error] [pid 39183:tid 39193] [client 173.244.55.29:61951] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sat Feb 28 08:34:20.723635 2026] [:error] [pid 39183:tid 39203] [client 173.244.55.29:61951] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sat Feb 28 08:34:21.163194 2026] [:error] [pid 39183:tid 39199] [client 173.244.55.29:61951] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaI4DRCf4HvhVePw3LaSLQAAAAc"]
[Sat Feb 28 08:34:22.941378 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.23:59077] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sat Feb 28 08:34:23.861012 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.23:59077] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaI4D36mbajs3bzQGytztwAAAVE"]
[Sat Feb 28 08:34:24.742075 2026] [:error] [pid 39292:tid 39301] [client 173.244.55.29:49349] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaI4EKIAO5fN7BxyqcEJ4AAAAMc"]
[Sat Feb 28 08:34:25.887490 2026] [:error] [pid 39292:tid 39313] [client 136.144.33.45:54135] [client 136.144.33.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.45, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaI4EaIAO5fN7BxyqcEJ-gAAANM"]
[Sat Feb 28 08:34:25.890851 2026] [:error] [pid 39292:tid 39313] [client 136.144.33.45:54135] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 28 08:34:26.503288 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.21:41865] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaI4EqIAO5fN7BxyqcEKCwAAANE"]
[Sat Feb 28 08:34:28.720757 2026] [:error] [pid 22194:tid 22215] [client 173.244.55.22:40419] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaI4FH6mbajs3bzQGyt0FwAAAVM"]
[Sat Feb 28 08:34:29.611301 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.23:50553] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaI4FRVE-FfM89u7BQaJDQAAAIE"]
[Sat Feb 28 08:34:30.938323 2026] [:error] [pid 22194:tid 22203] [client 173.244.55.23:55163] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sat Feb 28 08:34:33.139857 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.23:55163] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaI4GX6mbajs3bzQGyt0gAAAAUY"]
[Sat Feb 28 08:34:34.935168 2026] [:error] [pid 39184:tid 39235] [client 173.244.55.28:51673] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaI4GltZF9Zd_U7easBsiQAAAFA"]
[Sat Feb 28 08:34:35.825665 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.20:22981] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaI4G36mbajs3bzQGyt0pQAAAUo"]
[Sat Feb 28 08:34:37.175175 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.31:64381] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sat Feb 28 08:34:37.614147 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.31:64381] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaI4HX6mbajs3bzQGyt0vgAAAUU"]
[Sat Feb 28 08:34:38.946836 2026] [:error] [pid 22194:tid 22215] [client 173.244.55.23:35955] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaI4Hn6mbajs3bzQGyt00AAAAVM"]
[Sat Feb 28 08:34:42.060551 2026] [:error] [pid 22194:tid 22220] [client 173.244.55.20:54581] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaI4In6mbajs3bzQGyt1JQAAAVg"]
[Sat Feb 28 08:34:43.374750 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.30:61167] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sat Feb 28 08:34:43.811978 2026] [:error] [pid 39292:tid 39317] [client 173.244.55.30:61167] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaI4I6IAO5fN7BxyqcEK-AAAANc"]
[Sat Feb 28 08:34:45.587894 2026] [:error] [pid 39185:tid 39264] [client 173.244.55.20:51319] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaI4JRVE-FfM89u7BQaJYAAAAJI"]
[Sat Feb 28 08:34:46.917801 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.26:47219] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aaI4JqIAO5fN7BxyqcELRwAAAM4"]
[Sat Feb 28 08:34:48.246888 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.25:41293] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaI4KKIAO5fN7BxyqcELbQAAAM0"]
[Sat Feb 28 08:34:49.127169 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.26:21263] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aaI4KWuX5e1Q32gqxH387QAAAQU"]
[Sat Feb 28 08:34:50.009505 2026] [:error] [pid 39184:tid 39233] [client 173.244.55.29:39997] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaI4KltZF9Zd_U7easBs9gAAAE4"]
[Sat Feb 28 08:34:53.519530 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.20:58393] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaI4LaIAO5fN7BxyqcELxgAAAM4"]
[Sat Feb 28 08:34:54.401691 2026] [:error] [pid 39292:tid 39305] [client 173.244.55.31:59321] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/content.php"] [unique_id "aaI4LqIAO5fN7BxyqcELzgAAAMs"]
[Sat Feb 28 08:34:56.628580 2026] [:error] [pid 39292:tid 39310] [client 173.244.55.23:58163] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaI4MKIAO5fN7BxyqcEMCQAAANA"]
[Sat Feb 28 08:34:58.386816 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.23:23197] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sat Feb 28 08:34:58.823929 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.23:23197] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaI4MmuX5e1Q32gqxH39cQAAAQs"]
[Sat Feb 28 08:35:01.042191 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.31:27477] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaI4NX6mbajs3bzQGyt2BAAAAUg"]
[Sat Feb 28 08:35:01.935553 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.21:26347] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Sat Feb 28 08:35:02.383157 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.21:26347] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php%20"] [unique_id "aaI4NqIAO5fN7BxyqcEMaAAAAM0"]
[Sat Feb 28 08:35:03.264293 2026] [:error] [pid 39184:tid 39235] [client 173.244.55.21:63047] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php%20"] [unique_id "aaI4N1tZF9Zd_U7easBtSQAAAFA"]
[Sat Feb 28 08:35:06.366525 2026] [:error] [pid 11791:tid 11809] [client 173.244.55.28:44177] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaI4OmuX5e1Q32gqxH39mwAAARA"]
[Sat Feb 28 08:35:07.691053 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.31:46795] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaI4O2uX5e1Q32gqxH39qgAAARM"]
[Sat Feb 28 08:35:09.028244 2026] [:error] [pid 39183:tid 39205] [client 173.244.55.29:26129] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaI4PRCf4HvhVePw3LaSrQAAAA0"]
[Sat Feb 28 08:35:10.821128 2026] [:error] [pid 22194:tid 22217] [client 173.244.55.30:29347] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaI4Pn6mbajs3bzQGyt2YAAAAVU"]
[Sat Feb 28 08:35:13.037651 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.26:33763] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/Marvins.php"] [unique_id "aaI4QRVE-FfM89u7BQaKKAAAAII"]
[Sat Feb 28 08:35:13.928690 2026] [:error] [pid 39185:tid 39257] [client 173.244.55.22:38997] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/Marvins.php"] [unique_id "aaI4QRVE-FfM89u7BQaKLQAAAIs"]
[Sat Feb 28 08:35:17.065105 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.30:36775] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaI4RRVE-FfM89u7BQaKUwAAAIM"]
[Sat Feb 28 08:35:17.972651 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.20:27587] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaI4RaIAO5fN7BxyqcENDQAAAM0"]
[Sat Feb 28 08:35:20.216189 2026] [:error] [pid 22194:tid 22209] [client 173.244.55.29:58069] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaI4SH6mbajs3bzQGyt2uAAAAU0"]
[Sat Feb 28 08:35:21.095750 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.22:51341] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaI4SX6mbajs3bzQGyt2wAAAAUY"]
[Sat Feb 28 08:35:22.875746 2026] [:error] [pid 22194:tid 22203] [client 173.244.55.21:49549] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaI4Sn6mbajs3bzQGyt26AAAAUc"]
[Sat Feb 28 08:35:23.752729 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.31:32995] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaI4S6IAO5fN7BxyqcENTgAAAMg"]
[Sat Feb 28 08:35:24.649237 2026] [:error] [pid 39183:tid 39192] [client 173.244.55.22:31807] [client 173.244.55.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.22, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaI4TBCf4HvhVePw3LaTEQAAAAA"]
[Sat Feb 28 08:35:24.653652 2026] [:error] [pid 39183:tid 39192] [client 173.244.55.22:31807] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sat Feb 28 08:35:25.095341 2026] [:error] [pid 39183:tid 39216] [client 173.244.55.22:31807] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaI4TRCf4HvhVePw3LaTEgAAABg"]
[Sat Feb 28 08:35:26.874811 2026] [:error] [pid 39184:tid 39241] [client 173.244.55.30:45553] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sat Feb 28 08:35:27.315651 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.30:45553] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaI4T1tZF9Zd_U7easBt9AAAAEw"]
[Sat Feb 28 08:35:28.195925 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.22:62817] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aaI4UGuX5e1Q32gqxH3-TwAAAQU"]
[Sat Feb 28 08:35:29.074612 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.22:22499] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Sat Feb 28 08:35:32.178037 2026] [:error] [pid 39185:tid 39263] [client 173.244.55.22:22499] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaI4VBVE-FfM89u7BQaKzgAAAJE"]
[Sat Feb 28 08:35:33.047324 2026] [:error] [pid 22194:tid 22210] [client 173.244.55.29:52355] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaI4VX6mbajs3bzQGyt3ngAAAU4"]
[Sat Feb 28 08:35:34.833148 2026] [:error] [pid 39184:tid 39240] [client 173.244.55.23:39215] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaI4VltZF9Zd_U7easBuHQAAAFU"]
[Sat Feb 28 08:35:35.731487 2026] [:error] [pid 39184:tid 39222] [client 173.244.55.20:24017] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaI4V1tZF9Zd_U7easBuJwAAAEM"]
[Sat Feb 28 08:35:36.628337 2026] [:error] [pid 39183:tid 39212] [client 173.244.55.29:23875] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sat Feb 28 08:35:37.071560 2026] [:error] [pid 39183:tid 39214] [client 173.244.55.29:23875] [client 173.244.55.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.29, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaI4WRCf4HvhVePw3LaTeAAAABY"]
[Sat Feb 28 08:35:37.962114 2026] [:error] [pid 39183:tid 39206] [client 173.244.55.29:23875] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaI4WRCf4HvhVePw3LaThAAAAA4"]
[Sat Feb 28 08:35:39.718842 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.20:38795] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "aaI4W2uX5e1Q32gqxH3-lgAAAQw"]
[Sat Feb 28 08:35:41.474185 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.31:32789] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaI4XX6mbajs3bzQGyt39QAAAVE"]
[Sat Feb 28 08:35:42.360889 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.25:36537] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sat Feb 28 08:35:42.805270 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.25:36537] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaI4XqIAO5fN7BxyqcEOSwAAAM0"]
[Sat Feb 28 08:35:43.684427 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.29:29667] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaI4X36mbajs3bzQGyt4IwAAAUM"]
[Sat Feb 28 08:35:44.568630 2026] [:error] [pid 11791:tid 11811] [client 173.244.55.25:48957] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sat Feb 28 08:35:45.456251 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.25:48957] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/setting.php"] [unique_id "aaI4YWuX5e1Q32gqxH3-sAAAAQs"]
[Sat Feb 28 08:35:46.340264 2026] [:error] [pid 11791:tid 11802] [client 173.244.55.25:59001] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/setting.php"] [unique_id "aaI4YmuX5e1Q32gqxH3-uAAAAQk"]
[Sat Feb 28 08:35:47.672282 2026] [:error] [pid 11791:tid 11799] [client 173.244.55.22:20039] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaI4Y2uX5e1Q32gqxH3-wgAAAQY"]
[Sat Feb 28 08:35:49.439476 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.23:39435] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaI4ZaIAO5fN7BxyqcEOmwAAAM4"]
[Sat Feb 28 08:35:50.332523 2026] [:error] [pid 39185:tid 39262] [client 173.244.55.29:60193] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sat Feb 28 08:35:51.228448 2026] [:error] [pid 39185:tid 39266] [client 173.244.55.29:60193] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Feb 28 08:35:52.113337 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.29:60193] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaI4aBVE-FfM89u7BQaLfQAAAIU"]
[Sat Feb 28 08:35:53.001834 2026] [:error] [pid 39183:tid 39201] [client 173.244.55.28:23901] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaI4aRCf4HvhVePw3LaT4gAAAAk"]
[Sat Feb 28 08:35:54.335112 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.31:33005] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aaI4an6mbajs3bzQGyt4twAAAVc"]
[Sat Feb 28 08:35:55.220915 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.26:46173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Sat Feb 28 08:35:57.880277 2026] [:error] [pid 39292:tid 39315] [client 173.244.55.26:46173] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaI4baIAO5fN7BxyqcEPJAAAANU"]
[Sat Feb 28 08:35:59.643627 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.21:46485] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aaI4b36mbajs3bzQGyt5BwAAAVY"]
[Sat Feb 28 08:36:00.079924 2026] [:error] [pid 22194:tid 22216] [client 173.244.55.21:46485] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaI4cH6mbajs3bzQGyt5EgAAAVQ"]
[Sat Feb 28 08:36:01.858765 2026] [:error] [pid 22194:tid 22220] [client 173.244.55.26:47171] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaI4cX6mbajs3bzQGyt5SQAAAVg"]
[Sat Feb 28 08:36:02.738129 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.26:39765] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaI4chVE-FfM89u7BQaLzAAAAJY"]
[Sat Feb 28 08:36:04.516617 2026] [:error] [pid 39183:tid 39209] [client 173.244.55.21:64815] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sat Feb 28 08:36:05.864936 2026] [:error] [pid 39183:tid 39213] [client 173.244.55.21:64815] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saka.phP7"] [unique_id "aaI4dRCf4HvhVePw3LaUCQAAABU"]
[Sat Feb 28 08:36:06.760671 2026] [:error] [pid 39185:tid 39258] [client 173.244.55.21:23007] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saka.phP7"] [unique_id "aaI4dhVE-FfM89u7BQaL5wAAAIw"]
[Sat Feb 28 08:36:07.639008 2026] [:error] [pid 39292:tid 39300] [client 173.244.55.28:58365] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saka.phP7"] [unique_id "aaI4d6IAO5fN7BxyqcEPbQAAAMY"]
[Sat Feb 28 08:36:08.965976 2026] [:error] [pid 11791:tid 11807] [client 173.244.55.25:59039] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaI4eGuX5e1Q32gqxH3_nAAAAQ4"]
[Sat Feb 28 08:36:09.847173 2026] [:error] [pid 39183:tid 39197] [client 173.244.55.20:46095] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/WordPressCore/gecko.php"] [unique_id "aaI4eRCf4HvhVePw3LaUEwAAAAU"]
[Sat Feb 28 08:36:11.603092 2026] [:error] [pid 39183:tid 39199] [client 173.244.55.29:62005] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaI4exCf4HvhVePw3LaUIwAAAAc"]
[Sat Feb 28 08:36:12.928754 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.30:56213] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaI4fGuX5e1Q32gqxH3_5gAAARM"]
[Sat Feb 28 08:36:13.821904 2026] [:error] [pid 39292:tid 39296] [client 173.244.55.30:54031] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sat Feb 28 08:36:16.044363 2026] [:error] [pid 39292:tid 39318] [client 173.244.55.30:54031] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaI4gKIAO5fN7BxyqcEP_QAAANg"]
[Sat Feb 28 08:36:17.386188 2026] [:error] [pid 39292:tid 39313] [client 173.244.55.20:53207] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aaI4gaIAO5fN7BxyqcEQMgAAANM"]
[Sat Feb 28 08:36:18.277681 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.20:56237] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sat Feb 28 08:36:18.716882 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.20:56237] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaI4gn6mbajs3bzQGyt6YwAAAUU"]
[Sat Feb 28 08:36:19.605321 2026] [:error] [pid 39185:tid 39265] [client 173.244.55.23:59789] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaI4gxVE-FfM89u7BQaMVQAAAJM"]
[Sat Feb 28 08:36:21.374065 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.22:50447] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaI4hWuX5e1Q32gqxH0AEAAAAQs"]
[Sat Feb 28 08:36:23.624669 2026] [:error] [pid 39183:tid 39205] [client 173.244.55.20:60347] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Sat Feb 28 08:36:24.065295 2026] [:error] [pid 39183:tid 39202] [client 173.244.55.20:60347] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaI4iBCf4HvhVePw3LaUWQAAAAo"]
[Sat Feb 28 08:36:24.942331 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.26:62395] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaI4iKIAO5fN7BxyqcEQkgAAAMQ"]
[Sat Feb 28 08:36:28.024161 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.20:52425] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaI4jKIAO5fN7BxyqcEQ2gAAAMg"]
[Sat Feb 28 08:36:29.814005 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.30:60789] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaI4jaIAO5fN7BxyqcEQ-gAAAMg"]
[Sat Feb 28 08:36:30.703558 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.29:50759] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Sat Feb 28 08:36:32.039433 2026] [:error] [pid 39184:tid 39240] [client 173.244.55.29:50759] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaI4kFtZF9Zd_U7easBvPgAAAFU"]
[Sat Feb 28 08:36:32.910274 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.22:53901] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaI4kH6mbajs3bzQGyt7MQAAAUQ"]
[Sat Feb 28 08:36:34.238306 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.25:38635] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaI4kqIAO5fN7BxyqcERKwAAAMg"]
[Sat Feb 28 08:36:35.119685 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.25:58733] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sat Feb 28 08:36:36.001253 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.25:58733] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaI4lGuX5e1Q32gqxH0AcAAAARM"]
[Sat Feb 28 08:36:36.885827 2026] [:error] [pid 39292:tid 39305] [client 173.244.55.25:60779] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Sat Feb 28 08:36:37.774029 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.25:60779] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaI4laIAO5fN7BxyqcERXAAAANY"]
[Sat Feb 28 08:36:38.656036 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.23:57933] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaI4lqIAO5fN7BxyqcERZAAAAMk"]
[Sat Feb 28 08:36:40.004315 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.31:58347] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaI4mH6mbajs3bzQGyt7dgAAAVY"]
[Sat Feb 28 08:36:40.878995 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.23:48575] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaI4mKIAO5fN7BxyqcERjwAAAME"]
[Sat Feb 28 08:36:42.633980 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.23:36305] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaI4mn6mbajs3bzQGyt7qQAAAVE"]
[Sat Feb 28 08:36:43.956056 2026] [:error] [pid 39185:tid 39261] [client 173.244.55.26:40257] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaI4mxVE-FfM89u7BQaNOQAAAI8"]
[Sat Feb 28 08:36:44.841539 2026] [:error] [pid 39185:tid 39259] [client 173.244.55.29:34473] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaI4nBVE-FfM89u7BQaNPwAAAI0"]
[Sat Feb 28 08:36:45.737184 2026] [:error] [pid 39183:tid 39215] [client 173.244.55.30:49873] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaI4nRCf4HvhVePw3LaU7QAAABc"]
[Sat Feb 28 08:36:47.500305 2026] [:error] [pid 39183:tid 39192] [client 173.244.55.30:39239] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/autoload_classmap.php"] [unique_id "aaI4nxCf4HvhVePw3LaU9wAAAAA"]
[Sat Feb 28 08:36:48.822904 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.28:43367] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaI4oGuX5e1Q32gqxH0AzgAAARQ"]
[Sat Feb 28 08:36:50.584734 2026] [:error] [pid 39184:tid 39221] [client 173.244.55.29:46861] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaI4oltZF9Zd_U7easBvtwAAAEI"]
[Sat Feb 28 08:36:51.924495 2026] [:error] [pid 39185:tid 39258] [client 173.244.55.22:46623] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaI4oxVE-FfM89u7BQaNdgAAAIw"]
[Sat Feb 28 08:36:53.268228 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.20:44449] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaI4pX6mbajs3bzQGyt8WwAAAUo"]
[Sat Feb 28 08:36:55.046994 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.26:32345] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sat Feb 28 08:36:56.854858 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.26:32345] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaI4qH6mbajs3bzQGyt8gAAAAVc"]
[Sat Feb 28 08:37:00.055652 2026] [:error] [pid 39183:tid 39210] [client 173.244.55.23:33265] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaI4rBCf4HvhVePw3LaVUQAAABI"]
[Sat Feb 28 08:37:01.383969 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.31:26305] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sat Feb 28 08:37:01.829554 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.31:26305] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaI4raIAO5fN7BxyqcES9wAAANQ"]
[Sat Feb 28 08:37:02.703193 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.29:36191] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/classwithtostring.php%20"] [unique_id "aaI4rn6mbajs3bzQGyt8ugAAAVI"]
[Sat Feb 28 08:37:05.363008 2026] [:error] [pid 39183:tid 39208] [client 173.244.55.28:58293] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaI4sRCf4HvhVePw3LaVegAAABA"]
[Sat Feb 28 08:37:06.675480 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.30:58775] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Sat Feb 28 08:37:08.810902 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.30:58775] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaI4tKIAO5fN7BxyqcETYwAAAM8"]
[Sat Feb 28 08:37:09.698325 2026] [:error] [pid 39184:tid 39235] [client 173.244.55.28:30897] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/as.php"] [unique_id "aaI4tVtZF9Zd_U7easBwTAAAAFA"]
[Sat Feb 28 08:37:11.465695 2026] [:error] [pid 39183:tid 39198] [client 173.244.55.26:43493] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaI4txCf4HvhVePw3LaVnQAAAAY"]
[Sat Feb 28 08:37:12.351851 2026] [:error] [pid 39184:tid 39233] [client 173.244.55.25:56809] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Feb 28 08:37:12.792090 2026] [:error] [pid 39184:tid 39226] [client 173.244.55.25:56809] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaI4uFtZF9Zd_U7easBwagAAAEc"]
[Sat Feb 28 08:37:14.111089 2026] [:error] [pid 39183:tid 39215] [client 173.244.55.29:60057] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaI4uhCf4HvhVePw3LaVtAAAABc"]
[Sat Feb 28 08:37:15.011462 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.22:42431] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/install.php"] [unique_id "aaI4u36mbajs3bzQGyt9OwAAAU8"]
[Sat Feb 28 08:37:15.881666 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.22:26817] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/install.php"] [unique_id "aaI4u36mbajs3bzQGyt9RgAAAUE"]
[Sat Feb 28 08:37:17.207060 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.21:33637] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/av.php"] [unique_id "aaI4vaIAO5fN7BxyqcETzwAAAM8"]
[Sat Feb 28 08:37:18.535264 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.22:42145] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap/about.php"] [unique_id "aaI4vn6mbajs3bzQGyt9jwAAAUg"]
[Sat Feb 28 08:37:19.851442 2026] [:error] [pid 39184:tid 39233] [client 173.244.55.29:59455] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sat Feb 28 08:37:20.287755 2026] [:error] [pid 39184:tid 39237] [client 173.244.55.29:59455] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaI4wFtZF9Zd_U7easBwpAAAAFI"]
[Sat Feb 28 08:37:21.622242 2026] [:error] [pid 22194:tid 22210] [client 173.244.55.25:62095] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "aaI4wX6mbajs3bzQGyt9ywAAAU4"]
[Sat Feb 28 08:37:22.509467 2026] [:error] [pid 39292:tid 39308] [client 173.244.55.29:36373] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "aaI4wqIAO5fN7BxyqcEUBQAAAM4"]
[Sat Feb 28 08:37:24.279156 2026] [:error] [pid 39185:tid 39255] [client 173.244.55.31:62207] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaI4xBVE-FfM89u7BQaOowAAAIk"]
[Sat Feb 28 08:37:25.181744 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.28:24705] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sat Feb 28 08:37:25.622608 2026] [:error] [pid 22194:tid 22217] [client 173.244.55.28:24705] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaI4xX6mbajs3bzQGyt9-gAAAVU"]
[Sat Feb 28 08:37:26.509135 2026] [:error] [pid 39183:tid 39197] [client 173.244.55.28:24961] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaI4xhCf4HvhVePw3LaWAgAAAAU"]
[Sat Feb 28 08:37:27.392776 2026] [:error] [pid 39183:tid 39195] [client 173.244.55.29:30327] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sat Feb 28 08:37:27.834077 2026] [:error] [pid 39183:tid 39202] [client 173.244.55.29:30327] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/cc.php"] [unique_id "aaI4xxCf4HvhVePw3LaWFAAAAAo"]
[Sat Feb 28 08:37:29.160230 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.23:51405] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaI4yX6mbajs3bzQGyt-JAAAAUo"]
[Sat Feb 28 08:37:30.045424 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.21:62837] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaI4yqIAO5fN7BxyqcEUVwAAAMo"]
[Sat Feb 28 08:37:31.817564 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.21:53053] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-admin/includes/wordpress/wp-admin/includes/admin-filters.php"] [unique_id "aaI4yxVE-FfM89u7BQaO-QAAAIM"]
[Sat Feb 28 08:37:33.590901 2026] [:error] [pid 11791:tid 11803] [client 173.244.55.30:27177] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php%20"] [unique_id "aaI4zWuX5e1Q32gqxH0DEgAAAQo"]
[Sat Feb 28 08:37:35.364336 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.23:41897] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaI4z2uX5e1Q32gqxH0DKAAAAQs"]
[Sat Feb 28 08:37:36.244811 2026] [:error] [pid 39183:tid 39207] [client 173.244.55.21:36905] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaI40BCf4HvhVePw3LaWXQAAAA8"]
[Sat Feb 28 08:37:37.117059 2026] [:error] [pid 39183:tid 39215] [client 173.244.55.21:40875] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/cloud.php"] [unique_id "aaI40RCf4HvhVePw3LaWZAAAABc"]
[Sat Feb 28 08:37:38.020250 2026] [:error] [pid 39183:tid 39200] [client 173.244.55.29:53171] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/cloud.php"] [unique_id "aaI40hCf4HvhVePw3LaWbgAAAAg"]
[Sat Feb 28 08:37:39.342134 2026] [:error] [pid 39185:tid 39254] [client 173.244.55.30:62079] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aaI40xVE-FfM89u7BQaPNgAAAIg"]
[Sat Feb 28 08:37:40.215732 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.20:25275] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaI41GuX5e1Q32gqxH0DYQAAARg"]
[Sat Feb 28 08:37:41.098523 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.23:56277] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaI41X6mbajs3bzQGyt-8AAAAUE"]
[Sat Feb 28 08:37:41.967864 2026] [:error] [pid 39184:tid 39232] [client 173.244.55.25:40775] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aaI41VtZF9Zd_U7easBxQQAAAE0"]
[Sat Feb 28 08:37:42.842204 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.20:48603] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/gely.php"] [unique_id "aaI41qIAO5fN7BxyqcEU7gAAAMg"]
[Sat Feb 28 08:37:44.170094 2026] [:error] [pid 39184:tid 39223] [client 173.244.55.30:20519] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/c99shell.php"] [unique_id "aaI42FtZF9Zd_U7easBxWQAAAEQ"]
[Sat Feb 28 08:37:48.012477 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.26:24895] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaI43FtZF9Zd_U7easBxgQAAAEo"]
[Sat Feb 28 08:37:48.891532 2026] [:error] [pid 39183:tid 39195] [client 173.244.55.26:29865] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aaI43BCf4HvhVePw3LaWpgAAAAM"]
[Sat Feb 28 08:37:50.226443 2026] [:error] [pid 39185:tid 39264] [client 173.244.55.29:35333] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Sat Feb 28 08:37:50.665636 2026] [:error] [pid 39185:tid 39254] [client 173.244.55.29:35333] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaI43hVE-FfM89u7BQaPlgAAAIg"]
[Sat Feb 28 08:37:51.545902 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.29:25013] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaI4336mbajs3bzQGyt_rAAAAUM"]
[Sat Feb 28 08:37:52.427021 2026] [:error] [pid 11791:tid 11811] [client 173.244.55.22:51817] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/adminfusm.php"] [unique_id "aaI44GuX5e1Q32gqxH0D9AAAARI"]
[Sat Feb 28 08:37:54.183021 2026] [:error] [pid 39292:tid 39313] [client 173.244.55.25:58763] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aaI44qIAO5fN7BxyqcEVxQAAANM"]
[Sat Feb 28 08:37:55.067338 2026] [:error] [pid 39292:tid 39297] [client 173.244.55.26:52839] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaI446IAO5fN7BxyqcEV4gAAAMM"]
[Sat Feb 28 08:37:55.940404 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.20:25367] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/abcd.php"] [unique_id "aaI442uX5e1Q32gqxH0EBwAAARU"]
[Sat Feb 28 08:37:57.717257 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.28:50197] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/retu11.PhP7"] [unique_id "aaI45WuX5e1Q32gqxH0EIgAAAQw"]
[Sat Feb 28 08:38:00.841952 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.31:40127] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aaI46KIAO5fN7BxyqcEWjQAAAMQ"]
[Sat Feb 28 08:38:01.749661 2026] [:error] [pid 39183:tid 39210] [client 173.244.55.22:44425] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaI46RCf4HvhVePw3LaWxAAAABI"]
[Sat Feb 28 08:38:03.516208 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.28:56155] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aaI466IAO5fN7BxyqcEWuQAAAMQ"]
[Sat Feb 28 08:38:04.845180 2026] [:error] [pid 39292:tid 39313] [client 173.244.55.29:27509] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaI47KIAO5fN7BxyqcEW1wAAANM"]
[Sat Feb 28 08:38:06.156688 2026] [:error] [pid 39292:tid 39312] [client 173.244.55.29:40387] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aaI47qIAO5fN7BxyqcEW5wAAANI"]
[Sat Feb 28 08:38:07.039011 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.20:59287] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaI476IAO5fN7BxyqcEW9QAAAM8"]
[Sat Feb 28 08:38:07.917908 2026] [:error] [pid 39184:tid 39220] [client 173.244.55.29:60497] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaI471tZF9Zd_U7easBxowAAAEE"]
[Sat Feb 28 08:38:10.140661 2026] [:error] [pid 22194:tid 22196] [client 173.244.55.31:26547] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaI48n6mbajs3bzQGyuBAQAAAUA"]
[Sat Feb 28 08:38:11.037332 2026] [:error] [pid 39185:tid 39256] [client 173.244.55.26:44735] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Sat Feb 28 08:38:11.478580 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.26:44735] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaI48xVE-FfM89u7BQaQZgAAAIE"]
[Sat Feb 28 08:38:12.816399 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.26:48181] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img/prettyPhoto/dark_square/install.php"] [unique_id "aaI49KIAO5fN7BxyqcEXLQAAAM8"]
[Sat Feb 28 08:38:14.161182 2026] [:error] [pid 11791:tid 11810] [client 173.244.55.25:48971] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Sat Feb 28 08:38:14.600973 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.25:48971] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaI49muX5e1Q32gqxH0E6AAAAQs"]
[Sat Feb 28 08:38:15.481076 2026] [:error] [pid 39185:tid 39254] [client 173.244.55.28:65431] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaI49xVE-FfM89u7BQaQhwAAAIg"]
[Sat Feb 28 08:38:16.805569 2026] [:error] [pid 11791:tid 11816] [client 173.244.55.21:58761] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaI4-GuX5e1Q32gqxH0E_gAAARc"]
[Sat Feb 28 08:38:19.908039 2026] [:error] [pid 39185:tid 39262] [client 173.244.55.31:55799] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sat Feb 28 08:38:20.346152 2026] [:error] [pid 39185:tid 39256] [client 173.244.55.31:55799] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/fix.php7"] [unique_id "aaI4_BVE-FfM89u7BQaQ2QAAAIo"]
[Sat Feb 28 08:38:21.666425 2026] [:error] [pid 22194:tid 22209] [client 173.244.55.28:61841] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/tflow/adminfus.php"] [unique_id "aaI4_X6mbajs3bzQGyuByQAAAU0"]
[Sat Feb 28 08:38:22.978262 2026] [:error] [pid 39183:tid 39196] [client 173.244.55.22:61503] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php%20"] [unique_id "aaI4_hCf4HvhVePw3LaXTgAAAAQ"]
[Sat Feb 28 08:38:24.291056 2026] [:error] [pid 39184:tid 39226] [client 173.244.55.29:25293] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aaI5AFtZF9Zd_U7easBx2wAAAEc"]
[Sat Feb 28 08:38:25.604081 2026] [:error] [pid 39183:tid 39206] [client 173.244.55.21:21371] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaI5ARCf4HvhVePw3LaXXgAAAA4"]
[Sat Feb 28 08:38:26.918332 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.20:30331] [client 173.244.55.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/linkpreview/av.php"] [unique_id "aaI5AqIAO5fN7BxyqcEXqgAAANQ"]
[Sat Feb 28 08:38:28.230166 2026] [:error] [pid 11791:tid 11800] [client 173.244.55.31:60277] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaI5BGuX5e1Q32gqxH0FfQAAAQc"]
[Sat Feb 28 08:38:29.113317 2026] [:error] [pid 11791:tid 11807] [client 173.244.55.23:40199] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaI5BWuX5e1Q32gqxH0FnAAAAQ4"]
[Sat Feb 28 08:38:29.992332 2026] [:error] [pid 39184:tid 39232] [client 173.244.55.30:60307] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaI5BVtZF9Zd_U7easBx9gAAAE0"]
[Sat Feb 28 08:38:33.103488 2026] [:error] [pid 39184:tid 39233] [client 173.244.55.31:57339] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaI5CVtZF9Zd_U7easByDQAAAE4"]
[Sat Feb 28 08:38:33.971988 2026] [:error] [pid 39292:tid 39297] [client 173.244.55.21:62195] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaI5CaIAO5fN7BxyqcEX_wAAAMM"]
[Sat Feb 28 08:38:35.298299 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.28:41025] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI5C6IAO5fN7BxyqcEYKgAAAMo"]
[Sat Feb 28 08:38:36.174941 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.29:33677] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI5DGuX5e1Q32gqxH0GGQAAARU"]
[Sat Feb 28 08:38:37.051454 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.28:63191] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI5DRVE-FfM89u7BQaRXQAAAIE"]
[Sat Feb 28 08:38:37.932551 2026] [:error] [pid 39183:tid 39198] [client 173.244.55.28:35979] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI5DRCf4HvhVePw3LaXiQAAAAY"]
[Sat Feb 28 08:38:41.059004 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.26:51489] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "aaI5EX6mbajs3bzQGyuCxQAAAUg"]
[Sat Feb 28 08:54:48.075237 2026] [:error] [pid 39292:tid 39305] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/w4.php
[Sat Feb 28 08:54:48.317889 2026] [:error] [pid 39292:tid 39317] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/yawa.php
[Sat Feb 28 08:54:48.568185 2026] [:error] [pid 39292:tid 39308] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv.php
[Sat Feb 28 08:54:48.807512 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/mml.php
[Sat Feb 28 08:54:49.047156 2026] [:error] [pid 39292:tid 39295] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Sat Feb 28 08:54:49.287618 2026] [:error] [pid 39292:tid 39307] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/tymn.php
[Sat Feb 28 08:54:49.529785 2026] [:error] [pid 39292:tid 39298] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sat Feb 28 08:54:49.770102 2026] [:error] [pid 39292:tid 39302] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Sat Feb 28 08:54:50.023883 2026] [:error] [pid 39292:tid 39295] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Sat Feb 28 08:54:50.261922 2026] [:error] [pid 39292:tid 39301] [client 20.216.146.160:37339] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Sat Feb 28 08:54:50.546986 2026] [:error] [pid 39292:tid 39297] [client 20.216.146.160:37339] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aaI82qIAO5fN7BxyqcFH3AAAAMM"]
[Sat Feb 28 08:54:52.645245 2026] [:error] [pid 39184:tid 39242] [client 20.216.146.160:6873] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aaI83FtZF9Zd_U7easCMGgAAAFc"]
[Sat Feb 28 08:54:54.629352 2026] [:error] [pid 22194:tid 22197] [client 20.216.146.160:8268] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aaI83n6mbajs3bzQGyu70AAAAUE"]
[Sat Feb 28 08:54:55.838985 2026] [:error] [pid 39184:tid 39238] [client 20.216.146.160:47090] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aaI831tZF9Zd_U7easCMOQAAAFM"]
[Sat Feb 28 08:54:58.606574 2026] [:error] [pid 39292:tid 39308] [client 20.216.146.160:5995] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaI84qIAO5fN7BxyqcFIWQAAAM4"]
[Sat Feb 28 08:55:00.386654 2026] [:error] [pid 11791:tid 11797] [client 20.216.146.160:26269] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaI85GuX5e1Q32gqxH1IzAAAAQQ"]
[Sat Feb 28 08:55:02.377093 2026] [:error] [pid 11791:tid 11811] [client 20.216.146.160:41565] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaI85muX5e1Q32gqxH1I8gAAARI"]
[Sat Feb 28 08:55:03.548817 2026] [:error] [pid 11791:tid 11797] [client 20.216.146.160:3652] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaI852uX5e1Q32gqxH1JFQAAAQQ"]
[Sat Feb 28 08:55:05.499551 2026] [:error] [pid 39185:tid 39270] [client 20.216.146.160:44220] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaI86RVE-FfM89u7BQazMwAAAJg"]
[Sat Feb 28 08:55:08.331965 2026] [:error] [pid 39184:tid 39222] [client 20.216.146.160:37736] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaI87FtZF9Zd_U7easCMqgAAAEM"]
[Sat Feb 28 08:55:11.152334 2026] [:error] [pid 22194:tid 22201] [client 20.216.146.160:18512] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaI8736mbajs3bzQGyu8tAAAAUU"]
[Sat Feb 28 08:55:13.389213 2026] [:error] [pid 11791:tid 11793] [client 20.216.146.160:21111] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaI88WuX5e1Q32gqxH1KHQAAAQA"]
[Sat Feb 28 08:55:15.004021 2026] [:error] [pid 39292:tid 39305] [client 20.216.146.160:41078] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaI886IAO5fN7BxyqcFJOQAAAMs"]
[Sat Feb 28 08:55:16.581851 2026] [:error] [pid 39184:tid 39233] [client 20.216.146.160:39554] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaI89FtZF9Zd_U7easCM4AAAAE4"]
[Sat Feb 28 08:55:18.545473 2026] [:error] [pid 39185:tid 39247] [client 20.216.146.160:19007] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaI89hVE-FfM89u7BQazvgAAAIE"]
[Sat Feb 28 08:55:19.766619 2026] [:error] [pid 11791:tid 11805] [client 20.216.146.160:26285] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaI892uX5e1Q32gqxH1LHQAAAQw"]
[Sat Feb 28 08:55:20.870024 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:49590] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaI8-H6mbajs3bzQGyu9QgAAAUw"]
[Sat Feb 28 08:55:22.665042 2026] [:error] [pid 39183:tid 39192] [client 20.216.146.160:18997] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaI8-hCf4HvhVePw3LaqTQAAAAA"]
[Sat Feb 28 08:55:24.587813 2026] [:error] [pid 11791:tid 11817] [client 20.216.146.160:19385] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaI8_GuX5e1Q32gqxH1LZwAAARg"]
[Sat Feb 28 08:55:26.437740 2026] [:error] [pid 11791:tid 11816] [client 20.216.146.160:18516] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaI8_muX5e1Q32gqxH1LgAAAARc"]
[Sat Feb 28 08:55:27.171687 2026] [:error] [pid 39292:tid 39298] [client 20.216.146.160:44186] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaI8_6IAO5fN7BxyqcFJ7AAAAMQ"]
[Sat Feb 28 08:55:28.367997 2026] [:error] [pid 22194:tid 22215] [client 20.216.146.160:21063] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaI9AH6mbajs3bzQGyu9rwAAAVM"]
[Sat Feb 28 08:55:29.479480 2026] [:error] [pid 22194:tid 22209] [client 20.216.146.160:41061] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaI9AX6mbajs3bzQGyu9vgAAAU0"]
[Sat Feb 28 08:55:30.827055 2026] [:error] [pid 39185:tid 39262] [client 20.216.146.160:33345] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaI9AhVE-FfM89u7BQa0CAAAAJA"]
[Sat Feb 28 08:55:31.866115 2026] [:error] [pid 39184:tid 39223] [client 20.216.146.160:21046] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaI9A1tZF9Zd_U7easCNTgAAAEQ"]
[Sat Feb 28 08:55:33.067754 2026] [:error] [pid 39183:tid 39207] [client 20.216.146.160:44188] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaI9BRCf4HvhVePw3LaqfgAAAA8"]
[Sat Feb 28 08:55:34.407580 2026] [:error] [pid 39292:tid 39295] [client 20.216.146.160:14384] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaI9BqIAO5fN7BxyqcFKMgAAAME"]
[Sat Feb 28 08:55:35.700121 2026] [:error] [pid 39185:tid 39246] [client 20.216.146.160:18546] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaI9BxVE-FfM89u7BQa0JQAAAIA"]
[Sat Feb 28 08:55:36.364476 2026] [:error] [pid 11791:tid 11809] [client 20.216.146.160:5923] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaI9CGuX5e1Q32gqxH1MDQAAARA"]
[Sat Feb 28 08:55:37.280412 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:5919] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaI9CX6mbajs3bzQGyu-EAAAAU4"]
[Sat Feb 28 08:55:39.280130 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:5944] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaI9C36mbajs3bzQGyu-MQAAAU4"]
[Sat Feb 28 08:55:41.540658 2026] [:error] [pid 39184:tid 39221] [client 20.216.146.160:21001] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaI9DVtZF9Zd_U7easCNsAAAAEI"]
[Sat Feb 28 08:55:43.492523 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:21020] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaI9D36mbajs3bzQGyu-egAAAUw"]
[Sat Feb 28 08:55:45.524048 2026] [:error] [pid 11791:tid 11798] [client 20.216.146.160:19311] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaI9EWuX5e1Q32gqxH1MjAAAAQU"]
[Sat Feb 28 08:55:45.697233 2026] [:error] [pid 11791:tid 11803] [client 13.71.191.191:33746] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaI9EWuX5e1Q32gqxH1MkAAAAQo"]
[Sat Feb 28 08:55:46.108979 2026] [:error] [pid 39185:tid 39255] [client 13.71.191.191:33669] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaI9EhVE-FfM89u7BQa0ZQAAAIk"]
[Sat Feb 28 08:55:46.516354 2026] [:error] [pid 22194:tid 22202] [client 13.71.191.191:33695] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaI9En6mbajs3bzQGyu-ogAAAUY"]
[Sat Feb 28 08:55:46.941429 2026] [:error] [pid 39292:tid 39318] [client 13.71.191.191:33675] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaI9EqIAO5fN7BxyqcFKowAAANg"]
[Sat Feb 28 08:55:47.300444 2026] [:error] [pid 39185:tid 39265] [client 20.216.146.160:34167] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaI9ExVE-FfM89u7BQa0eQAAAJM"]
[Sat Feb 28 08:55:47.351681 2026] [:error] [pid 22194:tid 22214] [client 13.71.191.191:33730] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaI9E36mbajs3bzQGyu-qwAAAVI"]
[Sat Feb 28 08:55:47.762252 2026] [:error] [pid 39185:tid 39268] [client 13.71.191.191:33780] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaI9ExVE-FfM89u7BQa0ggAAAJY"]
[Sat Feb 28 08:55:48.175302 2026] [:error] [pid 39184:tid 39220] [client 13.71.191.191:33767] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaI9FFtZF9Zd_U7easCN7gAAAEE"]
[Sat Feb 28 08:55:48.366594 2026] [:error] [pid 39184:tid 39229] [client 20.216.146.160:5910] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaI9FFtZF9Zd_U7easCN7wAAAEo"]
[Sat Feb 28 08:55:48.583425 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:33741] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaI9FGuX5e1Q32gqxH1MwQAAAQw"]
[Sat Feb 28 08:55:48.994425 2026] [:error] [pid 39292:tid 39299] [client 13.71.191.191:33734] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php7"] [unique_id "aaI9FKIAO5fN7BxyqcFKrwAAAMU"]
[Sat Feb 28 08:55:49.414667 2026] [:error] [pid 11791:tid 11817] [client 13.71.191.191:33753] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php7"] [unique_id "aaI9FWuX5e1Q32gqxH1MzAAAARg"]
[Sat Feb 28 08:55:49.822718 2026] [:error] [pid 11791:tid 11809] [client 13.71.191.191:33683] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php7"] [unique_id "aaI9FWuX5e1Q32gqxH1M0gAAARA"]
[Sat Feb 28 08:55:50.232180 2026] [:error] [pid 22194:tid 22205] [client 13.71.191.191:33791] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php7"] [unique_id "aaI9Fn6mbajs3bzQGyu-0gAAAUk"]
[Sat Feb 28 08:55:50.486599 2026] [:error] [pid 39184:tid 39237] [client 20.216.146.160:15418] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Feb 28 08:55:50.650034 2026] [:error] [pid 22194:tid 22207] [client 13.71.191.191:33668] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aaI9Fn6mbajs3bzQGyu-2AAAAUs"]
[Sat Feb 28 08:55:50.976128 2026] [:error] [pid 39184:tid 39240] [client 20.216.146.160:15418] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Feb 28 08:55:51.059404 2026] [:error] [pid 39184:tid 39226] [client 13.71.191.191:33733] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aaI9F1tZF9Zd_U7easCOEQAAAEc"]
[Sat Feb 28 08:55:51.298016 2026] [:error] [pid 39184:tid 39237] [client 20.216.146.160:15418] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Sat Feb 28 08:55:51.471064 2026] [:error] [pid 39184:tid 39238] [client 13.71.191.191:33680] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aaI9F1tZF9Zd_U7easCOFgAAAFM"]
[Sat Feb 28 08:55:51.647581 2026] [:error] [pid 39184:tid 39241] [client 20.216.146.160:15418] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Feb 28 08:55:51.880538 2026] [:error] [pid 22194:tid 22214] [client 13.71.191.191:33750] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aaI9F36mbajs3bzQGyu-9AAAAVI"]
[Sat Feb 28 08:55:51.897638 2026] [:error] [pid 39184:tid 39231] [client 20.216.146.160:15418] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Feb 28 08:55:52.290690 2026] [:error] [pid 39292:tid 39302] [client 13.71.191.191:33731] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaI9GKIAO5fN7BxyqcFK3AAAAMg"]
[Sat Feb 28 08:55:52.703854 2026] [:error] [pid 39185:tid 39246] [client 13.71.191.191:33754] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaI9GBVE-FfM89u7BQa0uAAAAIA"]
[Sat Feb 28 08:55:53.121172 2026] [:error] [pid 11791:tid 11802] [client 13.71.191.191:33748] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaI9GWuX5e1Q32gqxH1M6wAAAQk"]
[Sat Feb 28 08:55:53.371452 2026] [:error] [pid 39184:tid 39223] [client 20.216.146.160:15418] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sat Feb 28 08:55:53.536761 2026] [:error] [pid 39292:tid 39300] [client 13.71.191.191:33756] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaI9GaIAO5fN7BxyqcFK9gAAAMY"]
[Sat Feb 28 08:55:53.624591 2026] [:error] [pid 39184:tid 39236] [client 20.216.146.160:15418] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9GVtZF9Zd_U7easCOMAAAAFE"]
[Sat Feb 28 08:55:53.949735 2026] [:error] [pid 11791:tid 11796] [client 13.71.191.191:33664] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lp6.php"] [unique_id "aaI9GWuX5e1Q32gqxH1M_AAAAQM"]
[Sat Feb 28 08:55:54.359297 2026] [:error] [pid 22194:tid 22218] [client 13.71.191.191:33775] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lp6.php"] [unique_id "aaI9Gn6mbajs3bzQGyu_IgAAAVY"]
[Sat Feb 28 08:55:54.595579 2026] [:error] [pid 11791:tid 11796] [client 20.216.146.160:14345] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9GmuX5e1Q32gqxH1NDAAAAQM"]
[Sat Feb 28 08:55:54.770202 2026] [:error] [pid 22194:tid 22213] [client 13.71.191.191:33622] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lp6.php"] [unique_id "aaI9Gn6mbajs3bzQGyu_LwAAAVE"]
[Sat Feb 28 08:55:55.179019 2026] [:error] [pid 39185:tid 39259] [client 13.71.191.191:33771] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lp6.php"] [unique_id "aaI9GxVE-FfM89u7BQa0yQAAAI0"]
[Sat Feb 28 08:55:55.588601 2026] [:error] [pid 11791:tid 11808] [client 13.71.191.191:33679] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI9G2uX5e1Q32gqxH1NKAAAAQ8"]
[Sat Feb 28 08:55:56.000265 2026] [:error] [pid 22194:tid 22201] [client 13.71.191.191:33743] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI9G36mbajs3bzQGyu_TAAAAUU"]
[Sat Feb 28 08:55:56.087923 2026] [:error] [pid 39292:tid 39304] [client 20.216.146.160:21114] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9HKIAO5fN7BxyqcFLFQAAAMo"]
[Sat Feb 28 08:55:56.422150 2026] [:error] [pid 11791:tid 11816] [client 13.71.191.191:33783] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI9HGuX5e1Q32gqxH1NSAAAARc"]
[Sat Feb 28 08:55:56.829981 2026] [:error] [pid 11791:tid 11807] [client 13.71.191.191:33738] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI9HGuX5e1Q32gqxH1NVQAAAQ4"]
[Sat Feb 28 08:55:57.107338 2026] [:error] [pid 11791:tid 11807] [client 20.216.146.160:19335] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9HWuX5e1Q32gqxH1NYAAAAQ4"]
[Sat Feb 28 08:55:57.243607 2026] [:error] [pid 11791:tid 11811] [client 13.71.191.191:33789] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI9HWuX5e1Q32gqxH1NZgAAARI"]
[Sat Feb 28 08:55:57.675863 2026] [:error] [pid 22194:tid 22199] [client 13.71.191.191:33755] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI9HX6mbajs3bzQGyu_cAAAAUM"]
[Sat Feb 28 08:55:58.085793 2026] [:error] [pid 11791:tid 11793] [client 13.71.191.191:33763] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI9HmuX5e1Q32gqxH1NfQAAAQA"]
[Sat Feb 28 08:55:58.496630 2026] [:error] [pid 39185:tid 39267] [client 13.71.191.191:33790] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI9HhVE-FfM89u7BQa00AAAAJU"]
[Sat Feb 28 08:55:58.908111 2026] [:error] [pid 39292:tid 39302] [client 13.71.191.191:33757] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaI9HqIAO5fN7BxyqcFLMQAAAMg"]
[Sat Feb 28 08:55:59.330450 2026] [:error] [pid 22194:tid 22215] [client 13.71.191.191:33670] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaI9H36mbajs3bzQGyu_ggAAAVM"]
[Sat Feb 28 08:55:59.758194 2026] [:error] [pid 39292:tid 39299] [client 13.71.191.191:33610] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaI9H6IAO5fN7BxyqcFLPgAAAMU"]
[Sat Feb 28 08:56:00.169745 2026] [:error] [pid 22194:tid 22206] [client 13.71.191.191:33742] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaI9IH6mbajs3bzQGyu_iwAAAUo"]
[Sat Feb 28 08:56:00.577658 2026] [:error] [pid 22194:tid 22200] [client 13.71.191.191:33678] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aaI9IH6mbajs3bzQGyu_kAAAAUQ"]
[Sat Feb 28 08:56:00.987173 2026] [:error] [pid 39185:tid 39262] [client 13.71.191.191:33712] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aaI9IBVE-FfM89u7BQa05wAAAJA"]
[Sat Feb 28 08:56:01.399341 2026] [:error] [pid 22194:tid 22206] [client 13.71.191.191:33760] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aaI9IX6mbajs3bzQGyu_mwAAAUo"]
[Sat Feb 28 08:56:01.812290 2026] [:error] [pid 22194:tid 22210] [client 13.71.191.191:33779] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aaI9IX6mbajs3bzQGyu_ogAAAU4"]
[Sat Feb 28 08:56:02.221951 2026] [:error] [pid 39292:tid 39297] [client 13.71.191.191:33778] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaI9IqIAO5fN7BxyqcFLYgAAAMM"]
[Sat Feb 28 08:56:02.630496 2026] [:error] [pid 11791:tid 11803] [client 13.71.191.191:33728] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaI9ImuX5e1Q32gqxH1NwAAAAQo"]
[Sat Feb 28 08:56:03.039968 2026] [:error] [pid 22194:tid 22203] [client 13.71.191.191:33701] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaI9I36mbajs3bzQGyu_tAAAAUc"]
[Sat Feb 28 08:56:03.449264 2026] [:error] [pid 11791:tid 11811] [client 13.71.191.191:33671] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaI9I2uX5e1Q32gqxH1NygAAARI"]
[Sat Feb 28 08:56:03.882555 2026] [:error] [pid 11791:tid 11803] [client 13.71.191.191:33759] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaI9I2uX5e1Q32gqxH1N0QAAAQo"]
[Sat Feb 28 08:56:04.312471 2026] [:error] [pid 22194:tid 22205] [client 13.71.191.191:33774] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaI9JH6mbajs3bzQGyu_wgAAAUk"]
[Sat Feb 28 08:56:04.731900 2026] [:error] [pid 39185:tid 39264] [client 13.71.191.191:33703] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaI9JBVE-FfM89u7BQa1AgAAAJI"]
[Sat Feb 28 08:56:05.145012 2026] [:error] [pid 22194:tid 22215] [client 13.71.191.191:33732] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaI9JX6mbajs3bzQGyu_zAAAAVM"]
[Sat Feb 28 08:56:05.555577 2026] [:error] [pid 39292:tid 39312] [client 13.71.191.191:33776] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaI9JaIAO5fN7BxyqcFLgwAAANI"]
[Sat Feb 28 08:56:05.964201 2026] [:error] [pid 11791:tid 11817] [client 13.71.191.191:33765] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaI9JWuX5e1Q32gqxH1N7wAAARg"]
[Sat Feb 28 08:56:06.377185 2026] [:error] [pid 39292:tid 39294] [client 13.71.191.191:33709] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaI9JqIAO5fN7BxyqcFLjwAAAMA"]
[Sat Feb 28 08:56:06.605174 2026] [:error] [pid 11791:tid 11807] [client 20.216.146.160:37357] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaI9JmuX5e1Q32gqxH1OAgAAAQ4"]
[Sat Feb 28 08:56:06.787222 2026] [:error] [pid 11791:tid 11794] [client 13.71.191.191:33682] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaI9JmuX5e1Q32gqxH1OCwAAAQE"]
[Sat Feb 28 08:56:07.195177 2026] [:error] [pid 11791:tid 11809] [client 13.71.191.191:33603] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaI9J2uX5e1Q32gqxH1OGgAAARA"]
[Sat Feb 28 08:56:07.604929 2026] [:error] [pid 39185:tid 39267] [client 13.71.191.191:33785] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaI9JxVE-FfM89u7BQa1FwAAAJU"]
[Sat Feb 28 08:56:08.017463 2026] [:error] [pid 22194:tid 22204] [client 13.71.191.191:33752] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaI9KH6mbajs3bzQGyu_8QAAAUg"]
[Sat Feb 28 08:56:08.068185 2026] [:error] [pid 39185:tid 39261] [client 20.216.146.160:18984] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaI9KBVE-FfM89u7BQa1GgAAAI8"]
[Sat Feb 28 08:56:08.430535 2026] [:error] [pid 22194:tid 22219] [client 13.71.191.191:33696] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaI9KH6mbajs3bzQGyu__AAAAVc"]
[Sat Feb 28 08:56:08.842975 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:33631] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaI9KGuX5e1Q32gqxH1OQwAAAQw"]
[Sat Feb 28 08:56:09.252685 2026] [:error] [pid 39292:tid 39315] [client 13.71.191.191:33777] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaI9KaIAO5fN7BxyqcFLrwAAANU"]
[Sat Feb 28 08:56:09.301640 2026] [:error] [pid 39292:tid 39299] [client 20.216.146.160:22928] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaI9KaIAO5fN7BxyqcFLswAAAMU"]
[Sat Feb 28 08:56:09.662663 2026] [:error] [pid 39185:tid 39266] [client 13.71.191.191:33677] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaI9KRVE-FfM89u7BQa1LgAAAJQ"]
[Sat Feb 28 08:56:10.079532 2026] [:error] [pid 39184:tid 39236] [client 13.71.191.191:33725] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaI9KltZF9Zd_U7easCOtgAAAFE"]
[Sat Feb 28 08:56:10.496973 2026] [:error] [pid 39184:tid 39221] [client 13.71.191.191:33686] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaI9KltZF9Zd_U7easCOugAAAEI"]
[Sat Feb 28 08:56:10.667474 2026] [:error] [pid 39292:tid 39317] [client 20.216.146.160:28829] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaI9KqIAO5fN7BxyqcFLxQAAANc"]
[Sat Feb 28 08:56:10.914592 2026] [:error] [pid 39292:tid 39313] [client 13.71.191.191:33725] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaI9KqIAO5fN7BxyqcFLyQAAANM"]
[Sat Feb 28 08:56:11.330439 2026] [:error] [pid 11791:tid 11797] [client 13.71.191.191:33611] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaI9K2uX5e1Q32gqxH1ObQAAAQQ"]
[Sat Feb 28 08:56:11.746351 2026] [:error] [pid 39183:tid 39197] [client 13.71.191.191:33620] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaI9KxCf4HvhVePw3LarPgAAAAU"]
[Sat Feb 28 08:56:12.164203 2026] [:error] [pid 39183:tid 39206] [client 13.71.191.191:33609] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaI9LBCf4HvhVePw3LarRgAAAA4"]
[Sat Feb 28 08:56:12.182404 2026] [:error] [pid 39183:tid 39195] [client 20.216.146.160:6892] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaI9LBCf4HvhVePw3LarSAAAAAM"]
[Sat Feb 28 08:56:12.582659 2026] [:error] [pid 11791:tid 11807] [client 13.71.191.191:33632] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaI9LGuX5e1Q32gqxH1OigAAAQ4"]
[Sat Feb 28 08:56:12.998590 2026] [:error] [pid 39183:tid 39205] [client 13.71.191.191:33697] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaI9LBCf4HvhVePw3LarVwAAAA0"]
[Sat Feb 28 08:56:13.357200 2026] [:error] [pid 39183:tid 39207] [client 20.216.146.160:22692] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaI9LRCf4HvhVePw3LarXQAAAA8"]
[Sat Feb 28 08:56:13.422349 2026] [:error] [pid 22194:tid 22207] [client 13.71.191.191:33772] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaI9LX6mbajs3bzQGyvAFQAAAUs"]
[Sat Feb 28 08:56:13.836494 2026] [:error] [pid 39185:tid 39259] [client 13.71.191.191:33612] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaI9LRVE-FfM89u7BQa1WAAAAI0"]
[Sat Feb 28 08:56:14.245023 2026] [:error] [pid 22194:tid 22209] [client 13.71.191.191:33713] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaI9Ln6mbajs3bzQGyvAHgAAAU0"]
[Sat Feb 28 08:56:14.656500 2026] [:error] [pid 22194:tid 22207] [client 13.71.191.191:33751] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaI9Ln6mbajs3bzQGyvAJQAAAUs"]
[Sat Feb 28 08:56:14.933130 2026] [:error] [pid 39185:tid 39266] [client 20.216.146.160:31846] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaI9LhVE-FfM89u7BQa1ZQAAAJQ"]
[Sat Feb 28 08:56:15.069865 2026] [:error] [pid 39183:tid 39202] [client 13.71.191.191:33747] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaI9LxCf4HvhVePw3LaragAAAAo"]
[Sat Feb 28 08:56:15.481182 2026] [:error] [pid 22194:tid 22212] [client 13.71.191.191:33716] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaI9L36mbajs3bzQGyvANwAAAVA"]
[Sat Feb 28 08:56:15.890530 2026] [:error] [pid 11791:tid 11816] [client 13.71.191.191:33768] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaI9L2uX5e1Q32gqxH1OxwAAARc"]
[Sat Feb 28 08:56:16.299457 2026] [:error] [pid 22194:tid 22213] [client 13.71.191.191:33659] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaI9MH6mbajs3bzQGyvARwAAAVE"]
[Sat Feb 28 08:56:16.722405 2026] [:error] [pid 22194:tid 22214] [client 13.71.191.191:33614] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaI9MH6mbajs3bzQGyvATgAAAVI"]
[Sat Feb 28 08:56:16.862650 2026] [:error] [pid 39292:tid 39302] [client 20.216.146.160:26576] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaI9MKIAO5fN7BxyqcFL7AAAAMg"]
[Sat Feb 28 08:56:17.132551 2026] [:error] [pid 11791:tid 11798] [client 13.71.191.191:33782] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9MWuX5e1Q32gqxH1O9AAAAQU"]
[Sat Feb 28 08:56:17.540698 2026] [:error] [pid 22194:tid 22200] [client 13.71.191.191:33665] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9MX6mbajs3bzQGyvAWAAAAUQ"]
[Sat Feb 28 08:56:17.958183 2026] [:error] [pid 11791:tid 11794] [client 13.71.191.191:33744] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9MWuX5e1Q32gqxH1PGgAAAQE"]
[Sat Feb 28 08:56:18.366701 2026] [:error] [pid 22194:tid 22220] [client 13.71.191.191:33736] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaI9Mn6mbajs3bzQGyvAbAAAAVg"]
[Sat Feb 28 08:56:18.778187 2026] [:error] [pid 11791:tid 11808] [client 13.71.191.191:33758] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaI9MmuX5e1Q32gqxH1PKwAAAQ8"]
[Sat Feb 28 08:56:19.143612 2026] [:error] [pid 39185:tid 39269] [client 20.216.146.160:30110] [client 20.216.146.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaI9MxVE-FfM89u7BQa1gQAAAJc"]
[Sat Feb 28 08:56:19.205537 2026] [:error] [pid 39183:tid 39199] [client 13.71.191.191:33739] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaI9MxCf4HvhVePw3LarcQAAAAc"]
[Sat Feb 28 08:56:19.614963 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:33673] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaI9M2uX5e1Q32gqxH1PQAAAAQw"]
[Sat Feb 28 08:56:20.027268 2026] [:error] [pid 11791:tid 11795] [client 13.71.191.191:33786] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaI9NGuX5e1Q32gqxH1PSgAAAQI"]
[Sat Feb 28 08:56:20.435727 2026] [:error] [pid 39185:tid 39261] [client 13.71.191.191:33638] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaI9NBVE-FfM89u7BQa1igAAAI8"]
[Sat Feb 28 08:56:20.845229 2026] [:error] [pid 22194:tid 22211] [client 13.71.191.191:33707] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaI9NH6mbajs3bzQGyvAmwAAAU8"]
[Sat Feb 28 08:56:21.259373 2026] [:error] [pid 22194:tid 22200] [client 13.71.191.191:33689] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaI9NX6mbajs3bzQGyvApAAAAUQ"]
[Sat Feb 28 08:56:21.670112 2026] [:error] [pid 39292:tid 39314] [client 13.71.191.191:33766] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaI9NaIAO5fN7BxyqcFMDgAAANQ"]
[Sat Feb 28 08:56:22.081704 2026] [:error] [pid 39292:tid 39317] [client 13.71.191.191:33699] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaI9NqIAO5fN7BxyqcFMFQAAANc"]
[Sat Feb 28 08:56:22.496279 2026] [:error] [pid 22194:tid 22204] [client 13.71.191.191:33676] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaI9Nn6mbajs3bzQGyvAvwAAAUg"]
[Sat Feb 28 08:56:22.544773 2026] [:error] [pid 22194:tid 22205] [client 20.216.146.160:44166] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI9Nn6mbajs3bzQGyvAwAAAAUk"]
[Sat Feb 28 08:56:22.924810 2026] [:error] [pid 39292:tid 39318] [client 13.71.191.191:33787] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaI9NqIAO5fN7BxyqcFMHQAAANg"]
[Sat Feb 28 08:56:23.335946 2026] [:error] [pid 39185:tid 39267] [client 13.71.191.191:33732] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaI9NxVE-FfM89u7BQa1qAAAAJU"]
[Sat Feb 28 08:56:23.749152 2026] [:error] [pid 22194:tid 22220] [client 13.71.191.191:33681] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaI9N36mbajs3bzQGyvA6QAAAVg"]
[Sat Feb 28 08:56:23.890877 2026] [:error] [pid 22194:tid 22205] [client 20.216.146.160:18558] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI9N36mbajs3bzQGyvA7wAAAUk"]
[Sat Feb 28 08:56:24.172068 2026] [:error] [pid 22194:tid 22218] [client 13.71.191.191:33687] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaI9OH6mbajs3bzQGyvA_AAAAVY"]
[Sat Feb 28 08:56:24.587471 2026] [:error] [pid 39292:tid 39310] [client 13.71.191.191:33729] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaI9OKIAO5fN7BxyqcFMLgAAANA"]
[Sat Feb 28 08:56:25.025636 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:33781] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaI9OWuX5e1Q32gqxH1PqwAAAQw"]
[Sat Feb 28 08:56:25.434359 2026] [:error] [pid 39184:tid 39238] [client 13.71.191.191:33735] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaI9OVtZF9Zd_U7easCO5QAAAFM"]
[Sat Feb 28 08:56:25.843164 2026] [:error] [pid 22194:tid 22219] [client 13.71.191.191:33698] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaI9OX6mbajs3bzQGyvBJQAAAVc"]
[Sat Feb 28 08:56:26.262228 2026] [:error] [pid 39292:tid 39316] [client 13.71.191.191:33600] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaI9OqIAO5fN7BxyqcFMPQAAANY"]
[Sat Feb 28 08:56:26.672578 2026] [:error] [pid 39183:tid 39194] [client 13.71.191.191:33616] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaI9OhCf4HvhVePw3LariQAAAAI"]
[Sat Feb 28 08:56:27.083311 2026] [:error] [pid 39185:tid 39263] [client 13.71.191.191:33702] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaI9OxVE-FfM89u7BQa1wAAAAJE"]
[Sat Feb 28 08:56:27.491200 2026] [:error] [pid 11791:tid 11810] [client 13.71.191.191:33705] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaI9O2uX5e1Q32gqxH1P6AAAARE"]
[Sat Feb 28 08:56:27.899112 2026] [:error] [pid 11791:tid 11802] [client 13.71.191.191:33645] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaI9O2uX5e1Q32gqxH1P8wAAAQk"]
[Sat Feb 28 08:56:28.307633 2026] [:error] [pid 39185:tid 39247] [client 13.71.191.191:33710] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaI9PBVE-FfM89u7BQa1ywAAAIE"]
[Sat Feb 28 08:56:28.727231 2026] [:error] [pid 11791:tid 11796] [client 13.71.191.191:33619] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaI9PGuX5e1Q32gqxH1QBQAAAQM"]
[Sat Feb 28 08:56:29.136834 2026] [:error] [pid 22194:tid 22201] [client 13.71.191.191:33691] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaI9PX6mbajs3bzQGyvBVAAAAUU"]
[Sat Feb 28 08:56:29.555947 2026] [:error] [pid 22194:tid 22219] [client 13.71.191.191:33655] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaI9PX6mbajs3bzQGyvBWwAAAVc"]
[Sat Feb 28 08:56:29.951350 2026] [:error] [pid 11791:tid 11794] [client 20.216.146.160:35708] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI9PWuX5e1Q32gqxH1QPQAAAQE"]
[Sat Feb 28 08:56:29.967382 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:33634] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaI9PWuX5e1Q32gqxH1QPgAAAQw"]
[Sat Feb 28 08:56:30.375262 2026] [:error] [pid 22194:tid 22214] [client 13.71.191.191:33605] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaI9Pn6mbajs3bzQGyvBZgAAAVI"]
[Sat Feb 28 08:56:30.785730 2026] [:error] [pid 39185:tid 39259] [client 13.71.191.191:33601] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaI9PhVE-FfM89u7BQa12wAAAI0"]
[Sat Feb 28 08:56:31.202632 2026] [:error] [pid 22194:tid 22197] [client 13.71.191.191:33623] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaI9P36mbajs3bzQGyvBdwAAAUE"]
[Sat Feb 28 08:56:31.611678 2026] [:error] [pid 22194:tid 22220] [client 13.71.191.191:33711] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaI9P36mbajs3bzQGyvBhwAAAVg"]
[Sat Feb 28 08:56:31.793789 2026] [:error] [pid 11791:tid 11803] [client 20.216.146.160:38344] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI9P2uX5e1Q32gqxH1QawAAAQo"]
[Sat Feb 28 08:56:32.019188 2026] [:error] [pid 11791:tid 11799] [client 13.71.191.191:33718] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaI9QGuX5e1Q32gqxH1QcgAAAQY"]
[Sat Feb 28 08:56:32.431181 2026] [:error] [pid 11791:tid 11807] [client 13.71.191.191:33694] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaI9QGuX5e1Q32gqxH1QfgAAAQ4"]
[Sat Feb 28 08:56:32.845360 2026] [:error] [pid 39292:tid 39316] [client 13.71.191.191:33788] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaI9QKIAO5fN7BxyqcFMaAAAANY"]
[Sat Feb 28 08:56:33.139255 2026] [:error] [pid 11791:tid 11815] [client 20.216.146.160:36993] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-monamon.php"] [unique_id "aaI9QWuX5e1Q32gqxH1QjwAAARY"]
[Sat Feb 28 08:56:33.255087 2026] [:error] [pid 22194:tid 22202] [client 13.71.191.191:33708] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaI9QX6mbajs3bzQGyvBvgAAAUY"]
[Sat Feb 28 08:56:33.667749 2026] [:error] [pid 22194:tid 22202] [client 13.71.191.191:33764] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI9QX6mbajs3bzQGyvByQAAAUY"]
[Sat Feb 28 08:56:34.081518 2026] [:error] [pid 39183:tid 39207] [client 13.71.191.191:33607] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI9QhCf4HvhVePw3LarvAAAAA8"]
[Sat Feb 28 08:56:34.510193 2026] [:error] [pid 11791:tid 11817] [client 13.71.191.191:33672] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI9QmuX5e1Q32gqxH1QrwAAARg"]
[Sat Feb 28 08:56:34.953108 2026] [:error] [pid 11791:tid 11800] [client 13.71.191.191:33574] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI9QmuX5e1Q32gqxH1QuQAAAQc"]
[Sat Feb 28 08:56:35.382984 2026] [:error] [pid 22194:tid 22219] [client 13.71.191.191:33692] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaI9Q36mbajs3bzQGyvB2QAAAVc"]
[Sat Feb 28 08:56:35.882346 2026] [:error] [pid 39184:tid 39238] [client 13.71.191.191:33601] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaI9Q1tZF9Zd_U7easCPCQAAAFM"]
[Sat Feb 28 08:56:36.822664 2026] [:error] [pid 39185:tid 39268] [client 13.71.191.191:33688] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaI9RBVE-FfM89u7BQa1_gAAAJY"]
[Sat Feb 28 08:56:37.509740 2026] [:error] [pid 39184:tid 39226] [client 13.71.191.191:33571] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaI9RVtZF9Zd_U7easCPEAAAAEc"]
[Sat Feb 28 08:56:38.028115 2026] [:error] [pid 22194:tid 22203] [client 13.71.191.191:33646] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaI9Rn6mbajs3bzQGyvB_gAAAUc"]
[Sat Feb 28 08:56:38.504141 2026] [:error] [pid 11791:tid 11812] [client 13.71.191.191:33722] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaI9RmuX5e1Q32gqxH1RCAAAARM"]
[Sat Feb 28 08:56:38.793824 2026] [:error] [pid 22194:tid 22214] [client 20.216.146.160:34500] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-monamon.php"] [unique_id "aaI9Rn6mbajs3bzQGyvCBwAAAVI"]
[Sat Feb 28 08:56:39.183144 2026] [:error] [pid 22194:tid 22201] [client 13.71.191.191:33558] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaI9R36mbajs3bzQGyvCDwAAAUU"]
[Sat Feb 28 08:56:39.699488 2026] [:error] [pid 11791:tid 11803] [client 13.71.191.191:33545] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaI9R2uX5e1Q32gqxH1RIAAAAQo"]
[Sat Feb 28 08:56:40.192201 2026] [:error] [pid 39185:tid 39264] [client 13.71.191.191:33724] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaI9SBVE-FfM89u7BQa2HQAAAJI"]
[Sat Feb 28 08:56:40.643354 2026] [:error] [pid 39292:tid 39300] [client 13.71.191.191:33762] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaI9SKIAO5fN7BxyqcFMqAAAAMY"]
[Sat Feb 28 08:56:41.056452 2026] [:error] [pid 39185:tid 39250] [client 13.71.191.191:33537] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaI9SRVE-FfM89u7BQa2IQAAAIQ"]
[Sat Feb 28 08:56:41.471437 2026] [:error] [pid 11791:tid 11796] [client 13.71.191.191:33685] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaI9SWuX5e1Q32gqxH1ROAAAAQM"]
[Sat Feb 28 08:56:41.892184 2026] [:error] [pid 39292:tid 39311] [client 13.71.191.191:33624] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6ijmjpa.php"] [unique_id "aaI9SaIAO5fN7BxyqcFMwwAAANE"]
[Sat Feb 28 08:56:42.301044 2026] [:error] [pid 39184:tid 39220] [client 13.71.191.191:33559] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6ijmjpa.php"] [unique_id "aaI9SltZF9Zd_U7easCPMgAAAEE"]
[Sat Feb 28 08:56:42.708404 2026] [:error] [pid 39184:tid 39221] [client 13.71.191.191:33707] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6ijmjpa.php"] [unique_id "aaI9SltZF9Zd_U7easCPNgAAAEI"]
[Sat Feb 28 08:56:43.125651 2026] [:error] [pid 22194:tid 22213] [client 13.71.191.191:33633] File does not exist: /usr/local/apache/htdocs/suspended-page/f6ijmjpa.php
[Sat Feb 28 08:56:43.333376 2026] [:error] [pid 22194:tid 22196] [client 13.71.191.191:33633] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_jVML8V37.php
[Sat Feb 28 08:56:43.539614 2026] [:error] [pid 22194:tid 22215] [client 13.71.191.191:33633] File does not exist: /usr/local/apache/htdocs/suspended-page/4wj632p1.php
[Sat Feb 28 08:56:43.753110 2026] [:error] [pid 22194:tid 22205] [client 13.71.191.191:33633] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Sat Feb 28 08:56:43.961081 2026] [:error] [pid 22194:tid 22220] [client 13.71.191.191:33633] File does not exist: /usr/local/apache/htdocs/suspended-page/e31hmf9b.php
[Sat Feb 28 08:56:44.581968 2026] [:error] [pid 11791:tid 11805] [client 20.216.146.160:34556] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-monamon.php"] [unique_id "aaI9TGuX5e1Q32gqxH1RZQAAAQw"]
[Sat Feb 28 08:56:46.459754 2026] [:error] [pid 11791:tid 11800] [client 20.216.146.160:40256] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-monamon.php"] [unique_id "aaI9TmuX5e1Q32gqxH1RjgAAAQc"]
[Sat Feb 28 08:56:49.555149 2026] [:error] [pid 11791:tid 11805] [client 20.216.146.160:51435] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aaI9UWuX5e1Q32gqxH1RzwAAAQw"]
[Sat Feb 28 08:56:50.941362 2026] [:error] [pid 39185:tid 39251] [client 20.216.146.160:19403] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/"] [unique_id "aaI9UhVE-FfM89u7BQa2aAAAAIU"]
[Sat Feb 28 08:56:55.842074 2026] [:error] [pid 22194:tid 22209] [client 20.216.146.160:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Feb 28 08:56:56.085038 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 28 08:56:56.326009 2026] [:error] [pid 22194:tid 22199] [client 20.216.146.160:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Sat Feb 28 08:56:56.564029 2026] [:error] [pid 22194:tid 22207] [client 20.216.146.160:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/zsec.php
[Sat Feb 28 08:56:57.063343 2026] [:error] [pid 22194:tid 22216] [client 20.216.146.160:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/hi.php
[Sat Feb 28 08:56:58.072279 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:30107] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaI9Wn6mbajs3bzQGyvDNAAAAUw"]
[Sat Feb 28 08:57:00.366334 2026] [:error] [pid 39183:tid 39210] [client 20.216.146.160:46309] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaI9XBCf4HvhVePw3LasIgAAABI"]
[Sat Feb 28 08:57:02.322849 2026] [:error] [pid 22194:tid 22215] [client 20.216.146.160:28948] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaI9Xn6mbajs3bzQGyvDcwAAAVM"]
[Sat Feb 28 08:57:05.538492 2026] [:error] [pid 22194:tid 22212] [client 20.216.146.160:47097] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaI9YX6mbajs3bzQGyvDoQAAAVA"]
[Sat Feb 28 08:57:07.403033 2026] [:error] [pid 39185:tid 39256] [client 20.216.146.160:20307] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI9YxVE-FfM89u7BQa20AAAAIo"]
[Sat Feb 28 08:57:08.242399 2026] [:error] [pid 39184:tid 39220] [client 20.216.146.160:20344] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI9ZFtZF9Zd_U7easCQIQAAAEE"]
[Sat Feb 28 08:57:13.055757 2026] [:error] [pid 39184:tid 39224] [client 20.216.146.160:48434] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI9aVtZF9Zd_U7easCQUQAAAEU"]
[Sat Feb 28 08:57:15.644648 2026] [:error] [pid 22194:tid 22215] [client 20.216.146.160:34754] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "aaI9a36mbajs3bzQGyvD9wAAAVM"]
[Sat Feb 28 08:57:17.287680 2026] [:error] [pid 39184:tid 39230] [client 20.216.146.160:37366] [client 20.216.146.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaI9bVtZF9Zd_U7easCQbwAAAEs"]
[Sat Feb 28 08:57:18.841212 2026] [:error] [pid 39292:tid 39303] [client 20.216.146.160:18950] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aaI9bqIAO5fN7BxyqcFOMAAAAMk"]
[Sat Feb 28 08:57:26.291128 2026] [:error] [pid 39185:tid 39250] [client 20.216.146.160:27405] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aaI9dhVE-FfM89u7BQa3hQAAAIQ"]
[Sat Feb 28 08:57:29.144243 2026] [:error] [pid 39183:tid 39214] [client 20.216.146.160:18122] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aaI9eRCf4HvhVePw3Las2QAAABY"]
[Sat Feb 28 08:57:33.414239 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:18166] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new/index.php"] [unique_id "aaI9faIAO5fN7BxyqcFOyAAAANE"]
[Sat Feb 28 08:57:35.501200 2026] [:error] [pid 39292:tid 39294] [client 20.216.146.160:47793] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new/index.php"] [unique_id "aaI9f6IAO5fN7BxyqcFO3QAAAMA"]
[Sat Feb 28 08:57:37.707194 2026] [:error] [pid 11791:tid 11812] [client 20.216.146.160:19269] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new/index.php"] [unique_id "aaI9gWuX5e1Q32gqxH1UlAAAARM"]
[Sat Feb 28 08:57:38.899032 2026] [:error] [pid 11791:tid 11817] [client 20.216.146.160:51388] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new/index.php"] [unique_id "aaI9gmuX5e1Q32gqxH1UtwAAARg"]
[Sat Feb 28 08:57:41.035460 2026] [:error] [pid 11791:tid 11793] [client 20.216.146.160:51387] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/dist/"] [unique_id "aaI9hWuX5e1Q32gqxH1U4gAAAQA"]
[Sat Feb 28 08:57:41.999998 2026] [:error] [pid 39185:tid 39255] [client 20.216.146.160:50880] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/dist/"] [unique_id "aaI9hRVE-FfM89u7BQa4DwAAAIk"]
[Sat Feb 28 08:57:42.864506 2026] [:error] [pid 22194:tid 22206] [client 20.216.146.160:7593] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/dist/"] [unique_id "aaI9hn6mbajs3bzQGyvFYAAAAUo"]
[Sat Feb 28 08:57:44.584956 2026] [:error] [pid 11791:tid 11802] [client 20.216.146.160:51331] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/dist/"] [unique_id "aaI9iGuX5e1Q32gqxH1VIQAAAQk"]
[Sat Feb 28 08:57:47.014851 2026] [:error] [pid 39292:tid 39298] [client 20.216.146.160:30272] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaI9i6IAO5fN7BxyqcFPbAAAAMQ"]
[Sat Feb 28 08:57:50.841194 2026] [:error] [pid 39185:tid 39256] [client 20.216.146.160:34731] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaI9jhVE-FfM89u7BQa4gQAAAIo"]
[Sat Feb 28 08:57:54.686276 2026] [:error] [pid 22194:tid 22202] [client 20.216.146.160:15370] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaI9kn6mbajs3bzQGyvF7QAAAUY"]
[Sat Feb 28 08:57:56.968200 2026] [:error] [pid 11791:tid 11798] [client 20.216.146.160:44184] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaI9lGuX5e1Q32gqxH1WLQAAAQU"]
[Sat Feb 28 08:57:59.345904 2026] [:error] [pid 11791:tid 11797] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/wc49.php
[Sat Feb 28 08:57:59.601801 2026] [:error] [pid 11791:tid 11815] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/TL.php
[Sat Feb 28 08:57:59.842260 2026] [:error] [pid 11791:tid 11802] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Sat Feb 28 08:58:00.091884 2026] [:error] [pid 11791:tid 11799] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/fck.php
[Sat Feb 28 08:58:00.332969 2026] [:error] [pid 11791:tid 11800] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Sat Feb 28 08:58:00.589446 2026] [:error] [pid 11791:tid 11811] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Sat Feb 28 08:58:00.830276 2026] [:error] [pid 11791:tid 11797] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/nw2.php
[Sat Feb 28 08:58:01.075231 2026] [:error] [pid 11791:tid 11808] [client 20.216.146.160:18554] File does not exist: /usr/local/apache/htdocs/suspended-page/blackmini.php
[Sat Feb 28 08:58:01.326333 2026] [:error] [pid 11791:tid 11793] [client 20.216.146.160:18554] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaI9mWuX5e1Q32gqxH1WuQAAAQA"]
[Sat Feb 28 08:58:02.118122 2026] [:error] [pid 39184:tid 39224] [client 20.216.146.160:24611] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaI9mltZF9Zd_U7easCRsgAAAEU"]
[Sat Feb 28 08:58:03.146162 2026] [:error] [pid 39184:tid 39220] [client 20.216.146.160:24632] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaI9m1tZF9Zd_U7easCRtgAAAEE"]
[Sat Feb 28 08:58:04.487681 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:24798] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaI9nH6mbajs3bzQGyvGVgAAAVU"]
[Sat Feb 28 08:58:05.769296 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:24602] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaI9nX6mbajs3bzQGyvGbQAAAUc"]
[Sat Feb 28 08:58:07.726489 2026] [:error] [pid 39185:tid 39257] [client 20.216.146.160:18534] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaI9nxVE-FfM89u7BQa5QwAAAIs"]
[Sat Feb 28 08:58:10.388193 2026] [:error] [pid 11791:tid 11808] [client 20.216.146.160:18549] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaI9omuX5e1Q32gqxH1XFwAAAQ8"]
[Sat Feb 28 08:58:11.497517 2026] [:error] [pid 11791:tid 11812] [client 20.216.146.160:18531] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaI9o2uX5e1Q32gqxH1XKgAAARM"]
[Sat Feb 28 08:58:13.636627 2026] [:error] [pid 39185:tid 39258] [client 20.216.146.160:15399] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaI9pRVE-FfM89u7BQa5nQAAAIw"]
[Sat Feb 28 08:58:14.829525 2026] [:error] [pid 39183:tid 39207] [client 20.216.146.160:34136] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaI9phCf4HvhVePw3LaugAAAAA8"]
[Sat Feb 28 08:58:16.927224 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:51740] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaI9qH6mbajs3bzQGyvG7AAAAVU"]
[Sat Feb 28 08:58:18.845056 2026] [:error] [pid 11791:tid 11808] [client 20.216.146.160:37292] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaI9qmuX5e1Q32gqxH1XtAAAAQ8"]
[Sat Feb 28 08:58:21.887914 2026] [:error] [pid 39185:tid 39250] [client 20.216.146.160:42783] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaI9rRVE-FfM89u7BQa54AAAAIQ"]
[Sat Feb 28 08:58:23.063346 2026] [:error] [pid 11791:tid 11813] [client 20.216.146.160:27110] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaI9r2uX5e1Q32gqxH1X8gAAARQ"]
[Sat Feb 28 08:58:24.112980 2026] [:error] [pid 39292:tid 39314] [client 20.216.146.160:48407] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaI9sKIAO5fN7BxyqcFRAwAAANQ"]
[Sat Feb 28 08:58:27.344168 2026] [:error] [pid 22194:tid 22211] [client 20.216.146.160:7469] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaI9s36mbajs3bzQGyvHigAAAU8"]
[Sat Feb 28 08:58:31.427258 2026] [:error] [pid 11791:tid 11810] [client 20.216.146.160:27099] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaI9t2uX5e1Q32gqxH1YywAAARE"]
[Sat Feb 28 08:58:34.315152 2026] [:error] [pid 11791:tid 11804] [client 20.216.146.160:51530] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaI9umuX5e1Q32gqxH1ZJgAAAQs"]
[Sat Feb 28 08:58:35.200261 2026] [:error] [pid 39184:tid 39220] [client 20.216.146.160:49180] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaI9u1tZF9Zd_U7easCS4AAAAEE"]
[Sat Feb 28 08:58:38.025523 2026] [:error] [pid 11791:tid 11811] [client 20.216.146.160:34133] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaI9vmuX5e1Q32gqxH1ZYgAAARI"]
[Sat Feb 28 08:58:39.909605 2026] [:error] [pid 39184:tid 39242] [client 20.216.146.160:26986] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaI9v1tZF9Zd_U7easCTDAAAAFc"]
[Sat Feb 28 08:58:42.018692 2026] [:error] [pid 22194:tid 22198] [client 20.216.146.160:20545] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaI9wn6mbajs3bzQGyvIdwAAAUI"]
[Sat Feb 28 08:58:42.857318 2026] [:error] [pid 22194:tid 22201] [client 20.216.146.160:6838] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaI9wn6mbajs3bzQGyvIjQAAAUU"]
[Sat Feb 28 08:58:44.118293 2026] [:error] [pid 39292:tid 39317] [client 20.216.146.160:34897] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaI9xKIAO5fN7BxyqcFRzQAAANc"]
[Sat Feb 28 08:58:49.513170 2026] [:error] [pid 39185:tid 39258] [client 20.216.146.160:20580] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaI9yRVE-FfM89u7BQa6lgAAAIw"]
[Sat Feb 28 08:58:52.352975 2026] [:error] [pid 39183:tid 39193] [client 20.216.146.160:34882] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaI9zBCf4HvhVePw3Lav_QAAAAE"]
[Sat Feb 28 08:58:54.217967 2026] [:error] [pid 39184:tid 39241] [client 20.216.146.160:24858] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaI9zltZF9Zd_U7easCThgAAAFY"]
[Sat Feb 28 08:58:56.569121 2026] [:error] [pid 22194:tid 22211] [client 20.216.146.160:19645] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaI90H6mbajs3bzQGyvJhgAAAU8"]
[Sat Feb 28 08:58:58.073725 2026] [:error] [pid 39184:tid 39223] [client 20.216.146.160:6721] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aaI90ltZF9Zd_U7easCTzwAAAEQ"]
[Sat Feb 28 08:58:59.599603 2026] [:error] [pid 39185:tid 39259] [client 20.216.146.160:19643] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aaI90xVE-FfM89u7BQa7EwAAAI0"]
[Sat Feb 28 08:59:00.940801 2026] [:error] [pid 39185:tid 39253] [client 20.216.146.160:18713] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aaI91BVE-FfM89u7BQa7NQAAAIc"]
[Sat Feb 28 08:59:02.001103 2026] [:error] [pid 39292:tid 39294] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sat Feb 28 08:59:02.240876 2026] [:error] [pid 39292:tid 39295] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sat Feb 28 08:59:02.483128 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/zu.php
[Sat Feb 28 08:59:02.721542 2026] [:error] [pid 39292:tid 39312] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Sat Feb 28 08:59:02.968901 2026] [:error] [pid 39292:tid 39301] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Sat Feb 28 08:59:03.209004 2026] [:error] [pid 39292:tid 39302] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sat Feb 28 08:59:03.450724 2026] [:error] [pid 39292:tid 39314] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/ze.php
[Sat Feb 28 08:59:03.705154 2026] [:error] [pid 39292:tid 39300] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/seetox.php
[Sat Feb 28 08:59:04.260371 2026] [:error] [pid 39292:tid 39305] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sat Feb 28 08:59:04.501885 2026] [:error] [pid 39292:tid 39310] [client 20.216.146.160:16387] File does not exist: /usr/local/apache/htdocs/suspended-page/xoot.php
[Sat Feb 28 08:59:04.738168 2026] [:error] [pid 39292:tid 39318] [client 20.216.146.160:16387] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaI92KIAO5fN7BxyqcFS0QAAANg"]
[Sat Feb 28 08:59:07.350815 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:18722] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaI9236mbajs3bzQGyvJ_wAAAUA"]
[Sat Feb 28 08:59:08.259802 2026] [:error] [pid 39292:tid 39304] [client 20.216.146.160:18736] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaI93KIAO5fN7BxyqcFTGwAAAMo"]
[Sat Feb 28 08:59:09.412426 2026] [:error] [pid 39292:tid 39304] [client 20.216.146.160:19327] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaI93aIAO5fN7BxyqcFTLQAAAMo"]
[Sat Feb 28 08:59:11.054793 2026] [:error] [pid 39185:tid 39246] [client 20.216.146.160:24216] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaI93xVE-FfM89u7BQa7sgAAAIA"]
[Sat Feb 28 08:59:13.239636 2026] [:error] [pid 39183:tid 39201] [client 20.216.146.160:34115] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaI94RCf4HvhVePw3LawpAAAAAk"]
[Sat Feb 28 08:59:15.130792 2026] [:error] [pid 39185:tid 39266] [client 20.216.146.160:27422] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaI94xVE-FfM89u7BQa78gAAAJQ"]
[Sat Feb 28 08:59:17.662502 2026] [:error] [pid 39185:tid 39250] [client 20.216.146.160:26276] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "aaI95RVE-FfM89u7BQa8CAAAAIQ"]
[Sat Feb 28 08:59:19.247181 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:6945] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaI952uX5e1Q32gqxH1b6AAAARU"]
[Sat Feb 28 08:59:22.683776 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:50550] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaI96n6mbajs3bzQGyvKyQAAAUc"]
[Sat Feb 28 08:59:23.763135 2026] [:error] [pid 11791:tid 11808] [client 20.216.146.160:34131] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaI962uX5e1Q32gqxH1cLwAAAQ8"]
[Sat Feb 28 08:59:25.190483 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:38597] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaI97WuX5e1Q32gqxH1cTgAAARU"]
[Sat Feb 28 08:59:26.491933 2026] [:error] [pid 39184:tid 39236] [client 20.216.146.160:7101] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aaI97ltZF9Zd_U7easCUrgAAAFE"]
[Sat Feb 28 08:59:28.209995 2026] [:error] [pid 11791:tid 11805] [client 20.216.146.160:34132] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aaI98GuX5e1Q32gqxH1ccgAAAQw"]
[Sat Feb 28 08:59:30.899596 2026] [:error] [pid 39292:tid 39295] [client 20.216.146.160:50536] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aaI98qIAO5fN7BxyqcFULQAAAME"]
[Sat Feb 28 08:59:31.810450 2026] [:error] [pid 39183:tid 39198] [client 20.216.146.160:38639] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "aaI98xCf4HvhVePw3LaxIAAAAAY"]
[Sat Feb 28 08:59:34.724663 2026] [:error] [pid 39292:tid 39301] [client 20.216.146.160:27416] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aaI99qIAO5fN7BxyqcFUbQAAAMc"]
[Sat Feb 28 08:59:37.052034 2026] [:error] [pid 11791:tid 11806] [client 20.216.146.160:40374] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aaI9-WuX5e1Q32gqxH1c6wAAAQ0"]
[Sat Feb 28 08:59:40.104317 2026] [:error] [pid 11791:tid 11798] [client 20.216.146.160:50546] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aaI9_GuX5e1Q32gqxH1dGQAAAQU"]
[Sat Feb 28 08:59:41.392881 2026] [:error] [pid 39185:tid 39255] [client 20.216.146.160:50499] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/er.php"] [unique_id "aaI9_RVE-FfM89u7BQa9LQAAAIk"]
[Sat Feb 28 08:59:43.708022 2026] [:error] [pid 22194:tid 22207] [client 20.216.146.160:20195] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aaI9_36mbajs3bzQGyvLzwAAAUs"]
[Sat Feb 28 08:59:45.032108 2026] [:error] [pid 39184:tid 39223] [client 20.216.146.160:50689] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aaI-AVtZF9Zd_U7easCVWAAAAEQ"]
[Sat Feb 28 08:59:47.951660 2026] [:error] [pid 11791:tid 11810] [client 20.216.146.160:34165] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aaI-A2uX5e1Q32gqxH1dtAAAARE"]
[Sat Feb 28 08:59:52.259612 2026] [:error] [pid 39292:tid 39297] [client 20.216.146.160:29177] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fault.php"] [unique_id "aaI-CKIAO5fN7BxyqcFVIAAAAMM"]
[Sat Feb 28 08:59:57.123206 2026] [:error] [pid 39292:tid 39310] [client 20.216.146.160:51862] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaI-DaIAO5fN7BxyqcFVjwAAANA"]
[Sat Feb 28 08:59:57.956083 2026] [:error] [pid 22194:tid 22204] [client 20.216.146.160:41542] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaI-DX6mbajs3bzQGyvMYwAAAUg"]
[Sat Feb 28 08:59:59.059429 2026] [:error] [pid 39184:tid 39223] [client 20.216.146.160:27442] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaI-D1tZF9Zd_U7easCVywAAAEQ"]
[Sat Feb 28 08:59:59.827282 2026] [:error] [pid 22194:tid 22202] [client 20.216.146.160:52125] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaI-D36mbajs3bzQGyvMcgAAAUY"]
[Sat Feb 28 09:00:01.010411 2026] [:error] [pid 39292:tid 39317] [client 20.216.146.160:20214] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aaI-EaIAO5fN7BxyqcFVtAAAANc"]
[Sat Feb 28 09:00:01.919150 2026] [:error] [pid 39184:tid 39236] [client 20.216.146.160:20212] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aaI-EVtZF9Zd_U7easCV7gAAAFE"]
[Sat Feb 28 09:00:03.152767 2026] [:error] [pid 39185:tid 39267] [client 20.216.146.160:29121] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aaI-ExVE-FfM89u7BQa-kQAAAJU"]
[Sat Feb 28 09:00:09.834424 2026] [:error] [pid 39183:tid 39206] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sat Feb 28 09:00:10.073695 2026] [:error] [pid 39183:tid 39195] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/leuk.php
[Sat Feb 28 09:00:10.313328 2026] [:error] [pid 39183:tid 39197] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Sat Feb 28 09:00:10.567702 2026] [:error] [pid 39183:tid 39203] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/kolda.php
[Sat Feb 28 09:00:10.809540 2026] [:error] [pid 39183:tid 39216] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Sat Feb 28 09:00:11.053469 2026] [:error] [pid 39183:tid 39192] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sat Feb 28 09:00:11.294821 2026] [:error] [pid 39183:tid 39199] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sat Feb 28 09:00:11.544694 2026] [:error] [pid 39183:tid 39215] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/un.php
[Sat Feb 28 09:00:11.785351 2026] [:error] [pid 39183:tid 39195] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Sat Feb 28 09:00:12.035150 2026] [:error] [pid 39183:tid 39201] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Sat Feb 28 09:00:12.278085 2026] [:error] [pid 39183:tid 39198] [client 20.216.146.160:37714] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Sat Feb 28 09:00:12.535957 2026] [:error] [pid 39183:tid 39193] [client 20.216.146.160:37714] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaI-HBCf4HvhVePw3LaydAAAAAE"]
[Sat Feb 28 09:00:13.667167 2026] [:error] [pid 39292:tid 39294] [client 20.216.146.160:6667] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaI-HaIAO5fN7BxyqcFWMQAAAMA"]
[Sat Feb 28 09:00:15.143147 2026] [:error] [pid 39184:tid 39229] [client 20.216.146.160:43278] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaI-H1tZF9Zd_U7easCWlwAAAEo"]
[Sat Feb 28 09:00:16.339254 2026] [:error] [pid 39184:tid 39225] [client 20.216.146.160:47025] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaI-IFtZF9Zd_U7easCWrwAAAEY"]
[Sat Feb 28 09:00:17.388460 2026] [:error] [pid 11791:tid 11816] [client 20.216.146.160:6688] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI-IWuX5e1Q32gqxH1f0gAAARc"]
[Sat Feb 28 09:00:18.735008 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:22928] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI-In6mbajs3bzQGyvNPQAAAUA"]
[Sat Feb 28 09:00:19.904328 2026] [:error] [pid 39292:tid 39299] [client 20.216.146.160:31819] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI-I6IAO5fN7BxyqcFWaAAAAMU"]
[Sat Feb 28 09:00:21.131123 2026] [:error] [pid 39183:tid 39207] [client 20.216.146.160:51521] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaI-JRCf4HvhVePw3LazUAAAAA8"]
[Sat Feb 28 09:00:23.589524 2026] [:error] [pid 39185:tid 39251] [client 20.216.146.160:17966] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaI-JxVE-FfM89u7BQa_jwAAAIU"]
[Sat Feb 28 09:00:25.241319 2026] [:error] [pid 11791:tid 11800] [client 20.216.146.160:25592] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaI-KWuX5e1Q32gqxH1gVwAAAQc"]
[Sat Feb 28 09:00:26.350913 2026] [:error] [pid 39185:tid 39252] [client 20.216.146.160:49564] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaI-KhVE-FfM89u7BQa_pAAAAIY"]
[Sat Feb 28 09:00:28.297971 2026] [:error] [pid 11791:tid 11794] [client 20.216.146.160:49594] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaI-LGuX5e1Q32gqxH1gtQAAAQE"]
[Sat Feb 28 09:00:30.001318 2026] [:error] [pid 39183:tid 39201] [client 20.216.146.160:31599] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaI-LhCf4HvhVePw3LazfAAAAAk"]
[Sat Feb 28 09:00:30.740617 2026] [:error] [pid 39292:tid 39299] [client 20.216.146.160:24391] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaI-LqIAO5fN7BxyqcFWsAAAAMU"]
[Sat Feb 28 09:00:31.779523 2026] [:error] [pid 39183:tid 39206] [client 20.216.146.160:24413] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaI-LxCf4HvhVePw3LazfgAAAA4"]
[Sat Feb 28 09:00:33.824097 2026] [:error] [pid 39292:tid 39302] [client 20.216.146.160:49577] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaI-MaIAO5fN7BxyqcFWywAAAMg"]
[Sat Feb 28 09:00:34.868881 2026] [:error] [pid 39185:tid 39247] [client 20.216.146.160:14358] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaI-MhVE-FfM89u7BQa_9QAAAIE"]
[Sat Feb 28 09:00:36.599867 2026] [:error] [pid 39183:tid 39212] [client 20.216.146.160:14364] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaI-NBCf4HvhVePw3LazoQAAABQ"]
[Sat Feb 28 09:00:40.039909 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:25564] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaI-OKIAO5fN7BxyqcFXIQAAANY"]
[Sat Feb 28 09:00:41.112238 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:49574] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaI-OX6mbajs3bzQGyvOTQAAAVU"]
[Sat Feb 28 09:00:44.000772 2026] [:error] [pid 22194:tid 22213] [client 20.216.146.160:41128] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaI-O36mbajs3bzQGyvOcAAAAVE"]
[Sat Feb 28 09:00:45.480307 2026] [:error] [pid 11791:tid 11807] [client 20.216.146.160:51568] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaI-PWuX5e1Q32gqxH1iIAAAAQ4"]
[Sat Feb 28 09:00:47.237972 2026] [:error] [pid 39292:tid 39295] [client 20.216.146.160:25566] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaI-P6IAO5fN7BxyqcFXegAAAME"]
[Sat Feb 28 09:00:48.856048 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:31828] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaI-QH6mbajs3bzQGyvOqAAAAU4"]
[Sat Feb 28 09:00:53.563252 2026] [:error] [pid 39292:tid 39304] [client 20.216.146.160:7018] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI-RaIAO5fN7BxyqcFX7QAAAMo"]
[Sat Feb 28 09:00:55.421261 2026] [:error] [pid 22194:tid 22219] [client 20.216.146.160:41481] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI-R36mbajs3bzQGyvO_wAAAVc"]
[Sat Feb 28 09:00:59.804785 2026] [:error] [pid 39184:tid 39235] [client 20.216.146.160:51551] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI-S1tZF9Zd_U7easCXtwAAAFA"]
[Sat Feb 28 09:01:01.655555 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:48458] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaI-TWuX5e1Q32gqxH1jIQAAARU"]
[Sat Feb 28 09:01:03.069780 2026] [:error] [pid 39184:tid 39226] [client 20.216.146.160:29584] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI-T1tZF9Zd_U7easCXzAAAAEc"]
[Sat Feb 28 09:01:05.471644 2026] [:error] [pid 22194:tid 22211] [client 20.216.146.160:39213] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI-UX6mbajs3bzQGyvPywAAAU8"]
[Sat Feb 28 09:01:07.440789 2026] [:error] [pid 39292:tid 39314] [client 20.216.146.160:39390] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI-U6IAO5fN7BxyqcFYhAAAANQ"]
[Sat Feb 28 09:01:09.196408 2026] [:error] [pid 11791:tid 11794] [client 20.216.146.160:43759] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaI-VWuX5e1Q32gqxH1jsgAAAQE"]
[Sat Feb 28 09:01:11.287976 2026] [:error] [pid 22194:tid 22214] [client 20.216.146.160:25434] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/06.php"] [unique_id "aaI-V36mbajs3bzQGyvQYwAAAVI"]
[Sat Feb 28 09:01:13.268411 2026] [:error] [pid 22194:tid 22219] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Sat Feb 28 09:01:13.506108 2026] [:error] [pid 22194:tid 22220] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Feb 28 09:01:13.755232 2026] [:error] [pid 22194:tid 22211] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/fot.php
[Sat Feb 28 09:01:14.043007 2026] [:error] [pid 22194:tid 22207] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Sat Feb 28 09:01:14.279585 2026] [:error] [pid 22194:tid 22206] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Sat Feb 28 09:01:14.520425 2026] [:error] [pid 22194:tid 22219] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 09:01:14.757890 2026] [:error] [pid 22194:tid 22205] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Sat Feb 28 09:01:15.057821 2026] [:error] [pid 22194:tid 22220] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/ffd.php
[Sat Feb 28 09:01:15.355291 2026] [:error] [pid 22194:tid 22213] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/admiin.php
[Sat Feb 28 09:01:15.601210 2026] [:error] [pid 22194:tid 22200] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Sat Feb 28 09:01:15.838681 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:46302] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sat Feb 28 09:01:16.126323 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:46302] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-XH6mbajs3bzQGyvQpAAAAUw"]
[Sat Feb 28 09:01:17.356746 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:40261] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-XX6mbajs3bzQGyvQtQAAAUc"]
[Sat Feb 28 09:01:22.489620 2026] [:error] [pid 11791:tid 11803] [client 20.216.146.160:52372] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-YmuX5e1Q32gqxH1kqAAAAQo"]
[Sat Feb 28 09:01:23.669160 2026] [:error] [pid 39292:tid 39302] [client 20.216.146.160:39375] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-Y6IAO5fN7BxyqcFZbgAAAMg"]
[Sat Feb 28 09:01:26.972668 2026] [:error] [pid 11791:tid 11793] [client 20.216.146.160:14433] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaI-ZmuX5e1Q32gqxH1lDwAAAQA"]
[Sat Feb 28 09:01:29.160060 2026] [:error] [pid 11791:tid 11807] [client 20.216.146.160:25892] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaI-aWuX5e1Q32gqxH1lXgAAAQ4"]
[Sat Feb 28 09:01:30.565563 2026] [:error] [pid 39292:tid 39306] [client 20.216.146.160:50348] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaI-aqIAO5fN7BxyqcFZlwAAAMw"]
[Sat Feb 28 09:01:31.511210 2026] [:error] [pid 11791:tid 11798] [client 20.216.146.160:27769] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaI-a2uX5e1Q32gqxH1lkAAAAQU"]
[Sat Feb 28 09:01:35.367269 2026] [:error] [pid 39292:tid 39304] [client 20.216.146.160:6971] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aaI-b6IAO5fN7BxyqcFZtgAAAMo"]
[Sat Feb 28 09:01:36.901875 2026] [:error] [pid 11791:tid 11798] [client 20.216.146.160:25880] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aaI-cGuX5e1Q32gqxH1l_QAAAQU"]
[Sat Feb 28 09:01:39.004693 2026] [:error] [pid 39292:tid 39294] [client 20.216.146.160:25904] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aaI-c6IAO5fN7BxyqcFZ2gAAAMA"]
[Sat Feb 28 09:01:45.243213 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:27712] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "aaI-eX6mbajs3bzQGyvSHQAAAVU"]
[Sat Feb 28 09:01:47.169259 2026] [:error] [pid 22194:tid 22216] [client 20.216.146.160:21820] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaI-e36mbajs3bzQGyvSLgAAAVQ"]
[Sat Feb 28 09:01:49.454696 2026] [:error] [pid 39292:tid 39313] [client 20.216.146.160:27068] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaI-faIAO5fN7BxyqcFaSgAAANM"]
[Sat Feb 28 09:01:51.273849 2026] [:error] [pid 39183:tid 39205] [client 20.216.146.160:40689] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaI-fxCf4HvhVePw3La1EAAAAA0"]
[Sat Feb 28 09:01:54.609619 2026] [:error] [pid 39183:tid 39207] [client 20.216.146.160:7386] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaI-ghCf4HvhVePw3La1GAAAAA8"]
[Sat Feb 28 09:01:55.564204 2026] [:error] [pid 39185:tid 39259] [client 20.216.146.160:5066] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-gxVE-FfM89u7BQbCKAAAAI0"]
[Sat Feb 28 09:01:56.967035 2026] [:error] [pid 39183:tid 39199] [client 20.216.146.160:21786] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-hBCf4HvhVePw3La1HQAAAAc"]
[Sat Feb 28 09:01:58.642595 2026] [:error] [pid 39185:tid 39248] [client 20.216.146.160:18999] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-hhVE-FfM89u7BQbCQwAAAII"]
[Sat Feb 28 09:01:59.801654 2026] [:error] [pid 39292:tid 39303] [client 20.216.146.160:27038] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vxrl.php"] [unique_id "aaI-h6IAO5fN7BxyqcFa3wAAAMk"]
[Sat Feb 28 09:02:00.984962 2026] [:error] [pid 39292:tid 39307] [client 20.216.146.160:19000] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaI-iKIAO5fN7BxyqcFa9wAAAM0"]
[Sat Feb 28 09:02:02.815266 2026] [:error] [pid 22194:tid 22216] [client 20.216.146.160:34709] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaI-in6mbajs3bzQGyvSqAAAAVQ"]
[Sat Feb 28 09:02:04.594656 2026] [:error] [pid 22194:tid 22219] [client 20.216.146.160:34702] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaI-jH6mbajs3bzQGyvSxAAAAVc"]
[Sat Feb 28 09:02:06.818735 2026] [:error] [pid 11791:tid 11816] [client 20.216.146.160:7607] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaI-jmuX5e1Q32gqxH1n6AAAARc"]
[Sat Feb 28 09:02:08.034599 2026] [:error] [pid 11791:tid 11810] [client 20.216.146.160:44777] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaI-kGuX5e1Q32gqxH1n-gAAARE"]
[Sat Feb 28 09:02:08.738721 2026] [:error] [pid 39185:tid 39258] [client 20.216.146.160:7512] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaI-kBVE-FfM89u7BQbCiwAAAIw"]
[Sat Feb 28 09:02:10.070353 2026] [:error] [pid 39292:tid 39296] [client 20.216.146.160:7496] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaI-kqIAO5fN7BxyqcFbPwAAAMI"]
[Sat Feb 28 09:02:11.529083 2026] [:error] [pid 11791:tid 11809] [client 20.216.146.160:51378] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaI-k2uX5e1Q32gqxH1oLAAAARA"]
[Sat Feb 28 09:02:12.173352 2026] [:error] [pid 11791:tid 11805] [client 20.216.146.160:44744] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaI-lGuX5e1Q32gqxH1oOgAAAQw"]
[Sat Feb 28 09:02:15.698017 2026] [:error] [pid 22194:tid 22212] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Sat Feb 28 09:02:15.938471 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 28 09:02:16.180667 2026] [:error] [pid 22194:tid 22220] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/karak.php
[Sat Feb 28 09:02:16.423748 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Sat Feb 28 09:02:16.668683 2026] [:error] [pid 22194:tid 22211] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sat Feb 28 09:02:16.909149 2026] [:error] [pid 22194:tid 22214] [client 20.216.146.160:6938] [client 20.216.146.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.216.146.160, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaI-mH6mbajs3bzQGyvTmQAAAVI"]
[Sat Feb 28 09:02:16.913542 2026] [:error] [pid 22194:tid 22214] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 09:02:17.289729 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Sat Feb 28 09:02:17.551164 2026] [:error] [pid 22194:tid 22220] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Feb 28 09:02:17.929378 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Sat Feb 28 09:02:18.172639 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sat Feb 28 09:02:18.412332 2026] [:error] [pid 22194:tid 22200] [client 20.216.146.160:6938] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sat Feb 28 09:02:18.664673 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:6938] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI-mn6mbajs3bzQGyvTrAAAAUc"]
[Sat Feb 28 09:02:19.866470 2026] [:error] [pid 39292:tid 39318] [client 20.216.146.160:44747] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI-m6IAO5fN7BxyqcFbegAAANg"]
[Sat Feb 28 09:02:20.623864 2026] [:error] [pid 11791:tid 11807] [client 20.216.146.160:24788] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI-nGuX5e1Q32gqxH1o0wAAAQ4"]
[Sat Feb 28 09:02:22.315277 2026] [:error] [pid 39183:tid 39193] [client 20.216.146.160:48379] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaI-nhCf4HvhVePw3La1XgAAAAE"]
[Sat Feb 28 09:02:23.554077 2026] [:error] [pid 22194:tid 22218] [client 20.216.146.160:44754] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aaI-n36mbajs3bzQGyvTzwAAAVY"]
[Sat Feb 28 09:02:26.213051 2026] [:error] [pid 39185:tid 39262] [client 20.216.146.160:34703] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aaI-ohVE-FfM89u7BQbC1AAAAJA"]
[Sat Feb 28 09:02:29.391715 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:30278] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aaI-pWuX5e1Q32gqxH1pmAAAARU"]
[Sat Feb 28 09:02:30.834540 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:48377] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi.php"] [unique_id "aaI-pn6mbajs3bzQGyvT_AAAAU4"]
[Sat Feb 28 09:02:32.792265 2026] [:error] [pid 22194:tid 22219] [client 20.216.146.160:48332] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaI-qH6mbajs3bzQGyvUHwAAAVc"]
[Sat Feb 28 09:02:33.967183 2026] [:error] [pid 22194:tid 22200] [client 20.216.146.160:46879] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaI-qX6mbajs3bzQGyvUKAAAAUQ"]
[Sat Feb 28 09:02:34.932950 2026] [:error] [pid 22194:tid 22207] [client 20.216.146.160:20466] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaI-qn6mbajs3bzQGyvUNAAAAUs"]
[Sat Feb 28 09:02:36.401860 2026] [:error] [pid 22194:tid 22200] [client 20.216.146.160:26829] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaI-rH6mbajs3bzQGyvUSQAAAUQ"]
[Sat Feb 28 09:02:39.201201 2026] [:error] [pid 39183:tid 39215] [client 20.216.146.160:26585] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aaI-rxCf4HvhVePw3La1egAAABc"]
[Sat Feb 28 09:02:44.688117 2026] [:error] [pid 11791:tid 11795] [client 20.216.146.160:42765] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aaI-tGuX5e1Q32gqxH1qnwAAAQI"]
[Sat Feb 28 09:02:46.212177 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:15420] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aaI-tn6mbajs3bzQGyvUuAAAAVU"]
[Sat Feb 28 09:02:50.023308 2026] [:error] [pid 39185:tid 39270] [client 20.216.146.160:46885] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ov.php"] [unique_id "aaI-uhVE-FfM89u7BQbDQwAAAJg"]
[Sat Feb 28 09:02:51.585036 2026] [:error] [pid 39183:tid 39201] [client 20.216.146.160:50094] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaI-uxCf4HvhVePw3La1kwAAAAk"]
[Sat Feb 28 09:02:52.976991 2026] [:error] [pid 11791:tid 11798] [client 20.216.146.160:30553] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaI-vGuX5e1Q32gqxH1q8AAAAQU"]
[Sat Feb 28 09:02:53.801119 2026] [:error] [pid 39183:tid 39197] [client 20.216.146.160:50079] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaI-vRCf4HvhVePw3La1lwAAAAU"]
[Sat Feb 28 09:02:55.196864 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:21526] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaI-v36mbajs3bzQGyvVUAAAAUw"]
[Sat Feb 28 09:02:55.926913 2026] [:error] [pid 39185:tid 39260] [client 20.216.146.160:19942] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aaI-vxVE-FfM89u7BQbDWQAAAI4"]
[Sat Feb 28 09:02:57.683138 2026] [:error] [pid 39292:tid 39300] [client 20.216.146.160:50095] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aaI-waIAO5fN7BxyqcFcrgAAAMY"]
[Sat Feb 28 09:02:58.585481 2026] [:error] [pid 39292:tid 39300] [client 20.216.146.160:15420] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aaI-wqIAO5fN7BxyqcFcvAAAAMY"]
[Sat Feb 28 09:03:01.551025 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:19919] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/default.php"] [unique_id "aaI-xX6mbajs3bzQGyvVeAAAAUA"]
[Sat Feb 28 09:03:04.356347 2026] [:error] [pid 39185:tid 39267] [client 20.216.146.160:44222] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaI-yBVE-FfM89u7BQbDgQAAAJU"]
[Sat Feb 28 09:03:05.860109 2026] [:error] [pid 39184:tid 39219] [client 20.216.146.160:27101] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaI-yVtZF9Zd_U7easCZ4AAAAEA"]
[Sat Feb 28 09:03:07.046810 2026] [:error] [pid 11791:tid 11808] [client 20.216.146.160:26864] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaI-y2uX5e1Q32gqxH1rpAAAAQ8"]
[Sat Feb 28 09:03:08.804677 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:26819] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaI-zKIAO5fN7BxyqcFc9QAAANY"]
[Sat Feb 28 09:03:11.775802 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:48436] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaI-z36mbajs3bzQGyvWBwAAAUc"]
[Sat Feb 28 09:03:13.975595 2026] [:error] [pid 39185:tid 39268] [client 20.216.146.160:44203] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaI-0RVE-FfM89u7BQbD2wAAAJY"]
[Sat Feb 28 09:03:15.885101 2026] [:error] [pid 11791:tid 11813] [client 20.216.146.160:44205] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaI-02uX5e1Q32gqxH1sBwAAARQ"]
[Sat Feb 28 09:03:17.317720 2026] [:error] [pid 39184:tid 39222] [client 20.216.146.160:21659] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaI-1VtZF9Zd_U7easCaCAAAAEM"]
[Sat Feb 28 09:03:18.615869 2026] [:error] [pid 22194:tid 22219] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/class.1.php
[Sat Feb 28 09:03:18.873170 2026] [:error] [pid 22194:tid 22209] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/async.php
[Sat Feb 28 09:03:19.123557 2026] [:error] [pid 22194:tid 22215] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Sat Feb 28 09:03:19.423311 2026] [:error] [pid 22194:tid 22216] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 09:03:19.660934 2026] [:error] [pid 22194:tid 22219] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Feb 28 09:03:19.917060 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Sat Feb 28 09:03:20.158052 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 28 09:03:20.395917 2026] [:error] [pid 22194:tid 22216] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Sat Feb 28 09:03:20.635974 2026] [:error] [pid 22194:tid 22198] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/cbrfo.php
[Sat Feb 28 09:03:21.004538 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Feb 28 09:03:21.298160 2026] [:error] [pid 22194:tid 22207] [client 20.216.146.160:51924] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sat Feb 28 09:03:21.540340 2026] [:error] [pid 22194:tid 22220] [client 20.216.146.160:51924] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaI-2X6mbajs3bzQGyvWcAAAAVg"]
[Sat Feb 28 09:03:23.490792 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:27192] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaI-236mbajs3bzQGyvWjAAAAU4"]
[Sat Feb 28 09:03:25.718827 2026] [:error] [pid 11791:tid 11796] [client 20.216.146.160:29030] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaI-3WuX5e1Q32gqxH1sOwAAAQM"]
[Sat Feb 28 09:03:26.619163 2026] [:error] [pid 22194:tid 22220] [client 20.216.146.160:20593] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaI-3n6mbajs3bzQGyvWrQAAAVg"]
[Sat Feb 28 09:03:27.590558 2026] [:error] [pid 11791:tid 11811] [client 20.216.146.160:34942] [client 20.216.146.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaI-32uX5e1Q32gqxH1sVgAAARI"]
[Sat Feb 28 09:03:28.337260 2026] [:error] [pid 11791:tid 11812] [client 20.216.146.160:21643] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaI-4GuX5e1Q32gqxH1sZAAAARM"]
[Sat Feb 28 09:03:28.879607 2026] [:error] [pid 39185:tid 39256] [client 20.216.146.160:16412] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaI-4BVE-FfM89u7BQbEKAAAAIo"]
[Sat Feb 28 09:03:32.804747 2026] [:error] [pid 39185:tid 39260] [client 20.216.146.160:7473] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaI-5BVE-FfM89u7BQbEPQAAAI4"]
[Sat Feb 28 09:03:33.879293 2026] [:error] [pid 11791:tid 11803] [client 20.216.146.160:34889] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaI-5WuX5e1Q32gqxH1soAAAAQo"]
[Sat Feb 28 09:03:35.214421 2026] [:error] [pid 39185:tid 39246] [client 20.216.146.160:7487] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaI-5xVE-FfM89u7BQbEVgAAAIA"]
[Sat Feb 28 09:03:36.743989 2026] [:error] [pid 11791:tid 11803] [client 20.216.146.160:7466] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaI-6GuX5e1Q32gqxH1swAAAAQo"]
[Sat Feb 28 09:03:39.729253 2026] [:error] [pid 22194:tid 22214] [client 20.216.146.160:26996] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaI-636mbajs3bzQGyvXJQAAAVI"]
[Sat Feb 28 09:03:42.704023 2026] [:error] [pid 39183:tid 39216] [client 20.216.146.160:26999] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaI-7hCf4HvhVePw3La2TAAAABg"]
[Sat Feb 28 09:03:45.240406 2026] [:error] [pid 39292:tid 39298] [client 20.216.146.160:7107] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aaI-8aIAO5fN7BxyqcFd3wAAAMQ"]
[Sat Feb 28 09:03:47.017905 2026] [:error] [pid 39184:tid 39237] [client 20.216.146.160:7148] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aaI-81tZF9Zd_U7easCakAAAAFI"]
[Sat Feb 28 09:03:49.248176 2026] [:error] [pid 11791:tid 11806] [client 20.216.146.160:26428] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aaI-9WuX5e1Q32gqxH1tTQAAAQ0"]
[Sat Feb 28 09:03:51.634148 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:19309] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/muzu.php"] [unique_id "aaI-936mbajs3bzQGyvXqgAAAUA"]
[Sat Feb 28 09:03:52.447930 2026] [:error] [pid 11791:tid 11808] [client 20.216.146.160:26417] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aaI--GuX5e1Q32gqxH1tdgAAAQ8"]
[Sat Feb 28 09:03:54.953454 2026] [:error] [pid 39185:tid 39260] [client 20.216.146.160:19601] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aaI--hVE-FfM89u7BQbEwQAAAI4"]
[Sat Feb 28 09:03:55.683734 2026] [:error] [pid 39185:tid 39269] [client 20.216.146.160:6750] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aaI--xVE-FfM89u7BQbEwwAAAJc"]
[Sat Feb 28 09:03:56.819989 2026] [:error] [pid 11791:tid 11808] [client 20.216.146.160:24235] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/reze.php"] [unique_id "aaI-_GuX5e1Q32gqxH1tnwAAAQ8"]
[Sat Feb 28 09:03:58.524256 2026] [:error] [pid 22194:tid 22214] [client 20.216.146.160:25564] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aaI-_n6mbajs3bzQGyvX9AAAAVI"]
[Sat Feb 28 09:03:59.496505 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:26294] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aaI-_6IAO5fN7BxyqcFeYQAAANE"]
[Sat Feb 28 09:04:02.534089 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:50512] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aaI_An6mbajs3bzQGyvYCwAAAUw"]
[Sat Feb 28 09:04:05.026223 2026] [:error] [pid 11791:tid 11795] [client 20.216.146.160:26263] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/styll.php"] [unique_id "aaI_BWuX5e1Q32gqxH1uCgAAAQI"]
[Sat Feb 28 09:04:09.319760 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:29335] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaI_CaIAO5fN7BxyqcFepQAAANE"]
[Sat Feb 28 09:04:11.105279 2026] [:error] [pid 39185:tid 39266] [client 20.216.146.160:34159] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaI_CxVE-FfM89u7BQbFQwAAAJQ"]
[Sat Feb 28 09:04:12.213210 2026] [:error] [pid 11791:tid 11813] [client 20.216.146.160:40323] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaI_DGuX5e1Q32gqxH1uWQAAARQ"]
[Sat Feb 28 09:04:14.775855 2026] [:error] [pid 11791:tid 11794] [client 20.216.146.160:34117] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7.php"] [unique_id "aaI_DmuX5e1Q32gqxH1uaQAAAQE"]
[Sat Feb 28 09:04:17.341632 2026] [:error] [pid 39292:tid 39308] [client 20.216.146.160:52145] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thebe.php"] [unique_id "aaI_EaIAO5fN7BxyqcFe-gAAAM4"]
[Sat Feb 28 09:04:19.309310 2026] [:error] [pid 11791:tid 11797] [client 20.216.146.160:52101] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thebe.php"] [unique_id "aaI_E2uX5e1Q32gqxH1udwAAAQQ"]
[Sat Feb 28 09:04:21.010112 2026] [:error] [pid 22194:tid 22208] [client 20.216.146.160:52152] File does not exist: /usr/local/apache/htdocs/suspended-page/thebe.php
[Sat Feb 28 09:04:21.264889 2026] [:error] [pid 22194:tid 22201] [client 20.216.146.160:52152] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Sat Feb 28 09:04:21.522689 2026] [:error] [pid 22194:tid 22199] [client 20.216.146.160:52152] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sat Feb 28 09:04:21.762426 2026] [:error] [pid 22194:tid 22203] [client 20.216.146.160:52152] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Sat Feb 28 09:04:22.004257 2026] [:error] [pid 22194:tid 22213] [client 20.216.146.160:52152] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Sat Feb 28 09:04:22.254119 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:52152] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Sat Feb 28 09:04:22.494229 2026] [:error] [pid 22194:tid 22218] [client 20.216.146.160:52152] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 28 09:04:24.272050 2026] [:error] [pid 22194:tid 22212] [client 20.216.146.160:52152] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaI_GH6mbajs3bzQGyvZKAAAAVA"]
[Sat Feb 28 09:04:25.599687 2026] [:error] [pid 39185:tid 39251] [client 20.216.146.160:5926] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaI_GRVE-FfM89u7BQbFiwAAAIU"]
[Sat Feb 28 09:04:28.777528 2026] [:error] [pid 11791:tid 11796] [client 20.216.146.160:21010] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaI_HGuX5e1Q32gqxH1vBQAAAQM"]
[Sat Feb 28 09:04:29.877500 2026] [:error] [pid 39292:tid 39308] [client 20.216.146.160:21003] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaI_HaIAO5fN7BxyqcFfigAAAM4"]
[Sat Feb 28 09:04:31.307798 2026] [:error] [pid 39183:tid 39215] [client 20.216.146.160:41036] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aaI_HxCf4HvhVePw3La3SQAAABc"]
[Sat Feb 28 09:04:35.785017 2026] [:error] [pid 22194:tid 22202] [client 20.216.146.160:33397] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aaI_I36mbajs3bzQGyvZYAAAAUY"]
[Sat Feb 28 09:04:36.825306 2026] [:error] [pid 39292:tid 39315] [client 20.216.146.160:51551] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aaI_JKIAO5fN7BxyqcFfxgAAANU"]
[Sat Feb 28 09:04:37.953750 2026] [:error] [pid 39292:tid 39299] [client 20.216.146.160:41026] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aaI_JaIAO5fN7BxyqcFf0wAAAMU"]
[Sat Feb 28 09:04:39.309559 2026] [:error] [pid 39292:tid 39299] [client 20.216.146.160:22928] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaI_J6IAO5fN7BxyqcFf8AAAAMU"]
[Sat Feb 28 09:04:40.816146 2026] [:error] [pid 11791:tid 11796] [client 20.216.146.160:13877] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaI_KGuX5e1Q32gqxH1vwgAAAQM"]
[Sat Feb 28 09:04:41.728401 2026] [:error] [pid 39184:tid 39229] [client 20.216.146.160:37738] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaI_KVtZF9Zd_U7easCbkAAAAEo"]
[Sat Feb 28 09:04:43.485247 2026] [:error] [pid 22194:tid 22214] [client 20.216.146.160:37705] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaI_K36mbajs3bzQGyvZlwAAAVI"]
[Sat Feb 28 09:04:44.414839 2026] [:error] [pid 39183:tid 39203] [client 20.216.146.160:33364] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaI_LBCf4HvhVePw3La3YwAAAAs"]
[Sat Feb 28 09:04:45.588925 2026] [:error] [pid 39184:tid 39231] [client 20.216.146.160:41025] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaI_LVtZF9Zd_U7easCbmQAAAEw"]
[Sat Feb 28 09:04:47.325262 2026] [:error] [pid 39184:tid 39229] [client 20.216.146.160:39612] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaI_L1tZF9Zd_U7easCboQAAAEo"]
[Sat Feb 28 09:04:51.295153 2026] [:error] [pid 11791:tid 11812] [client 20.216.146.160:14352] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaI_M2uX5e1Q32gqxH1wNQAAARM"]
[Sat Feb 28 09:04:57.257179 2026] [:error] [pid 22194:tid 22211] [client 20.216.146.160:31563] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaI_OX6mbajs3bzQGyvZ_wAAAU8"]
[Sat Feb 28 09:05:00.584218 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:22975] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaI_PKIAO5fN7BxyqcFgnQAAANE"]
[Sat Feb 28 09:05:03.002775 2026] [:error] [pid 11791:tid 11803] [client 20.216.146.160:25538] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaI_P2uX5e1Q32gqxH1wzQAAAQo"]
[Sat Feb 28 09:05:03.723469 2026] [:error] [pid 11791:tid 11802] [client 20.216.146.160:42826] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaI_P2uX5e1Q32gqxH1w0wAAAQk"]
[Sat Feb 28 09:05:04.678606 2026] [:error] [pid 11791:tid 11804] [client 20.216.146.160:17972] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aaI_QGuX5e1Q32gqxH1w3wAAAQs"]
[Sat Feb 28 09:05:05.720435 2026] [:error] [pid 11791:tid 11801] [client 20.216.146.160:13899] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aaI_QWuX5e1Q32gqxH1w8QAAAQg"]
[Sat Feb 28 09:05:06.812321 2026] [:error] [pid 22194:tid 22199] [client 20.216.146.160:23180] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aaI_Qn6mbajs3bzQGyvaYQAAAUM"]
[Sat Feb 28 09:05:07.785830 2026] [:error] [pid 39292:tid 39318] [client 20.216.146.160:51416] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aaI_Q6IAO5fN7BxyqcFgxQAAANg"]
[Sat Feb 28 09:05:08.864811 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:49590] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aaI_RH6mbajs3bzQGyvagwAAAVU"]
[Sat Feb 28 09:05:10.070820 2026] [:error] [pid 39185:tid 39253] [client 20.216.146.160:49539] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aaI_RhVE-FfM89u7BQbGrwAAAIc"]
[Sat Feb 28 09:05:11.012062 2026] [:error] [pid 39292:tid 39294] [client 20.216.146.160:38345] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aaI_R6IAO5fN7BxyqcFg4AAAAMA"]
[Sat Feb 28 09:05:11.738450 2026] [:error] [pid 11791:tid 11816] [client 20.216.146.160:37026] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "aaI_R2uX5e1Q32gqxH1xQQAAARc"]
[Sat Feb 28 09:05:14.050300 2026] [:error] [pid 39183:tid 39216] [client 20.216.146.160:41525] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaI_ShCf4HvhVePw3La3gwAAABg"]
[Sat Feb 28 09:05:15.820211 2026] [:error] [pid 39184:tid 39227] [client 20.216.146.160:39469] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaI_S1tZF9Zd_U7easCcEwAAAEg"]
[Sat Feb 28 09:05:16.963213 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:34500] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaI_TKIAO5fN7BxyqcFhAQAAANY"]
[Sat Feb 28 09:05:18.711415 2026] [:error] [pid 39185:tid 39247] [client 20.216.146.160:41476] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaI_ThVE-FfM89u7BQbG7gAAAIE"]
[Sat Feb 28 09:05:20.093976 2026] [:error] [pid 39184:tid 39220] [client 20.216.146.160:35472] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aaI_UFtZF9Zd_U7easCcKAAAAEE"]
[Sat Feb 28 09:05:21.022283 2026] [:error] [pid 39185:tid 39265] [client 20.216.146.160:19431] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aaI_URVE-FfM89u7BQbHEgAAAJM"]
[Sat Feb 28 09:05:21.848203 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:37017] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aaI_UX6mbajs3bzQGyva6AAAAUA"]
[Sat Feb 28 09:05:22.605989 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:39180] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f5.php"] [unique_id "aaI_UmuX5e1Q32gqxH1xogAAARU"]
[Sat Feb 28 09:05:23.749853 2026] [:error] [pid 39183:tid 39196] [client 20.216.146.160:30088] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Feb 28 09:05:23.989300 2026] [:error] [pid 39183:tid 39200] [client 20.216.146.160:30088] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sat Feb 28 09:05:24.231292 2026] [:error] [pid 39183:tid 39207] [client 20.216.146.160:30088] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Feb 28 09:05:25.136069 2026] [:error] [pid 39183:tid 39204] [client 20.216.146.160:30088] [client 20.216.146.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaI_VRCf4HvhVePw3La3zQAAAAw"]
[Sat Feb 28 09:05:26.923845 2026] [:error] [pid 39292:tid 39314] [client 20.216.146.160:7339] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Sat Feb 28 09:05:27.162604 2026] [:error] [pid 39292:tid 39307] [client 20.216.146.160:7339] File does not exist: /usr/local/apache/htdocs/suspended-page/jane.php
[Sat Feb 28 09:05:27.405702 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:7339] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Feb 28 09:05:27.654619 2026] [:error] [pid 39292:tid 39310] [client 20.216.146.160:7339] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Feb 28 09:05:28.023856 2026] [:error] [pid 39292:tid 39307] [client 20.216.146.160:7339] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Feb 28 09:05:28.263276 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:7339] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sat Feb 28 09:05:28.513496 2026] [:error] [pid 39292:tid 39304] [client 20.216.146.160:7339] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aaI_WKIAO5fN7BxyqcFhWgAAAMo"]
[Sat Feb 28 09:05:29.276647 2026] [:error] [pid 11791:tid 11815] [client 20.216.146.160:48494] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aaI_WWuX5e1Q32gqxH1x5AAAARY"]
[Sat Feb 28 09:05:33.685265 2026] [:error] [pid 39184:tid 39237] [client 20.216.146.160:36916] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aaI_XVtZF9Zd_U7easCcYwAAAFI"]
[Sat Feb 28 09:05:34.537583 2026] [:error] [pid 11791:tid 11816] [client 20.216.146.160:14429] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aaI_XmuX5e1Q32gqxH1yHgAAARc"]
[Sat Feb 28 09:05:36.101920 2026] [:error] [pid 39292:tid 39303] [client 20.216.146.160:43775] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaI_YKIAO5fN7BxyqcFhogAAAMk"]
[Sat Feb 28 09:05:36.893157 2026] [:error] [pid 39184:tid 39228] [client 20.216.146.160:36174] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaI_YFtZF9Zd_U7easCcdAAAAEk"]
[Sat Feb 28 09:05:40.532243 2026] [:error] [pid 11791:tid 11813] [client 20.216.146.160:11928] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaI_ZGuX5e1Q32gqxH1yYQAAARQ"]
[Sat Feb 28 09:05:41.592201 2026] [:error] [pid 39183:tid 39193] [client 20.216.146.160:7265] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaI_ZRCf4HvhVePw3La3-AAAAAE"]
[Sat Feb 28 09:05:44.224882 2026] [:error] [pid 39183:tid 39194] [client 20.216.146.160:30086] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaI_aBCf4HvhVePw3La3_AAAAAI"]
[Sat Feb 28 09:05:45.187177 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:11916] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaI_aaIAO5fN7BxyqcFh7AAAANE"]
[Sat Feb 28 09:05:47.260234 2026] [:error] [pid 11791:tid 11804] [client 20.216.146.160:28947] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaI_a2uX5e1Q32gqxH1yswAAAQs"]
[Sat Feb 28 09:05:52.575087 2026] [:error] [pid 11791:tid 11802] [client 20.216.146.160:39373] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaI_cGuX5e1Q32gqxH1y9gAAAQk"]
[Sat Feb 28 09:05:53.804024 2026] [:error] [pid 11791:tid 11798] [client 20.216.146.160:21910] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaI_cWuX5e1Q32gqxH1zFAAAAQU"]
[Sat Feb 28 09:05:54.556051 2026] [:error] [pid 22194:tid 22197] [client 20.216.146.160:35227] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaI_cn6mbajs3bzQGyvbqgAAAUE"]
[Sat Feb 28 09:05:55.271670 2026] [:error] [pid 11791:tid 11793] [client 20.216.146.160:36437] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaI_c2uX5e1Q32gqxH1zKwAAAQA"]
[Sat Feb 28 09:05:57.596055 2026] [:error] [pid 39185:tid 39269] [client 20.216.146.160:50359] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaI_dRVE-FfM89u7BQbH-QAAAJc"]
[Sat Feb 28 09:05:58.734670 2026] [:error] [pid 22194:tid 22211] [client 20.216.146.160:25420] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaI_dn6mbajs3bzQGyvb0AAAAU8"]
[Sat Feb 28 09:05:59.290900 2026] [:error] [pid 39184:tid 39223] [client 20.216.146.160:38241] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaI_d1tZF9Zd_U7easCc9QAAAEQ"]
[Sat Feb 28 09:06:00.527246 2026] [:error] [pid 39185:tid 39269] [client 20.216.146.160:35231] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaI_eBVE-FfM89u7BQbIEQAAAJc"]
[Sat Feb 28 09:06:01.396513 2026] [:error] [pid 22194:tid 22218] [client 20.216.146.160:39376] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaI_eX6mbajs3bzQGyvb4wAAAVY"]
[Sat Feb 28 09:06:03.978005 2026] [:error] [pid 22194:tid 22205] [client 20.216.146.160:20318] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aaI_e36mbajs3bzQGyvb_wAAAUk"]
[Sat Feb 28 09:06:06.383893 2026] [:error] [pid 39183:tid 39209] [client 20.216.146.160:5103] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aaI_fhCf4HvhVePw3La4QgAAABE"]
[Sat Feb 28 09:06:07.446325 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:18132] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aaI_f2uX5e1Q32gqxH1zuwAAARU"]
[Sat Feb 28 09:06:08.976010 2026] [:error] [pid 11791:tid 11796] [client 20.216.146.160:18162] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "aaI_gGuX5e1Q32gqxH1z5QAAAQM"]
[Sat Feb 28 09:06:10.789030 2026] [:error] [pid 22194:tid 22207] [client 20.216.146.160:27741] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaI_gn6mbajs3bzQGyvcLQAAAUs"]
[Sat Feb 28 09:06:12.517261 2026] [:error] [pid 39292:tid 39316] [client 20.216.146.160:37330] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaI_hKIAO5fN7BxyqcFiiQAAANY"]
[Sat Feb 28 09:06:13.729239 2026] [:error] [pid 22194:tid 22199] [client 20.216.146.160:7421] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaI_hX6mbajs3bzQGyvcQgAAAUM"]
[Sat Feb 28 09:06:15.443480 2026] [:error] [pid 39183:tid 39211] [client 20.216.146.160:18121] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaI_hxCf4HvhVePw3La4bwAAABM"]
[Sat Feb 28 09:06:17.146618 2026] [:error] [pid 39184:tid 39238] [client 20.216.146.160:7614] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaI_iVtZF9Zd_U7easCdZAAAAFM"]
[Sat Feb 28 09:06:19.499165 2026] [:error] [pid 39184:tid 39238] [client 20.216.146.160:5117] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaI_i1tZF9Zd_U7easCdcQAAAFM"]
[Sat Feb 28 09:06:22.445534 2026] [:error] [pid 22194:tid 22217] [client 20.216.146.160:7417] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaI_jn6mbajs3bzQGyvcpgAAAVU"]
[Sat Feb 28 09:06:23.743400 2026] [:error] [pid 39185:tid 39259] [client 20.216.146.160:18133] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaI_jxVE-FfM89u7BQbIqAAAAI0"]
[Sat Feb 28 09:06:24.993234 2026] [:error] [pid 39292:tid 39313] [client 20.216.146.160:37351] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaI_kKIAO5fN7BxyqcFi2wAAANM"]
[Sat Feb 28 09:06:26.114953 2026] [:error] [pid 11791:tid 11812] [client 20.216.146.160:21782] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaI_kmuX5e1Q32gqxH10dwAAARM"]
[Sat Feb 28 09:06:27.068235 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:50915] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaI_k6IAO5fN7BxyqcFi9wAAANE"]
[Sat Feb 28 09:06:29.560010 2026] [:error] [pid 39183:tid 39214] [client 20.216.146.160:18985] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sat Feb 28 09:06:30.074700 2026] [:error] [pid 39183:tid 39213] [client 20.216.146.160:18985] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sat Feb 28 09:06:30.332752 2026] [:error] [pid 39183:tid 39200] [client 20.216.146.160:18985] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 28 09:06:30.607041 2026] [:error] [pid 39183:tid 39197] [client 20.216.146.160:18985] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Sat Feb 28 09:06:30.888499 2026] [:error] [pid 39183:tid 39206] [client 20.216.146.160:18985] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Sat Feb 28 09:06:31.130135 2026] [:error] [pid 39183:tid 39211] [client 20.216.146.160:18985] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Sat Feb 28 09:06:31.365201 2026] [:error] [pid 39183:tid 39194] [client 20.216.146.160:18985] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaI_lxCf4HvhVePw3La4qAAAAAI"]
[Sat Feb 28 09:06:32.668122 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:51664] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaI_mH6mbajs3bzQGyvdBwAAAUA"]
[Sat Feb 28 09:06:33.303751 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:7181] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaI_maIAO5fN7BxyqcFjJAAAANE"]
[Sat Feb 28 09:06:34.198755 2026] [:error] [pid 39292:tid 39315] [client 20.216.146.160:7554] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaI_mqIAO5fN7BxyqcFjLgAAANU"]
[Sat Feb 28 09:06:35.275409 2026] [:error] [pid 39183:tid 39201] [client 20.216.146.160:7416] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aaI_mxCf4HvhVePw3La4rwAAAAk"]
[Sat Feb 28 09:06:36.356434 2026] [:error] [pid 11791:tid 11800] [client 20.216.146.160:18959] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aaI_nGuX5e1Q32gqxH106QAAAQc"]
[Sat Feb 28 09:06:37.257415 2026] [:error] [pid 39183:tid 39197] [client 20.216.146.160:47766] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aaI_nRCf4HvhVePw3La4tQAAAAU"]
[Sat Feb 28 09:06:38.230404 2026] [:error] [pid 39292:tid 39311] [client 20.216.146.160:7586] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admins.php"] [unique_id "aaI_nqIAO5fN7BxyqcFjXgAAANE"]
[Sat Feb 28 09:06:39.195880 2026] [:error] [pid 22194:tid 22210] [client 20.216.146.160:48331] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaI_n36mbajs3bzQGyvdRwAAAU4"]
[Sat Feb 28 09:06:40.206330 2026] [:error] [pid 39292:tid 39295] [client 20.216.146.160:3518] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaI_oKIAO5fN7BxyqcFjcQAAAME"]
[Sat Feb 28 09:06:42.158124 2026] [:error] [pid 39184:tid 39236] [client 20.216.146.160:51336] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaI_oltZF9Zd_U7easCd3wAAAFE"]
[Sat Feb 28 09:06:43.265245 2026] [:error] [pid 11791:tid 11805] [client 20.216.146.160:7521] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaI_o2uX5e1Q32gqxH11NAAAAQw"]
[Sat Feb 28 09:06:46.400018 2026] [:error] [pid 39185:tid 39246] [client 20.216.146.160:44756] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aaI_phVE-FfM89u7BQbJNQAAAIA"]
[Sat Feb 28 09:06:48.402106 2026] [:error] [pid 22194:tid 22213] [client 20.216.146.160:30333] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aaI_qH6mbajs3bzQGyvdowAAAVE"]
[Sat Feb 28 09:06:49.918499 2026] [:error] [pid 39185:tid 39247] [client 20.216.146.160:30329] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aaI_qRVE-FfM89u7BQbJSwAAAIE"]
[Sat Feb 28 09:06:51.301669 2026] [:error] [pid 39183:tid 39210] [client 20.216.146.160:3708] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "aaI_qxCf4HvhVePw3La45AAAABI"]
[Sat Feb 28 09:06:53.704826 2026] [:error] [pid 39183:tid 39216] [client 20.216.146.160:30335] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaI_rRCf4HvhVePw3La47QAAABg"]
[Sat Feb 28 09:06:54.680258 2026] [:error] [pid 39183:tid 39203] [client 20.216.146.160:24794] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaI_rhCf4HvhVePw3La48gAAAAs"]
[Sat Feb 28 09:06:57.956458 2026] [:error] [pid 39292:tid 39315] [client 20.216.146.160:23454] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaI_saIAO5fN7BxyqcFj9QAAANU"]
[Sat Feb 28 09:07:00.270228 2026] [:error] [pid 39185:tid 39256] [client 20.216.146.160:44768] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaI_tBVE-FfM89u7BQbJnwAAAIo"]
[Sat Feb 28 09:07:09.664223 2026] [:error] [pid 11791:tid 11806] [client 20.216.146.160:50095] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaI_vWuX5e1Q32gqxH12QAAAAQ0"]
[Sat Feb 28 09:07:10.976281 2026] [:error] [pid 22194:tid 22196] [client 20.216.146.160:42383] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaI_vn6mbajs3bzQGyvexgAAAUA"]
[Sat Feb 28 09:07:12.523754 2026] [:error] [pid 22194:tid 22218] [client 20.216.146.160:20431] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaI_wH6mbajs3bzQGyve0wAAAVY"]
[Sat Feb 28 09:07:14.315253 2026] [:error] [pid 39184:tid 39234] [client 20.216.146.160:47543] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaI_wltZF9Zd_U7easCedQAAAE8"]
[Sat Feb 28 09:07:15.118285 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:20445] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaI_w2uX5e1Q32gqxH12eAAAARU"]
[Sat Feb 28 09:07:16.342256 2026] [:error] [pid 11791:tid 11814] [client 20.216.146.160:23467] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaI_xGuX5e1Q32gqxH12iwAAARU"]
[Sat Feb 28 09:07:17.269988 2026] [:error] [pid 22194:tid 22205] [client 20.216.146.160:30303] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaI_xX6mbajs3bzQGyve_gAAAUk"]
[Sat Feb 28 09:07:18.596030 2026] [:error] [pid 11791:tid 11801] [client 20.216.146.160:29706] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaI_xmuX5e1Q32gqxH12vwAAAQg"]
[Sat Feb 28 09:07:19.632109 2026] [:error] [pid 11791:tid 11794] [client 20.216.146.160:23464] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aaI_x2uX5e1Q32gqxH122wAAAQE"]
[Sat Feb 28 09:07:20.647948 2026] [:error] [pid 39292:tid 39302] [client 20.216.146.160:42783] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aaI_yKIAO5fN7BxyqcFkfgAAAMg"]
[Sat Feb 28 09:07:21.760648 2026] [:error] [pid 39292:tid 39310] [client 20.216.146.160:24598] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aaI_yaIAO5fN7BxyqcFkiQAAANA"]
[Sat Feb 28 09:07:22.401457 2026] [:error] [pid 22194:tid 22213] [client 20.216.146.160:27107] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "aaI_yn6mbajs3bzQGyvfFgAAAVE"]
[Sat Feb 28 09:07:23.127345 2026] [:error] [pid 39292:tid 39307] [client 20.216.146.160:37252] [client 20.216.146.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaI_y6IAO5fN7BxyqcFkjwAAAM0"]
[Sat Feb 28 09:07:24.089413 2026] [:error] [pid 11791:tid 11817] [client 20.216.146.160:42388] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aaI_zGuX5e1Q32gqxH13DgAAARg"]
[Sat Feb 28 09:07:25.344549 2026] [:error] [pid 39292:tid 39305] [client 20.216.146.160:50071] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aaI_zaIAO5fN7BxyqcFkqAAAAMs"]
[Sat Feb 28 09:07:26.143397 2026] [:error] [pid 39185:tid 39259] [client 20.216.146.160:18516] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aaI_zhVE-FfM89u7BQbKJgAAAI0"]
[Sat Feb 28 09:07:27.968037 2026] [:error] [pid 39292:tid 39296] [client 20.216.146.160:37254] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jsond.php"] [unique_id "aaI_z6IAO5fN7BxyqcFk2AAAAMI"]
[Sat Feb 28 09:07:28.663597 2026] [:error] [pid 22194:tid 22220] [client 20.216.146.160:29736] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaI_0H6mbajs3bzQGyvfQQAAAVg"]
[Sat Feb 28 09:07:30.496947 2026] [:error] [pid 39185:tid 39270] [client 20.216.146.160:37287] [client 20.216.146.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaI_0hVE-FfM89u7BQbKSgAAAJg"]
[Sat Feb 28 09:07:33.221713 2026] [:error] [pid 39183:tid 39209] [client 20.216.146.160:37257] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sat Feb 28 11:21:11.810028 2026] [:error] [pid 22194:tid 22207] [client 45.141.233.196:64248] [client 45.141.233.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.141.233.196, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaJfJ36mbajs3bzQGysh_AAAAUs"]
[Sat Feb 28 11:21:11.813915 2026] [:error] [pid 22194:tid 22207] [client 45.141.233.196:64248] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 28 11:21:12.347823 2026] [:error] [pid 39183:tid 39202] [client 45.141.233.196:49648] [client 45.141.233.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.141.233.196, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaJfKBCf4HvhVePw3LbWwwAAAAo"]
[Sat Feb 28 11:21:12.352116 2026] [:error] [pid 39183:tid 39202] [client 45.141.233.196:49648] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 28 12:02:00.314950 2026] [:error] [pid 22194:tid 22198] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 28 12:02:00.762478 2026] [:error] [pid 22194:tid 22196] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sat Feb 28 12:02:00.973332 2026] [:error] [pid 22194:tid 22204] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Feb 28 12:02:01.183679 2026] [:error] [pid 22194:tid 22203] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 12:02:01.501478 2026] [:error] [pid 22194:tid 22202] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sat Feb 28 12:02:01.710073 2026] [:error] [pid 22194:tid 22207] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sat Feb 28 12:02:01.919007 2026] [:error] [pid 22194:tid 22220] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 12:02:02.354115 2026] [:error] [pid 22194:tid 22213] [client 20.104.82.189:11153] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sat Feb 28 12:02:02.561354 2026] [:error] [pid 22194:tid 22210] [client 20.104.82.189:11153] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaJoun6mbajs3bzQGysuhgAAAU4"]
[Sat Feb 28 12:02:03.126462 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11259] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaJou7LWOogAgHGh62T2uQAAAZU"]
[Sat Feb 28 12:02:04.738339 2026] [:error] [pid 52460:tid 52472] [client 20.104.82.189:11232] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaJovLLWOogAgHGh62T2xgAAAYk"]
[Sat Feb 28 12:02:05.570958 2026] [:error] [pid 11791:tid 11816] [client 20.104.82.189:11231] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx1.php"] [unique_id "aaJovWuX5e1Q32gqxH34ygAAARc"]
[Sat Feb 28 12:02:08.763205 2026] [:error] [pid 39292:tid 39295] [client 20.104.82.189:11151] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaJowKIAO5fN7BxyqcG7pgAAAME"]
[Sat Feb 28 12:02:12.697010 2026] [:error] [pid 52460:tid 52475] [client 20.104.82.189:11261] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaJoxLLWOogAgHGh62T3AAAAAYw"]
[Sat Feb 28 12:02:15.241773 2026] [:error] [pid 39292:tid 39296] [client 20.104.82.189:11152] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaJox6IAO5fN7BxyqcG7sgAAAMI"]
[Sat Feb 28 12:02:16.110210 2026] [:error] [pid 39185:tid 39261] [client 20.104.82.189:11251] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xv.php"] [unique_id "aaJoyBVE-FfM89u7BQaNKQAAAI8"]
[Sat Feb 28 12:02:16.822067 2026] [:error] [pid 39185:tid 39266] [client 20.104.82.189:11251] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaJoyBVE-FfM89u7BQaNLAAAAJQ"]
[Sat Feb 28 12:02:17.417303 2026] [:error] [pid 52460:tid 52465] [client 20.104.82.189:11223] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaJoybLWOogAgHGh62T3IwAAAYI"]
[Sat Feb 28 12:02:17.978134 2026] [:error] [pid 11791:tid 11807] [client 20.104.82.189:11226] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaJoyWuX5e1Q32gqxH34-wAAAQ4"]
[Sat Feb 28 12:02:18.483096 2026] [:error] [pid 52460:tid 52472] [client 20.104.82.189:11253] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x56.php"] [unique_id "aaJoyrLWOogAgHGh62T3LAAAAYk"]
[Sat Feb 28 12:02:19.222314 2026] [:error] [pid 52460:tid 52465] [client 20.104.82.189:11234] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaJoy7LWOogAgHGh62T3NgAAAYI"]
[Sat Feb 28 12:02:19.711691 2026] [:error] [pid 39292:tid 39306] [client 20.104.82.189:11200] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaJoy6IAO5fN7BxyqcG7vgAAAMw"]
[Sat Feb 28 12:02:20.245714 2026] [:error] [pid 11791:tid 11800] [client 20.104.82.189:11136] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaJozGuX5e1Q32gqxH35CwAAAQc"]
[Sat Feb 28 12:02:20.812862 2026] [:error] [pid 39292:tid 39311] [client 20.104.82.189:11240] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aaJozKIAO5fN7BxyqcG7wwAAANE"]
[Sat Feb 28 12:02:21.359646 2026] [:error] [pid 11791:tid 11795] [client 20.104.82.189:11138] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaJozWuX5e1Q32gqxH35EQAAAQI"]
[Sat Feb 28 12:02:21.932407 2026] [:error] [pid 52460:tid 52480] [client 20.104.82.189:11208] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaJozbLWOogAgHGh62T3QwAAAZE"]
[Sat Feb 28 12:02:22.413062 2026] [:error] [pid 39185:tid 39252] [client 20.104.82.189:11257] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaJozhVE-FfM89u7BQaNOQAAAIY"]
[Sat Feb 28 12:02:23.002525 2026] [:error] [pid 39185:tid 39267] [client 20.104.82.189:11165] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/readme.php"] [unique_id "aaJozxVE-FfM89u7BQaNOwAAAJU"]
[Sat Feb 28 12:02:23.542935 2026] [:error] [pid 52460:tid 52472] [client 20.104.82.189:11263] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaJoz7LWOogAgHGh62T3TwAAAYk"]
[Sat Feb 28 12:02:24.124651 2026] [:error] [pid 39292:tid 39296] [client 20.104.82.189:11088] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaJo0KIAO5fN7BxyqcG7xwAAAMI"]
[Sat Feb 28 12:02:24.602523 2026] [:error] [pid 22194:tid 22201] [client 20.104.82.189:11214] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaJo0H6mbajs3bzQGysumQAAAUU"]
[Sat Feb 28 12:02:25.025218 2026] [:error] [pid 39292:tid 39297] [client 20.104.82.189:11189] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x50.php"] [unique_id "aaJo0aIAO5fN7BxyqcG7zQAAAMM"]
[Sat Feb 28 12:02:25.593745 2026] [:error] [pid 52460:tid 52466] [client 20.104.82.189:11217] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaJo0bLWOogAgHGh62T3YwAAAYM"]
[Sat Feb 28 12:02:26.143329 2026] [:error] [pid 52460:tid 52475] [client 20.104.82.189:11236] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaJo0rLWOogAgHGh62T3agAAAYw"]
[Sat Feb 28 12:02:26.799461 2026] [:error] [pid 52460:tid 52487] [client 20.104.82.189:11170] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaJo0rLWOogAgHGh62T3bwAAAZg"]
[Sat Feb 28 12:02:27.228773 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:11213] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fv.php"] [unique_id "aaJo07LWOogAgHGh62T3cgAAAYs"]
[Sat Feb 28 12:02:27.809620 2026] [:error] [pid 52460:tid 52476] [client 20.104.82.189:11229] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaJo07LWOogAgHGh62T3egAAAY0"]
[Sat Feb 28 12:02:29.038384 2026] [:error] [pid 39184:tid 39226] [client 20.104.82.189:11248] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaJo1VtZF9Zd_U7easDMcAAAAEc"]
[Sat Feb 28 12:02:29.748407 2026] [:error] [pid 52460:tid 52482] [client 20.104.82.189:11258] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaJo1bLWOogAgHGh62T3jAAAAZM"]
[Sat Feb 28 12:02:30.667900 2026] [:error] [pid 52460:tid 52464] [client 20.104.82.189:11078] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "aaJo1rLWOogAgHGh62T3lQAAAYE"]
[Sat Feb 28 12:02:31.518406 2026] [:error] [pid 39184:tid 39227] [client 20.104.82.189:11191] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaJo11tZF9Zd_U7easDMdAAAAEg"]
[Sat Feb 28 12:02:32.498022 2026] [:error] [pid 39185:tid 39255] [client 20.104.82.189:11221] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaJo2BVE-FfM89u7BQaNXQAAAIk"]
[Sat Feb 28 12:02:33.343577 2026] [:error] [pid 39292:tid 39316] [client 20.104.82.189:11147] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaJo2aIAO5fN7BxyqcG71AAAANY"]
[Sat Feb 28 12:02:33.983579 2026] [:error] [pid 11791:tid 11809] [client 20.104.82.189:11145] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lsd.php"] [unique_id "aaJo2WuX5e1Q32gqxH35JAAAARA"]
[Sat Feb 28 12:02:34.974102 2026] [:error] [pid 11791:tid 11817] [client 20.104.82.189:11156] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaJo2muX5e1Q32gqxH35LAAAARg"]
[Sat Feb 28 12:02:35.679668 2026] [:error] [pid 39185:tid 39269] [client 20.104.82.189:11222] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaJo2xVE-FfM89u7BQaNaQAAAJc"]
[Sat Feb 28 12:02:36.810259 2026] [:error] [pid 39185:tid 39260] [client 20.104.82.189:11137] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaJo3BVE-FfM89u7BQaNeAAAAI4"]
[Sat Feb 28 12:02:37.782255 2026] [:error] [pid 39184:tid 39238] [client 20.104.82.189:11188] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "aaJo3VtZF9Zd_U7easDMfAAAAFM"]
[Sat Feb 28 12:02:38.998914 2026] [:error] [pid 39185:tid 39259] [client 20.104.82.189:11230] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaJo3hVE-FfM89u7BQaNhwAAAI0"]
[Sat Feb 28 12:02:39.940548 2026] [:error] [pid 39184:tid 39228] [client 20.104.82.189:11203] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaJo31tZF9Zd_U7easDMgQAAAEk"]
[Sat Feb 28 12:02:40.695725 2026] [:error] [pid 39185:tid 39269] [client 20.104.82.189:11168] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaJo4BVE-FfM89u7BQaNkQAAAJc"]
[Sat Feb 28 12:02:41.163782 2026] [:error] [pid 39292:tid 39318] [client 20.104.82.189:11148] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wsd.php"] [unique_id "aaJo4aIAO5fN7BxyqcG72AAAANg"]
[Sat Feb 28 12:02:41.749186 2026] [:error] [pid 39184:tid 39224] [client 20.104.82.189:11201] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaJo4VtZF9Zd_U7easDMiQAAAEU"]
[Sat Feb 28 12:02:42.171592 2026] [:error] [pid 22194:tid 22216] [client 20.104.82.189:11185] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaJo4n6mbajs3bzQGysusgAAAVQ"]
[Sat Feb 28 12:02:42.627937 2026] [:error] [pid 39185:tid 39258] [client 20.104.82.189:11146] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaJo4hVE-FfM89u7BQaNnwAAAIw"]
[Sat Feb 28 12:02:43.108865 2026] [:error] [pid 11791:tid 11794] [client 20.104.82.189:11245] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gtc.php"] [unique_id "aaJo42uX5e1Q32gqxH35RgAAAQE"]
[Sat Feb 28 12:02:43.675887 2026] [:error] [pid 52460:tid 52475] [client 20.104.82.189:11206] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaJo47LWOogAgHGh62T31QAAAYw"]
[Sat Feb 28 12:02:44.918430 2026] [:error] [pid 11791:tid 11817] [client 20.104.82.189:11215] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaJo5GuX5e1Q32gqxH35UwAAARg"]
[Sat Feb 28 12:02:45.869680 2026] [:error] [pid 52460:tid 52467] [client 20.104.82.189:11195] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaJo5bLWOogAgHGh62T37QAAAYQ"]
[Sat Feb 28 12:02:47.425794 2026] [:error] [pid 52460:tid 52467] [client 20.104.82.189:11173] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/atx.php"] [unique_id "aaJo57LWOogAgHGh62T3_AAAAYQ"]
[Sat Feb 28 12:02:48.723316 2026] [:error] [pid 52460:tid 52466] [client 20.104.82.189:11144] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/z60.php"] [unique_id "aaJo6LLWOogAgHGh62T4BQAAAYM"]
[Sat Feb 28 12:02:51.050870 2026] [:error] [pid 11791:tid 11812] [client 20.104.82.189:11255] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/z60.php"] [unique_id "aaJo62uX5e1Q32gqxH35XAAAARM"]
[Sat Feb 28 12:02:55.752434 2026] [:error] [pid 39183:tid 39212] [client 20.104.82.189:11235] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/z60.php"] [unique_id "aaJo7xCf4HvhVePw3Lbe5gAAABQ"]
[Sat Feb 28 12:03:02.878327 2026] [:error] [pid 52460:tid 52477] [client 20.104.82.189:11139] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Sat Feb 28 12:03:04.787009 2026] [:error] [pid 52460:tid 52464] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sat Feb 28 12:03:04.995001 2026] [:error] [pid 52460:tid 52468] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Sat Feb 28 12:03:05.224454 2026] [:error] [pid 52460:tid 52487] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 28 12:03:05.884238 2026] [:error] [pid 52460:tid 52486] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Feb 28 12:03:06.091761 2026] [:error] [pid 52460:tid 52464] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Feb 28 12:03:07.096268 2026] [:error] [pid 52460:tid 52480] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Feb 28 12:03:07.304714 2026] [:error] [pid 52460:tid 52477] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 28 12:03:07.530358 2026] [:error] [pid 52460:tid 52476] [client 20.104.82.189:11227] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Feb 28 12:03:07.745589 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11227] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaJo-7LWOogAgHGh62T4eQAAAZU"]
[Sat Feb 28 12:03:09.182814 2026] [:error] [pid 52460:tid 52475] [client 20.104.82.189:11246] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaJo_bLWOogAgHGh62T4hAAAAYw"]
[Sat Feb 28 12:03:09.729603 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:11074] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaJo_bLWOogAgHGh62T4jQAAAYs"]
[Sat Feb 28 12:03:10.211537 2026] [:error] [pid 39292:tid 39318] [client 20.104.82.189:11247] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaJo_qIAO5fN7BxyqcG8bwAAANg"]
[Sat Feb 28 12:03:11.042629 2026] [:error] [pid 39185:tid 39246] [client 20.104.82.189:11141] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaJo_xVE-FfM89u7BQaN3AAAAIA"]
[Sat Feb 28 12:03:11.635513 2026] [:error] [pid 39185:tid 39248] [client 20.104.82.189:11219] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaJo_xVE-FfM89u7BQaOHgAAAII"]
[Sat Feb 28 12:03:12.117090 2026] [:error] [pid 39185:tid 39254] [client 20.104.82.189:11180] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaJpABVE-FfM89u7BQaOJgAAAIg"]
[Sat Feb 28 12:03:12.690288 2026] [:error] [pid 39185:tid 39266] [client 20.104.82.189:11140] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cong.php"] [unique_id "aaJpABVE-FfM89u7BQaOKgAAAJQ"]
[Sat Feb 28 12:03:13.165875 2026] [:error] [pid 39185:tid 39251] [client 20.104.82.189:11143] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaJpARVE-FfM89u7BQaONAAAAIU"]
[Sat Feb 28 12:03:13.596216 2026] [:error] [pid 39292:tid 39306] [client 20.104.82.189:11198] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaJpAaIAO5fN7BxyqcG8mwAAAMw"]
[Sat Feb 28 12:03:14.015609 2026] [:error] [pid 39292:tid 39296] [client 20.104.82.189:11211] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaJpAqIAO5fN7BxyqcG8nQAAAMI"]
[Sat Feb 28 12:03:14.491984 2026] [:error] [pid 39185:tid 39265] [client 20.104.82.189:11082] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w.php"] [unique_id "aaJpAhVE-FfM89u7BQaORgAAAJM"]
[Sat Feb 28 12:03:15.022563 2026] [:error] [pid 39292:tid 39314] [client 20.104.82.189:11176] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaJpA6IAO5fN7BxyqcG8ogAAANQ"]
[Sat Feb 28 12:03:15.489939 2026] [:error] [pid 39185:tid 39253] [client 20.104.82.189:11218] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaJpAxVE-FfM89u7BQaOUgAAAIc"]
[Sat Feb 28 12:03:15.968941 2026] [:error] [pid 22194:tid 22196] [client 20.104.82.189:11216] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaJpA36mbajs3bzQGysu6QAAAUA"]
[Sat Feb 28 12:03:16.397433 2026] [:error] [pid 52460:tid 52471] [client 20.104.82.189:11204] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/404.php"] [unique_id "aaJpBLLWOogAgHGh62T4wgAAAYg"]
[Sat Feb 28 12:03:16.817175 2026] [:error] [pid 52460:tid 52485] [client 20.104.82.189:11175] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaJpBLLWOogAgHGh62T4xAAAAZY"]
[Sat Feb 28 12:03:17.250606 2026] [:error] [pid 39184:tid 39242] [client 20.104.82.189:11243] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaJpBVtZF9Zd_U7easDMvAAAAFc"]
[Sat Feb 28 12:03:17.736907 2026] [:error] [pid 39185:tid 39266] [client 20.104.82.189:11249] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaJpBRVE-FfM89u7BQaOWAAAAJQ"]
[Sat Feb 28 12:03:18.284495 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:11169] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0x.php"] [unique_id "aaJpBrLWOogAgHGh62T4yQAAAYs"]
[Sat Feb 28 12:03:18.965645 2026] [:error] [pid 39292:tid 39316] [client 20.104.82.189:11090] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaJpBqIAO5fN7BxyqcG8qAAAANY"]
[Sat Feb 28 12:03:19.683184 2026] [:error] [pid 39292:tid 39298] [client 20.104.82.189:11224] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaJpB6IAO5fN7BxyqcG8rQAAAMQ"]
[Sat Feb 28 12:03:20.364358 2026] [:error] [pid 11791:tid 11795] [client 20.104.82.189:11160] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaJpCGuX5e1Q32gqxH35iQAAAQI"]
[Sat Feb 28 12:03:21.287002 2026] [:error] [pid 39185:tid 39262] [client 20.104.82.189:11072] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css.php"] [unique_id "aaJpCRVE-FfM89u7BQaOXQAAAJA"]
[Sat Feb 28 12:03:21.726612 2026] [:error] [pid 52460:tid 52473] [client 20.104.82.189:11083] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaJpCbLWOogAgHGh62T4zwAAAYo"]
[Sat Feb 28 12:03:22.346007 2026] [:error] [pid 39292:tid 39309] [client 20.104.82.189:11158] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaJpCqIAO5fN7BxyqcG8sQAAAM8"]
[Sat Feb 28 12:03:22.978796 2026] [:error] [pid 39185:tid 39268] [client 20.104.82.189:11239] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaJpChVE-FfM89u7BQaOZQAAAJY"]
[Sat Feb 28 12:03:24.087591 2026] [:error] [pid 39185:tid 39263] [client 20.104.82.189:11178] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "aaJpDBVE-FfM89u7BQaObwAAAJE"]
[Sat Feb 28 12:03:24.886676 2026] [:error] [pid 39185:tid 39254] [client 20.104.82.189:11212] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaJpDBVE-FfM89u7BQaOcgAAAIg"]
[Sat Feb 28 12:03:26.337321 2026] [:error] [pid 39185:tid 39270] [client 20.104.82.189:11159] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaJpDhVE-FfM89u7BQaOdQAAAJg"]
[Sat Feb 28 12:03:27.655347 2026] [:error] [pid 39183:tid 39192] [client 20.104.82.189:11184] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaJpDxCf4HvhVePw3LbfFQAAAAA"]
[Sat Feb 28 12:03:28.714944 2026] [:error] [pid 39292:tid 39310] [client 20.104.82.189:11014] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "aaJpEKIAO5fN7BxyqcG8uQAAANA"]
[Sat Feb 28 12:03:29.888036 2026] [:error] [pid 11791:tid 11795] [client 20.104.82.189:11166] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaJpEWuX5e1Q32gqxH35nAAAAQI"]
[Sat Feb 28 12:03:30.725472 2026] [:error] [pid 39185:tid 39263] [client 20.104.82.189:11116] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaJpEhVE-FfM89u7BQaOgQAAAJE"]
[Sat Feb 28 12:03:31.613914 2026] [:error] [pid 39185:tid 39248] [client 20.104.82.189:11106] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaJpExVE-FfM89u7BQaOgwAAAII"]
[Sat Feb 28 12:03:32.229590 2026] [:error] [pid 39292:tid 39317] [client 20.104.82.189:11172] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "aaJpFKIAO5fN7BxyqcG8wwAAANc"]
[Sat Feb 28 12:03:32.677187 2026] [:error] [pid 52460:tid 52469] [client 20.104.82.189:11076] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJpFLLWOogAgHGh62T45wAAAYY"]
[Sat Feb 28 12:03:33.300918 2026] [:error] [pid 39185:tid 39262] [client 20.104.82.189:11142] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJpFRVE-FfM89u7BQaOhwAAAJA"]
[Sat Feb 28 12:03:33.943767 2026] [:error] [pid 52460:tid 52476] [client 20.104.82.189:11109] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJpFbLWOogAgHGh62T46QAAAY0"]
[Sat Feb 28 12:03:35.648906 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11187] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJpF7LWOogAgHGh62T47QAAAZU"]
[Sat Feb 28 12:03:37.318345 2026] [:error] [pid 39185:tid 39268] [client 20.104.82.189:11128] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaJpGRVE-FfM89u7BQaOjwAAAJY"]
[Sat Feb 28 12:03:38.640070 2026] [:error] [pid 52460:tid 52480] [client 20.104.82.189:11073] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaJpGrLWOogAgHGh62T48QAAAZE"]
[Sat Feb 28 12:03:39.718413 2026] [:error] [pid 39185:tid 39248] [client 20.104.82.189:11157] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaJpGxVE-FfM89u7BQaOlQAAAII"]
[Sat Feb 28 12:03:42.282626 2026] [:error] [pid 39292:tid 39296] [client 20.104.82.189:11095] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaJpHqIAO5fN7BxyqcG81AAAAMI"]
[Sat Feb 28 12:03:44.774448 2026] [:error] [pid 39292:tid 39312] [client 20.104.82.189:11196] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaJpIKIAO5fN7BxyqcG82gAAANI"]
[Sat Feb 28 12:03:46.593657 2026] [:error] [pid 11791:tid 11807] [client 20.104.82.189:11164] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaJpImuX5e1Q32gqxH35rQAAAQ4"]
[Sat Feb 28 12:03:47.875255 2026] [:error] [pid 39185:tid 39267] [client 20.104.82.189:11113] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaJpIxVE-FfM89u7BQaOmQAAAJU"]
[Sat Feb 28 12:03:48.720602 2026] [:error] [pid 52460:tid 52478] [client 20.104.82.189:11098] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaJpJLLWOogAgHGh62T5BAAAAY8"]
[Sat Feb 28 12:03:50.320230 2026] [:error] [pid 39185:tid 39251] [client 20.104.82.189:11075] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaJpJhVE-FfM89u7BQaOoQAAAIU"]
[Sat Feb 28 12:03:51.558592 2026] [:error] [pid 52460:tid 52478] [client 20.104.82.189:11154] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaJpJ7LWOogAgHGh62T5EgAAAY8"]
[Sat Feb 28 12:03:52.646126 2026] [:error] [pid 39185:tid 39247] [client 20.104.82.189:11162] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaJpKBVE-FfM89u7BQaOpwAAAIE"]
[Sat Feb 28 12:03:53.539876 2026] [:error] [pid 52460:tid 52473] [client 20.104.82.189:11119] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaJpKbLWOogAgHGh62T5GgAAAYo"]
[Sat Feb 28 12:03:54.026538 2026] [:error] [pid 52460:tid 52476] [client 20.104.82.189:11163] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJpKrLWOogAgHGh62T5HwAAAY0"]
[Sat Feb 28 12:03:54.570476 2026] [:error] [pid 39185:tid 39253] [client 20.104.82.189:11228] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJpKhVE-FfM89u7BQaOsQAAAIc"]
[Sat Feb 28 12:03:55.458695 2026] [:error] [pid 52460:tid 52478] [client 20.104.82.189:11104] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJpK7LWOogAgHGh62T5JAAAAY8"]
[Sat Feb 28 12:03:57.595220 2026] [:error] [pid 39292:tid 39300] [client 20.104.82.189:11225] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJpLaIAO5fN7BxyqcG85AAAAMY"]
[Sat Feb 28 12:03:59.367049 2026] [:error] [pid 39185:tid 39268] [client 20.104.82.189:11096] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaJpLxVE-FfM89u7BQaOvwAAAJY"]
[Sat Feb 28 12:04:01.653503 2026] [:error] [pid 52460:tid 52467] [client 20.104.82.189:11015] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaJpMbLWOogAgHGh62T5QAAAAYQ"]
[Sat Feb 28 12:04:03.647927 2026] [:error] [pid 52460:tid 52473] [client 20.104.82.189:11102] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaJpM7LWOogAgHGh62T5RAAAAYo"]
[Sat Feb 28 12:04:04.220992 2026] [:error] [pid 39184:tid 39230] [client 20.104.82.189:11179] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "aaJpNFtZF9Zd_U7easDM6wAAAEs"]
[Sat Feb 28 12:04:04.911707 2026] [:error] [pid 39183:tid 39204] [client 20.104.82.189:11149] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaJpNBCf4HvhVePw3LbfHQAAAAw"]
[Sat Feb 28 12:04:06.654022 2026] [:error] [pid 11791:tid 11810] [client 20.104.82.189:11241] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaJpNmuX5e1Q32gqxH35xAAAARE"]
[Sat Feb 28 12:04:08.754717 2026] [:error] [pid 39292:tid 39312] [client 20.104.82.189:11252] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Feb 28 12:04:10.013708 2026] [:error] [pid 39292:tid 39299] [client 20.104.82.189:11252] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Feb 28 12:04:10.225259 2026] [:error] [pid 39292:tid 39303] [client 20.104.82.189:11252] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Feb 28 12:04:10.678215 2026] [:error] [pid 39292:tid 39315] [client 20.104.82.189:11252] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sat Feb 28 12:04:10.885517 2026] [:error] [pid 39292:tid 39302] [client 20.104.82.189:11252] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Feb 28 12:04:11.297198 2026] [:error] [pid 39292:tid 39306] [client 20.104.82.189:11252] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaJpO6IAO5fN7BxyqcG89wAAAMw"]
[Sat Feb 28 12:04:11.924541 2026] [:error] [pid 52460:tid 52477] [client 20.104.82.189:11108] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaJpO7LWOogAgHGh62T5bAAAAY4"]
[Sat Feb 28 12:04:12.809070 2026] [:error] [pid 39184:tid 39219] [client 20.104.82.189:11174] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaJpPFtZF9Zd_U7easDM8wAAAEA"]
[Sat Feb 28 12:04:13.776799 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11207] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sx.php"] [unique_id "aaJpPbLWOogAgHGh62T5cgAAAZU"]
[Sat Feb 28 12:04:14.545773 2026] [:error] [pid 11791:tid 11811] [client 20.104.82.189:11242] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJpPmuX5e1Q32gqxH351wAAARI"]
[Sat Feb 28 12:04:14.980884 2026] [:error] [pid 11791:tid 11794] [client 20.104.82.189:11186] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJpPmuX5e1Q32gqxH352QAAAQE"]
[Sat Feb 28 12:04:15.431660 2026] [:error] [pid 39185:tid 39268] [client 20.104.82.189:11150] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJpPxVE-FfM89u7BQaO2QAAAJY"]
[Sat Feb 28 12:04:15.884175 2026] [:error] [pid 52460:tid 52473] [client 20.104.82.189:11197] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJpP7LWOogAgHGh62T5fgAAAYo"]
[Sat Feb 28 12:04:16.316022 2026] [:error] [pid 52460:tid 52471] [client 20.104.82.189:11237] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaJpQLLWOogAgHGh62T5gAAAAYg"]
[Sat Feb 28 12:04:17.000223 2026] [:error] [pid 39185:tid 39260] [client 20.104.82.189:11018] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaJpQBVE-FfM89u7BQaO3gAAAI4"]
[Sat Feb 28 12:04:17.532929 2026] [:error] [pid 11791:tid 11796] [client 20.104.82.189:11181] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaJpQWuX5e1Q32gqxH353QAAAQM"]
[Sat Feb 28 12:04:18.101189 2026] [:error] [pid 52460:tid 52478] [client 20.104.82.189:11101] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfa.php"] [unique_id "aaJpQrLWOogAgHGh62T5kAAAAY8"]
[Sat Feb 28 12:04:19.941356 2026] [:error] [pid 52460:tid 52472] [client 20.104.82.189:11135] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaJpQ7LWOogAgHGh62T5nwAAAYk"]
[Sat Feb 28 12:04:21.677157 2026] [:error] [pid 39185:tid 39248] [client 20.104.82.189:11022] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaJpRRVE-FfM89u7BQaO6AAAAII"]
[Sat Feb 28 12:04:22.483295 2026] [:error] [pid 52460:tid 52486] [client 20.104.82.189:11171] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaJpRrLWOogAgHGh62T5sgAAAZc"]
[Sat Feb 28 12:04:23.309846 2026] [:error] [pid 11791:tid 11800] [client 20.104.82.189:11133] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "aaJpR2uX5e1Q32gqxH354gAAAQc"]
[Sat Feb 28 12:04:24.485497 2026] [:error] [pid 39185:tid 39264] [client 20.104.82.189:11085] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaJpSBVE-FfM89u7BQaO8gAAAJI"]
[Sat Feb 28 12:04:26.162200 2026] [:error] [pid 52460:tid 52483] [client 20.104.82.189:11046] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaJpSrLWOogAgHGh62T5yAAAAZQ"]
[Sat Feb 28 12:04:27.150443 2026] [:error] [pid 39185:tid 39270] [client 20.104.82.189:11093] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaJpSxVE-FfM89u7BQaO9gAAAJg"]
[Sat Feb 28 12:04:28.414652 2026] [:error] [pid 11791:tid 11793] [client 20.104.82.189:11091] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp.php"] [unique_id "aaJpTGuX5e1Q32gqxH357AAAAQA"]
[Sat Feb 28 12:04:29.346625 2026] [:error] [pid 39183:tid 39209] [client 20.104.82.189:11190] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaJpTRCf4HvhVePw3LbfJQAAABE"]
[Sat Feb 28 12:04:30.061450 2026] [:error] [pid 11791:tid 11803] [client 20.104.82.189:11183] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaJpTmuX5e1Q32gqxH358gAAAQo"]
[Sat Feb 28 12:04:30.744127 2026] [:error] [pid 52460:tid 52471] [client 20.104.82.189:11047] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaJpTrLWOogAgHGh62T53gAAAYg"]
[Sat Feb 28 12:04:31.771382 2026] [:error] [pid 52460:tid 52480] [client 20.104.82.189:11210] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaJpT7LWOogAgHGh62T54wAAAZE"]
[Sat Feb 28 12:04:32.872204 2026] [:error] [pid 39184:tid 39227] [client 20.104.82.189:11084] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaJpUFtZF9Zd_U7easDNBQAAAEg"]
[Sat Feb 28 12:04:33.915914 2026] [:error] [pid 39183:tid 39207] [client 20.104.82.189:11028] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaJpURCf4HvhVePw3LbfJgAAAA8"]
[Sat Feb 28 12:04:34.862950 2026] [:error] [pid 39185:tid 39259] [client 20.104.82.189:11089] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaJpUhVE-FfM89u7BQaPCQAAAI0"]
[Sat Feb 28 12:04:35.506471 2026] [:error] [pid 39292:tid 39303] [client 20.104.82.189:11009] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "aaJpU6IAO5fN7BxyqcG9AwAAAMk"]
[Sat Feb 28 12:04:36.332671 2026] [:error] [pid 52460:tid 52486] [client 20.104.82.189:11079] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaJpVLLWOogAgHGh62T58AAAAZc"]
[Sat Feb 28 12:04:36.908341 2026] [:error] [pid 22194:tid 22216] [client 20.104.82.189:11192] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaJpVH6mbajs3bzQGysvGgAAAVQ"]
[Sat Feb 28 12:04:37.671205 2026] [:error] [pid 52460:tid 52467] [client 20.104.82.189:11025] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaJpVbLWOogAgHGh62T59wAAAYQ"]
[Sat Feb 28 12:04:38.775722 2026] [:error] [pid 39185:tid 39269] [client 20.104.82.189:11177] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaJpVhVE-FfM89u7BQaPEgAAAJc"]
[Sat Feb 28 12:04:39.611993 2026] [:error] [pid 11791:tid 11793] [client 20.104.82.189:11092] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaJpV2uX5e1Q32gqxH35-QAAAQA"]
[Sat Feb 28 12:04:40.353368 2026] [:error] [pid 39183:tid 39203] [client 20.104.82.189:11122] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaJpWBCf4HvhVePw3LbfKgAAAAs"]
[Sat Feb 28 12:04:40.923906 2026] [:error] [pid 39184:tid 39234] [client 20.104.82.189:11182] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaJpWFtZF9Zd_U7easDNDgAAAE8"]
[Sat Feb 28 12:04:41.384623 2026] [:error] [pid 39183:tid 39200] [client 20.104.82.189:11010] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "aaJpWRCf4HvhVePw3LbfKwAAAAg"]
[Sat Feb 28 12:04:41.853214 2026] [:error] [pid 11791:tid 11798] [client 20.104.82.189:11115] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaJpWWuX5e1Q32gqxH35_gAAAQU"]
[Sat Feb 28 12:04:42.561987 2026] [:error] [pid 39185:tid 39259] [client 20.104.82.189:11205] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaJpWhVE-FfM89u7BQaPGQAAAI0"]
[Sat Feb 28 12:04:43.489995 2026] [:error] [pid 39184:tid 39235] [client 20.104.82.189:11081] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaJpW1tZF9Zd_U7easDNFQAAAFA"]
[Sat Feb 28 12:04:44.496101 2026] [:error] [pid 39184:tid 39236] [client 20.104.82.189:11071] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gmo.php"] [unique_id "aaJpXFtZF9Zd_U7easDNFwAAAFE"]
[Sat Feb 28 12:04:45.308724 2026] [:error] [pid 22194:tid 22196] [client 20.104.82.189:11086] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaJpXX6mbajs3bzQGysvHwAAAUA"]
[Sat Feb 28 12:04:46.118521 2026] [:error] [pid 39185:tid 39247] [client 20.104.82.189:11038] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaJpXhVE-FfM89u7BQaPIAAAAIE"]
[Sat Feb 28 12:04:47.638682 2026] [:error] [pid 11791:tid 11802] [client 20.104.82.189:11066] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaJpX2uX5e1Q32gqxH36AwAAAQk"]
[Sat Feb 28 12:04:48.854252 2026] [:error] [pid 11791:tid 11795] [client 20.104.82.189:11030] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaJpYGuX5e1Q32gqxH36BAAAAQI"]
[Sat Feb 28 12:04:49.849932 2026] [:error] [pid 39185:tid 39259] [client 20.104.82.189:11155] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aaJpYRVE-FfM89u7BQaPKAAAAI0"]
[Sat Feb 28 12:04:51.080175 2026] [:error] [pid 39183:tid 39211] [client 20.104.82.189:11238] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJpYxCf4HvhVePw3LbfMgAAABM"]
[Sat Feb 28 12:04:52.670360 2026] [:error] [pid 39292:tid 39298] [client 20.104.82.189:11024] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJpZKIAO5fN7BxyqcG9UQAAAMQ"]
[Sat Feb 28 12:04:54.012946 2026] [:error] [pid 22194:tid 22215] [client 20.104.82.189:11039] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJpZn6mbajs3bzQGysvLgAAAVM"]
[Sat Feb 28 12:04:55.078043 2026] [:error] [pid 22194:tid 22199] [client 20.104.82.189:10962] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJpZ36mbajs3bzQGysvMQAAAUM"]
[Sat Feb 28 12:04:56.103612 2026] [:error] [pid 39292:tid 39309] [client 20.104.82.189:10964] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJpaKIAO5fN7BxyqcG9ZQAAAM8"]
[Sat Feb 28 12:04:56.922364 2026] [:error] [pid 11791:tid 11812] [client 20.104.82.189:11250] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJpaGuX5e1Q32gqxH36CgAAARM"]
[Sat Feb 28 12:04:57.483826 2026] [:error] [pid 39183:tid 39201] [client 20.104.82.189:10972] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJpaRCf4HvhVePw3LbfMwAAAAk"]
[Sat Feb 28 12:04:58.016459 2026] [:error] [pid 11791:tid 11797] [client 20.104.82.189:11061] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJpamuX5e1Q32gqxH36EAAAAQQ"]
[Sat Feb 28 12:04:58.866278 2026] [:error] [pid 11791:tid 11815] [client 20.104.82.189:11036] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJpamuX5e1Q32gqxH36EgAAARY"]
[Sat Feb 28 12:04:59.442238 2026] [:error] [pid 39292:tid 39314] [client 20.104.82.189:11017] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJpa6IAO5fN7BxyqcG9bgAAANQ"]
[Sat Feb 28 12:05:00.290557 2026] [:error] [pid 39292:tid 39318] [client 20.104.82.189:11034] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJpbKIAO5fN7BxyqcG9cgAAANg"]
[Sat Feb 28 12:05:01.502446 2026] [:error] [pid 39184:tid 39243] [client 20.104.82.189:11087] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJpbVtZF9Zd_U7easDNNgAAAFg"]
[Sat Feb 28 12:05:02.217733 2026] [:error] [pid 11791:tid 11810] [client 20.104.82.189:11118] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaJpbmuX5e1Q32gqxH36FQAAARE"]
[Sat Feb 28 12:05:02.920460 2026] [:error] [pid 39185:tid 39255] [client 20.104.82.189:11111] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaJpbhVE-FfM89u7BQaPWQAAAIk"]
[Sat Feb 28 12:05:03.347377 2026] [:error] [pid 22194:tid 22204] [client 20.104.82.189:10882] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaJpb36mbajs3bzQGysvOgAAAUg"]
[Sat Feb 28 12:05:03.836223 2026] [:error] [pid 39184:tid 39235] [client 20.104.82.189:11167] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaJpb1tZF9Zd_U7easDNOQAAAFA"]
[Sat Feb 28 12:05:04.414535 2026] [:error] [pid 22194:tid 22201] [client 20.104.82.189:11124] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaJpcH6mbajs3bzQGysvPQAAAUU"]
[Sat Feb 28 12:05:05.499429 2026] [:error] [pid 39185:tid 39257] [client 20.104.82.189:11031] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJpcRVE-FfM89u7BQaPZgAAAIs"]
[Sat Feb 28 12:05:06.193015 2026] [:error] [pid 39185:tid 39265] [client 20.104.82.189:11077] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJpchVE-FfM89u7BQaPcQAAAJM"]
[Sat Feb 28 12:05:06.767925 2026] [:error] [pid 39183:tid 39209] [client 20.104.82.189:11199] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJpchCf4HvhVePw3LbfNQAAABE"]
[Sat Feb 28 12:05:07.392772 2026] [:error] [pid 52460:tid 52478] [client 20.104.82.189:11107] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJpc7LWOogAgHGh62T6AwAAAY8"]
[Sat Feb 28 12:05:07.954778 2026] [:error] [pid 52460:tid 52482] [client 20.104.82.189:11097] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aaJpc7LWOogAgHGh62T6BgAAAZM"]
[Sat Feb 28 12:05:08.685245 2026] [:error] [pid 22194:tid 22198] [client 20.104.82.189:11193] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ww1.php"] [unique_id "aaJpdH6mbajs3bzQGysvQQAAAUI"]
[Sat Feb 28 12:05:09.630470 2026] [:error] [pid 11791:tid 11798] [client 20.104.82.189:11080] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ww1.php"] [unique_id "aaJpdWuX5e1Q32gqxH36HQAAAQU"]
[Sat Feb 28 12:05:10.046766 2026] [:error] [pid 39292:tid 39312] [client 20.104.82.189:11026] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ww1.php"] [unique_id "aaJpdqIAO5fN7BxyqcG9fQAAANI"]
[Sat Feb 28 12:05:10.575600 2026] [:error] [pid 39292:tid 39305] [client 20.104.82.189:10968] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ww1.php"] [unique_id "aaJpdqIAO5fN7BxyqcG9gAAAAMs"]
[Sat Feb 28 12:05:11.549451 2026] [:error] [pid 11791:tid 11817] [client 20.104.82.189:11131] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sat Feb 28 12:05:11.971062 2026] [:error] [pid 11791:tid 11802] [client 20.104.82.189:11131] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Sat Feb 28 12:05:12.821203 2026] [:error] [pid 11791:tid 11794] [client 20.104.82.189:11131] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaJpeGuX5e1Q32gqxH36KQAAAQE"]
[Sat Feb 28 12:05:14.024273 2026] [:error] [pid 52460:tid 52469] [client 20.104.82.189:11110] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaJperLWOogAgHGh62T6FQAAAYY"]
[Sat Feb 28 12:05:14.638327 2026] [:error] [pid 52460:tid 52482] [client 20.104.82.189:11209] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaJperLWOogAgHGh62T6FgAAAZM"]
[Sat Feb 28 12:05:15.291380 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:11059] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaJpe7LWOogAgHGh62T6GAAAAYs"]
[Sat Feb 28 12:05:15.913650 2026] [:error] [pid 52460:tid 52486] [client 20.104.82.189:11127] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaJpe7LWOogAgHGh62T6IgAAAZc"]
[Sat Feb 28 12:05:16.577931 2026] [:error] [pid 11791:tid 11809] [client 20.104.82.189:10946] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaJpfGuX5e1Q32gqxH36KwAAARA"]
[Sat Feb 28 12:05:17.664451 2026] [:error] [pid 39185:tid 39264] [client 20.104.82.189:11103] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaJpfRVE-FfM89u7BQaPiQAAAJI"]
[Sat Feb 28 12:05:18.199907 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11021] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaJpfrLWOogAgHGh62T6PAAAAZU"]
[Sat Feb 28 12:05:19.156593 2026] [:error] [pid 11791:tid 11813] [client 20.104.82.189:11035] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaJpf2uX5e1Q32gqxH36LwAAARQ"]
[Sat Feb 28 12:05:20.367088 2026] [:error] [pid 39292:tid 39298] [client 20.104.82.189:11262] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaJpgKIAO5fN7BxyqcG9hwAAAMQ"]
[Sat Feb 28 12:05:21.796992 2026] [:error] [pid 52460:tid 52478] [client 20.104.82.189:11016] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaJpgbLWOogAgHGh62T6TQAAAY8"]
[Sat Feb 28 12:05:22.851864 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:11094] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaJpgrLWOogAgHGh62T6TwAAAYs"]
[Sat Feb 28 12:05:23.539423 2026] [:error] [pid 11791:tid 11817] [client 20.104.82.189:11123] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaJpg2uX5e1Q32gqxH36MwAAARg"]
[Sat Feb 28 12:05:24.193821 2026] [:error] [pid 11791:tid 11815] [client 20.104.82.189:10966] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaJphGuX5e1Q32gqxH36NQAAARY"]
[Sat Feb 28 12:05:24.789726 2026] [:error] [pid 11791:tid 11801] [client 20.104.82.189:10891] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaJphGuX5e1Q32gqxH36NwAAAQg"]
[Sat Feb 28 12:05:25.889707 2026] [:error] [pid 39185:tid 39246] [client 20.104.82.189:10945] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaJphRVE-FfM89u7BQaPnwAAAIA"]
[Sat Feb 28 12:05:26.688357 2026] [:error] [pid 11791:tid 11794] [client 20.104.82.189:10957] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/log.php"] [unique_id "aaJphmuX5e1Q32gqxH36OgAAAQE"]
[Sat Feb 28 12:05:27.429021 2026] [:error] [pid 52460:tid 52464] [client 20.104.82.189:11027] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaJph7LWOogAgHGh62T6WAAAAYE"]
[Sat Feb 28 12:05:27.948180 2026] [:error] [pid 11791:tid 11812] [client 20.104.82.189:11126] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaJph2uX5e1Q32gqxH36PgAAARM"]
[Sat Feb 28 12:05:28.760187 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11100] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaJpiLLWOogAgHGh62T6WgAAAZU"]
[Sat Feb 28 12:05:30.112464 2026] [:error] [pid 52460:tid 52482] [client 20.104.82.189:11044] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/class.php"] [unique_id "aaJpirLWOogAgHGh62T6XgAAAZM"]
[Sat Feb 28 12:05:30.660604 2026] [:error] [pid 39292:tid 39318] [client 20.104.82.189:11112] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaJpiqIAO5fN7BxyqcG9kwAAANg"]
[Sat Feb 28 12:05:31.321173 2026] [:error] [pid 39184:tid 39225] [client 20.104.82.189:10947] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaJpi1tZF9Zd_U7easDNUAAAAEY"]
[Sat Feb 28 12:05:31.888190 2026] [:error] [pid 11791:tid 11793] [client 20.104.82.189:10944] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaJpi2uX5e1Q32gqxH36QwAAAQA"]
[Sat Feb 28 12:05:33.677404 2026] [:error] [pid 39185:tid 39250] [client 20.104.82.189:10955] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bless5.php"] [unique_id "aaJpjRVE-FfM89u7BQaPrQAAAIQ"]
[Sat Feb 28 12:05:35.535463 2026] [:error] [pid 52460:tid 52472] [client 20.104.82.189:11019] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaJpj7LWOogAgHGh62T6bQAAAYk"]
[Sat Feb 28 12:05:37.321206 2026] [:error] [pid 39185:tid 39265] [client 20.104.82.189:11023] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaJpkRVE-FfM89u7BQaPvwAAAJM"]
[Sat Feb 28 12:05:40.293136 2026] [:error] [pid 39185:tid 39266] [client 20.104.82.189:11139] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaJplBVE-FfM89u7BQaPyAAAAJQ"]
[Sat Feb 28 12:05:41.923250 2026] [:error] [pid 52460:tid 52463] [client 20.104.82.189:11037] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaJplbLWOogAgHGh62T6hAAAAYA"]
[Sat Feb 28 12:05:43.924935 2026] [:error] [pid 22194:tid 22207] [client 20.104.82.189:11062] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lock360.php"] [unique_id "aaJpl36mbajs3bzQGysvXgAAAUs"]
[Sat Feb 28 12:05:45.135002 2026] [:error] [pid 39185:tid 39269] [client 20.104.82.189:11045] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaJpmRVE-FfM89u7BQaP5AAAAJc"]
[Sat Feb 28 12:05:46.109684 2026] [:error] [pid 11791:tid 11798] [client 20.104.82.189:11099] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaJpmmuX5e1Q32gqxH36awAAAQU"]
[Sat Feb 28 12:05:47.214881 2026] [:error] [pid 52460:tid 52471] [client 20.104.82.189:11054] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaJpm7LWOogAgHGh62T6jwAAAYg"]
[Sat Feb 28 12:05:47.926928 2026] [:error] [pid 52460:tid 52464] [client 20.104.82.189:11001] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o1.php"] [unique_id "aaJpm7LWOogAgHGh62T6kgAAAYE"]
[Sat Feb 28 12:05:48.696261 2026] [:error] [pid 52460:tid 52468] [client 20.104.82.189:11233] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaJpnLLWOogAgHGh62T6lQAAAYU"]
[Sat Feb 28 12:05:49.277341 2026] [:error] [pid 39184:tid 39231] [client 20.104.82.189:10991] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaJpnVtZF9Zd_U7easDNZgAAAEw"]
[Sat Feb 28 12:05:50.353871 2026] [:error] [pid 52460:tid 52482] [client 20.104.82.189:10952] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaJpnrLWOogAgHGh62T6nQAAAZM"]
[Sat Feb 28 12:05:51.735836 2026] [:error] [pid 22194:tid 22197] [client 20.104.82.189:11052] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/juuuu.php"] [unique_id "aaJpn36mbajs3bzQGysvZAAAAUE"]
[Sat Feb 28 12:05:52.944898 2026] [:error] [pid 11791:tid 11812] [client 20.104.82.189:11117] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaJpoGuX5e1Q32gqxH36fQAAARM"]
[Sat Feb 28 12:05:54.415442 2026] [:error] [pid 39292:tid 39313] [client 20.104.82.189:11005] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaJpoqIAO5fN7BxyqcG9uQAAANM"]
[Sat Feb 28 12:05:56.889329 2026] [:error] [pid 39292:tid 39304] [client 20.104.82.189:10880] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaJppKIAO5fN7BxyqcG9wQAAAMo"]
[Sat Feb 28 12:05:58.691690 2026] [:error] [pid 52460:tid 52470] [client 20.104.82.189:11033] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ha.php"] [unique_id "aaJpprLWOogAgHGh62T6vwAAAYc"]
[Sat Feb 28 12:06:00.039115 2026] [:error] [pid 11791:tid 11805] [client 20.104.82.189:11244] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaJpqGuX5e1Q32gqxH36jgAAAQw"]
[Sat Feb 28 12:06:00.821633 2026] [:error] [pid 11791:tid 11804] [client 20.104.82.189:11220] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaJpqGuX5e1Q32gqxH36kQAAAQs"]
[Sat Feb 28 12:06:01.776054 2026] [:error] [pid 39292:tid 39316] [client 20.104.82.189:11105] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaJpqaIAO5fN7BxyqcG9yAAAANY"]
[Sat Feb 28 12:06:03.072000 2026] [:error] [pid 52460:tid 52485] [client 20.104.82.189:11254] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gg.php"] [unique_id "aaJpq7LWOogAgHGh62T62QAAAZY"]
[Sat Feb 28 12:06:04.206205 2026] [:error] [pid 11791:tid 11809] [client 20.104.82.189:11012] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaJprGuX5e1Q32gqxH36nwAAARA"]
[Sat Feb 28 12:06:05.138494 2026] [:error] [pid 39185:tid 39270] [client 20.104.82.189:10916] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaJprRVE-FfM89u7BQaQEgAAAJg"]
[Sat Feb 28 12:06:08.053774 2026] [:error] [pid 39184:tid 39221] [client 20.104.82.189:11130] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaJpsFtZF9Zd_U7easDNfQAAAEI"]
[Sat Feb 28 12:06:09.903198 2026] [:error] [pid 39292:tid 39307] [client 20.104.82.189:11194] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we2.php"] [unique_id "aaJpsaIAO5fN7BxyqcG90QAAAM0"]
[Sat Feb 28 12:06:13.237834 2026] [:error] [pid 22194:tid 22209] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Sat Feb 28 12:06:13.454269 2026] [:error] [pid 22194:tid 22218] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sat Feb 28 12:06:13.663102 2026] [:error] [pid 22194:tid 22210] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Sat Feb 28 12:06:13.871258 2026] [:error] [pid 22194:tid 22208] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Sat Feb 28 12:06:14.079289 2026] [:error] [pid 22194:tid 22206] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Feb 28 12:06:14.290674 2026] [:error] [pid 22194:tid 22202] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Feb 28 12:06:14.500307 2026] [:error] [pid 22194:tid 22212] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Sat Feb 28 12:06:14.713552 2026] [:error] [pid 22194:tid 22207] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Sat Feb 28 12:06:14.923308 2026] [:error] [pid 22194:tid 22220] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/ave.php
[Sat Feb 28 12:06:15.131855 2026] [:error] [pid 22194:tid 22219] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Sat Feb 28 12:06:15.361042 2026] [:error] [pid 22194:tid 22205] [client 20.104.82.189:11008] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Sat Feb 28 12:06:15.565900 2026] [:error] [pid 22194:tid 22211] [client 20.104.82.189:11008] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaJpt36mbajs3bzQGysvdwAAAU8"]
[Sat Feb 28 12:06:18.731878 2026] [:error] [pid 52460:tid 52486] [client 20.104.82.189:11070] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaJpurLWOogAgHGh62T7NwAAAZc"]
[Sat Feb 28 12:06:22.601007 2026] [:error] [pid 39292:tid 39301] [client 20.104.82.189:10960] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaJpvqIAO5fN7BxyqcG93AAAAMc"]
[Sat Feb 28 12:06:23.754192 2026] [:error] [pid 52460:tid 52471] [client 20.104.82.189:11256] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/radio.php"] [unique_id "aaJpv7LWOogAgHGh62T7YAAAAYg"]
[Sat Feb 28 12:06:25.303502 2026] [:error] [pid 52460:tid 52487] [client 20.104.82.189:11043] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaJpwbLWOogAgHGh62T7awAAAZg"]
[Sat Feb 28 12:06:26.291485 2026] [:error] [pid 39185:tid 39261] [client 20.104.82.189:11125] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaJpwhVE-FfM89u7BQaQLwAAAI8"]
[Sat Feb 28 12:06:27.460117 2026] [:error] [pid 52460:tid 52470] [client 20.104.82.189:11226] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaJpw7LWOogAgHGh62T7eQAAAYc"]
[Sat Feb 28 12:06:28.656930 2026] [:error] [pid 52460:tid 52467] [client 20.104.82.189:11050] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/files.php"] [unique_id "aaJpxLLWOogAgHGh62T7ggAAAYQ"]
[Sat Feb 28 12:06:29.535797 2026] [:error] [pid 39292:tid 39294] [client 20.104.82.189:11208] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaJpxaIAO5fN7BxyqcG98wAAAMA"]
[Sat Feb 28 12:06:30.647841 2026] [:error] [pid 11791:tid 11817] [client 20.104.82.189:11152] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaJpxmuX5e1Q32gqxH36xgAAARg"]
[Sat Feb 28 12:06:32.008952 2026] [:error] [pid 11791:tid 11800] [client 20.104.82.189:11200] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaJpyGuX5e1Q32gqxH36xwAAAQc"]
[Sat Feb 28 12:06:34.575707 2026] [:error] [pid 11791:tid 11802] [client 20.104.82.189:11063] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file7.php"] [unique_id "aaJpymuX5e1Q32gqxH36yQAAAQk"]
[Sat Feb 28 12:06:35.812624 2026] [:error] [pid 39185:tid 39248] [client 20.104.82.189:11258] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaJpyxVE-FfM89u7BQaQUgAAAII"]
[Sat Feb 28 12:06:36.862037 2026] [:error] [pid 39292:tid 39315] [client 20.104.82.189:11170] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaJpzKIAO5fN7BxyqcG9_gAAANU"]
[Sat Feb 28 12:06:37.675264 2026] [:error] [pid 11791:tid 11811] [client 20.104.82.189:11048] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaJpzWuX5e1Q32gqxH360AAAARI"]
[Sat Feb 28 12:06:39.796044 2026] [:error] [pid 39185:tid 39255] [client 20.104.82.189:11067] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaJpzxVE-FfM89u7BQaQaQAAAIk"]
[Sat Feb 28 12:06:43.310428 2026] [:error] [pid 52460:tid 52473] [client 20.104.82.189:11145] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaJp07LWOogAgHGh62T7pwAAAYo"]
[Sat Feb 28 12:06:46.137565 2026] [:error] [pid 39185:tid 39267] [client 20.104.82.189:11261] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaJp1hVE-FfM89u7BQaQlQAAAJU"]
[Sat Feb 28 12:06:50.071985 2026] [:error] [pid 39185:tid 39249] [client 20.104.82.189:11120] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaJp2hVE-FfM89u7BQaQsAAAAIM"]
[Sat Feb 28 12:06:58.440647 2026] [:error] [pid 52460:tid 52467] [client 20.104.82.189:11215] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaJp4rLWOogAgHGh62T7xQAAAYQ"]
[Sat Feb 28 12:07:00.687824 2026] [:error] [pid 22194:tid 22208] [client 20.104.82.189:11206] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaJp5H6mbajs3bzQGysvkwAAAUw"]
[Sat Feb 28 12:07:01.852590 2026] [:error] [pid 11791:tid 11801] [client 20.104.82.189:11147] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaJp5WuX5e1Q32gqxH36-AAAAQg"]
[Sat Feb 28 12:07:05.493787 2026] [:error] [pid 11791:tid 11807] [client 20.104.82.189:10883] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nox.php"] [unique_id "aaJp6WuX5e1Q32gqxH37CQAAAQ4"]
[Sat Feb 28 12:07:08.986379 2026] [:error] [pid 11791:tid 11807] [client 20.104.82.189:10979] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaJp7GuX5e1Q32gqxH37HgAAAQ4"]
[Sat Feb 28 12:07:10.511348 2026] [:error] [pid 39183:tid 39216] [client 20.104.82.189:10975] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaJp7hCf4HvhVePw3LbfdQAAABg"]
[Sat Feb 28 12:07:11.335976 2026] [:error] [pid 52460:tid 52482] [client 20.104.82.189:11251] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaJp77LWOogAgHGh62T76gAAAZM"]
[Sat Feb 28 12:07:12.047486 2026] [:error] [pid 11791:tid 11802] [client 20.104.82.189:11245] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "aaJp8GuX5e1Q32gqxH37KQAAAQk"]
[Sat Feb 28 12:07:12.658541 2026] [:error] [pid 39292:tid 39314] [client 20.104.82.189:11053] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aaJp8KIAO5fN7BxyqcG-UgAAANQ"]
[Sat Feb 28 12:07:13.533256 2026] [:error] [pid 52460:tid 52479] [client 20.104.82.189:11260] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aaJp8bLWOogAgHGh62T78AAAAZA"]
[Sat Feb 28 12:07:14.707810 2026] [:error] [pid 22194:tid 22213] [client 20.104.82.189:11203] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/info.php"] [unique_id "aaJp8n6mbajs3bzQGysvogAAAVE"]
[Sat Feb 28 12:07:15.645279 2026] [:error] [pid 22194:tid 22216] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Feb 28 12:07:16.164476 2026] [:error] [pid 22194:tid 22208] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Sat Feb 28 12:07:16.386158 2026] [:error] [pid 22194:tid 22218] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Sat Feb 28 12:07:16.594029 2026] [:error] [pid 22194:tid 22206] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Sat Feb 28 12:07:16.801355 2026] [:error] [pid 22194:tid 22202] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Sat Feb 28 12:07:17.017614 2026] [:error] [pid 22194:tid 22212] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Sat Feb 28 12:07:17.230631 2026] [:error] [pid 22194:tid 22205] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sat Feb 28 12:07:17.464777 2026] [:error] [pid 22194:tid 22200] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Sat Feb 28 12:07:17.688911 2026] [:error] [pid 22194:tid 22204] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Sat Feb 28 12:07:18.681733 2026] [:error] [pid 22194:tid 22211] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sat Feb 28 12:07:18.892451 2026] [:error] [pid 22194:tid 22201] [client 20.104.82.189:11202] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Sat Feb 28 12:07:20.327214 2026] [:error] [pid 22194:tid 22201] [client 20.104.82.189:11202] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaJp-H6mbajs3bzQGysvtQAAAUU"]
[Sat Feb 28 12:07:21.506408 2026] [:error] [pid 39185:tid 39259] [client 20.104.82.189:11141] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaJp-RVE-FfM89u7BQaRIwAAAI0"]
[Sat Feb 28 12:07:23.682721 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:10949] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaJp-7LWOogAgHGh62T8IAAAAYs"]
[Sat Feb 28 12:07:25.049638 2026] [:error] [pid 11791:tid 11817] [client 20.104.82.189:10888] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/az.php"] [unique_id "aaJp_WuX5e1Q32gqxH37RAAAARg"]
[Sat Feb 28 12:07:26.703890 2026] [:error] [pid 39184:tid 39222] [client 20.104.82.189:11249] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaJp_ltZF9Zd_U7easDNtQAAAEM"]
[Sat Feb 28 12:07:27.819979 2026] [:error] [pid 52460:tid 52463] [client 20.104.82.189:11173] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaJp_7LWOogAgHGh62T8MQAAAYA"]
[Sat Feb 28 12:07:32.186302 2026] [:error] [pid 39183:tid 39208] [client 20.104.82.189:11153] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaJqBBCf4HvhVePw3LbffAAAABA"]
[Sat Feb 28 12:07:34.946271 2026] [:error] [pid 11791:tid 11816] [client 20.104.82.189:11136] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xaz.php"] [unique_id "aaJqBmuX5e1Q32gqxH37ZQAAARc"]
[Sat Feb 28 12:07:36.125166 2026] [:error] [pid 11791:tid 11796] [client 20.104.82.189:11188] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaJqCGuX5e1Q32gqxH37ZwAAAQM"]
[Sat Feb 28 12:07:38.124154 2026] [:error] [pid 11791:tid 11797] [client 20.104.82.189:11257] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaJqCmuX5e1Q32gqxH37bwAAAQQ"]
[Sat Feb 28 12:07:39.510214 2026] [:error] [pid 39185:tid 39246] [client 20.104.82.189:11057] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaJqCxVE-FfM89u7BQaRSQAAAIA"]
[Sat Feb 28 12:07:40.561463 2026] [:error] [pid 52460:tid 52482] [client 20.104.82.189:10902] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/up4.php"] [unique_id "aaJqDLLWOogAgHGh62T8agAAAZM"]
[Sat Feb 28 12:07:42.103314 2026] [:error] [pid 52460:tid 52472] [client 20.104.82.189:11185] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaJqDrLWOogAgHGh62T8cgAAAYk"]
[Sat Feb 28 12:07:43.416049 2026] [:error] [pid 39184:tid 39221] [client 20.104.82.189:11219] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaJqD1tZF9Zd_U7easDNwgAAAEI"]
[Sat Feb 28 12:07:44.481836 2026] [:error] [pid 39185:tid 39247] [client 20.104.82.189:11248] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaJqEBVE-FfM89u7BQaRVQAAAIE"]
[Sat Feb 28 12:07:45.296001 2026] [:error] [pid 11791:tid 11796] [client 20.104.82.189:11143] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1aa.php"] [unique_id "aaJqEWuX5e1Q32gqxH37fAAAAQM"]
[Sat Feb 28 12:07:46.156151 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:11148] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaJqErLWOogAgHGh62T8lQAAAYs"]
[Sat Feb 28 12:07:47.996948 2026] [:error] [pid 22194:tid 22196] [client 20.104.82.189:11217] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaJqE36mbajs3bzQGysvwAAAAUA"]
[Sat Feb 28 12:07:49.177458 2026] [:error] [pid 39185:tid 39257] [client 20.104.82.189:11235] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaJqFRVE-FfM89u7BQaRYQAAAIs"]
[Sat Feb 28 12:07:50.599094 2026] [:error] [pid 52460:tid 52478] [client 20.104.82.189:11109] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/elp.php"] [unique_id "aaJqFrLWOogAgHGh62T8qgAAAY8"]
[Sat Feb 28 12:07:51.698106 2026] [:error] [pid 52460:tid 52466] [client 20.104.82.189:11222] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaJqF7LWOogAgHGh62T8tAAAAYM"]
[Sat Feb 28 12:07:52.239797 2026] [:error] [pid 52460:tid 52485] [client 20.104.82.189:10881] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaJqGLLWOogAgHGh62T8uQAAAZY"]
[Sat Feb 28 12:07:53.140183 2026] [:error] [pid 39292:tid 39306] [client 20.104.82.189:11151] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaJqGaIAO5fN7BxyqcG-jwAAAMw"]
[Sat Feb 28 12:07:53.915284 2026] [:error] [pid 52460:tid 52471] [client 20.104.82.189:10969] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtz.php"] [unique_id "aaJqGbLWOogAgHGh62T8wwAAAYg"]
[Sat Feb 28 12:07:54.659727 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11082] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaJqGrLWOogAgHGh62T8zgAAAZU"]
[Sat Feb 28 12:07:55.669626 2026] [:error] [pid 52460:tid 52468] [client 20.104.82.189:11056] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaJqG7LWOogAgHGh62T81AAAAYU"]
[Sat Feb 28 12:07:56.166659 2026] [:error] [pid 52460:tid 52485] [client 20.104.82.189:11129] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaJqHLLWOogAgHGh62T81gAAAZY"]
[Sat Feb 28 12:07:57.090983 2026] [:error] [pid 52460:tid 52479] [client 20.104.82.189:11168] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/galex.php"] [unique_id "aaJqHbLWOogAgHGh62T83QAAAZA"]
[Sat Feb 28 12:07:57.996113 2026] [:error] [pid 39185:tid 39264] [client 20.104.82.189:11020] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaJqHRVE-FfM89u7BQaRgAAAAJI"]
[Sat Feb 28 12:07:58.674813 2026] [:error] [pid 39185:tid 39253] [client 20.104.82.189:11234] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaJqHhVE-FfM89u7BQaRhQAAAIc"]
[Sat Feb 28 12:07:59.154615 2026] [:error] [pid 39185:tid 39262] [client 20.104.82.189:11142] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaJqHxVE-FfM89u7BQaRiAAAAJA"]
[Sat Feb 28 12:07:59.947690 2026] [:error] [pid 52460:tid 52469] [client 20.104.82.189:10985] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xb.php"] [unique_id "aaJqH7LWOogAgHGh62T85QAAAYY"]
[Sat Feb 28 12:08:00.444890 2026] [:error] [pid 52460:tid 52473] [client 20.104.82.189:11157] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaJqILLWOogAgHGh62T86QAAAYo"]
[Sat Feb 28 12:08:00.973901 2026] [:error] [pid 11791:tid 11814] [client 20.104.82.189:11228] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaJqIGuX5e1Q32gqxH37kgAAARU"]
[Sat Feb 28 12:08:01.491889 2026] [:error] [pid 11791:tid 11806] [client 20.104.82.189:11214] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaJqIWuX5e1Q32gqxH37lAAAAQ0"]
[Sat Feb 28 12:08:01.924848 2026] [:error] [pid 39185:tid 39253] [client 20.104.82.189:10967] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ova.php"] [unique_id "aaJqIRVE-FfM89u7BQaRlgAAAIc"]
[Sat Feb 28 12:08:02.423618 2026] [:error] [pid 52460:tid 52475] [client 20.104.82.189:11263] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaJqIrLWOogAgHGh62T89QAAAYw"]
[Sat Feb 28 12:08:03.199060 2026] [:error] [pid 52460:tid 52473] [client 20.104.82.189:11013] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaJqI7LWOogAgHGh62T8_QAAAYo"]
[Sat Feb 28 12:08:03.951823 2026] [:error] [pid 52460:tid 52475] [client 20.104.82.189:11164] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaJqI7LWOogAgHGh62T9AwAAAYw"]
[Sat Feb 28 12:08:04.554263 2026] [:error] [pid 52460:tid 52481] [client 20.104.82.189:11236] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vx.php"] [unique_id "aaJqJLLWOogAgHGh62T9CAAAAZI"]
[Sat Feb 28 12:08:05.234229 2026] [:error] [pid 52460:tid 52472] [client 20.104.82.189:11172] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaJqJbLWOogAgHGh62T9EQAAAYk"]
[Sat Feb 28 12:08:05.700599 2026] [:error] [pid 52460:tid 52483] [client 20.104.82.189:11156] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaJqJbLWOogAgHGh62T9FAAAAZQ"]
[Sat Feb 28 12:08:06.358152 2026] [:error] [pid 39185:tid 39248] [client 20.104.82.189:10958] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaJqJhVE-FfM89u7BQaRowAAAII"]
[Sat Feb 28 12:08:06.882407 2026] [:error] [pid 52460:tid 52476] [client 20.104.82.189:11146] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rh.php"] [unique_id "aaJqJrLWOogAgHGh62T9HQAAAY0"]
[Sat Feb 28 12:08:07.344963 2026] [:error] [pid 52460:tid 52477] [client 20.104.82.189:11144] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaJqJ7LWOogAgHGh62T9HgAAAY4"]
[Sat Feb 28 12:08:07.789194 2026] [:error] [pid 39185:tid 39254] [client 20.104.82.189:11175] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aaJqJxVE-FfM89u7BQaRqQAAAIg"]
[Sat Feb 28 12:08:08.251456 2026] [:error] [pid 11791:tid 11817] [client 20.104.82.189:11040] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aaJqKGuX5e1Q32gqxH37nQAAARg"]
[Sat Feb 28 12:08:08.845175 2026] [:error] [pid 52460:tid 52470] [client 20.104.82.189:11253] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aaJqKLLWOogAgHGh62T9IgAAAYc"]
[Sat Feb 28 12:08:09.305190 2026] [:error] [pid 11791:tid 11802] [client 20.104.82.189:11072] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aaJqKWuX5e1Q32gqxH37pAAAAQk"]
[Sat Feb 28 12:08:09.792575 2026] [:error] [pid 52460:tid 52484] [client 20.104.82.189:11151] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/spip.php"] [unique_id "aaJqKbLWOogAgHGh62T9JAAAAZU"]
[Sat Feb 28 12:08:10.233923 2026] [:error] [pid 52460:tid 52474] [client 20.104.82.189:11229] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/spip.php"] [unique_id "aaJqKrLWOogAgHGh62T9KAAAAYs"]
[Sat Feb 28 12:08:10.745510 2026] [:error] [pid 52460:tid 52466] [client 20.104.82.189:11055] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/spip.php"] [unique_id "aaJqKrLWOogAgHGh62T9LAAAAYM"]
[Sat Feb 28 12:08:11.157843 2026] [:error] [pid 22194:tid 22211] [client 20.104.82.189:11088] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/spip.php"] [unique_id "aaJqK36mbajs3bzQGysv1wAAAU8"]
[Sat Feb 28 12:08:11.772184 2026] [:error] [pid 39185:tid 39264] [client 20.104.82.189:11201] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aaJqKxVE-FfM89u7BQaRsgAAAJI"]
[Sat Feb 28 12:08:12.556496 2026] [:error] [pid 39184:tid 39220] [client 20.104.82.189:11025] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aaJqLFtZF9Zd_U7easDNzQAAAEE"]
[Sat Feb 28 12:08:13.232404 2026] [:error] [pid 52460:tid 52480] [client 20.104.82.189:11241] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aaJqLbLWOogAgHGh62T9NgAAAZE"]
[Sat Feb 28 12:08:13.862647 2026] [:error] [pid 52460:tid 52479] [client 20.104.82.189:11095] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scripts/wpup.php"] [unique_id "aaJqLbLWOogAgHGh62T9NwAAAZA"]
[Sat Feb 28 12:08:14.589796 2026] [:error] [pid 11791:tid 11811] [client 20.104.82.189:11211] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aaJqLmuX5e1Q32gqxH37rQAAARI"]
[Sat Feb 28 12:08:15.145432 2026] [:error] [pid 52460:tid 52477] [client 20.104.82.189:11231] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aaJqL7LWOogAgHGh62T9QAAAAY4"]
[Sat Feb 28 12:08:16.179731 2026] [:error] [pid 11791:tid 11807] [client 20.104.82.189:11240] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aaJqMGuX5e1Q32gqxH37tgAAAQ4"]
[Sat Feb 28 12:08:17.072701 2026] [:error] [pid 39185:tid 39263] [client 20.104.82.189:11232] [client 20.104.82.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/update/wpupex.php"] [unique_id "aaJqMRVE-FfM89u7BQaRywAAAJE"]
[Sat Feb 28 12:08:18.668819 2026] [:error] [pid 39185:tid 39251] [client 20.104.82.189:11015] File does not exist: /usr/local/apache/htdocs/suspended-page/myy.php
[Sat Feb 28 12:08:19.325568 2026] [:error] [pid 39185:tid 39257] [client 20.104.82.189:11015] [client 20.104.82.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/library/upload.php"] [unique_id "aaJqMxVE-FfM89u7BQaR3wAAAIs"]
[Sat Feb 28 12:08:21.476743 2026] [:error] [pid 39185:tid 39270] [client 20.104.82.189:11014] File does not exist: /usr/local/apache/htdocs/suspended-page/dapa.php
[Sat Feb 28 12:34:57.680696 2026] [:error] [pid 22194:tid 22200] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/god.php
[Sat Feb 28 12:34:58.096659 2026] [:error] [pid 22194:tid 22201] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Sat Feb 28 12:34:58.305131 2026] [:error] [pid 22194:tid 22208] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Sat Feb 28 12:34:58.673509 2026] [:error] [pid 22194:tid 22208] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sat Feb 28 12:34:59.038123 2026] [:error] [pid 22194:tid 22205] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Sat Feb 28 12:34:59.401248 2026] [:error] [pid 22194:tid 22216] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/C1.php
[Sat Feb 28 12:34:59.620706 2026] [:error] [pid 22194:tid 22211] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/gi.php
[Sat Feb 28 12:35:00.020438 2026] [:error] [pid 22194:tid 22211] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Sat Feb 28 12:35:00.232016 2026] [:error] [pid 22194:tid 22198] [client 20.104.16.102:13267] File does not exist: /usr/local/apache/htdocs/suspended-page/tkllu.php
[Sat Feb 28 12:35:00.436844 2026] [:error] [pid 22194:tid 22215] [client 20.104.16.102:13267] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aaJwdH6mbajs3bzQGys4NAAAAVM"]
[Sat Feb 28 12:35:01.835547 2026] [:error] [pid 52460:tid 52472] [client 20.104.16.102:17053] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aaJwdbLWOogAgHGh62QWuQAAAYk"]
[Sat Feb 28 12:35:04.444710 2026] [:error] [pid 52460:tid 52464] [client 20.104.16.102:8282] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aaJweLLWOogAgHGh62QW-AAAAYE"]
[Sat Feb 28 12:35:06.229882 2026] [:error] [pid 39185:tid 39257] [client 20.104.16.102:14654] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "aaJwehVE-FfM89u7BQajHwAAAIs"]
[Sat Feb 28 12:35:07.414941 2026] [:error] [pid 52460:tid 52468] [client 20.104.16.102:42859] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwe7LWOogAgHGh62QXAwAAAYU"]
[Sat Feb 28 12:35:08.962008 2026] [:error] [pid 52460:tid 52467] [client 20.104.16.102:22810] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwfLLWOogAgHGh62QXDAAAAYQ"]
[Sat Feb 28 12:35:10.684694 2026] [:error] [pid 52460:tid 52466] [client 20.104.16.102:64584] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwfrLWOogAgHGh62QXGwAAAYM"]
[Sat Feb 28 12:35:11.354792 2026] [:error] [pid 39292:tid 39294] [client 20.104.16.102:47851] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwf6IAO5fN7BxyqcHHpgAAAMA"]
[Sat Feb 28 12:35:12.131268 2026] [:error] [pid 11791:tid 11798] [client 20.104.16.102:9084] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwgGuX5e1Q32gqxH0KAAAAAQU"]
[Sat Feb 28 12:35:13.044088 2026] [:error] [pid 52460:tid 52470] [client 20.104.16.102:13235] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwgbLWOogAgHGh62QXJQAAAYc"]
[Sat Feb 28 12:35:14.004266 2026] [:error] [pid 11791:tid 11809] [client 20.104.16.102:37299] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwgmuX5e1Q32gqxH0KBwAAARA"]
[Sat Feb 28 12:35:15.055594 2026] [:error] [pid 52460:tid 52469] [client 20.104.16.102:48323] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaJwg7LWOogAgHGh62QXNgAAAYY"]
[Sat Feb 28 12:35:15.660988 2026] [:error] [pid 52460:tid 52487] [client 20.104.16.102:18471] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaJwg7LWOogAgHGh62QXOwAAAZg"]
[Sat Feb 28 12:35:16.582758 2026] [:error] [pid 11791:tid 11801] [client 20.104.16.102:26088] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaJwhGuX5e1Q32gqxH0KCwAAAQg"]
[Sat Feb 28 12:35:17.169597 2026] [:error] [pid 39185:tid 39246] [client 20.104.16.102:26054] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaJwhRVE-FfM89u7BQajKAAAAIA"]
[Sat Feb 28 12:35:17.925515 2026] [:error] [pid 11791:tid 11799] [client 20.104.16.102:32029] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaJwhWuX5e1Q32gqxH0KEAAAAQY"]
[Sat Feb 28 12:35:18.388807 2026] [:error] [pid 11791:tid 11797] [client 20.104.16.102:34592] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.PhP7"] [unique_id "aaJwhmuX5e1Q32gqxH0KEwAAAQQ"]
[Sat Feb 28 12:35:18.838893 2026] [:error] [pid 39185:tid 39266] [client 20.104.16.102:32053] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.PhP7"] [unique_id "aaJwhhVE-FfM89u7BQajMQAAAJQ"]
[Sat Feb 28 12:35:19.561567 2026] [:error] [pid 39185:tid 39247] [client 20.104.16.102:48343] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.PhP7"] [unique_id "aaJwhxVE-FfM89u7BQajNgAAAIE"]
[Sat Feb 28 12:35:20.220192 2026] [:error] [pid 11791:tid 11815] [client 20.104.16.102:32032] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f.PhP7"] [unique_id "aaJwiGuX5e1Q32gqxH0KFgAAARY"]
[Sat Feb 28 12:35:22.570233 2026] [:error] [pid 39185:tid 39260] [client 20.104.16.102:15326] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaJwihVE-FfM89u7BQajQQAAAI4"]
[Sat Feb 28 12:35:25.073934 2026] [:error] [pid 11791:tid 11808] [client 20.104.16.102:17449] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaJwjWuX5e1Q32gqxH0KHwAAAQ8"]
[Sat Feb 28 12:35:27.694564 2026] [:error] [pid 22194:tid 22209] [client 20.104.16.102:8730] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaJwj36mbajs3bzQGys4aQAAAU0"]
[Sat Feb 28 12:35:29.411891 2026] [:error] [pid 39292:tid 39310] [client 20.104.16.102:15333] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaJwkaIAO5fN7BxyqcHHswAAANA"]
[Sat Feb 28 12:35:31.226608 2026] [:error] [pid 39185:tid 39249] [client 20.104.16.102:32682] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "aaJwkxVE-FfM89u7BQajVgAAAIM"]
[Sat Feb 28 12:35:32.742672 2026] [:error] [pid 39185:tid 39260] [client 20.104.16.102:48266] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "aaJwlBVE-FfM89u7BQajYAAAAI4"]
[Sat Feb 28 12:35:33.732543 2026] [:error] [pid 39292:tid 39311] [client 20.104.16.102:32700] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "aaJwlaIAO5fN7BxyqcHHtAAAANE"]
[Sat Feb 28 12:35:36.002743 2026] [:error] [pid 39185:tid 39251] [client 20.104.16.102:25399] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "aaJwmBVE-FfM89u7BQajawAAAIU"]
[Sat Feb 28 12:35:37.317825 2026] [:error] [pid 39185:tid 39259] [client 20.104.16.102:24865] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aaJwmRVE-FfM89u7BQajcQAAAI0"]
[Sat Feb 28 12:35:38.561218 2026] [:error] [pid 39292:tid 39300] [client 20.104.16.102:17418] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aaJwmqIAO5fN7BxyqcHHvgAAAMY"]
[Sat Feb 28 12:35:39.229555 2026] [:error] [pid 39183:tid 39210] [client 20.104.16.102:32050] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aaJwmxCf4HvhVePw3Lbk1QAAABI"]
[Sat Feb 28 12:35:40.168698 2026] [:error] [pid 39185:tid 39251] [client 20.104.16.102:28835] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "aaJwnBVE-FfM89u7BQajewAAAIU"]
[Sat Feb 28 12:35:41.087567 2026] [:error] [pid 39185:tid 39268] [client 20.104.16.102:28801] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "aaJwnRVE-FfM89u7BQajfQAAAJY"]
[Sat Feb 28 12:35:42.847526 2026] [:error] [pid 39185:tid 39254] [client 20.104.16.102:13247] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "aaJwnhVE-FfM89u7BQajgQAAAIg"]
[Sat Feb 28 12:35:44.093323 2026] [:error] [pid 39185:tid 39261] [client 20.104.16.102:32116] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "aaJwoBVE-FfM89u7BQajigAAAI8"]
[Sat Feb 28 12:35:46.653958 2026] [:error] [pid 39292:tid 39296] [client 20.104.16.102:9150] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "aaJwoqIAO5fN7BxyqcHHwwAAAMI"]
[Sat Feb 28 12:35:50.573268 2026] [:error] [pid 22194:tid 22203] [client 20.104.16.102:17447] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaJwpn6mbajs3bzQGys4gQAAAUc"]
[Sat Feb 28 12:35:53.277107 2026] [:error] [pid 52460:tid 52478] [client 20.104.16.102:8971] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaJwqbLWOogAgHGh62QXqAAAAY8"]
[Sat Feb 28 12:35:55.754750 2026] [:error] [pid 39292:tid 39295] [client 20.104.16.102:9143] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaJwq6IAO5fN7BxyqcHHzgAAAME"]
[Sat Feb 28 12:35:57.738288 2026] [:error] [pid 11791:tid 11806] [client 20.104.16.102:28848] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaJwrWuX5e1Q32gqxH0KUAAAAQ0"]
[Sat Feb 28 12:35:58.682961 2026] [:error] [pid 52460:tid 52485] [client 20.104.16.102:35878] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/advanc.php"] [unique_id "aaJwrrLWOogAgHGh62QXtQAAAZY"]
[Sat Feb 28 12:35:59.831323 2026] [:error] [pid 22194:tid 22219] [client 20.104.16.102:28802] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/advanc.php"] [unique_id "aaJwr36mbajs3bzQGys4hwAAAVc"]
[Sat Feb 28 12:36:00.753761 2026] [:error] [pid 39292:tid 39316] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/advanc.php
[Sat Feb 28 12:36:00.961773 2026] [:error] [pid 39292:tid 39314] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sat Feb 28 12:36:01.193600 2026] [:error] [pid 39292:tid 39300] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/ftyude.php
[Sat Feb 28 12:36:01.401919 2026] [:error] [pid 39292:tid 39303] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Sat Feb 28 12:36:01.627173 2026] [:error] [pid 39292:tid 39313] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sat Feb 28 12:36:01.838235 2026] [:error] [pid 39292:tid 39299] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/vgtyu.php
[Sat Feb 28 12:36:02.046315 2026] [:error] [pid 39292:tid 39310] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/sxdfrt.php
[Sat Feb 28 12:36:02.256659 2026] [:error] [pid 39292:tid 39296] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-x.php
[Sat Feb 28 12:36:02.498761 2026] [:error] [pid 39292:tid 39304] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sat Feb 28 12:36:02.706714 2026] [:error] [pid 39292:tid 39301] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/asd67.php
[Sat Feb 28 12:36:02.923788 2026] [:error] [pid 39292:tid 39305] [client 20.104.16.102:39142] File does not exist: /usr/local/apache/htdocs/suspended-page/zr.php
[Sat Feb 28 12:36:03.129142 2026] [:error] [pid 39292:tid 39311] [client 20.104.16.102:39142] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaJws6IAO5fN7BxyqcHH3QAAANE"]
[Sat Feb 28 12:36:03.884903 2026] [:error] [pid 52460:tid 52479] [client 20.104.16.102:39711] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaJws7LWOogAgHGh62QXygAAAZA"]
[Sat Feb 28 12:36:04.404046 2026] [:error] [pid 52460:tid 52464] [client 20.104.16.102:39682] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaJwtLLWOogAgHGh62QXzgAAAYE"]
[Sat Feb 28 12:36:04.969361 2026] [:error] [pid 11791:tid 11801] [client 20.104.16.102:34300] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaJwtGuX5e1Q32gqxH0KUgAAAQg"]
[Sat Feb 28 12:36:05.544532 2026] [:error] [pid 52460:tid 52472] [client 20.104.16.102:17117] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1a.php"] [unique_id "aaJwtbLWOogAgHGh62QX1QAAAYk"]
[Sat Feb 28 12:36:06.636265 2026] [:error] [pid 39292:tid 39295] [client 20.104.16.102:28190] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1a.php"] [unique_id "aaJwtqIAO5fN7BxyqcHH5QAAAME"]
[Sat Feb 28 12:36:07.820058 2026] [:error] [pid 52460:tid 52480] [client 20.104.16.102:33172] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1a.php"] [unique_id "aaJwt7LWOogAgHGh62QX4AAAAZE"]
[Sat Feb 28 12:36:08.511400 2026] [:error] [pid 52460:tid 52464] [client 20.104.16.102:35890] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1a.php"] [unique_id "aaJwuLLWOogAgHGh62QX6QAAAYE"]
[Sat Feb 28 12:36:09.323655 2026] [:error] [pid 52460:tid 52467] [client 20.104.16.102:14708] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaJwubLWOogAgHGh62QX7wAAAYQ"]
[Sat Feb 28 12:36:10.473132 2026] [:error] [pid 52460:tid 52474] [client 20.104.16.102:16016] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaJwurLWOogAgHGh62QX8gAAAYs"]
[Sat Feb 28 12:36:11.766030 2026] [:error] [pid 39185:tid 39268] [client 20.104.16.102:39157] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaJwuxVE-FfM89u7BQajuwAAAJY"]
[Sat Feb 28 12:36:13.510554 2026] [:error] [pid 52460:tid 52472] [client 20.104.16.102:54286] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moshou.php"] [unique_id "aaJwvbLWOogAgHGh62QX_wAAAYk"]
[Sat Feb 28 12:36:15.912378 2026] [:error] [pid 39185:tid 39247] [client 20.104.16.102:39135] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leu.php"] [unique_id "aaJwvxVE-FfM89u7BQajygAAAIE"]
[Sat Feb 28 12:36:17.434242 2026] [:error] [pid 39292:tid 39297] [client 20.104.16.102:17100] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leu.php"] [unique_id "aaJwwaIAO5fN7BxyqcHH8wAAAMM"]
[Sat Feb 28 12:36:19.353808 2026] [:error] [pid 11791:tid 11813] [client 20.104.16.102:12129] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leu.php"] [unique_id "aaJww2uX5e1Q32gqxH0KVgAAARQ"]
[Sat Feb 28 12:36:20.089849 2026] [:error] [pid 11791:tid 11797] [client 20.104.16.102:36721] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/leu.php"] [unique_id "aaJwxGuX5e1Q32gqxH0KWQAAAQQ"]
[Sat Feb 28 12:36:21.857581 2026] [:error] [pid 11791:tid 11803] [client 20.104.16.102:19905] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "aaJwxWuX5e1Q32gqxH0KXwAAAQo"]
[Sat Feb 28 12:36:22.717777 2026] [:error] [pid 39185:tid 39249] [client 20.104.16.102:46490] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "aaJwxhVE-FfM89u7BQaj7gAAAIM"]
[Sat Feb 28 12:36:23.623329 2026] [:error] [pid 52460:tid 52474] [client 20.104.16.102:33241] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "aaJwx7LWOogAgHGh62QYEQAAAYs"]
[Sat Feb 28 12:36:25.119930 2026] [:error] [pid 11791:tid 11816] [client 20.104.16.102:33275] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "aaJwyWuX5e1Q32gqxH0KZAAAARc"]
[Sat Feb 28 12:36:27.149510 2026] [:error] [pid 39185:tid 39251] [client 20.104.16.102:39124] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaJwyxVE-FfM89u7BQaj_AAAAIU"]
[Sat Feb 28 12:36:28.708203 2026] [:error] [pid 39185:tid 39259] [client 20.104.16.102:46522] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaJwzBVE-FfM89u7BQakAAAAAI0"]
[Sat Feb 28 12:36:31.403772 2026] [:error] [pid 39185:tid 39261] [client 20.104.16.102:24122] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaJwzxVE-FfM89u7BQakCwAAAI8"]
[Sat Feb 28 12:36:33.762623 2026] [:error] [pid 39184:tid 39222] [client 20.104.16.102:14266] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaJw0VtZF9Zd_U7easDUeAAAAEM"]
[Sat Feb 28 12:36:35.417918 2026] [:error] [pid 39292:tid 39316] [client 20.104.16.102:39696] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mon.php"] [unique_id "aaJw06IAO5fN7BxyqcHH-wAAANY"]
[Sat Feb 28 12:36:37.378806 2026] [:error] [pid 39183:tid 39192] [client 20.104.16.102:16001] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mon.php"] [unique_id "aaJw1RCf4HvhVePw3Lbk6gAAAAA"]
[Sat Feb 28 12:36:41.594806 2026] [:error] [pid 39183:tid 39203] [client 20.104.16.102:18550] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mon.php"] [unique_id "aaJw2RCf4HvhVePw3Lbk6wAAAAs"]
[Sat Feb 28 12:36:42.975874 2026] [:error] [pid 52460:tid 52487] [client 20.104.16.102:14219] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mon.php"] [unique_id "aaJw2rLWOogAgHGh62QYOwAAAZg"]
[Sat Feb 28 12:36:46.191284 2026] [:error] [pid 11791:tid 11797] [client 20.104.16.102:36719] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aaJw3muX5e1Q32gqxH0KawAAAQQ"]
[Sat Feb 28 12:36:50.716120 2026] [:error] [pid 52460:tid 52469] [client 20.104.16.102:8823] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aaJw4rLWOogAgHGh62QYaAAAAYY"]
[Sat Feb 28 12:36:54.342601 2026] [:error] [pid 39185:tid 39261] [client 20.104.16.102:47275] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aaJw5hVE-FfM89u7BQakZgAAAI8"]
[Sat Feb 28 12:36:56.511309 2026] [:error] [pid 52460:tid 52487] [client 20.104.16.102:8811] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yas.php"] [unique_id "aaJw6LLWOogAgHGh62QYegAAAZg"]
[Sat Feb 28 12:36:58.217081 2026] [:error] [pid 52460:tid 52479] [client 20.104.16.102:14253] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aaJw6rLWOogAgHGh62QYhQAAAZA"]
[Sat Feb 28 12:37:00.523311 2026] [:error] [pid 52460:tid 52475] [client 20.104.16.102:14226] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aaJw7LLWOogAgHGh62QYiQAAAYw"]
[Sat Feb 28 12:37:01.323430 2026] [:error] [pid 11791:tid 11796] [client 20.104.16.102:18498] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aaJw7WuX5e1Q32gqxH0KdAAAAQM"]
[Sat Feb 28 12:37:02.173558 2026] [:error] [pid 39292:tid 39303] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sat Feb 28 12:37:02.383455 2026] [:error] [pid 39292:tid 39317] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sat Feb 28 12:37:02.596485 2026] [:error] [pid 39292:tid 39310] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/41.php
[Sat Feb 28 12:37:02.806281 2026] [:error] [pid 39292:tid 39307] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 12:37:03.014705 2026] [:error] [pid 39292:tid 39296] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Sat Feb 28 12:37:03.232897 2026] [:error] [pid 39292:tid 39304] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/w3llstore.php
[Sat Feb 28 12:37:03.458658 2026] [:error] [pid 39292:tid 39301] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 12:37:03.667785 2026] [:error] [pid 39292:tid 39311] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Sat Feb 28 12:37:03.876198 2026] [:error] [pid 39292:tid 39318] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sat Feb 28 12:37:04.084364 2026] [:error] [pid 39292:tid 39297] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/kaduu.php
[Sat Feb 28 12:37:04.298612 2026] [:error] [pid 39292:tid 39312] [client 20.104.16.102:12493] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-rdf.php
[Sat Feb 28 12:37:04.503884 2026] [:error] [pid 39292:tid 39309] [client 20.104.16.102:12493] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/fot.php"] [unique_id "aaJw8KIAO5fN7BxyqcHIGgAAAM8"]
[Sat Feb 28 12:37:05.580535 2026] [:error] [pid 39185:tid 39258] [client 20.104.16.102:14264] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/fot.php"] [unique_id "aaJw8RVE-FfM89u7BQakfwAAAIw"]
[Sat Feb 28 12:37:06.692350 2026] [:error] [pid 39185:tid 39255] [client 20.104.16.102:18524] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/fot.php"] [unique_id "aaJw8hVE-FfM89u7BQakgwAAAIk"]
[Sat Feb 28 12:37:07.740156 2026] [:error] [pid 11791:tid 11802] [client 20.104.16.102:15673] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/fot.php"] [unique_id "aaJw82uX5e1Q32gqxH0KfAAAAQk"]
[Sat Feb 28 12:37:11.154705 2026] [:error] [pid 52460:tid 52475] [client 20.104.16.102:46467] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yaiid.php"] [unique_id "aaJw97LWOogAgHGh62QYowAAAYw"]
[Sat Feb 28 12:37:11.848108 2026] [:error] [pid 39185:tid 39259] [client 20.104.16.102:8697] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yaiid.php"] [unique_id "aaJw9xVE-FfM89u7BQaklgAAAI0"]
[Sat Feb 28 12:37:14.248614 2026] [:error] [pid 39185:tid 39257] [client 20.104.16.102:47348] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yaiid.php"] [unique_id "aaJw-hVE-FfM89u7BQaknQAAAIs"]
[Sat Feb 28 12:37:17.510965 2026] [:error] [pid 52460:tid 52486] [client 20.104.16.102:47336] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yaiid.php"] [unique_id "aaJw_bLWOogAgHGh62QYtgAAAZc"]
[Sat Feb 28 12:37:20.669764 2026] [:error] [pid 39184:tid 39221] [client 20.104.16.102:47315] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "aaJxAFtZF9Zd_U7easDUjAAAAEI"]
[Sat Feb 28 12:37:23.287269 2026] [:error] [pid 39184:tid 39225] [client 20.104.16.102:18529] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "aaJxA1tZF9Zd_U7easDUkAAAAEY"]
[Sat Feb 28 12:37:27.408616 2026] [:error] [pid 52460:tid 52465] [client 20.104.16.102:49004] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "aaJxB7LWOogAgHGh62QYzgAAAYI"]
[Sat Feb 28 12:37:28.705560 2026] [:error] [pid 39184:tid 39239] [client 20.104.16.102:8957] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "aaJxCFtZF9Zd_U7easDUoQAAAFQ"]
[Sat Feb 28 12:37:30.419050 2026] [:error] [pid 52460:tid 52469] [client 20.104.16.102:17489] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x12.php"] [unique_id "aaJxCrLWOogAgHGh62QY2QAAAYY"]
[Sat Feb 28 12:37:31.433763 2026] [:error] [pid 52460:tid 52474] [client 20.104.16.102:26648] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x12.php"] [unique_id "aaJxC7LWOogAgHGh62QY4QAAAYs"]
[Sat Feb 28 12:37:32.907992 2026] [:error] [pid 11791:tid 11814] [client 20.104.16.102:47237] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x12.php"] [unique_id "aaJxDGuX5e1Q32gqxH0KogAAARU"]
[Sat Feb 28 12:37:33.988247 2026] [:error] [pid 39184:tid 39226] [client 20.104.16.102:35268] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x12.php"] [unique_id "aaJxDVtZF9Zd_U7easDUpgAAAEc"]
[Sat Feb 28 12:37:35.938447 2026] [:error] [pid 39183:tid 39209] [client 20.104.16.102:28251] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aaJxDxCf4HvhVePw3Lbk9wAAABE"]
[Sat Feb 28 12:37:37.932181 2026] [:error] [pid 39185:tid 39265] [client 20.104.16.102:8342] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aaJxERVE-FfM89u7BQak0gAAAJM"]
[Sat Feb 28 12:37:39.064616 2026] [:error] [pid 22194:tid 22210] [client 20.104.16.102:14938] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aaJxE36mbajs3bzQGys4swAAAU4"]
[Sat Feb 28 12:37:40.731632 2026] [:error] [pid 22194:tid 22196] [client 20.104.16.102:36648] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fz.php"] [unique_id "aaJxFH6mbajs3bzQGys4uQAAAUA"]
[Sat Feb 28 12:37:42.266036 2026] [:error] [pid 39183:tid 39202] [client 20.104.16.102:20715] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aaJxFhCf4HvhVePw3Lbk-QAAAAo"]
[Sat Feb 28 12:37:43.567461 2026] [:error] [pid 52460:tid 52468] [client 20.104.16.102:20688] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aaJxF7LWOogAgHGh62QZDAAAAYU"]
[Sat Feb 28 12:37:44.883923 2026] [:error] [pid 39292:tid 39302] [client 20.104.16.102:30788] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aaJxGKIAO5fN7BxyqcHIKwAAAMg"]
[Sat Feb 28 12:37:45.697276 2026] [:error] [pid 52460:tid 52476] [client 20.104.16.102:18830] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "aaJxGbLWOogAgHGh62QZEwAAAY0"]
[Sat Feb 28 12:37:46.379731 2026] [:error] [pid 39292:tid 39298] [client 20.104.16.102:30118] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8o82nc.php"] [unique_id "aaJxGqIAO5fN7BxyqcHILQAAAMQ"]
[Sat Feb 28 12:37:47.169991 2026] [:error] [pid 52460:tid 52486] [client 20.104.16.102:30845] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8o82nc.php"] [unique_id "aaJxG7LWOogAgHGh62QZHQAAAZc"]
[Sat Feb 28 12:37:48.194595 2026] [:error] [pid 52460:tid 52480] [client 20.104.16.102:30825] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8o82nc.php"] [unique_id "aaJxHLLWOogAgHGh62QZIQAAAZE"]
[Sat Feb 28 12:37:49.028986 2026] [:error] [pid 39185:tid 39248] [client 20.104.16.102:16756] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8o82nc.php"] [unique_id "aaJxHRVE-FfM89u7BQalBAAAAII"]
[Sat Feb 28 12:37:49.789702 2026] [:error] [pid 52460:tid 52466] [client 20.104.16.102:26027] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaJxHbLWOogAgHGh62QZKgAAAYM"]
[Sat Feb 28 12:37:50.415307 2026] [:error] [pid 39185:tid 39262] [client 20.104.16.102:54867] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaJxHhVE-FfM89u7BQalCgAAAJA"]
[Sat Feb 28 12:37:51.043535 2026] [:error] [pid 39185:tid 39250] [client 20.104.16.102:34225] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaJxHxVE-FfM89u7BQalDQAAAIQ"]
[Sat Feb 28 12:37:51.762031 2026] [:error] [pid 39185:tid 39256] [client 20.104.16.102:63167] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaJxHxVE-FfM89u7BQalEgAAAIo"]
[Sat Feb 28 12:37:52.598471 2026] [:error] [pid 52460:tid 52464] [client 20.104.16.102:23542] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opotv.php"] [unique_id "aaJxILLWOogAgHGh62QZNAAAAYE"]
[Sat Feb 28 12:37:54.445516 2026] [:error] [pid 52460:tid 52486] [client 20.104.16.102:18249] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opotv.php"] [unique_id "aaJxIrLWOogAgHGh62QZQAAAAZc"]
[Sat Feb 28 12:37:56.120037 2026] [:error] [pid 39184:tid 39232] [client 20.104.16.102:46056] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opotv.php"] [unique_id "aaJxJFtZF9Zd_U7easDUsgAAAE0"]
[Sat Feb 28 12:37:57.981921 2026] [:error] [pid 52460:tid 52468] [client 20.104.16.102:23529] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opotv.php"] [unique_id "aaJxJbLWOogAgHGh62QZUwAAAYU"]
[Sat Feb 28 12:37:59.636011 2026] [:error] [pid 39185:tid 39257] [client 20.104.16.102:19237] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu9.php"] [unique_id "aaJxJxVE-FfM89u7BQalIQAAAIs"]
[Sat Feb 28 12:38:01.164481 2026] [:error] [pid 39184:tid 39239] [client 20.104.16.102:16494] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pu9.php"] [unique_id "aaJxKVtZF9Zd_U7easDUtQAAAFQ"]
[Sat Feb 28 12:38:04.140329 2026] [:error] [pid 39292:tid 39305] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/pu9.php
[Sat Feb 28 12:38:04.363470 2026] [:error] [pid 39292:tid 39304] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/qoepq.php
[Sat Feb 28 12:38:04.586846 2026] [:error] [pid 39292:tid 39297] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/fodds.php
[Sat Feb 28 12:38:04.796786 2026] [:error] [pid 39292:tid 39315] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/gaigu.php
[Sat Feb 28 12:38:05.007131 2026] [:error] [pid 39292:tid 39302] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/ad2.php
[Sat Feb 28 12:38:05.220081 2026] [:error] [pid 39292:tid 39298] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8rd1.php
[Sat Feb 28 12:38:05.642760 2026] [:error] [pid 39292:tid 39313] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/asix.php
[Sat Feb 28 12:38:05.852023 2026] [:error] [pid 39292:tid 39300] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/gems.php
[Sat Feb 28 12:38:07.960930 2026] [:error] [pid 39292:tid 39296] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/xxd.php
[Sat Feb 28 12:38:08.172455 2026] [:error] [pid 39292:tid 39301] [client 20.104.16.102:23436] File does not exist: /usr/local/apache/htdocs/suspended-page/2sx.php
[Sat Feb 28 12:38:08.400030 2026] [:error] [pid 39292:tid 39305] [client 20.104.16.102:23436] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaq.php"] [unique_id "aaJxMKIAO5fN7BxyqcHIUAAAAMs"]
[Sat Feb 28 12:38:10.258203 2026] [:error] [pid 39185:tid 39253] [client 20.104.16.102:23489] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaq.php"] [unique_id "aaJxMhVE-FfM89u7BQalVgAAAIc"]
[Sat Feb 28 12:38:13.194487 2026] [:error] [pid 11791:tid 11817] [client 20.104.16.102:23482] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaq.php"] [unique_id "aaJxNWuX5e1Q32gqxH0LHwAAARg"]
[Sat Feb 28 12:38:16.195155 2026] [:error] [pid 39185:tid 39255] [client 20.104.16.102:12034] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaq.php"] [unique_id "aaJxOBVE-FfM89u7BQaljAAAAIk"]
[Sat Feb 28 12:38:18.841114 2026] [:error] [pid 39185:tid 39249] [client 20.104.16.102:23531] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaJxOhVE-FfM89u7BQalpgAAAIM"]
[Sat Feb 28 12:38:20.622078 2026] [:error] [pid 11791:tid 11808] [client 20.104.16.102:23449] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaJxPGuX5e1Q32gqxH0LKgAAAQ8"]
[Sat Feb 28 12:38:21.738291 2026] [:error] [pid 11791:tid 11794] [client 20.104.16.102:19209] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaJxPWuX5e1Q32gqxH0LLwAAAQE"]
[Sat Feb 28 12:38:25.074527 2026] [:error] [pid 52460:tid 52464] [client 20.104.16.102:19244] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaJxQbLWOogAgHGh62QZvwAAAYE"]
[Sat Feb 28 12:38:27.974199 2026] [:error] [pid 11791:tid 11812] [client 20.104.16.102:23527] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aaJxQ2uX5e1Q32gqxH0LQwAAARM"]
[Sat Feb 28 12:38:29.146588 2026] [:error] [pid 52460:tid 52478] [client 20.104.16.102:38650] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aaJxRbLWOogAgHGh62QZ2QAAAY8"]
[Sat Feb 28 12:38:30.785001 2026] [:error] [pid 11791:tid 11796] [client 20.104.16.102:19242] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aaJxRmuX5e1Q32gqxH0LTAAAAQM"]
[Sat Feb 28 12:38:33.427880 2026] [:error] [pid 11791:tid 11812] [client 20.104.16.102:16482] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "aaJxSWuX5e1Q32gqxH0LVwAAARM"]
[Sat Feb 28 12:38:35.975641 2026] [:error] [pid 39185:tid 39264] [client 20.104.16.102:16064] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aaJxSxVE-FfM89u7BQal0gAAAJI"]
[Sat Feb 28 12:38:37.842586 2026] [:error] [pid 39185:tid 39248] [client 20.104.16.102:26038] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aaJxTRVE-FfM89u7BQal2wAAAII"]
[Sat Feb 28 12:38:42.622717 2026] [:error] [pid 39292:tid 39316] [client 20.104.16.102:26684] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aaJxUqIAO5fN7BxyqcHItAAAANY"]
[Sat Feb 28 12:38:45.709077 2026] [:error] [pid 52460:tid 52463] [client 20.104.16.102:12148] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cwclass.php"] [unique_id "aaJxVbLWOogAgHGh62QaFAAAAYA"]
[Sat Feb 28 12:38:48.511608 2026] [:error] [pid 39185:tid 39265] [client 20.104.16.102:42295] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a6s2.php"] [unique_id "aaJxWBVE-FfM89u7BQal6wAAAJM"]
[Sat Feb 28 12:38:49.846539 2026] [:error] [pid 52460:tid 52477] [client 20.104.16.102:16000] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a6s2.php"] [unique_id "aaJxWbLWOogAgHGh62QaJAAAAY4"]
[Sat Feb 28 12:38:51.481405 2026] [:error] [pid 52460:tid 52474] [client 20.104.16.102:54289] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a6s2.php"] [unique_id "aaJxW7LWOogAgHGh62QaJwAAAYs"]
[Sat Feb 28 12:38:52.674943 2026] [:error] [pid 52460:tid 52464] [client 20.104.16.102:38594] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a6s2.php"] [unique_id "aaJxXLLWOogAgHGh62QaLAAAAYE"]
[Sat Feb 28 12:38:54.007802 2026] [:error] [pid 39185:tid 39253] [client 20.104.16.102:38611] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aki.php"] [unique_id "aaJxXhVE-FfM89u7BQal-gAAAIc"]
[Sat Feb 28 12:38:54.886947 2026] [:error] [pid 52460:tid 52463] [client 20.104.16.102:28188] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aki.php"] [unique_id "aaJxXrLWOogAgHGh62QaMwAAAYA"]
[Sat Feb 28 12:38:55.632522 2026] [:error] [pid 39185:tid 39263] [client 20.104.16.102:12818] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aki.php"] [unique_id "aaJxXxVE-FfM89u7BQamAgAAAJE"]
[Sat Feb 28 12:38:56.291711 2026] [:error] [pid 22194:tid 22207] [client 20.104.16.102:39681] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aki.php"] [unique_id "aaJxYH6mbajs3bzQGys44AAAAUs"]
[Sat Feb 28 12:38:56.983830 2026] [:error] [pid 39185:tid 39252] [client 20.104.16.102:28173] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaJxYBVE-FfM89u7BQamCAAAAIY"]
[Sat Feb 28 12:38:57.708975 2026] [:error] [pid 39292:tid 39310] [client 20.104.16.102:28206] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaJxYaIAO5fN7BxyqcHIzgAAANA"]
[Sat Feb 28 12:38:58.359694 2026] [:error] [pid 39292:tid 39297] [client 20.104.16.102:52797] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaJxYqIAO5fN7BxyqcHI0AAAAMM"]
[Sat Feb 28 12:38:59.043147 2026] [:error] [pid 39185:tid 39249] [client 20.104.16.102:17136] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaJxYxVE-FfM89u7BQamFgAAAIM"]
[Sat Feb 28 12:38:59.727690 2026] [:error] [pid 52460:tid 52465] [client 20.104.16.102:12840] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pepe.php"] [unique_id "aaJxY7LWOogAgHGh62QaQQAAAYI"]
[Sat Feb 28 12:39:00.511572 2026] [:error] [pid 39185:tid 39268] [client 20.104.16.102:28215] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pepe.php"] [unique_id "aaJxZBVE-FfM89u7BQamGQAAAJY"]
[Sat Feb 28 12:39:01.078659 2026] [:error] [pid 39185:tid 39248] [client 20.104.16.102:38617] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pepe.php"] [unique_id "aaJxZRVE-FfM89u7BQamGgAAAII"]
[Sat Feb 28 12:39:01.784702 2026] [:error] [pid 52460:tid 52487] [client 20.104.16.102:38625] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pepe.php"] [unique_id "aaJxZbLWOogAgHGh62QaUgAAAZg"]
[Sat Feb 28 12:39:02.494874 2026] [:error] [pid 52460:tid 52465] [client 20.104.16.102:17089] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aaJxZrLWOogAgHGh62QaVgAAAYI"]
[Sat Feb 28 12:39:03.159032 2026] [:error] [pid 52460:tid 52477] [client 20.104.16.102:17129] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aaJxZ7LWOogAgHGh62QaXgAAAY4"]
[Sat Feb 28 12:39:04.437994 2026] [:error] [pid 39183:tid 39208] [client 20.104.16.102:22281] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aaJxaBCf4HvhVePw3LblGgAAABA"]
[Sat Feb 28 12:39:05.007312 2026] [:error] [pid 22194:tid 22209] [client 20.104.16.102:22287] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "aaJxaX6mbajs3bzQGys45gAAAU0"]
[Sat Feb 28 12:39:05.708571 2026] [:error] [pid 22194:tid 22214] [client 20.104.16.102:28209] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaJxaX6mbajs3bzQGys46AAAAVI"]
[Sat Feb 28 12:39:06.520147 2026] [:error] [pid 52460:tid 52472] [client 20.104.16.102:34253] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaJxarLWOogAgHGh62QaZgAAAYk"]
[Sat Feb 28 12:39:07.174116 2026] [:error] [pid 39292:tid 39313] [client 20.104.16.102:52794] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaJxa6IAO5fN7BxyqcHI2wAAANM"]
[Sat Feb 28 12:39:08.183550 2026] [:error] [pid 11791:tid 11797] [client 20.104.16.102:54330] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Sat Feb 28 12:39:09.265103 2026] [:error] [pid 11791:tid 11801] [client 20.104.16.102:54330] File does not exist: /usr/local/apache/htdocs/suspended-page/daff42833e.php
[Sat Feb 28 12:39:10.386949 2026] [:error] [pid 11791:tid 11810] [client 20.104.16.102:54330] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/pu8.php"] [unique_id "aaJxbmuX5e1Q32gqxH0LuQAAARE"]
[Sat Feb 28 12:39:12.256860 2026] [:error] [pid 39185:tid 39269] [client 20.104.16.102:39699] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/pu9.php"] [unique_id "aaJxcBVE-FfM89u7BQamLQAAAJc"]
[Sat Feb 28 12:39:13.520123 2026] [:error] [pid 39292:tid 39312] [client 20.104.16.102:34294] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/povoy.php"] [unique_id "aaJxcaIAO5fN7BxyqcHI4gAAANI"]
[Sat Feb 28 12:39:15.009518 2026] [:error] [pid 52460:tid 52469] [client 20.104.16.102:12802] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/t00l.php"] [unique_id "aaJxc7LWOogAgHGh62QamQAAAYY"]
[Sat Feb 28 12:39:17.168943 2026] [:error] [pid 52460:tid 52480] [client 20.104.16.102:17092] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/rcc8.php"] [unique_id "aaJxdbLWOogAgHGh62QapwAAAZE"]
[Sat Feb 28 12:39:18.813707 2026] [:error] [pid 52460:tid 52467] [client 20.104.16.102:20298] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/rcc9.php"] [unique_id "aaJxdrLWOogAgHGh62QatAAAAYQ"]
[Sat Feb 28 12:39:19.405933 2026] [:error] [pid 39185:tid 39270] [client 20.104.16.102:35884] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xl9.php"] [unique_id "aaJxdxVE-FfM89u7BQamRQAAAJg"]
[Sat Feb 28 12:39:20.485605 2026] [:error] [pid 11791:tid 11799] [client 20.104.16.102:22330] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/gxoxx.php"] [unique_id "aaJxeGuX5e1Q32gqxH0LwgAAAQY"]
[Sat Feb 28 12:39:22.217791 2026] [:error] [pid 39292:tid 39294] [client 20.104.16.102:22283] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/g06akt.php"] [unique_id "aaJxeqIAO5fN7BxyqcHI6AAAAMA"]
[Sat Feb 28 12:39:23.596080 2026] [:error] [pid 52460:tid 52487] [client 20.104.16.102:12829] File does not exist: /usr/local/apache/htdocs/suspended-page/add.php
[Sat Feb 28 12:39:24.173823 2026] [:error] [pid 52460:tid 52466] [client 20.104.16.102:12829] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaJxfLLWOogAgHGh62QaxgAAAYM"]
[Sat Feb 28 12:39:25.096765 2026] [:error] [pid 39185:tid 39262] [client 20.104.16.102:33215] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaJxfRVE-FfM89u7BQamUwAAAJA"]
[Sat Feb 28 12:39:26.374433 2026] [:error] [pid 39185:tid 39258] [client 20.104.16.102:63176] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaJxfhVE-FfM89u7BQamWQAAAIw"]
[Sat Feb 28 12:39:27.295317 2026] [:error] [pid 52460:tid 52481] [client 20.104.16.102:12863] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaJxf7LWOogAgHGh62Qa1gAAAZI"]
[Sat Feb 28 12:39:27.826944 2026] [:error] [pid 39185:tid 39264] [client 20.104.16.102:34280] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/backup.php"] [unique_id "aaJxfxVE-FfM89u7BQamXAAAAJI"]
[Sat Feb 28 12:39:28.534294 2026] [:error] [pid 39184:tid 39227] [client 20.104.16.102:28218] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/backup.php"] [unique_id "aaJxgFtZF9Zd_U7easDU1gAAAEg"]
[Sat Feb 28 12:39:29.228787 2026] [:error] [pid 52460:tid 52475] [client 20.104.16.102:17108] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/backup.php"] [unique_id "aaJxgbLWOogAgHGh62Qa4wAAAYw"]
[Sat Feb 28 12:39:30.408885 2026] [:error] [pid 39292:tid 39296] [client 20.104.16.102:54331] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/backup.php"] [unique_id "aaJxgqIAO5fN7BxyqcHI7QAAAMI"]
[Sat Feb 28 12:39:32.262245 2026] [:error] [pid 52460:tid 52466] [client 20.104.16.102:63210] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaJxhLLWOogAgHGh62Qa9AAAAYM"]
[Sat Feb 28 12:39:33.802939 2026] [:error] [pid 39185:tid 39252] [client 20.104.16.102:34286] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaJxhRVE-FfM89u7BQamZQAAAIY"]
[Sat Feb 28 12:39:35.797974 2026] [:error] [pid 39185:tid 39258] [client 20.104.16.102:34297] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaJxhxVE-FfM89u7BQambQAAAIw"]
[Sat Feb 28 12:39:37.673692 2026] [:error] [pid 52460:tid 52472] [client 20.104.16.102:12839] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaJxibLWOogAgHGh62QbAAAAAYk"]
[Sat Feb 28 12:39:39.271298 2026] [:error] [pid 11791:tid 11807] [client 20.104.16.102:17103] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aaJxi2uX5e1Q32gqxH0L8AAAAQ4"]
[Sat Feb 28 12:39:41.005746 2026] [:error] [pid 52460:tid 52468] [client 20.104.16.102:28203] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aaJxjbLWOogAgHGh62QbCwAAAYU"]
[Sat Feb 28 12:39:42.018980 2026] [:error] [pid 39185:tid 39259] [client 20.104.16.102:34287] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aaJxjhVE-FfM89u7BQamdwAAAI0"]
[Sat Feb 28 12:39:44.067488 2026] [:error] [pid 11791:tid 11795] [client 20.104.16.102:34278] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aaJxkGuX5e1Q32gqxH0L-gAAAQI"]
[Sat Feb 28 12:39:46.913796 2026] [:error] [pid 39185:tid 39266] [client 20.104.16.102:35872] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaJxkhVE-FfM89u7BQamgAAAAJQ"]
[Sat Feb 28 12:39:48.836894 2026] [:error] [pid 52460:tid 52473] [client 20.104.16.102:54320] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaJxlLLWOogAgHGh62QbJwAAAYo"]
[Sat Feb 28 12:39:49.845132 2026] [:error] [pid 39184:tid 39227] [client 20.104.16.102:52786] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaJxlVtZF9Zd_U7easDU6gAAAEg"]
[Sat Feb 28 12:39:51.485472 2026] [:error] [pid 52460:tid 52476] [client 20.104.16.102:28185] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaJxl7LWOogAgHGh62QbNQAAAY0"]
[Sat Feb 28 12:39:52.931964 2026] [:error] [pid 11791:tid 11804] [client 20.104.16.102:52778] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aaJxmGuX5e1Q32gqxH0MCgAAAQs"]
[Sat Feb 28 12:39:54.048474 2026] [:error] [pid 39184:tid 39225] [client 20.104.16.102:12861] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aaJxmltZF9Zd_U7easDU8QAAAEY"]
[Sat Feb 28 12:39:55.156862 2026] [:error] [pid 52460:tid 52467] [client 20.104.16.102:22327] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aaJxm7LWOogAgHGh62QbRQAAAYQ"]
[Sat Feb 28 12:39:55.891754 2026] [:error] [pid 52460:tid 52474] [client 20.104.16.102:12814] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "aaJxm7LWOogAgHGh62QbSgAAAYs"]
[Sat Feb 28 12:39:56.867163 2026] [:error] [pid 39185:tid 39248] [client 20.104.16.102:20347] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJxnBVE-FfM89u7BQamjgAAAII"]
[Sat Feb 28 12:39:57.598621 2026] [:error] [pid 11791:tid 11797] [client 20.104.16.102:39767] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJxnWuX5e1Q32gqxH0MGQAAAQQ"]
[Sat Feb 28 12:39:58.176065 2026] [:error] [pid 39292:tid 39298] [client 20.104.16.102:39748] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJxnqIAO5fN7BxyqcHJOgAAAMQ"]
[Sat Feb 28 12:39:59.114956 2026] [:error] [pid 39292:tid 39315] [client 20.104.16.102:8588] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaJxn6IAO5fN7BxyqcHJPwAAANU"]
[Sat Feb 28 12:39:59.836977 2026] [:error] [pid 52460:tid 52468] [client 20.104.16.102:25350] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-atom.php"] [unique_id "aaJxn7LWOogAgHGh62QbXgAAAYU"]
[Sat Feb 28 12:40:01.086046 2026] [:error] [pid 39184:tid 39237] [client 20.104.16.102:39774] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-atom.php"] [unique_id "aaJxoVtZF9Zd_U7easDU8wAAAFI"]
[Sat Feb 28 12:40:01.665970 2026] [:error] [pid 39292:tid 39314] [client 20.104.16.102:13205] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-atom.php"] [unique_id "aaJxoaIAO5fN7BxyqcHJSAAAANQ"]
[Sat Feb 28 12:40:02.947768 2026] [:error] [pid 52460:tid 52478] [client 20.104.16.102:24920] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-atom.php"] [unique_id "aaJxorLWOogAgHGh62QbbAAAAY8"]
[Sat Feb 28 12:40:03.755116 2026] [:error] [pid 52460:tid 52482] [client 20.104.16.102:8577] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJxo7LWOogAgHGh62QbdQAAAZM"]
[Sat Feb 28 12:40:04.505752 2026] [:error] [pid 39292:tid 39298] [client 20.104.16.102:18462] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJxpKIAO5fN7BxyqcHJTQAAAMQ"]
[Sat Feb 28 12:40:06.428522 2026] [:error] [pid 11791:tid 11800] [client 20.104.16.102:34591] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJxpmuX5e1Q32gqxH0MKQAAAQc"]
[Sat Feb 28 12:40:07.270945 2026] [:error] [pid 39183:tid 39206] [client 20.104.16.102:40372] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJxpxCf4HvhVePw3LblLgAAAA4"]
[Sat Feb 28 12:40:08.511520 2026] [:error] [pid 39185:tid 39266] [client 20.104.16.102:24896] [client 20.104.16.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaJxqBVE-FfM89u7BQammQAAAJQ"]
[Sat Feb 28 12:40:10.174259 2026] [:error] [pid 39184:tid 39230] [client 20.104.16.102:9056] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aaJxqltZF9Zd_U7easDU_gAAAEs"]
[Sat Feb 28 12:40:11.668144 2026] [:error] [pid 39292:tid 39301] [client 20.104.16.102:40344] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aaJxq6IAO5fN7BxyqcHJXQAAAMc"]
[Sat Feb 28 12:40:12.691556 2026] [:error] [pid 39292:tid 39304] [client 20.104.16.102:17908] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aaJxrKIAO5fN7BxyqcHJYwAAAMo"]
[Sat Feb 28 12:40:14.516989 2026] [:error] [pid 52460:tid 52470] [client 20.104.16.102:24150] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws66.php"] [unique_id "aaJxrrLWOogAgHGh62QbkAAAAYc"]
[Sat Feb 28 12:40:15.716348 2026] [:error] [pid 39184:tid 39219] [client 20.104.16.102:14643] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaJxr1tZF9Zd_U7easDVAAAAAEA"]
[Sat Feb 28 12:40:17.726249 2026] [:error] [pid 39292:tid 39318] [client 20.104.16.102:8463] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaJxsaIAO5fN7BxyqcHJaQAAANg"]
[Sat Feb 28 12:40:18.994193 2026] [:error] [pid 22194:tid 22199] [client 20.104.16.102:42865] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaJxsn6mbajs3bzQGys5NgAAAUM"]
[Sat Feb 28 12:40:20.299203 2026] [:error] [pid 52460:tid 52487] [client 20.104.16.102:40327] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaJxtLLWOogAgHGh62QbqAAAAZg"]
[Sat Feb 28 12:40:21.632470 2026] [:error] [pid 39185:tid 39252] [client 20.104.16.102:24140] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaJxtRVE-FfM89u7BQamsAAAAIY"]
[Sat Feb 28 12:40:23.340931 2026] [:error] [pid 39185:tid 39253] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Feb 28 12:40:23.549447 2026] [:error] [pid 39185:tid 39246] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Sat Feb 28 12:40:23.757646 2026] [:error] [pid 39185:tid 39268] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Feb 28 12:40:23.968503 2026] [:error] [pid 39185:tid 39257] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sat Feb 28 12:40:24.176692 2026] [:error] [pid 39185:tid 39247] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/X57.php
[Sat Feb 28 12:40:24.404789 2026] [:error] [pid 39185:tid 39265] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 28 12:40:24.613978 2026] [:error] [pid 39185:tid 39254] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sat Feb 28 12:40:24.822265 2026] [:error] [pid 39185:tid 39266] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Feb 28 12:40:26.258104 2026] [:error] [pid 39185:tid 39254] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/my.php
[Sat Feb 28 12:40:26.467778 2026] [:error] [pid 39185:tid 39258] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 12:40:26.677788 2026] [:error] [pid 39185:tid 39246] [client 20.104.16.102:22815] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Sat Feb 28 12:40:26.898792 2026] [:error] [pid 39185:tid 39252] [client 20.104.16.102:22815] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4doption1.php"] [unique_id "aaJxuhVE-FfM89u7BQam5gAAAIY"]
[Sat Feb 28 12:40:30.377995 2026] [:error] [pid 39185:tid 39248] [client 20.104.16.102:34648] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4doption1.php"] [unique_id "aaJxvhVE-FfM89u7BQanDAAAAII"]
[Sat Feb 28 12:40:31.982301 2026] [:error] [pid 52460:tid 52473] [client 20.104.16.102:38002] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4doption1.php"] [unique_id "aaJxv7LWOogAgHGh62QcEgAAAYo"]
[Sat Feb 28 12:40:33.786140 2026] [:error] [pid 39185:tid 39257] [client 20.104.16.102:21140] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4doption1.php"] [unique_id "aaJxwRVE-FfM89u7BQanIgAAAIs"]
[Sat Feb 28 12:40:35.160823 2026] [:error] [pid 39185:tid 39270] [client 20.104.16.102:13867] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaJxwxVE-FfM89u7BQanMgAAAJg"]
[Sat Feb 28 12:40:36.420263 2026] [:error] [pid 11791:tid 11815] [client 20.104.16.102:17086] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaJxxGuX5e1Q32gqxH0M8QAAARY"]
[Sat Feb 28 12:40:37.391001 2026] [:error] [pid 11791:tid 11806] [client 20.104.16.102:37911] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaJxxWuX5e1Q32gqxH0M9wAAAQ0"]
[Sat Feb 28 12:40:38.512047 2026] [:error] [pid 39185:tid 39269] [client 20.104.16.102:14879] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaJxxhVE-FfM89u7BQanOwAAAJc"]
[Sat Feb 28 12:40:41.729331 2026] [:error] [pid 52460:tid 52482] [client 20.104.16.102:13288] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aaJxybLWOogAgHGh62QcZAAAAZM"]
[Sat Feb 28 12:40:44.805696 2026] [:error] [pid 39185:tid 39251] [client 20.104.16.102:34669] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aaJxzBVE-FfM89u7BQanTgAAAIU"]
[Sat Feb 28 12:40:47.372110 2026] [:error] [pid 52460:tid 52469] [client 20.104.16.102:37944] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aaJxz7LWOogAgHGh62QckQAAAYY"]
[Sat Feb 28 12:40:50.806780 2026] [:error] [pid 52460:tid 52484] [client 20.104.16.102:14876] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-setting.php"] [unique_id "aaJx0rLWOogAgHGh62QcrAAAAZU"]
[Sat Feb 28 12:40:53.438027 2026] [:error] [pid 11791:tid 11800] [client 20.104.16.102:17807] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaJx1WuX5e1Q32gqxH0NIAAAAQc"]
[Sat Feb 28 12:40:54.980242 2026] [:error] [pid 22194:tid 22206] [client 20.104.16.102:29527] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaJx1n6mbajs3bzQGys5fQAAAUo"]
[Sat Feb 28 12:40:57.568367 2026] [:error] [pid 39185:tid 39268] [client 20.104.16.102:19628] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaJx2RVE-FfM89u7BQanZgAAAJY"]
[Sat Feb 28 12:40:58.707772 2026] [:error] [pid 22194:tid 22208] [client 20.104.16.102:46573] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaJx2n6mbajs3bzQGys5kwAAAUw"]
[Sat Feb 28 12:40:59.739469 2026] [:error] [pid 22194:tid 22211] [client 20.104.16.102:9099] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaJx236mbajs3bzQGys5mQAAAU8"]
[Sat Feb 28 12:41:01.089883 2026] [:error] [pid 39185:tid 39253] [client 20.104.16.102:29509] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaJx3RVE-FfM89u7BQandgAAAIc"]
[Sat Feb 28 12:41:02.633296 2026] [:error] [pid 39292:tid 39301] [client 20.104.16.102:46562] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaJx3qIAO5fN7BxyqcHJjQAAAMc"]
[Sat Feb 28 12:41:04.149282 2026] [:error] [pid 11791:tid 11811] [client 20.104.16.102:32720] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaJx4GuX5e1Q32gqxH0NOQAAARI"]
[Sat Feb 28 13:40:08.608048 2026] [:error] [pid 39185:tid 39257] [client 13.71.191.191:22416] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaJ_uBVE-FfM89u7BQbjEAAAAIs"]
[Sat Feb 28 13:40:09.771332 2026] [:error] [pid 39185:tid 39256] [client 13.71.191.191:22520] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaJ_uRVE-FfM89u7BQbjHgAAAIo"]
[Sat Feb 28 13:40:10.419724 2026] [:error] [pid 39292:tid 39301] [client 13.71.191.191:22476] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaJ_uqIAO5fN7BxyqcHdNgAAAMc"]
[Sat Feb 28 13:40:11.830866 2026] [:error] [pid 52460:tid 52469] [client 13.71.191.191:22501] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaJ_u7LWOogAgHGh62RH1QAAAYY"]
[Sat Feb 28 13:47:01.184290 2026] [:error] [pid 52460:tid 52483] [client 40.80.89.74:4248] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 28 13:47:01.324692 2026] [:error] [pid 52460:tid 52479] [client 40.80.89.74:4248] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 13:47:01.603346 2026] [:error] [pid 52460:tid 52484] [client 40.80.89.74:4248] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Feb 28 13:47:01.752247 2026] [:error] [pid 52460:tid 52464] [client 40.80.89.74:4248] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 13:47:02.031702 2026] [:error] [pid 52460:tid 52487] [client 40.80.89.74:4248] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat Feb 28 13:47:02.171132 2026] [:error] [pid 52460:tid 52482] [client 40.80.89.74:4248] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 28 13:47:02.310851 2026] [:error] [pid 52460:tid 52475] [client 40.80.89.74:4248] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Feb 28 13:47:02.589125 2026] [:error] [pid 52460:tid 52467] [client 40.80.89.74:4248] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaKBVrLWOogAgHGh62RNMAAAAYQ"]
[Sat Feb 28 13:47:03.172289 2026] [:error] [pid 11791:tid 11801] [client 40.80.89.74:19560] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaKBV2uX5e1Q32gqxH0wAAAAAQg"]
[Sat Feb 28 13:47:03.722191 2026] [:error] [pid 11791:tid 11813] [client 40.80.89.74:4225] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaKBV2uX5e1Q32gqxH0wAgAAARQ"]
[Sat Feb 28 13:47:04.287547 2026] [:error] [pid 52460:tid 52469] [client 40.80.89.74:19531] [client 40.80.89.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaKBWLLWOogAgHGh62RNPwAAAYY"]
[Sat Feb 28 14:26:09.046025 2026] [:error] [pid 39185:tid 39256] [client 91.224.92.99:54768] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaKKgRVE-FfM89u7BQYUbQAAAIo"]
[Sat Feb 28 14:26:09.052436 2026] [:error] [pid 39185:tid 39256] [client 91.224.92.99:54768] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 14:26:12.170256 2026] [:error] [pid 39185:tid 39263] [client 91.224.92.99:54768] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaKKhBVE-FfM89u7BQYUjAAAAJE"]
[Sat Feb 28 14:26:12.860406 2026] [:error] [pid 52460:tid 52487] [client 91.224.92.99:50260] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaKKhLLWOogAgHGh62RqGAAAAZg"]
[Sat Feb 28 14:26:13.506890 2026] [:error] [pid 39292:tid 39299] [client 91.224.92.99:63252] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaKKhaIAO5fN7BxyqcHsrwAAAMU"]
[Sat Feb 28 14:26:14.149105 2026] [:error] [pid 39292:tid 39300] [client 91.224.92.99:58342] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaKKhqIAO5fN7BxyqcHsswAAAMY"]
[Sat Feb 28 14:42:02.078337 2026] [:error] [pid 39185:tid 39252] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Sat Feb 28 14:42:02.291674 2026] [:error] [pid 39185:tid 39269] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sat Feb 28 14:42:02.503157 2026] [:error] [pid 39185:tid 39254] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sat Feb 28 14:42:02.725663 2026] [:error] [pid 39185:tid 39258] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Feb 28 14:42:02.937209 2026] [:error] [pid 39185:tid 39250] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Sat Feb 28 14:42:03.150538 2026] [:error] [pid 39185:tid 39264] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 28 14:42:03.574892 2026] [:error] [pid 39185:tid 39259] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sat Feb 28 14:42:03.787058 2026] [:error] [pid 39185:tid 39265] [client 20.63.83.113:44550] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Feb 28 14:42:04.208156 2026] [:error] [pid 39185:tid 39260] [client 20.63.83.113:44550] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aaKOPBVE-FfM89u7BQYlFwAAAI4"]
[Sat Feb 28 14:42:04.636215 2026] [:error] [pid 11791:tid 11795] [client 20.63.83.113:35983] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aaKOPGuX5e1Q32gqxH1KywAAAQI"]
[Sat Feb 28 14:42:05.058359 2026] [:error] [pid 39185:tid 39258] [client 20.63.83.113:35970] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aaKOPRVE-FfM89u7BQYlGAAAAIw"]
[Sat Feb 28 14:42:05.498649 2026] [:error] [pid 11791:tid 11805] [client 20.63.83.113:58645] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "aaKOPWuX5e1Q32gqxH1KzQAAAQw"]
[Sat Feb 28 14:42:05.953762 2026] [:error] [pid 39185:tid 39264] [client 20.63.83.113:58530] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aaKOPRVE-FfM89u7BQYlGgAAAJI"]
[Sat Feb 28 14:42:06.384119 2026] [:error] [pid 22194:tid 22214] [client 20.63.83.113:44600] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aaKOPn6mbajs3bzQGytaNQAAAVI"]
[Sat Feb 28 14:42:06.857519 2026] [:error] [pid 39185:tid 39259] [client 20.63.83.113:5936] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aaKOPhVE-FfM89u7BQYlHwAAAI0"]
[Sat Feb 28 14:42:07.272207 2026] [:error] [pid 39185:tid 39265] [client 20.63.83.113:60607] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ynz.PhP7"] [unique_id "aaKOPxVE-FfM89u7BQYlIgAAAJM"]
[Sat Feb 28 14:42:07.685321 2026] [:error] [pid 39185:tid 39252] [client 20.63.83.113:64528] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aaKOPxVE-FfM89u7BQYlJgAAAIY"]
[Sat Feb 28 14:42:08.113083 2026] [:error] [pid 39185:tid 39260] [client 20.63.83.113:60559] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aaKOQBVE-FfM89u7BQYlKAAAAI4"]
[Sat Feb 28 14:42:08.569754 2026] [:error] [pid 39183:tid 39207] [client 20.63.83.113:5892] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aaKOQBCf4HvhVePw3Lb44wAAAA8"]
[Sat Feb 28 14:42:08.987563 2026] [:error] [pid 11791:tid 11798] [client 20.63.83.113:36025] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "aaKOQGuX5e1Q32gqxH1K0QAAAQU"]
[Sat Feb 28 14:42:09.402717 2026] [:error] [pid 11791:tid 11811] [client 20.63.83.113:42042] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packed.php"] [unique_id "aaKOQWuX5e1Q32gqxH1K0wAAARI"]
[Sat Feb 28 14:42:09.816877 2026] [:error] [pid 22194:tid 22201] [client 20.63.83.113:35984] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packed.php"] [unique_id "aaKOQX6mbajs3bzQGytaOAAAAUU"]
[Sat Feb 28 14:42:10.237862 2026] [:error] [pid 52460:tid 52472] [client 20.63.83.113:42024] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packed.php"] [unique_id "aaKOQrLWOogAgHGh62RziwAAAYk"]
[Sat Feb 28 14:42:10.653307 2026] [:error] [pid 11791:tid 11808] [client 20.63.83.113:60570] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packed.php"] [unique_id "aaKOQmuX5e1Q32gqxH1K1gAAAQ8"]
[Sat Feb 28 14:42:11.073244 2026] [:error] [pid 39185:tid 39266] [client 20.63.83.113:60601] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aaKOQxVE-FfM89u7BQYlKwAAAJQ"]
[Sat Feb 28 14:42:11.495067 2026] [:error] [pid 52460:tid 52486] [client 20.63.83.113:64211] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aaKOQ7LWOogAgHGh62RzjgAAAZc"]
[Sat Feb 28 14:42:11.925797 2026] [:error] [pid 52460:tid 52481] [client 20.63.83.113:35980] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aaKOQ7LWOogAgHGh62RzkAAAAZI"]
[Sat Feb 28 14:42:12.351302 2026] [:error] [pid 39183:tid 39201] [client 20.63.83.113:52461] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "aaKORBCf4HvhVePw3Lb48AAAAAk"]
[Sat Feb 28 14:42:12.773551 2026] [:error] [pid 39292:tid 39309] [client 20.63.83.113:64199] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaKORKIAO5fN7BxyqcHxlwAAAM8"]
[Sat Feb 28 14:42:13.200417 2026] [:error] [pid 52460:tid 52478] [client 20.63.83.113:52451] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaKORbLWOogAgHGh62RzkgAAAY8"]
[Sat Feb 28 14:42:13.612019 2026] [:error] [pid 39185:tid 39255] [client 20.63.83.113:64247] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaKORRVE-FfM89u7BQYlNQAAAIk"]
[Sat Feb 28 14:42:14.051123 2026] [:error] [pid 39185:tid 39262] [client 20.63.83.113:62727] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "aaKORhVE-FfM89u7BQYlPAAAAJA"]
[Sat Feb 28 14:42:14.474606 2026] [:error] [pid 22194:tid 22216] [client 20.63.83.113:60565] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aaKORn6mbajs3bzQGytaQgAAAVQ"]
[Sat Feb 28 14:42:14.884802 2026] [:error] [pid 39292:tid 39294] [client 20.63.83.113:36304] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aaKORqIAO5fN7BxyqcHxmQAAAMA"]
[Sat Feb 28 14:42:15.299971 2026] [:error] [pid 39184:tid 39231] [client 20.63.83.113:62769] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aaKOR1tZF9Zd_U7easDvBgAAAEw"]
[Sat Feb 28 14:42:15.711147 2026] [:error] [pid 22194:tid 22200] [client 20.63.83.113:64234] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/link.php"] [unique_id "aaKOR36mbajs3bzQGytaRQAAAUQ"]
[Sat Feb 28 14:42:16.119976 2026] [:error] [pid 11791:tid 11814] [client 20.63.83.113:58391] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass.php"] [unique_id "aaKOSGuX5e1Q32gqxH1K4AAAARU"]
[Sat Feb 28 14:42:16.535028 2026] [:error] [pid 39292:tid 39308] [client 20.63.83.113:62734] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass.php"] [unique_id "aaKOSKIAO5fN7BxyqcHxngAAAM4"]
[Sat Feb 28 14:42:16.955182 2026] [:error] [pid 39185:tid 39264] [client 20.63.83.113:23106] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass.php"] [unique_id "aaKOSBVE-FfM89u7BQYlQgAAAJI"]
[Sat Feb 28 14:42:17.376817 2026] [:error] [pid 39185:tid 39250] [client 20.63.83.113:65469] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass.php"] [unique_id "aaKOSRVE-FfM89u7BQYlRAAAAIQ"]
[Sat Feb 28 14:42:17.795210 2026] [:error] [pid 39185:tid 39259] [client 20.63.83.113:51506] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaKOSRVE-FfM89u7BQYlRwAAAI0"]
[Sat Feb 28 14:42:18.210232 2026] [:error] [pid 22194:tid 22214] [client 20.63.83.113:58386] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaKOSn6mbajs3bzQGytaSQAAAVI"]
[Sat Feb 28 14:42:18.626181 2026] [:error] [pid 11791:tid 11798] [client 20.63.83.113:64243] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaKOSmuX5e1Q32gqxH1K5gAAAQU"]
[Sat Feb 28 14:42:19.038798 2026] [:error] [pid 11791:tid 11808] [client 20.63.83.113:11414] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaKOS2uX5e1Q32gqxH1K6gAAAQ8"]
[Sat Feb 28 15:29:56.504028 2026] [:error] [pid 39292:tid 39300] [client 104.194.155.80:59592] [client 104.194.155.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aaKZdKIAO5fN7BxyqcECVQAAAMY"]
[Sat Feb 28 16:40:54.053417 2026] [:error] [pid 52460:tid 52474] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sat Feb 28 16:40:54.272123 2026] [:error] [pid 52460:tid 52481] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/tews.php
[Sat Feb 28 16:40:54.486922 2026] [:error] [pid 52460:tid 52477] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/wpp.php
[Sat Feb 28 16:40:54.706032 2026] [:error] [pid 52460:tid 52487] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/wc49.php
[Sat Feb 28 16:40:54.918427 2026] [:error] [pid 52460:tid 52463] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/TL.php
[Sat Feb 28 16:40:55.130712 2026] [:error] [pid 52460:tid 52482] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Sat Feb 28 16:40:55.346259 2026] [:error] [pid 52460:tid 52483] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/fck.php
[Sat Feb 28 16:40:55.561945 2026] [:error] [pid 52460:tid 52484] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Sat Feb 28 16:40:55.776450 2026] [:error] [pid 52460:tid 52485] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Sat Feb 28 16:40:55.993877 2026] [:error] [pid 52460:tid 52468] [client 20.104.16.102:57113] File does not exist: /usr/local/apache/htdocs/suspended-page/nw2.php
[Sat Feb 28 16:40:56.203235 2026] [:error] [pid 52460:tid 52478] [client 20.104.16.102:57113] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaKqGLLWOogAgHGh62SrDgAAAY8"]
[Sat Feb 28 16:40:56.644847 2026] [:error] [pid 11791:tid 11795] [client 20.104.16.102:47227] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaKqGGuX5e1Q32gqxH12nAAAAQI"]
[Sat Feb 28 16:40:57.083945 2026] [:error] [pid 39184:tid 39223] [client 20.104.16.102:47191] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaKqGVtZF9Zd_U7easAmhgAAAEQ"]
[Sat Feb 28 16:40:57.496896 2026] [:error] [pid 39184:tid 39219] [client 20.104.16.102:23632] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blackmini.php"] [unique_id "aaKqGVtZF9Zd_U7easAmiAAAAEA"]
[Sat Feb 28 16:40:57.980678 2026] [:error] [pid 39184:tid 39241] [client 20.104.16.102:62834] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaKqGVtZF9Zd_U7easAmjQAAAFY"]
[Sat Feb 28 16:40:58.403274 2026] [:error] [pid 39184:tid 39235] [client 20.104.16.102:23641] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaKqGltZF9Zd_U7easAmkAAAAFA"]
[Sat Feb 28 16:40:58.845844 2026] [:error] [pid 49763:tid 49768] [client 20.104.16.102:51306] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaKqGrTHSOG_yf2PpqHxHwAAAcI"]
[Sat Feb 28 16:40:59.271617 2026] [:error] [pid 49763:tid 49773] [client 20.104.16.102:47213] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaKqG7THSOG_yf2PpqHxIwAAAcc"]
[Sat Feb 28 16:40:59.701908 2026] [:error] [pid 39184:tid 39231] [client 20.104.16.102:41549] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaKqG1tZF9Zd_U7easAmkwAAAEw"]
[Sat Feb 28 16:41:00.129343 2026] [:error] [pid 39184:tid 39228] [client 20.104.16.102:57117] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaKqHFtZF9Zd_U7easAmmAAAAEk"]
[Sat Feb 28 16:41:00.554126 2026] [:error] [pid 39184:tid 39219] [client 20.104.16.102:23616] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaKqHFtZF9Zd_U7easAmnAAAAEA"]
[Sat Feb 28 16:41:00.989801 2026] [:error] [pid 39184:tid 39241] [client 20.104.16.102:51311] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F19.php"] [unique_id "aaKqHFtZF9Zd_U7easAmogAAAFY"]
[Sat Feb 28 16:41:01.403732 2026] [:error] [pid 39184:tid 39231] [client 20.104.16.102:48595] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaKqHVtZF9Zd_U7easAmpgAAAEw"]
[Sat Feb 28 16:41:01.816958 2026] [:error] [pid 49763:tid 49777] [client 20.104.16.102:62827] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaKqHbTHSOG_yf2PpqHxKwAAAcs"]
[Sat Feb 28 16:41:02.238074 2026] [:error] [pid 39292:tid 39303] [client 20.104.16.102:48636] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaKqHqIAO5fN7BxyqcEZVAAAAMk"]
[Sat Feb 28 16:41:02.657147 2026] [:error] [pid 39184:tid 39229] [client 20.104.16.102:62838] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1.php"] [unique_id "aaKqHltZF9Zd_U7easAmtAAAAEo"]
[Sat Feb 28 16:41:03.081426 2026] [:error] [pid 39183:tid 39196] [client 20.104.16.102:48639] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaKqHxCf4HvhVePw3LYiSAAAAAQ"]
[Sat Feb 28 16:41:03.498560 2026] [:error] [pid 39183:tid 39216] [client 20.104.16.102:43986] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaKqHxCf4HvhVePw3LYiTwAAABg"]
[Sat Feb 28 16:41:03.940989 2026] [:error] [pid 39183:tid 39206] [client 20.104.16.102:41593] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaKqHxCf4HvhVePw3LYiVQAAAA4"]
[Sat Feb 28 16:41:04.362163 2026] [:error] [pid 49763:tid 49775] [client 20.104.16.102:51299] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaKqILTHSOG_yf2PpqHxLgAAAck"]
[Sat Feb 28 16:41:04.779869 2026] [:error] [pid 49763:tid 49768] [client 20.104.16.102:57098] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaKqILTHSOG_yf2PpqHxMgAAAcI"]
[Sat Feb 28 16:41:05.197614 2026] [:error] [pid 49763:tid 49773] [client 20.104.16.102:57095] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaKqIbTHSOG_yf2PpqHxNQAAAcc"]
[Sat Feb 28 16:41:05.610354 2026] [:error] [pid 49763:tid 49783] [client 20.104.16.102:57108] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaKqIbTHSOG_yf2PpqHxOAAAAdE"]
[Sat Feb 28 16:41:06.018713 2026] [:error] [pid 49763:tid 49776] [client 20.104.16.102:62796] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/R57.php"] [unique_id "aaKqIrTHSOG_yf2PpqHxOgAAAco"]
[Sat Feb 28 16:41:06.429381 2026] [:error] [pid 39292:tid 39299] [client 20.104.16.102:54528] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaKqIqIAO5fN7BxyqcEZVgAAAMU"]
[Sat Feb 28 16:41:06.846663 2026] [:error] [pid 22194:tid 22201] [client 20.104.16.102:48620] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaKqIn6mbajs3bzQGytypgAAAUU"]
[Sat Feb 28 16:41:07.266969 2026] [:error] [pid 11791:tid 11795] [client 20.104.16.102:44004] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaKqI2uX5e1Q32gqxH12sQAAAQI"]
[Sat Feb 28 16:41:07.686533 2026] [:error] [pid 22194:tid 22212] [client 20.104.16.102:48637] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4h.php"] [unique_id "aaKqI36mbajs3bzQGytyqQAAAVA"]
[Sat Feb 28 16:41:08.103590 2026] [:error] [pid 39185:tid 39256] [client 20.104.16.102:47225] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaKqJBVE-FfM89u7BQZm-gAAAIo"]
[Sat Feb 28 16:41:08.517108 2026] [:error] [pid 39184:tid 39242] [client 20.104.16.102:43983] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaKqJFtZF9Zd_U7easAmvQAAAFc"]
[Sat Feb 28 16:41:08.936271 2026] [:error] [pid 11791:tid 11804] [client 20.104.16.102:51277] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaKqJGuX5e1Q32gqxH12twAAAQs"]
[Sat Feb 28 16:41:09.354284 2026] [:error] [pid 11791:tid 11803] [client 20.104.16.102:62790] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "aaKqJWuX5e1Q32gqxH12uQAAAQo"]
[Sat Feb 28 16:41:09.812457 2026] [:error] [pid 49763:tid 49770] [client 20.104.16.102:62814] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaKqJbTHSOG_yf2PpqHxPQAAAcQ"]
[Sat Feb 28 16:41:10.240052 2026] [:error] [pid 39183:tid 39216] [client 20.104.16.102:23621] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaKqJhCf4HvhVePw3LYiZwAAABg"]
[Sat Feb 28 16:41:10.700199 2026] [:error] [pid 39183:tid 39197] [client 20.104.16.102:62811] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaKqJhCf4HvhVePw3LYiawAAAAU"]
[Sat Feb 28 16:41:11.120063 2026] [:error] [pid 11791:tid 11793] [client 20.104.16.102:57088] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaKqJ2uX5e1Q32gqxH12ugAAAQA"]
[Sat Feb 28 16:41:11.545901 2026] [:error] [pid 39185:tid 39262] [client 20.104.16.102:48605] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaKqJxVE-FfM89u7BQZnAgAAAJA"]
[Sat Feb 28 16:41:11.978807 2026] [:error] [pid 39185:tid 39267] [client 20.104.16.102:51272] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaKqJxVE-FfM89u7BQZnAwAAAJU"]
[Sat Feb 28 16:41:12.418473 2026] [:error] [pid 39185:tid 39269] [client 20.104.16.102:41548] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaKqKBVE-FfM89u7BQZnBwAAAJc"]
[Sat Feb 28 16:41:12.831965 2026] [:error] [pid 39292:tid 39316] [client 20.104.16.102:47231] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaKqKKIAO5fN7BxyqcEZXAAAANY"]
[Sat Feb 28 16:41:13.242851 2026] [:error] [pid 39185:tid 39265] [client 20.104.16.102:51276] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaKqKRVE-FfM89u7BQZnCQAAAJM"]
[Sat Feb 28 16:41:13.653445 2026] [:error] [pid 39184:tid 39225] [client 20.104.16.102:47206] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaKqKVtZF9Zd_U7easAmxwAAAEY"]
[Sat Feb 28 16:41:14.092011 2026] [:error] [pid 39184:tid 39230] [client 20.104.16.102:20880] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaKqKltZF9Zd_U7easAmyQAAAEs"]
[Sat Feb 28 16:41:14.546035 2026] [:error] [pid 39292:tid 39301] [client 20.104.16.102:47180] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaKqKqIAO5fN7BxyqcEZXwAAAMc"]
[Sat Feb 28 16:41:15.024636 2026] [:error] [pid 39184:tid 39223] [client 20.104.16.102:47221] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaKqK1tZF9Zd_U7easAmzQAAAEQ"]
[Sat Feb 28 16:41:15.457769 2026] [:error] [pid 11791:tid 11807] [client 20.104.16.102:48617] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaKqK2uX5e1Q32gqxH12xgAAAQ4"]
[Sat Feb 28 16:41:15.879783 2026] [:error] [pid 49763:tid 49777] [client 20.104.16.102:20917] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaKqK7THSOG_yf2PpqHxQAAAAcs"]
[Sat Feb 28 16:41:16.305737 2026] [:error] [pid 49763:tid 49788] [client 20.104.16.102:62843] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/samfa.php"] [unique_id "aaKqLLTHSOG_yf2PpqHxQQAAAdY"]
[Sat Feb 28 16:41:16.716026 2026] [:error] [pid 39184:tid 39235] [client 20.104.16.102:51314] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaKqLFtZF9Zd_U7easAm2wAAAFA"]
[Sat Feb 28 16:41:17.143048 2026] [:error] [pid 39184:tid 39224] [client 20.104.16.102:47219] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaKqLVtZF9Zd_U7easAm3wAAAEU"]
[Sat Feb 28 16:41:17.556008 2026] [:error] [pid 11791:tid 11805] [client 20.104.16.102:57143] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaKqLWuX5e1Q32gqxH12ygAAAQw"]
[Sat Feb 28 16:41:18.004378 2026] [:error] [pid 39184:tid 39219] [client 20.104.16.102:57114] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/boots.php"] [unique_id "aaKqLltZF9Zd_U7easAm4wAAAEA"]
[Sat Feb 28 16:41:18.436945 2026] [:error] [pid 39184:tid 39235] [client 20.104.16.102:54531] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaKqLltZF9Zd_U7easAm6AAAAFA"]
[Sat Feb 28 16:41:18.900359 2026] [:error] [pid 22194:tid 22202] [client 20.104.16.102:62819] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaKqLn6mbajs3bzQGytyrwAAAUY"]
[Sat Feb 28 16:41:19.322559 2026] [:error] [pid 11791:tid 11806] [client 20.104.16.102:41567] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaKqL2uX5e1Q32gqxH12zQAAAQ0"]
[Sat Feb 28 16:41:19.733674 2026] [:error] [pid 11791:tid 11793] [client 20.104.16.102:44011] [client 20.104.16.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/logi.php"] [unique_id "aaKqL2uX5e1Q32gqxH12zwAAAQA"]
[Sat Feb 28 16:58:03.864048 2026] [:error] [pid 39292:tid 39307] [client 40.85.218.222:30276] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaKuG6IAO5fN7BxyqcEe6AAAAM0"]
[Sat Feb 28 16:58:04.705790 2026] [:error] [pid 22194:tid 22205] [client 40.85.218.222:30313] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaKuHH6mbajs3bzQGyt2ZwAAAUk"]
[Sat Feb 28 16:58:05.576352 2026] [:error] [pid 49763:tid 49775] [client 40.85.218.222:30307] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaKuHbTHSOG_yf2PpqH-3AAAAck"]
[Sat Feb 28 16:58:06.428281 2026] [:error] [pid 49763:tid 49770] [client 40.85.218.222:30297] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaKuHrTHSOG_yf2PpqH-5gAAAcQ"]
[Sat Feb 28 17:25:13.359903 2026] [:error] [pid 11791:tid 11812] [client 45.153.34.31:57570] [client 45.153.34.31] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aaK0eWuX5e1Q32gqxH2CYwAAARM"]
[Sat Feb 28 19:03:17.246599 2026] [:error] [pid 49763:tid 49769] [client 145.239.10.137:39567] File does not exist: /usr/local/apache/htdocs/suspended-page/tcb.php, referer: http://aoswa.com.au/tcb.php
[Sat Feb 28 19:18:17.239214 2026] [:error] [pid 49763:tid 49784] [client 185.103.89.118:52043] [client 185.103.89.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.103.89.118, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaLO-bTHSOG_yf2PpqGtNQAAAdI"]
[Sat Feb 28 19:18:17.245410 2026] [:error] [pid 49763:tid 49784] [client 185.103.89.118:52043] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 19:23:17.401151 2026] [:error] [pid 52460:tid 52477] [client 82.129.23.162:20295] [client 82.129.23.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.129.23.162, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaLQJbLWOogAgHGh62Qr7AAAAY4"]
[Sat Feb 28 19:23:17.406677 2026] [:error] [pid 52460:tid 52477] [client 82.129.23.162:20295] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 19:36:57.968066 2026] [:error] [pid 39184:tid 39223] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Feb 28 19:36:58.253342 2026] [:error] [pid 39184:tid 39237] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 28 19:36:58.534973 2026] [:error] [pid 39184:tid 39221] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Feb 28 19:36:58.793339 2026] [:error] [pid 39184:tid 39230] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Feb 28 19:36:59.084703 2026] [:error] [pid 39184:tid 39238] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 28 19:36:59.478030 2026] [:error] [pid 39184:tid 39226] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Feb 28 19:36:59.728404 2026] [:error] [pid 39184:tid 39227] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 28 19:36:59.990167 2026] [:error] [pid 39184:tid 39231] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 19:37:00.546773 2026] [:error] [pid 39184:tid 39243] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Feb 28 19:37:01.309089 2026] [:error] [pid 39184:tid 39234] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Feb 28 19:37:01.588963 2026] [:error] [pid 39184:tid 39223] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Feb 28 19:37:01.885331 2026] [:error] [pid 39184:tid 39225] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 28 19:37:02.183283 2026] [:error] [pid 39184:tid 39238] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Feb 28 19:37:02.422689 2026] [:error] [pid 39184:tid 39240] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Feb 28 19:37:02.709620 2026] [:error] [pid 39184:tid 39233] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Feb 28 19:37:02.966951 2026] [:error] [pid 39184:tid 39222] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Feb 28 19:37:03.226235 2026] [:error] [pid 39184:tid 39228] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Feb 28 19:37:03.509110 2026] [:error] [pid 39184:tid 39234] [client 185.198.240.178:61949] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 28 19:37:07.471589 2026] [:error] [pid 39184:tid 39236] [client 185.198.240.178:61949] [client 185.198.240.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaLTY1tZF9Zd_U7easCLhgAAAFE"]
[Sat Feb 28 19:37:08.772409 2026] [:error] [pid 11791:tid 11794] [client 185.198.240.175:25611] [client 185.198.240.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaLTZGuX5e1Q32gqxH2qLwAAAQE"]
[Sat Feb 28 19:37:10.210900 2026] [:error] [pid 49763:tid 49788] [client 209.87.169.172:59891] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Feb 28 19:37:12.143375 2026] [:error] [pid 49763:tid 49785] [client 209.87.169.172:59891] [client 209.87.169.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaLTaLTHSOG_yf2PpqHSPAAAAdM"]
[Sat Feb 28 19:37:13.241965 2026] [:error] [pid 39184:tid 39233] [client 185.198.240.177:49153] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 28 19:37:13.581965 2026] [:error] [pid 39184:tid 39222] [client 185.198.240.177:49153] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaLTaVtZF9Zd_U7easCLkQAAAEM"]
[Sat Feb 28 19:37:14.386623 2026] [:error] [pid 52460:tid 52464] [client 209.87.169.165:59523] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Feb 28 19:37:15.703228 2026] [:error] [pid 52460:tid 52471] [client 209.87.169.165:59523] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaLTa7LWOogAgHGh62Q3nQAAAYg"]
[Sat Feb 28 19:37:16.514305 2026] [:error] [pid 39183:tid 39211] [client 185.198.240.159:54991] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaLTbBCf4HvhVePw3LbWPwAAABM"]
[Sat Feb 28 19:37:17.014749 2026] [:error] [pid 49763:tid 49780] [client 185.198.240.177:62957] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaLTbbTHSOG_yf2PpqHSWwAAAc4"]
[Sat Feb 28 19:37:17.556588 2026] [:error] [pid 49763:tid 49775] [client 185.198.240.159:50237] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaLTbbTHSOG_yf2PpqHSYgAAAck"]
[Sat Feb 28 19:37:18.091052 2026] [:error] [pid 49763:tid 49780] [client 209.87.169.161:40003] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaLTbrTHSOG_yf2PpqHSZwAAAc4"]
[Sat Feb 28 19:37:18.656716 2026] [:error] [pid 39292:tid 39317] [client 185.198.240.180:36605] [client 185.198.240.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaLTbqIAO5fN7BxyqcFaRAAAANc"]
[Sat Feb 28 19:37:19.761290 2026] [:error] [pid 49763:tid 49767] [client 209.87.169.173:31115] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaLTb7THSOG_yf2PpqHSbwAAAcE"]
[Sat Feb 28 19:37:20.279476 2026] [:error] [pid 39185:tid 39254] [client 173.239.214.179:64687] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Feb 28 19:37:20.808154 2026] [:error] [pid 39185:tid 39260] [client 173.239.214.179:64687] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aaLTcBVE-FfM89u7BQaLdAAAAI4"]
[Sat Feb 28 19:37:21.905732 2026] [:error] [pid 52460:tid 52480] [client 185.198.240.98:41591] [client 185.198.240.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaLTcbLWOogAgHGh62Q3tAAAAZE"]
[Sat Feb 28 19:37:22.657762 2026] [:error] [pid 39183:tid 39192] [client 209.87.169.172:38641] [client 209.87.169.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaLTchCf4HvhVePw3LbWYAAAAAA"]
[Sat Feb 28 19:37:23.155572 2026] [:error] [pid 49763:tid 49779] [client 185.198.240.168:50449] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Feb 28 19:37:23.408804 2026] [:error] [pid 49763:tid 49782] [client 185.198.240.168:50449] [client 185.198.240.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaLTc7THSOG_yf2PpqHSeQAAAdA"]
[Sat Feb 28 19:37:23.898053 2026] [:error] [pid 49763:tid 49786] [client 185.198.240.165:26173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Feb 28 19:37:24.716887 2026] [:error] [pid 49763:tid 49768] [client 185.198.240.165:26173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Feb 28 19:37:25.497474 2026] [:error] [pid 49763:tid 49779] [client 185.198.240.165:26173] [client 185.198.240.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaLTdbTHSOG_yf2PpqHShgAAAc0"]
[Sat Feb 28 19:37:26.043541 2026] [:error] [pid 52460:tid 52479] [client 185.198.240.176:28399] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sat Feb 28 19:37:26.307518 2026] [:error] [pid 52460:tid 52466] [client 185.198.240.176:28399] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaLTdrLWOogAgHGh62Q3xwAAAYM"]
[Sat Feb 28 19:37:26.842598 2026] [:error] [pid 52460:tid 52477] [client 209.87.169.170:20499] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Feb 28 19:37:28.618942 2026] [:error] [pid 52460:tid 52471] [client 209.87.169.170:20499] [client 209.87.169.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaLTeLLWOogAgHGh62Q31AAAAYg"]
[Sat Feb 28 19:37:29.429871 2026] [:error] [pid 39183:tid 39192] [client 209.87.169.162:36465] [client 209.87.169.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaLTeRCf4HvhVePw3LbWbgAAAAA"]
[Sat Feb 28 19:37:30.255638 2026] [:error] [pid 49763:tid 49782] [client 185.198.240.169:53961] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sat Feb 28 19:37:30.530575 2026] [:error] [pid 49763:tid 49776] [client 185.198.240.169:53961] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Feb 28 19:37:31.119267 2026] [:error] [pid 49763:tid 49768] [client 185.198.240.169:53961] [client 185.198.240.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaLTe7THSOG_yf2PpqHSuAAAAcI"]
[Sat Feb 28 19:37:31.918083 2026] [:error] [pid 49763:tid 49781] [client 209.87.169.172:56971] [client 209.87.169.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaLTe7THSOG_yf2PpqHSwgAAAc8"]
[Sat Feb 28 19:37:32.731113 2026] [:error] [pid 49763:tid 49769] [client 185.198.240.163:26449] [client 185.198.240.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaLTfLTHSOG_yf2PpqHSzAAAAcM"]
[Sat Feb 28 19:37:33.276345 2026] [:error] [pid 11791:tid 11810] [client 185.198.240.163:49453] [client 185.198.240.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaLTfWuX5e1Q32gqxH2qQgAAARE"]
[Sat Feb 28 19:37:33.821232 2026] [:error] [pid 39184:tid 39235] [client 173.239.214.181:42779] [client 173.239.214.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaLTfVtZF9Zd_U7easCLrQAAAFA"]
[Sat Feb 28 19:37:34.994988 2026] [:error] [pid 22194:tid 22199] [client 45.131.195.215:44415] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sat Feb 28 19:37:35.245805 2026] [:error] [pid 22194:tid 22206] [client 45.131.195.215:44415] [client 45.131.195.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaLTf36mbajs3bzQGyuQpQAAAUo"]
[Sat Feb 28 19:37:36.949227 2026] [:error] [pid 11791:tid 11809] [client 209.87.169.163:61279] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaLTgGuX5e1Q32gqxH2qRAAAARA"]
[Sat Feb 28 19:37:37.436651 2026] [:error] [pid 11791:tid 11807] [client 185.198.240.159:62071] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaLTgWuX5e1Q32gqxH2qRQAAAQ4"]
[Sat Feb 28 19:37:38.558020 2026] [:error] [pid 39184:tid 39229] [client 185.198.240.169:34037] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sat Feb 28 19:37:39.109945 2026] [:error] [pid 39184:tid 39237] [client 185.198.240.169:34037] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Feb 28 19:37:40.154376 2026] [:error] [pid 39184:tid 39234] [client 185.198.240.169:34037] [client 185.198.240.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaLThFtZF9Zd_U7easCLuwAAAE8"]
[Sat Feb 28 19:37:42.181983 2026] [:error] [pid 39183:tid 39203] [client 185.198.240.180:48361] [client 185.198.240.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.180, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaLThhCf4HvhVePw3LbWlAAAAAs"]
[Sat Feb 28 19:37:42.596249 2026] [:error] [pid 39183:tid 39216] [client 185.198.240.180:48361] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Feb 28 19:37:44.727048 2026] [:error] [pid 39183:tid 39204] [client 185.198.240.180:48361] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sat Feb 28 19:37:45.147657 2026] [:error] [pid 39183:tid 39200] [client 185.198.240.180:48361] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Feb 28 19:37:47.786767 2026] [:error] [pid 39183:tid 39211] [client 185.198.240.180:48361] [client 185.198.240.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaLTixCf4HvhVePw3LbWuwAAABM"]
[Sat Feb 28 19:37:50.202163 2026] [:error] [pid 49763:tid 49787] [client 173.239.214.180:64491] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sat Feb 28 19:37:50.413123 2026] [:error] [pid 49763:tid 49771] [client 173.239.214.180:64491] [client 173.239.214.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.180, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaLTjrTHSOG_yf2PpqHTAwAAAcU"]
[Sat Feb 28 19:37:50.934737 2026] [:error] [pid 49763:tid 49779] [client 173.239.214.180:64491] [client 173.239.214.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aaLTjrTHSOG_yf2PpqHTBgAAAc0"]
[Sat Feb 28 19:37:52.616191 2026] [:error] [pid 49763:tid 49789] [client 45.131.195.252:53501] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Feb 28 19:37:53.140161 2026] [:error] [pid 49763:tid 49766] [client 45.131.195.252:53501] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sat Feb 28 19:37:53.654744 2026] [:error] [pid 49763:tid 49776] [client 45.131.195.252:53501] [client 45.131.195.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaLTkbTHSOG_yf2PpqHTJgAAAco"]
[Sat Feb 28 19:37:54.212473 2026] [:error] [pid 49763:tid 49773] [client 45.131.195.253:26463] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Feb 28 19:37:55.314800 2026] [:error] [pid 49763:tid 49776] [client 45.131.195.253:26463] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sat Feb 28 19:37:55.799336 2026] [:error] [pid 49763:tid 49766] [client 45.131.195.253:26463] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sat Feb 28 19:37:56.304349 2026] [:error] [pid 49763:tid 49769] [client 45.131.195.253:26463] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Feb 28 19:37:56.608322 2026] [:error] [pid 49763:tid 49766] [client 45.131.195.253:26463] [client 45.131.195.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaLTlLTHSOG_yf2PpqHTTQAAAcA"]
[Sat Feb 28 19:37:57.087118 2026] [:error] [pid 49763:tid 49782] [client 185.198.240.180:45293] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Feb 28 19:37:57.333211 2026] [:error] [pid 49763:tid 49784] [client 185.198.240.180:45293] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Feb 28 19:37:57.588373 2026] [:error] [pid 49763:tid 49778] [client 185.198.240.180:45293] [client 185.198.240.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaLTlbTHSOG_yf2PpqHTVwAAAcw"]
[Sat Feb 28 19:37:58.323381 2026] [:error] [pid 39183:tid 39209] [client 185.198.240.179:38195] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sat Feb 28 19:37:58.841184 2026] [:error] [pid 39183:tid 39195] [client 185.198.240.179:38195] [client 185.198.240.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.179, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaLTlhCf4HvhVePw3LbW8gAAAAM"]
[Sat Feb 28 19:37:59.099878 2026] [:error] [pid 39183:tid 39192] [client 185.198.240.179:38195] [client 185.198.240.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaLTlxCf4HvhVePw3LbW8wAAAAA"]
[Sat Feb 28 19:38:02.608773 2026] [:error] [pid 39184:tid 39220] [client 185.198.240.158:52189] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sat Feb 28 19:38:04.394454 2026] [:error] [pid 39184:tid 39243] [client 185.198.240.158:52189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Feb 28 19:38:04.673751 2026] [:error] [pid 39184:tid 39236] [client 185.198.240.158:52189] [client 185.198.240.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaLTnFtZF9Zd_U7easCL-gAAAFE"]
[Sat Feb 28 19:38:05.147747 2026] [:error] [pid 39183:tid 39204] [client 45.131.195.216:31111] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Feb 28 19:38:05.902431 2026] [:error] [pid 39183:tid 39209] [client 45.131.195.216:31111] [client 45.131.195.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.216, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaLTnRCf4HvhVePw3LbXHQAAABE"]
[Sat Feb 28 19:38:06.202248 2026] [:error] [pid 39183:tid 39197] [client 45.131.195.216:31111] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Feb 28 19:38:06.456128 2026] [:error] [pid 39183:tid 39206] [client 45.131.195.216:31111] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sat Feb 28 19:38:06.697677 2026] [:error] [pid 39183:tid 39204] [client 45.131.195.216:31111] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sat Feb 28 19:38:06.971739 2026] [:error] [pid 39183:tid 39209] [client 45.131.195.216:31111] [client 45.131.195.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaLTnhCf4HvhVePw3LbXKQAAABE"]
[Sat Feb 28 19:38:07.512583 2026] [:error] [pid 11791:tid 11810] [client 45.131.195.252:42031] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sat Feb 28 19:38:07.761254 2026] [:error] [pid 11791:tid 11803] [client 45.131.195.252:42031] [client 45.131.195.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aaLTn2uX5e1Q32gqxH2qaAAAAQo"]
[Sat Feb 28 19:38:08.593156 2026] [:error] [pid 11791:tid 11807] [client 185.198.240.175:31807] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Feb 28 19:38:08.852878 2026] [:error] [pid 11791:tid 11814] [client 185.198.240.175:31807] [client 185.198.240.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaLToGuX5e1Q32gqxH2qawAAARU"]
[Sat Feb 28 19:38:09.887604 2026] [:error] [pid 49763:tid 49782] [client 209.87.169.171:55629] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sat Feb 28 19:38:10.152080 2026] [:error] [pid 49763:tid 49787] [client 209.87.169.171:55629] [client 209.87.169.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaLTorTHSOG_yf2PpqHTdQAAAdU"]
[Sat Feb 28 19:38:10.671524 2026] [:error] [pid 52460:tid 52468] [client 209.87.169.161:41295] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaLTorLWOogAgHGh62Q4SgAAAYU"]
[Sat Feb 28 19:38:11.183915 2026] [:error] [pid 52460:tid 52477] [client 185.198.240.159:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Feb 28 19:38:11.436448 2026] [:error] [pid 52460:tid 52471] [client 185.198.240.159:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sat Feb 28 19:38:13.644627 2026] [:error] [pid 52460:tid 52485] [client 185.198.240.159:44777] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaLTpbLWOogAgHGh62Q4WwAAAZY"]
[Sat Feb 28 19:38:14.407061 2026] [:error] [pid 49763:tid 49769] [client 185.198.240.161:42151] [client 185.198.240.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaLTprTHSOG_yf2PpqHTfQAAAcM"]
[Sat Feb 28 19:38:16.941516 2026] [:error] [pid 49763:tid 49773] [client 209.87.169.156:40231] [client 209.87.169.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aaLTqLTHSOG_yf2PpqHTkwAAAcc"]
[Sat Feb 28 19:38:17.461476 2026] [:error] [pid 49763:tid 49788] [client 185.198.240.172:40457] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sat Feb 28 19:38:17.958026 2026] [:error] [pid 49763:tid 49774] [client 185.198.240.172:40457] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sat Feb 28 19:38:18.205832 2026] [:error] [pid 49763:tid 49778] [client 185.198.240.172:40457] [client 185.198.240.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaLTqrTHSOG_yf2PpqHToQAAAcw"]
[Sat Feb 28 19:38:18.743555 2026] [:error] [pid 49763:tid 49773] [client 173.239.214.180:33781] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Feb 28 19:38:19.268772 2026] [:error] [pid 49763:tid 49788] [client 173.239.214.180:33781] [client 173.239.214.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aaLTq7THSOG_yf2PpqHTrQAAAdY"]
[Sat Feb 28 19:38:20.563087 2026] [:error] [pid 49763:tid 49776] [client 209.87.169.173:56225] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaLTrLTHSOG_yf2PpqHTvwAAAco"]
[Sat Feb 28 19:38:21.325116 2026] [:error] [pid 49763:tid 49771] [client 185.198.240.163:65133] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Feb 28 19:38:22.090531 2026] [:error] [pid 49763:tid 49774] [client 185.198.240.163:65133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sat Feb 28 19:38:22.641701 2026] [:error] [pid 49763:tid 49771] [client 185.198.240.163:65133] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Feb 28 19:38:22.878628 2026] [:error] [pid 49763:tid 49777] [client 185.198.240.163:65133] [client 185.198.240.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaLTrrTHSOG_yf2PpqHT3QAAAcs"]
[Sat Feb 28 19:38:23.355753 2026] [:error] [pid 11791:tid 11802] [client 209.87.169.163:34885] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaLTr2uX5e1Q32gqxH2qbwAAAQk"]
[Sat Feb 28 19:38:23.843921 2026] [:error] [pid 49763:tid 49788] [client 185.198.240.169:43969] [client 185.198.240.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaLTr7THSOG_yf2PpqHT7wAAAdY"]
[Sat Feb 28 19:38:24.305818 2026] [:error] [pid 52460:tid 52468] [client 173.239.214.179:56177] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaLTsLLWOogAgHGh62Q4dgAAAYU"]
[Sat Feb 28 19:38:24.828143 2026] [:error] [pid 39185:tid 39251] [client 173.239.214.179:45433] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sat Feb 28 19:38:25.084241 2026] [:error] [pid 39185:tid 39264] [client 173.239.214.179:45433] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaLTsRVE-FfM89u7BQaLoQAAAJI"]
[Sat Feb 28 19:38:25.692264 2026] [:error] [pid 39292:tid 39298] [client 185.198.240.164:58739] [client 185.198.240.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaLTsaIAO5fN7BxyqcFacAAAAMQ"]
[Sat Feb 28 19:38:26.237938 2026] [:error] [pid 39185:tid 39256] [client 209.87.169.163:39615] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sat Feb 28 19:38:26.747230 2026] [:error] [pid 39185:tid 39269] [client 209.87.169.163:39615] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaLTshVE-FfM89u7BQaLpwAAAJc"]
[Sat Feb 28 19:38:27.236598 2026] [:error] [pid 39184:tid 39230] [client 45.131.195.217:49437] [client 45.131.195.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaLTs1tZF9Zd_U7easCMDAAAAEs"]
[Sat Feb 28 19:38:27.702569 2026] [:error] [pid 39183:tid 39208] [client 185.198.240.160:41873] [client 185.198.240.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaLTsxCf4HvhVePw3LbXaAAAABA"]
[Sat Feb 28 19:38:28.210522 2026] [:error] [pid 39183:tid 39213] [client 209.87.169.161:25807] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaLTtBCf4HvhVePw3LbXbgAAABU"]
[Sat Feb 28 19:38:29.058874 2026] [:error] [pid 52460:tid 52477] [client 185.198.240.158:48547] [client 185.198.240.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaLTtbLWOogAgHGh62Q4gwAAAY4"]
[Sat Feb 28 19:38:30.036910 2026] [:error] [pid 39183:tid 39195] [client 209.87.169.162:64531] [client 209.87.169.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaLTthCf4HvhVePw3LbXiwAAAAM"]
[Sat Feb 28 19:38:30.590647 2026] [:error] [pid 39183:tid 39209] [client 185.198.240.179:25555] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Feb 28 19:38:31.329497 2026] [:error] [pid 39183:tid 39195] [client 185.198.240.179:25555] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sat Feb 28 19:38:31.594324 2026] [:error] [pid 39183:tid 39208] [client 185.198.240.179:25555] [client 185.198.240.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaLTtxCf4HvhVePw3LbXnAAAABA"]
[Sat Feb 28 19:38:32.331699 2026] [:error] [pid 39183:tid 39198] [client 209.87.169.170:51571] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sat Feb 28 19:38:32.678876 2026] [:error] [pid 39183:tid 39204] [client 209.87.169.170:51571] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sat Feb 28 19:38:34.000085 2026] [:error] [pid 39183:tid 39211] [client 209.87.169.170:51571] [client 209.87.169.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaLTuRCf4HvhVePw3LbXsgAAABM"]
[Sat Feb 28 19:38:35.269984 2026] [:error] [pid 39292:tid 39305] [client 185.198.240.174:20913] [client 185.198.240.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaLTu6IAO5fN7BxyqcFafwAAAMs"]
[Sat Feb 28 19:38:35.769123 2026] [:error] [pid 49763:tid 49786] [client 209.87.169.160:29393] [client 209.87.169.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaLTu7THSOG_yf2PpqHUHgAAAdQ"]
[Sat Feb 28 19:38:37.423166 2026] [:error] [pid 49763:tid 49787] [client 185.198.240.164:45531] [client 185.198.240.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaLTvbTHSOG_yf2PpqHUMAAAAdU"]
[Sat Feb 28 19:38:38.440693 2026] [:error] [pid 39292:tid 39318] [client 185.198.240.177:45217] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sat Feb 28 19:38:38.678547 2026] [:error] [pid 39292:tid 39295] [client 185.198.240.177:45217] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sat Feb 28 19:38:38.932616 2026] [:error] [pid 39292:tid 39317] [client 185.198.240.177:45217] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sat Feb 28 19:38:39.162803 2026] [:error] [pid 39292:tid 39300] [client 185.198.240.177:45217] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sat Feb 28 19:38:40.413863 2026] [:error] [pid 39292:tid 39305] [client 185.198.240.177:45217] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaLTwKIAO5fN7BxyqcFakwAAAMs"]
[Sat Feb 28 19:38:40.908592 2026] [:error] [pid 49763:tid 49789] [client 45.131.195.216:32011] [client 45.131.195.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaLTwLTHSOG_yf2PpqHUTQAAAdc"]
[Sat Feb 28 19:38:41.589326 2026] [:error] [pid 52460:tid 52469] [client 185.198.240.161:26497] [client 185.198.240.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaLTwbLWOogAgHGh62Q4ngAAAYY"]
[Sat Feb 28 19:38:42.090914 2026] [:error] [pid 22194:tid 22208] [client 185.198.240.179:31643] [client 185.198.240.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaLTwn6mbajs3bzQGyuQygAAAUw"]
[Sat Feb 28 19:38:42.731621 2026] [:error] [pid 49763:tid 49786] [client 45.131.195.217:27439] [client 45.131.195.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaLTwrTHSOG_yf2PpqHUUwAAAdQ"]
[Sat Feb 28 19:38:43.238630 2026] [:error] [pid 52460:tid 52486] [client 45.131.195.252:31953] [client 45.131.195.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaLTw7LWOogAgHGh62Q4oAAAAZc"]
[Sat Feb 28 19:38:44.061481 2026] [:error] [pid 39184:tid 39238] [client 209.87.169.158:31091] [client 209.87.169.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaLTxFtZF9Zd_U7easCMHQAAAFM"]
[Sat Feb 28 19:38:44.591189 2026] [:error] [pid 39184:tid 39223] [client 45.131.195.216:30317] [client 45.131.195.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaLTxFtZF9Zd_U7easCMHwAAAEQ"]
[Sat Feb 28 19:38:45.143790 2026] [:error] [pid 52460:tid 52469] [client 185.198.240.170:36323] [client 185.198.240.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaLTxbLWOogAgHGh62Q4rQAAAYY"]
[Sat Feb 28 19:38:45.628521 2026] [:error] [pid 39292:tid 39296] [client 209.87.169.167:64263] [client 209.87.169.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaLTxaIAO5fN7BxyqcFaoQAAAMI"]
[Sat Feb 28 19:38:46.628168 2026] [:error] [pid 39184:tid 39235] [client 173.239.214.180:42933] [client 173.239.214.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaLTxltZF9Zd_U7easCMKAAAAFA"]
[Sat Feb 28 19:38:47.378467 2026] [:error] [pid 49763:tid 49783] [client 209.87.169.171:34035] [client 209.87.169.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaLTx7THSOG_yf2PpqHUZgAAAdE"]
[Sat Feb 28 19:38:47.838364 2026] [:error] [pid 39292:tid 39311] [client 185.198.240.178:26033] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Feb 28 19:38:48.332928 2026] [:error] [pid 39292:tid 39303] [client 185.198.240.178:26033] [client 185.198.240.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaLTyKIAO5fN7BxyqcFapwAAAMk"]
[Sat Feb 28 19:38:49.356332 2026] [:error] [pid 49763:tid 49786] [client 173.239.214.181:37225] [client 173.239.214.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaLTybTHSOG_yf2PpqHUdgAAAdQ"]
[Sat Feb 28 19:38:50.596365 2026] [:error] [pid 39183:tid 39198] [client 185.198.240.172:57715] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sat Feb 28 19:38:50.832527 2026] [:error] [pid 39183:tid 39204] [client 185.198.240.172:57715] [client 185.198.240.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaLTyhCf4HvhVePw3LbXzwAAAAw"]
[Sat Feb 28 19:38:51.528431 2026] [:error] [pid 39183:tid 39206] [client 209.87.169.161:38437] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sat Feb 28 19:38:51.790251 2026] [:error] [pid 39183:tid 39201] [client 209.87.169.161:38437] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sat Feb 28 19:38:52.028158 2026] [:error] [pid 39183:tid 39203] [client 209.87.169.161:38437] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sat Feb 28 19:38:52.280292 2026] [:error] [pid 39183:tid 39216] [client 209.87.169.161:38437] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaLTzBCf4HvhVePw3LbX4QAAABg"]
[Sat Feb 28 19:38:52.767343 2026] [:error] [pid 39183:tid 39197] [client 45.131.195.217:52845] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Feb 28 19:38:53.001050 2026] [:error] [pid 39183:tid 39208] [client 45.131.195.217:52845] [client 45.131.195.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaLTzRCf4HvhVePw3LbX5wAAABA"]
[Sat Feb 28 19:38:55.034292 2026] [:error] [pid 49763:tid 49768] [client 45.131.195.215:44225] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 19:38:55.292317 2026] [:error] [pid 49763:tid 49787] [client 45.131.195.215:44225] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Feb 28 19:38:55.573120 2026] [:error] [pid 49763:tid 49785] [client 45.131.195.215:44225] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sat Feb 28 19:38:56.886479 2026] [:error] [pid 49763:tid 49773] [client 45.131.195.215:44225] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Feb 28 19:38:57.156735 2026] [:error] [pid 49763:tid 49770] [client 45.131.195.215:44225] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sat Feb 28 19:38:57.645287 2026] [:error] [pid 49763:tid 49781] [client 45.131.195.215:44225] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sat Feb 28 19:38:58.388082 2026] [:error] [pid 49763:tid 49776] [client 45.131.195.215:44225] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat Feb 28 19:38:58.645185 2026] [:error] [pid 49763:tid 49775] [client 45.131.195.215:44225] [client 45.131.195.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaLT0rTHSOG_yf2PpqHUsgAAAck"]
[Sat Feb 28 19:38:59.169507 2026] [:error] [pid 39183:tid 39206] [client 173.239.214.180:64131] [client 173.239.214.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaLT0xCf4HvhVePw3LbX-wAAAA4"]
[Sat Feb 28 19:38:59.683831 2026] [:error] [pid 49763:tid 49774] [client 209.87.169.159:58509] [client 209.87.169.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.159, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaLT07THSOG_yf2PpqHUtQAAAcg"]
[Sat Feb 28 19:38:59.687857 2026] [:error] [pid 49763:tid 49774] [client 209.87.169.159:58509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 28 19:38:59.918733 2026] [:error] [pid 49763:tid 49766] [client 209.87.169.159:58509] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sat Feb 28 19:39:00.256836 2026] [:error] [pid 49763:tid 49780] [client 209.87.169.159:58509] [client 209.87.169.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaLT1LTHSOG_yf2PpqHUugAAAc4"]
[Sat Feb 28 19:39:01.228864 2026] [:error] [pid 52460:tid 52470] [client 209.87.169.160:41687] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Feb 28 19:39:01.466799 2026] [:error] [pid 52460:tid 52477] [client 209.87.169.160:41687] [client 209.87.169.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaLT1bLWOogAgHGh62Q44AAAAY4"]
[Sat Feb 28 19:39:01.988799 2026] [:error] [pid 39185:tid 39268] [client 185.198.240.161:25447] [client 185.198.240.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaLT1RVE-FfM89u7BQaLvwAAAJY"]
[Sat Feb 28 19:39:03.698899 2026] [:error] [pid 11791:tid 11796] [client 209.87.169.160:32477] [client 209.87.169.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaLT12uX5e1Q32gqxH2qjQAAAQM"]
[Sat Feb 28 19:39:04.237169 2026] [:error] [pid 49763:tid 49781] [client 185.198.240.171:52289] [client 185.198.240.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaLT2LTHSOG_yf2PpqHUxwAAAc8"]
[Sat Feb 28 19:39:05.517585 2026] [:error] [pid 49763:tid 49772] [client 185.198.240.171:26013] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sat Feb 28 19:39:06.041115 2026] [:error] [pid 49763:tid 49780] [client 185.198.240.171:26013] [client 185.198.240.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaLT2rTHSOG_yf2PpqHU1gAAAc4"]
[Sat Feb 28 19:39:07.122348 2026] [:error] [pid 49763:tid 49774] [client 209.87.169.165:61531] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sat Feb 28 19:39:07.693655 2026] [:error] [pid 49763:tid 49781] [client 209.87.169.165:61531] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aaLT27THSOG_yf2PpqHU4wAAAc8"]
[Sat Feb 28 19:39:08.196346 2026] [:error] [pid 39184:tid 39222] [client 209.87.169.162:34461] [client 209.87.169.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaLT3FtZF9Zd_U7easCMYwAAAEM"]
[Sat Feb 28 19:39:08.937854 2026] [:error] [pid 22194:tid 22196] [client 209.87.169.160:47151] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sat Feb 28 19:39:09.184968 2026] [:error] [pid 22194:tid 22202] [client 209.87.169.160:47151] [client 209.87.169.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaLT3X6mbajs3bzQGyuQ3AAAAUY"]
[Sat Feb 28 19:39:09.674899 2026] [:error] [pid 52460:tid 52477] [client 185.198.240.175:62573] [client 185.198.240.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaLT3bLWOogAgHGh62Q4-wAAAY4"]
[Sat Feb 28 19:39:10.704002 2026] [:error] [pid 49763:tid 49775] [client 185.198.240.175:48237] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sat Feb 28 19:39:10.974370 2026] [:error] [pid 49763:tid 49769] [client 185.198.240.175:48237] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sat Feb 28 19:39:11.518055 2026] [:error] [pid 49763:tid 49784] [client 185.198.240.175:48237] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sat Feb 28 19:39:12.023930 2026] [:error] [pid 49763:tid 49785] [client 185.198.240.175:48237] [client 185.198.240.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaLT4LTHSOG_yf2PpqHU9wAAAdM"]
[Sat Feb 28 19:39:12.492945 2026] [:error] [pid 52460:tid 52478] [client 209.87.169.172:27585] [client 209.87.169.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaLT4LLWOogAgHGh62Q5BwAAAY8"]
[Sat Feb 28 19:39:13.740519 2026] [:error] [pid 39184:tid 39220] [client 209.87.169.156:24987] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Feb 28 19:39:14.000419 2026] [:error] [pid 39184:tid 39240] [client 209.87.169.156:24987] [client 209.87.169.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aaLT4VtZF9Zd_U7easCMcwAAAFU"]
[Sat Feb 28 19:39:14.534170 2026] [:error] [pid 52460:tid 52469] [client 209.87.169.157:32923] [client 209.87.169.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaLT4rLWOogAgHGh62Q5EQAAAYY"]
[Sat Feb 28 19:39:15.072851 2026] [:error] [pid 39184:tid 39221] [client 185.198.240.176:45713] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaLT41tZF9Zd_U7easCMdQAAAEI"]
[Sat Feb 28 19:39:16.610015 2026] [:error] [pid 52460:tid 52476] [client 185.198.240.179:44281] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sat Feb 28 19:39:16.834042 2026] [:error] [pid 52460:tid 52478] [client 185.198.240.179:44281] [client 185.198.240.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaLT5LLWOogAgHGh62Q5JgAAAY8"]
[Sat Feb 28 19:39:17.737011 2026] [:error] [pid 11791:tid 11804] [client 185.198.240.98:51133] [client 185.198.240.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaLT5WuX5e1Q32gqxH2qmAAAAQs"]
[Sat Feb 28 19:39:18.321618 2026] [:error] [pid 49763:tid 49779] [client 209.87.169.161:32021] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Feb 28 19:39:18.576658 2026] [:error] [pid 49763:tid 49780] [client 209.87.169.161:32021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sat Feb 28 19:39:19.099131 2026] [:error] [pid 49763:tid 49768] [client 209.87.169.161:32021] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sat Feb 28 19:39:20.272595 2026] [:error] [pid 49763:tid 49768] [client 209.87.169.161:32021] [client 209.87.169.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.161, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aaLT6LTHSOG_yf2PpqHVGAAAAcI"]
[Sat Feb 28 19:39:20.827139 2026] [:error] [pid 49763:tid 49789] [client 209.87.169.161:32021] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sat Feb 28 19:39:21.087917 2026] [:error] [pid 49763:tid 49781] [client 209.87.169.161:32021] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sat Feb 28 19:39:21.444235 2026] [:error] [pid 49763:tid 49772] [client 209.87.169.161:32021] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sat Feb 28 19:39:22.000798 2026] [:error] [pid 49763:tid 49787] [client 209.87.169.161:32021] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaLT6rTHSOG_yf2PpqHVLQAAAdU"]
[Sat Feb 28 19:39:22.563862 2026] [:error] [pid 39184:tid 39220] [client 185.198.240.160:50875] [client 185.198.240.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.160, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaLT6ltZF9Zd_U7easCMgAAAAEE"]
[Sat Feb 28 19:39:23.652126 2026] [:error] [pid 39184:tid 39233] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sat Feb 28 19:39:23.886938 2026] [:error] [pid 39184:tid 39229] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sat Feb 28 19:39:24.401777 2026] [:error] [pid 39184:tid 39236] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sat Feb 28 19:39:24.886556 2026] [:error] [pid 39184:tid 39239] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Feb 28 19:39:25.642933 2026] [:error] [pid 39184:tid 39243] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sat Feb 28 19:39:27.508172 2026] [:error] [pid 39184:tid 39222] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Feb 28 19:39:27.803696 2026] [:error] [pid 39184:tid 39219] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sat Feb 28 19:39:29.229406 2026] [:error] [pid 39184:tid 39233] [client 185.198.240.160:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sat Feb 28 19:39:29.778169 2026] [:error] [pid 39184:tid 39234] [client 185.198.240.160:50875] [client 185.198.240.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaLT8VtZF9Zd_U7easCMnwAAAE8"]
[Sat Feb 28 19:39:30.847718 2026] [:error] [pid 39183:tid 39212] [client 185.198.240.170:47279] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sat Feb 28 19:39:31.076695 2026] [:error] [pid 39183:tid 39201] [client 185.198.240.170:47279] [client 185.198.240.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaLT8xCf4HvhVePw3LbYmwAAAAk"]
[Sat Feb 28 19:39:31.779041 2026] [:error] [pid 52460:tid 52467] [client 173.239.214.181:38277] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sat Feb 28 19:39:32.036765 2026] [:error] [pid 52460:tid 52484] [client 173.239.214.181:38277] [client 173.239.214.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaLT9LLWOogAgHGh62Q5aQAAAZU"]
[Sat Feb 28 19:39:33.037270 2026] [:error] [pid 39183:tid 39194] [client 209.87.169.165:48345] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sat Feb 28 19:39:33.541213 2026] [:error] [pid 39183:tid 39208] [client 209.87.169.165:48345] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sat Feb 28 19:39:34.105881 2026] [:error] [pid 39183:tid 39216] [client 209.87.169.165:48345] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sat Feb 28 19:39:34.344106 2026] [:error] [pid 39183:tid 39212] [client 209.87.169.165:48345] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sat Feb 28 19:39:34.853138 2026] [:error] [pid 39183:tid 39192] [client 209.87.169.165:48345] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaLT9hCf4HvhVePw3LbYtwAAAAA"]
[Sat Feb 28 19:39:35.384039 2026] [:error] [pid 49763:tid 49779] [client 45.131.195.217:20085] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sat Feb 28 19:39:35.628925 2026] [:error] [pid 49763:tid 49776] [client 45.131.195.217:20085] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sat Feb 28 19:39:35.862350 2026] [:error] [pid 49763:tid 49774] [client 45.131.195.217:20085] [client 45.131.195.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaLT97THSOG_yf2PpqHVdQAAAcg"]
[Sat Feb 28 19:39:36.641871 2026] [:error] [pid 39184:tid 39234] [client 185.198.240.181:32719] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaLT-FtZF9Zd_U7easCMrwAAAE8"]
[Sat Feb 28 19:39:37.455640 2026] [:error] [pid 39185:tid 39253] [client 185.198.240.162:38799] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Feb 28 19:39:38.259201 2026] [:error] [pid 39185:tid 39265] [client 185.198.240.162:38799] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sat Feb 28 19:39:39.448769 2026] [:error] [pid 39185:tid 39265] [client 185.198.240.162:38799] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sat Feb 28 19:39:39.722251 2026] [:error] [pid 39185:tid 39267] [client 185.198.240.162:38799] [client 185.198.240.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaLT-xVE-FfM89u7BQaL2QAAAJU"]
[Sat Feb 28 19:39:40.262366 2026] [:error] [pid 49763:tid 49768] [client 209.87.169.159:48799] [client 209.87.169.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaLT_LTHSOG_yf2PpqHVpwAAAcI"]
[Sat Feb 28 19:39:42.042692 2026] [:error] [pid 52460:tid 52472] [client 185.198.240.171:58263] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sat Feb 28 19:39:42.545708 2026] [:error] [pid 52460:tid 52465] [client 185.198.240.171:58263] [client 185.198.240.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaLT_rLWOogAgHGh62Q5lgAAAYI"]
[Sat Feb 28 19:39:43.399234 2026] [:error] [pid 49763:tid 49778] [client 185.198.240.181:44705] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaLT_7THSOG_yf2PpqHVtQAAAcw"]
[Sat Feb 28 19:39:44.233249 2026] [:error] [pid 39184:tid 39242] [client 209.87.169.168:61939] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 28 19:39:44.535374 2026] [:error] [pid 39184:tid 39235] [client 209.87.169.168:61939] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sat Feb 28 19:39:44.807339 2026] [:error] [pid 39184:tid 39225] [client 209.87.169.168:61939] [client 209.87.169.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaLUAFtZF9Zd_U7easCMywAAAEY"]
[Sat Feb 28 19:39:45.549693 2026] [:error] [pid 49763:tid 49775] [client 185.198.240.165:27221] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sat Feb 28 19:39:45.840192 2026] [:error] [pid 49763:tid 49768] [client 185.198.240.165:27221] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sat Feb 28 19:39:46.325246 2026] [:error] [pid 49763:tid 49770] [client 185.198.240.165:27221] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sat Feb 28 19:39:47.058170 2026] [:error] [pid 49763:tid 49789] [client 185.198.240.165:27221] [client 185.198.240.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaLUA7THSOG_yf2PpqHV-gAAAdc"]
[Sat Feb 28 19:39:47.564944 2026] [:error] [pid 49763:tid 49776] [client 45.131.195.253:25103] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sat Feb 28 19:39:48.344990 2026] [:error] [pid 49763:tid 49775] [client 45.131.195.253:25103] [client 45.131.195.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaLUBLTHSOG_yf2PpqHWIAAAAck"]
[Sat Feb 28 19:39:49.131069 2026] [:error] [pid 22194:tid 22212] [client 209.87.169.159:48229] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sat Feb 28 19:39:49.935294 2026] [:error] [pid 22194:tid 22213] [client 209.87.169.159:48229] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sat Feb 28 19:39:50.174150 2026] [:error] [pid 22194:tid 22197] [client 209.87.169.159:48229] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sat Feb 28 19:39:50.715122 2026] [:error] [pid 22194:tid 22218] [client 209.87.169.159:48229] [client 209.87.169.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.159, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaLUBn6mbajs3bzQGyuQ6QAAAVY"]
[Sat Feb 28 19:39:52.010266 2026] [:error] [pid 22194:tid 22196] [client 209.87.169.159:48229] [client 209.87.169.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaLUCH6mbajs3bzQGyuQ7gAAAUA"]
[Sat Feb 28 19:39:53.614645 2026] [:error] [pid 39183:tid 39192] [client 185.198.240.167:46475] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sat Feb 28 19:39:53.858361 2026] [:error] [pid 39183:tid 39197] [client 185.198.240.167:46475] [client 185.198.240.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaLUCRCf4HvhVePw3LbZIQAAAAU"]
[Sat Feb 28 19:39:54.389428 2026] [:error] [pid 49763:tid 49775] [client 185.198.240.172:31289] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sat Feb 28 19:39:54.949670 2026] [:error] [pid 49763:tid 49772] [client 185.198.240.172:31289] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sat Feb 28 19:39:56.033841 2026] [:error] [pid 49763:tid 49774] [client 185.198.240.172:31289] [client 185.198.240.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaLUDLTHSOG_yf2PpqHWnAAAAcg"]
[Sat Feb 28 19:39:56.927892 2026] [:error] [pid 52460:tid 52480] [client 209.87.169.170:33707] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sat Feb 28 19:39:57.183976 2026] [:error] [pid 52460:tid 52484] [client 209.87.169.170:33707] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sat Feb 28 19:39:59.116814 2026] [:error] [pid 52460:tid 52480] [client 209.87.169.170:33707] [client 209.87.169.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaLUD7LWOogAgHGh62Q50wAAAZE"]
[Sat Feb 28 19:39:59.873459 2026] [:error] [pid 49763:tid 49774] [client 185.198.240.98:39713] [client 185.198.240.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaLUD7THSOG_yf2PpqHWtwAAAcg"]
[Sat Feb 28 19:40:00.416385 2026] [:error] [pid 49763:tid 49770] [client 185.198.240.165:44013] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sat Feb 28 19:40:00.815656 2026] [:error] [pid 49763:tid 49774] [client 185.198.240.165:44013] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sat Feb 28 19:40:01.305991 2026] [:error] [pid 49763:tid 49769] [client 185.198.240.165:44013] [client 185.198.240.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaLUEbTHSOG_yf2PpqHWzAAAAcM"]
[Sat Feb 28 19:40:02.108116 2026] [:error] [pid 11791:tid 11808] [client 185.198.240.164:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sat Feb 28 19:40:02.819448 2026] [:error] [pid 11791:tid 11800] [client 185.198.240.164:61633] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sat Feb 28 19:40:03.092322 2026] [:error] [pid 11791:tid 11793] [client 185.198.240.164:61633] [client 185.198.240.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaLUE2uX5e1Q32gqxH2qxgAAAQA"]
[Sat Feb 28 19:40:03.956540 2026] [:error] [pid 49763:tid 49768] [client 45.131.195.253:61997] [client 45.131.195.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aaLUE7THSOG_yf2PpqHW7wAAAcI"]
[Sat Feb 28 19:40:04.485859 2026] [:error] [pid 39292:tid 39312] [client 185.198.240.176:53211] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaLUFKIAO5fN7BxyqcFbFgAAANI"]
[Sat Feb 28 19:40:05.015577 2026] [:error] [pid 39292:tid 39314] [client 185.198.240.159:23463] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaLUFaIAO5fN7BxyqcFbGgAAANQ"]
[Sat Feb 28 19:40:05.568578 2026] [:error] [pid 49763:tid 49773] [client 185.198.240.164:60375] [client 185.198.240.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaLUFbTHSOG_yf2PpqHW9wAAAcc"]
[Sat Feb 28 19:40:06.114065 2026] [:error] [pid 39183:tid 39195] [client 185.198.240.161:33701] [client 185.198.240.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaLUFhCf4HvhVePw3LbZXgAAAAM"]
[Sat Feb 28 19:40:06.674513 2026] [:error] [pid 39183:tid 39203] [client 185.198.240.170:38783] [client 185.198.240.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaLUFhCf4HvhVePw3LbZYgAAAAs"]
[Sat Feb 28 19:40:07.688687 2026] [:error] [pid 39183:tid 39215] [client 209.87.169.166:62903] [client 209.87.169.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaLUFxCf4HvhVePw3LbZawAAABc"]
[Sat Feb 28 19:40:08.266878 2026] [:error] [pid 52460:tid 52483] [client 45.131.195.214:29463] [client 45.131.195.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaLUGLLWOogAgHGh62Q6BAAAAZQ"]
[Sat Feb 28 19:40:08.782905 2026] [:error] [pid 49763:tid 49782] [client 185.198.240.161:43741] [client 185.198.240.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaLUGLTHSOG_yf2PpqHXCAAAAdA"]
[Sat Feb 28 19:40:09.584633 2026] [:error] [pid 49763:tid 49789] [client 209.87.169.161:44271] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaLUGbTHSOG_yf2PpqHXFQAAAdc"]
[Sat Feb 28 19:40:10.572860 2026] [:error] [pid 22194:tid 22205] [client 185.198.240.174:31975] [client 185.198.240.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaLUGn6mbajs3bzQGyuQ_gAAAUk"]
[Sat Feb 28 19:40:11.088132 2026] [:error] [pid 39183:tid 39209] [client 209.87.169.172:42053] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sat Feb 28 19:40:12.188536 2026] [:error] [pid 39183:tid 39200] [client 209.87.169.172:42053] [client 209.87.169.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.172, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaLUHBCf4HvhVePw3LbZhQAAAAg"]
[Sat Feb 28 19:40:14.052565 2026] [:error] [pid 39183:tid 39207] [client 209.87.169.172:42053] [client 209.87.169.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaLUHhCf4HvhVePw3LbZjwAAAA8"]
[Sat Feb 28 19:40:14.620537 2026] [:error] [pid 52460:tid 52464] [client 185.198.240.159:36259] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaLUHrLWOogAgHGh62Q6IgAAAYE"]
[Sat Feb 28 19:40:15.880485 2026] [:error] [pid 49763:tid 49775] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sat Feb 28 19:40:16.157621 2026] [:error] [pid 49763:tid 49770] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sat Feb 28 19:40:17.219268 2026] [:error] [pid 49763:tid 49781] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sat Feb 28 19:40:17.556895 2026] [:error] [pid 49763:tid 49768] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sat Feb 28 19:40:18.625533 2026] [:error] [pid 49763:tid 49774] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sat Feb 28 19:40:18.888488 2026] [:error] [pid 49763:tid 49768] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sat Feb 28 19:40:19.140415 2026] [:error] [pid 49763:tid 49766] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sat Feb 28 19:40:19.414860 2026] [:error] [pid 49763:tid 49773] [client 209.87.169.165:55785] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sat Feb 28 19:40:19.672539 2026] [:error] [pid 49763:tid 49770] [client 209.87.169.165:55785] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaLUI7THSOG_yf2PpqHXXwAAAcQ"]
[Sat Feb 28 19:40:20.152903 2026] [:error] [pid 49763:tid 49786] [client 173.239.214.179:37383] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaLUJLTHSOG_yf2PpqHXZwAAAdQ"]
[Sat Feb 28 19:40:20.675676 2026] [:error] [pid 39183:tid 39206] [client 185.198.240.168:27123] [client 185.198.240.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaLUJBCf4HvhVePw3LbZqQAAAA4"]
[Sat Feb 28 19:40:21.427286 2026] [:error] [pid 39183:tid 39213] [client 185.198.240.181:29315] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sat Feb 28 19:40:21.681304 2026] [:error] [pid 39183:tid 39210] [client 185.198.240.181:29315] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sat Feb 28 19:40:22.183307 2026] [:error] [pid 39183:tid 39198] [client 185.198.240.181:29315] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sat Feb 28 19:40:22.702403 2026] [:error] [pid 39183:tid 39197] [client 185.198.240.181:29315] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaLUJhCf4HvhVePw3LbZuAAAAAU"]
[Sat Feb 28 19:40:23.240523 2026] [:error] [pid 39183:tid 39210] [client 185.198.240.181:38163] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaLUJxCf4HvhVePw3LbZwQAAABI"]
[Sat Feb 28 19:40:23.775728 2026] [:error] [pid 39183:tid 39203] [client 185.198.240.179:63459] [client 185.198.240.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaLUJxCf4HvhVePw3LbZxwAAAAs"]
[Sat Feb 28 19:40:25.307162 2026] [:error] [pid 22194:tid 22198] [client 185.198.240.158:20815] [client 185.198.240.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaLUKX6mbajs3bzQGyuRDQAAAUI"]
[Sat Feb 28 19:40:26.149836 2026] [:error] [pid 49763:tid 49772] [client 185.198.240.169:27417] [client 185.198.240.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaLUKrTHSOG_yf2PpqHXoAAAAcY"]
[Sat Feb 28 19:40:27.205958 2026] [:error] [pid 49763:tid 49789] [client 185.198.240.159:43263] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaLUK7THSOG_yf2PpqHXsAAAAdc"]
[Sat Feb 28 19:40:32.039900 2026] [:error] [pid 11791:tid 11803] [client 185.198.240.162:26959] [client 185.198.240.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaLUMGuX5e1Q32gqxH2q3AAAAQo"]
[Sat Feb 28 19:40:32.590636 2026] [:error] [pid 39292:tid 39307] [client 209.87.169.156:30217] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sat Feb 28 19:40:33.092506 2026] [:error] [pid 39292:tid 39301] [client 209.87.169.156:30217] [client 209.87.169.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aaLUMaIAO5fN7BxyqcFbTgAAAMc"]
[Sat Feb 28 19:40:34.187284 2026] [:error] [pid 39183:tid 39202] [client 209.87.169.173:31987] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sat Feb 28 19:40:35.021290 2026] [:error] [pid 39183:tid 39211] [client 209.87.169.173:31987] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sat Feb 28 19:40:35.259528 2026] [:error] [pid 39183:tid 39194] [client 209.87.169.173:31987] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaLUMxCf4HvhVePw3LbaCgAAAAI"]
[Sat Feb 28 19:40:36.251627 2026] [:error] [pid 39184:tid 39235] [client 209.87.169.157:33819] [client 209.87.169.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaLUNFtZF9Zd_U7easCNUQAAAFA"]
[Sat Feb 28 19:40:37.776149 2026] [:error] [pid 52460:tid 52479] [client 209.87.169.170:23519] [client 209.87.169.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaLUNbLWOogAgHGh62Q6bAAAAZA"]
[Sat Feb 28 19:40:39.618264 2026] [:error] [pid 52460:tid 52463] [client 185.198.240.176:53997] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaLUN7LWOogAgHGh62Q6gAAAAYA"]
[Sat Feb 28 19:40:40.346588 2026] [:error] [pid 39183:tid 39194] [client 185.198.240.175:56483] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Feb 28 19:40:40.801510 2026] [:error] [pid 39183:tid 39204] [client 185.198.240.175:56483] [client 185.198.240.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaLUOBCf4HvhVePw3LbaGwAAAAw"]
[Sat Feb 28 19:40:41.299694 2026] [:error] [pid 11791:tid 11816] [client 209.87.169.157:27041] [client 209.87.169.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaLUOWuX5e1Q32gqxH2q6QAAARc"]
[Sat Feb 28 19:40:43.086658 2026] [:error] [pid 39185:tid 39253] [client 185.198.240.178:45373] [client 185.198.240.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaLUOxVE-FfM89u7BQaMDQAAAIc"]
[Sat Feb 28 19:40:43.600581 2026] [:error] [pid 39184:tid 39224] [client 185.198.240.162:33687] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sat Feb 28 19:40:44.984438 2026] [:error] [pid 39184:tid 39229] [client 185.198.240.162:33687] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sat Feb 28 19:40:45.224012 2026] [:error] [pid 39184:tid 39219] [client 185.198.240.162:33687] [client 185.198.240.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaLUPVtZF9Zd_U7easCNdgAAAEA"]
[Sat Feb 28 19:40:46.206321 2026] [:error] [pid 52460:tid 52469] [client 185.198.240.167:43647] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sat Feb 28 19:40:46.748019 2026] [:error] [pid 52460:tid 52473] [client 185.198.240.167:43647] [client 185.198.240.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaLUPrLWOogAgHGh62Q6oQAAAYo"]
[Sat Feb 28 19:40:47.374639 2026] [:error] [pid 49763:tid 49778] [client 185.198.240.179:28617] [client 185.198.240.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaLUP7THSOG_yf2PpqHYLQAAAcw"]
[Sat Feb 28 19:40:48.553733 2026] [:error] [pid 39183:tid 39208] [client 185.198.240.170:29041] [client 185.198.240.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaLUQBCf4HvhVePw3LbaPQAAABA"]
[Sat Feb 28 19:40:49.801326 2026] [:error] [pid 49763:tid 49776] [client 45.131.195.253:22041] [client 45.131.195.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaLUQbTHSOG_yf2PpqHYSQAAAco"]
[Sat Feb 28 19:40:50.317146 2026] [:error] [pid 39184:tid 39240] [client 209.87.169.162:61249] [client 209.87.169.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaLUQltZF9Zd_U7easCNfgAAAFU"]
[Sat Feb 28 19:40:51.037654 2026] [:error] [pid 39184:tid 39231] [client 185.198.240.174:27407] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sat Feb 28 19:40:52.599209 2026] [:error] [pid 39184:tid 39239] [client 185.198.240.174:27407] [client 185.198.240.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaLURFtZF9Zd_U7easCNhwAAAFQ"]
[Sat Feb 28 19:40:53.637958 2026] [:error] [pid 52460:tid 52469] [client 173.239.214.181:28035] [client 173.239.214.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaLURbLWOogAgHGh62Q6qgAAAYY"]
[Sat Feb 28 19:40:54.186905 2026] [:error] [pid 39184:tid 39235] [client 185.198.240.164:49623] [client 185.198.240.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaLURltZF9Zd_U7easCNiQAAAFA"]
[Sat Feb 28 19:40:54.951939 2026] [:error] [pid 39184:tid 39230] [client 209.87.169.163:54899] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sat Feb 28 19:40:55.203087 2026] [:error] [pid 39184:tid 39240] [client 209.87.169.163:54899] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaLUR1tZF9Zd_U7easCNkQAAAFU"]
[Sat Feb 28 19:40:56.007632 2026] [:error] [pid 39183:tid 39209] [client 185.198.240.160:64001] [client 185.198.240.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaLUSBCf4HvhVePw3LbacgAAABE"]
[Sat Feb 28 19:40:57.811045 2026] [:error] [pid 52460:tid 52474] [client 185.198.240.173:30357] [client 185.198.240.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaLUSbLWOogAgHGh62Q6ugAAAYs"]
[Sat Feb 28 19:40:58.556164 2026] [:error] [pid 39183:tid 39204] [client 209.87.169.173:46657] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sat Feb 28 19:40:58.812836 2026] [:error] [pid 39183:tid 39201] [client 209.87.169.173:46657] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaLUShCf4HvhVePw3LbajgAAAAk"]
[Sat Feb 28 19:40:59.820738 2026] [:error] [pid 39292:tid 39309] [client 185.198.240.158:23913] [client 185.198.240.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaLUS6IAO5fN7BxyqcFbZAAAAM8"]
[Sat Feb 28 19:41:00.628567 2026] [:error] [pid 39184:tid 39229] [client 185.198.240.177:24913] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aaLUTFtZF9Zd_U7easCNlwAAAEo"]
[Sat Feb 28 19:41:01.368554 2026] [:error] [pid 52460:tid 52465] [client 209.87.169.166:63415] [client 209.87.169.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaLUTbLWOogAgHGh62Q61gAAAYI"]
[Sat Feb 28 19:41:01.920511 2026] [:error] [pid 39184:tid 39241] [client 209.87.169.166:33321] [client 209.87.169.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aaLUTVtZF9Zd_U7easCNngAAAFY"]
[Sat Feb 28 19:41:02.602286 2026] [:error] [pid 49763:tid 49782] [client 209.87.169.163:35211] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaLUTrTHSOG_yf2PpqHYegAAAdA"]
[Sat Feb 28 19:41:05.048110 2026] [:error] [pid 39183:tid 39208] [client 209.87.169.156:35689] [client 209.87.169.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaLUURCf4HvhVePw3LbaugAAABA"]
[Sat Feb 28 19:41:06.365284 2026] [:error] [pid 49763:tid 49767] [client 209.87.169.158:49747] [client 209.87.169.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaLUUrTHSOG_yf2PpqHYngAAAcE"]
[Sat Feb 28 19:41:07.569096 2026] [:error] [pid 39184:tid 39238] [client 173.239.214.181:53721] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sat Feb 28 19:41:07.813779 2026] [:error] [pid 39184:tid 39219] [client 173.239.214.181:53721] [client 173.239.214.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaLUU1tZF9Zd_U7easCNrgAAAEA"]
[Sat Feb 28 19:41:09.415659 2026] [:error] [pid 39183:tid 39211] [client 209.87.169.164:54369] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaLUVRCf4HvhVePw3Lba1wAAABM"]
[Sat Feb 28 19:41:09.869365 2026] [:error] [pid 39183:tid 39208] [client 185.198.240.176:61309] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Sat Feb 28 19:41:12.685818 2026] [:error] [pid 39183:tid 39194] [client 185.198.240.176:61309] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaLUWBCf4HvhVePw3Lba9gAAAAI"]
[Sat Feb 28 19:41:13.485365 2026] [:error] [pid 39292:tid 39312] [client 209.87.169.163:54361] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaLUWaIAO5fN7BxyqcFbcAAAANI"]
[Sat Feb 28 19:41:14.238124 2026] [:error] [pid 52460:tid 52466] [client 185.198.240.169:64905] [client 185.198.240.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaLUWrLWOogAgHGh62Q7BAAAAYM"]
[Sat Feb 28 19:41:15.304869 2026] [:error] [pid 11791:tid 11798] [client 209.87.169.171:65035] [client 209.87.169.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaLUW2uX5e1Q32gqxH2rCQAAAQU"]
[Sat Feb 28 19:41:17.787012 2026] [:error] [pid 39184:tid 39236] [client 185.198.240.167:40783] [client 185.198.240.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaLUXVtZF9Zd_U7easCNzQAAAFE"]
[Sat Feb 28 19:41:18.290247 2026] [:error] [pid 49763:tid 49789] [client 209.87.169.173:57397] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaLUXrTHSOG_yf2PpqHY6wAAAdc"]
[Sat Feb 28 19:41:19.713697 2026] [:error] [pid 39183:tid 39214] [client 209.87.169.159:61775] [client 209.87.169.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaLUXxCf4HvhVePw3LbbGAAAABY"]
[Sat Feb 28 19:41:20.256376 2026] [:error] [pid 11791:tid 11814] [client 185.198.240.168:26527] [client 185.198.240.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaLUYGuX5e1Q32gqxH2rDQAAARU"]
[Sat Feb 28 19:41:21.266676 2026] [:error] [pid 39184:tid 39219] [client 173.239.214.179:37803] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaLUYVtZF9Zd_U7easCN2AAAAEA"]
[Sat Feb 28 19:41:21.867680 2026] [:error] [pid 49763:tid 49790] [client 209.87.169.156:57813] [client 209.87.169.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaLUYbTHSOG_yf2PpqHY8QAAAdg"]
[Sat Feb 28 19:41:23.869016 2026] [:error] [pid 39184:tid 39221] [client 209.87.169.168:54725] [client 209.87.169.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.168, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaLUY1tZF9Zd_U7easCN3gAAAEI"]
[Sat Feb 28 19:41:23.872770 2026] [:error] [pid 39184:tid 39221] [client 209.87.169.168:54725] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sat Feb 28 19:41:24.105020 2026] [:error] [pid 39184:tid 39230] [client 209.87.169.168:54725] [client 209.87.169.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaLUZFtZF9Zd_U7easCN3wAAAEs"]
[Sat Feb 28 19:41:25.126093 2026] [:error] [pid 39184:tid 39223] [client 209.87.169.162:62589] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sat Feb 28 19:41:25.344042 2026] [:error] [pid 39184:tid 39220] [client 209.87.169.162:62589] [client 209.87.169.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaLUZVtZF9Zd_U7easCN6QAAAEE"]
[Sat Feb 28 19:41:27.357051 2026] [:error] [pid 52460:tid 52479] [client 185.198.240.166:48471] [client 185.198.240.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aaLUZ7LWOogAgHGh62Q7HwAAAZA"]
[Sat Feb 28 19:41:27.805683 2026] [:error] [pid 49763:tid 49782] [client 185.198.240.171:35091] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Sat Feb 28 19:41:29.598562 2026] [:error] [pid 49763:tid 49775] [client 185.198.240.171:35091] [client 185.198.240.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaLUabTHSOG_yf2PpqHZKAAAAck"]
[Sat Feb 28 19:41:30.144057 2026] [:error] [pid 39184:tid 39241] [client 45.131.195.253:63075] [client 45.131.195.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaLUaltZF9Zd_U7easCN7gAAAFY"]
[Sat Feb 28 19:41:31.283621 2026] [:error] [pid 39184:tid 39220] [client 209.87.169.173:30825] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaLUa1tZF9Zd_U7easCN_gAAAEE"]
[Sat Feb 28 19:41:31.792849 2026] [:error] [pid 11791:tid 11800] [client 209.87.169.171:61847] [client 209.87.169.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaLUa2uX5e1Q32gqxH2rHgAAAQc"]
[Sat Feb 28 19:41:32.290883 2026] [:error] [pid 52460:tid 52477] [client 185.198.240.165:46947] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sat Feb 28 19:41:32.552955 2026] [:error] [pid 52460:tid 52469] [client 185.198.240.165:46947] [client 185.198.240.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.165, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaLUbLLWOogAgHGh62Q7PgAAAYY"]
[Sat Feb 28 19:41:33.062110 2026] [:error] [pid 52460:tid 52482] [client 185.198.240.165:46947] [client 185.198.240.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaLUbbLWOogAgHGh62Q7QgAAAZM"]
[Sat Feb 28 19:41:34.647094 2026] [:error] [pid 49763:tid 49779] [client 185.198.240.161:64385] [client 185.198.240.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaLUbrTHSOG_yf2PpqHZPwAAAc0"]
[Sat Feb 28 19:41:35.141676 2026] [:error] [pid 39183:tid 39211] [client 45.131.195.252:35289] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sat Feb 28 19:41:35.418805 2026] [:error] [pid 39183:tid 39210] [client 45.131.195.252:35289] [client 45.131.195.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaLUbxCf4HvhVePw3LbbZwAAABI"]
[Sat Feb 28 19:41:35.920454 2026] [:error] [pid 39183:tid 39203] [client 209.87.169.164:58119] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaLUbxCf4HvhVePw3LbbbAAAAAs"]
[Sat Feb 28 19:41:36.430790 2026] [:error] [pid 39183:tid 39197] [client 209.87.169.158:64191] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sat Feb 28 19:41:37.204115 2026] [:error] [pid 39183:tid 39192] [client 209.87.169.158:64191] [client 209.87.169.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaLUcRCf4HvhVePw3LbbfAAAAAA"]
[Sat Feb 28 19:41:38.482355 2026] [:error] [pid 22194:tid 22209] [client 209.87.169.161:64523] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaLUcn6mbajs3bzQGyuRSwAAAU0"]
[Sat Feb 28 19:41:39.027825 2026] [:error] [pid 39292:tid 39299] [client 173.239.214.181:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sat Feb 28 19:41:39.524816 2026] [:error] [pid 39292:tid 39309] [client 173.239.214.181:56015] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Feb 28 19:41:40.057234 2026] [:error] [pid 39292:tid 39297] [client 173.239.214.181:56015] [client 173.239.214.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaLUdKIAO5fN7BxyqcFblwAAAMM"]
[Sat Feb 28 19:41:40.503797 2026] [:error] [pid 11791:tid 11817] [client 209.87.169.169:36839] [client 209.87.169.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaLUdGuX5e1Q32gqxH2rKQAAARg"]
[Sat Feb 28 19:41:41.308730 2026] [:error] [pid 39184:tid 39236] [client 185.198.240.181:41621] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aaLUdVtZF9Zd_U7easCOGAAAAFE"]
[Sat Feb 28 19:41:41.858355 2026] [:error] [pid 49763:tid 49778] [client 185.198.240.160:46411] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Sat Feb 28 19:41:43.451579 2026] [:error] [pid 49763:tid 49781] [client 185.198.240.160:46411] [client 185.198.240.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaLUd7THSOG_yf2PpqHZXgAAAc8"]
[Sat Feb 28 19:41:45.469259 2026] [:error] [pid 39184:tid 39220] [client 209.87.169.173:23049] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aaLUeVtZF9Zd_U7easCOHgAAAEE"]
[Sat Feb 28 19:41:45.722852 2026] [:error] [pid 39184:tid 39238] [client 209.87.169.173:23049] [client 209.87.169.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaLUeVtZF9Zd_U7easCOHwAAAFM"]
[Sat Feb 28 19:41:46.764350 2026] [:error] [pid 52460:tid 52465] [client 209.87.169.165:50903] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaLUerLWOogAgHGh62Q7dAAAAYI"]
[Sat Feb 28 19:41:47.285565 2026] [:error] [pid 52460:tid 52471] [client 209.87.169.161:53963] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaLUe7LWOogAgHGh62Q7eQAAAYg"]
[Sat Feb 28 19:41:48.426064 2026] [:error] [pid 39185:tid 39255] [client 209.87.169.164:56639] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sat Feb 28 19:41:49.488252 2026] [:error] [pid 39185:tid 39266] [client 209.87.169.164:56639] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaLUfRVE-FfM89u7BQaMVQAAAJQ"]
[Sat Feb 28 19:41:50.519645 2026] [:error] [pid 39183:tid 39210] [client 185.198.240.181:27495] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaLUfhCf4HvhVePw3LbbsgAAABI"]
[Sat Feb 28 19:41:51.326349 2026] [:error] [pid 49763:tid 49772] [client 209.87.169.167:43653] [client 209.87.169.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaLUf7THSOG_yf2PpqHZfAAAAcY"]
[Sat Feb 28 19:41:51.861911 2026] [:error] [pid 39183:tid 39193] [client 45.131.195.214:36111] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sat Feb 28 19:41:53.229469 2026] [:error] [pid 39183:tid 39216] [client 45.131.195.214:36111] [client 45.131.195.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaLUgRCf4HvhVePw3LbbxgAAABg"]
[Sat Feb 28 19:41:55.247767 2026] [:error] [pid 22194:tid 22206] [client 185.198.240.181:32737] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aaLUg36mbajs3bzQGyuRWQAAAUo"]
[Sat Feb 28 19:41:55.738155 2026] [:error] [pid 39183:tid 39195] [client 185.198.240.162:21761] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sat Feb 28 19:41:55.973011 2026] [:error] [pid 39183:tid 39198] [client 185.198.240.162:21761] [client 185.198.240.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaLUgxCf4HvhVePw3Lbb1QAAAAY"]
[Sat Feb 28 19:41:56.502234 2026] [:error] [pid 22194:tid 22207] [client 209.87.169.163:31671] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaLUhH6mbajs3bzQGyuRWgAAAUs"]
[Sat Feb 28 19:41:57.479863 2026] [:error] [pid 22194:tid 22196] [client 185.198.240.160:43245] [client 185.198.240.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaLUhX6mbajs3bzQGyuRXwAAAUA"]
[Sat Feb 28 19:41:58.729361 2026] [:error] [pid 39183:tid 39204] [client 173.239.214.179:38183] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Sat Feb 28 19:41:59.010718 2026] [:error] [pid 39183:tid 39193] [client 173.239.214.179:38183] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaLUhxCf4HvhVePw3Lbb8AAAAAE"]
[Sat Feb 28 19:41:59.513809 2026] [:error] [pid 52460:tid 52473] [client 173.239.214.179:25215] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaLUh7LWOogAgHGh62Q7sgAAAYo"]
[Sat Feb 28 19:42:01.388285 2026] [:error] [pid 22194:tid 22212] [client 209.87.169.164:53925] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaLUiX6mbajs3bzQGyuRZwAAAVA"]
[Sat Feb 28 19:42:02.565306 2026] [:error] [pid 39185:tid 39246] [client 185.198.240.173:41825] [client 185.198.240.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaLUihVE-FfM89u7BQaMZAAAAIA"]
[Sat Feb 28 19:42:03.095873 2026] [:error] [pid 39183:tid 39206] [client 209.87.169.170:51739] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Sat Feb 28 19:42:05.120869 2026] [:error] [pid 39183:tid 39199] [client 209.87.169.170:51739] [client 209.87.169.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaLUjRCf4HvhVePw3LbcFwAAAAc"]
[Sat Feb 28 19:42:05.640648 2026] [:error] [pid 52460:tid 52485] [client 209.87.169.164:34829] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaLUjbLWOogAgHGh62Q7yQAAAZY"]
[Sat Feb 28 19:42:06.432737 2026] [:error] [pid 39184:tid 39234] [client 209.87.169.168:62337] [client 209.87.169.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaLUjltZF9Zd_U7easCORgAAAE8"]
[Sat Feb 28 19:42:06.923152 2026] [:error] [pid 11791:tid 11817] [client 185.198.240.176:43769] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sat Feb 28 19:42:07.469827 2026] [:error] [pid 11791:tid 11809] [client 185.198.240.176:43769] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaLUj2uX5e1Q32gqxH2rTgAAARA"]
[Sat Feb 28 19:42:08.008065 2026] [:error] [pid 49763:tid 49769] [client 209.87.169.165:25673] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Sat Feb 28 19:42:08.530654 2026] [:error] [pid 49763:tid 49777] [client 209.87.169.165:25673] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaLUkLTHSOG_yf2PpqHZ7AAAAcs"]
[Sat Feb 28 19:42:09.095070 2026] [:error] [pid 39292:tid 39294] [client 45.131.195.216:49593] [client 45.131.195.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaLUkaIAO5fN7BxyqcFbwwAAAMA"]
[Sat Feb 28 19:42:10.014386 2026] [:error] [pid 49763:tid 49774] [client 185.198.240.169:40999] [client 185.198.240.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaLUkrTHSOG_yf2PpqHZ8gAAAcg"]
[Sat Feb 28 19:42:10.542214 2026] [:error] [pid 52460:tid 52482] [client 185.198.240.171:29301] [client 185.198.240.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaLUkrLWOogAgHGh62Q71gAAAZM"]
[Sat Feb 28 19:42:11.571537 2026] [:error] [pid 52460:tid 52477] [client 185.198.240.177:37623] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaLUk7LWOogAgHGh62Q73wAAAY4"]
[Sat Feb 28 19:42:12.319653 2026] [:error] [pid 39183:tid 39201] [client 209.87.169.156:43105] [client 209.87.169.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaLUlBCf4HvhVePw3LbcKgAAAAk"]
[Sat Feb 28 19:42:12.846040 2026] [:error] [pid 49763:tid 49781] [client 185.198.240.177:49219] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaLUlLTHSOG_yf2PpqHaAQAAAc8"]
[Sat Feb 28 19:42:13.352608 2026] [:error] [pid 39292:tid 39302] [client 209.87.169.164:60529] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaLUlaIAO5fN7BxyqcFb0wAAAMg"]
[Sat Feb 28 19:42:14.652237 2026] [:error] [pid 11791:tid 11816] [client 209.87.169.158:64275] [client 209.87.169.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaLUlmuX5e1Q32gqxH2rXQAAARc"]
[Sat Feb 28 19:42:15.734962 2026] [:error] [pid 49763:tid 49776] [client 185.198.240.167:58381] [client 185.198.240.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaLUl7THSOG_yf2PpqHaGAAAAco"]
[Sat Feb 28 19:42:16.537366 2026] [:error] [pid 39183:tid 39209] [client 209.87.169.165:35965] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaLUmBCf4HvhVePw3LbcQAAAABE"]
[Sat Feb 28 19:42:17.300136 2026] [:error] [pid 39183:tid 39212] [client 185.198.240.173:43217] [client 185.198.240.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaLUmRCf4HvhVePw3LbcSAAAABQ"]
[Sat Feb 28 19:42:18.301219 2026] [:error] [pid 52460:tid 52470] [client 185.198.240.160:36231] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sat Feb 28 19:42:19.368953 2026] [:error] [pid 52460:tid 52478] [client 185.198.240.160:36231] [client 185.198.240.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaLUm7LWOogAgHGh62Q8AwAAAY8"]
[Sat Feb 28 19:42:19.889604 2026] [:error] [pid 39183:tid 39212] [client 209.87.169.166:52351] [client 209.87.169.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaLUmxCf4HvhVePw3LbcWwAAABQ"]
[Sat Feb 28 19:42:20.654146 2026] [:error] [pid 49763:tid 49790] [client 209.87.169.161:31351] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sat Feb 28 19:42:20.907871 2026] [:error] [pid 49763:tid 49766] [client 209.87.169.161:31351] [client 209.87.169.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaLUnLTHSOG_yf2PpqHaOgAAAcA"]
[Sat Feb 28 19:42:22.803140 2026] [:error] [pid 49763:tid 49779] [client 45.131.195.217:49993] [client 45.131.195.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaLUnrTHSOG_yf2PpqHaQQAAAc0"]
[Sat Feb 28 19:42:23.559637 2026] [:error] [pid 39183:tid 39194] [client 209.87.169.164:59553] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Sat Feb 28 19:42:23.823780 2026] [:error] [pid 39183:tid 39210] [client 209.87.169.164:59553] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaLUnxCf4HvhVePw3LbchAAAABI"]
[Sat Feb 28 19:42:25.896886 2026] [:error] [pid 39292:tid 39303] [client 209.87.169.172:52409] [client 209.87.169.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaLUoaIAO5fN7BxyqcFb7AAAAMk"]
[Sat Feb 28 19:42:26.410104 2026] [:error] [pid 49763:tid 49778] [client 209.87.169.158:34397] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Feb 28 19:42:26.653140 2026] [:error] [pid 49763:tid 49766] [client 209.87.169.158:34397] [client 209.87.169.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaLUorTHSOG_yf2PpqHaWgAAAcA"]
[Sat Feb 28 19:42:28.562577 2026] [:error] [pid 39185:tid 39248] [client 185.198.240.177:42223] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaLUpBVE-FfM89u7BQaMcgAAAII"]
[Sat Feb 28 19:42:29.899334 2026] [:error] [pid 39185:tid 39262] [client 185.198.240.179:59329] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sat Feb 28 19:42:30.192237 2026] [:error] [pid 39185:tid 39260] [client 185.198.240.179:59329] [client 185.198.240.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaLUphVE-FfM89u7BQaMeQAAAI4"]
[Sat Feb 28 19:42:31.770343 2026] [:error] [pid 22194:tid 22201] [client 185.198.240.172:51163] [client 185.198.240.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaLUp36mbajs3bzQGyuR6AAAAUU"]
[Sat Feb 28 19:42:32.286152 2026] [:error] [pid 49763:tid 49778] [client 185.198.240.180:38135] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sat Feb 28 19:42:32.523503 2026] [:error] [pid 49763:tid 49784] [client 185.198.240.180:38135] [client 185.198.240.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaLUqLTHSOG_yf2PpqHaZwAAAdI"]
[Sat Feb 28 19:42:33.095892 2026] [:error] [pid 39183:tid 39199] [client 173.239.214.179:39911] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaLUqRCf4HvhVePw3LbcsAAAAAc"]
[Sat Feb 28 19:42:33.626598 2026] [:error] [pid 39292:tid 39300] [client 173.239.214.181:20497] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sat Feb 28 19:42:34.120223 2026] [:error] [pid 39292:tid 39304] [client 173.239.214.181:20497] [client 173.239.214.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaLUqqIAO5fN7BxyqcFb9wAAAMo"]
[Sat Feb 28 19:42:34.602694 2026] [:error] [pid 39185:tid 39253] [client 209.87.169.169:48821] [client 209.87.169.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaLUqhVE-FfM89u7BQaMfwAAAIc"]
[Sat Feb 28 19:42:36.603624 2026] [:error] [pid 11791:tid 11808] [client 45.131.195.215:45621] [client 45.131.195.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaLUrGuX5e1Q32gqxH2regAAAQ8"]
[Sat Feb 28 19:42:37.101880 2026] [:error] [pid 39184:tid 39220] [client 185.198.240.176:34603] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaLUrVtZF9Zd_U7easCOqwAAAEE"]
[Sat Feb 28 19:42:37.896633 2026] [:error] [pid 49763:tid 49783] [client 173.239.214.179:36199] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aaLUrbTHSOG_yf2PpqHalAAAAdE"]
[Sat Feb 28 19:42:38.438531 2026] [:error] [pid 49763:tid 49779] [client 209.87.169.165:31801] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaLUrrTHSOG_yf2PpqHamwAAAc0"]
[Sat Feb 28 19:42:38.914326 2026] [:error] [pid 49763:tid 49778] [client 185.198.240.160:50653] [client 185.198.240.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaLUrrTHSOG_yf2PpqHaoAAAAcw"]
[Sat Feb 28 19:42:39.426600 2026] [:error] [pid 52460:tid 52469] [client 185.198.240.181:61053] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aaLUr7LWOogAgHGh62Q8FwAAAYY"]
[Sat Feb 28 19:42:42.017004 2026] [:error] [pid 39183:tid 39192] [client 185.198.240.176:27925] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaLUshCf4HvhVePw3Lbc2gAAAAA"]
[Sat Feb 28 19:42:42.487791 2026] [:error] [pid 49763:tid 49782] [client 209.87.169.170:41411] [client 209.87.169.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aaLUsrTHSOG_yf2PpqHatQAAAdA"]
[Sat Feb 28 19:42:43.207670 2026] [:error] [pid 39183:tid 39211] [client 185.198.240.176:52609] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Sat Feb 28 19:42:43.442720 2026] [:error] [pid 39183:tid 39205] [client 185.198.240.176:52609] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaLUsxCf4HvhVePw3Lbc4wAAAA0"]
[Sat Feb 28 19:42:43.961138 2026] [:error] [pid 39184:tid 39222] [client 209.87.169.159:27579] [client 209.87.169.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaLUs1tZF9Zd_U7easCOvwAAAEM"]
[Sat Feb 28 19:42:45.484708 2026] [:error] [pid 52460:tid 52482] [client 185.198.240.159:58291] [client 185.198.240.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aaLUtbLWOogAgHGh62Q8MgAAAZM"]
[Sat Feb 28 19:42:47.584969 2026] [:error] [pid 11791:tid 11816] [client 45.131.195.253:59361] [client 45.131.195.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaLUt2uX5e1Q32gqxH2rfQAAARc"]
[Sat Feb 28 19:42:52.436442 2026] [:error] [pid 11791:tid 11814] [client 185.198.240.167:33293] [client 185.198.240.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aaLUvGuX5e1Q32gqxH2rlgAAARU"]
[Sat Feb 28 19:42:53.463757 2026] [:error] [pid 39185:tid 39270] [client 185.198.240.176:39721] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaLUvRVE-FfM89u7BQaMlgAAAJg"]
[Sat Feb 28 19:42:55.821178 2026] [:error] [pid 49763:tid 49769] [client 185.198.240.177:46709] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aaLUv7THSOG_yf2PpqHbDQAAAcM"]
[Sat Feb 28 19:42:57.841856 2026] [:error] [pid 39183:tid 39203] [client 173.239.214.179:28417] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaLUwRCf4HvhVePw3LbdGgAAAAs"]
[Sat Feb 28 19:42:58.531168 2026] [:error] [pid 39292:tid 39294] [client 209.87.169.160:24673] [client 209.87.169.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aaLUwqIAO5fN7BxyqcFcHwAAAMA"]
[Sat Feb 28 19:42:59.059768 2026] [:error] [pid 49763:tid 49771] [client 185.198.240.177:21849] [client 185.198.240.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaLUw7THSOG_yf2PpqHbEgAAAcU"]
[Sat Feb 28 19:42:59.604478 2026] [:error] [pid 52460:tid 52468] [client 185.198.240.176:63287] [client 185.198.240.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaLUw7LWOogAgHGh62Q8fgAAAYU"]
[Sat Feb 28 19:43:00.937750 2026] [:error] [pid 11791:tid 11801] [client 185.198.240.172:28811] [client 185.198.240.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaLUxGuX5e1Q32gqxH2rpgAAAQg"]
[Sat Feb 28 19:43:01.424870 2026] [:error] [pid 52460:tid 52465] [client 45.131.195.216:60105] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Sat Feb 28 19:43:01.682152 2026] [:error] [pid 52460:tid 52485] [client 45.131.195.216:60105] [client 45.131.195.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaLUxbLWOogAgHGh62Q8oQAAAZY"]
[Sat Feb 28 19:43:03.172538 2026] [:error] [pid 11791:tid 11795] [client 209.87.169.156:55479] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Sat Feb 28 19:43:03.454253 2026] [:error] [pid 11791:tid 11814] [client 209.87.169.156:55479] [client 209.87.169.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaLUx2uX5e1Q32gqxH2rqwAAARU"]
[Sat Feb 28 19:43:03.967089 2026] [:error] [pid 39184:tid 39224] [client 209.87.169.169:48409] [client 209.87.169.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaLUx1tZF9Zd_U7easCO7gAAAEU"]
[Sat Feb 28 19:43:04.751229 2026] [:error] [pid 11791:tid 11796] [client 185.198.240.178:45925] [client 185.198.240.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaLUyGuX5e1Q32gqxH2rsAAAAQM"]
[Sat Feb 28 19:43:06.967648 2026] [:error] [pid 52460:tid 52475] [client 209.87.169.163:45599] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sat Feb 28 19:43:08.115301 2026] [:error] [pid 52460:tid 52479] [client 209.87.169.163:45599] [client 209.87.169.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aaLUzLLWOogAgHGh62Q80AAAAZA"]
[Sat Feb 28 19:43:08.988905 2026] [:error] [pid 39183:tid 39199] [client 173.239.214.179:55331] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaLUzBCf4HvhVePw3LbdZQAAAAc"]
[Sat Feb 28 19:43:10.051660 2026] [:error] [pid 39183:tid 39193] [client 209.87.169.165:58067] [client 209.87.169.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaLUzhCf4HvhVePw3LbddAAAAAE"]
[Sat Feb 28 19:43:10.651692 2026] [:error] [pid 39183:tid 39212] [client 209.87.169.164:50607] [client 209.87.169.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaLUzhCf4HvhVePw3LbdfgAAABQ"]
[Sat Feb 28 19:43:11.179496 2026] [:error] [pid 39292:tid 39304] [client 185.198.240.181:65383] [client 185.198.240.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaLUz6IAO5fN7BxyqcFcPAAAAMo"]
[Sat Feb 28 20:22:47.987460 2026] [:error] [pid 11791:tid 11812] [client 170.0.169.8:28842] [client 170.0.169.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.0.169.8, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaLeF2uX5e1Q32gqxH23BQAAARM"]
[Sat Feb 28 20:22:47.992833 2026] [:error] [pid 11791:tid 11812] [client 170.0.169.8:28842] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 21:01:34.964308 2026] [:error] [pid 52460:tid 52474] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Feb 28 21:01:35.173317 2026] [:error] [pid 52460:tid 52485] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 28 21:01:35.381795 2026] [:error] [pid 52460:tid 52464] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 28 21:01:35.595043 2026] [:error] [pid 52460:tid 52476] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 21:01:35.839090 2026] [:error] [pid 52460:tid 52468] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 21:01:36.052026 2026] [:error] [pid 52460:tid 52486] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Feb 28 21:01:36.474523 2026] [:error] [pid 52460:tid 52475] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Feb 28 21:01:36.684652 2026] [:error] [pid 52460:tid 52478] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Feb 28 21:01:36.903443 2026] [:error] [pid 52460:tid 52471] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Feb 28 21:01:37.113698 2026] [:error] [pid 52460:tid 52477] [client 40.85.218.222:30016] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Feb 28 21:01:37.319773 2026] [:error] [pid 52460:tid 52481] [client 40.85.218.222:30016] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaLnMbLWOogAgHGh62R6ogAAAZI"]
[Sat Feb 28 21:01:38.168696 2026] [:error] [pid 52460:tid 52480] [client 40.85.218.222:29770] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaLnMrLWOogAgHGh62R6pAAAAZE"]
[Sat Feb 28 21:01:39.002855 2026] [:error] [pid 49763:tid 49785] [client 40.85.218.222:30048] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaLnM7THSOG_yf2PpqFSRQAAAdM"]
[Sat Feb 28 21:01:39.831670 2026] [:error] [pid 39184:tid 39234] [client 40.85.218.222:29791] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaLnM1tZF9Zd_U7easC5fgAAAE8"]
[Sat Feb 28 22:26:01.204653 2026] [:error] [pid 52460:tid 52475] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Sat Feb 28 22:26:01.416363 2026] [:error] [pid 52460:tid 52473] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/swallowable.php
[Sat Feb 28 22:26:01.627415 2026] [:error] [pid 52460:tid 52464] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Sat Feb 28 22:26:01.839035 2026] [:error] [pid 52460:tid 52480] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/sty.php
[Sat Feb 28 22:26:02.052457 2026] [:error] [pid 52460:tid 52467] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sat Feb 28 22:26:02.264311 2026] [:error] [pid 52460:tid 52481] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Sat Feb 28 22:26:02.476287 2026] [:error] [pid 52460:tid 52484] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sat Feb 28 22:26:02.688170 2026] [:error] [pid 52460:tid 52466] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sat Feb 28 22:26:02.899918 2026] [:error] [pid 52460:tid 52487] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Sat Feb 28 22:26:03.111009 2026] [:error] [pid 52460:tid 52463] [client 20.220.196.236:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Sat Feb 28 22:26:03.319545 2026] [:error] [pid 52460:tid 52470] [client 20.220.196.236:46079] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaL6-7LWOogAgHGh62S64QAAAYc"]
[Sat Feb 28 22:26:03.739290 2026] [:error] [pid 39185:tid 39246] [client 20.220.196.236:46060] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaL6-xVE-FfM89u7BQaxcwAAAIA"]
[Sat Feb 28 22:26:04.157460 2026] [:error] [pid 11791:tid 11793] [client 20.220.196.236:46064] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaL6_GuX5e1Q32gqxH3YeAAAAQA"]
[Sat Feb 28 22:26:04.569802 2026] [:error] [pid 22194:tid 22196] [client 20.220.196.236:46018] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaL6_H6mbajs3bzQGyuzqAAAAUA"]
[Sat Feb 28 22:26:04.986765 2026] [:error] [pid 39292:tid 39301] [client 20.220.196.236:45958] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaL6_KIAO5fN7BxyqcGWOwAAAMc"]
[Sat Feb 28 22:26:05.396636 2026] [:error] [pid 39184:tid 39229] [client 20.220.196.236:46070] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaL6_VtZF9Zd_U7easDl5wAAAEo"]
[Sat Feb 28 22:26:05.815290 2026] [:error] [pid 22194:tid 22197] [client 20.220.196.236:46017] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaL6_X6mbajs3bzQGyuzrQAAAUE"]
[Sat Feb 28 22:26:06.233156 2026] [:error] [pid 11791:tid 11813] [client 20.220.196.236:45965] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aaL6_muX5e1Q32gqxH3YfAAAARQ"]
[Sat Feb 28 22:26:06.649484 2026] [:error] [pid 39183:tid 39195] [client 20.220.196.236:46020] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "aaL6_hCf4HvhVePw3LaJ4wAAAAM"]
[Sat Feb 28 22:26:07.064363 2026] [:error] [pid 39183:tid 39209] [client 20.220.196.236:45984] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "aaL6_xCf4HvhVePw3LaJ6AAAABE"]
[Sat Feb 28 22:26:07.475229 2026] [:error] [pid 52460:tid 52478] [client 20.220.196.236:46038] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "aaL6_7LWOogAgHGh62S66AAAAY8"]
[Sat Feb 28 22:26:07.893254 2026] [:error] [pid 49763:tid 49781] [client 20.220.196.236:46040] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "aaL6_7THSOG_yf2PpqHMIwAAAc8"]
[Sat Feb 28 22:26:08.306628 2026] [:error] [pid 52460:tid 52479] [client 20.220.196.236:46041] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7ALLWOogAgHGh62S66gAAAZA"]
[Sat Feb 28 22:26:08.718810 2026] [:error] [pid 39183:tid 39206] [client 20.220.196.236:46072] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7ABCf4HvhVePw3LaJ8QAAAA4"]
[Sat Feb 28 22:26:09.135603 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:46051] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7AbTHSOG_yf2PpqHMKAAAAcY"]
[Sat Feb 28 22:26:09.555704 2026] [:error] [pid 39183:tid 39199] [client 20.220.196.236:45969] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7ARCf4HvhVePw3LaJ-AAAAAc"]
[Sat Feb 28 22:26:09.971172 2026] [:error] [pid 52460:tid 52469] [client 20.220.196.236:45908] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7AbLWOogAgHGh62S67gAAAYY"]
[Sat Feb 28 22:26:10.381982 2026] [:error] [pid 52460:tid 52471] [client 20.220.196.236:45975] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7ArLWOogAgHGh62S68QAAAYg"]
[Sat Feb 28 22:26:10.797865 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:46032] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7AhCf4HvhVePw3LaJ_QAAAAU"]
[Sat Feb 28 22:26:11.211569 2026] [:error] [pid 39183:tid 39201] [client 20.220.196.236:45953] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7AxCf4HvhVePw3LaKAAAAAAk"]
[Sat Feb 28 22:26:11.620406 2026] [:error] [pid 39184:tid 39226] [client 20.220.196.236:45966] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "aaL7A1tZF9Zd_U7easDl9gAAAEc"]
[Sat Feb 28 22:26:12.031191 2026] [:error] [pid 39184:tid 39220] [client 20.220.196.236:45956] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "aaL7BFtZF9Zd_U7easDl-QAAAEE"]
[Sat Feb 28 22:26:12.444848 2026] [:error] [pid 22194:tid 22206] [client 20.220.196.236:46054] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "aaL7BH6mbajs3bzQGyuzsAAAAUo"]
[Sat Feb 28 22:26:12.855911 2026] [:error] [pid 39184:tid 39234] [client 20.220.196.236:46074] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "aaL7BFtZF9Zd_U7easDmAQAAAE8"]
[Sat Feb 28 22:26:13.267938 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:46026] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "aaL7BRCf4HvhVePw3LaKCgAAAAY"]
[Sat Feb 28 22:26:13.687433 2026] [:error] [pid 39183:tid 39201] [client 20.220.196.236:45973] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "aaL7BRCf4HvhVePw3LaKEAAAAAk"]
[Sat Feb 28 22:26:14.113330 2026] [:error] [pid 49763:tid 49787] [client 20.220.196.236:46045] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "aaL7BrTHSOG_yf2PpqHMLwAAAdU"]
[Sat Feb 28 22:26:14.533449 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45970] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "aaL7BrTHSOG_yf2PpqHMMAAAAcc"]
[Sat Feb 28 22:26:14.949440 2026] [:error] [pid 49763:tid 49767] [client 20.220.196.236:46019] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7BrTHSOG_yf2PpqHMMwAAAcE"]
[Sat Feb 28 22:26:15.369575 2026] [:error] [pid 49763:tid 49784] [client 20.220.196.236:46036] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7B7THSOG_yf2PpqHMNwAAAdI"]
[Sat Feb 28 22:26:15.791153 2026] [:error] [pid 39292:tid 39309] [client 20.220.196.236:46044] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7B6IAO5fN7BxyqcGWRAAAAM8"]
[Sat Feb 28 22:26:16.206201 2026] [:error] [pid 39183:tid 39213] [client 20.220.196.236:46042] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7CBCf4HvhVePw3LaKHwAAABU"]
[Sat Feb 28 22:26:16.618966 2026] [:error] [pid 49763:tid 49788] [client 20.220.196.236:46037] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "aaL7CLTHSOG_yf2PpqHMPwAAAdY"]
[Sat Feb 28 22:26:17.029982 2026] [:error] [pid 52460:tid 52483] [client 20.220.196.236:46069] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "aaL7CbLWOogAgHGh62S7BwAAAZQ"]
[Sat Feb 28 22:26:17.443929 2026] [:error] [pid 52460:tid 52472] [client 20.220.196.236:45982] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "aaL7CbLWOogAgHGh62S7CQAAAYk"]
[Sat Feb 28 22:26:17.856402 2026] [:error] [pid 49763:tid 49785] [client 20.220.196.236:45957] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "aaL7CbTHSOG_yf2PpqHMSAAAAdM"]
[Sat Feb 28 22:26:18.284084 2026] [:error] [pid 39183:tid 39200] [client 20.220.196.236:45994] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "aaL7ChCf4HvhVePw3LaKKQAAAAg"]
[Sat Feb 28 22:26:18.717748 2026] [:error] [pid 49763:tid 49775] [client 20.220.196.236:46057] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "aaL7CrTHSOG_yf2PpqHMTQAAAck"]
[Sat Feb 28 22:26:19.133977 2026] [:error] [pid 49763:tid 49788] [client 20.220.196.236:46039] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "aaL7C7THSOG_yf2PpqHMTwAAAdY"]
[Sat Feb 28 22:26:19.550149 2026] [:error] [pid 39185:tid 39266] [client 20.220.196.236:46067] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "aaL7CxVE-FfM89u7BQaxfgAAAJQ"]
[Sat Feb 28 22:26:19.964192 2026] [:error] [pid 52460:tid 52469] [client 20.220.196.236:45899] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "aaL7C7LWOogAgHGh62S7GAAAAYY"]
[Sat Feb 28 22:26:20.377123 2026] [:error] [pid 22194:tid 22209] [client 20.220.196.236:45991] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "aaL7DH6mbajs3bzQGyuzugAAAU0"]
[Sat Feb 28 22:26:20.795309 2026] [:error] [pid 49763:tid 49776] [client 20.220.196.236:46006] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "aaL7DLTHSOG_yf2PpqHMUQAAAco"]
[Sat Feb 28 22:26:21.222320 2026] [:error] [pid 39183:tid 39202] [client 20.220.196.236:45979] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "aaL7DRCf4HvhVePw3LaKLwAAAAo"]
[Sat Feb 28 22:26:21.631837 2026] [:error] [pid 39183:tid 39207] [client 20.220.196.236:46077] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "aaL7DRCf4HvhVePw3LaKMwAAAA8"]
[Sat Feb 28 22:26:22.057429 2026] [:error] [pid 52460:tid 52475] [client 20.220.196.236:45959] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "aaL7DrLWOogAgHGh62S7JwAAAYw"]
[Sat Feb 28 22:26:22.475220 2026] [:error] [pid 49763:tid 49770] [client 20.220.196.236:45962] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "aaL7DrTHSOG_yf2PpqHMVgAAAcQ"]
[Sat Feb 28 22:26:22.893466 2026] [:error] [pid 49763:tid 49771] [client 20.220.196.236:45912] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "aaL7DrTHSOG_yf2PpqHMVwAAAcU"]
[Sat Feb 28 22:26:23.312987 2026] [:error] [pid 49763:tid 49788] [client 20.220.196.236:45890] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aaL7D7THSOG_yf2PpqHMWwAAAdY"]
[Sat Feb 28 22:26:23.725652 2026] [:error] [pid 49763:tid 49789] [client 20.220.196.236:45960] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aaL7D7THSOG_yf2PpqHMYQAAAdc"]
[Sat Feb 28 22:26:24.140683 2026] [:error] [pid 49763:tid 49781] [client 20.220.196.236:46005] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aaL7ELTHSOG_yf2PpqHMZgAAAc8"]
[Sat Feb 28 22:26:24.553946 2026] [:error] [pid 39183:tid 39200] [client 20.220.196.236:46035] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "aaL7EBCf4HvhVePw3LaKRAAAAAg"]
[Sat Feb 28 22:26:24.966571 2026] [:error] [pid 39183:tid 39206] [client 20.220.196.236:46055] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aaL7EBCf4HvhVePw3LaKSAAAAA4"]
[Sat Feb 28 22:26:25.382344 2026] [:error] [pid 39183:tid 39215] [client 20.220.196.236:46056] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aaL7ERCf4HvhVePw3LaKTgAAABc"]
[Sat Feb 28 22:26:25.794342 2026] [:error] [pid 49763:tid 49785] [client 20.220.196.236:46030] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aaL7EbTHSOG_yf2PpqHMbQAAAdM"]
[Sat Feb 28 22:26:26.205523 2026] [:error] [pid 49763:tid 49784] [client 20.220.196.236:45986] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "aaL7ErTHSOG_yf2PpqHMcQAAAdI"]
[Sat Feb 28 22:26:26.616085 2026] [:error] [pid 49763:tid 49782] [client 20.220.196.236:45992] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "aaL7ErTHSOG_yf2PpqHMdQAAAdA"]
[Sat Feb 28 22:26:27.025709 2026] [:error] [pid 22194:tid 22218] [client 20.220.196.236:46053] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "aaL7E36mbajs3bzQGyuz0gAAAVY"]
[Sat Feb 28 22:26:27.444057 2026] [:error] [pid 39185:tid 39252] [client 20.220.196.236:46021] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "aaL7ExVE-FfM89u7BQaxggAAAIY"]
[Sat Feb 28 22:26:27.856916 2026] [:error] [pid 39184:tid 39243] [client 20.220.196.236:45963] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "aaL7E1tZF9Zd_U7easDmJAAAAFg"]
[Sat Feb 28 22:26:28.270141 2026] [:error] [pid 39184:tid 39237] [client 20.220.196.236:46028] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aaL7FFtZF9Zd_U7easDmJwAAAFI"]
[Sat Feb 28 22:26:28.699459 2026] [:error] [pid 49763:tid 49776] [client 20.220.196.236:45954] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aaL7FLTHSOG_yf2PpqHMgAAAAco"]
[Sat Feb 28 22:26:29.112738 2026] [:error] [pid 49763:tid 49770] [client 20.220.196.236:45955] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aaL7FbTHSOG_yf2PpqHMhgAAAcQ"]
[Sat Feb 28 22:26:29.521293 2026] [:error] [pid 39183:tid 39215] [client 20.220.196.236:45892] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "aaL7FRCf4HvhVePw3LaKVwAAABc"]
[Sat Feb 28 22:26:29.936065 2026] [:error] [pid 39184:tid 39233] [client 20.220.196.236:46052] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaL7FVtZF9Zd_U7easDmLAAAAE4"]
[Sat Feb 28 22:26:30.353774 2026] [:error] [pid 52460:tid 52483] [client 20.220.196.236:46050] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaL7FrLWOogAgHGh62S7OwAAAZQ"]
[Sat Feb 28 22:26:30.780091 2026] [:error] [pid 52460:tid 52465] [client 20.220.196.236:45922] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaL7FrLWOogAgHGh62S7PAAAAYI"]
[Sat Feb 28 22:26:31.195379 2026] [:error] [pid 49763:tid 49785] [client 20.220.196.236:46007] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaL7F7THSOG_yf2PpqHMlAAAAdM"]
[Sat Feb 28 22:26:31.612980 2026] [:error] [pid 49763:tid 49771] [client 20.220.196.236:45918] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7F7THSOG_yf2PpqHMmAAAAcU"]
[Sat Feb 28 22:26:32.028444 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:46058] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7GLTHSOG_yf2PpqHMnwAAAdQ"]
[Sat Feb 28 22:26:32.448960 2026] [:error] [pid 39184:tid 39222] [client 20.220.196.236:46075] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7GFtZF9Zd_U7easDmLwAAAEM"]
[Sat Feb 28 22:26:32.865454 2026] [:error] [pid 39184:tid 39230] [client 20.220.196.236:46024] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7GFtZF9Zd_U7easDmMgAAAEs"]
[Sat Feb 28 22:26:33.287210 2026] [:error] [pid 39185:tid 39267] [client 20.220.196.236:45961] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aaL7GRVE-FfM89u7BQaxhQAAAJU"]
[Sat Feb 28 22:26:33.695325 2026] [:error] [pid 39184:tid 39220] [client 20.220.196.236:46059] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aaL7GVtZF9Zd_U7easDmNwAAAEE"]
[Sat Feb 28 22:26:34.112996 2026] [:error] [pid 39183:tid 39200] [client 20.220.196.236:46033] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aaL7GhCf4HvhVePw3LaKWQAAAAg"]
[Sat Feb 28 22:26:34.523796 2026] [:error] [pid 49763:tid 49778] [client 20.220.196.236:45985] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aaL7GrTHSOG_yf2PpqHMsQAAAcw"]
[Sat Feb 28 22:26:34.938213 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:46048] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaL7GrTHSOG_yf2PpqHMswAAAcc"]
[Sat Feb 28 22:26:35.355758 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:46015] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaL7G7THSOG_yf2PpqHMugAAAdQ"]
[Sat Feb 28 22:26:35.775506 2026] [:error] [pid 49763:tid 49768] [client 20.220.196.236:45897] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaL7G7THSOG_yf2PpqHMvQAAAcI"]
[Sat Feb 28 22:26:36.191807 2026] [:error] [pid 49763:tid 49778] [client 20.220.196.236:46047] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaL7HLTHSOG_yf2PpqHMwAAAAcw"]
[Sat Feb 28 22:26:36.602374 2026] [:error] [pid 52460:tid 52468] [client 20.220.196.236:45894] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaL7HLLWOogAgHGh62S7SAAAAYU"]
[Sat Feb 28 22:26:37.016158 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:46003] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaL7HbTHSOG_yf2PpqHMxwAAAc4"]
[Sat Feb 28 22:26:37.438861 2026] [:error] [pid 49763:tid 49766] [client 20.220.196.236:45895] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaL7HbTHSOG_yf2PpqHMyQAAAcA"]
[Sat Feb 28 22:26:37.858151 2026] [:error] [pid 52460:tid 52482] [client 20.220.196.236:46014] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "aaL7HbLWOogAgHGh62S7UQAAAZM"]
[Sat Feb 28 22:26:38.279700 2026] [:error] [pid 52460:tid 52476] [client 20.220.196.236:46011] [client 20.220.196.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaL7HrLWOogAgHGh62S7UwAAAY0"]
[Sat Feb 28 22:26:38.701566 2026] [:error] [pid 52460:tid 52473] [client 20.220.196.236:45839] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aaL7HrLWOogAgHGh62S7VwAAAYo"]
[Sat Feb 28 22:26:39.116699 2026] [:error] [pid 49763:tid 49767] [client 20.220.196.236:46061] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aaL7H7THSOG_yf2PpqHM0wAAAcE"]
[Sat Feb 28 22:26:39.534350 2026] [:error] [pid 11791:tid 11798] [client 20.220.196.236:46029] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aaL7H2uX5e1Q32gqxH3YhQAAAQU"]
[Sat Feb 28 22:26:39.948272 2026] [:error] [pid 11791:tid 11794] [client 20.220.196.236:46059] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaL7H2uX5e1Q32gqxH3YhgAAAQE"]
[Sat Feb 28 22:26:40.367925 2026] [:error] [pid 39183:tid 39201] [client 20.220.196.236:45888] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaL7IBCf4HvhVePw3LaKXwAAAAk"]
[Sat Feb 28 22:26:40.786799 2026] [:error] [pid 39183:tid 39195] [client 20.220.196.236:45987] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaL7IBCf4HvhVePw3LaKYQAAAAM"]
[Sat Feb 28 22:26:41.206740 2026] [:error] [pid 39185:tid 39264] [client 20.220.196.236:45980] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaL7IRVE-FfM89u7BQaxiwAAAJI"]
[Sat Feb 28 22:26:41.630831 2026] [:error] [pid 49763:tid 49787] [client 20.220.196.236:45967] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaL7IbTHSOG_yf2PpqHM2AAAAdU"]
[Sat Feb 28 22:26:42.057067 2026] [:error] [pid 39184:tid 39240] [client 20.220.196.236:46009] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaL7IltZF9Zd_U7easDmRQAAAFU"]
[Sat Feb 28 22:26:42.477018 2026] [:error] [pid 39183:tid 39200] [client 20.220.196.236:45978] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaL7IhCf4HvhVePw3LaKagAAAAg"]
[Sat Feb 28 22:26:42.903444 2026] [:error] [pid 49763:tid 49782] [client 20.220.196.236:46063] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "aaL7IrTHSOG_yf2PpqHM2wAAAdA"]
[Sat Feb 28 22:26:43.324933 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:46027] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7IxCf4HvhVePw3LaKbwAAAAU"]
[Sat Feb 28 22:26:43.738926 2026] [:error] [pid 39183:tid 39208] [client 20.220.196.236:45977] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7IxCf4HvhVePw3LaKdAAAABA"]
[Sat Feb 28 22:26:44.158340 2026] [:error] [pid 39184:tid 39234] [client 20.220.196.236:45999] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7JFtZF9Zd_U7easDmSgAAAE8"]
[Sat Feb 28 22:26:44.584277 2026] [:error] [pid 39183:tid 39204] [client 20.220.196.236:45915] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7JBCf4HvhVePw3LaKeQAAAAw"]
[Sat Feb 28 22:26:45.003413 2026] [:error] [pid 39183:tid 39214] [client 20.220.196.236:45942] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaL7JRCf4HvhVePw3LaKgAAAABY"]
[Sat Feb 28 22:26:45.422859 2026] [:error] [pid 39183:tid 39208] [client 20.220.196.236:45859] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaL7JRCf4HvhVePw3LaKgwAAABA"]
[Sat Feb 28 22:26:45.836950 2026] [:error] [pid 39185:tid 39262] [client 20.220.196.236:45824] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaL7JRVE-FfM89u7BQaxjgAAAJA"]
[Sat Feb 28 22:26:46.260723 2026] [:error] [pid 39292:tid 39301] [client 20.220.196.236:45971] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaL7JqIAO5fN7BxyqcGWWAAAAMc"]
[Sat Feb 28 22:26:46.680922 2026] [:error] [pid 11791:tid 11813] [client 20.220.196.236:45826] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aaL7JmuX5e1Q32gqxH3YigAAARQ"]
[Sat Feb 28 22:26:47.097506 2026] [:error] [pid 39183:tid 39204] [client 20.220.196.236:45935] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aaL7JxCf4HvhVePw3LaKigAAAAw"]
[Sat Feb 28 22:26:47.518063 2026] [:error] [pid 39183:tid 39214] [client 20.220.196.236:45989] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aaL7JxCf4HvhVePw3LaKkAAAABY"]
[Sat Feb 28 22:26:47.929963 2026] [:error] [pid 39185:tid 39255] [client 20.220.196.236:45921] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "aaL7JxVE-FfM89u7BQaxkAAAAIk"]
[Sat Feb 28 22:26:48.354119 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45933] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaL7KLTHSOG_yf2PpqHM4AAAAc0"]
[Sat Feb 28 22:26:48.771982 2026] [:error] [pid 22194:tid 22218] [client 20.220.196.236:45990] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaL7KH6mbajs3bzQGyuz9gAAAVY"]
[Sat Feb 28 22:26:49.184127 2026] [:error] [pid 39292:tid 39296] [client 20.220.196.236:45974] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaL7KaIAO5fN7BxyqcGWXwAAAMI"]
[Sat Feb 28 22:26:49.595097 2026] [:error] [pid 39184:tid 39231] [client 20.220.196.236:45829] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aaL7KVtZF9Zd_U7easDmUAAAAEw"]
[Sat Feb 28 22:26:50.010641 2026] [:error] [pid 39292:tid 39294] [client 20.220.196.236:45943] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaL7KqIAO5fN7BxyqcGWYAAAAMA"]
[Sat Feb 28 22:26:50.431335 2026] [:error] [pid 39185:tid 39270] [client 20.220.196.236:45964] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaL7KhVE-FfM89u7BQaxlQAAAJg"]
[Sat Feb 28 22:26:50.850601 2026] [:error] [pid 39184:tid 39222] [client 20.220.196.236:45902] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaL7KltZF9Zd_U7easDmVAAAAEM"]
[Sat Feb 28 22:26:51.263738 2026] [:error] [pid 39184:tid 39230] [client 20.220.196.236:46068] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "aaL7K1tZF9Zd_U7easDmWAAAAEs"]
[Sat Feb 28 22:26:51.674278 2026] [:error] [pid 39185:tid 39250] [client 20.220.196.236:46013] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaL7KxVE-FfM89u7BQaxlgAAAIQ"]
[Sat Feb 28 22:26:52.087917 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45988] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaL7LLTHSOG_yf2PpqHM5AAAAdQ"]
[Sat Feb 28 22:26:52.497438 2026] [:error] [pid 49763:tid 49778] [client 20.220.196.236:45909] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaL7LLTHSOG_yf2PpqHM5wAAAcw"]
[Sat Feb 28 22:26:52.910008 2026] [:error] [pid 52460:tid 52482] [client 20.220.196.236:45947] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaL7LLLWOogAgHGh62S7eQAAAZM"]
[Sat Feb 28 22:26:53.329357 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45937] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaL7LbTHSOG_yf2PpqHM7QAAAcs"]
[Sat Feb 28 22:26:53.748973 2026] [:error] [pid 11791:tid 11795] [client 20.220.196.236:45972] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaL7LWuX5e1Q32gqxH3YkwAAAQI"]
[Sat Feb 28 22:26:54.186570 2026] [:error] [pid 39184:tid 39234] [client 20.220.196.236:45834] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaL7LltZF9Zd_U7easDmXgAAAE8"]
[Sat Feb 28 22:26:54.597540 2026] [:error] [pid 11791:tid 11815] [client 20.220.196.236:45924] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "aaL7LmuX5e1Q32gqxH3YnQAAARY"]
[Sat Feb 28 22:26:55.009339 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:46043] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaL7L7THSOG_yf2PpqHM8wAAAdQ"]
[Sat Feb 28 22:26:55.435980 2026] [:error] [pid 39292:tid 39306] [client 20.220.196.236:45852] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaL7L6IAO5fN7BxyqcGWZwAAAMw"]
[Sat Feb 28 22:26:55.850481 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:46012] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaL7L7THSOG_yf2PpqHNCgAAAcc"]
[Sat Feb 28 22:26:56.264115 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45968] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaL7MLTHSOG_yf2PpqHNDgAAAc0"]
[Sat Feb 28 22:26:56.689944 2026] [:error] [pid 39184:tid 39236] [client 20.220.196.236:45932] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaL7MFtZF9Zd_U7easDmZAAAAFE"]
[Sat Feb 28 22:26:57.107044 2026] [:error] [pid 39184:tid 39227] [client 20.220.196.236:46034] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaL7MVtZF9Zd_U7easDmZQAAAEg"]
[Sat Feb 28 22:26:57.521330 2026] [:error] [pid 39292:tid 39318] [client 20.220.196.236:45941] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaL7MaIAO5fN7BxyqcGWcQAAANg"]
[Sat Feb 28 22:26:57.935833 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45889] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "aaL7MbTHSOG_yf2PpqHNFgAAAc0"]
[Sat Feb 28 22:26:58.357760 2026] [:error] [pid 52460:tid 52465] [client 20.220.196.236:46002] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7MrLWOogAgHGh62S7iQAAAYI"]
[Sat Feb 28 22:26:58.781181 2026] [:error] [pid 52460:tid 52473] [client 20.220.196.236:46065] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7MrLWOogAgHGh62S7jQAAAYo"]
[Sat Feb 28 22:26:59.198061 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45911] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7M7THSOG_yf2PpqHNIQAAAc0"]
[Sat Feb 28 22:26:59.623246 2026] [:error] [pid 39185:tid 39251] [client 20.220.196.236:46078] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaL7MxVE-FfM89u7BQaxmwAAAIU"]
[Sat Feb 28 22:27:00.044519 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45906] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7NLTHSOG_yf2PpqHNJgAAAc0"]
[Sat Feb 28 22:27:00.464763 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:45838] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7NBCf4HvhVePw3LaKoQAAAAY"]
[Sat Feb 28 22:27:00.888227 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:46023] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7NLTHSOG_yf2PpqHNMQAAAdQ"]
[Sat Feb 28 22:27:01.301444 2026] [:error] [pid 49763:tid 49767] [client 20.220.196.236:45848] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7NbTHSOG_yf2PpqHNOQAAAcE"]
[Sat Feb 28 22:27:01.719439 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45927] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaL7NbTHSOG_yf2PpqHNQgAAAcc"]
[Sat Feb 28 22:27:02.131180 2026] [:error] [pid 49763:tid 49770] [client 20.220.196.236:45767] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaL7NrTHSOG_yf2PpqHNSQAAAcQ"]
[Sat Feb 28 22:27:02.551828 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45831] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaL7NrTHSOG_yf2PpqHNTQAAAdQ"]
[Sat Feb 28 22:27:02.971865 2026] [:error] [pid 39183:tid 39209] [client 20.220.196.236:45901] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaL7NhCf4HvhVePw3LaKpQAAABE"]
[Sat Feb 28 22:27:03.397078 2026] [:error] [pid 52460:tid 52473] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sat Feb 28 22:27:03.609402 2026] [:error] [pid 52460:tid 52468] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Sat Feb 28 22:27:03.822764 2026] [:error] [pid 52460:tid 52481] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 28 22:27:04.039655 2026] [:error] [pid 52460:tid 52469] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sat Feb 28 22:27:04.254053 2026] [:error] [pid 52460:tid 52475] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sat Feb 28 22:27:04.468905 2026] [:error] [pid 52460:tid 52467] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sat Feb 28 22:27:04.683989 2026] [:error] [pid 52460:tid 52476] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Sat Feb 28 22:27:05.113513 2026] [:error] [pid 52460:tid 52486] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sat Feb 28 22:27:05.327527 2026] [:error] [pid 52460:tid 52482] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Sat Feb 28 22:27:05.541246 2026] [:error] [pid 52460:tid 52470] [client 20.220.196.236:45952] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Sat Feb 28 22:27:05.751622 2026] [:error] [pid 52460:tid 52468] [client 20.220.196.236:45952] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaL7ObLWOogAgHGh62S7qgAAAYU"]
[Sat Feb 28 22:27:06.168210 2026] [:error] [pid 52460:tid 52481] [client 20.220.196.236:45904] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaL7OrLWOogAgHGh62S7qwAAAZI"]
[Sat Feb 28 22:27:06.581672 2026] [:error] [pid 52460:tid 52469] [client 20.220.196.236:45791] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaL7OrLWOogAgHGh62S7rgAAAYY"]
[Sat Feb 28 22:27:07.005714 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:46073] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "aaL7O7THSOG_yf2PpqHNXAAAAcY"]
[Sat Feb 28 22:27:07.419540 2026] [:error] [pid 52460:tid 52467] [client 20.220.196.236:45944] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaL7O7LWOogAgHGh62S7swAAAYQ"]
[Sat Feb 28 22:27:07.837920 2026] [:error] [pid 39183:tid 39206] [client 20.220.196.236:46001] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaL7OxCf4HvhVePw3LaKswAAAA4"]
[Sat Feb 28 22:27:08.257345 2026] [:error] [pid 39184:tid 39220] [client 20.220.196.236:45847] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaL7PFtZF9Zd_U7easDmegAAAEE"]
[Sat Feb 28 22:27:08.680627 2026] [:error] [pid 49763:tid 49766] [client 20.220.196.236:45898] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaL7PLTHSOG_yf2PpqHNYwAAAcA"]
[Sat Feb 28 22:27:09.100115 2026] [:error] [pid 49763:tid 49778] [client 20.220.196.236:45900] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaL7PbTHSOG_yf2PpqHNZgAAAcw"]
[Sat Feb 28 22:27:09.523449 2026] [:error] [pid 39183:tid 39214] [client 20.220.196.236:45833] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaL7PRCf4HvhVePw3LaKuwAAABY"]
[Sat Feb 28 22:27:09.941464 2026] [:error] [pid 39292:tid 39304] [client 20.220.196.236:45950] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaL7PaIAO5fN7BxyqcGWhwAAAMo"]
[Sat Feb 28 22:27:10.358138 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:45976] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaL7PhCf4HvhVePw3LaKvQAAAAU"]
[Sat Feb 28 22:27:10.779771 2026] [:error] [pid 49763:tid 49766] [client 20.220.196.236:45916] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaL7PrTHSOG_yf2PpqHNbwAAAcA"]
[Sat Feb 28 22:27:11.205932 2026] [:error] [pid 39183:tid 39208] [client 20.220.196.236:45858] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaL7PxCf4HvhVePw3LaKxgAAABA"]
[Sat Feb 28 22:27:11.635877 2026] [:error] [pid 39183:tid 39194] [client 20.220.196.236:45796] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaL7PxCf4HvhVePw3LaKyQAAAAI"]
[Sat Feb 28 22:27:12.048834 2026] [:error] [pid 39184:tid 39240] [client 20.220.196.236:45878] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaL7QFtZF9Zd_U7easDmfQAAAFU"]
[Sat Feb 28 22:27:12.464329 2026] [:error] [pid 11791:tid 11802] [client 20.220.196.236:46016] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaL7QGuX5e1Q32gqxH3YuQAAAQk"]
[Sat Feb 28 22:27:12.910474 2026] [:error] [pid 39185:tid 39254] [client 20.220.196.236:45920] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaL7QBVE-FfM89u7BQaxowAAAIg"]
[Sat Feb 28 22:27:13.322757 2026] [:error] [pid 39292:tid 39299] [client 20.220.196.236:45948] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaL7QaIAO5fN7BxyqcGWlAAAAMU"]
[Sat Feb 28 22:27:13.737044 2026] [:error] [pid 39292:tid 39314] [client 20.220.196.236:46022] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "aaL7QaIAO5fN7BxyqcGWmAAAANQ"]
[Sat Feb 28 22:27:14.149817 2026] [:error] [pid 52460:tid 52464] [client 20.220.196.236:45836] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaL7QrLWOogAgHGh62S7xAAAAYE"]
[Sat Feb 28 22:27:14.563300 2026] [:error] [pid 39183:tid 39213] [client 20.220.196.236:46046] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaL7QhCf4HvhVePw3LaKzAAAABU"]
[Sat Feb 28 22:27:14.973863 2026] [:error] [pid 49763:tid 49767] [client 20.220.196.236:45910] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaL7QrTHSOG_yf2PpqHNeQAAAcE"]
[Sat Feb 28 22:27:15.382623 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45830] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "aaL7Q7THSOG_yf2PpqHNewAAAcs"]
[Sat Feb 28 22:27:15.794727 2026] [:error] [pid 49763:tid 49770] [client 20.220.196.236:45887] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaL7Q7THSOG_yf2PpqHNfgAAAcQ"]
[Sat Feb 28 22:27:16.211078 2026] [:error] [pid 49763:tid 49766] [client 20.220.196.236:45891] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaL7RLTHSOG_yf2PpqHNgAAAAcA"]
[Sat Feb 28 22:27:16.624161 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:46031] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaL7RLTHSOG_yf2PpqHNhgAAAc4"]
[Sat Feb 28 22:27:17.038919 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45939] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaL7RbTHSOG_yf2PpqHNiwAAAcs"]
[Sat Feb 28 22:27:17.467059 2026] [:error] [pid 39185:tid 39267] [client 20.220.196.236:46004] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7RRVE-FfM89u7BQaxqAAAAJU"]
[Sat Feb 28 22:27:17.880776 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45765] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7RbTHSOG_yf2PpqHNkwAAAc0"]
[Sat Feb 28 22:27:18.291575 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45801] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7RrTHSOG_yf2PpqHNmAAAAc4"]
[Sat Feb 28 22:27:18.702875 2026] [:error] [pid 39183:tid 39212] [client 20.220.196.236:45946] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaL7RhCf4HvhVePw3LaK0AAAABQ"]
[Sat Feb 28 22:27:19.121480 2026] [:error] [pid 39183:tid 39211] [client 20.220.196.236:46066] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aaL7RxCf4HvhVePw3LaK0gAAABM"]
[Sat Feb 28 22:27:19.537200 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:45853] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aaL7RxCf4HvhVePw3LaK1AAAAAY"]
[Sat Feb 28 22:27:19.950655 2026] [:error] [pid 39183:tid 39203] [client 20.220.196.236:45797] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aaL7RxCf4HvhVePw3LaK1gAAAAs"]
[Sat Feb 28 22:27:20.362596 2026] [:error] [pid 52460:tid 52470] [client 20.220.196.236:45786] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "aaL7SLLWOogAgHGh62S7zgAAAYc"]
[Sat Feb 28 22:27:20.776559 2026] [:error] [pid 39183:tid 39215] [client 20.220.196.236:46062] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaL7SBCf4HvhVePw3LaK3AAAABc"]
[Sat Feb 28 22:27:21.196713 2026] [:error] [pid 39183:tid 39201] [client 20.220.196.236:45917] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaL7SRCf4HvhVePw3LaK3wAAAAk"]
[Sat Feb 28 22:27:21.619879 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:45851] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaL7SRCf4HvhVePw3LaK4wAAAAU"]
[Sat Feb 28 22:27:22.029548 2026] [:error] [pid 39183:tid 39196] [client 20.220.196.236:45825] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaL7ShCf4HvhVePw3LaK6AAAAAQ"]
[Sat Feb 28 22:27:22.444855 2026] [:error] [pid 39183:tid 39216] [client 20.220.196.236:45841] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaL7ShCf4HvhVePw3LaK8AAAABg"]
[Sat Feb 28 22:27:22.862492 2026] [:error] [pid 39183:tid 39206] [client 20.220.196.236:45949] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaL7ShCf4HvhVePw3LaK9wAAAA4"]
[Sat Feb 28 22:27:23.282539 2026] [:error] [pid 39183:tid 39208] [client 20.220.196.236:45936] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaL7SxCf4HvhVePw3LaK-gAAABA"]
[Sat Feb 28 22:27:23.701275 2026] [:error] [pid 49763:tid 49783] [client 20.220.196.236:45856] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x/"] [unique_id "aaL7S7THSOG_yf2PpqHNowAAAdE"]
[Sat Feb 28 22:27:24.136895 2026] [:error] [pid 52460:tid 52464] [client 20.220.196.236:45896] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaL7TLLWOogAgHGh62S70AAAAYE"]
[Sat Feb 28 22:27:24.546160 2026] [:error] [pid 39184:tid 39235] [client 20.220.196.236:45828] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaL7TFtZF9Zd_U7easDmlQAAAFA"]
[Sat Feb 28 22:27:24.958469 2026] [:error] [pid 11791:tid 11794] [client 20.220.196.236:45983] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaL7TGuX5e1Q32gqxH3YvwAAAQE"]
[Sat Feb 28 22:27:25.367547 2026] [:error] [pid 22194:tid 22202] [client 20.220.196.236:45930] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "aaL7TX6mbajs3bzQGyu0HQAAAUY"]
[Sat Feb 28 22:27:25.790478 2026] [:error] [pid 39184:tid 39237] [client 20.220.196.236:45951] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aaL7TVtZF9Zd_U7easDmoAAAAFI"]
[Sat Feb 28 22:27:26.208658 2026] [:error] [pid 49763:tid 49768] [client 20.220.196.236:45827] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aaL7TrTHSOG_yf2PpqHNqwAAAcI"]
[Sat Feb 28 22:27:26.626295 2026] [:error] [pid 49763:tid 49778] [client 20.220.196.236:45893] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aaL7TrTHSOG_yf2PpqHNsgAAAcw"]
[Sat Feb 28 22:27:27.041403 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45779] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aaL7T7THSOG_yf2PpqHNtwAAAc4"]
[Sat Feb 28 22:27:27.459121 2026] [:error] [pid 49763:tid 49775] [client 20.220.196.236:45923] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aaL7T7THSOG_yf2PpqHNuwAAAck"]
[Sat Feb 28 22:27:27.876713 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45766] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aaL7T7THSOG_yf2PpqHNwgAAAcs"]
[Sat Feb 28 22:27:28.298455 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:45843] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aaL7ULTHSOG_yf2PpqHNxwAAAcY"]
[Sat Feb 28 22:27:28.712483 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:46049] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aaL7ULTHSOG_yf2PpqHNygAAAcc"]
[Sat Feb 28 22:27:29.131893 2026] [:error] [pid 49763:tid 49766] [client 20.220.196.236:45884] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaL7UbTHSOG_yf2PpqHNzwAAAcA"]
[Sat Feb 28 22:27:29.545994 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45835] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaL7UbTHSOG_yf2PpqHN0wAAAcs"]
[Sat Feb 28 22:27:29.954031 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:45845] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaL7UbTHSOG_yf2PpqHN1QAAAcY"]
[Sat Feb 28 22:27:30.371852 2026] [:error] [pid 49763:tid 49775] [client 20.220.196.236:45866] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "aaL7UrTHSOG_yf2PpqHN3AAAAck"]
[Sat Feb 28 22:27:30.787273 2026] [:error] [pid 49763:tid 49768] [client 20.220.196.236:45995] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7UrTHSOG_yf2PpqHN4QAAAcI"]
[Sat Feb 28 22:27:31.197628 2026] [:error] [pid 39184:tid 39228] [client 20.220.196.236:45996] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7U1tZF9Zd_U7easDmqQAAAEk"]
[Sat Feb 28 22:27:31.613551 2026] [:error] [pid 39184:tid 39238] [client 20.220.196.236:45867] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7U1tZF9Zd_U7easDmrAAAAFM"]
[Sat Feb 28 22:27:32.023210 2026] [:error] [pid 39184:tid 39227] [client 20.220.196.236:45806] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "aaL7VFtZF9Zd_U7easDmrwAAAEg"]
[Sat Feb 28 22:27:32.439710 2026] [:error] [pid 39292:tid 39312] [client 20.220.196.236:45844] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7VKIAO5fN7BxyqcGWqgAAANI"]
[Sat Feb 28 22:27:32.863144 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:45704] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7VBCf4HvhVePw3LaLDgAAAAY"]
[Sat Feb 28 22:27:33.281619 2026] [:error] [pid 11791:tid 11809] [client 20.220.196.236:45846] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7VWuX5e1Q32gqxH3YygAAARA"]
[Sat Feb 28 22:27:33.694523 2026] [:error] [pid 52460:tid 52487] [client 20.220.196.236:45925] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaL7VbLWOogAgHGh62S72gAAAZg"]
[Sat Feb 28 22:27:34.107080 2026] [:error] [pid 52460:tid 52482] [client 20.220.196.236:45997] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7VrLWOogAgHGh62S72wAAAZM"]
[Sat Feb 28 22:27:34.518337 2026] [:error] [pid 52460:tid 52470] [client 20.220.196.236:45855] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7VrLWOogAgHGh62S73QAAAYc"]
[Sat Feb 28 22:27:34.930102 2026] [:error] [pid 39183:tid 39212] [client 20.220.196.236:45860] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7VhCf4HvhVePw3LaLFAAAABQ"]
[Sat Feb 28 22:27:35.341565 2026] [:error] [pid 39292:tid 39315] [client 20.220.196.236:45864] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7V6IAO5fN7BxyqcGWsgAAANU"]
[Sat Feb 28 22:27:35.753878 2026] [:error] [pid 39183:tid 39213] [client 20.220.196.236:45905] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaL7VxCf4HvhVePw3LaLFwAAABU"]
[Sat Feb 28 22:27:36.163830 2026] [:error] [pid 39292:tid 39307] [client 20.220.196.236:45861] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaL7WKIAO5fN7BxyqcGWtAAAAM0"]
[Sat Feb 28 22:27:36.578905 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45784] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaL7WLTHSOG_yf2PpqHN8QAAAc4"]
[Sat Feb 28 22:27:36.994990 2026] [:error] [pid 52460:tid 52485] [client 20.220.196.236:46071] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaL7WLLWOogAgHGh62S75QAAAZY"]
[Sat Feb 28 22:27:37.409749 2026] [:error] [pid 52460:tid 52480] [client 20.220.196.236:45837] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaL7WbLWOogAgHGh62S76AAAAZE"]
[Sat Feb 28 22:27:37.830405 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45777] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaL7WbTHSOG_yf2PpqHN9QAAAc0"]
[Sat Feb 28 22:27:38.239867 2026] [:error] [pid 39183:tid 39193] [client 20.220.196.236:45931] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaL7WhCf4HvhVePw3LaLGwAAAAE"]
[Sat Feb 28 22:27:38.657809 2026] [:error] [pid 39183:tid 39208] [client 20.220.196.236:45805] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaL7WhCf4HvhVePw3LaLHgAAABA"]
[Sat Feb 28 22:27:39.071974 2026] [:error] [pid 49763:tid 49775] [client 20.220.196.236:45934] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7W7THSOG_yf2PpqHN-wAAAck"]
[Sat Feb 28 22:27:39.484724 2026] [:error] [pid 49763:tid 49766] [client 20.220.196.236:45798] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7W7THSOG_yf2PpqHN_wAAAcA"]
[Sat Feb 28 22:27:39.897011 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45875] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7W7THSOG_yf2PpqHOAwAAAc4"]
[Sat Feb 28 22:27:40.331265 2026] [:error] [pid 49763:tid 49784] [client 20.220.196.236:45903] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "aaL7XLTHSOG_yf2PpqHOBwAAAdI"]
[Sat Feb 28 22:27:40.755126 2026] [:error] [pid 52460:tid 52481] [client 20.220.196.236:45821] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaL7XLLWOogAgHGh62S79QAAAZI"]
[Sat Feb 28 22:27:41.178942 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45885] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaL7XbTHSOG_yf2PpqHODwAAAc4"]
[Sat Feb 28 22:27:41.606771 2026] [:error] [pid 39184:tid 39225] [client 20.220.196.236:45811] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaL7XVtZF9Zd_U7easDmtwAAAEY"]
[Sat Feb 28 22:27:42.022664 2026] [:error] [pid 22194:tid 22213] [client 20.220.196.236:45755] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaL7Xn6mbajs3bzQGyu0IwAAAVE"]
[Sat Feb 28 22:27:42.444124 2026] [:error] [pid 39184:tid 39230] [client 20.220.196.236:45763] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaL7XltZF9Zd_U7easDmuQAAAEs"]
[Sat Feb 28 22:27:42.856994 2026] [:error] [pid 49763:tid 49788] [client 20.220.196.236:46025] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaL7XrTHSOG_yf2PpqHOGAAAAdY"]
[Sat Feb 28 22:27:43.284353 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45998] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaL7X7THSOG_yf2PpqHOIAAAAc4"]
[Sat Feb 28 22:27:43.713410 2026] [:error] [pid 49763:tid 49782] [client 20.220.196.236:45872] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "aaL7X7THSOG_yf2PpqHOIQAAAdA"]
[Sat Feb 28 22:27:44.124494 2026] [:error] [pid 52460:tid 52483] [client 20.220.196.236:45849] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaL7YLLWOogAgHGh62S8AQAAAZQ"]
[Sat Feb 28 22:27:44.537008 2026] [:error] [pid 11791:tid 11795] [client 20.220.196.236:45938] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaL7YGuX5e1Q32gqxH3Y0wAAAQI"]
[Sat Feb 28 22:27:44.958274 2026] [:error] [pid 39185:tid 39252] [client 20.220.196.236:45882] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaL7YBVE-FfM89u7BQaxswAAAIY"]
[Sat Feb 28 22:27:45.376475 2026] [:error] [pid 49763:tid 49771] [client 20.220.196.236:45871] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aaL7YbTHSOG_yf2PpqHOKgAAAcU"]
[Sat Feb 28 22:27:45.784842 2026] [:error] [pid 49763:tid 49776] [client 20.220.196.236:45928] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaL7YbTHSOG_yf2PpqHOLQAAAco"]
[Sat Feb 28 22:27:46.198486 2026] [:error] [pid 52460:tid 52473] [client 20.220.196.236:45781] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaL7YrLWOogAgHGh62S8CQAAAYo"]
[Sat Feb 28 22:27:46.608957 2026] [:error] [pid 49763:tid 49787] [client 20.220.196.236:45981] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaL7YrTHSOG_yf2PpqHOMwAAAdU"]
[Sat Feb 28 22:27:47.023686 2026] [:error] [pid 49763:tid 49767] [client 20.220.196.236:45785] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaL7Y7THSOG_yf2PpqHONQAAAcE"]
[Sat Feb 28 22:27:47.444734 2026] [:error] [pid 39185:tid 39270] [client 20.220.196.236:45764] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaL7YxVE-FfM89u7BQaxtAAAAJg"]
[Sat Feb 28 22:27:47.878969 2026] [:error] [pid 49763:tid 49783] [client 20.220.196.236:46010] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaL7Y7THSOG_yf2PpqHOOgAAAdE"]
[Sat Feb 28 22:27:48.295842 2026] [:error] [pid 49763:tid 49785] [client 20.220.196.236:45719] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaL7ZLTHSOG_yf2PpqHOPgAAAdM"]
[Sat Feb 28 22:27:48.706407 2026] [:error] [pid 52460:tid 52472] [client 20.220.196.236:45745] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaL7ZLLWOogAgHGh62S8EAAAAYk"]
[Sat Feb 28 22:27:49.118618 2026] [:error] [pid 52460:tid 52463] [client 20.220.196.236:45769] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaL7ZbLWOogAgHGh62S8EwAAAYA"]
[Sat Feb 28 22:27:49.533285 2026] [:error] [pid 52460:tid 52471] [client 20.220.196.236:45807] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaL7ZbLWOogAgHGh62S8FwAAAYg"]
[Sat Feb 28 22:27:49.944893 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:45823] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaL7ZRCf4HvhVePw3LaLNQAAAAY"]
[Sat Feb 28 22:27:50.361906 2026] [:error] [pid 49763:tid 49769] [client 20.220.196.236:46076] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "aaL7ZrTHSOG_yf2PpqHORgAAAcM"]
[Sat Feb 28 22:27:50.802127 2026] [:error] [pid 39184:tid 39222] [client 20.220.196.236:45772] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aaL7ZltZF9Zd_U7easDmzAAAAEM"]
[Sat Feb 28 22:27:51.228781 2026] [:error] [pid 39183:tid 39200] [client 20.220.196.236:45789] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aaL7ZxCf4HvhVePw3LaLPgAAAAg"]
[Sat Feb 28 22:27:51.646312 2026] [:error] [pid 39184:tid 39220] [client 20.220.196.236:45907] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aaL7Z1tZF9Zd_U7easDm0AAAAEE"]
[Sat Feb 28 22:27:52.060909 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:45869] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "aaL7aLTHSOG_yf2PpqHOUwAAAcY"]
[Sat Feb 28 22:27:52.473529 2026] [:error] [pid 49763:tid 49774] [client 20.220.196.236:45870] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaL7aLTHSOG_yf2PpqHOVQAAAcg"]
[Sat Feb 28 22:27:52.892258 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45782] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaL7aLTHSOG_yf2PpqHOWgAAAc4"]
[Sat Feb 28 22:27:53.307030 2026] [:error] [pid 39184:tid 39229] [client 20.220.196.236:45718] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaL7aVtZF9Zd_U7easDm2AAAAEo"]
[Sat Feb 28 22:27:53.718753 2026] [:error] [pid 39184:tid 39224] [client 20.220.196.236:45913] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat.php"] [unique_id "aaL7aVtZF9Zd_U7easDm2gAAAEU"]
[Sat Feb 28 22:27:54.139264 2026] [:error] [pid 39184:tid 39222] [client 20.220.196.236:45868] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aaL7altZF9Zd_U7easDm3gAAAEM"]
[Sat Feb 28 22:27:54.555180 2026] [:error] [pid 52460:tid 52470] [client 20.220.196.236:45850] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aaL7arLWOogAgHGh62S8IgAAAYc"]
[Sat Feb 28 22:27:54.972453 2026] [:error] [pid 39185:tid 39247] [client 20.220.196.236:45840] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aaL7ahVE-FfM89u7BQaxuAAAAIE"]
[Sat Feb 28 22:27:55.393664 2026] [:error] [pid 39184:tid 39237] [client 20.220.196.236:45711] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "aaL7a1tZF9Zd_U7easDm5wAAAFI"]
[Sat Feb 28 22:27:55.807316 2026] [:error] [pid 11791:tid 11798] [client 20.220.196.236:45771] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaL7a2uX5e1Q32gqxH3Y5AAAAQU"]
[Sat Feb 28 22:27:56.231710 2026] [:error] [pid 52460:tid 52482] [client 20.220.196.236:45790] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaL7bLLWOogAgHGh62S8LwAAAZM"]
[Sat Feb 28 22:27:56.657447 2026] [:error] [pid 52460:tid 52467] [client 20.220.196.236:45842] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaL7bLLWOogAgHGh62S8NAAAAYQ"]
[Sat Feb 28 22:27:57.073614 2026] [:error] [pid 39183:tid 39201] [client 20.220.196.236:45725] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaL7bRCf4HvhVePw3LaLXQAAAAk"]
[Sat Feb 28 22:27:57.488026 2026] [:error] [pid 39183:tid 39215] [client 20.220.196.236:45792] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "aaL7bRCf4HvhVePw3LaLYwAAABc"]
[Sat Feb 28 22:27:57.901629 2026] [:error] [pid 39183:tid 39206] [client 20.220.196.236:45876] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "aaL7bRCf4HvhVePw3LaLZgAAAA4"]
[Sat Feb 28 22:27:58.312848 2026] [:error] [pid 39183:tid 39195] [client 20.220.196.236:45733] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "aaL7bhCf4HvhVePw3LaLawAAAAM"]
[Sat Feb 28 22:27:58.724207 2026] [:error] [pid 52460:tid 52481] [client 20.220.196.236:45783] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "aaL7brLWOogAgHGh62S8RwAAAZI"]
[Sat Feb 28 22:27:59.137798 2026] [:error] [pid 39183:tid 39193] [client 20.220.196.236:45919] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaL7bxCf4HvhVePw3LaLdgAAAAE"]
[Sat Feb 28 22:27:59.550058 2026] [:error] [pid 39292:tid 39295] [client 20.220.196.236:45714] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaL7b6IAO5fN7BxyqcGWywAAAME"]
[Sat Feb 28 22:27:59.961743 2026] [:error] [pid 39292:tid 39312] [client 20.220.196.236:45945] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaL7b6IAO5fN7BxyqcGWzgAAANI"]
[Sat Feb 28 22:28:00.376552 2026] [:error] [pid 39292:tid 39306] [client 20.220.196.236:45702] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "aaL7cKIAO5fN7BxyqcGW1AAAAMw"]
[Sat Feb 28 22:28:00.789922 2026] [:error] [pid 39183:tid 39207] [client 20.220.196.236:45877] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "aaL7cBCf4HvhVePw3LaLfgAAAA8"]
[Sat Feb 28 22:28:01.207456 2026] [:error] [pid 52460:tid 52478] [client 20.220.196.236:45787] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "aaL7cbLWOogAgHGh62S8WAAAAY8"]
[Sat Feb 28 22:28:01.627615 2026] [:error] [pid 39183:tid 39215] [client 20.220.196.236:45815] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "aaL7cRCf4HvhVePw3LaLhAAAABc"]
[Sat Feb 28 22:28:02.047735 2026] [:error] [pid 52460:tid 52472] [client 20.220.196.236:46000] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "aaL7crLWOogAgHGh62S8XwAAAYk"]
[Sat Feb 28 22:28:02.463606 2026] [:error] [pid 39184:tid 39242] [client 20.220.196.236:45880] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cong.php"] [unique_id "aaL7cltZF9Zd_U7easDm8wAAAFc"]
[Sat Feb 28 22:28:02.878905 2026] [:error] [pid 52460:tid 52487] [client 20.220.196.236:45862] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cong.php"] [unique_id "aaL7crLWOogAgHGh62S8ZgAAAZg"]
[Sat Feb 28 22:28:03.293194 2026] [:error] [pid 39292:tid 39316] [client 20.220.196.236:45710] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cong.php"] [unique_id "aaL7c6IAO5fN7BxyqcGW2QAAANY"]
[Sat Feb 28 22:28:03.709895 2026] [:error] [pid 11791:tid 11810] [client 20.220.196.236:45802] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/cong.php"] [unique_id "aaL7c2uX5e1Q32gqxH3Y9wAAARE"]
[Sat Feb 28 22:28:04.130103 2026] [:error] [pid 52460:tid 52473] [client 20.220.196.236:45706] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaL7dLLWOogAgHGh62S8dgAAAYo"]
[Sat Feb 28 22:28:04.545955 2026] [:error] [pid 39292:tid 39297] [client 20.220.196.236:45810] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaL7dKIAO5fN7BxyqcGW3AAAAMM"]
[Sat Feb 28 22:28:04.982763 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45863] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaL7dLTHSOG_yf2PpqHOnAAAAdQ"]
[Sat Feb 28 22:28:05.409883 2026] [:error] [pid 39184:tid 39221] [client 20.220.196.236:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Feb 28 22:28:05.846661 2026] [:error] [pid 39184:tid 39243] [client 20.220.196.236:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sat Feb 28 22:28:07.109863 2026] [:error] [pid 39184:tid 39220] [client 20.220.196.236:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Feb 28 22:28:07.540562 2026] [:error] [pid 39184:tid 39239] [client 20.220.196.236:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/w4.php
[Sat Feb 28 22:28:07.968725 2026] [:error] [pid 39184:tid 39231] [client 20.220.196.236:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sat Feb 28 22:28:08.183298 2026] [:error] [pid 39184:tid 39240] [client 20.220.196.236:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 28 22:28:08.396852 2026] [:error] [pid 39184:tid 39241] [client 20.220.196.236:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/tymn.php
[Sat Feb 28 22:28:08.607517 2026] [:error] [pid 39184:tid 39234] [client 20.220.196.236:45757] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaL7eFtZF9Zd_U7easDnBAAAAE8"]
[Sat Feb 28 22:28:09.029877 2026] [:error] [pid 39183:tid 39210] [client 20.220.196.236:45980] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaL7eRCf4HvhVePw3LaLnQAAABI"]
[Sat Feb 28 22:28:09.447709 2026] [:error] [pid 39183:tid 39213] [client 20.220.196.236:45774] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaL7eRCf4HvhVePw3LaLogAAABU"]
[Sat Feb 28 22:28:09.863773 2026] [:error] [pid 39184:tid 39235] [client 20.220.196.236:45776] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaL7eVtZF9Zd_U7easDnBwAAAFA"]
[Sat Feb 28 22:28:10.274037 2026] [:error] [pid 52460:tid 52471] [client 20.220.196.236:45818] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaL7erLWOogAgHGh62S8qAAAAYg"]
[Sat Feb 28 22:28:10.691109 2026] [:error] [pid 52460:tid 52463] [client 20.220.196.236:45735] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaL7erLWOogAgHGh62S8rgAAAYA"]
[Sat Feb 28 22:28:11.124084 2026] [:error] [pid 39292:tid 39294] [client 20.220.196.236:45874] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaL7e6IAO5fN7BxyqcGW6AAAAMA"]
[Sat Feb 28 22:28:11.539904 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45857] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaL7e7THSOG_yf2PpqHOrAAAAdQ"]
[Sat Feb 28 22:28:11.953202 2026] [:error] [pid 49763:tid 49790] [client 20.220.196.236:45827] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaL7e7THSOG_yf2PpqHOrwAAAdg"]
[Sat Feb 28 22:28:12.371517 2026] [:error] [pid 52460:tid 52475] [client 20.220.196.236:45832] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaL7fLLWOogAgHGh62S8tAAAAYw"]
[Sat Feb 28 22:28:12.783386 2026] [:error] [pid 39185:tid 39262] [client 20.220.196.236:45940] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaL7fBVE-FfM89u7BQaxwAAAAJA"]
[Sat Feb 28 22:28:13.198007 2026] [:error] [pid 39183:tid 39213] [client 20.220.196.236:45993] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "aaL7fRCf4HvhVePw3LaLrwAAABU"]
[Sat Feb 28 22:28:13.620772 2026] [:error] [pid 49763:tid 49778] [client 20.220.196.236:45697] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaL7fbTHSOG_yf2PpqHOvAAAAcw"]
[Sat Feb 28 22:28:14.041346 2026] [:error] [pid 52460:tid 52487] [client 20.220.196.236:45865] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaL7frLWOogAgHGh62S8vAAAAZg"]
[Sat Feb 28 22:28:14.464135 2026] [:error] [pid 39184:tid 39226] [client 20.220.196.236:45754] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaL7fltZF9Zd_U7easDnCgAAAEc"]
[Sat Feb 28 22:28:14.883405 2026] [:error] [pid 39184:tid 39237] [client 20.220.196.236:45721] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "aaL7fltZF9Zd_U7easDnDQAAAFI"]
[Sat Feb 28 22:28:15.300417 2026] [:error] [pid 52460:tid 52472] [client 20.220.196.236:45929] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaL7f7LWOogAgHGh62S8ygAAAYk"]
[Sat Feb 28 22:28:15.709118 2026] [:error] [pid 49763:tid 49768] [client 20.220.196.236:45696] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaL7f7THSOG_yf2PpqHOwgAAAcI"]
[Sat Feb 28 22:28:16.124320 2026] [:error] [pid 39292:tid 39312] [client 20.220.196.236:46008] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaL7gKIAO5fN7BxyqcGW8gAAANI"]
[Sat Feb 28 22:28:16.549883 2026] [:error] [pid 39183:tid 39194] [client 20.220.196.236:45813] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aaL7gBCf4HvhVePw3LaLvwAAAAI"]
[Sat Feb 28 22:28:16.964307 2026] [:error] [pid 52460:tid 52483] [client 20.220.196.236:45698] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7gLLWOogAgHGh62S82QAAAZQ"]
[Sat Feb 28 22:28:17.375640 2026] [:error] [pid 39183:tid 39202] [client 20.220.196.236:45804] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7gRCf4HvhVePw3LaLyQAAAAo"]
[Sat Feb 28 22:28:17.787867 2026] [:error] [pid 39185:tid 39269] [client 20.220.196.236:45648] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7gRVE-FfM89u7BQaxxQAAAJc"]
[Sat Feb 28 22:28:18.203861 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:45724] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "aaL7ghCf4HvhVePw3LaL1AAAAAU"]
[Sat Feb 28 22:28:18.618919 2026] [:error] [pid 22194:tid 22201] [client 20.220.196.236:45641] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaL7gn6mbajs3bzQGyu0KwAAAUU"]
[Sat Feb 28 22:28:19.032129 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:45883] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaL7gxCf4HvhVePw3LaL5QAAAAU"]
[Sat Feb 28 22:28:19.450912 2026] [:error] [pid 39183:tid 39209] [client 20.220.196.236:45778] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaL7gxCf4HvhVePw3LaL7gAAABE"]
[Sat Feb 28 22:28:19.865788 2026] [:error] [pid 39183:tid 39195] [client 20.220.196.236:45762] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaL7gxCf4HvhVePw3LaL8QAAAAM"]
[Sat Feb 28 22:28:20.283932 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:45744] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aaL7hBCf4HvhVePw3LaL-AAAAAY"]
[Sat Feb 28 22:28:20.696208 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:45703] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aaL7hLTHSOG_yf2PpqHO1gAAAcY"]
[Sat Feb 28 22:28:21.111707 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45701] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aaL7hbTHSOG_yf2PpqHO2wAAAcs"]
[Sat Feb 28 22:28:21.526241 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45914] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "aaL7hbTHSOG_yf2PpqHO3wAAAcc"]
[Sat Feb 28 22:28:21.939383 2026] [:error] [pid 49763:tid 49776] [client 20.220.196.236:45773] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaL7hbTHSOG_yf2PpqHO4wAAAco"]
[Sat Feb 28 22:28:22.350108 2026] [:error] [pid 49763:tid 49769] [client 20.220.196.236:45886] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaL7hrTHSOG_yf2PpqHO5wAAAcM"]
[Sat Feb 28 22:28:22.774359 2026] [:error] [pid 49763:tid 49788] [client 20.220.196.236:45747] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaL7hrTHSOG_yf2PpqHO8QAAAdY"]
[Sat Feb 28 22:28:23.195958 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45729] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "aaL7h7THSOG_yf2PpqHO9wAAAcs"]
[Sat Feb 28 22:28:23.607715 2026] [:error] [pid 39183:tid 39199] [client 20.220.196.236:45722] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaL7hxCf4HvhVePw3LaMEQAAAAc"]
[Sat Feb 28 22:28:24.020004 2026] [:error] [pid 49763:tid 49790] [client 20.220.196.236:45812] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaL7iLTHSOG_yf2PpqHPAAAAAdg"]
[Sat Feb 28 22:28:24.429960 2026] [:error] [pid 49763:tid 49767] [client 20.220.196.236:45879] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaL7iLTHSOG_yf2PpqHPBAAAAcE"]
[Sat Feb 28 22:28:24.851815 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45822] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "aaL7iLTHSOG_yf2PpqHPCgAAAdQ"]
[Sat Feb 28 22:28:25.268885 2026] [:error] [pid 22194:tid 22202] [client 20.220.196.236:45671] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaL7iX6mbajs3bzQGyu0LwAAAUY"]
[Sat Feb 28 22:28:25.699774 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45734] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaL7ibTHSOG_yf2PpqHPFAAAAdQ"]
[Sat Feb 28 22:28:26.116326 2026] [:error] [pid 49763:tid 49771] [client 20.220.196.236:45768] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaL7irTHSOG_yf2PpqHPGwAAAcU"]
[Sat Feb 28 22:28:26.542145 2026] [:error] [pid 39185:tid 39250] [client 20.220.196.236:45737] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "aaL7ihVE-FfM89u7BQaxxwAAAIQ"]
[Sat Feb 28 22:28:26.970748 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45741] [client 20.220.196.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaL7irTHSOG_yf2PpqHPJQAAAc4"]
[Sat Feb 28 22:28:27.417693 2026] [:error] [pid 49763:tid 49785] [client 20.220.196.236:45775] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaL7i7THSOG_yf2PpqHPKgAAAdM"]
[Sat Feb 28 22:28:27.834326 2026] [:error] [pid 52460:tid 52474] [client 20.220.196.236:45640] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaL7i7LWOogAgHGh62S9AAAAAYs"]
[Sat Feb 28 22:28:28.247888 2026] [:error] [pid 52460:tid 52482] [client 20.220.196.236:45794] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaL7jLLWOogAgHGh62S9AgAAAZM"]
[Sat Feb 28 22:28:28.672600 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:45760] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "aaL7jLTHSOG_yf2PpqHPNwAAAcY"]
[Sat Feb 28 22:28:29.089143 2026] [:error] [pid 11791:tid 11816] [client 20.220.196.236:45761] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aaL7jWuX5e1Q32gqxH3ZHQAAARc"]
[Sat Feb 28 22:28:29.510353 2026] [:error] [pid 52460:tid 52463] [client 20.220.196.236:45704] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aaL7jbLWOogAgHGh62S9CgAAAYA"]
[Sat Feb 28 22:28:29.930194 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45658] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aaL7jbTHSOG_yf2PpqHPPQAAAcs"]
[Sat Feb 28 22:28:30.346971 2026] [:error] [pid 49763:tid 49769] [client 20.220.196.236:45650] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hi.php"] [unique_id "aaL7jrTHSOG_yf2PpqHPRAAAAcM"]
[Sat Feb 28 22:28:30.757905 2026] [:error] [pid 49763:tid 49790] [client 20.220.196.236:45709] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaL7jrTHSOG_yf2PpqHPSwAAAdg"]
[Sat Feb 28 22:28:31.175467 2026] [:error] [pid 49763:tid 49787] [client 20.220.196.236:45665] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaL7j7THSOG_yf2PpqHPUgAAAdU"]
[Sat Feb 28 22:28:31.596046 2026] [:error] [pid 49763:tid 49768] [client 20.220.196.236:45575] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaL7j7THSOG_yf2PpqHPVwAAAcI"]
[Sat Feb 28 22:28:32.017227 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45749] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lala.php"] [unique_id "aaL7kLTHSOG_yf2PpqHPXAAAAc4"]
[Sat Feb 28 22:28:32.428731 2026] [:error] [pid 49763:tid 49789] [client 20.220.196.236:45712] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaL7kLTHSOG_yf2PpqHPZQAAAdc"]
[Sat Feb 28 22:28:32.842135 2026] [:error] [pid 39183:tid 39202] [client 20.220.196.236:45750] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaL7kBCf4HvhVePw3LaMNAAAAAo"]
[Sat Feb 28 22:28:33.261283 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:45759] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaL7kRCf4HvhVePw3LaMOAAAAAU"]
[Sat Feb 28 22:28:33.695485 2026] [:error] [pid 52460:tid 52471] [client 20.220.196.236:45699] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lb.php"] [unique_id "aaL7kbLWOogAgHGh62S9EQAAAYg"]
[Sat Feb 28 22:28:34.109047 2026] [:error] [pid 52460:tid 52482] [client 20.220.196.236:45881] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaL7krLWOogAgHGh62S9EwAAAZM"]
[Sat Feb 28 22:28:34.528979 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45646] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaL7krTHSOG_yf2PpqHPcgAAAdQ"]
[Sat Feb 28 22:28:34.949852 2026] [:error] [pid 52460:tid 52478] [client 20.220.196.236:45799] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaL7krLWOogAgHGh62S9GAAAAY8"]
[Sat Feb 28 22:28:35.369926 2026] [:error] [pid 49763:tid 49771] [client 20.220.196.236:45820] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaL7k7THSOG_yf2PpqHPdgAAAcU"]
[Sat Feb 28 22:28:35.790569 2026] [:error] [pid 52460:tid 52465] [client 20.220.196.236:45746] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaL7k7LWOogAgHGh62S9GwAAAYI"]
[Sat Feb 28 22:28:36.213606 2026] [:error] [pid 39183:tid 39203] [client 20.220.196.236:45673] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaL7lBCf4HvhVePw3LaMRQAAAAs"]
[Sat Feb 28 22:28:36.633138 2026] [:error] [pid 39183:tid 39194] [client 20.220.196.236:45819] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaL7lBCf4HvhVePw3LaMRgAAAAI"]
[Sat Feb 28 22:28:37.056406 2026] [:error] [pid 49763:tid 49790] [client 20.220.196.236:45686] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "aaL7lbTHSOG_yf2PpqHPfQAAAdg"]
[Sat Feb 28 22:28:37.482998 2026] [:error] [pid 49763:tid 49782] [client 20.220.196.236:45795] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaL7lbTHSOG_yf2PpqHPggAAAdA"]
[Sat Feb 28 22:28:37.895797 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:45700] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaL7lRCf4HvhVePw3LaMVQAAAAY"]
[Sat Feb 28 22:28:38.312614 2026] [:error] [pid 49763:tid 49788] [client 20.220.196.236:45742] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaL7lrTHSOG_yf2PpqHPigAAAdY"]
[Sat Feb 28 22:28:38.728312 2026] [:error] [pid 39292:tid 39300] [client 20.220.196.236:45808] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaL7lqIAO5fN7BxyqcGXCQAAAMY"]
[Sat Feb 28 22:28:39.144997 2026] [:error] [pid 49763:tid 49769] [client 20.220.196.236:45655] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7l7THSOG_yf2PpqHPjgAAAcM"]
[Sat Feb 28 22:28:39.559774 2026] [:error] [pid 22194:tid 22198] [client 20.220.196.236:45727] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7l36mbajs3bzQGyu0MgAAAUI"]
[Sat Feb 28 22:28:39.982519 2026] [:error] [pid 39183:tid 39213] [client 20.220.196.236:45677] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7lxCf4HvhVePw3LaMYwAAABU"]
[Sat Feb 28 22:28:40.397576 2026] [:error] [pid 49763:tid 49780] [client 20.220.196.236:45842] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "aaL7mLTHSOG_yf2PpqHPkQAAAc4"]
[Sat Feb 28 22:28:40.825235 2026] [:error] [pid 22194:tid 22197] [client 20.220.196.236:45728] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaL7mH6mbajs3bzQGyu0NAAAAUE"]
[Sat Feb 28 22:28:41.247377 2026] [:error] [pid 52460:tid 52463] [client 20.220.196.236:45732] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaL7mbLWOogAgHGh62S9KwAAAYA"]
[Sat Feb 28 22:28:41.658095 2026] [:error] [pid 39183:tid 39213] [client 20.220.196.236:45756] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaL7mRCf4HvhVePw3LaMcgAAABU"]
[Sat Feb 28 22:28:42.076194 2026] [:error] [pid 39292:tid 39313] [client 20.220.196.236:45726] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaL7mqIAO5fN7BxyqcGXEwAAANM"]
[Sat Feb 28 22:28:42.486251 2026] [:error] [pid 22194:tid 22207] [client 20.220.196.236:45873] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "aaL7mn6mbajs3bzQGyu0NQAAAUs"]
[Sat Feb 28 22:28:42.895529 2026] [:error] [pid 49763:tid 49771] [client 20.220.196.236:45803] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "aaL7mrTHSOG_yf2PpqHPmgAAAcU"]
[Sat Feb 28 22:28:43.310799 2026] [:error] [pid 52460:tid 52487] [client 20.220.196.236:45748] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "aaL7m7LWOogAgHGh62S9NgAAAZg"]
[Sat Feb 28 22:28:43.732033 2026] [:error] [pid 52460:tid 52475] [client 20.220.196.236:45736] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "aaL7m7LWOogAgHGh62S9OwAAAYw"]
[Sat Feb 28 22:28:44.166035 2026] [:error] [pid 22194:tid 22208] [client 20.220.196.236:45667] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaL7nH6mbajs3bzQGyu0PQAAAUw"]
[Sat Feb 28 22:28:44.580329 2026] [:error] [pid 11791:tid 11803] [client 20.220.196.236:45740] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaL7nGuX5e1Q32gqxH3ZOwAAAQo"]
[Sat Feb 28 22:28:45.009591 2026] [:error] [pid 39183:tid 39198] [client 20.220.196.236:45690] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaL7nRCf4HvhVePw3LaMgQAAAAY"]
[Sat Feb 28 22:28:45.431126 2026] [:error] [pid 52460:tid 52485] [client 20.220.196.236:45644] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "aaL7nbLWOogAgHGh62S9PwAAAZY"]
[Sat Feb 28 22:28:45.856095 2026] [:error] [pid 22194:tid 22216] [client 20.220.196.236:46004] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaL7nX6mbajs3bzQGyu0SAAAAVQ"]
[Sat Feb 28 22:28:46.285109 2026] [:error] [pid 52460:tid 52468] [client 20.220.196.236:45573] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaL7nrLWOogAgHGh62S9QwAAAYU"]
[Sat Feb 28 22:28:46.701946 2026] [:error] [pid 39185:tid 39256] [client 20.220.196.236:45647] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaL7nhVE-FfM89u7BQax4QAAAIo"]
[Sat Feb 28 22:28:47.118823 2026] [:error] [pid 52460:tid 52484] [client 20.220.196.236:45672] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaL7n7LWOogAgHGh62S9RgAAAZU"]
[Sat Feb 28 22:28:47.535109 2026] [:error] [pid 39183:tid 39193] [client 20.220.196.236:45659] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaL7nxCf4HvhVePw3LaMlAAAAAE"]
[Sat Feb 28 22:28:47.948212 2026] [:error] [pid 52460:tid 52464] [client 20.220.196.236:45809] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaL7n7LWOogAgHGh62S9SwAAAYE"]
[Sat Feb 28 22:28:48.363085 2026] [:error] [pid 52460:tid 52485] [client 20.220.196.236:45666] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaL7oLLWOogAgHGh62S9TwAAAZY"]
[Sat Feb 28 22:28:48.784284 2026] [:error] [pid 52460:tid 52471] [client 20.220.196.236:45604] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaL7oLLWOogAgHGh62S9WQAAAYg"]
[Sat Feb 28 22:28:49.201656 2026] [:error] [pid 52460:tid 52474] [client 20.220.196.236:45669] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaL7obLWOogAgHGh62S9YQAAAYs"]
[Sat Feb 28 22:28:49.611623 2026] [:error] [pid 52460:tid 52468] [client 20.220.196.236:45707] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaL7obLWOogAgHGh62S9awAAAYU"]
[Sat Feb 28 22:28:50.025507 2026] [:error] [pid 39184:tid 39226] [client 20.220.196.236:45926] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaL7oltZF9Zd_U7easDnPgAAAEc"]
[Sat Feb 28 22:28:50.436689 2026] [:error] [pid 49763:tid 49767] [client 20.220.196.236:45676] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "aaL7orTHSOG_yf2PpqHPuQAAAcE"]
[Sat Feb 28 22:28:50.849192 2026] [:error] [pid 52460:tid 52483] [client 20.220.196.236:45752] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaL7orLWOogAgHGh62S9hgAAAZQ"]
[Sat Feb 28 22:28:51.269646 2026] [:error] [pid 49763:tid 49769] [client 20.220.196.236:45634] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaL7o7THSOG_yf2PpqHPvAAAAcM"]
[Sat Feb 28 22:28:51.687299 2026] [:error] [pid 52460:tid 52474] [client 20.220.196.236:45651] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaL7o7LWOogAgHGh62S9kQAAAYs"]
[Sat Feb 28 22:28:52.103053 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45636] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "aaL7pLTHSOG_yf2PpqHPwAAAAc0"]
[Sat Feb 28 22:28:52.518290 2026] [:error] [pid 39183:tid 39197] [client 20.220.196.236:45576] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaL7pBCf4HvhVePw3LaMtQAAAAU"]
[Sat Feb 28 22:28:52.935703 2026] [:error] [pid 39183:tid 39192] [client 20.220.196.236:45681] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaL7pBCf4HvhVePw3LaMvQAAAAA"]
[Sat Feb 28 22:28:53.350689 2026] [:error] [pid 49763:tid 49790] [client 20.220.196.236:45723] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaL7pbTHSOG_yf2PpqHPywAAAdg"]
[Sat Feb 28 22:28:53.759802 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:45801] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "aaL7pbTHSOG_yf2PpqHP1AAAAcY"]
[Sat Feb 28 22:28:54.170011 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45800] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaL7prTHSOG_yf2PpqHP3gAAAc0"]
[Sat Feb 28 22:28:54.583254 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45758] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaL7prTHSOG_yf2PpqHP6gAAAcc"]
[Sat Feb 28 22:28:54.997595 2026] [:error] [pid 39183:tid 39207] [client 20.220.196.236:45676] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaL7phCf4HvhVePw3LaMwwAAAA8"]
[Sat Feb 28 22:28:55.411758 2026] [:error] [pid 49763:tid 49787] [client 20.220.196.236:45738] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "aaL7p7THSOG_yf2PpqHP9wAAAdU"]
[Sat Feb 28 22:28:55.837526 2026] [:error] [pid 39185:tid 39255] [client 20.220.196.236:45788] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aaL7pxVE-FfM89u7BQax6gAAAIk"]
[Sat Feb 28 22:28:56.264181 2026] [:error] [pid 39183:tid 39194] [client 20.220.196.236:45668] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aaL7qBCf4HvhVePw3LaMyQAAAAI"]
[Sat Feb 28 22:28:56.687894 2026] [:error] [pid 39183:tid 39212] [client 20.220.196.236:45607] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aaL7qBCf4HvhVePw3LaM0gAAABQ"]
[Sat Feb 28 22:28:57.097749 2026] [:error] [pid 22194:tid 22220] [client 20.220.196.236:45569] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "aaL7qX6mbajs3bzQGyu0WAAAAVg"]
[Sat Feb 28 22:28:57.527714 2026] [:error] [pid 11791:tid 11793] [client 20.220.196.236:45753] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaL7qWuX5e1Q32gqxH3ZUAAAAQA"]
[Sat Feb 28 22:28:57.936298 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45505] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaL7qbTHSOG_yf2PpqHQBQAAAcc"]
[Sat Feb 28 22:28:58.350228 2026] [:error] [pid 52460:tid 52477] [client 20.220.196.236:45584] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaL7qrLWOogAgHGh62S9pAAAAY4"]
[Sat Feb 28 22:28:58.770071 2026] [:error] [pid 39185:tid 39259] [client 20.220.196.236:45652] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "aaL7qhVE-FfM89u7BQax8QAAAI0"]
[Sat Feb 28 22:28:59.188734 2026] [:error] [pid 39185:tid 39267] [client 20.220.196.236:45715] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aaL7qxVE-FfM89u7BQax9gAAAJU"]
[Sat Feb 28 22:28:59.607334 2026] [:error] [pid 39292:tid 39307] [client 20.220.196.236:45610] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aaL7q6IAO5fN7BxyqcGXUQAAAM0"]
[Sat Feb 28 22:29:00.022750 2026] [:error] [pid 52460:tid 52465] [client 20.220.196.236:45600] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aaL7rLLWOogAgHGh62S9qgAAAYI"]
[Sat Feb 28 22:29:00.437065 2026] [:error] [pid 49763:tid 49790] [client 20.220.196.236:45657] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log.php"] [unique_id "aaL7rLTHSOG_yf2PpqHQEwAAAdg"]
[Sat Feb 28 22:29:00.852471 2026] [:error] [pid 49763:tid 49787] [client 20.220.196.236:45694] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaL7rLTHSOG_yf2PpqHQGgAAAdU"]
[Sat Feb 28 22:29:01.274353 2026] [:error] [pid 49763:tid 49785] [client 20.220.196.236:45654] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaL7rbTHSOG_yf2PpqHQGwAAAdM"]
[Sat Feb 28 22:29:01.689304 2026] [:error] [pid 39292:tid 39296] [client 20.220.196.236:45716] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaL7raIAO5fN7BxyqcGXXAAAAMI"]
[Sat Feb 28 22:29:02.105101 2026] [:error] [pid 49763:tid 49782] [client 20.220.196.236:45751] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/miansha.php"] [unique_id "aaL7rrTHSOG_yf2PpqHQHgAAAdA"]
[Sat Feb 28 22:29:02.515779 2026] [:error] [pid 39183:tid 39193] [client 20.220.196.236:45572] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaL7rhCf4HvhVePw3LaM6wAAAAE"]
[Sat Feb 28 22:29:02.929169 2026] [:error] [pid 49763:tid 49766] [client 20.220.196.236:45578] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaL7rrTHSOG_yf2PpqHQIQAAAcA"]
[Sat Feb 28 22:29:03.339185 2026] [:error] [pid 49763:tid 49788] [client 20.220.196.236:45731] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaL7r7THSOG_yf2PpqHQKgAAAdY"]
[Sat Feb 28 22:29:03.749675 2026] [:error] [pid 49763:tid 49779] [client 20.220.196.236:45601] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "aaL7r7THSOG_yf2PpqHQLgAAAc0"]
[Sat Feb 28 22:29:04.166035 2026] [:error] [pid 49763:tid 49781] [client 20.220.196.236:45720] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaL7sLTHSOG_yf2PpqHQNgAAAc8"]
[Sat Feb 28 22:29:04.581582 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45780] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaL7sLTHSOG_yf2PpqHQQAAAAcc"]
[Sat Feb 28 22:29:05.000586 2026] [:error] [pid 39184:tid 39219] [client 20.220.196.236:45817] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaL7sFtZF9Zd_U7easDnawAAAEA"]
[Sat Feb 28 22:29:05.413833 2026] [:error] [pid 49763:tid 49778] [client 20.220.196.236:45645] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaL7sbTHSOG_yf2PpqHQRgAAAcw"]
[Sat Feb 28 22:29:05.824546 2026] [:error] [pid 49763:tid 49789] [client 20.220.196.236:45615] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaL7sbTHSOG_yf2PpqHQTgAAAdc"]
[Sat Feb 28 22:29:06.236478 2026] [:error] [pid 49763:tid 49772] [client 20.220.196.236:45814] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaL7srTHSOG_yf2PpqHQUQAAAcY"]
[Sat Feb 28 22:29:06.648212 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45642] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaL7srTHSOG_yf2PpqHQWgAAAcc"]
[Sat Feb 28 22:29:07.061206 2026] [:error] [pid 49763:tid 49777] [client 20.220.196.236:45581] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X57.php"] [unique_id "aaL7s7THSOG_yf2PpqHQYAAAAcs"]
[Sat Feb 28 22:29:07.473465 2026] [:error] [pid 49763:tid 49786] [client 20.220.196.236:45643] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aaL7s7THSOG_yf2PpqHQZgAAAdQ"]
[Sat Feb 28 22:29:07.886985 2026] [:error] [pid 49763:tid 49782] [client 20.220.196.236:45713] [client 20.220.196.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "aaL7s7THSOG_yf2PpqHQcgAAAdA"]
[Sat Feb 28 22:29:08.306524 2026] [:error] [pid 49763:tid 49776] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Sat Feb 28 22:29:08.518347 2026] [:error] [pid 49763:tid 49787] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Sat Feb 28 22:29:08.730665 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Sat Feb 28 22:29:08.944543 2026] [:error] [pid 49763:tid 49768] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/re.php
[Sat Feb 28 22:29:09.158543 2026] [:error] [pid 49763:tid 49776] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/styll.php
[Sat Feb 28 22:29:09.371231 2026] [:error] [pid 49763:tid 49769] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Feb 28 22:29:09.584209 2026] [:error] [pid 49763:tid 49784] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/flower2.php
[Sat Feb 28 22:29:09.796315 2026] [:error] [pid 49763:tid 49781] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/4h.php
[Sat Feb 28 22:29:10.007519 2026] [:error] [pid 49763:tid 49790] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Sat Feb 28 22:29:10.219626 2026] [:error] [pid 49763:tid 49773] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sat Feb 28 22:29:10.432039 2026] [:error] [pid 49763:tid 49782] [client 20.220.196.236:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Sat Feb 28 22:34:46.934562 2026] [:error] [pid 52460:tid 52476] [client 20.220.13.5:9405] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaL9BrLWOogAgHGh62TCJAAAAY0"]
[Sat Feb 28 22:34:47.764010 2026] [:error] [pid 39183:tid 39204] [client 20.220.13.5:9617] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaL9BxCf4HvhVePw3LaTvgAAAAw"]
[Sat Feb 28 22:34:48.611249 2026] [:error] [pid 52460:tid 52474] [client 20.220.13.5:9401] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaL9CLLWOogAgHGh62TCKAAAAYs"]
[Sat Feb 28 22:34:49.436899 2026] [:error] [pid 49763:tid 49768] [client 20.220.13.5:9390] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaL9CbTHSOG_yf2PpqHXeQAAAcI"]
[Sat Feb 28 22:53:04.902997 2026] [:error] [pid 11791:tid 11798] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sat Feb 28 22:53:05.124727 2026] [:error] [pid 11791:tid 11813] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 22:53:05.553754 2026] [:error] [pid 11791:tid 11811] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/ws77.php
[Sat Feb 28 22:53:05.769280 2026] [:error] [pid 11791:tid 11817] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sat Feb 28 22:53:05.987980 2026] [:error] [pid 11791:tid 11801] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Sat Feb 28 22:53:06.209729 2026] [:error] [pid 11791:tid 11799] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Feb 28 22:53:07.022344 2026] [:error] [pid 11791:tid 11799] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Feb 28 22:53:07.244455 2026] [:error] [pid 11791:tid 11815] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sat Feb 28 22:53:07.454664 2026] [:error] [pid 11791:tid 11802] [client 13.71.191.191:34780] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Sat Feb 28 22:53:07.661033 2026] [:error] [pid 11791:tid 11800] [client 13.71.191.191:34780] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaMBU2uX5e1Q32gqxH3fnQAAAQc"]
[Sat Feb 28 22:53:08.156080 2026] [:error] [pid 52460:tid 52486] [client 13.71.191.191:34811] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaMBVLLWOogAgHGh62TOFgAAAZc"]
[Sat Feb 28 22:53:08.592606 2026] [:error] [pid 49763:tid 49790] [client 13.71.191.191:34801] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaMBVLTHSOG_yf2PpqHqnAAAAdg"]
[Sat Feb 28 22:53:09.063675 2026] [:error] [pid 52460:tid 52474] [client 13.71.191.191:34806] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaMBVbLWOogAgHGh62TOHQAAAYs"]
[Sat Feb 28 22:53:09.643524 2026] [:error] [pid 39184:tid 39219] [client 13.71.191.191:34789] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaMBVVtZF9Zd_U7easDx3AAAAEA"]
[Sat Feb 28 22:53:10.097840 2026] [:error] [pid 39183:tid 39206] [client 13.71.191.191:34707] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaMBVhCf4HvhVePw3LavDgAAAA4"]
[Sat Feb 28 22:53:10.659130 2026] [:error] [pid 11791:tid 11814] [client 13.71.191.191:34796] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaMBVmuX5e1Q32gqxH3fngAAARU"]
[Sat Feb 28 22:53:11.119017 2026] [:error] [pid 49763:tid 49788] [client 13.71.191.191:34708] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shop.php"] [unique_id "aaMBV7THSOG_yf2PpqHqpgAAAdY"]
[Sat Feb 28 22:53:11.656990 2026] [:error] [pid 52460:tid 52479] [client 13.71.191.191:34766] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaMBV7LWOogAgHGh62TOJgAAAZA"]
[Sat Feb 28 22:53:12.311289 2026] [:error] [pid 52460:tid 52481] [client 13.71.191.191:34766] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaMBWLLWOogAgHGh62TOKwAAAZI"]
[Sat Feb 28 22:53:13.050028 2026] [:error] [pid 49763:tid 49767] [client 13.71.191.191:34689] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaMBWbTHSOG_yf2PpqHqrwAAAcE"]
[Sat Feb 28 22:53:13.552869 2026] [:error] [pid 39292:tid 39314] [client 13.71.191.191:34807] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cxxuv.php"] [unique_id "aaMBWaIAO5fN7BxyqcGfTAAAANQ"]
[Sat Feb 28 22:53:14.052886 2026] [:error] [pid 52460:tid 52464] [client 13.71.191.191:34813] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaMBWrLWOogAgHGh62TONgAAAYE"]
[Sat Feb 28 22:53:14.549217 2026] [:error] [pid 52460:tid 52472] [client 13.71.191.191:34695] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaMBWrLWOogAgHGh62TOOgAAAYk"]
[Sat Feb 28 22:53:15.113643 2026] [:error] [pid 39183:tid 39192] [client 13.71.191.191:34808] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaMBWxCf4HvhVePw3LavFwAAAAA"]
[Sat Feb 28 22:53:15.588184 2026] [:error] [pid 39183:tid 39200] [client 13.71.191.191:34701] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aaMBWxCf4HvhVePw3LavHQAAAAg"]
[Sat Feb 28 22:53:16.253228 2026] [:error] [pid 39292:tid 39310] [client 13.71.191.191:34703] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaMBXKIAO5fN7BxyqcGfUgAAANA"]
[Sat Feb 28 22:53:16.866203 2026] [:error] [pid 49763:tid 49769] [client 13.71.191.191:34781] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaMBXLTHSOG_yf2PpqHquAAAAcM"]
[Sat Feb 28 22:53:17.330369 2026] [:error] [pid 39292:tid 39305] [client 13.71.191.191:34768] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaMBXaIAO5fN7BxyqcGfVwAAAMs"]
[Sat Feb 28 22:53:17.821373 2026] [:error] [pid 39183:tid 39192] [client 13.71.191.191:34782] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gi.php"] [unique_id "aaMBXRCf4HvhVePw3LavJwAAAAA"]
[Sat Feb 28 22:53:18.428171 2026] [:error] [pid 39183:tid 39216] [client 13.71.191.191:34765] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaMBXhCf4HvhVePw3LavKgAAABg"]
[Sat Feb 28 22:53:18.916683 2026] [:error] [pid 49763:tid 49789] [client 13.71.191.191:34726] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaMBXrTHSOG_yf2PpqHqvQAAAdc"]
[Sat Feb 28 22:53:19.622223 2026] [:error] [pid 52460:tid 52467] [client 13.71.191.191:34770] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaMBX7LWOogAgHGh62TORgAAAYQ"]
[Sat Feb 28 22:53:20.208810 2026] [:error] [pid 52460:tid 52470] [client 13.71.191.191:34753] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e0v9e95c.php"] [unique_id "aaMBYLLWOogAgHGh62TOTAAAAYc"]
[Sat Feb 28 22:53:20.645798 2026] [:error] [pid 39183:tid 39206] [client 13.71.191.191:34763] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaMBYBCf4HvhVePw3LavMAAAAA4"]
[Sat Feb 28 22:53:21.175868 2026] [:error] [pid 39183:tid 39201] [client 13.71.191.191:34792] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaMBYRCf4HvhVePw3LavNgAAAAk"]
[Sat Feb 28 22:53:21.648223 2026] [:error] [pid 39183:tid 39197] [client 13.71.191.191:34785] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaMBYRCf4HvhVePw3LavOgAAAAU"]
[Sat Feb 28 22:53:22.165742 2026] [:error] [pid 39292:tid 39307] [client 13.71.191.191:34775] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2gz1dxix.php"] [unique_id "aaMBYqIAO5fN7BxyqcGfYAAAAM0"]
[Sat Feb 28 22:53:22.630871 2026] [:error] [pid 39292:tid 39295] [client 13.71.191.191:34736] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaMBYqIAO5fN7BxyqcGfZAAAAME"]
[Sat Feb 28 22:53:23.097616 2026] [:error] [pid 39183:tid 39211] [client 13.71.191.191:34702] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaMBYxCf4HvhVePw3LavSQAAABM"]
[Sat Feb 28 22:53:23.566097 2026] [:error] [pid 39183:tid 39214] [client 13.71.191.191:34786] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaMBYxCf4HvhVePw3LavTQAAABY"]
[Sat Feb 28 22:53:23.984913 2026] [:error] [pid 39184:tid 39236] [client 13.71.191.191:34704] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "aaMBY1tZF9Zd_U7easDx7AAAAFE"]
[Sat Feb 28 22:53:24.494806 2026] [:error] [pid 39183:tid 39207] [client 13.71.191.191:34756] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaMBZBCf4HvhVePw3LavVQAAAA8"]
[Sat Feb 28 22:53:24.955693 2026] [:error] [pid 52460:tid 52480] [client 13.71.191.191:34725] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaMBZLLWOogAgHGh62TOUgAAAZE"]
[Sat Feb 28 22:53:25.396980 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:34705] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaMBZbTHSOG_yf2PpqHqxAAAAcg"]
[Sat Feb 28 22:53:25.990782 2026] [:error] [pid 49763:tid 49772] [client 13.71.191.191:34643] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "aaMBZbTHSOG_yf2PpqHqygAAAcY"]
[Sat Feb 28 22:53:26.439946 2026] [:error] [pid 39185:tid 39264] [client 13.71.191.191:34761] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaMBZhVE-FfM89u7BQa2xwAAAJI"]
[Sat Feb 28 22:53:26.934025 2026] [:error] [pid 39185:tid 39255] [client 13.71.191.191:34755] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaMBZhVE-FfM89u7BQa2yAAAAIk"]
[Sat Feb 28 22:53:27.583219 2026] [:error] [pid 39183:tid 39194] [client 13.71.191.191:34799] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaMBZxCf4HvhVePw3LavYQAAAAI"]
[Sat Feb 28 22:53:28.188061 2026] [:error] [pid 39184:tid 39230] [client 13.71.191.191:34713] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bak.php"] [unique_id "aaMBaFtZF9Zd_U7easDx7QAAAEs"]
[Sat Feb 28 22:53:28.764402 2026] [:error] [pid 39183:tid 39202] [client 13.71.191.191:34784] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMBaBCf4HvhVePw3LavZAAAAAo"]
[Sat Feb 28 22:53:29.258968 2026] [:error] [pid 39183:tid 39204] [client 13.71.191.191:34752] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMBaRCf4HvhVePw3LavawAAAAw"]
[Sat Feb 28 22:53:29.753455 2026] [:error] [pid 39184:tid 39234] [client 13.71.191.191:34722] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMBaVtZF9Zd_U7easDx7wAAAE8"]
[Sat Feb 28 22:53:30.215107 2026] [:error] [pid 39183:tid 39206] [client 13.71.191.191:34640] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMBahCf4HvhVePw3LavcwAAAA4"]
[Sat Feb 28 22:53:30.804769 2026] [:error] [pid 52460:tid 52465] [client 13.71.191.191:34790] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaMBarLWOogAgHGh62TOXgAAAYI"]
[Sat Feb 28 22:53:31.361655 2026] [:error] [pid 39183:tid 39192] [client 13.71.191.191:34751] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaMBaxCf4HvhVePw3LavgQAAAAA"]
[Sat Feb 28 22:53:31.837655 2026] [:error] [pid 39183:tid 39195] [client 13.71.191.191:34637] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaMBaxCf4HvhVePw3LavhgAAAAM"]
[Sat Feb 28 22:53:32.616877 2026] [:error] [pid 39183:tid 39214] [client 13.71.191.191:34762] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-f.php"] [unique_id "aaMBbBCf4HvhVePw3LavkQAAABY"]
[Sat Feb 28 22:53:33.067077 2026] [:error] [pid 39183:tid 39205] [client 13.71.191.191:34809] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaMBbRCf4HvhVePw3LavmwAAAA0"]
[Sat Feb 28 22:53:33.620265 2026] [:error] [pid 39183:tid 39203] [client 13.71.191.191:34778] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaMBbRCf4HvhVePw3LavpQAAAAs"]
[Sat Feb 28 22:53:34.119318 2026] [:error] [pid 39183:tid 39215] [client 13.71.191.191:34642] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaMBbhCf4HvhVePw3LavrgAAABc"]
[Sat Feb 28 22:53:34.605225 2026] [:error] [pid 39183:tid 39209] [client 13.71.191.191:34655] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "aaMBbhCf4HvhVePw3LavuAAAABE"]
[Sat Feb 28 22:53:35.092926 2026] [:error] [pid 49763:tid 49773] [client 13.71.191.191:34814] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaMBb7THSOG_yf2PpqHq5QAAAcc"]
[Sat Feb 28 22:53:35.569337 2026] [:error] [pid 49763:tid 49772] [client 13.71.191.191:34812] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaMBb7THSOG_yf2PpqHq7QAAAcY"]
[Sat Feb 28 22:53:36.059994 2026] [:error] [pid 49763:tid 49784] [client 13.71.191.191:34690] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaMBcLTHSOG_yf2PpqHq8QAAAdI"]
[Sat Feb 28 22:53:36.568362 2026] [:error] [pid 52460:tid 52486] [client 13.71.191.191:34787] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "aaMBcLLWOogAgHGh62TOdQAAAZc"]
[Sat Feb 28 22:53:37.050530 2026] [:error] [pid 49763:tid 49788] [client 13.71.191.191:34717] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMBcbTHSOG_yf2PpqHq-AAAAdY"]
[Sat Feb 28 22:53:37.530714 2026] [:error] [pid 52460:tid 52483] [client 13.71.191.191:34740] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMBcbLWOogAgHGh62TOggAAAZQ"]
[Sat Feb 28 22:53:37.973953 2026] [:error] [pid 52460:tid 52475] [client 13.71.191.191:34795] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMBcbLWOogAgHGh62TOhAAAAYw"]
[Sat Feb 28 22:53:38.473956 2026] [:error] [pid 39184:tid 39221] [client 13.71.191.191:34791] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMBcltZF9Zd_U7easDx9wAAAEI"]
[Sat Feb 28 22:53:39.071316 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:34720] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaMBc2uX5e1Q32gqxH3fqQAAAQw"]
[Sat Feb 28 22:53:39.557231 2026] [:error] [pid 52460:tid 52466] [client 13.71.191.191:34747] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaMBc7LWOogAgHGh62TOuwAAAYM"]
[Sat Feb 28 22:53:40.107184 2026] [:error] [pid 39185:tid 39249] [client 13.71.191.191:34739] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaMBdBVE-FfM89u7BQa20QAAAIM"]
[Sat Feb 28 22:53:40.645233 2026] [:error] [pid 39183:tid 39201] [client 13.71.191.191:34667] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0bb45ctt.php"] [unique_id "aaMBdBCf4HvhVePw3LawCQAAAAk"]
[Sat Feb 28 22:53:41.169674 2026] [:error] [pid 49763:tid 49779] [client 13.71.191.191:34779] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaMBdbTHSOG_yf2PpqHrJwAAAc0"]
[Sat Feb 28 22:53:41.877995 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:34710] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaMBdbTHSOG_yf2PpqHrLAAAAcI"]
[Sat Feb 28 22:53:42.625262 2026] [:error] [pid 11791:tid 11798] [client 13.71.191.191:34641] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaMBdmuX5e1Q32gqxH3ftQAAAQU"]
[Sat Feb 28 22:53:43.472281 2026] [:error] [pid 39185:tid 39261] [client 13.71.191.191:34636] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "aaMBdxVE-FfM89u7BQa21AAAAI8"]
[Sat Feb 28 22:53:43.934202 2026] [:error] [pid 39183:tid 39214] [client 13.71.191.191:34574] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaMBdxCf4HvhVePw3LawKAAAABY"]
[Sat Feb 28 22:53:44.450629 2026] [:error] [pid 39184:tid 39219] [client 13.71.191.191:34691] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaMBeFtZF9Zd_U7easDyCAAAAEA"]
[Sat Feb 28 22:53:44.891696 2026] [:error] [pid 39184:tid 39229] [client 13.71.191.191:34797] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaMBeFtZF9Zd_U7easDyCwAAAEo"]
[Sat Feb 28 22:53:45.405519 2026] [:error] [pid 39183:tid 39205] [client 13.71.191.191:34706] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aaMBeRCf4HvhVePw3LawOAAAAA0"]
[Sat Feb 28 22:53:45.862960 2026] [:error] [pid 52460:tid 52487] [client 13.71.191.191:34815] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaMBebLWOogAgHGh62TO0wAAAZg"]
[Sat Feb 28 22:53:46.387445 2026] [:error] [pid 39183:tid 39210] [client 13.71.191.191:34694] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaMBehCf4HvhVePw3LawQAAAABI"]
[Sat Feb 28 22:53:46.845199 2026] [:error] [pid 52460:tid 52477] [client 13.71.191.191:34696] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaMBerLWOogAgHGh62TO1gAAAY4"]
[Sat Feb 28 22:53:47.533288 2026] [:error] [pid 52460:tid 52471] [client 13.71.191.191:34683] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "aaMBe7LWOogAgHGh62TO1wAAAYg"]
[Sat Feb 28 22:53:48.134129 2026] [:error] [pid 49763:tid 49782] [client 13.71.191.191:34629] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMBfLTHSOG_yf2PpqHrRgAAAdA"]
[Sat Feb 28 22:53:48.597097 2026] [:error] [pid 11791:tid 11799] [client 13.71.191.191:34634] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMBfGuX5e1Q32gqxH3fvQAAAQY"]
[Sat Feb 28 22:53:49.123154 2026] [:error] [pid 39183:tid 39192] [client 13.71.191.191:34639] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMBfRCf4HvhVePw3LawYAAAAAA"]
[Sat Feb 28 22:53:49.686660 2026] [:error] [pid 22194:tid 22208] [client 13.71.191.191:34698] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMBfX6mbajs3bzQGyu4igAAAUw"]
[Sat Feb 28 22:53:50.251599 2026] [:error] [pid 39185:tid 39251] [client 13.71.191.191:34630] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMBfhVE-FfM89u7BQa22AAAAIU"]
[Sat Feb 28 22:53:50.753152 2026] [:error] [pid 39183:tid 39211] [client 13.71.191.191:34727] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMBfhCf4HvhVePw3LawagAAABM"]
[Sat Feb 28 22:53:51.191078 2026] [:error] [pid 39183:tid 39192] [client 13.71.191.191:34758] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMBfxCf4HvhVePw3LawcAAAAAA"]
[Sat Feb 28 22:53:51.653247 2026] [:error] [pid 49763:tid 49786] [client 13.71.191.191:34759] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMBf7THSOG_yf2PpqHrUAAAAdQ"]
[Sat Feb 28 22:53:52.425818 2026] [:error] [pid 39292:tid 39317] [client 13.71.191.191:34730] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaMBgKIAO5fN7BxyqcGfmwAAANc"]
[Sat Feb 28 22:53:52.884605 2026] [:error] [pid 39183:tid 39195] [client 13.71.191.191:34746] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaMBgBCf4HvhVePw3LawigAAAAM"]
[Sat Feb 28 22:53:53.525238 2026] [:error] [pid 39183:tid 39209] [client 13.71.191.191:34632] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaMBgRCf4HvhVePw3LawkwAAABE"]
[Sat Feb 28 22:53:54.010043 2026] [:error] [pid 39185:tid 39254] [client 13.71.191.191:34721] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/62ix02bk.php"] [unique_id "aaMBghVE-FfM89u7BQa23QAAAIg"]
[Sat Feb 28 22:53:54.467760 2026] [:error] [pid 52460:tid 52469] [client 13.71.191.191:34764] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaMBgrLWOogAgHGh62TO9gAAAYY"]
[Sat Feb 28 22:53:54.949989 2026] [:error] [pid 39183:tid 39208] [client 13.71.191.191:34800] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaMBghCf4HvhVePw3LawoQAAABA"]
[Sat Feb 28 22:53:55.566117 2026] [:error] [pid 39184:tid 39220] [client 13.71.191.191:34738] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaMBg1tZF9Zd_U7easDyMgAAAEE"]
[Sat Feb 28 22:53:56.091146 2026] [:error] [pid 49763:tid 49782] [client 13.71.191.191:34688] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "aaMBhLTHSOG_yf2PpqHrWAAAAdA"]
[Sat Feb 28 22:53:56.856889 2026] [:error] [pid 39183:tid 39206] [client 13.71.191.191:34679] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6ijmjpa.php"] [unique_id "aaMBhBCf4HvhVePw3LawrwAAAA4"]
[Sat Feb 28 22:53:57.601762 2026] [:error] [pid 52460:tid 52470] [client 13.71.191.191:34700] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6ijmjpa.php"] [unique_id "aaMBhbLWOogAgHGh62TPFwAAAYc"]
[Sat Feb 28 22:53:58.096849 2026] [:error] [pid 49763:tid 49778] [client 13.71.191.191:34754] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6ijmjpa.php"] [unique_id "aaMBhrTHSOG_yf2PpqHrXgAAAcw"]
[Sat Feb 28 22:53:58.843947 2026] [:error] [pid 39292:tid 39301] [client 13.71.191.191:34793] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6ijmjpa.php"] [unique_id "aaMBhqIAO5fN7BxyqcGfogAAAMc"]
[Sat Feb 28 22:53:59.391501 2026] [:error] [pid 39183:tid 39205] [client 13.71.191.191:34669] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaMBhxCf4HvhVePw3LawzgAAAA0"]
[Sat Feb 28 22:53:59.919922 2026] [:error] [pid 39183:tid 39210] [client 13.71.191.191:34627] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaMBhxCf4HvhVePw3Law2AAAABI"]
[Sat Feb 28 22:54:00.375682 2026] [:error] [pid 39183:tid 39202] [client 13.71.191.191:34810] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaMBiBCf4HvhVePw3Law3gAAAAo"]
[Sat Feb 28 22:54:00.805552 2026] [:error] [pid 52460:tid 52477] [client 13.71.191.191:34731] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaMBiLLWOogAgHGh62TPHwAAAY4"]
[Sat Feb 28 22:54:01.254725 2026] [:error] [pid 52460:tid 52480] [client 13.71.191.191:34714] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4wj632p1.php"] [unique_id "aaMBibLWOogAgHGh62TPJAAAAZE"]
[Sat Feb 28 22:54:01.770718 2026] [:error] [pid 39183:tid 39192] [client 13.71.191.191:34788] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4wj632p1.php"] [unique_id "aaMBiRCf4HvhVePw3Law6wAAAAA"]
[Sat Feb 28 22:54:02.271966 2026] [:error] [pid 39183:tid 39209] [client 13.71.191.191:34749] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4wj632p1.php"] [unique_id "aaMBihCf4HvhVePw3Law9QAAABE"]
[Sat Feb 28 22:54:02.743068 2026] [:error] [pid 39183:tid 39199] [client 13.71.191.191:34716] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4wj632p1.php"] [unique_id "aaMBihCf4HvhVePw3Law_QAAAAc"]
[Sat Feb 28 22:54:03.286209 2026] [:error] [pid 52460:tid 52463] [client 13.71.191.191:34647] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "aaMBi7LWOogAgHGh62TPJwAAAYA"]
[Sat Feb 28 22:54:03.769106 2026] [:error] [pid 39183:tid 39212] [client 13.71.191.191:34718] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "aaMBixCf4HvhVePw3LaxDQAAABQ"]
[Sat Feb 28 22:54:04.218342 2026] [:error] [pid 11791:tid 11817] [client 13.71.191.191:34769] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "aaMBjGuX5e1Q32gqxH3fygAAARg"]
[Sat Feb 28 22:54:04.706888 2026] [:error] [pid 39183:tid 39211] [client 13.71.191.191:34659] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "aaMBjBCf4HvhVePw3LaxGAAAABM"]
[Sat Feb 28 22:54:05.279956 2026] [:error] [pid 39183:tid 39196] [client 13.71.191.191:34645] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e31hmf9b.php"] [unique_id "aaMBjRCf4HvhVePw3LaxJgAAAAQ"]
[Sat Feb 28 22:54:05.785324 2026] [:error] [pid 39292:tid 39315] [client 13.71.191.191:34804] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e31hmf9b.php"] [unique_id "aaMBjaIAO5fN7BxyqcGfqAAAANU"]
[Sat Feb 28 22:54:06.248251 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:34651] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e31hmf9b.php"] [unique_id "aaMBjmuX5e1Q32gqxH3fzQAAAQw"]
[Sat Feb 28 22:54:06.716523 2026] [:error] [pid 39184:tid 39221] [client 13.71.191.191:34657] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/e31hmf9b.php"] [unique_id "aaMBjltZF9Zd_U7easDyQwAAAEI"]
[Sat Feb 28 23:14:22.646302 2026] [:error] [pid 52460:tid 52468] [client 20.63.83.162:48994] File does not exist: /usr/local/apache/htdocs/suspended-page/f.php
[Sat Feb 28 23:14:22.852977 2026] [:error] [pid 52460:tid 52467] [client 20.63.83.162:48994] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 23:14:23.290917 2026] [:error] [pid 52460:tid 52465] [client 20.63.83.162:48994] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaMGT7LWOogAgHGh62TcrgAAAYI"]
[Sat Feb 28 23:14:24.730904 2026] [:error] [pid 39183:tid 39211] [client 20.63.83.162:48392] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Feb 28 23:14:25.246076 2026] [:error] [pid 39183:tid 39212] [client 20.63.83.162:48392] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sat Feb 28 23:14:25.915702 2026] [:error] [pid 39183:tid 39194] [client 20.63.83.162:48392] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaMGURCf4HvhVePw3LbPGAAAAAI"]
[Sat Feb 28 23:14:26.804050 2026] [:error] [pid 39184:tid 39241] [client 20.63.83.162:48397] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaMGUltZF9Zd_U7easD6OwAAAFY"]
[Sat Feb 28 23:14:27.863430 2026] [:error] [pid 39184:tid 39236] [client 20.63.83.162:48403] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaMGU1tZF9Zd_U7easD6PQAAAFE"]
[Sat Feb 28 23:14:28.918699 2026] [:error] [pid 39183:tid 39215] [client 20.63.83.162:48986] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaMGVBCf4HvhVePw3LbPIgAAABc"]
[Sat Feb 28 23:58:32.145305 2026] [:error] [pid 39183:tid 39194] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Sat Feb 28 23:58:32.398427 2026] [:error] [pid 39183:tid 39209] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sat Feb 28 23:58:32.619729 2026] [:error] [pid 39183:tid 39197] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Sat Feb 28 23:58:32.831999 2026] [:error] [pid 39183:tid 39204] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/X57.php
[Sat Feb 28 23:58:33.044858 2026] [:error] [pid 39183:tid 39205] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/wpver.php
[Sat Feb 28 23:58:33.474149 2026] [:error] [pid 39183:tid 39215] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sat Feb 28 23:58:33.687572 2026] [:error] [pid 39183:tid 39216] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sat Feb 28 23:58:33.901615 2026] [:error] [pid 39183:tid 39195] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/wqqs.php
[Sat Feb 28 23:58:34.124158 2026] [:error] [pid 39183:tid 39213] [client 4.204.200.32:59200] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-318.php
[Sat Feb 28 23:58:34.333890 2026] [:error] [pid 39183:tid 39203] [client 4.204.200.32:59200] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aaMQqhCf4HvhVePw3LYKOgAAAAs"]
[Sat Feb 28 23:58:35.091038 2026] [:error] [pid 49763:tid 49772] [client 4.204.200.32:59251] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aaMQq7THSOG_yf2PpqEspQAAAcY"]
[Sat Feb 28 23:58:35.974160 2026] [:error] [pid 39183:tid 39193] [client 4.204.200.32:59160] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aaMQqxCf4HvhVePw3LYKQgAAAAE"]
[Sat Feb 28 23:58:37.182008 2026] [:error] [pid 22194:tid 22207] [client 4.204.200.32:59201] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dom.php"] [unique_id "aaMQrX6mbajs3bzQGyvFGwAAAUs"]
[Sat Feb 28 23:58:38.233760 2026] [:error] [pid 11791:tid 11815] [client 4.204.200.32:59138] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaMQrmuX5e1Q32gqxH3xiwAAARY"]
[Sat Feb 28 23:58:38.897155 2026] [:error] [pid 52460:tid 52482] [client 4.204.200.32:59139] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaMQrrLWOogAgHGh62T8tgAAAZM"]
[Sat Feb 28 23:58:40.059527 2026] [:error] [pid 49763:tid 49767] [client 4.204.200.32:59230] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaMQsLTHSOG_yf2PpqEssQAAAcE"]
[Sat Feb 28 23:58:40.769808 2026] [:error] [pid 49763:tid 49769] [client 4.204.200.32:59236] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaMQsLTHSOG_yf2PpqEsswAAAcM"]
[Sat Feb 28 23:58:41.830116 2026] [:error] [pid 49763:tid 49782] [client 4.204.200.32:59260] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaMQsbTHSOG_yf2PpqEsuQAAAdA"]
[Sat Feb 28 23:58:42.330224 2026] [:error] [pid 49763:tid 49771] [client 4.204.200.32:59205] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaMQsrTHSOG_yf2PpqEsvgAAAcU"]
[Sat Feb 28 23:58:43.124595 2026] [:error] [pid 39185:tid 39255] [client 4.204.200.32:59228] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaMQsxVE-FfM89u7BQbDngAAAIk"]
[Sat Feb 28 23:58:44.152682 2026] [:error] [pid 49763:tid 49782] [client 4.204.200.32:59213] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon3.php"] [unique_id "aaMQtLTHSOG_yf2PpqEsxwAAAdA"]
[Sat Feb 28 23:58:45.330111 2026] [:error] [pid 39183:tid 39210] [client 4.204.200.32:59155] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMQtRCf4HvhVePw3LYKXwAAABI"]
[Sat Feb 28 23:58:46.441004 2026] [:error] [pid 39183:tid 39192] [client 4.204.200.32:59222] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMQthCf4HvhVePw3LYKZAAAAAA"]
[Sat Feb 28 23:58:47.544300 2026] [:error] [pid 39183:tid 39196] [client 4.204.200.32:59137] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMQtxCf4HvhVePw3LYKbQAAAAQ"]
[Sat Feb 28 23:58:48.660860 2026] [:error] [pid 22194:tid 22217] [client 4.204.200.32:59152] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMQuH6mbajs3bzQGyvFIQAAAVU"]
[Sat Feb 28 23:58:49.494578 2026] [:error] [pid 49763:tid 49779] [client 4.204.200.32:59207] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ebahvhhh.php"] [unique_id "aaMQubTHSOG_yf2PpqEs9gAAAc0"]
[Sat Feb 28 23:58:50.166896 2026] [:error] [pid 52460:tid 52478] [client 4.204.200.32:59149] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ebahvhhh.php"] [unique_id "aaMQurLWOogAgHGh62T8yQAAAY8"]
[Sat Feb 28 23:58:50.932931 2026] [:error] [pid 49763:tid 49773] [client 4.204.200.32:59145] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ebahvhhh.php"] [unique_id "aaMQurTHSOG_yf2PpqEtBgAAAcc"]
[Sat Feb 28 23:58:51.646473 2026] [:error] [pid 39185:tid 39257] [client 4.204.200.32:59238] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ebahvhhh.php"] [unique_id "aaMQuxVE-FfM89u7BQbDowAAAIs"]
[Sat Feb 28 23:58:52.376867 2026] [:error] [pid 49763:tid 49781] [client 4.204.200.32:59136] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/snq.php"] [unique_id "aaMQvLTHSOG_yf2PpqEtGgAAAc8"]
[Sat Feb 28 23:58:53.157411 2026] [:error] [pid 52460:tid 52486] [client 4.204.200.32:59211] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/snq.php"] [unique_id "aaMQvbLWOogAgHGh62T80QAAAZc"]
[Sat Feb 28 23:58:54.175268 2026] [:error] [pid 52460:tid 52471] [client 4.204.200.32:59214] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/snq.php"] [unique_id "aaMQvrLWOogAgHGh62T80wAAAYg"]
[Sat Feb 28 23:58:55.098562 2026] [:error] [pid 52460:tid 52482] [client 4.204.200.32:59147] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/snq.php"] [unique_id "aaMQv7LWOogAgHGh62T81QAAAZM"]
[Sat Feb 28 23:58:55.661107 2026] [:error] [pid 52460:tid 52484] [client 4.204.200.32:59159] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mcs.php"] [unique_id "aaMQv7LWOogAgHGh62T82AAAAZU"]
[Sat Feb 28 23:58:56.386110 2026] [:error] [pid 49763:tid 49769] [client 4.204.200.32:59235] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mcs.php"] [unique_id "aaMQwLTHSOG_yf2PpqEtUwAAAcM"]
[Sat Feb 28 23:58:57.289960 2026] [:error] [pid 49763:tid 49774] [client 4.204.200.32:59210] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mcs.php"] [unique_id "aaMQwbTHSOG_yf2PpqEtXgAAAcg"]
[Sat Feb 28 23:58:58.573613 2026] [:error] [pid 49763:tid 49773] [client 4.204.200.32:59168] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mcs.php"] [unique_id "aaMQwrTHSOG_yf2PpqEtbgAAAcc"]
[Sat Feb 28 23:58:59.331161 2026] [:error] [pid 49763:tid 49767] [client 4.204.200.32:59212] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ok.php"] [unique_id "aaMQw7THSOG_yf2PpqEteAAAAcE"]
[Sat Feb 28 23:58:59.931766 2026] [:error] [pid 49763:tid 49776] [client 4.204.200.32:59150] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ok.php"] [unique_id "aaMQw7THSOG_yf2PpqEtgQAAAco"]
[Sat Feb 28 23:59:00.811781 2026] [:error] [pid 49763:tid 49777] [client 4.204.200.32:59224] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ok.php"] [unique_id "aaMQxLTHSOG_yf2PpqEtkAAAAcs"]
[Sat Feb 28 23:59:01.370920 2026] [:error] [pid 52460:tid 52483] [client 4.204.200.32:59257] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ok.php"] [unique_id "aaMQxbLWOogAgHGh62T87AAAAZQ"]
[Sat Feb 28 23:59:02.223580 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:59227] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xleet.php"] [unique_id "aaMQxrTHSOG_yf2PpqEtngAAAdQ"]
[Sat Feb 28 23:59:02.974085 2026] [:error] [pid 39183:tid 39216] [client 4.204.200.32:16328] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xleet.php"] [unique_id "aaMQxhCf4HvhVePw3LYKsAAAABg"]
[Sat Feb 28 23:59:04.023574 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:59232] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xleet.php"] [unique_id "aaMQyLTHSOG_yf2PpqEtvgAAAdQ"]
[Sat Feb 28 23:59:05.281779 2026] [:error] [pid 22194:tid 22209] [client 4.204.200.32:59163] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xleet.php"] [unique_id "aaMQyX6mbajs3bzQGyvFMQAAAU0"]
[Sat Feb 28 23:59:05.860004 2026] [:error] [pid 49763:tid 49774] [client 4.204.200.32:59218] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaMQybTHSOG_yf2PpqEt1wAAAcg"]
[Sat Feb 28 23:59:06.386690 2026] [:error] [pid 39184:tid 39221] [client 4.204.200.32:59204] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaMQyltZF9Zd_U7easAQYAAAAEI"]
[Sat Feb 28 23:59:07.008812 2026] [:error] [pid 49763:tid 49781] [client 4.204.200.32:59215] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaMQy7THSOG_yf2PpqEt5AAAAc8"]
[Sat Feb 28 23:59:07.746011 2026] [:error] [pid 39183:tid 39213] [client 4.204.200.32:59183] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "aaMQyxCf4HvhVePw3LYKwwAAABU"]
[Sat Feb 28 23:59:08.527803 2026] [:error] [pid 52460:tid 52483] [client 4.204.200.32:59143] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "aaMQzLLWOogAgHGh62T8-wAAAZQ"]
[Sat Feb 28 23:59:09.639608 2026] [:error] [pid 49763:tid 49780] [client 4.204.200.32:59144] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "aaMQzbTHSOG_yf2PpqEuBQAAAc4"]
[Sat Feb 28 23:59:10.403111 2026] [:error] [pid 49763:tid 49781] [client 4.204.200.32:59161] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "aaMQzrTHSOG_yf2PpqEuFQAAAc8"]
[Sat Feb 28 23:59:11.149535 2026] [:error] [pid 39185:tid 39264] [client 4.204.200.32:16336] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "aaMQzxVE-FfM89u7BQbDpQAAAJI"]
[Sat Feb 28 23:59:11.968951 2026] [:error] [pid 22194:tid 22211] [client 4.204.200.32:59237] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaMQz36mbajs3bzQGyvFNwAAAU8"]
[Sat Feb 28 23:59:13.091714 2026] [:error] [pid 39183:tid 39205] [client 4.204.200.32:59261] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaMQ0RCf4HvhVePw3LYK4gAAAA0"]
[Sat Feb 28 23:59:14.313020 2026] [:error] [pid 49763:tid 49780] [client 4.204.200.32:59162] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaMQ0rTHSOG_yf2PpqEuTAAAAc4"]
[Sat Feb 28 23:59:14.993838 2026] [:error] [pid 49763:tid 49766] [client 4.204.200.32:59216] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "aaMQ0rTHSOG_yf2PpqEuVAAAAcA"]
[Sat Feb 28 23:59:15.769181 2026] [:error] [pid 52460:tid 52478] [client 4.204.200.32:59254] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaMQ07LWOogAgHGh62T9CAAAAY8"]
[Sat Feb 28 23:59:17.113065 2026] [:error] [pid 39183:tid 39197] [client 4.204.200.32:59226] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaMQ1RCf4HvhVePw3LYK9QAAAAU"]
[Sat Feb 28 23:59:17.751145 2026] [:error] [pid 49763:tid 49783] [client 4.204.200.32:59158] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaMQ1bTHSOG_yf2PpqEufQAAAdE"]
[Sat Feb 28 23:59:18.533287 2026] [:error] [pid 39292:tid 39308] [client 4.204.200.32:59245] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "aaMQ1qIAO5fN7BxyqcG0GwAAAM4"]
[Sat Feb 28 23:59:19.255808 2026] [:error] [pid 49763:tid 49772] [client 4.204.200.32:59249] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tmpls.php"] [unique_id "aaMQ17THSOG_yf2PpqEulgAAAcY"]
[Sat Feb 28 23:59:20.474411 2026] [:error] [pid 49763:tid 49778] [client 4.204.200.32:59146] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tmpls.php"] [unique_id "aaMQ2LTHSOG_yf2PpqEuqQAAAcw"]
[Sat Feb 28 23:59:21.221992 2026] [:error] [pid 49763:tid 49766] [client 4.204.200.32:59244] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tmpls.php"] [unique_id "aaMQ2bTHSOG_yf2PpqEuswAAAcA"]
[Sat Feb 28 23:59:22.159486 2026] [:error] [pid 49763:tid 49788] [client 4.204.200.32:59198] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tmpls.php"] [unique_id "aaMQ2rTHSOG_yf2PpqEuwwAAAdY"]
[Sat Feb 28 23:59:23.324406 2026] [:error] [pid 52460:tid 52470] [client 4.204.200.32:59153] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bsg-management/php.php"] [unique_id "aaMQ27LWOogAgHGh62T9NwAAAYc"]
[Sat Feb 28 23:59:23.980831 2026] [:error] [pid 49763:tid 49776] [client 4.204.200.32:16322] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bsg-management/php.php"] [unique_id "aaMQ27THSOG_yf2PpqEu3gAAAco"]
[Sat Feb 28 23:59:24.624722 2026] [:error] [pid 49763:tid 49789] [client 4.204.200.32:16332] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bsg-management/php.php"] [unique_id "aaMQ3LTHSOG_yf2PpqEu6gAAAdc"]
[Sat Feb 28 23:59:25.459576 2026] [:error] [pid 52460:tid 52475] [client 4.204.200.32:59231] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bsg-management/php.php"] [unique_id "aaMQ3bLWOogAgHGh62T9PQAAAYw"]
[Sat Feb 28 23:59:26.024077 2026] [:error] [pid 39183:tid 39199] [client 4.204.200.32:59142] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaMQ3hCf4HvhVePw3LYLIQAAAAc"]
[Sat Feb 28 23:59:26.635517 2026] [:error] [pid 39183:tid 39201] [client 4.204.200.32:59157] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaMQ3hCf4HvhVePw3LYLJAAAAAk"]
[Sat Feb 28 23:59:27.637804 2026] [:error] [pid 39185:tid 39266] [client 4.204.200.32:59225] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaMQ3xVE-FfM89u7BQbDqwAAAJQ"]
[Sat Feb 28 23:59:28.319562 2026] [:error] [pid 39185:tid 39268] [client 4.204.200.32:59223] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pouhg.php"] [unique_id "aaMQ4BVE-FfM89u7BQbDrAAAAJY"]
[Sat Feb 28 23:59:28.998783 2026] [:error] [pid 49763:tid 49790] [client 4.204.200.32:59164] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaMQ4LTHSOG_yf2PpqEu_gAAAdg"]
[Sat Feb 28 23:59:30.242864 2026] [:error] [pid 39183:tid 39208] [client 4.204.200.32:59167] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaMQ4hCf4HvhVePw3LYLLQAAABA"]
[Sat Feb 28 23:59:31.137264 2026] [:error] [pid 39184:tid 39228] [client 4.204.200.32:16256] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaMQ41tZF9Zd_U7easAQegAAAEk"]
[Sat Feb 28 23:59:32.016470 2026] [:error] [pid 11791:tid 11805] [client 4.204.200.32:59156] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws61.php"] [unique_id "aaMQ5GuX5e1Q32gqxH3xogAAAQw"]
[Sat Feb 28 23:59:33.004922 2026] [:error] [pid 52460:tid 52479] [client 4.204.200.32:59258] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaMQ5bLWOogAgHGh62T9VwAAAZA"]
[Sat Feb 28 23:59:34.778066 2026] [:error] [pid 39292:tid 39313] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Sat Feb 28 23:59:35.341060 2026] [:error] [pid 39292:tid 39308] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/ws59.php
[Sat Feb 28 23:59:35.551670 2026] [:error] [pid 39292:tid 39303] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Feb 28 23:59:36.087782 2026] [:error] [pid 39292:tid 39309] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/mamzi.php
[Sat Feb 28 23:59:36.299103 2026] [:error] [pid 39292:tid 39295] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Feb 28 23:59:36.511481 2026] [:error] [pid 39292:tid 39298] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Sat Feb 28 23:59:36.796575 2026] [:error] [pid 39292:tid 39302] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Sat Feb 28 23:59:37.005187 2026] [:error] [pid 39292:tid 39318] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Sat Feb 28 23:59:37.221462 2026] [:error] [pid 39292:tid 39299] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Sat Feb 28 23:59:37.506881 2026] [:error] [pid 39292:tid 39294] [client 4.204.200.32:59206] File does not exist: /usr/local/apache/htdocs/suspended-page/bb.php
[Sat Feb 28 23:59:37.718701 2026] [:error] [pid 39292:tid 39300] [client 4.204.200.32:59206] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dsd.php"] [unique_id "aaMQ6aIAO5fN7BxyqcG0NwAAAMY"]
[Sat Feb 28 23:59:38.419809 2026] [:error] [pid 39183:tid 39193] [client 4.204.200.32:59151] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dsd.php"] [unique_id "aaMQ6hCf4HvhVePw3LYLRQAAAAE"]
[Sat Feb 28 23:59:39.167380 2026] [:error] [pid 39184:tid 39225] [client 4.204.200.32:16340] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dsd.php"] [unique_id "aaMQ61tZF9Zd_U7easAQiAAAAEY"]
[Sat Feb 28 23:59:39.819507 2026] [:error] [pid 39183:tid 39208] [client 4.204.200.32:59243] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dsd.php"] [unique_id "aaMQ6xCf4HvhVePw3LYLTAAAABA"]
[Sat Feb 28 23:59:40.823543 2026] [:error] [pid 11791:tid 11793] [client 4.204.200.32:59182] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/guk.php"] [unique_id "aaMQ7GuX5e1Q32gqxH3xrwAAAQA"]
[Sat Feb 28 23:59:42.026696 2026] [:error] [pid 39184:tid 39231] [client 4.204.200.32:16363] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/guk.php"] [unique_id "aaMQ7ltZF9Zd_U7easAQlwAAAEw"]
[Sat Feb 28 23:59:42.720543 2026] [:error] [pid 52460:tid 52480] [client 4.204.200.32:16338] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/guk.php"] [unique_id "aaMQ7rLWOogAgHGh62T9awAAAZE"]
[Sat Feb 28 23:59:43.509843 2026] [:error] [pid 39183:tid 39215] [client 4.204.200.32:59253] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/guk.php"] [unique_id "aaMQ7xCf4HvhVePw3LYLVQAAABc"]
[Sat Feb 28 23:59:44.319186 2026] [:error] [pid 39184:tid 39236] [client 4.204.200.32:59262] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaMQ8FtZF9Zd_U7easAQngAAAFE"]
[Sat Feb 28 23:59:45.251604 2026] [:error] [pid 49763:tid 49778] [client 4.204.200.32:59203] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaMQ8bTHSOG_yf2PpqEvNAAAAcw"]
[Sat Feb 28 23:59:45.868538 2026] [:error] [pid 49763:tid 49779] [client 4.204.200.32:59233] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaMQ8bTHSOG_yf2PpqEvPQAAAc0"]
[Sat Feb 28 23:59:46.730595 2026] [:error] [pid 39184:tid 39234] [client 4.204.200.32:16369] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/vx.php"] [unique_id "aaMQ8ltZF9Zd_U7easAQqAAAAE8"]
[Sat Feb 28 23:59:47.381084 2026] [:error] [pid 22194:tid 22202] [client 4.204.200.32:59174] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ze.php"] [unique_id "aaMQ836mbajs3bzQGyvFRAAAAUY"]
[Sat Feb 28 23:59:48.246172 2026] [:error] [pid 49763:tid 49779] [client 4.204.200.32:59247] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ze.php"] [unique_id "aaMQ9LTHSOG_yf2PpqEvUAAAAc0"]
[Sat Feb 28 23:59:49.307344 2026] [:error] [pid 39183:tid 39202] [client 4.204.200.32:16341] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ze.php"] [unique_id "aaMQ9RCf4HvhVePw3LYLZgAAAAo"]
[Sat Feb 28 23:59:50.183091 2026] [:error] [pid 39183:tid 39212] [client 4.204.200.32:16349] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ze.php"] [unique_id "aaMQ9hCf4HvhVePw3LYLbAAAABQ"]
[Sat Feb 28 23:59:51.250830 2026] [:error] [pid 39183:tid 39207] [client 4.204.200.32:59202] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file52.php"] [unique_id "aaMQ9xCf4HvhVePw3LYLcAAAAA8"]
[Sat Feb 28 23:59:52.000062 2026] [:error] [pid 39183:tid 39201] [client 4.204.200.32:59170] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file52.php"] [unique_id "aaMQ9xCf4HvhVePw3LYLdgAAAAk"]
[Sat Feb 28 23:59:52.571778 2026] [:error] [pid 52460:tid 52473] [client 4.204.200.32:59141] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file52.php"] [unique_id "aaMQ-LLWOogAgHGh62T9iwAAAYo"]
[Sat Feb 28 23:59:53.171881 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:59189] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file52.php"] [unique_id "aaMQ-bTHSOG_yf2PpqEvYwAAAdQ"]
[Sat Feb 28 23:59:53.744610 2026] [:error] [pid 49763:tid 49784] [client 4.204.200.32:59193] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tax.php"] [unique_id "aaMQ-bTHSOG_yf2PpqEvaAAAAdI"]
[Sat Feb 28 23:59:54.416804 2026] [:error] [pid 39184:tid 39241] [client 4.204.200.32:16325] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tax.php"] [unique_id "aaMQ-ltZF9Zd_U7easAQsQAAAFY"]
[Sat Feb 28 23:59:55.184585 2026] [:error] [pid 11791:tid 11814] [client 4.204.200.32:59219] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tax.php"] [unique_id "aaMQ-2uX5e1Q32gqxH3xuQAAARU"]
[Sat Feb 28 23:59:55.892243 2026] [:error] [pid 11791:tid 11794] [client 4.204.200.32:16377] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tax.php"] [unique_id "aaMQ-2uX5e1Q32gqxH3xvAAAAQE"]
[Sat Feb 28 23:59:56.767636 2026] [:error] [pid 49763:tid 49777] [client 4.204.200.32:59241] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/an7.php"] [unique_id "aaMQ_LTHSOG_yf2PpqEvhgAAAcs"]
[Sat Feb 28 23:59:57.441785 2026] [:error] [pid 49763:tid 49790] [client 4.204.200.32:59173] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/an7.php"] [unique_id "aaMQ_bTHSOG_yf2PpqEvjwAAAdg"]
[Sat Feb 28 23:59:58.070446 2026] [:error] [pid 49763:tid 49777] [client 4.204.200.32:16320] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/an7.php"] [unique_id "aaMQ_rTHSOG_yf2PpqEvlwAAAcs"]
[Sat Feb 28 23:59:58.722503 2026] [:error] [pid 11791:tid 11799] [client 4.204.200.32:59259] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/an7.php"] [unique_id "aaMQ_muX5e1Q32gqxH3xwwAAAQY"]
[Sat Feb 28 23:59:59.351274 2026] [:error] [pid 39183:tid 39199] [client 4.204.200.32:16352] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ty.php"] [unique_id "aaMQ_xCf4HvhVePw3LYLiwAAAAc"]
[Sun Mar 01 00:00:00.273349 2026] [:error] [pid 39185:tid 39248] [client 4.204.200.32:16343] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ty.php"] [unique_id "aaMRABVE-FfM89u7BQbDwQAAAII"]
[Sun Mar 01 00:00:01.175246 2026] [:error] [pid 39184:tid 39227] [client 4.204.200.32:59140] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ty.php"] [unique_id "aaMRAVtZF9Zd_U7easAQuAAAAEg"]
[Sun Mar 01 00:00:02.040967 2026] [:error] [pid 39185:tid 39269] [client 4.204.200.32:59217] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ty.php"] [unique_id "aaMRAhVE-FfM89u7BQbDwgAAAJc"]
[Sun Mar 01 00:00:02.805615 2026] [:error] [pid 49763:tid 49788] [client 4.204.200.32:16375] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brc.php"] [unique_id "aaMRArTHSOG_yf2PpqEvrAAAAdY"]
[Sun Mar 01 00:00:03.695534 2026] [:error] [pid 39184:tid 39235] [client 4.204.200.32:59239] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brc.php"] [unique_id "aaMRA1tZF9Zd_U7easAQvgAAAFA"]
[Sun Mar 01 00:00:04.773752 2026] [:error] [pid 39184:tid 39224] [client 4.204.200.32:59263] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brc.php"] [unique_id "aaMRBFtZF9Zd_U7easAQxQAAAEU"]
[Sun Mar 01 00:00:05.579453 2026] [:error] [pid 39183:tid 39209] [client 4.204.200.32:16356] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/brc.php"] [unique_id "aaMRBRCf4HvhVePw3LYLoQAAABE"]
[Sun Mar 01 00:00:06.289684 2026] [:error] [pid 52460:tid 52485] [client 4.204.200.32:59197] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaMRBrLWOogAgHGh62T9ngAAAZY"]
[Sun Mar 01 00:00:07.203071 2026] [:error] [pid 52460:tid 52483] [client 4.204.200.32:16358] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaMRB7LWOogAgHGh62T9pAAAAZQ"]
[Sun Mar 01 00:00:07.824494 2026] [:error] [pid 39183:tid 39197] [client 4.204.200.32:59195] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaMRBxCf4HvhVePw3LYLpQAAAAU"]
[Sun Mar 01 00:00:08.354915 2026] [:error] [pid 39292:tid 39306] [client 4.204.200.32:16337] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/koiy.php"] [unique_id "aaMRCKIAO5fN7BxyqcG0VAAAAMw"]
[Sun Mar 01 00:00:09.185215 2026] [:error] [pid 39292:tid 39302] [client 4.204.200.32:59190] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaMRCaIAO5fN7BxyqcG0VgAAAMg"]
[Sun Mar 01 00:00:10.095000 2026] [:error] [pid 52460:tid 52481] [client 4.204.200.32:16329] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaMRCrLWOogAgHGh62T9qAAAAZI"]
[Sun Mar 01 00:00:10.688102 2026] [:error] [pid 39183:tid 39215] [client 4.204.200.32:59208] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaMRChCf4HvhVePw3LYLsgAAABc"]
[Sun Mar 01 00:00:11.304937 2026] [:error] [pid 39292:tid 39312] [client 4.204.200.32:59177] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "aaMRC6IAO5fN7BxyqcG0WQAAANI"]
[Sun Mar 01 00:00:11.952280 2026] [:error] [pid 52460:tid 52487] [client 4.204.200.32:16344] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaMRC7LWOogAgHGh62T9qwAAAZg"]
[Sun Mar 01 00:00:12.613657 2026] [:error] [pid 39183:tid 39199] [client 4.204.200.32:59255] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaMRDBCf4HvhVePw3LYLuwAAAAc"]
[Sun Mar 01 00:00:13.124519 2026] [:error] [pid 39183:tid 39210] [client 4.204.200.32:59148] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaMRDRCf4HvhVePw3LYLwQAAABI"]
[Sun Mar 01 00:00:14.012481 2026] [:error] [pid 39183:tid 39215] [client 4.204.200.32:16287] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fr/ms.php"] [unique_id "aaMRDhCf4HvhVePw3LYLxAAAABc"]
[Sun Mar 01 00:00:14.599800 2026] [:error] [pid 11791:tid 11817] [client 4.204.200.32:16323] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaMRDmuX5e1Q32gqxH3x1gAAARg"]
[Sun Mar 01 00:00:15.188361 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:59240] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaMRD7THSOG_yf2PpqEv4wAAAdQ"]
[Sun Mar 01 00:00:15.935608 2026] [:error] [pid 49763:tid 49777] [client 4.204.200.32:16368] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaMRD7THSOG_yf2PpqEv5wAAAcs"]
[Sun Mar 01 00:00:16.772240 2026] [:error] [pid 49763:tid 49779] [client 4.204.200.32:16331] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "aaMRELTHSOG_yf2PpqEv7wAAAc0"]
[Sun Mar 01 00:00:17.383315 2026] [:error] [pid 49763:tid 49769] [client 4.204.200.32:16350] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gool.php"] [unique_id "aaMREbTHSOG_yf2PpqEv9gAAAcM"]
[Sun Mar 01 00:00:18.064051 2026] [:error] [pid 39183:tid 39216] [client 4.204.200.32:59165] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gool.php"] [unique_id "aaMREhCf4HvhVePw3LYL1QAAABg"]
[Sun Mar 01 00:00:18.647439 2026] [:error] [pid 39183:tid 39199] [client 4.204.200.32:59180] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gool.php"] [unique_id "aaMREhCf4HvhVePw3LYL2AAAAAc"]
[Sun Mar 01 00:00:19.325767 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:16365] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gool.php"] [unique_id "aaMRE7THSOG_yf2PpqEwAwAAAdQ"]
[Sun Mar 01 00:00:19.936653 2026] [:error] [pid 39292:tid 39296] [client 4.204.200.32:16270] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaMRE6IAO5fN7BxyqcG0XAAAAMI"]
[Sun Mar 01 00:00:20.700363 2026] [:error] [pid 39292:tid 39305] [client 4.204.200.32:59172] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaMRFKIAO5fN7BxyqcG0YQAAAMs"]
[Sun Mar 01 00:00:21.489254 2026] [:error] [pid 39185:tid 39248] [client 4.204.200.32:16192] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaMRFRVE-FfM89u7BQbD0AAAAII"]
[Sun Mar 01 00:00:22.064599 2026] [:error] [pid 39292:tid 39306] [client 4.204.200.32:59191] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1vx.php"] [unique_id "aaMRFqIAO5fN7BxyqcG0ZAAAAMw"]
[Sun Mar 01 00:00:22.927146 2026] [:error] [pid 52460:tid 52483] [client 4.204.200.32:59209] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mans.php"] [unique_id "aaMRFrLWOogAgHGh62T9tgAAAZQ"]
[Sun Mar 01 00:00:23.620326 2026] [:error] [pid 52460:tid 52479] [client 4.204.200.32:16359] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mans.php"] [unique_id "aaMRF7LWOogAgHGh62T9twAAAZA"]
[Sun Mar 01 00:00:24.847739 2026] [:error] [pid 52460:tid 52469] [client 4.204.200.32:59248] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mans.php"] [unique_id "aaMRGLLWOogAgHGh62T9uwAAAYY"]
[Sun Mar 01 00:00:25.435515 2026] [:error] [pid 49763:tid 49767] [client 4.204.200.32:59250] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mans.php"] [unique_id "aaMRGbTHSOG_yf2PpqEwGgAAAcE"]
[Sun Mar 01 00:00:26.457592 2026] [:error] [pid 49763:tid 49782] [client 4.204.200.32:16353] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rum.php"] [unique_id "aaMRGrTHSOG_yf2PpqEwIQAAAdA"]
[Sun Mar 01 00:00:27.047251 2026] [:error] [pid 39184:tid 39223] [client 4.204.200.32:16282] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rum.php"] [unique_id "aaMRG1tZF9Zd_U7easAQ2gAAAEQ"]
[Sun Mar 01 00:00:27.640753 2026] [:error] [pid 39183:tid 39214] [client 4.204.200.32:16278] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rum.php"] [unique_id "aaMRGxCf4HvhVePw3LYL-wAAABY"]
[Sun Mar 01 00:00:28.475166 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:16290] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rum.php"] [unique_id "aaMRHLTHSOG_yf2PpqEwKAAAAdQ"]
[Sun Mar 01 00:00:29.123014 2026] [:error] [pid 49763:tid 49779] [client 4.204.200.32:59194] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMRHbTHSOG_yf2PpqEwLgAAAc0"]
[Sun Mar 01 00:00:30.045848 2026] [:error] [pid 52460:tid 52468] [client 4.204.200.32:16261] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMRHrLWOogAgHGh62T9zwAAAYU"]
[Sun Mar 01 00:00:30.774877 2026] [:error] [pid 39185:tid 39265] [client 4.204.200.32:59234] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMRHhVE-FfM89u7BQbD1QAAAJM"]
[Sun Mar 01 00:00:31.393994 2026] [:error] [pid 49763:tid 49766] [client 4.204.200.32:16265] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "aaMRH7THSOG_yf2PpqEwQAAAAcA"]
[Sun Mar 01 00:00:32.333938 2026] [:error] [pid 11791:tid 11797] [client 4.204.200.32:16275] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wio.php"] [unique_id "aaMRIGuX5e1Q32gqxH3x7QAAAQQ"]
[Sun Mar 01 00:00:33.071401 2026] [:error] [pid 49763:tid 49781] [client 4.204.200.32:59184] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wio.php"] [unique_id "aaMRIbTHSOG_yf2PpqEwSgAAAc8"]
[Sun Mar 01 00:00:34.173144 2026] [:error] [pid 39292:tid 39300] [client 4.204.200.32:16333] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wio.php"] [unique_id "aaMRIqIAO5fN7BxyqcG0awAAAMY"]
[Sun Mar 01 00:00:35.108538 2026] [:error] [pid 39292:tid 39314] [client 4.204.200.32:59176] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wio.php"] [unique_id "aaMRI6IAO5fN7BxyqcG0bwAAANQ"]
[Sun Mar 01 00:00:36.213763 2026] [:error] [pid 22194:tid 22201] [client 4.204.200.32:59171] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/clasa99.php"] [unique_id "aaMRJH6mbajs3bzQGyvFXAAAAUU"]
[Sun Mar 01 00:00:37.270678 2026] [:error] [pid 52460:tid 52468] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/clasa99.php
[Sun Mar 01 00:00:37.691217 2026] [:error] [pid 52460:tid 52483] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/ws62.php
[Sun Mar 01 00:00:38.151580 2026] [:error] [pid 52460:tid 52467] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sun Mar 01 00:00:38.360902 2026] [:error] [pid 52460:tid 52477] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sun Mar 01 00:00:38.770433 2026] [:error] [pid 52460:tid 52485] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Sun Mar 01 00:00:38.980837 2026] [:error] [pid 52460:tid 52465] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/cxc.php
[Sun Mar 01 00:00:39.204116 2026] [:error] [pid 52460:tid 52470] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/gjm.php
[Sun Mar 01 00:00:39.426507 2026] [:error] [pid 52460:tid 52481] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/ex.php
[Sun Mar 01 00:00:39.695868 2026] [:error] [pid 52460:tid 52468] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Sun Mar 01 00:00:39.920910 2026] [:error] [pid 52460:tid 52484] [client 4.204.200.32:59154] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Sun Mar 01 00:00:40.270633 2026] [:error] [pid 52460:tid 52475] [client 4.204.200.32:59154] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jq.php"] [unique_id "aaMRKLLWOogAgHGh62T98gAAAYw"]
[Sun Mar 01 00:00:41.256039 2026] [:error] [pid 52460:tid 52467] [client 4.204.200.32:16272] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jq.php"] [unique_id "aaMRKbLWOogAgHGh62T99wAAAYQ"]
[Sun Mar 01 00:00:42.425814 2026] [:error] [pid 52460:tid 52486] [client 4.204.200.32:16312] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jq.php"] [unique_id "aaMRKrLWOogAgHGh62T9_wAAAZc"]
[Sun Mar 01 00:00:42.976152 2026] [:error] [pid 52460:tid 52467] [client 4.204.200.32:16295] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jq.php"] [unique_id "aaMRKrLWOogAgHGh62T-BgAAAYQ"]
[Sun Mar 01 00:00:43.611692 2026] [:error] [pid 52460:tid 52465] [client 4.204.200.32:59229] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x7.php"] [unique_id "aaMRK7LWOogAgHGh62T-DAAAAYI"]
[Sun Mar 01 00:00:44.573622 2026] [:error] [pid 39183:tid 39211] [client 4.204.200.32:59188] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x7.php"] [unique_id "aaMRLBCf4HvhVePw3LYMTQAAABM"]
[Sun Mar 01 00:00:45.367864 2026] [:error] [pid 39183:tid 39200] [client 4.204.200.32:59256] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x7.php"] [unique_id "aaMRLRCf4HvhVePw3LYMWwAAAAg"]
[Sun Mar 01 00:00:46.283730 2026] [:error] [pid 39183:tid 39204] [client 4.204.200.32:59246] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/x7.php"] [unique_id "aaMRLhCf4HvhVePw3LYMZgAAAAw"]
[Sun Mar 01 00:00:46.843610 2026] [:error] [pid 39183:tid 39199] [client 4.204.200.32:59220] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bes.php"] [unique_id "aaMRLhCf4HvhVePw3LYMbQAAAAc"]
[Sun Mar 01 00:00:47.484742 2026] [:error] [pid 49763:tid 49777] [client 4.204.200.32:16296] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bes.php"] [unique_id "aaMRL7THSOG_yf2PpqEwbAAAAcs"]
[Sun Mar 01 00:00:48.385240 2026] [:error] [pid 49763:tid 49778] [client 4.204.200.32:59263] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bes.php"] [unique_id "aaMRMLTHSOG_yf2PpqEwcAAAAcw"]
[Sun Mar 01 00:00:48.950696 2026] [:error] [pid 11791:tid 11804] [client 4.204.200.32:16305] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bes.php"] [unique_id "aaMRMGuX5e1Q32gqxH3x9wAAAQs"]
[Sun Mar 01 00:00:49.744649 2026] [:error] [pid 52460:tid 52475] [client 4.204.200.32:16291] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaMRMbLWOogAgHGh62T-MAAAAYw"]
[Sun Mar 01 00:00:50.231724 2026] [:error] [pid 49763:tid 49766] [client 4.204.200.32:16304] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaMRMrTHSOG_yf2PpqEwdQAAAcA"]
[Sun Mar 01 00:00:50.913598 2026] [:error] [pid 39183:tid 39198] [client 4.204.200.32:16307] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaMRMhCf4HvhVePw3LYMkwAAAAY"]
[Sun Mar 01 00:00:51.541208 2026] [:error] [pid 39183:tid 39212] [client 4.204.200.32:59178] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadd.php"] [unique_id "aaMRMxCf4HvhVePw3LYMnAAAABQ"]
[Sun Mar 01 00:00:52.099654 2026] [:error] [pid 22194:tid 22217] [client 4.204.200.32:16351] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaMRNH6mbajs3bzQGyvFYwAAAVU"]
[Sun Mar 01 00:00:52.679888 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:16334] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaMRNLTHSOG_yf2PpqEwewAAAdQ"]
[Sun Mar 01 00:00:53.341508 2026] [:error] [pid 49763:tid 49776] [client 4.204.200.32:16302] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaMRNbTHSOG_yf2PpqEwgQAAAco"]
[Sun Mar 01 00:00:54.080075 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:16339] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/vgtyu.php"] [unique_id "aaMRNrTHSOG_yf2PpqEwiwAAAdQ"]
[Sun Mar 01 00:00:54.833128 2026] [:error] [pid 39183:tid 39195] [client 4.204.200.32:16354] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "aaMRNhCf4HvhVePw3LYMywAAAAM"]
[Sun Mar 01 00:00:55.540562 2026] [:error] [pid 11791:tid 11811] [client 4.204.200.32:16314] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "aaMRN2uX5e1Q32gqxH3x_AAAARI"]
[Sun Mar 01 00:00:56.117515 2026] [:error] [pid 49763:tid 49776] [client 4.204.200.32:59175] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "aaMROLTHSOG_yf2PpqEwkQAAAco"]
[Sun Mar 01 00:00:56.622092 2026] [:error] [pid 39183:tid 39215] [client 4.204.200.32:16326] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "aaMROBCf4HvhVePw3LYM3QAAABc"]
[Sun Mar 01 00:00:57.198639 2026] [:error] [pid 49763:tid 49767] [client 4.204.200.32:16283] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aaMRObTHSOG_yf2PpqEwkwAAAcE"]
[Sun Mar 01 00:00:57.896620 2026] [:error] [pid 49763:tid 49781] [client 4.204.200.32:16236] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aaMRObTHSOG_yf2PpqEwnAAAAc8"]
[Sun Mar 01 00:00:58.595371 2026] [:error] [pid 39183:tid 39206] [client 4.204.200.32:16366] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aaMROhCf4HvhVePw3LYM7QAAAA4"]
[Sun Mar 01 00:00:59.128523 2026] [:error] [pid 39183:tid 39198] [client 4.204.200.32:16292] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fs.php"] [unique_id "aaMROxCf4HvhVePw3LYM8gAAAAY"]
[Sun Mar 01 00:00:59.987670 2026] [:error] [pid 39184:tid 39238] [client 4.204.200.32:16347] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/c4.php"] [unique_id "aaMRO1tZF9Zd_U7easARPQAAAFM"]
[Sun Mar 01 00:01:00.683256 2026] [:error] [pid 22194:tid 22218] [client 4.204.200.32:16286] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/c4.php"] [unique_id "aaMRPH6mbajs3bzQGyvFZQAAAVY"]
[Sun Mar 01 00:01:01.383798 2026] [:error] [pid 49763:tid 49771] [client 4.204.200.32:59242] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/c4.php"] [unique_id "aaMRPbTHSOG_yf2PpqEwsAAAAcU"]
[Sun Mar 01 00:01:02.471210 2026] [:error] [pid 49763:tid 49775] [client 4.204.200.32:16321] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/c4.php"] [unique_id "aaMRPrTHSOG_yf2PpqEwwAAAAck"]
[Sun Mar 01 00:01:03.291075 2026] [:error] [pid 49763:tid 49787] [client 4.204.200.32:16229] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaMRP7THSOG_yf2PpqEwxwAAAdU"]
[Sun Mar 01 00:01:04.191768 2026] [:error] [pid 49763:tid 49789] [client 4.204.200.32:16288] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaMRQLTHSOG_yf2PpqEw1gAAAdc"]
[Sun Mar 01 00:01:04.766569 2026] [:error] [pid 49763:tid 49779] [client 4.204.200.32:59181] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaMRQLTHSOG_yf2PpqEw3QAAAc0"]
[Sun Mar 01 00:01:05.655409 2026] [:error] [pid 52460:tid 52467] [client 4.204.200.32:59186] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/eauu.php"] [unique_id "aaMRQbLWOogAgHGh62T-UwAAAYQ"]
[Sun Mar 01 00:01:06.284142 2026] [:error] [pid 49763:tid 49774] [client 4.204.200.32:16259] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fasx.php"] [unique_id "aaMRQrTHSOG_yf2PpqEw7gAAAcg"]
[Sun Mar 01 00:01:07.119378 2026] [:error] [pid 49763:tid 49787] [client 4.204.200.32:59196] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fasx.php"] [unique_id "aaMRQ7THSOG_yf2PpqEw-wAAAdU"]
[Sun Mar 01 00:01:07.873385 2026] [:error] [pid 11791:tid 11803] [client 4.204.200.32:16324] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fasx.php"] [unique_id "aaMRQ2uX5e1Q32gqxH3yBgAAAQo"]
[Sun Mar 01 00:01:08.777162 2026] [:error] [pid 39183:tid 39216] [client 4.204.200.32:16335] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fasx.php"] [unique_id "aaMRRBCf4HvhVePw3LYNKQAAABg"]
[Sun Mar 01 00:01:09.598271 2026] [:error] [pid 39183:tid 39214] [client 4.204.200.32:59187] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/opts.php"] [unique_id "aaMRRRCf4HvhVePw3LYNLgAAABY"]
[Sun Mar 01 00:01:10.370934 2026] [:error] [pid 39292:tid 39307] [client 4.204.200.32:16249] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/opts.php"] [unique_id "aaMRRqIAO5fN7BxyqcG0nQAAAM0"]
[Sun Mar 01 00:01:10.841804 2026] [:error] [pid 39184:tid 39221] [client 4.204.200.32:16310] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/opts.php"] [unique_id "aaMRRltZF9Zd_U7easARYwAAAEI"]
[Sun Mar 01 00:01:11.397974 2026] [:error] [pid 39183:tid 39205] [client 4.204.200.32:59199] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/opts.php"] [unique_id "aaMRRxCf4HvhVePw3LYNPgAAAA0"]
[Sun Mar 01 00:01:11.923212 2026] [:error] [pid 39292:tid 39318] [client 4.204.200.32:16244] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nzv.php"] [unique_id "aaMRR6IAO5fN7BxyqcG0nwAAANg"]
[Sun Mar 01 00:01:12.657614 2026] [:error] [pid 49763:tid 49787] [client 4.204.200.32:59179] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nzv.php"] [unique_id "aaMRSLTHSOG_yf2PpqExMAAAAdU"]
[Sun Mar 01 00:01:13.272283 2026] [:error] [pid 39183:tid 39193] [client 4.204.200.32:16230] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nzv.php"] [unique_id "aaMRSRCf4HvhVePw3LYNUAAAAAE"]
[Sun Mar 01 00:01:13.796314 2026] [:error] [pid 39183:tid 39198] [client 4.204.200.32:59192] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nzv.php"] [unique_id "aaMRSRCf4HvhVePw3LYNVwAAAAY"]
[Sun Mar 01 00:01:14.373576 2026] [:error] [pid 52460:tid 52484] [client 4.204.200.32:16258] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaMRSrLWOogAgHGh62T-egAAAZU"]
[Sun Mar 01 00:01:15.148810 2026] [:error] [pid 39183:tid 39198] [client 4.204.200.32:16376] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaMRSxCf4HvhVePw3LYNZQAAAAY"]
[Sun Mar 01 00:01:15.792173 2026] [:error] [pid 39183:tid 39207] [client 4.204.200.32:16373] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaMRSxCf4HvhVePw3LYNdQAAAA8"]
[Sun Mar 01 00:01:16.406222 2026] [:error] [pid 11791:tid 11814] [client 4.204.200.32:16346] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "aaMRTGuX5e1Q32gqxH3yFQAAARU"]
[Sun Mar 01 00:01:17.009410 2026] [:error] [pid 49763:tid 49789] [client 4.204.200.32:16223] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaMRTbTHSOG_yf2PpqExUAAAAdc"]
[Sun Mar 01 00:01:17.767690 2026] [:error] [pid 39183:tid 39200] [client 4.204.200.32:16381] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaMRTRCf4HvhVePw3LYNgAAAAAg"]
[Sun Mar 01 00:01:18.601746 2026] [:error] [pid 39183:tid 39197] [client 4.204.200.32:16284] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaMRThCf4HvhVePw3LYNiAAAAAU"]
[Sun Mar 01 00:01:19.978608 2026] [:error] [pid 39183:tid 39198] [client 4.204.200.32:16215] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byp8.php"] [unique_id "aaMRTxCf4HvhVePw3LYNkgAAAAY"]
[Sun Mar 01 00:01:20.840965 2026] [:error] [pid 49763:tid 49789] [client 4.204.200.32:16311] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nhr.php"] [unique_id "aaMRULTHSOG_yf2PpqExiQAAAdc"]
[Sun Mar 01 00:01:21.772858 2026] [:error] [pid 49763:tid 49767] [client 4.204.200.32:59252] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nhr.php"] [unique_id "aaMRUbTHSOG_yf2PpqExnQAAAcE"]
[Sun Mar 01 00:01:22.984733 2026] [:error] [pid 49763:tid 49777] [client 4.204.200.32:16157] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nhr.php"] [unique_id "aaMRUrTHSOG_yf2PpqExrwAAAcs"]
[Sun Mar 01 00:01:25.426147 2026] [:error] [pid 52460:tid 52466] [client 4.204.200.32:16289] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nhr.php"] [unique_id "aaMRVbLWOogAgHGh62T-pQAAAYM"]
[Sun Mar 01 00:01:26.051621 2026] [:error] [pid 52460:tid 52464] [client 4.204.200.32:16195] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaMRVrLWOogAgHGh62T-qQAAAYE"]
[Sun Mar 01 00:01:26.674747 2026] [:error] [pid 49763:tid 49770] [client 4.204.200.32:16372] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaMRVrTHSOG_yf2PpqExzAAAAcQ"]
[Sun Mar 01 00:01:27.686116 2026] [:error] [pid 39184:tid 39228] [client 4.204.200.32:16263] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaMRV1tZF9Zd_U7easARhQAAAEk"]
[Sun Mar 01 00:01:28.479758 2026] [:error] [pid 39292:tid 39300] [client 4.204.200.32:16313] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-access.php"] [unique_id "aaMRWKIAO5fN7BxyqcG0sAAAAMY"]
[Sun Mar 01 00:01:29.996172 2026] [:error] [pid 52460:tid 52483] [client 4.204.200.32:16211] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws79.php"] [unique_id "aaMRWbLWOogAgHGh62T-twAAAZQ"]
[Sun Mar 01 00:01:30.811603 2026] [:error] [pid 11791:tid 11815] [client 4.204.200.32:16297] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws79.php"] [unique_id "aaMRWmuX5e1Q32gqxH3yKwAAARY"]
[Sun Mar 01 00:01:31.657135 2026] [:error] [pid 49763:tid 49774] [client 4.204.200.32:59185] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws79.php"] [unique_id "aaMRW7THSOG_yf2PpqEx1AAAAcg"]
[Sun Mar 01 00:01:32.534012 2026] [:error] [pid 39183:tid 39211] [client 4.204.200.32:16382] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws79.php"] [unique_id "aaMRXBCf4HvhVePw3LYN6QAAABM"]
[Sun Mar 01 00:01:33.823780 2026] [:error] [pid 39184:tid 39240] [client 4.204.200.32:59221] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1061.php"] [unique_id "aaMRXVtZF9Zd_U7easARnwAAAFU"]
[Sun Mar 01 00:01:34.620237 2026] [:error] [pid 52460:tid 52480] [client 4.204.200.32:16367] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1061.php"] [unique_id "aaMRXrLWOogAgHGh62T-wAAAAZE"]
[Sun Mar 01 00:01:35.596808 2026] [:error] [pid 49763:tid 49774] [client 4.204.200.32:16269] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1061.php"] [unique_id "aaMRX7THSOG_yf2PpqEx5gAAAcg"]
[Sun Mar 01 00:01:36.253149 2026] [:error] [pid 52460:tid 52469] [client 4.204.200.32:16330] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1061.php"] [unique_id "aaMRYLLWOogAgHGh62T-yAAAAYY"]
[Sun Mar 01 00:01:37.051009 2026] [:error] [pid 49763:tid 49782] [client 4.204.200.32:16342] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zwq13.php"] [unique_id "aaMRYbTHSOG_yf2PpqEx8wAAAdA"]
[Sun Mar 01 00:01:37.927141 2026] [:error] [pid 49763:tid 49787] [client 4.204.200.32:16345] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zwq13.php"] [unique_id "aaMRYbTHSOG_yf2PpqEyBAAAAdU"]
[Sun Mar 01 00:01:38.944029 2026] [:error] [pid 49763:tid 49766] [client 4.204.200.32:16306] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zwq13.php"] [unique_id "aaMRYrTHSOG_yf2PpqEyCgAAAcA"]
[Sun Mar 01 00:01:39.429988 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq13.php
[Sun Mar 01 00:01:39.645225 2026] [:error] [pid 49763:tid 49773] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/hello.php
[Sun Mar 01 00:01:39.884919 2026] [:error] [pid 49763:tid 49787] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/05.php
[Sun Mar 01 00:01:40.112863 2026] [:error] [pid 49763:tid 49772] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/zxin.php
[Sun Mar 01 00:01:40.331827 2026] [:error] [pid 49763:tid 49778] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sun Mar 01 00:01:40.694658 2026] [:error] [pid 49763:tid 49770] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Sun Mar 01 00:01:40.914537 2026] [:error] [pid 49763:tid 49777] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Mar 01 00:01:41.142876 2026] [:error] [pid 49763:tid 49768] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/iko.php
[Sun Mar 01 00:01:41.530884 2026] [:error] [pid 49763:tid 49785] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/xmy.php
[Sun Mar 01 00:01:41.756796 2026] [:error] [pid 49763:tid 49766] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/fun.php
[Sun Mar 01 00:01:41.969572 2026] [:error] [pid 49763:tid 49776] [client 4.204.200.32:16250] File does not exist: /usr/local/apache/htdocs/suspended-page/end.php
[Sun Mar 01 00:01:42.181153 2026] [:error] [pid 49763:tid 49779] [client 4.204.200.32:16250] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaMRZrTHSOG_yf2PpqEyMQAAAc0"]
[Sun Mar 01 00:01:43.712378 2026] [:error] [pid 39185:tid 39254] [client 4.204.200.32:16361] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaMRZxVE-FfM89u7BQbECQAAAIg"]
[Sun Mar 01 00:01:44.810893 2026] [:error] [pid 39184:tid 39225] [client 4.204.200.32:16221] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaMRaFtZF9Zd_U7easARtwAAAEY"]
[Sun Mar 01 00:01:45.400950 2026] [:error] [pid 39184:tid 39242] [client 4.204.200.32:16218] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ah25.php"] [unique_id "aaMRaVtZF9Zd_U7easARvAAAAFc"]
[Sun Mar 01 00:01:45.907192 2026] [:error] [pid 22194:tid 22197] [client 4.204.200.32:16301] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scx.php7"] [unique_id "aaMRaX6mbajs3bzQGyvFmgAAAUE"]
[Sun Mar 01 00:01:47.315155 2026] [:error] [pid 39292:tid 39308] [client 4.204.200.32:16309] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scx.php7"] [unique_id "aaMRa6IAO5fN7BxyqcG04wAAAM4"]
[Sun Mar 01 00:01:48.414680 2026] [:error] [pid 49763:tid 49774] [client 4.204.200.32:16315] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scx.php7"] [unique_id "aaMRbLTHSOG_yf2PpqEyTgAAAcg"]
[Sun Mar 01 00:01:49.662670 2026] [:error] [pid 52460:tid 52485] [client 4.204.200.32:16267] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/scx.php7"] [unique_id "aaMRbbLWOogAgHGh62T-2AAAAZY"]
[Sun Mar 01 00:01:50.488203 2026] [:error] [pid 52460:tid 52464] [client 4.204.200.32:16262] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/error1.php"] [unique_id "aaMRbrLWOogAgHGh62T-3wAAAYE"]
[Sun Mar 01 00:01:51.895988 2026] [:error] [pid 39183:tid 39208] [client 4.204.200.32:16285] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/error1.php"] [unique_id "aaMRbxCf4HvhVePw3LYOAgAAABA"]
[Sun Mar 01 00:01:52.868180 2026] [:error] [pid 39183:tid 39198] [client 4.204.200.32:16380] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/error1.php"] [unique_id "aaMRcBCf4HvhVePw3LYOAwAAAAY"]
[Sun Mar 01 00:01:54.116070 2026] [:error] [pid 39183:tid 39205] [client 4.204.200.32:16318] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/error1.php"] [unique_id "aaMRchCf4HvhVePw3LYOCAAAAA0"]
[Sun Mar 01 00:01:55.185151 2026] [:error] [pid 52460:tid 52487] [client 4.204.200.32:16209] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMRc7LWOogAgHGh62T-7gAAAZg"]
[Sun Mar 01 00:01:56.329098 2026] [:error] [pid 39185:tid 39256] [client 4.204.200.32:59166] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMRdBVE-FfM89u7BQbEHwAAAIo"]
[Sun Mar 01 00:01:57.408787 2026] [:error] [pid 39184:tid 39233] [client 4.204.200.32:16327] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMRdVtZF9Zd_U7easARzQAAAE4"]
[Sun Mar 01 00:01:58.486831 2026] [:error] [pid 49763:tid 49783] [client 4.204.200.32:16379] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/thui.php"] [unique_id "aaMRdrTHSOG_yf2PpqEytAAAAdE"]
[Sun Mar 01 00:02:00.089197 2026] [:error] [pid 52460:tid 52482] [client 4.204.200.32:16182] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaMReLLWOogAgHGh62T_GwAAAZM"]
[Sun Mar 01 00:02:01.083205 2026] [:error] [pid 49763:tid 49768] [client 4.204.200.32:16239] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaMRebTHSOG_yf2PpqEy3AAAAcI"]
[Sun Mar 01 00:02:01.876371 2026] [:error] [pid 49763:tid 49782] [client 4.204.200.32:16348] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaMRebTHSOG_yf2PpqEy4gAAAdA"]
[Sun Mar 01 00:02:02.586474 2026] [:error] [pid 49763:tid 49781] [client 4.204.200.32:16276] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ff1.php"] [unique_id "aaMRerTHSOG_yf2PpqEy5wAAAc8"]
[Sun Mar 01 00:02:03.229362 2026] [:error] [pid 39183:tid 39206] [client 4.204.200.32:16281] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/sc.php"] [unique_id "aaMRexCf4HvhVePw3LYOTgAAAA4"]
[Sun Mar 01 00:02:04.361911 2026] [:error] [pid 39292:tid 39315] [client 4.204.200.32:16216] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/sc.php"] [unique_id "aaMRfKIAO5fN7BxyqcG1HAAAANU"]
[Sun Mar 01 00:02:05.553228 2026] [:error] [pid 39183:tid 39206] [client 4.204.200.32:16200] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/sc.php"] [unique_id "aaMRfRCf4HvhVePw3LYOXgAAAA4"]
[Sun Mar 01 00:02:07.364302 2026] [:error] [pid 39183:tid 39206] [client 4.204.200.32:16257] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/sc.php"] [unique_id "aaMRfxCf4HvhVePw3LYObQAAAA4"]
[Sun Mar 01 00:02:08.557856 2026] [:error] [pid 22194:tid 22201] [client 4.204.200.32:16279] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaMRgH6mbajs3bzQGyvFpwAAAUU"]
[Sun Mar 01 00:02:09.670894 2026] [:error] [pid 52460:tid 52476] [client 4.204.200.32:16196] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaMRgbLWOogAgHGh62T_NwAAAY0"]
[Sun Mar 01 00:02:11.067929 2026] [:error] [pid 39184:tid 39222] [client 4.204.200.32:16274] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaMRg1tZF9Zd_U7easASJwAAAEM"]
[Sun Mar 01 00:02:13.615150 2026] [:error] [pid 49763:tid 49772] [client 4.204.200.32:16232] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-act.php"] [unique_id "aaMRhbTHSOG_yf2PpqEzEAAAAcY"]
[Sun Mar 01 00:02:14.447126 2026] [:error] [pid 52460:tid 52464] [client 4.204.200.32:16206] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaMRhrLWOogAgHGh62T_RwAAAYE"]
[Sun Mar 01 00:02:16.403197 2026] [:error] [pid 49763:tid 49781] [client 4.204.200.32:16213] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaMRiLTHSOG_yf2PpqEzJgAAAc8"]
[Sun Mar 01 00:02:17.461544 2026] [:error] [pid 52460:tid 52468] [client 4.204.200.32:16374] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaMRibLWOogAgHGh62T_TgAAAYU"]
[Sun Mar 01 00:02:18.071287 2026] [:error] [pid 39292:tid 39304] [client 4.204.200.32:16370] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "aaMRiqIAO5fN7BxyqcG1NQAAAMo"]
[Sun Mar 01 00:02:19.287722 2026] [:error] [pid 39292:tid 39297] [client 4.204.200.32:16210] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rpk.php"] [unique_id "aaMRi6IAO5fN7BxyqcG1NgAAAMM"]
[Sun Mar 01 00:02:21.384638 2026] [:error] [pid 39292:tid 39302] [client 4.204.200.32:16146] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rpk.php"] [unique_id "aaMRjaIAO5fN7BxyqcG1OgAAAMg"]
[Sun Mar 01 00:02:22.484960 2026] [:error] [pid 39183:tid 39197] [client 4.204.200.32:16199] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rpk.php"] [unique_id "aaMRjhCf4HvhVePw3LYOoQAAAAU"]
[Sun Mar 01 00:02:23.597806 2026] [:error] [pid 52460:tid 52463] [client 4.204.200.32:16316] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/rpk.php"] [unique_id "aaMRj7LWOogAgHGh62T_fAAAAYA"]
[Sun Mar 01 00:02:24.621917 2026] [:error] [pid 39292:tid 39307] [client 4.204.200.32:16194] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaMRkKIAO5fN7BxyqcG1PwAAAM0"]
[Sun Mar 01 00:02:25.600669 2026] [:error] [pid 49763:tid 49773] [client 4.204.200.32:16251] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaMRkbTHSOG_yf2PpqEzUwAAAcc"]
[Sun Mar 01 00:02:27.246078 2026] [:error] [pid 39183:tid 39198] [client 4.204.200.32:16360] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaMRkxCf4HvhVePw3LYOrwAAAAY"]
[Sun Mar 01 00:02:27.921763 2026] [:error] [pid 22194:tid 22214] [client 4.204.200.32:16378] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms.php"] [unique_id "aaMRk36mbajs3bzQGyvFqQAAAVI"]
[Sun Mar 01 00:02:29.318970 2026] [:error] [pid 11791:tid 11811] [client 4.204.200.32:16201] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/155.php"] [unique_id "aaMRlWuX5e1Q32gqxH3ycQAAARI"]
[Sun Mar 01 00:02:31.070595 2026] [:error] [pid 39292:tid 39301] [client 4.204.200.32:16231] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/155.php"] [unique_id "aaMRl6IAO5fN7BxyqcG1RwAAAMc"]
[Sun Mar 01 00:02:31.912092 2026] [:error] [pid 22194:tid 22215] [client 4.204.200.32:16156] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/155.php"] [unique_id "aaMRl36mbajs3bzQGyvFrAAAAVM"]
[Sun Mar 01 00:02:33.253633 2026] [:error] [pid 39183:tid 39206] [client 4.204.200.32:16139] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/155.php"] [unique_id "aaMRmRCf4HvhVePw3LYOxAAAAA4"]
[Sun Mar 01 00:02:34.156875 2026] [:error] [pid 39183:tid 39199] [client 4.204.200.32:16133] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/e.php"] [unique_id "aaMRmhCf4HvhVePw3LYOzQAAAAc"]
[Sun Mar 01 00:02:35.681317 2026] [:error] [pid 49763:tid 49775] [client 4.204.200.32:16224] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/e.php"] [unique_id "aaMRm7THSOG_yf2PpqEztgAAAck"]
[Sun Mar 01 00:02:37.315705 2026] [:error] [pid 11791:tid 11800] [client 4.204.200.32:16242] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/e.php"] [unique_id "aaMRnWuX5e1Q32gqxH3ydQAAAQc"]
[Sun Mar 01 00:02:38.319130 2026] [:error] [pid 39183:tid 39215] [client 4.204.200.32:16317] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/e.php"] [unique_id "aaMRnhCf4HvhVePw3LYO5gAAABc"]
[Sun Mar 01 00:02:39.079047 2026] [:error] [pid 49763:tid 49766] [client 4.204.200.32:16217] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aaMRn7THSOG_yf2PpqEz1gAAAcA"]
[Sun Mar 01 00:02:40.187185 2026] [:error] [pid 49763:tid 49782] [client 4.204.200.32:16202] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/forbidals.php"] [unique_id "aaMRoLTHSOG_yf2PpqEz4QAAAdA"]
[Sun Mar 01 00:02:41.421569 2026] [:error] [pid 49763:tid 49790] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Sun Mar 01 00:02:41.793528 2026] [:error] [pid 49763:tid 49780] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Sun Mar 01 00:02:42.004011 2026] [:error] [pid 49763:tid 49778] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Sun Mar 01 00:02:42.213780 2026] [:error] [pid 49763:tid 49775] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/get.php
[Sun Mar 01 00:02:42.684547 2026] [:error] [pid 49763:tid 49788] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Sun Mar 01 00:02:43.246313 2026] [:error] [pid 49763:tid 49778] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Sun Mar 01 00:02:43.465221 2026] [:error] [pid 49763:tid 49775] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sun Mar 01 00:02:43.674853 2026] [:error] [pid 49763:tid 49783] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Sun Mar 01 00:02:43.884817 2026] [:error] [pid 49763:tid 49789] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Mar 01 00:02:44.116869 2026] [:error] [pid 49763:tid 49788] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Sun Mar 01 00:02:44.473523 2026] [:error] [pid 49763:tid 49773] [client 4.204.200.32:16362] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Sun Mar 01 00:02:44.700779 2026] [:error] [pid 49763:tid 49787] [client 4.204.200.32:16362] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaMRpLTHSOG_yf2PpqE0DAAAAdU"]
[Sun Mar 01 00:02:46.530650 2026] [:error] [pid 39184:tid 39243] [client 4.204.200.32:59138] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaMRpltZF9Zd_U7easAScwAAAFg"]
[Sun Mar 01 00:02:47.841794 2026] [:error] [pid 52460:tid 52484] [client 4.204.200.32:16273] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaMRp7LWOogAgHGh62QADgAAAZU"]
[Sun Mar 01 00:02:48.866130 2026] [:error] [pid 39183:tid 39208] [client 4.204.200.32:16135] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/erty.php"] [unique_id "aaMRqBCf4HvhVePw3LYPAwAAABA"]
[Sun Mar 01 00:02:49.935827 2026] [:error] [pid 39184:tid 39226] [client 4.204.200.32:16219] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0.php"] [unique_id "aaMRqVtZF9Zd_U7easASdwAAAEc"]
[Sun Mar 01 00:02:51.142682 2026] [:error] [pid 39183:tid 39196] [client 4.204.200.32:16248] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0.php"] [unique_id "aaMRqxCf4HvhVePw3LYPDAAAAAQ"]
[Sun Mar 01 00:02:52.527316 2026] [:error] [pid 52460:tid 52466] [client 4.204.200.32:16303] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0.php"] [unique_id "aaMRrLLWOogAgHGh62QAFwAAAYM"]
[Sun Mar 01 00:02:53.184053 2026] [:error] [pid 49763:tid 49773] [client 4.204.200.32:16143] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0.php"] [unique_id "aaMRrbTHSOG_yf2PpqE0HgAAAcc"]
[Sun Mar 01 00:02:54.235624 2026] [:error] [pid 49763:tid 49780] [client 4.204.200.32:16355] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon.php"] [unique_id "aaMRrrTHSOG_yf2PpqE0JQAAAc4"]
[Sun Mar 01 00:02:55.082596 2026] [:error] [pid 39183:tid 39195] [client 4.204.200.32:16069] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon.php"] [unique_id "aaMRrxCf4HvhVePw3LYPHwAAAAM"]
[Sun Mar 01 00:02:56.648824 2026] [:error] [pid 49763:tid 49780] [client 4.204.200.32:59155] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon.php"] [unique_id "aaMRsLTHSOG_yf2PpqE0LQAAAc4"]
[Sun Mar 01 00:02:57.645296 2026] [:error] [pid 52460:tid 52467] [client 4.204.200.32:16242] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/moon.php"] [unique_id "aaMRsbLWOogAgHGh62QAKQAAAYQ"]
[Sun Mar 01 00:02:58.198118 2026] [:error] [pid 52460:tid 52484] [client 4.204.200.32:16235] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "aaMRsrLWOogAgHGh62QAKwAAAZU"]
[Sun Mar 01 00:02:59.263196 2026] [:error] [pid 52460:tid 52479] [client 4.204.200.32:59182] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "aaMRs7LWOogAgHGh62QALgAAAZA"]
[Sun Mar 01 00:03:00.938000 2026] [:error] [pid 11791:tid 11796] [client 4.204.200.32:16247] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "aaMRtGuX5e1Q32gqxH3ynQAAAQM"]
[Sun Mar 01 00:03:02.302748 2026] [:error] [pid 52460:tid 52474] [client 4.204.200.32:59169] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "aaMRtrLWOogAgHGh62QAOQAAAYs"]
[Sun Mar 01 00:03:03.036277 2026] [:error] [pid 49763:tid 49787] [client 4.204.200.32:59213] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gec.php"] [unique_id "aaMRt7THSOG_yf2PpqE0NwAAAdU"]
[Sun Mar 01 00:03:03.938436 2026] [:error] [pid 52460:tid 52464] [client 4.204.200.32:16207] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gec.php"] [unique_id "aaMRt7LWOogAgHGh62QAPgAAAYE"]
[Sun Mar 01 00:03:04.530821 2026] [:error] [pid 49763:tid 49770] [client 4.204.200.32:59139] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gec.php"] [unique_id "aaMRuLTHSOG_yf2PpqE0RAAAAcQ"]
[Sun Mar 01 00:03:05.267520 2026] [:error] [pid 39183:tid 39213] [client 4.204.200.32:16304] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gec.php"] [unique_id "aaMRuRCf4HvhVePw3LYPOQAAABU"]
[Sun Mar 01 00:03:06.557093 2026] [:error] [pid 49763:tid 49783] [client 4.204.200.32:59145] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sxdfrt.php"] [unique_id "aaMRurTHSOG_yf2PpqE0VgAAAdE"]
[Sun Mar 01 00:03:07.620459 2026] [:error] [pid 49763:tid 49776] [client 4.204.200.32:59200] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sxdfrt.php"] [unique_id "aaMRu7THSOG_yf2PpqE0YgAAAco"]
[Sun Mar 01 00:03:09.225955 2026] [:error] [pid 39183:tid 39215] [client 4.204.200.32:16357] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sxdfrt.php"] [unique_id "aaMRvRCf4HvhVePw3LYPPwAAABc"]
[Sun Mar 01 00:03:10.297069 2026] [:error] [pid 39183:tid 39203] [client 4.204.200.32:59207] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sxdfrt.php"] [unique_id "aaMRvhCf4HvhVePw3LYPRAAAAAs"]
[Sun Mar 01 00:03:11.356296 2026] [:error] [pid 49763:tid 49776] [client 4.204.200.32:16280] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMRv7THSOG_yf2PpqE0eAAAAco"]
[Sun Mar 01 00:03:12.643886 2026] [:error] [pid 39184:tid 39228] [client 4.204.200.32:59160] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMRwFtZF9Zd_U7easASngAAAEk"]
[Sun Mar 01 00:03:14.286821 2026] [:error] [pid 39292:tid 39310] [client 4.204.200.32:16220] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMRwqIAO5fN7BxyqcG1YQAAANA"]
[Sun Mar 01 00:03:15.426009 2026] [:error] [pid 52460:tid 52486] [client 4.204.200.32:59204] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "aaMRw7LWOogAgHGh62QAUgAAAZc"]
[Sun Mar 01 00:03:16.129871 2026] [:error] [pid 39184:tid 39242] [client 4.204.200.32:16268] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaMRxFtZF9Zd_U7easASrwAAAFc"]
[Sun Mar 01 00:03:17.358451 2026] [:error] [pid 39183:tid 39206] [client 4.204.200.32:16371] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaMRxRCf4HvhVePw3LYPXgAAAA4"]
[Sun Mar 01 00:03:18.524094 2026] [:error] [pid 11791:tid 11805] [client 4.204.200.32:59201] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaMRxmuX5e1Q32gqxH3ypQAAAQw"]
[Sun Mar 01 00:03:19.659207 2026] [:error] [pid 52460:tid 52480] [client 4.204.200.32:16134] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "aaMRx7LWOogAgHGh62QAXAAAAZE"]
[Sun Mar 01 00:03:20.699690 2026] [:error] [pid 39184:tid 39229] [client 4.204.200.32:16203] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "aaMRyFtZF9Zd_U7easASvQAAAEo"]
[Sun Mar 01 00:03:21.432878 2026] [:error] [pid 39183:tid 39200] [client 4.204.200.32:59162] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "aaMRyRCf4HvhVePw3LYPbwAAAAg"]
[Sun Mar 01 00:03:22.593527 2026] [:error] [pid 39184:tid 39235] [client 4.204.200.32:16308] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "aaMRyltZF9Zd_U7easASxAAAAFA"]
[Sun Mar 01 00:03:24.178244 2026] [:error] [pid 52460:tid 52480] [client 4.204.200.32:59228] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "aaMRzLLWOogAgHGh62QAawAAAZE"]
[Sun Mar 01 00:03:25.373597 2026] [:error] [pid 11791:tid 11793] [client 4.204.200.32:16130] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ocxla.php"] [unique_id "aaMRzWuX5e1Q32gqxH3yqQAAAQA"]
[Sun Mar 01 00:03:27.297070 2026] [:error] [pid 11791:tid 11807] [client 4.204.200.32:16222] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ocxla.php"] [unique_id "aaMRz2uX5e1Q32gqxH3yrQAAAQ4"]
[Sun Mar 01 00:03:28.341599 2026] [:error] [pid 11791:tid 11816] [client 4.204.200.32:16298] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ocxla.php"] [unique_id "aaMR0GuX5e1Q32gqxH3yswAAARc"]
[Sun Mar 01 00:03:28.975363 2026] [:error] [pid 49763:tid 49788] [client 4.204.200.32:16065] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ocxla.php"] [unique_id "aaMR0LTHSOG_yf2PpqE0hwAAAdY"]
[Sun Mar 01 00:03:29.673680 2026] [:error] [pid 22194:tid 22202] [client 4.204.200.32:16243] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaMR0X6mbajs3bzQGyvFwAAAAUY"]
[Sun Mar 01 00:03:30.656829 2026] [:error] [pid 11791:tid 11812] [client 4.204.200.32:16148] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaMR0muX5e1Q32gqxH3yvwAAARM"]
[Sun Mar 01 00:03:31.695627 2026] [:error] [pid 49763:tid 49772] [client 4.204.200.32:59235] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaMR07THSOG_yf2PpqE0mgAAAcY"]
[Sun Mar 01 00:03:32.403282 2026] [:error] [pid 52460:tid 52474] [client 4.204.200.32:16225] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/god.php"] [unique_id "aaMR1LLWOogAgHGh62QAewAAAYs"]
[Sun Mar 01 00:03:33.297093 2026] [:error] [pid 39183:tid 39203] [client 4.204.200.32:16240] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaMR1RCf4HvhVePw3LYPgQAAAAs"]
[Sun Mar 01 00:03:34.057577 2026] [:error] [pid 39184:tid 39237] [client 4.204.200.32:59249] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaMR1ltZF9Zd_U7easAS0wAAAFI"]
[Sun Mar 01 00:03:34.789240 2026] [:error] [pid 39184:tid 39235] [client 4.204.200.32:59146] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaMR1ltZF9Zd_U7easAS1AAAAFA"]
[Sun Mar 01 00:03:35.574476 2026] [:error] [pid 39184:tid 39233] [client 4.204.200.32:16144] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cu.php"] [unique_id "aaMR11tZF9Zd_U7easAS2AAAAE4"]
[Sun Mar 01 00:03:36.142854 2026] [:error] [pid 52460:tid 52468] [client 4.204.200.32:59260] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zz.php"] [unique_id "aaMR2LLWOogAgHGh62QAjwAAAYU"]
[Sun Mar 01 00:03:37.020246 2026] [:error] [pid 49763:tid 49786] [client 4.204.200.32:59237] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zz.php"] [unique_id "aaMR2bTHSOG_yf2PpqE0pAAAAdQ"]
[Sun Mar 01 00:03:38.244296 2026] [:error] [pid 52460:tid 52468] [client 4.204.200.32:16188] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zz.php"] [unique_id "aaMR2rLWOogAgHGh62QAoQAAAYU"]
[Sun Mar 01 00:03:39.440419 2026] [:error] [pid 52460:tid 52475] [client 4.204.200.32:59231] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zz.php"] [unique_id "aaMR27LWOogAgHGh62QAqgAAAYw"]
[Sun Mar 01 00:03:40.169347 2026] [:error] [pid 52460:tid 52466] [client 4.204.200.32:59156] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaMR3LLWOogAgHGh62QArgAAAYM"]
[Sun Mar 01 00:03:40.807012 2026] [:error] [pid 39184:tid 39239] [client 4.204.200.32:59137] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaMR3FtZF9Zd_U7easAS4QAAAFQ"]
[Sun Mar 01 00:03:41.678999 2026] [:error] [pid 39183:tid 39212] [client 4.204.200.32:59164] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaMR3RCf4HvhVePw3LYPjAAAABQ"]
[Sun Mar 01 00:03:42.909028 2026] [:error] [pid 39292:tid 39307] [client 4.204.200.32:59211] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xqq.php"] [unique_id "aaMR3qIAO5fN7BxyqcG1fQAAAM0"]
[Sun Mar 01 00:03:43.482102 2026] [:error] [pid 22194:tid 22196] [client 4.204.200.32:16214] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sdsa.php"] [unique_id "aaMR336mbajs3bzQGyvF0wAAAUA"]
[Sun Mar 01 00:03:44.560423 2026] [:error] [pid 22194:tid 22220] [client 4.204.200.32:59236] File does not exist: /usr/local/apache/htdocs/suspended-page/sdsa.php
[Sun Mar 01 00:03:44.775765 2026] [:error] [pid 22194:tid 22210] [client 4.204.200.32:59236] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun Mar 01 00:03:45.014460 2026] [:error] [pid 22194:tid 22203] [client 4.204.200.32:59236] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Mar 01 00:03:45.230446 2026] [:error] [pid 22194:tid 22204] [client 4.204.200.32:59236] File does not exist: /usr/local/apache/htdocs/suspended-page/un.php
[Sun Mar 01 00:03:45.618743 2026] [:error] [pid 22194:tid 22207] [client 4.204.200.32:59236] File does not exist: /usr/local/apache/htdocs/suspended-page/100.kb.php
[Sun Mar 01 00:03:45.833089 2026] [:error] [pid 22194:tid 22214] [client 4.204.200.32:59236] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sun Mar 01 00:49:28.672132 2026] [:error] [pid 7644:tid 7669] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Mar 01 00:49:28.957622 2026] [:error] [pid 7644:tid 7667] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 01 00:49:30.461102 2026] [:error] [pid 7644:tid 7667] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Mar 01 00:49:30.898348 2026] [:error] [pid 7644:tid 7670] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Mar 01 00:49:31.198599 2026] [:error] [pid 7644:tid 7665] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Mar 01 00:49:31.525732 2026] [:error] [pid 7644:tid 7664] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Mar 01 00:49:31.860462 2026] [:error] [pid 7644:tid 7668] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 00:49:32.214999 2026] [:error] [pid 7644:tid 7662] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 00:49:33.308490 2026] [:error] [pid 7644:tid 7649] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Mar 01 00:49:33.949616 2026] [:error] [pid 7644:tid 7668] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Mar 01 00:49:34.432508 2026] [:error] [pid 7644:tid 7652] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Mar 01 00:49:34.786952 2026] [:error] [pid 7644:tid 7659] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 01 00:49:35.103697 2026] [:error] [pid 7644:tid 7663] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Mar 01 00:49:35.771231 2026] [:error] [pid 7644:tid 7656] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 01 00:49:36.195336 2026] [:error] [pid 7644:tid 7652] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Mar 01 00:49:36.516616 2026] [:error] [pid 7644:tid 7661] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Mar 01 00:49:36.863145 2026] [:error] [pid 7644:tid 7666] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Mar 01 00:49:37.191235 2026] [:error] [pid 7644:tid 7665] [client 45.86.200.249:60991] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Mar 01 00:49:43.123273 2026] [:error] [pid 7644:tid 7660] [client 45.86.200.249:60991] [client 45.86.200.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaMcp_qeDUGmVAHX7VCLjQAAAU4"]
[Sun Mar 01 00:49:46.078068 2026] [:error] [pid 30797:tid 30878] [client 45.86.200.241:35599] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaMcqvQmcmSQL-3rvLAATwAAAEc"]
[Sun Mar 01 00:49:47.715320 2026] [:error] [pid 7644:tid 7666] [client 45.86.200.217:25759] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Mar 01 00:49:48.684344 2026] [:error] [pid 7644:tid 7660] [client 45.86.200.217:25759] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaMcrPqeDUGmVAHX7VCLswAAAU4"]
[Sun Mar 01 00:49:50.002276 2026] [:error] [pid 30797:tid 30890] [client 45.86.200.223:31005] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 00:49:50.399047 2026] [:error] [pid 30797:tid 30895] [client 45.86.200.223:31005] [client 45.86.200.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaMcrvQmcmSQL-3rvLAAVAAAAFg"]
[Sun Mar 01 00:49:51.388515 2026] [:error] [pid 7644:tid 7653] [client 45.86.200.219:59217] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Mar 01 00:49:53.061307 2026] [:error] [pid 7644:tid 7661] [client 45.86.200.219:59217] [client 45.86.200.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaMcsfqeDUGmVAHX7VCL0wAAAU8"]
[Sun Mar 01 00:49:54.135541 2026] [:error] [pid 30795:tid 30826] [client 45.86.200.226:59281] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaMcsmuI44IL94Zgti-2BwAAABI"]
[Sun Mar 01 00:49:55.184833 2026] [:error] [pid 31190:tid 31221] [client 45.86.200.225:45081] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaMcsxfvwGOholYpM1FY9QAAAM8"]
[Sun Mar 01 00:49:55.788918 2026] [:error] [pid 30795:tid 30828] [client 185.82.72.104:45013] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaMcs2uI44IL94Zgti-2CgAAABQ"]
[Sun Mar 01 00:49:56.481993 2026] [:error] [pid 7644:tid 7658] [client 45.86.200.241:32801] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaMctPqeDUGmVAHX7VCMBgAAAUw"]
[Sun Mar 01 00:49:57.531274 2026] [:error] [pid 7644:tid 7655] [client 45.86.200.216:46515] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaMctfqeDUGmVAHX7VCMCwAAAUk"]
[Sun Mar 01 00:49:58.593239 2026] [:error] [pid 7644:tid 7658] [client 45.86.200.244:38555] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaMctvqeDUGmVAHX7VCMGwAAAUw"]
[Sun Mar 01 00:49:59.298249 2026] [:error] [pid 30798:tid 30899] [client 45.86.200.226:26085] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Mar 01 00:49:59.930455 2026] [:error] [pid 30798:tid 30908] [client 45.86.200.226:26085] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aaMct8BkD73gO8wTonZEbgAAAIk"]
[Sun Mar 01 00:50:01.382733 2026] [:error] [pid 31190:tid 31214] [client 45.86.200.236:26991] [client 45.86.200.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaMcuRfvwGOholYpM1FZEAAAAMg"]
[Sun Mar 01 00:50:03.485812 2026] [:error] [pid 30798:tid 30922] [client 45.86.200.226:27651] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaMcu8BkD73gO8wTonZEcwAAAJY"]
[Sun Mar 01 00:50:04.398336 2026] [:error] [pid 31190:tid 31209] [client 45.86.200.235:40729] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Mar 01 00:50:04.706521 2026] [:error] [pid 31190:tid 31224] [client 45.86.200.235:40729] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaMcvBfvwGOholYpM1FZGQAAANI"]
[Sun Mar 01 00:50:05.344414 2026] [:error] [pid 31190:tid 31230] [client 185.82.72.102:32911] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Mar 01 00:50:06.422653 2026] [:error] [pid 31190:tid 31217] [client 185.82.72.102:32911] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Mar 01 00:50:07.482295 2026] [:error] [pid 31190:tid 31228] [client 185.82.72.102:32911] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaMcvxfvwGOholYpM1FZMgAAANY"]
[Sun Mar 01 00:50:08.133266 2026] [:error] [pid 53600:tid 53603] [client 185.82.72.107:26061] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Mar 01 00:50:08.434765 2026] [:error] [pid 53600:tid 53604] [client 185.82.72.107:26061] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaMcwA2UMRAYWtDB23THsgAAAQE"]
[Sun Mar 01 00:50:09.256145 2026] [:error] [pid 53600:tid 53606] [client 45.86.200.226:30281] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Mar 01 00:50:10.276451 2026] [:error] [pid 53600:tid 53619] [client 45.86.200.226:30281] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaMcwg2UMRAYWtDB23THvAAAARA"]
[Sun Mar 01 00:50:11.294946 2026] [:error] [pid 7644:tid 7664] [client 185.82.72.107:54893] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaMcw_qeDUGmVAHX7VCMXAAAAVI"]
[Sun Mar 01 00:50:12.471885 2026] [:error] [pid 7644:tid 7648] [client 45.86.200.225:34481] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Mar 01 00:50:12.893327 2026] [:error] [pid 7644:tid 7661] [client 45.86.200.225:34481] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Mar 01 00:50:13.972768 2026] [:error] [pid 7644:tid 7649] [client 45.86.200.225:34481] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaMcxfqeDUGmVAHX7VCMdgAAAUM"]
[Sun Mar 01 00:50:14.984969 2026] [:error] [pid 30795:tid 30822] [client 185.82.72.109:59201] [client 185.82.72.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaMcxmuI44IL94Zgti-2IgAAAA4"]
[Sun Mar 01 00:50:16.035484 2026] [:error] [pid 7644:tid 7647] [client 45.86.200.222:35973] [client 45.86.200.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaMcyPqeDUGmVAHX7VCMiQAAAUE"]
[Sun Mar 01 00:50:16.704183 2026] [:error] [pid 53600:tid 53613] [client 45.86.200.234:50767] [client 45.86.200.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaMcyA2UMRAYWtDB23TH6gAAAQo"]
[Sun Mar 01 00:50:17.325052 2026] [:error] [pid 53600:tid 53619] [client 185.82.72.107:60863] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaMcyQ2UMRAYWtDB23TH8QAAARA"]
[Sun Mar 01 00:50:18.614697 2026] [:error] [pid 31190:tid 31222] [client 45.86.200.213:63381] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 01 00:50:18.931802 2026] [:error] [pid 31190:tid 31223] [client 45.86.200.213:63381] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaMcyhfvwGOholYpM1FZUQAAANE"]
[Sun Mar 01 00:50:19.589583 2026] [:error] [pid 31190:tid 31218] [client 45.86.200.228:21687] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaMcyxfvwGOholYpM1FZVgAAAMw"]
[Sun Mar 01 00:50:20.412299 2026] [:error] [pid 31190:tid 31222] [client 45.86.200.237:41395] [client 45.86.200.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaMczBfvwGOholYpM1FZWwAAANA"]
[Sun Mar 01 00:50:21.929285 2026] [:error] [pid 31190:tid 31228] [client 45.86.200.225:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Mar 01 00:50:22.931015 2026] [:error] [pid 31190:tid 31212] [client 45.86.200.225:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Mar 01 00:50:24.899672 2026] [:error] [pid 31190:tid 31221] [client 45.86.200.225:41293] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaMc0BfvwGOholYpM1FZegAAAM8"]
[Sun Mar 01 00:50:26.599541 2026] [:error] [pid 30795:tid 30823] [client 185.82.72.106:53177] [client 185.82.72.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.106, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaMc0muI44IL94Zgti-2TAAAAA8"]
[Sun Mar 01 00:50:26.940650 2026] [:error] [pid 30795:tid 30820] [client 185.82.72.106:53177] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Mar 01 00:50:28.574401 2026] [:error] [pid 30795:tid 30822] [client 185.82.72.106:53177] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Mar 01 00:50:28.882933 2026] [:error] [pid 30795:tid 30823] [client 185.82.72.106:53177] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Mar 01 00:50:30.610858 2026] [:error] [pid 30795:tid 30821] [client 185.82.72.106:53177] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaMc1muI44IL94Zgti-2YAAAAA0"]
[Sun Mar 01 00:50:31.632407 2026] [:error] [pid 31190:tid 31210] [client 45.86.200.218:32805] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Mar 01 00:50:32.074054 2026] [:error] [pid 31190:tid 31216] [client 45.86.200.218:32805] [client 45.86.200.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.218, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaMc2BfvwGOholYpM1FZoAAAAMo"]
[Sun Mar 01 00:50:32.712530 2026] [:error] [pid 31190:tid 31215] [client 45.86.200.218:32805] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aaMc2BfvwGOholYpM1FZqgAAAMk"]
[Sun Mar 01 00:50:34.949287 2026] [:error] [pid 31190:tid 31210] [client 45.86.200.239:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 01 00:50:35.667197 2026] [:error] [pid 31190:tid 31211] [client 45.86.200.239:50875] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Mar 01 00:50:36.286867 2026] [:error] [pid 31190:tid 31209] [client 45.86.200.239:50875] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaMc3BfvwGOholYpM1FZzwAAAMM"]
[Sun Mar 01 00:50:37.024453 2026] [:error] [pid 53600:tid 53616] [client 45.86.200.221:60847] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Mar 01 00:50:38.260519 2026] [:error] [pid 53600:tid 53605] [client 45.86.200.221:60847] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Mar 01 00:50:39.310838 2026] [:error] [pid 53600:tid 53624] [client 45.86.200.221:60847] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Mar 01 00:50:40.209712 2026] [:error] [pid 53600:tid 53604] [client 45.86.200.221:60847] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Mar 01 00:50:40.519559 2026] [:error] [pid 53600:tid 53607] [client 45.86.200.221:60847] [client 45.86.200.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaMc4A2UMRAYWtDB23TIkgAAAQQ"]
[Sun Mar 01 00:50:41.612497 2026] [:error] [pid 7644:tid 7670] [client 185.82.72.179:21145] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Mar 01 00:50:41.914161 2026] [:error] [pid 7644:tid 7665] [client 185.82.72.179:21145] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Mar 01 00:50:42.297315 2026] [:error] [pid 7644:tid 7670] [client 185.82.72.179:21145] [client 185.82.72.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaMc4vqeDUGmVAHX7VCNIAAAAVg"]
[Sun Mar 01 00:50:43.465070 2026] [:error] [pid 30797:tid 30882] [client 45.86.200.231:59651] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Mar 01 00:50:44.096755 2026] [:error] [pid 30797:tid 30887] [client 45.86.200.231:59651] [client 45.86.200.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.231, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaMc5PQmcmSQL-3rvLAAdAAAAFA"]
[Sun Mar 01 00:50:44.420684 2026] [:error] [pid 30797:tid 30881] [client 45.86.200.231:59651] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaMc5PQmcmSQL-3rvLAAdQAAAEo"]
[Sun Mar 01 00:50:50.343040 2026] [:error] [pid 7644:tid 7647] [client 185.82.72.104:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Mar 01 00:50:52.530071 2026] [:error] [pid 7644:tid 7657] [client 185.82.72.104:45757] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Mar 01 00:50:52.865323 2026] [:error] [pid 7644:tid 7656] [client 185.82.72.104:45757] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaMc7PqeDUGmVAHX7VCNlAAAAUo"]
[Sun Mar 01 00:50:53.456844 2026] [:error] [pid 31190:tid 31218] [client 45.86.200.224:56919] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Mar 01 00:50:54.455520 2026] [:error] [pid 31190:tid 31210] [client 45.86.200.224:56919] [client 45.86.200.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.224, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaMc7hfvwGOholYpM1FaCwAAAMQ"]
[Sun Mar 01 00:50:54.783121 2026] [:error] [pid 31190:tid 31213] [client 45.86.200.224:56919] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Mar 01 00:50:55.189839 2026] [:error] [pid 31190:tid 31211] [client 45.86.200.224:56919] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Mar 01 00:50:55.541950 2026] [:error] [pid 31190:tid 31229] [client 45.86.200.224:56919] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Mar 01 00:50:55.870646 2026] [:error] [pid 31190:tid 31209] [client 45.86.200.224:56919] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaMc7xfvwGOholYpM1FaEQAAAMM"]
[Sun Mar 01 00:50:56.618905 2026] [:error] [pid 53600:tid 53611] [client 45.86.200.223:60091] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Mar 01 00:50:56.925758 2026] [:error] [pid 53600:tid 53617] [client 45.86.200.223:60091] [client 45.86.200.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aaMc8A2UMRAYWtDB23TIyQAAAQ4"]
[Sun Mar 01 00:50:57.865713 2026] [:error] [pid 53600:tid 53626] [client 45.86.200.224:52707] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Mar 01 00:50:58.163402 2026] [:error] [pid 53600:tid 53622] [client 45.86.200.224:52707] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaMc8g2UMRAYWtDB23TI0gAAARM"]
[Sun Mar 01 00:50:59.430879 2026] [:error] [pid 31190:tid 31226] [client 45.86.200.238:53749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Mar 01 00:51:00.809257 2026] [:error] [pid 31190:tid 31226] [client 45.86.200.238:53749] [client 45.86.200.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaMc9BfvwGOholYpM1FaIwAAANQ"]
[Sun Mar 01 00:51:01.806119 2026] [:error] [pid 53600:tid 53627] [client 45.86.200.227:31971] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaMc9Q2UMRAYWtDB23TI5QAAARg"]
[Sun Mar 01 00:51:02.469349 2026] [:error] [pid 30795:tid 30820] [client 45.86.200.213:28533] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Mar 01 00:51:02.801554 2026] [:error] [pid 30795:tid 30831] [client 45.86.200.213:28533] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Mar 01 00:51:04.503217 2026] [:error] [pid 30795:tid 30829] [client 45.86.200.213:28533] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaMc-GuI44IL94Zgti-2owAAABU"]
[Sun Mar 01 00:51:05.472204 2026] [:error] [pid 53600:tid 53622] [client 45.86.200.243:38309] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaMc-Q2UMRAYWtDB23TI_AAAARM"]
[Sun Mar 01 00:51:07.009313 2026] [:error] [pid 30795:tid 30819] [client 185.82.72.206:51003] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aaMc-2uI44IL94Zgti-2sQAAAAs"]
[Sun Mar 01 00:51:07.711735 2026] [:error] [pid 53600:tid 53612] [client 45.86.200.243:43351] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Mar 01 00:51:08.377502 2026] [:error] [pid 53600:tid 53605] [client 45.86.200.243:43351] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Mar 01 00:51:08.711463 2026] [:error] [pid 53600:tid 53624] [client 45.86.200.243:43351] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaMc_A2UMRAYWtDB23TJDgAAARU"]
[Sun Mar 01 00:51:09.346303 2026] [:error] [pid 53600:tid 53621] [client 185.82.72.103:26935] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Mar 01 00:51:09.979202 2026] [:error] [pid 53600:tid 53609] [client 185.82.72.103:26935] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aaMc_Q2UMRAYWtDB23TJLQAAAQY"]
[Sun Mar 01 00:51:11.601878 2026] [:error] [pid 7644:tid 7670] [client 185.82.72.182:37129] [client 185.82.72.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaMc__qeDUGmVAHX7VCOCAAAAVg"]
[Sun Mar 01 00:51:13.070542 2026] [:error] [pid 7644:tid 7647] [client 45.86.200.248:20271] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 01 00:51:14.125155 2026] [:error] [pid 7644:tid 7668] [client 45.86.200.248:20271] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Mar 01 00:51:14.892715 2026] [:error] [pid 7644:tid 7660] [client 45.86.200.248:20271] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Mar 01 00:51:15.415002 2026] [:error] [pid 7644:tid 7648] [client 45.86.200.248:20271] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaMdA_qeDUGmVAHX7VCOGAAAAUI"]
[Sun Mar 01 00:51:16.081765 2026] [:error] [pid 31190:tid 31208] [client 45.86.200.220:39131] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaMdBBfvwGOholYpM1FadgAAAMI"]
[Sun Mar 01 00:51:16.745920 2026] [:error] [pid 31190:tid 31225] [client 185.82.72.109:58275] [client 185.82.72.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaMdBBfvwGOholYpM1FafgAAANM"]
[Sun Mar 01 00:51:17.647604 2026] [:error] [pid 30798:tid 30920] [client 45.86.200.231:58673] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaMdBcBkD73gO8wTonZE-gAAAJQ"]
[Sun Mar 01 00:51:18.268125 2026] [:error] [pid 7644:tid 7664] [client 45.86.200.229:51137] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Mar 01 00:51:18.798481 2026] [:error] [pid 7644:tid 7659] [client 45.86.200.229:51137] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaMdBvqeDUGmVAHX7VCONAAAAU0"]
[Sun Mar 01 00:51:19.507203 2026] [:error] [pid 7644:tid 7663] [client 45.86.200.229:32763] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaMdB_qeDUGmVAHX7VCONwAAAVE"]
[Sun Mar 01 00:51:20.195508 2026] [:error] [pid 30798:tid 30915] [client 45.86.200.244:47943] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Mar 01 00:51:20.859185 2026] [:error] [pid 30798:tid 30914] [client 45.86.200.244:47943] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaMdCMBkD73gO8wTonZFBgAAAI8"]
[Sun Mar 01 00:51:21.693577 2026] [:error] [pid 11920:tid 11944] [client 45.86.200.220:56349] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaMdCSzLNJUKxvBorrBqxAAAAZQ"]
[Sun Mar 01 00:51:22.346796 2026] [:error] [pid 11920:tid 11924] [client 45.86.200.247:26501] [client 45.86.200.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaMdCizLNJUKxvBorrBqyAAAAYA"]
[Sun Mar 01 00:51:23.459583 2026] [:error] [pid 30798:tid 30916] [client 45.86.200.219:36665] [client 45.86.200.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaMdC8BkD73gO8wTonZFFAAAAJE"]
[Sun Mar 01 00:51:24.420821 2026] [:error] [pid 30798:tid 30921] [client 45.86.200.239:25677] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaMdDMBkD73gO8wTonZFGwAAAJU"]
[Sun Mar 01 00:51:25.836487 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.224:37355] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaMdDSzLNJUKxvBorrBq4QAAAYU"]
[Sun Mar 01 00:51:26.523912 2026] [:error] [pid 11920:tid 11926] [client 45.86.200.224:50717] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Mar 01 00:51:27.531003 2026] [:error] [pid 11920:tid 11941] [client 45.86.200.224:50717] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Mar 01 00:51:28.091645 2026] [:error] [pid 11920:tid 11946] [client 45.86.200.224:50717] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaMdECzLNJUKxvBorrBq-AAAAZY"]
[Sun Mar 01 00:51:29.050184 2026] [:error] [pid 11920:tid 11945] [client 45.86.200.248:30229] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Mar 01 00:51:29.370279 2026] [:error] [pid 11920:tid 11925] [client 45.86.200.248:30229] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Mar 01 00:51:31.191837 2026] [:error] [pid 11920:tid 11928] [client 45.86.200.248:30229] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaMdEyzLNJUKxvBorrBrHwAAAYQ"]
[Sun Mar 01 00:51:33.503013 2026] [:error] [pid 30798:tid 30912] [client 45.86.200.248:55005] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaMdFcBkD73gO8wTonZFPwAAAI0"]
[Sun Mar 01 00:51:34.319812 2026] [:error] [pid 30797:tid 30873] [client 45.86.200.228:52801] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaMdFvQmcmSQL-3rvLAAswAAAEI"]
[Sun Mar 01 00:51:36.311056 2026] [:error] [pid 7644:tid 7654] [client 185.82.72.108:62831] [client 185.82.72.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaMdGPqeDUGmVAHX7VCOWwAAAUg"]
[Sun Mar 01 00:51:37.638708 2026] [:error] [pid 30798:tid 30921] [client 45.86.200.246:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Mar 01 00:51:38.021369 2026] [:error] [pid 30798:tid 30899] [client 45.86.200.246:43889] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Mar 01 00:51:38.354036 2026] [:error] [pid 30798:tid 30911] [client 45.86.200.246:43889] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Mar 01 00:51:38.671312 2026] [:error] [pid 30798:tid 30918] [client 45.86.200.246:43889] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Mar 01 00:51:40.516022 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.246:43889] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaMdHMBkD73gO8wTonZFhwAAAIE"]
[Sun Mar 01 00:51:41.202087 2026] [:error] [pid 30798:tid 30912] [client 45.86.200.231:45415] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaMdHcBkD73gO8wTonZFkAAAAI0"]
[Sun Mar 01 00:51:41.986881 2026] [:error] [pid 53600:tid 53604] [client 45.86.200.220:25231] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaMdHQ2UMRAYWtDB23TJdAAAAQE"]
[Sun Mar 01 00:51:42.664538 2026] [:error] [pid 53600:tid 53605] [client 185.82.72.182:30047] [client 185.82.72.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaMdHg2UMRAYWtDB23TJdgAAAQI"]
[Sun Mar 01 00:51:43.220679 2026] [:error] [pid 53600:tid 53615] [client 45.86.200.250:47353] [client 45.86.200.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaMdHw2UMRAYWtDB23TJfQAAAQw"]
[Sun Mar 01 00:51:43.869753 2026] [:error] [pid 30798:tid 30917] [client 45.86.200.237:32943] [client 45.86.200.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaMdH8BkD73gO8wTonZFoQAAAJI"]
[Sun Mar 01 00:51:45.122905 2026] [:error] [pid 53600:tid 53614] [client 185.82.72.9:31479] [client 185.82.72.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaMdIQ2UMRAYWtDB23TJiAAAAQs"]
[Sun Mar 01 00:51:45.933345 2026] [:error] [pid 11920:tid 11930] [client 45.86.200.231:42409] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaMdISzLNJUKxvBorrBrTgAAAYY"]
[Sun Mar 01 00:51:46.571706 2026] [:error] [pid 7644:tid 7647] [client 45.86.200.224:46285] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaMdIvqeDUGmVAHX7VCOaAAAAUE"]
[Sun Mar 01 00:51:47.137214 2026] [:error] [pid 11920:tid 11928] [client 45.86.200.244:46579] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaMdIyzLNJUKxvBorrBrVwAAAYQ"]
[Sun Mar 01 00:51:48.382108 2026] [:error] [pid 53600:tid 53627] [client 45.86.200.251:57765] [client 45.86.200.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaMdJA2UMRAYWtDB23TJkwAAARg"]
[Sun Mar 01 00:51:50.339213 2026] [:error] [pid 7644:tid 7654] [client 185.82.72.103:30231] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaMdJvqeDUGmVAHX7VCObAAAAUg"]
[Sun Mar 01 00:51:51.029163 2026] [:error] [pid 30798:tid 30905] [client 185.82.72.106:58179] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Mar 01 00:51:51.672157 2026] [:error] [pid 30798:tid 30922] [client 185.82.72.106:58179] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaMdJ8BkD73gO8wTonZFygAAAJY"]
[Sun Mar 01 00:51:53.030731 2026] [:error] [pid 11920:tid 11946] [client 45.86.200.244:38517] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaMdKSzLNJUKxvBorrBrdQAAAZY"]
[Sun Mar 01 00:51:54.556034 2026] [:error] [pid 30798:tid 30918] [client 45.86.200.220:52883] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Mar 01 00:51:55.194250 2026] [:error] [pid 30798:tid 30903] [client 45.86.200.220:52883] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaMdK8BkD73gO8wTonZF9AAAAIQ"]
[Sun Mar 01 00:51:56.143477 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.213:55273] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Mar 01 00:51:56.469610 2026] [:error] [pid 11920:tid 11943] [client 45.86.200.213:55273] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Mar 01 00:51:56.823801 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.213:55273] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Mar 01 00:51:57.128904 2026] [:error] [pid 11920:tid 11926] [client 45.86.200.213:55273] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaMdLSzLNJUKxvBorrBriQAAAYI"]
[Sun Mar 01 00:51:57.824928 2026] [:error] [pid 30798:tid 30915] [client 45.86.200.228:60671] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Mar 01 00:51:58.169779 2026] [:error] [pid 30798:tid 30921] [client 45.86.200.228:60671] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaMdLsBkD73gO8wTonZGCgAAAJU"]
[Sun Mar 01 00:51:59.759002 2026] [:error] [pid 11920:tid 11936] [client 45.86.200.231:39417] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 00:52:00.086939 2026] [:error] [pid 11920:tid 11946] [client 45.86.200.231:39417] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Mar 01 00:52:00.444780 2026] [:error] [pid 11920:tid 11944] [client 45.86.200.231:39417] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Mar 01 00:52:02.631679 2026] [:error] [pid 11920:tid 11945] [client 45.86.200.231:39417] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Mar 01 00:52:03.295092 2026] [:error] [pid 11920:tid 11942] [client 45.86.200.231:39417] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Mar 01 00:52:04.259298 2026] [:error] [pid 11920:tid 11947] [client 45.86.200.231:39417] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Mar 01 00:52:05.644004 2026] [:error] [pid 11920:tid 11933] [client 45.86.200.231:39417] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Mar 01 00:52:06.284705 2026] [:error] [pid 11920:tid 11931] [client 45.86.200.231:39417] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaMdNizLNJUKxvBorrBr9wAAAYc"]
[Sun Mar 01 00:52:07.003367 2026] [:error] [pid 11920:tid 11927] [client 45.86.200.232:42511] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaMdNyzLNJUKxvBorrBr_AAAAYM"]
[Sun Mar 01 00:52:08.740368 2026] [:error] [pid 53600:tid 53615] [client 185.82.72.111:58153] [client 185.82.72.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.111, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaMdOA2UMRAYWtDB23TJ8QAAAQw"]
[Sun Mar 01 00:52:08.743768 2026] [:error] [pid 53600:tid 53615] [client 185.82.72.111:58153] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 01 00:52:09.277096 2026] [:error] [pid 53600:tid 53621] [client 185.82.72.111:58153] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Mar 01 00:52:09.606763 2026] [:error] [pid 53600:tid 53616] [client 185.82.72.111:58153] [client 185.82.72.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaMdOQ2UMRAYWtDB23TJ-wAAAQ0"]
[Sun Mar 01 00:52:10.633186 2026] [:error] [pid 53600:tid 53603] [client 185.82.72.104:56585] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Mar 01 00:52:10.973511 2026] [:error] [pid 53600:tid 53626] [client 185.82.72.104:56585] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaMdOg2UMRAYWtDB23TKCgAAARc"]
[Sun Mar 01 00:52:11.886091 2026] [:error] [pid 11920:tid 11942] [client 45.86.200.228:56059] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaMdOyzLNJUKxvBorrBsEgAAAZI"]
[Sun Mar 01 00:52:14.471907 2026] [:error] [pid 11920:tid 11931] [client 45.86.200.248:32903] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaMdPizLNJUKxvBorrBsKAAAAYc"]
[Sun Mar 01 00:52:15.103373 2026] [:error] [pid 11920:tid 11930] [client 185.82.72.108:36303] [client 185.82.72.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaMdPyzLNJUKxvBorrBsMQAAAYY"]
[Sun Mar 01 00:52:16.875290 2026] [:error] [pid 30798:tid 30917] [client 45.86.200.214:37261] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Mar 01 00:52:17.823219 2026] [:error] [pid 30798:tid 30922] [client 45.86.200.214:37261] [client 45.86.200.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaMdQcBkD73gO8wTonZGVwAAAJY"]
[Sun Mar 01 00:52:20.295571 2026] [:error] [pid 30798:tid 30899] [client 45.86.200.224:60117] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Mar 01 00:52:20.995475 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.224:60117] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aaMdRMBkD73gO8wTonZGZwAAAIE"]
[Sun Mar 01 00:52:21.771290 2026] [:error] [pid 11920:tid 11937] [client 185.82.72.206:58379] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaMdRSzLNJUKxvBorrBsYgAAAY0"]
[Sun Mar 01 00:52:22.756213 2026] [:error] [pid 30795:tid 30831] [client 45.86.200.250:30127] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Mar 01 00:52:23.117250 2026] [:error] [pid 30795:tid 30826] [client 45.86.200.250:30127] [client 45.86.200.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaMdR2uI44IL94Zgti-29AAAABI"]
[Sun Mar 01 00:52:23.836123 2026] [:error] [pid 53600:tid 53621] [client 185.82.72.109:65407] [client 185.82.72.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaMdRw2UMRAYWtDB23TKNgAAARI"]
[Sun Mar 01 00:52:25.134321 2026] [:error] [pid 30798:tid 30910] [client 45.86.200.244:20245] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Mar 01 00:52:25.491953 2026] [:error] [pid 30798:tid 30906] [client 45.86.200.244:20245] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Mar 01 00:52:26.233447 2026] [:error] [pid 30798:tid 30915] [client 45.86.200.244:20245] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 01 00:52:26.935511 2026] [:error] [pid 30798:tid 30905] [client 45.86.200.244:20245] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaMdSsBkD73gO8wTonZGjgAAAIY"]
[Sun Mar 01 00:52:27.642504 2026] [:error] [pid 31190:tid 31215] [client 45.86.200.243:62937] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaMdSxfvwGOholYpM1FbFAAAAMk"]
[Sun Mar 01 00:52:29.489127 2026] [:error] [pid 11920:tid 11926] [client 45.86.200.224:51383] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Mar 01 00:52:29.873880 2026] [:error] [pid 11920:tid 11938] [client 45.86.200.224:51383] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aaMdTSzLNJUKxvBorrBsogAAAY4"]
[Sun Mar 01 00:52:30.501817 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.218:36507] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaMdTizLNJUKxvBorrBsqQAAAZg"]
[Sun Mar 01 00:52:31.139573 2026] [:error] [pid 11920:tid 11934] [client 45.86.200.243:39621] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaMdTyzLNJUKxvBorrBstAAAAYo"]
[Sun Mar 01 00:52:33.641171 2026] [:error] [pid 11920:tid 11942] [client 45.86.200.224:51847] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sun Mar 01 00:52:33.994976 2026] [:error] [pid 11920:tid 11943] [client 45.86.200.224:51847] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaMdUSzLNJUKxvBorrBs7AAAAZM"]
[Sun Mar 01 00:52:34.993019 2026] [:error] [pid 31190:tid 31211] [client 45.86.200.229:57707] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaMdUhfvwGOholYpM1FbJwAAAMU"]
[Sun Mar 01 00:52:36.629514 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.229:51705] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Mar 01 00:52:36.967326 2026] [:error] [pid 11920:tid 11933] [client 45.86.200.229:51705] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Mar 01 00:52:37.879059 2026] [:error] [pid 11920:tid 11947] [client 45.86.200.229:51705] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Mar 01 00:52:40.593977 2026] [:error] [pid 11920:tid 11925] [client 45.86.200.229:51705] [client 45.86.200.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.229, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aaMdWCzLNJUKxvBorrBtQQAAAYE"]
[Sun Mar 01 00:52:41.205962 2026] [:error] [pid 11920:tid 11946] [client 45.86.200.229:51705] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Mar 01 00:52:41.537061 2026] [:error] [pid 11920:tid 11941] [client 45.86.200.229:51705] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Mar 01 00:52:41.859915 2026] [:error] [pid 11920:tid 11944] [client 45.86.200.229:51705] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Mar 01 00:52:42.451198 2026] [:error] [pid 11920:tid 11947] [client 45.86.200.229:51705] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaMdWizLNJUKxvBorrBtVQAAAZc"]
[Sun Mar 01 00:52:43.110434 2026] [:error] [pid 30795:tid 30810] [client 185.82.72.179:21689] [client 185.82.72.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.179, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaMdW2uI44IL94Zgti-2-gAAAAI"]
[Sun Mar 01 00:52:44.430435 2026] [:error] [pid 30795:tid 30832] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Mar 01 00:52:45.034562 2026] [:error] [pid 30795:tid 30821] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Mar 01 00:52:45.879033 2026] [:error] [pid 30795:tid 30822] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sun Mar 01 00:52:46.627403 2026] [:error] [pid 30795:tid 30827] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 01 00:52:47.689951 2026] [:error] [pid 30795:tid 30826] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Mar 01 00:52:50.136891 2026] [:error] [pid 30795:tid 30809] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Mar 01 00:52:50.478740 2026] [:error] [pid 30795:tid 30810] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sun Mar 01 00:52:52.235263 2026] [:error] [pid 30795:tid 30821] [client 185.82.72.179:21689] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Mar 01 00:52:52.863448 2026] [:error] [pid 30795:tid 30822] [client 185.82.72.179:21689] [client 185.82.72.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaMdZGuI44IL94Zgti-3GgAAAA4"]
[Sun Mar 01 00:52:54.351812 2026] [:error] [pid 11920:tid 11939] [client 45.86.200.229:54879] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Mar 01 00:52:54.683203 2026] [:error] [pid 11920:tid 11931] [client 45.86.200.229:54879] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaMdZizLNJUKxvBorrBtxgAAAYc"]
[Sun Mar 01 00:52:55.619103 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.246:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Mar 01 00:52:55.930933 2026] [:error] [pid 11920:tid 11934] [client 45.86.200.246:37319] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaMdZyzLNJUKxvBorrBt4AAAAYo"]
[Sun Mar 01 00:52:57.685051 2026] [:error] [pid 31190:tid 31226] [client 45.86.200.230:43039] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sun Mar 01 00:52:58.454718 2026] [:error] [pid 31190:tid 31228] [client 45.86.200.230:43039] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Mar 01 00:52:59.246154 2026] [:error] [pid 31190:tid 31227] [client 45.86.200.230:43039] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Mar 01 00:52:59.586430 2026] [:error] [pid 31190:tid 31216] [client 45.86.200.230:43039] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sun Mar 01 00:53:00.334055 2026] [:error] [pid 31190:tid 31210] [client 45.86.200.230:43039] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaMdbBfvwGOholYpM1FbdwAAAMQ"]
[Sun Mar 01 00:53:01.113752 2026] [:error] [pid 31190:tid 31218] [client 45.86.200.228:46769] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sun Mar 01 00:53:01.462748 2026] [:error] [pid 31190:tid 31209] [client 45.86.200.228:46769] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Mar 01 00:53:01.809191 2026] [:error] [pid 31190:tid 31214] [client 45.86.200.228:46769] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaMdbRfvwGOholYpM1FbfwAAAMg"]
[Sun Mar 01 00:53:02.847504 2026] [:error] [pid 30798:tid 30902] [client 45.86.200.213:54405] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaMdbsBkD73gO8wTonZHLAAAAIM"]
[Sun Mar 01 00:53:03.958013 2026] [:error] [pid 30795:tid 30824] [client 45.86.200.239:36621] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Mar 01 00:53:05.099799 2026] [:error] [pid 30795:tid 30816] [client 45.86.200.239:36621] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Mar 01 00:53:05.432835 2026] [:error] [pid 30795:tid 30820] [client 45.86.200.239:36621] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Mar 01 00:53:05.770897 2026] [:error] [pid 30795:tid 30821] [client 45.86.200.239:36621] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaMdcWuI44IL94Zgti-3KAAAAA0"]
[Sun Mar 01 00:53:06.587774 2026] [:error] [pid 30797:tid 30889] [client 45.86.200.244:26069] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaMdcvQmcmSQL-3rvLAAzAAAAFI"]
[Sun Mar 01 00:53:09.007149 2026] [:error] [pid 7644:tid 7652] [client 45.86.200.227:34977] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sun Mar 01 00:53:10.003225 2026] [:error] [pid 7644:tid 7660] [client 45.86.200.227:34977] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaMddvqeDUGmVAHX7VCOoQAAAU4"]
[Sun Mar 01 00:53:11.026868 2026] [:error] [pid 11920:tid 11934] [client 45.86.200.222:45313] [client 45.86.200.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaMddyzLNJUKxvBorrBuRQAAAYo"]
[Sun Mar 01 00:53:12.132636 2026] [:error] [pid 30798:tid 30915] [client 45.86.200.235:23793] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 01 00:53:12.485629 2026] [:error] [pid 30798:tid 30906] [client 45.86.200.235:23793] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Mar 01 00:53:14.173133 2026] [:error] [pid 30798:tid 30906] [client 45.86.200.235:23793] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaMdesBkD73gO8wTonZHUQAAAIc"]
[Sun Mar 01 00:53:15.161289 2026] [:error] [pid 53600:tid 53603] [client 185.82.72.106:38091] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Mar 01 00:53:15.482614 2026] [:error] [pid 53600:tid 53605] [client 185.82.72.106:38091] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sun Mar 01 00:53:16.174356 2026] [:error] [pid 53600:tid 53621] [client 185.82.72.106:38091] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Mar 01 00:53:17.776273 2026] [:error] [pid 53600:tid 53626] [client 185.82.72.106:38091] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaMdfQ2UMRAYWtDB23TK9AAAARc"]
[Sun Mar 01 00:53:18.419840 2026] [:error] [pid 30798:tid 30910] [client 45.86.200.220:28017] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Mar 01 00:53:19.692749 2026] [:error] [pid 30798:tid 30901] [client 45.86.200.220:28017] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaMdf8BkD73gO8wTonZHcAAAAII"]
[Sun Mar 01 00:53:20.846039 2026] [:error] [pid 11920:tid 11933] [client 45.86.200.229:32247] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sun Mar 01 00:53:21.842213 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.229:32247] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sun Mar 01 00:53:22.170353 2026] [:error] [pid 11920:tid 11930] [client 45.86.200.229:32247] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Mar 01 00:53:22.919793 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.229:32247] [client 45.86.200.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.229, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaMdgizLNJUKxvBorrBufAAAAZg"]
[Sun Mar 01 00:53:24.852698 2026] [:error] [pid 11920:tid 11941] [client 45.86.200.229:32247] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaMdhCzLNJUKxvBorrBugwAAAZE"]
[Sun Mar 01 00:53:25.501906 2026] [:error] [pid 30797:tid 30885] [client 45.86.200.216:41667] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sun Mar 01 00:53:25.828152 2026] [:error] [pid 30797:tid 30884] [client 45.86.200.216:41667] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaMdhfQmcmSQL-3rvLAA2AAAAE0"]
[Sun Mar 01 00:53:26.466134 2026] [:error] [pid 31190:tid 31218] [client 45.86.200.232:27845] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Mar 01 00:53:27.160814 2026] [:error] [pid 31190:tid 31212] [client 45.86.200.232:27845] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Mar 01 00:53:28.094403 2026] [:error] [pid 31190:tid 31213] [client 45.86.200.232:27845] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaMdiBfvwGOholYpM1FcDgAAAMc"]
[Sun Mar 01 00:53:29.554707 2026] [:error] [pid 53600:tid 53621] [client 45.86.200.244:59459] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Mar 01 00:53:29.846202 2026] [:error] [pid 53600:tid 53622] [client 45.86.200.244:59459] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Mar 01 00:53:30.471286 2026] [:error] [pid 53600:tid 53603] [client 45.86.200.244:59459] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaMdig2UMRAYWtDB23TLJwAAAQA"]
[Sun Mar 01 00:53:31.417297 2026] [:error] [pid 11920:tid 11930] [client 45.86.200.243:62389] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaMdiyzLNJUKxvBorrBurAAAAYY"]
[Sun Mar 01 00:53:32.202489 2026] [:error] [pid 11920:tid 11930] [client 45.86.200.243:25073] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sun Mar 01 00:53:32.607753 2026] [:error] [pid 11920:tid 11927] [client 45.86.200.243:25073] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Mar 01 00:53:33.302365 2026] [:error] [pid 11920:tid 11943] [client 45.86.200.243:25073] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaMdjSzLNJUKxvBorrBuxgAAAZM"]
[Sun Mar 01 00:53:35.112748 2026] [:error] [pid 11920:tid 11935] [client 45.86.200.232:54941] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sun Mar 01 00:53:35.709174 2026] [:error] [pid 11920:tid 11945] [client 45.86.200.232:54941] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sun Mar 01 00:53:36.140481 2026] [:error] [pid 11920:tid 11946] [client 45.86.200.232:54941] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaMdkCzLNJUKxvBorrBu3wAAAZY"]
[Sun Mar 01 00:53:37.065726 2026] [:error] [pid 11920:tid 11930] [client 185.82.72.9:36707] [client 185.82.72.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aaMdkSzLNJUKxvBorrBu5gAAAYY"]
[Sun Mar 01 00:53:39.436038 2026] [:error] [pid 31190:tid 31207] [client 45.86.200.227:42839] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaMdkxfvwGOholYpM1FcPAAAAME"]
[Sun Mar 01 00:53:40.077086 2026] [:error] [pid 30798:tid 30921] [client 45.86.200.231:41767] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaMdlMBkD73gO8wTonZHvwAAAJU"]
[Sun Mar 01 00:53:40.788378 2026] [:error] [pid 30798:tid 30924] [client 45.86.200.231:23279] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaMdlMBkD73gO8wTonZHxAAAAJg"]
[Sun Mar 01 00:53:42.438436 2026] [:error] [pid 7644:tid 7659] [client 45.86.200.235:29189] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaMdlvqeDUGmVAHX7VCO0QAAAU0"]
[Sun Mar 01 00:53:42.999793 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.225:59559] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaMdlsBkD73gO8wTonZH0AAAAIE"]
[Sun Mar 01 00:53:44.351746 2026] [:error] [pid 30797:tid 30872] [client 185.82.72.206:43759] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaMdmPQmcmSQL-3rvLAA6wAAAEE"]
[Sun Mar 01 00:53:45.001317 2026] [:error] [pid 31190:tid 31222] [client 185.82.72.107:54863] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaMdmRfvwGOholYpM1FcUQAAANA"]
[Sun Mar 01 00:53:45.660437 2026] [:error] [pid 31190:tid 31210] [client 45.86.200.249:33773] [client 45.86.200.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaMdmRfvwGOholYpM1FcVQAAAMQ"]
[Sun Mar 01 00:53:46.695478 2026] [:error] [pid 7644:tid 7647] [client 185.82.72.182:59565] [client 185.82.72.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaMdmvqeDUGmVAHX7VCO3QAAAUE"]
[Sun Mar 01 00:53:48.269537 2026] [:error] [pid 11920:tid 11926] [client 45.86.200.224:28423] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaMdnCzLNJUKxvBorrBvGQAAAYI"]
[Sun Mar 01 00:53:48.977789 2026] [:error] [pid 11920:tid 11928] [client 45.86.200.248:55041] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Mar 01 00:53:50.695131 2026] [:error] [pid 11920:tid 11939] [client 45.86.200.248:55041] [client 45.86.200.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.248, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaMdnizLNJUKxvBorrBvMgAAAY8"]
[Sun Mar 01 00:53:52.847561 2026] [:error] [pid 11920:tid 11938] [client 45.86.200.248:55041] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaMdoCzLNJUKxvBorrBvRwAAAY4"]
[Sun Mar 01 00:53:53.489613 2026] [:error] [pid 11920:tid 11935] [client 45.86.200.224:44779] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaMdoSzLNJUKxvBorrBvUAAAAYs"]
[Sun Mar 01 00:53:55.289408 2026] [:error] [pid 30798:tid 30918] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Mar 01 00:53:55.631659 2026] [:error] [pid 30798:tid 30917] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sun Mar 01 00:53:56.857045 2026] [:error] [pid 30798:tid 30906] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Mar 01 00:53:58.548588 2026] [:error] [pid 30798:tid 30906] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sun Mar 01 00:53:59.878537 2026] [:error] [pid 30798:tid 30902] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sun Mar 01 00:54:00.196888 2026] [:error] [pid 30798:tid 30910] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Mar 01 00:54:00.538468 2026] [:error] [pid 30798:tid 30912] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sun Mar 01 00:54:00.853678 2026] [:error] [pid 30798:tid 30899] [client 185.82.72.179:20491] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sun Mar 01 00:54:01.179022 2026] [:error] [pid 30798:tid 30916] [client 185.82.72.179:20491] [client 185.82.72.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaMdqcBkD73gO8wTonZIKAAAAJE"]
[Sun Mar 01 00:54:01.861203 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.231:53105] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaMdqSzLNJUKxvBorrBvjwAAAYU"]
[Sun Mar 01 00:54:02.496887 2026] [:error] [pid 31190:tid 31213] [client 45.86.200.232:56339] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaMdqhfvwGOholYpM1FcdgAAAMc"]
[Sun Mar 01 00:54:03.493244 2026] [:error] [pid 30798:tid 30899] [client 45.86.200.232:30343] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sun Mar 01 00:54:03.986248 2026] [:error] [pid 30798:tid 30916] [client 45.86.200.232:30343] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Mar 01 00:54:04.679202 2026] [:error] [pid 30798:tid 30909] [client 45.86.200.232:30343] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Mar 01 00:54:05.304832 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.232:30343] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaMdrcBkD73gO8wTonZIOgAAAIE"]
[Sun Mar 01 00:54:05.966697 2026] [:error] [pid 53600:tid 53614] [client 45.86.200.221:29395] [client 45.86.200.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaMdrQ2UMRAYWtDB23TLfwAAAQs"]
[Sun Mar 01 00:54:06.560792 2026] [:error] [pid 11920:tid 11930] [client 185.82.72.103:34589] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaMdrizLNJUKxvBorrBvnAAAAYY"]
[Sun Mar 01 00:54:08.434802 2026] [:error] [pid 11920:tid 11936] [client 45.86.200.242:22277] [client 45.86.200.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaMdsCzLNJUKxvBorrBvqwAAAYw"]
[Sun Mar 01 00:54:09.395163 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.247:22827] [client 45.86.200.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaMdsSzLNJUKxvBorrBvugAAAYU"]
[Sun Mar 01 00:54:10.692254 2026] [:error] [pid 30798:tid 30913] [client 45.86.200.226:56491] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaMdssBkD73gO8wTonZITQAAAI4"]
[Sun Mar 01 00:54:15.416111 2026] [:error] [pid 31190:tid 31227] [client 185.82.72.107:61265] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaMdtxfvwGOholYpM1FcswAAANU"]
[Sun Mar 01 00:54:16.174185 2026] [:error] [pid 30798:tid 30902] [client 45.86.200.246:57591] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sun Mar 01 00:54:16.847776 2026] [:error] [pid 30798:tid 30901] [client 45.86.200.246:57591] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aaMduMBkD73gO8wTonZIcAAAAII"]
[Sun Mar 01 00:54:18.585680 2026] [:error] [pid 11920:tid 11940] [client 185.82.72.104:51779] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Mar 01 00:54:19.606900 2026] [:error] [pid 11920:tid 11925] [client 185.82.72.104:51779] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Mar 01 00:54:20.215682 2026] [:error] [pid 11920:tid 11946] [client 185.82.72.104:51779] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaMdvCzLNJUKxvBorrBwBwAAAZY"]
[Sun Mar 01 00:54:21.783324 2026] [:error] [pid 30798:tid 30924] [client 45.86.200.228:27097] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaMdvcBkD73gO8wTonZIjwAAAJg"]
[Sun Mar 01 00:54:23.611498 2026] [:error] [pid 30798:tid 30917] [client 45.86.200.244:55607] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaMdv8BkD73gO8wTonZIoQAAAJI"]
[Sun Mar 01 00:54:26.023593 2026] [:error] [pid 30798:tid 30910] [client 45.86.200.223:42923] [client 45.86.200.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaMdwsBkD73gO8wTonZIwwAAAIs"]
[Sun Mar 01 00:54:26.921959 2026] [:error] [pid 11920:tid 11948] [client 185.82.72.206:43089] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Mar 01 00:54:27.245339 2026] [:error] [pid 11920:tid 11943] [client 185.82.72.206:43089] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaMdwyzLNJUKxvBorrBwHQAAAZM"]
[Sun Mar 01 00:54:27.883321 2026] [:error] [pid 11920:tid 11944] [client 45.86.200.229:44371] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaMdwyzLNJUKxvBorrBwIQAAAZQ"]
[Sun Mar 01 00:54:31.431224 2026] [:error] [pid 11920:tid 11933] [client 45.86.200.225:22375] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaMdxyzLNJUKxvBorrBwNgAAAYk"]
[Sun Mar 01 00:54:32.112786 2026] [:error] [pid 53600:tid 53622] [client 185.82.72.10:51021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Mar 01 00:54:33.441606 2026] [:error] [pid 53600:tid 53620] [client 185.82.72.10:51021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Mar 01 00:54:33.764202 2026] [:error] [pid 53600:tid 53624] [client 185.82.72.10:51021] [client 185.82.72.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaMdyQ2UMRAYWtDB23TLvgAAARU"]
[Sun Mar 01 00:54:35.083265 2026] [:error] [pid 30798:tid 30916] [client 185.82.72.206:47901] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Mar 01 00:54:35.674994 2026] [:error] [pid 30798:tid 30923] [client 185.82.72.206:47901] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaMdy8BkD73gO8wTonZJAgAAAJc"]
[Sun Mar 01 00:54:36.519958 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.226:20939] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaMdzCzLNJUKxvBorrBwSgAAAYU"]
[Sun Mar 01 00:54:38.205646 2026] [:error] [pid 11920:tid 11943] [client 185.82.72.104:28087] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaMdzizLNJUKxvBorrBwYAAAAZM"]
[Sun Mar 01 00:54:39.934050 2026] [:error] [pid 30798:tid 30905] [client 185.82.72.107:45287] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaMdz8BkD73gO8wTonZJFgAAAIY"]
[Sun Mar 01 00:54:40.562723 2026] [:error] [pid 31190:tid 31222] [client 45.86.200.224:45649] [client 45.86.200.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaMd0BfvwGOholYpM1Fc6QAAANA"]
[Sun Mar 01 00:54:41.630277 2026] [:error] [pid 11920:tid 11932] [client 45.86.200.233:40237] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sun Mar 01 00:54:43.415118 2026] [:error] [pid 11920:tid 11935] [client 45.86.200.233:40237] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaMd0yzLNJUKxvBorrBwpgAAAYs"]
[Sun Mar 01 00:54:44.645251 2026] [:error] [pid 30798:tid 30899] [client 45.86.200.213:46515] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaMd1MBkD73gO8wTonZJLAAAAIA"]
[Sun Mar 01 00:54:45.278060 2026] [:error] [pid 11920:tid 11933] [client 45.86.200.213:37305] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaMd1SzLNJUKxvBorrBwwwAAAYk"]
[Sun Mar 01 00:54:46.221317 2026] [:error] [pid 31190:tid 31221] [client 45.86.200.231:26467] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Mar 01 00:54:46.567079 2026] [:error] [pid 31190:tid 31228] [client 45.86.200.231:26467] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaMd1hfvwGOholYpM1Fc-QAAANY"]
[Sun Mar 01 00:54:47.606942 2026] [:error] [pid 30798:tid 30913] [client 45.86.200.233:65431] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaMd18BkD73gO8wTonZJOQAAAI4"]
[Sun Mar 01 00:54:50.305591 2026] [:error] [pid 11920:tid 11944] [client 45.86.200.239:37821] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaMd2izLNJUKxvBorrBw7AAAAZQ"]
[Sun Mar 01 00:54:51.610885 2026] [:error] [pid 11920:tid 11939] [client 45.86.200.220:43747] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sun Mar 01 00:54:51.913096 2026] [:error] [pid 11920:tid 11937] [client 45.86.200.220:43747] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaMd2yzLNJUKxvBorrBw9gAAAY0"]
[Sun Mar 01 00:54:53.222689 2026] [:error] [pid 31190:tid 31213] [client 45.86.200.248:34979] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaMd3RfvwGOholYpM1FdFAAAAMc"]
[Sun Mar 01 00:54:54.265904 2026] [:error] [pid 11920:tid 11945] [client 45.86.200.233:57735] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aaMd3izLNJUKxvBorrBxBwAAAZU"]
[Sun Mar 01 00:54:55.476403 2026] [:error] [pid 11920:tid 11933] [client 185.82.72.106:27613] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaMd3yzLNJUKxvBorrBxHAAAAYk"]
[Sun Mar 01 00:54:57.166031 2026] [:error] [pid 11920:tid 11927] [client 45.86.200.232:56349] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aaMd4SzLNJUKxvBorrBxLgAAAYM"]
[Sun Mar 01 00:54:57.715727 2026] [:error] [pid 7644:tid 7654] [client 45.86.200.250:53685] [client 45.86.200.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaMd4fqeDUGmVAHX7VCPLAAAAUg"]
[Sun Mar 01 00:55:00.933243 2026] [:error] [pid 7644:tid 7654] [client 45.86.200.217:58749] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaMd5PqeDUGmVAHX7VCPQAAAAUg"]
[Sun Mar 01 00:55:02.596470 2026] [:error] [pid 11920:tid 11939] [client 45.86.200.235:59241] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaMd5izLNJUKxvBorrBxaAAAAY8"]
[Sun Mar 01 00:55:04.042519 2026] [:error] [pid 30798:tid 30901] [client 45.86.200.237:35575] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Mar 01 00:55:04.693351 2026] [:error] [pid 30798:tid 30907] [client 45.86.200.237:35575] [client 45.86.200.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaMd6MBkD73gO8wTonZJgwAAAIg"]
[Sun Mar 01 00:55:06.580170 2026] [:error] [pid 30798:tid 30923] [client 45.86.200.216:46653] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaMd6sBkD73gO8wTonZJjgAAAJc"]
[Sun Mar 01 00:55:07.246997 2026] [:error] [pid 30798:tid 30906] [client 185.82.72.9:52925] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Sun Mar 01 00:55:09.439920 2026] [:error] [pid 30798:tid 30923] [client 185.82.72.9:52925] [client 185.82.72.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaMd7cBkD73gO8wTonZJrgAAAJc"]
[Sun Mar 01 00:55:10.476204 2026] [:error] [pid 31190:tid 31219] [client 45.86.200.223:33823] [client 45.86.200.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaMd7hfvwGOholYpM1FdQwAAAM0"]
[Sun Mar 01 00:55:11.457997 2026] [:error] [pid 11920:tid 11945] [client 185.82.72.206:24647] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaMd7yzLNJUKxvBorrBxwAAAAZU"]
[Sun Mar 01 00:55:12.783716 2026] [:error] [pid 30798:tid 30907] [client 45.86.200.249:20239] [client 45.86.200.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaMd8MBkD73gO8wTonZJzAAAAIg"]
[Sun Mar 01 00:55:16.377207 2026] [:error] [pid 11920:tid 11938] [client 185.82.72.104:23655] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaMd9CzLNJUKxvBorrBx8wAAAY4"]
[Sun Mar 01 00:55:17.041266 2026] [:error] [pid 31190:tid 31225] [client 45.86.200.248:59993] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaMd9RfvwGOholYpM1FdTwAAANM"]
[Sun Mar 01 00:55:18.620713 2026] [:error] [pid 53600:tid 53612] [client 185.82.72.104:58677] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaMd9g2UMRAYWtDB23TMJQAAAQk"]
[Sun Mar 01 00:55:19.296351 2026] [:error] [pid 53600:tid 53617] [client 45.86.200.246:23049] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaMd9w2UMRAYWtDB23TMKQAAAQ4"]
[Sun Mar 01 00:55:20.988967 2026] [:error] [pid 53600:tid 53618] [client 185.82.72.104:45675] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaMd-A2UMRAYWtDB23TMLgAAAQ8"]
[Sun Mar 01 00:55:21.740986 2026] [:error] [pid 7644:tid 7659] [client 45.86.200.218:62529] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaMd-fqeDUGmVAHX7VCPYgAAAU0"]
[Sun Mar 01 00:55:22.374671 2026] [:error] [pid 11920:tid 11933] [client 45.86.200.232:61603] [client 45.86.200.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.232, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaMd-izLNJUKxvBorrByMQAAAYk"]
[Sun Mar 01 00:55:22.378519 2026] [:error] [pid 11920:tid 11933] [client 45.86.200.232:61603] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Mar 01 00:55:22.705458 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.232:61603] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaMd-izLNJUKxvBorrByMgAAAZg"]
[Sun Mar 01 00:55:23.916724 2026] [:error] [pid 53600:tid 53623] [client 45.86.200.234:59329] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Mar 01 00:55:24.329125 2026] [:error] [pid 53600:tid 53624] [client 45.86.200.234:59329] [client 45.86.200.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaMd_A2UMRAYWtDB23TMOQAAARU"]
[Sun Mar 01 00:55:24.941739 2026] [:error] [pid 30797:tid 30886] [client 45.86.200.245:39197] [client 45.86.200.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aaMd_PQmcmSQL-3rvLABBgAAAE8"]
[Sun Mar 01 00:55:25.588073 2026] [:error] [pid 30797:tid 30883] [client 185.82.72.10:64049] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Sun Mar 01 00:55:27.952990 2026] [:error] [pid 30797:tid 30875] [client 185.82.72.10:64049] [client 185.82.72.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaMd__QmcmSQL-3rvLABDwAAAEQ"]
[Sun Mar 01 00:55:28.593646 2026] [:error] [pid 31190:tid 31212] [client 45.86.200.232:36107] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaMeABfvwGOholYpM1FdiQAAAMY"]
[Sun Mar 01 00:55:29.857497 2026] [:error] [pid 11920:tid 11936] [client 45.86.200.227:39277] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaMeASzLNJUKxvBorrByZwAAAYw"]
[Sun Mar 01 00:55:30.637107 2026] [:error] [pid 7644:tid 7667] [client 45.86.200.242:55075] [client 45.86.200.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaMeAvqeDUGmVAHX7VCPcQAAAVU"]
[Sun Mar 01 00:55:31.253463 2026] [:error] [pid 7644:tid 7660] [client 45.86.200.216:51843] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sun Mar 01 00:55:31.552047 2026] [:error] [pid 7644:tid 7669] [client 45.86.200.216:51843] [client 45.86.200.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.216, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaMeA_qeDUGmVAHX7VCPdQAAAVc"]
[Sun Mar 01 00:55:32.177513 2026] [:error] [pid 7644:tid 7656] [client 45.86.200.216:51843] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaMeBPqeDUGmVAHX7VCPeQAAAUo"]
[Sun Mar 01 00:55:34.053636 2026] [:error] [pid 53600:tid 53610] [client 45.86.200.241:23821] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaMeBg2UMRAYWtDB23TMRwAAAQc"]
[Sun Mar 01 00:55:34.683434 2026] [:error] [pid 31190:tid 31216] [client 45.86.200.233:34625] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Mar 01 00:55:34.983224 2026] [:error] [pid 31190:tid 31217] [client 45.86.200.233:34625] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaMeBhfvwGOholYpM1FdpQAAAMs"]
[Sun Mar 01 00:55:35.614506 2026] [:error] [pid 31190:tid 31228] [client 45.86.200.244:44923] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaMeBxfvwGOholYpM1FdqQAAANY"]
[Sun Mar 01 00:55:36.226606 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.245:36499] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sun Mar 01 00:55:37.170112 2026] [:error] [pid 30798:tid 30909] [client 45.86.200.245:36499] [client 45.86.200.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaMeCcBkD73gO8wTonZKiwAAAIo"]
[Sun Mar 01 00:55:38.457102 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.216:22975] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaMeCizLNJUKxvBorrBypgAAAYU"]
[Sun Mar 01 00:55:39.085459 2026] [:error] [pid 11920:tid 11937] [client 45.86.200.218:60751] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sun Mar 01 00:55:39.775587 2026] [:error] [pid 11920:tid 11938] [client 45.86.200.218:60751] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Mar 01 00:55:40.506913 2026] [:error] [pid 11920:tid 11925] [client 45.86.200.218:60751] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaMeDCzLNJUKxvBorrByzgAAAYE"]
[Sun Mar 01 00:55:41.197156 2026] [:error] [pid 30798:tid 30913] [client 45.86.200.251:42035] [client 45.86.200.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaMeDcBkD73gO8wTonZKmAAAAI4"]
[Sun Mar 01 00:55:42.343458 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.242:33513] [client 45.86.200.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aaMeDsBkD73gO8wTonZKqQAAAIE"]
[Sun Mar 01 00:55:42.993836 2026] [:error] [pid 53600:tid 53620] [client 45.86.200.230:37837] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Sun Mar 01 00:55:45.028932 2026] [:error] [pid 53600:tid 53624] [client 45.86.200.230:37837] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaMeEQ2UMRAYWtDB23TMXgAAARU"]
[Sun Mar 01 00:55:46.375967 2026] [:error] [pid 53600:tid 53608] [client 45.86.200.248:41089] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aaMeEg2UMRAYWtDB23TMbAAAAQU"]
[Sun Mar 01 00:55:46.682737 2026] [:error] [pid 53600:tid 53623] [client 45.86.200.248:41089] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaMeEg2UMRAYWtDB23TMbwAAARQ"]
[Sun Mar 01 00:55:48.002053 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.228:22857] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaMeFCzLNJUKxvBorrBzBQAAAZg"]
[Sun Mar 01 00:55:48.657345 2026] [:error] [pid 30798:tid 30911] [client 45.86.200.218:22151] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaMeFMBkD73gO8wTonZKygAAAIw"]
[Sun Mar 01 00:55:50.088461 2026] [:error] [pid 31190:tid 31214] [client 45.86.200.237:28019] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun Mar 01 00:55:51.502140 2026] [:error] [pid 31190:tid 31208] [client 45.86.200.237:28019] [client 45.86.200.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaMeFxfvwGOholYpM1Fd0gAAAMI"]
[Sun Mar 01 00:55:52.934883 2026] [:error] [pid 11920:tid 11942] [client 45.86.200.236:34409] [client 45.86.200.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaMeGCzLNJUKxvBorrBzLQAAAZI"]
[Sun Mar 01 00:55:53.885427 2026] [:error] [pid 11920:tid 11945] [client 45.86.200.219:49411] [client 45.86.200.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaMeGSzLNJUKxvBorrBzNgAAAZU"]
[Sun Mar 01 00:55:54.501496 2026] [:error] [pid 7644:tid 7662] [client 185.82.72.179:29267] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sun Mar 01 00:55:56.148874 2026] [:error] [pid 7644:tid 7658] [client 185.82.72.179:29267] [client 185.82.72.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaMeHPqeDUGmVAHX7VCPqwAAAUw"]
[Sun Mar 01 00:55:57.082608 2026] [:error] [pid 11920:tid 11925] [client 45.86.200.230:45803] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aaMeHSzLNJUKxvBorrBzWwAAAYE"]
[Sun Mar 01 00:55:57.702534 2026] [:error] [pid 11920:tid 11927] [client 45.86.200.250:52145] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Mar 01 00:55:58.117012 2026] [:error] [pid 11920:tid 11937] [client 45.86.200.250:52145] [client 45.86.200.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaMeHizLNJUKxvBorrBzcAAAAY0"]
[Sun Mar 01 00:55:58.782319 2026] [:error] [pid 31190:tid 31216] [client 45.86.200.233:61431] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaMeHhfvwGOholYpM1Fd3wAAAMo"]
[Sun Mar 01 00:56:00.042720 2026] [:error] [pid 30798:tid 30922] [client 45.86.200.223:28215] [client 45.86.200.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaMeIMBkD73gO8wTonZLDQAAAJY"]
[Sun Mar 01 00:56:01.578207 2026] [:error] [pid 30798:tid 30914] [client 45.86.200.225:59927] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Sun Mar 01 00:56:01.897299 2026] [:error] [pid 30798:tid 30904] [client 45.86.200.225:59927] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaMeIcBkD73gO8wTonZLLgAAAIU"]
[Sun Mar 01 00:56:02.484408 2026] [:error] [pid 7644:tid 7660] [client 185.82.72.106:62861] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaMeIvqeDUGmVAHX7VCPsgAAAU4"]
[Sun Mar 01 00:56:04.881858 2026] [:error] [pid 31190:tid 31214] [client 45.86.200.239:30393] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaMeJBfvwGOholYpM1FeDgAAAMg"]
[Sun Mar 01 00:56:06.399958 2026] [:error] [pid 31190:tid 31225] [client 45.86.200.251:21577] [client 45.86.200.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaMeJhfvwGOholYpM1FeFAAAANM"]
[Sun Mar 01 00:56:07.053412 2026] [:error] [pid 30798:tid 30911] [client 185.82.72.103:48047] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Sun Mar 01 00:56:08.059426 2026] [:error] [pid 30798:tid 30915] [client 185.82.72.103:48047] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaMeKMBkD73gO8wTonZLUgAAAJA"]
[Sun Mar 01 00:56:08.672886 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.230:30319] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaMeKMBkD73gO8wTonZLVwAAAIE"]
[Sun Mar 01 00:56:09.641097 2026] [:error] [pid 30798:tid 30900] [client 185.82.72.10:60777] [client 185.82.72.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaMeKcBkD73gO8wTonZLYwAAAIE"]
[Sun Mar 01 00:56:10.246746 2026] [:error] [pid 30798:tid 30924] [client 45.86.200.229:56227] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sun Mar 01 00:56:10.879520 2026] [:error] [pid 30798:tid 30911] [client 45.86.200.229:56227] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaMeKsBkD73gO8wTonZLcQAAAIw"]
[Sun Mar 01 00:56:11.498081 2026] [:error] [pid 30798:tid 30914] [client 45.86.200.228:27981] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Sun Mar 01 00:56:12.109869 2026] [:error] [pid 30798:tid 30904] [client 45.86.200.228:27981] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaMeLMBkD73gO8wTonZLewAAAIU"]
[Sun Mar 01 00:56:12.711767 2026] [:error] [pid 30798:tid 30912] [client 185.82.72.206:52651] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaMeLMBkD73gO8wTonZLgAAAAI0"]
[Sun Mar 01 00:56:13.667295 2026] [:error] [pid 31190:tid 31221] [client 185.82.72.111:58369] [client 185.82.72.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaMeLRfvwGOholYpM1FeKQAAAM8"]
[Sun Mar 01 00:56:14.305883 2026] [:error] [pid 30798:tid 30901] [client 45.86.200.221:35715] [client 45.86.200.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaMeLsBkD73gO8wTonZLigAAAII"]
[Sun Mar 01 00:56:15.623411 2026] [:error] [pid 30798:tid 30904] [client 185.82.72.106:34199] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaMeL8BkD73gO8wTonZLlgAAAIU"]
[Sun Mar 01 00:56:16.517575 2026] [:error] [pid 31190:tid 31209] [client 185.82.72.9:48405] [client 185.82.72.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaMeMBfvwGOholYpM1FeNgAAAMM"]
[Sun Mar 01 00:56:17.145430 2026] [:error] [pid 53600:tid 53615] [client 45.86.200.228:59303] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaMeMQ2UMRAYWtDB23TMvAAAAQw"]
[Sun Mar 01 00:56:17.881415 2026] [:error] [pid 53600:tid 53603] [client 45.86.200.217:62653] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaMeMQ2UMRAYWtDB23TMwgAAAQA"]
[Sun Mar 01 00:56:19.527296 2026] [:error] [pid 30797:tid 30879] [client 45.86.200.247:22609] [client 45.86.200.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaMeM_QmcmSQL-3rvLABOQAAAEg"]
[Sun Mar 01 00:56:20.802861 2026] [:error] [pid 11920:tid 11932] [client 185.82.72.206:54203] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaMeNCzLNJUKxvBorrBz7AAAAYg"]
[Sun Mar 01 00:56:21.770575 2026] [:error] [pid 30798:tid 30909] [client 45.86.200.245:57947] [client 45.86.200.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaMeNcBkD73gO8wTonZLuwAAAIo"]
[Sun Mar 01 00:56:22.716486 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.214:54459] [client 45.86.200.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaMeNizLNJUKxvBorrBz_wAAAZg"]
[Sun Mar 01 00:56:24.065766 2026] [:error] [pid 11920:tid 11928] [client 185.82.72.102:61533] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sun Mar 01 00:56:27.134221 2026] [:error] [pid 11920:tid 11930] [client 185.82.72.102:61533] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaMeOyzLNJUKxvBorrB0KwAAAYY"]
[Sun Mar 01 00:56:27.807468 2026] [:error] [pid 31190:tid 31206] [client 45.86.200.251:30771] [client 45.86.200.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaMeOxfvwGOholYpM1FeTQAAAMA"]
[Sun Mar 01 00:56:28.853621 2026] [:error] [pid 30798:tid 30905] [client 185.82.72.106:40091] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sun Mar 01 00:56:29.162578 2026] [:error] [pid 30798:tid 30917] [client 185.82.72.106:40091] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaMePcBkD73gO8wTonZL7gAAAJI"]
[Sun Mar 01 00:56:31.459260 2026] [:error] [pid 31190:tid 31216] [client 45.86.200.235:45095] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaMePxfvwGOholYpM1FeYQAAAMo"]
[Sun Mar 01 00:56:32.422894 2026] [:error] [pid 11920:tid 11937] [client 45.86.200.222:20907] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Sun Mar 01 00:56:32.745043 2026] [:error] [pid 11920:tid 11927] [client 45.86.200.222:20907] [client 45.86.200.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaMeQCzLNJUKxvBorrB0OAAAAYM"]
[Sun Mar 01 00:56:33.952361 2026] [:error] [pid 31190:tid 31216] [client 185.82.72.111:56171] [client 185.82.72.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaMeQRfvwGOholYpM1FecAAAAMo"]
[Sun Mar 01 00:56:34.576107 2026] [:error] [pid 11920:tid 11926] [client 45.86.200.237:51325] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Mar 01 00:56:34.984215 2026] [:error] [pid 11920:tid 11927] [client 45.86.200.237:51325] [client 45.86.200.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaMeQizLNJUKxvBorrB0RwAAAYM"]
[Sun Mar 01 00:56:36.280913 2026] [:error] [pid 30797:tid 30887] [client 45.86.200.248:20365] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaMeRPQmcmSQL-3rvLABRQAAAFA"]
[Sun Mar 01 00:56:37.848023 2026] [:error] [pid 31190:tid 31210] [client 45.86.200.248:58955] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sun Mar 01 00:56:38.139991 2026] [:error] [pid 31190:tid 31214] [client 45.86.200.248:58955] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaMeRhfvwGOholYpM1FejgAAAMg"]
[Sun Mar 01 00:56:39.748197 2026] [:error] [pid 30797:tid 30881] [client 45.86.200.246:33981] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaMeR_QmcmSQL-3rvLABTAAAAEo"]
[Sun Mar 01 00:56:40.341648 2026] [:error] [pid 11920:tid 11928] [client 45.86.200.243:33103] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sun Mar 01 00:56:40.707491 2026] [:error] [pid 11920:tid 11930] [client 45.86.200.243:33103] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaMeSCzLNJUKxvBorrB0ZwAAAYY"]
[Sun Mar 01 00:56:41.323877 2026] [:error] [pid 11920:tid 11944] [client 45.86.200.234:59237] [client 45.86.200.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaMeSSzLNJUKxvBorrB0bwAAAZQ"]
[Sun Mar 01 00:56:41.963232 2026] [:error] [pid 11920:tid 11929] [client 45.86.200.241:39067] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sun Mar 01 00:56:42.605597 2026] [:error] [pid 11920:tid 11925] [client 45.86.200.241:39067] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaMeSizLNJUKxvBorrB0fQAAAYE"]
[Sun Mar 01 00:56:43.252097 2026] [:error] [pid 11920:tid 11931] [client 45.86.200.216:44787] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaMeSyzLNJUKxvBorrB0hQAAAYc"]
[Sun Mar 01 00:56:45.765985 2026] [:error] [pid 11920:tid 11936] [client 45.86.200.223:60019] [client 45.86.200.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaMeTSzLNJUKxvBorrB0mwAAAYw"]
[Sun Mar 01 00:56:47.443150 2026] [:error] [pid 7644:tid 7655] [client 45.86.200.230:31759] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaMeT_qeDUGmVAHX7VCP6AAAAUk"]
[Sun Mar 01 00:56:48.399575 2026] [:error] [pid 53600:tid 53607] [client 45.86.200.218:55181] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aaMeUA2UMRAYWtDB23TM4AAAAQQ"]
[Sun Mar 01 00:56:49.022501 2026] [:error] [pid 30798:tid 30900] [client 185.82.72.9:34243] [client 185.82.72.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaMeUcBkD73gO8wTonZMSwAAAIE"]
[Sun Mar 01 00:56:49.660216 2026] [:error] [pid 53600:tid 53614] [client 185.82.72.102:51491] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaMeUQ2UMRAYWtDB23TM4QAAAQs"]
[Sun Mar 01 00:56:50.266111 2026] [:error] [pid 11920:tid 11947] [client 45.86.200.237:35493] [client 45.86.200.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aaMeUizLNJUKxvBorrB0twAAAZc"]
[Sun Mar 01 00:56:52.162234 2026] [:error] [pid 30795:tid 30817] [client 45.86.200.216:56393] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaMeVGuI44IL94Zgti-3wgAAAAk"]
[Sun Mar 01 00:56:52.742091 2026] [:error] [pid 30798:tid 30924] [client 45.86.200.228:26573] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aaMeVMBkD73gO8wTonZMWAAAAJg"]
[Sun Mar 01 00:56:54.083648 2026] [:error] [pid 31190:tid 31226] [client 45.86.200.214:23249] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Sun Mar 01 00:56:54.377281 2026] [:error] [pid 31190:tid 31228] [client 45.86.200.214:23249] [client 45.86.200.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaMeVhfvwGOholYpM1Fe0gAAANY"]
[Sun Mar 01 00:56:55.134721 2026] [:error] [pid 7644:tid 7653] [client 45.86.200.218:29815] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaMeV_qeDUGmVAHX7VCP8gAAAUc"]
[Sun Mar 01 00:56:56.600981 2026] [:error] [pid 11920:tid 11939] [client 45.86.200.229:33541] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aaMeWCzLNJUKxvBorrB02QAAAY8"]
[Sun Mar 01 00:56:57.336723 2026] [:error] [pid 11920:tid 11935] [client 45.86.200.221:34499] [client 45.86.200.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaMeWSzLNJUKxvBorrB04QAAAYs"]
[Sun Mar 01 00:57:00.255031 2026] [:error] [pid 30798:tid 30915] [client 45.86.200.221:54457] [client 45.86.200.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aaMeXMBkD73gO8wTonZMfgAAAJA"]
[Sun Mar 01 00:57:00.876642 2026] [:error] [pid 31190:tid 31221] [client 45.86.200.222:32885] [client 45.86.200.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaMeXBfvwGOholYpM1Fe5wAAAM8"]
[Sun Mar 01 00:57:02.118830 2026] [:error] [pid 11920:tid 11941] [client 45.86.200.248:37497] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aaMeXizLNJUKxvBorrB09wAAAZE"]
[Sun Mar 01 00:57:03.057368 2026] [:error] [pid 11920:tid 11940] [client 45.86.200.244:30249] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaMeXyzLNJUKxvBorrB1AAAAAZA"]
[Sun Mar 01 00:57:03.969760 2026] [:error] [pid 30798:tid 30914] [client 185.82.72.9:38579] [client 185.82.72.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aaMeX8BkD73gO8wTonZMiwAAAI8"]
[Sun Mar 01 00:57:04.568187 2026] [:error] [pid 30798:tid 30901] [client 45.86.200.227:40351] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaMeYMBkD73gO8wTonZMjQAAAII"]
[Sun Mar 01 00:57:05.168965 2026] [:error] [pid 11920:tid 11947] [client 45.86.200.230:55741] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaMeYSzLNJUKxvBorrB1EQAAAZc"]
[Sun Mar 01 00:57:06.668109 2026] [:error] [pid 11920:tid 11942] [client 45.86.200.235:42551] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaMeYizLNJUKxvBorrB1IgAAAZI"]
[Sun Mar 01 00:57:07.305035 2026] [:error] [pid 11920:tid 11948] [client 45.86.200.231:58561] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Sun Mar 01 00:57:07.595127 2026] [:error] [pid 11920:tid 11935] [client 45.86.200.231:58561] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaMeYyzLNJUKxvBorrB1LQAAAYs"]
[Sun Mar 01 00:57:08.825045 2026] [:error] [pid 30797:tid 30879] [client 185.82.72.106:27467] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Sun Mar 01 00:57:09.110015 2026] [:error] [pid 30797:tid 30880] [client 185.82.72.106:27467] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaMeZfQmcmSQL-3rvLABbQAAAEk"]
[Sun Mar 01 00:57:09.686072 2026] [:error] [pid 11920:tid 11934] [client 185.82.72.103:58773] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaMeZSzLNJUKxvBorrB1RAAAAYo"]
[Sun Mar 01 00:57:10.600480 2026] [:error] [pid 11920:tid 11948] [client 185.82.72.179:31287] [client 185.82.72.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaMeZizLNJUKxvBorrB1TwAAAZg"]
[Sun Mar 01 00:57:13.879804 2026] [:error] [pid 30798:tid 30900] [client 45.86.200.219:60559] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun Mar 01 00:57:15.119633 2026] [:error] [pid 30798:tid 30922] [client 45.86.200.219:60559] [client 45.86.200.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aaMea8BkD73gO8wTonZMxgAAAJY"]
[Sun Mar 01 00:57:16.128521 2026] [:error] [pid 11920:tid 11935] [client 45.86.200.243:48031] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaMebCzLNJUKxvBorrB1dgAAAYs"]
[Sun Mar 01 00:57:17.364679 2026] [:error] [pid 53600:tid 53611] [client 45.86.200.214:29497] [client 45.86.200.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaMebQ2UMRAYWtDB23TNAwAAAQg"]
[Sun Mar 01 00:57:17.955739 2026] [:error] [pid 11920:tid 11930] [client 45.86.200.225:51253] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaMebSzLNJUKxvBorrB1hAAAAYY"]
[Sun Mar 01 00:57:18.545596 2026] [:error] [pid 30798:tid 30909] [client 185.82.72.182:21359] [client 185.82.72.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaMebsBkD73gO8wTonZM2wAAAIo"]
[Sun Mar 01 01:01:01.097725 2026] [:error] [pid 31190:tid 31228] [client 20.63.83.162:12812] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaMfTRfvwGOholYpM1FiywAAANY"]
[Sun Mar 01 01:01:01.937312 2026] [:error] [pid 7644:tid 7667] [client 20.63.83.162:13128] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaMfTfqeDUGmVAHX7VCRCwAAAVU"]
[Sun Mar 01 01:01:02.766704 2026] [:error] [pid 31190:tid 31222] [client 20.63.83.162:13150] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaMfThfvwGOholYpM1Fi3QAAANA"]
[Sun Mar 01 01:01:03.585404 2026] [:error] [pid 31190:tid 31215] [client 20.63.83.162:13124] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaMfTxfvwGOholYpM1Fi5wAAAMk"]
[Sun Mar 01 02:03:07.520305 2026] [:error] [pid 11920:tid 11941] [client 20.78.169.245:6592] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 01 02:03:07.669077 2026] [:error] [pid 11920:tid 11926] [client 20.78.169.245:6592] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 02:03:08.128535 2026] [:error] [pid 11920:tid 11934] [client 20.78.169.245:6592] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sun Mar 01 02:03:08.251512 2026] [:error] [pid 11920:tid 11927] [client 20.78.169.245:6592] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 02:03:08.499637 2026] [:error] [pid 11920:tid 11931] [client 20.78.169.245:6592] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sun Mar 01 02:03:08.622846 2026] [:error] [pid 11920:tid 11936] [client 20.78.169.245:6592] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 01 02:03:08.747582 2026] [:error] [pid 11920:tid 11946] [client 20.78.169.245:6592] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sun Mar 01 02:03:09.002344 2026] [:error] [pid 11920:tid 11932] [client 20.78.169.245:6592] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaMt3SzLNJUKxvBorrDerQAAAYg"]
[Sun Mar 01 02:03:09.487405 2026] [:error] [pid 7644:tid 7653] [client 20.78.169.245:2688] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaMt3fqeDUGmVAHX7VCmuwAAAUc"]
[Sun Mar 01 02:03:09.990408 2026] [:error] [pid 53600:tid 53616] [client 20.78.169.245:2705] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaMt3Q2UMRAYWtDB23TtXQAAAQ0"]
[Sun Mar 01 02:03:10.474013 2026] [:error] [pid 30798:tid 30902] [client 20.78.169.245:25488] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaMt3sBkD73gO8wTonaSZgAAAIM"]
[Sun Mar 01 02:14:50.951042 2026] [:error] [pid 30798:tid 30905] [client 20.220.13.5:10194] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "aaMwmsBkD73gO8wTonafsgAAAIY"]
[Sun Mar 01 02:14:51.776234 2026] [:error] [pid 11920:tid 11930] [client 20.220.13.5:10195] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaMwmyzLNJUKxvBorrDx1AAAAYY"]
[Sun Mar 01 02:14:52.602560 2026] [:error] [pid 31190:tid 31220] [client 20.220.13.5:10182] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "aaMwnBfvwGOholYpM1GebQAAAM4"]
[Sun Mar 01 02:14:53.451098 2026] [:error] [pid 53600:tid 53611] [client 20.220.13.5:9226] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aaMwnQ2UMRAYWtDB23TyWQAAAQg"]
[Sun Mar 01 02:14:54.278781 2026] [:error] [pid 7644:tid 7655] [client 20.220.13.5:10181] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaMwnvqeDUGmVAHX7VCq9gAAAUk"]
[Sun Mar 01 02:14:55.104767 2026] [:error] [pid 30798:tid 30924] [client 20.220.13.5:9242] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaMwn8BkD73gO8wTonafwgAAAJg"]
[Sun Mar 01 02:14:55.930883 2026] [:error] [pid 30798:tid 30908] [client 20.220.13.5:9270] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "aaMwn8BkD73gO8wTonafyAAAAIk"]
[Sun Mar 01 02:14:56.769873 2026] [:error] [pid 31190:tid 31223] [client 20.220.13.5:9251] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaMwoBfvwGOholYpM1GehAAAANE"]
[Sun Mar 01 02:14:57.629249 2026] [:error] [pid 11920:tid 11944] [client 20.220.13.5:10177] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/xmrlpc.php"] [unique_id "aaMwoSzLNJUKxvBorrDx-AAAAZQ"]
[Sun Mar 01 02:14:58.463706 2026] [:error] [pid 30798:tid 30904] [client 20.220.13.5:10176] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "aaMwosBkD73gO8wTonafzgAAAIU"]
[Sun Mar 01 02:14:59.287142 2026] [:error] [pid 30798:tid 30924] [client 20.220.13.5:9273] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "aaMwo8BkD73gO8wTonafzwAAAJg"]
[Sun Mar 01 02:15:00.111966 2026] [:error] [pid 11920:tid 11925] [client 20.220.13.5:9263] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "aaMwpCzLNJUKxvBorrDyFwAAAYE"]
[Sun Mar 01 02:15:00.938111 2026] [:error] [pid 11920:tid 11944] [client 20.220.13.5:9230] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aaMwpCzLNJUKxvBorrDyIAAAAZQ"]
[Sun Mar 01 02:15:01.768258 2026] [:error] [pid 11920:tid 11930] [client 20.220.13.5:10187] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/aw.php"] [unique_id "aaMwpSzLNJUKxvBorrDyKgAAAYY"]
[Sun Mar 01 02:15:02.603543 2026] [:error] [pid 11920:tid 11947] [client 20.220.13.5:9261] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/bb.php"] [unique_id "aaMwpizLNJUKxvBorrDyNAAAAZc"]
[Sun Mar 01 02:15:03.440145 2026] [:error] [pid 11920:tid 11942] [client 20.220.13.5:9238] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aaMwpyzLNJUKxvBorrDyOgAAAZI"]
[Sun Mar 01 02:15:04.258789 2026] [:error] [pid 31190:tid 31215] [client 20.220.13.5:9258] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "aaMwqBfvwGOholYpM1GejAAAAMk"]
[Sun Mar 01 02:15:05.088571 2026] [:error] [pid 11920:tid 11940] [client 20.220.13.5:10178] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/test1.php"] [unique_id "aaMwqSzLNJUKxvBorrDySQAAAZA"]
[Sun Mar 01 02:15:05.927436 2026] [:error] [pid 11920:tid 11926] [client 20.220.13.5:9221] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "aaMwqSzLNJUKxvBorrDyUgAAAYI"]
[Sun Mar 01 02:15:06.827330 2026] [:error] [pid 30798:tid 30910] [client 20.220.13.5:10199] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/css/autoload_classmap.php"] [unique_id "aaMwqsBkD73gO8wTonaf8QAAAIs"]
[Sun Mar 01 02:15:07.660559 2026] [:error] [pid 30797:tid 30892] [client 20.220.13.5:10232] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/fx.php"] [unique_id "aaMwq_QmcmSQL-3rvLAP8gAAAFU"]
[Sun Mar 01 02:15:08.494820 2026] [:error] [pid 11920:tid 11934] [client 20.220.13.5:9268] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/gelay.php"] [unique_id "aaMwrCzLNJUKxvBorrDyZAAAAYo"]
[Sun Mar 01 02:15:09.330695 2026] [:error] [pid 30798:tid 30909] [client 20.220.13.5:9234] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/god4m.php"] [unique_id "aaMwrcBkD73gO8wTonagAAAAAIo"]
[Sun Mar 01 02:15:10.162313 2026] [:error] [pid 11920:tid 11945] [client 20.220.13.5:9237] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/mari.php"] [unique_id "aaMwrizLNJUKxvBorrDydAAAAZU"]
[Sun Mar 01 02:15:11.001508 2026] [:error] [pid 31190:tid 31226] [client 20.220.13.5:9232] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "aaMwrxfvwGOholYpM1GelAAAANQ"]
[Sun Mar 01 02:15:11.848404 2026] [:error] [pid 30798:tid 30923] [client 20.220.13.5:10180] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "aaMwr8BkD73gO8wTonagDAAAAJc"]
[Sun Mar 01 02:15:12.674756 2026] [:error] [pid 7644:tid 7646] [client 20.220.13.5:10188] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/tmp.php"] [unique_id "aaMwsPqeDUGmVAHX7VCrCAAAAUA"]
[Sun Mar 01 02:15:13.513963 2026] [:error] [pid 11920:tid 11931] [client 20.220.13.5:10205] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/"] [unique_id "aaMwsSzLNJUKxvBorrDylwAAAYc"]
[Sun Mar 01 02:15:14.349265 2026] [:error] [pid 30798:tid 30907] [client 20.220.13.5:9265] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-admin/a.php"] [unique_id "aaMwssBkD73gO8wTonagFAAAAIg"]
[Sun Mar 01 02:15:15.177937 2026] [:error] [pid 31190:tid 31216] [client 20.220.13.5:10220] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-admin/alfa.php"] [unique_id "aaMwsxfvwGOholYpM1GemwAAAMo"]
[Sun Mar 01 02:15:16.012811 2026] [:error] [pid 31190:tid 31230] [client 20.220.13.5:9606] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors"] [unique_id "aaMwtBfvwGOholYpM1GeoQAAANg"]
[Sun Mar 01 02:15:16.852531 2026] [:error] [pid 31190:tid 31229] [client 20.220.13.5:10183] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/widgets/"] [unique_id "aaMwtBfvwGOholYpM1GeqgAAANc"]
[Sun Mar 01 02:15:17.688151 2026] [:error] [pid 11920:tid 11941] [client 20.220.13.5:9276] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/index.php"] [unique_id "aaMwtSzLNJUKxvBorrDyrQAAAZE"]
[Sun Mar 01 02:15:18.529619 2026] [:error] [pid 31190:tid 31211] [client 20.220.13.5:9222] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "aaMwthfvwGOholYpM1GeswAAAMU"]
[Sun Mar 01 02:15:19.357733 2026] [:error] [pid 31190:tid 31229] [client 20.220.13.5:10217] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "aaMwtxfvwGOholYpM1GetwAAANc"]
[Sun Mar 01 02:15:20.181244 2026] [:error] [pid 30798:tid 30901] [client 20.220.13.5:9275] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/cropper.php"] [unique_id "aaMwuMBkD73gO8wTonagJwAAAII"]
[Sun Mar 01 02:15:21.020931 2026] [:error] [pid 30798:tid 30904] [client 20.220.13.5:10190] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/"] [unique_id "aaMwucBkD73gO8wTonagKgAAAIU"]
[Sun Mar 01 02:15:21.859876 2026] [:error] [pid 11920:tid 11935] [client 20.220.13.5:9255] [client 20.220.13.5] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.220.13.5 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/"] [unique_id "aaMwuSzLNJUKxvBorrDyxwAAAYs"]
[Sun Mar 01 02:17:44.739453 2026] [:error] [pid 30798:tid 30899] [client 20.63.83.162:49001] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-corn-sample.php"] [unique_id "aaMxSMBkD73gO8wTonaiaAAAAIA"]
[Sun Mar 01 02:17:45.657127 2026] [:error] [pid 30798:tid 30900] [client 20.63.83.162:48984] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-corn-sample.php"] [unique_id "aaMxScBkD73gO8wTonaiagAAAIE"]
[Sun Mar 01 02:17:46.521983 2026] [:error] [pid 11920:tid 11931] [client 20.63.83.162:48359] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-corn-sample.php"] [unique_id "aaMxSizLNJUKxvBorrD2FgAAAYc"]
[Sun Mar 01 02:17:47.461710 2026] [:error] [pid 31190:tid 31226] [client 20.63.83.162:48988] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-corn-sample.php"] [unique_id "aaMxSxfvwGOholYpM1GgqQAAANQ"]
[Sun Mar 01 03:16:18.805535 2026] [:error] [pid 30798:tid 30903] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/yo.php
[Sun Mar 01 03:16:19.015912 2026] [:error] [pid 30798:tid 30916] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sun Mar 01 03:16:19.230958 2026] [:error] [pid 30798:tid 30918] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/ba.php
[Sun Mar 01 03:16:19.439160 2026] [:error] [pid 30798:tid 30910] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/ym.php
[Sun Mar 01 03:16:19.647123 2026] [:error] [pid 30798:tid 30924] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sun Mar 01 03:16:19.855126 2026] [:error] [pid 30798:tid 30920] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Sun Mar 01 03:16:20.072132 2026] [:error] [pid 30798:tid 30900] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Mar 01 03:16:20.279922 2026] [:error] [pid 30798:tid 30923] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Sun Mar 01 03:16:20.488536 2026] [:error] [pid 30798:tid 30901] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Sun Mar 01 03:16:20.698265 2026] [:error] [pid 30798:tid 30917] [client 20.104.206.150:52011] File does not exist: /usr/local/apache/htdocs/suspended-page/asd67.php
[Sun Mar 01 03:16:20.911043 2026] [:error] [pid 30798:tid 30916] [client 20.104.206.150:52011] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaM_BMBkD73gO8wTonbd1AAAAJE"]
[Sun Mar 01 03:16:21.346764 2026] [:error] [pid 30795:tid 30815] [client 20.104.206.150:51968] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaM_BWuI44IL94Zgti_WwQAAAAc"]
[Sun Mar 01 03:16:21.793844 2026] [:error] [pid 53600:tid 53609] [client 20.104.206.150:52014] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaM_BQ2UMRAYWtDB23QJBAAAAQY"]
[Sun Mar 01 03:16:22.407591 2026] [:error] [pid 30798:tid 30914] [client 20.104.206.150:51994] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "aaM_BsBkD73gO8wTonbd2AAAAI8"]
[Sun Mar 01 03:16:22.850260 2026] [:error] [pid 30798:tid 30920] [client 20.104.206.150:51497] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaM_BsBkD73gO8wTonbd2wAAAJQ"]
[Sun Mar 01 03:16:23.371669 2026] [:error] [pid 30798:tid 30916] [client 20.104.206.150:52024] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaM_B8BkD73gO8wTonbd4gAAAJE"]
[Sun Mar 01 03:16:24.002214 2026] [:error] [pid 30798:tid 30917] [client 20.104.206.150:51550] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaM_CMBkD73gO8wTonbd6gAAAJI"]
[Sun Mar 01 03:16:24.448247 2026] [:error] [pid 30795:tid 30818] [client 20.104.206.150:52063] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "aaM_CGuI44IL94Zgti_WxwAAAAo"]
[Sun Mar 01 03:16:24.882354 2026] [:error] [pid 30795:tid 30816] [client 20.104.206.150:52088] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaM_CGuI44IL94Zgti_WyQAAAAg"]
[Sun Mar 01 03:16:25.310851 2026] [:error] [pid 31190:tid 31217] [client 20.104.206.150:52054] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaM_CRfvwGOholYpM1HGkgAAAMs"]
[Sun Mar 01 03:16:25.757902 2026] [:error] [pid 30797:tid 30872] [client 20.104.206.150:51991] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaM_CfQmcmSQL-3rvLAY-QAAAEE"]
[Sun Mar 01 03:16:26.208670 2026] [:error] [pid 11920:tid 11947] [client 20.104.206.150:52043] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/000.php"] [unique_id "aaM_CizLNJUKxvBorrA7EwAAAZc"]
[Sun Mar 01 03:16:26.645572 2026] [:error] [pid 31190:tid 31206] [client 20.104.206.150:51575] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaM_ChfvwGOholYpM1HGmQAAAMA"]
[Sun Mar 01 03:16:27.129832 2026] [:error] [pid 30798:tid 30906] [client 20.104.206.150:52069] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaM_C8BkD73gO8wTonbd-AAAAIc"]
[Sun Mar 01 03:16:27.558498 2026] [:error] [pid 30798:tid 30903] [client 20.104.206.150:51571] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaM_C8BkD73gO8wTonbd-wAAAIQ"]
[Sun Mar 01 03:16:28.032905 2026] [:error] [pid 11920:tid 11938] [client 20.104.206.150:51975] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mails.php"] [unique_id "aaM_DCzLNJUKxvBorrA7FgAAAY4"]
[Sun Mar 01 03:16:28.469450 2026] [:error] [pid 31190:tid 31211] [client 20.104.206.150:51972] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaM_DBfvwGOholYpM1HGmwAAAMU"]
[Sun Mar 01 03:16:28.877853 2026] [:error] [pid 31190:tid 31212] [client 20.104.206.150:51989] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaM_DBfvwGOholYpM1HGnAAAAMY"]
[Sun Mar 01 03:16:29.313020 2026] [:error] [pid 11920:tid 11942] [client 20.104.206.150:51982] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaM_DSzLNJUKxvBorrA7HAAAAZI"]
[Sun Mar 01 03:16:29.722911 2026] [:error] [pid 53600:tid 53607] [client 20.104.206.150:52026] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xex.php"] [unique_id "aaM_DQ2UMRAYWtDB23QJGwAAAQQ"]
[Sun Mar 01 03:16:30.174643 2026] [:error] [pid 11920:tid 11945] [client 20.104.206.150:52056] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaM_DizLNJUKxvBorrA7IAAAAZU"]
[Sun Mar 01 03:16:30.593342 2026] [:error] [pid 31190:tid 31217] [client 20.104.206.150:52065] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaM_DhfvwGOholYpM1HGoQAAAMs"]
[Sun Mar 01 03:16:31.004748 2026] [:error] [pid 11920:tid 11935] [client 20.104.206.150:51530] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaM_DyzLNJUKxvBorrA7JgAAAYs"]
[Sun Mar 01 03:16:31.412745 2026] [:error] [pid 11920:tid 11943] [client 20.104.206.150:52004] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3.php"] [unique_id "aaM_DyzLNJUKxvBorrA7KgAAAZM"]
[Sun Mar 01 03:16:31.828511 2026] [:error] [pid 11920:tid 11945] [client 20.104.206.150:51535] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaM_DyzLNJUKxvBorrA7MQAAAZU"]
[Sun Mar 01 03:16:32.288406 2026] [:error] [pid 31190:tid 31210] [client 20.104.206.150:52075] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaM_EBfvwGOholYpM1HGowAAAMQ"]
[Sun Mar 01 03:16:32.743028 2026] [:error] [pid 11920:tid 11927] [client 20.104.206.150:51971] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaM_ECzLNJUKxvBorrA7PQAAAYM"]
[Sun Mar 01 03:16:33.191842 2026] [:error] [pid 11920:tid 11926] [client 20.104.206.150:51539] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/key.php"] [unique_id "aaM_ESzLNJUKxvBorrA7QgAAAYI"]
[Sun Mar 01 03:16:33.682769 2026] [:error] [pid 7644:tid 7651] [client 20.104.206.150:51536] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaM_EfqeDUGmVAHX7VC7OgAAAUU"]
[Sun Mar 01 03:16:34.230290 2026] [:error] [pid 30798:tid 30910] [client 20.104.206.150:52022] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaM_EsBkD73gO8wTonbeCQAAAIs"]
[Sun Mar 01 03:16:34.701662 2026] [:error] [pid 53600:tid 53622] [client 20.104.206.150:52091] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaM_Eg2UMRAYWtDB23QJJQAAARM"]
[Sun Mar 01 03:16:35.153615 2026] [:error] [pid 30798:tid 30907] [client 20.104.206.150:51516] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/667.php"] [unique_id "aaM_E8BkD73gO8wTonbeCwAAAIg"]
[Sun Mar 01 03:16:35.598081 2026] [:error] [pid 31190:tid 31226] [client 20.104.206.150:52081] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaM_ExfvwGOholYpM1HGqwAAANQ"]
[Sun Mar 01 03:16:36.031236 2026] [:error] [pid 53600:tid 53625] [client 20.104.206.150:52071] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaM_FA2UMRAYWtDB23QJLQAAARY"]
[Sun Mar 01 03:16:36.481749 2026] [:error] [pid 31190:tid 31227] [client 20.104.206.150:52057] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaM_FBfvwGOholYpM1HGrQAAANU"]
[Sun Mar 01 03:16:36.920787 2026] [:error] [pid 30798:tid 30913] [client 20.104.206.150:52028] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ctfbe.php"] [unique_id "aaM_FMBkD73gO8wTonbeGQAAAI4"]
[Sun Mar 01 03:16:37.365275 2026] [:error] [pid 31190:tid 31218] [client 20.104.206.150:51983] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaM_FRfvwGOholYpM1HGswAAAMw"]
[Sun Mar 01 03:16:37.843153 2026] [:error] [pid 30798:tid 30921] [client 20.104.206.150:51526] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaM_FcBkD73gO8wTonbeGwAAAJU"]
[Sun Mar 01 03:16:38.291703 2026] [:error] [pid 30798:tid 30910] [client 20.104.206.150:52058] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaM_FsBkD73gO8wTonbeHgAAAIs"]
[Sun Mar 01 03:16:38.970450 2026] [:error] [pid 7644:tid 7657] [client 20.104.206.150:52053] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hkweu.php"] [unique_id "aaM_FvqeDUGmVAHX7VC7QAAAAUs"]
[Sun Mar 01 03:16:39.666873 2026] [:error] [pid 30798:tid 30908] [client 20.104.206.150:52086] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaM_F8BkD73gO8wTonbeKwAAAIk"]
[Sun Mar 01 03:16:40.098961 2026] [:error] [pid 30798:tid 30917] [client 20.104.206.150:51528] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaM_GMBkD73gO8wTonbeLwAAAJI"]
[Sun Mar 01 03:16:40.578265 2026] [:error] [pid 30798:tid 30924] [client 20.104.206.150:52005] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaM_GMBkD73gO8wTonbeNAAAAJg"]
[Sun Mar 01 03:16:41.038158 2026] [:error] [pid 53600:tid 53620] [client 20.104.206.150:51998] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qdlte.php"] [unique_id "aaM_GQ2UMRAYWtDB23QJNQAAARE"]
[Sun Mar 01 03:16:41.539292 2026] [:error] [pid 31190:tid 31227] [client 20.104.206.150:51537] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f7.php"] [unique_id "aaM_GRfvwGOholYpM1HGvgAAANU"]
[Sun Mar 01 03:16:41.995633 2026] [:error] [pid 30795:tid 30827] [client 20.104.206.150:51970] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f7.php"] [unique_id "aaM_GWuI44IL94Zgti_W2gAAABM"]
[Sun Mar 01 03:16:42.513321 2026] [:error] [pid 30798:tid 30923] [client 20.104.206.150:51014] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f7.php"] [unique_id "aaM_GsBkD73gO8wTonbePQAAAJc"]
[Sun Mar 01 03:16:43.125360 2026] [:error] [pid 30798:tid 30901] [client 20.104.206.150:51493] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f7.php"] [unique_id "aaM_G8BkD73gO8wTonbeRAAAAII"]
[Sun Mar 01 03:16:43.541701 2026] [:error] [pid 30798:tid 30923] [client 20.104.206.150:52037] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaM_G8BkD73gO8wTonbeRgAAAJc"]
[Sun Mar 01 03:16:44.009819 2026] [:error] [pid 30798:tid 30922] [client 20.104.206.150:52045] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaM_HMBkD73gO8wTonbeTQAAAJY"]
[Sun Mar 01 03:16:44.452677 2026] [:error] [pid 11920:tid 11924] [client 20.104.206.150:51490] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaM_HCzLNJUKxvBorrA7VAAAAYA"]
[Sun Mar 01 03:16:44.917355 2026] [:error] [pid 11920:tid 11927] [client 20.104.206.150:51045] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "aaM_HCzLNJUKxvBorrA7VwAAAYM"]
[Sun Mar 01 03:16:45.390070 2026] [:error] [pid 30798:tid 30913] [client 20.104.206.150:52019] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp7.php"] [unique_id "aaM_HcBkD73gO8wTonbeXgAAAI4"]
[Sun Mar 01 03:16:45.849653 2026] [:error] [pid 30798:tid 30912] [client 20.104.206.150:52039] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp7.php"] [unique_id "aaM_HcBkD73gO8wTonbeZwAAAI0"]
[Sun Mar 01 03:16:46.336184 2026] [:error] [pid 30798:tid 30906] [client 20.104.206.150:52023] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp7.php"] [unique_id "aaM_HsBkD73gO8wTonbeawAAAIc"]
[Sun Mar 01 03:16:46.777777 2026] [:error] [pid 30798:tid 30909] [client 20.104.206.150:52049] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp7.php"] [unique_id "aaM_HsBkD73gO8wTonbecAAAAIo"]
[Sun Mar 01 03:16:47.218287 2026] [:error] [pid 30798:tid 30914] [client 20.104.206.150:52066] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C1.php"] [unique_id "aaM_H8BkD73gO8wTonbedgAAAI8"]
[Sun Mar 01 03:16:47.700112 2026] [:error] [pid 31190:tid 31221] [client 20.104.206.150:51570] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C1.php"] [unique_id "aaM_HxfvwGOholYpM1HG0gAAAM8"]
[Sun Mar 01 03:16:48.144209 2026] [:error] [pid 7644:tid 7668] [client 20.104.206.150:51028] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C1.php"] [unique_id "aaM_IPqeDUGmVAHX7VC7XgAAAVY"]
[Sun Mar 01 03:16:48.641571 2026] [:error] [pid 30795:tid 30811] [client 20.104.206.150:52001] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/C1.php"] [unique_id "aaM_IGuI44IL94Zgti_W3AAAAAM"]
[Sun Mar 01 03:16:49.267194 2026] [:error] [pid 31190:tid 31230] [client 20.104.206.150:51576] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clcdu.php"] [unique_id "aaM_IRfvwGOholYpM1HG1gAAANg"]
[Sun Mar 01 03:16:49.840198 2026] [:error] [pid 30798:tid 30908] [client 20.104.206.150:51471] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clcdu.php"] [unique_id "aaM_IcBkD73gO8wTonbehQAAAIk"]
[Sun Mar 01 03:16:50.476972 2026] [:error] [pid 30798:tid 30914] [client 20.104.206.150:51532] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clcdu.php"] [unique_id "aaM_IsBkD73gO8wTonbejQAAAI8"]
[Sun Mar 01 03:16:50.936146 2026] [:error] [pid 31190:tid 31213] [client 20.104.206.150:51475] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clcdu.php"] [unique_id "aaM_IhfvwGOholYpM1HG2QAAAMc"]
[Sun Mar 01 03:16:51.420337 2026] [:error] [pid 11920:tid 11924] [client 20.104.206.150:51459] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffbsq.php"] [unique_id "aaM_IyzLNJUKxvBorrA7YwAAAYA"]
[Sun Mar 01 03:16:51.874763 2026] [:error] [pid 30795:tid 30810] [client 20.104.206.150:52035] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffbsq.php"] [unique_id "aaM_I2uI44IL94Zgti_W3gAAAAI"]
[Sun Mar 01 03:16:52.329408 2026] [:error] [pid 30798:tid 30899] [client 20.104.206.150:51522] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffbsq.php"] [unique_id "aaM_JMBkD73gO8wTonbelQAAAIA"]
[Sun Mar 01 03:16:52.794790 2026] [:error] [pid 30798:tid 30902] [client 20.104.206.150:51505] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffbsq.php"] [unique_id "aaM_JMBkD73gO8wTonbemgAAAIM"]
[Sun Mar 01 03:16:53.321297 2026] [:error] [pid 30795:tid 30825] [client 20.104.206.150:51456] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/resp.php"] [unique_id "aaM_JWuI44IL94Zgti_W4AAAABE"]
[Sun Mar 01 03:16:53.781593 2026] [:error] [pid 11920:tid 11928] [client 20.104.206.150:51553] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/resp.php"] [unique_id "aaM_JSzLNJUKxvBorrA7bQAAAYQ"]
[Sun Mar 01 03:16:54.311295 2026] [:error] [pid 53600:tid 53616] [client 20.104.206.150:52040] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/resp.php"] [unique_id "aaM_Jg2UMRAYWtDB23QJUAAAAQ0"]
[Sun Mar 01 03:16:54.753296 2026] [:error] [pid 11920:tid 11938] [client 20.104.206.150:52084] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/resp.php"] [unique_id "aaM_JizLNJUKxvBorrA7fQAAAY4"]
[Sun Mar 01 03:16:55.231900 2026] [:error] [pid 30795:tid 30824] [client 20.104.206.150:52010] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaM_J2uI44IL94Zgti_W4gAAABA"]
[Sun Mar 01 03:16:55.718376 2026] [:error] [pid 11920:tid 11940] [client 20.104.206.150:51984] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaM_JyzLNJUKxvBorrA7hQAAAZA"]
[Sun Mar 01 03:16:56.261713 2026] [:error] [pid 31190:tid 31223] [client 20.104.206.150:52006] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaM_KBfvwGOholYpM1HG4QAAANE"]
[Sun Mar 01 03:16:56.768085 2026] [:error] [pid 30798:tid 30912] [client 20.104.206.150:51548] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aaM_KMBkD73gO8wTonbeqAAAAI0"]
[Sun Mar 01 03:16:57.260131 2026] [:error] [pid 53600:tid 53606] [client 20.104.206.150:51976] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaM_KQ2UMRAYWtDB23QJWAAAAQM"]
[Sun Mar 01 03:16:57.897251 2026] [:error] [pid 53600:tid 53614] [client 20.104.206.150:50964] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaM_KQ2UMRAYWtDB23QJXAAAAQs"]
[Sun Mar 01 03:16:58.447145 2026] [:error] [pid 53600:tid 53610] [client 20.104.206.150:52025] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaM_Kg2UMRAYWtDB23QJXwAAAQc"]
[Sun Mar 01 03:16:59.014239 2026] [:error] [pid 30795:tid 30829] [client 20.104.206.150:51476] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaM_K2uI44IL94Zgti_W6gAAABU"]
[Sun Mar 01 03:16:59.535705 2026] [:error] [pid 30798:tid 30910] [client 20.104.206.150:51574] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kma.php"] [unique_id "aaM_K8BkD73gO8wTonbeswAAAIs"]
[Sun Mar 01 03:17:00.050614 2026] [:error] [pid 31190:tid 31227] [client 20.104.206.150:51554] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kma.php"] [unique_id "aaM_LBfvwGOholYpM1HG6AAAANU"]
[Sun Mar 01 03:17:00.503372 2026] [:error] [pid 30795:tid 30826] [client 20.104.206.150:51980] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kma.php"] [unique_id "aaM_LGuI44IL94Zgti_W7AAAABI"]
[Sun Mar 01 03:17:01.017949 2026] [:error] [pid 31190:tid 31217] [client 20.104.206.150:51544] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kma.php"] [unique_id "aaM_LRfvwGOholYpM1HG7AAAAMs"]
[Sun Mar 01 03:17:01.458885 2026] [:error] [pid 30798:tid 30917] [client 20.104.206.150:51499] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aaM_LcBkD73gO8wTonbeuwAAAJI"]
[Sun Mar 01 03:17:01.892645 2026] [:error] [pid 30798:tid 30901] [client 20.104.206.150:51524] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aaM_LcBkD73gO8wTonbewAAAAII"]
[Sun Mar 01 03:17:02.397210 2026] [:error] [pid 11920:tid 11926] [client 20.104.206.150:52078] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aaM_LizLNJUKxvBorrA7uAAAAYI"]
[Sun Mar 01 03:17:02.913433 2026] [:error] [pid 30798:tid 30924] [client 20.104.206.150:52052] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "aaM_LsBkD73gO8wTonbeygAAAJg"]
[Sun Mar 01 03:17:03.439170 2026] [:error] [pid 7644:tid 7657] [client 20.104.206.150:51993] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaM_L_qeDUGmVAHX7VC7mAAAAUs"]
[Sun Mar 01 03:17:03.987115 2026] [:error] [pid 11920:tid 11936] [client 20.104.206.150:52080] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaM_LyzLNJUKxvBorrA7xgAAAYw"]
[Sun Mar 01 03:17:04.444186 2026] [:error] [pid 30798:tid 30911] [client 20.104.206.150:51041] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaM_MMBkD73gO8wTonbe0wAAAIw"]
[Sun Mar 01 03:17:04.925869 2026] [:error] [pid 30798:tid 30900] [client 20.104.206.150:51485] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ova-wso.php"] [unique_id "aaM_MMBkD73gO8wTonbe1wAAAIE"]
[Sun Mar 01 03:17:05.478654 2026] [:error] [pid 30798:tid 30922] [client 20.104.206.150:51986] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaM_McBkD73gO8wTonbe3wAAAJY"]
[Sun Mar 01 03:17:06.054250 2026] [:error] [pid 30798:tid 30901] [client 20.104.206.150:51525] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaM_MsBkD73gO8wTonbe5AAAAII"]
[Sun Mar 01 03:17:06.518934 2026] [:error] [pid 30798:tid 30899] [client 20.104.206.150:51557] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaM_MsBkD73gO8wTonbe5wAAAIA"]
[Sun Mar 01 03:17:07.255128 2026] [:error] [pid 30798:tid 30915] [client 20.104.206.150:51969] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjq.php"] [unique_id "aaM_M8BkD73gO8wTonbe8wAAAJA"]
[Sun Mar 01 03:17:07.720577 2026] [:error] [pid 7644:tid 7668] [client 20.104.206.150:51990] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaM_M_qeDUGmVAHX7VC7oAAAAVY"]
[Sun Mar 01 03:17:08.347194 2026] [:error] [pid 31190:tid 31230] [client 20.104.206.150:51556] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaM_NBfvwGOholYpM1HG8gAAANg"]
[Sun Mar 01 03:17:08.871219 2026] [:error] [pid 7644:tid 7651] [client 20.104.206.150:52046] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaM_NPqeDUGmVAHX7VC7pQAAAUU"]
[Sun Mar 01 03:17:09.558545 2026] [:error] [pid 30798:tid 30922] [client 20.104.206.150:52017] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php7"] [unique_id "aaM_NcBkD73gO8wTonbe_QAAAJY"]
[Sun Mar 01 03:17:10.122409 2026] [:error] [pid 30798:tid 30910] [client 20.104.206.150:51560] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaM_NsBkD73gO8wTonbfBAAAAIs"]
[Sun Mar 01 03:17:10.553579 2026] [:error] [pid 30798:tid 30921] [client 20.104.206.150:51465] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaM_NsBkD73gO8wTonbfCAAAAJU"]
[Sun Mar 01 03:17:11.048885 2026] [:error] [pid 11920:tid 11928] [client 20.104.206.150:51068] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaM_NyzLNJUKxvBorrA74gAAAYQ"]
[Sun Mar 01 03:17:11.515554 2026] [:error] [pid 11920:tid 11947] [client 20.104.206.150:51579] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "aaM_NyzLNJUKxvBorrA75gAAAZc"]
[Sun Mar 01 03:17:11.962337 2026] [:error] [pid 11920:tid 11939] [client 20.104.206.150:51545] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaM_NyzLNJUKxvBorrA76wAAAY8"]
[Sun Mar 01 03:17:12.481709 2026] [:error] [pid 30798:tid 30917] [client 20.104.206.150:52044] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaM_OMBkD73gO8wTonbfGQAAAJI"]
[Sun Mar 01 03:17:12.982041 2026] [:error] [pid 31190:tid 31214] [client 20.104.206.150:52092] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaM_OBfvwGOholYpM1HG-AAAAMg"]
[Sun Mar 01 03:17:13.473746 2026] [:error] [pid 31190:tid 31219] [client 20.104.206.150:51978] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sql.php7"] [unique_id "aaM_ORfvwGOholYpM1HG-wAAAM0"]
[Sun Mar 01 03:17:13.947519 2026] [:error] [pid 30798:tid 30906] [client 20.104.206.150:51997] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaM_OcBkD73gO8wTonbfIgAAAIc"]
[Sun Mar 01 03:17:14.438912 2026] [:error] [pid 30798:tid 30912] [client 20.104.206.150:52050] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaM_OsBkD73gO8wTonbfKgAAAI0"]
[Sun Mar 01 03:17:14.916406 2026] [:error] [pid 30798:tid 30922] [client 20.104.206.150:52060] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaM_OsBkD73gO8wTonbfMQAAAJY"]
[Sun Mar 01 03:17:15.356403 2026] [:error] [pid 30798:tid 30910] [client 20.104.206.150:52020] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "aaM_O8BkD73gO8wTonbfOQAAAIs"]
[Sun Mar 01 03:17:15.969822 2026] [:error] [pid 30798:tid 30923] [client 20.104.206.150:51463] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaM_O8BkD73gO8wTonbfRQAAAJc"]
[Sun Mar 01 03:17:16.432124 2026] [:error] [pid 30798:tid 30912] [client 20.104.206.150:51546] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaM_PMBkD73gO8wTonbfSwAAAI0"]
[Sun Mar 01 03:17:16.896069 2026] [:error] [pid 11920:tid 11939] [client 20.104.206.150:52033] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaM_PCzLNJUKxvBorrA79wAAAY8"]
[Sun Mar 01 03:17:17.380741 2026] [:error] [pid 30798:tid 30899] [client 20.104.206.150:51547] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc.php"] [unique_id "aaM_PcBkD73gO8wTonbfXQAAAIA"]
[Sun Mar 01 03:17:17.897619 2026] [:error] [pid 30798:tid 30911] [client 20.104.206.150:51531] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaM_PcBkD73gO8wTonbfagAAAIw"]
[Sun Mar 01 03:17:18.382856 2026] [:error] [pid 30798:tid 30913] [client 20.104.206.150:51987] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaM_PsBkD73gO8wTonbfegAAAI4"]
[Sun Mar 01 03:17:19.001660 2026] [:error] [pid 30798:tid 30907] [client 20.104.206.150:51566] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaM_P8BkD73gO8wTonbfhwAAAIg"]
[Sun Mar 01 03:17:19.525950 2026] [:error] [pid 30798:tid 30913] [client 20.104.206.150:52093] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "aaM_P8BkD73gO8wTonbflQAAAI4"]
[Sun Mar 01 04:26:57.814307 2026] [:error] [pid 21156:tid 21178] [client 145.239.10.137:50901] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php, referer: http://aoswa.com.au/wo.php
[Sun Mar 01 04:39:11.780147 2026] [:error] [pid 21158:tid 21215] [client 103.65.236.153:55115] [client 103.65.236.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aaNSbzriSIe3-pWnbPbPzgAAAFY"]
[Sun Mar 01 05:06:33.343586 2026] [:error] [pid 24576:tid 24594] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 05:06:33.575407 2026] [:error] [pid 24576:tid 24592] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Mar 01 05:06:33.790915 2026] [:error] [pid 24576:tid 24589] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Mar 01 05:06:34.003352 2026] [:error] [pid 24576:tid 24579] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 01 05:06:34.214629 2026] [:error] [pid 24576:tid 24581] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 01 05:06:34.427646 2026] [:error] [pid 24576:tid 24584] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sun Mar 01 05:06:34.640321 2026] [:error] [pid 24576:tid 24587] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 05:06:34.851208 2026] [:error] [pid 24576:tid 24594] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 01 05:06:35.061960 2026] [:error] [pid 24576:tid 24602] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/fx.php
[Sun Mar 01 05:06:35.339201 2026] [:error] [pid 24576:tid 24592] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/contact_tpl.php
[Sun Mar 01 05:06:35.618162 2026] [:error] [pid 24576:tid 24597] [client 20.104.96.199:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Mar 01 05:06:35.827091 2026] [:error] [pid 24576:tid 24593] [client 20.104.96.199:44929] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNY24vfb5CnctJh073rhAAAAQ0"]
[Sun Mar 01 05:06:36.760998 2026] [:error] [pid 21263:tid 21282] [client 20.104.96.199:44751] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNY3NAxjzLvN1upBhnYgwAAAM8"]
[Sun Mar 01 05:06:37.859341 2026] [:error] [pid 24576:tid 24580] [client 20.104.96.199:44991] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNY3Yvfb5CnctJh073rjgAAAQE"]
[Sun Mar 01 05:06:38.999770 2026] [:error] [pid 21159:tid 21224] [client 20.104.96.199:44062] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNY3uLi3ouy1NZIkgobpwAAAIM"]
[Sun Mar 01 05:08:14.342863 2026] [:error] [pid 21159:tid 21221] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 05:08:14.604787 2026] [:error] [pid 21159:tid 21227] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Mar 01 05:08:14.817854 2026] [:error] [pid 21159:tid 21243] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Mar 01 05:08:15.065225 2026] [:error] [pid 21159:tid 21223] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 01 05:08:15.292005 2026] [:error] [pid 21159:tid 21233] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 01 05:08:15.504873 2026] [:error] [pid 21159:tid 21237] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sun Mar 01 05:08:15.805948 2026] [:error] [pid 21159:tid 21224] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 05:08:16.064978 2026] [:error] [pid 21159:tid 21244] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 01 05:08:16.275666 2026] [:error] [pid 21159:tid 21240] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/fx.php
[Sun Mar 01 05:08:16.490362 2026] [:error] [pid 21159:tid 21222] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/contact_tpl.php
[Sun Mar 01 05:08:16.779916 2026] [:error] [pid 21159:tid 21229] [client 20.104.96.199:44064] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Mar 01 05:08:16.988534 2026] [:error] [pid 21159:tid 21242] [client 20.104.96.199:44064] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNZQOLi3ouy1NZIkgocYQAAAJU"]
[Sun Mar 01 05:08:19.219421 2026] [:error] [pid 24576:tid 24601] [client 20.104.96.199:44053] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNZQ4vfb5CnctJh073tJQAAARU"]
[Sun Mar 01 05:08:21.285934 2026] [:error] [pid 21263:tid 21272] [client 20.104.96.199:44060] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNZRdAxjzLvN1upBhnZ7wAAAMU"]
[Sun Mar 01 05:08:22.822994 2026] [:error] [pid 21263:tid 21282] [client 20.104.96.199:44066] [client 20.104.96.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aaNZRtAxjzLvN1upBhnZ-AAAAM8"]
[Sun Mar 01 05:31:44.680070 2026] [:error] [pid 21156:tid 21189] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Sun Mar 01 05:31:44.892716 2026] [:error] [pid 21156:tid 21190] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/f.php
[Sun Mar 01 05:31:45.099622 2026] [:error] [pid 21156:tid 21180] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Sun Mar 01 05:31:45.308192 2026] [:error] [pid 21156:tid 21168] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Sun Mar 01 05:31:45.554949 2026] [:error] [pid 21156:tid 21176] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 01 05:31:45.812591 2026] [:error] [pid 21156:tid 21182] [client 20.63.83.162:48385] [client 20.63.83.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.83.162, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "aaNewasaG_9IkG8N2p3rHQAAABA"]
[Sun Mar 01 05:31:46.027359 2026] [:error] [pid 21156:tid 21185] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Mar 01 05:31:46.250217 2026] [:error] [pid 21156:tid 21170] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Mar 01 05:31:46.459148 2026] [:error] [pid 21156:tid 21178] [client 20.63.83.162:48385] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Mar 01 05:31:46.663823 2026] [:error] [pid 21156:tid 21179] [client 20.63.83.162:48385] [client 20.63.83.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.83.162, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaNewqsaG_9IkG8N2p3rIgAAAA0"]
[Sun Mar 01 05:31:46.663901 2026] [:error] [pid 21156:tid 21179] [client 20.63.83.162:48385] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaNewqsaG_9IkG8N2p3rIgAAAA0"]
[Sun Mar 01 05:31:47.743106 2026] [:error] [pid 21159:tid 21225] [client 20.63.83.162:48393] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "aaNew-Li3ouy1NZIkgomIQAAAIQ"]
[Sun Mar 01 05:31:48.954748 2026] [:error] [pid 21159:tid 21233] [client 20.63.83.162:48698] [client 20.63.83.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.63.83.162, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaNexOLi3ouy1NZIkgomKwAAAIw"]
[Sun Mar 01 05:31:48.954820 2026] [:error] [pid 21159:tid 21233] [client 20.63.83.162:48698] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaNexOLi3ouy1NZIkgomKwAAAIw"]
[Sun Mar 01 05:31:50.003640 2026] [:error] [pid 21158:tid 21193] [client 20.63.83.162:48700] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2025/"] [unique_id "aaNexjriSIe3-pWnbPbjKwAAAEA"]
[Sun Mar 01 05:31:51.023214 2026] [:error] [pid 21158:tid 21194] [client 20.63.83.162:48387] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "aaNexzriSIe3-pWnbPbjLwAAAEE"]
[Sun Mar 01 05:31:51.980061 2026] [:error] [pid 21158:tid 21199] [client 20.63.83.162:48687] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "aaNexzriSIe3-pWnbPbjMQAAAEY"]
[Sun Mar 01 05:31:52.945927 2026] [:error] [pid 24576:tid 24602] [client 20.63.83.162:48675] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/upload/login.php"] [unique_id "aaNeyIvfb5CnctJh070EpAAAARY"]
[Sun Mar 01 05:31:54.006438 2026] [:error] [pid 8688:tid 8709] [client 20.63.83.162:48391] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "aaNeyjHJ4Nn-RvulD0qRBgAAAVM"]
[Sun Mar 01 05:31:55.023783 2026] [:error] [pid 21159:tid 21238] [client 20.63.83.162:48389] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaNey-Li3ouy1NZIkgomQwAAAJE"]
[Sun Mar 01 05:31:56.186695 2026] [:error] [pid 21158:tid 21214] [client 20.63.83.162:48386] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aaNezDriSIe3-pWnbPbjNAAAAFU"]
[Sun Mar 01 05:31:57.333799 2026] [:error] [pid 21156:tid 21173] [client 20.63.83.162:48653] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "aaNezasaG_9IkG8N2p3rOwAAAAc"]
[Sun Mar 01 05:31:58.455530 2026] [:error] [pid 24576:tid 24596] [client 20.63.83.162:48654] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/"] [unique_id "aaNezovfb5CnctJh070ExQAAARA"]
[Sun Mar 01 05:31:59.784054 2026] [:error] [pid 21263:tid 21285] [client 20.63.83.162:48395] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aaNez9AxjzLvN1upBhnntgAAANI"]
[Sun Mar 01 05:32:00.807351 2026] [:error] [pid 24576:tid 24585] [client 20.63.83.162:48400] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aaNe0Ivfb5CnctJh070E1QAAAQY"]
[Sun Mar 01 05:32:01.954249 2026] [:error] [pid 21156:tid 21172] [client 20.63.83.162:48642] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aaNe0asaG_9IkG8N2p3rPAAAAAY"]
[Sun Mar 01 05:32:03.070831 2026] [:error] [pid 21263:tid 21281] [client 20.63.83.162:48676] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/xml.php"] [unique_id "aaNe09AxjzLvN1upBhnnwQAAAM4"]
[Sun Mar 01 05:32:04.164447 2026] [:error] [pid 8688:tid 8710] [client 20.63.83.162:48674] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaNe1DHJ4Nn-RvulD0qROgAAAVQ"]
[Sun Mar 01 05:32:05.194207 2026] [:error] [pid 24576:tid 24587] [client 20.63.83.162:48398] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaNe1Yvfb5CnctJh070E8AAAAQg"]
[Sun Mar 01 05:32:06.332890 2026] [:error] [pid 21159:tid 21232] [client 20.63.83.162:48670] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "aaNe1uLi3ouy1NZIkgomYgAAAIs"]
[Sun Mar 01 05:32:07.365225 2026] [:error] [pid 24576:tid 24584] [client 20.63.83.162:48644] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aaNe14vfb5CnctJh070E_AAAAQU"]
[Sun Mar 01 05:32:08.483479 2026] [:error] [pid 24576:tid 24593] [client 20.63.83.162:48394] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admiin.php"] [unique_id "aaNe2Ivfb5CnctJh070FBQAAAQ0"]
[Sun Mar 01 05:32:09.698734 2026] [:error] [pid 21263:tid 21277] [client 20.63.83.162:48680] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/admin.phphttps://www-vn500.com/inputs.php"] [unique_id "aaNe2dAxjzLvN1upBhnn0wAAAMo"]
[Sun Mar 01 05:32:10.714788 2026] [:error] [pid 24576:tid 24579] [client 20.63.83.162:48666] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaNe2ovfb5CnctJh070FFwAAAQA"]
[Sun Mar 01 05:32:11.687032 2026] [:error] [pid 24576:tid 24581] [client 20.63.83.162:48647] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/"] [unique_id "aaNe24vfb5CnctJh070FHAAAAQI"]
[Sun Mar 01 05:32:12.828874 2026] [:error] [pid 24576:tid 24599] [client 20.63.83.162:48691] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "aaNe3Ivfb5CnctJh070FJgAAARM"]
[Sun Mar 01 05:32:13.856659 2026] [:error] [pid 24576:tid 24604] [client 20.63.83.162:48667] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "aaNe3Yvfb5CnctJh070FMAAAARg"]
[Sun Mar 01 05:32:14.932046 2026] [:error] [pid 24576:tid 24603] [client 20.63.83.162:48656] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "aaNe3ovfb5CnctJh070FPAAAARc"]
[Sun Mar 01 05:32:15.994473 2026] [:error] [pid 8688:tid 8714] [client 20.63.83.162:48646] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/themes.php"] [unique_id "aaNe3zHJ4Nn-RvulD0qRbQAAAVg"]
[Sun Mar 01 05:32:17.017090 2026] [:error] [pid 8688:tid 8707] [client 20.63.83.162:49034] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2023/08/"] [unique_id "aaNe4THJ4Nn-RvulD0qRdwAAAVE"]
[Sun Mar 01 05:32:18.086292 2026] [:error] [pid 24576:tid 24581] [client 20.63.83.162:48657] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/index.php"] [unique_id "aaNe4ovfb5CnctJh070FUwAAAQI"]
[Sun Mar 01 05:32:19.103048 2026] [:error] [pid 21158:tid 21215] [client 20.63.83.162:48641] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aaNe4zriSIe3-pWnbPbjVgAAAFY"]
[Sun Mar 01 05:32:20.147031 2026] [:error] [pid 8688:tid 8690] [client 20.63.83.162:48399] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "aaNe5DHJ4Nn-RvulD0qRjgAAAUA"]
[Sun Mar 01 05:32:21.114554 2026] [:error] [pid 21263:tid 21279] [client 20.63.83.162:48650] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaNe5dAxjzLvN1upBhnn9QAAAMw"]
[Sun Mar 01 05:32:22.239043 2026] [:error] [pid 21159:tid 21232] [client 20.63.83.162:49055] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "aaNe5uLi3ouy1NZIkgomdAAAAIs"]
[Sun Mar 01 05:32:23.137322 2026] [:error] [pid 24576:tid 24595] [client 20.63.83.162:48660] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaNe54vfb5CnctJh070FaAAAAQ8"]
[Sun Mar 01 05:32:24.106337 2026] [:error] [pid 24576:tid 24593] [client 20.63.83.162:48438] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aaNe6Ivfb5CnctJh070FbgAAAQ0"]
[Sun Mar 01 05:32:25.065735 2026] [:error] [pid 8688:tid 8694] [client 20.63.83.162:48693] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/"] [unique_id "aaNe6THJ4Nn-RvulD0qRpQAAAUQ"]
[Sun Mar 01 05:32:26.034994 2026] [:error] [pid 24576:tid 24582] [client 20.63.83.162:48694] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "aaNe6ovfb5CnctJh070FdwAAAQM"]
[Sun Mar 01 05:32:27.119206 2026] [:error] [pid 8688:tid 8699] [client 20.63.83.162:48418] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "aaNe6zHJ4Nn-RvulD0qRuAAAAUk"]
[Sun Mar 01 05:32:28.154371 2026] [:error] [pid 24576:tid 24597] [client 20.63.83.162:48662] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/about.php"] [unique_id "aaNe7Ivfb5CnctJh070FgwAAARE"]
[Sun Mar 01 05:32:29.243149 2026] [:error] [pid 8688:tid 8691] [client 20.63.83.162:48684] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "aaNe7THJ4Nn-RvulD0qRyAAAAUE"]
[Sun Mar 01 05:32:30.388664 2026] [:error] [pid 8688:tid 8692] [client 20.63.83.162:48688] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 11"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "aaNe7jHJ4Nn-RvulD0qR0AAAAUI"]
[Sun Mar 01 05:32:31.435451 2026] [:error] [pid 8688:tid 8693] [client 20.63.83.162:48668] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/"] [unique_id "aaNe7zHJ4Nn-RvulD0qR2wAAAUM"]
[Sun Mar 01 05:32:32.510497 2026] [:error] [pid 21263:tid 21278] [client 20.63.83.162:48690] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaNe8NAxjzLvN1upBhnoEgAAAMs"]
[Sun Mar 01 05:32:33.524683 2026] [:error] [pid 24576:tid 24592] [client 20.63.83.162:49040] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "aaNe8Yvfb5CnctJh070FmwAAAQw"]
[Sun Mar 01 05:32:34.538518 2026] [:error] [pid 8688:tid 8707] [client 20.63.83.162:48651] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.63.83.162 on wp-login.php, counter = 12"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "aaNe8jHJ4Nn-RvulD0qR-AAAAVE"]
[Sun Mar 01 05:32:35.585570 2026] [:error] [pid 8688:tid 8691] [client 20.63.83.162:48389] [client 20.63.83.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaNe8zHJ4Nn-RvulD0qSBAAAAUE"]
[Sun Mar 01 08:51:40.980631 2026] [:error] [pid 21159:tid 21230] [client 204.76.203.25:57380] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aaONnOLi3ouy1NZIkgo7uQAAAIk"]
[Sun Mar 01 12:57:42.084122 2026] [:error] [pid 34286:tid 34304] [client 217.165.0.169:56805] [client 217.165.0.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.165.0.169, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaPHRnPFxpCIhHW6XmnDuAAAApA"]
[Sun Mar 01 12:57:42.090695 2026] [:error] [pid 34286:tid 34304] [client 217.165.0.169:56805] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 01 14:29:32.382274 2026] [:error] [pid 38034:tid 38051] [client 62.60.131.218:53518] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aaPczAxtfZjwlJok9K9_3gAAAQ0"]
[Sun Mar 01 14:56:46.922499 2026] [:error] [pid 42619:tid 42643] [client 20.78.169.245:7889] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 01 14:56:47.046785 2026] [:error] [pid 42619:tid 42635] [client 20.78.169.245:7889] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 14:56:47.324476 2026] [:error] [pid 42619:tid 42629] [client 20.78.169.245:7889] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sun Mar 01 14:56:47.450551 2026] [:error] [pid 42619:tid 42627] [client 20.78.169.245:7889] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 14:56:47.700466 2026] [:error] [pid 42619:tid 42639] [client 20.78.169.245:7889] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sun Mar 01 14:56:47.824214 2026] [:error] [pid 42619:tid 42633] [client 20.78.169.245:7889] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 01 14:56:47.967238 2026] [:error] [pid 42619:tid 42635] [client 20.78.169.245:7889] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sun Mar 01 14:56:48.220306 2026] [:error] [pid 42619:tid 42633] [client 20.78.169.245:7889] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaPjMB_zUXcYaZE4AOeBtwAAAUw"]
[Sun Mar 01 14:56:48.763453 2026] [:error] [pid 42619:tid 42635] [client 20.78.169.245:5801] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaPjMB_zUXcYaZE4AOeBuAAAAU4"]
[Sun Mar 01 14:56:49.280188 2026] [:error] [pid 37032:tid 37045] [client 20.78.169.245:7917] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaPjMeu0U4o7eSImsVQqcAAAAYs"]
[Sun Mar 01 14:56:49.771248 2026] [:error] [pid 38241:tid 38260] [client 20.78.169.245:6470] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaPjMfKRPk6YnJBxw_wqCAAAANA"]
[Sun Mar 01 16:09:14.845971 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Mar 01 16:09:15.133660 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 01 16:09:15.433159 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Mar 01 16:09:15.759819 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Mar 01 16:09:16.148560 2026] [:error] [pid 38034:tid 38056] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Mar 01 16:09:16.421701 2026] [:error] [pid 38034:tid 38062] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Mar 01 16:09:16.704518 2026] [:error] [pid 38034:tid 38053] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 16:09:18.250190 2026] [:error] [pid 38034:tid 38053] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 16:09:18.908895 2026] [:error] [pid 38034:tid 38053] [client 45.86.202.193:53803] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Mar 01 16:09:20.104324 2026] [:error] [pid 37032:tid 37049] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Mar 01 16:09:20.407744 2026] [:error] [pid 37032:tid 37050] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Mar 01 16:09:20.868031 2026] [:error] [pid 37032:tid 37050] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 01 16:09:21.190648 2026] [:error] [pid 37032:tid 37039] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Mar 01 16:09:21.615657 2026] [:error] [pid 37032:tid 37049] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 01 16:09:21.963545 2026] [:error] [pid 37032:tid 37045] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Mar 01 16:09:22.360947 2026] [:error] [pid 37032:tid 37039] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Mar 01 16:09:22.668988 2026] [:error] [pid 37032:tid 37045] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Mar 01 16:09:22.964404 2026] [:error] [pid 37032:tid 37039] [client 45.86.202.224:24015] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Mar 01 16:09:27.401081 2026] [:error] [pid 37032:tid 37041] [client 45.86.202.224:24015] [client 45.86.202.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaP0N-u0U4o7eSImsVRTJQAAAYc"]
[Sun Mar 01 16:09:29.466881 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.192:60807] [client 45.86.202.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaP0ORRjCrA8qWBjgG84pwAAAkA"]
[Sun Mar 01 16:09:31.724222 2026] [:error] [pid 42619:tid 42641] [client 45.86.202.167:47537] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Mar 01 16:09:32.639491 2026] [:error] [pid 42619:tid 42627] [client 45.86.202.167:47537] [client 45.86.202.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaP0PB_zUXcYaZE4AOeYPAAAAUY"]
[Sun Mar 01 16:09:34.017809 2026] [:error] [pid 38241:tid 38264] [client 45.86.202.195:64233] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 16:09:34.667785 2026] [:error] [pid 38034:tid 38039] [client 45.86.202.188:25765] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaP0PgxtfZjwlJok9K_U_gAAAQM"]
[Sun Mar 01 16:09:35.658376 2026] [:error] [pid 44644:tid 44657] [client 45.86.202.198:42837] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Mar 01 16:09:37.221447 2026] [:error] [pid 44644:tid 44668] [client 45.86.202.198:42837] [client 45.86.202.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaP0QZ3RJaXMcw3y9V-64gAAABU"]
[Sun Mar 01 16:09:38.972478 2026] [:error] [pid 41967:tid 41981] [client 45.86.202.195:46159] [client 45.86.202.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaP0QoO1bqY181I02eGTKAAAAIw"]
[Sun Mar 01 16:09:39.608528 2026] [:error] [pid 38034:tid 38057] [client 45.86.202.200:57577] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaP0QwxtfZjwlJok9K_VHAAAARM"]
[Sun Mar 01 16:09:40.224794 2026] [:error] [pid 41342:tid 41367] [client 45.86.202.163:51025] [client 45.86.202.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaP0RI4iJ6RAS5CatDlL8QAAAhY"]
[Sun Mar 01 16:09:40.875318 2026] [:error] [pid 38034:tid 38057] [client 45.86.202.178:55745] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaP0RAxtfZjwlJok9K_VKQAAARM"]
[Sun Mar 01 16:09:41.480856 2026] [:error] [pid 37032:tid 37049] [client 45.86.202.186:49235] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaP0Reu0U4o7eSImsVRTOQAAAY8"]
[Sun Mar 01 16:09:42.312173 2026] [:error] [pid 44644:tid 44671] [client 45.86.202.186:47305] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaP0Rp3RJaXMcw3y9V-66wAAABg"]
[Sun Mar 01 16:09:42.912058 2026] [:error] [pid 44644:tid 44652] [client 45.86.202.189:22053] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Mar 01 16:09:43.533129 2026] [:error] [pid 44644:tid 44655] [client 45.86.202.189:22053] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "aaP0R53RJaXMcw3y9V-6-gAAAAg"]
[Sun Mar 01 16:09:45.058706 2026] [:error] [pid 37032:tid 37034] [client 45.86.202.182:60533] [client 45.86.202.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaP0Seu0U4o7eSImsVRTQAAAAYA"]
[Sun Mar 01 16:09:45.942398 2026] [:error] [pid 42619:tid 42623] [client 45.86.202.192:58621] [client 45.86.202.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaP0SR_zUXcYaZE4AOeYRAAAAUI"]
[Sun Mar 01 16:09:47.607932 2026] [:error] [pid 38241:tid 38262] [client 45.86.202.180:62775] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Mar 01 16:09:47.938717 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.180:62775] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaP0S_KRPk6YnJBxw_xm0wAAAMQ"]
[Sun Mar 01 16:09:48.645995 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.181:24861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Mar 01 16:09:49.534932 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.181:24861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Mar 01 16:09:50.400018 2026] [:error] [pid 38034:tid 38054] [client 45.86.202.181:24861] [client 45.86.202.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaP0TgxtfZjwlJok9K_VbAAAARA"]
[Sun Mar 01 16:09:51.034709 2026] [:error] [pid 38241:tid 38262] [client 45.86.202.189:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Mar 01 16:09:51.329992 2026] [:error] [pid 38241:tid 38262] [client 45.86.202.189:51713] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaP0T_KRPk6YnJBxw_xm7gAAANI"]
[Sun Mar 01 16:09:51.923368 2026] [:error] [pid 37032:tid 37052] [client 45.86.202.166:33963] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Mar 01 16:09:52.508705 2026] [:error] [pid 37032:tid 37037] [client 45.86.202.166:33963] [client 45.86.202.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaP0UOu0U4o7eSImsVRTWwAAAYM"]
[Sun Mar 01 16:09:53.385913 2026] [:error] [pid 38241:tid 38249] [client 45.86.202.164:44941] [client 45.86.202.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaP0UfKRPk6YnJBxw_xm8wAAAMU"]
[Sun Mar 01 16:09:54.296552 2026] [:error] [pid 38034:tid 38053] [client 45.86.202.165:39795] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Mar 01 16:09:54.698442 2026] [:error] [pid 38034:tid 38040] [client 45.86.202.165:39795] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Mar 01 16:09:55.397231 2026] [:error] [pid 38034:tid 38058] [client 45.86.202.165:39795] [client 45.86.202.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaP0UwxtfZjwlJok9K_VfgAAARQ"]
[Sun Mar 01 16:09:56.267758 2026] [:error] [pid 38241:tid 38265] [client 45.86.202.158:42573] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaP0VPKRPk6YnJBxw_xnAQAAANU"]
[Sun Mar 01 16:09:57.236052 2026] [:error] [pid 42619:tid 42636] [client 45.86.202.172:28635] [client 45.86.202.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaP0VR_zUXcYaZE4AOeYSAAAAU8"]
[Sun Mar 01 16:09:57.857628 2026] [:error] [pid 38034:tid 38036] [client 45.86.202.188:57153] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaP0VQxtfZjwlJok9K_VhAAAAQA"]
[Sun Mar 01 16:09:58.543536 2026] [:error] [pid 37032:tid 37039] [client 45.86.202.166:45729] [client 45.86.202.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaP0Vuu0U4o7eSImsVRTZAAAAYU"]
[Sun Mar 01 16:10:00.027692 2026] [:error] [pid 38034:tid 38050] [client 45.86.202.192:52755] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 01 16:10:00.344819 2026] [:error] [pid 38034:tid 38039] [client 45.86.202.192:52755] [client 45.86.202.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaP0WAxtfZjwlJok9K_ViwAAAQM"]
[Sun Mar 01 16:10:00.902676 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.160:46967] [client 45.86.202.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaP0WAxtfZjwlJok9K_VjQAAAQc"]
[Sun Mar 01 16:10:01.520866 2026] [:error] [pid 38241:tid 38261] [client 45.86.202.173:20843] [client 45.86.202.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaP0WfKRPk6YnJBxw_xnDQAAANE"]
[Sun Mar 01 16:10:03.582991 2026] [:error] [pid 44644:tid 44647] [client 45.86.202.203:54397] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Mar 01 16:10:04.417016 2026] [:error] [pid 44644:tid 44663] [client 45.86.202.203:54397] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Mar 01 16:10:05.648611 2026] [:error] [pid 44644:tid 44647] [client 45.86.202.203:54397] [client 45.86.202.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aaP0XZ3RJaXMcw3y9V-7QwAAAAA"]
[Sun Mar 01 16:10:07.208015 2026] [:error] [pid 38034:tid 38056] [client 45.86.202.158:45837] [client 45.86.202.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.158, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaP0XwxtfZjwlJok9K_VogAAARI"]
[Sun Mar 01 16:10:07.565900 2026] [:error] [pid 38034:tid 38043] [client 45.86.202.158:45837] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Mar 01 16:10:09.027152 2026] [:error] [pid 38034:tid 38046] [client 45.86.202.158:45837] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Mar 01 16:10:10.495166 2026] [:error] [pid 38034:tid 38046] [client 45.86.202.158:45837] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Mar 01 16:10:11.996849 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.158:45837] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaP0YwxtfZjwlJok9K_VxgAAAQc"]
[Sun Mar 01 16:10:13.344202 2026] [:error] [pid 38241:tid 38246] [client 45.86.202.164:24749] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Mar 01 16:10:13.643524 2026] [:error] [pid 38241:tid 38250] [client 45.86.202.164:24749] [client 45.86.202.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.164, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaP0ZfKRPk6YnJBxw_xnUAAAAMY"]
[Sun Mar 01 16:10:14.268641 2026] [:error] [pid 38241:tid 38250] [client 45.86.202.164:24749] [client 45.86.202.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "aaP0ZvKRPk6YnJBxw_xnVwAAAMY"]
[Sun Mar 01 16:10:16.139957 2026] [:error] [pid 38034:tid 38048] [client 45.86.202.196:38483] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 01 16:10:16.798799 2026] [:error] [pid 38034:tid 38050] [client 45.86.202.196:38483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Mar 01 16:10:17.559506 2026] [:error] [pid 38034:tid 38043] [client 45.86.202.196:38483] [client 45.86.202.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaP0aQxtfZjwlJok9K_V5wAAAQU"]
[Sun Mar 01 16:10:19.227952 2026] [:error] [pid 7165:tid 7186] [client 45.86.202.185:54873] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Mar 01 16:10:20.160838 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.185:54873] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Mar 01 16:10:20.770509 2026] [:error] [pid 7165:tid 7171] [client 45.86.202.185:54873] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Mar 01 16:10:21.437543 2026] [:error] [pid 7165:tid 7175] [client 45.86.202.185:54873] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Mar 01 16:10:21.712764 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.185:54873] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaP0bRRjCrA8qWBjgG84zAAAAkA"]
[Sun Mar 01 16:10:22.263261 2026] [:error] [pid 38241:tid 38246] [client 45.86.202.170:20409] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Mar 01 16:10:22.603455 2026] [:error] [pid 38241:tid 38246] [client 45.86.202.170:20409] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Mar 01 16:10:22.873875 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.170:20409] [client 45.86.202.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaP0bvKRPk6YnJBxw_xngQAAAMQ"]
[Sun Mar 01 16:10:23.748775 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.162:40297] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Mar 01 16:10:24.991791 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.178:34497] [client 45.86.202.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.178, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaP0cPKRPk6YnJBxw_xnlAAAAMQ"]
[Sun Mar 01 16:10:25.288324 2026] [:error] [pid 38241:tid 38264] [client 45.86.202.178:34497] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaP0cfKRPk6YnJBxw_xnlQAAANQ"]
[Sun Mar 01 16:10:29.783221 2026] [:error] [pid 7165:tid 7186] [client 45.86.202.197:36855] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Mar 01 16:10:31.657489 2026] [:error] [pid 7165:tid 7171] [client 45.86.202.197:36855] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Mar 01 16:10:32.054982 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.197:36855] [client 45.86.202.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaP0eBRjCrA8qWBjgG85FAAAAk8"]
[Sun Mar 01 16:10:32.650795 2026] [:error] [pid 33822:tid 33829] [client 45.86.202.186:28933] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Mar 01 16:10:33.589838 2026] [:error] [pid 33822:tid 33837] [client 45.86.202.186:28933] [client 45.86.202.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.186, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaP0eW6W3ygu1YVssubKtwAAAo0"]
[Sun Mar 01 16:10:33.900334 2026] [:error] [pid 33822:tid 33841] [client 45.86.202.186:28933] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Mar 01 16:10:34.193492 2026] [:error] [pid 33822:tid 33843] [client 45.86.202.186:28933] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Mar 01 16:10:34.506667 2026] [:error] [pid 33822:tid 33847] [client 45.86.202.186:28933] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Mar 01 16:10:34.796278 2026] [:error] [pid 33822:tid 33824] [client 45.86.202.186:28933] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaP0em6W3ygu1YVssubKvwAAAoA"]
[Sun Mar 01 16:10:35.481486 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.158:54349] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Mar 01 16:10:35.755766 2026] [:error] [pid 7165:tid 7180] [client 45.86.202.158:54349] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aaP0exRjCrA8qWBjgG85KAAAAk0"]
[Sun Mar 01 16:10:36.881721 2026] [:error] [pid 42619:tid 42626] [client 45.86.202.156:36581] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Mar 01 16:10:37.160276 2026] [:error] [pid 42619:tid 42624] [client 45.86.202.156:36581] [client 45.86.202.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaP0fR_zUXcYaZE4AOeYZgAAAUM"]
[Sun Mar 01 16:10:38.307676 2026] [:error] [pid 38034:tid 38054] [client 45.86.202.194:51709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Mar 01 16:10:38.594799 2026] [:error] [pid 38034:tid 38050] [client 45.86.202.194:51709] [client 45.86.202.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaP0fgxtfZjwlJok9K_WMgAAAQw"]
[Sun Mar 01 16:10:39.176290 2026] [:error] [pid 38034:tid 38057] [client 45.86.202.158:41375] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaP0fwxtfZjwlJok9K_WMwAAARM"]
[Sun Mar 01 16:10:39.722287 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.185:65111] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Mar 01 16:10:40.067567 2026] [:error] [pid 40750:tid 40759] [client 45.86.202.185:65111] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Mar 01 16:10:41.296145 2026] [:error] [pid 40750:tid 40766] [client 45.86.202.185:65111] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaP0gQfBuk03yQKDyqvM5AAAAc0"]
[Sun Mar 01 16:10:42.115832 2026] [:error] [pid 7165:tid 7176] [client 45.86.202.173:41899] [client 45.86.202.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaP0ghRjCrA8qWBjgG85MgAAAkk"]
[Sun Mar 01 16:10:43.679134 2026] [:error] [pid 7133:tid 7155] [client 45.86.202.162:40761] [client 45.86.202.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aaP0g_Ctubh8pR64qB_LNgAAAFQ"]
[Sun Mar 01 16:10:44.265141 2026] [:error] [pid 41967:tid 41980] [client 45.86.202.181:56575] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Mar 01 16:10:44.933175 2026] [:error] [pid 41967:tid 41974] [client 45.86.202.181:56575] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Mar 01 16:10:45.215501 2026] [:error] [pid 41967:tid 41983] [client 45.86.202.181:56575] [client 45.86.202.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaP0hYO1bqY181I02eGTbAAAAI4"]
[Sun Mar 01 16:10:45.802229 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.176:21627] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Mar 01 16:10:46.428632 2026] [:error] [pid 40750:tid 40756] [client 45.86.202.176:21627] [client 45.86.202.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "aaP0hgfBuk03yQKDyqvNAgAAAcM"]
[Sun Mar 01 16:10:48.045879 2026] [:error] [pid 33822:tid 33833] [client 45.86.202.176:23941] [client 45.86.202.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaP0iG6W3ygu1YVssubK1QAAAok"]
[Sun Mar 01 16:10:49.379106 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.181:39845] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 01 16:10:50.482623 2026] [:error] [pid 40750:tid 40755] [client 45.86.202.181:39845] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Mar 01 16:10:51.072745 2026] [:error] [pid 40750:tid 40764] [client 45.86.202.181:39845] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Mar 01 16:10:51.367466 2026] [:error] [pid 40750:tid 40756] [client 45.86.202.181:39845] [client 45.86.202.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaP0iwfBuk03yQKDyqvNNAAAAcM"]
[Sun Mar 01 16:10:51.920937 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.174:29837] [client 45.86.202.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaP0ixRjCrA8qWBjgG85PgAAAlA"]
[Sun Mar 01 16:10:52.627015 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.183:56527] [client 45.86.202.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaP0jAfBuk03yQKDyqvNPgAAAdQ"]
[Sun Mar 01 16:10:53.218219 2026] [:error] [pid 41967:tid 41971] [client 45.86.202.177:38717] [client 45.86.202.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaP0jYO1bqY181I02eGTdgAAAII"]
[Sun Mar 01 16:10:53.818681 2026] [:error] [pid 41780:tid 41795] [client 45.86.202.202:40975] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Mar 01 16:10:54.139204 2026] [:error] [pid 41780:tid 41787] [client 45.86.202.202:40975] [client 45.86.202.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaP0jsONkVoocLIqzy0UAgAAA8Q"]
[Sun Mar 01 16:10:54.710955 2026] [:error] [pid 33822:tid 33845] [client 45.86.202.182:53193] [client 45.86.202.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaP0jm6W3ygu1YVssubK2gAAApU"]
[Sun Mar 01 16:10:55.280603 2026] [:error] [pid 40750:tid 40755] [client 45.86.202.180:61883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Mar 01 16:10:55.886963 2026] [:error] [pid 40750:tid 40756] [client 45.86.202.180:61883] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaP0jwfBuk03yQKDyqvNUgAAAcM"]
[Sun Mar 01 16:10:56.821149 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.203:52521] [client 45.86.202.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaP0kIO1bqY181I02eGTewAAAI0"]
[Sun Mar 01 16:10:57.508131 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.168:48389] [client 45.86.202.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaP0kQfBuk03yQKDyqvNWAAAAdQ"]
[Sun Mar 01 16:10:58.189230 2026] [:error] [pid 40750:tid 40756] [client 45.86.202.191:43837] [client 45.86.202.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaP0kgfBuk03yQKDyqvNWwAAAcM"]
[Sun Mar 01 16:10:59.146800 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.180:46745] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaP0k4O1bqY181I02eGTiAAAAI0"]
[Sun Mar 01 16:11:00.302176 2026] [:error] [pid 40750:tid 40774] [client 45.86.202.176:22079] [client 45.86.202.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaP0lAfBuk03yQKDyqvNbQAAAdU"]
[Sun Mar 01 16:11:00.897059 2026] [:error] [pid 7133:tid 7158] [client 45.86.202.160:45747] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Mar 01 16:11:01.852558 2026] [:error] [pid 7133:tid 7142] [client 45.86.202.160:45747] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Mar 01 16:11:02.175405 2026] [:error] [pid 7133:tid 7143] [client 45.86.202.160:45747] [client 45.86.202.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaP0lvCtubh8pR64qB_LUgAAAEg"]
[Sun Mar 01 16:11:03.304539 2026] [:error] [pid 7165:tid 7171] [client 45.86.202.188:60287] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Mar 01 16:11:03.587912 2026] [:error] [pid 7165:tid 7170] [client 45.86.202.188:60287] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Mar 01 16:11:06.142662 2026] [:error] [pid 7165:tid 7190] [client 45.86.202.188:60287] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaP0mhRjCrA8qWBjgG85XwAAAlc"]
[Sun Mar 01 16:11:07.865585 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.167:23591] [client 45.86.202.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaP0m_KRPk6YnJBxw_xnswAAANY"]
[Sun Mar 01 16:11:08.423080 2026] [:error] [pid 7133:tid 7136] [client 45.86.202.195:24179] [client 45.86.202.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaP0nPCtubh8pR64qB_LaAAAAEE"]
[Sun Mar 01 16:11:10.415599 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.181:50619] [client 45.86.202.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaP0ngfBuk03yQKDyqvNngAAAcQ"]
[Sun Mar 01 16:11:11.593285 2026] [:error] [pid 7165:tid 7175] [client 45.86.202.204:41629] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Mar 01 16:11:11.874386 2026] [:error] [pid 7165:tid 7186] [client 45.86.202.204:41629] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Mar 01 16:11:12.152203 2026] [:error] [pid 7165:tid 7179] [client 45.86.202.204:41629] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Mar 01 16:11:12.489955 2026] [:error] [pid 7165:tid 7181] [client 45.86.202.204:41629] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Mar 01 16:11:13.954789 2026] [:error] [pid 7165:tid 7176] [client 45.86.202.204:41629] [client 45.86.202.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaP0oRRjCrA8qWBjgG85dQAAAkk"]
[Sun Mar 01 16:11:14.525912 2026] [:error] [pid 41967:tid 41992] [client 45.86.202.201:37577] [client 45.86.202.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaP0ooO1bqY181I02eGTpAAAAJc"]
[Sun Mar 01 16:11:15.162865 2026] [:error] [pid 7165:tid 7172] [client 45.86.202.188:40045] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaP0oxRjCrA8qWBjgG85eQAAAkU"]
[Sun Mar 01 16:11:15.713756 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.182:47805] [client 45.86.202.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaP0owfBuk03yQKDyqvOCQAAAdg"]
[Sun Mar 01 16:11:16.439576 2026] [:error] [pid 7133:tid 7151] [client 45.86.202.205:33805] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaP0pPCtubh8pR64qB_LlgAAAFA"]
[Sun Mar 01 16:11:16.986024 2026] [:error] [pid 41967:tid 41983] [client 45.86.202.183:45579] [client 45.86.202.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaP0pIO1bqY181I02eGTtAAAAI4"]
[Sun Mar 01 16:11:17.845812 2026] [:error] [pid 7133:tid 7135] [client 45.86.202.186:23965] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaP0pfCtubh8pR64qB_LnwAAAEA"]
[Sun Mar 01 16:11:18.514943 2026] [:error] [pid 38034:tid 38057] [client 45.86.202.180:43601] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaP0pgxtfZjwlJok9K_WOgAAARM"]
[Sun Mar 01 16:11:19.136777 2026] [:error] [pid 38034:tid 38045] [client 45.86.202.224:46877] [client 45.86.202.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaP0pwxtfZjwlJok9K_WPgAAAQc"]
[Sun Mar 01 16:11:21.887664 2026] [:error] [pid 7165:tid 7180] [client 45.86.202.167:20777] [client 45.86.202.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaP0qRRjCrA8qWBjgG85nQAAAk0"]
[Sun Mar 01 16:11:23.303140 2026] [:error] [pid 38241:tid 38250] [client 45.86.202.175:28303] [client 45.86.202.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaP0q_KRPk6YnJBxw_xnxQAAAMY"]
[Sun Mar 01 16:11:24.345494 2026] [:error] [pid 41967:tid 41969] [client 45.86.202.194:43247] [client 45.86.202.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaP0rIO1bqY181I02eGT0AAAAIA"]
[Sun Mar 01 16:11:25.001612 2026] [:error] [pid 40750:tid 40766] [client 45.86.202.171:32639] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Mar 01 16:11:25.567433 2026] [:error] [pid 40750:tid 40775] [client 45.86.202.171:32639] [client 45.86.202.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaP0rQfBuk03yQKDyqvOLQAAAdY"]
[Sun Mar 01 16:11:26.732207 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.175:24703] [client 45.86.202.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaP0rvKRPk6YnJBxw_xnzgAAAMQ"]
[Sun Mar 01 16:11:27.981579 2026] [:error] [pid 7133:tid 7141] [client 45.86.202.192:31997] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Mar 01 16:11:28.311983 2026] [:error] [pid 7133:tid 7149] [client 45.86.202.192:31997] [client 45.86.202.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaP0sPCtubh8pR64qB_L3wAAAE4"]
[Sun Mar 01 16:11:29.146648 2026] [:error] [pid 40750:tid 40763] [client 45.86.202.203:23179] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Mar 01 16:11:29.441986 2026] [:error] [pid 40750:tid 40756] [client 45.86.202.203:23179] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Mar 01 16:11:29.755016 2026] [:error] [pid 40750:tid 40767] [client 45.86.202.203:23179] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Mar 01 16:11:30.041790 2026] [:error] [pid 40750:tid 40764] [client 45.86.202.203:23179] [client 45.86.202.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaP0sgfBuk03yQKDyqvORAAAAcs"]
[Sun Mar 01 16:11:30.700517 2026] [:error] [pid 33822:tid 33832] [client 45.86.202.159:39441] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Mar 01 16:11:30.969039 2026] [:error] [pid 33822:tid 33838] [client 45.86.202.159:39441] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaP0sm6W3ygu1YVssubK-gAAAo4"]
[Sun Mar 01 16:11:32.250058 2026] [:error] [pid 40750:tid 40770] [client 45.86.202.183:38721] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 16:11:32.551860 2026] [:error] [pid 40750:tid 40759] [client 45.86.202.183:38721] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Mar 01 16:11:32.996868 2026] [:error] [pid 40750:tid 40765] [client 45.86.202.183:38721] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Mar 01 16:11:34.713707 2026] [:error] [pid 40750:tid 40763] [client 45.86.202.183:38721] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Mar 01 16:11:35.122159 2026] [:error] [pid 40750:tid 40760] [client 45.86.202.183:38721] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Mar 01 16:11:36.061241 2026] [:error] [pid 40750:tid 40753] [client 45.86.202.183:38721] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Mar 01 16:11:37.591240 2026] [:error] [pid 40750:tid 40763] [client 45.86.202.183:38721] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Mar 01 16:11:37.889598 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.183:38721] [client 45.86.202.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaP0uQfBuk03yQKDyqvOfAAAAcQ"]
[Sun Mar 01 16:11:38.435834 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.177:49049] [client 45.86.202.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaP0uvKRPk6YnJBxw_xoFAAAAMQ"]
[Sun Mar 01 16:11:39.006668 2026] [:error] [pid 38034:tid 38047] [client 45.86.202.177:31913] [client 45.86.202.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.177, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaP0uwxtfZjwlJok9K_WTwAAAQk"]
[Sun Mar 01 16:11:39.010151 2026] [:error] [pid 38034:tid 38047] [client 45.86.202.177:31913] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 01 16:11:39.346374 2026] [:error] [pid 38034:tid 38054] [client 45.86.202.177:31913] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Mar 01 16:11:40.707018 2026] [:error] [pid 38034:tid 38054] [client 45.86.202.177:31913] [client 45.86.202.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaP0vAxtfZjwlJok9K_WVwAAARA"]
[Sun Mar 01 16:11:41.584648 2026] [:error] [pid 7165:tid 7190] [client 45.86.202.200:53191] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Mar 01 16:11:41.871358 2026] [:error] [pid 7165:tid 7180] [client 45.86.202.200:53191] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaP0vRRjCrA8qWBjgG86KQAAAk0"]
[Sun Mar 01 16:11:42.542775 2026] [:error] [pid 40750:tid 40764] [client 45.86.202.163:56181] [client 45.86.202.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaP0vgfBuk03yQKDyqvOgQAAAcs"]
[Sun Mar 01 16:11:44.330205 2026] [:error] [pid 40750:tid 40756] [client 45.86.202.162:60757] [client 45.86.202.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaP0wAfBuk03yQKDyqvOmgAAAcM"]
[Sun Mar 01 16:11:45.031737 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.158:64709] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "aaP0wQfBuk03yQKDyqvOoQAAAcQ"]
[Sun Mar 01 16:11:46.805936 2026] [:error] [pid 7165:tid 7189] [client 45.86.202.185:57377] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Mar 01 16:11:47.508502 2026] [:error] [pid 7165:tid 7179] [client 45.86.202.185:57377] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaP0wxRjCrA8qWBjgG86OQAAAkw"]
[Sun Mar 01 16:11:48.781762 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.162:48303] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Mar 01 16:11:49.465048 2026] [:error] [pid 40750:tid 40776] [client 45.86.202.162:48303] [client 45.86.202.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "aaP0xQfBuk03yQKDyqvO0wAAAdc"]
[Sun Mar 01 16:11:51.141141 2026] [:error] [pid 37032:tid 37045] [client 45.86.202.172:27827] [client 45.86.202.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaP0x-u0U4o7eSImsVRTuAAAAYs"]
[Sun Mar 01 16:11:51.945773 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.159:52767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Mar 01 16:11:52.255054 2026] [:error] [pid 38241:tid 38258] [client 45.86.202.159:52767] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaP0yPKRPk6YnJBxw_xoHQAAAM4"]
[Sun Mar 01 16:11:52.779713 2026] [:error] [pid 33822:tid 33837] [client 45.86.202.183:25969] [client 45.86.202.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaP0yG6W3ygu1YVssubLCwAAAo0"]
[Sun Mar 01 16:11:54.001120 2026] [:error] [pid 33822:tid 33831] [client 45.86.202.158:49711] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Mar 01 16:11:54.337156 2026] [:error] [pid 33822:tid 33830] [client 45.86.202.158:49711] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Mar 01 16:11:54.943540 2026] [:error] [pid 33822:tid 33842] [client 45.86.202.158:49711] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 01 16:11:55.506826 2026] [:error] [pid 33822:tid 33833] [client 45.86.202.158:49711] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaP0y26W3ygu1YVssubLGgAAAok"]
[Sun Mar 01 16:11:56.082475 2026] [:error] [pid 37032:tid 37040] [client 45.86.202.179:45167] [client 45.86.202.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaP0zOu0U4o7eSImsVRTwQAAAYY"]
[Sun Mar 01 16:11:57.659426 2026] [:error] [pid 40750:tid 40766] [client 45.86.202.156:40415] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Mar 01 16:11:57.966949 2026] [:error] [pid 40750:tid 40770] [client 45.86.202.156:40415] [client 45.86.202.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "aaP0zQfBuk03yQKDyqvPBgAAAdE"]
[Sun Mar 01 16:11:58.577280 2026] [:error] [pid 41967:tid 41976] [client 45.86.202.195:38917] [client 45.86.202.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaP0zoO1bqY181I02eGUQgAAAIc"]
[Sun Mar 01 16:11:59.727977 2026] [:error] [pid 7165:tid 7181] [client 45.86.202.202:38365] [client 45.86.202.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaP0zxRjCrA8qWBjgG86cwAAAk4"]
[Sun Mar 01 16:12:02.031652 2026] [:error] [pid 7165:tid 7170] [client 45.86.202.185:57547] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sun Mar 01 16:12:02.390894 2026] [:error] [pid 7165:tid 7188] [client 45.86.202.185:57547] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaP00hRjCrA8qWBjgG86gwAAAlU"]
[Sun Mar 01 16:12:03.503689 2026] [:error] [pid 38034:tid 38048] [client 45.86.202.167:39177] [client 45.86.202.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaP00wxtfZjwlJok9K_WYAAAAQo"]
[Sun Mar 01 16:12:04.187626 2026] [:error] [pid 40750:tid 40767] [client 45.86.202.189:41867] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Mar 01 16:12:04.487339 2026] [:error] [pid 40750:tid 40760] [client 45.86.202.189:41867] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Mar 01 16:12:05.131322 2026] [:error] [pid 40750:tid 40776] [client 45.86.202.189:41867] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Mar 01 16:12:06.412195 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.189:41867] [client 45.86.202.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.189, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "aaP01gfBuk03yQKDyqvPIAAAAcg"]
[Sun Mar 01 16:12:07.011824 2026] [:error] [pid 40750:tid 40772] [client 45.86.202.189:41867] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Mar 01 16:12:07.323321 2026] [:error] [pid 40750:tid 40776] [client 45.86.202.189:41867] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Mar 01 16:12:07.611901 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.189:41867] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Mar 01 16:12:08.229286 2026] [:error] [pid 40750:tid 40767] [client 45.86.202.189:41867] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaP02AfBuk03yQKDyqvPOgAAAc4"]
[Sun Mar 01 16:12:08.878091 2026] [:error] [pid 7165:tid 7171] [client 45.86.202.188:59109] [client 45.86.202.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.188, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaP02BRjCrA8qWBjgG86rAAAAkQ"]
[Sun Mar 01 16:12:09.876900 2026] [:error] [pid 7165:tid 7172] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Mar 01 16:12:10.214666 2026] [:error] [pid 7165:tid 7170] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Mar 01 16:12:10.826279 2026] [:error] [pid 7165:tid 7189] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sun Mar 01 16:12:11.611830 2026] [:error] [pid 7165:tid 7168] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 01 16:12:12.487767 2026] [:error] [pid 7165:tid 7188] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Mar 01 16:12:14.989453 2026] [:error] [pid 7165:tid 7180] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Mar 01 16:12:15.284745 2026] [:error] [pid 7165:tid 7189] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sun Mar 01 16:12:18.419368 2026] [:error] [pid 7165:tid 7180] [client 45.86.202.188:59109] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Mar 01 16:12:19.020731 2026] [:error] [pid 7165:tid 7168] [client 45.86.202.188:59109] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaP04xRjCrA8qWBjgG863gAAAkE"]
[Sun Mar 01 16:12:21.198073 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.194:56177] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Mar 01 16:12:21.514866 2026] [:error] [pid 38241:tid 38265] [client 45.86.202.194:56177] [client 45.86.202.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaP05fKRPk6YnJBxw_xoSwAAANU"]
[Sun Mar 01 16:12:23.567129 2026] [:error] [pid 40750:tid 40774] [client 45.86.202.179:39603] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Mar 01 16:12:23.956434 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.179:39603] [client 45.86.202.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaP05wfBuk03yQKDyqvPhgAAAdI"]
[Sun Mar 01 16:12:25.168645 2026] [:error] [pid 40750:tid 40770] [client 45.86.202.197:26745] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sun Mar 01 16:12:25.737802 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.197:26745] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Mar 01 16:12:26.327847 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.197:26745] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Mar 01 16:12:26.608635 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.197:26745] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sun Mar 01 16:12:27.223031 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.197:26745] [client 45.86.202.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaP06wfBuk03yQKDyqvPogAAAcg"]
[Sun Mar 01 16:12:27.807638 2026] [:error] [pid 40750:tid 40767] [client 45.86.202.160:28621] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sun Mar 01 16:12:28.156803 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.160:28621] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Mar 01 16:12:28.436785 2026] [:error] [pid 40750:tid 40776] [client 45.86.202.160:28621] [client 45.86.202.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaP07AfBuk03yQKDyqvPrgAAAdc"]
[Sun Mar 01 16:12:29.425478 2026] [:error] [pid 7133:tid 7143] [client 45.86.202.196:34035] [client 45.86.202.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaP07fCtubh8pR64qB_MQAAAAEg"]
[Sun Mar 01 16:12:30.293932 2026] [:error] [pid 41967:tid 41986] [client 45.86.202.179:28991] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Mar 01 16:12:31.523245 2026] [:error] [pid 41967:tid 41987] [client 45.86.202.179:28991] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Mar 01 16:12:31.807048 2026] [:error] [pid 41967:tid 41986] [client 45.86.202.179:28991] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Mar 01 16:12:32.067732 2026] [:error] [pid 41967:tid 41975] [client 45.86.202.179:28991] [client 45.86.202.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaP08IO1bqY181I02eGU5QAAAIY"]
[Sun Mar 01 16:12:32.648139 2026] [:error] [pid 7165:tid 7190] [client 45.86.202.188:59527] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaP08BRjCrA8qWBjgG869QAAAlc"]
[Sun Mar 01 16:12:35.029885 2026] [:error] [pid 7165:tid 7189] [client 45.86.202.164:21065] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sun Mar 01 16:12:35.610020 2026] [:error] [pid 7165:tid 7170] [client 45.86.202.164:21065] [client 45.86.202.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaP08xRjCrA8qWBjgG87EQAAAkM"]
[Sun Mar 01 16:12:36.505600 2026] [:error] [pid 41967:tid 41975] [client 45.86.202.174:22083] [client 45.86.202.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaP09IO1bqY181I02eGU6wAAAIY"]
[Sun Mar 01 16:12:37.623768 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.188:54085] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 01 16:12:37.914002 2026] [:error] [pid 40750:tid 40753] [client 45.86.202.188:54085] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Mar 01 16:12:38.186585 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.188:54085] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaP09gfBuk03yQKDyqvP7gAAAdI"]
[Sun Mar 01 16:12:39.114380 2026] [:error] [pid 40750:tid 40766] [client 45.86.202.156:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Mar 01 16:12:40.683340 2026] [:error] [pid 40750:tid 40766] [client 45.86.202.156:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sun Mar 01 16:12:41.334347 2026] [:error] [pid 40750:tid 40765] [client 45.86.202.156:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Mar 01 16:12:42.395145 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.156:34345] [client 45.86.202.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaP0-gfBuk03yQKDyqvQOQAAAdg"]
[Sun Mar 01 16:12:42.989233 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.171:44393] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Mar 01 16:12:44.717123 2026] [:error] [pid 41967:tid 41975] [client 45.86.202.171:44393] [client 45.86.202.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaP0_IO1bqY181I02eGVFgAAAIY"]
[Sun Mar 01 16:12:45.687518 2026] [:error] [pid 41967:tid 41987] [client 45.86.202.170:45323] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sun Mar 01 16:12:46.583221 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.170:45323] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sun Mar 01 16:12:46.903952 2026] [:error] [pid 41967:tid 41983] [client 45.86.202.170:45323] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Mar 01 16:12:47.513844 2026] [:error] [pid 41967:tid 41975] [client 45.86.202.170:45323] [client 45.86.202.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.170, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaP0_4O1bqY181I02eGVKQAAAIY"]
[Sun Mar 01 16:12:49.062790 2026] [:error] [pid 41967:tid 41971] [client 45.86.202.170:45323] [client 45.86.202.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaP1AYO1bqY181I02eGVNgAAAII"]
[Sun Mar 01 16:12:49.596801 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.164:42451] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sun Mar 01 16:12:49.876358 2026] [:error] [pid 40750:tid 40770] [client 45.86.202.164:42451] [client 45.86.202.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaP1AQfBuk03yQKDyqvQewAAAdE"]
[Sun Mar 01 16:12:50.436769 2026] [:error] [pid 42619:tid 42639] [client 45.86.202.193:33863] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Mar 01 16:12:51.036292 2026] [:error] [pid 42619:tid 42623] [client 45.86.202.193:33863] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Mar 01 16:12:51.623580 2026] [:error] [pid 42619:tid 42641] [client 45.86.202.193:33863] [client 45.86.202.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaP1Ax_zUXcYaZE4AOeYfgAAAVQ"]
[Sun Mar 01 16:12:52.896271 2026] [:error] [pid 33822:tid 33826] [client 45.86.202.189:37621] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Mar 01 16:12:53.188490 2026] [:error] [pid 33822:tid 33830] [client 45.86.202.189:37621] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Mar 01 16:12:53.786351 2026] [:error] [pid 33822:tid 33848] [client 45.86.202.189:37621] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaP1BW6W3ygu1YVssubLOQAAApg"]
[Sun Mar 01 16:12:54.880158 2026] [:error] [pid 41967:tid 41971] [client 45.86.202.200:63319] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaP1BoO1bqY181I02eGVRgAAAII"]
[Sun Mar 01 16:12:55.603454 2026] [:error] [pid 38241:tid 38257] [client 45.86.202.205:48033] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sun Mar 01 16:12:55.881147 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.205:48033] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Mar 01 16:12:56.503323 2026] [:error] [pid 38241:tid 38248] [client 45.86.202.205:48033] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaP1CPKRPk6YnJBxw_xojgAAAMQ"]
[Sun Mar 01 16:12:57.108210 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.193:33243] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sun Mar 01 16:12:57.681017 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.193:33243] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sun Mar 01 16:12:57.991076 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.193:33243] [client 45.86.202.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaP1CQfBuk03yQKDyqvQrwAAAdg"]
[Sun Mar 01 16:12:58.835558 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.198:32695] [client 45.86.202.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "aaP1ChRjCrA8qWBjgG87TAAAAlA"]
[Sun Mar 01 16:12:59.391733 2026] [:error] [pid 7133:tid 7139] [client 45.86.202.166:29891] [client 45.86.202.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaP1C_Ctubh8pR64qB_McgAAAEQ"]
[Sun Mar 01 16:13:01.062657 2026] [:error] [pid 38241:tid 38267] [client 45.86.202.181:21267] [client 45.86.202.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaP1DfKRPk6YnJBxw_xokwAAANc"]
[Sun Mar 01 16:13:01.658925 2026] [:error] [pid 7165:tid 7168] [client 45.86.202.188:32279] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaP1DRRjCrA8qWBjgG87TgAAAkE"]
[Sun Mar 01 16:13:02.327039 2026] [:error] [pid 38241:tid 38267] [client 45.86.202.205:42577] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaP1DvKRPk6YnJBxw_xomQAAANc"]
[Sun Mar 01 16:13:03.064290 2026] [:error] [pid 41967:tid 41979] [client 45.86.202.205:26365] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaP1D4O1bqY181I02eGVVwAAAIo"]
[Sun Mar 01 16:13:04.594019 2026] [:error] [pid 7165:tid 7189] [client 45.86.202.165:46481] [client 45.86.202.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaP1EBRjCrA8qWBjgG87ZAAAAlY"]
[Sun Mar 01 16:13:05.426294 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.178:49919] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaP1ERRjCrA8qWBjgG87aAAAAlA"]
[Sun Mar 01 16:13:06.032654 2026] [:error] [pid 38241:tid 38257] [client 45.86.202.190:52073] [client 45.86.202.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaP1EvKRPk6YnJBxw_xoqgAAAM0"]
[Sun Mar 01 16:13:06.915230 2026] [:error] [pid 40750:tid 40765] [client 45.86.202.156:47049] [client 45.86.202.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaP1EgfBuk03yQKDyqvQ4wAAAcw"]
[Sun Mar 01 16:13:08.089781 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.178:33235] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaP1FBRjCrA8qWBjgG87ggAAAlQ"]
[Sun Mar 01 16:13:08.964522 2026] [:error] [pid 40750:tid 40755] [client 45.86.202.170:51469] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Mar 01 16:13:10.164075 2026] [:error] [pid 40750:tid 40755] [client 45.86.202.170:51469] [client 45.86.202.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.170, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaP1FgfBuk03yQKDyqvREgAAAcI"]
[Sun Mar 01 16:13:11.939275 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.170:51469] [client 45.86.202.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaP1FwfBuk03yQKDyqvRJAAAAdI"]
[Sun Mar 01 16:13:12.609181 2026] [:error] [pid 41967:tid 41972] [client 45.86.202.160:51499] [client 45.86.202.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaP1GIO1bqY181I02eGVZAAAAIM"]
[Sun Mar 01 16:13:14.109370 2026] [:error] [pid 38241:tid 38259] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Mar 01 16:13:14.460120 2026] [:error] [pid 38241:tid 38250] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sun Mar 01 16:13:15.949076 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Mar 01 16:13:16.242238 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sun Mar 01 16:13:17.443127 2026] [:error] [pid 38241:tid 38250] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sun Mar 01 16:13:17.770256 2026] [:error] [pid 38241:tid 38250] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Mar 01 16:13:18.072290 2026] [:error] [pid 38241:tid 38257] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sun Mar 01 16:13:18.375497 2026] [:error] [pid 38241:tid 38257] [client 45.86.202.163:40167] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sun Mar 01 16:13:18.667757 2026] [:error] [pid 38241:tid 38259] [client 45.86.202.163:40167] [client 45.86.202.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaP1HvKRPk6YnJBxw_xo9wAAAM8"]
[Sun Mar 01 16:13:19.411645 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.182:39703] [client 45.86.202.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaP1HwfBuk03yQKDyqvROgAAAcQ"]
[Sun Mar 01 16:13:20.069662 2026] [:error] [pid 40750:tid 40755] [client 45.86.202.201:50689] [client 45.86.202.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaP1IAfBuk03yQKDyqvRQgAAAcI"]
[Sun Mar 01 16:13:21.473496 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.202:58205] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sun Mar 01 16:13:21.737478 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.202:58205] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Mar 01 16:13:22.640463 2026] [:error] [pid 40750:tid 40767] [client 45.86.202.202:58205] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Mar 01 16:13:23.299606 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.202:58205] [client 45.86.202.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaP1IwfBuk03yQKDyqvRXQAAAdg"]
[Sun Mar 01 16:13:23.890113 2026] [:error] [pid 38241:tid 38259] [client 45.86.202.205:40091] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaP1I_KRPk6YnJBxw_xpCwAAAM8"]
[Sun Mar 01 16:13:24.538000 2026] [:error] [pid 38241:tid 38258] [client 45.86.202.183:31079] [client 45.86.202.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaP1JPKRPk6YnJBxw_xpEgAAAM4"]
[Sun Mar 01 16:13:26.909560 2026] [:error] [pid 41967:tid 41979] [client 45.86.202.202:50065] [client 45.86.202.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaP1JoO1bqY181I02eGVfwAAAIo"]
[Sun Mar 01 16:13:27.781910 2026] [:error] [pid 41967:tid 41986] [client 45.86.202.205:55633] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaP1J4O1bqY181I02eGVigAAAJE"]
[Sun Mar 01 16:13:29.985720 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.224:43663] [client 45.86.202.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaP1KQfBuk03yQKDyqvRtwAAAdQ"]
[Sun Mar 01 16:13:34.003401 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.188:35973] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaP1LhRjCrA8qWBjgG878wAAAk8"]
[Sun Mar 01 16:13:34.691896 2026] [:error] [pid 7165:tid 7190] [client 45.86.202.174:37949] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sun Mar 01 16:13:35.293245 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.174:37949] [client 45.86.202.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "aaP1LxRjCrA8qWBjgG88BAAAAlA"]
[Sun Mar 01 16:13:36.444685 2026] [:error] [pid 38241:tid 38246] [client 45.86.202.205:32691] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Mar 01 16:13:37.580536 2026] [:error] [pid 38241:tid 38246] [client 45.86.202.205:32691] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Mar 01 16:13:37.990743 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.205:32691] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaP1MfKRPk6YnJBxw_xpSwAAANY"]
[Sun Mar 01 16:13:39.151119 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.186:38701] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaP1MwfBuk03yQKDyqvR1QAAAdI"]
[Sun Mar 01 16:13:40.951563 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.198:26867] [client 45.86.202.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaP1NAfBuk03yQKDyqvR5AAAAcQ"]
[Sun Mar 01 16:13:43.168051 2026] [:error] [pid 38241:tid 38259] [client 45.86.202.200:28529] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaP1N_KRPk6YnJBxw_xpXgAAAM8"]
[Sun Mar 01 16:13:44.603101 2026] [:error] [pid 38241:tid 38246] [client 45.86.202.182:35609] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Mar 01 16:13:44.894931 2026] [:error] [pid 38241:tid 38258] [client 45.86.202.182:35609] [client 45.86.202.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaP1OPKRPk6YnJBxw_xpZwAAAM4"]
[Sun Mar 01 16:13:45.550122 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.197:21595] [client 45.86.202.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaP1OQfBuk03yQKDyqvR_AAAAcQ"]
[Sun Mar 01 16:13:47.810504 2026] [:error] [pid 7165:tid 7191] [client 45.86.202.199:21845] [client 45.86.202.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaP1OxRjCrA8qWBjgG88XwAAAlg"]
[Sun Mar 01 16:13:48.489253 2026] [:error] [pid 38241:tid 38252] [client 45.86.202.204:29017] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Mar 01 16:13:49.843938 2026] [:error] [pid 38241:tid 38265] [client 45.86.202.204:29017] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Mar 01 16:13:50.115013 2026] [:error] [pid 38241:tid 38265] [client 45.86.202.204:29017] [client 45.86.202.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaP1PvKRPk6YnJBxw_xpfQAAANU"]
[Sun Mar 01 16:13:51.355223 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.158:27819] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Mar 01 16:13:51.928329 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.158:27819] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaP1P_KRPk6YnJBxw_xpjwAAANY"]
[Sun Mar 01 16:13:53.595773 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.180:39239] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaP1QRRjCrA8qWBjgG88bwAAAk8"]
[Sun Mar 01 16:13:54.782407 2026] [:error] [pid 37032:tid 37055] [client 45.86.202.172:63553] [client 45.86.202.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaP1Quu0U4o7eSImsVRT_wAAAZU"]
[Sun Mar 01 16:13:56.309254 2026] [:error] [pid 38241:tid 38259] [client 45.86.202.196:61699] [client 45.86.202.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaP1RPKRPk6YnJBxw_xppQAAAM8"]
[Sun Mar 01 16:13:56.884010 2026] [:error] [pid 41967:tid 41984] [client 45.86.202.198:45059] [client 45.86.202.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaP1RIO1bqY181I02eGVxwAAAI8"]
[Sun Mar 01 16:13:57.916216 2026] [:error] [pid 38241:tid 38258] [client 45.86.202.201:52399] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sun Mar 01 16:13:59.564157 2026] [:error] [pid 38241:tid 38258] [client 45.86.202.201:52399] [client 45.86.202.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaP1R_KRPk6YnJBxw_xpuAAAAM4"]
[Sun Mar 01 16:14:00.703722 2026] [:error] [pid 41967:tid 41969] [client 45.86.202.169:38781] [client 45.86.202.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaP1SIO1bqY181I02eGVzwAAAIA"]
[Sun Mar 01 16:14:01.262544 2026] [:error] [pid 33822:tid 33832] [client 45.86.202.186:64737] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaP1SW6W3ygu1YVssubLVgAAAog"]
[Sun Mar 01 16:14:02.316918 2026] [:error] [pid 7133:tid 7148] [client 45.86.202.203:37495] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Mar 01 16:14:02.639098 2026] [:error] [pid 7133:tid 7135] [client 45.86.202.203:37495] [client 45.86.202.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaP1SvCtubh8pR64qB_NwAAAAEA"]
[Sun Mar 01 16:14:03.941011 2026] [:error] [pid 38241:tid 38246] [client 45.86.202.203:35843] [client 45.86.202.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaP1S_KRPk6YnJBxw_xpzwAAAMI"]
[Sun Mar 01 16:14:06.232050 2026] [:error] [pid 7165:tid 7170] [client 45.86.202.200:24453] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaP1ThRjCrA8qWBjgG88swAAAkM"]
[Sun Mar 01 16:14:07.119537 2026] [:error] [pid 33822:tid 33837] [client 45.86.202.198:38411] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sun Mar 01 16:14:07.407621 2026] [:error] [pid 33822:tid 33839] [client 45.86.202.198:38411] [client 45.86.202.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaP1T26W3ygu1YVssubLYAAAAo8"]
[Sun Mar 01 16:14:08.809957 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.173:65431] [client 45.86.202.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaP1UAfBuk03yQKDyqvSPQAAAdg"]
[Sun Mar 01 16:14:09.933686 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.160:58227] [client 45.86.202.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "aaP1URRjCrA8qWBjgG88xQAAAkA"]
[Sun Mar 01 16:14:10.773975 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.164:31535] [client 45.86.202.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaP1UgfBuk03yQKDyqvSRgAAAcQ"]
[Sun Mar 01 16:14:11.551345 2026] [:error] [pid 7133:tid 7156] [client 45.86.202.203:61953] [client 45.86.202.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "aaP1U_Ctubh8pR64qB_N5gAAAFU"]
[Sun Mar 01 16:14:12.154833 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.196:44415] [client 45.86.202.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaP1VAfBuk03yQKDyqvSUAAAAcg"]
[Sun Mar 01 16:14:14.598008 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.171:50557] [client 45.86.202.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaP1VgfBuk03yQKDyqvSXgAAAcg"]
[Sun Mar 01 16:14:15.997322 2026] [:error] [pid 41342:tid 41358] [client 45.86.202.168:51399] [client 45.86.202.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaP1V44iJ6RAS5CatDlMcgAAAg0"]
[Sun Mar 01 16:14:17.103802 2026] [:error] [pid 7165:tid 7176] [client 45.86.202.203:25069] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Mar 01 16:14:17.488453 2026] [:error] [pid 7165:tid 7191] [client 45.86.202.203:25069] [client 45.86.202.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaP1WRRjCrA8qWBjgG885QAAAlg"]
[Sun Mar 01 16:14:19.148702 2026] [:error] [pid 7165:tid 7172] [client 45.86.202.182:41833] [client 45.86.202.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaP1WxRjCrA8qWBjgG888QAAAkU"]
[Sun Mar 01 16:14:19.736165 2026] [:error] [pid 40750:tid 40763] [client 45.86.202.175:43171] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Sun Mar 01 16:14:21.626797 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.175:43171] [client 45.86.202.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaP1XQfBuk03yQKDyqvSegAAAdg"]
[Sun Mar 01 16:14:22.547035 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.194:26353] [client 45.86.202.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaP1XhRjCrA8qWBjgG889wAAAk8"]
[Sun Mar 01 16:14:23.483124 2026] [:error] [pid 38241:tid 38252] [client 45.86.202.191:58239] [client 45.86.202.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaP1X_KRPk6YnJBxw_xqEQAAAMg"]
[Sun Mar 01 16:14:24.687274 2026] [:error] [pid 41780:tid 41794] [client 45.86.202.185:39861] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaP1YMONkVoocLIqzy0UMQAAA8s"]
[Sun Mar 01 16:14:28.385796 2026] [:error] [pid 38241:tid 38265] [client 45.86.202.166:50771] [client 45.86.202.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaP1ZPKRPk6YnJBxw_xqKgAAANU"]
[Sun Mar 01 16:14:29.360046 2026] [:error] [pid 38241:tid 38244] [client 45.86.202.180:60841] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaP1ZfKRPk6YnJBxw_xqMwAAAMA"]
[Sun Mar 01 16:14:30.857217 2026] [:error] [pid 33822:tid 33839] [client 45.86.202.178:52779] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaP1Zm6W3ygu1YVssubLeQAAAo8"]
[Sun Mar 01 16:14:31.574492 2026] [:error] [pid 33822:tid 33846] [client 45.86.202.164:64709] [client 45.86.202.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaP1Z26W3ygu1YVssubLfAAAApY"]
[Sun Mar 01 16:14:33.024086 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.205:36355] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaP1aRRjCrA8qWBjgG89BAAAAkA"]
[Sun Mar 01 16:14:33.662707 2026] [:error] [pid 40750:tid 40770] [client 45.86.202.171:52151] [client 45.86.202.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaP1aQfBuk03yQKDyqvSngAAAdE"]
[Sun Mar 01 16:14:34.234135 2026] [:error] [pid 7133:tid 7139] [client 45.86.202.176:57199] [client 45.86.202.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.176, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaP1avCtubh8pR64qB_OGwAAAEQ"]
[Sun Mar 01 16:14:34.237852 2026] [:error] [pid 7133:tid 7139] [client 45.86.202.176:57199] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Mar 01 16:14:34.606259 2026] [:error] [pid 7133:tid 7140] [client 45.86.202.176:57199] [client 45.86.202.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaP1avCtubh8pR64qB_OHQAAAEU"]
[Sun Mar 01 16:14:37.032648 2026] [:error] [pid 7165:tid 7178] [client 45.86.202.178:43253] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Mar 01 16:14:37.331057 2026] [:error] [pid 7165:tid 7190] [client 45.86.202.178:43253] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaP1bRRjCrA8qWBjgG89FgAAAlc"]
[Sun Mar 01 16:14:37.961705 2026] [:error] [pid 7165:tid 7178] [client 45.86.202.192:59521] [client 45.86.202.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "aaP1bRRjCrA8qWBjgG89GQAAAks"]
[Sun Mar 01 16:14:38.542829 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.197:50179] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Sun Mar 01 16:14:40.786071 2026] [:error] [pid 40750:tid 40763] [client 45.86.202.197:50179] [client 45.86.202.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaP1cAfBuk03yQKDyqvSxwAAAco"]
[Sun Mar 01 16:14:41.336741 2026] [:error] [pid 41967:tid 41979] [client 45.86.202.161:64989] [client 45.86.202.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaP1cYO1bqY181I02eGV8QAAAIo"]
[Sun Mar 01 16:14:42.516132 2026] [:error] [pid 38241:tid 38252] [client 45.86.202.166:51037] [client 45.86.202.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaP1cvKRPk6YnJBxw_xqWgAAAMg"]
[Sun Mar 01 16:14:43.116905 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.188:41107] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaP1cwfBuk03yQKDyqvSzQAAAdQ"]
[Sun Mar 01 16:14:43.682553 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.193:45261] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sun Mar 01 16:14:44.012090 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.193:45261] [client 45.86.202.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.193, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaP1dBRjCrA8qWBjgG89KAAAAlQ"]
[Sun Mar 01 16:14:44.628576 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.193:45261] [client 45.86.202.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaP1dBRjCrA8qWBjgG89MQAAAkA"]
[Sun Mar 01 16:14:46.421139 2026] [:error] [pid 38241:tid 38255] [client 45.86.202.161:26409] [client 45.86.202.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaP1dvKRPk6YnJBxw_xqdgAAAMs"]
[Sun Mar 01 16:14:46.992148 2026] [:error] [pid 38034:tid 38046] [client 45.86.202.159:47327] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Mar 01 16:14:47.261264 2026] [:error] [pid 38034:tid 38055] [client 45.86.202.159:47327] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaP1dwxtfZjwlJok9K_W2AAAARE"]
[Sun Mar 01 16:14:48.864067 2026] [:error] [pid 41967:tid 41986] [client 45.86.202.187:55375] [client 45.86.202.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaP1eIO1bqY181I02eGWDQAAAJE"]
[Sun Mar 01 16:14:49.453808 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.168:65191] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sun Mar 01 16:14:50.411441 2026] [:error] [pid 41967:tid 41988] [client 45.86.202.168:65191] [client 45.86.202.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaP1eoO1bqY181I02eGWIAAAAJM"]
[Sun Mar 01 16:14:51.622190 2026] [:error] [pid 38241:tid 38265] [client 45.86.202.196:52691] [client 45.86.202.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaP1e_KRPk6YnJBxw_xqggAAANU"]
[Sun Mar 01 16:14:52.220100 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.181:27507] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sun Mar 01 16:14:52.888400 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.181:27507] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Mar 01 16:14:53.587066 2026] [:error] [pid 7165:tid 7188] [client 45.86.202.181:27507] [client 45.86.202.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaP1fRRjCrA8qWBjgG89VgAAAlU"]
[Sun Mar 01 16:14:54.223635 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.224:36741] [client 45.86.202.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaP1fvKRPk6YnJBxw_xqhwAAANY"]
[Sun Mar 01 16:14:55.090605 2026] [:error] [pid 41967:tid 41988] [client 45.86.202.204:37685] [client 45.86.202.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "aaP1f4O1bqY181I02eGWKAAAAJM"]
[Sun Mar 01 16:14:55.664443 2026] [:error] [pid 38241:tid 38255] [client 45.86.202.176:64691] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Sun Mar 01 16:14:57.706762 2026] [:error] [pid 38241:tid 38260] [client 45.86.202.176:64691] [client 45.86.202.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaP1gfKRPk6YnJBxw_xqqgAAANA"]
[Sun Mar 01 16:14:58.854813 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.201:63655] [client 45.86.202.201] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "aaP1ggfBuk03yQKDyqvS-QAAAcg"]
[Sun Mar 01 16:14:59.167032 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.201:63655] [client 45.86.202.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaP1gwfBuk03yQKDyqvS-gAAAdQ"]
[Sun Mar 01 16:15:00.498960 2026] [:error] [pid 40750:tid 40763] [client 45.86.202.170:63545] [client 45.86.202.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaP1hAfBuk03yQKDyqvTBgAAAco"]
[Sun Mar 01 16:15:01.206550 2026] [:error] [pid 40750:tid 40771] [client 45.86.202.159:62553] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaP1hQfBuk03yQKDyqvTDAAAAdI"]
[Sun Mar 01 16:15:02.614164 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.224:23629] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun Mar 01 16:15:04.980094 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.224:23629] [client 45.86.202.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaP1iBRjCrA8qWBjgG89ggAAAkA"]
[Sun Mar 01 16:15:06.332255 2026] [:error] [pid 37032:tid 37036] [client 45.86.202.175:22077] [client 45.86.202.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaP1iuu0U4o7eSImsVRUEgAAAYI"]
[Sun Mar 01 16:15:07.222745 2026] [:error] [pid 41967:tid 41972] [client 45.86.202.185:51583] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaP1i4O1bqY181I02eGWLwAAAIM"]
[Sun Mar 01 16:15:08.039499 2026] [:error] [pid 7165:tid 7191] [client 45.86.202.205:29425] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sun Mar 01 16:15:11.251468 2026] [:error] [pid 7165:tid 7184] [client 45.86.202.205:29425] [client 45.86.202.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaP1jxRjCrA8qWBjgG89nAAAAlE"]
[Sun Mar 01 16:15:12.087901 2026] [:error] [pid 7165:tid 7184] [client 45.86.202.225:41075] [client 45.86.202.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aaP1kBRjCrA8qWBjgG89oAAAAlE"]
[Sun Mar 01 16:15:12.712452 2026] [:error] [pid 38241:tid 38268] [client 45.86.202.180:29773] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Mar 01 16:15:13.015946 2026] [:error] [pid 38241:tid 38260] [client 45.86.202.180:29773] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaP1kfKRPk6YnJBxw_xq3wAAANA"]
[Sun Mar 01 16:15:13.649728 2026] [:error] [pid 7165:tid 7188] [client 45.86.202.195:62899] [client 45.86.202.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaP1kRRjCrA8qWBjgG89pgAAAlU"]
[Sun Mar 01 16:15:14.942398 2026] [:error] [pid 41967:tid 41975] [client 45.86.202.170:52559] [client 45.86.202.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaP1koO1bqY181I02eGWNwAAAIY"]
[Sun Mar 01 16:15:16.628401 2026] [:error] [pid 7165:tid 7188] [client 45.86.202.193:38537] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Sun Mar 01 16:15:16.932936 2026] [:error] [pid 7165:tid 7174] [client 45.86.202.193:38537] [client 45.86.202.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaP1lBRjCrA8qWBjgG89ugAAAkc"]
[Sun Mar 01 16:15:17.608333 2026] [:error] [pid 40750:tid 40770] [client 45.86.202.171:27617] [client 45.86.202.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaP1lQfBuk03yQKDyqvTUAAAAdE"]
[Sun Mar 01 16:15:19.691352 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.197:29495] [client 45.86.202.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaP1l4O1bqY181I02eGWQQAAAI0"]
[Sun Mar 01 16:15:21.147246 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.225:37289] [client 45.86.202.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaP1mYO1bqY181I02eGWRwAAAI0"]
[Sun Mar 01 16:15:21.753459 2026] [:error] [pid 40750:tid 40773] [client 45.86.202.225:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Sun Mar 01 16:15:22.615020 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.225:43867] [client 45.86.202.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaP1mgfBuk03yQKDyqvTdwAAAcQ"]
[Sun Mar 01 16:15:23.265929 2026] [:error] [pid 41967:tid 41984] [client 45.86.202.174:28451] [client 45.86.202.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaP1m4O1bqY181I02eGWTgAAAI8"]
[Sun Mar 01 16:15:24.293355 2026] [:error] [pid 41967:tid 41982] [client 45.86.202.177:54365] [client 45.86.202.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaP1nIO1bqY181I02eGWVAAAAI0"]
[Sun Mar 01 16:15:24.938285 2026] [:error] [pid 41967:tid 41988] [client 45.86.202.161:42059] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sun Mar 01 16:15:25.716174 2026] [:error] [pid 41967:tid 41972] [client 45.86.202.161:42059] [client 45.86.202.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaP1nYO1bqY181I02eGWWgAAAIM"]
[Sun Mar 01 16:15:26.280964 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.168:50831] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Sun Mar 01 16:15:26.861937 2026] [:error] [pid 40750:tid 40770] [client 45.86.202.168:50831] [client 45.86.202.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaP1ngfBuk03yQKDyqvTiwAAAdE"]
[Sun Mar 01 16:15:27.433039 2026] [:error] [pid 38241:tid 38251] [client 45.86.202.177:56245] [client 45.86.202.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaP1n_KRPk6YnJBxw_xrAgAAAMc"]
[Sun Mar 01 16:15:29.011270 2026] [:error] [pid 38241:tid 38268] [client 45.86.202.194:49545] [client 45.86.202.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaP1ofKRPk6YnJBxw_xrBwAAANg"]
[Sun Mar 01 16:15:29.696823 2026] [:error] [pid 38241:tid 38251] [client 45.86.202.195:27037] [client 45.86.202.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaP1ofKRPk6YnJBxw_xrCwAAAMc"]
[Sun Mar 01 16:15:30.923241 2026] [:error] [pid 38241:tid 38251] [client 45.86.202.177:30089] [client 45.86.202.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaP1ovKRPk6YnJBxw_xrFQAAAMc"]
[Sun Mar 01 16:15:31.836000 2026] [:error] [pid 38241:tid 38263] [client 45.86.202.179:26845] [client 45.86.202.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaP1o_KRPk6YnJBxw_xrGwAAANM"]
[Sun Mar 01 16:15:32.872611 2026] [:error] [pid 44644:tid 44647] [client 45.86.202.199:44549] [client 45.86.202.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaP1pJ3RJaXMcw3y9V-7uQAAAAA"]
[Sun Mar 01 16:15:33.483319 2026] [:error] [pid 41967:tid 41969] [client 45.86.202.159:49643] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaP1pYO1bqY181I02eGWXQAAAIA"]
[Sun Mar 01 16:15:35.136327 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.201:36569] [client 45.86.202.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaP1pwfBuk03yQKDyqvTwgAAAcQ"]
[Sun Mar 01 16:15:36.349265 2026] [:error] [pid 38241:tid 38266] [client 45.86.202.176:23093] [client 45.86.202.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaP1qPKRPk6YnJBxw_xrKgAAANY"]
[Sun Mar 01 16:15:37.391547 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.195:39721] [client 45.86.202.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaP1qRRjCrA8qWBjgG896gAAAlQ"]
[Sun Mar 01 16:15:38.264521 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.186:50051] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaP1qgfBuk03yQKDyqvT0gAAAcg"]
[Sun Mar 01 16:15:39.512059 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.189:56835] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sun Mar 01 16:15:40.872262 2026] [:error] [pid 7165:tid 7191] [client 45.86.202.189:56835] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaP1rBRjCrA8qWBjgG89_gAAAlg"]
[Sun Mar 01 16:15:41.439193 2026] [:error] [pid 41967:tid 41972] [client 45.86.202.192:49581] [client 45.86.202.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaP1rYO1bqY181I02eGWcAAAAIM"]
[Sun Mar 01 16:15:43.994283 2026] [:error] [pid 41967:tid 41990] [client 45.86.202.156:21213] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sun Mar 01 16:15:44.293840 2026] [:error] [pid 41967:tid 41969] [client 45.86.202.156:21213] [client 45.86.202.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaP1sIO1bqY181I02eGWfQAAAIA"]
[Sun Mar 01 16:15:46.997278 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.199:49923] [client 45.86.202.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaP1shRjCrA8qWBjgG8-JQAAAlA"]
[Sun Mar 01 16:15:47.889771 2026] [:error] [pid 7165:tid 7181] [client 45.86.202.178:35387] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Sun Mar 01 16:15:48.227325 2026] [:error] [pid 7165:tid 7181] [client 45.86.202.178:35387] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaP1tBRjCrA8qWBjgG8-NAAAAk4"]
[Sun Mar 01 16:15:49.372004 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.196:31551] [client 45.86.202.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaP1tRRjCrA8qWBjgG8-QwAAAkA"]
[Sun Mar 01 16:15:50.062978 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.188:23095] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Mar 01 16:15:50.433561 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.188:23095] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaP1thRjCrA8qWBjgG8-UgAAAkA"]
[Sun Mar 01 16:15:51.418684 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.225:63811] [client 45.86.202.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaP1txRjCrA8qWBjgG8-WgAAAkA"]
[Sun Mar 01 16:15:53.043507 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.225:56229] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sun Mar 01 16:15:53.359950 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.225:56229] [client 45.86.202.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaP1uRRjCrA8qWBjgG8-ZgAAAk8"]
[Sun Mar 01 16:15:55.059069 2026] [:error] [pid 38034:tid 38060] [client 45.86.202.173:53939] [client 45.86.202.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaP1uwxtfZjwlJok9K_W9gAAARY"]
[Sun Mar 01 16:15:55.679552 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.168:60785] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sun Mar 01 16:15:56.054902 2026] [:error] [pid 7165:tid 7191] [client 45.86.202.168:60785] [client 45.86.202.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaP1vBRjCrA8qWBjgG8-fAAAAlg"]
[Sun Mar 01 16:15:56.588353 2026] [:error] [pid 7165:tid 7174] [client 45.86.202.184:39351] [client 45.86.202.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaP1vBRjCrA8qWBjgG8-ggAAAkc"]
[Sun Mar 01 16:15:57.199328 2026] [:error] [pid 33822:tid 33848] [client 45.86.202.185:31869] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sun Mar 01 16:15:57.853455 2026] [:error] [pid 33822:tid 33832] [client 45.86.202.185:31869] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaP1vW6W3ygu1YVssubLvgAAAog"]
[Sun Mar 01 16:15:58.388793 2026] [:error] [pid 37032:tid 37055] [client 45.86.202.199:50029] [client 45.86.202.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaP1vuu0U4o7eSImsVRUGwAAAZU"]
[Sun Mar 01 16:16:00.981776 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.191:58333] [client 45.86.202.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaP1wAfBuk03yQKDyqvUBAAAAdg"]
[Sun Mar 01 16:16:01.613202 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.186:56693] [client 45.86.202.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaP1wRRjCrA8qWBjgG8-nAAAAkA"]
[Sun Mar 01 16:16:03.266122 2026] [:error] [pid 38241:tid 38263] [client 45.86.202.185:58485] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/log.php"] [unique_id "aaP1w_KRPk6YnJBxw_xrdgAAANM"]
[Sun Mar 01 16:16:03.919880 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.180:64267] [client 45.86.202.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaP1wwfBuk03yQKDyqvUCQAAAdg"]
[Sun Mar 01 16:16:04.503240 2026] [:error] [pid 37032:tid 37058] [client 45.86.202.177:34517] [client 45.86.202.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaP1xOu0U4o7eSImsVRUHQAAAZg"]
[Sun Mar 01 16:16:05.092950 2026] [:error] [pid 33822:tid 33842] [client 45.86.202.178:53461] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aaP1xW6W3ygu1YVssubLwAAAApI"]
[Sun Mar 01 16:16:06.869280 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.179:34225] [client 45.86.202.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaP1xhRjCrA8qWBjgG8-xwAAAlQ"]
[Sun Mar 01 16:16:07.587310 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.185:28023] [client 45.86.202.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aaP1xwfBuk03yQKDyqvUHwAAAdg"]
[Sun Mar 01 16:16:08.551964 2026] [:error] [pid 7165:tid 7182] [client 45.86.202.172:25779] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Sun Mar 01 16:16:08.842779 2026] [:error] [pid 7165:tid 7181] [client 45.86.202.172:25779] [client 45.86.202.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaP1yBRjCrA8qWBjgG8-4AAAAk4"]
[Sun Mar 01 16:16:09.450778 2026] [:error] [pid 38241:tid 38251] [client 45.86.202.161:58245] [client 45.86.202.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaP1yfKRPk6YnJBxw_xrgwAAAMc"]
[Sun Mar 01 16:16:10.741836 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.183:29613] [client 45.86.202.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aaP1ygfBuk03yQKDyqvUNwAAAcQ"]
[Sun Mar 01 16:16:11.312260 2026] [:error] [pid 33822:tid 33824] [client 45.86.202.178:36689] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaP1y26W3ygu1YVssubLywAAAoA"]
[Sun Mar 01 16:16:14.536115 2026] [:error] [pid 40750:tid 40777] [client 45.86.202.225:25901] [client 45.86.202.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aaP1zgfBuk03yQKDyqvUTAAAAdg"]
[Sun Mar 01 16:16:15.088737 2026] [:error] [pid 7165:tid 7172] [client 45.86.202.161:59245] [client 45.86.202.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaP1zxRjCrA8qWBjgG8_DwAAAkU"]
[Sun Mar 01 16:16:16.907956 2026] [:error] [pid 7165:tid 7181] [client 45.86.202.224:34091] [client 45.86.202.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/file.php"] [unique_id "aaP10BRjCrA8qWBjgG8_GAAAAk4"]
[Sun Mar 01 16:16:17.938480 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.178:55031] [client 45.86.202.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaP10QfBuk03yQKDyqvUcwAAAcg"]
[Sun Mar 01 16:16:18.890910 2026] [:error] [pid 7133:tid 7136] [client 45.86.202.158:28589] [client 45.86.202.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/load.php"] [unique_id "aaP10vCtubh8pR64qB_OhwAAAEE"]
[Sun Mar 01 16:16:20.512910 2026] [:error] [pid 40750:tid 40757] [client 45.86.202.172:41613] [client 45.86.202.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaP11AfBuk03yQKDyqvUfAAAAcQ"]
[Sun Mar 01 16:16:21.106040 2026] [:error] [pid 7165:tid 7183] [client 45.86.202.189:62209] [client 45.86.202.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaP11RRjCrA8qWBjgG8_JQAAAlA"]
[Sun Mar 01 16:16:22.576848 2026] [:error] [pid 7165:tid 7167] [client 45.86.202.200:49123] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaP11hRjCrA8qWBjgG8_LQAAAkA"]
[Sun Mar 01 16:16:23.155118 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.168:41529] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Sun Mar 01 16:16:24.176747 2026] [:error] [pid 7165:tid 7187] [client 45.86.202.168:41529] [client 45.86.202.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaP12BRjCrA8qWBjgG8_MgAAAlQ"]
[Sun Mar 01 16:16:25.462725 2026] [:error] [pid 41967:tid 41990] [client 45.86.202.200:39539] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Sun Mar 01 16:16:25.803662 2026] [:error] [pid 41967:tid 41969] [client 45.86.202.200:39539] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaP12YO1bqY181I02eGWtAAAAIA"]
[Sun Mar 01 16:16:26.435219 2026] [:error] [pid 38241:tid 38263] [client 45.86.202.194:54419] [client 45.86.202.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaP12vKRPk6YnJBxw_xrswAAANM"]
[Sun Mar 01 16:16:28.383134 2026] [:error] [pid 41967:tid 41988] [client 45.86.202.200:37269] [client 45.86.202.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaP13IO1bqY181I02eGWuwAAAJM"]
[Sun Mar 01 16:16:30.546131 2026] [:error] [pid 42619:tid 42630] [client 45.86.202.159:31431] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun Mar 01 16:16:32.065831 2026] [:error] [pid 42619:tid 42627] [client 45.86.202.159:31431] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aaP14B_zUXcYaZE4AOeYrwAAAUY"]
[Sun Mar 01 16:16:33.005827 2026] [:error] [pid 7165:tid 7172] [client 45.86.202.188:26673] [client 45.86.202.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaP14RRjCrA8qWBjgG8_QgAAAkU"]
[Sun Mar 01 16:16:34.233868 2026] [:error] [pid 38241:tid 38263] [client 45.86.202.165:23399] [client 45.86.202.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaP14vKRPk6YnJBxw_xr1AAAANM"]
[Sun Mar 01 16:16:34.822955 2026] [:error] [pid 40750:tid 40761] [client 45.86.202.184:50347] [client 45.86.202.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaP14gfBuk03yQKDyqvUqwAAAcg"]
[Sun Mar 01 16:16:35.538017 2026] [:error] [pid 7165:tid 7191] [client 45.86.202.164:50297] [client 45.86.202.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaP14xRjCrA8qWBjgG8_XQAAAlg"]
[Sun Mar 01 16:26:43.848598 2026] [:error] [pid 40750:tid 40760] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Mar 01 16:26:43.985416 2026] [:error] [pid 40750:tid 40777] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Sun Mar 01 16:26:44.122529 2026] [:error] [pid 40750:tid 40772] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Mar 01 16:26:44.260951 2026] [:error] [pid 40750:tid 40766] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Mar 01 16:26:44.399845 2026] [:error] [pid 40750:tid 40768] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 16:26:44.570719 2026] [:error] [pid 40750:tid 40769] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 16:26:44.707840 2026] [:error] [pid 40750:tid 40763] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/meta.php
[Sun Mar 01 16:26:44.844942 2026] [:error] [pid 40750:tid 40775] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Sun Mar 01 16:26:44.998962 2026] [:error] [pid 40750:tid 40753] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 16:26:45.135524 2026] [:error] [pid 40750:tid 40773] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sun Mar 01 16:26:45.298869 2026] [:error] [pid 40750:tid 40755] [client 20.194.29.45:12109] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 01 16:26:45.444406 2026] [:error] [pid 40750:tid 40756] [client 20.194.29.45:12109] [client 20.194.29.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aaP4RQfBuk03yQKDyqvhwwAAAcM"]
[Sun Mar 01 16:26:46.025909 2026] [:error] [pid 33822:tid 33829] [client 20.194.29.45:12430] [client 20.194.29.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aaP4Rm6W3ygu1YVssubPGAAAAoU"]
[Sun Mar 01 16:26:46.706870 2026] [:error] [pid 7165:tid 7170] [client 20.194.29.45:10729] [client 20.194.29.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aaP4RhRjCrA8qWBjgG9H5wAAAkM"]
[Sun Mar 01 16:26:47.444763 2026] [:error] [pid 7165:tid 7187] [client 20.194.29.45:12656] [client 20.194.29.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "aaP4RxRjCrA8qWBjgG9H7AAAAlQ"]
[Sun Mar 01 16:27:08.798670 2026] [:error] [pid 40750:tid 40757] [client 104.28.214.115:28911] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aaP4XAfBuk03yQKDyqviBgAAAcQ"]
[Sun Mar 01 16:27:09.252070 2026] [:error] [pid 40750:tid 40762] [client 104.28.214.115:28919] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/style.php"] [unique_id "aaP4XQfBuk03yQKDyqviCgAAAck"]
[Sun Mar 01 16:27:09.683131 2026] [:error] [pid 40750:tid 40769] [client 104.28.214.115:28921] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "aaP4XQfBuk03yQKDyqviDAAAAdA"]
[Sun Mar 01 16:27:10.919812 2026] [:error] [pid 41342:tid 41354] [client 104.28.214.115:28924] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/style.php"] [unique_id "aaP4Xo4iJ6RAS5CatDlMtgAAAgk"]
[Sun Mar 01 16:27:12.382353 2026] [:error] [pid 37032:tid 37058] [client 104.28.246.115:19372] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style.php"] [unique_id "aaP4YOu0U4o7eSImsVRVsgAAAZg"]
[Sun Mar 01 16:27:15.640837 2026] [:error] [pid 40750:tid 40775] [client 104.28.246.115:19376] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aaP4YwfBuk03yQKDyqviHwAAAdY"]
[Sun Mar 01 16:27:16.083039 2026] [:error] [pid 38241:tid 38255] [client 104.28.214.115:56739] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aaP4ZPKRPk6YnJBxw_xxNAAAAMs"]
[Sun Mar 01 17:16:54.754057 2026] [:error] [pid 40750:tid 40776] [client 194.180.48.253:37500] [client 194.180.48.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aaQEBgfBuk03yQKDyqsbPgAAAdc"]
[Sun Mar 01 18:01:10.972492 2026] [:error] [pid 7133:tid 7157] [client 74.243.251.125:13852] [client 74.243.251.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaQOZvCtubh8pR64qB_5fwAAAFY"]
[Sun Mar 01 18:01:11.299945 2026] [:error] [pid 40750:tid 40767] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Sun Mar 01 18:01:11.631874 2026] [:error] [pid 40750:tid 40769] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sun Mar 01 18:01:11.795458 2026] [:error] [pid 40750:tid 40766] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Sun Mar 01 18:01:11.959672 2026] [:error] [pid 40750:tid 40777] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Sun Mar 01 18:01:12.127178 2026] [:error] [pid 40750:tid 40759] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Sun Mar 01 18:01:12.292912 2026] [:error] [pid 40750:tid 40762] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Sun Mar 01 18:01:12.457249 2026] [:error] [pid 40750:tid 40766] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Sun Mar 01 18:01:12.623014 2026] [:error] [pid 40750:tid 40755] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Sun Mar 01 18:01:12.788142 2026] [:error] [pid 40750:tid 40753] [client 74.243.251.125:13505] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Sun Mar 01 18:01:12.949452 2026] [:error] [pid 40750:tid 40777] [client 74.243.251.125:13505] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaQOaAfBuk03yQKDyqtTvQAAAdg"]
[Sun Mar 01 18:01:13.286758 2026] [:error] [pid 38034:tid 38058] [client 74.243.251.125:13861] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaQOaQxtfZjwlJok9K_uwwAAARQ"]
[Sun Mar 01 18:01:13.613523 2026] [:error] [pid 40750:tid 40759] [client 74.243.251.125:13521] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaQOaQfBuk03yQKDyqtTwwAAAcY"]
[Sun Mar 01 18:01:13.936591 2026] [:error] [pid 38241:tid 38259] [client 74.243.251.125:13874] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaQOafKRPk6YnJBxw_yrrQAAAM8"]
[Sun Mar 01 18:01:14.260470 2026] [:error] [pid 38241:tid 38263] [client 74.243.251.125:13858] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaQOavKRPk6YnJBxw_yrrwAAANM"]
[Sun Mar 01 18:01:14.583289 2026] [:error] [pid 7133:tid 7142] [client 74.243.251.125:13841] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaQOavCtubh8pR64qB_5hgAAAEc"]
[Sun Mar 01 18:01:14.905894 2026] [:error] [pid 40750:tid 40754] [client 74.243.251.125:13873] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaQOagfBuk03yQKDyqtTzwAAAcE"]
[Sun Mar 01 18:01:15.232091 2026] [:error] [pid 37032:tid 37057] [client 74.243.251.125:13520] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaQOa-u0U4o7eSImsVRk6wAAAZc"]
[Sun Mar 01 18:01:15.555621 2026] [:error] [pid 37032:tid 37035] [client 74.243.251.125:13864] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaQOa-u0U4o7eSImsVRk7AAAAYE"]
[Sun Mar 01 18:01:15.878839 2026] [:error] [pid 7133:tid 7139] [client 74.243.251.125:13875] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaQOa_Ctubh8pR64qB_5iQAAAEQ"]
[Sun Mar 01 18:01:16.201948 2026] [:error] [pid 40750:tid 40754] [client 74.243.251.125:13863] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaQObAfBuk03yQKDyqtT2QAAAcE"]
[Sun Mar 01 18:01:16.525716 2026] [:error] [pid 7133:tid 7147] [client 74.243.251.125:13881] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaQObPCtubh8pR64qB_5iwAAAEw"]
[Sun Mar 01 18:01:16.849973 2026] [:error] [pid 41780:tid 41791] [client 74.243.251.125:13840] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaQObMONkVoocLIqzy0diAAAA8g"]
[Sun Mar 01 18:01:17.173556 2026] [:error] [pid 33822:tid 33826] [client 74.243.251.125:13833] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaQObW6W3ygu1YVssubsJgAAAoI"]
[Sun Mar 01 18:01:17.496458 2026] [:error] [pid 38241:tid 38265] [client 74.243.251.125:13880] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaQObfKRPk6YnJBxw_yrtQAAANU"]
[Sun Mar 01 18:01:17.819123 2026] [:error] [pid 7133:tid 7137] [client 74.243.251.125:13825] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaQObfCtubh8pR64qB_5kQAAAEI"]
[Sun Mar 01 18:01:18.142293 2026] [:error] [pid 7133:tid 7156] [client 74.243.251.125:13527] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaQObvCtubh8pR64qB_5kgAAAFU"]
[Sun Mar 01 18:01:18.504477 2026] [:error] [pid 7133:tid 7135] [client 74.243.251.125:13845] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaQObvCtubh8pR64qB_5lQAAAEA"]
[Sun Mar 01 18:01:18.827238 2026] [:error] [pid 7133:tid 7139] [client 74.243.251.125:13856] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaQObvCtubh8pR64qB_5mAAAAEQ"]
[Sun Mar 01 18:01:19.149502 2026] [:error] [pid 38034:tid 38048] [client 74.243.251.125:13514] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaQObwxtfZjwlJok9K_uyAAAAQo"]
[Sun Mar 01 18:01:19.472491 2026] [:error] [pid 40750:tid 40764] [client 74.243.251.125:13511] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaQObwfBuk03yQKDyqtT6QAAAcs"]
[Sun Mar 01 18:01:19.794750 2026] [:error] [pid 40750:tid 40766] [client 74.243.251.125:13838] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaQObwfBuk03yQKDyqtT7AAAAc0"]
[Sun Mar 01 18:01:20.117900 2026] [:error] [pid 40750:tid 40760] [client 74.243.251.125:13886] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaQOcAfBuk03yQKDyqtT8AAAAcc"]
[Sun Mar 01 18:01:20.451595 2026] [:error] [pid 40750:tid 40759] [client 74.243.251.125:13876] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaQOcAfBuk03yQKDyqtT9AAAAcY"]
[Sun Mar 01 18:01:20.775325 2026] [:error] [pid 40750:tid 40768] [client 74.243.251.125:14293] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaQOcAfBuk03yQKDyqtT-AAAAc8"]
[Sun Mar 01 18:01:21.099033 2026] [:error] [pid 41342:tid 41358] [client 74.243.251.125:13832] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaQOcY4iJ6RAS5CatDlTqAAAAg0"]
[Sun Mar 01 18:01:21.423469 2026] [:error] [pid 33822:tid 33834] [client 74.243.251.125:13846] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaQOcW6W3ygu1YVssubsLQAAAoo"]
[Sun Mar 01 18:01:21.746916 2026] [:error] [pid 33822:tid 33840] [client 74.243.251.125:13548] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaQOcW6W3ygu1YVssubsMQAAApA"]
[Sun Mar 01 19:01:26.083704 2026] [:error] [pid 33822:tid 33845] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Mar 01 19:01:26.221173 2026] [:error] [pid 33822:tid 33840] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 19:01:26.360427 2026] [:error] [pid 33822:tid 33847] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 19:01:26.498060 2026] [:error] [pid 33822:tid 33844] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Mar 01 19:01:26.632409 2026] [:error] [pid 33822:tid 33831] [client 20.41.98.49:20993] [client 20.41.98.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.41.98.49, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaQchm6W3ygu1YVssub9KgAAAoc"]
[Sun Mar 01 19:01:26.637759 2026] [:error] [pid 33822:tid 33831] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 01 19:01:26.775335 2026] [:error] [pid 33822:tid 33827] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 01 19:01:26.914744 2026] [:error] [pid 33822:tid 33834] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 19:01:27.053294 2026] [:error] [pid 33822:tid 33825] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sun Mar 01 19:01:27.191066 2026] [:error] [pid 33822:tid 33837] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 19:01:27.328789 2026] [:error] [pid 33822:tid 33841] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Sun Mar 01 19:01:27.467418 2026] [:error] [pid 33822:tid 33842] [client 20.41.98.49:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sun Mar 01 19:01:27.601577 2026] [:error] [pid 33822:tid 33828] [client 20.41.98.49:20993] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaQch26W3ygu1YVssub9NgAAAoQ"]
[Sun Mar 01 19:01:28.180874 2026] [:error] [pid 38034:tid 38037] [client 20.41.98.49:6401] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaQciAxtfZjwlJok9K_71gAAAQE"]
[Sun Mar 01 19:01:28.769288 2026] [:error] [pid 38034:tid 38043] [client 20.41.98.49:6402] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaQciAxtfZjwlJok9K_72wAAAQU"]
[Sun Mar 01 19:01:29.309237 2026] [:error] [pid 7165:tid 7186] [client 20.41.98.49:7435] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoload_classmap.php"] [unique_id "aaQciRRjCrA8qWBjgG_POgAAAlM"]
[Sun Mar 01 21:58:17.955122 2026] [:error] [pid 38034:tid 38047] [client 40.85.219.62:13109] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaRF-QxtfZjwlJok9K8eNwAAAQk"]
[Sun Mar 01 21:58:18.790624 2026] [:error] [pid 7133:tid 7158] [client 40.85.219.62:12777] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaRF-vCtubh8pR64qB9TigAAAFc"]
[Sun Mar 01 21:58:19.627814 2026] [:error] [pid 7133:tid 7138] [client 40.85.219.62:12795] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaRF-_Ctubh8pR64qB9TlQAAAEM"]
[Sun Mar 01 21:58:20.468616 2026] [:error] [pid 40750:tid 40754] [client 40.85.219.62:13085] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "aaRF_AfBuk03yQKDyqteXQAAAcE"]
[Sun Mar 01 23:17:50.364984 2026] [:error] [pid 37032:tid 37042] [client 185.193.157.189:57544] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaRYnuu0U4o7eSImsVSSZAAAAYg"]
[Sun Mar 01 23:17:50.368425 2026] [:error] [pid 37032:tid 37042] [client 185.193.157.189:57544] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 01 23:17:52.105467 2026] [:error] [pid 37032:tid 37048] [client 185.193.157.189:57544] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaRYoOu0U4o7eSImsVSSdQAAAY4"]
[Sun Mar 01 23:17:52.407010 2026] [:error] [pid 40750:tid 40777] [client 185.193.157.189:57546] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaRYoAfBuk03yQKDyquXCwAAAdg"]
[Sun Mar 01 23:17:52.711122 2026] [:error] [pid 7133:tid 7135] [client 185.193.157.189:57560] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaRYoPCtubh8pR64qB9yMQAAAEA"]
[Sun Mar 01 23:17:53.006060 2026] [:error] [pid 7165:tid 7186] [client 185.193.157.189:57566] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaRYoRRjCrA8qWBjgG-tQwAAAlM"]
[Sun Mar 01 23:17:53.300485 2026] [:error] [pid 44644:tid 44657] [client 185.193.157.189:57572] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaRYoZ3RJaXMcw3y9V_p5gAAAAo"]
[Sun Mar 01 23:17:53.595342 2026] [:error] [pid 44644:tid 44659] [client 185.193.157.189:57574] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaRYoZ3RJaXMcw3y9V_p5wAAAAw"]
[Sun Mar 01 23:17:53.891899 2026] [:error] [pid 44644:tid 44668] [client 185.193.157.189:52618] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaRYoZ3RJaXMcw3y9V_p6AAAABU"]
[Mon Mar 02 00:26:07.417098 2026] [:error] [pid 53585:tid 53604] [client 35.84.207.10:57817] [client 35.84.207.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.84.207.10, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaRon3bCvYsvu6kKhM1LKwAAABA"]
[Mon Mar 02 00:26:07.422414 2026] [:error] [pid 53585:tid 53604] [client 35.84.207.10:57817] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 02 00:26:09.439472 2026] [:error] [pid 53585:tid 53607] [client 35.84.207.10:57817] [client 35.84.207.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaRooXbCvYsvu6kKhM1LQAAAABM"]
[Mon Mar 02 00:26:09.805044 2026] [:error] [pid 53585:tid 53606] [client 35.84.207.10:49824] [client 35.84.207.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaRooXbCvYsvu6kKhM1LQwAAABI"]
[Mon Mar 02 00:26:10.180591 2026] [:error] [pid 53180:tid 53449] [client 35.84.207.10:53837] [client 35.84.207.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaRoojPPJpDOBvYnaa01lgAAAYU"]
[Mon Mar 02 00:26:10.552544 2026] [:error] [pid 53585:tid 53600] [client 35.84.207.10:52432] [client 35.84.207.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaRoonbCvYsvu6kKhM1LSAAAAAw"]
[Mon Mar 02 00:26:10.932874 2026] [:error] [pid 53585:tid 53602] [client 35.84.207.10:64710] [client 35.84.207.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaRoonbCvYsvu6kKhM1LTQAAAA4"]
[Mon Mar 02 00:26:11.310322 2026] [:error] [pid 53585:tid 53593] [client 35.84.207.10:56764] [client 35.84.207.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaRoo3bCvYsvu6kKhM1LUQAAAAU"]
[Mon Mar 02 00:26:11.673366 2026] [:error] [pid 53585:tid 53595] [client 35.84.207.10:53770] [client 35.84.207.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaRoo3bCvYsvu6kKhM1LVQAAAAc"]
[Mon Mar 02 00:49:15.786277 2026] [:error] [pid 53181:tid 53534] [client 20.220.162.180:36955] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 02 00:49:15.993907 2026] [:error] [pid 53181:tid 53526] [client 20.220.162.180:36955] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 02 00:49:16.484879 2026] [:error] [pid 53181:tid 53517] [client 20.220.162.180:36955] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 02 00:49:16.705123 2026] [:error] [pid 53181:tid 53516] [client 20.220.162.180:36955] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 02 00:49:17.116896 2026] [:error] [pid 53181:tid 53525] [client 20.220.162.180:36955] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaRuDYr_0T1SazTrJOAgdgAAAQo"]
[Mon Mar 02 00:49:17.959185 2026] [:error] [pid 53585:tid 53597] [client 20.220.162.180:36928] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaRuDXbCvYsvu6kKhM1tQQAAAAk"]
[Mon Mar 02 00:49:18.818590 2026] [:error] [pid 53585:tid 53592] [client 20.220.162.180:36971] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaRuDnbCvYsvu6kKhM1tTwAAAAQ"]
[Mon Mar 02 00:49:19.652675 2026] [:error] [pid 53180:tid 53467] [client 20.220.162.180:36976] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaRuDzPPJpDOBvYnaa1BzQAAAZc"]
[Mon Mar 02 03:55:29.644382 2026] [:error] [pid 61944:tid 61980] [client 20.78.169.245:6213] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 02 03:55:29.768457 2026] [:error] [pid 61944:tid 61998] [client 20.78.169.245:6213] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 02 03:55:30.030127 2026] [:error] [pid 61944:tid 61987] [client 20.78.169.245:6213] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 02 03:55:30.154024 2026] [:error] [pid 61944:tid 61977] [client 20.78.169.245:6213] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 02 03:55:30.400814 2026] [:error] [pid 61944:tid 61999] [client 20.78.169.245:6213] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Mar 02 03:55:30.547193 2026] [:error] [pid 61944:tid 61979] [client 20.78.169.245:6213] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Mar 02 03:55:30.669768 2026] [:error] [pid 61944:tid 61976] [client 20.78.169.245:6213] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Mar 02 03:55:30.931897 2026] [:error] [pid 61944:tid 61995] [client 20.78.169.245:6213] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSZsq-iKFsV5usEryV_6AAAAFM"]
[Mon Mar 02 03:55:31.416063 2026] [:error] [pid 62033:tid 62037] [client 20.78.169.245:6228] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSZs2t1AZs_Rh_7SVaBJgAAAMI"]
[Mon Mar 02 03:55:31.931639 2026] [:error] [pid 62033:tid 62038] [client 20.78.169.245:6224] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSZs2t1AZs_Rh_7SVaBKgAAAMM"]
[Mon Mar 02 03:55:32.439132 2026] [:error] [pid 61943:tid 61966] [client 20.78.169.245:6263] [client 20.78.169.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSZtNn1J3fKuQpdZdMkigAAABI"]
[Mon Mar 02 04:01:06.942591 2026] [:error] [pid 28908:tid 28932] [client 146.190.117.220:49525] [client 146.190.117.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.190.117.220, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaSbAoqJmC8ih_lQQnCikQAAANY"]
[Mon Mar 02 04:01:06.948444 2026] [:error] [pid 28908:tid 28932] [client 146.190.117.220:49525] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 02 04:08:45.568230 2026] [:error] [pid 28908:tid 28919] [client 91.224.92.99:64430] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaSczYqJmC8ih_lQQnCpIQAAAMk"]
[Mon Mar 02 04:08:45.571923 2026] [:error] [pid 28908:tid 28919] [client 91.224.92.99:64430] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 02 04:08:49.823794 2026] [:error] [pid 28908:tid 28915] [client 91.224.92.99:64430] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaSc0YqJmC8ih_lQQnCpSAAAAMU"]
[Mon Mar 02 04:08:51.523478 2026] [:error] [pid 28793:tid 28825] [client 91.224.92.99:51409] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaSc0w2_fxBANaHo1f7o9gAAABI"]
[Mon Mar 02 04:08:52.217967 2026] [:error] [pid 28908:tid 28928] [client 91.224.92.99:50262] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaSc1IqJmC8ih_lQQnCpUQAAANI"]
[Mon Mar 02 04:08:53.581263 2026] [:error] [pid 31257:tid 31272] [client 91.224.92.99:54831] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaSc1f-JFLfishX45N_DpwAAAQk"]
[Mon Mar 02 04:55:37.247537 2026] [:error] [pid 28795:tid 28880] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/signon.php
[Mon Mar 02 04:55:37.457256 2026] [:error] [pid 28795:tid 28875] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Mon Mar 02 04:55:37.665211 2026] [:error] [pid 28795:tid 28883] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Mon Mar 02 04:55:37.876338 2026] [:error] [pid 28795:tid 28865] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Mon Mar 02 04:55:38.083648 2026] [:error] [pid 28795:tid 28869] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Mon Mar 02 04:55:38.292760 2026] [:error] [pid 28795:tid 28886] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xmlmp.php
[Mon Mar 02 04:55:38.501735 2026] [:error] [pid 28795:tid 28863] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Mon Mar 02 04:55:38.710901 2026] [:error] [pid 28795:tid 28878] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configssss.php
[Mon Mar 02 04:55:38.918715 2026] [:error] [pid 28795:tid 28868] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configss1.php
[Mon Mar 02 04:55:39.127252 2026] [:error] [pid 28795:tid 28876] [client 20.104.206.150:32725] File does not exist: /usr/local/apache/htdocs/suspended-page/ngif.php
[Mon Mar 02 04:55:39.332298 2026] [:error] [pid 28795:tid 28885] [client 20.104.206.150:32725] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configss.php"] [unique_id "aaSny7ROd53wZBkdI_f8DgAAAJY"]
[Mon Mar 02 04:55:39.756926 2026] [:error] [pid 31257:tid 31263] [client 20.104.206.150:32760] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configss.php"] [unique_id "aaSny_-JFLfishX45N_-YwAAAQA"]
[Mon Mar 02 04:55:40.175540 2026] [:error] [pid 28794:tid 28837] [client 20.104.206.150:32767] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configss.php"] [unique_id "aaSnzKVy2qpaelbUob31ygAAAEE"]
[Mon Mar 02 04:55:40.615625 2026] [:error] [pid 28794:tid 28840] [client 20.104.206.150:32731] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-configss.php"] [unique_id "aaSnzKVy2qpaelbUob31zQAAAEQ"]
[Mon Mar 02 04:55:41.043791 2026] [:error] [pid 28908:tid 28925] [client 20.104.206.150:32746] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aaSnzYqJmC8ih_lQQnDRtwAAAM8"]
[Mon Mar 02 04:55:41.468091 2026] [:error] [pid 31257:tid 31284] [client 20.104.206.150:32744] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aaSnzf-JFLfishX45N_-awAAARU"]
[Mon Mar 02 04:55:41.891506 2026] [:error] [pid 28794:tid 28847] [client 20.104.206.150:32712] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aaSnzaVy2qpaelbUob31zwAAAEs"]
[Mon Mar 02 04:55:42.319493 2026] [:error] [pid 28908:tid 28913] [client 20.104.206.150:32666] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "aaSnzoqJmC8ih_lQQnDRvAAAAMM"]
[Mon Mar 02 04:55:42.762817 2026] [:error] [pid 28793:tid 28818] [client 20.104.206.150:32766] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.phpa"] [unique_id "aaSnzg2_fxBANaHo1f72YQAAAAs"]
[Mon Mar 02 04:55:43.181811 2026] [:error] [pid 31257:tid 31274] [client 20.104.206.150:32723] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.phpa"] [unique_id "aaSnz_-JFLfishX45N_-cgAAAQs"]
[Mon Mar 02 04:55:43.604757 2026] [:error] [pid 28793:tid 28831] [client 20.104.206.150:32647] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.phpa"] [unique_id "aaSnzw2_fxBANaHo1f72ZQAAABg"]
[Mon Mar 02 04:55:44.061856 2026] [:error] [pid 31257:tid 31286] [client 20.104.206.150:32650] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.phpa"] [unique_id "aaSn0P-JFLfishX45N_-egAAARc"]
[Mon Mar 02 04:55:44.478592 2026] [:error] [pid 31257:tid 31283] [client 20.104.206.150:32728] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/defaults.php"] [unique_id "aaSn0P-JFLfishX45N_-fwAAARQ"]
[Mon Mar 02 04:55:44.900123 2026] [:error] [pid 31257:tid 31277] [client 20.104.206.150:32752] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/defaults.php"] [unique_id "aaSn0P-JFLfishX45N_-gwAAAQ4"]
[Mon Mar 02 04:55:45.327197 2026] [:error] [pid 28908:tid 28916] [client 20.104.206.150:32732] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/defaults.php"] [unique_id "aaSn0YqJmC8ih_lQQnDRwgAAAMY"]
[Mon Mar 02 04:55:45.747513 2026] [:error] [pid 28794:tid 28860] [client 20.104.206.150:32718] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/defaults.php"] [unique_id "aaSn0aVy2qpaelbUob310gAAAFg"]
[Mon Mar 02 04:55:46.167792 2026] [:error] [pid 31257:tid 31284] [client 20.104.206.150:32743] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/im.php"] [unique_id "aaSn0v-JFLfishX45N_-iwAAARU"]
[Mon Mar 02 04:55:46.579277 2026] [:error] [pid 28793:tid 28809] [client 20.104.206.150:32700] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/im.php"] [unique_id "aaSn0g2_fxBANaHo1f72ZwAAAAI"]
[Mon Mar 02 04:55:47.027876 2026] [:error] [pid 31257:tid 31280] [client 20.104.206.150:32660] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/im.php"] [unique_id "aaSn0_-JFLfishX45N_-kAAAARE"]
[Mon Mar 02 04:55:47.442885 2026] [:error] [pid 31257:tid 31281] [client 20.104.206.150:32695] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/im.php"] [unique_id "aaSn0_-JFLfishX45N_-lgAAARI"]
[Mon Mar 02 04:55:47.856263 2026] [:error] [pid 31257:tid 31279] [client 20.104.206.150:32741] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments-post.php"] [unique_id "aaSn0_-JFLfishX45N_-mgAAARA"]
[Mon Mar 02 04:55:48.288258 2026] [:error] [pid 28795:tid 28874] [client 20.104.206.150:32742] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments-post.php"] [unique_id "aaSn1LROd53wZBkdI_f8GwAAAIs"]
[Mon Mar 02 04:55:48.702987 2026] [:error] [pid 28795:tid 28887] [client 20.104.206.150:32659] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments-post.php"] [unique_id "aaSn1LROd53wZBkdI_f8HAAAAJg"]
[Mon Mar 02 04:55:49.118060 2026] [:error] [pid 28794:tid 28855] [client 20.104.206.150:32721] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-comments-post.php"] [unique_id "aaSn1aVy2qpaelbUob312AAAAFM"]
[Mon Mar 02 04:55:49.543744 2026] [:error] [pid 28793:tid 28814] [client 20.104.206.150:32761] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache-compat.php"] [unique_id "aaSn1Q2_fxBANaHo1f72aQAAAAc"]
[Mon Mar 02 04:55:49.963586 2026] [:error] [pid 31257:tid 31283] [client 20.104.206.150:32713] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache-compat.php"] [unique_id "aaSn1f-JFLfishX45N_-pgAAARQ"]
[Mon Mar 02 04:55:50.381167 2026] [:error] [pid 31257:tid 31280] [client 20.104.206.150:32674] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache-compat.php"] [unique_id "aaSn1v-JFLfishX45N_-rgAAARE"]
[Mon Mar 02 04:55:50.803150 2026] [:error] [pid 28908:tid 28931] [client 20.104.206.150:32739] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache-compat.php"] [unique_id "aaSn1oqJmC8ih_lQQnDRzAAAANU"]
[Mon Mar 02 04:55:51.249680 2026] [:error] [pid 28795:tid 28864] [client 20.104.206.150:32678] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aaSn17ROd53wZBkdI_f8IAAAAIE"]
[Mon Mar 02 04:55:51.677476 2026] [:error] [pid 31257:tid 31264] [client 20.104.206.150:32729] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aaSn1_-JFLfishX45N_-tQAAAQE"]
[Mon Mar 02 04:55:52.089679 2026] [:error] [pid 28908:tid 28928] [client 20.104.206.150:32745] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aaSn2IqJmC8ih_lQQnDR0AAAANI"]
[Mon Mar 02 04:55:52.506642 2026] [:error] [pid 31257:tid 31263] [client 20.104.206.150:32749] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fw.php"] [unique_id "aaSn2P-JFLfishX45N_-ugAAAQA"]
[Mon Mar 02 04:55:52.921602 2026] [:error] [pid 28908:tid 28914] [client 20.104.206.150:32748] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aaSn2IqJmC8ih_lQQnDR1gAAAMQ"]
[Mon Mar 02 04:55:53.337705 2026] [:error] [pid 31257:tid 31286] [client 20.104.206.150:32648] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aaSn2f-JFLfishX45N_-vQAAARc"]
[Mon Mar 02 04:55:53.761761 2026] [:error] [pid 28793:tid 28822] [client 20.104.206.150:32758] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aaSn2Q2_fxBANaHo1f72bAAAAA8"]
[Mon Mar 02 04:55:54.173220 2026] [:error] [pid 28795:tid 28884] [client 20.104.206.150:32655] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/berlin.php"] [unique_id "aaSn2rROd53wZBkdI_f8IwAAAJU"]
[Mon Mar 02 04:55:54.584783 2026] [:error] [pid 31257:tid 31283] [client 20.104.206.150:32590] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaSn2v-JFLfishX45N_-wgAAARQ"]
[Mon Mar 02 04:55:54.996123 2026] [:error] [pid 28795:tid 28883] [client 20.104.206.150:32644] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaSn2rROd53wZBkdI_f8JwAAAJQ"]
[Mon Mar 02 04:55:55.413890 2026] [:error] [pid 31257:tid 31287] [client 20.104.206.150:32653] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaSn2_-JFLfishX45N_-xgAAARg"]
[Mon Mar 02 04:55:55.825201 2026] [:error] [pid 28908:tid 28921] [client 20.104.206.150:32662] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abe.php"] [unique_id "aaSn24qJmC8ih_lQQnDR5gAAAMs"]
[Mon Mar 02 04:55:56.234907 2026] [:error] [pid 31257:tid 31267] [client 20.104.206.150:32643] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/otuz1.php"] [unique_id "aaSn3P-JFLfishX45N_-ygAAAQQ"]
[Mon Mar 02 04:55:56.664833 2026] [:error] [pid 28908:tid 28930] [client 20.104.206.150:32657] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/otuz1.php"] [unique_id "aaSn3IqJmC8ih_lQQnDR7gAAANQ"]
[Mon Mar 02 04:55:57.075770 2026] [:error] [pid 31257:tid 31287] [client 20.104.206.150:32714] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/otuz1.php"] [unique_id "aaSn3f-JFLfishX45N_-0AAAARg"]
[Mon Mar 02 04:55:57.496553 2026] [:error] [pid 31257:tid 31279] [client 20.104.206.150:32649] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/otuz1.php"] [unique_id "aaSn3f-JFLfishX45N_-1gAAARA"]
[Mon Mar 02 04:55:57.914274 2026] [:error] [pid 31257:tid 31284] [client 20.104.206.150:32759] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aaSn3f-JFLfishX45N_-2QAAARU"]
[Mon Mar 02 04:55:58.327985 2026] [:error] [pid 28795:tid 28867] [client 20.104.206.150:32715] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aaSn3rROd53wZBkdI_f8MgAAAIQ"]
[Mon Mar 02 04:55:58.747172 2026] [:error] [pid 28793:tid 28827] [client 20.104.206.150:32694] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aaSn3g2_fxBANaHo1f72cgAAABQ"]
[Mon Mar 02 04:55:59.161099 2026] [:error] [pid 28793:tid 28825] [client 20.104.206.150:32740] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-files.php"] [unique_id "aaSn3w2_fxBANaHo1f72dAAAABI"]
[Mon Mar 02 04:55:59.575401 2026] [:error] [pid 28795:tid 28876] [client 20.104.206.150:32592] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aaSn37ROd53wZBkdI_f8NQAAAI0"]
[Mon Mar 02 04:55:59.998320 2026] [:error] [pid 28908:tid 28921] [client 20.104.206.150:32658] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aaSn34qJmC8ih_lQQnDSCwAAAMs"]
[Mon Mar 02 04:56:00.435348 2026] [:error] [pid 31257:tid 31286] [client 20.104.206.150:32667] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aaSn4P-JFLfishX45N_-5AAAARc"]
[Mon Mar 02 04:56:00.869448 2026] [:error] [pid 31257:tid 31267] [client 20.104.206.150:32757] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aj.php"] [unique_id "aaSn4P-JFLfishX45N_-5gAAAQQ"]
[Mon Mar 02 04:56:01.298400 2026] [:error] [pid 28795:tid 28879] [client 20.104.206.150:32703] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aaSn4bROd53wZBkdI_f8OAAAAJA"]
[Mon Mar 02 04:56:01.712581 2026] [:error] [pid 31257:tid 31268] [client 20.104.206.150:32645] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aaSn4f-JFLfishX45N_-7gAAAQU"]
[Mon Mar 02 04:56:02.131462 2026] [:error] [pid 31257:tid 31286] [client 20.104.206.150:32616] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aaSn4v-JFLfishX45N_-8gAAARc"]
[Mon Mar 02 04:56:02.550446 2026] [:error] [pid 31257:tid 31280] [client 20.104.206.150:32671] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "aaSn4v-JFLfishX45N_-9gAAARE"]
[Mon Mar 02 04:56:02.967661 2026] [:error] [pid 31257:tid 31268] [client 20.104.206.150:32654] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaSn4v-JFLfishX45N_--QAAAQU"]
[Mon Mar 02 04:56:03.378890 2026] [:error] [pid 28908:tid 28924] [client 20.104.206.150:32670] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaSn44qJmC8ih_lQQnDSFgAAAM4"]
[Mon Mar 02 04:56:03.790488 2026] [:error] [pid 31257:tid 31284] [client 20.104.206.150:32724] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaSn4_-JFLfishX45N_-_wAAARU"]
[Mon Mar 02 04:56:04.219201 2026] [:error] [pid 31257:tid 31266] [client 20.104.206.150:32697] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cache.php"] [unique_id "aaSn5P-JFLfishX45N__BAAAAQM"]
[Mon Mar 02 04:56:04.631062 2026] [:error] [pid 31257:tid 31278] [client 20.104.206.150:32765] [client 20.104.206.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "aaSn5P-JFLfishX45N__CQAAAQ8"]
[Mon Mar 02 04:56:05.048500 2026] [:error] [pid 28795:tid 28863] [client 20.104.206.150:32579] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "aaSn5bROd53wZBkdI_f8OgAAAIA"]
[Mon Mar 02 04:56:05.466942 2026] [:error] [pid 28795:tid 28864] [client 20.104.206.150:32688] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "aaSn5bROd53wZBkdI_f8PQAAAIE"]
[Mon Mar 02 04:56:05.888166 2026] [:error] [pid 28908:tid 28925] [client 20.104.206.150:32656] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "aaSn5YqJmC8ih_lQQnDSGAAAAM8"]
[Mon Mar 02 04:56:06.299685 2026] [:error] [pid 31257:tid 31274] [client 20.104.206.150:32665] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "aaSn5v-JFLfishX45N__FgAAAQs"]
[Mon Mar 02 04:56:06.718976 2026] [:error] [pid 31257:tid 31287] [client 20.104.206.150:32722] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aaSn5v-JFLfishX45N__GAAAARg"]
[Mon Mar 02 04:56:07.133019 2026] [:error] [pid 31257:tid 31264] [client 20.104.206.150:32646] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aaSn5_-JFLfishX45N__HgAAAQE"]
[Mon Mar 02 04:56:07.544733 2026] [:error] [pid 31257:tid 31277] [client 20.104.206.150:32699] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aaSn5_-JFLfishX45N__IgAAAQ4"]
[Mon Mar 02 04:56:07.956344 2026] [:error] [pid 28795:tid 28868] [client 20.104.206.150:32764] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blog.php"] [unique_id "aaSn57ROd53wZBkdI_f8PgAAAIU"]
[Mon Mar 02 04:56:08.376410 2026] [:error] [pid 31257:tid 31263] [client 20.104.206.150:32636] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php7"] [unique_id "aaSn6P-JFLfishX45N__JwAAAQA"]
[Mon Mar 02 04:56:08.790608 2026] [:error] [pid 31257:tid 31264] [client 20.104.206.150:32705] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php7"] [unique_id "aaSn6P-JFLfishX45N__KAAAAQE"]
[Mon Mar 02 04:56:09.199011 2026] [:error] [pid 31257:tid 31277] [client 20.104.206.150:32751] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php7"] [unique_id "aaSn6f-JFLfishX45N__LQAAAQ4"]
[Mon Mar 02 04:56:09.614102 2026] [:error] [pid 31257:tid 31263] [client 20.104.206.150:32720] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfanew.php7"] [unique_id "aaSn6f-JFLfishX45N__MQAAAQA"]
[Mon Mar 02 04:56:10.030190 2026] [:error] [pid 28795:tid 28871] [client 20.104.206.150:32710] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aaSn6rROd53wZBkdI_f8QgAAAIg"]
[Mon Mar 02 04:56:10.444328 2026] [:error] [pid 31257:tid 31275] [client 20.104.206.150:32675] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aaSn6v-JFLfishX45N__OgAAAQw"]
[Mon Mar 02 04:56:10.869207 2026] [:error] [pid 28908:tid 28914] [client 20.104.206.150:32716] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aaSn6oqJmC8ih_lQQnDSGQAAAMQ"]
[Mon Mar 02 04:56:11.282465 2026] [:error] [pid 31257:tid 31271] [client 20.104.206.150:32603] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lufix.php"] [unique_id "aaSn6_-JFLfishX45N__QgAAAQg"]
[Mon Mar 02 04:56:11.696744 2026] [:error] [pid 31257:tid 31277] [client 20.104.206.150:32750] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax-actions.php"] [unique_id "aaSn6_-JFLfishX45N__RgAAAQ4"]
[Mon Mar 02 04:56:12.113405 2026] [:error] [pid 28793:tid 28813] [client 20.104.206.150:32730] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax-actions.php"] [unique_id "aaSn7A2_fxBANaHo1f72ewAAAAY"]
[Mon Mar 02 04:56:12.532225 2026] [:error] [pid 28795:tid 28873] [client 20.104.206.150:32642] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax-actions.php"] [unique_id "aaSn7LROd53wZBkdI_f8RAAAAIo"]
[Mon Mar 02 04:56:12.947784 2026] [:error] [pid 28795:tid 28887] [client 20.104.206.150:32686] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax-actions.php"] [unique_id "aaSn7LROd53wZBkdI_f8RQAAAJg"]
[Mon Mar 02 04:56:13.361276 2026] [:error] [pid 31257:tid 31286] [client 20.104.206.150:32676] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aaSn7f-JFLfishX45N__TwAAARc"]
[Mon Mar 02 04:56:13.786343 2026] [:error] [pid 31257:tid 31282] [client 20.104.206.150:32704] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aaSn7f-JFLfishX45N__VAAAARM"]
[Mon Mar 02 04:56:14.207896 2026] [:error] [pid 31257:tid 31285] [client 20.104.206.150:32534] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aaSn7v-JFLfishX45N__WgAAARY"]
[Mon Mar 02 04:56:14.623805 2026] [:error] [pid 31257:tid 31281] [client 20.104.206.150:32706] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex.php7"] [unique_id "aaSn7v-JFLfishX45N__XAAAARI"]
[Mon Mar 02 04:56:15.044732 2026] [:error] [pid 28908:tid 28915] [client 20.104.206.150:32619] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aaSn74qJmC8ih_lQQnDSHQAAAMU"]
[Mon Mar 02 04:56:15.470057 2026] [:error] [pid 28908:tid 28920] [client 20.104.206.150:32611] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aaSn74qJmC8ih_lQQnDSIgAAAMo"]
[Mon Mar 02 04:56:15.882267 2026] [:error] [pid 28908:tid 28917] [client 20.104.206.150:32651] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aaSn74qJmC8ih_lQQnDSKwAAAMc"]
[Mon Mar 02 04:56:16.299151 2026] [:error] [pid 28795:tid 28882] [client 20.104.206.150:32581] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc.php"] [unique_id "aaSn8LROd53wZBkdI_f8RwAAAJM"]
[Mon Mar 02 04:56:16.709760 2026] [:error] [pid 28908:tid 28924] [client 20.104.206.150:32585] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaSn8IqJmC8ih_lQQnDSMwAAAM4"]
[Mon Mar 02 04:56:17.128446 2026] [:error] [pid 28795:tid 28875] [client 20.104.206.150:32754] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaSn8bROd53wZBkdI_f8SwAAAIw"]
[Mon Mar 02 04:56:17.540583 2026] [:error] [pid 28794:tid 28852] [client 20.104.206.150:32613] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaSn8aVy2qpaelbUob31-wAAAFA"]
[Mon Mar 02 04:56:17.958043 2026] [:error] [pid 28908:tid 28910] [client 20.104.206.150:32673] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "aaSn8YqJmC8ih_lQQnDSQAAAAMA"]
[Mon Mar 02 04:56:18.374259 2026] [:error] [pid 31257:tid 31278] [client 20.104.206.150:32635] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "aaSn8v-JFLfishX45N__aQAAAQ8"]
[Mon Mar 02 04:56:18.790508 2026] [:error] [pid 31257:tid 31275] [client 20.104.206.150:32587] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "aaSn8v-JFLfishX45N__bgAAAQw"]
[Mon Mar 02 04:56:19.203671 2026] [:error] [pid 31257:tid 31273] [client 20.104.206.150:32610] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "aaSn8_-JFLfishX45N__cwAAAQo"]
[Mon Mar 02 04:56:19.631623 2026] [:error] [pid 28794:tid 28854] [client 20.104.206.150:32578] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "aaSn86Vy2qpaelbUob31_gAAAFI"]
[Mon Mar 02 04:56:20.040420 2026] [:error] [pid 28908:tid 28924] [client 20.104.206.150:32641] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aaSn9IqJmC8ih_lQQnDSQgAAAM4"]
[Mon Mar 02 04:56:20.454601 2026] [:error] [pid 28795:tid 28868] [client 20.104.206.150:32652] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aaSn9LROd53wZBkdI_f8TAAAAIU"]
[Mon Mar 02 04:56:20.869181 2026] [:error] [pid 28793:tid 28827] [client 20.104.206.150:32736] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aaSn9A2_fxBANaHo1f72gQAAABQ"]
[Mon Mar 02 04:56:21.291636 2026] [:error] [pid 31257:tid 31286] [client 20.104.206.150:32696] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/license.php"] [unique_id "aaSn9f-JFLfishX45N__fQAAARc"]
[Mon Mar 02 04:56:21.707316 2026] [:error] [pid 31257:tid 31273] [client 20.104.206.150:32755] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aaSn9f-JFLfishX45N__fwAAAQo"]
[Mon Mar 02 04:56:22.123937 2026] [:error] [pid 31257:tid 31284] [client 20.104.206.150:32733] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aaSn9v-JFLfishX45N__gwAAARU"]
[Mon Mar 02 04:56:22.544745 2026] [:error] [pid 28793:tid 28821] [client 20.104.206.150:32618] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aaSn9g2_fxBANaHo1f72ggAAAA4"]
[Mon Mar 02 04:56:22.965191 2026] [:error] [pid 31257:tid 31275] [client 20.104.206.150:32726] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/contact.php"] [unique_id "aaSn9v-JFLfishX45N__igAAAQw"]
[Mon Mar 02 04:56:23.382038 2026] [:error] [pid 28795:tid 28872] [client 20.104.206.150:32576] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aaSn97ROd53wZBkdI_f8UAAAAIk"]
[Mon Mar 02 04:56:23.813405 2026] [:error] [pid 28794:tid 28857] [client 20.104.206.150:32598] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aaSn96Vy2qpaelbUob32BQAAAFU"]
[Mon Mar 02 04:56:24.225579 2026] [:error] [pid 28908:tid 28929] [client 20.104.206.150:32727] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aaSn-IqJmC8ih_lQQnDSUAAAANM"]
[Mon Mar 02 04:56:24.646170 2026] [:error] [pid 28908:tid 28919] [client 20.104.206.150:32672] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/minik.php"] [unique_id "aaSn-IqJmC8ih_lQQnDSUwAAAMk"]
[Mon Mar 02 04:56:25.061460 2026] [:error] [pid 28908:tid 28925] [client 20.104.206.150:32685] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/st.php"] [unique_id "aaSn-YqJmC8ih_lQQnDSVQAAAM8"]
[Mon Mar 02 04:56:25.475490 2026] [:error] [pid 28794:tid 28850] [client 20.104.206.150:32530] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/st.php"] [unique_id "aaSn-aVy2qpaelbUob32CgAAAE4"]
[Mon Mar 02 04:56:25.890690 2026] [:error] [pid 28794:tid 28847] [client 20.104.206.150:32624] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/st.php"] [unique_id "aaSn-aVy2qpaelbUob32DAAAAEs"]
[Mon Mar 02 04:56:26.314089 2026] [:error] [pid 28908:tid 28933] [client 20.104.206.150:32588] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/st.php"] [unique_id "aaSn-oqJmC8ih_lQQnDSWQAAANc"]
[Mon Mar 02 04:56:26.731680 2026] [:error] [pid 28908:tid 28926] [client 20.104.206.150:32559] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upgrade.php"] [unique_id "aaSn-oqJmC8ih_lQQnDSXQAAANA"]
[Mon Mar 02 04:56:27.140724 2026] [:error] [pid 28908:tid 28910] [client 20.104.206.150:32663] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upgrade.php"] [unique_id "aaSn-4qJmC8ih_lQQnDSYgAAAMA"]
[Mon Mar 02 04:56:27.551632 2026] [:error] [pid 28908:tid 28934] [client 20.104.206.150:32584] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upgrade.php"] [unique_id "aaSn-4qJmC8ih_lQQnDSZgAAANg"]
[Mon Mar 02 04:56:27.974363 2026] [:error] [pid 28793:tid 28822] [client 20.104.206.150:32698] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upgrade.php"] [unique_id "aaSn-w2_fxBANaHo1f72jQAAAA8"]
[Mon Mar 02 05:10:03.064234 2026] [:error] [pid 31257:tid 31282] [client 37.211.187.144:61652] [client 37.211.187.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.211.187.144, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaSrK_-JFLfishX45N8NGwAAARM"]
[Mon Mar 02 05:10:03.070254 2026] [:error] [pid 31257:tid 31282] [client 37.211.187.144:61652] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 02 05:31:28.766212 2026] [:error] [pid 28795:tid 28863] [client 20.104.97.185:9712] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 02 05:31:28.974869 2026] [:error] [pid 28795:tid 28865] [client 20.104.97.185:9712] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 02 05:31:29.408520 2026] [:error] [pid 28795:tid 28885] [client 20.104.97.185:9712] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 02 05:31:29.618500 2026] [:error] [pid 28795:tid 28874] [client 20.104.97.185:9712] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 02 05:31:30.041793 2026] [:error] [pid 28795:tid 28878] [client 20.104.97.185:9712] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Mar 02 05:31:30.251916 2026] [:error] [pid 28795:tid 28880] [client 20.104.97.185:9712] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Mar 02 05:31:30.460927 2026] [:error] [pid 28795:tid 28883] [client 20.104.97.185:9712] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Mar 02 05:31:30.875075 2026] [:error] [pid 28795:tid 28885] [client 20.104.97.185:9712] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSwMrROd53wZBkdI_cSugAAAJY"]
[Mon Mar 02 05:31:31.711253 2026] [:error] [pid 31257:tid 31271] [client 20.104.97.185:9676] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSwM_-JFLfishX45N8ligAAAQg"]
[Mon Mar 02 05:31:32.554237 2026] [:error] [pid 28908:tid 28929] [client 20.104.97.185:9665] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSwNIqJmC8ih_lQQnDtNQAAANM"]
[Mon Mar 02 05:31:33.392718 2026] [:error] [pid 28795:tid 28884] [client 20.104.97.185:9711] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaSwNbROd53wZBkdI_cSwAAAAJU"]
[Mon Mar 02 06:48:35.691427 2026] [:error] [pid 28795:tid 28883] [client 62.60.131.156:19273] [client 62.60.131.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.60.131.156, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaTCQ7ROd53wZBkdI_dF2QAAAJQ"]
[Mon Mar 02 06:48:35.694027 2026] [:error] [pid 28795:tid 28883] [client 62.60.131.156:19273] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 02 06:48:38.391538 2026] [:error] [pid 28795:tid 28864] [client 62.60.131.156:19273] [client 62.60.131.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaTCRrROd53wZBkdI_dF7gAAAIE"]
[Mon Mar 02 06:48:38.876036 2026] [:error] [pid 31257:tid 31269] [client 62.60.131.156:21403] [client 62.60.131.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaTCRv-JFLfishX45N9vWQAAAQY"]
[Mon Mar 02 06:48:39.362446 2026] [:error] [pid 28795:tid 28880] [client 62.60.131.156:21637] [client 62.60.131.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaTCR7ROd53wZBkdI_dF8gAAAJE"]
[Mon Mar 02 09:40:21.536083 2026] [:error] [pid 28795:tid 28875] [client 195.178.110.157:34282] [client 195.178.110.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aaTqhbROd53wZBkdI_eayQAAAIw"]
[Mon Mar 02 10:03:38.017795 2026] [:error] [pid 23872:tid 23889] [client 134.149.59.124:2075] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 10:03:38.301226 2026] [:error] [pid 23872:tid 23876] [client 134.149.59.124:2075] [client 134.149.59.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaTv-kzkQFuA2qBk8UOR-QAAAYE"]
[Mon Mar 02 10:03:38.865448 2026] [:error] [pid 28908:tid 28918] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Mon Mar 02 10:03:39.136933 2026] [:error] [pid 28908:tid 28934] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Mon Mar 02 10:03:39.407483 2026] [:error] [pid 28908:tid 28920] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/as1337.php
[Mon Mar 02 10:03:39.677221 2026] [:error] [pid 28908:tid 28929] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Mon Mar 02 10:03:39.946896 2026] [:error] [pid 28908:tid 28912] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/wolf-shell.php
[Mon Mar 02 10:03:40.216130 2026] [:error] [pid 28908:tid 28933] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Mon Mar 02 10:03:40.486118 2026] [:error] [pid 28908:tid 28913] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/zeal.php
[Mon Mar 02 10:03:40.757812 2026] [:error] [pid 28908:tid 28925] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Mon Mar 02 10:03:41.029968 2026] [:error] [pid 28908:tid 28927] [client 134.149.59.124:3896] File does not exist: /usr/local/apache/htdocs/suspended-page/sa.php
[Mon Mar 02 10:04:51.581899 2026] [:error] [pid 31257:tid 31273] [client 40.69.66.178:5515] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 10:04:51.831091 2026] [:error] [pid 31257:tid 31264] [client 40.69.66.178:5515] [client 40.69.66.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaTwQ_-JFLfishX45N8XnwAAAQE"]
[Mon Mar 02 10:04:52.336293 2026] [:error] [pid 28793:tid 28821] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Mon Mar 02 10:04:52.841628 2026] [:error] [pid 28793:tid 28813] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 10:04:53.094611 2026] [:error] [pid 28793:tid 28824] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 10:04:53.347459 2026] [:error] [pid 28793:tid 28820] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Mon Mar 02 10:04:53.600060 2026] [:error] [pid 28793:tid 28831] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Mon Mar 02 10:04:53.852904 2026] [:error] [pid 28793:tid 28829] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Mon Mar 02 10:04:54.106099 2026] [:error] [pid 28793:tid 28823] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Mon Mar 02 10:04:54.361345 2026] [:error] [pid 28793:tid 28810] [client 40.69.66.178:13068] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Mon Mar 02 10:04:54.610661 2026] [:error] [pid 28793:tid 28827] [client 40.69.66.178:13068] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaTwRg2_fxBANaHo1f5O_gAAABQ"]
[Mon Mar 02 10:04:55.127310 2026] [:error] [pid 28908:tid 28931] [client 40.69.66.178:14321] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaTwR4qJmC8ih_lQQnD3LgAAANU"]
[Mon Mar 02 10:04:55.655351 2026] [:error] [pid 28795:tid 28887] [client 40.69.66.178:16312] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaTwR7ROd53wZBkdI_ehJwAAAJg"]
[Mon Mar 02 10:04:56.186082 2026] [:error] [pid 23872:tid 23897] [client 40.69.66.178:4747] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaTwSEzkQFuA2qBk8UOS9QAAAZY"]
[Mon Mar 02 10:04:56.684008 2026] [:error] [pid 31257:tid 31264] [client 40.69.66.178:2766] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaTwSP-JFLfishX45N8XrgAAAQE"]
[Mon Mar 02 10:04:57.181982 2026] [:error] [pid 23872:tid 23887] [client 40.69.66.178:5607] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaTwSUzkQFuA2qBk8UOS_wAAAYw"]
[Mon Mar 02 10:04:57.730663 2026] [:error] [pid 28793:tid 28808] [client 40.69.66.178:3627] [client 40.69.66.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaTwSQ2_fxBANaHo1f5O_wAAAAE"]
[Mon Mar 02 10:28:24.419883 2026] [:error] [pid 31257:tid 31285] [client 37.77.150.123:51842] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.77.150.123, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaT1yP-JFLfishX45N8opQAAARY"], referer: https://aoswa.com.au/wp-login.php
[Mon Mar 02 10:28:24.424271 2026] [:error] [pid 31257:tid 31285] [client 37.77.150.123:51842] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://aoswa.com.au/wp-login.php
[Mon Mar 02 10:28:29.035171 2026] [:error] [pid 28908:tid 28920] [client 37.77.150.123:52957] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.77.150.123, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaT1zIqJmC8ih_lQQnAA3gAAAMo"], referer: https://aoswa.com.au/xmlrpc.php
[Mon Mar 02 10:28:29.038777 2026] [:error] [pid 28908:tid 28920] [client 37.77.150.123:52957] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://aoswa.com.au/xmlrpc.php
[Mon Mar 02 10:46:00.693526 2026] [:error] [pid 21575:tid 21585] [client 20.104.19.195:7910] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Mon Mar 02 10:46:01.158921 2026] [:error] [pid 21575:tid 21588] [client 20.104.19.195:7910] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz1.php
[Mon Mar 02 10:46:01.368232 2026] [:error] [pid 21575:tid 21590] [client 20.104.19.195:7910] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php
[Mon Mar 02 10:46:01.581930 2026] [:error] [pid 21575:tid 21601] [client 20.104.19.195:7910] File does not exist: /usr/local/apache/htdocs/suspended-page/f.php
[Mon Mar 02 10:46:01.788705 2026] [:error] [pid 21575:tid 21596] [client 20.104.19.195:7910] [client 20.104.19.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aaT56SrocdArcJqFfIm56AAAAVE"]
[Mon Mar 02 10:46:04.226047 2026] [:error] [pid 28795:tid 28865] [client 20.104.19.195:4499] File does not exist: /usr/local/apache/htdocs/suspended-page/home.php
[Mon Mar 02 10:46:04.685574 2026] [:error] [pid 28795:tid 28865] [client 20.104.19.195:4499] File does not exist: /usr/local/apache/htdocs/suspended-page/dialog.php
[Mon Mar 02 10:46:04.903100 2026] [:error] [pid 28795:tid 28883] [client 20.104.19.195:4499] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwso.php
[Mon Mar 02 10:46:05.116333 2026] [:error] [pid 28795:tid 28882] [client 20.104.19.195:4499] File does not exist: /usr/local/apache/htdocs/suspended-page/smaxx.php
[Mon Mar 02 10:46:05.338342 2026] [:error] [pid 28795:tid 28873] [client 20.104.19.195:4499] File does not exist: /usr/local/apache/htdocs/suspended-page/block-support.php
[Mon Mar 02 10:46:05.551000 2026] [:error] [pid 28795:tid 28866] [client 20.104.19.195:4499] File does not exist: /usr/local/apache/htdocs/suspended-page/Mhbgf.php
[Mon Mar 02 10:46:05.763497 2026] [:error] [pid 28795:tid 28886] [client 20.104.19.195:4499] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Xleet.php"] [unique_id "aaT57bROd53wZBkdI_es7gAAAJc"]
[Mon Mar 02 10:46:09.536869 2026] [:error] [pid 28908:tid 28920] [client 20.104.19.195:10115] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Xleet.php"] [unique_id "aaT58YqJmC8ih_lQQnAIHgAAAMo"]
[Mon Mar 02 10:46:30.844080 2026] [:error] [pid 23872:tid 23893] [client 20.104.19.195:11693] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fosil.php"] [unique_id "aaT6BkzkQFuA2qBk8UPAkQAAAZI"]
[Mon Mar 02 10:46:33.011157 2026] [:error] [pid 28794:tid 28853] [client 20.104.19.195:14143] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fosil.php"] [unique_id "aaT6CaVy2qpaelbUob12bAAAAFE"]
[Mon Mar 02 10:46:34.792823 2026] [:error] [pid 28794:tid 28850] [client 20.104.19.195:12329] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fosil.php"] [unique_id "aaT6CqVy2qpaelbUob12bwAAAE4"]
[Mon Mar 02 10:46:37.852240 2026] [:error] [pid 31257:tid 31264] [client 20.104.19.195:11696] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fosil.php"] [unique_id "aaT6Df-JFLfishX45N817gAAAQE"]
[Mon Mar 02 10:46:39.402983 2026] [:error] [pid 28794:tid 28856] [client 20.104.19.195:8513] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/issue.php"] [unique_id "aaT6D6Vy2qpaelbUob12dwAAAFQ"]
[Mon Mar 02 10:46:44.938587 2026] [:error] [pid 23872:tid 23878] [client 20.104.19.195:8976] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/issue.php"] [unique_id "aaT6FEzkQFuA2qBk8UPA0QAAAYM"]
[Mon Mar 02 10:46:47.556376 2026] [:error] [pid 23872:tid 23885] [client 20.104.19.195:8985] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/issue.php"] [unique_id "aaT6F0zkQFuA2qBk8UPA6gAAAYo"]
[Mon Mar 02 10:46:48.622455 2026] [:error] [pid 28908:tid 28929] [client 20.104.19.195:12430] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/issue.php"] [unique_id "aaT6GIqJmC8ih_lQQnAIVgAAANM"]
[Mon Mar 02 10:46:49.601831 2026] [:error] [pid 31257:tid 31285] [client 20.104.19.195:15389] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/verify.php"] [unique_id "aaT6Gf-JFLfishX45N82HAAAARY"]
[Mon Mar 02 10:46:50.983332 2026] [:error] [pid 28793:tid 28812] [client 20.104.19.195:51962] [client 20.104.19.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/verify.php"] [unique_id "aaT6Gg2_fxBANaHo1f5WhAAAAAU"]
[Mon Mar 02 10:48:24.640922 2026] [:error] [pid 23872:tid 23895] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php.php
[Mon Mar 02 10:48:24.866477 2026] [:error] [pid 23872:tid 23888] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Mon Mar 02 10:48:25.093072 2026] [:error] [pid 23872:tid 23891] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex1.php
[Mon Mar 02 10:48:25.312723 2026] [:error] [pid 23872:tid 23875] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Mon Mar 02 10:48:25.529740 2026] [:error] [pid 23872:tid 23886] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/configs.php
[Mon Mar 02 10:48:25.747276 2026] [:error] [pid 23872:tid 23878] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa1.php
[Mon Mar 02 10:48:25.974882 2026] [:error] [pid 23872:tid 23887] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/abouts.php
[Mon Mar 02 10:48:26.194603 2026] [:error] [pid 23872:tid 23895] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cache.php
[Mon Mar 02 10:48:26.412321 2026] [:error] [pid 23872:tid 23888] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Mon Mar 02 10:48:26.682257 2026] [:error] [pid 23872:tid 23891] [client 20.104.19.195:5194] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Mon Mar 02 10:59:43.452881 2026] [:error] [pid 23872:tid 23896] [client 20.63.41.168:26521] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 10:59:43.668313 2026] [:error] [pid 23872:tid 23889] [client 20.63.41.168:26521] [client 20.63.41.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaT9H0zkQFuA2qBk8UPS4wAAAY4"]
[Mon Mar 02 10:59:45.020059 2026] [:error] [pid 21575:tid 21602] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Mon Mar 02 10:59:45.450274 2026] [:error] [pid 21575:tid 21603] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 10:59:45.672262 2026] [:error] [pid 21575:tid 21582] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 10:59:45.888836 2026] [:error] [pid 21575:tid 21584] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Mon Mar 02 10:59:46.113035 2026] [:error] [pid 21575:tid 21585] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Mon Mar 02 10:59:46.332377 2026] [:error] [pid 21575:tid 21593] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Mon Mar 02 10:59:46.548767 2026] [:error] [pid 21575:tid 21597] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Mon Mar 02 10:59:46.765907 2026] [:error] [pid 21575:tid 21600] [client 20.63.41.168:26485] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Mon Mar 02 10:59:46.978766 2026] [:error] [pid 21575:tid 21583] [client 20.63.41.168:26485] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaT9IirocdArcJqFfInC-wAAAUQ"]
[Mon Mar 02 10:59:49.124733 2026] [:error] [pid 21575:tid 21586] [client 20.63.41.168:26564] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaT9JSrocdArcJqFfInDAQAAAUc"]
[Mon Mar 02 10:59:50.194900 2026] [:error] [pid 23872:tid 23884] [client 20.63.41.168:26425] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaT9JkzkQFuA2qBk8UPTAgAAAYk"]
[Mon Mar 02 10:59:50.986720 2026] [:error] [pid 21575:tid 21580] [client 20.63.41.168:26560] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaT9JirocdArcJqFfInDBgAAAUE"]
[Mon Mar 02 10:59:53.665689 2026] [:error] [pid 31257:tid 31275] [client 20.63.41.168:26405] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaT9Kf-JFLfishX45N9DjwAAAQw"]
[Mon Mar 02 10:59:54.432351 2026] [:error] [pid 31257:tid 31265] [client 20.63.41.168:26417] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaT9Kv-JFLfishX45N9DlgAAAQI"]
[Mon Mar 02 11:00:05.167402 2026] [:error] [pid 31257:tid 31264] [client 20.63.41.168:26428] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaT9Nf-JFLfishX45N9DywAAAQE"]
[Mon Mar 02 11:00:06.060878 2026] [:error] [pid 28794:tid 28838] [client 20.63.41.168:26403] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaT9NqVy2qpaelbUob15lwAAAEI"]
[Mon Mar 02 11:00:06.758613 2026] [:error] [pid 31257:tid 31277] [client 20.63.41.168:26489] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaT9Nv-JFLfishX45N9D2QAAAQ4"]
[Mon Mar 02 11:00:07.394933 2026] [:error] [pid 23872:tid 23879] [client 20.63.41.168:26429] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaT9N0zkQFuA2qBk8UPTXwAAAYQ"]
[Mon Mar 02 11:00:08.437105 2026] [:error] [pid 23872:tid 23877] [client 20.63.41.168:26406] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaT9OEzkQFuA2qBk8UPTagAAAYI"]
[Mon Mar 02 11:00:09.150913 2026] [:error] [pid 23872:tid 23878] [client 20.63.41.168:26578] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaT9OUzkQFuA2qBk8UPTdQAAAYM"]
[Mon Mar 02 11:00:10.269190 2026] [:error] [pid 23872:tid 23884] [client 20.63.41.168:26623] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaT9OkzkQFuA2qBk8UPThAAAAYk"]
[Mon Mar 02 11:00:11.973737 2026] [:error] [pid 23872:tid 23875] [client 20.63.41.168:26484] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaT9O0zkQFuA2qBk8UPTkgAAAYA"]
[Mon Mar 02 11:00:12.776790 2026] [:error] [pid 28795:tid 28868] [client 20.63.41.168:26431] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaT9PLROd53wZBkdI_exVAAAAIU"]
[Mon Mar 02 11:00:13.365303 2026] [:error] [pid 28794:tid 28841] [client 20.63.41.168:26486] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaT9PaVy2qpaelbUob15nwAAAEU"]
[Mon Mar 02 11:00:14.445639 2026] [:error] [pid 28795:tid 28869] [client 20.63.41.168:26456] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaT9PrROd53wZBkdI_exWAAAAIY"]
[Mon Mar 02 11:00:15.094534 2026] [:error] [pid 23872:tid 23886] [client 20.63.41.168:26552] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaT9P0zkQFuA2qBk8UPTmgAAAYs"]
[Mon Mar 02 11:00:15.804956 2026] [:error] [pid 23872:tid 23884] [client 20.63.41.168:26320] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaT9P0zkQFuA2qBk8UPTnwAAAYk"]
[Mon Mar 02 11:00:17.293894 2026] [:error] [pid 23872:tid 23889] [client 20.63.41.168:26309] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaT9QUzkQFuA2qBk8UPTqQAAAY4"]
[Mon Mar 02 11:00:18.190302 2026] [:error] [pid 31257:tid 31265] [client 20.63.41.168:26380] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaT9Qv-JFLfishX45N9D6QAAAQI"]
[Mon Mar 02 11:00:18.687817 2026] [:error] [pid 23872:tid 23886] [client 20.63.41.168:26314] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaT9QkzkQFuA2qBk8UPTsQAAAYs"]
[Mon Mar 02 11:00:19.324161 2026] [:error] [pid 23872:tid 23893] [client 20.63.41.168:26396] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaT9Q0zkQFuA2qBk8UPTtQAAAZI"]
[Mon Mar 02 11:00:19.790511 2026] [:error] [pid 28795:tid 28867] [client 20.63.41.168:26312] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaT9Q7ROd53wZBkdI_exYgAAAIQ"]
[Mon Mar 02 11:00:20.533252 2026] [:error] [pid 28795:tid 28885] [client 20.63.41.168:26444] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaT9RLROd53wZBkdI_exYwAAAJY"]
[Mon Mar 02 11:00:21.037147 2026] [:error] [pid 31257:tid 31273] [client 20.63.41.168:26430] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaT9Rf-JFLfishX45N9D9QAAAQo"]
[Mon Mar 02 11:00:21.621487 2026] [:error] [pid 28795:tid 28870] [client 20.63.41.168:26387] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaT9RbROd53wZBkdI_exZQAAAIc"]
[Mon Mar 02 11:00:22.595052 2026] [:error] [pid 28794:tid 28837] [client 20.63.41.168:26419] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaT9RqVy2qpaelbUob15pwAAAEE"]
[Mon Mar 02 12:00:27.422910 2026] [:error] [pid 28908:tid 28923] [client 146.190.117.220:60398] [client 146.190.117.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.190.117.220, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-login.php"] [unique_id "aaULW4qJmC8ih_lQQnBL3AAAAM0"]
[Mon Mar 02 12:00:27.426353 2026] [:error] [pid 28908:tid 28923] [client 146.190.117.220:60398] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 02 21:45:56.182741 2026] [:error] [pid 59734:tid 59745] [client 20.151.217.152:33507] [client 20.151.217.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaWUlJeWQx7ZQG9NybExxAAAAUk"]
[Mon Mar 02 21:45:56.183162 2026] [:error] [pid 59602:tid 59684] [client 20.151.217.152:33414] [client 20.151.217.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaWUlDMtSo_Fr0lHnSZ4jQAAAJM"]
[Mon Mar 02 21:45:56.598971 2026] [:error] [pid 59602:tid 59674] [client 20.151.217.152:33506] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Mon Mar 02 21:45:56.601761 2026] [:error] [pid 28847:tid 28867] [client 20.151.217.152:33418] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Mon Mar 02 21:45:57.021717 2026] [:error] [pid 59602:tid 59676] [client 20.151.217.152:33506] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 21:45:57.022021 2026] [:error] [pid 28847:tid 28851] [client 20.151.217.152:33418] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 21:45:57.229134 2026] [:error] [pid 59602:tid 59671] [client 20.151.217.152:33506] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 21:45:57.231466 2026] [:error] [pid 28847:tid 28856] [client 20.151.217.152:33418] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 21:45:57.448320 2026] [:error] [pid 59602:tid 59669] [client 20.151.217.152:33506] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 21:45:57.448647 2026] [:error] [pid 28847:tid 28860] [client 20.151.217.152:33418] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 21:45:57.652920 2026] [:error] [pid 59602:tid 59679] [client 20.151.217.152:33506] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUlTMtSo_Fr0lHnSZ4lQAAAI4"]
[Mon Mar 02 21:45:57.656191 2026] [:error] [pid 28847:tid 28864] [client 20.151.217.152:33418] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUlZ9xbBq8VfeqVDZmaAAAAM8"]
[Mon Mar 02 21:45:58.063558 2026] [:error] [pid 28847:tid 28855] [client 20.151.217.152:33472] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUlp9xbBq8VfeqVDZmaQAAAMY"]
[Mon Mar 02 21:45:58.065444 2026] [:error] [pid 59600:tid 59631] [client 20.151.217.152:33422] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUloQ5lE4yocV9IBdyJQAAABY"]
[Mon Mar 02 21:45:58.473843 2026] [:error] [pid 28847:tid 28857] [client 20.151.217.152:33526] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUlp9xbBq8VfeqVDZmagAAAMg"]
[Mon Mar 02 21:45:58.474210 2026] [:error] [pid 28847:tid 28850] [client 20.151.217.152:33527] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUlp9xbBq8VfeqVDZmawAAAME"]
[Mon Mar 02 21:45:58.885810 2026] [:error] [pid 28847:tid 28871] [client 20.151.217.152:33497] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUlp9xbBq8VfeqVDZmbAAAANY"]
[Mon Mar 02 21:45:58.889278 2026] [:error] [pid 28847:tid 28849] [client 20.151.217.152:33489] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpo.php"] [unique_id "aaWUlp9xbBq8VfeqVDZmbQAAAMA"]
[Mon Mar 02 21:45:59.303610 2026] [:error] [pid 28847:tid 28867] [client 20.151.217.152:33478] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUl59xbBq8VfeqVDZmcAAAANI"]
[Mon Mar 02 21:45:59.305010 2026] [:error] [pid 59701:tid 59709] [client 20.151.217.152:33503] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUl-UmTDVso96U9_LfWQAAAQU"]
[Mon Mar 02 21:45:59.720338 2026] [:error] [pid 28847:tid 28856] [client 20.151.217.152:33504] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUl59xbBq8VfeqVDZmcgAAAMc"]
[Mon Mar 02 21:45:59.720360 2026] [:error] [pid 28847:tid 28851] [client 20.151.217.152:33520] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUl59xbBq8VfeqVDZmcwAAAMI"]
[Mon Mar 02 21:46:00.131881 2026] [:error] [pid 59701:tid 59711] [client 20.151.217.152:33488] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUmOUmTDVso96U9_LfWwAAAQc"]
[Mon Mar 02 21:46:00.137713 2026] [:error] [pid 59701:tid 59728] [client 20.151.217.152:33368] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUmOUmTDVso96U9_LfXAAAARg"]
[Mon Mar 02 21:46:00.553659 2026] [:error] [pid 28847:tid 28864] [client 20.151.217.152:33481] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUmJ9xbBq8VfeqVDZmdwAAAM8"]
[Mon Mar 02 21:46:00.556271 2026] [:error] [pid 28847:tid 28869] [client 20.151.217.152:33510] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWUmJ9xbBq8VfeqVDZmeAAAANQ"]
[Mon Mar 02 21:46:00.963082 2026] [:error] [pid 59602:tid 59680] [client 20.151.217.152:33502] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmDMtSo_Fr0lHnSZ4mAAAAI8"]
[Mon Mar 02 21:46:00.971344 2026] [:error] [pid 59602:tid 59684] [client 20.151.217.152:33417] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmDMtSo_Fr0lHnSZ4mQAAAJM"]
[Mon Mar 02 21:46:01.372982 2026] [:error] [pid 59701:tid 59714] [client 20.151.217.152:33509] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmeUmTDVso96U9_LfYgAAAQo"]
[Mon Mar 02 21:46:01.388592 2026] [:error] [pid 59601:tid 59640] [client 20.151.217.152:33428] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmcQ1lXfvWN0-ZQmYKQAAAEI"]
[Mon Mar 02 21:46:01.789122 2026] [:error] [pid 59601:tid 59652] [client 20.151.217.152:33484] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmcQ1lXfvWN0-ZQmYLAAAAE4"]
[Mon Mar 02 21:46:01.815678 2026] [:error] [pid 59601:tid 59655] [client 20.151.217.152:33409] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmcQ1lXfvWN0-ZQmYLQAAAFE"]
[Mon Mar 02 21:46:02.199031 2026] [:error] [pid 28847:tid 28859] [client 20.151.217.152:33486] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmp9xbBq8VfeqVDZmegAAAMo"]
[Mon Mar 02 21:46:02.225802 2026] [:error] [pid 59600:tid 59611] [client 20.151.217.152:33525] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWUmoQ5lE4yocV9IBdyKQAAAAI"]
[Mon Mar 02 21:46:02.613977 2026] [:error] [pid 59602:tid 59674] [client 20.151.217.152:33500] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUmjMtSo_Fr0lHnSZ4ngAAAIk"]
[Mon Mar 02 21:46:02.639423 2026] [:error] [pid 59602:tid 59665] [client 20.151.217.152:33411] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUmjMtSo_Fr0lHnSZ4nwAAAIA"]
[Mon Mar 02 21:46:03.023381 2026] [:error] [pid 59601:tid 59641] [client 20.151.217.152:33419] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUm8Q1lXfvWN0-ZQmYMAAAAEM"]
[Mon Mar 02 21:46:03.054016 2026] [:error] [pid 59602:tid 59689] [client 20.151.217.152:33505] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUmzMtSo_Fr0lHnSZ4oQAAAJg"]
[Mon Mar 02 21:46:03.433053 2026] [:error] [pid 59701:tid 59711] [client 20.151.217.152:33476] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUm-UmTDVso96U9_LfYwAAAQc"]
[Mon Mar 02 21:46:03.464902 2026] [:error] [pid 59701:tid 59728] [client 20.151.217.152:33495] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUm-UmTDVso96U9_LfZAAAARg"]
[Mon Mar 02 21:46:03.841944 2026] [:error] [pid 59701:tid 59706] [client 20.151.217.152:33494] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUm-UmTDVso96U9_LfZgAAAQI"]
[Mon Mar 02 21:46:03.872338 2026] [:error] [pid 59601:tid 59645] [client 20.151.217.152:33413] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/011i.php"] [unique_id "aaWUm8Q1lXfvWN0-ZQmYMQAAAEc"]
[Mon Mar 02 21:46:04.253208 2026] [:error] [pid 59701:tid 59710] [client 20.151.217.152:33427] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnOUmTDVso96U9_LfagAAAQY"]
[Mon Mar 02 21:46:04.286920 2026] [:error] [pid 59701:tid 59717] [client 20.151.217.152:33529] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnOUmTDVso96U9_LfawAAAQ0"]
[Mon Mar 02 21:46:04.668465 2026] [:error] [pid 59601:tid 59643] [client 20.151.217.152:33485] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnMQ1lXfvWN0-ZQmYMwAAAEU"]
[Mon Mar 02 21:46:04.698097 2026] [:error] [pid 59734:tid 59760] [client 20.151.217.152:33496] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnJeWQx7ZQG9NybEx5wAAAVg"]
[Mon Mar 02 21:46:05.082765 2026] [:error] [pid 59602:tid 59679] [client 20.151.217.152:33508] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnTMtSo_Fr0lHnSZ4owAAAI4"]
[Mon Mar 02 21:46:05.111211 2026] [:error] [pid 59602:tid 59675] [client 20.151.217.152:33426] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnTMtSo_Fr0lHnSZ4pAAAAIo"]
[Mon Mar 02 21:46:05.494997 2026] [:error] [pid 28847:tid 28860] [client 20.151.217.152:33491] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnZ9xbBq8VfeqVDZmfAAAAMs"]
[Mon Mar 02 21:46:05.521441 2026] [:error] [pid 59602:tid 59682] [client 20.151.217.152:33511] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit-tags.php"] [unique_id "aaWUnTMtSo_Fr0lHnSZ4pgAAAJE"]
[Mon Mar 02 21:46:05.905336 2026] [:error] [pid 28847:tid 28872] [client 20.151.217.152:33532] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUnZ9xbBq8VfeqVDZmfQAAANc"]
[Mon Mar 02 21:46:05.932922 2026] [:error] [pid 28847:tid 28864] [client 20.151.217.152:33482] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUnZ9xbBq8VfeqVDZmfgAAAM8"]
[Mon Mar 02 21:46:06.318789 2026] [:error] [pid 28847:tid 28850] [client 20.151.217.152:33437] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUnp9xbBq8VfeqVDZmfwAAAME"]
[Mon Mar 02 21:46:06.347946 2026] [:error] [pid 59602:tid 59688] [client 20.151.217.152:33479] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUnjMtSo_Fr0lHnSZ4qQAAAJc"]
[Mon Mar 02 21:46:06.735450 2026] [:error] [pid 59602:tid 59685] [client 20.151.217.152:33475] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUnjMtSo_Fr0lHnSZ4qgAAAJQ"]
[Mon Mar 02 21:46:06.758012 2026] [:error] [pid 59602:tid 59678] [client 20.151.217.152:33483] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUnjMtSo_Fr0lHnSZ4qwAAAI0"]
[Mon Mar 02 21:46:07.157874 2026] [:error] [pid 59601:tid 59658] [client 20.151.217.152:33522] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUn8Q1lXfvWN0-ZQmYOgAAAFQ"]
[Mon Mar 02 21:46:07.173368 2026] [:error] [pid 59734:tid 59738] [client 20.151.217.152:33424] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWUn5eWQx7ZQG9NybEx8QAAAUI"]
[Mon Mar 02 21:46:07.566928 2026] [:error] [pid 59602:tid 59671] [client 20.151.217.152:33514] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUnzMtSo_Fr0lHnSZ4rgAAAIY"]
[Mon Mar 02 21:46:07.583681 2026] [:error] [pid 59602:tid 59683] [client 20.151.217.152:33501] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUnzMtSo_Fr0lHnSZ4rwAAAJI"]
[Mon Mar 02 21:46:07.974552 2026] [:error] [pid 59701:tid 59704] [client 20.151.217.152:33449] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUn-UmTDVso96U9_LfbwAAAQA"]
[Mon Mar 02 21:46:07.991744 2026] [:error] [pid 59602:tid 59675] [client 20.151.217.152:33480] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUnzMtSo_Fr0lHnSZ4swAAAIo"]
[Mon Mar 02 21:46:08.383446 2026] [:error] [pid 59600:tid 59631] [client 20.151.217.152:33518] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUoIQ5lE4yocV9IBdyLQAAABY"]
[Mon Mar 02 21:46:08.401729 2026] [:error] [pid 59600:tid 59617] [client 20.151.217.152:33447] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUoIQ5lE4yocV9IBdyLgAAAAg"]
[Mon Mar 02 21:46:08.792599 2026] [:error] [pid 59600:tid 59633] [client 20.151.217.152:33524] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUoIQ5lE4yocV9IBdyMgAAABg"]
[Mon Mar 02 21:46:08.813816 2026] [:error] [pid 59600:tid 59616] [client 20.151.217.152:33487] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWUoIQ5lE4yocV9IBdyMwAAAAc"]
[Mon Mar 02 21:46:09.206028 2026] [:error] [pid 59600:tid 59618] [client 20.151.217.152:33436] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUoYQ5lE4yocV9IBdyNQAAAAk"]
[Mon Mar 02 21:46:09.228474 2026] [:error] [pid 59600:tid 59629] [client 20.151.217.152:33493] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUoYQ5lE4yocV9IBdyNgAAABQ"]
[Mon Mar 02 21:46:09.623133 2026] [:error] [pid 59600:tid 59628] [client 20.151.217.152:33429] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUoYQ5lE4yocV9IBdyOQAAABM"]
[Mon Mar 02 21:46:09.639724 2026] [:error] [pid 59701:tid 59722] [client 20.151.217.152:33350] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUoeUmTDVso96U9_LfcQAAARI"]
[Mon Mar 02 21:46:10.039601 2026] [:error] [pid 59600:tid 59624] [client 20.151.217.152:33443] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUooQ5lE4yocV9IBdyPQAAAA8"]
[Mon Mar 02 21:46:10.056576 2026] [:error] [pid 59600:tid 59622] [client 20.151.217.152:33499] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUooQ5lE4yocV9IBdyPgAAAA0"]
[Mon Mar 02 21:46:10.361062 2026] [:error] [pid 59600:tid 59610] [client 20.151.217.152:54979] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUooQ5lE4yocV9IBdyQgAAAAE"]
[Mon Mar 02 21:46:10.361085 2026] [:error] [pid 59600:tid 59616] [client 20.151.217.152:54932] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUooQ5lE4yocV9IBdyQQAAAAc"]
[Mon Mar 02 21:46:10.450335 2026] [:error] [pid 59600:tid 59618] [client 20.151.217.152:33352] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUooQ5lE4yocV9IBdyRQAAAAk"]
[Mon Mar 02 21:46:10.472922 2026] [:error] [pid 59602:tid 59684] [client 20.151.217.152:33444] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWUojMtSo_Fr0lHnSZ4tgAAAJM"]
[Mon Mar 02 21:46:10.772089 2026] [:error] [pid 59600:tid 59626] [client 20.151.217.152:54998] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUooQ5lE4yocV9IBdySAAAABE"]
[Mon Mar 02 21:46:10.775804 2026] [:error] [pid 59600:tid 59619] [client 20.151.217.152:55002] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUooQ5lE4yocV9IBdySQAAAAo"]
[Mon Mar 02 21:46:10.862739 2026] [:error] [pid 59602:tid 59688] [client 20.151.217.152:33534] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUojMtSo_Fr0lHnSZ4twAAAJc"]
[Mon Mar 02 21:46:10.882011 2026] [:error] [pid 59602:tid 59687] [client 20.151.217.152:33438] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUojMtSo_Fr0lHnSZ4uAAAAJY"]
[Mon Mar 02 21:46:11.180885 2026] [:error] [pid 59600:tid 59616] [client 20.151.217.152:54993] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUo4Q5lE4yocV9IBdyTgAAAAc"]
[Mon Mar 02 21:46:11.184408 2026] [:error] [pid 59602:tid 59678] [client 20.151.217.152:54921] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUozMtSo_Fr0lHnSZ4uQAAAI0"]
[Mon Mar 02 21:46:11.272574 2026] [:error] [pid 59602:tid 59674] [client 20.151.217.152:33468] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUozMtSo_Fr0lHnSZ4ugAAAIk"]
[Mon Mar 02 21:46:11.294712 2026] [:error] [pid 59734:tid 59757] [client 20.151.217.152:33423] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUo5eWQx7ZQG9NybEyAAAAAVU"]
[Mon Mar 02 21:46:11.593103 2026] [:error] [pid 28847:tid 28867] [client 20.151.217.152:54984] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUo59xbBq8VfeqVDZmhgAAANI"]
[Mon Mar 02 21:46:11.601046 2026] [:error] [pid 59734:tid 59738] [client 20.151.217.152:54990] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWUo5eWQx7ZQG9NybEyAwAAAUI"]
[Mon Mar 02 21:46:11.682486 2026] [:error] [pid 59701:tid 59720] [client 20.151.217.152:33451] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUo-UmTDVso96U9_LfcwAAARA"]
[Mon Mar 02 21:46:11.705689 2026] [:error] [pid 28847:tid 28858] [client 20.151.217.152:33408] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUo59xbBq8VfeqVDZmhwAAAMk"]
[Mon Mar 02 21:46:12.090353 2026] [:error] [pid 28847:tid 28872] [client 20.151.217.152:33349] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUpJ9xbBq8VfeqVDZmigAAANc"]
[Mon Mar 02 21:46:12.121639 2026] [:error] [pid 59734:tid 59743] [client 20.151.217.152:33455] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWUpJeWQx7ZQG9NybEyBQAAAUc"]
[Mon Mar 02 21:46:12.501196 2026] [:error] [pid 28847:tid 28850] [client 20.151.217.152:33477] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpJ9xbBq8VfeqVDZmjAAAAME"]
[Mon Mar 02 21:46:12.535134 2026] [:error] [pid 28847:tid 28865] [client 20.151.217.152:33516] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpJ9xbBq8VfeqVDZmjQAAANA"]
[Mon Mar 02 21:46:12.920505 2026] [:error] [pid 28847:tid 28857] [client 20.151.217.152:33410] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpJ9xbBq8VfeqVDZmkAAAAMg"]
[Mon Mar 02 21:46:12.946457 2026] [:error] [pid 28847:tid 28849] [client 20.151.217.152:33420] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpJ9xbBq8VfeqVDZmkQAAAMA"]
[Mon Mar 02 21:46:13.338404 2026] [:error] [pid 28847:tid 28870] [client 20.151.217.152:33533] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpZ9xbBq8VfeqVDZmlAAAANU"]
[Mon Mar 02 21:46:13.357426 2026] [:error] [pid 28847:tid 28858] [client 20.151.217.152:33517] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpZ9xbBq8VfeqVDZmlgAAAMk"]
[Mon Mar 02 21:46:13.752466 2026] [:error] [pid 28847:tid 28872] [client 20.151.217.152:33442] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpZ9xbBq8VfeqVDZmmAAAANc"]
[Mon Mar 02 21:46:13.768710 2026] [:error] [pid 28847:tid 28851] [client 20.151.217.152:33535] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWUpZ9xbBq8VfeqVDZmmQAAAMI"]
[Mon Mar 02 21:46:14.171830 2026] [:error] [pid 28847:tid 28850] [client 20.151.217.152:33531] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUpp9xbBq8VfeqVDZmmwAAAME"]
[Mon Mar 02 21:46:14.190931 2026] [:error] [pid 28847:tid 28865] [client 20.151.217.152:33355] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUpp9xbBq8VfeqVDZmnAAAANA"]
[Mon Mar 02 21:46:14.578973 2026] [:error] [pid 59734:tid 59737] [client 20.151.217.152:33513] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUppeWQx7ZQG9NybEyDQAAAUE"]
[Mon Mar 02 21:46:14.605735 2026] [:error] [pid 59602:tid 59677] [client 20.151.217.152:33416] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUpjMtSo_Fr0lHnSZ4vAAAAIw"]
[Mon Mar 02 21:46:14.987239 2026] [:error] [pid 59601:tid 59649] [client 20.151.217.152:33457] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUpsQ1lXfvWN0-ZQmYOwAAAEs"]
[Mon Mar 02 21:46:15.019448 2026] [:error] [pid 59602:tid 59687] [client 20.151.217.152:33421] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUpzMtSo_Fr0lHnSZ4vwAAAJY"]
[Mon Mar 02 21:46:15.396958 2026] [:error] [pid 28847:tid 28863] [client 20.151.217.152:33347] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUp59xbBq8VfeqVDZmoQAAAM4"]
[Mon Mar 02 21:46:15.435943 2026] [:error] [pid 59601:tid 59644] [client 20.151.217.152:33498] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWUp8Q1lXfvWN0-ZQmYPQAAAEY"]
[Mon Mar 02 21:46:15.810404 2026] [:error] [pid 59601:tid 59654] [client 20.151.217.152:33490] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUp8Q1lXfvWN0-ZQmYPgAAAFA"]
[Mon Mar 02 21:46:15.846885 2026] [:error] [pid 59734:tid 59746] [client 20.151.217.152:33432] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUp5eWQx7ZQG9NybEyEwAAAUo"]
[Mon Mar 02 21:46:16.221674 2026] [:error] [pid 59600:tid 59619] [client 20.151.217.152:33370] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUqIQ5lE4yocV9IBdyVwAAAAo"]
[Mon Mar 02 21:46:16.259177 2026] [:error] [pid 59600:tid 59609] [client 20.151.217.152:33348] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUqIQ5lE4yocV9IBdyWAAAAAA"]
[Mon Mar 02 21:46:16.636827 2026] [:error] [pid 28847:tid 28852] [client 20.151.217.152:33446] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUqJ9xbBq8VfeqVDZmogAAAMM"]
[Mon Mar 02 21:46:16.676584 2026] [:error] [pid 59734:tid 59752] [client 20.151.217.152:33412] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUqJeWQx7ZQG9NybEyFgAAAVA"]
[Mon Mar 02 21:46:17.045162 2026] [:error] [pid 59602:tid 59670] [client 20.151.217.152:33466] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUqTMtSo_Fr0lHnSZ4wwAAAIU"]
[Mon Mar 02 21:46:17.094761 2026] [:error] [pid 59602:tid 59681] [client 20.151.217.152:33351] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWUqTMtSo_Fr0lHnSZ4xAAAAJA"]
[Mon Mar 02 21:48:41.785854 2026] [:error] [pid 59600:tid 59616] [client 20.151.217.152:53980] [client 20.151.217.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaWVOYQ5lE4yocV9IBdz0wAAAAc"]
[Mon Mar 02 21:48:41.824556 2026] [:error] [pid 59600:tid 59609] [client 20.151.217.152:21348] [client 20.151.217.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaWVOYQ5lE4yocV9IBdz1AAAAAA"]
[Mon Mar 02 21:48:42.211485 2026] [:error] [pid 59602:tid 59666] [client 20.151.217.152:53888] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Mon Mar 02 21:48:42.421472 2026] [:error] [pid 59602:tid 59679] [client 20.151.217.152:53888] File does not exist: /usr/local/apache/htdocs/suspended-page/sa.php
[Mon Mar 02 21:48:42.444945 2026] [:error] [pid 59602:tid 59668] [client 20.151.217.152:21350] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 21:48:42.653478 2026] [:error] [pid 59602:tid 59671] [client 20.151.217.152:21350] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 21:48:42.867557 2026] [:error] [pid 59602:tid 59670] [client 20.151.217.152:21350] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 21:48:43.076271 2026] [:error] [pid 59602:tid 59685] [client 20.151.217.152:21350] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Mon Mar 02 21:48:43.282263 2026] [:error] [pid 59602:tid 59665] [client 20.151.217.152:21350] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWVOzMtSo_Fr0lHnSZ5qwAAAIA"]
[Mon Mar 02 21:48:43.693013 2026] [:error] [pid 59734:tid 59749] [client 20.151.217.152:21340] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWVO5eWQx7ZQG9NybEysAAAAU0"]
[Mon Mar 02 21:48:44.122806 2026] [:error] [pid 28847:tid 28849] [client 20.151.217.152:21267] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWVPJ9xbBq8VfeqVDZn7AAAAMA"]
[Mon Mar 02 21:48:44.533080 2026] [:error] [pid 59600:tid 59610] [client 20.151.217.152:21198] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "aaWVPIQ5lE4yocV9IBdz4AAAAAE"]
[Mon Mar 02 21:48:44.946761 2026] [:error] [pid 59734:tid 59740] [client 20.151.217.152:21265] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aq.php"] [unique_id "aaWVPJeWQx7ZQG9NybEyuAAAAUQ"]
[Mon Mar 02 21:48:45.358506 2026] [:error] [pid 59600:tid 59609] [client 20.151.217.152:21318] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVPYQ5lE4yocV9IBdz4QAAAAA"]
[Mon Mar 02 21:48:45.768981 2026] [:error] [pid 59600:tid 59625] [client 20.151.217.152:21194] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVPYQ5lE4yocV9IBdz5AAAABA"]
[Mon Mar 02 21:48:46.189804 2026] [:error] [pid 59602:tid 59666] [client 20.151.217.152:21257] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVPjMtSo_Fr0lHnSZ5xgAAAIE"]
[Mon Mar 02 21:48:46.607633 2026] [:error] [pid 59600:tid 59631] [client 20.151.217.152:21330] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVPoQ5lE4yocV9IBdz6QAAABY"]
[Mon Mar 02 21:48:47.023524 2026] [:error] [pid 59600:tid 59611] [client 20.151.217.152:21353] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVP4Q5lE4yocV9IBdz6wAAAAI"]
[Mon Mar 02 21:48:47.434873 2026] [:error] [pid 59602:tid 59667] [client 20.151.217.152:21250] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVPzMtSo_Fr0lHnSZ5zQAAAII"]
[Mon Mar 02 21:48:47.843771 2026] [:error] [pid 59600:tid 59610] [client 20.151.217.152:21346] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVP4Q5lE4yocV9IBdz7wAAAAE"]
[Mon Mar 02 21:48:48.261806 2026] [:error] [pid 59600:tid 59624] [client 20.151.217.152:21375] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVQIQ5lE4yocV9IBdz8wAAAA8"]
[Mon Mar 02 21:49:04.147018 2026] [:error] [pid 59734:tid 59738] [client 20.151.217.152:49518] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVUJeWQx7ZQG9NybEyzQAAAUI"]
[Mon Mar 02 21:49:04.558229 2026] [:error] [pid 59734:tid 59746] [client 20.151.217.152:49489] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVUJeWQx7ZQG9NybEy0QAAAUo"]
[Mon Mar 02 21:49:04.967931 2026] [:error] [pid 59600:tid 59630] [client 20.151.217.152:49534] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVUIQ5lE4yocV9IBd0HwAAABU"]
[Mon Mar 02 21:49:05.379461 2026] [:error] [pid 59600:tid 59627] [client 20.151.217.152:49479] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVUYQ5lE4yocV9IBd0JAAAABI"]
[Mon Mar 02 21:49:13.533251 2026] [:error] [pid 59734:tid 59744] [client 20.151.217.152:25448] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVWZeWQx7ZQG9NybEy3AAAAUg"]
[Mon Mar 02 21:49:13.944681 2026] [:error] [pid 59734:tid 59741] [client 20.151.217.152:25435] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVWZeWQx7ZQG9NybEy3wAAAUU"]
[Mon Mar 02 21:49:14.356999 2026] [:error] [pid 59600:tid 59629] [client 20.151.217.152:25438] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVWoQ5lE4yocV9IBd0RQAAABQ"]
[Mon Mar 02 21:49:14.772003 2026] [:error] [pid 59600:tid 59612] [client 20.151.217.152:25450] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVWoQ5lE4yocV9IBd0RgAAAAM"]
[Mon Mar 02 21:50:08.351809 2026] [:error] [pid 59601:tid 59641] [client 20.151.217.152:24337] [client 20.151.217.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaWVkMQ1lXfvWN0-ZQmZDgAAAEM"]
[Mon Mar 02 21:50:08.771806 2026] [:error] [pid 28847:tid 28870] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Mon Mar 02 21:50:09.194900 2026] [:error] [pid 28847:tid 28866] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 21:50:09.417788 2026] [:error] [pid 28847:tid 28858] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 21:50:09.629027 2026] [:error] [pid 28847:tid 28856] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 21:50:09.840591 2026] [:error] [pid 28847:tid 28861] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Mon Mar 02 21:50:11.623996 2026] [:error] [pid 28847:tid 28861] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Mon Mar 02 21:50:11.834841 2026] [:error] [pid 28847:tid 28866] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Mon Mar 02 21:50:12.044825 2026] [:error] [pid 28847:tid 28858] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Mon Mar 02 21:50:12.256643 2026] [:error] [pid 28847:tid 28872] [client 20.151.217.152:24429] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Mon Mar 02 21:50:12.464559 2026] [:error] [pid 28847:tid 28857] [client 20.151.217.152:24429] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVlJ9xbBq8VfeqVDZo8QAAAMg"]
[Mon Mar 02 21:50:12.880521 2026] [:error] [pid 59600:tid 59611] [client 20.151.217.152:24428] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVlIQ5lE4yocV9IBd0sQAAAAI"]
[Mon Mar 02 21:50:13.291195 2026] [:error] [pid 59701:tid 59722] [client 20.151.217.152:24326] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVleUmTDVso96U9_LgLAAAARI"]
[Mon Mar 02 21:50:13.727593 2026] [:error] [pid 59600:tid 59613] [client 20.151.217.152:24323] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWVlYQ5lE4yocV9IBd0tgAAAAQ"]
[Mon Mar 02 21:50:14.164293 2026] [:error] [pid 59600:tid 59622] [client 20.151.217.152:24405] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVloQ5lE4yocV9IBd0uwAAAA0"]
[Mon Mar 02 21:50:14.576313 2026] [:error] [pid 28847:tid 28855] [client 20.151.217.152:24420] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVlp9xbBq8VfeqVDZo_QAAAMY"]
[Mon Mar 02 21:50:14.993274 2026] [:error] [pid 28847:tid 28868] [client 20.151.217.152:24425] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVlp9xbBq8VfeqVDZpAgAAANM"]
[Mon Mar 02 21:50:15.404124 2026] [:error] [pid 28847:tid 28860] [client 20.151.217.152:24388] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWVl59xbBq8VfeqVDZpBwAAAMs"]
[Mon Mar 02 21:50:15.814633 2026] [:error] [pid 28847:tid 28873] [client 20.151.217.152:24352] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWVl59xbBq8VfeqVDZpDQAAANg"]
[Mon Mar 02 21:50:16.229599 2026] [:error] [pid 59600:tid 59616] [client 20.151.217.152:24416] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWVmIQ5lE4yocV9IBd0vwAAAAc"]
[Mon Mar 02 21:50:16.638322 2026] [:error] [pid 59600:tid 59612] [client 20.151.217.152:24447] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWVmIQ5lE4yocV9IBd0wQAAAAM"]
[Mon Mar 02 21:50:17.054086 2026] [:error] [pid 59600:tid 59623] [client 20.151.217.152:24443] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWVmYQ5lE4yocV9IBd0xAAAAA4"]
[Mon Mar 02 21:50:17.463754 2026] [:error] [pid 59600:tid 59624] [client 20.151.217.152:24334] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWVmYQ5lE4yocV9IBd0xgAAAA8"]
[Mon Mar 02 21:50:17.886627 2026] [:error] [pid 59601:tid 59648] [client 20.151.217.152:24432] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWVmcQ1lXfvWN0-ZQmZFQAAAEo"]
[Mon Mar 02 21:50:18.294776 2026] [:error] [pid 59601:tid 59646] [client 20.151.217.152:24426] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWVmsQ1lXfvWN0-ZQmZFwAAAEg"]
[Mon Mar 02 21:50:18.706089 2026] [:error] [pid 59602:tid 59680] [client 20.151.217.152:24332] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWVmjMtSo_Fr0lHnSZ6ZAAAAI8"]
[Mon Mar 02 21:50:19.122896 2026] [:error] [pid 28847:tid 28853] [client 20.151.217.152:24402] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWVm59xbBq8VfeqVDZpJwAAAMQ"]
[Mon Mar 02 21:50:19.533451 2026] [:error] [pid 59734:tid 59758] [client 20.151.217.152:24411] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWVm5eWQx7ZQG9NybEzLQAAAVY"]
[Mon Mar 02 21:50:19.945047 2026] [:error] [pid 28847:tid 28864] [client 20.151.217.152:24362] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWVm59xbBq8VfeqVDZpLAAAAM8"]
[Mon Mar 02 21:50:20.354433 2026] [:error] [pid 59734:tid 59755] [client 20.151.217.152:24335] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWVnJeWQx7ZQG9NybEzMQAAAVM"]
[Mon Mar 02 21:50:20.767152 2026] [:error] [pid 28847:tid 28859] [client 20.151.217.152:24434] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWVnJ9xbBq8VfeqVDZpMAAAAMo"]
[Mon Mar 02 21:50:21.182232 2026] [:error] [pid 28847:tid 28851] [client 20.151.217.152:24329] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWVnZ9xbBq8VfeqVDZpMwAAAMI"]
[Mon Mar 02 21:50:21.597144 2026] [:error] [pid 28847:tid 28873] [client 20.151.217.152:24325] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWVnZ9xbBq8VfeqVDZpNgAAANg"]
[Mon Mar 02 21:50:22.005821 2026] [:error] [pid 28847:tid 28870] [client 20.151.217.152:24437] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWVnp9xbBq8VfeqVDZpOgAAANU"]
[Mon Mar 02 21:50:22.415600 2026] [:error] [pid 59600:tid 59623] [client 20.151.217.152:24400] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWVnoQ5lE4yocV9IBd0zAAAAA4"]
[Mon Mar 02 21:50:22.831767 2026] [:error] [pid 28847:tid 28858] [client 20.151.217.152:24322] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWVnp9xbBq8VfeqVDZpQwAAAMk"]
[Mon Mar 02 21:50:23.243229 2026] [:error] [pid 28847:tid 28860] [client 20.151.217.152:24341] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWVn59xbBq8VfeqVDZpRgAAAMs"]
[Mon Mar 02 21:50:23.656208 2026] [:error] [pid 59600:tid 59622] [client 20.151.217.152:24320] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWVn4Q5lE4yocV9IBd0zgAAAA0"]
[Mon Mar 02 21:51:05.710429 2026] [:error] [pid 59602:tid 59681] [client 20.151.217.152:18708] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVyTMtSo_Fr0lHnSZ6ngAAAJA"]
[Mon Mar 02 21:51:06.120173 2026] [:error] [pid 59601:tid 59646] [client 20.151.217.152:18759] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVysQ1lXfvWN0-ZQmZQgAAAEg"]
[Mon Mar 02 21:51:06.529357 2026] [:error] [pid 59734:tid 59755] [client 20.151.217.152:18776] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVypeWQx7ZQG9NybEzbQAAAVM"]
[Mon Mar 02 21:51:06.948019 2026] [:error] [pid 59601:tid 59660] [client 20.151.217.152:18813] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaWVysQ1lXfvWN0-ZQmZQwAAAFY"]
[Mon Mar 02 22:04:08.564817 2026] [:error] [pid 59701:tid 59719] [client 13.71.189.74:61607] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 22:04:08.827852 2026] [:error] [pid 59701:tid 59724] [client 13.71.189.74:61607] [client 13.71.189.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaWY2OUmTDVso96U9_LjKQAAARQ"]
[Mon Mar 02 22:04:09.284841 2026] [:error] [pid 59734:tid 59740] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Mon Mar 02 22:04:09.706091 2026] [:error] [pid 59734:tid 59738] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 22:04:09.917622 2026] [:error] [pid 59734:tid 59742] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 22:04:10.129811 2026] [:error] [pid 59734:tid 59758] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Mon Mar 02 22:04:10.341473 2026] [:error] [pid 59734:tid 59757] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Mon Mar 02 22:04:10.553961 2026] [:error] [pid 59734:tid 59739] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Mon Mar 02 22:04:10.765498 2026] [:error] [pid 59734:tid 59743] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Mon Mar 02 22:04:10.976019 2026] [:error] [pid 59734:tid 59745] [client 13.71.189.74:58496] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Mon Mar 02 22:04:11.197317 2026] [:error] [pid 59734:tid 59759] [client 13.71.189.74:58496] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWY25eWQx7ZQG9NybE3AAAAAVc"]
[Mon Mar 02 22:04:11.614137 2026] [:error] [pid 59601:tid 59642] [client 13.71.189.74:61594] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWY28Q1lXfvWN0-ZQmb2QAAAEQ"]
[Mon Mar 02 22:04:12.029221 2026] [:error] [pid 59600:tid 59615] [client 13.71.189.74:61580] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWY3IQ5lE4yocV9IBd7_AAAAAY"]
[Mon Mar 02 22:04:12.439657 2026] [:error] [pid 59601:tid 59655] [client 13.71.189.74:42994] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as1337.php"] [unique_id "aaWY3MQ1lXfvWN0-ZQmb2wAAAFE"]
[Mon Mar 02 22:04:12.848287 2026] [:error] [pid 59600:tid 59631] [client 13.71.189.74:2358] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWY3IQ5lE4yocV9IBd7_QAAABY"]
[Mon Mar 02 22:04:13.263255 2026] [:error] [pid 59600:tid 59626] [client 13.71.189.74:58506] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWY3YQ5lE4yocV9IBd7_gAAABE"]
[Mon Mar 02 22:04:13.680429 2026] [:error] [pid 59601:tid 59652] [client 13.71.189.74:61585] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWY3cQ1lXfvWN0-ZQmb3AAAAE4"]
[Mon Mar 02 22:04:14.092760 2026] [:error] [pid 59701:tid 59723] [client 13.71.189.74:59723] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "aaWY3uUmTDVso96U9_LjMQAAARM"]
[Mon Mar 02 22:04:14.507995 2026] [:error] [pid 59600:tid 59629] [client 13.71.189.74:59724] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf-shell.php"] [unique_id "aaWY3oQ5lE4yocV9IBd8BQAAABQ"]
[Mon Mar 02 22:04:14.925750 2026] [:error] [pid 28847:tid 28867] [client 13.71.189.74:58501] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWY3p9xbBq8VfeqVDZ0jgAAANI"]
[Mon Mar 02 22:04:15.342293 2026] [:error] [pid 59600:tid 59616] [client 13.71.189.74:40764] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWY34Q5lE4yocV9IBd8BwAAAAc"]
[Mon Mar 02 22:04:15.755013 2026] [:error] [pid 59601:tid 59647] [client 13.71.189.74:54542] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/core.php"] [unique_id "aaWY38Q1lXfvWN0-ZQmb3gAAAEk"]
[Mon Mar 02 22:04:16.181203 2026] [:error] [pid 59602:tid 59678] [client 13.71.189.74:57970] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWY4DMtSo_Fr0lHnSZ_8QAAAI0"]
[Mon Mar 02 22:04:16.598226 2026] [:error] [pid 59601:tid 59661] [client 13.71.189.74:54538] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWY4MQ1lXfvWN0-ZQmb3wAAAFc"]
[Mon Mar 02 22:04:17.014055 2026] [:error] [pid 59701:tid 59715] [client 13.71.189.74:59713] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWY4eUmTDVso96U9_LjNwAAAQs"]
[Mon Mar 02 22:04:17.425673 2026] [:error] [pid 59600:tid 59619] [client 13.71.189.74:57971] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "aaWY4YQ5lE4yocV9IBd8CwAAAAo"]
[Mon Mar 02 22:04:17.869338 2026] [:error] [pid 59600:tid 59609] [client 13.71.189.74:54570] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWY4YQ5lE4yocV9IBd8DAAAAAA"]
[Mon Mar 02 22:04:18.279775 2026] [:error] [pid 28847:tid 28864] [client 13.71.189.74:54553] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWY4p9xbBq8VfeqVDZ0lQAAAM8"]
[Mon Mar 02 22:04:18.689974 2026] [:error] [pid 28847:tid 28850] [client 13.71.189.74:40760] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWY4p9xbBq8VfeqVDZ0mgAAAME"]
[Mon Mar 02 22:04:19.111009 2026] [:error] [pid 59701:tid 59720] [client 13.71.189.74:54551] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asf.php"] [unique_id "aaWY4-UmTDVso96U9_LjOgAAARA"]
[Mon Mar 02 22:04:19.528002 2026] [:error] [pid 59701:tid 59726] [client 13.71.189.74:40705] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWY4-UmTDVso96U9_LjOwAAARY"]
[Mon Mar 02 22:04:19.941357 2026] [:error] [pid 59601:tid 59639] [client 13.71.189.74:59771] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWY48Q1lXfvWN0-ZQmb4wAAAEE"]
[Mon Mar 02 22:04:20.352277 2026] [:error] [pid 59701:tid 59719] [client 13.71.189.74:42983] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWY5OUmTDVso96U9_LjPwAAAQ8"]
[Mon Mar 02 22:04:20.785907 2026] [:error] [pid 59601:tid 59642] [client 13.71.189.74:40734] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sa.php"] [unique_id "aaWY5MQ1lXfvWN0-ZQmb6AAAAEQ"]
[Mon Mar 02 22:12:25.794749 2026] [:error] [pid 59601:tid 59661] [client 40.85.218.182:32402] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 02 22:12:26.005646 2026] [:error] [pid 59601:tid 59648] [client 40.85.218.182:32402] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 02 22:12:26.421909 2026] [:error] [pid 59601:tid 59651] [client 40.85.218.182:32402] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 02 22:12:26.631283 2026] [:error] [pid 59601:tid 59662] [client 40.85.218.182:32402] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 02 22:12:27.049599 2026] [:error] [pid 59601:tid 59639] [client 40.85.218.182:32402] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Mar 02 22:12:27.257900 2026] [:error] [pid 59601:tid 59657] [client 40.85.218.182:32402] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Mar 02 22:12:27.465605 2026] [:error] [pid 59601:tid 59641] [client 40.85.218.182:32402] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Mar 02 22:12:27.670517 2026] [:error] [pid 59601:tid 59654] [client 40.85.218.182:32402] [client 40.85.218.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaWay8Q1lXfvWN0-ZQmdxAAAAFA"]
[Mon Mar 02 22:12:28.497179 2026] [:error] [pid 59734:tid 59736] [client 40.85.218.182:32422] [client 40.85.218.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaWazJeWQx7ZQG9NybE6owAAAUA"]
[Mon Mar 02 22:12:29.322215 2026] [:error] [pid 59734:tid 59752] [client 40.85.218.182:32403] [client 40.85.218.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaWazZeWQx7ZQG9NybE6pgAAAVA"]
[Mon Mar 02 22:12:30.158992 2026] [:error] [pid 59701:tid 59707] [client 40.85.218.182:31879] [client 40.85.218.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "aaWazuUmTDVso96U9_LlxAAAAQM"]
[Tue Mar 03 01:56:46.771154 2026] [:error] [pid 18558:tid 18874] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Mar 03 01:56:46.999768 2026] [:error] [pid 18558:tid 18857] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Mar 03 01:56:47.208636 2026] [:error] [pid 18558:tid 18855] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Mar 03 01:56:47.417571 2026] [:error] [pid 18558:tid 18858] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue Mar 03 01:56:47.637818 2026] [:error] [pid 18558:tid 18865] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Mar 03 01:56:47.852242 2026] [:error] [pid 18558:tid 18871] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Mar 03 01:56:48.062326 2026] [:error] [pid 18558:tid 18877] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Mar 03 01:56:48.274339 2026] [:error] [pid 18558:tid 18856] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Mar 03 01:56:48.488695 2026] [:error] [pid 18558:tid 18867] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Mar 03 01:56:48.710263 2026] [:error] [pid 18558:tid 18875] [client 20.151.114.166:6914] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Mar 03 01:56:48.915226 2026] [:error] [pid 18558:tid 18877] [client 20.151.114.166:6914] [client 20.151.114.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aaXPYLO1kQHjTOLioCnOIgAAAJc"]
[Tue Mar 03 01:56:49.768257 2026] [:error] [pid 60214:tid 60226] [client 20.151.114.166:6425] [client 20.151.114.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aaXPYYmuQ_v4S3RkLisYSgAAAQo"]
[Tue Mar 03 01:56:50.603788 2026] [:error] [pid 18558:tid 18865] [client 20.151.114.166:6926] [client 20.151.114.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aaXPYrO1kQHjTOLioCnOLwAAAIs"]
[Tue Mar 03 01:56:51.433620 2026] [:error] [pid 18558:tid 18868] [client 20.151.114.166:6924] [client 20.151.114.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rip.php"] [unique_id "aaXPY7O1kQHjTOLioCnONAAAAI4"]
[Tue Mar 03 03:00:48.873531 2026] [:error] [pid 18558:tid 18877] [client 20.151.217.152:33525] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaXeYLO1kQHjTOLioCnspQAAAJc"]
[Tue Mar 03 03:00:49.283077 2026] [:error] [pid 18558:tid 18873] [client 20.151.217.152:33485] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaXeYbO1kQHjTOLioCnsqQAAAJM"]
[Tue Mar 03 08:36:41.753501 2026] [:error] [pid 26186:tid 26193] [client 87.116.135.152:60344] [client 87.116.135.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.116.135.152, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaYtGfbZCNtk8wDak9f-awAAAUU"]
[Tue Mar 03 08:36:41.760472 2026] [:error] [pid 26186:tid 26193] [client 87.116.135.152:60344] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 03 18:03:40.868943 2026] [:error] [pid 36785:tid 36855] [client 20.151.222.76:40270] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Mar 03 18:03:41.290149 2026] [:error] [pid 36785:tid 36873] [client 20.151.222.76:40270] [client 20.151.222.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.222.76, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "aaax_XhJejauENG9qTiVowAAAJc"]
[Tue Mar 03 18:03:42.772207 2026] [:error] [pid 36785:tid 36857] [client 20.151.222.76:40270] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Tue Mar 03 18:03:44.858932 2026] [:error] [pid 36785:tid 36862] [client 20.151.222.76:40270] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Tue Mar 03 18:03:45.497815 2026] [:error] [pid 36785:tid 36866] [client 20.151.222.76:40270] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Mar 03 18:03:45.707299 2026] [:error] [pid 36785:tid 36854] [client 20.151.222.76:40270] [client 20.151.222.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaayAXhJejauENG9qTiVvQAAAIQ"]
[Tue Mar 03 18:03:46.537628 2026] [:error] [pid 36785:tid 36872] [client 20.151.222.76:40261] [client 20.151.222.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaayAnhJejauENG9qTiVwAAAAJY"]
[Tue Mar 03 18:03:47.398904 2026] [:error] [pid 36785:tid 36874] [client 20.151.222.76:40689] [client 20.151.222.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaayA3hJejauENG9qTiVxQAAAJg"]
[Tue Mar 03 18:03:48.258259 2026] [:error] [pid 36897:tid 36911] [client 20.151.222.76:40645] [client 20.151.222.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaayBCZC69_8eM0UousGdQAAAMk"]
[Tue Mar 03 21:03:32.555214 2026] [:error] [pid 36785:tid 36868] [client 20.242.80.74:16358] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 03 21:03:32.769516 2026] [:error] [pid 36785:tid 36866] [client 20.242.80.74:16358] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Mar 03 21:03:33.176620 2026] [:error] [pid 36785:tid 36864] [client 20.242.80.74:16358] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Mar 03 21:03:33.379798 2026] [:error] [pid 36785:tid 36856] [client 20.242.80.74:16358] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Mar 03 21:03:33.786050 2026] [:error] [pid 36785:tid 36852] [client 20.242.80.74:16358] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Mar 03 21:03:33.989976 2026] [:error] [pid 36785:tid 36850] [client 20.242.80.74:16358] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Mar 03 21:03:34.195829 2026] [:error] [pid 36785:tid 36867] [client 20.242.80.74:16358] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue Mar 03 21:03:34.632705 2026] [:error] [pid 36785:tid 36853] [client 20.242.80.74:16358] [client 20.242.80.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aabcJnhJejauENG9qTjrUwAAAIM"]
[Tue Mar 03 21:03:35.514726 2026] [:error] [pid 36785:tid 36856] [client 20.242.80.74:16268] [client 20.242.80.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aabcJ3hJejauENG9qTjrWQAAAIY"]
[Tue Mar 03 21:03:36.350640 2026] [:error] [pid 36897:tid 36913] [client 20.242.80.74:16370] [client 20.242.80.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aabcKCZC69_8eM0Uout2JQAAAMs"]
[Tue Mar 03 21:03:37.167300 2026] [:error] [pid 14042:tid 14058] [client 20.242.80.74:16265] [client 20.242.80.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aabcKWeHGCmSEiIBcK512gAAAY4"]
[Tue Mar 03 21:55:48.741320 2026] [:error] [pid 36897:tid 36914] [client 34.169.129.120:54571] [client 34.169.129.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.169.129.120, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaboZCZC69_8eM0UouuU0wAAAMw"]
[Tue Mar 03 21:55:48.745080 2026] [:error] [pid 36897:tid 36914] [client 34.169.129.120:54571] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 03 21:55:51.581512 2026] [:error] [pid 36897:tid 36907] [client 34.169.129.120:54571] [client 34.169.129.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaboZyZC69_8eM0UouuU7gAAAMU"]
[Tue Mar 03 21:55:52.224930 2026] [:error] [pid 26186:tid 26188] [client 34.169.129.120:63522] [client 34.169.129.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaboaPbZCNtk8wDak9fWjAAAAUA"]
[Tue Mar 03 21:55:52.704157 2026] [:error] [pid 36897:tid 36918] [client 34.169.129.120:65085] [client 34.169.129.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaboaCZC69_8eM0UouuU8QAAANA"]
[Tue Mar 03 21:55:53.404966 2026] [:error] [pid 36784:tid 36838] [client 34.169.129.120:58376] [client 34.169.129.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaboaXNeKOSGbW9kDgTlqQAAAE8"]
[Tue Mar 03 21:55:54.063591 2026] [:error] [pid 36785:tid 36870] [client 34.169.129.120:65395] [client 34.169.129.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaboanhJejauENG9qTgEiAAAAJQ"]
[Tue Mar 03 21:55:54.460487 2026] [:error] [pid 36897:tid 36910] [client 34.169.129.120:49534] [client 34.169.129.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaboaiZC69_8eM0UouuU-QAAAMg"]
[Tue Mar 03 21:55:55.027507 2026] [:error] [pid 26186:tid 26209] [client 34.169.129.120:62031] [client 34.169.129.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaboa_bZCNtk8wDak9fWjwAAAVU"]
[Tue Mar 03 22:11:33.432460 2026] [:error] [pid 36785:tid 36857] [client 178.16.53.90:59209] [client 178.16.53.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "aabsFXhJejauENG9qTgM9gAAAIc"]
[Tue Mar 03 22:30:45.151028 2026] [:error] [pid 36784:tid 36827] [client 177.190.179.244:9792] [client 177.190.179.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.190.179.244, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aabwlXNeKOSGbW9kDgTxoQAAAEQ"]
[Tue Mar 03 22:30:45.155798 2026] [:error] [pid 36784:tid 36827] [client 177.190.179.244:9792] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 04 00:57:55.213894 2026] [:error] [pid 48807:tid 48831] [client 20.127.131.187:8478] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 04 00:57:55.430496 2026] [:error] [pid 48807:tid 48810] [client 20.127.131.187:8478] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 04 00:57:55.869306 2026] [:error] [pid 48807:tid 48833] [client 20.127.131.187:8478] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Wed Mar 04 00:57:56.087741 2026] [:error] [pid 48807:tid 48831] [client 20.127.131.187:8478] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 04 00:57:56.527016 2026] [:error] [pid 48807:tid 48818] [client 20.127.131.187:8478] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Mar 04 00:57:56.744753 2026] [:error] [pid 48807:tid 48824] [client 20.127.131.187:8478] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Mar 04 00:57:56.962892 2026] [:error] [pid 48807:tid 48831] [client 20.127.131.187:8478] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Wed Mar 04 00:57:57.406356 2026] [:error] [pid 48807:tid 48820] [client 20.127.131.187:8478] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aacTFQ9v35BN-51vqYZozwAAAQs"]
[Wed Mar 04 00:57:58.306377 2026] [:error] [pid 48807:tid 48823] [client 20.127.131.187:8511] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aacTFg9v35BN-51vqYZo0wAAAQ4"]
[Wed Mar 04 00:57:59.151267 2026] [:error] [pid 48407:tid 48693] [client 20.127.131.187:8459] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aacTFz7Td6SiHn8fwfnDXQAAAIM"]
[Wed Mar 04 00:58:00.055616 2026] [:error] [pid 48807:tid 48816] [client 20.127.131.187:9172] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aacTGA9v35BN-51vqYZo2QAAAQc"]
[Wed Mar 04 06:18:58.180481 2026] [:error] [pid 18553:tid 18587] [client 52.252.56.196:64213] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Mar 04 06:18:58.602793 2026] [:error] [pid 18553:tid 18564] [client 52.252.56.196:64213] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Wed Mar 04 06:18:58.807940 2026] [:error] [pid 18553:tid 18575] [client 52.252.56.196:64213] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Wed Mar 04 06:18:59.012962 2026] [:error] [pid 18553:tid 18581] [client 52.252.56.196:64213] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 04 06:18:59.218519 2026] [:error] [pid 18553:tid 18586] [client 52.252.56.196:64213] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Wed Mar 04 06:18:59.423529 2026] [:error] [pid 18553:tid 18588] [client 52.252.56.196:64213] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Wed Mar 04 06:18:59.860055 2026] [:error] [pid 18553:tid 18577] [client 52.252.56.196:64213] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aadeU2bax1neh8d0AHaQ4gAAAA0"]
[Wed Mar 04 06:19:00.305256 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:64165] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aadeVPN8030QMpFXdds3agAAARI"]
[Wed Mar 04 06:19:00.734344 2026] [:error] [pid 18553:tid 18585] [client 52.252.56.196:62025] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aadeVGbax1neh8d0AHaQ4wAAABU"]
[Wed Mar 04 06:19:01.213507 2026] [:error] [pid 18554:tid 18611] [client 52.252.56.196:64189] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "aadeVZ0fKmKeTIK7QS2mWQAAAFM"]
[Wed Mar 04 06:19:01.845480 2026] [:error] [pid 18681:tid 18692] [client 52.252.56.196:62032] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aadeVaE_TuZYUBveWkWhtQAAAMk"]
[Wed Mar 04 06:19:02.423948 2026] [:error] [pid 18554:tid 18609] [client 52.252.56.196:64134] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aadeVp0fKmKeTIK7QS2mXgAAAFE"]
[Wed Mar 04 06:19:02.946990 2026] [:error] [pid 18554:tid 18594] [client 52.252.56.196:64129] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aadeVp0fKmKeTIK7QS2mXwAAAEI"]
[Wed Mar 04 06:19:03.414351 2026] [:error] [pid 54487:tid 54491] [client 52.252.56.196:64198] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "aadeV_N8030QMpFXdds3cAAAAQI"]
[Wed Mar 04 06:19:03.872706 2026] [:error] [pid 54487:tid 54513] [client 52.252.56.196:64135] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aadeV_N8030QMpFXdds3cQAAARg"]
[Wed Mar 04 06:19:04.654608 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:62033] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aadeWPN8030QMpFXdds3cgAAARI"]
[Wed Mar 04 06:19:05.103281 2026] [:error] [pid 54487:tid 54495] [client 52.252.56.196:61407] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aadeWfN8030QMpFXdds3cwAAAQY"]
[Wed Mar 04 06:19:05.581348 2026] [:error] [pid 54487:tid 54502] [client 52.252.56.196:64173] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "aadeWfN8030QMpFXdds3dQAAAQ0"]
[Wed Mar 04 06:19:06.482134 2026] [:error] [pid 18554:tid 18596] [client 52.252.56.196:64187] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aadeWp0fKmKeTIK7QS2mbAAAAEQ"]
[Wed Mar 04 06:19:06.951751 2026] [:error] [pid 18554:tid 18605] [client 52.252.56.196:64233] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aadeWp0fKmKeTIK7QS2mdwAAAE0"]
[Wed Mar 04 06:19:07.356123 2026] [:error] [pid 18554:tid 18605] [client 52.252.56.196:64252] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aadeW50fKmKeTIK7QS2mfQAAAE0"]
[Wed Mar 04 06:19:07.826850 2026] [:error] [pid 18553:tid 18577] [client 52.252.56.196:64208] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "aadeW2bax1neh8d0AHaQ6wAAAA0"]
[Wed Mar 04 06:19:08.277811 2026] [:error] [pid 54487:tid 54497] [client 52.252.56.196:64196] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aadeXPN8030QMpFXdds3egAAAQg"]
[Wed Mar 04 06:19:08.678053 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:64181] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aadeXJ0fKmKeTIK7QS2mhQAAAEU"]
[Wed Mar 04 06:19:09.128877 2026] [:error] [pid 18554:tid 18608] [client 52.252.56.196:64170] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aadeXZ0fKmKeTIK7QS2miAAAAFA"]
[Wed Mar 04 06:19:09.634238 2026] [:error] [pid 54487:tid 54492] [client 52.252.56.196:62035] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "aadeXfN8030QMpFXdds3gQAAAQM"]
[Wed Mar 04 06:19:10.086467 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:62022] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aadeXp0fKmKeTIK7QS2mjAAAAFY"]
[Wed Mar 04 06:19:10.592655 2026] [:error] [pid 18554:tid 18599] [client 52.252.56.196:64218] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aadeXp0fKmKeTIK7QS2mkAAAAEc"]
[Wed Mar 04 06:19:11.023905 2026] [:error] [pid 18553:tid 18580] [client 52.252.56.196:64158] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aadeX2bax1neh8d0AHaQ7wAAABA"]
[Wed Mar 04 06:19:11.443559 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:64255] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "aadeX50fKmKeTIK7QS2mnAAAAFY"]
[Wed Mar 04 06:19:11.869124 2026] [:error] [pid 18555:tid 18619] [client 52.252.56.196:64130] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aadeXzQeUDANiOsQ3Gd1lQAAAIA"]
[Wed Mar 04 06:19:12.307589 2026] [:error] [pid 18554:tid 18607] [client 52.252.56.196:64247] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aadeYJ0fKmKeTIK7QS2mowAAAE8"]
[Wed Mar 04 06:19:12.757569 2026] [:error] [pid 18554:tid 18594] [client 52.252.56.196:64176] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aadeYJ0fKmKeTIK7QS2mpQAAAEI"]
[Wed Mar 04 06:19:13.193093 2026] [:error] [pid 54487:tid 54512] [client 52.252.56.196:61957] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "aadeYfN8030QMpFXdds3jQAAARc"]
[Wed Mar 04 06:19:13.726341 2026] [:error] [pid 18554:tid 18612] [client 52.252.56.196:64175] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aadeYZ0fKmKeTIK7QS2mpgAAAFQ"]
[Wed Mar 04 06:19:14.168483 2026] [:error] [pid 18554:tid 18593] [client 52.252.56.196:62020] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aadeYp0fKmKeTIK7QS2mqAAAAEE"]
[Wed Mar 04 06:19:14.610056 2026] [:error] [pid 18554:tid 18604] [client 52.252.56.196:64153] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aadeYp0fKmKeTIK7QS2mqQAAAEw"]
[Wed Mar 04 06:19:15.096876 2026] [:error] [pid 18554:tid 18616] [client 52.252.56.196:64164] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "aadeY50fKmKeTIK7QS2mqwAAAFg"]
[Wed Mar 04 06:19:15.559470 2026] [:error] [pid 54487:tid 54510] [client 52.252.56.196:64149] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aadeY_N8030QMpFXdds3lgAAARU"]
[Wed Mar 04 06:19:15.958873 2026] [:error] [pid 54487:tid 54491] [client 52.252.56.196:64168] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aadeY_N8030QMpFXdds3mAAAAQI"]
[Wed Mar 04 06:19:16.781467 2026] [:error] [pid 18681:tid 18683] [client 52.252.56.196:64145] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aadeZKE_TuZYUBveWkWhvgAAAMA"]
[Wed Mar 04 06:19:17.315184 2026] [:error] [pid 18554:tid 18603] [client 52.252.56.196:62042] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "aadeZZ0fKmKeTIK7QS2mrgAAAEs"]
[Wed Mar 04 06:19:17.764981 2026] [:error] [pid 18554:tid 18592] [client 52.252.56.196:64190] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aadeZZ0fKmKeTIK7QS2mrwAAAEA"]
[Wed Mar 04 06:19:18.246352 2026] [:error] [pid 18553:tid 18581] [client 52.252.56.196:64182] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aadeZmbax1neh8d0AHaQ8wAAABE"]
[Wed Mar 04 06:19:18.766587 2026] [:error] [pid 18554:tid 18595] [client 52.252.56.196:62017] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aadeZp0fKmKeTIK7QS2msgAAAEM"]
[Wed Mar 04 06:19:19.225247 2026] [:error] [pid 54487:tid 54491] [client 52.252.56.196:62031] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "aadeZ_N8030QMpFXdds3nAAAAQI"]
[Wed Mar 04 06:19:19.695254 2026] [:error] [pid 54487:tid 54500] [client 52.252.56.196:64177] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aadeZ_N8030QMpFXdds3nQAAAQs"]
[Wed Mar 04 06:19:20.298032 2026] [:error] [pid 18554:tid 18604] [client 52.252.56.196:64238] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aadeaJ0fKmKeTIK7QS2mtwAAAEw"]
[Wed Mar 04 06:19:20.716901 2026] [:error] [pid 54487:tid 54503] [client 52.252.56.196:64128] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aadeaPN8030QMpFXdds3nwAAAQ4"]
[Wed Mar 04 06:19:21.117831 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:62040] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aadeaZ0fKmKeTIK7QS2muQAAAFY"]
[Wed Mar 04 06:19:21.634872 2026] [:error] [pid 54487:tid 54505] [client 52.252.56.196:64157] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aadeafN8030QMpFXdds3ogAAARA"]
[Wed Mar 04 06:19:22.200937 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:62034] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aadeavN8030QMpFXdds3owAAARI"]
[Wed Mar 04 06:19:22.693404 2026] [:error] [pid 18554:tid 18612] [client 52.252.56.196:64142] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aadeap0fKmKeTIK7QS2mvgAAAFQ"]
[Wed Mar 04 06:19:23.410566 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:64171] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "aadea50fKmKeTIK7QS2mwwAAAFI"]
[Wed Mar 04 06:19:24.279716 2026] [:error] [pid 18553:tid 18569] [client 52.252.56.196:62030] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aadebGbax1neh8d0AHaQ-QAAAAU"]
[Wed Mar 04 06:19:25.103544 2026] [:error] [pid 18554:tid 18604] [client 52.252.56.196:61971] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aadebZ0fKmKeTIK7QS2mzwAAAEw"]
[Wed Mar 04 06:19:45.122568 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:64209] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "aadegZ0fKmKeTIK7QS2nEAAAAFI"]
[Wed Mar 04 06:19:48.527610 2026] [:error] [pid 54487:tid 54496] [client 52.252.56.196:64134] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aadehPN8030QMpFXdds4BQAAAQc"]
[Wed Mar 04 06:19:49.532663 2026] [:error] [pid 18554:tid 18602] [client 52.252.56.196:61983] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aadehZ0fKmKeTIK7QS2nGQAAAEo"]
[Wed Mar 04 06:19:49.996942 2026] [:error] [pid 18553:tid 18567] [client 52.252.56.196:64160] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aadehWbax1neh8d0AHaREgAAAAM"]
[Wed Mar 04 06:19:50.496965 2026] [:error] [pid 18554:tid 18605] [client 52.252.56.196:62002] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "aadehp0fKmKeTIK7QS2nGgAAAE0"]
[Wed Mar 04 06:19:50.931300 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:61970] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aadehp0fKmKeTIK7QS2nHAAAAFI"]
[Wed Mar 04 06:19:51.457566 2026] [:error] [pid 18554:tid 18601] [client 52.252.56.196:64220] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aadeh50fKmKeTIK7QS2nHgAAAEk"]
[Wed Mar 04 06:19:52.287716 2026] [:error] [pid 18554:tid 18595] [client 52.252.56.196:64227] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aadeiJ0fKmKeTIK7QS2nIAAAAEM"]
[Wed Mar 04 06:19:52.791319 2026] [:error] [pid 18553:tid 18587] [client 52.252.56.196:64226] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "aadeiGbax1neh8d0AHaRFAAAABc"]
[Wed Mar 04 06:19:53.302784 2026] [:error] [pid 18681:tid 18687] [client 52.252.56.196:64235] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aadeiaE_TuZYUBveWkWh7wAAAMQ"]
[Wed Mar 04 06:19:53.701538 2026] [:error] [pid 18554:tid 18604] [client 52.252.56.196:64211] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aadeiZ0fKmKeTIK7QS2nIwAAAEw"]
[Wed Mar 04 06:19:54.118285 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:61398] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aadeip0fKmKeTIK7QS2nJQAAAFY"]
[Wed Mar 04 06:19:54.530935 2026] [:error] [pid 54487:tid 54500] [client 52.252.56.196:64179] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "aadeivN8030QMpFXdds4EQAAAQs"]
[Wed Mar 04 06:19:54.941491 2026] [:error] [pid 18554:tid 18608] [client 52.252.56.196:64200] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aadeip0fKmKeTIK7QS2nKQAAAFA"]
[Wed Mar 04 06:19:55.416233 2026] [:error] [pid 18681:tid 18692] [client 52.252.56.196:64194] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aadei6E_TuZYUBveWkWh8QAAAMk"]
[Wed Mar 04 06:19:55.970128 2026] [:error] [pid 18554:tid 18601] [client 52.252.56.196:64167] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aadei50fKmKeTIK7QS2nLgAAAEk"]
[Wed Mar 04 06:19:56.438731 2026] [:error] [pid 18554:tid 18615] [client 52.252.56.196:64248] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aadejJ0fKmKeTIK7QS2nMAAAAFc"]
[Wed Mar 04 06:19:56.888887 2026] [:error] [pid 18681:tid 18698] [client 52.252.56.196:62052] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadejKE_TuZYUBveWkWh8wAAAM8"]
[Wed Mar 04 06:19:57.334623 2026] [:error] [pid 18554:tid 18603] [client 52.252.56.196:62059] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadejZ0fKmKeTIK7QS2nMwAAAEs"]
[Wed Mar 04 06:19:57.752830 2026] [:error] [pid 18555:tid 18624] [client 52.252.56.196:62072] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadejTQeUDANiOsQ3Gd1zAAAAIU"]
[Wed Mar 04 06:19:58.283278 2026] [:error] [pid 18554:tid 18601] [client 52.252.56.196:64251] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadejp0fKmKeTIK7QS2nNgAAAEk"]
[Wed Mar 04 06:19:58.783319 2026] [:error] [pid 18681:tid 18695] [client 52.252.56.196:62046] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "aadejqE_TuZYUBveWkWh-gAAAMw"]
[Wed Mar 04 06:19:59.308521 2026] [:error] [pid 18553:tid 18569] [client 52.252.56.196:61975] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Mar 04 06:19:59.539225 2026] [:error] [pid 18553:tid 18578] [client 52.252.56.196:61975] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Mar 04 06:19:59.778947 2026] [:error] [pid 18553:tid 18579] [client 52.252.56.196:61975] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Mar 04 06:19:59.989752 2026] [:error] [pid 18553:tid 18568] [client 52.252.56.196:61975] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Mar 04 06:20:00.202768 2026] [:error] [pid 18553:tid 18574] [client 52.252.56.196:61975] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aadekGbax1neh8d0AHaRHgAAAAo"]
[Wed Mar 04 06:20:00.902753 2026] [:error] [pid 18555:tid 18625] [client 52.252.56.196:64174] File does not exist: /usr/local/apache/htdocs/suspended-page/core3.php
[Wed Mar 04 06:20:01.127482 2026] [:error] [pid 18555:tid 18628] [client 52.252.56.196:64174] File does not exist: /usr/local/apache/htdocs/suspended-page/RxR.php
[Wed Mar 04 06:20:01.794715 2026] [:error] [pid 18555:tid 18641] [client 52.252.56.196:64174] File does not exist: /usr/local/apache/htdocs/suspended-page/Gel.php
[Wed Mar 04 06:20:02.020736 2026] [:error] [pid 18555:tid 18635] [client 52.252.56.196:64174] File does not exist: /usr/local/apache/htdocs/suspended-page/pent.php
[Wed Mar 04 06:20:02.241303 2026] [:error] [pid 18555:tid 18636] [client 52.252.56.196:64174] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system/logs/dz1.php"] [unique_id "aadekjQeUDANiOsQ3Gd11QAAAJE"]
[Wed Mar 04 06:20:02.708981 2026] [:error] [pid 54487:tid 54513] [client 52.252.56.196:64138] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system/logs/dz1.php"] [unique_id "aadekvN8030QMpFXdds4HAAAARg"]
[Wed Mar 04 06:20:03.114870 2026] [:error] [pid 54487:tid 54489] [client 52.252.56.196:64217] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system/logs/dz1.php"] [unique_id "aadek_N8030QMpFXdds4HwAAAQA"]
[Wed Mar 04 06:20:03.557043 2026] [:error] [pid 18555:tid 18638] [client 52.252.56.196:64225] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system/logs/dz1.php"] [unique_id "aadekzQeUDANiOsQ3Gd12AAAAJM"]
[Wed Mar 04 06:20:03.977095 2026] [:error] [pid 54487:tid 54500] [client 52.252.56.196:61386] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aadek_N8030QMpFXdds4IQAAAQs"]
[Wed Mar 04 06:20:04.481479 2026] [:error] [pid 18553:tid 18581] [client 52.252.56.196:62004] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aadelGbax1neh8d0AHaRIQAAABE"]
[Wed Mar 04 06:20:05.017946 2026] [:error] [pid 18555:tid 18632] [client 52.252.56.196:64232] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aadelTQeUDANiOsQ3Gd12QAAAI0"]
[Wed Mar 04 06:20:05.498293 2026] [:error] [pid 18554:tid 18613] [client 52.252.56.196:64140] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aadelZ0fKmKeTIK7QS2nPAAAAFU"]
[Wed Mar 04 06:20:05.924490 2026] [:error] [pid 18554:tid 18608] [client 52.252.56.196:64222] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aadelZ0fKmKeTIK7QS2nPwAAAFA"]
[Wed Mar 04 06:20:06.392824 2026] [:error] [pid 18553:tid 18566] [client 52.252.56.196:64184] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aadelmbax1neh8d0AHaRIwAAAAI"]
[Wed Mar 04 06:20:06.832966 2026] [:error] [pid 18554:tid 18616] [client 52.252.56.196:64243] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aadelp0fKmKeTIK7QS2nQAAAAFg"]
[Wed Mar 04 06:20:07.244897 2026] [:error] [pid 18553:tid 18564] [client 52.252.56.196:64185] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aadel2bax1neh8d0AHaRJQAAAAA"]
[Wed Mar 04 06:20:07.660914 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:64207] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aadel_N8030QMpFXdds4JAAAARI"]
[Wed Mar 04 06:20:08.095612 2026] [:error] [pid 54487:tid 54511] [client 52.252.56.196:62049] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aademPN8030QMpFXdds4JQAAARY"]
[Wed Mar 04 06:20:08.502937 2026] [:error] [pid 18681:tid 18697] [client 52.252.56.196:61426] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aademKE_TuZYUBveWkWiBgAAAM4"]
[Wed Mar 04 06:20:09.009893 2026] [:error] [pid 18681:tid 18686] [client 52.252.56.196:64132] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aademaE_TuZYUBveWkWiBwAAAMM"]
[Wed Mar 04 06:20:09.452355 2026] [:error] [pid 18681:tid 18687] [client 52.252.56.196:64169] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aademaE_TuZYUBveWkWiCQAAAMQ"]
[Wed Mar 04 06:20:09.925502 2026] [:error] [pid 18554:tid 18592] [client 52.252.56.196:64199] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aademZ0fKmKeTIK7QS2nQwAAAEA"]
[Wed Mar 04 06:20:10.349490 2026] [:error] [pid 54487:tid 54505] [client 52.252.56.196:62058] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aademvN8030QMpFXdds4JwAAARA"]
[Wed Mar 04 06:20:10.789288 2026] [:error] [pid 18554:tid 18604] [client 52.252.56.196:64228] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aademp0fKmKeTIK7QS2nRAAAAEw"]
[Wed Mar 04 06:20:11.207286 2026] [:error] [pid 18554:tid 18606] [client 52.252.56.196:64216] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/php-compat/chosen.php"] [unique_id "aadem50fKmKeTIK7QS2nRgAAAE4"]
[Wed Mar 04 06:20:11.681972 2026] [:error] [pid 18554:tid 18613] [client 52.252.56.196:64186] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aadem50fKmKeTIK7QS2nSQAAAFU"]
[Wed Mar 04 06:20:12.127317 2026] [:error] [pid 54487:tid 54503] [client 52.252.56.196:62079] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aadenPN8030QMpFXdds4KgAAAQ4"]
[Wed Mar 04 06:20:12.567071 2026] [:error] [pid 18554:tid 18596] [client 52.252.56.196:62021] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aadenJ0fKmKeTIK7QS2nTwAAAEQ"]
[Wed Mar 04 06:20:13.020879 2026] [:error] [pid 18554:tid 18612] [client 52.252.56.196:62048] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aadenZ0fKmKeTIK7QS2nUwAAAFQ"]
[Wed Mar 04 06:20:13.424148 2026] [:error] [pid 18555:tid 18636] [client 52.252.56.196:62063] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aadenTQeUDANiOsQ3Gd13wAAAJE"]
[Wed Mar 04 06:20:13.975848 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:62061] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aadenZ0fKmKeTIK7QS2nWQAAAEU"]
[Wed Mar 04 06:20:14.406375 2026] [:error] [pid 18554:tid 18600] [client 52.252.56.196:62071] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aadenp0fKmKeTIK7QS2nWwAAAEg"]
[Wed Mar 04 06:20:14.869181 2026] [:error] [pid 18553:tid 18583] [client 52.252.56.196:62055] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aadenmbax1neh8d0AHaROgAAABM"]
[Wed Mar 04 06:20:15.332255 2026] [:error] [pid 18554:tid 18592] [client 52.252.56.196:61966] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso112233a.php"] [unique_id "aaden50fKmKeTIK7QS2nXwAAAEA"]
[Wed Mar 04 06:20:15.758929 2026] [:error] [pid 54487:tid 54499] [client 52.252.56.196:61393] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso112233a.php"] [unique_id "aaden_N8030QMpFXdds4LQAAAQo"]
[Wed Mar 04 06:20:16.200804 2026] [:error] [pid 54487:tid 54504] [client 52.252.56.196:61383] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso112233a.php"] [unique_id "aadeoPN8030QMpFXdds4MAAAAQ8"]
[Wed Mar 04 06:20:16.603013 2026] [:error] [pid 18554:tid 18601] [client 52.252.56.196:64188] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso112233a.php"] [unique_id "aadeoJ0fKmKeTIK7QS2nYgAAAEk"]
[Wed Mar 04 06:20:17.025206 2026] [:error] [pid 54487:tid 54512] [client 52.252.56.196:62076] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.1-mysql-sk.php"] [unique_id "aadeofN8030QMpFXdds4MgAAARc"]
[Wed Mar 04 06:20:17.464689 2026] [:error] [pid 18681:tid 18697] [client 52.252.56.196:64246] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.1-mysql-sk.php"] [unique_id "aadeoaE_TuZYUBveWkWiEQAAAM4"]
[Wed Mar 04 06:20:17.895807 2026] [:error] [pid 18554:tid 18613] [client 52.252.56.196:61956] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.1-mysql-sk.php"] [unique_id "aadeoZ0fKmKeTIK7QS2nZwAAAFU"]
[Wed Mar 04 06:20:18.413927 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:62069] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer-4.3.1-mysql-sk.php"] [unique_id "aadeop0fKmKeTIK7QS2nbAAAAFI"]
[Wed Mar 04 06:20:18.838119 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:64254] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-apps.php"] [unique_id "aadeovN8030QMpFXdds4MwAAAQQ"]
[Wed Mar 04 06:20:19.256494 2026] [:error] [pid 18553:tid 18564] [client 52.252.56.196:64244] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-apps.php"] [unique_id "aadeo2bax1neh8d0AHaROwAAAAA"]
[Wed Mar 04 06:20:19.675253 2026] [:error] [pid 18554:tid 18613] [client 52.252.56.196:62028] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-apps.php"] [unique_id "aadeo50fKmKeTIK7QS2ncwAAAFU"]
[Wed Mar 04 06:20:20.148532 2026] [:error] [pid 18555:tid 18630] [client 52.252.56.196:64172] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/wp-apps.php"] [unique_id "aadepDQeUDANiOsQ3Gd15AAAAIs"]
[Wed Mar 04 06:20:20.632140 2026] [:error] [pid 54487:tid 54499] [client 52.252.56.196:61995] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asdf.php"] [unique_id "aadepPN8030QMpFXdds4OgAAAQo"]
[Wed Mar 04 06:20:21.158135 2026] [:error] [pid 18681:tid 18683] [client 52.252.56.196:64139] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asdf.php"] [unique_id "aadepaE_TuZYUBveWkWiFgAAAMA"]
[Wed Mar 04 06:20:21.888297 2026] [:error] [pid 18681:tid 18697] [client 52.252.56.196:64143] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asdf.php"] [unique_id "aadepaE_TuZYUBveWkWiGAAAAM4"]
[Wed Mar 04 06:20:22.422079 2026] [:error] [pid 18553:tid 18586] [client 52.252.56.196:64223] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asdf.php"] [unique_id "aadepmbax1neh8d0AHaRPQAAABY"]
[Wed Mar 04 06:20:22.907752 2026] [:error] [pid 18681:tid 18686] [client 52.252.56.196:62011] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pixelpages/application/views/auth/common/about.php7"] [unique_id "aadepqE_TuZYUBveWkWiHAAAAMM"]
[Wed Mar 04 06:20:23.320041 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:64150] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pixelpages/application/views/auth/common/about.php7"] [unique_id "aadep_N8030QMpFXdds4PwAAAQQ"]
[Wed Mar 04 06:20:23.779137 2026] [:error] [pid 18681:tid 18684] [client 52.252.56.196:61998] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pixelpages/application/views/auth/common/about.php7"] [unique_id "aadep6E_TuZYUBveWkWiHwAAAME"]
[Wed Mar 04 06:20:24.188443 2026] [:error] [pid 18681:tid 18683] [client 52.252.56.196:62047] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pixelpages/application/views/auth/common/about.php7"] [unique_id "aadeqKE_TuZYUBveWkWiIQAAAMA"]
[Wed Mar 04 06:20:24.588027 2026] [:error] [pid 54487:tid 54496] [client 52.252.56.196:64161] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/aaa.php"] [unique_id "aadeqPN8030QMpFXdds4QwAAAQc"]
[Wed Mar 04 06:20:25.021346 2026] [:error] [pid 54487:tid 54501] [client 52.252.56.196:64229] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/class-core-upgrader-first.php"] [unique_id "aadeqfN8030QMpFXdds4RAAAAQw"]
[Wed Mar 04 06:20:25.539529 2026] [:error] [pid 54487:tid 54490] [client 52.252.56.196:62054] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/class-core-upgrader-first.php"] [unique_id "aadeqfN8030QMpFXdds4SAAAAQE"]
[Wed Mar 04 06:20:26.021174 2026] [:error] [pid 18554:tid 18600] [client 52.252.56.196:64234] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/class-core-upgrader-first.php"] [unique_id "aadeqp0fKmKeTIK7QS2nfAAAAEg"]
[Wed Mar 04 06:20:26.482423 2026] [:error] [pid 18553:tid 18569] [client 52.252.56.196:64219] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/oQGWC1HLhE5.php"] [unique_id "aadeqmbax1neh8d0AHaRQAAAAAU"]
[Wed Mar 04 06:20:26.991924 2026] [:error] [pid 54487:tid 54511] [client 52.252.56.196:64201] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bar.php"] [unique_id "aadeqvN8030QMpFXdds4VgAAARY"]
[Wed Mar 04 06:20:27.438319 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:64240] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bar.php"] [unique_id "aadeq_N8030QMpFXdds4WwAAAQQ"]
[Wed Mar 04 06:20:27.845540 2026] [:error] [pid 54487:tid 54491] [client 52.252.56.196:62050] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bar.php"] [unique_id "aadeq_N8030QMpFXdds4XgAAAQI"]
[Wed Mar 04 06:20:28.293426 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:62070] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aaderPN8030QMpFXdds4YgAAARI"]
[Wed Mar 04 06:20:28.695610 2026] [:error] [pid 54487:tid 54503] [client 52.252.56.196:64183] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aaderPN8030QMpFXdds4aQAAAQ4"]
[Wed Mar 04 06:20:29.151683 2026] [:error] [pid 54487:tid 54511] [client 52.252.56.196:62045] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aaderfN8030QMpFXdds4awAAARY"]
[Wed Mar 04 06:20:29.575969 2026] [:error] [pid 54487:tid 54508] [client 52.252.56.196:62062] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aaderfN8030QMpFXdds4bQAAARM"]
[Wed Mar 04 06:20:30.021125 2026] [:error] [pid 18553:tid 18566] [client 52.252.56.196:62051] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enviar-recibo.php"] [unique_id "aadermbax1neh8d0AHaRRwAAAAI"]
[Wed Mar 04 06:20:30.420592 2026] [:error] [pid 18555:tid 18633] [client 52.252.56.196:64221] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enviar-recibo.php"] [unique_id "aaderjQeUDANiOsQ3Gd16wAAAI4"]
[Wed Mar 04 06:20:30.894861 2026] [:error] [pid 54487:tid 54489] [client 52.252.56.196:62043] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enviar-recibo.php"] [unique_id "aadervN8030QMpFXdds4cAAAAQA"]
[Wed Mar 04 06:20:31.358859 2026] [:error] [pid 54487:tid 54509] [client 52.252.56.196:61381] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enviar-recibo.php"] [unique_id "aader_N8030QMpFXdds4cwAAARQ"]
[Wed Mar 04 06:20:31.757501 2026] [:error] [pid 18553:tid 18577] [client 52.252.56.196:62053] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style.php"] [unique_id "aader2bax1neh8d0AHaRSQAAAA0"]
[Wed Mar 04 06:20:32.257204 2026] [:error] [pid 54487:tid 54508] [client 52.252.56.196:61962] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/gallery/20160513-delelott/photo-gallery/thumb/admin.php"] [unique_id "aadesPN8030QMpFXdds4dQAAARM"]
[Wed Mar 04 06:20:32.705737 2026] [:error] [pid 18553:tid 18578] [client 52.252.56.196:61961] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/gallery/20160513-delelott/photo-gallery/thumb/admin.php"] [unique_id "aadesGbax1neh8d0AHaRSgAAAA4"]
[Wed Mar 04 06:20:33.126327 2026] [:error] [pid 18555:tid 18625] [client 52.252.56.196:64136] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/gallery/20160513-delelott/photo-gallery/thumb/admin.php"] [unique_id "aadesTQeUDANiOsQ3Gd17wAAAIY"]
[Wed Mar 04 09:44:15.279281 2026] [:error] [pid 18681:tid 18702] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Wed Mar 04 09:44:15.491592 2026] [:error] [pid 18681:tid 18707] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 04 09:44:15.703378 2026] [:error] [pid 18681:tid 18699] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko-new.php
[Wed Mar 04 09:44:15.915289 2026] [:error] [pid 18681:tid 18706] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Mar 04 09:44:16.127322 2026] [:error] [pid 18681:tid 18683] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Mar 04 09:44:16.340469 2026] [:error] [pid 18681:tid 18695] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Wed Mar 04 09:44:16.554048 2026] [:error] [pid 18681:tid 18703] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Mar 04 09:44:16.767799 2026] [:error] [pid 18681:tid 18684] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Mar 04 09:44:16.980764 2026] [:error] [pid 18681:tid 18685] [client 137.116.32.109:18381] File does not exist: /usr/local/apache/htdocs/suspended-page/headers.php
[Wed Mar 04 09:44:17.403350 2026] [:error] [pid 18681:tid 18705] [client 137.116.32.109:18381] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aaeOcaE_TuZYUBveWkXnqgAAANY"]
[Wed Mar 04 09:44:17.812153 2026] [:error] [pid 18555:tid 18642] [client 137.116.32.109:18373] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aaeOcTQeUDANiOsQ3GenwQAAAJc"]
[Wed Mar 04 09:44:18.219922 2026] [:error] [pid 18554:tid 18592] [client 137.116.32.109:18409] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aaeOcp0fKmKeTIK7QS000QAAAEA"]
[Wed Mar 04 09:44:18.628238 2026] [:error] [pid 18554:tid 18606] [client 137.116.32.109:18397] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "aaeOcp0fKmKeTIK7QS001QAAAE4"]
[Wed Mar 04 09:44:19.036501 2026] [:error] [pid 18554:tid 18600] [client 137.116.32.109:18409] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cah.php"] [unique_id "aaeOc50fKmKeTIK7QS002gAAAEg"]
[Wed Mar 04 09:44:19.463467 2026] [:error] [pid 54487:tid 54510] [client 137.116.32.109:18408] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cah.php"] [unique_id "aaeOc_N8030QMpFXddvJzgAAARU"]
[Wed Mar 04 09:44:19.871893 2026] [:error] [pid 54487:tid 54495] [client 137.116.32.109:18416] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cah.php"] [unique_id "aaeOc_N8030QMpFXddvJ0wAAAQY"]
[Wed Mar 04 09:44:20.277523 2026] [:error] [pid 18555:tid 18620] [client 137.116.32.109:18383] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cah.php"] [unique_id "aaeOdDQeUDANiOsQ3GenxgAAAIE"]
[Wed Mar 04 09:44:20.678584 2026] [:error] [pid 18554:tid 18595] [client 137.116.32.109:18315] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "aaeOdJ0fKmKeTIK7QS004AAAAEM"]
[Wed Mar 04 09:44:21.086985 2026] [:error] [pid 54487:tid 54513] [client 137.116.32.109:18395] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-file.php"] [unique_id "aaeOdfN8030QMpFXddvJ4AAAARg"]
[Wed Mar 04 09:44:21.498045 2026] [:error] [pid 18681:tid 18705] [client 137.116.32.109:18380] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaeOdaE_TuZYUBveWkXnrwAAANY"]
[Wed Mar 04 09:44:21.907895 2026] [:error] [pid 18554:tid 18605] [client 137.116.32.109:18378] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaeOdZ0fKmKeTIK7QS004wAAAE0"]
[Wed Mar 04 09:44:22.316701 2026] [:error] [pid 54487:tid 54509] [client 137.116.32.109:18388] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaeOdvN8030QMpFXddvJ6QAAARQ"]
[Wed Mar 04 09:44:22.715993 2026] [:error] [pid 18681:tid 18699] [client 137.116.32.109:18376] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "aaeOdqE_TuZYUBveWkXnswAAANA"]
[Wed Mar 04 09:50:44.920110 2026] [:error] [pid 18681:tid 18691] [client 45.86.202.183:20355] [client 45.86.202.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aaeP9KE_TuZYUBveWkXqrwAAAMg"]
[Wed Mar 04 11:49:00.341788 2026] [:error] [pid 45947:tid 46040] [client 152.233.20.86:34126] [client 152.233.20.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aaerrEQXEtszYKy6savjawAAAUo"]
[Wed Mar 04 12:28:22.037338 2026] [:error] [pid 18553:tid 18583] [client 27.147.237.51:54130] [client 27.147.237.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.147.237.51, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aae05mbax1neh8d0AHbJVgAAABM"]
[Wed Mar 04 12:28:22.042811 2026] [:error] [pid 18553:tid 18583] [client 27.147.237.51:54130] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 05 02:06:11.342838 2026] [:error] [pid 26934:tid 26956] [client 200.220.167.148:50749] [client 200.220.167.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.220.167.148, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aah0k2DWd71V_nuoqWJCGAAAAIM"]
[Thu Mar 05 02:06:11.348238 2026] [:error] [pid 26934:tid 26956] [client 200.220.167.148:50749] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 05 15:42:28.470614 2026] [:error] [pid 62177:tid 62329] [client 103.106.20.169:63619] [client 103.106.20.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.106.20.169, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aakz5BWSQc2OzPrsnwWQaQAAAJE"]
[Thu Mar 05 15:42:28.475746 2026] [:error] [pid 62177:tid 62329] [client 103.106.20.169:63619] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 05 17:06:28.351879 2026] [:error] [pid 62173:tid 62266] [client 49.151.166.95:2530] [client 49.151.166.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.151.166.95, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aalHlGj_GWbFb-1ncGlohgAAAA0"]
[Thu Mar 05 17:06:28.356688 2026] [:error] [pid 62173:tid 62266] [client 49.151.166.95:2530] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 05 17:14:12.269998 2026] [:error] [pid 62177:tid 62335] [client 118.103.238.183:65054] [client 118.103.238.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.103.238.183, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aalJZBWSQc2OzPrsnwWobAAAAJc"]
[Thu Mar 05 17:14:12.274914 2026] [:error] [pid 62177:tid 62335] [client 118.103.238.183:65054] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 05 19:07:52.571098 2026] [:error] [pid 53350:tid 53378] [client 103.77.106.118:59942] [client 103.77.106.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aalkCKO0Baxc5WFYeP0CLQAAAQM"]
[Thu Mar 05 22:40:24.611285 2026] [:error] [pid 41459:tid 41478] [client 157.15.40.88:50074] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "aamV2OdFBZEnZ3pzxrWDjQAAAUQ"]
[Thu Mar 05 22:40:24.874386 2026] [:error] [pid 8151:tid 8242] [client 157.15.40.88:50092] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/txets.php"] [unique_id "aamV2JO3dLEidct1HvCn9AAAAZY"]
[Thu Mar 05 22:40:25.139559 2026] [:error] [pid 8151:tid 8217] [client 157.15.40.88:50119] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/txets.php"] [unique_id "aamV2ZO3dLEidct1HvCoAAAAAYA"]
[Thu Mar 05 22:40:25.395275 2026] [:error] [pid 62176:tid 62297] [client 157.15.40.88:50160] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/txets.php"] [unique_id "aamV2SNfTPJryi30JPkJYgAAAE0"]
[Thu Mar 05 22:40:25.645931 2026] [:error] [pid 8151:tid 8230] [client 157.15.40.88:50206] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/schallfuns.php"] [unique_id "aamV2ZO3dLEidct1HvCoKwAAAYs"]
[Thu Mar 05 22:40:25.905035 2026] [:error] [pid 62176:tid 62285] [client 157.15.40.88:50269] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/postnews.php"] [unique_id "aamV2SNfTPJryi30JPkJbgAAAEE"]
[Thu Mar 05 22:40:26.161595 2026] [:error] [pid 53350:tid 53394] [client 157.15.40.88:50336] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/postnews.php"] [unique_id "aamV2qO0Baxc5WFYeP2FFgAAARE"]
[Thu Mar 05 22:40:26.423104 2026] [:error] [pid 41459:tid 41486] [client 157.15.40.88:50411] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/postnews.php"] [unique_id "aamV2udFBZEnZ3pzxrWDvQAAAUw"]
[Thu Mar 05 22:40:26.694817 2026] [:error] [pid 41459:tid 41491] [client 157.15.40.88:50486] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/postnews.php"] [unique_id "aamV2udFBZEnZ3pzxrWD2gAAAVE"]
[Fri Mar 06 00:42:02.036225 2026] [:error] [pid 27687:tid 27712] [client 103.77.107.222:59294] [client 103.77.107.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "aamyWkI2IG23EwU7sL_-4QAAAIs"]
[Fri Mar 06 00:56:25.460974 2026] [:error] [pid 27687:tid 27708] [client 104.28.214.114:64241] [client 104.28.214.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "aam1uUI2IG23EwU7sL8K3AAAAIc"]
[Fri Mar 06 00:56:26.890206 2026] [:error] [pid 47657:tid 47901] [client 104.28.214.114:62967] [client 104.28.214.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/style.php"] [unique_id "aam1ui76-uV01o_084mJjAAAAAE"]
[Fri Mar 06 00:56:27.320959 2026] [:error] [pid 27687:tid 27702] [client 104.28.214.114:23662] [client 104.28.214.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "aam1u0I2IG23EwU7sL8K3wAAAIE"]
[Fri Mar 06 00:56:29.813539 2026] [:error] [pid 48372:tid 48388] [client 104.28.214.114:23663] [client 104.28.214.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/style.php"] [unique_id "aam1vUWaQyQyfhXPRrYMFgAAAUE"]
[Fri Mar 06 00:56:30.241601 2026] [:error] [pid 47665:tid 48034] [client 104.28.214.114:38252] [client 104.28.214.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style.php"] [unique_id "aam1vnvwcWrOi3qzRcd1TAAAANE"]
[Fri Mar 06 00:56:32.502860 2026] [:error] [pid 27687:tid 27716] [client 104.28.214.114:61321] [client 104.28.214.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "aam1wEI2IG23EwU7sL8K7gAAAI8"]
[Fri Mar 06 04:51:07.716901 2026] [:error] [pid 8945:tid 8977] [client 129.45.77.9:34036] [client 129.45.77.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.45.77.9, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aansuwttiLGNg13nMzLBmwAAAMo"]
[Fri Mar 06 04:51:07.722483 2026] [:error] [pid 8945:tid 8977] [client 129.45.77.9:34036] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 06 06:53:26.296511 2026] [:error] [pid 16140:tid 16165] [client 109.158.86.157:63661] [client 109.158.86.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.158.86.157, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaoJZpZVpEeGhAeSpv2SDQAAARc"]
[Fri Mar 06 06:53:26.304658 2026] [:error] [pid 16140:tid 16165] [client 109.158.86.157:63661] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 06 08:07:23.634164 2026] [:error] [pid 8656:tid 8824] [client 104.208.72.234:7939] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Mar 06 08:07:23.754894 2026] [:error] [pid 8656:tid 8814] [client 104.208.72.234:7939] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Mar 06 08:07:23.997539 2026] [:error] [pid 8656:tid 8822] [client 104.208.72.234:7939] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Mar 06 08:07:24.118647 2026] [:error] [pid 8656:tid 8830] [client 104.208.72.234:7939] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Mar 06 08:07:24.363988 2026] [:error] [pid 8656:tid 8820] [client 104.208.72.234:7939] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Mar 06 08:07:24.506113 2026] [:error] [pid 8656:tid 8813] [client 104.208.72.234:7939] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Mar 06 08:07:24.627531 2026] [:error] [pid 8656:tid 8812] [client 104.208.72.234:7939] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Mar 06 08:07:24.865869 2026] [:error] [pid 8656:tid 8815] [client 104.208.72.234:7939] [client 104.208.72.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaoavJPxTG9Ff1TtP6Mg9gAAAIU"]
[Fri Mar 06 08:07:25.342575 2026] [:error] [pid 16140:tid 16149] [client 104.208.72.234:7957] [client 104.208.72.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaoavZZVpEeGhAeSpv2r4QAAAQc"]
[Fri Mar 06 08:07:25.840723 2026] [:error] [pid 16140:tid 16164] [client 104.208.72.234:7658] [client 104.208.72.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaoavZZVpEeGhAeSpv2r4gAAARY"]
[Fri Mar 06 08:07:26.359269 2026] [:error] [pid 8945:tid 8987] [client 104.208.72.234:9277] [client 104.208.72.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "aaoavgttiLGNg13nMzIigAAAANQ"]
[Fri Mar 06 23:10:54.426059 2026] [:error] [pid 59237:tid 59266] [client 62.60.131.218:55981] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aarufuqfMSBs0nxOTxGYxQAAA5g"]
[Sat Mar 07 03:53:49.239196 2026] [:error] [pid 4307:tid 4403] [client 144.172.115.113:49433] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aaswzTeKp4wgnLc38f8_PQAAABU"], referer: https://www.bing.com
[Sat Mar 07 03:53:51.525536 2026] [:error] [pid 4311:tid 4434] [client 144.172.115.113:49968] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aaswz3byS653WMGf2vXV3gAAAE8"], referer: https://www.pinterest.com
[Sat Mar 07 03:53:54.641125 2026] [:error] [pid 4315:tid 4453] [client 144.172.115.113:50522] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aasw0tDEK9AXzxu9OSgHugAAAIY"], referer: https://www.baidu.com
[Sat Mar 07 03:53:57.020655 2026] [:error] [pid 4315:tid 4470] [client 144.172.115.113:51003] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aasw1dDEK9AXzxu9OSgHvgAAAJU"], referer: https://www.booking.com
[Sat Mar 07 09:56:52.014747 2026] [:error] [pid 52484:tid 52511] [client 20.219.23.223:2539] File does not exist: /usr/local/apache/htdocs/suspended-page/xmr.php
[Sat Mar 07 09:56:52.157961 2026] [:error] [pid 52484:tid 52520] [client 20.219.23.223:2539] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Mar 07 09:56:52.300555 2026] [:error] [pid 52484:tid 52508] [client 20.219.23.223:2539] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Mar 07 09:56:52.443148 2026] [:error] [pid 52484:tid 52516] [client 20.219.23.223:2539] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Mar 07 09:56:52.585084 2026] [:error] [pid 52484:tid 52503] [client 20.219.23.223:2539] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Mar 07 09:56:52.729354 2026] [:error] [pid 52484:tid 52507] [client 20.219.23.223:2539] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sat Mar 07 09:56:52.868482 2026] [:error] [pid 52484:tid 52522] [client 20.219.23.223:2539] [client 20.219.23.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aauF5PE9AnX6zUICFeSelgAAARI"]
[Sat Mar 07 09:56:53.454024 2026] [:error] [pid 52484:tid 52519] [client 20.219.23.223:2940] [client 20.219.23.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aauF5fE9AnX6zUICFeSemgAAAQ8"]
[Sat Mar 07 09:56:54.048357 2026] [:error] [pid 52484:tid 52510] [client 20.219.23.223:2904] [client 20.219.23.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aauF5vE9AnX6zUICFeSenQAAAQc"]
[Sat Mar 07 09:56:54.634217 2026] [:error] [pid 4609:tid 4646] [client 20.219.23.223:2491] [client 20.219.23.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aauF5uP7JMxUbw4Fd1afmAAAANI"]
[Sat Mar 07 13:05:22.240698 2026] [:error] [pid 4609:tid 4647] [client 169.150.203.245:49607] [client 169.150.203.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.245, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aauyEuP7JMxUbw4Fd1b1UwAAANM"]
[Sat Mar 07 13:05:22.245984 2026] [:error] [pid 4609:tid 4647] [client 169.150.203.245:49607] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 07 13:05:24.181360 2026] [:error] [pid 4609:tid 4629] [client 169.150.203.245:49607] [client 169.150.203.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aauyFOP7JMxUbw4Fd1b1XwAAAME"]
[Sat Mar 07 13:05:24.522750 2026] [:error] [pid 52484:tid 52508] [client 169.150.203.245:60512] [client 169.150.203.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aauyFPE9AnX6zUICFeQsCwAAAQU"]
[Sat Mar 07 13:05:24.860883 2026] [:error] [pid 52484:tid 52523] [client 169.150.203.245:60514] [client 169.150.203.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aauyFPE9AnX6zUICFeQsDwAAARM"]
[Sat Mar 07 13:05:25.200001 2026] [:error] [pid 52484:tid 52507] [client 169.150.203.245:60518] [client 169.150.203.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aauyFfE9AnX6zUICFeQsEwAAAQQ"]
[Sat Mar 07 13:05:25.541089 2026] [:error] [pid 52484:tid 52508] [client 169.150.203.245:60534] [client 169.150.203.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aauyFfE9AnX6zUICFeQsFAAAAQU"]
[Sat Mar 07 13:05:25.877092 2026] [:error] [pid 52484:tid 52513] [client 169.150.203.245:60540] [client 169.150.203.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aauyFfE9AnX6zUICFeQsFgAAAQo"]
[Sat Mar 07 13:05:26.211836 2026] [:error] [pid 52484:tid 52512] [client 169.150.203.245:60546] [client 169.150.203.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aauyFvE9AnX6zUICFeQsFwAAAQk"]
[Sat Mar 07 14:37:31.909804 2026] [:error] [pid 52484:tid 52505] [client 34.24.47.138:49725] [client 34.24.47.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "aavHq_E9AnX6zUICFeRcmAAAAQI"]
[Sat Mar 07 14:50:36.696267 2026] [:error] [pid 4311:tid 4421] [client 182.9.1.78:30186] [client 182.9.1.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.9.1.78, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aavKvHbyS653WMGf2vVKFgAAAEI"]
[Sat Mar 07 14:50:36.701710 2026] [:error] [pid 4311:tid 4421] [client 182.9.1.78:30186] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 07 17:29:52.659959 2026] [:error] [pid 37998:tid 38058] [client 89.163.146.197:58169] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: www.google.com
[Sat Mar 07 17:30:04.069036 2026] [:error] [pid 4311:tid 4432] [client 89.163.146.197:58230] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: www.google.com
[Sun Mar 08 01:59:40.261772 2026] [:error] [pid 42362:tid 42389] [client 74.244.222.148:60950] [client 74.244.222.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.222.148, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aaxnjK-bLI2XD-bK6dCzCwAAAJM"]
[Sun Mar 08 01:59:40.275021 2026] [:error] [pid 42362:tid 42389] [client 74.244.222.148:60950] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 08 15:13:52.844101 2026] [:error] [pid 22788:tid 22877] [client 92.54.209.160:24914] [client 92.54.209.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.54.209.160, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa0hsEhwluk21OG9mSeJRwAAA5Y"]
[Sun Mar 08 15:13:52.850173 2026] [:error] [pid 22788:tid 22877] [client 92.54.209.160:24914] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 08 15:16:00.371630 2026] [:error] [pid 22786:tid 22818] [client 83.24.168.1:60017] [client 83.24.168.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.24.168.1, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa0iMHPuJewMN2jPbdWLfgAAAxE"]
[Sun Mar 08 15:16:00.383361 2026] [:error] [pid 22786:tid 22818] [client 83.24.168.1:60017] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 08 15:19:08.734530 2026] [:error] [pid 22790:tid 22905] [client 59.96.3.2:1943] [client 59.96.3.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.96.3.2, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa0i7BXbGDWrzD_dTOeFygAAA9c"]
[Sun Mar 08 15:19:08.739170 2026] [:error] [pid 22790:tid 22905] [client 59.96.3.2:1943] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 09 04:11:46.761036 2026] [:error] [pid 17485:tid 17498] [client 125.236.224.23:55700] [client 125.236.224.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.236.224.23, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa3YAtQOL_kxQEc1PTAw-AAAAQo"]
[Mon Mar 09 04:11:46.766245 2026] [:error] [pid 17485:tid 17498] [client 125.236.224.23:55700] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 09 07:38:29.078655 2026] [:error] [pid 5783:tid 5900] [client 20.211.123.94:4865] File does not exist: /usr/local/apache/htdocs/suspended-page/xmr.php
[Mon Mar 09 07:38:29.100786 2026] [:error] [pid 5783:tid 5903] [client 20.211.123.94:4865] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Mar 09 07:38:29.121141 2026] [:error] [pid 5783:tid 5910] [client 20.211.123.94:4865] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 09 07:38:29.140602 2026] [:error] [pid 5783:tid 5918] [client 20.211.123.94:4865] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon Mar 09 07:38:29.160810 2026] [:error] [pid 5783:tid 5908] [client 20.211.123.94:4865] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Mar 09 07:38:29.181339 2026] [:error] [pid 5783:tid 5916] [client 20.211.123.94:4865] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Mon Mar 09 07:38:29.197558 2026] [:error] [pid 5783:tid 5905] [client 20.211.123.94:4865] [client 20.211.123.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aa4IdQdiZJ1FQPtsTNQbpgAAAEs"]
[Mon Mar 09 07:38:29.348498 2026] [:error] [pid 17485:tid 17511] [client 20.211.123.94:3168] [client 20.211.123.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aa4IddQOL_kxQEc1PTDO2wAAARc"]
[Mon Mar 09 07:38:29.447753 2026] [:error] [pid 17485:tid 17488] [client 20.211.123.94:3338] [client 20.211.123.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aa4IddQOL_kxQEc1PTDO3gAAAQA"]
[Mon Mar 09 07:38:29.510962 2026] [:error] [pid 17485:tid 17499] [client 20.211.123.94:3163] [client 20.211.123.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "aa4IddQOL_kxQEc1PTDO3wAAAQs"]
[Mon Mar 09 13:53:15.185518 2026] [:error] [pid 2145:tid 2184] [client 198.163.193.135:34538] [client 198.163.193.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.163.193.135, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa5gS3czzpD9XHtKwuDxYgAAAVA"]
[Mon Mar 09 13:53:15.191813 2026] [:error] [pid 2145:tid 2184] [client 198.163.193.135:34538] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 09 13:53:48.817669 2026] [:error] [pid 17485:tid 17511] [client 223.184.170.66:32300] [client 223.184.170.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.184.170.66, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa5gbNQOL_kxQEc1PTAvkgAAARc"]
[Mon Mar 09 13:53:48.832315 2026] [:error] [pid 17485:tid 17511] [client 223.184.170.66:32300] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 09 19:09:41.440264 2026] [:error] [pid 5787:tid 5926] [client 106.219.74.35:3277] [client 106.219.74.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.74.35, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa6qdbGpMgQ18gGUaFOnowAAAIQ"]
[Mon Mar 09 19:09:41.447437 2026] [:error] [pid 5787:tid 5926] [client 106.219.74.35:3277] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 10 02:06:30.930909 2026] [:error] [pid 64775:tid 64804] [client 41.76.192.13:61941] [client 41.76.192.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.76.192.13, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa8MJuD6wJvkR_jrqnWzgwAAARg"]
[Tue Mar 10 02:06:30.937290 2026] [:error] [pid 64775:tid 64804] [client 41.76.192.13:61941] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 10 05:23:21.599473 2026] [:error] [pid 32149:tid 32166] [client 62.60.131.218:57944] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aa86SWdqak0GlFD4uMIfywAAAQY"]
[Tue Mar 10 05:40:48.616574 2026] [:error] [pid 7912:tid 8065] [client 62.60.131.218:62080] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "aa8-YCV7wJYuQ3GZEAVylwAAAIE"]
[Tue Mar 10 06:15:08.675502 2026] [:error] [pid 7908:tid 8049] [client 93.123.109.124:58440] [client 93.123.109.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/favicon.ico"] [unique_id "aa9GbMY8gEjgYKb1A_jPeAAAAE4"]
[Tue Mar 10 11:23:31.156693 2026] [:error] [pid 42730:tid 42732] [client 14.139.196.136:61073] [client 14.139.196.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.139.196.136, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa-Os8hla5zfkJ-81FAw3QAAAcA"]
[Tue Mar 10 11:23:31.162403 2026] [:error] [pid 42730:tid 42732] [client 14.139.196.136:61073] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 10 14:06:48.643063 2026] [:error] [pid 42666:tid 42679] [client 41.90.123.253:49315] [client 41.90.123.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.90.123.253, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aa-0-I0d5emjo-Hs706RZgAAAQs"]
[Tue Mar 10 14:06:48.648606 2026] [:error] [pid 42666:tid 42679] [client 41.90.123.253:49315] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
2026/03/10 18:23:10 [error] 14455#14455: *14953 openat() "/usr/local/apache/htdocs/suspended-page/xmlrpc.php" failed (2: No such file or directory), client: 5.31.197.193, server: aoswa.com.au, request: "POST /xmlrpc.php HTTP/1.1", host: "aoswa.com.au"
2026/03/10 19:55:54 [error] 14458#14458: *84532 openat() "/usr/local/apache/htdocs/suspended-page/themes/tenant/css/purple-login.css" failed (2: No such file or directory), client: 46.229.60.150, server: aoswa.com.au, request: "GET /themes/tenant/css/purple-login.css HTTP/1.1", host: "aoswa.com.au"
2026/03/10 20:08:02 [error] 14458#14458: *93756 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/v3/payment_gateways" failed (2: No such file or directory), client: 79.127.155.168, server: aoswa.com.au, request: "GET /wp-json/wc/v3/payment_gateways HTTP/1.1", host: "aoswa.com.au"
2026/03/10 20:08:03 [error] 14457#14457: *93762 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/v2/payment_gateways" failed (2: No such file or directory), client: 79.127.155.168, server: aoswa.com.au, request: "GET /wp-json/wc/v2/payment_gateways HTTP/1.1", host: "aoswa.com.au"
2026/03/10 20:08:03 [error] 14458#14458: *93776 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/store/v1/cart" failed (2: No such file or directory), client: 79.127.155.168, server: aoswa.com.au, request: "GET /wp-json/wc/store/v1/cart HTTP/1.1", host: "aoswa.com.au"
2026/03/10 20:08:04 [error] 14455#14455: *93787 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/store/v1/payment_methods" failed (2: No such file or directory), client: 79.127.155.168, server: aoswa.com.au, request: "GET /wp-json/wc/store/v1/payment_methods HTTP/1.1", host: "aoswa.com.au"
2026/03/10 21:18:50 [error] 3833#3833: *146802 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 66.249.75.105, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/10 23:52:19 [error] 3843#3843: *257552 openat() "/usr/local/apache/htdocs/suspended-page/xmlrpc.php" failed (2: No such file or directory), client: 213.186.183.40, server: aoswa.com.au, request: "POST /xmlrpc.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 00:53:10 [error] 6427#6427: *301447 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 74.7.244.52, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "www.aoswa.com.au"
2026/03/11 00:53:54 [error] 6422#6422: *301804 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 66.249.75.100, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/11 02:41:47 [error] 6425#6425: *379990 openat() "/usr/local/apache/htdocs/suspended-page/xmlrpc.php" failed (2: No such file or directory), client: 109.178.25.17, server: aoswa.com.au, request: "POST /xmlrpc.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 05:17:36 [error] 3463#3463: *486215 openat() "/usr/local/apache/htdocs/suspended-page/favicon.ico" failed (2: No such file or directory), client: 194.187.178.8, server: aoswa.com.au, request: "GET /favicon.ico HTTP/1.1", host: "aoswa.com.au"
2026/03/11 05:33:28 [error] 3470#3470: *497897 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 51.68.111.216, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/11 06:17:40 [error] 3471#3471: *525254 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 74.7.228.26, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/11 07:48:34 [error] 3469#3469: *581448 openat() "/usr/local/apache/htdocs/suspended-page/wp-login.php" failed (2: No such file or directory), client: 209.87.169.85, server: aoswa.com.au, request: "GET /wp-login.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 09:54:05 [error] 53943#53943: *649742 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 93.158.90.36, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:18 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/wp-content/plugins/hellopress/wp_filemanager.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:18 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/ws81.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /ws81.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:18 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/hnikt.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /hnikt.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:18 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/awh.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /awh.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:19 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/js.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /js.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:19 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/34.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /34.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:19 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/rafa.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /rafa.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:19 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/gu.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /gu.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:19 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/wp-wlx.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /wp-wlx.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:20 [error] 53945#53945: *674407 openat() "/usr/local/apache/autossl_tmp/.well-known/acme-challenge/gu.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /.well-known/pki-validation/gu.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:20 [error] 53945#53945: *674407 openat() "/usr/local/apache/autossl_tmp/.well-known/acme-challenge/rafa.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /.well-known/pki-validation/rafa.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:20 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/wp-content/themes/pridmag/js.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /wp-content/themes/pridmag/js.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 10:40:20 [error] 53945#53945: *674407 openat() "/usr/local/apache/htdocs/suspended-page/wp-content/themes/pridmag/34.php" failed (2: No such file or directory), client: 40.70.24.180, server: aoswa.com.au, request: "GET /wp-content/themes/pridmag/34.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 12:20:32 [error] 53946#53946: *736600 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 54.39.210.190, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/11 15:45:26 [error] 53942#53942: *865256 openat() "/usr/local/apache/htdocs/suspended-page/gto.php" failed (2: No such file or directory), client: 145.239.10.137, server: aoswa.com.au, request: "GET /gto.php HTTP/1.1", host: "aoswa.com.au", referrer: "http://aoswa.com.au/gto.php"
2026/03/11 15:45:26 [error] 53948#53948: *865258 openat() "/usr/local/apache/htdocs/suspended-page/opsn.php" failed (2: No such file or directory), client: 145.239.10.137, server: aoswa.com.au, request: "GET /opsn.php HTTP/1.1", host: "aoswa.com.au", referrer: "http://aoswa.com.au/opsn.php"
2026/03/11 15:46:30 [error] 53946#53946: *866014 openat() "/usr/local/apache/htdocs/suspended-page/gt.php" failed (2: No such file or directory), client: 145.239.10.137, server: aoswa.com.au, request: "GET /gt.php HTTP/1.1", host: "aoswa.com.au", referrer: "http://aoswa.com.au/gt.php"
2026/03/11 15:46:31 [error] 53944#53944: *866018 openat() "/usr/local/apache/htdocs/suspended-page/gg.php" failed (2: No such file or directory), client: 145.239.10.137, server: aoswa.com.au, request: "GET /gg.php HTTP/1.1", host: "aoswa.com.au", referrer: "http://aoswa.com.au/gg.php"
2026/03/11 17:38:32 [error] 53947#53947: *947693 openat() "/usr/local/apache/htdocs/suspended-page/xmlrpc.php" failed (2: No such file or directory), client: 102.223.33.103, server: aoswa.com.au, request: "POST /xmlrpc.php HTTP/1.1", host: "aoswa.com.au"
2026/03/11 22:45:19 [error] 53948#53948: *1172649 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 81.167.26.57, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/12 02:37:35 [error] 53401#53401: *1336283 openat() "/usr/local/apache/htdocs/suspended-page/xmlrpc.php" failed (2: No such file or directory), client: 103.153.66.233, server: aoswa.com.au, request: "POST /xmlrpc.php HTTP/1.1", host: "aoswa.com.au"
2026/03/12 02:40:16 [error] 53473#53473: *1338159 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 173.252.87.2, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
2026/03/12 02:40:17 [error] 53500#53500: *1338174 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 173.252.87.114, server: aoswa.com.au, request: "GET /robots.txt HTTP/1.1", host: "aoswa.com.au"
[Thu Mar 12 07:11:29.498059 2026] [:error] [pid 51457:tid 51538] [client 187.19.156.59:23292] [client 187.19.156.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.19.156.59, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abH2oSjknw2FvT4H3DZrRQAAAJg"]
[Thu Mar 12 07:11:29.504787 2026] [:error] [pid 51457:tid 51538] [client 187.19.156.59:23292] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 12 09:33:00.846550 2026] [:error] [pid 51455:tid 51477] [client 104.28.153.126:17343] [client 104.28.153.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "abIXzJE0YyNxdg6PL_AX5gAAABE"]
[Thu Mar 12 13:06:21.877092 2026] [:error] [pid 22063:tid 22085] [client 182.48.221.242:43866] [client 182.48.221.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.48.221.242, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abJJza0RUhS-MJyHWLS6mQAAAhQ"]
[Thu Mar 12 13:06:21.882031 2026] [:error] [pid 22063:tid 22085] [client 182.48.221.242:43866] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 12 13:07:37.510405 2026] [:error] [pid 8249:tid 8260] [client 175.158.203.213:43268] [client 175.158.203.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.158.203.213, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abJKGSK5dL3-8Jdf0M1S3AAAAQk"]
[Thu Mar 12 13:07:37.520489 2026] [:error] [pid 8249:tid 8260] [client 175.158.203.213:43268] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 12 18:23:31.914774 2026] [:error] [pid 8249:tid 8269] [client 103.65.236.149:62770] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "abKUIyK5dL3-8Jdf0M0JZAAAARI"]
[Thu Mar 12 18:24:08.961071 2026] [:error] [pid 11985:tid 12009] [client 173.239.240.150:28747] [client 173.239.240.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.150, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abKUSHcAcNujsOssVDcU8gAAAZI"]
[Thu Mar 12 18:24:08.965052 2026] [:error] [pid 11985:tid 12009] [client 173.239.240.150:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Mar 12 21:39:37.576983 2026] [:error] [pid 11953:tid 11957] [client 37.111.214.222:59936] [client 37.111.214.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.111.214.222, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abLCGZudzqsnq3bvtDZS4QAAAUI"]
[Thu Mar 12 21:39:37.582646 2026] [:error] [pid 11953:tid 11957] [client 37.111.214.222:59936] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 13 00:00:07.805883 2026] [:error] [pid 11953:tid 11969] [client 172.245.102.1:45283] [client 172.245.102.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.1, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abLjB5udzqsnq3bvtDaR4AAAAU4"]
[Fri Mar 13 00:00:07.809485 2026] [:error] [pid 11953:tid 11969] [client 172.245.102.1:45283] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 13 00:55:00.031961 2026] [:error] [pid 48029:tid 48035] [client 45.199.187.112:57974] [client 45.199.187.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.199.187.112, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abLv5G7cFKMmtdGhPH-2RQAAAAQ"]
[Fri Mar 13 00:55:00.037522 2026] [:error] [pid 48029:tid 48035] [client 45.199.187.112:57974] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 13 01:01:20.645303 2026] [:error] [pid 47894:tid 48002] [client 23.92.70.5:54228] [client 23.92.70.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.92.70.5, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abLxYJiuFpRtVNR6uOJ1_QAAAQA"]
[Fri Mar 13 01:01:20.650624 2026] [:error] [pid 47894:tid 48002] [client 23.92.70.5:54228] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 13 09:50:26.449146 2026] [:error] [pid 55077:tid 55102] [client 209.87.169.132:32801] [client 209.87.169.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.132, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abNtYt9Ul5ym4M-PlQJV1AAAAVc"]
[Fri Mar 13 09:50:26.454065 2026] [:error] [pid 55077:tid 55102] [client 209.87.169.132:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 13 11:01:30.021549 2026] [:error] [pid 9241:tid 9278] [client 152.237.147.64:10779] [client 152.237.147.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.237.147.64, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abN-Cg48xagB6AsXkJ7a8wAAAdg"]
[Fri Mar 13 11:01:30.027693 2026] [:error] [pid 9241:tid 9278] [client 152.237.147.64:10779] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 13 11:03:07.874770 2026] [:error] [pid 9311:tid 9351] [client 143.105.233.194:15991] [client 143.105.233.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.233.194, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abN-a1TiCkU4QLmYwPm7VQAAAkA"]
[Fri Mar 13 11:03:07.883075 2026] [:error] [pid 9311:tid 9351] [client 143.105.233.194:15991] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 13 14:06:10.228665 2026] [:error] [pid 9309:tid 9332] [client 136.144.35.60:41427] [client 136.144.35.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.35.60, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abOpUqo1KEMMghNWAN-_ugAAAgk"]
[Fri Mar 13 14:06:10.232212 2026] [:error] [pid 9309:tid 9332] [client 136.144.35.60:41427] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 13 22:37:10.118410 2026] [:error] [pid 60497:tid 60543] [client 104.194.152.134:54828] File does not exist: /usr/local/apache/htdocs/suspended-page/unzipper.php
[Fri Mar 13 23:46:22.540314 2026] [:error] [pid 60398:tid 60417] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Fri Mar 13 23:46:22.749903 2026] [:error] [pid 60398:tid 60422] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Mar 13 23:46:22.959612 2026] [:error] [pid 60398:tid 60420] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Mar 13 23:46:23.169474 2026] [:error] [pid 60398:tid 60409] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Mar 13 23:46:23.379288 2026] [:error] [pid 60398:tid 60412] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Mar 13 23:46:23.589042 2026] [:error] [pid 60398:tid 60424] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Fri Mar 13 23:46:23.798787 2026] [:error] [pid 60398:tid 60410] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Mar 13 23:46:24.009952 2026] [:error] [pid 60398:tid 60427] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/nux.php
[Fri Mar 13 23:46:24.219644 2026] [:error] [pid 60398:tid 60416] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Fri Mar 13 23:46:24.429315 2026] [:error] [pid 60398:tid 60422] [client 20.151.4.179:33231] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Fri Mar 13 23:46:24.635504 2026] [:error] [pid 60398:tid 60411] [client 20.151.4.179:33231] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "abQxUECJdGSTt6QlH2BhQQAAAog"]
[Fri Mar 13 23:46:25.463900 2026] [:error] [pid 61928:tid 61997] [client 20.151.4.179:33310] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "abQxUQod66AHekJJZiqzGgAAAFQ"]
[Fri Mar 13 23:46:26.298417 2026] [:error] [pid 55077:tid 55089] [client 20.151.4.179:33232] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "abQxUt9Ul5ym4M-PlQIEKgAAAUo"]
[Fri Mar 13 23:46:27.125988 2026] [:error] [pid 9111:tid 9144] [client 20.151.4.179:33301] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chati.php"] [unique_id "abQxU0-M156SLpD2BrtfsQAAAZI"]
[Sat Mar 14 01:23:11.667377 2026] [:error] [pid 47878:tid 47944] [client 94.128.154.132:30721] [client 94.128.154.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.128.154.132, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abRH_38jymmmpr1jcBerjAAAAEU"]
[Sat Mar 14 01:23:11.682169 2026] [:error] [pid 47878:tid 47944] [client 94.128.154.132:30721] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 14 01:24:57.364641 2026] [:error] [pid 47891:tid 47978] [client 4.204.233.55:51465] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abRIafchNnuMqi7I_WH2_gAAAIw"]
[Sat Mar 14 01:24:58.192046 2026] [:error] [pid 48070:tid 48092] [client 4.204.233.55:51463] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abRIakIvrhMS5BVHxNkbaQAAABQ"]
[Sat Mar 14 01:24:59.048423 2026] [:error] [pid 47891:tid 47980] [client 4.204.233.55:51685] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abRIa_chNnuMqi7I_WH3AQAAAI4"]
[Sat Mar 14 01:24:59.878985 2026] [:error] [pid 48070:tid 48093] [client 4.204.233.55:51696] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abRIa0IvrhMS5BVHxNkbbQAAABU"]
[Sat Mar 14 01:32:25.650552 2026] [:error] [pid 47905:tid 48004] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat Mar 14 01:32:25.858951 2026] [:error] [pid 47905:tid 48015] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Sat Mar 14 01:32:26.104405 2026] [:error] [pid 47905:tid 48013] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Mar 14 01:32:26.312828 2026] [:error] [pid 47905:tid 47996] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Mar 14 01:32:26.521454 2026] [:error] [pid 47905:tid 48003] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Mar 14 01:32:26.733187 2026] [:error] [pid 47905:tid 47993] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Mar 14 01:32:26.940997 2026] [:error] [pid 47905:tid 48005] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Mar 14 01:32:27.148751 2026] [:error] [pid 47905:tid 48016] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sat Mar 14 01:32:27.357102 2026] [:error] [pid 47905:tid 47999] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sat Mar 14 01:32:27.565591 2026] [:error] [pid 47905:tid 48002] [client 4.204.197.4:23542] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Mar 14 01:32:27.777992 2026] [:error] [pid 47905:tid 48011] [client 4.204.197.4:23542] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "abRKKxaYZayP4o4wpJckbgAAAVI"]
[Sat Mar 14 01:32:28.188797 2026] [:error] [pid 47878:tid 47960] [client 4.204.197.4:23527] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "abRKLH8jymmmpr1jcBeuSAAAAFU"]
[Sat Mar 14 01:32:28.602391 2026] [:error] [pid 48070:tid 48093] [client 4.204.197.4:23507] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "abRKLEIvrhMS5BVHxNkgowAAABU"]
[Sat Mar 14 01:32:29.016623 2026] [:error] [pid 47878:tid 47950] [client 4.204.197.4:23531] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "abRKLX8jymmmpr1jcBeuSgAAAEs"]
[Sat Mar 14 01:32:29.446485 2026] [:error] [pid 48070:tid 48081] [client 4.204.197.4:23503] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "abRKLUIvrhMS5BVHxNkgqAAAAAk"]
[Sat Mar 14 01:32:29.860368 2026] [:error] [pid 48070:tid 48095] [client 4.204.197.4:23520] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "abRKLUIvrhMS5BVHxNkgqgAAABc"]
[Sat Mar 14 01:32:30.271077 2026] [:error] [pid 48070:tid 48086] [client 4.204.197.4:23504] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "abRKLkIvrhMS5BVHxNkgrQAAAA4"]
[Sat Mar 14 01:32:30.683576 2026] [:error] [pid 47878:tid 47957] [client 4.204.197.4:23522] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shell.php"] [unique_id "abRKLn8jymmmpr1jcBeuTAAAAFI"]
[Sat Mar 14 01:32:31.107624 2026] [:error] [pid 47878:tid 47952] [client 4.204.197.4:23547] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "abRKL38jymmmpr1jcBeuUAAAAE0"]
[Sat Mar 14 01:32:31.518917 2026] [:error] [pid 47878:tid 47959] [client 4.204.197.4:23526] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "abRKL38jymmmpr1jcBeuUgAAAFQ"]
[Sat Mar 14 01:32:31.933043 2026] [:error] [pid 47878:tid 47960] [client 4.204.197.4:23512] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "abRKL38jymmmpr1jcBeuVAAAAFU"]
[Sat Mar 14 01:32:32.362298 2026] [:error] [pid 47891:tid 47979] [client 4.204.197.4:23427] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "abRKMPchNnuMqi7I_WH5TwAAAI0"]
[Sat Mar 14 01:32:32.802939 2026] [:error] [pid 48070:tid 48093] [client 4.204.197.4:23505] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "abRKMEIvrhMS5BVHxNkgsAAAABU"]
[Sat Mar 14 01:32:33.214201 2026] [:error] [pid 47878:tid 47958] [client 4.204.197.4:23518] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "abRKMX8jymmmpr1jcBeuVwAAAFM"]
[Sat Mar 14 01:32:33.624386 2026] [:error] [pid 47905:tid 48013] [client 4.204.197.4:23525] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "abRKMRaYZayP4o4wpJckdgAAAVQ"]
[Sat Mar 14 01:32:34.040208 2026] [:error] [pid 47905:tid 47999] [client 4.204.197.4:23424] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "abRKMhaYZayP4o4wpJckegAAAUY"]
[Sat Mar 14 01:32:34.458547 2026] [:error] [pid 48070:tid 48087] [client 4.204.197.4:23548] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "abRKMkIvrhMS5BVHxNkgswAAAA8"]
[Sat Mar 14 01:32:35.015984 2026] [:error] [pid 48070:tid 48080] [client 4.204.197.4:23516] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "abRKM0IvrhMS5BVHxNkgtgAAAAg"]
[Sat Mar 14 01:32:35.501941 2026] [:error] [pid 48070:tid 48078] [client 4.204.197.4:23436] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "abRKM0IvrhMS5BVHxNkgugAAAAY"]
[Sat Mar 14 01:32:36.027275 2026] [:error] [pid 47905:tid 47998] [client 4.204.197.4:23550] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin.php"] [unique_id "abRKNBaYZayP4o4wpJckgQAAAUU"]
[Sat Mar 14 01:32:36.474081 2026] [:error] [pid 47905:tid 47994] [client 4.204.197.4:23524] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "abRKNBaYZayP4o4wpJckgwAAAUE"]
[Sat Mar 14 01:32:36.955133 2026] [:error] [pid 47905:tid 48012] [client 4.204.197.4:23471] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "abRKNBaYZayP4o4wpJckhAAAAVM"]
[Sat Mar 14 01:32:37.390959 2026] [:error] [pid 47905:tid 47993] [client 4.204.197.4:23501] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "abRKNRaYZayP4o4wpJckhgAAAUA"]
[Sat Mar 14 01:32:37.807140 2026] [:error] [pid 47905:tid 48016] [client 4.204.197.4:23528] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "abRKNRaYZayP4o4wpJckhwAAAVc"]
[Sat Mar 14 01:32:38.225575 2026] [:error] [pid 47878:tid 47944] [client 4.204.197.4:23442] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "abRKNn8jymmmpr1jcBeuWgAAAEU"]
[Sat Mar 14 01:32:38.643029 2026] [:error] [pid 47905:tid 48001] [client 4.204.197.4:23460] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "abRKNhaYZayP4o4wpJckigAAAUg"]
[Sat Mar 14 01:32:39.074788 2026] [:error] [pid 47878:tid 47941] [client 4.204.197.4:23521] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "abRKN38jymmmpr1jcBeuXQAAAEI"]
[Sat Mar 14 01:32:39.514796 2026] [:error] [pid 47905:tid 48004] [client 4.204.197.4:23366] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "abRKNxaYZayP4o4wpJckjQAAAUs"]
[Sat Mar 14 01:32:39.927171 2026] [:error] [pid 47905:tid 48013] [client 4.204.197.4:23443] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRKNxaYZayP4o4wpJckjgAAAVQ"]
[Sat Mar 14 01:32:40.346981 2026] [:error] [pid 48070:tid 48078] [client 4.204.197.4:23529] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRKOEIvrhMS5BVHxNkgxAAAAAY"]
[Sat Mar 14 01:32:40.763107 2026] [:error] [pid 48070:tid 48092] [client 4.204.197.4:23443] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRKOEIvrhMS5BVHxNkgxgAAABQ"]
[Sat Mar 14 01:32:41.178252 2026] [:error] [pid 47891:tid 47982] [client 4.204.197.4:23467] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRKOfchNnuMqi7I_WH5UQAAAJA"]
[Sat Mar 14 01:32:41.593804 2026] [:error] [pid 47905:tid 47993] [client 4.204.197.4:23506] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "abRKORaYZayP4o4wpJckkgAAAUA"]
[Sat Mar 14 01:32:42.004889 2026] [:error] [pid 47905:tid 48007] [client 4.204.197.4:23519] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "abRKOhaYZayP4o4wpJcklQAAAU4"]
[Sat Mar 14 01:32:42.429821 2026] [:error] [pid 48070:tid 48087] [client 4.204.197.4:23530] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "abRKOkIvrhMS5BVHxNkgzwAAAA8"]
[Sat Mar 14 01:32:42.842676 2026] [:error] [pid 48070:tid 48078] [client 4.204.197.4:23539] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "abRKOkIvrhMS5BVHxNkg0AAAAAY"]
[Sat Mar 14 01:32:43.259726 2026] [:error] [pid 48070:tid 48072] [client 4.204.197.4:23444] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "abRKO0IvrhMS5BVHxNkg1QAAAAA"]
[Sat Mar 14 01:32:43.671823 2026] [:error] [pid 48070:tid 48094] [client 4.204.197.4:23523] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "abRKO0IvrhMS5BVHxNkg1wAAABY"]
[Sat Mar 14 01:32:44.082797 2026] [:error] [pid 48070:tid 48086] [client 4.204.197.4:23538] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "abRKPEIvrhMS5BVHxNkg2AAAAA4"]
[Sat Mar 14 01:32:44.493331 2026] [:error] [pid 48070:tid 48093] [client 4.204.197.4:23546] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up.php"] [unique_id "abRKPEIvrhMS5BVHxNkg2QAAABU"]
[Sat Mar 14 01:32:44.912764 2026] [:error] [pid 48070:tid 48087] [client 4.204.197.4:23545] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "abRKPEIvrhMS5BVHxNkg3QAAAA8"]
[Sat Mar 14 01:32:45.338877 2026] [:error] [pid 48070:tid 48073] [client 4.204.197.4:23369] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "abRKPUIvrhMS5BVHxNkg4gAAAAE"]
[Sat Mar 14 01:32:45.762435 2026] [:error] [pid 48070:tid 48084] [client 4.204.197.4:23398] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "abRKPUIvrhMS5BVHxNkg5wAAAAw"]
[Sat Mar 14 01:32:46.174865 2026] [:error] [pid 48070:tid 48093] [client 4.204.197.4:23469] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "abRKPkIvrhMS5BVHxNkg6wAAABU"]
[Sat Mar 14 03:36:43.546557 2026] [:error] [pid 48070:tid 48092] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Sat Mar 14 03:36:43.787142 2026] [:error] [pid 48070:tid 48095] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/hnikt.php
[Sat Mar 14 03:36:44.082822 2026] [:error] [pid 48070:tid 48076] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/awh.php
[Sat Mar 14 03:36:44.406339 2026] [:error] [pid 48070:tid 48082] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/js.php
[Sat Mar 14 03:36:44.647671 2026] [:error] [pid 48070:tid 48074] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/34.php
[Sat Mar 14 03:36:44.888319 2026] [:error] [pid 48070:tid 48086] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/rafa.php
[Sat Mar 14 03:36:45.127738 2026] [:error] [pid 48070:tid 48087] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/gu.php
[Sat Mar 14 03:36:45.368194 2026] [:error] [pid 48070:tid 48096] [client 20.203.171.169:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-wlx.php
[Sat Mar 14 03:36:46.092495 2026] [:error] [pid 48070:tid 48073] [client 20.203.171.169:12494] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/js.php"] [unique_id "abRnTkIvrhMS5BVHxNlIfAAAAAE"]
[Sat Mar 14 03:36:47.131960 2026] [:error] [pid 47891:tid 47969] [client 20.203.171.169:15253] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/js.php"] [unique_id "abRnT_chNnuMqi7I_WE88AAAAIM"]
[Sat Mar 14 03:36:48.525281 2026] [:error] [pid 47905:tid 47997] [client 20.203.171.169:12518] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/js.php"] [unique_id "abRnUBaYZayP4o4wpJdTpAAAAUQ"]
[Sat Mar 14 03:36:49.308040 2026] [:error] [pid 47891:tid 47970] [client 20.203.171.169:15240] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/js.php"] [unique_id "abRnUfchNnuMqi7I_WE9AQAAAIQ"]
[Sat Mar 14 03:36:50.666960 2026] [:error] [pid 48070:tid 48081] [client 20.203.171.169:14797] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/34.php"] [unique_id "abRnUkIvrhMS5BVHxNlIhQAAAAk"]
[Sat Mar 14 03:36:51.259116 2026] [:error] [pid 47891:tid 47988] [client 20.203.171.169:29875] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/34.php"] [unique_id "abRnU_chNnuMqi7I_WE9CgAAAJY"]
[Sat Mar 14 03:36:51.803497 2026] [:error] [pid 48070:tid 48090] [client 20.203.171.169:29877] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/34.php"] [unique_id "abRnU0IvrhMS5BVHxNlIiQAAABI"]
[Sat Mar 14 03:36:52.614012 2026] [:error] [pid 47905:tid 48016] [client 20.203.171.169:12492] [client 20.203.171.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/pridmag/34.php"] [unique_id "abRnVBaYZayP4o4wpJdTqgAAAVc"]
[Sat Mar 14 04:38:46.571061 2026] [:error] [pid 3913:tid 3963] [client 104.234.53.75:24839] [client 104.234.53.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.75, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abR11h9qvQd4GQHUp6_yYAAAAEY"]
[Sat Mar 14 04:38:46.574787 2026] [:error] [pid 3913:tid 3963] [client 104.234.53.75:24839] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Mar 14 13:39:15.208290 2026] [:error] [pid 13262:tid 13311] [client 104.236.46.246:43618] [client 104.236.46.246] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/favicon.ico"] [unique_id "abT0gzAdvM7ft5BXQ2ecawAAAZI"]
[Sat Mar 14 13:39:15.620049 2026] [:error] [pid 13360:tid 13378] [client 104.236.46.246:43634] [client 104.236.46.246] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/robots.txt"] [unique_id "abT0g_oSWtMry3M5X6sS_QAAAo4"]
[Sat Mar 14 13:39:16.025795 2026] [:error] [pid 54132:tid 54147] [client 104.236.46.246:56146] [client 104.236.46.246] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/favicon.ico"] [unique_id "abT0hMMoWcZxtn8Rxy9aoAAAA0o"]
[Sat Mar 14 13:39:16.897337 2026] [:error] [pid 3912:tid 3943] [client 104.236.46.246:56162] [client 104.236.46.246] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/robots.txt"] [unique_id "abT0hMXFZBK-jpdCvTEQRgAAABA"]
[Sat Mar 14 13:39:48.025688 2026] [:error] [pid 54017:tid 54030] [client 167.71.87.2:48252] [client 167.71.87.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/favicon.ico"] [unique_id "abT0pJh88Lk5QZp0lWWKewAAAkY"]
[Sat Mar 14 13:39:48.437292 2026] [:error] [pid 13261:tid 13280] [client 167.71.87.2:48256] [client 167.71.87.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/robots.txt"] [unique_id "abT0pPDFVxjWSW61p5kiggAAAM4"]
[Sat Mar 14 13:39:48.849752 2026] [:error] [pid 13360:tid 13380] [client 167.71.87.2:52466] [client 167.71.87.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/favicon.ico"] [unique_id "abT0pPoSWtMry3M5X6sTTAAAApA"]
[Sat Mar 14 13:39:49.672397 2026] [:error] [pid 13360:tid 13373] [client 167.71.87.2:52480] [client 167.71.87.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/robots.txt"] [unique_id "abT0pfoSWtMry3M5X6sTUQAAAok"]
[Sat Mar 14 15:17:25.962931 2026] [:error] [pid 61477:tid 61505] [client 196.75.252.177:58465] [client 196.75.252.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.75.252.177, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abULhacx6muYfIYRM7CDWAAAAFg"]
[Sat Mar 14 15:17:25.967692 2026] [:error] [pid 61477:tid 61505] [client 196.75.252.177:58465] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 14 17:49:52.011096 2026] [:error] [pid 13151:tid 13160] [client 136.232.89.206:54235] [client 136.232.89.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.89.206, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abUvQNbXrXQxFzrsw404HQAAAIc"]
[Sat Mar 14 17:49:52.019052 2026] [:error] [pid 13151:tid 13160] [client 136.232.89.206:54235] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 15 08:20:27.920921 2026] [:error] [pid 38541:tid 38635] [client 217.165.159.190:53846] [client 217.165.159.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.165.159.190, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abX7S3uOpex8jIO0jt4IugAAAJY"]
[Sun Mar 15 08:20:27.925618 2026] [:error] [pid 38541:tid 38635] [client 217.165.159.190:53846] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 15 10:52:05.067657 2026] [:error] [pid 50986:tid 51007] [client 212.30.33.86:41073] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 15 10:52:05.482014 2026] [:error] [pid 50986:tid 51007] [client 212.30.33.86:41073] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 15 10:52:05.912201 2026] [:error] [pid 50986:tid 51007] [client 212.30.33.86:41073] [client 212.30.33.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "abYe1SknK4c779bcQqECggAAAVI"]
[Sun Mar 15 10:52:06.723022 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 15 10:52:07.126928 2026] [:error] [pid 9995:tid 9999] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Mar 15 10:52:07.528511 2026] [:error] [pid 9995:tid 10001] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 15 10:52:07.935997 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Mar 15 10:52:08.339312 2026] [:error] [pid 9995:tid 10001] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 15 10:52:08.745039 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 15 10:52:09.150206 2026] [:error] [pid 9995:tid 10007] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 15 10:52:09.557333 2026] [:error] [pid 9995:tid 10018] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Mar 15 10:52:09.960436 2026] [:error] [pid 9995:tid 10001] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Mar 15 10:52:10.363812 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Mar 15 10:52:10.768442 2026] [:error] [pid 9995:tid 10016] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Mar 15 10:52:11.180885 2026] [:error] [pid 9995:tid 10018] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Mar 15 10:52:11.582721 2026] [:error] [pid 9995:tid 10013] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Mar 15 10:52:11.989061 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 15 10:52:12.394574 2026] [:error] [pid 9995:tid 10018] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sun Mar 15 10:52:12.798482 2026] [:error] [pid 9995:tid 10005] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sun Mar 15 10:52:13.204616 2026] [:error] [pid 9995:tid 10000] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Mar 15 10:52:13.605356 2026] [:error] [pid 9995:tid 10011] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Mar 15 10:52:14.012672 2026] [:error] [pid 9995:tid 10022] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/warm.PhP
[Sun Mar 15 10:52:14.416504 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Mar 15 10:52:14.824404 2026] [:error] [pid 9995:tid 10013] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Mar 15 10:52:15.242313 2026] [:error] [pid 9995:tid 10002] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Mar 15 10:52:15.648024 2026] [:error] [pid 9995:tid 10021] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Mar 15 10:52:16.068930 2026] [:error] [pid 9995:tid 10011] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Mar 15 10:52:16.474157 2026] [:error] [pid 9995:tid 10000] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 15 10:52:16.878133 2026] [:error] [pid 9995:tid 10005] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Mar 15 10:52:17.279405 2026] [:error] [pid 9995:tid 10022] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Mar 15 10:52:17.685099 2026] [:error] [pid 9995:tid 10004] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Mar 15 10:52:18.103569 2026] [:error] [pid 9995:tid 10016] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Mar 15 10:52:18.513623 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Mar 15 10:52:19.059009 2026] [:error] [pid 9995:tid 10017] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Mar 15 10:52:19.463817 2026] [:error] [pid 9995:tid 10012] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Mar 15 10:52:19.866850 2026] [:error] [pid 9995:tid 10000] [client 212.30.33.72:43673] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Mar 15 10:52:20.283368 2026] [:error] [pid 9995:tid 10011] [client 212.30.33.72:43673] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "abYe5Aa8xkcaSmgTbwhGaAAAAQ0"]
[Sun Mar 15 10:52:21.113711 2026] [:error] [pid 38536:tid 38575] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Mar 15 10:52:21.537818 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Mar 15 10:52:21.952665 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Mar 15 10:52:22.376623 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Mar 15 10:52:22.793912 2026] [:error] [pid 38536:tid 38570] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Mar 15 10:52:23.211613 2026] [:error] [pid 38536:tid 38556] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Mar 15 10:52:23.630324 2026] [:error] [pid 38536:tid 38557] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Mar 15 10:52:24.049449 2026] [:error] [pid 38536:tid 38570] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Mar 15 10:52:24.480521 2026] [:error] [pid 38536:tid 38572] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 15 10:52:24.905707 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Mar 15 10:52:25.325639 2026] [:error] [pid 38536:tid 38557] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 15 10:52:25.741130 2026] [:error] [pid 38536:tid 38566] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Mar 15 10:52:26.157655 2026] [:error] [pid 38536:tid 38577] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Mar 15 10:52:26.574819 2026] [:error] [pid 38536:tid 38554] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Mar 15 10:52:26.989203 2026] [:error] [pid 38536:tid 38564] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Mar 15 10:52:27.403896 2026] [:error] [pid 38536:tid 38554] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/exit.php
[Sun Mar 15 10:52:27.821308 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Mar 15 10:52:28.240742 2026] [:error] [pid 38536:tid 38572] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Mar 15 10:52:28.656944 2026] [:error] [pid 38536:tid 38562] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Mar 15 10:52:29.094101 2026] [:error] [pid 38536:tid 38556] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Mar 15 10:52:29.508750 2026] [:error] [pid 38536:tid 38559] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Sun Mar 15 10:52:30.348881 2026] [:error] [pid 38536:tid 38557] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Mar 15 10:52:30.887247 2026] [:error] [pid 38536:tid 38575] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Mar 15 10:52:31.303788 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Mar 15 10:52:31.762882 2026] [:error] [pid 38536:tid 38554] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Mar 15 10:52:32.211880 2026] [:error] [pid 38536:tid 38559] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Mar 15 10:52:32.638166 2026] [:error] [pid 38536:tid 38556] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Mar 15 10:52:33.060411 2026] [:error] [pid 38536:tid 38564] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Mar 15 10:52:33.898275 2026] [:error] [pid 38536:tid 38564] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Mar 15 10:52:34.738907 2026] [:error] [pid 38536:tid 38557] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Mar 15 10:52:35.158462 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Mar 15 10:52:35.575914 2026] [:error] [pid 38536:tid 38572] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Mar 15 10:52:35.993094 2026] [:error] [pid 38536:tid 38577] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Mar 15 10:52:36.414850 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Mar 15 10:52:36.832438 2026] [:error] [pid 38536:tid 38564] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Mar 15 10:52:37.254808 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Mar 15 10:52:37.670939 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Mar 15 10:52:38.087713 2026] [:error] [pid 38536:tid 38575] [client 212.30.33.225:55925] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Mar 15 10:52:38.503361 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.225:55925] [client 212.30.33.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "abYe9vpTEqkVJ0rBEWvc0QAAAA4"]
[Sun Mar 15 10:52:39.329893 2026] [:error] [pid 9995:tid 9999] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Mar 15 10:52:39.747614 2026] [:error] [pid 9995:tid 9999] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Mar 15 10:52:40.165442 2026] [:error] [pid 9995:tid 10007] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Mar 15 10:52:40.580650 2026] [:error] [pid 9995:tid 10020] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 15 10:52:40.996333 2026] [:error] [pid 9995:tid 10011] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Mar 15 10:52:41.409380 2026] [:error] [pid 9995:tid 10008] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Mar 15 10:52:41.825185 2026] [:error] [pid 9995:tid 10018] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Mar 15 10:52:42.238520 2026] [:error] [pid 9995:tid 10003] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Mar 15 10:52:43.072318 2026] [:error] [pid 9995:tid 10006] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Mar 15 10:52:43.900010 2026] [:error] [pid 9995:tid 10002] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Mar 15 10:52:44.319450 2026] [:error] [pid 9995:tid 10018] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Mar 15 10:52:44.734718 2026] [:error] [pid 9995:tid 10015] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Mar 15 10:52:45.150127 2026] [:error] [pid 9995:tid 10019] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Mar 15 10:52:45.579336 2026] [:error] [pid 9995:tid 10000] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Mar 15 10:52:46.002761 2026] [:error] [pid 9995:tid 10002] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Mar 15 10:52:46.420526 2026] [:error] [pid 9995:tid 10019] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Mar 15 10:52:46.838396 2026] [:error] [pid 9995:tid 10015] [client 212.30.33.90:45781] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Mar 15 10:52:47.668081 2026] [:error] [pid 9995:tid 10019] [client 212.30.33.90:45781] [client 212.30.33.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "abYe_wa8xkcaSmgTbwhHpQAAARU"]
[Sun Mar 15 10:52:48.483493 2026] [:error] [pid 45801:tid 45824] [client 212.30.33.90:58537] [client 212.30.33.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "abYfAIaKHL9CTKoVzTDFbAAAAdU"]
[Sun Mar 15 10:52:51.723761 2026] [:error] [pid 38540:tid 38609] [client 212.30.33.69:26767] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "abYfA18bnHsJ1dE90bI4yQAAAFc"]
[Sun Mar 15 10:52:52.925555 2026] [:error] [pid 45801:tid 45812] [client 212.30.33.179:42625] [client 212.30.33.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "abYfBIaKHL9CTKoVzTDFkgAAAck"]
[Sun Mar 15 10:52:54.543780 2026] [:error] [pid 50986:tid 51009] [client 212.30.33.60:41297] [client 212.30.33.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "abYfBiknK4c779bcQqED-AAAAVQ"]
[Sun Mar 15 10:52:57.872050 2026] [:error] [pid 9995:tid 10000] [client 212.30.33.71:50293] [client 212.30.33.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "abYfCQa8xkcaSmgTbwhH6QAAAQI"]
[Sun Mar 15 10:52:59.490636 2026] [:error] [pid 38540:tid 38610] [client 212.30.33.62:30629] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sun Mar 15 10:52:59.890915 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.62:30629] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "abYfC18bnHsJ1dE90bI5FwAAAEI"]
[Sun Mar 15 10:53:02.126186 2026] [:error] [pid 45974:tid 45998] [client 212.30.33.93:43055] [client 212.30.33.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "abYfDhWn4R6u72SegehDUQAAAhY"]
[Sun Mar 15 10:53:03.783752 2026] [:error] [pid 42570:tid 42589] [client 212.30.33.92:35113] [client 212.30.33.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "abYfD8IUXZJLmk_gYCO56AAAAZA"]
[Sun Mar 15 10:53:05.428170 2026] [:error] [pid 45974:tid 45989] [client 212.30.33.73:27753] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "abYfERWn4R6u72SegehDbQAAAg0"]
[Sun Mar 15 10:53:06.252489 2026] [:error] [pid 38645:tid 38664] [client 212.30.33.52:27623] [client 212.30.33.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "abYfEhFPHtsDUuVrWDbHHQAAANE"]
[Sun Mar 15 10:53:07.473783 2026] [:error] [pid 45801:tid 45827] [client 212.30.33.179:27869] [client 212.30.33.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "abYfE4aKHL9CTKoVzTDGCQAAAdg"]
[Sun Mar 15 10:53:09.138623 2026] [:error] [pid 38540:tid 38605] [client 212.30.33.229:28165] [client 212.30.33.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "abYfFV8bnHsJ1dE90bI5ZgAAAFM"]
[Sun Mar 15 10:53:09.939735 2026] [:error] [pid 38645:tid 38658] [client 212.30.33.59:53205] [client 212.30.33.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "abYfFRFPHtsDUuVrWDbHQAAAAMs"]
[Sun Mar 15 10:53:10.752250 2026] [:error] [pid 38645:tid 38662] [client 212.30.33.90:20977] [client 212.30.33.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "abYfFhFPHtsDUuVrWDbHTAAAAM8"]
[Sun Mar 15 10:53:12.368997 2026] [:error] [pid 42570:tid 42595] [client 212.30.33.51:41527] [client 212.30.33.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "abYfGMIUXZJLmk_gYCO6IQAAAZY"]
[Sun Mar 15 10:53:13.171358 2026] [:error] [pid 42570:tid 42583] [client 212.30.33.100:61785] [client 212.30.33.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "abYfGcIUXZJLmk_gYCO6IwAAAYo"]
[Sun Mar 15 10:53:14.033480 2026] [:error] [pid 45801:tid 45810] [client 212.30.33.54:49515] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "abYfGoaKHL9CTKoVzTDGMgAAAcc"]
[Sun Mar 15 10:53:14.858964 2026] [:error] [pid 45974:tid 45976] [client 212.30.33.69:36827] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "abYfGhWn4R6u72SegehD4gAAAgA"]
[Sun Mar 15 10:53:15.688054 2026] [:error] [pid 38645:tid 38664] [client 212.30.33.80:26023] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "abYfGxFPHtsDUuVrWDbHcAAAANE"]
[Sun Mar 15 10:53:16.911619 2026] [:error] [pid 42570:tid 42593] [client 212.30.33.74:39655] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "abYfHMIUXZJLmk_gYCO6QAAAAZQ"]
[Sun Mar 15 10:53:17.758578 2026] [:error] [pid 50986:tid 51001] [client 212.30.33.68:25453] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "abYfHSknK4c779bcQqEExAAAAUw"]
[Sun Mar 15 10:53:18.599907 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.54:48415] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "abYfHhFPHtsDUuVrWDbHhAAAAMk"]
[Sun Mar 15 10:53:19.836709 2026] [:error] [pid 9995:tid 10001] [client 212.30.33.84:55461] [client 212.30.33.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "abYfHwa8xkcaSmgTbwhIgwAAAQM"]
[Sun Mar 15 10:53:21.476869 2026] [:error] [pid 38536:tid 38566] [client 212.30.33.77:32297] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "abYfIfpTEqkVJ0rBEWveYgAAAA0"]
[Sun Mar 15 10:53:22.285046 2026] [:error] [pid 38536:tid 38553] [client 212.30.33.79:23471] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "abYfIvpTEqkVJ0rBEWvecAAAAAA"]
[Sun Mar 15 10:53:25.581173 2026] [:error] [pid 38645:tid 38648] [client 212.30.33.69:57113] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "abYfJRFPHtsDUuVrWDbH2QAAAME"]
[Sun Mar 15 10:53:28.846875 2026] [:error] [pid 38541:tid 38632] [client 212.30.33.80:44383] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "abYfKHuOpex8jIO0jt5RXgAAAJM"]
[Sun Mar 15 10:53:29.676972 2026] [:error] [pid 38536:tid 38575] [client 212.30.33.72:48599] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "abYfKfpTEqkVJ0rBEWvelgAAABY"]
[Sun Mar 15 10:53:30.477438 2026] [:error] [pid 38540:tid 38600] [client 212.30.33.190:54383] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "abYfKl8bnHsJ1dE90bI50wAAAE4"]
[Sun Mar 15 10:53:31.283151 2026] [:error] [pid 45974:tid 45989] [client 212.30.33.190:62077] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Mar 15 10:53:33.302910 2026] [:error] [pid 45974:tid 45983] [client 212.30.33.190:62077] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "abYfLRWn4R6u72SegehEaAAAAgc"]
[Sun Mar 15 10:53:34.938952 2026] [:error] [pid 9995:tid 10015] [client 212.30.33.73:54147] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "abYfLga8xkcaSmgTbwhI6AAAARE"]
[Sun Mar 15 10:53:36.568847 2026] [:error] [pid 45801:tid 45820] [client 212.30.33.79:28525] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "abYfMIaKHL9CTKoVzTDG0AAAAdE"]
[Sun Mar 15 10:53:38.782830 2026] [:error] [pid 45801:tid 45825] [client 212.30.33.66:48313] [client 212.30.33.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "abYfMoaKHL9CTKoVzTDG4AAAAdY"]
[Sun Mar 15 10:53:39.618162 2026] [:error] [pid 50986:tid 51008] [client 212.30.33.84:53943] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Mar 15 10:53:41.257109 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.84:53943] [client 212.30.33.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "abYfNSknK4c779bcQqEFogAAAVY"]
[Sun Mar 15 10:53:42.055054 2026] [:error] [pid 38645:tid 38667] [client 212.30.33.96:45799] [client 212.30.33.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "abYfNhFPHtsDUuVrWDbITQAAANQ"]
[Sun Mar 15 10:53:43.716746 2026] [:error] [pid 38645:tid 38650] [client 212.30.33.213:56637] [client 212.30.33.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "abYfNxFPHtsDUuVrWDbIXAAAAMM"]
[Sun Mar 15 10:53:44.579516 2026] [:error] [pid 38541:tid 38623] [client 212.30.33.54:31263] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "abYfOHuOpex8jIO0jt5R0QAAAIo"]
[Sun Mar 15 10:53:46.695129 2026] [:error] [pid 42570:tid 42590] [client 212.30.33.60:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Mar 15 10:53:48.363126 2026] [:error] [pid 42570:tid 42589] [client 212.30.33.60:29153] [client 212.30.33.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "abYfPMIUXZJLmk_gYCO7agAAAZA"]
[Sun Mar 15 10:53:49.199762 2026] [:error] [pid 45801:tid 45814] [client 212.30.33.97:21911] [client 212.30.33.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "abYfPYaKHL9CTKoVzTDHGwAAAcs"]
[Sun Mar 15 10:53:50.855997 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.79:55193] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "abYfPhFPHtsDUuVrWDbI5gAAAMk"]
[Sun Mar 15 10:53:51.685137 2026] [:error] [pid 45974:tid 45989] [client 212.30.33.76:30603] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "abYfPxWn4R6u72SegehE6gAAAg0"]
[Sun Mar 15 10:53:54.225391 2026] [:error] [pid 45801:tid 45826] [client 212.30.33.83:53151] [client 212.30.33.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "abYfQoaKHL9CTKoVzTDHRQAAAdc"]
[Sun Mar 15 10:53:55.469040 2026] [:error] [pid 38540:tid 38609] [client 212.30.33.52:35703] [client 212.30.33.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "abYfQ18bnHsJ1dE90bI6UAAAAFc"]
[Sun Mar 15 10:53:57.102355 2026] [:error] [pid 50986:tid 51001] [client 212.30.33.85:20085] [client 212.30.33.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "abYfRSknK4c779bcQqEGHAAAAUw"]
[Sun Mar 15 10:53:57.917229 2026] [:error] [pid 38541:tid 38620] [client 212.30.33.65:31607] [client 212.30.33.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "abYfRXuOpex8jIO0jt5SFwAAAIc"]
[Sun Mar 15 10:53:58.737386 2026] [:error] [pid 38645:tid 38662] [client 212.30.33.94:40835] [client 212.30.33.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "abYfRhFPHtsDUuVrWDbJFQAAAM8"]
[Sun Mar 15 10:53:59.552079 2026] [:error] [pid 38536:tid 38572] [client 212.30.33.51:24793] [client 212.30.33.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "abYfR_pTEqkVJ0rBEWvfFAAAABM"]
[Sun Mar 15 10:54:01.227276 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.60:20645] [client 212.30.33.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "abYfSV8bnHsJ1dE90bI6YQAAAEY"]
[Sun Mar 15 10:54:02.882869 2026] [:error] [pid 45974:tid 45980] [client 212.30.33.103:34445] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Mar 15 10:54:06.995617 2026] [:error] [pid 45974:tid 45993] [client 212.30.33.103:34445] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "abYfThWn4R6u72SegehFoQAAAhE"]
[Sun Mar 15 10:54:09.890940 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.53:28095] [client 212.30.33.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "abYfUXuOpex8jIO0jt5SOgAAAJU"]
[Sun Mar 15 10:54:10.692323 2026] [:error] [pid 45801:tid 45827] [client 212.30.33.88:57347] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "abYfUoaKHL9CTKoVzTDHxAAAAdg"]
[Sun Mar 15 10:54:11.906686 2026] [:error] [pid 45974:tid 45993] [client 212.30.33.52:46145] [client 212.30.33.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "abYfUxWn4R6u72SegehFxgAAAhE"]
[Sun Mar 15 10:54:13.927053 2026] [:error] [pid 50986:tid 51007] [client 212.30.33.70:46685] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Mar 15 10:54:14.750512 2026] [:error] [pid 50986:tid 51005] [client 212.30.33.70:46685] [client 212.30.33.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "abYfViknK4c779bcQqEG3QAAAVA"]
[Sun Mar 15 10:54:15.998134 2026] [:error] [pid 38540:tid 38596] [client 212.30.33.100:20311] [client 212.30.33.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "abYfV18bnHsJ1dE90bI6qAAAAEo"]
[Sun Mar 15 10:54:17.214088 2026] [:error] [pid 38645:tid 38651] [client 212.30.33.88:63511] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "abYfWRFPHtsDUuVrWDbJuAAAAMQ"]
[Sun Mar 15 10:54:18.433965 2026] [:error] [pid 45801:tid 45827] [client 212.30.33.63:62875] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "abYfWoaKHL9CTKoVzTDIDgAAAdg"]
[Sun Mar 15 10:54:20.104025 2026] [:error] [pid 45801:tid 45805] [client 212.30.33.57:30531] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "abYfXIaKHL9CTKoVzTDIJwAAAcI"]
[Sun Mar 15 10:54:20.940011 2026] [:error] [pid 42570:tid 42592] [client 212.30.33.56:22455] [client 212.30.33.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "abYfXMIUXZJLmk_gYCO8QwAAAZM"]
[Sun Mar 15 10:54:23.371021 2026] [:error] [pid 50986:tid 50996] [client 212.30.33.57:25621] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "abYfXyknK4c779bcQqEHPQAAAUc"]
[Sun Mar 15 10:54:25.905166 2026] [:error] [pid 38536:tid 38561] [client 212.30.33.72:55177] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "abYfYfpTEqkVJ0rBEWvfmgAAAAg"]
[Sun Mar 15 10:54:26.755662 2026] [:error] [pid 45974:tid 45988] [client 212.30.33.58:44629] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Mar 15 10:54:28.854628 2026] [:error] [pid 45974:tid 45980] [client 212.30.33.58:44629] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Mar 15 10:54:31.338995 2026] [:error] [pid 45974:tid 45981] [client 212.30.33.58:44629] [client 212.30.33.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "abYfZxWn4R6u72SegehGpQAAAgU"]
[Sun Mar 15 10:54:32.136179 2026] [:error] [pid 42570:tid 42585] [client 212.30.33.91:30561] [client 212.30.33.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ln/wp-login.php"] [unique_id "abYfaMIUXZJLmk_gYCO8dwAAAYw"]
[Sun Mar 15 10:54:33.340961 2026] [:error] [pid 45974:tid 45976] [client 212.30.33.73:32641] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "abYfaRWn4R6u72SegehGsgAAAgA"]
[Sun Mar 15 10:54:34.160019 2026] [:error] [pid 38645:tid 38663] [client 212.30.33.57:25925] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "abYfahFPHtsDUuVrWDbKKgAAANA"]
[Sun Mar 15 10:54:35.433486 2026] [:error] [pid 38540:tid 38594] [client 212.30.33.84:22345] [client 212.30.33.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.84, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "abYfa18bnHsJ1dE90bI7NAAAAEg"]
[Sun Mar 15 10:54:35.855030 2026] [:error] [pid 38540:tid 38603] [client 212.30.33.84:22345] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Mar 15 10:54:38.337570 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.84:22345] [client 212.30.33.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "abYfbl8bnHsJ1dE90bI7TQAAAEY"]
[Sun Mar 15 10:54:39.562332 2026] [:error] [pid 45801:tid 45803] [client 212.30.33.77:43893] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sun Mar 15 10:54:39.965415 2026] [:error] [pid 45801:tid 45815] [client 212.30.33.77:43893] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "abYfb4aKHL9CTKoVzTDInAAAAcw"]
[Sun Mar 15 10:54:41.627928 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.99:49181] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky.php"] [unique_id "abYfcV8bnHsJ1dE90bI7awAAAEI"]
[Sun Mar 15 10:54:42.438765 2026] [:error] [pid 38536:tid 38556] [client 212.30.33.61:45449] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "abYfcvpTEqkVJ0rBEWvf3QAAAAM"]
[Sun Mar 15 10:54:43.254103 2026] [:error] [pid 50986:tid 50998] [client 212.30.33.55:63049] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "abYfcyknK4c779bcQqEIFwAAAUk"]
[Sun Mar 15 10:54:44.078124 2026] [:error] [pid 45974:tid 45979] [client 212.30.33.89:40191] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Mar 15 10:54:45.747527 2026] [:error] [pid 45974:tid 45998] [client 212.30.33.89:40191] [client 212.30.33.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "abYfdRWn4R6u72SegehHAwAAAhY"]
[Sun Mar 15 10:54:46.613224 2026] [:error] [pid 38536:tid 38577] [client 212.30.33.213:42703] [client 212.30.33.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "abYfdvpTEqkVJ0rBEWvf9QAAABg"]
[Sun Mar 15 10:54:47.866357 2026] [:error] [pid 45974:tid 45977] [client 212.30.33.61:64463] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Mar 15 10:54:48.691927 2026] [:error] [pid 45974:tid 45977] [client 212.30.33.61:64463] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "abYfeBWn4R6u72SegehHIAAAAgE"]
[Sun Mar 15 10:54:51.432334 2026] [:error] [pid 50986:tid 50998] [client 212.30.33.81:24091] [client 212.30.33.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "abYfeyknK4c779bcQqEIbQAAAUk"]
[Sun Mar 15 10:54:52.652421 2026] [:error] [pid 50986:tid 51004] [client 212.30.33.76:23979] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "abYffCknK4c779bcQqEIegAAAU8"]
[Sun Mar 15 10:54:53.486134 2026] [:error] [pid 45974:tid 45991] [client 212.30.33.87:59823] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Mar 15 10:54:53.885590 2026] [:error] [pid 45974:tid 45991] [client 212.30.33.87:59823] [client 212.30.33.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "abYffRWn4R6u72SegehHiAAAAg8"]
[Sun Mar 15 10:54:55.128746 2026] [:error] [pid 38645:tid 38668] [client 212.30.33.80:25303] [client 212.30.33.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.80, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abYffxFPHtsDUuVrWDbLBwAAANU"]
[Sun Mar 15 10:54:55.130735 2026] [:error] [pid 38645:tid 38668] [client 212.30.33.80:25303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 15 10:54:55.538117 2026] [:error] [pid 38645:tid 38670] [client 212.30.33.80:25303] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "abYffxFPHtsDUuVrWDbLCwAAANc"]
[Sun Mar 15 10:54:57.146924 2026] [:error] [pid 38540:tid 38596] [client 212.30.33.73:49797] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "abYfgV8bnHsJ1dE90bI7nQAAAEo"]
[Sun Mar 15 10:54:58.813618 2026] [:error] [pid 45801:tid 45817] [client 212.30.33.55:58681] [client 212.30.33.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.55, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "abYfgoaKHL9CTKoVzTDI_gAAAc4"]
[Sun Mar 15 10:55:00.066345 2026] [:error] [pid 45801:tid 45824] [client 212.30.33.55:58681] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "abYfhIaKHL9CTKoVzTDJAgAAAdU"]
[Sun Mar 15 10:55:00.918627 2026] [:error] [pid 38645:tid 38652] [client 212.30.33.99:53039] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "abYfhBFPHtsDUuVrWDbLoAAAAMU"]
[Sun Mar 15 10:55:01.763808 2026] [:error] [pid 38645:tid 38655] [client 212.30.33.96:57465] [client 212.30.33.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "abYfhRFPHtsDUuVrWDbLyAAAAMg"]
[Sun Mar 15 10:55:02.620200 2026] [:error] [pid 38645:tid 38669] [client 212.30.33.82:28263] [client 212.30.33.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.82, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "abYfhhFPHtsDUuVrWDbL6gAAANY"]
[Sun Mar 15 10:55:04.330536 2026] [:error] [pid 38645:tid 38669] [client 212.30.33.82:28263] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Mar 15 10:55:05.195059 2026] [:error] [pid 38645:tid 38663] [client 212.30.33.82:28263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Mar 15 10:55:05.608161 2026] [:error] [pid 38645:tid 38662] [client 212.30.33.82:28263] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "abYfiRFPHtsDUuVrWDbMTAAAAM8"]
[Sun Mar 15 10:55:06.428361 2026] [:error] [pid 45974:tid 46000] [client 212.30.33.62:59851] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Mar 15 10:55:07.270123 2026] [:error] [pid 45974:tid 45976] [client 212.30.33.62:59851] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 15 10:55:08.116344 2026] [:error] [pid 45974:tid 45987] [client 212.30.33.62:59851] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "abYfjBWn4R6u72SegehIKgAAAgs"]
[Sun Mar 15 10:55:08.948689 2026] [:error] [pid 42570:tid 42584] [client 212.30.33.65:63587] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Mar 15 10:55:09.818439 2026] [:error] [pid 42570:tid 42590] [client 212.30.33.65:63587] [client 212.30.33.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abYfjcIUXZJLmk_gYCO9LgAAAZE"]
[Sun Mar 15 10:55:11.076972 2026] [:error] [pid 38645:tid 38660] [client 212.30.33.63:42677] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Mar 15 10:55:11.488152 2026] [:error] [pid 38645:tid 38667] [client 212.30.33.63:42677] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sun Mar 15 10:55:11.892200 2026] [:error] [pid 38645:tid 38660] [client 212.30.33.63:42677] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "abYfjxFPHtsDUuVrWDbMpwAAAM0"]
[Sun Mar 15 10:55:12.712043 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.92:49189] [client 212.30.33.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "abYfkCknK4c779bcQqEJIgAAAVY"]
[Sun Mar 15 10:55:13.521069 2026] [:error] [pid 38536:tid 38559] [client 212.30.33.55:54433] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "abYfkfpTEqkVJ0rBEWvgUAAAAAY"]
[Sun Mar 15 10:55:14.948542 2026] [:error] [pid 45974:tid 45987] [client 212.30.33.73:42335] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "abYfkhWn4R6u72SegehIZQAAAgs"]
[Sun Mar 15 10:55:15.763625 2026] [:error] [pid 38540:tid 38598] [client 212.30.33.54:21769] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "abYfk18bnHsJ1dE90bI71AAAAEw"]
[Sun Mar 15 10:55:18.624691 2026] [:error] [pid 42570:tid 42575] [client 212.30.33.103:43787] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Mar 15 10:55:19.037003 2026] [:error] [pid 42570:tid 42583] [client 212.30.33.103:43787] [client 212.30.33.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.103, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "abYfl8IUXZJLmk_gYCO9agAAAYo"]
[Sun Mar 15 10:55:19.455201 2026] [:error] [pid 42570:tid 42577] [client 212.30.33.103:43787] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Mar 15 10:55:19.886970 2026] [:error] [pid 42570:tid 42593] [client 212.30.33.103:43787] [client 212.30.33.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.103, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "abYfl8IUXZJLmk_gYCO9cgAAAZQ"]
[Sun Mar 15 10:55:20.303733 2026] [:error] [pid 42570:tid 42596] [client 212.30.33.103:43787] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "abYfmMIUXZJLmk_gYCO9dwAAAZc"]
[Sun Mar 15 10:55:21.124303 2026] [:error] [pid 45801:tid 45814] [client 212.30.33.190:53227] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Mar 15 10:55:21.533050 2026] [:error] [pid 45801:tid 45825] [client 212.30.33.190:53227] [client 212.30.33.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.190, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "abYfmYaKHL9CTKoVzTDJRwAAAdY"]
[Sun Mar 15 10:55:21.536434 2026] [:error] [pid 45801:tid 45825] [client 212.30.33.190:53227] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Mar 15 10:55:22.767512 2026] [:error] [pid 45801:tid 45817] [client 212.30.33.190:53227] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Mar 15 10:55:23.184505 2026] [:error] [pid 45801:tid 45814] [client 212.30.33.190:53227] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "abYfm4aKHL9CTKoVzTDJVgAAAcs"]
[Sun Mar 15 10:55:23.991285 2026] [:error] [pid 50986:tid 50989] [client 212.30.33.73:36949] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID/wp-conflg.php"] [unique_id "abYfmyknK4c779bcQqEJpQAAAUE"]
[Sun Mar 15 10:55:26.085371 2026] [:error] [pid 42570:tid 42577] [client 212.30.33.99:64495] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID/wp-work.php"] [unique_id "abYfnsIUXZJLmk_gYCO9qwAAAYQ"]
[Sun Mar 15 10:55:28.318369 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.95:24063] [client 212.30.33.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.95, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "abYfoHuOpex8jIO0jt5TVgAAAJU"]
[Sun Mar 15 10:55:29.562646 2026] [:error] [pid 38541:tid 38617] [client 212.30.33.95:24063] [client 212.30.33.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.95, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "abYfoXuOpex8jIO0jt5TZAAAAIQ"]
[Sun Mar 15 10:55:29.978358 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.95:24063] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iRSzrsOUEP.php
[Sun Mar 15 10:55:30.876537 2026] [:error] [pid 38541:tid 38627] [client 212.30.33.95:24063] [client 212.30.33.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "abYfonuOpex8jIO0jt5TbAAAAI4"]
[Sun Mar 15 10:55:31.701773 2026] [:error] [pid 45974:tid 45996] [client 212.30.33.59:27309] [client 212.30.33.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "abYfoxWn4R6u72SegehI_AAAAhQ"]
[Sun Mar 15 10:55:34.152750 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.54:30171] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Mar 15 10:55:34.962452 2026] [:error] [pid 50986:tid 51000] [client 212.30.33.54:30171] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "abYfpiknK4c779bcQqEKCgAAAUs"]
[Sun Mar 15 10:55:35.790077 2026] [:error] [pid 38645:tid 38667] [client 212.30.33.99:60531] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "abYfpxFPHtsDUuVrWDbNtgAAANQ"]
[Sun Mar 15 10:55:37.026480 2026] [:error] [pid 38645:tid 38662] [client 212.30.33.190:58267] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl.php"] [unique_id "abYfqRFPHtsDUuVrWDbN0AAAAM8"]
[Sun Mar 15 10:55:39.071688 2026] [:error] [pid 45801:tid 45816] [client 212.30.33.57:21299] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "abYfq4aKHL9CTKoVzTDJxwAAAc0"]
[Sun Mar 15 10:55:40.276376 2026] [:error] [pid 38645:tid 38659] [client 212.30.33.103:64085] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Mar 15 10:55:40.685194 2026] [:error] [pid 38645:tid 38658] [client 212.30.33.103:64085] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "abYfrBFPHtsDUuVrWDbOEgAAAMs"]
[Sun Mar 15 10:55:41.496112 2026] [:error] [pid 50986:tid 50996] [client 212.30.33.64:21907] [client 212.30.33.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "abYfrSknK4c779bcQqEKTwAAAUc"]
[Sun Mar 15 10:55:43.119114 2026] [:error] [pid 38536:tid 38559] [client 212.30.33.81:35703] [client 212.30.33.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "abYfr_pTEqkVJ0rBEWvggQAAAAY"]
[Sun Mar 15 10:55:43.926591 2026] [:error] [pid 45974:tid 45987] [client 212.30.33.79:32719] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "abYfrxWn4R6u72SegehJiQAAAgs"]
[Sun Mar 15 10:55:45.158326 2026] [:error] [pid 38645:tid 38661] [client 212.30.33.94:60915] [client 212.30.33.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "abYfsRFPHtsDUuVrWDbOIwAAAM4"]
[Sun Mar 15 10:55:47.397127 2026] [:error] [pid 50986:tid 51002] [client 212.30.33.62:49615] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "abYfsyknK4c779bcQqEKegAAAU0"]
[Sun Mar 15 10:55:49.066119 2026] [:error] [pid 38645:tid 38658] [client 212.30.33.70:62467] [client 212.30.33.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "abYftRFPHtsDUuVrWDbOUAAAAMs"]
[Sun Mar 15 10:55:50.755669 2026] [:error] [pid 42570:tid 42574] [client 212.30.33.55:25375] [client 212.30.33.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.55, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "abYftsIUXZJLmk_gYCO-QQAAAYE"]
[Sun Mar 15 10:55:52.014159 2026] [:error] [pid 42570:tid 42577] [client 212.30.33.55:25375] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Mar 15 10:55:53.258936 2026] [:error] [pid 42570:tid 42573] [client 212.30.33.55:25375] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "abYfucIUXZJLmk_gYCO-UQAAAYA"]
[Sun Mar 15 10:55:54.516415 2026] [:error] [pid 38645:tid 38662] [client 212.30.33.164:40041] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Mar 15 10:55:54.929508 2026] [:error] [pid 38645:tid 38649] [client 212.30.33.164:40041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Mar 15 10:55:55.350980 2026] [:error] [pid 38645:tid 38657] [client 212.30.33.164:40041] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Mar 15 10:55:55.824588 2026] [:error] [pid 38645:tid 38653] [client 212.30.33.164:40041] [client 212.30.33.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "abYfuxFPHtsDUuVrWDbO9QAAAMY"]
[Sun Mar 15 10:55:57.055984 2026] [:error] [pid 45801:tid 45818] [client 212.30.33.86:35041] [client 212.30.33.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "abYfvYaKHL9CTKoVzTDKFwAAAc8"]
[Sun Mar 15 10:55:57.906342 2026] [:error] [pid 50986:tid 50993] [client 212.30.33.91:36501] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Mar 15 10:55:58.328621 2026] [:error] [pid 50986:tid 51005] [client 212.30.33.91:36501] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun Mar 15 10:55:58.750966 2026] [:error] [pid 50986:tid 51004] [client 212.30.33.91:36501] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Mar 15 10:56:00.284152 2026] [:error] [pid 50986:tid 50994] [client 212.30.33.91:36501] [client 212.30.33.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abYfwCknK4c779bcQqEK2QAAAUY"]
[Sun Mar 15 10:56:01.134839 2026] [:error] [pid 45801:tid 45816] [client 212.30.33.54:64551] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Mar 15 10:56:01.952244 2026] [:error] [pid 45801:tid 45824] [client 212.30.33.54:64551] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Mar 15 10:56:02.365071 2026] [:error] [pid 45801:tid 45813] [client 212.30.33.54:64551] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Mar 15 10:56:03.187465 2026] [:error] [pid 45801:tid 45814] [client 212.30.33.54:64551] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "abYfw4aKHL9CTKoVzTDKPgAAAcs"]
[Sun Mar 15 10:56:03.986106 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.56:47489] [client 212.30.33.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "abYfwxFPHtsDUuVrWDbPbgAAAMk"]
[Sun Mar 15 10:56:04.815555 2026] [:error] [pid 45801:tid 45804] [client 212.30.33.57:49053] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Mar 15 10:56:05.617466 2026] [:error] [pid 45801:tid 45823] [client 212.30.33.57:49053] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "abYfxYaKHL9CTKoVzTDKWgAAAdQ"]
[Sun Mar 15 10:56:07.298738 2026] [:error] [pid 38541:tid 38637] [client 212.30.33.103:48051] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Mar 15 10:56:08.533743 2026] [:error] [pid 38541:tid 38622] [client 212.30.33.103:48051] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "abYfyHuOpex8jIO0jt5T3wAAAIk"]
[Sun Mar 15 10:56:09.373722 2026] [:error] [pid 45974:tid 45984] [client 212.30.33.82:65243] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "abYfyRWn4R6u72SegehK0QAAAgg"]
[Sun Mar 15 10:56:13.034858 2026] [:error] [pid 38541:tid 38632] [client 212.30.33.53:54637] [client 212.30.33.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "abYfzXuOpex8jIO0jt5T8wAAAJM"]
[Sun Mar 15 10:56:13.839712 2026] [:error] [pid 50986:tid 50989] [client 212.30.33.58:29765] [client 212.30.33.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "abYfzSknK4c779bcQqELwwAAAUE"]
[Sun Mar 15 10:56:32.980835 2026] [autoindex:error] [pid 38540:tid 38594] [client 212.30.33.90:52309] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 16:13:18.918911 2026] [:error] [pid 45801:tid 45823] [client 104.234.53.76:20483] [client 104.234.53.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.76, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abZqHoaKHL9CTKoVzTAKZAAAAdQ"]
[Sun Mar 15 16:13:18.924783 2026] [:error] [pid 45801:tid 45823] [client 104.234.53.76:20483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 15 16:26:22.569683 2026] [:error] [pid 45801:tid 45816] [client 185.225.84.60:52315] [client 185.225.84.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.84.60, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abZtLoaKHL9CTKoVzTAOOgAAAc0"]
[Sun Mar 15 16:26:22.574590 2026] [:error] [pid 45801:tid 45816] [client 185.225.84.60:52315] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 15 16:28:22.416252 2026] [:error] [pid 50986:tid 51003] [client 103.115.198.216:50680] [client 103.115.198.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.115.198.216, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abZtpiknK4c779bcQqF8CAAAAU4"]
[Sun Mar 15 16:28:22.421272 2026] [:error] [pid 50986:tid 51003] [client 103.115.198.216:50680] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 15 16:28:24.250019 2026] [:error] [pid 50986:tid 51007] [client 49.43.201.54:57757] [client 49.43.201.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.201.54, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abZtqCknK4c779bcQqF8CwAAAVI"]
[Sun Mar 15 16:28:24.254686 2026] [:error] [pid 50986:tid 51007] [client 49.43.201.54:57757] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 16 00:39:31.534735 2026] [:error] [pid 60947:tid 61007] [client 70.31.231.236:62126] [client 70.31.231.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.31.231.236, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abbgw_8DVbvyAQDJWh1MowAAAMU"]
[Mon Mar 16 00:39:31.542506 2026] [:error] [pid 60947:tid 61007] [client 70.31.231.236:62126] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 16 05:04:38.796223 2026] [:error] [pid 62529:tid 62551] [client 37.63.40.28:61906] [client 37.63.40.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.63.40.28, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abce5j84-luOVYZKK0Nd1AAAAM4"]
[Mon Mar 16 05:04:38.803429 2026] [:error] [pid 62529:tid 62551] [client 37.63.40.28:61906] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 16 07:02:29.896437 2026] [:error] [pid 62428:tid 62469] [client 203.188.168.29:51209] [client 203.188.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.29, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abc6harHSRXFZx1-aIHoNgAAAEA"]
[Mon Mar 16 07:02:29.902618 2026] [:error] [pid 62428:tid 62469] [client 203.188.168.29:51209] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 16 08:12:37.508728 2026] [:error] [pid 62427:tid 62455] [client 103.65.237.124:56468] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "abdK9cUPP8fzo6XzJCUnxwAAAA4"]
[Mon Mar 16 11:05:09.980249 2026] [:error] [pid 62026:tid 62098] [client 173.239.236.250:27837] [client 173.239.236.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.239.236.250, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abdzZe8oW52PUIYI2O4K6wAAAIw"]
[Mon Mar 16 11:05:09.990913 2026] [:error] [pid 62026:tid 62098] [client 173.239.236.250:27837] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 16 11:05:11.101399 2026] [:error] [pid 62026:tid 62101] [client 173.239.236.250:27837] [client 173.239.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "abdzZ-8oW52PUIYI2O4LIAAAAI8"]
[Mon Mar 16 18:01:07.517168 2026] [:error] [pid 39154:tid 39176] [client 34.187.158.4:60112] [client 34.187.158.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "abfU4xgq1_qjm7J1LqvsgQAAAVM"]
[Mon Mar 16 18:01:08.067792 2026] [:error] [pid 39154:tid 39173] [client 34.187.158.4:60316] [client 34.187.158.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "abfU5Bgq1_qjm7J1LqvskwAAAVA"]
[Mon Mar 16 18:01:08.688085 2026] [:error] [pid 36198:tid 36204] [client 34.187.158.4:60586] [client 34.187.158.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "abfU5OlL1GNckmsdWlML1gAAAQM"]
[Mon Mar 16 18:01:09.359764 2026] [:error] [pid 36198:tid 36201] [client 34.187.158.4:60938] [client 34.187.158.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/env.js"] [unique_id "abfU5elL1GNckmsdWlML6wAAAQA"]
[Tue Mar 17 02:39:55.108089 2026] [:error] [pid 45652:tid 45668] [client 106.222.225.1:15541] [client 106.222.225.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.225.1, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abhOe_eWZ4w4tc07R6lhmwAAAM0"]
[Tue Mar 17 02:39:55.112408 2026] [:error] [pid 45652:tid 45668] [client 106.222.225.1:15541] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 17 02:40:54.816847 2026] [:error] [pid 45404:tid 45527] [client 177.2.114.162:18001] [client 177.2.114.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.2.114.162, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abhOtmcrPifELUd8UWAZaAAAAAo"]
[Tue Mar 17 02:40:54.821933 2026] [:error] [pid 45404:tid 45527] [client 177.2.114.162:18001] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 17 06:58:01.879221 2026] [:error] [pid 46020:tid 46032] [client 103.55.99.46:59406] [client 103.55.99.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.55.99.46, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abiK-X-nCcd9BdzGdLcT8gAAAMo"]
[Tue Mar 17 06:58:01.885400 2026] [:error] [pid 46020:tid 46032] [client 103.55.99.46:59406] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 17 07:56:11.095445 2026] [:error] [pid 46020:tid 46044] [client 185.223.152.129:38385] [client 185.223.152.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.129, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abiYm3-nCcd9BdzGdLdBQwAAANY"]
[Tue Mar 17 07:56:11.098946 2026] [:error] [pid 46020:tid 46044] [client 185.223.152.129:38385] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Mar 17 16:09:05.231975 2026] [:error] [pid 45916:tid 45986] [client 103.224.39.116:52490] [client 103.224.39.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.224.39.116, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abkMIbiS53PnClk_C9A5cgAAAFg"]
[Tue Mar 17 16:09:05.239782 2026] [:error] [pid 45916:tid 45986] [client 103.224.39.116:52490] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 17 20:45:23.695315 2026] [:error] [pid 45916:tid 45980] [client 112.201.66.203:8210] [client 112.201.66.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.201.66.203, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ablM47iS53PnClk_C9CfjAAAAFI"]
[Tue Mar 17 20:45:23.700095 2026] [:error] [pid 45916:tid 45980] [client 112.201.66.203:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 18 02:02:27.023807 2026] [:error] [pid 63612:tid 63615] [client 187.87.221.120:57927] [client 187.87.221.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.87.221.120, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abmXM-7vPBSR8vo387M8SwAAAYE"]
[Wed Mar 18 02:02:27.028749 2026] [:error] [pid 63612:tid 63615] [client 187.87.221.120:57927] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 18 03:22:26.150118 2026] [:error] [pid 40716:tid 41027] [client 20.39.61.185:8245] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "abmp8hR6i4ByUuhUBASjuQAAAEY"]
[Wed Mar 18 03:22:28.320383 2026] [:error] [pid 63412:tid 63424] [client 20.39.61.185:53689] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "abmp9DKUzzFOGoXRLQ_btQAAAMg"]
[Wed Mar 18 03:22:31.701780 2026] [:error] [pid 63412:tid 63434] [client 20.39.61.185:59361] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "abmp9zKUzzFOGoXRLQ_buAAAANI"]
[Wed Mar 18 03:22:34.399698 2026] [:error] [pid 40717:tid 41072] [client 20.39.61.185:53692] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "abmp-sR22EbC70ICesgjggAAAJQ"]
[Wed Mar 18 04:16:43.964517 2026] [:error] [pid 44965:tid 45018] [client 173.239.254.150:46297] [client 173.239.254.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.150, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abm2q6NZys-oG-hM22hn6gAAAEg"]
[Wed Mar 18 04:16:43.970050 2026] [:error] [pid 44965:tid 45018] [client 173.239.254.150:46297] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 18 08:13:18.290609 2026] [:error] [pid 13716:tid 13741] [client 20.2.90.103:39026] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "abnuHmWKzQVHkZkUHaRT6wAAAVc"]
[Wed Mar 18 10:10:02.423114 2026] [:error] [pid 43009:tid 43032] [client 213.238.171.87:54172] [client 213.238.171.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.238.171.87, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aboJen8aUp4Sm6m3nmOM7wAAARU"]
[Wed Mar 18 10:10:02.430370 2026] [:error] [pid 43009:tid 43032] [client 213.238.171.87:54172] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 18 15:39:36.507216 2026] [:error] [pid 42870:tid 42906] [client 206.84.229.46:60242] [client 206.84.229.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.84.229.46, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abpWuJ6axlAooiuYyUzoMwAAABU"]
[Wed Mar 18 15:39:36.512460 2026] [:error] [pid 42870:tid 42906] [client 206.84.229.46:60242] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 18 17:16:51.838508 2026] [:error] [pid 31232:tid 31254] [client 145.239.10.137:51339] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php, referer: http://aoswa.com.au/k.php
[Wed Mar 18 18:28:50.508955 2026] [:error] [pid 31232:tid 31247] [client 20.220.57.95:15003] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 18 18:28:50.863474 2026] [:error] [pid 31232:tid 31258] [client 20.220.57.95:15003] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 18 18:28:51.357847 2026] [:error] [pid 31232:tid 31235] [client 20.220.57.95:15003] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Wed Mar 18 18:28:51.642327 2026] [:error] [pid 31232:tid 31248] [client 20.220.57.95:15003] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 18 18:28:52.067544 2026] [:error] [pid 31232:tid 31240] [client 20.220.57.95:15003] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Mar 18 18:28:52.279393 2026] [:error] [pid 31232:tid 31238] [client 20.220.57.95:15003] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Mar 18 18:28:52.563405 2026] [:error] [pid 31232:tid 31253] [client 20.220.57.95:15003] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Wed Mar 18 18:28:52.983565 2026] [:error] [pid 31232:tid 31242] [client 20.220.57.95:15003] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abp-ZGX6HV7dqh3BQD27NAAAAEc"]
[Wed Mar 18 18:28:55.799423 2026] [:error] [pid 42870:tid 42893] [client 20.220.57.95:15033] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abp-Z56axlAooiuYyUwSxwAAAAg"]
[Wed Mar 18 18:28:57.216539 2026] [:error] [pid 31232:tid 31235] [client 20.220.57.95:15012] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abp-aWX6HV7dqh3BQD27OwAAAEA"]
[Wed Mar 18 18:29:00.270131 2026] [:error] [pid 31232:tid 31236] [client 20.220.57.95:15036] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abp-bGX6HV7dqh3BQD27SwAAAEE"]
[Thu Mar 19 00:35:57.858959 2026] [:error] [pid 41180:tid 41185] [client 27.34.110.129:7925] [client 27.34.110.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.34.110.129, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abrUbbuSQ3z2YqXgnyfpPQAAAMM"]
[Thu Mar 19 00:35:57.864505 2026] [:error] [pid 41180:tid 41185] [client 27.34.110.129:7925] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 19 01:29:26.304043 2026] [:error] [pid 41180:tid 41202] [client 188.166.188.255:56763] [client 188.166.188.255] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "abrg9ruSQ3z2YqXgnycNUQAAANQ"]
[Thu Mar 19 06:31:03.670799 2026] [:error] [pid 23883:tid 23935] [client 31.171.130.40:36977] [client 31.171.130.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.40, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "absnp9Ni-EnEAH4abz1__wAAAEY"]
[Thu Mar 19 06:31:03.676490 2026] [:error] [pid 23883:tid 23935] [client 31.171.130.40:36977] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Mar 19 08:30:14.883394 2026] [:error] [pid 32226:tid 32235] [client 41.109.175.147:62075] [client 41.109.175.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.109.175.147, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abtDlrBb58lgPwqxC6qbsQAAAwc"]
[Thu Mar 19 08:30:14.900049 2026] [:error] [pid 32226:tid 32235] [client 41.109.175.147:62075] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 19 08:33:31.698584 2026] [:error] [pid 31313:tid 31383] [client 116.202.13.195:57774] [client 116.202.13.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "abtEWw9HuAbqf2tZOycL9gAAAdY"]
[Thu Mar 19 09:09:25.157397 2026] [:error] [pid 31205:tid 31239] [client 91.99.181.243:55256] [client 91.99.181.243] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "abtMxVu5gZKGrGz5P1E3WgAAAVY"]
[Thu Mar 19 09:54:31.141914 2026] [:error] [pid 31447:tid 31472] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Mar 19 09:54:31.420620 2026] [:error] [pid 31447:tid 31459] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Mar 19 09:54:31.638667 2026] [:error] [pid 31447:tid 31463] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Mar 19 09:54:31.893496 2026] [:error] [pid 31447:tid 31469] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Mar 19 09:54:32.142462 2026] [:error] [pid 31447:tid 31466] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Mar 19 09:54:32.440176 2026] [:error] [pid 31447:tid 31468] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Mar 19 09:54:32.759260 2026] [:error] [pid 31447:tid 31476] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Mar 19 09:54:33.028307 2026] [:error] [pid 31447:tid 31461] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Mar 19 09:54:33.530137 2026] [:error] [pid 31447:tid 31479] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Mar 19 09:54:35.256840 2026] [:error] [pid 31447:tid 31469] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Mar 19 09:54:35.596017 2026] [:error] [pid 31447:tid 31479] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Mar 19 09:54:35.877738 2026] [:error] [pid 31447:tid 31471] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Mar 19 09:54:37.861006 2026] [:error] [pid 31447:tid 31471] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Mar 19 09:54:38.189290 2026] [:error] [pid 31447:tid 31472] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Mar 19 09:54:38.504738 2026] [:error] [pid 31447:tid 31469] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Mar 19 09:54:38.771747 2026] [:error] [pid 31447:tid 31464] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Mar 19 09:54:39.061453 2026] [:error] [pid 31447:tid 31458] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Mar 19 09:54:39.342723 2026] [:error] [pid 31447:tid 31459] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Mar 19 09:54:39.611542 2026] [:error] [pid 31447:tid 31471] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Mar 19 09:54:39.936511 2026] [:error] [pid 31447:tid 31472] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Mar 19 09:54:40.177497 2026] [:error] [pid 31447:tid 31463] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Mar 19 09:54:40.433572 2026] [:error] [pid 31447:tid 31458] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Mar 19 09:54:40.719770 2026] [:error] [pid 31447:tid 31473] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Mar 19 09:54:41.260601 2026] [:error] [pid 31447:tid 31455] [client 209.87.169.216:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Mar 19 09:54:41.508313 2026] [:error] [pid 31447:tid 31458] [client 209.87.169.216:50339] [client 209.87.169.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "abtXYRmVNRDSLnGvghiUMgAAAgM"]
[Thu Mar 19 09:54:42.001470 2026] [:error] [pid 31205:tid 31229] [client 209.87.169.43:62785] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Mar 19 09:54:42.276521 2026] [:error] [pid 31205:tid 31218] [client 209.87.169.43:62785] [client 209.87.169.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "abtXYlu5gZKGrGz5P1FGNAAAAUI"]
[Thu Mar 19 09:54:42.828605 2026] [:error] [pid 31205:tid 31224] [client 209.87.169.68:60453] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Mar 19 09:54:43.071194 2026] [:error] [pid 31205:tid 31233] [client 209.87.169.68:60453] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Mar 19 09:54:43.326644 2026] [:error] [pid 31205:tid 31221] [client 209.87.169.68:60453] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Mar 19 09:54:43.596330 2026] [:error] [pid 31205:tid 31237] [client 209.87.169.68:60453] [client 209.87.169.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "abtXY1u5gZKGrGz5P1FGQgAAAVQ"]
[Thu Mar 19 09:54:44.175215 2026] [:error] [pid 32226:tid 32243] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Mar 19 09:54:44.456174 2026] [:error] [pid 32226:tid 32247] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Mar 19 09:54:44.696450 2026] [:error] [pid 32226:tid 32234] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Mar 19 09:54:44.981113 2026] [:error] [pid 32226:tid 32232] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Mar 19 09:54:45.220715 2026] [:error] [pid 32226:tid 32236] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Mar 19 09:54:45.463839 2026] [:error] [pid 32226:tid 32230] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Mar 19 09:54:45.725317 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Mar 19 09:54:45.976596 2026] [:error] [pid 32226:tid 32251] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Mar 19 09:54:48.267216 2026] [:error] [pid 32226:tid 32251] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Mar 19 09:54:48.515116 2026] [:error] [pid 32226:tid 32248] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Mar 19 09:54:48.767973 2026] [:error] [pid 32226:tid 32245] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Mar 19 09:54:49.022534 2026] [:error] [pid 32226:tid 32252] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Mar 19 09:54:49.306428 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Mar 19 09:54:49.626381 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Mar 19 09:54:49.886733 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Mar 19 09:54:50.121731 2026] [:error] [pid 32226:tid 32237] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Mar 19 09:54:50.413682 2026] [:error] [pid 32226:tid 32235] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Mar 19 09:54:50.653745 2026] [:error] [pid 32226:tid 32229] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Mar 19 09:54:50.895023 2026] [:error] [pid 32226:tid 32240] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Mar 19 09:54:51.200175 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Mar 19 09:54:53.220410 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Mar 19 09:54:53.481797 2026] [:error] [pid 32226:tid 32244] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Mar 19 09:54:53.754483 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Mar 19 09:54:54.046931 2026] [:error] [pid 32226:tid 32234] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Mar 19 09:54:54.313369 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Mar 19 09:54:54.569526 2026] [:error] [pid 32226:tid 32234] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Mar 19 09:54:54.827862 2026] [:error] [pid 32226:tid 32242] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Mar 19 09:54:55.096117 2026] [:error] [pid 32226:tid 32234] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Mar 19 09:54:55.373386 2026] [:error] [pid 32226:tid 32238] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Mar 19 09:54:55.647353 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Thu Mar 19 09:54:55.908657 2026] [:error] [pid 32226:tid 32245] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Mar 19 09:54:56.156531 2026] [:error] [pid 32226:tid 32234] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Mar 19 09:54:56.446207 2026] [:error] [pid 32226:tid 32232] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Mar 19 09:54:56.758249 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Mar 19 09:54:56.989762 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Mar 19 09:54:57.248177 2026] [:error] [pid 32226:tid 32244] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Thu Mar 19 09:54:57.507107 2026] [:error] [pid 32226:tid 32235] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Mar 19 09:54:57.782056 2026] [:error] [pid 32226:tid 32229] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Mar 19 09:54:58.172369 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Mar 19 09:54:58.424357 2026] [:error] [pid 32226:tid 32243] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Mar 19 09:54:58.722030 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Mar 19 09:54:59.029193 2026] [:error] [pid 32226:tid 32243] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Mar 19 09:54:59.398110 2026] [:error] [pid 32226:tid 32234] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Mar 19 09:54:59.626305 2026] [:error] [pid 32226:tid 32246] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Mar 19 09:54:59.911667 2026] [:error] [pid 32226:tid 32245] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Mar 19 09:55:00.233028 2026] [:error] [pid 32226:tid 32237] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Mar 19 09:55:00.554883 2026] [:error] [pid 32226:tid 32234] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Mar 19 09:55:00.896598 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Mar 19 09:55:01.161181 2026] [:error] [pid 32226:tid 32231] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Mar 19 09:55:01.435703 2026] [:error] [pid 32226:tid 32245] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Mar 19 09:55:02.238017 2026] [:error] [pid 32226:tid 32249] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Mar 19 09:55:02.598841 2026] [:error] [pid 32226:tid 32235] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Mar 19 09:55:02.935475 2026] [:error] [pid 32226:tid 32242] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Mar 19 09:55:03.265672 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Mar 19 09:55:03.614015 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Mar 19 09:55:03.920714 2026] [:error] [pid 32226:tid 32236] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Mar 19 09:55:04.262884 2026] [:error] [pid 32226:tid 32231] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Mar 19 09:55:05.254027 2026] [:error] [pid 32226:tid 32229] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Mar 19 09:55:05.521403 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Mar 19 09:55:06.164859 2026] [:error] [pid 32226:tid 32236] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Mar 19 09:55:08.417610 2026] [:error] [pid 32226:tid 32236] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Mar 19 09:55:08.673767 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Mar 19 09:55:08.928570 2026] [:error] [pid 32226:tid 32240] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Mar 19 09:55:10.765929 2026] [:error] [pid 32226:tid 32240] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Mar 19 09:55:11.034898 2026] [:error] [pid 32226:tid 32230] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Mar 19 09:55:11.266427 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Mar 19 09:55:11.524021 2026] [:error] [pid 32226:tid 32244] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Mar 19 09:55:11.778042 2026] [:error] [pid 32226:tid 32237] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Mar 19 09:55:12.029906 2026] [:error] [pid 32226:tid 32236] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Mar 19 09:55:12.292530 2026] [:error] [pid 32226:tid 32231] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Mar 19 09:55:12.567546 2026] [:error] [pid 32226:tid 32243] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Mar 19 09:55:12.828446 2026] [:error] [pid 32226:tid 32237] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Mar 19 09:55:13.107927 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Mar 19 09:55:13.364943 2026] [:error] [pid 32226:tid 32249] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Mar 19 09:55:13.611467 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Mar 19 09:55:13.855824 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Mar 19 09:55:14.132276 2026] [:error] [pid 32226:tid 32229] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Mar 19 09:55:14.383748 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Mar 19 09:55:14.613758 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Mar 19 09:55:14.873816 2026] [:error] [pid 32226:tid 32242] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Mar 19 09:55:15.435170 2026] [:error] [pid 32226:tid 32237] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Mar 19 09:55:15.777075 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Thu Mar 19 09:55:16.055943 2026] [:error] [pid 32226:tid 32235] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Mar 19 09:55:16.332842 2026] [:error] [pid 32226:tid 32240] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Mar 19 09:55:16.572301 2026] [:error] [pid 32226:tid 32251] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Mar 19 09:55:16.807363 2026] [:error] [pid 32226:tid 32244] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Thu Mar 19 09:55:17.062075 2026] [:error] [pid 32226:tid 32239] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Thu Mar 19 09:55:17.323277 2026] [:error] [pid 32226:tid 32249] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Mar 19 09:55:17.554748 2026] [:error] [pid 32226:tid 32250] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Thu Mar 19 09:55:17.790070 2026] [:error] [pid 32226:tid 32251] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Mar 19 09:55:18.079570 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Thu Mar 19 09:55:19.766624 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Mar 19 09:55:20.004813 2026] [:error] [pid 32226:tid 32246] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Mar 19 09:55:20.269600 2026] [:error] [pid 32226:tid 32245] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Mar 19 09:55:20.513126 2026] [:error] [pid 32226:tid 32244] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Thu Mar 19 09:55:20.791214 2026] [:error] [pid 32226:tid 32237] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Mar 19 09:55:21.093963 2026] [:error] [pid 32226:tid 32236] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Thu Mar 19 09:55:21.393247 2026] [:error] [pid 32226:tid 32250] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Thu Mar 19 09:55:21.637391 2026] [:error] [pid 32226:tid 32229] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Thu Mar 19 09:55:21.876865 2026] [:error] [pid 32226:tid 32247] [client 209.87.169.48:46451] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Thu Mar 19 09:55:22.328394 2026] [:error] [pid 3278:tid 3295] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Mar 19 09:55:22.605024 2026] [:error] [pid 3278:tid 3304] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Thu Mar 19 09:55:22.873518 2026] [:error] [pid 3278:tid 3283] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Thu Mar 19 09:55:23.096764 2026] [:error] [pid 3278:tid 3296] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Thu Mar 19 09:55:23.327182 2026] [:error] [pid 3278:tid 3292] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Thu Mar 19 09:55:23.599663 2026] [:error] [pid 3278:tid 3287] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Mar 19 09:55:23.821481 2026] [:error] [pid 3278:tid 3290] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Thu Mar 19 09:55:24.164672 2026] [:error] [pid 3278:tid 3288] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Mar 19 09:55:24.423656 2026] [:error] [pid 3278:tid 3294] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Mar 19 09:55:24.964449 2026] [:error] [pid 3278:tid 3283] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Thu Mar 19 09:55:25.710625 2026] [:error] [pid 3278:tid 3293] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Thu Mar 19 09:55:25.949319 2026] [:error] [pid 3278:tid 3303] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Thu Mar 19 09:55:26.254135 2026] [:error] [pid 3278:tid 3299] [client 209.87.169.253:59041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Thu Mar 19 09:55:29.580253 2026] [:error] [pid 3278:tid 3304] [client 209.87.169.253:59041] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "abtXkQC2T_lM6ZgvfcRMdwAAARc"]
[Thu Mar 19 09:55:30.898206 2026] [:error] [pid 31313:tid 31363] [client 209.87.169.33:31633] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "abtXkg9HuAbqf2tZOycZLQAAAcI"]
[Thu Mar 19 09:55:33.936655 2026] [:error] [pid 31447:tid 31460] [client 209.87.169.234:47693] [client 209.87.169.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "abtXlRmVNRDSLnGvghiYWQAAAgU"]
[Thu Mar 19 09:55:34.636886 2026] [:error] [pid 31735:tid 31763] [client 209.87.169.242:51223] [client 209.87.169.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "abtXln-gyQbRQWJYccw4yAAAApg"]
[Thu Mar 19 09:55:36.426185 2026] [:error] [pid 31447:tid 31464] [client 209.87.169.41:35201] [client 209.87.169.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "abtXmBmVNRDSLnGvghiYigAAAgk"]
[Thu Mar 19 09:55:37.896181 2026] [:error] [pid 23884:tid 23958] [client 209.87.169.29:37517] [client 209.87.169.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "abtXmV6St-VCdOYnZMoeNgAAAII"]
[Thu Mar 19 09:55:39.398534 2026] [:error] [pid 31735:tid 31752] [client 209.87.169.57:25117] [client 209.87.169.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "abtXm3-gyQbRQWJYccw4-QAAAo0"]
[Thu Mar 19 09:55:39.931172 2026] [:error] [pid 31447:tid 31473] [client 209.87.169.69:54867] [client 209.87.169.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "abtXmxmVNRDSLnGvghiYxgAAAhI"]
[Thu Mar 19 09:55:40.482689 2026] [:error] [pid 3278:tid 3304] [client 209.87.169.228:39203] [client 209.87.169.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "abtXnAC2T_lM6ZgvfcRMlQAAARc"]
[Thu Mar 19 09:55:41.372486 2026] [:error] [pid 23883:tid 23932] [client 209.87.169.60:26975] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "abtXndNi-EnEAH4abz2LJQAAAEM"]
[Thu Mar 19 09:55:45.572461 2026] [:error] [pid 31313:tid 31381] [client 209.87.169.73:26475] [client 209.87.169.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "abtXoQ9HuAbqf2tZOycZrQAAAdQ"]
[Thu Mar 19 09:55:50.612398 2026] [:error] [pid 31313:tid 31379] [client 209.87.169.248:25781] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "abtXpg9HuAbqf2tZOycZ4QAAAdI"]
[Thu Mar 19 09:55:51.071724 2026] [:error] [pid 31447:tid 31468] [client 209.87.169.60:28795] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "abtXpxmVNRDSLnGvghiZWwAAAg0"]
[Thu Mar 19 09:55:52.656262 2026] [:error] [pid 31447:tid 31467] [client 209.87.169.33:50981] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "abtXqBmVNRDSLnGvghiZiAAAAgw"]
[Thu Mar 19 09:55:53.121093 2026] [:error] [pid 31735:tid 31743] [client 209.87.169.35:40839] [client 209.87.169.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "abtXqX-gyQbRQWJYccw5VgAAAoQ"]
[Thu Mar 19 09:55:53.763357 2026] [:error] [pid 31313:tid 31368] [client 209.87.169.41:65471] [client 209.87.169.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "abtXqQ9HuAbqf2tZOycZ_QAAAcc"]
[Thu Mar 19 09:55:55.981346 2026] [:error] [pid 23882:tid 23904] [client 209.87.169.245:48081] [client 209.87.169.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "abtXq7WnClbtbN12M78TcAAAAAI"]
[Thu Mar 19 09:55:57.981545 2026] [:error] [pid 31735:tid 31739] [client 209.87.169.224:38493] [client 209.87.169.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "abtXrX-gyQbRQWJYccw5awAAAoA"]
[Thu Mar 19 09:55:58.857121 2026] [:error] [pid 23884:tid 23978] [client 209.87.169.50:58339] [client 209.87.169.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "abtXrl6St-VCdOYnZMoe3wAAAJY"]
[Thu Mar 19 09:55:59.668431 2026] [:error] [pid 31447:tid 31469] [client 209.87.169.54:30949] [client 209.87.169.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "abtXrxmVNRDSLnGvghiZ8QAAAg4"]
[Thu Mar 19 09:56:00.228811 2026] [:error] [pid 23883:tid 23942] [client 209.87.169.60:28381] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "abtXsNNi-EnEAH4abz2LkAAAAE0"]
[Thu Mar 19 09:56:02.037661 2026] [:error] [pid 31735:tid 31750] [client 209.87.169.32:26589] [client 209.87.169.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "abtXsn-gyQbRQWJYccw5iAAAAos"]
[Thu Mar 19 09:56:02.526806 2026] [:error] [pid 23988:tid 23993] [client 209.87.169.240:26435] [client 209.87.169.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "abtXsmnlkSPXj2matr0rnAAAAMI"]
[Thu Mar 19 09:56:04.136189 2026] [:error] [pid 31735:tid 31758] [client 209.87.169.232:52757] [client 209.87.169.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "abtXtH-gyQbRQWJYccw5lwAAApM"]
[Thu Mar 19 09:56:06.497279 2026] [:error] [pid 31447:tid 31479] [client 209.87.169.240:42657] [client 209.87.169.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "abtXthmVNRDSLnGvghiagAAAAhg"]
[Thu Mar 19 09:56:10.490160 2026] [:error] [pid 23884:tid 23966] [client 209.87.169.32:25759] [client 209.87.169.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.32, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "abtXul6St-VCdOYnZMofXAAAAIo"]
[Thu Mar 19 09:56:12.482037 2026] [:error] [pid 23884:tid 23980] [client 209.87.169.32:25759] [client 209.87.169.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "abtXvF6St-VCdOYnZMofhQAAAJg"]
[Thu Mar 19 09:56:13.212492 2026] [:error] [pid 23884:tid 23969] [client 209.87.169.42:47697] [client 209.87.169.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.42, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "abtXvV6St-VCdOYnZMofkAAAAI0"]
[Thu Mar 19 09:56:13.678059 2026] [:error] [pid 23884:tid 23956] [client 209.87.169.42:47697] [client 209.87.169.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "abtXvV6St-VCdOYnZMofmwAAAIA"]
[Thu Mar 19 09:56:15.576356 2026] [:error] [pid 23883:tid 23930] [client 209.87.169.243:26069] [client 209.87.169.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "abtXv9Ni-EnEAH4abz2L7wAAAEE"]
[Thu Mar 19 09:56:17.048487 2026] [:error] [pid 23988:tid 23993] [client 209.87.169.43:23443] [client 209.87.169.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "abtXwWnlkSPXj2matr0r6gAAAMI"]
[Thu Mar 19 09:56:17.499659 2026] [:error] [pid 3278:tid 3300] [client 209.87.169.217:60539] [client 209.87.169.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "abtXwQC2T_lM6ZgvfcRNaQAAARM"]
[Thu Mar 19 09:56:18.461144 2026] [:error] [pid 23884:tid 23977] [client 209.87.169.240:53877] [client 209.87.169.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.240, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "abtXwl6St-VCdOYnZMofyQAAAJU"]
[Thu Mar 19 09:56:18.706272 2026] [:error] [pid 23884:tid 23964] [client 209.87.169.240:53877] [client 209.87.169.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "abtXwl6St-VCdOYnZMofygAAAIg"]
[Thu Mar 19 09:56:29.044550 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.243:41261] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Mar 19 09:56:29.268987 2026] [:error] [pid 32226:tid 32247] [client 209.87.169.243:41261] [client 209.87.169.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "abtXzbBb58lgPwqxC6rJhwAAAxM"]
[Thu Mar 19 09:56:30.218308 2026] [:error] [pid 31313:tid 31364] [client 209.87.169.64:34383] [client 209.87.169.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.64, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "abtXzg9HuAbqf2tZOycbJwAAAcM"]
[Thu Mar 19 09:56:30.509744 2026] [:error] [pid 31313:tid 31383] [client 209.87.169.64:34383] [client 209.87.169.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "abtXzg9HuAbqf2tZOycbLAAAAdY"]
[Thu Mar 19 09:56:31.092828 2026] [:error] [pid 23988:tid 24008] [client 185.198.240.24:61667] [client 185.198.240.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "abtXz2nlkSPXj2matr0sHAAAANE"]
[Thu Mar 19 09:56:31.861914 2026] [:error] [pid 31205:tid 31222] [client 209.87.169.37:63173] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "abtXz1u5gZKGrGz5P1FK7QAAAUY"]
[Thu Mar 19 09:56:32.581919 2026] [:error] [pid 23884:tid 23969] [client 209.87.169.210:54595] [client 209.87.169.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "abtX0F6St-VCdOYnZMogIgAAAI0"]
[Thu Mar 19 09:56:33.052900 2026] [:error] [pid 23884:tid 23975] [client 45.131.195.236:39959] [client 45.131.195.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "abtX0V6St-VCdOYnZMogJgAAAJM"]
[Thu Mar 19 09:56:34.327963 2026] [:error] [pid 31205:tid 31231] [client 185.198.240.182:61569] [client 185.198.240.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "abtX0lu5gZKGrGz5P1FLIgAAAU4"]
[Thu Mar 19 09:56:35.112207 2026] [:error] [pid 23988:tid 23992] [client 209.87.169.37:37161] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "abtX02nlkSPXj2matr0sMAAAAME"]
[Thu Mar 19 09:56:39.451364 2026] [:error] [pid 32226:tid 32248] [client 209.87.169.241:60333] [client 209.87.169.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "abtX17Bb58lgPwqxC6rJ8wAAAxQ"]
[Thu Mar 19 09:56:43.113542 2026] [:error] [pid 31313:tid 31361] [client 209.87.169.247:48521] [client 209.87.169.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "abtX2w9HuAbqf2tZOycbrwAAAcA"]
[Thu Mar 19 09:56:43.817945 2026] [:error] [pid 23884:tid 23967] [client 209.87.169.207:50351] [client 209.87.169.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "abtX216St-VCdOYnZMogZAAAAIs"]
[Thu Mar 19 09:56:45.981774 2026] [:error] [pid 31447:tid 31478] [client 209.87.169.214:24061] [client 209.87.169.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "abtX3RmVNRDSLnGvghic3gAAAhc"]
[Thu Mar 19 09:56:47.533909 2026] [:error] [pid 32226:tid 32250] [client 209.87.169.68:23993] [client 209.87.169.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "abtX37Bb58lgPwqxC6rKHgAAAxY"]
[Thu Mar 19 09:56:47.977400 2026] [:error] [pid 23882:tid 23903] [client 209.87.169.68:36053] [client 209.87.169.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "abtX37WnClbtbN12M78UJQAAAAE"]
[Thu Mar 19 09:56:48.494957 2026] [:error] [pid 23884:tid 23957] [client 209.87.169.253:42677] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "abtX4F6St-VCdOYnZMogogAAAIE"]
[Thu Mar 19 09:56:49.125410 2026] [:error] [pid 23882:tid 23913] [client 209.87.169.30:45663] [client 209.87.169.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "abtX4bWnClbtbN12M78ULwAAAAs"]
[Thu Mar 19 09:56:49.632197 2026] [:error] [pid 23882:tid 23908] [client 209.87.169.44:23407] [client 209.87.169.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "abtX4bWnClbtbN12M78UOgAAAAY"]
[Thu Mar 19 09:56:50.395471 2026] [:error] [pid 3278:tid 3288] [client 209.87.169.53:41213] [client 209.87.169.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "abtX4gC2T_lM6ZgvfcRORwAAAQc"]
[Thu Mar 19 09:56:50.817325 2026] [:error] [pid 3278:tid 3300] [client 209.87.169.214:22017] [client 209.87.169.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "abtX4gC2T_lM6ZgvfcROSwAAARM"]
[Thu Mar 19 09:56:51.286603 2026] [:error] [pid 31447:tid 31455] [client 209.87.169.248:47059] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "abtX4xmVNRDSLnGvghidAQAAAgA"]
[Thu Mar 19 09:56:52.821268 2026] [:error] [pid 31447:tid 31474] [client 209.87.169.248:58717] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "abtX5BmVNRDSLnGvghidDgAAAhM"]
[Thu Mar 19 09:56:54.266664 2026] [:error] [pid 23882:tid 23922] [client 209.87.169.228:58167] [client 209.87.169.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "abtX5rWnClbtbN12M78UfgAAABQ"]
[Thu Mar 19 09:56:55.230648 2026] [:error] [pid 23884:tid 23959] [client 209.87.169.245:27575] [client 209.87.169.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "abtX516St-VCdOYnZMog3wAAAIM"]
[Thu Mar 19 09:56:56.152706 2026] [:error] [pid 23883:tid 23949] [client 45.131.195.237:55183] [client 45.131.195.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "abtX6NNi-EnEAH4abz2M4gAAAFQ"]
[Thu Mar 19 09:56:57.782434 2026] [:error] [pid 31447:tid 31458] [client 209.87.169.60:45815] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "abtX6RmVNRDSLnGvghidLQAAAgM"]
[Thu Mar 19 09:57:00.015934 2026] [:error] [pid 23882:tid 23920] [client 209.87.169.215:45375] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "abtX7LWnClbtbN12M78UwgAAABI"]
[Thu Mar 19 09:57:01.574644 2026] [:error] [pid 23883:tid 23950] [client 209.87.169.30:44697] [client 209.87.169.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "abtX7dNi-EnEAH4abz2M-AAAAFU"]
[Thu Mar 19 09:57:03.046875 2026] [:error] [pid 31735:tid 31752] [client 209.87.169.28:22049] [client 209.87.169.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "abtX73-gyQbRQWJYccw7swAAAo0"]
[Thu Mar 19 09:57:04.943253 2026] [:error] [pid 31205:tid 31229] [client 209.87.169.241:27031] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Mar 19 09:57:05.196567 2026] [:error] [pid 31205:tid 31216] [client 209.87.169.241:27031] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Mar 19 09:57:05.478738 2026] [:error] [pid 31205:tid 31216] [client 209.87.169.241:27031] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Mar 19 09:57:07.340050 2026] [:error] [pid 3278:tid 3292] [client 209.87.169.212:31871] [client 209.87.169.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "abtX8wC2T_lM6ZgvfcROyAAAAQs"]
[Thu Mar 19 09:57:07.768137 2026] [:error] [pid 31313:tid 31367] [client 209.87.169.29:39653] [client 209.87.169.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "abtX8w9HuAbqf2tZOycdMAAAAcY"]
[Thu Mar 19 09:57:08.285335 2026] [:error] [pid 31447:tid 31460] [client 209.87.169.54:63263] [client 209.87.169.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "abtX9BmVNRDSLnGvghidXAAAAgU"]
[Thu Mar 19 09:57:08.785873 2026] [:error] [pid 31447:tid 31475] [client 209.87.169.228:41257] [client 209.87.169.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "abtX9BmVNRDSLnGvghidYwAAAhQ"]
[Thu Mar 19 09:57:09.295813 2026] [:error] [pid 23883:tid 23947] [client 209.87.169.60:60745] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "abtX9dNi-EnEAH4abz2NMAAAAFI"]
[Thu Mar 19 09:57:10.849810 2026] [:error] [pid 23884:tid 23976] [client 209.87.169.208:39249] [client 209.87.169.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "abtX9l6St-VCdOYnZMohfgAAAJQ"]
[Thu Mar 19 09:57:11.626804 2026] [:error] [pid 24925:tid 24933] [client 209.87.169.74:49205] [client 209.87.169.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "abtX9_UZEHbnUgjEbWM7wwAAAYQ"]
[Thu Mar 19 09:57:12.094024 2026] [:error] [pid 23988:tid 24004] [client 209.87.169.61:44181] [client 209.87.169.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "abtX-GnlkSPXj2matr0s8gAAAM0"]
[Thu Mar 19 09:57:12.554875 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.252:38723] [client 209.87.169.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "abtX-LBb58lgPwqxC6rKpgAAAwA"]
[Thu Mar 19 09:57:23.006358 2026] [:error] [pid 31447:tid 31466] [client 209.87.169.59:45663] [client 209.87.169.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "abtYAxmVNRDSLnGvghidpgAAAgs"]
[Thu Mar 19 09:59:18.071753 2026] [autoindex:error] [pid 25269:tid 25292] [client 209.87.169.237:55597] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 12:23:18.121020 2026] [:error] [pid 25269:tid 25284] [client 35.173.201.178:52409] [client 35.173.201.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "abt6NsU9ntriqNcU-b68UQAAA8w"]
[Thu Mar 19 12:23:18.533542 2026] [:error] [pid 23882:tid 23925] [client 35.173.201.178:58988] [client 35.173.201.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "abt6NrWnClbtbN12M7-AXgAAABc"]
[Thu Mar 19 12:23:18.956734 2026] [:error] [pid 24925:tid 24948] [client 35.173.201.178:50384] [client 35.173.201.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "abt6NvUZEHbnUgjEbWNiAgAAAZM"]
[Thu Mar 19 12:54:11.467163 2026] [:error] [pid 23882:tid 23921] [client 154.16.49.101:5579] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feed/"] [unique_id "abuBc7WnClbtbN12M7-T_AAAABM"]
[Thu Mar 19 14:08:10.086196 2026] [:error] [pid 11015:tid 11066] [client 112.208.64.137:59720] [client 112.208.64.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.64.137, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abuSyvPcMwFQZAVfzLQGUwAAAJQ"]
[Thu Mar 19 14:08:10.092651 2026] [:error] [pid 11015:tid 11066] [client 112.208.64.137:59720] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 19 19:43:58.485986 2026] [:error] [pid 11016:tid 11079] [client 45.131.195.4:26427] [client 45.131.195.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.4, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "abvhfhPK94J9G19C6uVQAAAAAQY"]
[Thu Mar 19 19:43:58.488763 2026] [:error] [pid 11016:tid 11079] [client 45.131.195.4:26427] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Mar 19 19:56:56.022381 2026] [:error] [pid 51091:tid 51133] [client 103.79.19.82:30873] [client 103.79.19.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.79.19.82, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abvkiL7LZKhdJPD9CBvLggAAAVY"]
[Thu Mar 19 19:56:56.028734 2026] [:error] [pid 51091:tid 51133] [client 103.79.19.82:30873] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 19 21:20:24.561133 2026] [:error] [pid 11110:tid 11120] [client 20.104.104.81:29416] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Mar 19 21:20:24.770605 2026] [:error] [pid 11110:tid 11134] [client 20.104.104.81:29416] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Mar 19 21:20:25.220203 2026] [:error] [pid 11110:tid 11130] [client 20.104.104.81:29416] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Thu Mar 19 21:20:25.436270 2026] [:error] [pid 11110:tid 11135] [client 20.104.104.81:29416] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Mar 19 21:20:25.857709 2026] [:error] [pid 11110:tid 11129] [client 20.104.104.81:29416] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Thu Mar 19 21:20:26.068511 2026] [:error] [pid 11110:tid 11123] [client 20.104.104.81:29416] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Mar 19 21:20:26.356076 2026] [:error] [pid 11110:tid 11122] [client 20.104.104.81:29416] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Thu Mar 19 21:20:26.802193 2026] [:error] [pid 11110:tid 11138] [client 20.104.104.81:29416] [client 20.104.104.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abv4GgSNPqGfikw7k8LARQAAABc"]
[Thu Mar 19 21:20:36.363895 2026] [:error] [pid 1441:tid 1447] [client 20.104.104.81:29381] [client 20.104.104.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abv4JIf6BGzjfVNuehUgYQAAAwQ"]
[Thu Mar 19 21:20:37.676017 2026] [:error] [pid 1285:tid 1303] [client 20.104.104.81:29433] [client 20.104.104.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abv4JVE95r3zR75X1Ho_aQAAAhA"]
[Fri Mar 20 01:14:31.602911 2026] [:error] [pid 46126:tid 46222] [client 209.97.171.56:63362] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "abwu96Q44YePbsZz3j7MWAAAAQY"]
[Fri Mar 20 01:14:32.024312 2026] [:error] [pid 46125:tid 46243] [client 209.97.171.56:56501] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "abwu-GgN4lI6NHeckY5cPAAAAJE"]
[Fri Mar 20 01:14:32.437015 2026] [:error] [pid 11258:tid 11274] [client 209.97.171.56:53436] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "abwu-JPHb95f6xzHJOcPnQAAAM4"]
[Fri Mar 20 01:14:32.591355 2026] [:error] [pid 46126:tid 46256] [client 209.97.171.56:56005] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "abwu-KQ44YePbsZz3j7MdgAAARc"]
[Fri Mar 20 01:22:39.862693 2026] [:error] [pid 11258:tid 11278] [client 187.189.69.9:2009] [client 187.189.69.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.69.9, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abww35PHb95f6xzHJOcVgAAAANI"]
[Fri Mar 20 01:22:39.867852 2026] [:error] [pid 11258:tid 11278] [client 187.189.69.9:2009] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 20 07:31:11.050057 2026] [:error] [pid 55419:tid 55433] [client 179.227.141.181:60166] [client 179.227.141.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.227.141.181, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abyHP2ZBdOmqhJCTdb7b9wAAAww"]
[Fri Mar 20 07:31:11.055146 2026] [:error] [pid 55419:tid 55433] [client 179.227.141.181:60166] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 20 08:32:30.068559 2026] [:error] [pid 55419:tid 55435] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Mar 20 08:32:30.203351 2026] [:error] [pid 55419:tid 55425] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Fri Mar 20 08:32:30.328628 2026] [:error] [pid 55419:tid 55428] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Mar 20 08:32:30.460824 2026] [:error] [pid 55419:tid 55429] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Mar 20 08:32:30.583270 2026] [:error] [pid 55419:tid 55422] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Mar 20 08:32:30.976307 2026] [:error] [pid 55419:tid 55433] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Mar 20 08:32:31.099521 2026] [:error] [pid 55419:tid 55445] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Mar 20 08:32:31.234824 2026] [:error] [pid 55419:tid 55434] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Mar 20 08:32:31.357028 2026] [:error] [pid 55419:tid 55426] [client 104.208.81.111:6309] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Mar 20 08:32:31.476727 2026] [:error] [pid 55419:tid 55442] [client 104.208.81.111:6309] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "abyVn2ZBdOmqhJCTdb7h7gAAAxU"]
[Fri Mar 20 08:32:31.953845 2026] [:error] [pid 58126:tid 58175] [client 104.208.81.111:6133] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "abyVn6KAmdXQSS0Y5KB1AAAAAEM"]
[Fri Mar 20 08:32:32.440627 2026] [:error] [pid 55239:tid 55273] [client 104.208.81.111:6126] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "abyVoKycM6mGWSmcyoIMEQAAAcA"]
[Fri Mar 20 08:32:32.927849 2026] [:error] [pid 55299:tid 55326] [client 104.208.81.111:6118] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "abyVoPoGhbNgkNIkZwmmIgAAAhU"]
[Fri Mar 20 09:49:42.664017 2026] [:error] [pid 51714:tid 51718] [client 1.123.155.9:60294] [client 1.123.155.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.123.155.9, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "abyntjWI82pxvQ0gkssIQwAAAII"]
[Fri Mar 20 09:49:42.670298 2026] [:error] [pid 51714:tid 51718] [client 1.123.155.9:60294] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 20 16:14:33.270628 2026] [:error] [pid 49081:tid 49127] [client 152.52.128.58:58607] [client 152.52.128.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.52.128.58, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab0B6Ro1LBAUhfhYPR0EjQAAAQw"]
[Fri Mar 20 16:14:33.275433 2026] [:error] [pid 49081:tid 49127] [client 152.52.128.58:58607] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 20 17:11:40.053143 2026] [:error] [pid 51714:tid 51727] [client 162.158.95.242:11310] [client 162.158.95.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/refs/heads/master"] [unique_id "ab0PTDWI82pxvQ0gksu-uwAAAIs"]
[Fri Mar 20 17:11:40.057744 2026] [:error] [pid 49081:tid 49132] [client 162.158.95.241:12046] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "ab0PTBo1LBAUhfhYPR0rgwAAARE"]
[Fri Mar 20 17:11:40.103609 2026] [:error] [pid 49080:tid 49106] [client 162.158.95.55:11092] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/logs/HEAD"] [unique_id "ab0PTIk5CHi4V0A3tti7lAAAAFQ"]
[Fri Mar 20 17:11:40.108099 2026] [:error] [pid 49170:tid 49177] [client 162.158.95.241:12042] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/refs/heads/main"] [unique_id "ab0PTM-c8ctLVDCqUJVK0gAAAAM"]
[Fri Mar 20 17:11:40.112050 2026] [:error] [pid 49081:tid 49124] [client 162.158.95.55:11084] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/index"] [unique_id "ab0PTBo1LBAUhfhYPR0rhAAAAQk"]
[Fri Mar 20 17:11:40.166071 2026] [:error] [pid 49080:tid 49086] [client 162.158.94.34:10239] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "ab0PTIk5CHi4V0A3tti7lQAAAEA"]
[Fri Mar 20 17:11:41.097885 2026] [:error] [pid 51714:tid 51740] [client 162.158.95.56:14038] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "ab0PTTWI82pxvQ0gksu-vQAAAJg"]
[Fri Mar 20 17:11:41.139559 2026] [:error] [pid 49080:tid 49095] [client 162.158.94.35:9491] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "ab0PTYk5CHi4V0A3tti7lwAAAEk"]
[Fri Mar 20 17:11:41.164514 2026] [:error] [pid 49081:tid 49131] [client 162.158.95.55:11096] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "ab0PTRo1LBAUhfhYPR0rhgAAARA"]
[Fri Mar 20 17:11:41.188222 2026] [:error] [pid 27302:tid 27313] [client 162.158.94.34:10245] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "ab0PTbDKiUve17xv6yFB_AAAAMk"]
[Fri Mar 20 17:11:41.259732 2026] [:error] [pid 27302:tid 27305] [client 162.158.94.164:13279] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev"] [unique_id "ab0PTbDKiUve17xv6yFB_QAAAME"]
[Fri Mar 20 17:11:41.297124 2026] [:error] [pid 51714:tid 51725] [client 162.158.94.165:10809] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "ab0PTTWI82pxvQ0gksu-vgAAAIk"]
[Fri Mar 20 17:11:42.120398 2026] [:error] [pid 27302:tid 27320] [client 162.158.95.55:11097] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "ab0PTrDKiUve17xv6yFCAAAAANA"]
[Fri Mar 20 17:11:42.150834 2026] [:error] [pid 49081:tid 49130] [client 162.158.94.164:10405] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "ab0PTho1LBAUhfhYPR0riwAAAQ8"]
[Fri Mar 20 17:11:42.232354 2026] [:error] [pid 27302:tid 27314] [client 162.158.95.55:11104] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "ab0PTrDKiUve17xv6yFCAQAAAMo"]
[Fri Mar 20 17:11:42.244395 2026] [:error] [pid 49081:tid 49133] [client 162.158.95.242:11311] [client 162.158.95.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "ab0PTho1LBAUhfhYPR0rjAAAARI"]
[Fri Mar 20 17:11:42.304157 2026] [:error] [pid 49081:tid 49118] [client 162.158.94.34:10248] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "ab0PTho1LBAUhfhYPR0rjQAAAQM"]
[Fri Mar 20 17:11:42.355780 2026] [:error] [pid 49081:tid 49121] [client 162.158.95.55:11111] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.tmp"] [unique_id "ab0PTho1LBAUhfhYPR0rjgAAAQY"]
[Fri Mar 20 17:11:43.154858 2026] [:error] [pid 49082:tid 49155] [client 162.158.94.165:11416] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production.local"] [unique_id "ab0PT6pllYJI1LUIdL-ZSwAAAU0"]
[Fri Mar 20 17:11:43.180998 2026] [:error] [pid 27302:tid 27319] [client 162.158.94.35:9493] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.example"] [unique_id "ab0PT7DKiUve17xv6yFCBQAAAM8"]
[Fri Mar 20 17:11:43.239649 2026] [:error] [pid 51714:tid 51719] [client 162.158.94.35:9500] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development.local"] [unique_id "ab0PTzWI82pxvQ0gksu-wAAAAIM"]
[Fri Mar 20 17:11:43.300140 2026] [:error] [pid 49170:tid 49183] [client 162.158.95.55:11113] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "ab0PT8-c8ctLVDCqUJVK1QAAAAk"]
[Fri Mar 20 17:11:43.366031 2026] [:error] [pid 49170:tid 49191] [client 162.158.94.165:11423] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "ab0PT8-c8ctLVDCqUJVK2AAAABE"]
[Fri Mar 20 17:11:43.419878 2026] [:error] [pid 49082:tid 49146] [client 162.158.95.56:14039] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backend/.env"] [unique_id "ab0PT6pllYJI1LUIdL-ZTAAAAUQ"]
[Fri Mar 20 17:11:44.149057 2026] [:error] [pid 49080:tid 49102] [client 162.158.95.241:9725] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "ab0PUIk5CHi4V0A3tti7mAAAAFA"]
[Fri Mar 20 17:11:44.244040 2026] [:error] [pid 49081:tid 49115] [client 162.158.94.35:9504] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/.env"] [unique_id "ab0PUBo1LBAUhfhYPR0rkQAAAQA"]
[Fri Mar 20 17:11:44.249896 2026] [:error] [pid 49081:tid 49136] [client 162.158.94.34:10249] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/admin/.env"] [unique_id "ab0PUBo1LBAUhfhYPR0rkgAAARU"]
[Fri Mar 20 17:11:44.357579 2026] [:error] [pid 49081:tid 49130] [client 162.158.94.35:9505] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env"] [unique_id "ab0PUBo1LBAUhfhYPR0rlAAAAQ8"]
[Fri Mar 20 17:11:44.435266 2026] [:error] [pid 49081:tid 49139] [client 162.158.94.164:10406] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/private/.env"] [unique_id "ab0PUBo1LBAUhfhYPR0rlgAAARg"]
[Fri Mar 20 17:11:45.190217 2026] [:error] [pid 49081:tid 49126] [client 162.158.95.241:9729] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.local"] [unique_id "ab0PURo1LBAUhfhYPR0rmQAAAQs"]
[Fri Mar 20 17:11:45.268549 2026] [:error] [pid 49081:tid 49131] [client 162.158.94.165:11427] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.php"] [unique_id "ab0PURo1LBAUhfhYPR0rmgAAARA"]
[Fri Mar 20 17:11:45.313032 2026] [:error] [pid 49081:tid 49116] [client 162.158.95.241:9731] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.json"] [unique_id "ab0PURo1LBAUhfhYPR0rmwAAAQE"]
[Fri Mar 20 17:11:45.418176 2026] [:error] [pid 49081:tid 49122] [client 162.158.95.56:14043] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_backup"] [unique_id "ab0PURo1LBAUhfhYPR0rnAAAAQc"]
[Fri Mar 20 17:11:45.449048 2026] [:error] [pid 49081:tid 49129] [client 162.158.94.164:10413] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env~"] [unique_id "ab0PURo1LBAUhfhYPR0rnQAAAQ4"]
[Fri Mar 20 17:11:45.455536 2026] [:error] [pid 49081:tid 49128] [client 162.158.94.34:12276] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env1"] [unique_id "ab0PURo1LBAUhfhYPR0rngAAAQ0"]
[Fri Mar 20 17:11:45.455846 2026] [:error] [pid 49081:tid 49121] [client 162.158.95.242:10472] [client 162.158.95.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env2"] [unique_id "ab0PURo1LBAUhfhYPR0rnwAAAQY"]
[Fri Mar 20 17:11:46.269305 2026] [:error] [pid 49081:tid 49138] [client 162.158.94.34:12277] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dist"] [unique_id "ab0PUho1LBAUhfhYPR0rowAAARc"]
[Fri Mar 20 17:11:46.392402 2026] [:error] [pid 49081:tid 49119] [client 162.158.95.56:10889] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.envrc"] [unique_id "ab0PUho1LBAUhfhYPR0rpAAAAQQ"]
[Fri Mar 20 17:11:46.449709 2026] [:error] [pid 49081:tid 49137] [client 162.158.94.34:12285] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.prod"] [unique_id "ab0PUho1LBAUhfhYPR0rpQAAARY"]
[Fri Mar 20 17:11:46.460664 2026] [:error] [pid 49081:tid 49126] [client 162.158.95.55:9710] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev.local"] [unique_id "ab0PUho1LBAUhfhYPR0rpwAAAQs"]
[Fri Mar 20 17:11:46.479763 2026] [:error] [pid 49082:tid 49151] [client 162.158.94.165:11430] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.orig"] [unique_id "ab0PUqpllYJI1LUIdL-ZTwAAAUk"]
[Fri Mar 20 17:11:46.493948 2026] [:error] [pid 49081:tid 49134] [client 162.158.94.35:11166] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production.bak"] [unique_id "ab0PUho1LBAUhfhYPR0rqAAAARM"]
[Fri Mar 20 17:11:47.318791 2026] [:error] [pid 49080:tid 49103] [client 162.158.95.241:9736] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.docker"] [unique_id "ab0PU4k5CHi4V0A3tti7mgAAAFE"]
[Fri Mar 20 17:11:47.418748 2026] [:error] [pid 49080:tid 49100] [client 162.158.95.56:10896] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.container"] [unique_id "ab0PU4k5CHi4V0A3tti7mwAAAE4"]
[Fri Mar 20 17:11:47.488385 2026] [:error] [pid 49080:tid 49091] [client 162.158.95.55:9712] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/docker/.env"] [unique_id "ab0PU4k5CHi4V0A3tti7nAAAAEU"]
[Fri Mar 20 17:11:47.535077 2026] [:error] [pid 49080:tid 49088] [client 162.158.95.55:9720] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/docker/.env.local"] [unique_id "ab0PU4k5CHi4V0A3tti7nQAAAEI"]
[Fri Mar 20 17:11:47.555460 2026] [:error] [pid 27302:tid 27307] [client 162.158.94.34:12288] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/server/.env"] [unique_id "ab0PU7DKiUve17xv6yFCDQAAAMM"]
[Fri Mar 20 17:11:47.800521 2026] [:error] [pid 27302:tid 27310] [client 162.158.94.35:11169] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/var/www/.env"] [unique_id "ab0PU7DKiUve17xv6yFCDgAAAMY"]
[Fri Mar 20 17:11:48.338512 2026] [:error] [pid 49080:tid 49108] [client 162.158.95.241:9744] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/srv/.env"] [unique_id "ab0PVIk5CHi4V0A3tti7pAAAAFY"]
[Fri Mar 20 17:11:48.466831 2026] [:error] [pid 49080:tid 49089] [client 162.158.94.164:10418] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/web/.env"] [unique_id "ab0PVIk5CHi4V0A3tti7pQAAAEM"]
[Fri Mar 20 17:11:48.508428 2026] [:error] [pid 49080:tid 49109] [client 162.158.95.56:10904] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/www/.env"] [unique_id "ab0PVIk5CHi4V0A3tti7pgAAAFc"]
[Fri Mar 20 17:11:48.523540 2026] [:error] [pid 49080:tid 49094] [client 162.158.94.165:11432] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/site/.env"] [unique_id "ab0PVIk5CHi4V0A3tti7pwAAAEg"]
[Fri Mar 20 17:11:48.563364 2026] [:error] [pid 49080:tid 49098] [client 162.158.94.35:11177] [client 162.158.94.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/var/www/html/.env"] [unique_id "ab0PVIk5CHi4V0A3tti7qAAAAEw"]
[Fri Mar 20 17:11:48.811087 2026] [:error] [pid 49080:tid 49093] [client 162.158.94.164:10421] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/home/.env"] [unique_id "ab0PVIk5CHi4V0A3tti7rAAAAEc"]
[Fri Mar 20 17:11:49.313496 2026] [:error] [pid 49081:tid 49132] [client 162.158.94.165:13415] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "ab0PVRo1LBAUhfhYPR0rugAAARE"]
[Fri Mar 20 17:11:49.391858 2026] [:error] [pid 49080:tid 49105] [client 162.158.95.56:10906] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/root/.env"] [unique_id "ab0PVYk5CHi4V0A3tti7swAAAFM"]
[Fri Mar 20 17:11:49.533584 2026] [:error] [pid 49081:tid 49116] [client 162.158.94.34:12296] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_settings"] [unique_id "ab0PVRo1LBAUhfhYPR0rvgAAAQE"]
[Fri Mar 20 17:11:49.533606 2026] [:error] [pid 49081:tid 49127] [client 162.158.94.164:10424] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_config"] [unique_id "ab0PVRo1LBAUhfhYPR0rvQAAAQw"]
[Fri Mar 20 17:11:49.548316 2026] [:error] [pid 27302:tid 27320] [client 162.158.95.242:10474] [client 162.158.95.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_secret"] [unique_id "ab0PVbDKiUve17xv6yFCIQAAANA"]
[Fri Mar 20 17:11:49.632788 2026] [:error] [pid 49081:tid 49124] [client 162.158.94.165:11437] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local.backup"] [unique_id "ab0PVRo1LBAUhfhYPR0rvwAAAQk"]
[Fri Mar 20 17:11:49.810875 2026] [:error] [pid 49170:tid 49183] [client 162.158.94.164:13760] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "ab0PVc-c8ctLVDCqUJVK3gAAAAk"]
[Fri Mar 20 17:11:49.919053 2026] [:error] [pid 49082:tid 49160] [client 162.158.95.55:12268] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/index"] [unique_id "ab0PVapllYJI1LUIdL-ZVQAAAVI"]
[Fri Mar 20 17:11:50.059389 2026] [:error] [pid 49081:tid 49134] [client 162.158.94.165:13416] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/refs/heads/main"] [unique_id "ab0PVho1LBAUhfhYPR0rwQAAARM"]
[Fri Mar 20 17:11:50.069245 2026] [:error] [pid 27302:tid 27328] [client 162.158.94.164:13767] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/refs/heads/master"] [unique_id "ab0PVrDKiUve17xv6yFCJAAAANg"]
[Fri Mar 20 17:11:50.156108 2026] [:error] [pid 49082:tid 49155] [client 162.158.94.34:11217] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "ab0PVqpllYJI1LUIdL-ZVgAAAU0"]
[Fri Mar 20 17:11:50.310552 2026] [:error] [pid 49081:tid 49133] [client 162.158.95.56:10740] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "ab0PVho1LBAUhfhYPR0rwwAAARI"]
[Fri Mar 20 17:11:50.431710 2026] [:error] [pid 49081:tid 49123] [client 162.158.94.164:13770] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "ab0PVho1LBAUhfhYPR0rxQAAAQg"]
[Fri Mar 20 17:11:50.560124 2026] [:error] [pid 49081:tid 49138] [client 162.158.95.56:10746] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development"] [unique_id "ab0PVho1LBAUhfhYPR0rxwAAARc"]
[Fri Mar 20 17:11:50.584790 2026] [:error] [pid 49081:tid 49127] [client 162.158.94.34:11224] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dev"] [unique_id "ab0PVho1LBAUhfhYPR0ryAAAAQw"]
[Fri Mar 20 17:11:50.676406 2026] [:error] [pid 49081:tid 49124] [client 162.158.94.164:13771] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.test"] [unique_id "ab0PVho1LBAUhfhYPR0rygAAAQk"]
[Fri Mar 20 17:11:50.819073 2026] [:error] [pid 49081:tid 49117] [client 162.158.94.34:11230] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.staging"] [unique_id "ab0PVho1LBAUhfhYPR0rzAAAAQI"]
[Fri Mar 20 17:11:50.930274 2026] [:error] [pid 49081:tid 49131] [client 162.158.94.164:13779] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "ab0PVho1LBAUhfhYPR0rzgAAARA"]
[Fri Mar 20 17:11:51.070890 2026] [:error] [pid 49081:tid 49116] [client 162.158.94.34:11237] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.bak"] [unique_id "ab0PVxo1LBAUhfhYPR0rzwAAAQE"]
[Fri Mar 20 17:11:51.098232 2026] [:error] [pid 49081:tid 49118] [client 162.158.95.241:14042] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "ab0PVxo1LBAUhfhYPR0r0AAAAQM"]
[Fri Mar 20 17:11:51.190531 2026] [:error] [pid 49081:tid 49124] [client 162.158.94.165:13422] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "ab0PVxo1LBAUhfhYPR0r0QAAAQk"]
[Fri Mar 20 17:11:51.327698 2026] [:error] [pid 49080:tid 49088] [client 162.158.94.165:13423] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.tmp"] [unique_id "ab0PV4k5CHi4V0A3tti7uAAAAEI"]
[Fri Mar 20 17:11:51.581156 2026] [:error] [pid 49080:tid 49092] [client 162.158.94.164:13783] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production.local"] [unique_id "ab0PV4k5CHi4V0A3tti7uQAAAEY"]
[Fri Mar 20 17:11:51.630439 2026] [:error] [pid 49081:tid 49131] [client 162.158.95.55:12271] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.development.local"] [unique_id "ab0PVxo1LBAUhfhYPR0r1gAAARA"]
[Fri Mar 20 17:11:51.689679 2026] [:error] [pid 49080:tid 49094] [client 162.158.95.241:14050] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "ab0PV4k5CHi4V0A3tti7uwAAAEg"]
[Fri Mar 20 17:11:51.844198 2026] [:error] [pid 49081:tid 49116] [client 162.158.95.56:10752] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/app/.env"] [unique_id "ab0PVxo1LBAUhfhYPR0r1wAAAQE"]
[Fri Mar 20 17:11:52.107061 2026] [:error] [pid 49080:tid 49100] [client 162.158.95.241:14052] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/backend/.env"] [unique_id "ab0PWIk5CHi4V0A3tti7vgAAAE4"]
[Fri Mar 20 17:11:52.146388 2026] [:error] [pid 49081:tid 49120] [client 162.158.94.165:10881] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "ab0PWBo1LBAUhfhYPR0r2QAAAQU"]
[Fri Mar 20 17:11:52.377950 2026] [:error] [pid 49170:tid 49179] [client 162.158.94.164:10300] [client 162.158.94.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/core/.env"] [unique_id "ab0PWM-c8ctLVDCqUJVK4gAAAAU"]
[Fri Mar 20 17:11:52.637337 2026] [:error] [pid 27302:tid 27327] [client 162.158.95.55:12279] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/public/.env"] [unique_id "ab0PWLDKiUve17xv6yFCKAAAANc"]
[Fri Mar 20 17:11:52.651869 2026] [:error] [pid 27302:tid 27323] [client 162.158.95.55:12280] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/private/.env"] [unique_id "ab0PWLDKiUve17xv6yFCKQAAANM"]
[Fri Mar 20 17:11:53.169618 2026] [:error] [pid 49080:tid 49106] [client 162.158.94.165:10892] [client 162.158.94.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env.local"] [unique_id "ab0PWYk5CHi4V0A3tti7wQAAAFQ"]
[Fri Mar 20 17:11:53.170360 2026] [:error] [pid 49080:tid 49093] [client 162.158.95.56:10754] [client 162.158.95.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.php"] [unique_id "ab0PWYk5CHi4V0A3tti7wgAAAEc"]
[Fri Mar 20 17:11:53.700134 2026] [:error] [pid 49080:tid 49104] [client 162.158.95.55:12287] [client 162.158.95.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env~"] [unique_id "ab0PWYk5CHi4V0A3tti7yAAAAFI"]
[Fri Mar 20 17:11:53.704598 2026] [:error] [pid 49080:tid 49086] [client 162.158.95.241:9475] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_backup"] [unique_id "ab0PWYk5CHi4V0A3tti7yQAAAEA"]
[Fri Mar 20 17:11:54.217700 2026] [:error] [pid 49170:tid 49178] [client 162.158.95.242:12675] [client 162.158.95.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env1"] [unique_id "ab0PWs-c8ctLVDCqUJVK5QAAAAQ"]
[Fri Mar 20 17:11:54.219893 2026] [:error] [pid 49080:tid 49093] [client 162.158.94.34:11244] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env2"] [unique_id "ab0PWok5CHi4V0A3tti7zAAAAEc"]
[Fri Mar 20 17:11:54.716433 2026] [:error] [pid 49080:tid 49110] [client 162.158.94.34:13384] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.dist"] [unique_id "ab0PWok5CHi4V0A3tti7zwAAAFg"]
[Fri Mar 20 17:11:54.731676 2026] [:error] [pid 49080:tid 49101] [client 162.158.95.241:9478] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.envrc"] [unique_id "ab0PWok5CHi4V0A3tti70AAAAE8"]
[Fri Mar 20 17:11:55.264828 2026] [:error] [pid 27302:tid 27315] [client 162.158.95.241:9479] [client 162.158.95.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production.bak"] [unique_id "ab0PW7DKiUve17xv6yFCMAAAAMs"]
[Fri Mar 20 17:11:55.780101 2026] [:error] [pid 27302:tid 27328] [client 162.158.95.242:12677] [client 162.158.95.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.prod"] [unique_id "ab0PW7DKiUve17xv6yFCMQAAANg"]
[Fri Mar 20 17:12:10.593250 2026] [:error] [pid 49080:tid 49101] [client 172.69.186.170:11859] [client 172.69.186.170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.docker"] [unique_id "ab0Paok5CHi4V0A3tti79gAAAE8"]
[Fri Mar 20 17:12:11.133195 2026] [:error] [pid 49170:tid 49190] [client 172.69.186.171:9711] [client 172.69.186.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.container"] [unique_id "ab0Pa8-c8ctLVDCqUJVK-QAAABA"]
[Fri Mar 20 17:12:30.940572 2026] [:error] [pid 49081:tid 49123] [client 172.69.186.24:12754] [client 172.69.186.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/web/.env"] [unique_id "ab0Pfho1LBAUhfhYPR0sQQAAAQg"]
[Fri Mar 20 17:12:31.007343 2026] [:error] [pid 49081:tid 49139] [client 172.69.186.62:9423] [client 172.69.186.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/site/.env"] [unique_id "ab0Pfxo1LBAUhfhYPR0sQgAAARg"]
[Fri Mar 20 17:12:31.262898 2026] [:error] [pid 49081:tid 49124] [client 172.69.186.214:10353] [client 172.69.186.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/var/www/.env"] [unique_id "ab0Pfxo1LBAUhfhYPR0sQwAAAQk"]
[Fri Mar 20 17:12:31.519739 2026] [:error] [pid 49081:tid 49119] [client 172.69.186.170:10161] [client 172.69.186.170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/var/www/html/.env"] [unique_id "ab0Pfxo1LBAUhfhYPR0sRwAAAQQ"]
[Fri Mar 20 17:12:31.782101 2026] [:error] [pid 49081:tid 49127] [client 172.69.186.45:13391] [client 172.69.186.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/root/.env"] [unique_id "ab0Pfxo1LBAUhfhYPR0sSQAAAQw"]
[Fri Mar 20 17:12:31.985980 2026] [:error] [pid 49081:tid 49120] [client 172.69.186.170:10168] [client 172.69.186.170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_config"] [unique_id "ab0Pfxo1LBAUhfhYPR0sSwAAAQU"]
[Fri Mar 20 17:12:32.038668 2026] [:error] [pid 49081:tid 49137] [client 172.69.186.45:13395] [client 172.69.186.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_secret"] [unique_id "ab0PgBo1LBAUhfhYPR0sTgAAARY"]
[Fri Mar 20 17:12:32.257700 2026] [:error] [pid 49081:tid 49135] [client 172.69.186.200:11338] [client 172.69.186.200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env_settings"] [unique_id "ab0PgBo1LBAUhfhYPR0sTwAAARQ"]
[Fri Mar 20 17:12:32.529655 2026] [:error] [pid 49082:tid 49142] [client 162.158.94.34:13345] [client 162.158.94.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local.backup"] [unique_id "ab0PgKpllYJI1LUIdL-ZZQAAAUA"]
[Fri Mar 20 17:13:12.474495 2026] [:error] [pid 49080:tid 49098] [client 172.69.186.160:10385] [client 172.69.186.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/www/.env"] [unique_id "ab0PqIk5CHi4V0A3tti8VQAAAEw"]
[Fri Mar 20 20:13:29.021855 2026] [:error] [pid 51714:tid 51723] [client 216.24.212.20:65275] [client 216.24.212.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.20, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "ab056TWI82pxvQ0gksvhVQAAAIc"]
[Fri Mar 20 20:13:29.025693 2026] [:error] [pid 51714:tid 51723] [client 216.24.212.20:65275] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 20 21:15:56.974070 2026] [:error] [pid 49082:tid 49149] [client 102.216.182.248:5447] [client 102.216.182.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.216.182.248, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab1IjKpllYJI1LUIdL_PYAAAAUc"]
[Fri Mar 20 21:15:56.981334 2026] [:error] [pid 49082:tid 49149] [client 102.216.182.248:5447] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 21 03:52:12.383678 2026] [:error] [pid 1601:tid 1624] [client 170.247.40.243:7652] [client 170.247.40.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.247.40.243, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab2lbKdDBYVcyITq-IEADQAAANM"]
[Sat Mar 21 03:52:12.390818 2026] [:error] [pid 1601:tid 1624] [client 170.247.40.243:7652] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 21 07:07:03.856049 2026] [:error] [pid 1491:tid 1568] [client 147.45.198.221:58371] [client 147.45.198.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "ab3TF63VfHftzE9w9t7ewgAAAIU"]
[Sat Mar 21 07:07:03.856206 2026] [:error] [pid 1491:tid 1563] [client 147.45.198.221:58369] [client 147.45.198.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "ab3TF63VfHftzE9w9t7ewwAAAIA"]
[Sat Mar 21 07:07:03.858983 2026] [:error] [pid 1491:tid 1583] [client 147.45.198.221:58368] [client 147.45.198.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/config/.env"] [unique_id "ab3TF63VfHftzE9w9t7exQAAAJM"]
[Sat Mar 21 07:07:03.859354 2026] [:error] [pid 1491:tid 1569] [client 147.45.198.221:58373] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Mar 21 07:07:03.864630 2026] [:error] [pid 1491:tid 1581] [client 147.45.198.221:58372] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sat Mar 21 07:07:04.148440 2026] [:error] [pid 1491:tid 1567] [client 147.45.198.221:58367] [client 147.45.198.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "ab3TGK3VfHftzE9w9t7ezAAAAIQ"]
[Sat Mar 21 07:07:04.152642 2026] [:error] [pid 1491:tid 1587] [client 147.45.198.221:58374] [client 147.45.198.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "ab3TGK3VfHftzE9w9t7ezQAAAJc"]
[Sat Mar 21 07:07:04.155646 2026] [:error] [pid 1491:tid 1568] [client 147.45.198.221:58372] File does not exist: /usr/local/apache/htdocs/suspended-page/php_info.php
[Sat Mar 21 07:07:04.158379 2026] [:error] [pid 1491:tid 1563] [client 147.45.198.221:58370] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Sat Mar 21 07:07:04.404439 2026] [:error] [pid 1491:tid 1573] [client 147.45.198.221:58373] [client 147.45.198.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "ab3TGK3VfHftzE9w9t7e0gAAAIo"]
[Sat Mar 21 07:07:04.411628 2026] [:error] [pid 1491:tid 1577] [client 147.45.198.221:58372] [client 147.45.198.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/_profiler/phpinfo"] [unique_id "ab3TGK3VfHftzE9w9t7e0wAAAI4"]
[Sat Mar 21 07:07:04.667388 2026] [:error] [pid 1491:tid 1566] [client 147.45.198.221:58055] [client 147.45.198.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "ab3TGK3VfHftzE9w9t7e1gAAAIM"]
[Sat Mar 21 07:07:04.672892 2026] [:error] [pid 1489:tid 1524] [client 147.45.198.221:58614] [client 147.45.198.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/_profiler/phpinfo"] [unique_id "ab3TGFRvnvBO_DG9kxsJsAAAABQ"]
[Sat Mar 21 07:07:04.918641 2026] [:error] [pid 1601:tid 1614] [client 147.45.198.221:58613] [client 147.45.198.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "ab3TGKdDBYVcyITq-IFSCgAAAMk"]
[Sat Mar 21 07:07:05.172958 2026] [:error] [pid 1491:tid 1567] [client 147.45.198.221:58615] [client 147.45.198.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test.php"] [unique_id "ab3TGa3VfHftzE9w9t7e2QAAAIQ"]
[Sat Mar 21 15:30:04.350368 2026] [:error] [pid 49170:tid 49185] [client 181.215.182.124:60529] [client 181.215.182.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "ab5I_L1KUC-QISS0eWqN_gAAAQ0"]
[Sat Mar 21 19:41:12.964572 2026] [:error] [pid 42886:tid 42910] [client 47.30.247.111:57883] [client 47.30.247.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.30.247.111, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab6D2F452dC6nbNWav1wBAAAAxY"]
[Sat Mar 21 19:41:12.970137 2026] [:error] [pid 42886:tid 42910] [client 47.30.247.111:57883] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 21 20:11:07.656194 2026] [:error] [pid 1489:tid 1523] [client 197.1.229.135:59968] [client 197.1.229.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.1.229.135, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab6K21RvnvBO_DG9kxsBMAAAABM"]
[Sat Mar 21 20:11:07.671028 2026] [:error] [pid 1489:tid 1523] [client 197.1.229.135:59968] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 21 20:11:54.933478 2026] [:error] [pid 33348:tid 33375] [client 187.86.171.130:44919] [client 187.86.171.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.171.130, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab6LCjEj9d9zzbs_KjgIIAAAAVg"]
[Sat Mar 21 20:11:54.940918 2026] [:error] [pid 33348:tid 33375] [client 187.86.171.130:44919] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 21 22:46:41.207136 2026] [:error] [pid 49170:tid 49185] [client 105.235.71.17:20594] [client 105.235.71.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.235.71.17, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab6vUb1KUC-QISS0eWoxPwAAAQ0"]
[Sat Mar 21 22:46:41.212713 2026] [:error] [pid 49170:tid 49185] [client 105.235.71.17:20594] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 22 06:56:06.523841 2026] [:error] [pid 51468:tid 51483] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sun Mar 22 06:56:06.733146 2026] [:error] [pid 51468:tid 51489] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sun Mar 22 06:56:06.942574 2026] [:error] [pid 51468:tid 51477] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 22 06:56:07.155024 2026] [:error] [pid 51468:tid 51493] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Sun Mar 22 06:56:07.366183 2026] [:error] [pid 51468:tid 51492] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Sun Mar 22 06:56:07.787138 2026] [:error] [pid 51468:tid 51499] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sun Mar 22 06:56:08.031716 2026] [:error] [pid 51468:tid 51483] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/wa.php
[Sun Mar 22 06:56:08.452791 2026] [:error] [pid 51468:tid 51494] [client 52.138.39.105:12293] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sun Mar 22 06:56:08.869172 2026] [:error] [pid 51468:tid 51479] [client 52.138.39.105:12293] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8iCE2TppSvA8W5CBSxwAAAAMM"]
[Sun Mar 22 06:56:09.701230 2026] [:error] [pid 51363:tid 51436] [client 52.138.39.105:64235] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8iCVwa9x6OCTRkhl1kwwAAAIc"]
[Sun Mar 22 06:56:10.528647 2026] [:error] [pid 51363:tid 51437] [client 52.138.39.105:64236] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8iClwa9x6OCTRkhl1kxgAAAIg"]
[Sun Mar 22 06:56:11.354068 2026] [:error] [pid 40039:tid 40049] [client 52.138.39.105:12625] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8iCx3aDgUJfBYishkhCwAAAQg"]
[Sun Mar 22 10:02:46.638051 2026] [:error] [pid 51468:tid 51491] [client 185.198.240.60:21167] [client 185.198.240.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.60, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "ab9Nxk2TppSvA8W5CBQF8AAAAM8"]
[Sun Mar 22 10:02:46.641778 2026] [:error] [pid 51468:tid 51491] [client 185.198.240.60:21167] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 22 15:52:57.554725 2026] [:error] [pid 40039:tid 40058] [client 223.184.186.241:40568] [client 223.184.186.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.184.186.241, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab-f2R3aDgUJfBYishliVAAAARE"]
[Sun Mar 22 15:52:57.559066 2026] [:error] [pid 40039:tid 40058] [client 223.184.186.241:40568] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 22 15:53:10.694374 2026] [:error] [pid 40039:tid 40052] [client 209.35.79.81:25774] [client 209.35.79.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.35.79.81, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ab-f5h3aDgUJfBYishlibQAAAQs"]
[Sun Mar 22 15:53:10.699623 2026] [:error] [pid 40039:tid 40052] [client 209.35.79.81:25774] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 22 20:38:56.064593 2026] [:error] [pid 51468:tid 51499] [client 20.119.51.14:16536] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "ab_i4E2TppSvA8W5CBRZMwAAANc"]
[Sun Mar 22 20:38:56.893082 2026] [:error] [pid 51468:tid 51486] [client 20.119.51.14:16525] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "ab_i4E2TppSvA8W5CBRZNQAAAMo"]
[Sun Mar 22 20:38:57.726319 2026] [:error] [pid 51363:tid 51449] [client 20.119.51.14:16393] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "ab_i4Vwa9x6OCTRkhl28pQAAAJM"]
[Sun Mar 22 20:38:58.561776 2026] [:error] [pid 30166:tid 30174] [client 20.119.51.14:16396] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wk/index.php"] [unique_id "ab_i4rm4_26jKMD0zy32TgAAAUM"]
[Sun Mar 22 21:09:09.309921 2026] [:error] [pid 51468:tid 51495] [client 217.216.37.52:51647] [client 217.216.37.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "ab_p9U2TppSvA8W5CBRjzAAAANM"]
[Sun Mar 22 21:09:09.500394 2026] [:error] [pid 30166:tid 30193] [client 217.216.37.52:53594] [client 217.216.37.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ab_p9bm4_26jKMD0zy0QQgAAAVI"]
[Sun Mar 22 21:09:09.691344 2026] [:error] [pid 51362:tid 51422] [client 217.216.37.52:59410] [client 217.216.37.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "ab_p9cOwPm3DXzTDjUfVxwAAAFU"]
[Sun Mar 22 22:16:16.570299 2026] [:error] [pid 51468:tid 51490] [client 23.226.132.115:49270] [client 23.226.132.115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "ab_5sE2TppSvA8W5CBSSngAAAM4"], referer: https://www.baidu.com/s?wd=login
[Mon Mar 23 07:38:41.020443 2026] [:error] [pid 14573:tid 14579] [client 196.117.15.112:64807] [client 196.117.15.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.117.15.112, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acB9ge-oSmHn3q4_J1HjjgAAAUQ"]
[Mon Mar 23 07:38:41.026033 2026] [:error] [pid 14573:tid 14579] [client 196.117.15.112:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 23 16:39:00.817085 2026] [:error] [pid 23440:tid 23477] [client 104.28.153.126:23222] [client 104.28.153.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "acD8JD49_8n8h_ttcUojSwAAAEE"]
[Mon Mar 23 16:50:48.641069 2026] [:error] [pid 35165:tid 35183] [client 20.102.82.167:11535] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Mar 23 16:50:49.079000 2026] [:error] [pid 35165:tid 35177] [client 20.102.82.167:11535] [client 20.102.82.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.102.82.167, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acD-6c6udpN6Esk7JKuZKwAAAYk"]
[Mon Mar 23 16:50:49.305533 2026] [:error] [pid 35165:tid 35171] [client 20.102.82.167:11535] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Mon Mar 23 16:50:50.196512 2026] [:error] [pid 35165:tid 35188] [client 20.102.82.167:11535] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Mon Mar 23 16:50:50.873588 2026] [:error] [pid 35165:tid 35175] [client 20.102.82.167:11535] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Mon Mar 23 16:50:51.091043 2026] [:error] [pid 35165:tid 35172] [client 20.102.82.167:11535] [client 20.102.82.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acD-686udpN6Esk7JKuZOQAAAYQ"]
[Mon Mar 23 16:50:51.986295 2026] [:error] [pid 14573:tid 14587] [client 20.102.82.167:11591] [client 20.102.82.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acD-6--oSmHn3q4_J1GYEQAAAUw"]
[Mon Mar 23 16:50:52.857671 2026] [:error] [pid 35165:tid 35174] [client 20.102.82.167:11594] [client 20.102.82.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acD-7M6udpN6Esk7JKuZPAAAAYY"]
[Mon Mar 23 16:50:53.686923 2026] [:error] [pid 35165:tid 35171] [client 20.102.82.167:11596] [client 20.102.82.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acD-7c6udpN6Esk7JKuZPQAAAYM"]
[Mon Mar 23 17:45:43.301703 2026] [:error] [pid 57265:tid 57268] [client 4.204.193.107:17986] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 23 17:45:43.510290 2026] [:error] [pid 57265:tid 57286] [client 4.204.193.107:17986] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 23 17:45:43.928059 2026] [:error] [pid 57265:tid 57282] [client 4.204.193.107:17986] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 23 17:45:44.137107 2026] [:error] [pid 57265:tid 57272] [client 4.204.193.107:17986] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 23 17:45:44.600998 2026] [:error] [pid 57265:tid 57275] [client 4.204.193.107:17986] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Mar 23 17:45:44.809354 2026] [:error] [pid 57265:tid 57289] [client 4.204.193.107:17986] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Mar 23 17:45:45.018747 2026] [:error] [pid 57265:tid 57288] [client 4.204.193.107:17986] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Mar 23 17:45:45.434853 2026] [:error] [pid 57265:tid 57278] [client 4.204.193.107:17986] [client 4.204.193.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acELyWNLjPJJkhuqCsggNgAAAQs"]
[Mon Mar 23 17:45:46.264540 2026] [:error] [pid 23440:tid 23483] [client 4.204.193.107:17654] [client 4.204.193.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acELyj49_8n8h_ttcUotTAAAAEc"]
[Mon Mar 23 17:45:47.112162 2026] [:error] [pid 14573:tid 14590] [client 4.204.193.107:17612] [client 4.204.193.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acELy--oSmHn3q4_J1GwgAAAAU8"]
[Mon Mar 23 17:45:47.943137 2026] [:error] [pid 23439:tid 23451] [client 4.204.193.107:17632] [client 4.204.193.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acELy6Zv8XIzUKdgaMeMfgAAAAI"]
[Mon Mar 23 18:10:40.228511 2026] [:error] [pid 23439:tid 23460] [client 34.11.93.99:56312] [client 34.11.93.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.93.99, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acERoKZv8XIzUKdgaMePGwAAAAs"]
[Mon Mar 23 18:10:40.232408 2026] [:error] [pid 23439:tid 23460] [client 34.11.93.99:56312] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 23 18:10:42.887059 2026] [:error] [pid 23439:tid 23468] [client 34.11.93.99:56312] [client 34.11.93.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "acERoqZv8XIzUKdgaMePJgAAABM"]
[Mon Mar 23 18:10:43.356212 2026] [:error] [pid 57265:tid 57289] [client 34.11.93.99:50279] [client 34.11.93.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "acERo2NLjPJJkhuqCsgzgAAAARY"]
[Mon Mar 23 18:10:43.789125 2026] [:error] [pid 14573:tid 14597] [client 34.11.93.99:62881] [client 34.11.93.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "acERo--oSmHn3q4_J1G99wAAAVY"]
[Mon Mar 23 18:10:44.235701 2026] [:error] [pid 14573:tid 14578] [client 34.11.93.99:64439] [client 34.11.93.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "acERpO-oSmHn3q4_J1G9-gAAAUM"]
[Mon Mar 23 18:10:44.671178 2026] [:error] [pid 23439:tid 23471] [client 34.11.93.99:52980] [client 34.11.93.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "acERpKZv8XIzUKdgaMePJwAAABY"]
[Mon Mar 23 18:10:45.115454 2026] [:error] [pid 23440:tid 23493] [client 34.11.93.99:56200] [client 34.11.93.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "acERpT49_8n8h_ttcUow3wAAAFE"]
[Mon Mar 23 18:10:45.569127 2026] [:error] [pid 23440:tid 23491] [client 34.11.93.99:57448] [client 34.11.93.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "acERpT49_8n8h_ttcUow4QAAAE8"]
[Mon Mar 23 21:27:39.314474 2026] [:error] [pid 38276:tid 38281] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Mon Mar 23 21:27:39.524166 2026] [:error] [pid 38276:tid 38283] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Mon Mar 23 21:27:39.731977 2026] [:error] [pid 38276:tid 38296] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/sty.php
[Mon Mar 23 21:27:39.941130 2026] [:error] [pid 38276:tid 38284] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Mon Mar 23 21:27:40.149076 2026] [:error] [pid 38276:tid 38290] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Mon Mar 23 21:27:40.357814 2026] [:error] [pid 38276:tid 38285] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Mon Mar 23 21:27:40.566992 2026] [:error] [pid 38276:tid 38288] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Mon Mar 23 21:27:40.774731 2026] [:error] [pid 38276:tid 38303] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Mon Mar 23 21:27:40.983060 2026] [:error] [pid 38276:tid 38294] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Mon Mar 23 21:27:41.192064 2026] [:error] [pid 38276:tid 38282] [client 40.85.246.124:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Mon Mar 23 21:27:41.412640 2026] [:error] [pid 38276:tid 38291] [client 40.85.246.124:30678] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acE_zZoKGiI-a7oME3L5awAAAMw"]
[Mon Mar 23 21:27:41.848454 2026] [:error] [pid 38276:tid 38280] [client 40.85.246.124:30689] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acE_zZoKGiI-a7oME3L5bgAAAME"]
[Mon Mar 23 21:27:42.265017 2026] [:error] [pid 38306:tid 38326] [client 40.85.246.124:30697] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acE_zjkL8qwu-hHc6BiimwAAARI"]
[Mon Mar 23 21:27:42.675462 2026] [:error] [pid 38177:tid 38228] [client 40.85.246.124:30625] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acE_znsYW-_HCI66MunzqwAAAE0"]
[Mon Mar 23 21:27:43.087794 2026] [:error] [pid 38276:tid 38290] [client 40.85.246.124:30695] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "acE_z5oKGiI-a7oME3L5cgAAAMs"]
[Mon Mar 23 21:27:43.497339 2026] [:error] [pid 38276:tid 38294] [client 40.85.246.124:30600] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "acE_z5oKGiI-a7oME3L5dgAAAM8"]
[Mon Mar 23 21:27:43.908735 2026] [:error] [pid 38306:tid 38324] [client 40.85.246.124:30717] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "acE_zzkL8qwu-hHc6BiioAAAARA"]
[Mon Mar 23 21:27:44.322548 2026] [:error] [pid 38176:tid 38205] [client 40.85.246.124:30690] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/path.php"] [unique_id "acE_0EtG4qlh1gvNjuI9vwAAABI"]
[Mon Mar 23 21:27:44.732968 2026] [:error] [pid 52341:tid 52353] [client 40.85.246.124:30605] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "acE_0KPKTBDR2u47Gb3XvAAAAUo"]
[Mon Mar 23 21:27:45.142924 2026] [:error] [pid 38176:tid 38201] [client 40.85.246.124:30607] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "acE_0UtG4qlh1gvNjuI9wAAAAA4"]
[Mon Mar 23 21:27:45.554063 2026] [:error] [pid 52341:tid 52359] [client 40.85.246.124:30609] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "acE_0aPKTBDR2u47Gb3XwQAAAVA"]
[Mon Mar 23 21:27:45.963959 2026] [:error] [pid 52341:tid 52358] [client 40.85.246.124:30622] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdf.php"] [unique_id "acE_0aPKTBDR2u47Gb3XxQAAAU8"]
[Mon Mar 23 21:27:46.398334 2026] [:error] [pid 38176:tid 38202] [client 40.85.246.124:30691] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "acE_0ktG4qlh1gvNjuI9wwAAAA8"]
[Mon Mar 23 21:27:46.820788 2026] [:error] [pid 52341:tid 52364] [client 40.85.246.124:30606] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "acE_0qPKTBDR2u47Gb3XxwAAAVU"]
[Mon Mar 23 21:27:47.231961 2026] [:error] [pid 52341:tid 52348] [client 40.85.246.124:30656] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "acE_06PKTBDR2u47Gb3XywAAAUU"]
[Mon Mar 23 21:27:47.641773 2026] [:error] [pid 52341:tid 52366] [client 40.85.246.124:30658] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fleen.php"] [unique_id "acE_06PKTBDR2u47Gb3XzgAAAVc"]
[Mon Mar 23 21:27:48.052701 2026] [:error] [pid 52341:tid 52344] [client 40.85.246.124:30593] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "acE_1KPKTBDR2u47Gb3X0wAAAUE"]
[Mon Mar 23 21:27:48.465496 2026] [:error] [pid 52341:tid 52364] [client 40.85.246.124:30707] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "acE_1KPKTBDR2u47Gb3X1wAAAVU"]
[Mon Mar 23 21:27:48.877369 2026] [:error] [pid 52341:tid 52354] [client 40.85.246.124:30685] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "acE_1KPKTBDR2u47Gb3X2AAAAUs"]
[Mon Mar 23 21:27:49.287232 2026] [:error] [pid 52341:tid 52348] [client 40.85.246.124:30718] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tem.php"] [unique_id "acE_1aPKTBDR2u47Gb3X2wAAAUU"]
[Mon Mar 23 21:27:49.696259 2026] [:error] [pid 38178:tid 38263] [client 40.85.246.124:30657] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "acE_1Q0axWfXsVvR9udDXQAAAJU"]
[Mon Mar 23 21:27:50.114542 2026] [:error] [pid 38176:tid 38190] [client 40.85.246.124:30653] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "acE_1ktG4qlh1gvNjuI9yAAAAAM"]
[Mon Mar 23 21:27:50.525095 2026] [:error] [pid 38178:tid 38246] [client 40.85.246.124:30699] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "acE_1g0axWfXsVvR9udDXwAAAIQ"]
[Mon Mar 23 21:27:50.936323 2026] [:error] [pid 38176:tid 38196] [client 40.85.246.124:30677] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av6m.php"] [unique_id "acE_1ktG4qlh1gvNjuI9yQAAAAk"]
[Mon Mar 23 21:27:51.348586 2026] [:error] [pid 38306:tid 38310] [client 40.85.246.124:30709] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "acE_1zkL8qwu-hHc6BiirwAAAQI"]
[Mon Mar 23 21:27:51.758634 2026] [:error] [pid 38276:tid 38295] [client 40.85.246.124:30715] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "acE_15oKGiI-a7oME3L5fgAAANA"]
[Mon Mar 23 21:27:52.175398 2026] [:error] [pid 52341:tid 52366] [client 40.85.246.124:30595] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "acE_2KPKTBDR2u47Gb3X6QAAAVc"]
[Mon Mar 23 21:27:52.586705 2026] [:error] [pid 52341:tid 52364] [client 40.85.246.124:30654] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autogooey.php"] [unique_id "acE_2KPKTBDR2u47Gb3X7QAAAVU"]
[Mon Mar 23 21:27:53.019018 2026] [:error] [pid 52341:tid 52344] [client 40.85.246.124:30602] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "acE_2aPKTBDR2u47Gb3X7gAAAUE"]
[Mon Mar 23 21:27:53.442523 2026] [:error] [pid 38306:tid 38326] [client 40.85.246.124:30612] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "acE_2TkL8qwu-hHc6BiiswAAARI"]
[Mon Mar 23 21:27:53.855423 2026] [:error] [pid 38306:tid 38319] [client 40.85.246.124:30705] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "acE_2TkL8qwu-hHc6BiitAAAAQs"]
[Mon Mar 23 21:27:54.268898 2026] [:error] [pid 38176:tid 38192] [client 40.85.246.124:30619] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mga.php"] [unique_id "acE_2ktG4qlh1gvNjuI9zQAAAAU"]
[Mon Mar 23 21:27:54.685029 2026] [:error] [pid 38276:tid 38303] [client 40.85.246.124:30719] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "acE_2poKGiI-a7oME3L5gAAAANg"]
[Mon Mar 23 21:27:55.119346 2026] [:error] [pid 38176:tid 38210] [client 40.85.246.124:30664] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "acE_20tG4qlh1gvNjuI9zgAAABc"]
[Mon Mar 23 21:27:55.530061 2026] [:error] [pid 52341:tid 52359] [client 40.85.246.124:30623] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "acE_26PKTBDR2u47Gb3X-QAAAVA"]
[Mon Mar 23 21:27:55.956862 2026] [:error] [pid 52341:tid 52351] [client 40.85.246.124:30596] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maxro.php"] [unique_id "acE_26PKTBDR2u47Gb3X_AAAAUg"]
[Mon Mar 23 21:27:56.384080 2026] [:error] [pid 52341:tid 52356] [client 40.85.246.124:30680] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "acE_3KPKTBDR2u47Gb3X_wAAAU0"]
[Mon Mar 23 21:27:56.794954 2026] [:error] [pid 38176:tid 38199] [client 40.85.246.124:30665] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "acE_3EtG4qlh1gvNjuI90gAAAAw"]
[Mon Mar 23 21:27:57.205790 2026] [:error] [pid 52341:tid 52345] [client 40.85.246.124:30711] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "acE_3aPKTBDR2u47Gb3YBgAAAUI"]
[Mon Mar 23 21:27:57.616869 2026] [:error] [pid 38176:tid 38198] [client 40.85.246.124:30662] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/agg.php"] [unique_id "acE_3UtG4qlh1gvNjuI91AAAAAs"]
[Mon Mar 23 21:27:58.029151 2026] [:error] [pid 38176:tid 38196] [client 40.85.246.124:30675] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "acE_3ktG4qlh1gvNjuI91gAAAAk"]
[Mon Mar 23 21:27:58.441070 2026] [:error] [pid 38276:tid 38282] [client 40.85.246.124:30679] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "acE_3poKGiI-a7oME3L5hAAAAMM"]
[Mon Mar 23 21:27:58.852803 2026] [:error] [pid 38176:tid 38207] [client 40.85.246.124:30712] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "acE_3ktG4qlh1gvNjuI93QAAABQ"]
[Mon Mar 23 21:27:59.265274 2026] [:error] [pid 38306:tid 38318] [client 40.85.246.124:30687] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "acE_3zkL8qwu-hHc6BiiuQAAAQo"]
[Mon Mar 23 21:27:59.675263 2026] [:error] [pid 38176:tid 38202] [client 40.85.246.124:30670] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "acE_30tG4qlh1gvNjuI94QAAAA8"]
[Mon Mar 23 21:28:00.086365 2026] [:error] [pid 52341:tid 52359] [client 40.85.246.124:30611] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "acE_4KPKTBDR2u47Gb3YEgAAAVA"]
[Mon Mar 23 21:28:00.497281 2026] [:error] [pid 52341:tid 52348] [client 40.85.246.124:30541] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "acE_4KPKTBDR2u47Gb3YFgAAAUU"]
[Mon Mar 23 21:28:00.910786 2026] [:error] [pid 52341:tid 52356] [client 40.85.246.124:30692] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsvvs.php"] [unique_id "acE_4KPKTBDR2u47Gb3YGQAAAU0"]
[Mon Mar 23 21:28:01.332549 2026] [:error] [pid 52341:tid 52367] [client 40.85.246.124:30684] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "acE_4aPKTBDR2u47Gb3YHQAAAVg"]
[Mon Mar 23 21:28:01.743128 2026] [:error] [pid 52341:tid 52355] [client 40.85.246.124:30613] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "acE_4aPKTBDR2u47Gb3YIQAAAUw"]
[Mon Mar 23 21:28:02.165182 2026] [:error] [pid 38176:tid 38188] [client 40.85.246.124:30601] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "acE_4ktG4qlh1gvNjuI95gAAAAE"]
[Mon Mar 23 21:28:02.585213 2026] [:error] [pid 52341:tid 52349] [client 40.85.246.124:30562] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/G-In.php"] [unique_id "acE_4qPKTBDR2u47Gb3YJwAAAUY"]
[Mon Mar 23 21:28:02.994660 2026] [:error] [pid 38306:tid 38317] [client 40.85.246.124:30485] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acE_4jkL8qwu-hHc6BiivgAAAQk"]
[Mon Mar 23 21:28:03.403854 2026] [:error] [pid 38276:tid 38281] [client 40.85.246.124:30696] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acE_45oKGiI-a7oME3L5jgAAAMI"]
[Mon Mar 23 21:28:03.829044 2026] [:error] [pid 38177:tid 38237] [client 40.85.246.124:30599] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acE_43sYW-_HCI66MunzrwAAAFY"]
[Mon Mar 23 21:28:04.239151 2026] [:error] [pid 52341:tid 52354] [client 40.85.246.124:30698] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acE_5KPKTBDR2u47Gb3YMgAAAUs"]
[Mon Mar 23 21:28:04.648796 2026] [:error] [pid 52341:tid 52360] [client 40.85.246.124:30660] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acE_5KPKTBDR2u47Gb3YOAAAAVE"]
[Mon Mar 23 21:28:05.058870 2026] [:error] [pid 38176:tid 38207] [client 40.85.246.124:30594] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acE_5UtG4qlh1gvNjuI96QAAABQ"]
[Mon Mar 23 21:28:05.472857 2026] [:error] [pid 38306:tid 38323] [client 40.85.246.124:30646] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acE_5TkL8qwu-hHc6BiiwQAAAQ8"]
[Mon Mar 23 21:28:05.904074 2026] [:error] [pid 52341:tid 52362] [client 40.85.246.124:30700] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acE_5aPKTBDR2u47Gb3YPAAAAVM"]
[Mon Mar 23 21:28:06.329768 2026] [:error] [pid 38176:tid 38202] [client 40.85.246.124:30703] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "acE_5ktG4qlh1gvNjuI96gAAAA8"]
[Mon Mar 23 21:28:06.742944 2026] [:error] [pid 52341:tid 52357] [client 40.85.246.124:30708] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acE_5qPKTBDR2u47Gb3YQwAAAU4"]
[Mon Mar 23 21:28:07.154758 2026] [:error] [pid 38177:tid 38239] [client 40.85.246.124:30688] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acE_53sYW-_HCI66MunzsAAAAFg"]
[Mon Mar 23 21:28:07.572083 2026] [:error] [pid 38176:tid 38203] [client 40.85.246.124:30597] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acE_50tG4qlh1gvNjuI97AAAABA"]
[Mon Mar 23 21:28:07.984500 2026] [:error] [pid 38306:tid 38316] [client 40.85.246.124:30652] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acE_5zkL8qwu-hHc6BiiyAAAAQg"]
[Mon Mar 23 21:28:08.400735 2026] [:error] [pid 52341:tid 52360] [client 40.85.246.124:30627] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acE_6KPKTBDR2u47Gb3YSAAAAVE"]
[Mon Mar 23 21:28:08.811967 2026] [:error] [pid 38306:tid 38324] [client 40.85.246.124:30669] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acE_6DkL8qwu-hHc6BiiygAAARA"]
[Mon Mar 23 21:28:09.238557 2026] [:error] [pid 38306:tid 38314] [client 40.85.246.124:30645] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acE_6TkL8qwu-hHc6BiizQAAAQY"]
[Mon Mar 23 21:28:09.648390 2026] [:error] [pid 38178:tid 38250] [client 40.85.246.124:30631] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acE_6Q0axWfXsVvR9udDaAAAAIg"]
[Mon Mar 23 21:28:10.061916 2026] [:error] [pid 38178:tid 38255] [client 40.85.246.124:30565] [client 40.85.246.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acE_6g0axWfXsVvR9udDawAAAI0"]
[Mon Mar 23 21:28:12.049948 2026] [:error] [pid 52341:tid 52350] [client 40.85.246.124:30537] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acE_7KPKTBDR2u47Gb3YTwAAAUc"]
[Mon Mar 23 21:28:12.466846 2026] [:error] [pid 38306:tid 38320] [client 40.85.246.124:30608] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acE_7DkL8qwu-hHc6Bii0gAAAQw"]
[Mon Mar 23 21:28:12.885507 2026] [:error] [pid 38276:tid 38279] [client 40.85.246.124:30714] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acE_7JoKGiI-a7oME3L5lwAAAMA"]
[Mon Mar 23 21:28:13.297047 2026] [:error] [pid 52341:tid 52367] [client 40.85.246.124:30478] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acE_7aPKTBDR2u47Gb3YUQAAAVg"]
[Mon Mar 23 21:28:13.768399 2026] [:error] [pid 52341:tid 52359] [client 40.85.246.124:30610] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acE_7aPKTBDR2u47Gb3YVAAAAVA"]
[Mon Mar 23 21:28:14.178452 2026] [:error] [pid 38306:tid 38310] [client 40.85.246.124:30545] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acE_7jkL8qwu-hHc6Bii1QAAAQI"]
[Mon Mar 23 21:28:14.587649 2026] [:error] [pid 38176:tid 38189] [client 40.85.246.124:30716] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acE_7ktG4qlh1gvNjuI98QAAAAI"]
[Mon Mar 23 21:28:15.001640 2026] [:error] [pid 52341:tid 52346] [client 40.85.246.124:30546] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acE_76PKTBDR2u47Gb3YWwAAAUM"]
[Mon Mar 23 21:28:15.413565 2026] [:error] [pid 38176:tid 38210] [client 40.85.246.124:30556] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acE_70tG4qlh1gvNjuI9-AAAABc"]
[Mon Mar 23 21:28:15.829353 2026] [:error] [pid 38176:tid 38202] [client 40.85.246.124:30650] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acE_70tG4qlh1gvNjuI9-wAAAA8"]
[Mon Mar 23 21:28:16.238715 2026] [:error] [pid 38176:tid 38191] [client 40.85.246.124:30533] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acE_8EtG4qlh1gvNjuI9_gAAAAQ"]
[Tue Mar 24 00:53:39.175569 2026] [:error] [pid 56237:tid 56335] [client 138.0.189.57:33994] [client 138.0.189.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.0.189.57, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acFwEwymO0MnzQb90MMZ_QAAAI4"]
[Tue Mar 24 00:53:39.179794 2026] [:error] [pid 56237:tid 56335] [client 138.0.189.57:33994] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 24 08:00:47.378370 2026] [:error] [pid 3137:tid 3151] [client 178.113.131.213:62658] [client 178.113.131.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.113.131.213, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acHUL5dZesutm6dfYM8sVQAAAMw"]
[Tue Mar 24 08:00:47.385725 2026] [:error] [pid 3137:tid 3151] [client 178.113.131.213:62658] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 24 08:15:31.924356 2026] [:error] [pid 38767:tid 38793] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Tue Mar 24 08:15:32.205215 2026] [:error] [pid 38767:tid 38789] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Tue Mar 24 08:15:32.848147 2026] [:error] [pid 38767:tid 38773] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Mar 24 08:15:33.182781 2026] [:error] [pid 38767:tid 38778] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Mar 24 08:15:33.433719 2026] [:error] [pid 38767:tid 38770] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Tue Mar 24 08:15:33.831872 2026] [:error] [pid 38767:tid 38772] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/baixy.php
[Tue Mar 24 08:15:34.068129 2026] [:error] [pid 38767:tid 38792] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Tue Mar 24 08:15:35.224520 2026] [:error] [pid 38767:tid 38775] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Mar 24 08:15:35.460991 2026] [:error] [pid 38767:tid 38777] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Tue Mar 24 08:15:35.759138 2026] [:error] [pid 38767:tid 38776] [client 172.213.236.250:52058] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Mar 24 08:15:36.065511 2026] [:error] [pid 38767:tid 38787] [client 172.213.236.250:52058] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acHXqPwkUqN4GJAI5oWwWgAAARE"]
[Tue Mar 24 08:15:38.218647 2026] [:error] [pid 3137:tid 3144] [client 172.213.236.250:57870] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acHXqpdZesutm6dfYM83DQAAAMU"]
[Tue Mar 24 08:15:39.544809 2026] [:error] [pid 3032:tid 3120] [client 172.213.236.250:3879] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acHXqya_-JXXD03-JNzs9QAAAJE"]
[Tue Mar 24 08:15:42.339166 2026] [:error] [pid 3137:tid 3141] [client 172.213.236.250:3843] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acHXrpdZesutm6dfYM83GwAAAMI"]
[Tue Mar 24 08:15:43.379438 2026] [:error] [pid 3137:tid 3157] [client 172.213.236.250:62909] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acHXr5dZesutm6dfYM83HQAAANI"]
[Tue Mar 24 08:15:44.975134 2026] [:error] [pid 3137:tid 3158] [client 172.213.236.250:61503] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acHXsJdZesutm6dfYM83IQAAANM"]
[Tue Mar 24 08:15:45.731152 2026] [:error] [pid 64198:tid 64211] [client 172.213.236.250:61461] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acHXsXVzJqf6OS_oSZ0XHwAAAUs"]
[Tue Mar 24 08:15:46.463008 2026] [:error] [pid 64198:tid 64209] [client 172.213.236.250:3873] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acHXsnVzJqf6OS_oSZ0XIQAAAUk"]
[Tue Mar 24 08:15:47.873253 2026] [:error] [pid 64198:tid 64207] [client 172.213.236.250:61463] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acHXs3VzJqf6OS_oSZ0XJAAAAUc"]
[Tue Mar 24 08:15:49.443471 2026] [:error] [pid 64198:tid 64224] [client 172.213.236.250:62902] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acHXtXVzJqf6OS_oSZ0XJwAAAVg"]
[Tue Mar 24 08:15:51.282891 2026] [:error] [pid 3137:tid 3146] [client 172.213.236.250:62384] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acHXt5dZesutm6dfYM83JAAAAMc"]
[Tue Mar 24 08:15:55.846079 2026] [:error] [pid 3030:tid 3064] [client 172.213.236.250:61473] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acHXuwyOuILyynfcqfkP9AAAAA8"]
[Tue Mar 24 08:15:58.999702 2026] [:error] [pid 3031:tid 3082] [client 172.213.236.250:63723] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acHXvqJBKytnG47nuib8UwAAAEY"]
[Tue Mar 24 08:16:00.249000 2026] [:error] [pid 3032:tid 3125] [client 172.213.236.250:62905] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acHXwCa_-JXXD03-JNztAwAAAJY"]
[Tue Mar 24 08:16:01.746437 2026] [:error] [pid 64198:tid 64206] [client 172.213.236.250:62897] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acHXwXVzJqf6OS_oSZ0XPAAAAUY"]
[Tue Mar 24 08:16:02.870154 2026] [:error] [pid 64198:tid 64213] [client 172.213.236.250:57901] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acHXwnVzJqf6OS_oSZ0XQAAAAU0"]
[Tue Mar 24 08:16:04.570680 2026] [:error] [pid 3030:tid 3059] [client 172.213.236.250:61477] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acHXxAyOuILyynfcqfkP-QAAAAo"]
[Tue Mar 24 08:16:05.865984 2026] [:error] [pid 64198:tid 64212] [client 172.213.236.250:62853] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acHXxXVzJqf6OS_oSZ0XRgAAAUw"]
[Tue Mar 24 08:16:08.022489 2026] [:error] [pid 3032:tid 3105] [client 172.213.236.250:62041] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acHXyCa_-JXXD03-JNztDQAAAII"]
[Tue Mar 24 08:16:13.964101 2026] [:error] [pid 3137:tid 3150] [client 172.213.236.250:63740] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acHXzZdZesutm6dfYM83OwAAAMs"]
[Tue Mar 24 08:16:18.677353 2026] [:error] [pid 3031:tid 3092] [client 172.213.236.250:61464] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acHX0qJBKytnG47nuib8gwAAAFA"]
[Tue Mar 24 08:16:21.095792 2026] [:error] [pid 64198:tid 64216] [client 172.213.236.250:3865] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acHX1XVzJqf6OS_oSZ0XVwAAAVA"]
[Tue Mar 24 08:16:22.345745 2026] [:error] [pid 38767:tid 38793] [client 172.213.236.250:58158] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acHX1vwkUqN4GJAI5oWwgAAAARc"]
[Tue Mar 24 08:16:24.783977 2026] [:error] [pid 3137:tid 3147] [client 172.213.236.250:63703] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acHX2JdZesutm6dfYM83VQAAAMg"]
[Tue Mar 24 08:16:26.066048 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:52072] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acHX2pdZesutm6dfYM83WQAAANY"]
[Tue Mar 24 08:16:27.275753 2026] [:error] [pid 64198:tid 64212] [client 172.213.236.250:62878] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acHX23VzJqf6OS_oSZ0XWwAAAUw"]
[Tue Mar 24 08:16:33.787074 2026] [:error] [pid 64198:tid 64209] [client 172.213.236.250:63729] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acHX4XVzJqf6OS_oSZ0XZwAAAUk"]
[Tue Mar 24 08:16:59.187541 2026] [:error] [pid 3137:tid 3147] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Tue Mar 24 08:16:59.488048 2026] [:error] [pid 3137:tid 3162] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Mar 24 08:16:59.796153 2026] [:error] [pid 3137:tid 3144] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Tue Mar 24 08:17:00.111141 2026] [:error] [pid 3137:tid 3163] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Tue Mar 24 08:17:00.347666 2026] [:error] [pid 3137:tid 3143] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Tue Mar 24 08:17:00.583726 2026] [:error] [pid 3137:tid 3139] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Tue Mar 24 08:17:01.171329 2026] [:error] [pid 3137:tid 3152] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Tue Mar 24 08:17:01.466103 2026] [:error] [pid 3137:tid 3157] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/ws75.php
[Tue Mar 24 08:17:01.755954 2026] [:error] [pid 3137:tid 3154] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Mar 24 08:17:01.992118 2026] [:error] [pid 3137:tid 3156] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Tue Mar 24 08:17:02.345011 2026] [:error] [pid 3137:tid 3163] [client 172.213.236.250:62901] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Tue Mar 24 08:17:02.579595 2026] [:error] [pid 3137:tid 3146] [client 172.213.236.250:62901] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acHX_pdZesutm6dfYM83nwAAAMc"]
[Tue Mar 24 08:17:04.023616 2026] [:error] [pid 3031:tid 3089] [client 172.213.236.250:3890] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acHYAKJBKytnG47nuib8nAAAAE0"]
[Tue Mar 24 08:17:04.796921 2026] [:error] [pid 38767:tid 38789] [client 172.213.236.250:57864] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acHYAPwkUqN4GJAI5oWwowAAARM"]
[Tue Mar 24 08:17:05.840380 2026] [:error] [pid 3137:tid 3142] [client 172.213.236.250:57881] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acHYAZdZesutm6dfYM833AAAAMM"]
[Tue Mar 24 08:17:06.637037 2026] [:error] [pid 3032:tid 3108] [client 172.213.236.250:61483] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acHYAia_-JXXD03-JNztNgAAAIU"]
[Tue Mar 24 08:17:07.718436 2026] [:error] [pid 3031:tid 3094] [client 172.213.236.250:52037] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acHYA6JBKytnG47nuib8oAAAAFI"]
[Tue Mar 24 08:17:08.448614 2026] [:error] [pid 3137:tid 3149] [client 172.213.236.250:57866] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acHYBJdZesutm6dfYM836AAAAMo"]
[Tue Mar 24 08:17:09.473949 2026] [:error] [pid 3137:tid 3143] [client 172.213.236.250:62050] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acHYBZdZesutm6dfYM838QAAAMQ"]
[Tue Mar 24 08:17:10.516414 2026] [:error] [pid 3137:tid 3140] [client 172.213.236.250:61462] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acHYBpdZesutm6dfYM83-QAAAME"]
[Tue Mar 24 08:17:13.627968 2026] [:error] [pid 3032:tid 3121] [client 172.213.236.250:57878] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acHYCSa_-JXXD03-JNztPAAAAJI"]
[Tue Mar 24 08:17:15.609863 2026] [:error] [pid 64198:tid 64201] [client 172.213.236.250:63704] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acHYC3VzJqf6OS_oSZ0X2gAAAUE"]
[Tue Mar 24 08:17:18.881028 2026] [:error] [pid 64198:tid 64215] [client 172.213.236.250:61492] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acHYDnVzJqf6OS_oSZ0X3AAAAU8"]
[Tue Mar 24 08:17:21.210790 2026] [:error] [pid 38767:tid 38780] [client 172.213.236.250:62061] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acHYEfwkUqN4GJAI5oWwrQAAAQo"]
[Tue Mar 24 08:17:22.121695 2026] [:error] [pid 38767:tid 38776] [client 172.213.236.250:3902] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acHYEvwkUqN4GJAI5oWwswAAAQY"]
[Tue Mar 24 08:17:24.882095 2026] [:error] [pid 3030:tid 3060] [client 172.213.236.250:58747] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acHYFAyOuILyynfcqfkQHQAAAAs"]
[Tue Mar 24 08:17:27.471617 2026] [:error] [pid 64198:tid 64213] [client 172.213.236.250:3881] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acHYF3VzJqf6OS_oSZ0X5gAAAU0"]
[Tue Mar 24 08:18:05.154383 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Tue Mar 24 08:18:05.404190 2026] [:error] [pid 3137:tid 3144] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Tue Mar 24 08:18:05.919447 2026] [:error] [pid 3137:tid 3149] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Mar 24 08:18:06.400021 2026] [:error] [pid 3137:tid 3142] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Mar 24 08:18:06.716746 2026] [:error] [pid 3137:tid 3159] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Mar 24 08:18:06.956993 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Mar 24 08:18:07.384364 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Tue Mar 24 08:18:07.623968 2026] [:error] [pid 3137:tid 3150] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Mar 24 08:18:07.864899 2026] [:error] [pid 3137:tid 3148] [client 172.213.236.250:52076] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Mar 24 08:18:08.204029 2026] [:error] [pid 3137:tid 3139] [client 172.213.236.250:52076] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acHYQJdZesutm6dfYM84dAAAAMA"]
[Tue Mar 24 08:18:08.942984 2026] [:error] [pid 3032:tid 3122] [client 172.213.236.250:63701] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acHYQCa_-JXXD03-JNztYgAAAJM"]
[Tue Mar 24 08:18:09.692878 2026] [:error] [pid 3137:tid 3147] [client 172.213.236.250:61466] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acHYQZdZesutm6dfYM84ewAAAMg"]
[Tue Mar 24 08:18:11.852359 2026] [:error] [pid 3031:tid 3093] [client 172.213.236.250:62895] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acHYQ6JBKytnG47nuib88QAAAFE"]
[Tue Mar 24 08:18:13.176681 2026] [:error] [pid 3031:tid 3088] [client 172.213.236.250:3885] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acHYRaJBKytnG47nuib88wAAAEw"]
[Tue Mar 24 08:18:14.024284 2026] [:error] [pid 3032:tid 3106] [client 172.213.236.250:3860] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acHYRia_-JXXD03-JNztZwAAAIM"]
[Tue Mar 24 08:18:15.790670 2026] [:error] [pid 38767:tid 38782] [client 172.213.236.250:52044] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acHYR_wkUqN4GJAI5oWxCQAAAQw"]
[Tue Mar 24 08:18:16.900865 2026] [:error] [pid 64198:tid 64223] [client 172.213.236.250:63707] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acHYSHVzJqf6OS_oSZ0YTAAAAVc"]
[Tue Mar 24 08:18:17.766463 2026] [:error] [pid 38767:tid 38771] [client 172.213.236.250:61447] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "acHYSfwkUqN4GJAI5oWxCwAAAQE"]
[Tue Mar 24 08:18:18.645875 2026] [:error] [pid 3137:tid 3159] [client 172.213.236.250:62859] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "acHYSpdZesutm6dfYM84hAAAANQ"]
[Tue Mar 24 08:18:19.589575 2026] [:error] [pid 3031:tid 3078] [client 172.213.236.250:52069] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "acHYS6JBKytnG47nuib89wAAAEI"]
[Tue Mar 24 08:18:20.311341 2026] [:error] [pid 64198:tid 64215] [client 172.213.236.250:58171] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "acHYTHVzJqf6OS_oSZ0YXAAAAU8"]
[Tue Mar 24 08:18:21.740252 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:58161] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acHYTZdZesutm6dfYM84iQAAANY"]
[Tue Mar 24 08:18:22.969019 2026] [:error] [pid 64198:tid 64205] [client 172.213.236.250:64821] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acHYTnVzJqf6OS_oSZ0YaAAAAUU"]
[Tue Mar 24 08:18:27.148962 2026] [:error] [pid 3137:tid 3142] [client 172.213.236.250:64809] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acHYU5dZesutm6dfYM84kwAAAMM"]
[Tue Mar 24 08:18:29.289732 2026] [:error] [pid 3031:tid 3095] [client 172.213.236.250:52079] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acHYVaJBKytnG47nuib8-gAAAFM"]
[Tue Mar 24 08:18:30.935190 2026] [:error] [pid 64198:tid 64204] [client 172.213.236.250:52049] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acHYVnVzJqf6OS_oSZ0YeQAAAUQ"]
[Tue Mar 24 08:18:34.633108 2026] [:error] [pid 38767:tid 38790] [client 172.213.236.250:63731] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acHYWvwkUqN4GJAI5oWxGwAAARQ"]
[Tue Mar 24 08:18:36.499872 2026] [:error] [pid 38767:tid 38787] [client 172.213.236.250:61460] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acHYXPwkUqN4GJAI5oWxMgAAARE"]
[Tue Mar 24 08:18:38.431368 2026] [:error] [pid 3137:tid 3144] [client 172.213.236.250:62341] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acHYXpdZesutm6dfYM84sAAAAMU"]
[Tue Mar 24 08:18:51.883838 2026] [:error] [pid 64198:tid 64202] [client 172.213.236.250:62893] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acHYa3VzJqf6OS_oSZ0YsAAAAUI"]
[Tue Mar 24 08:18:55.526728 2026] [:error] [pid 3137:tid 3141] [client 172.213.236.250:58131] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acHYb5dZesutm6dfYM847gAAAMI"]
[Tue Mar 24 08:19:00.969306 2026] [:error] [pid 64198:tid 64214] [client 172.213.236.250:52039] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acHYdHVzJqf6OS_oSZ0YvQAAAU4"]
[Tue Mar 24 08:19:03.309139 2026] [:error] [pid 3137:tid 3147] [client 172.213.236.250:52073] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acHYd5dZesutm6dfYM85BQAAAMg"]
[Tue Mar 24 08:19:04.636874 2026] [:error] [pid 3137:tid 3144] [client 172.213.236.250:62855] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acHYeJdZesutm6dfYM85CwAAAMU"]
[Tue Mar 24 08:19:06.699512 2026] [:error] [pid 38767:tid 38773] [client 172.213.236.250:62393] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHYevwkUqN4GJAI5oWxnQAAAQM"]
[Tue Mar 24 08:19:08.240387 2026] [:error] [pid 3030:tid 3065] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Tue Mar 24 08:19:08.546548 2026] [:error] [pid 3030:tid 3051] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Mar 24 08:19:08.783329 2026] [:error] [pid 3030:tid 3055] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Mar 24 08:19:09.096496 2026] [:error] [pid 3030:tid 3057] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax.php
[Tue Mar 24 08:19:09.369027 2026] [:error] [pid 3030:tid 3066] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Mar 24 08:19:09.896347 2026] [:error] [pid 3030:tid 3053] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Tue Mar 24 08:19:10.387955 2026] [:error] [pid 3030:tid 3052] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Tue Mar 24 08:19:10.663817 2026] [:error] [pid 3030:tid 3064] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/drhunthq.php
[Tue Mar 24 08:19:10.965864 2026] [:error] [pid 3030:tid 3059] [client 172.213.236.250:63732] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Mar 24 08:19:11.223818 2026] [:error] [pid 3030:tid 3050] [client 172.213.236.250:63732] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acHYfwyOuILyynfcqfkQYAAAAAE"]
[Tue Mar 24 08:19:13.591132 2026] [:error] [pid 3137:tid 3152] [client 172.213.236.250:3893] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acHYgZdZesutm6dfYM85KAAAAM0"]
[Tue Mar 24 08:19:14.806969 2026] [:error] [pid 64198:tid 64201] [client 172.213.236.250:58147] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acHYgnVzJqf6OS_oSZ0YywAAAUE"]
[Tue Mar 24 08:19:16.721685 2026] [:error] [pid 64198:tid 64209] [client 172.213.236.250:52055] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acHYhHVzJqf6OS_oSZ0Y1wAAAUk"]
[Tue Mar 24 08:19:17.899406 2026] [:error] [pid 3137:tid 3153] [client 172.213.236.250:61451] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acHYhZdZesutm6dfYM85NAAAAM4"]
[Tue Mar 24 08:19:18.982568 2026] [:error] [pid 3137:tid 3146] [client 172.213.236.250:61469] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acHYhpdZesutm6dfYM85PQAAAMc"]
[Tue Mar 24 08:19:20.085184 2026] [:error] [pid 3030:tid 3071] [client 172.213.236.250:56207] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acHYiAyOuILyynfcqfkQZQAAABY"]
[Tue Mar 24 08:19:21.358869 2026] [:error] [pid 38767:tid 38784] [client 172.213.236.250:63697] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acHYifwkUqN4GJAI5oWxqQAAAQ4"]
[Tue Mar 24 08:19:22.298219 2026] [:error] [pid 3031:tid 3100] [client 172.213.236.250:61470] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acHYiqJBKytnG47nuib9NAAAAFg"]
[Tue Mar 24 08:19:24.289308 2026] [:error] [pid 38767:tid 38771] [client 172.213.236.250:64828] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acHYjPwkUqN4GJAI5oWxrgAAAQE"]
[Tue Mar 24 08:19:25.612434 2026] [:error] [pid 3031:tid 3098] [client 172.213.236.250:62857] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acHYjaJBKytnG47nuib9OQAAAFY"]
[Tue Mar 24 08:19:26.719434 2026] [:error] [pid 3030:tid 3057] [client 172.213.236.250:61442] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acHYjgyOuILyynfcqfkQaAAAAAg"]
[Tue Mar 24 08:19:27.805854 2026] [:error] [pid 3032:tid 3111] [client 172.213.236.250:61445] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acHYjya_-JXXD03-JNzt7AAAAIg"]
[Tue Mar 24 08:19:28.611711 2026] [:error] [pid 3032:tid 3128] [client 172.213.236.250:63710] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acHYkCa_-JXXD03-JNzt7wAAAJg"]
[Tue Mar 24 08:19:29.447045 2026] [:error] [pid 3030:tid 3073] [client 172.213.236.250:61452] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acHYkQyOuILyynfcqfkQbAAAABg"]
[Tue Mar 24 08:19:30.945443 2026] [:error] [pid 38767:tid 38773] [client 172.213.236.250:52062] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acHYkvwkUqN4GJAI5oWxuQAAAQM"]
[Tue Mar 24 08:19:31.952802 2026] [:error] [pid 38767:tid 38770] [client 172.213.236.250:58746] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acHYk_wkUqN4GJAI5oWxvwAAAQA"]
[Tue Mar 24 08:19:33.571818 2026] [:error] [pid 64198:tid 64204] [client 172.213.236.250:62073] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acHYlXVzJqf6OS_oSZ0Y6gAAAUQ"]
[Tue Mar 24 08:19:36.397877 2026] [:error] [pid 3032:tid 3117] [client 172.213.236.250:63712] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acHYmCa_-JXXD03-JNzt9wAAAI4"]
[Tue Mar 24 08:19:41.700794 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:64779] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acHYnZdZesutm6dfYM85bgAAAMw"]
[Tue Mar 24 08:19:52.508279 2026] [:error] [pid 3032:tid 3112] [client 172.213.236.250:64819] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acHYqCa_-JXXD03-JNzt-wAAAIk"]
[Tue Mar 24 08:19:59.671896 2026] [:error] [pid 3030:tid 3062] [client 172.213.236.250:3894] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acHYrwyOuILyynfcqfkQfQAAAA0"]
[Tue Mar 24 08:20:01.682051 2026] [:error] [pid 3031:tid 3084] [client 172.213.236.250:62065] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acHYsaJBKytnG47nuib9SgAAAEg"]
[Tue Mar 24 08:20:03.061454 2026] [:error] [pid 3137:tid 3162] [client 172.213.236.250:58142] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acHYs5dZesutm6dfYM85uAAAANc"]
[Tue Mar 24 08:20:04.539018 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:45059] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acHYtJdZesutm6dfYM85wAAAANY"]
[Tue Mar 24 08:20:05.538896 2026] [:error] [pid 3137:tid 3143] [client 172.213.236.250:52054] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acHYtZdZesutm6dfYM85zAAAAMQ"]
[Tue Mar 24 08:20:06.541049 2026] [:error] [pid 3030:tid 3050] [client 172.213.236.250:58137] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acHYtgyOuILyynfcqfkQhAAAAAE"]
[Tue Mar 24 08:20:07.230252 2026] [:error] [pid 3030:tid 3069] [client 172.213.236.250:62017] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acHYtwyOuILyynfcqfkQhwAAABQ"]
[Tue Mar 24 08:20:08.495408 2026] [:error] [pid 3137:tid 3141] [client 172.213.236.250:62900] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acHYuJdZesutm6dfYM852gAAAMI"]
[Tue Mar 24 08:20:10.091266 2026] [:error] [pid 3137:tid 3154] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Tue Mar 24 08:20:10.584332 2026] [:error] [pid 3137:tid 3155] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Tue Mar 24 08:20:11.016332 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Tue Mar 24 08:20:11.255415 2026] [:error] [pid 3137:tid 3143] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Tue Mar 24 08:20:11.563676 2026] [:error] [pid 3137:tid 3154] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/hots.php
[Tue Mar 24 08:20:12.249923 2026] [:error] [pid 3137:tid 3150] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Tue Mar 24 08:20:12.495244 2026] [:error] [pid 3137:tid 3157] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Tue Mar 24 08:20:12.885769 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Tue Mar 24 08:20:13.231495 2026] [:error] [pid 3137:tid 3154] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Mar 24 08:20:13.987109 2026] [:error] [pid 3137:tid 3143] [client 172.213.236.250:3623] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Tue Mar 24 08:20:14.591614 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:3623] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "acHYvpdZesutm6dfYM86MwAAAMw"]
[Tue Mar 24 08:20:15.698977 2026] [:error] [pid 64198:tid 64223] [client 172.213.236.250:61494] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "acHYv3VzJqf6OS_oSZ0ZUQAAAVc"]
[Tue Mar 24 08:20:17.259753 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:62368] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "acHYwZdZesutm6dfYM86NwAAANY"]
[Tue Mar 24 08:20:21.002965 2026] [:error] [pid 3031:tid 3087] [client 172.213.236.250:64812] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "acHYxaJBKytnG47nuib9XQAAAEs"]
[Tue Mar 24 08:20:23.030385 2026] [:error] [pid 38767:tid 38784] [client 172.213.236.250:62394] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acHYx_wkUqN4GJAI5oWx4gAAAQ4"]
[Tue Mar 24 08:20:24.527782 2026] [:error] [pid 64198:tid 64206] [client 172.213.236.250:3880] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acHYyHVzJqf6OS_oSZ0ZZQAAAUY"]
[Tue Mar 24 08:20:26.003748 2026] [:error] [pid 3137:tid 3162] [client 172.213.236.250:62039] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acHYypdZesutm6dfYM86RgAAANc"]
[Tue Mar 24 08:20:27.023898 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:62031] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acHYy5dZesutm6dfYM86SAAAAMw"]
[Tue Mar 24 08:20:27.859808 2026] [:error] [pid 3031:tid 3085] [client 172.213.236.250:3886] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "acHYy6JBKytnG47nuib9YQAAAEk"]
[Tue Mar 24 08:20:30.013767 2026] [:error] [pid 64198:tid 64209] [client 172.213.236.250:58130] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "acHYznVzJqf6OS_oSZ0ZbQAAAUk"]
[Tue Mar 24 08:20:31.181284 2026] [:error] [pid 3031:tid 3089] [client 172.213.236.250:3899] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "acHYz6JBKytnG47nuib9ZQAAAE0"]
[Tue Mar 24 08:20:32.992656 2026] [:error] [pid 3137:tid 3142] [client 172.213.236.250:62370] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/grsiuk.php"] [unique_id "acHY0JdZesutm6dfYM86WAAAAMM"]
[Tue Mar 24 08:20:34.644197 2026] [:error] [pid 64198:tid 64219] [client 172.213.236.250:52075] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acHY0nVzJqf6OS_oSZ0ZgwAAAVM"]
[Tue Mar 24 08:20:35.431434 2026] [:error] [pid 3031:tid 3079] [client 172.213.236.250:64786] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acHY06JBKytnG47nuib9aQAAAEM"]
[Tue Mar 24 08:20:36.390526 2026] [:error] [pid 3137:tid 3162] [client 172.213.236.250:63702] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acHY1JdZesutm6dfYM86XAAAANc"]
[Tue Mar 24 08:20:37.323803 2026] [:error] [pid 64198:tid 64219] [client 172.213.236.250:3888] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acHY1XVzJqf6OS_oSZ0ZjAAAAVM"]
[Tue Mar 24 08:20:41.736059 2026] [:error] [pid 3032:tid 3117] [client 172.213.236.250:58740] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acHY2Sa_-JXXD03-JNzuDQAAAI4"]
[Tue Mar 24 08:20:54.698115 2026] [:error] [pid 38767:tid 38773] [client 172.213.236.250:3883] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "acHY5vwkUqN4GJAI5oWyGAAAAQM"]
[Tue Mar 24 08:20:57.599054 2026] [:error] [pid 38767:tid 38789] [client 172.213.236.250:62904] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "acHY6fwkUqN4GJAI5oWyHgAAARM"]
[Tue Mar 24 08:21:18.709786 2026] [:error] [pid 3137:tid 3143] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Tue Mar 24 08:21:18.957150 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Tue Mar 24 08:21:19.227958 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Tue Mar 24 08:21:19.465978 2026] [:error] [pid 3137:tid 3157] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Tue Mar 24 08:21:19.711003 2026] [:error] [pid 3137:tid 3147] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Tue Mar 24 08:21:19.948321 2026] [:error] [pid 3137:tid 3149] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-104.php
[Tue Mar 24 08:21:21.411566 2026] [:error] [pid 3137:tid 3149] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/rzki.php
[Tue Mar 24 08:21:21.676384 2026] [:error] [pid 3137:tid 3156] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Tue Mar 24 08:21:21.952470 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Tue Mar 24 08:21:23.217357 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Tue Mar 24 08:21:23.607553 2026] [:error] [pid 3137:tid 3143] [client 172.213.236.250:62871] File does not exist: /usr/local/apache/htdocs/suspended-page/55b76.php
[Tue Mar 24 08:21:23.845696 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:62871] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "acHZA5dZesutm6dfYM864AAAAMw"]
[Tue Mar 24 08:21:27.025224 2026] [:error] [pid 64198:tid 64210] [client 172.213.236.250:63681] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "acHZB3VzJqf6OS_oSZ0Z3wAAAUo"]
[Tue Mar 24 08:21:33.972903 2026] [:error] [pid 3031:tid 3096] [client 172.213.236.250:52048] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "acHZDaJBKytnG47nuib9mQAAAFQ"]
[Tue Mar 24 08:21:36.580351 2026] [:error] [pid 3137:tid 3163] [client 172.213.236.250:62908] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "acHZEJdZesutm6dfYM86_AAAANg"]
[Tue Mar 24 08:21:38.842006 2026] [:error] [pid 3032:tid 3103] [client 172.213.236.250:62025] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acHZEia_-JXXD03-JNzuQQAAAIA"]
[Tue Mar 24 08:21:39.589283 2026] [:error] [pid 3137:tid 3146] [client 172.213.236.250:64831] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acHZE5dZesutm6dfYM87AwAAAMc"]
[Tue Mar 24 08:21:42.105165 2026] [:error] [pid 3031:tid 3094] [client 172.213.236.250:52060] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acHZFqJBKytnG47nuib9ogAAAFI"]
[Tue Mar 24 08:21:43.149512 2026] [:error] [pid 38767:tid 38778] [client 172.213.236.250:64808] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acHZF_wkUqN4GJAI5oWyWQAAAQg"]
[Tue Mar 24 08:21:44.716711 2026] [:error] [pid 3031:tid 3095] [client 172.213.236.250:64791] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "acHZGKJBKytnG47nuib9pgAAAFM"]
[Tue Mar 24 08:21:46.900045 2026] [:error] [pid 3032:tid 3114] [client 172.213.236.250:58124] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "acHZGia_-JXXD03-JNzuTgAAAIs"]
[Tue Mar 24 08:21:48.027323 2026] [:error] [pid 38767:tid 38777] [client 172.213.236.250:52080] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "acHZHPwkUqN4GJAI5oWybQAAAQc"]
[Tue Mar 24 08:21:49.586347 2026] [:error] [pid 3137:tid 3139] [client 172.213.236.250:62877] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "acHZHZdZesutm6dfYM87FwAAAMA"]
[Tue Mar 24 08:21:51.668359 2026] [:error] [pid 64198:tid 64209] [client 172.213.236.250:52040] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "acHZH3VzJqf6OS_oSZ0Z_gAAAUk"]
[Tue Mar 24 08:21:53.834771 2026] [:error] [pid 3032:tid 3123] [client 172.213.236.250:57885] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "acHZISa_-JXXD03-JNzuUgAAAJQ"]
[Tue Mar 24 08:21:55.168395 2026] [:error] [pid 64198:tid 64207] [client 172.213.236.250:61448] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "acHZI3VzJqf6OS_oSZ0aBQAAAUc"]
[Tue Mar 24 08:22:00.158684 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:62351] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "acHZKJdZesutm6dfYM87IAAAANY"]
[Tue Mar 24 08:22:03.034755 2026] [:error] [pid 64198:tid 64223] [client 172.213.236.250:62358] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acHZK3VzJqf6OS_oSZ0aEwAAAVc"]
[Tue Mar 24 08:22:11.893138 2026] [:error] [pid 3137:tid 3161] [client 172.213.236.250:3859] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acHZM5dZesutm6dfYM87QQAAANY"]
[Tue Mar 24 08:22:15.309704 2026] [:error] [pid 38767:tid 38787] [client 172.213.236.250:63735] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acHZN_wkUqN4GJAI5oWylwAAARE"]
[Tue Mar 24 08:22:16.985383 2026] [:error] [pid 3137:tid 3157] [client 172.213.236.250:3881] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "acHZOJdZesutm6dfYM87SQAAANI"]
[Tue Mar 24 08:22:19.301331 2026] [:error] [pid 64198:tid 64212] [client 172.213.236.250:3870] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "acHZO3VzJqf6OS_oSZ0aNQAAAUw"]
[Tue Mar 24 08:22:21.373552 2026] [:error] [pid 3137:tid 3153] [client 172.213.236.250:62852] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "acHZPZdZesutm6dfYM87TwAAAM4"]
[Tue Mar 24 08:22:24.172657 2026] [:error] [pid 3137:tid 3150] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/varb.php
[Tue Mar 24 08:22:24.781539 2026] [:error] [pid 3137:tid 3140] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/lm15.php
[Tue Mar 24 08:22:25.234617 2026] [:error] [pid 3137:tid 3139] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Tue Mar 24 08:22:25.583001 2026] [:error] [pid 3137:tid 3148] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Tue Mar 24 08:22:25.962303 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Tue Mar 24 08:22:26.200950 2026] [:error] [pid 3137:tid 3142] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Tue Mar 24 08:22:26.439980 2026] [:error] [pid 3137:tid 3159] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/56c53.php
[Tue Mar 24 08:22:26.677577 2026] [:error] [pid 3137:tid 3139] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Tue Mar 24 08:22:26.915503 2026] [:error] [pid 3137:tid 3158] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Tue Mar 24 08:22:27.203193 2026] [:error] [pid 3137:tid 3144] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Mar 24 08:22:27.558192 2026] [:error] [pid 3137:tid 3154] [client 172.213.236.250:58116] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Tue Mar 24 08:22:27.868573 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:58116] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acHZQ5dZesutm6dfYM87eQAAAMY"]
[Tue Mar 24 08:22:37.233963 2026] [:error] [pid 3137:tid 3162] [client 172.213.236.250:52035] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acHZTZdZesutm6dfYM87owAAANc"]
[Tue Mar 24 08:22:38.242391 2026] [:error] [pid 3137:tid 3153] [client 172.213.236.250:62390] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acHZTpdZesutm6dfYM87sAAAAM4"]
[Tue Mar 24 08:22:40.410517 2026] [:error] [pid 64198:tid 64224] [client 172.213.236.250:62343] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acHZUHVzJqf6OS_oSZ0aYwAAAVg"]
[Tue Mar 24 08:22:43.193436 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:58125] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "acHZU5dZesutm6dfYM87xQAAAMw"]
[Tue Mar 24 08:22:48.657880 2026] [:error] [pid 3137:tid 3157] [client 172.213.236.250:62853] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "acHZWJdZesutm6dfYM871gAAANI"]
[Tue Mar 24 08:22:53.029306 2026] [:error] [pid 3137:tid 3142] [client 172.213.236.250:3862] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "acHZXZdZesutm6dfYM874gAAAMM"]
[Tue Mar 24 08:22:54.974974 2026] [:error] [pid 3031:tid 3093] [client 172.213.236.250:58150] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "acHZXqJBKytnG47nuib90gAAAFE"]
[Tue Mar 24 08:22:59.708886 2026] [:error] [pid 64198:tid 64219] [client 172.213.236.250:62883] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acHZY3VzJqf6OS_oSZ0ajgAAAVM"]
[Tue Mar 24 08:23:01.356465 2026] [:error] [pid 38767:tid 38782] [client 172.213.236.250:62891] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acHZZfwkUqN4GJAI5oWy2wAAAQw"]
[Tue Mar 24 08:23:02.395938 2026] [:error] [pid 3030:tid 3064] [client 172.213.236.250:62872] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acHZZgyOuILyynfcqfkQ6QAAAA8"]
[Tue Mar 24 08:23:03.705409 2026] [:error] [pid 3032:tid 3127] [client 172.213.236.250:62044] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acHZZya_-JXXD03-JNzulwAAAJc"]
[Tue Mar 24 08:23:05.539347 2026] [:error] [pid 3032:tid 3111] [client 172.213.236.250:52071] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHZaSa_-JXXD03-JNzumgAAAIg"]
[Tue Mar 24 08:23:07.333638 2026] [:error] [pid 3137:tid 3151] [client 172.213.236.250:58694] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHZa5dZesutm6dfYM88FQAAAMw"]
[Tue Mar 24 08:23:09.306407 2026] [:error] [pid 64198:tid 64221] [client 172.213.236.250:52033] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHZbXVzJqf6OS_oSZ0algAAAVU"]
[Tue Mar 24 08:23:10.975702 2026] [:error] [pid 3032:tid 3111] [client 172.213.236.250:62881] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHZbia_-JXXD03-JNzuowAAAIg"]
[Tue Mar 24 08:23:12.440805 2026] [:error] [pid 3137:tid 3158] [client 172.213.236.250:63721] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acHZcJdZesutm6dfYM88GQAAANM"]
[Tue Mar 24 08:23:14.061470 2026] [:error] [pid 3137:tid 3145] [client 172.213.236.250:45077] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acHZcpdZesutm6dfYM88IgAAAMY"]
[Tue Mar 24 08:23:16.422649 2026] [:error] [pid 3137:tid 3160] [client 172.213.236.250:56911] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acHZdJdZesutm6dfYM88LAAAANU"]
[Tue Mar 24 08:23:18.893512 2026] [:error] [pid 3137:tid 3148] [client 172.213.236.250:3860] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acHZdpdZesutm6dfYM88NQAAAMk"]
[Tue Mar 24 08:23:19.643804 2026] [:error] [pid 3030:tid 3066] [client 172.213.236.250:58151] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acHZdwyOuILyynfcqfkQ-QAAABE"]
[Tue Mar 24 08:23:20.915094 2026] [:error] [pid 3030:tid 3054] [client 172.213.236.250:56954] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acHZeAyOuILyynfcqfkQ-wAAAAU"]
[Tue Mar 24 08:23:21.727599 2026] [:error] [pid 3032:tid 3124] [client 172.213.236.250:62072] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acHZeSa_-JXXD03-JNzurAAAAJU"]
[Tue Mar 24 08:23:22.715147 2026] [:error] [pid 64198:tid 64221] [client 172.213.236.250:62901] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acHZenVzJqf6OS_oSZ0aowAAAVU"]
[Tue Mar 24 08:23:23.439588 2026] [:error] [pid 38767:tid 38781] [client 172.213.236.250:57863] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/callback.php"] [unique_id "acHZe_wkUqN4GJAI5oWzBgAAAQs"]
[Tue Mar 24 08:23:24.358260 2026] [:error] [pid 38767:tid 38770] [client 172.213.236.250:62369] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/callback.php"] [unique_id "acHZfPwkUqN4GJAI5oWzCgAAAQA"]
[Tue Mar 24 08:23:25.185868 2026] [:error] [pid 38767:tid 38771] [client 172.213.236.250:62855] [client 172.213.236.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/callback.php"] [unique_id "acHZffwkUqN4GJAI5oWzDgAAAQE"]
[Tue Mar 24 08:23:27.997169 2026] [:error] [pid 64198:tid 64217] [client 172.213.236.250:62874] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Tue Mar 24 08:23:28.281459 2026] [:error] [pid 64198:tid 64213] [client 172.213.236.250:62874] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Mar 24 08:23:28.617567 2026] [:error] [pid 64198:tid 64214] [client 172.213.236.250:62874] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Mar 24 08:23:28.889163 2026] [:error] [pid 64198:tid 64216] [client 172.213.236.250:62874] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Tue Mar 24 09:02:43.709690 2026] [:error] [pid 64198:tid 64209] [client 185.223.152.142:54423] [client 185.223.152.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.142, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "acHis3VzJqf6OS_oSZ0sPwAAAUk"]
[Tue Mar 24 09:02:43.711721 2026] [:error] [pid 64198:tid 64209] [client 185.223.152.142:54423] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Mar 24 14:59:02.406019 2026] [:error] [pid 48219:tid 48293] [client 103.115.155.126:61526] [client 103.115.155.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.115.155.126, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acI2Nihf3b4R_lAIyv8ynAAAAgw"]
[Tue Mar 24 14:59:02.413454 2026] [:error] [pid 48219:tid 48293] [client 103.115.155.126:61526] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 24 16:13:37.517639 2026] [:error] [pid 64198:tid 64212] [client 34.168.128.247:56952] [client 34.168.128.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.128.247, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acJHsXVzJqf6OS_oSZ1BfAAAAUw"]
[Tue Mar 24 16:13:37.521122 2026] [:error] [pid 64198:tid 64212] [client 34.168.128.247:56952] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 24 16:13:39.693529 2026] [:error] [pid 64198:tid 64216] [client 34.168.128.247:56952] [client 34.168.128.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "acJHs3VzJqf6OS_oSZ1BjAAAAVA"]
[Tue Mar 24 16:13:40.091679 2026] [:error] [pid 48214:tid 48267] [client 34.168.128.247:65225] [client 34.168.128.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "acJHtLeshLWZ3uUDHKlCdAAAAc8"]
[Tue Mar 24 16:13:40.456534 2026] [:error] [pid 3137:tid 3139] [client 34.168.128.247:61673] [client 34.168.128.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "acJHtJdZesutm6dfYM_fawAAAMA"]
[Tue Mar 24 16:13:40.842213 2026] [:error] [pid 64198:tid 64203] [client 34.168.128.247:51913] [client 34.168.128.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "acJHtHVzJqf6OS_oSZ1BkAAAAUM"]
[Tue Mar 24 16:13:41.206314 2026] [:error] [pid 64198:tid 64222] [client 34.168.128.247:58451] [client 34.168.128.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "acJHtXVzJqf6OS_oSZ1BkwAAAVY"]
[Tue Mar 24 16:13:41.575341 2026] [:error] [pid 38767:tid 38777] [client 34.168.128.247:56995] [client 34.168.128.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "acJHtfwkUqN4GJAI5oWc5wAAAQc"]
[Tue Mar 24 16:13:41.907050 2026] [:error] [pid 38767:tid 38785] [client 34.168.128.247:57653] [client 34.168.128.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "acJHtfwkUqN4GJAI5oWc6QAAAQ8"]
[Tue Mar 24 16:54:44.440856 2026] [:error] [pid 38767:tid 38788] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Tue Mar 24 16:54:44.769842 2026] [:error] [pid 38767:tid 38776] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Tue Mar 24 16:54:45.012476 2026] [:error] [pid 38767:tid 38781] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Mar 24 16:54:45.471404 2026] [:error] [pid 38767:tid 38785] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Tue Mar 24 16:54:45.713776 2026] [:error] [pid 38767:tid 38771] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue Mar 24 16:54:46.291426 2026] [:error] [pid 38767:tid 38773] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Tue Mar 24 16:54:46.672109 2026] [:error] [pid 38767:tid 38784] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Tue Mar 24 16:54:47.057804 2026] [:error] [pid 38767:tid 38789] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Tue Mar 24 16:54:47.359522 2026] [:error] [pid 38767:tid 38790] [client 158.158.35.221:47051] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Tue Mar 24 16:54:47.602857 2026] [:error] [pid 38767:tid 38791] [client 158.158.35.221:47051] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xvs.php"] [unique_id "acJRV_wkUqN4GJAI5oW14AAAARU"]
[Tue Mar 24 16:54:56.668481 2026] [:error] [pid 3137:tid 3150] [client 158.158.35.221:28785] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xvs.php"] [unique_id "acJRYJdZesutm6dfYM_rggAAAMs"]
[Tue Mar 24 16:57:03.528418 2026] [:error] [pid 3030:tid 3057] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Tue Mar 24 16:57:03.770482 2026] [:error] [pid 3030:tid 3054] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/ws77.php
[Tue Mar 24 16:57:04.014305 2026] [:error] [pid 3030:tid 3061] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Tue Mar 24 16:57:04.315733 2026] [:error] [pid 3030:tid 3064] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Tue Mar 24 16:57:04.633789 2026] [:error] [pid 3030:tid 3073] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/feokc.php
[Tue Mar 24 16:57:04.952805 2026] [:error] [pid 3030:tid 3069] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Tue Mar 24 16:57:05.591968 2026] [:error] [pid 3030:tid 3072] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Mar 24 16:57:06.192122 2026] [:error] [pid 3030:tid 3055] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/24.php
[Tue Mar 24 16:57:06.494131 2026] [:error] [pid 3030:tid 3060] [client 158.158.35.221:36062] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Mar 24 16:57:06.792830 2026] [:error] [pid 3030:tid 3049] [client 158.158.35.221:36062] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acJR4gyOuILyynfcqflHFAAAAAA"]
[Tue Mar 24 16:57:55.513992 2026] [:error] [pid 38767:tid 38777] [client 158.158.35.221:33187] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aifa.php"] [unique_id "acJSE_wkUqN4GJAI5oW3jQAAAQc"]
[Tue Mar 24 16:58:03.130687 2026] [:error] [pid 3137:tid 3149] [client 158.158.35.221:36699] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aifa.php"] [unique_id "acJSG5dZesutm6dfYM_s4AAAAMo"]
[Tue Mar 24 16:58:05.104312 2026] [:error] [pid 3137:tid 3140] [client 158.158.35.221:30898] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aifa.php"] [unique_id "acJSHZdZesutm6dfYM_s4wAAAME"]
[Tue Mar 24 16:58:08.325185 2026] [:error] [pid 64198:tid 64205] [client 158.158.35.221:43221] File does not exist: /usr/local/apache/htdocs/suspended-page/aifa.php
[Tue Mar 24 16:58:08.749098 2026] [:error] [pid 64198:tid 64205] [client 158.158.35.221:43221] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Tue Mar 24 16:58:08.988963 2026] [:error] [pid 64198:tid 64202] [client 158.158.35.221:43221] [client 158.158.35.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/app.php"] [unique_id "acJSIHVzJqf6OS_oSZ1WMwAAAUI"]
[Tue Mar 24 16:58:10.420589 2026] [:error] [pid 3031:tid 3095] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Tue Mar 24 16:58:10.663037 2026] [:error] [pid 3031:tid 3094] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Tue Mar 24 16:58:10.906471 2026] [:error] [pid 3031:tid 3085] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Tue Mar 24 16:58:11.383886 2026] [:error] [pid 3031:tid 3089] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Mar 24 16:58:11.628511 2026] [:error] [pid 3031:tid 3086] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/aapig.php
[Tue Mar 24 16:58:13.146547 2026] [:error] [pid 3031:tid 3086] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/com.php
[Tue Mar 24 16:58:13.389803 2026] [:error] [pid 3031:tid 3093] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Tue Mar 24 16:58:13.631706 2026] [:error] [pid 3031:tid 3076] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Mar 24 16:58:13.874736 2026] [:error] [pid 3031:tid 3098] [client 158.158.35.221:38112] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue Mar 24 16:58:14.113720 2026] [:error] [pid 3031:tid 3092] [client 158.158.35.221:38112] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "acJSJqJBKytnG47nuiYl9gAAAFA"]
[Tue Mar 24 16:58:14.759769 2026] [:error] [pid 3137:tid 3149] [client 158.158.35.221:43211] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "acJSJpdZesutm6dfYM_s_QAAAMo"]
[Tue Mar 24 16:58:15.439587 2026] [:error] [pid 38767:tid 38782] [client 158.158.35.221:33177] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "acJSJ_wkUqN4GJAI5oW3sQAAAQw"]
[Tue Mar 24 16:58:16.024477 2026] [:error] [pid 38767:tid 38777] [client 158.158.35.221:24486] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "acJSKPwkUqN4GJAI5oW3tAAAAQc"]
[Tue Mar 24 16:58:16.690076 2026] [:error] [pid 38767:tid 38770] [client 158.158.35.221:38593] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acJSKPwkUqN4GJAI5oW3uAAAAQA"]
[Tue Mar 24 16:58:17.231349 2026] [:error] [pid 48214:tid 48263] [client 158.158.35.221:62428] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acJSKbeshLWZ3uUDHKlKTwAAAcs"]
[Tue Mar 24 16:58:18.198972 2026] [:error] [pid 38767:tid 38787] [client 158.158.35.221:61346] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acJSKvwkUqN4GJAI5oW3vAAAARE"]
[Tue Mar 24 16:58:18.994482 2026] [:error] [pid 48219:tid 48285] [client 158.158.35.221:32456] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "acJSKihf3b4R_lAIyv9MVgAAAgQ"]
[Tue Mar 24 16:58:19.526950 2026] [:error] [pid 3137:tid 3147] [client 158.158.35.221:38133] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acJSK5dZesutm6dfYM_tCwAAAMg"]
[Tue Mar 24 16:58:20.413678 2026] [:error] [pid 3137:tid 3142] [client 158.158.35.221:32463] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acJSLJdZesutm6dfYM_tEAAAAMM"]
[Tue Mar 24 16:58:21.016774 2026] [:error] [pid 3137:tid 3162] [client 158.158.35.221:62834] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acJSLZdZesutm6dfYM_tFAAAANc"]
[Tue Mar 24 16:58:21.528612 2026] [:error] [pid 3137:tid 3160] [client 158.158.35.221:61327] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acJSLZdZesutm6dfYM_tGQAAANU"]
[Tue Mar 24 16:58:22.310514 2026] [:error] [pid 48214:tid 48260] [client 158.158.35.221:22182] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acJSLreshLWZ3uUDHKlKUQAAAcg"]
[Tue Mar 24 16:58:22.842376 2026] [:error] [pid 38767:tid 38780] [client 158.158.35.221:43260] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acJSLvwkUqN4GJAI5oW3vQAAAQo"]
[Tue Mar 24 16:58:23.341062 2026] [:error] [pid 38767:tid 38788] [client 158.158.35.221:37675] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acJSL_wkUqN4GJAI5oW3wgAAARI"]
[Tue Mar 24 16:58:23.941419 2026] [:error] [pid 38767:tid 38793] [client 158.158.35.221:22189] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acJSL_wkUqN4GJAI5oW3xAAAARc"]
[Tue Mar 24 16:58:24.560425 2026] [:error] [pid 3137:tid 3143] [client 158.158.35.221:30899] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acJSMJdZesutm6dfYM_tIQAAAMQ"]
[Tue Mar 24 16:58:25.236677 2026] [:error] [pid 38767:tid 38790] [client 158.158.35.221:25125] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acJSMfwkUqN4GJAI5oW3xgAAARQ"]
[Tue Mar 24 16:58:25.994050 2026] [:error] [pid 48214:tid 48272] [client 158.158.35.221:21418] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acJSMbeshLWZ3uUDHKlKVgAAAdQ"]
[Tue Mar 24 16:58:26.760795 2026] [:error] [pid 48214:tid 48255] [client 158.158.35.221:22184] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acJSMreshLWZ3uUDHKlKVwAAAcM"]
[Tue Mar 24 16:58:27.430409 2026] [:error] [pid 38767:tid 38777] [client 158.158.35.221:25132] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "acJSM_wkUqN4GJAI5oW3zAAAAQc"]
[Tue Mar 24 16:58:27.969958 2026] [:error] [pid 64198:tid 64217] [client 158.158.35.221:62837] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "acJSM3VzJqf6OS_oSZ1WQAAAAVE"]
[Tue Mar 24 16:58:28.530410 2026] [:error] [pid 48219:tid 48285] [client 158.158.35.221:22205] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "acJSNChf3b4R_lAIyv9MYQAAAgQ"]
[Tue Mar 24 16:58:29.074199 2026] [:error] [pid 48128:tid 48160] [client 158.158.35.221:62817] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "acJSNcvR4LIMFLbM5VklCwAAAYg"]
[Tue Mar 24 16:58:29.827208 2026] [:error] [pid 38767:tid 38792] [client 158.158.35.221:25133] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "acJSNfwkUqN4GJAI5oW30QAAARY"]
[Tue Mar 24 16:58:30.361198 2026] [:error] [pid 38767:tid 38773] [client 158.158.35.221:30869] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "acJSNvwkUqN4GJAI5oW31QAAAQM"]
[Tue Mar 24 16:58:30.896771 2026] [:error] [pid 38767:tid 38783] [client 158.158.35.221:53559] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "acJSNvwkUqN4GJAI5oW31gAAAQ0"]
[Tue Mar 24 16:58:31.528106 2026] [:error] [pid 3137:tid 3156] [client 158.158.35.221:51056] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/web.php"] [unique_id "acJSN5dZesutm6dfYM_tLAAAANE"]
[Tue Mar 24 16:58:32.415277 2026] [:error] [pid 48128:tid 48165] [client 158.158.35.221:62811] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acJSOMvR4LIMFLbM5VklDAAAAY0"]
[Tue Mar 24 16:58:33.501368 2026] [:error] [pid 3137:tid 3151] [client 158.158.35.221:32472] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acJSOZdZesutm6dfYM_tLwAAAMw"]
[Tue Mar 24 16:58:34.484021 2026] [:error] [pid 38767:tid 38792] [client 158.158.35.221:54663] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acJSOvwkUqN4GJAI5oW33AAAARY"]
[Tue Mar 24 16:58:35.062605 2026] [:error] [pid 3137:tid 3149] [client 158.158.35.221:24481] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acJSO5dZesutm6dfYM_tMgAAAMo"]
[Tue Mar 24 16:58:36.209617 2026] [:error] [pid 3030:tid 3060] [client 158.158.35.221:53506] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acJSPAyOuILyynfcqflHOAAAAAs"]
[Tue Mar 24 16:58:37.069308 2026] [:error] [pid 48214:tid 48267] [client 158.158.35.221:61363] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acJSPbeshLWZ3uUDHKlKWQAAAc8"]
[Tue Mar 24 16:58:37.793870 2026] [:error] [pid 48219:tid 48304] [client 158.158.35.221:24489] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acJSPShf3b4R_lAIyv9MaAAAAhc"]
[Tue Mar 24 16:58:38.491000 2026] [:error] [pid 3032:tid 3125] [client 158.158.35.221:62445] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acJSPia_-JXXD03-JNw3wAAAAJY"]
[Tue Mar 24 16:58:39.152552 2026] [:error] [pid 48219:tid 48296] [client 158.158.35.221:37671] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acJSPyhf3b4R_lAIyv9MawAAAg8"]
[Tue Mar 24 16:58:40.163687 2026] [:error] [pid 3137:tid 3150] [client 158.158.35.221:30907] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acJSQJdZesutm6dfYM_tPgAAAMs"]
[Tue Mar 24 16:58:41.100779 2026] [:error] [pid 64198:tid 64206] [client 158.158.35.221:33211] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acJSQXVzJqf6OS_oSZ1WSwAAAUY"]
[Tue Mar 24 16:58:41.802010 2026] [:error] [pid 64198:tid 64222] [client 158.158.35.221:62828] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acJSQXVzJqf6OS_oSZ1WTQAAAVY"]
[Tue Mar 24 16:58:42.449321 2026] [:error] [pid 48214:tid 48265] [client 158.158.35.221:51018] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "acJSQreshLWZ3uUDHKlKXAAAAc0"]
[Tue Mar 24 16:58:43.051540 2026] [:error] [pid 3032:tid 3113] [client 158.158.35.221:43244] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "acJSQya_-JXXD03-JNw3wQAAAIo"]
[Tue Mar 24 16:58:44.357762 2026] [:error] [pid 3032:tid 3112] [client 158.158.35.221:62421] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "acJSRCa_-JXXD03-JNw3wwAAAIk"]
[Tue Mar 24 16:58:45.369570 2026] [:error] [pid 48214:tid 48260] [client 158.158.35.221:32480] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "acJSRbeshLWZ3uUDHKlKXgAAAcg"]
[Tue Mar 24 16:58:46.681771 2026] [:error] [pid 48214:tid 48261] [client 158.158.35.221:53504] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xper1.php"] [unique_id "acJSRreshLWZ3uUDHKlKXwAAAck"]
[Tue Mar 24 16:58:47.874942 2026] [:error] [pid 64198:tid 64218] [client 158.158.35.221:22197] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xper1.php"] [unique_id "acJSR3VzJqf6OS_oSZ1WVAAAAVI"]
[Tue Mar 24 16:58:50.903608 2026] [:error] [pid 48219:tid 48295] [client 158.158.35.221:30857] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xper1.php"] [unique_id "acJSSihf3b4R_lAIyv9McwAAAg4"]
[Tue Mar 24 16:58:54.115439 2026] [:error] [pid 64198:tid 64223] [client 158.158.35.221:33192] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xper1.php"] [unique_id "acJSTnVzJqf6OS_oSZ1WWgAAAVc"]
[Tue Mar 24 16:58:55.059529 2026] [:error] [pid 38767:tid 38781] [client 158.158.35.221:30868] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "acJST_wkUqN4GJAI5oW39QAAAQs"]
[Tue Mar 24 16:58:56.443383 2026] [:error] [pid 3137:tid 3139] [client 158.158.35.221:24450] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "acJSUJdZesutm6dfYM_tXQAAAMA"]
[Tue Mar 24 16:58:57.568048 2026] [:error] [pid 3031:tid 3077] [client 158.158.35.221:36724] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "acJSUaJBKytnG47nuiYl_AAAAEE"]
[Tue Mar 24 16:58:58.744735 2026] [:error] [pid 48128:tid 48162] [client 158.158.35.221:32500] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "acJSUsvR4LIMFLbM5VklFAAAAYo"]
[Tue Mar 24 16:58:59.738776 2026] [:error] [pid 38767:tid 38791] [client 158.158.35.221:63031] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "acJSU_wkUqN4GJAI5oW3_QAAARU"]
[Tue Mar 24 16:59:01.026012 2026] [:error] [pid 64198:tid 64206] [client 158.158.35.221:44237] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "acJSVXVzJqf6OS_oSZ1WawAAAUY"]
[Tue Mar 24 16:59:02.447611 2026] [:error] [pid 3137:tid 3160] [client 158.158.35.221:62458] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "acJSVpdZesutm6dfYM_tZwAAANU"]
[Tue Mar 24 16:59:03.742853 2026] [:error] [pid 48219:tid 48288] [client 158.158.35.221:61326] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "acJSVyhf3b4R_lAIyv9MggAAAgc"]
[Tue Mar 24 16:59:04.429363 2026] [:error] [pid 3032:tid 3103] [client 158.158.35.221:38121] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acJSWCa_-JXXD03-JNw3yQAAAIA"]
[Tue Mar 24 16:59:05.036316 2026] [:error] [pid 3032:tid 3105] [client 158.158.35.221:30889] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acJSWSa_-JXXD03-JNw3ywAAAII"]
[Tue Mar 24 16:59:05.647106 2026] [:error] [pid 3031:tid 3090] [client 158.158.35.221:38138] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acJSWaJBKytnG47nuiYl_gAAAE4"]
[Tue Mar 24 16:59:06.586007 2026] [:error] [pid 3137:tid 3152] [client 158.158.35.221:61372] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acJSWpdZesutm6dfYM_tawAAAM0"]
[Tue Mar 24 16:59:07.520451 2026] [:error] [pid 3030:tid 3051] [client 158.158.35.221:38634] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "acJSWwyOuILyynfcqflHPQAAAAI"]
[Tue Mar 24 16:59:08.632079 2026] [:error] [pid 38767:tid 38789] [client 158.158.35.221:43239] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "acJSXPwkUqN4GJAI5oW4FQAAARM"]
[Tue Mar 24 16:59:09.249306 2026] [:error] [pid 38767:tid 38792] [client 158.158.35.221:25129] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "acJSXfwkUqN4GJAI5oW4FgAAARY"]
[Tue Mar 24 16:59:09.745844 2026] [:error] [pid 48214:tid 48276] [client 158.158.35.221:44278] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "acJSXbeshLWZ3uUDHKlKZwAAAdg"]
[Tue Mar 24 16:59:10.415463 2026] [:error] [pid 3137:tid 3150] [client 158.158.35.221:33157] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "acJSXpdZesutm6dfYM_tbQAAAMs"]
[Tue Mar 24 16:59:11.123614 2026] [:error] [pid 3031:tid 3098] [client 158.158.35.221:44285] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "acJSX6JBKytnG47nuiYmAgAAAFY"]
[Tue Mar 24 16:59:11.838107 2026] [:error] [pid 48214:tid 48259] [client 158.158.35.221:37635] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "acJSX7eshLWZ3uUDHKlKaAAAAcc"]
[Tue Mar 24 16:59:12.435975 2026] [:error] [pid 38767:tid 38793] [client 158.158.35.221:33154] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gm.php"] [unique_id "acJSYPwkUqN4GJAI5oW4IAAAARc"]
[Tue Mar 24 16:59:13.072197 2026] [:error] [pid 3032:tid 3125] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Mar 24 16:59:13.372414 2026] [:error] [pid 3032:tid 3108] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/x1.php
[Tue Mar 24 16:59:13.851202 2026] [:error] [pid 3032:tid 3110] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Tue Mar 24 16:59:14.096336 2026] [:error] [pid 3032:tid 3113] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Tue Mar 24 16:59:14.359068 2026] [:error] [pid 3032:tid 3106] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Tue Mar 24 16:59:14.661876 2026] [:error] [pid 3032:tid 3109] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Tue Mar 24 16:59:15.012408 2026] [:error] [pid 3032:tid 3120] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Tue Mar 24 16:59:15.356648 2026] [:error] [pid 3032:tid 3124] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq13.php
[Tue Mar 24 16:59:15.686030 2026] [:error] [pid 3032:tid 3115] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/6kDPjgFTmvS.php
[Tue Mar 24 16:59:15.987905 2026] [:error] [pid 3032:tid 3117] [client 158.158.35.221:38631] File does not exist: /usr/local/apache/htdocs/suspended-page/sc.php
[Tue Mar 24 16:59:16.581773 2026] [:error] [pid 3032:tid 3105] [client 158.158.35.221:38631] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "acJSZCa_-JXXD03-JNw33AAAAII"]
[Tue Mar 24 16:59:17.456511 2026] [:error] [pid 38767:tid 38772] [client 158.158.35.221:62804] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "acJSZfwkUqN4GJAI5oW4MwAAAQI"]
[Tue Mar 24 16:59:18.128794 2026] [:error] [pid 38767:tid 38774] [client 158.158.35.221:36732] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "acJSZvwkUqN4GJAI5oW4NwAAAQQ"]
[Tue Mar 24 16:59:18.839472 2026] [:error] [pid 48219:tid 48295] [client 158.158.35.221:24485] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "acJSZihf3b4R_lAIyv9MiQAAAg4"]
[Tue Mar 24 16:59:20.149302 2026] [:error] [pid 64198:tid 64208] [client 158.158.35.221:44232] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acJSaHVzJqf6OS_oSZ1WuwAAAUg"]
[Tue Mar 24 16:59:21.101647 2026] [:error] [pid 38767:tid 38774] [client 158.158.35.221:53538] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acJSafwkUqN4GJAI5oW4QQAAAQQ"]
[Tue Mar 24 16:59:21.733125 2026] [:error] [pid 38767:tid 38791] [client 158.158.35.221:22202] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acJSafwkUqN4GJAI5oW4RAAAARU"]
[Tue Mar 24 16:59:23.023002 2026] [:error] [pid 38767:tid 38793] [client 158.158.35.221:62459] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acJSa_wkUqN4GJAI5oW4TQAAARc"]
[Tue Mar 24 16:59:23.997963 2026] [:error] [pid 38767:tid 38793] [client 158.158.35.221:43225] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "acJSa_wkUqN4GJAI5oW4VwAAARc"]
[Tue Mar 24 16:59:24.853072 2026] [:error] [pid 38767:tid 38770] [client 158.158.35.221:30911] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "acJSbPwkUqN4GJAI5oW4XgAAAQA"]
[Tue Mar 24 16:59:25.652199 2026] [:error] [pid 48219:tid 48290] [client 158.158.35.221:38107] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "acJSbShf3b4R_lAIyv9MjwAAAgk"]
[Tue Mar 24 16:59:26.580090 2026] [:error] [pid 3137:tid 3147] [client 158.158.35.221:43206] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gk.php"] [unique_id "acJSbpdZesutm6dfYM_tfAAAAMg"]
[Tue Mar 24 16:59:27.536204 2026] [:error] [pid 38767:tid 38779] [client 158.158.35.221:20998] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "acJSb_wkUqN4GJAI5oW4aQAAAQk"]
[Tue Mar 24 16:59:28.665552 2026] [:error] [pid 3137:tid 3154] [client 158.158.35.221:62791] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "acJScJdZesutm6dfYM_tfQAAAM8"]
[Tue Mar 24 16:59:29.683040 2026] [:error] [pid 38767:tid 38772] [client 158.158.35.221:43223] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "acJScfwkUqN4GJAI5oW4dgAAAQI"]
[Tue Mar 24 16:59:30.557568 2026] [:error] [pid 48219:tid 48289] [client 158.158.35.221:21006] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "acJScihf3b4R_lAIyv9MkgAAAgg"]
[Tue Mar 24 16:59:31.177299 2026] [:error] [pid 38767:tid 38794] [client 158.158.35.221:24493] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acJSc_wkUqN4GJAI5oW4iAAAARg"]
[Tue Mar 24 16:59:32.138930 2026] [:error] [pid 38767:tid 38789] [client 158.158.35.221:30910] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acJSdPwkUqN4GJAI5oW4kgAAARM"]
[Tue Mar 24 16:59:33.090116 2026] [:error] [pid 38767:tid 38791] [client 158.158.35.221:62836] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acJSdfwkUqN4GJAI5oW4mwAAARU"]
[Tue Mar 24 16:59:34.024034 2026] [:error] [pid 3137:tid 3142] [client 158.158.35.221:33203] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acJSdpdZesutm6dfYM_tggAAAMM"]
[Tue Mar 24 16:59:35.212487 2026] [:error] [pid 48219:tid 48281] [client 158.158.35.221:44281] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acJSdyhf3b4R_lAIyv9MlwAAAgA"]
[Tue Mar 24 16:59:36.366285 2026] [:error] [pid 48214:tid 48273] [client 158.158.35.221:53520] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acJSeLeshLWZ3uUDHKlKcAAAAdU"]
[Tue Mar 24 16:59:37.892806 2026] [:error] [pid 48219:tid 48287] [client 158.158.35.221:37666] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acJSeShf3b4R_lAIyv9MmAAAAgY"]
[Tue Mar 24 16:59:40.652786 2026] [:error] [pid 38767:tid 38778] [client 158.158.35.221:61319] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acJSfPwkUqN4GJAI5oW4xwAAAQg"]
[Tue Mar 24 16:59:45.577137 2026] [:error] [pid 48128:tid 48156] [client 158.158.35.221:38614] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "acJSgcvR4LIMFLbM5VklHwAAAYY"]
[Tue Mar 24 16:59:51.747756 2026] [:error] [pid 3030:tid 3072] [client 158.158.35.221:21021] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "acJShwyOuILyynfcqflHSgAAABc"]
[Tue Mar 24 16:59:53.717761 2026] [:error] [pid 64198:tid 64200] [client 158.158.35.221:63039] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "acJSiXVzJqf6OS_oSZ1W5wAAAUA"]
[Tue Mar 24 16:59:55.154114 2026] [:error] [pid 64198:tid 64213] [client 158.158.35.221:33179] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "acJSi3VzJqf6OS_oSZ1W6AAAAU0"]
[Tue Mar 24 16:59:56.220468 2026] [:error] [pid 38767:tid 38777] [client 158.158.35.221:38606] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acJSjPwkUqN4GJAI5oW5BwAAAQc"]
[Tue Mar 24 16:59:57.248005 2026] [:error] [pid 64198:tid 64202] [client 158.158.35.221:23421] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acJSjXVzJqf6OS_oSZ1W7QAAAUI"]
[Tue Mar 24 16:59:58.396670 2026] [:error] [pid 38767:tid 38773] [client 158.158.35.221:53532] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acJSjvwkUqN4GJAI5oW5DgAAAQM"]
[Tue Mar 24 16:59:59.446094 2026] [:error] [pid 38767:tid 38776] [client 158.158.35.221:51030] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acJSj_wkUqN4GJAI5oW5EAAAAQY"]
[Tue Mar 24 17:00:00.658196 2026] [:error] [pid 38767:tid 38782] [client 158.158.35.221:36691] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acJSkPwkUqN4GJAI5oW5FQAAAQw"]
[Tue Mar 24 17:00:01.637848 2026] [:error] [pid 48219:tid 48299] [client 158.158.35.221:32487] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acJSkShf3b4R_lAIyv9MqAAAAhI"]
[Tue Mar 24 17:00:04.327582 2026] [:error] [pid 3137:tid 3155] [client 158.158.35.221:51061] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acJSlJdZesutm6dfYM_tkgAAANA"]
[Tue Mar 24 17:00:05.086430 2026] [:error] [pid 38767:tid 38784] [client 158.158.35.221:51010] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acJSlfwkUqN4GJAI5oW5HwAAAQ4"]
[Tue Mar 24 17:00:06.087196 2026] [:error] [pid 38767:tid 38771] [client 158.158.35.221:37693] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "acJSlvwkUqN4GJAI5oW5JAAAAQE"]
[Tue Mar 24 17:00:07.005961 2026] [:error] [pid 38767:tid 38770] [client 158.158.35.221:35781] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "acJSl_wkUqN4GJAI5oW5KAAAAQA"]
[Tue Mar 24 17:00:07.715955 2026] [:error] [pid 3031:tid 3082] [client 158.158.35.221:51070] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "acJSl6JBKytnG47nuiYmCwAAAEY"]
[Tue Mar 24 17:00:08.429687 2026] [:error] [pid 48219:tid 48282] [client 158.158.35.221:62376] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "acJSmChf3b4R_lAIyv9MqQAAAgE"]
[Tue Mar 24 17:00:09.632045 2026] [:error] [pid 64198:tid 64201] [client 158.158.35.221:34027] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "acJSmXVzJqf6OS_oSZ1W_QAAAUE"]
[Tue Mar 24 17:00:10.434850 2026] [:error] [pid 3137:tid 3145] [client 158.158.35.221:34022] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "acJSmpdZesutm6dfYM_tlQAAAMY"]
[Tue Mar 24 17:00:11.114069 2026] [:error] [pid 3137:tid 3141] [client 158.158.35.221:44250] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "acJSm5dZesutm6dfYM_tlwAAAMI"]
[Tue Mar 24 17:00:11.932403 2026] [:error] [pid 48219:tid 48297] [client 158.158.35.221:62991] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-aaa.php"] [unique_id "acJSmyhf3b4R_lAIyv9MrQAAAhA"]
[Tue Mar 24 17:00:12.791963 2026] [:error] [pid 48219:tid 48295] [client 158.158.35.221:48669] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "acJSnChf3b4R_lAIyv9MrgAAAg4"]
[Tue Mar 24 17:00:13.527331 2026] [:error] [pid 3030:tid 3051] [client 158.158.35.221:26330] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "acJSnQyOuILyynfcqflHUgAAAAI"]
[Tue Mar 24 17:00:14.541272 2026] [:error] [pid 3030:tid 3057] [client 158.158.35.221:40195] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "acJSngyOuILyynfcqflHVQAAAAg"]
[Tue Mar 24 17:00:15.417696 2026] [:error] [pid 64198:tid 64223] [client 158.158.35.221:35833] [client 158.158.35.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "acJSn3VzJqf6OS_oSZ1XAgAAAVc"]
[Tue Mar 24 17:00:16.279077 2026] [:error] [pid 38767:tid 38775] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Tue Mar 24 17:00:16.730698 2026] [:error] [pid 38767:tid 38792] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Tue Mar 24 17:00:17.125701 2026] [:error] [pid 38767:tid 38778] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/filer.php
[Tue Mar 24 17:00:17.369720 2026] [:error] [pid 38767:tid 38777] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/lites.php
[Tue Mar 24 17:00:17.614515 2026] [:error] [pid 38767:tid 38771] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/cord.php
[Tue Mar 24 17:00:17.943996 2026] [:error] [pid 38767:tid 38779] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/shlo.php
[Tue Mar 24 17:00:18.218050 2026] [:error] [pid 38767:tid 38774] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Tue Mar 24 17:00:18.463723 2026] [:error] [pid 38767:tid 38791] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Tue Mar 24 17:00:18.706251 2026] [:error] [pid 38767:tid 38770] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Tue Mar 24 17:00:19.114355 2026] [:error] [pid 38767:tid 38785] [client 158.158.35.221:50113] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Tue Mar 24 18:43:49.406186 2026] [:error] [pid 48219:tid 48281] [client 104.208.81.111:6682] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 24 18:43:49.548555 2026] [:error] [pid 48219:tid 48298] [client 104.208.81.111:6682] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acJq5Shf3b4R_lAIyv9prwAAAhE"]
[Tue Mar 24 18:43:50.035439 2026] [:error] [pid 64198:tid 64211] [client 104.208.81.111:6700] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acJq5nVzJqf6OS_oSZ2KAAAAAUs"]
[Tue Mar 24 18:43:50.539322 2026] [:error] [pid 64198:tid 64212] [client 104.208.81.111:5370] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acJq5nVzJqf6OS_oSZ2KAQAAAUw"]
[Tue Mar 24 18:43:51.018987 2026] [:error] [pid 3032:tid 3103] [client 104.208.81.111:2640] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acJq5ya_-JXXD03-JNxIAQAAAIA"]
[Tue Mar 24 19:58:28.005287 2026] [:error] [pid 3137:tid 3144] [client 103.94.251.77:50198] [client 103.94.251.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.94.251.77, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acJ8ZJdZesutm6dfYM8qCwAAAMU"]
[Tue Mar 24 19:58:28.012267 2026] [:error] [pid 3137:tid 3144] [client 103.94.251.77:50198] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 24 20:01:26.971083 2026] [:error] [pid 64198:tid 64215] [client 14.96.134.82:52378] [client 14.96.134.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.96.134.82, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acJ9FnVzJqf6OS_oSZ2xEgAAAU8"]
[Tue Mar 24 20:01:26.976192 2026] [:error] [pid 64198:tid 64215] [client 14.96.134.82:52378] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 24 21:12:06.797068 2026] [:error] [pid 3030:tid 3050] [client 20.63.12.125:3208] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 24 21:12:07.006685 2026] [:error] [pid 3030:tid 3055] [client 20.63.12.125:3208] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Mar 24 21:12:07.425844 2026] [:error] [pid 3030:tid 3049] [client 20.63.12.125:3208] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Mar 24 21:12:07.635284 2026] [:error] [pid 3030:tid 3061] [client 20.63.12.125:3208] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Mar 24 21:12:08.535859 2026] [:error] [pid 3030:tid 3063] [client 20.63.12.125:3208] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Mar 24 21:12:08.980395 2026] [:error] [pid 3030:tid 3066] [client 20.63.12.125:3208] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Mar 24 21:12:09.188670 2026] [:error] [pid 3030:tid 3053] [client 20.63.12.125:3208] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue Mar 24 21:12:09.604566 2026] [:error] [pid 3030:tid 3057] [client 20.63.12.125:3208] [client 20.63.12.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acKNqQyOuILyynfcqflkJgAAAAg"]
[Tue Mar 24 21:12:10.428678 2026] [:error] [pid 38767:tid 38775] [client 20.63.12.125:3276] [client 20.63.12.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acKNqvwkUqN4GJAI5oVPtwAAAQU"]
[Tue Mar 24 21:12:11.276653 2026] [:error] [pid 38767:tid 38776] [client 20.63.12.125:3304] [client 20.63.12.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acKNq_wkUqN4GJAI5oVPvQAAAQY"]
[Tue Mar 24 21:12:12.100350 2026] [:error] [pid 3137:tid 3143] [client 20.63.12.125:3317] [client 20.63.12.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acKNrJdZesutm6dfYM89xwAAAMQ"]
[Wed Mar 25 05:34:30.367708 2026] [:error] [pid 47946:tid 47953] [client 148.72.173.218:52644] [client 148.72.173.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.173.218, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "acMDZjipQTqBMSeKYhfpqQAAAQU"]
[Wed Mar 25 05:34:30.371811 2026] [:error] [pid 47946:tid 47953] [client 148.72.173.218:52644] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 25 05:41:32.287564 2026] [:error] [pid 754:tid 771] [client 85.203.36.41:61761] [client 85.203.36.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.36.41, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "acMFDDisL3asPbA3Cti5JQAAAAY"]
[Wed Mar 25 05:41:32.291135 2026] [:error] [pid 754:tid 771] [client 85.203.36.41:61761] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 25 07:38:45.444944 2026] [:error] [pid 755:tid 823] [client 45.94.31.15:56260] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghaS6bdaeEwgCGwpMcwAAAEg"], referer: www.google.com
[Wed Mar 25 07:38:45.445011 2026] [:error] [pid 26321:tid 26339] [client 45.94.31.15:56243] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghfKO65qqGZCSPZqxCgAAAgA"], referer: www.google.com
[Wed Mar 25 07:38:45.447649 2026] [:error] [pid 754:tid 781] [client 45.94.31.15:56268] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "acMghTisL3asPbA3CtjO-wAAABA"]
[Wed Mar 25 07:38:45.450044 2026] [:error] [pid 756:tid 876] [client 45.94.31.15:56222] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMghTOaW6oylMIDBCTFrAAAAJg"]
[Wed Mar 25 07:38:45.448262 2026] [:error] [pid 756:tid 872] [client 45.94.31.15:56264] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "acMghTOaW6oylMIDBCTFqwAAAJQ"], referer: www.google.com
[Wed Mar 25 07:38:45.937916 2026] [:error] [pid 756:tid 857] [client 45.94.31.15:54124] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghTOaW6oylMIDBCTFwwAAAIU"], referer: www.google.com
[Wed Mar 25 07:38:45.942354 2026] [:error] [pid 47946:tid 47967] [client 45.94.31.15:54196] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "acMghTipQTqBMSeKYhcYBwAAARM"], referer: www.google.com
[Wed Mar 25 07:38:45.944635 2026] [:error] [pid 756:tid 857] [client 45.94.31.15:54109] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghTOaW6oylMIDBCTFxAAAAIU"], referer: www.google.com
[Wed Mar 25 07:38:45.945901 2026] [:error] [pid 756:tid 868] [client 45.94.31.15:54138] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "acMghTOaW6oylMIDBCTFyAAAAJA"]
[Wed Mar 25 07:38:45.950089 2026] [:error] [pid 756:tid 864] [client 45.94.31.15:54391] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMghTOaW6oylMIDBCTFyQAAAIw"]
[Wed Mar 25 07:38:46.426765 2026] [:error] [pid 892:tid 907] [client 45.94.31.15:52631] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghiT_G8WMU3T3yxpPVAAAAMk"], referer: www.google.com
[Wed Mar 25 07:38:46.431395 2026] [:error] [pid 47946:tid 47948] [client 45.94.31.15:52855] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghjipQTqBMSeKYhcYGgAAAQA"], referer: www.google.com
[Wed Mar 25 07:38:46.434385 2026] [:error] [pid 892:tid 909] [client 45.94.31.15:52715] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "acMghiT_G8WMU3T3yxpPVQAAAMs"], referer: www.google.com
[Wed Mar 25 07:38:46.438216 2026] [:error] [pid 892:tid 908] [client 45.94.31.15:52887] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "acMghiT_G8WMU3T3yxpPVwAAAMo"]
[Wed Mar 25 07:38:46.441553 2026] [:error] [pid 756:tid 870] [client 45.94.31.15:52983] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMghjOaW6oylMIDBCTF8gAAAJI"]
[Wed Mar 25 07:38:46.936364 2026] [:error] [pid 892:tid 896] [client 45.94.31.15:63942] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghiT_G8WMU3T3yxpPZQAAAMI"], referer: www.google.com
[Wed Mar 25 07:38:46.938658 2026] [:error] [pid 47989:tid 48002] [client 45.94.31.15:64151] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghiWKdJMhIccROjme6QAAAUs"], referer: www.google.com
[Wed Mar 25 07:38:46.940951 2026] [:error] [pid 47989:tid 48002] [client 45.94.31.15:64230] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "acMghiWKdJMhIccROjme6gAAAUs"]
[Wed Mar 25 07:38:46.941571 2026] [:error] [pid 26269:tid 26299] [client 45.94.31.15:64231] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "acMghkn7e-ZQbaIs7qx_-AAAAZc"], referer: www.google.com
[Wed Mar 25 07:38:46.948136 2026] [:error] [pid 26320:tid 26329] [client 45.94.31.15:64258] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMghjkUgS2mHAojGnl5LgAAAcA"]
[Wed Mar 25 07:38:47.427632 2026] [:error] [pid 26269:tid 26279] [client 45.94.31.15:54217] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMgh0n7e-ZQbaIs7qyAEwAAAYM"], referer: www.google.com
[Wed Mar 25 07:38:47.485503 2026] [:error] [pid 892:tid 909] [client 45.94.31.15:54186] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghyT_G8WMU3T3yxpPcgAAAMs"], referer: www.google.com
[Wed Mar 25 07:38:47.486424 2026] [:error] [pid 892:tid 909] [client 45.94.31.15:54418] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "acMghyT_G8WMU3T3yxpPdAAAAMs"]
[Wed Mar 25 07:38:47.488184 2026] [:error] [pid 892:tid 896] [client 45.94.31.15:54420] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-plain.php"] [unique_id "acMghyT_G8WMU3T3yxpPdQAAAMI"], referer: www.google.com
[Wed Mar 25 07:38:47.489095 2026] [:error] [pid 892:tid 923] [client 45.94.31.15:54669] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMghyT_G8WMU3T3yxpPdgAAANg"]
[Wed Mar 25 07:38:48.426708 2026] [:error] [pid 26321:tid 26344] [client 45.94.31.15:61814] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMgiPKO65qqGZCSPZqxcQAAAgU"], referer: www.google.com
[Wed Mar 25 07:38:48.493740 2026] [:error] [pid 26321:tid 26352] [client 45.94.31.15:62147] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMgiPKO65qqGZCSPZqxdAAAAgs"], referer: www.google.com
[Wed Mar 25 07:38:49.424684 2026] [:error] [pid 26269:tid 26276] [client 45.94.31.15:53845] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMgiUn7e-ZQbaIs7qyANQAAAYA"], referer: www.google.com
[Wed Mar 25 07:38:49.502460 2026] [:error] [pid 26269:tid 26295] [client 45.94.31.15:54173] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMgiUn7e-ZQbaIs7qyAOQAAAZM"], referer: www.google.com
[Wed Mar 25 07:38:50.408080 2026] [:error] [pid 47989:tid 48012] [client 45.94.31.15:49152] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMgiiWKdJMhIccROjmfGwAAAVU"], referer: www.google.com
[Wed Mar 25 07:38:50.497900 2026] [:error] [pid 26449:tid 26472] [client 45.94.31.15:50560] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMgitpZ2T15NDqzAjGdQQAAAlM"], referer: www.google.com
[Wed Mar 25 07:38:51.476805 2026] [:error] [pid 756:tid 872] [client 45.94.31.15:49915] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMgizOaW6oylMIDBCTGQQAAAJQ"], referer: www.google.com
[Wed Mar 25 07:38:51.502034 2026] [:error] [pid 26449:tid 26466] [client 45.94.31.15:64269] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMgi9pZ2T15NDqzAjGdaAAAAk0"], referer: www.google.com
[Wed Mar 25 07:38:52.461080 2026] [:error] [pid 755:tid 805] [client 45.94.31.15:56940] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMgjKS6bdaeEwgCGwpM4QAAAEA"], referer: www.google.com
[Wed Mar 25 07:38:52.483664 2026] [:error] [pid 756:tid 852] [client 45.94.31.15:56965] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMgjDOaW6oylMIDBCTGQwAAAII"], referer: www.google.com
[Wed Mar 25 10:24:00.041527 2026] [:error] [pid 26449:tid 26470] [client 42.119.182.129:59995] [client 42.119.182.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.119.182.129, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acNHQNpZ2T15NDqzAjH8HQAAAlE"]
[Wed Mar 25 10:24:00.049802 2026] [:error] [pid 26449:tid 26470] [client 42.119.182.129:59995] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 25 10:59:59.639926 2026] [:error] [pid 755:tid 807] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 25 10:59:59.908285 2026] [:error] [pid 755:tid 841] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Wed Mar 25 11:00:00.179697 2026] [:error] [pid 755:tid 826] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Wed Mar 25 11:00:00.445825 2026] [:error] [pid 755:tid 836] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Mar 25 11:00:00.716106 2026] [:error] [pid 755:tid 808] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Wed Mar 25 11:00:00.979449 2026] [:error] [pid 755:tid 837] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Wed Mar 25 11:00:01.248837 2026] [:error] [pid 755:tid 838] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Wed Mar 25 11:00:01.513438 2026] [:error] [pid 755:tid 844] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Mar 25 11:00:01.791962 2026] [:error] [pid 755:tid 839] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Wed Mar 25 11:00:02.056860 2026] [:error] [pid 755:tid 843] [client 20.251.200.74:41571] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Mar 25 11:00:02.335340 2026] [:error] [pid 755:tid 845] [client 20.251.200.74:41571] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acNPsqS6bdaeEwgCGwpk5QAAAFY"]
[Wed Mar 25 11:00:03.511972 2026] [:error] [pid 26449:tid 26474] [client 20.251.200.74:32398] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acNPs9pZ2T15NDqzAjEQZQAAAlU"]
[Wed Mar 25 11:00:04.087960 2026] [:error] [pid 26449:tid 26469] [client 20.251.200.74:2056] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acNPtNpZ2T15NDqzAjEQawAAAlA"]
[Wed Mar 25 11:00:04.837916 2026] [:error] [pid 755:tid 847] [client 20.251.200.74:29362] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acNPtKS6bdaeEwgCGwpk5wAAAFg"]
[Wed Mar 25 11:00:05.960567 2026] [:error] [pid 756:tid 851] [client 20.251.200.74:45228] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acNPtTOaW6oylMIDBCT1MwAAAIE"]
[Wed Mar 25 11:00:08.869525 2026] [:error] [pid 26449:tid 26465] [client 20.251.200.74:2762] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acNPuNpZ2T15NDqzAjEQdQAAAkw"]
[Wed Mar 25 11:00:10.255551 2026] [:error] [pid 26449:tid 26471] [client 20.251.200.74:60097] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acNPutpZ2T15NDqzAjEQegAAAlI"]
[Wed Mar 25 11:00:11.674275 2026] [:error] [pid 26449:tid 26466] [client 20.251.200.74:34065] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acNPu9pZ2T15NDqzAjEQggAAAk0"]
[Wed Mar 25 11:00:12.291578 2026] [:error] [pid 47989:tid 48010] [client 20.251.200.74:25097] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acNPvCWKdJMhIccROjn0hQAAAVM"]
[Wed Mar 25 11:00:12.976862 2026] [:error] [pid 26449:tid 26471] [client 20.251.200.74:57328] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acNPvNpZ2T15NDqzAjEQhAAAAlI"]
[Wed Mar 25 11:00:13.665760 2026] [:error] [pid 47946:tid 47966] [client 20.251.200.74:57310] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acNPvTipQTqBMSeKYhdUfQAAARI"]
[Wed Mar 25 11:00:14.356452 2026] [:error] [pid 47946:tid 47962] [client 20.251.200.74:45239] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acNPvjipQTqBMSeKYhdUfgAAAQ4"]
[Wed Mar 25 11:00:14.980355 2026] [:error] [pid 47989:tid 47994] [client 20.251.200.74:2775] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/init.php"] [unique_id "acNPviWKdJMhIccROjn0iwAAAUM"]
[Wed Mar 25 11:00:16.025607 2026] [:error] [pid 26449:tid 26475] [client 20.251.200.74:42022] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/init.php"] [unique_id "acNPwNpZ2T15NDqzAjEQjAAAAlY"]
[Wed Mar 25 11:00:16.761874 2026] [:error] [pid 47989:tid 48008] [client 20.251.200.74:2986] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/init.php"] [unique_id "acNPwCWKdJMhIccROjn0kgAAAVE"]
[Wed Mar 25 11:00:17.453913 2026] [:error] [pid 892:tid 913] [client 20.251.200.74:34069] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/init.php"] [unique_id "acNPwST_G8WMU3T3yxpzQwAAAM8"]
[Wed Mar 25 11:00:18.452866 2026] [:error] [pid 47946:tid 47959] [client 20.251.200.74:45247] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acNPwjipQTqBMSeKYhdUgQAAAQs"]
[Wed Mar 25 11:00:19.614834 2026] [:error] [pid 26449:tid 26465] [client 20.251.200.74:2977] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acNPw9pZ2T15NDqzAjEQkwAAAkw"]
[Wed Mar 25 11:00:20.619461 2026] [:error] [pid 26449:tid 26463] [client 20.251.200.74:45240] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acNPxNpZ2T15NDqzAjEQlQAAAko"]
[Wed Mar 25 11:00:21.459538 2026] [:error] [pid 26449:tid 26455] [client 20.251.200.74:60147] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acNPxdpZ2T15NDqzAjEQlwAAAkI"]
[Wed Mar 25 11:00:22.277714 2026] [:error] [pid 26449:tid 26473] [client 20.251.200.74:34083] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "acNPxtpZ2T15NDqzAjEQmwAAAlQ"]
[Wed Mar 25 11:00:22.901308 2026] [:error] [pid 47989:tid 48008] [client 20.251.200.74:45214] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "acNPxiWKdJMhIccROjn0mwAAAVE"]
[Wed Mar 25 11:00:23.937166 2026] [:error] [pid 26449:tid 26461] [client 20.251.200.74:2993] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "acNPx9pZ2T15NDqzAjEQngAAAkg"]
[Wed Mar 25 11:00:24.539718 2026] [:error] [pid 756:tid 851] [client 20.251.200.74:3006] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "acNPyDOaW6oylMIDBCT1PAAAAIE"]
[Wed Mar 25 11:00:25.259313 2026] [:error] [pid 26269:tid 26276] [client 20.251.200.74:2187] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "acNPyUn7e-ZQbaIs7qyNZAAAAYA"]
[Wed Mar 25 11:00:26.042890 2026] [:error] [pid 47946:tid 47962] [client 20.251.200.74:34076] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "acNPyjipQTqBMSeKYhdUigAAAQ4"]
[Wed Mar 25 11:00:26.777713 2026] [:error] [pid 47989:tid 48002] [client 20.251.200.74:42019] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "acNPyiWKdJMhIccROjn0nwAAAUs"]
[Wed Mar 25 11:00:27.523091 2026] [:error] [pid 47989:tid 47996] [client 20.251.200.74:2239] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "acNPyyWKdJMhIccROjn0oAAAAUU"]
[Wed Mar 25 11:00:28.543598 2026] [:error] [pid 754:tid 770] [client 20.251.200.74:25110] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acNPzDisL3asPbA3CtjhGgAAAAU"]
[Wed Mar 25 11:00:29.280468 2026] [:error] [pid 756:tid 872] [client 20.251.200.74:2099] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acNPzTOaW6oylMIDBCT1SwAAAJQ"]
[Wed Mar 25 11:00:30.720300 2026] [:error] [pid 47989:tid 47998] [client 20.251.200.74:32439] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acNPziWKdJMhIccROjn0pAAAAUc"]
[Wed Mar 25 11:00:32.630185 2026] [:error] [pid 26449:tid 26464] [client 20.251.200.74:45193] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acNP0NpZ2T15NDqzAjEQtQAAAks"]
[Wed Mar 25 11:00:35.038426 2026] [:error] [pid 47989:tid 48008] [client 20.251.200.74:2800] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "acNP0yWKdJMhIccROjn0pQAAAVE"]
[Wed Mar 25 11:00:36.698563 2026] [:error] [pid 26449:tid 26462] [client 20.251.200.74:42031] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "acNP1NpZ2T15NDqzAjEQvQAAAkk"]
[Wed Mar 25 11:00:47.352057 2026] [:error] [pid 47989:tid 48006] [client 20.251.200.74:42023] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "acNP3yWKdJMhIccROjn0qwAAAU8"]
[Wed Mar 25 11:00:50.452781 2026] [:error] [pid 47989:tid 47997] [client 20.251.200.74:38574] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mh.php"] [unique_id "acNP4iWKdJMhIccROjn0tAAAAUY"]
[Wed Mar 25 11:00:51.751031 2026] [:error] [pid 26449:tid 26466] [client 20.251.200.74:41557] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mh.php"] [unique_id "acNP49pZ2T15NDqzAjERawAAAk0"]
[Wed Mar 25 11:00:53.202812 2026] [:error] [pid 47946:tid 47967] [client 20.251.200.74:60139] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mh.php"] [unique_id "acNP5TipQTqBMSeKYhdUqAAAARM"]
[Wed Mar 25 11:00:53.903969 2026] [:error] [pid 26449:tid 26473] [client 20.251.200.74:2790] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/mh.php"] [unique_id "acNP5dpZ2T15NDqzAjERdQAAAlQ"]
[Wed Mar 25 11:00:54.680874 2026] [:error] [pid 26449:tid 26464] [client 20.251.200.74:60157] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acNP5tpZ2T15NDqzAjERfAAAAks"]
[Wed Mar 25 11:00:55.274034 2026] [:error] [pid 892:tid 901] [client 20.251.200.74:38548] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acNP5yT_G8WMU3T3yxpzdAAAAMQ"]
[Wed Mar 25 11:00:56.121947 2026] [:error] [pid 26449:tid 26458] [client 20.251.200.74:2579] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acNP6NpZ2T15NDqzAjERhgAAAkU"]
[Wed Mar 25 11:00:56.771216 2026] [:error] [pid 26449:tid 26459] [client 20.251.200.74:47821] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acNP6NpZ2T15NDqzAjERjQAAAkY"]
[Wed Mar 25 11:00:57.304125 2026] [:error] [pid 26449:tid 26458] [client 20.251.200.74:36599] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "acNP6dpZ2T15NDqzAjERkgAAAkU"]
[Wed Mar 25 11:00:58.437585 2026] [:error] [pid 756:tid 860] [client 20.251.200.74:29346] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "acNP6jOaW6oylMIDBCT1kwAAAIg"]
[Wed Mar 25 11:00:59.207460 2026] [:error] [pid 47989:tid 47993] [client 20.251.200.74:36587] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "acNP6yWKdJMhIccROjn0vgAAAUI"]
[Wed Mar 25 11:00:59.862638 2026] [:error] [pid 892:tid 908] [client 20.251.200.74:2744] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file.php"] [unique_id "acNP6yT_G8WMU3T3yxpzdQAAAMo"]
[Wed Mar 25 11:01:00.649559 2026] [:error] [pid 26449:tid 26470] [client 20.251.200.74:62796] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "acNP7NpZ2T15NDqzAjERnAAAAlE"]
[Wed Mar 25 11:01:01.395374 2026] [:error] [pid 47946:tid 47954] [client 20.251.200.74:47845] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/as.php"] [unique_id "acNP7TipQTqBMSeKYhdUrwAAAQY"]
[Wed Mar 25 11:01:02.181268 2026] [:error] [pid 47989:tid 47994] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Mar 25 11:01:02.445912 2026] [:error] [pid 47989:tid 47996] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Mar 25 11:01:02.723632 2026] [:error] [pid 47989:tid 48006] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Wed Mar 25 11:01:02.997472 2026] [:error] [pid 47989:tid 47991] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Wed Mar 25 11:01:03.260773 2026] [:error] [pid 47989:tid 48011] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Wed Mar 25 11:01:03.560469 2026] [:error] [pid 47989:tid 47995] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Wed Mar 25 11:01:03.824050 2026] [:error] [pid 47989:tid 48005] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Wed Mar 25 11:01:04.109557 2026] [:error] [pid 47989:tid 47999] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Wed Mar 25 11:01:04.372885 2026] [:error] [pid 47989:tid 48008] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Wed Mar 25 11:01:04.832086 2026] [:error] [pid 47989:tid 48001] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Mar 25 11:01:05.143993 2026] [:error] [pid 47989:tid 47998] [client 20.251.200.74:61467] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Wed Mar 25 11:01:05.429596 2026] [:error] [pid 47989:tid 47998] [client 20.251.200.74:61467] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acNP8SWKdJMhIccROjn0zQAAAUc"]
[Wed Mar 25 11:01:06.400315 2026] [:error] [pid 26449:tid 26463] [client 20.251.200.74:59471] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acNP8tpZ2T15NDqzAjERqwAAAko"]
[Wed Mar 25 11:01:07.354599 2026] [:error] [pid 26449:tid 26477] [client 20.251.200.74:2742] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acNP89pZ2T15NDqzAjERsQAAAlg"]
[Wed Mar 25 11:01:08.851908 2026] [:error] [pid 47989:tid 48012] [client 20.251.200.74:57269] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acNP9CWKdJMhIccROjn01AAAAVU"]
[Wed Mar 25 11:01:10.309294 2026] [:error] [pid 26449:tid 26456] [client 20.251.200.74:31112] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acNP9tpZ2T15NDqzAjERtQAAAkM"]
[Wed Mar 25 11:01:11.661785 2026] [:error] [pid 756:tid 872] [client 20.251.200.74:31166] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acNP9zOaW6oylMIDBCT1pAAAAJQ"]
[Wed Mar 25 11:01:13.016291 2026] [:error] [pid 47946:tid 47950] [client 20.251.200.74:25841] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acNP-TipQTqBMSeKYhdUuAAAAQI"]
[Wed Mar 25 11:01:13.800146 2026] [:error] [pid 26449:tid 26468] [client 20.251.200.74:33549] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acNP-dpZ2T15NDqzAjERwQAAAk8"]
[Wed Mar 25 11:01:14.738421 2026] [:error] [pid 755:tid 842] [client 20.251.200.74:26468] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t.php"] [unique_id "acNP-qS6bdaeEwgCGwplHgAAAFM"]
[Wed Mar 25 11:01:16.730824 2026] [:error] [pid 756:tid 861] [client 20.251.200.74:2328] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t.php"] [unique_id "acNP_DOaW6oylMIDBCT1pgAAAIk"]
[Wed Mar 25 11:01:17.602833 2026] [:error] [pid 47946:tid 47971] [client 20.251.200.74:44569] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t.php"] [unique_id "acNP_TipQTqBMSeKYhdUyAAAARc"]
[Wed Mar 25 11:01:18.221450 2026] [:error] [pid 754:tid 783] [client 20.251.200.74:33536] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t.php"] [unique_id "acNP_jisL3asPbA3CtjhIQAAABI"]
[Wed Mar 25 11:01:19.491883 2026] [:error] [pid 26449:tid 26474] [client 20.251.200.74:51945] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acNP_9pZ2T15NDqzAjERzAAAAlU"]
[Wed Mar 25 11:01:20.534310 2026] [:error] [pid 47946:tid 47967] [client 20.251.200.74:33639] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acNQADipQTqBMSeKYhdU0QAAARM"]
[Wed Mar 25 11:01:21.737136 2026] [:error] [pid 47946:tid 47957] [client 20.251.200.74:40297] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acNQATipQTqBMSeKYhdU3AAAAQk"]
[Wed Mar 25 11:01:26.194501 2026] [:error] [pid 756:tid 852] [client 20.251.200.74:53923] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acNQBjOaW6oylMIDBCT10gAAAII"]
[Wed Mar 25 11:01:27.758585 2026] [:error] [pid 47946:tid 47955] [client 20.251.200.74:51911] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "acNQBzipQTqBMSeKYhdU7QAAAQc"]
[Wed Mar 25 11:01:30.499109 2026] [:error] [pid 892:tid 899] [client 20.251.200.74:60163] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "acNQCiT_G8WMU3T3yxpzkwAAAMM"]
[Wed Mar 25 11:01:34.655302 2026] [:error] [pid 26449:tid 26468] [client 20.251.200.74:46977] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "acNQDtpZ2T15NDqzAjER9AAAAk8"]
[Wed Mar 25 11:01:37.599273 2026] [:error] [pid 756:tid 871] [client 20.251.200.74:27088] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/166.php"] [unique_id "acNQETOaW6oylMIDBCT13wAAAJM"]
[Wed Mar 25 11:01:39.544688 2026] [:error] [pid 26449:tid 26470] [client 20.251.200.74:47001] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "acNQE9pZ2T15NDqzAjER-wAAAlE"]
[Wed Mar 25 11:01:40.263126 2026] [:error] [pid 26449:tid 26461] [client 20.251.200.74:27073] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "acNQFNpZ2T15NDqzAjER_wAAAkg"]
[Wed Mar 25 11:01:42.041223 2026] [:error] [pid 47989:tid 48002] [client 20.251.200.74:63389] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "acNQFiWKdJMhIccROjn1JwAAAUs"]
[Wed Mar 25 11:01:44.316194 2026] [:error] [pid 754:tid 770] [client 20.251.200.74:56179] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "acNQGDisL3asPbA3CtjhJQAAAAU"]
[Wed Mar 25 11:01:49.923606 2026] [:error] [pid 754:tid 784] [client 20.251.200.74:48346] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tool.php"] [unique_id "acNQHTisL3asPbA3CtjhKQAAABM"]
[Wed Mar 25 11:01:56.480783 2026] [:error] [pid 26449:tid 26453] [client 20.251.200.74:2901] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tool.php"] [unique_id "acNQJNpZ2T15NDqzAjESEwAAAkA"]
[Wed Mar 25 11:02:17.421527 2026] [:error] [pid 47946:tid 47963] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Wed Mar 25 11:02:17.960156 2026] [:error] [pid 47946:tid 47949] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Wed Mar 25 11:02:18.223795 2026] [:error] [pid 47946:tid 47950] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Wed Mar 25 11:02:18.486133 2026] [:error] [pid 47946:tid 47967] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Wed Mar 25 11:02:18.749846 2026] [:error] [pid 47946:tid 47970] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Wed Mar 25 11:02:19.047680 2026] [:error] [pid 47946:tid 47951] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Wed Mar 25 11:02:19.321563 2026] [:error] [pid 47946:tid 47954] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Wed Mar 25 11:02:19.584391 2026] [:error] [pid 47946:tid 47956] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Mar 25 11:02:19.847532 2026] [:error] [pid 47946:tid 47957] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Wed Mar 25 11:02:20.122985 2026] [:error] [pid 47946:tid 47972] [client 20.251.200.74:29921] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Wed Mar 25 11:02:20.408006 2026] [:error] [pid 47946:tid 47969] [client 20.251.200.74:29921] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jga.php"] [unique_id "acNQPDipQTqBMSeKYhdVVwAAARU"]
[Wed Mar 25 11:02:21.519486 2026] [:error] [pid 756:tid 872] [client 20.251.200.74:50904] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jga.php"] [unique_id "acNQPTOaW6oylMIDBCT2CAAAAJQ"]
[Wed Mar 25 11:02:23.507425 2026] [:error] [pid 892:tid 904] [client 20.251.200.74:56141] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jga.php"] [unique_id "acNQPyT_G8WMU3T3yxpzyQAAAMY"]
[Wed Mar 25 11:02:24.547375 2026] [:error] [pid 754:tid 765] [client 20.251.200.74:23292] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jga.php"] [unique_id "acNQQDisL3asPbA3CtjhMQAAAAA"]
[Wed Mar 25 11:02:25.506811 2026] [:error] [pid 47946:tid 47953] [client 20.251.200.74:61387] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acNQQTipQTqBMSeKYhdVWAAAAQU"]
[Wed Mar 25 11:02:27.122289 2026] [:error] [pid 47989:tid 48007] [client 20.251.200.74:23290] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acNQQyWKdJMhIccROjn1TwAAAVA"]
[Wed Mar 25 11:02:28.168065 2026] [:error] [pid 26449:tid 26473] [client 20.251.200.74:48306] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acNQRNpZ2T15NDqzAjESRwAAAlQ"]
[Wed Mar 25 11:02:29.670636 2026] [:error] [pid 47989:tid 48002] [client 20.251.200.74:32474] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acNQRSWKdJMhIccROjn1VgAAAUs"]
[Wed Mar 25 11:02:30.793104 2026] [:error] [pid 26449:tid 26454] [client 20.251.200.74:55613] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acNQRtpZ2T15NDqzAjESTAAAAkE"]
[Wed Mar 25 11:02:31.552177 2026] [:error] [pid 26449:tid 26477] [client 20.251.200.74:32509] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acNQR9pZ2T15NDqzAjESTgAAAlg"]
[Wed Mar 25 11:02:32.338880 2026] [:error] [pid 892:tid 913] [client 20.251.200.74:56160] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acNQSCT_G8WMU3T3yxpzzgAAAM8"]
[Wed Mar 25 11:02:33.015194 2026] [:error] [pid 47946:tid 47955] [client 20.251.200.74:29892] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acNQSTipQTqBMSeKYhdVWwAAAQc"]
[Wed Mar 25 11:02:34.615832 2026] [:error] [pid 26320:tid 26367] [client 20.251.200.74:50905] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "acNQSjkUgS2mHAojGnmJwQAAAcs"]
[Wed Mar 25 11:02:36.965282 2026] [:error] [pid 26321:tid 26348] [client 20.251.200.74:55584] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "acNQTPKO65qqGZCSPZrOuwAAAgc"]
[Wed Mar 25 11:02:42.608470 2026] [:error] [pid 26449:tid 26459] [client 20.251.200.74:61422] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "acNQUtpZ2T15NDqzAjESZQAAAkY"]
[Wed Mar 25 11:02:44.110059 2026] [:error] [pid 756:tid 858] [client 20.251.200.74:57728] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "acNQVDOaW6oylMIDBCT2GAAAAIY"]
[Wed Mar 25 11:02:46.701811 2026] [:error] [pid 26321:tid 26344] [client 20.251.200.74:23265] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws85.php"] [unique_id "acNQVvKO65qqGZCSPZrOwwAAAgU"]
[Wed Mar 25 11:02:47.981410 2026] [:error] [pid 47989:tid 48015] [client 20.251.200.74:2845] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws85.php"] [unique_id "acNQVyWKdJMhIccROjn1ZwAAAVg"]
[Wed Mar 25 11:02:49.020571 2026] [:error] [pid 47946:tid 47960] [client 20.251.200.74:42746] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws85.php"] [unique_id "acNQWTipQTqBMSeKYhdVdgAAAQw"]
[Wed Mar 25 11:02:49.852573 2026] [:error] [pid 47946:tid 47948] [client 20.251.200.74:24476] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws85.php"] [unique_id "acNQWTipQTqBMSeKYhdVewAAAQA"]
[Wed Mar 25 11:02:50.436422 2026] [:error] [pid 47946:tid 47958] [client 20.251.200.74:32489] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/file.php"] [unique_id "acNQWjipQTqBMSeKYhdVfAAAAQo"]
[Wed Mar 25 11:02:51.054894 2026] [:error] [pid 26321:tid 26353] [client 20.251.200.74:2388] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/file.php"] [unique_id "acNQW_KO65qqGZCSPZrOyQAAAgw"]
[Wed Mar 25 11:02:51.633292 2026] [:error] [pid 26320:tid 26337] [client 20.251.200.74:61423] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/file.php"] [unique_id "acNQWzkUgS2mHAojGnmJxQAAAcg"]
[Wed Mar 25 11:02:52.405249 2026] [:error] [pid 26449:tid 26461] [client 20.251.200.74:50921] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/file.php"] [unique_id "acNQXNpZ2T15NDqzAjESdwAAAkg"]
[Wed Mar 25 11:02:53.356104 2026] [:error] [pid 47989:tid 47997] [client 20.251.200.74:63329] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/buc.php"] [unique_id "acNQXSWKdJMhIccROjn1cQAAAUY"]
[Wed Mar 25 11:02:53.965378 2026] [:error] [pid 26321:tid 26339] [client 20.251.200.74:32502] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/buc.php"] [unique_id "acNQXfKO65qqGZCSPZrOzwAAAgA"]
[Wed Mar 25 11:02:54.748033 2026] [:error] [pid 47946:tid 47963] [client 20.251.200.74:23248] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/buc.php"] [unique_id "acNQXjipQTqBMSeKYhdVhQAAAQ8"]
[Wed Mar 25 11:02:55.370033 2026] [:error] [pid 26449:tid 26453] [client 20.251.200.74:24454] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/buc.php"] [unique_id "acNQX9pZ2T15NDqzAjESfgAAAkA"]
[Wed Mar 25 11:02:56.330568 2026] [:error] [pid 756:tid 862] [client 20.251.200.74:61421] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws84.php"] [unique_id "acNQYDOaW6oylMIDBCT2HwAAAIo"]
[Wed Mar 25 11:02:57.311742 2026] [:error] [pid 47989:tid 47994] [client 20.251.200.74:55599] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws84.php"] [unique_id "acNQYSWKdJMhIccROjn1egAAAUM"]
[Wed Mar 25 11:02:58.279073 2026] [:error] [pid 26449:tid 26468] [client 20.251.200.74:24493] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws84.php"] [unique_id "acNQYtpZ2T15NDqzAjESggAAAk8"]
[Wed Mar 25 11:02:59.387287 2026] [:error] [pid 26449:tid 26469] [client 20.251.200.74:23271] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws84.php"] [unique_id "acNQY9pZ2T15NDqzAjEShgAAAlA"]
[Wed Mar 25 11:03:00.486811 2026] [:error] [pid 26449:tid 26459] [client 20.251.200.74:2868] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acNQZNpZ2T15NDqzAjESjQAAAkY"]
[Wed Mar 25 11:03:01.126750 2026] [:error] [pid 47989:tid 47997] [client 20.251.200.74:55573] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acNQZSWKdJMhIccROjn1jQAAAUY"]
[Wed Mar 25 11:03:01.836041 2026] [:error] [pid 26449:tid 26457] [client 20.251.200.74:24470] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acNQZdpZ2T15NDqzAjESkAAAAkQ"]
[Wed Mar 25 11:03:02.462893 2026] [:error] [pid 47989:tid 48015] [client 20.251.200.74:2424] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acNQZiWKdJMhIccROjn1kwAAAVg"]
[Wed Mar 25 11:03:03.325250 2026] [:error] [pid 47989:tid 48012] [client 20.251.200.74:61382] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acNQZyWKdJMhIccROjn1mAAAAVU"]
[Wed Mar 25 11:03:04.367329 2026] [:error] [pid 26449:tid 26470] [client 20.251.200.74:2398] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acNQaNpZ2T15NDqzAjESmgAAAlE"]
[Wed Mar 25 11:03:05.390532 2026] [:error] [pid 26449:tid 26473] [client 20.251.200.74:2827] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acNQadpZ2T15NDqzAjESnwAAAlQ"]
[Wed Mar 25 11:03:06.595172 2026] [:error] [pid 47989:tid 47992] [client 20.251.200.74:23238] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acNQaiWKdJMhIccROjn1ogAAAUE"]
[Wed Mar 25 11:03:08.023397 2026] [:error] [pid 26321:tid 26353] [client 20.251.200.74:32468] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abc.php"] [unique_id "acNQbPKO65qqGZCSPZrO0wAAAgw"]
[Wed Mar 25 11:03:09.490461 2026] [:error] [pid 47989:tid 48015] [client 20.251.200.74:57736] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abc.php"] [unique_id "acNQbSWKdJMhIccROjn1rgAAAVg"]
[Wed Mar 25 11:03:10.775693 2026] [:error] [pid 47946:tid 47964] [client 20.251.200.74:55560] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abc.php"] [unique_id "acNQbjipQTqBMSeKYhdVkAAAARA"]
[Wed Mar 25 11:03:13.655803 2026] [:error] [pid 26449:tid 26476] [client 20.251.200.74:23244] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abc.php"] [unique_id "acNQcdpZ2T15NDqzAjESrAAAAlc"]
[Wed Mar 25 11:03:23.980090 2026] [:error] [pid 47989:tid 48000] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Wed Mar 25 11:03:24.241010 2026] [:error] [pid 47989:tid 48007] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Wed Mar 25 11:03:24.514676 2026] [:error] [pid 47989:tid 48015] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/ws49.php
[Wed Mar 25 11:03:24.777430 2026] [:error] [pid 47989:tid 48013] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Wed Mar 25 11:03:25.041707 2026] [:error] [pid 47989:tid 47996] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Mar 25 11:03:25.303828 2026] [:error] [pid 47989:tid 48012] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Wed Mar 25 11:03:25.585684 2026] [:error] [pid 47989:tid 47994] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Wed Mar 25 11:03:26.886276 2026] [:error] [pid 47989:tid 47994] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Wed Mar 25 11:03:27.331110 2026] [:error] [pid 47989:tid 47993] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Wed Mar 25 11:03:27.613136 2026] [:error] [pid 47989:tid 48002] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Wed Mar 25 11:03:27.875267 2026] [:error] [pid 47989:tid 48014] [client 20.251.200.74:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Wed Mar 25 11:03:28.145178 2026] [:error] [pid 47989:tid 48000] [client 20.251.200.74:32511] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/asd.php"] [unique_id "acNQgCWKdJMhIccROjn10gAAAUk"]
[Wed Mar 25 11:03:30.467749 2026] [:error] [pid 47946:tid 47970] [client 20.251.200.74:32505] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/asd.php"] [unique_id "acNQgjipQTqBMSeKYhdVrwAAARY"]
[Wed Mar 25 11:03:31.592853 2026] [:error] [pid 754:tid 773] [client 20.251.200.74:57755] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/asd.php"] [unique_id "acNQgzisL3asPbA3CtjhPQAAAAg"]
[Wed Mar 25 11:03:32.695785 2026] [:error] [pid 47989:tid 48003] [client 20.251.200.74:50917] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/asd.php"] [unique_id "acNQhCWKdJMhIccROjn12AAAAUw"]
[Wed Mar 25 11:03:33.590572 2026] [:error] [pid 26449:tid 26468] [client 20.251.200.74:61384] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byypas.php"] [unique_id "acNQhdpZ2T15NDqzAjES3AAAAk8"]
[Wed Mar 25 11:03:34.591629 2026] [:error] [pid 756:tid 859] [client 20.251.200.74:42734] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byypas.php"] [unique_id "acNQhjOaW6oylMIDBCT2LgAAAIc"]
[Wed Mar 25 11:03:36.371975 2026] [:error] [pid 26449:tid 26472] [client 20.251.200.74:50895] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byypas.php"] [unique_id "acNQiNpZ2T15NDqzAjES3wAAAlM"]
[Wed Mar 25 11:03:37.496848 2026] [:error] [pid 756:tid 865] [client 20.251.200.74:24458] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byypas.php"] [unique_id "acNQiTOaW6oylMIDBCT2MwAAAI0"]
[Wed Mar 25 11:03:38.203700 2026] [:error] [pid 892:tid 923] [client 20.251.200.74:24506] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "acNQiiT_G8WMU3T3yxpz9wAAANg"]
[Wed Mar 25 11:03:38.924268 2026] [:error] [pid 47989:tid 48012] [client 20.251.200.74:28759] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "acNQiiWKdJMhIccROjn12wAAAVU"]
[Wed Mar 25 11:03:40.108177 2026] [:error] [pid 47989:tid 48004] [client 20.251.200.74:42710] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "acNQjCWKdJMhIccROjn15gAAAU0"]
[Wed Mar 25 11:03:41.024256 2026] [:error] [pid 756:tid 852] [client 20.251.200.74:61412] [client 20.251.200.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "acNQjTOaW6oylMIDBCT2OAAAAII"]
[Wed Mar 25 14:24:59.690293 2026] [:error] [pid 25875:tid 25891] [client 173.239.240.139:62529] [client 173.239.240.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.139, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "acN_uxJ38QkS3Nyfshyb-AAAAoo"]
[Wed Mar 25 14:24:59.693875 2026] [:error] [pid 25875:tid 25891] [client 173.239.240.139:62529] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 25 15:52:47.474968 2026] [:error] [pid 47989:tid 48003] [client 110.38.248.183:62972] [client 110.38.248.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.38.248.183, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acOUTyWKdJMhIccROjleQQAAAUw"]
[Wed Mar 25 15:52:47.479633 2026] [:error] [pid 47989:tid 48003] [client 110.38.248.183:62972] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 25 15:54:14.537291 2026] [:error] [pid 26269:tid 26280] [client 92.40.172.71:40223] [client 92.40.172.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.40.172.71, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acOUpkn7e-ZQbaIs7qymcQAAAYQ"]
[Wed Mar 25 15:54:14.542784 2026] [:error] [pid 26269:tid 26280] [client 92.40.172.71:40223] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 25 16:37:04.621591 2026] [:error] [pid 25967:tid 25989] [client 20.63.97.61:49697] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 25 16:37:04.828422 2026] [:error] [pid 25967:tid 25972] [client 20.63.97.61:49697] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 25 16:37:05.247384 2026] [:error] [pid 25967:tid 25978] [client 20.63.97.61:49697] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Wed Mar 25 16:37:05.456357 2026] [:error] [pid 25967:tid 25995] [client 20.63.97.61:49697] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 25 16:37:05.884461 2026] [:error] [pid 25967:tid 25975] [client 20.63.97.61:49697] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Mar 25 16:37:06.093373 2026] [:error] [pid 25967:tid 25985] [client 20.63.97.61:49697] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Mar 25 16:37:06.301886 2026] [:error] [pid 25967:tid 25992] [client 20.63.97.61:49697] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Wed Mar 25 16:37:06.717853 2026] [:error] [pid 25967:tid 25981] [client 20.63.97.61:49697] [client 20.63.97.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acOesvg8Qtq7ZM4mSFkPKQAAA0k"]
[Wed Mar 25 16:37:07.554246 2026] [:error] [pid 25875:tid 25884] [client 20.63.97.61:49701] [client 20.63.97.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acOesxJ38QkS3NyfshzAygAAAoM"]
[Wed Mar 25 16:37:08.381782 2026] [:error] [pid 26321:tid 26351] [client 20.63.97.61:49706] [client 20.63.97.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acOetPKO65qqGZCSPZofEwAAAgo"]
[Wed Mar 25 16:37:09.212545 2026] [:error] [pid 25969:tid 26043] [client 20.63.97.61:49665] [client 20.63.97.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acOetRd3aEUmOfdKja_2dgAAA9E"]
[Wed Mar 25 17:37:34.061380 2026] [:error] [pid 26321:tid 26356] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/tx22.php
[Wed Mar 25 17:37:34.320967 2026] [:error] [pid 26321:tid 26365] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Mar 25 17:37:35.096747 2026] [:error] [pid 26321:tid 26354] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/lfm.php
[Wed Mar 25 17:37:35.354694 2026] [:error] [pid 26321:tid 26355] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/abca.php
[Wed Mar 25 17:37:35.612797 2026] [:error] [pid 26321:tid 26349] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Wed Mar 25 17:37:35.872206 2026] [:error] [pid 26321:tid 26339] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Wed Mar 25 17:37:36.130304 2026] [:error] [pid 26321:tid 26362] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2024.php
[Wed Mar 25 17:37:36.391155 2026] [:error] [pid 26321:tid 26343] [client 74.248.130.23:41293] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Wed Mar 25 17:37:36.647344 2026] [:error] [pid 26321:tid 26363] [client 74.248.130.23:41293] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acOs4PKO65qqGZCSPZoqlwAAAhY"]
[Wed Mar 25 17:37:37.159993 2026] [:error] [pid 47946:tid 47967] [client 74.248.130.23:41587] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acOs4TipQTqBMSeKYhd8JAAAARM"]
[Wed Mar 25 17:37:37.669015 2026] [:error] [pid 26269:tid 26292] [client 74.248.130.23:41658] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acOs4Un7e-ZQbaIs7qyvFgAAAZA"]
[Wed Mar 25 17:37:38.177518 2026] [:error] [pid 26449:tid 26468] [client 74.248.130.23:41554] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acOs4tpZ2T15NDqzAjFnlgAAAk8"]
[Wed Mar 25 17:37:38.690745 2026] [:error] [pid 25967:tid 25985] [client 74.248.130.23:41631] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fde.php"] [unique_id "acOs4vg8Qtq7ZM4mSFkk1wAAA00"]
[Wed Mar 25 18:27:52.353669 2026] [:error] [pid 26449:tid 26477] [client 20.220.197.73:44436] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Mar 25 18:27:52.770643 2026] [:error] [pid 26449:tid 26459] [client 20.220.197.73:44436] [client 20.220.197.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.197.73, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acO4qNpZ2T15NDqzAjFu8gAAAkY"]
[Wed Mar 25 18:27:52.983481 2026] [:error] [pid 26449:tid 26457] [client 20.220.197.73:44436] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Wed Mar 25 18:27:53.851429 2026] [:error] [pid 26449:tid 26473] [client 20.220.197.73:44436] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Wed Mar 25 18:27:54.501831 2026] [:error] [pid 26449:tid 26466] [client 20.220.197.73:44436] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Mar 25 18:27:54.707705 2026] [:error] [pid 26449:tid 26474] [client 20.220.197.73:44436] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acO4qtpZ2T15NDqzAjFu-wAAAlU"]
[Wed Mar 25 18:27:55.541274 2026] [:error] [pid 25967:tid 25991] [client 20.220.197.73:44118] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acO4q_g8Qtq7ZM4mSFk5tQAAA1M"]
[Wed Mar 25 18:27:56.369858 2026] [:error] [pid 26321:tid 26363] [client 20.220.197.73:44125] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acO4rPKO65qqGZCSPZo1VgAAAhY"]
[Wed Mar 25 18:27:57.219984 2026] [:error] [pid 26321:tid 26364] [client 20.220.197.73:44077] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acO4rfKO65qqGZCSPZo1WAAAAhc"]
[Wed Mar 25 20:30:15.618741 2026] [:error] [pid 25969:tid 26037] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/tx22.php
[Wed Mar 25 20:30:15.884839 2026] [:error] [pid 25969:tid 26046] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Mar 25 20:30:16.685514 2026] [:error] [pid 25969:tid 26041] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/lfm.php
[Wed Mar 25 20:30:16.959423 2026] [:error] [pid 25969:tid 26030] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/abca.php
[Wed Mar 25 20:30:17.226182 2026] [:error] [pid 25969:tid 26042] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Wed Mar 25 20:30:17.492614 2026] [:error] [pid 25969:tid 26043] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Wed Mar 25 20:30:17.759250 2026] [:error] [pid 25969:tid 26029] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2024.php
[Wed Mar 25 20:30:18.026813 2026] [:error] [pid 25969:tid 26038] [client 4.223.157.191:38738] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Wed Mar 25 20:30:18.291260 2026] [:error] [pid 25969:tid 26040] [client 4.223.157.191:38738] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPVWhd3aEUmOfdKja8N-wAAA84"]
[Wed Mar 25 20:30:18.893861 2026] [:error] [pid 25875:tid 25892] [client 4.223.157.191:58179] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjde.php"] [unique_id "acPVWhJ38QkS3NyfshwP7gAAAos"]
[Wed Mar 25 20:30:19.432599 2026] [:error] [pid 892:tid 909] [client 4.223.157.191:47968] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjde.php"] [unique_id "acPVWyT_G8WMU3T3yxrXyAAAAMs"]
[Wed Mar 25 20:30:20.020252 2026] [:error] [pid 47989:tid 48002] [client 4.223.157.191:38732] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjde.php"] [unique_id "acPVXCWKdJMhIccROjntpAAAAUs"]
[Wed Mar 25 20:30:20.589751 2026] [:error] [pid 26449:tid 26464] [client 4.223.157.191:33516] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjde.php"] [unique_id "acPVXNpZ2T15NDqzAjGBygAAAks"]
[Wed Mar 25 20:30:21.119984 2026] [:error] [pid 26321:tid 26349] [client 4.223.157.191:22205] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gin.php"] [unique_id "acPVXfKO65qqGZCSPZpSewAAAgg"]
[Wed Mar 25 20:30:21.652872 2026] [:error] [pid 25875:tid 25882] [client 4.223.157.191:52570] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPVXRJ38QkS3NyfshwP8wAAAoE"]
[Wed Mar 25 20:30:22.176653 2026] [:error] [pid 25875:tid 25901] [client 4.223.157.191:47959] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPVXhJ38QkS3NyfshwP9QAAApQ"]
[Wed Mar 25 20:30:22.702701 2026] [:error] [pid 26449:tid 26462] [client 4.223.157.191:38780] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPVXtpZ2T15NDqzAjGBywAAAkk"]
[Wed Mar 25 20:30:23.228974 2026] [:error] [pid 26449:tid 26455] [client 4.223.157.191:33478] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPVX9pZ2T15NDqzAjGBzQAAAkI"]
[Wed Mar 25 20:30:23.801552 2026] [:error] [pid 25967:tid 25974] [client 4.223.157.191:63123] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPVX_g8Qtq7ZM4mSFllYgAAA0I"]
[Wed Mar 25 20:30:24.382406 2026] [:error] [pid 25875:tid 25890] [client 4.223.157.191:23708] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPVYBJ38QkS3NyfshwP-wAAAok"]
[Wed Mar 25 20:30:24.906963 2026] [:error] [pid 25875:tid 25891] [client 4.223.157.191:31992] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPVYBJ38QkS3NyfshwP_wAAAoo"]
[Wed Mar 25 20:30:25.435729 2026] [:error] [pid 26321:tid 26341] [client 4.223.157.191:52569] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPVYfKO65qqGZCSPZpSfwAAAgI"]
[Wed Mar 25 21:30:52.631892 2026] [:error] [pid 25875:tid 25899] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/tx22.php
[Wed Mar 25 21:30:52.873927 2026] [:error] [pid 25875:tid 25882] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Mar 25 21:30:53.599974 2026] [:error] [pid 25875:tid 25893] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/lfm.php
[Wed Mar 25 21:30:53.845048 2026] [:error] [pid 25875:tid 25897] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/abca.php
[Wed Mar 25 21:30:54.087118 2026] [:error] [pid 25875:tid 25896] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Wed Mar 25 21:30:54.328729 2026] [:error] [pid 25875:tid 25885] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Wed Mar 25 21:30:54.575051 2026] [:error] [pid 25875:tid 25894] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2024.php
[Wed Mar 25 21:30:54.819738 2026] [:error] [pid 25875:tid 25898] [client 68.221.133.183:20993] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Wed Mar 25 21:30:55.058160 2026] [:error] [pid 25875:tid 25881] [client 68.221.133.183:20993] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPjjxJ38QkS3NyfshwqDwAAAoA"]
[Wed Mar 25 21:30:55.542005 2026] [:error] [pid 26449:tid 26464] [client 68.221.133.183:28553] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPjj9pZ2T15NDqzAjGKlAAAAks"]
[Wed Mar 25 21:30:56.029974 2026] [:error] [pid 26449:tid 26457] [client 68.221.133.183:34146] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPjkNpZ2T15NDqzAjGKlgAAAkQ"]
[Wed Mar 25 21:30:56.513193 2026] [:error] [pid 47989:tid 47991] [client 68.221.133.183:43321] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPjkCWKdJMhIccROjkA8gAAAUA"]
[Wed Mar 25 21:30:57.000254 2026] [:error] [pid 47989:tid 48000] [client 68.221.133.183:30595] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fde.php"] [unique_id "acPjkCWKdJMhIccROjkA9AAAAUk"]
[Wed Mar 25 21:30:57.477692 2026] [:error] [pid 47989:tid 48015] [client 68.221.133.183:54556] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fde.php"] [unique_id "acPjkSWKdJMhIccROjkA9QAAAVg"]
[Wed Mar 25 21:30:57.970624 2026] [:error] [pid 47989:tid 48013] [client 68.221.133.183:24152] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPjkSWKdJMhIccROjkA9wAAAVY"]
[Wed Mar 25 21:30:58.448777 2026] [:error] [pid 47989:tid 47997] [client 68.221.133.183:24546] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPjkiWKdJMhIccROjkA-QAAAUY"]
[Wed Mar 25 21:30:58.931136 2026] [:error] [pid 47989:tid 47998] [client 68.221.133.183:21770] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPjkiWKdJMhIccROjkA-wAAAUc"]
[Wed Mar 25 21:30:59.423801 2026] [:error] [pid 892:tid 912] [client 68.221.133.183:48935] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPjkyT_G8WMU3T3yxre0wAAAM4"]
[Wed Mar 25 21:30:59.913216 2026] [:error] [pid 892:tid 920] [client 68.221.133.183:63753] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0rg.php"] [unique_id "acPjkyT_G8WMU3T3yxre1gAAANU"]
[Wed Mar 25 21:31:00.391172 2026] [:error] [pid 47989:tid 47992] [client 68.221.133.183:24161] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0rg.php"] [unique_id "acPjlCWKdJMhIccROjkA_gAAAUE"]
[Wed Mar 25 21:31:00.869981 2026] [:error] [pid 25967:tid 25987] [client 68.221.133.183:34138] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0rg.php"] [unique_id "acPjlPg8Qtq7ZM4mSFlzMgAAA08"]
[Wed Mar 25 21:31:01.347855 2026] [:error] [pid 25875:tid 25899] [client 68.221.133.183:54582] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0rg.php"] [unique_id "acPjlRJ38QkS3NyfshwqEQAAApI"]
[Wed Mar 25 21:31:01.849553 2026] [:error] [pid 25969:tid 26026] [client 68.221.133.183:63807] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPjlRd3aEUmOfdKja8TiQAAA8A"]
[Wed Mar 25 21:31:02.332084 2026] [:error] [pid 756:tid 851] [client 68.221.133.183:48919] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPjljOaW6oylMIDBCQlrAAAAIE"]
[Wed Mar 25 21:31:02.812575 2026] [:error] [pid 25875:tid 25890] [client 68.221.133.183:3789] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPjlhJ38QkS3NyfshwqEwAAAok"]
[Wed Mar 25 21:31:03.292825 2026] [:error] [pid 25875:tid 25883] [client 68.221.133.183:21778] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dk.php"] [unique_id "acPjlxJ38QkS3NyfshwqFQAAAoI"]
[Wed Mar 25 21:31:03.773383 2026] [:error] [pid 25875:tid 25898] [client 68.221.133.183:24564] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPjlxJ38QkS3NyfshwqFwAAApE"]
[Wed Mar 25 21:31:04.264380 2026] [:error] [pid 756:tid 850] [client 68.221.133.183:63802] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPjmDOaW6oylMIDBCQlrQAAAIA"]
[Wed Mar 25 21:31:04.745855 2026] [:error] [pid 25875:tid 25901] [client 68.221.133.183:54567] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPjmBJ38QkS3NyfshwqHQAAApQ"]
[Wed Mar 25 21:31:05.223452 2026] [:error] [pid 25969:tid 26041] [client 68.221.133.183:21437] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPjmRd3aEUmOfdKja8TiwAAA88"]
[Wed Mar 25 21:35:52.681432 2026] [:error] [pid 25967:tid 25986] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/tx22.php
[Wed Mar 25 21:35:52.917566 2026] [:error] [pid 25967:tid 25992] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Mar 25 21:35:53.625950 2026] [:error] [pid 25967:tid 25975] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/lfm.php
[Wed Mar 25 21:35:53.859967 2026] [:error] [pid 25967:tid 25980] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/abca.php
[Wed Mar 25 21:35:54.097984 2026] [:error] [pid 25967:tid 25974] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Wed Mar 25 21:35:54.335561 2026] [:error] [pid 25967:tid 25987] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Wed Mar 25 21:35:54.570845 2026] [:error] [pid 25967:tid 25983] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2024.php
[Wed Mar 25 21:35:54.806774 2026] [:error] [pid 25967:tid 25994] [client 72.146.6.194:4867] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Wed Mar 25 21:35:55.039384 2026] [:error] [pid 25967:tid 25972] [client 72.146.6.194:4867] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPku_g8Qtq7ZM4mSFl0vgAAA0A"]
[Wed Mar 25 21:35:55.519738 2026] [:error] [pid 47989:tid 48010] [client 72.146.6.194:4881] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPkuyWKdJMhIccROjkCKwAAAVM"]
[Wed Mar 25 21:35:55.993403 2026] [:error] [pid 47989:tid 48013] [client 72.146.6.194:13401] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPkuyWKdJMhIccROjkCLwAAAVY"]
[Wed Mar 25 21:35:56.460468 2026] [:error] [pid 47989:tid 48012] [client 72.146.6.194:28001] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/AAAA.php"] [unique_id "acPkvCWKdJMhIccROjkCMQAAAVU"]
[Wed Mar 25 21:35:56.940530 2026] [:error] [pid 26449:tid 26469] [client 72.146.6.194:35419] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fde.php"] [unique_id "acPkvNpZ2T15NDqzAjGLUQAAAlA"]
[Wed Mar 25 21:35:57.417461 2026] [:error] [pid 47989:tid 47995] [client 72.146.6.194:27976] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fde.php"] [unique_id "acPkvSWKdJMhIccROjkCNgAAAUQ"]
[Wed Mar 25 21:35:57.883944 2026] [:error] [pid 26321:tid 26359] [client 72.146.6.194:36984] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fde.php"] [unique_id "acPkvfKO65qqGZCSPZpdRgAAAhI"]
[Wed Mar 25 21:35:58.393887 2026] [:error] [pid 25875:tid 25882] [client 72.146.6.194:36164] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mjde.php"] [unique_id "acPkvhJ38QkS3NyfshwsXAAAAoE"]
[Wed Mar 25 21:35:59.016814 2026] [:error] [pid 25875:tid 25904] [client 72.146.6.194:28012] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPkvxJ38QkS3NyfshwsXgAAApc"]
[Wed Mar 25 21:35:59.496534 2026] [:error] [pid 26321:tid 26355] [client 72.146.6.194:36162] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPkv_KO65qqGZCSPZpdSgAAAg4"]
[Wed Mar 25 21:35:59.968525 2026] [:error] [pid 47989:tid 48013] [client 72.146.6.194:36191] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPkvyWKdJMhIccROjkCOQAAAVY"]
[Wed Mar 25 21:36:00.436416 2026] [:error] [pid 25969:tid 26031] [client 72.146.6.194:32002] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bays.php"] [unique_id "acPkwBd3aEUmOfdKja8T9QAAA8U"]
[Wed Mar 25 21:36:00.920122 2026] [:error] [pid 25967:tid 25981] [client 72.146.6.194:32122] [client 72.146.6.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "acPkwPg8Qtq7ZM4mSFl0wQAAA0k"]
[Thu Mar 26 01:22:26.556195 2026] [:error] [pid 32829:tid 32847] [client 180.211.111.230:47207] [client 180.211.111.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.211.111.230, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acQZ0nFEeazI9mYaKszZugAAAFA"]
[Thu Mar 26 01:22:26.562796 2026] [:error] [pid 32829:tid 32847] [client 180.211.111.230:47207] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 26 02:13:01.768753 2026] [:error] [pid 55733:tid 55749] [client 108.165.47.212:38050] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Thu Mar 26 04:41:57.895896 2026] [:error] [pid 19710:tid 19745] [client 167.172.249.13:54852] [client 167.172.249.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.249.13, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "acRIlQVEWP8Ar68Njk55gQAAABc"]
[Thu Mar 26 04:41:57.899668 2026] [:error] [pid 19710:tid 19745] [client 167.172.249.13:54852] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Mar 26 07:12:51.715930 2026] [:error] [pid 19712:tid 19795] [client 192.3.207.218:56675] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/artisan"] [unique_id "acRr89WhKhRNqm23vFPd7AAAAJM"]
[Thu Mar 26 07:12:52.857936 2026] [:error] [pid 19712:tid 19786] [client 192.3.207.218:57120] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/artisan"] [unique_id "acRr9NWhKhRNqm23vFPeBQAAAIo"]
[Thu Mar 26 07:12:53.281682 2026] [:error] [pid 19818:tid 19839] [client 192.3.207.218:57610] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/artisan"] [unique_id "acRr9czaSnm3d1BeM5WNmwAAANM"]
[Thu Mar 26 07:12:54.142041 2026] [:error] [pid 60829:tid 60854] [client 192.3.207.218:57928] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "acRr9vTdjHKeZokybaQpsQAAARc"]
[Thu Mar 26 07:12:54.589203 2026] [:error] [pid 31670:tid 31685] [client 192.3.207.218:58595] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "acRr9jXVthXxCnWjOTQxpAAAAU0"]
[Thu Mar 26 07:12:55.483777 2026] [:error] [pid 19710:tid 19728] [client 192.3.207.218:58954] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "acRr9wVEWP8Ar68Njk6pVgAAAAY"]
[Thu Mar 26 07:12:55.908320 2026] [:error] [pid 31780:tid 31838] [client 192.3.207.218:59951] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.env"] [unique_id "acRr95JDwZsy5O4ZXEiUXAAAAhE"]
[Thu Mar 26 08:16:00.184283 2026] [:error] [pid 31670:tid 31687] [client 70.36.101.5:61228] [client 70.36.101.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.36.101.5, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acR6wDXVthXxCnWjOTRR3AAAAU8"]
[Thu Mar 26 08:16:00.188999 2026] [:error] [pid 31670:tid 31687] [client 70.36.101.5:61228] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 26 08:16:01.950388 2026] [:error] [pid 31670:tid 31691] [client 70.36.101.5:61228] [client 70.36.101.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "acR6wTXVthXxCnWjOTRR7AAAAVM"]
[Thu Mar 26 08:16:02.259312 2026] [:error] [pid 31778:tid 31815] [client 70.36.101.5:62201] [client 70.36.101.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "acR6wg3kybI2o-xasmBPWQAAAdY"]
[Thu Mar 26 08:16:04.061309 2026] [:error] [pid 31670:tid 31683] [client 70.36.101.5:62291] [client 70.36.101.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "acR6xDXVthXxCnWjOTRR7wAAAUs"]
[Thu Mar 26 08:16:06.235895 2026] [:error] [pid 19818:tid 19842] [client 70.36.101.5:62925] [client 70.36.101.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "acR6xszaSnm3d1BeM5WWTwAAANY"]
[Thu Mar 26 08:16:06.545081 2026] [:error] [pid 60829:tid 60847] [client 70.36.101.5:63433] [client 70.36.101.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "acR6xvTdjHKeZokybaQ5wQAAARA"]
[Thu Mar 26 08:16:06.854229 2026] [:error] [pid 31780:tid 31839] [client 70.36.101.5:63512] [client 70.36.101.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "acR6xpJDwZsy5O4ZXEi7ygAAAhI"]
[Thu Mar 26 08:16:07.164854 2026] [:error] [pid 60829:tid 60831] [client 70.36.101.5:63608] [client 70.36.101.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "acR6x_TdjHKeZokybaQ5wwAAAQA"]
[Thu Mar 26 09:55:07.920168 2026] [:error] [pid 19818:tid 19836] [client 20.78.152.237:4195] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Mar 26 09:55:08.047289 2026] [:error] [pid 19818:tid 19841] [client 20.78.152.237:4195] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Mar 26 09:55:08.321352 2026] [:error] [pid 19818:tid 19834] [client 20.78.152.237:4195] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Thu Mar 26 09:55:08.477230 2026] [:error] [pid 19818:tid 19825] [client 20.78.152.237:4195] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Mar 26 09:55:08.727553 2026] [:error] [pid 19818:tid 19842] [client 20.78.152.237:4195] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Thu Mar 26 09:55:08.860285 2026] [:error] [pid 19818:tid 19839] [client 20.78.152.237:4195] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Mar 26 09:55:08.986167 2026] [:error] [pid 19818:tid 19829] [client 20.78.152.237:4195] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Thu Mar 26 09:55:09.394770 2026] [:error] [pid 19818:tid 19833] [client 20.78.152.237:4195] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "acSR_czaSnm3d1BeM5XDhAAAAM0"]
[Thu Mar 26 09:55:09.953878 2026] [:error] [pid 31670:tid 31687] [client 20.78.152.237:4100] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "acSR_TXVthXxCnWjOTSJKwAAAU8"]
[Thu Mar 26 09:55:10.555085 2026] [:error] [pid 31670:tid 31675] [client 20.78.152.237:4116] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "acSR_jXVthXxCnWjOTSJLgAAAUM"]
[Thu Mar 26 09:55:11.144967 2026] [:error] [pid 31778:tid 31797] [client 20.78.152.237:4205] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "acSR_w3kybI2o-xasmBwFgAAAcQ"]
[Thu Mar 26 10:04:11.941928 2026] [:error] [pid 31717:tid 31723] [client 14.188.34.68:26946] [client 14.188.34.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.188.34.68, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acSUG7-SCF7YDISDX4-PDQAAAYE"]
[Thu Mar 26 10:04:11.947527 2026] [:error] [pid 31717:tid 31723] [client 14.188.34.68:26946] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 26 10:43:36.266913 2026] [:error] [pid 31670:tid 31676] [client 195.178.110.187:28290] [client 195.178.110.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "acSdWDXVthXxCnWjOTSecAAAAUQ"]
[Thu Mar 26 12:49:50.536109 2026] [:error] [pid 31670:tid 31686] [client 181.215.182.26:30089] [client 181.215.182.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "acS67jXVthXxCnWjOTTaPQAAAU4"]
[Thu Mar 26 13:09:06.671495 2026] [:error] [pid 31670:tid 31694] [client 197.27.226.189:62015] [client 197.27.226.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.27.226.189, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acS_cjXVthXxCnWjOTTlJgAAAVY"]
[Thu Mar 26 13:09:06.689356 2026] [:error] [pid 31670:tid 31694] [client 197.27.226.189:62015] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 26 19:23:26.853959 2026] [:error] [pid 19711:tid 19771] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Thu Mar 26 19:23:27.112594 2026] [:error] [pid 19711:tid 19768] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/xocx.php
[Thu Mar 26 19:23:27.395588 2026] [:error] [pid 19711:tid 19766] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/sodas.php
[Thu Mar 26 19:23:27.655478 2026] [:error] [pid 19711:tid 19756] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/zaz.php
[Thu Mar 26 19:23:28.039890 2026] [:error] [pid 19711:tid 19765] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Thu Mar 26 19:23:28.366865 2026] [:error] [pid 19711:tid 19757] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/bm.php
[Thu Mar 26 19:23:28.626413 2026] [:error] [pid 19711:tid 19749] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa.php
[Thu Mar 26 19:23:28.906763 2026] [:error] [pid 19711:tid 19767] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/sace.php
[Thu Mar 26 19:23:29.236447 2026] [:error] [pid 19711:tid 19750] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/north1.php
[Thu Mar 26 19:23:29.496526 2026] [:error] [pid 19711:tid 19763] [client 20.215.59.107:62309] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Thu Mar 26 19:23:29.751988 2026] [:error] [pid 19711:tid 19758] [client 20.215.59.107:62309] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acUXMWj3l1y81GYfluSU8AAAAEk"]
[Thu Mar 26 19:23:30.493410 2026] [:error] [pid 60829:tid 60835] [client 20.215.59.107:64961] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acUXMvTdjHKeZokybaTBYQAAAQQ"]
[Thu Mar 26 19:23:31.622603 2026] [:error] [pid 31717:tid 31742] [client 20.215.59.107:64398] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acUXM7-SCF7YDISDX4_mHAAAAZQ"]
[Thu Mar 26 19:23:32.202518 2026] [:error] [pid 31778:tid 31800] [client 20.215.59.107:62326] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acUXNA3kybI2o-xasmADfQAAAcc"]
[Thu Mar 26 19:23:32.820891 2026] [:error] [pid 19818:tid 19821] [client 20.215.59.107:62327] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acUXNMzaSnm3d1BeM5UIoQAAAME"]
[Thu Mar 26 19:23:33.474723 2026] [:error] [pid 19818:tid 19833] [client 20.215.59.107:64414] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acUXNczaSnm3d1BeM5UIpAAAAM0"]
[Thu Mar 26 19:23:34.439723 2026] [:error] [pid 31717:tid 31737] [client 20.215.59.107:64998] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acUXNr-SCF7YDISDX4_mIAAAAY8"]
[Thu Mar 26 19:23:35.886793 2026] [:error] [pid 31717:tid 31723] [client 20.215.59.107:59646] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acUXN7-SCF7YDISDX4_mJgAAAYE"]
[Thu Mar 26 19:23:36.536252 2026] [:error] [pid 19710:tid 19744] [client 20.215.59.107:64446] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUXOAVEWP8Ar68Njk4EPwAAABY"]
[Thu Mar 26 19:23:37.208872 2026] [:error] [pid 31778:tid 31796] [client 20.215.59.107:64430] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUXOQ3kybI2o-xasmADgQAAAcM"]
[Thu Mar 26 19:23:37.806184 2026] [:error] [pid 31778:tid 31794] [client 20.215.59.107:59594] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUXOQ3kybI2o-xasmADgwAAAcE"]
[Thu Mar 26 19:23:38.526350 2026] [:error] [pid 31717:tid 31746] [client 20.215.59.107:65009] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUXOr-SCF7YDISDX4_mKgAAAZg"]
[Thu Mar 26 19:23:39.356696 2026] [:error] [pid 19818:tid 19825] [client 20.215.59.107:64419] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acUXO8zaSnm3d1BeM5UIqQAAAMU"]
[Thu Mar 26 19:23:39.983677 2026] [:error] [pid 31670:tid 31675] [client 20.215.59.107:59630] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acUXOzXVthXxCnWjOTSVowAAAUM"]
[Thu Mar 26 19:23:40.828284 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:56618] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acUXPDXVthXxCnWjOTSVqAAAAUs"]
[Thu Mar 26 19:23:41.496117 2026] [:error] [pid 31670:tid 31692] [client 20.215.59.107:62674] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acUXPTXVthXxCnWjOTSVrQAAAVQ"]
[Thu Mar 26 19:23:42.612505 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:64973] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acUXPjXVthXxCnWjOTSVswAAAVc"]
[Thu Mar 26 19:23:43.377537 2026] [:error] [pid 31778:tid 31812] [client 20.215.59.107:62330] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acUXPw3kybI2o-xasmADiQAAAdM"]
[Thu Mar 26 19:23:43.937873 2026] [:error] [pid 19818:tid 19832] [client 20.215.59.107:59601] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acUXP8zaSnm3d1BeM5UIrQAAAMw"]
[Thu Mar 26 19:23:44.579688 2026] [:error] [pid 19818:tid 19824] [client 20.215.59.107:59622] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acUXQMzaSnm3d1BeM5UIsQAAAMQ"]
[Thu Mar 26 19:23:45.213112 2026] [:error] [pid 19818:tid 19833] [client 20.215.59.107:50235] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acUXQczaSnm3d1BeM5UItgAAAM0"]
[Thu Mar 26 19:23:45.828106 2026] [:error] [pid 31670:tid 31674] [client 20.215.59.107:62685] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acUXQTXVthXxCnWjOTSVvAAAAUI"]
[Thu Mar 26 19:23:46.392883 2026] [:error] [pid 31670:tid 31681] [client 20.215.59.107:62291] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acUXQjXVthXxCnWjOTSVvwAAAUk"]
[Thu Mar 26 19:23:47.389971 2026] [:error] [pid 31780:tid 31836] [client 20.215.59.107:59589] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acUXQ5JDwZsy5O4ZXEijIAAAAg8"]
[Thu Mar 26 19:23:48.082357 2026] [:error] [pid 31778:tid 31816] [client 20.215.59.107:56006] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless13.php"] [unique_id "acUXRA3kybI2o-xasmADiwAAAdc"]
[Thu Mar 26 19:23:48.681997 2026] [:error] [pid 19818:tid 19824] [client 20.215.59.107:62332] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless13.php"] [unique_id "acUXRMzaSnm3d1BeM5UIvwAAAMQ"]
[Thu Mar 26 19:23:49.435148 2026] [:error] [pid 31778:tid 31809] [client 20.215.59.107:53169] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless13.php"] [unique_id "acUXRQ3kybI2o-xasmADjgAAAdA"]
[Thu Mar 26 19:23:50.143902 2026] [:error] [pid 60829:tid 60852] [client 20.215.59.107:62294] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless13.php"] [unique_id "acUXRvTdjHKeZokybaTBcQAAARU"]
[Thu Mar 26 19:23:51.126951 2026] [:error] [pid 31670:tid 31682] [client 20.215.59.107:62317] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "acUXRzXVthXxCnWjOTSVyAAAAUo"]
[Thu Mar 26 19:23:53.757944 2026] [:error] [pid 31778:tid 31797] [client 20.215.59.107:59620] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "acUXSQ3kybI2o-xasmADkgAAAcQ"]
[Thu Mar 26 19:23:54.343284 2026] [:error] [pid 31717:tid 31740] [client 20.215.59.107:59595] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "acUXSr-SCF7YDISDX4_mMQAAAZI"]
[Thu Mar 26 19:23:55.240323 2026] [:error] [pid 31778:tid 31803] [client 20.215.59.107:60223] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "acUXSw3kybI2o-xasmADkwAAAco"]
[Thu Mar 26 19:23:57.196365 2026] [:error] [pid 31780:tid 31829] [client 20.215.59.107:62687] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acUXTZJDwZsy5O4ZXEijKgAAAgg"]
[Thu Mar 26 19:23:58.010208 2026] [:error] [pid 31778:tid 31796] [client 20.215.59.107:62335] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acUXTg3kybI2o-xasmADlgAAAcM"]
[Thu Mar 26 19:23:58.758519 2026] [:error] [pid 31780:tid 31835] [client 20.215.59.107:62276] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acUXTpJDwZsy5O4ZXEijLgAAAg4"]
[Thu Mar 26 19:23:59.927092 2026] [:error] [pid 31670:tid 31676] [client 20.215.59.107:65008] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acUXTzXVthXxCnWjOTSVzAAAAUQ"]
[Thu Mar 26 19:24:00.539093 2026] [:error] [pid 31670:tid 31680] [client 20.215.59.107:64415] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "acUXUDXVthXxCnWjOTSV0QAAAUg"]
[Thu Mar 26 19:24:01.443821 2026] [:error] [pid 31670:tid 31675] [client 20.215.59.107:64977] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "acUXUTXVthXxCnWjOTSV1gAAAUM"]
[Thu Mar 26 19:24:02.431471 2026] [:error] [pid 60829:tid 60835] [client 20.215.59.107:62274] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "acUXUvTdjHKeZokybaTBfQAAAQQ"]
[Thu Mar 26 19:24:03.135380 2026] [:error] [pid 60829:tid 60850] [client 20.215.59.107:64999] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "acUXU_TdjHKeZokybaTBgQAAARM"]
[Thu Mar 26 19:24:04.039655 2026] [:error] [pid 31670:tid 31694] [client 20.215.59.107:59616] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acUXVDXVthXxCnWjOTSV3AAAAVY"]
[Thu Mar 26 19:24:04.644074 2026] [:error] [pid 31780:tid 31830] [client 20.215.59.107:64993] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acUXVJJDwZsy5O4ZXEijNwAAAgk"]
[Thu Mar 26 19:24:05.324188 2026] [:error] [pid 19710:tid 19745] [client 20.215.59.107:62658] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acUXVQVEWP8Ar68Njk4EUQAAABc"]
[Thu Mar 26 19:24:05.971448 2026] [:error] [pid 31717:tid 31733] [client 20.215.59.107:60173] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acUXVb-SCF7YDISDX4_mQQAAAYs"]
[Thu Mar 26 19:24:06.756815 2026] [:error] [pid 60829:tid 60833] [client 20.215.59.107:60181] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "acUXVvTdjHKeZokybaTBhgAAAQI"]
[Thu Mar 26 19:24:07.652637 2026] [:error] [pid 31780:tid 31824] [client 20.215.59.107:60162] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "acUXV5JDwZsy5O4ZXEijOAAAAgQ"]
[Thu Mar 26 19:24:08.253512 2026] [:error] [pid 31717:tid 31742] [client 20.215.59.107:64440] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "acUXWL-SCF7YDISDX4_mQgAAAZQ"]
[Thu Mar 26 19:24:08.886760 2026] [:error] [pid 60829:tid 60837] [client 20.215.59.107:56594] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "acUXWPTdjHKeZokybaTBiQAAAQY"]
[Thu Mar 26 19:24:09.568010 2026] [:error] [pid 19712:tid 19780] [client 20.215.59.107:62717] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acUXWdWhKhRNqm23vFMgOAAAAIQ"]
[Thu Mar 26 19:24:10.202686 2026] [:error] [pid 19711:tid 19771] [client 20.215.59.107:56612] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acUXWmj3l1y81GYfluSU_gAAAFY"]
[Thu Mar 26 19:24:11.130104 2026] [:error] [pid 31780:tid 31843] [client 20.215.59.107:64435] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acUXW5JDwZsy5O4ZXEijQQAAAhY"]
[Thu Mar 26 19:24:12.146900 2026] [:error] [pid 31780:tid 31842] [client 20.215.59.107:62689] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acUXXJJDwZsy5O4ZXEijQwAAAhU"]
[Thu Mar 26 19:24:12.802541 2026] [:error] [pid 31717:tid 31740] [client 20.215.59.107:62331] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/settings.php"] [unique_id "acUXXL-SCF7YDISDX4_mRwAAAZI"]
[Thu Mar 26 19:24:13.443023 2026] [:error] [pid 31717:tid 31724] [client 20.215.59.107:62681] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/settings.php"] [unique_id "acUXXb-SCF7YDISDX4_mSAAAAYI"]
[Thu Mar 26 19:24:14.550425 2026] [:error] [pid 31670:tid 31674] [client 20.215.59.107:56579] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/settings.php"] [unique_id "acUXXjXVthXxCnWjOTSV6wAAAUI"]
[Thu Mar 26 19:24:15.265633 2026] [:error] [pid 19818:tid 19826] [client 20.215.59.107:56635] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/settings.php"] [unique_id "acUXX8zaSnm3d1BeM5UIzQAAAMY"]
[Thu Mar 26 19:24:16.144349 2026] [:error] [pid 19818:tid 19825] [client 20.215.59.107:62683] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "acUXYMzaSnm3d1BeM5UI0AAAAMU"]
[Thu Mar 26 19:24:16.681611 2026] [:error] [pid 31778:tid 31798] [client 20.215.59.107:62275] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "acUXYA3kybI2o-xasmADqAAAAcU"]
[Thu Mar 26 19:24:17.490584 2026] [:error] [pid 19710:tid 19733] [client 20.215.59.107:56625] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "acUXYQVEWP8Ar68Njk4EWQAAAAs"]
[Thu Mar 26 19:24:18.430901 2026] [:error] [pid 19712:tid 19793] [client 20.215.59.107:62316] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "acUXYtWhKhRNqm23vFMgOgAAAJE"]
[Thu Mar 26 19:24:18.975102 2026] [:error] [pid 31717:tid 31739] [client 20.215.59.107:65016] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "acUXYr-SCF7YDISDX4_mTwAAAZE"]
[Thu Mar 26 19:24:19.625667 2026] [:error] [pid 19710:tid 19737] [client 20.215.59.107:65002] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "acUXYwVEWP8Ar68Njk4EWwAAAA8"]
[Thu Mar 26 19:24:20.647683 2026] [:error] [pid 19710:tid 19732] [client 20.215.59.107:56005] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "acUXZAVEWP8Ar68Njk4EXAAAAAo"]
[Thu Mar 26 19:24:21.501492 2026] [:error] [pid 19818:tid 19841] [client 20.215.59.107:56638] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "acUXZczaSnm3d1BeM5UI1gAAANU"]
[Thu Mar 26 19:24:22.313924 2026] [:error] [pid 31670:tid 31684] [client 20.215.59.107:62328] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "acUXZjXVthXxCnWjOTSV8wAAAUw"]
[Thu Mar 26 19:24:23.078622 2026] [:error] [pid 31780:tid 31830] [client 20.215.59.107:62323] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "acUXZ5JDwZsy5O4ZXEijUAAAAgk"]
[Thu Mar 26 19:24:23.777744 2026] [:error] [pid 31780:tid 31844] [client 20.215.59.107:59614] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "acUXZ5JDwZsy5O4ZXEijUgAAAhc"]
[Thu Mar 26 19:24:24.839721 2026] [:error] [pid 31670:tid 31678] [client 20.215.59.107:62281] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "acUXaDXVthXxCnWjOTSV9AAAAUY"]
[Thu Mar 26 19:24:25.426972 2026] [:error] [pid 19818:tid 19840] [client 20.215.59.107:60205] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acUXaczaSnm3d1BeM5UI4AAAANQ"]
[Thu Mar 26 19:24:26.074583 2026] [:error] [pid 31780:tid 31822] [client 20.215.59.107:64385] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acUXapJDwZsy5O4ZXEijVgAAAgI"]
[Thu Mar 26 19:24:26.969558 2026] [:error] [pid 31670:tid 31676] [client 20.215.59.107:59602] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acUXajXVthXxCnWjOTSV9wAAAUQ"]
[Thu Mar 26 19:24:27.528977 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:53124] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acUXazXVthXxCnWjOTSV-QAAAVI"]
[Thu Mar 26 19:24:28.045248 2026] [:error] [pid 60829:tid 60840] [client 20.215.59.107:56022] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "acUXbPTdjHKeZokybaTBnAAAAQk"]
[Thu Mar 26 19:24:29.248897 2026] [:error] [pid 31670:tid 31675] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/swallowable.php
[Thu Mar 26 19:24:29.560554 2026] [:error] [pid 31670:tid 31696] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Thu Mar 26 19:24:29.820524 2026] [:error] [pid 31670:tid 31689] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Thu Mar 26 19:24:30.084099 2026] [:error] [pid 31670:tid 31676] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/sty.php
[Thu Mar 26 19:24:30.382912 2026] [:error] [pid 31670:tid 31681] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Thu Mar 26 19:24:30.640699 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Mar 26 19:24:30.922565 2026] [:error] [pid 31670:tid 31694] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Mar 26 19:24:31.538156 2026] [:error] [pid 31670:tid 31692] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Mar 26 19:24:31.871959 2026] [:error] [pid 31670:tid 31681] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Thu Mar 26 19:24:32.162984 2026] [:error] [pid 31670:tid 31682] [client 20.215.59.107:59626] [client 20.215.59.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.215.59.107, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acUXcDXVthXxCnWjOTSWFwAAAUo"]
[Thu Mar 26 19:24:32.166094 2026] [:error] [pid 31670:tid 31682] [client 20.215.59.107:59626] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 26 19:24:32.434662 2026] [:error] [pid 31670:tid 31687] [client 20.215.59.107:59626] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "acUXcDXVthXxCnWjOTSWGQAAAU8"]
[Thu Mar 26 19:24:33.254270 2026] [:error] [pid 19818:tid 19833] [client 20.215.59.107:62664] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "acUXcczaSnm3d1BeM5UI4wAAAM0"]
[Thu Mar 26 19:24:33.854913 2026] [:error] [pid 19818:tid 19836] [client 20.215.59.107:62280] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "acUXcczaSnm3d1BeM5UI5AAAANA"]
[Thu Mar 26 19:24:34.543563 2026] [:error] [pid 60829:tid 60854] [client 20.215.59.107:60184] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "acUXcvTdjHKeZokybaTBngAAARc"]
[Thu Mar 26 19:24:35.310025 2026] [:error] [pid 31717:tid 31726] [client 20.215.59.107:56001] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "acUXc7-SCF7YDISDX4_mUwAAAYQ"]
[Thu Mar 26 19:24:35.987403 2026] [:error] [pid 60829:tid 60833] [client 20.215.59.107:60191] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "acUXc_TdjHKeZokybaTBoAAAAQI"]
[Thu Mar 26 19:24:36.541714 2026] [:error] [pid 19818:tid 19834] [client 20.215.59.107:59613] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "acUXdMzaSnm3d1BeM5UI7wAAAM4"]
[Thu Mar 26 19:24:37.273719 2026] [:error] [pid 31670:tid 31692] [client 20.215.59.107:56008] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "acUXdTXVthXxCnWjOTSWIQAAAVQ"]
[Thu Mar 26 19:24:37.853080 2026] [:error] [pid 19818:tid 19833] [client 20.215.59.107:64412] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acUXdczaSnm3d1BeM5UI8QAAAM0"]
[Thu Mar 26 19:24:38.610362 2026] [:error] [pid 19818:tid 19824] [client 20.215.59.107:64417] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acUXdszaSnm3d1BeM5UI9QAAAMQ"]
[Thu Mar 26 19:24:39.296766 2026] [:error] [pid 31780:tid 31830] [client 20.215.59.107:56002] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acUXd5JDwZsy5O4ZXEijaQAAAgk"]
[Thu Mar 26 19:24:39.898767 2026] [:error] [pid 19710:tid 19724] [client 20.215.59.107:59591] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acUXdwVEWP8Ar68Njk4EaAAAAAI"]
[Thu Mar 26 19:24:40.587115 2026] [:error] [pid 31717:tid 31742] [client 20.215.59.107:62659] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "acUXeL-SCF7YDISDX4_mWQAAAZQ"]
[Thu Mar 26 19:24:41.193195 2026] [:error] [pid 31780:tid 31831] [client 20.215.59.107:59615] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "acUXeZJDwZsy5O4ZXEijcQAAAgo"]
[Thu Mar 26 19:24:41.871272 2026] [:error] [pid 19710:tid 19723] [client 20.215.59.107:56608] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "acUXeQVEWP8Ar68Njk4EbQAAAAE"]
[Thu Mar 26 19:24:42.510490 2026] [:error] [pid 31780:tid 31842] [client 20.215.59.107:64399] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "acUXepJDwZsy5O4ZXEijdQAAAhU"]
[Thu Mar 26 19:24:43.294035 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:65022] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acUXezXVthXxCnWjOTSWJAAAAUE"]
[Thu Mar 26 19:24:43.931460 2026] [:error] [pid 60829:tid 60842] [client 20.215.59.107:62304] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acUXe_TdjHKeZokybaTBpwAAAQs"]
[Thu Mar 26 19:24:44.620627 2026] [:error] [pid 31780:tid 31843] [client 20.215.59.107:56045] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acUXfJJDwZsy5O4ZXEijewAAAhY"]
[Thu Mar 26 19:24:45.276516 2026] [:error] [pid 31780:tid 31824] [client 20.215.59.107:64421] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acUXfZJDwZsy5O4ZXEijgAAAAgQ"]
[Thu Mar 26 19:24:45.880495 2026] [:error] [pid 31780:tid 31845] [client 20.215.59.107:62703] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acUXfZJDwZsy5O4ZXEijhAAAAhg"]
[Thu Mar 26 19:24:46.624385 2026] [:error] [pid 31670:tid 31685] [client 20.215.59.107:59588] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acUXfjXVthXxCnWjOTSWLgAAAU0"]
[Thu Mar 26 19:24:49.346160 2026] [:error] [pid 19818:tid 19824] [client 20.215.59.107:65001] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acUXgczaSnm3d1BeM5UJCAAAAMQ"]
[Thu Mar 26 19:24:50.088026 2026] [:error] [pid 19818:tid 19828] [client 20.215.59.107:62278] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acUXgszaSnm3d1BeM5UJCgAAAMg"]
[Thu Mar 26 19:24:50.740825 2026] [:error] [pid 31778:tid 31808] [client 20.215.59.107:64443] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acUXgg3kybI2o-xasmADwQAAAc8"]
[Thu Mar 26 19:24:51.518666 2026] [:error] [pid 19818:tid 19826] [client 20.215.59.107:62704] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acUXg8zaSnm3d1BeM5UJDAAAAMY"]
[Thu Mar 26 19:24:52.157468 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:60180] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acUXhDXVthXxCnWjOTSWRQAAAUs"]
[Thu Mar 26 19:24:52.781788 2026] [:error] [pid 19711:tid 19768] [client 20.215.59.107:64992] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acUXhGj3l1y81GYfluSVEgAAAFM"]
[Thu Mar 26 19:24:55.338366 2026] [:error] [pid 19818:tid 19834] [client 20.215.59.107:56007] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acUXh8zaSnm3d1BeM5UJEAAAAM4"]
[Thu Mar 26 19:24:55.855799 2026] [:error] [pid 31780:tid 31829] [client 20.215.59.107:62283] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acUXh5JDwZsy5O4ZXEijjAAAAgg"]
[Thu Mar 26 19:24:56.408954 2026] [:error] [pid 31670:tid 31672] [client 20.215.59.107:56603] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acUXiDXVthXxCnWjOTSWXgAAAUA"]
[Thu Mar 26 19:24:57.200824 2026] [:error] [pid 31670:tid 31679] [client 20.215.59.107:60166] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acUXiTXVthXxCnWjOTSWYQAAAUc"]
[Thu Mar 26 19:24:57.715601 2026] [:error] [pid 31670:tid 31681] [client 20.215.59.107:56627] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUXiTXVthXxCnWjOTSWZAAAAUk"]
[Thu Mar 26 19:24:58.301405 2026] [:error] [pid 31670:tid 31688] [client 20.215.59.107:59590] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUXijXVthXxCnWjOTSWagAAAVA"]
[Thu Mar 26 19:24:59.120965 2026] [:error] [pid 31778:tid 31795] [client 20.215.59.107:56605] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUXiw3kybI2o-xasmADyAAAAcI"]
[Thu Mar 26 19:24:59.938694 2026] [:error] [pid 31780:tid 31823] [client 20.215.59.107:52859] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUXi5JDwZsy5O4ZXEijjQAAAgM"]
[Thu Mar 26 19:25:00.969038 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:53132] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acUXjDXVthXxCnWjOTSWbwAAAVI"]
[Thu Mar 26 19:25:01.566811 2026] [:error] [pid 19818:tid 19841] [client 20.215.59.107:64401] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acUXjczaSnm3d1BeM5UJHQAAANU"]
[Thu Mar 26 19:25:02.323612 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:62705] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acUXjjXVthXxCnWjOTSWegAAAVI"]
[Thu Mar 26 19:25:02.965401 2026] [:error] [pid 31670:tid 31674] [client 20.215.59.107:56591] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acUXjjXVthXxCnWjOTSWgAAAAUI"]
[Thu Mar 26 19:25:03.584246 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:64439] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acUXjzXVthXxCnWjOTSWhAAAAVI"]
[Thu Mar 26 19:25:04.251720 2026] [:error] [pid 31670:tid 31693] [client 20.215.59.107:60198] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acUXkDXVthXxCnWjOTSWhwAAAVU"]
[Thu Mar 26 19:25:05.384722 2026] [:error] [pid 31670:tid 31692] [client 20.215.59.107:60193] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acUXkTXVthXxCnWjOTSWjgAAAVQ"]
[Thu Mar 26 19:25:07.371539 2026] [:error] [pid 31670:tid 31685] [client 20.215.59.107:53152] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acUXkzXVthXxCnWjOTSWlAAAAU0"]
[Thu Mar 26 19:25:08.024966 2026] [:error] [pid 60829:tid 60834] [client 20.215.59.107:62288] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acUXlPTdjHKeZokybaTBtAAAAQM"]
[Thu Mar 26 19:25:08.622694 2026] [:error] [pid 60829:tid 60839] [client 20.215.59.107:62320] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acUXlPTdjHKeZokybaTBtQAAAQg"]
[Thu Mar 26 19:25:11.150548 2026] [:error] [pid 31780:tid 31823] [client 20.215.59.107:64433] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acUXl5JDwZsy5O4ZXEijmQAAAgM"]
[Thu Mar 26 19:25:18.211123 2026] [:error] [pid 19712:tid 19800] [client 20.215.59.107:56613] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acUXntWhKhRNqm23vFMgRgAAAJg"]
[Thu Mar 26 19:25:20.434401 2026] [:error] [pid 31780:tid 31840] [client 20.215.59.107:62678] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acUXoJJDwZsy5O4ZXEijsgAAAhM"]
[Thu Mar 26 19:25:21.752848 2026] [:error] [pid 19818:tid 19832] [client 20.215.59.107:62701] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acUXoczaSnm3d1BeM5UJLgAAAMw"]
[Thu Mar 26 19:25:22.573196 2026] [:error] [pid 19818:tid 19830] [client 20.215.59.107:60210] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acUXoszaSnm3d1BeM5UJLwAAAMo"]
[Thu Mar 26 19:25:23.225751 2026] [:error] [pid 19711:tid 19765] [client 20.215.59.107:56632] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acUXo2j3l1y81GYfluSVHQAAAFA"]
[Thu Mar 26 19:25:23.806317 2026] [:error] [pid 31780:tid 31845] [client 20.215.59.107:62285] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acUXo5JDwZsy5O4ZXEijuwAAAhg"]
[Thu Mar 26 19:25:25.230620 2026] [:error] [pid 31780:tid 31835] [client 20.215.59.107:64423] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acUXpZJDwZsy5O4ZXEijwQAAAg4"]
[Thu Mar 26 19:25:25.939402 2026] [:error] [pid 19818:tid 19825] [client 20.215.59.107:49763] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acUXpczaSnm3d1BeM5UJMgAAAMU"]
[Thu Mar 26 19:25:26.499856 2026] [:error] [pid 19711:tid 19749] [client 20.215.59.107:64431] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acUXpmj3l1y81GYfluSVHgAAAEA"]
[Thu Mar 26 19:25:27.169460 2026] [:error] [pid 19712:tid 19795] [client 20.215.59.107:60216] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acUXp9WhKhRNqm23vFMgRwAAAJM"]
[Thu Mar 26 19:25:27.762377 2026] [:error] [pid 60829:tid 60845] [client 20.215.59.107:62691] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acUXp_TdjHKeZokybaTBwwAAAQ4"]
[Thu Mar 26 19:25:28.398454 2026] [:error] [pid 19712:tid 19785] [client 20.215.59.107:64402] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acUXqNWhKhRNqm23vFMgSQAAAIk"]
[Thu Mar 26 19:25:29.087602 2026] [:error] [pid 60829:tid 60831] [client 20.215.59.107:59603] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acUXqfTdjHKeZokybaTBxwAAAQA"]
[Thu Mar 26 19:25:29.633939 2026] [:error] [pid 60829:tid 60852] [client 20.215.59.107:56606] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acUXqfTdjHKeZokybaTByAAAARU"]
[Thu Mar 26 19:25:30.193110 2026] [:error] [pid 19711:tid 19763] [client 20.215.59.107:59599] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acUXqmj3l1y81GYfluSVIAAAAE4"]
[Thu Mar 26 19:25:30.808303 2026] [:error] [pid 19711:tid 19752] [client 20.215.59.107:64441] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acUXqmj3l1y81GYfluSVIgAAAEM"]
[Thu Mar 26 19:25:31.395410 2026] [:error] [pid 19818:tid 19823] [client 20.215.59.107:59647] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acUXq8zaSnm3d1BeM5UJNwAAAMM"]
[Thu Mar 26 19:25:32.561558 2026] [:error] [pid 31670:tid 31693] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Thu Mar 26 19:25:32.877450 2026] [:error] [pid 31670:tid 31678] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Thu Mar 26 19:25:33.210734 2026] [:error] [pid 31670:tid 31691] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Thu Mar 26 19:25:34.639393 2026] [:error] [pid 31670:tid 31691] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Thu Mar 26 19:25:34.962017 2026] [:error] [pid 31670:tid 31677] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Mar 26 19:25:35.221356 2026] [:error] [pid 31670:tid 31675] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Thu Mar 26 19:25:35.737445 2026] [:error] [pid 31670:tid 31680] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Thu Mar 26 19:25:36.889982 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:59587] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Mar 26 19:25:37.194270 2026] [:error] [pid 31670:tid 31692] [client 20.215.59.107:59587] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acUXsTXVthXxCnWjOTSWwgAAAVQ"]
[Thu Mar 26 19:25:38.017648 2026] [:error] [pid 31780:tid 31831] [client 20.215.59.107:49785] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acUXspJDwZsy5O4ZXEij0QAAAgo"]
[Thu Mar 26 19:25:38.761954 2026] [:error] [pid 31780:tid 31835] [client 20.215.59.107:60178] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acUXspJDwZsy5O4ZXEij0gAAAg4"]
[Thu Mar 26 19:25:39.928400 2026] [:error] [pid 31670:tid 31678] [client 20.215.59.107:59629] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acUXszXVthXxCnWjOTSWyQAAAUY"]
[Thu Mar 26 19:25:40.650909 2026] [:error] [pid 31670:tid 31685] [client 20.215.59.107:64393] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acUXtDXVthXxCnWjOTSWzwAAAU0"]
[Thu Mar 26 19:25:41.281351 2026] [:error] [pid 60829:tid 60840] [client 20.215.59.107:62322] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acUXtfTdjHKeZokybaTB2AAAAQk"]
[Thu Mar 26 19:25:42.076904 2026] [:error] [pid 60829:tid 60835] [client 20.215.59.107:60195] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acUXtvTdjHKeZokybaTB3AAAAQQ"]
[Thu Mar 26 19:25:43.183823 2026] [:error] [pid 60829:tid 60854] [client 20.215.59.107:56619] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acUXt_TdjHKeZokybaTB4AAAARc"]
[Thu Mar 26 19:25:45.274123 2026] [:error] [pid 19710:tid 19723] [client 20.215.59.107:56616] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acUXuQVEWP8Ar68Njk4EkQAAAAE"]
[Thu Mar 26 19:25:45.965487 2026] [:error] [pid 31717:tid 31732] [client 20.215.59.107:56639] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acUXub-SCF7YDISDX4_maQAAAYo"]
[Thu Mar 26 19:25:47.880845 2026] [:error] [pid 31670:tid 31686] [client 20.215.59.107:60212] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acUXuzXVthXxCnWjOTSW2AAAAU4"]
[Thu Mar 26 19:25:49.198810 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:60220] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acUXvTXVthXxCnWjOTSW2wAAAVI"]
[Thu Mar 26 19:25:50.043801 2026] [:error] [pid 19711:tid 19768] [client 20.215.59.107:59625] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acUXvmj3l1y81GYfluSVKAAAAFM"]
[Thu Mar 26 19:25:50.581095 2026] [:error] [pid 19711:tid 19749] [client 20.215.59.107:56597] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acUXvmj3l1y81GYfluSVKgAAAEA"]
[Thu Mar 26 19:25:51.254188 2026] [:error] [pid 60829:tid 60850] [client 20.215.59.107:50195] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acUXv_TdjHKeZokybaTB5gAAARM"]
[Thu Mar 26 19:25:51.979141 2026] [:error] [pid 19818:tid 19839] [client 20.215.59.107:62700] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acUXv8zaSnm3d1BeM5UJPwAAANM"]
[Thu Mar 26 19:25:52.727488 2026] [:error] [pid 31670:tid 31689] [client 20.215.59.107:65010] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUXwDXVthXxCnWjOTSW4wAAAVE"]
[Thu Mar 26 19:25:53.528140 2026] [:error] [pid 31670:tid 31689] [client 20.215.59.107:62696] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUXwTXVthXxCnWjOTSW7AAAAVE"]
[Thu Mar 26 19:25:54.529839 2026] [:error] [pid 19818:tid 19844] [client 20.215.59.107:62711] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUXwszaSnm3d1BeM5UJQgAAANg"]
[Thu Mar 26 19:25:55.248292 2026] [:error] [pid 19711:tid 19759] [client 20.215.59.107:25188] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUXw2j3l1y81GYfluSVLgAAAEo"]
[Thu Mar 26 19:25:55.922779 2026] [:error] [pid 60829:tid 60846] [client 20.215.59.107:59621] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acUXw_TdjHKeZokybaTB6QAAAQ8"]
[Thu Mar 26 19:25:56.468509 2026] [:error] [pid 19712:tid 19777] [client 20.215.59.107:56589] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acUXxNWhKhRNqm23vFMgZQAAAIE"]
[Thu Mar 26 19:25:57.549111 2026] [:error] [pid 31670:tid 31693] [client 20.215.59.107:62670] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acUXxTXVthXxCnWjOTSXEQAAAVU"]
[Thu Mar 26 19:25:58.587789 2026] [:error] [pid 31717:tid 31745] [client 20.215.59.107:56000] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acUXxr-SCF7YDISDX4_mbwAAAZc"]
[Thu Mar 26 19:25:59.431072 2026] [:error] [pid 31670:tid 31672] [client 20.215.59.107:64425] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acUXxzXVthXxCnWjOTSXGAAAAUA"]
[Thu Mar 26 19:25:59.958425 2026] [:error] [pid 31670:tid 31693] [client 20.215.59.107:59641] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acUXxzXVthXxCnWjOTSXJAAAAVU"]
[Thu Mar 26 19:26:00.779584 2026] [:error] [pid 31670:tid 31696] [client 20.215.59.107:60217] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acUXyDXVthXxCnWjOTSXLwAAAVg"]
[Thu Mar 26 19:26:01.402488 2026] [:error] [pid 31778:tid 31808] [client 20.215.59.107:62684] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acUXyQ3kybI2o-xasmAEBQAAAc8"]
[Thu Mar 26 19:26:02.078607 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:62284] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acUXyjXVthXxCnWjOTSXQQAAAUE"]
[Thu Mar 26 19:26:03.019896 2026] [:error] [pid 31670:tid 31689] [client 20.215.59.107:62673] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acUXyzXVthXxCnWjOTSXRgAAAVE"]
[Thu Mar 26 19:26:03.962617 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:59607] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acUXyzXVthXxCnWjOTSXSQAAAUs"]
[Thu Mar 26 19:26:04.634508 2026] [:error] [pid 31780:tid 31821] [client 20.215.59.107:62303] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acUXzJJDwZsy5O4ZXEij8QAAAgE"]
[Thu Mar 26 19:26:06.286822 2026] [:error] [pid 31717:tid 31738] [client 20.215.59.107:50197] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acUXzr-SCF7YDISDX4_mcQAAAZA"]
[Thu Mar 26 19:26:07.110415 2026] [:error] [pid 31778:tid 31796] [client 20.215.59.107:60164] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acUXzw3kybI2o-xasmAEDQAAAcM"]
[Thu Mar 26 19:26:07.838809 2026] [:error] [pid 31670:tid 31687] [client 20.215.59.107:52811] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acUXzzXVthXxCnWjOTSXUwAAAU8"]
[Thu Mar 26 19:26:08.683685 2026] [:error] [pid 31780:tid 31822] [client 20.215.59.107:60193] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acUX0JJDwZsy5O4ZXEij8gAAAgI"]
[Thu Mar 26 19:26:09.554713 2026] [:error] [pid 31780:tid 31824] [client 20.215.59.107:62310] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "acUX0ZJDwZsy5O4ZXEij-gAAAgQ"]
[Thu Mar 26 19:26:10.248277 2026] [:error] [pid 31670:tid 31691] [client 20.215.59.107:13764] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "acUX0jXVthXxCnWjOTSXYAAAAVM"]
[Thu Mar 26 19:26:10.936054 2026] [:error] [pid 31780:tid 31821] [client 20.215.59.107:56012] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "acUX0pJDwZsy5O4ZXEikBQAAAgE"]
[Thu Mar 26 19:26:11.597997 2026] [:error] [pid 19711:tid 19749] [client 20.215.59.107:56578] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "acUX02j3l1y81GYfluSVNAAAAEA"]
[Thu Mar 26 19:26:12.241021 2026] [:error] [pid 60829:tid 60834] [client 20.215.59.107:62708] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "acUX1PTdjHKeZokybaTB8QAAAQM"]
[Thu Mar 26 19:26:12.865417 2026] [:error] [pid 19712:tid 19778] [client 20.215.59.107:56590] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "acUX1NWhKhRNqm23vFMgaQAAAII"]
[Thu Mar 26 19:26:13.598840 2026] [:error] [pid 31778:tid 31815] [client 20.215.59.107:52842] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "acUX1Q3kybI2o-xasmAEEwAAAdY"]
[Thu Mar 26 19:26:14.151328 2026] [:error] [pid 19818:tid 19821] [client 20.215.59.107:65021] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "acUX1szaSnm3d1BeM5UJbAAAAME"]
[Thu Mar 26 19:26:14.732161 2026] [:error] [pid 19711:tid 19756] [client 20.215.59.107:25190] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "acUX1mj3l1y81GYfluSVNgAAAEc"]
[Thu Mar 26 19:26:15.343316 2026] [:error] [pid 31670:tid 31687] [client 20.215.59.107:53145] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "acUX1zXVthXxCnWjOTSXcgAAAU8"]
[Thu Mar 26 19:26:15.984793 2026] [:error] [pid 60829:tid 60832] [client 20.215.59.107:59639] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "acUX1_TdjHKeZokybaTB-gAAAQE"]
[Thu Mar 26 19:26:16.534358 2026] [:error] [pid 19818:tid 19834] [client 20.215.59.107:25200] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "acUX2MzaSnm3d1BeM5UJbQAAAM4"]
[Thu Mar 26 19:26:17.198023 2026] [:error] [pid 31780:tid 31825] [client 20.215.59.107:65000] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "acUX2ZJDwZsy5O4ZXEikEAAAAgU"]
[Thu Mar 26 19:26:17.838283 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:52838] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "acUX2TXVthXxCnWjOTSXegAAAUE"]
[Thu Mar 26 19:26:18.485883 2026] [:error] [pid 31780:tid 31836] [client 20.215.59.107:25198] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "acUX2pJDwZsy5O4ZXEikFQAAAg8"]
[Thu Mar 26 19:26:19.093892 2026] [:error] [pid 60829:tid 60849] [client 20.215.59.107:59596] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "acUX2_TdjHKeZokybaTB_AAAARI"]
[Thu Mar 26 19:26:19.665048 2026] [:error] [pid 31670:tid 31679] [client 20.215.59.107:62300] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acUX2zXVthXxCnWjOTSXggAAAUc"]
[Thu Mar 26 19:26:20.364409 2026] [:error] [pid 31717:tid 31723] [client 20.215.59.107:56009] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acUX3L-SCF7YDISDX4_mggAAAYE"]
[Thu Mar 26 19:26:21.234992 2026] [:error] [pid 31778:tid 31795] [client 20.215.59.107:62312] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acUX3Q3kybI2o-xasmAEGAAAAcI"]
[Thu Mar 26 19:26:21.838553 2026] [:error] [pid 31717:tid 31725] [client 20.215.59.107:56044] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acUX3b-SCF7YDISDX4_mhgAAAYM"]
[Thu Mar 26 19:26:22.387224 2026] [:error] [pid 60829:tid 60850] [client 20.215.59.107:64438] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "acUX3vTdjHKeZokybaTB_gAAARM"]
[Thu Mar 26 19:26:22.966196 2026] [:error] [pid 60829:tid 60841] [client 20.215.59.107:62706] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "acUX3vTdjHKeZokybaTCAQAAAQo"]
[Thu Mar 26 19:26:23.608382 2026] [:error] [pid 19818:tid 19822] [client 20.215.59.107:60175] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "acUX38zaSnm3d1BeM5UJegAAAMI"]
[Thu Mar 26 19:26:24.184215 2026] [:error] [pid 31778:tid 31801] [client 20.215.59.107:64996] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "acUX4A3kybI2o-xasmAEHQAAAcg"]
[Thu Mar 26 19:26:24.963186 2026] [:error] [pid 31670:tid 31694] [client 20.215.59.107:60215] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "acUX4DXVthXxCnWjOTSXjAAAAVY"]
[Thu Mar 26 19:26:25.607056 2026] [:error] [pid 19711:tid 19766] [client 20.215.59.107:56003] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "acUX4Wj3l1y81GYfluSVPQAAAFE"]
[Thu Mar 26 19:26:26.258583 2026] [:error] [pid 31780:tid 31832] [client 20.215.59.107:56601] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "acUX4pJDwZsy5O4ZXEikGgAAAgs"]
[Thu Mar 26 19:26:26.878087 2026] [:error] [pid 31780:tid 31835] [client 20.215.59.107:53142] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "acUX4pJDwZsy5O4ZXEikHAAAAg4"]
[Thu Mar 26 19:26:27.400021 2026] [:error] [pid 19710:tid 19745] [client 20.215.59.107:64416] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "acUX4wVEWP8Ar68Njk4EsgAAABc"]
[Thu Mar 26 19:26:27.935317 2026] [:error] [pid 19712:tid 19796] [client 20.215.59.107:53143] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "acUX49WhKhRNqm23vFMgdAAAAJQ"]
[Thu Mar 26 19:26:28.497747 2026] [:error] [pid 31717:tid 31725] [client 20.215.59.107:56602] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "acUX5L-SCF7YDISDX4_mjQAAAYM"]
[Thu Mar 26 19:26:29.142351 2026] [:error] [pid 19818:tid 19825] [client 20.215.59.107:62298] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "acUX5czaSnm3d1BeM5UJhAAAAMU"]
[Thu Mar 26 19:26:29.775266 2026] [:error] [pid 19712:tid 19782] [client 20.215.59.107:60171] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acUX5dWhKhRNqm23vFMgdwAAAIY"]
[Thu Mar 26 19:26:30.309117 2026] [:error] [pid 19818:tid 19827] [client 20.215.59.107:56634] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acUX5szaSnm3d1BeM5UJhQAAAMc"]
[Thu Mar 26 19:26:31.140039 2026] [:error] [pid 31670:tid 31694] [client 20.215.59.107:64386] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acUX5zXVthXxCnWjOTSXlQAAAVY"]
[Thu Mar 26 19:26:31.951872 2026] [:error] [pid 31778:tid 31803] [client 20.215.59.107:50192] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acUX5w3kybI2o-xasmAEKwAAAco"]
[Thu Mar 26 19:26:32.518073 2026] [:error] [pid 19710:tid 19722] [client 20.215.59.107:64966] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acUX6AVEWP8Ar68Njk4EuQAAAAA"]
[Thu Mar 26 19:26:33.134365 2026] [:error] [pid 31780:tid 31830] [client 20.215.59.107:62669] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acUX6ZJDwZsy5O4ZXEikIgAAAgk"]
[Thu Mar 26 19:26:33.881105 2026] [:error] [pid 31717:tid 31730] [client 20.215.59.107:64987] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acUX6b-SCF7YDISDX4_mlgAAAYg"]
[Thu Mar 26 19:26:34.448439 2026] [:error] [pid 19712:tid 19793] [client 20.215.59.107:64390] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acUX6tWhKhRNqm23vFMgeQAAAJE"]
[Thu Mar 26 19:26:35.046215 2026] [:error] [pid 19818:tid 19821] [client 20.215.59.107:59592] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acUX68zaSnm3d1BeM5UJhwAAAME"]
[Thu Mar 26 19:26:35.791982 2026] [:error] [pid 31780:tid 31821] [client 20.215.59.107:60209] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acUX65JDwZsy5O4ZXEikKAAAAgE"]
[Thu Mar 26 19:26:36.574068 2026] [:error] [pid 19711:tid 19773] [client 20.215.59.107:56628] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Thu Mar 26 19:26:36.832337 2026] [:error] [pid 19711:tid 19769] [client 20.215.59.107:56628] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Thu Mar 26 19:26:37.349007 2026] [:error] [pid 19711:tid 19766] [client 20.215.59.107:56628] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Mar 26 19:26:37.613535 2026] [:error] [pid 19711:tid 19767] [client 20.215.59.107:56628] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Mar 26 19:26:37.897623 2026] [:error] [pid 19711:tid 19756] [client 20.215.59.107:56628] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Mar 26 19:26:38.182418 2026] [:error] [pid 19711:tid 19763] [client 20.215.59.107:56628] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Thu Mar 26 19:26:38.511691 2026] [:error] [pid 19711:tid 19757] [client 20.215.59.107:56628] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Thu Mar 26 19:26:39.130586 2026] [:error] [pid 19711:tid 19770] [client 20.215.59.107:56628] [client 20.215.59.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acUX72j3l1y81GYfluSVXAAAAFU"]
[Thu Mar 26 19:26:39.700866 2026] [:error] [pid 31717:tid 31739] [client 20.215.59.107:53153] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Mar 26 19:26:40.060744 2026] [:error] [pid 31717:tid 31734] [client 20.215.59.107:53153] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUX8L-SCF7YDISDX4_mmAAAAYw"]
[Thu Mar 26 19:26:40.660587 2026] [:error] [pid 31780:tid 31821] [client 20.215.59.107:25207] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUX8JJDwZsy5O4ZXEikMwAAAgE"]
[Thu Mar 26 19:26:41.243401 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:50196] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUX8TXVthXxCnWjOTSXrAAAAVI"]
[Thu Mar 26 19:26:41.852518 2026] [:error] [pid 19818:tid 19836] [client 20.215.59.107:56583] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUX8czaSnm3d1BeM5UJjgAAANA"]
[Thu Mar 26 19:26:42.480342 2026] [:error] [pid 60829:tid 60843] [client 20.215.59.107:52819] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUX8vTdjHKeZokybaTCDQAAAQw"]
[Thu Mar 26 19:26:43.029205 2026] [:error] [pid 31778:tid 31810] [client 20.215.59.107:62716] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUX8w3kybI2o-xasmAELwAAAdE"]
[Thu Mar 26 19:26:43.672640 2026] [:error] [pid 31778:tid 31798] [client 20.215.59.107:62702] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUX8w3kybI2o-xasmAEMAAAAcU"]
[Thu Mar 26 19:26:44.189943 2026] [:error] [pid 31778:tid 31797] [client 20.215.59.107:62277] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUX9A3kybI2o-xasmAEMgAAAcQ"]
[Thu Mar 26 19:26:44.838174 2026] [:error] [pid 31717:tid 31745] [client 20.215.59.107:62312] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "acUX9L-SCF7YDISDX4_mnQAAAZc"]
[Thu Mar 26 19:26:45.541301 2026] [:error] [pid 31778:tid 31808] [client 20.215.59.107:56041] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "acUX9Q3kybI2o-xasmAEPQAAAc8"]
[Thu Mar 26 19:26:46.206067 2026] [:error] [pid 31780:tid 31840] [client 20.215.59.107:59642] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "acUX9pJDwZsy5O4ZXEikRAAAAhM"]
[Thu Mar 26 19:26:46.877289 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:49731] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "acUX9jXVthXxCnWjOTSXtgAAAUs"]
[Thu Mar 26 19:26:47.574698 2026] [:error] [pid 31780:tid 31832] [client 20.215.59.107:56596] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "acUX95JDwZsy5O4ZXEikRgAAAgs"]
[Thu Mar 26 19:26:48.235227 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:59609] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "acUX-DXVthXxCnWjOTSXvwAAAUE"]
[Thu Mar 26 19:26:49.074839 2026] [:error] [pid 31670:tid 31672] [client 20.215.59.107:59586] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "acUX-TXVthXxCnWjOTSXwwAAAUA"]
[Thu Mar 26 19:26:49.690697 2026] [:error] [pid 31670:tid 31696] [client 20.215.59.107:64982] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "acUX-TXVthXxCnWjOTSXxgAAAVg"]
[Thu Mar 26 19:26:50.316599 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:62293] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "acUX-jXVthXxCnWjOTSXzAAAAUs"]
[Thu Mar 26 19:26:51.041834 2026] [:error] [pid 31670:tid 31696] [client 20.215.59.107:64444] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "acUX-zXVthXxCnWjOTSX0AAAAVg"]
[Thu Mar 26 19:26:51.880107 2026] [:error] [pid 19818:tid 19832] [client 20.215.59.107:64965] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "acUX-8zaSnm3d1BeM5UJlAAAAMw"]
[Thu Mar 26 19:26:52.739911 2026] [:error] [pid 31670:tid 31696] [client 20.215.59.107:65011] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "acUX_DXVthXxCnWjOTSX2QAAAVg"]
[Thu Mar 26 19:26:53.856410 2026] [:error] [pid 31670:tid 31686] [client 20.215.59.107:62275] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "acUX_TXVthXxCnWjOTSX-wAAAU4"]
[Thu Mar 26 19:26:54.486559 2026] [:error] [pid 31780:tid 31825] [client 20.215.59.107:53120] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "acUX_pJDwZsy5O4ZXEikTAAAAgU"]
[Thu Mar 26 19:26:55.251000 2026] [:error] [pid 19818:tid 19826] [client 20.215.59.107:50232] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "acUX_8zaSnm3d1BeM5UJmQAAAMY"]
[Thu Mar 26 19:26:55.888051 2026] [:error] [pid 31670:tid 31687] [client 20.215.59.107:65003] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "acUX_zXVthXxCnWjOTSYAQAAAU8"]
[Thu Mar 26 19:26:56.651357 2026] [:error] [pid 31780:tid 31832] [client 20.215.59.107:64971] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "acUYAJJDwZsy5O4ZXEikTwAAAgs"]
[Thu Mar 26 19:26:57.263864 2026] [:error] [pid 31670:tid 31693] [client 20.215.59.107:56587] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "acUYATXVthXxCnWjOTSYBwAAAVU"]
[Thu Mar 26 19:26:58.095043 2026] [:error] [pid 60829:tid 60846] [client 20.215.59.107:59624] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "acUYAvTdjHKeZokybaTCFwAAAQ8"]
[Thu Mar 26 19:26:58.786246 2026] [:error] [pid 19710:tid 19737] [client 20.215.59.107:62308] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "acUYAgVEWP8Ar68Njk4E0gAAAA8"]
[Thu Mar 26 19:26:59.619927 2026] [:error] [pid 19710:tid 19745] [client 20.215.59.107:59606] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "acUYAwVEWP8Ar68Njk4E1AAAABc"]
[Thu Mar 26 19:27:00.383741 2026] [:error] [pid 19711:tid 19771] [client 20.215.59.107:60165] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "acUYBGj3l1y81GYfluSVYgAAAFY"]
[Thu Mar 26 19:27:00.989562 2026] [:error] [pid 31778:tid 31814] [client 20.215.59.107:53155] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "acUYBA3kybI2o-xasmAEVgAAAdU"]
[Thu Mar 26 19:27:02.057327 2026] [:error] [pid 31780:tid 31824] [client 20.215.59.107:60170] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "acUYBpJDwZsy5O4ZXEikUQAAAgQ"]
[Thu Mar 26 19:27:03.349446 2026] [:error] [pid 31778:tid 31806] [client 20.215.59.107:56629] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acUYBw3kybI2o-xasmAEYAAAAc0"]
[Thu Mar 26 19:27:04.030427 2026] [:error] [pid 19710:tid 19740] [client 20.215.59.107:50188] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acUYCAVEWP8Ar68Njk4E1QAAABI"]
[Thu Mar 26 19:27:05.057164 2026] [:error] [pid 19818:tid 19831] [client 20.215.59.107:62313] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acUYCczaSnm3d1BeM5UJqwAAAMs"]
[Thu Mar 26 19:27:05.615171 2026] [:error] [pid 19710:tid 19729] [client 20.215.59.107:59604] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acUYCQVEWP8Ar68Njk4E2AAAAAc"]
[Thu Mar 26 19:27:06.162374 2026] [:error] [pid 19818:tid 19838] [client 20.215.59.107:59598] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "acUYCszaSnm3d1BeM5UJrgAAANI"]
[Thu Mar 26 19:27:06.710045 2026] [:error] [pid 31780:tid 31821] [client 20.215.59.107:56631] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "acUYCpJDwZsy5O4ZXEikWwAAAgE"]
[Thu Mar 26 19:27:07.240878 2026] [:error] [pid 31780:tid 31844] [client 20.215.59.107:56621] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "acUYC5JDwZsy5O4ZXEikXQAAAhc"]
[Thu Mar 26 19:27:07.887816 2026] [:error] [pid 31780:tid 31837] [client 20.215.59.107:25177] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "acUYC5JDwZsy5O4ZXEikZAAAAhA"]
[Thu Mar 26 19:27:08.567805 2026] [:error] [pid 19818:tid 19830] [client 20.215.59.107:62301] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acUYDMzaSnm3d1BeM5UJtQAAAMo"]
[Thu Mar 26 19:27:09.129427 2026] [:error] [pid 19711:tid 19764] [client 20.215.59.107:62311] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acUYDWj3l1y81GYfluSVaAAAAE8"]
[Thu Mar 26 19:27:09.888740 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:65017] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acUYDTXVthXxCnWjOTSYIAAAAUs"]
[Thu Mar 26 19:27:10.813828 2026] [:error] [pid 31670:tid 31691] [client 20.215.59.107:60203] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acUYDjXVthXxCnWjOTSYJwAAAVM"]
[Thu Mar 26 19:27:11.900427 2026] [:error] [pid 31780:tid 31835] [client 20.215.59.107:59634] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUYD5JDwZsy5O4ZXEikawAAAg4"]
[Thu Mar 26 19:27:12.524282 2026] [:error] [pid 31670:tid 31693] [client 20.215.59.107:60213] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUYEDXVthXxCnWjOTSYPAAAAVU"]
[Thu Mar 26 19:27:13.183101 2026] [:error] [pid 31780:tid 31834] [client 20.215.59.107:59597] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUYEZJDwZsy5O4ZXEikcAAAAg0"]
[Thu Mar 26 19:27:13.729055 2026] [:error] [pid 31670:tid 31693] [client 20.215.59.107:59611] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUYETXVthXxCnWjOTSYRgAAAVU"]
[Thu Mar 26 19:27:14.347549 2026] [:error] [pid 31778:tid 31817] [client 20.215.59.107:49783] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acUYEg3kybI2o-xasmAEcgAAAdg"]
[Thu Mar 26 19:27:14.991761 2026] [:error] [pid 19712:tid 19795] [client 20.215.59.107:64403] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acUYEtWhKhRNqm23vFMghAAAAJM"]
[Thu Mar 26 19:27:15.509049 2026] [:error] [pid 31670:tid 31694] [client 20.215.59.107:64410] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acUYEzXVthXxCnWjOTSYSAAAAVY"]
[Thu Mar 26 19:27:16.299941 2026] [:error] [pid 31670:tid 31672] [client 20.215.59.107:56020] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acUYFDXVthXxCnWjOTSYTAAAAUA"]
[Thu Mar 26 19:27:17.345822 2026] [:error] [pid 19710:tid 19739] [client 20.215.59.107:53179] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acUYFQVEWP8Ar68Njk4E-wAAABE"]
[Thu Mar 26 19:27:17.993257 2026] [:error] [pid 19710:tid 19738] [client 20.215.59.107:64962] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acUYFQVEWP8Ar68Njk4E_gAAABA"]
[Thu Mar 26 19:27:18.817404 2026] [:error] [pid 31778:tid 31799] [client 20.215.59.107:56610] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acUYFg3kybI2o-xasmAEeQAAAcY"]
[Thu Mar 26 19:27:19.504685 2026] [:error] [pid 19711:tid 19766] [client 20.215.59.107:62286] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acUYF2j3l1y81GYfluSVcgAAAFE"]
[Thu Mar 26 19:27:20.416409 2026] [:error] [pid 31670:tid 31680] [client 20.215.59.107:49784] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "acUYGDXVthXxCnWjOTSYUwAAAUg"]
[Thu Mar 26 19:27:25.118720 2026] [:error] [pid 31670:tid 31677] [client 20.215.59.107:25167] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "acUYHTXVthXxCnWjOTSYZgAAAUU"]
[Thu Mar 26 19:27:51.188030 2026] [:error] [pid 31778:tid 31805] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Mar 26 19:27:51.452064 2026] [:error] [pid 31778:tid 31815] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Thu Mar 26 19:27:51.708629 2026] [:error] [pid 31778:tid 31797] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Thu Mar 26 19:27:52.021186 2026] [:error] [pid 31778:tid 31801] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/sdm.php
[Thu Mar 26 19:27:52.491376 2026] [:error] [pid 31778:tid 31795] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/file52.php
[Thu Mar 26 19:27:52.798094 2026] [:error] [pid 31778:tid 31796] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Thu Mar 26 19:27:53.126612 2026] [:error] [pid 31778:tid 31806] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Thu Mar 26 19:27:53.386738 2026] [:error] [pid 31778:tid 31808] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Thu Mar 26 19:27:54.052205 2026] [:error] [pid 31778:tid 31815] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Mar 26 19:27:54.347998 2026] [:error] [pid 31778:tid 31809] [client 20.215.59.107:56016] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Mar 26 19:27:54.603345 2026] [:error] [pid 31778:tid 31817] [client 20.215.59.107:56016] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acUYOg3kybI2o-xasmAEzQAAAdg"]
[Thu Mar 26 19:27:55.166703 2026] [:error] [pid 31670:tid 31679] [client 20.215.59.107:60169] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acUYOzXVthXxCnWjOTSY1AAAAUc"]
[Thu Mar 26 19:27:55.804768 2026] [:error] [pid 31778:tid 31802] [client 20.215.59.107:25172] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acUYOw3kybI2o-xasmAEzgAAAck"]
[Thu Mar 26 19:27:56.398906 2026] [:error] [pid 31670:tid 31677] [client 20.215.59.107:60222] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acUYPDXVthXxCnWjOTSY3wAAAUU"]
[Thu Mar 26 19:27:57.028903 2026] [:error] [pid 60829:tid 60841] [client 20.215.59.107:64430] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acUYPfTdjHKeZokybaTCWgAAAQo"]
[Thu Mar 26 19:27:57.674297 2026] [:error] [pid 31778:tid 31806] [client 20.215.59.107:62657] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acUYPQ3kybI2o-xasmAE0gAAAc0"]
[Thu Mar 26 19:27:58.403771 2026] [:error] [pid 31670:tid 31674] [client 20.215.59.107:52821] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acUYPjXVthXxCnWjOTSY9wAAAUI"]
[Thu Mar 26 19:27:59.088098 2026] [:error] [pid 19818:tid 19840] [client 20.215.59.107:64991] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acUYP8zaSnm3d1BeM5UKAwAAANQ"]
[Thu Mar 26 19:27:59.764181 2026] [:error] [pid 19710:tid 19742] [client 20.215.59.107:47769] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "acUYPwVEWP8Ar68Njk4FEQAAABQ"]
[Thu Mar 26 19:28:00.548622 2026] [:error] [pid 31780:tid 31832] [client 20.215.59.107:56031] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "acUYQJJDwZsy5O4ZXEikrwAAAgs"]
[Thu Mar 26 19:28:01.268315 2026] [:error] [pid 31670:tid 31688] [client 20.215.59.107:62326] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "acUYQTXVthXxCnWjOTSY_gAAAVA"]
[Thu Mar 26 19:28:01.900912 2026] [:error] [pid 19818:tid 19823] [client 20.215.59.107:62662] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "acUYQczaSnm3d1BeM5UKEgAAAMM"]
[Thu Mar 26 19:28:02.570349 2026] [:error] [pid 31670:tid 31688] [client 20.215.59.107:56581] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "acUYQjXVthXxCnWjOTSZBgAAAVA"]
[Thu Mar 26 19:28:03.598400 2026] [:error] [pid 31778:tid 31810] [client 20.215.59.107:56050] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "acUYQw3kybI2o-xasmAE2wAAAdE"]
[Thu Mar 26 19:28:04.274184 2026] [:error] [pid 31670:tid 31681] [client 20.215.59.107:62690] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "acUYRDXVthXxCnWjOTSZCwAAAUk"]
[Thu Mar 26 19:28:04.986094 2026] [:error] [pid 19818:tid 19841] [client 20.215.59.107:56021] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "acUYRMzaSnm3d1BeM5UKFQAAANU"]
[Thu Mar 26 19:28:05.734513 2026] [:error] [pid 31717:tid 31744] [client 20.215.59.107:62334] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "acUYRb-SCF7YDISDX4_myAAAAZY"]
[Thu Mar 26 19:28:06.497119 2026] [:error] [pid 31717:tid 31730] [client 20.215.59.107:52839] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "acUYRr-SCF7YDISDX4_mygAAAYg"]
[Thu Mar 26 19:28:07.386976 2026] [:error] [pid 19818:tid 19836] [client 20.215.59.107:56615] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "acUYR8zaSnm3d1BeM5UKKgAAANA"]
[Thu Mar 26 19:28:08.296832 2026] [:error] [pid 19818:tid 19834] [client 20.215.59.107:64977] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "acUYSMzaSnm3d1BeM5UKLgAAAM4"]
[Thu Mar 26 19:28:09.133858 2026] [:error] [pid 19710:tid 19740] [client 20.215.59.107:47215] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "acUYSQVEWP8Ar68Njk4FFQAAABI"]
[Thu Mar 26 19:28:09.877022 2026] [:error] [pid 19818:tid 19823] [client 20.215.59.107:60207] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "acUYSczaSnm3d1BeM5UKNgAAAMM"]
[Thu Mar 26 19:28:10.716786 2026] [:error] [pid 31717:tid 31736] [client 20.215.59.107:60183] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "acUYSr-SCF7YDISDX4_m0AAAAY4"]
[Thu Mar 26 19:28:11.876057 2026] [:error] [pid 60829:tid 60847] [client 20.215.59.107:52860] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "acUYS_TdjHKeZokybaTCYgAAARA"]
[Thu Mar 26 19:28:12.635770 2026] [:error] [pid 19711:tid 19749] [client 20.215.59.107:50200] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "acUYTGj3l1y81GYfluSViAAAAEA"]
[Thu Mar 26 19:28:13.976504 2026] [:error] [pid 19818:tid 19843] [client 20.215.59.107:25208] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "acUYTczaSnm3d1BeM5UKOAAAANc"]
[Thu Mar 26 19:28:14.726446 2026] [:error] [pid 19712:tid 19776] [client 20.215.59.107:59600] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "acUYTtWhKhRNqm23vFMgpwAAAIA"]
[Thu Mar 26 19:28:15.371246 2026] [:error] [pid 19712:tid 19798] [client 20.215.59.107:64981] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "acUYT9WhKhRNqm23vFMgqwAAAJY"]
[Thu Mar 26 19:28:16.285455 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:56588] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "acUYUDXVthXxCnWjOTSZDAAAAVc"]
[Thu Mar 26 19:28:17.352724 2026] [:error] [pid 19818:tid 19842] [client 20.215.59.107:60221] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "acUYUczaSnm3d1BeM5UKQAAAANY"]
[Thu Mar 26 19:28:18.106622 2026] [:error] [pid 31778:tid 31812] [client 20.215.59.107:64406] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "acUYUg3kybI2o-xasmAE7QAAAdM"]
[Thu Mar 26 19:28:18.936192 2026] [:error] [pid 31717:tid 31725] [client 20.215.59.107:60188] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/thh.php"] [unique_id "acUYUr-SCF7YDISDX4_m1QAAAYM"]
[Thu Mar 26 19:28:19.479027 2026] [:error] [pid 19712:tid 19797] [client 20.215.59.107:5171] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "acUYU9WhKhRNqm23vFMgsAAAAJU"]
[Thu Mar 26 19:28:20.210818 2026] [:error] [pid 19712:tid 19787] [client 20.215.59.107:60174] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "acUYVNWhKhRNqm23vFMgsQAAAIs"]
[Thu Mar 26 19:28:20.857918 2026] [:error] [pid 19818:tid 19824] [client 20.215.59.107:56585] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "acUYVMzaSnm3d1BeM5UKRgAAAMQ"]
[Thu Mar 26 19:28:21.600872 2026] [:error] [pid 19712:tid 19799] [client 20.215.59.107:64979] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yellow.php"] [unique_id "acUYVdWhKhRNqm23vFMgtAAAAJc"]
[Thu Mar 26 19:28:23.228403 2026] [:error] [pid 31717:tid 31735] [client 20.215.59.107:60206] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "acUYV7-SCF7YDISDX4_m3QAAAY0"]
[Thu Mar 26 19:28:23.807064 2026] [:error] [pid 31717:tid 31722] [client 20.215.59.107:62687] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "acUYV7-SCF7YDISDX4_m3wAAAYA"]
[Thu Mar 26 19:28:24.416397 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:62324] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "acUYWDXVthXxCnWjOTSZJgAAAUs"]
[Thu Mar 26 19:28:25.563297 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:56576] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "acUYWTXVthXxCnWjOTSZKQAAAVI"]
[Thu Mar 26 19:28:26.258155 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:56025] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "acUYWjXVthXxCnWjOTSZLAAAAUE"]
[Thu Mar 26 19:28:27.020753 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:64974] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "acUYWzXVthXxCnWjOTSZMwAAAUs"]
[Thu Mar 26 19:28:27.821259 2026] [:error] [pid 19710:tid 19722] [client 20.215.59.107:52832] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "acUYWwVEWP8Ar68Njk4FIAAAAAA"]
[Thu Mar 26 19:28:28.410053 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:62718] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "acUYXDXVthXxCnWjOTSZNwAAAVI"]
[Thu Mar 26 19:28:29.509693 2026] [:error] [pid 19818:tid 19833] [client 20.215.59.107:60208] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "acUYXczaSnm3d1BeM5UKUwAAAM0"]
[Thu Mar 26 19:28:30.736659 2026] [:error] [pid 31717:tid 31738] [client 20.215.59.107:64429] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "acUYXr-SCF7YDISDX4_m5gAAAZA"]
[Thu Mar 26 19:28:32.373005 2026] [:error] [pid 19711:tid 19761] [client 20.215.59.107:64967] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "acUYYGj3l1y81GYfluSVkQAAAEw"]
[Thu Mar 26 19:28:33.161583 2026] [:error] [pid 31780:tid 31836] [client 20.215.59.107:64418] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/build.php"] [unique_id "acUYYZJDwZsy5O4ZXEikzQAAAg8"]
[Thu Mar 26 19:28:34.235555 2026] [:error] [pid 31717:tid 31741] [client 20.215.59.107:60168] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "acUYYr-SCF7YDISDX4_m8AAAAZM"]
[Thu Mar 26 19:28:34.993060 2026] [:error] [pid 31717:tid 31727] [client 20.215.59.107:62332] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "acUYYr-SCF7YDISDX4_m8gAAAYU"]
[Thu Mar 26 19:28:35.609939 2026] [:error] [pid 31670:tid 31688] [client 20.215.59.107:62292] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "acUYYzXVthXxCnWjOTSZQgAAAVA"]
[Thu Mar 26 19:28:36.315460 2026] [:error] [pid 31670:tid 31689] [client 20.215.59.107:62681] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file1.php"] [unique_id "acUYZDXVthXxCnWjOTSZQwAAAVE"]
[Thu Mar 26 19:28:37.386659 2026] [:error] [pid 31717:tid 31735] [client 20.215.59.107:64408] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "acUYZb-SCF7YDISDX4_m9gAAAY0"]
[Thu Mar 26 19:28:37.989982 2026] [:error] [pid 31670:tid 31672] [client 20.215.59.107:53130] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "acUYZTXVthXxCnWjOTSZSgAAAUA"]
[Thu Mar 26 19:28:38.741088 2026] [:error] [pid 31670:tid 31684] [client 20.215.59.107:49757] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "acUYZjXVthXxCnWjOTSZTwAAAUw"]
[Thu Mar 26 19:28:39.270037 2026] [:error] [pid 19818:tid 19839] [client 20.215.59.107:56594] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "acUYZ8zaSnm3d1BeM5UKkwAAANM"]
[Thu Mar 26 19:28:39.843059 2026] [:error] [pid 31780:tid 31838] [client 20.215.59.107:60196] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "acUYZ5JDwZsy5O4ZXEilPAAAAhE"]
[Thu Mar 26 19:28:40.619249 2026] [:error] [pid 31780:tid 31837] [client 20.215.59.107:53146] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "acUYaJJDwZsy5O4ZXEilQQAAAhA"]
[Thu Mar 26 19:28:41.443062 2026] [:error] [pid 60829:tid 60833] [client 20.215.59.107:65012] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "acUYafTdjHKeZokybaTCdQAAAQI"]
[Thu Mar 26 19:28:42.003488 2026] [:error] [pid 31780:tid 31842] [client 20.215.59.107:53141] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "acUYapJDwZsy5O4ZXEilSQAAAhU"]
[Thu Mar 26 19:28:42.615578 2026] [:error] [pid 31717:tid 31739] [client 20.215.59.107:64398] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "acUYar-SCF7YDISDX4_m-AAAAZE"]
[Thu Mar 26 19:28:43.301675 2026] [:error] [pid 31780:tid 31845] [client 20.215.59.107:62272] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "acUYa5JDwZsy5O4ZXEilTAAAAhg"]
[Thu Mar 26 19:28:44.179851 2026] [:error] [pid 19818:tid 19844] [client 20.215.59.107:53154] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "acUYbMzaSnm3d1BeM5UKmAAAANg"]
[Thu Mar 26 19:28:44.975458 2026] [:error] [pid 31670:tid 31672] [client 20.215.59.107:53161] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ffile.php"] [unique_id "acUYbDXVthXxCnWjOTSZYQAAAUA"]
[Thu Mar 26 19:28:45.690880 2026] [:error] [pid 31780:tid 31833] [client 20.215.59.107:53123] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acUYbZJDwZsy5O4ZXEilVgAAAgw"]
[Thu Mar 26 19:28:46.239997 2026] [:error] [pid 60829:tid 60849] [client 20.215.59.107:62309] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acUYbvTdjHKeZokybaTCeAAAARI"]
[Thu Mar 26 19:28:46.874976 2026] [:error] [pid 31670:tid 31684] [client 20.215.59.107:60189] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acUYbjXVthXxCnWjOTSZYwAAAUw"]
[Thu Mar 26 19:28:47.496057 2026] [:error] [pid 19712:tid 19785] [client 20.215.59.107:56577] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acUYb9WhKhRNqm23vFMgzQAAAIk"]
[Thu Mar 26 19:28:48.245783 2026] [:error] [pid 31717:tid 31736] [client 20.215.59.107:64440] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acUYcL-SCF7YDISDX4_m_AAAAY4"]
[Thu Mar 26 19:28:48.948807 2026] [:error] [pid 31780:tid 31824] [client 20.215.59.107:56580] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acUYcJJDwZsy5O4ZXEilWgAAAgQ"]
[Thu Mar 26 19:28:49.490751 2026] [:error] [pid 31670:tid 31679] [client 20.215.59.107:62679] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acUYcTXVthXxCnWjOTSZZgAAAUc"]
[Thu Mar 26 19:28:50.179011 2026] [:error] [pid 31780:tid 31831] [client 20.215.59.107:53151] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acUYcpJDwZsy5O4ZXEilXgAAAgo"]
[Thu Mar 26 19:28:50.718337 2026] [:error] [pid 31670:tid 31691] [client 20.215.59.107:62714] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acUYcjXVthXxCnWjOTSZaQAAAVM"]
[Thu Mar 26 19:28:51.332568 2026] [:error] [pid 60829:tid 60841] [client 20.215.59.107:64985] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acUYc_TdjHKeZokybaTCgQAAAQo"]
[Thu Mar 26 19:28:51.938190 2026] [:error] [pid 31778:tid 31795] [client 20.215.59.107:5160] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acUYcw3kybI2o-xasmAFBQAAAcI"]
[Thu Mar 26 19:28:52.581443 2026] [:error] [pid 60829:tid 60839] [client 20.215.59.107:53127] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acUYdPTdjHKeZokybaTCggAAAQg"]
[Thu Mar 26 19:28:53.367625 2026] [:error] [pid 31717:tid 31735] [client 20.215.59.107:56053] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "acUYdb-SCF7YDISDX4_m_QAAAY0"]
[Thu Mar 26 19:28:54.178398 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Thu Mar 26 19:28:54.476391 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/bless3.php
[Thu Mar 26 19:28:54.736101 2026] [:error] [pid 31670:tid 31679] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/enclas.php
[Thu Mar 26 19:28:55.085807 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/he.php
[Thu Mar 26 19:28:55.375432 2026] [:error] [pid 31670:tid 31692] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/aves.php
[Thu Mar 26 19:28:55.680518 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Thu Mar 26 19:28:55.953847 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/file88.php
[Thu Mar 26 19:28:56.221993 2026] [:error] [pid 31670:tid 31684] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Thu Mar 26 19:28:56.485458 2026] [:error] [pid 31670:tid 31673] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Thu Mar 26 19:28:56.746232 2026] [:error] [pid 31670:tid 31687] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/des.php
[Thu Mar 26 19:28:57.122985 2026] [:error] [pid 31670:tid 31685] [client 20.215.59.107:52851] File does not exist: /usr/local/apache/htdocs/suspended-page/kaza.php
[Thu Mar 26 19:28:57.407021 2026] [:error] [pid 31670:tid 31686] [client 20.215.59.107:52851] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acUYeTXVthXxCnWjOTSZnwAAAU4"]
[Thu Mar 26 19:28:58.096418 2026] [:error] [pid 31670:tid 31687] [client 20.215.59.107:49767] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acUYejXVthXxCnWjOTSZpQAAAU8"]
[Thu Mar 26 19:28:58.673675 2026] [:error] [pid 31670:tid 31696] [client 20.215.59.107:60187] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acUYejXVthXxCnWjOTSZpwAAAVg"]
[Thu Mar 26 19:28:59.331755 2026] [:error] [pid 31670:tid 31686] [client 20.215.59.107:64980] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acUYezXVthXxCnWjOTSZqQAAAU4"]
[Thu Mar 26 19:28:59.944344 2026] [:error] [pid 19711:tid 19761] [client 20.215.59.107:53134] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acUYe2j3l1y81GYfluSVrwAAAEw"]
[Thu Mar 26 19:29:00.527843 2026] [:error] [pid 19712:tid 19789] [client 20.215.59.107:62692] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acUYfNWhKhRNqm23vFMg0AAAAI0"]
[Thu Mar 26 19:29:01.562614 2026] [:error] [pid 31778:tid 31816] [client 20.215.59.107:62715] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acUYfQ3kybI2o-xasmAFDAAAAdc"]
[Thu Mar 26 19:29:02.170514 2026] [:error] [pid 31778:tid 31807] [client 20.215.59.107:60197] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acUYfg3kybI2o-xasmAFDQAAAc4"]
[Thu Mar 26 19:29:02.873447 2026] [:error] [pid 31780:tid 31838] [client 20.215.59.107:64446] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acUYfpJDwZsy5O4ZXEilbgAAAhE"]
[Thu Mar 26 19:29:03.511785 2026] [:error] [pid 31780:tid 31839] [client 20.215.59.107:52805] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acUYf5JDwZsy5O4ZXEilcAAAAhI"]
[Thu Mar 26 19:29:04.133715 2026] [:error] [pid 31780:tid 31829] [client 20.215.59.107:59605] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acUYgJJDwZsy5O4ZXEildgAAAgg"]
[Thu Mar 26 19:29:04.657675 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:62304] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acUYgDXVthXxCnWjOTSZsAAAAVc"]
[Thu Mar 26 19:29:05.326770 2026] [:error] [pid 60829:tid 60832] [client 20.215.59.107:56637] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acUYgfTdjHKeZokybaTCigAAAQE"]
[Thu Mar 26 19:29:05.890771 2026] [:error] [pid 31780:tid 31834] [client 20.215.59.107:64972] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acUYgZJDwZsy5O4ZXEilgwAAAg0"]
[Thu Mar 26 19:29:06.516129 2026] [:error] [pid 19710:tid 19740] [client 20.215.59.107:65007] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acUYggVEWP8Ar68Njk4FPAAAABI"]
[Thu Mar 26 19:29:07.054553 2026] [:error] [pid 31670:tid 31690] [client 20.215.59.107:47225] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acUYgzXVthXxCnWjOTSZsQAAAVI"]
[Thu Mar 26 19:29:07.668886 2026] [:error] [pid 19711:tid 19762] [client 20.215.59.107:56617] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acUYg2j3l1y81GYfluSVsAAAAE0"]
[Thu Mar 26 19:29:08.243715 2026] [:error] [pid 19711:tid 19767] [client 20.215.59.107:59620] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acUYhGj3l1y81GYfluSVsQAAAFI"]
[Thu Mar 26 19:29:08.926891 2026] [:error] [pid 31778:tid 31803] [client 20.215.59.107:56002] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acUYhA3kybI2o-xasmAFFgAAAco"]
[Thu Mar 26 19:29:09.534033 2026] [:error] [pid 19818:tid 19820] [client 20.215.59.107:60223] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acUYhczaSnm3d1BeM5UKswAAAMA"]
[Thu Mar 26 19:29:10.277891 2026] [:error] [pid 19818:tid 19825] [client 20.215.59.107:59595] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acUYhszaSnm3d1BeM5UKuAAAAMU"]
[Thu Mar 26 19:29:10.924942 2026] [:error] [pid 19818:tid 19835] [client 20.215.59.107:62695] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acUYhszaSnm3d1BeM5UKvQAAAM8"]
[Thu Mar 26 19:29:11.650839 2026] [:error] [pid 19818:tid 19832] [client 20.215.59.107:65023] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acUYh8zaSnm3d1BeM5UKwgAAAMw"]
[Thu Mar 26 19:29:12.223316 2026] [:error] [pid 19818:tid 19834] [client 20.215.59.107:49732] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acUYiMzaSnm3d1BeM5UKxgAAAM4"]
[Thu Mar 26 19:29:13.004398 2026] [:error] [pid 31778:tid 31807] [client 20.215.59.107:60219] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "acUYiQ3kybI2o-xasmAFGQAAAc4"]
[Thu Mar 26 19:29:13.588764 2026] [:error] [pid 31670:tid 31696] [client 20.215.59.107:60204] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "acUYiTXVthXxCnWjOTSZtQAAAVg"]
[Thu Mar 26 19:29:14.376852 2026] [:error] [pid 31670:tid 31686] [client 20.215.59.107:50191] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "acUYijXVthXxCnWjOTSZuAAAAU4"]
[Thu Mar 26 19:29:15.038316 2026] [:error] [pid 31670:tid 31680] [client 20.215.59.107:56023] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "acUYizXVthXxCnWjOTSZuwAAAUg"]
[Thu Mar 26 19:29:15.909341 2026] [:error] [pid 31670:tid 31692] [client 20.215.59.107:56030] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acUYizXVthXxCnWjOTSZwwAAAVQ"]
[Thu Mar 26 19:29:18.160424 2026] [:error] [pid 19711:tid 19768] [client 20.215.59.107:62315] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acUYjmj3l1y81GYfluSVswAAAFM"]
[Thu Mar 26 19:29:18.921660 2026] [:error] [pid 31670:tid 31694] [client 20.215.59.107:59584] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acUYjjXVthXxCnWjOTSZywAAAVY"]
[Thu Mar 26 19:29:19.677760 2026] [:error] [pid 31717:tid 31725] [client 20.215.59.107:64994] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "acUYj7-SCF7YDISDX4_nDAAAAYM"]
[Thu Mar 26 19:29:20.220164 2026] [:error] [pid 31717:tid 31742] [client 20.215.59.107:25173] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acUYkL-SCF7YDISDX4_nDQAAAZQ"]
[Thu Mar 26 19:29:21.035136 2026] [:error] [pid 31670:tid 31683] [client 20.215.59.107:56043] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acUYkTXVthXxCnWjOTSZ0AAAAUs"]
[Thu Mar 26 19:29:21.763651 2026] [:error] [pid 31670:tid 31695] [client 20.215.59.107:65004] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acUYkTXVthXxCnWjOTSZ1QAAAVc"]
[Thu Mar 26 19:29:22.374180 2026] [:error] [pid 19712:tid 19792] [client 20.215.59.107:13812] [client 20.215.59.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acUYktWhKhRNqm23vFMg2QAAAJA"]
[Thu Mar 26 21:53:39.801001 2026] [:error] [pid 19712:tid 19785] [client 20.104.216.159:40466] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Mar 26 21:53:40.009838 2026] [:error] [pid 19712:tid 19793] [client 20.104.216.159:40466] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Mar 26 21:53:40.429755 2026] [:error] [pid 19712:tid 19787] [client 20.104.216.159:40466] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Thu Mar 26 21:53:40.637869 2026] [:error] [pid 19712:tid 19780] [client 20.104.216.159:40466] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Mar 26 21:53:41.056016 2026] [:error] [pid 19712:tid 19783] [client 20.104.216.159:40466] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Thu Mar 26 21:53:41.264034 2026] [:error] [pid 19712:tid 19795] [client 20.104.216.159:40466] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Mar 26 21:53:41.473051 2026] [:error] [pid 19712:tid 19785] [client 20.104.216.159:40466] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Thu Mar 26 21:53:41.887738 2026] [:error] [pid 19712:tid 19798] [client 20.104.216.159:40466] [client 20.104.216.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acU6ZdWhKhRNqm23vFNIKQAAAJY"]
[Thu Mar 26 21:53:42.711573 2026] [:error] [pid 31670:tid 31686] [client 20.104.216.159:39943] [client 20.104.216.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acU6ZjXVthXxCnWjOTTVQgAAAU4"]
[Thu Mar 26 21:53:43.542759 2026] [:error] [pid 31670:tid 31685] [client 20.104.216.159:39952] [client 20.104.216.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acU6ZzXVthXxCnWjOTTVTQAAAU0"]
[Thu Mar 26 21:53:44.368307 2026] [:error] [pid 19712:tid 19796] [client 20.104.216.159:39944] [client 20.104.216.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/randkeyword.PhP7"] [unique_id "acU6aNWhKhRNqm23vFNILwAAAJQ"]
[Thu Mar 26 22:30:40.000918 2026] [:error] [pid 60829:tid 60832] [client 103.225.125.148:62622] [client 103.225.125.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.225.125.148, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acVDD_TdjHKeZokybaTd8gAAAQE"]
[Thu Mar 26 22:30:40.010359 2026] [:error] [pid 60829:tid 60832] [client 103.225.125.148:62622] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 27 01:32:58.678673 2026] [:error] [pid 62551:tid 62558] [client 185.169.4.152:58859] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "acVtyoQvFHgfE1g4p7CP7QAAAcQ"]
[Fri Mar 27 02:00:37.438073 2026] [:error] [pid 62551:tid 62565] [client 49.47.8.8:50707] [client 49.47.8.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.8.8, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acV0RYQvFHgfE1g4p7CYUgAAAcs"]
[Fri Mar 27 02:00:37.442713 2026] [:error] [pid 62551:tid 62565] [client 49.47.8.8:50707] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 27 05:02:55.337921 2026] [:error] [pid 63897:tid 63903] [client 177.23.136.6:49726] [client 177.23.136.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.23.136.6, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acWe_2VSkmYmLu7ycYjPngAAAQQ"]
[Fri Mar 27 05:02:55.343175 2026] [:error] [pid 63897:tid 63903] [client 177.23.136.6:49726] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 27 06:00:42.263045 2026] [:error] [pid 4341:tid 4349] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Mar 27 06:00:42.526120 2026] [:error] [pid 4341:tid 4343] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Mar 27 06:00:42.790280 2026] [:error] [pid 4341:tid 4348] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Fri Mar 27 06:00:43.057100 2026] [:error] [pid 4341:tid 4346] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Mar 27 06:00:43.314421 2026] [:error] [pid 4341:tid 4361] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Mar 27 06:00:43.571748 2026] [:error] [pid 4341:tid 4354] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Fri Mar 27 06:00:43.829904 2026] [:error] [pid 4341:tid 4355] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Fri Mar 27 06:00:44.089021 2026] [:error] [pid 4341:tid 4362] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Mar 27 06:00:44.348051 2026] [:error] [pid 4341:tid 4359] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Fri Mar 27 06:00:44.605951 2026] [:error] [pid 4341:tid 4353] [client 74.248.18.153:48932] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Mar 27 06:00:44.869049 2026] [:error] [pid 4341:tid 4351] [client 74.248.18.153:48932] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acWsjOKJWrNB5dMlEREMJgAAAYg"]
[Fri Mar 27 06:00:45.516684 2026] [:error] [pid 27851:tid 27866] [client 74.248.18.153:48928] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acWsjXR2ccxe3RMCLboRrgAAAMg"]
[Fri Mar 27 06:00:46.188804 2026] [:error] [pid 27749:tid 27793] [client 74.248.18.153:51131] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acWsjsEqyoMni2Q6_X5e3QAAAEI"]
[Fri Mar 27 06:00:46.800378 2026] [:error] [pid 27750:tid 27837] [client 74.248.18.153:6487] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acWsjoaSil5rd17ieLw4GwAAAJM"]
[Fri Mar 27 06:00:47.390086 2026] [:error] [pid 27750:tid 27827] [client 74.248.18.153:62512] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acWsj4aSil5rd17ieLw4HwAAAIk"]
[Fri Mar 27 06:00:47.975418 2026] [:error] [pid 4341:tid 4363] [client 74.248.18.153:51073] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acWsj-KJWrNB5dMlEREMKQAAAZQ"]
[Fri Mar 27 06:00:48.558706 2026] [:error] [pid 27851:tid 27872] [client 74.248.18.153:48902] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acWskHR2ccxe3RMCLboRtQAAAM4"]
[Fri Mar 27 06:00:49.137547 2026] [:error] [pid 27750:tid 27835] [client 74.248.18.153:59641] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acWskYaSil5rd17ieLw4JAAAAJE"]
[Fri Mar 27 06:00:49.757315 2026] [:error] [pid 27851:tid 27874] [client 74.248.18.153:55406] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acWskXR2ccxe3RMCLboRuAAAANA"]
[Fri Mar 27 06:00:50.355474 2026] [:error] [pid 4293:tid 4316] [client 74.248.18.153:59856] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acWskpLjeJUC3OKtEx9WOAAAAVU"]
[Fri Mar 27 06:00:50.962771 2026] [:error] [pid 27851:tid 27881] [client 74.248.18.153:62513] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acWsknR2ccxe3RMCLboRuQAAANc"]
[Fri Mar 27 06:00:51.574716 2026] [:error] [pid 63897:tid 63923] [client 74.248.18.153:61923] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acWsk2VSkmYmLu7ycYj00QAAARg"]
[Fri Mar 27 06:00:52.134517 2026] [:error] [pid 4341:tid 4362] [client 74.248.18.153:59844] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "acWslOKJWrNB5dMlEREMLgAAAZM"]
[Fri Mar 27 06:00:52.712126 2026] [:error] [pid 27750:tid 27837] [client 74.248.18.153:62475] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "acWslIaSil5rd17ieLw4JwAAAJM"]
[Fri Mar 27 06:00:53.287285 2026] [:error] [pid 27750:tid 27827] [client 74.248.18.153:59610] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "acWslYaSil5rd17ieLw4KwAAAIk"]
[Fri Mar 27 06:00:53.829092 2026] [:error] [pid 63897:tid 63916] [client 74.248.18.153:59611] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/init.php"] [unique_id "acWslWVSkmYmLu7ycYj00wAAARE"]
[Fri Mar 27 06:00:54.491883 2026] [:error] [pid 63897:tid 63903] [client 74.248.18.153:59879] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acWslmVSkmYmLu7ycYj02AAAAQQ"]
[Fri Mar 27 06:00:55.140504 2026] [:error] [pid 63897:tid 63917] [client 74.248.18.153:59642] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acWsl2VSkmYmLu7ycYj03AAAARI"]
[Fri Mar 27 06:00:55.869544 2026] [:error] [pid 4293:tid 4298] [client 74.248.18.153:47965] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acWsl5LjeJUC3OKtEx9WUwAAAUM"]
[Fri Mar 27 06:00:56.476419 2026] [:error] [pid 63897:tid 63916] [client 74.248.18.153:55382] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "acWsmGVSkmYmLu7ycYj04wAAARE"]
[Fri Mar 27 06:00:57.328438 2026] [:error] [pid 4341:tid 4348] [client 74.248.18.153:6465] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acWsmeKJWrNB5dMlEREMTAAAAYU"]
[Fri Mar 27 06:00:58.011015 2026] [:error] [pid 27749:tid 27808] [client 74.248.18.153:59863] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acWsmsEqyoMni2Q6_X5e5QAAAFE"]
[Fri Mar 27 06:00:59.285897 2026] [:error] [pid 27749:tid 27797] [client 74.248.18.153:50863] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acWsm8EqyoMni2Q6_X5e5wAAAEY"]
[Fri Mar 27 06:01:00.198293 2026] [:error] [pid 27851:tid 27863] [client 74.248.18.153:55685] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acWsnHR2ccxe3RMCLboR0gAAAMU"]
[Fri Mar 27 06:01:01.069203 2026] [:error] [pid 27749:tid 27803] [client 74.248.18.153:62514] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acWsncEqyoMni2Q6_X5e6gAAAEw"]
[Fri Mar 27 06:01:01.718326 2026] [:error] [pid 27750:tid 27824] [client 74.248.18.153:55700] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acWsnYaSil5rd17ieLw4NQAAAIY"]
[Fri Mar 27 06:01:02.925820 2026] [:error] [pid 63897:tid 63907] [client 74.248.18.153:48837] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acWsnmVSkmYmLu7ycYj08wAAAQg"]
[Fri Mar 27 06:01:03.551346 2026] [:error] [pid 63897:tid 63916] [client 74.248.18.153:50843] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acWsn2VSkmYmLu7ycYj09QAAARE"]
[Fri Mar 27 06:01:04.141858 2026] [:error] [pid 27851:tid 27870] [client 74.248.18.153:59491] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acWsoHR2ccxe3RMCLboR2AAAAMw"]
[Fri Mar 27 06:01:04.801814 2026] [:error] [pid 27749:tid 27800] [client 74.248.18.153:7157] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acWsoMEqyoMni2Q6_X5e7QAAAEk"]
[Fri Mar 27 06:01:05.473501 2026] [:error] [pid 27743:tid 27780] [client 74.248.18.153:61911] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acWsoSA46UYYLqzw99D9VgAAABA"]
[Fri Mar 27 06:01:06.231832 2026] [:error] [pid 63897:tid 63902] [client 74.248.18.153:61902] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acWsomVSkmYmLu7ycYj1AQAAAQM"]
[Fri Mar 27 06:01:06.870564 2026] [:error] [pid 27851:tid 27864] [client 74.248.18.153:60102] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acWsonR2ccxe3RMCLboR3QAAAMY"]
[Fri Mar 27 06:01:07.450157 2026] [:error] [pid 27851:tid 27868] [client 74.248.18.153:50868] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acWso3R2ccxe3RMCLboR3gAAAMo"]
[Fri Mar 27 06:01:08.020616 2026] [:error] [pid 63897:tid 63903] [client 74.248.18.153:62477] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acWspGVSkmYmLu7ycYj1BwAAAQQ"]
[Fri Mar 27 06:01:08.605694 2026] [:error] [pid 27743:tid 27783] [client 74.248.18.153:6526] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acWspCA46UYYLqzw99D9XAAAABM"]
[Fri Mar 27 06:01:09.235263 2026] [:error] [pid 27743:tid 27781] [client 74.248.18.153:59479] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "acWspSA46UYYLqzw99D9XQAAABE"]
[Fri Mar 27 06:01:10.459598 2026] [:error] [pid 27749:tid 27814] [client 74.248.18.153:55729] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "acWspsEqyoMni2Q6_X5e9AAAAFc"]
[Fri Mar 27 06:01:11.444974 2026] [:error] [pid 63897:tid 63918] [client 74.248.18.153:55706] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "acWsp2VSkmYmLu7ycYj1CQAAARM"]
[Fri Mar 27 06:01:12.714174 2026] [:error] [pid 27750:tid 27835] [client 74.248.18.153:48847] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "acWsqIaSil5rd17ieLw4OgAAAJE"]
[Fri Mar 27 06:01:13.332705 2026] [:error] [pid 27749:tid 27796] [client 74.248.18.153:60140] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acWsqcEqyoMni2Q6_X5e9gAAAEU"]
[Fri Mar 27 06:01:13.925211 2026] [:error] [pid 27749:tid 27799] [client 74.248.18.153:7104] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acWsqcEqyoMni2Q6_X5e9wAAAEg"]
[Fri Mar 27 06:01:14.671908 2026] [:error] [pid 63897:tid 63923] [client 74.248.18.153:62489] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acWsqmVSkmYmLu7ycYj1FQAAARg"]
[Fri Mar 27 06:01:15.583462 2026] [:error] [pid 4293:tid 4298] [client 74.248.18.153:6501] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acWsq5LjeJUC3OKtEx9WXwAAAUM"]
[Fri Mar 27 06:01:16.140603 2026] [:error] [pid 27743:tid 27775] [client 74.248.18.153:6527] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acWsrCA46UYYLqzw99D9ZgAAAAs"]
[Fri Mar 27 06:01:16.981441 2026] [:error] [pid 27743:tid 27785] [client 74.248.18.153:55416] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acWsrCA46UYYLqzw99D9aAAAABU"]
[Fri Mar 27 06:01:17.816145 2026] [:error] [pid 27743:tid 27780] [client 74.248.18.153:48862] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acWsrSA46UYYLqzw99D9bAAAABA"]
[Fri Mar 27 06:01:19.947852 2026] [:error] [pid 4341:tid 4357] [client 74.248.18.153:59599] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acWsr-KJWrNB5dMlEREMXAAAAY4"]
[Fri Mar 27 06:01:22.766661 2026] [:error] [pid 27743:tid 27781] [client 74.248.18.153:55715] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acWssiA46UYYLqzw99D9cgAAABE"]
[Fri Mar 27 06:01:23.861122 2026] [:error] [pid 27743:tid 27784] [client 74.248.18.153:47987] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acWssyA46UYYLqzw99D9cwAAABQ"]
[Fri Mar 27 06:01:25.109915 2026] [:error] [pid 27750:tid 27837] [client 74.248.18.153:61897] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acWstYaSil5rd17ieLw4RwAAAJM"]
[Fri Mar 27 06:01:26.363889 2026] [:error] [pid 27750:tid 27828] [client 74.248.18.153:47943] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acWstoaSil5rd17ieLw4TQAAAIo"]
[Fri Mar 27 06:01:27.580289 2026] [:error] [pid 27750:tid 27818] [client 74.248.18.153:48836] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acWst4aSil5rd17ieLw4VAAAAIA"]
[Fri Mar 27 06:01:28.798410 2026] [:error] [pid 63897:tid 63921] [client 74.248.18.153:60143] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acWsuGVSkmYmLu7ycYj1HwAAARY"]
[Fri Mar 27 06:01:29.408055 2026] [:error] [pid 27743:tid 27781] [client 74.248.18.153:59477] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acWsuSA46UYYLqzw99D9fwAAABE"]
[Fri Mar 27 06:01:30.203902 2026] [:error] [pid 27749:tid 27810] [client 74.248.18.153:61892] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "acWsusEqyoMni2Q6_X5fDAAAAFM"]
[Fri Mar 27 06:01:31.520316 2026] [:error] [pid 27743:tid 27768] [client 74.248.18.153:60117] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "acWsuyA46UYYLqzw99D9iAAAAAQ"]
[Fri Mar 27 06:01:32.350215 2026] [:error] [pid 27851:tid 27873] [client 74.248.18.153:48832] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "acWsvHR2ccxe3RMCLboR8AAAAM8"]
[Fri Mar 27 06:01:33.043882 2026] [:error] [pid 4341:tid 4365] [client 74.248.18.153:55692] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "acWsveKJWrNB5dMlEREMYwAAAZY"]
[Fri Mar 27 06:01:34.083419 2026] [:error] [pid 63897:tid 63901] [client 74.248.18.153:55399] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "acWsvmVSkmYmLu7ycYj1JAAAAQI"]
[Fri Mar 27 06:01:35.044203 2026] [:error] [pid 63897:tid 63911] [client 74.248.18.153:47937] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acWsv2VSkmYmLu7ycYj1KwAAAQw"]
[Fri Mar 27 06:01:35.937072 2026] [:error] [pid 63897:tid 63908] [client 74.248.18.153:62501] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acWsv2VSkmYmLu7ycYj1MQAAAQk"]
[Fri Mar 27 06:01:36.680472 2026] [:error] [pid 4341:tid 4346] [client 74.248.18.153:61901] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acWswOKJWrNB5dMlEREMagAAAYM"]
[Fri Mar 27 06:01:37.667162 2026] [:error] [pid 4341:tid 4352] [client 74.248.18.153:48874] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "acWsweKJWrNB5dMlEREMcAAAAYk"]
[Fri Mar 27 06:01:38.774502 2026] [:error] [pid 63897:tid 63899] [client 74.248.18.153:60104] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acWswmVSkmYmLu7ycYj1NwAAAQA"]
[Fri Mar 27 06:01:39.497968 2026] [:error] [pid 4341:tid 4359] [client 74.248.18.153:64624] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acWsw-KJWrNB5dMlEREMdQAAAZA"]
[Fri Mar 27 06:01:40.568013 2026] [:error] [pid 4293:tid 4296] [client 74.248.18.153:55687] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acWsxJLjeJUC3OKtEx9WdQAAAUE"]
[Fri Mar 27 06:01:41.643097 2026] [:error] [pid 4293:tid 4314] [client 74.248.18.153:59495] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acWsxZLjeJUC3OKtEx9WdwAAAVM"]
[Fri Mar 27 06:01:42.440860 2026] [:error] [pid 63897:tid 63903] [client 74.248.18.153:6509] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "acWsxmVSkmYmLu7ycYj1SAAAAQQ"]
[Fri Mar 27 06:01:43.539122 2026] [:error] [pid 4293:tid 4300] [client 74.248.18.153:59496] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "acWsx5LjeJUC3OKtEx9WewAAAUU"]
[Fri Mar 27 06:01:44.420200 2026] [:error] [pid 63897:tid 63920] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Fri Mar 27 06:01:44.678880 2026] [:error] [pid 63897:tid 63911] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Fri Mar 27 06:01:44.939665 2026] [:error] [pid 63897:tid 63913] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Fri Mar 27 06:01:45.199936 2026] [:error] [pid 63897:tid 63912] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Fri Mar 27 06:01:45.459971 2026] [:error] [pid 63897:tid 63916] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Mar 27 06:01:45.735358 2026] [:error] [pid 63897:tid 63922] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Mar 27 06:01:45.993859 2026] [:error] [pid 63897:tid 63903] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Fri Mar 27 06:01:46.252932 2026] [:error] [pid 63897:tid 63909] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Mar 27 06:01:46.512003 2026] [:error] [pid 63897:tid 63914] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Fri Mar 27 06:01:46.771322 2026] [:error] [pid 63897:tid 63906] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Fri Mar 27 06:01:47.033607 2026] [:error] [pid 63897:tid 63905] [client 74.248.18.153:6502] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Fri Mar 27 06:01:47.289712 2026] [:error] [pid 63897:tid 63917] [client 74.248.18.153:6502] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acWsy2VSkmYmLu7ycYj1XwAAARI"]
[Fri Mar 27 06:01:48.340445 2026] [:error] [pid 4293:tid 4311] [client 74.248.18.153:48865] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acWszJLjeJUC3OKtEx9WgAAAAVA"]
[Fri Mar 27 06:01:49.153713 2026] [:error] [pid 4293:tid 4305] [client 74.248.18.153:6506] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acWszZLjeJUC3OKtEx9WgQAAAUo"]
[Fri Mar 27 06:01:49.931714 2026] [:error] [pid 4341:tid 4344] [client 74.248.18.153:6482] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acWszeKJWrNB5dMlEREMlwAAAYE"]
[Fri Mar 27 06:01:50.844014 2026] [:error] [pid 27743:tid 27766] [client 74.248.18.153:6473] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acWsziA46UYYLqzw99D9kwAAAAI"]
[Fri Mar 27 06:01:51.584790 2026] [:error] [pid 27743:tid 27765] [client 74.248.18.153:55407] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acWszyA46UYYLqzw99D9lAAAAAE"]
[Fri Mar 27 06:01:52.578364 2026] [:error] [pid 4341:tid 4349] [client 74.248.18.153:47985] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acWs0OKJWrNB5dMlEREMnAAAAYY"]
[Fri Mar 27 06:01:53.333025 2026] [:error] [pid 4293:tid 4303] [client 74.248.18.153:59461] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acWs0ZLjeJUC3OKtEx9WkwAAAUg"]
[Fri Mar 27 06:01:54.538037 2026] [:error] [pid 4341:tid 4345] [client 74.248.18.153:64619] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "acWs0uKJWrNB5dMlEREMogAAAYI"]
[Fri Mar 27 06:01:56.071844 2026] [:error] [pid 63897:tid 63906] [client 74.248.18.153:59493] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "acWs1GVSkmYmLu7ycYj1ZQAAAQc"]
[Fri Mar 27 06:01:57.184677 2026] [:error] [pid 27750:tid 27822] [client 74.248.18.153:62483] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "acWs1YaSil5rd17ieLw4wgAAAIQ"]
[Fri Mar 27 06:01:57.881587 2026] [:error] [pid 4341:tid 4353] [client 74.248.18.153:7115] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-access.php"] [unique_id "acWs1eKJWrNB5dMlEREMqwAAAYo"]
[Fri Mar 27 06:01:58.825211 2026] [:error] [pid 4341:tid 4359] [client 74.248.18.153:59616] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acWs1uKJWrNB5dMlEREMrgAAAZA"]
[Fri Mar 27 06:01:59.612491 2026] [:error] [pid 4341:tid 4367] [client 74.248.18.153:55413] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acWs1-KJWrNB5dMlEREMsgAAAZg"]
[Fri Mar 27 06:02:00.284473 2026] [:error] [pid 27749:tid 27813] [client 74.248.18.153:59498] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acWs2MEqyoMni2Q6_X5fJQAAAFY"]
[Fri Mar 27 06:02:01.160836 2026] [:error] [pid 27750:tid 27831] [client 74.248.18.153:55723] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acWs2YaSil5rd17ieLw41QAAAI0"]
[Fri Mar 27 06:02:02.108836 2026] [:error] [pid 63897:tid 63912] [client 74.248.18.153:55379] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acWs2mVSkmYmLu7ycYj1awAAAQ0"]
[Fri Mar 27 06:02:03.863893 2026] [:error] [pid 27851:tid 27878] [client 74.248.18.153:59466] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acWs23R2ccxe3RMCLboR-wAAANQ"]
[Fri Mar 27 06:02:04.506941 2026] [:error] [pid 27851:tid 27860] [client 74.248.18.153:64625] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acWs3HR2ccxe3RMCLboR_QAAAMI"]
[Fri Mar 27 06:02:05.404466 2026] [:error] [pid 27743:tid 27769] [client 74.248.18.153:60112] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acWs3SA46UYYLqzw99D9mwAAAAU"]
[Fri Mar 27 06:02:06.373604 2026] [:error] [pid 4293:tid 4319] [client 74.248.18.153:7167] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acWs3pLjeJUC3OKtEx9WqgAAAVg"]
[Fri Mar 27 06:02:07.218933 2026] [:error] [pid 4293:tid 4315] [client 74.248.18.153:59638] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acWs35LjeJUC3OKtEx9WrAAAAVQ"]
[Fri Mar 27 06:02:08.012923 2026] [:error] [pid 63897:tid 63901] [client 74.248.18.153:59487] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acWs4GVSkmYmLu7ycYj1dwAAAQI"]
[Fri Mar 27 06:02:08.669897 2026] [:error] [pid 27851:tid 27877] [client 74.248.18.153:55390] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acWs4HR2ccxe3RMCLboSAwAAANM"]
[Fri Mar 27 06:02:09.398028 2026] [:error] [pid 27750:tid 27830] [client 74.248.18.153:48924] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acWs4YaSil5rd17ieLw46QAAAIw"]
[Fri Mar 27 06:02:10.326823 2026] [:error] [pid 27851:tid 27881] [client 74.248.18.153:64585] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acWs4nR2ccxe3RMCLboSDAAAANc"]
[Fri Mar 27 06:02:11.915462 2026] [:error] [pid 27743:tid 27771] [client 74.248.18.153:60121] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acWs4yA46UYYLqzw99D9nQAAAAc"]
[Fri Mar 27 06:02:12.662496 2026] [:error] [pid 27749:tid 27814] [client 74.248.18.153:55730] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acWs5MEqyoMni2Q6_X5fLQAAAFc"]
[Fri Mar 27 06:02:13.225034 2026] [:error] [pid 63897:tid 63913] [client 74.248.18.153:55702] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acWs5WVSkmYmLu7ycYj1iAAAAQ4"]
[Fri Mar 27 06:02:13.978758 2026] [:error] [pid 4293:tid 4304] [client 74.248.18.153:55395] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acWs5ZLjeJUC3OKtEx9WswAAAUk"]
[Fri Mar 27 06:02:14.919163 2026] [:error] [pid 4293:tid 4297] [client 74.248.18.153:48867] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acWs5pLjeJUC3OKtEx9WtQAAAUI"]
[Fri Mar 27 06:02:15.606199 2026] [:error] [pid 4293:tid 4311] [client 74.248.18.153:55419] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acWs55LjeJUC3OKtEx9WtwAAAVA"]
[Fri Mar 27 06:02:16.305458 2026] [:error] [pid 63897:tid 63922] [client 74.248.18.153:59492] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "acWs6GVSkmYmLu7ycYj1lQAAARc"]
[Fri Mar 27 06:02:16.964134 2026] [:error] [pid 27749:tid 27794] [client 74.248.18.153:64610] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "acWs6MEqyoMni2Q6_X5fQAAAAEM"]
[Fri Mar 27 06:02:17.908480 2026] [:error] [pid 27749:tid 27792] [client 74.248.18.153:59647] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "acWs6cEqyoMni2Q6_X5fQwAAAEE"]
[Fri Mar 27 06:02:18.897137 2026] [:error] [pid 27750:tid 27842] [client 74.248.18.153:62525] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "acWs6oaSil5rd17ieLw47gAAAJg"]
[Fri Mar 27 06:02:20.326809 2026] [:error] [pid 27750:tid 27821] [client 74.248.18.153:48839] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acWs7IaSil5rd17ieLw48QAAAIM"]
[Fri Mar 27 06:02:21.981749 2026] [:error] [pid 4341:tid 4352] [client 74.248.18.153:60124] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acWs7eKJWrNB5dMlEREMwQAAAYk"]
[Fri Mar 27 06:02:22.997101 2026] [:error] [pid 4341:tid 4344] [client 74.248.18.153:59508] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acWs7uKJWrNB5dMlEREMxgAAAYE"]
[Fri Mar 27 06:02:24.233731 2026] [:error] [pid 4293:tid 4318] [client 74.248.18.153:59507] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acWs8JLjeJUC3OKtEx9WvwAAAVc"]
[Fri Mar 27 06:02:25.873767 2026] [:error] [pid 63897:tid 63914] [client 74.248.18.153:7147] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acWs8WVSkmYmLu7ycYj1sgAAAQ8"]
[Fri Mar 27 06:02:28.085642 2026] [:error] [pid 27743:tid 27770] [client 74.248.18.153:51089] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acWs9CA46UYYLqzw99D9tAAAAAY"]
[Fri Mar 27 06:02:29.361182 2026] [:error] [pid 4293:tid 4303] [client 74.248.18.153:59469] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acWs9ZLjeJUC3OKtEx9WxwAAAUg"]
[Fri Mar 27 06:02:30.225231 2026] [:error] [pid 63897:tid 63914] [client 74.248.18.153:55688] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acWs9mVSkmYmLu7ycYj1wwAAAQ8"]
[Fri Mar 27 06:02:31.331024 2026] [:error] [pid 27750:tid 27827] [client 74.248.18.153:64626] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acWs94aSil5rd17ieLw4_AAAAIk"]
[Fri Mar 27 06:02:32.350335 2026] [:error] [pid 4341:tid 4347] [client 74.248.18.153:54492] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acWs-OKJWrNB5dMlEREM1gAAAYQ"]
[Fri Mar 27 06:02:33.317801 2026] [:error] [pid 27851:tid 27868] [client 74.248.18.153:59614] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acWs-XR2ccxe3RMCLboSRQAAAMo"]
[Fri Mar 27 06:02:35.119160 2026] [:error] [pid 27851:tid 27872] [client 74.248.18.153:60114] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "acWs-3R2ccxe3RMCLboSSQAAAM4"]
[Fri Mar 27 06:02:36.259128 2026] [:error] [pid 4293:tid 4309] [client 74.248.18.153:64635] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acWs_JLjeJUC3OKtEx9W1gAAAU4"]
[Fri Mar 27 06:02:37.178002 2026] [:error] [pid 4293:tid 4304] [client 74.248.18.153:61909] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acWs_ZLjeJUC3OKtEx9W3gAAAUk"]
[Fri Mar 27 06:02:37.908114 2026] [:error] [pid 4293:tid 4318] [client 74.248.18.153:64623] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acWs_ZLjeJUC3OKtEx9W4QAAAVc"]
[Fri Mar 27 06:02:38.800126 2026] [:error] [pid 4341:tid 4355] [client 74.248.18.153:47964] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acWs_uKJWrNB5dMlEREM6QAAAYw"]
[Fri Mar 27 06:02:39.812470 2026] [:error] [pid 27750:tid 27826] [client 74.248.18.153:54486] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acWs_4aSil5rd17ieLw5AQAAAIg"]
[Fri Mar 27 06:02:40.534877 2026] [:error] [pid 27750:tid 27827] [client 74.248.18.153:64588] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acWtAIaSil5rd17ieLw5AwAAAIk"]
[Fri Mar 27 06:02:41.511520 2026] [:error] [pid 4341:tid 4346] [client 74.248.18.153:7127] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acWtAeKJWrNB5dMlEREM8QAAAYM"]
[Fri Mar 27 06:02:42.335163 2026] [:error] [pid 4341:tid 4353] [client 74.248.18.153:6504] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acWtAuKJWrNB5dMlEREM8wAAAYo"]
[Fri Mar 27 06:02:43.000442 2026] [:error] [pid 27743:tid 27767] [client 74.248.18.153:54516] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acWtAiA46UYYLqzw99D9zgAAAAM"]
[Fri Mar 27 06:02:44.000585 2026] [:error] [pid 4341:tid 4364] [client 74.248.18.153:50875] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acWtA-KJWrNB5dMlEREM-QAAAZU"]
[Fri Mar 27 06:02:44.755672 2026] [:error] [pid 4341:tid 4367] [client 74.248.18.153:55378] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acWtBOKJWrNB5dMlEREM_AAAAZg"]
[Fri Mar 27 06:02:45.478176 2026] [:error] [pid 4341:tid 4361] [client 74.248.18.153:56931] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acWtBeKJWrNB5dMlEREM_gAAAZI"]
[Fri Mar 27 06:02:46.112653 2026] [:error] [pid 27851:tid 27875] [client 74.248.18.153:59900] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acWtBnR2ccxe3RMCLboSVgAAANE"]
[Fri Mar 27 06:02:46.973868 2026] [:error] [pid 27749:tid 27805] [client 74.248.18.153:6494] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acWtBsEqyoMni2Q6_X5fXwAAAE4"]
[Fri Mar 27 06:02:48.056278 2026] [:error] [pid 63897:tid 63910] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Fri Mar 27 06:02:48.316200 2026] [:error] [pid 63897:tid 63914] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Fri Mar 27 06:02:48.582345 2026] [:error] [pid 63897:tid 63915] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Fri Mar 27 06:02:48.843459 2026] [:error] [pid 63897:tid 63901] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Fri Mar 27 06:02:49.381382 2026] [:error] [pid 63897:tid 63906] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/buc.php
[Fri Mar 27 06:02:49.640581 2026] [:error] [pid 63897:tid 63913] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Fri Mar 27 06:02:49.906711 2026] [:error] [pid 63897:tid 63909] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Mar 27 06:02:50.165249 2026] [:error] [pid 63897:tid 63918] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Fri Mar 27 06:02:50.424137 2026] [:error] [pid 63897:tid 63912] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Fri Mar 27 06:02:50.683677 2026] [:error] [pid 63897:tid 63917] [client 74.248.18.153:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Fri Mar 27 06:02:50.942882 2026] [:error] [pid 63897:tid 63922] [client 74.248.18.153:59467] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "acWtCmVSkmYmLu7ycYj18wAAARc"]
[Fri Mar 27 06:02:52.256902 2026] [:error] [pid 63897:tid 63921] [client 74.248.18.153:47981] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "acWtDGVSkmYmLu7ycYj1-AAAARY"]
[Fri Mar 27 06:02:54.092104 2026] [:error] [pid 27851:tid 27867] [client 74.248.18.153:6523] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "acWtDnR2ccxe3RMCLboSVwAAAMk"]
[Fri Mar 27 06:02:55.326707 2026] [:error] [pid 63897:tid 63917] [client 74.248.18.153:62505] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "acWtD2VSkmYmLu7ycYj1_wAAARI"]
[Fri Mar 27 06:02:56.387348 2026] [:error] [pid 63897:tid 63913] [client 74.248.18.153:64637] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acWtEGVSkmYmLu7ycYj2BQAAAQ4"]
[Fri Mar 27 06:02:57.098434 2026] [:error] [pid 4341:tid 4358] [client 74.248.18.153:55743] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acWtEeKJWrNB5dMlERENDwAAAY8"]
[Fri Mar 27 06:02:59.955693 2026] [:error] [pid 27851:tid 27872] [client 74.248.18.153:55365] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acWtE3R2ccxe3RMCLboSXAAAAM4"]
[Fri Mar 27 06:03:01.333752 2026] [:error] [pid 4293:tid 4301] [client 74.248.18.153:62499] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acWtFZLjeJUC3OKtEx9W7gAAAUY"]
[Fri Mar 27 06:03:03.227186 2026] [:error] [pid 27749:tid 27812] [client 74.248.18.153:59472] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acWtF8EqyoMni2Q6_X5fcQAAAFU"]
[Fri Mar 27 06:03:05.011019 2026] [:error] [pid 27743:tid 27775] [client 74.248.18.153:62508] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acWtGSA46UYYLqzw99D96QAAAAs"]
[Fri Mar 27 06:03:08.714522 2026] [:error] [pid 4293:tid 4296] [client 74.248.18.153:50861] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acWtHJLjeJUC3OKtEx9W_QAAAUE"]
[Fri Mar 27 06:03:09.354321 2026] [:error] [pid 4293:tid 4316] [client 74.248.18.153:7146] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acWtHZLjeJUC3OKtEx9XAgAAAVU"]
[Fri Mar 27 06:03:10.390074 2026] [:error] [pid 63897:tid 63902] [client 74.248.18.153:47951] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acWtHmVSkmYmLu7ycYj2IQAAAQM"]
[Fri Mar 27 06:03:11.749697 2026] [:error] [pid 27851:tid 27859] [client 74.248.18.153:59594] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acWtH3R2ccxe3RMCLboSZwAAAME"]
[Fri Mar 27 06:03:12.988827 2026] [:error] [pid 4293:tid 4319] [client 74.248.18.153:55727] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acWtIJLjeJUC3OKtEx9XBQAAAVg"]
[Fri Mar 27 06:03:14.154022 2026] [:error] [pid 4293:tid 4313] [client 74.248.18.153:60125] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acWtIpLjeJUC3OKtEx9XCwAAAVI"]
[Fri Mar 27 06:03:15.457684 2026] [:error] [pid 4293:tid 4300] [client 74.248.18.153:7134] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acWtI5LjeJUC3OKtEx9XDwAAAUU"]
[Fri Mar 27 06:03:16.509698 2026] [:error] [pid 27851:tid 27866] [client 74.248.18.153:64616] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acWtJHR2ccxe3RMCLboScAAAAMg"]
[Fri Mar 27 06:03:17.539380 2026] [:error] [pid 27749:tid 27814] [client 74.248.18.153:60111] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acWtJcEqyoMni2Q6_X5fhgAAAFc"]
[Fri Mar 27 06:03:18.674127 2026] [:error] [pid 27851:tid 27859] [client 74.248.18.153:59108] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acWtJnR2ccxe3RMCLboSdQAAAME"]
[Fri Mar 27 06:03:19.485044 2026] [:error] [pid 27851:tid 27881] [client 74.248.18.153:7132] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acWtJ3R2ccxe3RMCLboSeAAAANc"]
[Fri Mar 27 06:03:20.118654 2026] [:error] [pid 27749:tid 27795] [client 74.248.18.153:7136] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acWtKMEqyoMni2Q6_X5fhwAAAEQ"]
[Fri Mar 27 06:03:20.813458 2026] [:error] [pid 27851:tid 27869] [client 74.248.18.153:50822] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acWtKHR2ccxe3RMCLboSfgAAAMs"]
[Fri Mar 27 06:03:21.425980 2026] [:error] [pid 27743:tid 27788] [client 74.248.18.153:55371] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acWtKSA46UYYLqzw99D98AAAABg"]
[Fri Mar 27 06:03:22.297946 2026] [:error] [pid 27743:tid 27783] [client 74.248.18.153:48881] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acWtKiA46UYYLqzw99D98QAAABM"]
[Fri Mar 27 06:03:23.240105 2026] [:error] [pid 27851:tid 27863] [client 74.248.18.153:64638] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acWtK3R2ccxe3RMCLboShwAAAMU"]
[Fri Mar 27 06:03:23.970167 2026] [:error] [pid 27851:tid 27865] [client 74.248.18.153:6519] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acWtK3R2ccxe3RMCLboSiAAAAMc"]
[Fri Mar 27 06:03:24.610992 2026] [:error] [pid 4341:tid 4359] [client 74.248.18.153:54523] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "acWtLOKJWrNB5dMlERENLQAAAZA"]
[Fri Mar 27 06:03:25.232034 2026] [:error] [pid 4341:tid 4362] [client 74.248.18.153:64622] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acWtLeKJWrNB5dMlERENLgAAAZM"]
[Fri Mar 27 06:03:25.927524 2026] [:error] [pid 27750:tid 27836] [client 74.248.18.153:55380] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acWtLYaSil5rd17ieLw5NAAAAJI"]
[Fri Mar 27 06:03:26.630477 2026] [:error] [pid 27750:tid 27833] [client 74.248.18.153:56911] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acWtLoaSil5rd17ieLw5NgAAAI8"]
[Fri Mar 27 06:03:27.761060 2026] [:error] [pid 4341:tid 4366] [client 74.248.18.153:47957] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acWtL-KJWrNB5dMlERENMwAAAZc"]
[Fri Mar 27 06:03:28.904557 2026] [:error] [pid 27851:tid 27879] [client 74.248.18.153:56646] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acWtMHR2ccxe3RMCLboSjgAAANU"]
[Fri Mar 27 06:03:29.840710 2026] [:error] [pid 27743:tid 27786] [client 74.248.18.153:57179] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acWtMSA46UYYLqzw99D98wAAABY"]
[Fri Mar 27 06:03:30.726964 2026] [:error] [pid 27749:tid 27795] [client 74.248.18.153:59468] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acWtMsEqyoMni2Q6_X5fjgAAAEQ"]
[Fri Mar 27 06:03:32.438568 2026] [:error] [pid 4293:tid 4313] [client 74.248.18.153:57195] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acWtNJLjeJUC3OKtEx9XJgAAAVI"]
[Fri Mar 27 06:03:33.251468 2026] [:error] [pid 4293:tid 4298] [client 74.248.18.153:62471] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acWtNZLjeJUC3OKtEx9XKgAAAUM"]
[Fri Mar 27 06:03:33.881951 2026] [:error] [pid 27743:tid 27785] [client 74.248.18.153:55726] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acWtNSA46UYYLqzw99D99gAAABU"]
[Fri Mar 27 06:03:34.669414 2026] [:error] [pid 27743:tid 27772] [client 74.248.18.153:55718] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acWtNiA46UYYLqzw99D99wAAAAg"]
[Fri Mar 27 06:03:36.647777 2026] [:error] [pid 63897:tid 63918] [client 74.248.18.153:60149] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acWtOGVSkmYmLu7ycYj2NwAAARM"]
[Fri Mar 27 06:03:38.258110 2026] [:error] [pid 4293:tid 4305] [client 74.248.18.153:60120] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acWtOpLjeJUC3OKtEx9XMAAAAUo"]
[Fri Mar 27 06:03:39.819887 2026] [:error] [pid 4341:tid 4364] [client 74.248.18.153:48854] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acWtO-KJWrNB5dMlERENSQAAAZU"]
[Fri Mar 27 06:03:42.286559 2026] [:error] [pid 4293:tid 4312] [client 74.248.18.153:56661] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acWtPpLjeJUC3OKtEx9XMwAAAVE"]
[Fri Mar 27 06:03:46.425086 2026] [:error] [pid 4293:tid 4308] [client 74.248.18.153:44355] [client 74.248.18.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acWtQpLjeJUC3OKtEx9XOgAAAU0"]
[Fri Mar 27 06:03:50.032334 2026] [:error] [pid 27750:tid 27818] [client 74.248.18.153:6489] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Fri Mar 27 06:03:50.302999 2026] [:error] [pid 27750:tid 27823] [client 74.248.18.153:6489] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Fri Mar 27 06:04:27.110067 2026] [:error] [pid 4293:tid 4308] [client 20.24.77.78:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Fri Mar 27 06:04:27.233344 2026] [:error] [pid 4293:tid 4303] [client 20.24.77.78:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Mar 27 06:04:27.356872 2026] [:error] [pid 4293:tid 4307] [client 20.24.77.78:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri Mar 27 06:04:27.479945 2026] [:error] [pid 4293:tid 4300] [client 20.24.77.78:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Fri Mar 27 06:04:28.136892 2026] [:error] [pid 4293:tid 4304] [client 20.24.77.78:8942] File does not exist: /usr/local/apache/htdocs/suspended-page/Canonical.php
[Fri Mar 27 06:04:28.511616 2026] [:error] [pid 4293:tid 4303] [client 20.24.77.78:8942] [client 20.24.77.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Content/Type/index.php"] [unique_id "acWtbJLjeJUC3OKtEx9X5gAAAUg"]
[Fri Mar 27 06:04:29.014816 2026] [:error] [pid 63897:tid 63903] [client 20.24.77.78:6644] [client 20.24.77.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Content/Type/index.php"] [unique_id "acWtbWVSkmYmLu7ycYj2jAAAAQQ"]
[Fri Mar 27 06:04:29.531315 2026] [:error] [pid 4293:tid 4297] [client 20.24.77.78:9548] [client 20.24.77.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Content/Type/index.php"] [unique_id "acWtbZLjeJUC3OKtEx9X6gAAAUI"]
[Fri Mar 27 06:04:30.016653 2026] [:error] [pid 4293:tid 4311] [client 20.24.77.78:3059] [client 20.24.77.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Content/Type/index.php"] [unique_id "acWtbpLjeJUC3OKtEx9X7QAAAVA"]
[Fri Mar 27 08:36:44.802742 2026] [:error] [pid 4341:tid 4353] [client 51.107.9.165:55458] [client 51.107.9.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "acXRHOKJWrNB5dMlERFKuQAAAYo"]
[Fri Mar 27 10:21:38.281776 2026] [:error] [pid 27851:tid 27869] [client 216.81.200.83:33484] [client 216.81.200.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "acXpsnR2ccxe3RMCLbpbdgAAAMs"]
[Fri Mar 27 15:35:45.624058 2026] [:error] [pid 27743:tid 27773] [client 185.198.240.180:54185] [client 185.198.240.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.180, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "acYzUSA46UYYLqzw99BXogAAAAk"]
[Fri Mar 27 15:35:45.627469 2026] [:error] [pid 27743:tid 27773] [client 185.198.240.180:54185] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 27 18:12:52.957794 2026] [:error] [pid 4341:tid 4363] [client 103.74.169.229:64705] [client 103.74.169.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.74.169.229, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acZYJOKJWrNB5dMlERF2nwAAAZQ"]
[Fri Mar 27 18:12:52.970875 2026] [:error] [pid 4341:tid 4363] [client 103.74.169.229:64705] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 27 18:28:12.451326 2026] [:error] [pid 4341:tid 4362] [client 27.107.228.82:64193] [client 27.107.228.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.107.228.82, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acZbvOKJWrNB5dMlERF92AAAAZM"]
[Fri Mar 27 18:28:12.457080 2026] [:error] [pid 4341:tid 4362] [client 27.107.228.82:64193] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 27 19:58:18.674776 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Fri Mar 27 19:58:18.985666 2026] [:error] [pid 4293:tid 4314] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/xocx.php
[Fri Mar 27 19:58:19.225639 2026] [:error] [pid 4293:tid 4309] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/sodas.php
[Fri Mar 27 19:58:19.546270 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/zks.php
[Fri Mar 27 19:58:19.931738 2026] [:error] [pid 4293:tid 4301] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/xbc.php
[Fri Mar 27 19:58:20.186121 2026] [:error] [pid 4293:tid 4295] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/b1ack2.php
[Fri Mar 27 19:58:20.424615 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/ne2026.php
[Fri Mar 27 19:58:20.784887 2026] [:error] [pid 4293:tid 4318] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/duea.php
[Fri Mar 27 19:58:21.071202 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Fri Mar 27 19:58:21.382230 2026] [:error] [pid 4293:tid 4300] [client 20.203.249.159:64556] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa.php
[Fri Mar 27 19:58:21.747166 2026] [:error] [pid 4293:tid 4316] [client 20.203.249.159:64556] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sace.php"] [unique_id "acZw3ZLjeJUC3OKtEx96YgAAAVU"]
[Fri Mar 27 19:58:22.958151 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:61821] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sace.php"] [unique_id "acZw3pLjeJUC3OKtEx96aQAAAVY"]
[Fri Mar 27 19:58:23.612537 2026] [:error] [pid 27851:tid 27869] [client 20.203.249.159:60089] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sace.php"] [unique_id "acZw33R2ccxe3RMCLbrslgAAAMs"]
[Fri Mar 27 19:58:27.588561 2026] [:error] [pid 63897:tid 63920] [client 20.203.249.159:59199] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sace.php"] [unique_id "acZw42VSkmYmLu7ycYhLFwAAARU"]
[Fri Mar 27 19:58:29.869541 2026] [:error] [pid 4341:tid 4345] [client 20.203.249.159:64538] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acZw5eKJWrNB5dMlERGergAAAYI"]
[Fri Mar 27 19:58:31.506991 2026] [:error] [pid 4341:tid 4347] [client 20.203.249.159:62821] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acZw5-KJWrNB5dMlERGetAAAAYQ"]
[Fri Mar 27 19:58:32.463703 2026] [:error] [pid 63897:tid 63922] [client 20.203.249.159:54735] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acZw6GVSkmYmLu7ycYhLGwAAARc"]
[Fri Mar 27 19:58:33.485141 2026] [:error] [pid 63897:tid 63910] [client 20.203.249.159:60094] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acZw6WVSkmYmLu7ycYhLIgAAAQs"]
[Fri Mar 27 19:58:35.960454 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:54656] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "acZw65LjeJUC3OKtEx96hwAAAUw"]
[Fri Mar 27 19:58:38.573949 2026] [:error] [pid 4293:tid 4301] [client 20.203.249.159:61786] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "acZw7pLjeJUC3OKtEx96igAAAUY"]
[Fri Mar 27 19:58:39.381991 2026] [:error] [pid 27743:tid 27775] [client 20.203.249.159:64549] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "acZw7yA46UYYLqzw99DbbgAAAAs"]
[Fri Mar 27 19:58:40.969607 2026] [:error] [pid 27743:tid 27786] [client 20.203.249.159:54751] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "acZw8CA46UYYLqzw99DbeAAAABY"]
[Fri Mar 27 19:58:42.890665 2026] [:error] [pid 63897:tid 63908] [client 20.203.249.159:61687] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acZw8mVSkmYmLu7ycYhLKQAAAQk"]
[Fri Mar 27 19:58:44.983491 2026] [:error] [pid 4341:tid 4359] [client 20.203.249.159:62751] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acZw9OKJWrNB5dMlERGe2AAAAZA"]
[Fri Mar 27 19:58:46.899364 2026] [:error] [pid 4293:tid 4295] [client 20.203.249.159:62840] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acZw9pLjeJUC3OKtEx96lAAAAUA"]
[Fri Mar 27 19:58:48.213340 2026] [:error] [pid 27749:tid 27814] [client 20.203.249.159:62796] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "acZw-MEqyoMni2Q6_X7v8gAAAFc"]
[Fri Mar 27 19:58:50.595920 2026] [:error] [pid 27851:tid 27869] [client 20.203.249.159:61808] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acZw-nR2ccxe3RMCLbrsqwAAAMs"]
[Fri Mar 27 19:58:51.282386 2026] [:error] [pid 4293:tid 4296] [client 20.203.249.159:58955] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acZw-5LjeJUC3OKtEx96ogAAAUE"]
[Fri Mar 27 19:58:53.084956 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:60095] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acZw_ZLjeJUC3OKtEx96qAAAAU0"]
[Fri Mar 27 19:58:54.167546 2026] [:error] [pid 4293:tid 4304] [client 20.203.249.159:64548] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "acZw_pLjeJUC3OKtEx96rwAAAUk"]
[Fri Mar 27 19:58:54.854146 2026] [:error] [pid 63897:tid 63923] [client 20.203.249.159:54782] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZw_mVSkmYmLu7ycYhLNAAAARg"]
[Fri Mar 27 19:58:57.348657 2026] [:error] [pid 4341:tid 4349] [client 20.203.249.159:60127] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZxAeKJWrNB5dMlERGe4wAAAYY"]
[Fri Mar 27 19:58:59.098660 2026] [:error] [pid 63897:tid 63906] [client 20.203.249.159:58997] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZxA2VSkmYmLu7ycYhLOQAAAQc"]
[Fri Mar 27 19:59:00.116963 2026] [:error] [pid 27743:tid 27788] [client 20.203.249.159:61819] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acZxBCA46UYYLqzw99DbjgAAABg"]
[Fri Mar 27 19:59:01.350533 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:58978] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acZxBZLjeJUC3OKtEx96tQAAAUw"]
[Fri Mar 27 19:59:02.085658 2026] [:error] [pid 27749:tid 27811] [client 20.203.249.159:60137] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acZxBsEqyoMni2Q6_X7v_gAAAFQ"]
[Fri Mar 27 19:59:03.235870 2026] [:error] [pid 27750:tid 27838] [client 20.203.249.159:60122] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acZxB4aSil5rd17ieLzvIQAAAJQ"]
[Fri Mar 27 19:59:04.497920 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:62789] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acZxCJLjeJUC3OKtEx96xAAAAU0"]
[Fri Mar 27 19:59:05.326718 2026] [:error] [pid 4293:tid 4296] [client 20.203.249.159:62732] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acZxCZLjeJUC3OKtEx96ygAAAUE"]
[Fri Mar 27 19:59:06.534497 2026] [:error] [pid 27851:tid 27860] [client 20.203.249.159:61762] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acZxCnR2ccxe3RMCLbrsuAAAAMI"]
[Fri Mar 27 19:59:07.201602 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:54670] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acZxC5LjeJUC3OKtEx960gAAAVQ"]
[Fri Mar 27 19:59:08.081595 2026] [:error] [pid 27851:tid 27866] [client 20.203.249.159:54748] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "acZxDHR2ccxe3RMCLbrsvAAAAMg"]
[Fri Mar 27 19:59:10.070763 2026] [:error] [pid 4341:tid 4353] [client 20.203.249.159:60084] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acZxDuKJWrNB5dMlERGe7AAAAYo"]
[Fri Mar 27 19:59:10.859813 2026] [:error] [pid 4341:tid 4361] [client 20.203.249.159:58954] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acZxDuKJWrNB5dMlERGe7gAAAZI"]
[Fri Mar 27 19:59:12.058584 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:61689] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acZxEJLjeJUC3OKtEx962wAAAUM"]
[Fri Mar 27 19:59:12.880056 2026] [:error] [pid 4341:tid 4367] [client 20.203.249.159:58962] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "acZxEOKJWrNB5dMlERGe8QAAAZg"]
[Fri Mar 27 19:59:16.400475 2026] [:error] [pid 27743:tid 27784] [client 20.203.249.159:61646] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless13.php"] [unique_id "acZxFCA46UYYLqzw99DbrwAAABQ"]
[Fri Mar 27 19:59:17.442983 2026] [:error] [pid 27851:tid 27859] [client 20.203.249.159:60091] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless13.php"] [unique_id "acZxFXR2ccxe3RMCLbrswwAAAME"]
[Fri Mar 27 19:59:19.235684 2026] [:error] [pid 27750:tid 27834] [client 20.203.249.159:61655] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless13.php"] [unique_id "acZxF4aSil5rd17ieLzvLgAAAJA"]
[Fri Mar 27 19:59:21.278204 2026] [:error] [pid 4293:tid 4310] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/bless13.php
[Fri Mar 27 19:59:21.578777 2026] [:error] [pid 4293:tid 4306] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mter.php
[Fri Mar 27 19:59:21.830873 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Fri Mar 27 19:59:22.157021 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Fri Mar 27 19:59:22.435981 2026] [:error] [pid 4293:tid 4313] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Fri Mar 27 19:59:22.727912 2026] [:error] [pid 4293:tid 4304] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Fri Mar 27 19:59:22.986768 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Fri Mar 27 19:59:23.236634 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/settings.php
[Fri Mar 27 19:59:23.476175 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Fri Mar 27 19:59:23.767866 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/eee.php
[Fri Mar 27 19:59:24.007052 2026] [:error] [pid 4293:tid 4316] [client 20.203.249.159:61817] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Fri Mar 27 19:59:24.271049 2026] [:error] [pid 4293:tid 4318] [client 20.203.249.159:61817] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acZxHJLjeJUC3OKtEx97BQAAAVc"]
[Fri Mar 27 19:59:26.898188 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:59188] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acZxHpLjeJUC3OKtEx97FQAAAU0"]
[Fri Mar 27 19:59:29.376880 2026] [:error] [pid 4293:tid 4301] [client 20.203.249.159:61680] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acZxIZLjeJUC3OKtEx97JAAAAUY"]
[Fri Mar 27 19:59:30.519407 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:61778] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "acZxIpLjeJUC3OKtEx97LQAAAVQ"]
[Fri Mar 27 19:59:32.388918 2026] [:error] [pid 27743:tid 27773] [client 20.203.249.159:64175] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "acZxJCA46UYYLqzw99Db1QAAAAk"]
[Fri Mar 27 19:59:33.411409 2026] [:error] [pid 4341:tid 4351] [client 20.203.249.159:62828] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "acZxJeKJWrNB5dMlERGfBwAAAYg"]
[Fri Mar 27 19:59:38.127513 2026] [:error] [pid 4293:tid 4301] [client 20.203.249.159:62761] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "acZxKpLjeJUC3OKtEx97QwAAAUY"]
[Fri Mar 27 19:59:39.136706 2026] [:error] [pid 27743:tid 27766] [client 20.203.249.159:60036] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "acZxKyA46UYYLqzw99Db5gAAAAI"]
[Fri Mar 27 19:59:41.296484 2026] [:error] [pid 4341:tid 4352] [client 20.203.249.159:62839] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "acZxLeKJWrNB5dMlERGfGAAAAYk"]
[Fri Mar 27 19:59:42.732800 2026] [:error] [pid 27851:tid 27872] [client 20.203.249.159:54777] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "acZxLnR2ccxe3RMCLbrszwAAAM4"]
[Fri Mar 27 19:59:43.738570 2026] [:error] [pid 27743:tid 27774] [client 20.203.249.159:54779] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "acZxLyA46UYYLqzw99Db8gAAAAo"]
[Fri Mar 27 19:59:45.153808 2026] [:error] [pid 27743:tid 27787] [client 20.203.249.159:62720] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "acZxMSA46UYYLqzw99Db9wAAABc"]
[Fri Mar 27 19:59:47.270329 2026] [:error] [pid 4341:tid 4352] [client 20.203.249.159:62795] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "acZxM-KJWrNB5dMlERGfHgAAAYk"]
[Fri Mar 27 19:59:48.647609 2026] [:error] [pid 27743:tid 27767] [client 20.203.249.159:54724] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "acZxNCA46UYYLqzw99DcBwAAAAM"]
[Fri Mar 27 19:59:50.775675 2026] [:error] [pid 4293:tid 4306] [client 20.203.249.159:61656] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "acZxNpLjeJUC3OKtEx97bgAAAUs"]
[Fri Mar 27 20:00:00.442925 2026] [:error] [pid 27743:tid 27770] [client 20.203.249.159:59168] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "acZxQCA46UYYLqzw99DcIAAAAAY"]
[Fri Mar 27 20:00:01.602829 2026] [:error] [pid 4293:tid 4304] [client 20.203.249.159:64136] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sty.php"] [unique_id "acZxQZLjeJUC3OKtEx97iAAAAUk"]
[Fri Mar 27 20:00:03.283437 2026] [:error] [pid 4341:tid 4356] [client 20.203.249.159:64186] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sty.php"] [unique_id "acZxQ-KJWrNB5dMlERGfNgAAAY0"]
[Fri Mar 27 20:00:04.482662 2026] [:error] [pid 27750:tid 27838] [client 20.203.249.159:25463] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sty.php"] [unique_id "acZxRIaSil5rd17ieLzvSQAAAJQ"]
[Fri Mar 27 20:00:06.632045 2026] [:error] [pid 4341:tid 4354] [client 20.203.249.159:64179] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sty.php"] [unique_id "acZxRuKJWrNB5dMlERGfQgAAAYs"]
[Fri Mar 27 20:00:07.796021 2026] [:error] [pid 27749:tid 27793] [client 20.203.249.159:62823] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "acZxR8EqyoMni2Q6_X7wHgAAAEI"]
[Fri Mar 27 20:00:09.278197 2026] [:error] [pid 4341:tid 4362] [client 20.203.249.159:60056] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "acZxSeKJWrNB5dMlERGfSAAAAZM"]
[Fri Mar 27 20:00:10.616814 2026] [:error] [pid 4341:tid 4359] [client 20.203.249.159:61691] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "acZxSuKJWrNB5dMlERGfTQAAAZA"]
[Fri Mar 27 20:00:11.627740 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:60105] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/txets.php"] [unique_id "acZxS5LjeJUC3OKtEx97kAAAAUo"]
[Fri Mar 27 20:00:13.269775 2026] [:error] [pid 27743:tid 27769] [client 20.203.249.159:64514] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acZxTSA46UYYLqzw99DcMQAAAAU"]
[Fri Mar 27 20:00:14.976450 2026] [:error] [pid 4293:tid 4310] [client 20.203.249.159:64173] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acZxTpLjeJUC3OKtEx97lgAAAU8"]
[Fri Mar 27 20:00:16.534580 2026] [:error] [pid 4341:tid 4343] [client 20.203.249.159:61783] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acZxUOKJWrNB5dMlERGfUAAAAYA"]
[Fri Mar 27 20:00:17.874389 2026] [:error] [pid 63897:tid 63918] [client 20.203.249.159:62802] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acZxUWVSkmYmLu7ycYhLbwAAARM"]
[Fri Mar 27 20:00:19.106086 2026] [:error] [pid 27743:tid 27767] [client 20.203.249.159:64191] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acZxUyA46UYYLqzw99DcQgAAAAM"]
[Fri Mar 27 20:00:20.077399 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:54754] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acZxVJLjeJUC3OKtEx97oQAAAUw"]
[Fri Mar 27 20:00:20.928524 2026] [:error] [pid 4341:tid 4353] [client 20.203.249.159:60158] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acZxVOKJWrNB5dMlERGfVQAAAYo"]
[Fri Mar 27 20:00:22.731498 2026] [:error] [pid 4341:tid 4364] [client 20.203.249.159:61768] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acZxVuKJWrNB5dMlERGfXwAAAZU"]
[Fri Mar 27 20:00:23.829556 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:64567] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "acZxV5LjeJUC3OKtEx97qgAAAUw"]
[Fri Mar 27 20:00:27.423010 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Fri Mar 27 20:00:27.676501 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Mar 27 20:00:27.921408 2026] [:error] [pid 4293:tid 4313] [client 20.203.249.159:59144] [client 20.203.249.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.203.249.159, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acZxW5LjeJUC3OKtEx97uAAAAVI"]
[Fri Mar 27 20:00:27.924852 2026] [:error] [pid 4293:tid 4313] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 27 20:00:28.163137 2026] [:error] [pid 4293:tid 4314] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Fri Mar 27 20:00:28.401912 2026] [:error] [pid 4293:tid 4310] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Mar 27 20:00:28.639871 2026] [:error] [pid 4293:tid 4296] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Mar 27 20:00:28.905661 2026] [:error] [pid 4293:tid 4319] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Mar 27 20:00:29.219648 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Mar 27 20:00:29.464751 2026] [:error] [pid 4293:tid 4304] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Mar 27 20:00:29.722899 2026] [:error] [pid 4293:tid 4312] [client 20.203.249.159:59144] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Mar 27 20:00:29.961525 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:59144] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZxXZLjeJUC3OKtEx97wgAAAU0"]
[Fri Mar 27 20:00:32.338074 2026] [:error] [pid 27749:tid 27803] [client 20.203.249.159:61672] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZxYMEqyoMni2Q6_X7wNwAAAEw"]
[Fri Mar 27 20:00:33.731926 2026] [:error] [pid 27743:tid 27771] [client 20.203.249.159:61686] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZxYSA46UYYLqzw99DccwAAAAc"]
[Fri Mar 27 20:00:35.970476 2026] [:error] [pid 27743:tid 27785] [client 20.203.249.159:59151] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZxYyA46UYYLqzw99DchAAAABU"]
[Fri Mar 27 20:00:37.766570 2026] [:error] [pid 63897:tid 63900] [client 20.203.249.159:64177] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZxZWVSkmYmLu7ycYhLhQAAAQE"]
[Fri Mar 27 20:00:39.328683 2026] [:error] [pid 27750:tid 27831] [client 20.203.249.159:54725] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZxZ4aSil5rd17ieLzvYQAAAI0"]
[Fri Mar 27 20:00:40.777176 2026] [:error] [pid 4293:tid 4295] [client 20.203.249.159:64563] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZxaJLjeJUC3OKtEx97yAAAAUA"]
[Fri Mar 27 20:00:42.257067 2026] [:error] [pid 4293:tid 4299] [client 20.203.249.159:59180] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZxapLjeJUC3OKtEx97ygAAAUQ"]
[Fri Mar 27 20:00:43.835453 2026] [:error] [pid 27750:tid 27829] [client 20.203.249.159:61693] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acZxa4aSil5rd17ieLzvZQAAAIs"]
[Fri Mar 27 20:00:45.258660 2026] [:error] [pid 63897:tid 63914] [client 20.203.249.159:61673] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acZxbWVSkmYmLu7ycYhLkwAAAQ8"]
[Fri Mar 27 20:00:47.625414 2026] [:error] [pid 63897:tid 63915] [client 20.203.249.159:62833] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acZxb2VSkmYmLu7ycYhLngAAARA"]
[Fri Mar 27 20:00:50.549841 2026] [:error] [pid 4293:tid 4299] [client 20.203.249.159:61633] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file59.php"] [unique_id "acZxcpLjeJUC3OKtEx971gAAAUQ"]
[Fri Mar 27 20:00:51.684352 2026] [:error] [pid 27750:tid 27836] [client 20.203.249.159:54738] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acZxc4aSil5rd17ieLzvawAAAJI"]
[Fri Mar 27 20:00:53.209884 2026] [:error] [pid 27749:tid 27813] [client 20.203.249.159:51461] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acZxdcEqyoMni2Q6_X7wRAAAAFY"]
[Fri Mar 27 20:00:53.901067 2026] [:error] [pid 4341:tid 4347] [client 20.203.249.159:58987] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acZxdeKJWrNB5dMlERGfhgAAAYQ"]
[Fri Mar 27 20:00:55.321545 2026] [:error] [pid 27750:tid 27842] [client 20.203.249.159:62726] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "acZxd4aSil5rd17ieLzvbwAAAJg"]
[Fri Mar 27 20:00:56.810711 2026] [:error] [pid 27851:tid 27869] [client 20.203.249.159:51470] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acZxeHR2ccxe3RMCLbrtAwAAAMs"]
[Fri Mar 27 20:00:57.947723 2026] [:error] [pid 4293:tid 4306] [client 20.203.249.159:60114] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acZxeZLjeJUC3OKtEx975wAAAUs"]
[Fri Mar 27 20:01:00.199081 2026] [:error] [pid 63897:tid 63903] [client 20.203.249.159:64157] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acZxfGVSkmYmLu7ycYhLqwAAAQQ"]
[Fri Mar 27 20:01:01.243215 2026] [:error] [pid 63897:tid 63920] [client 20.203.249.159:60046] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "acZxfWVSkmYmLu7ycYhLrQAAARU"]
[Fri Mar 27 20:01:02.395166 2026] [:error] [pid 4293:tid 4300] [client 20.203.249.159:64555] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acZxfpLjeJUC3OKtEx977gAAAUU"]
[Fri Mar 27 20:01:04.073477 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:59001] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acZxgJLjeJUC3OKtEx978AAAAUw"]
[Fri Mar 27 20:01:07.747213 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:61671] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acZxg5LjeJUC3OKtEx97_AAAAUo"]
[Fri Mar 27 20:01:09.775596 2026] [:error] [pid 63897:tid 63912] [client 20.203.249.159:54730] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "acZxhWVSkmYmLu7ycYhLtgAAAQ0"]
[Fri Mar 27 20:01:10.697879 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:60034] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acZxhpLjeJUC3OKtEx98BQAAAUo"]
[Fri Mar 27 20:01:14.404433 2026] [:error] [pid 27750:tid 27824] [client 20.203.249.159:62818] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acZxioaSil5rd17ieLzvfAAAAIY"]
[Fri Mar 27 20:01:15.782875 2026] [:error] [pid 27750:tid 27831] [client 20.203.249.159:60093] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acZxi4aSil5rd17ieLzvggAAAI0"]
[Fri Mar 27 20:01:17.200644 2026] [:error] [pid 4341:tid 4344] [client 20.203.249.159:62826] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "acZxjeKJWrNB5dMlERGfmQAAAYE"]
[Fri Mar 27 20:01:18.770390 2026] [:error] [pid 27750:tid 27820] [client 20.203.249.159:62764] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acZxjoaSil5rd17ieLzvjwAAAII"]
[Fri Mar 27 20:01:20.413723 2026] [:error] [pid 4293:tid 4295] [client 20.203.249.159:61642] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acZxkJLjeJUC3OKtEx98JwAAAUA"]
[Fri Mar 27 20:01:21.599173 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:64550] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acZxkZLjeJUC3OKtEx98LQAAAUo"]
[Fri Mar 27 20:01:23.269839 2026] [:error] [pid 63897:tid 63906] [client 20.203.249.159:59150] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "acZxk2VSkmYmLu7ycYhLzwAAAQc"]
[Fri Mar 27 20:01:24.450758 2026] [:error] [pid 4341:tid 4355] [client 20.203.249.159:54661] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acZxlOKJWrNB5dMlERGfogAAAYw"]
[Fri Mar 27 20:01:27.301170 2026] [:error] [pid 4341:tid 4352] [client 20.203.249.159:61639] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acZxl-KJWrNB5dMlERGfpgAAAYk"]
[Fri Mar 27 20:01:29.282532 2026] [:error] [pid 4293:tid 4296] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Mar 27 20:01:29.815849 2026] [:error] [pid 4293:tid 4314] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Fri Mar 27 20:01:30.062365 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Fri Mar 27 20:01:30.301175 2026] [:error] [pid 4293:tid 4318] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Fri Mar 27 20:01:30.539189 2026] [:error] [pid 4293:tid 4300] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Fri Mar 27 20:01:30.776894 2026] [:error] [pid 4293:tid 4310] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Mar 27 20:01:31.038473 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Fri Mar 27 20:01:31.559086 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:54666] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Fri Mar 27 20:01:32.101036 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:54666] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxnJLjeJUC3OKtEx98TAAAAUw"]
[Fri Mar 27 20:01:33.583680 2026] [:error] [pid 27743:tid 27770] [client 20.203.249.159:27122] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxnSA46UYYLqzw99DcsAAAAAY"]
[Fri Mar 27 20:01:37.512732 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:58999] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxoZLjeJUC3OKtEx98YwAAAUw"]
[Fri Mar 27 20:01:39.338969 2026] [:error] [pid 63897:tid 63906] [client 20.203.249.159:64545] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxo2VSkmYmLu7ycYhL1wAAAQc"]
[Fri Mar 27 20:01:40.882956 2026] [:error] [pid 63897:tid 63914] [client 20.203.249.159:54775] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acZxpGVSkmYmLu7ycYhL3gAAAQ8"]
[Fri Mar 27 20:01:42.512982 2026] [:error] [pid 27743:tid 27788] [client 20.203.249.159:61797] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acZxpiA46UYYLqzw99DcvgAAABg"]
[Fri Mar 27 20:01:44.345625 2026] [:error] [pid 27750:tid 27838] [client 20.203.249.159:58964] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acZxqIaSil5rd17ieLzvqgAAAJQ"]
[Fri Mar 27 20:01:47.184309 2026] [:error] [pid 4341:tid 4367] [client 20.203.249.159:54713] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "acZxq-KJWrNB5dMlERGftAAAAZg"]
[Fri Mar 27 20:01:49.404025 2026] [:error] [pid 4293:tid 4313] [client 20.203.249.159:59182] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acZxrZLjeJUC3OKtEx98jAAAAVI"]
[Fri Mar 27 20:01:51.259638 2026] [:error] [pid 4341:tid 4363] [client 20.203.249.159:54765] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acZxr-KJWrNB5dMlERGfwgAAAZQ"]
[Fri Mar 27 20:01:52.605049 2026] [:error] [pid 63897:tid 63911] [client 20.203.249.159:60044] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acZxsGVSkmYmLu7ycYhL4gAAAQw"]
[Fri Mar 27 20:01:53.669444 2026] [:error] [pid 4293:tid 4304] [client 20.203.249.159:64558] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "acZxsZLjeJUC3OKtEx98rAAAAUk"]
[Fri Mar 27 20:01:55.049578 2026] [:error] [pid 27743:tid 27787] [client 20.203.249.159:62842] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxsyA46UYYLqzw99Dc0wAAABc"]
[Fri Mar 27 20:01:56.463298 2026] [:error] [pid 27743:tid 27769] [client 20.203.249.159:60113] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxtCA46UYYLqzw99Dc2AAAAAU"]
[Fri Mar 27 20:01:57.532350 2026] [:error] [pid 63897:tid 63919] [client 20.203.249.159:64528] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxtWVSkmYmLu7ycYhL5QAAARQ"]
[Fri Mar 27 20:01:58.594780 2026] [:error] [pid 63897:tid 63912] [client 20.203.249.159:64184] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "acZxtmVSkmYmLu7ycYhL6QAAAQ0"]
[Fri Mar 27 20:02:01.666161 2026] [:error] [pid 27743:tid 27775] [client 20.203.249.159:64190] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acZxuSA46UYYLqzw99Dc6wAAAAs"]
[Fri Mar 27 20:02:05.653546 2026] [:error] [pid 4341:tid 4364] [client 20.203.249.159:59140] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acZxveKJWrNB5dMlERGf1gAAAZU"]
[Fri Mar 27 20:02:07.233474 2026] [:error] [pid 4293:tid 4304] [client 20.203.249.159:61803] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acZxv5LjeJUC3OKtEx98wAAAAUk"]
[Fri Mar 27 20:02:11.037587 2026] [:error] [pid 27743:tid 27770] [client 20.203.249.159:27093] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acZxwyA46UYYLqzw99DdMAAAAAY"]
[Fri Mar 27 20:02:12.524719 2026] [:error] [pid 27743:tid 27765] [client 20.203.249.159:64147] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acZxxCA46UYYLqzw99DdZwAAAAE"]
[Fri Mar 27 20:02:14.663947 2026] [:error] [pid 4341:tid 4343] [client 20.203.249.159:59163] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acZxxuKJWrNB5dMlERGgAQAAAYA"]
[Fri Mar 27 20:02:16.471136 2026] [:error] [pid 27851:tid 27870] [client 20.203.249.159:60048] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acZxyHR2ccxe3RMCLbrtMwAAAMw"]
[Fri Mar 27 20:02:17.324117 2026] [:error] [pid 27851:tid 27858] [client 20.203.249.159:52747] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acZxyXR2ccxe3RMCLbrtNQAAAMA"]
[Fri Mar 27 20:02:18.880883 2026] [:error] [pid 27743:tid 27788] [client 20.203.249.159:58969] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acZxyiA46UYYLqzw99DddQAAABg"]
[Fri Mar 27 20:02:20.158635 2026] [:error] [pid 4293:tid 4301] [client 20.203.249.159:54766] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acZxzJLjeJUC3OKtEx98_QAAAUY"]
[Fri Mar 27 20:02:21.688150 2026] [:error] [pid 27743:tid 27771] [client 20.203.249.159:64575] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acZxzSA46UYYLqzw99DdfQAAAAc"]
[Fri Mar 27 20:02:24.310754 2026] [:error] [pid 27743:tid 27773] [client 20.203.249.159:62743] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ff1.php"] [unique_id "acZx0CA46UYYLqzw99DdhAAAAAk"]
[Fri Mar 27 20:02:25.619273 2026] [:error] [pid 27743:tid 27787] [client 20.203.249.159:64155] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acZx0SA46UYYLqzw99DdiAAAABc"]
[Fri Mar 27 20:02:26.724154 2026] [:error] [pid 27743:tid 27782] [client 20.203.249.159:60148] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acZx0iA46UYYLqzw99DdjQAAABI"]
[Fri Mar 27 20:02:28.054922 2026] [:error] [pid 4341:tid 4354] [client 20.203.249.159:60142] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acZx1OKJWrNB5dMlERGgGAAAAYs"]
[Fri Mar 27 20:02:29.399921 2026] [:error] [pid 4293:tid 4300] [client 20.203.249.159:59174] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "acZx1ZLjeJUC3OKtEx99FAAAAUU"]
[Fri Mar 27 20:02:30.265094 2026] [:error] [pid 4341:tid 4343] [client 20.203.249.159:51466] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acZx1uKJWrNB5dMlERGgIAAAAYA"]
[Fri Mar 27 20:02:31.325790 2026] [:error] [pid 4341:tid 4347] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Fri Mar 27 20:02:31.566910 2026] [:error] [pid 4341:tid 4357] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Fri Mar 27 20:02:31.888615 2026] [:error] [pid 4341:tid 4343] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Fri Mar 27 20:02:32.126418 2026] [:error] [pid 4341:tid 4359] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Mar 27 20:02:32.371501 2026] [:error] [pid 4341:tid 4345] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Fri Mar 27 20:02:32.715008 2026] [:error] [pid 4341:tid 4365] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Mar 27 20:02:34.520514 2026] [:error] [pid 4341:tid 4355] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Fri Mar 27 20:02:35.142021 2026] [:error] [pid 4341:tid 4361] [client 20.203.249.159:51486] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Mar 27 20:02:35.428066 2026] [:error] [pid 4341:tid 4360] [client 20.203.249.159:51486] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acZx2-KJWrNB5dMlERGgPQAAAZE"]
[Fri Mar 27 20:02:37.145483 2026] [:error] [pid 4293:tid 4296] [client 20.203.249.159:35434] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acZx3ZLjeJUC3OKtEx99MAAAAUE"]
[Fri Mar 27 20:02:38.100791 2026] [:error] [pid 27750:tid 27821] [client 20.203.249.159:58981] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acZx3oaSil5rd17ieLzvwwAAAIM"]
[Fri Mar 27 20:02:39.947180 2026] [:error] [pid 27749:tid 27811] [client 20.203.249.159:35416] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "acZx38EqyoMni2Q6_X7wcAAAAFQ"]
[Fri Mar 27 20:02:42.750636 2026] [:error] [pid 27749:tid 27800] [client 20.203.249.159:61637] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acZx4sEqyoMni2Q6_X7wdwAAAEk"]
[Fri Mar 27 20:02:44.715657 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:58951] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acZx5JLjeJUC3OKtEx99NwAAAUg"]
[Fri Mar 27 20:02:46.862131 2026] [:error] [pid 27750:tid 27819] [client 20.203.249.159:64543] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acZx5oaSil5rd17ieLzv1QAAAIE"]
[Fri Mar 27 20:02:48.074725 2026] [:error] [pid 27743:tid 27767] [client 20.203.249.159:58979] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acZx6CA46UYYLqzw99DdoQAAAAM"]
[Fri Mar 27 20:02:50.058048 2026] [:error] [pid 27743:tid 27776] [client 20.203.249.159:62805] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acZx6iA46UYYLqzw99DdpQAAAAw"]
[Fri Mar 27 20:02:51.952779 2026] [:error] [pid 4341:tid 4357] [client 20.203.249.159:64562] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acZx6-KJWrNB5dMlERGgWQAAAY4"]
[Fri Mar 27 20:02:53.631829 2026] [:error] [pid 63897:tid 63916] [client 20.203.249.159:60129] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acZx7WVSkmYmLu7ycYhMGgAAARE"]
[Fri Mar 27 20:02:54.686971 2026] [:error] [pid 27851:tid 27871] [client 20.203.249.159:61793] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "acZx7nR2ccxe3RMCLbrtTgAAAM0"]
[Fri Mar 27 20:02:56.929036 2026] [:error] [pid 63897:tid 63899] [client 20.203.249.159:61645] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acZx8GVSkmYmLu7ycYhMHQAAAQA"]
[Fri Mar 27 20:02:57.977396 2026] [:error] [pid 27749:tid 27798] [client 20.203.249.159:64181] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acZx8cEqyoMni2Q6_X7wegAAAEc"]
[Fri Mar 27 20:02:59.771045 2026] [:error] [pid 27743:tid 27764] [client 20.203.249.159:62758] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acZx8yA46UYYLqzw99DduAAAAAA"]
[Fri Mar 27 20:03:00.860407 2026] [:error] [pid 27750:tid 27842] [client 20.203.249.159:62770] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acZx9IaSil5rd17ieLzv3wAAAJg"]
[Fri Mar 27 20:03:02.885060 2026] [:error] [pid 27851:tid 27871] [client 20.203.249.159:61815] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acZx9nR2ccxe3RMCLbrtWwAAAM0"]
[Fri Mar 27 20:03:05.147080 2026] [:error] [pid 27743:tid 27773] [client 20.203.249.159:60041] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acZx-SA46UYYLqzw99DdwgAAAAk"]
[Fri Mar 27 20:03:07.695674 2026] [:error] [pid 4341:tid 4356] [client 20.203.249.159:62774] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acZx--KJWrNB5dMlERGgawAAAY0"]
[Fri Mar 27 20:03:08.746685 2026] [:error] [pid 4293:tid 4299] [client 20.203.249.159:64180] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acZx_JLjeJUC3OKtEx99cgAAAUQ"]
[Fri Mar 27 20:03:09.781180 2026] [:error] [pid 63897:tid 63899] [client 20.203.249.159:64141] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZx_WVSkmYmLu7ycYhMKAAAAQA"]
[Fri Mar 27 20:03:10.856901 2026] [:error] [pid 27851:tid 27870] [client 20.203.249.159:25422] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZx_nR2ccxe3RMCLbrtYwAAAMw"]
[Fri Mar 27 20:03:12.070042 2026] [:error] [pid 4293:tid 4319] [client 20.203.249.159:54692] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZyAJLjeJUC3OKtEx99dAAAAVg"]
[Fri Mar 27 20:03:13.876910 2026] [:error] [pid 4341:tid 4355] [client 20.203.249.159:59183] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "acZyAeKJWrNB5dMlERGgfAAAAYw"]
[Fri Mar 27 20:03:14.697381 2026] [:error] [pid 27851:tid 27860] [client 20.203.249.159:61652] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "acZyAnR2ccxe3RMCLbrtZwAAAMI"]
[Fri Mar 27 20:03:15.719826 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:51456] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "acZyA5LjeJUC3OKtEx99hwAAAU0"]
[Fri Mar 27 20:03:16.516866 2026] [:error] [pid 27750:tid 27829] [client 20.203.249.159:54662] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "acZyBIaSil5rd17ieLzv7gAAAIs"]
[Fri Mar 27 20:03:17.405833 2026] [:error] [pid 4341:tid 4361] [client 20.203.249.159:61694] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "acZyBeKJWrNB5dMlERGgggAAAZI"]
[Fri Mar 27 20:03:18.429422 2026] [:error] [pid 4341:tid 4358] [client 20.203.249.159:58983] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acZyBuKJWrNB5dMlERGghQAAAY8"]
[Fri Mar 27 20:03:19.440299 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:58977] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acZyB5LjeJUC3OKtEx99mwAAAVY"]
[Fri Mar 27 20:03:21.058839 2026] [:error] [pid 27743:tid 27771] [client 20.203.249.159:59191] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acZyCSA46UYYLqzw99Dd2gAAAAc"]
[Fri Mar 27 20:03:22.103443 2026] [:error] [pid 4293:tid 4310] [client 20.203.249.159:60058] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acZyCpLjeJUC3OKtEx99oAAAAU8"]
[Fri Mar 27 20:03:22.865167 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:62831] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "acZyCpLjeJUC3OKtEx99ogAAAUM"]
[Fri Mar 27 20:03:23.914499 2026] [:error] [pid 27743:tid 27772] [client 20.203.249.159:54673] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "acZyCyA46UYYLqzw99Dd5wAAAAg"]
[Fri Mar 27 20:03:24.872099 2026] [:error] [pid 27750:tid 27823] [client 20.203.249.159:58963] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "acZyDIaSil5rd17ieLzv_AAAAIU"]
[Fri Mar 27 20:03:25.770491 2026] [:error] [pid 4341:tid 4357] [client 20.203.249.159:64574] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "acZyDeKJWrNB5dMlERGgjAAAAY4"]
[Fri Mar 27 20:03:26.991526 2026] [:error] [pid 4341:tid 4355] [client 20.203.249.159:54774] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "acZyDuKJWrNB5dMlERGglQAAAYw"]
[Fri Mar 27 20:03:27.983551 2026] [:error] [pid 4293:tid 4299] [client 20.203.249.159:64554] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "acZyD5LjeJUC3OKtEx99uQAAAUQ"]
[Fri Mar 27 20:03:28.965786 2026] [:error] [pid 27743:tid 27772] [client 20.203.249.159:59171] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "acZyECA46UYYLqzw99Dd8QAAAAg"]
[Fri Mar 27 20:03:29.971641 2026] [:error] [pid 27743:tid 27776] [client 20.203.249.159:60094] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "acZyESA46UYYLqzw99Dd9QAAAAw"]
[Fri Mar 27 20:03:30.558424 2026] [:error] [pid 27743:tid 27768] [client 20.203.249.159:62844] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "acZyEiA46UYYLqzw99Dd-AAAAAQ"]
[Fri Mar 27 20:03:31.245885 2026] [:error] [pid 63897:tid 63915] [client 20.203.249.159:60122] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "acZyE2VSkmYmLu7ycYhMMQAAARA"]
[Fri Mar 27 20:03:32.078208 2026] [:error] [pid 27750:tid 27835] [client 20.203.249.159:54751] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "acZyFIaSil5rd17ieLzwBAAAAJE"]
[Fri Mar 27 20:03:32.812812 2026] [:error] [pid 27749:tid 27792] [client 20.203.249.159:61665] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "acZyFMEqyoMni2Q6_X7wiAAAAEE"]
[Fri Mar 27 20:03:33.840010 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:54745] [client 20.203.249.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acZyFZLjeJUC3OKtEx99ywAAAVY"]
[Fri Mar 27 20:03:34.718777 2026] [:error] [pid 4293:tid 4312] [client 20.203.249.159:60099] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "acZyFpLjeJUC3OKtEx99zgAAAVE"]
[Fri Mar 27 20:03:36.041307 2026] [:error] [pid 27743:tid 27781] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Mar 27 20:03:37.172866 2026] [:error] [pid 27743:tid 27788] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Fri Mar 27 20:03:37.430552 2026] [:error] [pid 27743:tid 27781] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Mar 27 20:03:37.744400 2026] [:error] [pid 27743:tid 27778] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Fri Mar 27 20:03:37.985276 2026] [:error] [pid 27743:tid 27779] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Fri Mar 27 20:03:38.227180 2026] [:error] [pid 27743:tid 27783] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Mar 27 20:03:38.470579 2026] [:error] [pid 27743:tid 27786] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Fri Mar 27 20:03:38.711731 2026] [:error] [pid 27743:tid 27769] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Mar 27 20:03:38.951355 2026] [:error] [pid 27743:tid 27773] [client 20.203.249.159:62786] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Mar 27 20:03:39.200095 2026] [:error] [pid 27743:tid 27777] [client 20.203.249.159:62786] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acZyGyA46UYYLqzw99DeIAAAAA0"]
[Fri Mar 27 20:03:39.944972 2026] [:error] [pid 63897:tid 63907] [client 20.203.249.159:58953] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acZyG2VSkmYmLu7ycYhMQAAAAQg"]
[Fri Mar 27 20:03:40.617045 2026] [:error] [pid 27743:tid 27776] [client 20.203.249.159:60117] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acZyHCA46UYYLqzw99DeKgAAAAw"]
[Fri Mar 27 20:03:41.353154 2026] [:error] [pid 4341:tid 4367] [client 20.203.249.159:61662] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "acZyHeKJWrNB5dMlERGgqQAAAZg"]
[Fri Mar 27 20:03:42.249686 2026] [:error] [pid 27743:tid 27776] [client 20.203.249.159:61776] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZyHiA46UYYLqzw99DeMQAAAAw"]
[Fri Mar 27 20:03:43.105651 2026] [:error] [pid 4341:tid 4365] [client 20.203.249.159:62723] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZyH-KJWrNB5dMlERGgrAAAAZY"]
[Fri Mar 27 20:03:44.100314 2026] [:error] [pid 4293:tid 4306] [client 20.203.249.159:60047] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZyIJLjeJUC3OKtEx991AAAAUs"]
[Fri Mar 27 20:03:44.711462 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:59184] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acZyIJLjeJUC3OKtEx992AAAAUM"]
[Fri Mar 27 20:03:45.842484 2026] [:error] [pid 27851:tid 27859] [client 20.203.249.159:54728] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acZyIXR2ccxe3RMCLbrthQAAAME"]
[Fri Mar 27 20:03:46.680288 2026] [:error] [pid 27851:tid 27862] [client 20.203.249.159:58994] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acZyInR2ccxe3RMCLbrtigAAAMQ"]
[Fri Mar 27 20:03:47.663766 2026] [:error] [pid 4293:tid 4313] [client 20.203.249.159:64185] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acZyI5LjeJUC3OKtEx995wAAAVI"]
[Fri Mar 27 20:03:48.486933 2026] [:error] [pid 4293:tid 4310] [client 20.203.249.159:54657] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "acZyJJLjeJUC3OKtEx996wAAAU8"]
[Fri Mar 27 20:03:49.429798 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:60137] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acZyJZLjeJUC3OKtEx997QAAAVQ"]
[Fri Mar 27 20:03:50.510664 2026] [:error] [pid 4341:tid 4352] [client 20.203.249.159:64546] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acZyJuKJWrNB5dMlERGgtAAAAYk"]
[Fri Mar 27 20:03:51.157405 2026] [:error] [pid 27743:tid 27773] [client 20.203.249.159:62754] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acZyJyA46UYYLqzw99DeOAAAAAk"]
[Fri Mar 27 20:03:51.971002 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:21899] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "acZyJ5LjeJUC3OKtEx998wAAAU0"]
[Fri Mar 27 20:03:53.172732 2026] [:error] [pid 4293:tid 4311] [client 20.203.249.159:59167] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "acZyKZLjeJUC3OKtEx99-wAAAVA"]
[Fri Mar 27 20:03:53.948653 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:64532] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "acZyKZLjeJUC3OKtEx9-AwAAAUM"]
[Fri Mar 27 20:03:54.961635 2026] [:error] [pid 4293:tid 4311] [client 20.203.249.159:59155] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "acZyKpLjeJUC3OKtEx9-BgAAAVA"]
[Fri Mar 27 20:03:55.684740 2026] [:error] [pid 4293:tid 4313] [client 20.203.249.159:54683] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "acZyK5LjeJUC3OKtEx9-DgAAAVI"]
[Fri Mar 27 20:03:56.604664 2026] [:error] [pid 63897:tid 63911] [client 20.203.249.159:51487] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "acZyLGVSkmYmLu7ycYhMUQAAAQw"]
[Fri Mar 27 20:03:57.274864 2026] [:error] [pid 63897:tid 63909] [client 20.203.249.159:61658] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "acZyLWVSkmYmLu7ycYhMWAAAAQo"]
[Fri Mar 27 20:03:58.782635 2026] [:error] [pid 4293:tid 4302] [client 20.203.249.159:58967] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "acZyLpLjeJUC3OKtEx9-HAAAAUc"]
[Fri Mar 27 20:03:59.320811 2026] [:error] [pid 27743:tid 27769] [client 20.203.249.159:60116] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "acZyLyA46UYYLqzw99DeWwAAAAU"]
[Fri Mar 27 20:04:00.021382 2026] [:error] [pid 27743:tid 27765] [client 20.203.249.159:35421] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acZyMCA46UYYLqzw99DeXwAAAAE"]
[Fri Mar 27 20:04:00.639250 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:60060] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acZyMJLjeJUC3OKtEx9-IAAAAUg"]
[Fri Mar 27 20:04:01.323411 2026] [:error] [pid 27743:tid 27771] [client 20.203.249.159:60144] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acZyMSA46UYYLqzw99DeZwAAAAc"]
[Fri Mar 27 20:04:02.466294 2026] [:error] [pid 63897:tid 63911] [client 20.203.249.159:61816] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acZyMmVSkmYmLu7ycYhMXQAAAQw"]
[Fri Mar 27 20:04:03.345904 2026] [:error] [pid 4293:tid 4297] [client 20.203.249.159:64188] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "acZyM5LjeJUC3OKtEx9-KQAAAUI"]
[Fri Mar 27 20:04:04.138585 2026] [:error] [pid 4293:tid 4307] [client 20.203.249.159:60135] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "acZyNJLjeJUC3OKtEx9-LgAAAUw"]
[Fri Mar 27 20:04:05.092824 2026] [:error] [pid 27743:tid 27786] [client 20.203.249.159:64189] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "acZyNSA46UYYLqzw99DecAAAABY"]
[Fri Mar 27 20:04:05.971821 2026] [:error] [pid 27851:tid 27863] [client 20.203.249.159:61680] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "acZyNXR2ccxe3RMCLbrt-AAAAMU"]
[Fri Mar 27 20:04:06.859747 2026] [:error] [pid 27743:tid 27783] [client 20.203.249.159:62730] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdm.php"] [unique_id "acZyNiA46UYYLqzw99DeeAAAABM"]
[Fri Mar 27 20:04:08.074409 2026] [:error] [pid 4293:tid 4297] [client 20.203.249.159:64552] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdm.php"] [unique_id "acZyOJLjeJUC3OKtEx9-PgAAAUI"]
[Fri Mar 27 20:04:09.002290 2026] [:error] [pid 4341:tid 4361] [client 20.203.249.159:58962] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdm.php"] [unique_id "acZyOeKJWrNB5dMlERGg_QAAAZI"]
[Fri Mar 27 20:04:10.561860 2026] [:error] [pid 27750:tid 27825] [client 20.203.249.159:62815] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sdm.php"] [unique_id "acZyOoaSil5rd17ieLzwGQAAAIc"]
[Fri Mar 27 20:04:11.587583 2026] [:error] [pid 4293:tid 4302] [client 20.203.249.159:60072] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "acZyO5LjeJUC3OKtEx9-RAAAAUc"]
[Fri Mar 27 20:04:12.402963 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:64548] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "acZyPJLjeJUC3OKtEx9-SQAAAU0"]
[Fri Mar 27 20:04:13.315506 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:61769] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "acZyPZLjeJUC3OKtEx9-UAAAAUM"]
[Fri Mar 27 20:04:13.901967 2026] [:error] [pid 4293:tid 4311] [client 20.203.249.159:52769] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file52.php"] [unique_id "acZyPZLjeJUC3OKtEx9-UwAAAVA"]
[Fri Mar 27 20:04:14.602160 2026] [:error] [pid 63897:tid 63914] [client 20.203.249.159:27120] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "acZyPmVSkmYmLu7ycYhMawAAAQ8"]
[Fri Mar 27 20:04:15.234824 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:52769] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "acZyP5LjeJUC3OKtEx9-WAAAAVY"]
[Fri Mar 27 20:04:15.846600 2026] [:error] [pid 4293:tid 4299] [client 20.203.249.159:52781] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "acZyP5LjeJUC3OKtEx9-XQAAAUQ"]
[Fri Mar 27 20:04:16.623150 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:21678] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "acZyQJLjeJUC3OKtEx9-YAAAAU0"]
[Fri Mar 27 20:04:17.327413 2026] [:error] [pid 4341:tid 4349] [client 20.203.249.159:61648] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "acZyQeKJWrNB5dMlERGhAgAAAYY"]
[Fri Mar 27 20:04:18.097712 2026] [:error] [pid 27851:tid 27865] [client 20.203.249.159:62757] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "acZyQnR2ccxe3RMCLbruAAAAAMc"]
[Fri Mar 27 20:04:18.746064 2026] [:error] [pid 27749:tid 27802] [client 20.203.249.159:52736] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "acZyQsEqyoMni2Q6_X7wngAAAEs"]
[Fri Mar 27 20:04:19.350132 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:64515] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "acZyQ5LjeJUC3OKtEx9-bwAAAVY"]
[Fri Mar 27 20:04:19.957137 2026] [:error] [pid 4293:tid 4313] [client 20.203.249.159:62814] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "acZyQ5LjeJUC3OKtEx9-dAAAAVI"]
[Fri Mar 27 20:04:20.585167 2026] [:error] [pid 63897:tid 63922] [client 20.203.249.159:58959] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "acZyRGVSkmYmLu7ycYhMbwAAARc"]
[Fri Mar 27 20:04:21.201728 2026] [:error] [pid 27750:tid 27818] [client 20.203.249.159:62780] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "acZyRYaSil5rd17ieLzwIQAAAIA"]
[Fri Mar 27 20:04:21.891491 2026] [:error] [pid 63897:tid 63921] [client 20.203.249.159:25470] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "acZyRWVSkmYmLu7ycYhMcwAAARY"]
[Fri Mar 27 20:04:22.560052 2026] [:error] [pid 27743:tid 27767] [client 20.203.249.159:61636] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acZyRiA46UYYLqzw99DejQAAAAM"]
[Fri Mar 27 20:04:23.255895 2026] [:error] [pid 4293:tid 4309] [client 20.203.249.159:64134] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acZyR5LjeJUC3OKtEx9-eQAAAU4"]
[Fri Mar 27 20:04:23.970673 2026] [:error] [pid 4293:tid 4317] [client 20.203.249.159:62835] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acZyR5LjeJUC3OKtEx9-fgAAAVY"]
[Fri Mar 27 20:04:24.729862 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:61764] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "acZySJLjeJUC3OKtEx9-ggAAAUg"]
[Fri Mar 27 20:04:25.693135 2026] [:error] [pid 63897:tid 63908] [client 20.203.249.159:59187] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "acZySWVSkmYmLu7ycYhMdQAAAQk"]
[Fri Mar 27 20:04:26.560022 2026] [:error] [pid 4293:tid 4301] [client 20.203.249.159:60070] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "acZySpLjeJUC3OKtEx9-jQAAAUY"]
[Fri Mar 27 20:04:27.258875 2026] [:error] [pid 27749:tid 27801] [client 20.203.249.159:54761] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "acZyS8EqyoMni2Q6_X7wogAAAEo"]
[Fri Mar 27 20:04:28.005308 2026] [:error] [pid 27743:tid 27766] [client 20.203.249.159:62738] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "acZyTCA46UYYLqzw99DenAAAAAI"]
[Fri Mar 27 20:04:28.732902 2026] [:error] [pid 4293:tid 4312] [client 20.203.249.159:64537] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "acZyTJLjeJUC3OKtEx9-nAAAAVE"]
[Fri Mar 27 20:04:29.354884 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:54674] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "acZyTZLjeJUC3OKtEx9-ogAAAUo"]
[Fri Mar 27 20:04:30.665228 2026] [:error] [pid 27851:tid 27858] [client 20.203.249.159:64138] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "acZyTnR2ccxe3RMCLbruDAAAAMA"]
[Fri Mar 27 20:04:31.593342 2026] [:error] [pid 27743:tid 27776] [client 20.203.249.159:54686] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "acZyTyA46UYYLqzw99DengAAAAw"]
[Fri Mar 27 20:04:32.635143 2026] [:error] [pid 27743:tid 27782] [client 20.203.249.159:64168] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acZyUCA46UYYLqzw99DepQAAABI"]
[Fri Mar 27 20:04:33.340171 2026] [:error] [pid 27743:tid 27774] [client 20.203.249.159:62807] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acZyUSA46UYYLqzw99DeqgAAAAo"]
[Fri Mar 27 20:04:34.292357 2026] [:error] [pid 27743:tid 27780] [client 20.203.249.159:54656] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acZyUiA46UYYLqzw99DergAAABA"]
[Fri Mar 27 20:04:34.872892 2026] [:error] [pid 63897:tid 63899] [client 20.203.249.159:64561] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hla.php"] [unique_id "acZyUmVSkmYmLu7ycYhMewAAAQA"]
[Fri Mar 27 20:04:35.749361 2026] [:error] [pid 27743:tid 27782] [client 20.203.249.159:54760] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acZyUyA46UYYLqzw99DesQAAABI"]
[Fri Mar 27 20:04:36.342156 2026] [:error] [pid 27743:tid 27788] [client 20.203.249.159:59145] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acZyVCA46UYYLqzw99DeswAAABg"]
[Fri Mar 27 20:04:37.131047 2026] [:error] [pid 27851:tid 27880] [client 20.203.249.159:62737] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acZyVXR2ccxe3RMCLbruGAAAANY"]
[Fri Mar 27 20:04:37.859026 2026] [:error] [pid 63897:tid 63908] [client 20.203.249.159:61681] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "acZyVWVSkmYmLu7ycYhMgAAAAQk"]
[Fri Mar 27 20:04:38.892283 2026] [:error] [pid 4293:tid 4309] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Mar 27 20:04:39.225763 2026] [:error] [pid 4293:tid 4306] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/goat1.php
[Fri Mar 27 20:04:39.465098 2026] [:error] [pid 4293:tid 4295] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Fri Mar 27 20:04:39.796795 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Fri Mar 27 20:04:40.113823 2026] [:error] [pid 4293:tid 4318] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/fffff.php
[Fri Mar 27 20:04:40.353587 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/thh.php
[Fri Mar 27 20:04:40.643912 2026] [:error] [pid 4293:tid 4309] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/yellow.php
[Fri Mar 27 20:04:40.939851 2026] [:error] [pid 4293:tid 4295] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Fri Mar 27 20:04:41.238391 2026] [:error] [pid 4293:tid 4299] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Fri Mar 27 20:04:41.481021 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Fri Mar 27 20:04:41.719334 2026] [:error] [pid 4293:tid 4315] [client 20.203.249.159:59138] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Fri Mar 27 20:04:41.957582 2026] [:error] [pid 4293:tid 4300] [client 20.203.249.159:59138] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acZyWZLjeJUC3OKtEx9-xAAAAUU"]
[Fri Mar 27 20:04:42.734111 2026] [:error] [pid 63897:tid 63902] [client 20.203.249.159:51473] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acZyWmVSkmYmLu7ycYhMjAAAAQM"]
[Fri Mar 27 20:04:43.522990 2026] [:error] [pid 27750:tid 27839] [client 20.203.249.159:62763] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acZyW4aSil5rd17ieLzwMgAAAJU"]
[Fri Mar 27 20:04:44.232179 2026] [:error] [pid 63897:tid 63911] [client 20.203.249.159:60121] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/efile.php"] [unique_id "acZyXGVSkmYmLu7ycYhMkAAAAQw"]
[Fri Mar 27 20:04:45.222099 2026] [:error] [pid 27749:tid 27792] [client 20.203.249.159:52764] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acZyXcEqyoMni2Q6_X7wqAAAAEE"]
[Fri Mar 27 20:04:46.079917 2026] [:error] [pid 27851:tid 27869] [client 20.203.249.159:60132] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acZyXnR2ccxe3RMCLbruIAAAAMs"]
[Fri Mar 27 20:04:46.967937 2026] [:error] [pid 27749:tid 27813] [client 20.203.249.159:61780] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acZyXsEqyoMni2Q6_X7wqQAAAFY"]
[Fri Mar 27 20:04:47.586213 2026] [:error] [pid 4341:tid 4363] [client 20.203.249.159:54753] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/afile.php"] [unique_id "acZyX-KJWrNB5dMlERGhGAAAAZQ"]
[Fri Mar 27 20:04:48.273161 2026] [:error] [pid 27749:tid 27796] [client 20.203.249.159:62778] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acZyYMEqyoMni2Q6_X7wrQAAAEU"]
[Fri Mar 27 20:04:48.945931 2026] [:error] [pid 63897:tid 63903] [client 20.203.249.159:54746] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acZyYGVSkmYmLu7ycYhMmAAAAQQ"]
[Fri Mar 27 20:04:49.651139 2026] [:error] [pid 27743:tid 27773] [client 20.203.249.159:64145] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acZyYSA46UYYLqzw99DevgAAAAk"]
[Fri Mar 27 20:04:50.328908 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:35430] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "acZyYpLjeJUC3OKtEx9-xwAAAUM"]
[Fri Mar 27 20:04:50.933161 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:58990] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "acZyYpLjeJUC3OKtEx9-ygAAAUo"]
[Fri Mar 27 20:04:51.512900 2026] [:error] [pid 27851:tid 27881] [client 20.203.249.159:58958] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "acZyY3R2ccxe3RMCLbruKQAAANc"]
[Fri Mar 27 20:04:52.025585 2026] [:error] [pid 27851:tid 27863] [client 20.203.249.159:64572] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "acZyZHR2ccxe3RMCLbruKgAAAMU"]
[Fri Mar 27 20:04:52.761964 2026] [:error] [pid 63897:tid 63916] [client 20.203.249.159:27074] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "acZyZGVSkmYmLu7ycYhMngAAARE"]
[Fri Mar 27 20:04:53.564031 2026] [:error] [pid 27749:tid 27792] [client 20.203.249.159:35432] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "acZyZcEqyoMni2Q6_X7wtQAAAEE"]
[Fri Mar 27 20:04:54.545945 2026] [:error] [pid 4341:tid 4366] [client 20.203.249.159:60036] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "acZyZuKJWrNB5dMlERGhHgAAAZc"]
[Fri Mar 27 20:04:55.162740 2026] [:error] [pid 63897:tid 63910] [client 20.203.249.159:59137] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "acZyZ2VSkmYmLu7ycYhMpAAAAQs"]
[Fri Mar 27 20:04:55.966317 2026] [:error] [pid 27851:tid 27875] [client 20.203.249.159:60046] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless3.php"] [unique_id "acZyZ3R2ccxe3RMCLbruLgAAANE"]
[Fri Mar 27 20:04:56.678445 2026] [:error] [pid 27851:tid 27873] [client 20.203.249.159:61654] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "acZyaHR2ccxe3RMCLbruLwAAAM8"]
[Fri Mar 27 20:04:57.583549 2026] [:error] [pid 63897:tid 63909] [client 20.203.249.159:62793] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "acZyaWVSkmYmLu7ycYhMqgAAAQo"]
[Fri Mar 27 20:04:58.362330 2026] [:error] [pid 63897:tid 63922] [client 20.203.249.159:51494] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "acZyamVSkmYmLu7ycYhMsQAAARc"]
[Fri Mar 27 20:04:58.945512 2026] [:error] [pid 63897:tid 63908] [client 20.203.249.159:64539] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enclas.php"] [unique_id "acZyamVSkmYmLu7ycYhMtQAAAQk"]
[Fri Mar 27 20:04:59.687094 2026] [:error] [pid 4341:tid 4357] [client 20.203.249.159:62766] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "acZya-KJWrNB5dMlERGhKwAAAY4"]
[Fri Mar 27 20:05:00.678069 2026] [:error] [pid 27851:tid 27867] [client 20.203.249.159:60073] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "acZybHR2ccxe3RMCLbruMwAAAMk"]
[Fri Mar 27 20:05:01.504427 2026] [:error] [pid 4341:tid 4360] [client 20.203.249.159:60056] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "acZybeKJWrNB5dMlERGhLwAAAZE"]
[Fri Mar 27 20:05:02.395948 2026] [:error] [pid 4293:tid 4304] [client 20.203.249.159:62773] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/he.php"] [unique_id "acZybpLjeJUC3OKtEx9-zQAAAUk"]
[Fri Mar 27 20:05:03.219382 2026] [:error] [pid 27750:tid 27818] [client 20.203.249.159:51477] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "acZyb4aSil5rd17ieLzwPwAAAIA"]
[Fri Mar 27 20:05:04.126657 2026] [:error] [pid 27750:tid 27833] [client 20.203.249.159:61653] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "acZycIaSil5rd17ieLzwQgAAAI8"]
[Fri Mar 27 20:05:04.781487 2026] [:error] [pid 27750:tid 27840] [client 20.203.249.159:62794] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "acZycIaSil5rd17ieLzwRwAAAJY"]
[Fri Mar 27 20:05:05.468693 2026] [:error] [pid 27743:tid 27778] [client 20.203.249.159:15043] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aves.php"] [unique_id "acZycSA46UYYLqzw99De2QAAAA4"]
[Fri Mar 27 20:05:06.124992 2026] [:error] [pid 4341:tid 4348] [client 20.203.249.159:54773] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "acZycuKJWrNB5dMlERGhNgAAAYU"]
[Fri Mar 27 20:05:07.562922 2026] [:error] [pid 27743:tid 27787] [client 20.203.249.159:52751] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "acZycyA46UYYLqzw99De3wAAABc"]
[Fri Mar 27 20:05:08.268635 2026] [:error] [pid 27743:tid 27786] [client 20.203.249.159:61669] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "acZydCA46UYYLqzw99De4wAAABY"]
[Fri Mar 27 20:05:08.881822 2026] [:error] [pid 27743:tid 27784] [client 20.203.249.159:62755] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "acZydCA46UYYLqzw99De6AAAABQ"]
[Fri Mar 27 20:05:10.073364 2026] [:error] [pid 4293:tid 4298] [client 20.203.249.159:58956] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "acZydpLjeJUC3OKtEx9-4AAAAUM"]
[Fri Mar 27 20:05:10.907056 2026] [:error] [pid 4293:tid 4303] [client 20.203.249.159:54667] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "acZydpLjeJUC3OKtEx9-6QAAAUg"]
[Fri Mar 27 20:05:11.872447 2026] [:error] [pid 27851:tid 27875] [client 20.203.249.159:59000] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "acZyd3R2ccxe3RMCLbruNwAAANE"]
[Fri Mar 27 20:05:12.662856 2026] [:error] [pid 63897:tid 63904] [client 20.203.249.159:59192] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "acZyeGVSkmYmLu7ycYhMzgAAAQU"]
[Fri Mar 27 20:05:13.680029 2026] [:error] [pid 27851:tid 27880] [client 20.203.249.159:64538] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "acZyeXR2ccxe3RMCLbruQAAAANY"]
[Fri Mar 27 20:05:15.095450 2026] [:error] [pid 4341:tid 4355] [client 20.203.249.159:62829] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "acZye-KJWrNB5dMlERGhOwAAAYw"]
[Fri Mar 27 20:05:15.757054 2026] [:error] [pid 4341:tid 4367] [client 20.203.249.159:58950] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "acZye-KJWrNB5dMlERGhQgAAAZg"]
[Fri Mar 27 20:05:16.693860 2026] [:error] [pid 27750:tid 27835] [client 20.203.249.159:25450] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "acZyfIaSil5rd17ieLzwWAAAAJE"]
[Fri Mar 27 20:05:17.572470 2026] [:error] [pid 27743:tid 27785] [client 20.203.249.159:14021] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "acZyfSA46UYYLqzw99De-wAAABU"]
[Fri Mar 27 20:05:18.165987 2026] [:error] [pid 27743:tid 27782] [client 20.203.249.159:54677] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "acZyfiA46UYYLqzw99De_gAAABI"]
[Fri Mar 27 20:05:18.924282 2026] [:error] [pid 27743:tid 27785] [client 20.203.249.159:61796] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "acZyfiA46UYYLqzw99DfAgAAABU"]
[Fri Mar 27 20:05:19.633961 2026] [:error] [pid 27743:tid 27782] [client 20.203.249.159:60154] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "acZyfyA46UYYLqzw99DfDAAAABI"]
[Fri Mar 27 20:05:20.322275 2026] [:error] [pid 27749:tid 27797] [client 20.203.249.159:61668] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "acZygMEqyoMni2Q6_X7wyAAAAEY"]
[Fri Mar 27 20:05:21.056310 2026] [:error] [pid 27851:tid 27859] [client 20.203.249.159:64159] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "acZygXR2ccxe3RMCLbruTQAAAME"]
[Fri Mar 27 20:05:22.032336 2026] [:error] [pid 4341:tid 4353] [client 20.203.249.159:64158] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "acZyguKJWrNB5dMlERGhTgAAAYo"]
[Fri Mar 27 20:05:23.048287 2026] [:error] [pid 27749:tid 27796] [client 20.203.249.159:58989] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/des.php"] [unique_id "acZyg8EqyoMni2Q6_X7wywAAAEU"]
[Fri Mar 27 20:05:23.682714 2026] [:error] [pid 27851:tid 27878] [client 20.203.249.159:61804] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "acZyg3R2ccxe3RMCLbruUwAAANQ"]
[Fri Mar 27 20:05:24.309196 2026] [:error] [pid 63897:tid 63920] [client 20.203.249.159:59195] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "acZyhGVSkmYmLu7ycYhM2QAAARU"]
[Fri Mar 27 20:05:24.970706 2026] [:error] [pid 27750:tid 27840] [client 20.203.249.159:56898] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "acZyhIaSil5rd17ieLzwZAAAAJY"]
[Fri Mar 27 20:05:25.518297 2026] [:error] [pid 4341:tid 4364] [client 20.203.249.159:58992] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "acZyheKJWrNB5dMlERGhUAAAAZU"]
[Fri Mar 27 20:05:26.047106 2026] [:error] [pid 63897:tid 63919] [client 20.203.249.159:62761] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acZyhmVSkmYmLu7ycYhM3QAAARQ"]
[Fri Mar 27 20:05:26.633801 2026] [:error] [pid 27743:tid 27783] [client 20.203.249.159:54720] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acZyhiA46UYYLqzw99DfIQAAABM"]
[Fri Mar 27 20:05:27.288904 2026] [:error] [pid 4293:tid 4305] [client 20.203.249.159:54768] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acZyh5LjeJUC3OKtEx9-9wAAAUo"]
[Fri Mar 27 20:05:27.896063 2026] [:error] [pid 63897:tid 63906] [client 20.203.249.159:60107] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file51.php"] [unique_id "acZyh2VSkmYmLu7ycYhM3wAAAQc"]
[Fri Mar 27 20:05:28.537441 2026] [:error] [pid 27743:tid 27786] [client 20.203.249.159:64174] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acZyiCA46UYYLqzw99DfLQAAABY"]
[Fri Mar 27 20:05:29.073543 2026] [:error] [pid 27743:tid 27774] [client 20.203.249.159:64129] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acZyiSA46UYYLqzw99DfLgAAAAo"]
[Fri Mar 27 20:05:29.687116 2026] [:error] [pid 4341:tid 4348] [client 20.203.249.159:60126] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acZyieKJWrNB5dMlERGhWQAAAYU"]
[Fri Mar 27 20:05:30.264289 2026] [:error] [pid 27743:tid 27771] [client 20.203.249.159:21907] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs15.php"] [unique_id "acZyiiA46UYYLqzw99DfMgAAAAc"]
[Fri Mar 27 20:05:30.859334 2026] [:error] [pid 27743:tid 27775] [client 20.203.249.159:64166] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acZyiiA46UYYLqzw99DfNQAAAAs"]
[Fri Mar 27 20:05:31.475145 2026] [:error] [pid 4293:tid 4312] [client 20.203.249.159:64522] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acZyi5LjeJUC3OKtEx9_AgAAAVE"]
[Fri Mar 27 20:05:32.100552 2026] [:error] [pid 4293:tid 4299] [client 20.203.249.159:64172] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acZyjJLjeJUC3OKtEx9_BAAAAUQ"]
[Fri Mar 27 20:05:32.845040 2026] [:error] [pid 4293:tid 4308] [client 20.203.249.159:62806] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "acZyjJLjeJUC3OKtEx9_DQAAAU0"]
[Fri Mar 27 20:05:33.411717 2026] [:error] [pid 27743:tid 27768] [client 20.203.249.159:64570] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acZyjSA46UYYLqzw99DfPgAAAAQ"]
[Fri Mar 27 20:05:33.972716 2026] [:error] [pid 4341:tid 4355] [client 20.203.249.159:35415] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acZyjeKJWrNB5dMlERGhZgAAAYw"]
[Fri Mar 27 20:05:34.662797 2026] [:error] [pid 63897:tid 63901] [client 20.203.249.159:64517] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acZyjmVSkmYmLu7ycYhM4QAAAQI"]
[Fri Mar 27 20:05:35.246536 2026] [:error] [pid 63897:tid 63904] [client 20.203.249.159:60034] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "acZyj2VSkmYmLu7ycYhM4gAAAQU"]
[Fri Mar 27 20:05:35.795836 2026] [:error] [pid 27743:tid 27780] [client 20.203.249.159:62740] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acZyjyA46UYYLqzw99DfRgAAABA"]
[Fri Mar 27 20:05:36.392086 2026] [:error] [pid 27743:tid 27768] [client 20.203.249.159:61647] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acZykCA46UYYLqzw99DfSAAAAAQ"]
[Fri Mar 27 20:05:36.905131 2026] [:error] [pid 63897:tid 63911] [client 20.203.249.159:58974] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acZykGVSkmYmLu7ycYhM5gAAAQw"]
[Fri Mar 27 20:05:37.720030 2026] [:error] [pid 27851:tid 27879] [client 20.203.249.159:54682] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acZykXR2ccxe3RMCLbruXAAAANU"]
[Fri Mar 27 20:05:38.317553 2026] [:error] [pid 4293:tid 4318] [client 20.203.249.159:60106] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acZykpLjeJUC3OKtEx9_FAAAAVc"]
[Fri Mar 27 20:05:38.839470 2026] [:error] [pid 27743:tid 27784] [client 20.203.249.159:34824] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acZykiA46UYYLqzw99DfVgAAABQ"]
[Fri Mar 27 20:05:39.547616 2026] [:error] [pid 27743:tid 27764] [client 20.203.249.159:51501] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acZykyA46UYYLqzw99DfXgAAAAA"]
[Fri Mar 27 20:05:40.183634 2026] [:error] [pid 27743:tid 27770] [client 20.203.249.159:54658] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "acZylCA46UYYLqzw99DfZAAAAAY"]
[Fri Mar 27 20:05:40.809952 2026] [:error] [pid 27749:tid 27802] [client 20.203.249.159:60043] [client 20.203.249.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xoot.php"] [unique_id "acZylMEqyoMni2Q6_X7w4AAAAEs"]
[Fri Mar 27 20:05:41.465314 2026] [:error] [pid 27743:tid 27782] [client 20.203.249.159:59143] File does not exist: /usr/local/apache/htdocs/suspended-page/xoot.php
[Fri Mar 27 23:22:15.891752 2026] [:error] [pid 54663:tid 54682] [client 171.4.247.64:50616] [client 171.4.247.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.4.247.64, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acagpxUtStIXFk9WHe3qSQAAAdA"]
[Fri Mar 27 23:22:15.896221 2026] [:error] [pid 54663:tid 54682] [client 171.4.247.64:50616] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 27 23:22:36.267933 2026] [:error] [pid 4293:tid 4315] [client 179.191.215.178:38211] [client 179.191.215.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.191.215.178, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acagvJLjeJUC3OKtEx_GiwAAAVQ"]
[Fri Mar 27 23:22:36.272826 2026] [:error] [pid 4293:tid 4315] [client 179.191.215.178:38211] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 28 00:25:30.533652 2026] [:error] [pid 22607:tid 22628] [client 152.42.214.22:49238] [client 152.42.214.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "acavepiC8WpFMM-VCJcuAAAAAlE"]
[Sat Mar 28 09:25:46.772296 2026] [:error] [pid 34597:tid 34624] [client 2.58.56.116:53327] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "accuGoluI7-e5s1cafc6sgAAAVc"]
[Sat Mar 28 09:25:47.275272 2026] [:error] [pid 43578:tid 43598] [client 2.58.56.116:53645] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "accuG3NG2YdGm41aN8Lw8gAAAlE"]
[Sat Mar 28 09:25:47.779895 2026] [:error] [pid 64859:tid 64903] [client 2.58.56.116:54354] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "accuG23qEBHXq3rHdBm44AAAABY"]
[Sat Mar 28 09:25:48.279024 2026] [:error] [pid 64861:tid 64953] [client 2.58.56.116:54973] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "accuHOxK22_lUN2kvnWQZQAAAJI"]
[Sat Mar 28 09:25:48.804135 2026] [:error] [pid 64859:tid 64896] [client 2.58.56.116:55410] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "accuHG3qEBHXq3rHdBm5AAAAAA8"]
[Sat Mar 28 10:13:00.281800 2026] [:error] [pid 64860:tid 64922] [client 52.231.64.83:11593] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Mar 28 10:13:01.165888 2026] [:error] [pid 64860:tid 64931] [client 52.231.64.83:11593] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Mar 28 10:13:01.729507 2026] [:error] [pid 64860:tid 64920] [client 52.231.64.83:11593] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Mar 28 10:13:01.879016 2026] [:error] [pid 64860:tid 64930] [client 52.231.64.83:11593] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php
[Sat Mar 28 10:13:02.019557 2026] [:error] [pid 64860:tid 64909] [client 52.231.64.83:11593] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Sat Mar 28 10:13:02.160902 2026] [:error] [pid 64860:tid 64929] [client 52.231.64.83:11593] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Mar 28 10:13:02.301630 2026] [:error] [pid 64860:tid 64921] [client 52.231.64.83:11593] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Mar 28 10:13:02.439051 2026] [:error] [pid 64860:tid 64923] [client 52.231.64.83:11593] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acc5LhkU3N0pg_4aEL8jJwAAAE8"]
[Sat Mar 28 10:13:02.995397 2026] [:error] [pid 64861:tid 64942] [client 52.231.64.83:6860] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acc5LuxK22_lUN2kvnWcWQAAAIc"]
[Sat Mar 28 10:13:03.550451 2026] [:error] [pid 64861:tid 64940] [client 52.231.64.83:6885] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acc5L-xK22_lUN2kvnWcWgAAAIU"]
[Sat Mar 28 10:13:04.119556 2026] [:error] [pid 43547:tid 43555] [client 52.231.64.83:6866] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acc5MD4ZEfdetXP-9aDCAgAAAgY"]
[Sat Mar 28 10:59:41.725453 2026] [:error] [pid 64859:tid 64884] [client 159.146.43.197:16247] [client 159.146.43.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.146.43.197, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acdEHW3qEBHXq3rHdBnECQAAAAM"]
[Sat Mar 28 10:59:41.730917 2026] [:error] [pid 64859:tid 64884] [client 159.146.43.197:16247] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 28 15:18:55.209178 2026] [:error] [pid 64861:tid 64953] [client 103.137.19.235:65287] [client 103.137.19.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.137.19.235, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aceA3-xK22_lUN2kvnXxBgAAAJI"]
[Sat Mar 28 15:18:55.214752 2026] [:error] [pid 64861:tid 64953] [client 103.137.19.235:65287] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Mar 28 20:21:52.200579 2026] [:error] [pid 34631:tid 34662] [client 103.24.86.190:64723] [client 103.24.86.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.24.86.190, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acfH4DtzjMMS6kojpeRF6gAAAcI"]
[Sat Mar 28 20:21:52.206497 2026] [:error] [pid 34631:tid 34662] [client 103.24.86.190:64723] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 29 02:17:08.941264 2026] [:error] [pid 60346:tid 60365] [client 51.68.206.58:44252] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Sun Mar 29 02:42:13.208592 2026] [:error] [pid 39427:tid 39444] [client 20.151.113.137:22394] [client 20.151.113.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acghBVvLf0RDUqcYq-ZXQgAAAAw"]
[Sun Mar 29 02:42:13.635617 2026] [:error] [pid 39514:tid 39528] [client 20.151.113.137:22289] [client 20.151.113.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acghBSkUyvlQod6qQu2ukwAAAMM"]
[Sun Mar 29 02:42:14.056160 2026] [:error] [pid 39428:tid 39465] [client 20.151.113.137:22288] [client 20.151.113.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acghBqXMrozFMIaP8nII0QAAAEY"]
[Sun Mar 29 02:42:14.478497 2026] [:error] [pid 39514:tid 39532] [client 20.151.113.137:22382] [client 20.151.113.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acghBikUyvlQod6qQu2ulAAAAMc"]
[Sun Mar 29 06:02:34.359764 2026] [:error] [pid 1524:tid 1528] [client 20.122.187.158:61571] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achP-loaWSl2asqQCh8kRAAAAQE"]
[Sun Mar 29 06:02:36.081328 2026] [:error] [pid 23137:tid 23161] [client 20.122.187.158:64954] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achP_BaWQa7LdZ_qGFaE2gAAAZY"]
[Sun Mar 29 06:02:38.347077 2026] [:error] [pid 32255:tid 32302] [client 20.122.187.158:64947] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achP_mnfn-AtRoMbquxS5wAAAEs"]
[Sun Mar 29 06:02:40.431277 2026] [:error] [pid 23250:tid 23264] [client 20.122.187.158:5625] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achQAJxrpj-dQjy1cvo8RAAAAkw"]
[Sun Mar 29 18:12:31.230832 2026] [:error] [pid 23168:tid 23200] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Sun Mar 29 18:12:31.439738 2026] [:error] [pid 23168:tid 23219] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/xc0252.php
[Sun Mar 29 18:12:31.655685 2026] [:error] [pid 23168:tid 23201] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sun Mar 29 18:12:31.864061 2026] [:error] [pid 23168:tid 23204] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sun Mar 29 18:12:32.189410 2026] [:error] [pid 23168:tid 23216] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sun Mar 29 18:12:32.398479 2026] [:error] [pid 23168:tid 23207] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Sun Mar 29 18:12:32.720494 2026] [:error] [pid 23168:tid 23213] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/ws47.php
[Sun Mar 29 18:12:32.928892 2026] [:error] [pid 23168:tid 23221] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/vvvb.php
[Sun Mar 29 18:12:33.138887 2026] [:error] [pid 23168:tid 23198] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/x12.php
[Sun Mar 29 18:12:33.348941 2026] [:error] [pid 23168:tid 23209] [client 20.151.168.140:53037] File does not exist: /usr/local/apache/htdocs/suspended-page/zcsu.php
[Sun Mar 29 18:12:33.703281 2026] [:error] [pid 23168:tid 23199] [client 20.151.168.140:53037] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acj7EWP8p0yRL8ot_29eBQAAAgI"]
[Sun Mar 29 18:12:34.956906 2026] [:error] [pid 32255:tid 32312] [client 20.151.168.140:17443] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acj7Emnfn-AtRoMbquyR-gAAAFU"]
[Sun Mar 29 18:12:35.781833 2026] [:error] [pid 23284:tid 23288] [client 20.151.168.140:48093] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acj7E4zBujdPHsq7wyQb2wAAAoI"]
[Sun Mar 29 18:12:36.630527 2026] [:error] [pid 32255:tid 32312] [client 20.151.168.140:32823] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acj7FGnfn-AtRoMbquySBQAAAFU"]
[Sun Mar 29 18:12:37.328314 2026] [:error] [pid 23168:tid 23216] [client 20.151.168.140:20447] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxs.php"] [unique_id "acj7FWP8p0yRL8ot_29eDQAAAhM"]
[Sun Mar 29 18:12:38.018951 2026] [:error] [pid 32359:tid 32372] [client 20.151.168.140:51151] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxs.php"] [unique_id "acj7FgMb8G3UzfQP3WgVFQAAAMs"]
[Sun Mar 29 18:12:39.608993 2026] [:error] [pid 23284:tid 23296] [client 20.151.168.140:65011] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxs.php"] [unique_id "acj7F4zBujdPHsq7wyQb6wAAAoo"]
[Sun Mar 29 18:12:40.607785 2026] [:error] [pid 32255:tid 32300] [client 20.151.168.140:51725] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxs.php"] [unique_id "acj7GGnfn-AtRoMbquySKAAAAEk"]
[Sun Mar 29 18:12:41.360024 2026] [:error] [pid 32254:tid 32280] [client 20.151.168.140:17423] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "acj7Gaug2IHuyGgCTn9IlQAAABA"]
[Sun Mar 29 18:12:42.052112 2026] [:error] [pid 23167:tid 23193] [client 20.151.168.140:53760] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "acj7GhIAHJCFaHff3_eJHAAAAdc"]
[Sun Mar 29 18:12:42.801610 2026] [:error] [pid 23167:tid 23192] [client 20.151.168.140:39563] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "acj7GhIAHJCFaHff3_eJIQAAAdY"]
[Sun Mar 29 18:12:43.829081 2026] [:error] [pid 1524:tid 1553] [client 20.151.168.140:51773] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "acj7G1oaWSl2asqQCh9wEwAAARU"]
[Sun Mar 29 18:12:46.302104 2026] [:error] [pid 32255:tid 32291] [client 20.151.168.140:17432] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acj7Hmnfn-AtRoMbquySUwAAAEA"]
[Sun Mar 29 18:12:47.033992 2026] [:error] [pid 23167:tid 23179] [client 20.151.168.140:20444] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acj7HxIAHJCFaHff3_eJNQAAAck"]
[Sun Mar 29 18:12:47.819645 2026] [:error] [pid 32257:tid 32323] [client 20.151.168.140:39608] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acj7HyE3TArOFrUtgWrDMQAAAIU"]
[Sun Mar 29 18:12:48.748427 2026] [:error] [pid 23250:tid 23263] [client 20.151.168.140:53812] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "acj7IJxrpj-dQjy1cvrebQAAAks"]
[Sun Mar 29 18:12:50.563137 2026] [:error] [pid 32255:tid 32314] [client 20.151.168.140:64350] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "acj7Imnfn-AtRoMbquySXgAAAFc"]
[Sun Mar 29 18:12:52.398668 2026] [:error] [pid 32255:tid 32311] [client 20.151.168.140:47444] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "acj7JGnfn-AtRoMbquySagAAAFQ"]
[Sun Mar 29 18:12:53.910966 2026] [:error] [pid 23167:tid 23185] [client 20.151.168.140:30331] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "acj7JRIAHJCFaHff3_eJTAAAAc8"]
[Sun Mar 29 18:12:56.019146 2026] [:error] [pid 23167:tid 23173] [client 20.151.168.140:53775] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24.php"] [unique_id "acj7KBIAHJCFaHff3_eJVgAAAcM"]
[Sun Mar 29 18:12:57.767590 2026] [:error] [pid 23137:tid 23162] [client 20.151.168.140:53703] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz8.php"] [unique_id "acj7KRaWQa7LdZ_qGFbc4AAAAZc"]
[Sun Mar 29 18:12:59.242041 2026] [:error] [pid 23167:tid 23185] [client 20.151.168.140:40674] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz8.php"] [unique_id "acj7KxIAHJCFaHff3_eJWQAAAc8"]
[Sun Mar 29 18:12:59.954911 2026] [:error] [pid 32359:tid 32382] [client 20.151.168.140:27234] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz8.php"] [unique_id "acj7KwMb8G3UzfQP3WgVLQAAANU"]
[Sun Mar 29 18:13:00.934602 2026] [:error] [pid 23137:tid 23161] [client 20.151.168.140:27210] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz8.php"] [unique_id "acj7LBaWQa7LdZ_qGFbc5AAAAZY"]
[Sun Mar 29 18:13:02.304085 2026] [:error] [pid 23284:tid 23295] [client 20.151.168.140:27235] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "acj7LozBujdPHsq7wyQcEQAAAok"]
[Sun Mar 29 18:13:03.448683 2026] [:error] [pid 23250:tid 23267] [client 20.151.168.140:64970] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "acj7L5xrpj-dQjy1cvrefwAAAk8"]
[Sun Mar 29 18:13:04.225042 2026] [:error] [pid 23168:tid 23212] [client 20.151.168.140:47463] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "acj7MGP8p0yRL8ot_29eJAAAAg8"]
[Sun Mar 29 18:13:04.801637 2026] [:error] [pid 32255:tid 32315] [client 20.151.168.140:20448] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "acj7MGnfn-AtRoMbquySjwAAAFg"]
[Sun Mar 29 18:13:05.287480 2026] [:error] [pid 32255:tid 32305] [client 20.151.168.140:17466] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "acj7MWnfn-AtRoMbquySmAAAAE4"]
[Sun Mar 29 18:13:06.125088 2026] [:error] [pid 23284:tid 23294] [client 20.151.168.140:47465] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "acj7MozBujdPHsq7wyQcHQAAAog"]
[Sun Mar 29 18:13:07.207546 2026] [:error] [pid 32255:tid 32295] [client 20.151.168.140:65004] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "acj7M2nfn-AtRoMbquyStQAAAEQ"]
[Sun Mar 29 18:13:07.984451 2026] [:error] [pid 23137:tid 23148] [client 20.151.168.140:64323] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "acj7MxaWQa7LdZ_qGFbc6wAAAYk"]
[Sun Mar 29 18:13:09.445306 2026] [:error] [pid 32255:tid 32306] [client 20.151.168.140:30308] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpmini.php"] [unique_id "acj7NWnfn-AtRoMbquySxAAAAE8"]
[Sun Mar 29 18:13:11.535652 2026] [:error] [pid 23284:tid 23307] [client 20.151.168.140:47428] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpmini.php"] [unique_id "acj7N4zBujdPHsq7wyQcJgAAApU"]
[Sun Mar 29 18:13:12.891918 2026] [:error] [pid 32254:tid 32275] [client 20.151.168.140:58927] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpmini.php"] [unique_id "acj7OKug2IHuyGgCTn9IsQAAAAs"]
[Sun Mar 29 18:13:13.911586 2026] [:error] [pid 23284:tid 23296] [client 20.151.168.140:53714] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/phpmini.php"] [unique_id "acj7OYzBujdPHsq7wyQcLgAAAoo"]
[Sun Mar 29 18:13:15.179598 2026] [:error] [pid 32257:tid 32338] [client 20.151.168.140:53820] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "acj7OyE3TArOFrUtgWrDPQAAAJQ"]
[Sun Mar 29 18:13:19.458422 2026] [:error] [pid 32257:tid 32333] [client 20.151.168.140:64971] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "acj7PyE3TArOFrUtgWrDRwAAAI8"]
[Sun Mar 29 18:13:20.982311 2026] [:error] [pid 23250:tid 23256] [client 20.151.168.140:47449] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "acj7QJxrpj-dQjy1cvrelgAAAkQ"]
[Sun Mar 29 18:13:22.163373 2026] [:error] [pid 32359:tid 32379] [client 20.151.168.140:64340] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "acj7QgMb8G3UzfQP3WgVOAAAANI"]
[Sun Mar 29 18:13:23.517026 2026] [:error] [pid 23137:tid 23162] [client 20.151.168.140:64326] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tbute.php"] [unique_id "acj7QxaWQa7LdZ_qGFbc-AAAAZc"]
[Sun Mar 29 18:13:25.058332 2026] [:error] [pid 23250:tid 23271] [client 20.151.168.140:58917] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tbute.php"] [unique_id "acj7RZxrpj-dQjy1cvreoQAAAlM"]
[Sun Mar 29 18:13:25.950807 2026] [:error] [pid 32254:tid 32267] [client 20.151.168.140:47442] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tbute.php"] [unique_id "acj7Raug2IHuyGgCTn9IuwAAAAM"]
[Sun Mar 29 18:13:26.687938 2026] [:error] [pid 23137:tid 23145] [client 20.151.168.140:20430] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tbute.php"] [unique_id "acj7RhaWQa7LdZ_qGFbdAAAAAYY"]
[Sun Mar 29 18:13:28.127818 2026] [:error] [pid 23167:tid 23171] [client 20.151.168.140:32802] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rovoj.php"] [unique_id "acj7SBIAHJCFaHff3_eJeAAAAcE"]
[Sun Mar 29 18:13:29.933082 2026] [:error] [pid 32255:tid 32302] [client 20.151.168.140:17416] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rovoj.php"] [unique_id "acj7SWnfn-AtRoMbquyTBAAAAEs"]
[Sun Mar 29 18:13:31.591363 2026] [:error] [pid 23168:tid 23218] [client 20.151.168.140:58940] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rovoj.php"] [unique_id "acj7S2P8p0yRL8ot_29eQQAAAhU"]
[Sun Mar 29 18:13:32.478836 2026] [:error] [pid 23167:tid 23190] [client 20.151.168.140:39604] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rovoj.php"] [unique_id "acj7TBIAHJCFaHff3_eJfwAAAdQ"]
[Sun Mar 29 18:13:35.833887 2026] [:error] [pid 23167:tid 23179] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/r3grt7.php
[Sun Mar 29 18:13:36.043698 2026] [:error] [pid 23167:tid 23171] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/phina.php
[Sun Mar 29 18:13:36.252554 2026] [:error] [pid 23167:tid 23186] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Sun Mar 29 18:13:36.463149 2026] [:error] [pid 23167:tid 23170] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/fs6.php
[Sun Mar 29 18:13:36.675399 2026] [:error] [pid 23167:tid 23187] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/fs7.php
[Sun Mar 29 18:13:36.884626 2026] [:error] [pid 23167:tid 23188] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/kbfr.php
[Sun Mar 29 18:13:37.179482 2026] [:error] [pid 23167:tid 23180] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/595.php
[Sun Mar 29 18:13:38.648595 2026] [:error] [pid 23167:tid 23180] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/x1.php
[Sun Mar 29 18:13:38.856826 2026] [:error] [pid 23167:tid 23184] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/gk.php
[Sun Mar 29 18:13:39.106570 2026] [:error] [pid 23167:tid 23194] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Sun Mar 29 18:13:39.345790 2026] [:error] [pid 23167:tid 23177] [client 20.151.168.140:40701] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Sun Mar 29 18:13:39.574170 2026] [:error] [pid 23167:tid 23192] [client 20.151.168.140:40701] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acj7UxIAHJCFaHff3_eJlAAAAdY"]
[Sun Mar 29 18:13:41.894851 2026] [:error] [pid 23168:tid 23208] [client 20.151.168.140:20458] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acj7VWP8p0yRL8ot_29eVAAAAgs"]
[Sun Mar 29 18:13:42.979446 2026] [:error] [pid 23137:tid 23148] [client 20.151.168.140:17430] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acj7VhaWQa7LdZ_qGFbdEQAAAYk"]
[Sun Mar 29 18:13:44.044041 2026] [:error] [pid 23284:tid 23310] [client 20.151.168.140:64375] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acj7WIzBujdPHsq7wyQccwAAApg"]
[Sun Mar 29 18:13:45.011414 2026] [:error] [pid 32257:tid 32330] [client 20.151.168.140:53711] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws79.php"] [unique_id "acj7WSE3TArOFrUtgWrDfgAAAIw"]
[Sun Mar 29 18:13:45.693498 2026] [:error] [pid 32359:tid 32375] [client 20.151.168.140:47426] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws79.php"] [unique_id "acj7WQMb8G3UzfQP3WgVWAAAAM4"]
[Sun Mar 29 18:13:46.486213 2026] [:error] [pid 23168:tid 23209] [client 20.151.168.140:32811] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws79.php"] [unique_id "acj7WmP8p0yRL8ot_29eagAAAgw"]
[Sun Mar 29 18:13:47.236363 2026] [:error] [pid 23250:tid 23259] [client 20.151.168.140:32817] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws79.php"] [unique_id "acj7W5xrpj-dQjy1cvreyQAAAkc"]
[Sun Mar 29 18:13:47.739539 2026] [:error] [pid 23284:tid 23309] [client 20.151.168.140:17436] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws78.php"] [unique_id "acj7W4zBujdPHsq7wyQcfAAAApc"]
[Sun Mar 29 18:13:48.402674 2026] [:error] [pid 23137:tid 23139] [client 20.151.168.140:47480] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws78.php"] [unique_id "acj7XBaWQa7LdZ_qGFbdHAAAAYA"]
[Sun Mar 29 18:13:48.919545 2026] [:error] [pid 23167:tid 23174] [client 20.151.168.140:53726] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws78.php"] [unique_id "acj7XBIAHJCFaHff3_eJnQAAAcQ"]
[Sun Mar 29 18:13:49.379704 2026] [:error] [pid 23137:tid 23157] [client 20.151.168.140:27223] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws78.php"] [unique_id "acj7XRaWQa7LdZ_qGFbdIAAAAZI"]
[Sun Mar 29 18:13:49.847850 2026] [:error] [pid 23167:tid 23172] [client 20.151.168.140:58901] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws50.php"] [unique_id "acj7XRIAHJCFaHff3_eJnwAAAcI"]
[Sun Mar 29 18:13:50.411544 2026] [:error] [pid 1524:tid 1553] [client 20.151.168.140:58924] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws50.php"] [unique_id "acj7XloaWSl2asqQCh9wXAAAARU"]
[Sun Mar 29 18:13:51.094599 2026] [:error] [pid 32255:tid 32307] [client 20.151.168.140:17470] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws50.php"] [unique_id "acj7X2nfn-AtRoMbquyTIAAAAFA"]
[Sun Mar 29 18:13:51.838214 2026] [:error] [pid 23167:tid 23191] [client 20.151.168.140:53715] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws50.php"] [unique_id "acj7XxIAHJCFaHff3_eJpgAAAdU"]
[Sun Mar 29 18:13:52.268736 2026] [:error] [pid 23167:tid 23185] [client 20.151.168.140:39584] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws44.php"] [unique_id "acj7YBIAHJCFaHff3_eJqgAAAc8"]
[Sun Mar 29 18:13:52.907179 2026] [:error] [pid 32257:tid 32329] [client 20.151.168.140:53696] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws44.php"] [unique_id "acj7YCE3TArOFrUtgWrDgwAAAIs"]
[Sun Mar 29 18:13:53.439426 2026] [:error] [pid 32255:tid 32311] [client 20.151.168.140:17417] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws44.php"] [unique_id "acj7YWnfn-AtRoMbquyTKgAAAFQ"]
[Sun Mar 29 18:13:53.883464 2026] [:error] [pid 32359:tid 32368] [client 20.151.168.140:64996] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws44.php"] [unique_id "acj7YQMb8G3UzfQP3WgVYAAAAMc"]
[Sun Mar 29 18:13:54.692645 2026] [:error] [pid 23168:tid 23206] [client 20.151.168.140:47447] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws43.php"] [unique_id "acj7YmP8p0yRL8ot_29edgAAAgk"]
[Sun Mar 29 18:13:55.534350 2026] [:error] [pid 32255:tid 32303] [client 20.151.168.140:64331] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws43.php"] [unique_id "acj7Y2nfn-AtRoMbquyTMwAAAEw"]
[Sun Mar 29 18:13:56.517977 2026] [:error] [pid 32257:tid 32326] [client 20.151.168.140:53702] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws43.php"] [unique_id "acj7ZCE3TArOFrUtgWrDiQAAAIg"]
[Sun Mar 29 18:13:57.372353 2026] [:error] [pid 23250:tid 23260] [client 20.151.168.140:47472] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws43.php"] [unique_id "acj7ZZxrpj-dQjy1cvre0QAAAkg"]
[Sun Mar 29 18:13:58.253785 2026] [:error] [pid 23168:tid 23202] [client 20.151.168.140:27229] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "acj7ZmP8p0yRL8ot_29edwAAAgU"]
[Sun Mar 29 18:13:59.361269 2026] [:error] [pid 32255:tid 32306] [client 20.151.168.140:30286] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "acj7Z2nfn-AtRoMbquyTQwAAAE8"]
[Sun Mar 29 18:14:00.619802 2026] [:error] [pid 23284:tid 23306] [client 20.151.168.140:30324] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "acj7aIzBujdPHsq7wyQcigAAApQ"]
[Sun Mar 29 18:14:06.579291 2026] [:error] [pid 32255:tid 32300] [client 20.151.168.140:20451] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "acj7bmnfn-AtRoMbquyTYAAAAEk"]
[Sun Mar 29 18:14:11.338349 2026] [:error] [pid 32255:tid 32302] [client 20.151.168.140:39580] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "acj7c2nfn-AtRoMbquyTdAAAAEs"]
[Sun Mar 29 18:14:12.251359 2026] [:error] [pid 23167:tid 23184] [client 20.151.168.140:32812] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "acj7dBIAHJCFaHff3_eJygAAAc4"]
[Sun Mar 29 18:14:13.217837 2026] [:error] [pid 23284:tid 23300] [client 20.151.168.140:64373] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "acj7dYzBujdPHsq7wyQcrgAAAo4"]
[Sun Mar 29 18:14:14.798618 2026] [:error] [pid 32359:tid 32373] [client 20.151.168.140:53802] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "acj7dgMb8G3UzfQP3WgVcQAAAMw"]
[Sun Mar 29 18:14:16.631823 2026] [:error] [pid 1524:tid 1530] [client 20.151.168.140:39614] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws36.php"] [unique_id "acj7eFoaWSl2asqQCh9wewAAAQI"]
[Sun Mar 29 18:14:17.403472 2026] [:error] [pid 32359:tid 32384] [client 20.151.168.140:32819] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws36.php"] [unique_id "acj7eQMb8G3UzfQP3WgVdwAAANc"]
[Sun Mar 29 18:14:29.536300 2026] [:error] [pid 23284:tid 23307] [client 20.151.168.140:44645] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws36.php"] [unique_id "acj7hYzBujdPHsq7wyQcygAAApU"]
[Sun Mar 29 18:14:40.305752 2026] [:error] [pid 23284:tid 23306] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/vwxbi.php
[Sun Mar 29 18:14:40.515005 2026] [:error] [pid 23284:tid 23308] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/shellerr.php
[Sun Mar 29 18:14:40.723811 2026] [:error] [pid 23284:tid 23295] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/vaza.php
[Sun Mar 29 18:14:41.449146 2026] [:error] [pid 23284:tid 23298] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/cvz.php
[Sun Mar 29 18:14:41.740595 2026] [:error] [pid 23284:tid 23287] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Sun Mar 29 18:14:41.948043 2026] [:error] [pid 23284:tid 23300] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Sun Mar 29 18:14:43.528564 2026] [:error] [pid 23284:tid 23304] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/sweg.php
[Sun Mar 29 18:14:43.749853 2026] [:error] [pid 23284:tid 23299] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/sql.php
[Sun Mar 29 18:14:43.958227 2026] [:error] [pid 23284:tid 23301] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/sc.php
[Sun Mar 29 18:14:44.508319 2026] [:error] [pid 23284:tid 23307] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/eee.php
[Sun Mar 29 18:14:44.757266 2026] [:error] [pid 23284:tid 23291] [client 20.151.168.140:20426] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Sun Mar 29 18:14:45.024134 2026] [:error] [pid 23284:tid 23293] [client 20.151.168.140:20426] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "acj7lYzBujdPHsq7wyQc9gAAAoc"]
[Sun Mar 29 18:14:49.754087 2026] [:error] [pid 32255:tid 32298] [client 20.151.168.140:20446] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "acj7mWnfn-AtRoMbquyTtQAAAEc"]
[Sun Mar 29 18:14:53.432301 2026] [:error] [pid 23284:tid 23300] [client 20.151.168.140:44667] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "acj7nYzBujdPHsq7wyQdBQAAAo4"]
[Sun Mar 29 18:14:54.606807 2026] [:error] [pid 23250:tid 23259] [client 20.151.168.140:58069] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "acj7npxrpj-dQjy1cvrfAQAAAkc"]
[Sun Mar 29 18:14:55.305098 2026] [:error] [pid 32255:tid 32293] [client 20.151.168.140:47450] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roter.php"] [unique_id "acj7n2nfn-AtRoMbquyTzgAAAEI"]
[Sun Mar 29 18:14:58.614954 2026] [:error] [pid 23167:tid 23189] [client 20.151.168.140:53757] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roter.php"] [unique_id "acj7ohIAHJCFaHff3_eKHwAAAdM"]
[Sun Mar 29 18:14:59.846608 2026] [:error] [pid 23250:tid 23264] [client 20.151.168.140:58058] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roter.php"] [unique_id "acj7o5xrpj-dQjy1cvrfBAAAAkw"]
[Sun Mar 29 18:15:00.870944 2026] [:error] [pid 32255:tid 32295] [client 20.151.168.140:8201] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roter.php"] [unique_id "acj7pGnfn-AtRoMbquyT4gAAAEQ"]
[Sun Mar 29 18:15:02.432513 2026] [:error] [pid 23250:tid 23262] [client 20.151.168.140:40675] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "acj7ppxrpj-dQjy1cvrfCgAAAko"]
[Sun Mar 29 18:15:03.048482 2026] [:error] [pid 23250:tid 23254] [client 20.151.168.140:27221] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "acj7p5xrpj-dQjy1cvrfCwAAAkI"]
[Sun Mar 29 18:15:03.828679 2026] [:error] [pid 32255:tid 32314] [client 20.151.168.140:43513] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "acj7p2nfn-AtRoMbquyT9wAAAFc"]
[Sun Mar 29 18:15:04.314157 2026] [:error] [pid 32255:tid 32291] [client 20.151.168.140:27233] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "acj7qGnfn-AtRoMbquyT-QAAAEA"]
[Sun Mar 29 18:15:05.041229 2026] [:error] [pid 23284:tid 23290] [client 20.151.168.140:58906] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/save.php"] [unique_id "acj7qYzBujdPHsq7wyQdFAAAAoQ"]
[Sun Mar 29 18:15:05.732855 2026] [:error] [pid 32257:tid 32342] [client 20.151.168.140:52365] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/save.php"] [unique_id "acj7qSE3TArOFrUtgWrDvgAAAJg"]
[Sun Mar 29 18:15:06.362897 2026] [:error] [pid 23250:tid 23258] [client 20.151.168.140:27227] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/save.php"] [unique_id "acj7qpxrpj-dQjy1cvrfDwAAAkY"]
[Sun Mar 29 18:15:07.110823 2026] [:error] [pid 23284:tid 23291] [client 20.151.168.140:8251] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/save.php"] [unique_id "acj7q4zBujdPHsq7wyQdIgAAAoU"]
[Sun Mar 29 18:15:07.575967 2026] [:error] [pid 32254:tid 32281] [client 20.151.168.140:27253] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acj7q6ug2IHuyGgCTn9I7gAAABE"]
[Sun Mar 29 18:15:08.490744 2026] [:error] [pid 23250:tid 23264] [client 20.151.168.140:8236] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acj7rJxrpj-dQjy1cvrfEAAAAkw"]
[Sun Mar 29 18:15:09.189455 2026] [:error] [pid 32255:tid 32303] [client 20.151.168.140:64327] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acj7rWnfn-AtRoMbquyT_gAAAEw"]
[Sun Mar 29 18:15:10.022522 2026] [:error] [pid 32359:tid 32365] [client 20.151.168.140:43462] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acj7rgMb8G3UzfQP3WgViAAAAMQ"]
[Sun Mar 29 18:15:11.086429 2026] [:error] [pid 23250:tid 23253] [client 20.151.168.140:64356] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n1GiO.php"] [unique_id "acj7r5xrpj-dQjy1cvrfEgAAAkE"]
[Sun Mar 29 18:15:12.330405 2026] [:error] [pid 32255:tid 32312] [client 20.151.168.140:45175] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n1GiO.php"] [unique_id "acj7sGnfn-AtRoMbquyUDgAAAFU"]
[Sun Mar 29 18:15:13.247156 2026] [:error] [pid 23167:tid 23191] [client 20.151.168.140:58925] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n1GiO.php"] [unique_id "acj7sRIAHJCFaHff3_eKNAAAAdU"]
[Sun Mar 29 18:15:14.140650 2026] [:error] [pid 23168:tid 23204] [client 20.151.168.140:58110] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n1GiO.php"] [unique_id "acj7smP8p0yRL8ot_29ekAAAAgc"]
[Sun Mar 29 18:15:15.541562 2026] [:error] [pid 23137:tid 23151] [client 20.151.168.140:44610] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pLdK1.php"] [unique_id "acj7sxaWQa7LdZ_qGFbdUgAAAYw"]
[Sun Mar 29 18:15:16.545752 2026] [:error] [pid 32255:tid 32295] [client 20.151.168.140:21843] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pLdK1.php"] [unique_id "acj7tGnfn-AtRoMbquyUXgAAAEQ"]
[Sun Mar 29 18:15:17.855333 2026] [:error] [pid 23167:tid 23185] [client 20.151.168.140:34164] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pLdK1.php"] [unique_id "acj7tRIAHJCFaHff3_eKSQAAAc8"]
[Sun Mar 29 18:15:18.813381 2026] [:error] [pid 23284:tid 23298] [client 20.151.168.140:27208] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pLdK1.php"] [unique_id "acj7tozBujdPHsq7wyQdOAAAAow"]
[Sun Mar 29 18:15:20.416038 2026] [:error] [pid 23167:tid 23194] [client 20.151.168.140:45150] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/llb1J.php"] [unique_id "acj7uBIAHJCFaHff3_eKTQAAAdg"]
[Sun Mar 29 18:15:22.047831 2026] [:error] [pid 23284:tid 23301] [client 20.151.168.140:44613] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/llb1J.php"] [unique_id "acj7uozBujdPHsq7wyQdPQAAAo8"]
[Sun Mar 29 18:15:23.315717 2026] [:error] [pid 23167:tid 23170] [client 20.151.168.140:45121] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/llb1J.php"] [unique_id "acj7uxIAHJCFaHff3_eKdwAAAcA"]
[Sun Mar 29 18:15:24.724140 2026] [:error] [pid 23167:tid 23187] [client 20.151.168.140:17882] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/llb1J.php"] [unique_id "acj7vBIAHJCFaHff3_eKfQAAAdE"]
[Sun Mar 29 18:15:27.721832 2026] [:error] [pid 23167:tid 23188] [client 20.151.168.140:58071] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jeZDu.php"] [unique_id "acj7vxIAHJCFaHff3_eKhgAAAdI"]
[Sun Mar 29 18:15:34.128501 2026] [:error] [pid 32255:tid 32300] [client 20.151.168.140:17893] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jeZDu.php"] [unique_id "acj7xmnfn-AtRoMbquyUiwAAAEk"]
[Sun Mar 29 18:15:45.284753 2026] [:error] [pid 23167:tid 23194] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/gec.php
[Sun Mar 29 18:15:45.494764 2026] [:error] [pid 23167:tid 23177] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/bfuKK.php
[Sun Mar 29 18:15:45.703774 2026] [:error] [pid 23167:tid 23180] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/OpVq6.php
[Sun Mar 29 18:15:45.974630 2026] [:error] [pid 23167:tid 23189] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/Q73BO.php
[Sun Mar 29 18:15:46.214277 2026] [:error] [pid 23167:tid 23188] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/rmpoa.php
[Sun Mar 29 18:15:46.848027 2026] [:error] [pid 23167:tid 23186] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Sun Mar 29 18:15:47.057039 2026] [:error] [pid 23167:tid 23171] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Sun Mar 29 18:15:47.287721 2026] [:error] [pid 23167:tid 23181] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Sun Mar 29 18:15:47.496199 2026] [:error] [pid 23167:tid 23185] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Sun Mar 29 18:15:47.704794 2026] [:error] [pid 23167:tid 23189] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sun Mar 29 18:15:47.913399 2026] [:error] [pid 23167:tid 23178] [client 20.151.168.140:39670] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Sun Mar 29 18:15:48.140680 2026] [:error] [pid 23167:tid 23170] [client 20.151.168.140:39670] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "acj71BIAHJCFaHff3_eKsQAAAcA"]
[Sun Mar 29 18:15:48.858624 2026] [:error] [pid 23284:tid 23289] [client 20.151.168.140:39661] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "acj71IzBujdPHsq7wyQdYQAAAoM"]
[Sun Mar 29 18:15:49.861162 2026] [:error] [pid 23250:tid 23267] [client 20.151.168.140:43495] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "acj71Zxrpj-dQjy1cvrfMQAAAk8"]
[Sun Mar 29 18:15:51.319792 2026] [:error] [pid 32257:tid 32319] [client 20.151.168.140:43499] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v4.php"] [unique_id "acj71yE3TArOFrUtgWrD-gAAAIE"]
[Sun Mar 29 18:15:52.348987 2026] [:error] [pid 23250:tid 23263] [client 20.151.168.140:52932] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "acj72Jxrpj-dQjy1cvrfOAAAAks"]
[Sun Mar 29 18:15:54.033457 2026] [:error] [pid 32255:tid 32293] [client 20.151.168.140:58070] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "acj72mnfn-AtRoMbquyUowAAAEI"]
[Sun Mar 29 18:15:55.628752 2026] [:error] [pid 23250:tid 23269] [client 20.151.168.140:43457] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "acj725xrpj-dQjy1cvrfPgAAAlE"]
[Sun Mar 29 18:15:57.404222 2026] [:error] [pid 23250:tid 23274] [client 20.151.168.140:58086] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ant.php"] [unique_id "acj73Zxrpj-dQjy1cvrfQgAAAlY"]
[Sun Mar 29 18:15:58.472424 2026] [:error] [pid 32257:tid 32323] [client 20.151.168.140:39654] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acj73iE3TArOFrUtgWrEDgAAAIU"]
[Sun Mar 29 18:15:59.909078 2026] [:error] [pid 23284:tid 23299] [client 20.151.168.140:52951] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acj734zBujdPHsq7wyQdcQAAAo0"]
[Sun Mar 29 18:16:01.517715 2026] [:error] [pid 23167:tid 23193] [client 20.151.168.140:58081] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acj74RIAHJCFaHff3_eKugAAAdc"]
[Sun Mar 29 18:16:03.690988 2026] [:error] [pid 23284:tid 23297] [client 20.151.168.140:7668] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acj744zBujdPHsq7wyQdfQAAAos"]
[Sun Mar 29 18:16:04.896984 2026] [:error] [pid 23167:tid 23186] [client 20.151.168.140:7500] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "acj75BIAHJCFaHff3_eKwAAAAdA"]
[Sun Mar 29 18:16:05.513876 2026] [:error] [pid 32255:tid 32304] [client 20.151.168.140:58873] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "acj75Wnfn-AtRoMbquyUyAAAAE0"]
[Sun Mar 29 18:16:06.348365 2026] [:error] [pid 23168:tid 23208] [client 20.151.168.140:8230] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "acj75mP8p0yRL8ot_29e1AAAAgs"]
[Sun Mar 29 18:16:07.149305 2026] [:error] [pid 32255:tid 32303] [client 20.151.168.140:8082] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cc13.php"] [unique_id "acj752nfn-AtRoMbquyUzAAAAEw"]
[Sun Mar 29 18:16:07.991311 2026] [:error] [pid 32254:tid 32264] [client 20.151.168.140:58838] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "acj756ug2IHuyGgCTn9JCQAAAAA"]
[Sun Mar 29 18:16:08.989423 2026] [:error] [pid 32255:tid 32312] [client 20.151.168.140:7662] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "acj76Gnfn-AtRoMbquyU0gAAAFU"]
[Sun Mar 29 18:16:09.937628 2026] [:error] [pid 23167:tid 23186] [client 20.151.168.140:17878] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "acj76RIAHJCFaHff3_eKyAAAAdA"]
[Sun Mar 29 18:16:11.235660 2026] [:error] [pid 32359:tid 32367] [client 20.151.168.140:39665] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "acj76wMb8G3UzfQP3WgVrQAAAMY"]
[Sun Mar 29 18:16:12.346984 2026] [:error] [pid 23167:tid 23185] [client 20.151.168.140:17903] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acj77BIAHJCFaHff3_eK0wAAAc8"]
[Sun Mar 29 18:16:13.156774 2026] [:error] [pid 32255:tid 32313] [client 20.151.168.140:58057] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acj77Wnfn-AtRoMbquyU5AAAAFY"]
[Sun Mar 29 18:16:14.187259 2026] [:error] [pid 32255:tid 32301] [client 20.151.168.140:8105] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acj77mnfn-AtRoMbquyU6AAAAEo"]
[Sun Mar 29 18:16:15.438791 2026] [:error] [pid 23168:tid 23211] [client 20.151.168.140:8069] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acj772P8p0yRL8ot_29e2QAAAg4"]
[Sun Mar 29 18:16:16.042684 2026] [:error] [pid 32255:tid 32302] [client 20.151.168.140:46259] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "acj78Gnfn-AtRoMbquyU8wAAAEs"]
[Sun Mar 29 18:16:16.629141 2026] [:error] [pid 32255:tid 32312] [client 20.151.168.140:24656] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "acj78Gnfn-AtRoMbquyU-gAAAFU"]
[Sun Mar 29 18:16:17.234522 2026] [:error] [pid 32255:tid 32303] [client 20.151.168.140:58088] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "acj78Wnfn-AtRoMbquyU_gAAAEw"]
[Sun Mar 29 18:16:18.037778 2026] [:error] [pid 23167:tid 23171] [client 20.151.168.140:7679] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "acj78hIAHJCFaHff3_eK1wAAAcE"]
[Sun Mar 29 18:16:19.142407 2026] [:error] [pid 23168:tid 23200] [client 20.151.168.140:46269] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acj782P8p0yRL8ot_29e3AAAAgM"]
[Sun Mar 29 18:16:19.910930 2026] [:error] [pid 23250:tid 23270] [client 20.151.168.140:46235] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acj785xrpj-dQjy1cvrfWQAAAlI"]
[Sun Mar 29 18:16:20.526938 2026] [:error] [pid 23250:tid 23266] [client 20.151.168.140:7506] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acj79Jxrpj-dQjy1cvrfXgAAAk4"]
[Sun Mar 29 18:16:21.373178 2026] [:error] [pid 23250:tid 23262] [client 20.151.168.140:30335] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acj79Zxrpj-dQjy1cvrfZgAAAko"]
[Sun Mar 29 18:16:22.354710 2026] [:error] [pid 1524:tid 1551] [client 20.151.168.140:58834] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acj79loaWSl2asqQCh9wxgAAARM"]
[Sun Mar 29 18:16:23.008817 2026] [:error] [pid 23137:tid 23144] [client 20.151.168.140:46258] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acj79xaWQa7LdZ_qGFbdlAAAAYU"]
[Sun Mar 29 18:16:24.183207 2026] [:error] [pid 32255:tid 32299] [client 20.151.168.140:8107] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acj7-Gnfn-AtRoMbquyVDgAAAEg"]
[Sun Mar 29 18:16:24.758967 2026] [:error] [pid 32255:tid 32307] [client 20.151.168.140:39640] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "acj7-Gnfn-AtRoMbquyVFAAAAFA"]
[Sun Mar 29 18:16:25.910368 2026] [:error] [pid 32255:tid 32307] [client 20.151.168.140:58077] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dragonshell.php"] [unique_id "acj7-Wnfn-AtRoMbquyVHAAAAFA"]
[Sun Mar 29 18:16:26.991429 2026] [:error] [pid 32255:tid 32303] [client 20.151.168.140:34124] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dragonshell.php"] [unique_id "acj7-mnfn-AtRoMbquyVIgAAAEw"]
[Sun Mar 29 18:16:27.659850 2026] [:error] [pid 23167:tid 23175] [client 20.151.168.140:7492] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dragonshell.php"] [unique_id "acj7-xIAHJCFaHff3_eK2gAAAcU"]
[Sun Mar 29 18:16:28.425769 2026] [:error] [pid 23168:tid 23220] [client 20.151.168.140:52988] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dragonshell.php"] [unique_id "acj7_GP8p0yRL8ot_29e5wAAAhc"]
[Sun Mar 29 18:16:29.233672 2026] [:error] [pid 23250:tid 23271] [client 20.151.168.140:39632] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "acj7_Zxrpj-dQjy1cvrfbAAAAlM"]
[Sun Mar 29 18:16:31.913480 2026] [:error] [pid 23167:tid 23181] [client 20.151.168.140:58821] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "acj7_xIAHJCFaHff3_eK4gAAAcs"]
[Sun Mar 29 18:16:32.556010 2026] [:error] [pid 23168:tid 23198] [client 20.151.168.140:7622] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "acj8AGP8p0yRL8ot_29e7wAAAgE"]
[Sun Mar 29 18:16:33.355825 2026] [:error] [pid 32255:tid 32310] [client 20.151.168.140:58067] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "acj8AWnfn-AtRoMbquyVKwAAAFM"]
[Sun Mar 29 18:16:35.245540 2026] [:error] [pid 23137:tid 23154] [client 20.151.168.140:58829] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/caiij.php"] [unique_id "acj8AxaWQa7LdZ_qGFbdoAAAAY8"]
[Sun Mar 29 18:16:36.740457 2026] [:error] [pid 23167:tid 23193] [client 20.151.168.140:52938] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/caiij.php"] [unique_id "acj8BBIAHJCFaHff3_eK8AAAAdc"]
[Sun Mar 29 18:16:38.781416 2026] [:error] [pid 23168:tid 23214] [client 20.151.168.140:24660] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/caiij.php"] [unique_id "acj8BmP8p0yRL8ot_29e8QAAAhE"]
[Sun Mar 29 18:16:42.275686 2026] [:error] [pid 23168:tid 23220] [client 20.151.168.140:34123] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/caiij.php"] [unique_id "acj8CmP8p0yRL8ot_29e8wAAAhc"]
[Sun Mar 29 18:16:42.857709 2026] [:error] [pid 32255:tid 32304] [client 20.151.168.140:7761] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gel4y.php"] [unique_id "acj8Cmnfn-AtRoMbquyVQgAAAE0"]
[Sun Mar 29 18:16:44.838130 2026] [:error] [pid 32359:tid 32368] [client 20.151.168.140:46222] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gel4y.php"] [unique_id "acj8DAMb8G3UzfQP3WgVvgAAAMc"]
[Sun Mar 29 18:16:47.624829 2026] [:error] [pid 32257:tid 32324] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php
[Sun Mar 29 18:16:47.833027 2026] [:error] [pid 32257:tid 32331] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/uxijj.php
[Sun Mar 29 18:16:48.040142 2026] [:error] [pid 32257:tid 32325] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/rkiea.php
[Sun Mar 29 18:16:48.281534 2026] [:error] [pid 32257:tid 32319] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/resp.php
[Sun Mar 29 18:16:48.780070 2026] [:error] [pid 32257:tid 32337] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/lanou.php
[Sun Mar 29 18:16:48.987599 2026] [:error] [pid 32257:tid 32340] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/eursi.php
[Sun Mar 29 18:16:49.212436 2026] [:error] [pid 32257:tid 32321] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/pas2.php
[Sun Mar 29 18:16:49.424191 2026] [:error] [pid 32257:tid 32330] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/schal.php
[Sun Mar 29 18:16:49.631573 2026] [:error] [pid 32257:tid 32338] [client 20.151.168.140:7531] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sun Mar 29 18:16:50.297735 2026] [:error] [pid 32257:tid 32333] [client 20.151.168.140:7531] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtyh.php"] [unique_id "acj8EiE3TArOFrUtgWrEWAAAAI8"]
[Sun Mar 29 18:16:52.243818 2026] [:error] [pid 23167:tid 23180] [client 20.151.168.140:7800] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtyh.php"] [unique_id "acj8FBIAHJCFaHff3_eLDQAAAco"]
[Sun Mar 29 18:16:53.491723 2026] [:error] [pid 32257:tid 32333] [client 20.151.168.140:17870] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtyh.php"] [unique_id "acj8FSE3TArOFrUtgWrEZAAAAI8"]
[Sun Mar 29 18:16:54.852662 2026] [:error] [pid 32359:tid 32371] [client 20.151.168.140:7771] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtyh.php"] [unique_id "acj8FgMb8G3UzfQP3WgVxAAAAMo"]
[Sun Mar 29 18:16:55.763497 2026] [:error] [pid 23284:tid 23290] [client 20.151.168.140:7503] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wta.php"] [unique_id "acj8F4zBujdPHsq7wyQdtAAAAoQ"]
[Sun Mar 29 18:16:59.005349 2026] [:error] [pid 23250:tid 23273] [client 20.151.168.140:7632] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wta.php"] [unique_id "acj8G5xrpj-dQjy1cvrfjgAAAlU"]
[Sun Mar 29 18:17:00.240813 2026] [:error] [pid 1524:tid 1545] [client 20.151.168.140:58886] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wta.php"] [unique_id "acj8HFoaWSl2asqQCh9w2AAAAQ4"]
[Sun Mar 29 18:17:01.279859 2026] [:error] [pid 23250:tid 23255] [client 20.151.168.140:7794] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wta.php"] [unique_id "acj8HZxrpj-dQjy1cvrfoAAAAkM"]
[Sun Mar 29 18:17:01.942657 2026] [:error] [pid 23168:tid 23210] [client 20.151.168.140:8097] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acj8HWP8p0yRL8ot_29fAgAAAg0"]
[Sun Mar 29 18:17:02.916573 2026] [:error] [pid 23284:tid 23301] [client 20.151.168.140:58877] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acj8HozBujdPHsq7wyQd-AAAAo8"]
[Sun Mar 29 18:17:03.861945 2026] [:error] [pid 32255:tid 32299] [client 20.151.168.140:17881] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acj8H2nfn-AtRoMbquyVcQAAAEg"]
[Sun Mar 29 18:17:05.208034 2026] [:error] [pid 23167:tid 23171] [client 20.151.168.140:53756] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acj8IRIAHJCFaHff3_eLGgAAAcE"]
[Sun Mar 29 18:17:06.501339 2026] [:error] [pid 32255:tid 32292] [client 20.151.168.140:52935] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acj8Imnfn-AtRoMbquyVdwAAAEE"]
[Sun Mar 29 18:17:08.213017 2026] [:error] [pid 1524:tid 1541] [client 20.151.168.140:58863] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acj8JFoaWSl2asqQCh9w3QAAAQo"]
[Sun Mar 29 18:17:09.937103 2026] [:error] [pid 32257:tid 32327] [client 20.151.168.140:8239] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acj8JSE3TArOFrUtgWrEbwAAAIk"]
[Sun Mar 29 18:17:10.972441 2026] [:error] [pid 32255:tid 32302] [client 20.151.168.140:7787] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acj8Jmnfn-AtRoMbquyVfAAAAEs"]
[Sun Mar 29 18:17:12.853695 2026] [:error] [pid 23284:tid 23288] [client 20.151.168.140:7495] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "acj8KIzBujdPHsq7wyQeCwAAAoI"]
[Sun Mar 29 18:17:14.335357 2026] [:error] [pid 23137:tid 23154] [client 20.151.168.140:8090] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "acj8KhaWQa7LdZ_qGFbd3QAAAY8"]
[Sun Mar 29 18:17:15.414534 2026] [:error] [pid 32257:tid 32325] [client 20.151.168.140:34132] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "acj8KyE3TArOFrUtgWrEdAAAAIc"]
[Sun Mar 29 18:17:18.148075 2026] [:error] [pid 32257:tid 32330] [client 20.151.168.140:7625] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "acj8LiE3TArOFrUtgWrEfgAAAIw"]
[Sun Mar 29 18:17:19.556955 2026] [:error] [pid 32359:tid 32361] [client 20.151.168.140:8118] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "acj8LwMb8G3UzfQP3WgV0gAAAMA"]
[Sun Mar 29 18:17:20.396755 2026] [:error] [pid 23167:tid 23173] [client 20.151.168.140:43458] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "acj8MBIAHJCFaHff3_eLLgAAAcM"]
[Sun Mar 29 18:17:21.482432 2026] [:error] [pid 23168:tid 23198] [client 20.151.168.140:39641] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "acj8MWP8p0yRL8ot_29fDAAAAgE"]
[Sun Mar 29 18:17:25.058062 2026] [:error] [pid 32254:tid 32274] [client 20.151.168.140:58865] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class.php"] [unique_id "acj8Naug2IHuyGgCTn9JNQAAAAo"]
[Sun Mar 29 18:17:26.149556 2026] [:error] [pid 23137:tid 23143] [client 20.151.168.140:24687] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acj8NhaWQa7LdZ_qGFbd7AAAAYQ"]
[Sun Mar 29 18:17:26.798038 2026] [:error] [pid 32257:tid 32342] [client 20.151.168.140:17864] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acj8NiE3TArOFrUtgWrEiAAAAJg"]
[Sun Mar 29 18:17:27.433741 2026] [:error] [pid 23167:tid 23177] [client 20.151.168.140:46240] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acj8NxIAHJCFaHff3_eLOAAAAcc"]
[Sun Mar 29 18:17:27.986544 2026] [:error] [pid 32255:tid 32309] [client 20.151.168.140:39648] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acj8N2nfn-AtRoMbquyViQAAAFI"]
[Sun Mar 29 18:17:28.686396 2026] [:error] [pid 32359:tid 32364] [client 20.151.168.140:58856] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "acj8OAMb8G3UzfQP3WgV3QAAAMM"]
[Sun Mar 29 18:17:30.581938 2026] [:error] [pid 23250:tid 23265] [client 20.151.168.140:58060] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "acj8Opxrpj-dQjy1cvrftgAAAk0"]
[Sun Mar 29 18:17:31.194795 2026] [:error] [pid 23250:tid 23254] [client 20.151.168.140:52979] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "acj8O5xrpj-dQjy1cvrfuQAAAkI"]
[Sun Mar 29 18:17:31.877516 2026] [:error] [pid 23250:tid 23266] [client 20.151.168.140:39644] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "acj8O5xrpj-dQjy1cvrfvQAAAk4"]
[Sun Mar 29 18:17:32.456659 2026] [:error] [pid 23250:tid 23275] [client 20.151.168.140:58854] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "acj8PJxrpj-dQjy1cvrfwQAAAlc"]
[Sun Mar 29 18:17:33.712274 2026] [:error] [pid 32257:tid 32329] [client 20.151.168.140:17857] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "acj8PSE3TArOFrUtgWrEjAAAAIs"]
[Sun Mar 29 18:17:34.823330 2026] [:error] [pid 1524:tid 1531] [client 20.151.168.140:7767] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "acj8PloaWSl2asqQCh9w7wAAAQM"]
[Sun Mar 29 18:17:35.519720 2026] [:error] [pid 1524:tid 1549] [client 20.151.168.140:46251] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "acj8P1oaWSl2asqQCh9w8QAAARI"]
[Sun Mar 29 18:17:36.431464 2026] [:error] [pid 32257:tid 32332] [client 20.151.168.140:17911] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bywaf.php"] [unique_id "acj8QCE3TArOFrUtgWrEkwAAAI4"]
[Sun Mar 29 18:17:37.203183 2026] [:error] [pid 32255:tid 32294] [client 20.151.168.140:8073] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bywaf.php"] [unique_id "acj8QWnfn-AtRoMbquyVkAAAAEM"]
[Sun Mar 29 18:17:42.795042 2026] [:error] [pid 23250:tid 23263] [client 20.151.168.140:58056] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bywaf.php"] [unique_id "acj8Rpxrpj-dQjy1cvrf1gAAAks"]
[Sun Mar 29 18:17:57.095402 2026] [:error] [pid 1524:tid 1530] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-true.php
[Sun Mar 29 18:17:57.619619 2026] [:error] [pid 1524:tid 1538] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Sun Mar 29 18:17:57.892948 2026] [:error] [pid 1524:tid 1548] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/tx88.php
[Sun Mar 29 18:17:58.120028 2026] [:error] [pid 1524:tid 1547] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Sun Mar 29 18:17:58.329516 2026] [:error] [pid 1524:tid 1556] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Sun Mar 29 18:17:58.578792 2026] [:error] [pid 1524:tid 1531] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Sun Mar 29 18:17:59.188434 2026] [:error] [pid 1524:tid 1545] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/utky.php
[Sun Mar 29 18:17:59.433339 2026] [:error] [pid 1524:tid 1549] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/uang.php
[Sun Mar 29 18:17:59.677048 2026] [:error] [pid 1524:tid 1544] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/wp3.php
[Sun Mar 29 18:17:59.925976 2026] [:error] [pid 1524:tid 1527] [client 20.151.168.140:24647] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sun Mar 29 18:18:00.436028 2026] [:error] [pid 1524:tid 1528] [client 20.151.168.140:24647] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ticket.php"] [unique_id "acj8WFoaWSl2asqQCh9xEAAAAQE"]
[Sun Mar 29 18:18:06.305636 2026] [:error] [pid 32255:tid 32295] [client 20.151.168.140:17896] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ticket.php"] [unique_id "acj8Xmnfn-AtRoMbquyV0AAAAEQ"]
[Sun Mar 29 18:18:09.639383 2026] [:error] [pid 23167:tid 23174] [client 20.151.168.140:7516] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ticket.php"] [unique_id "acj8YRIAHJCFaHff3_eLgwAAAcQ"]
[Sun Mar 29 18:18:10.962290 2026] [:error] [pid 32359:tid 32383] [client 20.151.168.140:34159] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ticket.php"] [unique_id "acj8YgMb8G3UzfQP3WgV6QAAANY"]
[Sun Mar 29 18:18:11.890583 2026] [:error] [pid 23250:tid 23252] [client 20.151.168.140:52928] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum1.php"] [unique_id "acj8Y5xrpj-dQjy1cvrf-AAAAkA"]
[Sun Mar 29 18:18:12.849220 2026] [:error] [pid 23137:tid 23160] [client 20.151.168.140:58111] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum1.php"] [unique_id "acj8ZBaWQa7LdZ_qGFbd-wAAAZU"]
[Sun Mar 29 18:18:14.540004 2026] [:error] [pid 23168:tid 23220] [client 20.151.168.140:24679] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum1.php"] [unique_id "acj8ZmP8p0yRL8ot_29fNAAAAhc"]
[Sun Mar 29 18:18:16.234327 2026] [:error] [pid 23284:tid 23297] [client 20.151.168.140:24659] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum1.php"] [unique_id "acj8aIzBujdPHsq7wyQeKgAAAos"]
[Sun Mar 29 18:18:17.479128 2026] [:error] [pid 32255:tid 32292] [client 20.151.168.140:7547] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "acj8aWnfn-AtRoMbquyV-wAAAEE"]
[Sun Mar 29 18:18:25.865555 2026] [:error] [pid 23250:tid 23275] [client 20.151.168.140:58052] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "acj8cZxrpj-dQjy1cvrgCAAAAlc"]
[Sun Mar 29 18:18:27.571778 2026] [:error] [pid 23250:tid 23259] [client 20.151.168.140:34130] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "acj8c5xrpj-dQjy1cvrgCQAAAkc"]
[Sun Mar 29 18:18:28.879787 2026] [:error] [pid 23250:tid 23262] [client 20.151.168.140:52977] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "acj8dJxrpj-dQjy1cvrgDAAAAko"]
[Sun Mar 29 18:18:30.037539 2026] [:error] [pid 23167:tid 23178] [client 20.151.168.140:24670] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "acj8dhIAHJCFaHff3_eLswAAAcg"]
[Sun Mar 29 18:18:31.435334 2026] [:error] [pid 23284:tid 23300] [client 20.151.168.140:7629] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "acj8d4zBujdPHsq7wyQePgAAAo4"]
[Sun Mar 29 18:18:32.960335 2026] [:error] [pid 23250:tid 23274] [client 20.151.168.140:58870] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "acj8eJxrpj-dQjy1cvrgDgAAAlY"]
[Sun Mar 29 18:18:34.134869 2026] [:error] [pid 23168:tid 23212] [client 20.151.168.140:58839] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "acj8emP8p0yRL8ot_29fRAAAAg8"]
[Sun Mar 29 18:18:35.390422 2026] [:error] [pid 23168:tid 23205] [client 20.151.168.140:46248] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "acj8e2P8p0yRL8ot_29fSwAAAgg"]
[Sun Mar 29 18:18:36.065192 2026] [:error] [pid 32255:tid 32308] [client 20.151.168.140:43477] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "acj8fGnfn-AtRoMbquyWGAAAAFE"]
[Sun Mar 29 18:18:36.686976 2026] [:error] [pid 23167:tid 23187] [client 20.151.168.140:20470] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "acj8fBIAHJCFaHff3_eLxwAAAdE"]
[Sun Mar 29 18:18:39.638200 2026] [:error] [pid 23284:tid 23287] [client 20.151.168.140:17910] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "acj8f4zBujdPHsq7wyQeSAAAAoE"]
[Sun Mar 29 18:18:43.274817 2026] [:error] [pid 32257:tid 32328] [client 20.151.168.140:7661] [client 20.151.168.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpass.php"] [unique_id "acj8gyE3TArOFrUtgWrEzwAAAIo"]
[Sun Mar 29 18:19:30.330891 2026] [:error] [pid 23167:tid 23194] [client 20.151.168.140:35805] File does not exist: /usr/local/apache/htdocs/suspended-page/h02ugyh.php
[Sun Mar 29 19:30:52.446445 2026] [:error] [pid 32257:tid 32331] [client 195.140.224.192:37482] [client 195.140.224.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.140.224.192, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ackNbCE3TArOFrUtgWruZQAAAI0"]
[Sun Mar 29 19:30:52.450963 2026] [:error] [pid 32257:tid 32331] [client 195.140.224.192:37482] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 29 21:52:09.517926 2026] [:error] [pid 23168:tid 23210] [client 74.248.20.136:34124] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Mar 29 21:52:10.984724 2026] [:error] [pid 23168:tid 23204] [client 74.248.20.136:34124] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ackuimP8p0yRL8ot_2-b5AAAAgc"]
[Sun Mar 29 21:52:12.229655 2026] [:error] [pid 23284:tid 23296] [client 74.248.20.136:45392] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Sun Mar 29 21:52:12.502702 2026] [:error] [pid 23284:tid 23304] [client 74.248.20.136:45392] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun Mar 29 21:52:12.804360 2026] [:error] [pid 23284:tid 23305] [client 74.248.20.136:45392] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Mar 29 21:52:13.197710 2026] [:error] [pid 23284:tid 23293] [client 74.248.20.136:45392] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Mar 29 21:52:13.455894 2026] [:error] [pid 23284:tid 23295] [client 74.248.20.136:45392] File does not exist: /usr/local/apache/htdocs/suspended-page/file15.php
[Sun Mar 29 21:52:13.750123 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:45392] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "ackujYzBujdPHsq7wySdDwAAAoE"]
[Sun Mar 29 21:52:14.478178 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:11775] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "ackujmnfn-AtRoMbquzs2wAAAFM"]
[Sun Mar 29 21:52:15.677478 2026] [:error] [pid 8818:tid 8830] [client 74.248.20.136:11722] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "ackujyCDvotZNSF0FBre5QAAAUg"]
[Sun Mar 29 21:52:16.715886 2026] [:error] [pid 32359:tid 32380] [client 74.248.20.136:35598] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/031.php"] [unique_id "ackukAMb8G3UzfQP3WgvEQAAANM"]
[Sun Mar 29 21:52:19.337647 2026] [:error] [pid 32359:tid 32368] [client 74.248.20.136:44199] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackukwMb8G3UzfQP3WgvEwAAAMc"]
[Sun Mar 29 21:52:20.334598 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:13772] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackulGnfn-AtRoMbquzs5gAAAFM"]
[Sun Mar 29 21:52:21.284205 2026] [:error] [pid 32255:tid 32295] [client 74.248.20.136:11726] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackulWnfn-AtRoMbquzs6gAAAEQ"]
[Sun Mar 29 21:52:21.981178 2026] [:error] [pid 23250:tid 23276] [client 74.248.20.136:11234] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackulZxrpj-dQjy1cvoEmgAAAlg"]
[Sun Mar 29 21:52:23.849319 2026] [:error] [pid 23168:tid 23216] [client 74.248.20.136:11772] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackul2P8p0yRL8ot_2-b6QAAAhM"]
[Sun Mar 29 21:52:24.735344 2026] [:error] [pid 23250:tid 23252] [client 74.248.20.136:35620] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackumJxrpj-dQjy1cvoEowAAAkA"]
[Sun Mar 29 21:52:25.808515 2026] [:error] [pid 8818:tid 8834] [client 74.248.20.136:11248] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackumSCDvotZNSF0FBre-AAAAUw"]
[Sun Mar 29 21:52:26.636921 2026] [:error] [pid 8818:tid 8833] [client 74.248.20.136:45056] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ackumiCDvotZNSF0FBre-wAAAUs"]
[Sun Mar 29 21:52:27.843119 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:45433] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackum2P8p0yRL8ot_2-b7QAAAhg"]
[Sun Mar 29 21:52:29.457444 2026] [:error] [pid 32254:tid 32282] [client 74.248.20.136:44107] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackunaug2IHuyGgCTn9cTgAAABI"]
[Sun Mar 29 21:52:30.161867 2026] [:error] [pid 23168:tid 23215] [client 74.248.20.136:13708] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackunmP8p0yRL8ot_2-b9gAAAhI"]
[Sun Mar 29 21:52:31.322439 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:6225] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackun2P8p0yRL8ot_2-b_AAAAhg"]
[Sun Mar 29 21:52:33.125084 2026] [:error] [pid 23137:tid 23145] [client 74.248.20.136:45101] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackuoRaWQa7LdZ_qGFb61gAAAYY"]
[Sun Mar 29 21:52:35.087997 2026] [:error] [pid 23250:tid 23256] [client 74.248.20.136:11258] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackuo5xrpj-dQjy1cvoErQAAAkQ"]
[Sun Mar 29 21:52:36.421825 2026] [:error] [pid 23250:tid 23257] [client 74.248.20.136:44211] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackupJxrpj-dQjy1cvoErgAAAkU"]
[Sun Mar 29 21:52:37.319723 2026] [:error] [pid 32255:tid 32298] [client 74.248.20.136:44811] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "ackupWnfn-AtRoMbquztFgAAAEc"]
[Sun Mar 29 21:52:38.262389 2026] [:error] [pid 32254:tid 32268] [client 74.248.20.136:13788] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hly.php"] [unique_id "ackupqug2IHuyGgCTn9cWQAAAAQ"]
[Sun Mar 29 21:52:39.879297 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:35609] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hly.php"] [unique_id "ackup2nfn-AtRoMbquztGwAAAEg"]
[Sun Mar 29 21:52:41.094530 2026] [:error] [pid 23137:tid 23146] [client 74.248.20.136:45583] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hly.php"] [unique_id "ackuqRaWQa7LdZ_qGFb62AAAAYc"]
[Sun Mar 29 21:52:42.675562 2026] [:error] [pid 23250:tid 23253] [client 74.248.20.136:35930] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hly.php"] [unique_id "ackuqpxrpj-dQjy1cvoEwwAAAkE"]
[Sun Mar 29 21:52:44.000308 2026] [:error] [pid 23250:tid 23255] [client 74.248.20.136:45594] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "ackuq5xrpj-dQjy1cvoEyQAAAkM"]
[Sun Mar 29 21:52:47.327918 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:44217] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "ackur2nfn-AtRoMbquztJgAAAEg"]
[Sun Mar 29 21:52:49.252696 2026] [:error] [pid 32257:tid 32332] [client 74.248.20.136:38236] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "ackusSE3TArOFrUtgWozOwAAAI4"]
[Sun Mar 29 21:52:50.319037 2026] [:error] [pid 32257:tid 32318] [client 74.248.20.136:13735] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "ackusiE3TArOFrUtgWozPwAAAIA"]
[Sun Mar 29 21:52:53.379127 2026] [:error] [pid 23284:tid 23286] [client 74.248.20.136:34463] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "ackutYzBujdPHsq7wySdSAAAAoA"]
[Sun Mar 29 21:52:57.103252 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:37774] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "ackuuSE3TArOFrUtgWozTgAAAJY"]
[Sun Mar 29 21:52:58.665096 2026] [:error] [pid 23167:tid 23185] [client 74.248.20.136:45568] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "ackuuhIAHJCFaHff3_fAkQAAAc8"]
[Sun Mar 29 21:53:00.000831 2026] [:error] [pid 32254:tid 32279] [client 74.248.20.136:6169] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "ackuvKug2IHuyGgCTn9cfAAAAA8"]
[Sun Mar 29 21:53:00.758165 2026] [:error] [pid 23284:tid 23293] [client 74.248.20.136:34480] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "ackuvIzBujdPHsq7wySdbAAAAoc"]
[Sun Mar 29 21:53:01.529540 2026] [:error] [pid 8818:tid 8833] [client 74.248.20.136:34131] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "ackuvSCDvotZNSF0FBrfLAAAAUs"]
[Sun Mar 29 21:53:02.580454 2026] [:error] [pid 23284:tid 23309] [client 74.248.20.136:11753] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "ackuvozBujdPHsq7wySddAAAApc"]
[Sun Mar 29 21:53:03.889166 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:45105] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tajj.php"] [unique_id "ackuvyE3TArOFrUtgWozXgAAAIU"]
[Sun Mar 29 21:53:05.255505 2026] [:error] [pid 32255:tid 32304] [client 74.248.20.136:13756] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "ackuwWnfn-AtRoMbquztPwAAAE0"]
[Sun Mar 29 21:53:06.362365 2026] [:error] [pid 32255:tid 32296] [client 74.248.20.136:42137] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "ackuwmnfn-AtRoMbquztQwAAAEU"]
[Sun Mar 29 21:53:07.663551 2026] [:error] [pid 23167:tid 23185] [client 74.248.20.136:35591] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "ackuwxIAHJCFaHff3_fAnAAAAc8"]
[Sun Mar 29 21:53:09.807517 2026] [:error] [pid 32255:tid 32305] [client 74.248.20.136:44836] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file30.php"] [unique_id "ackuxWnfn-AtRoMbquztRQAAAE4"]
[Sun Mar 29 21:53:11.021565 2026] [:error] [pid 23250:tid 23269] [client 74.248.20.136:11768] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "ackux5xrpj-dQjy1cvoE3AAAAlE"]
[Sun Mar 29 21:53:11.695464 2026] [:error] [pid 32359:tid 32366] [client 74.248.20.136:45059] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "ackuxwMb8G3UzfQP3WgvMgAAAMU"]
[Sun Mar 29 21:53:12.963962 2026] [:error] [pid 23137:tid 23150] [client 74.248.20.136:38214] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "ackuyBaWQa7LdZ_qGFb66QAAAYs"]
[Sun Mar 29 21:53:14.009908 2026] [:error] [pid 32257:tid 32327] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Sun Mar 29 21:53:14.267364 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 29 21:53:14.534274 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-2.php
[Sun Mar 29 21:53:15.491625 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 29 21:53:15.748410 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Mar 29 21:53:16.042381 2026] [:error] [pid 32257:tid 32318] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 29 21:53:16.375993 2026] [:error] [pid 32257:tid 32326] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 29 21:53:16.685671 2026] [:error] [pid 32257:tid 32319] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/output.php
[Sun Mar 29 21:53:16.943055 2026] [:error] [pid 32257:tid 32320] [client 74.248.20.136:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/output.php
[Sun Mar 29 21:53:17.312719 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:35963] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ackuzSE3TArOFrUtgWozeQAAAIY"]
[Sun Mar 29 21:53:19.371105 2026] [:error] [pid 23168:tid 23211] [client 74.248.20.136:6271] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ackuz2P8p0yRL8ot_2-cSwAAAg4"]
[Sun Mar 29 21:53:45.677460 2026] [:error] [pid 8818:tid 8832] [client 74.248.20.136:6198] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "acku6SCDvotZNSF0FBrfVwAAAUo"]
[Sun Mar 29 21:53:46.912195 2026] [:error] [pid 23284:tid 23294] [client 74.248.20.136:43562] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "acku6ozBujdPHsq7wySd5QAAAog"]
[Sun Mar 29 21:53:48.415787 2026] [:error] [pid 23167:tid 23175] [client 74.248.20.136:6223] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "acku7BIAHJCFaHff3_fA1gAAAcU"]
[Sun Mar 29 21:53:50.006757 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:38231] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "acku7iE3TArOFrUtgWoz4QAAAJI"]
[Sun Mar 29 21:53:51.132773 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:35616] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "acku7yE3TArOFrUtgWoz5AAAAJc"]
[Sun Mar 29 21:53:52.561207 2026] [:error] [pid 23137:tid 23148] [client 74.248.20.136:35949] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "acku8BaWQa7LdZ_qGFb69wAAAYk"]
[Sun Mar 29 21:53:53.271133 2026] [:error] [pid 32257:tid 32326] [client 74.248.20.136:38245] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "acku8SE3TArOFrUtgWoz7AAAAIg"]
[Sun Mar 29 21:53:54.304219 2026] [:error] [pid 23137:tid 23149] [client 74.248.20.136:39946] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "acku8haWQa7LdZ_qGFb6-QAAAYo"]
[Sun Mar 29 21:53:55.392930 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:6222] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "acku8yE3TArOFrUtgWoz-QAAAI8"]
[Sun Mar 29 21:53:57.176783 2026] [:error] [pid 23284:tid 23306] [client 74.248.20.136:13813] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "acku9YzBujdPHsq7wySd9AAAApQ"]
[Sun Mar 29 21:53:58.542859 2026] [:error] [pid 23284:tid 23297] [client 74.248.20.136:35601] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acku9ozBujdPHsq7wySd-wAAAos"]
[Sun Mar 29 21:54:01.023030 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:41637] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0x.php"] [unique_id "acku-SE3TArOFrUtgWo0CQAAAJQ"]
[Sun Mar 29 21:54:02.816582 2026] [:error] [pid 23284:tid 23305] [client 74.248.20.136:37777] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0x.php"] [unique_id "acku-ozBujdPHsq7wySeAwAAApM"]
[Sun Mar 29 21:54:04.307099 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:41554] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x0x.php"] [unique_id "acku_IzBujdPHsq7wySeDgAAAoE"]
[Sun Mar 29 21:54:06.539701 2026] [:error] [pid 23167:tid 23185] [client 74.248.20.136:13744] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "acku_hIAHJCFaHff3_fA6AAAAc8"]
[Sun Mar 29 21:54:07.849519 2026] [:error] [pid 8818:tid 8822] [client 74.248.20.136:39898] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "acku_yCDvotZNSF0FBrfawAAAUA"]
[Sun Mar 29 21:54:09.046759 2026] [:error] [pid 32254:tid 32269] [client 74.248.20.136:38254] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "ackvAaug2IHuyGgCTn9cpgAAAAU"]
[Sun Mar 29 21:54:09.990408 2026] [:error] [pid 32255:tid 32296] [client 74.248.20.136:34442] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfile.php"] [unique_id "ackvAWnfn-AtRoMbquztgwAAAEU"]
[Sun Mar 29 21:54:10.949106 2026] [:error] [pid 23137:tid 23159] [client 74.248.20.136:38213] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "ackvAhaWQa7LdZ_qGFb7AQAAAZQ"]
[Sun Mar 29 21:54:12.662078 2026] [:error] [pid 32359:tid 32363] [client 74.248.20.136:39873] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "ackvBAMb8G3UzfQP3WgvTwAAAMI"]
[Sun Mar 29 21:54:15.434527 2026] [:error] [pid 23284:tid 23303] [client 74.248.20.136:13731] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-freya.php"] [unique_id "ackvB4zBujdPHsq7wySeMgAAApE"]
[Sun Mar 29 21:54:16.679525 2026] [:error] [pid 32255:tid 32291] [client 74.248.20.136:35924] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Sun Mar 29 21:54:17.123427 2026] [:error] [pid 32255:tid 32291] [client 74.248.20.136:35924] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "ackvCWnfn-AtRoMbquztjAAAAEA"]
[Sun Mar 29 21:54:18.577068 2026] [:error] [pid 23137:tid 23152] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sun Mar 29 21:54:19.019225 2026] [:error] [pid 23137:tid 23144] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Mar 29 21:54:19.335244 2026] [:error] [pid 23137:tid 23141] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Sun Mar 29 21:54:19.592535 2026] [:error] [pid 23137:tid 23148] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/ctex1.php
[Sun Mar 29 21:54:21.099319 2026] [:error] [pid 23137:tid 23148] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Sun Mar 29 21:54:21.390806 2026] [:error] [pid 23137:tid 23153] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sun Mar 29 21:54:21.650885 2026] [:error] [pid 23137:tid 23149] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Sun Mar 29 21:54:22.018362 2026] [:error] [pid 23137:tid 23140] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Mar 29 21:54:22.310462 2026] [:error] [pid 23137:tid 23145] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Sun Mar 29 21:54:22.657338 2026] [:error] [pid 23137:tid 23142] [client 74.248.20.136:37812] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Mar 29 21:54:22.913087 2026] [:error] [pid 23137:tid 23156] [client 74.248.20.136:37812] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-.php"] [unique_id "ackvDhaWQa7LdZ_qGFb7GgAAAZE"]
[Sun Mar 29 21:54:24.524226 2026] [:error] [pid 23168:tid 23210] [client 74.248.20.136:35940] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-.php"] [unique_id "ackvEGP8p0yRL8ot_2-c9gAAAg0"]
[Sun Mar 29 21:54:25.225551 2026] [:error] [pid 23284:tid 23304] [client 74.248.20.136:11767] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-.php"] [unique_id "ackvEYzBujdPHsq7wySeUgAAApI"]
[Sun Mar 29 21:54:26.072729 2026] [:error] [pid 23284:tid 23305] [client 74.248.20.136:6220] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-.php"] [unique_id "ackvEozBujdPHsq7wySeWAAAApM"]
[Sun Mar 29 21:54:27.277715 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:34169] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ackvE4zBujdPHsq7wySeXgAAApY"]
[Sun Mar 29 21:54:29.505707 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:44420] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ackvFSE3TArOFrUtgWo0TQAAAJI"]
[Sun Mar 29 21:54:30.476716 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:11220] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ackvFozBujdPHsq7wySecwAAApg"]
[Sun Mar 29 21:54:31.228709 2026] [:error] [pid 23167:tid 23182] [client 74.248.20.136:35967] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ackvFxIAHJCFaHff3_fBCQAAAcw"]
[Sun Mar 29 21:54:33.532116 2026] [:error] [pid 8818:tid 8846] [client 74.248.20.136:11246] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "ackvGSCDvotZNSF0FBrffgAAAVg"]
[Sun Mar 29 21:54:34.653691 2026] [:error] [pid 8818:tid 8839] [client 74.248.20.136:38249] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "ackvGiCDvotZNSF0FBrfgQAAAVE"]
[Sun Mar 29 21:54:35.735643 2026] [:error] [pid 32255:tid 32314] [client 74.248.20.136:11263] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "ackvG2nfn-AtRoMbquztwgAAAFc"]
[Sun Mar 29 21:54:37.073519 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:44458] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ee.php"] [unique_id "ackvHYzBujdPHsq7wySekQAAApA"]
[Sun Mar 29 21:54:38.425499 2026] [:error] [pid 23168:tid 23205] [client 74.248.20.136:35614] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/epinyins.php"] [unique_id "ackvHmP8p0yRL8ot_2-dCQAAAgg"]
[Sun Mar 29 21:54:39.417294 2026] [:error] [pid 32359:tid 32384] [client 74.248.20.136:34443] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/epinyins.php"] [unique_id "ackvHwMb8G3UzfQP3WgvXAAAANc"]
[Sun Mar 29 21:54:40.318799 2026] [:error] [pid 32257:tid 32331] [client 74.248.20.136:11249] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/epinyins.php"] [unique_id "ackvICE3TArOFrUtgWo0pQAAAI0"]
[Sun Mar 29 21:54:40.990472 2026] [:error] [pid 32255:tid 32303] [client 74.248.20.136:41555] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/epinyins.php"] [unique_id "ackvIGnfn-AtRoMbquzt5QAAAEw"]
[Sun Mar 29 21:54:41.855178 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:11214] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i1.php"] [unique_id "ackvIYzBujdPHsq7wySeoQAAAoE"]
[Sun Mar 29 21:54:44.699839 2026] [:error] [pid 23167:tid 23182] [client 74.248.20.136:39880] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i1.php"] [unique_id "ackvJBIAHJCFaHff3_fBFAAAAcw"]
[Sun Mar 29 21:54:45.672093 2026] [:error] [pid 23284:tid 23296] [client 74.248.20.136:38221] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i1.php"] [unique_id "ackvJYzBujdPHsq7wySerQAAAoo"]
[Sun Mar 29 21:54:47.050121 2026] [:error] [pid 23284:tid 23295] [client 74.248.20.136:11219] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i1.php"] [unique_id "ackvJ4zBujdPHsq7wySesgAAAok"]
[Sun Mar 29 21:54:48.507608 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:46210] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "ackvKIzBujdPHsq7wySewQAAApY"]
[Sun Mar 29 21:54:49.995557 2026] [:error] [pid 23167:tid 23179] [client 74.248.20.136:35638] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "ackvKRIAHJCFaHff3_fBGAAAAck"]
[Sun Mar 29 21:54:52.420154 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:44014] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "ackvLGnfn-AtRoMbquzuFQAAAFM"]
[Sun Mar 29 21:54:54.095807 2026] [:error] [pid 23167:tid 23176] [client 74.248.20.136:44441] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vv.php"] [unique_id "ackvLhIAHJCFaHff3_fBHAAAAcY"]
[Sun Mar 29 21:54:54.988768 2026] [:error] [pid 8818:tid 8832] [client 74.248.20.136:39996] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "ackvLiCDvotZNSF0FBrfpAAAAUo"]
[Sun Mar 29 21:54:55.775326 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:35929] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "ackvLyE3TArOFrUtgWo0uAAAAIQ"]
[Sun Mar 29 21:54:57.390524 2026] [:error] [pid 23250:tid 23265] [client 74.248.20.136:34166] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "ackvMZxrpj-dQjy1cvoFRgAAAk0"]
[Sun Mar 29 21:54:58.324873 2026] [:error] [pid 23250:tid 23261] [client 74.248.20.136:46262] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oo.php"] [unique_id "ackvMpxrpj-dQjy1cvoFSAAAAkk"]
[Sun Mar 29 21:55:01.386973 2026] [:error] [pid 23167:tid 23185] [client 74.248.20.136:46224] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk.php"] [unique_id "ackvNRIAHJCFaHff3_fBKwAAAc8"]
[Sun Mar 29 21:55:02.553120 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:35939] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk.php"] [unique_id "ackvNozBujdPHsq7wySe3wAAAoE"]
[Sun Mar 29 21:55:03.794962 2026] [:error] [pid 32359:tid 32376] [client 74.248.20.136:13812] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk.php"] [unique_id "ackvNwMb8G3UzfQP3WgvfQAAAM8"]
[Sun Mar 29 21:55:05.559974 2026] [:error] [pid 32257:tid 32331] [client 74.248.20.136:44449] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk.php"] [unique_id "ackvOSE3TArOFrUtgWo0ywAAAI0"]
[Sun Mar 29 21:55:08.147738 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:37805] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ackvPCE3TArOFrUtgWo02AAAAJI"]
[Sun Mar 29 21:55:09.146186 2026] [:error] [pid 8818:tid 8822] [client 74.248.20.136:44452] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ackvPSCDvotZNSF0FBrf0AAAAUA"]
[Sun Mar 29 21:55:10.528296 2026] [:error] [pid 32254:tid 32276] [client 74.248.20.136:41600] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ackvPqug2IHuyGgCTn9cwAAAAAw"]
[Sun Mar 29 21:55:11.622500 2026] [:error] [pid 32255:tid 32292] [client 74.248.20.136:37791] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ackvP2nfn-AtRoMbquzuKgAAAEE"]
[Sun Mar 29 21:55:15.278526 2026] [:error] [pid 32359:tid 32371] [client 74.248.20.136:39947] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "ackvQwMb8G3UzfQP3WgvfwAAAMo"]
[Sun Mar 29 21:55:16.221779 2026] [:error] [pid 32255:tid 32296] [client 74.248.20.136:39997] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "ackvRGnfn-AtRoMbquzuNAAAAEU"]
[Sun Mar 29 21:55:18.238276 2026] [:error] [pid 23167:tid 23180] [client 74.248.20.136:34159] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "ackvRhIAHJCFaHff3_fBLgAAAco"]
[Sun Mar 29 21:55:21.208748 2026] [:error] [pid 23284:tid 23298] [client 74.248.20.136:46316] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "ackvSYzBujdPHsq7wySfJwAAAow"]
[Sun Mar 29 21:55:22.245313 2026] [:error] [pid 23168:tid 23204] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sun Mar 29 21:55:22.543287 2026] [:error] [pid 23168:tid 23210] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sun Mar 29 21:55:22.809693 2026] [:error] [pid 23168:tid 23211] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sun Mar 29 21:55:23.231224 2026] [:error] [pid 23168:tid 23199] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun Mar 29 21:55:23.632784 2026] [:error] [pid 23168:tid 23209] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Mar 29 21:55:23.890045 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Sun Mar 29 21:55:24.157931 2026] [:error] [pid 23168:tid 23212] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Mar 29 21:55:25.634778 2026] [:error] [pid 23168:tid 23212] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sun Mar 29 21:55:25.915085 2026] [:error] [pid 23168:tid 23205] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun Mar 29 21:55:26.174909 2026] [:error] [pid 23168:tid 23197] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Mar 29 21:55:26.434310 2026] [:error] [pid 23168:tid 23213] [client 74.248.20.136:38220] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Sun Mar 29 21:55:26.690803 2026] [:error] [pid 23168:tid 23220] [client 74.248.20.136:38220] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ackvTmP8p0yRL8ot_2-dQwAAAhc"]
[Sun Mar 29 21:55:28.242182 2026] [:error] [pid 32255:tid 32301] [client 74.248.20.136:34135] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ackvUGnfn-AtRoMbquzuRQAAAEo"]
[Sun Mar 29 21:55:29.594828 2026] [:error] [pid 32255:tid 32315] [client 74.248.20.136:37804] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ackvUWnfn-AtRoMbquzuSAAAAFg"]
[Sun Mar 29 21:55:30.500901 2026] [:error] [pid 23168:tid 23211] [client 74.248.20.136:36616] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ackvUmP8p0yRL8ot_2-dSwAAAg4"]
[Sun Mar 29 21:55:31.530158 2026] [:error] [pid 23168:tid 23218] [client 74.248.20.136:39977] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ackvU2P8p0yRL8ot_2-dTgAAAhU"]
[Sun Mar 29 21:55:32.402493 2026] [:error] [pid 32257:tid 32331] [client 74.248.20.136:39985] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ackvVCE3TArOFrUtgWo1AAAAAI0"]
[Sun Mar 29 21:55:33.659315 2026] [:error] [pid 32255:tid 32305] [client 74.248.20.136:46254] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ackvVWnfn-AtRoMbquzuUgAAAE4"]
[Sun Mar 29 21:55:35.111583 2026] [:error] [pid 23167:tid 23186] [client 74.248.20.136:46233] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ackvVxIAHJCFaHff3_fBPwAAAdA"]
[Sun Mar 29 21:55:36.234593 2026] [:error] [pid 23250:tid 23275] [client 74.248.20.136:38252] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ackvWJxrpj-dQjy1cvoFcAAAAlc"]
[Sun Mar 29 21:55:37.255655 2026] [:error] [pid 23284:tid 23286] [client 74.248.20.136:41610] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ackvWYzBujdPHsq7wySfTQAAAoA"]
[Sun Mar 29 21:55:38.167567 2026] [:error] [pid 23284:tid 23291] [client 74.248.20.136:39897] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ackvWozBujdPHsq7wySfVQAAAoU"]
[Sun Mar 29 21:55:39.200942 2026] [:error] [pid 32255:tid 32313] [client 74.248.20.136:38268] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ackvW2nfn-AtRoMbquzuWAAAAFY"]
[Sun Mar 29 21:55:40.965610 2026] [:error] [pid 32257:tid 32335] [client 74.248.20.136:43985] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "ackvXCE3TArOFrUtgWo1AQAAAJE"]
[Sun Mar 29 21:55:42.309601 2026] [:error] [pid 23284:tid 23292] [client 74.248.20.136:36630] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "ackvXozBujdPHsq7wySfZQAAAoY"]
[Sun Mar 29 21:55:44.131525 2026] [:error] [pid 32257:tid 32342] [client 74.248.20.136:44029] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "ackvYCE3TArOFrUtgWo1AgAAAJg"]
[Sun Mar 29 21:56:07.700603 2026] [:error] [pid 8818:tid 8837] [client 74.248.20.136:2901] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ackvdyCDvotZNSF0FBrgJAAAAU8"]
[Sun Mar 29 21:56:08.698778 2026] [:error] [pid 23250:tid 23259] [client 74.248.20.136:46292] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ackveJxrpj-dQjy1cvoFgAAAAkc"]
[Sun Mar 29 21:56:09.962319 2026] [:error] [pid 23167:tid 23175] [client 74.248.20.136:44466] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ackveRIAHJCFaHff3_fBZAAAAcU"]
[Sun Mar 29 21:56:11.038835 2026] [:error] [pid 23250:tid 23268] [client 74.248.20.136:47564] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "ackve5xrpj-dQjy1cvoFhgAAAlA"]
[Sun Mar 29 21:56:12.479653 2026] [:error] [pid 23284:tid 23304] [client 74.248.20.136:58855] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "ackvfIzBujdPHsq7wySf1gAAApI"]
[Sun Mar 29 21:56:15.242865 2026] [:error] [pid 23284:tid 23290] [client 74.248.20.136:2911] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "ackvf4zBujdPHsq7wySf4wAAAoQ"]
[Sun Mar 29 21:56:16.154530 2026] [:error] [pid 32359:tid 32377] [client 74.248.20.136:2930] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc.php"] [unique_id "ackvgAMb8G3UzfQP3WgvpAAAANA"]
[Sun Mar 29 21:56:17.474475 2026] [:error] [pid 23284:tid 23305] [client 74.248.20.136:46933] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "ackvgYzBujdPHsq7wySf-wAAApM"]
[Sun Mar 29 21:56:18.664086 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:3052] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "ackvgmP8p0yRL8ot_2-dhAAAAhg"]
[Sun Mar 29 21:56:19.459110 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:21928] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "ackvg4zBujdPHsq7wySgHAAAApA"]
[Sun Mar 29 21:56:20.400508 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:58840] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "ackvhIzBujdPHsq7wySgKgAAAoE"]
[Sun Mar 29 21:56:22.302195 2026] [:error] [pid 23284:tid 23296] [client 74.248.20.136:3046] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "ackvhozBujdPHsq7wySgSwAAAoo"]
[Sun Mar 29 21:56:23.936883 2026] [:error] [pid 32255:tid 32314] [client 74.248.20.136:31914] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "ackvh2nfn-AtRoMbquzuegAAAFc"]
[Sun Mar 29 21:56:25.763181 2026] [:error] [pid 23137:tid 23155] [client 74.248.20.136:46275] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "ackviRaWQa7LdZ_qGFb7YQAAAZA"]
[Sun Mar 29 21:56:27.681997 2026] [:error] [pid 23167:tid 23171] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Sun Mar 29 21:56:27.980527 2026] [:error] [pid 23167:tid 23189] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Mar 29 21:56:28.237713 2026] [:error] [pid 23167:tid 23179] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun Mar 29 21:56:28.574726 2026] [:error] [pid 23167:tid 23188] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/ut.php
[Sun Mar 29 21:56:28.849177 2026] [:error] [pid 23167:tid 23190] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/wfile.php
[Sun Mar 29 21:56:29.136425 2026] [:error] [pid 23167:tid 23174] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Sun Mar 29 21:56:29.397729 2026] [:error] [pid 23167:tid 23184] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/admir.php
[Sun Mar 29 21:56:29.765713 2026] [:error] [pid 23167:tid 23180] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/file52.php
[Sun Mar 29 21:56:30.163329 2026] [:error] [pid 23167:tid 23176] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/zde.php
[Sun Mar 29 21:56:30.572176 2026] [:error] [pid 23167:tid 23187] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Sun Mar 29 21:56:30.829563 2026] [:error] [pid 23167:tid 23181] [client 74.248.20.136:14351] File does not exist: /usr/local/apache/htdocs/suspended-page/aj.php
[Sun Mar 29 21:56:31.112312 2026] [:error] [pid 23167:tid 23171] [client 74.248.20.136:14351] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "ackvjxIAHJCFaHff3_fBhQAAAcE"]
[Sun Mar 29 21:56:33.517545 2026] [:error] [pid 32257:tid 32320] [client 74.248.20.136:23490] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "ackvkSE3TArOFrUtgWo1QQAAAII"]
[Sun Mar 29 21:56:34.530740 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:47576] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "ackvkiE3TArOFrUtgWo1RgAAAJI"]
[Sun Mar 29 21:56:35.672987 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:3015] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/opts.php"] [unique_id "ackvk2nfn-AtRoMbquzufgAAAFM"]
[Sun Mar 29 21:56:36.423057 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:58861] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "ackvlGnfn-AtRoMbquzugAAAAEg"]
[Sun Mar 29 21:56:37.330109 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:14336] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "ackvlSE3TArOFrUtgWo1TgAAAJc"]
[Sun Mar 29 21:56:39.025472 2026] [:error] [pid 32359:tid 32382] [client 74.248.20.136:47646] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "ackvlwMb8G3UzfQP3WgvtgAAANU"]
[Sun Mar 29 21:56:40.707203 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:23546] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filer.php"] [unique_id "ackvmIzBujdPHsq7wySgugAAAoE"]
[Sun Mar 29 21:56:41.578810 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:3043] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "ackvmSE3TArOFrUtgWo1VwAAAJQ"]
[Sun Mar 29 21:56:42.657140 2026] [:error] [pid 32255:tid 32301] [client 74.248.20.136:36989] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "ackvmmnfn-AtRoMbquzuhgAAAEo"]
[Sun Mar 29 21:56:43.688137 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:40956] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "ackvm2nfn-AtRoMbquzujAAAAEg"]
[Sun Mar 29 21:56:45.400250 2026] [:error] [pid 32255:tid 32305] [client 74.248.20.136:58877] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lites.php"] [unique_id "ackvnWnfn-AtRoMbquzumAAAAE4"]
[Sun Mar 29 21:56:47.138083 2026] [:error] [pid 32359:tid 32370] [client 74.248.20.136:2937] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "ackvnwMb8G3UzfQP3WgvvgAAAMk"]
[Sun Mar 29 21:56:49.244753 2026] [:error] [pid 32359:tid 32383] [client 74.248.20.136:46292] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "ackvoQMb8G3UzfQP3WgvwQAAANY"]
[Sun Mar 29 21:56:52.322111 2026] [:error] [pid 23284:tid 23303] [client 74.248.20.136:58859] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "ackvpIzBujdPHsq7wySgzgAAApE"]
[Sun Mar 29 21:56:53.441041 2026] [:error] [pid 23167:tid 23186] [client 74.248.20.136:3036] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gorila.php"] [unique_id "ackvpRIAHJCFaHff3_fBlAAAAdA"]
[Sun Mar 29 21:56:54.622912 2026] [:error] [pid 32257:tid 32319] [client 74.248.20.136:48472] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ackvpiE3TArOFrUtgWo1ZwAAAIE"]
[Sun Mar 29 21:56:55.901694 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:40911] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ackvpyE3TArOFrUtgWo1cQAAAIw"]
[Sun Mar 29 21:56:57.634879 2026] [:error] [pid 32255:tid 32312] [client 74.248.20.136:13364] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ackvqWnfn-AtRoMbquzusgAAAFU"]
[Sun Mar 29 21:56:58.622028 2026] [:error] [pid 32257:tid 32334] [client 74.248.20.136:2804] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ackvqiE3TArOFrUtgWo1dwAAAJA"]
[Sun Mar 29 21:56:59.694369 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:14359] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "ackvqyE3TArOFrUtgWo1fAAAAIc"]
[Sun Mar 29 21:57:00.578684 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:46984] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "ackvrCE3TArOFrUtgWo1ggAAAIQ"]
[Sun Mar 29 21:57:04.027421 2026] [:error] [pid 32255:tid 32302] [client 74.248.20.136:15471] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "ackvsGnfn-AtRoMbquzuyQAAAEs"]
[Sun Mar 29 21:57:05.606282 2026] [:error] [pid 23167:tid 23189] [client 74.248.20.136:40915] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/main.php"] [unique_id "ackvsRIAHJCFaHff3_fBoQAAAdM"]
[Sun Mar 29 21:57:07.073657 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:48490] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "ackvsyE3TArOFrUtgWo1lAAAAIQ"]
[Sun Mar 29 21:57:08.007225 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:2541] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "ackvtGnfn-AtRoMbquzu1AAAAFM"]
[Sun Mar 29 21:57:09.262525 2026] [:error] [pid 23168:tid 23210] [client 74.248.20.136:15381] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "ackvtWP8p0yRL8ot_2-dngAAAg0"]
[Sun Mar 29 21:57:10.333702 2026] [:error] [pid 23284:tid 23292] [client 74.248.20.136:19319] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins.php"] [unique_id "ackvtozBujdPHsq7wySg-QAAAoY"]
[Sun Mar 29 21:57:12.668560 2026] [:error] [pid 23284:tid 23288] [client 74.248.20.136:24621] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filename.php"] [unique_id "ackvuIzBujdPHsq7wyShBgAAAoI"]
[Sun Mar 29 21:57:14.485856 2026] [:error] [pid 8818:tid 8842] [client 74.248.20.136:14639] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filename.php"] [unique_id "ackvuiCDvotZNSF0FBrgPAAAAVQ"]
[Sun Mar 29 21:57:15.957770 2026] [:error] [pid 32254:tid 32264] [client 74.248.20.136:22656] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filename.php"] [unique_id "ackvu6ug2IHuyGgCTn9c8gAAAAA"]
[Sun Mar 29 21:57:16.649116 2026] [:error] [pid 23168:tid 23217] [client 74.248.20.136:22673] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filename.php"] [unique_id "ackvvGP8p0yRL8ot_2-doQAAAhQ"]
[Sun Mar 29 21:57:19.236706 2026] [:error] [pid 8818:tid 8833] [client 74.248.20.136:24604] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "ackvvyCDvotZNSF0FBrgQwAAAUs"]
[Sun Mar 29 21:57:20.149247 2026] [:error] [pid 8818:tid 8841] [client 74.248.20.136:42063] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "ackvwCCDvotZNSF0FBrgRAAAAVM"]
[Sun Mar 29 21:57:21.081686 2026] [:error] [pid 23168:tid 23215] [client 74.248.20.136:19286] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "ackvwWP8p0yRL8ot_2-dpQAAAhI"]
[Sun Mar 29 21:57:21.879047 2026] [:error] [pid 32254:tid 32281] [client 74.248.20.136:48485] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminer.php"] [unique_id "ackvwaug2IHuyGgCTn9c9wAAABE"]
[Sun Mar 29 21:57:24.573162 2026] [:error] [pid 32255:tid 32305] [client 74.248.20.136:14648] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "ackvxGnfn-AtRoMbquzu5gAAAE4"]
[Sun Mar 29 21:57:25.888494 2026] [:error] [pid 32257:tid 32328] [client 74.248.20.136:12297] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "ackvxSE3TArOFrUtgWo1owAAAIo"]
[Sun Mar 29 21:57:26.702336 2026] [:error] [pid 23250:tid 23276] [client 74.248.20.136:34649] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "ackvxpxrpj-dQjy1cvoFuwAAAlg"]
[Sun Mar 29 21:57:30.336590 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 29 21:57:30.731667 2026] [:error] [pid 32255:tid 32296] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 29 21:57:31.053468 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-gr.php
[Sun Mar 29 21:57:31.367760 2026] [:error] [pid 32255:tid 32311] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mn.php
[Sun Mar 29 21:57:31.630061 2026] [:error] [pid 32255:tid 32297] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mt.php
[Sun Mar 29 21:57:31.945450 2026] [:error] [pid 32255:tid 32313] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/shout.php
[Sun Mar 29 21:57:32.278311 2026] [:error] [pid 32255:tid 32309] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/zews.php
[Sun Mar 29 21:57:32.566761 2026] [:error] [pid 32255:tid 32301] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Mar 29 21:57:32.827164 2026] [:error] [pid 32255:tid 32308] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Sun Mar 29 21:57:33.097990 2026] [:error] [pid 32255:tid 32306] [client 74.248.20.136:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sun Mar 29 21:57:34.477691 2026] [:error] [pid 32255:tid 32300] [client 74.248.20.136:22695] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "ackvzmnfn-AtRoMbquzvCwAAAEk"]
[Sun Mar 29 21:57:35.802604 2026] [:error] [pid 23284:tid 23288] [client 74.248.20.136:45676] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "ackvz4zBujdPHsq7wyShPQAAAoI"]
[Sun Mar 29 21:57:37.426457 2026] [:error] [pid 23284:tid 23299] [client 74.248.20.136:24619] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "ackv0YzBujdPHsq7wyShRQAAAo0"]
[Sun Mar 29 21:57:38.214191 2026] [:error] [pid 23137:tid 23143] [client 74.248.20.136:22676] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "ackv0haWQa7LdZ_qGFb7hAAAAYQ"]
[Sun Mar 29 21:57:39.130449 2026] [:error] [pid 23168:tid 23206] [client 74.248.20.136:24602] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ackv02P8p0yRL8ot_2-duQAAAgk"]
[Sun Mar 29 21:57:40.744902 2026] [:error] [pid 8818:tid 8827] [client 74.248.20.136:23857] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ackv1CCDvotZNSF0FBrgVQAAAUU"]
[Sun Mar 29 21:57:41.932249 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:2499] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ackv1SE3TArOFrUtgWo1rwAAAIU"]
[Sun Mar 29 21:57:43.042296 2026] [:error] [pid 32255:tid 32313] [client 74.248.20.136:34633] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ackv12nfn-AtRoMbquzvHwAAAFY"]
[Sun Mar 29 21:57:44.690508 2026] [:error] [pid 23137:tid 23158] [client 74.248.20.136:2546] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "ackv2BaWQa7LdZ_qGFb7iAAAAZM"]
[Sun Mar 29 21:57:45.787405 2026] [:error] [pid 23168:tid 23209] [client 74.248.20.136:49439] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "ackv2WP8p0yRL8ot_2-dwQAAAgw"]
[Sun Mar 29 21:57:47.302075 2026] [:error] [pid 32257:tid 32327] [client 74.248.20.136:2751] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "ackv2yE3TArOFrUtgWo1tQAAAIk"]
[Sun Mar 29 21:57:48.757343 2026] [:error] [pid 23168:tid 23199] [client 74.248.20.136:25837] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "ackv3GP8p0yRL8ot_2-d0QAAAgI"]
[Sun Mar 29 21:57:49.741554 2026] [:error] [pid 23284:tid 23306] [client 74.248.20.136:2548] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "ackv3YzBujdPHsq7wyShZQAAApQ"]
[Sun Mar 29 21:57:51.370782 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:12341] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "ackv32nfn-AtRoMbquzvKQAAAEg"]
[Sun Mar 29 21:57:53.676024 2026] [:error] [pid 32257:tid 32334] [client 74.248.20.136:12307] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "ackv4SE3TArOFrUtgWo1ygAAAJA"]
[Sun Mar 29 21:57:55.896635 2026] [:error] [pid 32257:tid 32342] [client 74.248.20.136:13149] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13k.php"] [unique_id "ackv4yE3TArOFrUtgWo10AAAAJg"]
[Sun Mar 29 21:57:57.181205 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:12304] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "ackv5SE3TArOFrUtgWo12QAAAIQ"]
[Sun Mar 29 21:57:57.913038 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:2507] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "ackv5SE3TArOFrUtgWo13gAAAIU"]
[Sun Mar 29 21:57:59.502760 2026] [:error] [pid 32257:tid 32331] [client 74.248.20.136:2715] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "ackv5yE3TArOFrUtgWo16AAAAI0"]
[Sun Mar 29 21:58:00.162778 2026] [:error] [pid 32359:tid 32382] [client 74.248.20.136:25843] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dropdown.php"] [unique_id "ackv6AMb8G3UzfQP3Wgv1wAAANU"]
[Sun Mar 29 21:58:01.404529 2026] [:error] [pid 32257:tid 32321] [client 74.248.20.136:49431] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "ackv6SE3TArOFrUtgWo17gAAAIM"]
[Sun Mar 29 21:58:02.649957 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:34670] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "ackv6iE3TArOFrUtgWo17wAAAIQ"]
[Sun Mar 29 21:58:05.249458 2026] [:error] [pid 32255:tid 32303] [client 74.248.20.136:22662] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "ackv7Wnfn-AtRoMbquzvOAAAAEw"]
[Sun Mar 29 21:58:06.085735 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:34639] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "ackv7ozBujdPHsq7wyShdwAAApA"]
[Sun Mar 29 21:58:32.320091 2026] [:error] [pid 32359:tid 32367] [client 74.248.20.136:21578] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "ackwCAMb8G3UzfQP3Wgv7gAAAMY"]
[Sun Mar 29 21:58:33.322215 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mn.php
[Sun Mar 29 21:58:33.652732 2026] [:error] [pid 23284:tid 23296] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sun Mar 29 21:58:33.912862 2026] [:error] [pid 23284:tid 23299] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/abe.php
[Sun Mar 29 21:58:34.625461 2026] [:error] [pid 23284:tid 23294] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sun Mar 29 21:58:34.945721 2026] [:error] [pid 23284:tid 23309] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/gelay.php
[Sun Mar 29 21:58:35.225494 2026] [:error] [pid 23284:tid 23286] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Mar 29 21:58:35.558843 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Mar 29 21:58:35.969951 2026] [:error] [pid 23284:tid 23298] [client 74.248.20.136:34652] [client 74.248.20.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.248.20.136, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "ackwC4zBujdPHsq7wyShqAAAAow"]
[Sun Mar 29 21:58:35.973390 2026] [:error] [pid 23284:tid 23298] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 29 21:58:36.303858 2026] [:error] [pid 23284:tid 23297] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Sun Mar 29 21:58:36.574773 2026] [:error] [pid 23284:tid 23304] [client 74.248.20.136:34652] File does not exist: /usr/local/apache/htdocs/suspended-page/vbbn.php
[Sun Mar 29 21:58:36.829681 2026] [:error] [pid 23284:tid 23295] [client 74.248.20.136:34652] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "ackwDIzBujdPHsq7wyShrwAAAok"]
[Sun Mar 29 21:58:38.276781 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:50076] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "ackwDiE3TArOFrUtgWo2YAAAAJM"]
[Sun Mar 29 21:58:39.201845 2026] [:error] [pid 23284:tid 23301] [client 74.248.20.136:50028] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "ackwD4zBujdPHsq7wyShtAAAAo8"]
[Sun Mar 29 21:58:40.495095 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:21586] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shoyo.php"] [unique_id "ackwECE3TArOFrUtgWo2ZAAAAIw"]
[Sun Mar 29 21:58:42.132789 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:45658] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "ackwEiE3TArOFrUtgWo2ZQAAAJI"]
[Sun Mar 29 21:58:45.610838 2026] [:error] [pid 23167:tid 23178] [client 74.248.20.136:50012] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "ackwFRIAHJCFaHff3_fBzwAAAcg"]
[Sun Mar 29 21:58:46.692092 2026] [:error] [pid 32255:tid 32298] [client 74.248.20.136:48533] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "ackwFmnfn-AtRoMbquzvjwAAAEc"]
[Sun Mar 29 21:58:47.426064 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:13140] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "ackwF4zBujdPHsq7wySh0gAAApg"]
[Sun Mar 29 21:58:49.215067 2026] [:error] [pid 23168:tid 23205] [client 74.248.20.136:2409] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "ackwGWP8p0yRL8ot_2-eDQAAAgg"]
[Sun Mar 29 21:58:51.287088 2026] [:error] [pid 32257:tid 32320] [client 74.248.20.136:26209] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "ackwGyE3TArOFrUtgWo2agAAAII"]
[Sun Mar 29 21:58:53.846513 2026] [:error] [pid 23284:tid 23307] [client 74.248.20.136:45642] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "ackwHYzBujdPHsq7wySh6QAAApU"]
[Sun Mar 29 21:58:54.478855 2026] [:error] [pid 32257:tid 32332] [client 74.248.20.136:19616] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/waq.php"] [unique_id "ackwHiE3TArOFrUtgWo2eAAAAI4"]
[Sun Mar 29 21:58:55.727385 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:2389] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "ackwHyE3TArOFrUtgWo2fgAAAJQ"]
[Sun Mar 29 21:58:56.773088 2026] [:error] [pid 23168:tid 23215] [client 74.248.20.136:3036] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "ackwIGP8p0yRL8ot_2-eFAAAAhI"]
[Sun Mar 29 21:58:57.764890 2026] [:error] [pid 23168:tid 23203] [client 74.248.20.136:11346] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "ackwIWP8p0yRL8ot_2-eGQAAAgY"]
[Sun Mar 29 21:58:58.557017 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:23071] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wakak.php"] [unique_id "ackwIiE3TArOFrUtgWo2iAAAAIw"]
[Sun Mar 29 21:58:59.991009 2026] [:error] [pid 23250:tid 23263] [client 74.248.20.136:2749] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "ackwI5xrpj-dQjy1cvoF-wAAAks"]
[Sun Mar 29 21:59:02.503275 2026] [:error] [pid 23250:tid 23254] [client 74.248.20.136:13123] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "ackwJpxrpj-dQjy1cvoF_QAAAkI"]
[Sun Mar 29 21:59:03.292788 2026] [:error] [pid 32255:tid 32298] [client 74.248.20.136:49379] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "ackwJ2nfn-AtRoMbquzvpwAAAEc"]
[Sun Mar 29 21:59:04.968897 2026] [:error] [pid 23284:tid 23292] [client 74.248.20.136:50016] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bipas.php"] [unique_id "ackwKIzBujdPHsq7wySh_QAAAoY"]
[Sun Mar 29 21:59:06.641767 2026] [:error] [pid 23250:tid 23252] [client 74.248.20.136:41600] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "ackwKpxrpj-dQjy1cvoGAAAAAkA"]
[Sun Mar 29 21:59:07.584471 2026] [:error] [pid 32255:tid 32298] [client 74.248.20.136:15819] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "ackwK2nfn-AtRoMbquzvtAAAAEc"]
[Sun Mar 29 21:59:08.834697 2026] [:error] [pid 8818:tid 8826] [client 74.248.20.136:2690] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "ackwLCCDvotZNSF0FBrgfgAAAUQ"]
[Sun Mar 29 21:59:09.555346 2026] [:error] [pid 23137:tid 23154] [client 74.248.20.136:15848] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/conte.php"] [unique_id "ackwLRaWQa7LdZ_qGFb7vAAAAY8"]
[Sun Mar 29 21:59:10.727051 2026] [:error] [pid 23284:tid 23301] [client 74.248.20.136:19645] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "ackwLozBujdPHsq7wySiDwAAAo8"]
[Sun Mar 29 21:59:12.323746 2026] [:error] [pid 32359:tid 32376] [client 74.248.20.136:2452] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "ackwMAMb8G3UzfQP3Wgv-gAAAM8"]
[Sun Mar 29 21:59:13.355071 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:44663] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "ackwMYzBujdPHsq7wySiGAAAAoE"]
[Sun Mar 29 21:59:14.120415 2026] [:error] [pid 23284:tid 23305] [client 74.248.20.136:2318] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class3.php"] [unique_id "ackwMozBujdPHsq7wySiHwAAApM"]
[Sun Mar 29 21:59:15.650443 2026] [:error] [pid 23284:tid 23293] [client 74.248.20.136:50583] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "ackwM4zBujdPHsq7wySiKQAAAoc"]
[Sun Mar 29 21:59:16.481602 2026] [:error] [pid 32255:tid 32312] [client 74.248.20.136:2121] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "ackwNGnfn-AtRoMbquzvvQAAAFU"]
[Sun Mar 29 21:59:18.354155 2026] [:error] [pid 32255:tid 32297] [client 74.248.20.136:27652] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "ackwNmnfn-AtRoMbquzvwQAAAEY"]
[Sun Mar 29 21:59:20.902777 2026] [:error] [pid 32255:tid 32302] [client 74.248.20.136:19631] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blurbs18.php"] [unique_id "ackwOGnfn-AtRoMbquzvyQAAAEs"]
[Sun Mar 29 21:59:21.697550 2026] [:error] [pid 32255:tid 32301] [client 74.248.20.136:2459] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "ackwOWnfn-AtRoMbquzvzQAAAEo"]
[Sun Mar 29 21:59:23.485348 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:15846] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "ackwOyE3TArOFrUtgWo2mgAAAIc"]
[Sun Mar 29 21:59:24.510974 2026] [:error] [pid 32255:tid 32292] [client 74.248.20.136:50610] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "ackwPGnfn-AtRoMbquzv2gAAAEE"]
[Sun Mar 29 21:59:25.216226 2026] [:error] [pid 32255:tid 32300] [client 74.248.20.136:50109] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/claa.php"] [unique_id "ackwPWnfn-AtRoMbquzv4gAAAEk"]
[Sun Mar 29 21:59:27.433991 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:24169] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "ackwPyE3TArOFrUtgWo2pQAAAJY"]
[Sun Mar 29 21:59:28.492861 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:15839] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "ackwQCE3TArOFrUtgWo2qgAAAJM"]
[Sun Mar 29 21:59:30.394490 2026] [:error] [pid 23284:tid 23299] [client 74.248.20.136:18308] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "ackwQozBujdPHsq7wySiagAAAo0"]
[Sun Mar 29 21:59:34.970445 2026] [:error] [pid 23284:tid 23307] [client 74.248.20.136:2998] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xb.php"] [unique_id "ackwRozBujdPHsq7wySigAAAApU"]
[Sun Mar 29 21:59:35.862826 2026] [:error] [pid 23284:tid 23297] [client 74.248.20.136:24177] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "ackwR4zBujdPHsq7wySiigAAAos"]
[Sun Mar 29 21:59:37.113224 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sun Mar 29 21:59:37.371251 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Mar 29 21:59:37.664104 2026] [:error] [pid 32257:tid 32327] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Sun Mar 29 21:59:37.975581 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Sun Mar 29 21:59:38.308176 2026] [:error] [pid 32257:tid 32334] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Sun Mar 29 21:59:38.580793 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sun Mar 29 21:59:38.838741 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sun Mar 29 21:59:39.132402 2026] [:error] [pid 32257:tid 32332] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Sun Mar 29 21:59:39.390740 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Mar 29 21:59:39.928336 2026] [:error] [pid 32257:tid 32329] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/lopst.php
[Sun Mar 29 21:59:40.186753 2026] [:error] [pid 32257:tid 32334] [client 74.248.20.136:20756] File does not exist: /usr/local/apache/htdocs/suspended-page/wft.php
[Sun Mar 29 21:59:40.442604 2026] [:error] [pid 32257:tid 32318] [client 74.248.20.136:20756] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ackwTCE3TArOFrUtgWo23AAAAIA"]
[Sun Mar 29 21:59:41.143544 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:18392] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ackwTYzBujdPHsq7wySitAAAApY"]
[Sun Mar 29 21:59:43.630843 2026] [:error] [pid 23284:tid 23305] [client 74.248.20.136:21530] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ackwT4zBujdPHsq7wySixAAAApM"]
[Sun Mar 29 21:59:44.963419 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:11327] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ackwUCE3TArOFrUtgWo25QAAAJY"]
[Sun Mar 29 21:59:46.858128 2026] [:error] [pid 32257:tid 32329] [client 74.248.20.136:18344] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "ackwUiE3TArOFrUtgWo26gAAAIs"]
[Sun Mar 29 21:59:48.050305 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:13648] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "ackwVIzBujdPHsq7wySi3QAAApg"]
[Sun Mar 29 21:59:49.281179 2026] [:error] [pid 23167:tid 23173] [client 74.248.20.136:11275] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "ackwVRIAHJCFaHff3_fB8wAAAcM"]
[Sun Mar 29 21:59:50.517437 2026] [:error] [pid 23284:tid 23298] [client 74.248.20.136:24866] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "ackwVozBujdPHsq7wySi-wAAAow"]
[Sun Mar 29 21:59:52.326138 2026] [:error] [pid 32255:tid 32291] [client 74.248.20.136:12105] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "ackwWGnfn-AtRoMbquzwEAAAAEA"]
[Sun Mar 29 21:59:53.809599 2026] [:error] [pid 23284:tid 23307] [client 74.248.20.136:6282] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "ackwWYzBujdPHsq7wySjHAAAApU"]
[Sun Mar 29 21:59:56.751067 2026] [:error] [pid 32255:tid 32305] [client 74.248.20.136:25496] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "ackwXGnfn-AtRoMbquzwIwAAAE4"]
[Sun Mar 29 21:59:58.150307 2026] [:error] [pid 8818:tid 8829] [client 74.248.20.136:20784] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "ackwXiCDvotZNSF0FBrgkgAAAUc"]
[Sun Mar 29 22:00:00.069155 2026] [:error] [pid 23168:tid 23201] [client 74.248.20.136:17219] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "ackwYGP8p0yRL8ot_2-eOAAAAgQ"]
[Sun Mar 29 22:00:01.854312 2026] [:error] [pid 23168:tid 23215] [client 74.248.20.136:18384] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "ackwYWP8p0yRL8ot_2-eOgAAAhI"]
[Sun Mar 29 22:00:03.243568 2026] [:error] [pid 23284:tid 23288] [client 74.248.20.136:11324] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "ackwY4zBujdPHsq7wySjTwAAAoI"]
[Sun Mar 29 22:00:04.349088 2026] [:error] [pid 32255:tid 32314] [client 74.248.20.136:25535] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "ackwZGnfn-AtRoMbquzwPAAAAFc"]
[Sun Mar 29 22:00:05.161109 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:43639] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "ackwZWnfn-AtRoMbquzwPgAAAFM"]
[Sun Mar 29 22:00:06.127721 2026] [:error] [pid 23284:tid 23289] [client 74.248.20.136:13392] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "ackwZozBujdPHsq7wySjaAAAAoM"]
[Sun Mar 29 22:00:06.967746 2026] [:error] [pid 23167:tid 23170] [client 74.248.20.136:2094] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "ackwZhIAHJCFaHff3_fB-AAAAcA"]
[Sun Mar 29 22:00:07.618174 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:2049] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "ackwZ4zBujdPHsq7wySjbQAAAoE"]
[Sun Mar 29 22:00:09.022513 2026] [:error] [pid 23167:tid 23193] [client 74.248.20.136:43596] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "ackwaRIAHJCFaHff3_fCAAAAAdc"]
[Sun Mar 29 22:00:10.094274 2026] [:error] [pid 23168:tid 23218] [client 74.248.20.136:39359] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "ackwamP8p0yRL8ot_2-eQgAAAhU"]
[Sun Mar 29 22:00:13.154656 2026] [:error] [pid 23250:tid 23267] [client 74.248.20.136:2864] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "ackwbZxrpj-dQjy1cvoGDwAAAk8"]
[Sun Mar 29 22:00:14.540890 2026] [:error] [pid 32255:tid 32305] [client 74.248.20.136:12142] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "ackwbmnfn-AtRoMbquzwUAAAAE4"]
[Sun Mar 29 22:00:16.319173 2026] [:error] [pid 23137:tid 23154] [client 74.248.20.136:12065] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "ackwcBaWQa7LdZ_qGFb7zwAAAY8"]
[Sun Mar 29 22:00:18.008896 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:19233] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "ackwciE3TArOFrUtgWo3FAAAAJc"]
[Sun Mar 29 22:00:19.030326 2026] [:error] [pid 32257:tid 32339] [client 74.248.20.136:10533] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "ackwcyE3TArOFrUtgWo3HQAAAJU"]
[Sun Mar 29 22:00:20.370935 2026] [:error] [pid 32257:tid 32321] [client 74.248.20.136:12051] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "ackwdCE3TArOFrUtgWo3LAAAAIM"]
[Sun Mar 29 22:00:21.634004 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:32083] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "ackwdSE3TArOFrUtgWo3NwAAAIQ"]
[Sun Mar 29 22:00:22.741109 2026] [:error] [pid 32257:tid 32339] [client 74.248.20.136:31086] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "ackwdiE3TArOFrUtgWo3RAAAAJU"]
[Sun Mar 29 22:00:23.848188 2026] [:error] [pid 23284:tid 23294] [client 74.248.20.136:12371] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "ackwd4zBujdPHsq7wySjoAAAAog"]
[Sun Mar 29 22:00:25.492985 2026] [:error] [pid 23284:tid 23293] [client 74.248.20.136:12374] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "ackweYzBujdPHsq7wySjowAAAoc"]
[Sun Mar 29 22:00:27.634665 2026] [:error] [pid 8818:tid 8832] [client 74.248.20.136:2644] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "ackweyCDvotZNSF0FBrgrwAAAUo"]
[Sun Mar 29 22:00:34.096709 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:2843] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "ackwgiE3TArOFrUtgWo3YwAAAJY"]
[Sun Mar 29 22:00:36.106055 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:12402] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "ackwhCE3TArOFrUtgWo3cgAAAIw"]
[Sun Mar 29 22:00:37.192068 2026] [:error] [pid 23167:tid 23177] [client 74.248.20.136:10502] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "ackwhRIAHJCFaHff3_fCEAAAAcc"]
[Sun Mar 29 22:00:38.746469 2026] [:error] [pid 32257:tid 32326] [client 74.248.20.136:10523] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "ackwhiE3TArOFrUtgWo3gQAAAIg"]
[Sun Mar 29 22:00:40.939129 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Sun Mar 29 22:00:41.316771 2026] [:error] [pid 32257:tid 32327] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/zample.php
[Sun Mar 29 22:00:41.671517 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/read.php
[Sun Mar 29 22:00:41.929015 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kd4xalrg7m.php
[Sun Mar 29 22:00:42.198154 2026] [:error] [pid 32257:tid 32320] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Sun Mar 29 22:00:42.456439 2026] [:error] [pid 32257:tid 32319] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mter.php
[Sun Mar 29 22:00:42.713154 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Sun Mar 29 22:00:42.999809 2026] [:error] [pid 32257:tid 32327] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Sun Mar 29 22:00:43.257459 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Sun Mar 29 22:00:43.514586 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/eee.php
[Sun Mar 29 22:00:44.798290 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:2624] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Sun Mar 29 22:00:45.081101 2026] [:error] [pid 32257:tid 32331] [client 74.248.20.136:2624] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "ackwjSE3TArOFrUtgWo3ogAAAI0"]
[Sun Mar 29 22:00:48.010811 2026] [:error] [pid 23284:tid 23296] [client 74.248.20.136:30423] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "ackwkIzBujdPHsq7wySj3wAAAoo"]
[Sun Mar 29 22:00:49.084691 2026] [:error] [pid 32255:tid 32291] [client 74.248.20.136:25702] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "ackwkWnfn-AtRoMbquzwiAAAAEA"]
[Sun Mar 29 22:00:50.549086 2026] [:error] [pid 23168:tid 23206] [client 74.248.20.136:2828] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/swallowable.php"] [unique_id "ackwkmP8p0yRL8ot_2-ebAAAAgk"]
[Sun Mar 29 22:00:51.827200 2026] [:error] [pid 8818:tid 8837] [client 74.248.20.136:20381] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "ackwkyCDvotZNSF0FBrgyAAAAU8"]
[Sun Mar 29 22:00:55.659128 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:13149] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "ackwlyE3TArOFrUtgWo3xgAAAIc"]
[Sun Mar 29 22:00:58.731603 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:2836] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "ackwmozBujdPHsq7wySkDAAAApg"]
[Sun Mar 29 22:01:00.961500 2026] [:error] [pid 32359:tid 32371] [client 74.248.20.136:25417] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "ackwnAMb8G3UzfQP3WgwKgAAAMo"]
[Sun Mar 29 22:01:02.207335 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:20414] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "ackwnozBujdPHsq7wySkJAAAApY"]
[Sun Mar 29 22:01:03.502975 2026] [:error] [pid 23168:tid 23203] [client 74.248.20.136:27714] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "ackwn2P8p0yRL8ot_2-egwAAAgY"]
[Sun Mar 29 22:01:04.570720 2026] [:error] [pid 32255:tid 32297] [client 74.248.20.136:15164] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "ackwoGnfn-AtRoMbquzw0QAAAEY"]
[Sun Mar 29 22:01:05.315535 2026] [:error] [pid 23250:tid 23276] [client 74.248.20.136:40973] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "ackwoZxrpj-dQjy1cvoGLgAAAlg"]
[Sun Mar 29 22:01:06.511171 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:25667] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "ackwoiE3TArOFrUtgWo35wAAAJM"]
[Sun Mar 29 22:01:07.301127 2026] [:error] [pid 32359:tid 32372] [client 74.248.20.136:2818] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "ackwowMb8G3UzfQP3WgwMgAAAMs"]
[Sun Mar 29 22:01:09.443156 2026] [:error] [pid 32255:tid 32304] [client 74.248.20.136:13065] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "ackwpWnfn-AtRoMbquzw4AAAAE0"]
[Sun Mar 29 22:01:11.220341 2026] [:error] [pid 32255:tid 32307] [client 74.248.20.136:2874] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "ackwp2nfn-AtRoMbquzw6wAAAFA"]
[Sun Mar 29 22:01:13.503066 2026] [:error] [pid 23284:tid 23297] [client 74.248.20.136:36150] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ackwqYzBujdPHsq7wySkTQAAAos"]
[Sun Mar 29 22:01:16.093782 2026] [:error] [pid 32255:tid 32314] [client 74.248.20.136:20412] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ackwrGnfn-AtRoMbquzw9AAAAFc"]
[Sun Mar 29 22:01:18.411886 2026] [:error] [pid 23167:tid 23187] [client 74.248.20.136:27721] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ackwrhIAHJCFaHff3_fCLwAAAdE"]
[Sun Mar 29 22:01:19.338895 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:35081] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ackwryE3TArOFrUtgWo4BQAAAI8"]
[Sun Mar 29 22:01:20.540367 2026] [:error] [pid 8818:tid 8825] [client 74.248.20.136:57724] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "ackwsCCDvotZNSF0FBrg2wAAAUM"]
[Sun Mar 29 22:01:25.378145 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:20353] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "ackwtSE3TArOFrUtgWo4DgAAAJI"]
[Sun Mar 29 22:01:27.927385 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:42803] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "ackwtyE3TArOFrUtgWo4IwAAAIc"]
[Sun Mar 29 22:01:29.591897 2026] [:error] [pid 32255:tid 32302] [client 74.248.20.136:12404] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "ackwuWnfn-AtRoMbquzxAgAAAEs"]
[Sun Mar 29 22:01:30.407003 2026] [:error] [pid 32257:tid 32329] [client 74.248.20.136:35131] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ackwuiE3TArOFrUtgWo4LAAAAIs"]
[Sun Mar 29 22:01:32.755731 2026] [:error] [pid 23284:tid 23293] [client 74.248.20.136:2837] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ackwvIzBujdPHsq7wySkiAAAAoc"]
[Sun Mar 29 22:01:34.614606 2026] [:error] [pid 32257:tid 32339] [client 74.248.20.136:36073] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ackwviE3TArOFrUtgWo4NgAAAJU"]
[Sun Mar 29 22:01:35.566272 2026] [:error] [pid 23168:tid 23203] [client 74.248.20.136:36042] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ackwv2P8p0yRL8ot_2-eqAAAAgY"]
[Sun Mar 29 22:01:36.617985 2026] [:error] [pid 23284:tid 23290] [client 74.248.20.136:16341] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ackwwIzBujdPHsq7wySkqwAAAoQ"]
[Sun Mar 29 22:01:37.908696 2026] [:error] [pid 32257:tid 32318] [client 74.248.20.136:34247] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ackwwSE3TArOFrUtgWo4OwAAAIA"]
[Sun Mar 29 22:01:38.756375 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:32787] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ackwwiE3TArOFrUtgWo4PQAAAIw"]
[Sun Mar 29 22:01:39.885838 2026] [:error] [pid 23168:tid 23211] [client 74.248.20.136:32378] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ackww2P8p0yRL8ot_2-esgAAAg4"]
[Sun Mar 29 22:01:41.574206 2026] [:error] [pid 23168:tid 23211] [client 74.248.20.136:36078] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ackwxWP8p0yRL8ot_2-evQAAAg4"]
[Sun Mar 29 22:01:43.511840 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:32380] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ackwxyE3TArOFrUtgWo4SgAAAJM"]
[Sun Mar 29 22:01:44.878504 2026] [:error] [pid 23168:tid 23200] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sun Mar 29 22:01:45.137122 2026] [:error] [pid 23168:tid 23203] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Mar 29 22:01:45.700473 2026] [:error] [pid 23168:tid 23198] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Sun Mar 29 22:01:46.222718 2026] [:error] [pid 23168:tid 23205] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sun Mar 29 22:01:46.519495 2026] [:error] [pid 23168:tid 23207] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Sun Mar 29 22:01:46.777722 2026] [:error] [pid 23168:tid 23218] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sun Mar 29 22:01:47.064167 2026] [:error] [pid 23168:tid 23203] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Sun Mar 29 22:01:47.328633 2026] [:error] [pid 23168:tid 23213] [client 74.248.20.136:16320] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Sun Mar 29 22:01:47.703138 2026] [:error] [pid 23168:tid 23208] [client 74.248.20.136:16320] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "ackwy2P8p0yRL8ot_2-e2AAAAgs"]
[Sun Mar 29 22:01:49.404545 2026] [:error] [pid 23284:tid 23307] [client 74.248.20.136:15149] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "ackwzYzBujdPHsq7wySk0QAAApU"]
[Sun Mar 29 22:01:50.610964 2026] [:error] [pid 23250:tid 23262] [client 74.248.20.136:31129] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "ackwzpxrpj-dQjy1cvoGUQAAAko"]
[Sun Mar 29 22:01:51.729379 2026] [:error] [pid 23168:tid 23215] [client 74.248.20.136:27616] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fffff.php"] [unique_id "ackwz2P8p0yRL8ot_2-e3QAAAhI"]
[Sun Mar 29 22:01:53.159195 2026] [:error] [pid 32255:tid 32297] [client 74.248.20.136:26669] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ackw0Wnfn-AtRoMbquzxIQAAAEY"]
[Sun Mar 29 22:01:54.110080 2026] [:error] [pid 23284:tid 23291] [client 74.248.20.136:10526] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ackw0ozBujdPHsq7wySk6gAAAoU"]
[Sun Mar 29 22:01:54.985591 2026] [:error] [pid 23284:tid 23291] [client 74.248.20.136:36032] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ackw0ozBujdPHsq7wySk8gAAAoU"]
[Sun Mar 29 22:01:55.794315 2026] [:error] [pid 23137:tid 23159] [client 74.248.20.136:10551] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ackw0xaWQa7LdZ_qGFb8DgAAAZQ"]
[Sun Mar 29 22:01:57.238823 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:42770] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ackw1SE3TArOFrUtgWo4hQAAAJI"]
[Sun Mar 29 22:01:58.547464 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:29291] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ackw1iE3TArOFrUtgWo4mQAAAJI"]
[Sun Mar 29 22:01:59.363693 2026] [:error] [pid 32257:tid 32334] [client 74.248.20.136:27345] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ackw1yE3TArOFrUtgWo4owAAAJA"]
[Sun Mar 29 22:02:00.500173 2026] [:error] [pid 23137:tid 23142] [client 74.248.20.136:29265] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ackw2BaWQa7LdZ_qGFb8DwAAAYM"]
[Sun Mar 29 22:02:01.807103 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:12373] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ackw2YzBujdPHsq7wySk_gAAApg"]
[Sun Mar 29 22:02:02.557984 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:10547] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ackw2ozBujdPHsq7wySlAgAAApA"]
[Sun Mar 29 22:02:03.894971 2026] [:error] [pid 32257:tid 32319] [client 74.248.20.136:33637] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ackw2yE3TArOFrUtgWo4sAAAAIE"]
[Sun Mar 29 22:02:05.564019 2026] [:error] [pid 32255:tid 32311] [client 74.248.20.136:26632] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ackw3Wnfn-AtRoMbquzxWQAAAFQ"]
[Sun Mar 29 22:02:06.943131 2026] [:error] [pid 23137:tid 23139] [client 74.248.20.136:26680] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ackw3haWQa7LdZ_qGFb8EwAAAYA"]
[Sun Mar 29 22:02:07.590393 2026] [:error] [pid 8818:tid 8845] [client 74.248.20.136:40658] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ackw3yCDvotZNSF0FBrg_QAAAVc"]
[Sun Mar 29 22:02:09.883440 2026] [:error] [pid 8818:tid 8842] [client 74.248.20.136:26637] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ackw4SCDvotZNSF0FBrhCwAAAVQ"]
[Sun Mar 29 22:02:11.438607 2026] [:error] [pid 23168:tid 23214] [client 74.248.20.136:33748] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ackw42P8p0yRL8ot_2-e-AAAAhE"]
[Sun Mar 29 22:02:14.169167 2026] [:error] [pid 32254:tid 32283] [client 74.248.20.136:10511] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "ackw5qug2IHuyGgCTn9daAAAABM"]
[Sun Mar 29 22:02:14.965960 2026] [:error] [pid 23168:tid 23199] [client 74.248.20.136:36738] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "ackw5mP8p0yRL8ot_2-fAgAAAgI"]
[Sun Mar 29 22:02:15.715043 2026] [:error] [pid 32255:tid 32295] [client 74.248.20.136:50642] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "ackw52nfn-AtRoMbquzxcAAAAEQ"]
[Sun Mar 29 22:02:17.028374 2026] [:error] [pid 32255:tid 32311] [client 74.248.20.136:36788] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "ackw6Wnfn-AtRoMbquzxeAAAAFQ"]
[Sun Mar 29 22:02:17.998585 2026] [:error] [pid 8818:tid 8842] [client 74.248.20.136:33736] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/admin.php"] [unique_id "ackw6SCDvotZNSF0FBrhEgAAAVQ"]
[Sun Mar 29 22:02:19.493816 2026] [:error] [pid 32255:tid 32309] [client 74.248.20.136:2875] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/admin.php"] [unique_id "ackw62nfn-AtRoMbquzxfgAAAFI"]
[Sun Mar 29 22:02:20.143466 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:16707] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/admin.php"] [unique_id "ackw7Gnfn-AtRoMbquzxgQAAAEg"]
[Sun Mar 29 22:02:21.408627 2026] [:error] [pid 23284:tid 23301] [client 74.248.20.136:29100] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/admin.php"] [unique_id "ackw7YzBujdPHsq7wySlQgAAAo8"]
[Sun Mar 29 22:02:22.467619 2026] [:error] [pid 23137:tid 23145] [client 74.248.20.136:23661] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ackw7haWQa7LdZ_qGFb8IwAAAYY"]
[Sun Mar 29 22:02:23.601040 2026] [:error] [pid 23250:tid 23261] [client 74.248.20.136:40547] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ackw75xrpj-dQjy1cvoGYAAAAkk"]
[Sun Mar 29 22:02:25.031612 2026] [:error] [pid 23168:tid 23201] [client 74.248.20.136:40643] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ackw8WP8p0yRL8ot_2-fDgAAAgQ"]
[Sun Mar 29 22:02:26.301155 2026] [:error] [pid 23284:tid 23299] [client 74.248.20.136:2829] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ackw8ozBujdPHsq7wySlYQAAAo0"]
[Sun Mar 29 22:02:27.530518 2026] [:error] [pid 23137:tid 23144] [client 74.248.20.136:37613] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ackw8xaWQa7LdZ_qGFb8LQAAAYU"]
[Sun Mar 29 22:02:29.008837 2026] [:error] [pid 32255:tid 32314] [client 74.248.20.136:33770] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ackw9Wnfn-AtRoMbquzxjgAAAFc"]
[Sun Mar 29 22:02:31.338794 2026] [:error] [pid 23250:tid 23269] [client 74.248.20.136:33760] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ackw95xrpj-dQjy1cvoGaAAAAlE"]
[Sun Mar 29 22:02:33.287166 2026] [:error] [pid 23167:tid 23183] [client 74.248.20.136:34353] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ackw-RIAHJCFaHff3_fCZQAAAc0"]
[Sun Mar 29 22:02:36.551772 2026] [:error] [pid 23250:tid 23265] [client 74.248.20.136:19369] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa2.php"] [unique_id "ackw_Jxrpj-dQjy1cvoGawAAAk0"]
[Sun Mar 29 22:02:52.105154 2026] [:error] [pid 23137:tid 23147] [client 74.248.20.136:19365] File does not exist: /usr/local/apache/htdocs/suspended-page/aa2.php
[Sun Mar 29 22:03:07.448878 2026] [:error] [pid 23168:tid 23203] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sun Mar 29 22:03:07.640562 2026] [:error] [pid 23168:tid 23205] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Sun Mar 29 22:03:07.830039 2026] [:error] [pid 23168:tid 23198] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Sun Mar 29 22:03:08.021186 2026] [:error] [pid 23168:tid 23212] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Sun Mar 29 22:03:08.211677 2026] [:error] [pid 23168:tid 23210] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Mar 29 22:03:08.403425 2026] [:error] [pid 23168:tid 23211] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Sun Mar 29 22:03:08.594198 2026] [:error] [pid 23168:tid 23201] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Sun Mar 29 22:03:08.784503 2026] [:error] [pid 23168:tid 23217] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Sun Mar 29 22:03:08.974465 2026] [:error] [pid 23168:tid 23213] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/nz.php
[Sun Mar 29 22:03:09.163537 2026] [:error] [pid 23168:tid 23208] [client 52.180.158.245:64690] File does not exist: /usr/local/apache/htdocs/suspended-page/bnn_.php
[Sun Mar 29 22:03:09.350128 2026] [:error] [pid 23168:tid 23214] [client 52.180.158.245:64690] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "ackxHWP8p0yRL8ot_2-fYAAAAhE"]
[Sun Mar 29 22:03:10.832168 2026] [:error] [pid 23284:tid 23295] [client 52.180.158.245:65367] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "ackxHozBujdPHsq7wySl9wAAAok"]
[Sun Mar 29 22:03:12.154998 2026] [:error] [pid 23284:tid 23301] [client 52.180.158.245:64739] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "ackxIIzBujdPHsq7wySmAgAAAo8"]
[Sun Mar 29 22:03:13.615687 2026] [:error] [pid 8818:tid 8830] [client 52.180.158.245:64671] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/anz.php"] [unique_id "ackxISCDvotZNSF0FBrhNwAAAUg"]
[Sun Mar 29 22:03:14.304906 2026] [:error] [pid 8818:tid 8838] [client 52.180.158.245:64342] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ackxIiCDvotZNSF0FBrhPQAAAVA"]
[Sun Mar 29 22:03:15.546725 2026] [:error] [pid 23250:tid 23260] [client 52.180.158.245:64367] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ackxI5xrpj-dQjy1cvoGeAAAAkg"]
[Sun Mar 29 22:03:16.368243 2026] [:error] [pid 32257:tid 32342] [client 52.180.158.245:64764] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ackxJCE3TArOFrUtgWo5YgAAAJg"]
[Sun Mar 29 22:03:20.207954 2026] [:error] [pid 23284:tid 23305] [client 52.180.158.245:64681] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ackxKIzBujdPHsq7wySmIQAAApM"]
[Sun Mar 29 22:03:21.962993 2026] [:error] [pid 32257:tid 32341] [client 52.180.158.245:64356] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "ackxKSE3TArOFrUtgWo5dwAAAJc"]
[Sun Mar 29 22:03:22.583329 2026] [:error] [pid 23284:tid 23294] [client 52.180.158.245:64661] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "ackxKozBujdPHsq7wySmKwAAAog"]
[Sun Mar 29 22:03:23.333748 2026] [:error] [pid 32257:tid 32339] [client 52.180.158.245:64650] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "ackxKyE3TArOFrUtgWo5fgAAAJU"]
[Sun Mar 29 22:03:24.603598 2026] [:error] [pid 32257:tid 32327] [client 52.180.158.245:64335] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file66.php"] [unique_id "ackxLCE3TArOFrUtgWo5hAAAAIk"]
[Sun Mar 29 22:03:25.693394 2026] [:error] [pid 23168:tid 23221] [client 52.180.158.245:65342] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "ackxLWP8p0yRL8ot_2-fbgAAAhg"]
[Sun Mar 29 22:03:26.959191 2026] [:error] [pid 23168:tid 23219] [client 52.180.158.245:65351] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "ackxLmP8p0yRL8ot_2-fcQAAAhY"]
[Sun Mar 29 22:03:27.527318 2026] [:error] [pid 23284:tid 23289] [client 52.180.158.245:64365] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "ackxL4zBujdPHsq7wySmSgAAAoM"]
[Sun Mar 29 22:03:28.499454 2026] [:error] [pid 32257:tid 32340] [client 52.180.158.245:64701] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kure.php"] [unique_id "ackxMCE3TArOFrUtgWo5jAAAAJY"]
[Sun Mar 29 22:03:30.460749 2026] [:error] [pid 32257:tid 32333] [client 52.180.158.245:64339] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "ackxMiE3TArOFrUtgWo5lgAAAI8"]
[Sun Mar 29 22:03:31.323969 2026] [:error] [pid 32255:tid 32314] [client 52.180.158.245:65373] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "ackxM2nfn-AtRoMbquzyNAAAAFc"]
[Sun Mar 29 22:03:33.402814 2026] [:error] [pid 8818:tid 8825] [client 52.180.158.245:64738] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "ackxNSCDvotZNSF0FBrhVgAAAUM"]
[Sun Mar 29 22:03:35.432361 2026] [:error] [pid 32257:tid 32322] [client 52.180.158.245:64669] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "ackxNyE3TArOFrUtgWo5nwAAAIQ"]
[Sun Mar 29 22:03:36.525534 2026] [:error] [pid 32257:tid 32337] [client 52.180.158.245:64685] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "ackxOCE3TArOFrUtgWo5pQAAAJM"]
[Sun Mar 29 22:03:37.451867 2026] [:error] [pid 23137:tid 23147] [client 52.180.158.245:65326] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "ackxORaWQa7LdZ_qGFb8SwAAAYg"]
[Sun Mar 29 22:03:38.049722 2026] [:error] [pid 23137:tid 23162] [client 52.180.158.245:64725] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "ackxOhaWQa7LdZ_qGFb8TAAAAZc"]
[Sun Mar 29 22:03:40.512548 2026] [:error] [pid 32257:tid 32334] [client 52.180.158.245:65352] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gaje.php"] [unique_id "ackxPCE3TArOFrUtgWo5swAAAJA"]
[Sun Mar 29 22:03:41.745157 2026] [:error] [pid 23284:tid 23307] [client 52.180.158.245:64371] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "ackxPYzBujdPHsq7wySmZQAAApU"]
[Sun Mar 29 22:03:42.387162 2026] [:error] [pid 32257:tid 32328] [client 52.180.158.245:64644] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "ackxPiE3TArOFrUtgWo5uQAAAIo"]
[Sun Mar 29 22:03:43.874563 2026] [:error] [pid 32257:tid 32337] [client 52.180.158.245:64358] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "ackxPyE3TArOFrUtgWo5uwAAAJM"]
[Sun Mar 29 22:03:44.398949 2026] [:error] [pid 23250:tid 23268] [client 52.180.158.245:65346] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/msy.php"] [unique_id "ackxQJxrpj-dQjy1cvoGkwAAAlA"]
[Sun Mar 29 22:03:45.150670 2026] [:error] [pid 32359:tid 32383] [client 52.180.158.245:64347] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "ackxQQMb8G3UzfQP3WgwowAAANY"]
[Sun Mar 29 22:03:46.049627 2026] [:error] [pid 32255:tid 32313] [client 52.180.158.245:65350] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "ackxQmnfn-AtRoMbquzySgAAAFY"]
[Sun Mar 29 22:03:47.461271 2026] [:error] [pid 32255:tid 32292] [client 52.180.158.245:65340] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "ackxQ2nfn-AtRoMbquzyVgAAAEE"]
[Sun Mar 29 22:03:49.000374 2026] [:error] [pid 23168:tid 23210] [client 52.180.158.245:64641] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fgd.php"] [unique_id "ackxRGP8p0yRL8ot_2-ffQAAAg0"]
[Sun Mar 29 22:03:50.423812 2026] [:error] [pid 32254:tid 32287] [client 52.180.158.245:65317] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "ackxRqug2IHuyGgCTn9dpQAAABc"]
[Sun Mar 29 22:03:51.191311 2026] [:error] [pid 8818:tid 8823] [client 52.180.158.245:64747] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "ackxRyCDvotZNSF0FBrhXAAAAUE"]
[Sun Mar 29 22:03:51.828978 2026] [:error] [pid 23168:tid 23198] [client 52.180.158.245:65320] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "ackxR2P8p0yRL8ot_2-fiwAAAgE"]
[Sun Mar 29 22:03:52.945838 2026] [:error] [pid 32255:tid 32310] [client 52.180.158.245:64748] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/X7T6.php"] [unique_id "ackxSGnfn-AtRoMbquzyXwAAAFM"]
[Sun Mar 29 22:03:55.103896 2026] [:error] [pid 32257:tid 32339] [client 52.180.158.245:64320] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "ackxSyE3TArOFrUtgWo54gAAAJU"]
[Sun Mar 29 22:03:55.899148 2026] [:error] [pid 23284:tid 23291] [client 52.180.158.245:64670] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "ackxS4zBujdPHsq7wySmdwAAAoU"]
[Sun Mar 29 22:03:57.007047 2026] [:error] [pid 23284:tid 23310] [client 52.180.158.245:64333] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "ackxTYzBujdPHsq7wySmggAAApg"]
[Sun Mar 29 22:03:57.499737 2026] [:error] [pid 23168:tid 23205] [client 52.180.158.245:63623] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alog.php"] [unique_id "ackxTWP8p0yRL8ot_2-fkgAAAgg"]
[Sun Mar 29 22:03:58.713690 2026] [:error] [pid 23284:tid 23290] [client 52.180.158.245:65357] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "ackxTozBujdPHsq7wySmlQAAAoQ"]
[Sun Mar 29 22:04:00.834774 2026] [:error] [pid 23284:tid 23302] [client 52.180.158.245:65397] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "ackxUIzBujdPHsq7wySmqgAAApA"]
[Sun Mar 29 22:04:03.440363 2026] [:error] [pid 32257:tid 32339] [client 52.180.158.245:65307] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "ackxUyE3TArOFrUtgWo59wAAAJU"]
[Sun Mar 29 22:04:04.756926 2026] [:error] [pid 32257:tid 32342] [client 52.180.158.245:64721] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "ackxVCE3TArOFrUtgWo5_AAAAJg"]
[Sun Mar 29 22:04:07.033176 2026] [:error] [pid 23284:tid 23293] [client 52.180.158.245:64752] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sef.php"] [unique_id "ackxV4zBujdPHsq7wySmzwAAAoc"]
[Sun Mar 29 22:04:09.422725 2026] [:error] [pid 32255:tid 32310] [client 52.180.158.245:64693] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Sun Mar 29 22:04:09.617998 2026] [:error] [pid 32255:tid 32299] [client 52.180.158.245:64693] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Sun Mar 29 22:04:09.807201 2026] [:error] [pid 32255:tid 32297] [client 52.180.158.245:64693] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Sun Mar 29 22:04:09.994852 2026] [:error] [pid 32255:tid 32303] [client 52.180.158.245:64693] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "ackxWWnfn-AtRoMbquzyeAAAAEw"]
[Sun Mar 29 22:04:11.820442 2026] [:error] [pid 23167:tid 23185] [client 52.180.158.245:64652] [client 52.180.158.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.180.158.245, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "ackxWxIAHJCFaHff3_fC2gAAAc8"]
[Sun Mar 29 22:04:12.609405 2026] [:error] [pid 23167:tid 23178] [client 52.180.158.245:64652] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 29 22:04:12.798378 2026] [:error] [pid 23167:tid 23170] [client 52.180.158.245:64652] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sun Mar 29 22:04:13.173827 2026] [:error] [pid 23167:tid 23172] [client 52.180.158.245:64652] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "ackxXRIAHJCFaHff3_fC5AAAAcI"]
[Sun Mar 29 22:04:14.408828 2026] [:error] [pid 32255:tid 32312] [client 52.180.158.245:65318] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "ackxXmnfn-AtRoMbquzyfwAAAFU"]
[Sun Mar 29 22:04:15.387635 2026] [:error] [pid 32257:tid 32330] [client 52.180.158.245:64741] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "ackxXyE3TArOFrUtgWo6EwAAAIw"]
[Sun Mar 29 22:04:16.894446 2026] [:error] [pid 23168:tid 23220] [client 52.180.158.245:65384] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "ackxYGP8p0yRL8ot_2-fpwAAAhc"]
[Sun Mar 29 22:04:18.251265 2026] [:error] [pid 23168:tid 23205] [client 52.180.158.245:65329] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ini.php"] [unique_id "ackxYmP8p0yRL8ot_2-frwAAAgg"]
[Sun Mar 29 22:04:19.191283 2026] [:error] [pid 23284:tid 23294] [client 52.180.158.245:65353] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "ackxY4zBujdPHsq7wySm7wAAAog"]
[Sun Mar 29 22:04:21.090843 2026] [:error] [pid 32255:tid 32292] [client 52.180.158.245:64369] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "ackxZWnfn-AtRoMbquzyhgAAAEE"]
[Sun Mar 29 22:04:23.086637 2026] [:error] [pid 32255:tid 32297] [client 52.180.158.245:64642] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "ackxZ2nfn-AtRoMbquzykwAAAEY"]
[Sun Mar 29 22:04:24.841027 2026] [:error] [pid 23284:tid 23307] [client 52.180.158.245:64765] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "ackxaIzBujdPHsq7wySnFAAAApU"]
[Sun Mar 29 22:04:25.734040 2026] [:error] [pid 23284:tid 23286] [client 52.180.158.245:65391] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "ackxaYzBujdPHsq7wySnFwAAAoA"]
[Sun Mar 29 22:04:29.088377 2026] [:error] [pid 23284:tid 23306] [client 52.180.158.245:64659] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "ackxbYzBujdPHsq7wySnGwAAApQ"]
[Sun Mar 29 22:04:30.484438 2026] [:error] [pid 32255:tid 32315] [client 52.180.158.245:64647] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "ackxbmnfn-AtRoMbquzypAAAAFg"]
[Sun Mar 29 22:04:31.766481 2026] [:error] [pid 8818:tid 8842] [client 52.180.158.245:64364] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "ackxbyCDvotZNSF0FBrhdAAAAVQ"]
[Sun Mar 29 22:04:32.507441 2026] [:error] [pid 32359:tid 32384] [client 52.180.158.245:64647] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "ackxcAMb8G3UzfQP3WgwvQAAANc"]
[Sun Mar 29 22:04:32.988191 2026] [:error] [pid 32255:tid 32300] [client 52.180.158.245:64682] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "ackxcGnfn-AtRoMbquzyrwAAAEk"]
[Sun Mar 29 22:04:33.598853 2026] [:error] [pid 32255:tid 32294] [client 52.180.158.245:65370] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "ackxcWnfn-AtRoMbquzysAAAAEM"]
[Sun Mar 29 22:04:34.032558 2026] [:error] [pid 32255:tid 32304] [client 52.180.158.245:64734] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "ackxcmnfn-AtRoMbquzytAAAAE0"]
[Sun Mar 29 22:04:34.576621 2026] [:error] [pid 23137:tid 23149] [client 52.180.158.245:64692] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ackxchaWQa7LdZ_qGFb8aQAAAYo"]
[Sun Mar 29 22:04:35.047139 2026] [:error] [pid 23250:tid 23269] [client 52.180.158.245:63683] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ackxc5xrpj-dQjy1cvoGsQAAAlE"]
[Sun Mar 29 22:04:35.687538 2026] [:error] [pid 23284:tid 23293] [client 52.180.158.245:65363] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ackxc4zBujdPHsq7wySnKAAAAoc"]
[Sun Mar 29 22:04:36.511846 2026] [:error] [pid 23250:tid 23256] [client 52.180.158.245:64306] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ackxdJxrpj-dQjy1cvoGugAAAkQ"]
[Sun Mar 29 22:04:37.163369 2026] [:error] [pid 8818:tid 8825] [client 52.180.158.245:65330] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "ackxdSCDvotZNSF0FBrhdwAAAUM"]
[Sun Mar 29 22:04:37.548726 2026] [:error] [pid 23284:tid 23310] [client 52.180.158.245:65309] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "ackxdYzBujdPHsq7wySnLQAAApg"]
[Sun Mar 29 22:04:38.499356 2026] [:error] [pid 23284:tid 23307] [client 52.180.158.245:64326] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "ackxdozBujdPHsq7wySnMQAAApU"]
[Sun Mar 29 22:04:38.999633 2026] [:error] [pid 23168:tid 23211] [client 52.180.158.245:64679] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "ackxdmP8p0yRL8ot_2-fwwAAAg4"]
[Sun Mar 29 22:04:39.654021 2026] [:error] [pid 23284:tid 23287] [client 52.180.158.245:65352] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "ackxd4zBujdPHsq7wySnOgAAAoE"]
[Sun Mar 29 22:04:40.057611 2026] [:error] [pid 32257:tid 32330] [client 52.180.158.245:65400] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "ackxeCE3TArOFrUtgWo6QQAAAIw"]
[Sun Mar 29 22:04:41.489407 2026] [:error] [pid 23137:tid 23162] [client 52.180.158.245:65316] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "ackxeRaWQa7LdZ_qGFb8bAAAAZc"]
[Sun Mar 29 22:04:43.122922 2026] [:error] [pid 32257:tid 32327] [client 52.180.158.245:65382] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "ackxeyE3TArOFrUtgWo6SwAAAIk"]
[Sun Mar 29 22:04:45.005844 2026] [:error] [pid 23250:tid 23269] [client 52.180.158.245:65374] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "ackxfZxrpj-dQjy1cvoGxgAAAlE"]
[Sun Mar 29 22:04:46.989904 2026] [:error] [pid 23250:tid 23267] [client 52.180.158.245:65393] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "ackxfpxrpj-dQjy1cvoGyQAAAk8"]
[Sun Mar 29 22:04:50.157018 2026] [:error] [pid 32254:tid 32282] [client 52.180.158.245:64370] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "ackxgqug2IHuyGgCTn9d3QAAABI"]
[Sun Mar 29 22:04:52.390569 2026] [:error] [pid 32359:tid 32378] [client 52.180.158.245:64334] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "ackxhAMb8G3UzfQP3WgwwwAAANE"]
[Sun Mar 29 22:04:53.459052 2026] [:error] [pid 23168:tid 23216] [client 52.180.158.245:64321] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackxhWP8p0yRL8ot_2-f5AAAAhM"]
[Sun Mar 29 22:04:54.776426 2026] [:error] [pid 8818:tid 8845] [client 52.180.158.245:65305] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackxhiCDvotZNSF0FBrhjwAAAVc"]
[Sun Mar 29 22:04:55.609384 2026] [:error] [pid 32359:tid 32372] [client 52.180.158.245:65339] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackxhwMb8G3UzfQP3WgwxwAAAMs"]
[Sun Mar 29 22:04:56.914509 2026] [:error] [pid 23168:tid 23212] [client 52.180.158.245:64361] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackxiGP8p0yRL8ot_2-f5QAAAg8"]
[Sun Mar 29 22:04:57.829663 2026] [:error] [pid 32359:tid 32369] [client 52.180.158.245:64672] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ackxiQMb8G3UzfQP3WgwzQAAAMg"]
[Sun Mar 29 22:04:58.952940 2026] [:error] [pid 23250:tid 23274] [client 52.180.158.245:65302] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ackxipxrpj-dQjy1cvoGzQAAAlY"]
[Sun Mar 29 22:04:59.850752 2026] [:error] [pid 32257:tid 32332] [client 52.180.158.245:64328] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ackxiyE3TArOFrUtgWo6bwAAAI4"]
[Sun Mar 29 22:05:00.641103 2026] [:error] [pid 8818:tid 8846] [client 52.180.158.245:65383] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ackxjCCDvotZNSF0FBrhnAAAAVg"]
[Sun Mar 29 22:05:01.257740 2026] [:error] [pid 23168:tid 23220] [client 52.180.158.245:65344] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ackxjWP8p0yRL8ot_2-f6AAAAhc"]
[Sun Mar 29 22:05:01.782634 2026] [:error] [pid 23168:tid 23199] [client 52.180.158.245:64760] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ackxjWP8p0yRL8ot_2-f6wAAAgI"]
[Sun Mar 29 22:05:02.672288 2026] [:error] [pid 23168:tid 23209] [client 52.180.158.245:64711] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "ackxjmP8p0yRL8ot_2-f8QAAAgw"]
[Sun Mar 29 22:05:03.848104 2026] [:error] [pid 23137:tid 23142] [client 52.180.158.245:65315] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "ackxjxaWQa7LdZ_qGFb8fgAAAYM"]
[Sun Mar 29 22:05:05.141586 2026] [:error] [pid 23284:tid 23299] [client 52.180.158.245:65381] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "ackxkYzBujdPHsq7wySnUwAAAo0"]
[Sun Mar 29 22:05:06.998279 2026] [:error] [pid 32255:tid 32291] [client 52.180.158.245:63686] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "ackxkmnfn-AtRoMbquzy3AAAAEA"]
[Sun Mar 29 22:05:08.766978 2026] [:error] [pid 32257:tid 32335] [client 52.180.158.245:63684] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "ackxlCE3TArOFrUtgWo6egAAAJE"]
[Sun Mar 29 22:05:09.365854 2026] [:error] [pid 32257:tid 32340] [client 52.180.158.245:64755] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "ackxlSE3TArOFrUtgWo6ewAAAJY"]
[Sun Mar 29 22:05:10.001407 2026] [:error] [pid 23250:tid 23253] [client 52.180.158.245:64662] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "ackxlpxrpj-dQjy1cvoG1gAAAkE"]
[Sun Mar 29 22:05:11.739002 2026] [:error] [pid 32257:tid 32337] [client 52.180.158.245:65378] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "ackxlyE3TArOFrUtgWo6iAAAAJM"]
[Sun Mar 29 22:05:12.978008 2026] [:error] [pid 32257:tid 32329] [client 52.180.158.245:64353] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "ackxmCE3TArOFrUtgWo6kQAAAIs"]
[Sun Mar 29 22:05:13.582735 2026] [:error] [pid 8818:tid 8822] [client 52.180.158.245:64689] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "ackxmSCDvotZNSF0FBrhrQAAAUA"]
[Sun Mar 29 22:05:14.502203 2026] [:error] [pid 23284:tid 23301] [client 52.180.158.245:63041] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sun Mar 29 22:05:14.704724 2026] [:error] [pid 23284:tid 23307] [client 52.180.158.245:63041] [client 52.180.158.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.180.158.245, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "ackxmozBujdPHsq7wySnaAAAApU"]
[Sun Mar 29 22:05:15.274325 2026] [:error] [pid 23284:tid 23302] [client 52.180.158.245:63041] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "ackxm4zBujdPHsq7wySnbAAAApA"]
[Sun Mar 29 22:05:16.122471 2026] [:error] [pid 32257:tid 32333] [client 52.180.158.245:65375] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "ackxnCE3TArOFrUtgWo6lQAAAI8"]
[Sun Mar 29 22:05:16.704812 2026] [:error] [pid 23284:tid 23308] [client 52.180.158.245:64643] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "ackxnIzBujdPHsq7wySncAAAApY"]
[Sun Mar 29 22:05:17.974592 2026] [:error] [pid 32255:tid 32302] [client 52.180.158.245:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 29 22:05:18.351997 2026] [:error] [pid 32255:tid 32313] [client 52.180.158.245:64735] [client 52.180.158.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.180.158.245, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "ackxnmnfn-AtRoMbquzy6QAAAFY"]
[Sun Mar 29 22:05:18.548741 2026] [:error] [pid 32255:tid 32296] [client 52.180.158.245:64735] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/xp.php"] [unique_id "ackxnmnfn-AtRoMbquzy6gAAAEU"]
[Sun Mar 29 22:05:19.469608 2026] [:error] [pid 32255:tid 32298] [client 52.180.158.245:63663] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/xp.php"] [unique_id "ackxn2nfn-AtRoMbquzy6wAAAEc"]
[Sun Mar 29 22:05:20.755690 2026] [:error] [pid 23284:tid 23291] [client 52.180.158.245:65392] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/xp.php"] [unique_id "ackxoIzBujdPHsq7wySneAAAAoU"]
[Sun Mar 29 22:05:22.737559 2026] [:error] [pid 23284:tid 23296] [client 52.180.158.245:64699] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/xp.php"] [unique_id "ackxoozBujdPHsq7wySnfwAAAoo"]
[Sun Mar 29 22:05:24.166716 2026] [:error] [pid 23167:tid 23193] [client 52.180.158.245:65356] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "ackxpBIAHJCFaHff3_fDDQAAAdc"]
[Sun Mar 29 22:05:25.385086 2026] [:error] [pid 23284:tid 23300] [client 52.180.158.245:64705] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "ackxpYzBujdPHsq7wySniAAAAo4"]
[Sun Mar 29 22:05:26.021223 2026] [:error] [pid 23250:tid 23256] [client 52.180.158.245:64299] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "ackxppxrpj-dQjy1cvoG4AAAAkQ"]
[Sun Mar 29 22:05:26.585191 2026] [:error] [pid 32254:tid 32282] [client 52.180.158.245:65295] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "ackxpqug2IHuyGgCTn9d6AAAABI"]
[Sun Mar 29 22:05:27.093979 2026] [:error] [pid 23167:tid 23180] [client 52.180.158.245:64336] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "ackxpxIAHJCFaHff3_fDDwAAAco"]
[Sun Mar 29 22:05:27.737322 2026] [:error] [pid 32257:tid 32325] [client 52.180.158.245:63678] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "ackxpyE3TArOFrUtgWo6mwAAAIc"]
[Sun Mar 29 22:05:28.277840 2026] [:error] [pid 32255:tid 32303] [client 52.180.158.245:64746] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "ackxqGnfn-AtRoMbquzy-AAAAEw"]
[Sun Mar 29 22:05:28.915124 2026] [:error] [pid 23137:tid 23151] [client 52.180.158.245:64355] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "ackxqBaWQa7LdZ_qGFb8jwAAAYw"]
[Sun Mar 29 22:05:29.354120 2026] [:error] [pid 23284:tid 23286] [client 52.180.158.245:63639] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "ackxqYzBujdPHsq7wySnkgAAAoA"]
[Sun Mar 29 22:05:30.082287 2026] [:error] [pid 23168:tid 23212] [client 52.180.158.245:64732] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ackxqmP8p0yRL8ot_2-gBQAAAg8"]
[Sun Mar 29 22:05:31.152192 2026] [:error] [pid 23168:tid 23214] [client 52.180.158.245:65328] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "ackxq2P8p0yRL8ot_2-gBgAAAhE"]
[Sun Mar 29 22:05:31.879824 2026] [:error] [pid 32257:tid 32339] [client 52.180.158.245:64379] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/style.php"] [unique_id "ackxqyE3TArOFrUtgWo6owAAAJU"]
[Sun Mar 29 22:05:32.554976 2026] [:error] [pid 23284:tid 23310] [client 52.180.158.245:64350] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/style.php"] [unique_id "ackxrIzBujdPHsq7wySnmgAAApg"]
[Sun Mar 29 22:05:33.193311 2026] [:error] [pid 32257:tid 32330] [client 52.180.158.245:65286] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/style.php"] [unique_id "ackxrSE3TArOFrUtgWo6pgAAAIw"]
[Sun Mar 29 22:05:33.705027 2026] [:error] [pid 32257:tid 32335] [client 52.180.158.245:64709] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/js/style.php"] [unique_id "ackxrSE3TArOFrUtgWo6qAAAAJE"]
[Sun Mar 29 22:05:34.571819 2026] [:error] [pid 32257:tid 32342] [client 52.180.158.245:64744] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "ackxriE3TArOFrUtgWo6rgAAAJg"]
[Sun Mar 29 22:05:37.630147 2026] [:error] [pid 8818:tid 8840] [client 52.180.158.245:64687] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "ackxsSCDvotZNSF0FBrhxAAAAVI"]
[Sun Mar 29 22:05:38.138439 2026] [:error] [pid 32255:tid 32303] [client 52.180.158.245:64265] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "ackxsmnfn-AtRoMbquzzAAAAAEw"]
[Sun Mar 29 22:05:38.615204 2026] [:error] [pid 23168:tid 23201] [client 52.180.158.245:65321] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "ackxsmP8p0yRL8ot_2-gCgAAAgQ"]
[Sun Mar 29 22:05:39.064084 2026] [:error] [pid 32257:tid 32340] [client 52.180.158.245:64686] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ackxsyE3TArOFrUtgWo6tgAAAJY"]
[Sun Mar 29 22:05:39.869617 2026] [:error] [pid 32257:tid 32320] [client 52.180.158.245:65319] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ackxsyE3TArOFrUtgWo6wAAAAII"]
[Sun Mar 29 22:05:41.266330 2026] [:error] [pid 32255:tid 32294] [client 52.180.158.245:64368] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ackxtWnfn-AtRoMbquzzBwAAAEM"]
[Sun Mar 29 22:05:42.633643 2026] [:error] [pid 32255:tid 32306] [client 52.180.158.245:64310] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ackxtmnfn-AtRoMbquzzDAAAAE8"]
[Sun Mar 29 22:05:44.343288 2026] [:error] [pid 23167:tid 23184] [client 52.180.158.245:63634] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "ackxuBIAHJCFaHff3_fDIgAAAc4"]
[Sun Mar 29 22:05:45.506781 2026] [:error] [pid 32254:tid 32283] [client 52.180.158.245:63720] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "ackxuaug2IHuyGgCTn9d7QAAABM"]
[Sun Mar 29 22:05:46.673623 2026] [:error] [pid 8818:tid 8834] [client 52.180.158.245:64704] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/dropdown.php"] [unique_id "ackxuiCDvotZNSF0FBrhzAAAAUw"]
[Sun Mar 29 22:05:47.092111 2026] [:error] [pid 23284:tid 23286] [client 52.180.158.245:64295] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/dropdown.php"] [unique_id "ackxu4zBujdPHsq7wySnsgAAAoA"]
[Sun Mar 29 22:05:48.046548 2026] [:error] [pid 23167:tid 23173] [client 52.180.158.245:65338] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/dropdown.php"] [unique_id "ackxvBIAHJCFaHff3_fDKwAAAcM"]
[Sun Mar 29 22:05:48.754644 2026] [:error] [pid 32255:tid 32297] [client 52.180.158.245:65390] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/dropdown.php"] [unique_id "ackxvGnfn-AtRoMbquzzEQAAAEY"]
[Sun Mar 29 22:05:49.433065 2026] [:error] [pid 23137:tid 23140] [client 52.180.158.245:65366] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "ackxvRaWQa7LdZ_qGFb8lgAAAYE"]
[Sun Mar 29 22:05:49.965814 2026] [:error] [pid 23137:tid 23146] [client 52.180.158.245:64643] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "ackxvRaWQa7LdZ_qGFb8lwAAAYc"]
[Sun Mar 29 22:05:50.724404 2026] [:error] [pid 32255:tid 32302] [client 52.180.158.245:64698] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "ackxvmnfn-AtRoMbquzzFgAAAEs"]
[Sun Mar 29 22:05:51.380045 2026] [:error] [pid 32255:tid 32296] [client 52.180.158.245:64660] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "ackxv2nfn-AtRoMbquzzGAAAAEU"]
[Sun Mar 29 22:05:51.774092 2026] [:error] [pid 32255:tid 32314] [client 52.180.158.245:64737] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "ackxv2nfn-AtRoMbquzzGgAAAFc"]
[Sun Mar 29 22:05:52.251249 2026] [:error] [pid 23167:tid 23188] [client 52.180.158.245:63643] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "ackxwBIAHJCFaHff3_fDMQAAAdI"]
[Sun Mar 29 22:05:52.777355 2026] [:error] [pid 23167:tid 23189] [client 52.180.158.245:64666] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "ackxwBIAHJCFaHff3_fDMgAAAdM"]
[Sun Mar 29 22:05:53.259005 2026] [:error] [pid 32255:tid 32295] [client 52.180.158.245:64349] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "ackxwWnfn-AtRoMbquzzIQAAAEQ"]
[Sun Mar 29 22:05:53.734915 2026] [:error] [pid 23250:tid 23265] [client 52.180.158.245:64266] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "ackxwZxrpj-dQjy1cvoG5wAAAk0"]
[Sun Mar 29 22:05:54.531874 2026] [:error] [pid 32359:tid 32361] [client 52.180.158.245:64729] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "ackxwgMb8G3UzfQP3Wgw5wAAAMA"]
[Sun Mar 29 22:05:55.312064 2026] [:error] [pid 32257:tid 32338] [client 52.180.158.245:64651] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "ackxwyE3TArOFrUtgWo6yQAAAJQ"]
[Sun Mar 29 22:05:56.031687 2026] [:error] [pid 8818:tid 8837] [client 52.180.158.245:64658] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "ackxxCCDvotZNSF0FBrh2AAAAU8"]
[Sun Mar 29 22:05:56.770802 2026] [:error] [pid 8818:tid 8842] [client 52.180.158.245:64707] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "ackxxCCDvotZNSF0FBrh3AAAAVQ"]
[Sun Mar 29 22:05:57.518994 2026] [:error] [pid 23168:tid 23199] [client 52.180.158.245:65282] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admin.php"] [unique_id "ackxxWP8p0yRL8ot_2-gFAAAAgI"]
[Sun Mar 29 22:05:57.951311 2026] [:error] [pid 23167:tid 23193] [client 52.180.158.245:63685] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admin.php"] [unique_id "ackxxRIAHJCFaHff3_fDNAAAAdc"]
[Sun Mar 29 22:05:58.458769 2026] [:error] [pid 23250:tid 23260] [client 52.180.158.245:64766] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admin.php"] [unique_id "ackxxpxrpj-dQjy1cvoG6gAAAkg"]
[Sun Mar 29 22:05:58.924324 2026] [:error] [pid 32257:tid 32336] [client 52.180.158.245:65313] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-admin.php"] [unique_id "ackxxiE3TArOFrUtgWo6ygAAAJI"]
[Sun Mar 29 22:05:59.477637 2026] [:error] [pid 23168:tid 23198] [client 52.180.158.245:65287] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/DaoZM.php"] [unique_id "ackxx2P8p0yRL8ot_2-gGAAAAgE"]
[Sun Mar 29 22:06:00.092882 2026] [:error] [pid 32257:tid 32327] [client 52.180.158.245:62381] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/DaoZM.php"] [unique_id "ackxyCE3TArOFrUtgWo60AAAAIk"]
[Sun Mar 29 22:06:00.714156 2026] [:error] [pid 32257:tid 32323] [client 52.180.158.245:64680] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/DaoZM.php"] [unique_id "ackxyCE3TArOFrUtgWo61QAAAIU"]
[Sun Mar 29 22:06:01.168380 2026] [:error] [pid 23284:tid 23304] [client 52.180.158.245:63738] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/DaoZM.php"] [unique_id "ackxyYzBujdPHsq7wySntwAAApI"]
[Sun Mar 29 22:06:01.763872 2026] [:error] [pid 32359:tid 32378] [client 52.180.158.245:64341] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "ackxyQMb8G3UzfQP3Wgw7wAAANE"]
[Sun Mar 29 22:06:02.175295 2026] [:error] [pid 8818:tid 8834] [client 52.180.158.245:64702] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "ackxyiCDvotZNSF0FBrh3wAAAUw"]
[Sun Mar 29 22:06:02.760754 2026] [:error] [pid 23168:tid 23212] [client 52.180.158.245:63734] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "ackxymP8p0yRL8ot_2-gGwAAAg8"]
[Sun Mar 29 22:06:03.269566 2026] [:error] [pid 23168:tid 23214] [client 52.180.158.245:63051] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "ackxy2P8p0yRL8ot_2-gHAAAAhE"]
[Sun Mar 29 22:06:04.527020 2026] [:error] [pid 32257:tid 32326] [client 52.180.158.245:64261] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "ackxzCE3TArOFrUtgWo63QAAAIg"]
[Sun Mar 29 22:06:05.171941 2026] [:error] [pid 32257:tid 32332] [client 52.180.158.245:64767] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "ackxzSE3TArOFrUtgWo63gAAAI4"]
[Sun Mar 29 22:06:05.741673 2026] [:error] [pid 23284:tid 23306] [client 52.180.158.245:64346] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "ackxzYzBujdPHsq7wySnuQAAApQ"]
[Sun Mar 29 22:06:06.193537 2026] [:error] [pid 32255:tid 32293] [client 52.180.158.245:64713] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "ackxzmnfn-AtRoMbquzzNgAAAEI"]
[Sun Mar 29 22:06:06.791749 2026] [:error] [pid 23250:tid 23270] [client 52.180.158.245:65327] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "ackxzpxrpj-dQjy1cvoG8AAAAlI"]
[Sun Mar 29 22:06:07.219330 2026] [:error] [pid 23284:tid 23297] [client 52.180.158.245:63618] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "ackxz4zBujdPHsq7wySnvgAAAos"]
[Sun Mar 29 22:06:07.613807 2026] [:error] [pid 23284:tid 23303] [client 52.180.158.245:64742] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "ackxz4zBujdPHsq7wySnvwAAApE"]
[Sun Mar 29 22:06:08.098651 2026] [:error] [pid 23284:tid 23309] [client 52.180.158.245:65322] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "ackx0IzBujdPHsq7wySnwQAAApc"]
[Sun Mar 29 22:06:08.812184 2026] [:error] [pid 23284:tid 23310] [client 52.180.158.245:65395] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "ackx0IzBujdPHsq7wySnyQAAApg"]
[Sun Mar 29 22:06:09.795292 2026] [:error] [pid 23284:tid 23303] [client 52.180.158.245:64757] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "ackx0YzBujdPHsq7wySn0AAAApE"]
[Sun Mar 29 22:06:10.609865 2026] [:error] [pid 23137:tid 23156] [client 52.180.158.245:64668] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "ackx0haWQa7LdZ_qGFb8nAAAAZE"]
[Sun Mar 29 22:06:11.194897 2026] [:error] [pid 8818:tid 8823] [client 52.180.158.245:64345] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "ackx0yCDvotZNSF0FBrh5wAAAUE"]
[Sun Mar 29 22:06:11.898437 2026] [:error] [pid 23284:tid 23291] [client 52.180.158.245:64758] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "ackx04zBujdPHsq7wySn0gAAAoU"]
[Sun Mar 29 22:06:12.568004 2026] [:error] [pid 32254:tid 32276] [client 52.180.158.245:63624] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "ackx1Kug2IHuyGgCTn9d-gAAAAw"]
[Sun Mar 29 22:06:13.021721 2026] [:error] [pid 32257:tid 32329] [client 52.180.158.245:65358] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "ackx1SE3TArOFrUtgWo67gAAAIs"]
[Sun Mar 29 22:06:13.472707 2026] [:error] [pid 23284:tid 23303] [client 52.180.158.245:64706] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "ackx1YzBujdPHsq7wySn2AAAApE"]
[Sun Mar 29 22:06:14.489683 2026] [:error] [pid 32257:tid 32318] [client 52.180.158.245:63661] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "ackx1iE3TArOFrUtgWo6-QAAAIA"]
[Sun Mar 29 22:06:14.904209 2026] [:error] [pid 23167:tid 23192] [client 52.180.158.245:64697] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "ackx1hIAHJCFaHff3_fDNgAAAdY"]
[Sun Mar 29 22:06:15.370630 2026] [:error] [pid 32257:tid 32326] [client 52.180.158.245:65283] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "ackx1yE3TArOFrUtgWo7AAAAAIg"]
[Sun Mar 29 22:06:15.836015 2026] [:error] [pid 32257:tid 32334] [client 52.180.158.245:64316] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin.php"] [unique_id "ackx1yE3TArOFrUtgWo7BgAAAJA"]
[Sun Mar 29 22:06:16.363417 2026] [:error] [pid 32257:tid 32326] [client 52.180.158.245:64363] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "ackx2CE3TArOFrUtgWo7DAAAAIg"]
[Sun Mar 29 22:06:16.785341 2026] [:error] [pid 23168:tid 23212] [client 52.180.158.245:62406] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Assets/edit.php"] [unique_id "ackx2GP8p0yRL8ot_2-gNAAAAg8"]
[Sun Mar 29 22:06:17.219397 2026] [:error] [pid 32255:tid 32309] [client 52.180.158.245:64338] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Assets/edit.php"] [unique_id "ackx2Wnfn-AtRoMbquzzSwAAAFI"]
[Sun Mar 29 22:06:17.669624 2026] [:error] [pid 23167:tid 23180] [client 52.180.158.245:64322] [client 52.180.158.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Assets/edit.php"] [unique_id "ackx2RIAHJCFaHff3_fDOAAAAco"]
[Sun Mar 29 22:06:19.528291 2026] [:error] [pid 23284:tid 23301] [client 52.180.158.245:64688] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "ackx24zBujdPHsq7wySn6wAAAo8"]
[Sun Mar 29 22:06:20.370346 2026] [:error] [pid 23284:tid 23286] [client 52.180.158.245:64714] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ackx3IzBujdPHsq7wySn9QAAAoA"]
[Sun Mar 29 22:06:21.415856 2026] [:error] [pid 23168:tid 23203] [client 52.180.158.245:61770] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Sun Mar 29 22:06:21.614744 2026] [:error] [pid 23168:tid 23210] [client 52.180.158.245:61770] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 29 22:06:21.811750 2026] [:error] [pid 23168:tid 23216] [client 52.180.158.245:61770] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "ackx3WP8p0yRL8ot_2-gPAAAAhM"]
[Sun Mar 29 22:06:22.316413 2026] [:error] [pid 32257:tid 32340] [client 52.180.158.245:65369] [client 52.180.158.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "ackx3iE3TArOFrUtgWo7EwAAAJY"]
[Mon Mar 30 01:50:15.240704 2026] [:error] [pid 8818:tid 8827] [client 31.171.130.56:29543] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 30 01:51:46.035685 2026] [:error] [pid 23250:tid 23260] [client 31.171.130.66:34215] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Mar 30 01:59:42.816977 2026] [:error] [pid 23168:tid 23211] [client 103.75.160.130:39257] [client 103.75.160.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.160.130, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aclojmP8p0yRL8ot_2_3PQAAAg4"]
[Mon Mar 30 01:59:42.821600 2026] [:error] [pid 23168:tid 23211] [client 103.75.160.130:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 05:35:38.250943 2026] [:error] [pid 55884:tid 55969] [client 5.38.1.213:56084] [client 5.38.1.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.38.1.213, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acmbKjjuYLVkve3VbhyZ8AAAARA"]
[Mon Mar 30 05:35:38.255625 2026] [:error] [pid 55884:tid 55969] [client 5.38.1.213:56084] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 07:08:19.158312 2026] [:error] [pid 14110:tid 14134] [client 192.141.174.39:47896] [client 192.141.174.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.141.174.39, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acmw4-Hp_fSDxBlHFX9lrAAAAVI"]
[Mon Mar 30 07:08:19.165210 2026] [:error] [pid 14110:tid 14134] [client 192.141.174.39:47896] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 07:29:00.889930 2026] [:error] [pid 4040:tid 4128] [client 173.239.218.208:63495] [client 173.239.218.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acm1vAxlbJV8kpOpFvaWRwAAAJQ"]
[Mon Mar 30 09:19:59.015648 2026] [:error] [pid 35248:tid 35268] [client 149.102.93.227:52331] [client 149.102.93.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.102.93.227, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acnPv73igMCgAQPFS_9spAAAAE4"]
[Mon Mar 30 09:19:59.020307 2026] [:error] [pid 35248:tid 35268] [client 149.102.93.227:52331] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 11:46:10.509756 2026] [:error] [pid 35343:tid 35365] [client 152.58.34.46:50463] [client 152.58.34.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.34.46, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acnyAqP5HurqmbvwN-JysAAAABQ"]
[Mon Mar 30 11:46:10.514449 2026] [:error] [pid 35343:tid 35365] [client 152.58.34.46:50463] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 12:03:23.896945 2026] [:error] [pid 64743:tid 64767] [client 91.73.42.209:36884] [client 91.73.42.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.73.42.209, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acn2CyzmpVL6Ubzil4hhMQAAAVY"]
[Mon Mar 30 12:03:23.904646 2026] [:error] [pid 64743:tid 64767] [client 91.73.42.209:36884] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 12:32:05.378611 2026] [:error] [pid 35248:tid 35278] [client 20.213.160.162:1776] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xb3igMCgAQPFS_80ZAAAAFg"]
[Mon Mar 30 12:32:05.447169 2026] [:error] [pid 35248:tid 35256] [client 20.213.160.162:1764] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xb3igMCgAQPFS_80ewAAAEI"]
[Mon Mar 30 12:32:05.544095 2026] [:error] [pid 35250:tid 35333] [client 20.213.160.162:1485] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xYaKM1MR6zcp2YPBkAAAANY"]
[Mon Mar 30 12:32:05.611083 2026] [:error] [pid 35248:tid 35255] [client 20.213.160.162:1784] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xb3igMCgAQPFS_80uwAAAEE"]
[Mon Mar 30 13:43:54.719948 2026] [:error] [pid 35249:tid 35307] [client 104.168.126.136:9394] [client 104.168.126.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "acoNmiqCKiTq85d6rgAxSgAAAJc"]
[Mon Mar 30 14:38:08.839307 2026] [:error] [pid 35343:tid 35366] [client 182.188.120.97:50256] [client 182.188.120.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.188.120.97, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acoaUKP5HurqmbvwN-LO3AAAABU"]
[Mon Mar 30 14:38:08.843890 2026] [:error] [pid 35343:tid 35366] [client 182.188.120.97:50256] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 17:49:43.570829 2026] [:error] [pid 41941:tid 41958] [client 72.167.50.60:51211] [client 72.167.50.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "acpHNyB2g7BNCXGBOJNQQgAAAQ8"]
[Mon Mar 30 19:49:23.693860 2026] [:error] [pid 11947:tid 11952] [client 122.177.245.88:15234] [client 122.177.245.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.177.245.88, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acpjQzSVtzzXIgk-FglbdAAAAgM"]
[Mon Mar 30 19:49:23.698225 2026] [:error] [pid 11947:tid 11952] [client 122.177.245.88:15234] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 30 19:54:03.677503 2026] [:error] [pid 35250:tid 35316] [client 152.59.232.37:54290] [client 152.59.232.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.232.37, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acpkW4aKM1MR6zcp2YNsYAAAAMU"]
[Mon Mar 30 19:54:03.691563 2026] [:error] [pid 35250:tid 35316] [client 152.59.232.37:54290] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 03:03:24.663843 2026] [:error] [pid 39123:tid 39146] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Tue Mar 31 03:03:24.901192 2026] [:error] [pid 39123:tid 39125] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/sw.php
[Tue Mar 31 03:03:25.139579 2026] [:error] [pid 39123:tid 39147] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/fsgdjkl.php
[Tue Mar 31 03:03:25.377770 2026] [:error] [pid 39123:tid 39133] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/ahutr.php
[Tue Mar 31 03:03:25.614942 2026] [:error] [pid 39123:tid 39138] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Tue Mar 31 03:03:25.853997 2026] [:error] [pid 39123:tid 39132] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Tue Mar 31 03:03:26.092001 2026] [:error] [pid 39123:tid 39131] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/abouta.php
[Tue Mar 31 03:03:26.336141 2026] [:error] [pid 39123:tid 39148] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/zfe.php
[Tue Mar 31 03:03:26.575978 2026] [:error] [pid 39123:tid 39134] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Tue Mar 31 03:03:26.813374 2026] [:error] [pid 39123:tid 39144] [client 20.208.32.234:2830] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Mar 31 03:03:27.055853 2026] [:error] [pid 39123:tid 39146] [client 20.208.32.234:2830] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asudo.php"] [unique_id "acrI_yobgVY20PMQKVu5WgAAARU"]
[Tue Mar 31 03:03:27.527790 2026] [:error] [pid 39123:tid 39129] [client 20.208.32.234:37262] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asudo.php"] [unique_id "acrI_yobgVY20PMQKVu5WwAAAQQ"]
[Tue Mar 31 03:03:28.024887 2026] [:error] [pid 39123:tid 39126] [client 20.208.32.234:49176] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asudo.php"] [unique_id "acrJACobgVY20PMQKVu5XgAAAQE"]
[Tue Mar 31 03:03:28.505132 2026] [:error] [pid 36672:tid 36815] [client 20.208.32.234:43317] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asudo.php"] [unique_id "acrJALKHDzEfeL3XiLplZwAAAEg"]
[Tue Mar 31 03:03:29.155492 2026] [:error] [pid 36688:tid 36857] [client 20.208.32.234:39952] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acrJAZIe8NBGKiiCIcI4QQAAAJY"]
[Tue Mar 31 03:03:29.637388 2026] [:error] [pid 36688:tid 36856] [client 20.208.32.234:39939] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acrJAZIe8NBGKiiCIcI4QgAAAJU"]
[Tue Mar 31 03:03:30.120859 2026] [:error] [pid 36688:tid 36848] [client 20.208.32.234:64056] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acrJApIe8NBGKiiCIcI4RQAAAI0"]
[Tue Mar 31 03:03:30.594156 2026] [:error] [pid 36706:tid 36870] [client 20.208.32.234:39495] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "acrJAra-eBLL1E34-UUleQAAAMg"]
[Tue Mar 31 03:03:31.153697 2026] [:error] [pid 39123:tid 39136] [client 20.208.32.234:43289] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "acrJAyobgVY20PMQKVu5YwAAAQs"]
[Tue Mar 31 03:03:31.657844 2026] [:error] [pid 36688:tid 36835] [client 20.208.32.234:50484] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "acrJA5Ie8NBGKiiCIcI4SAAAAIA"]
[Tue Mar 31 03:03:32.130035 2026] [:error] [pid 39123:tid 39143] [client 20.208.32.234:37265] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "acrJBCobgVY20PMQKVu5ZwAAARI"]
[Tue Mar 31 03:03:32.640599 2026] [:error] [pid 36939:tid 36964] [client 20.208.32.234:50476] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "acrJBMRDKH225Jeq1jeEgQAAABc"]
[Tue Mar 31 03:03:33.123432 2026] [:error] [pid 36706:tid 36869] [client 20.208.32.234:2859] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "acrJBba-eBLL1E34-UUlfwAAAMc"]
[Tue Mar 31 03:03:33.608153 2026] [:error] [pid 36706:tid 36879] [client 20.208.32.234:2278] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "acrJBba-eBLL1E34-UUlgAAAANE"]
[Tue Mar 31 03:03:34.150818 2026] [:error] [pid 36939:tid 36957] [client 20.208.32.234:39509] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdkfu.php"] [unique_id "acrJBsRDKH225Jeq1jeEhAAAABA"]
[Tue Mar 31 03:03:34.628416 2026] [:error] [pid 36706:tid 36868] [client 20.208.32.234:64024] [client 20.208.32.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdkfu.php"] [unique_id "acrJBra-eBLL1E34-UUlhwAAAMY"]
[Tue Mar 31 05:01:37.572887 2026] [:error] [pid 1224:tid 1247] [client 158.173.189.114:37940] [client 158.173.189.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.189.114, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acrkscXGPQPzIHnCuJgQEQAAARU"]
[Tue Mar 31 05:01:37.579717 2026] [:error] [pid 1224:tid 1247] [client 158.173.189.114:37940] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 05:17:52.924078 2026] [:error] [pid 18332:tid 18361] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Tue Mar 31 05:17:53.162678 2026] [:error] [pid 18332:tid 18355] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/sw.php
[Tue Mar 31 05:17:53.400623 2026] [:error] [pid 18332:tid 18373] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/fsgdjkl.php
[Tue Mar 31 05:17:53.637914 2026] [:error] [pid 18332:tid 18372] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/ahutr.php
[Tue Mar 31 05:17:53.875145 2026] [:error] [pid 18332:tid 18371] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Tue Mar 31 05:17:54.114669 2026] [:error] [pid 18332:tid 18352] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Tue Mar 31 05:17:54.351860 2026] [:error] [pid 18332:tid 18357] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/abouta.php
[Tue Mar 31 05:17:54.590115 2026] [:error] [pid 18332:tid 18364] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/zfe.php
[Tue Mar 31 05:17:54.827655 2026] [:error] [pid 18332:tid 18363] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Tue Mar 31 05:17:55.066931 2026] [:error] [pid 18332:tid 18353] [client 20.19.191.237:24604] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Mar 31 05:17:55.301503 2026] [:error] [pid 18332:tid 18348] [client 20.19.191.237:24604] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asudo.php"] [unique_id "acrog74KXr1F9raS5GSaLQAAAAA"]
[Tue Mar 31 05:17:55.771755 2026] [:error] [pid 18439:tid 18452] [client 20.19.191.237:24522] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-temp.php"] [unique_id "acrogy-R9nOaA8Xqs7jLZAAAAME"]
[Tue Mar 31 05:17:56.241360 2026] [:error] [pid 18333:tid 18400] [client 20.19.191.237:24512] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-temp.php"] [unique_id "acrohESx2C5hLR0-8dLoIwAAAFU"]
[Tue Mar 31 05:17:56.710186 2026] [:error] [pid 1224:tid 1247] [client 20.19.191.237:24634] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "acrohMXGPQPzIHnCuJgkgAAAARU"]
[Tue Mar 31 05:17:57.182197 2026] [:error] [pid 18334:tid 18413] [client 20.19.191.237:24628] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "acrohXqQrXLbk1cg3mhETQAAAIc"]
[Tue Mar 31 05:17:57.651942 2026] [:error] [pid 18439:tid 18456] [client 20.19.191.237:24515] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "acrohS-R9nOaA8Xqs7jLawAAAMU"]
[Tue Mar 31 05:17:58.122266 2026] [:error] [pid 18332:tid 18349] [client 20.19.191.237:24601] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "acrohr4KXr1F9raS5GSaLwAAAAE"]
[Tue Mar 31 05:17:58.591634 2026] [:error] [pid 18334:tid 18425] [client 20.19.191.237:24594] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "acrohnqQrXLbk1cg3mhEUQAAAJM"]
[Tue Mar 31 05:17:59.105805 2026] [:error] [pid 18334:tid 18428] [client 20.19.191.237:24587] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zlnckdxn.php"] [unique_id "acroh3qQrXLbk1cg3mhEVAAAAJY"]
[Tue Mar 31 05:17:59.576730 2026] [:error] [pid 18439:tid 18452] [client 20.19.191.237:24530] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zlnckdxn.php"] [unique_id "acrohy-R9nOaA8Xqs7jLbwAAAME"]
[Tue Mar 31 05:18:00.049113 2026] [:error] [pid 18439:tid 18474] [client 20.19.191.237:24513] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zlnckdxn.php"] [unique_id "acroiC-R9nOaA8Xqs7jLcgAAANc"]
[Tue Mar 31 05:18:00.538039 2026] [:error] [pid 18439:tid 18470] [client 20.19.191.237:24578] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acroiC-R9nOaA8Xqs7jLdgAAANM"]
[Tue Mar 31 05:18:01.009955 2026] [:error] [pid 18439:tid 18460] [client 20.19.191.237:24613] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acroiS-R9nOaA8Xqs7jLeAAAAMk"]
[Tue Mar 31 05:18:01.481520 2026] [:error] [pid 1224:tid 1229] [client 20.19.191.237:24605] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acroicXGPQPzIHnCuJgkiwAAAQM"]
[Tue Mar 31 05:18:01.954582 2026] [:error] [pid 18334:tid 18428] [client 20.19.191.237:24600] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t00l.php"] [unique_id "acroiXqQrXLbk1cg3mhEXgAAAJY"]
[Tue Mar 31 05:18:02.470455 2026] [:error] [pid 18334:tid 18414] [client 20.19.191.237:24589] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "acroinqQrXLbk1cg3mhEYgAAAIg"]
[Tue Mar 31 05:18:02.941769 2026] [:error] [pid 18333:tid 18390] [client 20.19.191.237:24527] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "acroikSx2C5hLR0-8dLoKQAAAEs"]
[Tue Mar 31 05:18:03.428700 2026] [:error] [pid 18333:tid 18388] [client 20.19.191.237:24532] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "acroi0Sx2C5hLR0-8dLoLAAAAEk"]
[Tue Mar 31 05:18:03.898176 2026] [:error] [pid 18439:tid 18458] [client 20.19.191.237:24631] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "acroiy-R9nOaA8Xqs7jLfAAAAMc"]
[Tue Mar 31 05:18:04.368010 2026] [:error] [pid 18439:tid 18470] [client 20.19.191.237:24611] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "acrojC-R9nOaA8Xqs7jLfQAAANM"]
[Tue Mar 31 05:18:04.838952 2026] [:error] [pid 18333:tid 18401] [client 20.19.191.237:24528] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "acrojESx2C5hLR0-8dLoNQAAAFY"]
[Tue Mar 31 05:18:05.321600 2026] [:error] [pid 18333:tid 18383] [client 20.19.191.237:24523] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xhejulap.php"] [unique_id "acrojUSx2C5hLR0-8dLoOAAAAEQ"]
[Tue Mar 31 05:18:05.793885 2026] [:error] [pid 18439:tid 18451] [client 20.19.191.237:24619] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xhejulap.php"] [unique_id "acrojS-R9nOaA8Xqs7jLggAAAMA"]
[Tue Mar 31 06:20:55.414618 2026] [:error] [pid 18334:tid 18426] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Tue Mar 31 06:20:55.671153 2026] [:error] [pid 18334:tid 18428] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Tue Mar 31 06:20:55.922031 2026] [:error] [pid 18334:tid 18410] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Tue Mar 31 06:20:56.171096 2026] [:error] [pid 18334:tid 18421] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Tue Mar 31 06:20:57.764474 2026] [:error] [pid 18334:tid 18421] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/wxfyf.php
[Tue Mar 31 06:20:58.014966 2026] [:error] [pid 18334:tid 18419] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Tue Mar 31 06:20:58.265629 2026] [:error] [pid 18334:tid 18424] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Tue Mar 31 06:20:58.518746 2026] [:error] [pid 18334:tid 18429] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Tue Mar 31 06:20:58.774653 2026] [:error] [pid 18334:tid 18420] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Tue Mar 31 06:20:59.025400 2026] [:error] [pid 18334:tid 18430] [client 20.107.195.165:26722] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Tue Mar 31 06:20:59.272676 2026] [:error] [pid 18334:tid 18415] [client 20.107.195.165:26722] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "acr3S3qQrXLbk1cg3mhZxwAAAIk"]
[Tue Mar 31 06:21:00.022739 2026] [:error] [pid 18333:tid 18394] [client 20.107.195.165:26735] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "acr3TESx2C5hLR0-8dIJZAAAAE8"]
[Tue Mar 31 06:21:00.573399 2026] [:error] [pid 11907:tid 11912] [client 20.107.195.165:65245] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "acr3TMcoKGLZkBF4Ym1YXAAAAgI"]
[Tue Mar 31 06:21:01.264941 2026] [:error] [pid 11822:tid 11840] [client 20.107.195.165:26716] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "acr3TSLLrL4a3YEM2I0LmgAAAZA"]
[Tue Mar 31 06:21:01.938432 2026] [:error] [pid 11786:tid 11804] [client 20.107.195.165:12567] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acr3TU-ANHwuqDZumRDaVQAAAVA"]
[Tue Mar 31 06:21:02.559937 2026] [:error] [pid 18333:tid 18401] [client 20.107.195.165:26731] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acr3TkSx2C5hLR0-8dIJaQAAAFY"]
[Tue Mar 31 06:21:03.331310 2026] [:error] [pid 18333:tid 18382] [client 20.107.195.165:26701] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acr3T0Sx2C5hLR0-8dIJbQAAAEM"]
[Tue Mar 31 06:21:04.314161 2026] [:error] [pid 18439:tid 18455] [client 20.107.195.165:65236] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "acr3UC-R9nOaA8Xqs7joGAAAAMQ"]
[Tue Mar 31 06:21:04.963944 2026] [:error] [pid 18439:tid 18474] [client 20.107.195.165:12585] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acr3UC-R9nOaA8Xqs7joGwAAANc"]
[Tue Mar 31 06:21:05.601957 2026] [:error] [pid 18334:tid 18427] [client 20.107.195.165:65274] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acr3UXqQrXLbk1cg3mhZ1QAAAJU"]
[Tue Mar 31 06:21:06.704859 2026] [:error] [pid 18333:tid 18391] [client 20.107.195.165:26688] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acr3UkSx2C5hLR0-8dIJgQAAAEw"]
[Tue Mar 31 06:21:08.784382 2026] [:error] [pid 18439:tid 18473] [client 20.107.195.165:12555] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "acr3VC-R9nOaA8Xqs7joMgAAANY"]
[Tue Mar 31 06:21:10.334048 2026] [:error] [pid 11869:tid 11883] [client 20.107.195.165:12588] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acr3VhvAVplg9I6KoIIm3AAAAcs"]
[Tue Mar 31 06:21:13.296361 2026] [:error] [pid 18333:tid 18380] [client 20.107.195.165:12594] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acr3WUSx2C5hLR0-8dIJmAAAAEE"]
[Tue Mar 31 06:21:15.231610 2026] [:error] [pid 18439:tid 18472] [client 20.107.195.165:65246] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acr3Wy-R9nOaA8Xqs7joSAAAANU"]
[Tue Mar 31 06:21:16.463427 2026] [:error] [pid 11907:tid 11913] [client 20.107.195.165:12562] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asasx.php"] [unique_id "acr3XMcoKGLZkBF4Ym1YbQAAAgM"]
[Tue Mar 31 06:21:17.029929 2026] [:error] [pid 18439:tid 18452] [client 20.107.195.165:26706] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acr3XS-R9nOaA8Xqs7joVAAAAME"]
[Tue Mar 31 06:21:17.631487 2026] [:error] [pid 18439:tid 18463] [client 20.107.195.165:12581] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acr3XS-R9nOaA8Xqs7joXAAAAMw"]
[Tue Mar 31 06:21:18.210621 2026] [:error] [pid 18334:tid 18410] [client 20.107.195.165:26714] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acr3XnqQrXLbk1cg3mhZ-AAAAIQ"]
[Tue Mar 31 06:21:19.006155 2026] [:error] [pid 18333:tid 18389] [client 20.107.195.165:65240] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "acr3X0Sx2C5hLR0-8dIJtgAAAEo"]
[Tue Mar 31 06:21:19.589009 2026] [:error] [pid 18333:tid 18380] [client 20.107.195.165:12550] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acr3X0Sx2C5hLR0-8dIJvAAAAEE"]
[Tue Mar 31 06:21:20.363123 2026] [:error] [pid 18333:tid 18397] [client 20.107.195.165:26735] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acr3YESx2C5hLR0-8dIJwgAAAFI"]
[Tue Mar 31 06:21:21.261327 2026] [:error] [pid 18333:tid 18382] [client 20.107.195.165:26724] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acr3YUSx2C5hLR0-8dIJxwAAAEM"]
[Tue Mar 31 06:21:22.184813 2026] [:error] [pid 18333:tid 18398] [client 20.107.195.165:65227] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "acr3YkSx2C5hLR0-8dIJzAAAAFM"]
[Tue Mar 31 06:21:23.070578 2026] [:error] [pid 18333:tid 18391] [client 20.107.195.165:65251] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sale.php"] [unique_id "acr3Y0Sx2C5hLR0-8dIJ0wAAAEw"]
[Tue Mar 31 06:21:23.868046 2026] [:error] [pid 1224:tid 1228] [client 20.107.195.165:12601] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sale.php"] [unique_id "acr3Y8XGPQPzIHnCuJhEvgAAAQI"]
[Tue Mar 31 06:21:24.801710 2026] [:error] [pid 18439:tid 18471] [client 20.107.195.165:65260] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sale.php"] [unique_id "acr3ZC-R9nOaA8Xqs7joiwAAANQ"]
[Tue Mar 31 06:21:26.221809 2026] [:error] [pid 11822:tid 11846] [client 20.107.195.165:12600] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sale.php"] [unique_id "acr3ZiLLrL4a3YEM2I0LwAAAAZY"]
[Tue Mar 31 06:21:27.350402 2026] [:error] [pid 18334:tid 18423] [client 20.107.195.165:12577] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acr3Z3qQrXLbk1cg3mhaBwAAAJE"]
[Tue Mar 31 06:21:28.119672 2026] [:error] [pid 18334:tid 18430] [client 20.107.195.165:65247] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acr3aHqQrXLbk1cg3mhaDQAAAJg"]
[Tue Mar 31 06:21:29.622470 2026] [:error] [pid 1224:tid 1248] [client 20.107.195.165:65272] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acr3acXGPQPzIHnCuJhExAAAARY"]
[Tue Mar 31 06:21:31.631119 2026] [:error] [pid 18439:tid 18460] [client 20.107.195.165:12566] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "acr3ay-R9nOaA8Xqs7joygAAAMk"]
[Tue Mar 31 06:21:33.705284 2026] [:error] [pid 11907:tid 11923] [client 20.107.195.165:65226] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2ksm17n.php"] [unique_id "acr3bccoKGLZkBF4Ym1YdQAAAg0"]
[Tue Mar 31 06:21:36.150521 2026] [:error] [pid 11786:tid 11803] [client 20.107.195.165:12571] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2ksm17n.php"] [unique_id "acr3cE-ANHwuqDZumRDaXQAAAU8"]
[Tue Mar 31 06:21:38.548962 2026] [:error] [pid 1224:tid 1234] [client 20.107.195.165:12593] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2ksm17n.php"] [unique_id "acr3csXGPQPzIHnCuJhE0gAAAQg"]
[Tue Mar 31 06:21:39.399577 2026] [:error] [pid 11822:tid 11834] [client 20.107.195.165:65248] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2ksm17n.php"] [unique_id "acr3cyLLrL4a3YEM2I0LzwAAAYo"]
[Tue Mar 31 06:21:40.101743 2026] [:error] [pid 11907:tid 11920] [client 20.107.195.165:65225] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acr3dMcoKGLZkBF4Ym1YfQAAAgo"]
[Tue Mar 31 06:21:40.807488 2026] [:error] [pid 11907:tid 11930] [client 20.107.195.165:12557] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acr3dMcoKGLZkBF4Ym1YfgAAAhQ"]
[Tue Mar 31 06:21:41.691721 2026] [:error] [pid 11786:tid 11802] [client 20.107.195.165:12580] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acr3dU-ANHwuqDZumRDaYwAAAU4"]
[Tue Mar 31 06:21:42.661106 2026] [:error] [pid 11907:tid 11923] [client 20.107.195.165:26699] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "acr3dscoKGLZkBF4Ym1YggAAAg0"]
[Tue Mar 31 06:21:43.528656 2026] [:error] [pid 18439:tid 18467] [client 20.107.195.165:12564] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hots.php"] [unique_id "acr3dy-R9nOaA8Xqs7jpGwAAANA"]
[Tue Mar 31 06:21:44.461946 2026] [:error] [pid 18439:tid 18475] [client 20.107.195.165:19854] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hots.php"] [unique_id "acr3eC-R9nOaA8Xqs7jpJgAAANg"]
[Tue Mar 31 06:21:45.180963 2026] [:error] [pid 18334:tid 18423] [client 20.107.195.165:65268] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hots.php"] [unique_id "acr3eXqQrXLbk1cg3mhadQAAAJE"]
[Tue Mar 31 06:21:45.936749 2026] [:error] [pid 18439:tid 18456] [client 20.107.195.165:19901] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hots.php"] [unique_id "acr3eS-R9nOaA8Xqs7jpMwAAAMU"]
[Tue Mar 31 06:21:46.656454 2026] [:error] [pid 11907:tid 11921] [client 20.107.195.165:12605] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "acr3escoKGLZkBF4Ym1YiAAAAgs"]
[Tue Mar 31 06:21:47.541919 2026] [:error] [pid 18439:tid 18467] [client 20.107.195.165:12556] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "acr3ey-R9nOaA8Xqs7jpOwAAANA"]
[Tue Mar 31 06:21:48.329857 2026] [:error] [pid 18333:tid 18394] [client 20.107.195.165:24439] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "acr3fESx2C5hLR0-8dIKcwAAAE8"]
[Tue Mar 31 06:21:49.318083 2026] [:error] [pid 18333:tid 18382] [client 20.107.195.165:12583] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "acr3fUSx2C5hLR0-8dIKfQAAAEM"]
[Tue Mar 31 06:21:50.094905 2026] [:error] [pid 18334:tid 18426] [client 20.107.195.165:65219] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acr3fnqQrXLbk1cg3mhakwAAAJQ"]
[Tue Mar 31 06:21:50.871284 2026] [:error] [pid 18334:tid 18422] [client 20.107.195.165:65255] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acr3fnqQrXLbk1cg3mhalwAAAJA"]
[Tue Mar 31 06:21:51.735729 2026] [:error] [pid 18439:tid 18473] [client 20.107.195.165:65222] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acr3fy-R9nOaA8Xqs7jpQwAAANY"]
[Tue Mar 31 06:21:52.569060 2026] [:error] [pid 18334:tid 18416] [client 20.107.195.165:12584] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acr3gHqQrXLbk1cg3mhaogAAAIo"]
[Tue Mar 31 06:21:53.332177 2026] [:error] [pid 18333:tid 18389] [client 20.107.195.165:19848] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "acr3gUSx2C5hLR0-8dIKiQAAAEo"]
[Tue Mar 31 06:21:54.199588 2026] [:error] [pid 11822:tid 11833] [client 20.107.195.165:12546] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "acr3giLLrL4a3YEM2I0L9AAAAYk"]
[Tue Mar 31 06:21:54.762781 2026] [:error] [pid 18439:tid 18458] [client 20.107.195.165:65237] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "acr3gi-R9nOaA8Xqs7jpUgAAAMc"]
[Tue Mar 31 06:21:55.543692 2026] [:error] [pid 18334:tid 18425] [client 20.107.195.165:12582] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "acr3g3qQrXLbk1cg3mhasAAAAJM"]
[Tue Mar 31 06:21:56.284754 2026] [:error] [pid 11822:tid 11842] [client 20.107.195.165:26695] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acr3hCLLrL4a3YEM2I0L-gAAAZI"]
[Tue Mar 31 06:21:57.046566 2026] [:error] [pid 18333:tid 18393] [client 20.107.195.165:65273] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acr3hUSx2C5hLR0-8dIKngAAAE4"]
[Tue Mar 31 06:21:57.858974 2026] [:error] [pid 18333:tid 18390] [client 20.107.195.165:65258] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acr3hUSx2C5hLR0-8dIKpQAAAEs"]
[Tue Mar 31 06:21:58.463439 2026] [:error] [pid 18333:tid 18387] [client 20.107.195.165:26708] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acr3hkSx2C5hLR0-8dIKqwAAAEg"]
[Tue Mar 31 06:21:59.664939 2026] [:error] [pid 18332:tid 18364] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Mar 31 06:21:59.918154 2026] [:error] [pid 18332:tid 18350] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Tue Mar 31 06:22:00.174017 2026] [:error] [pid 18332:tid 18358] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Tue Mar 31 06:22:00.428144 2026] [:error] [pid 18332:tid 18361] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Tue Mar 31 06:22:02.011905 2026] [:error] [pid 18332:tid 18361] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/56c53.php
[Tue Mar 31 06:22:02.265401 2026] [:error] [pid 18332:tid 18356] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Mar 31 06:22:02.524856 2026] [:error] [pid 18332:tid 18353] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Tue Mar 31 06:22:02.788755 2026] [:error] [pid 18332:tid 18348] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Mar 31 06:22:03.054180 2026] [:error] [pid 18332:tid 18371] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Tue Mar 31 06:22:03.314468 2026] [:error] [pid 18332:tid 18351] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/5b9ac.php
[Tue Mar 31 06:22:03.567851 2026] [:error] [pid 18332:tid 18367] [client 20.107.195.165:65254] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Mar 31 06:22:03.818175 2026] [:error] [pid 18332:tid 18357] [client 20.107.195.165:65254] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr3i74KXr1F9raS5GSmiwAAAAk"]
[Tue Mar 31 06:22:05.117480 2026] [:error] [pid 11907:tid 11917] [client 20.107.195.165:19866] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr3jccoKGLZkBF4Ym1YuwAAAgc"]
[Tue Mar 31 06:22:06.092117 2026] [:error] [pid 18334:tid 18418] [client 20.107.195.165:65235] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr3jnqQrXLbk1cg3mhauwAAAIw"]
[Tue Mar 31 06:22:07.329085 2026] [:error] [pid 18439:tid 18461] [client 20.107.195.165:12572] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr3jy-R9nOaA8Xqs7jpbgAAAMo"]
[Tue Mar 31 06:22:08.261764 2026] [:error] [pid 18332:tid 18352] [client 20.107.195.165:26713] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acr3kL4KXr1F9raS5GSmjgAAAAQ"]
[Tue Mar 31 06:22:08.943692 2026] [:error] [pid 11822:tid 11841] [client 20.107.195.165:12548] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acr3kCLLrL4a3YEM2I0MEQAAAZE"]
[Tue Mar 31 06:22:09.974423 2026] [:error] [pid 1224:tid 1231] [client 20.107.195.165:19855] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acr3kcXGPQPzIHnCuJhFDwAAAQU"]
[Tue Mar 31 06:22:10.516046 2026] [:error] [pid 18332:tid 18351] [client 20.107.195.165:65250] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "acr3kr4KXr1F9raS5GSmnAAAAAM"]
[Tue Mar 31 06:22:11.101750 2026] [:error] [pid 18333:tid 18383] [client 20.107.195.165:65270] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acr3k0Sx2C5hLR0-8dIKzgAAAEQ"]
[Tue Mar 31 06:22:11.861090 2026] [:error] [pid 18334:tid 18406] [client 20.107.195.165:12568] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acr3k3qQrXLbk1cg3mhawgAAAIA"]
[Tue Mar 31 06:22:12.881472 2026] [:error] [pid 18333:tid 18383] [client 20.107.195.165:65241] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acr3lESx2C5hLR0-8dIK4wAAAEQ"]
[Tue Mar 31 06:22:13.650353 2026] [:error] [pid 11822:tid 11847] [client 20.107.195.165:65231] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "acr3lSLLrL4a3YEM2I0MFAAAAZc"]
[Tue Mar 31 06:22:14.266624 2026] [:error] [pid 18334:tid 18424] [client 20.107.195.165:65259] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "acr3lnqQrXLbk1cg3mhaxQAAAJI"]
[Tue Mar 31 06:22:14.993336 2026] [:error] [pid 18439:tid 18467] [client 20.107.195.165:24426] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "acr3li-R9nOaA8Xqs7jpeAAAANA"]
[Tue Mar 31 06:22:15.801770 2026] [:error] [pid 11822:tid 11848] [client 20.107.195.165:24419] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "acr3lyLLrL4a3YEM2I0MFwAAAZg"]
[Tue Mar 31 06:22:16.707875 2026] [:error] [pid 1224:tid 1247] [client 20.107.195.165:12574] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "acr3mMXGPQPzIHnCuJhFIQAAARU"]
[Tue Mar 31 06:22:17.362769 2026] [:error] [pid 18439:tid 18459] [client 20.107.195.165:19870] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acr3mS-R9nOaA8Xqs7jpfgAAAMg"]
[Tue Mar 31 06:22:17.988623 2026] [:error] [pid 18334:tid 18430] [client 20.107.195.165:26702] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acr3mXqQrXLbk1cg3mhazgAAAJg"]
[Tue Mar 31 06:22:18.853606 2026] [:error] [pid 11786:tid 11803] [client 20.107.195.165:24392] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acr3mk-ANHwuqDZumRDaeQAAAU8"]
[Tue Mar 31 06:22:19.619201 2026] [:error] [pid 18439:tid 18473] [client 20.107.195.165:12569] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "acr3my-R9nOaA8Xqs7jphQAAANY"]
[Tue Mar 31 06:22:21.537073 2026] [:error] [pid 18439:tid 18451] [client 20.107.195.165:54202] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acr3nS-R9nOaA8Xqs7jpigAAAMA"]
[Tue Mar 31 06:22:24.240626 2026] [:error] [pid 18439:tid 18472] [client 20.107.195.165:65229] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acr3oC-R9nOaA8Xqs7jpmgAAANU"]
[Tue Mar 31 06:22:27.462964 2026] [:error] [pid 1224:tid 1243] [client 20.107.195.165:12561] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acr3o8XGPQPzIHnCuJhFQQAAARE"]
[Tue Mar 31 06:22:30.369184 2026] [:error] [pid 18334:tid 18417] [client 20.107.195.165:19881] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "acr3pnqQrXLbk1cg3mha3gAAAIs"]
[Tue Mar 31 06:22:31.348643 2026] [:error] [pid 18333:tid 18381] [client 20.107.195.165:65263] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acr3p0Sx2C5hLR0-8dILGQAAAEI"]
[Tue Mar 31 06:22:32.156950 2026] [:error] [pid 11907:tid 11917] [client 20.107.195.165:26689] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acr3qMcoKGLZkBF4Ym1ZDAAAAgc"]
[Tue Mar 31 06:22:32.703976 2026] [:error] [pid 11907:tid 11911] [client 20.107.195.165:26733] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acr3qMcoKGLZkBF4Ym1ZDwAAAgE"]
[Tue Mar 31 06:22:33.606937 2026] [:error] [pid 11822:tid 11824] [client 20.107.195.165:24415] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "acr3qSLLrL4a3YEM2I0MLQAAAYA"]
[Tue Mar 31 06:22:34.495408 2026] [:error] [pid 18439:tid 18472] [client 20.107.195.165:12549] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acr3qi-R9nOaA8Xqs7jp2gAAANU"]
[Tue Mar 31 06:22:35.285409 2026] [:error] [pid 1224:tid 1238] [client 20.107.195.165:26704] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acr3q8XGPQPzIHnCuJhFdAAAAQw"]
[Tue Mar 31 06:22:36.184505 2026] [:error] [pid 18334:tid 18423] [client 20.107.195.165:26737] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acr3rHqQrXLbk1cg3mha6gAAAJE"]
[Tue Mar 31 06:22:37.243829 2026] [:error] [pid 18334:tid 18417] [client 20.107.195.165:24411] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "acr3rXqQrXLbk1cg3mha7QAAAIs"]
[Tue Mar 31 06:22:38.370375 2026] [:error] [pid 11822:tid 11838] [client 20.107.195.165:12602] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acr3riLLrL4a3YEM2I0MLwAAAY4"]
[Tue Mar 31 06:22:39.052405 2026] [:error] [pid 11907:tid 11911] [client 20.107.195.165:65256] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acr3r8coKGLZkBF4Ym1ZGgAAAgE"]
[Tue Mar 31 06:22:39.659716 2026] [:error] [pid 18334:tid 18428] [client 20.107.195.165:12607] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acr3r3qQrXLbk1cg3mha8wAAAJY"]
[Tue Mar 31 06:22:40.388315 2026] [:error] [pid 11907:tid 11920] [client 20.107.195.165:65239] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acr3sMcoKGLZkBF4Ym1ZHgAAAgo"]
[Tue Mar 31 06:22:41.071430 2026] [:error] [pid 11907:tid 11915] [client 20.107.195.165:54161] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acr3sccoKGLZkBF4Ym1ZIAAAAgU"]
[Tue Mar 31 06:22:41.666789 2026] [:error] [pid 11869:tid 11889] [client 20.107.195.165:12559] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acr3sRvAVplg9I6KoIInFgAAAdE"]
[Tue Mar 31 06:22:42.386815 2026] [:error] [pid 11907:tid 11924] [client 20.107.195.165:65252] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acr3sscoKGLZkBF4Ym1ZJAAAAg4"]
[Tue Mar 31 06:22:42.973017 2026] [:error] [pid 18332:tid 18349] [client 20.107.195.165:24443] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "acr3sr4KXr1F9raS5GSm1AAAAAE"]
[Tue Mar 31 06:22:43.545677 2026] [:error] [pid 11822:tid 11846] [client 20.107.195.165:26745] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acr3syLLrL4a3YEM2I0MNgAAAZY"]
[Tue Mar 31 06:22:44.218523 2026] [:error] [pid 11907:tid 11932] [client 20.107.195.165:12553] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acr3tMcoKGLZkBF4Ym1ZKQAAAhY"]
[Tue Mar 31 06:22:44.899695 2026] [:error] [pid 1224:tid 1243] [client 20.107.195.165:24391] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acr3tMXGPQPzIHnCuJhFeQAAARE"]
[Tue Mar 31 06:22:45.599383 2026] [:error] [pid 11907:tid 11919] [client 20.107.195.165:26744] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "acr3tccoKGLZkBF4Ym1ZKwAAAgk"]
[Tue Mar 31 06:22:46.190521 2026] [:error] [pid 11869:tid 11881] [client 20.107.195.165:12573] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "acr3thvAVplg9I6KoIInHAAAAck"]
[Tue Mar 31 06:22:46.894073 2026] [:error] [pid 11869:tid 11895] [client 20.107.195.165:26693] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "acr3thvAVplg9I6KoIInHgAAAdc"]
[Tue Mar 31 06:22:47.470075 2026] [:error] [pid 11822:tid 11841] [client 20.107.195.165:12545] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "acr3tyLLrL4a3YEM2I0MOwAAAZE"]
[Tue Mar 31 06:22:48.060807 2026] [:error] [pid 11869:tid 11878] [client 20.107.195.165:24387] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "acr3uBvAVplg9I6KoIInIAAAAcY"]
[Tue Mar 31 06:22:48.693346 2026] [:error] [pid 11822:tid 11847] [client 20.107.195.165:26711] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acr3uCLLrL4a3YEM2I0MQAAAAZc"]
[Tue Mar 31 06:22:49.321916 2026] [:error] [pid 1224:tid 1247] [client 20.107.195.165:12554] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acr3ucXGPQPzIHnCuJhFggAAARU"]
[Tue Mar 31 06:22:50.034623 2026] [:error] [pid 11786:tid 11801] [client 20.107.195.165:26712] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acr3uk-ANHwuqDZumRDalwAAAU0"]
[Tue Mar 31 06:22:50.758966 2026] [:error] [pid 11869:tid 11892] [client 20.107.195.165:26748] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gfd.php"] [unique_id "acr3uhvAVplg9I6KoIInJgAAAdQ"]
[Tue Mar 31 06:22:51.339644 2026] [:error] [pid 11907:tid 11916] [client 20.107.195.165:24440] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abrand.php"] [unique_id "acr3u8coKGLZkBF4Ym1ZOQAAAgY"]
[Tue Mar 31 06:22:52.026304 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:65228] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abrand.php"] [unique_id "acr3vC-R9nOaA8Xqs7jqLQAAAM4"]
[Tue Mar 31 06:22:52.686819 2026] [:error] [pid 18333:tid 18389] [client 20.107.195.165:26720] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abrand.php"] [unique_id "acr3vESx2C5hLR0-8dILMgAAAEo"]
[Tue Mar 31 06:22:53.269694 2026] [:error] [pid 11907:tid 11918] [client 20.107.195.165:26698] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abrand.php"] [unique_id "acr3vccoKGLZkBF4Ym1ZPwAAAgg"]
[Tue Mar 31 06:22:53.768493 2026] [:error] [pid 11907:tid 11931] [client 20.107.195.165:65238] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acr3vccoKGLZkBF4Ym1ZQAAAAhU"]
[Tue Mar 31 06:22:54.365594 2026] [:error] [pid 18333:tid 18393] [client 20.107.195.165:65234] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acr3vkSx2C5hLR0-8dILPQAAAE4"]
[Tue Mar 31 06:22:54.937903 2026] [:error] [pid 18333:tid 18387] [client 20.107.195.165:26751] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acr3vkSx2C5hLR0-8dILQQAAAEg"]
[Tue Mar 31 06:22:55.570583 2026] [:error] [pid 1224:tid 1231] [client 20.107.195.165:65244] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amp.php"] [unique_id "acr3v8XGPQPzIHnCuJhFnQAAAQU"]
[Tue Mar 31 06:22:56.156092 2026] [:error] [pid 18333:tid 18395] [client 20.107.195.165:19846] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "acr3wESx2C5hLR0-8dILRQAAAFA"]
[Tue Mar 31 06:22:56.727073 2026] [:error] [pid 11907:tid 11920] [client 20.107.195.165:26726] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "acr3wMcoKGLZkBF4Ym1ZRwAAAgo"]
[Tue Mar 31 06:22:57.270657 2026] [:error] [pid 18334:tid 18419] [client 20.107.195.165:24407] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "acr3wXqQrXLbk1cg3mhbCAAAAI0"]
[Tue Mar 31 06:22:57.858400 2026] [:error] [pid 18334:tid 18410] [client 20.107.195.165:65242] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "acr3wXqQrXLbk1cg3mhbDAAAAIQ"]
[Tue Mar 31 06:22:58.450565 2026] [:error] [pid 18332:tid 18363] [client 20.107.195.165:26740] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acr3wr4KXr1F9raS5GSm3QAAAA8"]
[Tue Mar 31 06:22:59.010767 2026] [:error] [pid 18333:tid 18380] [client 20.107.195.165:26691] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acr3w0Sx2C5hLR0-8dILTQAAAEE"]
[Tue Mar 31 06:22:59.572968 2026] [:error] [pid 11907:tid 11917] [client 20.107.195.165:65224] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acr3w8coKGLZkBF4Ym1ZSgAAAgc"]
[Tue Mar 31 06:23:00.106822 2026] [:error] [pid 18334:tid 18414] [client 20.107.195.165:65264] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "acr3xHqQrXLbk1cg3mhbEwAAAIg"]
[Tue Mar 31 06:23:00.692818 2026] [:error] [pid 18333:tid 18388] [client 20.107.195.165:19844] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acr3xESx2C5hLR0-8dILWwAAAEk"]
[Tue Mar 31 06:23:01.330370 2026] [:error] [pid 18333:tid 18400] [client 20.107.195.165:65232] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acr3xUSx2C5hLR0-8dILYAAAAFU"]
[Tue Mar 31 06:23:01.917600 2026] [:error] [pid 18439:tid 18453] [client 20.107.195.165:65271] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acr3xS-R9nOaA8Xqs7jqMQAAAMI"]
[Tue Mar 31 06:23:02.492595 2026] [:error] [pid 18333:tid 18388] [client 20.107.195.165:12565] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "acr3xkSx2C5hLR0-8dILaAAAAEk"]
[Tue Mar 31 06:23:03.069321 2026] [:error] [pid 18439:tid 18471] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/lowpr.php
[Tue Mar 31 06:23:03.358667 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Tue Mar 31 06:23:03.627624 2026] [:error] [pid 18439:tid 18463] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Tue Mar 31 06:23:03.892686 2026] [:error] [pid 18439:tid 18452] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Tue Mar 31 06:23:04.161436 2026] [:error] [pid 18439:tid 18456] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Tue Mar 31 06:23:04.424962 2026] [:error] [pid 18439:tid 18464] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Tue Mar 31 06:23:04.691418 2026] [:error] [pid 18439:tid 18472] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Mar 31 06:23:04.955064 2026] [:error] [pid 18439:tid 18455] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Mar 31 06:23:05.217790 2026] [:error] [pid 18439:tid 18461] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/ne2026.php
[Tue Mar 31 06:23:05.482477 2026] [:error] [pid 18439:tid 18451] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/ws73.php
[Tue Mar 31 06:23:05.748257 2026] [:error] [pid 18439:tid 18470] [client 20.107.195.165:26750] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Tue Mar 31 06:23:06.008004 2026] [:error] [pid 18439:tid 18460] [client 20.107.195.165:26750] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "acr3yi-R9nOaA8Xqs7jqSQAAAMk"]
[Tue Mar 31 06:23:06.618076 2026] [:error] [pid 11786:tid 11808] [client 20.107.195.165:24437] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "acr3yk-ANHwuqDZumRDamgAAAVQ"]
[Tue Mar 31 06:23:07.213796 2026] [:error] [pid 11822:tid 11833] [client 20.107.195.165:24397] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "acr3yyLLrL4a3YEM2I0MQwAAAYk"]
[Tue Mar 31 06:23:07.878043 2026] [:error] [pid 11907:tid 11910] [client 20.107.195.165:24421] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/baixy.php"] [unique_id "acr3y8coKGLZkBF4Ym1ZVgAAAgA"]
[Tue Mar 31 06:23:08.457788 2026] [:error] [pid 18439:tid 18456] [client 20.107.195.165:26734] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acr3zC-R9nOaA8Xqs7jqTwAAAMU"]
[Tue Mar 31 06:23:09.025381 2026] [:error] [pid 18439:tid 18461] [client 20.107.195.165:19890] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acr3zS-R9nOaA8Xqs7jqUQAAAMo"]
[Tue Mar 31 06:23:09.658049 2026] [:error] [pid 18333:tid 18380] [client 20.107.195.165:12557] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acr3zUSx2C5hLR0-8dILogAAAEE"]
[Tue Mar 31 06:23:10.205730 2026] [:error] [pid 18333:tid 18384] [client 20.107.195.165:12603] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "acr3zkSx2C5hLR0-8dILpAAAAEU"]
[Tue Mar 31 06:23:10.889450 2026] [:error] [pid 18439:tid 18452] [client 20.107.195.165:12606] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acr3zi-R9nOaA8Xqs7jqVwAAAME"]
[Tue Mar 31 06:23:11.509283 2026] [:error] [pid 18334:tid 18420] [client 20.107.195.165:19859] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acr3z3qQrXLbk1cg3mhbKgAAAI4"]
[Tue Mar 31 06:23:12.083894 2026] [:error] [pid 1224:tid 1240] [client 20.107.195.165:65257] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acr30MXGPQPzIHnCuJhF6AAAAQ4"]
[Tue Mar 31 06:23:12.821251 2026] [:error] [pid 1224:tid 1226] [client 20.107.195.165:65261] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "acr30MXGPQPzIHnCuJhF7gAAAQA"]
[Tue Mar 31 06:23:13.434473 2026] [:error] [pid 18439:tid 18458] [client 20.107.195.165:26728] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acr30S-R9nOaA8Xqs7jqYQAAAMc"]
[Tue Mar 31 06:23:13.978389 2026] [:error] [pid 18333:tid 18379] [client 20.107.195.165:19875] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acr30USx2C5hLR0-8dILrwAAAEA"]
[Tue Mar 31 06:23:14.532355 2026] [:error] [pid 18333:tid 18389] [client 20.107.195.165:19858] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acr30kSx2C5hLR0-8dILsQAAAEo"]
[Tue Mar 31 06:23:15.153866 2026] [:error] [pid 18333:tid 18400] [client 20.107.195.165:19885] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "acr300Sx2C5hLR0-8dILtAAAAFU"]
[Tue Mar 31 06:23:15.752142 2026] [:error] [pid 18439:tid 18456] [client 20.107.195.165:65218] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "acr30y-R9nOaA8Xqs7jqZwAAAMU"]
[Tue Mar 31 06:23:16.278370 2026] [:error] [pid 18334:tid 18426] [client 20.107.195.165:54166] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "acr31HqQrXLbk1cg3mhbNgAAAJQ"]
[Tue Mar 31 06:23:16.837575 2026] [:error] [pid 18333:tid 18396] [client 20.107.195.165:19895] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "acr31ESx2C5hLR0-8dILuQAAAFE"]
[Tue Mar 31 06:23:17.419747 2026] [:error] [pid 18333:tid 18399] [client 20.107.195.165:65253] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "acr31USx2C5hLR0-8dILuwAAAFQ"]
[Tue Mar 31 06:23:18.020052 2026] [:error] [pid 11786:tid 11791] [client 20.107.195.165:19849] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "acr31k-ANHwuqDZumRDaoAAAAUM"]
[Tue Mar 31 06:23:18.718618 2026] [:error] [pid 18439:tid 18459] [client 20.107.195.165:19847] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "acr31i-R9nOaA8Xqs7jqcAAAAMg"]
[Tue Mar 31 06:23:19.294616 2026] [:error] [pid 18334:tid 18410] [client 20.107.195.165:26692] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "acr313qQrXLbk1cg3mhbOQAAAIQ"]
[Tue Mar 31 06:23:19.891350 2026] [:error] [pid 18334:tid 18421] [client 20.107.195.165:54189] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "acr313qQrXLbk1cg3mhbOwAAAI8"]
[Tue Mar 31 06:23:20.517554 2026] [:error] [pid 18333:tid 18380] [client 20.107.195.165:65269] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acr32ESx2C5hLR0-8dILwgAAAEE"]
[Tue Mar 31 06:23:21.070015 2026] [:error] [pid 18333:tid 18384] [client 20.107.195.165:12563] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acr32USx2C5hLR0-8dILxgAAAEU"]
[Tue Mar 31 06:23:21.722120 2026] [:error] [pid 18333:tid 18380] [client 20.107.195.165:54147] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acr32USx2C5hLR0-8dILzAAAAEE"]
[Tue Mar 31 06:23:22.261817 2026] [:error] [pid 11869:tid 11882] [client 20.107.195.165:19841] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "acr32hvAVplg9I6KoIInNQAAAco"]
[Tue Mar 31 06:23:22.853569 2026] [:error] [pid 18439:tid 18468] [client 20.107.195.165:19868] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acr32i-R9nOaA8Xqs7jqfgAAANE"]
[Tue Mar 31 06:23:23.405628 2026] [:error] [pid 18334:tid 18430] [client 20.107.195.165:19843] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acr323qQrXLbk1cg3mhbQgAAAJg"]
[Tue Mar 31 06:23:24.144487 2026] [:error] [pid 1224:tid 1228] [client 20.107.195.165:12579] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acr33MXGPQPzIHnCuJhGCQAAAQI"]
[Tue Mar 31 06:23:24.825797 2026] [:error] [pid 18333:tid 18398] [client 20.107.195.165:65277] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "acr33ESx2C5hLR0-8dIL3AAAAFM"]
[Tue Mar 31 06:23:25.374061 2026] [:error] [pid 18439:tid 18469] [client 20.107.195.165:26736] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "acr33S-R9nOaA8Xqs7jqggAAANI"]
[Tue Mar 31 06:23:25.958191 2026] [:error] [pid 1224:tid 1235] [client 20.107.195.165:12552] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "acr33cXGPQPzIHnCuJhGDgAAAQk"]
[Tue Mar 31 06:23:26.842437 2026] [:error] [pid 11869:tid 11890] [client 20.107.195.165:12598] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "acr33hvAVplg9I6KoIInOwAAAdI"]
[Tue Mar 31 06:23:27.606612 2026] [:error] [pid 18333:tid 18383] [client 20.107.195.165:12604] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "acr330Sx2C5hLR0-8dIL4AAAAEQ"]
[Tue Mar 31 06:23:28.212093 2026] [:error] [pid 18334:tid 18430] [client 20.107.195.165:19876] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acr34HqQrXLbk1cg3mhbUAAAAJg"]
[Tue Mar 31 06:23:28.814056 2026] [:error] [pid 1224:tid 1230] [client 20.107.195.165:65267] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acr34MXGPQPzIHnCuJhGEwAAAQQ"]
[Tue Mar 31 06:23:29.382764 2026] [:error] [pid 1224:tid 1229] [client 20.107.195.165:65230] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acr34cXGPQPzIHnCuJhGFQAAAQM"]
[Tue Mar 31 06:23:30.148391 2026] [:error] [pid 1224:tid 1232] [client 20.107.195.165:26743] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd.php"] [unique_id "acr34sXGPQPzIHnCuJhGFwAAAQY"]
[Tue Mar 31 06:23:30.896199 2026] [:error] [pid 11786:tid 11798] [client 20.107.195.165:54162] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acr34k-ANHwuqDZumRDapQAAAUo"]
[Tue Mar 31 06:23:31.466951 2026] [:error] [pid 18439:tid 18462] [client 20.107.195.165:19862] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acr34y-R9nOaA8Xqs7jqmQAAAMs"]
[Tue Mar 31 06:23:32.068928 2026] [:error] [pid 11822:tid 11827] [client 20.107.195.165:24442] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acr35CLLrL4a3YEM2I0MUAAAAYM"]
[Tue Mar 31 06:23:32.644297 2026] [:error] [pid 18439:tid 18457] [client 20.107.195.165:12591] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "acr35C-R9nOaA8Xqs7jqoAAAAMY"]
[Tue Mar 31 06:23:33.217937 2026] [:error] [pid 18333:tid 18398] [client 20.107.195.165:19867] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "acr35USx2C5hLR0-8dIL6wAAAFM"]
[Tue Mar 31 06:23:33.784668 2026] [:error] [pid 18439:tid 18452] [client 20.107.195.165:19879] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "acr35S-R9nOaA8Xqs7jqqQAAAME"]
[Tue Mar 31 06:23:34.384251 2026] [:error] [pid 18439:tid 18475] [client 20.107.195.165:26727] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "acr35i-R9nOaA8Xqs7jqqwAAANg"]
[Tue Mar 31 06:23:34.948194 2026] [:error] [pid 18334:tid 18422] [client 20.107.195.165:26747] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "acr35nqQrXLbk1cg3mhbZgAAAJA"]
[Tue Mar 31 06:23:35.693772 2026] [:error] [pid 18334:tid 18424] [client 20.107.195.165:44853] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acr353qQrXLbk1cg3mhbbgAAAJI"]
[Tue Mar 31 06:23:36.331871 2026] [:error] [pid 18334:tid 18427] [client 20.107.195.165:19853] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acr36HqQrXLbk1cg3mhbcgAAAJU"]
[Tue Mar 31 06:23:36.870054 2026] [:error] [pid 11822:tid 11847] [client 20.107.195.165:44808] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acr36CLLrL4a3YEM2I0MUwAAAZc"]
[Tue Mar 31 06:23:37.419932 2026] [:error] [pid 18334:tid 18425] [client 20.107.195.165:44804] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "acr36XqQrXLbk1cg3mhbfQAAAJM"]
[Tue Mar 31 06:23:38.003339 2026] [:error] [pid 18334:tid 18421] [client 20.107.195.165:19903] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "acr36nqQrXLbk1cg3mhbgAAAAI8"]
[Tue Mar 31 06:23:38.631390 2026] [:error] [pid 18439:tid 18464] [client 20.107.195.165:12558] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "acr36i-R9nOaA8Xqs7jquAAAAM0"]
[Tue Mar 31 06:23:39.227724 2026] [:error] [pid 1224:tid 1229] [client 20.107.195.165:26709] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "acr368XGPQPzIHnCuJhGLAAAAQM"]
[Tue Mar 31 06:23:39.769876 2026] [:error] [pid 18334:tid 18413] [client 20.107.195.165:12599] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "acr363qQrXLbk1cg3mhbiAAAAIc"]
[Tue Mar 31 06:23:40.327836 2026] [:error] [pid 18439:tid 18463] [client 20.107.195.165:24386] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/file.php"] [unique_id "acr37C-R9nOaA8Xqs7jqvwAAAMw"]
[Tue Mar 31 06:23:40.931045 2026] [:error] [pid 18334:tid 18430] [client 20.107.195.165:65265] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/file.php"] [unique_id "acr37HqQrXLbk1cg3mhbjwAAAJg"]
[Tue Mar 31 06:23:41.531642 2026] [:error] [pid 18334:tid 18413] [client 20.107.195.165:19863] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/file.php"] [unique_id "acr37XqQrXLbk1cg3mhbkwAAAIc"]
[Tue Mar 31 06:23:42.070386 2026] [:error] [pid 11822:tid 11829] [client 20.107.195.165:19903] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/file.php"] [unique_id "acr37iLLrL4a3YEM2I0MZQAAAYU"]
[Tue Mar 31 06:23:42.666142 2026] [:error] [pid 18439:tid 18464] [client 20.107.195.165:65278] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acr37i-R9nOaA8Xqs7jqxAAAAM0"]
[Tue Mar 31 06:23:43.230670 2026] [:error] [pid 11907:tid 11918] [client 20.107.195.165:65216] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acr378coKGLZkBF4Ym1ZfQAAAgg"]
[Tue Mar 31 06:23:43.851844 2026] [:error] [pid 11907:tid 11915] [client 20.107.195.165:19899] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acr378coKGLZkBF4Ym1ZfgAAAgU"]
[Tue Mar 31 06:23:44.480832 2026] [:error] [pid 18333:tid 18394] [client 20.107.195.165:12551] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "acr38ESx2C5hLR0-8dIL8wAAAE8"]
[Tue Mar 31 06:23:45.097420 2026] [:error] [pid 18439:tid 18461] [client 20.107.195.165:12560] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acr38S-R9nOaA8Xqs7jqzAAAAMo"]
[Tue Mar 31 06:23:45.754974 2026] [:error] [pid 18334:tid 18428] [client 20.107.195.165:26723] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acr38XqQrXLbk1cg3mhbmwAAAJY"]
[Tue Mar 31 06:23:46.435760 2026] [:error] [pid 18439:tid 18475] [client 20.107.195.165:12592] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acr38i-R9nOaA8Xqs7jq0gAAANg"]
[Tue Mar 31 06:23:47.050788 2026] [:error] [pid 1224:tid 1248] [client 20.107.195.165:24446] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "acr388XGPQPzIHnCuJhGMwAAARY"]
[Tue Mar 31 06:23:47.692583 2026] [:error] [pid 1224:tid 1247] [client 20.107.195.165:65262] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws87.php"] [unique_id "acr388XGPQPzIHnCuJhGNwAAARU"]
[Tue Mar 31 06:23:48.331952 2026] [:error] [pid 18333:tid 18403] [client 20.107.195.165:12544] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws87.php"] [unique_id "acr39ESx2C5hLR0-8dIL_wAAAFg"]
[Tue Mar 31 06:23:48.921943 2026] [:error] [pid 11822:tid 11831] [client 20.107.195.165:26700] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws87.php"] [unique_id "acr39CLLrL4a3YEM2I0MdQAAAYc"]
[Tue Mar 31 06:23:49.563582 2026] [:error] [pid 18333:tid 18395] [client 20.107.195.165:65243] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws87.php"] [unique_id "acr39USx2C5hLR0-8dIMCgAAAFA"]
[Tue Mar 31 06:23:50.140336 2026] [:error] [pid 18333:tid 18403] [client 20.107.195.165:19856] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "acr39kSx2C5hLR0-8dIMDgAAAFg"]
[Tue Mar 31 06:23:50.702330 2026] [:error] [pid 18333:tid 18379] [client 20.107.195.165:65233] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "acr39kSx2C5hLR0-8dIMEgAAAEA"]
[Tue Mar 31 06:23:51.289779 2026] [:error] [pid 11869:tid 11877] [client 20.107.195.165:54173] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "acr39xvAVplg9I6KoIInSwAAAcU"]
[Tue Mar 31 06:23:51.869205 2026] [:error] [pid 11907:tid 11923] [client 20.107.195.165:19865] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "acr398coKGLZkBF4Ym1ZjgAAAg0"]
[Tue Mar 31 06:23:52.490680 2026] [:error] [pid 18334:tid 18422] [client 20.107.195.165:19845] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "acr3-HqQrXLbk1cg3mhboAAAAJA"]
[Tue Mar 31 06:23:53.083663 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:19842] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "acr3-S-R9nOaA8Xqs7jq5wAAAM4"]
[Tue Mar 31 06:23:53.688527 2026] [:error] [pid 11907:tid 11932] [client 20.107.195.165:65266] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "acr3-ccoKGLZkBF4Ym1ZmwAAAhY"]
[Tue Mar 31 06:23:54.231037 2026] [:error] [pid 18439:tid 18459] [client 20.107.195.165:12587] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "acr3-i-R9nOaA8Xqs7jq7AAAAMg"]
[Tue Mar 31 06:23:54.848863 2026] [:error] [pid 18439:tid 18452] [client 20.107.195.165:24418] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acr3-i-R9nOaA8Xqs7jq8wAAAME"]
[Tue Mar 31 06:23:55.534328 2026] [:error] [pid 18439:tid 18462] [client 20.107.195.165:44858] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acr3-y-R9nOaA8Xqs7jq9wAAAMs"]
[Tue Mar 31 06:23:56.119381 2026] [:error] [pid 18334:tid 18425] [client 20.107.195.165:19886] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acr3_HqQrXLbk1cg3mhbogAAAJM"]
[Tue Mar 31 06:23:56.719794 2026] [:error] [pid 11869:tid 11883] [client 20.107.195.165:24398] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "acr3_BvAVplg9I6KoIInUAAAAcs"]
[Tue Mar 31 06:23:57.291749 2026] [:error] [pid 11822:tid 11838] [client 20.107.195.165:12596] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acr3_SLLrL4a3YEM2I0MfQAAAY4"]
[Tue Mar 31 06:23:57.863980 2026] [:error] [pid 11907:tid 11930] [client 20.107.195.165:44857] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acr3_ccoKGLZkBF4Ym1ZngAAAhQ"]
[Tue Mar 31 06:23:58.404592 2026] [:error] [pid 18334:tid 18412] [client 20.107.195.165:26741] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acr3_nqQrXLbk1cg3mhbqwAAAIY"]
[Tue Mar 31 06:23:58.990714 2026] [:error] [pid 11907:tid 11920] [client 20.107.195.165:54152] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "acr3_scoKGLZkBF4Ym1ZpwAAAgo"]
[Tue Mar 31 06:23:59.567080 2026] [:error] [pid 1224:tid 1249] [client 20.107.195.165:24436] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acr3_8XGPQPzIHnCuJhGVwAAARc"]
[Tue Mar 31 06:24:00.133158 2026] [:error] [pid 11907:tid 11930] [client 20.107.195.165:24429] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acr4AMcoKGLZkBF4Ym1ZqQAAAhQ"]
[Tue Mar 31 06:24:00.723459 2026] [:error] [pid 18334:tid 18427] [client 20.107.195.165:19851] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acr4AHqQrXLbk1cg3mhbsQAAAJU"]
[Tue Mar 31 06:24:01.260470 2026] [:error] [pid 1224:tid 1227] [client 20.107.195.165:26696] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "acr4AcXGPQPzIHnCuJhGWwAAAQE"]
[Tue Mar 31 06:24:01.884378 2026] [:error] [pid 18334:tid 18408] [client 20.107.195.165:19871] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acr4AXqQrXLbk1cg3mhbtAAAAII"]
[Tue Mar 31 06:24:02.443639 2026] [:error] [pid 18334:tid 18425] [client 20.107.195.165:12590] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acr4AnqQrXLbk1cg3mhbtgAAAJM"]
[Tue Mar 31 06:24:03.034899 2026] [:error] [pid 1224:tid 1248] [client 20.107.195.165:65279] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acr4A8XGPQPzIHnCuJhGYAAAARY"]
[Tue Mar 31 06:24:03.671941 2026] [:error] [pid 11786:tid 11811] [client 20.107.195.165:26738] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "acr4A0-ANHwuqDZumRDasAAAAVc"]
[Tue Mar 31 06:24:04.340187 2026] [:error] [pid 11822:tid 11827] [client 20.107.195.165:54160] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acr4BCLLrL4a3YEM2I0MhwAAAYM"]
[Tue Mar 31 06:24:04.912859 2026] [:error] [pid 11869:tid 11888] [client 20.107.195.165:19864] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "acr4BBvAVplg9I6KoIInWgAAAdA"]
[Tue Mar 31 06:24:05.556869 2026] [:error] [pid 18439:tid 18467] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Tue Mar 31 06:24:05.824363 2026] [:error] [pid 18439:tid 18469] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Tue Mar 31 06:24:06.361076 2026] [:error] [pid 18439:tid 18453] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Mar 31 06:24:06.625192 2026] [:error] [pid 18439:tid 18455] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Mar 31 06:24:06.895968 2026] [:error] [pid 18439:tid 18458] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Tue Mar 31 06:24:07.160889 2026] [:error] [pid 18439:tid 18473] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax.php
[Tue Mar 31 06:24:07.445220 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Tue Mar 31 06:24:08.027250 2026] [:error] [pid 18439:tid 18451] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Tue Mar 31 06:24:08.293939 2026] [:error] [pid 18439:tid 18467] [client 20.107.195.165:65221] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Tue Mar 31 06:24:08.585814 2026] [:error] [pid 18439:tid 18454] [client 20.107.195.165:65221] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "acr4CC-R9nOaA8Xqs7jrHwAAAMM"]
[Tue Mar 31 06:24:09.215064 2026] [:error] [pid 11907:tid 11910] [client 20.107.195.165:24410] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "acr4CccoKGLZkBF4Ym1ZtAAAAgA"]
[Tue Mar 31 06:24:09.809971 2026] [:error] [pid 11786:tid 11801] [client 20.107.195.165:54170] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "acr4CU-ANHwuqDZumRDatAAAAU0"]
[Tue Mar 31 06:24:10.466438 2026] [:error] [pid 11869:tid 11877] [client 20.107.195.165:44855] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws60.php"] [unique_id "acr4ChvAVplg9I6KoIInYQAAAcU"]
[Tue Mar 31 06:24:11.023117 2026] [:error] [pid 18333:tid 18394] [client 20.107.195.165:65275] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acr4C0Sx2C5hLR0-8dIMKAAAAE8"]
[Tue Mar 31 06:24:11.549331 2026] [:error] [pid 18333:tid 18387] [client 20.107.195.165:54196] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acr4C0Sx2C5hLR0-8dIMKQAAAEg"]
[Tue Mar 31 06:24:12.157853 2026] [:error] [pid 18333:tid 18390] [client 20.107.195.165:12547] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acr4DESx2C5hLR0-8dIMLwAAAEs"]
[Tue Mar 31 06:24:12.692396 2026] [:error] [pid 18439:tid 18457] [client 20.107.195.165:19887] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "acr4DC-R9nOaA8Xqs7jrKAAAAMY"]
[Tue Mar 31 06:24:13.301603 2026] [:error] [pid 18333:tid 18389] [client 20.107.195.165:24424] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acr4DUSx2C5hLR0-8dIMNgAAAEo"]
[Tue Mar 31 06:24:13.848917 2026] [:error] [pid 18439:tid 18466] [client 20.107.195.165:54168] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acr4DS-R9nOaA8Xqs7jrLQAAAM8"]
[Tue Mar 31 06:24:14.465433 2026] [:error] [pid 18333:tid 18386] [client 20.107.195.165:24423] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acr4DkSx2C5hLR0-8dIMOwAAAEc"]
[Tue Mar 31 06:24:15.029074 2026] [:error] [pid 11786:tid 11808] [client 20.107.195.165:24435] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "acr4D0-ANHwuqDZumRDatwAAAVQ"]
[Tue Mar 31 06:24:15.578536 2026] [:error] [pid 11869:tid 11890] [client 20.107.195.165:24406] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acr4DxvAVplg9I6KoIInZAAAAdI"]
[Tue Mar 31 06:24:16.121843 2026] [:error] [pid 18333:tid 18389] [client 20.107.195.165:19889] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acr4EESx2C5hLR0-8dIMRAAAAEo"]
[Tue Mar 31 06:24:16.686822 2026] [:error] [pid 11869:tid 11872] [client 20.107.195.165:19878] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acr4EBvAVplg9I6KoIInZwAAAcA"]
[Tue Mar 31 06:24:17.211078 2026] [:error] [pid 18439:tid 18456] [client 20.107.195.165:12589] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "acr4ES-R9nOaA8Xqs7jrOwAAAMU"]
[Tue Mar 31 06:24:17.806933 2026] [:error] [pid 18333:tid 18382] [client 20.107.195.165:12575] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acr4EUSx2C5hLR0-8dIMUgAAAEM"]
[Tue Mar 31 06:24:18.358415 2026] [:error] [pid 18333:tid 18387] [client 20.107.195.165:19861] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acr4EkSx2C5hLR0-8dIMVwAAAEg"]
[Tue Mar 31 06:24:18.918918 2026] [:error] [pid 11869:tid 11878] [client 20.107.195.165:26694] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acr4EhvAVplg9I6KoIInbQAAAcY"]
[Tue Mar 31 06:24:19.510458 2026] [:error] [pid 1224:tid 1241] [client 20.107.195.165:44802] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "acr4E8XGPQPzIHnCuJhGqAAAAQ8"]
[Tue Mar 31 06:24:20.130665 2026] [:error] [pid 18439:tid 18468] [client 20.107.195.165:24413] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "acr4FC-R9nOaA8Xqs7jrRwAAANE"]
[Tue Mar 31 06:24:20.788068 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:54184] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "acr4FC-R9nOaA8Xqs7jrSgAAAM4"]
[Tue Mar 31 06:24:21.329032 2026] [:error] [pid 18439:tid 18461] [client 20.107.195.165:24445] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "acr4FS-R9nOaA8Xqs7jrUAAAAMo"]
[Tue Mar 31 06:24:21.918980 2026] [:error] [pid 18334:tid 18406] [client 20.107.195.165:65276] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "acr4FXqQrXLbk1cg3mhbxwAAAIA"]
[Tue Mar 31 06:24:22.478919 2026] [:error] [pid 18439:tid 18456] [client 20.107.195.165:24417] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acr4Fi-R9nOaA8Xqs7jrWQAAAMU"]
[Tue Mar 31 06:24:23.009151 2026] [:error] [pid 18439:tid 18471] [client 20.107.195.165:24414] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acr4Fy-R9nOaA8Xqs7jrXAAAANQ"]
[Tue Mar 31 06:24:23.652603 2026] [:error] [pid 1224:tid 1233] [client 20.107.195.165:54149] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acr4F8XGPQPzIHnCuJhGqQAAAQc"]
[Tue Mar 31 06:24:24.263014 2026] [:error] [pid 11869:tid 11876] [client 20.107.195.165:19850] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "acr4GBvAVplg9I6KoIIncQAAAcQ"]
[Tue Mar 31 06:24:24.855440 2026] [:error] [pid 18439:tid 18453] [client 20.107.195.165:54172] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "acr4GC-R9nOaA8Xqs7jrZgAAAMI"]
[Tue Mar 31 06:24:25.484485 2026] [:error] [pid 18439:tid 18454] [client 20.107.195.165:54204] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "acr4GS-R9nOaA8Xqs7jragAAAMM"]
[Tue Mar 31 06:24:26.093584 2026] [:error] [pid 11907:tid 11925] [client 20.107.195.165:40140] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "acr4GscoKGLZkBF4Ym1ZxgAAAg8"]
[Tue Mar 31 06:24:26.728993 2026] [:error] [pid 18439:tid 18459] [client 20.107.195.165:26697] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "acr4Gi-R9nOaA8Xqs7jrcgAAAMg"]
[Tue Mar 31 06:24:27.417685 2026] [:error] [pid 1224:tid 1236] [client 20.107.195.165:54192] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acr4G8XGPQPzIHnCuJhGrwAAAQo"]
[Tue Mar 31 06:24:28.068031 2026] [:error] [pid 18333:tid 18386] [client 20.107.195.165:44842] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acr4HESx2C5hLR0-8dIMhQAAAEc"]
[Tue Mar 31 06:24:28.684079 2026] [:error] [pid 18334:tid 18415] [client 20.107.195.165:12586] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acr4HHqQrXLbk1cg3mhb1gAAAIk"]
[Tue Mar 31 06:24:29.277674 2026] [:error] [pid 18439:tid 18471] [client 20.107.195.165:54158] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "acr4HS-R9nOaA8Xqs7jrfAAAANQ"]
[Tue Mar 31 06:24:29.893948 2026] [:error] [pid 18439:tid 18466] [client 20.107.195.165:24409] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acr4HS-R9nOaA8Xqs7jrgwAAAM8"]
[Tue Mar 31 06:24:30.465062 2026] [:error] [pid 18439:tid 18471] [client 20.107.195.165:12578] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acr4Hi-R9nOaA8Xqs7jriAAAANQ"]
[Tue Mar 31 06:24:31.088624 2026] [:error] [pid 18334:tid 18422] [client 20.107.195.165:26730] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acr4H3qQrXLbk1cg3mhb2QAAAJA"]
[Tue Mar 31 06:24:31.712384 2026] [:error] [pid 18333:tid 18387] [client 20.107.195.165:24438] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blogs.php"] [unique_id "acr4H0Sx2C5hLR0-8dIMkQAAAEg"]
[Tue Mar 31 06:24:32.288961 2026] [:error] [pid 1224:tid 1248] [client 20.107.195.165:65217] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acr4IMXGPQPzIHnCuJhGsgAAARY"]
[Tue Mar 31 06:24:33.193869 2026] [:error] [pid 18333:tid 18400] [client 20.107.195.165:25306] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acr4IUSx2C5hLR0-8dIMmwAAAFU"]
[Tue Mar 31 06:24:34.019076 2026] [:error] [pid 18334:tid 18420] [client 20.107.195.165:19869] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acr4InqQrXLbk1cg3mhb7AAAAI4"]
[Tue Mar 31 06:24:34.699565 2026] [:error] [pid 18334:tid 18413] [client 20.107.195.165:24396] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "acr4InqQrXLbk1cg3mhb8QAAAIc"]
[Tue Mar 31 06:24:35.353911 2026] [:error] [pid 18439:tid 18468] [client 20.107.195.165:54163] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acr4Iy-R9nOaA8Xqs7jrlgAAANE"]
[Tue Mar 31 06:24:36.040975 2026] [:error] [pid 18439:tid 18454] [client 20.107.195.165:24390] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acr4JC-R9nOaA8Xqs7jrmwAAAMM"]
[Tue Mar 31 06:24:36.622321 2026] [:error] [pid 11822:tid 11825] [client 20.107.195.165:44810] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acr4JCLLrL4a3YEM2I0MnAAAAYE"]
[Tue Mar 31 06:24:37.316650 2026] [:error] [pid 1224:tid 1238] [client 20.107.195.165:19857] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "acr4JcXGPQPzIHnCuJhGtQAAAQw"]
[Tue Mar 31 06:24:38.032169 2026] [:error] [pid 11869:tid 11873] [client 20.107.195.165:24400] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acr4JhvAVplg9I6KoIIndwAAAcE"]
[Tue Mar 31 06:24:38.630606 2026] [:error] [pid 18333:tid 18391] [client 20.107.195.165:26742] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acr4JkSx2C5hLR0-8dIMrQAAAEw"]
[Tue Mar 31 06:24:39.250532 2026] [:error] [pid 18333:tid 18394] [client 20.107.195.165:19840] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acr4J0Sx2C5hLR0-8dIMswAAAE8"]
[Tue Mar 31 06:24:39.982630 2026] [:error] [pid 11907:tid 11921] [client 20.107.195.165:44833] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xfun.php"] [unique_id "acr4J8coKGLZkBF4Ym1Z0AAAAgs"]
[Tue Mar 31 06:24:40.603033 2026] [:error] [pid 18439:tid 18453] [client 20.107.195.165:54174] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acr4KC-R9nOaA8Xqs7jrsAAAAMI"]
[Tue Mar 31 06:24:41.274252 2026] [:error] [pid 18439:tid 18460] [client 20.107.195.165:12576] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acr4KS-R9nOaA8Xqs7jruQAAAMk"]
[Tue Mar 31 06:24:41.878951 2026] [:error] [pid 18439:tid 18459] [client 20.107.195.165:54183] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acr4KS-R9nOaA8Xqs7jrvwAAAMg"]
[Tue Mar 31 06:24:42.608247 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:12595] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bjfl.php"] [unique_id "acr4Ki-R9nOaA8Xqs7jrxQAAAM4"]
[Tue Mar 31 06:24:43.370726 2026] [:error] [pid 18333:tid 18394] [client 20.107.195.165:44800] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acr4K0Sx2C5hLR0-8dIMxgAAAE8"]
[Tue Mar 31 06:24:44.087840 2026] [:error] [pid 18333:tid 18401] [client 20.107.195.165:24432] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acr4LESx2C5hLR0-8dIMywAAAFY"]
[Tue Mar 31 06:24:44.768195 2026] [:error] [pid 11869:tid 11885] [client 20.107.195.165:26718] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acr4LBvAVplg9I6KoIInewAAAc0"]
[Tue Mar 31 06:24:45.608916 2026] [:error] [pid 18334:tid 18416] [client 20.107.195.165:24444] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "acr4LXqQrXLbk1cg3mhb_gAAAIo"]
[Tue Mar 31 06:24:46.286313 2026] [:error] [pid 1224:tid 1229] [client 20.107.195.165:44818] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "acr4LsXGPQPzIHnCuJhG0AAAAQM"]
[Tue Mar 31 06:24:46.939773 2026] [:error] [pid 1224:tid 1235] [client 20.107.195.165:24447] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "acr4LsXGPQPzIHnCuJhG0gAAAQk"]
[Tue Mar 31 06:24:47.596548 2026] [:error] [pid 1224:tid 1231] [client 20.107.195.165:54164] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "acr4L8XGPQPzIHnCuJhG1QAAAQU"]
[Tue Mar 31 06:24:48.274106 2026] [:error] [pid 1224:tid 1237] [client 20.107.195.165:65220] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "acr4MMXGPQPzIHnCuJhG1wAAAQs"]
[Tue Mar 31 06:24:49.010172 2026] [:error] [pid 11907:tid 11919] [client 20.107.195.165:54151] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acr4MccoKGLZkBF4Ym1Z0wAAAgk"]
[Tue Mar 31 06:24:49.672569 2026] [:error] [pid 18333:tid 18403] [client 20.107.195.165:44822] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acr4MUSx2C5hLR0-8dIM4wAAAFg"]
[Tue Mar 31 06:24:50.221681 2026] [:error] [pid 18333:tid 18399] [client 20.107.195.165:54165] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acr4MkSx2C5hLR0-8dIM6QAAAFQ"]
[Tue Mar 31 06:24:50.827914 2026] [:error] [pid 11786:tid 11790] [client 20.107.195.165:65223] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "acr4Mk-ANHwuqDZumRDaygAAAUI"]
[Tue Mar 31 06:24:51.432409 2026] [:error] [pid 11907:tid 11927] [client 20.107.195.165:44827] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acr4M8coKGLZkBF4Ym1Z2AAAAhE"]
[Tue Mar 31 06:24:51.987689 2026] [:error] [pid 11907:tid 11910] [client 20.107.195.165:54198] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acr4M8coKGLZkBF4Ym1Z2QAAAgA"]
[Tue Mar 31 06:24:52.531275 2026] [:error] [pid 11869:tid 11891] [client 20.107.195.165:24433] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acr4NBvAVplg9I6KoIInfgAAAdM"]
[Tue Mar 31 06:24:53.182020 2026] [:error] [pid 1224:tid 1249] [client 20.107.195.165:44807] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "acr4NcXGPQPzIHnCuJhG4gAAARc"]
[Tue Mar 31 06:24:53.735609 2026] [:error] [pid 18332:tid 18354] [client 20.107.195.165:25288] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acr4Nb4KXr1F9raS5GSnMQAAAAY"]
[Tue Mar 31 06:24:54.305183 2026] [:error] [pid 11869:tid 11879] [client 20.107.195.165:40148] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acr4NhvAVplg9I6KoIInggAAAcc"]
[Tue Mar 31 06:24:54.842522 2026] [:error] [pid 11822:tid 11843] [client 20.107.195.165:44821] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acr4NiLLrL4a3YEM2I0MqAAAAZM"]
[Tue Mar 31 06:24:55.466111 2026] [:error] [pid 11822:tid 11840] [client 20.107.195.165:54159] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "acr4NyLLrL4a3YEM2I0MqwAAAZA"]
[Tue Mar 31 06:24:56.117229 2026] [:error] [pid 1224:tid 1230] [client 20.107.195.165:26717] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acr4OMXGPQPzIHnCuJhG5gAAAQQ"]
[Tue Mar 31 06:24:56.684858 2026] [:error] [pid 1224:tid 1236] [client 20.107.195.165:44816] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acr4OMXGPQPzIHnCuJhG6AAAAQo"]
[Tue Mar 31 06:24:57.274664 2026] [:error] [pid 1224:tid 1246] [client 20.107.195.165:44819] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acr4OcXGPQPzIHnCuJhG7QAAARQ"]
[Tue Mar 31 06:24:57.803366 2026] [:error] [pid 18334:tid 18421] [client 20.107.195.165:54188] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "acr4OXqQrXLbk1cg3mhcDAAAAI8"]
[Tue Mar 31 06:24:58.339323 2026] [:error] [pid 1224:tid 1248] [client 20.107.195.165:40191] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "acr4OsXGPQPzIHnCuJhG8QAAARY"]
[Tue Mar 31 06:24:58.877476 2026] [:error] [pid 1224:tid 1231] [client 20.107.195.165:24402] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "acr4OsXGPQPzIHnCuJhG8wAAAQU"]
[Tue Mar 31 06:24:59.439468 2026] [:error] [pid 18334:tid 18412] [client 20.107.195.165:40180] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "acr4O3qQrXLbk1cg3mhcDwAAAIY"]
[Tue Mar 31 06:24:59.959555 2026] [:error] [pid 11869:tid 11886] [client 20.107.195.165:44825] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanda.php"] [unique_id "acr4OxvAVplg9I6KoIInhQAAAc4"]
[Tue Mar 31 06:25:00.524154 2026] [:error] [pid 11907:tid 11931] [client 20.107.195.165:26749] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr4PMcoKGLZkBF4Ym1Z6AAAAhU"]
[Tue Mar 31 06:25:01.078764 2026] [:error] [pid 1224:tid 1236] [client 20.107.195.165:54156] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr4PcXGPQPzIHnCuJhG-QAAAQo"]
[Tue Mar 31 06:25:01.616450 2026] [:error] [pid 11822:tid 11829] [client 20.107.195.165:40183] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr4PSLLrL4a3YEM2I0MsAAAAYU"]
[Tue Mar 31 06:25:02.124224 2026] [:error] [pid 1224:tid 1249] [client 20.107.195.165:19897] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "acr4PsXGPQPzIHnCuJhG_AAAARc"]
[Tue Mar 31 06:25:02.719666 2026] [:error] [pid 18333:tid 18386] [client 20.107.195.165:40143] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acr4PkSx2C5hLR0-8dIM_QAAAEc"]
[Tue Mar 31 06:25:03.256077 2026] [:error] [pid 1224:tid 1237] [client 20.107.195.165:54175] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acr4P8XGPQPzIHnCuJhG_gAAAQs"]
[Tue Mar 31 06:25:03.835780 2026] [:error] [pid 11822:tid 11830] [client 20.107.195.165:19894] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acr4PyLLrL4a3YEM2I0MsgAAAYY"]
[Tue Mar 31 06:25:04.351594 2026] [:error] [pid 1224:tid 1228] [client 20.107.195.165:19882] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cu.php"] [unique_id "acr4QMXGPQPzIHnCuJhHAAAAAQI"]
[Tue Mar 31 06:25:04.856581 2026] [:error] [pid 1224:tid 1242] [client 20.107.195.165:54193] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "acr4QMXGPQPzIHnCuJhHBgAAARA"]
[Tue Mar 31 06:25:05.363893 2026] [:error] [pid 18439:tid 18466] [client 20.107.195.165:54171] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "acr4QS-R9nOaA8Xqs7jr5wAAAM8"]
[Tue Mar 31 06:25:05.927198 2026] [:error] [pid 18439:tid 18454] [client 20.107.195.165:24389] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "acr4QS-R9nOaA8Xqs7jr6QAAAMM"]
[Tue Mar 31 06:25:06.441439 2026] [:error] [pid 18333:tid 18392] [client 20.107.195.165:54167] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "acr4QkSx2C5hLR0-8dINBwAAAE0"]
[Tue Mar 31 06:25:07.037216 2026] [:error] [pid 11822:tid 11836] [client 20.107.195.165:40168] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acr4QyLLrL4a3YEM2I0MtwAAAYw"]
[Tue Mar 31 06:25:07.569937 2026] [:error] [pid 11822:tid 11840] [client 20.107.195.165:19892] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "acr4QyLLrL4a3YEM2I0MuQAAAZA"]
[Tue Mar 31 06:25:08.147919 2026] [:error] [pid 18439:tid 18464] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Tue Mar 31 06:25:08.402344 2026] [:error] [pid 18439:tid 18461] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Tue Mar 31 06:25:08.652771 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/aa21.php
[Tue Mar 31 06:25:08.904902 2026] [:error] [pid 18439:tid 18452] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Mar 31 06:25:09.161268 2026] [:error] [pid 18439:tid 18466] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Tue Mar 31 06:25:10.571644 2026] [:error] [pid 18439:tid 18466] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/bootstrap.php
[Tue Mar 31 06:25:11.080843 2026] [:error] [pid 18439:tid 18474] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Tue Mar 31 06:25:11.334722 2026] [:error] [pid 18439:tid 18460] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/csv.php
[Tue Mar 31 06:25:11.585876 2026] [:error] [pid 18439:tid 18462] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/varb.php
[Tue Mar 31 06:25:11.842488 2026] [:error] [pid 18439:tid 18464] [client 20.107.195.165:54145] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Mar 31 06:25:12.090772 2026] [:error] [pid 18439:tid 18461] [client 20.107.195.165:54145] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "acr4SC-R9nOaA8Xqs7jr_wAAAMo"]
[Tue Mar 31 06:25:12.637425 2026] [:error] [pid 18439:tid 18465] [client 20.107.195.165:25327] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "acr4SC-R9nOaA8Xqs7jsAQAAAM4"]
[Tue Mar 31 06:25:13.192910 2026] [:error] [pid 1224:tid 1238] [client 20.107.195.165:19852] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "acr4ScXGPQPzIHnCuJhHGgAAAQw"]
[Tue Mar 31 06:25:13.774038 2026] [:error] [pid 18334:tid 18414] [client 20.107.195.165:25280] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "acr4SXqQrXLbk1cg3mhcLQAAAIg"]
[Tue Mar 31 06:25:14.338306 2026] [:error] [pid 18439:tid 18451] [client 20.107.195.165:25334] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acr4Si-R9nOaA8Xqs7jsCAAAAMA"]
[Tue Mar 31 06:25:14.958338 2026] [:error] [pid 18439:tid 18472] [client 20.107.195.165:19884] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acr4Si-R9nOaA8Xqs7jsEAAAANU"]
[Tue Mar 31 06:25:15.521479 2026] [:error] [pid 1224:tid 1235] [client 20.107.195.165:40129] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acr4S8XGPQPzIHnCuJhHHQAAAQk"]
[Tue Mar 31 06:25:16.057606 2026] [:error] [pid 11869:tid 11879] [client 20.107.195.165:40189] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "acr4TBvAVplg9I6KoIInjwAAAcc"]
[Tue Mar 31 06:25:16.620084 2026] [:error] [pid 18334:tid 18419] [client 20.107.195.165:54186] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acr4THqQrXLbk1cg3mhcPAAAAI0"]
[Tue Mar 31 06:25:17.158176 2026] [:error] [pid 18333:tid 18386] [client 20.107.195.165:19883] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acr4TUSx2C5hLR0-8dINGQAAAEc"]
[Tue Mar 31 06:25:17.755028 2026] [:error] [pid 18334:tid 18411] [client 20.107.195.165:44845] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acr4TXqQrXLbk1cg3mhcQQAAAIU"]
[Tue Mar 31 06:25:18.293496 2026] [:error] [pid 11907:tid 11927] [client 20.107.195.165:40138] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "acr4TscoKGLZkBF4Ym1Z7QAAAhE"]
[Tue Mar 31 06:25:18.859362 2026] [:error] [pid 18334:tid 18430] [client 20.107.195.165:26732] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acr4TnqQrXLbk1cg3mhcSAAAAJg"]
[Tue Mar 31 06:25:19.467940 2026] [:error] [pid 18333:tid 18381] [client 20.107.195.165:54181] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acr4T0Sx2C5hLR0-8dINHgAAAEI"]
[Tue Mar 31 06:25:20.005489 2026] [:error] [pid 18334:tid 18428] [client 20.107.195.165:54154] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acr4UHqQrXLbk1cg3mhcTQAAAJY"]
[Tue Mar 31 06:25:20.549308 2026] [:error] [pid 18333:tid 18384] [client 20.107.195.165:12570] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "acr4UESx2C5hLR0-8dINIwAAAEU"]
[Tue Mar 31 06:25:21.145615 2026] [:error] [pid 18333:tid 18400] [client 20.107.195.165:54195] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acr4UUSx2C5hLR0-8dINKAAAAFU"]
[Tue Mar 31 06:25:21.852335 2026] [:error] [pid 18333:tid 18381] [client 20.107.195.165:54144] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acr4UUSx2C5hLR0-8dINLgAAAEI"]
[Tue Mar 31 06:25:22.399610 2026] [:error] [pid 18334:tid 18418] [client 20.107.195.165:24430] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acr4UnqQrXLbk1cg3mhcUgAAAIw"]
[Tue Mar 31 06:25:22.992724 2026] [:error] [pid 1224:tid 1246] [client 20.107.195.165:65246] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-footer.php"] [unique_id "acr4UsXGPQPzIHnCuJhHLAAAARQ"]
[Tue Mar 31 06:25:43.897787 2026] [:error] [pid 18439:tid 18470] [client 154.254.134.195:50678] [client 154.254.134.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.254.134.195, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acr4Zy-R9nOaA8Xqs7jsVAAAANM"]
[Tue Mar 31 06:25:43.902731 2026] [:error] [pid 18439:tid 18470] [client 154.254.134.195:50678] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 06:26:00.462826 2026] [:error] [pid 18439:tid 18451] [client 131.221.211.96:64494] [client 131.221.211.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 131.221.211.96, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acr4eC-R9nOaA8Xqs7jscwAAAMA"]
[Tue Mar 31 06:26:00.470142 2026] [:error] [pid 18439:tid 18451] [client 131.221.211.96:64494] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 08:25:21.271904 2026] [:error] [pid 36982:tid 36998] [client 49.37.26.252:52542] [client 49.37.26.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.26.252, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acsUcflMmeoQKN0r_GNyHQAAAM0"]
[Tue Mar 31 08:25:21.276867 2026] [:error] [pid 36982:tid 36998] [client 49.37.26.252:52542] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 09:37:58.281955 2026] [:error] [pid 6548:tid 6560] [client 213.100.10.125:53824] [client 213.100.10.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.100.10.125, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acsldrgIz9HgMl9YwE6iUQAAAUo"]
[Tue Mar 31 09:37:58.300547 2026] [:error] [pid 6548:tid 6560] [client 213.100.10.125:53824] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 12:56:30.366104 2026] [:error] [pid 36982:tid 36993] [client 110.39.1.22:60693] [client 110.39.1.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.39.1.22, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "actT_vlMmeoQKN0r_GNiagAAAMg"]
[Tue Mar 31 12:56:30.370968 2026] [:error] [pid 36982:tid 36993] [client 110.39.1.22:60693] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 12:56:31.880556 2026] [:error] [pid 36892:tid 36968] [client 78.101.15.212:2197] [client 78.101.15.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.15.212, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "actT_0yj9S4G0ek3O4IVpgAAAJE"]
[Tue Mar 31 12:56:31.885210 2026] [:error] [pid 36892:tid 36968] [client 78.101.15.212:2197] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 19:22:59.672505 2026] [:error] [pid 36982:tid 36996] [client 37.114.145.157:1092] [client 37.114.145.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.114.145.157, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acuuk_lMmeoQKN0r_GOQAgAAAMs"]
[Tue Mar 31 19:22:59.677336 2026] [:error] [pid 36982:tid 36996] [client 37.114.145.157:1092] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 20:14:47.120383 2026] [:error] [pid 36892:tid 36975] [client 43.250.252.250:53576] [client 43.250.252.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.250.252.250, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acu6t0yj9S4G0ek3O4KT2wAAAJg"]
[Tue Mar 31 20:14:47.125252 2026] [:error] [pid 36892:tid 36975] [client 43.250.252.250:53576] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 22:26:55.803991 2026] [:error] [pid 36890:tid 36908] [client 107.172.27.154:58080] [client 107.172.27.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aoswa.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "acvZr58FASPd_uH8z7dlxAAAAA0"], referer: https://duckduckgo.com/
[Wed Apr 01 05:50:06.511753 2026] [:error] [pid 23819:tid 23844] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Apr 01 05:50:06.726921 2026] [:error] [pid 23819:tid 23846] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Wed Apr 01 05:50:07.148887 2026] [:error] [pid 23819:tid 23828] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Wed Apr 01 05:50:07.369336 2026] [:error] [pid 23819:tid 23837] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Wed Apr 01 05:50:08.829536 2026] [:error] [pid 23819:tid 23837] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Wed Apr 01 05:50:09.040294 2026] [:error] [pid 23819:tid 23826] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Wed Apr 01 05:50:09.254328 2026] [:error] [pid 23819:tid 23832] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Wed Apr 01 05:50:09.464867 2026] [:error] [pid 23819:tid 23841] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Wed Apr 01 05:50:09.686049 2026] [:error] [pid 23819:tid 23838] [client 20.116.48.67:25158] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Wed Apr 01 05:50:09.893323 2026] [:error] [pid 23819:tid 23825] [client 20.116.48.67:25158] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nz.php"] [unique_id "acxBkddfUS_37wFAM77cMgAAAMM"]
[Wed Apr 01 05:50:10.668006 2026] [:error] [pid 23714:tid 23752] [client 20.116.48.67:25169] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nz.php"] [unique_id "acxBkkHxDDU2ETcG9DSuAQAAABI"]
[Wed Apr 01 05:50:11.277238 2026] [:error] [pid 23819:tid 23833] [client 20.116.48.67:25553] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nz.php"] [unique_id "acxBk9dfUS_37wFAM77cNQAAAMs"]
[Wed Apr 01 05:50:13.177991 2026] [:error] [pid 23715:tid 23772] [client 20.116.48.67:25190] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nz.php"] [unique_id "acxBla-REzOruNbiT9wyKQAAAEs"]
[Wed Apr 01 05:50:15.701332 2026] [:error] [pid 24348:tid 24382] [client 20.116.48.67:25548] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bnn_.php"] [unique_id "acxBl20Vs69Y5nF1HA_GMQAAAYM"]
[Wed Apr 01 05:50:17.528855 2026] [:error] [pid 24348:tid 24383] [client 20.116.48.67:25545] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bnn_.php"] [unique_id "acxBmW0Vs69Y5nF1HA_GNgAAAYQ"]
[Wed Apr 01 05:50:19.860455 2026] [:error] [pid 24346:tid 24355] [client 20.116.48.67:25187] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bnn_.php"] [unique_id "acxBm7c1l8kg9MhGHIJ7mgAAAUM"]
[Wed Apr 01 05:50:20.394924 2026] [:error] [pid 23714:tid 23753] [client 20.116.48.67:25157] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bnn_.php"] [unique_id "acxBnEHxDDU2ETcG9DSuEAAAABM"]
[Wed Apr 01 05:50:21.441521 2026] [:error] [pid 24314:tid 24323] [client 20.116.48.67:25164] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/anz.php"] [unique_id "acxBnZRF3FCzjmMUX5bZUgAAAQU"]
[Wed Apr 01 05:50:22.461634 2026] [:error] [pid 23714:tid 23744] [client 20.116.48.67:25161] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/anz.php"] [unique_id "acxBnkHxDDU2ETcG9DSuGAAAAAo"]
[Wed Apr 01 05:50:23.168612 2026] [:error] [pid 23714:tid 23749] [client 20.116.48.67:25204] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/anz.php"] [unique_id "acxBn0HxDDU2ETcG9DSuHQAAAA8"]
[Wed Apr 01 05:50:23.715401 2026] [:error] [pid 23714:tid 23745] [client 20.116.48.67:25170] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/anz.php"] [unique_id "acxBn0HxDDU2ETcG9DSuIQAAAAs"]
[Wed Apr 01 05:50:24.561351 2026] [:error] [pid 23716:tid 23800] [client 20.116.48.67:25536] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acxBoHVtFUg_mx-RYb5e-wAAAIw"]
[Wed Apr 01 05:50:25.296741 2026] [:error] [pid 23714:tid 23736] [client 20.116.48.67:25542] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acxBoUHxDDU2ETcG9DSuJQAAAAI"]
[Wed Apr 01 05:50:26.462326 2026] [:error] [pid 24314:tid 24324] [client 20.116.48.67:25176] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acxBopRF3FCzjmMUX5bZVwAAAQY"]
[Wed Apr 01 05:50:27.000978 2026] [:error] [pid 23714:tid 23752] [client 20.116.48.67:25193] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wen.php"] [unique_id "acxBo0HxDDU2ETcG9DSuJwAAABI"]
[Wed Apr 01 05:50:27.503623 2026] [:error] [pid 23714:tid 23755] [client 20.116.48.67:25197] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file66.php"] [unique_id "acxBo0HxDDU2ETcG9DSuKwAAABU"]
[Wed Apr 01 05:50:28.053440 2026] [:error] [pid 23714:tid 23738] [client 20.116.48.67:25199] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file66.php"] [unique_id "acxBpEHxDDU2ETcG9DSuLQAAAAQ"]
[Wed Apr 01 05:50:28.665454 2026] [:error] [pid 24346:tid 24366] [client 20.116.48.67:25209] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file66.php"] [unique_id "acxBpLc1l8kg9MhGHIJ7pQAAAU4"]
[Wed Apr 01 05:50:29.363004 2026] [:error] [pid 24348:tid 24385] [client 20.116.48.67:25555] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file66.php"] [unique_id "acxBpW0Vs69Y5nF1HA_GUwAAAYY"]
[Wed Apr 01 05:50:30.230906 2026] [:error] [pid 23819:tid 23831] [client 20.116.48.67:25538] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kure.php"] [unique_id "acxBptdfUS_37wFAM77cRwAAAMk"]
[Wed Apr 01 05:50:30.972064 2026] [:error] [pid 23715:tid 23768] [client 20.116.48.67:25547] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kure.php"] [unique_id "acxBpq-REzOruNbiT9wyRQAAAEc"]
[Wed Apr 01 05:50:31.601101 2026] [:error] [pid 23715:tid 23769] [client 20.116.48.67:25202] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kure.php"] [unique_id "acxBp6-REzOruNbiT9wyRwAAAEg"]
[Wed Apr 01 05:50:32.078509 2026] [:error] [pid 24314:tid 24322] [client 20.116.48.67:25167] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kure.php"] [unique_id "acxBqJRF3FCzjmMUX5bZWgAAAQQ"]
[Wed Apr 01 05:50:32.622275 2026] [:error] [pid 24314:tid 24320] [client 20.116.48.67:25550] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/blnux.php"] [unique_id "acxBqJRF3FCzjmMUX5bZXAAAAQI"]
[Wed Apr 01 05:50:33.291906 2026] [:error] [pid 24346:tid 24375] [client 20.116.48.67:25196] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/blnux.php"] [unique_id "acxBqbc1l8kg9MhGHIJ7rQAAAVc"]
[Wed Apr 01 05:50:33.937501 2026] [:error] [pid 23715:tid 23777] [client 20.116.48.67:25500] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/blnux.php"] [unique_id "acxBqa-REzOruNbiT9wySAAAAFA"]
[Wed Apr 01 05:50:34.516483 2026] [:error] [pid 24314:tid 24331] [client 20.116.48.67:25183] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/blnux.php"] [unique_id "acxBqpRF3FCzjmMUX5bZYAAAAQ0"]
[Wed Apr 01 05:50:35.124714 2026] [:error] [pid 23715:tid 23764] [client 20.116.48.67:25168] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gaje.php"] [unique_id "acxBq6-REzOruNbiT9wyTQAAAEM"]
[Wed Apr 01 05:50:35.797923 2026] [:error] [pid 24346:tid 24360] [client 20.116.48.67:25178] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gaje.php"] [unique_id "acxBq7c1l8kg9MhGHIJ7swAAAUg"]
[Wed Apr 01 05:50:36.572367 2026] [:error] [pid 24314:tid 24335] [client 20.116.48.67:25207] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gaje.php"] [unique_id "acxBrJRF3FCzjmMUX5bZYwAAARE"]
[Wed Apr 01 05:50:36.994194 2026] [:error] [pid 23715:tid 23769] [client 20.116.48.67:25203] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gaje.php"] [unique_id "acxBrK-REzOruNbiT9wyUQAAAEg"]
[Wed Apr 01 05:50:37.449203 2026] [:error] [pid 23716:tid 23808] [client 20.116.48.67:25544] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/msy.php"] [unique_id "acxBrXVtFUg_mx-RYb5fCAAAAJQ"]
[Wed Apr 01 05:50:38.452609 2026] [:error] [pid 24314:tid 24340] [client 20.116.48.67:25200] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/msy.php"] [unique_id "acxBrpRF3FCzjmMUX5bZZQAAARY"]
[Wed Apr 01 05:50:38.932699 2026] [:error] [pid 23819:tid 23835] [client 20.116.48.67:25162] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/msy.php"] [unique_id "acxBrtdfUS_37wFAM77cSgAAAM0"]
[Wed Apr 01 05:50:39.403777 2026] [:error] [pid 23819:tid 23837] [client 20.116.48.67:25184] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/msy.php"] [unique_id "acxBr9dfUS_37wFAM77cSwAAAM8"]
[Wed Apr 01 05:50:40.096385 2026] [:error] [pid 24348:tid 24379] [client 20.116.48.67:25163] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fgd.php"] [unique_id "acxBsG0Vs69Y5nF1HA_GWgAAAYA"]
[Wed Apr 01 05:50:40.909942 2026] [:error] [pid 24348:tid 24380] [client 20.116.48.67:25174] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fgd.php"] [unique_id "acxBsG0Vs69Y5nF1HA_GXAAAAYE"]
[Wed Apr 01 05:50:41.574120 2026] [:error] [pid 24314:tid 24333] [client 20.116.48.67:25198] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fgd.php"] [unique_id "acxBsZRF3FCzjmMUX5bZaQAAAQ8"]
[Wed Apr 01 05:50:42.851738 2026] [:error] [pid 23714:tid 23734] [client 20.116.48.67:25165] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fgd.php"] [unique_id "acxBskHxDDU2ETcG9DSuOwAAAAA"]
[Wed Apr 01 05:50:43.282249 2026] [:error] [pid 23715:tid 23784] [client 20.116.48.67:25179] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X7T6.php"] [unique_id "acxBs6-REzOruNbiT9wyWAAAAFc"]
[Wed Apr 01 05:50:43.736701 2026] [:error] [pid 23715:tid 23775] [client 20.116.48.67:25596] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X7T6.php"] [unique_id "acxBs6-REzOruNbiT9wyWwAAAE4"]
[Wed Apr 01 05:50:44.168630 2026] [:error] [pid 24346:tid 24355] [client 20.116.48.67:25194] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X7T6.php"] [unique_id "acxBtLc1l8kg9MhGHIJ7tQAAAUM"]
[Wed Apr 01 05:50:44.621312 2026] [:error] [pid 24314:tid 24338] [client 20.116.48.67:25539] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/X7T6.php"] [unique_id "acxBtJRF3FCzjmMUX5bZbwAAARQ"]
[Wed Apr 01 05:50:45.348617 2026] [:error] [pid 24346:tid 24363] [client 20.116.48.67:25557] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alog.php"] [unique_id "acxBtbc1l8kg9MhGHIJ7twAAAUs"]
[Wed Apr 01 05:50:46.457632 2026] [:error] [pid 23714:tid 23743] [client 20.116.48.67:25546] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alog.php"] [unique_id "acxBtkHxDDU2ETcG9DSuSAAAAAk"]
[Wed Apr 01 05:50:47.207671 2026] [:error] [pid 23715:tid 23785] [client 20.116.48.67:25572] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alog.php"] [unique_id "acxBt6-REzOruNbiT9wyYQAAAFg"]
[Wed Apr 01 05:50:48.174714 2026] [:error] [pid 23714:tid 23754] [client 20.116.48.67:25185] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alog.php"] [unique_id "acxBuEHxDDU2ETcG9DSuTwAAABQ"]
[Wed Apr 01 05:50:49.378659 2026] [:error] [pid 23715:tid 23763] [client 20.116.48.67:25213] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "acxBua-REzOruNbiT9wyYwAAAEI"]
[Wed Apr 01 05:50:49.945770 2026] [:error] [pid 23714:tid 23738] [client 20.116.48.67:25589] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "acxBuUHxDDU2ETcG9DSuWQAAAAQ"]
[Wed Apr 01 05:50:50.399119 2026] [:error] [pid 23715:tid 23767] [client 20.116.48.67:25568] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "acxBuq-REzOruNbiT9wyagAAAEY"]
[Wed Apr 01 05:50:50.827544 2026] [:error] [pid 23714:tid 23747] [client 20.116.48.67:25195] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "acxBukHxDDU2ETcG9DSuXQAAAA0"]
[Wed Apr 01 05:50:51.344973 2026] [:error] [pid 23714:tid 23743] [client 20.116.48.67:25476] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sef.php"] [unique_id "acxBu0HxDDU2ETcG9DSuYAAAAAk"]
[Wed Apr 01 05:50:52.168565 2026] [:error] [pid 24346:tid 24368] [client 20.116.48.67:25586] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sef.php"] [unique_id "acxBvLc1l8kg9MhGHIJ7vgAAAVA"]
[Wed Apr 01 05:50:53.543772 2026] [:error] [pid 23819:tid 23841] [client 20.116.48.67:25472] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sef.php"] [unique_id "acxBvddfUS_37wFAM77cVwAAANM"]
[Wed Apr 01 05:50:54.499823 2026] [:error] [pid 23819:tid 23822] [client 20.116.48.67:25154] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sef.php"] [unique_id "acxBvtdfUS_37wFAM77cWgAAAMA"]
[Wed Apr 01 05:50:55.725970 2026] [:error] [pid 24348:tid 24387] [client 20.116.48.67:25559] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ztv.php"] [unique_id "acxBv20Vs69Y5nF1HA_GawAAAYg"]
[Wed Apr 01 05:50:56.158432 2026] [:error] [pid 23714:tid 23758] [client 20.116.48.67:25588] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ztv.php"] [unique_id "acxBwEHxDDU2ETcG9DSuagAAABg"]
[Wed Apr 01 05:50:56.746019 2026] [:error] [pid 24346:tid 24359] [client 20.116.48.67:25549] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ztv.php"] [unique_id "acxBwLc1l8kg9MhGHIJ7wwAAAUc"]
[Wed Apr 01 05:50:57.275254 2026] [:error] [pid 23714:tid 23739] [client 20.116.48.67:25215] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ztv.php"] [unique_id "acxBwUHxDDU2ETcG9DSucAAAAAU"]
[Wed Apr 01 05:50:57.935993 2026] [:error] [pid 23715:tid 23776] [client 20.116.48.67:25543] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Rk41.php"] [unique_id "acxBwa-REzOruNbiT9wybwAAAE8"]
[Wed Apr 01 05:50:58.696836 2026] [:error] [pid 24346:tid 24354] [client 20.116.48.67:25551] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Rk41.php"] [unique_id "acxBwrc1l8kg9MhGHIJ7xwAAAUI"]
[Wed Apr 01 05:50:59.192632 2026] [:error] [pid 24346:tid 24364] [client 20.116.48.67:25585] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Rk41.php"] [unique_id "acxBw7c1l8kg9MhGHIJ7yAAAAUw"]
[Wed Apr 01 05:51:00.127962 2026] [:error] [pid 23715:tid 23777] [client 20.116.48.67:25571] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Rk41.php"] [unique_id "acxBxK-REzOruNbiT9wydQAAAFA"]
[Wed Apr 01 05:51:00.737973 2026] [:error] [pid 23819:tid 23845] [client 20.116.48.67:25206] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "acxBxNdfUS_37wFAM77cYQAAANc"]
[Wed Apr 01 05:51:01.633899 2026] [:error] [pid 23715:tid 23766] [client 20.116.48.67:25475] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acxBxa-REzOruNbiT9wyeAAAAEU"]
[Wed Apr 01 05:51:02.191696 2026] [:error] [pid 24348:tid 24390] [client 20.116.48.67:25155] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acxBxm0Vs69Y5nF1HA_GbQAAAYs"]
[Wed Apr 01 05:51:02.648307 2026] [:error] [pid 24348:tid 24401] [client 20.116.48.67:25576] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acxBxm0Vs69Y5nF1HA_GbgAAAZY"]
[Wed Apr 01 05:51:03.294160 2026] [:error] [pid 24346:tid 24370] [client 20.116.48.67:25166] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/fm.php"] [unique_id "acxBx7c1l8kg9MhGHIJ7zAAAAVI"]
[Wed Apr 01 05:51:04.035630 2026] [:error] [pid 24314:tid 24341] [client 20.116.48.67:25591] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/fm.php"] [unique_id "acxByJRF3FCzjmMUX5bZhQAAARc"]
[Wed Apr 01 05:51:04.774296 2026] [:error] [pid 24348:tid 24395] [client 20.116.48.67:25173] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/fm.php"] [unique_id "acxByG0Vs69Y5nF1HA_GcAAAAZA"]
[Wed Apr 01 05:51:05.600054 2026] [:error] [pid 24348:tid 24403] [client 20.116.48.67:25540] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/fm.php"] [unique_id "acxByW0Vs69Y5nF1HA_GcQAAAZg"]
[Wed Apr 01 05:51:06.183148 2026] [:error] [pid 23714:tid 23741] [client 20.116.48.67:25570] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "acxBykHxDDU2ETcG9DSuigAAAAc"]
[Wed Apr 01 05:51:06.646330 2026] [:error] [pid 24314:tid 24338] [client 20.116.48.67:25579] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "acxBypRF3FCzjmMUX5bZiAAAARQ"]
[Wed Apr 01 05:51:07.615085 2026] [:error] [pid 24314:tid 24329] [client 20.116.48.67:25483] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Apr 01 05:51:07.824907 2026] [:error] [pid 24314:tid 24331] [client 20.116.48.67:25483] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Wed Apr 01 05:51:08.245029 2026] [:error] [pid 24314:tid 24318] [client 20.116.48.67:25483] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/fm.php"] [unique_id "acxBzJRF3FCzjmMUX5bZkQAAAQA"]
[Wed Apr 01 05:51:09.083546 2026] [:error] [pid 23714:tid 23749] [client 20.116.48.67:25490] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Apr 01 05:51:09.924971 2026] [:error] [pid 23714:tid 23740] [client 20.116.48.67:25490] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Apr 01 05:51:10.143051 2026] [:error] [pid 23714:tid 23734] [client 20.116.48.67:25490] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "acxBzkHxDDU2ETcG9DSunwAAAAA"]
[Wed Apr 01 05:51:10.940635 2026] [:error] [pid 23819:tid 23841] [client 20.116.48.67:25201] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "acxBztdfUS_37wFAM77cawAAANM"]
[Wed Apr 01 05:51:11.698805 2026] [:error] [pid 23714:tid 23744] [client 20.116.48.67:25418] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "acxBz0HxDDU2ETcG9DSuowAAAAo"]
[Wed Apr 01 05:51:12.197874 2026] [:error] [pid 24348:tid 24382] [client 20.116.48.67:25437] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "acxB0G0Vs69Y5nF1HA_GfAAAAYM"]
[Wed Apr 01 05:51:12.783168 2026] [:error] [pid 23714:tid 23752] [client 20.116.48.67:25212] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "acxB0EHxDDU2ETcG9DSuqAAAABI"]
[Wed Apr 01 05:51:13.718222 2026] [:error] [pid 23714:tid 23757] [client 20.116.48.67:25581] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "acxB0UHxDDU2ETcG9DSuqgAAABc"]
[Wed Apr 01 05:51:14.408880 2026] [:error] [pid 23714:tid 23739] [client 20.116.48.67:25177] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "acxB0kHxDDU2ETcG9DSurQAAAAU"]
[Wed Apr 01 05:51:14.869878 2026] [:error] [pid 24348:tid 24398] [client 20.116.48.67:25592] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "acxB0m0Vs69Y5nF1HA_GggAAAZM"]
[Wed Apr 01 05:51:15.425650 2026] [:error] [pid 23714:tid 23751] [client 20.116.48.67:25564] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "acxB00HxDDU2ETcG9DSutAAAABE"]
[Wed Apr 01 05:51:16.052787 2026] [:error] [pid 23714:tid 23750] [client 20.116.48.67:25205] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "acxB1EHxDDU2ETcG9DSutwAAABA"]
[Wed Apr 01 05:51:16.582815 2026] [:error] [pid 23714:tid 23757] [client 20.116.48.67:25594] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "acxB1EHxDDU2ETcG9DSuuAAAABc"]
[Wed Apr 01 05:51:17.142629 2026] [:error] [pid 23714:tid 23755] [client 20.116.48.67:25573] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "acxB1UHxDDU2ETcG9DSuuQAAABU"]
[Wed Apr 01 05:51:17.909351 2026] [:error] [pid 23714:tid 23737] [client 20.116.48.67:25577] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "acxB1UHxDDU2ETcG9DSuugAAAAM"]
[Wed Apr 01 05:51:18.589869 2026] [:error] [pid 23714:tid 23745] [client 20.116.48.67:25479] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "acxB1kHxDDU2ETcG9DSuvAAAAAs"]
[Wed Apr 01 05:51:19.050124 2026] [:error] [pid 24346:tid 24362] [client 20.116.48.67:25480] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "acxB17c1l8kg9MhGHIJ74AAAAUo"]
[Wed Apr 01 05:51:19.527972 2026] [:error] [pid 23715:tid 23776] [client 20.116.48.67:25491] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "acxB16-REzOruNbiT9wyggAAAE8"]
[Wed Apr 01 05:51:20.279190 2026] [:error] [pid 23715:tid 23779] [client 20.116.48.67:25489] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acxB2K-REzOruNbiT9wyhgAAAFI"]
[Wed Apr 01 05:51:20.802407 2026] [:error] [pid 23819:tid 23823] [client 20.116.48.67:25485] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "acxB2NdfUS_37wFAM77cbwAAAME"]
[Wed Apr 01 05:51:21.244642 2026] [:error] [pid 24348:tid 24402] [client 20.116.48.67:25509] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "acxB2W0Vs69Y5nF1HA_GhgAAAZc"]
[Wed Apr 01 05:51:21.982944 2026] [:error] [pid 24346:tid 24366] [client 20.116.48.67:25171] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "acxB2bc1l8kg9MhGHIJ75AAAAU4"]
[Wed Apr 01 05:51:22.421852 2026] [:error] [pid 24346:tid 24354] [client 20.116.48.67:25526] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "acxB2rc1l8kg9MhGHIJ75QAAAUI"]
[Wed Apr 01 05:51:22.873301 2026] [:error] [pid 23714:tid 23739] [client 20.116.48.67:25574] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "acxB2kHxDDU2ETcG9DSuygAAAAU"]
[Wed Apr 01 05:51:23.486451 2026] [:error] [pid 24346:tid 24375] [client 20.116.48.67:25560] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "acxB27c1l8kg9MhGHIJ75gAAAVc"]
[Wed Apr 01 05:51:23.947631 2026] [:error] [pid 24346:tid 24358] [client 20.116.48.67:25506] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "acxB27c1l8kg9MhGHIJ76AAAAUY"]
[Wed Apr 01 05:51:24.374893 2026] [:error] [pid 23714:tid 23751] [client 20.116.48.67:25582] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "acxB3EHxDDU2ETcG9DSu0wAAABE"]
[Wed Apr 01 05:51:24.905141 2026] [:error] [pid 23714:tid 23740] [client 20.116.48.67:25554] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "acxB3EHxDDU2ETcG9DSu1QAAAAY"]
[Wed Apr 01 05:51:25.355775 2026] [:error] [pid 23714:tid 23755] [client 20.116.48.67:25552] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/install.php"] [unique_id "acxB3UHxDDU2ETcG9DSu1wAAABU"]
[Wed Apr 01 05:51:26.179922 2026] [:error] [pid 24348:tid 24382] [client 20.116.48.67:25578] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "acxB3m0Vs69Y5nF1HA_GjAAAAYM"]
[Wed Apr 01 05:51:26.594873 2026] [:error] [pid 23715:tid 23764] [client 20.116.48.67:25495] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "acxB3q-REzOruNbiT9wyjwAAAEM"]
[Wed Apr 01 05:51:27.052560 2026] [:error] [pid 23715:tid 23772] [client 20.116.48.67:25522] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "acxB36-REzOruNbiT9wykQAAAEs"]
[Wed Apr 01 05:51:27.569498 2026] [:error] [pid 23819:tid 23846] [client 20.116.48.67:25516] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/link.php"] [unique_id "acxB39dfUS_37wFAM77ccAAAANg"]
[Wed Apr 01 05:51:28.293225 2026] [:error] [pid 23715:tid 23761] [client 20.116.48.67:25580] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "acxB4K-REzOruNbiT9wymAAAAEA"]
[Wed Apr 01 05:51:28.963933 2026] [:error] [pid 23714:tid 23747] [client 20.116.48.67:25474] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "acxB4EHxDDU2ETcG9DSu3wAAAA0"]
[Wed Apr 01 05:51:29.476679 2026] [:error] [pid 23714:tid 23736] [client 20.116.48.67:25492] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "acxB4UHxDDU2ETcG9DSu4gAAAAI"]
[Wed Apr 01 05:51:29.973290 2026] [:error] [pid 23714:tid 23755] [client 20.116.48.67:25486] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "acxB4UHxDDU2ETcG9DSu5wAAABU"]
[Wed Apr 01 05:51:30.548181 2026] [:error] [pid 23714:tid 23748] [client 20.116.48.67:25499] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "acxB4kHxDDU2ETcG9DSu7AAAAA4"]
[Wed Apr 01 05:51:31.005746 2026] [:error] [pid 23715:tid 23779] [client 20.116.48.67:25558] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "acxB46-REzOruNbiT9wymgAAAFI"]
[Wed Apr 01 05:51:31.496639 2026] [:error] [pid 23715:tid 23776] [client 20.116.48.67:25449] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "acxB46-REzOruNbiT9wymwAAAE8"]
[Wed Apr 01 05:51:32.024773 2026] [:error] [pid 24314:tid 24342] [client 20.116.48.67:25477] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "acxB5JRF3FCzjmMUX5bZmgAAARg"]
[Wed Apr 01 05:51:32.466119 2026] [:error] [pid 23714:tid 23753] [client 20.116.48.67:25508] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/network.php"] [unique_id "acxB5EHxDDU2ETcG9DSu9QAAABM"]
[Wed Apr 01 05:51:33.113978 2026] [:error] [pid 23714:tid 23748] [client 20.116.48.67:25567] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/network.php"] [unique_id "acxB5UHxDDU2ETcG9DSu9wAAAA4"]
[Wed Apr 01 05:51:33.638686 2026] [:error] [pid 23714:tid 23740] [client 20.116.48.67:25493] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/network.php"] [unique_id "acxB5UHxDDU2ETcG9DSu-QAAAAY"]
[Wed Apr 01 05:51:34.250366 2026] [:error] [pid 23714:tid 23744] [client 20.116.48.67:25566] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/network.php"] [unique_id "acxB5kHxDDU2ETcG9DSu_AAAAAo"]
[Wed Apr 01 05:51:34.935924 2026] [:error] [pid 24348:tid 24394] [client 20.116.48.67:25537] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acxB5m0Vs69Y5nF1HA_GkgAAAY8"]
[Wed Apr 01 05:51:35.483814 2026] [:error] [pid 24348:tid 24385] [client 20.116.48.67:25525] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acxB520Vs69Y5nF1HA_GkwAAAYY"]
[Wed Apr 01 05:51:36.210371 2026] [:error] [pid 24348:tid 24388] [client 20.116.48.67:25525] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acxB6G0Vs69Y5nF1HA_GlQAAAYk"]
[Wed Apr 01 05:51:36.751134 2026] [:error] [pid 23715:tid 23771] [client 20.116.48.67:25191] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acxB6K-REzOruNbiT9wyoAAAAEo"]
[Wed Apr 01 05:51:37.181960 2026] [:error] [pid 24348:tid 24395] [client 20.116.48.67:25575] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acxB6W0Vs69Y5nF1HA_GlwAAAZA"]
[Wed Apr 01 05:51:37.793190 2026] [:error] [pid 24346:tid 24357] [client 20.116.48.67:25189] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acxB6bc1l8kg9MhGHIJ78AAAAUU"]
[Wed Apr 01 05:51:38.443162 2026] [:error] [pid 24348:tid 24392] [client 20.116.48.67:25208] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acxB6m0Vs69Y5nF1HA_GnwAAAY0"]
[Wed Apr 01 05:51:39.118815 2026] [:error] [pid 23715:tid 23772] [client 20.116.48.67:25505] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acxB66-REzOruNbiT9wypAAAAEs"]
[Wed Apr 01 05:51:40.073693 2026] [:error] [pid 24346:tid 24362] [client 20.116.48.67:25459] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/file.php"] [unique_id "acxB7Lc1l8kg9MhGHIJ79AAAAUo"]
[Wed Apr 01 05:51:40.719547 2026] [:error] [pid 24314:tid 24335] [client 20.116.48.67:25583] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/file.php"] [unique_id "acxB7JRF3FCzjmMUX5bZpwAAARE"]
[Wed Apr 01 05:51:41.580838 2026] [:error] [pid 24314:tid 24339] [client 20.116.48.67:25153] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/file.php"] [unique_id "acxB7ZRF3FCzjmMUX5bZqgAAARU"]
[Wed Apr 01 05:51:42.182536 2026] [:error] [pid 24348:tid 24395] [client 20.116.48.67:25181] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/file.php"] [unique_id "acxB7m0Vs69Y5nF1HA_GogAAAZA"]
[Wed Apr 01 05:51:42.657590 2026] [:error] [pid 24314:tid 24323] [client 20.116.48.67:25186] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "acxB7pRF3FCzjmMUX5bZrAAAAQU"]
[Wed Apr 01 05:51:43.346643 2026] [:error] [pid 24348:tid 24400] [client 20.116.48.67:25481] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acxB720Vs69Y5nF1HA_GowAAAZU"]
[Wed Apr 01 05:51:43.915019 2026] [:error] [pid 24314:tid 24319] [client 20.116.48.67:25562] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acxB75RF3FCzjmMUX5bZrQAAAQE"]
[Wed Apr 01 05:51:44.634646 2026] [:error] [pid 23716:tid 23801] [client 20.116.48.67:25152] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acxB8HVtFUg_mx-RYb5fJgAAAI0"]
[Wed Apr 01 05:51:45.212532 2026] [:error] [pid 24346:tid 24354] [client 20.116.48.67:25519] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acxB8bc1l8kg9MhGHIJ79wAAAUI"]
[Wed Apr 01 05:51:46.427752 2026] [:error] [pid 24314:tid 24326] [client 20.116.48.67:25535] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "acxB8pRF3FCzjmMUX5bZrgAAAQg"]
[Wed Apr 01 05:51:48.532956 2026] [:error] [pid 23714:tid 23758] [client 20.116.48.67:25498] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acxB9EHxDDU2ETcG9DSvAwAAABg"]
[Wed Apr 01 05:51:49.124429 2026] [:error] [pid 23714:tid 23740] [client 20.116.48.67:25192] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acxB9UHxDDU2ETcG9DSvBQAAAAY"]
[Wed Apr 01 05:51:50.003745 2026] [:error] [pid 23714:tid 23757] [client 20.116.48.67:25487] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acxB9kHxDDU2ETcG9DSvDQAAABc"]
[Wed Apr 01 05:51:50.921184 2026] [:error] [pid 23715:tid 23776] [client 20.116.48.67:25561] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acxB9q-REzOruNbiT9wyrgAAAE8"]
[Wed Apr 01 05:51:51.376221 2026] [:error] [pid 24348:tid 24400] [client 20.116.48.67:25175] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acxB920Vs69Y5nF1HA_GrQAAAZU"]
[Wed Apr 01 05:51:52.383024 2026] [:error] [pid 23715:tid 23780] [client 20.116.48.67:25531] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acxB-K-REzOruNbiT9wysAAAAFM"]
[Wed Apr 01 05:51:53.110505 2026] [:error] [pid 23714:tid 23756] [client 20.116.48.67:25597] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acxB-UHxDDU2ETcG9DSvJwAAABY"]
[Wed Apr 01 05:51:53.657710 2026] [:error] [pid 23714:tid 23753] [client 20.116.48.67:25210] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acxB-UHxDDU2ETcG9DSvKwAAABM"]
[Wed Apr 01 05:51:54.291509 2026] [:error] [pid 23819:tid 23828] [client 20.116.48.67:25503] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acxB-tdfUS_37wFAM77chAAAAMY"]
[Wed Apr 01 05:51:54.744891 2026] [:error] [pid 23714:tid 23736] [client 20.116.48.67:25595] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acxB-kHxDDU2ETcG9DSvNwAAAAI"]
[Wed Apr 01 05:51:55.304128 2026] [:error] [pid 23714:tid 23754] [client 20.116.48.67:25432] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acxB-0HxDDU2ETcG9DSvPQAAABQ"]
[Wed Apr 01 05:51:55.797608 2026] [:error] [pid 23714:tid 23748] [client 20.116.48.67:25417] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acxB-0HxDDU2ETcG9DSvRAAAAA4"]
[Wed Apr 01 05:51:56.467137 2026] [:error] [pid 23715:tid 23770] [client 20.116.48.67:25497] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acxB_K-REzOruNbiT9wyswAAAEk"]
[Wed Apr 01 05:51:56.942214 2026] [:error] [pid 24348:tid 24381] [client 20.116.48.67:25590] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acxB_G0Vs69Y5nF1HA_GsQAAAYI"]
[Wed Apr 01 05:51:57.388699 2026] [:error] [pid 24348:tid 24389] [client 20.116.48.67:25214] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acxB_W0Vs69Y5nF1HA_GtQAAAYo"]
[Wed Apr 01 05:51:58.454473 2026] [:error] [pid 23716:tid 23812] [client 20.116.48.67:25511] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/xp.php"] [unique_id "acxB_nVtFUg_mx-RYb5fMwAAAJg"]
[Wed Apr 01 05:51:58.965006 2026] [:error] [pid 23716:tid 23795] [client 20.116.48.67:25462] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/xp.php"] [unique_id "acxB_nVtFUg_mx-RYb5fOQAAAIc"]
[Wed Apr 01 05:51:59.392768 2026] [:error] [pid 24346:tid 24365] [client 20.116.48.67:25172] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/xp.php"] [unique_id "acxB_7c1l8kg9MhGHIJ8CAAAAU0"]
[Wed Apr 01 05:52:00.080556 2026] [:error] [pid 23714:tid 23741] [client 20.116.48.67:25523] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/css/xp.php"] [unique_id "acxCAEHxDDU2ETcG9DSvSQAAAAc"]
[Wed Apr 01 05:52:00.514702 2026] [:error] [pid 23714:tid 23744] [client 20.116.48.67:25514] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "acxCAEHxDDU2ETcG9DSvTAAAAAo"]
[Wed Apr 01 05:52:00.966624 2026] [:error] [pid 23714:tid 23735] [client 20.116.48.67:25182] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "acxCAEHxDDU2ETcG9DSvTgAAAAE"]
[Wed Apr 01 05:52:01.561760 2026] [:error] [pid 24348:tid 24403] [client 20.116.48.67:25541] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "acxCAW0Vs69Y5nF1HA_GwQAAAZg"]
[Wed Apr 01 05:52:02.015418 2026] [:error] [pid 23715:tid 23769] [client 20.116.48.67:25359] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "acxCAq-REzOruNbiT9wyvgAAAEg"]
[Wed Apr 01 05:52:02.587148 2026] [:error] [pid 24348:tid 24384] [client 20.116.48.67:25441] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "acxCAm0Vs69Y5nF1HA_GygAAAYU"]
[Wed Apr 01 05:52:03.075025 2026] [:error] [pid 24348:tid 24383] [client 20.116.48.67:25211] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "acxCA20Vs69Y5nF1HA_G0AAAAYQ"]
[Wed Apr 01 05:52:03.576955 2026] [:error] [pid 23715:tid 23775] [client 20.116.48.67:25410] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "acxCA6-REzOruNbiT9wywwAAAE4"]
[Wed Apr 01 05:52:04.025380 2026] [:error] [pid 23819:tid 23829] [client 20.116.48.67:25180] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "acxCBNdfUS_37wFAM77cigAAAMc"]
[Wed Apr 01 05:52:04.588147 2026] [:error] [pid 23819:tid 23844] [client 20.116.48.67:25529] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acxCBNdfUS_37wFAM77ciwAAANY"]
[Wed Apr 01 05:52:05.138882 2026] [:error] [pid 24348:tid 24403] [client 20.116.48.67:25453] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "acxCBW0Vs69Y5nF1HA_G4QAAAZg"]
[Wed Apr 01 05:52:05.617859 2026] [:error] [pid 24346:tid 24354] [client 20.116.48.67:25507] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/style.php"] [unique_id "acxCBbc1l8kg9MhGHIJ8DwAAAUI"]
[Wed Apr 01 05:52:06.211290 2026] [:error] [pid 23715:tid 23769] [client 20.116.48.67:25496] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/style.php"] [unique_id "acxCBq-REzOruNbiT9wyygAAAEg"]
[Wed Apr 01 05:52:07.391407 2026] [:error] [pid 23715:tid 23775] [client 20.116.48.67:25598] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/style.php"] [unique_id "acxCB6-REzOruNbiT9wyzgAAAE4"]
[Wed Apr 01 05:52:07.980179 2026] [:error] [pid 23714:tid 23747] [client 20.116.48.67:25482] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/js/style.php"] [unique_id "acxCB0HxDDU2ETcG9DSvXQAAAA0"]
[Wed Apr 01 05:52:08.552427 2026] [:error] [pid 24314:tid 24323] [client 20.116.48.67:25448] [client 20.116.48.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.48.67, incrementing brute counter"] [hostname "www.aoswa.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acxCCJRF3FCzjmMUX5bZwQAAAQU"]
[Wed Apr 01 05:52:08.768184 2026] [:error] [pid 24314:tid 24319] [client 20.116.48.67:25448] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Wed Apr 01 05:52:08.975637 2026] [:error] [pid 24314:tid 24327] [client 20.116.48.67:25448] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "acxCCJRF3FCzjmMUX5bZwwAAAQk"]
[Wed Apr 01 05:52:09.452690 2026] [:error] [pid 23714:tid 23748] [client 20.116.48.67:25501] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "acxCCUHxDDU2ETcG9DSvYgAAAA4"]
[Wed Apr 01 05:52:10.200545 2026] [:error] [pid 23714:tid 23746] [client 20.116.48.67:25447] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acxCCkHxDDU2ETcG9DSvaAAAAAw"]
[Wed Apr 01 05:52:10.718137 2026] [:error] [pid 23714:tid 23754] [client 20.116.48.67:25414] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Wed Apr 01 05:52:10.942730 2026] [:error] [pid 23714:tid 23736] [client 20.116.48.67:25414] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Apr 01 05:52:11.996912 2026] [:error] [pid 23714:tid 23741] [client 20.116.48.67:25414] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "acxCC0HxDDU2ETcG9DSveQAAAAc"]
[Wed Apr 01 05:52:12.681928 2026] [:error] [pid 23714:tid 23756] [client 20.116.48.67:25420] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Apr 01 05:52:12.888403 2026] [:error] [pid 23714:tid 23748] [client 20.116.48.67:25420] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acxCDEHxDDU2ETcG9DSvfgAAAA4"]
[Wed Apr 01 05:52:13.345660 2026] [:error] [pid 24348:tid 24394] [client 20.116.48.67:25452] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acxCDW0Vs69Y5nF1HA_G-QAAAY8"]
[Wed Apr 01 05:52:14.112260 2026] [:error] [pid 23715:tid 23785] [client 20.116.48.67:25347] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acxCDq-REzOruNbiT9wy0gAAAFg"]
[Wed Apr 01 05:52:14.636847 2026] [:error] [pid 23714:tid 23754] [client 20.116.48.67:25426] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acxCDkHxDDU2ETcG9DSvhAAAABQ"]
[Wed Apr 01 05:52:15.232439 2026] [:error] [pid 23714:tid 23744] [client 20.116.48.67:25584] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "acxCD0HxDDU2ETcG9DSviAAAAAo"]
[Wed Apr 01 05:52:15.833774 2026] [:error] [pid 23714:tid 23737] [client 20.116.48.67:25518] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugin.php"] [unique_id "acxCD0HxDDU2ETcG9DSviQAAAAM"]
[Wed Apr 01 05:52:16.337174 2026] [:error] [pid 23714:tid 23743] [client 20.116.48.67:25431] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugin.php"] [unique_id "acxCEEHxDDU2ETcG9DSvjAAAAAk"]
[Wed Apr 01 05:52:17.044896 2026] [:error] [pid 23714:tid 23749] [client 20.116.48.67:25443] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/plugin.php"] [unique_id "acxCEUHxDDU2ETcG9DSvkwAAAA8"]
[Wed Apr 01 05:52:17.539657 2026] [:error] [pid 23715:tid 23765] [client 20.116.48.67:25421] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "acxCEa-REzOruNbiT9wy1QAAAEQ"]
[Wed Apr 01 05:52:18.359463 2026] [:error] [pid 24314:tid 24325] [client 20.116.48.67:25504] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Assets/edit.php"] [unique_id "acxCEpRF3FCzjmMUX5bZzgAAAQc"]
[Wed Apr 01 05:52:18.820918 2026] [:error] [pid 23819:tid 23824] [client 20.116.48.67:25419] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Assets/edit.php"] [unique_id "acxCEtdfUS_37wFAM77cmgAAAMI"]
[Wed Apr 01 05:52:19.346609 2026] [:error] [pid 24348:tid 24386] [client 20.116.48.67:25515] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Assets/edit.php"] [unique_id "acxCE20Vs69Y5nF1HA_G_wAAAYc"]
[Wed Apr 01 05:52:19.984201 2026] [:error] [pid 24348:tid 24398] [client 20.116.48.67:25160] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Assets/edit.php"] [unique_id "acxCE20Vs69Y5nF1HA_HAQAAAZM"]
[Wed Apr 01 05:52:20.498729 2026] [:error] [pid 23714:tid 23751] [client 20.116.48.67:25188] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "acxCFEHxDDU2ETcG9DSvmgAAABE"]
[Wed Apr 01 05:52:21.152837 2026] [:error] [pid 23714:tid 23742] [client 20.116.48.67:25563] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/file.php"] [unique_id "acxCFUHxDDU2ETcG9DSvngAAAAg"]
[Wed Apr 01 05:52:21.992362 2026] [:error] [pid 23715:tid 23762] [client 20.116.48.67:25412] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/file.php"] [unique_id "acxCFa-REzOruNbiT9wy2gAAAEE"]
[Wed Apr 01 05:52:22.449102 2026] [:error] [pid 23715:tid 23780] [client 20.116.48.67:25365] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/file.php"] [unique_id "acxCFq-REzOruNbiT9wy3AAAAFM"]
[Wed Apr 01 05:52:22.978348 2026] [:error] [pid 23715:tid 23766] [client 20.116.48.67:25435] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acxCFq-REzOruNbiT9wy3wAAAEU"]
[Wed Apr 01 05:52:23.557828 2026] [:error] [pid 24348:tid 24400] [client 20.116.48.67:25484] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acxCF20Vs69Y5nF1HA_HEQAAAZU"]
[Wed Apr 01 05:52:24.176725 2026] [:error] [pid 23819:tid 23831] [client 20.116.48.67:25442] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acxCGNdfUS_37wFAM77cnwAAAMk"]
[Wed Apr 01 05:52:24.609507 2026] [:error] [pid 24314:tid 24329] [client 20.116.48.67:25520] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acxCGJRF3FCzjmMUX5bZ0gAAAQs"]
[Wed Apr 01 05:52:25.334771 2026] [:error] [pid 23715:tid 23765] [client 20.116.48.67:25416] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acxCGa-REzOruNbiT9wy4gAAAEQ"]
[Wed Apr 01 05:52:26.219938 2026] [:error] [pid 23819:tid 23836] [client 20.116.48.67:25349] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/packed.php"] [unique_id "acxCGtdfUS_37wFAM77cpQAAAM4"]
[Wed Apr 01 05:52:26.656730 2026] [:error] [pid 23819:tid 23832] [client 20.116.48.67:25460] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/packed.php"] [unique_id "acxCGtdfUS_37wFAM77cqAAAAMo"]
[Wed Apr 01 05:52:27.139271 2026] [:error] [pid 23714:tid 23737] [client 20.116.48.67:25565] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/packed.php"] [unique_id "acxCG0HxDDU2ETcG9DSvpgAAAAM"]
[Wed Apr 01 05:52:27.721038 2026] [:error] [pid 23714:tid 23738] [client 20.116.48.67:25351] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/user.php"] [unique_id "acxCG0HxDDU2ETcG9DSvqQAAAAQ"]
[Wed Apr 01 05:52:28.383141 2026] [:error] [pid 23715:tid 23782] [client 20.116.48.67:25428] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/user.php"] [unique_id "acxCHK-REzOruNbiT9wy6AAAAFU"]
[Wed Apr 01 05:52:29.052958 2026] [:error] [pid 24314:tid 24332] [client 20.116.48.67:25533] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/user.php"] [unique_id "acxCHZRF3FCzjmMUX5bZ2gAAAQ4"]
[Wed Apr 01 05:52:29.741799 2026] [:error] [pid 23819:tid 23845] [client 20.116.48.67:25521] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/user.php"] [unique_id "acxCHddfUS_37wFAM77cqwAAANc"]
[Wed Apr 01 05:52:30.894005 2026] [:error] [pid 23715:tid 23771] [client 20.116.48.67:25556] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "acxCHq-REzOruNbiT9wy7gAAAEo"]
[Wed Apr 01 05:52:32.528722 2026] [:error] [pid 23715:tid 23779] [client 20.116.48.67:25473] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "acxCIK-REzOruNbiT9wy9QAAAFI"]
[Wed Apr 01 05:52:33.695179 2026] [:error] [pid 23715:tid 23774] [client 20.116.48.67:25471] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "acxCIa-REzOruNbiT9wy_QAAAE0"]
[Wed Apr 01 05:52:34.256670 2026] [:error] [pid 24314:tid 24335] [client 20.116.48.67:25445] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "acxCIpRF3FCzjmMUX5bZ3QAAARE"]
[Wed Apr 01 05:52:35.125224 2026] [:error] [pid 23714:tid 23743] [client 20.116.48.67:25461] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.aoswa.com.au"] [uri "/filemanager.php"] [unique_id "acxCI0HxDDU2ETcG9DSvvAAAAAk"]
[Wed Apr 01 05:52:35.938764 2026] [:error] [pid 23714:tid 23742] [client 20.116.48.67:25527] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "acxCI0HxDDU2ETcG9DSvywAAAAg"]
[Wed Apr 01 05:52:36.409273 2026] [:error] [pid 24346:tid 24376] [client 20.116.48.67:25440] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gfile.php"] [unique_id "acxCJLc1l8kg9MhGHIJ8JQAAAVg"]
[Wed Apr 01 05:52:36.993677 2026] [:error] [pid 23716:tid 23807] [client 20.116.48.67:25470] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gfile.php"] [unique_id "acxCJHVtFUg_mx-RYb5fTAAAAJM"]
[Wed Apr 01 05:52:37.450261 2026] [:error] [pid 23819:tid 23831] [client 20.116.48.67:25413] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gfile.php"] [unique_id "acxCJddfUS_37wFAM77csgAAAMk"]
[Wed Apr 01 05:52:38.516065 2026] [:error] [pid 23714:tid 23742] [client 20.116.48.67:25389] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "acxCJkHxDDU2ETcG9DSv8AAAAAg"]
[Wed Apr 01 05:52:38.996226 2026] [:error] [pid 23819:tid 23840] [client 20.116.48.67:25524] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "acxCJtdfUS_37wFAM77ctAAAANI"]
[Wed Apr 01 05:52:39.598166 2026] [:error] [pid 24346:tid 24372] [client 20.116.48.67:25436] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "acxCJ7c1l8kg9MhGHIJ8MgAAAVQ"]
[Wed Apr 01 05:52:40.105439 2026] [:error] [pid 24346:tid 24363] [client 20.116.48.67:25478] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "acxCKLc1l8kg9MhGHIJ8NAAAAUs"]
[Wed Apr 01 05:52:40.686260 2026] [:error] [pid 24346:tid 24375] [client 20.116.48.67:25427] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sty.php"] [unique_id "acxCKLc1l8kg9MhGHIJ8OQAAAVc"]
[Wed Apr 01 05:52:41.389586 2026] [:error] [pid 24346:tid 24365] [client 20.116.48.67:25512] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sty.php"] [unique_id "acxCKbc1l8kg9MhGHIJ8PAAAAU0"]
[Wed Apr 01 05:52:42.100509 2026] [:error] [pid 24346:tid 24361] [client 20.116.48.67:25446] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sty.php"] [unique_id "acxCKrc1l8kg9MhGHIJ8PwAAAUk"]
[Wed Apr 01 05:52:42.772762 2026] [:error] [pid 24348:tid 24379] [client 20.116.48.67:25466] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sty.php"] [unique_id "acxCKm0Vs69Y5nF1HA_HQwAAAYA"]
[Wed Apr 01 05:52:43.300318 2026] [:error] [pid 24348:tid 24397] [client 20.116.48.67:25517] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xxxx.php"] [unique_id "acxCK20Vs69Y5nF1HA_HRgAAAZI"]
[Wed Apr 01 05:52:43.858224 2026] [:error] [pid 24348:tid 24398] [client 20.116.48.67:25454] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xxxx.php"] [unique_id "acxCK20Vs69Y5nF1HA_HSQAAAZM"]
[Wed Apr 01 05:52:44.558044 2026] [:error] [pid 23715:tid 23780] [client 20.116.48.67:25352] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xxxx.php"] [unique_id "acxCLK-REzOruNbiT9wzHgAAAFM"]
[Wed Apr 01 05:52:45.146984 2026] [:error] [pid 24314:tid 24337] [client 20.116.48.67:25409] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xxxx.php"] [unique_id "acxCLZRF3FCzjmMUX5bZ4gAAARM"]
[Wed Apr 01 05:52:45.812043 2026] [:error] [pid 24348:tid 24396] [client 20.116.48.67:25510] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/h.php"] [unique_id "acxCLW0Vs69Y5nF1HA_HUQAAAZE"]
[Wed Apr 01 05:52:46.710625 2026] [:error] [pid 23714:tid 23735] [client 20.116.48.67:25384] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/h.php"] [unique_id "acxCLkHxDDU2ETcG9DSwBQAAAAE"]
[Wed Apr 01 05:52:47.281759 2026] [:error] [pid 23715:tid 23785] [client 20.116.48.67:25532] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/h.php"] [unique_id "acxCL6-REzOruNbiT9wzJAAAAFg"]
[Wed Apr 01 05:52:48.043348 2026] [:error] [pid 23714:tid 23755] [client 20.116.48.67:25395] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/h.php"] [unique_id "acxCMEHxDDU2ETcG9DSwDQAAABU"]
[Wed Apr 01 05:52:49.364894 2026] [:error] [pid 24314:tid 24329] [client 20.116.48.67:25423] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "acxCMZRF3FCzjmMUX5bZ6AAAAQs"]
[Wed Apr 01 05:52:50.451870 2026] [:error] [pid 23714:tid 23734] [client 20.116.48.67:25593] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "acxCMkHxDDU2ETcG9DSwFwAAAAA"]
[Wed Apr 01 05:52:51.951517 2026] [:error] [pid 24346:tid 24352] [client 20.116.48.67:25434] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "acxCM7c1l8kg9MhGHIJ8SwAAAUA"]
[Wed Apr 01 05:52:52.378503 2026] [:error] [pid 23714:tid 23757] [client 20.116.48.67:25304] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "acxCNEHxDDU2ETcG9DSwHQAAABc"]
[Wed Apr 01 05:52:52.825683 2026] [:error] [pid 23715:tid 23763] [client 20.116.48.67:25403] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pp.php"] [unique_id "acxCNK-REzOruNbiT9wzKQAAAEI"]
[Wed Apr 01 05:52:53.748348 2026] [:error] [pid 23715:tid 23771] [client 20.116.48.67:25494] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pp.php"] [unique_id "acxCNa-REzOruNbiT9wzMQAAAEo"]
[Wed Apr 01 05:52:54.783141 2026] [:error] [pid 24314:tid 24328] [client 20.116.48.67:25422] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pp.php"] [unique_id "acxCNpRF3FCzjmMUX5bZ9gAAAQo"]
[Wed Apr 01 05:52:55.247895 2026] [:error] [pid 23819:tid 23838] [client 20.116.48.67:25369] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pp.php"] [unique_id "acxCN9dfUS_37wFAM77cywAAANA"]
[Wed Apr 01 05:52:56.412440 2026] [:error] [pid 23716:tid 23800] [client 20.116.48.67:25463] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sys.php"] [unique_id "acxCOHVtFUg_mx-RYb5fYAAAAIw"]
[Wed Apr 01 05:52:57.644228 2026] [:error] [pid 24346:tid 24356] [client 20.116.48.67:25156] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sys.php"] [unique_id "acxCObc1l8kg9MhGHIJ8UQAAAUQ"]
[Wed Apr 01 05:52:58.959868 2026] [:error] [pid 23714:tid 23752] [client 20.116.48.67:25393] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sys.php"] [unique_id "acxCOkHxDDU2ETcG9DSwLAAAABI"]
[Wed Apr 01 05:53:00.202818 2026] [:error] [pid 23714:tid 23739] [client 20.116.48.67:25402] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sys.php"] [unique_id "acxCPEHxDDU2ETcG9DSwMQAAAAU"]
[Wed Apr 01 05:53:01.504306 2026] [:error] [pid 23819:tid 23836] [client 20.116.48.67:25530] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/txets.php"] [unique_id "acxCPddfUS_37wFAM77c1AAAAM4"]
[Wed Apr 01 05:53:02.515420 2026] [:error] [pid 23819:tid 23830] [client 20.116.48.67:25455] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/txets.php"] [unique_id "acxCPtdfUS_37wFAM77c1wAAAMg"]
[Wed Apr 01 05:53:03.250392 2026] [:error] [pid 23715:tid 23761] [client 20.116.48.67:25379] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/txets.php"] [unique_id "acxCP6-REzOruNbiT9wzRAAAAEA"]
[Wed Apr 01 05:53:03.756995 2026] [:error] [pid 24314:tid 24320] [client 20.116.48.67:25465] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/txets.php"] [unique_id "acxCP5RF3FCzjmMUX5baCgAAAQI"]
[Wed Apr 01 05:53:04.520917 2026] [:error] [pid 24314:tid 24331] [client 20.116.48.67:25362] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "acxCQJRF3FCzjmMUX5baDwAAAQ0"]
[Wed Apr 01 05:53:04.960674 2026] [:error] [pid 23714:tid 23754] [client 20.116.48.67:25367] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "acxCQEHxDDU2ETcG9DSwQQAAABQ"]
[Wed Apr 01 05:53:05.762019 2026] [:error] [pid 23715:tid 23774] [client 20.116.48.67:25358] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "acxCQa-REzOruNbiT9wzTAAAAE0"]
[Wed Apr 01 05:53:06.195884 2026] [:error] [pid 23715:tid 23781] [client 20.116.48.67:25415] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tt.php"] [unique_id "acxCQq-REzOruNbiT9wzUQAAAFQ"]
[Wed Apr 01 05:53:06.649091 2026] [:error] [pid 24348:tid 24385] [client 20.116.48.67:25316] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "acxCQm0Vs69Y5nF1HA_HXgAAAYY"]
[Wed Apr 01 05:53:07.341906 2026] [:error] [pid 23715:tid 23763] [client 20.116.48.67:25387] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "acxCQ6-REzOruNbiT9wzWQAAAEI"]
[Wed Apr 01 05:53:08.280179 2026] [:error] [pid 23715:tid 23784] [client 20.116.48.67:25353] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "acxCRK-REzOruNbiT9wzXAAAAFc"]
[Wed Apr 01 05:53:09.255860 2026] [:error] [pid 24314:tid 24342] [client 20.116.48.67:25354] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "acxCRZRF3FCzjmMUX5baFgAAARg"]
[Wed Apr 01 05:53:09.992619 2026] [:error] [pid 24348:tid 24379] [client 20.116.48.67:25361] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/path.php"] [unique_id "acxCRW0Vs69Y5nF1HA_HZQAAAYA"]
[Wed Apr 01 05:53:10.571289 2026] [:error] [pid 24348:tid 24386] [client 20.116.48.67:25411] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/path.php"] [unique_id "acxCRm0Vs69Y5nF1HA_HZwAAAYc"]
[Wed Apr 01 05:53:11.280906 2026] [:error] [pid 24346:tid 24359] [client 20.116.48.67:25488] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/path.php"] [unique_id "acxCR7c1l8kg9MhGHIJ8ZwAAAUc"]
[Wed Apr 01 05:53:11.763670 2026] [:error] [pid 23819:tid 23841] [client 20.116.48.67:25424] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/path.php"] [unique_id "acxCR9dfUS_37wFAM77c6gAAANM"]
[Wed Apr 01 05:53:12.620806 2026] [:error] [pid 24346:tid 24364] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/wdf.php
[Wed Apr 01 05:53:12.839074 2026] [:error] [pid 24346:tid 24368] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/fleen.php
[Wed Apr 01 05:53:13.047791 2026] [:error] [pid 24346:tid 24352] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-tem.php
[Wed Apr 01 05:53:13.257287 2026] [:error] [pid 24346:tid 24355] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/av6m.php
[Wed Apr 01 05:53:13.476306 2026] [:error] [pid 24346:tid 24359] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/autogooey.php
[Wed Apr 01 05:53:13.701702 2026] [:error] [pid 24346:tid 24371] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/btx25.php
[Wed Apr 01 05:53:15.361805 2026] [:error] [pid 24346:tid 24371] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/mga.php
[Wed Apr 01 05:53:15.570781 2026] [:error] [pid 24346:tid 24373] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Wed Apr 01 05:53:15.785382 2026] [:error] [pid 24346:tid 24365] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/agg.php
[Wed Apr 01 05:53:15.998132 2026] [:error] [pid 24346:tid 24372] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Wed Apr 01 05:53:16.220948 2026] [:error] [pid 24346:tid 24361] [client 20.116.48.67:25285] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Wed Apr 01 05:53:16.426805 2026] [:error] [pid 24346:tid 24357] [client 20.116.48.67:25285] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/G-In.php"] [unique_id "acxCTLc1l8kg9MhGHIJ8ggAAAUU"]
[Wed Apr 01 05:53:17.336051 2026] [:error] [pid 24348:tid 24381] [client 20.116.48.67:25161] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/G-In.php"] [unique_id "acxCTW0Vs69Y5nF1HA_HcgAAAYI"]
[Wed Apr 01 05:53:17.804824 2026] [:error] [pid 24348:tid 24395] [client 20.116.48.67:25300] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/G-In.php"] [unique_id "acxCTW0Vs69Y5nF1HA_HcwAAAZA"]
[Wed Apr 01 05:53:18.268062 2026] [:error] [pid 23716:tid 23808] [client 20.116.48.67:25502] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/G-In.php"] [unique_id "acxCTnVtFUg_mx-RYb5fbwAAAJQ"]
[Wed Apr 01 05:53:18.722567 2026] [:error] [pid 23819:tid 23834] [client 20.116.48.67:25587] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acxCTtdfUS_37wFAM77c9AAAAMw"]
[Wed Apr 01 05:53:19.220645 2026] [:error] [pid 23716:tid 23811] [client 20.116.48.67:25288] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acxCT3VtFUg_mx-RYb5fcQAAAJc"]
[Wed Apr 01 05:53:19.794944 2026] [:error] [pid 23714:tid 23755] [client 20.116.48.67:25391] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acxCT0HxDDU2ETcG9DSwYAAAABU"]
[Wed Apr 01 05:53:20.362723 2026] [:error] [pid 24314:tid 24325] [client 20.116.48.67:25382] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "acxCUJRF3FCzjmMUX5baMgAAAQc"]
[Wed Apr 01 05:53:21.314994 2026] [:error] [pid 23715:tid 23783] [client 20.116.48.67:25394] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acxCUa-REzOruNbiT9wzcQAAAFY"]
[Wed Apr 01 05:53:22.469533 2026] [:error] [pid 23714:tid 23758] [client 20.116.48.67:25372] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acxCUkHxDDU2ETcG9DSwaAAAABg"]
[Wed Apr 01 05:53:23.269143 2026] [:error] [pid 23714:tid 23754] [client 20.116.48.67:25513] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acxCU0HxDDU2ETcG9DSwbgAAABQ"]
[Wed Apr 01 05:53:23.963144 2026] [:error] [pid 23714:tid 23740] [client 20.116.48.67:25378] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "acxCU0HxDDU2ETcG9DSwcwAAAAY"]
[Wed Apr 01 05:53:25.547596 2026] [:error] [pid 24348:tid 24386] [client 20.116.48.67:25528] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "acxCVW0Vs69Y5nF1HA_HfAAAAYc"]
[Wed Apr 01 05:53:26.462251 2026] [:error] [pid 23715:tid 23775] [client 20.116.48.67:25381] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "acxCVq-REzOruNbiT9wzcwAAAE4"]
[Wed Apr 01 05:53:27.019845 2026] [:error] [pid 23714:tid 23736] [client 20.116.48.67:25468] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "acxCV0HxDDU2ETcG9DSwggAAAAI"]
[Wed Apr 01 05:53:27.562877 2026] [:error] [pid 23714:tid 23751] [client 20.116.48.67:25346] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "acxCV0HxDDU2ETcG9DSwhgAAABE"]
[Wed Apr 01 05:53:27.988527 2026] [:error] [pid 23714:tid 23747] [client 20.116.48.67:25284] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "acxCV0HxDDU2ETcG9DSwiwAAAA0"]
[Wed Apr 01 05:53:30.356421 2026] [:error] [pid 24346:tid 24365] [client 20.116.48.67:25330] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "acxCWrc1l8kg9MhGHIJ8kQAAAU0"]
[Wed Apr 01 05:53:31.312633 2026] [:error] [pid 23714:tid 23738] [client 20.116.48.67:25301] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "acxCW0HxDDU2ETcG9DSwlAAAAAQ"]
[Wed Apr 01 05:53:32.143709 2026] [:error] [pid 23715:tid 23765] [client 20.116.48.67:25425] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "acxCXK-REzOruNbiT9wzfAAAAEQ"]
[Wed Apr 01 05:53:32.819555 2026] [:error] [pid 24348:tid 24390] [client 20.116.48.67:25355] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acxCXG0Vs69Y5nF1HA_HigAAAYs"]
[Wed Apr 01 05:53:33.350928 2026] [:error] [pid 23714:tid 23735] [client 20.116.48.67:25433] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acxCXUHxDDU2ETcG9DSwmAAAAAE"]
[Wed Apr 01 05:53:34.143667 2026] [:error] [pid 23714:tid 23740] [client 20.116.48.67:25388] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acxCXkHxDDU2ETcG9DSwnAAAAAY"]
[Wed Apr 01 05:53:35.440771 2026] [:error] [pid 24346:tid 24357] [client 20.116.48.67:25336] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acxCX7c1l8kg9MhGHIJ8lAAAAUU"]
[Wed Apr 01 05:53:36.296893 2026] [:error] [pid 24346:tid 24368] [client 20.116.48.67:25218] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acxCYLc1l8kg9MhGHIJ8lQAAAVA"]
[Wed Apr 01 05:53:36.783407 2026] [:error] [pid 23715:tid 23780] [client 20.116.48.67:25451] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acxCYK-REzOruNbiT9wzgQAAAFM"]
[Wed Apr 01 05:53:38.081573 2026] [:error] [pid 24348:tid 24390] [client 20.116.48.67:25430] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acxCYm0Vs69Y5nF1HA_HlgAAAYs"]
[Wed Apr 01 05:53:39.046455 2026] [:error] [pid 24348:tid 24381] [client 20.116.48.67:25429] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gifclass.php"] [unique_id "acxCY20Vs69Y5nF1HA_HlwAAAYI"]
[Wed Apr 01 05:53:39.869382 2026] [:error] [pid 23819:tid 23824] [client 20.116.48.67:25397] [client 20.116.48.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acxCY9dfUS_37wFAM77dEwAAAMI"]
[Wed Apr 01 05:53:40.349264 2026] [:error] [pid 24346:tid 24355] [client 20.116.48.67:25383] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acxCZLc1l8kg9MhGHIJ8mgAAAUM"]
[Wed Apr 01 05:53:40.928768 2026] [:error] [pid 23819:tid 23827] [client 20.116.48.67:25398] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acxCZNdfUS_37wFAM77dGwAAAMU"]
[Wed Apr 01 05:53:41.470683 2026] [:error] [pid 23819:tid 23825] [client 20.116.48.67:25298] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acxCZddfUS_37wFAM77dHgAAAMM"]
[Wed Apr 01 05:53:42.039038 2026] [:error] [pid 23819:tid 23846] [client 20.116.48.67:25370] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acxCZtdfUS_37wFAM77dIwAAANg"]
[Wed Apr 01 05:53:43.469369 2026] [:error] [pid 23716:tid 23804] [client 20.116.48.67:25392] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acxCZ3VtFUg_mx-RYb5fegAAAJA"]
[Wed Apr 01 05:53:43.898982 2026] [:error] [pid 24348:tid 24379] [client 20.116.48.67:25308] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acxCZ20Vs69Y5nF1HA_HowAAAYA"]
[Wed Apr 01 05:53:44.331277 2026] [:error] [pid 24346:tid 24369] [client 20.116.48.67:25244] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acxCaLc1l8kg9MhGHIJ8nwAAAVE"]
[Wed Apr 01 05:53:45.443564 2026] [:error] [pid 24346:tid 24352] [client 20.116.48.67:25376] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acxCabc1l8kg9MhGHIJ8owAAAUA"]
[Wed Apr 01 05:53:46.038421 2026] [:error] [pid 23714:tid 23750] [client 20.116.48.67:25364] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acxCakHxDDU2ETcG9DSwnwAAABA"]
[Wed Apr 01 05:53:46.612278 2026] [:error] [pid 23714:tid 23749] [client 20.116.48.67:25407] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acxCakHxDDU2ETcG9DSwowAAAA8"]
[Wed Apr 01 05:53:47.638775 2026] [:error] [pid 23715:tid 23778] [client 20.116.48.67:25599] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acxCa6-REzOruNbiT9wzhAAAAFE"]
[Wed Apr 01 05:53:49.067629 2026] [:error] [pid 23715:tid 23774] [client 20.116.48.67:25340] [client 20.116.48.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/assets/css/index.php"] [unique_id "acxCba-REzOruNbiT9wzhgAAAE0"]
[Wed Apr 01 07:49:37.621184 2026] [:error] [pid 23714:tid 23754] [client 20.91.204.128:9427] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Wed Apr 01 07:49:37.887201 2026] [:error] [pid 23714:tid 23739] [client 20.91.204.128:9427] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Wed Apr 01 07:58:38.816827 2026] [:error] [pid 24346:tid 24354] [client 74.248.134.58:40882] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Wed Apr 01 07:58:39.075384 2026] [:error] [pid 24346:tid 24371] [client 74.248.134.58:40882] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Wed Apr 01 08:25:35.714696 2026] [:error] [pid 23714:tid 23755] [client 49.144.164.123:15943] [client 49.144.164.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.144.164.123, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acxl_0HxDDU2ETcG9DQVZgAAABU"]
[Wed Apr 01 08:25:35.720777 2026] [:error] [pid 23714:tid 23755] [client 49.144.164.123:15943] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 01 10:35:51.361363 2026] [:error] [pid 23714:tid 23746] [client 201.177.104.150:57964] [client 201.177.104.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.177.104.150, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acyEh0HxDDU2ETcG9DR9_wAAAAw"]
[Wed Apr 01 10:35:51.368444 2026] [:error] [pid 23714:tid 23746] [client 201.177.104.150:57964] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 01 18:17:22.942909 2026] [:error] [pid 17856:tid 17875] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/fffff.php
[Wed Apr 01 18:17:23.209273 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/xdd.php
[Wed Apr 01 18:17:23.463581 2026] [:error] [pid 17856:tid 17873] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php
[Wed Apr 01 18:17:23.714865 2026] [:error] [pid 17856:tid 17880] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/wdone1.php
[Wed Apr 01 18:17:23.974443 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/ws79.php
[Wed Apr 01 18:17:24.240890 2026] [:error] [pid 17856:tid 17877] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Wed Apr 01 18:17:24.523401 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Wed Apr 01 18:17:24.783879 2026] [:error] [pid 17856:tid 17871] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Wed Apr 01 18:17:25.036372 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/wglum1.php
[Wed Apr 01 18:17:25.289957 2026] [:error] [pid 17856:tid 17867] [client 52.156.211.140:38011] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Wed Apr 01 18:17:25.540014 2026] [:error] [pid 17856:tid 17881] [client 52.156.211.140:38011] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-true.php"] [unique_id "aczwtT7Idlm5j9frhqTEwwAAAFc"]
[Wed Apr 01 18:17:26.055899 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:37968] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-true.php"] [unique_id "aczwtjvP_a0662gDl6AzvwAAAMo"]
[Wed Apr 01 18:17:26.662537 2026] [:error] [pid 8909:tid 8950] [client 52.156.211.140:37997] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-true.php"] [unique_id "aczwtjvP_a0662gDl6AzxAAAAMk"]
[Wed Apr 01 18:17:27.165169 2026] [:error] [pid 8910:tid 8975] [client 52.156.211.140:38001] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-true.php"] [unique_id "aczwt6JZINUcF3tYgEw2GAAAAQc"]
[Wed Apr 01 18:17:28.714197 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:37973] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "aczwuDvP_a0662gDl6AzzwAAAMc"]
[Wed Apr 01 18:17:37.008782 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:38005] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "aczwwT7Idlm5j9frhqTE5wAAAEI"]
[Wed Apr 01 18:17:37.516837 2026] [:error] [pid 8908:tid 8937] [client 52.156.211.140:37976] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "aczwwfkmxtJXGnLdvgA7BwAAAJg"]
[Wed Apr 01 18:17:38.061914 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:37999] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws42.php"] [unique_id "aczwwj7Idlm5j9frhqTE6wAAAEU"]
[Wed Apr 01 18:17:41.449205 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:37930] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aczwxT7Idlm5j9frhqTFAwAAAEo"]
[Wed Apr 01 18:17:41.957113 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:37990] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aczwxTvP_a0662gDl6Az_wAAAMQ"]
[Wed Apr 01 18:17:43.489887 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:38003] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aczwxz7Idlm5j9frhqTFDwAAAFI"]
[Wed Apr 01 18:17:44.009217 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:37890] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "aczwyD7Idlm5j9frhqTFFAAAAEI"]
[Wed Apr 01 18:17:44.540001 2026] [:error] [pid 8910:tid 8970] [client 52.156.211.140:8141] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "aczwyKJZINUcF3tYgEw2LgAAAQI"]
[Wed Apr 01 18:17:47.290180 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:37993] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "aczwyy7NKI8IaNKZFIdhzgAAAVY"]
[Wed Apr 01 18:17:48.808358 2026] [:error] [pid 8910:tid 8988] [client 52.156.211.140:37992] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "aczwzKJZINUcF3tYgEw2MQAAARQ"]
[Wed Apr 01 18:17:50.336709 2026] [:error] [pid 8908:tid 8921] [client 52.156.211.140:37909] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "aczwzvkmxtJXGnLdvgA7KgAAAIg"]
[Wed Apr 01 18:17:50.858159 2026] [:error] [pid 8908:tid 8920] [client 52.156.211.140:37908] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aczwzvkmxtJXGnLdvgA7LwAAAIc"]
[Wed Apr 01 18:17:51.380612 2026] [:error] [pid 8909:tid 8944] [client 52.156.211.140:37991] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aczwzzvP_a0662gDl6A0JwAAAMM"]
[Wed Apr 01 18:17:51.895400 2026] [:error] [pid 17856:tid 17871] [client 52.156.211.140:37917] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aczwzz7Idlm5j9frhqTFRwAAAE0"]
[Wed Apr 01 18:17:52.420596 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:38014] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "aczw0D7Idlm5j9frhqTFTAAAAFg"]
[Wed Apr 01 18:17:52.929716 2026] [:error] [pid 8909:tid 8963] [client 52.156.211.140:37994] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "aczw0DvP_a0662gDl6A0LgAAANY"]
[Wed Apr 01 18:17:53.440030 2026] [:error] [pid 8909:tid 8941] [client 52.156.211.140:38002] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "aczw0TvP_a0662gDl6A0MQAAAMA"]
[Wed Apr 01 18:17:54.860987 2026] [:error] [pid 62559:tid 62585] [client 52.156.211.140:37971] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "aczw0i7NKI8IaNKZFIdh3AAAAVg"]
[Wed Apr 01 18:17:55.368131 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37912] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/north1.php"] [unique_id "aczw0_kmxtJXGnLdvgA7OAAAAI8"]
[Wed Apr 01 18:17:55.890363 2026] [:error] [pid 8908:tid 8931] [client 52.156.211.140:37896] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aczw0_kmxtJXGnLdvgA7PQAAAJI"]
[Wed Apr 01 18:17:56.396531 2026] [:error] [pid 17856:tid 17862] [client 52.156.211.140:8137] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aczw1D7Idlm5j9frhqTFVQAAAEQ"]
[Wed Apr 01 18:17:58.130820 2026] [:error] [pid 8909:tid 8957] [client 52.156.211.140:37894] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aczw1jvP_a0662gDl6A0PwAAANA"]
[Wed Apr 01 18:17:58.641136 2026] [:error] [pid 8910:tid 8972] [client 52.156.211.140:37888] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "aczw1qJZINUcF3tYgEw2SgAAAQQ"]
[Wed Apr 01 18:18:00.198087 2026] [:error] [pid 62559:tid 62578] [client 52.156.211.140:37935] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "aczw2C7NKI8IaNKZFIdh5wAAAVE"]
[Wed Apr 01 18:18:00.737976 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:8144] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "aczw2C7NKI8IaNKZFIdh6AAAAVU"]
[Wed Apr 01 18:18:01.242091 2026] [:error] [pid 8909:tid 8963] [client 52.156.211.140:37952] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "aczw2TvP_a0662gDl6A0UAAAANY"]
[Wed Apr 01 18:18:01.764808 2026] [:error] [pid 62559:tid 62572] [client 52.156.211.140:37893] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "aczw2S7NKI8IaNKZFIdh6gAAAUs"]
[Wed Apr 01 18:18:02.304604 2026] [:error] [pid 8908:tid 8917] [client 52.156.211.140:37982] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aczw2vkmxtJXGnLdvgA7SQAAAIQ"]
[Wed Apr 01 18:18:02.812105 2026] [:error] [pid 17856:tid 17879] [client 52.156.211.140:37989] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aczw2j7Idlm5j9frhqTFZwAAAFU"]
[Wed Apr 01 18:18:03.332163 2026] [:error] [pid 8910:tid 8985] [client 52.156.211.140:38013] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aczw26JZINUcF3tYgEw2VwAAARE"]
[Wed Apr 01 18:18:04.440804 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:37987] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin.php"] [unique_id "aczw3D7Idlm5j9frhqTFagAAAEA"]
[Wed Apr 01 18:18:05.551667 2026] [:error] [pid 8909:tid 8952] [client 52.156.211.140:37948] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aczw3TvP_a0662gDl6A0ZQAAAMs"]
[Wed Apr 01 18:18:06.887885 2026] [:error] [pid 8908:tid 8923] [client 52.156.211.140:37923] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aczw3vkmxtJXGnLdvgA7UgAAAIo"]
[Wed Apr 01 18:18:07.412038 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:8138] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aczw3y7NKI8IaNKZFIdh8gAAAVY"]
[Wed Apr 01 18:18:09.327934 2026] [:error] [pid 8908:tid 8927] [client 52.156.211.140:37986] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "aczw4fkmxtJXGnLdvgA7YgAAAI4"]
[Wed Apr 01 18:18:09.831308 2026] [:error] [pid 8908:tid 8920] [client 52.156.211.140:38008] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "aczw4fkmxtJXGnLdvgA7ZwAAAIc"]
[Wed Apr 01 18:18:10.350864 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:37918] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "aczw4uonaBjs3qxcReeVEAAAAA4"]
[Wed Apr 01 18:18:10.872827 2026] [:error] [pid 8908:tid 8927] [client 52.156.211.140:37907] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "aczw4vkmxtJXGnLdvgA7bAAAAI4"]
[Wed Apr 01 18:18:11.405489 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:37922] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gpt-sh.php"] [unique_id "aczw4z7Idlm5j9frhqTFeAAAAEA"]
[Wed Apr 01 18:18:11.912165 2026] [:error] [pid 17856:tid 17880] [client 52.156.211.140:8175] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aczw4z7Idlm5j9frhqTFegAAAFY"]
[Wed Apr 01 18:18:14.513563 2026] [:error] [pid 8995:tid 9001] [client 52.156.211.140:37970] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aczw5uonaBjs3qxcReeVGQAAAAM"]
[Wed Apr 01 18:18:15.067590 2026] [:error] [pid 62559:tid 62585] [client 52.156.211.140:37895] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aczw5y7NKI8IaNKZFIdh9AAAAVg"]
[Wed Apr 01 18:18:16.401424 2026] [:error] [pid 8910:tid 8969] [client 52.156.211.140:37916] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "aczw6KJZINUcF3tYgEw2YAAAAQE"]
[Wed Apr 01 18:18:16.918042 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:37928] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "aczw6C7NKI8IaNKZFIdh9gAAAVU"]
[Wed Apr 01 18:18:18.427709 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:37933] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "aczw6i7NKI8IaNKZFIdh-gAAAUM"]
[Wed Apr 01 18:18:19.879147 2026] [:error] [pid 17856:tid 17873] [client 52.156.211.140:8075] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "aczw6z7Idlm5j9frhqTFmgAAAE8"]
[Wed Apr 01 18:18:20.379764 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37903] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "aczw7PkmxtJXGnLdvgA7hgAAAI8"]
[Wed Apr 01 18:18:20.885127 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:38007] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "aczw7D7Idlm5j9frhqTFowAAAEU"]
[Wed Apr 01 18:18:21.390102 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:37919] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "aczw7eonaBjs3qxcReeVIAAAABg"]
[Wed Apr 01 18:18:21.891058 2026] [:error] [pid 62559:tid 62571] [client 52.156.211.140:37915] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "aczw7S7NKI8IaNKZFIdiBAAAAUo"]
[Wed Apr 01 18:18:22.391518 2026] [:error] [pid 62559:tid 62572] [client 52.156.211.140:37905] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wander.php"] [unique_id "aczw7i7NKI8IaNKZFIdiCAAAAUs"]
[Wed Apr 01 18:18:22.891362 2026] [:error] [pid 17856:tid 17871] [client 52.156.211.140:37958] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h02ugyh.php"] [unique_id "aczw7j7Idlm5j9frhqTFqQAAAE0"]
[Wed Apr 01 18:18:23.402897 2026] [:error] [pid 8909:tid 8959] [client 52.156.211.140:37965] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h02ugyh.php"] [unique_id "aczw7zvP_a0662gDl6A0hgAAANI"]
[Wed Apr 01 18:18:23.913743 2026] [:error] [pid 8909:tid 8956] [client 52.156.211.140:37957] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h02ugyh.php"] [unique_id "aczw7zvP_a0662gDl6A0iAAAAM8"]
[Wed Apr 01 18:18:24.453927 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:38015] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h02ugyh.php"] [unique_id "aczw8DvP_a0662gDl6A0jQAAANQ"]
[Wed Apr 01 18:18:25.863129 2026] [:error] [pid 8995:tid 9003] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Wed Apr 01 18:18:26.115597 2026] [:error] [pid 8995:tid 9015] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Wed Apr 01 18:18:26.367518 2026] [:error] [pid 8995:tid 9005] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Wed Apr 01 18:18:26.883437 2026] [:error] [pid 8995:tid 9013] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/sql.php
[Wed Apr 01 18:18:27.135203 2026] [:error] [pid 8995:tid 8999] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Wed Apr 01 18:18:27.399346 2026] [:error] [pid 8995:tid 9021] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Apr 01 18:18:27.650956 2026] [:error] [pid 8995:tid 9009] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Wed Apr 01 18:18:27.981314 2026] [:error] [pid 8995:tid 9019] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Wed Apr 01 18:18:28.233335 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/uang.php
[Wed Apr 01 18:18:28.494485 2026] [:error] [pid 8995:tid 9007] [client 52.156.211.140:38006] File does not exist: /usr/local/apache/htdocs/suspended-page/save.php
[Wed Apr 01 18:18:28.743830 2026] [:error] [pid 8995:tid 9016] [client 52.156.211.140:38006] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "aczw9OonaBjs3qxcReeVLwAAABI"]
[Wed Apr 01 18:18:29.249283 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:37913] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "aczw9fkmxtJXGnLdvgA7mAAAAIk"]
[Wed Apr 01 18:18:29.751649 2026] [:error] [pid 8910:tid 8972] [client 52.156.211.140:8157] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "aczw9aJZINUcF3tYgEw2awAAAQQ"]
[Wed Apr 01 18:18:30.257746 2026] [:error] [pid 8908:tid 8913] [client 52.156.211.140:37906] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "aczw9vkmxtJXGnLdvgA7mwAAAIA"]
[Wed Apr 01 18:18:30.761953 2026] [:error] [pid 8908:tid 8926] [client 52.156.211.140:37995] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aczw9vkmxtJXGnLdvgA7nQAAAI0"]
[Wed Apr 01 18:18:31.268578 2026] [:error] [pid 8909:tid 8943] [client 52.156.211.140:37966] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aczw9zvP_a0662gDl6A0rQAAAMI"]
[Wed Apr 01 18:18:31.779338 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:37998] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aczw9zvP_a0662gDl6A0sAAAAMQ"]
[Wed Apr 01 18:18:32.282308 2026] [:error] [pid 8909:tid 8953] [client 52.156.211.140:37911] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "aczw-DvP_a0662gDl6A0sgAAAMw"]
[Wed Apr 01 18:18:32.801515 2026] [:error] [pid 8909:tid 8944] [client 52.156.211.140:8073] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aczw-DvP_a0662gDl6A0tAAAAMM"]
[Wed Apr 01 18:18:33.393185 2026] [:error] [pid 8909:tid 8947] [client 52.156.211.140:37921] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aczw-TvP_a0662gDl6A0uwAAAMY"]
[Wed Apr 01 18:18:33.918325 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:37938] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aczw-T7Idlm5j9frhqTFvwAAAEU"]
[Wed Apr 01 18:18:34.554689 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:37889] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "aczw-jvP_a0662gDl6A0vwAAAME"]
[Wed Apr 01 18:18:35.212168 2026] [:error] [pid 8995:tid 9002] [client 52.156.211.140:8182] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "aczw--onaBjs3qxcReeVMQAAAAQ"]
[Wed Apr 01 18:18:35.766348 2026] [:error] [pid 17856:tid 17872] [client 52.156.211.140:37914] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "aczw-z7Idlm5j9frhqTFyAAAAE4"]
[Wed Apr 01 18:18:36.658731 2026] [:error] [pid 62559:tid 62584] [client 52.156.211.140:8178] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "aczw_C7NKI8IaNKZFIdiFgAAAVc"]
[Wed Apr 01 18:18:38.369805 2026] [:error] [pid 8995:tid 9013] [client 52.156.211.140:38010] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gelio1.php"] [unique_id "aczw_uonaBjs3qxcReeVOAAAAA8"]
[Wed Apr 01 18:18:38.921953 2026] [:error] [pid 8909:tid 8963] [client 52.156.211.140:37953] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aczw_jvP_a0662gDl6A00AAAANY"]
[Wed Apr 01 18:18:40.464523 2026] [:error] [pid 17856:tid 17881] [client 52.156.211.140:8150] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aczxAD7Idlm5j9frhqTF2gAAAFc"]
[Wed Apr 01 18:18:41.025884 2026] [:error] [pid 8909:tid 8964] [client 52.156.211.140:37898] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aczxATvP_a0662gDl6A01wAAANc"]
[Wed Apr 01 18:18:41.551617 2026] [:error] [pid 8908:tid 8914] [client 52.156.211.140:38000] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "aczxAfkmxtJXGnLdvgA7rgAAAIE"]
[Wed Apr 01 18:18:42.102721 2026] [:error] [pid 8908:tid 8934] [client 52.156.211.140:37974] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "aczxAvkmxtJXGnLdvgA7sAAAAJU"]
[Wed Apr 01 18:18:42.604895 2026] [:error] [pid 8910:tid 8987] [client 52.156.211.140:37910] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "aczxAqJZINUcF3tYgEw2eQAAARM"]
[Wed Apr 01 18:18:43.115697 2026] [:error] [pid 8910:tid 8974] [client 52.156.211.140:8164] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "aczxA6JZINUcF3tYgEw2fQAAAQY"]
[Wed Apr 01 18:18:43.619325 2026] [:error] [pid 8908:tid 8932] [client 52.156.211.140:8179] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yuzuru1.php"] [unique_id "aczxA_kmxtJXGnLdvgA7tQAAAJM"]
[Wed Apr 01 18:18:44.768693 2026] [:error] [pid 8995:tid 9011] [client 52.156.211.140:8174] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aczxBOonaBjs3qxcReeVQgAAAA0"]
[Wed Apr 01 18:18:45.274742 2026] [:error] [pid 8908:tid 8937] [client 52.156.211.140:37946] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aczxBfkmxtJXGnLdvgA7vQAAAJg"]
[Wed Apr 01 18:18:45.779816 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:37969] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aczxBT7Idlm5j9frhqTF3AAAAFI"]
[Wed Apr 01 18:18:49.336557 2026] [:error] [pid 8909:tid 8960] [client 52.156.211.140:37927] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "aczxCTvP_a0662gDl6A0-gAAANM"]
[Wed Apr 01 18:18:49.885328 2026] [:error] [pid 8909:tid 8958] [client 52.156.211.140:37936] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sweg.php"] [unique_id "aczxCTvP_a0662gDl6A0_gAAANE"]
[Wed Apr 01 18:18:50.482946 2026] [:error] [pid 8909:tid 8941] [client 52.156.211.140:8130] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sweg.php"] [unique_id "aczxCjvP_a0662gDl6A1BwAAAMA"]
[Wed Apr 01 18:18:51.058279 2026] [:error] [pid 8909:tid 8960] [client 52.156.211.140:8129] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sweg.php"] [unique_id "aczxCzvP_a0662gDl6A1DQAAANM"]
[Wed Apr 01 18:18:53.612480 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:8128] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sweg.php"] [unique_id "aczxDS7NKI8IaNKZFIdiHwAAAUg"]
[Wed Apr 01 18:18:54.137775 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:8160] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "aczxDjvP_a0662gDl6A1IgAAAMc"]
[Wed Apr 01 18:18:54.761020 2026] [:error] [pid 17856:tid 17869] [client 52.156.211.140:37967] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "aczxDj7Idlm5j9frhqTF7QAAAEs"]
[Wed Apr 01 18:18:55.338455 2026] [:error] [pid 8995:tid 9021] [client 52.156.211.140:37983] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "aczxD-onaBjs3qxcReeVRwAAABc"]
[Wed Apr 01 18:18:55.843432 2026] [:error] [pid 8909:tid 8959] [client 52.156.211.140:8117] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xpwer1.php"] [unique_id "aczxDzvP_a0662gDl6A1JgAAANI"]
[Wed Apr 01 18:18:56.376811 2026] [:error] [pid 17856:tid 17877] [client 52.156.211.140:8163] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "aczxED7Idlm5j9frhqTF9wAAAFM"]
[Wed Apr 01 18:18:56.923660 2026] [:error] [pid 17856:tid 17875] [client 52.156.211.140:37891] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "aczxED7Idlm5j9frhqTF-gAAAFE"]
[Wed Apr 01 18:18:57.452029 2026] [:error] [pid 62559:tid 62585] [client 52.156.211.140:37900] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "aczxES7NKI8IaNKZFIdiJgAAAVg"]
[Wed Apr 01 18:18:59.532981 2026] [:error] [pid 8995:tid 9016] [client 52.156.211.140:37902] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws40.php"] [unique_id "aczxE-onaBjs3qxcReeVTAAAABI"]
[Wed Apr 01 18:19:00.057517 2026] [:error] [pid 8909:tid 8956] [client 52.156.211.140:37988] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "aczxFDvP_a0662gDl6A1LQAAAM8"]
[Wed Apr 01 18:19:00.578574 2026] [:error] [pid 8909:tid 8959] [client 52.156.211.140:8149] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "aczxFDvP_a0662gDl6A1LgAAANI"]
[Wed Apr 01 18:19:01.122949 2026] [:error] [pid 8910:tid 8975] [client 52.156.211.140:37978] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "aczxFaJZINUcF3tYgEw2nAAAAQc"]
[Wed Apr 01 18:19:01.638484 2026] [:error] [pid 17856:tid 17869] [client 52.156.211.140:8170] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albin.php"] [unique_id "aczxFT7Idlm5j9frhqTGBAAAAEs"]
[Wed Apr 01 18:19:02.165660 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:37947] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "aczxFj7Idlm5j9frhqTGBwAAAEo"]
[Wed Apr 01 18:19:02.692362 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:37897] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "aczxFj7Idlm5j9frhqTGDAAAAFg"]
[Wed Apr 01 18:19:03.261444 2026] [:error] [pid 8909:tid 8946] [client 52.156.211.140:8158] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "aczxFzvP_a0662gDl6A1OAAAAMU"]
[Wed Apr 01 18:19:03.772767 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:8140] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "aczxFzvP_a0662gDl6A1OwAAAM4"]
[Wed Apr 01 18:19:04.315024 2026] [:error] [pid 8909:tid 8965] [client 52.156.211.140:38009] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "aczxGDvP_a0662gDl6A1PQAAANg"]
[Wed Apr 01 18:19:04.818903 2026] [:error] [pid 8995:tid 9003] [client 52.156.211.140:37925] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "aczxGOonaBjs3qxcReeVUwAAAAU"]
[Wed Apr 01 18:19:05.373295 2026] [:error] [pid 8909:tid 8946] [client 52.156.211.140:8153] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "aczxGTvP_a0662gDl6A1SAAAAMU"]
[Wed Apr 01 18:19:07.956203 2026] [:error] [pid 8908:tid 8937] [client 52.156.211.140:37960] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shellerr.php"] [unique_id "aczxG_kmxtJXGnLdvgA71wAAAJg"]
[Wed Apr 01 18:19:08.522102 2026] [:error] [pid 62559:tid 62581] [client 52.156.211.140:37940] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "aczxHC7NKI8IaNKZFIdiNAAAAVQ"]
[Wed Apr 01 18:19:09.102787 2026] [:error] [pid 8909:tid 8953] [client 52.156.211.140:8171] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "aczxHTvP_a0662gDl6A1YgAAAMw"]
[Wed Apr 01 18:19:09.725283 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:8081] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "aczxHTvP_a0662gDl6A1aQAAAMQ"]
[Wed Apr 01 18:19:10.322594 2026] [:error] [pid 8908:tid 8934] [client 52.156.211.140:8135] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-scanner.php"] [unique_id "aczxHvkmxtJXGnLdvgA72gAAAJU"]
[Wed Apr 01 18:19:10.886282 2026] [:error] [pid 8908:tid 8917] [client 52.156.211.140:38012] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aczxHvkmxtJXGnLdvgA73AAAAIQ"]
[Wed Apr 01 18:19:11.432696 2026] [:error] [pid 8909:tid 8953] [client 52.156.211.140:37980] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aczxHzvP_a0662gDl6A1bAAAAMw"]
[Wed Apr 01 18:19:11.996207 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:37937] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aczxHzvP_a0662gDl6A1bwAAAM4"]
[Wed Apr 01 18:19:12.588707 2026] [:error] [pid 8995:tid 9018] [client 52.156.211.140:8181] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "aczxIOonaBjs3qxcReeVVAAAABQ"]
[Wed Apr 01 18:19:16.753369 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:37942] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aczxJC7NKI8IaNKZFIdiUAAAAUM"]
[Wed Apr 01 18:19:17.565073 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:37954] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aczxJT7Idlm5j9frhqTGOQAAAEA"]
[Wed Apr 01 18:19:22.632248 2026] [:error] [pid 8908:tid 8921] [client 52.156.211.140:37955] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aczxKvkmxtJXGnLdvgA7_AAAAIg"]
[Wed Apr 01 18:19:23.877721 2026] [:error] [pid 8995:tid 9001] [client 52.156.211.140:37904] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "aczxK-onaBjs3qxcReeVXAAAAAM"]
[Wed Apr 01 18:19:25.637145 2026] [:error] [pid 8908:tid 8924] [client 52.156.211.140:37892] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aczxLfkmxtJXGnLdvgA8CAAAAIs"]
[Wed Apr 01 18:19:26.206077 2026] [:error] [pid 8908:tid 8932] [client 52.156.211.140:37943] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aczxLvkmxtJXGnLdvgA8CgAAAJM"]
[Wed Apr 01 18:19:26.737605 2026] [:error] [pid 17856:tid 17871] [client 52.156.211.140:37956] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aczxLj7Idlm5j9frhqTGXwAAAE0"]
[Wed Apr 01 18:19:27.701178 2026] [:error] [pid 8908:tid 8919] [client 52.156.211.140:37964] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "aczxL_kmxtJXGnLdvgA8DgAAAIY"]
[Wed Apr 01 18:19:28.282319 2026] [:error] [pid 17856:tid 17879] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/ant.php
[Wed Apr 01 18:19:28.534715 2026] [:error] [pid 17856:tid 17867] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Wed Apr 01 18:19:28.816182 2026] [:error] [pid 17856:tid 17864] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Wed Apr 01 18:19:29.114524 2026] [:error] [pid 17856:tid 17873] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Wed Apr 01 18:19:29.372508 2026] [:error] [pid 17856:tid 17877] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Wed Apr 01 18:19:29.673737 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Wed Apr 01 18:19:29.965840 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/ws43.php
[Wed Apr 01 18:19:30.268044 2026] [:error] [pid 17856:tid 17864] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/gec.php
[Wed Apr 01 18:19:30.520843 2026] [:error] [pid 17856:tid 17862] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Wed Apr 01 18:19:30.783956 2026] [:error] [pid 17856:tid 17873] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 01 18:19:31.036827 2026] [:error] [pid 17856:tid 17875] [client 52.156.211.140:37996] File does not exist: /usr/local/apache/htdocs/suspended-page/size.php
[Wed Apr 01 18:19:31.286515 2026] [:error] [pid 17856:tid 17879] [client 52.156.211.140:37996] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aczxMz7Idlm5j9frhqTGgwAAAFU"]
[Wed Apr 01 18:19:31.828271 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:37901] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aczxMzvP_a0662gDl6A1vgAAANQ"]
[Wed Apr 01 18:19:32.400471 2026] [:error] [pid 62559:tid 62570] [client 52.156.211.140:37985] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aczxNC7NKI8IaNKZFIdiZwAAAUk"]
[Wed Apr 01 18:19:33.945604 2026] [:error] [pid 17856:tid 17873] [client 52.156.211.140:8191] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "aczxNT7Idlm5j9frhqTGhgAAAE8"]
[Wed Apr 01 18:19:34.522063 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:8166] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "aczxNj7Idlm5j9frhqTGigAAAFI"]
[Wed Apr 01 18:19:35.150359 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:8011] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "aczxNz7Idlm5j9frhqTGjwAAAEA"]
[Wed Apr 01 18:19:38.121486 2026] [:error] [pid 8909:tid 8963] [client 52.156.211.140:37975] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-load.php"] [unique_id "aczxOjvP_a0662gDl6A1zAAAANY"]
[Wed Apr 01 18:19:57.106487 2026] [:error] [pid 62559:tid 62565] [client 52.156.211.140:8183] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "aczxTS7NKI8IaNKZFIdiegAAAUQ"]
[Wed Apr 01 18:19:59.017512 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:37961] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "aczxTz7Idlm5j9frhqTGsAAAAEI"]
[Wed Apr 01 18:19:59.528033 2026] [:error] [pid 8909:tid 8964] [client 52.156.211.140:8080] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "aczxTzvP_a0662gDl6A2EQAAANc"]
[Wed Apr 01 18:20:02.766756 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:8155] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "aczxUjvP_a0662gDl6A2GAAAAMQ"]
[Wed Apr 01 18:20:03.313661 2026] [:error] [pid 62559:tid 62570] [client 52.156.211.140:8142] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aczxUy7NKI8IaNKZFIdigwAAAUk"]
[Wed Apr 01 18:20:03.849677 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:8156] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aczxU-onaBjs3qxcReeViQAAABg"]
[Wed Apr 01 18:20:04.351251 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:8074] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aczxVC7NKI8IaNKZFIdiiAAAAVA"]
[Wed Apr 01 18:20:04.855677 2026] [:error] [pid 62559:tid 62580] [client 52.156.211.140:8084] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "aczxVC7NKI8IaNKZFIdiiQAAAVM"]
[Wed Apr 01 18:20:05.356350 2026] [:error] [pid 8995:tid 9020] [client 52.156.211.140:8147] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vaza.php"] [unique_id "aczxVeonaBjs3qxcReeVjwAAABY"]
[Wed Apr 01 18:20:05.920964 2026] [:error] [pid 17856:tid 17866] [client 52.156.211.140:37929] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vaza.php"] [unique_id "aczxVT7Idlm5j9frhqTGxAAAAEg"]
[Wed Apr 01 18:20:06.475497 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:37934] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vaza.php"] [unique_id "aczxVj7Idlm5j9frhqTGywAAAFg"]
[Wed Apr 01 18:20:07.025176 2026] [:error] [pid 8995:tid 9010] [client 52.156.211.140:37945] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vaza.php"] [unique_id "aczxV-onaBjs3qxcReeVlgAAAAw"]
[Wed Apr 01 18:20:08.532653 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:8079] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "aczxWOonaBjs3qxcReeVmwAAAA4"]
[Wed Apr 01 18:20:09.109959 2026] [:error] [pid 62559:tid 62562] [client 52.156.211.140:37924] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "aczxWS7NKI8IaNKZFIdikgAAAUE"]
[Wed Apr 01 18:20:09.614896 2026] [:error] [pid 62559:tid 62585] [client 52.156.211.140:8086] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "aczxWS7NKI8IaNKZFIdilQAAAVg"]
[Wed Apr 01 18:20:10.170782 2026] [:error] [pid 8995:tid 9018] [client 52.156.211.140:8101] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bnm.php"] [unique_id "aczxWuonaBjs3qxcReeVnwAAABQ"]
[Wed Apr 01 18:20:10.679944 2026] [:error] [pid 8995:tid 9005] [client 52.156.211.140:8090] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aczxWuonaBjs3qxcReeVogAAAAc"]
[Wed Apr 01 18:20:11.219513 2026] [:error] [pid 8909:tid 8960] [client 52.156.211.140:8146] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aczxWzvP_a0662gDl6A2IgAAANM"]
[Wed Apr 01 18:20:11.724012 2026] [:error] [pid 17856:tid 17871] [client 52.156.211.140:37939] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aczxWz7Idlm5j9frhqTG1AAAAE0"]
[Wed Apr 01 18:20:12.235139 2026] [:error] [pid 8910:tid 8992] [client 52.156.211.140:8159] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aczxXKJZINUcF3tYgEw25wAAARg"]
[Wed Apr 01 18:20:12.749197 2026] [:error] [pid 8908:tid 8927] [client 52.156.211.140:8126] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "aczxXPkmxtJXGnLdvgA8VQAAAI4"]
[Wed Apr 01 18:20:13.270869 2026] [:error] [pid 8995:tid 9006] [client 52.156.211.140:8188] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "aczxXeonaBjs3qxcReeVpQAAAAg"]
[Wed Apr 01 18:20:13.783549 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:8190] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "aczxXT7Idlm5j9frhqTG2QAAAFg"]
[Wed Apr 01 18:20:15.340091 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:8120] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "aczxXz7Idlm5j9frhqTG3gAAAEI"]
[Wed Apr 01 18:20:16.026045 2026] [:error] [pid 8908:tid 8918] [client 52.156.211.140:37950] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "aczxYPkmxtJXGnLdvgA8ZwAAAIU"]
[Wed Apr 01 18:20:16.562348 2026] [:error] [pid 8908:tid 8935] [client 52.156.211.140:8154] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "aczxYPkmxtJXGnLdvgA8agAAAJY"]
[Wed Apr 01 18:20:17.118250 2026] [:error] [pid 8910:tid 8968] [client 52.156.211.140:37981] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "aczxYaJZINUcF3tYgEw28wAAAQA"]
[Wed Apr 01 18:20:17.714149 2026] [:error] [pid 8908:tid 8932] [client 52.156.211.140:37961] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "aczxYfkmxtJXGnLdvgA8dAAAAJM"]
[Wed Apr 01 18:20:18.221676 2026] [:error] [pid 8909:tid 8943] [client 52.156.211.140:8143] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aczxYjvP_a0662gDl6A2KgAAAMI"]
[Wed Apr 01 18:20:18.762659 2026] [:error] [pid 8995:tid 9018] [client 52.156.211.140:8123] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aczxYuonaBjs3qxcReeVrAAAABQ"]
[Wed Apr 01 18:20:19.293324 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:8067] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aczxYzvP_a0662gDl6A2LwAAAMc"]
[Wed Apr 01 18:20:19.848822 2026] [:error] [pid 8995:tid 9007] [client 52.156.211.140:8078] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "aczxY-onaBjs3qxcReeVrgAAAAk"]
[Wed Apr 01 18:20:20.415021 2026] [:error] [pid 17856:tid 17861] [client 52.156.211.140:8086] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aczxZD7Idlm5j9frhqTG5AAAAEM"]
[Wed Apr 01 18:20:20.938340 2026] [:error] [pid 8908:tid 8933] [client 52.156.211.140:37990] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aczxZPkmxtJXGnLdvgA8eQAAAJQ"]
[Wed Apr 01 18:20:21.533524 2026] [:error] [pid 8908:tid 8925] [client 52.156.211.140:8176] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aczxZfkmxtJXGnLdvgA8ewAAAIw"]
[Wed Apr 01 18:20:22.040774 2026] [:error] [pid 8909:tid 8943] [client 52.156.211.140:8072] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aczxZjvP_a0662gDl6A2PQAAAMI"]
[Wed Apr 01 18:20:22.580408 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:37932] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "aczxZj7Idlm5j9frhqTG6QAAAEA"]
[Wed Apr 01 18:20:23.129496 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:37899] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "aczxZz7Idlm5j9frhqTG7AAAAFQ"]
[Wed Apr 01 18:20:23.687878 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:37920] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "aczxZy7NKI8IaNKZFIdiogAAAVY"]
[Wed Apr 01 18:20:24.348958 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:8028] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "aczxaD7Idlm5j9frhqTG8QAAAEE"]
[Wed Apr 01 18:20:24.897613 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:8008] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aczxaD7Idlm5j9frhqTG8wAAAFI"]
[Wed Apr 01 18:20:25.461740 2026] [:error] [pid 8910:tid 8971] [client 52.156.211.140:8107] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aczxaaJZINUcF3tYgEw2-gAAAQM"]
[Wed Apr 01 18:20:25.967549 2026] [:error] [pid 8909:tid 8958] [client 52.156.211.140:8133] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aczxaTvP_a0662gDl6A2RQAAANE"]
[Wed Apr 01 18:20:26.498009 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:8177] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "aczxaj7Idlm5j9frhqTG9wAAAEU"]
[Wed Apr 01 18:20:27.024822 2026] [:error] [pid 8909:tid 8949] [client 52.156.211.140:37941] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aczxazvP_a0662gDl6A2SwAAAMg"]
[Wed Apr 01 18:20:27.586526 2026] [:error] [pid 8910:tid 8985] [client 52.156.211.140:37963] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aczxa6JZINUcF3tYgEw3AAAAARE"]
[Wed Apr 01 18:20:28.117713 2026] [:error] [pid 8908:tid 8915] [client 52.156.211.140:8184] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aczxbPkmxtJXGnLdvgA8hAAAAII"]
[Wed Apr 01 18:20:28.688595 2026] [:error] [pid 8908:tid 8921] [client 52.156.211.140:8089] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "aczxbPkmxtJXGnLdvgA8hQAAAIg"]
[Wed Apr 01 18:20:29.234909 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37949] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aczxbfkmxtJXGnLdvgA8iAAAAI8"]
[Wed Apr 01 18:20:30.829881 2026] [:error] [pid 17856:tid 17870] [client 52.156.211.140:8041] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d2.php"] [unique_id "aczxbj7Idlm5j9frhqTHCAAAAEw"]
[Wed Apr 01 18:20:31.364205 2026] [:error] [pid 62559:tid 62581] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/d2.php
[Wed Apr 01 18:20:31.651577 2026] [:error] [pid 62559:tid 62562] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Wed Apr 01 18:20:31.904817 2026] [:error] [pid 62559:tid 62584] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Wed Apr 01 18:20:32.181782 2026] [:error] [pid 62559:tid 62573] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Wed Apr 01 18:20:32.439920 2026] [:error] [pid 62559:tid 62572] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Wed Apr 01 18:20:32.706929 2026] [:error] [pid 62559:tid 62566] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/20.php
[Wed Apr 01 18:20:32.960131 2026] [:error] [pid 62559:tid 62579] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 01 18:20:33.214489 2026] [:error] [pid 62559:tid 62580] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Wed Apr 01 18:20:33.472773 2026] [:error] [pid 62559:tid 62578] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Wed Apr 01 18:20:33.729735 2026] [:error] [pid 62559:tid 62571] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Wed Apr 01 18:20:33.987601 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:8165] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Wed Apr 01 18:54:37.668721 2026] [:error] [pid 8909:tid 8954] [client 102.165.48.81:9909] [client 102.165.48.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.165.48.81, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "acz5bTvP_a0662gDl6BSwgAAAM0"]
[Wed Apr 01 18:54:37.672340 2026] [:error] [pid 8909:tid 8954] [client 102.165.48.81:9909] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 01 18:54:39.942924 2026] [:error] [pid 8909:tid 8942] [client 102.165.48.81:9909] [client 102.165.48.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "acz5bzvP_a0662gDl6BS2AAAAME"]
[Wed Apr 01 18:54:40.437754 2026] [:error] [pid 8910:tid 8973] [client 102.165.48.81:10551] [client 102.165.48.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "acz5cKJZINUcF3tYgEw_GQAAAQU"]
[Wed Apr 01 18:54:40.930897 2026] [:error] [pid 17856:tid 17878] [client 102.165.48.81:10634] [client 102.165.48.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "acz5cD7Idlm5j9frhqTciwAAAFQ"]
[Wed Apr 01 18:54:41.425643 2026] [:error] [pid 8910:tid 8979] [client 102.165.48.81:10741] [client 102.165.48.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "acz5caJZINUcF3tYgEw_GwAAAQs"]
[Wed Apr 01 18:59:37.504777 2026] [:error] [pid 17856:tid 17867] [client 45.131.195.101:43875] [client 45.131.195.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acz6mT7Idlm5j9frhqTfywAAAEk"]
[Wed Apr 01 19:36:32.650289 2026] [:error] [pid 8909:tid 8952] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Wed Apr 01 19:36:32.907702 2026] [:error] [pid 8909:tid 8958] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/8daf1238_1774208172.php
[Wed Apr 01 19:36:33.176222 2026] [:error] [pid 8909:tid 8948] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/0yellow.php
[Wed Apr 01 19:36:33.434970 2026] [:error] [pid 8909:tid 8942] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/dichku.php
[Wed Apr 01 19:36:33.692674 2026] [:error] [pid 8909:tid 8944] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 01 19:36:33.954127 2026] [:error] [pid 8909:tid 8955] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Wed Apr 01 19:36:34.210377 2026] [:error] [pid 8909:tid 8958] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Wed Apr 01 19:36:34.469037 2026] [:error] [pid 8909:tid 8965] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/a9.php
[Wed Apr 01 19:36:34.726857 2026] [:error] [pid 8909:tid 8960] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Wed Apr 01 19:36:34.984083 2026] [:error] [pid 8909:tid 8962] [client 20.215.250.169:64627] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Wed Apr 01 19:36:35.238694 2026] [:error] [pid 8909:tid 8956] [client 20.215.250.169:64627] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hnphq.php"] [unique_id "ac0DQzvP_a0662gDl6B6egAAAM8"]
[Wed Apr 01 19:36:35.793917 2026] [:error] [pid 8909:tid 8948] [client 20.215.250.169:65440] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hnphq.php"] [unique_id "ac0DQzvP_a0662gDl6B6fwAAAMc"]
[Wed Apr 01 19:36:36.554128 2026] [:error] [pid 17856:tid 17861] [client 20.215.250.169:64643] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0DRD7Idlm5j9frhqT24AAAAEM"]
[Wed Apr 01 19:36:37.066769 2026] [:error] [pid 17856:tid 17878] [client 20.215.250.169:64002] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0DRT7Idlm5j9frhqT25wAAAFQ"]
[Wed Apr 01 19:36:37.670160 2026] [:error] [pid 62559:tid 62579] [client 20.215.250.169:65405] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0DRS7NKI8IaNKZFId9PwAAAVI"]
[Wed Apr 01 19:36:38.384342 2026] [:error] [pid 8908:tid 8914] [client 20.215.250.169:63982] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0DRvkmxtJXGnLdvgBetwAAAIE"]
[Wed Apr 01 19:36:39.338070 2026] [:error] [pid 8995:tid 9016] [client 20.215.250.169:63974] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "ac0DR-onaBjs3qxcReesmwAAABI"]
[Wed Apr 01 19:36:40.017768 2026] [:error] [pid 8995:tid 9009] [client 20.215.250.169:63947] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "ac0DSOonaBjs3qxcReesnQAAAAs"]
[Wed Apr 01 19:36:40.830013 2026] [:error] [pid 8909:tid 8964] [client 20.215.250.169:65458] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "ac0DSDvP_a0662gDl6B6kQAAANc"]
[Wed Apr 01 19:36:41.556092 2026] [:error] [pid 17856:tid 17871] [client 20.215.250.169:65441] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Okxob.php"] [unique_id "ac0DST7Idlm5j9frhqT29gAAAE0"]
[Wed Apr 01 19:36:42.104356 2026] [:error] [pid 17856:tid 17869] [client 20.215.250.169:64666] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0DSj7Idlm5j9frhqT2-QAAAEs"]
[Wed Apr 01 19:36:42.933921 2026] [:error] [pid 8909:tid 8965] [client 20.215.250.169:63949] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0DSjvP_a0662gDl6B6lwAAANg"]
[Wed Apr 01 19:36:43.823863 2026] [:error] [pid 8910:tid 8976] [client 20.215.250.169:64677] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "ac0DS6JZINUcF3tYgExJxAAAAQg"]
[Wed Apr 01 19:36:44.471594 2026] [:error] [pid 8909:tid 8961] [client 20.215.250.169:65457] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "ac0DTDvP_a0662gDl6B6mQAAANQ"]
[Wed Apr 01 19:36:45.100330 2026] [:error] [pid 17856:tid 17859] [client 20.215.250.169:63996] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "ac0DTT7Idlm5j9frhqT3AAAAAEE"]
[Wed Apr 01 19:36:46.051435 2026] [:error] [pid 8909:tid 8952] [client 20.215.250.169:63960] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac0DTjvP_a0662gDl6B6pAAAAMs"]
[Wed Apr 01 19:36:47.508503 2026] [:error] [pid 8909:tid 8942] [client 20.215.250.169:64678] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class-20260318122951.php"] [unique_id "ac0DTzvP_a0662gDl6B6qwAAAME"]
[Wed Apr 01 19:36:48.115066 2026] [:error] [pid 8909:tid 8952] [client 20.215.250.169:65459] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class-20260318122951.php"] [unique_id "ac0DUDvP_a0662gDl6B6sgAAAMs"]
[Wed Apr 01 19:36:48.725306 2026] [:error] [pid 8909:tid 8965] [client 20.215.250.169:64675] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-class-20260318122951.php"] [unique_id "ac0DUDvP_a0662gDl6B6tAAAANg"]
[Wed Apr 01 19:36:49.617179 2026] [:error] [pid 8909:tid 8947] [client 20.215.250.169:64611] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "ac0DUTvP_a0662gDl6B6wAAAAMY"]
[Wed Apr 01 19:36:50.247736 2026] [:error] [pid 8909:tid 8963] [client 20.215.250.169:65370] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "ac0DUjvP_a0662gDl6B6xwAAANY"]
[Wed Apr 01 19:36:50.863140 2026] [:error] [pid 8995:tid 9009] [client 20.215.250.169:63970] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "ac0DUuonaBjs3qxcReesuAAAAAs"]
[Wed Apr 01 19:36:51.444100 2026] [:error] [pid 8909:tid 8947] [client 20.215.250.169:65435] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "ac0DUzvP_a0662gDl6B6zQAAAMY"]
[Wed Apr 01 19:36:52.129202 2026] [:error] [pid 8908:tid 8925] [client 20.215.250.169:65380] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "ac0DVPkmxtJXGnLdvgBe0QAAAIw"]
[Wed Apr 01 19:36:52.790109 2026] [:error] [pid 8995:tid 9016] [client 20.215.250.169:64672] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "ac0DVOonaBjs3qxcReesvAAAABI"]
[Wed Apr 01 19:36:53.433432 2026] [:error] [pid 8909:tid 8945] [client 20.215.250.169:64586] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "ac0DVTvP_a0662gDl6B62QAAAMQ"]
[Wed Apr 01 19:36:54.013120 2026] [:error] [pid 17856:tid 17861] [client 20.215.250.169:64597] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-moonka.php"] [unique_id "ac0DVj7Idlm5j9frhqT3DAAAAEM"]
[Wed Apr 01 19:36:54.725093 2026] [:error] [pid 8909:tid 8945] [client 20.215.250.169:65411] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "ac0DVjvP_a0662gDl6B65AAAAMQ"]
[Wed Apr 01 19:36:55.423071 2026] [:error] [pid 8908:tid 8923] [client 20.215.250.169:65442] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "ac0DV_kmxtJXGnLdvgBe3QAAAIo"]
[Wed Apr 01 19:36:56.039530 2026] [:error] [pid 8909:tid 8943] [client 20.215.250.169:64594] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "ac0DWDvP_a0662gDl6B66AAAAMI"]
[Wed Apr 01 19:36:56.773477 2026] [:error] [pid 8995:tid 8999] [client 20.215.250.169:64010] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "ac0DWOonaBjs3qxcReeswQAAAAE"]
[Wed Apr 01 19:36:57.659403 2026] [:error] [pid 8909:tid 8960] [client 20.215.250.169:65415] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "ac0DWTvP_a0662gDl6B69wAAANM"]
[Wed Apr 01 19:36:58.303871 2026] [:error] [pid 8995:tid 9002] [client 20.215.250.169:65348] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "ac0DWuonaBjs3qxcReeswgAAAAQ"]
[Wed Apr 01 19:36:59.019172 2026] [:error] [pid 17856:tid 17863] [client 20.215.250.169:62028] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "ac0DWz7Idlm5j9frhqT3GQAAAEU"]
[Wed Apr 01 19:36:59.661734 2026] [:error] [pid 8908:tid 8936] [client 20.215.250.169:62736] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "ac0DW_kmxtJXGnLdvgBe6QAAAJc"]
[Wed Apr 01 19:37:00.372733 2026] [:error] [pid 62559:tid 62575] [client 20.215.250.169:63297] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0DXC7NKI8IaNKZFId9XAAAAU4"]
[Wed Apr 01 19:37:01.184123 2026] [:error] [pid 8995:tid 9000] [client 20.215.250.169:64595] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0DXeonaBjs3qxcReesxAAAAAI"]
[Wed Apr 01 19:37:02.062905 2026] [:error] [pid 8908:tid 8929] [client 20.215.250.169:64632] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0DXvkmxtJXGnLdvgBe8QAAAJA"]
[Wed Apr 01 19:37:02.714235 2026] [:error] [pid 8910:tid 8980] [client 20.215.250.169:64021] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0DXqJZINUcF3tYgExJ3QAAAQw"]
[Wed Apr 01 19:37:03.275632 2026] [:error] [pid 8908:tid 8937] [client 20.215.250.169:65373] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "ac0DX_kmxtJXGnLdvgBe9gAAAJg"]
[Wed Apr 01 19:37:03.834769 2026] [:error] [pid 8910:tid 8977] [client 20.215.250.169:63940] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac0DX6JZINUcF3tYgExJ3gAAAQk"]
[Wed Apr 01 19:37:04.497205 2026] [:error] [pid 62559:tid 62577] [client 20.215.250.169:63962] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac0DYC7NKI8IaNKZFId9XgAAAVA"]
[Wed Apr 01 19:37:05.076862 2026] [:error] [pid 17856:tid 17880] [client 20.215.250.169:65453] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac0DYT7Idlm5j9frhqT3OQAAAFY"]
[Wed Apr 01 19:37:05.683447 2026] [:error] [pid 8908:tid 8913] [client 20.215.250.169:63316] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac0DYfkmxtJXGnLdvgBe_wAAAIA"]
[Wed Apr 01 19:37:06.391783 2026] [:error] [pid 62559:tid 62573] [client 20.215.250.169:64674] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0DYi7NKI8IaNKZFId9ZAAAAUw"]
[Wed Apr 01 19:37:06.965440 2026] [:error] [pid 17856:tid 17879] [client 20.215.250.169:64676] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0DYj7Idlm5j9frhqT3RAAAAFU"]
[Wed Apr 01 19:37:07.523961 2026] [:error] [pid 8909:tid 8945] [client 20.215.250.169:64606] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0DYzvP_a0662gDl6B7IAAAAMQ"]
[Wed Apr 01 19:37:08.293727 2026] [:error] [pid 8909:tid 8965] [client 20.215.250.169:63344] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0DZDvP_a0662gDl6B7JgAAANg"]
[Wed Apr 01 19:37:08.938903 2026] [:error] [pid 8910:tid 8972] [client 20.215.250.169:65404] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "ac0DZKJZINUcF3tYgExJ4gAAAQQ"]
[Wed Apr 01 19:37:09.520973 2026] [:error] [pid 62559:tid 62565] [client 20.215.250.169:65465] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "ac0DZS7NKI8IaNKZFId9awAAAUQ"]
[Wed Apr 01 19:37:10.286314 2026] [:error] [pid 62559:tid 62575] [client 20.215.250.169:63378] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0DZi7NKI8IaNKZFId9bQAAAU4"]
[Wed Apr 01 19:37:10.881980 2026] [:error] [pid 8995:tid 9017] [client 20.215.250.169:64057] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0DZuonaBjs3qxcRees0AAAABM"]
[Wed Apr 01 19:37:11.468737 2026] [:error] [pid 17856:tid 17870] [client 20.215.250.169:64584] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0DZz7Idlm5j9frhqT3TAAAAEw"]
[Wed Apr 01 19:37:12.096154 2026] [:error] [pid 8995:tid 8998] [client 20.215.250.169:63980] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0DaOonaBjs3qxcRees1AAAAAA"]
[Wed Apr 01 19:37:12.686492 2026] [:error] [pid 8995:tid 9016] [client 20.215.250.169:64579] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "ac0DaOonaBjs3qxcRees1gAAABI"]
[Wed Apr 01 19:37:13.231201 2026] [:error] [pid 17856:tid 17860] [client 20.215.250.169:64012] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "ac0DaT7Idlm5j9frhqT3UgAAAEI"]
[Wed Apr 01 19:37:13.807451 2026] [:error] [pid 8910:tid 8992] [client 20.215.250.169:64622] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rogsa.php"] [unique_id "ac0DaaJZINUcF3tYgExJ5AAAARg"]
[Wed Apr 01 19:37:14.568520 2026] [:error] [pid 8910:tid 8973] [client 20.215.250.169:64007] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htzevfl4k9ey5hoaywdwiCdefault.php"] [unique_id "ac0DaqJZINUcF3tYgExJ5wAAAQU"]
[Wed Apr 01 19:37:15.093468 2026] [:error] [pid 8909:tid 8956] [client 20.215.250.169:63421] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htzevfl4k9ey5hoaywdwiCdefault.php"] [unique_id "ac0DazvP_a0662gDl6B7PQAAAM8"]
[Wed Apr 01 19:37:15.628326 2026] [:error] [pid 8909:tid 8948] [client 20.215.250.169:64621] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htzevfl4k9ey5hoaywdwiCdefault.php"] [unique_id "ac0DazvP_a0662gDl6B7QgAAAMc"]
[Wed Apr 01 19:37:16.787890 2026] [:error] [pid 17856:tid 17869] [client 20.215.250.169:64693] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0DbD7Idlm5j9frhqT3ZQAAAEs"]
[Wed Apr 01 19:37:17.328903 2026] [:error] [pid 8910:tid 8980] [client 20.215.250.169:64697] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a8.php"] [unique_id "ac0DbaJZINUcF3tYgExJ6QAAAQw"]
[Wed Apr 01 19:37:17.903167 2026] [:error] [pid 17856:tid 17877] [client 20.215.250.169:63959] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a8.php"] [unique_id "ac0DbT7Idlm5j9frhqT3agAAAFM"]
[Wed Apr 01 19:37:18.422814 2026] [:error] [pid 17856:tid 17869] [client 20.215.250.169:64638] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a8.php"] [unique_id "ac0Dbj7Idlm5j9frhqT3bwAAAEs"]
[Wed Apr 01 19:37:19.031421 2026] [:error] [pid 17856:tid 17870] [client 20.215.250.169:64641] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0Dbz7Idlm5j9frhqT3dQAAAEw"]
[Wed Apr 01 19:37:19.583977 2026] [:error] [pid 8908:tid 8930] [client 20.215.250.169:64011] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0Db_kmxtJXGnLdvgBfMAAAAJE"]
[Wed Apr 01 19:37:20.126796 2026] [:error] [pid 17856:tid 17881] [client 20.215.250.169:63312] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0DcD7Idlm5j9frhqT3jwAAAFc"]
[Wed Apr 01 19:37:20.676952 2026] [:error] [pid 17856:tid 17868] [client 20.215.250.169:63969] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0DcD7Idlm5j9frhqT3lQAAAEo"]
[Wed Apr 01 19:37:21.298492 2026] [:error] [pid 8909:tid 8964] [client 20.215.250.169:63981] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0DcTvP_a0662gDl6B7agAAANc"]
[Wed Apr 01 19:37:21.881331 2026] [:error] [pid 8908:tid 8927] [client 20.215.250.169:64040] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0DcfkmxtJXGnLdvgBfVQAAAI4"]
[Wed Apr 01 19:37:22.436526 2026] [:error] [pid 8909:tid 8962] [client 20.215.250.169:65456] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0DcjvP_a0662gDl6B7dgAAANU"]
[Wed Apr 01 19:37:23.142630 2026] [:error] [pid 62559:tid 62576] [client 20.215.250.169:64044] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0Dcy7NKI8IaNKZFId9fQAAAU8"]
[Wed Apr 01 19:37:23.946463 2026] [:error] [pid 8909:tid 8948] [client 20.215.250.169:65456] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "ac0DczvP_a0662gDl6B7fAAAAMc"]
[Wed Apr 01 19:37:24.733696 2026] [:error] [pid 17856:tid 17870] [client 20.215.250.169:63326] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "ac0DdD7Idlm5j9frhqT3mgAAAEw"]
[Wed Apr 01 19:37:25.396769 2026] [:error] [pid 17856:tid 17868] [client 20.215.250.169:63363] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "ac0DdT7Idlm5j9frhqT3nAAAAEo"]
[Wed Apr 01 19:37:26.016617 2026] [:error] [pid 8909:tid 8949] [client 20.215.250.169:64612] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "ac0DdjvP_a0662gDl6B7hAAAAMg"]
[Wed Apr 01 19:37:26.812253 2026] [:error] [pid 8909:tid 8956] [client 20.215.250.169:63361] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Geforce.php"] [unique_id "ac0DdjvP_a0662gDl6B7hwAAAM8"]
[Wed Apr 01 19:37:27.483175 2026] [:error] [pid 8909:tid 8963] [client 20.215.250.169:65450] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/press.php"] [unique_id "ac0DdzvP_a0662gDl6B7iwAAANY"]
[Wed Apr 01 19:37:28.332767 2026] [:error] [pid 17856:tid 17882] [client 20.215.250.169:64024] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/press.php"] [unique_id "ac0DeD7Idlm5j9frhqT4SAAAAFg"]
[Wed Apr 01 19:37:29.136462 2026] [:error] [pid 8908:tid 8929] [client 20.215.250.169:63953] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "ac0DefkmxtJXGnLdvgBfiAAAAJA"]
[Wed Apr 01 19:37:29.857538 2026] [:error] [pid 8910:tid 8969] [client 20.215.250.169:65397] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "ac0DeaJZINUcF3tYgExJ7wAAAQE"]
[Wed Apr 01 19:37:30.560203 2026] [:error] [pid 17856:tid 17878] [client 20.215.250.169:63415] [client 20.215.250.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "ac0Dej7Idlm5j9frhqT4WAAAAFQ"]
[Wed Apr 01 20:04:01.298000 2026] [:error] [pid 8910:tid 8972] [client 185.175.254.11:55109] [client 185.175.254.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.175.254.11, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac0JsaJZINUcF3tYgExRiAAAAQQ"]
[Wed Apr 01 20:04:01.302818 2026] [:error] [pid 8910:tid 8972] [client 185.175.254.11:55109] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 01 23:28:43.327248 2026] [:error] [pid 8910:tid 8968] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 01 23:28:43.573995 2026] [:error] [pid 8910:tid 8991] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Wed Apr 01 23:28:43.813094 2026] [:error] [pid 8910:tid 8988] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 01 23:28:44.052002 2026] [:error] [pid 8910:tid 8977] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Wed Apr 01 23:28:44.291640 2026] [:error] [pid 8910:tid 8987] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/x1.php
[Wed Apr 01 23:28:44.530895 2026] [:error] [pid 8910:tid 8973] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Wed Apr 01 23:28:45.008167 2026] [:error] [pid 8910:tid 8989] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Wed Apr 01 23:28:45.250690 2026] [:error] [pid 8910:tid 8975] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/24.php
[Wed Apr 01 23:28:45.536920 2026] [:error] [pid 8910:tid 8982] [client 51.103.96.231:55718] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Wed Apr 01 23:28:45.776519 2026] [:error] [pid 8910:tid 8979] [client 51.103.96.231:55718] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "ac05raJZINUcF3tYgEyE_gAAAQs"]
[Wed Apr 01 23:28:46.354956 2026] [:error] [pid 8995:tid 9003] [client 51.103.96.231:51383] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "ac05ruonaBjs3qxcRef08QAAAAU"]
[Wed Apr 01 23:28:46.907548 2026] [:error] [pid 17856:tid 17859] [client 51.103.96.231:47085] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "ac05rj7Idlm5j9frhqR-pgAAAEE"]
[Wed Apr 01 23:28:47.574770 2026] [:error] [pid 8910:tid 8974] [client 51.103.96.231:53588] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "ac05r6JZINUcF3tYgEyFBQAAAQY"]
[Wed Apr 01 23:28:48.249309 2026] [:error] [pid 17856:tid 17881] [client 51.103.96.231:49016] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "ac05sD7Idlm5j9frhqR-rwAAAFc"]
[Wed Apr 01 23:28:48.856127 2026] [:error] [pid 8995:tid 9022] [client 51.103.96.231:47042] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "ac05sOonaBjs3qxcRef0-QAAABg"]
[Wed Apr 01 23:28:49.546365 2026] [:error] [pid 17856:tid 17866] [client 51.103.96.231:4765] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "ac05sT7Idlm5j9frhqR-ugAAAEg"]
[Wed Apr 01 23:28:50.279676 2026] [:error] [pid 8909:tid 8944] [client 51.103.96.231:53599] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyiiz.php"] [unique_id "ac05sjvP_a0662gDl6ATQwAAAMM"]
[Wed Apr 01 23:28:50.963730 2026] [:error] [pid 62559:tid 62584] [client 51.103.96.231:51346] [client 51.103.96.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/app.php"] [unique_id "ac05si7NKI8IaNKZFIf37AAAAVc"]
[Wed Apr 01 23:28:51.526694 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:51351] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac05s_kmxtJXGnLdvgDUhwAAAIE"]
[Wed Apr 01 23:28:52.229854 2026] [:error] [pid 8908:tid 8937] [client 51.103.96.231:50865] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac05tPkmxtJXGnLdvgDUjAAAAJg"]
[Wed Apr 01 23:28:52.884696 2026] [:error] [pid 62559:tid 62572] [client 51.103.96.231:64104] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac05tC7NKI8IaNKZFIf38AAAAUs"]
[Wed Apr 01 23:28:53.488288 2026] [:error] [pid 62559:tid 62563] [client 51.103.96.231:55705] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac05tS7NKI8IaNKZFIf39AAAAUI"]
[Wed Apr 01 23:28:54.140072 2026] [:error] [pid 8995:tid 9008] [client 51.103.96.231:55715] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac05tuonaBjs3qxcRef1CgAAAAo"]
[Wed Apr 01 23:28:54.757614 2026] [:error] [pid 62559:tid 62565] [client 51.103.96.231:53577] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac05ti7NKI8IaNKZFIf3_QAAAUQ"]
[Wed Apr 01 23:28:55.521165 2026] [:error] [pid 8910:tid 8986] [client 51.103.96.231:51342] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac05t6JZINUcF3tYgEyFCQAAARI"]
[Wed Apr 01 23:28:56.381394 2026] [:error] [pid 8995:tid 9014] [client 51.103.96.231:50849] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac05uOonaBjs3qxcRef1EAAAABA"]
[Wed Apr 01 23:28:56.950108 2026] [:error] [pid 8910:tid 8969] [client 51.103.96.231:4772] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac05uKJZINUcF3tYgEyFDAAAAQE"]
[Wed Apr 01 23:28:57.597697 2026] [:error] [pid 17856:tid 17875] [client 51.103.96.231:4792] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac05uT7Idlm5j9frhqR-ywAAAFE"]
[Wed Apr 01 23:28:58.518532 2026] [:error] [pid 17856:tid 17864] [client 51.103.96.231:62475] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac05uj7Idlm5j9frhqR-0AAAAEY"]
[Wed Apr 01 23:28:59.786031 2026] [:error] [pid 8909:tid 8947] [client 51.103.96.231:47070] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac05uzvP_a0662gDl6ATVAAAAMY"]
[Wed Apr 01 23:29:00.869702 2026] [:error] [pid 8908:tid 8915] [client 51.103.96.231:51328] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "ac05vPkmxtJXGnLdvgDUlAAAAII"]
[Wed Apr 01 23:29:01.584292 2026] [:error] [pid 8995:tid 9015] [client 51.103.96.231:53613] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "ac05veonaBjs3qxcRef1GgAAABE"]
[Wed Apr 01 23:29:02.312701 2026] [:error] [pid 8995:tid 9003] [client 51.103.96.231:51359] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "ac05vuonaBjs3qxcRef1HgAAAAU"]
[Wed Apr 01 23:29:03.058246 2026] [:error] [pid 8995:tid 9005] [client 51.103.96.231:51338] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "ac05v-onaBjs3qxcRef1JQAAAAc"]
[Wed Apr 01 23:29:03.804126 2026] [:error] [pid 17856:tid 17879] [client 51.103.96.231:62509] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac05vz7Idlm5j9frhqR-4wAAAFU"]
[Wed Apr 01 23:29:04.327086 2026] [:error] [pid 8995:tid 8998] [client 51.103.96.231:55701] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac05wOonaBjs3qxcRef1LQAAAAA"]
[Wed Apr 01 23:29:04.825251 2026] [:error] [pid 62559:tid 62566] [client 51.103.96.231:55693] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac05wC7NKI8IaNKZFIf4EAAAAUU"]
[Wed Apr 01 23:29:05.515425 2026] [:error] [pid 62559:tid 62563] [client 51.103.96.231:51380] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac05wS7NKI8IaNKZFIf4EwAAAUI"]
[Wed Apr 01 23:29:06.037689 2026] [:error] [pid 62559:tid 62565] [client 51.103.96.231:51391] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "ac05wi7NKI8IaNKZFIf4GQAAAUQ"]
[Wed Apr 01 23:29:07.364410 2026] [:error] [pid 62559:tid 62563] [client 51.103.96.231:4744] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "ac05wy7NKI8IaNKZFIf4IgAAAUI"]
[Wed Apr 01 23:29:07.939514 2026] [:error] [pid 62559:tid 62567] [client 51.103.96.231:4747] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "ac05wy7NKI8IaNKZFIf4KAAAAUY"]
[Wed Apr 01 23:29:09.319212 2026] [:error] [pid 17856:tid 17880] [client 51.103.96.231:48996] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/erty.php"] [unique_id "ac05xT7Idlm5j9frhqR-7wAAAFY"]
[Wed Apr 01 23:29:10.257455 2026] [:error] [pid 8908:tid 8920] [client 51.103.96.231:53576] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "ac05xvkmxtJXGnLdvgDUmQAAAIc"]
[Wed Apr 01 23:29:11.022948 2026] [:error] [pid 8910:tid 8990] [client 51.103.96.231:51382] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "ac05x6JZINUcF3tYgEyFGAAAARY"]
[Wed Apr 01 23:29:11.996390 2026] [:error] [pid 8908:tid 8929] [client 51.103.96.231:50866] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "ac05x_kmxtJXGnLdvgDUowAAAJA"]
[Wed Apr 01 23:29:12.752454 2026] [:error] [pid 62559:tid 62574] [client 51.103.96.231:55027] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0.php"] [unique_id "ac05yC7NKI8IaNKZFIf4NQAAAU0"]
[Wed Apr 01 23:29:13.313120 2026] [:error] [pid 8908:tid 8924] [client 51.103.96.231:53605] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "ac05yfkmxtJXGnLdvgDUqwAAAIs"]
[Wed Apr 01 23:29:14.431127 2026] [:error] [pid 8908:tid 8934] [client 51.103.96.231:49372] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "ac05yvkmxtJXGnLdvgDUsgAAAJU"]
[Wed Apr 01 23:29:15.078979 2026] [:error] [pid 62559:tid 62572] [client 51.103.96.231:49370] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "ac05yy7NKI8IaNKZFIf4QQAAAUs"]
[Wed Apr 01 23:29:15.657040 2026] [:error] [pid 62559:tid 62564] [client 51.103.96.231:53579] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "ac05yy7NKI8IaNKZFIf4RAAAAUM"]
[Wed Apr 01 23:29:16.236909 2026] [:error] [pid 8908:tid 8937] [client 51.103.96.231:52161] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac05zPkmxtJXGnLdvgDUtQAAAJg"]
[Wed Apr 01 23:29:17.069919 2026] [:error] [pid 62559:tid 62579] [client 51.103.96.231:51379] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac05zS7NKI8IaNKZFIf4TgAAAVI"]
[Wed Apr 01 23:29:17.750897 2026] [:error] [pid 8995:tid 9008] [client 51.103.96.231:51345] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac05zeonaBjs3qxcRef1SAAAAAo"]
[Wed Apr 01 23:29:18.238664 2026] [:error] [pid 8909:tid 8951] [client 51.103.96.231:4413] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac05zjvP_a0662gDl6ATbwAAAMo"]
[Wed Apr 01 23:29:18.866040 2026] [:error] [pid 8910:tid 8974] [client 51.103.96.231:48963] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ac05zqJZINUcF3tYgEyFHQAAAQY"]
[Wed Apr 01 23:29:19.406673 2026] [:error] [pid 62559:tid 62567] [client 51.103.96.231:4385] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ac05zy7NKI8IaNKZFIf4UwAAAUY"]
[Wed Apr 01 23:29:19.926029 2026] [:error] [pid 8995:tid 9022] [client 51.103.96.231:53571] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ac05z-onaBjs3qxcRef1TQAAABg"]
[Wed Apr 01 23:29:20.671980 2026] [:error] [pid 8995:tid 9005] [client 51.103.96.231:50856] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "ac050OonaBjs3qxcRef1UAAAAAc"]
[Wed Apr 01 23:29:21.466794 2026] [:error] [pid 17856:tid 17874] [client 51.103.96.231:49365] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac050T7Idlm5j9frhqR--gAAAFA"]
[Wed Apr 01 23:29:22.081494 2026] [:error] [pid 8908:tid 8921] [client 51.103.96.231:55031] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac050vkmxtJXGnLdvgDUugAAAIg"]
[Wed Apr 01 23:29:22.834456 2026] [:error] [pid 8908:tid 8913] [client 51.103.96.231:49364] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac050vkmxtJXGnLdvgDUuwAAAIA"]
[Wed Apr 01 23:29:23.482675 2026] [:error] [pid 8908:tid 8937] [client 51.103.96.231:48981] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac050_kmxtJXGnLdvgDUvgAAAJg"]
[Wed Apr 01 23:29:24.385597 2026] [:error] [pid 8908:tid 8933] [client 51.103.96.231:55354] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "ac051PkmxtJXGnLdvgDUxwAAAJQ"]
[Wed Apr 01 23:29:25.133434 2026] [:error] [pid 62559:tid 62566] [client 51.103.96.231:53583] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "ac051S7NKI8IaNKZFIf4awAAAUU"]
[Wed Apr 01 23:29:25.654327 2026] [:error] [pid 8908:tid 8913] [client 51.103.96.231:4406] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "ac051fkmxtJXGnLdvgDU1QAAAIA"]
[Wed Apr 01 23:29:26.421209 2026] [:error] [pid 8908:tid 8916] [client 51.103.96.231:49010] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwq13.php"] [unique_id "ac051vkmxtJXGnLdvgDU4QAAAIM"]
[Wed Apr 01 23:29:26.925964 2026] [:error] [pid 8908:tid 8924] [client 51.103.96.231:53626] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aapig.php"] [unique_id "ac051vkmxtJXGnLdvgDU5wAAAIs"]
[Wed Apr 01 23:29:27.462743 2026] [:error] [pid 17856:tid 17872] [client 51.103.96.231:54996] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aapig.php"] [unique_id "ac051z7Idlm5j9frhqR_BQAAAE4"]
[Wed Apr 01 23:29:27.962650 2026] [:error] [pid 8995:tid 9003] [client 51.103.96.231:49014] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aapig.php"] [unique_id "ac051-onaBjs3qxcRef1WgAAAAU"]
[Wed Apr 01 23:29:28.438811 2026] [:error] [pid 8910:tid 8973] [client 51.103.96.231:4388] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aapig.php"] [unique_id "ac052KJZINUcF3tYgEyFJgAAAQU"]
[Wed Apr 01 23:29:28.927431 2026] [:error] [pid 8908:tid 8915] [client 51.103.96.231:48995] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webadmin.php"] [unique_id "ac052PkmxtJXGnLdvgDU9wAAAII"]
[Wed Apr 01 23:29:29.498620 2026] [:error] [pid 8908:tid 8937] [client 51.103.96.231:55310] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webadmin.php"] [unique_id "ac052fkmxtJXGnLdvgDU_AAAAJg"]
[Wed Apr 01 23:29:30.036326 2026] [:error] [pid 8908:tid 8913] [client 51.103.96.231:49374] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webadmin.php"] [unique_id "ac052vkmxtJXGnLdvgDVAAAAAIA"]
[Wed Apr 01 23:29:30.602671 2026] [:error] [pid 8908:tid 8917] [client 51.103.96.231:49017] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webadmin.php"] [unique_id "ac052vkmxtJXGnLdvgDVBQAAAIQ"]
[Wed Apr 01 23:29:31.131009 2026] [:error] [pid 62559:tid 62566] [client 51.103.96.231:52211] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "ac052y7NKI8IaNKZFIf4dAAAAUU"]
[Wed Apr 01 23:29:31.657274 2026] [:error] [pid 8909:tid 8954] [client 51.103.96.231:4359] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "ac052zvP_a0662gDl6ATrAAAAM0"]
[Wed Apr 01 23:29:32.403779 2026] [:error] [pid 8909:tid 8947] [client 51.103.96.231:4377] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "ac053DvP_a0662gDl6ATsgAAAMY"]
[Wed Apr 01 23:29:32.951338 2026] [:error] [pid 8909:tid 8955] [client 51.103.96.231:49400] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xc0252.php"] [unique_id "ac053DvP_a0662gDl6ATtgAAAM4"]
[Wed Apr 01 23:29:33.476549 2026] [:error] [pid 17856:tid 17863] [client 51.103.96.231:48992] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws84.php"] [unique_id "ac053T7Idlm5j9frhqR_CwAAAEU"]
[Wed Apr 01 23:29:34.170974 2026] [:error] [pid 8908:tid 8929] [client 51.103.96.231:50861] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws84.php"] [unique_id "ac053vkmxtJXGnLdvgDVFQAAAJA"]
[Wed Apr 01 23:29:34.734371 2026] [:error] [pid 8908:tid 8928] [client 51.103.96.231:4415] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws84.php"] [unique_id "ac053vkmxtJXGnLdvgDVGwAAAI8"]
[Wed Apr 01 23:29:35.281664 2026] [:error] [pid 8908:tid 8930] [client 51.103.96.231:55340] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws84.php"] [unique_id "ac053_kmxtJXGnLdvgDVHwAAAJE"]
[Wed Apr 01 23:29:35.848177 2026] [:error] [pid 8909:tid 8951] [client 51.103.96.231:55344] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "ac053zvP_a0662gDl6ATvgAAAMo"]
[Wed Apr 01 23:29:36.540696 2026] [:error] [pid 8909:tid 8961] [client 51.103.96.231:49384] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "ac054DvP_a0662gDl6ATwgAAANQ"]
[Wed Apr 01 23:29:37.223478 2026] [:error] [pid 8909:tid 8960] [client 51.103.96.231:55320] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "ac054TvP_a0662gDl6ATxwAAANM"]
[Wed Apr 01 23:29:37.787762 2026] [:error] [pid 8908:tid 8932] [client 51.103.96.231:4405] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sc.php"] [unique_id "ac054fkmxtJXGnLdvgDVJQAAAJM"]
[Wed Apr 01 23:29:38.402636 2026] [:error] [pid 17856:tid 17861] [client 51.103.96.231:52213] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mis.php"] [unique_id "ac054j7Idlm5j9frhqR_FQAAAEM"]
[Wed Apr 01 23:29:38.920199 2026] [:error] [pid 8909:tid 8954] [client 51.103.96.231:4376] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mis.php"] [unique_id "ac054jvP_a0662gDl6ATywAAAM0"]
[Wed Apr 01 23:29:39.564575 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:49396] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mis.php"] [unique_id "ac054_kmxtJXGnLdvgDVKwAAAIE"]
[Wed Apr 01 23:29:40.121520 2026] [:error] [pid 8909:tid 8947] [client 51.103.96.231:55004] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mis.php"] [unique_id "ac055DvP_a0662gDl6ATzgAAAMY"]
[Wed Apr 01 23:29:40.730814 2026] [:error] [pid 62559:tid 62568] [client 51.103.96.231:57220] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zogy1.php"] [unique_id "ac055C7NKI8IaNKZFIf4hQAAAUc"]
[Wed Apr 01 23:29:41.250759 2026] [:error] [pid 8908:tid 8930] [client 51.103.96.231:49000] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zogy1.php"] [unique_id "ac055fkmxtJXGnLdvgDVMgAAAJE"]
[Wed Apr 01 23:29:41.765468 2026] [:error] [pid 62559:tid 62562] [client 51.103.96.231:48978] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zogy1.php"] [unique_id "ac055S7NKI8IaNKZFIf4igAAAUE"]
[Wed Apr 01 23:29:42.378413 2026] [:error] [pid 8909:tid 8943] [client 51.103.96.231:57258] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zogy1.php"] [unique_id "ac055jvP_a0662gDl6AT0QAAAMI"]
[Wed Apr 01 23:29:42.893302 2026] [:error] [pid 8908:tid 8918] [client 51.103.96.231:51362] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xvs.php"] [unique_id "ac055vkmxtJXGnLdvgDVOQAAAIU"]
[Wed Apr 01 23:29:43.394959 2026] [:error] [pid 8908:tid 8926] [client 51.103.96.231:55014] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xvs.php"] [unique_id "ac055_kmxtJXGnLdvgDVOwAAAI0"]
[Wed Apr 01 23:29:43.868984 2026] [:error] [pid 62559:tid 62580] [client 51.103.96.231:53589] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xvs.php"] [unique_id "ac055y7NKI8IaNKZFIf4jQAAAVM"]
[Wed Apr 01 23:29:44.417455 2026] [:error] [pid 8909:tid 8956] [client 51.103.96.231:55314] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xvs.php"] [unique_id "ac056DvP_a0662gDl6AT0wAAAM8"]
[Wed Apr 01 23:29:44.935194 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:4382] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "ac056PkmxtJXGnLdvgDVQwAAAIE"]
[Wed Apr 01 23:29:45.585708 2026] [:error] [pid 8908:tid 8926] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Wed Apr 01 23:29:45.888490 2026] [:error] [pid 8908:tid 8926] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Wed Apr 01 23:29:46.126875 2026] [:error] [pid 8908:tid 8936] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Apr 01 23:29:46.606325 2026] [:error] [pid 8908:tid 8928] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Wed Apr 01 23:29:46.855090 2026] [:error] [pid 8908:tid 8924] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/com.php
[Wed Apr 01 23:29:47.093372 2026] [:error] [pid 8908:tid 8917] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Apr 01 23:29:47.333382 2026] [:error] [pid 8908:tid 8920] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Wed Apr 01 23:29:47.571522 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Apr 01 23:29:47.813652 2026] [:error] [pid 8908:tid 8918] [client 51.103.96.231:54993] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 01 23:29:48.351471 2026] [:error] [pid 8908:tid 8928] [client 51.103.96.231:54993] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "ac057PkmxtJXGnLdvgDVXgAAAI8"]
[Wed Apr 01 23:29:48.855063 2026] [:error] [pid 8909:tid 8959] [client 51.103.96.231:49020] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "ac057DvP_a0662gDl6AT1AAAANI"]
[Wed Apr 01 23:29:49.391954 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:63651] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "ac057fkmxtJXGnLdvgDVZAAAAIE"]
[Wed Apr 01 23:29:49.889067 2026] [:error] [pid 8908:tid 8929] [client 51.103.96.231:55327] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v3.php"] [unique_id "ac057fkmxtJXGnLdvgDVZwAAAJA"]
[Wed Apr 01 23:29:50.489280 2026] [:error] [pid 8908:tid 8925] [client 51.103.96.231:49352] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "ac057vkmxtJXGnLdvgDVawAAAIw"]
[Wed Apr 01 23:29:50.974783 2026] [:error] [pid 8908:tid 8920] [client 51.103.96.231:55012] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "ac057vkmxtJXGnLdvgDVcAAAAIc"]
[Wed Apr 01 23:29:51.652868 2026] [:error] [pid 8908:tid 8919] [client 51.103.96.231:52206] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "ac057_kmxtJXGnLdvgDVdQAAAIY"]
[Wed Apr 01 23:29:52.127413 2026] [:error] [pid 8910:tid 8981] [client 51.103.96.231:54988] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "ac058KJZINUcF3tYgEyFMQAAAQ0"]
[Wed Apr 01 23:29:52.762658 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:57224] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "ac058PkmxtJXGnLdvgDVewAAAIE"]
[Wed Apr 01 23:29:53.318688 2026] [:error] [pid 8908:tid 8932] [client 51.103.96.231:57244] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "ac058fkmxtJXGnLdvgDVgAAAAJM"]
[Wed Apr 01 23:29:53.885133 2026] [:error] [pid 8995:tid 9005] [client 51.103.96.231:55341] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "ac058eonaBjs3qxcRef1bQAAAAc"]
[Wed Apr 01 23:29:54.387373 2026] [:error] [pid 8909:tid 8955] [client 51.103.96.231:52193] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/to.php"] [unique_id "ac058jvP_a0662gDl6AT4gAAAM4"]
[Wed Apr 01 23:29:54.880134 2026] [:error] [pid 8909:tid 8960] [client 51.103.96.231:55729] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wqqs.php"] [unique_id "ac058jvP_a0662gDl6AT5gAAANM"]
[Wed Apr 01 23:29:55.426179 2026] [:error] [pid 62559:tid 62561] [client 51.103.96.231:55325] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wqqs.php"] [unique_id "ac058y7NKI8IaNKZFIf4mwAAAUA"]
[Wed Apr 01 23:29:55.967712 2026] [:error] [pid 8995:tid 9016] [client 51.103.96.231:52164] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wqqs.php"] [unique_id "ac058-onaBjs3qxcRef1cgAAABI"]
[Wed Apr 01 23:29:56.567403 2026] [:error] [pid 8910:tid 8984] [client 51.103.96.231:51331] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wqqs.php"] [unique_id "ac059KJZINUcF3tYgEyFNQAAARA"]
[Wed Apr 01 23:29:57.041120 2026] [:error] [pid 8910:tid 8991] [client 51.103.96.231:54998] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "ac059aJZINUcF3tYgEyFOgAAARc"]
[Wed Apr 01 23:29:57.635665 2026] [:error] [pid 8995:tid 9010] [client 51.103.96.231:55352] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "ac059eonaBjs3qxcRef1cwAAAAw"]
[Wed Apr 01 23:29:58.185688 2026] [:error] [pid 8909:tid 8956] [client 51.103.96.231:51349] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "ac059jvP_a0662gDl6AT7AAAAM8"]
[Wed Apr 01 23:29:58.747056 2026] [:error] [pid 8909:tid 8941] [client 51.103.96.231:55304] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "ac059jvP_a0662gDl6AT7wAAAMA"]
[Wed Apr 01 23:29:59.234663 2026] [:error] [pid 8995:tid 9015] [client 51.103.96.231:55018] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac059-onaBjs3qxcRef1dwAAABE"]
[Wed Apr 01 23:29:59.789207 2026] [:error] [pid 62559:tid 62579] [client 51.103.96.231:49005] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac059y7NKI8IaNKZFIf4nwAAAVI"]
[Wed Apr 01 23:30:00.276017 2026] [:error] [pid 8910:tid 8971] [client 51.103.96.231:54997] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac05-KJZINUcF3tYgEyFPQAAAQM"]
[Wed Apr 01 23:30:00.778303 2026] [:error] [pid 8995:tid 9021] [client 51.103.96.231:48983] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac05-OonaBjs3qxcRef1ewAAABc"]
[Wed Apr 01 23:30:01.312550 2026] [:error] [pid 8908:tid 8932] [client 51.103.96.231:49379] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aifa.php"] [unique_id "ac05-fkmxtJXGnLdvgDVmQAAAJM"]
[Wed Apr 01 23:30:01.843711 2026] [:error] [pid 62559:tid 62577] [client 51.103.96.231:49406] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aifa.php"] [unique_id "ac05-S7NKI8IaNKZFIf4pAAAAVA"]
[Wed Apr 01 23:30:02.356728 2026] [:error] [pid 62559:tid 62565] [client 51.103.96.231:51387] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aifa.php"] [unique_id "ac05-i7NKI8IaNKZFIf4pgAAAUQ"]
[Wed Apr 01 23:30:02.869547 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:51385] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aifa.php"] [unique_id "ac05-vkmxtJXGnLdvgDVnwAAAIE"]
[Wed Apr 01 23:30:03.378940 2026] [:error] [pid 8908:tid 8921] [client 51.103.96.231:51356] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "ac05-_kmxtJXGnLdvgDVpAAAAIg"]
[Wed Apr 01 23:30:03.954132 2026] [:error] [pid 8910:tid 8992] [client 51.103.96.231:54978] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "ac05-6JZINUcF3tYgEyFQgAAARg"]
[Wed Apr 01 23:30:04.444210 2026] [:error] [pid 17856:tid 17878] [client 51.103.96.231:50842] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "ac05_D7Idlm5j9frhqR_KgAAAFQ"]
[Wed Apr 01 23:30:04.989135 2026] [:error] [pid 8910:tid 8984] [client 51.103.96.231:50852] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "ac05_KJZINUcF3tYgEyFRQAAARA"]
[Wed Apr 01 23:30:05.502104 2026] [:error] [pid 8995:tid 9013] [client 51.103.96.231:48994] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "ac05_eonaBjs3qxcRef1hAAAAA8"]
[Wed Apr 01 23:30:06.007703 2026] [:error] [pid 8909:tid 8962] [client 51.103.96.231:4368] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "ac05_jvP_a0662gDl6AT_gAAANU"]
[Wed Apr 01 23:30:06.521105 2026] [:error] [pid 8910:tid 8972] [client 51.103.96.231:57267] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "ac05_qJZINUcF3tYgEyFRwAAAQQ"]
[Wed Apr 01 23:30:07.035543 2026] [:error] [pid 8909:tid 8957] [client 51.103.96.231:50868] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/feokc.php"] [unique_id "ac05_zvP_a0662gDl6AUAQAAANA"]
[Wed Apr 01 23:30:07.567459 2026] [:error] [pid 8909:tid 8964] [client 51.103.96.231:4356] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "ac05_zvP_a0662gDl6AUBgAAANc"]
[Wed Apr 01 23:30:08.055928 2026] [:error] [pid 8909:tid 8942] [client 51.103.96.231:49354] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "ac06ADvP_a0662gDl6AUCQAAAME"]
[Wed Apr 01 23:30:08.586272 2026] [:error] [pid 8909:tid 8952] [client 51.103.96.231:50864] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "ac06ADvP_a0662gDl6AUDQAAAMs"]
[Wed Apr 01 23:30:09.090156 2026] [:error] [pid 8909:tid 8947] [client 51.103.96.231:55356] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nc4.php"] [unique_id "ac06ATvP_a0662gDl6AUEwAAAMY"]
[Wed Apr 01 23:30:09.592429 2026] [:error] [pid 62559:tid 62582] [client 51.103.96.231:50835] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "ac06AS7NKI8IaNKZFIf4tAAAAVU"]
[Wed Apr 01 23:30:10.077602 2026] [:error] [pid 8909:tid 8964] [client 51.103.96.231:51335] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "ac06AjvP_a0662gDl6AUFQAAANc"]
[Wed Apr 01 23:30:10.596317 2026] [:error] [pid 62559:tid 62562] [client 51.103.96.231:50857] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "ac06Ai7NKI8IaNKZFIf4uAAAAUE"]
[Wed Apr 01 23:30:11.105413 2026] [:error] [pid 8909:tid 8944] [client 51.103.96.231:56503] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "ac06AzvP_a0662gDl6AUFgAAAMM"]
[Wed Apr 01 23:30:11.600681 2026] [:error] [pid 8995:tid 9012] [client 51.103.96.231:51340] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac06A-onaBjs3qxcRef1jQAAAA4"]
[Wed Apr 01 23:30:12.079441 2026] [:error] [pid 17856:tid 17876] [client 51.103.96.231:55035] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac06BD7Idlm5j9frhqR_OgAAAFI"]
[Wed Apr 01 23:30:12.557891 2026] [:error] [pid 8910:tid 8989] [client 51.103.96.231:53569] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac06BKJZINUcF3tYgEyFTAAAARU"]
[Wed Apr 01 23:30:13.089192 2026] [:error] [pid 8995:tid 9019] [client 51.103.96.231:51364] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac06BeonaBjs3qxcRef1kgAAABU"]
[Wed Apr 01 23:30:13.576563 2026] [:error] [pid 8910:tid 8970] [client 51.103.96.231:4361] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac06BaJZINUcF3tYgEyFUwAAAQI"]
[Wed Apr 01 23:30:14.116277 2026] [:error] [pid 8909:tid 8948] [client 51.103.96.231:52170] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac06BjvP_a0662gDl6AUIAAAAMc"]
[Wed Apr 01 23:30:14.633219 2026] [:error] [pid 8995:tid 9006] [client 51.103.96.231:49375] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac06BuonaBjs3qxcRef1lgAAAAg"]
[Wed Apr 01 23:30:15.139732 2026] [:error] [pid 17856:tid 17870] [client 51.103.96.231:62513] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac06Bz7Idlm5j9frhqR_QAAAAEw"]
[Wed Apr 01 23:30:15.668910 2026] [:error] [pid 8995:tid 9004] [client 51.103.96.231:55359] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "ac06B-onaBjs3qxcRef1mAAAAAY"]
[Wed Apr 01 23:30:16.173852 2026] [:error] [pid 8908:tid 8928] [client 51.103.96.231:49380] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "ac06CPkmxtJXGnLdvgDVrQAAAI8"]
[Wed Apr 01 23:30:16.672293 2026] [:error] [pid 8910:tid 8989] [client 51.103.96.231:48997] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "ac06CKJZINUcF3tYgEyFWgAAARU"]
[Wed Apr 01 23:30:17.194442 2026] [:error] [pid 8908:tid 8935] [client 51.103.96.231:53598] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goat1.php"] [unique_id "ac06CfkmxtJXGnLdvgDVtgAAAJY"]
[Wed Apr 01 23:30:17.666072 2026] [:error] [pid 8908:tid 8937] [client 51.103.96.231:55302] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "ac06CfkmxtJXGnLdvgDVugAAAJg"]
[Wed Apr 01 23:30:18.145808 2026] [:error] [pid 8909:tid 8946] [client 51.103.96.231:50830] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "ac06CjvP_a0662gDl6AUJAAAAMU"]
[Wed Apr 01 23:30:18.630796 2026] [:error] [pid 8908:tid 8922] [client 51.103.96.231:55355] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "ac06CvkmxtJXGnLdvgDVwwAAAIk"]
[Wed Apr 01 23:30:19.178627 2026] [:error] [pid 62559:tid 62580] [client 51.103.96.231:55022] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cron.php"] [unique_id "ac06Cy7NKI8IaNKZFIf4wgAAAVM"]
[Wed Apr 01 23:30:19.665479 2026] [:error] [pid 62559:tid 62568] [client 51.103.96.231:50836] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "ac06Cy7NKI8IaNKZFIf4xAAAAUc"]
[Wed Apr 01 23:30:20.195681 2026] [:error] [pid 62559:tid 62581] [client 51.103.96.231:55349] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "ac06DC7NKI8IaNKZFIf4ywAAAVQ"]
[Wed Apr 01 23:30:20.792600 2026] [:error] [pid 62559:tid 62568] [client 51.103.96.231:49369] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "ac06DC7NKI8IaNKZFIf40gAAAUc"]
[Wed Apr 01 23:30:21.304859 2026] [:error] [pid 62559:tid 62577] [client 51.103.96.231:49359] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yanz.php"] [unique_id "ac06DS7NKI8IaNKZFIf41AAAAVA"]
[Wed Apr 01 23:30:21.881538 2026] [:error] [pid 62559:tid 62564] [client 51.103.96.231:57217] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "ac06DS7NKI8IaNKZFIf42AAAAUM"]
[Wed Apr 01 23:30:22.487664 2026] [:error] [pid 8908:tid 8919] [client 51.103.96.231:48980] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "ac06DvkmxtJXGnLdvgDVzAAAAIY"]
[Wed Apr 01 23:30:23.058898 2026] [:error] [pid 8908:tid 8935] [client 51.103.96.231:50860] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "ac06D_kmxtJXGnLdvgDVzwAAAJY"]
[Wed Apr 01 23:30:23.557407 2026] [:error] [pid 62559:tid 62578] [client 51.103.96.231:52210] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "ac06Dy7NKI8IaNKZFIf43AAAAVE"]
[Wed Apr 01 23:30:24.092596 2026] [:error] [pid 62559:tid 62585] [client 51.103.96.231:56473] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "ac06EC7NKI8IaNKZFIf43gAAAVg"]
[Wed Apr 01 23:30:24.575855 2026] [:error] [pid 8908:tid 8936] [client 51.103.96.231:55025] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "ac06EPkmxtJXGnLdvgDV0wAAAJc"]
[Wed Apr 01 23:30:25.132191 2026] [:error] [pid 8909:tid 8947] [client 51.103.96.231:52183] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "ac06ETvP_a0662gDl6AUMgAAAMY"]
[Wed Apr 01 23:30:25.712733 2026] [:error] [pid 8909:tid 8950] [client 51.103.96.231:54991] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/network.php"] [unique_id "ac06ETvP_a0662gDl6AUMwAAAMk"]
[Wed Apr 01 23:30:26.217406 2026] [:error] [pid 17856:tid 17872] [client 51.103.96.231:55315] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "ac06Ej7Idlm5j9frhqR_SQAAAE4"]
[Wed Apr 01 23:30:26.743330 2026] [:error] [pid 17856:tid 17865] [client 51.103.96.231:54985] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "ac06Ej7Idlm5j9frhqR_TAAAAEc"]
[Wed Apr 01 23:30:27.240022 2026] [:error] [pid 8910:tid 8985] [client 51.103.96.231:4387] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "ac06E6JZINUcF3tYgEyFaAAAARE"]
[Wed Apr 01 23:30:27.725590 2026] [:error] [pid 62559:tid 62569] [client 51.103.96.231:48998] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-2019.php"] [unique_id "ac06Ey7NKI8IaNKZFIf45gAAAUg"]
[Wed Apr 01 23:30:28.218387 2026] [:error] [pid 62559:tid 62583] [client 51.103.96.231:51368] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "ac06FC7NKI8IaNKZFIf46AAAAVY"]
[Wed Apr 01 23:30:28.738568 2026] [:error] [pid 8910:tid 8979] [client 51.103.96.231:49368] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "ac06FKJZINUcF3tYgEyFaQAAAQs"]
[Wed Apr 01 23:30:29.263521 2026] [:error] [pid 17856:tid 17876] [client 51.103.96.231:52204] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "ac06FT7Idlm5j9frhqR_UgAAAFI"]
[Wed Apr 01 23:30:29.777541 2026] [:error] [pid 17856:tid 17875] [client 51.103.96.231:49022] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "ac06FT7Idlm5j9frhqR_VAAAAFE"]
[Wed Apr 01 23:30:30.298169 2026] [:error] [pid 62559:tid 62567] [client 51.103.96.231:49007] [client 51.103.96.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ac06Fi7NKI8IaNKZFIf48wAAAUY"]
[Wed Apr 01 23:30:30.795315 2026] [:error] [pid 8910:tid 8986] [client 51.103.96.231:57256] [client 51.103.96.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ac06FqJZINUcF3tYgEyFawAAARI"]
[Wed Apr 01 23:30:31.291927 2026] [:error] [pid 17856:tid 17873] [client 51.103.96.231:47076] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "ac06Fz7Idlm5j9frhqR_WQAAAE8"]
[Wed Apr 01 23:30:31.811647 2026] [:error] [pid 8909:tid 8965] [client 51.103.96.231:64125] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "ac06FzvP_a0662gDl6AUOwAAANg"]
[Wed Apr 01 23:30:32.371929 2026] [:error] [pid 8909:tid 8964] [client 51.103.96.231:49378] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "ac06GDvP_a0662gDl6AUPwAAANc"]
[Wed Apr 01 23:30:33.027309 2026] [:error] [pid 62559:tid 62577] [client 51.103.96.231:4362] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ac06GS7NKI8IaNKZFIf4_gAAAVA"]
[Wed Apr 01 23:30:33.514678 2026] [:error] [pid 62559:tid 62572] [client 51.103.96.231:52220] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ac06GS7NKI8IaNKZFIf5BAAAAUs"]
[Wed Apr 01 23:30:34.019166 2026] [:error] [pid 17856:tid 17863] [client 51.103.96.231:4391] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ac06Gj7Idlm5j9frhqR_XgAAAEU"]
[Wed Apr 01 23:30:34.568148 2026] [:error] [pid 62559:tid 62569] [client 51.103.96.231:52207] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lock.php"] [unique_id "ac06Gi7NKI8IaNKZFIf5CQAAAUg"]
[Wed Apr 01 23:30:35.148275 2026] [:error] [pid 62559:tid 62570] [client 51.103.96.231:55312] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "ac06Gy7NKI8IaNKZFIf5DQAAAUk"]
[Wed Apr 01 23:30:35.674832 2026] [:error] [pid 8909:tid 8947] [client 51.103.96.231:50819] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "ac06GzvP_a0662gDl6AURwAAAMY"]
[Wed Apr 01 23:30:36.173340 2026] [:error] [pid 8909:tid 8951] [client 51.103.96.231:57261] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "ac06HDvP_a0662gDl6AUSAAAAMo"]
[Wed Apr 01 23:30:36.693101 2026] [:error] [pid 8909:tid 8944] [client 51.103.96.231:57231] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "ac06HDvP_a0662gDl6AUSgAAAMM"]
[Wed Apr 01 23:30:37.170548 2026] [:error] [pid 62559:tid 62578] [client 51.103.96.231:52218] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "ac06HS7NKI8IaNKZFIf5EgAAAVE"]
[Wed Apr 01 23:30:37.693136 2026] [:error] [pid 17856:tid 17867] [client 51.103.96.231:53600] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "ac06HT7Idlm5j9frhqR_YwAAAEk"]
[Wed Apr 01 23:30:38.204084 2026] [:error] [pid 17856:tid 17861] [client 51.103.96.231:50823] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "ac06Hj7Idlm5j9frhqR_ZgAAAEM"]
[Wed Apr 01 23:30:38.721958 2026] [:error] [pid 8995:tid 9014] [client 51.103.96.231:49356] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/marijuana.php"] [unique_id "ac06HuonaBjs3qxcRef1pAAAABA"]
[Wed Apr 01 23:30:39.213876 2026] [:error] [pid 17856:tid 17881] [client 51.103.96.231:55028] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "ac06Hz7Idlm5j9frhqR_awAAAFc"]
[Wed Apr 01 23:30:39.720595 2026] [:error] [pid 17856:tid 17869] [client 51.103.96.231:62523] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "ac06Hz7Idlm5j9frhqR_bQAAAEs"]
[Wed Apr 01 23:30:40.219657 2026] [:error] [pid 17856:tid 17876] [client 51.103.96.231:4366] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "ac06ID7Idlm5j9frhqR_cQAAAFI"]
[Wed Apr 01 23:30:40.705994 2026] [:error] [pid 17856:tid 17877] [client 51.103.96.231:48989] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "ac06ID7Idlm5j9frhqR_cgAAAFM"]
[Wed Apr 01 23:30:41.192600 2026] [:error] [pid 8995:tid 9001] [client 51.103.96.231:57270] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "ac06IeonaBjs3qxcRef1pwAAAAM"]
[Wed Apr 01 23:30:41.683655 2026] [:error] [pid 8909:tid 8945] [client 51.103.96.231:48979] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "ac06ITvP_a0662gDl6AUUgAAAMQ"]
[Wed Apr 01 23:30:42.182024 2026] [:error] [pid 8909:tid 8955] [client 51.103.96.231:4360] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "ac06IjvP_a0662gDl6AUUwAAAM4"]
[Wed Apr 01 23:30:42.690460 2026] [:error] [pid 62559:tid 62571] [client 51.103.96.231:50870] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/444.php"] [unique_id "ac06Ii7NKI8IaNKZFIf5HQAAAUo"]
[Wed Apr 01 23:30:43.220399 2026] [:error] [pid 62559:tid 62563] [client 51.103.96.231:50872] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "ac06Iy7NKI8IaNKZFIf5IAAAAUI"]
[Wed Apr 01 23:30:43.771115 2026] [:error] [pid 8909:tid 8954] [client 51.103.96.231:55298] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "ac06IzvP_a0662gDl6AUWgAAAM0"]
[Wed Apr 01 23:30:44.294842 2026] [:error] [pid 62559:tid 62582] [client 51.103.96.231:64069] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "ac06JC7NKI8IaNKZFIf5JAAAAVU"]
[Wed Apr 01 23:30:44.799198 2026] [:error] [pid 8909:tid 8955] [client 51.103.96.231:4650] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "ac06JDvP_a0662gDl6AUXgAAAM4"]
[Wed Apr 01 23:30:45.337189 2026] [:error] [pid 8909:tid 8943] [client 51.103.96.231:48968] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "ac06JTvP_a0662gDl6AUYwAAAMI"]
[Wed Apr 01 23:30:45.847027 2026] [:error] [pid 8908:tid 8930] [client 51.103.96.231:47075] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "ac06JfkmxtJXGnLdvgDV6AAAAJE"]
[Wed Apr 01 23:30:46.464717 2026] [:error] [pid 62559:tid 62580] [client 51.103.96.231:62503] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "ac06Ji7NKI8IaNKZFIf5KgAAAVM"]
[Wed Apr 01 23:30:47.120100 2026] [:error] [pid 17856:tid 17871] [client 51.103.96.231:52192] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filesss.php"] [unique_id "ac06Jz7Idlm5j9frhqR_fgAAAE0"]
[Wed Apr 01 23:30:47.711395 2026] [:error] [pid 62559:tid 62582] [client 51.103.96.231:49405] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file88.php"] [unique_id "ac06Jy7NKI8IaNKZFIf5MQAAAVU"]
[Wed Apr 01 23:30:48.223510 2026] [:error] [pid 8910:tid 8986] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/file88.php
[Wed Apr 01 23:30:48.464062 2026] [:error] [pid 8910:tid 8992] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Wed Apr 01 23:30:48.705412 2026] [:error] [pid 8910:tid 8978] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/admir.php
[Wed Apr 01 23:30:48.945353 2026] [:error] [pid 8910:tid 8972] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/aj.php
[Wed Apr 01 23:30:49.202857 2026] [:error] [pid 8910:tid 8974] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Wed Apr 01 23:30:49.441972 2026] [:error] [pid 8910:tid 8980] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/filer.php
[Wed Apr 01 23:30:49.689431 2026] [:error] [pid 8910:tid 8981] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/lites.php
[Wed Apr 01 23:30:49.936132 2026] [:error] [pid 8910:tid 8991] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Apr 01 23:30:50.177836 2026] [:error] [pid 8910:tid 8971] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/he.php
[Wed Apr 01 23:30:50.417649 2026] [:error] [pid 8910:tid 8976] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/aves.php
[Wed Apr 01 23:30:50.671493 2026] [:error] [pid 8910:tid 8985] [client 51.103.96.231:50853] File does not exist: /usr/local/apache/htdocs/suspended-page/gorila.php
[Wed Apr 01 23:30:50.934363 2026] [:error] [pid 8910:tid 8992] [client 51.103.96.231:50853] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "ac06KqJZINUcF3tYgEyFiQAAARg"]
[Wed Apr 01 23:30:51.571064 2026] [:error] [pid 8909:tid 8953] [client 51.103.96.231:50858] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "ac06KzvP_a0662gDl6AUZwAAAMw"]
[Wed Apr 01 23:30:52.085612 2026] [:error] [pid 62559:tid 62579] [client 51.103.96.231:49367] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "ac06LC7NKI8IaNKZFIf5RwAAAVI"]
[Wed Apr 01 23:30:52.632835 2026] [:error] [pid 62559:tid 62577] [client 51.103.96.231:49388] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vanta.php"] [unique_id "ac06LC7NKI8IaNKZFIf5SgAAAVA"]
[Wed Apr 01 23:30:53.157463 2026] [:error] [pid 62559:tid 62580] [client 51.103.96.231:4402] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "ac06LS7NKI8IaNKZFIf5TwAAAVM"]
[Wed Apr 01 23:30:53.711673 2026] [:error] [pid 62559:tid 62562] [client 51.103.96.231:51363] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "ac06LS7NKI8IaNKZFIf5VAAAAUE"]
[Wed Apr 01 23:30:54.265337 2026] [:error] [pid 8908:tid 8932] [client 51.103.96.231:48960] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "ac06LvkmxtJXGnLdvgDV7AAAAJM"]
[Wed Apr 01 23:30:54.790218 2026] [:error] [pid 62559:tid 62564] [client 51.103.96.231:55002] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sh3ll.php"] [unique_id "ac06Li7NKI8IaNKZFIf5WgAAAUM"]
[Wed Apr 01 23:30:55.292648 2026] [:error] [pid 17856:tid 17876] [client 51.103.96.231:52209] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ac06Lz7Idlm5j9frhqR_hQAAAFI"]
[Wed Apr 01 23:30:55.778658 2026] [:error] [pid 8910:tid 8989] [client 51.103.96.231:50824] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ac06L6JZINUcF3tYgEyFkQAAARU"]
[Wed Apr 01 23:30:56.260662 2026] [:error] [pid 8908:tid 8919] [client 51.103.96.231:55321] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ac06MPkmxtJXGnLdvgDV8QAAAIY"]
[Wed Apr 01 23:30:56.731258 2026] [:error] [pid 8908:tid 8929] [client 51.103.96.231:48984] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "ac06MPkmxtJXGnLdvgDV8wAAAJA"]
[Thu Apr 02 00:34:04.769126 2026] [:error] [pid 8035:tid 8044] [client 20.116.26.190:50708] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Thu Apr 02 00:34:05.765623 2026] [:error] [pid 8035:tid 8043] [client 20.116.26.190:50708] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Apr 02 00:34:07.033824 2026] [:error] [pid 8035:tid 8044] [client 20.116.26.190:50708] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/tools/functions.php"] [unique_id "ac1I_wY2zflwGmvw_QbK1wAAAIQ"]
[Thu Apr 02 00:34:07.447358 2026] [:error] [pid 8035:tid 8063] [client 20.116.26.190:50701] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/tools/functions.php"] [unique_id "ac1I_wY2zflwGmvw_QbK3QAAAJc"]
[Thu Apr 02 00:34:07.890138 2026] [:error] [pid 8035:tid 8060] [client 20.116.26.190:50714] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/tools/functions.php"] [unique_id "ac1I_wY2zflwGmvw_QbK4QAAAJQ"]
[Thu Apr 02 00:34:08.305572 2026] [:error] [pid 8036:tid 8097] [client 20.116.26.190:51142] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/tools/functions.php"] [unique_id "ac1JAEMvKg9PFa_VV4zLhAAAANQ"]
[Thu Apr 02 00:34:08.735614 2026] [:error] [pid 8035:tid 8056] [client 20.116.26.190:50724] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/database/basic.php"] [unique_id "ac1JAAY2zflwGmvw_QbK6AAAAJA"]
[Thu Apr 02 00:34:09.148311 2026] [:error] [pid 8387:tid 8441] [client 20.116.26.190:51153] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/database/basic.php"] [unique_id "ac1JARdQYJ2y8LDYkv_jwQAAAAE"]
[Thu Apr 02 00:34:09.560931 2026] [:error] [pid 8387:tid 8448] [client 20.116.26.190:51141] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/database/basic.php"] [unique_id "ac1JARdQYJ2y8LDYkv_jxwAAAAg"]
[Thu Apr 02 00:34:10.018940 2026] [:error] [pid 8387:tid 8449] [client 20.116.26.190:50721] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/app/database/basic.php"] [unique_id "ac1JAhdQYJ2y8LDYkv_jywAAAAk"]
[Thu Apr 02 00:34:10.440808 2026] [:error] [pid 8387:tid 8459] [client 20.116.26.190:50706] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/template/views/.php"] [unique_id "ac1JAhdQYJ2y8LDYkv_jzgAAABI"]
[Thu Apr 02 00:34:10.869844 2026] [:error] [pid 8387:tid 8442] [client 20.116.26.190:50711] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/template/views/.php"] [unique_id "ac1JAhdQYJ2y8LDYkv_j0gAAAAI"]
[Thu Apr 02 00:34:11.293579 2026] [:error] [pid 8037:tid 8121] [client 20.116.26.190:50735] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/template/views/.php"] [unique_id "ac1JA4GD8ox-W9jHVfCtcwAAAQ0"]
[Thu Apr 02 00:34:11.707852 2026] [:error] [pid 8035:tid 8064] [client 20.116.26.190:50703] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w/template/views/.php"] [unique_id "ac1JAwY2zflwGmvw_QbK8AAAAJg"]
[Thu Apr 02 00:34:12.122093 2026] [:error] [pid 8037:tid 8114] [client 20.116.26.190:50691] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "ac1JBIGD8ox-W9jHVfCtdwAAAQY"]
[Thu Apr 02 00:34:12.537593 2026] [:error] [pid 8035:tid 8046] [client 20.116.26.190:50709] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "ac1JBAY2zflwGmvw_QbK-AAAAIY"]
[Thu Apr 02 00:34:12.949636 2026] [:error] [pid 8035:tid 8057] [client 20.116.26.190:51183] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "ac1JBAY2zflwGmvw_QbK_QAAAJE"]
[Thu Apr 02 00:34:13.363430 2026] [:error] [pid 8387:tid 8459] [client 20.116.26.190:50751] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "ac1JBRdQYJ2y8LDYkv_j6gAAABI"]
[Thu Apr 02 00:34:13.793088 2026] [:error] [pid 8035:tid 8058] [client 20.116.26.190:50726] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "ac1JBQY2zflwGmvw_QbLBAAAAJI"]
[Thu Apr 02 00:34:14.205870 2026] [:error] [pid 8387:tid 8446] [client 20.116.26.190:51144] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "ac1JBhdQYJ2y8LDYkv_j8gAAAAY"]
[Thu Apr 02 00:34:14.616989 2026] [:error] [pid 8037:tid 8130] [client 20.116.26.190:50732] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "ac1JBoGD8ox-W9jHVfCtfQAAARY"]
[Thu Apr 02 00:34:15.029944 2026] [:error] [pid 8035:tid 8058] [client 20.116.26.190:50716] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "ac1JBwY2zflwGmvw_QbLDQAAAJI"]
[Thu Apr 02 00:34:15.451585 2026] [:error] [pid 8035:tid 8060] [client 20.116.26.190:51074] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "ac1JBwY2zflwGmvw_QbLEAAAAJQ"]
[Thu Apr 02 00:34:15.876911 2026] [:error] [pid 8035:tid 8047] [client 20.116.26.190:50725] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "ac1JBwY2zflwGmvw_QbLEwAAAIc"]
[Thu Apr 02 00:34:16.295817 2026] [:error] [pid 8036:tid 8078] [client 20.116.26.190:51138] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "ac1JCEMvKg9PFa_VV4zLoAAAAMI"]
[Thu Apr 02 00:34:16.713026 2026] [:error] [pid 8037:tid 8131] [client 20.116.26.190:50727] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "ac1JCIGD8ox-W9jHVfCtfwAAARc"]
[Thu Apr 02 00:34:17.153018 2026] [:error] [pid 8387:tid 8442] [client 20.116.26.190:51079] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wer.php"] [unique_id "ac1JCRdQYJ2y8LDYkv_kDgAAAAI"]
[Thu Apr 02 00:34:17.565950 2026] [:error] [pid 8387:tid 8449] [client 20.116.26.190:51148] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wer.php"] [unique_id "ac1JCRdQYJ2y8LDYkv_kEwAAAAk"]
[Thu Apr 02 00:34:17.984202 2026] [:error] [pid 8036:tid 8080] [client 20.116.26.190:50689] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wer.php"] [unique_id "ac1JCUMvKg9PFa_VV4zLsAAAAMQ"]
[Thu Apr 02 00:34:18.405665 2026] [:error] [pid 8387:tid 8467] [client 20.116.26.190:51151] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wer.php"] [unique_id "ac1JChdQYJ2y8LDYkv_kHQAAABc"]
[Thu Apr 02 00:34:18.836318 2026] [:error] [pid 8035:tid 8049] [client 20.116.26.190:50697] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/crouter.php"] [unique_id "ac1JCgY2zflwGmvw_QbLHgAAAIk"]
[Thu Apr 02 00:34:19.263391 2026] [:error] [pid 8036:tid 8089] [client 20.116.26.190:51160] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/crouter.php"] [unique_id "ac1JC0MvKg9PFa_VV4zLuAAAAM0"]
[Thu Apr 02 00:34:19.677143 2026] [:error] [pid 8035:tid 8047] [client 20.116.26.190:51157] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/crouter.php"] [unique_id "ac1JCwY2zflwGmvw_QbLJAAAAIc"]
[Thu Apr 02 00:34:20.102700 2026] [:error] [pid 8037:tid 8120] [client 20.116.26.190:51156] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/crouter.php"] [unique_id "ac1JDIGD8ox-W9jHVfCthwAAAQw"]
[Thu Apr 02 00:34:20.516790 2026] [:error] [pid 8037:tid 8117] [client 20.116.26.190:51161] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/COPYRIGHT.php"] [unique_id "ac1JDIGD8ox-W9jHVfCtiAAAAQk"]
[Thu Apr 02 00:34:20.945000 2026] [:error] [pid 8037:tid 8128] [client 20.116.26.190:50736] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/COPYRIGHT.php"] [unique_id "ac1JDIGD8ox-W9jHVfCtigAAARQ"]
[Thu Apr 02 00:34:21.364053 2026] [:error] [pid 8035:tid 8061] [client 20.116.26.190:50715] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/COPYRIGHT.php"] [unique_id "ac1JDQY2zflwGmvw_QbLMAAAAJU"]
[Thu Apr 02 00:34:21.779652 2026] [:error] [pid 8387:tid 8453] [client 20.116.26.190:50744] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/COPYRIGHT.php"] [unique_id "ac1JDRdQYJ2y8LDYkv_kOAAAAA0"]
[Thu Apr 02 00:34:22.196034 2026] [:error] [pid 8387:tid 8445] [client 20.116.26.190:50690] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/hehe.php"] [unique_id "ac1JDhdQYJ2y8LDYkv_kPQAAAAU"]
[Thu Apr 02 00:34:22.607779 2026] [:error] [pid 8387:tid 8448] [client 20.116.26.190:51154] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/hehe.php"] [unique_id "ac1JDhdQYJ2y8LDYkv_kRAAAAAg"]
[Thu Apr 02 00:34:23.029006 2026] [:error] [pid 8387:tid 8445] [client 20.116.26.190:51189] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/hehe.php"] [unique_id "ac1JDxdQYJ2y8LDYkv_kSwAAAAU"]
[Thu Apr 02 00:34:23.452164 2026] [:error] [pid 8035:tid 8049] [client 20.116.26.190:50734] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/assets/images/hehe.php"] [unique_id "ac1JDwY2zflwGmvw_QbLNQAAAIk"]
[Thu Apr 02 00:34:23.873245 2026] [:error] [pid 8387:tid 8460] [client 20.116.26.190:50712] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conter.php"] [unique_id "ac1JDxdQYJ2y8LDYkv_kVAAAABM"]
[Thu Apr 02 00:34:24.292979 2026] [:error] [pid 8387:tid 8452] [client 20.116.26.190:51175] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conter.php"] [unique_id "ac1JEBdQYJ2y8LDYkv_kXAAAAAw"]
[Thu Apr 02 00:34:24.704483 2026] [:error] [pid 8035:tid 8045] [client 20.116.26.190:50692] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conter.php"] [unique_id "ac1JEAY2zflwGmvw_QbLPAAAAIU"]
[Thu Apr 02 00:34:25.147621 2026] [:error] [pid 8387:tid 8450] [client 20.116.26.190:51172] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-conter.php"] [unique_id "ac1JERdQYJ2y8LDYkv_kYwAAAAo"]
[Thu Apr 02 00:34:25.558458 2026] [:error] [pid 8387:tid 8456] [client 20.116.26.190:51165] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ua/index_old.php"] [unique_id "ac1JERdQYJ2y8LDYkv_kaAAAAA8"]
[Thu Apr 02 00:34:25.994279 2026] [:error] [pid 8387:tid 8458] [client 20.116.26.190:50740] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ua/index_old.php"] [unique_id "ac1JERdQYJ2y8LDYkv_kbgAAABE"]
[Thu Apr 02 00:34:26.420432 2026] [:error] [pid 8037:tid 8126] [client 20.116.26.190:50737] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ua/index_old.php"] [unique_id "ac1JEoGD8ox-W9jHVfCtlgAAARI"]
[Thu Apr 02 00:34:26.831658 2026] [:error] [pid 8387:tid 8440] [client 20.116.26.190:50748] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ua/index_old.php"] [unique_id "ac1JEhdQYJ2y8LDYkv_kdgAAAAA"]
[Thu Apr 02 00:34:27.245343 2026] [:error] [pid 8036:tid 8099] [client 20.116.26.190:50733] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/upgrade.php"] [unique_id "ac1JE0MvKg9PFa_VV4zL6AAAANY"]
[Thu Apr 02 00:34:27.655023 2026] [:error] [pid 8037:tid 8111] [client 20.116.26.190:51194] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/upgrade.php"] [unique_id "ac1JE4GD8ox-W9jHVfCtmwAAAQM"]
[Thu Apr 02 00:34:28.067303 2026] [:error] [pid 8036:tid 8086] [client 20.116.26.190:51190] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/upgrade.php"] [unique_id "ac1JFEMvKg9PFa_VV4zL7wAAAMo"]
[Thu Apr 02 00:34:28.479447 2026] [:error] [pid 8387:tid 8447] [client 20.116.26.190:51174] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/upgrade.php"] [unique_id "ac1JFBdQYJ2y8LDYkv_kgQAAAAc"]
[Thu Apr 02 00:34:28.893119 2026] [:error] [pid 8387:tid 8466] [client 20.116.26.190:50729] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-adminmaintmailer.php"] [unique_id "ac1JFBdQYJ2y8LDYkv_khQAAABY"]
[Thu Apr 02 00:34:29.319001 2026] [:error] [pid 8387:tid 8468] [client 20.116.26.190:51120] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-adminmaintmailer.php"] [unique_id "ac1JFRdQYJ2y8LDYkv_kiQAAABg"]
[Thu Apr 02 00:34:29.730959 2026] [:error] [pid 8387:tid 8450] [client 20.116.26.190:51198] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-adminmaintmailer.php"] [unique_id "ac1JFRdQYJ2y8LDYkv_kjgAAAAo"]
[Thu Apr 02 00:34:30.151799 2026] [:error] [pid 8035:tid 8049] [client 20.116.26.190:50743] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-adminmaintmailer.php"] [unique_id "ac1JFgY2zflwGmvw_QbLSQAAAIk"]
[Thu Apr 02 00:34:30.562872 2026] [:error] [pid 8037:tid 8131] [client 20.116.26.190:50688] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en/wp-login.php"] [unique_id "ac1JFoGD8ox-W9jHVfCtqAAAARc"]
[Thu Apr 02 00:34:30.970781 2026] [:error] [pid 8387:tid 8456] [client 20.116.26.190:50730] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en/wp-login.php"] [unique_id "ac1JFhdQYJ2y8LDYkv_kmAAAAA8"]
[Thu Apr 02 00:34:31.381948 2026] [:error] [pid 8387:tid 8442] [client 20.116.26.190:51137] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en/wp-login.php"] [unique_id "ac1JFxdQYJ2y8LDYkv_kmgAAAAI"]
[Thu Apr 02 00:34:31.793612 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:50710] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/en/wp-login.php"] [unique_id "ac1JFxdQYJ2y8LDYkv_kngAAABU"]
[Thu Apr 02 00:34:32.217514 2026] [:error] [pid 8387:tid 8446] [client 20.116.26.190:50698] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer-4.2.4.php"] [unique_id "ac1JGBdQYJ2y8LDYkv_kpwAAAAY"]
[Thu Apr 02 00:34:32.640185 2026] [:error] [pid 8036:tid 8097] [client 20.116.26.190:51193] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer-4.2.4.php"] [unique_id "ac1JGEMvKg9PFa_VV4zMCQAAANQ"]
[Thu Apr 02 00:34:33.056351 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:50728] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer-4.2.4.php"] [unique_id "ac1JGRdQYJ2y8LDYkv_kqwAAABU"]
[Thu Apr 02 00:34:33.482086 2026] [:error] [pid 8035:tid 8047] [client 20.116.26.190:51147] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ru/adminer-4.2.4.php"] [unique_id "ac1JGQY2zflwGmvw_QbLUQAAAIc"]
[Thu Apr 02 00:34:33.892067 2026] [:error] [pid 8036:tid 8091] [client 20.116.26.190:51108] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "ac1JGUMvKg9PFa_VV4zMEgAAAM8"]
[Thu Apr 02 00:34:34.306121 2026] [:error] [pid 8387:tid 8441] [client 20.116.26.190:51180] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "ac1JGhdQYJ2y8LDYkv_ktgAAAAE"]
[Thu Apr 02 00:34:34.722393 2026] [:error] [pid 8037:tid 8122] [client 20.116.26.190:51146] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "ac1JGoGD8ox-W9jHVfCttgAAAQ4"]
[Thu Apr 02 00:34:35.137358 2026] [:error] [pid 8037:tid 8108] [client 20.116.26.190:51150] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hvoxejcn.php"] [unique_id "ac1JG4GD8ox-W9jHVfCtuQAAAQA"]
[Thu Apr 02 00:34:35.547775 2026] [:error] [pid 8036:tid 8078] [client 20.116.26.190:51155] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "ac1JG0MvKg9PFa_VV4zMGAAAAMI"]
[Thu Apr 02 00:34:35.970178 2026] [:error] [pid 8035:tid 8046] [client 20.116.26.190:51163] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "ac1JGwY2zflwGmvw_QbLWQAAAIY"]
[Thu Apr 02 00:34:36.383967 2026] [:error] [pid 8035:tid 8062] [client 20.116.26.190:51115] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "ac1JHAY2zflwGmvw_QbLXQAAAJY"]
[Thu Apr 02 00:34:36.796902 2026] [:error] [pid 8035:tid 8057] [client 20.116.26.190:50749] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rasp.php"] [unique_id "ac1JHAY2zflwGmvw_QbLYQAAAJE"]
[Thu Apr 02 00:34:37.208151 2026] [:error] [pid 8035:tid 8045] [client 20.116.26.190:51176] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk-park.php"] [unique_id "ac1JHQY2zflwGmvw_QbLZgAAAIU"]
[Thu Apr 02 00:34:37.619804 2026] [:error] [pid 8387:tid 8461] [client 20.116.26.190:51162] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk-park.php"] [unique_id "ac1JHRdQYJ2y8LDYkv_kwgAAABQ"]
[Thu Apr 02 00:34:38.037140 2026] [:error] [pid 8387:tid 8453] [client 20.116.26.190:51140] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk-park.php"] [unique_id "ac1JHhdQYJ2y8LDYkv_kxwAAAA0"]
[Thu Apr 02 00:34:38.454741 2026] [:error] [pid 8387:tid 8440] [client 20.116.26.190:51168] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk-park.php"] [unique_id "ac1JHhdQYJ2y8LDYkv_kywAAAAA"]
[Thu Apr 02 00:34:38.864964 2026] [:error] [pid 8387:tid 8468] [client 20.116.26.190:51131] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/functions.php"] [unique_id "ac1JHhdQYJ2y8LDYkv_kzwAAABg"]
[Thu Apr 02 00:34:39.282820 2026] [:error] [pid 8387:tid 8447] [client 20.116.26.190:51099] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-settings.php"] [unique_id "ac1JHxdQYJ2y8LDYkv_k0wAAAAc"]
[Thu Apr 02 00:34:39.694328 2026] [:error] [pid 8037:tid 8108] [client 20.116.26.190:51187] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-settings.php"] [unique_id "ac1JH4GD8ox-W9jHVfCtxwAAAQA"]
[Thu Apr 02 00:34:40.105409 2026] [:error] [pid 8035:tid 8051] [client 20.116.26.190:51050] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-settings.php"] [unique_id "ac1JIAY2zflwGmvw_QbLagAAAIs"]
[Thu Apr 02 00:34:40.514293 2026] [:error] [pid 8387:tid 8441] [client 20.116.26.190:51022] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pluggable.php"] [unique_id "ac1JIBdQYJ2y8LDYkv_k3gAAAAE"]
[Thu Apr 02 00:34:40.929938 2026] [:error] [pid 8035:tid 8041] [client 20.116.26.190:50696] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "ac1JIAY2zflwGmvw_QbLcQAAAIE"]
[Thu Apr 02 00:34:41.344569 2026] [:error] [pid 8037:tid 8119] [client 20.116.26.190:51133] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "ac1JIYGD8ox-W9jHVfCtzgAAAQs"]
[Thu Apr 02 00:34:41.754939 2026] [:error] [pid 8035:tid 8043] [client 20.116.26.190:51095] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "ac1JIQY2zflwGmvw_QbLcwAAAIM"]
[Thu Apr 02 00:34:42.183469 2026] [:error] [pid 8387:tid 8460] [client 20.116.26.190:51091] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index.php"] [unique_id "ac1JIhdQYJ2y8LDYkv_k5AAAABM"]
[Thu Apr 02 00:34:42.595745 2026] [:error] [pid 8035:tid 8045] [client 20.116.26.190:50747] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/13.php"] [unique_id "ac1JIgY2zflwGmvw_QbLeQAAAIU"]
[Thu Apr 02 00:34:43.014422 2026] [:error] [pid 8387:tid 8449] [client 20.116.26.190:51102] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uctshcum.php"] [unique_id "ac1JIxdQYJ2y8LDYkv_k6wAAAAk"]
[Thu Apr 02 00:34:43.435083 2026] [:error] [pid 8387:tid 8445] [client 20.116.26.190:51100] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uctshcum.php"] [unique_id "ac1JIxdQYJ2y8LDYkv_k8QAAAAU"]
[Thu Apr 02 00:34:43.848024 2026] [:error] [pid 8387:tid 8451] [client 20.116.26.190:51145] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uctshcum.php"] [unique_id "ac1JIxdQYJ2y8LDYkv_k9AAAAAs"]
[Thu Apr 02 00:34:44.270294 2026] [:error] [pid 8387:tid 8466] [client 20.116.26.190:51192] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/old/wp-admin/setup-config.php"] [unique_id "ac1JJBdQYJ2y8LDYkv_k-gAAABY"]
[Thu Apr 02 00:34:44.688710 2026] [:error] [pid 8037:tid 8130] [client 20.116.26.190:51092] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/old/wp-admin/setup-config.php"] [unique_id "ac1JJIGD8ox-W9jHVfCt1wAAARY"]
[Thu Apr 02 00:34:45.107040 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:51171] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/old/wp-admin/setup-config.php"] [unique_id "ac1JJRdQYJ2y8LDYkv_k_wAAABU"]
[Thu Apr 02 00:34:45.519377 2026] [:error] [pid 8036:tid 8079] [client 20.116.26.190:51078] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/old/wp-admin/setup-config.php"] [unique_id "ac1JJUMvKg9PFa_VV4zMIQAAAMM"]
[Thu Apr 02 00:34:45.932894 2026] [:error] [pid 8387:tid 8455] [client 20.116.26.190:51093] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/expect.php"] [unique_id "ac1JJRdQYJ2y8LDYkv_lBQAAAA4"]
[Thu Apr 02 00:34:46.351722 2026] [:error] [pid 8036:tid 8082] [client 20.116.26.190:50723] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/expect.php"] [unique_id "ac1JJkMvKg9PFa_VV4zMIwAAAMY"]
[Thu Apr 02 00:34:46.766974 2026] [:error] [pid 8387:tid 8445] [client 20.116.26.190:51075] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/expect.php"] [unique_id "ac1JJhdQYJ2y8LDYkv_lEgAAAAU"]
[Thu Apr 02 00:34:47.201169 2026] [:error] [pid 8035:tid 8063] [client 20.116.26.190:50713] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/expect.php"] [unique_id "ac1JJwY2zflwGmvw_QbLiAAAAJc"]
[Thu Apr 02 00:34:47.623830 2026] [:error] [pid 8035:tid 8052] [client 20.116.26.190:51098] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/json.php"] [unique_id "ac1JJwY2zflwGmvw_QbLiwAAAIw"]
[Thu Apr 02 00:34:48.049361 2026] [:error] [pid 8035:tid 8045] [client 20.116.26.190:51119] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/json.php"] [unique_id "ac1JKAY2zflwGmvw_QbLkAAAAIU"]
[Thu Apr 02 00:34:48.467771 2026] [:error] [pid 8387:tid 8452] [client 20.116.26.190:50702] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/json.php"] [unique_id "ac1JKBdQYJ2y8LDYkv_lHQAAAAw"]
[Thu Apr 02 00:34:48.890902 2026] [:error] [pid 8387:tid 8441] [client 20.116.26.190:51136] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/json.php"] [unique_id "ac1JKBdQYJ2y8LDYkv_lHgAAAAE"]
[Thu Apr 02 00:34:49.308387 2026] [:error] [pid 8036:tid 8089] [client 20.116.26.190:50722] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/lv.php"] [unique_id "ac1JKUMvKg9PFa_VV4zMJwAAAM0"]
[Thu Apr 02 00:34:49.721683 2026] [:error] [pid 8037:tid 8132] [client 20.116.26.190:50699] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/lv.php"] [unique_id "ac1JKYGD8ox-W9jHVfCt4AAAARg"]
[Thu Apr 02 00:34:50.148164 2026] [:error] [pid 8036:tid 8078] [client 20.116.26.190:51047] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/lv.php"] [unique_id "ac1JKkMvKg9PFa_VV4zMKwAAAMI"]
[Thu Apr 02 00:34:50.556842 2026] [:error] [pid 8037:tid 8126] [client 20.116.26.190:51177] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/lv.php"] [unique_id "ac1JKoGD8ox-W9jHVfCt5wAAARI"]
[Thu Apr 02 00:34:50.988117 2026] [:error] [pid 8035:tid 8045] [client 20.116.26.190:51158] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "ac1JKgY2zflwGmvw_QbLlgAAAIU"]
[Thu Apr 02 00:34:51.411835 2026] [:error] [pid 8387:tid 8440] [client 20.116.26.190:50719] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "ac1JKxdQYJ2y8LDYkv_lKAAAAAA"]
[Thu Apr 02 00:34:51.824845 2026] [:error] [pid 8036:tid 8082] [client 20.116.26.190:50739] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "ac1JK0MvKg9PFa_VV4zMMgAAAMY"]
[Thu Apr 02 00:34:52.245155 2026] [:error] [pid 8035:tid 8050] [client 20.116.26.190:50702] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/about.php"] [unique_id "ac1JLAY2zflwGmvw_QbLmAAAAIo"]
[Thu Apr 02 00:34:52.656275 2026] [:error] [pid 8037:tid 8126] [client 20.116.26.190:51199] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/media.php"] [unique_id "ac1JLIGD8ox-W9jHVfCt9QAAARI"]
[Thu Apr 02 00:34:53.072509 2026] [:error] [pid 8035:tid 8047] [client 20.116.26.190:51185] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/media.php"] [unique_id "ac1JLQY2zflwGmvw_QbLnAAAAIc"]
[Thu Apr 02 00:34:53.499847 2026] [:error] [pid 8036:tid 8088] [client 20.116.26.190:50742] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/media.php"] [unique_id "ac1JLUMvKg9PFa_VV4zMNwAAAMw"]
[Thu Apr 02 00:34:53.937079 2026] [:error] [pid 8035:tid 8064] [client 20.116.26.190:51084] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/uploads/media.php"] [unique_id "ac1JLQY2zflwGmvw_QbLngAAAJg"]
[Thu Apr 02 00:34:54.362993 2026] [:error] [pid 8387:tid 8457] [client 20.116.26.190:50746] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "ac1JLhdQYJ2y8LDYkv_lMwAAABA"]
[Thu Apr 02 00:34:54.774522 2026] [:error] [pid 8035:tid 8042] [client 20.116.26.190:50705] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "ac1JLgY2zflwGmvw_QbLnwAAAII"]
[Thu Apr 02 00:34:55.191433 2026] [:error] [pid 8035:tid 8050] [client 20.116.26.190:51179] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "ac1JLwY2zflwGmvw_QbLoAAAAIo"]
[Thu Apr 02 00:34:55.604753 2026] [:error] [pid 8036:tid 8097] [client 20.116.26.190:51014] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "ac1JL0MvKg9PFa_VV4zMPgAAANQ"]
[Thu Apr 02 00:34:56.018859 2026] [:error] [pid 8387:tid 8450] [client 20.116.26.190:51173] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "ac1JMBdQYJ2y8LDYkv_lOwAAAAo"]
[Thu Apr 02 00:34:56.445291 2026] [:error] [pid 8387:tid 8442] [client 20.116.26.190:50738] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "ac1JMBdQYJ2y8LDYkv_lPwAAAAI"]
[Thu Apr 02 00:34:56.857832 2026] [:error] [pid 8036:tid 8081] [client 20.116.26.190:50728] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "ac1JMEMvKg9PFa_VV4zMQAAAAMU"]
[Thu Apr 02 00:34:57.275627 2026] [:error] [pid 8037:tid 8130] [client 20.116.26.190:51188] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "ac1JMYGD8ox-W9jHVfCuBAAAARY"]
[Thu Apr 02 00:34:57.691357 2026] [:error] [pid 8036:tid 8078] [client 20.116.26.190:51073] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "ac1JMUMvKg9PFa_VV4zMRAAAAMI"]
[Thu Apr 02 00:34:58.127197 2026] [:error] [pid 8036:tid 8099] [client 20.116.26.190:51080] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "ac1JMkMvKg9PFa_VV4zMSQAAANY"]
[Thu Apr 02 00:34:58.535637 2026] [:error] [pid 8387:tid 8468] [client 20.116.26.190:51010] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "ac1JMhdQYJ2y8LDYkv_lSgAAABg"]
[Thu Apr 02 00:34:58.952089 2026] [:error] [pid 8387:tid 8445] [client 20.116.26.190:51116] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/browse.php"] [unique_id "ac1JMhdQYJ2y8LDYkv_lTAAAAAU"]
[Thu Apr 02 00:34:59.381007 2026] [:error] [pid 8387:tid 8466] [client 20.116.26.190:51077] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/lock.php"] [unique_id "ac1JMxdQYJ2y8LDYkv_lTgAAABY"]
[Thu Apr 02 00:34:59.792345 2026] [:error] [pid 8037:tid 8125] [client 20.116.26.190:51018] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/lock.php"] [unique_id "ac1JM4GD8ox-W9jHVfCuCgAAARE"]
[Thu Apr 02 00:35:00.219077 2026] [:error] [pid 8037:tid 8131] [client 20.116.26.190:51090] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/lock.php"] [unique_id "ac1JNIGD8ox-W9jHVfCuDAAAARc"]
[Thu Apr 02 00:35:00.634065 2026] [:error] [pid 8387:tid 8466] [client 20.116.26.190:51167] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/lock.php"] [unique_id "ac1JNBdQYJ2y8LDYkv_lWwAAABY"]
[Thu Apr 02 00:35:01.055723 2026] [:error] [pid 8036:tid 8092] [client 20.116.26.190:50695] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/config.php"] [unique_id "ac1JNUMvKg9PFa_VV4zMVgAAANA"]
[Thu Apr 02 00:35:01.479846 2026] [:error] [pid 8037:tid 8111] [client 20.116.26.190:51169] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/config.php"] [unique_id "ac1JNYGD8ox-W9jHVfCuEQAAAQM"]
[Thu Apr 02 00:35:01.893709 2026] [:error] [pid 8387:tid 8449] [client 20.116.26.190:51082] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/config.php"] [unique_id "ac1JNRdQYJ2y8LDYkv_lZAAAAAk"]
[Thu Apr 02 00:35:02.325326 2026] [:error] [pid 8387:tid 8444] [client 20.116.26.190:51086] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/config.php"] [unique_id "ac1JNhdQYJ2y8LDYkv_lZgAAAAQ"]
[Thu Apr 02 00:35:02.740398 2026] [:error] [pid 8036:tid 8089] [client 20.116.26.190:51113] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac1JNkMvKg9PFa_VV4zMYQAAAM0"]
[Thu Apr 02 00:35:03.159012 2026] [:error] [pid 8037:tid 8108] [client 20.116.26.190:51088] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac1JN4GD8ox-W9jHVfCuFAAAAQA"]
[Thu Apr 02 00:35:03.577061 2026] [:error] [pid 8035:tid 8048] [client 20.116.26.190:51139] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac1JNwY2zflwGmvw_QbLtwAAAIg"]
[Thu Apr 02 00:35:03.987086 2026] [:error] [pid 8036:tid 8087] [client 20.116.26.190:51196] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac1JN0MvKg9PFa_VV4zMbwAAAMs"]
[Thu Apr 02 00:35:04.397620 2026] [:error] [pid 8035:tid 8044] [client 20.116.26.190:50704] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "ac1JOAY2zflwGmvw_QbLvQAAAIQ"]
[Thu Apr 02 00:35:04.817537 2026] [:error] [pid 8037:tid 8117] [client 20.116.26.190:51107] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "ac1JOIGD8ox-W9jHVfCuGAAAAQk"]
[Thu Apr 02 00:35:05.232512 2026] [:error] [pid 8037:tid 8118] [client 20.116.26.190:51097] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "ac1JOYGD8ox-W9jHVfCuGQAAAQo"]
[Thu Apr 02 00:35:05.649560 2026] [:error] [pid 8387:tid 8449] [client 20.116.26.190:51159] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "ac1JORdQYJ2y8LDYkv_ldAAAAAk"]
[Thu Apr 02 00:35:06.487908 2026] [:error] [pid 8037:tid 8131] [client 20.116.26.190:51125] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "ac1JOoGD8ox-W9jHVfCuIAAAARc"]
[Thu Apr 02 00:35:06.906592 2026] [:error] [pid 8387:tid 8456] [client 20.116.26.190:51112] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Thu Apr 02 00:35:07.354476 2026] [:error] [pid 8387:tid 8457] [client 20.116.26.190:51112] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Thu Apr 02 00:35:07.562830 2026] [:error] [pid 8387:tid 8441] [client 20.116.26.190:51112] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Thu Apr 02 00:35:07.771669 2026] [:error] [pid 8387:tid 8458] [client 20.116.26.190:51112] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Apr 02 00:35:07.980671 2026] [:error] [pid 8387:tid 8450] [client 20.116.26.190:51112] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Thu Apr 02 00:35:08.189309 2026] [:error] [pid 8387:tid 8467] [client 20.116.26.190:51112] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Thu Apr 02 00:35:08.815115 2026] [:error] [pid 8387:tid 8445] [client 20.116.26.190:51112] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/m.php"] [unique_id "ac1JPBdQYJ2y8LDYkv_lkAAAAAU"]
[Thu Apr 02 00:35:09.225897 2026] [:error] [pid 8387:tid 8456] [client 20.116.26.190:50731] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/m.php"] [unique_id "ac1JPRdQYJ2y8LDYkv_llQAAAA8"]
[Thu Apr 02 00:35:09.651601 2026] [:error] [pid 8387:tid 8452] [client 20.116.26.190:50741] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/m.php"] [unique_id "ac1JPRdQYJ2y8LDYkv_lmgAAAAw"]
[Thu Apr 02 00:35:10.061612 2026] [:error] [pid 8035:tid 8046] [client 20.116.26.190:51089] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/includes/m.php"] [unique_id "ac1JPgY2zflwGmvw_QbLzwAAAIY"]
[Thu Apr 02 00:35:10.480770 2026] [:error] [pid 8035:tid 8053] [client 20.116.26.190:51104] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/admin.php"] [unique_id "ac1JPgY2zflwGmvw_QbL0gAAAI0"]
[Thu Apr 02 00:35:10.889788 2026] [:error] [pid 8387:tid 8443] [client 20.116.26.190:50694] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/admin.php"] [unique_id "ac1JPhdQYJ2y8LDYkv_lpAAAAAM"]
[Thu Apr 02 00:35:11.311575 2026] [:error] [pid 8035:tid 8055] [client 20.116.26.190:51063] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/admin.php"] [unique_id "ac1JPwY2zflwGmvw_QbL1AAAAI8"]
[Thu Apr 02 00:35:11.728147 2026] [:error] [pid 8035:tid 8057] [client 20.116.26.190:51044] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/admin.php"] [unique_id "ac1JPwY2zflwGmvw_QbL1gAAAJE"]
[Thu Apr 02 00:35:12.144321 2026] [:error] [pid 8387:tid 8446] [client 20.116.26.190:51121] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/admin.php"] [unique_id "ac1JQBdQYJ2y8LDYkv_lsAAAAAY"]
[Thu Apr 02 00:35:12.555021 2026] [:error] [pid 8387:tid 8460] [client 20.116.26.190:50944] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/admin.php"] [unique_id "ac1JQBdQYJ2y8LDYkv_lsgAAABM"]
[Thu Apr 02 00:35:12.972936 2026] [:error] [pid 8387:tid 8443] [client 20.116.26.190:51085] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/admin.php"] [unique_id "ac1JQBdQYJ2y8LDYkv_ltwAAAAM"]
[Thu Apr 02 00:35:13.394319 2026] [:error] [pid 8387:tid 8451] [client 20.116.26.190:51149] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/admin.php"] [unique_id "ac1JQRdQYJ2y8LDYkv_luwAAAAs"]
[Thu Apr 02 00:35:13.822386 2026] [:error] [pid 8036:tid 8083] [client 20.116.26.190:51043] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/shell.php"] [unique_id "ac1JQUMvKg9PFa_VV4zMrQAAAMc"]
[Thu Apr 02 00:35:14.234286 2026] [:error] [pid 8037:tid 8113] [client 20.116.26.190:51118] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "ac1JQoGD8ox-W9jHVfCuKwAAAQU"]
[Thu Apr 02 00:35:14.649066 2026] [:error] [pid 8387:tid 8455] [client 20.116.26.190:51106] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "ac1JQhdQYJ2y8LDYkv_lxgAAAA4"]
[Thu Apr 02 00:35:15.057985 2026] [:error] [pid 8035:tid 8043] [client 20.116.26.190:51012] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "ac1JQwY2zflwGmvw_QbL5gAAAIM"]
[Thu Apr 02 00:35:15.471738 2026] [:error] [pid 8037:tid 8122] [client 20.116.26.190:51026] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/themes-install.php"] [unique_id "ac1JQ4GD8ox-W9jHVfCuLgAAAQ4"]
[Thu Apr 02 00:35:15.883678 2026] [:error] [pid 8035:tid 8051] [client 20.116.26.190:50693] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/themes-install.php"] [unique_id "ac1JQwY2zflwGmvw_QbL6QAAAIs"]
[Thu Apr 02 00:35:16.305831 2026] [:error] [pid 8387:tid 8453] [client 20.116.26.190:51166] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/themes-install.php"] [unique_id "ac1JRBdQYJ2y8LDYkv_lygAAAA0"]
[Thu Apr 02 00:35:16.744945 2026] [:error] [pid 8387:tid 8440] [client 20.116.26.190:50962] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/upload/themes-install.php"] [unique_id "ac1JRBdQYJ2y8LDYkv_l0AAAAAA"]
[Thu Apr 02 00:35:17.159342 2026] [:error] [pid 8036:tid 8080] [client 20.116.26.190:51052] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac1JRUMvKg9PFa_VV4zMwAAAAMQ"]
[Thu Apr 02 00:35:17.568679 2026] [:error] [pid 8035:tid 8053] [client 20.116.26.190:51083] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac1JRQY2zflwGmvw_QbL9QAAAI0"]
[Thu Apr 02 00:35:17.981026 2026] [:error] [pid 8035:tid 8054] [client 20.116.26.190:51135] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac1JRQY2zflwGmvw_QbL9wAAAI4"]
[Thu Apr 02 00:35:18.394089 2026] [:error] [pid 8035:tid 8040] [client 20.116.26.190:51023] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac1JRgY2zflwGmvw_QbL-wAAAIA"]
[Thu Apr 02 00:35:18.810024 2026] [:error] [pid 8035:tid 8052] [client 20.116.26.190:51181] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/alfa-rex.php"] [unique_id "ac1JRgY2zflwGmvw_QbL_wAAAIw"]
[Thu Apr 02 00:35:19.225965 2026] [:error] [pid 8036:tid 8097] [client 20.116.26.190:51054] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/alfa-rex.php"] [unique_id "ac1JR0MvKg9PFa_VV4zM0AAAANQ"]
[Thu Apr 02 00:35:19.636576 2026] [:error] [pid 8387:tid 8443] [client 20.116.26.190:51045] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/alfa-rex.php"] [unique_id "ac1JRxdQYJ2y8LDYkv_l2QAAAAM"]
[Thu Apr 02 00:35:20.053647 2026] [:error] [pid 8035:tid 8044] [client 20.116.26.190:51143] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/alfa-rex.php"] [unique_id "ac1JSAY2zflwGmvw_QbMBQAAAIQ"]
[Thu Apr 02 00:35:20.474094 2026] [:error] [pid 8387:tid 8457] [client 20.116.26.190:51032] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/mail.php"] [unique_id "ac1JSBdQYJ2y8LDYkv_l3wAAABA"]
[Thu Apr 02 00:35:20.885250 2026] [:error] [pid 8035:tid 8046] [client 20.116.26.190:51076] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/mail.php"] [unique_id "ac1JSAY2zflwGmvw_QbMBwAAAIY"]
[Thu Apr 02 00:35:21.298921 2026] [:error] [pid 8036:tid 8082] [client 20.116.26.190:50745] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/mail.php"] [unique_id "ac1JSUMvKg9PFa_VV4zM2wAAAMY"]
[Thu Apr 02 00:35:21.716436 2026] [:error] [pid 8037:tid 8129] [client 20.116.26.190:51195] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/mail.php"] [unique_id "ac1JSYGD8ox-W9jHVfCuPAAAARU"]
[Thu Apr 02 00:35:22.132008 2026] [:error] [pid 8037:tid 8126] [client 20.116.26.190:51184] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "ac1JSoGD8ox-W9jHVfCuPwAAARI"]
[Thu Apr 02 00:35:22.540936 2026] [:error] [pid 8037:tid 8117] [client 20.116.26.190:51182] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "ac1JSoGD8ox-W9jHVfCuQgAAAQk"]
[Thu Apr 02 00:35:22.960855 2026] [:error] [pid 8036:tid 8092] [client 20.116.26.190:51128] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "ac1JSkMvKg9PFa_VV4zM4QAAANA"]
[Thu Apr 02 00:35:23.384006 2026] [:error] [pid 8036:tid 8095] [client 20.116.26.190:51129] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "ac1JS0MvKg9PFa_VV4zM4wAAANI"]
[Thu Apr 02 00:35:23.797594 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:51064] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac1JSxdQYJ2y8LDYkv_l9AAAABU"]
[Thu Apr 02 00:35:24.213357 2026] [:error] [pid 8036:tid 8102] [client 20.116.26.190:51053] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac1JTEMvKg9PFa_VV4zM5QAAANg"]
[Thu Apr 02 00:35:24.627595 2026] [:error] [pid 8036:tid 8079] [client 20.116.26.190:51038] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac1JTEMvKg9PFa_VV4zM6QAAAMM"]
[Thu Apr 02 00:35:25.038832 2026] [:error] [pid 8387:tid 8452] [client 20.116.26.190:51101] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac1JTRdQYJ2y8LDYkv_mAQAAAAw"]
[Thu Apr 02 00:35:25.460324 2026] [:error] [pid 8387:tid 8441] [client 20.116.26.190:51109] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/about.php"] [unique_id "ac1JTRdQYJ2y8LDYkv_mCAAAAAE"]
[Thu Apr 02 00:35:25.874051 2026] [:error] [pid 8037:tid 8112] [client 20.116.26.190:51152] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/about.php"] [unique_id "ac1JTYGD8ox-W9jHVfCuSwAAAQQ"]
[Thu Apr 02 00:35:26.285089 2026] [:error] [pid 8387:tid 8445] [client 20.116.26.190:51072] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/about.php"] [unique_id "ac1JThdQYJ2y8LDYkv_mFQAAAAU"]
[Thu Apr 02 00:35:26.698813 2026] [:error] [pid 8387:tid 8443] [client 20.116.26.190:51029] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/about.php"] [unique_id "ac1JThdQYJ2y8LDYkv_mGwAAAAM"]
[Thu Apr 02 00:35:27.124894 2026] [:error] [pid 8037:tid 8109] [client 20.116.26.190:51178] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/log.php"] [unique_id "ac1JT4GD8ox-W9jHVfCuTwAAAQE"]
[Thu Apr 02 00:35:27.534989 2026] [:error] [pid 8037:tid 8126] [client 20.116.26.190:51126] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/log.php"] [unique_id "ac1JT4GD8ox-W9jHVfCuUAAAARI"]
[Thu Apr 02 00:35:27.954561 2026] [:error] [pid 8037:tid 8123] [client 20.116.26.190:51016] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/log.php"] [unique_id "ac1JT4GD8ox-W9jHVfCuUgAAAQ8"]
[Thu Apr 02 00:35:28.379433 2026] [:error] [pid 8387:tid 8449] [client 20.116.26.190:51025] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/log.php"] [unique_id "ac1JUBdQYJ2y8LDYkv_mKAAAAAk"]
[Thu Apr 02 00:35:28.797143 2026] [:error] [pid 8035:tid 8040] [client 20.116.26.190:50973] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/xmrlpc.php"] [unique_id "ac1JUAY2zflwGmvw_QbMHQAAAIA"]
[Thu Apr 02 00:35:29.211904 2026] [:error] [pid 8036:tid 8076] [client 20.116.26.190:51027] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/xmrlpc.php"] [unique_id "ac1JUUMvKg9PFa_VV4zM8QAAAMA"]
[Thu Apr 02 00:35:29.626574 2026] [:error] [pid 8036:tid 8091] [client 20.116.26.190:51035] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/xmrlpc.php"] [unique_id "ac1JUUMvKg9PFa_VV4zM9AAAAM8"]
[Thu Apr 02 00:35:30.039383 2026] [:error] [pid 8037:tid 8118] [client 20.116.26.190:51186] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/xmrlpc.php"] [unique_id "ac1JUoGD8ox-W9jHVfCuVQAAAQo"]
[Thu Apr 02 00:35:30.463154 2026] [:error] [pid 8035:tid 8057] [client 20.116.26.190:51170] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/test.php"] [unique_id "ac1JUgY2zflwGmvw_QbMIgAAAJE"]
[Thu Apr 02 00:35:30.887470 2026] [:error] [pid 8387:tid 8460] [client 20.116.26.190:51132] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/test.php"] [unique_id "ac1JUhdQYJ2y8LDYkv_mNwAAABM"]
[Thu Apr 02 00:35:31.305701 2026] [:error] [pid 8036:tid 8088] [client 20.116.26.190:51069] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/test.php"] [unique_id "ac1JU0MvKg9PFa_VV4zM-gAAAMw"]
[Thu Apr 02 00:35:31.727320 2026] [:error] [pid 8387:tid 8459] [client 20.116.26.190:51033] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/test.php"] [unique_id "ac1JUxdQYJ2y8LDYkv_mPQAAABI"]
[Thu Apr 02 00:35:32.141084 2026] [:error] [pid 8035:tid 8062] [client 20.116.26.190:51070] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/upgrade.php"] [unique_id "ac1JVAY2zflwGmvw_QbMJgAAAJY"]
[Thu Apr 02 00:35:32.564366 2026] [:error] [pid 8036:tid 8084] [client 20.116.26.190:50718] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/upgrade.php"] [unique_id "ac1JVEMvKg9PFa_VV4zM_gAAAMg"]
[Thu Apr 02 00:35:32.986801 2026] [:error] [pid 8387:tid 8455] [client 20.116.26.190:50750] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/upgrade.php"] [unique_id "ac1JVBdQYJ2y8LDYkv_mSgAAAA4"]
[Thu Apr 02 00:35:33.450791 2026] [:error] [pid 8036:tid 8079] [client 20.116.26.190:51001] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/upgrade.php"] [unique_id "ac1JVUMvKg9PFa_VV4zNBAAAAMM"]
[Thu Apr 02 00:35:33.862569 2026] [:error] [pid 8387:tid 8466] [client 20.116.26.190:51031] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "ac1JVRdQYJ2y8LDYkv_mUwAAABY"]
[Thu Apr 02 00:35:34.285442 2026] [:error] [pid 8035:tid 8056] [client 20.116.26.190:50981] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "ac1JVgY2zflwGmvw_QbMKgAAAJA"]
[Thu Apr 02 00:35:34.707010 2026] [:error] [pid 8387:tid 8450] [client 20.116.26.190:51130] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "ac1JVhdQYJ2y8LDYkv_mXgAAAAo"]
[Thu Apr 02 00:35:35.132539 2026] [:error] [pid 8387:tid 8451] [client 20.116.26.190:51042] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/max.php"] [unique_id "ac1JVxdQYJ2y8LDYkv_mYQAAAAs"]
[Thu Apr 02 00:35:35.555159 2026] [:error] [pid 8387:tid 8457] [client 20.116.26.190:50914] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/phpThumb/404.php"] [unique_id "ac1JVxdQYJ2y8LDYkv_mZgAAABA"]
[Thu Apr 02 00:35:35.966323 2026] [:error] [pid 8387:tid 8448] [client 20.116.26.190:50991] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/phpThumb/404.php"] [unique_id "ac1JVxdQYJ2y8LDYkv_mbAAAAAg"]
[Thu Apr 02 00:35:36.390902 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:50978] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/phpThumb/404.php"] [unique_id "ac1JWBdQYJ2y8LDYkv_mdAAAABU"]
[Thu Apr 02 00:35:36.803636 2026] [:error] [pid 8035:tid 8055] [client 20.116.26.190:50720] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/phpThumb/404.php"] [unique_id "ac1JWAY2zflwGmvw_QbMLQAAAI8"]
[Thu Apr 02 00:35:37.215931 2026] [:error] [pid 8387:tid 8456] [client 20.116.26.190:51087] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/media.php"] [unique_id "ac1JWRdQYJ2y8LDYkv_mgQAAAA8"]
[Thu Apr 02 00:35:37.627653 2026] [:error] [pid 8035:tid 8044] [client 20.116.26.190:51039] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/media.php"] [unique_id "ac1JWQY2zflwGmvw_QbMMAAAAIQ"]
[Thu Apr 02 00:35:38.040019 2026] [:error] [pid 8035:tid 8040] [client 20.116.26.190:51164] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/media.php"] [unique_id "ac1JWgY2zflwGmvw_QbMMgAAAIA"]
[Thu Apr 02 00:35:38.458391 2026] [:error] [pid 8037:tid 8110] [client 20.116.26.190:51127] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/media.php"] [unique_id "ac1JWoGD8ox-W9jHVfCuWwAAAQI"]
[Thu Apr 02 00:35:38.872607 2026] [:error] [pid 8037:tid 8127] [client 20.116.26.190:50998] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "ac1JWoGD8ox-W9jHVfCuXQAAARM"]
[Thu Apr 02 00:35:39.282829 2026] [:error] [pid 8387:tid 8442] [client 20.116.26.190:50945] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "ac1JWxdQYJ2y8LDYkv_mkwAAAAI"]
[Thu Apr 02 00:35:39.694323 2026] [:error] [pid 8035:tid 8056] [client 20.116.26.190:50955] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "ac1JWwY2zflwGmvw_QbMNgAAAJA"]
[Thu Apr 02 00:35:40.113936 2026] [:error] [pid 8387:tid 8468] [client 20.116.26.190:50976] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "ac1JXBdQYJ2y8LDYkv_mmAAAABg"]
[Thu Apr 02 00:35:40.536732 2026] [:error] [pid 8035:tid 8063] [client 20.116.26.190:51071] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "ac1JXAY2zflwGmvw_QbMRgAAAJc"]
[Thu Apr 02 00:35:40.948838 2026] [:error] [pid 8035:tid 8040] [client 20.116.26.190:51028] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "ac1JXAY2zflwGmvw_QbMUQAAAIA"]
[Thu Apr 02 00:35:41.364833 2026] [:error] [pid 8035:tid 8049] [client 20.116.26.190:51197] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "ac1JXQY2zflwGmvw_QbMWgAAAIk"]
[Thu Apr 02 00:35:41.781246 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:51008] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "ac1JXRdQYJ2y8LDYkv_mowAAABU"]
[Thu Apr 02 00:35:42.190887 2026] [:error] [pid 8036:tid 8084] [client 20.116.26.190:50885] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/wp-configs.php"] [unique_id "ac1JXkMvKg9PFa_VV4zNFgAAAMg"]
[Thu Apr 02 00:35:42.600717 2026] [:error] [pid 8037:tid 8109] [client 20.116.26.190:51041] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/wp-configs.php"] [unique_id "ac1JXoGD8ox-W9jHVfCuaAAAAQE"]
[Thu Apr 02 00:35:43.045376 2026] [:error] [pid 8387:tid 8455] [client 20.116.26.190:50948] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/wp-configs.php"] [unique_id "ac1JXxdQYJ2y8LDYkv_mqgAAAA4"]
[Thu Apr 02 00:35:43.457870 2026] [:error] [pid 8035:tid 8044] [client 20.116.26.190:51114] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/include/wp-configs.php"] [unique_id "ac1JXwY2zflwGmvw_QbMlAAAAIQ"]
[Thu Apr 02 00:35:43.868174 2026] [:error] [pid 8037:tid 8124] [client 20.116.26.190:51117] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/chosen.php"] [unique_id "ac1JX4GD8ox-W9jHVfCuagAAARA"]
[Thu Apr 02 00:35:44.278977 2026] [:error] [pid 8387:tid 8442] [client 20.116.26.190:51107] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/chosen.php"] [unique_id "ac1JYBdQYJ2y8LDYkv_mtgAAAAI"]
[Thu Apr 02 00:35:44.692180 2026] [:error] [pid 8387:tid 8460] [client 20.116.26.190:51123] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/chosen.php"] [unique_id "ac1JYBdQYJ2y8LDYkv_mugAAABM"]
[Thu Apr 02 00:35:45.104804 2026] [:error] [pid 8387:tid 8446] [client 20.116.26.190:51088] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/chosen.php"] [unique_id "ac1JYRdQYJ2y8LDYkv_mvAAAAAY"]
[Thu Apr 02 00:35:45.514684 2026] [:error] [pid 8036:tid 8076] [client 20.116.26.190:50707] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "ac1JYUMvKg9PFa_VV4zNGAAAAMA"]
[Thu Apr 02 00:35:45.931857 2026] [:error] [pid 8036:tid 8090] [client 20.116.26.190:51067] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "ac1JYUMvKg9PFa_VV4zNHAAAAM4"]
[Thu Apr 02 00:35:46.342091 2026] [:error] [pid 8387:tid 8448] [client 20.116.26.190:51065] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "ac1JYhdQYJ2y8LDYkv_mwgAAAAg"]
[Thu Apr 02 00:35:46.761841 2026] [:error] [pid 8036:tid 8087] [client 20.116.26.190:51122] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "ac1JYkMvKg9PFa_VV4zNIgAAAMs"]
[Thu Apr 02 00:35:47.178227 2026] [:error] [pid 8387:tid 8457] [client 20.116.26.190:51124] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bg/xmrlpc.php"] [unique_id "ac1JYxdQYJ2y8LDYkv_mxQAAABA"]
[Thu Apr 02 00:35:47.592855 2026] [:error] [pid 8036:tid 8094] [client 20.116.26.190:51011] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bg/xmrlpc.php"] [unique_id "ac1JY0MvKg9PFa_VV4zNJgAAANE"]
[Thu Apr 02 00:35:48.013444 2026] [:error] [pid 8387:tid 8458] [client 20.116.26.190:50958] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bg/xmrlpc.php"] [unique_id "ac1JZBdQYJ2y8LDYkv_mxgAAABE"]
[Thu Apr 02 00:35:48.434855 2026] [:error] [pid 8387:tid 8441] [client 20.116.26.190:50986] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bg/xmrlpc.php"] [unique_id "ac1JZBdQYJ2y8LDYkv_myAAAAAE"]
[Thu Apr 02 00:35:48.856199 2026] [:error] [pid 8387:tid 8450] [client 20.116.26.190:50995] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "ac1JZBdQYJ2y8LDYkv_mzQAAAAo"]
[Thu Apr 02 00:35:49.272329 2026] [:error] [pid 8387:tid 8448] [client 20.116.26.190:51024] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "ac1JZRdQYJ2y8LDYkv_m0QAAAAg"]
[Thu Apr 02 00:35:49.688489 2026] [:error] [pid 8037:tid 8132] [client 20.116.26.190:50963] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "ac1JZYGD8ox-W9jHVfCudQAAARg"]
[Thu Apr 02 00:35:50.109999 2026] [:error] [pid 8037:tid 8121] [client 20.116.26.190:51081] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "ac1JZoGD8ox-W9jHVfCueAAAAQ0"]
[Thu Apr 02 00:35:50.531649 2026] [:error] [pid 8035:tid 8056] [client 20.116.26.190:51024] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "ac1JZgY2zflwGmvw_QbMpgAAAJA"]
[Thu Apr 02 00:35:50.949307 2026] [:error] [pid 8037:tid 8130] [client 20.116.26.190:51062] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "ac1JZoGD8ox-W9jHVfCuewAAARY"]
[Thu Apr 02 00:35:51.369995 2026] [:error] [pid 8036:tid 8085] [client 20.116.26.190:51030] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "ac1JZ0MvKg9PFa_VV4zNLwAAAMk"]
[Thu Apr 02 00:35:51.825283 2026] [:error] [pid 8387:tid 8468] [client 20.116.26.190:50717] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/blue/atomlib.php"] [unique_id "ac1JZxdQYJ2y8LDYkv_m0wAAABg"]
[Thu Apr 02 00:35:52.260044 2026] [:error] [pid 8037:tid 8131] [client 20.116.26.190:50911] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/byp.php"] [unique_id "ac1JaIGD8ox-W9jHVfCufQAAARc"]
[Thu Apr 02 00:35:52.677085 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:50972] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/byp.php"] [unique_id "ac1JaBdQYJ2y8LDYkv_m1wAAABU"]
[Thu Apr 02 00:35:53.097006 2026] [:error] [pid 8037:tid 8115] [client 20.116.26.190:51058] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/byp.php"] [unique_id "ac1JaYGD8ox-W9jHVfCuggAAAQc"]
[Thu Apr 02 00:35:53.519945 2026] [:error] [pid 8035:tid 8040] [client 20.116.26.190:50922] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/byp.php"] [unique_id "ac1JaQY2zflwGmvw_QbMtQAAAIA"]
[Thu Apr 02 00:35:53.939058 2026] [:error] [pid 8036:tid 8086] [client 20.116.26.190:51061] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/index.php"] [unique_id "ac1JaUMvKg9PFa_VV4zNNAAAAMo"]
[Thu Apr 02 00:35:54.364268 2026] [:error] [pid 8036:tid 8092] [client 20.116.26.190:51049] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-login.php"] [unique_id "ac1JakMvKg9PFa_VV4zNNgAAANA"]
[Thu Apr 02 00:35:54.780558 2026] [:error] [pid 8035:tid 8042] [client 20.116.26.190:50936] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-login.php"] [unique_id "ac1JagY2zflwGmvw_QbMugAAAII"]
[Thu Apr 02 00:35:55.202994 2026] [:error] [pid 8035:tid 8060] [client 20.116.26.190:50902] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-login.php"] [unique_id "ac1JawY2zflwGmvw_QbMvQAAAJQ"]
[Thu Apr 02 00:35:55.625664 2026] [:error] [pid 8037:tid 8121] [client 20.116.26.190:51110] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/wp-login.php"] [unique_id "ac1Ja4GD8ox-W9jHVfCuhQAAAQ0"]
[Thu Apr 02 00:35:56.039173 2026] [:error] [pid 8036:tid 8095] [client 20.116.26.190:51134] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/editor/engine.php"] [unique_id "ac1JbEMvKg9PFa_VV4zNPQAAANI"]
[Thu Apr 02 00:35:56.456554 2026] [:error] [pid 8387:tid 8467] [client 20.116.26.190:51068] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/editor/engine.php"] [unique_id "ac1JbBdQYJ2y8LDYkv_m4AAAABc"]
[Thu Apr 02 00:35:56.874045 2026] [:error] [pid 8035:tid 8049] [client 20.116.26.190:51020] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/editor/engine.php"] [unique_id "ac1JbAY2zflwGmvw_QbMxAAAAIk"]
[Thu Apr 02 00:35:57.320186 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:50952] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/editor/engine.php"] [unique_id "ac1JbRdQYJ2y8LDYkv_m4gAAABU"]
[Thu Apr 02 00:35:57.738722 2026] [:error] [pid 8036:tid 8091] [client 20.116.26.190:51017] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac1JbUMvKg9PFa_VV4zNRgAAAM8"]
[Thu Apr 02 00:35:58.151454 2026] [:error] [pid 8387:tid 8450] [client 20.116.26.190:51019] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac1JbhdQYJ2y8LDYkv_m5AAAAAo"]
[Thu Apr 02 00:35:58.562141 2026] [:error] [pid 8035:tid 8063] [client 20.116.26.190:50993] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac1JbgY2zflwGmvw_QbMyAAAAJc"]
[Thu Apr 02 00:35:58.980383 2026] [:error] [pid 8035:tid 8043] [client 20.116.26.190:50950] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac1JbgY2zflwGmvw_QbMyQAAAIM"]
[Thu Apr 02 00:35:59.399908 2026] [:error] [pid 8387:tid 8460] [client 20.116.26.190:50887] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "ac1JbxdQYJ2y8LDYkv_m5wAAABM"]
[Thu Apr 02 00:35:59.827966 2026] [:error] [pid 8035:tid 8050] [client 20.116.26.190:50990] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "ac1JbwY2zflwGmvw_QbMzgAAAIo"]
[Thu Apr 02 00:36:00.244563 2026] [:error] [pid 8387:tid 8446] [client 20.116.26.190:50985] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "ac1JcBdQYJ2y8LDYkv_m7QAAAAY"]
[Thu Apr 02 00:36:00.672074 2026] [:error] [pid 8035:tid 8047] [client 20.116.26.190:50989] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "ac1JcAY2zflwGmvw_QbM1AAAAIc"]
[Thu Apr 02 00:36:01.082557 2026] [:error] [pid 8036:tid 8099] [client 20.116.26.190:50892] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/about.php"] [unique_id "ac1JcUMvKg9PFa_VV4zNTAAAANY"]
[Thu Apr 02 00:36:01.512710 2026] [:error] [pid 8387:tid 8467] [client 20.116.26.190:50893] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/lmfi2.php"] [unique_id "ac1JcRdQYJ2y8LDYkv_m8QAAABc"]
[Thu Apr 02 00:36:01.933820 2026] [:error] [pid 8035:tid 8049] [client 20.116.26.190:51051] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/lmfi2.php"] [unique_id "ac1JcQY2zflwGmvw_QbM2gAAAIk"]
[Thu Apr 02 00:36:02.345116 2026] [:error] [pid 8387:tid 8465] [client 20.116.26.190:50960] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/lmfi2.php"] [unique_id "ac1JchdQYJ2y8LDYkv_m9QAAABU"]
[Thu Apr 02 00:36:02.759669 2026] [:error] [pid 8036:tid 8097] [client 20.116.26.190:51055] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/lmfi2.php"] [unique_id "ac1JckMvKg9PFa_VV4zNTgAAANQ"]
[Thu Apr 02 00:36:03.176623 2026] [:error] [pid 8037:tid 8132] [client 20.116.26.190:51191] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/function.php"] [unique_id "ac1Jc4GD8ox-W9jHVfCulQAAARg"]
[Thu Apr 02 00:36:03.586970 2026] [:error] [pid 8387:tid 8461] [client 20.116.26.190:50980] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/function.php"] [unique_id "ac1JcxdQYJ2y8LDYkv_m-QAAABQ"]
[Thu Apr 02 00:36:04.000809 2026] [:error] [pid 8036:tid 8089] [client 20.116.26.190:51015] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/function.php"] [unique_id "ac1JdEMvKg9PFa_VV4zNVQAAAM0"]
[Thu Apr 02 00:36:04.414951 2026] [:error] [pid 8036:tid 8080] [client 20.116.26.190:50992] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/function.php"] [unique_id "ac1JdEMvKg9PFa_VV4zNWAAAAMQ"]
[Thu Apr 02 00:36:04.828027 2026] [:error] [pid 8036:tid 8102] [client 20.116.26.190:50883] [client 20.116.26.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/alfa-rex.php"] [unique_id "ac1JdEMvKg9PFa_VV4zNWwAAANg"]
[Thu Apr 02 00:36:05.246492 2026] [:error] [pid 8036:tid 8098] [client 20.116.26.190:51059] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/chosen.php"] [unique_id "ac1JdUMvKg9PFa_VV4zNYAAAANU"]
[Thu Apr 02 00:36:05.665440 2026] [:error] [pid 8036:tid 8087] [client 20.116.26.190:51037] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/chosen.php"] [unique_id "ac1JdUMvKg9PFa_VV4zNZQAAAMs"]
[Thu Apr 02 00:36:06.079601 2026] [:error] [pid 8037:tid 8108] [client 20.116.26.190:51096] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/chosen.php"] [unique_id "ac1JdoGD8ox-W9jHVfCungAAAQA"]
[Thu Apr 02 00:36:06.489048 2026] [:error] [pid 8036:tid 8086] [client 20.116.26.190:50967] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac1JdkMvKg9PFa_VV4zNaAAAAMo"]
[Thu Apr 02 00:36:06.915372 2026] [:error] [pid 8035:tid 8046] [client 20.116.26.190:51003] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac1JdgY2zflwGmvw_QbM6AAAAIY"]
[Thu Apr 02 00:36:07.326033 2026] [:error] [pid 8387:tid 8460] [client 20.116.26.190:51105] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac1JdxdQYJ2y8LDYkv_nBwAAABM"]
[Thu Apr 02 00:36:07.751644 2026] [:error] [pid 8036:tid 8082] [client 20.116.26.190:51094] [client 20.116.26.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac1Jd0MvKg9PFa_VV4zNcAAAAMY"]
[Thu Apr 02 02:16:38.051846 2026] [:error] [pid 8037:tid 8121] [client 5.195.91.60:64599] [client 5.195.91.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.195.91.60, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac1hBoGD8ox-W9jHVfDPbgAAAQ0"]
[Thu Apr 02 02:16:38.057081 2026] [:error] [pid 8037:tid 8121] [client 5.195.91.60:64599] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 03:28:05.060527 2026] [:error] [pid 59201:tid 59291] [client 39.48.187.57:58110] [client 39.48.187.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.48.187.57, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac1xxcAC0Tw8eL6gzZ5I2gAAAJg"]
[Thu Apr 02 03:28:05.065412 2026] [:error] [pid 59201:tid 59291] [client 39.48.187.57:58110] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 04:30:20.916839 2026] [:error] [pid 29467:tid 29488] [client 5.29.16.108:52564] [client 5.29.16.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.29.16.108, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac2AXL4VUBFCJAq-WOn3aAAAARI"]
[Thu Apr 02 04:30:20.921392 2026] [:error] [pid 29467:tid 29488] [client 5.29.16.108:52564] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 06:13:00.926540 2026] [:error] [pid 59200:tid 59248] [client 197.133.129.96:52948] [client 197.133.129.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.133.129.96, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac2YbLfP26txrdLs3Er7FQAAAEg"]
[Thu Apr 02 06:13:00.933707 2026] [:error] [pid 59200:tid 59248] [client 197.133.129.96:52948] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 07:23:15.331787 2026] [:error] [pid 23927:tid 23939] [client 102.218.40.17:50789] [client 102.218.40.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.218.40.17, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac2o40sZwqCndhl9uKBn7AAAAYo"]
[Thu Apr 02 07:23:15.336948 2026] [:error] [pid 23927:tid 23939] [client 102.218.40.17:50789] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 07:44:17.576008 2026] [:error] [pid 23927:tid 23950] [client 206.212.255.60:46196] [client 206.212.255.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.212.255.60, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "ac2t0UsZwqCndhl9uKBwSwAAAZU"]
[Thu Apr 02 07:44:17.579964 2026] [:error] [pid 23927:tid 23950] [client 206.212.255.60:46196] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Apr 02 09:01:30.897061 2026] [:error] [pid 59194:tid 59217] [client 73.115.99.151:59889] [client 73.115.99.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 73.115.99.151, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac2_6hMpAeV11hcQehzzqgAAAAQ"]
[Thu Apr 02 09:01:30.910734 2026] [:error] [pid 59194:tid 59217] [client 73.115.99.151:59889] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 11:02:46.704374 2026] [:error] [pid 54384:tid 54393] [client 43.240.55.50:45463] [client 43.240.55.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.240.55.50, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac3cVtWWpaby3TVN7MdojgAAAcc"]
[Thu Apr 02 11:02:46.709810 2026] [:error] [pid 54384:tid 54393] [client 43.240.55.50:45463] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 16:58:40.055412 2026] [:error] [pid 29467:tid 29472] [client 103.218.106.165:49432] [client 103.218.106.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.218.106.165, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac4vwL4VUBFCJAq-WOn4SAAAAQI"]
[Thu Apr 02 16:58:40.061576 2026] [:error] [pid 29467:tid 29472] [client 103.218.106.165:49432] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 16:58:48.499929 2026] [:error] [pid 54384:tid 54406] [client 49.43.231.175:63325] [client 49.43.231.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.231.175, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac4vyNWWpaby3TVN7MfTqQAAAdQ"]
[Thu Apr 02 16:58:48.504302 2026] [:error] [pid 54384:tid 54406] [client 49.43.231.175:63325] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 17:22:29.625785 2026] [:error] [pid 37543:tid 37566] [client 180.249.64.9:55816] [client 180.249.64.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.249.64.9, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac41VXhdk2bEYJCvILauagAAAVU"]
[Thu Apr 02 17:22:29.630725 2026] [:error] [pid 37543:tid 37566] [client 180.249.64.9:55816] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 17:37:38.902191 2026] [:error] [pid 54384:tid 54397] [client 117.196.124.116:60475] [client 117.196.124.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.196.124.116, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac444tWWpaby3TVN7Mfd6QAAAcs"]
[Thu Apr 02 17:37:38.907077 2026] [:error] [pid 54384:tid 54397] [client 117.196.124.116:60475] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 02 17:52:18.440710 2026] [:error] [pid 29467:tid 29481] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/bhm.php
[Thu Apr 02 17:52:18.695368 2026] [:error] [pid 29467:tid 29488] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/class-bda.php
[Thu Apr 02 17:52:18.948421 2026] [:error] [pid 29467:tid 29477] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/f2.php
[Thu Apr 02 17:52:19.839547 2026] [:error] [pid 29467:tid 29489] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/classc.php
[Thu Apr 02 17:52:20.093986 2026] [:error] [pid 29467:tid 29478] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/ahutr.php
[Thu Apr 02 17:52:20.349333 2026] [:error] [pid 29467:tid 29487] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/class-cc.php
[Thu Apr 02 17:52:20.602994 2026] [:error] [pid 29467:tid 29473] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Thu Apr 02 17:52:20.859861 2026] [:error] [pid 29467:tid 29485] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/brtnd.php
[Thu Apr 02 17:52:21.114273 2026] [:error] [pid 29467:tid 29489] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/azrhw.php
[Thu Apr 02 17:52:21.413270 2026] [:error] [pid 29467:tid 29486] [client 40.115.124.4:10645] File does not exist: /usr/local/apache/htdocs/suspended-page/cnusw.php
[Thu Apr 02 17:52:21.663722 2026] [:error] [pid 29467:tid 29483] [client 40.115.124.4:10645] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtwpf.php"] [unique_id "ac48Vb4VUBFCJAq-WOkaKQAAAQ0"]
[Thu Apr 02 17:52:22.163007 2026] [:error] [pid 29467:tid 29488] [client 40.115.124.4:10727] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtwpf.php"] [unique_id "ac48Vr4VUBFCJAq-WOkaMAAAARI"]
[Thu Apr 02 17:52:22.664781 2026] [:error] [pid 29467:tid 29474] [client 40.115.124.4:10634] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtwpf.php"] [unique_id "ac48Vr4VUBFCJAq-WOkaNAAAAQQ"]
[Thu Apr 02 17:52:23.166034 2026] [:error] [pid 29467:tid 29494] [client 40.115.124.4:10711] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dtwpf.php"] [unique_id "ac48V74VUBFCJAq-WOkaOgAAARg"]
[Thu Apr 02 17:52:23.671005 2026] [:error] [pid 29467:tid 29492] [client 40.115.124.4:10710] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "ac48V74VUBFCJAq-WOkaPwAAARY"]
[Thu Apr 02 17:52:24.171075 2026] [:error] [pid 59305:tid 59311] [client 40.115.124.4:10714] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "ac48WKr2tV4rDwKFxKc_5wAAAMI"]
[Thu Apr 02 17:52:24.680440 2026] [:error] [pid 59200:tid 59263] [client 40.115.124.4:10709] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "ac48WLfP26txrdLs3EpZxQAAAFc"]
[Thu Apr 02 17:52:25.194118 2026] [:error] [pid 59194:tid 59226] [client 40.115.124.4:10629] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "ac48WRMpAeV11hcQehwtOAAAAA0"]
[Thu Apr 02 17:52:25.747317 2026] [:error] [pid 59194:tid 59231] [client 40.115.124.4:10707] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "ac48WRMpAeV11hcQehwtOwAAABI"]
[Thu Apr 02 17:52:26.248974 2026] [:error] [pid 59194:tid 59220] [client 40.115.124.4:10704] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "ac48WhMpAeV11hcQehwtPgAAAAc"]
[Thu Apr 02 17:52:26.766189 2026] [:error] [pid 59194:tid 59225] [client 40.115.124.4:10732] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "ac48WhMpAeV11hcQehwtQgAAAAw"]
[Thu Apr 02 17:52:27.278797 2026] [:error] [pid 54384:tid 54402] [client 40.115.124.4:10719] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "ac48W9WWpaby3TVN7MfiQQAAAdA"]
[Thu Apr 02 17:52:27.778376 2026] [:error] [pid 59305:tid 59318] [client 40.115.124.4:10674] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "ac48W6r2tV4rDwKFxKc_6wAAAMk"]
[Thu Apr 02 17:52:28.287095 2026] [:error] [pid 23927:tid 23952] [client 40.115.124.4:10701] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "ac48XEsZwqCndhl9uKB2sgAAAZc"]
[Thu Apr 02 17:52:28.797443 2026] [:error] [pid 59305:tid 59332] [client 40.115.124.4:10647] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "ac48XKr2tV4rDwKFxKc_7wAAANc"]
[Thu Apr 02 17:52:29.305479 2026] [:error] [pid 54384:tid 54391] [client 40.115.124.4:10654] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "ac48XdWWpaby3TVN7MfiRwAAAcU"]
[Thu Apr 02 17:52:29.823913 2026] [:error] [pid 37543:tid 37560] [client 40.115.124.4:10684] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lef.php"] [unique_id "ac48XXhdk2bEYJCvILa1cwAAAU8"]
[Thu Apr 02 17:52:30.379832 2026] [:error] [pid 54384:tid 54394] [client 40.115.124.4:10745] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lef.php"] [unique_id "ac48XtWWpaby3TVN7MfiSQAAAcg"]
[Thu Apr 02 17:52:30.887816 2026] [:error] [pid 54384:tid 54392] [client 40.115.124.4:10626] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lef.php"] [unique_id "ac48XtWWpaby3TVN7MfiTQAAAcY"]
[Thu Apr 02 17:52:31.458131 2026] [:error] [pid 59305:tid 59324] [client 40.115.124.4:10696] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lef.php"] [unique_id "ac48X6r2tV4rDwKFxKc_-AAAAM8"]
[Thu Apr 02 17:52:31.964041 2026] [:error] [pid 59201:tid 59282] [client 40.115.124.4:10698] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48X8AC0Tw8eL6gzZ78IwAAAI8"]
[Thu Apr 02 17:52:32.469667 2026] [:error] [pid 37543:tid 37565] [client 40.115.124.4:10728] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48YHhdk2bEYJCvILa1eAAAAVQ"]
[Thu Apr 02 17:52:32.971791 2026] [:error] [pid 29467:tid 29492] [client 40.115.124.4:10713] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48YL4VUBFCJAq-WOkaSwAAARY"]
[Thu Apr 02 17:52:33.477155 2026] [:error] [pid 29467:tid 29487] [client 40.115.124.4:10734] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48Yb4VUBFCJAq-WOkaTgAAARE"]
[Thu Apr 02 17:52:33.993881 2026] [:error] [pid 29467:tid 29493] [client 40.115.124.4:10717] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "ac48Yb4VUBFCJAq-WOkaUwAAARc"]
[Thu Apr 02 17:52:34.505576 2026] [:error] [pid 29467:tid 29491] [client 40.115.124.4:10637] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "ac48Yr4VUBFCJAq-WOkaVwAAARU"]
[Thu Apr 02 17:52:35.015681 2026] [:error] [pid 59201:tid 59286] [client 40.115.124.4:10686] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "ac48Y8AC0Tw8eL6gzZ78JgAAAJM"]
[Thu Apr 02 17:52:35.520001 2026] [:error] [pid 59194:tid 59235] [client 40.115.124.4:10720] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "ac48YxMpAeV11hcQehwtSwAAABY"]
[Thu Apr 02 17:52:36.020551 2026] [:error] [pid 23927:tid 23938] [client 40.115.124.4:10738] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "ac48ZEsZwqCndhl9uKB2wwAAAYk"]
[Thu Apr 02 17:52:36.520548 2026] [:error] [pid 59305:tid 59317] [client 40.115.124.4:10735] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "ac48ZKr2tV4rDwKFxKdAAAAAAMg"]
[Thu Apr 02 17:52:37.042272 2026] [:error] [pid 59305:tid 59326] [client 40.115.124.4:10633] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "ac48Zar2tV4rDwKFxKdAAwAAANE"]
[Thu Apr 02 17:52:37.561117 2026] [:error] [pid 29467:tid 29479] [client 40.115.124.4:10712] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "ac48Zb4VUBFCJAq-WOkaXAAAAQk"]
[Thu Apr 02 17:52:38.065860 2026] [:error] [pid 59201:tid 59275] [client 40.115.124.4:10742] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haz.php"] [unique_id "ac48ZsAC0Tw8eL6gzZ78KgAAAIg"]
[Thu Apr 02 17:52:38.568922 2026] [:error] [pid 29467:tid 29492] [client 40.115.124.4:10640] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haz.php"] [unique_id "ac48Zr4VUBFCJAq-WOkaXQAAARY"]
[Thu Apr 02 17:52:39.073741 2026] [:error] [pid 37543:tid 37565] [client 40.115.124.4:10721] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haz.php"] [unique_id "ac48Z3hdk2bEYJCvILa1gwAAAVQ"]
[Thu Apr 02 17:52:39.591829 2026] [:error] [pid 23927:tid 23943] [client 40.115.124.4:10648] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haz.php"] [unique_id "ac48Z0sZwqCndhl9uKB20QAAAY4"]
[Thu Apr 02 17:52:40.120501 2026] [:error] [pid 23927:tid 23933] [client 40.115.124.4:5083] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "ac48aEsZwqCndhl9uKB21gAAAYQ"]
[Thu Apr 02 17:52:40.620650 2026] [:error] [pid 37543:tid 37557] [client 40.115.124.4:10722] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "ac48aHhdk2bEYJCvILa1hwAAAUw"]
[Thu Apr 02 17:52:41.126249 2026] [:error] [pid 37543:tid 37549] [client 40.115.124.4:10643] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "ac48aXhdk2bEYJCvILa1iwAAAUQ"]
[Thu Apr 02 17:52:41.640330 2026] [:error] [pid 29467:tid 29475] [client 40.115.124.4:10676] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "ac48ab4VUBFCJAq-WOkaYQAAAQU"]
[Thu Apr 02 17:52:42.211965 2026] [:error] [pid 23927:tid 23950] [client 40.115.124.4:10747] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac48aksZwqCndhl9uKB23QAAAZU"]
[Thu Apr 02 17:52:42.711276 2026] [:error] [pid 23927:tid 23941] [client 40.115.124.4:10646] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac48aksZwqCndhl9uKB24AAAAYw"]
[Thu Apr 02 17:52:43.218771 2026] [:error] [pid 59305:tid 59311] [client 40.115.124.4:10699] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac48a6r2tV4rDwKFxKdADwAAAMI"]
[Thu Apr 02 17:52:43.719738 2026] [:error] [pid 59201:tid 59267] [client 40.115.124.4:5060] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac48a8AC0Tw8eL6gzZ78MgAAAIA"]
[Thu Apr 02 17:52:44.226966 2026] [:error] [pid 59305:tid 59331] [client 40.115.124.4:10741] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "ac48bKr2tV4rDwKFxKdAEQAAANY"]
[Thu Apr 02 17:52:44.737589 2026] [:error] [pid 37543:tid 37559] [client 40.115.124.4:10705] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "ac48bHhdk2bEYJCvILa1mQAAAU4"]
[Thu Apr 02 17:52:45.238453 2026] [:error] [pid 23927:tid 23932] [client 40.115.124.4:10625] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "ac48bUsZwqCndhl9uKB26AAAAYM"]
[Thu Apr 02 17:52:45.755748 2026] [:error] [pid 23927:tid 23933] [client 40.115.124.4:10748] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "ac48bUsZwqCndhl9uKB27QAAAYQ"]
[Thu Apr 02 17:52:46.270873 2026] [:error] [pid 29467:tid 29472] [client 40.115.124.4:10702] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f222.php"] [unique_id "ac48br4VUBFCJAq-WOkaZwAAAQI"]
[Thu Apr 02 17:52:46.770737 2026] [:error] [pid 23927:tid 23950] [client 40.115.124.4:10743] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f222.php"] [unique_id "ac48bksZwqCndhl9uKB2-gAAAZU"]
[Thu Apr 02 17:52:47.272015 2026] [:error] [pid 54384:tid 54396] [client 40.115.124.4:10726] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f222.php"] [unique_id "ac48b9WWpaby3TVN7MfiUwAAAco"]
[Thu Apr 02 17:52:47.770886 2026] [:error] [pid 59200:tid 59249] [client 40.115.124.4:5090] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f222.php"] [unique_id "ac48b7fP26txrdLs3EpZ5QAAAEk"]
[Thu Apr 02 17:52:48.269936 2026] [:error] [pid 23927:tid 23942] [client 40.115.124.4:10746] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ver.php"] [unique_id "ac48cEsZwqCndhl9uKB3AgAAAY0"]
[Thu Apr 02 17:52:49.786933 2026] [:error] [pid 54384:tid 54388] [client 40.115.124.4:5071] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ver.php"] [unique_id "ac48cdWWpaby3TVN7MfiYAAAAcI"]
[Thu Apr 02 17:52:50.340393 2026] [:error] [pid 29467:tid 29475] [client 40.115.124.4:5032] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ver.php"] [unique_id "ac48cr4VUBFCJAq-WOkaegAAAQU"]
[Thu Apr 02 17:52:52.039102 2026] [:error] [pid 29467:tid 29481] [client 40.115.124.4:10673] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ver.php"] [unique_id "ac48dL4VUBFCJAq-WOkahwAAAQs"]
[Thu Apr 02 17:52:52.565138 2026] [:error] [pid 29467:tid 29483] [client 40.115.124.4:5075] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "ac48dL4VUBFCJAq-WOkajQAAAQ0"]
[Thu Apr 02 17:52:53.065218 2026] [:error] [pid 59201:tid 59291] [client 40.115.124.4:10730] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "ac48dcAC0Tw8eL6gzZ78QgAAAJg"]
[Thu Apr 02 17:52:53.569552 2026] [:error] [pid 23927:tid 23931] [client 40.115.124.4:5014] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "ac48dUsZwqCndhl9uKB3DAAAAYI"]
[Thu Apr 02 17:52:54.077820 2026] [:error] [pid 29467:tid 29493] [client 40.115.124.4:10651] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "ac48dr4VUBFCJAq-WOkakgAAARc"]
[Thu Apr 02 17:52:55.459551 2026] [:error] [pid 54384:tid 54396] [client 40.115.124.4:5080] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac48d9WWpaby3TVN7MfiZgAAAco"]
[Thu Apr 02 17:52:55.963712 2026] [:error] [pid 59194:tid 59225] [client 40.115.124.4:10681] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac48dxMpAeV11hcQehwtWAAAAAw"]
[Thu Apr 02 17:52:56.542211 2026] [:error] [pid 59201:tid 59271] [client 40.115.124.4:10736] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac48eMAC0Tw8eL6gzZ78RgAAAIQ"]
[Thu Apr 02 17:52:57.044514 2026] [:error] [pid 29467:tid 29470] [client 40.115.124.4:10638] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac48eb4VUBFCJAq-WOkanQAAAQA"]
[Thu Apr 02 17:52:57.571323 2026] [:error] [pid 59194:tid 59223] [client 40.115.124.4:10624] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac48eRMpAeV11hcQehwtWwAAAAo"]
[Thu Apr 02 17:52:58.075751 2026] [:error] [pid 23927:tid 23936] [client 40.115.124.4:10672] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac48eksZwqCndhl9uKB3GAAAAYc"]
[Thu Apr 02 17:52:58.588524 2026] [:error] [pid 23927:tid 23939] [client 40.115.124.4:10737] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac48eksZwqCndhl9uKB3HwAAAYo"]
[Thu Apr 02 17:52:59.115511 2026] [:error] [pid 37543:tid 37547] [client 40.115.124.4:5089] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac48e3hdk2bEYJCvILa1pQAAAUI"]
[Thu Apr 02 17:52:59.623595 2026] [:error] [pid 29467:tid 29488] [client 40.115.124.4:10653] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "ac48e74VUBFCJAq-WOkanwAAARI"]
[Thu Apr 02 17:53:00.125675 2026] [:error] [pid 54384:tid 54399] [client 40.115.124.4:5005] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "ac48fNWWpaby3TVN7MfieAAAAc0"]
[Thu Apr 02 17:53:00.631534 2026] [:error] [pid 29467:tid 29475] [client 40.115.124.4:5105] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "ac48fL4VUBFCJAq-WOkaoQAAAQU"]
[Thu Apr 02 17:53:01.172120 2026] [:error] [pid 59305:tid 59333] [client 40.115.124.4:10671] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "ac48far2tV4rDwKFxKdAHwAAANg"]
[Thu Apr 02 17:53:01.672620 2026] [:error] [pid 29467:tid 29479] [client 40.115.124.4:10628] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "ac48fb4VUBFCJAq-WOkapQAAAQk"]
[Thu Apr 02 17:53:02.183431 2026] [:error] [pid 37543:tid 37560] [client 40.115.124.4:10677] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "ac48fnhdk2bEYJCvILa1rQAAAU8"]
[Thu Apr 02 17:53:02.695223 2026] [:error] [pid 54384:tid 54402] [client 40.115.124.4:5074] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "ac48ftWWpaby3TVN7MfifwAAAdA"]
[Thu Apr 02 17:53:03.194027 2026] [:error] [pid 59201:tid 59289] [client 40.115.124.4:5072] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "ac48f8AC0Tw8eL6gzZ78UwAAAJY"]
[Thu Apr 02 17:53:03.704494 2026] [:error] [pid 23927:tid 23944] [client 40.115.124.4:10751] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "ac48f0sZwqCndhl9uKB3JgAAAY8"]
[Thu Apr 02 17:53:05.217000 2026] [:error] [pid 59200:tid 59252] [client 40.115.124.4:10655] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "ac48gbfP26txrdLs3EpZ_AAAAEw"]
[Thu Apr 02 17:53:05.716781 2026] [:error] [pid 37543:tid 37559] [client 40.115.124.4:5059] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "ac48gXhdk2bEYJCvILa1wAAAAU4"]
[Thu Apr 02 17:53:06.217722 2026] [:error] [pid 29467:tid 29493] [client 40.115.124.4:10650] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "ac48gr4VUBFCJAq-WOkargAAARc"]
[Thu Apr 02 17:53:06.716129 2026] [:error] [pid 59305:tid 59319] [client 40.115.124.4:10639] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "ac48gqr2tV4rDwKFxKdAJgAAAMo"]
[Thu Apr 02 17:53:07.216017 2026] [:error] [pid 54384:tid 54390] [client 40.115.124.4:10636] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "ac48g9WWpaby3TVN7MfihAAAAcQ"]
[Thu Apr 02 17:53:08.293179 2026] [:error] [pid 54384:tid 54408] [client 40.115.124.4:10666] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "ac48hNWWpaby3TVN7MfihwAAAdY"]
[Thu Apr 02 17:53:09.368992 2026] [:error] [pid 29467:tid 29470] [client 40.115.124.4:10652] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "ac48hb4VUBFCJAq-WOkatwAAAQA"]
[Thu Apr 02 17:53:09.913424 2026] [:error] [pid 29467:tid 29473] [client 40.115.124.4:10656] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "ac48hb4VUBFCJAq-WOkavQAAAQM"]
[Thu Apr 02 17:53:11.432747 2026] [:error] [pid 59194:tid 59226] [client 40.115.124.4:10707] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "ac48hxMpAeV11hcQehwtcgAAAA0"]
[Thu Apr 02 17:53:11.933448 2026] [:error] [pid 59194:tid 59227] [client 40.115.124.4:10744] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "ac48hxMpAeV11hcQehwtcwAAAA4"]
[Thu Apr 02 17:53:12.455605 2026] [:error] [pid 29467:tid 29470] [client 40.115.124.4:5113] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "ac48iL4VUBFCJAq-WOkaxAAAAQA"]
[Thu Apr 02 17:53:12.969023 2026] [:error] [pid 29467:tid 29486] [client 40.115.124.4:10703] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "ac48iL4VUBFCJAq-WOkayAAAARA"]
[Thu Apr 02 17:53:13.474622 2026] [:error] [pid 29467:tid 29480] [client 40.115.124.4:10689] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "ac48ib4VUBFCJAq-WOkazQAAAQo"]
[Thu Apr 02 17:53:14.037877 2026] [:error] [pid 54384:tid 54390] [client 40.115.124.4:10661] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac48itWWpaby3TVN7MfijgAAAcQ"]
[Thu Apr 02 17:53:14.538190 2026] [:error] [pid 37543:tid 37546] [client 40.115.124.4:5056] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac48inhdk2bEYJCvILa13QAAAUE"]
[Thu Apr 02 17:53:15.052790 2026] [:error] [pid 29467:tid 29483] [client 40.115.124.4:10627] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac48i74VUBFCJAq-WOka0wAAAQ0"]
[Thu Apr 02 17:53:15.553968 2026] [:error] [pid 23927:tid 23949] [client 40.115.124.4:10716] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac48i0sZwqCndhl9uKB3NQAAAZQ"]
[Thu Apr 02 17:53:16.057882 2026] [:error] [pid 54384:tid 54402] [client 40.115.124.4:10718] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48jNWWpaby3TVN7MfikwAAAdA"]
[Thu Apr 02 17:53:16.564700 2026] [:error] [pid 54384:tid 54409] [client 40.115.124.4:10664] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48jNWWpaby3TVN7MfilgAAAdc"]
[Thu Apr 02 17:53:17.094677 2026] [:error] [pid 23927:tid 23948] [client 40.115.124.4:10642] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48jUsZwqCndhl9uKB3OQAAAZM"]
[Thu Apr 02 17:53:17.600036 2026] [:error] [pid 59305:tid 59319] [client 40.115.124.4:5076] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac48jar2tV4rDwKFxKdAOwAAAMo"]
[Thu Apr 02 17:53:18.109845 2026] [:error] [pid 37543:tid 37568] [client 40.115.124.4:5114] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "ac48jnhdk2bEYJCvILa14QAAAVc"]
[Thu Apr 02 17:53:18.668186 2026] [:error] [pid 23927:tid 23947] [client 40.115.124.4:5111] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "ac48jksZwqCndhl9uKB3PQAAAZI"]
[Thu Apr 02 17:53:19.167028 2026] [:error] [pid 23927:tid 23951] [client 40.115.124.4:10731] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "ac48j0sZwqCndhl9uKB3QAAAAZY"]
[Thu Apr 02 17:53:19.669095 2026] [:error] [pid 23927:tid 23943] [client 40.115.124.4:5111] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "ac48j0sZwqCndhl9uKB3QwAAAY4"]
[Thu Apr 02 17:53:20.169434 2026] [:error] [pid 54384:tid 54398] [client 40.115.124.4:5099] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/export.php"] [unique_id "ac48kNWWpaby3TVN7MfimAAAAcw"]
[Thu Apr 02 17:53:20.671776 2026] [:error] [pid 59305:tid 59323] [client 40.115.124.4:5066] [client 40.115.124.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mmp.php"] [unique_id "ac48kKr2tV4rDwKFxKdASgAAAM4"]
[Thu Apr 02 17:53:21.181122 2026] [:error] [pid 59200:tid 59259] [client 40.115.124.4:5069] File does not exist: /usr/local/apache/htdocs/suspended-page/mmp.php
[Thu Apr 02 17:53:21.434930 2026] [:error] [pid 59200:tid 59244] [client 40.115.124.4:5069] File does not exist: /usr/local/apache/htdocs/suspended-page/rrr.php
[Thu Apr 02 17:53:21.715279 2026] [:error] [pid 59200:tid 59247] [client 40.115.124.4:5069] File does not exist: /usr/local/apache/htdocs/suspended-page/un.php
[Thu Apr 02 17:53:21.968146 2026] [:error] [pid 59200:tid 59245] [client 40.115.124.4:5069] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Thu Apr 02 17:53:22.220922 2026] [:error] [pid 59200:tid 59256] [client 40.115.124.4:5069] File does not exist: /usr/local/apache/htdocs/suspended-page/ianmg.php
[Thu Apr 02 17:53:22.474313 2026] [:error] [pid 59200:tid 59257] [client 40.115.124.4:5069] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Thu Apr 02 19:19:52.810116 2026] [:error] [pid 29467:tid 29480] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Thu Apr 02 19:19:53.070449 2026] [:error] [pid 29467:tid 29491] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Thu Apr 02 19:19:53.348882 2026] [:error] [pid 29467:tid 29492] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Thu Apr 02 19:19:54.896577 2026] [:error] [pid 29467:tid 29492] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Thu Apr 02 19:19:55.154777 2026] [:error] [pid 29467:tid 29482] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 02 19:19:55.561850 2026] [:error] [pid 29467:tid 29476] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Thu Apr 02 19:19:55.895778 2026] [:error] [pid 29467:tid 29477] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Thu Apr 02 19:19:56.179049 2026] [:error] [pid 29467:tid 29484] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Thu Apr 02 19:19:56.435810 2026] [:error] [pid 29467:tid 29476] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Thu Apr 02 19:19:56.713918 2026] [:error] [pid 29467:tid 29486] [client 20.250.17.247:60078] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Thu Apr 02 19:19:57.122007 2026] [:error] [pid 29467:tid 29493] [client 20.250.17.247:60078] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "ac5Q3b4VUBFCJAq-WOljvAAAARc"]
[Thu Apr 02 19:19:59.120522 2026] [:error] [pid 59305:tid 59327] [client 20.250.17.247:29196] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "ac5Q36r2tV4rDwKFxKd0wwAAANI"]
[Thu Apr 02 19:19:59.937181 2026] [:error] [pid 59305:tid 59324] [client 20.250.17.247:16459] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "ac5Q36r2tV4rDwKFxKd0zQAAAM8"]
[Thu Apr 02 19:20:00.773569 2026] [:error] [pid 59305:tid 59330] [client 20.250.17.247:17980] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "ac5Q4Kr2tV4rDwKFxKd00gAAANU"]
[Thu Apr 02 19:20:02.298123 2026] [:error] [pid 59200:tid 59264] [client 20.250.17.247:31339] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "ac5Q4rfP26txrdLs3EptLAAAAFg"]
[Thu Apr 02 19:20:03.152910 2026] [:error] [pid 23927:tid 23937] [client 20.250.17.247:29799] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "ac5Q40sZwqCndhl9uKCgOgAAAYg"]
[Thu Apr 02 19:20:04.991897 2026] [:error] [pid 23927:tid 23950] [client 20.250.17.247:51768] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "ac5Q5EsZwqCndhl9uKCgQwAAAZU"]
[Thu Apr 02 19:20:05.738584 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:25158] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "ac5Q5dWWpaby3TVN7McEAgAAAcM"]
[Thu Apr 02 19:20:06.524686 2026] [:error] [pid 59305:tid 59315] [client 20.250.17.247:29221] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "ac5Q5qr2tV4rDwKFxKd04QAAAMY"]
[Thu Apr 02 19:20:07.193498 2026] [:error] [pid 54384:tid 54408] [client 20.250.17.247:19516] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "ac5Q59WWpaby3TVN7McEBgAAAdY"]
[Thu Apr 02 19:20:08.122902 2026] [:error] [pid 29467:tid 29491] [client 20.250.17.247:29816] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "ac5Q6L4VUBFCJAq-WOljxAAAARU"]
[Thu Apr 02 19:20:08.994941 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:31341] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "ac5Q6NWWpaby3TVN7McEDQAAAcM"]
[Thu Apr 02 19:20:09.874575 2026] [:error] [pid 59305:tid 59315] [client 20.250.17.247:43143] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "ac5Q6ar2tV4rDwKFxKd08AAAAMY"]
[Thu Apr 02 19:20:11.118221 2026] [:error] [pid 59194:tid 59234] [client 20.250.17.247:29784] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "ac5Q6xMpAeV11hcQehw-rQAAABU"]
[Thu Apr 02 19:20:12.479994 2026] [:error] [pid 59305:tid 59314] [client 20.250.17.247:19504] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "ac5Q7Kr2tV4rDwKFxKd0_wAAAMU"]
[Thu Apr 02 19:20:13.423953 2026] [:error] [pid 54384:tid 54410] [client 20.250.17.247:15987] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "ac5Q7dWWpaby3TVN7McEEwAAAdg"]
[Thu Apr 02 19:20:15.150624 2026] [:error] [pid 59305:tid 59313] [client 20.250.17.247:31312] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "ac5Q76r2tV4rDwKFxKd1EAAAAMQ"]
[Thu Apr 02 19:20:16.628370 2026] [:error] [pid 23927:tid 23945] [client 20.250.17.247:25156] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "ac5Q8EsZwqCndhl9uKCgVwAAAZA"]
[Thu Apr 02 19:20:17.358076 2026] [:error] [pid 59305:tid 59309] [client 20.250.17.247:50086] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "ac5Q8ar2tV4rDwKFxKd1JgAAAMA"]
[Thu Apr 02 19:20:18.319594 2026] [:error] [pid 54384:tid 54398] [client 20.250.17.247:16495] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "ac5Q8tWWpaby3TVN7McEGQAAAcw"]
[Thu Apr 02 19:20:19.044692 2026] [:error] [pid 59201:tid 59273] [client 20.250.17.247:48161] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "ac5Q88AC0Tw8eL6gzZ4TCgAAAIY"]
[Thu Apr 02 19:20:20.227126 2026] [:error] [pid 23927:tid 23932] [client 20.250.17.247:29205] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "ac5Q9EsZwqCndhl9uKCgXAAAAYM"]
[Thu Apr 02 19:20:21.441799 2026] [:error] [pid 29467:tid 29491] [client 20.250.17.247:38204] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "ac5Q9b4VUBFCJAq-WOlj7QAAARU"]
[Thu Apr 02 19:20:23.076183 2026] [:error] [pid 29467:tid 29487] [client 20.250.17.247:28791] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "ac5Q974VUBFCJAq-WOlj9QAAARE"]
[Thu Apr 02 19:20:24.060573 2026] [:error] [pid 23927:tid 23938] [client 20.250.17.247:28772] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "ac5Q-EsZwqCndhl9uKCgZQAAAYk"]
[Thu Apr 02 19:20:25.046473 2026] [:error] [pid 59200:tid 59248] [client 20.250.17.247:29794] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "ac5Q-bfP26txrdLs3EptOQAAAEg"]
[Thu Apr 02 19:20:26.078701 2026] [:error] [pid 29467:tid 29493] [client 20.250.17.247:48234] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "ac5Q-r4VUBFCJAq-WOlj_AAAARc"]
[Thu Apr 02 19:20:27.302614 2026] [:error] [pid 59305:tid 59310] [client 20.250.17.247:28764] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "ac5Q-6r2tV4rDwKFxKd1PQAAAME"]
[Thu Apr 02 19:20:28.387334 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:16467] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac5Q_NWWpaby3TVN7McEIQAAAcM"]
[Thu Apr 02 19:20:30.030338 2026] [:error] [pid 29467:tid 29492] [client 20.250.17.247:31321] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac5Q_r4VUBFCJAq-WOlkDwAAARY"]
[Thu Apr 02 19:20:30.907747 2026] [:error] [pid 59194:tid 59226] [client 20.250.17.247:17946] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac5Q_hMpAeV11hcQehw-wQAAAA0"]
[Thu Apr 02 19:20:31.954560 2026] [:error] [pid 29467:tid 29486] [client 20.250.17.247:31297] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "ac5Q_74VUBFCJAq-WOlkJAAAARA"]
[Thu Apr 02 19:20:32.937348 2026] [:error] [pid 29467:tid 29487] [client 20.250.17.247:48160] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file31.php"] [unique_id "ac5RAL4VUBFCJAq-WOlkLgAAARE"]
[Thu Apr 02 19:20:34.269349 2026] [:error] [pid 59201:tid 59291] [client 20.250.17.247:38185] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file31.php"] [unique_id "ac5RAsAC0Tw8eL6gzZ4TEgAAAJg"]
[Thu Apr 02 19:20:35.347974 2026] [:error] [pid 59201:tid 59284] [client 20.250.17.247:43242] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file31.php"] [unique_id "ac5RA8AC0Tw8eL6gzZ4TFwAAAJE"]
[Thu Apr 02 19:20:36.449826 2026] [:error] [pid 59305:tid 59314] [client 20.250.17.247:50082] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file31.php"] [unique_id "ac5RBKr2tV4rDwKFxKd1XQAAAMU"]
[Thu Apr 02 19:20:38.150599 2026] [:error] [pid 54384:tid 54392] [client 20.250.17.247:28760] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "ac5RBtWWpaby3TVN7McEMAAAAcY"]
[Thu Apr 02 19:20:39.311360 2026] [:error] [pid 59201:tid 59279] [client 20.250.17.247:48198] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "ac5RB8AC0Tw8eL6gzZ4TIQAAAIw"]
[Thu Apr 02 19:20:40.346118 2026] [:error] [pid 59194:tid 59226] [client 20.250.17.247:26169] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "ac5RCBMpAeV11hcQehw-ywAAAA0"]
[Thu Apr 02 19:20:41.475625 2026] [:error] [pid 59201:tid 59267] [client 20.250.17.247:34762] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "ac5RCcAC0Tw8eL6gzZ4TKQAAAIA"]
[Thu Apr 02 19:20:42.400400 2026] [:error] [pid 37543:tid 37553] [client 20.250.17.247:43173] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/control.php"] [unique_id "ac5RCnhdk2bEYJCvILbRdAAAAUg"]
[Thu Apr 02 19:20:43.145801 2026] [:error] [pid 59305:tid 59309] [client 20.250.17.247:34798] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/control.php"] [unique_id "ac5RC6r2tV4rDwKFxKd1bwAAAMA"]
[Thu Apr 02 19:20:44.020979 2026] [:error] [pid 29467:tid 29482] [client 20.250.17.247:34802] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/control.php"] [unique_id "ac5RDL4VUBFCJAq-WOlkQAAAAQw"]
[Thu Apr 02 19:20:44.919087 2026] [:error] [pid 59194:tid 59235] [client 20.250.17.247:24664] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/control.php"] [unique_id "ac5RDBMpAeV11hcQehw-zgAAABY"]
[Thu Apr 02 19:20:45.930521 2026] [:error] [pid 54384:tid 54409] [client 20.250.17.247:25173] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "ac5RDdWWpaby3TVN7McEOQAAAdc"]
[Thu Apr 02 19:20:46.567475 2026] [:error] [pid 59201:tid 59283] [client 20.250.17.247:38153] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "ac5RDsAC0Tw8eL6gzZ4TLgAAAJA"]
[Thu Apr 02 19:20:47.502624 2026] [:error] [pid 54384:tid 54406] [client 20.250.17.247:43219] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "ac5RD9WWpaby3TVN7McEPgAAAdQ"]
[Thu Apr 02 19:20:48.156003 2026] [:error] [pid 59194:tid 59220] [client 20.250.17.247:17970] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "ac5REBMpAeV11hcQehw-0wAAAAc"]
[Thu Apr 02 19:20:48.816990 2026] [:error] [pid 37543:tid 37567] [client 20.250.17.247:43232] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1111.php"] [unique_id "ac5REHhdk2bEYJCvILbRewAAAVY"]
[Thu Apr 02 19:20:49.803466 2026] [:error] [pid 54384:tid 54405] [client 20.250.17.247:58537] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1111.php"] [unique_id "ac5REdWWpaby3TVN7McERAAAAdM"]
[Thu Apr 02 19:20:51.312311 2026] [:error] [pid 23927:tid 23933] [client 20.250.17.247:25153] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1111.php"] [unique_id "ac5RE0sZwqCndhl9uKCgewAAAYQ"]
[Thu Apr 02 19:20:53.311733 2026] [:error] [pid 59200:tid 59259] [client 20.250.17.247:62143] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1111.php"] [unique_id "ac5RFbfP26txrdLs3EptVAAAAFM"]
[Thu Apr 02 19:20:54.867571 2026] [:error] [pid 59194:tid 59215] [client 20.250.17.247:31353] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "ac5RFhMpAeV11hcQehw-4gAAAAI"]
[Thu Apr 02 19:20:57.294786 2026] [:error] [pid 37543:tid 37559] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/fetch.php
[Thu Apr 02 19:20:57.601948 2026] [:error] [pid 37543:tid 37546] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Thu Apr 02 19:20:57.992140 2026] [:error] [pid 37543:tid 37546] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Thu Apr 02 19:20:58.229419 2026] [:error] [pid 37543:tid 37549] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Thu Apr 02 19:20:58.494314 2026] [:error] [pid 37543:tid 37557] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Thu Apr 02 19:20:58.819835 2026] [:error] [pid 37543:tid 37551] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Thu Apr 02 19:20:59.169372 2026] [:error] [pid 37543:tid 37547] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 02 19:20:59.527016 2026] [:error] [pid 37543:tid 37567] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Thu Apr 02 19:20:59.763922 2026] [:error] [pid 37543:tid 37566] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Thu Apr 02 19:21:00.000809 2026] [:error] [pid 37543:tid 37560] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/zample.php
[Thu Apr 02 19:21:00.241124 2026] [:error] [pid 37543:tid 37568] [client 20.250.17.247:19578] File does not exist: /usr/local/apache/htdocs/suspended-page/read.php
[Thu Apr 02 19:21:00.512424 2026] [:error] [pid 37543:tid 37564] [client 20.250.17.247:19578] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ac5RHHhdk2bEYJCvILbRjwAAAVM"]
[Thu Apr 02 19:21:01.216382 2026] [:error] [pid 23927:tid 23941] [client 20.250.17.247:15944] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ac5RHUsZwqCndhl9uKCgjAAAAYw"]
[Thu Apr 02 19:21:02.509444 2026] [:error] [pid 23927:tid 23936] [client 20.250.17.247:58529] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ac5RHksZwqCndhl9uKCglwAAAYc"]
[Thu Apr 02 19:21:03.530104 2026] [:error] [pid 59305:tid 59323] [client 20.250.17.247:43251] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ac5RH6r2tV4rDwKFxKd1mQAAAM4"]
[Thu Apr 02 19:21:04.356869 2026] [:error] [pid 59194:tid 59234] [client 20.250.17.247:17948] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "ac5RIBMpAeV11hcQehw-6QAAABU"]
[Thu Apr 02 19:21:05.426054 2026] [:error] [pid 23927:tid 23947] [client 20.250.17.247:43210] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "ac5RIUsZwqCndhl9uKCgnAAAAZI"]
[Thu Apr 02 19:21:06.325065 2026] [:error] [pid 59305:tid 59325] [client 20.250.17.247:58519] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "ac5RIqr2tV4rDwKFxKd1pAAAANA"]
[Thu Apr 02 19:21:07.633056 2026] [:error] [pid 37543:tid 37557] [client 20.250.17.247:43233] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "ac5RI3hdk2bEYJCvILbRlgAAAUw"]
[Thu Apr 02 19:21:09.011576 2026] [:error] [pid 29467:tid 29490] [client 20.250.17.247:40042] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "ac5RJb4VUBFCJAq-WOlkZQAAARQ"]
[Thu Apr 02 19:21:09.908580 2026] [:error] [pid 59201:tid 59283] [client 20.250.17.247:28792] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "ac5RJcAC0Tw8eL6gzZ4TRAAAAJA"]
[Thu Apr 02 19:21:11.446836 2026] [:error] [pid 37543:tid 37558] [client 20.250.17.247:48202] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "ac5RJ3hdk2bEYJCvILbRnAAAAU0"]
[Thu Apr 02 19:21:12.349839 2026] [:error] [pid 59305:tid 59327] [client 20.250.17.247:58497] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "ac5RKKr2tV4rDwKFxKd1tAAAANI"]
[Thu Apr 02 19:21:13.097377 2026] [:error] [pid 54384:tid 54403] [client 20.250.17.247:62113] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ac5RKdWWpaby3TVN7McEVwAAAdE"]
[Thu Apr 02 19:21:13.900901 2026] [:error] [pid 37543:tid 37560] [client 20.250.17.247:31322] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ac5RKXhdk2bEYJCvILbRpQAAAU8"]
[Thu Apr 02 19:21:14.785347 2026] [:error] [pid 59305:tid 59312] [client 20.250.17.247:43226] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ac5RKqr2tV4rDwKFxKd1uAAAAMM"]
[Thu Apr 02 19:21:16.045946 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:50104] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "ac5RLNWWpaby3TVN7McEWwAAAcM"]
[Thu Apr 02 19:21:16.876503 2026] [:error] [pid 23927:tid 23935] [client 20.250.17.247:28758] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ac5RLEsZwqCndhl9uKCgrgAAAYY"]
[Thu Apr 02 19:21:17.885506 2026] [:error] [pid 59201:tid 59273] [client 20.250.17.247:29809] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ac5RLcAC0Tw8eL6gzZ4TTwAAAIY"]
[Thu Apr 02 19:21:19.367309 2026] [:error] [pid 23927:tid 23933] [client 20.250.17.247:31345] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ac5RL0sZwqCndhl9uKCgsAAAAYQ"]
[Thu Apr 02 19:21:21.086366 2026] [:error] [pid 54384:tid 54402] [client 20.250.17.247:15984] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "ac5RMdWWpaby3TVN7McEaQAAAdA"]
[Thu Apr 02 19:21:22.116489 2026] [:error] [pid 23927:tid 23951] [client 20.250.17.247:48173] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "ac5RMksZwqCndhl9uKCgtQAAAZY"]
[Thu Apr 02 19:21:23.144892 2026] [:error] [pid 29467:tid 29482] [client 20.250.17.247:15942] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "ac5RM74VUBFCJAq-WOlkmQAAAQw"]
[Thu Apr 02 19:21:23.798308 2026] [:error] [pid 54384:tid 54390] [client 20.250.17.247:31319] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "ac5RM9WWpaby3TVN7McEcwAAAcQ"]
[Thu Apr 02 19:21:26.388749 2026] [:error] [pid 29467:tid 29482] [client 20.250.17.247:17959] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "ac5RNr4VUBFCJAq-WOlkpQAAAQw"]
[Thu Apr 02 19:21:27.567480 2026] [:error] [pid 29467:tid 29492] [client 20.250.17.247:17932] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac5RN74VUBFCJAq-WOlkqgAAARY"]
[Thu Apr 02 19:21:29.481052 2026] [:error] [pid 59305:tid 59317] [client 20.250.17.247:24674] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac5ROar2tV4rDwKFxKd2EgAAAMg"]
[Thu Apr 02 19:21:31.169434 2026] [:error] [pid 59305:tid 59317] [client 20.250.17.247:28707] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac5RO6r2tV4rDwKFxKd2IgAAAMg"]
[Thu Apr 02 19:21:31.886607 2026] [:error] [pid 59305:tid 59329] [client 20.250.17.247:28699] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "ac5RO6r2tV4rDwKFxKd2KwAAANQ"]
[Thu Apr 02 19:21:32.625831 2026] [:error] [pid 59305:tid 59315] [client 20.250.17.247:30209] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ac5RPKr2tV4rDwKFxKd2LwAAAMY"]
[Thu Apr 02 19:21:33.463813 2026] [:error] [pid 29467:tid 29478] [client 20.250.17.247:24126] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ac5RPb4VUBFCJAq-WOlkvAAAAQg"]
[Thu Apr 02 19:21:34.611255 2026] [:error] [pid 23927:tid 23931] [client 20.250.17.247:46226] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ac5RPksZwqCndhl9uKCgxQAAAYI"]
[Thu Apr 02 19:21:35.676223 2026] [:error] [pid 23927:tid 23930] [client 20.250.17.247:24603] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "ac5RP0sZwqCndhl9uKCgyQAAAYE"]
[Thu Apr 02 19:21:36.218055 2026] [:error] [pid 23927:tid 23943] [client 20.250.17.247:24191] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5RQEsZwqCndhl9uKCgzQAAAY4"]
[Thu Apr 02 19:21:36.971285 2026] [:error] [pid 59305:tid 59327] [client 20.250.17.247:54335] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5RQKr2tV4rDwKFxKd2TwAAANI"]
[Thu Apr 02 19:21:37.580955 2026] [:error] [pid 59194:tid 59230] [client 20.250.17.247:20002] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5RQRMpAeV11hcQehw-_QAAABE"]
[Thu Apr 02 19:21:38.133742 2026] [:error] [pid 59200:tid 59246] [client 20.250.17.247:24618] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5RQrfP26txrdLs3EptcgAAAEY"]
[Thu Apr 02 19:21:39.032792 2026] [:error] [pid 59201:tid 59270] [client 20.250.17.247:19970] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "ac5RQ8AC0Tw8eL6gzZ4TXAAAAIM"]
[Thu Apr 02 19:21:39.620422 2026] [:error] [pid 29467:tid 29470] [client 20.250.17.247:39308] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "ac5RQ74VUBFCJAq-WOlkzAAAAQA"]
[Thu Apr 02 19:21:40.652249 2026] [:error] [pid 23927:tid 23940] [client 20.250.17.247:24187] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "ac5RREsZwqCndhl9uKCg3gAAAYs"]
[Thu Apr 02 19:21:41.374786 2026] [:error] [pid 29467:tid 29471] [client 20.250.17.247:50757] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "ac5RRb4VUBFCJAq-WOlk0AAAAQE"]
[Thu Apr 02 19:21:42.411410 2026] [:error] [pid 37543:tid 37552] [client 20.250.17.247:24186] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac5RRnhdk2bEYJCvILbRvgAAAUc"]
[Thu Apr 02 19:21:43.140951 2026] [:error] [pid 29467:tid 29493] [client 20.250.17.247:5551] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac5RR74VUBFCJAq-WOlk0gAAARc"]
[Thu Apr 02 19:21:43.851175 2026] [:error] [pid 59194:tid 59237] [client 20.250.17.247:20007] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac5RRxMpAeV11hcQehw_AAAAABg"]
[Thu Apr 02 19:21:44.802086 2026] [:error] [pid 59201:tid 59278] [client 20.250.17.247:48789] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac5RSMAC0Tw8eL6gzZ4TXwAAAIs"]
[Thu Apr 02 19:21:45.594491 2026] [:error] [pid 54384:tid 54403] [client 20.250.17.247:46212] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac5RSdWWpaby3TVN7McE0gAAAdE"]
[Thu Apr 02 19:21:46.452186 2026] [:error] [pid 29467:tid 29475] [client 20.250.17.247:46238] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac5RSr4VUBFCJAq-WOlk2AAAAQU"]
[Thu Apr 02 19:21:47.120753 2026] [:error] [pid 59194:tid 59218] [client 20.250.17.247:46237] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac5RSxMpAeV11hcQehw_CAAAAAU"]
[Thu Apr 02 19:21:47.808419 2026] [:error] [pid 59201:tid 59271] [client 20.250.17.247:24584] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "ac5RS8AC0Tw8eL6gzZ4TYwAAAIQ"]
[Thu Apr 02 19:21:48.538980 2026] [:error] [pid 37543:tid 37549] [client 20.250.17.247:24090] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "ac5RTHhdk2bEYJCvILbRxwAAAUQ"]
[Thu Apr 02 19:21:51.355004 2026] [:error] [pid 54384:tid 54388] [client 20.250.17.247:24098] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "ac5RT9WWpaby3TVN7McE3gAAAcI"]
[Thu Apr 02 19:21:52.124071 2026] [:error] [pid 54384:tid 54403] [client 20.250.17.247:51788] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "ac5RUNWWpaby3TVN7McE4gAAAdE"]
[Thu Apr 02 19:21:52.876429 2026] [:error] [pid 59194:tid 59228] [client 20.250.17.247:48791] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eee.php"] [unique_id "ac5RUBMpAeV11hcQehw_DgAAAA8"]
[Thu Apr 02 19:21:53.772769 2026] [:error] [pid 59194:tid 59235] [client 20.250.17.247:50763] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "ac5RURMpAeV11hcQehw_EAAAABY"]
[Thu Apr 02 19:21:54.548170 2026] [:error] [pid 59305:tid 59327] [client 20.250.17.247:24130] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "ac5RUqr2tV4rDwKFxKd2YQAAANI"]
[Thu Apr 02 19:21:55.416834 2026] [:error] [pid 29467:tid 29494] [client 20.250.17.247:5531] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "ac5RU74VUBFCJAq-WOlk7wAAARg"]
[Thu Apr 02 19:21:56.104712 2026] [:error] [pid 29467:tid 29479] [client 20.250.17.247:16963] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "ac5RVL4VUBFCJAq-WOlk9gAAAQk"]
[Thu Apr 02 19:21:56.966037 2026] [:error] [pid 29467:tid 29477] [client 20.250.17.247:39336] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "ac5RVL4VUBFCJAq-WOlk-gAAAQc"]
[Thu Apr 02 19:21:57.736866 2026] [:error] [pid 29467:tid 29483] [client 20.250.17.247:48830] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "ac5RVb4VUBFCJAq-WOllAAAAAQ0"]
[Thu Apr 02 19:21:58.836841 2026] [:error] [pid 59200:tid 59244] [client 20.250.17.247:39334] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "ac5RVrfP26txrdLs3EpthgAAAEQ"]
[Thu Apr 02 19:21:59.779279 2026] [:error] [pid 59200:tid 59263] [client 20.250.17.247:37697] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "ac5RV7fP26txrdLs3EpthwAAAFc"]
[Thu Apr 02 19:22:00.399647 2026] [:error] [pid 54384:tid 54400] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/swallowable.php
[Thu Apr 02 19:22:00.671015 2026] [:error] [pid 54384:tid 54390] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Thu Apr 02 19:22:01.233125 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Thu Apr 02 19:22:01.944362 2026] [:error] [pid 54384:tid 54387] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Thu Apr 02 19:22:02.294764 2026] [:error] [pid 54384:tid 54409] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 02 19:22:02.598617 2026] [:error] [pid 54384:tid 54406] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 02 19:22:03.112349 2026] [:error] [pid 54384:tid 54386] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Apr 02 19:22:03.406480 2026] [:error] [pid 54384:tid 54398] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Thu Apr 02 19:22:03.642811 2026] [:error] [pid 54384:tid 54408] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Thu Apr 02 19:22:03.881092 2026] [:error] [pid 54384:tid 54396] [client 20.250.17.247:24124] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Thu Apr 02 19:22:04.155082 2026] [:error] [pid 54384:tid 54391] [client 20.250.17.247:24124] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "ac5RXNWWpaby3TVN7McFAAAAAcU"]
[Thu Apr 02 19:22:05.021919 2026] [:error] [pid 59200:tid 59254] [client 20.250.17.247:32314] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "ac5RXbfP26txrdLs3EptjwAAAE4"]
[Thu Apr 02 19:22:05.589713 2026] [:error] [pid 37543:tid 37563] [client 20.250.17.247:17022] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "ac5RXXhdk2bEYJCvILbR4wAAAVI"]
[Thu Apr 02 19:22:06.560709 2026] [:error] [pid 29467:tid 29479] [client 20.250.17.247:40582] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "ac5RXr4VUBFCJAq-WOllFwAAAQk"]
[Thu Apr 02 19:22:07.688851 2026] [:error] [pid 29467:tid 29472] [client 20.250.17.247:17014] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "ac5RX74VUBFCJAq-WOllGgAAAQI"]
[Thu Apr 02 19:22:08.743115 2026] [:error] [pid 59305:tid 59333] [client 20.250.17.247:36832] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "ac5RYKr2tV4rDwKFxKd2egAAANg"]
[Thu Apr 02 19:22:09.471134 2026] [:error] [pid 59305:tid 59314] [client 20.250.17.247:39330] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "ac5RYar2tV4rDwKFxKd2fAAAAMU"]
[Thu Apr 02 19:22:10.410590 2026] [:error] [pid 29467:tid 29494] [client 20.250.17.247:36829] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "ac5RYr4VUBFCJAq-WOllKAAAARg"]
[Thu Apr 02 19:22:11.072660 2026] [:error] [pid 29467:tid 29481] [client 20.250.17.247:32319] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "ac5RY74VUBFCJAq-WOllLgAAAQs"]
[Thu Apr 02 19:22:11.674594 2026] [:error] [pid 23927:tid 23947] [client 20.250.17.247:24149] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "ac5RY0sZwqCndhl9uKCg-wAAAZI"]
[Thu Apr 02 19:22:12.391908 2026] [:error] [pid 59200:tid 59242] [client 20.250.17.247:51809] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "ac5RZLfP26txrdLs3EptlAAAAEI"]
[Thu Apr 02 19:22:13.179533 2026] [:error] [pid 54384:tid 54405] [client 20.250.17.247:37729] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "ac5RZdWWpaby3TVN7McFCAAAAdM"]
[Thu Apr 02 19:22:13.797098 2026] [:error] [pid 54384:tid 54393] [client 20.250.17.247:15379] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac5RZdWWpaby3TVN7McFCgAAAcc"]
[Thu Apr 02 19:22:14.472424 2026] [:error] [pid 59305:tid 59319] [client 20.250.17.247:39326] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac5RZqr2tV4rDwKFxKd2igAAAMo"]
[Thu Apr 02 19:22:15.165978 2026] [:error] [pid 59201:tid 59271] [client 20.250.17.247:24065] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac5RZ8AC0Tw8eL6gzZ4TcwAAAIQ"]
[Thu Apr 02 19:22:15.738217 2026] [:error] [pid 29467:tid 29486] [client 20.250.17.247:36801] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac5RZ74VUBFCJAq-WOllOAAAARA"]
[Thu Apr 02 19:22:16.402101 2026] [:error] [pid 59305:tid 59323] [client 20.250.17.247:51796] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ac5RaKr2tV4rDwKFxKd2kQAAAM4"]
[Thu Apr 02 19:22:17.006858 2026] [:error] [pid 59305:tid 59318] [client 20.250.17.247:54274] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ac5Raar2tV4rDwKFxKd2lAAAAMk"]
[Thu Apr 02 19:22:17.523305 2026] [:error] [pid 23927:tid 23947] [client 20.250.17.247:36831] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ac5RaUsZwqCndhl9uKChBAAAAZI"]
[Thu Apr 02 19:22:18.283258 2026] [:error] [pid 59305:tid 59317] [client 20.250.17.247:36857] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "ac5Raqr2tV4rDwKFxKd2mgAAAMg"]
[Thu Apr 02 19:22:18.973393 2026] [:error] [pid 59200:tid 59252] [client 20.250.17.247:19020] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ac5RarfP26txrdLs3EptmgAAAEw"]
[Thu Apr 02 19:22:19.676856 2026] [:error] [pid 59305:tid 59314] [client 20.250.17.247:51822] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ac5Ra6r2tV4rDwKFxKd2oAAAAMU"]
[Thu Apr 02 19:22:20.370054 2026] [:error] [pid 59305:tid 59309] [client 20.250.17.247:32282] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ac5RbKr2tV4rDwKFxKd2owAAAMA"]
[Thu Apr 02 19:22:21.009911 2026] [:error] [pid 59194:tid 59217] [client 20.250.17.247:20008] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ac5RbRMpAeV11hcQehw_FwAAAAQ"]
[Thu Apr 02 19:22:21.835639 2026] [:error] [pid 59305:tid 59321] [client 20.250.17.247:24100] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "ac5Rbar2tV4rDwKFxKd2qgAAAMw"]
[Thu Apr 02 19:22:22.690599 2026] [:error] [pid 59200:tid 59259] [client 20.250.17.247:20008] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "ac5RbrfP26txrdLs3EptoAAAAFM"]
[Thu Apr 02 19:22:23.323197 2026] [:error] [pid 59201:tid 59279] [client 20.250.17.247:51807] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "ac5Rb8AC0Tw8eL6gzZ4TgwAAAIw"]
[Thu Apr 02 19:22:24.067646 2026] [:error] [pid 59305:tid 59311] [client 20.250.17.247:51810] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "ac5RcKr2tV4rDwKFxKd2sAAAAMI"]
[Thu Apr 02 19:22:24.857494 2026] [:error] [pid 23927:tid 23935] [client 20.250.17.247:20010] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac5RcEsZwqCndhl9uKChDQAAAYY"]
[Thu Apr 02 19:22:25.845573 2026] [:error] [pid 29467:tid 29472] [client 20.250.17.247:24081] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac5Rcb4VUBFCJAq-WOllPAAAAQI"]
[Thu Apr 02 19:22:26.535373 2026] [:error] [pid 23927:tid 23939] [client 20.250.17.247:48768] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac5RcksZwqCndhl9uKChEwAAAYo"]
[Thu Apr 02 19:22:27.241995 2026] [:error] [pid 37543:tid 37562] [client 20.250.17.247:48795] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "ac5Rc3hdk2bEYJCvILbR8QAAAVE"]
[Thu Apr 02 19:22:28.340035 2026] [:error] [pid 29467:tid 29489] [client 20.250.17.247:37714] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "ac5RdL4VUBFCJAq-WOllSgAAARM"]
[Thu Apr 02 19:22:28.899409 2026] [:error] [pid 23927:tid 23934] [client 20.250.17.247:24135] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "ac5RdEsZwqCndhl9uKChGQAAAYU"]
[Thu Apr 02 19:22:29.972416 2026] [:error] [pid 54384:tid 54397] [client 20.250.17.247:24622] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "ac5RddWWpaby3TVN7McFGgAAAcs"]
[Thu Apr 02 19:22:30.540360 2026] [:error] [pid 59201:tid 59275] [client 20.250.17.247:15383] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "ac5RdsAC0Tw8eL6gzZ4TjAAAAIg"]
[Thu Apr 02 19:22:32.011128 2026] [:error] [pid 23927:tid 23946] [client 20.250.17.247:15400] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "ac5ReEsZwqCndhl9uKChMAAAAZE"]
[Thu Apr 02 19:22:32.790357 2026] [:error] [pid 23927:tid 23942] [client 20.250.17.247:19016] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "ac5ReEsZwqCndhl9uKChOAAAAY0"]
[Thu Apr 02 19:22:33.600333 2026] [:error] [pid 59194:tid 59226] [client 20.250.17.247:5521] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "ac5ReRMpAeV11hcQehw_HQAAAA0"]
[Thu Apr 02 19:22:34.482724 2026] [:error] [pid 59201:tid 59267] [client 20.250.17.247:36820] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "ac5ResAC0Tw8eL6gzZ4TkQAAAIA"]
[Thu Apr 02 19:22:35.152448 2026] [:error] [pid 59305:tid 59313] [client 20.250.17.247:19997] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ac5Re6r2tV4rDwKFxKd2uwAAAMQ"]
[Thu Apr 02 19:22:36.249121 2026] [:error] [pid 29467:tid 29471] [client 20.250.17.247:16984] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ac5RfL4VUBFCJAq-WOllVwAAAQE"]
[Thu Apr 02 19:22:37.275655 2026] [:error] [pid 54384:tid 54387] [client 20.250.17.247:37754] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ac5RfdWWpaby3TVN7McFLgAAAcE"]
[Thu Apr 02 19:22:39.309551 2026] [:error] [pid 29467:tid 29493] [client 20.250.17.247:39312] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "ac5Rf74VUBFCJAq-WOllZQAAARc"]
[Thu Apr 02 19:22:40.186937 2026] [:error] [pid 29467:tid 29482] [client 20.250.17.247:19029] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac5RgL4VUBFCJAq-WOllagAAAQw"]
[Thu Apr 02 19:22:41.261209 2026] [:error] [pid 23927:tid 23953] [client 20.250.17.247:24083] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac5RgUsZwqCndhl9uKChRgAAAZg"]
[Thu Apr 02 19:22:42.033955 2026] [:error] [pid 29467:tid 29494] [client 20.250.17.247:19067] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac5Rgr4VUBFCJAq-WOlldgAAARg"]
[Thu Apr 02 19:22:42.750875 2026] [:error] [pid 54384:tid 54406] [client 20.250.17.247:32291] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac5RgtWWpaby3TVN7McFNgAAAdQ"]
[Thu Apr 02 19:22:43.873965 2026] [:error] [pid 23927:tid 23946] [client 20.250.17.247:5526] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ac5Rg0sZwqCndhl9uKChTQAAAZE"]
[Thu Apr 02 19:22:45.621923 2026] [:error] [pid 29467:tid 29486] [client 20.250.17.247:19046] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ac5Rhb4VUBFCJAq-WOllgAAAARA"]
[Thu Apr 02 19:22:47.146659 2026] [:error] [pid 29467:tid 29479] [client 20.250.17.247:46248] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ac5Rh74VUBFCJAq-WOlligAAAQk"]
[Thu Apr 02 19:22:47.748516 2026] [:error] [pid 29467:tid 29491] [client 20.250.17.247:48776] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ac5Rh74VUBFCJAq-WOllkQAAARU"]
[Thu Apr 02 19:22:48.742302 2026] [:error] [pid 23927:tid 23953] [client 20.250.17.247:39308] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ac5RiEsZwqCndhl9uKChUAAAAZg"]
[Thu Apr 02 19:22:49.482176 2026] [:error] [pid 29467:tid 29491] [client 20.250.17.247:16979] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ac5Rib4VUBFCJAq-WOllnAAAARU"]
[Thu Apr 02 19:22:50.341781 2026] [:error] [pid 29467:tid 29473] [client 20.250.17.247:24161] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ac5Rir4VUBFCJAq-WOllpwAAAQM"]
[Thu Apr 02 19:22:51.138776 2026] [:error] [pid 29467:tid 29479] [client 20.250.17.247:24132] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ac5Ri74VUBFCJAq-WOllrQAAAQk"]
[Thu Apr 02 19:22:51.810585 2026] [:error] [pid 29467:tid 29490] [client 20.250.17.247:5884] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ac5Ri74VUBFCJAq-WOllsgAAARQ"]
[Thu Apr 02 19:22:52.563762 2026] [:error] [pid 29467:tid 29476] [client 20.250.17.247:20016] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ac5RjL4VUBFCJAq-WOlltgAAAQY"]
[Thu Apr 02 19:22:53.167716 2026] [:error] [pid 23927:tid 23948] [client 20.250.17.247:36858] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ac5RjUsZwqCndhl9uKChVwAAAZM"]
[Thu Apr 02 19:22:53.842932 2026] [:error] [pid 37543:tid 37545] [client 20.250.17.247:51819] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "ac5RjXhdk2bEYJCvILbSAAAAAUA"]
[Thu Apr 02 19:22:54.451356 2026] [:error] [pid 59200:tid 59252] [client 20.250.17.247:24629] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "ac5RjrfP26txrdLs3EptwwAAAEw"]
[Thu Apr 02 19:22:55.142567 2026] [:error] [pid 59194:tid 59223] [client 20.250.17.247:24109] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "ac5RjxMpAeV11hcQehw_LAAAAAo"]
[Thu Apr 02 19:22:55.909268 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:41254] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "ac5Rj9WWpaby3TVN7McFTgAAAcM"]
[Thu Apr 02 19:22:56.801665 2026] [:error] [pid 23927:tid 23929] [client 20.250.17.247:19033] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "ac5RkEsZwqCndhl9uKChYQAAAYA"]
[Thu Apr 02 19:22:58.179197 2026] [:error] [pid 23927:tid 23948] [client 20.250.17.247:54277] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac5RkksZwqCndhl9uKChZQAAAZM"]
[Thu Apr 02 19:22:58.804804 2026] [:error] [pid 59305:tid 59323] [client 20.250.17.247:6109] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac5Rkqr2tV4rDwKFxKd20AAAAM4"]
[Thu Apr 02 19:22:59.668468 2026] [:error] [pid 59201:tid 59278] [client 20.250.17.247:24147] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac5Rk8AC0Tw8eL6gzZ4TvgAAAIs"]
[Thu Apr 02 19:23:00.359901 2026] [:error] [pid 29467:tid 29484] [client 20.250.17.247:15375] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "ac5RlL4VUBFCJAq-WOllygAAAQ4"]
[Thu Apr 02 19:23:01.139491 2026] [:error] [pid 29467:tid 29477] [client 20.250.17.247:5528] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ac5Rlb4VUBFCJAq-WOll1AAAAQc"]
[Thu Apr 02 19:23:02.101773 2026] [:error] [pid 59305:tid 59333] [client 20.250.17.247:15398] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ac5Rlqr2tV4rDwKFxKd21QAAANg"]
[Thu Apr 02 19:23:02.836316 2026] [:error] [pid 59305:tid 59323] [client 20.250.17.247:48820] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ac5Rlqr2tV4rDwKFxKd22QAAAM4"]
[Thu Apr 02 19:23:04.989115 2026] [:error] [pid 59305:tid 59328] [client 20.250.17.247:19973] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Apr 02 19:23:05.227940 2026] [:error] [pid 59305:tid 59321] [client 20.250.17.247:19973] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Apr 02 19:23:05.509919 2026] [:error] [pid 59305:tid 59312] [client 20.250.17.247:19973] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 02 19:23:05.748200 2026] [:error] [pid 59305:tid 59325] [client 20.250.17.247:19973] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Apr 02 19:23:06.065905 2026] [:error] [pid 59305:tid 59329] [client 20.250.17.247:19973] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Thu Apr 02 19:23:06.595466 2026] [:error] [pid 59305:tid 59313] [client 20.250.17.247:19973] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Thu Apr 02 19:23:07.145817 2026] [:error] [pid 59305:tid 59318] [client 20.250.17.247:19973] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Thu Apr 02 19:23:07.381548 2026] [:error] [pid 59305:tid 59309] [client 20.250.17.247:19973] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ac5Rm6r2tV4rDwKFxKd27QAAAMA"]
[Thu Apr 02 19:23:08.446957 2026] [:error] [pid 59305:tid 59317] [client 20.250.17.247:5562] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ac5RnKr2tV4rDwKFxKd28wAAAMg"]
[Thu Apr 02 19:23:09.117834 2026] [:error] [pid 59305:tid 59326] [client 20.250.17.247:37719] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ac5Rnar2tV4rDwKFxKd2_AAAANE"]
[Thu Apr 02 19:23:10.139069 2026] [:error] [pid 59305:tid 59327] [client 20.250.17.247:56648] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "ac5Rnqr2tV4rDwKFxKd3BgAAANI"]
[Thu Apr 02 19:23:10.751089 2026] [:error] [pid 37543:tid 37549] [client 20.250.17.247:34285] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "ac5Rnnhdk2bEYJCvILbSDAAAAUQ"]
[Thu Apr 02 19:23:11.407969 2026] [:error] [pid 29467:tid 29476] [client 20.250.17.247:19001] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "ac5Rn74VUBFCJAq-WOlmAgAAAQY"]
[Thu Apr 02 19:23:12.354863 2026] [:error] [pid 59194:tid 59233] [client 20.250.17.247:18947] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "ac5RoBMpAeV11hcQehw_PgAAABQ"]
[Thu Apr 02 19:23:13.199016 2026] [:error] [pid 29467:tid 29482] [client 20.250.17.247:30741] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "ac5Rob4VUBFCJAq-WOlmDQAAAQw"]
[Thu Apr 02 19:23:14.277561 2026] [:error] [pid 37543:tid 37561] [client 20.250.17.247:25615] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "ac5Ronhdk2bEYJCvILbSGAAAAVA"]
[Thu Apr 02 19:23:15.255899 2026] [:error] [pid 59200:tid 59256] [client 20.250.17.247:64080] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "ac5Ro7fP26txrdLs3Ept2AAAAFA"]
[Thu Apr 02 19:23:18.427923 2026] [:error] [pid 37543:tid 37564] [client 20.250.17.247:20504] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "ac5Rpnhdk2bEYJCvILbSIQAAAVM"]
[Thu Apr 02 19:23:20.120509 2026] [:error] [pid 59201:tid 59271] [client 20.250.17.247:41284] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "ac5RqMAC0Tw8eL6gzZ4T3QAAAIQ"]
[Thu Apr 02 19:23:20.918085 2026] [:error] [pid 59201:tid 59280] [client 20.250.17.247:6008] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "ac5RqMAC0Tw8eL6gzZ4T5gAAAI0"]
[Thu Apr 02 19:23:21.603780 2026] [:error] [pid 59201:tid 59281] [client 20.250.17.247:5967] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "ac5RqcAC0Tw8eL6gzZ4T7AAAAI4"]
[Thu Apr 02 19:23:22.273089 2026] [:error] [pid 37543:tid 37559] [client 20.250.17.247:23154] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "ac5Rqnhdk2bEYJCvILbSLgAAAU4"]
[Thu Apr 02 19:23:23.091052 2026] [:error] [pid 59201:tid 59273] [client 20.250.17.247:32813] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "ac5Rq8AC0Tw8eL6gzZ4T8wAAAIY"]
[Thu Apr 02 19:23:24.797425 2026] [:error] [pid 54384:tid 54396] [client 20.250.17.247:25125] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ac5RrNWWpaby3TVN7McFfAAAAco"]
[Thu Apr 02 19:23:25.746297 2026] [:error] [pid 23927:tid 23948] [client 20.250.17.247:21087] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ac5RrUsZwqCndhl9uKChkAAAAZM"]
[Thu Apr 02 19:23:26.822419 2026] [:error] [pid 29467:tid 29474] [client 20.250.17.247:59077] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ac5Rrr4VUBFCJAq-WOlmSAAAAQQ"]
[Thu Apr 02 19:23:27.617283 2026] [:error] [pid 29467:tid 29481] [client 20.250.17.247:59081] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ac5Rr74VUBFCJAq-WOlmTwAAAQs"]
[Thu Apr 02 19:23:28.492452 2026] [:error] [pid 54384:tid 54402] [client 20.250.17.247:47613] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "ac5RsNWWpaby3TVN7McFjQAAAdA"]
[Thu Apr 02 19:23:29.299158 2026] [:error] [pid 59305:tid 59320] [client 20.250.17.247:47517] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "ac5Rsar2tV4rDwKFxKd3GwAAAMs"]
[Thu Apr 02 19:23:30.185321 2026] [:error] [pid 59200:tid 59250] [client 20.250.17.247:21111] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "ac5RsrfP26txrdLs3Ept6QAAAEo"]
[Thu Apr 02 19:23:31.231355 2026] [:error] [pid 59305:tid 59330] [client 20.250.17.247:44989] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "ac5Rs6r2tV4rDwKFxKd3KQAAANU"]
[Thu Apr 02 19:23:32.015708 2026] [:error] [pid 59305:tid 59325] [client 20.250.17.247:35216] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ac5RtKr2tV4rDwKFxKd3MQAAANA"]
[Thu Apr 02 19:23:32.977935 2026] [:error] [pid 23927:tid 23948] [client 20.250.17.247:47507] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ac5RtEsZwqCndhl9uKChnQAAAZM"]
[Thu Apr 02 19:23:33.897661 2026] [:error] [pid 59305:tid 59320] [client 20.250.17.247:59021] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ac5Rtar2tV4rDwKFxKd3PwAAAMs"]
[Thu Apr 02 19:23:34.531048 2026] [:error] [pid 54384:tid 54398] [client 20.250.17.247:47591] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ac5RttWWpaby3TVN7McFqQAAAcw"]
[Thu Apr 02 19:23:35.121045 2026] [:error] [pid 59305:tid 59332] [client 20.250.17.247:54813] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ac5Rt6r2tV4rDwKFxKd3RgAAANc"]
[Thu Apr 02 19:23:35.847753 2026] [:error] [pid 37543:tid 37564] [client 20.250.17.247:16393] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ac5Rt3hdk2bEYJCvILbSNgAAAVM"]
[Thu Apr 02 19:23:36.947614 2026] [:error] [pid 37543:tid 37556] [client 20.250.17.247:59049] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ac5RuHhdk2bEYJCvILbSOwAAAUs"]
[Thu Apr 02 19:23:37.753729 2026] [:error] [pid 37543:tid 37558] [client 20.250.17.247:59019] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "ac5RuXhdk2bEYJCvILbSPAAAAU0"]
[Thu Apr 02 19:23:38.597895 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:42520] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac5RutWWpaby3TVN7McFtgAAAcM"]
[Thu Apr 02 19:23:39.335097 2026] [:error] [pid 54384:tid 54387] [client 20.250.17.247:30329] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac5Ru9WWpaby3TVN7McFuAAAAcE"]
[Thu Apr 02 19:23:40.292747 2026] [:error] [pid 59201:tid 59270] [client 20.250.17.247:48865] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac5RvMAC0Tw8eL6gzZ4UDQAAAIM"]
[Thu Apr 02 19:23:43.615477 2026] [:error] [pid 59305:tid 59317] [client 20.250.17.247:36309] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac5Rv6r2tV4rDwKFxKd3ZgAAAMg"]
[Thu Apr 02 19:23:44.628692 2026] [:error] [pid 59201:tid 59291] [client 20.250.17.247:63328] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5RwMAC0Tw8eL6gzZ4UEAAAAJg"]
[Thu Apr 02 19:23:45.501378 2026] [:error] [pid 59305:tid 59312] [client 20.250.17.247:5712] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5Rwar2tV4rDwKFxKd3awAAAMM"]
[Thu Apr 02 19:23:47.939648 2026] [:error] [pid 29467:tid 29484] [client 20.250.17.247:30797] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5Rw74VUBFCJAq-WOlmwgAAAQ4"]
[Thu Apr 02 19:23:48.720738 2026] [:error] [pid 54384:tid 54389] [client 20.250.17.247:41900] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5RxNWWpaby3TVN7McF2AAAAcM"]
[Thu Apr 02 19:23:49.599890 2026] [:error] [pid 37543:tid 37547] [client 20.250.17.247:41878] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5RxXhdk2bEYJCvILbSVAAAAUI"]
[Thu Apr 02 19:23:51.011430 2026] [:error] [pid 29467:tid 29486] [client 20.250.17.247:35309] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5Rx74VUBFCJAq-WOlmzgAAARA"]
[Thu Apr 02 19:23:53.333618 2026] [:error] [pid 29467:tid 29490] [client 20.250.17.247:61180] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5Ryb4VUBFCJAq-WOlm0QAAARQ"]
[Thu Apr 02 19:23:54.907360 2026] [:error] [pid 23927:tid 23953] [client 20.250.17.247:31828] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "ac5RyksZwqCndhl9uKChyAAAAZg"]
[Thu Apr 02 19:23:55.900124 2026] [:error] [pid 37543:tid 37556] [client 20.250.17.247:37353] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "ac5Ry3hdk2bEYJCvILbSYgAAAUs"]
[Thu Apr 02 19:23:56.802559 2026] [:error] [pid 59200:tid 59248] [client 20.250.17.247:37351] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "ac5RzLfP26txrdLs3EpuCQAAAEg"]
[Thu Apr 02 19:24:02.631672 2026] [:error] [pid 59305:tid 59314] [client 20.250.17.247:5208] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "ac5R0qr2tV4rDwKFxKd3lgAAAMU"]
[Thu Apr 02 19:24:03.389388 2026] [:error] [pid 23927:tid 23945] [client 20.250.17.247:35731] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "ac5R00sZwqCndhl9uKCh4AAAAZA"]
[Thu Apr 02 19:24:04.986841 2026] [:error] [pid 59305:tid 59315] [client 20.250.17.247:35726] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ac5R1Kr2tV4rDwKFxKd3rAAAAMY"]
[Thu Apr 02 19:24:06.815341 2026] [:error] [pid 59305:tid 59309] [client 20.250.17.247:27182] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ac5R1qr2tV4rDwKFxKd3vAAAAMA"]
[Thu Apr 02 19:24:08.238774 2026] [:error] [pid 23927:tid 23931] [client 20.250.17.247:61150] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 02 19:24:08.521307 2026] [:error] [pid 23927:tid 23935] [client 20.250.17.247:61150] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Apr 02 19:24:08.758573 2026] [:error] [pid 23927:tid 23941] [client 20.250.17.247:61150] File does not exist: /usr/local/apache/htdocs/suspended-page/about2.php
[Thu Apr 02 19:24:08.999251 2026] [:error] [pid 23927:tid 23932] [client 20.250.17.247:61150] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Thu Apr 02 19:24:09.279112 2026] [:error] [pid 23927:tid 23937] [client 20.250.17.247:61150] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Thu Apr 02 19:24:09.870862 2026] [:error] [pid 23927:tid 23945] [client 20.250.17.247:61150] [client 20.250.17.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ac5R2UsZwqCndhl9uKCh8QAAAZA"]
[Thu Apr 02 19:24:10.653557 2026] [:error] [pid 59305:tid 59332] [client 20.250.17.247:27181] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 02 19:24:11.600342 2026] [:error] [pid 59305:tid 59320] [client 20.250.17.247:27181] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Thu Apr 02 19:24:11.863530 2026] [:error] [pid 59305:tid 59318] [client 20.250.17.247:27181] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "ac5R26r2tV4rDwKFxKd34QAAAMk"]
[Thu Apr 02 19:24:13.099697 2026] [:error] [pid 23927:tid 23952] [client 20.250.17.247:22093] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "ac5R3UsZwqCndhl9uKCiBAAAAZc"]
[Thu Apr 02 19:24:13.735373 2026] [:error] [pid 29467:tid 29492] [client 20.250.17.247:20075] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "ac5R3b4VUBFCJAq-WOlm6QAAARY"]
[Thu Apr 02 19:24:14.347358 2026] [:error] [pid 59194:tid 59227] [client 20.250.17.247:18440] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "ac5R3hMpAeV11hcQehw_lQAAAA4"]
[Thu Apr 02 19:24:15.523220 2026] [:error] [pid 29467:tid 29476] [client 20.250.17.247:46858] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "ac5R374VUBFCJAq-WOlm9AAAAQY"]
[Thu Apr 02 19:24:16.626826 2026] [:error] [pid 59201:tid 59290] [client 20.250.17.247:54911] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "ac5R4MAC0Tw8eL6gzZ4URAAAAJc"]
[Thu Apr 02 19:24:17.289023 2026] [:error] [pid 59194:tid 59219] [client 20.250.17.247:62155] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "ac5R4RMpAeV11hcQehw_mAAAAAY"]
[Thu Apr 02 19:24:18.342369 2026] [:error] [pid 59194:tid 59216] [client 20.250.17.247:46890] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "ac5R4hMpAeV11hcQehw_oAAAAAM"]
[Thu Apr 02 19:24:19.376136 2026] [:error] [pid 59194:tid 59233] [client 20.250.17.247:27215] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "ac5R4xMpAeV11hcQehw_pgAAABQ"]
[Thu Apr 02 19:24:20.131438 2026] [:error] [pid 59305:tid 59315] [client 20.250.17.247:59591] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "ac5R5Kr2tV4rDwKFxKd4BQAAAMY"]
[Thu Apr 02 19:24:20.816852 2026] [:error] [pid 54384:tid 54408] [client 20.250.17.247:55872] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "ac5R5NWWpaby3TVN7McF9gAAAdY"]
[Thu Apr 02 19:24:22.628456 2026] [:error] [pid 59305:tid 59312] [client 20.250.17.247:5477] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "ac5R5qr2tV4rDwKFxKd4EAAAAMM"]
[Thu Apr 02 19:24:23.926692 2026] [:error] [pid 23927:tid 23934] [client 20.250.17.247:53758] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "ac5R50sZwqCndhl9uKCiGQAAAYU"]
[Thu Apr 02 19:24:24.616901 2026] [:error] [pid 59305:tid 59329] [client 20.250.17.247:57185] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "ac5R6Kr2tV4rDwKFxKd4GQAAANQ"]
[Thu Apr 02 19:24:25.865307 2026] [:error] [pid 37543:tid 37567] [client 20.250.17.247:27242] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "ac5R6Xhdk2bEYJCvILbSkAAAAVY"]
[Thu Apr 02 19:24:26.577965 2026] [:error] [pid 29467:tid 29475] [client 20.250.17.247:16917] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "ac5R6r4VUBFCJAq-WOlnJwAAAQU"]
[Thu Apr 02 19:24:27.608359 2026] [:error] [pid 29467:tid 29472] [client 20.250.17.247:58569] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "ac5R674VUBFCJAq-WOlnMgAAAQI"]
[Thu Apr 02 19:24:28.938046 2026] [:error] [pid 59305:tid 59325] [client 20.250.17.247:55880] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "ac5R7Kr2tV4rDwKFxKd4iwAAANA"]
[Thu Apr 02 19:24:29.972653 2026] [:error] [pid 29467:tid 29494] [client 20.250.17.247:33693] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "ac5R7b4VUBFCJAq-WOlnSwAAARg"]
[Thu Apr 02 19:24:31.028122 2026] [:error] [pid 23927:tid 23950] [client 20.250.17.247:53096] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "ac5R70sZwqCndhl9uKCicwAAAZU"]
[Thu Apr 02 19:24:31.615894 2026] [:error] [pid 59201:tid 59281] [client 20.250.17.247:60504] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "ac5R78AC0Tw8eL6gzZ4UXgAAAI4"]
[Thu Apr 02 19:24:32.317797 2026] [:error] [pid 29467:tid 29493] [client 20.250.17.247:33712] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "ac5R8L4VUBFCJAq-WOlncQAAARc"]
[Thu Apr 02 19:24:33.016845 2026] [:error] [pid 37543:tid 37545] [client 20.250.17.247:17514] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "ac5R8Xhdk2bEYJCvILbSnwAAAUA"]
[Thu Apr 02 19:24:33.644977 2026] [:error] [pid 59305:tid 59327] [client 20.250.17.247:63738] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "ac5R8ar2tV4rDwKFxKd4nAAAANI"]
[Thu Apr 02 19:24:34.241545 2026] [:error] [pid 29467:tid 29478] [client 20.250.17.247:63701] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac5R8r4VUBFCJAq-WOlnlgAAAQg"]
[Thu Apr 02 19:24:35.128307 2026] [:error] [pid 29467:tid 29492] [client 20.250.17.247:16920] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac5R874VUBFCJAq-WOlnqQAAARY"]
[Thu Apr 02 19:24:36.856343 2026] [:error] [pid 29467:tid 29484] [client 20.250.17.247:38701] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac5R9L4VUBFCJAq-WOlnxwAAAQ4"]
[Thu Apr 02 19:24:38.171389 2026] [:error] [pid 29467:tid 29474] [client 20.250.17.247:33722] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "ac5R9r4VUBFCJAq-WOln2wAAAQQ"]
[Thu Apr 02 19:24:39.513671 2026] [:error] [pid 59200:tid 59244] [client 20.250.17.247:52388] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "ac5R97fP26txrdLs3EpuHQAAAEQ"]
[Thu Apr 02 19:24:40.404593 2026] [:error] [pid 59200:tid 59263] [client 20.250.17.247:60521] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "ac5R-LfP26txrdLs3EpuIQAAAFc"]
[Thu Apr 02 19:24:41.474079 2026] [:error] [pid 59194:tid 59231] [client 20.250.17.247:33676] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "ac5R-RMpAeV11hcQehw_vAAAABI"]
[Thu Apr 02 19:24:44.468869 2026] [:error] [pid 59305:tid 59324] [client 20.250.17.247:16908] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "ac5R_Kr2tV4rDwKFxKd4tgAAAM8"]
[Thu Apr 02 19:24:45.858727 2026] [:error] [pid 59200:tid 59247] [client 20.250.17.247:31799] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5R_bfP26txrdLs3EpuKAAAAEc"]
[Thu Apr 02 19:24:46.609367 2026] [:error] [pid 54384:tid 54390] [client 20.250.17.247:33703] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5R_tWWpaby3TVN7McGGwAAAcQ"]
[Thu Apr 02 19:24:48.090127 2026] [:error] [pid 59200:tid 59261] [client 20.250.17.247:39955] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5SALfP26txrdLs3EpuKwAAAFU"]
[Thu Apr 02 19:24:48.875627 2026] [:error] [pid 59194:tid 59223] [client 20.250.17.247:38754] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5SABMpAeV11hcQehw_yQAAAAo"]
[Thu Apr 02 19:24:49.781814 2026] [:error] [pid 54384:tid 54401] [client 20.250.17.247:38736] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "ac5SAdWWpaby3TVN7McGKwAAAc8"]
[Thu Apr 02 19:24:50.591624 2026] [:error] [pid 54384:tid 54394] [client 20.250.17.247:55367] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "ac5SAtWWpaby3TVN7McGMAAAAcg"]
[Thu Apr 02 19:24:51.646866 2026] [:error] [pid 54384:tid 54386] [client 20.250.17.247:16927] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "ac5SA9WWpaby3TVN7McGOAAAAcA"]
[Thu Apr 02 19:24:52.436213 2026] [:error] [pid 54384:tid 54390] [client 20.250.17.247:41980] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "ac5SBNWWpaby3TVN7McGPQAAAcQ"]
[Thu Apr 02 19:24:53.342027 2026] [:error] [pid 59305:tid 59316] [client 20.250.17.247:39992] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "ac5SBar2tV4rDwKFxKd40gAAAMc"]
[Thu Apr 02 19:24:54.949927 2026] [:error] [pid 59201:tid 59270] [client 20.250.17.247:62901] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "ac5SBsAC0Tw8eL6gzZ4UkAAAAIM"]
[Thu Apr 02 19:24:55.779367 2026] [:error] [pid 59305:tid 59309] [client 20.250.17.247:52402] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "ac5SB6r2tV4rDwKFxKd44gAAAMA"]
[Thu Apr 02 19:24:57.171273 2026] [:error] [pid 29467:tid 29487] [client 20.250.17.247:62868] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "ac5SCb4VUBFCJAq-WOloDQAAARE"]
[Thu Apr 02 19:24:57.967671 2026] [:error] [pid 23927:tid 23945] [client 20.250.17.247:55408] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "ac5SCUsZwqCndhl9uKCiqgAAAZA"]
[Thu Apr 02 19:24:58.741066 2026] [:error] [pid 29467:tid 29471] [client 20.250.17.247:44607] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "ac5SCr4VUBFCJAq-WOloHAAAAQE"]
[Thu Apr 02 19:24:59.983082 2026] [:error] [pid 59201:tid 59290] [client 20.250.17.247:38710] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "ac5SC8AC0Tw8eL6gzZ4UmQAAAJc"]
[Thu Apr 02 19:25:00.860069 2026] [:error] [pid 23927:tid 23938] [client 20.250.17.247:63718] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "ac5SDEsZwqCndhl9uKCirgAAAYk"]
[Thu Apr 02 19:25:01.490883 2026] [:error] [pid 23927:tid 23947] [client 20.250.17.247:60469] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac5SDUsZwqCndhl9uKCisAAAAZI"]
[Thu Apr 02 19:25:02.409696 2026] [:error] [pid 29467:tid 29477] [client 20.250.17.247:44551] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac5SDr4VUBFCJAq-WOloMwAAAQc"]
[Thu Apr 02 19:25:03.444434 2026] [:error] [pid 23927:tid 23939] [client 20.250.17.247:41939] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac5SD0sZwqCndhl9uKCivQAAAYo"]
[Thu Apr 02 19:25:04.466704 2026] [:error] [pid 29467:tid 29486] [client 20.250.17.247:50156] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac5SEL4VUBFCJAq-WOloOAAAARA"]
[Thu Apr 02 19:25:05.152085 2026] [:error] [pid 59305:tid 59329] [client 20.250.17.247:38712] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "ac5SEar2tV4rDwKFxKd46gAAANQ"]
[Thu Apr 02 19:25:05.808761 2026] [:error] [pid 59200:tid 59242] [client 20.250.17.247:35789] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "ac5SEbfP26txrdLs3EpuNQAAAEI"]
[Thu Apr 02 19:25:06.386696 2026] [:error] [pid 59201:tid 59278] [client 20.250.17.247:33711] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "ac5SEsAC0Tw8eL6gzZ4UrQAAAIs"]
[Thu Apr 02 19:25:07.091748 2026] [:error] [pid 37543:tid 37548] [client 20.250.17.247:26657] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "ac5SE3hdk2bEYJCvILbS5gAAAUM"]
[Thu Apr 02 19:25:07.849830 2026] [:error] [pid 29467:tid 29475] [client 20.250.17.247:5941] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac5SE74VUBFCJAq-WOloRQAAAQU"]
[Thu Apr 02 19:25:08.807195 2026] [:error] [pid 29467:tid 29485] [client 20.250.17.247:31757] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac5SFL4VUBFCJAq-WOloSwAAAQ8"]
[Thu Apr 02 19:25:09.823425 2026] [:error] [pid 37543:tid 37554] [client 20.250.17.247:26631] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac5SFXhdk2bEYJCvILbS5wAAAUk"]
[Thu Apr 02 19:25:10.457206 2026] [:error] [pid 59201:tid 59288] [client 20.250.17.247:60437] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac5SFsAC0Tw8eL6gzZ4UtgAAAJU"]
[Thu Apr 02 19:25:12.128567 2026] [:error] [pid 37543:tid 37555] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 02 19:25:12.367744 2026] [:error] [pid 37543:tid 37556] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Thu Apr 02 19:25:12.640833 2026] [:error] [pid 37543:tid 37553] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Thu Apr 02 19:25:12.971916 2026] [:error] [pid 37543:tid 37546] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Thu Apr 02 19:25:13.413104 2026] [:error] [pid 37543:tid 37565] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Apr 02 19:25:13.756174 2026] [:error] [pid 37543:tid 37560] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Thu Apr 02 19:25:13.998185 2026] [:error] [pid 37543:tid 37568] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Thu Apr 02 19:25:14.240830 2026] [:error] [pid 37543:tid 37556] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/efile.php
[Thu Apr 02 19:25:14.506011 2026] [:error] [pid 37543:tid 37548] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/afile.php
[Thu Apr 02 19:25:14.817329 2026] [:error] [pid 37543:tid 37561] [client 20.250.17.247:62903] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Thu Apr 02 19:25:15.052421 2026] [:error] [pid 37543:tid 37569] [client 20.250.17.247:62903] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac5SG3hdk2bEYJCvILbTEQAAAVg"]
[Thu Apr 02 19:25:15.767848 2026] [:error] [pid 59201:tid 59271] [client 20.250.17.247:52376] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac5SG8AC0Tw8eL6gzZ4UvgAAAIQ"]
[Thu Apr 02 19:25:16.758418 2026] [:error] [pid 29467:tid 29494] [client 20.250.17.247:60471] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac5SHL4VUBFCJAq-WOloWQAAARg"]
[Thu Apr 02 19:25:17.938657 2026] [:error] [pid 29467:tid 29474] [client 20.250.17.247:62533] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac5SHb4VUBFCJAq-WOloXwAAAQQ"]
[Thu Apr 02 19:25:19.124068 2026] [:error] [pid 54384:tid 54410] [client 20.250.17.247:64029] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ac5SH9WWpaby3TVN7McGYgAAAdg"]
[Thu Apr 02 19:25:20.091940 2026] [:error] [pid 29467:tid 29484] [client 20.250.17.247:64051] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ac5SIL4VUBFCJAq-WOloaQAAAQ4"]
[Thu Apr 02 19:25:20.790812 2026] [:error] [pid 59305:tid 59331] [client 20.250.17.247:35809] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ac5SIKr2tV4rDwKFxKd49AAAANY"]
[Thu Apr 02 19:25:21.430656 2026] [:error] [pid 29467:tid 29471] [client 20.250.17.247:60464] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "ac5SIb4VUBFCJAq-WOlobwAAAQE"]
[Thu Apr 02 19:25:22.104362 2026] [:error] [pid 29467:tid 29491] [client 20.250.17.247:41948] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac5SIr4VUBFCJAq-WOlodgAAARU"]
[Thu Apr 02 19:25:23.034286 2026] [:error] [pid 29467:tid 29470] [client 20.250.17.247:60462] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac5SI74VUBFCJAq-WOlofgAAAQA"]
[Thu Apr 02 19:25:24.127313 2026] [:error] [pid 23927:tid 23933] [client 20.250.17.247:60435] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac5SJEsZwqCndhl9uKCi1gAAAYQ"]
[Thu Apr 02 19:25:25.590740 2026] [:error] [pid 29467:tid 29470] [client 20.250.17.247:41968] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac5SJb4VUBFCJAq-WOloggAAAQA"]
[Thu Apr 02 19:25:27.125039 2026] [:error] [pid 59200:tid 59259] [client 20.250.17.247:64021] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac5SJ7fP26txrdLs3EpuOQAAAFM"]
[Thu Apr 02 19:25:28.018513 2026] [:error] [pid 29467:tid 29472] [client 20.250.17.247:62908] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac5SKL4VUBFCJAq-WOlojQAAAQI"]
[Thu Apr 02 19:25:28.871899 2026] [:error] [pid 59201:tid 59281] [client 20.250.17.247:26630] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac5SKMAC0Tw8eL6gzZ4UyAAAAI4"]
[Thu Apr 02 19:25:29.866766 2026] [:error] [pid 59305:tid 59309] [client 20.250.17.247:50116] [client 20.250.17.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac5SKar2tV4rDwKFxKd5AQAAAMA"]
[Thu Apr 02 22:58:00.278803 2026] [:error] [pid 59305:tid 59314] [client 172.213.211.100:34392] File does not exist: /usr/local/apache/htdocs/suspended-page/xozx.php
[Fri Apr 03 00:40:43.811343 2026] [:error] [pid 25470:tid 25480] [client 20.63.60.10:58847] File does not exist: /usr/local/apache/htdocs/suspended-page/xozx.php
[Fri Apr 03 02:29:13.123189 2026] [:error] [pid 25035:tid 25459] [client 45.131.195.161:26529] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac61eRhR292toNOkLqHWnwAAAJE"]
[Fri Apr 03 06:28:04.726958 2026] [:error] [pid 58590:tid 58614] [client 4.232.187.184:40500] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac7tdEze_aEPDM9xEE3lRgAAARY"]
[Fri Apr 03 06:28:06.312633 2026] [:error] [pid 22672:tid 22743] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/asd67.php
[Fri Apr 03 06:28:07.758166 2026] [:error] [pid 22672:tid 22743] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Apr 03 06:28:09.067701 2026] [:error] [pid 22672:tid 22743] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Fri Apr 03 06:28:10.834509 2026] [:error] [pid 22672:tid 22743] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Fri Apr 03 06:28:11.086548 2026] [:error] [pid 22672:tid 22741] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Apr 03 06:28:11.831654 2026] [:error] [pid 22672:tid 22724] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Fri Apr 03 06:28:12.507735 2026] [:error] [pid 22672:tid 22738] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv2.php
[Fri Apr 03 06:28:12.893531 2026] [:error] [pid 22672:tid 22722] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Fri Apr 03 06:28:13.129249 2026] [:error] [pid 22672:tid 22725] [client 4.232.187.184:35035] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Fri Apr 03 06:28:13.408325 2026] [:error] [pid 22672:tid 22729] [client 4.232.187.184:35035] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "ac7tfazrgXkFSOK0fvqX9gAAAEo"]
[Fri Apr 03 06:28:14.330391 2026] [:error] [pid 22778:tid 22798] [client 4.232.187.184:50907] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "ac7tfvS-q9hkdFqUjq-caAAAAM0"]
[Fri Apr 03 06:28:15.689686 2026] [:error] [pid 58590:tid 58601] [client 4.232.187.184:50887] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "ac7tf0ze_aEPDM9xEE3laQAAAQk"]
[Fri Apr 03 06:28:16.720004 2026] [:error] [pid 22672:tid 22742] [client 4.232.187.184:61094] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/index.php"] [unique_id "ac7tgKzrgXkFSOK0fvqX-gAAAFc"]
[Fri Apr 03 06:28:18.462061 2026] [:error] [pid 58590:tid 58610] [client 4.232.187.184:50892] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n.php"] [unique_id "ac7tgkze_aEPDM9xEE3ldQAAARI"]
[Fri Apr 03 06:28:19.708847 2026] [:error] [pid 22673:tid 22768] [client 4.232.187.184:53286] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n.php"] [unique_id "ac7tg--GlVDWdWxxwJCdIgAAAJY"]
[Fri Apr 03 06:28:20.639824 2026] [:error] [pid 22778:tid 22809] [client 4.232.187.184:3456] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n.php"] [unique_id "ac7thPS-q9hkdFqUjq-chgAAANg"]
[Fri Apr 03 06:28:22.681125 2026] [:error] [pid 22778:tid 22800] [client 4.232.187.184:61110] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n.php"] [unique_id "ac7thvS-q9hkdFqUjq-cjQAAAM8"]
[Fri Apr 03 06:28:23.932133 2026] [:error] [pid 22672:tid 22730] [client 4.232.187.184:41798] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "ac7th6zrgXkFSOK0fvqX_AAAAEs"]
[Fri Apr 03 06:28:24.571834 2026] [:error] [pid 22778:tid 22790] [client 4.232.187.184:47349] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "ac7tiPS-q9hkdFqUjq-ckwAAAMU"]
[Fri Apr 03 06:28:25.307798 2026] [:error] [pid 22673:tid 22755] [client 4.232.187.184:37575] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "ac7tie-GlVDWdWxxwJCdNgAAAIk"]
[Fri Apr 03 06:28:26.146866 2026] [:error] [pid 58590:tid 58594] [client 4.232.187.184:37821] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "ac7tikze_aEPDM9xEE3lngAAAQI"]
[Fri Apr 03 06:28:27.154215 2026] [:error] [pid 22778:tid 22805] [client 4.232.187.184:50936] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "ac7ti_S-q9hkdFqUjq-clwAAANQ"]
[Fri Apr 03 06:28:27.751403 2026] [:error] [pid 22672:tid 22736] [client 4.232.187.184:50906] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "ac7ti6zrgXkFSOK0fvqYAQAAAFE"]
[Fri Apr 03 06:28:28.446508 2026] [:error] [pid 58590:tid 58605] [client 4.232.187.184:29051] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "ac7tjEze_aEPDM9xEE3lrQAAAQ0"]
[Fri Apr 03 06:28:29.499708 2026] [:error] [pid 58590:tid 58610] [client 4.232.187.184:47443] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "ac7tjUze_aEPDM9xEE3ltgAAARI"]
[Fri Apr 03 06:28:30.366777 2026] [:error] [pid 58590:tid 58593] [client 4.232.187.184:50918] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "ac7tjkze_aEPDM9xEE3lvgAAAQE"]
[Fri Apr 03 06:28:31.597646 2026] [:error] [pid 58590:tid 58613] [client 4.232.187.184:29015] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "ac7tj0ze_aEPDM9xEE3lzAAAARU"]
[Fri Apr 03 06:28:32.675417 2026] [:error] [pid 58590:tid 58609] [client 4.232.187.184:35016] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "ac7tkEze_aEPDM9xEE3lzwAAARE"]
[Fri Apr 03 06:28:33.941171 2026] [:error] [pid 58590:tid 58601] [client 4.232.187.184:40469] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r4f_1.php"] [unique_id "ac7tkUze_aEPDM9xEE3l2wAAAQk"]
[Fri Apr 03 06:28:35.216743 2026] [:error] [pid 58590:tid 58611] [client 4.232.187.184:37603] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac7tk0ze_aEPDM9xEE3l4QAAARM"]
[Fri Apr 03 06:28:36.507644 2026] [:error] [pid 58590:tid 58607] [client 4.232.187.184:38966] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac7tlEze_aEPDM9xEE3l5AAAAQ8"]
[Fri Apr 03 06:28:38.604316 2026] [:error] [pid 58590:tid 58604] [client 4.232.187.184:39034] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac7tlkze_aEPDM9xEE3l6gAAAQw"]
[Fri Apr 03 06:28:39.740507 2026] [:error] [pid 22778:tid 22791] [client 4.232.187.184:3616] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac7tl_S-q9hkdFqUjq-cqgAAAMY"]
[Fri Apr 03 06:28:41.615465 2026] [:error] [pid 22778:tid 22801] [client 4.232.187.184:63313] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac7tmfS-q9hkdFqUjq-crAAAANA"]
[Fri Apr 03 06:28:43.118766 2026] [:error] [pid 58590:tid 58611] [client 4.232.187.184:28956] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac7tm0ze_aEPDM9xEE3l_wAAARM"]
[Fri Apr 03 06:28:44.211539 2026] [:error] [pid 58590:tid 58592] [client 4.232.187.184:60797] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac7tnEze_aEPDM9xEE3mAwAAAQA"]
[Fri Apr 03 06:28:45.214189 2026] [:error] [pid 22673:tid 22756] [client 4.232.187.184:53284] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class.php"] [unique_id "ac7tne-GlVDWdWxxwJCdQgAAAIo"]
[Fri Apr 03 06:28:46.013165 2026] [:error] [pid 22672:tid 22733] [client 4.232.187.184:42698] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "ac7tnqzrgXkFSOK0fvqYDAAAAE4"]
[Fri Apr 03 06:28:46.886313 2026] [:error] [pid 22778:tid 22795] [client 4.232.187.184:42735] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "ac7tnvS-q9hkdFqUjq-cwQAAAMo"]
[Fri Apr 03 06:28:48.213929 2026] [:error] [pid 22778:tid 22802] [client 4.232.187.184:34307] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "ac7toPS-q9hkdFqUjq-cxQAAANE"]
[Fri Apr 03 06:28:49.121857 2026] [:error] [pid 22778:tid 22785] [client 4.232.187.184:48083] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "ac7tofS-q9hkdFqUjq-cygAAAMA"]
[Fri Apr 03 06:28:50.030120 2026] [:error] [pid 22778:tid 22792] [client 4.232.187.184:35050] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "ac7tovS-q9hkdFqUjq-c0AAAAMc"]
[Fri Apr 03 06:28:50.838878 2026] [:error] [pid 58590:tid 58601] [client 4.232.187.184:36020] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "ac7tokze_aEPDM9xEE3mEQAAAQk"]
[Fri Apr 03 06:28:52.159067 2026] [:error] [pid 22673:tid 22759] [client 4.232.187.184:41382] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "ac7tpO-GlVDWdWxxwJCdWgAAAI0"]
[Fri Apr 03 06:28:53.018491 2026] [:error] [pid 22673:tid 22769] [client 4.232.187.184:3507] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/o.php"] [unique_id "ac7tpe-GlVDWdWxxwJCdXwAAAJc"]
[Fri Apr 03 06:28:53.882107 2026] [:error] [pid 22673:tid 22762] [client 4.232.187.184:62223] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "ac7tpe-GlVDWdWxxwJCdZgAAAJA"]
[Fri Apr 03 06:28:55.096172 2026] [:error] [pid 58590:tid 58600] [client 4.232.187.184:35814] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "ac7tp0ze_aEPDM9xEE3mHAAAAQg"]
[Fri Apr 03 06:28:56.474944 2026] [:error] [pid 22672:tid 22729] [client 4.232.187.184:60678] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "ac7tqKzrgXkFSOK0fvqYHgAAAEo"]
[Fri Apr 03 06:28:57.759867 2026] [:error] [pid 58590:tid 58604] [client 4.232.187.184:3086] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a.php"] [unique_id "ac7tqUze_aEPDM9xEE3mJQAAAQw"]
[Fri Apr 03 06:28:58.825406 2026] [:error] [pid 22673:tid 22760] [client 4.232.187.184:53853] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "ac7tqu-GlVDWdWxxwJCdcwAAAI4"]
[Fri Apr 03 06:28:59.788308 2026] [:error] [pid 22673:tid 22764] [client 4.232.187.184:44970] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "ac7tq--GlVDWdWxxwJCddwAAAJI"]
[Fri Apr 03 06:29:00.582556 2026] [:error] [pid 22778:tid 22809] [client 4.232.187.184:50719] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "ac7trPS-q9hkdFqUjq-c2AAAANg"]
[Fri Apr 03 06:29:01.596347 2026] [:error] [pid 22673:tid 22767] [client 4.232.187.184:50907] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/system_log.php"] [unique_id "ac7tre-GlVDWdWxxwJCdgAAAAJU"]
[Fri Apr 03 06:29:02.541474 2026] [:error] [pid 58590:tid 58608] [client 4.232.187.184:50735] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac7trkze_aEPDM9xEE3mQQAAARA"]
[Fri Apr 03 06:29:03.567992 2026] [:error] [pid 22671:tid 22693] [client 4.232.187.184:50728] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac7tryRuUnMW7r8hvyZZWAAAAAI"]
[Fri Apr 03 06:29:04.226325 2026] [:error] [pid 22672:tid 22719] [client 4.232.187.184:63103] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac7tsKzrgXkFSOK0fvqYKwAAAEA"]
[Fri Apr 03 06:29:05.406131 2026] [:error] [pid 22778:tid 22785] [client 4.232.187.184:37789] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac7tsfS-q9hkdFqUjq-c5QAAAMA"]
[Fri Apr 03 06:29:06.155792 2026] [:error] [pid 22778:tid 22806] [client 4.232.187.184:37880] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ac7tsvS-q9hkdFqUjq-c7QAAANU"]
[Fri Apr 03 06:29:06.860648 2026] [:error] [pid 22778:tid 22804] [client 4.232.187.184:63063] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ac7tsvS-q9hkdFqUjq-c8AAAANM"]
[Fri Apr 03 06:29:07.509790 2026] [:error] [pid 22673:tid 22756] [client 4.232.187.184:60294] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ac7ts--GlVDWdWxxwJCdgwAAAIo"]
[Fri Apr 03 06:29:08.305193 2026] [:error] [pid 22672:tid 22737] [client 4.232.187.184:44960] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "ac7ttKzrgXkFSOK0fvqYNQAAAFI"]
[Fri Apr 03 06:29:09.534414 2026] [:error] [pid 22673:tid 22755] [client 4.232.187.184:39872] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac7tte-GlVDWdWxxwJCdiwAAAIk"]
[Fri Apr 03 06:29:10.240082 2026] [:error] [pid 22672:tid 22723] [client 4.232.187.184:54436] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac7ttqzrgXkFSOK0fvqYPgAAAEQ"]
[Fri Apr 03 06:29:10.818533 2026] [:error] [pid 22672:tid 22732] [client 4.232.187.184:60318] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac7ttqzrgXkFSOK0fvqYQgAAAE0"]
[Fri Apr 03 06:29:12.007993 2026] [:error] [pid 22673:tid 22758] [client 4.232.187.184:4006] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac7tuO-GlVDWdWxxwJCdmAAAAIw"]
[Fri Apr 03 06:29:13.121585 2026] [:error] [pid 22673:tid 22750] [client 4.232.187.184:44936] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Apr 03 06:29:13.567948 2026] [:error] [pid 22673:tid 22749] [client 4.232.187.184:44936] File does not exist: /usr/local/apache/htdocs/suspended-page/file32.php
[Fri Apr 03 06:29:13.892738 2026] [:error] [pid 22673:tid 22753] [client 4.232.187.184:44936] File does not exist: /usr/local/apache/htdocs/suspended-page/nope.php
[Fri Apr 03 06:29:14.358174 2026] [:error] [pid 22673:tid 22748] [client 4.232.187.184:44936] File does not exist: /usr/local/apache/htdocs/suspended-page/js.php
[Fri Apr 03 06:29:14.662769 2026] [:error] [pid 22673:tid 22767] [client 4.232.187.184:44936] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ac7tuu-GlVDWdWxxwJCdtAAAAJU"]
[Fri Apr 03 06:29:16.033848 2026] [:error] [pid 22778:tid 22795] [client 4.232.187.184:60291] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "ac7tvPS-q9hkdFqUjq-c9gAAAMo"]
[Fri Apr 03 06:29:17.112390 2026] [:error] [pid 22673:tid 22748] [client 4.232.187.184:39917] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "ac7tve-GlVDWdWxxwJCdwgAAAII"]
[Fri Apr 03 06:29:17.820828 2026] [:error] [pid 22673:tid 22759] [client 4.232.187.184:39578] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "ac7tve-GlVDWdWxxwJCdxAAAAI0"]
[Fri Apr 03 06:29:18.655052 2026] [:error] [pid 58590:tid 58616] [client 4.232.187.184:55307] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/num.php"] [unique_id "ac7tvkze_aEPDM9xEE3mawAAARg"]
[Fri Apr 03 06:29:19.482009 2026] [:error] [pid 58590:tid 58594] [client 4.232.187.184:44487] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac7tv0ze_aEPDM9xEE3mcgAAAQI"]
[Fri Apr 03 06:29:20.597994 2026] [:error] [pid 58590:tid 58613] [client 4.232.187.184:52096] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac7twEze_aEPDM9xEE3mfQAAARU"]
[Fri Apr 03 06:29:21.665606 2026] [:error] [pid 22673:tid 22767] [client 4.232.187.184:40515] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac7twe-GlVDWdWxxwJCdzgAAAJU"]
[Fri Apr 03 06:29:22.408018 2026] [:error] [pid 22778:tid 22797] [client 4.232.187.184:26546] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mah.php"] [unique_id "ac7twvS-q9hkdFqUjq-dCgAAAMw"]
[Fri Apr 03 06:29:23.087592 2026] [:error] [pid 22778:tid 22800] [client 4.232.187.184:37770] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "ac7tw_S-q9hkdFqUjq-dEAAAAM8"]
[Fri Apr 03 06:29:23.731711 2026] [:error] [pid 22778:tid 22802] [client 4.232.187.184:44529] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "ac7tw_S-q9hkdFqUjq-dFQAAANE"]
[Fri Apr 03 06:29:24.675020 2026] [:error] [pid 22671:tid 22705] [client 4.232.187.184:52148] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "ac7txCRuUnMW7r8hvyZZcwAAAA4"]
[Fri Apr 03 06:29:25.721848 2026] [:error] [pid 22778:tid 22808] [client 4.232.187.184:3969] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "ac7txfS-q9hkdFqUjq-dHQAAANc"]
[Fri Apr 03 06:29:27.856181 2026] [:error] [pid 22671:tid 22705] [client 4.232.187.184:54443] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "ac7txyRuUnMW7r8hvyZZgwAAAA4"]
[Fri Apr 03 06:29:29.123435 2026] [:error] [pid 22778:tid 22785] [client 4.232.187.184:54404] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "ac7tyfS-q9hkdFqUjq-dKgAAAMA"]
[Fri Apr 03 06:29:30.258799 2026] [:error] [pid 58590:tid 58594] [client 4.232.187.184:44492] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "ac7tykze_aEPDM9xEE3mkwAAAQI"]
[Fri Apr 03 06:29:32.218089 2026] [:error] [pid 22672:tid 22735] [client 4.232.187.184:49345] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atomlib.php"] [unique_id "ac7tzKzrgXkFSOK0fvqYgAAAAFA"]
[Fri Apr 03 06:29:36.965781 2026] [:error] [pid 58590:tid 58613] [client 4.232.187.184:61808] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "ac7t0Eze_aEPDM9xEE3mpwAAARU"]
[Fri Apr 03 06:29:38.250517 2026] [:error] [pid 58590:tid 58615] [client 4.232.187.184:62732] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "ac7t0kze_aEPDM9xEE3mrAAAARc"]
[Fri Apr 03 06:29:39.082437 2026] [:error] [pid 58590:tid 58616] [client 4.232.187.184:31041] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "ac7t00ze_aEPDM9xEE3mswAAARg"]
[Fri Apr 03 06:29:39.933738 2026] [:error] [pid 58590:tid 58598] [client 4.232.187.184:61782] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wfile.php"] [unique_id "ac7t00ze_aEPDM9xEE3muwAAAQY"]
[Fri Apr 03 06:29:41.288314 2026] [:error] [pid 22673:tid 22747] [client 4.232.187.184:3991] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "ac7t1e-GlVDWdWxxwJCd_QAAAIE"]
[Fri Apr 03 06:29:42.215569 2026] [:error] [pid 22671:tid 22714] [client 4.232.187.184:3128] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "ac7t1iRuUnMW7r8hvyZZlAAAABc"]
[Fri Apr 03 06:29:43.156533 2026] [:error] [pid 22671:tid 22695] [client 4.232.187.184:61810] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "ac7t1yRuUnMW7r8hvyZZmwAAAAQ"]
[Fri Apr 03 06:29:43.898497 2026] [:error] [pid 22671:tid 22711] [client 4.232.187.184:62828] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "ac7t1yRuUnMW7r8hvyZZogAAABQ"]
[Fri Apr 03 06:29:44.651706 2026] [:error] [pid 58590:tid 58607] [client 4.232.187.184:62842] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "ac7t2Eze_aEPDM9xEE3mwwAAAQ8"]
[Fri Apr 03 06:29:45.875042 2026] [:error] [pid 22672:tid 22726] [client 4.232.187.184:34996] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "ac7t2azrgXkFSOK0fvqYnQAAAEc"]
[Fri Apr 03 06:29:46.942435 2026] [:error] [pid 22672:tid 22738] [client 4.232.187.184:45048] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "ac7t2qzrgXkFSOK0fvqYngAAAFM"]
[Fri Apr 03 06:29:47.934632 2026] [:error] [pid 58590:tid 58601] [client 4.232.187.184:45073] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "ac7t20ze_aEPDM9xEE3m0QAAAQk"]
[Fri Apr 03 06:29:48.703189 2026] [:error] [pid 58590:tid 58592] [client 4.232.187.184:55459] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "ac7t3Eze_aEPDM9xEE3m1AAAAQA"]
[Fri Apr 03 06:29:49.549644 2026] [:error] [pid 22778:tid 22788] [client 4.232.187.184:38870] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "ac7t3fS-q9hkdFqUjq-dZwAAAMM"]
[Fri Apr 03 06:29:50.224126 2026] [:error] [pid 22671:tid 22695] [client 4.232.187.184:61536] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "ac7t3iRuUnMW7r8hvyZZqgAAAAQ"]
[Fri Apr 03 06:29:51.064811 2026] [:error] [pid 22778:tid 22797] [client 4.232.187.184:44997] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "ac7t3_S-q9hkdFqUjq-dbAAAAMw"]
[Fri Apr 03 06:29:52.339635 2026] [:error] [pid 58590:tid 58599] [client 4.232.187.184:32565] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "ac7t4Eze_aEPDM9xEE3m3gAAAQc"]
[Fri Apr 03 06:29:53.587168 2026] [:error] [pid 22778:tid 22793] [client 4.232.187.184:60385] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "ac7t4fS-q9hkdFqUjq-ddAAAAMg"]
[Fri Apr 03 06:29:54.541925 2026] [:error] [pid 22778:tid 22809] [client 4.232.187.184:42080] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "ac7t4vS-q9hkdFqUjq-ddwAAANg"]
[Fri Apr 03 06:29:55.440453 2026] [:error] [pid 58590:tid 58598] [client 4.232.187.184:35642] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "ac7t40ze_aEPDM9xEE3m6gAAAQY"]
[Fri Apr 03 06:29:56.262279 2026] [:error] [pid 58590:tid 58614] [client 4.232.187.184:63374] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/123.php"] [unique_id "ac7t5Eze_aEPDM9xEE3m7wAAARY"]
[Fri Apr 03 06:29:57.653056 2026] [:error] [pid 22671:tid 22713] [client 4.232.187.184:47396] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "ac7t5SRuUnMW7r8hvyZZvgAAABY"]
[Fri Apr 03 06:29:58.818140 2026] [:error] [pid 22778:tid 22786] [client 4.232.187.184:54232] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "ac7t5vS-q9hkdFqUjq-diQAAAME"]
[Fri Apr 03 06:29:59.656757 2026] [:error] [pid 22778:tid 22794] [client 4.232.187.184:54754] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "ac7t5_S-q9hkdFqUjq-dkAAAAMk"]
[Fri Apr 03 06:30:03.174217 2026] [:error] [pid 22672:tid 22719] [client 4.232.187.184:36315] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links-opml.php"] [unique_id "ac7t66zrgXkFSOK0fvqYtQAAAEA"]
[Fri Apr 03 06:30:05.008667 2026] [:error] [pid 22673:tid 22750] [client 4.232.187.184:50514] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac7t7e-GlVDWdWxxwJCeLAAAAIQ"]
[Fri Apr 03 06:30:05.565940 2026] [:error] [pid 58590:tid 58615] [client 4.232.187.184:38907] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac7t7Uze_aEPDM9xEE3nCQAAARc"]
[Fri Apr 03 06:30:06.159412 2026] [:error] [pid 58590:tid 58600] [client 4.232.187.184:47373] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac7t7kze_aEPDM9xEE3nDgAAAQg"]
[Fri Apr 03 06:30:06.742032 2026] [:error] [pid 58590:tid 58596] [client 4.232.187.184:41749] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac7t7kze_aEPDM9xEE3nEgAAAQQ"]
[Fri Apr 03 06:30:07.422198 2026] [:error] [pid 22778:tid 22797] [client 4.232.187.184:41753] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac7t7_S-q9hkdFqUjq-dtAAAAMw"]
[Fri Apr 03 06:30:08.030290 2026] [:error] [pid 22778:tid 22795] [client 4.232.187.184:47050] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac7t8PS-q9hkdFqUjq-dtQAAAMo"]
[Fri Apr 03 06:30:08.606146 2026] [:error] [pid 22673:tid 22762] [client 4.232.187.184:32533] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac7t8O-GlVDWdWxxwJCeOwAAAJA"]
[Fri Apr 03 06:30:09.244804 2026] [:error] [pid 22778:tid 22790] [client 4.232.187.184:38898] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/moon.php"] [unique_id "ac7t8fS-q9hkdFqUjq-dtwAAAMU"]
[Fri Apr 03 06:30:09.850283 2026] [:error] [pid 22673:tid 22749] [client 4.232.187.184:36307] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/33.php"] [unique_id "ac7t8e-GlVDWdWxxwJCeQAAAAIM"]
[Fri Apr 03 06:30:10.513523 2026] [:error] [pid 58590:tid 58610] [client 4.232.187.184:53214] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/33.php"] [unique_id "ac7t8kze_aEPDM9xEE3nIAAAARI"]
[Fri Apr 03 06:30:11.738989 2026] [:error] [pid 58590:tid 58612] [client 4.232.187.184:54773] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/33.php"] [unique_id "ac7t80ze_aEPDM9xEE3nKgAAARQ"]
[Fri Apr 03 06:30:12.635969 2026] [:error] [pid 22778:tid 22804] [client 4.232.187.184:35749] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/33.php"] [unique_id "ac7t9PS-q9hkdFqUjq-dvAAAANM"]
[Fri Apr 03 06:30:13.641988 2026] [:error] [pid 22778:tid 22801] [client 4.232.187.184:61868] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "ac7t9fS-q9hkdFqUjq-dwQAAANA"]
[Fri Apr 03 06:30:15.340405 2026] [:error] [pid 22673:tid 22764] [client 4.232.187.184:50547] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Apr 03 06:30:15.710248 2026] [:error] [pid 22673:tid 22760] [client 4.232.187.184:50547] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Apr 03 06:30:16.373451 2026] [:error] [pid 22673:tid 22749] [client 4.232.187.184:50547] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-x7.php
[Fri Apr 03 06:30:16.651438 2026] [:error] [pid 22673:tid 22746] [client 4.232.187.184:50547] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Fri Apr 03 06:30:17.011249 2026] [:error] [pid 22673:tid 22755] [client 4.232.187.184:50547] File does not exist: /usr/local/apache/htdocs/suspended-page/v4.php
[Fri Apr 03 06:30:17.261000 2026] [:error] [pid 22673:tid 22754] [client 4.232.187.184:50547] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ac7t-e-GlVDWdWxxwJCeUgAAAIg"]
[Fri Apr 03 06:30:18.101513 2026] [:error] [pid 22778:tid 22808] [client 4.232.187.184:38788] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ac7t-vS-q9hkdFqUjq-dzAAAANc"]
[Fri Apr 03 06:30:18.815386 2026] [:error] [pid 22778:tid 22791] [client 4.232.187.184:38405] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ac7t-vS-q9hkdFqUjq-d0AAAAMY"]
[Fri Apr 03 06:30:19.530068 2026] [:error] [pid 22673:tid 22758] [client 4.232.187.184:59995] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "ac7t---GlVDWdWxxwJCeXQAAAIw"]
[Fri Apr 03 06:30:20.154806 2026] [:error] [pid 22671:tid 22713] [client 4.232.187.184:47063] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "ac7t_CRuUnMW7r8hvyZZ3wAAABY"]
[Fri Apr 03 06:30:21.275650 2026] [:error] [pid 22673:tid 22746] [client 4.232.187.184:59980] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "ac7t_e-GlVDWdWxxwJCeYgAAAIA"]
[Fri Apr 03 06:30:22.089112 2026] [:error] [pid 22673:tid 22763] [client 4.232.187.184:60023] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "ac7t_u-GlVDWdWxxwJCeZAAAAJE"]
[Fri Apr 03 06:30:22.732743 2026] [:error] [pid 22778:tid 22785] [client 4.232.187.184:62444] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "ac7t_vS-q9hkdFqUjq-d1AAAAMA"]
[Fri Apr 03 06:30:23.480017 2026] [:error] [pid 22671:tid 22704] [client 4.232.187.184:57372] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "ac7t_yRuUnMW7r8hvyZZ5QAAAA0"]
[Fri Apr 03 06:30:24.194858 2026] [:error] [pid 22671:tid 22697] [client 4.232.187.184:3297] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "ac7uACRuUnMW7r8hvyZZ6QAAAAY"]
[Fri Apr 03 06:30:25.169299 2026] [:error] [pid 22778:tid 22806] [client 4.232.187.184:37211] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "ac7uAfS-q9hkdFqUjq-d4gAAANU"]
[Fri Apr 03 06:30:26.123808 2026] [:error] [pid 58590:tid 58602] [client 4.232.187.184:38454] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "ac7uAkze_aEPDM9xEE3nXQAAAQo"]
[Fri Apr 03 06:30:26.885969 2026] [:error] [pid 58590:tid 58615] [client 4.232.187.184:56270] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "ac7uAkze_aEPDM9xEE3nYQAAARc"]
[Fri Apr 03 06:30:27.525455 2026] [:error] [pid 58590:tid 58613] [client 4.232.187.184:56264] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "ac7uA0ze_aEPDM9xEE3nZQAAARU"]
[Fri Apr 03 06:30:28.452179 2026] [:error] [pid 22778:tid 22808] [client 4.232.187.184:53228] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "ac7uBPS-q9hkdFqUjq-d5wAAANc"]
[Fri Apr 03 06:30:29.198482 2026] [:error] [pid 22778:tid 22786] [client 4.232.187.184:61313] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "ac7uBfS-q9hkdFqUjq-d6AAAAME"]
[Fri Apr 03 06:30:29.947728 2026] [:error] [pid 22672:tid 22737] [client 4.232.187.184:63601] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ac7uBazrgXkFSOK0fvqY0wAAAFI"]
[Fri Apr 03 06:30:30.968337 2026] [:error] [pid 22672:tid 22720] [client 4.232.187.184:59973] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "ac7uBqzrgXkFSOK0fvqY1gAAAEE"]
[Fri Apr 03 06:30:31.788018 2026] [:error] [pid 22778:tid 22793] [client 4.232.187.184:28649] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "ac7uB_S-q9hkdFqUjq-d7wAAAMg"]
[Fri Apr 03 06:30:32.496093 2026] [:error] [pid 22671:tid 22714] [client 4.232.187.184:62404] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "ac7uCCRuUnMW7r8hvyZZ9wAAABc"]
[Fri Apr 03 06:30:33.259513 2026] [:error] [pid 22671:tid 22695] [client 4.232.187.184:28638] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "ac7uCSRuUnMW7r8hvyZZ_QAAAAQ"]
[Fri Apr 03 06:30:34.845821 2026] [:error] [pid 58590:tid 58613] [client 4.232.187.184:60015] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "ac7uCkze_aEPDM9xEE3nbgAAARU"]
[Fri Apr 03 06:30:36.165284 2026] [:error] [pid 58590:tid 58598] [client 4.232.187.184:38404] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "ac7uDEze_aEPDM9xEE3ndwAAAQY"]
[Fri Apr 03 06:30:38.638988 2026] [:error] [pid 58590:tid 58606] [client 4.232.187.184:52034] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "ac7uDkze_aEPDM9xEE3nhgAAAQ4"]
[Fri Apr 03 06:30:40.340783 2026] [:error] [pid 22673:tid 22765] [client 4.232.187.184:48576] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ext.php"] [unique_id "ac7uEO-GlVDWdWxxwJCefwAAAJM"]
[Fri Apr 03 06:30:43.424457 2026] [:error] [pid 22672:tid 22724] [client 4.232.187.184:43194] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "ac7uE6zrgXkFSOK0fvqY5gAAAEU"]
[Fri Apr 03 06:30:44.194667 2026] [:error] [pid 22778:tid 22795] [client 4.232.187.184:48604] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "ac7uFPS-q9hkdFqUjq-eDAAAAMo"]
[Fri Apr 03 06:30:44.992770 2026] [:error] [pid 22672:tid 22731] [client 4.232.187.184:28667] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "ac7uFKzrgXkFSOK0fvqY6gAAAEw"]
[Fri Apr 03 06:30:46.153591 2026] [:error] [pid 58590:tid 58592] [client 4.232.187.184:55378] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about3.php"] [unique_id "ac7uFkze_aEPDM9xEE3nmgAAAQA"]
[Fri Apr 03 06:30:47.215250 2026] [:error] [pid 22671:tid 22703] [client 4.232.187.184:59622] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac7uFyRuUnMW7r8hvyZaBAAAAAw"]
[Fri Apr 03 06:30:49.272068 2026] [:error] [pid 22673:tid 22766] [client 4.232.187.184:42615] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac7uGe-GlVDWdWxxwJCekAAAAJQ"]
[Fri Apr 03 06:30:50.673033 2026] [:error] [pid 22672:tid 22729] [client 4.232.187.184:59613] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac7uGqzrgXkFSOK0fvqY8AAAAEo"]
[Fri Apr 03 06:30:51.903855 2026] [:error] [pid 22671:tid 22715] [client 4.232.187.184:63820] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac7uGyRuUnMW7r8hvyZaDwAAABg"]
[Fri Apr 03 06:30:52.677099 2026] [:error] [pid 22671:tid 22701] [client 4.232.187.184:49297] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "ac7uHCRuUnMW7r8hvyZaEgAAAAo"]
[Fri Apr 03 06:30:53.483995 2026] [:error] [pid 22778:tid 22797] [client 4.232.187.184:49299] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "ac7uHfS-q9hkdFqUjq-eGwAAAMw"]
[Fri Apr 03 06:30:54.153001 2026] [:error] [pid 22672:tid 22726] [client 4.232.187.184:40119] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "ac7uHqzrgXkFSOK0fvqY_wAAAEc"]
[Fri Apr 03 06:30:54.836529 2026] [:error] [pid 58590:tid 58608] [client 4.232.187.184:55930] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "ac7uHkze_aEPDM9xEE3npQAAARA"]
[Fri Apr 03 06:30:55.550432 2026] [:error] [pid 22672:tid 22724] [client 4.232.187.184:42580] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ac7uH6zrgXkFSOK0fvqZAwAAAEU"]
[Fri Apr 03 06:30:56.070989 2026] [:error] [pid 22672:tid 22719] [client 4.232.187.184:49615] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ac7uIKzrgXkFSOK0fvqZBQAAAEA"]
[Fri Apr 03 06:30:56.722878 2026] [:error] [pid 58590:tid 58596] [client 4.232.187.184:63123] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ac7uIEze_aEPDM9xEE3nrgAAAQQ"]
[Fri Apr 03 06:30:57.636988 2026] [:error] [pid 22672:tid 22737] [client 4.232.187.184:40064] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "ac7uIazrgXkFSOK0fvqZBgAAAFI"]
[Fri Apr 03 06:30:58.533653 2026] [:error] [pid 58590:tid 58603] [client 4.232.187.184:56010] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "ac7uIkze_aEPDM9xEE3nuwAAAQs"]
[Fri Apr 03 06:30:59.896156 2026] [:error] [pid 22671:tid 22693] [client 4.232.187.184:40083] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "ac7uIyRuUnMW7r8hvyZaHQAAAAI"]
[Fri Apr 03 06:31:00.637054 2026] [:error] [pid 22672:tid 22743] [client 4.232.187.184:3234] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "ac7uJKzrgXkFSOK0fvqZEQAAAFg"]
[Fri Apr 03 06:31:01.586920 2026] [:error] [pid 22778:tid 22796] [client 4.232.187.184:3243] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "ac7uJfS-q9hkdFqUjq-eJQAAAMs"]
[Fri Apr 03 06:31:02.428977 2026] [:error] [pid 22673:tid 22751] [client 4.232.187.184:37158] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "ac7uJu-GlVDWdWxxwJCemAAAAIU"]
[Fri Apr 03 06:31:03.665421 2026] [:error] [pid 58590:tid 58603] [client 4.232.187.184:36591] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac7uJ0ze_aEPDM9xEE3n0QAAAQs"]
[Fri Apr 03 06:31:05.477725 2026] [:error] [pid 58590:tid 58600] [client 4.232.187.184:50998] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac7uKUze_aEPDM9xEE3n4QAAAQg"]
[Fri Apr 03 06:31:06.845362 2026] [:error] [pid 22672:tid 22733] [client 4.232.187.184:63108] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac7uKqzrgXkFSOK0fvqZHAAAAE4"]
[Fri Apr 03 06:31:11.806141 2026] [:error] [pid 33445:tid 33453] [client 4.232.187.184:49316] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "ac7uL1lRNZ0iDVmJWM2DzgAAAAM"]
[Fri Apr 03 06:31:12.717524 2026] [:error] [pid 33542:tid 33546] [client 4.232.187.184:43840] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac7uMHwb6uB1LaGtepb5FgAAAME"]
[Fri Apr 03 06:31:13.439740 2026] [:error] [pid 33445:tid 33474] [client 4.232.187.184:57994] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac7uMVlRNZ0iDVmJWM2D7wAAABg"]
[Fri Apr 03 06:31:14.471709 2026] [:error] [pid 33446:tid 33486] [client 4.232.187.184:50350] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac7uMtg3dCqFYIIdw0oTigAAAEk"]
[Fri Apr 03 06:31:15.452639 2026] [:error] [pid 33445:tid 33456] [client 4.232.187.184:58019] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "ac7uM1lRNZ0iDVmJWM2D9gAAAAY"]
[Fri Apr 03 06:31:16.949709 2026] [:error] [pid 33445:tid 33462] [client 4.232.187.184:63130] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/app/webroot/filemanager.php"] [unique_id "ac7uNFlRNZ0iDVmJWM2D-gAAAAw"]
[Fri Apr 03 06:31:17.973185 2026] [:error] [pid 33542:tid 33555] [client 4.232.187.184:63873] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "ac7uNXwb6uB1LaGtepb5LQAAAMo"]
[Fri Apr 03 06:31:18.848486 2026] [:error] [pid 33446:tid 33481] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Apr 03 06:31:19.117320 2026] [:error] [pid 33446:tid 33492] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Apr 03 06:31:20.149298 2026] [:error] [pid 33446:tid 33498] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/dlu.php
[Fri Apr 03 06:31:20.546496 2026] [:error] [pid 33446:tid 33497] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/555.php
[Fri Apr 03 06:31:20.822543 2026] [:error] [pid 33446:tid 33500] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Apr 03 06:31:21.064130 2026] [:error] [pid 33446:tid 33479] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Fri Apr 03 06:31:21.332822 2026] [:error] [pid 33446:tid 33484] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Fri Apr 03 06:31:21.624622 2026] [:error] [pid 33446:tid 33481] [client 4.232.187.184:43370] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Apr 03 06:31:21.856984 2026] [:error] [pid 33446:tid 33477] [client 4.232.187.184:43370] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hook.php"] [unique_id "ac7uOdg3dCqFYIIdw0oTpwAAAEA"]
[Fri Apr 03 06:31:23.061522 2026] [:error] [pid 33445:tid 33462] [client 4.232.187.184:60999] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hook.php"] [unique_id "ac7uO1lRNZ0iDVmJWM2EFwAAAAw"]
[Fri Apr 03 06:31:24.645992 2026] [:error] [pid 33542:tid 33560] [client 4.232.187.184:52568] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hook.php"] [unique_id "ac7uPHwb6uB1LaGtepb5UQAAAM8"]
[Fri Apr 03 06:31:26.500832 2026] [:error] [pid 33447:tid 33523] [client 4.232.187.184:43909] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hook.php"] [unique_id "ac7uPkgaPmDHz92j4lOLpQAAAJM"]
[Fri Apr 03 06:31:27.681101 2026] [:error] [pid 33542:tid 33559] [client 4.232.187.184:61020] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "ac7uP3wb6uB1LaGtepb5XQAAAM4"]
[Fri Apr 03 06:31:32.896572 2026] [:error] [pid 33542:tid 33559] [client 4.232.187.184:52844] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "ac7uRHwb6uB1LaGtepb5fAAAAM4"]
[Fri Apr 03 06:31:34.247868 2026] [:error] [pid 33446:tid 33496] [client 4.232.187.184:36985] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "ac7uRtg3dCqFYIIdw0oTvgAAAFM"]
[Fri Apr 03 06:31:36.091155 2026] [:error] [pid 33542:tid 33557] [client 4.232.187.184:42672] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "ac7uSHwb6uB1LaGtepb5iQAAAMw"]
[Fri Apr 03 06:31:41.396342 2026] [:error] [pid 33445:tid 33474] [client 4.232.187.184:56834] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac7uTVlRNZ0iDVmJWM2EQwAAABg"]
[Fri Apr 03 06:31:43.300463 2026] [:error] [pid 33446:tid 33492] [client 4.232.187.184:44639] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac7uT9g3dCqFYIIdw0oTxwAAAE8"]
[Fri Apr 03 06:31:45.365212 2026] [:error] [pid 33542:tid 33562] [client 4.232.187.184:3916] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac7uUXwb6uB1LaGtepb5oQAAANE"]
[Fri Apr 03 06:31:46.701346 2026] [:error] [pid 33542:tid 33555] [client 4.232.187.184:52581] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "ac7uUnwb6uB1LaGtepb5qwAAAMo"]
[Fri Apr 03 06:31:49.148687 2026] [:error] [pid 33542:tid 33562] [client 4.232.187.184:44624] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "ac7uVXwb6uB1LaGtepb5ugAAANE"]
[Fri Apr 03 06:31:53.467810 2026] [:error] [pid 33445:tid 33472] [client 4.232.187.184:50318] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "ac7uWVlRNZ0iDVmJWM2EXQAAABY"]
[Fri Apr 03 06:31:56.217607 2026] [:error] [pid 33445:tid 33464] [client 4.232.187.184:44584] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "ac7uXFlRNZ0iDVmJWM2EZAAAAA4"]
[Fri Apr 03 06:31:58.932253 2026] [:error] [pid 33445:tid 33452] [client 4.232.187.184:46118] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "ac7uXllRNZ0iDVmJWM2EaQAAAAI"]
[Fri Apr 03 06:31:59.988076 2026] [:error] [pid 33445:tid 33460] [client 4.232.187.184:56225] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/te.php"] [unique_id "ac7uX1lRNZ0iDVmJWM2EbgAAAAo"]
[Fri Apr 03 06:32:00.781941 2026] [:error] [pid 33445:tid 33453] [client 4.232.187.184:56149] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/te.php"] [unique_id "ac7uYFlRNZ0iDVmJWM2EcgAAAAM"]
[Fri Apr 03 06:32:02.014374 2026] [:error] [pid 33542:tid 33556] [client 4.232.187.184:29559] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/te.php"] [unique_id "ac7uYnwb6uB1LaGtepb57wAAAMs"]
[Fri Apr 03 06:32:02.993382 2026] [:error] [pid 33446:tid 33480] [client 4.232.187.184:52547] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/te.php"] [unique_id "ac7uYtg3dCqFYIIdw0oT2AAAAEM"]
[Fri Apr 03 06:32:03.849164 2026] [:error] [pid 33542:tid 33561] [client 4.232.187.184:49747] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "ac7uY3wb6uB1LaGtepb5-gAAANA"]
[Fri Apr 03 06:32:05.331552 2026] [:error] [pid 33542:tid 33547] [client 4.232.187.184:61039] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "ac7uZXwb6uB1LaGtepb6BgAAAMI"]
[Fri Apr 03 06:32:06.699146 2026] [:error] [pid 33542:tid 33565] [client 4.232.187.184:42655] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "ac7uZnwb6uB1LaGtepb6EwAAANQ"]
[Fri Apr 03 06:32:07.839921 2026] [:error] [pid 33542:tid 33546] [client 4.232.187.184:42687] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "ac7uZ3wb6uB1LaGtepb6GgAAAME"]
[Fri Apr 03 06:32:08.953012 2026] [:error] [pid 33542:tid 33564] [client 4.232.187.184:64120] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "ac7uaHwb6uB1LaGtepb6IQAAANM"]
[Fri Apr 03 06:32:10.188076 2026] [:error] [pid 33542:tid 33565] [client 4.232.187.184:34036] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "ac7uanwb6uB1LaGtepb6LgAAANQ"]
[Fri Apr 03 06:32:11.135757 2026] [:error] [pid 33542:tid 33555] [client 4.232.187.184:49736] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "ac7ua3wb6uB1LaGtepb6NwAAAMo"]
[Fri Apr 03 06:32:12.224381 2026] [:error] [pid 33447:tid 33508] [client 4.232.187.184:54568] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "ac7ubEgaPmDHz92j4lOL5QAAAIQ"]
[Fri Apr 03 06:32:13.280834 2026] [:error] [pid 33445:tid 33460] [client 4.232.187.184:42682] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "ac7ubVlRNZ0iDVmJWM2EiQAAAAo"]
[Fri Apr 03 06:32:14.190726 2026] [:error] [pid 33445:tid 33469] [client 4.232.187.184:52601] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "ac7ubllRNZ0iDVmJWM2EjQAAABM"]
[Fri Apr 03 06:32:15.384734 2026] [:error] [pid 33445:tid 33458] [client 4.232.187.184:51644] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "ac7ub1lRNZ0iDVmJWM2EkQAAAAg"]
[Fri Apr 03 06:32:16.581936 2026] [:error] [pid 33542:tid 33555] [client 4.232.187.184:45407] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "ac7ucHwb6uB1LaGtepb6WAAAAMo"]
[Fri Apr 03 06:32:17.605787 2026] [:error] [pid 33447:tid 33514] [client 4.232.187.184:43902] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "ac7ucUgaPmDHz92j4lOL8QAAAIo"]
[Fri Apr 03 06:32:19.004387 2026] [:error] [pid 33447:tid 33511] [client 4.232.187.184:45380] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "ac7uc0gaPmDHz92j4lOL-gAAAIc"]
[Fri Apr 03 06:32:20.372491 2026] [:error] [pid 33447:tid 33527] [client 4.232.187.184:44650] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "ac7udEgaPmDHz92j4lOMAAAAAJc"]
[Fri Apr 03 06:32:21.178080 2026] [:error] [pid 33447:tid 33510] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Apr 03 06:32:21.448963 2026] [:error] [pid 33447:tid 33506] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Apr 03 06:32:21.941764 2026] [:error] [pid 33447:tid 33507] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Apr 03 06:32:22.341380 2026] [:error] [pid 33447:tid 33514] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Fri Apr 03 06:32:22.694048 2026] [:error] [pid 33447:tid 33504] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Fri Apr 03 06:32:23.284169 2026] [:error] [pid 33447:tid 33524] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/shoha.php
[Fri Apr 03 06:32:23.557752 2026] [:error] [pid 33447:tid 33506] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Apr 03 06:32:23.982341 2026] [:error] [pid 33447:tid 33507] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Apr 03 06:32:24.281243 2026] [:error] [pid 33447:tid 33526] [client 4.232.187.184:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Fri Apr 03 06:32:24.631878 2026] [:error] [pid 33447:tid 33504] [client 4.232.187.184:52807] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ac7ueEgaPmDHz92j4lOMGwAAAIA"]
[Fri Apr 03 06:32:25.392844 2026] [:error] [pid 33447:tid 33512] [client 4.232.187.184:52583] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ac7ueUgaPmDHz92j4lOMHQAAAIg"]
[Fri Apr 03 06:32:26.163954 2026] [:error] [pid 33446:tid 33501] [client 4.232.187.184:56884] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ac7uetg3dCqFYIIdw0oT-gAAAFg"]
[Fri Apr 03 06:32:26.918429 2026] [:error] [pid 33542:tid 33560] [client 4.232.187.184:29506] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "ac7uenwb6uB1LaGtepb6hQAAAM8"]
[Fri Apr 03 06:32:27.915891 2026] [:error] [pid 33445:tid 33462] [client 4.232.187.184:60997] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mo.php"] [unique_id "ac7ue1lRNZ0iDVmJWM2EnwAAAAw"]
[Fri Apr 03 06:32:28.731926 2026] [:error] [pid 33445:tid 33450] [client 4.232.187.184:61046] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mo.php"] [unique_id "ac7ufFlRNZ0iDVmJWM2EowAAAAA"]
[Fri Apr 03 06:32:30.293758 2026] [:error] [pid 33446:tid 33480] [client 4.232.187.184:50365] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mo.php"] [unique_id "ac7uftg3dCqFYIIdw0oUAQAAAEM"]
[Fri Apr 03 06:32:31.323202 2026] [:error] [pid 33445:tid 33461] [client 4.232.187.184:51642] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mo.php"] [unique_id "ac7uf1lRNZ0iDVmJWM2EqgAAAAs"]
[Fri Apr 03 06:32:32.457296 2026] [:error] [pid 33542:tid 33557] [client 4.232.187.184:44652] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "ac7ugHwb6uB1LaGtepb6qAAAAMw"]
[Fri Apr 03 06:32:34.860360 2026] [:error] [pid 33447:tid 33521] [client 4.232.187.184:43854] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "ac7ugkgaPmDHz92j4lOMMQAAAJE"]
[Fri Apr 03 06:32:36.986233 2026] [:error] [pid 33542:tid 33555] [client 4.232.187.184:63105] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "ac7uhHwb6uB1LaGtepb6xgAAAMo"]
[Fri Apr 03 06:32:39.951274 2026] [:error] [pid 33445:tid 33470] [client 4.232.187.184:43893] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/doc.php"] [unique_id "ac7uh1lRNZ0iDVmJWM2EsQAAABQ"]
[Fri Apr 03 06:32:41.451479 2026] [:error] [pid 33446:tid 33496] [client 4.232.187.184:55667] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "ac7uidg3dCqFYIIdw0oUDAAAAFM"]
[Fri Apr 03 06:32:42.358650 2026] [:error] [pid 33445:tid 33473] [client 4.232.187.184:45358] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "ac7uillRNZ0iDVmJWM2EtgAAABc"]
[Fri Apr 03 06:32:43.235297 2026] [:error] [pid 33447:tid 33527] [client 4.232.187.184:43695] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "ac7ui0gaPmDHz92j4lOMRgAAAJc"]
[Fri Apr 03 06:32:44.092331 2026] [:error] [pid 33446:tid 33499] [client 4.232.187.184:45493] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inde.php"] [unique_id "ac7ujNg3dCqFYIIdw0oUEwAAAFY"]
[Fri Apr 03 06:32:44.876758 2026] [:error] [pid 33446:tid 33477] [client 4.232.187.184:39632] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "ac7ujNg3dCqFYIIdw0oUGAAAAEA"]
[Fri Apr 03 06:32:45.975730 2026] [:error] [pid 33446:tid 33487] [client 4.232.187.184:47336] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "ac7ujdg3dCqFYIIdw0oUIQAAAEo"]
[Fri Apr 03 06:32:47.916180 2026] [:error] [pid 33542:tid 33546] [client 4.232.187.184:63882] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "ac7uj3wb6uB1LaGtepb61AAAAME"]
[Fri Apr 03 06:32:50.039668 2026] [:error] [pid 33446:tid 33496] [client 4.232.187.184:56003] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "ac7uktg3dCqFYIIdw0oUKQAAAFM"]
[Fri Apr 03 06:32:51.057975 2026] [:error] [pid 33446:tid 33493] [client 4.232.187.184:48630] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac7uk9g3dCqFYIIdw0oULgAAAFA"]
[Fri Apr 03 06:32:56.418056 2026] [:error] [pid 33542:tid 33561] [client 4.232.187.184:63590] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac7umHwb6uB1LaGtepb63gAAANA"]
[Fri Apr 03 06:32:57.656531 2026] [:error] [pid 33445:tid 33457] [client 4.232.187.184:35614] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac7umVlRNZ0iDVmJWM2E4QAAAAc"]
[Fri Apr 03 06:33:00.602027 2026] [:error] [pid 33446:tid 33487] [client 4.232.187.184:35603] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "ac7unNg3dCqFYIIdw0oUOQAAAEo"]
[Fri Apr 03 06:33:02.173309 2026] [:error] [pid 33445:tid 33454] [client 4.232.187.184:31046] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "ac7unllRNZ0iDVmJWM2E8wAAAAQ"]
[Fri Apr 03 06:33:04.055319 2026] [:error] [pid 33542:tid 33547] [client 4.232.187.184:32535] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "ac7uoHwb6uB1LaGtepb68AAAAMI"]
[Fri Apr 03 06:33:06.108161 2026] [:error] [pid 33445:tid 33468] [client 4.232.187.184:45100] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "ac7uollRNZ0iDVmJWM2E_gAAABI"]
[Fri Apr 03 06:33:06.980643 2026] [:error] [pid 33446:tid 33491] [client 4.232.187.184:52098] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zxin.php"] [unique_id "ac7uotg3dCqFYIIdw0oUQwAAAE4"]
[Fri Apr 03 06:33:07.900413 2026] [:error] [pid 33542:tid 33562] [client 4.232.187.184:62647] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "ac7uo3wb6uB1LaGtepb6-QAAANE"]
[Fri Apr 03 06:33:08.737289 2026] [:error] [pid 33447:tid 33523] [client 4.232.187.184:52106] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "ac7upEgaPmDHz92j4lOMbwAAAJM"]
[Fri Apr 03 06:33:09.503110 2026] [:error] [pid 33447:tid 33511] [client 4.232.187.184:62616] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "ac7upUgaPmDHz92j4lOMcgAAAIc"]
[Fri Apr 03 06:33:10.170178 2026] [:error] [pid 33446:tid 33488] [client 4.232.187.184:60316] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "ac7uptg3dCqFYIIdw0oURwAAAEs"]
[Fri Apr 03 06:33:11.073083 2026] [:error] [pid 33446:tid 33483] [client 4.232.187.184:56920] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "ac7up9g3dCqFYIIdw0oUSgAAAEY"]
[Fri Apr 03 06:33:12.019589 2026] [:error] [pid 33447:tid 33513] [client 4.232.187.184:60713] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "ac7uqEgaPmDHz92j4lOMegAAAIk"]
[Fri Apr 03 06:33:12.835893 2026] [:error] [pid 33447:tid 33517] [client 4.232.187.184:28988] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "ac7uqEgaPmDHz92j4lOMfQAAAI0"]
[Fri Apr 03 06:33:14.526447 2026] [:error] [pid 33445:tid 33473] [client 4.232.187.184:36797] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NewFile.php"] [unique_id "ac7uqllRNZ0iDVmJWM2FDwAAABc"]
[Fri Apr 03 06:33:16.107344 2026] [:error] [pid 33542:tid 33545] [client 4.232.187.184:48520] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac7urHwb6uB1LaGtepb7BgAAAMA"]
[Fri Apr 03 06:33:18.199800 2026] [:error] [pid 33542:tid 33563] [client 4.232.187.184:48549] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac7urnwb6uB1LaGtepb7DgAAANI"]
[Fri Apr 03 06:33:20.084103 2026] [:error] [pid 33542:tid 33559] [client 4.232.187.184:27533] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac7usHwb6uB1LaGtepb7FQAAAM4"]
[Fri Apr 03 06:33:21.170781 2026] [:error] [pid 33447:tid 33526] [client 4.232.187.184:27533] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "ac7usUgaPmDHz92j4lOMjAAAAJY"]
[Fri Apr 03 06:33:23.137385 2026] [:error] [pid 33447:tid 33510] [client 4.232.187.184:27604] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolv2.php"] [unique_id "ac7us0gaPmDHz92j4lOMlAAAAIY"]
[Fri Apr 03 06:33:24.170084 2026] [:error] [pid 33447:tid 33516] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv2.php
[Fri Apr 03 06:33:24.568151 2026] [:error] [pid 33447:tid 33522] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/geck.php
[Fri Apr 03 06:33:24.928742 2026] [:error] [pid 33447:tid 33508] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/xtt.php
[Fri Apr 03 06:33:25.171219 2026] [:error] [pid 33447:tid 33519] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Apr 03 06:33:25.646907 2026] [:error] [pid 33447:tid 33525] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Fri Apr 03 06:33:26.025576 2026] [:error] [pid 33447:tid 33528] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Apr 03 06:33:26.260911 2026] [:error] [pid 33447:tid 33526] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Fri Apr 03 06:33:27.174590 2026] [:error] [pid 33447:tid 33517] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Fri Apr 03 06:33:27.724766 2026] [:error] [pid 33447:tid 33523] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Fri Apr 03 06:33:28.216265 2026] [:error] [pid 33447:tid 33509] [client 4.232.187.184:32815] File does not exist: /usr/local/apache/htdocs/suspended-page/admir.php
[Fri Apr 03 06:33:28.872990 2026] [:error] [pid 33447:tid 33525] [client 4.232.187.184:32815] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "ac7uuEgaPmDHz92j4lOMsQAAAJU"]
[Fri Apr 03 06:33:31.851978 2026] [:error] [pid 33445:tid 33462] [client 4.232.187.184:45652] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "ac7uu1lRNZ0iDVmJWM2FHgAAAAw"]
[Fri Apr 03 06:33:33.137537 2026] [:error] [pid 33445:tid 33458] [client 4.232.187.184:51549] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "ac7uvVlRNZ0iDVmJWM2FIwAAAAg"]
[Fri Apr 03 06:33:34.109598 2026] [:error] [pid 33447:tid 33505] [client 4.232.187.184:48513] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "ac7uvkgaPmDHz92j4lOMuQAAAIE"]
[Fri Apr 03 06:33:43.447136 2026] [:error] [pid 33447:tid 33524] [client 4.232.187.184:51566] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error.php"] [unique_id "ac7ux0gaPmDHz92j4lOMywAAAJQ"]
[Fri Apr 03 06:35:39.101986 2026] [:error] [pid 33446:tid 33500] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/bkxzo.php
[Fri Apr 03 06:35:39.448341 2026] [:error] [pid 33446:tid 33493] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/lo.php
[Fri Apr 03 06:35:39.686112 2026] [:error] [pid 33446:tid 33486] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Apr 03 06:35:39.922019 2026] [:error] [pid 33446:tid 33483] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Fri Apr 03 06:35:40.399053 2026] [:error] [pid 33446:tid 33492] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/lmutxdvyp7u5yksqke8ozbjgCdefault.php
[Fri Apr 03 06:35:41.159609 2026] [:error] [pid 33446:tid 33491] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Apr 03 06:35:41.556704 2026] [:error] [pid 33446:tid 33484] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Fri Apr 03 06:35:41.792316 2026] [:error] [pid 33446:tid 33496] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Fri Apr 03 06:35:42.031439 2026] [:error] [pid 33446:tid 33481] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Apr 03 06:35:42.351597 2026] [:error] [pid 33446:tid 33498] [client 4.232.187.184:52100] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Fri Apr 03 06:35:42.584778 2026] [:error] [pid 33446:tid 33485] [client 4.232.187.184:52100] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ac7vPtg3dCqFYIIdw0oU-AAAAEg"]
[Fri Apr 03 06:35:44.724443 2026] [:error] [pid 33542:tid 33558] [client 4.232.187.184:47351] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ac7vQHwb6uB1LaGtepb8pAAAAM0"]
[Fri Apr 03 06:35:46.675958 2026] [:error] [pid 33445:tid 33462] [client 4.232.187.184:38972] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ac7vQllRNZ0iDVmJWM2GTgAAAAw"]
[Fri Apr 03 06:35:49.234615 2026] [:error] [pid 33542:tid 33562] [client 4.232.187.184:56367] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ac7vRXwb6uB1LaGtepb8rgAAANE"]
[Fri Apr 03 06:35:51.174164 2026] [:error] [pid 33542:tid 33561] [client 4.232.187.184:56347] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "ac7vR3wb6uB1LaGtepb8swAAANA"]
[Fri Apr 03 06:35:53.514284 2026] [:error] [pid 33542:tid 33558] [client 4.232.187.184:43217] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "ac7vSXwb6uB1LaGtepb8vQAAAM0"]
[Fri Apr 03 06:35:55.401522 2026] [:error] [pid 33447:tid 33504] [client 4.232.187.184:58101] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "ac7vS0gaPmDHz92j4lONkwAAAIA"]
[Fri Apr 03 06:35:56.579336 2026] [:error] [pid 33445:tid 33465] [client 4.232.187.184:38970] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gg.php"] [unique_id "ac7vTFlRNZ0iDVmJWM2GXwAAAA8"]
[Fri Apr 03 06:35:58.958187 2026] [:error] [pid 33446:tid 33490] [client 4.232.187.184:41796] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac7vTtg3dCqFYIIdw0oVCQAAAE0"]
[Fri Apr 03 06:35:59.781134 2026] [:error] [pid 33445:tid 33463] [client 4.232.187.184:38968] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac7vT1lRNZ0iDVmJWM2GZQAAAA0"]
[Fri Apr 03 06:36:00.498108 2026] [:error] [pid 33542:tid 33551] [client 4.232.187.184:52881] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac7vUHwb6uB1LaGtepb8xAAAAMY"]
[Fri Apr 03 06:36:01.482422 2026] [:error] [pid 33542:tid 33566] [client 4.232.187.184:52113] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac7vUXwb6uB1LaGtepb8xgAAANU"]
[Fri Apr 03 06:36:02.623722 2026] [:error] [pid 33446:tid 33479] [client 4.232.187.184:41848] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "ac7vUtg3dCqFYIIdw0oVCwAAAEI"]
[Fri Apr 03 06:36:03.459409 2026] [:error] [pid 33542:tid 33554] [client 4.232.187.184:3673] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "ac7vU3wb6uB1LaGtepb8zgAAAMk"]
[Fri Apr 03 06:36:05.062494 2026] [:error] [pid 33542:tid 33555] [client 4.232.187.184:36538] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "ac7vVXwb6uB1LaGtepb81gAAAMo"]
[Fri Apr 03 06:36:06.830013 2026] [:error] [pid 33445:tid 33474] [client 4.232.187.184:51403] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/himu.php"] [unique_id "ac7vVllRNZ0iDVmJWM2GcQAAABg"]
[Fri Apr 03 06:36:08.165814 2026] [:error] [pid 33446:tid 33487] [client 4.232.187.184:39570] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "ac7vWNg3dCqFYIIdw0oVDQAAAEo"]
[Fri Apr 03 06:36:10.569002 2026] [:error] [pid 33542:tid 33545] [client 4.232.187.184:52901] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "ac7vWnwb6uB1LaGtepb86AAAAMA"]
[Fri Apr 03 06:36:11.705739 2026] [:error] [pid 33445:tid 33458] [client 4.232.187.184:36506] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "ac7vW1lRNZ0iDVmJWM2GfgAAAAg"]
[Fri Apr 03 06:36:13.420437 2026] [:error] [pid 33447:tid 33518] [client 4.232.187.184:49598] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z.php"] [unique_id "ac7vXUgaPmDHz92j4lONtwAAAI4"]
[Fri Apr 03 06:36:15.517041 2026] [:error] [pid 33447:tid 33506] [client 4.232.187.184:44603] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "ac7vX0gaPmDHz92j4lONvgAAAII"]
[Fri Apr 03 06:36:17.155255 2026] [:error] [pid 33446:tid 33480] [client 4.232.187.184:54567] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "ac7vYdg3dCqFYIIdw0oVFwAAAEM"]
[Fri Apr 03 06:36:18.750935 2026] [:error] [pid 33447:tid 33523] [client 4.232.187.184:28265] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "ac7vYkgaPmDHz92j4lONyQAAAJM"]
[Fri Apr 03 06:36:19.778994 2026] [:error] [pid 33446:tid 33485] [client 4.232.187.184:41797] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/png.php"] [unique_id "ac7vY9g3dCqFYIIdw0oVIQAAAEg"]
[Fri Apr 03 06:36:21.101819 2026] [:error] [pid 33542:tid 33546] [client 4.232.187.184:46991] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "ac7vZXwb6uB1LaGtepb88gAAAME"]
[Fri Apr 03 06:36:22.368951 2026] [:error] [pid 33446:tid 33487] [client 4.232.187.184:41842] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "ac7vZtg3dCqFYIIdw0oVKAAAAEo"]
[Fri Apr 03 06:36:24.957064 2026] [:error] [pid 33542:tid 33564] [client 4.232.187.184:43259] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "ac7vaHwb6uB1LaGtepb8-AAAANM"]
[Fri Apr 03 06:36:27.136144 2026] [:error] [pid 33542:tid 33557] [client 4.232.187.184:58721] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mds.php"] [unique_id "ac7va3wb6uB1LaGtepb8_gAAAMw"]
[Fri Apr 03 06:36:28.766319 2026] [:error] [pid 33446:tid 33496] [client 4.232.187.184:58747] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac7vbNg3dCqFYIIdw0oVKwAAAFM"]
[Fri Apr 03 06:36:30.994920 2026] [:error] [pid 33447:tid 33528] [client 4.232.187.184:43200] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac7vbkgaPmDHz92j4lON1wAAAJg"]
[Fri Apr 03 06:36:33.624870 2026] [:error] [pid 33542:tid 33556] [client 4.232.187.184:52853] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac7vcXwb6uB1LaGtepb9CwAAAMs"]
[Fri Apr 03 06:36:34.711201 2026] [:error] [pid 33446:tid 33497] [client 4.232.187.184:52821] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "ac7vctg3dCqFYIIdw0oVMwAAAFQ"]
[Fri Apr 03 06:36:36.208699 2026] [:error] [pid 33542:tid 33555] [client 4.232.187.184:56232] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "ac7vdHwb6uB1LaGtepb9GQAAAMo"]
[Fri Apr 03 06:36:37.478413 2026] [:error] [pid 33542:tid 33560] [client 4.232.187.184:52842] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "ac7vdXwb6uB1LaGtepb9IQAAAM8"]
[Fri Apr 03 06:36:38.873668 2026] [:error] [pid 33445:tid 33469] [client 4.232.187.184:34001] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "ac7vdllRNZ0iDVmJWM2GtwAAABM"]
[Fri Apr 03 06:36:39.908805 2026] [:error] [pid 33446:tid 33489] [client 4.232.187.184:63228] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "ac7vd9g3dCqFYIIdw0oVNQAAAEw"]
[Fri Apr 03 06:36:41.146275 2026] [:error] [pid 33542:tid 33551] [client 4.232.187.184:3662] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-is.php"] [unique_id "ac7veXwb6uB1LaGtepb9MQAAAMY"]
[Fri Apr 03 06:36:42.244349 2026] [:error] [pid 33542:tid 33560] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-is.php
[Fri Apr 03 06:36:42.490083 2026] [:error] [pid 33542:tid 33566] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/file15.php
[Fri Apr 03 06:36:42.794828 2026] [:error] [pid 33542:tid 33559] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Fri Apr 03 06:36:43.029066 2026] [:error] [pid 33542:tid 33551] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Apr 03 06:36:43.472457 2026] [:error] [pid 33542:tid 33564] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Apr 03 06:36:43.717375 2026] [:error] [pid 33542:tid 33565] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri Apr 03 06:36:44.015279 2026] [:error] [pid 33542:tid 33561] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/lol.php
[Fri Apr 03 06:36:44.362246 2026] [:error] [pid 33542:tid 33554] [client 4.232.187.184:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Apr 03 08:46:03.557496 2026] [:error] [pid 33542:tid 33559] [client 122.173.28.251:27831] [client 122.173.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.173.28.251, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac8Ny3wb6uB1LaGtepZL8AAAAM4"]
[Fri Apr 03 08:46:03.564655 2026] [:error] [pid 33542:tid 33559] [client 122.173.28.251:27831] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 03 11:02:18.601627 2026] [:error] [pid 33445:tid 33455] [client 164.138.84.72:42290] [client 164.138.84.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.138.84.72, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac8tullRNZ0iDVmJWM28QAAAAAU"]
[Fri Apr 03 11:02:18.606501 2026] [:error] [pid 33445:tid 33455] [client 164.138.84.72:42290] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 03 14:10:01.374901 2026] [:error] [pid 40562:tid 40577] [client 136.232.146.50:54005] [client 136.232.146.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.146.50, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac9ZuTfFMXuP9zvqCeoABwAAAYw"]
[Fri Apr 03 14:10:01.382475 2026] [:error] [pid 40562:tid 40577] [client 136.232.146.50:54005] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 03 15:00:29.161997 2026] [:error] [pid 33446:tid 33484] [client 14.166.143.31:61981] [client 14.166.143.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.166.143.31, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac9ljdg3dCqFYIIdw0qtpAAAAEc"]
[Fri Apr 03 15:00:29.166855 2026] [:error] [pid 33446:tid 33484] [client 14.166.143.31:61981] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 03 17:51:31.165341 2026] [:error] [pid 33447:tid 33514] [client 74.56.244.59:50591] [client 74.56.244.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.56.244.59, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac-No0gaPmDHz92j4lMYwwAAAIo"]
[Fri Apr 03 17:51:31.169420 2026] [:error] [pid 33447:tid 33514] [client 74.56.244.59:50591] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 03 22:05:06.110071 2026] [:error] [pid 33445:tid 33457] [client 45.92.1.144:51045] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Fri Apr 03 22:05:07.092939 2026] [:error] [pid 40533:tid 40547] [client 45.92.1.144:57974] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ac_JE_bIAA8AViDmwsu7cwAAAUw"]
[Fri Apr 03 22:05:07.572304 2026] [:error] [pid 40533:tid 40546] [client 45.92.1.144:64999] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ac_JE_bIAA8AViDmwsu7dgAAAUs"]
[Fri Apr 03 22:05:08.059575 2026] [:error] [pid 33447:tid 33520] [client 45.92.1.144:61268] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ac_JFEgaPmDHz92j4lNYXwAAAJA"]
[Fri Apr 03 22:05:09.035928 2026] [:error] [pid 33445:tid 33470] [client 45.92.1.144:63503] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/txets.php"] [unique_id "ac_JFVlRNZ0iDVmJWM0hPAAAABQ"]
[Fri Apr 03 22:05:09.524969 2026] [:error] [pid 40533:tid 40538] [client 45.92.1.144:49749] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Fri Apr 03 22:05:10.007285 2026] [:error] [pid 35469:tid 35476] [client 45.92.1.144:58670] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Fri Apr 03 23:39:28.790113 2026] [:error] [pid 33446:tid 33488] [client 20.250.11.224:1071] File does not exist: /usr/local/apache/htdocs/suspended-page/wpb.php
[Fri Apr 03 23:51:23.643288 2026] [:error] [pid 33447:tid 33515] [client 112.213.236.79:27333] [client 112.213.236.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.213.236.79, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ac_h-0gaPmDHz92j4lNrIgAAAIs"]
[Fri Apr 03 23:51:23.648128 2026] [:error] [pid 33447:tid 33515] [client 112.213.236.79:27333] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 01:28:30.149014 2026] [:error] [pid 12081:tid 12119] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Sat Apr 04 01:28:30.409282 2026] [:error] [pid 12081:tid 12101] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Sat Apr 04 01:28:30.674287 2026] [:error] [pid 12081:tid 12108] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Sat Apr 04 01:28:30.936169 2026] [:error] [pid 12081:tid 12104] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Sat Apr 04 01:28:31.198114 2026] [:error] [pid 12081:tid 12111] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sat Apr 04 01:28:31.459669 2026] [:error] [pid 12081:tid 12100] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Sat Apr 04 01:28:31.727690 2026] [:error] [pid 12081:tid 12121] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Sat Apr 04 01:28:31.988272 2026] [:error] [pid 12081:tid 12110] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Sat Apr 04 01:28:32.249572 2026] [:error] [pid 12081:tid 12101] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/only.php
[Sat Apr 04 01:28:32.509573 2026] [:error] [pid 12081:tid 12116] [client 20.215.254.185:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/t2gorhwasq4vioshtatw5eCdefault.php
[Sat Apr 04 01:28:32.776826 2026] [:error] [pid 12081:tid 12108] [client 20.215.254.185:65444] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac_4wKMJBCYerZTQdmL_rwAAAEg"]
[Sat Apr 04 01:28:33.320653 2026] [:error] [pid 12097:tid 12170] [client 20.215.254.185:62913] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac_4wRnkcvJ01y2CY3mxPgAAAM8"]
[Sat Apr 04 01:28:34.020362 2026] [:error] [pid 12081:tid 12108] [client 20.215.254.185:65495] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac_4wqMJBCYerZTQdmL_uQAAAEg"]
[Sat Apr 04 01:28:34.530197 2026] [:error] [pid 12233:tid 12259] [client 20.215.254.185:62918] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "ac_4whQDAzkmdfiSgI2plAAAARg"]
[Sat Apr 04 01:28:35.046505 2026] [:error] [pid 12081:tid 12101] [client 20.215.254.185:62933] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "ac_4w6MJBCYerZTQdmL_wAAAAEE"]
[Sat Apr 04 01:28:35.709777 2026] [:error] [pid 12233:tid 12252] [client 20.215.254.185:62875] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "ac_4wxQDAzkmdfiSgI2pmQAAARE"]
[Sat Apr 04 01:28:36.233262 2026] [:error] [pid 12097:tid 12168] [client 20.215.254.185:62885] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "ac_4xBnkcvJ01y2CY3mxQgAAAM0"]
[Sat Apr 04 01:28:36.749056 2026] [:error] [pid 12081:tid 12106] [client 20.215.254.185:62927] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "ac_4xKMJBCYerZTQdmL_yAAAAEY"]
[Sat Apr 04 01:28:37.328516 2026] [:error] [pid 12233:tid 12246] [client 20.215.254.185:62850] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "ac_4xRQDAzkmdfiSgI2pnQAAAQs"]
[Sat Apr 04 01:28:37.892451 2026] [:error] [pid 12233:tid 12254] [client 20.215.254.185:65438] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_4xRQDAzkmdfiSgI2poQAAARM"]
[Sat Apr 04 01:28:38.465521 2026] [:error] [pid 12233:tid 12259] [client 20.215.254.185:62929] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_4xhQDAzkmdfiSgI2ppAAAARg"]
[Sat Apr 04 01:28:38.995142 2026] [:error] [pid 12233:tid 12235] [client 20.215.254.185:62924] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_4xhQDAzkmdfiSgI2pqwAAAQA"]
[Sat Apr 04 01:28:39.534180 2026] [:error] [pid 12089:tid 12130] [client 20.215.254.185:65441] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_4x0SCG1Z_hi7I_jJqxQAAAIM"]
[Sat Apr 04 01:28:40.057452 2026] [:error] [pid 12233:tid 12246] [client 20.215.254.185:62863] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "ac_4yBQDAzkmdfiSgI2psAAAAQs"]
[Sat Apr 04 01:28:40.605571 2026] [:error] [pid 12233:tid 12253] [client 20.215.254.185:65488] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "ac_4yBQDAzkmdfiSgI2psgAAARI"]
[Sat Apr 04 01:28:41.591727 2026] [:error] [pid 12097:tid 12179] [client 20.215.254.185:65439] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "ac_4yRnkcvJ01y2CY3mxVAAAANg"]
[Sat Apr 04 01:28:42.128626 2026] [:error] [pid 12097:tid 12159] [client 20.215.254.185:62945] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "ac_4yhnkcvJ01y2CY3mxVgAAAMQ"]
[Sat Apr 04 01:28:42.669959 2026] [:error] [pid 12081:tid 12103] [client 20.215.254.185:62857] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "ac_4yqMJBCYerZTQdmL_1AAAAEM"]
[Sat Apr 04 01:28:43.188035 2026] [:error] [pid 12081:tid 12121] [client 20.215.254.185:62858] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "ac_4y6MJBCYerZTQdmL_2QAAAFU"]
[Sat Apr 04 01:28:43.744920 2026] [:error] [pid 12081:tid 12104] [client 20.215.254.185:65423] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "ac_4y6MJBCYerZTQdmL_4QAAAEQ"]
[Sat Apr 04 01:28:44.299846 2026] [:error] [pid 12081:tid 12103] [client 20.215.254.185:65450] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac_4zKMJBCYerZTQdmL_5QAAAEM"]
[Sat Apr 04 01:28:44.829989 2026] [:error] [pid 12089:tid 12145] [client 20.215.254.185:62882] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac_4zESCG1Z_hi7I_jJq0AAAAJI"]
[Sat Apr 04 01:28:45.376812 2026] [:error] [pid 12089:tid 12134] [client 20.215.254.185:62950] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac_4zUSCG1Z_hi7I_jJq1wAAAIc"]
[Sat Apr 04 01:28:45.936766 2026] [:error] [pid 12089:tid 12150] [client 20.215.254.185:62958] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "ac_4zUSCG1Z_hi7I_jJq4AAAAJc"]
[Sat Apr 04 01:28:46.510844 2026] [:error] [pid 12233:tid 12236] [client 20.215.254.185:65408] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "ac_4zhQDAzkmdfiSgI2pvQAAAQE"]
[Sat Apr 04 01:28:47.052781 2026] [:error] [pid 12233:tid 12241] [client 20.215.254.185:61775] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "ac_4zxQDAzkmdfiSgI2pwQAAAQY"]
[Sat Apr 04 01:28:47.577866 2026] [:error] [pid 12097:tid 12175] [client 20.215.254.185:65442] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac_4zxnkcvJ01y2CY3mxXAAAANQ"]
[Sat Apr 04 01:28:48.091888 2026] [:error] [pid 12081:tid 12106] [client 20.215.254.185:65431] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "ac_40KMJBCYerZTQdmL_6QAAAEY"]
[Sat Apr 04 01:28:48.616121 2026] [:error] [pid 12089:tid 12129] [client 20.215.254.185:65416] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "ac_40ESCG1Z_hi7I_jJq8wAAAII"]
[Sat Apr 04 01:28:49.126463 2026] [:error] [pid 12097:tid 12177] [client 20.215.254.185:65503] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "ac_40RnkcvJ01y2CY3mxYgAAANY"]
[Sat Apr 04 01:28:49.651806 2026] [:error] [pid 12081:tid 12122] [client 20.215.254.185:65524] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "ac_40aMJBCYerZTQdmL_7QAAAFY"]
[Sat Apr 04 01:28:50.225802 2026] [:error] [pid 12089:tid 12145] [client 20.215.254.185:62923] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "ac_40kSCG1Z_hi7I_jJq-QAAAJI"]
[Sat Apr 04 01:28:50.792687 2026] [:error] [pid 12233:tid 12240] [client 20.215.254.185:65514] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ac_40hQDAzkmdfiSgI2pzgAAAQU"]
[Sat Apr 04 01:28:51.304340 2026] [:error] [pid 12233:tid 12256] [client 20.215.254.185:65515] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ac_40xQDAzkmdfiSgI2p1AAAARU"]
[Sat Apr 04 01:28:51.814993 2026] [:error] [pid 12097:tid 12175] [client 20.215.254.185:65440] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ac_40xnkcvJ01y2CY3mxagAAANQ"]
[Sat Apr 04 01:28:52.354351 2026] [:error] [pid 12233:tid 12249] [client 20.215.254.185:62874] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "ac_41BQDAzkmdfiSgI2p2wAAAQ4"]
[Sat Apr 04 01:28:52.868080 2026] [:error] [pid 12097:tid 12177] [client 20.215.254.185:65475] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac_41BnkcvJ01y2CY3mxbwAAANY"]
[Sat Apr 04 01:28:53.396933 2026] [:error] [pid 12097:tid 12157] [client 20.215.254.185:65510] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac_41RnkcvJ01y2CY3mxcgAAAMI"]
[Sat Apr 04 01:28:53.918544 2026] [:error] [pid 12097:tid 12166] [client 20.215.254.185:65473] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac_41RnkcvJ01y2CY3mxeQAAAMs"]
[Sat Apr 04 01:28:54.440790 2026] [:error] [pid 12233:tid 12259] [client 20.215.254.185:65493] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac_41hQDAzkmdfiSgI2p5QAAARg"]
[Sat Apr 04 01:28:54.968746 2026] [:error] [pid 12081:tid 12119] [client 20.215.254.185:62849] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "ac_41qMJBCYerZTQdmL_9wAAAFM"]
[Sat Apr 04 01:28:55.480620 2026] [:error] [pid 12081:tid 12100] [client 20.215.254.185:62852] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "ac_416MJBCYerZTQdmIAAAAAAEA"]
[Sat Apr 04 01:28:56.022902 2026] [:error] [pid 12089:tid 12144] [client 20.215.254.185:65522] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "ac_42ESCG1Z_hi7I_jJq_wAAAJE"]
[Sat Apr 04 01:28:56.585992 2026] [:error] [pid 12233:tid 12239] [client 20.215.254.185:62965] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "ac_42BQDAzkmdfiSgI2p7gAAAQQ"]
[Sat Apr 04 01:28:57.099021 2026] [:error] [pid 12089:tid 12137] [client 20.215.254.185:62942] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac_42USCG1Z_hi7I_jJrBgAAAIo"]
[Sat Apr 04 01:28:57.629438 2026] [:error] [pid 12233:tid 12256] [client 20.215.254.185:62881] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac_42RQDAzkmdfiSgI2p9wAAARU"]
[Sat Apr 04 01:28:58.150062 2026] [:error] [pid 12233:tid 12245] [client 20.215.254.185:65505] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac_42hQDAzkmdfiSgI2p_QAAAQo"]
[Sat Apr 04 01:28:58.670148 2026] [:error] [pid 12081:tid 12101] [client 20.215.254.185:62870] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac_42qMJBCYerZTQdmIABwAAAEE"]
[Sat Apr 04 01:28:59.182730 2026] [:error] [pid 12081:tid 12112] [client 20.215.254.185:65462] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "ac_426MJBCYerZTQdmIACwAAAEw"]
[Sat Apr 04 01:28:59.745855 2026] [:error] [pid 12081:tid 12123] [client 20.215.254.185:65519] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "ac_426MJBCYerZTQdmIADgAAAFc"]
[Sat Apr 04 01:29:00.260105 2026] [:error] [pid 12081:tid 12108] [client 20.215.254.185:62867] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "ac_43KMJBCYerZTQdmIAFAAAAEg"]
[Sat Apr 04 01:29:00.838649 2026] [:error] [pid 12097:tid 12173] [client 20.215.254.185:62935] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pass4.php"] [unique_id "ac_43BnkcvJ01y2CY3mxhAAAANI"]
[Sat Apr 04 01:29:01.409833 2026] [:error] [pid 12097:tid 12157] [client 20.215.254.185:65455] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac_43RnkcvJ01y2CY3mxhwAAAMI"]
[Sat Apr 04 01:29:01.933645 2026] [:error] [pid 12233:tid 12255] [client 20.215.254.185:61699] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac_43RQDAzkmdfiSgI2qCgAAARQ"]
[Sat Apr 04 01:29:02.545864 2026] [:error] [pid 12081:tid 12105] [client 20.215.254.185:65430] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "ac_43qMJBCYerZTQdmIAHgAAAEU"]
[Sat Apr 04 01:29:03.225277 2026] [:error] [pid 12233:tid 12258] [client 20.215.254.185:65433] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac_43xQDAzkmdfiSgI2qEAAAARc"]
[Sat Apr 04 01:29:03.859059 2026] [:error] [pid 12233:tid 12242] [client 20.215.254.185:65437] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac_43xQDAzkmdfiSgI2qEwAAAQc"]
[Sat Apr 04 01:29:04.402853 2026] [:error] [pid 12081:tid 12106] [client 20.215.254.185:62926] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac_44KMJBCYerZTQdmIAKgAAAEY"]
[Sat Apr 04 01:29:04.932214 2026] [:error] [pid 12233:tid 12256] [client 20.215.254.185:61774] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac_44BQDAzkmdfiSgI2qHgAAARU"]
[Sat Apr 04 01:29:05.506530 2026] [:error] [pid 12089:tid 12146] [client 20.215.254.185:65453] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "ac_44USCG1Z_hi7I_jJrFQAAAJM"]
[Sat Apr 04 01:29:06.419638 2026] [:error] [pid 12089:tid 12151] [client 20.215.254.185:65428] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "ac_44kSCG1Z_hi7I_jJrGAAAAJg"]
[Sat Apr 04 01:29:06.989471 2026] [:error] [pid 12089:tid 12132] [client 20.215.254.185:65447] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "ac_44kSCG1Z_hi7I_jJrGwAAAIU"]
[Sat Apr 04 01:29:07.594020 2026] [:error] [pid 12089:tid 12129] [client 20.215.254.185:65527] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac_440SCG1Z_hi7I_jJrIAAAAII"]
[Sat Apr 04 01:29:08.124873 2026] [:error] [pid 12089:tid 12136] [client 20.215.254.185:65409] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac_45ESCG1Z_hi7I_jJrIwAAAIk"]
[Sat Apr 04 01:29:08.638978 2026] [:error] [pid 12097:tid 12158] [client 20.215.254.185:62963] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "ac_45BnkcvJ01y2CY3mxkQAAAMM"]
[Sat Apr 04 01:29:09.283609 2026] [:error] [pid 12081:tid 12124] [client 20.215.254.185:65470] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0yellow.php"] [unique_id "ac_45aMJBCYerZTQdmIAOwAAAFg"]
[Sat Apr 04 01:29:09.795983 2026] [:error] [pid 12097:tid 12163] [client 20.215.254.185:62879] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0yellow.php"] [unique_id "ac_45RnkcvJ01y2CY3mxlgAAAMg"]
[Sat Apr 04 01:29:10.314378 2026] [:error] [pid 12097:tid 12179] [client 20.215.254.185:65481] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0yellow.php"] [unique_id "ac_45hnkcvJ01y2CY3mxmAAAANg"]
[Sat Apr 04 01:29:10.937136 2026] [:error] [pid 12097:tid 12169] [client 20.215.254.185:62880] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "ac_45hnkcvJ01y2CY3mxngAAAM4"]
[Sat Apr 04 01:29:11.531456 2026] [:error] [pid 12089:tid 12135] [client 20.215.254.185:43724] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "ac_450SCG1Z_hi7I_jJrNQAAAIg"]
[Sat Apr 04 01:29:12.206884 2026] [:error] [pid 12233:tid 12244] [client 20.215.254.185:62866] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac_46BQDAzkmdfiSgI2qOwAAAQk"]
[Sat Apr 04 01:29:12.746841 2026] [:error] [pid 12233:tid 12235] [client 20.215.254.185:65419] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac_46BQDAzkmdfiSgI2qPgAAAQA"]
[Sat Apr 04 01:29:13.300102 2026] [:error] [pid 12097:tid 12172] [client 20.215.254.185:61725] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac_46RnkcvJ01y2CY3mxpAAAANE"]
[Sat Apr 04 01:29:13.838406 2026] [:error] [pid 12097:tid 12161] [client 20.215.254.185:62940] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "ac_46RnkcvJ01y2CY3mxpwAAAMY"]
[Sat Apr 04 01:29:14.360636 2026] [:error] [pid 12233:tid 12249] [client 20.215.254.185:65448] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac_46hQDAzkmdfiSgI2qRAAAAQ4"]
[Sat Apr 04 01:29:14.941465 2026] [:error] [pid 12097:tid 12179] [client 20.215.254.185:62974] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac_46hnkcvJ01y2CY3mxqgAAANg"]
[Sat Apr 04 01:29:15.493775 2026] [:error] [pid 12089:tid 12129] [client 20.215.254.185:62871] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac_460SCG1Z_hi7I_jJrQwAAAII"]
[Sat Apr 04 01:29:16.095482 2026] [:error] [pid 12233:tid 12245] [client 20.215.254.185:62925] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "ac_47BQDAzkmdfiSgI2qSQAAAQo"]
[Sat Apr 04 01:29:16.699907 2026] [:error] [pid 12097:tid 12165] [client 20.215.254.185:43720] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac_47BnkcvJ01y2CY3mxrQAAAMo"]
[Sat Apr 04 01:29:17.251172 2026] [:error] [pid 12097:tid 12164] [client 20.215.254.185:62937] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac_47RnkcvJ01y2CY3mxsQAAAMk"]
[Sat Apr 04 01:29:17.900413 2026] [:error] [pid 12089:tid 12145] [client 20.215.254.185:62969] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac_47USCG1Z_hi7I_jJrTwAAAJI"]
[Sat Apr 04 01:29:18.435119 2026] [:error] [pid 12097:tid 12176] [client 20.215.254.185:61698] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac_47hnkcvJ01y2CY3mxtgAAANU"]
[Sat Apr 04 01:29:18.989426 2026] [:error] [pid 12233:tid 12243] [client 20.215.254.185:62851] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "ac_47hQDAzkmdfiSgI2qUAAAAQg"]
[Sat Apr 04 01:29:19.535083 2026] [:error] [pid 12233:tid 12256] [client 20.215.254.185:62930] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "ac_47xQDAzkmdfiSgI2qVQAAARU"]
[Sat Apr 04 01:29:20.178503 2026] [:error] [pid 12233:tid 12244] [client 20.215.254.185:65513] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp5.php"] [unique_id "ac_48BQDAzkmdfiSgI2qWgAAAQk"]
[Sat Apr 04 01:29:20.782382 2026] [:error] [pid 12097:tid 12170] [client 20.215.254.185:61744] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "ac_48BnkcvJ01y2CY3mxvwAAAM8"]
[Sat Apr 04 01:29:21.350875 2026] [:error] [pid 12233:tid 12247] [client 20.215.254.185:61796] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "ac_48RQDAzkmdfiSgI2qYgAAAQw"]
[Sat Apr 04 01:29:22.024187 2026] [:error] [pid 12097:tid 12175] [client 20.215.254.185:62853] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "ac_48hnkcvJ01y2CY3mxwwAAANQ"]
[Sat Apr 04 01:29:22.555074 2026] [:error] [pid 12081:tid 12114] [client 20.215.254.185:61780] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "ac_48qMJBCYerZTQdmIAUwAAAE4"]
[Sat Apr 04 01:29:23.161062 2026] [:error] [pid 12233:tid 12244] [client 20.215.254.185:62877] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "ac_48xQDAzkmdfiSgI2qawAAAQk"]
[Sat Apr 04 01:29:23.750179 2026] [:error] [pid 12097:tid 12162] [client 20.215.254.185:65468] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "ac_48xnkcvJ01y2CY3mxxgAAAMc"]
[Sat Apr 04 01:29:24.287190 2026] [:error] [pid 12233:tid 12249] [client 20.215.254.185:61791] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "ac_49BQDAzkmdfiSgI2qcwAAAQ4"]
[Sat Apr 04 01:29:24.923066 2026] [:error] [pid 12081:tid 12105] [client 20.215.254.185:65460] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "ac_49KMJBCYerZTQdmIAWgAAAEU"]
[Sat Apr 04 01:29:25.564363 2026] [:error] [pid 12089:tid 12143] [client 20.215.254.185:62955] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "ac_49USCG1Z_hi7I_jJrYQAAAJA"]
[Sat Apr 04 01:29:26.308299 2026] [:error] [pid 12233:tid 12246] [client 20.215.254.185:65485] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "ac_49hQDAzkmdfiSgI2qggAAAQs"]
[Sat Apr 04 01:29:26.873781 2026] [:error] [pid 12233:tid 12242] [client 20.215.254.185:62917] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "ac_49hQDAzkmdfiSgI2qiwAAAQc"]
[Sat Apr 04 01:29:27.475086 2026] [:error] [pid 12089:tid 12149] [client 20.215.254.185:62886] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "ac_490SCG1Z_hi7I_jJrZwAAAJY"]
[Sat Apr 04 01:29:28.112750 2026] [:error] [pid 12233:tid 12242] [client 20.215.254.185:61697] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "ac_4-BQDAzkmdfiSgI2qlQAAAQc"]
[Sat Apr 04 01:29:28.735017 2026] [:error] [pid 12081:tid 12108] [client 20.215.254.185:65492] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "ac_4-KMJBCYerZTQdmIAZQAAAEg"]
[Sat Apr 04 01:29:29.311129 2026] [:error] [pid 12081:tid 12112] [client 20.215.254.185:61815] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "ac_4-aMJBCYerZTQdmIAaQAAAEw"]
[Sat Apr 04 01:29:29.922820 2026] [:error] [pid 12089:tid 12135] [client 20.215.254.185:62854] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "ac_4-USCG1Z_hi7I_jJragAAAIg"]
[Sat Apr 04 01:29:30.544600 2026] [:error] [pid 12089:tid 12130] [client 20.215.254.185:61806] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "ac_4-kSCG1Z_hi7I_jJrawAAAIM"]
[Sat Apr 04 01:29:31.221801 2026] [:error] [pid 12081:tid 12122] [client 20.215.254.185:62872] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "ac_4-6MJBCYerZTQdmIAdAAAAFY"]
[Sat Apr 04 01:29:31.768516 2026] [:error] [pid 12081:tid 12123] [client 20.215.254.185:61769] [client 20.215.254.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "ac_4-6MJBCYerZTQdmIAdwAAAFc"]
[Sat Apr 04 01:29:32.291507 2026] [:error] [pid 12081:tid 12105] [client 20.215.254.185:65436] File does not exist: /usr/local/apache/htdocs/suspended-page/hhxc.php
[Sat Apr 04 01:39:30.573063 2026] [:error] [pid 12081:tid 12121] [client 185.93.89.27:35132] [client 185.93.89.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "ac_7UqMJBCYerZTQdmIHBQAAAFU"]
[Sat Apr 04 01:39:30.576400 2026] [:error] [pid 12233:tid 12255] [client 185.93.89.27:35138] [client 185.93.89.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/env/.env"] [unique_id "ac_7UhQDAzkmdfiSgI20AAAAARQ"]
[Sat Apr 04 01:39:31.898828 2026] [:error] [pid 12233:tid 12240] [client 185.93.89.27:59462] [client 185.93.89.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/env/.env"] [unique_id "ac_7UxQDAzkmdfiSgI20EQAAAQU"]
[Sat Apr 04 01:39:31.903318 2026] [:error] [pid 12081:tid 12122] [client 185.93.89.27:59460] [client 185.93.89.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/api/.env"] [unique_id "ac_7U6MJBCYerZTQdmIHCQAAAFY"]
[Sat Apr 04 02:15:21.359864 2026] [:error] [pid 12081:tid 12102] [client 118.99.73.107:2750] [client 118.99.73.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.99.73.107, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adADuaMJBCYerZTQdmIgRgAAAEI"]
[Sat Apr 04 02:15:21.365186 2026] [:error] [pid 12081:tid 12102] [client 118.99.73.107:2750] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 02:15:35.816458 2026] [:error] [pid 12081:tid 12124] [client 49.36.222.199:53440] [client 49.36.222.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.222.199, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adADx6MJBCYerZTQdmIgXgAAAFg"]
[Sat Apr 04 02:15:35.820543 2026] [:error] [pid 12081:tid 12124] [client 49.36.222.199:53440] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 02:39:06.857977 2026] [:error] [pid 44382:tid 44395] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Apr 04 02:39:07.102360 2026] [:error] [pid 44382:tid 44404] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sat Apr 04 02:39:07.339476 2026] [:error] [pid 44382:tid 44397] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Sat Apr 04 02:39:07.578307 2026] [:error] [pid 44382:tid 44392] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Sat Apr 04 02:39:07.816430 2026] [:error] [pid 44382:tid 44396] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sat Apr 04 02:39:08.055045 2026] [:error] [pid 44382:tid 44393] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sat Apr 04 02:39:08.294055 2026] [:error] [pid 44382:tid 44402] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sat Apr 04 02:39:08.531616 2026] [:error] [pid 44382:tid 44387] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/xxc.php
[Sat Apr 04 02:39:08.769786 2026] [:error] [pid 44382:tid 44394] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Sat Apr 04 02:39:09.007155 2026] [:error] [pid 44382:tid 44399] [client 20.250.11.224:63641] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sat Apr 04 02:39:09.241596 2026] [:error] [pid 44382:tid 44397] [client 20.250.11.224:63641] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55l453.php"] [unique_id "adAJTZpzSLFOX5FpZ8rKzwAAAA0"]
[Sat Apr 04 02:39:09.712307 2026] [:error] [pid 12081:tid 12114] [client 20.250.11.224:15197] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkyac.php"] [unique_id "adAJTaMJBCYerZTQdmIrowAAAE4"]
[Sat Apr 04 02:39:10.191598 2026] [:error] [pid 44382:tid 44391] [client 20.250.11.224:63642] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HLA-dd.php"] [unique_id "adAJTppzSLFOX5FpZ8rK1AAAAAc"]
[Sat Apr 04 02:39:10.660981 2026] [:error] [pid 12233:tid 12236] [client 20.250.11.224:46267] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsc.php"] [unique_id "adAJThQDAzkmdfiSgI3oWAAAAQE"]
[Sat Apr 04 02:39:11.172358 2026] [:error] [pid 44382:tid 44404] [client 20.250.11.224:15169] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dczem.php"] [unique_id "adAJT5pzSLFOX5FpZ8rK2gAAABQ"]
[Sat Apr 04 02:39:11.641809 2026] [:error] [pid 44382:tid 44389] [client 20.250.11.224:46233] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dczem.php"] [unique_id "adAJT5pzSLFOX5FpZ8rK3wAAAAU"]
[Sat Apr 04 02:39:12.121970 2026] [:error] [pid 44382:tid 44403] [client 20.250.11.224:15216] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dczem.php"] [unique_id "adAJUJpzSLFOX5FpZ8rK5QAAABM"]
[Sat Apr 04 03:06:39.037320 2026] [:error] [pid 44382:tid 44393] [client 117.196.148.249:49536] [client 117.196.148.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.196.148.249, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adAPv5pzSLFOX5FpZ8rivwAAAAk"]
[Sat Apr 04 03:06:39.041903 2026] [:error] [pid 44382:tid 44393] [client 117.196.148.249:49536] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 04:01:31.160714 2026] [:error] [pid 2567:tid 2590] [client 20.215.255.154:12298] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAcm2JJmfRsTrAKjdQOHQAAANA"]
[Sat Apr 04 04:01:31.679666 2026] [:error] [pid 2567:tid 2582] [client 20.215.255.154:14813] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAcm2JJmfRsTrAKjdQOIQAAAMg"]
[Sat Apr 04 04:01:32.190163 2026] [:error] [pid 2567:tid 2586] [client 20.215.255.154:3944] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAcnGJJmfRsTrAKjdQOJwAAAMw"]
[Sat Apr 04 04:01:32.703568 2026] [:error] [pid 2459:tid 2535] [client 20.215.255.154:47787] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAcnAefyCmu4LR_PlpAnwAAAIQ"]
[Sat Apr 04 05:11:58.796612 2026] [:error] [pid 2567:tid 2581] [client 143.255.205.159:50084] [client 143.255.205.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.255.205.159, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adAtHmJJmfRsTrAKjdRHxwAAAMc"]
[Sat Apr 04 05:11:58.801279 2026] [:error] [pid 2567:tid 2581] [client 143.255.205.159:50084] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 07:05:03.679172 2026] [:error] [pid 2457:tid 2483] [client 45.92.1.112:64938] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "adBHn0mNHppaMd92ZpdnFAAAAAY"]
[Sat Apr 04 07:05:04.171154 2026] [:error] [pid 37114:tid 37116] [client 45.92.1.112:53505] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "adBHoM-DnSj3fGMexeKjWAAAAQA"]
[Sat Apr 04 07:05:04.672682 2026] [:error] [pid 2459:tid 2556] [client 45.92.1.112:52846] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "adBHoAefyCmu4LR_PlqJWgAAAJg"]
[Sat Apr 04 07:05:05.157759 2026] [:error] [pid 2458:tid 2516] [client 45.92.1.112:55570] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "adBHoSNozic5SuWqcln01gAAAEw"]
[Sat Apr 04 07:05:05.697134 2026] [:error] [pid 37114:tid 37124] [client 45.92.1.112:53152] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "adBHoc-DnSj3fGMexeKjZAAAAQg"]
[Sat Apr 04 07:55:24.384560 2026] [:error] [pid 2459:tid 2554] [client 188.71.221.181:38260] [client 188.71.221.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.71.221.181, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adBTbAefyCmu4LR_PlqcywAAAJY"]
[Sat Apr 04 07:55:24.389673 2026] [:error] [pid 2459:tid 2554] [client 188.71.221.181:38260] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 12:35:21.093019 2026] [:error] [pid 2567:tid 2578] [client 202.184.66.66:57764] [client 202.184.66.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.184.66.66, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adCVCWJJmfRsTrAKjdR1kAAAAMQ"]
[Sat Apr 04 12:35:21.097968 2026] [:error] [pid 2567:tid 2578] [client 202.184.66.66:57764] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 13:28:53.978824 2026] [:error] [pid 2459:tid 2541] [client 49.205.245.255:37556] [client 49.205.245.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.205.245.255, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adChlQefyCmu4LR_Plob-QAAAIk"]
[Sat Apr 04 13:28:53.985351 2026] [:error] [pid 2459:tid 2541] [client 49.205.245.255:37556] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 18:47:04.289553 2026] [:error] [pid 2457:tid 2491] [client 183.82.125.2:1089] [client 183.82.125.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.125.2, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adDsKEmNHppaMd92Zpcm0wAAAA4"]
[Sat Apr 04 18:47:04.294449 2026] [:error] [pid 2457:tid 2491] [client 183.82.125.2:1089] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 19:48:56.291407 2026] [:error] [pid 2458:tid 2520] [client 216.24.210.119:27097] [client 216.24.210.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adD6qCNozic5SuWqclkBbAAAAFA"]
[Sat Apr 04 19:54:00.464465 2026] [:error] [pid 2567:tid 2574] [client 113.199.241.226:65053] [client 113.199.241.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.199.241.226, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adD72GJJmfRsTrAKjdQgHgAAAMA"]
[Sat Apr 04 19:54:00.469901 2026] [:error] [pid 2567:tid 2574] [client 113.199.241.226:65053] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 19:57:35.404487 2026] [:error] [pid 37114:tid 37120] [client 109.38.128.83:3501] [client 109.38.128.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.38.128.83, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adD8r8-DnSj3fGMexeIvxwAAAQQ"]
[Sat Apr 04 19:57:35.414658 2026] [:error] [pid 37114:tid 37120] [client 109.38.128.83:3501] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 04 23:15:34.428050 2026] [:error] [pid 2457:tid 2499] [client 181.122.254.30:50207] [client 181.122.254.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.122.254.30, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adErFkmNHppaMd92ZpeESgAAABY"]
[Sat Apr 04 23:15:34.432642 2026] [:error] [pid 2457:tid 2499] [client 181.122.254.30:50207] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 01:44:11.886999 2026] [:error] [pid 63313:tid 63343] [client 82.76.139.197:49901] [client 82.76.139.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.76.139.197, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adFN6-1cPeVj2b7ZXSRMggAAARg"]
[Sun Apr 05 01:44:11.891698 2026] [:error] [pid 63313:tid 63343] [client 82.76.139.197:49901] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 03:11:57.845390 2026] [:error] [pid 53819:tid 53888] [client 84.225.76.100:30516] [client 84.225.76.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.225.76.100, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adFifWkolvq4mv6siDMPUgAAAA8"]
[Sun Apr 05 03:11:57.853400 2026] [:error] [pid 53819:tid 53888] [client 84.225.76.100:30516] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 04:22:29.796760 2026] [:error] [pid 45409:tid 45412] [client 87.116.160.227:11023] [client 87.116.160.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.116.160.227, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adFzBdHt_Oyw03gjCNiDEwAAAME"]
[Sun Apr 05 04:22:29.802135 2026] [:error] [pid 45409:tid 45412] [client 87.116.160.227:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 04:23:48.841519 2026] [:error] [pid 45305:tid 45374] [client 131.196.229.170:39672] [client 131.196.229.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 131.196.229.170, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adFzVOjDQjr7aWhjflDNSgAAAIM"]
[Sun Apr 05 04:23:48.846557 2026] [:error] [pid 45305:tid 45374] [client 131.196.229.170:39672] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 06:03:43.777243 2026] [:error] [pid 45305:tid 45383] [client 39.37.150.216:60883] [client 39.37.150.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.37.150.216, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adGKv-jDQjr7aWhjflAeSAAAAIw"]
[Sun Apr 05 06:03:43.783533 2026] [:error] [pid 45305:tid 45383] [client 39.37.150.216:60883] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 07:45:57.287680 2026] [:error] [pid 30921:tid 30940] [client 20.70.191.87:10353] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 05 07:45:57.307649 2026] [:error] [pid 30921:tid 30935] [client 20.70.191.87:10353] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 05 07:45:57.392294 2026] [:error] [pid 30921:tid 30932] [client 20.70.191.87:10353] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Apr 05 07:45:57.414405 2026] [:error] [pid 30921:tid 30944] [client 20.70.191.87:10353] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Apr 05 07:45:57.495605 2026] [:error] [pid 30921:tid 30930] [client 20.70.191.87:10353] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Sun Apr 05 07:45:57.532916 2026] [:error] [pid 30921:tid 30941] [client 20.70.191.87:10353] [client 20.70.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/"] [unique_id "adGitWFGQVn8Q0ueB26dsQAAARI"]
[Sun Apr 05 07:45:57.602644 2026] [:error] [pid 45304:tid 45344] [client 20.70.191.87:22804] [client 20.70.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/"] [unique_id "adGitQ5jnqDKKovdRkkl0wAAAEA"]
[Sun Apr 05 07:45:57.681400 2026] [:error] [pid 30921:tid 30934] [client 20.70.191.87:17675] [client 20.70.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/"] [unique_id "adGitWFGQVn8Q0ueB26dsgAAAQs"]
[Sun Apr 05 07:45:57.748807 2026] [:error] [pid 45305:tid 45384] [client 20.70.191.87:20180] [client 20.70.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/"] [unique_id "adGitejDQjr7aWhjflBxqAAAAI0"]
[Sun Apr 05 08:53:13.872552 2026] [:error] [pid 45305:tid 45391] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 05 08:53:14.116146 2026] [:error] [pid 45305:tid 45381] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sun Apr 05 08:53:14.366518 2026] [:error] [pid 45305:tid 45386] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Sun Apr 05 08:53:14.602056 2026] [:error] [pid 45305:tid 45380] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Sun Apr 05 08:53:14.837929 2026] [:error] [pid 45305:tid 45378] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sun Apr 05 08:53:15.094041 2026] [:error] [pid 45305:tid 45372] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Apr 05 08:53:15.335468 2026] [:error] [pid 45305:tid 45383] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Apr 05 08:53:15.603167 2026] [:error] [pid 45305:tid 45386] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/xxc.php
[Sun Apr 05 08:53:15.854129 2026] [:error] [pid 45305:tid 45389] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Sun Apr 05 08:53:16.094774 2026] [:error] [pid 45305:tid 45380] [client 172.213.234.56:64769] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Apr 05 08:53:39.932054 2026] [:error] [pid 45304:tid 45355] [client 172.213.234.56:33423] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adGykw5jnqDKKovdRkk3cgAAAEs"]
[Sun Apr 05 08:53:42.415587 2026] [:error] [pid 45303:tid 45341] [client 172.213.234.56:33413] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adGylrboQ9eViZ4hdnm9WwAAABg"]
[Sun Apr 05 08:53:44.853056 2026] [:error] [pid 30921:tid 30923] [client 172.213.234.56:35882] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adGymGFGQVn8Q0ueB262DwAAAQA"]
[Sun Apr 05 08:53:55.270771 2026] [:error] [pid 45409:tid 45431] [client 172.213.234.56:48959] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkyac.php"] [unique_id "adGyo9Ht_Oyw03gjCNgwZAAAANQ"]
[Sun Apr 05 08:53:59.183705 2026] [:error] [pid 45305:tid 45382] [client 172.213.234.56:35881] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkyac.php"] [unique_id "adGyp-jDQjr7aWhjflCjuAAAAIs"]
[Sun Apr 05 08:54:01.331743 2026] [:error] [pid 45303:tid 45331] [client 172.213.234.56:63520] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkyac.php"] [unique_id "adGyqbboQ9eViZ4hdnm9gwAAAA4"]
[Sun Apr 05 08:54:02.829023 2026] [:error] [pid 45409:tid 45434] [client 172.213.234.56:29709] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkyac.php"] [unique_id "adGyqtHt_Oyw03gjCNgwawAAANc"]
[Sun Apr 05 08:54:05.163986 2026] [:error] [pid 45305:tid 45377] [client 172.213.234.56:39422] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adGyrejDQjr7aWhjflCjxgAAAIY"]
[Sun Apr 05 08:54:07.044653 2026] [:error] [pid 45409:tid 45429] [client 172.213.234.56:63667] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adGyr9Ht_Oyw03gjCNgwdgAAANI"]
[Sun Apr 05 08:54:08.602817 2026] [:error] [pid 30921:tid 30930] [client 172.213.234.56:39375] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adGysGFGQVn8Q0ueB262OgAAAQc"]
[Sun Apr 05 08:54:11.453888 2026] [:error] [pid 45409:tid 45421] [client 172.213.234.56:35876] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adGys9Ht_Oyw03gjCNgwhQAAAMo"]
[Sun Apr 05 08:54:15.255663 2026] [:error] [pid 45303:tid 45339] [client 172.213.234.56:63494] [client 172.213.234.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "adGyt7boQ9eViZ4hdnm9mAAAABY"]
[Sun Apr 05 08:54:17.352078 2026] [:error] [pid 45304:tid 45354] [client 172.213.234.56:63653] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Sun Apr 05 08:54:17.589324 2026] [:error] [pid 45304:tid 45348] [client 172.213.234.56:63653] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Sun Apr 05 08:54:17.838009 2026] [:error] [pid 45304:tid 45344] [client 172.213.234.56:63653] File does not exist: /usr/local/apache/htdocs/suspended-page/wsc.php
[Sun Apr 05 08:54:18.085399 2026] [:error] [pid 45304:tid 45360] [client 172.213.234.56:63653] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lvminl.php
[Sun Apr 05 08:54:18.325092 2026] [:error] [pid 45304:tid 45355] [client 172.213.234.56:63653] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Sun Apr 05 08:54:18.566797 2026] [:error] [pid 45304:tid 45362] [client 172.213.234.56:63653] File does not exist: /usr/local/apache/htdocs/suspended-page/dczem.php
[Sun Apr 05 08:54:18.825738 2026] [:error] [pid 45304:tid 45346] [client 172.213.234.56:63653] File does not exist: /usr/local/apache/htdocs/suspended-page/albrt.php
[Sun Apr 05 10:47:01.499036 2026] [:error] [pid 30921:tid 30934] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 05 10:47:01.757447 2026] [:error] [pid 30921:tid 30944] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sun Apr 05 10:47:02.026114 2026] [:error] [pid 30921:tid 30933] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Sun Apr 05 10:47:02.291457 2026] [:error] [pid 30921:tid 30932] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Sun Apr 05 10:47:02.702089 2026] [:error] [pid 30921:tid 30928] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sun Apr 05 10:47:02.960919 2026] [:error] [pid 30921:tid 30936] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Apr 05 10:47:03.228554 2026] [:error] [pid 30921:tid 30939] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Apr 05 10:47:03.508219 2026] [:error] [pid 30921:tid 30947] [client 74.248.146.253:12430] File does not exist: /usr/local/apache/htdocs/suspended-page/xxc.php
[Sun Apr 05 10:47:03.847575 2026] [:error] [pid 30921:tid 30929] [client 74.248.146.253:12430] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "adHNJ2FGQVn8Q0ueB27o0wAAAQY"]
[Sun Apr 05 10:47:20.859447 2026] [:error] [pid 30921:tid 30931] [client 74.248.146.253:15080] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adHNOGFGQVn8Q0ueB27pFAAAAQg"]
[Sun Apr 05 10:47:23.840016 2026] [:error] [pid 45303:tid 45333] [client 74.248.146.253:18421] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adHNO7boQ9eViZ4hdnnmWAAAABA"]
[Sun Apr 05 10:47:25.286030 2026] [:error] [pid 30921:tid 30930] [client 74.248.146.253:1983] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adHNPWFGQVn8Q0ueB27pLgAAAQc"]
[Sun Apr 05 10:47:29.309757 2026] [:error] [pid 45303:tid 45330] [client 74.248.146.253:9227] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adHNQbboQ9eViZ4hdnnmZwAAAA0"]
[Sun Apr 05 10:47:32.465808 2026] [:error] [pid 30921:tid 30930] [client 74.248.146.253:9225] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55l453.php"] [unique_id "adHNRGFGQVn8Q0ueB27pRAAAAQc"]
[Sun Apr 05 10:47:38.799356 2026] [:error] [pid 45305:tid 45373] [client 74.248.146.253:1928] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55l453.php"] [unique_id "adHNSujDQjr7aWhjflABzQAAAII"]
[Sun Apr 05 10:47:47.095529 2026] [:error] [pid 30921:tid 30925] [client 74.248.146.253:18395] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adHNU2FGQVn8Q0ueB27pYgAAAQI"]
[Sun Apr 05 10:47:51.860646 2026] [:error] [pid 45304:tid 45360] [client 74.248.146.253:12425] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adHNVw5jnqDKKovdRklZpwAAAFA"]
[Sun Apr 05 10:47:54.563416 2026] [:error] [pid 45305:tid 45391] [client 74.248.146.253:15093] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adHNWujDQjr7aWhjflACDwAAAJQ"]
[Sun Apr 05 10:47:57.513627 2026] [:error] [pid 45303:tid 45331] [client 74.248.146.253:25132] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adHNXbboQ9eViZ4hdnnmiAAAAA4"]
[Sun Apr 05 10:48:00.763219 2026] [:error] [pid 45409:tid 45423] [client 74.248.146.253:9243] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkyac.php"] [unique_id "adHNYNHt_Oyw03gjCNh0QwAAAMw"]
[Sun Apr 05 10:48:07.736306 2026] [:error] [pid 45305:tid 45392] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Sun Apr 05 10:48:07.998140 2026] [:error] [pid 45305:tid 45382] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sun Apr 05 10:48:08.257471 2026] [:error] [pid 45305:tid 45372] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Sun Apr 05 10:48:08.531759 2026] [:error] [pid 45305:tid 45377] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Sun Apr 05 10:48:08.790121 2026] [:error] [pid 45305:tid 45389] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/wsc.php
[Sun Apr 05 10:48:09.058803 2026] [:error] [pid 45305:tid 45393] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lvminl.php
[Sun Apr 05 10:48:09.316520 2026] [:error] [pid 45305:tid 45392] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Sun Apr 05 10:48:09.574980 2026] [:error] [pid 45305:tid 45385] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/dczem.php
[Sun Apr 05 10:48:09.836819 2026] [:error] [pid 45305:tid 45391] [client 74.248.146.253:24766] File does not exist: /usr/local/apache/htdocs/suspended-page/albrt.php
[Sun Apr 05 12:22:26.824050 2026] [:error] [pid 30921:tid 30939] [client 154.161.10.115:8173] [client 154.161.10.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.10.115, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adHjgmFGQVn8Q0ueB24WGwAAARA"]
[Sun Apr 05 12:22:26.839309 2026] [:error] [pid 30921:tid 30939] [client 154.161.10.115:8173] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 13:15:58.467408 2026] [:error] [pid 45305:tid 45394] [client 139.5.1.235:40572] [client 139.5.1.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.5.1.235, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adHwDujDQjr7aWhjflB8CwAAAJc"]
[Sun Apr 05 13:15:58.476537 2026] [:error] [pid 45305:tid 45394] [client 139.5.1.235:40572] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 13:21:22.994063 2026] [:error] [pid 45305:tid 45380] [client 74.234.80.3:51884] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Sun Apr 05 13:23:15.132653 2026] [:error] [pid 45305:tid 45393] [client 68.221.137.197:35911] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Sun Apr 05 13:30:20.888280 2026] [:error] [pid 30921:tid 30934] [client 20.199.97.195:19970] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Sun Apr 05 18:16:54.563276 2026] [:error] [pid 45305:tid 45385] [client 212.105.142.179:12544] [client 212.105.142.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.105.142.179, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adI2lujDQjr7aWhjflAV1gAAAI4"]
[Sun Apr 05 18:16:54.572446 2026] [:error] [pid 45305:tid 45385] [client 212.105.142.179:12544] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 20:27:57.062094 2026] [:error] [pid 45409:tid 45418] [client 183.87.174.151:63373] [client 183.87.174.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.87.174.151, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adJVTdHt_Oyw03gjCNjWtgAAAMc"]
[Sun Apr 05 20:27:57.067331 2026] [:error] [pid 45409:tid 45418] [client 183.87.174.151:63373] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 05 23:10:47.132820 2026] [:error] [pid 45303:tid 45339] [client 49.43.133.128:57865] [client 49.43.133.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.133.128, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adJ7d7boQ9eViZ4hdnmCIQAAABY"]
[Sun Apr 05 23:10:47.137850 2026] [:error] [pid 45303:tid 45339] [client 49.43.133.128:57865] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Apr 06 00:32:39.832533 2026] [:error] [pid 51584:tid 51714] [client 38.89.143.10:55159] [client 38.89.143.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "adKOp8Z4qY_GoNCPARABzQAAANE"]
[Mon Apr 06 00:32:40.378787 2026] [:error] [pid 51584:tid 51699] [client 38.89.143.10:55378] [client 38.89.143.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.local"] [unique_id "adKOqMZ4qY_GoNCPARAB0gAAAMI"]
[Mon Apr 06 00:32:40.876695 2026] [:error] [pid 51753:tid 51825] [client 38.89.143.10:55514] [client 38.89.143.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.production"] [unique_id "adKOqK3pmp1JkaicYbs_jQAAAQ4"]
[Mon Apr 06 00:32:41.648927 2026] [:error] [pid 51584:tid 51702] [client 38.89.143.10:55638] [client 38.89.143.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.backup"] [unique_id "adKOqcZ4qY_GoNCPARAB1gAAAMU"]
[Mon Apr 06 00:32:42.304714 2026] [:error] [pid 51580:tid 51656] [client 38.89.143.10:55767] [client 38.89.143.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.save"] [unique_id "adKOqlNFl1NiyNgNZAkEYwAAAFE"]
[Mon Apr 06 00:32:43.034631 2026] [:error] [pid 51584:tid 51697] [client 38.89.143.10:55903] [client 38.89.143.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env.old"] [unique_id "adKOq8Z4qY_GoNCPARAB2QAAAMA"]
[Mon Apr 06 01:19:22.031254 2026] [:error] [pid 51584:tid 51704] [client 20.91.197.85:10946] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Mon Apr 06 01:19:24.853515 2026] [:error] [pid 51584:tid 51721] [client 20.91.197.85:10946] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/wp-login.php"] [unique_id "adKZnMZ4qY_GoNCPARAc_AAAANg"]
[Mon Apr 06 01:19:27.479098 2026] [:error] [pid 51581:tid 51669] [client 20.91.197.85:11327] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adKZn94k74fhQLPUy7E-xwAAAIA"]
[Mon Apr 06 01:19:30.292466 2026] [:error] [pid 51581:tid 51694] [client 20.91.197.85:17695] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adKZot4k74fhQLPUy7E-zQAAAJg"]
[Mon Apr 06 01:19:34.440705 2026] [:error] [pid 51581:tid 51671] [client 20.91.197.85:10991] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "adKZpt4k74fhQLPUy7E-1wAAAII"]
[Mon Apr 06 01:19:36.798284 2026] [:error] [pid 51580:tid 51652] [client 20.91.197.85:18866] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Mon Apr 06 01:19:37.061674 2026] [:error] [pid 51580:tid 51655] [client 20.91.197.85:18866] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adKZqVNFl1NiyNgNZAkm0gAAAFA"]
[Mon Apr 06 01:19:38.700115 2026] [:error] [pid 51753:tid 51819] [client 20.91.197.85:11281] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adKZqq3pmp1JkaicYbtzmAAAAQg"]
[Mon Apr 06 01:19:41.455953 2026] [:error] [pid 51753:tid 51821] [client 20.91.197.85:19348] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adKZra3pmp1JkaicYbtzowAAAQo"]
[Mon Apr 06 01:19:44.522686 2026] [:error] [pid 51581:tid 51689] [client 20.91.197.85:10963] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adKZsN4k74fhQLPUy7E-3wAAAJQ"]
[Mon Apr 06 01:19:46.413743 2026] [:error] [pid 51580:tid 51641] [client 20.91.197.85:11343] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/makeasmtp.php"] [unique_id "adKZslNFl1NiyNgNZAkm8QAAAEI"]
[Mon Apr 06 01:19:48.954771 2026] [:error] [pid 51753:tid 51832] [client 20.91.197.85:18875] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/makeasmtp.php"] [unique_id "adKZtK3pmp1JkaicYbtzzQAAARU"]
[Mon Apr 06 01:19:50.822211 2026] [:error] [pid 51580:tid 51645] [client 20.91.197.85:11377] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/makeasmtp.php"] [unique_id "adKZtlNFl1NiyNgNZAkm-gAAAEY"]
[Mon Apr 06 01:19:52.121715 2026] [:error] [pid 51753:tid 51813] [client 20.91.197.85:11310] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/makeasmtp.php"] [unique_id "adKZuK3pmp1JkaicYbtz3AAAAQI"]
[Mon Apr 06 01:19:53.610163 2026] [:error] [pid 51584:tid 51711] [client 20.91.197.85:19361] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adKZucZ4qY_GoNCPARAdLgAAAM4"]
[Mon Apr 06 01:19:54.771931 2026] [:error] [pid 51581:tid 51672] [client 20.91.197.85:19352] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adKZut4k74fhQLPUy7E-7QAAAIM"]
[Mon Apr 06 01:19:56.566844 2026] [:error] [pid 51581:tid 51670] [client 20.91.197.85:19372] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adKZvN4k74fhQLPUy7E-8QAAAIE"]
[Mon Apr 06 01:19:59.652226 2026] [:error] [pid 51581:tid 51670] [client 20.91.197.85:18899] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adKZv94k74fhQLPUy7E_AAAAAIE"]
[Mon Apr 06 01:20:02.792461 2026] [:error] [pid 51581:tid 51674] [client 20.91.197.85:19381] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adKZwt4k74fhQLPUy7E_CQAAAIU"]
[Mon Apr 06 01:20:04.673252 2026] [:error] [pid 51753:tid 51819] [client 20.91.197.85:11355] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adKZxK3pmp1JkaicYbt0DgAAAQg"]
[Mon Apr 06 01:20:06.033400 2026] [:error] [pid 51753:tid 51812] [client 20.91.197.85:19422] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/about.php"] [unique_id "adKZxq3pmp1JkaicYbt0FgAAAQE"]
[Mon Apr 06 01:20:08.811755 2026] [:error] [pid 51584:tid 51709] [client 20.91.197.85:18833] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/about.php"] [unique_id "adKZyMZ4qY_GoNCPARAdQgAAAMw"]
[Mon Apr 06 01:20:10.661736 2026] [:error] [pid 51584:tid 51717] [client 20.91.197.85:7327] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/about.php"] [unique_id "adKZysZ4qY_GoNCPARAdRwAAANQ"]
[Mon Apr 06 01:20:14.826242 2026] [:error] [pid 51580:tid 51649] [client 20.91.197.85:19339] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/images/about.php"] [unique_id "adKZzlNFl1NiyNgNZAknRAAAAEo"]
[Mon Apr 06 01:20:17.459663 2026] [:error] [pid 51753:tid 51811] [client 20.91.197.85:1920] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/wp-includes/certificates/about.php"] [unique_id "adKZ0a3pmp1JkaicYbt0TgAAAQA"]
[Mon Apr 06 01:20:20.525770 2026] [:error] [pid 51584:tid 51707] [client 20.91.197.85:7393] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/wp-includes/certificates/about.php"] [unique_id "adKZ1MZ4qY_GoNCPARAdVgAAAMo"]
[Mon Apr 06 01:20:22.337623 2026] [:error] [pid 51584:tid 51697] [client 20.91.197.85:10655] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/wp-includes/certificates/about.php"] [unique_id "adKZ1sZ4qY_GoNCPARAdWgAAAMA"]
[Mon Apr 06 01:20:23.650812 2026] [:error] [pid 51753:tid 51826] [client 20.91.197.85:19752] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php/wp-includes/certificates/about.php"] [unique_id "adKZ163pmp1JkaicYbt0aQAAAQ8"]
[Mon Apr 06 01:20:25.421888 2026] [:error] [pid 51581:tid 51682] [client 20.91.197.85:12709] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "adKZ2d4k74fhQLPUy7E_LwAAAI0"]
[Mon Apr 06 01:20:27.245842 2026] [:error] [pid 51753:tid 51814] [client 20.91.197.85:10397] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "adKZ263pmp1JkaicYbt0dwAAAQM"]
[Mon Apr 06 01:20:28.578582 2026] [:error] [pid 51580:tid 51647] [client 20.91.197.85:7447] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "adKZ3FNFl1NiyNgNZAknbQAAAEg"]
[Mon Apr 06 01:20:30.303427 2026] [:error] [pid 51753:tid 51826] [client 20.91.197.85:1975] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-links.php"] [unique_id "adKZ3q3pmp1JkaicYbt0gQAAAQ8"]
[Mon Apr 06 01:20:32.270211 2026] [:error] [pid 51753:tid 51822] [client 20.91.197.85:19792] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alexantr/filemanager.php"] [unique_id "adKZ4K3pmp1JkaicYbt0jQAAAQs"]
[Mon Apr 06 01:20:33.991314 2026] [:error] [pid 51584:tid 51708] [client 20.91.197.85:10418] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alexantr/filemanager.php"] [unique_id "adKZ4cZ4qY_GoNCPARAdfwAAAMs"]
[Mon Apr 06 01:20:35.750153 2026] [:error] [pid 51584:tid 51702] [client 20.91.197.85:10452] [client 20.91.197.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alexantr/filemanager.php"] [unique_id "adKZ48Z4qY_GoNCPARAdhwAAAMU"]
[Mon Apr 06 01:20:39.721446 2026] [:error] [pid 51753:tid 51835] [client 20.91.197.85:7469] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Mon Apr 06 01:20:39.987222 2026] [:error] [pid 51753:tid 51816] [client 20.91.197.85:7469] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adKZ563pmp1JkaicYbt0uQAAAQU"]
[Mon Apr 06 01:21:10.811468 2026] [:error] [pid 51580:tid 51662] [client 20.91.197.85:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Mon Apr 06 01:21:11.362391 2026] [:error] [pid 51580:tid 51660] [client 20.91.197.85:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Mon Apr 06 01:21:11.636866 2026] [:error] [pid 51580:tid 51653] [client 20.91.197.85:12335] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "adKaB1NFl1NiyNgNZAkn2gAAAE4"]
[Mon Apr 06 01:21:19.797403 2026] [:error] [pid 51581:tid 51672] [client 20.91.197.85:1527] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adKaD94k74fhQLPUy7E_lAAAAIM"]
[Mon Apr 06 01:21:32.420969 2026] [:error] [pid 51753:tid 51818] [client 20.91.197.85:12514] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-login.php"] [unique_id "adKaHK3pmp1JkaicYbt1WQAAAQc"]
[Mon Apr 06 01:21:35.415407 2026] [:error] [pid 51753:tid 51815] [client 20.91.197.85:10325] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Mon Apr 06 01:21:35.946418 2026] [:error] [pid 51753:tid 51816] [client 20.91.197.85:10325] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adKaH63pmp1JkaicYbt1cwAAAQU"]
[Mon Apr 06 01:21:37.187213 2026] [:error] [pid 51584:tid 51717] [client 20.91.197.85:20410] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "adKaIcZ4qY_GoNCPARAd9gAAANQ"]
[Mon Apr 06 01:21:37.941149 2026] [:error] [pid 51753:tid 51822] [client 20.91.197.85:12560] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/alfa-rex.php"] [unique_id "adKaIa3pmp1JkaicYbt1ewAAAQs"]
[Mon Apr 06 01:21:38.752061 2026] [:error] [pid 51584:tid 51705] [client 20.91.197.85:12461] [client 20.91.197.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adKaIsZ4qY_GoNCPARAd-gAAAMg"]
[Mon Apr 06 01:53:09.757479 2026] [:error] [pid 51580:tid 51653] [client 39.34.188.180:59591] [client 39.34.188.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.34.188.180, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adKhhVNFl1NiyNgNZAlDdgAAAE4"]
[Mon Apr 06 01:53:09.771734 2026] [:error] [pid 51580:tid 51653] [client 39.34.188.180:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Apr 06 04:36:29.224139 2026] [:error] [pid 35688:tid 35766] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/zt2.php
[Mon Apr 06 04:36:29.489490 2026] [:error] [pid 35688:tid 35750] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/nco.php
[Mon Apr 06 04:36:29.758621 2026] [:error] [pid 35688:tid 35765] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/green.php
[Mon Apr 06 04:36:30.021678 2026] [:error] [pid 35688:tid 35756] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Mon Apr 06 04:36:30.281999 2026] [:error] [pid 35688:tid 35773] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Mon Apr 06 04:36:30.540899 2026] [:error] [pid 35688:tid 35769] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/nti.php
[Mon Apr 06 04:36:30.799912 2026] [:error] [pid 35688:tid 35761] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Mon Apr 06 04:36:31.078972 2026] [:error] [pid 35688:tid 35774] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Mon Apr 06 04:36:31.337125 2026] [:error] [pid 35688:tid 35752] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Mon Apr 06 04:36:31.603922 2026] [:error] [pid 35688:tid 35763] [client 20.215.186.156:54433] File does not exist: /usr/local/apache/htdocs/suspended-page/enacting.php
[Mon Apr 06 04:36:31.860978 2026] [:error] [pid 35688:tid 35771] [client 20.215.186.156:54433] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adLHz-Z85qg4jLsRpQyOzgAAAJU"]
[Mon Apr 06 04:36:36.275149 2026] [:error] [pid 9442:tid 9453] [client 20.215.186.156:58102] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adLH1EPsNnAJTnmz6saDWAAAAQk"]
[Mon Apr 06 04:36:39.164552 2026] [:error] [pid 35687:tid 35728] [client 20.215.186.156:58090] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adLH153LtDozV0i8BiuHdAAAAEU"]
[Mon Apr 06 04:36:41.492723 2026] [:error] [pid 35687:tid 35726] [client 20.215.186.156:8175] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adLH2Z3LtDozV0i8BiuHewAAAEM"]
[Mon Apr 06 04:36:43.882696 2026] [:error] [pid 35687:tid 35729] [client 20.215.186.156:54408] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/act.php"] [unique_id "adLH253LtDozV0i8BiuHhAAAAEY"]
[Mon Apr 06 04:36:45.892401 2026] [:error] [pid 9442:tid 9448] [client 20.215.186.156:8095] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/act.php"] [unique_id "adLH3UPsNnAJTnmz6saDbAAAAQQ"]
[Mon Apr 06 04:36:53.787290 2026] [:error] [pid 35688:tid 35769] [client 20.215.186.156:54406] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/act.php"] [unique_id "adLH5eZ85qg4jLsRpQyO7wAAAJM"]
[Mon Apr 06 04:36:59.415065 2026] [:error] [pid 9442:tid 9445] [client 20.215.186.156:8078] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adLH60PsNnAJTnmz6saDogAAAQE"]
[Mon Apr 06 04:37:03.455521 2026] [:error] [pid 35688:tid 35771] [client 20.215.186.156:12227] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adLH7-Z85qg4jLsRpQyO-QAAAJU"]
[Mon Apr 06 04:37:23.636977 2026] [:error] [pid 35786:tid 35817] [client 20.215.186.156:8099] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prosell2.php"] [unique_id "adLIA2gkfCKTaLhwaKT42AAAANg"]
[Mon Apr 06 04:37:25.530664 2026] [:error] [pid 35786:tid 35800] [client 20.215.186.156:58050] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prosell2.php"] [unique_id "adLIBWgkfCKTaLhwaKT43QAAAMc"]
[Mon Apr 06 04:37:27.375054 2026] [:error] [pid 9442:tid 9446] [client 20.215.186.156:48060] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prosell2.php"] [unique_id "adLIB0PsNnAJTnmz6saEGAAAAQI"]
[Mon Apr 06 04:37:28.892446 2026] [:error] [pid 35687:tid 35724] [client 20.215.186.156:64138] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bdktk.php"] [unique_id "adLICJ3LtDozV0i8BiuHrgAAAEE"]
[Mon Apr 06 04:37:31.092840 2026] [:error] [pid 35688:tid 35769] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/bdktk.php
[Mon Apr 06 04:37:31.350959 2026] [:error] [pid 35688:tid 35752] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Mon Apr 06 04:37:31.621042 2026] [:error] [pid 35688:tid 35768] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/bx.php
[Mon Apr 06 04:37:32.543122 2026] [:error] [pid 35688:tid 35764] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/unloathness.php
[Mon Apr 06 04:37:32.800424 2026] [:error] [pid 35688:tid 35763] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-stat.php
[Mon Apr 06 04:37:33.059067 2026] [:error] [pid 35688:tid 35761] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/xl9.php
[Mon Apr 06 04:37:33.326463 2026] [:error] [pid 35688:tid 35751] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/lolz.php
[Mon Apr 06 04:37:34.074570 2026] [:error] [pid 35688:tid 35767] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Mon Apr 06 04:37:34.332339 2026] [:error] [pid 35688:tid 35770] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/fs9.php
[Mon Apr 06 04:37:34.590193 2026] [:error] [pid 35688:tid 35766] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-tymanage.php
[Mon Apr 06 04:37:35.153069 2026] [:error] [pid 35688:tid 35773] [client 20.215.186.156:7987] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Mon Apr 06 04:37:35.409065 2026] [:error] [pid 35688:tid 35758] [client 20.215.186.156:7987] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/congeree.php"] [unique_id "adLID-Z85qg4jLsRpQyPQQAAAIg"]
[Mon Apr 06 04:37:38.358671 2026] [:error] [pid 35786:tid 35817] [client 20.215.186.156:48023] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/congeree.php"] [unique_id "adLIEmgkfCKTaLhwaKT5GAAAANg"]
[Mon Apr 06 04:37:40.969071 2026] [:error] [pid 35687:tid 35737] [client 20.215.186.156:55244] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/congeree.php"] [unique_id "adLIFJ3LtDozV0i8BiuHuwAAAE4"]
[Mon Apr 06 04:37:44.677405 2026] [:error] [pid 9442:tid 9455] [client 20.215.186.156:46660] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/congeree.php"] [unique_id "adLIGEPsNnAJTnmz6saEqwAAAQs"]
[Mon Apr 06 04:37:49.816331 2026] [:error] [pid 35786:tid 35807] [client 20.215.186.156:56111] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "adLIHWgkfCKTaLhwaKT5KQAAAM4"]
[Mon Apr 06 04:37:56.031620 2026] [:error] [pid 35786:tid 35807] [client 20.215.186.156:56081] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "adLIJGgkfCKTaLhwaKT5NAAAAM4"]
[Mon Apr 06 04:38:00.527896 2026] [:error] [pid 9442:tid 9448] [client 20.215.186.156:59706] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "adLIKEPsNnAJTnmz6saE8gAAAQQ"]
[Mon Apr 06 04:38:01.374283 2026] [:error] [pid 9442:tid 9464] [client 20.215.186.156:55240] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adLIKUPsNnAJTnmz6saE9AAAARQ"]
[Mon Apr 06 04:38:03.654346 2026] [:error] [pid 35687:tid 35748] [client 20.215.186.156:53097] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adLIK53LtDozV0i8BiuH1QAAAFg"]
[Mon Apr 06 04:38:04.453018 2026] [:error] [pid 35688:tid 35763] [client 20.215.186.156:49838] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adLILOZ85qg4jLsRpQyPcgAAAI0"]
[Mon Apr 06 04:38:05.890044 2026] [:error] [pid 9442:tid 9452] [client 20.215.186.156:55258] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adLILUPsNnAJTnmz6saFBgAAAQg"]
[Mon Apr 06 04:38:07.017037 2026] [:error] [pid 35786:tid 35817] [client 20.215.186.156:64137] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amxloxxr.php"] [unique_id "adLIL2gkfCKTaLhwaKT5TQAAANg"]
[Mon Apr 06 04:38:13.640392 2026] [:error] [pid 9442:tid 9447] [client 20.215.186.156:58870] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amxloxxr.php"] [unique_id "adLINUPsNnAJTnmz6saFKAAAAQM"]
[Mon Apr 06 04:38:18.938361 2026] [:error] [pid 35786:tid 35812] [client 20.215.186.156:49844] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amxloxxr.php"] [unique_id "adLIOmgkfCKTaLhwaKT5awAAANM"]
[Mon Apr 06 04:38:23.447992 2026] [:error] [pid 35688:tid 35765] [client 20.215.186.156:59754] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/greateb.php"] [unique_id "adLIP-Z85qg4jLsRpQyPhgAAAI8"]
[Mon Apr 06 04:38:25.445845 2026] [:error] [pid 9442:tid 9447] [client 20.215.186.156:12021] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/greateb.php"] [unique_id "adLIQUPsNnAJTnmz6saFgQAAAQM"]
[Mon Apr 06 04:38:28.100617 2026] [:error] [pid 35786:tid 35800] [client 20.215.186.156:59078] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/greateb.php"] [unique_id "adLIRGgkfCKTaLhwaKT5eQAAAMc"]
[Mon Apr 06 04:38:33.050142 2026] [:error] [pid 35687:tid 35729] [client 20.215.186.156:58388] [client 20.215.186.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/greateb.php"] [unique_id "adLISZ3LtDozV0i8BiuH7QAAAEY"]
[Mon Apr 06 04:38:35.695004 2026] [:error] [pid 35687:tid 35734] [client 20.215.186.156:59681] File does not exist: /usr/local/apache/htdocs/suspended-page/multirole.php
[Mon Apr 06 05:19:42.358232 2026] [:error] [pid 35686:tid 35706] [client 172.161.12.11:59615] [client 172.161.12.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adLR7sMKdea6oORd2fxDzAAAAAo"]
[Mon Apr 06 05:19:45.478714 2026] [:error] [pid 35786:tid 35796] [client 172.161.12.11:55400] [client 172.161.12.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adLR8WgkfCKTaLhwaKQSiQAAAMM"]
[Mon Apr 06 08:06:34.423963 2026] [:error] [pid 35687:tid 35745] [client 176.78.88.93:51517] [client 176.78.88.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.78.88.93, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adL5Cp3LtDozV0i8BivAlgAAAFY"]
[Mon Apr 06 08:06:34.430425 2026] [:error] [pid 35687:tid 35745] [client 176.78.88.93:51517] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Apr 06 14:47:50.490281 2026] [:error] [pid 35786:tid 35797] [client 112.208.162.148:50419] [client 112.208.162.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.162.148, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adNXFmgkfCKTaLhwaKThPwAAAMQ"]
[Mon Apr 06 14:47:50.494946 2026] [:error] [pid 35786:tid 35797] [client 112.208.162.148:50419] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Apr 06 22:40:58.303594 2026] [:error] [pid 10280:tid 10306] [client 194.26.192.92:61179] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Mon Apr 06 22:40:59.279163 2026] [:error] [pid 9442:tid 9444] [client 194.26.192.92:61347] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "adPF-0PsNnAJTnmz6sY-bAAAAQA"]
[Mon Apr 06 22:40:59.762258 2026] [:error] [pid 35688:tid 35774] [client 194.26.192.92:61391] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "adPF--Z85qg4jLsRpQz72wAAAJg"]
[Mon Apr 06 22:41:00.254911 2026] [:error] [pid 35688:tid 35751] [client 194.26.192.92:61433] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "adPF_OZ85qg4jLsRpQz73wAAAIE"]
[Mon Apr 06 22:41:01.250887 2026] [:error] [pid 35688:tid 35750] [client 194.26.192.92:61542] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/txets.php"] [unique_id "adPF_eZ85qg4jLsRpQz75gAAAIA"]
[Mon Apr 06 22:41:01.739057 2026] [:error] [pid 9442:tid 9462] [client 194.26.192.92:61608] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Mon Apr 06 22:41:02.235155 2026] [:error] [pid 9442:tid 9468] [client 194.26.192.92:61685] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Tue Apr 07 03:51:04.908905 2026] [:error] [pid 33736:tid 33836] [client 196.179.160.43:61594] [client 196.179.160.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.179.160.43, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adQOqMlKCx7O9Go89nph-AAAAJY"]
[Tue Apr 07 03:51:04.913728 2026] [:error] [pid 33736:tid 33836] [client 196.179.160.43:61594] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 07 04:27:09.125633 2026] [:error] [pid 37597:tid 37639] [client 74.89.168.18:63877] [client 74.89.168.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.89.168.18, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adQXHQ6uAY0QAy-8EEIj7QAAAEU"]
[Tue Apr 07 04:27:09.133024 2026] [:error] [pid 37597:tid 37639] [client 74.89.168.18:63877] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 07 09:38:40.905882 2026] [:error] [pid 37598:tid 37663] [client 156.202.44.71:65214] [client 156.202.44.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.202.44.71, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adRgIO9g7q_cV2WhPazqngAAAII"]
[Tue Apr 07 09:38:40.910534 2026] [:error] [pid 37598:tid 37663] [client 156.202.44.71:65214] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 07 10:56:42.128929 2026] [:error] [pid 37597:tid 37641] [client 217.216.72.68:64141] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adRyag6uAY0QAy-8EEK_hwAAAEc"]
[Tue Apr 07 10:56:42.291833 2026] [:error] [pid 37597:tid 37644] [client 217.216.72.68:64335] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/"] [unique_id "adRyag6uAY0QAy-8EEK_iQAAAEo"]
[Tue Apr 07 10:56:51.844651 2026] [:error] [pid 12948:tid 12973] [client 217.216.72.68:53244] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/readme.html"] [unique_id "adRyc8beSPAN8LvMqsY2nwAAARY"]
[Tue Apr 07 10:56:51.950687 2026] [:error] [pid 37719:tid 37724] [client 217.216.72.68:53428] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "adRyc009Xv52u2xXGLDvCAAAAMI"]
[Tue Apr 07 10:56:57.113714 2026] [:error] [pid 37597:tid 37641] [client 217.216.72.68:64317] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adRyeQ6uAY0QAy-8EEK_vwAAAEc"]
[Tue Apr 07 10:57:03.135937 2026] [:error] [pid 12948:tid 12963] [client 217.216.72.68:59099] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/"] [unique_id "adRyf8beSPAN8LvMqsY3BgAAAQw"]
[Tue Apr 07 10:57:13.704150 2026] [:error] [pid 37719:tid 37727] [client 217.216.72.68:57172] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "adRyiU09Xv52u2xXGLDvrgAAAMU"]
[Tue Apr 07 10:57:13.816000 2026] [:error] [pid 37719:tid 37731] [client 217.216.72.68:57816] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adRyiU09Xv52u2xXGLDvsAAAAMk"]
[Tue Apr 07 14:47:26.875118 2026] [:error] [pid 59804:tid 59813] [client 159.89.55.133:60778] [client 159.89.55.133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adSofnYVIXiPh5_eJTkw7wAAAgc"]
[Tue Apr 07 17:29:22.539162 2026] [:error] [pid 59551:tid 59566] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/image.php
[Tue Apr 07 17:29:22.791599 2026] [:error] [pid 59551:tid 59553] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Tue Apr 07 17:29:23.042980 2026] [:error] [pid 59551:tid 59564] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Tue Apr 07 17:29:23.299425 2026] [:error] [pid 59551:tid 59567] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Tue Apr 07 17:29:23.552755 2026] [:error] [pid 59551:tid 59571] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Tue Apr 07 17:29:23.805715 2026] [:error] [pid 59551:tid 59561] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/006.php
[Tue Apr 07 17:29:24.058598 2026] [:error] [pid 59551:tid 59563] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Tue Apr 07 17:29:24.311751 2026] [:error] [pid 59551:tid 59558] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Apr 07 17:29:24.564896 2026] [:error] [pid 59551:tid 59559] [client 20.234.13.12:12978] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Tue Apr 07 17:29:24.814789 2026] [:error] [pid 59551:tid 59572] [client 20.234.13.12:12978] [client 20.234.13.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "adTOdF7LN7Ubyqs-sVu0iQAAAZM"]
[Tue Apr 07 17:29:25.382476 2026] [:error] [pid 37597:tid 37645] [client 20.234.13.12:20235] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue Apr 07 17:29:25.631542 2026] [:error] [pid 37597:tid 37649] [client 20.234.13.12:20235] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adTOdQ6uAY0QAy-8EELdHQAAAE8"]
[Tue Apr 07 17:29:26.209572 2026] [:error] [pid 37597:tid 37638] [client 20.234.13.12:11841] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adTOdg6uAY0QAy-8EELdIgAAAEQ"]
[Tue Apr 07 17:29:26.720675 2026] [:error] [pid 37597:tid 37652] [client 20.234.13.12:15634] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adTOdg6uAY0QAy-8EELdKgAAAFI"]
[Tue Apr 07 17:29:27.235846 2026] [:error] [pid 37597:tid 37649] [client 20.234.13.12:20249] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adTOdw6uAY0QAy-8EELdLQAAAE8"]
[Tue Apr 07 17:29:27.746502 2026] [:error] [pid 37597:tid 37636] [client 20.234.13.12:13375] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adTOdw6uAY0QAy-8EELdMQAAAEI"]
[Tue Apr 07 17:29:28.276966 2026] [:error] [pid 37597:tid 37645] [client 20.234.13.12:14899] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adTOeA6uAY0QAy-8EELdOAAAAEs"]
[Tue Apr 07 17:29:28.824951 2026] [:error] [pid 37597:tid 37658] [client 20.234.13.12:8681] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adTOeA6uAY0QAy-8EELdOwAAAFg"]
[Tue Apr 07 17:29:29.336667 2026] [:error] [pid 59660:tid 59666] [client 20.234.13.12:20257] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adTOeTp3-oiX2o5bTszspwAAAcQ"]
[Tue Apr 07 17:29:29.837168 2026] [:error] [pid 12948:tid 12957] [client 20.234.13.12:19250] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adTOecbeSPAN8LvMqsaDWgAAAQY"]
[Tue Apr 07 17:29:30.361797 2026] [:error] [pid 37598:tid 37671] [client 20.234.13.12:13325] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adTOeu9g7q_cV2WhPax_zAAAAIo"]
[Tue Apr 07 17:29:30.936468 2026] [:error] [pid 37597:tid 37640] [client 20.234.13.12:8754] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adTOeg6uAY0QAy-8EELdPwAAAEY"]
[Tue Apr 07 17:29:31.483636 2026] [:error] [pid 37597:tid 37638] [client 20.234.13.12:8726] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adTOew6uAY0QAy-8EELdQQAAAEQ"]
[Tue Apr 07 17:29:32.026791 2026] [:error] [pid 59660:tid 59678] [client 20.234.13.12:8230] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adTOfDp3-oiX2o5bTszsqAAAAdA"]
[Tue Apr 07 17:29:32.587963 2026] [:error] [pid 59804:tid 59812] [client 20.234.13.12:8255] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adTOfHYVIXiPh5_eJTlilQAAAgY"]
[Tue Apr 07 17:29:33.157754 2026] [:error] [pid 59660:tid 59663] [client 20.234.13.12:19104] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adTOfTp3-oiX2o5bTszsrAAAAcE"]
[Tue Apr 07 17:29:33.691757 2026] [:error] [pid 37719:tid 37743] [client 20.234.13.12:11515] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adTOfU09Xv52u2xXGLCn1AAAANU"]
[Tue Apr 07 17:29:34.217776 2026] [:error] [pid 37719:tid 37740] [client 20.234.13.12:10850] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "adTOfk09Xv52u2xXGLCn1wAAANI"]
[Tue Apr 07 17:29:34.768887 2026] [:error] [pid 37597:tid 37640] [client 20.234.13.12:19122] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "adTOfg6uAY0QAy-8EELdRgAAAEY"]
[Tue Apr 07 17:29:35.303824 2026] [:error] [pid 37597:tid 37653] [client 20.234.13.12:15727] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "adTOfw6uAY0QAy-8EELdSgAAAFM"]
[Tue Apr 07 17:29:35.831804 2026] [:error] [pid 59660:tid 59675] [client 20.234.13.12:18770] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "adTOfzp3-oiX2o5bTszsrwAAAc0"]
[Tue Apr 07 17:29:36.342006 2026] [:error] [pid 59660:tid 59679] [client 20.234.13.12:18636] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aee.php"] [unique_id "adTOgDp3-oiX2o5bTszssAAAAdE"]
[Tue Apr 07 17:29:36.855541 2026] [:error] [pid 59551:tid 59577] [client 20.234.13.12:18994] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aee.php"] [unique_id "adTOgF7LN7Ubyqs-sVu0jQAAAZg"]
[Tue Apr 07 17:29:37.371958 2026] [:error] [pid 59551:tid 59568] [client 20.234.13.12:18996] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aee.php"] [unique_id "adTOgV7LN7Ubyqs-sVu0kAAAAY8"]
[Tue Apr 07 17:29:37.902007 2026] [:error] [pid 37597:tid 37645] [client 20.234.13.12:15424] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aee.php"] [unique_id "adTOgQ6uAY0QAy-8EELdUQAAAEs"]
[Tue Apr 07 17:29:38.430453 2026] [:error] [pid 37597:tid 37653] [client 20.234.13.12:18743] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adTOgg6uAY0QAy-8EELdVAAAAFM"]
[Tue Apr 07 17:29:38.975604 2026] [:error] [pid 37597:tid 37639] [client 20.234.13.12:8681] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adTOgg6uAY0QAy-8EELdWAAAAEU"]
[Tue Apr 07 17:29:39.481892 2026] [:error] [pid 59551:tid 59567] [client 20.234.13.12:18609] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adTOg17LN7Ubyqs-sVu0lgAAAY4"]
[Tue Apr 07 17:29:40.056563 2026] [:error] [pid 59490:tid 59506] [client 20.234.13.12:18985] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adTOhEcw8OFbiUZ7Rx1H1AAAAU4"]
[Tue Apr 07 17:29:40.567920 2026] [:error] [pid 59551:tid 59561] [client 20.234.13.12:18793] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ruabjw00.php"] [unique_id "adTOhF7LN7Ubyqs-sVu0mAAAAYg"]
[Tue Apr 07 17:29:41.108189 2026] [:error] [pid 37598:tid 37667] [client 20.234.13.12:17789] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ruabjw00.php"] [unique_id "adTOhe9g7q_cV2WhPax_2gAAAIY"]
[Tue Apr 07 17:29:41.690114 2026] [:error] [pid 37597:tid 37641] [client 20.234.13.12:19000] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ruabjw00.php"] [unique_id "adTOhQ6uAY0QAy-8EELdYwAAAEc"]
[Tue Apr 07 17:29:42.303684 2026] [:error] [pid 37598:tid 37681] [client 20.234.13.12:18573] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ruabjw00.php"] [unique_id "adTOhu9g7q_cV2WhPax_3AAAAJQ"]
[Tue Apr 07 17:29:42.819571 2026] [:error] [pid 59660:tid 59663] [client 20.234.13.12:13267] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTOhjp3-oiX2o5bTszstwAAAcE"]
[Tue Apr 07 17:29:43.363296 2026] [:error] [pid 37598:tid 37676] [client 20.234.13.12:18805] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTOh-9g7q_cV2WhPax_4AAAAI8"]
[Tue Apr 07 17:29:43.929986 2026] [:error] [pid 12948:tid 12962] [client 20.234.13.12:14801] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTOh8beSPAN8LvMqsaDXgAAAQs"]
[Tue Apr 07 17:29:44.462838 2026] [:error] [pid 37719:tid 37737] [client 20.234.13.12:12147] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTOiE09Xv52u2xXGLCn7wAAAM8"]
[Tue Apr 07 17:29:44.972044 2026] [:error] [pid 12948:tid 12958] [client 20.234.13.12:14218] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webx.php"] [unique_id "adTOiMbeSPAN8LvMqsaDYAAAAQc"]
[Tue Apr 07 17:29:45.510782 2026] [:error] [pid 37598:tid 37683] [client 20.234.13.12:20181] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webx.php"] [unique_id "adTOie9g7q_cV2WhPax_5AAAAJY"]
[Tue Apr 07 17:29:46.030791 2026] [:error] [pid 37597:tid 37642] [client 20.234.13.12:10806] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webx.php"] [unique_id "adTOig6uAY0QAy-8EELdagAAAEg"]
[Tue Apr 07 17:29:46.543994 2026] [:error] [pid 59804:tid 59812] [client 20.234.13.12:14014] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/webx.php"] [unique_id "adTOinYVIXiPh5_eJTlisQAAAgY"]
[Tue Apr 07 17:29:47.078795 2026] [:error] [pid 37597:tid 37658] [client 20.234.13.12:10428] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adTOiw6uAY0QAy-8EELdbwAAAFg"]
[Tue Apr 07 17:29:47.618600 2026] [:error] [pid 59660:tid 59684] [client 20.234.13.12:1129] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adTOizp3-oiX2o5bTszsugAAAdY"]
[Tue Apr 07 17:29:48.160748 2026] [:error] [pid 59660:tid 59665] [client 20.234.13.12:19945] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adTOjDp3-oiX2o5bTszsvAAAAcM"]
[Tue Apr 07 17:29:48.682185 2026] [:error] [pid 59490:tid 59502] [client 20.234.13.12:19944] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adTOjEcw8OFbiUZ7Rx1H4QAAAUo"]
[Tue Apr 07 17:29:49.188755 2026] [:error] [pid 59551:tid 59565] [client 20.234.13.12:9409] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "adTOjV7LN7Ubyqs-sVu0pAAAAYw"]
[Tue Apr 07 17:29:49.781411 2026] [:error] [pid 37597:tid 37641] [client 20.234.13.12:10782] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "adTOjQ6uAY0QAy-8EELddAAAAEc"]
[Tue Apr 07 17:29:50.293628 2026] [:error] [pid 37719:tid 37729] [client 20.234.13.12:13971] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "adTOjk09Xv52u2xXGLCoBwAAAMc"]
[Tue Apr 07 17:29:50.891657 2026] [:error] [pid 59660:tid 59662] [client 20.234.13.12:11956] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-22.php"] [unique_id "adTOjjp3-oiX2o5bTszswwAAAcA"]
[Tue Apr 07 17:29:51.425179 2026] [:error] [pid 12948:tid 12970] [client 20.234.13.12:15856] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/villain.php"] [unique_id "adTOj8beSPAN8LvMqsaDZwAAARM"]
[Tue Apr 07 17:29:51.965579 2026] [:error] [pid 12948:tid 12969] [client 20.234.13.12:17376] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/villain.php"] [unique_id "adTOj8beSPAN8LvMqsaDaQAAARI"]
[Tue Apr 07 17:29:52.468150 2026] [:error] [pid 37719:tid 37744] [client 20.234.13.12:10780] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/villain.php"] [unique_id "adTOkE09Xv52u2xXGLCoCgAAANY"]
[Tue Apr 07 17:29:53.070232 2026] [:error] [pid 59551:tid 59559] [client 20.234.13.12:14223] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/villain.php"] [unique_id "adTOkV7LN7Ubyqs-sVu0qgAAAYY"]
[Tue Apr 07 17:29:53.633286 2026] [:error] [pid 12948:tid 12964] [client 20.234.13.12:10426] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-db.php"] [unique_id "adTOkcbeSPAN8LvMqsaDbQAAAQ0"]
[Tue Apr 07 17:29:54.183124 2026] [:error] [pid 59804:tid 59809] [client 20.234.13.12:9457] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-db.php"] [unique_id "adTOknYVIXiPh5_eJTlivAAAAgM"]
[Tue Apr 07 17:29:54.685150 2026] [:error] [pid 12948:tid 12965] [client 20.234.13.12:18502] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-db.php"] [unique_id "adTOksbeSPAN8LvMqsaDcQAAAQ4"]
[Tue Apr 07 17:29:55.189670 2026] [:error] [pid 59804:tid 59819] [client 20.234.13.12:10425] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-db.php"] [unique_id "adTOk3YVIXiPh5_eJTlivwAAAg0"]
[Tue Apr 07 17:29:55.704020 2026] [:error] [pid 12948:tid 12973] [client 20.234.13.12:12148] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adTOk8beSPAN8LvMqsaDcwAAARY"]
[Tue Apr 07 17:29:56.288305 2026] [:error] [pid 37719:tid 37741] [client 20.234.13.12:9424] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adTOlE09Xv52u2xXGLCoDQAAANM"]
[Tue Apr 07 17:29:56.818829 2026] [:error] [pid 12948:tid 12970] [client 20.234.13.12:18533] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adTOlMbeSPAN8LvMqsaDdQAAARM"]
[Tue Apr 07 17:29:57.399511 2026] [:error] [pid 59660:tid 59683] [client 20.234.13.12:19718] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adTOlTp3-oiX2o5bTszs0gAAAdU"]
[Tue Apr 07 17:29:57.955824 2026] [:error] [pid 59804:tid 59813] [client 20.234.13.12:14237] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "adTOlXYVIXiPh5_eJTliwgAAAgc"]
[Tue Apr 07 17:29:58.526283 2026] [:error] [pid 59804:tid 59826] [client 20.234.13.12:18555] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "adTOlnYVIXiPh5_eJTliwwAAAhQ"]
[Tue Apr 07 17:29:59.067047 2026] [:error] [pid 59804:tid 59816] [client 20.234.13.12:1126] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "adTOl3YVIXiPh5_eJTlixAAAAgo"]
[Tue Apr 07 17:29:59.601287 2026] [:error] [pid 37596:tid 37620] [client 20.234.13.12:14794] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an7.php"] [unique_id "adTOl6paAOZHEjRWjP2CnQAAAA4"]
[Tue Apr 07 17:30:00.106820 2026] [:error] [pid 59660:tid 59678] [client 20.234.13.12:10372] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adTOmDp3-oiX2o5bTszs2AAAAdA"]
[Tue Apr 07 17:30:00.639640 2026] [:error] [pid 37597:tid 37650] [client 20.234.13.12:10422] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adTOmA6uAY0QAy-8EELdfAAAAFA"]
[Tue Apr 07 17:30:01.171473 2026] [:error] [pid 59551:tid 59558] [client 20.234.13.12:13984] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adTOmV7LN7Ubyqs-sVu0rgAAAYU"]
[Tue Apr 07 17:30:01.695496 2026] [:error] [pid 37598:tid 37668] [client 20.234.13.12:17727] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adTOme9g7q_cV2WhPax_-gAAAIc"]
[Tue Apr 07 17:30:02.218888 2026] [:error] [pid 37719:tid 37729] [client 20.234.13.12:13603] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uxijj.php"] [unique_id "adTOmk09Xv52u2xXGLCoEQAAAMc"]
[Tue Apr 07 17:30:02.745874 2026] [:error] [pid 37596:tid 37621] [client 20.234.13.12:10813] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uxijj.php"] [unique_id "adTOmqpaAOZHEjRWjP2CoQAAAA8"]
[Tue Apr 07 17:30:03.261611 2026] [:error] [pid 37596:tid 37617] [client 20.234.13.12:19908] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uxijj.php"] [unique_id "adTOm6paAOZHEjRWjP2CowAAAAs"]
[Tue Apr 07 17:30:03.851927 2026] [:error] [pid 59804:tid 59824] [client 20.234.13.12:12126] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uxijj.php"] [unique_id "adTOm3YVIXiPh5_eJTliygAAAhI"]
[Tue Apr 07 17:30:04.393535 2026] [:error] [pid 59804:tid 59820] [client 20.234.13.12:17749] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs7.php"] [unique_id "adTOnHYVIXiPh5_eJTlizQAAAg4"]
[Tue Apr 07 17:30:04.923016 2026] [:error] [pid 59551:tid 59564] [client 20.234.13.12:13601] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs7.php"] [unique_id "adTOnF7LN7Ubyqs-sVu0uQAAAYs"]
[Tue Apr 07 17:30:05.446437 2026] [:error] [pid 59804:tid 59808] [client 20.234.13.12:18658] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs7.php"] [unique_id "adTOnXYVIXiPh5_eJTli0QAAAgI"]
[Tue Apr 07 17:30:05.980367 2026] [:error] [pid 37596:tid 37606] [client 20.234.13.12:10373] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs7.php"] [unique_id "adTOnapaAOZHEjRWjP2CqAAAAAA"]
[Tue Apr 07 17:30:06.493894 2026] [:error] [pid 37596:tid 37627] [client 20.234.13.12:18626] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool2.php"] [unique_id "adTOnqpaAOZHEjRWjP2CqQAAABU"]
[Tue Apr 07 17:30:07.010356 2026] [:error] [pid 37596:tid 37620] [client 20.234.13.12:20163] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool2.php"] [unique_id "adTOn6paAOZHEjRWjP2CrAAAAA4"]
[Tue Apr 07 17:30:07.520468 2026] [:error] [pid 37719:tid 37732] [client 20.234.13.12:13649] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool2.php"] [unique_id "adTOn009Xv52u2xXGLCoEwAAAMo"]
[Tue Apr 07 17:30:08.100996 2026] [:error] [pid 59551:tid 59576] [client 20.234.13.12:19127] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool2.php"] [unique_id "adTOoF7LN7Ubyqs-sVu0vwAAAZc"]
[Tue Apr 07 17:30:08.651367 2026] [:error] [pid 37597:tid 37652] [client 20.234.13.12:13262] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zjllx.php"] [unique_id "adTOoA6uAY0QAy-8EELdjAAAAFI"]
[Tue Apr 07 17:30:09.224538 2026] [:error] [pid 59804:tid 59818] [client 20.234.13.12:19995] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zjllx.php"] [unique_id "adTOoXYVIXiPh5_eJTli2gAAAgw"]
[Tue Apr 07 17:30:09.865844 2026] [:error] [pid 59804:tid 59808] [client 20.234.13.12:19004] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zjllx.php"] [unique_id "adTOoXYVIXiPh5_eJTli3AAAAgI"]
[Tue Apr 07 17:30:10.514463 2026] [:error] [pid 37597:tid 37640] [client 20.234.13.12:18625] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zjllx.php"] [unique_id "adTOog6uAY0QAy-8EELdkgAAAEY"]
[Tue Apr 07 17:30:11.034747 2026] [:error] [pid 37719:tid 37738] [client 20.234.13.12:11478] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "adTOo009Xv52u2xXGLCoFQAAANA"]
[Tue Apr 07 17:30:11.570040 2026] [:error] [pid 37597:tid 37655] [client 20.234.13.12:9286] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "adTOow6uAY0QAy-8EELdmQAAAFU"]
[Tue Apr 07 17:30:12.104922 2026] [:error] [pid 37597:tid 37656] [client 20.234.13.12:18647] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "adTOpA6uAY0QAy-8EELdmwAAAFY"]
[Tue Apr 07 17:30:12.692430 2026] [:error] [pid 37597:tid 37635] [client 20.234.13.12:19247] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/h2.php"] [unique_id "adTOpA6uAY0QAy-8EELdngAAAEE"]
[Tue Apr 07 17:30:13.258694 2026] [:error] [pid 37597:tid 37649] [client 20.234.13.12:13940] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adTOpQ6uAY0QAy-8EELdpAAAAE8"]
[Tue Apr 07 17:30:13.803859 2026] [:error] [pid 59804:tid 59825] [client 20.234.13.12:9308] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adTOpXYVIXiPh5_eJTli4AAAAhM"]
[Tue Apr 07 17:30:14.332039 2026] [:error] [pid 37719:tid 37743] [client 20.234.13.12:14889] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adTOpk09Xv52u2xXGLCoHQAAANU"]
[Tue Apr 07 17:30:14.840435 2026] [:error] [pid 12948:tid 12958] [client 20.234.13.12:12701] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adTOpsbeSPAN8LvMqsaDgAAAAQc"]
[Tue Apr 07 17:30:15.356958 2026] [:error] [pid 37597:tid 37655] [client 20.234.13.12:16725] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adTOpw6uAY0QAy-8EELdpgAAAFU"]
[Tue Apr 07 17:30:15.871738 2026] [:error] [pid 37597:tid 37635] [client 20.234.13.12:9291] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adTOpw6uAY0QAy-8EELdqQAAAEE"]
[Tue Apr 07 17:30:16.411407 2026] [:error] [pid 59804:tid 59826] [client 20.234.13.12:19203] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adTOqHYVIXiPh5_eJTli4gAAAhQ"]
[Tue Apr 07 17:30:16.935830 2026] [:error] [pid 59804:tid 59818] [client 20.234.13.12:11464] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adTOqHYVIXiPh5_eJTli4wAAAgw"]
[Tue Apr 07 17:30:17.496192 2026] [:error] [pid 59804:tid 59817] [client 20.234.13.12:15896] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "adTOqXYVIXiPh5_eJTli5AAAAgs"]
[Tue Apr 07 17:30:18.046676 2026] [:error] [pid 59660:tid 59668] [client 20.234.13.12:8731] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "adTOqjp3-oiX2o5bTszs2wAAAcY"]
[Tue Apr 07 17:30:18.563441 2026] [:error] [pid 37597:tid 37654] [client 20.234.13.12:11492] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "adTOqg6uAY0QAy-8EELdugAAAFQ"]
[Tue Apr 07 17:30:19.140538 2026] [:error] [pid 37598:tid 37671] [client 20.234.13.12:12706] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dbc.php"] [unique_id "adTOq-9g7q_cV2WhPayABAAAAIo"]
[Tue Apr 07 17:30:19.658164 2026] [:error] [pid 12948:tid 12959] [client 20.234.13.12:1033] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTOq8beSPAN8LvMqsaDhAAAAQg"]
[Tue Apr 07 17:30:20.162353 2026] [:error] [pid 37598:tid 37667] [client 20.234.13.12:19266] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTOrO9g7q_cV2WhPayABQAAAIY"]
[Tue Apr 07 17:30:20.670296 2026] [:error] [pid 37719:tid 37745] [client 20.234.13.12:12735] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTOrE09Xv52u2xXGLCoLQAAANc"]
[Tue Apr 07 17:30:21.187503 2026] [:error] [pid 59660:tid 59669] [client 20.234.13.12:13206] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTOrTp3-oiX2o5bTszs3AAAAcc"]
[Tue Apr 07 17:30:21.698977 2026] [:error] [pid 37719:tid 37736] [client 20.234.13.12:19276] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ukaa.php"] [unique_id "adTOrU09Xv52u2xXGLCoNwAAAM4"]
[Tue Apr 07 17:30:22.205997 2026] [:error] [pid 37597:tid 37637] [client 20.234.13.12:11870] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ukaa.php"] [unique_id "adTOrg6uAY0QAy-8EELdxgAAAEM"]
[Tue Apr 07 17:30:22.724972 2026] [:error] [pid 37719:tid 37723] [client 20.234.13.12:19026] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ukaa.php"] [unique_id "adTOrk09Xv52u2xXGLCoOwAAAME"]
[Tue Apr 07 17:30:23.322028 2026] [:error] [pid 37597:tid 37640] [client 20.234.13.12:13099] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ukaa.php"] [unique_id "adTOrw6uAY0QAy-8EELdyQAAAEY"]
[Tue Apr 07 17:30:23.902998 2026] [:error] [pid 59551:tid 59569] [client 20.234.13.12:13356] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "adTOr17LN7Ubyqs-sVu0xQAAAZA"]
[Tue Apr 07 17:30:24.457495 2026] [:error] [pid 59551:tid 59570] [client 20.234.13.12:12663] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "adTOsF7LN7Ubyqs-sVu0xwAAAZE"]
[Tue Apr 07 17:30:24.985803 2026] [:error] [pid 12948:tid 12953] [client 20.234.13.12:11700] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "adTOsMbeSPAN8LvMqsaDjwAAAQI"]
[Tue Apr 07 17:30:25.493953 2026] [:error] [pid 59551:tid 59560] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Tue Apr 07 17:30:25.746782 2026] [:error] [pid 59551:tid 59568] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Tue Apr 07 17:30:27.345283 2026] [:error] [pid 59551:tid 59568] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Tue Apr 07 17:30:27.597949 2026] [:error] [pid 59551:tid 59561] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Tue Apr 07 17:30:27.853897 2026] [:error] [pid 59551:tid 59559] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Tue Apr 07 17:30:28.110284 2026] [:error] [pid 59551:tid 59566] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/cc13.php
[Tue Apr 07 17:30:28.362521 2026] [:error] [pid 59551:tid 59564] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Tue Apr 07 17:30:28.615367 2026] [:error] [pid 59551:tid 59567] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/ccu.php
[Tue Apr 07 17:30:28.876872 2026] [:error] [pid 59551:tid 59572] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Tue Apr 07 17:30:29.131667 2026] [:error] [pid 59551:tid 59573] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Tue Apr 07 17:30:29.408269 2026] [:error] [pid 59551:tid 59571] [client 20.234.13.12:11621] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-turn.php
[Tue Apr 07 17:30:29.658128 2026] [:error] [pid 59551:tid 59555] [client 20.234.13.12:11621] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adTOtV7LN7Ubyqs-sVu04gAAAYI"]
[Tue Apr 07 17:30:30.166310 2026] [:error] [pid 59551:tid 59554] [client 20.234.13.12:19560] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adTOtl7LN7Ubyqs-sVu05AAAAYE"]
[Tue Apr 07 17:30:30.696269 2026] [:error] [pid 37597:tid 37641] [client 20.234.13.12:19510] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adTOtg6uAY0QAy-8EELd1gAAAEc"]
[Tue Apr 07 17:30:31.253745 2026] [:error] [pid 37597:tid 37649] [client 20.234.13.12:19140] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adTOtw6uAY0QAy-8EELd2QAAAE8"]
[Tue Apr 07 17:30:31.865666 2026] [:error] [pid 37719:tid 37727] [client 20.234.13.12:13148] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adTOt009Xv52u2xXGLCoUgAAAMU"]
[Tue Apr 07 17:30:32.469751 2026] [:error] [pid 37719:tid 37722] [client 20.234.13.12:11288] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adTOuE09Xv52u2xXGLCoVgAAAMA"]
[Tue Apr 07 17:30:33.162645 2026] [:error] [pid 37719:tid 37732] [client 20.234.13.12:19576] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adTOuU09Xv52u2xXGLCoXQAAAMo"]
[Tue Apr 07 17:30:33.788002 2026] [:error] [pid 37597:tid 37648] [client 20.234.13.12:19533] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adTOuQ6uAY0QAy-8EELd5gAAAE4"]
[Tue Apr 07 17:30:34.385681 2026] [:error] [pid 59490:tid 59500] [client 20.234.13.12:8396] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "adTOukcw8OFbiUZ7Rx1H9QAAAUg"]
[Tue Apr 07 17:30:34.986797 2026] [:error] [pid 59551:tid 59555] [client 20.234.13.12:19809] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "adTOul7LN7Ubyqs-sVu06gAAAYI"]
[Tue Apr 07 17:30:35.532460 2026] [:error] [pid 37596:tid 37619] [client 20.234.13.12:11052] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "adTOu6paAOZHEjRWjP2CuQAAAA0"]
[Tue Apr 07 17:30:36.180103 2026] [:error] [pid 37598:tid 37683] [client 20.234.13.12:9525] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kolda.php"] [unique_id "adTOvO9g7q_cV2WhPayADQAAAJY"]
[Tue Apr 07 17:30:36.768079 2026] [:error] [pid 37597:tid 37642] [client 20.234.13.12:11301] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "adTOvA6uAY0QAy-8EELd9AAAAEg"]
[Tue Apr 07 17:30:37.325300 2026] [:error] [pid 37719:tid 37734] [client 20.234.13.12:18124] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "adTOvU09Xv52u2xXGLCoawAAAMw"]
[Tue Apr 07 17:30:37.966152 2026] [:error] [pid 37597:tid 37655] [client 20.234.13.12:19795] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "adTOvQ6uAY0QAy-8EELd9wAAAFU"]
[Tue Apr 07 17:30:38.632487 2026] [:error] [pid 59551:tid 59570] [client 20.234.13.12:8394] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yussef.php"] [unique_id "adTOvl7LN7Ubyqs-sVu06wAAAZE"]
[Tue Apr 07 17:30:39.393046 2026] [:error] [pid 37597:tid 37644] [client 20.234.13.12:13151] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ay.php"] [unique_id "adTOvw6uAY0QAy-8EELeAgAAAEo"]
[Tue Apr 07 17:30:39.976062 2026] [:error] [pid 59490:tid 59496] [client 20.234.13.12:8405] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ay.php"] [unique_id "adTOv0cw8OFbiUZ7Rx1H9gAAAUQ"]
[Tue Apr 07 17:30:40.475955 2026] [:error] [pid 59490:tid 59492] [client 20.234.13.12:11273] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ay.php"] [unique_id "adTOwEcw8OFbiUZ7Rx1H9wAAAUA"]
[Tue Apr 07 17:30:41.011317 2026] [:error] [pid 37597:tid 37654] [client 20.234.13.12:19582] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ay.php"] [unique_id "adTOwQ6uAY0QAy-8EELeCAAAAFQ"]
[Tue Apr 07 17:30:41.557502 2026] [:error] [pid 37597:tid 37646] [client 20.234.13.12:19554] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adTOwQ6uAY0QAy-8EELeCgAAAEw"]
[Tue Apr 07 17:30:42.141812 2026] [:error] [pid 37597:tid 37642] [client 20.234.13.12:20807] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adTOwg6uAY0QAy-8EELeEgAAAEg"]
[Tue Apr 07 17:30:42.714484 2026] [:error] [pid 37597:tid 37654] [client 20.234.13.12:9545] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adTOwg6uAY0QAy-8EELeGAAAAFQ"]
[Tue Apr 07 17:30:43.285349 2026] [:error] [pid 37719:tid 37742] [client 20.234.13.12:19521] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adTOw009Xv52u2xXGLCohQAAANQ"]
[Tue Apr 07 17:30:43.825612 2026] [:error] [pid 12948:tid 12955] [client 20.234.13.12:9521] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "adTOw8beSPAN8LvMqsaDngAAAQQ"]
[Tue Apr 07 17:30:44.401010 2026] [:error] [pid 37597:tid 37639] [client 20.234.13.12:19498] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "adTOxA6uAY0QAy-8EELeHwAAAEU"]
[Tue Apr 07 17:30:44.951581 2026] [:error] [pid 37597:tid 37636] [client 20.234.13.12:9516] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "adTOxA6uAY0QAy-8EELeIwAAAEI"]
[Tue Apr 07 17:30:45.480466 2026] [:error] [pid 59804:tid 59828] [client 20.234.13.12:11028] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/btx25.php"] [unique_id "adTOxXYVIXiPh5_eJTli8gAAAhY"]
[Tue Apr 07 17:30:46.038704 2026] [:error] [pid 37719:tid 37745] [client 20.234.13.12:20869] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "adTOxk09Xv52u2xXGLCokwAAANc"]
[Tue Apr 07 17:30:46.645666 2026] [:error] [pid 37598:tid 37678] [client 20.234.13.12:19182] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "adTOxu9g7q_cV2WhPayAFAAAAJE"]
[Tue Apr 07 17:30:47.237581 2026] [:error] [pid 37598:tid 37672] [client 20.234.13.12:11283] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "adTOx-9g7q_cV2WhPayAGAAAAIs"]
[Tue Apr 07 17:30:47.798612 2026] [:error] [pid 37719:tid 37744] [client 20.234.13.12:11265] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x123x.php"] [unique_id "adTOx009Xv52u2xXGLComgAAANY"]
[Tue Apr 07 17:30:48.343609 2026] [:error] [pid 37719:tid 37734] [client 20.234.13.12:19178] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "adTOyE09Xv52u2xXGLComwAAAMw"]
[Tue Apr 07 17:30:49.010792 2026] [:error] [pid 37719:tid 37725] [client 20.234.13.12:12045] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "adTOyU09Xv52u2xXGLCoqQAAAMM"]
[Tue Apr 07 17:30:49.573528 2026] [:error] [pid 37719:tid 37722] [client 20.234.13.12:11425] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "adTOyU09Xv52u2xXGLCorAAAAMA"]
[Tue Apr 07 17:30:50.085187 2026] [:error] [pid 59804:tid 59807] [client 20.234.13.12:12034] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/trx24.php"] [unique_id "adTOynYVIXiPh5_eJTli-AAAAgE"]
[Tue Apr 07 17:30:50.716298 2026] [:error] [pid 37719:tid 37729] [client 20.234.13.12:17576] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adTOyk09Xv52u2xXGLCotAAAAMc"]
[Tue Apr 07 17:30:51.223358 2026] [:error] [pid 59551:tid 59563] [client 20.234.13.12:11297] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adTOy17LN7Ubyqs-sVu0-wAAAYo"]
[Tue Apr 07 17:30:51.820816 2026] [:error] [pid 37719:tid 37739] [client 20.234.13.12:18212] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adTOy009Xv52u2xXGLCougAAANE"]
[Tue Apr 07 17:30:52.327985 2026] [:error] [pid 37719:tid 37736] [client 20.234.13.12:12848] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adTOzE09Xv52u2xXGLCovwAAAM4"]
[Tue Apr 07 17:30:52.843034 2026] [:error] [pid 12948:tid 12956] [client 20.234.13.12:19507] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adTOzMbeSPAN8LvMqsaDoQAAAQU"]
[Tue Apr 07 17:30:53.366149 2026] [:error] [pid 37596:tid 37620] [client 20.234.13.12:13138] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adTOzapaAOZHEjRWjP2CuwAAAA4"]
[Tue Apr 07 17:30:53.891558 2026] [:error] [pid 59551:tid 59577] [client 20.234.13.12:20871] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adTOzV7LN7Ubyqs-sVu1AAAAAZg"]
[Tue Apr 07 17:30:54.443197 2026] [:error] [pid 37597:tid 37658] [client 20.234.13.12:18199] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adTOzg6uAY0QAy-8EELePAAAAFg"]
[Tue Apr 07 17:30:55.082592 2026] [:error] [pid 37597:tid 37637] [client 20.234.13.12:12047] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adTOzw6uAY0QAy-8EELePwAAAEM"]
[Tue Apr 07 17:30:55.590054 2026] [:error] [pid 37596:tid 37625] [client 20.234.13.12:18120] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adTOz6paAOZHEjRWjP2CvAAAABM"]
[Tue Apr 07 17:30:56.093514 2026] [:error] [pid 37597:tid 37641] [client 20.234.13.12:19136] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adTO0A6uAY0QAy-8EELeRwAAAEc"]
[Tue Apr 07 17:30:56.615477 2026] [:error] [pid 37598:tid 37664] [client 20.234.13.12:13134] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adTO0O9g7q_cV2WhPayAIAAAAIM"]
[Tue Apr 07 17:30:57.163261 2026] [:error] [pid 37598:tid 37663] [client 20.234.13.12:18184] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adTO0e9g7q_cV2WhPayAIQAAAII"]
[Tue Apr 07 17:30:57.709933 2026] [:error] [pid 12948:tid 12967] [client 20.234.13.12:10028] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adTO0cbeSPAN8LvMqsaDpwAAARA"]
[Tue Apr 07 17:30:58.226498 2026] [:error] [pid 59490:tid 59505] [client 20.234.13.12:13145] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adTO0kcw8OFbiUZ7Rx1H-gAAAU0"]
[Tue Apr 07 17:30:58.734251 2026] [:error] [pid 37719:tid 37741] [client 20.234.13.12:11318] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adTO0k09Xv52u2xXGLCoxQAAANM"]
[Tue Apr 07 17:30:59.243382 2026] [:error] [pid 37719:tid 37732] [client 20.234.13.12:11779] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xdd.php"] [unique_id "adTO0009Xv52u2xXGLCoyQAAAMo"]
[Tue Apr 07 17:30:59.809834 2026] [:error] [pid 59551:tid 59568] [client 20.234.13.12:18155] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xdd.php"] [unique_id "adTO017LN7Ubyqs-sVu1CAAAAY8"]
[Tue Apr 07 17:31:00.323363 2026] [:error] [pid 59551:tid 59564] [client 20.234.13.12:11043] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xdd.php"] [unique_id "adTO1F7LN7Ubyqs-sVu1CgAAAYs"]
[Tue Apr 07 17:31:00.828328 2026] [:error] [pid 37597:tid 37657] [client 20.234.13.12:11789] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xdd.php"] [unique_id "adTO1A6uAY0QAy-8EELeVwAAAFc"]
[Tue Apr 07 17:31:01.330123 2026] [:error] [pid 37598:tid 37678] [client 20.234.13.12:11430] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adTO1e9g7q_cV2WhPayAJwAAAJE"]
[Tue Apr 07 17:31:01.875979 2026] [:error] [pid 37598:tid 37666] [client 20.234.13.12:9585] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adTO1e9g7q_cV2WhPayAKQAAAIU"]
[Tue Apr 07 17:31:02.428909 2026] [:error] [pid 59660:tid 59680] [client 20.234.13.12:17162] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adTO1jp3-oiX2o5bTszs-wAAAdI"]
[Tue Apr 07 17:31:02.948847 2026] [:error] [pid 59551:tid 59574] [client 20.234.13.12:17173] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adTO1l7LN7Ubyqs-sVu1DQAAAZU"]
[Tue Apr 07 17:31:03.493901 2026] [:error] [pid 37597:tid 37652] [client 20.234.13.12:18215] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adTO1w6uAY0QAy-8EELeYAAAAFI"]
[Tue Apr 07 17:31:04.084191 2026] [:error] [pid 59551:tid 59555] [client 20.234.13.12:1494] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adTO2F7LN7Ubyqs-sVu1DwAAAYI"]
[Tue Apr 07 17:31:04.615969 2026] [:error] [pid 37596:tid 37608] [client 20.234.13.12:17541] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adTO2KpaAOZHEjRWjP2CvgAAAAI"]
[Tue Apr 07 17:31:05.164863 2026] [:error] [pid 37596:tid 37628] [client 20.234.13.12:9031] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adTO2apaAOZHEjRWjP2CwAAAABY"]
[Tue Apr 07 17:31:05.713772 2026] [:error] [pid 37596:tid 37626] [client 20.234.13.12:17195] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update1.php"] [unique_id "adTO2apaAOZHEjRWjP2CwQAAABQ"]
[Tue Apr 07 17:31:06.281432 2026] [:error] [pid 37597:tid 37646] [client 20.234.13.12:1381] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update1.php"] [unique_id "adTO2g6uAY0QAy-8EELeagAAAEw"]
[Tue Apr 07 17:31:06.823193 2026] [:error] [pid 37596:tid 37607] [client 20.234.13.12:11807] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update1.php"] [unique_id "adTO2qpaAOZHEjRWjP2CxAAAAAE"]
[Tue Apr 07 17:31:07.419949 2026] [:error] [pid 59660:tid 59664] [client 20.234.13.12:1510] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update1.php"] [unique_id "adTO2zp3-oiX2o5bTszs_QAAAcI"]
[Tue Apr 07 17:31:07.951416 2026] [:error] [pid 37597:tid 37655] [client 20.234.13.12:18411] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTO2w6uAY0QAy-8EELecQAAAFU"]
[Tue Apr 07 17:31:08.561176 2026] [:error] [pid 37598:tid 37672] [client 20.234.13.12:17543] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTO3O9g7q_cV2WhPayANgAAAIs"]
[Tue Apr 07 17:31:09.143282 2026] [:error] [pid 37597:tid 37639] [client 20.234.13.12:12886] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTO3Q6uAY0QAy-8EELedQAAAEU"]
[Tue Apr 07 17:31:09.788535 2026] [:error] [pid 37597:tid 37642] [client 20.234.13.12:16476] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTO3Q6uAY0QAy-8EELedwAAAEg"]
[Tue Apr 07 17:31:10.429011 2026] [:error] [pid 37597:tid 37658] [client 20.234.13.12:20915] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTO3g6uAY0QAy-8EELeeQAAAFg"]
[Tue Apr 07 17:31:11.677078 2026] [:error] [pid 12948:tid 12962] [client 20.234.13.12:11525] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTO38beSPAN8LvMqsaDqAAAAQs"]
[Tue Apr 07 17:31:12.474532 2026] [:error] [pid 37598:tid 37670] [client 20.234.13.12:14598] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTO4O9g7q_cV2WhPayAOAAAAIk"]
[Tue Apr 07 17:31:13.039665 2026] [:error] [pid 59551:tid 59564] [client 20.234.13.12:11577] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTO4V7LN7Ubyqs-sVu1IwAAAYs"]
[Tue Apr 07 17:31:13.578573 2026] [:error] [pid 59490:tid 59503] [client 20.234.13.12:7931] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "adTO4Ucw8OFbiUZ7Rx1H_wAAAUs"]
[Tue Apr 07 17:31:14.235471 2026] [:error] [pid 59490:tid 59514] [client 20.234.13.12:20658] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "adTO4kcw8OFbiUZ7Rx1IAQAAAVY"]
[Tue Apr 07 17:31:14.797935 2026] [:error] [pid 59490:tid 59496] [client 20.234.13.12:9651] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "adTO4kcw8OFbiUZ7Rx1IAwAAAUQ"]
[Tue Apr 07 17:31:15.314644 2026] [:error] [pid 37597:tid 37645] [client 20.234.13.12:10282] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new2.php"] [unique_id "adTO4w6uAY0QAy-8EELeiwAAAEs"]
[Tue Apr 07 17:31:15.971133 2026] [:error] [pid 12948:tid 12957] [client 20.234.13.12:19385] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adTO48beSPAN8LvMqsaDrAAAAQY"]
[Tue Apr 07 17:31:16.513121 2026] [:error] [pid 12948:tid 12954] [client 20.234.13.12:9687] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adTO5MbeSPAN8LvMqsaDrgAAAQM"]
[Tue Apr 07 17:31:17.281488 2026] [:error] [pid 37719:tid 37729] [client 20.234.13.12:14356] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adTO5U09Xv52u2xXGLCo3gAAAMc"]
[Tue Apr 07 17:31:17.796038 2026] [:error] [pid 12948:tid 12964] [client 20.234.13.12:14051] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adTO5cbeSPAN8LvMqsaDsAAAAQ0"]
[Tue Apr 07 17:31:18.343028 2026] [:error] [pid 12948:tid 12970] [client 20.234.13.12:13487] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adTO5sbeSPAN8LvMqsaDsQAAARM"]
[Tue Apr 07 17:31:20.150164 2026] [:error] [pid 59490:tid 59497] [client 20.234.13.12:16249] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adTO6Ecw8OFbiUZ7Rx1ICAAAAUU"]
[Tue Apr 07 17:31:21.171479 2026] [:error] [pid 59660:tid 59680] [client 20.234.13.12:9714] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adTO6Tp3-oiX2o5bTsztAwAAAdI"]
[Tue Apr 07 17:31:21.696971 2026] [:error] [pid 12948:tid 12974] [client 20.234.13.12:11092] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adTO6cbeSPAN8LvMqsaDtwAAARc"]
[Tue Apr 07 17:31:22.281726 2026] [:error] [pid 59804:tid 59828] [client 20.234.13.12:16902] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adTO6nYVIXiPh5_eJTljDwAAAhY"]
[Tue Apr 07 17:31:22.889826 2026] [:error] [pid 59551:tid 59574] [client 20.234.13.12:17427] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adTO6l7LN7Ubyqs-sVu1MwAAAZU"]
[Tue Apr 07 17:31:23.578466 2026] [:error] [pid 59660:tid 59669] [client 20.234.13.12:10183] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adTO6zp3-oiX2o5bTsztCAAAAcc"]
[Tue Apr 07 17:31:24.120167 2026] [:error] [pid 37598:tid 37676] [client 20.234.13.12:12277] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adTO7O9g7q_cV2WhPayAPAAAAI8"]
[Tue Apr 07 17:31:24.673744 2026] [:error] [pid 59490:tid 59492] [client 20.234.13.12:15993] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adTO7Ecw8OFbiUZ7Rx1IDQAAAUA"]
[Tue Apr 07 17:31:25.248385 2026] [:error] [pid 37597:tid 37648] [client 20.234.13.12:11110] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adTO7Q6uAY0QAy-8EELemQAAAE4"]
[Tue Apr 07 17:31:25.951072 2026] [:error] [pid 37719:tid 37731] [client 20.234.13.12:16226] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adTO7U09Xv52u2xXGLCo9gAAAMk"]
[Tue Apr 07 17:31:26.471329 2026] [:error] [pid 37597:tid 37643] [client 20.234.13.12:17411] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adTO7g6uAY0QAy-8EELemgAAAEk"]
[Tue Apr 07 17:31:27.198374 2026] [:error] [pid 37719:tid 37730] [client 20.234.13.12:15560] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wo.php"] [unique_id "adTO7009Xv52u2xXGLCo_gAAAMg"]
[Tue Apr 07 17:31:27.801335 2026] [:error] [pid 37719:tid 37723] [client 20.234.13.12:17321] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wo.php"] [unique_id "adTO7009Xv52u2xXGLCpBwAAAME"]
[Tue Apr 07 17:31:28.553771 2026] [:error] [pid 37598:tid 37685] [client 20.234.13.12:15012] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wo.php"] [unique_id "adTO8O9g7q_cV2WhPayAQQAAAJg"]
[Tue Apr 07 17:31:29.914211 2026] [:error] [pid 37719:tid 37724] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php
[Tue Apr 07 17:31:30.188066 2026] [:error] [pid 37719:tid 37742] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Tue Apr 07 17:31:30.442981 2026] [:error] [pid 37719:tid 37743] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/floya.php
[Tue Apr 07 17:31:30.698923 2026] [:error] [pid 37719:tid 37734] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/wolf.php
[Tue Apr 07 17:31:30.952695 2026] [:error] [pid 37719:tid 37733] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/only.php
[Tue Apr 07 17:31:31.207128 2026] [:error] [pid 37719:tid 37735] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/vdb.php
[Tue Apr 07 17:31:31.460839 2026] [:error] [pid 37719:tid 37724] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/om.php
[Tue Apr 07 17:31:31.715173 2026] [:error] [pid 37719:tid 37742] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/ox.php
[Tue Apr 07 17:31:31.969649 2026] [:error] [pid 37719:tid 37738] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/htto.php
[Tue Apr 07 17:31:32.859564 2026] [:error] [pid 37719:tid 37738] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/h2h.php
[Tue Apr 07 17:31:33.114783 2026] [:error] [pid 37719:tid 37735] [client 20.234.13.12:7505] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Tue Apr 07 17:31:33.365827 2026] [:error] [pid 37719:tid 37729] [client 20.234.13.12:7505] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "adTO9U09Xv52u2xXGLCpMwAAAMc"]
[Tue Apr 07 17:31:33.975797 2026] [:error] [pid 37598:tid 37676] [client 20.234.13.12:11251] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "adTO9e9g7q_cV2WhPayASAAAAI8"]
[Tue Apr 07 17:31:34.548569 2026] [:error] [pid 37597:tid 37655] [client 20.234.13.12:21004] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "adTO9g6uAY0QAy-8EELeqQAAAFU"]
[Tue Apr 07 17:31:35.129885 2026] [:error] [pid 37719:tid 37733] [client 20.234.13.12:7512] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dichku.php"] [unique_id "adTO9009Xv52u2xXGLCpPgAAAMs"]
[Tue Apr 07 17:31:35.652117 2026] [:error] [pid 37719:tid 37740] [client 20.234.13.12:7440] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adTO9009Xv52u2xXGLCpPwAAANI"]
[Tue Apr 07 17:31:36.168301 2026] [:error] [pid 37596:tid 37627] [client 20.234.13.12:14310] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adTO-KpaAOZHEjRWjP2C4wAAABU"]
[Tue Apr 07 17:31:36.757363 2026] [:error] [pid 12948:tid 12968] [client 20.234.13.12:14306] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adTO-MbeSPAN8LvMqsaDvgAAARE"]
[Tue Apr 07 17:31:37.377418 2026] [:error] [pid 59551:tid 59570] [client 20.234.13.12:8509] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adTO-V7LN7Ubyqs-sVu1PgAAAZE"]
[Tue Apr 07 17:31:38.057779 2026] [:error] [pid 59660:tid 59675] [client 20.234.13.12:21000] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/store.php"] [unique_id "adTO-jp3-oiX2o5bTsztFQAAAc0"]
[Tue Apr 07 17:31:38.707974 2026] [:error] [pid 37597:tid 37658] [client 20.234.13.12:18252] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/store.php"] [unique_id "adTO-g6uAY0QAy-8EELergAAAFg"]
[Tue Apr 07 17:31:39.247036 2026] [:error] [pid 37598:tid 37670] [client 20.234.13.12:14928] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/store.php"] [unique_id "adTO--9g7q_cV2WhPayAUQAAAIk"]
[Tue Apr 07 17:31:39.903634 2026] [:error] [pid 37598:tid 37677] [client 20.234.13.12:17977] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/store.php"] [unique_id "adTO--9g7q_cV2WhPayAUgAAAJA"]
[Tue Apr 07 17:31:40.428705 2026] [:error] [pid 12948:tid 12973] [client 20.234.13.12:19432] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "adTO_MbeSPAN8LvMqsaDyQAAARY"]
[Tue Apr 07 17:31:40.968365 2026] [:error] [pid 37597:tid 37636] [client 20.234.13.12:17826] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "adTO_A6uAY0QAy-8EELesgAAAEI"]
[Tue Apr 07 17:31:41.479466 2026] [:error] [pid 37719:tid 37743] [client 20.234.13.12:17956] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "adTO_U09Xv52u2xXGLCpRAAAANU"]
[Tue Apr 07 17:31:42.046318 2026] [:error] [pid 37719:tid 37733] [client 20.234.13.12:14408] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xenium4.php"] [unique_id "adTO_k09Xv52u2xXGLCpRwAAAMs"]
[Tue Apr 07 17:31:42.643987 2026] [:error] [pid 59660:tid 59685] [client 20.234.13.12:16072] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adTO_jp3-oiX2o5bTsztFwAAAdc"]
[Tue Apr 07 17:31:43.237346 2026] [:error] [pid 37598:tid 37680] [client 20.234.13.12:19656] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adTO_-9g7q_cV2WhPayAVQAAAJM"]
[Tue Apr 07 17:31:43.785024 2026] [:error] [pid 37719:tid 37724] [client 20.234.13.12:9253] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adTO_009Xv52u2xXGLCpTAAAAMI"]
[Tue Apr 07 17:31:44.355446 2026] [:error] [pid 37597:tid 37647] [client 20.234.13.12:18265] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adTPAA6uAY0QAy-8EELetAAAAE0"]
[Tue Apr 07 17:31:44.893693 2026] [:error] [pid 59804:tid 59817] [client 20.234.13.12:16070] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpyur.php"] [unique_id "adTPAHYVIXiPh5_eJTljEwAAAgs"]
[Tue Apr 07 17:31:45.440715 2026] [:error] [pid 12948:tid 12952] [client 20.234.13.12:1601] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpyur.php"] [unique_id "adTPAcbeSPAN8LvMqsaDywAAAQE"]
[Tue Apr 07 17:31:46.003298 2026] [:error] [pid 59490:tid 59494] [client 20.234.13.12:9228] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpyur.php"] [unique_id "adTPAkcw8OFbiUZ7Rx1IEgAAAUI"]
[Tue Apr 07 17:31:46.569441 2026] [:error] [pid 37597:tid 37648] [client 20.234.13.12:18069] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpyur.php"] [unique_id "adTPAg6uAY0QAy-8EELevAAAAE4"]
[Tue Apr 07 17:31:47.097747 2026] [:error] [pid 37597:tid 37634] [client 20.234.13.12:9092] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum.php"] [unique_id "adTPAw6uAY0QAy-8EELevQAAAEA"]
[Tue Apr 07 17:31:47.737371 2026] [:error] [pid 59551:tid 59572] [client 20.234.13.12:1662] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum.php"] [unique_id "adTPA17LN7Ubyqs-sVu1RwAAAZM"]
[Tue Apr 07 17:31:48.251868 2026] [:error] [pid 59551:tid 59555] [client 20.234.13.12:19669] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum.php"] [unique_id "adTPBF7LN7Ubyqs-sVu1SAAAAYI"]
[Tue Apr 07 17:31:48.760347 2026] [:error] [pid 59804:tid 59809] [client 20.234.13.12:1630] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wglum.php"] [unique_id "adTPBHYVIXiPh5_eJTljGAAAAgM"]
[Tue Apr 07 17:31:49.281460 2026] [:error] [pid 59551:tid 59558] [client 20.234.13.12:19678] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adTPBV7LN7Ubyqs-sVu1SwAAAYU"]
[Tue Apr 07 17:31:49.810593 2026] [:error] [pid 37597:tid 37634] [client 20.234.13.12:15136] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adTPBQ6uAY0QAy-8EELeyQAAAEA"]
[Tue Apr 07 17:31:50.416286 2026] [:error] [pid 37597:tid 37635] [client 20.234.13.12:9216] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adTPBg6uAY0QAy-8EELezAAAAEE"]
[Tue Apr 07 17:31:50.988654 2026] [:error] [pid 37597:tid 37637] [client 20.234.13.12:10532] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adTPBg6uAY0QAy-8EELezgAAAEM"]
[Tue Apr 07 17:31:51.584206 2026] [:error] [pid 37597:tid 37648] [client 20.234.13.12:13875] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "adTPBw6uAY0QAy-8EELe0AAAAE4"]
[Tue Apr 07 17:31:52.133483 2026] [:error] [pid 37598:tid 37683] [client 20.234.13.12:18029] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "adTPCO9g7q_cV2WhPayAVgAAAJY"]
[Tue Apr 07 17:31:52.682943 2026] [:error] [pid 37597:tid 37652] [client 20.234.13.12:8456] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "adTPCA6uAY0QAy-8EELe2QAAAFI"]
[Tue Apr 07 17:31:53.185343 2026] [:error] [pid 59804:tid 59825] [client 20.234.13.12:1651] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp8.php"] [unique_id "adTPCXYVIXiPh5_eJTljGgAAAhM"]
[Tue Apr 07 17:31:53.734859 2026] [:error] [pid 59551:tid 59569] [client 20.234.13.12:1650] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adTPCV7LN7Ubyqs-sVu1TwAAAZA"]
[Tue Apr 07 17:31:54.352314 2026] [:error] [pid 37597:tid 37634] [client 20.234.13.12:17930] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adTPCg6uAY0QAy-8EELe3gAAAEA"]
[Tue Apr 07 17:31:54.894641 2026] [:error] [pid 37719:tid 37732] [client 20.234.13.12:9188] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adTPCk09Xv52u2xXGLCpUQAAAMo"]
[Tue Apr 07 17:31:55.395619 2026] [:error] [pid 37597:tid 37645] [client 20.234.13.12:13883] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adTPCw6uAY0QAy-8EELe4gAAAEs"]
[Tue Apr 07 17:31:55.919605 2026] [:error] [pid 37719:tid 37735] [client 20.234.13.12:9198] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gilo.php"] [unique_id "adTPC009Xv52u2xXGLCpVQAAAM0"]
[Tue Apr 07 17:31:56.433184 2026] [:error] [pid 37597:tid 37653] [client 20.234.13.12:13857] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gilo.php"] [unique_id "adTPDA6uAY0QAy-8EELe5QAAAFM"]
[Tue Apr 07 17:31:56.972525 2026] [:error] [pid 12948:tid 12962] [client 20.234.13.12:16275] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gilo.php"] [unique_id "adTPDMbeSPAN8LvMqsaD0wAAAQs"]
[Tue Apr 07 17:31:57.649513 2026] [:error] [pid 12948:tid 12953] [client 20.234.13.12:17939] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gilo.php"] [unique_id "adTPDcbeSPAN8LvMqsaD1QAAAQI"]
[Tue Apr 07 17:31:58.361880 2026] [:error] [pid 12948:tid 12957] [client 20.234.13.12:18035] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adTPDsbeSPAN8LvMqsaD1gAAAQY"]
[Tue Apr 07 17:31:58.945047 2026] [:error] [pid 37598:tid 37668] [client 20.234.13.12:9206] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adTPDu9g7q_cV2WhPayAWQAAAIc"]
[Tue Apr 07 17:31:59.508468 2026] [:error] [pid 37596:tid 37613] [client 20.234.13.12:13845] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adTPD6paAOZHEjRWjP2C7AAAAAc"]
[Tue Apr 07 17:32:00.049579 2026] [:error] [pid 37596:tid 37625] [client 20.234.13.12:16065] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adTPEKpaAOZHEjRWjP2C7wAAABM"]
[Tue Apr 07 17:32:00.599684 2026] [:error] [pid 37597:tid 37638] [client 20.234.13.12:8476] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7r.php"] [unique_id "adTPEA6uAY0QAy-8EELe-gAAAEQ"]
[Tue Apr 07 17:32:01.113740 2026] [:error] [pid 37597:tid 37644] [client 20.234.13.12:15132] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7r.php"] [unique_id "adTPEQ6uAY0QAy-8EELe_AAAAEo"]
[Tue Apr 07 17:32:01.697681 2026] [:error] [pid 37597:tid 37647] [client 20.234.13.12:9187] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7r.php"] [unique_id "adTPEQ6uAY0QAy-8EELe_gAAAE0"]
[Tue Apr 07 17:32:02.283034 2026] [:error] [pid 12948:tid 12973] [client 20.234.13.12:16341] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7r.php"] [unique_id "adTPEsbeSPAN8LvMqsaD2wAAARY"]
[Tue Apr 07 17:32:02.916782 2026] [:error] [pid 37597:tid 37649] [client 20.234.13.12:14414] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/riz.php"] [unique_id "adTPEg6uAY0QAy-8EELfBAAAAE8"]
[Tue Apr 07 17:32:03.431739 2026] [:error] [pid 37597:tid 37636] [client 20.234.13.12:12423] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/riz.php"] [unique_id "adTPEw6uAY0QAy-8EELfCAAAAEI"]
[Tue Apr 07 17:32:04.002517 2026] [:error] [pid 37597:tid 37653] [client 20.234.13.12:9946] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/riz.php"] [unique_id "adTPFA6uAY0QAy-8EELfDQAAAFM"]
[Tue Apr 07 17:32:04.540357 2026] [:error] [pid 37597:tid 37634] [client 20.234.13.12:10496] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/riz.php"] [unique_id "adTPFA6uAY0QAy-8EELfEAAAAEA"]
[Tue Apr 07 17:32:05.077180 2026] [:error] [pid 37597:tid 37637] [client 20.234.13.12:14712] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "adTPFQ6uAY0QAy-8EELfFgAAAEM"]
[Tue Apr 07 17:32:05.689489 2026] [:error] [pid 37597:tid 37644] [client 20.234.13.12:14658] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "adTPFQ6uAY0QAy-8EELfHwAAAEo"]
[Tue Apr 07 17:32:06.264385 2026] [:error] [pid 37597:tid 37639] [client 20.234.13.12:18089] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "adTPFg6uAY0QAy-8EELfJQAAAEU"]
[Tue Apr 07 17:32:06.848997 2026] [:error] [pid 37598:tid 37677] [client 20.234.13.12:12454] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp3.php"] [unique_id "adTPFu9g7q_cV2WhPayAYgAAAJA"]
[Tue Apr 07 17:32:07.353952 2026] [:error] [pid 12948:tid 12952] [client 20.234.13.12:13549] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adTPF8beSPAN8LvMqsaD3wAAAQE"]
[Tue Apr 07 17:32:07.995414 2026] [:error] [pid 59804:tid 59824] [client 20.234.13.12:18923] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adTPF3YVIXiPh5_eJTljJgAAAhI"]
[Tue Apr 07 17:32:08.547612 2026] [:error] [pid 37597:tid 37651] [client 20.234.13.12:1623] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adTPGA6uAY0QAy-8EELfOwAAAFE"]
[Tue Apr 07 17:32:09.149015 2026] [:error] [pid 59551:tid 59559] [client 20.234.13.12:17104] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adTPGV7LN7Ubyqs-sVu1VgAAAYY"]
[Tue Apr 07 17:32:09.667047 2026] [:error] [pid 59551:tid 59563] [client 20.234.13.12:10534] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ympoo.php"] [unique_id "adTPGV7LN7Ubyqs-sVu1YAAAAYo"]
[Tue Apr 07 17:32:10.183457 2026] [:error] [pid 59551:tid 59557] [client 20.234.13.12:13851] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ympoo.php"] [unique_id "adTPGl7LN7Ubyqs-sVu1YwAAAYQ"]
[Tue Apr 07 17:32:10.736107 2026] [:error] [pid 59660:tid 59677] [client 20.234.13.12:9381] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ympoo.php"] [unique_id "adTPGjp3-oiX2o5bTsztJAAAAc8"]
[Tue Apr 07 17:32:11.264942 2026] [:error] [pid 59551:tid 59571] [client 20.234.13.12:15060] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ympoo.php"] [unique_id "adTPG17LN7Ubyqs-sVu1ZgAAAZI"]
[Tue Apr 07 17:32:11.804624 2026] [:error] [pid 37596:tid 37609] [client 20.234.13.12:10543] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/she.php"] [unique_id "adTPG6paAOZHEjRWjP2C9QAAAAM"]
[Tue Apr 07 17:32:12.343952 2026] [:error] [pid 59804:tid 59807] [client 20.234.13.12:12440] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/she.php"] [unique_id "adTPHHYVIXiPh5_eJTljMQAAAgE"]
[Tue Apr 07 17:32:12.934173 2026] [:error] [pid 59804:tid 59813] [client 20.234.13.12:14704] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/she.php"] [unique_id "adTPHHYVIXiPh5_eJTljNQAAAgc"]
[Tue Apr 07 17:32:13.470306 2026] [:error] [pid 37597:tid 37656] [client 20.234.13.12:18891] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/she.php"] [unique_id "adTPHQ6uAY0QAy-8EELfQgAAAFY"]
[Tue Apr 07 17:32:14.076011 2026] [:error] [pid 37596:tid 37630] [client 20.234.13.12:13885] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haojj.php"] [unique_id "adTPHqpaAOZHEjRWjP2C-AAAABg"]
[Tue Apr 07 17:32:14.629039 2026] [:error] [pid 37598:tid 37663] [client 20.234.13.12:9353] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haojj.php"] [unique_id "adTPHu9g7q_cV2WhPayAbQAAAII"]
[Tue Apr 07 17:32:15.181293 2026] [:error] [pid 59551:tid 59567] [client 20.234.13.12:9193] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haojj.php"] [unique_id "adTPH17LN7Ubyqs-sVu1bgAAAY4"]
[Tue Apr 07 17:32:15.728171 2026] [:error] [pid 37596:tid 37613] [client 20.234.13.12:20510] [client 20.234.13.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/haojj.php"] [unique_id "adTPH6paAOZHEjRWjP2C-wAAAAc"]
[Tue Apr 07 17:33:18.702511 2026] [:error] [pid 37596:tid 37613] [client 74.248.155.160:18526] [client 74.248.155.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adTPXqpaAOZHEjRWjP2DBAAAAAc"]
[Tue Apr 07 17:33:19.547652 2026] [:error] [pid 37719:tid 37737] [client 74.248.155.160:45834] [client 74.248.155.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adTPX009Xv52u2xXGLCqCwAAAM8"]
[Tue Apr 07 17:33:20.128244 2026] [:error] [pid 37719:tid 37745] [client 74.248.155.160:13860] [client 74.248.155.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adTPYE09Xv52u2xXGLCqDwAAANc"]
[Tue Apr 07 17:33:20.735462 2026] [:error] [pid 12948:tid 12952] [client 74.248.155.160:16594] [client 74.248.155.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adTPYMbeSPAN8LvMqsaD_wAAAQE"]
[Tue Apr 07 18:30:31.174089 2026] [:error] [pid 59804:tid 59830] [client 216.73.216.6:21212] [client 216.73.216.6] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||aoswa.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "aoswa.com.au"] [uri "/robots.txt"] [unique_id "adTcx3YVIXiPh5_eJTl82QAAAhg"]
[Tue Apr 07 18:54:26.673002 2026] [:error] [pid 37598:tid 37680] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Tue Apr 07 18:54:26.928516 2026] [:error] [pid 37598:tid 37665] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue Apr 07 18:54:27.400398 2026] [:error] [pid 37598:tid 37673] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/turkshell.php
[Tue Apr 07 18:54:27.727101 2026] [:error] [pid 37598:tid 37674] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/qqqa.php
[Tue Apr 07 18:54:28.048920 2026] [:error] [pid 37598:tid 37666] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/om.php
[Tue Apr 07 18:54:28.340421 2026] [:error] [pid 37598:tid 37662] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/esp.php
[Tue Apr 07 18:54:28.593449 2026] [:error] [pid 37598:tid 37668] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Tue Apr 07 18:54:28.905307 2026] [:error] [pid 37598:tid 37669] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/bypltspd.php
[Tue Apr 07 18:54:29.202391 2026] [:error] [pid 37598:tid 37675] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/qqa.php
[Tue Apr 07 18:54:29.496261 2026] [:error] [pid 37598:tid 37681] [client 20.234.6.239:9392] File does not exist: /usr/local/apache/htdocs/suspended-page/bogles.php
[Tue Apr 07 18:54:29.834583 2026] [:error] [pid 37598:tid 37672] [client 20.234.6.239:9392] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adTiZe9g7q_cV2WhPaya4gAAAIs"]
[Tue Apr 07 18:54:30.608135 2026] [:error] [pid 59804:tid 59812] [client 20.234.6.239:9361] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adTiZnYVIXiPh5_eJTmDxAAAAgY"]
[Tue Apr 07 18:54:31.340994 2026] [:error] [pid 12948:tid 12970] [client 20.234.6.239:23103] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adTiZ8beSPAN8LvMqsaYXgAAARM"]
[Tue Apr 07 18:54:32.403783 2026] [:error] [pid 37598:tid 37683] [client 20.234.6.239:7023] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adTiaO9g7q_cV2WhPaya4wAAAJY"]
[Tue Apr 07 18:54:33.169387 2026] [:error] [pid 59490:tid 59494] [client 20.234.6.239:9695] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adTiaUcw8OFbiUZ7Rx1YLAAAAUI"]
[Tue Apr 07 18:54:33.978788 2026] [:error] [pid 12948:tid 12958] [client 20.234.6.239:19065] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adTiacbeSPAN8LvMqsaYYQAAAQc"]
[Tue Apr 07 18:54:34.899705 2026] [:error] [pid 59660:tid 59673] [client 20.234.6.239:14243] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adTiajp3-oiX2o5bTswAXQAAAcs"]
[Tue Apr 07 18:54:35.826264 2026] [:error] [pid 59660:tid 59682] [client 20.234.6.239:19051] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adTiazp3-oiX2o5bTswAXwAAAdQ"]
[Tue Apr 07 18:54:36.973882 2026] [:error] [pid 37719:tid 37742] [client 20.234.6.239:9487] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adTibE09Xv52u2xXGLDc4wAAANQ"]
[Tue Apr 07 18:54:37.679809 2026] [:error] [pid 37596:tid 37622] [client 20.234.6.239:18936] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adTibapaAOZHEjRWjP2PuwAAABA"]
[Tue Apr 07 18:54:39.251001 2026] [:error] [pid 37598:tid 37675] [client 20.234.6.239:7512] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adTib-9g7q_cV2WhPaya6wAAAI4"]
[Tue Apr 07 18:54:40.081516 2026] [:error] [pid 37598:tid 37683] [client 20.234.6.239:12421] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adTicO9g7q_cV2WhPaya8wAAAJY"]
[Tue Apr 07 18:54:41.328339 2026] [:error] [pid 59490:tid 59514] [client 20.234.6.239:15538] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adTicUcw8OFbiUZ7Rx1YMAAAAVY"]
[Tue Apr 07 18:54:42.341024 2026] [:error] [pid 59490:tid 59506] [client 20.234.6.239:15941] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adTickcw8OFbiUZ7Rx1YMgAAAU4"]
[Tue Apr 07 18:54:43.398813 2026] [:error] [pid 37598:tid 37679] [client 20.234.6.239:8366] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adTic-9g7q_cV2WhPaya-QAAAJI"]
[Tue Apr 07 18:54:44.107666 2026] [:error] [pid 37596:tid 37613] [client 20.234.6.239:21739] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adTidKpaAOZHEjRWjP2PvwAAAAc"]
[Tue Apr 07 18:54:44.885308 2026] [:error] [pid 37598:tid 37668] [client 20.234.6.239:21733] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "adTidO9g7q_cV2WhPaya_wAAAIc"]
[Tue Apr 07 18:54:46.076052 2026] [:error] [pid 37719:tid 37729] [client 20.234.6.239:15551] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "adTidk09Xv52u2xXGLDc7QAAAMc"]
[Tue Apr 07 18:54:46.674900 2026] [:error] [pid 37719:tid 37740] [client 20.234.6.239:8331] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "adTidk09Xv52u2xXGLDc8wAAANI"]
[Tue Apr 07 18:54:48.156936 2026] [:error] [pid 59804:tid 59829] [client 20.234.6.239:19067] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "adTieHYVIXiPh5_eJTmD3gAAAhc"]
[Tue Apr 07 18:54:48.922701 2026] [:error] [pid 12948:tid 12968] [client 20.234.6.239:9519] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "adTieMbeSPAN8LvMqsaYbQAAARE"]
[Tue Apr 07 18:54:49.556030 2026] [:error] [pid 37596:tid 37626] [client 20.234.6.239:14354] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "adTieapaAOZHEjRWjP2PwgAAABQ"]
[Tue Apr 07 18:54:50.486348 2026] [:error] [pid 12948:tid 12972] [client 20.234.6.239:8329] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "adTiesbeSPAN8LvMqsaYdgAAARU"]
[Tue Apr 07 18:54:51.200009 2026] [:error] [pid 37597:tid 37647] [client 20.234.6.239:6977] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3.php"] [unique_id "adTiew6uAY0QAy-8EEIlaAAAAE0"]
[Tue Apr 07 18:54:52.216378 2026] [:error] [pid 37598:tid 37670] [client 20.234.6.239:15946] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "adTifO9g7q_cV2WhPaybBAAAAIk"]
[Tue Apr 07 18:54:52.891520 2026] [:error] [pid 59551:tid 59556] [client 20.234.6.239:14356] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "adTifF7LN7Ubyqs-sVvdagAAAYM"]
[Tue Apr 07 18:54:54.167744 2026] [:error] [pid 59804:tid 59809] [client 20.234.6.239:15997] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "adTifnYVIXiPh5_eJTmD-AAAAgM"]
[Tue Apr 07 18:54:55.116239 2026] [:error] [pid 37597:tid 37639] [client 20.234.6.239:15509] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4.php"] [unique_id "adTifw6uAY0QAy-8EEIlawAAAEU"]
[Tue Apr 07 18:54:56.675839 2026] [:error] [pid 37596:tid 37623] [client 20.234.6.239:15290] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5.php"] [unique_id "adTigKpaAOZHEjRWjP2PxQAAABE"]
[Tue Apr 07 18:54:57.594589 2026] [:error] [pid 59490:tid 59507] [client 20.234.6.239:12420] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5.php"] [unique_id "adTigUcw8OFbiUZ7Rx1YPAAAAU8"]
[Tue Apr 07 18:54:58.527223 2026] [:error] [pid 59551:tid 59558] [client 20.234.6.239:14364] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5.php"] [unique_id "adTigl7LN7Ubyqs-sVvddQAAAYU"]
[Tue Apr 07 18:54:59.609918 2026] [:error] [pid 59804:tid 59813] [client 20.234.6.239:8361] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5.php"] [unique_id "adTig3YVIXiPh5_eJTmEBgAAAgc"]
[Tue Apr 07 18:55:00.277689 2026] [:error] [pid 37597:tid 37647] [client 20.234.6.239:9727] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adTihA6uAY0QAy-8EEIlcwAAAE0"]
[Tue Apr 07 18:55:01.233863 2026] [:error] [pid 59804:tid 59822] [client 20.234.6.239:15991] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adTihXYVIXiPh5_eJTmECgAAAhA"]
[Tue Apr 07 18:55:02.039040 2026] [:error] [pid 12948:tid 12952] [client 20.234.6.239:6993] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adTihsbeSPAN8LvMqsaYlgAAAQE"]
[Tue Apr 07 18:55:03.147103 2026] [:error] [pid 37597:tid 37637] [client 20.234.6.239:8374] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adTihw6uAY0QAy-8EEIlfgAAAEM"]
[Tue Apr 07 18:55:04.012393 2026] [:error] [pid 59551:tid 59577] [client 20.234.6.239:19043] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTiiF7LN7Ubyqs-sVvddgAAAZg"]
[Tue Apr 07 18:55:04.882937 2026] [:error] [pid 37597:tid 37638] [client 20.234.6.239:9703] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTiiA6uAY0QAy-8EEIliQAAAEQ"]
[Tue Apr 07 18:55:06.342169 2026] [:error] [pid 37597:tid 37637] [client 20.234.6.239:7537] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTiig6uAY0QAy-8EEIljAAAAEM"]
[Tue Apr 07 18:55:07.903289 2026] [:error] [pid 37596:tid 37628] [client 20.234.6.239:15979] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adTii6paAOZHEjRWjP2PzAAAABY"]
[Tue Apr 07 18:55:08.666249 2026] [:error] [pid 37597:tid 37645] [client 20.234.6.239:8324] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adTijA6uAY0QAy-8EEIllwAAAEs"]
[Tue Apr 07 18:55:09.562190 2026] [:error] [pid 59804:tid 59819] [client 20.234.6.239:8830] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adTijXYVIXiPh5_eJTmEEgAAAg0"]
[Tue Apr 07 18:55:10.415476 2026] [:error] [pid 37596:tid 37619] [client 20.234.6.239:9501] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adTijqpaAOZHEjRWjP2PzgAAAA0"]
[Tue Apr 07 18:55:11.247563 2026] [:error] [pid 59804:tid 59810] [client 20.234.6.239:12476] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adTij3YVIXiPh5_eJTmEFgAAAgQ"]
[Tue Apr 07 18:55:12.190574 2026] [:error] [pid 59804:tid 59813] [client 20.234.6.239:9692] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adTikHYVIXiPh5_eJTmEHQAAAgc"]
[Tue Apr 07 18:55:13.011771 2026] [:error] [pid 59804:tid 59815] [client 20.234.6.239:23297] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adTikXYVIXiPh5_eJTmEHwAAAgk"]
[Tue Apr 07 18:55:13.969077 2026] [:error] [pid 37597:tid 37657] [client 20.234.6.239:6898] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adTikQ6uAY0QAy-8EEIlqAAAAFc"]
[Tue Apr 07 18:55:14.731338 2026] [:error] [pid 59490:tid 59495] [client 20.234.6.239:15288] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adTikkcw8OFbiUZ7Rx1YSAAAAUM"]
[Tue Apr 07 18:55:15.944444 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:23308] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adTikw6uAY0QAy-8EEIltAAAAEE"]
[Tue Apr 07 18:55:16.754077 2026] [:error] [pid 59804:tid 59820] [client 20.234.6.239:8152] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adTilHYVIXiPh5_eJTmEKAAAAg4"]
[Tue Apr 07 18:55:17.683386 2026] [:error] [pid 37597:tid 37640] [client 20.234.6.239:16794] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adTilQ6uAY0QAy-8EEIluwAAAEY"]
[Tue Apr 07 18:55:18.761655 2026] [:error] [pid 37597:tid 37650] [client 20.234.6.239:15491] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adTilg6uAY0QAy-8EEIlxQAAAFA"]
[Tue Apr 07 18:55:19.669656 2026] [:error] [pid 59804:tid 59828] [client 20.234.6.239:8380] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adTil3YVIXiPh5_eJTmELAAAAhY"]
[Tue Apr 07 18:55:20.484226 2026] [:error] [pid 59804:tid 59816] [client 20.234.6.239:8185] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adTimHYVIXiPh5_eJTmEMAAAAgo"]
[Tue Apr 07 18:55:21.260244 2026] [:error] [pid 59660:tid 59666] [client 20.234.6.239:23345] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adTimTp3-oiX2o5bTswAgAAAAcQ"]
[Tue Apr 07 18:55:22.310850 2026] [:error] [pid 59551:tid 59565] [client 20.234.6.239:7010] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adTiml7LN7Ubyqs-sVvdggAAAYw"]
[Tue Apr 07 18:55:23.046875 2026] [:error] [pid 37597:tid 37651] [client 20.234.6.239:6911] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adTimw6uAY0QAy-8EEIl0gAAAFE"]
[Tue Apr 07 18:55:23.831041 2026] [:error] [pid 37719:tid 37726] [client 20.234.6.239:23301] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adTim009Xv52u2xXGLDdDgAAAMQ"]
[Tue Apr 07 18:55:24.563267 2026] [:error] [pid 37596:tid 37612] [client 20.234.6.239:16798] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adTinKpaAOZHEjRWjP2P0gAAAAY"]
[Tue Apr 07 18:55:25.342190 2026] [:error] [pid 37597:tid 37641] [client 20.234.6.239:7628] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adTinQ6uAY0QAy-8EEIl2gAAAEc"]
[Tue Apr 07 18:55:26.313974 2026] [:error] [pid 59490:tid 59512] [client 20.234.6.239:9373] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adTinkcw8OFbiUZ7Rx1YUQAAAVQ"]
[Tue Apr 07 18:55:27.009625 2026] [:error] [pid 37719:tid 37741] [client 20.234.6.239:6788] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adTin009Xv52u2xXGLDdFwAAANM"]
[Tue Apr 07 18:55:27.679136 2026] [:error] [pid 37719:tid 37724] [client 20.234.6.239:8171] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adTin009Xv52u2xXGLDdGwAAAMI"]
[Tue Apr 07 18:55:28.587337 2026] [:error] [pid 37597:tid 37643] [client 20.234.6.239:9346] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adTioA6uAY0QAy-8EEIl5gAAAEk"]
[Tue Apr 07 18:55:29.210864 2026] [:error] [pid 37597:tid 37648] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/file31.php
[Tue Apr 07 18:55:29.464337 2026] [:error] [pid 37597:tid 37656] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Tue Apr 07 18:55:29.745090 2026] [:error] [pid 37597:tid 37655] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/control.php
[Tue Apr 07 18:55:30.007752 2026] [:error] [pid 37597:tid 37653] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/fetch.php
[Tue Apr 07 18:55:30.266563 2026] [:error] [pid 37597:tid 37642] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Tue Apr 07 18:55:30.563863 2026] [:error] [pid 37597:tid 37647] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 07 18:55:30.858099 2026] [:error] [pid 37597:tid 37634] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Tue Apr 07 18:55:31.156427 2026] [:error] [pid 37597:tid 37636] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Tue Apr 07 18:55:31.407364 2026] [:error] [pid 37597:tid 37655] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Tue Apr 07 18:55:31.660438 2026] [:error] [pid 37597:tid 37638] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 07 18:55:32.012771 2026] [:error] [pid 37597:tid 37639] [client 20.234.6.239:21704] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Tue Apr 07 18:55:32.370414 2026] [:error] [pid 37597:tid 37641] [client 20.234.6.239:21704] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adTipA6uAY0QAy-8EEIl_wAAAEc"]
[Tue Apr 07 18:55:33.293960 2026] [:error] [pid 37597:tid 37636] [client 20.234.6.239:7625] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adTipQ6uAY0QAy-8EEImAwAAAEI"]
[Tue Apr 07 18:55:33.914435 2026] [:error] [pid 37719:tid 37736] [client 20.234.6.239:21727] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adTipU09Xv52u2xXGLDdJAAAAM4"]
[Tue Apr 07 18:55:34.817348 2026] [:error] [pid 59551:tid 59568] [client 20.234.6.239:8328] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adTipl7LN7Ubyqs-sVvdkwAAAY8"]
[Tue Apr 07 18:55:35.671930 2026] [:error] [pid 59551:tid 59557] [client 20.234.6.239:10190] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adTip17LN7Ubyqs-sVvdlgAAAYQ"]
[Tue Apr 07 18:55:36.502407 2026] [:error] [pid 37598:tid 37674] [client 20.234.6.239:14496] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adTiqO9g7q_cV2WhPaybLgAAAI0"]
[Tue Apr 07 18:55:37.088566 2026] [:error] [pid 12948:tid 12969] [client 20.234.6.239:9221] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adTiqcbeSPAN8LvMqsaYtAAAARI"]
[Tue Apr 07 18:55:37.887890 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:9242] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adTiqQ6uAY0QAy-8EEImDAAAAEE"]
[Tue Apr 07 18:55:38.642486 2026] [:error] [pid 37598:tid 37664] [client 20.234.6.239:10201] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "adTiqu9g7q_cV2WhPaybNgAAAIM"]
[Tue Apr 07 18:55:39.381143 2026] [:error] [pid 37719:tid 37737] [client 20.234.6.239:17326] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "adTiq009Xv52u2xXGLDdLQAAAM8"]
[Tue Apr 07 18:55:40.204066 2026] [:error] [pid 59804:tid 59806] [client 20.234.6.239:16911] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "adTirHYVIXiPh5_eJTmETQAAAgA"]
[Tue Apr 07 18:55:40.981369 2026] [:error] [pid 59551:tid 59572] [client 20.234.6.239:18336] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/read.php"] [unique_id "adTirF7LN7Ubyqs-sVvdnwAAAZM"]
[Tue Apr 07 18:55:41.693298 2026] [:error] [pid 59490:tid 59502] [client 20.234.6.239:18307] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTirUcw8OFbiUZ7Rx1YVwAAAUo"]
[Tue Apr 07 18:55:42.379389 2026] [:error] [pid 59490:tid 59500] [client 20.234.6.239:17173] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTirkcw8OFbiUZ7Rx1YWwAAAUg"]
[Tue Apr 07 18:55:43.001547 2026] [:error] [pid 37597:tid 37642] [client 20.234.6.239:7796] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTirw6uAY0QAy-8EEImGAAAAEg"]
[Tue Apr 07 18:55:44.003587 2026] [:error] [pid 37597:tid 37649] [client 20.234.6.239:11489] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTisA6uAY0QAy-8EEImHQAAAE8"]
[Tue Apr 07 18:55:44.743917 2026] [:error] [pid 37597:tid 37634] [client 20.234.6.239:14066] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adTisA6uAY0QAy-8EEImJAAAAEA"]
[Tue Apr 07 18:55:45.356089 2026] [:error] [pid 37597:tid 37644] [client 20.234.6.239:21289] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adTisQ6uAY0QAy-8EEImKwAAAEo"]
[Tue Apr 07 18:55:45.934701 2026] [:error] [pid 37597:tid 37650] [client 20.234.6.239:21261] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adTisQ6uAY0QAy-8EEImMgAAAFA"]
[Tue Apr 07 18:55:46.542356 2026] [:error] [pid 37597:tid 37649] [client 20.234.6.239:10212] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adTisg6uAY0QAy-8EEImOgAAAE8"]
[Tue Apr 07 18:55:48.549674 2026] [:error] [pid 37597:tid 37655] [client 20.234.6.239:8594] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "adTitA6uAY0QAy-8EEImTAAAAFU"]
[Tue Apr 07 18:55:49.321267 2026] [:error] [pid 59551:tid 59561] [client 20.234.6.239:14620] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "adTitV7LN7Ubyqs-sVvdqAAAAYg"]
[Tue Apr 07 18:55:50.145882 2026] [:error] [pid 37719:tid 37723] [client 20.234.6.239:14649] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "adTitk09Xv52u2xXGLDdSAAAAME"]
[Tue Apr 07 18:55:50.851746 2026] [:error] [pid 59551:tid 59559] [client 20.234.6.239:18327] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "adTitl7LN7Ubyqs-sVvdqQAAAYY"]
[Tue Apr 07 18:55:51.904212 2026] [:error] [pid 59804:tid 59826] [client 20.234.6.239:13131] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adTit3YVIXiPh5_eJTmEVwAAAhQ"]
[Tue Apr 07 18:55:52.724405 2026] [:error] [pid 37597:tid 37657] [client 20.234.6.239:10678] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adTiuA6uAY0QAy-8EEImZgAAAFc"]
[Tue Apr 07 18:55:53.725632 2026] [:error] [pid 37598:tid 37675] [client 20.234.6.239:17567] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adTiue9g7q_cV2WhPaybQQAAAI4"]
[Tue Apr 07 18:55:54.695225 2026] [:error] [pid 37598:tid 37671] [client 20.234.6.239:18180] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adTiuu9g7q_cV2WhPaybRgAAAIo"]
[Tue Apr 07 18:55:55.820443 2026] [:error] [pid 37719:tid 37738] [client 20.234.6.239:11333] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "adTiu009Xv52u2xXGLDdXgAAANA"]
[Tue Apr 07 18:55:56.704637 2026] [:error] [pid 37597:tid 37645] [client 20.234.6.239:15346] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "adTivA6uAY0QAy-8EEImbwAAAEs"]
[Tue Apr 07 18:55:58.139939 2026] [:error] [pid 37719:tid 37735] [client 20.234.6.239:11372] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "adTivk09Xv52u2xXGLDdYgAAAM0"]
[Tue Apr 07 18:55:58.814537 2026] [:error] [pid 12948:tid 12967] [client 20.234.6.239:18607] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mter.php"] [unique_id "adTivsbeSPAN8LvMqsaYwAAAARA"]
[Tue Apr 07 18:56:03.998538 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:16961] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adTiww6uAY0QAy-8EEImhwAAAEE"]
[Tue Apr 07 18:56:04.862647 2026] [:error] [pid 59551:tid 59571] [client 20.234.6.239:21970] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adTixF7LN7Ubyqs-sVvdwgAAAZI"]
[Tue Apr 07 18:56:05.612838 2026] [:error] [pid 59551:tid 59574] [client 20.234.6.239:6282] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adTixV7LN7Ubyqs-sVvdxgAAAZU"]
[Tue Apr 07 18:56:06.405944 2026] [:error] [pid 37597:tid 37638] [client 20.234.6.239:8123] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adTixg6uAY0QAy-8EEImoQAAAEQ"]
[Tue Apr 07 18:56:07.265843 2026] [:error] [pid 37719:tid 37722] [client 20.234.6.239:11913] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "adTix009Xv52u2xXGLDddwAAAMA"]
[Tue Apr 07 18:56:08.548284 2026] [:error] [pid 37719:tid 37734] [client 20.234.6.239:8091] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "adTiyE09Xv52u2xXGLDdfgAAAMw"]
[Tue Apr 07 18:56:09.706976 2026] [:error] [pid 37598:tid 37668] [client 20.234.6.239:22012] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "adTiye9g7q_cV2WhPaybWQAAAIc"]
[Tue Apr 07 18:56:10.705726 2026] [:error] [pid 59804:tid 59811] [client 20.234.6.239:17010] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/19.php"] [unique_id "adTiynYVIXiPh5_eJTmEhQAAAgU"]
[Tue Apr 07 18:56:11.716909 2026] [:error] [pid 37719:tid 37744] [client 20.234.6.239:21962] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "adTiy009Xv52u2xXGLDdhAAAANY"]
[Tue Apr 07 18:56:12.355590 2026] [:error] [pid 37719:tid 37732] [client 20.234.6.239:7365] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "adTizE09Xv52u2xXGLDdhgAAAMo"]
[Tue Apr 07 18:56:13.195283 2026] [:error] [pid 37596:tid 37608] [client 20.234.6.239:12104] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "adTizapaAOZHEjRWjP2P3gAAAAI"]
[Tue Apr 07 18:56:13.912683 2026] [:error] [pid 37719:tid 37737] [client 20.234.6.239:7082] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "adTizU09Xv52u2xXGLDdjwAAAM8"]
[Tue Apr 07 18:56:14.996845 2026] [:error] [pid 37597:tid 37641] [client 20.234.6.239:16883] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adTizg6uAY0QAy-8EEImvQAAAEc"]
[Tue Apr 07 18:56:15.661875 2026] [:error] [pid 59551:tid 59577] [client 20.234.6.239:15331] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adTiz17LN7Ubyqs-sVvdzwAAAZg"]
[Tue Apr 07 18:56:16.474732 2026] [:error] [pid 37596:tid 37611] [client 20.234.6.239:19366] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adTi0KpaAOZHEjRWjP2P4AAAAAU"]
[Tue Apr 07 18:56:17.383255 2026] [:error] [pid 37597:tid 37650] [client 20.234.6.239:22003] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adTi0Q6uAY0QAy-8EEImwgAAAFA"]
[Tue Apr 07 18:56:18.137318 2026] [:error] [pid 37597:tid 37636] [client 20.234.6.239:9789] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adTi0g6uAY0QAy-8EEImyQAAAEI"]
[Tue Apr 07 18:56:19.222108 2026] [:error] [pid 37719:tid 37738] [client 20.234.6.239:10916] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adTi0009Xv52u2xXGLDdmwAAANA"]
[Tue Apr 07 18:56:20.042238 2026] [:error] [pid 59551:tid 59557] [client 20.234.6.239:12655] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adTi1F7LN7Ubyqs-sVvd0wAAAYQ"]
[Tue Apr 07 18:56:21.742577 2026] [:error] [pid 37597:tid 37657] [client 20.234.6.239:17012] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adTi1Q6uAY0QAy-8EEIm1gAAAFc"]
[Tue Apr 07 18:56:22.305189 2026] [:error] [pid 59551:tid 59567] [client 20.234.6.239:34167] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adTi1l7LN7Ubyqs-sVvd1wAAAY4"]
[Tue Apr 07 18:56:23.378016 2026] [:error] [pid 37719:tid 37738] [client 20.234.6.239:10905] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adTi1009Xv52u2xXGLDdpQAAANA"]
[Tue Apr 07 18:56:24.162181 2026] [:error] [pid 37719:tid 37734] [client 20.234.6.239:12645] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adTi2E09Xv52u2xXGLDdpwAAAMw"]
[Tue Apr 07 18:56:25.090463 2026] [:error] [pid 59804:tid 59820] [client 20.234.6.239:18565] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adTi2XYVIXiPh5_eJTmElwAAAg4"]
[Tue Apr 07 18:56:26.149495 2026] [:error] [pid 37598:tid 37683] [client 20.234.6.239:7414] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxfile.php"] [unique_id "adTi2u9g7q_cV2WhPaybZQAAAJY"]
[Tue Apr 07 18:56:27.237281 2026] [:error] [pid 59551:tid 59557] [client 20.234.6.239:12623] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxfile.php"] [unique_id "adTi217LN7Ubyqs-sVvd3QAAAYQ"]
[Tue Apr 07 18:56:28.194468 2026] [:error] [pid 12948:tid 12958] [client 20.234.6.239:10255] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxfile.php"] [unique_id "adTi3MbeSPAN8LvMqsaY1wAAAQc"]
[Tue Apr 07 18:56:29.380019 2026] [:error] [pid 37596:tid 37623] [client 20.234.6.239:18621] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxfile.php"] [unique_id "adTi3apaAOZHEjRWjP2P6gAAABE"]
[Tue Apr 07 18:56:30.615686 2026] [:error] [pid 12948:tid 12971] [client 20.234.6.239:10257] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "adTi3sbeSPAN8LvMqsaY2QAAARQ"]
[Tue Apr 07 18:56:31.651712 2026] [:error] [pid 59551:tid 59575] [client 20.234.6.239:18210] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "adTi317LN7Ubyqs-sVvd5gAAAZY"]
[Tue Apr 07 18:56:32.446092 2026] [:error] [pid 37719:tid 37732] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Tue Apr 07 18:56:32.846532 2026] [:error] [pid 37719:tid 37725] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Tue Apr 07 18:56:33.100556 2026] [:error] [pid 37719:tid 37731] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/swallowable.php
[Tue Apr 07 18:56:33.355917 2026] [:error] [pid 37719:tid 37740] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Tue Apr 07 18:56:33.725717 2026] [:error] [pid 37719:tid 37741] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Tue Apr 07 18:56:33.992692 2026] [:error] [pid 37719:tid 37736] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 07 18:56:34.255561 2026] [:error] [pid 37719:tid 37722] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Apr 07 18:56:34.861914 2026] [:error] [pid 37719:tid 37732] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Tue Apr 07 18:56:35.195822 2026] [:error] [pid 37719:tid 37729] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Apr 07 18:56:35.596253 2026] [:error] [pid 37719:tid 37737] [client 20.234.6.239:11708] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Tue Apr 07 18:56:35.846753 2026] [:error] [pid 37719:tid 37725] [client 20.234.6.239:11708] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adTi4009Xv52u2xXGLDdwAAAAMM"]
[Tue Apr 07 18:56:37.097628 2026] [:error] [pid 12948:tid 12970] [client 20.234.6.239:15301] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adTi5cbeSPAN8LvMqsaY3QAAARM"]
[Tue Apr 07 18:56:38.302588 2026] [:error] [pid 37719:tid 37736] [client 20.234.6.239:16964] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adTi5k09Xv52u2xXGLDdxQAAAM4"]
[Tue Apr 07 18:56:39.384256 2026] [:error] [pid 37598:tid 37661] [client 20.234.6.239:16156] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adTi5-9g7q_cV2WhPaybdQAAAIA"]
[Tue Apr 07 18:56:40.176552 2026] [:error] [pid 59551:tid 59553] [client 20.234.6.239:18600] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adTi6F7LN7Ubyqs-sVvd7AAAAYA"]
[Tue Apr 07 18:56:41.122897 2026] [:error] [pid 37597:tid 37649] [client 20.234.6.239:18396] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adTi6Q6uAY0QAy-8EEIm5QAAAE8"]
[Tue Apr 07 18:56:41.935450 2026] [:error] [pid 59551:tid 59559] [client 20.234.6.239:18594] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adTi6V7LN7Ubyqs-sVvd7wAAAYY"]
[Tue Apr 07 18:56:42.461297 2026] [:error] [pid 37596:tid 37609] [client 20.234.6.239:7570] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adTi6qpaAOZHEjRWjP2P7AAAAAM"]
[Tue Apr 07 18:56:43.184141 2026] [:error] [pid 59551:tid 59569] [client 20.234.6.239:14058] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adTi617LN7Ubyqs-sVvd8AAAAZA"]
[Tue Apr 07 18:56:44.137545 2026] [:error] [pid 59551:tid 59576] [client 20.234.6.239:17570] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adTi7F7LN7Ubyqs-sVvd9QAAAZc"]
[Tue Apr 07 18:56:44.798214 2026] [:error] [pid 37598:tid 37676] [client 20.234.6.239:18616] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adTi7O9g7q_cV2WhPaybewAAAI8"]
[Tue Apr 07 18:56:45.489872 2026] [:error] [pid 59660:tid 59680] [client 20.234.6.239:7597] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adTi7Tp3-oiX2o5bTswApgAAAdI"]
[Tue Apr 07 18:56:46.457456 2026] [:error] [pid 37719:tid 37732] [client 20.234.6.239:13148] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adTi7k09Xv52u2xXGLDdzwAAAMo"]
[Tue Apr 07 18:56:47.552028 2026] [:error] [pid 37719:tid 37730] [client 20.234.6.239:21276] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adTi7009Xv52u2xXGLDd1AAAAMg"]
[Tue Apr 07 18:56:48.280270 2026] [:error] [pid 59551:tid 59570] [client 20.234.6.239:15797] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adTi8F7LN7Ubyqs-sVvd-QAAAZE"]
[Tue Apr 07 18:56:49.039293 2026] [:error] [pid 12948:tid 12973] [client 20.234.6.239:7784] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adTi8cbeSPAN8LvMqsaY5gAAARY"]
[Tue Apr 07 18:56:49.727072 2026] [:error] [pid 59804:tid 59815] [client 20.234.6.239:10208] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adTi8XYVIXiPh5_eJTmEwQAAAgk"]
[Tue Apr 07 18:56:50.536905 2026] [:error] [pid 59804:tid 59811] [client 20.234.6.239:17292] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adTi8nYVIXiPh5_eJTmExQAAAgU"]
[Tue Apr 07 18:56:51.136726 2026] [:error] [pid 59660:tid 59663] [client 20.234.6.239:10177] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adTi8zp3-oiX2o5bTswAqgAAAcE"]
[Tue Apr 07 18:56:52.177341 2026] [:error] [pid 59551:tid 59554] [client 20.234.6.239:6682] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adTi9F7LN7Ubyqs-sVvd_QAAAYE"]
[Tue Apr 07 18:56:53.131462 2026] [:error] [pid 12948:tid 12957] [client 20.234.6.239:8133] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTi9cbeSPAN8LvMqsaY6wAAAQY"]
[Tue Apr 07 18:56:54.460632 2026] [:error] [pid 59804:tid 59810] [client 20.234.6.239:34060] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTi9nYVIXiPh5_eJTmEygAAAgQ"]
[Tue Apr 07 18:56:55.576551 2026] [:error] [pid 37598:tid 37678] [client 20.234.6.239:34081] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTi9-9g7q_cV2WhPaybfwAAAJE"]
[Tue Apr 07 18:56:56.531509 2026] [:error] [pid 37598:tid 37675] [client 20.234.6.239:14242] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTi-O9g7q_cV2WhPaybgQAAAI4"]
[Tue Apr 07 18:56:57.692822 2026] [:error] [pid 37719:tid 37724] [client 20.234.6.239:23324] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adTi-U09Xv52u2xXGLDd3QAAAMI"]
[Tue Apr 07 18:56:59.123442 2026] [:error] [pid 37719:tid 37723] [client 20.234.6.239:16906] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adTi-009Xv52u2xXGLDd6AAAAME"]
[Tue Apr 07 18:56:59.892816 2026] [:error] [pid 37719:tid 37727] [client 20.234.6.239:7647] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adTi-009Xv52u2xXGLDd6wAAAMU"]
[Tue Apr 07 18:57:00.826740 2026] [:error] [pid 37598:tid 37661] [client 20.234.6.239:21716] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adTi_O9g7q_cV2WhPaybiQAAAIA"]
[Tue Apr 07 18:57:01.437965 2026] [:error] [pid 37719:tid 37736] [client 20.234.6.239:8372] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTi_U09Xv52u2xXGLDd8gAAAM4"]
[Tue Apr 07 18:57:02.515380 2026] [:error] [pid 37597:tid 37642] [client 20.234.6.239:7022] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTi_g6uAY0QAy-8EEIm_gAAAEg"]
[Tue Apr 07 18:57:03.407617 2026] [:error] [pid 59660:tid 59684] [client 20.234.6.239:16897] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTi_zp3-oiX2o5bTswAuAAAAdY"]
[Tue Apr 07 18:57:04.773754 2026] [:error] [pid 59660:tid 59682] [client 20.234.6.239:19052] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adTjADp3-oiX2o5bTswAugAAAdQ"]
[Tue Apr 07 18:57:05.761337 2026] [:error] [pid 59490:tid 59512] [client 20.234.6.239:19052] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adTjAUcw8OFbiUZ7Rx1YeAAAAVQ"]
[Tue Apr 07 18:57:06.932935 2026] [:error] [pid 37719:tid 37727] [client 20.234.6.239:14396] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adTjAk09Xv52u2xXGLDd_QAAAMU"]
[Tue Apr 07 18:57:07.783760 2026] [:error] [pid 37597:tid 37654] [client 20.234.6.239:14352] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adTjAw6uAY0QAy-8EEInDAAAAFQ"]
[Tue Apr 07 18:57:08.665903 2026] [:error] [pid 37597:tid 37645] [client 20.234.6.239:21697] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adTjBA6uAY0QAy-8EEInDwAAAEs"]
[Tue Apr 07 18:57:09.547159 2026] [:error] [pid 37598:tid 37676] [client 20.234.6.239:18919] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adTjBe9g7q_cV2WhPaybjQAAAI8"]
[Tue Apr 07 18:57:10.834742 2026] [:error] [pid 37719:tid 37729] [client 20.234.6.239:9702] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adTjBk09Xv52u2xXGLDeBAAAAMc"]
[Tue Apr 07 18:57:11.767916 2026] [:error] [pid 59490:tid 59501] [client 20.234.6.239:9356] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adTjB0cw8OFbiUZ7Rx1YewAAAUk"]
[Tue Apr 07 18:57:12.685121 2026] [:error] [pid 59660:tid 59674] [client 20.234.6.239:16318] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adTjCDp3-oiX2o5bTswAwgAAAcw"]
[Tue Apr 07 18:57:13.812075 2026] [:error] [pid 37598:tid 37663] [client 20.234.6.239:10606] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "adTjCe9g7q_cV2WhPayblgAAAII"]
[Tue Apr 07 18:57:14.896282 2026] [:error] [pid 37597:tid 37651] [client 20.234.6.239:6342] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "adTjCg6uAY0QAy-8EEInJAAAAFE"]
[Tue Apr 07 18:57:15.640542 2026] [:error] [pid 37596:tid 37625] [client 20.234.6.239:9874] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "adTjC6paAOZHEjRWjP2P-wAAABM"]
[Tue Apr 07 18:57:16.983370 2026] [:error] [pid 59551:tid 59560] [client 20.234.6.239:23664] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "adTjDF7LN7Ubyqs-sVveFAAAAYc"]
[Tue Apr 07 18:57:18.076811 2026] [:error] [pid 37719:tid 37737] [client 20.234.6.239:14920] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adTjDk09Xv52u2xXGLDeFQAAAM8"]
[Tue Apr 07 18:57:19.072383 2026] [:error] [pid 37719:tid 37733] [client 20.234.6.239:16304] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adTjD009Xv52u2xXGLDeHQAAAMs"]
[Tue Apr 07 18:57:20.241016 2026] [:error] [pid 37598:tid 37671] [client 20.234.6.239:36497] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adTjEO9g7q_cV2WhPaybmgAAAIo"]
[Tue Apr 07 18:57:21.044165 2026] [:error] [pid 37596:tid 37613] [client 20.234.6.239:10138] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adTjEapaAOZHEjRWjP2QBAAAAAc"]
[Tue Apr 07 18:57:22.525906 2026] [:error] [pid 37719:tid 37746] [client 20.234.6.239:36360] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "adTjEk09Xv52u2xXGLDeJQAAANg"]
[Tue Apr 07 18:57:23.511817 2026] [:error] [pid 37598:tid 37678] [client 20.234.6.239:13943] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "adTjE-9g7q_cV2WhPayboQAAAJE"]
[Tue Apr 07 18:57:24.172871 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:36513] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "adTjFA6uAY0QAy-8EEInPAAAAEE"]
[Tue Apr 07 18:57:25.410338 2026] [:error] [pid 37719:tid 37732] [client 20.234.6.239:15454] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "adTjFU09Xv52u2xXGLDeMgAAAMo"]
[Tue Apr 07 18:57:26.161792 2026] [:error] [pid 37597:tid 37657] [client 20.234.6.239:12509] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adTjFg6uAY0QAy-8EEInTAAAAFc"]
[Tue Apr 07 18:57:26.937517 2026] [:error] [pid 37719:tid 37729] [client 20.234.6.239:20433] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adTjFk09Xv52u2xXGLDeOgAAAMc"]
[Tue Apr 07 18:57:28.113836 2026] [:error] [pid 59660:tid 59685] [client 20.234.6.239:13550] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adTjGDp3-oiX2o5bTswA0QAAAdc"]
[Tue Apr 07 18:57:28.776160 2026] [:error] [pid 37597:tid 37656] [client 20.234.6.239:13529] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adTjGA6uAY0QAy-8EEInWAAAAFY"]
[Tue Apr 07 18:57:29.506761 2026] [:error] [pid 59804:tid 59828] [client 20.234.6.239:13966] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "adTjGXYVIXiPh5_eJTmE-QAAAhY"]
[Tue Apr 07 18:57:30.535345 2026] [:error] [pid 59804:tid 59826] [client 20.234.6.239:13269] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "adTjGnYVIXiPh5_eJTmFAAAAAhQ"]
[Tue Apr 07 18:57:31.285221 2026] [:error] [pid 37719:tid 37725] [client 20.234.6.239:15600] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "adTjG009Xv52u2xXGLDeRAAAAMM"]
[Tue Apr 07 18:57:32.093570 2026] [:error] [pid 37597:tid 37640] [client 20.234.6.239:12765] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "adTjHA6uAY0QAy-8EEInXgAAAEY"]
[Tue Apr 07 18:57:32.937814 2026] [:error] [pid 59551:tid 59574] [client 20.234.6.239:13802] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "adTjHF7LN7Ubyqs-sVveJAAAAZU"]
[Tue Apr 07 18:57:33.903046 2026] [:error] [pid 37719:tid 37740] [client 20.234.6.239:13795] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "adTjHU09Xv52u2xXGLDeTQAAANI"]
[Tue Apr 07 18:57:34.967298 2026] [:error] [pid 12948:tid 12963] [client 20.234.6.239:16205] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "adTjHsbeSPAN8LvMqsaZBQAAAQw"]
[Tue Apr 07 18:57:35.656797 2026] [:error] [pid 37719:tid 37732] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Tue Apr 07 18:57:35.932869 2026] [:error] [pid 37719:tid 37738] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 07 18:57:36.827094 2026] [:error] [pid 37719:tid 37731] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 07 18:57:37.106633 2026] [:error] [pid 37719:tid 37744] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 07 18:57:37.509659 2026] [:error] [pid 37719:tid 37746] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 07 18:57:37.781906 2026] [:error] [pid 37719:tid 37740] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 07 18:57:38.037077 2026] [:error] [pid 37719:tid 37735] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Apr 07 18:57:38.546433 2026] [:error] [pid 37719:tid 37725] [client 20.234.6.239:15069] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Tue Apr 07 18:57:38.928758 2026] [:error] [pid 37719:tid 37736] [client 20.234.6.239:15069] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adTjIk09Xv52u2xXGLDeYAAAAM4"]
[Tue Apr 07 18:57:39.523813 2026] [:error] [pid 37598:tid 37678] [client 20.234.6.239:13788] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adTjI-9g7q_cV2WhPaybuAAAAJE"]
[Tue Apr 07 18:57:40.768553 2026] [:error] [pid 12948:tid 12967] [client 20.234.6.239:15575] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adTjJMbeSPAN8LvMqsaZDAAAARA"]
[Tue Apr 07 18:57:41.661808 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:7826] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adTjJQ6uAY0QAy-8EEIniwAAAEE"]
[Tue Apr 07 18:57:42.668368 2026] [:error] [pid 59490:tid 59500] [client 20.234.6.239:12866] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adTjJkcw8OFbiUZ7Rx1YigAAAUg"]
[Tue Apr 07 18:57:43.495395 2026] [:error] [pid 59490:tid 59496] [client 20.234.6.239:15603] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adTjJ0cw8OFbiUZ7Rx1YjAAAAUQ"]
[Tue Apr 07 18:57:44.124555 2026] [:error] [pid 37719:tid 37728] [client 20.234.6.239:13065] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adTjKE09Xv52u2xXGLDeYgAAAMY"]
[Tue Apr 07 18:57:44.873807 2026] [:error] [pid 59490:tid 59507] [client 20.234.6.239:7841] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adTjKEcw8OFbiUZ7Rx1YkQAAAU8"]
[Tue Apr 07 18:57:45.580543 2026] [:error] [pid 37598:tid 37666] [client 20.234.6.239:13477] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adTjKe9g7q_cV2WhPaybvQAAAIU"]
[Tue Apr 07 18:57:46.493590 2026] [:error] [pid 59804:tid 59829] [client 20.234.6.239:13196] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adTjKnYVIXiPh5_eJTmFDAAAAhc"]
[Tue Apr 07 18:57:47.134762 2026] [:error] [pid 37597:tid 37643] [client 20.234.6.239:7243] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adTjKw6uAY0QAy-8EEInmgAAAEk"]
[Tue Apr 07 18:57:48.257014 2026] [:error] [pid 59804:tid 59808] [client 20.234.6.239:20758] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adTjLHYVIXiPh5_eJTmFFAAAAgI"]
[Tue Apr 07 18:57:49.396846 2026] [:error] [pid 59551:tid 59574] [client 20.234.6.239:12574] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adTjLV7LN7Ubyqs-sVveNQAAAZU"]
[Tue Apr 07 18:57:50.212544 2026] [:error] [pid 37719:tid 37737] [client 20.234.6.239:12908] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adTjLk09Xv52u2xXGLDeZQAAAM8"]
[Tue Apr 07 18:57:51.308764 2026] [:error] [pid 37719:tid 37726] [client 20.234.6.239:8901] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adTjL009Xv52u2xXGLDeawAAAMQ"]
[Tue Apr 07 18:57:51.991016 2026] [:error] [pid 37719:tid 37742] [client 20.234.6.239:13456] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adTjL009Xv52u2xXGLDecAAAANQ"]
[Tue Apr 07 18:57:53.147484 2026] [:error] [pid 37719:tid 37729] [client 20.234.6.239:13229] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adTjMU09Xv52u2xXGLDeeAAAAMc"]
[Tue Apr 07 18:57:53.858348 2026] [:error] [pid 59551:tid 59556] [client 20.234.6.239:15709] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adTjMV7LN7Ubyqs-sVveQgAAAYM"]
[Tue Apr 07 18:57:54.479652 2026] [:error] [pid 59551:tid 59555] [client 20.234.6.239:7628] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adTjMl7LN7Ubyqs-sVveRgAAAYI"]
[Tue Apr 07 18:57:55.301605 2026] [:error] [pid 59551:tid 59567] [client 20.234.6.239:32486] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adTjM17LN7Ubyqs-sVveSAAAAY4"]
[Tue Apr 07 18:57:56.031811 2026] [:error] [pid 59551:tid 59562] [client 20.234.6.239:19398] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTjNF7LN7Ubyqs-sVveTgAAAYk"]
[Tue Apr 07 18:57:56.771119 2026] [:error] [pid 59804:tid 59814] [client 20.234.6.239:13216] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTjNHYVIXiPh5_eJTmFHQAAAgg"]
[Tue Apr 07 18:57:57.693205 2026] [:error] [pid 59804:tid 59827] [client 20.234.6.239:12504] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTjNXYVIXiPh5_eJTmFHgAAAhU"]
[Tue Apr 07 18:57:59.053762 2026] [:error] [pid 59551:tid 59576] [client 20.234.6.239:8937] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adTjN17LN7Ubyqs-sVveUgAAAZc"]
[Tue Apr 07 18:57:59.933299 2026] [:error] [pid 37598:tid 37676] [client 20.234.6.239:12818] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adTjN-9g7q_cV2WhPaybwgAAAI8"]
[Tue Apr 07 18:58:00.573506 2026] [:error] [pid 37596:tid 37622] [client 20.234.6.239:20786] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adTjOKpaAOZHEjRWjP2QHAAAABA"]
[Tue Apr 07 18:58:01.284513 2026] [:error] [pid 37597:tid 37645] [client 20.234.6.239:8920] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adTjOQ6uAY0QAy-8EEInowAAAEs"]
[Tue Apr 07 18:58:01.976326 2026] [:error] [pid 59804:tid 59825] [client 20.234.6.239:17994] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adTjOXYVIXiPh5_eJTmFKAAAAhM"]
[Tue Apr 07 18:58:02.827167 2026] [:error] [pid 37719:tid 37744] [client 20.234.6.239:10086] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "adTjOk09Xv52u2xXGLDepgAAANY"]
[Tue Apr 07 18:58:03.496619 2026] [:error] [pid 37597:tid 37648] [client 20.234.6.239:15643] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "adTjOw6uAY0QAy-8EEInqwAAAE4"]
[Tue Apr 07 18:58:06.428927 2026] [:error] [pid 37719:tid 37735] [client 20.234.6.239:19602] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "adTjPk09Xv52u2xXGLDeqAAAAM0"]
[Tue Apr 07 18:58:11.468719 2026] [:error] [pid 59660:tid 59679] [client 20.234.6.239:18080] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "adTjQzp3-oiX2o5bTswA8wAAAdE"]
[Tue Apr 07 18:58:49.882421 2026] [:error] [pid 59804:tid 59817] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 07 18:58:50.560000 2026] [:error] [pid 59804:tid 59827] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Tue Apr 07 18:58:50.843945 2026] [:error] [pid 59804:tid 59828] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Tue Apr 07 18:58:51.378959 2026] [:error] [pid 59804:tid 59813] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue Apr 07 18:58:51.635072 2026] [:error] [pid 59804:tid 59815] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue Apr 07 18:58:51.949445 2026] [:error] [pid 59804:tid 59807] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/about2.php
[Tue Apr 07 18:58:52.287892 2026] [:error] [pid 59804:tid 59816] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Tue Apr 07 18:58:52.583496 2026] [:error] [pid 59804:tid 59810] [client 20.234.6.239:18297] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Tue Apr 07 18:58:53.274731 2026] [:error] [pid 59804:tid 59812] [client 20.234.6.239:18297] [client 20.234.6.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adTjbXYVIXiPh5_eJTmFaAAAAgY"]
[Tue Apr 07 18:58:56.137697 2026] [:error] [pid 12948:tid 12965] [client 20.234.6.239:8720] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adTjcMbeSPAN8LvMqsaZRwAAAQ4"]
[Tue Apr 07 18:58:57.180275 2026] [:error] [pid 59551:tid 59553] [client 20.234.6.239:23242] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adTjcV7LN7Ubyqs-sVvetwAAAYA"]
[Tue Apr 07 18:58:58.083499 2026] [:error] [pid 59551:tid 59571] [client 20.234.6.239:34119] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adTjcl7LN7Ubyqs-sVveuQAAAZI"]
[Tue Apr 07 18:58:59.125564 2026] [:error] [pid 59490:tid 59513] [client 20.234.6.239:34147] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adTjc0cw8OFbiUZ7Rx1YxwAAAVU"]
[Tue Apr 07 18:59:00.055587 2026] [:error] [pid 37598:tid 37685] [client 20.234.6.239:33998] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adTjdO9g7q_cV2WhPayb8wAAAJg"]
[Tue Apr 07 18:59:00.797034 2026] [:error] [pid 37719:tid 37742] [client 20.234.6.239:10994] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adTjdE09Xv52u2xXGLDfiQAAANQ"]
[Tue Apr 07 18:59:01.606977 2026] [:error] [pid 37597:tid 37639] [client 20.234.6.239:18814] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adTjdQ6uAY0QAy-8EEIomwAAAEU"]
[Tue Apr 07 18:59:02.454402 2026] [:error] [pid 12948:tid 12953] [client 20.234.6.239:16031] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adTjdsbeSPAN8LvMqsaZTQAAAQI"]
[Tue Apr 07 18:59:03.311760 2026] [:error] [pid 37597:tid 37641] [client 20.234.6.239:16049] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adTjdw6uAY0QAy-8EEIopAAAAEc"]
[Tue Apr 07 18:59:04.388541 2026] [:error] [pid 37597:tid 37654] [client 20.234.6.239:18635] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adTjeA6uAY0QAy-8EEIoqQAAAFQ"]
[Tue Apr 07 18:59:05.114093 2026] [:error] [pid 59490:tid 59499] [client 20.234.6.239:16389] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adTjeUcw8OFbiUZ7Rx1YyQAAAUc"]
[Tue Apr 07 18:59:06.260968 2026] [:error] [pid 37597:tid 37637] [client 20.234.6.239:16393] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adTjeg6uAY0QAy-8EEIouwAAAEM"]
[Tue Apr 07 18:59:07.563020 2026] [:error] [pid 37719:tid 37733] [client 20.234.6.239:15920] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adTje009Xv52u2xXGLDfoQAAAMs"]
[Tue Apr 07 18:59:08.547635 2026] [:error] [pid 37719:tid 37745] [client 20.234.6.239:34131] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adTjfE09Xv52u2xXGLDfpQAAANc"]
[Tue Apr 07 18:59:09.267896 2026] [:error] [pid 37719:tid 37732] [client 20.234.6.239:6646] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adTjfU09Xv52u2xXGLDfqAAAAMo"]
[Tue Apr 07 18:59:10.072722 2026] [:error] [pid 37597:tid 37636] [client 20.234.6.239:18760] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adTjfg6uAY0QAy-8EEIo0QAAAEI"]
[Tue Apr 07 18:59:11.041070 2026] [:error] [pid 59551:tid 59562] [client 20.234.6.239:23245] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adTjf17LN7Ubyqs-sVvevgAAAYk"]
[Tue Apr 07 18:59:12.021858 2026] [:error] [pid 59551:tid 59575] [client 20.234.6.239:16435] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adTjgF7LN7Ubyqs-sVvexAAAAZY"]
[Tue Apr 07 18:59:13.202074 2026] [:error] [pid 37598:tid 37662] [client 20.234.6.239:17433] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adTjge9g7q_cV2WhPayb_wAAAIE"]
[Tue Apr 07 18:59:13.913538 2026] [:error] [pid 37597:tid 37640] [client 20.234.6.239:8742] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adTjgQ6uAY0QAy-8EEIo7gAAAEY"]
[Tue Apr 07 18:59:14.980726 2026] [:error] [pid 59551:tid 59555] [client 20.234.6.239:18769] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adTjgl7LN7Ubyqs-sVvexwAAAYI"]
[Tue Apr 07 18:59:15.704598 2026] [:error] [pid 37598:tid 37677] [client 20.234.6.239:33989] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adTjg-9g7q_cV2WhPaycBQAAAJA"]
[Tue Apr 07 18:59:16.814397 2026] [:error] [pid 37597:tid 37640] [client 20.234.6.239:7597] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adTjhA6uAY0QAy-8EEIpAgAAAEY"]
[Tue Apr 07 18:59:17.520331 2026] [:error] [pid 59804:tid 59825] [client 20.234.6.239:17801] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adTjhXYVIXiPh5_eJTmFewAAAhM"]
[Tue Apr 07 18:59:18.964906 2026] [:error] [pid 37597:tid 37637] [client 20.234.6.239:6628] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adTjhg6uAY0QAy-8EEIpCQAAAEM"]
[Tue Apr 07 18:59:21.197857 2026] [:error] [pid 37598:tid 37684] [client 20.234.6.239:11004] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adTjie9g7q_cV2WhPaycCAAAAJc"]
[Tue Apr 07 18:59:23.111005 2026] [:error] [pid 37596:tid 37618] [client 20.234.6.239:18778] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adTji6paAOZHEjRWjP2QSAAAAAw"]
[Tue Apr 07 18:59:24.768249 2026] [:error] [pid 37597:tid 37648] [client 20.234.6.239:16046] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adTjjA6uAY0QAy-8EEIpJQAAAE4"]
[Tue Apr 07 18:59:27.516067 2026] [:error] [pid 37719:tid 37725] [client 20.234.6.239:16021] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adTjj009Xv52u2xXGLDfvAAAAMM"]
[Tue Apr 07 18:59:29.569027 2026] [:error] [pid 37597:tid 37641] [client 20.234.6.239:34040] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adTjkQ6uAY0QAy-8EEIpQAAAAEc"]
[Tue Apr 07 18:59:30.857508 2026] [:error] [pid 37597:tid 37652] [client 20.234.6.239:18685] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adTjkg6uAY0QAy-8EEIpTgAAAFI"]
[Tue Apr 07 18:59:32.239485 2026] [:error] [pid 59551:tid 59564] [client 20.234.6.239:15898] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adTjlF7LN7Ubyqs-sVve6AAAAYs"]
[Tue Apr 07 18:59:33.553078 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:34136] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adTjlQ6uAY0QAy-8EEIpYwAAAEE"]
[Tue Apr 07 18:59:34.443726 2026] [:error] [pid 59804:tid 59825] [client 20.234.6.239:17506] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adTjlnYVIXiPh5_eJTmFjgAAAhM"]
[Tue Apr 07 18:59:35.094163 2026] [:error] [pid 37597:tid 37634] [client 20.234.6.239:34120] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adTjlw6uAY0QAy-8EEIpcwAAAEA"]
[Tue Apr 07 18:59:36.018980 2026] [:error] [pid 12948:tid 12965] [client 20.234.6.239:18789] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adTjmMbeSPAN8LvMqsaZXAAAAQ4"]
[Tue Apr 07 18:59:37.055682 2026] [:error] [pid 37597:tid 37640] [client 20.234.6.239:23276] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adTjmQ6uAY0QAy-8EEIpeQAAAEY"]
[Tue Apr 07 18:59:38.016508 2026] [:error] [pid 12948:tid 12973] [client 20.234.6.239:18016] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adTjmsbeSPAN8LvMqsaZZAAAARY"]
[Tue Apr 07 18:59:39.035137 2026] [:error] [pid 59490:tid 59495] [client 20.234.6.239:9801] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adTjm0cw8OFbiUZ7Rx1Y4gAAAUM"]
[Tue Apr 07 18:59:40.436992 2026] [:error] [pid 37719:tid 37724] [client 20.234.6.239:17825] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adTjnE09Xv52u2xXGLDf1AAAAMI"]
[Tue Apr 07 18:59:41.739795 2026] [:error] [pid 59660:tid 59683] [client 20.234.6.239:15897] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adTjnTp3-oiX2o5bTswBGQAAAdU"]
[Tue Apr 07 18:59:42.750077 2026] [:error] [pid 37598:tid 37674] [client 20.234.6.239:16434] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adTjnu9g7q_cV2WhPaycLgAAAI0"]
[Tue Apr 07 18:59:43.828889 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:18264] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adTjnw6uAY0QAy-8EEIplQAAAEE"]
[Tue Apr 07 18:59:44.823022 2026] [:error] [pid 37719:tid 37733] [client 20.234.6.239:10972] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adTjoE09Xv52u2xXGLDf-AAAAMs"]
[Tue Apr 07 18:59:45.798604 2026] [:error] [pid 59490:tid 59500] [client 20.234.6.239:20529] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adTjoUcw8OFbiUZ7Rx1Y8AAAAUg"]
[Tue Apr 07 18:59:46.490807 2026] [:error] [pid 59551:tid 59558] [client 20.234.6.239:8752] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adTjol7LN7Ubyqs-sVvfGAAAAYU"]
[Tue Apr 07 18:59:47.375067 2026] [:error] [pid 37597:tid 37646] [client 20.234.6.239:17831] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adTjow6uAY0QAy-8EEIpswAAAEw"]
[Tue Apr 07 18:59:48.144317 2026] [:error] [pid 59551:tid 59554] [client 20.234.6.239:16409] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adTjpF7LN7Ubyqs-sVvfGgAAAYE"]
[Tue Apr 07 18:59:48.869886 2026] [:error] [pid 37598:tid 37674] [client 20.234.6.239:8707] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTjpO9g7q_cV2WhPaycOQAAAI0"]
[Tue Apr 07 18:59:49.908710 2026] [:error] [pid 37719:tid 37743] [client 20.234.6.239:9566] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTjpU09Xv52u2xXGLDgJAAAANU"]
[Tue Apr 07 18:59:50.952774 2026] [:error] [pid 37596:tid 37619] [client 20.234.6.239:16480] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTjpqpaAOZHEjRWjP2QWQAAAA0"]
[Tue Apr 07 18:59:51.755660 2026] [:error] [pid 59551:tid 59562] [client 20.234.6.239:16060] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTjp17LN7Ubyqs-sVvfJwAAAYk"]
[Tue Apr 07 18:59:52.546221 2026] [:error] [pid 37719:tid 37729] [client 20.234.6.239:17439] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "adTjqE09Xv52u2xXGLDgMwAAAMc"]
[Tue Apr 07 18:59:53.371646 2026] [:error] [pid 37597:tid 37642] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Tue Apr 07 18:59:53.794234 2026] [:error] [pid 37597:tid 37658] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Tue Apr 07 18:59:54.100409 2026] [:error] [pid 37597:tid 37646] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Apr 07 18:59:54.673952 2026] [:error] [pid 37597:tid 37657] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Tue Apr 07 18:59:54.982737 2026] [:error] [pid 37597:tid 37637] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Tue Apr 07 18:59:55.279510 2026] [:error] [pid 37597:tid 37658] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Apr 07 18:59:55.946832 2026] [:error] [pid 37597:tid 37636] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 07 18:59:56.199967 2026] [:error] [pid 37597:tid 37635] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Tue Apr 07 18:59:56.492808 2026] [:error] [pid 37597:tid 37652] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Tue Apr 07 18:59:56.788102 2026] [:error] [pid 37597:tid 37642] [client 20.234.6.239:34022] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Tue Apr 07 18:59:57.085509 2026] [:error] [pid 37597:tid 37653] [client 20.234.6.239:34022] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "adTjrQ6uAY0QAy-8EEIqAgAAAFM"]
[Tue Apr 07 18:59:57.954281 2026] [:error] [pid 37719:tid 37738] [client 20.234.6.239:23275] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "adTjrU09Xv52u2xXGLDgUAAAANA"]
[Tue Apr 07 18:59:58.735232 2026] [:error] [pid 59804:tid 59812] [client 20.234.6.239:6639] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "adTjrnYVIXiPh5_eJTmF4QAAAgY"]
[Tue Apr 07 18:59:59.466715 2026] [:error] [pid 59804:tid 59823] [client 20.234.6.239:23256] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class20.php"] [unique_id "adTjr3YVIXiPh5_eJTmF6wAAAhE"]
[Tue Apr 07 19:00:00.297966 2026] [:error] [pid 59551:tid 59577] [client 20.234.6.239:34019] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "adTjsF7LN7Ubyqs-sVvfQgAAAZg"]
[Tue Apr 07 19:00:00.958286 2026] [:error] [pid 37598:tid 37670] [client 20.234.6.239:17837] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "adTjsO9g7q_cV2WhPaycUQAAAIk"]
[Tue Apr 07 19:00:01.701577 2026] [:error] [pid 12948:tid 12955] [client 20.234.6.239:31152] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "adTjscbeSPAN8LvMqsaZiQAAAQQ"]
[Tue Apr 07 19:00:02.731803 2026] [:error] [pid 37598:tid 37681] [client 20.234.6.239:17517] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "adTjsu9g7q_cV2WhPaycVwAAAJQ"]
[Tue Apr 07 19:00:03.291174 2026] [:error] [pid 37597:tid 37657] [client 20.234.6.239:23262] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "adTjsw6uAY0QAy-8EEIqJwAAAFc"]
[Tue Apr 07 19:00:04.019614 2026] [:error] [pid 59551:tid 59570] [client 20.234.6.239:17358] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "adTjtF7LN7Ubyqs-sVvfUAAAAZE"]
[Tue Apr 07 19:00:04.598147 2026] [:error] [pid 59804:tid 59812] [client 20.234.6.239:18687] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "adTjtHYVIXiPh5_eJTmGBAAAAgY"]
[Tue Apr 07 19:00:05.259102 2026] [:error] [pid 37596:tid 37617] [client 20.234.6.239:6603] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "adTjtapaAOZHEjRWjP2QYQAAAAs"]
[Tue Apr 07 19:00:05.955479 2026] [:error] [pid 37597:tid 37658] [client 20.234.6.239:8859] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "adTjtQ6uAY0QAy-8EEIqPgAAAFg"]
[Tue Apr 07 19:00:06.887601 2026] [:error] [pid 59490:tid 59513] [client 20.234.6.239:34142] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "adTjtkcw8OFbiUZ7Rx1ZBwAAAVU"]
[Tue Apr 07 19:00:07.594139 2026] [:error] [pid 59490:tid 59499] [client 20.234.6.239:16392] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "adTjt0cw8OFbiUZ7Rx1ZCAAAAUc"]
[Tue Apr 07 19:00:08.503885 2026] [:error] [pid 59490:tid 59509] [client 20.234.6.239:34115] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "adTjuEcw8OFbiUZ7Rx1ZDAAAAVE"]
[Tue Apr 07 19:00:09.301969 2026] [:error] [pid 59490:tid 59493] [client 20.234.6.239:15885] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTjuUcw8OFbiUZ7Rx1ZGwAAAUE"]
[Tue Apr 07 19:00:10.216300 2026] [:error] [pid 37597:tid 37655] [client 20.234.6.239:18783] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTjug6uAY0QAy-8EEIqWAAAAFU"]
[Tue Apr 07 19:00:10.936055 2026] [:error] [pid 37597:tid 37656] [client 20.234.6.239:18796] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTjug6uAY0QAy-8EEIqWwAAAFY"]
[Tue Apr 07 19:00:11.549666 2026] [:error] [pid 37596:tid 37621] [client 20.234.6.239:18281] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adTju6paAOZHEjRWjP2QbAAAAA8"]
[Tue Apr 07 19:00:12.159543 2026] [:error] [pid 37597:tid 37650] [client 20.234.6.239:17354] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adTjvA6uAY0QAy-8EEIqZQAAAFA"]
[Tue Apr 07 19:00:12.854886 2026] [:error] [pid 59660:tid 59681] [client 20.234.6.239:34034] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adTjvDp3-oiX2o5bTswBQQAAAdM"]
[Tue Apr 07 19:00:13.511252 2026] [:error] [pid 37719:tid 37745] [client 20.234.6.239:18653] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adTjvU09Xv52u2xXGLDggAAAANc"]
[Tue Apr 07 19:00:14.110608 2026] [:error] [pid 37719:tid 37742] [client 20.234.6.239:34126] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adTjvk09Xv52u2xXGLDghwAAANQ"]
[Tue Apr 07 19:00:14.793644 2026] [:error] [pid 59551:tid 59557] [client 20.234.6.239:6613] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adTjvl7LN7Ubyqs-sVvfdQAAAYQ"]
[Tue Apr 07 19:00:15.487196 2026] [:error] [pid 59804:tid 59814] [client 20.234.6.239:16461] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adTjv3YVIXiPh5_eJTmGJQAAAgg"]
[Tue Apr 07 19:00:16.239115 2026] [:error] [pid 59551:tid 59558] [client 20.234.6.239:23253] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adTjwF7LN7Ubyqs-sVvfgwAAAYU"]
[Tue Apr 07 19:00:16.798899 2026] [:error] [pid 59660:tid 59667] [client 20.234.6.239:17477] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adTjwDp3-oiX2o5bTswBRwAAAcU"]
[Tue Apr 07 19:00:17.416424 2026] [:error] [pid 37597:tid 37654] [client 20.234.6.239:17420] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adTjwQ6uAY0QAy-8EEIqiAAAAFQ"]
[Tue Apr 07 19:00:18.184207 2026] [:error] [pid 37719:tid 37727] [client 20.234.6.239:17529] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adTjwk09Xv52u2xXGLDgngAAAMU"]
[Tue Apr 07 19:00:19.280144 2026] [:error] [pid 37719:tid 37729] [client 20.234.6.239:18670] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adTjw009Xv52u2xXGLDgqAAAAMc"]
[Tue Apr 07 19:00:19.997509 2026] [:error] [pid 37597:tid 37652] [client 20.234.6.239:23265] [client 20.234.6.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adTjww6uAY0QAy-8EEIqkQAAAFI"]
[Tue Apr 07 20:48:29.182010 2026] [:error] [pid 12948:tid 12956] [client 34.148.63.88:59008] [client 34.148.63.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adT9HcbeSPAN8LvMqsaxqwAAAQU"]
[Tue Apr 07 20:48:29.329813 2026] [:error] [pid 37719:tid 37730] [client 34.148.63.88:51040] [client 34.148.63.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adT9HU09Xv52u2xXGLAiHAAAAMg"]
[Wed Apr 08 00:02:12.515793 2026] [:error] [pid 37597:tid 37646] [client 180.245.254.237:56923] [client 180.245.254.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.245.254.237, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adUqhA6uAY0QAy-8EELlVQAAAEw"]
[Wed Apr 08 00:02:12.521884 2026] [:error] [pid 37597:tid 37646] [client 180.245.254.237:56923] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 08 00:50:32.572183 2026] [:error] [pid 4860:tid 5224] [client 94.247.172.129:1902] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.aoswa.com.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.aoswa.com.au"] [uri "/"] [unique_id "adU12An6KmY32L3WSeGvugAAAIk"]
[Wed Apr 08 01:15:20.692659 2026] [:error] [pid 5337:tid 5372] [client 49.43.26.246:64181] [client 49.43.26.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.26.246, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adU7qCboIFdw6tlcN13K1wAAAQ4"]
[Wed Apr 08 01:15:20.697131 2026] [:error] [pid 5337:tid 5372] [client 49.43.26.246:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 08 01:58:33.830901 2026] [:error] [pid 5337:tid 5364] [client 20.100.182.194:20112] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Wed Apr 08 01:58:34.092968 2026] [:error] [pid 5337:tid 5379] [client 20.100.182.194:20112] File does not exist: /usr/local/apache/htdocs/suspended-page/bogles.php
[Wed Apr 08 01:58:34.617576 2026] [:error] [pid 5337:tid 5370] [client 20.100.182.194:20112] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Apr 08 01:58:34.879420 2026] [:error] [pid 5337:tid 5364] [client 20.100.182.194:20112] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Wed Apr 08 01:58:35.141795 2026] [:error] [pid 5337:tid 5377] [client 20.100.182.194:20112] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Wed Apr 08 01:58:35.666843 2026] [:error] [pid 5337:tid 5382] [client 20.100.182.194:20112] File does not exist: /usr/local/apache/htdocs/suspended-page/x123.php
[Wed Apr 08 01:58:35.928661 2026] [:error] [pid 5337:tid 5364] [client 20.100.182.194:20112] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 03:37:21.549605 2026] [:error] [pid 5246:tid 5261] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/green.php
[Wed Apr 08 03:37:21.793648 2026] [:error] [pid 5246:tid 5265] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Wed Apr 08 03:37:22.106007 2026] [:error] [pid 5246:tid 5258] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Wed Apr 08 03:37:22.350091 2026] [:error] [pid 5246:tid 5252] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Wed Apr 08 03:37:22.594524 2026] [:error] [pid 5246:tid 5273] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/5xkfgawzejgwqh9hiaznCdefault.php
[Wed Apr 08 03:37:22.838703 2026] [:error] [pid 5246:tid 5257] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Wed Apr 08 03:37:23.081780 2026] [:error] [pid 5246:tid 5271] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Apr 08 03:37:23.325222 2026] [:error] [pid 5246:tid 5261] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Wed Apr 08 03:37:23.574906 2026] [:error] [pid 5246:tid 5256] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Wed Apr 08 03:37:23.818635 2026] [:error] [pid 5246:tid 5252] [client 158.158.50.76:30353] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Wed Apr 08 03:37:24.058716 2026] [:error] [pid 5246:tid 5262] [client 158.158.50.76:30353] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dass.php"] [unique_id "adVc9BLpySxaVC8kLEbNSwAAAMw"]
[Wed Apr 08 03:37:27.978788 2026] [:error] [pid 5246:tid 5269] [client 158.158.50.76:50980] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dass.php"] [unique_id "adVc9xLpySxaVC8kLEbNUQAAANM"]
[Wed Apr 08 03:37:35.277842 2026] [:error] [pid 5337:tid 5375] [client 158.158.50.76:32335] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dass.php"] [unique_id "adVc_yboIFdw6tlcN12SCwAAARE"]
[Wed Apr 08 03:37:37.226670 2026] [:error] [pid 5337:tid 5362] [client 158.158.50.76:62154] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dass.php"] [unique_id "adVdASboIFdw6tlcN12SGAAAAQQ"]
[Wed Apr 08 03:37:38.358310 2026] [:error] [pid 5337:tid 5358] [client 158.158.50.76:62194] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lib.php"] [unique_id "adVdAiboIFdw6tlcN12SHwAAAQA"]
[Wed Apr 08 03:37:39.138122 2026] [:error] [pid 5246:tid 5254] [client 158.158.50.76:30409] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lib.php"] [unique_id "adVdAxLpySxaVC8kLEbNWwAAAMQ"]
[Wed Apr 08 03:37:39.742247 2026] [:error] [pid 5246:tid 5258] [client 158.158.50.76:62185] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lib.php"] [unique_id "adVdAxLpySxaVC8kLEbNXgAAAMg"]
[Wed Apr 08 03:37:40.559322 2026] [:error] [pid 5246:tid 5270] [client 158.158.50.76:32375] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lib.php"] [unique_id "adVdBBLpySxaVC8kLEbNXwAAANQ"]
[Wed Apr 08 03:37:41.336220 2026] [:error] [pid 303:tid 327] [client 158.158.50.76:4304] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "adVdBc9wWR0DHTrNMuhT5wAAAVU"]
[Wed Apr 08 03:37:41.961427 2026] [:error] [pid 303:tid 316] [client 158.158.50.76:30455] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "adVdBc9wWR0DHTrNMuhT6AAAAUo"]
[Wed Apr 08 03:37:42.687545 2026] [:error] [pid 303:tid 323] [client 158.158.50.76:60251] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "adVdBs9wWR0DHTrNMuhT7gAAAVE"]
[Wed Apr 08 03:37:43.432026 2026] [:error] [pid 4860:tid 5220] [client 158.158.50.76:60285] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp9.php"] [unique_id "adVdBwn6KmY32L3WSeEEwAAAAIU"]
[Wed Apr 08 03:37:44.260292 2026] [:error] [pid 5246:tid 5260] [client 158.158.50.76:4343] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pass4.php"] [unique_id "adVdCBLpySxaVC8kLEbNaAAAAMo"]
[Wed Apr 08 03:37:44.879682 2026] [:error] [pid 5337:tid 5381] [client 158.158.50.76:60279] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pass4.php"] [unique_id "adVdCCboIFdw6tlcN12SMQAAARc"]
[Wed Apr 08 03:37:45.483633 2026] [:error] [pid 5246:tid 5268] [client 158.158.50.76:4172] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pass4.php"] [unique_id "adVdCRLpySxaVC8kLEbNbgAAANI"]
[Wed Apr 08 03:37:46.292994 2026] [:error] [pid 5337:tid 5367] [client 158.158.50.76:44756] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/pass4.php"] [unique_id "adVdCiboIFdw6tlcN12SPgAAAQk"]
[Wed Apr 08 03:37:47.397758 2026] [:error] [pid 303:tid 330] [client 158.158.50.76:4205] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adVdC89wWR0DHTrNMuhT8wAAAVg"]
[Wed Apr 08 03:37:48.295682 2026] [:error] [pid 303:tid 326] [client 158.158.50.76:24669] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adVdDM9wWR0DHTrNMuhT9wAAAVQ"]
[Wed Apr 08 03:37:49.063900 2026] [:error] [pid 5246:tid 5250] [client 158.158.50.76:32352] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adVdDRLpySxaVC8kLEbNdAAAAMA"]
[Wed Apr 08 03:37:50.065496 2026] [:error] [pid 5337:tid 5373] [client 158.158.50.76:52128] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adVdDiboIFdw6tlcN12STgAAAQ8"]
[Wed Apr 08 03:37:52.748330 2026] [:error] [pid 5246:tid 5259] [client 158.158.50.76:4324] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8573.php"] [unique_id "adVdEBLpySxaVC8kLEbNeAAAAMk"]
[Wed Apr 08 03:37:54.594432 2026] [:error] [pid 4840:tid 5182] [client 158.158.50.76:30340] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8573.php"] [unique_id "adVdEhsUwg2fEe9p9LQPgwAAABY"]
[Wed Apr 08 03:37:55.443417 2026] [:error] [pid 303:tid 311] [client 158.158.50.76:46891] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8573.php"] [unique_id "adVdE89wWR0DHTrNMuhUFAAAAUU"]
[Wed Apr 08 03:37:56.434855 2026] [:error] [pid 4860:tid 5239] [client 158.158.50.76:32323] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8573.php"] [unique_id "adVdFAn6KmY32L3WSeEE0AAAAJg"]
[Wed Apr 08 03:37:57.372533 2026] [:error] [pid 303:tid 317] [client 158.158.50.76:62156] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adVdFc9wWR0DHTrNMuhUHQAAAUs"]
[Wed Apr 08 03:37:57.999143 2026] [:error] [pid 5246:tid 5256] [client 158.158.50.76:32356] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adVdFRLpySxaVC8kLEbNfgAAAMY"]
[Wed Apr 08 03:37:58.885139 2026] [:error] [pid 5337:tid 5375] [client 158.158.50.76:4506] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adVdFiboIFdw6tlcN12SdAAAARE"]
[Wed Apr 08 03:37:59.512662 2026] [:error] [pid 4840:tid 5180] [client 158.158.50.76:52144] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adVdFxsUwg2fEe9p9LQPjgAAABQ"]
[Wed Apr 08 03:38:00.178484 2026] [:error] [pid 5337:tid 5380] [client 158.158.50.76:62171] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adVdGCboIFdw6tlcN12SdwAAARY"]
[Wed Apr 08 03:38:00.880097 2026] [:error] [pid 303:tid 326] [client 158.158.50.76:52137] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adVdGM9wWR0DHTrNMuhUIQAAAVQ"]
[Wed Apr 08 03:38:01.696295 2026] [:error] [pid 4842:tid 5207] [client 158.158.50.76:4519] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adVdGZdncJIGbBiMOXT9NQAAAFM"]
[Wed Apr 08 03:38:02.773836 2026] [:error] [pid 4860:tid 5226] [client 158.158.50.76:62157] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adVdGgn6KmY32L3WSeEE2wAAAIs"]
[Wed Apr 08 03:38:04.601820 2026] [:error] [pid 5337:tid 5365] [client 158.158.50.76:44742] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gfd.php"] [unique_id "adVdHCboIFdw6tlcN12SiAAAAQc"]
[Wed Apr 08 03:38:05.752050 2026] [:error] [pid 5337:tid 5358] [client 158.158.50.76:37524] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gfd.php"] [unique_id "adVdHSboIFdw6tlcN12SjgAAAQA"]
[Wed Apr 08 03:38:06.905278 2026] [:error] [pid 5337:tid 5375] [client 158.158.50.76:37543] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gfd.php"] [unique_id "adVdHiboIFdw6tlcN12SlAAAARE"]
[Wed Apr 08 03:38:09.787155 2026] [:error] [pid 5246:tid 5268] [client 158.158.50.76:50991] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gfd.php"] [unique_id "adVdIRLpySxaVC8kLEbNjQAAANI"]
[Wed Apr 08 03:38:11.861952 2026] [:error] [pid 5337:tid 5373] [client 158.158.50.76:52102] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/asasx.php"] [unique_id "adVdIyboIFdw6tlcN12SrAAAAQ8"]
[Wed Apr 08 03:38:14.615088 2026] [:error] [pid 5337:tid 5366] [client 158.158.50.76:44086] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/asasx.php"] [unique_id "adVdJiboIFdw6tlcN12StwAAAQg"]
[Wed Apr 08 03:38:22.551453 2026] [:error] [pid 4840:tid 5166] [client 158.158.50.76:36887] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/asasx.php"] [unique_id "adVdLhsUwg2fEe9p9LQPnQAAAAY"]
[Wed Apr 08 03:38:27.121880 2026] [:error] [pid 5337:tid 5373] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Wed Apr 08 03:38:27.363842 2026] [:error] [pid 5337:tid 5381] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Wed Apr 08 03:38:27.604902 2026] [:error] [pid 5337:tid 5366] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Wed Apr 08 03:38:27.849507 2026] [:error] [pid 5337:tid 5377] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Wed Apr 08 03:38:28.135110 2026] [:error] [pid 5337:tid 5365] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Wed Apr 08 03:38:28.378609 2026] [:error] [pid 5337:tid 5374] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/mI35rZhMg1zJ1vuXdefault.php
[Wed Apr 08 03:38:28.620874 2026] [:error] [pid 5337:tid 5378] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/q7lhrgzoo7ijhnkcedq2Cdefault.php
[Wed Apr 08 03:38:28.865143 2026] [:error] [pid 5337:tid 5368] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/exhds0ucw0ju9vjgasxqCdefault.php
[Wed Apr 08 03:38:29.106731 2026] [:error] [pid 5337:tid 5369] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/lmutxdvyp7u5yksqke8ozbjgCdefault.php
[Wed Apr 08 03:38:29.350668 2026] [:error] [pid 5337:tid 5363] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 08 03:38:29.605521 2026] [:error] [pid 5337:tid 5376] [client 158.158.50.76:47571] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Apr 08 03:38:29.844005 2026] [:error] [pid 5337:tid 5358] [client 158.158.50.76:47571] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "adVdNSboIFdw6tlcN12S4QAAAQA"]
[Wed Apr 08 03:38:30.545092 2026] [:error] [pid 5246:tid 5267] [client 158.158.50.76:4458] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "adVdNhLpySxaVC8kLEbNvAAAANE"]
[Wed Apr 08 03:38:31.295564 2026] [:error] [pid 4840:tid 5164] [client 158.158.50.76:58615] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "adVdNxsUwg2fEe9p9LQPpwAAAAQ"]
[Wed Apr 08 03:38:32.173855 2026] [:error] [pid 5337:tid 5369] [client 158.158.50.76:25525] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp5.php"] [unique_id "adVdOCboIFdw6tlcN12S7gAAAQs"]
[Wed Apr 08 03:38:32.708840 2026] [:error] [pid 4842:tid 5193] [client 158.158.50.76:47506] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVdOJdncJIGbBiMOXT9TQAAAEU"]
[Wed Apr 08 03:38:33.369104 2026] [:error] [pid 5337:tid 5376] [client 158.158.50.76:40829] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVdOSboIFdw6tlcN12S8QAAARI"]
[Wed Apr 08 03:38:34.040249 2026] [:error] [pid 5246:tid 5265] [client 158.158.50.76:25516] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVdOhLpySxaVC8kLEbNxAAAAM8"]
[Wed Apr 08 03:38:34.558575 2026] [:error] [pid 5337:tid 5378] [client 158.158.50.76:47505] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVdOiboIFdw6tlcN12S_AAAARQ"]
[Wed Apr 08 03:38:35.429980 2026] [:error] [pid 303:tid 314] [client 158.158.50.76:47517] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adVdO89wWR0DHTrNMuhUXwAAAUg"]
[Wed Apr 08 03:38:36.054352 2026] [:error] [pid 303:tid 311] [client 158.158.50.76:22610] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adVdPM9wWR0DHTrNMuhUYwAAAUU"]
[Wed Apr 08 03:38:36.860702 2026] [:error] [pid 303:tid 315] [client 158.158.50.76:47521] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adVdPM9wWR0DHTrNMuhUZwAAAUk"]
[Wed Apr 08 03:38:38.551886 2026] [:error] [pid 5337:tid 5371] [client 158.158.50.76:40821] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adVdPiboIFdw6tlcN12TDwAAAQ0"]
[Wed Apr 08 03:38:39.803710 2026] [:error] [pid 5246:tid 5272] [client 158.158.50.76:26094] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adVdPxLpySxaVC8kLEbNywAAANY"]
[Wed Apr 08 03:38:40.845669 2026] [:error] [pid 303:tid 322] [client 158.158.50.76:58010] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adVdQM9wWR0DHTrNMuhUbgAAAVA"]
[Wed Apr 08 03:38:42.021891 2026] [:error] [pid 5337:tid 5381] [client 158.158.50.76:58537] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adVdQiboIFdw6tlcN12TGQAAARc"]
[Wed Apr 08 03:38:42.988750 2026] [:error] [pid 4840:tid 5166] [client 158.158.50.76:40795] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adVdQhsUwg2fEe9p9LQPvgAAAAY"]
[Wed Apr 08 03:38:45.279639 2026] [:error] [pid 303:tid 306] [client 158.158.50.76:44676] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adVdRc9wWR0DHTrNMuhUeAAAAUA"]
[Wed Apr 08 03:38:47.735946 2026] [:error] [pid 303:tid 320] [client 158.158.50.76:28996] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adVdR89wWR0DHTrNMuhUgAAAAU4"]
[Wed Apr 08 03:38:48.868850 2026] [:error] [pid 5246:tid 5270] [client 158.158.50.76:43398] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adVdSBLpySxaVC8kLEbN3AAAANQ"]
[Wed Apr 08 03:38:49.777867 2026] [:error] [pid 5337:tid 5365] [client 158.158.50.76:58039] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adVdSSboIFdw6tlcN12TKwAAAQc"]
[Wed Apr 08 03:38:50.435821 2026] [:error] [pid 4860:tid 5217] [client 158.158.50.76:5031] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jp.php"] [unique_id "adVdSgn6KmY32L3WSeEFJQAAAII"]
[Wed Apr 08 03:38:51.099272 2026] [:error] [pid 5246:tid 5268] [client 158.158.50.76:28931] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jp.php"] [unique_id "adVdSxLpySxaVC8kLEbN5QAAANI"]
[Wed Apr 08 03:38:51.737312 2026] [:error] [pid 5246:tid 5263] [client 158.158.50.76:58032] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jp.php"] [unique_id "adVdSxLpySxaVC8kLEbN6AAAAM0"]
[Wed Apr 08 03:38:52.479946 2026] [:error] [pid 4840:tid 5166] [client 158.158.50.76:40805] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/jp.php"] [unique_id "adVdTBsUwg2fEe9p9LQPygAAAAY"]
[Wed Apr 08 03:38:53.491779 2026] [:error] [pid 303:tid 314] [client 158.158.50.76:26068] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx79.php"] [unique_id "adVdTc9wWR0DHTrNMuhUjwAAAUg"]
[Wed Apr 08 03:38:54.838551 2026] [:error] [pid 5337:tid 5373] [client 158.158.50.76:31058] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx79.php"] [unique_id "adVdTiboIFdw6tlcN12TPQAAAQ8"]
[Wed Apr 08 03:38:55.857854 2026] [:error] [pid 4860:tid 5218] [client 158.158.50.76:43445] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx79.php"] [unique_id "adVdTwn6KmY32L3WSeEFLQAAAIM"]
[Wed Apr 08 03:38:56.773895 2026] [:error] [pid 5337:tid 5371] [client 158.158.50.76:26106] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tx79.php"] [unique_id "adVdUCboIFdw6tlcN12TSQAAAQ0"]
[Wed Apr 08 03:38:57.905094 2026] [:error] [pid 5337:tid 5359] [client 158.158.50.76:28948] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adVdUSboIFdw6tlcN12TUAAAAQE"]
[Wed Apr 08 03:38:58.641579 2026] [:error] [pid 5337:tid 5377] [client 158.158.50.76:31057] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adVdUiboIFdw6tlcN12TVgAAARM"]
[Wed Apr 08 03:38:59.366059 2026] [:error] [pid 5246:tid 5271] [client 158.158.50.76:5029] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adVdUxLpySxaVC8kLEbN_AAAANU"]
[Wed Apr 08 03:38:59.889373 2026] [:error] [pid 4840:tid 5169] [client 158.158.50.76:57984] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adVdUxsUwg2fEe9p9LQP8gAAAAk"]
[Wed Apr 08 03:39:00.661375 2026] [:error] [pid 4860:tid 5227] [client 158.158.50.76:58103] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "adVdVAn6KmY32L3WSeEFOAAAAIw"]
[Wed Apr 08 03:39:01.296618 2026] [:error] [pid 4840:tid 5175] [client 158.158.50.76:5028] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "adVdVRsUwg2fEe9p9LQP9wAAAA8"]
[Wed Apr 08 03:39:01.977585 2026] [:error] [pid 5246:tid 5260] [client 158.158.50.76:58007] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "adVdVRLpySxaVC8kLEbOAQAAAMo"]
[Wed Apr 08 03:39:03.164991 2026] [:error] [pid 5337:tid 5366] [client 158.158.50.76:5000] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/Ov-Simple1.php"] [unique_id "adVdVyboIFdw6tlcN12TXQAAAQg"]
[Wed Apr 08 03:39:04.347746 2026] [:error] [pid 5246:tid 5262] [client 158.158.50.76:29757] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adVdWBLpySxaVC8kLEbODQAAAMw"]
[Wed Apr 08 03:39:05.605303 2026] [:error] [pid 4842:tid 5204] [client 158.158.50.76:61861] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adVdWZdncJIGbBiMOXT9XAAAAFA"]
[Wed Apr 08 03:39:06.781539 2026] [:error] [pid 5337:tid 5372] [client 158.158.50.76:29044] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adVdWiboIFdw6tlcN12TZQAAAQ4"]
[Wed Apr 08 03:39:07.804514 2026] [:error] [pid 5246:tid 5255] [client 158.158.50.76:61882] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adVdWxLpySxaVC8kLEbODwAAAMU"]
[Wed Apr 08 03:39:09.276246 2026] [:error] [pid 303:tid 327] [client 158.158.50.76:61842] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adVdXc9wWR0DHTrNMuhUrgAAAVU"]
[Wed Apr 08 03:39:10.798708 2026] [:error] [pid 4840:tid 5170] [client 158.158.50.76:58049] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adVdXhsUwg2fEe9p9LQQCQAAAAo"]
[Wed Apr 08 03:39:13.051977 2026] [:error] [pid 4842:tid 5197] [client 158.158.50.76:28977] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adVdYZdncJIGbBiMOXT9YQAAAEk"]
[Wed Apr 08 03:39:14.033694 2026] [:error] [pid 5246:tid 5269] [client 158.158.50.76:57988] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adVdYhLpySxaVC8kLEbOGAAAANM"]
[Wed Apr 08 03:39:15.528078 2026] [:error] [pid 5337:tid 5380] [client 158.158.50.76:60955] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adVdYyboIFdw6tlcN12TiQAAARY"]
[Wed Apr 08 03:39:16.630116 2026] [:error] [pid 5337:tid 5372] [client 158.158.50.76:26054] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adVdZCboIFdw6tlcN12TjQAAAQ4"]
[Wed Apr 08 03:39:19.621643 2026] [:error] [pid 5246:tid 5250] [client 158.158.50.76:40816] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adVdZxLpySxaVC8kLEbOHgAAAMA"]
[Wed Apr 08 03:39:23.139647 2026] [:error] [pid 4840:tid 5168] [client 158.158.50.76:29015] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adVdaxsUwg2fEe9p9LQQHAAAAAg"]
[Wed Apr 08 03:39:25.267125 2026] [:error] [pid 4840:tid 5175] [client 158.158.50.76:5038] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws88.php"] [unique_id "adVdbRsUwg2fEe9p9LQQIwAAAA8"]
[Wed Apr 08 03:39:28.799055 2026] [:error] [pid 5337:tid 5372] [client 158.158.50.76:58052] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ws88.php"] [unique_id "adVdcCboIFdw6tlcN12T8QAAAQ4"]
[Wed Apr 08 03:39:30.381191 2026] [:error] [pid 5246:tid 5263] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Wed Apr 08 03:39:30.704161 2026] [:error] [pid 5246:tid 5262] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Wed Apr 08 03:39:30.972443 2026] [:error] [pid 5246:tid 5271] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Wed Apr 08 03:39:31.216498 2026] [:error] [pid 5246:tid 5260] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Wed Apr 08 03:39:31.464008 2026] [:error] [pid 5246:tid 5266] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Wed Apr 08 03:39:31.711980 2026] [:error] [pid 5246:tid 5267] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Wed Apr 08 03:39:31.957910 2026] [:error] [pid 5246:tid 5274] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 08 03:39:32.222424 2026] [:error] [pid 5246:tid 5250] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Wed Apr 08 03:39:32.465892 2026] [:error] [pid 5246:tid 5257] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Wed Apr 08 03:39:32.711168 2026] [:error] [pid 5246:tid 5261] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Wed Apr 08 03:39:32.977503 2026] [:error] [pid 5246:tid 5270] [client 158.158.50.76:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/ws87.php
[Wed Apr 08 03:39:33.229471 2026] [:error] [pid 5246:tid 5259] [client 158.158.50.76:28527] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adVddRLpySxaVC8kLEbOTwAAAMk"]
[Wed Apr 08 03:39:36.571321 2026] [:error] [pid 303:tid 316] [client 158.158.50.76:31060] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adVdeM9wWR0DHTrNMuhVCAAAAUo"]
[Wed Apr 08 03:39:56.883630 2026] [:error] [pid 5337:tid 5381] [client 158.158.50.76:61853] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new3.php"] [unique_id "adVdjCboIFdw6tlcN12U0AAAARc"]
[Wed Apr 08 03:39:59.510798 2026] [:error] [pid 4860:tid 5234] [client 158.158.50.76:28953] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/new3.php"] [unique_id "adVdjwn6KmY32L3WSeEFkQAAAJM"]
[Wed Apr 08 03:40:06.555538 2026] [:error] [pid 303:tid 314] [client 158.158.50.76:58099] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sid3.php"] [unique_id "adVdls9wWR0DHTrNMuhVhAAAAUg"]
[Wed Apr 08 03:40:08.127069 2026] [:error] [pid 4840:tid 5178] [client 158.158.50.76:51025] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sid3.php"] [unique_id "adVdmBsUwg2fEe9p9LQQeQAAABI"]
[Wed Apr 08 03:40:09.760099 2026] [:error] [pid 5246:tid 5257] [client 158.158.50.76:41465] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sid3.php"] [unique_id "adVdmRLpySxaVC8kLEbO8gAAAMc"]
[Wed Apr 08 03:40:10.473158 2026] [:error] [pid 303:tid 309] [client 158.158.50.76:58069] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sid3.php"] [unique_id "adVdms9wWR0DHTrNMuhVmgAAAUM"]
[Wed Apr 08 03:40:11.814157 2026] [:error] [pid 5337:tid 5358] [client 158.158.50.76:28495] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adVdmyboIFdw6tlcN12VFQAAAQA"]
[Wed Apr 08 03:40:12.539582 2026] [:error] [pid 5337:tid 5370] [client 158.158.50.76:22542] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adVdnCboIFdw6tlcN12VGgAAAQw"]
[Wed Apr 08 03:40:13.683952 2026] [:error] [pid 4860:tid 5215] [client 158.158.50.76:4746] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adVdnQn6KmY32L3WSeEFngAAAIA"]
[Wed Apr 08 03:40:14.711096 2026] [:error] [pid 303:tid 308] [client 158.158.50.76:48360] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adVdns9wWR0DHTrNMuhVpwAAAUI"]
[Wed Apr 08 03:40:15.644739 2026] [:error] [pid 5246:tid 5266] [client 158.158.50.76:4737] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adVdnxLpySxaVC8kLEbPBgAAANA"]
[Wed Apr 08 03:40:16.375003 2026] [:error] [pid 303:tid 315] [client 158.158.50.76:64916] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adVdoM9wWR0DHTrNMuhVrgAAAUk"]
[Wed Apr 08 03:40:17.303699 2026] [:error] [pid 5337:tid 5369] [client 158.158.50.76:51034] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adVdoSboIFdw6tlcN12VJQAAAQs"]
[Wed Apr 08 03:40:18.585817 2026] [:error] [pid 5246:tid 5250] [client 158.158.50.76:28493] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adVdohLpySxaVC8kLEbPCQAAAMA"]
[Wed Apr 08 03:40:20.248907 2026] [:error] [pid 4842:tid 5200] [client 158.158.50.76:22565] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "adVdpJdncJIGbBiMOXT9owAAAEw"]
[Wed Apr 08 03:40:23.333388 2026] [:error] [pid 303:tid 322] [client 158.158.50.76:61554] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "adVdp89wWR0DHTrNMuhVzgAAAVA"]
[Wed Apr 08 03:40:27.742526 2026] [:error] [pid 303:tid 328] [client 158.158.50.76:31071] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/kj.php"] [unique_id "adVdq89wWR0DHTrNMuhV2wAAAVY"]
[Wed Apr 08 03:40:35.101252 2026] [:error] [pid 5337:tid 5377] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/b4txckoieeyhynhsrpi9lCdefault.php
[Wed Apr 08 03:40:35.342943 2026] [:error] [pid 5337:tid 5378] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Wed Apr 08 03:40:35.585244 2026] [:error] [pid 5337:tid 5362] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/wziar1.php
[Wed Apr 08 03:40:35.827249 2026] [:error] [pid 5337:tid 5376] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Wed Apr 08 03:40:36.081964 2026] [:error] [pid 5337:tid 5375] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Wed Apr 08 03:40:36.327831 2026] [:error] [pid 5337:tid 5367] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/8daf1238_1774208172.php
[Wed Apr 08 03:40:36.570710 2026] [:error] [pid 5337:tid 5372] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Wed Apr 08 03:40:36.812632 2026] [:error] [pid 5337:tid 5377] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Wed Apr 08 03:40:37.055166 2026] [:error] [pid 5337:tid 5370] [client 158.158.50.76:39034] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Wed Apr 08 03:40:53.261297 2026] [:error] [pid 42781:tid 42790] [client 158.158.50.76:4799] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Wed Apr 08 03:40:53.503632 2026] [:error] [pid 42781:tid 42809] [client 158.158.50.76:4799] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Wed Apr 08 03:40:53.742786 2026] [:error] [pid 42781:tid 42810] [client 158.158.50.76:4799] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "adVdxb7OsCrWulOWMh-eugAAABc"]
[Wed Apr 08 03:40:54.919884 2026] [:error] [pid 42783:tid 42848] [client 158.158.50.76:45661] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "adVdxvqoCGd-THZImQWD7AAAAIc"]
[Wed Apr 08 03:40:56.115276 2026] [:error] [pid 42873:tid 42879] [client 158.158.50.76:29714] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "adVdyEdl_qK_mbrbBysj6gAAAME"]
[Wed Apr 08 03:40:58.096425 2026] [:error] [pid 42783:tid 42864] [client 158.158.50.76:29759] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "adVdyvqoCGd-THZImQWD9QAAAJc"]
[Wed Apr 08 03:41:00.115109 2026] [:error] [pid 42873:tid 42896] [client 158.158.50.76:45690] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adVdzEdl_qK_mbrbBysj9QAAANI"]
[Wed Apr 08 03:41:01.912413 2026] [:error] [pid 42873:tid 42902] [client 158.158.50.76:39010] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adVdzUdl_qK_mbrbBysj_AAAANg"]
[Wed Apr 08 03:41:04.340613 2026] [:error] [pid 42783:tid 42863] [client 158.158.50.76:54471] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adVd0PqoCGd-THZImQWECAAAAJY"]
[Wed Apr 08 03:41:11.336540 2026] [:error] [pid 43034:tid 43056] [client 158.158.50.76:51022] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adVd1w0EpJLWitp3sO4PEwAAABE"]
[Wed Apr 08 03:41:13.554423 2026] [:error] [pid 43035:tid 43079] [client 158.158.50.76:26025] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0yellow.php"] [unique_id "adVd2ZIWHgDBgbEgmel6bgAAAIw"]
[Wed Apr 08 03:41:17.540039 2026] [:error] [pid 43244:tid 43252] [client 158.158.50.76:45683] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/0yellow.php"] [unique_id "adVd3VELv-aEPZYj2H4roAAAAAM"]
[Wed Apr 08 03:41:26.717949 2026] [:error] [pid 43633:tid 43645] [client 158.158.50.76:26014] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/only.php"] [unique_id "adVd5tsCWksOCxqQlIITpwAAAAA"]
[Wed Apr 08 03:41:29.156097 2026] [:error] [pid 43638:tid 43673] [client 158.158.50.76:26027] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/only.php"] [unique_id "adVd6ay2EglHdeFahtb9_gAAAEE"]
[Wed Apr 08 03:41:30.058804 2026] [:error] [pid 43633:tid 43665] [client 158.158.50.76:32912] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/only.php"] [unique_id "adVd6tsCWksOCxqQlIITtgAAABQ"]
[Wed Apr 08 03:41:31.037558 2026] [:error] [pid 43638:tid 43677] [client 158.158.50.76:26012] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/only.php"] [unique_id "adVd66y2EglHdeFahtb-AQAAAEU"]
[Wed Apr 08 03:41:32.464879 2026] [:error] [pid 43633:tid 43668] [client 158.158.50.76:51054] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aligk.php"] [unique_id "adVd7NsCWksOCxqQlIITuAAAABc"]
[Wed Apr 08 03:41:33.361114 2026] [:error] [pid 43639:tid 43714] [client 158.158.50.76:32941] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aligk.php"] [unique_id "adVd7cyI1SifWKyNFYZA8QAAAI8"]
[Wed Apr 08 03:41:34.487570 2026] [:error] [pid 43639:tid 43720] [client 158.158.50.76:35640] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aligk.php"] [unique_id "adVd7syI1SifWKyNFYZA9wAAAJU"]
[Wed Apr 08 03:41:35.210873 2026] [:error] [pid 43633:tid 43648] [client 158.158.50.76:40174] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aligk.php"] [unique_id "adVd79sCWksOCxqQlIITuwAAAAM"]
[Wed Apr 08 03:41:35.866038 2026] [:error] [pid 43633:tid 43656] [client 158.158.50.76:48339] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adVd79sCWksOCxqQlIITvgAAAAs"]
[Wed Apr 08 03:41:36.700489 2026] [:error] [pid 43639:tid 43708] [client 158.158.50.76:38994] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adVd8MyI1SifWKyNFYZA_wAAAIk"]
[Wed Apr 08 03:41:37.676705 2026] [:error] [pid 43638:tid 43685] [client 158.158.50.76:26018] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adVd8ay2EglHdeFahtb-FQAAAE0"]
[Wed Apr 08 03:41:38.457608 2026] [:error] [pid 43638:tid 43686] [client 158.158.50.76:39012] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adVd8qy2EglHdeFahtb-FwAAAE4"]
[Wed Apr 08 03:41:39.950909 2026] [:error] [pid 43639:tid 43719] [client 158.158.50.76:56832] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adVd88yI1SifWKyNFYZBCQAAAJQ"]
[Wed Apr 08 03:41:40.860036 2026] [:error] [pid 43639:tid 43700] [client 158.158.50.76:54513] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adVd9MyI1SifWKyNFYZBDAAAAIE"]
[Wed Apr 08 03:41:41.810878 2026] [:error] [pid 43633:tid 43667] [client 158.158.50.76:42790] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adVd9dsCWksOCxqQlIITyQAAABY"]
[Wed Apr 08 03:41:42.603891 2026] [:error] [pid 43633:tid 43668] [client 158.158.50.76:40164] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adVd9tsCWksOCxqQlIITygAAABc"]
[Wed Apr 08 03:41:43.140335 2026] [:error] [pid 43738:tid 43740] [client 158.158.50.76:25992] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVd9wjwY_KYpD8o1SfAiQAAAMA"]
[Wed Apr 08 03:41:43.898947 2026] [:error] [pid 43738:tid 43750] [client 158.158.50.76:40133] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVd9wjwY_KYpD8o1SfAiwAAAMo"]
[Wed Apr 08 03:41:44.981211 2026] [:error] [pid 43639:tid 43713] [client 158.158.50.76:51012] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVd-MyI1SifWKyNFYZBFAAAAI4"]
[Wed Apr 08 03:41:45.736583 2026] [:error] [pid 43639:tid 43709] [client 158.158.50.76:45667] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp.php"] [unique_id "adVd-cyI1SifWKyNFYZBGAAAAIo"]
[Wed Apr 08 03:41:46.334715 2026] [:error] [pid 43639:tid 43719] [client 158.158.50.76:56850] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adVd-syI1SifWKyNFYZBGQAAAJQ"]
[Wed Apr 08 03:41:47.024507 2026] [:error] [pid 43638:tid 43683] [client 158.158.50.76:4584] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adVd-6y2EglHdeFahtb-IwAAAEs"]
[Wed Apr 08 03:41:47.792342 2026] [:error] [pid 43633:tid 43659] [client 158.158.50.76:4643] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adVd-9sCWksOCxqQlIITzgAAAA4"]
[Wed Apr 08 03:41:48.342994 2026] [:error] [pid 43633:tid 43660] [client 158.158.50.76:56878] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adVd_NsCWksOCxqQlIITzwAAAA8"]
[Wed Apr 08 03:41:48.879936 2026] [:error] [pid 43638:tid 43682] [client 158.158.50.76:32897] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "adVd_Ky2EglHdeFahtb-JgAAAEo"]
[Wed Apr 08 03:41:49.463303 2026] [:error] [pid 43638:tid 43686] [client 158.158.50.76:4618] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "adVd_ay2EglHdeFahtb-JwAAAE4"]
[Wed Apr 08 03:41:49.975787 2026] [:error] [pid 43738:tid 43742] [client 158.158.50.76:56889] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "adVd_QjwY_KYpD8o1SfAngAAAMI"]
[Wed Apr 08 03:41:50.597417 2026] [:error] [pid 43639:tid 43699] [client 158.158.50.76:45637] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/myfile.php"] [unique_id "adVd_syI1SifWKyNFYZBHQAAAIA"]
[Wed Apr 08 03:41:51.080389 2026] [:error] [pid 43738:tid 43758] [client 158.158.50.76:57567] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adVd_wjwY_KYpD8o1SfApAAAANI"]
[Wed Apr 08 03:41:51.569946 2026] [:error] [pid 43633:tid 43668] [client 158.158.50.76:4598] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adVd_9sCWksOCxqQlIIT1wAAABc"]
[Wed Apr 08 03:41:52.268254 2026] [:error] [pid 43639:tid 43705] [client 158.158.50.76:33804] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adVeAMyI1SifWKyNFYZBHgAAAIY"]
[Wed Apr 08 03:41:52.769376 2026] [:error] [pid 43738:tid 43762] [client 158.158.50.76:45674] [client 158.158.50.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adVeAAjwY_KYpD8o1SfAqQAAANY"]
[Wed Apr 08 03:59:04.074336 2026] [:error] [pid 16743:tid 16756] [client 20.100.182.194:10472] [client 20.100.182.194] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aevly.php"] [unique_id "adViCMcwMgE0xkyy3sGrkgAAAMo"]
[Wed Apr 08 04:09:36.565300 2026] [:error] [pid 47626:tid 47689] [client 216.81.248.41:34126] [client 216.81.248.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adVkgKjWI8TWtHx2sdbcfAAAAFU"]
[Wed Apr 08 07:48:53.856867 2026] [:error] [pid 47626:tid 47689] [client 45.55.196.51:58054] [client 45.55.196.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adWX5ajWI8TWtHx2sdYrzAAAAFU"]
[Wed Apr 08 07:48:54.751344 2026] [:error] [pid 47627:tid 47715] [client 45.55.196.51:39672] [client 45.55.196.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adWX5nOljf1Quv_kDjnRVwAAAJA"]
[Wed Apr 08 09:25:24.359046 2026] [:error] [pid 16630:tid 16633] [client 103.168.67.159:46000] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dashboard"] [unique_id "adWuhCjfVAkPG-jgJEpQbQAAAQE"]
[Wed Apr 08 09:25:25.102377 2026] [:error] [pid 47627:tid 47703] [client 103.168.67.159:46266] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dashboard"] [unique_id "adWuhXOljf1Quv_kDjn0HgAAAIQ"]
[Wed Apr 08 09:25:25.812136 2026] [:error] [pid 47732:tid 47744] [client 103.168.67.159:46626] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dashboard"] [unique_id "adWuhYm4N5QW9Mh7G127egAAAMo"]
[Wed Apr 08 09:25:26.516941 2026] [:error] [pid 47627:tid 47723] [client 103.168.67.159:46942] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dashboard"] [unique_id "adWuhnOljf1Quv_kDjn0JwAAAJg"]
[Wed Apr 08 11:19:09.832451 2026] [:error] [pid 47626:tid 47669] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 08 11:19:10.043692 2026] [:error] [pid 47626:tid 47671] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Apr 08 11:19:10.258414 2026] [:error] [pid 47626:tid 47674] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Apr 08 11:19:10.472598 2026] [:error] [pid 47626:tid 47683] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 08 11:19:10.689548 2026] [:error] [pid 47626:tid 47691] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 08 11:19:10.900162 2026] [:error] [pid 47626:tid 47679] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 08 11:19:11.161185 2026] [:error] [pid 47626:tid 47677] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 08 11:19:11.387346 2026] [:error] [pid 47626:tid 47690] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Apr 08 11:19:11.842064 2026] [:error] [pid 47626:tid 47684] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Apr 08 11:19:12.070301 2026] [:error] [pid 47626:tid 47680] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Apr 08 11:19:12.385698 2026] [:error] [pid 47626:tid 47686] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 11:19:12.599353 2026] [:error] [pid 47626:tid 47678] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Apr 08 11:19:12.815195 2026] [:error] [pid 47626:tid 47685] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 08 11:19:13.028053 2026] [:error] [pid 47626:tid 47683] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Apr 08 11:19:13.257809 2026] [:error] [pid 47626:tid 47668] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Apr 08 11:19:13.476621 2026] [:error] [pid 47626:tid 47679] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 08 11:19:13.708928 2026] [:error] [pid 47626:tid 47670] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Apr 08 11:19:13.926898 2026] [:error] [pid 47626:tid 47677] [client 209.87.169.153:54597] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 08 11:19:17.061759 2026] [:error] [pid 47626:tid 47682] [client 209.87.169.153:54597] [client 209.87.169.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adXJNajWI8TWtHx2sdZfRQAAAE4"]
[Wed Apr 08 11:19:18.421146 2026] [:error] [pid 47627:tid 47703] [client 209.87.169.155:49791] [client 209.87.169.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adXJNnOljf1Quv_kDjk1XQAAAIQ"]
[Wed Apr 08 11:19:19.648429 2026] [:error] [pid 16630:tid 16642] [client 209.87.169.128:25477] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 08 11:19:20.297015 2026] [:error] [pid 16630:tid 16635] [client 209.87.169.128:25477] [client 209.87.169.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adXJOCjfVAkPG-jgJEp-iwAAAQM"]
[Wed Apr 08 11:19:21.643103 2026] [:error] [pid 47625:tid 47654] [client 209.87.169.126:40011] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Apr 08 11:19:21.941895 2026] [:error] [pid 47625:tid 47656] [client 209.87.169.126:40011] [client 209.87.169.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adXJOSVuHyNWzZlE8PCVswAAABY"]
[Wed Apr 08 11:19:22.950477 2026] [:error] [pid 47732:tid 47743] [client 209.87.169.155:23153] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Apr 08 11:19:24.020014 2026] [:error] [pid 47732:tid 47742] [client 209.87.169.155:23153] [client 209.87.169.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adXJPIm4N5QW9Mh7G13g0gAAAMg"]
[Wed Apr 08 11:19:26.584940 2026] [:error] [pid 47625:tid 47645] [client 209.87.169.134:61983] [client 209.87.169.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adXJPiVuHyNWzZlE8PCV7wAAAAs"]
[Wed Apr 08 11:19:27.431972 2026] [:error] [pid 544:tid 571] [client 209.87.169.152:26675] [client 209.87.169.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adXJPzieLKSoiLVA6YffXwAAAZY"]
[Wed Apr 08 11:19:28.369764 2026] [:error] [pid 47732:tid 47752] [client 185.198.240.185:56953] [client 185.198.240.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adXJQIm4N5QW9Mh7G13g2gAAANI"]
[Wed Apr 08 11:19:29.463718 2026] [:error] [pid 47625:tid 47653] [client 45.131.195.107:41819] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adXJQSVuHyNWzZlE8PCV8QAAABM"]
[Wed Apr 08 11:19:30.174644 2026] [:error] [pid 47625:tid 47634] [client 209.87.169.138:22399] [client 209.87.169.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adXJQiVuHyNWzZlE8PCV9QAAAAA"]
[Wed Apr 08 11:19:31.200502 2026] [:error] [pid 47625:tid 47638] [client 45.131.195.138:63963] [client 45.131.195.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adXJQyVuHyNWzZlE8PCV_gAAAAQ"]
[Wed Apr 08 11:19:31.959034 2026] [:error] [pid 47625:tid 47651] [client 45.131.195.142:52141] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Apr 08 11:19:32.417436 2026] [:error] [pid 47625:tid 47654] [client 45.131.195.142:52141] [client 45.131.195.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "adXJRCVuHyNWzZlE8PCWBAAAABQ"]
[Wed Apr 08 11:19:33.516695 2026] [:error] [pid 47625:tid 47655] [client 209.87.169.140:38449] [client 209.87.169.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adXJRSVuHyNWzZlE8PCWCgAAABU"]
[Wed Apr 08 11:19:34.655747 2026] [:error] [pid 47627:tid 47721] [client 45.131.195.128:44067] [client 45.131.195.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adXJRnOljf1Quv_kDjk1bQAAAJY"]
[Wed Apr 08 11:19:36.385642 2026] [:error] [pid 47626:tid 47678] [client 45.131.195.108:42527] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Apr 08 11:19:36.594669 2026] [:error] [pid 47626:tid 47671] [client 45.131.195.108:42527] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adXJSKjWI8TWtHx2sdZfXQAAAEM"]
[Wed Apr 08 11:19:37.217780 2026] [:error] [pid 544:tid 561] [client 45.131.195.117:39157] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Apr 08 11:19:37.873131 2026] [:error] [pid 544:tid 549] [client 45.131.195.117:39157] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Apr 08 11:19:38.549645 2026] [:error] [pid 544:tid 560] [client 45.131.195.117:39157] [client 45.131.195.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adXJSjieLKSoiLVA6YffdQAAAYs"]
[Wed Apr 08 11:19:39.201553 2026] [:error] [pid 16630:tid 16637] [client 209.87.169.142:41645] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Apr 08 11:19:39.411380 2026] [:error] [pid 16630:tid 16648] [client 209.87.169.142:41645] [client 209.87.169.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adXJSyjfVAkPG-jgJEp-lgAAARA"]
[Wed Apr 08 11:19:39.972008 2026] [:error] [pid 47625:tid 47638] [client 209.87.169.129:60473] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Apr 08 11:19:40.415909 2026] [:error] [pid 47625:tid 47649] [client 209.87.169.129:60473] [client 209.87.169.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adXJTCVuHyNWzZlE8PCWIAAAAA8"]
[Wed Apr 08 11:19:41.392444 2026] [:error] [pid 16630:tid 16653] [client 45.131.195.132:37511] [client 45.131.195.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adXJTSjfVAkPG-jgJEp-nwAAARU"]
[Wed Apr 08 11:19:42.357701 2026] [:error] [pid 47627:tid 47709] [client 45.131.195.117:31503] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Apr 08 11:19:42.573535 2026] [:error] [pid 47627:tid 47712] [client 45.131.195.117:31503] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Apr 08 11:19:43.020098 2026] [:error] [pid 47627:tid 47719] [client 45.131.195.117:31503] [client 45.131.195.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adXJT3Oljf1Quv_kDjk1gwAAAJQ"]
[Wed Apr 08 11:19:45.632252 2026] [:error] [pid 47625:tid 47649] [client 45.131.195.128:36561] [client 45.131.195.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adXJUSVuHyNWzZlE8PCWNAAAAA8"]
[Wed Apr 08 11:19:46.715422 2026] [:error] [pid 47625:tid 47658] [client 209.87.169.145:47197] [client 209.87.169.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adXJUiVuHyNWzZlE8PCWRgAAABg"]
[Wed Apr 08 11:19:47.627957 2026] [:error] [pid 47626:tid 47669] [client 173.239.214.57:62089] [client 173.239.214.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adXJU6jWI8TWtHx2sdZfbQAAAEE"]
[Wed Apr 08 11:19:48.339067 2026] [:error] [pid 544:tid 561] [client 45.131.195.107:41661] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adXJVDieLKSoiLVA6YffeAAAAYw"]
[Wed Apr 08 11:19:49.512308 2026] [:error] [pid 16630:tid 16646] [client 209.87.169.141:38947] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Apr 08 11:19:49.723498 2026] [:error] [pid 16630:tid 16653] [client 209.87.169.141:38947] [client 209.87.169.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adXJVSjfVAkPG-jgJEp-vAAAARU"]
[Wed Apr 08 11:19:50.390826 2026] [:error] [pid 47627:tid 47712] [client 209.87.169.145:57755] [client 209.87.169.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adXJVnOljf1Quv_kDjk1pQAAAI0"]
[Wed Apr 08 11:19:51.103220 2026] [:error] [pid 47627:tid 47702] [client 173.239.214.57:51261] [client 173.239.214.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adXJV3Oljf1Quv_kDjk1rQAAAIM"]
[Wed Apr 08 11:19:52.195310 2026] [:error] [pid 47627:tid 47712] [client 45.131.195.108:64513] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Apr 08 11:19:52.620971 2026] [:error] [pid 47627:tid 47705] [client 45.131.195.108:64513] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Apr 08 11:19:53.485892 2026] [:error] [pid 47627:tid 47709] [client 45.131.195.108:64513] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adXJWXOljf1Quv_kDjk1zQAAAIo"]
[Wed Apr 08 11:19:54.578272 2026] [:error] [pid 16630:tid 16639] [client 209.87.169.132:52257] [client 209.87.169.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.132, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adXJWijfVAkPG-jgJEp-ygAAAQc"]
[Wed Apr 08 11:19:54.797883 2026] [:error] [pid 16630:tid 16632] [client 209.87.169.132:52257] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Apr 08 11:19:55.869880 2026] [:error] [pid 16630:tid 16640] [client 209.87.169.132:52257] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Apr 08 11:19:56.094490 2026] [:error] [pid 16630:tid 16633] [client 209.87.169.132:52257] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Apr 08 11:19:57.243175 2026] [:error] [pid 16630:tid 16650] [client 209.87.169.132:52257] [client 209.87.169.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adXJXSjfVAkPG-jgJEp-3AAAARI"]
[Wed Apr 08 11:19:58.040623 2026] [:error] [pid 16630:tid 16641] [client 209.87.169.130:37679] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Apr 08 11:19:58.248777 2026] [:error] [pid 16630:tid 16634] [client 209.87.169.130:37679] [client 209.87.169.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.130, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adXJXijfVAkPG-jgJEp-4QAAAQI"]
[Wed Apr 08 11:19:58.696887 2026] [:error] [pid 16630:tid 16651] [client 209.87.169.130:37679] [client 209.87.169.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "adXJXijfVAkPG-jgJEp-5AAAARM"]
[Wed Apr 08 11:20:00.159707 2026] [:error] [pid 47732:tid 47754] [client 45.131.195.132:38835] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Apr 08 11:20:00.774678 2026] [:error] [pid 47732:tid 47734] [client 45.131.195.132:38835] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Wed Apr 08 11:20:01.507455 2026] [:error] [pid 47732:tid 47746] [client 45.131.195.132:38835] [client 45.131.195.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adXJYYm4N5QW9Mh7G13hBgAAAMw"]
[Wed Apr 08 11:20:02.046207 2026] [:error] [pid 16630:tid 16650] [client 209.87.169.145:47425] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 08 11:20:02.985592 2026] [:error] [pid 16630:tid 16632] [client 209.87.169.145:47425] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Apr 08 11:20:03.574229 2026] [:error] [pid 16630:tid 16653] [client 209.87.169.145:47425] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Apr 08 11:20:04.072208 2026] [:error] [pid 16630:tid 16636] [client 209.87.169.145:47425] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Apr 08 11:20:04.327760 2026] [:error] [pid 16630:tid 16635] [client 209.87.169.145:47425] [client 209.87.169.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adXJZCjfVAkPG-jgJEp-8gAAAQM"]
[Wed Apr 08 11:20:05.309088 2026] [:error] [pid 47627:tid 47719] [client 209.87.169.148:54225] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Apr 08 11:20:05.529384 2026] [:error] [pid 47627:tid 47720] [client 209.87.169.148:54225] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Apr 08 11:20:05.740184 2026] [:error] [pid 47627:tid 47706] [client 209.87.169.148:54225] [client 209.87.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adXJZXOljf1Quv_kDjk2FgAAAIc"]
[Wed Apr 08 11:20:07.845625 2026] [:error] [pid 47627:tid 47706] [client 45.131.195.113:26169] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Apr 08 11:20:08.280540 2026] [:error] [pid 47627:tid 47711] [client 45.131.195.113:26169] [client 45.131.195.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.113, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adXJaHOljf1Quv_kDjk2IwAAAIw"]
[Wed Apr 08 11:20:08.506936 2026] [:error] [pid 47627:tid 47707] [client 45.131.195.113:26169] [client 45.131.195.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adXJaHOljf1Quv_kDjk2JAAAAIg"]
[Wed Apr 08 11:20:12.886581 2026] [:error] [pid 47625:tid 47636] [client 209.87.169.154:31621] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Apr 08 11:20:14.406349 2026] [:error] [pid 47625:tid 47655] [client 209.87.169.154:31621] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Apr 08 11:20:14.616169 2026] [:error] [pid 47625:tid 47636] [client 209.87.169.154:31621] [client 209.87.169.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adXJbiVuHyNWzZlE8PCWxwAAAAI"]
[Wed Apr 08 11:20:15.273972 2026] [:error] [pid 47625:tid 47652] [client 209.87.169.152:61957] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Apr 08 11:20:15.925071 2026] [:error] [pid 47625:tid 47651] [client 209.87.169.152:61957] [client 209.87.169.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.152, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adXJbyVuHyNWzZlE8PCW0AAAABE"]
[Wed Apr 08 11:20:16.179751 2026] [:error] [pid 47625:tid 47658] [client 209.87.169.152:61957] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Apr 08 11:20:16.392251 2026] [:error] [pid 47625:tid 47646] [client 209.87.169.152:61957] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Apr 08 11:20:16.609145 2026] [:error] [pid 47625:tid 47637] [client 209.87.169.152:61957] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Apr 08 11:20:16.819714 2026] [:error] [pid 47625:tid 47650] [client 209.87.169.152:61957] [client 209.87.169.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adXJcCVuHyNWzZlE8PCW1wAAABA"]
[Wed Apr 08 11:20:17.691514 2026] [:error] [pid 16630:tid 16647] [client 45.131.195.118:25041] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Apr 08 11:20:17.904957 2026] [:error] [pid 16630:tid 16654] [client 45.131.195.118:25041] [client 45.131.195.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adXJcSjfVAkPG-jgJEp_FAAAARY"]
[Wed Apr 08 11:20:19.016488 2026] [:error] [pid 47625:tid 47638] [client 209.87.169.146:61075] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Apr 08 11:20:19.234647 2026] [:error] [pid 47625:tid 47639] [client 209.87.169.146:61075] [client 209.87.169.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adXJcyVuHyNWzZlE8PCW2wAAAAU"]
[Wed Apr 08 11:20:20.627353 2026] [:error] [pid 47627:tid 47717] [client 45.131.195.123:49759] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Apr 08 11:20:20.841086 2026] [:error] [pid 47627:tid 47709] [client 45.131.195.123:49759] [client 45.131.195.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adXJdHOljf1Quv_kDjk2NgAAAIo"]
[Wed Apr 08 11:20:21.890896 2026] [:error] [pid 47627:tid 47715] [client 209.87.169.128:41141] [client 209.87.169.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adXJdXOljf1Quv_kDjk2PwAAAJA"]
[Wed Apr 08 11:20:22.884299 2026] [:error] [pid 47625:tid 47644] [client 45.131.195.118:38463] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Apr 08 11:20:23.106436 2026] [:error] [pid 47625:tid 47634] [client 45.131.195.118:38463] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Wed Apr 08 11:20:24.013864 2026] [:error] [pid 47625:tid 47656] [client 45.131.195.118:38463] [client 45.131.195.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adXJeCVuHyNWzZlE8PCW8wAAABY"]
[Wed Apr 08 11:20:25.043121 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.147:42195] [client 45.131.195.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adXJeSVuHyNWzZlE8PCW-wAAAAE"]
[Wed Apr 08 11:20:26.753727 2026] [:error] [pid 47625:tid 47634] [client 209.87.169.130:50157] [client 209.87.169.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adXJeiVuHyNWzZlE8PCXBQAAAAA"]
[Wed Apr 08 11:20:27.573492 2026] [:error] [pid 47625:tid 47638] [client 209.87.169.144:38253] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Apr 08 11:20:28.004865 2026] [:error] [pid 47625:tid 47645] [client 209.87.169.144:38253] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Apr 08 11:20:28.224514 2026] [:error] [pid 47625:tid 47657] [client 209.87.169.144:38253] [client 209.87.169.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adXJfCVuHyNWzZlE8PCXFgAAABc"]
[Wed Apr 08 11:20:30.926078 2026] [:error] [pid 47627:tid 47709] [client 185.198.240.185:23085] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Apr 08 11:20:31.459023 2026] [:error] [pid 47627:tid 47722] [client 185.198.240.185:23085] [client 185.198.240.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "adXJf3Oljf1Quv_kDjk2agAAAJc"]
[Wed Apr 08 11:20:32.643274 2026] [:error] [pid 47627:tid 47700] [client 209.87.169.139:24303] [client 209.87.169.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adXJgHOljf1Quv_kDjk2dwAAAIE"]
[Wed Apr 08 11:20:33.809202 2026] [:error] [pid 47625:tid 47648] [client 209.87.169.128:29619] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Apr 08 11:20:34.546770 2026] [:error] [pid 47625:tid 47637] [client 209.87.169.128:29619] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Apr 08 11:20:35.119041 2026] [:error] [pid 47625:tid 47646] [client 209.87.169.128:29619] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Apr 08 11:20:35.345253 2026] [:error] [pid 47625:tid 47655] [client 209.87.169.128:29619] [client 209.87.169.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adXJgyVuHyNWzZlE8PCXRgAAABU"]
[Wed Apr 08 11:20:36.292057 2026] [:error] [pid 47627:tid 47701] [client 45.131.195.148:64727] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adXJhHOljf1Quv_kDjk2igAAAII"]
[Wed Apr 08 11:20:37.277223 2026] [:error] [pid 47625:tid 47643] [client 45.131.195.117:43175] [client 45.131.195.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adXJhSVuHyNWzZlE8PCXUQAAAAk"]
[Wed Apr 08 11:20:38.242344 2026] [:error] [pid 544:tid 570] [client 209.87.169.144:25551] [client 209.87.169.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adXJhjieLKSoiLVA6YffzgAAAZU"]
[Wed Apr 08 11:20:38.870191 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.107:61279] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Wed Apr 08 11:20:39.081902 2026] [:error] [pid 47625:tid 47643] [client 45.131.195.107:61279] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adXJhyVuHyNWzZlE8PCXXgAAAAk"]
[Wed Apr 08 11:20:40.030381 2026] [:error] [pid 544:tid 569] [client 209.87.169.134:47427] [client 209.87.169.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adXJiDieLKSoiLVA6Yff0AAAAZQ"]
[Wed Apr 08 11:20:40.775571 2026] [:error] [pid 49984:tid 50013] [client 45.131.195.241:56065] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Apr 08 11:20:41.201219 2026] [:error] [pid 49984:tid 50008] [client 45.131.195.241:56065] [client 45.131.195.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adXJieYY_Bz5lRHcJIFRbQAAAVI"]
[Wed Apr 08 11:20:42.729603 2026] [:error] [pid 47625:tid 47643] [client 45.131.195.112:64635] [client 45.131.195.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adXJiiVuHyNWzZlE8PCXZwAAAAk"]
[Wed Apr 08 11:20:43.158740 2026] [:error] [pid 16630:tid 16650] [client 209.87.169.152:48415] [client 209.87.169.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adXJiyjfVAkPG-jgJEp_iAAAARI"]
[Wed Apr 08 11:20:43.618328 2026] [:error] [pid 47625:tid 47634] [client 209.87.169.136:57233] [client 209.87.169.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adXJiyVuHyNWzZlE8PCXaAAAAAA"]
[Wed Apr 08 11:20:44.322722 2026] [:error] [pid 16630:tid 16643] [client 45.131.195.117:30757] [client 45.131.195.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adXJjCjfVAkPG-jgJEp_jAAAAQs"]
[Wed Apr 08 11:20:45.634555 2026] [:error] [pid 47625:tid 47658] [client 185.198.240.185:30585] [client 185.198.240.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adXJjSVuHyNWzZlE8PCXbQAAABg"]
[Wed Apr 08 11:20:46.090471 2026] [:error] [pid 47625:tid 47639] [client 45.131.195.113:24623] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Apr 08 11:20:46.758577 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.113:24623] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Apr 08 11:20:46.979068 2026] [:error] [pid 47625:tid 47646] [client 45.131.195.113:24623] [client 45.131.195.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adXJjiVuHyNWzZlE8PCXdgAAAAw"]
[Wed Apr 08 11:20:49.351363 2026] [:error] [pid 47625:tid 47652] [client 209.87.169.148:45467] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Wed Apr 08 11:20:49.573906 2026] [:error] [pid 47625:tid 47657] [client 209.87.169.148:45467] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Wed Apr 08 11:20:50.774990 2026] [:error] [pid 47625:tid 47637] [client 209.87.169.148:45467] [client 209.87.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adXJkiVuHyNWzZlE8PCXgwAAAAM"]
[Wed Apr 08 11:20:52.358991 2026] [:error] [pid 47625:tid 47637] [client 45.131.195.133:49763] [client 45.131.195.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adXJlCVuHyNWzZlE8PCXkgAAAAM"]
[Wed Apr 08 11:20:53.976500 2026] [:error] [pid 16630:tid 16638] [client 209.87.169.131:25165] [client 209.87.169.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adXJlSjfVAkPG-jgJEp_nQAAAQY"]
[Wed Apr 08 11:20:55.847921 2026] [:error] [pid 16630:tid 16652] [client 45.131.195.107:51963] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adXJlyjfVAkPG-jgJEp_rgAAARQ"]
[Wed Apr 08 11:20:57.409058 2026] [:error] [pid 544:tid 560] [client 45.131.195.148:63411] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Apr 08 11:20:57.643971 2026] [:error] [pid 544:tid 556] [client 45.131.195.148:63411] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Wed Apr 08 11:20:57.860458 2026] [:error] [pid 544:tid 567] [client 45.131.195.148:63411] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Wed Apr 08 11:20:58.076841 2026] [:error] [pid 544:tid 552] [client 45.131.195.148:63411] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Wed Apr 08 11:20:59.424030 2026] [:error] [pid 544:tid 553] [client 45.131.195.148:63411] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adXJmzieLKSoiLVA6Yff4wAAAYQ"]
[Wed Apr 08 11:21:00.486976 2026] [:error] [pid 47626:tid 47678] [client 209.87.169.139:22417] [client 209.87.169.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adXJnKjWI8TWtHx2sdZftgAAAEo"]
[Wed Apr 08 11:21:01.012182 2026] [:error] [pid 47627:tid 47708] [client 185.198.240.185:62859] [client 185.198.240.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adXJnXOljf1Quv_kDjk2zgAAAIk"]
[Wed Apr 08 11:21:02.170126 2026] [:error] [pid 16630:tid 16643] [client 209.87.169.148:40245] [client 209.87.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adXJnijfVAkPG-jgJEp_ygAAAQs"]
[Wed Apr 08 11:21:03.180992 2026] [:error] [pid 47627:tid 47720] [client 209.87.169.151:27559] [client 209.87.169.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adXJn3Oljf1Quv_kDjk21gAAAJU"]
[Wed Apr 08 11:21:04.134873 2026] [:error] [pid 47627:tid 47701] [client 45.131.195.108:40451] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adXJoHOljf1Quv_kDjk23AAAAII"]
[Wed Apr 08 11:21:05.333001 2026] [:error] [pid 47627:tid 47703] [client 45.131.195.148:20567] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adXJoXOljf1Quv_kDjk24QAAAIQ"]
[Wed Apr 08 11:21:06.512024 2026] [:error] [pid 47627:tid 47721] [client 209.87.169.131:26109] [client 209.87.169.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adXJonOljf1Quv_kDjk24gAAAJY"]
[Wed Apr 08 11:21:07.666888 2026] [:error] [pid 16630:tid 16637] [client 209.87.169.150:54393] [client 209.87.169.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adXJoyjfVAkPG-jgJEp_1QAAAQU"]
[Wed Apr 08 11:21:08.458919 2026] [:error] [pid 47626:tid 47677] [client 209.87.169.142:61197] [client 209.87.169.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adXJpKjWI8TWtHx2sdZfvgAAAEk"]
[Wed Apr 08 11:21:10.021278 2026] [:error] [pid 47625:tid 47644] [client 209.87.169.150:60771] [client 209.87.169.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adXJpiVuHyNWzZlE8PCXwQAAAAo"]
[Wed Apr 08 11:21:11.551132 2026] [:error] [pid 49984:tid 50014] [client 209.87.169.142:48267] [client 209.87.169.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adXJp-YY_Bz5lRHcJIFRhQAAAVg"]
[Wed Apr 08 11:21:12.410227 2026] [:error] [pid 544:tid 552] [client 209.87.169.143:65059] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Wed Apr 08 11:21:12.932943 2026] [:error] [pid 544:tid 569] [client 209.87.169.143:65059] [client 209.87.169.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adXJqDieLKSoiLVA6Yff7QAAAZQ"]
[Wed Apr 08 11:21:14.262395 2026] [:error] [pid 49984:tid 49998] [client 209.87.169.132:59297] [client 209.87.169.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adXJquYY_Bz5lRHcJIFRkQAAAUg"]
[Wed Apr 08 11:21:15.291209 2026] [:error] [pid 49984:tid 50014] [client 209.87.169.141:54863] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Apr 08 11:21:15.500566 2026] [:error] [pid 49984:tid 50010] [client 209.87.169.141:54863] [client 209.87.169.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adXJq-YY_Bz5lRHcJIFRmQAAAVQ"]
[Wed Apr 08 11:21:16.274669 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.137:37061] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Apr 08 11:21:17.998553 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.137:37061] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Wed Apr 08 11:21:18.215754 2026] [:error] [pid 47625:tid 47642] [client 45.131.195.137:37061] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Apr 08 11:21:18.455816 2026] [:error] [pid 47625:tid 47648] [client 45.131.195.137:37061] [client 45.131.195.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adXJriVuHyNWzZlE8PCX2QAAAA4"]
[Wed Apr 08 11:21:19.459066 2026] [:error] [pid 47625:tid 47650] [client 45.131.195.117:48087] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Wed Apr 08 11:21:19.669788 2026] [:error] [pid 47625:tid 47651] [client 45.131.195.117:48087] [client 45.131.195.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adXJryVuHyNWzZlE8PCX3wAAABE"]
[Wed Apr 08 11:21:21.006153 2026] [:error] [pid 47625:tid 47640] [client 45.131.195.122:33625] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Apr 08 11:21:21.239392 2026] [:error] [pid 47625:tid 47657] [client 45.131.195.122:33625] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Apr 08 11:21:21.462898 2026] [:error] [pid 47625:tid 47638] [client 45.131.195.122:33625] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Wed Apr 08 11:21:22.723860 2026] [:error] [pid 47625:tid 47639] [client 45.131.195.122:33625] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Apr 08 11:21:22.941683 2026] [:error] [pid 47625:tid 47654] [client 45.131.195.122:33625] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Wed Apr 08 11:21:23.379956 2026] [:error] [pid 47625:tid 47634] [client 45.131.195.122:33625] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Wed Apr 08 11:21:24.045822 2026] [:error] [pid 47625:tid 47650] [client 45.131.195.122:33625] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Apr 08 11:21:24.259199 2026] [:error] [pid 47625:tid 47641] [client 45.131.195.122:33625] [client 45.131.195.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adXJtCVuHyNWzZlE8PCYBgAAAAc"]
[Wed Apr 08 11:21:25.247125 2026] [:error] [pid 47627:tid 47712] [client 209.87.169.139:32759] [client 209.87.169.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adXJtXOljf1Quv_kDjk3IAAAAI0"]
[Wed Apr 08 11:21:26.336888 2026] [:error] [pid 47627:tid 47707] [client 209.87.169.155:28733] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Wed Apr 08 11:21:26.547282 2026] [:error] [pid 47627:tid 47701] [client 209.87.169.155:28733] [client 209.87.169.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adXJtnOljf1Quv_kDjk3IwAAAII"]
[Wed Apr 08 11:21:27.772809 2026] [:error] [pid 47732:tid 47734] [client 209.87.169.135:34609] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 08 11:21:27.994464 2026] [:error] [pid 47732:tid 47754] [client 209.87.169.135:34609] [client 209.87.169.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adXJt4m4N5QW9Mh7G13hQgAAANQ"]
[Wed Apr 08 11:21:28.737110 2026] [:error] [pid 16630:tid 16634] [client 45.131.195.147:55931] [client 45.131.195.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adXJuCjfVAkPG-jgJEqAEwAAAQI"]
[Wed Apr 08 11:21:30.692928 2026] [:error] [pid 47627:tid 47699] [client 209.87.169.149:51943] [client 209.87.169.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adXJunOljf1Quv_kDjk3SAAAAIA"]
[Wed Apr 08 11:21:31.503026 2026] [:error] [pid 47625:tid 47652] [client 209.87.169.141:27027] [client 209.87.169.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "adXJuyVuHyNWzZlE8PCYDwAAABI"]
[Wed Apr 08 11:21:32.968967 2026] [:error] [pid 47625:tid 47657] [client 209.87.169.150:39739] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Apr 08 11:21:33.399471 2026] [:error] [pid 47625:tid 47649] [client 209.87.169.150:39739] [client 209.87.169.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adXJvSVuHyNWzZlE8PCYGAAAAA8"]
[Wed Apr 08 11:21:34.351760 2026] [:error] [pid 47627:tid 47714] [client 209.87.169.155:45927] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Wed Apr 08 11:21:34.785934 2026] [:error] [pid 47627:tid 47719] [client 209.87.169.155:45927] [client 209.87.169.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "adXJvnOljf1Quv_kDjk3ZwAAAJQ"]
[Wed Apr 08 11:21:35.460541 2026] [:error] [pid 47732:tid 47738] [client 209.87.169.130:39907] [client 209.87.169.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adXJv4m4N5QW9Mh7G13hSwAAAMQ"]
[Wed Apr 08 11:21:36.494260 2026] [:error] [pid 47625:tid 47651] [client 45.131.195.113:46425] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Apr 08 11:21:36.735681 2026] [:error] [pid 47625:tid 47650] [client 45.131.195.113:46425] [client 45.131.195.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adXJwCVuHyNWzZlE8PCYJwAAABA"]
[Wed Apr 08 11:21:37.520004 2026] [:error] [pid 47625:tid 47654] [client 209.87.169.128:39823] [client 209.87.169.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adXJwSVuHyNWzZlE8PCYLQAAABQ"]
[Wed Apr 08 11:21:39.006271 2026] [:error] [pid 47625:tid 47644] [client 209.87.169.146:60963] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Wed Apr 08 11:21:39.305453 2026] [:error] [pid 47625:tid 47646] [client 209.87.169.146:60963] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Wed Apr 08 11:21:39.768577 2026] [:error] [pid 47625:tid 47654] [client 209.87.169.146:60963] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Wed Apr 08 11:21:40.283380 2026] [:error] [pid 47625:tid 47649] [client 209.87.169.146:60963] [client 209.87.169.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adXJxCVuHyNWzZlE8PCYQAAAAA8"]
[Wed Apr 08 11:21:41.039982 2026] [:error] [pid 49984:tid 50006] [client 209.87.169.140:29989] [client 209.87.169.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adXJxeYY_Bz5lRHcJIFRpgAAAVA"]
[Wed Apr 08 11:21:42.710013 2026] [:error] [pid 47627:tid 47719] [client 45.131.195.148:59005] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Apr 08 11:21:42.922049 2026] [:error] [pid 47627:tid 47709] [client 45.131.195.148:59005] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "adXJxnOljf1Quv_kDjk3lAAAAIo"]
[Wed Apr 08 11:21:43.854990 2026] [:error] [pid 47627:tid 47722] [client 209.87.169.151:55581] [client 209.87.169.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adXJx3Oljf1Quv_kDjk3mQAAAJc"]
[Wed Apr 08 11:21:45.867724 2026] [:error] [pid 47625:tid 47648] [client 185.198.240.185:56561] [client 185.198.240.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adXJySVuHyNWzZlE8PCYVAAAAA4"]
[Wed Apr 08 11:21:47.537374 2026] [:error] [pid 47627:tid 47721] [client 45.131.195.147:30793] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Wed Apr 08 11:21:47.770802 2026] [:error] [pid 47627:tid 47718] [client 45.131.195.147:30793] [client 45.131.195.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adXJy3Oljf1Quv_kDjk3uQAAAJM"]
[Wed Apr 08 11:21:48.778434 2026] [:error] [pid 47626:tid 47670] [client 209.87.169.130:50667] [client 209.87.169.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adXJzKjWI8TWtHx2sdZf3QAAAEI"]
[Wed Apr 08 11:21:49.416950 2026] [:error] [pid 47626:tid 47676] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Apr 08 11:21:49.631290 2026] [:error] [pid 47626:tid 47678] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Wed Apr 08 11:21:50.092078 2026] [:error] [pid 47626:tid 47680] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Wed Apr 08 11:21:52.486201 2026] [:error] [pid 47626:tid 47674] [client 209.87.169.147:51159] [client 209.87.169.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "adXJ0KjWI8TWtHx2sdZf6QAAAEY"]
[Wed Apr 08 11:21:53.089298 2026] [:error] [pid 47626:tid 47677] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Wed Apr 08 11:21:53.347121 2026] [:error] [pid 47626:tid 47673] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Wed Apr 08 11:21:53.594792 2026] [:error] [pid 47626:tid 47672] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Wed Apr 08 11:21:54.019309 2026] [:error] [pid 47626:tid 47688] [client 209.87.169.147:51159] [client 209.87.169.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.147, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adXJ0qjWI8TWtHx2sdZf8AAAAFQ"]
[Wed Apr 08 11:21:54.679215 2026] [:error] [pid 47626:tid 47685] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Wed Apr 08 11:21:54.945693 2026] [:error] [pid 47626:tid 47676] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Wed Apr 08 11:21:55.389096 2026] [:error] [pid 47626:tid 47686] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Wed Apr 08 11:21:55.834063 2026] [:error] [pid 47626:tid 47691] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Apr 08 11:21:56.496060 2026] [:error] [pid 47626:tid 47684] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Wed Apr 08 11:21:58.118174 2026] [:error] [pid 47626:tid 47677] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Apr 08 11:21:58.339563 2026] [:error] [pid 47626:tid 47673] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Wed Apr 08 11:21:59.448285 2026] [:error] [pid 47626:tid 47681] [client 209.87.169.147:51159] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Apr 08 11:22:02.297371 2026] [:error] [pid 47626:tid 47688] [client 209.87.169.147:51159] [client 209.87.169.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adXJ2qjWI8TWtHx2sdZgCgAAAFQ"]
[Wed Apr 08 11:22:03.635174 2026] [:error] [pid 49984:tid 50013] [client 45.131.195.107:23757] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Apr 08 11:22:03.858133 2026] [:error] [pid 49984:tid 50001] [client 45.131.195.107:23757] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adXJ2-YY_Bz5lRHcJIFRtgAAAUs"]
[Wed Apr 08 11:22:05.076916 2026] [:error] [pid 16630:tid 16632] [client 209.87.169.139:27321] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Wed Apr 08 11:22:05.296250 2026] [:error] [pid 16630:tid 16652] [client 209.87.169.139:27321] [client 209.87.169.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adXJ3SjfVAkPG-jgJEqAPQAAARQ"]
[Wed Apr 08 11:22:06.219438 2026] [:error] [pid 544:tid 571] [client 45.131.195.132:49159] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Wed Apr 08 11:22:06.864107 2026] [:error] [pid 544:tid 566] [client 45.131.195.132:49159] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Wed Apr 08 11:22:07.304709 2026] [:error] [pid 544:tid 559] [client 45.131.195.132:49159] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Wed Apr 08 11:22:07.572205 2026] [:error] [pid 544:tid 550] [client 45.131.195.132:49159] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Wed Apr 08 11:22:08.014759 2026] [:error] [pid 544:tid 564] [client 45.131.195.132:49159] [client 45.131.195.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adXJ4DieLKSoiLVA6YfgaAAAAY8"]
[Wed Apr 08 11:22:08.486210 2026] [:error] [pid 47627:tid 47716] [client 45.131.195.127:52517] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Wed Apr 08 11:22:08.703076 2026] [:error] [pid 47627:tid 47699] [client 45.131.195.127:52517] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Wed Apr 08 11:22:09.041687 2026] [:error] [pid 47627:tid 47702] [client 45.131.195.127:52517] [client 45.131.195.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adXJ4XOljf1Quv_kDjk39wAAAIM"]
[Wed Apr 08 11:22:09.732950 2026] [:error] [pid 47626:tid 47675] [client 45.131.195.108:30253] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adXJ4ajWI8TWtHx2sdZgEgAAAEc"]
[Wed Apr 08 11:22:10.616422 2026] [:error] [pid 47732:tid 47749] [client 45.131.195.133:31371] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Apr 08 11:22:11.293827 2026] [:error] [pid 47732:tid 47736] [client 45.131.195.133:31371] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Wed Apr 08 11:22:11.563414 2026] [:error] [pid 47732:tid 47738] [client 45.131.195.133:31371] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Wed Apr 08 11:22:11.788724 2026] [:error] [pid 47732:tid 47746] [client 45.131.195.133:31371] [client 45.131.195.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adXJ44m4N5QW9Mh7G13heAAAAMw"]
[Wed Apr 08 11:22:12.404271 2026] [:error] [pid 47627:tid 47716] [client 209.87.169.144:20901] [client 209.87.169.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adXJ5HOljf1Quv_kDjk4AAAAAJE"]
[Wed Apr 08 11:22:21.150978 2026] [:error] [pid 16630:tid 16634] [client 209.87.169.148:42773] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Wed Apr 08 11:22:21.617675 2026] [:error] [pid 16630:tid 16643] [client 209.87.169.148:42773] [client 209.87.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adXJ7SjfVAkPG-jgJEqAfgAAAQs"]
[Wed Apr 08 11:22:22.864873 2026] [:error] [pid 16630:tid 16645] [client 209.87.169.137:56831] [client 209.87.169.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "adXJ7ijfVAkPG-jgJEqAhQAAAQ0"]
[Wed Apr 08 11:22:23.953912 2026] [:error] [pid 47625:tid 47648] [client 45.131.195.108:48379] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Apr 08 11:22:24.190711 2026] [:error] [pid 47625:tid 47653] [client 45.131.195.108:48379] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Wed Apr 08 11:22:24.405442 2026] [:error] [pid 47625:tid 47650] [client 45.131.195.108:48379] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adXJ8CVuHyNWzZlE8PCYtQAAABA"]
[Wed Apr 08 11:22:25.415822 2026] [:error] [pid 16630:tid 16633] [client 209.87.169.133:35857] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Wed Apr 08 11:22:25.648896 2026] [:error] [pid 16630:tid 16635] [client 209.87.169.133:35857] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Wed Apr 08 11:22:26.098978 2026] [:error] [pid 16630:tid 16654] [client 209.87.169.133:35857] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Wed Apr 08 11:22:26.878336 2026] [:error] [pid 16630:tid 16647] [client 209.87.169.133:35857] [client 209.87.169.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adXJ8ijfVAkPG-jgJEqAnQAAAQ8"]
[Wed Apr 08 11:22:27.334748 2026] [:error] [pid 47625:tid 47658] [client 209.87.169.140:61441] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Wed Apr 08 11:22:28.207535 2026] [:error] [pid 47625:tid 47640] [client 209.87.169.140:61441] [client 209.87.169.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adXJ9CVuHyNWzZlE8PCY0wAAAAY"]
[Wed Apr 08 11:22:29.213692 2026] [:error] [pid 16630:tid 16639] [client 45.131.195.137:40619] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Wed Apr 08 11:22:29.888700 2026] [:error] [pid 16630:tid 16637] [client 45.131.195.137:40619] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Wed Apr 08 11:22:30.107944 2026] [:error] [pid 16630:tid 16642] [client 45.131.195.137:40619] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Wed Apr 08 11:22:30.548587 2026] [:error] [pid 16630:tid 16645] [client 45.131.195.137:40619] [client 45.131.195.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.137, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adXJ9ijfVAkPG-jgJEqAsAAAAQ0"]
[Wed Apr 08 11:22:31.708992 2026] [:error] [pid 16630:tid 16656] [client 45.131.195.137:40619] [client 45.131.195.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adXJ9yjfVAkPG-jgJEqAtgAAARg"]
[Wed Apr 08 11:22:33.032331 2026] [:error] [pid 47625:tid 47657] [client 209.87.169.133:47065] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Wed Apr 08 11:22:33.292101 2026] [:error] [pid 47625:tid 47653] [client 209.87.169.133:47065] [client 209.87.169.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adXJ-SVuHyNWzZlE8PCY-AAAABM"]
[Wed Apr 08 11:22:34.727099 2026] [:error] [pid 16630:tid 16651] [client 209.87.169.153:44323] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Wed Apr 08 11:22:35.189566 2026] [:error] [pid 16630:tid 16642] [client 209.87.169.153:44323] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Wed Apr 08 11:22:35.764459 2026] [:error] [pid 16630:tid 16649] [client 209.87.169.153:44323] [client 209.87.169.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adXJ-yjfVAkPG-jgJEqAwgAAARE"]
[Wed Apr 08 11:22:36.843647 2026] [:error] [pid 47625:tid 47648] [client 45.131.195.147:44407] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Wed Apr 08 11:22:37.085343 2026] [:error] [pid 47625:tid 47644] [client 45.131.195.147:44407] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Wed Apr 08 11:22:37.308711 2026] [:error] [pid 47625:tid 47647] [client 45.131.195.147:44407] [client 45.131.195.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adXJ_SVuHyNWzZlE8PCZEwAAAA0"]
[Wed Apr 08 11:22:38.305155 2026] [:error] [pid 49984:tid 50010] [client 45.131.195.138:45873] [client 45.131.195.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adXJ_uYY_Bz5lRHcJIFSCQAAAVQ"]
[Wed Apr 08 11:22:39.292825 2026] [:error] [pid 544:tid 561] [client 45.131.195.128:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Wed Apr 08 11:22:39.509955 2026] [:error] [pid 544:tid 566] [client 45.131.195.128:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Wed Apr 08 11:22:39.952105 2026] [:error] [pid 544:tid 552] [client 45.131.195.128:22717] [client 45.131.195.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adXJ_zieLKSoiLVA6Yfg2wAAAYM"]
[Wed Apr 08 11:22:40.932614 2026] [:error] [pid 49984:tid 49999] [client 209.87.169.140:48333] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Wed Apr 08 11:22:41.361737 2026] [:error] [pid 49984:tid 49996] [client 209.87.169.140:48333] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Wed Apr 08 11:22:41.596486 2026] [:error] [pid 49984:tid 49995] [client 209.87.169.140:48333] [client 209.87.169.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adXKAeYY_Bz5lRHcJIFSEwAAAUU"]
[Wed Apr 08 11:22:42.749594 2026] [:error] [pid 47625:tid 47648] [client 45.131.195.107:45375] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "adXKAiVuHyNWzZlE8PCZPAAAAA4"]
[Wed Apr 08 11:22:50.979685 2026] [:error] [pid 16630:tid 16638] [client 45.131.195.107:20013] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adXKCijfVAkPG-jgJEqA8QAAAQY"]
[Wed Apr 08 11:22:51.952588 2026] [:error] [pid 16630:tid 16633] [client 45.131.195.127:43403] [client 45.131.195.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adXKCyjfVAkPG-jgJEqA9QAAAQE"]
[Wed Apr 08 11:22:52.982518 2026] [:error] [pid 47627:tid 47708] [client 209.87.169.144:64701] [client 209.87.169.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adXKDHOljf1Quv_kDjk4_gAAAIk"]
[Wed Apr 08 11:22:54.061918 2026] [:error] [pid 16630:tid 16651] [client 45.131.195.142:52915] [client 45.131.195.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adXKDijfVAkPG-jgJEqA-wAAARM"]
[Wed Apr 08 11:22:55.029432 2026] [:error] [pid 47627:tid 47709] [client 209.87.169.139:41095] [client 209.87.169.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adXKD3Oljf1Quv_kDjk5CwAAAIo"]
[Wed Apr 08 11:22:56.404003 2026] [:error] [pid 47732:tid 47748] [client 209.87.169.133:23699] [client 209.87.169.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adXKEIm4N5QW9Mh7G13iHwAAAM4"]
[Wed Apr 08 11:22:57.369930 2026] [:error] [pid 47627:tid 47713] [client 209.87.169.142:49753] [client 209.87.169.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adXKEXOljf1Quv_kDjk5IQAAAI4"]
[Wed Apr 08 11:22:58.340578 2026] [:error] [pid 47625:tid 47644] [client 45.131.195.148:22927] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adXKEiVuHyNWzZlE8PCZigAAAAo"]
[Wed Apr 08 11:22:59.315441 2026] [:error] [pid 16630:tid 16651] [client 45.131.195.108:49431] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adXKEyjfVAkPG-jgJEqBDAAAARM"]
[Wed Apr 08 11:23:00.148829 2026] [:error] [pid 16630:tid 16648] [client 209.87.169.153:45007] [client 209.87.169.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adXKFCjfVAkPG-jgJEqBEQAAARA"]
[Wed Apr 08 11:23:01.361713 2026] [:error] [pid 16630:tid 16640] [client 45.131.195.113:44177] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Wed Apr 08 11:23:02.041530 2026] [:error] [pid 16630:tid 16646] [client 45.131.195.113:44177] [client 45.131.195.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.113, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adXKFijfVAkPG-jgJEqBNAAAAQ4"]
[Wed Apr 08 11:23:03.206708 2026] [:error] [pid 16630:tid 16635] [client 45.131.195.113:44177] [client 45.131.195.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adXKFyjfVAkPG-jgJEqBPgAAAQM"]
[Wed Apr 08 11:23:04.583888 2026] [:error] [pid 16630:tid 16639] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Wed Apr 08 11:23:04.811790 2026] [:error] [pid 16630:tid 16646] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Wed Apr 08 11:23:05.729357 2026] [:error] [pid 16630:tid 16643] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Wed Apr 08 11:23:06.038081 2026] [:error] [pid 16630:tid 16645] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Wed Apr 08 11:23:07.052172 2026] [:error] [pid 16630:tid 16635] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Wed Apr 08 11:23:08.310666 2026] [:error] [pid 16630:tid 16635] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Wed Apr 08 11:23:08.539108 2026] [:error] [pid 16630:tid 16656] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Wed Apr 08 11:23:08.768767 2026] [:error] [pid 16630:tid 16646] [client 45.131.195.241:62503] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Wed Apr 08 11:23:09.004180 2026] [:error] [pid 16630:tid 16642] [client 45.131.195.241:62503] [client 45.131.195.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adXKHSjfVAkPG-jgJEqBXAAAAQo"]
[Wed Apr 08 11:23:10.001454 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.132:22261] [client 45.131.195.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adXKHiVuHyNWzZlE8PCZrAAAAAE"]
[Wed Apr 08 11:23:10.938267 2026] [:error] [pid 16630:tid 16635] [client 209.87.169.135:55979] [client 209.87.169.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adXKHijfVAkPG-jgJEqBYwAAAQM"]
[Wed Apr 08 11:23:12.165354 2026] [:error] [pid 47625:tid 47651] [client 209.87.169.137:45103] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Wed Apr 08 11:23:12.391093 2026] [:error] [pid 47625:tid 47652] [client 209.87.169.137:45103] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Wed Apr 08 11:23:12.879519 2026] [:error] [pid 47625:tid 47641] [client 209.87.169.137:45103] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Wed Apr 08 11:23:13.340536 2026] [:error] [pid 47625:tid 47638] [client 209.87.169.137:45103] [client 209.87.169.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adXKISVuHyNWzZlE8PCZvgAAAAQ"]
[Wed Apr 08 11:23:14.434522 2026] [:error] [pid 47625:tid 47638] [client 45.131.195.117:23899] [client 45.131.195.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adXKIiVuHyNWzZlE8PCZywAAAAQ"]
[Wed Apr 08 11:23:15.456633 2026] [:error] [pid 47732:tid 47748] [client 209.87.169.149:38761] [client 209.87.169.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adXKI4m4N5QW9Mh7G13iQQAAAM4"]
[Wed Apr 08 11:23:17.469388 2026] [:error] [pid 544:tid 554] [client 45.131.195.108:24773] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adXKJTieLKSoiLVA6YfhJwAAAYU"]
[Wed Apr 08 11:23:18.778119 2026] [:error] [pid 16630:tid 16636] [client 209.87.169.127:27029] [client 209.87.169.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adXKJijfVAkPG-jgJEqBdAAAAQQ"]
[Wed Apr 08 11:23:20.254758 2026] [:error] [pid 47732:tid 47750] [client 209.87.169.142:36959] [client 209.87.169.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adXKKIm4N5QW9Mh7G13iTQAAANA"]
[Wed Apr 08 11:23:25.289936 2026] [:error] [pid 47627:tid 47720] [client 209.87.169.148:20601] [client 209.87.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adXKLXOljf1Quv_kDjk5iAAAAJU"]
[Wed Apr 08 11:23:26.336767 2026] [:error] [pid 47625:tid 47641] [client 209.87.169.139:39249] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Wed Apr 08 11:23:26.551230 2026] [:error] [pid 47625:tid 47636] [client 209.87.169.139:39249] [client 209.87.169.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "adXKLiVuHyNWzZlE8PCaDgAAAAI"]
[Wed Apr 08 11:23:28.147071 2026] [:error] [pid 47627:tid 47712] [client 209.87.169.146:60423] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Wed Apr 08 11:23:28.849452 2026] [:error] [pid 47627:tid 47700] [client 209.87.169.146:60423] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Apr 08 11:23:29.087959 2026] [:error] [pid 47627:tid 47713] [client 209.87.169.146:60423] [client 209.87.169.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "adXKMXOljf1Quv_kDjk5oQAAAI4"]
[Wed Apr 08 11:23:31.641848 2026] [:error] [pid 47625:tid 47656] [client 209.87.169.126:31533] [client 209.87.169.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adXKMyVuHyNWzZlE8PCaVgAAABY"]
[Wed Apr 08 11:23:34.733762 2026] [:error] [pid 47732:tid 47743] [client 45.131.195.148:44847] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adXKNom4N5QW9Mh7G13ifwAAAMk"]
[Wed Apr 08 11:23:36.918586 2026] [:error] [pid 47627:tid 47702] [client 209.87.169.131:63807] [client 209.87.169.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adXKOHOljf1Quv_kDjk5uQAAAIM"]
[Wed Apr 08 11:23:38.090009 2026] [:error] [pid 47625:tid 47648] [client 209.87.169.142:40843] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Apr 08 11:23:38.353819 2026] [:error] [pid 47625:tid 47642] [client 209.87.169.142:40843] [client 209.87.169.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adXKOiVuHyNWzZlE8PCacAAAAAg"]
[Wed Apr 08 11:23:39.319757 2026] [:error] [pid 544:tid 568] [client 209.87.169.151:52081] [client 209.87.169.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adXKOzieLKSoiLVA6YfhcgAAAZM"]
[Wed Apr 08 11:23:41.568973 2026] [:error] [pid 47626:tid 47668] [client 209.87.169.153:59315] [client 209.87.169.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adXKPajWI8TWtHx2sdZgvAAAAEA"]
[Wed Apr 08 11:23:42.557281 2026] [:error] [pid 47625:tid 47642] [client 209.87.169.127:22805] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Wed Apr 08 11:23:43.530916 2026] [:error] [pid 47625:tid 47657] [client 209.87.169.127:22805] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Wed Apr 08 11:23:43.737931 2026] [:error] [pid 47625:tid 47652] [client 209.87.169.127:22805] [client 209.87.169.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adXKPyVuHyNWzZlE8PCajgAAABI"]
[Wed Apr 08 11:23:45.268729 2026] [:error] [pid 16630:tid 16646] [client 45.131.195.108:43411] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Wed Apr 08 11:23:45.811870 2026] [:error] [pid 16630:tid 16643] [client 45.131.195.108:43411] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adXKQSjfVAkPG-jgJEqBugAAAQs"]
[Wed Apr 08 11:23:46.813455 2026] [:error] [pid 47627:tid 47717] [client 45.131.195.107:53519] [client 45.131.195.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adXKQnOljf1Quv_kDjk6BgAAAJI"]
[Wed Apr 08 11:23:47.996038 2026] [:error] [pid 47732:tid 47747] [client 45.131.195.128:62809] [client 45.131.195.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adXKQ4m4N5QW9Mh7G13irQAAAM0"]
[Wed Apr 08 11:23:49.611598 2026] [:error] [pid 47627:tid 47715] [client 45.131.195.240:64463] [client 45.131.195.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "adXKRXOljf1Quv_kDjk6GgAAAJA"]
[Wed Apr 08 11:23:50.604143 2026] [:error] [pid 47627:tid 47713] [client 45.131.195.148:61603] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adXKRnOljf1Quv_kDjk6HQAAAI4"]
[Wed Apr 08 11:23:51.866518 2026] [:error] [pid 47626:tid 47690] [client 45.131.195.240:22765] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Wed Apr 08 11:23:53.125688 2026] [:error] [pid 47626:tid 47677] [client 45.131.195.240:22765] [client 45.131.195.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "adXKSajWI8TWtHx2sdZg6wAAAEk"]
[Wed Apr 08 11:23:54.607250 2026] [:error] [pid 16630:tid 16633] [client 209.87.169.153:29123] [client 209.87.169.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "adXKSijfVAkPG-jgJEqB7AAAAQE"]
[Wed Apr 08 11:23:55.621874 2026] [:error] [pid 49984:tid 50008] [client 209.87.169.135:39965] [client 209.87.169.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "adXKS-YY_Bz5lRHcJIFS1AAAAVI"]
[Wed Apr 08 11:23:56.805723 2026] [:error] [pid 49984:tid 50009] [client 209.87.169.130:30023] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Wed Apr 08 11:23:57.246638 2026] [:error] [pid 49984:tid 49998] [client 209.87.169.130:30023] [client 209.87.169.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adXKTeYY_Bz5lRHcJIFS4AAAAUg"]
[Wed Apr 08 11:23:58.354462 2026] [:error] [pid 16630:tid 16638] [client 209.87.169.137:30665] [client 209.87.169.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adXKTijfVAkPG-jgJEqCBQAAAQY"]
[Wed Apr 08 11:24:00.688537 2026] [:error] [pid 47626:tid 47689] [client 209.87.169.145:46585] [client 209.87.169.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adXKUKjWI8TWtHx2sdZg9QAAAFU"]
[Wed Apr 08 11:24:02.052518 2026] [:error] [pid 47627:tid 47709] [client 209.87.169.141:51471] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Wed Apr 08 11:24:02.272758 2026] [:error] [pid 47627:tid 47722] [client 209.87.169.141:51471] [client 209.87.169.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adXKUnOljf1Quv_kDjk6WgAAAJc"]
[Wed Apr 08 11:24:03.801175 2026] [:error] [pid 47625:tid 47655] [client 209.87.169.153:32839] [client 209.87.169.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adXKUyVuHyNWzZlE8PCa5AAAABU"]
[Wed Apr 08 11:24:05.178109 2026] [:error] [pid 47732:tid 47749] [client 209.87.169.141:41993] [client 209.87.169.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "adXKVYm4N5QW9Mh7G13i3wAAAM8"]
[Wed Apr 08 11:24:06.506170 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.143:56477] [client 45.131.195.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adXKViVuHyNWzZlE8PCa_gAAAAE"]
[Wed Apr 08 11:24:07.518745 2026] [:error] [pid 544:tid 556] [client 209.87.169.136:22805] [client 209.87.169.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "adXKVzieLKSoiLVA6YfhoAAAAYc"]
[Wed Apr 08 11:24:08.553677 2026] [:error] [pid 544:tid 564] [client 209.87.169.150:20373] [client 209.87.169.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "adXKWDieLKSoiLVA6YfhqgAAAY8"]
[Wed Apr 08 11:24:11.124008 2026] [:error] [pid 544:tid 561] [client 45.131.195.148:32211] [client 45.131.195.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adXKWzieLKSoiLVA6YfhuAAAAYw"]
[Wed Apr 08 11:24:12.764333 2026] [:error] [pid 47626:tid 47681] [client 45.131.195.142:42675] [client 45.131.195.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "adXKXKjWI8TWtHx2sdZhAgAAAE0"]
[Wed Apr 08 11:24:13.792644 2026] [:error] [pid 47625:tid 47643] [client 45.131.195.123:38613] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Apr 08 11:24:14.021043 2026] [:error] [pid 47625:tid 47653] [client 45.131.195.123:38613] [client 45.131.195.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "adXKXiVuHyNWzZlE8PCbJAAAABM"]
[Wed Apr 08 11:24:15.462527 2026] [:error] [pid 47625:tid 47638] [client 45.131.195.108:22559] [client 45.131.195.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "adXKXyVuHyNWzZlE8PCbKAAAAAQ"]
[Wed Apr 08 11:24:18.228851 2026] [:error] [pid 47625:tid 47635] [client 45.131.195.128:50277] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Wed Apr 08 11:24:19.426931 2026] [:error] [pid 47625:tid 47643] [client 45.131.195.128:50277] [client 45.131.195.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adXKYyVuHyNWzZlE8PCbRgAAAAk"]
[Wed Apr 08 11:24:20.765709 2026] [:error] [pid 47625:tid 47637] [client 209.87.169.135:61739] [client 209.87.169.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adXKZCVuHyNWzZlE8PCbVwAAAAM"]
[Wed Apr 08 11:24:22.237338 2026] [:error] [pid 49984:tid 49997] [client 209.87.169.149:49165] [client 209.87.169.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adXKZuYY_Bz5lRHcJIFS9AAAAUc"]
[Wed Apr 08 11:24:23.694416 2026] [:error] [pid 47625:tid 47639] [client 209.87.169.138:40371] [client 209.87.169.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adXKZyVuHyNWzZlE8PCbagAAAAU"]
[Wed Apr 08 11:24:26.610865 2026] [:error] [pid 47627:tid 47704] [client 45.131.195.143:63897] [client 45.131.195.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adXKanOljf1Quv_kDjk6nwAAAIU"]
[Wed Apr 08 11:24:27.649031 2026] [:error] [pid 49984:tid 50001] [client 45.131.195.117:35357] [client 45.131.195.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adXKa-YY_Bz5lRHcJIFS-wAAAUs"]
[Wed Apr 08 11:24:30.017997 2026] [:error] [pid 47625:tid 47644] [client 209.87.169.148:36869] [client 209.87.169.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adXKbiVuHyNWzZlE8PCblAAAAAo"]
[Wed Apr 08 11:24:30.931750 2026] [:error] [pid 47625:tid 47655] [client 45.131.195.132:48415] [client 45.131.195.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adXKbiVuHyNWzZlE8PCblgAAABU"]
[Wed Apr 08 11:25:14.435634 2026] [autoindex:error] [pid 47627:tid 47703] [client 45.131.195.241:35429] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 13:04:12.652739 2026] [:error] [pid 12453:tid 12466] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 08 13:04:12.981899 2026] [:error] [pid 12453:tid 12455] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Apr 08 13:04:13.308047 2026] [:error] [pid 12453:tid 12462] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Apr 08 13:04:13.645325 2026] [:error] [pid 12453:tid 12465] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 08 13:04:13.960937 2026] [:error] [pid 12453:tid 12472] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 08 13:04:14.287035 2026] [:error] [pid 12453:tid 12474] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 08 13:04:14.632783 2026] [:error] [pid 12453:tid 12476] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 08 13:04:14.987551 2026] [:error] [pid 12453:tid 12466] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Apr 08 13:04:15.656774 2026] [:error] [pid 12453:tid 12475] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Apr 08 13:04:15.992411 2026] [:error] [pid 12453:tid 12462] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Apr 08 13:04:16.321792 2026] [:error] [pid 12453:tid 12456] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 13:04:16.671391 2026] [:error] [pid 12453:tid 12474] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Apr 08 13:04:16.983692 2026] [:error] [pid 12453:tid 12458] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 08 13:04:17.299510 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Apr 08 13:04:17.635979 2026] [:error] [pid 12453:tid 12468] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Apr 08 13:04:17.968888 2026] [:error] [pid 12453:tid 12457] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 08 13:04:18.300551 2026] [:error] [pid 12453:tid 12462] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Apr 08 13:04:18.628806 2026] [:error] [pid 12453:tid 12479] [client 193.19.207.87:36316] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 08 13:04:24.631844 2026] [:error] [pid 12453:tid 12476] [client 193.19.207.87:36316] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adXh2BjtW7S6XsLPvrT-tQAAAJU"]
[Wed Apr 08 13:04:26.237523 2026] [:error] [pid 12385:tid 12412] [client 193.19.207.87:60044] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adXh2iAjtvRQEkLosq3vQgAAABc"]
[Wed Apr 08 13:04:27.886119 2026] [:error] [pid 12490:tid 12512] [client 193.19.207.87:60052] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 08 13:04:28.871576 2026] [:error] [pid 12490:tid 12493] [client 193.19.207.87:60052] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adXh3G1Fea4F4fbumr058QAAAME"]
[Wed Apr 08 13:04:30.207445 2026] [:error] [pid 12490:tid 12506] [client 193.19.207.87:37320] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Apr 08 13:04:30.517148 2026] [:error] [pid 12490:tid 12508] [client 193.19.207.87:37320] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adXh3m1Fea4F4fbumr05-wAAANA"]
[Wed Apr 08 13:04:31.529487 2026] [:error] [pid 12386:tid 12420] [client 193.19.207.87:28187] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Apr 08 13:04:33.208155 2026] [:error] [pid 12386:tid 12425] [client 193.19.207.87:28187] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adXh4RLhhLtqHi2gK7U7OwAAAQk"]
[Wed Apr 08 13:04:34.161500 2026] [:error] [pid 12385:tid 12390] [client 193.19.207.87:37348] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adXh4iAjtvRQEkLosq3vSwAAAAE"]
[Wed Apr 08 13:04:34.834572 2026] [:error] [pid 12490:tid 12498] [client 193.19.207.87:37362] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adXh4m1Fea4F4fbumr06AgAAAMY"]
[Wed Apr 08 13:04:35.462025 2026] [:error] [pid 12490:tid 12505] [client 193.19.207.87:37366] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adXh421Fea4F4fbumr06AwAAAM0"]
[Wed Apr 08 13:04:36.127435 2026] [:error] [pid 12490:tid 12511] [client 193.19.207.87:37380] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adXh5G1Fea4F4fbumr06BgAAANM"]
[Wed Apr 08 13:04:36.778468 2026] [:error] [pid 12386:tid 12431] [client 193.19.207.87:14538] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adXh5BLhhLtqHi2gK7U7QwAAAQ8"]
[Wed Apr 08 13:04:37.777929 2026] [:error] [pid 12490:tid 12498] [client 193.19.207.87:61349] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adXh5W1Fea4F4fbumr06DAAAAMY"]
[Wed Apr 08 13:04:38.468404 2026] [:error] [pid 12490:tid 12507] [client 193.19.207.87:58074] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Apr 08 13:04:39.459215 2026] [:error] [pid 12490:tid 12511] [client 193.19.207.87:58074] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "adXh521Fea4F4fbumr06EwAAANM"]
[Wed Apr 08 13:04:40.753038 2026] [:error] [pid 12490:tid 12492] [client 193.19.207.87:58084] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adXh6G1Fea4F4fbumr06GAAAAMA"]
[Wed Apr 08 13:04:42.961599 2026] [:error] [pid 12386:tid 12436] [client 193.19.207.87:58088] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adXh6hLhhLtqHi2gK7U7UwAAARQ"]
[Wed Apr 08 13:04:43.629286 2026] [:error] [pid 12385:tid 12412] [client 193.19.207.87:58090] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Apr 08 13:04:43.975492 2026] [:error] [pid 12385:tid 12405] [client 193.19.207.87:58090] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adXh6yAjtvRQEkLosq3vVAAAABA"]
[Wed Apr 08 13:04:44.662220 2026] [:error] [pid 12385:tid 12403] [client 193.19.207.87:58104] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Apr 08 13:04:45.662418 2026] [:error] [pid 12385:tid 12399] [client 193.19.207.87:58104] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Apr 08 13:04:46.758077 2026] [:error] [pid 12385:tid 12412] [client 193.19.207.87:58104] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adXh7iAjtvRQEkLosq3vYQAAABc"]
[Wed Apr 08 13:04:47.385184 2026] [:error] [pid 12490:tid 12500] [client 193.19.207.87:17096] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Apr 08 13:04:47.876477 2026] [:error] [pid 12490:tid 12503] [client 193.19.207.87:17096] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adXh721Fea4F4fbumr06MgAAAMs"]
[Wed Apr 08 13:04:50.799155 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:43796] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Apr 08 13:04:51.873718 2026] [:error] [pid 12490:tid 12499] [client 193.19.207.87:43796] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adXh821Fea4F4fbumr06OwAAAMc"]
[Wed Apr 08 13:04:55.808537 2026] [:error] [pid 12453:tid 12461] [client 193.19.207.87:43806] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adXh9xjtW7S6XsLPvrT-9wAAAIY"]
[Wed Apr 08 13:04:58.917379 2026] [:error] [pid 12386:tid 12437] [client 193.19.207.87:43756] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Apr 08 13:04:59.256334 2026] [:error] [pid 12386:tid 12428] [client 193.19.207.87:43756] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Apr 08 13:04:59.966063 2026] [:error] [pid 12386:tid 12421] [client 193.19.207.87:43756] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adXh-xLhhLtqHi2gK7U7bwAAAQU"]
[Wed Apr 08 13:05:00.998845 2026] [:error] [pid 12386:tid 12425] [client 193.19.207.87:43768] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adXh_BLhhLtqHi2gK7U7cwAAAQk"]
[Wed Apr 08 13:05:01.989942 2026] [:error] [pid 12453:tid 12479] [client 193.19.207.87:43770] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adXh_RjtW7S6XsLPvrT_BgAAAJg"]
[Wed Apr 08 13:05:02.617994 2026] [:error] [pid 12386:tid 12438] [client 193.19.207.87:43782] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adXh_hLhhLtqHi2gK7U7ewAAARY"]
[Wed Apr 08 13:05:03.260747 2026] [:error] [pid 12490:tid 12510] [client 193.19.207.87:43796] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adXh_21Fea4F4fbumr06YAAAANI"]
[Wed Apr 08 13:05:04.561972 2026] [:error] [pid 12385:tid 12393] [client 193.19.207.87:43798] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Apr 08 13:05:04.891118 2026] [:error] [pid 12385:tid 12390] [client 193.19.207.87:43798] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adXiACAjtvRQEkLosq3vbQAAAAE"]
[Wed Apr 08 13:05:05.602250 2026] [:error] [pid 12490:tid 12492] [client 193.19.207.87:43810] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adXiAW1Fea4F4fbumr06bQAAAMA"]
[Wed Apr 08 13:05:06.240000 2026] [:error] [pid 12453:tid 12479] [client 193.19.207.87:43812] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adXiAhjtW7S6XsLPvrT_EgAAAJg"]
[Wed Apr 08 13:05:08.825753 2026] [:error] [pid 12453:tid 12477] [client 193.19.207.87:43826] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Apr 08 13:05:09.538983 2026] [:error] [pid 12453:tid 12467] [client 193.19.207.87:43826] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Apr 08 13:05:10.883493 2026] [:error] [pid 12453:tid 12472] [client 193.19.207.87:43826] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adXiBhjtW7S6XsLPvrT_KQAAAJE"]
[Wed Apr 08 13:05:12.625724 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:47600] [client 193.19.207.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.207.87, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adXiCBjtW7S6XsLPvrT_MwAAAI4"]
[Wed Apr 08 13:05:12.962435 2026] [:error] [pid 12453:tid 12470] [client 193.19.207.87:47600] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Apr 08 13:05:14.621163 2026] [:error] [pid 12453:tid 12464] [client 193.19.207.87:47600] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Apr 08 13:05:14.978832 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:47600] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Apr 08 13:05:16.626463 2026] [:error] [pid 12453:tid 12456] [client 193.19.207.87:47600] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adXiDBjtW7S6XsLPvrT_TAAAAIE"]
[Wed Apr 08 13:05:17.614733 2026] [:error] [pid 12386:tid 12428] [client 193.19.207.87:47604] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Apr 08 13:05:17.947456 2026] [:error] [pid 12386:tid 12423] [client 193.19.207.87:47604] [client 193.19.207.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.207.87, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adXiDRLhhLtqHi2gK7U7jAAAAQc"]
[Wed Apr 08 13:05:18.657441 2026] [:error] [pid 12386:tid 12435] [client 193.19.207.87:47604] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "adXiDhLhhLtqHi2gK7U7kAAAARM"]
[Wed Apr 08 13:05:20.603124 2026] [:error] [pid 12386:tid 12421] [client 193.19.207.87:53922] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Apr 08 13:05:21.270165 2026] [:error] [pid 12386:tid 12437] [client 193.19.207.87:53922] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Wed Apr 08 13:05:21.963703 2026] [:error] [pid 12386:tid 12428] [client 193.19.207.87:53922] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adXiERLhhLtqHi2gK7U7mgAAAQw"]
[Wed Apr 08 13:05:22.619153 2026] [:error] [pid 12490:tid 12501] [client 193.19.207.87:61956] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 08 13:05:23.578016 2026] [:error] [pid 12490:tid 12492] [client 193.19.207.87:61956] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Apr 08 13:05:24.286245 2026] [:error] [pid 12490:tid 12499] [client 193.19.207.87:61956] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Apr 08 13:05:24.965330 2026] [:error] [pid 12490:tid 12502] [client 193.19.207.87:61956] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Apr 08 13:05:25.282474 2026] [:error] [pid 12490:tid 12493] [client 193.19.207.87:61956] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adXiFW1Fea4F4fbumr06sgAAAME"]
[Wed Apr 08 13:05:25.966048 2026] [:error] [pid 12490:tid 12494] [client 193.19.207.87:53926] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Apr 08 13:05:26.296014 2026] [:error] [pid 12490:tid 12512] [client 193.19.207.87:53926] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Apr 08 13:05:26.779725 2026] [:error] [pid 12490:tid 12507] [client 193.19.207.87:53926] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adXiFm1Fea4F4fbumr06uAAAAM8"]
[Wed Apr 08 13:05:29.200658 2026] [:error] [pid 12490:tid 12499] [client 193.19.207.87:50500] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Apr 08 13:05:29.835905 2026] [:error] [pid 12490:tid 12510] [client 193.19.207.87:50500] [client 193.19.207.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.207.87, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adXiGW1Fea4F4fbumr06yAAAANI"]
[Wed Apr 08 13:05:30.154847 2026] [:error] [pid 12490:tid 12501] [client 193.19.207.87:50500] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adXiGm1Fea4F4fbumr06ygAAAMk"]
[Wed Apr 08 13:05:34.067816 2026] [:error] [pid 12385:tid 12404] [client 193.19.207.87:50512] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Apr 08 13:05:35.991251 2026] [:error] [pid 12385:tid 12407] [client 193.19.207.87:50512] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Apr 08 13:05:36.311634 2026] [:error] [pid 12385:tid 12405] [client 193.19.207.87:50512] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adXiICAjtvRQEkLosq3vlQAAABA"]
[Wed Apr 08 13:05:36.994382 2026] [:error] [pid 12453:tid 12470] [client 193.19.207.87:50516] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Apr 08 13:05:38.000007 2026] [:error] [pid 12453:tid 12465] [client 193.19.207.87:50516] [client 193.19.207.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.207.87, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adXiIRjtW7S6XsLPvrT_lAAAAIo"]
[Wed Apr 08 13:05:38.318434 2026] [:error] [pid 12453:tid 12473] [client 193.19.207.87:50516] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Apr 08 13:05:38.650251 2026] [:error] [pid 12453:tid 12472] [client 193.19.207.87:50516] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Apr 08 13:05:38.962190 2026] [:error] [pid 12453:tid 12456] [client 193.19.207.87:50516] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Apr 08 13:05:39.283511 2026] [:error] [pid 12453:tid 12478] [client 193.19.207.87:50516] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adXiIxjtW7S6XsLPvrT_nAAAAJc"]
[Wed Apr 08 13:05:39.928697 2026] [:error] [pid 12386:tid 12432] [client 193.19.207.87:49484] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Apr 08 13:05:40.240342 2026] [:error] [pid 12386:tid 12427] [client 193.19.207.87:49484] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adXiJBLhhLtqHi2gK7U7xgAAAQs"]
[Wed Apr 08 13:05:41.216098 2026] [:error] [pid 12453:tid 12461] [client 193.19.207.87:49494] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Apr 08 13:05:41.527123 2026] [:error] [pid 12453:tid 12468] [client 193.19.207.87:49494] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adXiJRjtW7S6XsLPvrT_pAAAAI0"]
[Wed Apr 08 13:05:42.815106 2026] [:error] [pid 12386:tid 12431] [client 193.19.207.87:49496] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Apr 08 13:05:43.133577 2026] [:error] [pid 12386:tid 12418] [client 193.19.207.87:49496] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adXiJxLhhLtqHi2gK7U76gAAAQI"]
[Wed Apr 08 13:05:43.745954 2026] [:error] [pid 12490:tid 12512] [client 193.19.207.87:49500] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adXiJ21Fea4F4fbumr062AAAANQ"]
[Wed Apr 08 13:05:44.385899 2026] [:error] [pid 12490:tid 12501] [client 193.19.207.87:49514] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Apr 08 13:05:44.716627 2026] [:error] [pid 12490:tid 12510] [client 193.19.207.87:49514] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Wed Apr 08 13:05:46.079553 2026] [:error] [pid 12490:tid 12516] [client 193.19.207.87:49514] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adXiKm1Fea4F4fbumr068gAAANg"]
[Wed Apr 08 13:05:47.054003 2026] [:error] [pid 12453:tid 12477] [client 193.19.207.87:49516] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adXiKxjtW7S6XsLPvrT_rwAAAJY"]
[Wed Apr 08 13:05:48.735906 2026] [:error] [pid 12490:tid 12493] [client 193.19.207.87:37508] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adXiLG1Fea4F4fbumr07CAAAAME"]
[Wed Apr 08 13:05:49.395991 2026] [:error] [pid 12490:tid 12516] [client 193.19.207.87:37510] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Apr 08 13:05:50.057252 2026] [:error] [pid 12490:tid 12498] [client 193.19.207.87:37510] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Apr 08 13:05:50.403954 2026] [:error] [pid 12490:tid 12507] [client 193.19.207.87:37510] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adXiLm1Fea4F4fbumr07EgAAAM8"]
[Wed Apr 08 13:05:51.065599 2026] [:error] [pid 12386:tid 12434] [client 193.19.207.87:37518] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Apr 08 13:05:51.722076 2026] [:error] [pid 12386:tid 12420] [client 193.19.207.87:37518] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "adXiLxLhhLtqHi2gK7U7_gAAAQQ"]
[Wed Apr 08 13:05:53.382383 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:38423] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adXiMRjtW7S6XsLPvrT_wwAAAI4"]
[Wed Apr 08 13:05:54.342069 2026] [:error] [pid 12490:tid 12498] [client 193.19.207.87:40690] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Apr 08 13:05:55.312650 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:40690] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Apr 08 13:05:55.957779 2026] [:error] [pid 12490:tid 12503] [client 193.19.207.87:40690] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Apr 08 13:05:56.275246 2026] [:error] [pid 12490:tid 12507] [client 193.19.207.87:40690] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adXiNG1Fea4F4fbumr07LQAAAM8"]
[Wed Apr 08 13:05:56.911603 2026] [:error] [pid 12490:tid 12493] [client 193.19.207.87:37536] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adXiNG1Fea4F4fbumr07MAAAAME"]
[Wed Apr 08 13:05:57.552590 2026] [:error] [pid 12490:tid 12507] [client 193.19.207.87:13214] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adXiNW1Fea4F4fbumr07NQAAAM8"]
[Wed Apr 08 13:05:58.178726 2026] [:error] [pid 12490:tid 12511] [client 193.19.207.87:58342] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adXiNm1Fea4F4fbumr07NgAAANM"]
[Wed Apr 08 13:05:58.819243 2026] [:error] [pid 12453:tid 12477] [client 193.19.207.87:25235] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Wed Apr 08 13:05:59.170720 2026] [:error] [pid 12453:tid 12476] [client 193.19.207.87:25235] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adXiNxjtW7S6XsLPvrT_1wAAAJU"]
[Wed Apr 08 13:05:59.796322 2026] [:error] [pid 12490:tid 12505] [client 193.19.207.87:58356] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adXiN21Fea4F4fbumr07OQAAAM0"]
[Wed Apr 08 13:06:00.437985 2026] [:error] [pid 12453:tid 12479] [client 193.19.207.87:12564] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Apr 08 13:06:01.059826 2026] [:error] [pid 12453:tid 12477] [client 193.19.207.87:12564] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adXiORjtW7S6XsLPvrT_5AAAAJY"]
[Wed Apr 08 13:06:01.678416 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:58364] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adXiOW1Fea4F4fbumr07PwAAAMM"]
[Wed Apr 08 13:06:02.316650 2026] [:error] [pid 12453:tid 12476] [client 193.19.207.87:58374] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adXiOhjtW7S6XsLPvrT_5gAAAJU"]
[Wed Apr 08 13:06:02.936919 2026] [:error] [pid 12453:tid 12456] [client 193.19.207.87:58388] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adXiOhjtW7S6XsLPvrT_6AAAAIE"]
[Wed Apr 08 13:06:03.881006 2026] [:error] [pid 12453:tid 12463] [client 193.19.207.87:9891] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adXiOxjtW7S6XsLPvrT_7AAAAIg"]
[Wed Apr 08 13:06:05.128892 2026] [:error] [pid 12453:tid 12471] [client 193.19.207.87:58398] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adXiPRjtW7S6XsLPvrT_8QAAAJA"]
[Wed Apr 08 13:06:05.771014 2026] [:error] [pid 12386:tid 12438] [client 193.19.207.87:58404] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Apr 08 13:06:06.720562 2026] [:error] [pid 12386:tid 12439] [client 193.19.207.87:58404] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Apr 08 13:06:07.032311 2026] [:error] [pid 12386:tid 12421] [client 193.19.207.87:58404] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adXiPxLhhLtqHi2gK7U8HgAAAQU"]
[Wed Apr 08 13:06:07.977831 2026] [:error] [pid 12490:tid 12499] [client 193.19.207.87:40702] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Wed Apr 08 13:06:08.290394 2026] [:error] [pid 12490:tid 12514] [client 193.19.207.87:40702] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Wed Apr 08 13:06:09.864686 2026] [:error] [pid 12490:tid 12499] [client 193.19.207.87:40702] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adXiQW1Fea4F4fbumr07XQAAAMc"]
[Wed Apr 08 13:06:11.451006 2026] [:error] [pid 12385:tid 12412] [client 193.19.207.87:40704] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adXiQyAjtvRQEkLosq3v1wAAABc"]
[Wed Apr 08 13:06:12.077529 2026] [:error] [pid 12453:tid 12473] [client 193.19.207.87:12346] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adXiRBjtW7S6XsLPvrT_9wAAAJI"]
[Wed Apr 08 13:06:14.030618 2026] [:error] [pid 12385:tid 12411] [client 193.19.207.87:40710] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adXiRiAjtvRQEkLosq3v4AAAABY"]
[Wed Apr 08 13:06:15.417108 2026] [:error] [pid 12453:tid 12459] [client 193.19.207.87:4910] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Apr 08 13:06:15.766702 2026] [:error] [pid 12453:tid 12467] [client 193.19.207.87:4910] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Wed Apr 08 13:06:16.098122 2026] [:error] [pid 12453:tid 12463] [client 193.19.207.87:4910] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Wed Apr 08 13:06:16.452183 2026] [:error] [pid 12453:tid 12464] [client 193.19.207.87:4910] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Wed Apr 08 13:06:18.141567 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:4910] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adXiShjtW7S6XsLPvrQAEgAAAI4"]
[Wed Apr 08 13:06:19.058835 2026] [:error] [pid 12453:tid 12455] [client 193.19.207.87:33500] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adXiSxjtW7S6XsLPvrQAGAAAAIA"]
[Wed Apr 08 13:06:19.683713 2026] [:error] [pid 12490:tid 12512] [client 193.19.207.87:33506] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adXiS21Fea4F4fbumr07cgAAANQ"]
[Wed Apr 08 13:06:20.337138 2026] [:error] [pid 12490:tid 12494] [client 193.19.207.87:33508] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adXiTG1Fea4F4fbumr07dwAAAMI"]
[Wed Apr 08 13:06:20.985452 2026] [:error] [pid 12453:tid 12479] [client 193.19.207.87:33514] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adXiTBjtW7S6XsLPvrQAHQAAAJg"]
[Wed Apr 08 13:06:21.635393 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:7170] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adXiTW1Fea4F4fbumr07egAAAMM"]
[Wed Apr 08 13:06:22.590028 2026] [:error] [pid 12453:tid 12471] [client 193.19.207.87:33532] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adXiThjtW7S6XsLPvrQAIwAAAJA"]
[Wed Apr 08 13:06:23.268316 2026] [:error] [pid 12490:tid 12499] [client 193.19.207.87:33548] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adXiT21Fea4F4fbumr07hQAAAMc"]
[Wed Apr 08 13:06:23.900902 2026] [:error] [pid 12490:tid 12498] [client 193.19.207.87:3378] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adXiT21Fea4F4fbumr07iQAAAMY"]
[Wed Apr 08 13:06:24.564886 2026] [:error] [pid 12453:tid 12470] [client 193.19.207.87:33562] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adXiUBjtW7S6XsLPvrQALQAAAI8"]
[Wed Apr 08 13:06:25.874628 2026] [:error] [pid 12453:tid 12456] [client 193.19.207.87:30464] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adXiURjtW7S6XsLPvrQASQAAAIE"]
[Wed Apr 08 13:06:26.837627 2026] [:error] [pid 12453:tid 12478] [client 193.19.207.87:1470] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adXiUhjtW7S6XsLPvrQAUAAAAJc"]
[Wed Apr 08 13:06:27.487097 2026] [:error] [pid 12490:tid 12509] [client 193.19.207.87:10210] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Wed Apr 08 13:06:28.113137 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:10210] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adXiVG1Fea4F4fbumr07mwAAAMM"]
[Wed Apr 08 13:06:29.389383 2026] [:error] [pid 12453:tid 12455] [client 193.19.207.87:21961] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adXiVRjtW7S6XsLPvrQAVwAAAIA"]
[Wed Apr 08 13:06:30.690166 2026] [:error] [pid 12490:tid 12501] [client 193.19.207.87:58098] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Apr 08 13:06:31.031652 2026] [:error] [pid 12490:tid 12502] [client 193.19.207.87:58098] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adXiV21Fea4F4fbumr07qgAAAMo"]
[Wed Apr 08 13:06:32.000766 2026] [:error] [pid 12453:tid 12473] [client 193.19.207.87:58108] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Apr 08 13:06:33.501400 2026] [:error] [pid 12453:tid 12473] [client 193.19.207.87:58108] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Wed Apr 08 13:06:33.816584 2026] [:error] [pid 12453:tid 12464] [client 193.19.207.87:58108] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Apr 08 13:06:34.125986 2026] [:error] [pid 12453:tid 12463] [client 193.19.207.87:58108] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adXiWhjtW7S6XsLPvrQAcAAAAIg"]
[Wed Apr 08 13:06:34.760692 2026] [:error] [pid 12453:tid 12459] [client 193.19.207.87:58110] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Wed Apr 08 13:06:35.068120 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:58110] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adXiWxjtW7S6XsLPvrQAcwAAAI4"]
[Wed Apr 08 13:06:36.363699 2026] [:error] [pid 12386:tid 12429] [client 193.19.207.87:58114] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Apr 08 13:06:36.708135 2026] [:error] [pid 12386:tid 12422] [client 193.19.207.87:58114] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Apr 08 13:06:37.021372 2026] [:error] [pid 12386:tid 12430] [client 193.19.207.87:58114] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Wed Apr 08 13:06:38.594496 2026] [:error] [pid 12386:tid 12439] [client 193.19.207.87:58114] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Apr 08 13:06:38.910930 2026] [:error] [pid 12386:tid 12434] [client 193.19.207.87:58114] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Wed Apr 08 13:06:39.560585 2026] [:error] [pid 12386:tid 12429] [client 193.19.207.87:58114] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Wed Apr 08 13:06:40.582939 2026] [:error] [pid 12386:tid 12427] [client 193.19.207.87:58114] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Apr 08 13:06:40.908830 2026] [:error] [pid 12386:tid 12419] [client 193.19.207.87:58114] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adXiYBLhhLtqHi2gK7U8cAAAAQM"]
[Wed Apr 08 13:06:41.553087 2026] [:error] [pid 12490:tid 12505] [client 193.19.207.87:41112] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adXiYW1Fea4F4fbumr07tQAAAM0"]
[Wed Apr 08 13:06:42.198644 2026] [:error] [pid 12385:tid 12405] [client 193.19.207.87:11073] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Wed Apr 08 13:06:42.506366 2026] [:error] [pid 12385:tid 12389] [client 193.19.207.87:11073] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adXiYiAjtvRQEkLosq3v9QAAAAA"]
[Wed Apr 08 13:06:44.371362 2026] [:error] [pid 12490:tid 12500] [client 193.19.207.87:41122] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 08 13:06:44.678479 2026] [:error] [pid 12490:tid 12512] [client 193.19.207.87:41122] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adXiZG1Fea4F4fbumr07vQAAANQ"]
[Wed Apr 08 13:06:45.298140 2026] [:error] [pid 12453:tid 12471] [client 193.19.207.87:41136] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adXiZRjtW7S6XsLPvrQAmQAAAJA"]
[Wed Apr 08 13:06:47.300450 2026] [:error] [pid 12453:tid 12477] [client 193.19.207.87:41150] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adXiZxjtW7S6XsLPvrQAowAAAJY"]
[Wed Apr 08 13:06:47.921672 2026] [:error] [pid 12453:tid 12458] [client 193.19.207.87:37498] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "adXiZxjtW7S6XsLPvrQApwAAAIM"]
[Wed Apr 08 13:06:49.529594 2026] [:error] [pid 12490:tid 12504] [client 193.19.207.87:37500] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Apr 08 13:06:50.166627 2026] [:error] [pid 12490:tid 12497] [client 193.19.207.87:37500] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adXiam1Fea4F4fbumr07zwAAAMU"]
[Wed Apr 08 13:06:51.114070 2026] [:error] [pid 12453:tid 12465] [client 193.19.207.87:37508] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Wed Apr 08 13:06:51.746876 2026] [:error] [pid 12453:tid 12458] [client 193.19.207.87:37508] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "adXiaxjtW7S6XsLPvrQAvgAAAIM"]
[Wed Apr 08 13:06:52.364698 2026] [:error] [pid 12453:tid 12471] [client 193.19.207.87:37516] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adXibBjtW7S6XsLPvrQAwQAAAJA"]
[Wed Apr 08 13:06:53.317013 2026] [:error] [pid 12453:tid 12457] [client 193.19.207.87:37526] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Apr 08 13:06:53.640106 2026] [:error] [pid 12453:tid 12464] [client 193.19.207.87:37526] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adXibRjtW7S6XsLPvrQAxwAAAIk"]
[Wed Apr 08 13:06:54.265163 2026] [:error] [pid 12490:tid 12511] [client 193.19.207.87:37538] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adXibm1Fea4F4fbumr073gAAANM"]
[Wed Apr 08 13:06:55.601866 2026] [:error] [pid 12490:tid 12498] [client 193.19.207.87:37542] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Wed Apr 08 13:06:55.950872 2026] [:error] [pid 12490:tid 12515] [client 193.19.207.87:37542] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Wed Apr 08 13:06:56.641787 2026] [:error] [pid 12490:tid 12492] [client 193.19.207.87:37542] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Wed Apr 08 13:06:57.296252 2026] [:error] [pid 12490:tid 12494] [client 193.19.207.87:37542] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adXicW1Fea4F4fbumr078AAAAMI"]
[Wed Apr 08 13:06:57.923216 2026] [:error] [pid 12453:tid 12477] [client 193.19.207.87:41246] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adXicRjtW7S6XsLPvrQA1AAAAJY"]
[Wed Apr 08 13:06:59.607811 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:40933] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Apr 08 13:06:59.933621 2026] [:error] [pid 12453:tid 12463] [client 193.19.207.87:40933] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "adXicxjtW7S6XsLPvrQA3gAAAIg"]
[Wed Apr 08 13:07:00.597469 2026] [:error] [pid 12453:tid 12457] [client 193.19.207.87:41278] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adXidBjtW7S6XsLPvrQA3wAAAII"]
[Wed Apr 08 13:07:01.240817 2026] [:error] [pid 12453:tid 12459] [client 193.19.207.87:41292] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adXidRjtW7S6XsLPvrQA4wAAAIQ"]
[Wed Apr 08 13:07:03.182676 2026] [:error] [pid 12453:tid 12470] [client 193.19.207.87:41298] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Wed Apr 08 13:07:03.493339 2026] [:error] [pid 12453:tid 12468] [client 193.19.207.87:41298] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adXidxjtW7S6XsLPvrQA9AAAAI0"]
[Wed Apr 08 13:07:04.468710 2026] [:error] [pid 12385:tid 12391] [client 193.19.207.87:63046] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adXieCAjtvRQEkLosq3wAwAAAAI"]
[Wed Apr 08 13:07:05.118097 2026] [:error] [pid 12490:tid 12509] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Apr 08 13:07:05.438822 2026] [:error] [pid 12490:tid 12513] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Wed Apr 08 13:07:06.083251 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Wed Apr 08 13:07:07.391072 2026] [:error] [pid 12490:tid 12508] [client 193.19.207.87:41308] [client 193.19.207.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.207.87, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "adXie21Fea4F4fbumr08CAAAANA"]
[Wed Apr 08 13:07:08.031867 2026] [:error] [pid 12490:tid 12502] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Wed Apr 08 13:07:08.352079 2026] [:error] [pid 12490:tid 12510] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Wed Apr 08 13:07:08.694089 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Wed Apr 08 13:07:09.372516 2026] [:error] [pid 12490:tid 12513] [client 193.19.207.87:41308] [client 193.19.207.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.207.87, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adXifW1Fea4F4fbumr08FgAAANU"]
[Wed Apr 08 13:07:10.356641 2026] [:error] [pid 12490:tid 12506] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Wed Apr 08 13:07:10.684389 2026] [:error] [pid 12490:tid 12507] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Wed Apr 08 13:07:11.405886 2026] [:error] [pid 12490:tid 12515] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Wed Apr 08 13:07:12.116755 2026] [:error] [pid 12490:tid 12494] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Apr 08 13:07:13.127869 2026] [:error] [pid 12490:tid 12504] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Wed Apr 08 13:07:15.520018 2026] [:error] [pid 12490:tid 12513] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Apr 08 13:07:15.839685 2026] [:error] [pid 12490:tid 12501] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Wed Apr 08 13:07:18.769431 2026] [:error] [pid 12490:tid 12509] [client 193.19.207.87:41308] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Apr 08 13:07:19.395855 2026] [:error] [pid 12490:tid 12496] [client 193.19.207.87:41308] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adXih21Fea4F4fbumr08SQAAAMQ"]
[Wed Apr 08 13:07:21.778480 2026] [:error] [pid 12490:tid 12501] [client 193.19.207.87:41698] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Apr 08 13:07:22.096269 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:41698] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adXiim1Fea4F4fbumr08VgAAAMM"]
[Wed Apr 08 13:07:23.041107 2026] [:error] [pid 12490:tid 12493] [client 193.19.207.87:30381] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Wed Apr 08 13:07:23.355678 2026] [:error] [pid 12490:tid 12495] [client 193.19.207.87:30381] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adXii21Fea4F4fbumr08YgAAAMM"]
[Wed Apr 08 13:07:24.682981 2026] [:error] [pid 12490:tid 12493] [client 193.19.207.87:14487] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Wed Apr 08 13:07:25.371725 2026] [:error] [pid 12490:tid 12510] [client 193.19.207.87:14487] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Wed Apr 08 13:07:26.087232 2026] [:error] [pid 12490:tid 12503] [client 193.19.207.87:14487] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Wed Apr 08 13:07:26.428219 2026] [:error] [pid 12490:tid 12492] [client 193.19.207.87:14487] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Wed Apr 08 13:07:27.119023 2026] [:error] [pid 12490:tid 12514] [client 193.19.207.87:14487] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adXij21Fea4F4fbumr08ewAAANY"]
[Wed Apr 08 13:07:27.817870 2026] [:error] [pid 12386:tid 12431] [client 193.19.207.87:36176] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Wed Apr 08 13:07:28.184396 2026] [:error] [pid 12386:tid 12439] [client 193.19.207.87:36176] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Wed Apr 08 13:07:28.492551 2026] [:error] [pid 12386:tid 12421] [client 193.19.207.87:36176] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adXikBLhhLtqHi2gK7U81gAAAQU"]
[Wed Apr 08 13:07:29.435080 2026] [:error] [pid 12490:tid 12497] [client 193.19.207.87:11850] [client 193.19.207.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adXikW1Fea4F4fbumr08hQAAAMU"]
[Wed Apr 08 13:07:30.425439 2026] [:error] [pid 12490:tid 12514] [client 193.19.207.87:36186] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Apr 08 13:07:31.085083 2026] [:error] [pid 12490:tid 12510] [client 193.19.207.87:36186] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/file.php"] [unique_id "adXik21Fea4F4fbumr08kAAAANI"]
[Wed Apr 08 13:07:31.707704 2026] [:error] [pid 12385:tid 12389] [client 193.19.207.87:14932] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/file.php"] [unique_id "adXikyAjtvRQEkLosq3wKQAAAAA"]
[Wed Apr 08 13:07:32.334266 2026] [:error] [pid 12385:tid 12404] [client 193.19.207.87:36200] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/file.php"] [unique_id "adXilCAjtvRQEkLosq3wKgAAAA8"]
[Wed Apr 08 13:07:32.955169 2026] [:error] [pid 12386:tid 12431] [client 193.19.207.87:36204] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/file.php"] [unique_id "adXilBLhhLtqHi2gK7U83gAAAQ8"]
[Wed Apr 08 13:07:33.579402 2026] [:error] [pid 12490:tid 12503] [client 193.19.207.87:36220] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/file.php"] [unique_id "adXilW1Fea4F4fbumr08mQAAAMs"]
[Wed Apr 08 13:07:41.575750 2026] [:error] [pid 12490:tid 12497] [client 193.19.207.87:36232] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "adXinW1Fea4F4fbumr082wAAAMU"]
[Wed Apr 08 13:07:42.216402 2026] [:error] [pid 12386:tid 12433] [client 193.19.207.87:65518] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "adXinhLhhLtqHi2gK7U86wAAARE"]
[Wed Apr 08 13:07:42.868461 2026] [:error] [pid 12453:tid 12459] [client 193.19.207.87:35344] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "adXinhjtW7S6XsLPvrQBOgAAAIQ"]
[Wed Apr 08 13:07:43.522992 2026] [:error] [pid 12453:tid 12469] [client 193.19.207.87:35354] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "adXinxjtW7S6XsLPvrQBOwAAAI4"]
[Wed Apr 08 13:07:44.181463 2026] [:error] [pid 12453:tid 12472] [client 193.19.207.87:35356] [client 193.19.207.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/"] [unique_id "adXioBjtW7S6XsLPvrQBPwAAAJE"]
[Wed Apr 08 18:33:56.311443 2026] [:error] [pid 7189:tid 7202] [client 176.227.240.89:40062] [client 176.227.240.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.227.240.89, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "adYvFBaBqhBSu0L37lqjaQAAAcs"]
[Wed Apr 08 18:33:56.315630 2026] [:error] [pid 7189:tid 7202] [client 176.227.240.89:40062] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Apr 08 18:57:05.404951 2026] [:error] [pid 12386:tid 12425] [client 115.242.63.75:55503] [client 115.242.63.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.242.63.75, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adY0gRLhhLtqHi2gK7UHZAAAAQk"]
[Wed Apr 08 18:57:05.409130 2026] [:error] [pid 12386:tid 12425] [client 115.242.63.75:55503] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 08 19:39:56.020945 2026] [:error] [pid 7047:tid 7050] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 08 19:39:56.269393 2026] [:error] [pid 7047:tid 7052] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Apr 08 19:39:56.516269 2026] [:error] [pid 7047:tid 7059] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Apr 08 19:39:56.768760 2026] [:error] [pid 7047:tid 7049] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 08 19:39:57.018519 2026] [:error] [pid 7047:tid 7062] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 08 19:39:57.266590 2026] [:error] [pid 7047:tid 7054] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 08 19:39:57.514556 2026] [:error] [pid 7047:tid 7073] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 08 19:39:57.764303 2026] [:error] [pid 7047:tid 7063] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Apr 08 19:39:58.261404 2026] [:error] [pid 7047:tid 7068] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Apr 08 19:39:58.507885 2026] [:error] [pid 7047:tid 7050] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Apr 08 19:39:58.756595 2026] [:error] [pid 7047:tid 7049] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 19:39:59.007551 2026] [:error] [pid 7047:tid 7062] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Apr 08 19:39:59.262432 2026] [:error] [pid 7047:tid 7061] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 08 19:39:59.509938 2026] [:error] [pid 7047:tid 7063] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Apr 08 19:39:59.759075 2026] [:error] [pid 7047:tid 7069] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Apr 08 19:40:00.008504 2026] [:error] [pid 7047:tid 7071] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 08 19:40:00.258399 2026] [:error] [pid 7047:tid 7064] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Apr 08 19:40:00.507797 2026] [:error] [pid 7047:tid 7059] [client 178.238.10.113:43092] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 08 19:40:03.981404 2026] [:error] [pid 7047:tid 7054] [client 178.238.10.113:43092] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adY-k-Nh3oGO3pKiCzzsqQAAAYU"]
[Wed Apr 08 19:40:05.205594 2026] [:error] [pid 7047:tid 7050] [client 178.238.10.113:46928] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adY-leNh3oGO3pKiCzzssAAAAYE"]
[Wed Apr 08 19:40:06.436435 2026] [:error] [pid 12490:tid 12511] [client 178.238.10.113:46940] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 08 19:40:07.169884 2026] [:error] [pid 12490:tid 12499] [client 178.238.10.113:46940] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adY-l21Fea4F4fbumr3xdQAAAMc"]
[Wed Apr 08 19:40:08.158483 2026] [:error] [pid 12490:tid 12492] [client 178.238.10.113:46956] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Apr 08 19:40:08.402751 2026] [:error] [pid 12490:tid 12496] [client 178.238.10.113:46956] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adY-mG1Fea4F4fbumr3xfAAAAMQ"]
[Wed Apr 08 19:40:09.134904 2026] [:error] [pid 7189:tid 7204] [client 178.238.10.113:46970] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Apr 08 19:40:10.354378 2026] [:error] [pid 7189:tid 7203] [client 178.238.10.113:46970] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adY-mhaBqhBSu0L37lq7agAAAcw"]
[Wed Apr 08 19:40:11.084791 2026] [:error] [pid 12490:tid 12511] [client 178.238.10.113:46982] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adY-m21Fea4F4fbumr3xfwAAANM"]
[Wed Apr 08 19:40:11.572326 2026] [:error] [pid 12453:tid 12457] [client 178.238.10.113:46992] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adY-mxjtW7S6XsLPvrQMNAAAAII"]
[Wed Apr 08 19:40:12.061626 2026] [:error] [pid 64066:tid 64086] [client 178.238.10.113:47006] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adY-nFR3WucJgr2vZGYrSAAAAVE"]
[Wed Apr 08 19:40:12.547660 2026] [:error] [pid 64066:tid 64090] [client 178.238.10.113:47020] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adY-nFR3WucJgr2vZGYrSQAAAVU"]
[Wed Apr 08 19:40:13.036019 2026] [:error] [pid 64066:tid 64085] [client 178.238.10.113:47026] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adY-nVR3WucJgr2vZGYrSwAAAVA"]
[Wed Apr 08 19:40:13.771932 2026] [:error] [pid 12385:tid 12392] [client 178.238.10.113:47038] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adY-nSAjtvRQEkLosq2VTQAAAAM"]
[Wed Apr 08 19:40:14.264716 2026] [:error] [pid 12490:tid 12506] [client 178.238.10.113:42316] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Apr 08 19:40:14.756645 2026] [:error] [pid 12490:tid 12501] [client 178.238.10.113:42316] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "adY-nm1Fea4F4fbumr3xhAAAAMk"]
[Wed Apr 08 19:40:15.732152 2026] [:error] [pid 12385:tid 12390] [client 178.238.10.113:42320] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adY-nyAjtvRQEkLosq2VUQAAAAE"]
[Wed Apr 08 19:40:16.458364 2026] [:error] [pid 12453:tid 12456] [client 178.238.10.113:42326] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adY-oBjtW7S6XsLPvrQMPQAAAIE"]
[Wed Apr 08 19:40:16.948600 2026] [:error] [pid 35642:tid 35667] [client 178.238.10.113:42340] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Apr 08 19:40:17.192847 2026] [:error] [pid 35642:tid 35646] [client 178.238.10.113:42340] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adY-oQ-CqryxdEs5DN9OVQAAAEI"]
[Wed Apr 08 19:40:17.685063 2026] [:error] [pid 7189:tid 7200] [client 178.238.10.113:42342] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Apr 08 19:40:18.433633 2026] [:error] [pid 7189:tid 7203] [client 178.238.10.113:42342] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Apr 08 19:40:19.174493 2026] [:error] [pid 7189:tid 7215] [client 178.238.10.113:42342] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adY-oxaBqhBSu0L37lq7fQAAAdg"]
[Wed Apr 08 19:40:19.667488 2026] [:error] [pid 12385:tid 12409] [client 178.238.10.113:42348] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Apr 08 19:40:19.912129 2026] [:error] [pid 12385:tid 12401] [client 178.238.10.113:42348] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adY-oyAjtvRQEkLosq2VVQAAAAw"]
[Wed Apr 08 19:40:20.401336 2026] [:error] [pid 64066:tid 64083] [client 178.238.10.113:42362] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Apr 08 19:40:20.891001 2026] [:error] [pid 64066:tid 64073] [client 178.238.10.113:42362] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adY-pFR3WucJgr2vZGYrUwAAAUQ"]
[Wed Apr 08 19:40:21.622180 2026] [:error] [pid 7047:tid 7060] [client 178.238.10.113:42372] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adY-peNh3oGO3pKiCzzsvQAAAYs"]
[Wed Apr 08 19:40:22.359196 2026] [:error] [pid 35642:tid 35655] [client 178.238.10.113:42380] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Apr 08 19:40:22.605409 2026] [:error] [pid 35642:tid 35662] [client 178.238.10.113:42380] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Apr 08 19:40:23.094874 2026] [:error] [pid 35642:tid 35648] [client 178.238.10.113:42380] [client 178.238.10.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adY-pw-CqryxdEs5DN9OXgAAAEQ"]
[Wed Apr 08 19:41:01.665427 2026] [autoindex:error] [pid 12490:tid 12499] [client 149.50.209.217:48118] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 19:41:47.256227 2026] [:error] [pid 12386:tid 12416] [client 149.50.209.217:60228] [client 149.50.209.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2026/"] [unique_id "adY--xLhhLtqHi2gK7UOtAAAAQA"]
[Wed Apr 08 19:41:47.784958 2026] [:error] [pid 12453:tid 12465] [client 149.50.209.217:56334] [client 149.50.209.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2026/"] [unique_id "adY--xjtW7S6XsLPvrQM4QAAAIo"]
[Wed Apr 08 19:41:48.328597 2026] [:error] [pid 12385:tid 12397] [client 149.50.209.217:56338] [client 149.50.209.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2026/"] [unique_id "adY-_CAjtvRQEkLosq2VeQAAAAg"]
[Wed Apr 08 19:41:48.856043 2026] [:error] [pid 12385:tid 12404] [client 149.50.209.217:56352] [client 149.50.209.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2026/"] [unique_id "adY-_CAjtvRQEkLosq2VewAAAA8"]
[Wed Apr 08 19:41:49.383038 2026] [:error] [pid 12385:tid 12410] [client 149.50.209.217:56354] [client 149.50.209.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2026/"] [unique_id "adY-_SAjtvRQEkLosq2VfgAAABU"]
[Wed Apr 08 20:20:07.964311 2026] [:error] [pid 7047:tid 7060] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Apr 08 20:20:08.221981 2026] [:error] [pid 7047:tid 7069] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/uwu2.php
[Wed Apr 08 20:20:08.483727 2026] [:error] [pid 7047:tid 7065] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Wed Apr 08 20:20:08.741945 2026] [:error] [pid 7047:tid 7058] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Wed Apr 08 20:20:09.175901 2026] [:error] [pid 7047:tid 7063] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 08 20:20:09.523760 2026] [:error] [pid 7047:tid 7073] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/zews.php
[Wed Apr 08 20:20:09.781536 2026] [:error] [pid 7047:tid 7064] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 08 20:20:10.039770 2026] [:error] [pid 7047:tid 7052] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/124.php
[Wed Apr 08 20:20:10.311613 2026] [:error] [pid 7047:tid 7056] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Wed Apr 08 20:20:10.644547 2026] [:error] [pid 7047:tid 7050] [client 74.248.135.90:64715] File does not exist: /usr/local/apache/htdocs/suspended-page/geck.php
[Wed Apr 08 20:20:10.898965 2026] [:error] [pid 7047:tid 7057] [client 74.248.135.90:64715] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shout.php"] [unique_id "adZH-uNh3oGO3pKiCzwDdgAAAYg"]
[Wed Apr 08 20:20:12.795894 2026] [:error] [pid 12386:tid 12435] [client 74.248.135.90:65075] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shout.php"] [unique_id "adZH_BLhhLtqHi2gK7UUBQAAARM"]
[Wed Apr 08 20:20:38.762906 2026] [:error] [pid 12386:tid 12435] [client 74.248.135.90:65102] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "adZIFhLhhLtqHi2gK7UUEgAAARM"]
[Wed Apr 08 20:20:50.230650 2026] [:error] [pid 12385:tid 12403] [client 74.248.135.90:64334] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/size.php"] [unique_id "adZIIiAjtvRQEkLosq2aWwAAAA4"]
[Wed Apr 08 20:20:55.039908 2026] [:error] [pid 35642:tid 35644] [client 74.248.135.90:64735] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "adZIJw-CqryxdEs5DN9VBwAAAEA"]
[Wed Apr 08 20:20:56.976268 2026] [:error] [pid 12453:tid 12460] [client 74.248.135.90:65066] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "adZIKBjtW7S6XsLPvrQcUAAAAIU"]
[Wed Apr 08 20:21:07.031836 2026] [:error] [pid 7047:tid 7054] [client 74.248.135.90:65115] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "adZIM-Nh3oGO3pKiCzwD3AAAAYU"]
[Wed Apr 08 20:21:20.077719 2026] [:error] [pid 12453:tid 12472] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mn.php
[Wed Apr 08 20:21:20.335282 2026] [:error] [pid 12453:tid 12461] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mt.php
[Wed Apr 08 20:21:20.624099 2026] [:error] [pid 12453:tid 12456] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Wed Apr 08 20:21:20.907197 2026] [:error] [pid 12453:tid 12479] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Wed Apr 08 20:21:21.188956 2026] [:error] [pid 12453:tid 12470] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Wed Apr 08 20:21:21.477661 2026] [:error] [pid 12453:tid 12463] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Apr 08 20:21:21.736299 2026] [:error] [pid 12453:tid 12468] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 08 20:21:22.007514 2026] [:error] [pid 12453:tid 12469] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php
[Wed Apr 08 20:21:22.337542 2026] [:error] [pid 12453:tid 12461] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Wed Apr 08 20:21:22.594076 2026] [:error] [pid 12453:tid 12465] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Wed Apr 08 20:21:22.852411 2026] [:error] [pid 12453:tid 12478] [client 74.248.135.90:65046] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Apr 08 20:21:23.133525 2026] [:error] [pid 12453:tid 12470] [client 74.248.135.90:65046] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "adZIQxjtW7S6XsLPvrQclQAAAI8"]
[Wed Apr 08 20:21:29.417594 2026] [:error] [pid 12386:tid 12437] [client 74.248.135.90:65029] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v.php"] [unique_id "adZISRLhhLtqHi2gK7UULQAAARU"]
[Wed Apr 08 20:21:39.370396 2026] [:error] [pid 35642:tid 35666] [client 74.248.135.90:64370] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "adZIUw-CqryxdEs5DN9VHwAAAFY"]
[Wed Apr 08 20:23:01.222375 2026] [:error] [pid 12453:tid 12474] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Wed Apr 08 20:23:01.495898 2026] [:error] [pid 12453:tid 12463] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Wed Apr 08 20:23:01.785473 2026] [:error] [pid 12453:tid 12461] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Wed Apr 08 20:23:02.062637 2026] [:error] [pid 12453:tid 12470] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Wed Apr 08 20:23:02.338146 2026] [:error] [pid 12453:tid 12465] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Wed Apr 08 20:23:02.597174 2026] [:error] [pid 12453:tid 12456] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Wed Apr 08 20:23:02.856983 2026] [:error] [pid 12453:tid 12468] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Apr 08 20:23:03.136657 2026] [:error] [pid 12453:tid 12466] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Apr 08 20:23:03.392416 2026] [:error] [pid 12453:tid 12473] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/ee.php
[Wed Apr 08 20:23:03.813145 2026] [:error] [pid 12453:tid 12471] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Wed Apr 08 20:23:04.332576 2026] [:error] [pid 12453:tid 12474] [client 74.248.135.90:65067] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Wed Apr 08 20:23:04.596474 2026] [:error] [pid 12453:tid 12467] [client 74.248.135.90:65067] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/02.php"] [unique_id "adZIqBjtW7S6XsLPvrQd1wAAAIw"]
[Wed Apr 08 20:23:33.578352 2026] [:error] [pid 64066:tid 64093] [client 74.248.135.90:65149] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2.php"] [unique_id "adZIxVR3WucJgr2vZGY2UQAAAVg"]
[Wed Apr 08 20:23:38.237554 2026] [:error] [pid 7047:tid 7070] [client 74.248.135.90:62832] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adZIyuNh3oGO3pKiCzwGKAAAAZU"]
[Wed Apr 08 20:24:13.442927 2026] [:error] [pid 12386:tid 12434] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Apr 08 20:24:13.707113 2026] [:error] [pid 12386:tid 12423] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Apr 08 20:24:13.970462 2026] [:error] [pid 12386:tid 12420] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Wed Apr 08 20:24:14.249111 2026] [:error] [pid 12386:tid 12429] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Wed Apr 08 20:24:14.521459 2026] [:error] [pid 12386:tid 12427] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Wed Apr 08 20:24:14.807687 2026] [:error] [pid 12386:tid 12431] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/cf.php
[Wed Apr 08 20:24:16.132243 2026] [:error] [pid 12386:tid 12431] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/456.php
[Wed Apr 08 20:24:16.417865 2026] [:error] [pid 12386:tid 12428] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Wed Apr 08 20:24:16.706957 2026] [:error] [pid 12386:tid 12424] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/2x.php
[Wed Apr 08 20:24:17.102824 2026] [:error] [pid 12386:tid 12435] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Apr 08 20:24:17.360934 2026] [:error] [pid 12386:tid 12439] [client 74.248.135.90:65122] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 08 20:24:17.616334 2026] [:error] [pid 12386:tid 12426] [client 74.248.135.90:65122] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pepe.php"] [unique_id "adZI8RLhhLtqHi2gK7UUngAAAQo"]
[Wed Apr 08 20:24:20.271352 2026] [:error] [pid 12490:tid 12505] [client 74.248.135.90:62942] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pepe.php"] [unique_id "adZI9G1Fea4F4fbumr36bQAAAM0"]
[Wed Apr 08 20:24:32.836482 2026] [:error] [pid 12490:tid 12512] [client 74.248.135.90:62823] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "adZJAG1Fea4F4fbumr36dAAAANQ"]
[Wed Apr 08 20:24:33.686712 2026] [:error] [pid 64066:tid 64081] [client 74.248.135.90:64714] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "adZJAVR3WucJgr2vZGY2sAAAAUw"]
[Wed Apr 08 20:24:38.675596 2026] [:error] [pid 35642:tid 35656] [client 74.248.135.90:64752] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "adZJBg-CqryxdEs5DN9VswAAAEw"]
[Wed Apr 08 20:24:49.217581 2026] [:error] [pid 12453:tid 12461] [client 74.248.135.90:62912] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file32.php"] [unique_id "adZJERjtW7S6XsLPvrQeegAAAIY"]
[Wed Apr 08 20:24:58.806318 2026] [:error] [pid 35642:tid 35655] [client 74.248.135.90:64355] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adZJGg-CqryxdEs5DN9VyQAAAEs"]
[Wed Apr 08 20:25:01.137212 2026] [:error] [pid 12453:tid 12478] [client 74.248.135.90:62791] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adZJHRjtW7S6XsLPvrQepwAAAJc"]
[Wed Apr 08 20:25:03.747707 2026] [:error] [pid 12490:tid 12509] [client 74.248.135.90:65103] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adZJH21Fea4F4fbumr36pQAAANE"]
[Wed Apr 08 20:25:40.706965 2026] [:error] [pid 64066:tid 64093] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Apr 08 20:25:42.106333 2026] [:error] [pid 64066:tid 64093] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Wed Apr 08 20:25:43.664283 2026] [:error] [pid 64066:tid 64093] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Wed Apr 08 20:25:43.920502 2026] [:error] [pid 64066:tid 64089] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/ll.php
[Wed Apr 08 20:25:44.436553 2026] [:error] [pid 64066:tid 64076] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Apr 08 20:25:44.693924 2026] [:error] [pid 64066:tid 64088] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Apr 08 20:25:44.970593 2026] [:error] [pid 64066:tid 64086] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-gr.php
[Wed Apr 08 20:25:45.250473 2026] [:error] [pid 64066:tid 64073] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/asus.php
[Wed Apr 08 20:25:45.510533 2026] [:error] [pid 64066:tid 64075] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 08 20:25:45.768093 2026] [:error] [pid 64066:tid 64090] [client 74.248.135.90:65030] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Apr 08 20:25:46.042785 2026] [:error] [pid 64066:tid 64074] [client 74.248.135.90:65030] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "adZJSlR3WucJgr2vZGY3LAAAAUU"]
[Wed Apr 08 20:25:47.158310 2026] [:error] [pid 7047:tid 7065] [client 74.248.135.90:64751] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-mn.php"] [unique_id "adZJS-Nh3oGO3pKiCzwG6QAAAZA"]
[Wed Apr 08 20:26:20.595122 2026] [:error] [pid 12386:tid 12425] [client 74.248.135.90:65071] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adZJbBLhhLtqHi2gK7UVFAAAAQk"]
[Wed Apr 08 20:26:23.248933 2026] [:error] [pid 64066:tid 64088] [client 74.248.135.90:65059] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adZJb1R3WucJgr2vZGY3TgAAAVM"]
[Wed Apr 08 20:26:25.998857 2026] [:error] [pid 7047:tid 7054] [client 74.248.135.90:64667] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adZJceNh3oGO3pKiCzwHIAAAAYU"]
[Wed Apr 08 20:26:58.212378 2026] [:error] [pid 12385:tid 12397] [client 74.248.135.90:62924] File does not exist: /usr/local/apache/htdocs/suspended-page/html.php
[Thu Apr 09 13:20:19.347452 2026] [:error] [pid 24927:tid 24946] [client 221.121.110.91:46873] [client 221.121.110.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 221.121.110.91, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adc3EzXObuzEuw8mNJtVAAAAARA"]
[Thu Apr 09 13:20:19.352382 2026] [:error] [pid 24927:tid 24946] [client 221.121.110.91:46873] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 09 13:55:37.841572 2026] [:error] [pid 24927:tid 24933] [client 20.220.57.112:27739] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 14:00:16.807383 2026] [:error] [pid 24515:tid 24521] [client 20.63.32.44:38681] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 14:13:01.854768 2026] [:error] [pid 24927:tid 24939] [client 20.220.57.112:27783] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 14:52:01.815694 2026] [:error] [pid 24624:tid 24647] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/xfile25.php
[Thu Apr 09 14:52:02.055260 2026] [:error] [pid 24624:tid 24644] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Thu Apr 09 14:52:02.324959 2026] [:error] [pid 24624:tid 24646] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/azs.php
[Thu Apr 09 14:52:02.565763 2026] [:error] [pid 24624:tid 24638] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Thu Apr 09 14:52:02.803779 2026] [:error] [pid 24624:tid 24634] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/awa.php
[Thu Apr 09 14:52:03.043268 2026] [:error] [pid 24624:tid 24642] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Thu Apr 09 14:52:03.283449 2026] [:error] [pid 24624:tid 24629] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/popo.php
[Thu Apr 09 14:52:03.525294 2026] [:error] [pid 24624:tid 24641] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/syndicate.php
[Thu Apr 09 14:52:03.764536 2026] [:error] [pid 24624:tid 24635] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Thu Apr 09 14:52:04.003074 2026] [:error] [pid 24624:tid 24640] [client 20.203.230.84:28182] File does not exist: /usr/local/apache/htdocs/suspended-page/ll.php
[Thu Apr 09 14:52:04.268088 2026] [:error] [pid 24624:tid 24639] [client 20.203.230.84:28182] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxx.php"] [unique_id "addMlO4Jn-WvK1ZBTviB6gAAAM0"]
[Thu Apr 09 14:52:04.770605 2026] [:error] [pid 24517:tid 24580] [client 20.203.230.84:28746] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxx.php"] [unique_id "addMlHboYEn2ZFM_PS9OxQAAAIY"]
[Thu Apr 09 14:52:05.253576 2026] [:error] [pid 24624:tid 24644] [client 20.203.230.84:29796] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxx.php"] [unique_id "addMle4Jn-WvK1ZBTviB7wAAANI"]
[Thu Apr 09 14:52:05.861446 2026] [:error] [pid 24517:tid 24590] [client 20.203.230.84:28166] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-cxx.php"] [unique_id "addMlXboYEn2ZFM_PS9OxgAAAJA"]
[Thu Apr 09 14:52:07.949291 2026] [:error] [pid 24517:tid 24595] [client 20.203.230.84:28275] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "addMl3boYEn2ZFM_PS9OzwAAAJU"]
[Thu Apr 09 14:52:08.528406 2026] [:error] [pid 24517:tid 24588] [client 20.203.230.84:29188] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "addMmHboYEn2ZFM_PS9O0AAAAI4"]
[Thu Apr 09 14:52:09.638808 2026] [:error] [pid 24516:tid 24570] [client 20.203.230.84:28780] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "addMmdhW7vSS-UkeWCX7aQAAAFc"]
[Thu Apr 09 14:52:10.453302 2026] [:error] [pid 24927:tid 24950] [client 20.203.230.84:28253] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "addMmjXObuzEuw8mNJt-pwAAARQ"]
[Thu Apr 09 14:52:12.131840 2026] [:error] [pid 24927:tid 24940] [client 20.203.230.84:30235] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "addMnDXObuzEuw8mNJt-rgAAAQo"]
[Thu Apr 09 14:52:12.839804 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:29281] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "addMnDXObuzEuw8mNJt-tQAAARM"]
[Thu Apr 09 14:52:13.703366 2026] [:error] [pid 24927:tid 24952] [client 20.203.230.84:29266] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "addMnTXObuzEuw8mNJt-vwAAARY"]
[Thu Apr 09 14:52:14.493425 2026] [:error] [pid 24624:tid 24635] [client 20.203.230.84:30232] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "addMnu4Jn-WvK1ZBTviCDwAAAMk"]
[Thu Apr 09 14:52:15.269523 2026] [:error] [pid 24624:tid 24627] [client 20.203.230.84:29780] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "addMn-4Jn-WvK1ZBTviCFgAAAME"]
[Thu Apr 09 14:52:16.259621 2026] [:error] [pid 24624:tid 24642] [client 20.203.230.84:28693] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "addMoO4Jn-WvK1ZBTviCHwAAANA"]
[Thu Apr 09 14:52:17.192204 2026] [:error] [pid 24515:tid 24528] [client 20.203.230.84:28167] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "addMoa1OMnvM2fMnB1M74AAAAAk"]
[Thu Apr 09 14:52:17.899814 2026] [:error] [pid 24927:tid 24951] [client 20.203.230.84:28248] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "addMoTXObuzEuw8mNJt-6gAAARU"]
[Thu Apr 09 14:52:18.743012 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:29208] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "addMojXObuzEuw8mNJt-9gAAAQA"]
[Thu Apr 09 14:52:19.573673 2026] [:error] [pid 24515:tid 24527] [client 20.203.230.84:29706] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "addMo61OMnvM2fMnB1M75AAAAAg"]
[Thu Apr 09 14:52:20.248412 2026] [:error] [pid 24927:tid 24942] [client 20.203.230.84:29705] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "addMpDXObuzEuw8mNJt-_gAAAQw"]
[Thu Apr 09 14:52:21.271734 2026] [:error] [pid 24624:tid 24630] [client 20.203.230.84:28749] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "addMpe4Jn-WvK1ZBTviCPQAAAMQ"]
[Thu Apr 09 14:52:21.814370 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:30622] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "addMpTXObuzEuw8mNJt_BAAAAQc"]
[Thu Apr 09 14:52:23.701961 2026] [:error] [pid 24516:tid 24568] [client 20.203.230.84:29246] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "addMp9hW7vSS-UkeWCX7cgAAAFU"]
[Thu Apr 09 14:52:24.467953 2026] [:error] [pid 24517:tid 24578] [client 20.203.230.84:28165] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "addMqHboYEn2ZFM_PS9O8QAAAIQ"]
[Thu Apr 09 14:52:25.582127 2026] [:error] [pid 24927:tid 24954] [client 20.203.230.84:29272] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "addMqTXObuzEuw8mNJt_CwAAARg"]
[Thu Apr 09 14:52:26.449744 2026] [:error] [pid 24927:tid 24952] [client 20.203.230.84:29197] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "addMqjXObuzEuw8mNJt_DQAAARY"]
[Thu Apr 09 14:52:28.087136 2026] [:error] [pid 24624:tid 24648] [client 20.203.230.84:30644] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "addMrO4Jn-WvK1ZBTviCUwAAANY"]
[Thu Apr 09 14:52:28.965543 2026] [:error] [pid 24624:tid 24631] [client 20.203.230.84:29294] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "addMrO4Jn-WvK1ZBTviCWQAAAMU"]
[Thu Apr 09 14:52:29.673319 2026] [:error] [pid 24927:tid 24946] [client 20.203.230.84:30243] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "addMrTXObuzEuw8mNJt_IwAAARA"]
[Thu Apr 09 14:52:30.289408 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:29812] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "addMrjXObuzEuw8mNJt_JwAAAQI"]
[Thu Apr 09 14:52:30.855129 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:29763] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "addMrjXObuzEuw8mNJt_KQAAAQU"]
[Thu Apr 09 14:52:31.423076 2026] [:error] [pid 24927:tid 24934] [client 20.203.230.84:30656] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "addMrzXObuzEuw8mNJt_LwAAAQQ"]
[Thu Apr 09 14:52:31.936987 2026] [:error] [pid 24517:tid 24582] [client 20.203.230.84:28744] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "addMr3boYEn2ZFM_PS9O-AAAAIg"]
[Thu Apr 09 14:52:32.569030 2026] [:error] [pid 24927:tid 24951] [client 20.203.230.84:27758] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "addMsDXObuzEuw8mNJt_MwAAARU"]
[Thu Apr 09 14:52:33.381903 2026] [:error] [pid 24927:tid 24940] [client 20.203.230.84:28761] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "addMsTXObuzEuw8mNJt_NgAAAQo"]
[Thu Apr 09 14:52:34.029032 2026] [:error] [pid 24517:tid 24598] [client 20.203.230.84:29236] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "addMsnboYEn2ZFM_PS9O-QAAAJg"]
[Thu Apr 09 14:52:34.827396 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:30225] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "addMsjXObuzEuw8mNJt_PgAAAQI"]
[Thu Apr 09 14:52:35.586438 2026] [:error] [pid 24624:tid 24637] [client 20.203.230.84:30594] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "addMs-4Jn-WvK1ZBTviCZgAAAMs"]
[Thu Apr 09 14:52:36.181125 2026] [:error] [pid 24516:tid 24555] [client 20.203.230.84:30705] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "addMtNhW7vSS-UkeWCX7fgAAAEg"]
[Thu Apr 09 14:52:36.961496 2026] [:error] [pid 24624:tid 24640] [client 20.203.230.84:29290] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "addMtO4Jn-WvK1ZBTviCagAAAM4"]
[Thu Apr 09 14:52:37.553584 2026] [:error] [pid 24517:tid 24594] [client 20.203.230.84:29800] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "addMtXboYEn2ZFM_PS9PAAAAAJQ"]
[Thu Apr 09 14:52:38.213193 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:29194] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "addMtjXObuzEuw8mNJt_QwAAAQU"]
[Thu Apr 09 14:52:38.837817 2026] [:error] [pid 24517:tid 24582] [client 20.203.230.84:28266] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "addMtnboYEn2ZFM_PS9PCAAAAIg"]
[Thu Apr 09 14:52:39.545937 2026] [:error] [pid 24517:tid 24581] [client 20.203.230.84:29249] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "addMt3boYEn2ZFM_PS9PCgAAAIc"]
[Thu Apr 09 14:52:40.400022 2026] [:error] [pid 24927:tid 24931] [client 20.203.230.84:28758] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "addMuDXObuzEuw8mNJt_TQAAAQE"]
[Thu Apr 09 14:52:41.269662 2026] [:error] [pid 24517:tid 24575] [client 20.203.230.84:28772] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "addMuXboYEn2ZFM_PS9PDQAAAIE"]
[Thu Apr 09 14:52:42.298796 2026] [:error] [pid 24517:tid 24576] [client 20.203.230.84:30633] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "addMunboYEn2ZFM_PS9PDgAAAII"]
[Thu Apr 09 14:52:43.326610 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:30669] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "addMuzXObuzEuw8mNJt_VQAAAQU"]
[Thu Apr 09 14:52:44.011199 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:30610] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "addMvDXObuzEuw8mNJt_XQAAAQI"]
[Thu Apr 09 14:52:44.688997 2026] [:error] [pid 24517:tid 24579] [client 20.203.230.84:29774] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qqa.php"] [unique_id "addMvHboYEn2ZFM_PS9PEAAAAIU"]
[Thu Apr 09 14:52:45.288513 2026] [:error] [pid 24517:tid 24589] [client 20.203.230.84:29226] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qqa.php"] [unique_id "addMvXboYEn2ZFM_PS9PEgAAAI8"]
[Thu Apr 09 14:52:45.889072 2026] [:error] [pid 24624:tid 24628] [client 20.203.230.84:30304] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qqa.php"] [unique_id "addMve4Jn-WvK1ZBTviCdAAAAMI"]
[Thu Apr 09 14:52:46.380218 2026] [:error] [pid 24517:tid 24590] [client 20.203.230.84:28791] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/qqa.php"] [unique_id "addMvnboYEn2ZFM_PS9PGQAAAJA"]
[Thu Apr 09 14:52:47.061219 2026] [:error] [pid 24927:tid 24954] [client 20.203.230.84:29275] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "addMvzXObuzEuw8mNJt_aAAAARg"]
[Thu Apr 09 14:52:47.640131 2026] [:error] [pid 24927:tid 24934] [client 20.203.230.84:30322] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "addMvzXObuzEuw8mNJt_awAAAQQ"]
[Thu Apr 09 14:52:48.460049 2026] [:error] [pid 24624:tid 24630] [client 20.203.230.84:30220] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "addMwO4Jn-WvK1ZBTviCkAAAAMQ"]
[Thu Apr 09 14:52:49.069873 2026] [:error] [pid 24624:tid 24636] [client 20.203.230.84:30321] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "addMwe4Jn-WvK1ZBTviCngAAAMo"]
[Thu Apr 09 14:52:49.678330 2026] [:error] [pid 24517:tid 24598] [client 20.203.230.84:30294] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "addMwXboYEn2ZFM_PS9PGgAAAJg"]
[Thu Apr 09 14:53:21.840763 2026] [:error] [pid 24517:tid 24582] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Thu Apr 09 14:53:22.078820 2026] [:error] [pid 24517:tid 24577] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 09 14:53:22.318702 2026] [:error] [pid 24517:tid 24585] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Thu Apr 09 14:53:22.560494 2026] [:error] [pid 24517:tid 24579] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Thu Apr 09 14:53:22.806427 2026] [:error] [pid 24517:tid 24598] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Thu Apr 09 14:53:23.045762 2026] [:error] [pid 24517:tid 24590] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Thu Apr 09 14:53:23.338067 2026] [:error] [pid 24517:tid 24574] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Thu Apr 09 14:53:23.577485 2026] [:error] [pid 24517:tid 24583] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Thu Apr 09 14:53:23.876783 2026] [:error] [pid 24517:tid 24581] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Thu Apr 09 14:53:24.116092 2026] [:error] [pid 24517:tid 24595] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/.mopj.php
[Thu Apr 09 14:53:24.405408 2026] [:error] [pid 24517:tid 24597] [client 20.203.230.84:31676] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Thu Apr 09 14:53:24.653838 2026] [:error] [pid 24517:tid 24588] [client 20.203.230.84:31676] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "addM5HboYEn2ZFM_PS9PdgAAAI4"]
[Thu Apr 09 14:53:25.206510 2026] [:error] [pid 24516:tid 24569] [client 20.203.230.84:29708] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "addM5dhW7vSS-UkeWCX7wAAAAFY"]
[Thu Apr 09 14:53:25.725766 2026] [:error] [pid 24624:tid 24649] [client 20.203.230.84:31710] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "addM5e4Jn-WvK1ZBTviDLQAAANc"]
[Thu Apr 09 14:53:26.501356 2026] [:error] [pid 24515:tid 24531] [client 20.203.230.84:30659] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "addM5q1OMnvM2fMnB1M8PQAAAAw"]
[Thu Apr 09 14:53:27.115874 2026] [:error] [pid 24624:tid 24632] [client 20.203.230.84:30631] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "addM5-4Jn-WvK1ZBTviDLwAAAMY"]
[Thu Apr 09 14:53:27.711503 2026] [:error] [pid 24515:tid 24539] [client 20.203.230.84:30659] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "addM561OMnvM2fMnB1M8RwAAABQ"]
[Thu Apr 09 14:53:28.412289 2026] [:error] [pid 24515:tid 24525] [client 20.203.230.84:30691] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "addM6K1OMnvM2fMnB1M8SwAAAAY"]
[Thu Apr 09 14:53:29.172626 2026] [:error] [pid 24516:tid 24570] [client 20.203.230.84:31117] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "addM6dhW7vSS-UkeWCX70QAAAFc"]
[Thu Apr 09 14:53:29.656188 2026] [:error] [pid 24516:tid 24560] [client 20.203.230.84:28770] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "addM6dhW7vSS-UkeWCX71gAAAE0"]
[Thu Apr 09 14:53:30.341668 2026] [:error] [pid 24927:tid 24942] [client 20.203.230.84:31623] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "addM6jXObuzEuw8mNJuAzwAAAQw"]
[Thu Apr 09 14:53:31.101311 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:27760] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "addM6zXObuzEuw8mNJuA1AAAAQI"]
[Thu Apr 09 14:53:31.590810 2026] [:error] [pid 24927:tid 24941] [client 20.203.230.84:29274] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "addM6zXObuzEuw8mNJuA1QAAAQs"]
[Thu Apr 09 14:53:32.293175 2026] [:error] [pid 24624:tid 24627] [client 20.203.230.84:30327] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "addM7O4Jn-WvK1ZBTviDPgAAAME"]
[Thu Apr 09 14:53:32.772991 2026] [:error] [pid 24927:tid 24933] [client 20.203.230.84:29258] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "addM7DXObuzEuw8mNJuA2gAAAQM"]
[Thu Apr 09 14:53:33.286014 2026] [:error] [pid 24517:tid 24578] [client 20.203.230.84:31658] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "addM7XboYEn2ZFM_PS9PegAAAIQ"]
[Thu Apr 09 14:53:33.782136 2026] [:error] [pid 24927:tid 24939] [client 20.203.230.84:31196] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "addM7TXObuzEuw8mNJuA3wAAAQk"]
[Thu Apr 09 14:53:34.344834 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:31688] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "addM7jXObuzEuw8mNJuA4wAAAQI"]
[Thu Apr 09 14:53:34.820198 2026] [:error] [pid 24927:tid 24934] [client 20.203.230.84:29261] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "addM7jXObuzEuw8mNJuA5QAAAQQ"]
[Thu Apr 09 14:53:35.310309 2026] [:error] [pid 24624:tid 24632] [client 20.203.230.84:31697] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "addM7-4Jn-WvK1ZBTviDQwAAAMY"]
[Thu Apr 09 14:53:35.829602 2026] [:error] [pid 24624:tid 24648] [client 20.203.230.84:30713] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "addM7-4Jn-WvK1ZBTviDRwAAANY"]
[Thu Apr 09 14:53:36.787729 2026] [:error] [pid 24517:tid 24588] [client 20.203.230.84:31651] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "addM8HboYEn2ZFM_PS9PhgAAAI4"]
[Thu Apr 09 14:53:37.351010 2026] [:error] [pid 24624:tid 24639] [client 20.203.230.84:27649] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "addM8e4Jn-WvK1ZBTviDUgAAAM0"]
[Thu Apr 09 14:53:37.845199 2026] [:error] [pid 24517:tid 24596] [client 20.203.230.84:29761] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "addM8XboYEn2ZFM_PS9PjAAAAJY"]
[Thu Apr 09 14:53:38.593290 2026] [:error] [pid 24927:tid 24947] [client 20.203.230.84:31144] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "addM8jXObuzEuw8mNJuA7QAAARE"]
[Thu Apr 09 14:53:39.082394 2026] [:error] [pid 24624:tid 24630] [client 20.203.230.84:28727] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "addM8-4Jn-WvK1ZBTviDVwAAAMQ"]
[Thu Apr 09 14:53:39.611073 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:31152] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "addM8zXObuzEuw8mNJuA7wAAAQA"]
[Thu Apr 09 14:53:40.198225 2026] [:error] [pid 24517:tid 24597] [client 20.203.230.84:31116] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "addM9HboYEn2ZFM_PS9PlQAAAJc"]
[Thu Apr 09 14:53:40.796887 2026] [:error] [pid 24624:tid 24643] [client 20.203.230.84:31135] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "addM9O4Jn-WvK1ZBTviDYAAAANE"]
[Thu Apr 09 14:53:41.331229 2026] [:error] [pid 24624:tid 24633] [client 20.203.230.84:31121] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "addM9e4Jn-WvK1ZBTviDZwAAAMc"]
[Thu Apr 09 14:53:42.021192 2026] [:error] [pid 24516:tid 24565] [client 20.203.230.84:30623] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "addM9thW7vSS-UkeWCX76QAAAFI"]
[Thu Apr 09 14:53:42.674172 2026] [:error] [pid 24927:tid 24939] [client 20.203.230.84:31668] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "addM9jXObuzEuw8mNJuA9AAAAQk"]
[Thu Apr 09 14:53:43.201014 2026] [:error] [pid 24516:tid 24567] [client 20.203.230.84:31713] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "addM99hW7vSS-UkeWCX76wAAAFQ"]
[Thu Apr 09 14:53:43.800517 2026] [:error] [pid 24517:tid 24596] [client 20.203.230.84:31183] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "addM93boYEn2ZFM_PS9PmAAAAJY"]
[Thu Apr 09 14:53:44.301158 2026] [:error] [pid 24516:tid 24548] [client 20.203.230.84:31169] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "addM-NhW7vSS-UkeWCX77AAAAEE"]
[Thu Apr 09 14:53:44.851614 2026] [:error] [pid 24515:tid 24541] [client 20.203.230.84:30714] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "addM-K1OMnvM2fMnB1M8XQAAABY"]
[Thu Apr 09 14:53:45.337840 2026] [:error] [pid 24515:tid 24543] [client 20.203.230.84:30704] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "addM-a1OMnvM2fMnB1M8XwAAABg"]
[Thu Apr 09 14:53:45.880979 2026] [:error] [pid 24515:tid 24530] [client 20.203.230.84:31715] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "addM-a1OMnvM2fMnB1M8YAAAAAs"]
[Thu Apr 09 14:53:46.436900 2026] [:error] [pid 24927:tid 24933] [client 20.203.230.84:28223] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "addM-jXObuzEuw8mNJuA-QAAAQM"]
[Thu Apr 09 14:53:47.118693 2026] [:error] [pid 24516:tid 24569] [client 20.203.230.84:32222] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "addM-9hW7vSS-UkeWCX78wAAAFY"]
[Thu Apr 09 14:53:47.607792 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:30241] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "addM-zXObuzEuw8mNJuA-wAAARM"]
[Thu Apr 09 14:53:48.133556 2026] [:error] [pid 24516:tid 24563] [client 20.203.230.84:30665] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "addM_NhW7vSS-UkeWCX79AAAAFA"]
[Thu Apr 09 14:53:48.607184 2026] [:error] [pid 24517:tid 24580] [client 20.203.230.84:30310] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "addM_HboYEn2ZFM_PS9PsQAAAIY"]
[Thu Apr 09 14:53:49.186377 2026] [:error] [pid 24515:tid 24521] [client 20.203.230.84:31160] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "addM_a1OMnvM2fMnB1M8YgAAAAI"]
[Thu Apr 09 14:53:49.681842 2026] [:error] [pid 24624:tid 24639] [client 20.203.230.84:30324] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "addM_e4Jn-WvK1ZBTviDggAAAM0"]
[Thu Apr 09 14:53:50.201595 2026] [:error] [pid 24624:tid 24640] [client 20.203.230.84:27259] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "addM_u4Jn-WvK1ZBTviDigAAAM4"]
[Thu Apr 09 14:53:50.754501 2026] [:error] [pid 24927:tid 24942] [client 20.203.230.84:29248] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "addM_jXObuzEuw8mNJuBBQAAAQw"]
[Thu Apr 09 14:53:51.230093 2026] [:error] [pid 24517:tid 24581] [client 20.203.230.84:30638] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "addM_3boYEn2ZFM_PS9PswAAAIc"]
[Thu Apr 09 14:53:51.704966 2026] [:error] [pid 24927:tid 24941] [client 20.203.230.84:29791] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "addM_zXObuzEuw8mNJuBCAAAAQs"]
[Thu Apr 09 14:53:52.181694 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:31631] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "addNADXObuzEuw8mNJuBCgAAAQA"]
[Thu Apr 09 14:53:52.713504 2026] [:error] [pid 24927:tid 24931] [client 20.203.230.84:32148] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "addNADXObuzEuw8mNJuBEAAAAQE"]
[Thu Apr 09 14:53:53.370334 2026] [:error] [pid 24927:tid 24944] [client 20.203.230.84:32170] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "addNATXObuzEuw8mNJuBFwAAAQ4"]
[Thu Apr 09 14:53:53.887766 2026] [:error] [pid 24516:tid 24556] [client 20.203.230.84:28672] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "addNAdhW7vSS-UkeWCX7-QAAAEk"]
[Thu Apr 09 14:53:54.455215 2026] [:error] [pid 24515:tid 24528] [client 20.203.230.84:30261] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "addNAq1OMnvM2fMnB1M8ZQAAAAk"]
[Thu Apr 09 14:53:55.017376 2026] [:error] [pid 24927:tid 24931] [client 20.203.230.84:31165] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "addNAzXObuzEuw8mNJuBHwAAAQE"]
[Thu Apr 09 14:53:55.516801 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:30658] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "addNAzXObuzEuw8mNJuBJgAAAQc"]
[Thu Apr 09 14:53:55.993626 2026] [:error] [pid 24927:tid 24950] [client 20.203.230.84:30238] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "addNAzXObuzEuw8mNJuBKgAAARQ"]
[Thu Apr 09 14:53:56.565439 2026] [:error] [pid 24927:tid 24934] [client 20.203.230.84:30681] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "addNBDXObuzEuw8mNJuBMQAAAQQ"]
[Thu Apr 09 14:53:57.067072 2026] [:error] [pid 24517:tid 24593] [client 20.203.230.84:30249] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "addNBXboYEn2ZFM_PS9PuwAAAJM"]
[Thu Apr 09 14:53:57.542200 2026] [:error] [pid 24516:tid 24557] [client 20.203.230.84:31640] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "addNBdhW7vSS-UkeWCX7_QAAAEo"]
[Thu Apr 09 14:53:58.066468 2026] [:error] [pid 24516:tid 24550] [client 20.203.230.84:30648] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xa.php"] [unique_id "addNBthW7vSS-UkeWCX8AgAAAEM"]
[Thu Apr 09 14:53:58.558570 2026] [:error] [pid 24516:tid 24560] [client 20.203.230.84:31209] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "addNBthW7vSS-UkeWCX8CAAAAE0"]
[Thu Apr 09 14:53:59.096377 2026] [:error] [pid 24927:tid 24948] [client 20.203.230.84:32153] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "addNBzXObuzEuw8mNJuBNwAAARI"]
[Thu Apr 09 14:53:59.578820 2026] [:error] [pid 24927:tid 24939] [client 20.203.230.84:31211] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "addNBzXObuzEuw8mNJuBPAAAAQk"]
[Thu Apr 09 14:54:00.156943 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:30313] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "addNCDXObuzEuw8mNJuBQQAAAQc"]
[Thu Apr 09 14:54:00.636688 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:31704] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "addNCDXObuzEuw8mNJuBRQAAAQU"]
[Thu Apr 09 14:54:01.206425 2026] [:error] [pid 24516:tid 24558] [client 20.203.230.84:30328] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "addNCdhW7vSS-UkeWCX8DAAAAEs"]
[Thu Apr 09 14:54:02.036323 2026] [:error] [pid 24517:tid 24582] [client 20.203.230.84:30222] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "addNCnboYEn2ZFM_PS9PwAAAAIg"]
[Thu Apr 09 14:54:02.569077 2026] [:error] [pid 24624:tid 24650] [client 20.203.230.84:32152] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "addNCu4Jn-WvK1ZBTviDmgAAANg"]
[Thu Apr 09 14:54:03.156612 2026] [:error] [pid 24515:tid 24529] [client 20.203.230.84:28780] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNC61OMnvM2fMnB1M8ggAAAAo"]
[Thu Apr 09 14:54:03.688878 2026] [:error] [pid 24517:tid 24586] [client 20.203.230.84:31210] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNC3boYEn2ZFM_PS9PwgAAAIw"]
[Thu Apr 09 14:54:04.302685 2026] [:error] [pid 24517:tid 24581] [client 20.203.230.84:30311] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNDHboYEn2ZFM_PS9PxAAAAIc"]
[Thu Apr 09 14:54:04.785496 2026] [:error] [pid 24517:tid 24585] [client 20.203.230.84:31714] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNDHboYEn2ZFM_PS9PxgAAAIs"]
[Thu Apr 09 14:54:05.355199 2026] [:error] [pid 24517:tid 24592] [client 20.203.230.84:31723] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "addNDXboYEn2ZFM_PS9PxwAAAJI"]
[Thu Apr 09 14:54:05.923358 2026] [:error] [pid 24516:tid 24557] [client 20.203.230.84:28177] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "addNDdhW7vSS-UkeWCX8HQAAAEo"]
[Thu Apr 09 14:54:06.469115 2026] [:error] [pid 24515:tid 24527] [client 20.203.230.84:31679] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "addNDq1OMnvM2fMnB1M8mQAAAAg"]
[Thu Apr 09 14:54:06.975599 2026] [:error] [pid 24624:tid 24646] [client 20.203.230.84:30267] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "addNDu4Jn-WvK1ZBTviDoAAAANQ"]
[Thu Apr 09 14:54:07.511837 2026] [:error] [pid 24624:tid 24634] [client 20.203.230.84:31626] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "addND-4Jn-WvK1ZBTviDpgAAAMg"]
[Thu Apr 09 14:54:08.014499 2026] [:error] [pid 24624:tid 24636] [client 20.203.230.84:31621] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "addNEO4Jn-WvK1ZBTviDqwAAAMo"]
[Thu Apr 09 14:54:08.589629 2026] [:error] [pid 24624:tid 24631] [client 20.203.230.84:30251] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "addNEO4Jn-WvK1ZBTviDuwAAAMU"]
[Thu Apr 09 14:54:09.119397 2026] [:error] [pid 24927:tid 24931] [client 20.203.230.84:30663] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "addNETXObuzEuw8mNJuBVgAAAQE"]
[Thu Apr 09 14:54:09.769487 2026] [:error] [pid 24927:tid 24936] [client 20.203.230.84:30247] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "addNETXObuzEuw8mNJuBWwAAAQY"]
[Thu Apr 09 14:54:10.329598 2026] [:error] [pid 24927:tid 24948] [client 20.203.230.84:32176] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "addNEjXObuzEuw8mNJuBYAAAARI"]
[Thu Apr 09 14:54:11.258803 2026] [:error] [pid 24517:tid 24582] [client 20.203.230.84:31709] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "addNE3boYEn2ZFM_PS9P0QAAAIg"]
[Thu Apr 09 14:54:11.826587 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:28765] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no1.php"] [unique_id "addNEzXObuzEuw8mNJuBZwAAARM"]
[Thu Apr 09 14:54:12.395367 2026] [:error] [pid 24516:tid 24570] [client 20.203.230.84:31109] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "addNFNhW7vSS-UkeWCX8IAAAAFc"]
[Thu Apr 09 14:54:13.220077 2026] [:error] [pid 24624:tid 24646] [client 20.203.230.84:32181] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "addNFe4Jn-WvK1ZBTviDwwAAANQ"]
[Thu Apr 09 14:54:13.775363 2026] [:error] [pid 24624:tid 24638] [client 20.203.230.84:32649] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "addNFe4Jn-WvK1ZBTviDxgAAAMw"]
[Thu Apr 09 14:54:14.892776 2026] [:error] [pid 24624:tid 24636] [client 20.203.230.84:29696] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w2025.php"] [unique_id "addNFu4Jn-WvK1ZBTviDzgAAAMo"]
[Thu Apr 09 14:54:15.500189 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:32755] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "addNFzXObuzEuw8mNJuBcAAAAQA"]
[Thu Apr 09 14:54:16.054502 2026] [:error] [pid 24927:tid 24944] [client 20.203.230.84:32214] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "addNGDXObuzEuw8mNJuBcQAAAQ4"]
[Thu Apr 09 14:54:16.615886 2026] [:error] [pid 24927:tid 24941] [client 20.203.230.84:32227] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "addNGDXObuzEuw8mNJuBcgAAAQs"]
[Thu Apr 09 14:54:17.703064 2026] [:error] [pid 24927:tid 24936] [client 20.203.230.84:30244] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "addNGTXObuzEuw8mNJuBdAAAAQY"]
[Thu Apr 09 14:54:18.461838 2026] [:error] [pid 24516:tid 24552] [client 20.203.230.84:30699] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "addNGthW7vSS-UkeWCX8IwAAAEU"]
[Thu Apr 09 14:54:19.295940 2026] [:error] [pid 24927:tid 24943] [client 20.203.230.84:31683] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "addNGzXObuzEuw8mNJuBfQAAAQ0"]
[Thu Apr 09 14:54:19.840929 2026] [:error] [pid 24927:tid 24954] [client 20.203.230.84:31643] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "addNGzXObuzEuw8mNJuBfwAAARg"]
[Thu Apr 09 14:54:20.349059 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:32643] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "addNHDXObuzEuw8mNJuBggAAARM"]
[Thu Apr 09 14:54:20.825056 2026] [:error] [pid 24927:tid 24946] [client 20.203.230.84:30601] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "addNHDXObuzEuw8mNJuBhQAAARA"]
[Thu Apr 09 14:54:21.386055 2026] [:error] [pid 24624:tid 24642] [client 20.203.230.84:29288] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "addNHe4Jn-WvK1ZBTviD2AAAANA"]
[Thu Apr 09 14:54:21.938147 2026] [:error] [pid 24624:tid 24634] [client 20.203.230.84:31686] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "addNHe4Jn-WvK1ZBTviD3AAAAMg"]
[Thu Apr 09 14:54:22.428652 2026] [:error] [pid 24517:tid 24583] [client 20.203.230.84:30330] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "addNHnboYEn2ZFM_PS9P0wAAAIk"]
[Thu Apr 09 14:54:23.042867 2026] [:error] [pid 24624:tid 24632] [client 20.203.230.84:30621] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "addNH-4Jn-WvK1ZBTviD4QAAAMY"]
[Thu Apr 09 14:54:23.672008 2026] [:error] [pid 24517:tid 24587] [client 20.203.230.84:30329] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "addNH3boYEn2ZFM_PS9P1AAAAI0"]
[Thu Apr 09 14:54:24.275729 2026] [:error] [pid 24927:tid 24939] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 09 14:54:24.874130 2026] [:error] [pid 24927:tid 24947] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Apr 09 14:54:25.191365 2026] [:error] [pid 24927:tid 24944] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Thu Apr 09 14:54:25.464096 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Thu Apr 09 14:54:25.703409 2026] [:error] [pid 24927:tid 24950] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Thu Apr 09 14:54:26.070688 2026] [:error] [pid 24927:tid 24938] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 09 14:54:26.319305 2026] [:error] [pid 24927:tid 24947] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Apr 09 14:54:26.558199 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 09 14:54:26.861303 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 09 14:54:27.653987 2026] [:error] [pid 24927:tid 24938] [client 20.203.230.84:31685] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "addNIzXObuzEuw8mNJuBwQAAAQg"]
[Thu Apr 09 14:54:28.132820 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:32711] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "addNJDXObuzEuw8mNJuBxgAAAQA"]
[Thu Apr 09 14:54:28.939609 2026] [:error] [pid 24624:tid 24639] [client 20.203.230.84:30632] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "addNJO4Jn-WvK1ZBTviD7AAAAM0"]
[Thu Apr 09 14:54:29.434110 2026] [:error] [pid 24927:tid 24943] [client 20.203.230.84:32660] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "addNJTXObuzEuw8mNJuB0QAAAQ0"]
[Thu Apr 09 14:54:29.948880 2026] [:error] [pid 24516:tid 24558] [client 20.203.230.84:30257] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "addNJdhW7vSS-UkeWCX8KQAAAEs"]
[Thu Apr 09 14:54:30.499138 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:32178] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "addNJjXObuzEuw8mNJuB3AAAARM"]
[Thu Apr 09 14:54:30.996049 2026] [:error] [pid 24927:tid 24951] [client 20.203.230.84:32166] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "addNJjXObuzEuw8mNJuB4gAAARU"]
[Thu Apr 09 14:54:31.479166 2026] [:error] [pid 24927:tid 24944] [client 20.203.230.84:31149] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "addNJzXObuzEuw8mNJuB6QAAAQ4"]
[Thu Apr 09 14:54:32.010325 2026] [:error] [pid 24516:tid 24548] [client 20.203.230.84:32731] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "addNKNhW7vSS-UkeWCX8KwAAAEE"]
[Thu Apr 09 14:54:32.638404 2026] [:error] [pid 24624:tid 24644] [client 20.203.230.84:32206] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "addNKO4Jn-WvK1ZBTviD8QAAANI"]
[Thu Apr 09 14:54:33.127310 2026] [:error] [pid 24624:tid 24629] [client 20.203.230.84:28759] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "addNKe4Jn-WvK1ZBTviD8wAAAMM"]
[Thu Apr 09 14:54:35.767962 2026] [:error] [pid 24515:tid 24537] [client 20.203.230.84:30335] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "addNK61OMnvM2fMnB1M82gAAABI"]
[Thu Apr 09 14:54:36.257133 2026] [:error] [pid 24515:tid 24527] [client 20.203.230.84:30252] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "addNLK1OMnvM2fMnB1M82wAAAAg"]
[Thu Apr 09 14:54:36.747632 2026] [:error] [pid 24517:tid 24594] [client 20.203.230.84:31228] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "addNLHboYEn2ZFM_PS9P2AAAAJQ"]
[Thu Apr 09 14:54:37.267222 2026] [:error] [pid 24515:tid 24533] [client 20.203.230.84:32734] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "addNLa1OMnvM2fMnB1M83QAAAA4"]
[Thu Apr 09 14:54:38.222483 2026] [:error] [pid 24515:tid 24540] [client 20.203.230.84:31678] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "addNLq1OMnvM2fMnB1M83gAAABU"]
[Thu Apr 09 14:54:38.735771 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:31728] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "addNLjXObuzEuw8mNJuCEAAAAQA"]
[Thu Apr 09 14:54:39.305889 2026] [:error] [pid 24927:tid 24942] [client 20.203.230.84:30664] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "addNLzXObuzEuw8mNJuCEwAAAQw"]
[Thu Apr 09 14:54:39.876521 2026] [:error] [pid 24927:tid 24950] [client 20.203.230.84:30672] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "addNLzXObuzEuw8mNJuCFwAAARQ"]
[Thu Apr 09 14:54:40.469936 2026] [:error] [pid 24516:tid 24561] [client 20.203.230.84:30673] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "addNMNhW7vSS-UkeWCX8OAAAAE4"]
[Thu Apr 09 14:54:41.460037 2026] [:error] [pid 24517:tid 24584] [client 20.203.230.84:31632] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "addNMXboYEn2ZFM_PS9P2wAAAIo"]
[Thu Apr 09 14:54:42.064028 2026] [:error] [pid 24624:tid 24626] [client 20.203.230.84:32655] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "addNMu4Jn-WvK1ZBTviECAAAAMA"]
[Thu Apr 09 14:54:43.151179 2026] [:error] [pid 24517:tid 24582] [client 20.203.230.84:32143] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "addNM3boYEn2ZFM_PS9P3AAAAIg"]
[Thu Apr 09 14:54:43.857209 2026] [:error] [pid 24927:tid 24954] [client 20.203.230.84:32725] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "addNMzXObuzEuw8mNJuCHAAAARg"]
[Thu Apr 09 14:54:44.347766 2026] [:error] [pid 24515:tid 24541] [client 20.203.230.84:28255] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addNNK1OMnvM2fMnB1M8-QAAABY"]
[Thu Apr 09 14:54:44.838214 2026] [:error] [pid 24516:tid 24567] [client 20.203.230.84:30608] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addNNNhW7vSS-UkeWCX8PAAAAFQ"]
[Thu Apr 09 14:54:45.549770 2026] [:error] [pid 24516:tid 24562] [client 20.203.230.84:33174] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addNNdhW7vSS-UkeWCX8PgAAAE8"]
[Thu Apr 09 14:54:46.392057 2026] [:error] [pid 24624:tid 24646] [client 20.203.230.84:33194] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addNNu4Jn-WvK1ZBTviEEAAAANQ"]
[Thu Apr 09 14:54:49.590952 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:32174] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addNOTXObuzEuw8mNJuCHwAAARM"]
[Thu Apr 09 14:54:50.189546 2026] [:error] [pid 24517:tid 24575] [client 20.203.230.84:30620] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addNOnboYEn2ZFM_PS9P5wAAAIE"]
[Thu Apr 09 14:54:51.023717 2026] [:error] [pid 24516:tid 24551] [client 20.203.230.84:31698] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addNO9hW7vSS-UkeWCX8QAAAAEQ"]
[Thu Apr 09 14:54:51.597762 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:33161] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addNOzXObuzEuw8mNJuCKgAAAQU"]
[Thu Apr 09 14:54:52.225399 2026] [:error] [pid 24517:tid 24591] [client 20.203.230.84:32662] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "addNPHboYEn2ZFM_PS9P6AAAAJE"]
[Thu Apr 09 14:54:52.909214 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:31669] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "addNPDXObuzEuw8mNJuCLwAAAQc"]
[Thu Apr 09 14:54:53.435822 2026] [:error] [pid 24624:tid 24645] [client 20.203.230.84:30719] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "addNPe4Jn-WvK1ZBTviEGQAAANM"]
[Thu Apr 09 14:54:54.471491 2026] [:error] [pid 24927:tid 24944] [client 20.203.230.84:31716] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-update.php"] [unique_id "addNPjXObuzEuw8mNJuCOgAAAQ4"]
[Thu Apr 09 14:54:55.038204 2026] [:error] [pid 24927:tid 24945] [client 20.203.230.84:33195] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "addNPzXObuzEuw8mNJuCPwAAAQ8"]
[Thu Apr 09 14:54:56.380023 2026] [:error] [pid 24516:tid 24559] [client 20.203.230.84:31161] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "addNQNhW7vSS-UkeWCX8RQAAAEw"]
[Thu Apr 09 14:54:56.973298 2026] [:error] [pid 24517:tid 24594] [client 20.203.230.84:33240] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "addNQHboYEn2ZFM_PS9P8AAAAJQ"]
[Thu Apr 09 14:54:57.502675 2026] [:error] [pid 24624:tid 24638] [client 20.203.230.84:31182] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sbhu.php"] [unique_id "addNQe4Jn-WvK1ZBTviEIAAAAMw"]
[Thu Apr 09 14:54:58.104349 2026] [:error] [pid 24516:tid 24548] [client 20.203.230.84:31627] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "addNQthW7vSS-UkeWCX8RwAAAEE"]
[Thu Apr 09 14:54:58.662930 2026] [:error] [pid 24624:tid 24627] [client 20.203.230.84:33235] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "addNQu4Jn-WvK1ZBTviEIQAAAME"]
[Thu Apr 09 14:54:59.228408 2026] [:error] [pid 24927:tid 24947] [client 20.203.230.84:31624] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "addNQzXObuzEuw8mNJuCUwAAARE"]
[Thu Apr 09 14:55:01.099888 2026] [:error] [pid 24515:tid 24534] [client 20.203.230.84:32710] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "addNRa1OMnvM2fMnB1M9GAAAAA8"]
[Thu Apr 09 14:55:01.677361 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:33217] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "addNRTXObuzEuw8mNJuCXgAAAQA"]
[Thu Apr 09 14:55:02.235438 2026] [:error] [pid 24516:tid 24549] [client 20.203.230.84:28220] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "addNRthW7vSS-UkeWCX8VAAAAEI"]
[Thu Apr 09 14:55:02.724116 2026] [:error] [pid 24927:tid 24939] [client 20.203.230.84:32157] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "addNRjXObuzEuw8mNJuCYQAAAQk"]
[Thu Apr 09 14:55:03.291407 2026] [:error] [pid 24624:tid 24646] [client 20.203.230.84:33260] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "addNR-4Jn-WvK1ZBTviEJwAAANQ"]
[Thu Apr 09 14:55:03.806292 2026] [:error] [pid 24624:tid 24628] [client 20.203.230.84:30319] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "addNR-4Jn-WvK1ZBTviEKAAAAMI"]
[Thu Apr 09 14:55:04.385920 2026] [:error] [pid 24624:tid 24630] [client 20.203.230.84:32691] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "addNSO4Jn-WvK1ZBTviEKwAAAMQ"]
[Thu Apr 09 14:55:04.981417 2026] [:error] [pid 24624:tid 24631] [client 20.203.230.84:30711] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "addNSO4Jn-WvK1ZBTviELAAAAMU"]
[Thu Apr 09 14:55:05.467945 2026] [:error] [pid 24515:tid 24543] [client 20.203.230.84:33165] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "addNSa1OMnvM2fMnB1M9LwAAABg"]
[Thu Apr 09 14:55:06.015898 2026] [:error] [pid 24517:tid 24589] [client 20.203.230.84:32218] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNSnboYEn2ZFM_PS9P-AAAAI8"]
[Thu Apr 09 14:55:06.519981 2026] [:error] [pid 24517:tid 24581] [client 20.203.230.84:31677] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNSnboYEn2ZFM_PS9P-QAAAIc"]
[Thu Apr 09 14:55:07.411822 2026] [:error] [pid 24517:tid 24598] [client 20.203.230.84:32158] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNS3boYEn2ZFM_PS9P_AAAAJg"]
[Thu Apr 09 14:55:07.930796 2026] [:error] [pid 24624:tid 24649] [client 20.203.230.84:31689] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNS-4Jn-WvK1ZBTviEMQAAANc"]
[Thu Apr 09 14:55:08.771798 2026] [:error] [pid 24517:tid 24590] [client 20.203.230.84:31646] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "addNTHboYEn2ZFM_PS9P_gAAAJA"]
[Thu Apr 09 14:55:09.356778 2026] [:error] [pid 24624:tid 24645] [client 20.203.230.84:33269] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "addNTe4Jn-WvK1ZBTviENQAAANM"]
[Thu Apr 09 14:55:09.889754 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:32159] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "addNTTXObuzEuw8mNJuCngAAAQc"]
[Thu Apr 09 14:55:10.483428 2026] [:error] [pid 24624:tid 24631] [client 20.203.230.84:32672] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "addNTu4Jn-WvK1ZBTviEOgAAAMU"]
[Thu Apr 09 14:55:10.974959 2026] [:error] [pid 24624:tid 24627] [client 20.203.230.84:33221] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "addNTu4Jn-WvK1ZBTviEOwAAAME"]
[Thu Apr 09 14:55:12.100999 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:33231] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "addNUDXObuzEuw8mNJuCuAAAAQI"]
[Thu Apr 09 14:55:12.636375 2026] [:error] [pid 24927:tid 24943] [client 20.203.230.84:31174] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "addNUDXObuzEuw8mNJuCvgAAAQ0"]
[Thu Apr 09 14:55:13.161414 2026] [:error] [pid 24927:tid 24933] [client 20.203.230.84:32708] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "addNUTXObuzEuw8mNJuCwwAAAQM"]
[Thu Apr 09 14:55:13.746715 2026] [:error] [pid 24517:tid 24588] [client 20.203.230.84:32215] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNUXboYEn2ZFM_PS9QAQAAAI4"]
[Thu Apr 09 14:55:14.324131 2026] [:error] [pid 24927:tid 24948] [client 20.203.230.84:27670] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNUjXObuzEuw8mNJuC0AAAARI"]
[Thu Apr 09 14:55:14.940742 2026] [:error] [pid 24927:tid 24934] [client 20.203.230.84:29802] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNUjXObuzEuw8mNJuC1QAAAQQ"]
[Thu Apr 09 14:55:15.557448 2026] [:error] [pid 24517:tid 24580] [client 20.203.230.84:32647] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "addNU3boYEn2ZFM_PS9QCAAAAIY"]
[Thu Apr 09 14:55:16.836620 2026] [:error] [pid 24927:tid 24936] [client 20.203.230.84:33780] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "addNVDXObuzEuw8mNJuC9wAAAQY"]
[Thu Apr 09 14:55:17.410503 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:33173] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "addNVTXObuzEuw8mNJuC-wAAAQA"]
[Thu Apr 09 14:55:18.100225 2026] [:error] [pid 24927:tid 24940] [client 20.203.230.84:31712] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "addNVjXObuzEuw8mNJuC_wAAAQo"]
[Thu Apr 09 14:55:18.688422 2026] [:error] [pid 24927:tid 24933] [client 20.203.230.84:31159] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "addNVjXObuzEuw8mNJuDBAAAAQM"]
[Thu Apr 09 14:55:19.292796 2026] [:error] [pid 24624:tid 24644] [client 20.203.230.84:29759] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addNV-4Jn-WvK1ZBTviERAAAANI"]
[Thu Apr 09 14:55:20.241251 2026] [:error] [pid 24624:tid 24631] [client 20.203.230.84:32228] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addNWO4Jn-WvK1ZBTviERwAAAMU"]
[Thu Apr 09 14:55:20.749619 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:33180] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addNWDXObuzEuw8mNJuDGAAAAQU"]
[Thu Apr 09 14:55:22.779655 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:32186] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addNWjXObuzEuw8mNJuDJgAAAQA"]
[Thu Apr 09 14:55:23.373791 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:33171] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "addNWzXObuzEuw8mNJuDKgAAARM"]
[Thu Apr 09 14:55:24.117293 2026] [:error] [pid 24516:tid 24568] [client 20.203.230.84:32201] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "addNXNhW7vSS-UkeWCX8ZgAAAFU"]
[Thu Apr 09 14:55:24.647155 2026] [:error] [pid 24624:tid 24640] [client 20.203.230.84:33790] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "addNXO4Jn-WvK1ZBTviEVQAAAM4"]
[Thu Apr 09 14:55:25.138083 2026] [:error] [pid 24624:tid 24642] [client 20.203.230.84:32646] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "addNXe4Jn-WvK1ZBTviEWQAAANA"]
[Thu Apr 09 14:55:25.705571 2026] [:error] [pid 24624:tid 24636] [client 20.203.230.84:33168] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "addNXe4Jn-WvK1ZBTviEXgAAAMo"]
[Thu Apr 09 14:55:26.284768 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:31638] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "addNXjXObuzEuw8mNJuDOQAAAQU"]
[Thu Apr 09 14:55:26.887658 2026] [:error] [pid 24517:tid 24586] [client 20.203.230.84:31655] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "addNXnboYEn2ZFM_PS9QFwAAAIw"]
[Thu Apr 09 14:55:27.702172 2026] [:error] [pid 24624:tid 24647] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Thu Apr 09 14:55:27.942858 2026] [:error] [pid 24624:tid 24628] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Thu Apr 09 14:55:28.225649 2026] [:error] [pid 24624:tid 24630] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Apr 09 14:55:28.505431 2026] [:error] [pid 24624:tid 24634] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Thu Apr 09 14:55:28.750649 2026] [:error] [pid 24624:tid 24627] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Apr 09 14:55:29.270885 2026] [:error] [pid 24624:tid 24636] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Thu Apr 09 14:55:29.859970 2026] [:error] [pid 24624:tid 24631] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Thu Apr 09 14:55:30.110987 2026] [:error] [pid 24624:tid 24635] [client 20.203.230.84:32217] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 09 14:55:30.393174 2026] [:error] [pid 24624:tid 24626] [client 20.203.230.84:32217] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "addNYu4Jn-WvK1ZBTviEdgAAAMA"]
[Thu Apr 09 14:55:30.944913 2026] [:error] [pid 24517:tid 24590] [client 20.203.230.84:33740] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "addNYnboYEn2ZFM_PS9QHAAAAJA"]
[Thu Apr 09 14:55:31.428586 2026] [:error] [pid 24624:tid 24647] [client 20.203.230.84:32156] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "addNY-4Jn-WvK1ZBTviEgQAAANU"]
[Thu Apr 09 14:55:32.086465 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:29818] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "addNZDXObuzEuw8mNJuDYgAAARM"]
[Thu Apr 09 14:55:32.731169 2026] [:error] [pid 24515:tid 24534] [client 20.203.230.84:32250] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNZK1OMnvM2fMnB1M9SwAAAA8"]
[Thu Apr 09 14:55:33.301106 2026] [:error] [pid 24517:tid 24594] [client 20.203.230.84:32240] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNZXboYEn2ZFM_PS9QKAAAAJQ"]
[Thu Apr 09 14:55:33.889316 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:33190] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNZTXObuzEuw8mNJuDZAAAAQc"]
[Thu Apr 09 14:55:34.392489 2026] [:error] [pid 24927:tid 24947] [client 20.203.230.84:32200] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fe5.php"] [unique_id "addNZjXObuzEuw8mNJuDZQAAARE"]
[Thu Apr 09 14:55:34.866813 2026] [:error] [pid 24516:tid 24567] [client 20.203.230.84:33718] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "addNZthW7vSS-UkeWCX8hAAAAFQ"]
[Thu Apr 09 14:55:35.363797 2026] [:error] [pid 24516:tid 24564] [client 20.203.230.84:32717] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "addNZ9hW7vSS-UkeWCX8hQAAAFE"]
[Thu Apr 09 14:55:35.907041 2026] [:error] [pid 24516:tid 24555] [client 20.203.230.84:31625] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "addNZ9hW7vSS-UkeWCX8hgAAAEg"]
[Thu Apr 09 14:55:36.432124 2026] [:error] [pid 24927:tid 24940] [client 20.203.230.84:31154] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "addNaDXObuzEuw8mNJuDawAAAQo"]
[Thu Apr 09 14:55:37.057469 2026] [:error] [pid 24515:tid 24541] [client 20.203.230.84:32147] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "addNaa1OMnvM2fMnB1M9TQAAABY"]
[Thu Apr 09 14:55:37.603321 2026] [:error] [pid 24624:tid 24633] [client 20.203.230.84:31735] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "addNae4Jn-WvK1ZBTviEmwAAAMc"]
[Thu Apr 09 14:55:38.078335 2026] [:error] [pid 24624:tid 24649] [client 20.203.230.84:32760] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "addNau4Jn-WvK1ZBTviEnwAAANc"]
[Thu Apr 09 14:55:38.671698 2026] [:error] [pid 24624:tid 24648] [client 20.203.230.84:33158] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "addNau4Jn-WvK1ZBTviEpgAAANY"]
[Thu Apr 09 14:55:39.205230 2026] [:error] [pid 24515:tid 24536] [client 20.203.230.84:29698] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "addNa61OMnvM2fMnB1M9UgAAABE"]
[Thu Apr 09 14:55:39.782469 2026] [:error] [pid 24624:tid 24642] [client 20.203.230.84:31171] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "addNa-4Jn-WvK1ZBTviErgAAANA"]
[Thu Apr 09 14:55:40.258329 2026] [:error] [pid 24624:tid 24640] [client 20.203.230.84:30314] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "addNbO4Jn-WvK1ZBTviEtgAAAM4"]
[Thu Apr 09 14:55:40.880202 2026] [:error] [pid 24624:tid 24644] [client 20.203.230.84:31687] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "addNbO4Jn-WvK1ZBTviEuAAAANI"]
[Thu Apr 09 14:55:41.475961 2026] [:error] [pid 24927:tid 24948] [client 20.203.230.84:33270] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "addNbTXObuzEuw8mNJuDfAAAARI"]
[Thu Apr 09 14:55:41.994487 2026] [:error] [pid 24515:tid 24539] [client 20.203.230.84:33761] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "addNba1OMnvM2fMnB1M9WAAAABQ"]
[Thu Apr 09 14:55:43.388120 2026] [:error] [pid 24515:tid 24534] [client 20.203.230.84:30684] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "addNb61OMnvM2fMnB1M9WwAAAA8"]
[Thu Apr 09 14:55:43.993477 2026] [:error] [pid 24927:tid 24952] [client 20.203.230.84:31223] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "addNbzXObuzEuw8mNJuDnQAAARY"]
[Thu Apr 09 14:55:44.483944 2026] [:error] [pid 24927:tid 24948] [client 20.203.230.84:33164] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "addNcDXObuzEuw8mNJuDuQAAARI"]
[Thu Apr 09 14:55:45.043474 2026] [:error] [pid 24927:tid 24947] [client 20.203.230.84:33704] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "addNcTXObuzEuw8mNJuDwQAAARE"]
[Thu Apr 09 14:55:45.888999 2026] [:error] [pid 24624:tid 24648] [client 20.203.230.84:33717] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "addNce4Jn-WvK1ZBTviEwAAAANY"]
[Thu Apr 09 14:55:46.435416 2026] [:error] [pid 24927:tid 24949] [client 20.203.230.84:33708] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "addNcjXObuzEuw8mNJuD0AAAARM"]
[Thu Apr 09 14:55:47.046885 2026] [:error] [pid 24517:tid 24581] [client 20.203.230.84:33232] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "addNc3boYEn2ZFM_PS9QNwAAAIc"]
[Thu Apr 09 14:55:48.005363 2026] [:error] [pid 24624:tid 24636] [client 20.203.230.84:34301] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "addNdO4Jn-WvK1ZBTviEyAAAAMo"]
[Thu Apr 09 14:55:48.670957 2026] [:error] [pid 24517:tid 24589] [client 20.203.230.84:31104] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "addNdHboYEn2ZFM_PS9QOgAAAI8"]
[Thu Apr 09 14:55:49.376380 2026] [:error] [pid 24927:tid 24941] [client 20.203.230.84:34292] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "addNdTXObuzEuw8mNJuD1wAAAQs"]
[Thu Apr 09 14:55:50.016868 2026] [:error] [pid 24624:tid 24649] [client 20.203.230.84:31131] [client 20.203.230.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "addNdu4Jn-WvK1ZBTviEzwAAANc"]
[Thu Apr 09 14:55:50.527104 2026] [:error] [pid 24927:tid 24945] [client 20.203.230.84:33765] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "addNdjXObuzEuw8mNJuD2gAAAQ8"]
[Thu Apr 09 14:55:51.140972 2026] [:error] [pid 24624:tid 24643] [client 20.203.230.84:29764] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "addNd-4Jn-WvK1ZBTviE0QAAANE"]
[Thu Apr 09 14:55:53.847366 2026] [:error] [pid 24517:tid 24584] [client 20.203.230.84:34217] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "addNeXboYEn2ZFM_PS9QQgAAAIo"]
[Thu Apr 09 14:55:54.446621 2026] [:error] [pid 24927:tid 24954] [client 20.203.230.84:33155] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "addNejXObuzEuw8mNJuD3wAAARg"]
[Thu Apr 09 14:55:54.991402 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:34225] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addNejXObuzEuw8mNJuD4wAAAQc"]
[Thu Apr 09 14:55:55.568086 2026] [:error] [pid 24927:tid 24945] [client 20.203.230.84:33707] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addNezXObuzEuw8mNJuD6QAAAQ8"]
[Thu Apr 09 14:55:56.169792 2026] [:error] [pid 24927:tid 24938] [client 20.203.230.84:31732] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addNfDXObuzEuw8mNJuD7AAAAQg"]
[Thu Apr 09 14:55:56.646185 2026] [:error] [pid 24927:tid 24951] [client 20.203.230.84:33226] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addNfDXObuzEuw8mNJuD7wAAARU"]
[Thu Apr 09 14:55:57.205474 2026] [:error] [pid 24624:tid 24626] [client 20.203.230.84:27725] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addNfe4Jn-WvK1ZBTviE3AAAAMA"]
[Thu Apr 09 14:55:57.759577 2026] [:error] [pid 24624:tid 24637] [client 20.203.230.84:32168] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addNfe4Jn-WvK1ZBTviE4AAAAMs"]
[Thu Apr 09 14:55:58.934571 2026] [:error] [pid 24517:tid 24589] [client 20.203.230.84:33263] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addNfnboYEn2ZFM_PS9QRQAAAI8"]
[Thu Apr 09 14:55:59.589373 2026] [:error] [pid 24624:tid 24647] [client 20.203.230.84:33255] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addNf-4Jn-WvK1ZBTviE5QAAANU"]
[Thu Apr 09 14:56:00.166955 2026] [:error] [pid 24927:tid 24946] [client 20.203.230.84:29248] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "addNgDXObuzEuw8mNJuEBgAAARA"]
[Thu Apr 09 14:56:00.793327 2026] [:error] [pid 24516:tid 24569] [client 20.203.230.84:32640] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "addNgNhW7vSS-UkeWCX8nQAAAFY"]
[Thu Apr 09 14:56:01.627602 2026] [:error] [pid 24516:tid 24561] [client 20.203.230.84:33271] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "addNgdhW7vSS-UkeWCX8ngAAAE4"]
[Thu Apr 09 14:56:02.198946 2026] [:error] [pid 24927:tid 24938] [client 20.203.230.84:33202] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "addNgjXObuzEuw8mNJuECQAAAQg"]
[Thu Apr 09 14:56:02.874958 2026] [:error] [pid 24515:tid 24539] [client 20.203.230.84:33199] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "addNgq1OMnvM2fMnB1M9YgAAABQ"]
[Thu Apr 09 14:56:03.413365 2026] [:error] [pid 24624:tid 24638] [client 20.203.230.84:33153] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "addNg-4Jn-WvK1ZBTviE5wAAAMw"]
[Thu Apr 09 14:56:03.941979 2026] [:error] [pid 24516:tid 24548] [client 20.203.230.84:31682] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "addNg9hW7vSS-UkeWCX8owAAAEE"]
[Thu Apr 09 14:56:04.602653 2026] [:error] [pid 24927:tid 24939] [client 20.203.230.84:33275] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "addNhDXObuzEuw8mNJuECgAAAQk"]
[Thu Apr 09 14:56:05.748897 2026] [:error] [pid 24515:tid 24542] [client 20.203.230.84:31703] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "addNha1OMnvM2fMnB1M9bAAAABc"]
[Thu Apr 09 14:56:06.268424 2026] [:error] [pid 24517:tid 24590] [client 20.203.230.84:32162] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "addNhnboYEn2ZFM_PS9QSAAAAJA"]
[Thu Apr 09 14:56:07.038430 2026] [:error] [pid 24515:tid 24537] [client 20.203.230.84:34298] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "addNh61OMnvM2fMnB1M9bgAAABI"]
[Thu Apr 09 14:56:07.526943 2026] [:error] [pid 24927:tid 24943] [client 20.203.230.84:31105] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "addNhzXObuzEuw8mNJuEDQAAAQ0"]
[Thu Apr 09 14:56:08.203947 2026] [:error] [pid 24927:tid 24953] [client 20.203.230.84:31665] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "addNiDXObuzEuw8mNJuEDgAAARc"]
[Thu Apr 09 14:56:08.836315 2026] [:error] [pid 24516:tid 24563] [client 20.203.230.84:34193] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "addNiNhW7vSS-UkeWCX8pAAAAFA"]
[Thu Apr 09 14:56:09.563007 2026] [:error] [pid 24516:tid 24559] [client 20.203.230.84:32682] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "addNidhW7vSS-UkeWCX8pwAAAEw"]
[Thu Apr 09 14:56:10.171386 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:31711] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "addNijXObuzEuw8mNJuEDwAAAQA"]
[Thu Apr 09 14:56:10.758275 2026] [:error] [pid 24515:tid 24530] [client 20.203.230.84:33223] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "addNiq1OMnvM2fMnB1M9cwAAAAs"]
[Thu Apr 09 14:56:11.589011 2026] [:error] [pid 24927:tid 24935] [client 20.203.230.84:27220] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "addNizXObuzEuw8mNJuEEAAAAQU"]
[Thu Apr 09 14:56:12.125076 2026] [:error] [pid 24516:tid 24547] [client 20.203.230.84:31168] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "addNjNhW7vSS-UkeWCX8rQAAAEA"]
[Thu Apr 09 14:56:12.732043 2026] [:error] [pid 24624:tid 24649] [client 20.203.230.84:32229] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "addNjO4Jn-WvK1ZBTviE6QAAANc"]
[Thu Apr 09 14:56:13.230507 2026] [:error] [pid 24927:tid 24946] [client 20.203.230.84:33214] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "addNjTXObuzEuw8mNJuEEQAAARA"]
[Thu Apr 09 14:56:13.880289 2026] [:error] [pid 24517:tid 24579] [client 20.203.230.84:32155] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "addNjXboYEn2ZFM_PS9QTQAAAIU"]
[Thu Apr 09 14:56:14.585554 2026] [:error] [pid 24517:tid 24584] [client 20.203.230.84:32742] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "addNjnboYEn2ZFM_PS9QUAAAAIo"]
[Thu Apr 09 14:56:15.117362 2026] [:error] [pid 24516:tid 24554] [client 20.203.230.84:32750] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "addNj9hW7vSS-UkeWCX8sAAAAEc"]
[Thu Apr 09 14:56:15.985249 2026] [:error] [pid 24517:tid 24585] [client 20.203.230.84:32685] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "addNj3boYEn2ZFM_PS9QWgAAAIs"]
[Thu Apr 09 14:56:16.712461 2026] [:error] [pid 24517:tid 24579] [client 20.203.230.84:32139] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "addNkHboYEn2ZFM_PS9QXQAAAIU"]
[Thu Apr 09 14:56:17.323031 2026] [:error] [pid 24624:tid 24626] [client 20.203.230.84:28261] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "addNke4Jn-WvK1ZBTviE7AAAAMA"]
[Thu Apr 09 14:56:17.890184 2026] [:error] [pid 24927:tid 24937] [client 20.203.230.84:33776] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "addNkTXObuzEuw8mNJuEEgAAAQc"]
[Thu Apr 09 14:56:18.666573 2026] [:error] [pid 24517:tid 24589] [client 20.203.230.84:34197] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "addNknboYEn2ZFM_PS9QYgAAAI8"]
[Thu Apr 09 14:56:19.265437 2026] [:error] [pid 24927:tid 24952] [client 20.203.230.84:32683] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "addNkzXObuzEuw8mNJuEFAAAARY"]
[Thu Apr 09 14:56:19.866173 2026] [:error] [pid 24927:tid 24934] [client 20.203.230.84:34791] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "addNkzXObuzEuw8mNJuEFQAAAQQ"]
[Thu Apr 09 14:56:20.734943 2026] [:error] [pid 24516:tid 24552] [client 20.203.230.84:33690] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "addNlNhW7vSS-UkeWCX8sQAAAEU"]
[Thu Apr 09 14:56:21.483924 2026] [:error] [pid 24517:tid 24592] [client 20.203.230.84:34266] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "addNlXboYEn2ZFM_PS9QZgAAAJI"]
[Thu Apr 09 14:56:22.185041 2026] [:error] [pid 24927:tid 24938] [client 20.203.230.84:33162] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "addNljXObuzEuw8mNJuEGAAAAQg"]
[Thu Apr 09 14:56:22.908599 2026] [:error] [pid 24624:tid 24644] [client 20.203.230.84:32230] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "addNlu4Jn-WvK1ZBTviE8wAAANI"]
[Thu Apr 09 14:56:23.532675 2026] [:error] [pid 24517:tid 24579] [client 20.203.230.84:34235] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "addNl3boYEn2ZFM_PS9QaAAAAIU"]
[Thu Apr 09 14:56:24.210878 2026] [:error] [pid 24927:tid 24933] [client 20.203.230.84:34767] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addNmDXObuzEuw8mNJuEGQAAAQM"]
[Thu Apr 09 14:56:24.971396 2026] [:error] [pid 24927:tid 24936] [client 20.203.230.84:33250] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addNmDXObuzEuw8mNJuEGwAAAQY"]
[Thu Apr 09 14:56:25.612944 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:33179] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addNmTXObuzEuw8mNJuEHQAAAQI"]
[Thu Apr 09 14:56:26.220485 2026] [:error] [pid 24515:tid 24536] [client 20.203.230.84:33694] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addNmq1OMnvM2fMnB1M9fgAAABE"]
[Thu Apr 09 14:56:26.816757 2026] [:error] [pid 24515:tid 24522] [client 20.203.230.84:34691] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "addNmq1OMnvM2fMnB1M9fwAAAAM"]
[Thu Apr 09 14:56:27.512562 2026] [:error] [pid 24516:tid 24548] [client 20.203.230.84:27756] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "addNm9hW7vSS-UkeWCX8swAAAEE"]
[Thu Apr 09 14:56:28.106037 2026] [:error] [pid 24515:tid 24524] [client 20.203.230.84:34213] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "addNnK1OMnvM2fMnB1M9ggAAAAU"]
[Thu Apr 09 14:56:28.832334 2026] [:error] [pid 24515:tid 24530] [client 20.203.230.84:33166] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "addNnK1OMnvM2fMnB1M9hAAAAAs"]
[Thu Apr 09 14:56:29.412163 2026] [:error] [pid 24516:tid 24560] [client 20.203.230.84:34695] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "addNndhW7vSS-UkeWCX8tgAAAE0"]
[Thu Apr 09 14:56:29.931617 2026] [:error] [pid 24516:tid 24571] [client 20.203.230.84:34790] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "addNndhW7vSS-UkeWCX8uQAAAFg"]
[Thu Apr 09 14:56:30.561674 2026] [:error] [pid 24516:tid 24564] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Thu Apr 09 14:56:30.802534 2026] [:error] [pid 24516:tid 24553] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Thu Apr 09 14:56:31.085675 2026] [:error] [pid 24516:tid 24565] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Thu Apr 09 14:56:31.325858 2026] [:error] [pid 24516:tid 24550] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Thu Apr 09 14:56:31.594585 2026] [:error] [pid 24516:tid 24569] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Thu Apr 09 14:56:32.125981 2026] [:error] [pid 24516:tid 24557] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 09 14:56:32.374960 2026] [:error] [pid 24516:tid 24554] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Thu Apr 09 14:56:32.644661 2026] [:error] [pid 24516:tid 24558] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Thu Apr 09 14:56:32.890418 2026] [:error] [pid 24516:tid 24548] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Thu Apr 09 14:56:33.129988 2026] [:error] [pid 24516:tid 24566] [client 20.203.230.84:28175] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Apr 09 14:56:33.365793 2026] [:error] [pid 24516:tid 24570] [client 20.203.230.84:28175] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "addNodhW7vSS-UkeWCX8ygAAAFc"]
[Thu Apr 09 14:56:34.036148 2026] [:error] [pid 24516:tid 24567] [client 20.203.230.84:32658] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "addNothW7vSS-UkeWCX8ywAAAFQ"]
[Thu Apr 09 14:56:34.637416 2026] [:error] [pid 24516:tid 24560] [client 20.203.230.84:34237] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "addNothW7vSS-UkeWCX8zAAAAE0"]
[Thu Apr 09 14:56:35.478016 2026] [:error] [pid 24517:tid 24589] [client 20.203.230.84:33778] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file18.php"] [unique_id "addNo3boYEn2ZFM_PS9QcQAAAI8"]
[Thu Apr 09 14:56:36.384413 2026] [:error] [pid 24624:tid 24642] [client 20.203.230.84:32180] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "addNpO4Jn-WvK1ZBTviE9QAAANA"]
[Thu Apr 09 14:56:37.110484 2026] [:error] [pid 24624:tid 24649] [client 20.203.230.84:32249] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "addNpe4Jn-WvK1ZBTviE-AAAANc"]
[Thu Apr 09 14:56:37.744844 2026] [:error] [pid 24927:tid 24930] [client 20.203.230.84:32732] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "addNpTXObuzEuw8mNJuEIQAAAQA"]
[Thu Apr 09 14:56:38.418923 2026] [:error] [pid 24927:tid 24946] [client 20.203.230.84:34706] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vee.php"] [unique_id "addNpjXObuzEuw8mNJuEIgAAARA"]
[Thu Apr 09 14:56:39.247417 2026] [:error] [pid 24624:tid 24626] [client 20.203.230.84:34787] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "addNp-4Jn-WvK1ZBTviE_QAAAMA"]
[Thu Apr 09 14:56:39.957446 2026] [:error] [pid 24624:tid 24630] [client 20.203.230.84:34200] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "addNp-4Jn-WvK1ZBTviFAAAAAMQ"]
[Thu Apr 09 14:56:40.569303 2026] [:error] [pid 24624:tid 24633] [client 20.203.230.84:32211] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "addNqO4Jn-WvK1ZBTviFAQAAAMc"]
[Thu Apr 09 14:56:41.414870 2026] [:error] [pid 24624:tid 24634] [client 20.203.230.84:33724] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cabs.php"] [unique_id "addNqe4Jn-WvK1ZBTviFAwAAAMg"]
[Thu Apr 09 14:56:42.009763 2026] [:error] [pid 24927:tid 24950] [client 20.203.230.84:28680] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "addNqjXObuzEuw8mNJuEKAAAARQ"]
[Thu Apr 09 14:56:42.762147 2026] [:error] [pid 24624:tid 24650] [client 20.203.230.84:32713] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "addNqu4Jn-WvK1ZBTviFBgAAANg"]
[Thu Apr 09 14:56:43.400132 2026] [:error] [pid 24624:tid 24635] [client 20.203.230.84:32661] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "addNq-4Jn-WvK1ZBTviFCQAAAMk"]
[Thu Apr 09 14:56:44.149391 2026] [:error] [pid 24927:tid 24932] [client 20.203.230.84:30650] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "addNrDXObuzEuw8mNJuELQAAAQI"]
[Thu Apr 09 14:56:44.788553 2026] [:error] [pid 24517:tid 24578] [client 20.203.230.84:33746] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "addNrHboYEn2ZFM_PS9QdQAAAIQ"]
[Thu Apr 09 14:56:45.415351 2026] [:error] [pid 24927:tid 24947] [client 20.203.230.84:31725] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "addNrTXObuzEuw8mNJuEMAAAARE"]
[Thu Apr 09 14:56:46.189590 2026] [:error] [pid 24624:tid 24633] [client 20.203.230.84:32700] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "addNru4Jn-WvK1ZBTviFDwAAAMc"]
[Thu Apr 09 14:56:46.751004 2026] [:error] [pid 24624:tid 24631] [client 20.203.230.84:29190] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "addNru4Jn-WvK1ZBTviFEgAAAMU"]
[Thu Apr 09 14:56:47.588595 2026] [:error] [pid 24927:tid 24953] [client 20.203.230.84:34241] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "addNrzXObuzEuw8mNJuEMgAAARc"]
[Thu Apr 09 14:56:48.207580 2026] [:error] [pid 24516:tid 24568] [client 20.203.230.84:34714] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "addNsNhW7vSS-UkeWCX80QAAAFU"]
[Thu Apr 09 14:56:48.942701 2026] [:error] [pid 24517:tid 24579] [client 20.203.230.84:31193] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "addNsHboYEn2ZFM_PS9QewAAAIU"]
[Thu Apr 09 14:56:49.599030 2026] [:error] [pid 24516:tid 24569] [client 20.203.230.84:32666] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "addNsdhW7vSS-UkeWCX80wAAAFY"]
[Thu Apr 09 14:56:50.210320 2026] [:error] [pid 24927:tid 24940] [client 20.203.230.84:32671] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "addNsjXObuzEuw8mNJuENgAAAQo"]
[Thu Apr 09 14:56:50.889277 2026] [:error] [pid 24517:tid 24575] [client 20.203.230.84:34185] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "addNsnboYEn2ZFM_PS9QfgAAAIE"]
[Thu Apr 09 14:56:52.416538 2026] [:error] [pid 24927:tid 24948] [client 20.203.230.84:33713] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "addNtDXObuzEuw8mNJuEPQAAARI"]
[Thu Apr 09 14:56:53.095183 2026] [:error] [pid 24517:tid 24598] [client 20.203.230.84:34247] [client 20.203.230.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "addNtXboYEn2ZFM_PS9QgAAAAJg"]
[Thu Apr 09 19:56:32.424872 2026] [:error] [pid 24624:tid 24648] [client 172.213.2.23:61312] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 21:58:21.677777 2026] [:error] [pid 24624:tid 24643] [client 35.198.210.214:54048] [client 35.198.210.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adewfe4Jn-WvK1ZBTvjobQAAANE"]
[Thu Apr 09 21:58:22.275329 2026] [:error] [pid 63331:tid 63350] [client 35.198.210.214:43858] [client 35.198.210.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "adewfibKfIYuVjWbE4WD5wAAAdE"]
[Fri Apr 10 00:06:42.296381 2026] [:error] [pid 18477:tid 18485] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/green.php
[Fri Apr 10 00:06:42.532072 2026] [:error] [pid 18477:tid 18480] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Fri Apr 10 00:06:42.794351 2026] [:error] [pid 18477:tid 18483] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Fri Apr 10 00:06:43.053468 2026] [:error] [pid 18477:tid 18489] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Fri Apr 10 00:06:43.303781 2026] [:error] [pid 18477:tid 18487] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/5xkfgawzejgwqh9hiaznCdefault.php
[Fri Apr 10 00:06:43.558062 2026] [:error] [pid 18477:tid 18493] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Fri Apr 10 00:06:43.798509 2026] [:error] [pid 18477:tid 18502] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Apr 10 00:06:44.052703 2026] [:error] [pid 18477:tid 18497] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Fri Apr 10 00:06:44.299289 2026] [:error] [pid 18477:tid 18488] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Fri Apr 10 00:06:44.535088 2026] [:error] [pid 18477:tid 18499] [client 4.232.92.99:31413] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Fri Apr 10 00:06:44.768143 2026] [:error] [pid 18477:tid 18503] [client 4.232.92.99:31413] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adfOlMDe826HlFeoLPK1OgAAAVg"]
[Fri Apr 10 00:06:51.214939 2026] [:error] [pid 24624:tid 24629] [client 4.232.92.99:7314] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adfOm-4Jn-WvK1ZBTvgCrwAAAMM"]
[Fri Apr 10 00:06:54.857095 2026] [:error] [pid 24515:tid 24543] [client 4.232.92.99:31559] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adfOnq1OMnvM2fMnB1MMNwAAABg"]
[Fri Apr 10 00:07:05.595834 2026] [:error] [pid 20837:tid 20846] [client 4.232.92.99:31411] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adfOqfSL71FHZkjrGzMgXQAAAYc"]
[Fri Apr 10 00:07:14.280197 2026] [:error] [pid 24624:tid 24645] [client 4.232.92.99:31575] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adfOsu4Jn-WvK1ZBTvgCywAAANM"]
[Fri Apr 10 00:07:31.681816 2026] [:error] [pid 20837:tid 20842] [client 4.232.92.99:31591] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "adfOw_SL71FHZkjrGzMgegAAAYM"]
[Fri Apr 10 00:07:56.167806 2026] [:error] [pid 63331:tid 63348] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Fri Apr 10 00:07:56.466065 2026] [:error] [pid 63331:tid 63348] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Apr 10 00:07:56.703102 2026] [:error] [pid 63331:tid 63354] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Fri Apr 10 00:07:56.938752 2026] [:error] [pid 63331:tid 63339] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Fri Apr 10 00:07:57.176893 2026] [:error] [pid 63331:tid 63352] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Apr 10 00:07:57.411629 2026] [:error] [pid 63331:tid 63336] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Fri Apr 10 00:07:57.647138 2026] [:error] [pid 63331:tid 63349] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Fri Apr 10 00:07:57.892007 2026] [:error] [pid 63331:tid 63353] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Fri Apr 10 00:07:58.128794 2026] [:error] [pid 63331:tid 63335] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Fri Apr 10 00:07:58.364022 2026] [:error] [pid 63331:tid 63341] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Fri Apr 10 00:07:58.599444 2026] [:error] [pid 63331:tid 63357] [client 4.232.92.99:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Fri Apr 10 00:07:58.844887 2026] [:error] [pid 63331:tid 63343] [client 4.232.92.99:31313] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adfO3ibKfIYuVjWbE4WwnAAAAco"]
[Fri Apr 10 00:08:02.235358 2026] [:error] [pid 24515:tid 24542] [client 4.232.92.99:7320] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adfO4q1OMnvM2fMnB1MMygAAABc"]
[Fri Apr 10 00:08:05.359922 2026] [:error] [pid 63331:tid 63342] [client 4.232.92.99:31387] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adfO5SbKfIYuVjWbE4WwpQAAAck"]
[Fri Apr 10 00:08:09.022607 2026] [:error] [pid 24624:tid 24636] [client 4.232.92.99:7317] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adfO6e4Jn-WvK1ZBTvgC9wAAAMo"]
[Fri Apr 10 00:08:10.192998 2026] [:error] [pid 63331:tid 63346] [client 4.232.92.99:31374] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adfO6ibKfIYuVjWbE4WwtAAAAc0"]
[Fri Apr 10 00:08:11.237321 2026] [:error] [pid 24624:tid 24639] [client 4.232.92.99:7317] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adfO6-4Jn-WvK1ZBTvgC_AAAAM0"]
[Fri Apr 10 00:08:13.345661 2026] [:error] [pid 63331:tid 63348] [client 4.232.92.99:31318] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adfO7SbKfIYuVjWbE4WwwAAAAc8"]
[Fri Apr 10 00:08:15.834952 2026] [:error] [pid 24517:tid 24594] [client 4.232.92.99:31331] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adfO73boYEn2ZFM_PS-Q7AAAAJQ"]
[Fri Apr 10 00:08:26.514316 2026] [:error] [pid 24515:tid 24521] [client 4.232.92.99:31358] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adfO-q1OMnvM2fMnB1MNAAAAAAI"]
[Fri Apr 10 00:08:46.868190 2026] [:error] [pid 24927:tid 24943] [client 4.232.92.99:7318] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfPDjXObuzEuw8mNJtBeAAAAQ0"]
[Fri Apr 10 00:09:27.143769 2026] [:error] [pid 63331:tid 63339] [client 4.232.92.99:31596] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adfPNybKfIYuVjWbE4WxPwAAAcY"]
[Fri Apr 10 00:09:29.361783 2026] [:error] [pid 24624:tid 24649] [client 4.232.92.99:31558] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adfPOe4Jn-WvK1ZBTvgDWQAAANc"]
[Fri Apr 10 00:09:34.195377 2026] [:error] [pid 63331:tid 63348] [client 4.232.92.99:31371] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adfPPibKfIYuVjWbE4WxTAAAAc8"]
[Fri Apr 10 00:09:36.439222 2026] [:error] [pid 24927:tid 24934] [client 4.232.92.99:31393] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adfPQDXObuzEuw8mNJtBjwAAAQQ"]
[Fri Apr 10 00:10:00.459332 2026] [:error] [pid 24624:tid 24640] [client 4.232.92.99:31567] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "adfPWO4Jn-WvK1ZBTvgDkQAAAM4"]
[Fri Apr 10 00:10:20.067039 2026] [:error] [pid 63331:tid 63354] [client 4.232.92.99:31342] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adfPbCbKfIYuVjWbE4WxogAAAdU"]
[Fri Apr 10 00:10:42.492545 2026] [:error] [pid 20837:tid 20849] [client 4.232.92.99:31603] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adfPgvSL71FHZkjrGzMhUQAAAYo"]
[Fri Apr 10 00:10:45.344033 2026] [:error] [pid 18477:tid 18489] [client 4.232.92.99:31579] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adfPhcDe826HlFeoLPK1lwAAAUo"]
[Fri Apr 10 00:10:48.254196 2026] [:error] [pid 63331:tid 63334] [client 4.232.92.99:7337] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adfPiCbKfIYuVjWbE4WxzgAAAcE"]
[Fri Apr 10 00:10:50.551001 2026] [:error] [pid 24624:tid 24639] [client 4.232.92.99:65425] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adfPiu4Jn-WvK1ZBTvgEAQAAAM0"]
[Fri Apr 10 00:10:54.644033 2026] [:error] [pid 63331:tid 63351] [client 4.232.92.99:7310] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adfPjibKfIYuVjWbE4Wx8QAAAdI"]
[Fri Apr 10 00:10:56.989139 2026] [:error] [pid 20837:tid 20846] [client 4.232.92.99:31585] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adfPkPSL71FHZkjrGzMhXgAAAYc"]
[Fri Apr 10 00:10:58.566054 2026] [:error] [pid 24516:tid 24547] [client 4.232.92.99:31564] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adfPkthW7vSS-UkeWCVHTQAAAEA"]
[Fri Apr 10 00:11:14.192616 2026] [:error] [pid 24927:tid 24950] [client 4.232.92.99:31354] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adfPojXObuzEuw8mNJtB5wAAARQ"]
[Fri Apr 10 00:11:21.381969 2026] [:error] [pid 20837:tid 20856] [client 4.232.92.99:31297] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adfPqfSL71FHZkjrGzMhdAAAAZE"]
[Fri Apr 10 00:12:23.481295 2026] [:error] [pid 24927:tid 24933] [client 4.232.92.99:31408] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adfP5zXObuzEuw8mNJtCLgAAAQM"]
[Fri Apr 10 00:12:28.068780 2026] [:error] [pid 24517:tid 24583] [client 4.232.92.99:65154] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adfP7HboYEn2ZFM_PS-R3wAAAIk"]
[Fri Apr 10 00:12:47.861784 2026] [:error] [pid 24515:tid 24541] [client 4.232.92.99:31377] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adfP_61OMnvM2fMnB1MPQwAAABY"]
[Fri Apr 10 00:12:54.146272 2026] [:error] [pid 24515:tid 24534] [client 4.232.92.99:31389] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adfQBq1OMnvM2fMnB1MPZQAAAA8"]
[Fri Apr 10 00:13:18.895399 2026] [:error] [pid 24624:tid 24639] [client 74.248.136.41:6640] File does not exist: /usr/local/apache/htdocs/suspended-page/btx25.php
[Fri Apr 10 00:13:19.153984 2026] [:error] [pid 24624:tid 24631] [client 74.248.136.41:6640] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Fri Apr 10 00:13:19.412131 2026] [:error] [pid 24624:tid 24627] [client 74.248.136.41:6640] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Fri Apr 10 00:13:19.671272 2026] [:error] [pid 24624:tid 24649] [client 74.248.136.41:6640] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Fri Apr 10 00:13:19.930086 2026] [:error] [pid 24624:tid 24635] [client 74.248.136.41:6640] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Fri Apr 10 00:13:20.189712 2026] [:error] [pid 24624:tid 24643] [client 74.248.136.41:6640] File does not exist: /usr/local/apache/htdocs/suspended-page/bypltspd.php
[Fri Apr 10 00:14:51.990543 2026] [:error] [pid 24515:tid 24534] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 10 00:14:52.260334 2026] [:error] [pid 24515:tid 24543] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Fri Apr 10 00:14:52.505200 2026] [:error] [pid 24515:tid 24522] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 10 00:14:52.741362 2026] [:error] [pid 24515:tid 24530] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Fri Apr 10 00:14:54.292021 2026] [:error] [pid 24515:tid 24530] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Fri Apr 10 00:14:54.555929 2026] [:error] [pid 24515:tid 24536] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Fri Apr 10 00:14:54.795034 2026] [:error] [pid 24515:tid 24533] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 10 00:14:55.047860 2026] [:error] [pid 24515:tid 24526] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Fri Apr 10 00:14:55.308905 2026] [:error] [pid 24515:tid 24529] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Fri Apr 10 00:14:55.569138 2026] [:error] [pid 24515:tid 24528] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Apr 10 00:14:55.837008 2026] [:error] [pid 24515:tid 24542] [client 4.232.92.99:65131] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Fri Apr 10 00:14:56.080341 2026] [:error] [pid 24515:tid 24525] [client 4.232.92.99:65131] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws87.php"] [unique_id "adfQgK1OMnvM2fMnB1MQjAAAAAY"]
[Fri Apr 10 00:15:09.492855 2026] [:error] [pid 20837:tid 20846] [client 4.232.92.99:31552] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws87.php"] [unique_id "adfQjfSL71FHZkjrGzMidgAAAYc"]
[Fri Apr 10 00:15:17.314181 2026] [:error] [pid 24515:tid 24541] [client 4.232.92.99:7298] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adfQla1OMnvM2fMnB1MQswAAABY"]
[Fri Apr 10 00:15:28.209644 2026] [:error] [pid 24624:tid 24648] [client 4.232.92.99:31341] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adfQoO4Jn-WvK1ZBTvgFOAAAANY"]
[Fri Apr 10 00:15:37.413749 2026] [:error] [pid 24516:tid 24571] [client 4.232.92.99:31574] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adfQqdhW7vSS-UkeWCVH4QAAAFg"]
[Fri Apr 10 00:15:45.468110 2026] [:error] [pid 63331:tid 63337] [client 4.232.92.99:31564] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adfQsSbKfIYuVjWbE4Wz3QAAAcQ"]
[Fri Apr 10 00:15:49.251922 2026] [:error] [pid 24927:tid 24948] [client 4.232.92.99:31374] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "adfQtTXObuzEuw8mNJtCsAAAARI"]
[Fri Apr 10 00:16:14.219972 2026] [:error] [pid 24516:tid 24549] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Fri Apr 10 00:16:14.456761 2026] [:error] [pid 24516:tid 24558] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/t2gorhwasq4vioshtatw5eCdefault.php
[Fri Apr 10 00:16:14.708739 2026] [:error] [pid 24516:tid 24561] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Fri Apr 10 00:16:14.950889 2026] [:error] [pid 24516:tid 24562] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/b4txckoieeyhynhsrpi9lCdefault.php
[Fri Apr 10 00:16:15.187012 2026] [:error] [pid 24516:tid 24555] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Fri Apr 10 00:16:15.436149 2026] [:error] [pid 24516:tid 24556] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/wziar1.php
[Fri Apr 10 00:16:16.609360 2026] [:error] [pid 24516:tid 24556] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Fri Apr 10 00:16:16.853335 2026] [:error] [pid 24516:tid 24550] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Fri Apr 10 00:16:17.100077 2026] [:error] [pid 24516:tid 24552] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/8daf1238_1774208172.php
[Fri Apr 10 00:16:17.338116 2026] [:error] [pid 24516:tid 24563] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Fri Apr 10 00:16:17.574710 2026] [:error] [pid 24516:tid 24565] [client 4.232.92.99:65362] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Fri Apr 10 00:16:17.807703 2026] [:error] [pid 24516:tid 24564] [client 4.232.92.99:65362] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "adfQ0dhW7vSS-UkeWCVH8QAAAFE"]
[Fri Apr 10 00:16:38.177627 2026] [:error] [pid 63331:tid 63344] [client 4.232.92.99:31592] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "adfQ5ibKfIYuVjWbE4W0HAAAAcs"]
[Fri Apr 10 00:16:41.271636 2026] [:error] [pid 24517:tid 24592] [client 4.232.92.99:31397] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "adfQ6XboYEn2ZFM_PS-SZQAAAJI"]
[Fri Apr 10 00:16:45.017970 2026] [:error] [pid 24516:tid 24557] [client 4.232.92.99:7336] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/buc.php"] [unique_id "adfQ7dhW7vSS-UkeWCVH_wAAAEo"]
[Fri Apr 10 00:17:09.226598 2026] [:error] [pid 20837:tid 20851] [client 4.232.92.99:31342] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "adfRBfSL71FHZkjrGzMjDgAAAYw"]
[Fri Apr 10 00:17:21.079312 2026] [:error] [pid 63331:tid 63336] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Fri Apr 10 00:17:21.326587 2026] [:error] [pid 63331:tid 63335] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Fri Apr 10 00:17:22.329011 2026] [:error] [pid 63331:tid 63348] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Fri Apr 10 00:17:22.573462 2026] [:error] [pid 63331:tid 63354] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Fri Apr 10 00:17:24.194576 2026] [:error] [pid 63331:tid 63354] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Fri Apr 10 00:17:24.456105 2026] [:error] [pid 63331:tid 63353] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/hhxc.php
[Fri Apr 10 00:17:24.701774 2026] [:error] [pid 63331:tid 63334] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/0yellow.php
[Fri Apr 10 00:17:24.942106 2026] [:error] [pid 63331:tid 63339] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/only.php
[Fri Apr 10 00:17:25.177289 2026] [:error] [pid 63331:tid 63333] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Fri Apr 10 00:17:25.419310 2026] [:error] [pid 63331:tid 63338] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Fri Apr 10 00:17:25.670584 2026] [:error] [pid 63331:tid 63341] [client 4.232.92.99:31350] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Fri Apr 10 00:17:25.902685 2026] [:error] [pid 63331:tid 63344] [client 4.232.92.99:31350] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "adfRFSbKfIYuVjWbE4W0eQAAAcs"]
[Fri Apr 10 00:17:27.776036 2026] [:error] [pid 24515:tid 24519] [client 4.232.92.99:65467] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "adfRF61OMnvM2fMnB1MRpQAAAAA"]
[Fri Apr 10 00:17:51.035302 2026] [:error] [pid 20837:tid 20841] [client 4.232.92.99:31365] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfRL_SL71FHZkjrGzMjOgAAAYI"]
[Fri Apr 10 00:18:15.493004 2026] [:error] [pid 20837:tid 20860] [client 4.232.92.99:31379] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myfile.php"] [unique_id "adfRR_SL71FHZkjrGzMjXgAAAZU"]
[Fri Apr 10 00:18:42.910540 2026] [:error] [pid 18477:tid 18479] [client 143.244.57.120:42260] [client 143.244.57.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.57.120, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adfRYsDe826HlFeoLPK2lwAAAUA"]
[Fri Apr 10 00:18:42.913881 2026] [:error] [pid 18477:tid 18479] [client 143.244.57.120:42260] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 10 00:18:45.955414 2026] [:error] [pid 18477:tid 18489] [client 143.244.57.120:42260] [client 143.244.57.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "adfRZcDe826HlFeoLPK2owAAAUo"]
[Fri Apr 10 00:18:46.522237 2026] [:error] [pid 20837:tid 20859] [client 143.244.57.120:42276] [client 143.244.57.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "adfRZvSL71FHZkjrGzMjcwAAAZQ"]
[Fri Apr 10 00:18:48.820425 2026] [:error] [pid 18477:tid 18484] [client 143.244.57.120:42278] [client 143.244.57.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "adfRaMDe826HlFeoLPK2pAAAAUU"]
[Fri Apr 10 00:18:49.383038 2026] [:error] [pid 24516:tid 24555] [client 143.244.57.120:42280] [client 143.244.57.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "adfRadhW7vSS-UkeWCVIMgAAAEg"]
[Fri Apr 10 00:18:49.929493 2026] [:error] [pid 24516:tid 24550] [client 143.244.57.120:42282] [client 143.244.57.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "adfRadhW7vSS-UkeWCVINAAAAEM"]
[Fri Apr 10 00:18:50.474660 2026] [:error] [pid 24515:tid 24535] [client 143.244.57.120:42296] [client 143.244.57.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "adfRaq1OMnvM2fMnB1MSeQAAABA"]
[Fri Apr 10 00:18:51.015648 2026] [:error] [pid 24515:tid 24525] [client 143.244.57.120:42298] [client 143.244.57.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "adfRa61OMnvM2fMnB1MSegAAAAY"]
[Fri Apr 10 01:08:11.966921 2026] [:error] [pid 21486:tid 21506] [client 103.186.40.199:14996] [client 103.186.40.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.40.199, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adfc-6BRftltyNdYwLodewAAARI"]
[Fri Apr 10 01:08:11.972879 2026] [:error] [pid 21486:tid 21506] [client 103.186.40.199:14996] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 10 09:45:50.265913 2026] [:error] [pid 13100:tid 13122] [client 176.227.240.73:53844] [client 176.227.240.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.227.240.73, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "adhWTlzg-ZkZ0InWIP3GugAAARE"]
[Fri Apr 10 09:45:50.269999 2026] [:error] [pid 13100:tid 13122] [client 176.227.240.73:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Apr 10 12:10:00.404647 2026] [:error] [pid 13100:tid 13105] [client 189.4.106.15:11993] [client 189.4.106.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.4.106.15, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adh4GFzg-ZkZ0InWIP0DNwAAAQA"]
[Fri Apr 10 12:10:00.419079 2026] [:error] [pid 13100:tid 13105] [client 189.4.106.15:11993] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 10 14:58:19.421210 2026] [:error] [pid 13189:tid 13200] [client 213.177.179.116:50900] [client 213.177.179.116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "adifi5AxiJKPums3eBDY-wAAAEg"]
[Fri Apr 10 14:58:24.241818 2026] [:error] [pid 13101:tid 13155] [client 213.177.179.116:52545] [client 213.177.179.116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.env"] [unique_id "adifkN8Ldw85818pj2o-pQAAAJY"]
[Fri Apr 10 17:57:05.965776 2026] [:error] [pid 13100:tid 13107] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Fri Apr 10 17:57:06.201828 2026] [:error] [pid 13100:tid 13120] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Fri Apr 10 17:57:07.674335 2026] [:error] [pid 13100:tid 13120] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Fri Apr 10 17:57:07.910643 2026] [:error] [pid 13100:tid 13122] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Fri Apr 10 17:57:08.149582 2026] [:error] [pid 13100:tid 13109] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Fri Apr 10 17:57:08.386741 2026] [:error] [pid 13100:tid 13113] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/filemanger2.php
[Fri Apr 10 17:57:08.621707 2026] [:error] [pid 13100:tid 13128] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 10 17:57:08.977026 2026] [:error] [pid 13100:tid 13120] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-vn1.php
[Fri Apr 10 17:57:09.212372 2026] [:error] [pid 13100:tid 13122] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Fri Apr 10 17:57:09.446862 2026] [:error] [pid 13100:tid 13116] [client 51.103.82.36:48381] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Fri Apr 10 17:57:09.677818 2026] [:error] [pid 13100:tid 13124] [client 51.103.82.36:48381] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adjJdVzg-ZkZ0InWIP1_iAAAARM"]
[Fri Apr 10 17:57:10.972435 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:44411] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adjJdoa41m-BS8mg82d0xgAAAMY"]
[Fri Apr 10 17:57:11.687517 2026] [:error] [pid 3934:tid 3957] [client 51.103.82.36:59283] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adjJd4a41m-BS8mg82d0yAAAANI"]
[Fri Apr 10 17:57:12.713940 2026] [:error] [pid 13102:tid 13179] [client 51.103.82.36:39559] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adjJeP9xLvjW2guI55ZMwwAAABM"]
[Fri Apr 10 17:57:13.646681 2026] [:error] [pid 13101:tid 13154] [client 51.103.82.36:44348] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adjJed8Ldw85818pj2qQaQAAAJU"]
[Fri Apr 10 17:57:14.454896 2026] [:error] [pid 13102:tid 13177] [client 51.103.82.36:2877] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adjJev9xLvjW2guI55ZMxAAAABE"]
[Fri Apr 10 17:57:15.249660 2026] [:error] [pid 13189:tid 13204] [client 51.103.82.36:2728] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adjJe5AxiJKPums3eBBeegAAAEw"]
[Fri Apr 10 17:57:16.112443 2026] [:error] [pid 13101:tid 13145] [client 51.103.82.36:2866] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adjJfN8Ldw85818pj2qQcAAAAIw"]
[Fri Apr 10 17:57:16.705555 2026] [:error] [pid 13189:tid 13215] [client 51.103.82.36:50703] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjJfJAxiJKPums3eBBefQAAAFc"]
[Fri Apr 10 17:57:17.324289 2026] [:error] [pid 13189:tid 13200] [client 51.103.82.36:21439] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjJfZAxiJKPums3eBBegAAAAEg"]
[Fri Apr 10 17:57:18.095566 2026] [:error] [pid 13189:tid 13208] [client 51.103.82.36:19923] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjJfpAxiJKPums3eBBehAAAAFA"]
[Fri Apr 10 17:57:18.969899 2026] [:error] [pid 13100:tid 13114] [client 51.103.82.36:2850] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjJflzg-ZkZ0InWIP1_tQAAAQk"]
[Fri Apr 10 17:57:19.636850 2026] [:error] [pid 13102:tid 13169] [client 51.103.82.36:19958] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adjJf_9xLvjW2guI55ZM4AAAAAk"]
[Fri Apr 10 17:57:20.252220 2026] [:error] [pid 13189:tid 13196] [client 51.103.82.36:44341] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adjJgJAxiJKPums3eBBeiAAAAEQ"]
[Fri Apr 10 17:57:21.412783 2026] [:error] [pid 13189:tid 13197] [client 51.103.82.36:59301] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adjJgZAxiJKPums3eBBekAAAAEU"]
[Fri Apr 10 17:57:22.275516 2026] [:error] [pid 13189:tid 13199] [client 51.103.82.36:59304] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adjJgpAxiJKPums3eBBekgAAAEc"]
[Fri Apr 10 17:57:23.143687 2026] [:error] [pid 13101:tid 13156] [client 51.103.82.36:40213] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adjJg98Ldw85818pj2qQeQAAAJc"]
[Fri Apr 10 17:57:23.961450 2026] [:error] [pid 3934:tid 3963] [client 51.103.82.36:2835] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adjJg4a41m-BS8mg82d1CAAAANg"]
[Fri Apr 10 17:57:24.623010 2026] [:error] [pid 13189:tid 13203] [client 51.103.82.36:2391] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adjJhJAxiJKPums3eBBelwAAAEs"]
[Fri Apr 10 17:57:25.406674 2026] [:error] [pid 13101:tid 13141] [client 51.103.82.36:50720] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adjJhd8Ldw85818pj2qQfQAAAIg"]
[Fri Apr 10 17:57:26.815792 2026] [:error] [pid 13101:tid 13143] [client 51.103.82.36:21396] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjJht8Ldw85818pj2qQgwAAAIo"]
[Fri Apr 10 17:57:27.853142 2026] [:error] [pid 13100:tid 13117] [client 51.103.82.36:40216] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjJh1zg-ZkZ0InWIP1_2AAAAQw"]
[Fri Apr 10 17:57:28.665729 2026] [:error] [pid 13100:tid 13129] [client 51.103.82.36:17506] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjJiFzg-ZkZ0InWIP1_2wAAARg"]
[Fri Apr 10 17:57:29.769100 2026] [:error] [pid 13102:tid 13173] [client 51.103.82.36:2711] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjJif9xLvjW2guI55ZNEQAAAA0"]
[Fri Apr 10 17:57:30.596819 2026] [:error] [pid 13102:tid 13184] [client 51.103.82.36:21390] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adjJiv9xLvjW2guI55ZNGAAAABg"]
[Fri Apr 10 17:57:31.294727 2026] [:error] [pid 13189:tid 13199] [client 51.103.82.36:25392] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adjJi5AxiJKPums3eBBeqwAAAEc"]
[Fri Apr 10 17:57:32.201296 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:17485] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adjJjIa41m-BS8mg82d1FAAAAMo"]
[Fri Apr 10 17:57:33.130637 2026] [:error] [pid 13102:tid 13171] [client 51.103.82.36:2398] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adjJjf9xLvjW2guI55ZNJQAAAAs"]
[Fri Apr 10 17:57:33.739142 2026] [:error] [pid 13189:tid 13195] [client 51.103.82.36:40204] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adjJjZAxiJKPums3eBBetwAAAEM"]
[Fri Apr 10 17:57:34.436060 2026] [:error] [pid 13100:tid 13126] [client 51.103.82.36:2734] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adjJjlzg-ZkZ0InWIP1_4QAAARU"]
[Fri Apr 10 17:57:34.970918 2026] [:error] [pid 3934:tid 3953] [client 51.103.82.36:50703] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adjJjoa41m-BS8mg82d1GgAAAM4"]
[Fri Apr 10 17:57:35.623058 2026] [:error] [pid 3934:tid 3944] [client 51.103.82.36:2700] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adjJj4a41m-BS8mg82d1HAAAAMU"]
[Fri Apr 10 17:57:36.316124 2026] [:error] [pid 13100:tid 13119] [client 51.103.82.36:21404] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adjJkFzg-ZkZ0InWIP1_5gAAAQ4"]
[Fri Apr 10 17:57:36.904489 2026] [:error] [pid 13102:tid 13169] [client 51.103.82.36:24372] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adjJkP9xLvjW2guI55ZNOwAAAAk"]
[Fri Apr 10 17:57:37.477434 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:53261] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adjJkYa41m-BS8mg82d1IQAAAMw"]
[Fri Apr 10 17:57:38.065973 2026] [:error] [pid 13100:tid 13121] [client 51.103.82.36:17744] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adjJklzg-ZkZ0InWIP1_6wAAARA"]
[Fri Apr 10 17:57:38.849681 2026] [:error] [pid 13101:tid 13145] [client 51.103.82.36:25368] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adjJkt8Ldw85818pj2qQyQAAAIw"]
[Fri Apr 10 17:57:39.787370 2026] [:error] [pid 13101:tid 13137] [client 51.103.82.36:2995] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adjJk98Ldw85818pj2qQzAAAAIQ"]
[Fri Apr 10 17:57:40.562872 2026] [:error] [pid 13189:tid 13207] [client 51.103.82.36:20712] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adjJlJAxiJKPums3eBBeywAAAE8"]
[Fri Apr 10 17:57:41.738010 2026] [:error] [pid 13189:tid 13216] [client 51.103.82.36:2773] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adjJlZAxiJKPums3eBBe0QAAAFg"]
[Fri Apr 10 17:57:42.412712 2026] [:error] [pid 13189:tid 13193] [client 51.103.82.36:2988] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adjJlpAxiJKPums3eBBe0gAAAEE"]
[Fri Apr 10 17:57:43.058077 2026] [:error] [pid 13189:tid 13213] [client 51.103.82.36:27902] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adjJl5AxiJKPums3eBBe1wAAAFU"]
[Fri Apr 10 17:57:43.675726 2026] [:error] [pid 13189:tid 13209] [client 51.103.82.36:17780] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adjJl5AxiJKPums3eBBe3AAAAFE"]
[Fri Apr 10 17:57:44.605685 2026] [:error] [pid 13189:tid 13212] [client 51.103.82.36:17263] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adjJmJAxiJKPums3eBBe4gAAAFQ"]
[Fri Apr 10 17:57:45.426527 2026] [:error] [pid 13189:tid 13205] [client 51.103.82.36:2829] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adjJmZAxiJKPums3eBBe4wAAAE0"]
[Fri Apr 10 17:57:46.680691 2026] [:error] [pid 13100:tid 13121] [client 51.103.82.36:17201] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adjJmlzg-ZkZ0InWIP2AAgAAARA"]
[Fri Apr 10 17:57:47.606948 2026] [:error] [pid 13189:tid 13213] [client 51.103.82.36:27843] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adjJm5AxiJKPums3eBBe7AAAAFU"]
[Fri Apr 10 17:57:48.346915 2026] [:error] [pid 3934:tid 3947] [client 51.103.82.36:31513] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adjJnIa41m-BS8mg82d1MgAAAMg"]
[Fri Apr 10 17:57:49.164551 2026] [:error] [pid 13100:tid 13109] [client 51.103.82.36:25370] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adjJnVzg-ZkZ0InWIP2ABAAAAQQ"]
[Fri Apr 10 17:57:49.688795 2026] [:error] [pid 3934:tid 3963] [client 51.103.82.36:17767] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adjJnYa41m-BS8mg82d1NgAAANg"]
[Fri Apr 10 17:57:50.313508 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:17265] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adjJnoa41m-BS8mg82d1NwAAAMw"]
[Fri Apr 10 17:57:50.971049 2026] [:error] [pid 13101:tid 13156] [client 51.103.82.36:25390] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adjJnt8Ldw85818pj2qRBQAAAJc"]
[Fri Apr 10 17:57:51.799712 2026] [:error] [pid 13100:tid 13110] [client 51.103.82.36:17269] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adjJn1zg-ZkZ0InWIP2ACwAAAQU"]
[Fri Apr 10 17:57:52.722017 2026] [:error] [pid 13102:tid 13179] [client 51.103.82.36:17275] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adjJoP9xLvjW2guI55ZNTQAAABM"]
[Fri Apr 10 17:57:53.381113 2026] [:error] [pid 13189:tid 13209] [client 51.103.82.36:49546] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adjJoZAxiJKPums3eBBe_AAAAFE"]
[Fri Apr 10 17:57:53.976012 2026] [:error] [pid 13189:tid 13211] [client 51.103.82.36:49550] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adjJoZAxiJKPums3eBBe_wAAAFM"]
[Fri Apr 10 17:57:54.631476 2026] [:error] [pid 13189:tid 13201] [client 51.103.82.36:20683] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adjJopAxiJKPums3eBBfBgAAAEk"]
[Fri Apr 10 17:57:55.209031 2026] [:error] [pid 13101:tid 13142] [client 51.103.82.36:24347] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adjJo98Ldw85818pj2qRDAAAAIk"]
[Fri Apr 10 17:57:55.824863 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:31518] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adjJo4a41m-BS8mg82d1SQAAAMY"]
[Fri Apr 10 17:57:56.578030 2026] [:error] [pid 13101:tid 13133] [client 51.103.82.36:31498] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adjJpN8Ldw85818pj2qRDgAAAIA"]
[Fri Apr 10 17:57:57.112791 2026] [:error] [pid 13101:tid 13137] [client 51.103.82.36:27865] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "adjJpd8Ldw85818pj2qREQAAAIQ"]
[Fri Apr 10 17:57:57.758830 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:24322] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "adjJpYa41m-BS8mg82d1VwAAAM0"]
[Fri Apr 10 17:57:58.352192 2026] [:error] [pid 13189:tid 13208] [client 51.103.82.36:17169] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "adjJppAxiJKPums3eBBfDgAAAFA"]
[Fri Apr 10 17:57:58.989323 2026] [:error] [pid 3934:tid 3942] [client 51.103.82.36:2722] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turkshell.php"] [unique_id "adjJpoa41m-BS8mg82d1XgAAAMM"]
[Fri Apr 10 17:57:59.672545 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:27854] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "adjJp4a41m-BS8mg82d1YgAAAM0"]
[Fri Apr 10 17:58:00.256413 2026] [:error] [pid 13102:tid 13183] [client 51.103.82.36:27874] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "adjJqP9xLvjW2guI55ZNWgAAABc"]
[Fri Apr 10 17:58:00.991681 2026] [:error] [pid 13102:tid 13182] [client 51.103.82.36:25904] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "adjJqP9xLvjW2guI55ZNXQAAABY"]
[Fri Apr 10 17:58:01.571275 2026] [:error] [pid 13100:tid 13113] [client 51.103.82.36:2942] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tea.php"] [unique_id "adjJqVzg-ZkZ0InWIP2AIwAAAQg"]
[Fri Apr 10 17:58:02.146221 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:2933] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adjJqoa41m-BS8mg82d1bAAAAM0"]
[Fri Apr 10 17:58:02.820367 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:25891] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adjJqoa41m-BS8mg82d1cQAAAMA"]
[Fri Apr 10 17:58:03.645402 2026] [:error] [pid 13189:tid 13210] [client 51.103.82.36:36686] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adjJq5AxiJKPums3eBBfHgAAAFI"]
[Fri Apr 10 17:58:04.260861 2026] [:error] [pid 13102:tid 13175] [client 51.103.82.36:33386] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/seo.php"] [unique_id "adjJrP9xLvjW2guI55ZNZQAAAA8"]
[Fri Apr 10 17:58:05.004533 2026] [:error] [pid 3934:tid 3957] [client 51.103.82.36:25875] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjJrYa41m-BS8mg82d1gAAAANI"]
[Fri Apr 10 17:58:05.720022 2026] [:error] [pid 13101:tid 13142] [client 51.103.82.36:49626] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjJrd8Ldw85818pj2qRIwAAAIk"]
[Fri Apr 10 17:58:06.772296 2026] [:error] [pid 13101:tid 13151] [client 51.103.82.36:17741] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjJrt8Ldw85818pj2qRKgAAAJI"]
[Fri Apr 10 17:58:07.793510 2026] [:error] [pid 13102:tid 13178] [client 51.103.82.36:49624] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjJr_9xLvjW2guI55ZNbgAAABI"]
[Fri Apr 10 17:58:09.775118 2026] [:error] [pid 3934:tid 3946] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 10 17:58:10.009861 2026] [:error] [pid 3934:tid 3950] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Apr 10 17:58:10.244434 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Apr 10 17:58:10.485024 2026] [:error] [pid 3934:tid 3955] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Fri Apr 10 17:58:10.723058 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Fri Apr 10 17:58:10.959056 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Fri Apr 10 17:58:11.205926 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Fri Apr 10 17:58:11.454702 2026] [:error] [pid 3934:tid 3947] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Fri Apr 10 17:58:11.689429 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Fri Apr 10 17:58:11.923600 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/.mopj.php
[Fri Apr 10 17:58:12.157525 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:36679] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 10 17:58:12.390106 2026] [:error] [pid 3934:tid 3962] [client 51.103.82.36:36679] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adjJtIa41m-BS8mg82d1uwAAANc"]
[Fri Apr 10 17:58:13.001037 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:18466] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adjJtYa41m-BS8mg82d1wAAAAMY"]
[Fri Apr 10 17:58:13.875502 2026] [:error] [pid 3934:tid 3960] [client 51.103.82.36:41505] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adjJtYa41m-BS8mg82d1ygAAANU"]
[Fri Apr 10 17:58:15.241884 2026] [:error] [pid 3934:tid 3960] [client 51.103.82.36:19868] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adjJt4a41m-BS8mg82d10QAAANU"]
[Fri Apr 10 17:58:16.186155 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:18490] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adjJuIa41m-BS8mg82d12gAAAMo"]
[Fri Apr 10 17:58:16.903460 2026] [:error] [pid 13101:tid 13153] [client 51.103.82.36:19875] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adjJuN8Ldw85818pj2qRNgAAAJQ"]
[Fri Apr 10 17:58:17.909236 2026] [:error] [pid 13100:tid 13107] [client 51.103.82.36:18440] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adjJuVzg-ZkZ0InWIP2AKwAAAQI"]
[Fri Apr 10 17:58:18.584024 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:19873] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adjJuoa41m-BS8mg82d14wAAAM0"]
[Fri Apr 10 17:58:19.177966 2026] [:error] [pid 13189:tid 13215] [client 51.103.82.36:41524] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adjJu5AxiJKPums3eBBfMwAAAFc"]
[Fri Apr 10 17:58:20.486286 2026] [:error] [pid 13100:tid 13112] [client 51.103.82.36:49615] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adjJvFzg-ZkZ0InWIP2AMgAAAQc"]
[Fri Apr 10 17:58:21.900946 2026] [:error] [pid 13100:tid 13129] [client 51.103.82.36:28179] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adjJvVzg-ZkZ0InWIP2ANgAAARg"]
[Fri Apr 10 17:58:23.247666 2026] [:error] [pid 13100:tid 13116] [client 51.103.82.36:41490] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adjJv1zg-ZkZ0InWIP2AOAAAAQs"]
[Fri Apr 10 17:58:24.213650 2026] [:error] [pid 13100:tid 13105] [client 51.103.82.36:18473] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adjJwFzg-ZkZ0InWIP2AOwAAAQA"]
[Fri Apr 10 17:58:25.051063 2026] [:error] [pid 13101:tid 13153] [client 51.103.82.36:28216] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adjJwd8Ldw85818pj2qRUAAAAJQ"]
[Fri Apr 10 17:58:25.785554 2026] [:error] [pid 13100:tid 13108] [client 51.103.82.36:41530] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adjJwVzg-ZkZ0InWIP2AQgAAAQM"]
[Fri Apr 10 17:58:26.524349 2026] [:error] [pid 13101:tid 13148] [client 51.103.82.36:48916] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adjJwt8Ldw85818pj2qRUwAAAI8"]
[Fri Apr 10 17:58:27.777835 2026] [:error] [pid 13102:tid 13178] [client 51.103.82.36:48957] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adjJw_9xLvjW2guI55ZNhAAAABI"]
[Fri Apr 10 17:58:28.977443 2026] [:error] [pid 13100:tid 13119] [client 51.103.82.36:28705] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adjJxFzg-ZkZ0InWIP2ATAAAAQ4"]
[Fri Apr 10 17:58:29.849982 2026] [:error] [pid 13189:tid 13207] [client 51.103.82.36:28169] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adjJxZAxiJKPums3eBBfRwAAAE8"]
[Fri Apr 10 17:58:31.217385 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:36733] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adjJx4a41m-BS8mg82d1-QAAAMA"]
[Fri Apr 10 17:58:31.891750 2026] [:error] [pid 3934:tid 3946] [client 51.103.82.36:41486] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adjJx4a41m-BS8mg82d1_AAAAMc"]
[Fri Apr 10 17:58:33.928824 2026] [:error] [pid 13101:tid 13147] [client 51.103.82.36:49662] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adjJyd8Ldw85818pj2qRYQAAAI4"]
[Fri Apr 10 17:58:35.207785 2026] [:error] [pid 13189:tid 13194] [client 51.103.82.36:25920] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adjJy5AxiJKPums3eBBfVgAAAEI"]
[Fri Apr 10 17:58:36.270006 2026] [:error] [pid 13102:tid 13173] [client 51.103.82.36:38105] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adjJzP9xLvjW2guI55ZNjgAAAA0"]
[Fri Apr 10 17:58:36.799006 2026] [:error] [pid 13102:tid 13176] [client 51.103.82.36:48901] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adjJzP9xLvjW2guI55ZNjwAAABA"]
[Fri Apr 10 17:58:37.810880 2026] [:error] [pid 13101:tid 13139] [client 51.103.82.36:21020] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adjJzd8Ldw85818pj2qRagAAAIY"]
[Fri Apr 10 17:58:39.227986 2026] [:error] [pid 13101:tid 13155] [client 51.103.82.36:19853] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adjJz98Ldw85818pj2qRcgAAAJY"]
[Fri Apr 10 17:58:39.997698 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:28192] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adjJz4a41m-BS8mg82d2FgAAAMw"]
[Fri Apr 10 17:58:41.052367 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:61193] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adjJ0Ya41m-BS8mg82d2IAAAAMA"]
[Fri Apr 10 17:58:41.691511 2026] [:error] [pid 3934:tid 3947] [client 51.103.82.36:19902] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adjJ0Ya41m-BS8mg82d2JAAAAMg"]
[Fri Apr 10 17:58:42.764750 2026] [:error] [pid 13102:tid 13176] [client 51.103.82.36:18477] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adjJ0v9xLvjW2guI55ZNmgAAABA"]
[Fri Apr 10 17:58:44.157448 2026] [:error] [pid 3934:tid 3940] [client 51.103.82.36:61189] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adjJ1Ia41m-BS8mg82d2NQAAAME"]
[Fri Apr 10 17:58:44.786885 2026] [:error] [pid 13101:tid 13133] [client 51.103.82.36:28199] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adjJ1N8Ldw85818pj2qRgQAAAIA"]
[Fri Apr 10 17:58:45.394645 2026] [:error] [pid 13101:tid 13151] [client 51.103.82.36:21010] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adjJ1d8Ldw85818pj2qRhgAAAJI"]
[Fri Apr 10 17:58:46.036645 2026] [:error] [pid 13101:tid 13153] [client 51.103.82.36:25979] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adjJ1t8Ldw85818pj2qRigAAAJQ"]
[Fri Apr 10 17:58:46.914477 2026] [:error] [pid 3934:tid 3940] [client 51.103.82.36:18469] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adjJ1oa41m-BS8mg82d2QAAAAME"]
[Fri Apr 10 17:58:47.647006 2026] [:error] [pid 13101:tid 13156] [client 51.103.82.36:17209] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adjJ198Ldw85818pj2qRjwAAAJc"]
[Fri Apr 10 17:58:48.374305 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:49616] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adjJ2Ia41m-BS8mg82d2SgAAAM0"]
[Fri Apr 10 17:58:49.673519 2026] [:error] [pid 3934:tid 3954] [client 51.103.82.36:36717] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adjJ2Ya41m-BS8mg82d2TAAAAM8"]
[Fri Apr 10 17:58:50.916769 2026] [:error] [pid 13189:tid 13192] [client 51.103.82.36:21044] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adjJ2pAxiJKPums3eBBfewAAAEA"]
[Fri Apr 10 17:58:52.970002 2026] [:error] [pid 13189:tid 13192] [client 51.103.82.36:17782] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adjJ3JAxiJKPums3eBBfhAAAAEA"]
[Fri Apr 10 17:58:54.182527 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:36695] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adjJ3oa41m-BS8mg82d2WgAAAMo"]
[Fri Apr 10 17:58:56.312794 2026] [:error] [pid 3934:tid 3962] [client 51.103.82.36:17176] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adjJ4Ia41m-BS8mg82d2aAAAANc"]
[Fri Apr 10 17:58:58.512528 2026] [:error] [pid 13189:tid 13197] [client 51.103.82.36:17274] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adjJ4pAxiJKPums3eBBfmwAAAEU"]
[Fri Apr 10 17:58:59.762045 2026] [:error] [pid 13100:tid 13126] [client 51.103.82.36:17480] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adjJ41zg-ZkZ0InWIP2AaQAAARU"]
[Fri Apr 10 17:59:01.359128 2026] [:error] [pid 13101:tid 13139] [client 51.103.82.36:17754] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adjJ5d8Ldw85818pj2qRugAAAIY"]
[Fri Apr 10 17:59:02.478709 2026] [:error] [pid 13101:tid 13151] [client 51.103.82.36:28268] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adjJ5t8Ldw85818pj2qRwQAAAJI"]
[Fri Apr 10 17:59:03.100038 2026] [:error] [pid 3934:tid 3950] [client 51.103.82.36:37284] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adjJ54a41m-BS8mg82d2dQAAAMs"]
[Fri Apr 10 17:59:04.474946 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:18721] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adjJ6Ia41m-BS8mg82d2gAAAAMw"]
[Fri Apr 10 17:59:05.586366 2026] [:error] [pid 3934:tid 3956] [client 51.103.82.36:22929] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adjJ6Ya41m-BS8mg82d2hQAAANE"]
[Fri Apr 10 17:59:06.786897 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:63016] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adjJ6oa41m-BS8mg82d2iwAAAMw"]
[Fri Apr 10 17:59:07.975723 2026] [:error] [pid 13100:tid 13128] [client 51.103.82.36:45629] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zample.php"] [unique_id "adjJ61zg-ZkZ0InWIP2AcQAAARc"]
[Fri Apr 10 17:59:09.064511 2026] [:error] [pid 13100:tid 13125] [client 51.103.82.36:22614] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adjJ7Vzg-ZkZ0InWIP2AdQAAARQ"]
[Fri Apr 10 17:59:09.704301 2026] [:error] [pid 3934:tid 3961] [client 51.103.82.36:35345] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adjJ7Ya41m-BS8mg82d2kgAAANY"]
[Fri Apr 10 17:59:10.694944 2026] [:error] [pid 13101:tid 13140] [client 51.103.82.36:33789] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adjJ7t8Ldw85818pj2qR1AAAAIc"]
[Fri Apr 10 17:59:11.924588 2026] [:error] [pid 13102:tid 13170] [client 51.103.82.36:62050] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adjJ7_9xLvjW2guI55ZN0gAAAAo"]
[Fri Apr 10 17:59:13.517565 2026] [:error] [pid 13101:tid 13141] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Fri Apr 10 17:59:13.751688 2026] [:error] [pid 13101:tid 13135] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Apr 10 17:59:13.988445 2026] [:error] [pid 13101:tid 13151] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Fri Apr 10 17:59:14.225001 2026] [:error] [pid 13101:tid 13137] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Fri Apr 10 17:59:14.460874 2026] [:error] [pid 13101:tid 13147] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Fri Apr 10 17:59:14.698340 2026] [:error] [pid 13101:tid 13150] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Fri Apr 10 17:59:14.933079 2026] [:error] [pid 13101:tid 13155] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Fri Apr 10 17:59:15.167205 2026] [:error] [pid 13101:tid 13152] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Fri Apr 10 17:59:15.403687 2026] [:error] [pid 13101:tid 13138] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Fri Apr 10 17:59:15.638890 2026] [:error] [pid 13101:tid 13156] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Fri Apr 10 17:59:15.878010 2026] [:error] [pid 13101:tid 13134] [client 51.103.82.36:35408] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Apr 10 17:59:16.157709 2026] [:error] [pid 13101:tid 13148] [client 51.103.82.36:35408] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adjJ9N8Ldw85818pj2qR6gAAAI8"]
[Fri Apr 10 17:59:16.781043 2026] [:error] [pid 13102:tid 13170] [client 51.103.82.36:20300] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adjJ9P9xLvjW2guI55ZN3AAAAAo"]
[Fri Apr 10 17:59:17.404490 2026] [:error] [pid 13102:tid 13182] [client 51.103.82.36:63019] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adjJ9f9xLvjW2guI55ZN3gAAABY"]
[Fri Apr 10 17:59:18.057180 2026] [:error] [pid 13102:tid 13184] [client 51.103.82.36:32357] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adjJ9v9xLvjW2guI55ZN4gAAABg"]
[Fri Apr 10 17:59:18.794823 2026] [:error] [pid 13101:tid 13155] [client 51.103.82.36:30871] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adjJ9t8Ldw85818pj2qR7gAAAJY"]
[Fri Apr 10 17:59:19.575933 2026] [:error] [pid 13102:tid 13180] [client 51.103.82.36:27489] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adjJ9_9xLvjW2guI55ZN9QAAABQ"]
[Fri Apr 10 17:59:20.332096 2026] [:error] [pid 13100:tid 13124] [client 51.103.82.36:62037] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adjJ-Fzg-ZkZ0InWIP2AnAAAARM"]
[Fri Apr 10 17:59:20.977382 2026] [:error] [pid 13189:tid 13202] [client 51.103.82.36:20327] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adjJ-JAxiJKPums3eBBfrwAAAEo"]
[Fri Apr 10 17:59:21.542936 2026] [:error] [pid 13100:tid 13117] [client 51.103.82.36:27476] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adjJ-Vzg-ZkZ0InWIP2AnQAAAQw"]
[Fri Apr 10 17:59:22.410054 2026] [:error] [pid 13100:tid 13126] [client 51.103.82.36:27480] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adjJ-lzg-ZkZ0InWIP2AngAAARU"]
[Fri Apr 10 17:59:23.402456 2026] [:error] [pid 13100:tid 13109] [client 51.103.82.36:46242] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adjJ-1zg-ZkZ0InWIP2AqgAAAQQ"]
[Fri Apr 10 17:59:24.363796 2026] [:error] [pid 3934:tid 3954] [client 51.103.82.36:22592] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adjJ_Ia41m-BS8mg82d2tAAAAM8"]
[Fri Apr 10 17:59:25.303353 2026] [:error] [pid 3934:tid 3957] [client 51.103.82.36:32339] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adjJ_Ya41m-BS8mg82d2wgAAANI"]
[Fri Apr 10 17:59:25.978080 2026] [:error] [pid 3934:tid 3955] [client 51.103.82.36:33731] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adjJ_Ya41m-BS8mg82d2xgAAANA"]
[Fri Apr 10 17:59:26.664663 2026] [:error] [pid 13189:tid 13195] [client 51.103.82.36:20325] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adjJ_pAxiJKPums3eBBfuAAAAEM"]
[Fri Apr 10 17:59:27.334705 2026] [:error] [pid 3934:tid 3953] [client 51.103.82.36:46224] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adjJ_4a41m-BS8mg82d2zAAAAM4"]
[Fri Apr 10 17:59:28.097387 2026] [:error] [pid 13100:tid 13126] [client 51.103.82.36:50794] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adjKAFzg-ZkZ0InWIP2A9QAAARU"]
[Fri Apr 10 17:59:28.985481 2026] [:error] [pid 3934:tid 3959] [client 51.103.82.36:50759] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adjKAIa41m-BS8mg82d20wAAANQ"]
[Fri Apr 10 17:59:29.739294 2026] [:error] [pid 3934:tid 3955] [client 51.103.82.36:50808] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adjKAYa41m-BS8mg82d22gAAANA"]
[Fri Apr 10 17:59:30.357842 2026] [:error] [pid 3934:tid 3954] [client 51.103.82.36:50778] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adjKAoa41m-BS8mg82d24QAAAM8"]
[Fri Apr 10 17:59:30.899397 2026] [:error] [pid 13100:tid 13108] [client 51.103.82.36:22655] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adjKAlzg-ZkZ0InWIP2A_QAAAQM"]
[Fri Apr 10 17:59:31.477676 2026] [:error] [pid 13189:tid 13211] [client 51.103.82.36:20313] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adjKA5AxiJKPums3eBBfwwAAAFM"]
[Fri Apr 10 17:59:32.039777 2026] [:error] [pid 13102:tid 13170] [client 51.103.82.36:22630] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adjKBP9xLvjW2guI55ZOFQAAAAo"]
[Fri Apr 10 17:59:32.628358 2026] [:error] [pid 13102:tid 13161] [client 51.103.82.36:62020] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adjKBP9xLvjW2guI55ZOFwAAAAE"]
[Fri Apr 10 17:59:33.290878 2026] [:error] [pid 13189:tid 13201] [client 51.103.82.36:62985] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adjKBZAxiJKPums3eBBfxwAAAEk"]
[Fri Apr 10 17:59:33.918701 2026] [:error] [pid 13189:tid 13203] [client 51.103.82.36:35385] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adjKBZAxiJKPums3eBBf0AAAAEs"]
[Fri Apr 10 17:59:34.489769 2026] [:error] [pid 13100:tid 13127] [client 51.103.82.36:33787] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adjKBlzg-ZkZ0InWIP2BCgAAARY"]
[Fri Apr 10 17:59:35.119044 2026] [:error] [pid 13101:tid 13139] [client 51.103.82.36:24921] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adjKB98Ldw85818pj2qR_AAAAIY"]
[Fri Apr 10 17:59:35.813385 2026] [:error] [pid 13189:tid 13204] [client 51.103.82.36:22645] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adjKB5AxiJKPums3eBBf1gAAAEw"]
[Fri Apr 10 17:59:36.585934 2026] [:error] [pid 13189:tid 13197] [client 51.103.82.36:35346] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adjKCJAxiJKPums3eBBf2QAAAEU"]
[Fri Apr 10 17:59:37.247441 2026] [:error] [pid 13102:tid 13170] [client 51.103.82.36:46235] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adjKCf9xLvjW2guI55ZOIwAAAAo"]
[Fri Apr 10 17:59:37.996340 2026] [:error] [pid 13102:tid 13171] [client 51.103.82.36:46229] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adjKCf9xLvjW2guI55ZOKAAAAAs"]
[Fri Apr 10 17:59:39.261816 2026] [:error] [pid 13100:tid 13126] [client 51.103.82.36:30873] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adjKC1zg-ZkZ0InWIP2BFQAAARU"]
[Fri Apr 10 17:59:39.888120 2026] [:error] [pid 13100:tid 13108] [client 51.103.82.36:63008] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adjKC1zg-ZkZ0InWIP2BFgAAAQM"]
[Fri Apr 10 17:59:41.399226 2026] [:error] [pid 3934:tid 3956] [client 51.103.82.36:17944] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adjKDYa41m-BS8mg82d27gAAANE"]
[Fri Apr 10 17:59:42.497704 2026] [:error] [pid 13101:tid 13156] [client 51.103.82.36:27509] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adjKDt8Ldw85818pj2qSDAAAAJc"]
[Fri Apr 10 17:59:44.137157 2026] [:error] [pid 13189:tid 13204] [client 51.103.82.36:33771] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adjKEJAxiJKPums3eBBf5gAAAEw"]
[Fri Apr 10 17:59:45.428311 2026] [:error] [pid 13100:tid 13127] [client 51.103.82.36:32381] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adjKEVzg-ZkZ0InWIP2BGgAAARY"]
[Fri Apr 10 17:59:47.058137 2026] [:error] [pid 13189:tid 13207] [client 51.103.82.36:30876] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adjKE5AxiJKPums3eBBf7AAAAE8"]
[Fri Apr 10 17:59:49.302845 2026] [:error] [pid 13189:tid 13210] [client 51.103.82.36:27461] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adjKFZAxiJKPums3eBBf8wAAAFI"]
[Fri Apr 10 17:59:50.724691 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:27489] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adjKFoa41m-BS8mg82d3DAAAAMo"]
[Fri Apr 10 17:59:52.320150 2026] [:error] [pid 13102:tid 13168] [client 51.103.82.36:35449] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adjKGP9xLvjW2guI55ZOYQAAAAg"]
[Fri Apr 10 17:59:53.648308 2026] [:error] [pid 13100:tid 13111] [client 51.103.82.36:35407] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adjKGVzg-ZkZ0InWIP2BJQAAAQY"]
[Fri Apr 10 17:59:54.963146 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:27478] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adjKGoa41m-BS8mg82d3FAAAAMo"]
[Fri Apr 10 17:59:56.094276 2026] [:error] [pid 3934:tid 3953] [client 51.103.82.36:30886] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adjKHIa41m-BS8mg82d3HQAAAM4"]
[Fri Apr 10 17:59:57.702849 2026] [:error] [pid 3934:tid 3962] [client 51.103.82.36:62054] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adjKHYa41m-BS8mg82d3IQAAANc"]
[Fri Apr 10 17:59:59.061828 2026] [:error] [pid 13102:tid 13173] [client 51.103.82.36:17933] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adjKH_9xLvjW2guI55ZOcAAAAA0"]
[Fri Apr 10 18:00:00.399173 2026] [:error] [pid 13189:tid 13215] [client 51.103.82.36:35384] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless4.php"] [unique_id "adjKIJAxiJKPums3eBBgFAAAAFc"]
[Fri Apr 10 18:00:01.376908 2026] [:error] [pid 3934:tid 3942] [client 51.103.82.36:50788] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adjKIYa41m-BS8mg82d3MwAAAMM"]
[Fri Apr 10 18:00:02.284160 2026] [:error] [pid 13101:tid 13154] [client 51.103.82.36:22650] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adjKIt8Ldw85818pj2qSLQAAAJU"]
[Fri Apr 10 18:00:03.087565 2026] [:error] [pid 13100:tid 13125] [client 51.103.82.36:33767] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adjKI1zg-ZkZ0InWIP2BNQAAARQ"]
[Fri Apr 10 18:00:03.641738 2026] [:error] [pid 13100:tid 13112] [client 51.103.82.36:24907] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adjKI1zg-ZkZ0InWIP2BNwAAAQc"]
[Fri Apr 10 18:00:04.779218 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:24930] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adjKJIa41m-BS8mg82d3OQAAAMo"]
[Fri Apr 10 18:00:05.637965 2026] [:error] [pid 13189:tid 13201] [client 51.103.82.36:63036] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adjKJZAxiJKPums3eBBgGwAAAEk"]
[Fri Apr 10 18:00:06.284359 2026] [:error] [pid 13189:tid 13193] [client 51.103.82.36:24938] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adjKJpAxiJKPums3eBBgHgAAAEE"]
[Fri Apr 10 18:00:07.465283 2026] [:error] [pid 13189:tid 13213] [client 51.103.82.36:17939] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xqq.php"] [unique_id "adjKJ5AxiJKPums3eBBgIQAAAFU"]
[Fri Apr 10 18:00:08.293049 2026] [:error] [pid 13100:tid 13124] [client 51.103.82.36:62071] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adjKKFzg-ZkZ0InWIP2BQAAAARM"]
[Fri Apr 10 18:00:09.556856 2026] [:error] [pid 3934:tid 3943] [client 51.103.82.36:35355] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adjKKYa41m-BS8mg82d3UAAAAMQ"]
[Fri Apr 10 18:00:11.031841 2026] [:error] [pid 13189:tid 13210] [client 51.103.82.36:50805] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adjKK5AxiJKPums3eBBgIwAAAFI"]
[Fri Apr 10 18:00:12.170668 2026] [:error] [pid 13189:tid 13198] [client 51.103.82.36:17981] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plss3.php"] [unique_id "adjKLJAxiJKPums3eBBgJgAAAEY"]
[Fri Apr 10 18:00:12.829651 2026] [:error] [pid 13102:tid 13180] [client 51.103.82.36:33739] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "adjKLP9xLvjW2guI55ZOmAAAABQ"]
[Fri Apr 10 18:00:14.542559 2026] [:error] [pid 13189:tid 13210] [client 51.103.82.36:32322] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aaa.php"] [unique_id "adjKLpAxiJKPums3eBBgLQAAAFI"]
[Fri Apr 10 18:00:15.646379 2026] [:error] [pid 3934:tid 3960] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Fri Apr 10 18:00:15.886820 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 10 18:00:16.364749 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Fri Apr 10 18:00:16.601898 2026] [:error] [pid 3934:tid 3959] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Fri Apr 10 18:00:16.846768 2026] [:error] [pid 3934:tid 3947] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Fri Apr 10 18:00:17.083486 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Apr 10 18:00:17.786045 2026] [:error] [pid 3934:tid 3963] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Apr 10 18:00:18.082743 2026] [:error] [pid 3934:tid 3954] [client 51.103.82.36:17943] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Apr 10 18:00:18.315111 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:17943] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adjKMoa41m-BS8mg82d3jgAAAMA"]
[Fri Apr 10 18:00:19.579764 2026] [:error] [pid 13189:tid 13195] [client 51.103.82.36:62025] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adjKM5AxiJKPums3eBBgRgAAAEM"]
[Fri Apr 10 18:00:20.489510 2026] [:error] [pid 13100:tid 13122] [client 51.103.82.36:63011] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adjKNFzg-ZkZ0InWIP2BXAAAARE"]
[Fri Apr 10 18:00:21.378589 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:50777] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adjKNYa41m-BS8mg82d3mwAAAMY"]
[Fri Apr 10 18:00:22.350862 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:17973] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adjKNoa41m-BS8mg82d3oQAAAMY"]
[Fri Apr 10 18:00:23.057792 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:20309] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adjKN4a41m-BS8mg82d3pQAAAMA"]
[Fri Apr 10 18:00:23.731069 2026] [:error] [pid 13102:tid 13181] [client 51.103.82.36:20338] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adjKN_9xLvjW2guI55ZOqwAAABU"]
[Fri Apr 10 18:00:24.417899 2026] [:error] [pid 13102:tid 13178] [client 51.103.82.36:32361] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adjKOP9xLvjW2guI55ZOsAAAABI"]
[Fri Apr 10 18:00:24.989990 2026] [:error] [pid 13102:tid 13167] [client 51.103.82.36:27475] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adjKOP9xLvjW2guI55ZOsgAAAAc"]
[Fri Apr 10 18:00:26.173424 2026] [:error] [pid 13101:tid 13144] [client 51.103.82.36:27500] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adjKOt8Ldw85818pj2qSTgAAAIs"]
[Fri Apr 10 18:00:26.884027 2026] [:error] [pid 13102:tid 13178] [client 51.103.82.36:17975] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adjKOv9xLvjW2guI55ZOuAAAABI"]
[Fri Apr 10 18:00:28.069652 2026] [:error] [pid 13100:tid 13115] [client 51.103.82.36:33775] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adjKPFzg-ZkZ0InWIP2BaQAAAQo"]
[Fri Apr 10 18:00:30.044495 2026] [:error] [pid 3934:tid 3959] [client 51.103.82.36:20340] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adjKPoa41m-BS8mg82d30gAAANQ"]
[Fri Apr 10 18:00:32.942142 2026] [:error] [pid 3934:tid 3959] [client 51.103.82.36:26368] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adjKQIa41m-BS8mg82d36QAAANQ"]
[Fri Apr 10 18:00:36.031397 2026] [:error] [pid 13102:tid 13181] [client 51.103.82.36:20668] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adjKRP9xLvjW2guI55ZO0QAAABU"]
[Fri Apr 10 18:00:38.815588 2026] [:error] [pid 13100:tid 13120] [client 51.103.82.36:21020] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adjKRlzg-ZkZ0InWIP2BfwAAAQ8"]
[Fri Apr 10 18:00:41.490963 2026] [:error] [pid 3934:tid 3955] [client 51.103.82.36:20641] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adjKSYa41m-BS8mg82d4PAAAANA"]
[Fri Apr 10 18:00:43.216687 2026] [:error] [pid 3934:tid 3949] [client 51.103.82.36:26377] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adjKS4a41m-BS8mg82d4TAAAAMo"]
[Fri Apr 10 18:00:44.750341 2026] [:error] [pid 13102:tid 13166] [client 51.103.82.36:22598] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adjKTP9xLvjW2guI55ZO3gAAAAY"]
[Fri Apr 10 18:00:48.302444 2026] [:error] [pid 13100:tid 13122] [client 51.103.82.36:31597] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adjKUFzg-ZkZ0InWIP2BiwAAARE"]
[Fri Apr 10 18:00:49.469362 2026] [:error] [pid 3934:tid 3942] [client 51.103.82.36:28742] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKUYa41m-BS8mg82d4XgAAAMM"]
[Fri Apr 10 18:00:50.266481 2026] [:error] [pid 13101:tid 13154] [client 51.103.82.36:28756] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKUt8Ldw85818pj2qSagAAAJU"]
[Fri Apr 10 18:00:52.962224 2026] [:error] [pid 3934:tid 3940] [client 51.103.82.36:36686] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKVIa41m-BS8mg82d4awAAAME"]
[Fri Apr 10 18:00:54.529962 2026] [:error] [pid 3934:tid 3957] [client 51.103.82.36:26942] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKVoa41m-BS8mg82d4cgAAANI"]
[Fri Apr 10 18:00:55.827897 2026] [:error] [pid 3934:tid 3943] [client 51.103.82.36:34697] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adjKV4a41m-BS8mg82d4eAAAAMQ"]
[Fri Apr 10 18:00:56.888016 2026] [:error] [pid 3934:tid 3950] [client 51.103.82.36:2205] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adjKWIa41m-BS8mg82d4fwAAAMs"]
[Fri Apr 10 18:00:59.456572 2026] [:error] [pid 13101:tid 13151] [client 51.103.82.36:48307] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adjKW98Ldw85818pj2qSeQAAAJI"]
[Fri Apr 10 18:01:01.062539 2026] [:error] [pid 3934:tid 3950] [client 51.103.82.36:39630] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adjKXYa41m-BS8mg82d4mwAAAMs"]
[Fri Apr 10 18:01:02.773808 2026] [:error] [pid 13100:tid 13117] [client 51.103.82.36:19868] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adjKXlzg-ZkZ0InWIP2BpAAAAQw"]
[Fri Apr 10 18:01:05.698061 2026] [:error] [pid 13189:tid 13206] [client 51.103.82.36:26902] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adjKYZAxiJKPums3eBBgrQAAAE4"]
[Fri Apr 10 18:01:06.873037 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:2587] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adjKYoa41m-BS8mg82d4rAAAANM"]
[Fri Apr 10 18:01:07.999994 2026] [:error] [pid 13100:tid 13111] [client 51.103.82.36:20225] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adjKY1zg-ZkZ0InWIP2BrAAAAQY"]
[Fri Apr 10 18:01:08.860758 2026] [:error] [pid 13189:tid 13205] [client 51.103.82.36:2575] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adjKZJAxiJKPums3eBBguQAAAE0"]
[Fri Apr 10 18:01:10.505656 2026] [:error] [pid 13100:tid 13123] [client 51.103.82.36:26989] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adjKZlzg-ZkZ0InWIP2BrgAAARI"]
[Fri Apr 10 18:01:11.762771 2026] [:error] [pid 13101:tid 13147] [client 51.103.82.36:22159] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adjKZ98Ldw85818pj2qSiwAAAI4"]
[Fri Apr 10 18:01:12.582813 2026] [:error] [pid 13189:tid 13201] [client 51.103.82.36:43751] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adjKaJAxiJKPums3eBBgvwAAAEk"]
[Fri Apr 10 18:01:13.745778 2026] [:error] [pid 13100:tid 13109] [client 51.103.82.36:43740] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adjKaVzg-ZkZ0InWIP2BsgAAAQQ"]
[Fri Apr 10 18:01:14.827466 2026] [:error] [pid 13102:tid 13163] [client 51.103.82.36:33726] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adjKav9xLvjW2guI55ZPFAAAAAM"]
[Fri Apr 10 18:01:15.679664 2026] [:error] [pid 3934:tid 3954] [client 51.103.82.36:22568] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adjKa4a41m-BS8mg82d40QAAAM8"]
[Fri Apr 10 18:01:16.950478 2026] [:error] [pid 13189:tid 13215] [client 51.103.82.36:36024] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adjKbJAxiJKPums3eBBgzAAAAFc"]
[Fri Apr 10 18:01:17.755781 2026] [:error] [pid 13102:tid 13163] [client 51.103.82.36:47719] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adjKbf9xLvjW2guI55ZPHgAAAAM"]
[Fri Apr 10 18:01:18.371009 2026] [:error] [pid 13102:tid 13160] [client 51.103.82.36:43770] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Apr 10 18:01:19.065848 2026] [:error] [pid 13102:tid 13175] [client 51.103.82.36:43770] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Fri Apr 10 18:01:19.539362 2026] [:error] [pid 13102:tid 13183] [client 51.103.82.36:43770] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Fri Apr 10 18:01:19.834972 2026] [:error] [pid 13102:tid 13163] [client 51.103.82.36:43770] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Apr 10 18:01:20.310711 2026] [:error] [pid 13102:tid 13162] [client 51.103.82.36:43770] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Fri Apr 10 18:01:20.795700 2026] [:error] [pid 13102:tid 13170] [client 51.103.82.36:43770] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Apr 10 18:01:21.032475 2026] [:error] [pid 13102:tid 13183] [client 51.103.82.36:43770] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri Apr 10 18:01:21.263487 2026] [:error] [pid 13102:tid 13167] [client 51.103.82.36:43770] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "adjKcf9xLvjW2guI55ZPNgAAAAc"]
[Fri Apr 10 18:01:22.585905 2026] [:error] [pid 3934:tid 3947] [client 51.103.82.36:26994] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "adjKcoa41m-BS8mg82d41AAAAMg"]
[Fri Apr 10 18:01:24.361764 2026] [:error] [pid 13102:tid 13173] [client 51.103.82.36:22579] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "adjKdP9xLvjW2guI55ZPQAAAAA0"]
[Fri Apr 10 18:01:29.086779 2026] [:error] [pid 13102:tid 13164] [client 51.103.82.36:17939] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fi.php"] [unique_id "adjKef9xLvjW2guI55ZPTAAAAAQ"]
[Fri Apr 10 18:01:31.298052 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:52049] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "adjKe4a41m-BS8mg82d46wAAAMw"]
[Fri Apr 10 18:01:32.610600 2026] [:error] [pid 13102:tid 13175] [client 51.103.82.36:46979] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "adjKfP9xLvjW2guI55ZPUQAAAA8"]
[Fri Apr 10 18:01:34.316354 2026] [:error] [pid 13189:tid 13208] [client 51.103.82.36:47003] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "adjKfpAxiJKPums3eBBg5gAAAFA"]
[Fri Apr 10 18:01:35.770303 2026] [:error] [pid 3934:tid 3942] [client 51.103.82.36:51433] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a1.php"] [unique_id "adjKf4a41m-BS8mg82d49QAAAMM"]
[Fri Apr 10 18:01:37.005625 2026] [:error] [pid 13101:tid 13148] [client 51.103.82.36:42366] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adjKgd8Ldw85818pj2qSvgAAAI8"]
[Fri Apr 10 18:01:38.159124 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:52019] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adjKgoa41m-BS8mg82d4_AAAANM"]
[Fri Apr 10 18:01:39.498386 2026] [:error] [pid 13100:tid 13121] [client 51.103.82.36:19254] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adjKg1zg-ZkZ0InWIP2B3AAAARA"]
[Fri Apr 10 18:01:42.451632 2026] [:error] [pid 13101:tid 13156] [client 51.103.82.36:50098] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adjKht8Ldw85818pj2qSyQAAAJc"]
[Fri Apr 10 18:01:44.100554 2026] [:error] [pid 13101:tid 13133] [client 51.103.82.36:22246] [client 51.103.82.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adjKiN8Ldw85818pj2qSzAAAAIA"]
[Fri Apr 10 18:01:48.407651 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:29715] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adjKjIa41m-BS8mg82d5GwAAAMw"]
[Fri Apr 10 18:01:52.407134 2026] [:error] [pid 13102:tid 13167] [client 51.103.82.36:42852] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adjKkP9xLvjW2guI55ZPbAAAAAc"]
[Fri Apr 10 18:01:55.422789 2026] [:error] [pid 13189:tid 13204] [client 51.103.82.36:51357] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adjKk5AxiJKPums3eBBhDgAAAEw"]
[Fri Apr 10 18:01:58.093826 2026] [:error] [pid 13189:tid 13215] [client 51.103.82.36:18214] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adjKlpAxiJKPums3eBBhFwAAAFc"]
[Fri Apr 10 18:02:09.286808 2026] [:error] [pid 13100:tid 13119] [client 51.103.82.36:36038] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adjKoVzg-ZkZ0InWIP2CAQAAAQ4"]
[Fri Apr 10 18:02:12.676102 2026] [:error] [pid 13102:tid 13167] [client 51.103.82.36:48990] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adjKpP9xLvjW2guI55ZPiAAAAAc"]
[Fri Apr 10 18:02:14.377172 2026] [:error] [pid 13102:tid 13161] [client 51.103.82.36:27402] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adjKpv9xLvjW2guI55ZPjwAAAAE"]
[Fri Apr 10 18:02:16.052510 2026] [:error] [pid 3934:tid 3963] [client 51.103.82.36:18815] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adjKqIa41m-BS8mg82d5cQAAANg"]
[Fri Apr 10 18:02:17.093502 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:17669] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adjKqYa41m-BS8mg82d5dQAAAM0"]
[Fri Apr 10 18:02:18.572040 2026] [:error] [pid 13189:tid 13198] [client 51.103.82.36:32277] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adjKqpAxiJKPums3eBBhRwAAAEY"]
[Fri Apr 10 18:02:21.629607 2026] [:error] [pid 3934:tid 3956] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Fri Apr 10 18:02:21.865180 2026] [:error] [pid 3934:tid 3941] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Apr 10 18:02:22.121554 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Fri Apr 10 18:02:23.568689 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Fri Apr 10 18:02:23.984376 2026] [:error] [pid 3934:tid 3963] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Apr 10 18:02:24.220052 2026] [:error] [pid 3934:tid 3943] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Fri Apr 10 18:02:24.456206 2026] [:error] [pid 3934:tid 3956] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 10 18:02:24.703631 2026] [:error] [pid 3934:tid 3950] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Apr 10 18:02:24.947651 2026] [:error] [pid 3934:tid 3955] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Fri Apr 10 18:02:25.440207 2026] [:error] [pid 3934:tid 3943] [client 51.103.82.36:36051] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Fri Apr 10 18:02:25.673530 2026] [:error] [pid 3934:tid 3942] [client 51.103.82.36:36051] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adjKsYa41m-BS8mg82d5tgAAAMM"]
[Fri Apr 10 18:02:27.115384 2026] [:error] [pid 3934:tid 3940] [client 51.103.82.36:23330] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adjKs4a41m-BS8mg82d5vwAAAME"]
[Fri Apr 10 18:02:28.541029 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:29744] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adjKtIa41m-BS8mg82d5xwAAAMY"]
[Fri Apr 10 18:02:29.954104 2026] [:error] [pid 13101:tid 13142] [client 51.103.82.36:50141] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adjKtd8Ldw85818pj2qS9wAAAIk"]
[Fri Apr 10 18:02:30.628534 2026] [:error] [pid 13102:tid 13167] [client 51.103.82.36:48991] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adjKtv9xLvjW2guI55ZPqgAAAAc"]
[Fri Apr 10 18:02:31.726380 2026] [:error] [pid 13101:tid 13137] [client 51.103.82.36:52700] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adjKt98Ldw85818pj2qS_QAAAIQ"]
[Fri Apr 10 18:02:32.630299 2026] [:error] [pid 3934:tid 3940] [client 51.103.82.36:23888] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adjKuIa41m-BS8mg82d53QAAAME"]
[Fri Apr 10 18:02:33.938025 2026] [:error] [pid 3934:tid 3954] [client 51.103.82.36:34793] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adjKuYa41m-BS8mg82d55QAAAM8"]
[Fri Apr 10 18:02:34.974659 2026] [:error] [pid 3934:tid 3941] [client 51.103.82.36:36055] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adjKuoa41m-BS8mg82d56QAAAMI"]
[Fri Apr 10 18:02:37.813656 2026] [:error] [pid 3934:tid 3952] [client 51.103.82.36:32285] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adjKvYa41m-BS8mg82d58QAAAM0"]
[Fri Apr 10 18:02:39.408685 2026] [:error] [pid 13102:tid 13168] [client 51.103.82.36:17722] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adjKv_9xLvjW2guI55ZPrQAAAAg"]
[Fri Apr 10 18:02:40.502396 2026] [:error] [pid 3934:tid 3939] [client 51.103.82.36:34759] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adjKwIa41m-BS8mg82d5-AAAAMA"]
[Fri Apr 10 18:02:41.772202 2026] [:error] [pid 3934:tid 3941] [client 51.103.82.36:32273] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adjKwYa41m-BS8mg82d5-wAAAMI"]
[Fri Apr 10 18:02:43.101564 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:32290] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adjKw4a41m-BS8mg82d5_wAAAMw"]
[Fri Apr 10 18:02:44.692708 2026] [:error] [pid 13189:tid 13194] [client 51.103.82.36:59347] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adjKxJAxiJKPums3eBBhiQAAAEI"]
[Fri Apr 10 18:02:46.135400 2026] [:error] [pid 13101:tid 13154] [client 51.103.82.36:23928] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adjKxt8Ldw85818pj2qTDQAAAJU"]
[Fri Apr 10 18:02:46.958821 2026] [:error] [pid 13100:tid 13115] [client 51.103.82.36:23895] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "adjKxlzg-ZkZ0InWIP2CEwAAAQo"]
[Fri Apr 10 18:02:47.643305 2026] [:error] [pid 3934:tid 3958] [client 51.103.82.36:52702] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "adjKx4a41m-BS8mg82d6CwAAANM"]
[Fri Apr 10 18:02:48.355856 2026] [:error] [pid 13101:tid 13134] [client 51.103.82.36:23910] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "adjKyN8Ldw85818pj2qTEgAAAIE"]
[Fri Apr 10 18:02:49.203969 2026] [:error] [pid 3934:tid 3956] [client 51.103.82.36:49008] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/g.php"] [unique_id "adjKyYa41m-BS8mg82d6EQAAANE"]
[Fri Apr 10 18:02:50.228946 2026] [:error] [pid 13189:tid 13202] [client 51.103.82.36:52714] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKypAxiJKPums3eBBhlwAAAEo"]
[Fri Apr 10 18:02:51.509002 2026] [:error] [pid 13102:tid 13162] [client 51.103.82.36:23897] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKy_9xLvjW2guI55ZPtgAAAAI"]
[Fri Apr 10 18:02:52.533607 2026] [:error] [pid 13189:tid 13216] [client 51.103.82.36:36047] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKzJAxiJKPums3eBBhmwAAAFg"]
[Fri Apr 10 18:02:54.134986 2026] [:error] [pid 13101:tid 13149] [client 51.103.82.36:61283] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adjKzt8Ldw85818pj2qTGwAAAJA"]
[Fri Apr 10 18:02:57.911470 2026] [:error] [pid 13189:tid 13195] [client 51.103.82.36:36088] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adjK0ZAxiJKPums3eBBhpAAAAEM"]
[Fri Apr 10 18:03:00.595690 2026] [:error] [pid 13101:tid 13146] [client 51.103.82.36:59353] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adjK1N8Ldw85818pj2qTHwAAAI0"]
[Fri Apr 10 18:03:03.974916 2026] [:error] [pid 13102:tid 13167] [client 51.103.82.36:47655] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adjK1_9xLvjW2guI55ZPyAAAAAc"]
[Fri Apr 10 18:03:05.590580 2026] [:error] [pid 3934:tid 3960] [client 51.103.82.36:48949] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adjK2Ya41m-BS8mg82d6QwAAANU"]
[Fri Apr 10 18:03:07.240684 2026] [:error] [pid 13189:tid 13196] [client 51.103.82.36:36079] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "adjK25AxiJKPums3eBBhuwAAAEQ"]
[Fri Apr 10 18:03:08.930364 2026] [:error] [pid 13189:tid 13197] [client 51.103.82.36:36076] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "adjK3JAxiJKPums3eBBhwQAAAEU"]
[Fri Apr 10 18:03:10.437619 2026] [:error] [pid 13189:tid 13207] [client 51.103.82.36:42274] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "adjK3pAxiJKPums3eBBhxwAAAE8"]
[Fri Apr 10 18:03:12.264680 2026] [:error] [pid 3934:tid 3945] [client 51.103.82.36:59363] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ew.php"] [unique_id "adjK4Ia41m-BS8mg82d6UwAAAMY"]
[Fri Apr 10 18:03:12.996335 2026] [:error] [pid 13102:tid 13181] [client 51.103.82.36:33329] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "adjK4P9xLvjW2guI55ZP1QAAABU"]
[Fri Apr 10 18:03:14.570969 2026] [:error] [pid 13101:tid 13133] [client 51.103.82.36:48907] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "adjK4t8Ldw85818pj2qTJQAAAIA"]
[Fri Apr 10 18:03:15.774847 2026] [:error] [pid 3934:tid 3951] [client 51.103.82.36:58532] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "adjK44a41m-BS8mg82d6WQAAAMw"]
[Fri Apr 10 18:03:16.914868 2026] [:error] [pid 13189:tid 13195] [client 51.103.82.36:33282] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file21.php"] [unique_id "adjK5JAxiJKPums3eBBh0AAAAEM"]
[Fri Apr 10 18:03:19.838038 2026] [:error] [pid 13101:tid 13149] [client 51.103.82.36:46304] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "adjK598Ldw85818pj2qTKgAAAJA"]
[Fri Apr 10 18:03:24.107033 2026] [:error] [pid 13100:tid 13124] [client 51.103.82.36:46295] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class19.php"] [unique_id "adjK7Fzg-ZkZ0InWIP2CQwAAARM"]
[Fri Apr 10 18:03:26.986626 2026] [:error] [pid 13189:tid 13200] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Fri Apr 10 18:03:27.222985 2026] [:error] [pid 13189:tid 13201] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Fri Apr 10 18:03:27.489431 2026] [:error] [pid 13189:tid 13206] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Fri Apr 10 18:03:27.843995 2026] [:error] [pid 13189:tid 13206] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Fri Apr 10 18:03:28.093166 2026] [:error] [pid 13189:tid 13209] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Fri Apr 10 18:03:28.329445 2026] [:error] [pid 13189:tid 13203] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Fri Apr 10 18:03:28.566147 2026] [:error] [pid 13189:tid 13211] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Fri Apr 10 18:03:28.827069 2026] [:error] [pid 13189:tid 13215] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Apr 10 18:03:29.076939 2026] [:error] [pid 13189:tid 13200] [client 51.103.82.36:61250] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Apr 10 18:58:32.172454 2026] [:error] [pid 25984:tid 26008] [client 20.251.25.161:64582] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Fri Apr 10 18:58:32.432035 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:64582] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 10 18:58:32.694279 2026] [:error] [pid 25984:tid 26001] [client 20.251.25.161:64582] File does not exist: /usr/local/apache/htdocs/suspended-page/ga.php
[Fri Apr 10 18:58:32.957005 2026] [:error] [pid 25984:tid 25998] [client 20.251.25.161:64582] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Fri Apr 10 18:58:33.233733 2026] [:error] [pid 25984:tid 26012] [client 20.251.25.161:64582] File does not exist: /usr/local/apache/htdocs/suspended-page/x3x.php
[Fri Apr 10 18:58:33.490407 2026] [:error] [pid 25984:tid 26005] [client 20.251.25.161:64582] [client 20.251.25.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adjX2bsdbY_MC14OH16Z8gAAAVA"]
[Fri Apr 10 18:58:34.012365 2026] [:error] [pid 13102:tid 13183] [client 20.251.25.161:52326] File does not exist: /usr/local/apache/htdocs/suspended-page/state.php
[Fri Apr 10 18:58:34.289301 2026] [:error] [pid 13102:tid 13166] [client 20.251.25.161:52326] File does not exist: /usr/local/apache/htdocs/suspended-page/xozx.php
[Fri Apr 10 18:58:34.549298 2026] [:error] [pid 13102:tid 13161] [client 20.251.25.161:52326] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Fri Apr 10 18:58:34.811460 2026] [:error] [pid 13102:tid 13163] [client 20.251.25.161:52326] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 10 18:58:35.072359 2026] [:error] [pid 13102:tid 13168] [client 20.251.25.161:52326] File does not exist: /usr/local/apache/htdocs/suspended-page/97.php
[Fri Apr 10 18:58:35.329846 2026] [:error] [pid 13102:tid 13173] [client 20.251.25.161:52326] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adjX2_9xLvjW2guI55ZqcQAAAA0"]
[Fri Apr 10 18:58:35.948301 2026] [:error] [pid 13101:tid 13139] [client 20.251.25.161:53569] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adjX298Ldw85818pj2qljwAAAIY"]
[Fri Apr 10 18:58:36.490605 2026] [:error] [pid 13189:tid 13209] [client 20.251.25.161:53614] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adjX3JAxiJKPums3eBB5KgAAAFE"]
[Fri Apr 10 18:58:37.028745 2026] [:error] [pid 13101:tid 13151] [client 20.251.25.161:46584] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adjX3d8Ldw85818pj2qlkQAAAJI"]
[Fri Apr 10 18:58:37.559562 2026] [:error] [pid 13102:tid 13183] [client 20.251.25.161:49214] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adjX3f9xLvjW2guI55ZqeAAAABc"]
[Fri Apr 10 18:58:38.089081 2026] [:error] [pid 13189:tid 13201] [client 20.251.25.161:53630] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adjX3pAxiJKPums3eBB5LwAAAEk"]
[Fri Apr 10 18:58:38.613869 2026] [:error] [pid 13102:tid 13182] [client 20.251.25.161:9946] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adjX3v9xLvjW2guI55ZqfAAAABY"]
[Fri Apr 10 18:58:39.128324 2026] [:error] [pid 13189:tid 13208] [client 20.251.25.161:9947] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adjX35AxiJKPums3eBB5MgAAAFA"]
[Fri Apr 10 18:58:39.645163 2026] [:error] [pid 25984:tid 26001] [client 20.251.25.161:53613] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adjX37sdbY_MC14OH16Z_QAAAUw"]
[Fri Apr 10 18:58:40.159317 2026] [:error] [pid 25984:tid 26013] [client 20.251.25.161:54135] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adjX4LsdbY_MC14OH16aAgAAAVg"]
[Fri Apr 10 18:58:40.726798 2026] [:error] [pid 25984:tid 25989] [client 20.251.25.161:53621] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adjX4LsdbY_MC14OH16aBgAAAUA"]
[Fri Apr 10 18:58:41.247494 2026] [:error] [pid 25984:tid 26007] [client 20.251.25.161:52313] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adjX4bsdbY_MC14OH16aCgAAAVI"]
[Fri Apr 10 18:58:41.763193 2026] [:error] [pid 25984:tid 25992] [client 20.251.25.161:46604] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "adjX4bsdbY_MC14OH16aDQAAAUM"]
[Fri Apr 10 18:58:42.310091 2026] [:error] [pid 13102:tid 13172] [client 20.251.25.161:52329] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "adjX4v9xLvjW2guI55ZqfQAAAAw"]
[Fri Apr 10 18:58:42.831681 2026] [:error] [pid 25984:tid 25991] [client 20.251.25.161:53584] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "adjX4rsdbY_MC14OH16aEQAAAUI"]
[Fri Apr 10 18:58:43.354195 2026] [:error] [pid 13189:tid 13216] [client 20.251.25.161:9957] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/config.php"] [unique_id "adjX45AxiJKPums3eBB5NQAAAFg"]
[Fri Apr 10 18:58:43.907623 2026] [:error] [pid 13102:tid 13180] [client 20.251.25.161:58525] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adjX4_9xLvjW2guI55ZqgQAAABQ"]
[Fri Apr 10 18:58:44.421572 2026] [:error] [pid 25984:tid 25989] [client 20.251.25.161:54141] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adjX5LsdbY_MC14OH16aEwAAAUA"]
[Fri Apr 10 18:58:44.976995 2026] [:error] [pid 13102:tid 13166] [client 20.251.25.161:49196] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adjX5P9xLvjW2guI55ZqhAAAAAY"]
[Fri Apr 10 18:58:45.506876 2026] [:error] [pid 25984:tid 26005] [client 20.251.25.161:53209] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adjX5bsdbY_MC14OH16aPwAAAVA"]
[Fri Apr 10 18:58:46.044906 2026] [:error] [pid 13100:tid 13128] [client 20.251.25.161:53225] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adjX5lzg-ZkZ0InWIP2RVAAAARc"]
[Fri Apr 10 18:58:46.607426 2026] [:error] [pid 13189:tid 13209] [client 20.251.25.161:9939] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adjX5pAxiJKPums3eBB5SQAAAFE"]
[Fri Apr 10 18:58:47.140175 2026] [:error] [pid 25984:tid 26000] [client 20.251.25.161:58504] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adjX57sdbY_MC14OH16aYwAAAUs"]
[Fri Apr 10 18:58:47.660484 2026] [:error] [pid 25984:tid 25990] [client 20.251.25.161:46540] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adjX57sdbY_MC14OH16acgAAAUE"]
[Fri Apr 10 18:58:48.194351 2026] [:error] [pid 13102:tid 13177] [client 20.251.25.161:53601] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adjX6P9xLvjW2guI55ZqiAAAABE"]
[Fri Apr 10 18:58:48.730037 2026] [:error] [pid 13189:tid 13195] [client 20.251.25.161:52299] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adjX6JAxiJKPums3eBB5WQAAAEM"]
[Fri Apr 10 18:58:49.311681 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:54118] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adjX6bsdbY_MC14OH16akwAAAVU"]
[Fri Apr 10 18:58:49.827302 2026] [:error] [pid 25984:tid 25995] [client 20.251.25.161:53629] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ng.php"] [unique_id "adjX6bsdbY_MC14OH16alQAAAUY"]
[Fri Apr 10 18:58:50.342005 2026] [:error] [pid 13189:tid 13213] [client 20.251.25.161:54081] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adjX6pAxiJKPums3eBB5XwAAAFU"]
[Fri Apr 10 18:58:50.896226 2026] [:error] [pid 25984:tid 25999] [client 20.251.25.161:53616] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adjX6rsdbY_MC14OH16amgAAAUo"]
[Fri Apr 10 18:58:51.612300 2026] [:error] [pid 3934:tid 3959] [client 20.251.25.161:46587] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adjX64a41m-BS8mg82ed_QAAANQ"]
[Fri Apr 10 18:58:52.321716 2026] [:error] [pid 13100:tid 13127] [client 20.251.25.161:46639] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adjX7Fzg-ZkZ0InWIP2RWAAAARY"]
[Fri Apr 10 18:58:52.870334 2026] [:error] [pid 13189:tid 13214] [client 20.251.25.161:52330] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adjX7JAxiJKPums3eBB5YAAAAFY"]
[Fri Apr 10 18:58:53.423873 2026] [:error] [pid 13101:tid 13155] [client 20.251.25.161:9969] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adjX7d8Ldw85818pj2qlogAAAJY"]
[Fri Apr 10 18:58:53.941327 2026] [:error] [pid 25984:tid 25989] [client 20.251.25.161:64589] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adjX7bsdbY_MC14OH16anAAAAUA"]
[Fri Apr 10 18:58:54.463047 2026] [:error] [pid 13100:tid 13107] [client 20.251.25.161:53184] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wswer1.php"] [unique_id "adjX7lzg-ZkZ0InWIP2RXAAAAQI"]
[Fri Apr 10 18:58:54.985653 2026] [:error] [pid 13102:tid 13167] [client 20.251.25.161:53211] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adjX7v9xLvjW2guI55ZqjgAAAAc"]
[Fri Apr 10 18:58:55.600288 2026] [:error] [pid 25984:tid 26008] [client 20.251.25.161:52298] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adjX77sdbY_MC14OH16anwAAAVM"]
[Fri Apr 10 18:58:56.175858 2026] [:error] [pid 13102:tid 13178] [client 20.251.25.161:49186] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adjX8P9xLvjW2guI55ZqlQAAABI"]
[Fri Apr 10 18:58:56.763027 2026] [:error] [pid 25984:tid 26005] [client 20.251.25.161:54140] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/saorix1.php"] [unique_id "adjX8LsdbY_MC14OH16aoAAAAVA"]
[Fri Apr 10 18:58:57.423675 2026] [:error] [pid 25984:tid 26011] [client 20.251.25.161:54086] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "adjX8bsdbY_MC14OH16aoQAAAVY"]
[Fri Apr 10 18:58:57.987303 2026] [:error] [pid 25984:tid 25997] [client 20.251.25.161:49207] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "adjX8bsdbY_MC14OH16apQAAAUg"]
[Fri Apr 10 18:58:58.535125 2026] [:error] [pid 25984:tid 25995] [client 20.251.25.161:9973] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "adjX8rsdbY_MC14OH16aqQAAAUY"]
[Fri Apr 10 18:58:59.047381 2026] [:error] [pid 13189:tid 13216] [client 20.251.25.161:53611] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "adjX85AxiJKPums3eBB5aQAAAFg"]
[Fri Apr 10 18:58:59.615970 2026] [:error] [pid 13102:tid 13166] [client 20.251.25.161:64593] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adjX8_9xLvjW2guI55ZqngAAAAY"]
[Fri Apr 10 18:59:00.212646 2026] [:error] [pid 25984:tid 26005] [client 20.251.25.161:49211] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adjX9LsdbY_MC14OH16argAAAVA"]
[Fri Apr 10 18:59:00.787479 2026] [:error] [pid 13102:tid 13178] [client 20.251.25.161:46653] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adjX9P9xLvjW2guI55ZqoQAAABI"]
[Fri Apr 10 18:59:01.362850 2026] [:error] [pid 25984:tid 26001] [client 20.251.25.161:52306] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adjX9bsdbY_MC14OH16asQAAAUw"]
[Fri Apr 10 18:59:01.878787 2026] [:error] [pid 13101:tid 13152] [client 20.251.25.161:53193] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adjX9d8Ldw85818pj2qlqAAAAJM"]
[Fri Apr 10 18:59:02.481707 2026] [:error] [pid 13101:tid 13155] [client 20.251.25.161:53596] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adjX9t8Ldw85818pj2qlrQAAAJY"]
[Fri Apr 10 18:59:03.040980 2026] [:error] [pid 25984:tid 26012] [client 20.251.25.161:46645] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adjX97sdbY_MC14OH16auQAAAVc"]
[Fri Apr 10 18:59:03.565250 2026] [:error] [pid 25984:tid 25995] [client 20.251.25.161:49187] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adjX97sdbY_MC14OH16awAAAAUY"]
[Fri Apr 10 18:59:04.120114 2026] [:error] [pid 25984:tid 26007] [client 20.251.25.161:46555] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adjX-LsdbY_MC14OH16axAAAAVI"]
[Fri Apr 10 18:59:04.657253 2026] [:error] [pid 3934:tid 3943] [client 20.251.25.161:58538] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adjX-Ia41m-BS8mg82eeCAAAAMQ"]
[Fri Apr 10 18:59:05.205105 2026] [:error] [pid 13102:tid 13177] [client 20.251.25.161:58520] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adjX-f9xLvjW2guI55ZqpQAAABE"]
[Fri Apr 10 18:59:05.743121 2026] [:error] [pid 13102:tid 13181] [client 20.251.25.161:58543] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adjX-f9xLvjW2guI55ZqpgAAABU"]
[Fri Apr 10 18:59:06.263903 2026] [:error] [pid 25984:tid 26003] [client 20.251.25.161:57011] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adjX-rsdbY_MC14OH16azwAAAU4"]
[Fri Apr 10 18:59:06.843188 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:46618] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adjX-rsdbY_MC14OH16a0gAAAVU"]
[Fri Apr 10 18:59:07.388012 2026] [:error] [pid 3934:tid 3952] [client 20.251.25.161:9962] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adjX-4a41m-BS8mg82eeDgAAAM0"]
[Fri Apr 10 18:59:07.943498 2026] [:error] [pid 3934:tid 3944] [client 20.251.25.161:53572] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ayk.php"] [unique_id "adjX-4a41m-BS8mg82eeFgAAAMU"]
[Fri Apr 10 18:59:08.523308 2026] [:error] [pid 13102:tid 13161] [client 20.251.25.161:53218] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adjX_P9xLvjW2guI55ZqqwAAAAE"]
[Fri Apr 10 18:59:09.055318 2026] [:error] [pid 13102:tid 13168] [client 20.251.25.161:58523] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adjX_f9xLvjW2guI55ZqrQAAAAg"]
[Fri Apr 10 18:59:09.594428 2026] [:error] [pid 13189:tid 13198] [client 20.251.25.161:46609] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adjX_ZAxiJKPums3eBB5bgAAAEY"]
[Fri Apr 10 18:59:10.112529 2026] [:error] [pid 3934:tid 3953] [client 20.251.25.161:49168] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/red.php"] [unique_id "adjX_oa41m-BS8mg82eeHQAAAM4"]
[Fri Apr 10 18:59:10.638839 2026] [:error] [pid 13189:tid 13195] [client 20.251.25.161:64619] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adjX_pAxiJKPums3eBB5cAAAAEM"]
[Fri Apr 10 18:59:11.158153 2026] [:error] [pid 13101:tid 13145] [client 20.251.25.161:46651] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adjX_98Ldw85818pj2qlugAAAIw"]
[Fri Apr 10 18:59:11.727036 2026] [:error] [pid 13100:tid 13108] [client 20.251.25.161:9940] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adjX_1zg-ZkZ0InWIP2RYQAAAQM"]
[Fri Apr 10 18:59:12.241608 2026] [:error] [pid 13102:tid 13165] [client 20.251.25.161:46599] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adjYAP9xLvjW2guI55ZqsQAAAAU"]
[Fri Apr 10 18:59:12.759574 2026] [:error] [pid 25984:tid 26001] [client 20.251.25.161:57016] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjYALsdbY_MC14OH16a1QAAAUw"]
[Fri Apr 10 18:59:13.325743 2026] [:error] [pid 25984:tid 25999] [client 20.251.25.161:46634] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjYAbsdbY_MC14OH16a1wAAAUo"]
[Fri Apr 10 18:59:13.857215 2026] [:error] [pid 13101:tid 13141] [client 20.251.25.161:9271] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjYAd8Ldw85818pj2qlvwAAAIg"]
[Fri Apr 10 18:59:14.381251 2026] [:error] [pid 13100:tid 13128] [client 20.251.25.161:46553] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adjYAlzg-ZkZ0InWIP2RZAAAARc"]
[Fri Apr 10 18:59:14.895705 2026] [:error] [pid 3934:tid 3950] [client 20.251.25.161:54082] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adjYAoa41m-BS8mg82eeIAAAAMs"]
[Fri Apr 10 18:59:15.411376 2026] [:error] [pid 13189:tid 13206] [client 20.251.25.161:46572] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adjYA5AxiJKPums3eBB5eQAAAE4"]
[Fri Apr 10 18:59:15.932111 2026] [:error] [pid 3934:tid 3963] [client 20.251.25.161:53600] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adjYA4a41m-BS8mg82eeIwAAANg"]
[Fri Apr 10 18:59:16.447856 2026] [:error] [pid 13102:tid 13175] [client 20.251.25.161:58496] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gecko.php"] [unique_id "adjYBP9xLvjW2guI55ZqswAAAA8"]
[Fri Apr 10 18:59:16.966090 2026] [:error] [pid 13102:tid 13166] [client 20.251.25.161:9924] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adjYBP9xLvjW2guI55ZqtQAAAAY"]
[Fri Apr 10 18:59:17.502216 2026] [:error] [pid 13100:tid 13120] [client 20.251.25.161:64587] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adjYBVzg-ZkZ0InWIP2RZwAAAQ8"]
[Fri Apr 10 18:59:18.014405 2026] [:error] [pid 25984:tid 26009] [client 20.251.25.161:64603] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adjYBrsdbY_MC14OH16a3gAAAVQ"]
[Fri Apr 10 18:59:18.545755 2026] [:error] [pid 3934:tid 3959] [client 20.251.25.161:9242] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wziar1.php"] [unique_id "adjYBoa41m-BS8mg82eeKAAAANQ"]
[Fri Apr 10 18:59:19.075809 2026] [:error] [pid 3934:tid 3957] [client 20.251.25.161:46541] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "adjYB4a41m-BS8mg82eeKwAAANI"]
[Fri Apr 10 18:59:19.591604 2026] [:error] [pid 3934:tid 3953] [client 20.251.25.161:53236] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "adjYB4a41m-BS8mg82eeLgAAAM4"]
[Fri Apr 10 18:59:20.125948 2026] [:error] [pid 3934:tid 3960] [client 20.251.25.161:53208] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "adjYCIa41m-BS8mg82eeMQAAANU"]
[Fri Apr 10 18:59:20.639872 2026] [:error] [pid 3934:tid 3951] [client 20.251.25.161:54124] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xs.php"] [unique_id "adjYCIa41m-BS8mg82eeNAAAAMw"]
[Fri Apr 10 18:59:21.151850 2026] [:error] [pid 13101:tid 13133] [client 20.251.25.161:64586] [client 20.251.25.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adjYCd8Ldw85818pj2qlxAAAAIA"]
[Fri Apr 10 18:59:21.686454 2026] [:error] [pid 13100:tid 13106] [client 20.251.25.161:9952] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "adjYCVzg-ZkZ0InWIP2RbAAAAQE"]
[Fri Apr 10 18:59:22.212008 2026] [:error] [pid 13189:tid 13206] [client 20.251.25.161:9927] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "adjYCpAxiJKPums3eBB5ggAAAE4"]
[Fri Apr 10 18:59:22.728154 2026] [:error] [pid 13102:tid 13163] [client 20.251.25.161:52327] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "adjYCv9xLvjW2guI55ZqvAAAAAM"]
[Fri Apr 10 18:59:23.237639 2026] [:error] [pid 13101:tid 13141] [client 20.251.25.161:53206] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pp.php"] [unique_id "adjYC98Ldw85818pj2qlxwAAAIg"]
[Fri Apr 10 18:59:23.752394 2026] [:error] [pid 13100:tid 13128] [client 20.251.25.161:53590] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "adjYC1zg-ZkZ0InWIP2RbgAAARc"]
[Fri Apr 10 18:59:24.265515 2026] [:error] [pid 13101:tid 13137] [client 20.251.25.161:9928] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "adjYDN8Ldw85818pj2qlygAAAIQ"]
[Fri Apr 10 18:59:24.780868 2026] [:error] [pid 13101:tid 13143] [client 20.251.25.161:46570] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "adjYDN8Ldw85818pj2qlzAAAAIo"]
[Fri Apr 10 18:59:25.294132 2026] [:error] [pid 13101:tid 13145] [client 20.251.25.161:46529] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/myy.php"] [unique_id "adjYDd8Ldw85818pj2qlzwAAAIw"]
[Fri Apr 10 18:59:25.803951 2026] [:error] [pid 13102:tid 13161] [client 20.251.25.161:54097] [client 20.251.25.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "adjYDf9xLvjW2guI55ZqwgAAAAE"]
[Fri Apr 10 18:59:26.320457 2026] [:error] [pid 13102:tid 13168] [client 20.251.25.161:49194] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adjYDv9xLvjW2guI55ZqwwAAAAg"]
[Fri Apr 10 18:59:26.835405 2026] [:error] [pid 25984:tid 25994] [client 20.251.25.161:64579] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adjYDrsdbY_MC14OH16a4wAAAUU"]
[Fri Apr 10 18:59:27.363690 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:9953] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adjYD7sdbY_MC14OH16a5QAAAVU"]
[Fri Apr 10 18:59:27.912017 2026] [:error] [pid 13102:tid 13167] [client 20.251.25.161:46556] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wdone1.php"] [unique_id "adjYD_9xLvjW2guI55ZqxgAAAAc"]
[Fri Apr 10 18:59:28.429101 2026] [:error] [pid 13189:tid 13193] [client 20.251.25.161:53200] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjYEJAxiJKPums3eBB5hgAAAEE"]
[Fri Apr 10 18:59:28.939788 2026] [:error] [pid 13100:tid 13109] [client 20.251.25.161:53599] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjYEFzg-ZkZ0InWIP2RcgAAAQQ"]
[Fri Apr 10 18:59:29.493824 2026] [:error] [pid 13102:tid 13170] [client 20.251.25.161:53189] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjYEf9xLvjW2guI55ZqygAAAAo"]
[Fri Apr 10 18:59:30.024026 2026] [:error] [pid 13100:tid 13126] [client 20.251.25.161:54128] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adjYElzg-ZkZ0InWIP2RdAAAARU"]
[Fri Apr 10 18:59:30.539397 2026] [:error] [pid 25984:tid 25996] [client 20.251.25.161:52290] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adjYErsdbY_MC14OH16a6gAAAUc"]
[Fri Apr 10 18:59:31.050052 2026] [:error] [pid 25984:tid 25993] [client 20.251.25.161:54109] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adjYE7sdbY_MC14OH16a9wAAAUQ"]
[Fri Apr 10 18:59:31.581036 2026] [:error] [pid 3934:tid 3963] [client 20.251.25.161:9938] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adjYE4a41m-BS8mg82eeQgAAANg"]
[Fri Apr 10 18:59:32.094935 2026] [:error] [pid 3934:tid 3951] [client 20.251.25.161:49158] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adjYFIa41m-BS8mg82eeQwAAAMw"]
[Fri Apr 10 18:59:32.605208 2026] [:error] [pid 25984:tid 25989] [client 20.251.25.161:53604] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "adjYFLsdbY_MC14OH16a-gAAAUA"]
[Fri Apr 10 18:59:33.124684 2026] [:error] [pid 13100:tid 13122] [client 20.251.25.161:53619] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "adjYFVzg-ZkZ0InWIP2RfQAAARE"]
[Fri Apr 10 18:59:33.637007 2026] [:error] [pid 25984:tid 26003] [client 20.251.25.161:9949] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "adjYFbsdbY_MC14OH16bAwAAAU4"]
[Fri Apr 10 18:59:34.151568 2026] [:error] [pid 3934:tid 3943] [client 20.251.25.161:54114] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccs.php"] [unique_id "adjYFoa41m-BS8mg82eeSAAAAMQ"]
[Fri Apr 10 18:59:34.663611 2026] [:error] [pid 25984:tid 25997] [client 20.251.25.161:52624] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wps.php"] [unique_id "adjYFrsdbY_MC14OH16bBgAAAUg"]
[Fri Apr 10 18:59:35.188139 2026] [:error] [pid 3934:tid 3947] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Fri Apr 10 18:59:35.468267 2026] [:error] [pid 3934:tid 3950] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Fri Apr 10 18:59:35.727376 2026] [:error] [pid 3934:tid 3956] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Fri Apr 10 18:59:35.986938 2026] [:error] [pid 3934:tid 3942] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny2.php
[Fri Apr 10 18:59:36.247435 2026] [:error] [pid 3934:tid 3949] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/ava.php
[Fri Apr 10 18:59:36.508595 2026] [:error] [pid 3934:tid 3951] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/awh.php
[Fri Apr 10 18:59:36.767970 2026] [:error] [pid 3934:tid 3939] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Fri Apr 10 18:59:37.026944 2026] [:error] [pid 3934:tid 3958] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Apr 10 18:59:37.288861 2026] [:error] [pid 3934:tid 3961] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Apr 10 18:59:37.548633 2026] [:error] [pid 3934:tid 3943] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Fri Apr 10 18:59:37.808922 2026] [:error] [pid 3934:tid 3947] [client 20.251.25.161:46654] File does not exist: /usr/local/apache/htdocs/suspended-page/riz.php
[Fri Apr 10 18:59:38.065623 2026] [:error] [pid 3934:tid 3953] [client 20.251.25.161:46654] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adjYGoa41m-BS8mg82eeXAAAAM4"]
[Fri Apr 10 18:59:38.587945 2026] [:error] [pid 13100:tid 13125] [client 20.251.25.161:52337] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adjYGlzg-ZkZ0InWIP2RgAAAARQ"]
[Fri Apr 10 18:59:39.119775 2026] [:error] [pid 13100:tid 13124] [client 20.251.25.161:52321] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adjYG1zg-ZkZ0InWIP2RgQAAARM"]
[Fri Apr 10 18:59:39.650493 2026] [:error] [pid 3934:tid 3954] [client 20.251.25.161:56961] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/packsin1.php"] [unique_id "adjYG4a41m-BS8mg82eeYAAAAM8"]
[Fri Apr 10 18:59:40.163303 2026] [:error] [pid 25984:tid 26013] [client 20.251.25.161:52305] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "adjYHLsdbY_MC14OH16bEAAAAVg"]
[Fri Apr 10 18:59:40.686528 2026] [:error] [pid 25984:tid 26003] [client 20.251.25.161:54134] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "adjYHLsdbY_MC14OH16bEgAAAU4"]
[Fri Apr 10 18:59:41.231488 2026] [:error] [pid 25984:tid 25998] [client 20.251.25.161:52318] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "adjYHbsdbY_MC14OH16bGgAAAUk"]
[Fri Apr 10 18:59:41.768251 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:64590] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/om.php"] [unique_id "adjYHbsdbY_MC14OH16bHQAAAVU"]
[Fri Apr 10 18:59:42.337469 2026] [:error] [pid 25984:tid 26002] [client 20.251.25.161:46585] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/006.php"] [unique_id "adjYHrsdbY_MC14OH16bIQAAAU0"]
[Fri Apr 10 18:59:42.881191 2026] [:error] [pid 25984:tid 25999] [client 20.251.25.161:46561] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/006.php"] [unique_id "adjYHrsdbY_MC14OH16bJQAAAUo"]
[Fri Apr 10 18:59:43.503281 2026] [:error] [pid 13101:tid 13150] [client 20.251.25.161:46531] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/006.php"] [unique_id "adjYH98Ldw85818pj2ql3wAAAJE"]
[Fri Apr 10 18:59:44.111999 2026] [:error] [pid 3934:tid 3942] [client 20.251.25.161:54142] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/006.php"] [unique_id "adjYIIa41m-BS8mg82eeZgAAAMM"]
[Fri Apr 10 18:59:44.675379 2026] [:error] [pid 25984:tid 26003] [client 20.251.25.161:54137] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adjYILsdbY_MC14OH16bLwAAAU4"]
[Fri Apr 10 18:59:45.190644 2026] [:error] [pid 13102:tid 13173] [client 20.251.25.161:54127] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adjYIf9xLvjW2guI55Zq1gAAAA0"]
[Fri Apr 10 18:59:45.707494 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:53573] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adjYIbsdbY_MC14OH16bOgAAAVU"]
[Fri Apr 10 18:59:46.307797 2026] [:error] [pid 13102:tid 13172] [client 20.251.25.161:53186] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adjYIv9xLvjW2guI55Zq3AAAAAw"]
[Fri Apr 10 18:59:46.913083 2026] [:error] [pid 13100:tid 13116] [client 20.251.25.161:52667] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adjYIlzg-ZkZ0InWIP2RhAAAAQs"]
[Fri Apr 10 18:59:47.436009 2026] [:error] [pid 13102:tid 13164] [client 20.251.25.161:46637] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adjYI_9xLvjW2guI55Zq4AAAAAQ"]
[Fri Apr 10 18:59:48.043426 2026] [:error] [pid 13102:tid 13181] [client 20.251.25.161:46554] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adjYJP9xLvjW2guI55Zq4gAAABU"]
[Fri Apr 10 18:59:48.696128 2026] [:error] [pid 13101:tid 13146] [client 20.251.25.161:46623] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xda.php"] [unique_id "adjYJN8Ldw85818pj2ql5wAAAI0"]
[Fri Apr 10 18:59:49.345504 2026] [:error] [pid 13100:tid 13114] [client 20.251.25.161:49202] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf.php"] [unique_id "adjYJVzg-ZkZ0InWIP2RhwAAAQk"]
[Fri Apr 10 18:59:49.871035 2026] [:error] [pid 13100:tid 13121] [client 20.251.25.161:51842] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf.php"] [unique_id "adjYJVzg-ZkZ0InWIP2RiAAAARA"]
[Fri Apr 10 18:59:50.465005 2026] [:error] [pid 13100:tid 13113] [client 20.251.25.161:46611] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf.php"] [unique_id "adjYJlzg-ZkZ0InWIP2RiQAAAQg"]
[Fri Apr 10 18:59:51.088159 2026] [:error] [pid 25984:tid 25997] [client 20.251.25.161:49177] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wolf.php"] [unique_id "adjYJ7sdbY_MC14OH16bUwAAAUg"]
[Fri Apr 10 18:59:51.736521 2026] [:error] [pid 13189:tid 13202] [client 20.251.25.161:64602] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adjYJ5AxiJKPums3eBB5lgAAAEo"]
[Fri Apr 10 18:59:52.455654 2026] [:error] [pid 13100:tid 13108] [client 20.251.25.161:53227] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adjYKFzg-ZkZ0InWIP2RjAAAAQM"]
[Fri Apr 10 18:59:52.987349 2026] [:error] [pid 13100:tid 13129] [client 20.251.25.161:52302] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adjYKFzg-ZkZ0InWIP2RjgAAARg"]
[Fri Apr 10 18:59:53.508582 2026] [:error] [pid 25984:tid 26011] [client 20.251.25.161:53237] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adjYKbsdbY_MC14OH16bZAAAAVY"]
[Fri Apr 10 18:59:54.036072 2026] [:error] [pid 25984:tid 26009] [client 20.251.25.161:46573] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjYKrsdbY_MC14OH16bZwAAAVQ"]
[Fri Apr 10 18:59:54.567618 2026] [:error] [pid 13102:tid 13169] [client 20.251.25.161:50645] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjYKv9xLvjW2guI55Zq8wAAAAk"]
[Fri Apr 10 18:59:55.107865 2026] [:error] [pid 25984:tid 26005] [client 20.251.25.161:46539] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjYK7sdbY_MC14OH16bdQAAAVA"]
[Fri Apr 10 18:59:55.628553 2026] [:error] [pid 25984:tid 25995] [client 20.251.25.161:51844] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7.php"] [unique_id "adjYK7sdbY_MC14OH16beQAAAUY"]
[Fri Apr 10 18:59:56.168593 2026] [:error] [pid 25984:tid 26004] [client 20.251.25.161:46600] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adjYLLsdbY_MC14OH16bfgAAAU8"]
[Fri Apr 10 18:59:56.709740 2026] [:error] [pid 13101:tid 13142] [client 20.251.25.161:9340] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adjYLN8Ldw85818pj2ql6gAAAIk"]
[Fri Apr 10 18:59:57.219197 2026] [:error] [pid 13102:tid 13181] [client 20.251.25.161:9234] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adjYLf9xLvjW2guI55Zq9gAAABU"]
[Fri Apr 10 18:59:57.734635 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:58549] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adjYLbsdbY_MC14OH16biAAAAVU"]
[Fri Apr 10 18:59:58.259529 2026] [:error] [pid 13102:tid 13165] [client 20.251.25.161:51887] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adjYLv9xLvjW2guI55Zq-QAAAAU"]
[Fri Apr 10 18:59:58.777226 2026] [:error] [pid 13102:tid 13173] [client 20.251.25.161:54108] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adjYLv9xLvjW2guI55Zq-wAAAA0"]
[Fri Apr 10 18:59:59.302095 2026] [:error] [pid 13102:tid 13178] [client 20.251.25.161:58536] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adjYL_9xLvjW2guI55ZrAAAAABI"]
[Fri Apr 10 18:59:59.818629 2026] [:error] [pid 13102:tid 13161] [client 20.251.25.161:52311] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adjYL_9xLvjW2guI55ZrAgAAAAE"]
[Fri Apr 10 19:00:00.338768 2026] [:error] [pid 13102:tid 13174] [client 20.251.25.161:9971] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adjYMP9xLvjW2guI55ZrAwAAAA4"]
[Fri Apr 10 19:00:00.851592 2026] [:error] [pid 13102:tid 13184] [client 20.251.25.161:52348] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adjYMP9xLvjW2guI55ZrBQAAABg"]
[Fri Apr 10 19:00:01.382078 2026] [:error] [pid 3934:tid 3963] [client 20.251.25.161:54098] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adjYMYa41m-BS8mg82eehgAAANg"]
[Fri Apr 10 19:00:01.907802 2026] [:error] [pid 13102:tid 13171] [client 20.251.25.161:49208] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adjYMf9xLvjW2guI55ZrCgAAAAs"]
[Fri Apr 10 19:00:02.421951 2026] [:error] [pid 3934:tid 3962] [client 20.251.25.161:9925] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "adjYMoa41m-BS8mg82eeigAAANc"]
[Fri Apr 10 19:00:02.934595 2026] [:error] [pid 13189:tid 13192] [client 20.251.25.161:50668] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "adjYMpAxiJKPums3eBB5nAAAAEA"]
[Fri Apr 10 19:00:03.457209 2026] [:error] [pid 3934:tid 3948] [client 20.251.25.161:52316] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "adjYM4a41m-BS8mg82eejgAAAMk"]
[Fri Apr 10 19:00:03.970990 2026] [:error] [pid 13100:tid 13120] [client 20.251.25.161:53615] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/image.php"] [unique_id "adjYM1zg-ZkZ0InWIP2RlAAAAQ8"]
[Fri Apr 10 19:00:04.489535 2026] [:error] [pid 13189:tid 13210] [client 20.251.25.161:46563] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adjYNJAxiJKPums3eBB5oQAAAFI"]
[Fri Apr 10 19:00:05.013487 2026] [:error] [pid 13100:tid 13110] [client 20.251.25.161:51853] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adjYNVzg-ZkZ0InWIP2RlQAAAQU"]
[Fri Apr 10 19:00:05.536759 2026] [:error] [pid 13102:tid 13176] [client 20.251.25.161:46550] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adjYNf9xLvjW2guI55ZrEAAAABA"]
[Fri Apr 10 19:00:06.060846 2026] [:error] [pid 13189:tid 13215] [client 20.251.25.161:52649] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adjYNpAxiJKPums3eBB5pgAAAFc"]
[Fri Apr 10 19:00:06.605914 2026] [:error] [pid 13189:tid 13198] [client 20.251.25.161:46607] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adjYNpAxiJKPums3eBB5qQAAAEY"]
[Fri Apr 10 19:00:07.136895 2026] [:error] [pid 25984:tid 25991] [client 20.251.25.161:51876] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adjYN7sdbY_MC14OH16bjwAAAUI"]
[Fri Apr 10 19:00:07.674933 2026] [:error] [pid 13189:tid 13202] [client 20.251.25.161:46571] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adjYN5AxiJKPums3eBB5qwAAAEo"]
[Fri Apr 10 19:00:08.226069 2026] [:error] [pid 25984:tid 26002] [client 20.251.25.161:49154] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adjYOLsdbY_MC14OH16bkwAAAU0"]
[Fri Apr 10 19:00:08.740217 2026] [:error] [pid 13189:tid 13209] [client 20.251.25.161:9321] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adjYOJAxiJKPums3eBB5rgAAAFE"]
[Fri Apr 10 19:00:09.264851 2026] [:error] [pid 3934:tid 3956] [client 20.251.25.161:53222] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adjYOYa41m-BS8mg82eemAAAANE"]
[Fri Apr 10 19:00:09.781408 2026] [:error] [pid 3934:tid 3954] [client 20.251.25.161:51893] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adjYOYa41m-BS8mg82eemwAAAM8"]
[Fri Apr 10 19:00:10.299227 2026] [:error] [pid 3934:tid 3957] [client 20.251.25.161:51847] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adjYOoa41m-BS8mg82eeowAAANI"]
[Fri Apr 10 19:00:10.831941 2026] [:error] [pid 13102:tid 13173] [client 20.251.25.161:46598] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adjYOv9xLvjW2guI55ZrGQAAAA0"]
[Fri Apr 10 19:00:11.347887 2026] [:error] [pid 3934:tid 3953] [client 20.251.25.161:46560] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adjYO4a41m-BS8mg82eeqQAAAM4"]
[Fri Apr 10 19:00:11.878314 2026] [:error] [pid 25984:tid 25995] [client 20.251.25.161:58541] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adjYO7sdbY_MC14OH16bmQAAAUY"]
[Fri Apr 10 19:00:12.392790 2026] [:error] [pid 25984:tid 25999] [client 20.251.25.161:53628] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adjYPLsdbY_MC14OH16bnAAAAUo"]
[Fri Apr 10 19:00:12.911252 2026] [:error] [pid 13102:tid 13178] [client 20.251.25.161:9926] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adjYPP9xLvjW2guI55ZrHgAAABI"]
[Fri Apr 10 19:00:13.429002 2026] [:error] [pid 25984:tid 26004] [client 20.251.25.161:46528] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adjYPbsdbY_MC14OH16bowAAAU8"]
[Fri Apr 10 19:00:13.973248 2026] [:error] [pid 13100:tid 13121] [client 20.251.25.161:53231] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adjYPVzg-ZkZ0InWIP2RoAAAARA"]
[Fri Apr 10 19:00:14.487603 2026] [:error] [pid 25984:tid 26005] [client 20.251.25.161:9970] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/roksad1.php"] [unique_id "adjYPrsdbY_MC14OH16bqQAAAVA"]
[Fri Apr 10 19:00:15.016958 2026] [:error] [pid 25984:tid 25989] [client 20.251.25.161:58513] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adjYP7sdbY_MC14OH16brgAAAUA"]
[Fri Apr 10 19:00:15.532432 2026] [:error] [pid 13102:tid 13180] [client 20.251.25.161:46640] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adjYP_9xLvjW2guI55ZrIwAAABQ"]
[Fri Apr 10 19:00:16.050543 2026] [:error] [pid 13102:tid 13173] [client 20.251.25.161:53226] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adjYQP9xLvjW2guI55ZrJwAAAA0"]
[Fri Apr 10 19:00:16.564915 2026] [:error] [pid 25984:tid 25995] [client 20.251.25.161:46574] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adjYQLsdbY_MC14OH16btAAAAUY"]
[Fri Apr 10 19:00:17.079832 2026] [:error] [pid 25984:tid 26007] [client 20.251.25.161:9941] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adjYQbsdbY_MC14OH16buAAAAVI"]
[Fri Apr 10 19:00:17.598300 2026] [:error] [pid 25984:tid 26005] [client 20.251.25.161:49212] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adjYQbsdbY_MC14OH16bugAAAVA"]
[Fri Apr 10 19:00:18.125771 2026] [:error] [pid 3934:tid 3959] [client 20.251.25.161:46575] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adjYQoa41m-BS8mg82eesQAAANQ"]
[Fri Apr 10 19:00:18.635736 2026] [:error] [pid 25984:tid 25994] [client 20.251.25.161:49172] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adjYQrsdbY_MC14OH16bvwAAAUU"]
[Fri Apr 10 19:00:19.158866 2026] [:error] [pid 3934:tid 3947] [client 20.251.25.161:51859] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adjYQ4a41m-BS8mg82eeswAAAMg"]
[Fri Apr 10 19:00:19.672646 2026] [:error] [pid 25984:tid 25999] [client 20.251.25.161:54120] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adjYQ7sdbY_MC14OH16bxwAAAUo"]
[Fri Apr 10 19:00:20.198809 2026] [:error] [pid 25984:tid 25998] [client 20.251.25.161:46565] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adjYRLsdbY_MC14OH16byQAAAUk"]
[Fri Apr 10 19:00:20.713488 2026] [:error] [pid 25984:tid 26013] [client 20.251.25.161:46649] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adjYRLsdbY_MC14OH16bzQAAAVg"]
[Fri Apr 10 19:00:21.230877 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:49193] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adjYRbsdbY_MC14OH16b1AAAAVU"]
[Fri Apr 10 19:00:21.745902 2026] [:error] [pid 3934:tid 3944] [client 20.251.25.161:9968] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adjYRYa41m-BS8mg82eeuQAAAMU"]
[Fri Apr 10 19:00:22.267849 2026] [:error] [pid 25984:tid 25996] [client 20.251.25.161:9935] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adjYRrsdbY_MC14OH16b2wAAAUc"]
[Fri Apr 10 19:00:22.826784 2026] [:error] [pid 13101:tid 13153] [client 20.251.25.161:46619] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adjYRt8Ldw85818pj2qmBAAAAJQ"]
[Fri Apr 10 19:00:23.370257 2026] [:error] [pid 13102:tid 13162] [client 20.251.25.161:46601] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adjYR_9xLvjW2guI55ZrMQAAAAI"]
[Fri Apr 10 19:00:23.885055 2026] [:error] [pid 13189:tid 13196] [client 20.251.25.161:64583] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adjYR5AxiJKPums3eBB5vgAAAEQ"]
[Fri Apr 10 19:00:24.397910 2026] [:error] [pid 25984:tid 25992] [client 20.251.25.161:49175] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adjYSLsdbY_MC14OH16b4QAAAUM"]
[Fri Apr 10 19:00:24.943027 2026] [:error] [pid 13189:tid 13201] [client 20.251.25.161:53176] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adjYSJAxiJKPums3eBB5wQAAAEk"]
[Fri Apr 10 19:00:25.497806 2026] [:error] [pid 13100:tid 13115] [client 20.251.25.161:9920] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adjYSVzg-ZkZ0InWIP2RqwAAAQo"]
[Fri Apr 10 19:00:26.013525 2026] [:error] [pid 25984:tid 26010] [client 20.251.25.161:54094] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adjYSrsdbY_MC14OH16b6AAAAVU"]
[Fri Apr 10 19:00:26.554818 2026] [:error] [pid 13101:tid 13152] [client 20.251.25.161:58501] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adjYSt8Ldw85818pj2qmCgAAAJM"]
[Fri Apr 10 19:00:27.071320 2026] [:error] [pid 13102:tid 13179] [client 20.251.25.161:9295] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adjYS_9xLvjW2guI55ZrPQAAABM"]
[Fri Apr 10 19:00:27.611311 2026] [:error] [pid 25984:tid 25994] [client 20.251.25.161:9285] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adjYS7sdbY_MC14OH16b7gAAAUU"]
[Fri Apr 10 19:00:28.134523 2026] [:error] [pid 13102:tid 13173] [client 20.251.25.161:46627] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adjYTP9xLvjW2guI55ZrQgAAAA0"]
[Fri Apr 10 19:00:28.682117 2026] [:error] [pid 25984:tid 26007] [client 20.251.25.161:54102] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adjYTLsdbY_MC14OH16b8wAAAVI"]
[Fri Apr 10 19:00:29.196671 2026] [:error] [pid 13102:tid 13167] [client 20.251.25.161:52320] [client 20.251.25.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adjYTf9xLvjW2guI55ZrRgAAAAc"]
[Fri Apr 10 23:21:38.270844 2026] [:error] [pid 62710:tid 62714] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Fri Apr 10 23:21:38.504744 2026] [:error] [pid 62710:tid 62719] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Fri Apr 10 23:21:38.740558 2026] [:error] [pid 62710:tid 62727] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Fri Apr 10 23:21:38.974158 2026] [:error] [pid 62710:tid 62737] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Fri Apr 10 23:21:39.255893 2026] [:error] [pid 62710:tid 62716] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 10 23:21:39.573718 2026] [:error] [pid 62710:tid 62733] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Fri Apr 10 23:21:39.870976 2026] [:error] [pid 62710:tid 62730] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Fri Apr 10 23:21:40.126773 2026] [:error] [pid 62710:tid 62736] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Fri Apr 10 23:21:40.360480 2026] [:error] [pid 62710:tid 62729] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Fri Apr 10 23:21:40.599538 2026] [:error] [pid 62710:tid 62718] [client 172.213.0.120:64779] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Fri Apr 10 23:21:40.933036 2026] [:error] [pid 62710:tid 62728] [client 172.213.0.120:64779] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "adkVhOME7qrf5xEWWJtC5QAAAg8"]
[Fri Apr 10 23:21:41.600952 2026] [:error] [pid 13100:tid 13106] [client 172.213.0.120:42655] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "adkVhVzg-ZkZ0InWIP3QsgAAAQE"]
[Fri Apr 10 23:21:42.164024 2026] [:error] [pid 63134:tid 63159] [client 172.213.0.120:36187] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "adkVhtFALqPDwWi6eJLGRwAAA9Y"]
[Fri Apr 10 23:21:42.644582 2026] [:error] [pid 63134:tid 63137] [client 172.213.0.120:37419] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-104.php"] [unique_id "adkVhtFALqPDwWi6eJLGTAAAA8A"]
[Fri Apr 10 23:21:43.116383 2026] [:error] [pid 13189:tid 13206] [client 172.213.0.120:64795] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "adkVh5AxiJKPums3eBADywAAAE4"]
[Fri Apr 10 23:21:43.665549 2026] [:error] [pid 63062:tid 63081] [client 172.213.0.120:37380] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "adkVh52HtsmV85NqkMcN1AAAA5E"]
[Fri Apr 10 23:21:44.216676 2026] [:error] [pid 63134:tid 63137] [client 172.213.0.120:50162] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "adkViNFALqPDwWi6eJLGWQAAA8A"]
[Fri Apr 10 23:21:44.750833 2026] [:error] [pid 13101:tid 13149] [client 172.213.0.120:42651] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rzki.php"] [unique_id "adkViN8Ldw85818pj2oaUgAAAJA"]
[Fri Apr 10 23:21:45.323561 2026] [:error] [pid 62651:tid 62671] [client 172.213.0.120:64788] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adkViTbAH0le57SIaqw3owAAAdI"]
[Fri Apr 10 23:21:45.861434 2026] [:error] [pid 13101:tid 13140] [client 172.213.0.120:50452] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adkVid8Ldw85818pj2oaVQAAAIc"]
[Fri Apr 10 23:21:46.382411 2026] [:error] [pid 62819:tid 62822] [client 172.213.0.120:36210] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adkVivU20EyPf7NlsleCLQAAAoA"]
[Fri Apr 10 23:21:46.888624 2026] [:error] [pid 62819:tid 62833] [client 172.213.0.120:64830] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adkVivU20EyPf7NlsleCLwAAAos"]
[Fri Apr 10 23:21:47.363170 2026] [:error] [pid 62710:tid 62728] [client 172.213.0.120:64777] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "adkVi-ME7qrf5xEWWJtC9QAAAg8"]
[Fri Apr 10 23:21:47.831483 2026] [:error] [pid 13189:tid 13198] [client 172.213.0.120:36171] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "adkVi5AxiJKPums3eBAD5QAAAEY"]
[Fri Apr 10 23:21:48.384546 2026] [:error] [pid 13101:tid 13151] [client 172.213.0.120:37402] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "adkVjN8Ldw85818pj2oaXAAAAJI"]
[Fri Apr 10 23:21:48.905017 2026] [:error] [pid 13101:tid 13157] [client 172.213.0.120:64797] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d12.php"] [unique_id "adkVjN8Ldw85818pj2oaYAAAAJg"]
[Fri Apr 10 23:21:49.450346 2026] [:error] [pid 62769:tid 62782] [client 172.213.0.120:50169] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "adkVjcWsSnfLoB8ifjC3-AAAAks"]
[Fri Apr 10 23:21:49.932614 2026] [:error] [pid 63134:tid 63149] [client 172.213.0.120:50170] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "adkVjdFALqPDwWi6eJLGYwAAA8w"]
[Fri Apr 10 23:21:50.403092 2026] [:error] [pid 63134:tid 63140] [client 172.213.0.120:37435] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "adkVjtFALqPDwWi6eJLGZgAAA8M"]
[Fri Apr 10 23:21:50.917984 2026] [:error] [pid 62710:tid 62723] [client 172.213.0.120:37420] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/okxh.php"] [unique_id "adkVjuME7qrf5xEWWJtC_QAAAgo"]
[Fri Apr 10 23:21:51.386890 2026] [:error] [pid 62769:tid 62795] [client 172.213.0.120:50467] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "adkVj8WsSnfLoB8ifjC4BwAAAlg"]
[Fri Apr 10 23:21:51.938483 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:36193] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "adkVj8WsSnfLoB8ifjC4CwAAAk8"]
[Fri Apr 10 23:21:52.447914 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:36164] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "adkVkMWsSnfLoB8ifjC4EQAAAk0"]
[Fri Apr 10 23:21:52.951549 2026] [:error] [pid 13189:tid 13210] [client 172.213.0.120:64810] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55b76.php"] [unique_id "adkVkJAxiJKPums3eBAEDwAAAFI"]
[Fri Apr 10 23:21:53.432604 2026] [:error] [pid 13189:tid 13209] [client 172.213.0.120:50479] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "adkVkZAxiJKPums3eBAEEwAAAFE"]
[Fri Apr 10 23:21:54.016396 2026] [:error] [pid 13189:tid 13210] [client 172.213.0.120:37424] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "adkVkpAxiJKPums3eBAEHAAAAFI"]
[Fri Apr 10 23:21:54.709943 2026] [:error] [pid 13189:tid 13198] [client 172.213.0.120:37383] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "adkVkpAxiJKPums3eBAEJgAAAEY"]
[Fri Apr 10 23:21:55.196008 2026] [:error] [pid 63134:tid 63157] [client 172.213.0.120:50475] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tt.php"] [unique_id "adkVk9FALqPDwWi6eJLGawAAA9Q"]
[Fri Apr 10 23:21:55.754065 2026] [:error] [pid 13189:tid 13206] [client 172.213.0.120:50470] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "adkVk5AxiJKPums3eBAEMgAAAE4"]
[Fri Apr 10 23:21:56.344504 2026] [:error] [pid 62710:tid 62732] [client 172.213.0.120:50465] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "adkVlOME7qrf5xEWWJtDBAAAAhM"]
[Fri Apr 10 23:21:56.887914 2026] [:error] [pid 62884:tid 62910] [client 172.213.0.120:50149] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "adkVlOUCK1xrhnnmpo2Y-wAAAtM"]
[Fri Apr 10 23:21:57.561896 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:36218] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maul.php"] [unique_id "adkVlcWsSnfLoB8ifjC4KgAAAkc"]
[Fri Apr 10 23:21:58.025492 2026] [:error] [pid 62769:tid 62795] [client 172.213.0.120:36209] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "adkVlsWsSnfLoB8ifjC4LwAAAlg"]
[Fri Apr 10 23:21:58.497398 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:37431] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "adkVlsWsSnfLoB8ifjC4NAAAAk8"]
[Fri Apr 10 23:21:58.988208 2026] [:error] [pid 62769:tid 62791] [client 172.213.0.120:50492] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "adkVlsWsSnfLoB8ifjC4OgAAAlQ"]
[Fri Apr 10 23:21:59.458335 2026] [:error] [pid 62769:tid 62771] [client 172.213.0.120:36209] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5b9ac.php"] [unique_id "adkVl8WsSnfLoB8ifjC4PQAAAkA"]
[Fri Apr 10 23:22:00.120661 2026] [:error] [pid 62710:tid 62720] [client 172.213.0.120:50136] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "adkVmOME7qrf5xEWWJtDDgAAAgc"]
[Fri Apr 10 23:22:00.612585 2026] [:error] [pid 63134:tid 63138] [client 172.213.0.120:62216] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "adkVmNFALqPDwWi6eJLGcAAAA8E"]
[Fri Apr 10 23:22:01.156443 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:36219] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "adkVmcWsSnfLoB8ifjC4SAAAAk8"]
[Fri Apr 10 23:22:01.711882 2026] [:error] [pid 63062:tid 63069] [client 172.213.0.120:37381] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hehe.php"] [unique_id "adkVmZ2HtsmV85NqkMcN5QAAA4U"]
[Fri Apr 10 23:22:02.182012 2026] [:error] [pid 13101:tid 13141] [client 172.213.0.120:42658] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkVmt8Ldw85818pj2oaiQAAAIg"]
[Fri Apr 10 23:22:02.656117 2026] [:error] [pid 63134:tid 63139] [client 172.213.0.120:50451] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkVmtFALqPDwWi6eJLGeQAAA8I"]
[Fri Apr 10 23:22:03.146940 2026] [:error] [pid 62769:tid 62773] [client 172.213.0.120:37377] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkVm8WsSnfLoB8ifjC4SgAAAkI"]
[Fri Apr 10 23:22:03.632581 2026] [:error] [pid 62884:tid 62910] [client 172.213.0.120:50161] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkVm-UCK1xrhnnmpo2ZCAAAAtM"]
[Fri Apr 10 23:22:04.238664 2026] [:error] [pid 62710:tid 62718] [client 172.213.0.120:46650] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "adkVnOME7qrf5xEWWJtDFwAAAgU"]
[Fri Apr 10 23:22:04.717269 2026] [:error] [pid 13101:tid 13137] [client 172.213.0.120:64816] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "adkVnN8Ldw85818pj2oalQAAAIQ"]
[Fri Apr 10 23:22:05.514560 2026] [:error] [pid 63134:tid 63161] [client 172.213.0.120:36199] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "adkVndFALqPDwWi6eJLGgAAAA9g"]
[Fri Apr 10 23:22:06.055943 2026] [:error] [pid 63062:tid 63080] [client 172.213.0.120:46608] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/varb.php"] [unique_id "adkVnp2HtsmV85NqkMcN8gAAA5A"]
[Fri Apr 10 23:22:06.552292 2026] [:error] [pid 62769:tid 62780] [client 172.213.0.120:64791] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "adkVnsWsSnfLoB8ifjC4UQAAAkk"]
[Fri Apr 10 23:22:07.207965 2026] [:error] [pid 63134:tid 63145] [client 172.213.0.120:62310] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "adkVn9FALqPDwWi6eJLGhwAAA8g"]
[Fri Apr 10 23:22:07.741641 2026] [:error] [pid 62651:tid 62666] [client 172.213.0.120:64805] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "adkVnzbAH0le57SIaqw3swAAAc0"]
[Fri Apr 10 23:22:08.210647 2026] [:error] [pid 62651:tid 62657] [client 172.213.0.120:50147] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lm15.php"] [unique_id "adkVoDbAH0le57SIaqw3tAAAAcQ"]
[Fri Apr 10 23:22:08.853907 2026] [:error] [pid 63062:tid 63073] [client 172.213.0.120:50113] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "adkVoJ2HtsmV85NqkMcN-QAAA4k"]
[Fri Apr 10 23:22:09.319034 2026] [:error] [pid 13100:tid 13125] [client 172.213.0.120:32368] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "adkVoVzg-ZkZ0InWIP3Q0wAAARQ"]
[Fri Apr 10 23:22:09.800861 2026] [:error] [pid 62769:tid 62780] [client 172.213.0.120:50471] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "adkVocWsSnfLoB8ifjC4ZAAAAkk"]
[Fri Apr 10 23:22:10.267849 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:64820] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clss.php"] [unique_id "adkVosWsSnfLoB8ifjC4agAAAkE"]
[Fri Apr 10 23:22:10.931478 2026] [:error] [pid 62769:tid 62788] [client 172.213.0.120:37395] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "adkVosWsSnfLoB8ifjC4dAAAAlE"]
[Fri Apr 10 23:22:11.519184 2026] [:error] [pid 63062:tid 63077] [client 172.213.0.120:64771] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "adkVo52HtsmV85NqkMcN_AAAA40"]
[Fri Apr 10 23:22:12.026978 2026] [:error] [pid 62710:tid 62713] [client 172.213.0.120:50486] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "adkVpOME7qrf5xEWWJtDKgAAAgA"]
[Fri Apr 10 23:22:12.565473 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:42642] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/44.php"] [unique_id "adkVpMWsSnfLoB8ifjC4hAAAAk8"]
[Fri Apr 10 23:22:13.049813 2026] [:error] [pid 62651:tid 62663] [client 172.213.0.120:42629] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "adkVpTbAH0le57SIaqw3uwAAAco"]
[Fri Apr 10 23:22:13.527359 2026] [:error] [pid 62769:tid 62771] [client 172.213.0.120:50148] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "adkVpcWsSnfLoB8ifjC4jQAAAkA"]
[Fri Apr 10 23:22:14.230686 2026] [:error] [pid 13189:tid 13199] [client 172.213.0.120:37421] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "adkVppAxiJKPums3eBAEpwAAAEc"]
[Fri Apr 10 23:22:14.742893 2026] [:error] [pid 13189:tid 13214] [client 172.213.0.120:50153] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5e0a.php"] [unique_id "adkVppAxiJKPums3eBAEqQAAAFY"]
[Fri Apr 10 23:22:15.261964 2026] [:error] [pid 62769:tid 62777] [client 172.213.0.120:36204] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "adkVp8WsSnfLoB8ifjC4lQAAAkY"]
[Fri Apr 10 23:22:15.939144 2026] [:error] [pid 62769:tid 62789] [client 172.213.0.120:31858] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "adkVp8WsSnfLoB8ifjC4oAAAAlI"]
[Fri Apr 10 23:22:16.518626 2026] [:error] [pid 62710:tid 62721] [client 172.213.0.120:62278] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "adkVqOME7qrf5xEWWJtDPAAAAgg"]
[Fri Apr 10 23:22:17.001884 2026] [:error] [pid 62884:tid 62892] [client 172.213.0.120:64806] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bo.php"] [unique_id "adkVqeUCK1xrhnnmpo2ZIAAAAsE"]
[Fri Apr 10 23:22:17.463333 2026] [:error] [pid 62710:tid 62718] [client 172.213.0.120:46615] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "adkVqeME7qrf5xEWWJtDQgAAAgU"]
[Fri Apr 10 23:22:17.930555 2026] [:error] [pid 63134:tid 63156] [client 172.213.0.120:64815] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "adkVqdFALqPDwWi6eJLGjQAAA9M"]
[Fri Apr 10 23:22:18.770046 2026] [:error] [pid 62651:tid 62665] [client 172.213.0.120:42656] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "adkVqjbAH0le57SIaqw3wAAAAcw"]
[Fri Apr 10 23:22:19.328954 2026] [:error] [pid 13101:tid 13134] [client 172.213.0.120:50120] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/56c53.php"] [unique_id "adkVq98Ldw85818pj2oapwAAAIE"]
[Fri Apr 10 23:22:19.942121 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:62274] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "adkVq8WsSnfLoB8ifjC4wQAAAkE"]
[Fri Apr 10 23:22:20.556143 2026] [:error] [pid 13101:tid 13138] [client 172.213.0.120:37438] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "adkVrN8Ldw85818pj2oasQAAAIU"]
[Fri Apr 10 23:22:21.204588 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:64770] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "adkVrcWsSnfLoB8ifjC41gAAAk8"]
[Fri Apr 10 23:22:21.664735 2026] [:error] [pid 13101:tid 13152] [client 172.213.0.120:42660] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx78.php"] [unique_id "adkVrd8Ldw85818pj2oavAAAAJM"]
[Fri Apr 10 23:22:23.007996 2026] [:error] [pid 62710:tid 62724] [client 172.213.0.120:36191] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adkVr-ME7qrf5xEWWJtDSgAAAgs"]
[Fri Apr 10 23:22:23.495316 2026] [:error] [pid 63134:tid 63148] [client 172.213.0.120:42678] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adkVr9FALqPDwWi6eJLGlgAAA8s"]
[Fri Apr 10 23:22:23.960926 2026] [:error] [pid 63062:tid 63079] [client 172.213.0.120:64823] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adkVr52HtsmV85NqkMcOGAAAA48"]
[Fri Apr 10 23:22:24.424355 2026] [:error] [pid 62651:tid 62674] [client 172.213.0.120:50142] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adkVsDbAH0le57SIaqw3zQAAAdU"]
[Fri Apr 10 23:22:24.967197 2026] [:error] [pid 62651:tid 62659] [client 172.213.0.120:36184] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "adkVsDbAH0le57SIaqw3zwAAAcY"]
[Fri Apr 10 23:22:25.451479 2026] [:error] [pid 63062:tid 63073] [client 172.213.0.120:42663] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "adkVsZ2HtsmV85NqkMcOIgAAA4k"]
[Fri Apr 10 23:22:25.984429 2026] [:error] [pid 13101:tid 13139] [client 172.213.0.120:50455] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "adkVsd8Ldw85818pj2oa6wAAAIY"]
[Fri Apr 10 23:22:26.484883 2026] [:error] [pid 62651:tid 62672] [client 172.213.0.120:42643] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jga.php"] [unique_id "adkVsjbAH0le57SIaqw31AAAAdM"]
[Fri Apr 10 23:22:26.949250 2026] [:error] [pid 62769:tid 62794] [client 172.213.0.120:50433] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "adkVssWsSnfLoB8ifjC46QAAAlc"]
[Fri Apr 10 23:22:27.461922 2026] [:error] [pid 13101:tid 13151] [client 172.213.0.120:64803] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "adkVs98Ldw85818pj2oa9gAAAJI"]
[Fri Apr 10 23:22:28.072320 2026] [:error] [pid 13189:tid 13192] [client 172.213.0.120:50445] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "adkVtJAxiJKPums3eBAEwwAAAEA"]
[Fri Apr 10 23:22:28.620798 2026] [:error] [pid 13189:tid 13194] [client 172.213.0.120:37436] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs.php"] [unique_id "adkVtJAxiJKPums3eBAEzAAAAEI"]
[Fri Apr 10 23:22:29.138714 2026] [:error] [pid 13189:tid 13202] [client 172.213.0.120:36203] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adkVtZAxiJKPums3eBAE1wAAAEo"]
[Fri Apr 10 23:22:29.608635 2026] [:error] [pid 63062:tid 63083] [client 172.213.0.120:50159] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adkVtZ2HtsmV85NqkMcOLwAAA5M"]
[Fri Apr 10 23:22:30.126962 2026] [:error] [pid 63134:tid 63137] [client 172.213.0.120:64802] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adkVttFALqPDwWi6eJLGqQAAA8A"]
[Fri Apr 10 23:22:30.718202 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:50154] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adkVtsWsSnfLoB8ifjC4_gAAAkE"]
[Fri Apr 10 23:22:31.264566 2026] [:error] [pid 62769:tid 62792] [client 172.213.0.120:50487] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "adkVt8WsSnfLoB8ifjC5BQAAAlU"]
[Fri Apr 10 23:22:31.792054 2026] [:error] [pid 62769:tid 62785] [client 172.213.0.120:50478] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "adkVt8WsSnfLoB8ifjC5CgAAAk4"]
[Fri Apr 10 23:22:32.257458 2026] [:error] [pid 62884:tid 62905] [client 172.213.0.120:50130] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "adkVuOUCK1xrhnnmpo2ZMQAAAs4"]
[Fri Apr 10 23:22:32.757994 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:62212] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/b.php"] [unique_id "adkVuMWsSnfLoB8ifjC5EQAAAk8"]
[Fri Apr 10 23:22:33.226480 2026] [:error] [pid 13189:tid 13212] [client 172.213.0.120:42683] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "adkVuZAxiJKPums3eBAE6QAAAFQ"]
[Fri Apr 10 23:22:33.742875 2026] [:error] [pid 62819:tid 62832] [client 172.213.0.120:50167] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "adkVufU20EyPf7NlsleCkgAAAoo"]
[Fri Apr 10 23:22:34.205760 2026] [:error] [pid 13100:tid 13106] [client 172.213.0.120:50140] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "adkVulzg-ZkZ0InWIP3Q6AAAAQE"]
[Fri Apr 10 23:22:34.691324 2026] [:error] [pid 13100:tid 13111] [client 172.213.0.120:37414] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws49.php"] [unique_id "adkVulzg-ZkZ0InWIP3Q6gAAAQY"]
[Fri Apr 10 23:22:35.153287 2026] [:error] [pid 63134:tid 63150] [client 172.213.0.120:37378] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "adkVu9FALqPDwWi6eJLGqwAAA80"]
[Fri Apr 10 23:22:35.716160 2026] [:error] [pid 62769:tid 62795] [client 172.213.0.120:50474] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "adkVu8WsSnfLoB8ifjC5KgAAAlg"]
[Fri Apr 10 23:22:36.283915 2026] [:error] [pid 62769:tid 62773] [client 172.213.0.120:50146] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "adkVvMWsSnfLoB8ifjC5LgAAAkI"]
[Fri Apr 10 23:22:38.599598 2026] [:error] [pid 62819:tid 62822] [client 172.213.0.120:62224] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog-header.php"] [unique_id "adkVvvU20EyPf7NlsleCmQAAAoA"]
[Fri Apr 10 23:22:39.070429 2026] [:error] [pid 62710:tid 62715] [client 172.213.0.120:50444] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adkVv-ME7qrf5xEWWJtDbwAAAgI"]
[Fri Apr 10 23:22:39.605672 2026] [:error] [pid 62710:tid 62730] [client 172.213.0.120:64773] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adkVv-ME7qrf5xEWWJtDeQAAAhE"]
[Fri Apr 10 23:22:40.087901 2026] [:error] [pid 62769:tid 62775] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Apr 10 23:22:40.339041 2026] [:error] [pid 62769:tid 62783] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Fri Apr 10 23:22:40.571998 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Fri Apr 10 23:22:40.855567 2026] [:error] [pid 62769:tid 62788] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Apr 10 23:22:41.110179 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Apr 10 23:22:41.344318 2026] [:error] [pid 62769:tid 62771] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Fri Apr 10 23:22:41.579772 2026] [:error] [pid 62769:tid 62793] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/zlnckdxn.php
[Fri Apr 10 23:22:41.812968 2026] [:error] [pid 62769:tid 62780] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/fs6.php
[Fri Apr 10 23:22:42.046135 2026] [:error] [pid 62769:tid 62782] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/xwzs.php
[Fri Apr 10 23:22:42.545633 2026] [:error] [pid 62769:tid 62788] [client 172.213.0.120:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/ws66.php
[Fri Apr 10 23:22:42.803578 2026] [:error] [pid 62769:tid 62777] [client 172.213.0.120:50123] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ewe.php"] [unique_id "adkVwsWsSnfLoB8ifjC5WgAAAkY"]
[Fri Apr 10 23:22:43.264625 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:42630] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ewe.php"] [unique_id "adkVw8WsSnfLoB8ifjC5XwAAAk0"]
[Fri Apr 10 23:22:43.765134 2026] [:error] [pid 62710:tid 62730] [client 172.213.0.120:50472] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ewe.php"] [unique_id "adkVw-ME7qrf5xEWWJtDiAAAAhE"]
[Fri Apr 10 23:22:44.227900 2026] [:error] [pid 62769:tid 62774] [client 172.213.0.120:50128] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ewe.php"] [unique_id "adkVxMWsSnfLoB8ifjC5ZgAAAkM"]
[Fri Apr 10 23:22:44.702647 2026] [:error] [pid 62769:tid 62779] [client 172.213.0.120:64777] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adkVxMWsSnfLoB8ifjC5cAAAAkg"]
[Fri Apr 10 23:22:45.244893 2026] [:error] [pid 13189:tid 13215] [client 172.213.0.120:37387] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adkVxZAxiJKPums3eBAFAAAAAFc"]
[Fri Apr 10 23:22:45.720766 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:36217] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adkVxcWsSnfLoB8ifjC5eAAAAkE"]
[Fri Apr 10 23:22:46.261893 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:36206] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboute.php"] [unique_id "adkVxsWsSnfLoB8ifjC5fAAAAk0"]
[Fri Apr 10 23:22:46.736038 2026] [:error] [pid 13189:tid 13198] [client 172.213.0.120:50114] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x9.php"] [unique_id "adkVxpAxiJKPums3eBAFDAAAAEY"]
[Fri Apr 10 23:22:47.272321 2026] [:error] [pid 13189:tid 13212] [client 172.213.0.120:64805] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x9.php"] [unique_id "adkVx5AxiJKPums3eBAFEwAAAFQ"]
[Fri Apr 10 23:22:47.802491 2026] [:error] [pid 13189:tid 13205] [client 172.213.0.120:62287] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x9.php"] [unique_id "adkVx5AxiJKPums3eBAFGgAAAE0"]
[Fri Apr 10 23:22:48.293284 2026] [:error] [pid 62884:tid 62906] [client 172.213.0.120:36169] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x9.php"] [unique_id "adkVyOUCK1xrhnnmpo2ZTAAAAs8"]
[Fri Apr 10 23:22:48.770159 2026] [:error] [pid 63062:tid 63086] [client 172.213.0.120:37391] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "adkVyJ2HtsmV85NqkMcOVwAAA5Y"]
[Fri Apr 10 23:22:49.253341 2026] [:error] [pid 13100:tid 13118] [client 172.213.0.120:37427] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "adkVyVzg-ZkZ0InWIP3Q-gAAAQ0"]
[Fri Apr 10 23:22:49.725874 2026] [:error] [pid 63134:tid 63137] [client 172.213.0.120:64807] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "adkVydFALqPDwWi6eJLGwwAAA8A"]
[Fri Apr 10 23:22:50.233714 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:64818] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/an.php"] [unique_id "adkVysWsSnfLoB8ifjC5lgAAAkE"]
[Fri Apr 10 23:22:50.708574 2026] [:error] [pid 13189:tid 13194] [client 172.213.0.120:64827] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "adkVypAxiJKPums3eBAFNAAAAEI"]
[Fri Apr 10 23:22:51.200691 2026] [:error] [pid 63062:tid 63065] [client 172.213.0.120:36166] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "adkVy52HtsmV85NqkMcOWQAAA4E"]
[Fri Apr 10 23:22:51.673007 2026] [:error] [pid 13101:tid 13150] [client 172.213.0.120:37393] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "adkVy98Ldw85818pj2obkQAAAJE"]
[Fri Apr 10 23:22:52.180026 2026] [:error] [pid 13101:tid 13133] [client 172.213.0.120:50175] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aboutc.php"] [unique_id "adkVzN8Ldw85818pj2obmwAAAIA"]
[Fri Apr 10 23:22:52.663425 2026] [:error] [pid 62769:tid 62791] [client 172.213.0.120:64787] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adkVzMWsSnfLoB8ifjC5qQAAAlQ"]
[Fri Apr 10 23:22:53.137955 2026] [:error] [pid 63134:tid 63144] [client 172.213.0.120:50134] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adkVzdFALqPDwWi6eJLGxgAAA8c"]
[Fri Apr 10 23:22:53.621058 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:36175] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adkVzcWsSnfLoB8ifjC5rgAAAk0"]
[Fri Apr 10 23:22:54.178910 2026] [:error] [pid 62819:tid 62822] [client 172.213.0.120:62270] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adkVzvU20EyPf7NlsleCrQAAAoA"]
[Fri Apr 10 23:22:54.665582 2026] [:error] [pid 13101:tid 13145] [client 172.213.0.120:64783] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "adkVzt8Ldw85818pj2obvQAAAIw"]
[Fri Apr 10 23:22:55.144059 2026] [:error] [pid 13101:tid 13154] [client 172.213.0.120:50473] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "adkVz98Ldw85818pj2obyAAAAJU"]
[Fri Apr 10 23:22:55.667760 2026] [:error] [pid 13189:tid 13206] [client 172.213.0.120:62276] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "adkVz5AxiJKPums3eBAFUwAAAE4"]
[Fri Apr 10 23:22:56.148842 2026] [:error] [pid 13189:tid 13198] [client 172.213.0.120:37434] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/first.php"] [unique_id "adkV0JAxiJKPums3eBAFWQAAAEY"]
[Fri Apr 10 23:22:56.615937 2026] [:error] [pid 62769:tid 62788] [client 172.213.0.120:32377] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redixsx.php"] [unique_id "adkV0MWsSnfLoB8ifjC5vAAAAlE"]
[Fri Apr 10 23:22:57.085270 2026] [:error] [pid 13189:tid 13211] [client 172.213.0.120:46637] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redixsx.php"] [unique_id "adkV0ZAxiJKPums3eBAFYwAAAFM"]
[Fri Apr 10 23:22:57.589386 2026] [:error] [pid 63134:tid 63140] [client 172.213.0.120:50127] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redixsx.php"] [unique_id "adkV0dFALqPDwWi6eJLGzQAAA8M"]
[Fri Apr 10 23:22:58.135179 2026] [:error] [pid 63134:tid 63145] [client 172.213.0.120:42627] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/redixsx.php"] [unique_id "adkV0tFALqPDwWi6eJLGzgAAA8g"]
[Fri Apr 10 23:22:58.742874 2026] [:error] [pid 13100:tid 13110] [client 172.213.0.120:42645] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cpp2.php"] [unique_id "adkV0lzg-ZkZ0InWIP3RAgAAAQU"]
[Fri Apr 10 23:22:59.245271 2026] [:error] [pid 13189:tid 13207] [client 172.213.0.120:42640] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cpp2.php"] [unique_id "adkV05AxiJKPums3eBAFfQAAAE8"]
[Fri Apr 10 23:22:59.817895 2026] [:error] [pid 13189:tid 13194] [client 172.213.0.120:36186] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cpp2.php"] [unique_id "adkV05AxiJKPums3eBAFggAAAEI"]
[Fri Apr 10 23:23:00.285003 2026] [:error] [pid 62710:tid 62733] [client 172.213.0.120:37406] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cpp2.php"] [unique_id "adkV1OME7qrf5xEWWJtDqAAAAhQ"]
[Fri Apr 10 23:23:00.780894 2026] [:error] [pid 62710:tid 62718] [client 172.213.0.120:50462] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admlo.php"] [unique_id "adkV1OME7qrf5xEWWJtDrQAAAgU"]
[Fri Apr 10 23:23:01.549329 2026] [:error] [pid 62769:tid 62785] [client 172.213.0.120:50448] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admlo.php"] [unique_id "adkV1cWsSnfLoB8ifjC5yAAAAk4"]
[Fri Apr 10 23:23:02.082996 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:42649] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admlo.php"] [unique_id "adkV1sWsSnfLoB8ifjC5yQAAAk8"]
[Fri Apr 10 23:23:02.587032 2026] [:error] [pid 63062:tid 63086] [client 172.213.0.120:42648] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admlo.php"] [unique_id "adkV1p2HtsmV85NqkMcOaQAAA5Y"]
[Fri Apr 10 23:23:03.173081 2026] [:error] [pid 13101:tid 13152] [client 172.213.0.120:50132] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "adkV198Ldw85818pj2ob-wAAAJM"]
[Fri Apr 10 23:23:03.654070 2026] [:error] [pid 13101:tid 13143] [client 172.213.0.120:36162] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "adkV198Ldw85818pj2ocBQAAAIo"]
[Fri Apr 10 23:23:04.137628 2026] [:error] [pid 63134:tid 63157] [client 172.213.0.120:62251] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "adkV2NFALqPDwWi6eJLG5wAAA9Q"]
[Fri Apr 10 23:23:04.635780 2026] [:error] [pid 13101:tid 13147] [client 172.213.0.120:50150] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-ajax.php"] [unique_id "adkV2N8Ldw85818pj2ocEgAAAI4"]
[Fri Apr 10 23:23:05.904037 2026] [:error] [pid 13189:tid 13211] [client 172.213.0.120:31812] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amthd.php"] [unique_id "adkV2ZAxiJKPums3eBAFowAAAFM"]
[Fri Apr 10 23:23:06.497118 2026] [:error] [pid 63134:tid 63159] [client 172.213.0.120:62246] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amthd.php"] [unique_id "adkV2tFALqPDwWi6eJLG7wAAA9Y"]
[Fri Apr 10 23:23:07.232338 2026] [:error] [pid 63134:tid 63146] [client 172.213.0.120:31861] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amthd.php"] [unique_id "adkV29FALqPDwWi6eJLG9AAAA8k"]
[Fri Apr 10 23:23:07.790607 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:37439] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amthd.php"] [unique_id "adkV28WsSnfLoB8ifjC53wAAAk8"]
[Fri Apr 10 23:23:08.323596 2026] [:error] [pid 62769:tid 62788] [client 172.213.0.120:42652] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "adkV3MWsSnfLoB8ifjC56wAAAlE"]
[Fri Apr 10 23:23:08.874693 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:36221] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "adkV3MWsSnfLoB8ifjC59AAAAk0"]
[Fri Apr 10 23:23:09.498571 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:50463] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "adkV3cWsSnfLoB8ifjC6AgAAAk8"]
[Fri Apr 10 23:23:10.012586 2026] [:error] [pid 62769:tid 62788] [client 172.213.0.120:50137] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8xyz.php"] [unique_id "adkV3sWsSnfLoB8ifjC6DAAAAlE"]
[Fri Apr 10 23:23:10.671619 2026] [:error] [pid 62769:tid 62775] [client 172.213.0.120:64804] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adkV3sWsSnfLoB8ifjC6EQAAAkQ"]
[Fri Apr 10 23:23:11.285307 2026] [:error] [pid 62710:tid 62714] [client 172.213.0.120:62249] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adkV3-ME7qrf5xEWWJtDwwAAAgE"]
[Fri Apr 10 23:23:11.802328 2026] [:error] [pid 62819:tid 62840] [client 172.213.0.120:37398] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adkV3_U20EyPf7NlsleC2QAAApI"]
[Fri Apr 10 23:23:12.295638 2026] [:error] [pid 13189:tid 13198] [client 172.213.0.120:36196] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adkV4JAxiJKPums3eBAFsQAAAEY"]
[Fri Apr 10 23:23:12.831163 2026] [:error] [pid 62819:tid 62837] [client 172.213.0.120:37417] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws68.php"] [unique_id "adkV4PU20EyPf7NlsleC2wAAAo8"]
[Fri Apr 10 23:23:13.311662 2026] [:error] [pid 63062:tid 63086] [client 172.213.0.120:36161] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws68.php"] [unique_id "adkV4Z2HtsmV85NqkMcOhgAAA5Y"]
[Fri Apr 10 23:23:13.797668 2026] [:error] [pid 62710:tid 62718] [client 172.213.0.120:36180] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws68.php"] [unique_id "adkV4eME7qrf5xEWWJtD1AAAAgU"]
[Fri Apr 10 23:23:14.290675 2026] [:error] [pid 62884:tid 62904] [client 172.213.0.120:64831] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws68.php"] [unique_id "adkV4uUCK1xrhnnmpo2ZcwAAAs0"]
[Fri Apr 10 23:23:14.789496 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:42632] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adkV4sWsSnfLoB8ifjC6PQAAAkc"]
[Fri Apr 10 23:23:15.251700 2026] [:error] [pid 62819:tid 62830] [client 172.213.0.120:62250] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adkV4_U20EyPf7NlsleC4AAAAog"]
[Fri Apr 10 23:23:15.713198 2026] [:error] [pid 62819:tid 62843] [client 172.213.0.120:50131] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adkV4_U20EyPf7NlsleC6QAAApU"]
[Fri Apr 10 23:23:16.200997 2026] [:error] [pid 62884:tid 62894] [client 172.213.0.120:42641] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adkV5OUCK1xrhnnmpo2ZewAAAsM"]
[Fri Apr 10 23:23:16.762502 2026] [:error] [pid 13100:tid 13117] [client 172.213.0.120:50125] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/njxjtooj.php"] [unique_id "adkV5Fzg-ZkZ0InWIP3RFQAAAQw"]
[Fri Apr 10 23:23:17.278736 2026] [:error] [pid 13101:tid 13135] [client 172.213.0.120:36167] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/njxjtooj.php"] [unique_id "adkV5d8Ldw85818pj2ocNgAAAII"]
[Fri Apr 10 23:23:17.821703 2026] [:error] [pid 62819:tid 62833] [client 172.213.0.120:64796] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/njxjtooj.php"] [unique_id "adkV5fU20EyPf7NlsleC_AAAAos"]
[Fri Apr 10 23:23:18.384605 2026] [:error] [pid 13189:tid 13203] [client 172.213.0.120:37423] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/njxjtooj.php"] [unique_id "adkV5pAxiJKPums3eBAFuAAAAEs"]
[Fri Apr 10 23:23:18.859314 2026] [:error] [pid 13101:tid 13145] [client 172.213.0.120:62208] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "adkV5t8Ldw85818pj2ocPwAAAIw"]
[Fri Apr 10 23:23:19.327622 2026] [:error] [pid 13101:tid 13148] [client 172.213.0.120:42664] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "adkV598Ldw85818pj2ocQwAAAI8"]
[Fri Apr 10 23:23:19.849872 2026] [:error] [pid 13100:tid 13106] [client 172.213.0.120:42684] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "adkV51zg-ZkZ0InWIP3RGAAAAQE"]
[Fri Apr 10 23:23:20.351650 2026] [:error] [pid 62710:tid 62733] [client 172.213.0.120:50152] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws85.php"] [unique_id "adkV6OME7qrf5xEWWJtD7QAAAhQ"]
[Fri Apr 10 23:23:20.818749 2026] [:error] [pid 63134:tid 63141] [client 172.213.0.120:62273] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "adkV6NFALqPDwWi6eJLHGwAAA8Q"]
[Fri Apr 10 23:23:21.427048 2026] [:error] [pid 63134:tid 63160] [client 172.213.0.120:50450] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "adkV6dFALqPDwWi6eJLHIgAAA9c"]
[Fri Apr 10 23:23:22.029542 2026] [:error] [pid 62710:tid 62737] [client 172.213.0.120:64808] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "adkV6uME7qrf5xEWWJtD8gAAAhg"]
[Fri Apr 10 23:23:22.505897 2026] [:error] [pid 63134:tid 63159] [client 172.213.0.120:46626] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws61.php"] [unique_id "adkV6tFALqPDwWi6eJLHMgAAA9Y"]
[Fri Apr 10 23:23:23.120804 2026] [:error] [pid 63134:tid 63149] [client 172.213.0.120:62322] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iyy.php"] [unique_id "adkV69FALqPDwWi6eJLHQQAAA8w"]
[Fri Apr 10 23:23:23.590471 2026] [:error] [pid 13101:tid 13156] [client 172.213.0.120:42646] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iyy.php"] [unique_id "adkV698Ldw85818pj2ocTgAAAJc"]
[Fri Apr 10 23:23:24.237301 2026] [:error] [pid 13189:tid 13201] [client 172.213.0.120:64794] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iyy.php"] [unique_id "adkV7JAxiJKPums3eBAFzgAAAEk"]
[Fri Apr 10 23:23:24.785102 2026] [:error] [pid 13189:tid 13194] [client 172.213.0.120:36177] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iyy.php"] [unique_id "adkV7JAxiJKPums3eBAF0gAAAEI"]
[Fri Apr 10 23:23:25.262907 2026] [:error] [pid 13100:tid 13114] [client 172.213.0.120:50139] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/900.php"] [unique_id "adkV7Vzg-ZkZ0InWIP3RIQAAAQk"]
[Fri Apr 10 23:23:25.837611 2026] [:error] [pid 13101:tid 13148] [client 172.213.0.120:50143] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/900.php"] [unique_id "adkV7d8Ldw85818pj2ocWwAAAI8"]
[Fri Apr 10 23:23:26.456376 2026] [:error] [pid 62769:tid 62777] [client 172.213.0.120:36172] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/900.php"] [unique_id "adkV7sWsSnfLoB8ifjC6dQAAAkY"]
[Fri Apr 10 23:23:27.076920 2026] [:error] [pid 13189:tid 13204] [client 172.213.0.120:50489] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/900.php"] [unique_id "adkV75AxiJKPums3eBAF3gAAAEw"]
[Fri Apr 10 23:23:27.631642 2026] [:error] [pid 13101:tid 13135] [client 172.213.0.120:62272] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blsvgeyaza.php"] [unique_id "adkV798Ldw85818pj2ocYwAAAII"]
[Fri Apr 10 23:23:28.109504 2026] [:error] [pid 62769:tid 62774] [client 172.213.0.120:36205] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blsvgeyaza.php"] [unique_id "adkV8MWsSnfLoB8ifjC6jQAAAkM"]
[Fri Apr 10 23:23:28.629194 2026] [:error] [pid 62651:tid 62664] [client 172.213.0.120:36202] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blsvgeyaza.php"] [unique_id "adkV8DbAH0le57SIaqw4DQAAAcs"]
[Fri Apr 10 23:23:29.125145 2026] [:error] [pid 62819:tid 62843] [client 172.213.0.120:50163] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blsvgeyaza.php"] [unique_id "adkV8fU20EyPf7NlsleDDQAAApU"]
[Fri Apr 10 23:23:29.712773 2026] [:error] [pid 13101:tid 13153] [client 172.213.0.120:62227] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gqhyti.php"] [unique_id "adkV8d8Ldw85818pj2ocZwAAAJQ"]
[Fri Apr 10 23:23:30.178613 2026] [:error] [pid 62819:tid 62822] [client 172.213.0.120:64790] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gqhyti.php"] [unique_id "adkV8vU20EyPf7NlsleDEAAAAoA"]
[Fri Apr 10 23:23:30.684038 2026] [:error] [pid 62769:tid 62785] [client 172.213.0.120:42625] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gqhyti.php"] [unique_id "adkV8sWsSnfLoB8ifjC6xgAAAk4"]
[Fri Apr 10 23:23:31.334512 2026] [:error] [pid 13189:tid 13196] [client 172.213.0.120:46596] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gqhyti.php"] [unique_id "adkV85AxiJKPums3eBAF7gAAAEQ"]
[Fri Apr 10 23:23:31.868328 2026] [:error] [pid 13189:tid 13198] [client 172.213.0.120:42637] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoxxi.php"] [unique_id "adkV85AxiJKPums3eBAF9wAAAEY"]
[Fri Apr 10 23:23:32.347979 2026] [:error] [pid 62819:tid 62838] [client 172.213.0.120:42657] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoxxi.php"] [unique_id "adkV9PU20EyPf7NlsleDEwAAApA"]
[Fri Apr 10 23:23:32.846813 2026] [:error] [pid 62769:tid 62783] [client 172.213.0.120:50476] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoxxi.php"] [unique_id "adkV9MWsSnfLoB8ifjC64wAAAkw"]
[Fri Apr 10 23:23:33.316639 2026] [:error] [pid 62819:tid 62839] [client 172.213.0.120:62261] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/autoxxi.php"] [unique_id "adkV9fU20EyPf7NlsleDHgAAApE"]
[Fri Apr 10 23:23:33.853695 2026] [:error] [pid 13189:tid 13216] [client 172.213.0.120:64786] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1144452145_error_log.php"] [unique_id "adkV9ZAxiJKPums3eBAGBAAAAFg"]
[Fri Apr 10 23:23:34.406553 2026] [:error] [pid 62710:tid 62737] [client 172.213.0.120:42637] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1144452145_error_log.php"] [unique_id "adkV9uME7qrf5xEWWJtEAQAAAhg"]
[Fri Apr 10 23:23:34.907070 2026] [:error] [pid 62710:tid 62730] [client 172.213.0.120:42659] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1144452145_error_log.php"] [unique_id "adkV9uME7qrf5xEWWJtEBgAAAhE"]
[Fri Apr 10 23:23:35.460112 2026] [:error] [pid 13189:tid 13204] [client 172.213.0.120:50454] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1144452145_error_log.php"] [unique_id "adkV95AxiJKPums3eBAGDAAAAEw"]
[Fri Apr 10 23:23:35.964374 2026] [:error] [pid 62769:tid 62790] [client 172.213.0.120:46597] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws48.php"] [unique_id "adkV98WsSnfLoB8ifjC7AAAAAlM"]
[Fri Apr 10 23:23:36.515865 2026] [:error] [pid 62819:tid 62823] [client 172.213.0.120:42624] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws48.php"] [unique_id "adkV-PU20EyPf7NlsleDIwAAAoE"]
[Fri Apr 10 23:23:36.989523 2026] [:error] [pid 62819:tid 62842] [client 172.213.0.120:64789] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws48.php"] [unique_id "adkV-PU20EyPf7NlsleDJgAAApQ"]
[Fri Apr 10 23:23:37.460837 2026] [:error] [pid 13189:tid 13201] [client 172.213.0.120:50481] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws48.php"] [unique_id "adkV-ZAxiJKPums3eBAGGAAAAEk"]
[Fri Apr 10 23:23:37.922138 2026] [:error] [pid 13189:tid 13209] [client 172.213.0.120:32382] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "adkV-ZAxiJKPums3eBAGHwAAAFE"]
[Fri Apr 10 23:23:38.393605 2026] [:error] [pid 62710:tid 62730] [client 172.213.0.120:62320] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "adkV-uME7qrf5xEWWJtEGgAAAhE"]
[Fri Apr 10 23:23:38.881780 2026] [:error] [pid 63062:tid 63069] [client 172.213.0.120:46642] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "adkV-p2HtsmV85NqkMcOogAAA4U"]
[Fri Apr 10 23:23:39.395957 2026] [:error] [pid 13189:tid 13195] [client 172.213.0.120:50151] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "adkV-5AxiJKPums3eBAGLQAAAEM"]
[Fri Apr 10 23:23:39.880204 2026] [:error] [pid 62769:tid 62781] [client 172.213.0.120:37385] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/schallfuns.php"] [unique_id "adkV-8WsSnfLoB8ifjC7IwAAAko"]
[Fri Apr 10 23:23:40.357161 2026] [:error] [pid 13101:tid 13156] [client 172.213.0.120:62234] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/schallfuns.php"] [unique_id "adkV_N8Ldw85818pj2ocfwAAAJc"]
[Fri Apr 10 23:23:40.834639 2026] [:error] [pid 13101:tid 13155] [client 172.213.0.120:62268] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/schallfuns.php"] [unique_id "adkV_N8Ldw85818pj2ochgAAAJY"]
[Fri Apr 10 23:23:41.303562 2026] [:error] [pid 62710:tid 62724] [client 172.213.0.120:37389] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/schallfuns.php"] [unique_id "adkV_eME7qrf5xEWWJtEIwAAAgs"]
[Fri Apr 10 23:23:41.781387 2026] [:error] [pid 13189:tid 13216] [client 172.213.0.120:62258] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adkV_ZAxiJKPums3eBAGOwAAAFg"]
[Fri Apr 10 23:23:42.256606 2026] [:error] [pid 63062:tid 63068] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Fri Apr 10 23:23:42.489760 2026] [:error] [pid 63062:tid 63087] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/clasa99.php
[Fri Apr 10 23:23:42.725023 2026] [:error] [pid 63062:tid 63066] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/myfilexxx.php
[Fri Apr 10 23:23:42.957386 2026] [:error] [pid 63062:tid 63070] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/karma_144a.php
[Fri Apr 10 23:23:43.189997 2026] [:error] [pid 63062:tid 63080] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/3586 b64.php
[Fri Apr 10 23:23:43.433742 2026] [:error] [pid 63062:tid 63072] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Fri Apr 10 23:23:43.664710 2026] [:error] [pid 63062:tid 63084] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/bmi.php
[Fri Apr 10 23:23:43.907296 2026] [:error] [pid 63062:tid 63073] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/bypltspd.php
[Fri Apr 10 23:23:44.140515 2026] [:error] [pid 63062:tid 63079] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Apr 10 23:23:44.374035 2026] [:error] [pid 63062:tid 63085] [client 172.213.0.120:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Fri Apr 10 23:23:44.842779 2026] [:error] [pid 63062:tid 63065] [client 172.213.0.120:46613] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws82.php"] [unique_id "adkWAJ2HtsmV85NqkMcOugAAA4E"]
[Fri Apr 10 23:23:45.315965 2026] [:error] [pid 13189:tid 13206] [client 172.213.0.120:42647] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws82.php"] [unique_id "adkWAZAxiJKPums3eBAGWAAAAE4"]
[Fri Apr 10 23:23:45.784148 2026] [:error] [pid 63062:tid 63068] [client 172.213.0.120:64794] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws82.php"] [unique_id "adkWAZ2HtsmV85NqkMcOvAAAA4Q"]
[Fri Apr 10 23:23:46.373010 2026] [:error] [pid 62884:tid 62915] [client 172.213.0.120:32326] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws82.php"] [unique_id "adkWAuUCK1xrhnnmpo2ZuQAAAtg"]
[Fri Apr 10 23:23:46.911426 2026] [:error] [pid 13189:tid 13210] [client 172.213.0.120:62308] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "adkWApAxiJKPums3eBAGZAAAAFI"]
[Fri Apr 10 23:23:47.420530 2026] [:error] [pid 62819:tid 62826] [client 172.213.0.120:42634] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "adkWA_U20EyPf7NlsleDOAAAAoQ"]
[Fri Apr 10 23:23:47.897363 2026] [:error] [pid 63134:tid 63138] [client 172.213.0.120:50434] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "adkWA9FALqPDwWi6eJLHeAAAA8E"]
[Fri Apr 10 23:23:48.396294 2026] [:error] [pid 63062:tid 63073] [client 172.213.0.120:36160] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new.php"] [unique_id "adkWBJ2HtsmV85NqkMcOxQAAA4k"]
[Fri Apr 10 23:23:48.896914 2026] [:error] [pid 62651:tid 62670] [client 172.213.0.120:42675] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/press.php"] [unique_id "adkWBDbAH0le57SIaqw4NgAAAdE"]
[Fri Apr 10 23:23:49.430519 2026] [:error] [pid 13100:tid 13127] [client 172.213.0.120:46635] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/press.php"] [unique_id "adkWBVzg-ZkZ0InWIP3ROgAAARY"]
[Fri Apr 10 23:23:49.908046 2026] [:error] [pid 63062:tid 63074] [client 172.213.0.120:50457] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/press.php"] [unique_id "adkWBZ2HtsmV85NqkMcOywAAA4o"]
[Fri Apr 10 23:23:50.372445 2026] [:error] [pid 63134:tid 63158] [client 172.213.0.120:64792] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/press.php"] [unique_id "adkWBtFALqPDwWi6eJLHegAAA9U"]
[Fri Apr 10 23:23:50.865671 2026] [:error] [pid 63062:tid 63087] [client 172.213.0.120:36214] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adkWBp2HtsmV85NqkMcO0QAAA5c"]
[Fri Apr 10 23:23:51.340377 2026] [:error] [pid 13100:tid 13110] [client 172.213.0.120:64768] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adkWB1zg-ZkZ0InWIP3RRAAAAQU"]
[Fri Apr 10 23:23:51.807607 2026] [:error] [pid 13101:tid 13145] [client 172.213.0.120:36216] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adkWB98Ldw85818pj2ocsgAAAIw"]
[Fri Apr 10 23:23:52.334823 2026] [:error] [pid 13189:tid 13210] [client 172.213.0.120:46627] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adkWCJAxiJKPums3eBAGggAAAFI"]
[Fri Apr 10 23:23:52.832935 2026] [:error] [pid 13189:tid 13213] [client 172.213.0.120:50447] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adkWCJAxiJKPums3eBAGhQAAAFU"]
[Fri Apr 10 23:23:53.303436 2026] [:error] [pid 62710:tid 62735] [client 172.213.0.120:42666] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adkWCeME7qrf5xEWWJtERgAAAhY"]
[Fri Apr 10 23:23:53.770916 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:62289] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adkWCcWsSnfLoB8ifjC7UgAAAkc"]
[Fri Apr 10 23:23:54.246122 2026] [:error] [pid 13101:tid 13142] [client 172.213.0.120:62329] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adkWCt8Ldw85818pj2octwAAAIk"]
[Fri Apr 10 23:23:54.739039 2026] [:error] [pid 62710:tid 62728] [client 172.213.0.120:64828] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws57.php"] [unique_id "adkWCuME7qrf5xEWWJtETAAAAg8"]
[Fri Apr 10 23:23:55.208669 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:36194] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws57.php"] [unique_id "adkWC8WsSnfLoB8ifjC7YgAAAkc"]
[Fri Apr 10 23:23:55.684411 2026] [:error] [pid 13101:tid 13149] [client 172.213.0.120:37401] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws57.php"] [unique_id "adkWC98Ldw85818pj2ocvwAAAJA"]
[Fri Apr 10 23:23:56.171064 2026] [:error] [pid 13189:tid 13200] [client 172.213.0.120:64824] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws57.php"] [unique_id "adkWDJAxiJKPums3eBAGlQAAAEg"]
[Fri Apr 10 23:23:56.641077 2026] [:error] [pid 62710:tid 62733] [client 172.213.0.120:46636] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.qiodetme.php"] [unique_id "adkWDOME7qrf5xEWWJtEZwAAAhQ"]
[Fri Apr 10 23:23:57.136852 2026] [:error] [pid 13189:tid 13201] [client 172.213.0.120:42680] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.qiodetme.php"] [unique_id "adkWDZAxiJKPums3eBAGmAAAAEk"]
[Fri Apr 10 23:23:57.645675 2026] [:error] [pid 13189:tid 13216] [client 172.213.0.120:42654] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.qiodetme.php"] [unique_id "adkWDZAxiJKPums3eBAGngAAAFg"]
[Fri Apr 10 23:23:58.213012 2026] [:error] [pid 62769:tid 62790] [client 172.213.0.120:50156] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.qiodetme.php"] [unique_id "adkWDsWsSnfLoB8ifjC7agAAAlM"]
[Fri Apr 10 23:23:58.689586 2026] [:error] [pid 63062:tid 63087] [client 172.213.0.120:36212] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sodas.php"] [unique_id "adkWDp2HtsmV85NqkMcO2gAAA5c"]
[Fri Apr 10 23:23:59.154059 2026] [:error] [pid 13101:tid 13137] [client 172.213.0.120:50453] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sodas.php"] [unique_id "adkWD98Ldw85818pj2ocxwAAAIQ"]
[Fri Apr 10 23:23:59.666703 2026] [:error] [pid 62651:tid 62672] [client 172.213.0.120:36189] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sodas.php"] [unique_id "adkWDzbAH0le57SIaqw4RAAAAdM"]
[Fri Apr 10 23:24:00.146901 2026] [:error] [pid 62651:tid 62664] [client 172.213.0.120:42668] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sodas.php"] [unique_id "adkWEDbAH0le57SIaqw4RwAAAcs"]
[Fri Apr 10 23:24:00.640230 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:64822] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yw5bi63u.php"] [unique_id "adkWEMWsSnfLoB8ifjC7cgAAAk0"]
[Fri Apr 10 23:24:01.115077 2026] [:error] [pid 62769:tid 62780] [client 172.213.0.120:36222] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yw5bi63u.php"] [unique_id "adkWEcWsSnfLoB8ifjC7dQAAAkk"]
[Fri Apr 10 23:24:01.631849 2026] [:error] [pid 13189:tid 13209] [client 172.213.0.120:46647] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yw5bi63u.php"] [unique_id "adkWEZAxiJKPums3eBAGrAAAAFE"]
[Fri Apr 10 23:24:02.099449 2026] [:error] [pid 13189:tid 13206] [client 172.213.0.120:42639] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/yw5bi63u.php"] [unique_id "adkWEpAxiJKPums3eBAGsQAAAE4"]
[Fri Apr 10 23:24:02.562117 2026] [:error] [pid 62769:tid 62795] [client 172.213.0.120:64811] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "adkWEsWsSnfLoB8ifjC7egAAAlg"]
[Fri Apr 10 23:24:03.037395 2026] [:error] [pid 62819:tid 62841] [client 172.213.0.120:36183] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "adkWE_U20EyPf7NlsleDXQAAApM"]
[Fri Apr 10 23:24:03.529563 2026] [:error] [pid 13189:tid 13199] [client 172.213.0.120:62294] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "adkWE5AxiJKPums3eBAGtgAAAEc"]
[Fri Apr 10 23:24:03.992292 2026] [:error] [pid 62884:tid 62905] [client 172.213.0.120:36213] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws81.php"] [unique_id "adkWE-UCK1xrhnnmpo2Z2wAAAs4"]
[Fri Apr 10 23:24:04.498028 2026] [:error] [pid 13100:tid 13118] [client 172.213.0.120:32345] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "adkWFFzg-ZkZ0InWIP3RVQAAAQ0"]
[Fri Apr 10 23:24:04.998130 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:42628] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "adkWFMWsSnfLoB8ifjC7iwAAAk0"]
[Fri Apr 10 23:24:05.467307 2026] [:error] [pid 62710:tid 62727] [client 172.213.0.120:31856] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "adkWFeME7qrf5xEWWJtEhQAAAg4"]
[Fri Apr 10 23:24:05.936932 2026] [:error] [pid 62884:tid 62907] [client 172.213.0.120:36197] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mh.php"] [unique_id "adkWFeUCK1xrhnnmpo2Z4wAAAtA"]
[Fri Apr 10 23:24:06.429965 2026] [:error] [pid 62769:tid 62781] [client 172.213.0.120:50441] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adkWFsWsSnfLoB8ifjC7mAAAAko"]
[Fri Apr 10 23:24:06.894371 2026] [:error] [pid 62769:tid 62791] [client 172.213.0.120:36163] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adkWFsWsSnfLoB8ifjC7owAAAlQ"]
[Fri Apr 10 23:24:07.366703 2026] [:error] [pid 13101:tid 13157] [client 172.213.0.120:36220] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adkWF98Ldw85818pj2oc4QAAAJg"]
[Fri Apr 10 23:24:07.848154 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:37430] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adkWF8WsSnfLoB8ifjC7tQAAAk0"]
[Fri Apr 10 23:24:08.318873 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:50119] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "adkWGMWsSnfLoB8ifjC7vQAAAkc"]
[Fri Apr 10 23:24:08.849027 2026] [:error] [pid 62710:tid 62722] [client 172.213.0.120:50171] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "adkWGOME7qrf5xEWWJtEkQAAAgk"]
[Fri Apr 10 23:24:09.350129 2026] [:error] [pid 62769:tid 62777] [client 172.213.0.120:50483] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "adkWGcWsSnfLoB8ifjC7xQAAAkY"]
[Fri Apr 10 23:24:09.829176 2026] [:error] [pid 13101:tid 13133] [client 172.213.0.120:37432] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws86.php"] [unique_id "adkWGd8Ldw85818pj2oc7QAAAIA"]
[Fri Apr 10 23:24:10.287723 2026] [:error] [pid 62769:tid 62794] [client 172.213.0.120:50480] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "adkWGsWsSnfLoB8ifjC70AAAAlc"]
[Fri Apr 10 23:24:10.759501 2026] [:error] [pid 13189:tid 13212] [client 172.213.0.120:32351] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "adkWGpAxiJKPums3eBAG1AAAAFQ"]
[Fri Apr 10 23:24:11.221502 2026] [:error] [pid 13189:tid 13216] [client 172.213.0.120:36198] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "adkWG5AxiJKPums3eBAG2gAAAFg"]
[Fri Apr 10 23:24:11.682794 2026] [:error] [pid 62710:tid 62722] [client 172.213.0.120:46634] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vx.php"] [unique_id "adkWG-ME7qrf5xEWWJtEnAAAAgk"]
[Fri Apr 10 23:24:12.147367 2026] [:error] [pid 63062:tid 63071] [client 172.213.0.120:64809] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adkWHJ2HtsmV85NqkMcPBgAAA4c"]
[Fri Apr 10 23:24:12.624531 2026] [:error] [pid 63062:tid 63068] [client 172.213.0.120:46641] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adkWHJ2HtsmV85NqkMcPDAAAA4Q"]
[Fri Apr 10 23:24:13.089849 2026] [:error] [pid 13101:tid 13139] [client 172.213.0.120:62331] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adkWHd8Ldw85818pj2oc8wAAAIY"]
[Fri Apr 10 23:24:13.562273 2026] [:error] [pid 62884:tid 62910] [client 172.213.0.120:46651] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dass.php"] [unique_id "adkWHeUCK1xrhnnmpo2Z7wAAAtM"]
[Fri Apr 10 23:24:14.039480 2026] [:error] [pid 13189:tid 13210] [client 172.213.0.120:31824] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adkWHpAxiJKPums3eBAG3gAAAFI"]
[Fri Apr 10 23:24:14.509772 2026] [:error] [pid 13101:tid 13150] [client 172.213.0.120:32320] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adkWHt8Ldw85818pj2oc-gAAAJE"]
[Fri Apr 10 23:24:15.012368 2026] [:error] [pid 13101:tid 13141] [client 172.213.0.120:36176] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adkWH98Ldw85818pj2odAwAAAIg"]
[Fri Apr 10 23:24:15.488572 2026] [:error] [pid 62884:tid 62901] [client 172.213.0.120:64814] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adkWH-UCK1xrhnnmpo2Z9QAAAso"]
[Fri Apr 10 23:24:15.952216 2026] [:error] [pid 63062:tid 63083] [client 172.213.0.120:36192] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adkWH52HtsmV85NqkMcPEwAAA5M"]
[Fri Apr 10 23:24:16.429013 2026] [:error] [pid 63134:tid 63146] [client 172.213.0.120:37382] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adkWINFALqPDwWi6eJLHqQAAA8k"]
[Fri Apr 10 23:24:16.901838 2026] [:error] [pid 13189:tid 13194] [client 172.213.0.120:32325] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adkWIJAxiJKPums3eBAG6QAAAEI"]
[Fri Apr 10 23:24:17.382809 2026] [:error] [pid 62769:tid 62791] [client 172.213.0.120:42638] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adkWIcWsSnfLoB8ifjC76wAAAlQ"]
[Fri Apr 10 23:24:17.849084 2026] [:error] [pid 62769:tid 62784] [client 172.213.0.120:36215] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws83.php"] [unique_id "adkWIcWsSnfLoB8ifjC79gAAAk0"]
[Fri Apr 10 23:24:18.329997 2026] [:error] [pid 62710:tid 62732] [client 172.213.0.120:62103] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws83.php"] [unique_id "adkWIuME7qrf5xEWWJtEsQAAAhM"]
[Fri Apr 10 23:24:18.820315 2026] [:error] [pid 13189:tid 13196] [client 172.213.0.120:50439] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws83.php"] [unique_id "adkWIpAxiJKPums3eBAG7gAAAEQ"]
[Fri Apr 10 23:24:19.284916 2026] [:error] [pid 62710:tid 62727] [client 172.213.0.120:36208] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws83.php"] [unique_id "adkWI-ME7qrf5xEWWJtEvwAAAg4"]
[Fri Apr 10 23:24:19.766508 2026] [:error] [pid 62710:tid 62724] [client 172.213.0.120:62087] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "adkWI-ME7qrf5xEWWJtExAAAAgs"]
[Fri Apr 10 23:24:20.232665 2026] [:error] [pid 13189:tid 13197] [client 172.213.0.120:64793] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "adkWJJAxiJKPums3eBAG7wAAAEU"]
[Fri Apr 10 23:24:20.698792 2026] [:error] [pid 63134:tid 63157] [client 172.213.0.120:50493] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "adkWJNFALqPDwWi6eJLHuAAAA9Q"]
[Fri Apr 10 23:24:21.169939 2026] [:error] [pid 13100:tid 13117] [client 172.213.0.120:50122] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws75.php"] [unique_id "adkWJVzg-ZkZ0InWIP3RZQAAAQw"]
[Fri Apr 10 23:24:21.642118 2026] [:error] [pid 13189:tid 13210] [client 172.213.0.120:31829] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adkWJZAxiJKPums3eBAG9wAAAFI"]
[Fri Apr 10 23:24:22.118946 2026] [:error] [pid 13189:tid 13212] [client 172.213.0.120:64769] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adkWJpAxiJKPums3eBAHAAAAAFQ"]
[Fri Apr 10 23:24:22.592710 2026] [:error] [pid 13189:tid 13201] [client 172.213.0.120:62265] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adkWJpAxiJKPums3eBAHBwAAAEk"]
[Fri Apr 10 23:24:23.060899 2026] [:error] [pid 13189:tid 13192] [client 172.213.0.120:37404] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adkWJ5AxiJKPums3eBAHDgAAAEA"]
[Fri Apr 10 23:24:23.519341 2026] [:error] [pid 13189:tid 13200] [client 172.213.0.120:64819] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "adkWJ5AxiJKPums3eBAHGgAAAEg"]
[Fri Apr 10 23:24:23.980961 2026] [:error] [pid 63134:tid 63138] [client 172.213.0.120:31813] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "adkWJ9FALqPDwWi6eJLHwQAAA8E"]
[Fri Apr 10 23:24:24.446875 2026] [:error] [pid 13101:tid 13149] [client 172.213.0.120:46625] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "adkWKN8Ldw85818pj2odFwAAAJA"]
[Fri Apr 10 23:24:24.912365 2026] [:error] [pid 13189:tid 13204] [client 172.213.0.120:50138] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/abc.php"] [unique_id "adkWKJAxiJKPums3eBAHJAAAAEw"]
[Fri Apr 10 23:24:25.378398 2026] [:error] [pid 13101:tid 13157] [client 172.213.0.120:42662] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adkWKd8Ldw85818pj2odGgAAAJg"]
[Fri Apr 10 23:24:25.855826 2026] [:error] [pid 13101:tid 13134] [client 172.213.0.120:64784] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adkWKd8Ldw85818pj2odHQAAAIE"]
[Fri Apr 10 23:24:26.327654 2026] [:error] [pid 62769:tid 62773] [client 172.213.0.120:50124] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adkWKsWsSnfLoB8ifjC8IgAAAkI"]
[Fri Apr 10 23:24:26.815352 2026] [:error] [pid 63134:tid 63156] [client 172.213.0.120:62260] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adkWKtFALqPDwWi6eJLHyAAAA9M"]
[Fri Apr 10 23:24:27.280443 2026] [:error] [pid 13100:tid 13121] [client 172.213.0.120:37426] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adkWK1zg-ZkZ0InWIP3RbwAAARA"]
[Fri Apr 10 23:24:27.752040 2026] [:error] [pid 62769:tid 62775] [client 172.213.0.120:50135] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adkWK8WsSnfLoB8ifjC8KAAAAkQ"]
[Fri Apr 10 23:24:28.251484 2026] [:error] [pid 13100:tid 13125] [client 172.213.0.120:46606] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adkWLFzg-ZkZ0InWIP3RdwAAARQ"]
[Fri Apr 10 23:24:28.717515 2026] [:error] [pid 13189:tid 13209] [client 172.213.0.120:36185] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adkWLJAxiJKPums3eBAHMgAAAFE"]
[Fri Apr 10 23:24:29.191128 2026] [:error] [pid 13189:tid 13215] [client 172.213.0.120:62330] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "adkWLZAxiJKPums3eBAHOQAAAFc"]
[Fri Apr 10 23:24:29.651767 2026] [:error] [pid 13189:tid 13212] [client 172.213.0.120:62236] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "adkWLZAxiJKPums3eBAHPAAAAFQ"]
[Fri Apr 10 23:24:30.122917 2026] [:error] [pid 62651:tid 62667] [client 172.213.0.120:37384] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "adkWLjbAH0le57SIaqw4bQAAAc4"]
[Fri Apr 10 23:24:30.602664 2026] [:error] [pid 13101:tid 13148] [client 172.213.0.120:46631] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp9.php"] [unique_id "adkWLt8Ldw85818pj2odKwAAAI8"]
[Fri Apr 10 23:24:31.061365 2026] [:error] [pid 62769:tid 62782] [client 172.213.0.120:62226] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "adkWL8WsSnfLoB8ifjC8PAAAAks"]
[Fri Apr 10 23:24:31.555791 2026] [:error] [pid 62769:tid 62775] [client 172.213.0.120:62318] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "adkWL8WsSnfLoB8ifjC8RgAAAkQ"]
[Fri Apr 10 23:24:32.060080 2026] [:error] [pid 62710:tid 62724] [client 172.213.0.120:42679] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "adkWMOME7qrf5xEWWJtFAgAAAgs"]
[Fri Apr 10 23:24:32.536823 2026] [:error] [pid 13101:tid 13134] [client 172.213.0.120:64782] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/vx.php"] [unique_id "adkWMN8Ldw85818pj2odLAAAAIE"]
[Fri Apr 10 23:24:33.015471 2026] [:error] [pid 13101:tid 13137] [client 172.213.0.120:64776] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adkWMd8Ldw85818pj2odLQAAAIQ"]
[Fri Apr 10 23:24:33.482430 2026] [:error] [pid 63062:tid 63078] [client 172.213.0.120:37429] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adkWMZ2HtsmV85NqkMcPMQAAA44"]
[Fri Apr 10 23:24:33.944399 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:42644] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adkWMcWsSnfLoB8ifjC8bQAAAkE"]
[Fri Apr 10 23:24:34.426308 2026] [:error] [pid 62769:tid 62790] [client 172.213.0.120:31816] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inege.php"] [unique_id "adkWMsWsSnfLoB8ifjC8dAAAAlM"]
[Fri Apr 10 23:24:34.892636 2026] [:error] [pid 63134:tid 63152] [client 172.213.0.120:50442] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWMtFALqPDwWi6eJLH0wAAA88"]
[Fri Apr 10 23:24:35.357702 2026] [:error] [pid 62819:tid 62822] [client 172.213.0.120:37409] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWM_U20EyPf7NlsleDggAAAoA"]
[Fri Apr 10 23:24:35.854393 2026] [:error] [pid 62710:tid 62722] [client 172.213.0.120:50158] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWM-ME7qrf5xEWWJtFGAAAAgk"]
[Fri Apr 10 23:24:36.378288 2026] [:error] [pid 62769:tid 62793] [client 172.213.0.120:62333] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWNMWsSnfLoB8ifjC8hAAAAlY"]
[Fri Apr 10 23:24:36.846815 2026] [:error] [pid 62769:tid 62774] [client 172.213.0.120:31831] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "adkWNMWsSnfLoB8ifjC8jwAAAkM"]
[Fri Apr 10 23:24:37.394065 2026] [:error] [pid 62769:tid 62774] [client 172.213.0.120:31833] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "adkWNcWsSnfLoB8ifjC8ngAAAkM"]
[Fri Apr 10 23:24:37.874929 2026] [:error] [pid 62769:tid 62781] [client 172.213.0.120:62328] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "adkWNcWsSnfLoB8ifjC8qAAAAko"]
[Fri Apr 10 23:24:38.348444 2026] [:error] [pid 62884:tid 62903] [client 172.213.0.120:62237] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/t.php"] [unique_id "adkWNuUCK1xrhnnmpo2aDgAAAsw"]
[Fri Apr 10 23:24:38.816763 2026] [:error] [pid 62769:tid 62793] [client 172.213.0.120:32342] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adkWNsWsSnfLoB8ifjC8tQAAAlY"]
[Fri Apr 10 23:24:39.287761 2026] [:error] [pid 62769:tid 62771] [client 172.213.0.120:64778] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adkWN8WsSnfLoB8ifjC8tgAAAkA"]
[Fri Apr 10 23:24:39.818900 2026] [:error] [pid 62769:tid 62786] [client 172.213.0.120:62295] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adkWN8WsSnfLoB8ifjC8wQAAAk8"]
[Fri Apr 10 23:24:40.381048 2026] [:error] [pid 13189:tid 13207] [client 172.213.0.120:62334] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adkWOJAxiJKPums3eBAHTQAAAE8"]
[Fri Apr 10 23:24:40.852392 2026] [:error] [pid 13189:tid 13213] [client 172.213.0.120:42626] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "adkWOJAxiJKPums3eBAHUQAAAFU"]
[Fri Apr 10 23:24:41.328205 2026] [:error] [pid 62769:tid 62787] [client 172.213.0.120:46645] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "adkWOcWsSnfLoB8ifjC80wAAAlA"]
[Fri Apr 10 23:24:41.864151 2026] [:error] [pid 63134:tid 63154] [client 172.213.0.120:46609] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "adkWOdFALqPDwWi6eJLH2gAAA9E"]
[Fri Apr 10 23:24:42.520199 2026] [:error] [pid 13101:tid 13149] [client 172.213.0.120:36181] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/ws49.php"] [unique_id "adkWOt8Ldw85818pj2odXAAAAJA"]
[Fri Apr 10 23:24:42.989771 2026] [:error] [pid 13101:tid 13138] [client 172.213.0.120:46601] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adkWOt8Ldw85818pj2odYwAAAIU"]
[Fri Apr 10 23:24:43.472335 2026] [:error] [pid 13101:tid 13151] [client 172.213.0.120:64801] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adkWO98Ldw85818pj2odbAAAAJI"]
[Fri Apr 10 23:24:43.941992 2026] [:error] [pid 13101:tid 13135] [client 172.213.0.120:53234] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adkWO98Ldw85818pj2odcwAAAII"]
[Fri Apr 10 23:24:44.601270 2026] [:error] [pid 63134:tid 63149] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Apr 10 23:24:45.213024 2026] [:error] [pid 63134:tid 63141] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Apr 10 23:24:45.464038 2026] [:error] [pid 63134:tid 63140] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Apr 10 23:24:45.696967 2026] [:error] [pid 63134:tid 63146] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 10 23:24:46.356716 2026] [:error] [pid 63134:tid 63150] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Fri Apr 10 23:24:46.694365 2026] [:error] [pid 63134:tid 63154] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Fri Apr 10 23:24:47.052545 2026] [:error] [pid 63134:tid 63157] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Fri Apr 10 23:24:47.285372 2026] [:error] [pid 63134:tid 63144] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Fri Apr 10 23:24:47.558768 2026] [:error] [pid 63134:tid 63159] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Fri Apr 10 23:24:47.868358 2026] [:error] [pid 63134:tid 63153] [client 172.213.0.120:37416] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Fri Apr 10 23:24:48.162597 2026] [:error] [pid 63134:tid 63141] [client 172.213.0.120:37416] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adkWQNFALqPDwWi6eJLH-wAAA8Q"]
[Fri Apr 10 23:24:48.966657 2026] [:error] [pid 63134:tid 63152] [client 172.213.0.120:64813] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adkWQNFALqPDwWi6eJLH_QAAA88"]
[Fri Apr 10 23:24:49.966652 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:50133] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adkWQcWsSnfLoB8ifjC84gAAAkc"]
[Fri Apr 10 23:24:50.780506 2026] [:error] [pid 13189:tid 13203] [client 172.213.0.120:50164] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adkWQpAxiJKPums3eBAHdgAAAEs"]
[Fri Apr 10 23:24:51.587419 2026] [:error] [pid 62651:tid 62676] [client 172.213.0.120:62313] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "adkWQzbAH0le57SIaqw4fQAAAdc"]
[Fri Apr 10 23:24:52.164485 2026] [:error] [pid 13101:tid 13142] [client 172.213.0.120:32336] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "adkWRN8Ldw85818pj2oduwAAAIk"]
[Fri Apr 10 23:24:53.306834 2026] [:error] [pid 13189:tid 13195] [client 172.213.0.120:46609] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "adkWRZAxiJKPums3eBAHggAAAEM"]
[Fri Apr 10 23:24:54.272514 2026] [:error] [pid 62769:tid 62783] [client 172.213.0.120:37433] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxw.php"] [unique_id "adkWRsWsSnfLoB8ifjC86gAAAkw"]
[Fri Apr 10 23:24:55.156917 2026] [:error] [pid 63062:tid 63072] [client 172.213.0.120:42636] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adkWR52HtsmV85NqkMcPTQAAA4g"]
[Fri Apr 10 23:24:55.828392 2026] [:error] [pid 62819:tid 62828] [client 172.213.0.120:32328] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adkWR_U20EyPf7NlsleDmgAAAoY"]
[Fri Apr 10 23:24:56.721589 2026] [:error] [pid 13100:tid 13113] [client 172.213.0.120:50165] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adkWSFzg-ZkZ0InWIP3RkAAAAQg"]
[Fri Apr 10 23:24:57.571995 2026] [:error] [pid 62710:tid 62717] [client 172.213.0.120:37388] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-png.php"] [unique_id "adkWSeME7qrf5xEWWJtFRAAAAgQ"]
[Fri Apr 10 23:24:58.312779 2026] [:error] [pid 62710:tid 62720] [client 172.213.0.120:62123] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adkWSuME7qrf5xEWWJtFTQAAAgc"]
[Fri Apr 10 23:24:59.167407 2026] [:error] [pid 62769:tid 62779] [client 172.213.0.120:50144] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adkWS8WsSnfLoB8ifjC9CwAAAkg"]
[Fri Apr 10 23:25:00.217155 2026] [:error] [pid 63062:tid 63075] [client 172.213.0.120:46630] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adkWTJ2HtsmV85NqkMcPUwAAA4s"]
[Fri Apr 10 23:25:00.884984 2026] [:error] [pid 62884:tid 62909] [client 172.213.0.120:46652] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adkWTOUCK1xrhnnmpo2aJgAAAtI"]
[Fri Apr 10 23:25:01.422842 2026] [:error] [pid 62769:tid 62793] [client 172.213.0.120:62334] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adkWTcWsSnfLoB8ifjC9GQAAAlY"]
[Fri Apr 10 23:25:01.888033 2026] [:error] [pid 62884:tid 62902] [client 172.213.0.120:46638] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adkWTeUCK1xrhnnmpo2aKgAAAss"]
[Fri Apr 10 23:25:02.459743 2026] [:error] [pid 13189:tid 13208] [client 172.213.0.120:46629] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adkWTpAxiJKPums3eBAHlwAAAFA"]
[Fri Apr 10 23:25:02.923636 2026] [:error] [pid 13189:tid 13215] [client 172.213.0.120:37386] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adkWTpAxiJKPums3eBAHmQAAAFc"]
[Fri Apr 10 23:25:03.439110 2026] [:error] [pid 62819:tid 62822] [client 172.213.0.120:62288] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adkWT_U20EyPf7NlsleDpAAAAoA"]
[Fri Apr 10 23:25:03.939720 2026] [:error] [pid 13101:tid 13152] [client 172.213.0.120:32379] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adkWT98Ldw85818pj2od-QAAAJM"]
[Fri Apr 10 23:25:04.660387 2026] [:error] [pid 13101:tid 13149] [client 172.213.0.120:62211] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adkWUN8Ldw85818pj2oeCwAAAJA"]
[Fri Apr 10 23:25:05.194519 2026] [:error] [pid 13101:tid 13143] [client 172.213.0.120:46603] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adkWUd8Ldw85818pj2oeFwAAAIo"]
[Fri Apr 10 23:25:06.462599 2026] [:error] [pid 62710:tid 62725] [client 172.213.0.120:62245] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adkWUuME7qrf5xEWWJtFYAAAAgw"]
[Fri Apr 10 23:25:07.093997 2026] [:error] [pid 63134:tid 63143] [client 172.213.0.120:32356] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adkWU9FALqPDwWi6eJLIJgAAA8Y"]
[Fri Apr 10 23:25:07.603100 2026] [:error] [pid 13189:tid 13198] [client 172.213.0.120:46600] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adkWU5AxiJKPums3eBAHoQAAAEY"]
[Fri Apr 10 23:25:08.135311 2026] [:error] [pid 62819:tid 62825] [client 172.213.0.120:50166] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adkWVPU20EyPf7NlsleDrQAAAoM"]
[Fri Apr 10 23:25:08.612547 2026] [:error] [pid 62769:tid 62795] [client 172.213.0.120:36211] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adkWVMWsSnfLoB8ifjC9JwAAAlg"]
[Fri Apr 10 23:25:09.087276 2026] [:error] [pid 13101:tid 13146] [client 172.213.0.120:62256] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adkWVd8Ldw85818pj2oeKAAAAI0"]
[Fri Apr 10 23:25:09.595879 2026] [:error] [pid 13189:tid 13210] [client 172.213.0.120:62297] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adkWVZAxiJKPums3eBAHqgAAAFI"]
[Fri Apr 10 23:25:10.060656 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:62222] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adkWVsWsSnfLoB8ifjC9MAAAAkc"]
[Fri Apr 10 23:25:10.571513 2026] [:error] [pid 13189:tid 13204] [client 172.213.0.120:37397] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adkWVpAxiJKPums3eBAHrwAAAEw"]
[Fri Apr 10 23:25:11.127460 2026] [:error] [pid 63062:tid 63086] [client 172.213.0.120:50490] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adkWV52HtsmV85NqkMcPawAAA5Y"]
[Fri Apr 10 23:25:11.633458 2026] [:error] [pid 63062:tid 63072] [client 172.213.0.120:64799] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adkWV52HtsmV85NqkMcPcwAAA4g"]
[Fri Apr 10 23:25:12.174538 2026] [:error] [pid 63062:tid 63080] [client 172.213.0.120:36197] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adkWWJ2HtsmV85NqkMcPeAAAA5A"]
[Fri Apr 10 23:25:12.645624 2026] [:error] [pid 13189:tid 13206] [client 172.213.0.120:46595] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax.php"] [unique_id "adkWWJAxiJKPums3eBAHtwAAAE4"]
[Fri Apr 10 23:25:13.114868 2026] [:error] [pid 13189:tid 13212] [client 172.213.0.120:54976] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax.php"] [unique_id "adkWWZAxiJKPums3eBAHvAAAAFQ"]
[Fri Apr 10 23:25:13.582038 2026] [:error] [pid 63062:tid 63074] [client 172.213.0.120:37400] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax.php"] [unique_id "adkWWZ2HtsmV85NqkMcPegAAA4o"]
[Fri Apr 10 23:25:14.043642 2026] [:error] [pid 62769:tid 62787] [client 172.213.0.120:36195] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ajax.php"] [unique_id "adkWWsWsSnfLoB8ifjC9OQAAAlA"]
[Fri Apr 10 23:25:14.520512 2026] [:error] [pid 62769:tid 62794] [client 172.213.0.120:50141] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adkWWsWsSnfLoB8ifjC9PAAAAlc"]
[Fri Apr 10 23:25:14.994998 2026] [:error] [pid 63134:tid 63143] [client 172.213.0.120:46653] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adkWWtFALqPDwWi6eJLIOgAAA8Y"]
[Fri Apr 10 23:25:15.474461 2026] [:error] [pid 63134:tid 63157] [client 172.213.0.120:31848] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adkWW9FALqPDwWi6eJLIQQAAA9Q"]
[Fri Apr 10 23:25:16.051111 2026] [:error] [pid 13100:tid 13123] [client 172.213.0.120:62247] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adkWXFzg-ZkZ0InWIP3RnQAAARI"]
[Fri Apr 10 23:25:16.511479 2026] [:error] [pid 62769:tid 62789] [client 172.213.0.120:50488] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "adkWXMWsSnfLoB8ifjC9RAAAAlI"]
[Fri Apr 10 23:25:16.974162 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:62311] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "adkWXMWsSnfLoB8ifjC9RwAAAkE"]
[Fri Apr 10 23:25:17.460035 2026] [:error] [pid 62819:tid 62827] [client 172.213.0.120:62319] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "adkWXfU20EyPf7NlsleDzwAAAoU"]
[Fri Apr 10 23:25:18.015195 2026] [:error] [pid 62769:tid 62771] [client 172.213.0.120:42676] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/wp-blog.php"] [unique_id "adkWXsWsSnfLoB8ifjC9SQAAAkA"]
[Fri Apr 10 23:25:18.639751 2026] [:error] [pid 13101:tid 13140] [client 172.213.0.120:62266] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWXt8Ldw85818pj2oeQgAAAIc"]
[Fri Apr 10 23:25:19.146735 2026] [:error] [pid 62769:tid 62789] [client 172.213.0.120:64826] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWX8WsSnfLoB8ifjC9UwAAAlI"]
[Fri Apr 10 23:25:19.606840 2026] [:error] [pid 62769:tid 62787] [client 172.213.0.120:64775] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWX8WsSnfLoB8ifjC9VwAAAlA"]
[Fri Apr 10 23:25:20.125010 2026] [:error] [pid 62769:tid 62780] [client 172.213.0.120:62241] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adkWYMWsSnfLoB8ifjC9YAAAAkk"]
[Fri Apr 10 23:25:20.618587 2026] [:error] [pid 62710:tid 62713] [client 172.213.0.120:31845] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "adkWYOME7qrf5xEWWJtFewAAAgA"]
[Fri Apr 10 23:25:21.102072 2026] [:error] [pid 63134:tid 63154] [client 172.213.0.120:37376] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "adkWYdFALqPDwWi6eJLIWAAAA9E"]
[Fri Apr 10 23:25:21.691736 2026] [:error] [pid 63134:tid 63143] [client 172.213.0.120:37408] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "adkWYdFALqPDwWi6eJLIWgAAA8Y"]
[Fri Apr 10 23:25:22.183320 2026] [:error] [pid 13101:tid 13136] [client 172.213.0.120:62312] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tool.php"] [unique_id "adkWYt8Ldw85818pj2oeSQAAAIM"]
[Fri Apr 10 23:25:22.664612 2026] [:error] [pid 13101:tid 13137] [client 172.213.0.120:37388] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "adkWYt8Ldw85818pj2oeTQAAAIQ"]
[Fri Apr 10 23:25:23.128302 2026] [:error] [pid 62819:tid 62843] [client 172.213.0.120:50477] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "adkWY_U20EyPf7NlsleD6gAAApU"]
[Fri Apr 10 23:25:23.597143 2026] [:error] [pid 62710:tid 62723] [client 172.213.0.120:32323] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "adkWY-ME7qrf5xEWWJtFiwAAAgo"]
[Fri Apr 10 23:25:24.109515 2026] [:error] [pid 62769:tid 62772] [client 172.213.0.120:53185] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/drhunthq.php"] [unique_id "adkWZMWsSnfLoB8ifjC9cAAAAkE"]
[Fri Apr 10 23:25:24.574569 2026] [:error] [pid 63062:tid 63068] [client 172.213.0.120:62309] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "adkWZJ2HtsmV85NqkMcPnAAAA4Q"]
[Fri Apr 10 23:25:25.123344 2026] [:error] [pid 62769:tid 62774] [client 172.213.0.120:50155] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "adkWZcWsSnfLoB8ifjC9dAAAAkM"]
[Fri Apr 10 23:25:25.672833 2026] [:error] [pid 13189:tid 13200] [client 172.213.0.120:32361] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "adkWZZAxiJKPums3eBAH1AAAAEg"]
[Fri Apr 10 23:25:26.140753 2026] [:error] [pid 63062:tid 63076] [client 172.213.0.120:36207] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/index.php"] [unique_id "adkWZp2HtsmV85NqkMcPoAAAA4w"]
[Fri Apr 10 23:25:26.627140 2026] [:error] [pid 13101:tid 13147] [client 172.213.0.120:36182] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWZt8Ldw85818pj2oeXAAAAI4"]
[Fri Apr 10 23:25:27.111304 2026] [:error] [pid 13189:tid 13208] [client 172.213.0.120:62282] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWZ5AxiJKPums3eBAH2QAAAFA"]
[Fri Apr 10 23:25:27.582176 2026] [:error] [pid 62769:tid 62793] [client 172.213.0.120:62283] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWZ8WsSnfLoB8ifjC9dwAAAlY"]
[Fri Apr 10 23:25:28.057825 2026] [:error] [pid 13189:tid 13202] [client 172.213.0.120:31814] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWaJAxiJKPums3eBAH3QAAAEo"]
[Fri Apr 10 23:25:28.537389 2026] [:error] [pid 63062:tid 63082] [client 172.213.0.120:50482] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adkWaJ2HtsmV85NqkMcPsgAAA5I"]
[Fri Apr 10 23:25:29.065162 2026] [:error] [pid 62651:tid 62664] [client 172.213.0.120:62275] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adkWaTbAH0le57SIaqw4lQAAAcs"]
[Fri Apr 10 23:25:29.625074 2026] [:error] [pid 13189:tid 13193] [client 172.213.0.120:31808] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adkWaZAxiJKPums3eBAH4QAAAEE"]
[Fri Apr 10 23:25:30.092472 2026] [:error] [pid 63134:tid 63143] [client 172.213.0.120:62280] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adkWatFALqPDwWi6eJLIagAAA8Y"]
[Fri Apr 10 23:25:30.612872 2026] [:error] [pid 62710:tid 62733] [client 172.213.0.120:36201] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "adkWauME7qrf5xEWWJtFmgAAAhQ"]
[Fri Apr 10 23:25:31.077896 2026] [:error] [pid 13189:tid 13200] [client 172.213.0.120:62210] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "adkWa5AxiJKPums3eBAH6QAAAEg"]
[Fri Apr 10 23:25:31.545490 2026] [:error] [pid 62710:tid 62722] [client 172.213.0.120:26160] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "adkWa-ME7qrf5xEWWJtFnwAAAgk"]
[Fri Apr 10 23:25:32.027638 2026] [:error] [pid 62710:tid 62729] [client 172.213.0.120:50443] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wen.php"] [unique_id "adkWbOME7qrf5xEWWJtFogAAAhA"]
[Fri Apr 10 23:25:32.516425 2026] [:error] [pid 62769:tid 62777] [client 172.213.0.120:50460] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "adkWbMWsSnfLoB8ifjC9hwAAAkY"]
[Fri Apr 10 23:25:33.036517 2026] [:error] [pid 13189:tid 13193] [client 172.213.0.120:50112] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "adkWbZAxiJKPums3eBAH8QAAAEE"]
[Fri Apr 10 23:25:33.542894 2026] [:error] [pid 62819:tid 62837] [client 172.213.0.120:32371] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "adkWbfU20EyPf7NlsleEGQAAAo8"]
[Fri Apr 10 23:25:34.004261 2026] [:error] [pid 62651:tid 62663] [client 172.213.0.120:62221] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms.php"] [unique_id "adkWbjbAH0le57SIaqw4pAAAAco"]
[Fri Apr 10 23:25:34.484351 2026] [:error] [pid 62769:tid 62788] [client 172.213.0.120:37412] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adkWbsWsSnfLoB8ifjC9kAAAAlE"]
[Fri Apr 10 23:25:34.970010 2026] [:error] [pid 63062:tid 63073] [client 172.213.0.120:60973] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adkWbp2HtsmV85NqkMcPvgAAA4k"]
[Fri Apr 10 23:25:35.478875 2026] [:error] [pid 63134:tid 63146] [client 172.213.0.120:32337] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adkWb9FALqPDwWi6eJLIeAAAA8k"]
[Fri Apr 10 23:25:35.946943 2026] [:error] [pid 13101:tid 13136] [client 172.213.0.120:32372] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "adkWb98Ldw85818pj2oeegAAAIM"]
[Fri Apr 10 23:25:36.466366 2026] [:error] [pid 62710:tid 62726] [client 172.213.0.120:42667] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWcOME7qrf5xEWWJtFrQAAAg0"]
[Fri Apr 10 23:25:36.964992 2026] [:error] [pid 13101:tid 13138] [client 172.213.0.120:50116] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWcN8Ldw85818pj2oehAAAAIU"]
[Fri Apr 10 23:25:37.435078 2026] [:error] [pid 13189:tid 13200] [client 172.213.0.120:53220] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWcZAxiJKPums3eBAH9QAAAEg"]
[Fri Apr 10 23:25:38.004010 2026] [:error] [pid 13189:tid 13207] [client 172.213.0.120:50174] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tfm.php"] [unique_id "adkWcpAxiJKPums3eBAH-AAAAE8"]
[Fri Apr 10 23:25:38.467343 2026] [:error] [pid 62710:tid 62714] [client 172.213.0.120:62233] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "adkWcuME7qrf5xEWWJtFsgAAAgE"]
[Fri Apr 10 23:25:38.938062 2026] [:error] [pid 13189:tid 13205] [client 172.213.0.120:32347] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "adkWcpAxiJKPums3eBAH_wAAAE0"]
[Fri Apr 10 23:25:39.402508 2026] [:error] [pid 63062:tid 63066] [client 172.213.0.120:32360] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "adkWc52HtsmV85NqkMcPxQAAA4I"]
[Fri Apr 10 23:25:39.931982 2026] [:error] [pid 13101:tid 13145] [client 172.213.0.120:62248] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "adkWc98Ldw85818pj2oemQAAAIw"]
[Fri Apr 10 23:25:40.397667 2026] [:error] [pid 13101:tid 13157] [client 172.213.0.120:46620] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adkWdN8Ldw85818pj2oemwAAAJg"]
[Fri Apr 10 23:25:40.905784 2026] [:error] [pid 63062:tid 63085] [client 172.213.0.120:37418] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adkWdJ2HtsmV85NqkMcPygAAA5U"]
[Fri Apr 10 23:25:41.385083 2026] [:error] [pid 62819:tid 62828] [client 172.213.0.120:31820] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adkWdfU20EyPf7NlsleEMwAAAoY"]
[Fri Apr 10 23:25:41.907300 2026] [:error] [pid 13100:tid 13116] [client 172.213.0.120:50458] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adkWdVzg-ZkZ0InWIP3RsgAAAQs"]
[Fri Apr 10 23:25:42.391925 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:31863] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "adkWdsWsSnfLoB8ifjC9owAAAkc"]
[Fri Apr 10 23:25:42.871421 2026] [:error] [pid 62769:tid 62779] [client 172.213.0.120:46599] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "adkWdsWsSnfLoB8ifjC9rAAAAkg"]
[Fri Apr 10 23:25:43.377991 2026] [:error] [pid 62884:tid 62892] [client 172.213.0.120:60929] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "adkWd-UCK1xrhnnmpo2aWwAAAsE"]
[Fri Apr 10 23:25:43.889821 2026] [:error] [pid 63134:tid 63139] [client 172.213.0.120:36179] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/term.php"] [unique_id "adkWd9FALqPDwWi6eJLIlAAAA8I"]
[Fri Apr 10 23:25:44.403810 2026] [:error] [pid 13101:tid 13151] [client 172.213.0.120:62111] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adkWeN8Ldw85818pj2oeqAAAAJI"]
[Fri Apr 10 23:25:44.933276 2026] [:error] [pid 63134:tid 63161] [client 172.213.0.120:42685] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adkWeNFALqPDwWi6eJLImgAAA9g"]
[Fri Apr 10 23:25:45.442975 2026] [:error] [pid 62884:tid 62909] [client 172.213.0.120:26115] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adkWeeUCK1xrhnnmpo2aXgAAAtI"]
[Fri Apr 10 23:25:45.943158 2026] [:error] [pid 62884:tid 62902] [client 172.213.0.120:46621] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adkWeeUCK1xrhnnmpo2aXwAAAss"]
[Fri Apr 10 23:25:46.416217 2026] [:error] [pid 62769:tid 62778] [client 172.213.0.120:32378] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "adkWesWsSnfLoB8ifjC9yAAAAkc"]
[Fri Apr 10 23:25:46.885285 2026] [:error] [pid 62710:tid 62736] [client 172.213.0.120:50439] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/155.php"] [unique_id "adkWeuME7qrf5xEWWJtFxQAAAhc"]
[Fri Apr 10 23:25:47.356827 2026] [:error] [pid 62710:tid 62719] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Fri Apr 10 23:25:48.988471 2026] [:error] [pid 62710:tid 62719] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Apr 10 23:25:49.223347 2026] [:error] [pid 62710:tid 62729] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Fri Apr 10 23:25:49.463011 2026] [:error] [pid 62710:tid 62722] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Fri Apr 10 23:25:49.695333 2026] [:error] [pid 62710:tid 62714] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/hots.php
[Fri Apr 10 23:25:49.927837 2026] [:error] [pid 62710:tid 62717] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Fri Apr 10 23:25:50.162460 2026] [:error] [pid 62710:tid 62734] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Fri Apr 10 23:25:50.401076 2026] [:error] [pid 62710:tid 62713] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Fri Apr 10 23:25:50.635941 2026] [:error] [pid 62710:tid 62725] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Fri Apr 10 23:25:50.869616 2026] [:error] [pid 62710:tid 62736] [client 172.213.0.120:62257] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Fri Apr 10 23:25:51.337577 2026] [:error] [pid 62710:tid 62737] [client 172.213.0.120:62257] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "adkWf-ME7qrf5xEWWJtF2wAAAhg"]
[Fri Apr 10 23:25:51.801678 2026] [:error] [pid 13100:tid 13116] [client 172.213.0.120:64788] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "adkWf1zg-ZkZ0InWIP3R3wAAAQs"]
[Fri Apr 10 23:25:52.310106 2026] [:error] [pid 13101:tid 13148] [client 172.213.0.120:64800] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "adkWgN8Ldw85818pj2oeyAAAAI8"]
[Fri Apr 10 23:25:52.801020 2026] [:error] [pid 62819:tid 62830] [client 172.213.0.120:62213] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/166.php"] [unique_id "adkWgPU20EyPf7NlsleERgAAAog"]
[Fri Apr 10 23:25:53.269524 2026] [:error] [pid 62819:tid 62845] [client 172.213.0.120:36187] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "adkWgfU20EyPf7NlsleETAAAApc"]
[Fri Apr 10 23:25:53.804866 2026] [:error] [pid 13101:tid 13146] [client 172.213.0.120:60954] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "adkWgd8Ldw85818pj2oe1gAAAI0"]
[Fri Apr 10 23:25:54.269047 2026] [:error] [pid 62651:tid 62673] [client 172.213.0.120:62093] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "adkWgjbAH0le57SIaqw4sgAAAdQ"]
[Fri Apr 10 23:25:54.731338 2026] [:error] [pid 13189:tid 13202] [client 172.213.0.120:62259] [client 172.213.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws77.php"] [unique_id "adkWgpAxiJKPums3eBAIOwAAAEo"]
[Fri Apr 10 23:33:46.315047 2026] [:error] [pid 13189:tid 13192] [client 42.116.172.27:19456] [client 42.116.172.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.116.172.27, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adkYWpAxiJKPums3eBAPPAAAAEA"]
[Fri Apr 10 23:33:46.320647 2026] [:error] [pid 13189:tid 13192] [client 42.116.172.27:19456] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 10 23:50:35.241862 2026] [:error] [pid 13101:tid 13153] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/HhJj1KbY8mQ.php
[Fri Apr 10 23:50:35.499413 2026] [:error] [pid 13101:tid 13134] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/tJsRZpCPGbk.php
[Fri Apr 10 23:50:35.758796 2026] [:error] [pid 13101:tid 13152] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/aboud.php
[Fri Apr 10 23:50:36.013924 2026] [:error] [pid 13101:tid 13144] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/pCS3rHdUjGM.php
[Fri Apr 10 23:50:36.269891 2026] [:error] [pid 13101:tid 13140] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/JMckCndy4s3.php
[Fri Apr 10 23:50:36.525695 2026] [:error] [pid 13101:tid 13142] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/vkYjOI1NKVi.php
[Fri Apr 10 23:50:36.783214 2026] [:error] [pid 13101:tid 13137] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/4SfCBioxZaQ.php
[Fri Apr 10 23:50:37.039113 2026] [:error] [pid 13101:tid 13153] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Fri Apr 10 23:50:37.294608 2026] [:error] [pid 13101:tid 13154] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/wXPBaHfi2do.php
[Fri Apr 10 23:50:37.550058 2026] [:error] [pid 13101:tid 13151] [client 74.248.114.205:54121] File does not exist: /usr/local/apache/htdocs/suspended-page/ropyx.php
[Fri Apr 10 23:50:37.802843 2026] [:error] [pid 13101:tid 13134] [client 74.248.114.205:54121] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/option.php"] [unique_id "adkcTd8Ldw85818pj2oreAAAAIE"]
[Fri Apr 10 23:50:38.307891 2026] [:error] [pid 62769:tid 62787] [client 74.248.114.205:54107] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/option.php"] [unique_id "adkcTsWsSnfLoB8ifjDW1gAAAlA"]
[Fri Apr 10 23:50:38.814058 2026] [:error] [pid 13189:tid 13206] [client 74.248.114.205:11658] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/option.php"] [unique_id "adkcTpAxiJKPums3eBAaegAAAE4"]
[Fri Apr 10 23:50:39.321980 2026] [:error] [pid 13101:tid 13133] [client 74.248.114.205:11649] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/option.php"] [unique_id "adkcT98Ldw85818pj2orfQAAAIA"]
[Fri Apr 10 23:50:39.836012 2026] [:error] [pid 62769:tid 62771] [client 74.248.114.205:54142] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "adkcT8WsSnfLoB8ifjDW2QAAAkA"]
[Fri Apr 10 23:50:40.341476 2026] [:error] [pid 62710:tid 62718] [client 74.248.114.205:54108] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "adkcUOME7qrf5xEWWJtOswAAAgU"]
[Fri Apr 10 23:50:40.846170 2026] [:error] [pid 62769:tid 62780] [client 74.248.114.205:54136] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "adkcUMWsSnfLoB8ifjDW2wAAAkk"]
[Fri Apr 10 23:50:41.352101 2026] [:error] [pid 13189:tid 13200] [client 74.248.114.205:54130] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/OK.php"] [unique_id "adkcUZAxiJKPums3eBAagQAAAEg"]
[Fri Apr 10 23:50:41.862370 2026] [:error] [pid 62819:tid 62843] [client 74.248.114.205:54114] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adkcUfU20EyPf7NlsleKCQAAApU"]
[Fri Apr 10 23:50:42.366510 2026] [:error] [pid 63062:tid 63086] [client 74.248.114.205:54088] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adkcUp2HtsmV85NqkMcXMQAAA5Y"]
[Fri Apr 10 23:50:42.870885 2026] [:error] [pid 62819:tid 62822] [client 74.248.114.205:54099] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adkcUvU20EyPf7NlsleKCgAAAoA"]
[Fri Apr 10 23:50:43.374192 2026] [:error] [pid 13101:tid 13137] [client 74.248.114.205:54111] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ss.php"] [unique_id "adkcU98Ldw85818pj2orggAAAIQ"]
[Fri Apr 10 23:50:43.877768 2026] [:error] [pid 62769:tid 62775] [client 74.248.114.205:54104] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1jgmosvPbq.php"] [unique_id "adkcU8WsSnfLoB8ifjDW4gAAAkQ"]
[Fri Apr 10 23:50:44.389157 2026] [:error] [pid 13101:tid 13146] [client 74.248.114.205:11668] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1jgmosvPbq.php"] [unique_id "adkcVN8Ldw85818pj2orhQAAAI0"]
[Fri Apr 10 23:50:44.893476 2026] [:error] [pid 62769:tid 62779] [client 74.248.114.205:11663] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1jgmosvPbq.php"] [unique_id "adkcVMWsSnfLoB8ifjDW5wAAAkg"]
[Fri Apr 10 23:50:45.403925 2026] [:error] [pid 63134:tid 63150] [client 74.248.114.205:11662] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F1jgmosvPbq.php"] [unique_id "adkcVdFALqPDwWi6eJLRJAAAA80"]
[Fri Apr 10 23:50:45.909303 2026] [:error] [pid 63134:tid 63139] [client 74.248.114.205:54132] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkcVdFALqPDwWi6eJLRJwAAA8I"]
[Fri Apr 10 23:50:46.415124 2026] [:error] [pid 13101:tid 13148] [client 74.248.114.205:54125] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkcVt8Ldw85818pj2orhwAAAI8"]
[Fri Apr 10 23:50:46.920151 2026] [:error] [pid 62651:tid 62656] [client 74.248.114.205:11671] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkcVjbAH0le57SIaqw9HgAAAcM"]
[Fri Apr 10 23:50:47.430152 2026] [:error] [pid 62769:tid 62781] [client 74.248.114.205:54119] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkcV8WsSnfLoB8ifjDW9AAAAko"]
[Fri Apr 10 23:50:47.934612 2026] [:error] [pid 13100:tid 13124] [client 74.248.114.205:11667] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NexusLeads.php"] [unique_id "adkcV1zg-ZkZ0InWIP3VEgAAARM"]
[Fri Apr 10 23:50:48.439836 2026] [:error] [pid 13189:tid 13203] [client 74.248.114.205:54138] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NexusLeads.php"] [unique_id "adkcWJAxiJKPums3eBAaigAAAEs"]
[Fri Apr 10 23:50:48.944937 2026] [:error] [pid 62769:tid 62787] [client 74.248.114.205:54100] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NexusLeads.php"] [unique_id "adkcWMWsSnfLoB8ifjDW-gAAAlA"]
[Fri Apr 10 23:50:49.448962 2026] [:error] [pid 63062:tid 63064] [client 74.248.114.205:54115] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/NexusLeads.php"] [unique_id "adkcWZ2HtsmV85NqkMcXPwAAA4A"]
[Fri Apr 10 23:50:49.949347 2026] [:error] [pid 62710:tid 62734] [client 74.248.114.205:54120] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rfzhh.php"] [unique_id "adkcWeME7qrf5xEWWJtO0gAAAhU"]
[Fri Apr 10 23:50:50.468671 2026] [:error] [pid 13189:tid 13202] [client 74.248.114.205:54091] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rfzhh.php"] [unique_id "adkcWpAxiJKPums3eBAajQAAAEo"]
[Fri Apr 10 23:50:50.974527 2026] [:error] [pid 63134:tid 63155] [client 74.248.114.205:11654] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rfzhh.php"] [unique_id "adkcWtFALqPDwWi6eJLRMAAAA9I"]
[Fri Apr 10 23:50:51.478963 2026] [:error] [pid 62769:tid 62786] [client 74.248.114.205:54086] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rfzhh.php"] [unique_id "adkcW8WsSnfLoB8ifjDXBAAAAk8"]
[Fri Apr 10 23:50:51.983490 2026] [:error] [pid 13101:tid 13135] [client 74.248.114.205:54096] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin-wp.php"] [unique_id "adkcW98Ldw85818pj2orlwAAAII"]
[Fri Apr 10 23:50:52.487871 2026] [:error] [pid 62710:tid 62726] [client 74.248.114.205:54106] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin-wp.php"] [unique_id "adkcXOME7qrf5xEWWJtO2gAAAg0"]
[Fri Apr 10 23:50:52.991637 2026] [:error] [pid 62769:tid 62792] [client 74.248.114.205:11669] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin-wp.php"] [unique_id "adkcXMWsSnfLoB8ifjDXCgAAAlU"]
[Fri Apr 10 23:50:53.497439 2026] [:error] [pid 13101:tid 13149] [client 74.248.114.205:11688] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugin-wp.php"] [unique_id "adkcXd8Ldw85818pj2ormQAAAJA"]
[Fri Apr 10 23:50:54.003783 2026] [:error] [pid 13189:tid 13198] [client 74.248.114.205:11653] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uplozyu.php"] [unique_id "adkcXpAxiJKPums3eBAalQAAAEY"]
[Fri Apr 10 23:50:54.516328 2026] [:error] [pid 62819:tid 62844] [client 74.248.114.205:11661] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uplozyu.php"] [unique_id "adkcXvU20EyPf7NlsleKGAAAApY"]
[Fri Apr 10 23:50:55.026895 2026] [:error] [pid 13100:tid 13109] [client 74.248.114.205:54123] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uplozyu.php"] [unique_id "adkcX1zg-ZkZ0InWIP3VGgAAAQQ"]
[Fri Apr 10 23:50:55.532536 2026] [:error] [pid 63134:tid 63148] [client 74.248.114.205:54137] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uplozyu.php"] [unique_id "adkcX9FALqPDwWi6eJLRMgAAA8s"]
[Fri Apr 10 23:50:56.040556 2026] [:error] [pid 62819:tid 62831] [client 74.248.114.205:54094] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4oivIQALaOZ.php"] [unique_id "adkcYPU20EyPf7NlsleKIAAAAok"]
[Fri Apr 10 23:50:56.545317 2026] [:error] [pid 63134:tid 63139] [client 74.248.114.205:11694] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4oivIQALaOZ.php"] [unique_id "adkcYNFALqPDwWi6eJLRMwAAA8I"]
[Fri Apr 10 23:50:57.048798 2026] [:error] [pid 62884:tid 62911] [client 74.248.114.205:11666] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4oivIQALaOZ.php"] [unique_id "adkcYeUCK1xrhnnmpo2enAAAAtQ"]
[Fri Apr 10 23:50:57.553353 2026] [:error] [pid 62651:tid 62669] [client 74.248.114.205:54116] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/4oivIQALaOZ.php"] [unique_id "adkcYTbAH0le57SIaqw9JQAAAdA"]
[Fri Apr 10 23:50:58.058792 2026] [:error] [pid 63062:tid 63067] [client 74.248.114.205:11703] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lpktuneq.php"] [unique_id "adkcYp2HtsmV85NqkMcXTAAAA4M"]
[Fri Apr 10 23:50:58.564526 2026] [:error] [pid 62769:tid 62771] [client 74.248.114.205:11834] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lpktuneq.php"] [unique_id "adkcYsWsSnfLoB8ifjDXIwAAAkA"]
[Fri Apr 10 23:50:59.081672 2026] [:error] [pid 63134:tid 63151] [client 74.248.114.205:54084] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lpktuneq.php"] [unique_id "adkcY9FALqPDwWi6eJLRNgAAA84"]
[Fri Apr 10 23:50:59.591271 2026] [:error] [pid 62819:tid 62841] [client 74.248.114.205:54095] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lpktuneq.php"] [unique_id "adkcY_U20EyPf7NlsleKLwAAApM"]
[Fri Apr 10 23:51:00.093976 2026] [:error] [pid 13101:tid 13147] [client 74.248.114.205:11657] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5cnobsvIfGg.php"] [unique_id "adkcZN8Ldw85818pj2oroQAAAI4"]
[Fri Apr 10 23:51:00.602932 2026] [:error] [pid 62769:tid 62794] [client 74.248.114.205:11794] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5cnobsvIfGg.php"] [unique_id "adkcZMWsSnfLoB8ifjDXNAAAAlc"]
[Fri Apr 10 23:51:01.109368 2026] [:error] [pid 13100:tid 13123] [client 74.248.114.205:54080] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5cnobsvIfGg.php"] [unique_id "adkcZVzg-ZkZ0InWIP3VKQAAARI"]
[Fri Apr 10 23:51:01.616546 2026] [:error] [pid 62769:tid 62778] [client 74.248.114.205:11680] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5cnobsvIfGg.php"] [unique_id "adkcZcWsSnfLoB8ifjDXOQAAAkc"]
[Fri Apr 10 23:51:02.133121 2026] [:error] [pid 63062:tid 63078] [client 74.248.114.205:11786] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "adkcZp2HtsmV85NqkMcXVgAAA44"]
[Fri Apr 10 23:51:02.641116 2026] [:error] [pid 13101:tid 13151] [client 74.248.114.205:54093] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "adkcZt8Ldw85818pj2orrQAAAJI"]
[Fri Apr 10 23:51:03.146564 2026] [:error] [pid 13101:tid 13135] [client 74.248.114.205:11664] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "adkcZ98Ldw85818pj2orsgAAAII"]
[Fri Apr 10 23:51:03.653298 2026] [:error] [pid 62651:tid 62672] [client 74.248.114.205:11699] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-widgets.php"] [unique_id "adkcZzbAH0le57SIaqw9LAAAAdM"]
[Fri Apr 10 23:51:04.172605 2026] [:error] [pid 63134:tid 63147] [client 74.248.114.205:11673] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tsconfig.php"] [unique_id "adkcaNFALqPDwWi6eJLROwAAA8o"]
[Fri Apr 10 23:51:04.685463 2026] [:error] [pid 13189:tid 13193] [client 74.248.114.205:11709] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tsconfig.php"] [unique_id "adkcaJAxiJKPums3eBAaswAAAEE"]
[Fri Apr 10 23:51:05.199124 2026] [:error] [pid 62819:tid 62839] [client 74.248.114.205:54087] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tsconfig.php"] [unique_id "adkcafU20EyPf7NlsleKNAAAApE"]
[Fri Apr 10 23:51:05.718338 2026] [:error] [pid 13100:tid 13114] [client 74.248.114.205:11665] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tsconfig.php"] [unique_id "adkcaVzg-ZkZ0InWIP3VKwAAAQk"]
[Fri Apr 10 23:51:06.222788 2026] [:error] [pid 62710:tid 62734] [client 74.248.114.205:11822] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkcauME7qrf5xEWWJtO8gAAAhU"]
[Fri Apr 10 23:51:06.734809 2026] [:error] [pid 62710:tid 62727] [client 74.248.114.205:11707] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkcauME7qrf5xEWWJtO9gAAAg4"]
[Fri Apr 10 23:51:07.240958 2026] [:error] [pid 13189:tid 13204] [client 74.248.114.205:11780] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkca5AxiJKPums3eBAawQAAAEw"]
[Fri Apr 10 23:51:07.750546 2026] [:error] [pid 62769:tid 62775] [client 74.248.114.205:11803] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkca8WsSnfLoB8ifjDXVgAAAkQ"]
[Fri Apr 10 23:51:08.258161 2026] [:error] [pid 62884:tid 62904] [client 74.248.114.205:11816] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkcbOUCK1xrhnnmpo2eqQAAAs0"]
[Fri Apr 10 23:51:08.767126 2026] [:error] [pid 13189:tid 13198] [client 74.248.114.205:54133] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkcbJAxiJKPums3eBAazAAAAEY"]
[Fri Apr 10 23:51:09.269816 2026] [:error] [pid 62769:tid 62783] [client 74.248.114.205:11678] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkcbcWsSnfLoB8ifjDXXgAAAkw"]
[Fri Apr 10 23:51:09.778231 2026] [:error] [pid 62651:tid 62657] [client 74.248.114.205:54129] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkcbTbAH0le57SIaqw9LgAAAcQ"]
[Fri Apr 10 23:51:10.283108 2026] [:error] [pid 13101:tid 13147] [client 74.248.114.205:54085] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turbo.php"] [unique_id "adkcbt8Ldw85818pj2orvAAAAI4"]
[Fri Apr 10 23:51:10.787845 2026] [:error] [pid 63134:tid 63159] [client 74.248.114.205:11693] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turbo.php"] [unique_id "adkcbtFALqPDwWi6eJLRQQAAA9Y"]
[Fri Apr 10 23:51:11.294913 2026] [:error] [pid 63134:tid 63160] [client 74.248.114.205:54134] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turbo.php"] [unique_id "adkcb9FALqPDwWi6eJLRQgAAA9c"]
[Fri Apr 10 23:51:11.801087 2026] [:error] [pid 63134:tid 63150] [client 74.248.114.205:11798] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/turbo.php"] [unique_id "adkcb9FALqPDwWi6eJLRQwAAA80"]
[Fri Apr 10 23:51:12.303463 2026] [:error] [pid 13101:tid 13146] [client 74.248.114.205:11802] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/small.php"] [unique_id "adkccN8Ldw85818pj2orwAAAAI0"]
[Fri Apr 10 23:51:12.805985 2026] [:error] [pid 62884:tid 62903] [client 74.248.114.205:54083] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/small.php"] [unique_id "adkccOUCK1xrhnnmpo2erwAAAsw"]
[Fri Apr 10 23:51:13.308280 2026] [:error] [pid 13100:tid 13107] [client 74.248.114.205:11704] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/small.php"] [unique_id "adkccVzg-ZkZ0InWIP3VMAAAAQI"]
[Fri Apr 10 23:51:13.812408 2026] [:error] [pid 62710:tid 62718] [client 74.248.114.205:11679] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/small.php"] [unique_id "adkcceME7qrf5xEWWJtO_QAAAgU"]
[Fri Apr 10 23:51:14.356901 2026] [:error] [pid 62769:tid 62783] [client 74.248.114.205:11650] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkccsWsSnfLoB8ifjDXdgAAAkw"]
[Fri Apr 10 23:51:14.871524 2026] [:error] [pid 62884:tid 62891] [client 74.248.114.205:54143] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkccuUCK1xrhnnmpo2etQAAAsA"]
[Fri Apr 10 23:51:15.379102 2026] [:error] [pid 13101:tid 13140] [client 74.248.114.205:54126] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkcc98Ldw85818pj2orwwAAAIc"]
[Fri Apr 10 23:51:15.890141 2026] [:error] [pid 62769:tid 62784] [client 74.248.114.205:54112] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkcc8WsSnfLoB8ifjDXgAAAAk0"]
[Fri Apr 10 23:51:16.397007 2026] [:error] [pid 62710:tid 62717] [client 74.248.114.205:11677] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkcdOME7qrf5xEWWJtPAAAAAgQ"]
[Fri Apr 10 23:51:16.907682 2026] [:error] [pid 62710:tid 62715] [client 74.248.114.205:11701] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkcdOME7qrf5xEWWJtPAwAAAgI"]
[Fri Apr 10 23:51:17.420174 2026] [:error] [pid 62651:tid 62665] [client 74.248.114.205:11676] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkcdTbAH0le57SIaqw9OwAAAcw"]
[Fri Apr 10 23:51:17.932546 2026] [:error] [pid 62769:tid 62772] [client 74.248.114.205:11800] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkcdcWsSnfLoB8ifjDXiwAAAkE"]
[Fri Apr 10 23:51:18.441363 2026] [:error] [pid 13101:tid 13154] [client 74.248.114.205:11660] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veoblmpa.php"] [unique_id "adkcdt8Ldw85818pj2orzAAAAJU"]
[Fri Apr 10 23:51:18.951277 2026] [:error] [pid 13101:tid 13135] [client 74.248.114.205:11689] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veoblmpa.php"] [unique_id "adkcdt8Ldw85818pj2or0wAAAII"]
[Fri Apr 10 23:51:19.482836 2026] [:error] [pid 13189:tid 13202] [client 74.248.114.205:11681] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veoblmpa.php"] [unique_id "adkcd5AxiJKPums3eBAa5AAAAEo"]
[Fri Apr 10 23:51:19.998502 2026] [:error] [pid 63062:tid 63083] [client 74.248.114.205:54118] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/veoblmpa.php"] [unique_id "adkcd52HtsmV85NqkMcXYAAAA5M"]
[Fri Apr 10 23:51:20.507291 2026] [:error] [pid 63062:tid 63070] [client 74.248.114.205:54097] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkceJ2HtsmV85NqkMcXYQAAA4Y"]
[Fri Apr 10 23:51:21.020042 2026] [:error] [pid 13101:tid 13155] [client 74.248.114.205:11812] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkced8Ldw85818pj2or1gAAAJY"]
[Fri Apr 10 23:51:21.526288 2026] [:error] [pid 62769:tid 62780] [client 74.248.114.205:11670] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkcecWsSnfLoB8ifjDXnQAAAkk"]
[Fri Apr 10 23:51:22.057289 2026] [:error] [pid 13101:tid 13153] [client 74.248.114.205:11698] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkcet8Ldw85818pj2or2AAAAJQ"]
[Fri Apr 10 23:51:22.605860 2026] [:error] [pid 62651:tid 62654] [client 74.248.114.205:11710] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/levyzxsb.php"] [unique_id "adkcejbAH0le57SIaqw9PQAAAcE"]
[Fri Apr 10 23:51:23.110452 2026] [:error] [pid 13101:tid 13137] [client 74.248.114.205:11695] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/levyzxsb.php"] [unique_id "adkce98Ldw85818pj2or2gAAAIQ"]
[Fri Apr 10 23:51:23.627204 2026] [:error] [pid 13189:tid 13215] [client 74.248.114.205:54105] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/levyzxsb.php"] [unique_id "adkce5AxiJKPums3eBAa7wAAAFc"]
[Fri Apr 10 23:51:24.131769 2026] [:error] [pid 62819:tid 62828] [client 74.248.114.205:11557] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/levyzxsb.php"] [unique_id "adkcfPU20EyPf7NlsleKOgAAAoY"]
[Fri Apr 10 23:51:24.639768 2026] [:error] [pid 63062:tid 63086] [client 74.248.114.205:54101] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HtQmJOArI4R.php"] [unique_id "adkcfJ2HtsmV85NqkMcXaQAAA5Y"]
[Fri Apr 10 23:51:25.144972 2026] [:error] [pid 62710:tid 62713] [client 74.248.114.205:11685] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HtQmJOArI4R.php"] [unique_id "adkcfeME7qrf5xEWWJtPBwAAAgA"]
[Fri Apr 10 23:51:25.677949 2026] [:error] [pid 62710:tid 62722] [client 74.248.114.205:11783] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HtQmJOArI4R.php"] [unique_id "adkcfeME7qrf5xEWWJtPDAAAAgk"]
[Fri Apr 10 23:51:26.186811 2026] [:error] [pid 13100:tid 13114] [client 74.248.114.205:11652] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HtQmJOArI4R.php"] [unique_id "adkcflzg-ZkZ0InWIP3VPgAAAQk"]
[Fri Apr 10 23:51:26.691651 2026] [:error] [pid 13189:tid 13216] [client 74.248.114.205:11711] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2whl5XBpvzE.php"] [unique_id "adkcfpAxiJKPums3eBAa_gAAAFg"]
[Fri Apr 10 23:51:27.235687 2026] [:error] [pid 62651:tid 62671] [client 74.248.114.205:11697] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2whl5XBpvzE.php"] [unique_id "adkcfzbAH0le57SIaqw9QQAAAdI"]
[Fri Apr 10 23:51:27.767160 2026] [:error] [pid 62769:tid 62772] [client 74.248.114.205:11805] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2whl5XBpvzE.php"] [unique_id "adkcf8WsSnfLoB8ifjDXpQAAAkE"]
[Fri Apr 10 23:51:28.331565 2026] [:error] [pid 63134:tid 63151] [client 74.248.114.205:54113] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2whl5XBpvzE.php"] [unique_id "adkcgNFALqPDwWi6eJLRXQAAA84"]
[Fri Apr 10 23:51:28.840036 2026] [:error] [pid 62710:tid 62728] [client 74.248.114.205:11705] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jtMi25FrDCR.php"] [unique_id "adkcgOME7qrf5xEWWJtPEAAAAg8"]
[Fri Apr 10 23:51:29.371992 2026] [:error] [pid 62710:tid 62721] [client 74.248.114.205:11682] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jtMi25FrDCR.php"] [unique_id "adkcgeME7qrf5xEWWJtPFAAAAgg"]
[Fri Apr 10 23:51:29.884545 2026] [:error] [pid 13101:tid 13148] [client 74.248.114.205:11833] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jtMi25FrDCR.php"] [unique_id "adkcgd8Ldw85818pj2or5QAAAI8"]
[Fri Apr 10 23:51:30.395978 2026] [:error] [pid 13189:tid 13210] [client 74.248.114.205:11683] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jtMi25FrDCR.php"] [unique_id "adkcgpAxiJKPums3eBAbDQAAAFI"]
[Fri Apr 10 23:51:30.907843 2026] [:error] [pid 63134:tid 63142] [client 74.248.114.205:11554] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avTptOckufV.php"] [unique_id "adkcgtFALqPDwWi6eJLRXwAAA8U"]
[Fri Apr 10 23:51:31.414581 2026] [:error] [pid 62769:tid 62775] [client 74.248.114.205:54127] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avTptOckufV.php"] [unique_id "adkcg8WsSnfLoB8ifjDXqwAAAkQ"]
[Fri Apr 10 23:51:31.922576 2026] [:error] [pid 62769:tid 62784] [client 74.248.114.205:11823] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avTptOckufV.php"] [unique_id "adkcg8WsSnfLoB8ifjDXsAAAAk0"]
[Fri Apr 10 23:51:32.445394 2026] [:error] [pid 62651:tid 62673] [client 74.248.114.205:54140] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/avTptOckufV.php"] [unique_id "adkchDbAH0le57SIaqw9TAAAAdQ"]
[Fri Apr 10 23:51:32.956952 2026] [:error] [pid 13100:tid 13112] [client 74.248.114.205:54089] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FZH64c5eNOX.php"] [unique_id "adkchFzg-ZkZ0InWIP3VRQAAAQc"]
[Fri Apr 10 23:51:33.467094 2026] [:error] [pid 13101:tid 13136] [client 74.248.114.205:11829] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FZH64c5eNOX.php"] [unique_id "adkchd8Ldw85818pj2or7wAAAIM"]
[Fri Apr 10 23:51:33.977728 2026] [:error] [pid 13101:tid 13153] [client 74.248.114.205:11562] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FZH64c5eNOX.php"] [unique_id "adkchd8Ldw85818pj2or9AAAAJQ"]
[Fri Apr 10 23:51:34.512378 2026] [:error] [pid 13189:tid 13201] [client 74.248.114.205:11684] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/FZH64c5eNOX.php"] [unique_id "adkchpAxiJKPums3eBAbIwAAAEk"]
[Fri Apr 10 23:51:35.021691 2026] [:error] [pid 13189:tid 13207] [client 74.248.114.205:54117] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/K9s7LSHhmVd.php"] [unique_id "adkch5AxiJKPums3eBAbKAAAAE8"]
[Fri Apr 10 23:51:35.542920 2026] [:error] [pid 62769:tid 62772] [client 74.248.114.205:11809] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/K9s7LSHhmVd.php"] [unique_id "adkch8WsSnfLoB8ifjDXuAAAAkE"]
[Fri Apr 10 23:51:36.049039 2026] [:error] [pid 62769:tid 62775] [client 74.248.114.205:11785] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/K9s7LSHhmVd.php"] [unique_id "adkciMWsSnfLoB8ifjDXvAAAAkQ"]
[Fri Apr 10 23:51:36.559821 2026] [:error] [pid 62769:tid 62773] [client 74.248.114.205:11702] [client 74.248.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/K9s7LSHhmVd.php"] [unique_id "adkciMWsSnfLoB8ifjDXwwAAAkI"]
[Fri Apr 10 23:51:37.079466 2026] [:error] [pid 62710:tid 62732] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-casper.php
[Fri Apr 10 23:51:37.343646 2026] [:error] [pid 62710:tid 62721] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/Curve25519-items.php
[Fri Apr 10 23:51:37.602877 2026] [:error] [pid 62710:tid 62730] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/end.php
[Fri Apr 10 23:51:37.858592 2026] [:error] [pid 62710:tid 62713] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Fri Apr 10 23:51:38.117071 2026] [:error] [pid 62710:tid 62719] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/54Y7oaIvRCq.php
[Fri Apr 10 23:51:38.372908 2026] [:error] [pid 62710:tid 62736] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/rss-functions-session.php
[Fri Apr 10 23:51:38.629117 2026] [:error] [pid 62710:tid 62735] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/QPGxhzdFios.php
[Fri Apr 10 23:51:38.885147 2026] [:error] [pid 62710:tid 62728] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/kmsOihDGg24.php
[Fri Apr 10 23:51:40.474143 2026] [:error] [pid 62710:tid 62728] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-more.php
[Fri Apr 10 23:51:40.729993 2026] [:error] [pid 62710:tid 62713] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/zMjcvbswY.php
[Fri Apr 10 23:51:40.986531 2026] [:error] [pid 62710:tid 62719] [client 74.248.114.205:54110] File does not exist: /usr/local/apache/htdocs/suspended-page/4SnNfidKMe3.php
[Sat Apr 11 01:42:13.611427 2026] [:error] [pid 21706:tid 21714] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sat Apr 11 01:42:13.847056 2026] [:error] [pid 21706:tid 21732] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/4GrJSiwkF3A.php
[Sat Apr 11 01:42:14.101549 2026] [:error] [pid 21706:tid 21730] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/SS72_kKKjT.php
[Sat Apr 11 01:42:14.336281 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/wkogn.php
[Sat Apr 11 01:42:14.571947 2026] [:error] [pid 21706:tid 21728] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/hwjtry0zd1fzeakcuzn8Cdefault.php
[Sat Apr 11 01:42:14.814300 2026] [:error] [pid 21706:tid 21710] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sat Apr 11 01:42:15.072550 2026] [:error] [pid 21706:tid 21719] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/oLEzRVqmJJPFSucdefault.php
[Sat Apr 11 01:42:15.306813 2026] [:error] [pid 21706:tid 21729] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/wwdgl.php
[Sat Apr 11 01:42:15.566593 2026] [:error] [pid 21706:tid 21716] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/3akp.php
[Sat Apr 11 01:42:15.800994 2026] [:error] [pid 21706:tid 21711] [client 72.146.30.147:49727] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Sat Apr 11 01:42:16.031353 2026] [:error] [pid 21706:tid 21724] [client 72.146.30.147:49727] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adk2eCGQ1M5d8fQSsLGb9AAAABA"]
[Sat Apr 11 01:42:16.960971 2026] [:error] [pid 55451:tid 55472] [client 72.146.30.147:49737] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adk2eHApxuyB7yCS5Rn3fwAAANM"]
[Sat Apr 11 01:42:17.429379 2026] [:error] [pid 21570:tid 21677] [client 72.146.30.147:49678] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adk2eTKs5t9xRSNL6cm-zwAAAEg"]
[Sat Apr 11 01:42:17.904097 2026] [:error] [pid 21706:tid 21726] [client 72.146.30.147:49702] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adk2eSGQ1M5d8fQSsLGb-gAAABI"]
[Sat Apr 11 01:42:18.371123 2026] [:error] [pid 21706:tid 21730] [client 72.146.30.147:43465] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adk2eiGQ1M5d8fQSsLGb_AAAABY"]
[Sat Apr 11 01:42:18.888933 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:49720] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adk2enApxuyB7yCS5Rn3kwAAAMk"]
[Sat Apr 11 01:42:19.473800 2026] [:error] [pid 21706:tid 21723] [client 72.146.30.147:49768] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adk2eyGQ1M5d8fQSsLGb_wAAAA8"]
[Sat Apr 11 01:42:19.931169 2026] [:error] [pid 55451:tid 55470] [client 72.146.30.147:43458] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adk2e3ApxuyB7yCS5Rn3lwAAANE"]
[Sat Apr 11 01:42:20.393519 2026] [:error] [pid 21706:tid 21711] [client 72.146.30.147:49786] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adk2fCGQ1M5d8fQSsLGcAQAAAAM"]
[Sat Apr 11 01:42:21.076209 2026] [:error] [pid 21568:tid 21577] [client 72.146.30.147:49699] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adk2fYiz5v_ljZxkpR_AvAAAAQU"]
[Sat Apr 11 01:42:21.540906 2026] [:error] [pid 21568:tid 21592] [client 72.146.30.147:49680] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adk2fYiz5v_ljZxkpR_AwQAAARQ"]
[Sat Apr 11 01:42:21.998665 2026] [:error] [pid 21568:tid 21583] [client 72.146.30.147:49784] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adk2fYiz5v_ljZxkpR_AxgAAAQs"]
[Sat Apr 11 01:42:22.471017 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:49740] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adk2fnApxuyB7yCS5Rn3nAAAANI"]
[Sat Apr 11 01:42:23.007803 2026] [:error] [pid 55451:tid 55454] [client 72.146.30.147:49668] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adk2f3ApxuyB7yCS5Rn3ngAAAME"]
[Sat Apr 11 01:42:23.467947 2026] [:error] [pid 55451:tid 55476] [client 72.146.30.147:49707] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adk2f3ApxuyB7yCS5Rn3owAAANc"]
[Sat Apr 11 01:42:23.932012 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:49775] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adk2f3ApxuyB7yCS5Rn3pwAAAMg"]
[Sat Apr 11 01:42:24.636828 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:49781] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adk2gHApxuyB7yCS5Rn3rQAAAM0"]
[Sat Apr 11 01:42:25.110275 2026] [:error] [pid 21568:tid 21595] [client 72.146.30.147:49778] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adk2gYiz5v_ljZxkpR_AzQAAARc"]
[Sat Apr 11 01:42:25.576155 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:49726] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adk2gXApxuyB7yCS5Rn3sgAAANI"]
[Sat Apr 11 01:42:26.225149 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:49758] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adk2gnApxuyB7yCS5Rn3uQAAAMk"]
[Sat Apr 11 01:42:26.701360 2026] [:error] [pid 55451:tid 55453] [client 72.146.30.147:49785] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adk2gnApxuyB7yCS5Rn3vwAAAMA"]
[Sat Apr 11 01:42:27.278394 2026] [:error] [pid 21568:tid 21581] [client 72.146.30.147:49763] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adk2g4iz5v_ljZxkpR_A1QAAAQk"]
[Sat Apr 11 01:42:27.744627 2026] [:error] [pid 55451:tid 55463] [client 72.146.30.147:49791] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adk2g3ApxuyB7yCS5Rn3xwAAAMo"]
[Sat Apr 11 01:42:28.209678 2026] [:error] [pid 21569:tid 21664] [client 72.146.30.147:49741] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adk2hHAvQTgvXJ6vHoqTfgAAAJA"]
[Sat Apr 11 01:42:29.158475 2026] [:error] [pid 21570:tid 21670] [client 72.146.30.147:49675] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adk2hTKs5t9xRSNL6cm-4AAAAEQ"]
[Sat Apr 11 01:42:29.622323 2026] [:error] [pid 21568:tid 21577] [client 72.146.30.147:49683] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adk2hYiz5v_ljZxkpR_A6wAAAQU"]
[Sat Apr 11 01:42:30.085450 2026] [:error] [pid 55451:tid 55475] [client 72.146.30.147:49693] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adk2hnApxuyB7yCS5Rn31AAAANY"]
[Sat Apr 11 01:42:30.578317 2026] [:error] [pid 55451:tid 55464] [client 72.146.30.147:43457] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adk2hnApxuyB7yCS5Rn32AAAAMs"]
[Sat Apr 11 01:42:31.041789 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:43462] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adk2h3ApxuyB7yCS5Rn33QAAAMk"]
[Sat Apr 11 01:42:31.516996 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:49731] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adk2hyGQ1M5d8fQSsLGcGAAAAAA"]
[Sat Apr 11 01:42:32.010852 2026] [:error] [pid 21706:tid 21712] [client 72.146.30.147:49766] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adk2iCGQ1M5d8fQSsLGcHAAAAAQ"]
[Sat Apr 11 01:42:32.473073 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:49746] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adk2iHApxuyB7yCS5Rn36QAAANU"]
[Sat Apr 11 01:42:32.997317 2026] [:error] [pid 55451:tid 55467] [client 72.146.30.147:43395] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adk2iHApxuyB7yCS5Rn37AAAAM4"]
[Sat Apr 11 01:42:33.512131 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:49761] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adk2iXApxuyB7yCS5Rn38AAAAM0"]
[Sat Apr 11 01:42:33.972377 2026] [:error] [pid 55451:tid 55469] [client 72.146.30.147:43473] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adk2iXApxuyB7yCS5Rn39AAAANA"]
[Sat Apr 11 01:42:34.428558 2026] [:error] [pid 21570:tid 21661] [client 72.146.30.147:49753] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adk2ijKs5t9xRSNL6cm-6wAAAEA"]
[Sat Apr 11 01:42:34.966778 2026] [:error] [pid 21568:tid 21587] [client 72.146.30.147:49777] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adk2ioiz5v_ljZxkpR_BAQAAAQ8"]
[Sat Apr 11 01:42:35.453398 2026] [:error] [pid 21568:tid 21586] [client 72.146.30.147:49721] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adk2i4iz5v_ljZxkpR_BCQAAAQ4"]
[Sat Apr 11 01:42:35.923934 2026] [:error] [pid 55451:tid 55458] [client 72.146.30.147:49718] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adk2i3ApxuyB7yCS5Rn3_gAAAMU"]
[Sat Apr 11 01:42:36.413598 2026] [:error] [pid 21568:tid 21583] [client 72.146.30.147:49685] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adk2jIiz5v_ljZxkpR_BEwAAAQs"]
[Sat Apr 11 01:42:36.927991 2026] [:error] [pid 21570:tid 21689] [client 72.146.30.147:49674] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blqjs.php"] [unique_id "adk2jDKs5t9xRSNL6cm-9gAAAE8"]
[Sat Apr 11 01:42:37.468752 2026] [:error] [pid 21569:tid 21656] [client 72.146.30.147:49729] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blqjs.php"] [unique_id "adk2jXAvQTgvXJ6vHoqTjgAAAIs"]
[Sat Apr 11 01:42:37.932045 2026] [:error] [pid 21569:tid 21654] [client 72.146.30.147:49676] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blqjs.php"] [unique_id "adk2jXAvQTgvXJ6vHoqTkgAAAIk"]
[Sat Apr 11 01:42:38.399007 2026] [:error] [pid 21706:tid 21727] [client 72.146.30.147:43463] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blqjs.php"] [unique_id "adk2jiGQ1M5d8fQSsLGcHwAAABM"]
[Sat Apr 11 01:42:38.896590 2026] [:error] [pid 21706:tid 21710] [client 72.146.30.147:43456] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk25_1.php"] [unique_id "adk2jiGQ1M5d8fQSsLGcJgAAAAI"]
[Sat Apr 11 01:42:39.361977 2026] [:error] [pid 21570:tid 21677] [client 72.146.30.147:43491] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk25_1.php"] [unique_id "adk2jzKs5t9xRSNL6cm-_QAAAEg"]
[Sat Apr 11 01:42:39.849640 2026] [:error] [pid 21568:tid 21572] [client 72.146.30.147:49687] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk25_1.php"] [unique_id "adk2j4iz5v_ljZxkpR_BHwAAAQA"]
[Sat Apr 11 01:42:40.316069 2026] [:error] [pid 21568:tid 21584] [client 72.146.30.147:37254] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sk25_1.php"] [unique_id "adk2kIiz5v_ljZxkpR_BIwAAAQw"]
[Sat Apr 11 01:42:40.786766 2026] [:error] [pid 21568:tid 21586] [client 72.146.30.147:43433] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "adk2kIiz5v_ljZxkpR_BJwAAAQ4"]
[Sat Apr 11 01:42:41.249300 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:49743] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "adk2kXApxuyB7yCS5Rn4CAAAANU"]
[Sat Apr 11 01:42:41.807850 2026] [:error] [pid 55451:tid 55467] [client 72.146.30.147:49686] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "adk2kXApxuyB7yCS5Rn4EAAAAM4"]
[Sat Apr 11 01:42:42.278575 2026] [:error] [pid 55451:tid 55455] [client 72.146.30.147:49774] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fetch.php"] [unique_id "adk2knApxuyB7yCS5Rn4FAAAAMI"]
[Sat Apr 11 01:42:42.739565 2026] [:error] [pid 55451:tid 55468] [client 72.146.30.147:43512] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adk2knApxuyB7yCS5Rn4FwAAAM8"]
[Sat Apr 11 01:42:43.213494 2026] [:error] [pid 55451:tid 55473] [client 72.146.30.147:49748] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adk2k3ApxuyB7yCS5Rn4HAAAANQ"]
[Sat Apr 11 01:42:43.675212 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:43408] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adk2kyGQ1M5d8fQSsLGcOQAAAAA"]
[Sat Apr 11 01:42:44.137148 2026] [:error] [pid 21569:tid 21654] [client 72.146.30.147:43517] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adk2lHAvQTgvXJ6vHoqTnwAAAIk"]
[Sat Apr 11 01:42:44.611838 2026] [:error] [pid 21569:tid 21678] [client 72.146.30.147:49730] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adk2lHAvQTgvXJ6vHoqToQAAAJY"]
[Sat Apr 11 01:42:45.077135 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:49734] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adk2lSGQ1M5d8fQSsLGcRAAAAAA"]
[Sat Apr 11 01:42:45.541700 2026] [:error] [pid 55451:tid 55454] [client 72.146.30.147:49715] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adk2lXApxuyB7yCS5Rn4IQAAAME"]
[Sat Apr 11 01:42:46.024541 2026] [:error] [pid 55451:tid 55455] [client 72.146.30.147:43444] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adk2lnApxuyB7yCS5Rn4JQAAAMI"]
[Sat Apr 11 01:42:46.491098 2026] [:error] [pid 21570:tid 21665] [client 72.146.30.147:43474] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oircv.php"] [unique_id "adk2ljKs5t9xRSNL6cm_CAAAAEI"]
[Sat Apr 11 01:42:47.062825 2026] [:error] [pid 21706:tid 21714] [client 72.146.30.147:43498] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oircv.php"] [unique_id "adk2lyGQ1M5d8fQSsLGcUQAAAAY"]
[Sat Apr 11 01:42:47.529295 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:49738] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oircv.php"] [unique_id "adk2lyGQ1M5d8fQSsLGcVQAAAAA"]
[Sat Apr 11 01:42:48.003190 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:43480] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oircv.php"] [unique_id "adk2mHApxuyB7yCS5Rn4MAAAAMg"]
[Sat Apr 11 01:42:48.475592 2026] [:error] [pid 21569:tid 21657] [client 72.146.30.147:49719] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "adk2mHAvQTgvXJ6vHoqTqQAAAIw"]
[Sat Apr 11 01:42:48.935103 2026] [:error] [pid 21706:tid 21711] [client 72.146.30.147:49667] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "adk2mCGQ1M5d8fQSsLGcWQAAAAM"]
[Sat Apr 11 01:42:49.401473 2026] [:error] [pid 21569:tid 21652] [client 72.146.30.147:49679] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "adk2mXAvQTgvXJ6vHoqTrAAAAIc"]
[Sat Apr 11 01:42:49.873754 2026] [:error] [pid 21570:tid 21663] [client 72.146.30.147:49696] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blnux.php"] [unique_id "adk2mTKs5t9xRSNL6cm_EwAAAEE"]
[Sat Apr 11 01:42:50.378960 2026] [:error] [pid 21706:tid 21730] [client 72.146.30.147:49666] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adk2miGQ1M5d8fQSsLGcXAAAABY"]
[Sat Apr 11 01:42:50.843471 2026] [:error] [pid 21568:tid 21579] [client 72.146.30.147:49739] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adk2moiz5v_ljZxkpR_BOAAAAQc"]
[Sat Apr 11 01:42:51.311458 2026] [:error] [pid 21568:tid 21588] [client 72.146.30.147:49760] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adk2m4iz5v_ljZxkpR_BPgAAARA"]
[Sat Apr 11 01:42:51.793114 2026] [:error] [pid 21569:tid 21654] [client 72.146.30.147:49736] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adk2m3AvQTgvXJ6vHoqTsgAAAIk"]
[Sat Apr 11 01:42:52.259204 2026] [:error] [pid 55451:tid 55459] [client 72.146.30.147:43509] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Spow_SRw.php"] [unique_id "adk2nHApxuyB7yCS5Rn4SQAAAMY"]
[Sat Apr 11 01:42:52.724166 2026] [:error] [pid 21570:tid 21679] [client 72.146.30.147:43501] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Spow_SRw.php"] [unique_id "adk2nDKs5t9xRSNL6cm_HgAAAEk"]
[Sat Apr 11 01:42:53.239485 2026] [:error] [pid 21706:tid 21725] [client 72.146.30.147:49682] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Spow_SRw.php"] [unique_id "adk2nSGQ1M5d8fQSsLGcZQAAABE"]
[Sat Apr 11 01:42:53.700883 2026] [:error] [pid 21706:tid 21728] [client 72.146.30.147:49716] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Spow_SRw.php"] [unique_id "adk2nSGQ1M5d8fQSsLGcaAAAABQ"]
[Sat Apr 11 01:42:54.473087 2026] [:error] [pid 21569:tid 21647] [client 72.146.30.147:49790] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adk2nnAvQTgvXJ6vHoqTtAAAAII"]
[Sat Apr 11 01:42:54.973121 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:49759] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adk2nnApxuyB7yCS5Rn4UQAAAM0"]
[Sat Apr 11 01:42:55.445252 2026] [:error] [pid 21568:tid 21590] [client 72.146.30.147:49725] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adk2n4iz5v_ljZxkpR_BTAAAARI"]
[Sat Apr 11 01:42:55.910268 2026] [:error] [pid 21569:tid 21664] [client 72.146.30.147:49783] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adk2n3AvQTgvXJ6vHoqTtgAAAJA"]
[Sat Apr 11 01:42:56.476972 2026] [:error] [pid 21570:tid 21693] [client 72.146.30.147:49772] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adk2oDKs5t9xRSNL6cm_KQAAAFM"]
[Sat Apr 11 01:42:56.939456 2026] [:error] [pid 21570:tid 21697] [client 72.146.30.147:49669] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adk2oDKs5t9xRSNL6cm_LAAAAFc"]
[Sat Apr 11 01:42:57.405113 2026] [:error] [pid 21569:tid 21667] [client 72.146.30.147:49705] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adk2oXAvQTgvXJ6vHoqTvAAAAJE"]
[Sat Apr 11 01:42:57.870360 2026] [:error] [pid 21706:tid 21720] [client 72.146.30.147:43411] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adk2oSGQ1M5d8fQSsLGcigAAAAw"]
[Sat Apr 11 01:42:58.353895 2026] [:error] [pid 55451:tid 55468] [client 72.146.30.147:49759] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adk2onApxuyB7yCS5Rn4VwAAAM8"]
[Sat Apr 11 01:42:58.886994 2026] [:error] [pid 21568:tid 21591] [client 72.146.30.147:49752] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adk2ooiz5v_ljZxkpR_BYwAAARM"]
[Sat Apr 11 01:42:59.363945 2026] [:error] [pid 21706:tid 21731] [client 72.146.30.147:37258] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adk2oyGQ1M5d8fQSsLGcjwAAABc"]
[Sat Apr 11 01:42:59.924546 2026] [:error] [pid 55451:tid 55463] [client 72.146.30.147:49664] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adk2o3ApxuyB7yCS5Rn4XQAAAMo"]
[Sat Apr 11 01:43:00.395498 2026] [:error] [pid 55451:tid 55456] [client 72.146.30.147:49712] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adk2pHApxuyB7yCS5Rn4YQAAAMM"]
[Sat Apr 11 01:43:00.878339 2026] [:error] [pid 21569:tid 21650] [client 72.146.30.147:43439] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adk2pHAvQTgvXJ6vHoqTwAAAAIU"]
[Sat Apr 11 01:43:01.449722 2026] [:error] [pid 21570:tid 21698] [client 72.146.30.147:49756] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adk2pTKs5t9xRSNL6cm_PAAAAFg"]
[Sat Apr 11 01:43:01.922867 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:49724] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adk2pXApxuyB7yCS5Rn4bgAAANI"]
[Sat Apr 11 01:43:02.528062 2026] [:error] [pid 21570:tid 21682] [client 72.146.30.147:49762] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adk2pjKs5t9xRSNL6cm_RAAAAEs"]
[Sat Apr 11 01:43:02.998444 2026] [:error] [pid 21706:tid 21727] [client 72.146.30.147:43436] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adk2piGQ1M5d8fQSsLGcngAAABM"]
[Sat Apr 11 01:43:04.168802 2026] [:error] [pid 21569:tid 21647] [client 72.146.30.147:49713] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adk2qHAvQTgvXJ6vHoqTwQAAAII"]
[Sat Apr 11 01:43:04.636906 2026] [:error] [pid 21570:tid 21687] [client 72.146.30.147:49767] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adk2qDKs5t9xRSNL6cm_TQAAAE0"]
[Sat Apr 11 01:43:05.101231 2026] [:error] [pid 21568:tid 21580] [client 72.146.30.147:49779] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adk2qYiz5v_ljZxkpR_BcwAAAQg"]
[Sat Apr 11 01:43:05.579670 2026] [:error] [pid 21706:tid 21710] [client 72.146.30.147:43403] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adk2qSGQ1M5d8fQSsLGcpgAAAAI"]
[Sat Apr 11 01:43:06.133784 2026] [:error] [pid 55451:tid 55460] [client 72.146.30.147:43471] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adk2qnApxuyB7yCS5Rn4jAAAAMc"]
[Sat Apr 11 01:43:06.621283 2026] [:error] [pid 55451:tid 55457] [client 72.146.30.147:43494] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adk2qnApxuyB7yCS5Rn4kgAAAMQ"]
[Sat Apr 11 01:43:07.087803 2026] [:error] [pid 55451:tid 55477] [client 72.146.30.147:43514] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adk2q3ApxuyB7yCS5Rn4lwAAANg"]
[Sat Apr 11 01:43:07.652935 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:43404] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adk2q3ApxuyB7yCS5Rn4oAAAAMg"]
[Sat Apr 11 01:43:08.123065 2026] [:error] [pid 55451:tid 55459] [client 72.146.30.147:43393] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adk2rHApxuyB7yCS5Rn4qAAAAMY"]
[Sat Apr 11 01:43:08.592105 2026] [:error] [pid 21570:tid 21688] [client 72.146.30.147:49723] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adk2rDKs5t9xRSNL6cm_VgAAAE4"]
[Sat Apr 11 01:43:09.085370 2026] [:error] [pid 21568:tid 21592] [client 72.146.30.147:37294] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adk2rYiz5v_ljZxkpR_BfwAAARQ"]
[Sat Apr 11 01:43:09.568080 2026] [:error] [pid 21568:tid 21588] [client 72.146.30.147:43490] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adk2rYiz5v_ljZxkpR_BhAAAARA"]
[Sat Apr 11 01:43:10.087066 2026] [:error] [pid 55451:tid 55473] [client 72.146.30.147:49745] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adk2rnApxuyB7yCS5Rn4swAAANQ"]
[Sat Apr 11 01:43:10.569972 2026] [:error] [pid 21570:tid 21677] [client 72.146.30.147:49780] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adk2rjKs5t9xRSNL6cm_XQAAAEg"]
[Sat Apr 11 01:43:11.229951 2026] [:error] [pid 21570:tid 21698] [client 72.146.30.147:43405] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-942.php"] [unique_id "adk2rzKs5t9xRSNL6cm_XgAAAFg"]
[Sat Apr 11 01:43:11.728200 2026] [:error] [pid 55451:tid 55473] [client 72.146.30.147:49695] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-942.php"] [unique_id "adk2r3ApxuyB7yCS5Rn4wQAAANQ"]
[Sat Apr 11 01:43:12.190248 2026] [:error] [pid 55451:tid 55467] [client 72.146.30.147:43493] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-942.php"] [unique_id "adk2sHApxuyB7yCS5Rn4xwAAAM4"]
[Sat Apr 11 01:43:12.740032 2026] [:error] [pid 21570:tid 21661] [client 72.146.30.147:49782] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-942.php"] [unique_id "adk2sDKs5t9xRSNL6cm_YQAAAEA"]
[Sat Apr 11 01:43:13.204383 2026] [:error] [pid 55451:tid 55456] [client 72.146.30.147:43402] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adk2sXApxuyB7yCS5Rn40wAAAMM"]
[Sat Apr 11 01:43:13.668356 2026] [:error] [pid 21570:tid 21679] [client 72.146.30.147:49732] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adk2sTKs5t9xRSNL6cm_YgAAAEk"]
[Sat Apr 11 01:43:14.218854 2026] [:error] [pid 21569:tid 21651] [client 72.146.30.147:49769] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adk2snAvQTgvXJ6vHoqTxAAAAIY"]
[Sat Apr 11 01:43:14.795528 2026] [:error] [pid 21706:tid 21716] [client 72.146.30.147:49788] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adk2siGQ1M5d8fQSsLGctAAAAAg"]
[Sat Apr 11 01:43:15.433616 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/wpb.php
[Sat Apr 11 01:43:15.667295 2026] [:error] [pid 55451:tid 55473] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Sat Apr 11 01:43:15.901607 2026] [:error] [pid 55451:tid 55459] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/9EaklzMysJ.php
[Sat Apr 11 01:43:16.135267 2026] [:error] [pid 55451:tid 55465] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxl.php
[Sat Apr 11 01:43:16.385986 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/s3FiyJ2WGCnF0p1default.php
[Sat Apr 11 01:43:16.621584 2026] [:error] [pid 55451:tid 55469] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/bfil.php
[Sat Apr 11 01:43:16.856304 2026] [:error] [pid 55451:tid 55468] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Sat Apr 11 01:43:17.100859 2026] [:error] [pid 55451:tid 55470] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sat Apr 11 01:43:17.372341 2026] [:error] [pid 55451:tid 55459] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sat Apr 11 01:43:17.607358 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/p14rAeWytPdH5hZcscCFdefault.php
[Sat Apr 11 01:43:17.840356 2026] [:error] [pid 55451:tid 55476] [client 72.146.30.147:49717] File does not exist: /usr/local/apache/htdocs/suspended-page/iindv.php
[Sat Apr 11 01:43:18.070829 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:49717] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maintura.php"] [unique_id "adk2tnApxuyB7yCS5Rn4-wAAANI"]
[Sat Apr 11 01:43:18.535884 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:43495] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maintura.php"] [unique_id "adk2tnApxuyB7yCS5Rn5AAAAAMg"]
[Sat Apr 11 01:43:18.994686 2026] [:error] [pid 21569:tid 21676] [client 72.146.30.147:43417] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maintura.php"] [unique_id "adk2tnAvQTgvXJ6vHoqT0wAAAJU"]
[Sat Apr 11 01:43:19.467336 2026] [:error] [pid 55451:tid 55457] [client 72.146.30.147:43492] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/maintura.php"] [unique_id "adk2t3ApxuyB7yCS5Rn5CwAAAMQ"]
[Sat Apr 11 01:43:19.970377 2026] [:error] [pid 55451:tid 55459] [client 72.146.30.147:49764] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adk2t3ApxuyB7yCS5Rn5EgAAAMY"]
[Sat Apr 11 01:43:20.554853 2026] [:error] [pid 55451:tid 55458] [client 72.146.30.147:49747] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adk2uHApxuyB7yCS5Rn5FgAAAMU"]
[Sat Apr 11 01:43:21.017498 2026] [:error] [pid 55451:tid 55460] [client 72.146.30.147:43478] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adk2uXApxuyB7yCS5Rn5HQAAAMc"]
[Sat Apr 11 01:43:21.478130 2026] [:error] [pid 55451:tid 55468] [client 72.146.30.147:49677] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adk2uXApxuyB7yCS5Rn5IwAAAM8"]
[Sat Apr 11 01:43:21.937857 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:37249] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adk2uXApxuyB7yCS5Rn5JwAAAMg"]
[Sat Apr 11 01:43:22.401699 2026] [:error] [pid 55451:tid 55453] [client 72.146.30.147:43432] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adk2unApxuyB7yCS5Rn5KwAAAMA"]
[Sat Apr 11 01:43:22.881563 2026] [:error] [pid 21569:tid 21662] [client 72.146.30.147:43421] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adk2unAvQTgvXJ6vHoqT2gAAAI8"]
[Sat Apr 11 01:43:23.344148 2026] [:error] [pid 55451:tid 55454] [client 72.146.30.147:49722] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adk2u3ApxuyB7yCS5Rn5MAAAAME"]
[Sat Apr 11 01:43:23.808088 2026] [:error] [pid 55451:tid 55456] [client 72.146.30.147:37276] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-220.php"] [unique_id "adk2u3ApxuyB7yCS5Rn5NgAAAMM"]
[Sat Apr 11 01:43:24.292782 2026] [:error] [pid 21568:tid 21584] [client 72.146.30.147:43500] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-220.php"] [unique_id "adk2vIiz5v_ljZxkpR_BnwAAAQw"]
[Sat Apr 11 01:43:24.859751 2026] [:error] [pid 21706:tid 21712] [client 72.146.30.147:49688] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-220.php"] [unique_id "adk2vCGQ1M5d8fQSsLGcxQAAAAQ"]
[Sat Apr 11 01:43:25.321277 2026] [:error] [pid 55451:tid 55477] [client 72.146.30.147:43461] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-220.php"] [unique_id "adk2vXApxuyB7yCS5Rn5RQAAANg"]
[Sat Apr 11 01:43:25.804183 2026] [:error] [pid 21706:tid 21719] [client 72.146.30.147:37268] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adk2vSGQ1M5d8fQSsLGcyAAAAAs"]
[Sat Apr 11 01:43:26.271532 2026] [:error] [pid 21568:tid 21591] [client 72.146.30.147:49744] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adk2voiz5v_ljZxkpR_BqAAAARM"]
[Sat Apr 11 01:43:26.745870 2026] [:error] [pid 21569:tid 21646] [client 72.146.30.147:49671] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adk2vnAvQTgvXJ6vHoqT3wAAAIE"]
[Sat Apr 11 01:43:27.205605 2026] [:error] [pid 21569:tid 21655] [client 72.146.30.147:32149] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adk2v3AvQTgvXJ6vHoqT4wAAAIo"]
[Sat Apr 11 01:43:27.679990 2026] [:error] [pid 21569:tid 21667] [client 72.146.30.147:43427] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adk2v3AvQTgvXJ6vHoqT5wAAAJE"]
[Sat Apr 11 01:43:28.172701 2026] [:error] [pid 21570:tid 21661] [client 72.146.30.147:49697] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adk2wDKs5t9xRSNL6cm_dgAAAEA"]
[Sat Apr 11 01:43:28.658538 2026] [:error] [pid 21568:tid 21579] [client 72.146.30.147:49770] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adk2wIiz5v_ljZxkpR_BtAAAAQc"]
[Sat Apr 11 01:43:29.146832 2026] [:error] [pid 21568:tid 21591] [client 72.146.30.147:49750] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adk2wYiz5v_ljZxkpR_BuAAAARM"]
[Sat Apr 11 01:43:29.607275 2026] [:error] [pid 21568:tid 21580] [client 72.146.30.147:43513] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adk2wYiz5v_ljZxkpR_BuwAAAQg"]
[Sat Apr 11 01:43:30.097575 2026] [:error] [pid 21706:tid 21729] [client 72.146.30.147:36549] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adk2wiGQ1M5d8fQSsLGczgAAABU"]
[Sat Apr 11 01:43:30.590586 2026] [:error] [pid 21570:tid 21663] [client 72.146.30.147:43414] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adk2wjKs5t9xRSNL6cm_hgAAAEE"]
[Sat Apr 11 01:43:31.059110 2026] [:error] [pid 21570:tid 21668] [client 72.146.30.147:43505] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adk2wzKs5t9xRSNL6cm_iQAAAEM"]
[Sat Apr 11 01:43:31.537580 2026] [:error] [pid 21569:tid 21669] [client 72.146.30.147:43440] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hanyatersenyum.php"] [unique_id "adk2w3AvQTgvXJ6vHoqT9AAAAJI"]
[Sat Apr 11 01:43:32.059751 2026] [:error] [pid 21568:tid 21586] [client 72.146.30.147:43454] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hanyatersenyum.php"] [unique_id "adk2xIiz5v_ljZxkpR_BwgAAAQ4"]
[Sat Apr 11 01:43:32.519534 2026] [:error] [pid 21568:tid 21591] [client 72.146.30.147:49754] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hanyatersenyum.php"] [unique_id "adk2xIiz5v_ljZxkpR_BxQAAARM"]
[Sat Apr 11 01:43:33.049373 2026] [:error] [pid 21570:tid 21691] [client 72.146.30.147:43447] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hanyatersenyum.php"] [unique_id "adk2xTKs5t9xRSNL6cm_kwAAAFE"]
[Sat Apr 11 01:43:33.526751 2026] [:error] [pid 21706:tid 21719] [client 72.146.30.147:49684] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adk2xSGQ1M5d8fQSsLGc0AAAAAs"]
[Sat Apr 11 01:43:33.998570 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:43483] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adk2xXApxuyB7yCS5Rn5XAAAAM0"]
[Sat Apr 11 01:43:34.486079 2026] [:error] [pid 21568:tid 21591] [client 72.146.30.147:43442] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adk2xoiz5v_ljZxkpR_B0gAAARM"]
[Sat Apr 11 01:43:34.947930 2026] [:error] [pid 21706:tid 21729] [client 72.146.30.147:36549] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adk2xiGQ1M5d8fQSsLGc2QAAABU"]
[Sat Apr 11 01:43:35.411082 2026] [:error] [pid 21569:tid 21653] [client 72.146.30.147:43488] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upll22.php"] [unique_id "adk2x3AvQTgvXJ6vHoqUCAAAAIg"]
[Sat Apr 11 01:43:35.877355 2026] [:error] [pid 21568:tid 21581] [client 72.146.30.147:37288] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upll22.php"] [unique_id "adk2x4iz5v_ljZxkpR_B2gAAAQk"]
[Sat Apr 11 01:43:36.346489 2026] [:error] [pid 55451:tid 55455] [client 72.146.30.147:43422] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upll22.php"] [unique_id "adk2yHApxuyB7yCS5Rn5YQAAAMI"]
[Sat Apr 11 01:43:36.847407 2026] [:error] [pid 21706:tid 21716] [client 72.146.30.147:49672] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/upll22.php"] [unique_id "adk2yCGQ1M5d8fQSsLGc5AAAAAg"]
[Sat Apr 11 01:43:37.324552 2026] [:error] [pid 21568:tid 21594] [client 72.146.30.147:49711] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adk2yYiz5v_ljZxkpR_B4AAAARY"]
[Sat Apr 11 01:43:37.784743 2026] [:error] [pid 21706:tid 21711] [client 72.146.30.147:43450] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adk2ySGQ1M5d8fQSsLGc5gAAAAM"]
[Sat Apr 11 01:43:38.246684 2026] [:error] [pid 21570:tid 21698] [client 72.146.30.147:49694] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adk2yjKs5t9xRSNL6cm_ngAAAFg"]
[Sat Apr 11 01:43:38.718092 2026] [:error] [pid 21706:tid 21723] [client 72.146.30.147:43406] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adk2yiGQ1M5d8fQSsLGc6QAAAA8"]
[Sat Apr 11 01:43:39.219757 2026] [:error] [pid 21568:tid 21594] [client 72.146.30.147:43481] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adk2y4iz5v_ljZxkpR_B8QAAARY"]
[Sat Apr 11 01:43:39.748331 2026] [:error] [pid 21570:tid 21697] [client 72.146.30.147:43464] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adk2yzKs5t9xRSNL6cm_oQAAAFc"]
[Sat Apr 11 01:43:40.225891 2026] [:error] [pid 21568:tid 21577] [client 72.146.30.147:43502] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adk2zIiz5v_ljZxkpR_B9wAAAQU"]
[Sat Apr 11 01:43:40.711961 2026] [:error] [pid 21706:tid 21716] [client 72.146.30.147:37275] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adk2zCGQ1M5d8fQSsLGc9AAAAAg"]
[Sat Apr 11 01:43:41.175558 2026] [:error] [pid 21568:tid 21585] [client 72.146.30.147:43484] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-243.php"] [unique_id "adk2zYiz5v_ljZxkpR_B-QAAAQ0"]
[Sat Apr 11 01:43:41.692969 2026] [:error] [pid 21706:tid 21724] [client 72.146.30.147:43468] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-243.php"] [unique_id "adk2zSGQ1M5d8fQSsLGc_AAAABA"]
[Sat Apr 11 01:43:42.160833 2026] [:error] [pid 21568:tid 21586] [client 72.146.30.147:43429] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-243.php"] [unique_id "adk2zoiz5v_ljZxkpR_B_AAAAQ4"]
[Sat Apr 11 01:43:42.623929 2026] [:error] [pid 21568:tid 21593] [client 72.146.30.147:49751] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-243.php"] [unique_id "adk2zoiz5v_ljZxkpR_CAgAAARU"]
[Sat Apr 11 01:43:43.127033 2026] [:error] [pid 21706:tid 21714] [client 72.146.30.147:43475] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adk2zyGQ1M5d8fQSsLGdBQAAAAY"]
[Sat Apr 11 01:43:43.638694 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:49757] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adk2z3ApxuyB7yCS5Rn5dAAAANU"]
[Sat Apr 11 01:43:44.104313 2026] [:error] [pid 21568:tid 21573] [client 72.146.30.147:43423] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adk20Iiz5v_ljZxkpR_CCAAAAQE"]
[Sat Apr 11 01:43:44.566774 2026] [:error] [pid 21706:tid 21711] [client 72.146.30.147:36559] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adk20CGQ1M5d8fQSsLGdEgAAAAM"]
[Sat Apr 11 01:43:45.049083 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:43467] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "adk20XApxuyB7yCS5Rn5egAAAM0"]
[Sat Apr 11 01:43:45.544326 2026] [:error] [pid 21568:tid 21582] [client 72.146.30.147:49681] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "adk20Yiz5v_ljZxkpR_CCwAAAQo"]
[Sat Apr 11 01:43:46.009073 2026] [:error] [pid 21569:tid 21660] [client 72.146.30.147:43479] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "adk20nAvQTgvXJ6vHoqUEgAAAI4"]
[Sat Apr 11 01:43:46.491398 2026] [:error] [pid 21570:tid 21677] [client 72.146.30.147:43424] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "adk20jKs5t9xRSNL6cm_qgAAAEg"]
[Sat Apr 11 01:43:46.987937 2026] [:error] [pid 21569:tid 21669] [client 72.146.30.147:43413] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adk20nAvQTgvXJ6vHoqUFwAAAJI"]
[Sat Apr 11 01:43:47.517504 2026] [:error] [pid 21569:tid 21646] [client 72.146.30.147:37265] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adk203AvQTgvXJ6vHoqUHAAAAIE"]
[Sat Apr 11 01:43:48.004655 2026] [:error] [pid 21570:tid 21681] [client 72.146.30.147:49698] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adk21DKs5t9xRSNL6cm_sAAAAEo"]
[Sat Apr 11 01:43:48.465789 2026] [:error] [pid 21570:tid 21693] [client 72.146.30.147:43470] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX1.php"] [unique_id "adk21DKs5t9xRSNL6cm_swAAAFM"]
[Sat Apr 11 01:43:48.941953 2026] [:error] [pid 21568:tid 21584] [client 72.146.30.147:37257] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adk21Iiz5v_ljZxkpR_CEQAAAQw"]
[Sat Apr 11 01:43:49.421053 2026] [:error] [pid 55451:tid 55472] [client 72.146.30.147:43409] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adk21XApxuyB7yCS5Rn5igAAANM"]
[Sat Apr 11 01:43:49.882284 2026] [:error] [pid 21706:tid 21724] [client 72.146.30.147:49706] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adk21SGQ1M5d8fQSsLGdIQAAABA"]
[Sat Apr 11 01:43:50.352752 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:49704] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adk21nApxuyB7yCS5Rn5lAAAANU"]
[Sat Apr 11 01:43:50.820295 2026] [:error] [pid 55451:tid 55455] [client 72.146.30.147:43489] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adk21nApxuyB7yCS5Rn5mgAAAMI"]
[Sat Apr 11 01:43:51.399540 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:37250] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adk213ApxuyB7yCS5Rn5oAAAANU"]
[Sat Apr 11 01:43:51.861714 2026] [:error] [pid 21568:tid 21589] [client 72.146.30.147:43399] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adk214iz5v_ljZxkpR_CFwAAARE"]
[Sat Apr 11 01:43:52.415670 2026] [:error] [pid 21568:tid 21578] [client 72.146.30.147:49691] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adk22Iiz5v_ljZxkpR_CGAAAAQY"]
[Sat Apr 11 01:43:52.880890 2026] [:error] [pid 21706:tid 21729] [client 72.146.30.147:37264] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adk22CGQ1M5d8fQSsLGdKAAAABU"]
[Sat Apr 11 01:43:53.432205 2026] [:error] [pid 55451:tid 55453] [client 72.146.30.147:43446] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adk22XApxuyB7yCS5Rn5qwAAAMA"]
[Sat Apr 11 01:43:53.898214 2026] [:error] [pid 21569:tid 21683] [client 72.146.30.147:37306] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adk22XAvQTgvXJ6vHoqUIwAAAJg"]
[Sat Apr 11 01:43:54.394364 2026] [:error] [pid 21706:tid 21728] [client 72.146.30.147:49690] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adk22iGQ1M5d8fQSsLGdMQAAABQ"]
[Sat Apr 11 01:43:55.189959 2026] [:error] [pid 21706:tid 21723] [client 72.146.30.147:43412] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk22yGQ1M5d8fQSsLGdNwAAAA8"]
[Sat Apr 11 01:43:55.781975 2026] [:error] [pid 21568:tid 21575] [client 72.146.30.147:37279] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk224iz5v_ljZxkpR_CJgAAAQM"]
[Sat Apr 11 01:43:56.356986 2026] [:error] [pid 21568:tid 21594] [client 72.146.30.147:43472] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk23Iiz5v_ljZxkpR_CKQAAARY"]
[Sat Apr 11 01:43:57.185937 2026] [:error] [pid 21570:tid 21673] [client 72.146.30.147:36586] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk23TKs5t9xRSNL6cm_vQAAAEY"]
[Sat Apr 11 01:43:57.648849 2026] [:error] [pid 21706:tid 21721] [client 72.146.30.147:32134] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adk23SGQ1M5d8fQSsLGdQQAAAA0"]
[Sat Apr 11 01:43:58.180850 2026] [:error] [pid 21568:tid 21581] [client 72.146.30.147:43482] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adk23oiz5v_ljZxkpR_CLgAAAQk"]
[Sat Apr 11 01:43:58.663525 2026] [:error] [pid 55451:tid 55465] [client 72.146.30.147:37261] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adk23nApxuyB7yCS5Rn5uQAAAMw"]
[Sat Apr 11 01:43:59.226557 2026] [:error] [pid 21568:tid 21575] [client 72.146.30.147:49771] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adk234iz5v_ljZxkpR_CMwAAAQM"]
[Sat Apr 11 01:43:59.702276 2026] [:error] [pid 55451:tid 55477] [client 72.146.30.147:49700] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adk233ApxuyB7yCS5Rn5vgAAANg"]
[Sat Apr 11 01:44:00.197469 2026] [:error] [pid 21569:tid 21653] [client 72.146.30.147:36591] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adk24HAvQTgvXJ6vHoqUOQAAAIg"]
[Sat Apr 11 01:44:00.693839 2026] [:error] [pid 21569:tid 21659] [client 72.146.30.147:43416] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adk24HAvQTgvXJ6vHoqUOgAAAI0"]
[Sat Apr 11 01:44:01.154920 2026] [:error] [pid 21570:tid 21670] [client 72.146.30.147:36553] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adk24TKs5t9xRSNL6cm_xwAAAEQ"]
[Sat Apr 11 01:44:01.654734 2026] [:error] [pid 21569:tid 21651] [client 72.146.30.147:37260] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adk24XAvQTgvXJ6vHoqUQgAAAIY"]
[Sat Apr 11 01:44:02.120556 2026] [:error] [pid 21570:tid 21682] [client 72.146.30.147:43476] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adk24jKs5t9xRSNL6cm_zgAAAEs"]
[Sat Apr 11 01:44:02.579887 2026] [:error] [pid 21570:tid 21681] [client 72.146.30.147:37291] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adk24jKs5t9xRSNL6cm_0QAAAEo"]
[Sat Apr 11 01:44:03.064323 2026] [:error] [pid 21570:tid 21687] [client 72.146.30.147:43486] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adk24zKs5t9xRSNL6cm_2QAAAE0"]
[Sat Apr 11 01:44:03.548289 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:49714] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adk243ApxuyB7yCS5Rn5xwAAANI"]
[Sat Apr 11 01:44:04.018457 2026] [:error] [pid 21706:tid 21724] [client 72.146.30.147:49709] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adk25CGQ1M5d8fQSsLGdUQAAABA"]
[Sat Apr 11 01:44:04.562362 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:37257] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adk25HApxuyB7yCS5Rn5zAAAAMg"]
[Sat Apr 11 01:44:05.045694 2026] [:error] [pid 55451:tid 55456] [client 72.146.30.147:37285] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adk25XApxuyB7yCS5Rn5zwAAAMM"]
[Sat Apr 11 01:44:05.523581 2026] [:error] [pid 55451:tid 55458] [client 72.146.30.147:43460] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adk25XApxuyB7yCS5Rn51AAAAMU"]
[Sat Apr 11 01:44:06.033289 2026] [:error] [pid 21570:tid 21696] [client 72.146.30.147:43453] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adk25jKs5t9xRSNL6cm_3AAAAFY"]
[Sat Apr 11 01:44:06.513087 2026] [:error] [pid 21570:tid 21692] [client 72.146.30.147:37267] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adk25jKs5t9xRSNL6cm_3gAAAFI"]
[Sat Apr 11 01:44:06.976650 2026] [:error] [pid 55451:tid 55464] [client 72.146.30.147:49776] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adk25nApxuyB7yCS5Rn53gAAAMs"]
[Sat Apr 11 01:44:07.474014 2026] [:error] [pid 21568:tid 21576] [client 72.146.30.147:37284] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adk254iz5v_ljZxkpR_CSAAAAQQ"]
[Sat Apr 11 01:44:07.939687 2026] [:error] [pid 21568:tid 21596] [client 72.146.30.147:43420] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adk254iz5v_ljZxkpR_CTAAAARg"]
[Sat Apr 11 01:44:08.429035 2026] [:error] [pid 21568:tid 21587] [client 72.146.30.147:36557] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adk26Iiz5v_ljZxkpR_CUQAAAQ8"]
[Sat Apr 11 01:44:09.006637 2026] [:error] [pid 21568:tid 21586] [client 72.146.30.147:49689] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adk26Yiz5v_ljZxkpR_CWAAAAQ4"]
[Sat Apr 11 01:44:09.500132 2026] [:error] [pid 55451:tid 55467] [client 72.146.30.147:49728] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adk26XApxuyB7yCS5Rn55QAAAM4"]
[Sat Apr 11 01:44:09.982331 2026] [:error] [pid 21568:tid 21582] [client 72.146.30.147:43519] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adk26Yiz5v_ljZxkpR_CYgAAAQo"]
[Sat Apr 11 01:44:10.460566 2026] [:error] [pid 21706:tid 21730] [client 72.146.30.147:43459] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adk26iGQ1M5d8fQSsLGdXQAAABY"]
[Sat Apr 11 01:44:10.939755 2026] [:error] [pid 21706:tid 21732] [client 72.146.30.147:37252] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adk26iGQ1M5d8fQSsLGdYAAAABg"]
[Sat Apr 11 01:44:11.404501 2026] [:error] [pid 21568:tid 21575] [client 72.146.30.147:43437] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adk264iz5v_ljZxkpR_CaAAAAQM"]
[Sat Apr 11 01:44:11.865383 2026] [:error] [pid 55451:tid 55464] [client 72.146.30.147:43507] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adk263ApxuyB7yCS5Rn56gAAAMs"]
[Sat Apr 11 01:44:12.329402 2026] [:error] [pid 21568:tid 21581] [client 72.146.30.147:49673] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adk27Iiz5v_ljZxkpR_CbgAAAQk"]
[Sat Apr 11 01:44:12.808002 2026] [:error] [pid 21568:tid 21592] [client 72.146.30.147:43497] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adk27Iiz5v_ljZxkpR_CcgAAARQ"]
[Sat Apr 11 01:44:13.278446 2026] [:error] [pid 21569:tid 21664] [client 72.146.30.147:37295] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adk27XAvQTgvXJ6vHoqUUwAAAJA"]
[Sat Apr 11 01:44:13.770123 2026] [:error] [pid 21568:tid 21575] [client 72.146.30.147:36567] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adk27Yiz5v_ljZxkpR_CdQAAAQM"]
[Sat Apr 11 01:44:14.234694 2026] [:error] [pid 21569:tid 21667] [client 72.146.30.147:43449] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adk27nAvQTgvXJ6vHoqUVAAAAJE"]
[Sat Apr 11 01:44:14.831712 2026] [:error] [pid 21569:tid 21683] [client 72.146.30.147:43428] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adk27nAvQTgvXJ6vHoqUWAAAAJg"]
[Sat Apr 11 01:44:15.292447 2026] [:error] [pid 21569:tid 21662] [client 72.146.30.147:36558] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adk273AvQTgvXJ6vHoqUWwAAAI8"]
[Sat Apr 11 01:44:15.790275 2026] [:error] [pid 55451:tid 55473] [client 72.146.30.147:43508] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adk273ApxuyB7yCS5Rn58gAAANQ"]
[Sat Apr 11 01:44:16.265684 2026] [:error] [pid 55451:tid 55460] [client 72.146.30.147:32137] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adk28HApxuyB7yCS5Rn59AAAAMc"]
[Sat Apr 11 01:44:16.850836 2026] [:error] [pid 55451:tid 55470] [client 72.146.30.147:43407] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adk28HApxuyB7yCS5Rn5_QAAANE"]
[Sat Apr 11 01:44:17.355736 2026] [:error] [pid 21568:tid 21580] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Apr 11 01:44:17.598989 2026] [:error] [pid 21568:tid 21579] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Sat Apr 11 01:44:17.873096 2026] [:error] [pid 21568:tid 21589] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sat Apr 11 01:44:18.114344 2026] [:error] [pid 21568:tid 21578] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Apr 11 01:44:18.347675 2026] [:error] [pid 21568:tid 21593] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Sat Apr 11 01:44:18.619555 2026] [:error] [pid 21568:tid 21575] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sat Apr 11 01:44:18.853291 2026] [:error] [pid 21568:tid 21573] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Apr 11 01:44:19.088609 2026] [:error] [pid 21568:tid 21583] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Sat Apr 11 01:44:19.335535 2026] [:error] [pid 21568:tid 21574] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Sat Apr 11 01:44:19.581709 2026] [:error] [pid 21568:tid 21584] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Sat Apr 11 01:44:19.815349 2026] [:error] [pid 21568:tid 21592] [client 72.146.30.147:43394] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Sat Apr 11 01:44:20.046402 2026] [:error] [pid 21568:tid 21578] [client 72.146.30.147:43394] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adk29Iiz5v_ljZxkpR_CkQAAAQY"]
[Sat Apr 11 01:44:20.505760 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:43466] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adk29HApxuyB7yCS5Rn6DQAAANI"]
[Sat Apr 11 01:44:20.980597 2026] [:error] [pid 55451:tid 55473] [client 72.146.30.147:49703] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adk29HApxuyB7yCS5Rn6EAAAANQ"]
[Sat Apr 11 01:44:21.450452 2026] [:error] [pid 55451:tid 55454] [client 72.146.30.147:32162] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adk29XApxuyB7yCS5Rn6FwAAAME"]
[Sat Apr 11 01:44:21.913462 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:36600] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adk29XApxuyB7yCS5Rn6HgAAAMk"]
[Sat Apr 11 01:44:22.415912 2026] [:error] [pid 21706:tid 21713] [client 72.146.30.147:43518] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adk29iGQ1M5d8fQSsLGdcgAAAAU"]
[Sat Apr 11 01:44:23.130225 2026] [:error] [pid 21568:tid 21587] [client 72.146.30.147:43400] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adk294iz5v_ljZxkpR_ClAAAAQ8"]
[Sat Apr 11 01:44:23.712086 2026] [:error] [pid 55451:tid 55453] [client 72.146.30.147:43451] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adk293ApxuyB7yCS5Rn6JgAAAMA"]
[Sat Apr 11 01:44:24.355518 2026] [:error] [pid 21706:tid 21727] [client 72.146.30.147:36563] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adk2-CGQ1M5d8fQSsLGddAAAABM"]
[Sat Apr 11 01:44:24.823202 2026] [:error] [pid 21570:tid 21685] [client 72.146.30.147:37272] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adk2-DKs5t9xRSNL6cm_7wAAAEw"]
[Sat Apr 11 01:44:25.370539 2026] [:error] [pid 55451:tid 55456] [client 72.146.30.147:43496] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adk2-XApxuyB7yCS5Rn6LgAAAMM"]
[Sat Apr 11 01:44:25.861923 2026] [:error] [pid 55451:tid 55458] [client 72.146.30.147:36602] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adk2-XApxuyB7yCS5Rn6NgAAAMU"]
[Sat Apr 11 01:44:26.481466 2026] [:error] [pid 21569:tid 21649] [client 72.146.30.147:36551] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adk2-nAvQTgvXJ6vHoqUewAAAIQ"]
[Sat Apr 11 01:44:26.940765 2026] [:error] [pid 21570:tid 21679] [client 72.146.30.147:37266] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adk2-jKs5t9xRSNL6cm_8wAAAEk"]
[Sat Apr 11 01:44:27.447530 2026] [:error] [pid 21570:tid 21690] [client 72.146.30.147:43503] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adk2-zKs5t9xRSNL6cm_9wAAAFA"]
[Sat Apr 11 01:44:28.068133 2026] [:error] [pid 21568:tid 21574] [client 72.146.30.147:43438] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adk2_Iiz5v_ljZxkpR_CoQAAAQI"]
[Sat Apr 11 01:44:28.529464 2026] [:error] [pid 21569:tid 21647] [client 72.146.30.147:37304] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adk2_HAvQTgvXJ6vHoqUgAAAAII"]
[Sat Apr 11 01:44:29.000058 2026] [:error] [pid 21570:tid 21688] [client 72.146.30.147:43410] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adk2_DKs5t9xRSNL6cnAAAAAAE4"]
[Sat Apr 11 01:44:29.460474 2026] [:error] [pid 21570:tid 21685] [client 72.146.30.147:43419] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adk2_TKs5t9xRSNL6cnAAgAAAEw"]
[Sat Apr 11 01:44:29.955907 2026] [:error] [pid 21570:tid 21679] [client 72.146.30.147:37303] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adk2_TKs5t9xRSNL6cnABAAAAEk"]
[Sat Apr 11 01:44:30.424077 2026] [:error] [pid 55451:tid 55463] [client 72.146.30.147:36593] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk2_nApxuyB7yCS5Rn6PwAAAMo"]
[Sat Apr 11 01:44:30.916052 2026] [:error] [pid 21706:tid 21722] [client 72.146.30.147:43418] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk2_iGQ1M5d8fQSsLGddgAAAA4"]
[Sat Apr 11 01:44:31.481940 2026] [:error] [pid 21568:tid 21573] [client 72.146.30.147:36552] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk2_4iz5v_ljZxkpR_CqQAAAQE"]
[Sat Apr 11 01:44:31.956452 2026] [:error] [pid 21568:tid 21591] [client 72.146.30.147:36554] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adk2_4iz5v_ljZxkpR_CrAAAARM"]
[Sat Apr 11 01:44:32.456769 2026] [:error] [pid 21568:tid 21585] [client 72.146.30.147:37277] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adk3AIiz5v_ljZxkpR_CswAAAQ0"]
[Sat Apr 11 01:44:32.975470 2026] [:error] [pid 55451:tid 55457] [client 72.146.30.147:43515] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adk3AHApxuyB7yCS5Rn6RAAAAMQ"]
[Sat Apr 11 01:44:33.450469 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:36567] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adk3AXApxuyB7yCS5Rn6RgAAAMk"]
[Sat Apr 11 01:44:34.021120 2026] [:error] [pid 21570:tid 21692] [client 72.146.30.147:43396] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adk3AjKs5t9xRSNL6cnACgAAAFI"]
[Sat Apr 11 01:44:34.494477 2026] [:error] [pid 21570:tid 21688] [client 72.146.30.147:49735] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "adk3AjKs5t9xRSNL6cnADQAAAE4"]
[Sat Apr 11 01:44:35.748366 2026] [:error] [pid 55451:tid 55455] [client 72.146.30.147:36565] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "adk3A3ApxuyB7yCS5Rn6TwAAAMI"]
[Sat Apr 11 01:44:36.214490 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:49787] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "adk3BHApxuyB7yCS5Rn6VAAAAMk"]
[Sat Apr 11 01:44:36.681510 2026] [:error] [pid 21569:tid 21664] [client 72.146.30.147:36597] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gptsh.php"] [unique_id "adk3BHAvQTgvXJ6vHoqUmgAAAJA"]
[Sat Apr 11 01:44:37.162307 2026] [:error] [pid 55451:tid 55467] [client 72.146.30.147:49701] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adk3BXApxuyB7yCS5Rn6WwAAAM4"]
[Sat Apr 11 01:44:37.637482 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:43506] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adk3BXApxuyB7yCS5Rn6XgAAANU"]
[Sat Apr 11 01:44:38.235749 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:43431] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adk3BnApxuyB7yCS5Rn6YwAAAM0"]
[Sat Apr 11 01:44:38.727015 2026] [:error] [pid 21568:tid 21581] [client 72.146.30.147:36568] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adk3Boiz5v_ljZxkpR_CvwAAAQk"]
[Sat Apr 11 01:44:39.186230 2026] [:error] [pid 55451:tid 55467] [client 72.146.30.147:49670] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "adk3B3ApxuyB7yCS5Rn6awAAAM4"]
[Sat Apr 11 01:44:39.667640 2026] [:error] [pid 21570:tid 21673] [client 72.146.30.147:37300] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "adk3BzKs5t9xRSNL6cnAFAAAAEY"]
[Sat Apr 11 01:44:40.151166 2026] [:error] [pid 21568:tid 21573] [client 72.146.30.147:43398] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "adk3CIiz5v_ljZxkpR_CxQAAAQE"]
[Sat Apr 11 01:44:40.623581 2026] [:error] [pid 55451:tid 55462] [client 72.146.30.147:43504] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sid3.php"] [unique_id "adk3CHApxuyB7yCS5Rn6eAAAAMk"]
[Sat Apr 11 01:44:41.127083 2026] [:error] [pid 55451:tid 55469] [client 72.146.30.147:31011] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adk3CXApxuyB7yCS5Rn6egAAANA"]
[Sat Apr 11 01:44:41.774071 2026] [:error] [pid 55451:tid 55475] [client 72.146.30.147:43469] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adk3CXApxuyB7yCS5Rn6ggAAANY"]
[Sat Apr 11 01:44:42.252539 2026] [:error] [pid 55451:tid 55473] [client 72.146.30.147:36572] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adk3CnApxuyB7yCS5Rn6iAAAANQ"]
[Sat Apr 11 01:44:42.729621 2026] [:error] [pid 21568:tid 21595] [client 72.146.30.147:30981] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adk3Coiz5v_ljZxkpR_CyAAAARc"]
[Sat Apr 11 01:44:43.220893 2026] [:error] [pid 21568:tid 21591] [client 72.146.30.147:37248] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "adk3C4iz5v_ljZxkpR_CygAAARM"]
[Sat Apr 11 01:44:43.706975 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:36579] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "adk3C3ApxuyB7yCS5Rn6lAAAANI"]
[Sat Apr 11 01:44:44.172363 2026] [:error] [pid 21706:tid 21710] [client 72.146.30.147:49692] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "adk3DCGQ1M5d8fQSsLGdgwAAAAI"]
[Sat Apr 11 01:44:44.640429 2026] [:error] [pid 55451:tid 55477] [client 72.146.30.147:37290] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Cap.php"] [unique_id "adk3DHApxuyB7yCS5Rn6mQAAANg"]
[Sat Apr 11 01:44:45.134842 2026] [:error] [pid 21706:tid 21721] [client 72.146.30.147:37286] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adk3DSGQ1M5d8fQSsLGdhwAAAA0"]
[Sat Apr 11 01:44:45.620982 2026] [:error] [pid 21706:tid 21716] [client 72.146.30.147:49710] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adk3DSGQ1M5d8fQSsLGdiwAAAAg"]
[Sat Apr 11 01:44:46.091123 2026] [:error] [pid 55451:tid 55471] [client 72.146.30.147:37308] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adk3DnApxuyB7yCS5Rn6ogAAANI"]
[Sat Apr 11 01:44:46.605699 2026] [:error] [pid 21569:tid 21664] [client 72.146.30.147:37256] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adk3DnAvQTgvXJ6vHoqUpgAAAJA"]
[Sat Apr 11 01:44:47.126006 2026] [:error] [pid 55451:tid 55461] [client 72.146.30.147:43415] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adk3D3ApxuyB7yCS5Rn6rQAAAMg"]
[Sat Apr 11 01:44:47.588040 2026] [:error] [pid 21706:tid 21730] [client 72.146.30.147:49665] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adk3DyGQ1M5d8fQSsLGdjgAAABY"]
[Sat Apr 11 01:44:48.237848 2026] [:error] [pid 55451:tid 55460] [client 72.146.30.147:43430] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adk3EHApxuyB7yCS5Rn6tAAAAMc"]
[Sat Apr 11 01:44:48.699695 2026] [:error] [pid 55451:tid 55472] [client 72.146.30.147:43485] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adk3EHApxuyB7yCS5Rn6tgAAANM"]
[Sat Apr 11 01:44:49.186085 2026] [:error] [pid 55451:tid 55474] [client 72.146.30.147:49749] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adk3EXApxuyB7yCS5Rn6uQAAANU"]
[Sat Apr 11 01:44:49.652712 2026] [:error] [pid 21570:tid 21692] [client 72.146.30.147:49755] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adk3ETKs5t9xRSNL6cnAHwAAAFI"]
[Sat Apr 11 01:44:50.125484 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:31013] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adk3EnApxuyB7yCS5Rn6vAAAAM0"]
[Sat Apr 11 01:44:50.702532 2026] [:error] [pid 55451:tid 55469] [client 72.146.30.147:43434] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adk3EnApxuyB7yCS5Rn6wgAAANA"]
[Sat Apr 11 01:44:51.305521 2026] [:error] [pid 55451:tid 55466] [client 72.146.30.147:36604] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "adk3E3ApxuyB7yCS5Rn6zAAAAM0"]
[Sat Apr 11 01:44:51.794744 2026] [:error] [pid 21569:tid 21648] [client 72.146.30.147:43448] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "adk3E3AvQTgvXJ6vHoqUrAAAAIM"]
[Sat Apr 11 01:44:52.412940 2026] [:error] [pid 55451:tid 55459] [client 72.146.30.147:37255] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "adk3FHApxuyB7yCS5Rn60gAAAMY"]
[Sat Apr 11 01:44:52.901122 2026] [:error] [pid 55451:tid 55454] [client 72.146.30.147:37262] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zoper1.php"] [unique_id "adk3FHApxuyB7yCS5Rn62AAAAME"]
[Sat Apr 11 01:44:53.394751 2026] [:error] [pid 21569:tid 21652] [client 72.146.30.147:36582] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "adk3FXAvQTgvXJ6vHoqUrwAAAIc"]
[Sat Apr 11 01:44:53.938711 2026] [:error] [pid 21570:tid 21677] [client 72.146.30.147:36556] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "adk3FTKs5t9xRSNL6cnAKAAAAEg"]
[Sat Apr 11 01:44:54.613714 2026] [:error] [pid 21706:tid 21720] [client 72.146.30.147:36576] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "adk3FiGQ1M5d8fQSsLGdngAAAAw"]
[Sat Apr 11 01:44:55.086594 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:37292] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws.php"] [unique_id "adk3FyGQ1M5d8fQSsLGdpgAAAAA"]
[Sat Apr 11 01:44:55.600044 2026] [:error] [pid 21706:tid 21732] [client 72.146.30.147:37311] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adk3FyGQ1M5d8fQSsLGdqgAAABg"]
[Sat Apr 11 01:44:56.064334 2026] [:error] [pid 21569:tid 21674] [client 72.146.30.147:27232] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adk3GHAvQTgvXJ6vHoqUuQAAAJQ"]
[Sat Apr 11 01:44:56.526168 2026] [:error] [pid 21706:tid 21723] [client 72.146.30.147:32151] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adk3GCGQ1M5d8fQSsLGdsAAAAA8"]
[Sat Apr 11 01:44:56.990702 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:37270] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ortasekerli1.php"] [unique_id "adk3GCGQ1M5d8fQSsLGdswAAAAA"]
[Sat Apr 11 01:44:57.455117 2026] [:error] [pid 21570:tid 21687] [client 72.146.30.147:31033] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adk3GTKs5t9xRSNL6cnALwAAAE0"]
[Sat Apr 11 01:44:57.962346 2026] [:error] [pid 21570:tid 21679] [client 72.146.30.147:36571] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adk3GTKs5t9xRSNL6cnAMQAAAEk"]
[Sat Apr 11 01:44:58.430825 2026] [:error] [pid 21568:tid 21582] [client 72.146.30.147:36585] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adk3Goiz5v_ljZxkpR_C6QAAAQo"]
[Sat Apr 11 01:44:58.899038 2026] [:error] [pid 21706:tid 21729] [client 72.146.30.147:37287] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adk3GiGQ1M5d8fQSsLGdvAAAABU"]
[Sat Apr 11 01:44:59.376766 2026] [:error] [pid 21706:tid 21717] [client 72.146.30.147:37251] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adk3GyGQ1M5d8fQSsLGdvwAAAAk"]
[Sat Apr 11 01:44:59.836644 2026] [:error] [pid 21569:tid 21652] [client 72.146.30.147:36545] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adk3G3AvQTgvXJ6vHoqUwgAAAIc"]
[Sat Apr 11 01:45:00.304882 2026] [:error] [pid 21706:tid 21716] [client 72.146.30.147:36580] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adk3HCGQ1M5d8fQSsLGdxwAAAAg"]
[Sat Apr 11 01:45:00.835978 2026] [:error] [pid 21568:tid 21578] [client 72.146.30.147:32154] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adk3HIiz5v_ljZxkpR_C7gAAAQY"]
[Sat Apr 11 01:45:01.345669 2026] [:error] [pid 21706:tid 21712] [client 72.146.30.147:32174] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adk3HSGQ1M5d8fQSsLGdzQAAAAQ"]
[Sat Apr 11 01:45:01.822817 2026] [:error] [pid 21706:tid 21708] [client 72.146.30.147:36599] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adk3HSGQ1M5d8fQSsLGd0wAAAAA"]
[Sat Apr 11 01:45:02.287687 2026] [:error] [pid 21568:tid 21572] [client 72.146.30.147:36562] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adk3Hoiz5v_ljZxkpR_C8QAAAQA"]
[Sat Apr 11 01:45:02.889316 2026] [:error] [pid 21568:tid 21589] [client 72.146.30.147:37293] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adk3Hoiz5v_ljZxkpR_C8wAAARE"]
[Sat Apr 11 01:45:03.408229 2026] [:error] [pid 55451:tid 55472] [client 72.146.30.147:49773] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adk3H3ApxuyB7yCS5Rn67AAAANM"]
[Sat Apr 11 01:45:03.887173 2026] [:error] [pid 21706:tid 21712] [client 72.146.30.147:37273] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adk3HyGQ1M5d8fQSsLGd2QAAAAQ"]
[Sat Apr 11 01:45:04.572271 2026] [:error] [pid 21706:tid 21727] [client 72.146.30.147:43397] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adk3ICGQ1M5d8fQSsLGd4gAAABM"]
[Sat Apr 11 01:45:05.032307 2026] [:error] [pid 21569:tid 21660] [client 72.146.30.147:32133] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adk3IXAvQTgvXJ6vHoqUywAAAI4"]
[Sat Apr 11 01:45:05.514544 2026] [:error] [pid 21569:tid 21648] [client 72.146.30.147:43469] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adk3IXAvQTgvXJ6vHoqUzgAAAIM"]
[Sat Apr 11 01:45:05.979075 2026] [:error] [pid 21568:tid 21588] [client 72.146.30.147:37289] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adk3IYiz5v_ljZxkpR_C_gAAARA"]
[Sat Apr 11 01:45:06.468766 2026] [:error] [pid 21569:tid 21655] [client 72.146.30.147:37296] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adk3InAvQTgvXJ6vHoqU0wAAAIo"]
[Sat Apr 11 01:45:06.942825 2026] [:error] [pid 21570:tid 21689] [client 72.146.30.147:36546] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adk3IjKs5t9xRSNL6cnAPAAAAE8"]
[Sat Apr 11 01:45:07.406478 2026] [:error] [pid 21570:tid 21673] [client 72.146.30.147:36577] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adk3IzKs5t9xRSNL6cnAPgAAAEY"]
[Sat Apr 11 01:45:07.945311 2026] [:error] [pid 21568:tid 21594] [client 72.146.30.147:32190] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adk3I4iz5v_ljZxkpR_DCQAAARY"]
[Sat Apr 11 01:45:08.446750 2026] [:error] [pid 21706:tid 21721] [client 72.146.30.147:31026] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adk3JCGQ1M5d8fQSsLGd7wAAAA0"]
[Sat Apr 11 01:45:09.004763 2026] [:error] [pid 55451:tid 55477] [client 72.146.30.147:32129] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adk3JXApxuyB7yCS5Rn69QAAANg"]
[Sat Apr 11 01:45:09.537345 2026] [:error] [pid 21568:tid 21572] [client 72.146.30.147:32139] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adk3JYiz5v_ljZxkpR_DEgAAAQA"]
[Sat Apr 11 01:45:10.125459 2026] [:error] [pid 21706:tid 21716] [client 72.146.30.147:36573] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adk3JiGQ1M5d8fQSsLGd9gAAAAg"]
[Sat Apr 11 01:45:10.629351 2026] [:error] [pid 21706:tid 21727] [client 72.146.30.147:43435] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adk3JiGQ1M5d8fQSsLGd-AAAABM"]
[Sat Apr 11 01:45:11.091557 2026] [:error] [pid 55451:tid 55464] [client 72.146.30.147:43502] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a4.php"] [unique_id "adk3J3ApxuyB7yCS5Rn6_gAAAMs"]
[Sat Apr 11 01:45:11.551020 2026] [:error] [pid 21568:tid 21587] [client 72.146.30.147:32155] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "adk3J4iz5v_ljZxkpR_DFwAAAQ8"]
[Sat Apr 11 01:45:12.009644 2026] [:error] [pid 21568:tid 21575] [client 72.146.30.147:37310] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "adk3KIiz5v_ljZxkpR_DGgAAAQM"]
[Sat Apr 11 01:45:12.582999 2026] [:error] [pid 55451:tid 55455] [client 72.146.30.147:32150] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "adk3KHApxuyB7yCS5Rn7BgAAAMI"]
[Sat Apr 11 01:45:13.069927 2026] [:error] [pid 21706:tid 21730] [client 72.146.30.147:32179] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jlex.php"] [unique_id "adk3KSGQ1M5d8fQSsLGeAwAAABY"]
[Sat Apr 11 01:45:13.563002 2026] [:error] [pid 21706:tid 21727] [client 72.146.30.147:32165] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adk3KSGQ1M5d8fQSsLGeCQAAABM"]
[Sat Apr 11 01:45:14.053178 2026] [:error] [pid 21569:tid 21646] [client 72.146.30.147:32132] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adk3KnAvQTgvXJ6vHoqU3gAAAIE"]
[Sat Apr 11 01:45:14.514865 2026] [:error] [pid 21569:tid 21678] [client 72.146.30.147:37259] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adk3KnAvQTgvXJ6vHoqU4AAAAJY"]
[Sat Apr 11 01:45:14.982155 2026] [:error] [pid 55451:tid 55456] [client 72.146.30.147:43462] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xsas.php"] [unique_id "adk3KnApxuyB7yCS5Rn7EwAAAMM"]
[Sat Apr 11 01:45:15.507930 2026] [:error] [pid 55451:tid 55472] [client 72.146.30.147:36595] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/jp.php"] [unique_id "adk3K3ApxuyB7yCS5Rn7FwAAANM"]
[Sat Apr 11 01:45:16.152008 2026] [:error] [pid 21570:tid 21691] [client 72.146.30.147:36594] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/jp.php"] [unique_id "adk3LDKs5t9xRSNL6cnARgAAAFE"]
[Sat Apr 11 01:45:16.627284 2026] [:error] [pid 21569:tid 21683] [client 72.146.30.147:32161] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/jp.php"] [unique_id "adk3LHAvQTgvXJ6vHoqU4wAAAJg"]
[Sat Apr 11 01:45:17.088730 2026] [:error] [pid 21706:tid 21715] [client 72.146.30.147:37278] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp/jp.php"] [unique_id "adk3LSGQ1M5d8fQSsLGeEgAAAAc"]
[Sat Apr 11 01:45:17.576356 2026] [:error] [pid 21569:tid 21657] [client 72.146.30.147:31004] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "adk3LXAvQTgvXJ6vHoqU5wAAAIw"]
[Sat Apr 11 01:45:18.051097 2026] [:error] [pid 21568:tid 21576] [client 72.146.30.147:32153] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "adk3Loiz5v_ljZxkpR_DMgAAAQQ"]
[Sat Apr 11 01:45:18.568005 2026] [:error] [pid 21569:tid 21653] [client 72.146.30.147:37292] [client 72.146.30.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8573.php"] [unique_id "adk3LnAvQTgvXJ6vHoqU6wAAAIg"]
[Sat Apr 11 01:45:19.033826 2026] [:error] [pid 21570:tid 21682] [client 72.146.30.147:36578] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Sat Apr 11 01:45:19.274018 2026] [:error] [pid 21570:tid 21688] [client 72.146.30.147:36578] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Sat Apr 11 01:45:19.522798 2026] [:error] [pid 21570:tid 21695] [client 72.146.30.147:36578] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sat Apr 11 01:45:19.756021 2026] [:error] [pid 21570:tid 21693] [client 72.146.30.147:36578] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Sat Apr 11 01:45:19.989152 2026] [:error] [pid 21570:tid 21679] [client 72.146.30.147:36578] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sat Apr 11 01:45:20.256398 2026] [:error] [pid 21570:tid 21692] [client 72.146.30.147:36578] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Sat Apr 11 01:51:22.033897 2026] [:error] [pid 21570:tid 21696] [client 146.70.178.164:60312] [client 146.70.178.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.178.164, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "adk4mjKs5t9xRSNL6cnEdQAAAFY"]
[Sat Apr 11 01:51:22.037542 2026] [:error] [pid 21570:tid 21696] [client 146.70.178.164:60312] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Apr 11 02:30:05.194850 2026] [:error] [pid 21706:tid 21726] [client 103.209.18.120:56405] [client 103.209.18.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.209.18.120, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adlBrSGQ1M5d8fQSsLHGwQAAABI"]
[Sat Apr 11 02:30:05.199588 2026] [:error] [pid 21706:tid 21726] [client 103.209.18.120:56405] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 11 03:22:40.197986 2026] [:error] [pid 21706:tid 21717] [client 144.91.72.239:56210] [client 144.91.72.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/vacancies"] [unique_id "adlOACGQ1M5d8fQSsLEDFgAAAAk"]
[Sat Apr 11 03:40:47.279114 2026] [:error] [pid 21570:tid 21690] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Apr 11 03:40:47.491710 2026] [:error] [pid 21570:tid 21696] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Apr 11 03:40:47.703117 2026] [:error] [pid 21570:tid 21694] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Apr 11 03:40:47.914620 2026] [:error] [pid 21570:tid 21698] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Apr 11 03:40:48.125782 2026] [:error] [pid 21570:tid 21675] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Apr 11 03:40:48.346438 2026] [:error] [pid 21570:tid 21668] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Apr 11 03:40:48.559305 2026] [:error] [pid 21570:tid 21687] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Apr 11 03:40:48.769694 2026] [:error] [pid 21570:tid 21688] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Apr 11 03:40:49.201008 2026] [:error] [pid 21570:tid 21692] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Apr 11 03:40:49.416694 2026] [:error] [pid 21570:tid 21689] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Apr 11 03:40:49.627562 2026] [:error] [pid 21570:tid 21661] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Apr 11 03:40:49.843114 2026] [:error] [pid 21570:tid 21693] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Apr 11 03:40:50.056989 2026] [:error] [pid 21570:tid 21698] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Apr 11 03:40:50.269365 2026] [:error] [pid 21570:tid 21675] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Apr 11 03:40:50.484859 2026] [:error] [pid 21570:tid 21672] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Apr 11 03:40:50.693657 2026] [:error] [pid 21570:tid 21668] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Apr 11 03:40:50.905357 2026] [:error] [pid 21570:tid 21681] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Apr 11 03:40:51.114517 2026] [:error] [pid 21570:tid 21688] [client 173.239.214.69:55285] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sat Apr 11 03:40:54.134464 2026] [:error] [pid 21570:tid 21675] [client 173.239.214.69:55285] [client 173.239.214.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adlSRjKs5t9xRSNL6cn9fgAAAEc"]
[Sat Apr 11 03:50:53.261918 2026] [:error] [pid 32076:tid 32158] [client 72.146.8.12:9683] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Apr 11 07:48:51.850695 2026] [:error] [pid 33288:tid 33305] [client 20.250.31.31:53801] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Apr 11 07:48:52.087346 2026] [:error] [pid 33288:tid 33299] [client 20.250.31.31:53801] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-demomav.php
[Sat Apr 11 07:48:52.325954 2026] [:error] [pid 33288:tid 33306] [client 20.250.31.31:53801] File does not exist: /usr/local/apache/htdocs/suspended-page/itil.php
[Sat Apr 11 07:48:52.562606 2026] [:error] [pid 33288:tid 33292] [client 20.250.31.31:53801] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Apr 11 07:48:52.799526 2026] [:error] [pid 33288:tid 33314] [client 20.250.31.31:53801] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-filters.php
[Sat Apr 11 07:48:53.037452 2026] [:error] [pid 33288:tid 33310] [client 20.250.31.31:53801] File does not exist: /usr/local/apache/htdocs/suspended-page/new2.php
[Sat Apr 11 07:48:53.273458 2026] [:error] [pid 33288:tid 33302] [client 20.250.31.31:53801] File does not exist: /usr/local/apache/htdocs/suspended-page/mjq.php
[Sat Apr 11 08:55:38.486229 2026] [:error] [pid 11398:tid 11437] [client 20.100.191.67:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Apr 11 08:55:38.743417 2026] [:error] [pid 11398:tid 11438] [client 20.100.191.67:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-demomav.php
[Sat Apr 11 08:55:39.001366 2026] [:error] [pid 11398:tid 11443] [client 20.100.191.67:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/itil.php
[Sat Apr 11 08:55:39.259042 2026] [:error] [pid 11398:tid 11432] [client 20.100.191.67:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Apr 11 08:55:39.516148 2026] [:error] [pid 11398:tid 11434] [client 20.100.191.67:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-filters.php
[Sat Apr 11 08:55:39.773568 2026] [:error] [pid 11398:tid 11447] [client 20.100.191.67:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/new2.php
[Sat Apr 11 08:55:40.031064 2026] [:error] [pid 11398:tid 11428] [client 20.100.191.67:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/mjq.php
[Sat Apr 11 09:12:44.598345 2026] [:error] [pid 17920:tid 17961] [client 4.205.120.59:64957] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Apr 11 09:12:44.814555 2026] [:error] [pid 17920:tid 17964] [client 4.205.120.59:64957] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sat Apr 11 09:12:45.261878 2026] [:error] [pid 17920:tid 17965] [client 4.205.120.59:64957] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/install.php"] [unique_id "admgDT5Lc1p-Aqpat3lt-wAAAUw"]
[Sat Apr 11 09:13:16.588701 2026] [:error] [pid 17920:tid 17974] [client 4.205.120.59:62713] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "admgLD5Lc1p-Aqpat3luTAAAAVU"]
[Sat Apr 11 09:13:39.524028 2026] [:error] [pid 19452:tid 19454] [client 4.205.120.59:62705] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/pomo.php"] [unique_id "admgQ-Vaim9CK1Y72sIxBwAAAAA"]
[Sat Apr 11 09:13:50.099487 2026] [:error] [pid 18016:tid 18019] [client 4.205.120.59:62689] File does not exist: /usr/local/apache/htdocs/suspended-page/mailer.php
[Sat Apr 11 09:13:50.316614 2026] [:error] [pid 18016:tid 18040] [client 4.205.120.59:62689] File does not exist: /usr/local/apache/htdocs/suspended-page/sendmail.php
[Sat Apr 11 09:13:50.545459 2026] [:error] [pid 18016:tid 18041] [client 4.205.120.59:62689] File does not exist: /usr/local/apache/htdocs/suspended-page/send.php
[Sat Apr 11 09:13:50.766988 2026] [:error] [pid 18016:tid 18031] [client 4.205.120.59:62689] File does not exist: /usr/local/apache/htdocs/suspended-page/Sendemail.php
[Sat Apr 11 09:13:50.982405 2026] [:error] [pid 18016:tid 18032] [client 4.205.120.59:62689] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sat Apr 11 09:13:51.187644 2026] [:error] [pid 18016:tid 18024] [client 4.205.120.59:62689] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rss.php"] [unique_id "admgT-cxaCYZQ49a1dm9cwAAAEY"]
[Sat Apr 11 09:14:09.213479 2026] [:error] [pid 17921:tid 17989] [client 4.205.120.59:62714] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/it.php"] [unique_id "admgYVBsNecLQSPLg3D0dQAAAYk"]
[Sat Apr 11 09:14:11.285969 2026] [:error] [pid 17919:tid 17947] [client 4.205.120.59:62681] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/it.php"] [unique_id "admgYw4Th_c8TGOTho7pTAAAARc"]
[Sat Apr 11 09:14:14.002140 2026] [:error] [pid 19483:tid 19491] [client 4.205.120.59:65003] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/it.php"] [unique_id "admgZkfhEoDX8oI2QgsZ2gAAAIY"]
[Sat Apr 11 09:14:29.195034 2026] [:error] [pid 18016:tid 18018] [client 4.205.120.59:64987] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "admgdecxaCYZQ49a1dm-sAAAAEA"]
[Sat Apr 11 09:14:29.786517 2026] [:error] [pid 19452:tid 19466] [client 4.205.120.59:62601] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso.php"] [unique_id "admgdeVaim9CK1Y72sIx5AAAAAw"]
[Sat Apr 11 09:14:49.487152 2026] [:error] [pid 17920:tid 17973] [client 4.205.120.59:64913] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso1.php"] [unique_id "admgiT5Lc1p-Aqpat3luqwAAAVQ"]
[Sat Apr 11 09:15:06.539037 2026] [:error] [pid 18016:tid 18025] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/wso2.php
[Sat Apr 11 09:15:06.748145 2026] [:error] [pid 18016:tid 18024] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/wso1337.php
[Sat Apr 11 09:15:07.013646 2026] [:error] [pid 18016:tid 18032] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/WSO.php
[Sat Apr 11 09:15:07.222078 2026] [:error] [pid 18016:tid 18019] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Apr 11 09:15:07.441660 2026] [:error] [pid 18016:tid 18027] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa123.php
[Sat Apr 11 09:15:07.654644 2026] [:error] [pid 18016:tid 18023] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/alex.php
[Sat Apr 11 09:15:07.871473 2026] [:error] [pid 18016:tid 18035] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/alexus.php
[Sat Apr 11 09:15:08.095776 2026] [:error] [pid 18016:tid 18025] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/alexuse.php
[Sat Apr 11 09:15:08.304552 2026] [:error] [pid 18016:tid 18028] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/alexusmailer 2.0.php
[Sat Apr 11 09:15:08.512437 2026] [:error] [pid 18016:tid 18020] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Sat Apr 11 09:15:08.721029 2026] [:error] [pid 18016:tid 18030] [client 4.205.120.59:62711] File does not exist: /usr/local/apache/htdocs/suspended-page/leafmailer.php
[Sat Apr 11 09:15:08.926701 2026] [:error] [pid 18016:tid 18034] [client 4.205.120.59:62711] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiss.php"] [unique_id "admgnOcxaCYZQ49a1dm_OwAAAFA"]
[Sat Apr 11 09:15:15.734878 2026] [:error] [pid 18016:tid 18040] [client 4.205.120.59:64936] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiss.php"] [unique_id "admgo-cxaCYZQ49a1dm_TAAAAFY"]
[Sat Apr 11 09:15:20.713163 2026] [:error] [pid 19452:tid 19466] [client 4.205.120.59:64970] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiss.php"] [unique_id "admgqOVaim9CK1Y72sIyQwAAAAw"]
[Sat Apr 11 09:15:35.848276 2026] [:error] [pid 17921:tid 17980] [client 4.205.120.59:62717] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owl.php"] [unique_id "admgt1BsNecLQSPLg3D02QAAAYA"]
[Sat Apr 11 09:15:39.459761 2026] [:error] [pid 18016:tid 18040] [client 4.205.120.59:64924] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owl.php"] [unique_id "admgu-cxaCYZQ49a1dm_1QAAAFY"]
[Sat Apr 11 09:15:41.886658 2026] [:error] [pid 19483:tid 19499] [client 4.205.120.59:62704] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owl.php"] [unique_id "admgvUfhEoDX8oI2QgsbIwAAAI4"]
[Sat Apr 11 09:15:47.072194 2026] [:error] [pid 19452:tid 19456] [client 4.205.120.59:64940] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "admgw-Vaim9CK1Y72sIyZgAAAAI"]
[Sat Apr 11 09:15:57.648067 2026] [:error] [pid 19483:tid 19506] [client 4.205.120.59:64929] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bypass.php"] [unique_id "admgzUfhEoDX8oI2QgsbQQAAAJU"]
[Sat Apr 11 09:16:11.960168 2026] [:error] [pid 17921:tid 18000] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Apr 11 09:16:12.169654 2026] [:error] [pid 17921:tid 18002] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Sat Apr 11 09:16:12.388561 2026] [:error] [pid 17921:tid 18003] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Sat Apr 11 09:16:12.390167 2026] [:error] [pid 17920:tid 17972] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Sat Apr 11 09:16:12.605100 2026] [:error] [pid 17921:tid 17994] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/file-manager.php
[Sat Apr 11 09:16:12.650693 2026] [:error] [pid 17920:tid 17968] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Sat Apr 11 09:16:12.824883 2026] [:error] [pid 17921:tid 17986] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Sat Apr 11 09:16:12.910966 2026] [:error] [pid 17920:tid 17966] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Sat Apr 11 09:16:13.033280 2026] [:error] [pid 17921:tid 17990] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/gel.php
[Sat Apr 11 09:16:13.170573 2026] [:error] [pid 17920:tid 17969] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Sat Apr 11 09:16:13.247107 2026] [:error] [pid 17921:tid 17981] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/Gel.php
[Sat Apr 11 09:16:13.432552 2026] [:error] [pid 17920:tid 17958] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Sat Apr 11 09:16:13.692726 2026] [:error] [pid 17920:tid 17964] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/filemanger2.php
[Sat Apr 11 09:16:13.952458 2026] [:error] [pid 17920:tid 17954] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sat Apr 11 09:16:14.053771 2026] [:error] [pid 17921:tid 17985] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Sat Apr 11 09:16:14.214351 2026] [:error] [pid 17920:tid 17962] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-vn1.php
[Sat Apr 11 09:16:14.279012 2026] [:error] [pid 17921:tid 17999] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/olu.php
[Sat Apr 11 09:16:14.473845 2026] [:error] [pid 17920:tid 17977] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Sat Apr 11 09:16:14.502890 2026] [:error] [pid 17921:tid 17991] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/anone.php
[Sat Apr 11 09:16:14.712319 2026] [:error] [pid 17921:tid 17998] [client 4.205.120.59:65013] File does not exist: /usr/local/apache/htdocs/suspended-page/nasgor.php
[Sat Apr 11 09:16:14.731666 2026] [:error] [pid 17920:tid 17974] [client 20.251.36.179:2900] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Sat Apr 11 09:16:14.931404 2026] [:error] [pid 17921:tid 17993] [client 4.205.120.59:65013] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rahma.php"] [unique_id "admg3lBsNecLQSPLg3D1HAAAAY0"]
[Sat Apr 11 09:16:14.987677 2026] [:error] [pid 17920:tid 17953] [client 20.251.36.179:2900] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nwflm.php"] [unique_id "admg3j5Lc1p-Aqpat3lvIwAAAUA"]
[Sat Apr 11 09:16:15.509090 2026] [:error] [pid 18016:tid 18039] [client 20.251.36.179:57686] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nwflm.php"] [unique_id "admg3-cxaCYZQ49a1dnAwAAAAFU"]
[Sat Apr 11 09:16:16.034769 2026] [:error] [pid 18016:tid 18022] [client 20.251.36.179:25569] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nwflm.php"] [unique_id "admg4OcxaCYZQ49a1dnAygAAAEQ"]
[Sat Apr 11 09:16:16.573474 2026] [:error] [pid 17920:tid 17971] [client 20.251.36.179:2922] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/nwflm.php"] [unique_id "admg4D5Lc1p-Aqpat3lvJwAAAVI"]
[Sat Apr 11 09:16:17.081634 2026] [:error] [pid 18016:tid 18023] [client 20.251.36.179:25557] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dx.php"] [unique_id "admg4ecxaCYZQ49a1dnA0QAAAEU"]
[Sat Apr 11 09:16:17.602726 2026] [:error] [pid 17919:tid 17948] [client 20.251.36.179:48180] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dx.php"] [unique_id "admg4Q4Th_c8TGOTho7p9AAAARg"]
[Sat Apr 11 09:16:18.134275 2026] [:error] [pid 17921:tid 18004] [client 20.251.36.179:2891] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dx.php"] [unique_id "admg4lBsNecLQSPLg3D1HwAAAZg"]
[Sat Apr 11 09:16:18.671583 2026] [:error] [pid 18016:tid 18035] [client 20.251.36.179:48176] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dx.php"] [unique_id "admg4ucxaCYZQ49a1dnA2wAAAFE"]
[Sat Apr 11 09:16:19.208884 2026] [:error] [pid 18016:tid 18028] [client 20.251.36.179:2935] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xff.php"] [unique_id "admg4-cxaCYZQ49a1dnA5AAAAEo"]
[Sat Apr 11 09:16:19.731632 2026] [:error] [pid 18016:tid 18022] [client 20.251.36.179:20937] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xff.php"] [unique_id "admg4-cxaCYZQ49a1dnA6gAAAEQ"]
[Sat Apr 11 09:16:20.260901 2026] [:error] [pid 18016:tid 18031] [client 20.251.36.179:37713] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xff.php"] [unique_id "admg5OcxaCYZQ49a1dnA8gAAAE0"]
[Sat Apr 11 09:16:20.788084 2026] [:error] [pid 18016:tid 18025] [client 20.251.36.179:57715] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xff.php"] [unique_id "admg5OcxaCYZQ49a1dnA-QAAAEc"]
[Sat Apr 11 09:16:21.327775 2026] [:error] [pid 19452:tid 19459] [client 20.251.36.179:48183] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lupo.php"] [unique_id "admg5eVaim9CK1Y72sIynAAAAAU"]
[Sat Apr 11 09:16:21.839387 2026] [:error] [pid 18016:tid 18038] [client 20.251.36.179:57681] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lupo.php"] [unique_id "admg5ecxaCYZQ49a1dnBCwAAAFQ"]
[Sat Apr 11 09:16:22.366677 2026] [:error] [pid 17919:tid 17928] [client 20.251.36.179:2124] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lupo.php"] [unique_id "admg5g4Th_c8TGOTho7p-gAAAQQ"]
[Sat Apr 11 09:16:22.889775 2026] [:error] [pid 18016:tid 18032] [client 20.251.36.179:47559] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/lupo.php"] [unique_id "admg5ucxaCYZQ49a1dnBFgAAAE4"]
[Sat Apr 11 09:16:23.415977 2026] [:error] [pid 18016:tid 18034] [client 20.251.36.179:2120] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/awa.php"] [unique_id "admg5-cxaCYZQ49a1dnBHgAAAFA"]
[Sat Apr 11 09:16:23.946926 2026] [:error] [pid 18016:tid 18030] [client 20.251.36.179:20940] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/awa.php"] [unique_id "admg5-cxaCYZQ49a1dnBJAAAAEw"]
[Sat Apr 11 09:16:24.503176 2026] [:error] [pid 19452:tid 19469] [client 20.251.36.179:56304] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/awa.php"] [unique_id "admg6OVaim9CK1Y72sIyngAAAA8"]
[Sat Apr 11 09:16:25.017933 2026] [:error] [pid 19483:tid 19488] [client 20.251.36.179:24865] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/awa.php"] [unique_id "admg6UfhEoDX8oI2QgsbeAAAAIM"]
[Sat Apr 11 09:16:25.223079 2026] [:error] [pid 19483:tid 19497] [client 4.205.120.59:62670] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rahma.php"] [unique_id "admg6UfhEoDX8oI2QgsbewAAAIw"]
[Sat Apr 11 09:16:25.540268 2026] [:error] [pid 17921:tid 17991] [client 20.251.36.179:25584] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "admg6VBsNecLQSPLg3D1JwAAAYs"]
[Sat Apr 11 09:16:26.058987 2026] [:error] [pid 19483:tid 19487] [client 20.251.36.179:23455] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "admg6kfhEoDX8oI2QgsbfgAAAII"]
[Sat Apr 11 09:16:26.585789 2026] [:error] [pid 17921:tid 17986] [client 20.251.36.179:2885] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "admg6lBsNecLQSPLg3D1LwAAAYY"]
[Sat Apr 11 09:16:27.146190 2026] [:error] [pid 19483:tid 19485] [client 20.251.36.179:24860] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "admg60fhEoDX8oI2QgsbgwAAAIA"]
[Sat Apr 11 09:16:27.702152 2026] [:error] [pid 19452:tid 19478] [client 20.251.36.179:57722] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/popo.php"] [unique_id "admg6-Vaim9CK1Y72sIynwAAABg"]
[Sat Apr 11 09:16:28.221467 2026] [:error] [pid 19483:tid 19491] [client 20.251.36.179:26657] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/popo.php"] [unique_id "admg7EfhEoDX8oI2QgsbjAAAAIY"]
[Sat Apr 11 09:16:28.760076 2026] [:error] [pid 17920:tid 17959] [client 20.251.36.179:37757] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/popo.php"] [unique_id "admg7D5Lc1p-Aqpat3lvOQAAAUY"]
[Sat Apr 11 09:16:29.277889 2026] [:error] [pid 18016:tid 18037] [client 20.251.36.179:47610] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/popo.php"] [unique_id "admg7ecxaCYZQ49a1dnBOAAAAFM"]
[Sat Apr 11 09:16:29.789001 2026] [:error] [pid 17920:tid 17962] [client 20.251.36.179:26624] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/water.php"] [unique_id "admg7T5Lc1p-Aqpat3lvPgAAAUk"]
[Sat Apr 11 09:16:30.309588 2026] [:error] [pid 17920:tid 17973] [client 20.251.36.179:47583] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/water.php"] [unique_id "admg7j5Lc1p-Aqpat3lvQAAAAVQ"]
[Sat Apr 11 09:16:30.820309 2026] [:error] [pid 19483:tid 19502] [client 20.251.36.179:20946] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/water.php"] [unique_id "admg7kfhEoDX8oI2QgsbkwAAAJE"]
[Sat Apr 11 09:16:31.346907 2026] [:error] [pid 17919:tid 17927] [client 20.251.36.179:47571] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/water.php"] [unique_id "admg7w4Th_c8TGOTho7qEwAAAQM"]
[Sat Apr 11 09:16:31.858385 2026] [:error] [pid 19483:tid 19491] [client 20.251.36.179:25550] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ggb.php"] [unique_id "admg70fhEoDX8oI2QgsblgAAAIY"]
[Sat Apr 11 09:16:32.402389 2026] [:error] [pid 17920:tid 17969] [client 20.251.36.179:2920] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ggb.php"] [unique_id "admg8D5Lc1p-Aqpat3lvQQAAAVA"]
[Sat Apr 11 09:16:32.973893 2026] [:error] [pid 18016:tid 18031] [client 20.251.36.179:37704] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ggb.php"] [unique_id "admg8OcxaCYZQ49a1dnBRAAAAE0"]
[Sat Apr 11 09:16:33.515450 2026] [:error] [pid 18016:tid 18033] [client 20.251.36.179:24861] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ggb.php"] [unique_id "admg8ecxaCYZQ49a1dnBRQAAAE8"]
[Sat Apr 11 09:16:34.035715 2026] [:error] [pid 19483:tid 19498] [client 20.251.36.179:2409] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/13.php"] [unique_id "admg8kfhEoDX8oI2QgsbmgAAAI0"]
[Sat Apr 11 09:16:34.563738 2026] [:error] [pid 19452:tid 19456] [client 20.251.36.179:2414] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/13.php"] [unique_id "admg8uVaim9CK1Y72sIyuAAAAAI"]
[Sat Apr 11 09:16:35.101118 2026] [:error] [pid 19483:tid 19499] [client 20.251.36.179:47572] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/13.php"] [unique_id "admg80fhEoDX8oI2QgsbnQAAAI4"]
[Sat Apr 11 09:16:35.643165 2026] [:error] [pid 18016:tid 18027] [client 20.251.36.179:48157] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/13.php"] [unique_id "admg8-cxaCYZQ49a1dnBTAAAAEk"]
[Sat Apr 11 09:16:36.184358 2026] [:error] [pid 19452:tid 19467] [client 20.251.36.179:48191] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wert.php"] [unique_id "admg9OVaim9CK1Y72sIywQAAAA0"]
[Sat Apr 11 09:16:36.716111 2026] [:error] [pid 19452:tid 19456] [client 20.251.36.179:26676] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wert.php"] [unique_id "admg9OVaim9CK1Y72sIyxAAAAAI"]
[Sat Apr 11 09:16:37.268450 2026] [:error] [pid 18016:tid 18026] [client 20.251.36.179:26679] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wert.php"] [unique_id "admg9ecxaCYZQ49a1dnBVAAAAEg"]
[Sat Apr 11 09:16:37.812832 2026] [:error] [pid 17919:tid 17925] [client 20.251.36.179:35193] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wert.php"] [unique_id "admg9Q4Th_c8TGOTho7qIwAAAQE"]
[Sat Apr 11 09:16:38.361557 2026] [:error] [pid 19452:tid 19458] [client 20.251.36.179:24849] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/11.php"] [unique_id "admg9uVaim9CK1Y72sIyzQAAAAQ"]
[Sat Apr 11 09:16:39.036105 2026] [:error] [pid 17920:tid 17975] [client 20.251.36.179:2419] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/11.php"] [unique_id "admg9z5Lc1p-Aqpat3lvUQAAAVY"]
[Sat Apr 11 09:16:39.578604 2026] [:error] [pid 18016:tid 18020] [client 20.251.36.179:48163] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/11.php"] [unique_id "admg9-cxaCYZQ49a1dnBXAAAAEI"]
[Sat Apr 11 09:16:40.138063 2026] [:error] [pid 19452:tid 19466] [client 20.251.36.179:35179] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/11.php"] [unique_id "admg-OVaim9CK1Y72sIyzwAAAAw"]
[Sat Apr 11 09:16:40.726847 2026] [:error] [pid 19452:tid 19473] [client 20.251.36.179:23472] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "admg-OVaim9CK1Y72sIy1QAAABM"]
[Sat Apr 11 09:16:41.272209 2026] [:error] [pid 17921:tid 17984] [client 20.251.36.179:2061] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "admg-VBsNecLQSPLg3D1RwAAAYQ"]
[Sat Apr 11 09:16:41.806203 2026] [:error] [pid 19452:tid 19469] [client 20.251.36.179:24146] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "admg-eVaim9CK1Y72sIy3QAAAA8"]
[Sat Apr 11 09:16:42.357544 2026] [:error] [pid 17920:tid 17972] [client 20.251.36.179:35194] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/p.php"] [unique_id "admg-j5Lc1p-Aqpat3lvVQAAAVM"]
[Sat Apr 11 09:16:42.934365 2026] [:error] [pid 19452:tid 19474] [client 20.251.36.179:26686] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "admg-uVaim9CK1Y72sIy4gAAABQ"]
[Sat Apr 11 09:16:43.529338 2026] [:error] [pid 19452:tid 19472] [client 20.251.36.179:2169] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "admg--Vaim9CK1Y72sIy5gAAABI"]
[Sat Apr 11 09:16:44.144061 2026] [:error] [pid 19483:tid 19508] [client 20.251.36.179:26643] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "admg_EfhEoDX8oI2QgsbyQAAAJc"]
[Sat Apr 11 09:16:44.683375 2026] [:error] [pid 19483:tid 19497] [client 20.251.36.179:20969] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "admg_EfhEoDX8oI2QgsbygAAAIw"]
[Sat Apr 11 09:16:45.286622 2026] [:error] [pid 19452:tid 19457] [client 20.251.36.179:56220] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bthil.php"] [unique_id "admg_eVaim9CK1Y72sIy7QAAAAM"]
[Sat Apr 11 09:16:45.768827 2026] [:error] [pid 17920:tid 17959] [client 4.205.120.59:65011] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mrjn.php"] [unique_id "admg_T5Lc1p-Aqpat3lvVwAAAUY"]
[Sat Apr 11 09:16:45.917518 2026] [:error] [pid 17919:tid 17928] [client 20.251.36.179:26653] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bthil.php"] [unique_id "admg_Q4Th_c8TGOTho7qLQAAAQQ"]
[Sat Apr 11 09:16:46.480852 2026] [:error] [pid 19483:tid 19492] [client 20.251.36.179:2144] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bthil.php"] [unique_id "admg_kfhEoDX8oI2Qgsb2gAAAIc"]
[Sat Apr 11 09:16:47.117521 2026] [:error] [pid 17920:tid 17960] [client 20.251.36.179:56238] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bthil.php"] [unique_id "admg_z5Lc1p-Aqpat3lvWAAAAUc"]
[Sat Apr 11 09:16:47.734819 2026] [:error] [pid 17920:tid 17964] [client 20.251.36.179:37741] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/turkshell.php"] [unique_id "admg_z5Lc1p-Aqpat3lvWQAAAUs"]
[Sat Apr 11 09:16:48.306731 2026] [:error] [pid 18016:tid 18037] [client 20.251.36.179:24142] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/turkshell.php"] [unique_id "admhAOcxaCYZQ49a1dnBcwAAAFM"]
[Sat Apr 11 09:16:48.865074 2026] [:error] [pid 18016:tid 18029] [client 20.251.36.179:29830] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/turkshell.php"] [unique_id "admhAOcxaCYZQ49a1dnBegAAAEs"]
[Sat Apr 11 09:16:49.393801 2026] [:error] [pid 19452:tid 19457] [client 20.251.36.179:35141] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/turkshell.php"] [unique_id "admhAeVaim9CK1Y72sIy-gAAAAM"]
[Sat Apr 11 09:16:50.034308 2026] [:error] [pid 17919:tid 17939] [client 20.251.36.179:24183] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tea.php"] [unique_id "admhAg4Th_c8TGOTho7qNAAAAQ8"]
[Sat Apr 11 09:16:53.464506 2026] [:error] [pid 22663:tid 22671] [client 20.251.36.179:55674] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tea.php"] [unique_id "admhBY1p7ez17BT2hZYEMwAAAQM"]
[Sat Apr 11 09:16:53.470153 2026] [:error] [pid 22663:tid 22675] [client 4.205.120.59:64982] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mrjn.php"] [unique_id "admhBY1p7ez17BT2hZYENwAAAQc"]
[Sat Apr 11 09:16:54.059714 2026] [:error] [pid 22663:tid 22678] [client 20.251.36.179:25540] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tea.php"] [unique_id "admhBo1p7ez17BT2hZYEUAAAAQo"]
[Sat Apr 11 09:16:54.633051 2026] [:error] [pid 22665:tid 22725] [client 20.251.36.179:39679] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/tea.php"] [unique_id "admhBkgi15J0QUr6OrPb2AAAAYE"]
[Sat Apr 11 09:16:55.206637 2026] [:error] [pid 22665:tid 22731] [client 20.251.36.179:52960] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seo.php"] [unique_id "admhB0gi15J0QUr6OrPb2wAAAYc"]
[Sat Apr 11 09:16:55.767925 2026] [:error] [pid 22664:tid 22711] [client 20.251.36.179:36385] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seo.php"] [unique_id "admhBwRS_OPFpcXOZmWB-wAAAU4"]
[Sat Apr 11 09:16:56.344979 2026] [:error] [pid 22663:tid 22676] [client 20.251.36.179:30565] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seo.php"] [unique_id "admhCI1p7ez17BT2hZYEawAAAQg"]
[Sat Apr 11 09:16:56.935343 2026] [:error] [pid 22665:tid 22734] [client 20.251.36.179:64111] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/seo.php"] [unique_id "admhCEgi15J0QUr6OrPb4AAAAYo"]
[Sat Apr 11 09:16:57.545421 2026] [:error] [pid 22663:tid 22679] [client 20.251.36.179:48222] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/7.php"] [unique_id "admhCY1p7ez17BT2hZYEdAAAAQs"]
[Sat Apr 11 09:16:58.158862 2026] [:error] [pid 22665:tid 22739] [client 20.251.36.179:46264] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/7.php"] [unique_id "admhCkgi15J0QUr6OrPb5QAAAY8"]
[Sat Apr 11 09:16:58.764173 2026] [:error] [pid 22664:tid 22711] [client 20.251.36.179:64093] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/7.php"] [unique_id "admhCgRS_OPFpcXOZmWCDQAAAU4"]
[Sat Apr 11 09:16:59.385633 2026] [:error] [pid 22756:tid 22764] [client 20.251.36.179:39564] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/7.php"] [unique_id "admhC2foSJ40LEm6kfqp-gAAAAY"]
[Sat Apr 11 09:16:59.969677 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:18541] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "admhC2foSJ40LEm6kfqp_gAAAAs"]
[Sat Apr 11 09:17:00.665002 2026] [:error] [pid 22756:tid 22776] [client 20.251.36.179:18526] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "admhDGfoSJ40LEm6kfqqBQAAABI"]
[Sat Apr 11 09:17:01.264290 2026] [:error] [pid 22665:tid 22726] [client 20.251.36.179:46248] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "admhDUgi15J0QUr6OrPb7wAAAYI"]
[Sat Apr 11 09:17:01.841309 2026] [:error] [pid 22663:tid 22673] [client 20.251.36.179:30574] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/8.php"] [unique_id "admhDY1p7ez17BT2hZYEigAAAQU"]
[Sat Apr 11 09:17:02.530504 2026] [:error] [pid 22663:tid 22671] [client 20.251.36.179:46222] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "admhDo1p7ez17BT2hZYEkAAAAQM"]
[Sat Apr 11 09:17:03.145351 2026] [:error] [pid 22663:tid 22672] [client 20.251.36.179:40277] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "admhD41p7ez17BT2hZYElAAAAQQ"]
[Sat Apr 11 09:17:03.746928 2026] [:error] [pid 22664:tid 22698] [client 20.251.36.179:31848] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "admhDwRS_OPFpcXOZmWCHQAAAUE"]
[Sat Apr 11 09:17:04.325658 2026] [:error] [pid 22663:tid 22682] [client 20.251.36.179:2709] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/1.php"] [unique_id "admhEI1p7ez17BT2hZYEnAAAAQ4"]
[Sat Apr 11 09:17:04.970589 2026] [:error] [pid 22756:tid 22777] [client 20.251.36.179:24080] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2.php"] [unique_id "admhEGfoSJ40LEm6kfqqGgAAABM"]
[Sat Apr 11 09:17:05.570662 2026] [:error] [pid 22664:tid 22716] [client 20.251.36.179:48205] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2.php"] [unique_id "admhEQRS_OPFpcXOZmWCKQAAAVM"]
[Sat Apr 11 09:17:06.146175 2026] [:error] [pid 22665:tid 22726] [client 20.251.36.179:2737] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2.php"] [unique_id "admhEkgi15J0QUr6OrPb_AAAAYI"]
[Sat Apr 11 09:17:06.678471 2026] [:error] [pid 22664:tid 22721] [client 20.251.36.179:40282] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/2.php"] [unique_id "admhEgRS_OPFpcXOZmWCLQAAAVg"]
[Sat Apr 11 09:17:07.245003 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:2732] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/3.php"] [unique_id "admhE2foSJ40LEm6kfqqIgAAAAo"]
[Sat Apr 11 09:17:07.785007 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:2271] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/3.php"] [unique_id "admhE0gi15J0QUr6OrPb_wAAAZQ"]
[Sat Apr 11 09:17:08.334229 2026] [:error] [pid 22664:tid 22700] [client 20.251.36.179:64105] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/3.php"] [unique_id "admhFARS_OPFpcXOZmWCNQAAAUM"]
[Sat Apr 11 09:17:08.844977 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:2288] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/3.php"] [unique_id "admhFEgi15J0QUr6OrPcBQAAAZM"]
[Sat Apr 11 09:17:09.384209 2026] [:error] [pid 22756:tid 22774] [client 20.251.36.179:24121] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/4.php"] [unique_id "admhFWfoSJ40LEm6kfqqQgAAABA"]
[Sat Apr 11 09:17:09.949461 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:23488] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/4.php"] [unique_id "admhFWfoSJ40LEm6kfqqTgAAAAM"]
[Sat Apr 11 09:17:10.472638 2026] [:error] [pid 22664:tid 22721] [client 20.251.36.179:24123] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/4.php"] [unique_id "admhFgRS_OPFpcXOZmWCTgAAAVg"]
[Sat Apr 11 09:17:11.071626 2026] [:error] [pid 22756:tid 22781] [client 20.251.36.179:64127] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/4.php"] [unique_id "admhF2foSJ40LEm6kfqqZAAAABc"]
[Sat Apr 11 09:17:11.625421 2026] [:error] [pid 22664:tid 22700] [client 20.251.36.179:24115] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/5.php"] [unique_id "admhFwRS_OPFpcXOZmWCVgAAAUM"]
[Sat Apr 11 09:17:12.258052 2026] [:error] [pid 22665:tid 22734] [client 20.251.36.179:48213] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/5.php"] [unique_id "admhGEgi15J0QUr6OrPcHwAAAYo"]
[Sat Apr 11 09:17:12.818555 2026] [:error] [pid 22756:tid 22774] [client 20.251.36.179:24100] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/5.php"] [unique_id "admhGGfoSJ40LEm6kfqqdAAAABA"]
[Sat Apr 11 09:17:13.384979 2026] [:error] [pid 22664:tid 22702] [client 20.251.36.179:2247] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/5.php"] [unique_id "admhGQRS_OPFpcXOZmWCZAAAAUU"]
[Sat Apr 11 09:17:13.920148 2026] [:error] [pid 22756:tid 22764] [client 20.251.36.179:21397] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/6.php"] [unique_id "admhGWfoSJ40LEm6kfqqeAAAAAY"]
[Sat Apr 11 09:17:14.489060 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Sat Apr 11 09:17:14.750894 2026] [:error] [pid 22664:tid 22716] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Sat Apr 11 09:17:15.016434 2026] [:error] [pid 22664:tid 22709] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Sat Apr 11 09:17:15.279207 2026] [:error] [pid 22664:tid 22706] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/.mopj.php
[Sat Apr 11 09:17:15.536622 2026] [:error] [pid 22664:tid 22703] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sat Apr 11 09:17:15.795595 2026] [:error] [pid 22664:tid 22721] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/nano.php
[Sat Apr 11 09:17:16.057052 2026] [:error] [pid 22664:tid 22699] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_S.php
[Sat Apr 11 09:17:16.316575 2026] [:error] [pid 22664:tid 22705] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Sat Apr 11 09:17:16.575408 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Sat Apr 11 09:17:16.834326 2026] [:error] [pid 22664:tid 22708] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Sat Apr 11 09:17:17.092930 2026] [:error] [pid 22664:tid 22716] [client 20.251.36.179:61411] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Sat Apr 11 09:17:17.351181 2026] [:error] [pid 22664:tid 22714] [client 20.251.36.179:61411] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byrgo.php"] [unique_id "admhHQRS_OPFpcXOZmWCewAAAVE"]
[Sat Apr 11 09:17:17.914746 2026] [:error] [pid 22756:tid 22776] [client 20.251.36.179:2260] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byrgo.php"] [unique_id "admhHWfoSJ40LEm6kfqqlwAAABI"]
[Sat Apr 11 09:17:18.500650 2026] [:error] [pid 22663:tid 22681] [client 20.251.36.179:21414] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byrgo.php"] [unique_id "admhHo1p7ez17BT2hZYE7gAAAQ0"]
[Sat Apr 11 09:17:19.067896 2026] [:error] [pid 22664:tid 22702] [client 20.251.36.179:32395] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/byrgo.php"] [unique_id "admhHwRS_OPFpcXOZmWCfgAAAUU"]
[Sat Apr 11 09:17:19.641588 2026] [:error] [pid 22663:tid 22691] [client 20.251.36.179:26004] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwpg.php"] [unique_id "admhH41p7ez17BT2hZYE8QAAARc"]
[Sat Apr 11 09:17:20.169004 2026] [:error] [pid 22664:tid 22698] [client 20.251.36.179:24089] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwpg.php"] [unique_id "admhIARS_OPFpcXOZmWChAAAAUE"]
[Sat Apr 11 09:17:20.710126 2026] [:error] [pid 22665:tid 22725] [client 20.251.36.179:40285] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwpg.php"] [unique_id "admhIEgi15J0QUr6OrPcNQAAAYE"]
[Sat Apr 11 09:17:21.243393 2026] [:error] [pid 22665:tid 22726] [client 20.251.36.179:26001] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xwpg.php"] [unique_id "admhIUgi15J0QUr6OrPcNwAAAYI"]
[Sat Apr 11 09:17:21.262542 2026] [:error] [pid 22664:tid 22697] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conffg.php
[Sat Apr 11 09:17:21.470730 2026] [:error] [pid 22664:tid 22719] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-confiig.php
[Sat Apr 11 09:17:21.679911 2026] [:error] [pid 22664:tid 22705] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Sat Apr 11 09:17:21.769458 2026] [:error] [pid 22665:tid 22741] [client 20.251.36.179:2684] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ass.php"] [unique_id "admhIUgi15J0QUr6OrPcOgAAAZE"]
[Sat Apr 11 09:17:21.889310 2026] [:error] [pid 22664:tid 22713] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-confirm.php
[Sat Apr 11 09:17:22.379061 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:2739] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ass.php"] [unique_id "admhImfoSJ40LEm6kfqqowAAAAo"]
[Sat Apr 11 09:17:22.914890 2026] [:error] [pid 22663:tid 22682] [client 20.251.36.179:32421] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ass.php"] [unique_id "admhIo1p7ez17BT2hZYE-QAAAQ4"]
[Sat Apr 11 09:17:23.442099 2026] [:error] [pid 22756:tid 22774] [client 20.251.36.179:23546] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ass.php"] [unique_id "admhI2foSJ40LEm6kfqqrAAAABA"]
[Sat Apr 11 09:17:23.825850 2026] [:error] [pid 22664:tid 22708] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-one.php
[Sat Apr 11 09:17:23.985094 2026] [:error] [pid 22756:tid 22762] [client 20.251.36.179:21428] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "admhI2foSJ40LEm6kfqqrgAAAAQ"]
[Sat Apr 11 09:17:24.034901 2026] [:error] [pid 22664:tid 22715] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ad.php
[Sat Apr 11 09:17:24.260939 2026] [:error] [pid 22664:tid 22704] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Sat Apr 11 09:17:24.471543 2026] [:error] [pid 22664:tid 22710] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Sat Apr 11 09:17:24.542270 2026] [:error] [pid 22665:tid 22736] [client 20.251.36.179:48210] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "admhJEgi15J0QUr6OrPcPwAAAYw"]
[Sat Apr 11 09:17:24.694673 2026] [:error] [pid 22664:tid 22711] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Sat Apr 11 09:17:25.060907 2026] [:error] [pid 22663:tid 22688] [client 20.251.36.179:26008] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "admhJY1p7ez17BT2hZYFAQAAARQ"]
[Sat Apr 11 09:17:25.674462 2026] [:error] [pid 22664:tid 22713] [client 20.251.36.179:61392] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/about.php"] [unique_id "admhJQRS_OPFpcXOZmWCoQAAAVA"]
[Sat Apr 11 09:17:26.300108 2026] [:error] [pid 22663:tid 22673] [client 20.251.36.179:24095] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no18.php"] [unique_id "admhJo1p7ez17BT2hZYFBAAAAQU"]
[Sat Apr 11 09:17:26.816854 2026] [:error] [pid 22664:tid 22700] [client 20.251.36.179:2638] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no18.php"] [unique_id "admhJgRS_OPFpcXOZmWCowAAAUM"]
[Sat Apr 11 09:17:27.491998 2026] [:error] [pid 22663:tid 22675] [client 20.251.36.179:33045] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no18.php"] [unique_id "admhJ41p7ez17BT2hZYFBQAAAQc"]
[Sat Apr 11 09:17:28.023017 2026] [:error] [pid 22756:tid 22778] [client 20.251.36.179:33031] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no18.php"] [unique_id "admhKGfoSJ40LEm6kfqqtwAAABQ"]
[Sat Apr 11 09:17:28.572302 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:2678] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fine.php"] [unique_id "admhKGfoSJ40LEm6kfqquwAAAAs"]
[Sat Apr 11 09:17:29.140760 2026] [:error] [pid 22665:tid 22724] [client 20.251.36.179:32419] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fine.php"] [unique_id "admhKUgi15J0QUr6OrPcTwAAAYA"]
[Sat Apr 11 09:17:29.465548 2026] [:error] [pid 22664:tid 22703] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/bb.php
[Sat Apr 11 09:17:29.673813 2026] [:error] [pid 22664:tid 22721] [client 4.205.120.59:62700] File does not exist: /usr/local/apache/htdocs/suspended-page/lf.php
[Sat Apr 11 09:17:29.699642 2026] [:error] [pid 22756:tid 22758] [client 20.251.36.179:21419] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fine.php"] [unique_id "admhKWfoSJ40LEm6kfqqwwAAAAA"]
[Sat Apr 11 09:17:30.342648 2026] [:error] [pid 22756:tid 22777] [client 20.251.36.179:2628] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fine.php"] [unique_id "admhKmfoSJ40LEm6kfqqygAAABM"]
[Sat Apr 11 09:17:30.873658 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:32423] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zample.php"] [unique_id "admhKmfoSJ40LEm6kfqq0QAAAAo"]
[Sat Apr 11 09:17:31.467880 2026] [:error] [pid 22665:tid 22735] [client 20.251.36.179:24096] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zample.php"] [unique_id "admhK0gi15J0QUr6OrPcVAAAAYs"]
[Sat Apr 11 09:17:32.017380 2026] [:error] [pid 22665:tid 22738] [client 20.251.36.179:2628] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zample.php"] [unique_id "admhLEgi15J0QUr6OrPcWAAAAY4"]
[Sat Apr 11 09:17:32.565605 2026] [:error] [pid 22665:tid 22746] [client 20.251.36.179:2246] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/zample.php"] [unique_id "admhLEgi15J0QUr6OrPcWQAAAZY"]
[Sat Apr 11 09:17:33.104819 2026] [:error] [pid 22663:tid 22669] [client 20.251.36.179:2650] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "admhLY1p7ez17BT2hZYFCwAAAQE"]
[Sat Apr 11 09:17:33.683654 2026] [:error] [pid 22756:tid 22770] [client 20.251.36.179:2658] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "admhLWfoSJ40LEm6kfqq4gAAAAw"]
[Sat Apr 11 09:17:34.232108 2026] [:error] [pid 22665:tid 22741] [client 20.251.36.179:2687] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "admhLkgi15J0QUr6OrPcXgAAAZE"]
[Sat Apr 11 09:17:34.821303 2026] [:error] [pid 22663:tid 22687] [client 20.251.36.179:40257] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/hplfuns.php"] [unique_id "admhLo1p7ez17BT2hZYFDQAAARM"]
[Sat Apr 11 09:17:35.401415 2026] [:error] [pid 22756:tid 22775] [client 20.251.36.179:61421] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "admhL2foSJ40LEm6kfqq8gAAABE"]
[Sat Apr 11 09:17:35.954823 2026] [:error] [pid 22663:tid 22690] [client 20.251.36.179:23540] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "admhL41p7ez17BT2hZYFEQAAARY"]
[Sat Apr 11 09:17:36.578729 2026] [:error] [pid 22756:tid 22758] [client 20.251.36.179:2256] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "admhMGfoSJ40LEm6kfqq-AAAAAA"]
[Sat Apr 11 09:17:37.112649 2026] [:error] [pid 22756:tid 22780] [client 20.251.36.179:23025] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/xa.php"] [unique_id "admhMWfoSJ40LEm6kfqq-wAAABY"]
[Sat Apr 11 09:17:37.628508 2026] [:error] [pid 22664:tid 22721] [client 20.251.36.179:2284] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "admhMQRS_OPFpcXOZmWCtQAAAVg"]
[Sat Apr 11 09:17:38.171526 2026] [:error] [pid 22756:tid 22781] [client 20.251.36.179:32417] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "admhMmfoSJ40LEm6kfqrCAAAABc"]
[Sat Apr 11 09:17:38.768047 2026] [:error] [pid 22756:tid 22766] [client 20.251.36.179:24122] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "admhMmfoSJ40LEm6kfqrEQAAAAg"]
[Sat Apr 11 09:17:38.841615 2026] [:error] [pid 22663:tid 22668] [client 4.205.120.59:64919] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "admhMo1p7ez17BT2hZYFGAAAAQA"]
[Sat Apr 11 09:17:39.414680 2026] [:error] [pid 22665:tid 22724] [client 20.251.36.179:32422] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/admin.php"] [unique_id "admhM0gi15J0QUr6OrPcaAAAAYA"]
[Sat Apr 11 09:17:39.972686 2026] [:error] [pid 22756:tid 22772] [client 20.251.36.179:24075] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inege.php"] [unique_id "admhM2foSJ40LEm6kfqrGQAAAA4"]
[Sat Apr 11 09:17:40.555622 2026] [:error] [pid 22663:tid 22687] [client 20.251.36.179:22992] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inege.php"] [unique_id "admhNI1p7ez17BT2hZYFGwAAARM"]
[Sat Apr 11 09:17:41.072037 2026] [:error] [pid 22664:tid 22708] [client 20.251.36.179:2303] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inege.php"] [unique_id "admhNQRS_OPFpcXOZmWCuAAAAUs"]
[Sat Apr 11 09:17:41.620105 2026] [:error] [pid 22756:tid 22766] [client 20.251.36.179:61391] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inege.php"] [unique_id "admhNWfoSJ40LEm6kfqrKwAAAAg"]
[Sat Apr 11 09:17:41.985229 2026] [:error] [pid 22665:tid 22737] [client 4.205.120.59:64925] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "admhNUgi15J0QUr6OrPcegAAAY0"]
[Sat Apr 11 09:17:42.192186 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:32408] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhNmfoSJ40LEm6kfqrRQAAAAM"]
[Sat Apr 11 09:17:42.721576 2026] [:error] [pid 22756:tid 22775] [client 20.251.36.179:2297] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhNmfoSJ40LEm6kfqrVgAAABE"]
[Sat Apr 11 09:17:43.270636 2026] [:error] [pid 22663:tid 22688] [client 20.251.36.179:61392] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhN41p7ez17BT2hZYFIQAAARQ"]
[Sat Apr 11 09:17:43.805006 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:23501] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhN0gi15J0QUr6OrPchwAAAZQ"]
[Sat Apr 11 09:17:44.321137 2026] [:error] [pid 22756:tid 22763] [client 20.251.36.179:64127] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "admhOGfoSJ40LEm6kfqrbwAAAAU"]
[Sat Apr 11 09:17:44.833844 2026] [:error] [pid 22756:tid 22758] [client 20.251.36.179:32414] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "admhOGfoSJ40LEm6kfqrdQAAAAA"]
[Sat Apr 11 09:17:45.381035 2026] [:error] [pid 22756:tid 22767] [client 20.251.36.179:36451] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "admhOWfoSJ40LEm6kfqrfQAAAAk"]
[Sat Apr 11 09:17:45.890926 2026] [:error] [pid 22756:tid 22760] [client 20.251.36.179:36423] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/uuu.php"] [unique_id "admhOWfoSJ40LEm6kfqrhAAAAAI"]
[Sat Apr 11 09:17:46.428076 2026] [:error] [pid 22756:tid 22766] [client 20.251.36.179:23002] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sf.php"] [unique_id "admhOmfoSJ40LEm6kfqrjAAAAAg"]
[Sat Apr 11 09:17:46.949583 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:19357] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sf.php"] [unique_id "admhOgRS_OPFpcXOZmWCvwAAAU8"]
[Sat Apr 11 09:17:47.474073 2026] [:error] [pid 22663:tid 22687] [client 20.251.36.179:40249] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sf.php"] [unique_id "admhO41p7ez17BT2hZYFJQAAARM"]
[Sat Apr 11 09:17:48.021094 2026] [:error] [pid 22665:tid 22740] [client 20.251.36.179:19347] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sf.php"] [unique_id "admhPEgi15J0QUr6OrPcjwAAAZA"]
[Sat Apr 11 09:17:48.540956 2026] [:error] [pid 22664:tid 22697] [client 20.251.36.179:36425] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no1.php"] [unique_id "admhPARS_OPFpcXOZmWCxgAAAUA"]
[Sat Apr 11 09:17:49.063213 2026] [:error] [pid 22664:tid 22714] [client 20.251.36.179:61413] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no1.php"] [unique_id "admhPQRS_OPFpcXOZmWCyQAAAVE"]
[Sat Apr 11 09:17:49.601119 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:40228] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no1.php"] [unique_id "admhPUgi15J0QUr6OrPckwAAAZM"]
[Sat Apr 11 09:17:50.140100 2026] [:error] [pid 22663:tid 22683] [client 20.251.36.179:32420] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/no1.php"] [unique_id "admhPo1p7ez17BT2hZYFKQAAAQ8"]
[Sat Apr 11 09:17:50.692569 2026] [:error] [pid 22665:tid 22724] [client 20.251.36.179:23013] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w2025.php"] [unique_id "admhPkgi15J0QUr6OrPcmAAAAYA"]
[Sat Apr 11 09:17:51.214735 2026] [:error] [pid 22756:tid 22764] [client 20.251.36.179:23000] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w2025.php"] [unique_id "admhP2foSJ40LEm6kfqrqAAAAAY"]
[Sat Apr 11 09:17:51.733229 2026] [:error] [pid 22756:tid 22778] [client 20.251.36.179:61407] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w2025.php"] [unique_id "admhP2foSJ40LEm6kfqrrgAAABQ"]
[Sat Apr 11 09:17:52.280041 2026] [:error] [pid 22756:tid 22773] [client 20.251.36.179:2302] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/w2025.php"] [unique_id "admhQGfoSJ40LEm6kfqrsgAAAA8"]
[Sat Apr 11 09:17:52.793001 2026] [:error] [pid 22756:tid 22765] [client 20.251.36.179:2242] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fvvff.php"] [unique_id "admhQGfoSJ40LEm6kfqruAAAAAc"]
[Sat Apr 11 09:17:53.323725 2026] [:error] [pid 22663:tid 22692] [client 20.251.36.179:33750] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fvvff.php"] [unique_id "admhQY1p7ez17BT2hZYFKwAAARg"]
[Sat Apr 11 09:17:53.840027 2026] [:error] [pid 22664:tid 22714] [client 20.251.36.179:22987] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fvvff.php"] [unique_id "admhQQRS_OPFpcXOZmWC2AAAAVE"]
[Sat Apr 11 09:17:54.065669 2026] [:error] [pid 22665:tid 22744] [client 4.205.120.59:62690] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "admhQkgi15J0QUr6OrPcqQAAAZQ"]
[Sat Apr 11 09:17:54.374608 2026] [:error] [pid 22665:tid 22737] [client 20.251.36.179:23515] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fvvff.php"] [unique_id "admhQkgi15J0QUr6OrPcqwAAAY0"]
[Sat Apr 11 09:17:54.895682 2026] [:error] [pid 22663:tid 22676] [client 20.251.36.179:22990] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "admhQo1p7ez17BT2hZYFLgAAAQg"]
[Sat Apr 11 09:17:55.420873 2026] [:error] [pid 22663:tid 22673] [client 20.251.36.179:19358] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "admhQ41p7ez17BT2hZYFLwAAAQU"]
[Sat Apr 11 09:17:55.957633 2026] [:error] [pid 22756:tid 22762] [client 20.251.36.179:61417] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "admhQ2foSJ40LEm6kfqr0wAAAAQ"]
[Sat Apr 11 09:17:56.482478 2026] [:error] [pid 22663:tid 22686] [client 20.251.36.179:32444] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a2.php"] [unique_id "admhRI1p7ez17BT2hZYFMwAAARI"]
[Sat Apr 11 09:17:56.998863 2026] [:error] [pid 22663:tid 22677] [client 20.251.36.179:33739] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "admhRI1p7ez17BT2hZYFNQAAAQk"]
[Sat Apr 11 09:17:57.554489 2026] [:error] [pid 22756:tid 22776] [client 20.251.36.179:40206] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "admhRWfoSJ40LEm6kfqr2wAAABI"]
[Sat Apr 11 09:17:58.089963 2026] [:error] [pid 22664:tid 22718] [client 20.251.36.179:19362] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "admhRgRS_OPFpcXOZmWC5AAAAVU"]
[Sat Apr 11 09:17:58.623873 2026] [:error] [pid 22664:tid 22710] [client 20.251.36.179:40205] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/edit.php"] [unique_id "admhRgRS_OPFpcXOZmWC5gAAAU0"]
[Sat Apr 11 09:17:59.161550 2026] [:error] [pid 22665:tid 22742] [client 20.251.36.179:32428] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "admhR0gi15J0QUr6OrPctwAAAZI"]
[Sat Apr 11 09:17:59.706977 2026] [:error] [pid 22756:tid 22771] [client 20.251.36.179:33082] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "admhR2foSJ40LEm6kfqr6gAAAA0"]
[Sat Apr 11 09:18:00.225053 2026] [:error] [pid 22756:tid 22767] [client 20.251.36.179:23007] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "admhSGfoSJ40LEm6kfqr7wAAAAk"]
[Sat Apr 11 09:18:00.755961 2026] [:error] [pid 22664:tid 22713] [client 20.251.36.179:21381] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "admhSARS_OPFpcXOZmWC7gAAAVA"]
[Sat Apr 11 09:18:01.279136 2026] [:error] [pid 22665:tid 22742] [client 20.251.36.179:36465] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhSUgi15J0QUr6OrPcwQAAAZI"]
[Sat Apr 11 09:18:01.804930 2026] [:error] [pid 22756:tid 22774] [client 20.251.36.179:23545] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhSWfoSJ40LEm6kfqr-QAAABA"]
[Sat Apr 11 09:18:02.335535 2026] [:error] [pid 22756:tid 22782] [client 20.251.36.179:23029] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhSmfoSJ40LEm6kfqr_gAAABg"]
[Sat Apr 11 09:18:02.849751 2026] [:error] [pid 22665:tid 22729] [client 20.251.36.179:2715] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhSkgi15J0QUr6OrPcxwAAAYU"]
[Sat Apr 11 09:18:03.402276 2026] [:error] [pid 22665:tid 22728] [client 20.251.36.179:61426] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "admhS0gi15J0QUr6OrPcyQAAAYQ"]
[Sat Apr 11 09:18:03.917014 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:61418] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "admhS2foSJ40LEm6kfqsEAAAAAM"]
[Sat Apr 11 09:18:04.436117 2026] [:error] [pid 22756:tid 22765] [client 20.251.36.179:36426] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "admhTGfoSJ40LEm6kfqsHQAAAAc"]
[Sat Apr 11 09:18:04.957305 2026] [:error] [pid 22665:tid 22729] [client 20.251.36.179:36462] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/66.php"] [unique_id "admhTEgi15J0QUr6OrPc1gAAAYU"]
[Sat Apr 11 09:18:05.495912 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:23518] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "admhTWfoSJ40LEm6kfqsKwAAAAs"]
[Sat Apr 11 09:18:06.017085 2026] [:error] [pid 22756:tid 22782] [client 20.251.36.179:21434] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "admhTmfoSJ40LEm6kfqsMgAAABg"]
[Sat Apr 11 09:18:06.547745 2026] [:error] [pid 22756:tid 22775] [client 20.251.36.179:32434] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "admhTmfoSJ40LEm6kfqsOQAAABE"]
[Sat Apr 11 09:18:07.075382 2026] [:error] [pid 22756:tid 22782] [client 20.251.36.179:22977] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a5.php"] [unique_id "admhT2foSJ40LEm6kfqsQAAAABg"]
[Sat Apr 11 09:18:07.591555 2026] [:error] [pid 22756:tid 22773] [client 20.251.36.179:19381] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ol.php"] [unique_id "admhT2foSJ40LEm6kfqsSgAAAA8"]
[Sat Apr 11 09:18:08.122673 2026] [:error] [pid 22665:tid 22725] [client 20.251.36.179:33049] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ol.php"] [unique_id "admhUEgi15J0QUr6OrPc3QAAAYE"]
[Sat Apr 11 09:18:08.630005 2026] [:error] [pid 22665:tid 22747] [client 4.205.120.59:62661] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hello.php"] [unique_id "admhUEgi15J0QUr6OrPc3wAAAZc"]
[Sat Apr 11 09:18:08.641943 2026] [:error] [pid 22664:tid 22697] [client 20.251.36.179:2705] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ol.php"] [unique_id "admhUARS_OPFpcXOZmWDHgAAAUA"]
[Sat Apr 11 09:18:09.161551 2026] [:error] [pid 22663:tid 22683] [client 20.251.36.179:23547] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ol.php"] [unique_id "admhUY1p7ez17BT2hZYFRAAAAQ8"]
[Sat Apr 11 09:18:09.674201 2026] [:error] [pid 22663:tid 22685] [client 20.251.36.179:36435] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "admhUY1p7ez17BT2hZYFSAAAARE"]
[Sat Apr 11 09:18:10.204650 2026] [:error] [pid 22664:tid 22702] [client 20.251.36.179:33751] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "admhUgRS_OPFpcXOZmWDIwAAAUU"]
[Sat Apr 11 09:18:10.745842 2026] [:error] [pid 22756:tid 22764] [client 20.251.36.179:32443] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "admhUmfoSJ40LEm6kfqsYgAAAAY"]
[Sat Apr 11 09:18:11.277630 2026] [:error] [pid 22663:tid 22674] [client 20.251.36.179:2249] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f6.php"] [unique_id "admhU41p7ez17BT2hZYFTgAAAQY"]
[Sat Apr 11 09:18:11.804361 2026] [:error] [pid 22663:tid 22682] [client 20.251.36.179:40244] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "admhU41p7ez17BT2hZYFTwAAAQ4"]
[Sat Apr 11 09:18:12.331182 2026] [:error] [pid 22663:tid 22675] [client 20.251.36.179:61410] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "admhVI1p7ez17BT2hZYFUwAAAQc"]
[Sat Apr 11 09:18:12.846152 2026] [:error] [pid 22665:tid 22736] [client 20.251.36.179:36447] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "admhVEgi15J0QUr6OrPc8QAAAYw"]
[Sat Apr 11 09:18:13.364620 2026] [:error] [pid 22756:tid 22776] [client 20.251.36.179:23014] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/inputs.php"] [unique_id "admhVWfoSJ40LEm6kfqsdgAAABI"]
[Sat Apr 11 09:18:13.855007 2026] [:error] [pid 22756:tid 22780] [client 4.205.120.59:62689] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "admhVWfoSJ40LEm6kfqseAAAABY"]
[Sat Apr 11 09:18:13.875646 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:40212] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/style.php"] [unique_id "admhVWfoSJ40LEm6kfqseQAAAAs"]
[Sat Apr 11 09:18:14.406701 2026] [:error] [pid 22756:tid 22771] [client 20.251.36.179:21920] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/style.php"] [unique_id "admhVmfoSJ40LEm6kfqsfAAAAA0"]
[Sat Apr 11 09:18:14.927803 2026] [:error] [pid 22756:tid 22770] [client 20.251.36.179:19335] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/style.php"] [unique_id "admhVmfoSJ40LEm6kfqsfwAAAAw"]
[Sat Apr 11 09:18:15.444295 2026] [:error] [pid 22756:tid 22776] [client 20.251.36.179:40253] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/style.php"] [unique_id "admhV2foSJ40LEm6kfqsggAAABI"]
[Sat Apr 11 09:18:15.970098 2026] [:error] [pid 22664:tid 22697] [client 20.251.36.179:36458] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aa.php"] [unique_id "admhVwRS_OPFpcXOZmWDQQAAAUA"]
[Sat Apr 11 09:18:16.514280 2026] [:error] [pid 22664:tid 22716] [client 20.251.36.179:61408] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/aa.php"] [unique_id "admhWARS_OPFpcXOZmWDRQAAAVM"]
[Sat Apr 11 09:18:17.067063 2026] [:error] [pid 22664:tid 22708] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Apr 11 09:18:17.328760 2026] [:error] [pid 22664:tid 22700] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sat Apr 11 09:18:17.848658 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Sat Apr 11 09:18:18.110280 2026] [:error] [pid 22664:tid 22697] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sat Apr 11 09:18:18.370184 2026] [:error] [pid 22664:tid 22721] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Sat Apr 11 09:18:18.629556 2026] [:error] [pid 22664:tid 22709] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Sat Apr 11 09:18:18.891054 2026] [:error] [pid 22664:tid 22701] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Sat Apr 11 09:18:19.152076 2026] [:error] [pid 22664:tid 22708] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Apr 11 09:18:19.675032 2026] [:error] [pid 22664:tid 22699] [client 20.251.36.179:32447] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Sat Apr 11 09:18:19.931317 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:32447] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-update.php"] [unique_id "admhWwRS_OPFpcXOZmWDVwAAAU8"]
[Sat Apr 11 09:18:20.456718 2026] [:error] [pid 22756:tid 22766] [client 20.251.36.179:61431] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-update.php"] [unique_id "admhXGfoSJ40LEm6kfqslwAAAAg"]
[Sat Apr 11 09:18:21.056680 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:21890] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-update.php"] [unique_id "admhXWfoSJ40LEm6kfqsoAAAAAM"]
[Sat Apr 11 09:18:21.577911 2026] [:error] [pid 22664:tid 22702] [client 20.251.36.179:23493] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-update.php"] [unique_id "admhXQRS_OPFpcXOZmWDWQAAAUU"]
[Sat Apr 11 09:18:22.090742 2026] [:error] [pid 22756:tid 22781] [client 20.251.36.179:19382] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "admhXmfoSJ40LEm6kfqsrAAAABc"]
[Sat Apr 11 09:18:22.613050 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:33787] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "admhXmfoSJ40LEm6kfqssAAAAAo"]
[Sat Apr 11 09:18:22.661804 2026] [:error] [pid 22665:tid 22747] [client 4.205.120.59:64923] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ok.php"] [unique_id "admhXkgi15J0QUr6OrPdBwAAAZc"]
[Sat Apr 11 09:18:23.150906 2026] [:error] [pid 22756:tid 22772] [client 20.251.36.179:23018] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "admhX2foSJ40LEm6kfqstAAAAA4"]
[Sat Apr 11 09:18:23.669987 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:19379] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/sbhu.php"] [unique_id "admhX2foSJ40LEm6kfqsugAAAAM"]
[Sat Apr 11 09:18:24.203496 2026] [:error] [pid 22663:tid 22668] [client 20.251.36.179:32441] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "admhYI1p7ez17BT2hZYFgQAAAQA"]
[Sat Apr 11 09:18:24.728439 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:61409] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "admhYEgi15J0QUr6OrPdCgAAAZM"]
[Sat Apr 11 09:18:25.274029 2026] [:error] [pid 22665:tid 22730] [client 20.251.36.179:21945] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "admhYUgi15J0QUr6OrPdDAAAAYY"]
[Sat Apr 11 09:18:25.790447 2026] [:error] [pid 22663:tid 22678] [client 20.251.36.179:61404] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "admhYY1p7ez17BT2hZYFhgAAAQo"]
[Sat Apr 11 09:18:26.381708 2026] [:error] [pid 22663:tid 22673] [client 20.251.36.179:21424] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "admhYo1p7ez17BT2hZYFjQAAAQU"]
[Sat Apr 11 09:18:26.901285 2026] [:error] [pid 22663:tid 22682] [client 20.251.36.179:23492] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "admhYo1p7ez17BT2hZYFlAAAAQ4"]
[Sat Apr 11 09:18:27.578147 2026] [:error] [pid 22665:tid 22746] [client 20.251.36.179:19341] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "admhY0gi15J0QUr6OrPdDgAAAZY"]
[Sat Apr 11 09:18:28.405380 2026] [:error] [pid 22756:tid 22780] [client 20.251.36.179:22991] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "admhZGfoSJ40LEm6kfqszwAAABY"]
[Sat Apr 11 09:18:29.324697 2026] [:error] [pid 22664:tid 22706] [client 20.251.36.179:20371] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhZQRS_OPFpcXOZmWDaAAAAUk"]
[Sat Apr 11 09:18:30.259432 2026] [:error] [pid 22756:tid 22763] [client 20.251.36.179:40216] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhZmfoSJ40LEm6kfqs1wAAAAU"]
[Sat Apr 11 09:18:34.029828 2026] [:error] [pid 22756:tid 22761] [client 4.205.120.59:64934] File does not exist: /usr/local/apache/htdocs/suspended-page/if.php
[Sat Apr 11 09:18:34.240922 2026] [:error] [pid 22756:tid 22773] [client 4.205.120.59:64934] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Sat Apr 11 09:18:34.326183 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:19931] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhamfoSJ40LEm6kfqs-gAAAAs"]
[Sat Apr 11 09:18:34.448938 2026] [:error] [pid 22756:tid 22774] [client 4.205.120.59:64934] File does not exist: /usr/local/apache/htdocs/suspended-page/kn.php
[Sat Apr 11 09:18:34.657158 2026] [:error] [pid 22756:tid 22768] [client 4.205.120.59:64934] File does not exist: /usr/local/apache/htdocs/suspended-page/3301.php
[Sat Apr 11 09:18:36.566083 2026] [:error] [pid 22756:tid 22772] [client 20.251.36.179:61423] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "admhbGfoSJ40LEm6kfqtDgAAAA4"]
[Sat Apr 11 09:18:39.557070 2026] [:error] [pid 22664:tid 22709] [client 20.251.36.179:40234] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admhbwRS_OPFpcXOZmWDeQAAAUw"]
[Sat Apr 11 09:18:40.488777 2026] [:error] [pid 22663:tid 22678] [client 4.205.120.59:62672] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Sat Apr 11 09:18:40.697504 2026] [:error] [pid 22663:tid 22674] [client 4.205.120.59:62672] File does not exist: /usr/local/apache/htdocs/suspended-page/.wp-cache.php
[Sat Apr 11 09:18:40.902688 2026] [:error] [pid 22663:tid 22689] [client 4.205.120.59:62672] [client 4.205.120.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/niil.php"] [unique_id "admhcI1p7ez17BT2hZYFsQAAARU"]
[Sat Apr 11 09:18:42.036410 2026] [:error] [pid 22665:tid 22738] [client 20.251.36.179:23020] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admhckgi15J0QUr6OrPdNQAAAY4"]
[Sat Apr 11 09:18:43.995099 2026] [:error] [pid 22664:tid 22700] [client 4.205.120.59:64906] [client 4.205.120.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519-items.php"] [unique_id "admhcwRS_OPFpcXOZmWDhwAAAUM"]
[Sat Apr 11 09:18:47.682771 2026] [:error] [pid 22664:tid 22719] [client 20.251.36.179:22980] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admhdwRS_OPFpcXOZmWDiQAAAVY"]
[Sat Apr 11 09:18:48.489928 2026] [:error] [pid 22756:tid 22779] [client 20.251.36.179:23030] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admheGfoSJ40LEm6kfqtXQAAABU"]
[Sat Apr 11 09:18:48.712226 2026] [:error] [pid 22756:tid 22759] [client 4.205.120.59:64987] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Sat Apr 11 09:18:50.265990 2026] [:error] [pid 22664:tid 22718] [client 20.251.36.179:61386] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "admhegRS_OPFpcXOZmWDkAAAAVU"]
[Sat Apr 11 09:18:50.412769 2026] [:error] [pid 22756:tid 22761] [client 4.205.120.59:64987] File does not exist: /usr/local/apache/htdocs/suspended-page/ohayo.php
[Sat Apr 11 09:18:50.620194 2026] [:error] [pid 22756:tid 22759] [client 4.205.120.59:64987] File does not exist: /usr/local/apache/htdocs/suspended-page/cms.php
[Sat Apr 11 09:18:50.844509 2026] [:error] [pid 22756:tid 22782] [client 4.205.120.59:64987] File does not exist: /usr/local/apache/htdocs/suspended-page/41.php
[Sat Apr 11 09:18:51.059592 2026] [:error] [pid 22756:tid 22762] [client 4.205.120.59:64987] File does not exist: /usr/local/apache/htdocs/suspended-page/4price.php
[Sat Apr 11 09:18:51.239925 2026] [:error] [pid 22665:tid 22731] [client 20.251.36.179:40251] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "admhe0gi15J0QUr6OrPdWQAAAYc"]
[Sat Apr 11 09:18:51.293687 2026] [:error] [pid 22756:tid 22773] [client 4.205.120.59:64987] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MARIJUANA.php"] [unique_id "admhe2foSJ40LEm6kfqtawAAAA8"]
[Sat Apr 11 09:18:52.326123 2026] [:error] [pid 22664:tid 22719] [client 20.251.36.179:33733] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "admhfARS_OPFpcXOZmWDlgAAAVY"]
[Sat Apr 11 09:18:53.370367 2026] [:error] [pid 22663:tid 22673] [client 20.251.36.179:55559] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "admhfY1p7ez17BT2hZYF0wAAAQU"]
[Sat Apr 11 09:18:53.979578 2026] [:error] [pid 22665:tid 22735] [client 4.205.120.59:62675] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MARIJUANA.php"] [unique_id "admhfUgi15J0QUr6OrPdbgAAAYs"]
[Sat Apr 11 09:18:54.002390 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:36478] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/goods.php"] [unique_id "admhfkgi15J0QUr6OrPdbwAAAZQ"]
[Sat Apr 11 09:18:54.817932 2026] [:error] [pid 22756:tid 22758] [client 20.251.36.179:21393] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/goods.php"] [unique_id "admhfmfoSJ40LEm6kfqtcQAAAAA"]
[Sat Apr 11 09:18:55.829380 2026] [:error] [pid 22665:tid 22738] [client 20.251.36.179:21385] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/goods.php"] [unique_id "admhf0gi15J0QUr6OrPdeQAAAY4"]
[Sat Apr 11 09:18:57.267723 2026] [:error] [pid 22756:tid 22779] [client 20.251.36.179:40221] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/goods.php"] [unique_id "admhgWfoSJ40LEm6kfqtgAAAABU"]
[Sat Apr 11 09:18:58.066155 2026] [:error] [pid 22756:tid 22762] [client 4.205.120.59:62662] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MARIJUANA.php"] [unique_id "admhgmfoSJ40LEm6kfqthwAAAAQ"]
[Sat Apr 11 09:18:58.614589 2026] [:error] [pid 22756:tid 22778] [client 20.251.36.179:33077] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admhgmfoSJ40LEm6kfqtjAAAABQ"]
[Sat Apr 11 09:18:59.966635 2026] [:error] [pid 22664:tid 22700] [client 20.251.36.179:55564] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admhgwRS_OPFpcXOZmWDqQAAAUM"]
[Sat Apr 11 09:19:01.755699 2026] [:error] [pid 22665:tid 22729] [client 20.251.36.179:19330] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admhhUgi15J0QUr6OrPdiwAAAYU"]
[Sat Apr 11 09:19:03.565470 2026] [:error] [pid 22664:tid 22705] [client 4.205.120.59:64920] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/MARIJUANA.php"] [unique_id "admhhwRS_OPFpcXOZmWDsgAAAUg"]
[Sat Apr 11 09:19:03.741727 2026] [:error] [pid 22664:tid 22711] [client 20.251.36.179:21935] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "admhhwRS_OPFpcXOZmWDtAAAAU4"]
[Sat Apr 11 09:19:04.355975 2026] [:error] [pid 22664:tid 22713] [client 20.251.36.179:19930] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "admhiARS_OPFpcXOZmWDuQAAAVA"]
[Sat Apr 11 09:19:05.837803 2026] [:error] [pid 22664:tid 22717] [client 20.251.36.179:19948] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "admhiQRS_OPFpcXOZmWDvwAAAVQ"]
[Sat Apr 11 09:19:07.142789 2026] [:error] [pid 22665:tid 22729] [client 20.251.36.179:2440] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "admhi0gi15J0QUr6OrPdogAAAYU"]
[Sat Apr 11 09:19:08.233072 2026] [:error] [pid 22665:tid 22745] [client 20.251.36.179:42259] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/222.php"] [unique_id "admhjEgi15J0QUr6OrPdqAAAAZU"]
[Sat Apr 11 09:19:09.404481 2026] [:error] [pid 22756:tid 22766] [client 20.251.36.179:55591] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "admhjWfoSJ40LEm6kfqtogAAAAg"]
[Sat Apr 11 09:19:10.434856 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:33784] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "admhjkgi15J0QUr6OrPdqwAAAZM"]
[Sat Apr 11 09:19:10.451534 2026] [:error] [pid 22664:tid 22719] [client 4.205.120.59:64930] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.fk.php"] [unique_id "admhjgRS_OPFpcXOZmWDzgAAAVY"]
[Sat Apr 11 09:19:11.203156 2026] [:error] [pid 22756:tid 22780] [client 20.251.36.179:55583] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "admhj2foSJ40LEm6kfqtpwAAABY"]
[Sat Apr 11 09:19:12.180268 2026] [:error] [pid 22665:tid 22729] [client 20.251.36.179:24068] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "admhkEgi15J0QUr6OrPdsgAAAYU"]
[Sat Apr 11 09:19:12.793111 2026] [:error] [pid 22663:tid 22677] [client 20.251.36.179:20410] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fff.php"] [unique_id "admhkI1p7ez17BT2hZYF8AAAAQk"]
[Sat Apr 11 09:19:12.890979 2026] [:error] [pid 22756:tid 22761] [client 4.205.120.59:64896] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.fk.php"] [unique_id "admhkGfoSJ40LEm6kfqtqwAAAAM"]
[Sat Apr 11 09:19:13.656890 2026] [:error] [pid 22756:tid 22779] [client 20.251.36.179:19910] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fff.php"] [unique_id "admhkWfoSJ40LEm6kfqtrgAAABU"]
[Sat Apr 11 09:19:14.309650 2026] [:error] [pid 22665:tid 22728] [client 20.251.36.179:40213] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fff.php"] [unique_id "admhkkgi15J0QUr6OrPdtgAAAYQ"]
[Sat Apr 11 09:19:15.239760 2026] [:error] [pid 22664:tid 22717] [client 20.251.36.179:36438] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fff.php"] [unique_id "admhkwRS_OPFpcXOZmWD3QAAAVQ"]
[Sat Apr 11 09:19:15.831704 2026] [:error] [pid 22756:tid 22767] [client 20.251.36.179:33748] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admhk2foSJ40LEm6kfqttgAAAAk"]
[Sat Apr 11 09:19:16.399298 2026] [:error] [pid 22665:tid 22736] [client 20.251.36.179:36437] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admhlEgi15J0QUr6OrPdvAAAAYw"]
[Sat Apr 11 09:19:16.925795 2026] [:error] [pid 22756:tid 22782] [client 20.251.36.179:19336] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admhlGfoSJ40LEm6kfqtugAAABg"]
[Sat Apr 11 09:19:17.566642 2026] [:error] [pid 22756:tid 22762] [client 20.251.36.179:21917] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admhlWfoSJ40LEm6kfqtwQAAAAQ"]
[Sat Apr 11 09:19:18.188338 2026] [:error] [pid 22663:tid 22677] [client 20.251.36.179:2282] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we.php"] [unique_id "admhlo1p7ez17BT2hZYF-wAAAQk"]
[Sat Apr 11 09:19:18.813332 2026] [:error] [pid 22663:tid 22672] [client 20.251.36.179:55596] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/we.php"] [unique_id "admhlo1p7ez17BT2hZYF_AAAAQQ"]
[Sat Apr 11 09:19:19.381716 2026] [:error] [pid 22664:tid 22719] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Sat Apr 11 09:19:19.643997 2026] [:error] [pid 22664:tid 22713] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Sat Apr 11 09:19:19.908356 2026] [:error] [pid 22664:tid 22708] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sat Apr 11 09:19:20.808735 2026] [:error] [pid 22664:tid 22708] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Sat Apr 11 09:19:21.076207 2026] [:error] [pid 22664:tid 22701] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Apr 11 09:19:21.595678 2026] [:error] [pid 22664:tid 22704] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sat Apr 11 09:19:23.130231 2026] [:error] [pid 22664:tid 22713] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Sat Apr 11 09:19:23.390046 2026] [:error] [pid 22664:tid 22707] [client 20.251.36.179:40218] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Apr 11 09:19:23.907016 2026] [:error] [pid 22664:tid 22721] [client 20.251.36.179:40218] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhmwRS_OPFpcXOZmWD_wAAAVg"]
[Sat Apr 11 09:19:24.466925 2026] [:error] [pid 22664:tid 22703] [client 20.251.36.179:33048] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhnARS_OPFpcXOZmWEAAAAAUY"]
[Sat Apr 11 09:19:25.007937 2026] [:error] [pid 22756:tid 22765] [client 20.251.36.179:19360] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhnWfoSJ40LEm6kfqt3wAAAAc"]
[Sat Apr 11 09:19:25.576793 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:42272] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fe5.php"] [unique_id "admhnQRS_OPFpcXOZmWECQAAAU8"]
[Sat Apr 11 09:19:26.139497 2026] [:error] [pid 22756:tid 22763] [client 20.251.36.179:21897] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "admhnmfoSJ40LEm6kfqt4wAAAAU"]
[Sat Apr 11 09:19:26.681392 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:19383] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "admhnkgi15J0QUr6OrPdxQAAAZM"]
[Sat Apr 11 09:19:27.255818 2026] [:error] [pid 22665:tid 22738] [client 20.251.36.179:2465] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "admhn0gi15J0QUr6OrPdxwAAAY4"]
[Sat Apr 11 09:19:27.798713 2026] [:error] [pid 22756:tid 22758] [client 20.251.36.179:40230] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "admhn2foSJ40LEm6kfqt5AAAAAA"]
[Sat Apr 11 09:19:28.392799 2026] [:error] [pid 22663:tid 22688] [client 20.251.36.179:21932] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/av.php"] [unique_id "admhoI1p7ez17BT2hZYGBQAAARQ"]
[Sat Apr 11 09:19:28.939617 2026] [:error] [pid 22665:tid 22731] [client 20.251.36.179:40207] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/av.php"] [unique_id "admhoEgi15J0QUr6OrPdzAAAAYc"]
[Sat Apr 11 09:19:29.534749 2026] [:error] [pid 22665:tid 22732] [client 20.251.36.179:19354] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/av.php"] [unique_id "admhoUgi15J0QUr6OrPdzQAAAYg"]
[Sat Apr 11 09:19:30.061691 2026] [:error] [pid 22663:tid 22689] [client 20.251.36.179:40239] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/av.php"] [unique_id "admhoo1p7ez17BT2hZYGCAAAARU"]
[Sat Apr 11 09:19:30.600681 2026] [:error] [pid 22665:tid 22733] [client 20.251.36.179:19962] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "admhokgi15J0QUr6OrPdzwAAAYk"]
[Sat Apr 11 09:19:31.150126 2026] [:error] [pid 22664:tid 22702] [client 20.251.36.179:33754] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "admhowRS_OPFpcXOZmWEEgAAAUU"]
[Sat Apr 11 09:19:31.691548 2026] [:error] [pid 22756:tid 22781] [client 20.251.36.179:55606] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "admho2foSJ40LEm6kfqt8wAAABc"]
[Sat Apr 11 09:19:32.257128 2026] [:error] [pid 22756:tid 22780] [client 20.251.36.179:42243] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/abcd.php"] [unique_id "admhpGfoSJ40LEm6kfqt9gAAABY"]
[Sat Apr 11 09:19:32.798917 2026] [:error] [pid 22663:tid 22668] [client 20.251.36.179:33028] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fi.php"] [unique_id "admhpI1p7ez17BT2hZYGDgAAAQA"]
[Sat Apr 11 09:19:33.392385 2026] [:error] [pid 22756:tid 22770] [client 20.251.36.179:42263] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fi.php"] [unique_id "admhpWfoSJ40LEm6kfqt-wAAAAw"]
[Sat Apr 11 09:19:33.928987 2026] [:error] [pid 22756:tid 22782] [client 20.251.36.179:36442] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fi.php"] [unique_id "admhpWfoSJ40LEm6kfqt_QAAABg"]
[Sat Apr 11 09:19:34.495743 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:55553] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/fi.php"] [unique_id "admhpmfoSJ40LEm6kfquAQAAAAo"]
[Sat Apr 11 09:19:34.605035 2026] [:error] [pid 22663:tid 22688] [client 4.205.120.59:64931] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/XxX.php"] [unique_id "admhpo1p7ez17BT2hZYGFAAAARQ"]
[Sat Apr 11 09:19:35.048251 2026] [:error] [pid 22665:tid 22727] [client 20.251.36.179:33080] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1.php"] [unique_id "admhp0gi15J0QUr6OrPd2gAAAYM"]
[Sat Apr 11 09:19:35.587965 2026] [:error] [pid 22756:tid 22760] [client 20.251.36.179:19367] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1.php"] [unique_id "admhp2foSJ40LEm6kfquBgAAAAI"]
[Sat Apr 11 09:19:36.133903 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:2683] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1.php"] [unique_id "admhqGfoSJ40LEm6kfquCwAAAAs"]
[Sat Apr 11 09:19:36.669559 2026] [:error] [pid 22664:tid 22700] [client 20.251.36.179:23010] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/a1.php"] [unique_id "admhqARS_OPFpcXOZmWEFgAAAUM"]
[Sat Apr 11 09:19:37.204068 2026] [:error] [pid 22665:tid 22747] [client 20.251.36.179:21907] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/update/f35.php"] [unique_id "admhqUgi15J0QUr6OrPd4QAAAZc"]
[Sat Apr 11 09:19:37.783399 2026] [:error] [pid 22665:tid 22746] [client 20.251.36.179:33055] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/update/f35.php"] [unique_id "admhqUgi15J0QUr6OrPd4wAAAZY"]
[Sat Apr 11 09:19:38.328420 2026] [:error] [pid 22756:tid 22758] [client 20.251.36.179:42303] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/update/f35.php"] [unique_id "admhqmfoSJ40LEm6kfquFQAAAAA"]
[Sat Apr 11 09:19:38.876473 2026] [:error] [pid 22756:tid 22782] [client 20.251.36.179:33766] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/update/f35.php"] [unique_id "admhqmfoSJ40LEm6kfquFwAAABg"]
[Sat Apr 11 09:19:39.440208 2026] [:error] [pid 22665:tid 22733] [client 20.251.36.179:55575] [client 20.251.36.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "admhq0gi15J0QUr6OrPd5wAAAYk"]
[Sat Apr 11 09:19:39.974169 2026] [:error] [pid 22664:tid 22709] [client 20.251.36.179:25991] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "admhqwRS_OPFpcXOZmWEGAAAAUw"]
[Sat Apr 11 09:19:40.502599 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:55555] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "admhrEgi15J0QUr6OrPd7wAAAZM"]
[Sat Apr 11 09:19:41.035523 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:21942] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/f35.php"] [unique_id "admhrWfoSJ40LEm6kfquHQAAAAM"]
[Sat Apr 11 09:19:41.583024 2026] [:error] [pid 22665:tid 22733] [client 20.251.36.179:23006] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "admhrUgi15J0QUr6OrPd8wAAAYk"]
[Sat Apr 11 09:19:42.104405 2026] [:error] [pid 22664:tid 22718] [client 20.251.36.179:55615] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "admhrgRS_OPFpcXOZmWEHAAAAVU"]
[Sat Apr 11 09:19:42.637184 2026] [:error] [pid 22756:tid 22765] [client 20.251.36.179:21942] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "admhrmfoSJ40LEm6kfquHwAAAAc"]
[Sat Apr 11 09:19:43.179464 2026] [:error] [pid 22756:tid 22772] [client 20.251.36.179:33054] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "admhr2foSJ40LEm6kfquJQAAAA4"]
[Sat Apr 11 09:19:43.721584 2026] [:error] [pid 22663:tid 22692] [client 20.251.36.179:2494] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "admhr41p7ez17BT2hZYGLQAAARg"]
[Sat Apr 11 09:19:44.239941 2026] [:error] [pid 22756:tid 22776] [client 20.251.36.179:61382] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "admhsGfoSJ40LEm6kfquLgAAABI"]
[Sat Apr 11 09:19:44.789028 2026] [:error] [pid 22663:tid 22681] [client 20.251.36.179:23039] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "admhsI1p7ez17BT2hZYGMQAAAQ0"]
[Sat Apr 11 09:19:45.322378 2026] [:error] [pid 22663:tid 22668] [client 20.251.36.179:23008] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "admhsY1p7ez17BT2hZYGMgAAAQA"]
[Sat Apr 11 09:19:45.835981 2026] [:error] [pid 22663:tid 22682] [client 20.251.36.179:23031] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/prv8.php"] [unique_id "admhsY1p7ez17BT2hZYGNAAAAQ4"]
[Sat Apr 11 09:19:46.382170 2026] [:error] [pid 22665:tid 22726] [client 20.251.36.179:36475] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/prv8.php"] [unique_id "admhskgi15J0QUr6OrPeAAAAAYI"]
[Sat Apr 11 09:19:46.895793 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:36473] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/prv8.php"] [unique_id "admhskgi15J0QUr6OrPeAgAAAZQ"]
[Sat Apr 11 09:19:47.424627 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:33763] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/prv8.php"] [unique_id "admhs2foSJ40LEm6kfquOgAAAAo"]
[Sat Apr 11 09:19:47.968620 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:55600] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/k.php"] [unique_id "admhswRS_OPFpcXOZmWEJAAAAU8"]
[Sat Apr 11 09:19:48.496818 2026] [:error] [pid 22663:tid 22683] [client 20.251.36.179:2274] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/k.php"] [unique_id "admhtI1p7ez17BT2hZYGQAAAAQ8"]
[Sat Apr 11 09:19:49.025055 2026] [:error] [pid 22663:tid 22670] [client 20.251.36.179:19386] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/k.php"] [unique_id "admhtY1p7ez17BT2hZYGQgAAAQI"]
[Sat Apr 11 09:19:49.551354 2026] [:error] [pid 22665:tid 22741] [client 20.251.36.179:22979] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/k.php"] [unique_id "admhtUgi15J0QUr6OrPeDAAAAZE"]
[Sat Apr 11 09:19:50.066050 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:2493] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev.php"] [unique_id "admhtmfoSJ40LEm6kfquQwAAAAo"]
[Sat Apr 11 09:19:50.607188 2026] [:error] [pid 22756:tid 22778] [client 20.251.36.179:21904] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev.php"] [unique_id "admhtmfoSJ40LEm6kfquRAAAABQ"]
[Sat Apr 11 09:19:50.819705 2026] [:error] [pid 22665:tid 22731] [client 4.205.120.59:64956] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/content.php"] [unique_id "admhtkgi15J0QUr6OrPeEQAAAYc"]
[Sat Apr 11 09:19:51.164800 2026] [:error] [pid 22756:tid 22773] [client 20.251.36.179:23021] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev.php"] [unique_id "admht2foSJ40LEm6kfquSAAAAA8"]
[Sat Apr 11 09:19:51.703964 2026] [:error] [pid 22756:tid 22770] [client 20.251.36.179:2283] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/dev.php"] [unique_id "admht2foSJ40LEm6kfquTgAAAAw"]
[Sat Apr 11 09:19:52.226422 2026] [:error] [pid 22664:tid 22707] [client 20.251.36.179:55605] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bal.php"] [unique_id "admhuARS_OPFpcXOZmWEKQAAAUo"]
[Sat Apr 11 09:19:52.755200 2026] [:error] [pid 22665:tid 22726] [client 20.251.36.179:2434] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bal.php"] [unique_id "admhuEgi15J0QUr6OrPeFAAAAYI"]
[Sat Apr 11 09:19:53.282664 2026] [:error] [pid 22756:tid 22759] [client 20.251.36.179:19339] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bal.php"] [unique_id "admhuWfoSJ40LEm6kfquVwAAAAE"]
[Sat Apr 11 09:19:53.806583 2026] [:error] [pid 22756:tid 22777] [client 20.251.36.179:42240] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bal.php"] [unique_id "admhuWfoSJ40LEm6kfquWwAAABM"]
[Sat Apr 11 09:19:54.335418 2026] [:error] [pid 22664:tid 22719] [client 20.251.36.179:2489] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/in.php"] [unique_id "admhugRS_OPFpcXOZmWELAAAAVY"]
[Sat Apr 11 09:19:54.851223 2026] [:error] [pid 22665:tid 22736] [client 20.251.36.179:33747] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/in.php"] [unique_id "admhukgi15J0QUr6OrPeGgAAAYw"]
[Sat Apr 11 09:19:55.380972 2026] [:error] [pid 22665:tid 22747] [client 20.251.36.179:42277] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/in.php"] [unique_id "admhu0gi15J0QUr6OrPeHQAAAZc"]
[Sat Apr 11 09:19:55.912791 2026] [:error] [pid 22664:tid 22717] [client 20.251.36.179:21934] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/in.php"] [unique_id "admhuwRS_OPFpcXOZmWEMwAAAVQ"]
[Sat Apr 11 09:19:56.457917 2026] [:error] [pid 22664:tid 22707] [client 20.251.36.179:40227] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gssdd.php"] [unique_id "admhvARS_OPFpcXOZmWENgAAAUo"]
[Sat Apr 11 09:19:56.987063 2026] [:error] [pid 22665:tid 22748] [client 20.251.36.179:32394] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gssdd.php"] [unique_id "admhvEgi15J0QUr6OrPeIgAAAZg"]
[Sat Apr 11 09:19:57.514346 2026] [:error] [pid 22665:tid 22735] [client 20.251.36.179:21383] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gssdd.php"] [unique_id "admhvUgi15J0QUr6OrPeJAAAAYs"]
[Sat Apr 11 09:19:58.071943 2026] [:error] [pid 22665:tid 22733] [client 20.251.36.179:23022] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gssdd.php"] [unique_id "admhvkgi15J0QUr6OrPeKgAAAYk"]
[Sat Apr 11 09:19:58.594641 2026] [:error] [pid 22665:tid 22738] [client 20.251.36.179:2444] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "admhvkgi15J0QUr6OrPeLQAAAY4"]
[Sat Apr 11 09:19:59.120610 2026] [:error] [pid 22665:tid 22730] [client 20.251.36.179:19385] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "admhv0gi15J0QUr6OrPeMAAAAYY"]
[Sat Apr 11 09:19:59.650217 2026] [:error] [pid 22663:tid 22668] [client 20.251.36.179:40310] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "admhv41p7ez17BT2hZYGYQAAAQA"]
[Sat Apr 11 09:20:00.167977 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:2735] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/motu.php"] [unique_id "admhwARS_OPFpcXOZmWEPAAAAU8"]
[Sat Apr 11 09:20:00.693538 2026] [:error] [pid 22665:tid 22733] [client 20.251.36.179:2449] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bs1.php"] [unique_id "admhwEgi15J0QUr6OrPeNgAAAYk"]
[Sat Apr 11 09:20:01.214756 2026] [:error] [pid 22665:tid 22745] [client 20.251.36.179:22978] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bs1.php"] [unique_id "admhwUgi15J0QUr6OrPeOgAAAZU"]
[Sat Apr 11 09:20:01.734531 2026] [:error] [pid 22665:tid 22731] [client 20.251.36.179:2457] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bs1.php"] [unique_id "admhwUgi15J0QUr6OrPePQAAAYc"]
[Sat Apr 11 09:20:02.261041 2026] [:error] [pid 22663:tid 22674] [client 20.251.36.179:22983] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bs1.php"] [unique_id "admhwo1p7ez17BT2hZYGZwAAAQY"]
[Sat Apr 11 09:20:02.818954 2026] [:error] [pid 22663:tid 22686] [client 20.251.36.179:64072] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bengi.php"] [unique_id "admhwo1p7ez17BT2hZYGawAAARI"]
[Sat Apr 11 09:20:03.364098 2026] [:error] [pid 22664:tid 22719] [client 20.251.36.179:23533] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bengi.php"] [unique_id "admhwwRS_OPFpcXOZmWEQwAAAVY"]
[Sat Apr 11 09:20:03.879174 2026] [:error] [pid 22664:tid 22708] [client 20.251.36.179:21395] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bengi.php"] [unique_id "admhwwRS_OPFpcXOZmWERgAAAUs"]
[Sat Apr 11 09:20:04.453061 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:2495] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/bengi.php"] [unique_id "admhxARS_OPFpcXOZmWESAAAAU8"]
[Sat Apr 11 09:20:05.005409 2026] [:error] [pid 22756:tid 22774] [client 20.251.36.179:33743] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "admhxWfoSJ40LEm6kfquXwAAABA"]
[Sat Apr 11 09:20:05.561015 2026] [:error] [pid 22665:tid 22733] [client 20.251.36.179:42273] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "admhxUgi15J0QUr6OrPeSwAAAYk"]
[Sat Apr 11 09:20:06.088514 2026] [:error] [pid 22756:tid 22766] [client 20.251.36.179:61397] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "admhxmfoSJ40LEm6kfquZgAAAAg"]
[Sat Apr 11 09:20:06.612521 2026] [:error] [pid 22664:tid 22703] [client 20.251.36.179:2488] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "admhxgRS_OPFpcXOZmWETQAAAUY"]
[Sat Apr 11 09:20:07.149049 2026] [:error] [pid 22665:tid 22747] [client 20.251.36.179:2290] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/axx.php"] [unique_id "admhx0gi15J0QUr6OrPeUgAAAZc"]
[Sat Apr 11 09:20:07.675388 2026] [:error] [pid 22664:tid 22721] [client 20.251.36.179:40201] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/axx.php"] [unique_id "admhxwRS_OPFpcXOZmWEUQAAAVg"]
[Sat Apr 11 09:20:08.193422 2026] [:error] [pid 22664:tid 22712] [client 20.251.36.179:19352] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/axx.php"] [unique_id "admhyARS_OPFpcXOZmWEVAAAAU8"]
[Sat Apr 11 09:20:08.727177 2026] [:error] [pid 22665:tid 22728] [client 20.251.36.179:2486] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/axx.php"] [unique_id "admhyEgi15J0QUr6OrPeVQAAAYQ"]
[Sat Apr 11 09:20:09.248092 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:2450] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfashell.php"] [unique_id "admhyUgi15J0QUr6OrPeWQAAAZQ"]
[Sat Apr 11 09:20:09.763894 2026] [:error] [pid 22664:tid 22711] [client 20.251.36.179:33783] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfashell.php"] [unique_id "admhyQRS_OPFpcXOZmWEWgAAAU4"]
[Sat Apr 11 09:20:10.094988 2026] [:error] [pid 22665:tid 22734] [client 4.205.120.59:64992] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "admhykgi15J0QUr6OrPeXgAAAYo"]
[Sat Apr 11 09:20:10.282842 2026] [:error] [pid 22665:tid 22728] [client 20.251.36.179:23037] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfashell.php"] [unique_id "admhykgi15J0QUr6OrPeXwAAAYQ"]
[Sat Apr 11 09:20:10.806113 2026] [:error] [pid 22664:tid 22697] [client 20.251.36.179:24116] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/alfashell.php"] [unique_id "admhygRS_OPFpcXOZmWEXQAAAUA"]
[Sat Apr 11 09:20:11.337630 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:61377] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "admhy0gi15J0QUr6OrPeYgAAAZQ"]
[Sat Apr 11 09:20:11.844781 2026] [:error] [pid 22664:tid 22698] [client 20.251.36.179:33789] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "admhywRS_OPFpcXOZmWEYQAAAUE"]
[Sat Apr 11 09:20:12.375078 2026] [:error] [pid 22664:tid 22709] [client 20.251.36.179:33064] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "admhzARS_OPFpcXOZmWEYgAAAUw"]
[Sat Apr 11 09:20:12.894311 2026] [:error] [pid 22756:tid 22762] [client 20.251.36.179:19937] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/gettest.php"] [unique_id "admhzGfoSJ40LEm6kfquegAAAAQ"]
[Sat Apr 11 09:20:13.435440 2026] [:error] [pid 22663:tid 22670] [client 20.251.36.179:2476] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/acp.php"] [unique_id "admhzY1p7ez17BT2hZYGcAAAAQI"]
[Sat Apr 11 09:20:13.954570 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:21897] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/acp.php"] [unique_id "admhzWfoSJ40LEm6kfquhAAAAAs"]
[Sat Apr 11 09:20:14.485973 2026] [:error] [pid 22665:tid 22742] [client 20.251.36.179:33087] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/acp.php"] [unique_id "admhzkgi15J0QUr6OrPeZwAAAZI"]
[Sat Apr 11 09:20:15.004841 2026] [:error] [pid 22664:tid 22701] [client 20.251.36.179:33037] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/acp.php"] [unique_id "admhzwRS_OPFpcXOZmWEbAAAAUQ"]
[Sat Apr 11 09:20:15.526449 2026] [:error] [pid 22756:tid 22769] [client 20.251.36.179:40203] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "admhz2foSJ40LEm6kfqujwAAAAs"]
[Sat Apr 11 09:20:16.060278 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:22996] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "admh0GfoSJ40LEm6kfqulQAAAAM"]
[Sat Apr 11 09:20:16.589505 2026] [:error] [pid 22756:tid 22772] [client 20.251.36.179:33071] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "admh0GfoSJ40LEm6kfqumQAAAA4"]
[Sat Apr 11 09:20:17.108398 2026] [:error] [pid 22664:tid 22713] [client 20.251.36.179:55601] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/file48.php"] [unique_id "admh0QRS_OPFpcXOZmWEcwAAAVA"]
[Sat Apr 11 09:20:17.639674 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:36470] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "admh0Ugi15J0QUr6OrPecwAAAZM"]
[Sat Apr 11 09:20:18.187162 2026] [:error] [pid 22664:tid 22714] [client 20.251.36.179:55560] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "admh0gRS_OPFpcXOZmWEeQAAAVE"]
[Sat Apr 11 09:20:18.706748 2026] [:error] [pid 22756:tid 22761] [client 20.251.36.179:42298] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "admh0mfoSJ40LEm6kfquoQAAAAM"]
[Sat Apr 11 09:20:19.234348 2026] [:error] [pid 22664:tid 22700] [client 20.251.36.179:33782] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/g.php"] [unique_id "admh0wRS_OPFpcXOZmWEfgAAAUM"]
[Sat Apr 11 09:20:19.762388 2026] [:error] [pid 22756:tid 22780] [client 20.251.36.179:19925] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admh02foSJ40LEm6kfquqQAAABY"]
[Sat Apr 11 09:20:20.295989 2026] [:error] [pid 22663:tid 22685] [client 20.251.36.179:21429] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admh1I1p7ez17BT2hZYGdQAAARE"]
[Sat Apr 11 09:20:20.822044 2026] [:error] [pid 22756:tid 22768] [client 20.251.36.179:19380] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admh1GfoSJ40LEm6kfqurQAAAAo"]
[Sat Apr 11 09:20:21.369291 2026] [:error] [pid 22756:tid 22766] [client 20.251.36.179:36419] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/wp-content/"] [unique_id "admh1WfoSJ40LEm6kfqutAAAAAg"]
[Sat Apr 11 09:20:21.476695 2026] [:error] [pid 22756:tid 22779] [client 4.205.120.59:65016] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "admh1WfoSJ40LEm6kfquuAAAABU"]
[Sat Apr 11 09:20:21.888745 2026] [:error] [pid 22664:tid 22716] [client 20.251.36.179:40193] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/simple.php"] [unique_id "admh1QRS_OPFpcXOZmWEhgAAAVM"]
[Sat Apr 11 09:20:22.414942 2026] [:error] [pid 22663:tid 22671] [client 20.251.36.179:33027] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/simple.php"] [unique_id "admh1o1p7ez17BT2hZYGeAAAAQM"]
[Sat Apr 11 09:20:22.950678 2026] [:error] [pid 22664:tid 22707] [client 20.251.36.179:19951] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/simple.php"] [unique_id "admh1gRS_OPFpcXOZmWEiwAAAUo"]
[Sat Apr 11 09:20:23.483078 2026] [:error] [pid 22665:tid 22746] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Apr 11 09:20:23.740767 2026] [:error] [pid 22665:tid 22734] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Sat Apr 11 09:20:23.999352 2026] [:error] [pid 22665:tid 22742] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Sat Apr 11 09:20:24.260710 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sat Apr 11 09:20:24.520904 2026] [:error] [pid 22665:tid 22748] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Apr 11 09:20:24.780577 2026] [:error] [pid 22665:tid 22731] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Sat Apr 11 09:20:25.040265 2026] [:error] [pid 22665:tid 22730] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Sat Apr 11 09:20:25.303168 2026] [:error] [pid 22665:tid 22738] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Sat Apr 11 09:20:25.563788 2026] [:error] [pid 22665:tid 22729] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sat Apr 11 09:20:25.822658 2026] [:error] [pid 22665:tid 22724] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Sat Apr 11 09:20:26.081429 2026] [:error] [pid 22665:tid 22725] [client 20.251.36.179:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Apr 11 09:20:26.336747 2026] [:error] [pid 22665:tid 22726] [client 20.251.36.179:21935] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/chosen.php"] [unique_id "admh2kgi15J0QUr6OrPeiwAAAYI"]
[Sat Apr 11 09:20:26.847351 2026] [:error] [pid 22665:tid 22743] [client 20.251.36.179:33771] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/chosen.php"] [unique_id "admh2kgi15J0QUr6OrPejAAAAZM"]
[Sat Apr 11 09:20:27.374910 2026] [:error] [pid 22665:tid 22744] [client 20.251.36.179:42241] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/chosen.php"] [unique_id "admh20gi15J0QUr6OrPejgAAAZQ"]
[Sat Apr 11 09:20:27.908732 2026] [:error] [pid 22665:tid 22738] [client 20.251.36.179:33059] [client 20.251.36.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.aoswa.com.au"] [uri "/chosen.php"] [unique_id "admh20gi15J0QUr6OrPelQAAAY4"]
[Sat Apr 11 09:20:45.680229 2026] [:error] [pid 22664:tid 22719] [client 4.205.120.59:62695] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sad/about.php"] [unique_id "admh7QRS_OPFpcXOZmWEvQAAAVY"]
[Sat Apr 11 09:20:58.610979 2026] [:error] [pid 22665:tid 22729] [client 4.205.120.59:64965] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sat Apr 11 09:20:58.850147 2026] [:error] [pid 22665:tid 22733] [client 4.205.120.59:64965] File does not exist: /usr/local/apache/htdocs/suspended-page/xl.php
[Sat Apr 11 09:21:00.082826 2026] [:error] [pid 22665:tid 22740] [client 4.205.120.59:64965] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admh_Egi15J0QUr6OrPfBAAAAZA"]
[Sat Apr 11 09:21:07.942161 2026] [:error] [pid 22665:tid 22746] [client 4.205.120.59:62705] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admiA0gi15J0QUr6OrPfGAAAAZY"]
[Sat Apr 11 09:21:12.302001 2026] [:error] [pid 22756:tid 22779] [client 4.205.120.59:65017] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admiCGfoSJ40LEm6kfqvggAAABU"]
[Sat Apr 11 09:21:20.235969 2026] [:error] [pid 22663:tid 22676] [client 4.205.120.59:64972] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tmp_images/alfacgiapi/perl.alfa"] [unique_id "admiEI1p7ez17BT2hZYG2wAAAQg"]
[Sat Apr 11 09:21:26.042713 2026] [:error] [pid 22665:tid 22733] [client 4.205.120.59:64905] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tmp_images/alfacgiapi/perl.alfa"] [unique_id "admiFkgi15J0QUr6OrPfRgAAAYk"]
[Sat Apr 11 09:21:29.311688 2026] [:error] [pid 22665:tid 22737] [client 4.205.120.59:64943] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tmp_images/alfacgiapi/perl.alfa"] [unique_id "admiGUgi15J0QUr6OrPfTgAAAY0"]
[Sat Apr 11 09:21:40.773841 2026] [:error] [pid 22665:tid 22737] [client 4.205.120.59:62715] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tmp_images/alfacgiapi/perl.alfa"] [unique_id "admiJEgi15J0QUr6OrPfgAAAAY0"]
[Sat Apr 11 09:21:53.992033 2026] [:error] [pid 22665:tid 22732] [client 4.205.120.59:65012] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/alfacgiapi/perl.alfa"] [unique_id "admiMUgi15J0QUr6OrPfrAAAAYg"]
[Sat Apr 11 09:22:06.963363 2026] [:error] [pid 22665:tid 22747] [client 4.205.120.59:64975] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/alfacgiapi/perl.alfa"] [unique_id "admiPkgi15J0QUr6OrPf2wAAAZc"]
[Sat Apr 11 09:22:18.469066 2026] [:error] [pid 22665:tid 22748] [client 4.205.120.59:64918] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/alfacgiapi/perl.alfa"] [unique_id "admiSkgi15J0QUr6OrPgCAAAAZg"]
[Sat Apr 11 09:22:19.867277 2026] [:error] [pid 22665:tid 22747] [client 4.205.120.59:64904] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/alfacgiapi/perl.alfa"] [unique_id "admiS0gi15J0QUr6OrPgDQAAAZc"]
[Sat Apr 11 09:22:45.524428 2026] [:error] [pid 22665:tid 22729] [client 4.205.120.59:65006] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfacgiapi/perl.alfa"] [unique_id "admiZUgi15J0QUr6OrPgNwAAAYU"]
[Sat Apr 11 09:22:47.962887 2026] [:error] [pid 22665:tid 22747] [client 4.205.120.59:65004] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admiZ0gi15J0QUr6OrPgQQAAAZc"]
[Sat Apr 11 09:22:49.996031 2026] [:error] [pid 25460:tid 25465] [client 4.205.120.59:62671] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admiaZ4qILXFw3ifO2tgTAAAAEM"]
[Sat Apr 11 09:22:54.959952 2026] [:error] [pid 22665:tid 22742] [client 4.205.120.59:64958] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admibkgi15J0QUr6OrPgWQAAAZI"]
[Sat Apr 11 09:22:56.563203 2026] [:error] [pid 25460:tid 25469] [client 4.205.120.59:62712] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admicJ4qILXFw3ifO2tgagAAAEc"]
[Sat Apr 11 09:23:01.009306 2026] [:error] [pid 25460:tid 25462] [client 4.205.120.59:62678] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "admidZ4qILXFw3ifO2tgdgAAAEA"]
[Sat Apr 11 09:23:06.949294 2026] [:error] [pid 22756:tid 22759] [client 4.205.120.59:62595] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/date.php"] [unique_id "admiemfoSJ40LEm6kfqxOQAAAAE"]
[Sat Apr 11 09:23:11.850362 2026] [:error] [pid 22756:tid 22770] [client 4.205.120.59:64942] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/date.php"] [unique_id "admif2foSJ40LEm6kfqxTAAAAAw"]
[Sat Apr 11 09:23:18.066085 2026] [:error] [pid 25460:tid 25463] [client 4.205.120.59:64915] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/date.php"] [unique_id "admihp4qILXFw3ifO2tgowAAAEE"]
[Sat Apr 11 09:23:21.705346 2026] [:error] [pid 22665:tid 22724] [client 4.205.120.59:65011] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/date.php"] [unique_id "admiiUgi15J0QUr6OrPgeQAAAYA"]
[Sat Apr 11 09:23:37.338103 2026] [:error] [pid 25460:tid 25465] [client 4.205.120.59:62658] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "admimZ4qILXFw3ifO2tgxgAAAEM"]
[Sat Apr 11 09:23:51.845530 2026] [:error] [pid 22664:tid 22699] [client 4.205.120.59:62675] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pomo.php"] [unique_id "admipwRS_OPFpcXOZmWGywAAAUI"]
[Sat Apr 11 09:23:55.930951 2026] [:error] [pid 22663:tid 22678] [client 4.205.120.59:64903] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/pomo.php"] [unique_id "admiq41p7ez17BT2hZYHywAAAQo"]
[Sat Apr 11 09:24:17.650638 2026] [:error] [pid 25460:tid 25466] [client 4.205.120.59:62669] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/pomo.php"] [unique_id "admiwZ4qILXFw3ifO2thNwAAAEQ"]
[Sat Apr 11 09:24:23.015603 2026] [:error] [pid 22756:tid 22777] [client 4.205.120.59:60075] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/pomo.php"] [unique_id "admix2foSJ40LEm6kfqyUwAAABM"]
[Sat Apr 11 09:24:27.791517 2026] [:error] [pid 22665:tid 22738] [client 4.205.120.59:62714] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/pomo.php"] [unique_id "admiy0gi15J0QUr6OrPgyAAAAY4"]
[Sat Apr 11 09:24:37.307506 2026] [:error] [pid 22663:tid 22678] [client 4.205.120.59:62660] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/pomo.php"] [unique_id "admi1Y1p7ez17BT2hZYIIAAAAQo"]
[Sat Apr 11 09:24:39.853848 2026] [:error] [pid 22756:tid 22782] [client 4.205.120.59:64998] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/uploads/pomo.php"] [unique_id "admi12foSJ40LEm6kfqyhQAAABg"]
[Sat Apr 11 09:24:50.339711 2026] [:error] [pid 22665:tid 22732] [client 4.205.120.59:64945] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pomo.php"] [unique_id "admi4kgi15J0QUr6OrPg4AAAAYg"]
[Sat Apr 11 09:24:55.472190 2026] [:error] [pid 25460:tid 25481] [client 4.205.120.59:64912] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pomo.php"] [unique_id "admi554qILXFw3ifO2th9QAAAFM"]
[Sat Apr 11 09:24:58.853769 2026] [:error] [pid 22665:tid 22724] [client 4.205.120.59:64937] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pomo.php"] [unique_id "admi6kgi15J0QUr6OrPg7QAAAYA"]
[Sat Apr 11 09:25:30.023191 2026] [:error] [pid 22756:tid 22765] [client 4.205.120.59:62703] [client 4.205.120.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/languages/themes/pomo.php"] [unique_id "admjCmfoSJ40LEm6kfqzOgAAAAc"]
[Sat Apr 11 09:26:07.004920 2026] [:error] [pid 22663:tid 22679] [client 4.205.120.59:64956] [client 4.205.120.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/pomo.php"] [unique_id "admjL41p7ez17BT2hZYIngAAAQs"]
[Sat Apr 11 09:42:42.335375 2026] [:error] [pid 34822:tid 34851] [client 157.15.40.61:59930] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "admnEtoScBMkNZUKMZ3ZqgAAARg"]
[Sat Apr 11 14:11:36.092735 2026] [:error] [pid 2297:tid 2320] [client 157.15.40.61:55828] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adnmGLXJS-Jji11jZk3YsAAAARM"]
[Sat Apr 11 14:11:36.353250 2026] [:error] [pid 2187:tid 2226] [client 157.15.40.61:55895] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/style.php"] [unique_id "adnmGA4J29_qQi0FkjiH4AAAAAA"]
[Sat Apr 11 14:11:36.605929 2026] [:error] [pid 2186:tid 2196] [client 157.15.40.61:55976] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "adnmGMibnOEEvcO8wPL9DgAAAIY"]
[Sat Apr 11 14:11:36.863604 2026] [:error] [pid 2297:tid 2304] [client 157.15.40.61:56064] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/style.php"] [unique_id "adnmGLXJS-Jji11jZk3Y0gAAAQM"]
[Sat Apr 11 14:11:37.147984 2026] [:error] [pid 2186:tid 2201] [client 157.15.40.61:56127] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style.php"] [unique_id "adnmGcibnOEEvcO8wPL9JAAAAIs"]
[Sat Apr 11 14:11:37.400491 2026] [:error] [pid 11067:tid 11083] [client 157.15.40.61:56202] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adnmGcW3w7N67R04YCKQfgAAAE4"]
[Sat Apr 11 14:11:37.686442 2026] [:error] [pid 2186:tid 2203] [client 157.15.40.61:56303] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adnmGcibnOEEvcO8wPL9QgAAAI0"]
[Sat Apr 11 14:11:37.942589 2026] [:error] [pid 2187:tid 2236] [client 157.15.40.61:56408] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/flower.php"] [unique_id "adnmGQ4J29_qQi0FkjiIIgAAAAg"]
[Sat Apr 11 14:11:40.510424 2026] [:error] [pid 2186:tid 2207] [client 157.15.40.61:56523] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adnmHMibnOEEvcO8wPL9kwAAAJE"]
[Sat Apr 11 14:11:40.766045 2026] [:error] [pid 2188:tid 2261] [client 157.15.40.61:56971] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "adnmHIDhDA-Xtn2nRScJ1wAAAMU"]
[Sat Apr 11 14:11:42.937904 2026] [:error] [pid 2297:tid 2313] [client 157.15.40.61:57384] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/class-t.api.php"] [unique_id "adnmHrXJS-Jji11jZk3Z8QAAAQw"]
[Sat Apr 11 14:11:44.383446 2026] [:error] [pid 11067:tid 11084] [client 157.15.40.61:57634] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/blurbs.php"] [unique_id "adnmIMW3w7N67R04YCKRzQAAAE8"]
[Sat Apr 11 14:11:45.641636 2026] [:error] [pid 2187:tid 2228] [client 157.15.40.61:57815] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/akcc.php"] [unique_id "adnmIQ4J29_qQi0FkjiIoAAAAAI"]
[Sat Apr 11 14:11:46.377397 2026] [:error] [pid 11067:tid 11091] [client 157.15.40.61:57966] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/abcd.php"] [unique_id "adnmIsW3w7N67R04YCKSNgAAAFY"]
[Sat Apr 11 14:11:48.119797 2026] [:error] [pid 2297:tid 2320] [client 157.15.40.61:58229] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/shelp.php"] [unique_id "adnmJLXJS-Jji11jZk3avwAAARM"]
[Sat Apr 11 14:11:49.157971 2026] [:error] [pid 11067:tid 11091] [client 157.15.40.61:58424] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/cord.php"] [unique_id "adnmJcW3w7N67R04YCKSkQAAAFY"]
[Sat Apr 11 14:11:50.390624 2026] [:error] [pid 2188:tid 2264] [client 157.15.40.61:58701] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/dex.php"] [unique_id "adnmJoDhDA-Xtn2nRScKxAAAAMg"]
[Sat Apr 11 14:11:51.452427 2026] [:error] [pid 11067:tid 11073] [client 157.15.40.61:58935] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adnmJ8W3w7N67R04YCKTEAAAAEQ"]
[Sat Apr 11 14:11:52.720415 2026] [:error] [pid 2187:tid 2239] [client 157.15.40.61:59006] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/file2.php"] [unique_id "adnmKA4J29_qQi0FkjiJBAAAAAs"]
[Sat Apr 11 14:11:52.972324 2026] [:error] [pid 2186:tid 2200] [client 157.15.40.61:59251] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/zwso.php"] [unique_id "adnmKMibnOEEvcO8wPL-VAAAAIo"]
[Sat Apr 11 14:11:55.033314 2026] [:error] [pid 2187:tid 2231] [client 157.15.40.61:59605] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/zwso.php"] [unique_id "adnmKw4J29_qQi0FkjiJMQAAAAM"]
[Sat Apr 11 14:11:56.105768 2026] [:error] [pid 2186:tid 2213] [client 157.15.40.61:59902] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "adnmLMibnOEEvcO8wPL-ygAAAJY"]
[Sat Apr 11 14:11:58.469830 2026] [:error] [pid 11067:tid 11089] [client 157.15.40.61:60179] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adnmLsW3w7N67R04YCKVuwAAAFQ"]
[Sat Apr 11 14:11:59.738963 2026] [:error] [pid 11067:tid 11077] [client 157.15.40.61:60564] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "adnmL8W3w7N67R04YCKWGgAAAEg"]
[Sat Apr 11 14:12:00.000144 2026] [:error] [pid 2186:tid 2193] [client 157.15.40.61:60815] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/133.php"] [unique_id "adnmL8ibnOEEvcO8wPL_IAAAAIM"]
[Sat Apr 11 14:12:01.273324 2026] [:error] [pid 2188:tid 2278] [client 157.15.40.61:60873] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "adnmMYDhDA-Xtn2nRScL6AAAANY"]
[Sat Apr 11 14:12:05.557416 2026] [:error] [pid 11067:tid 11078] [client 157.15.40.61:62593] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/php8.php"] [unique_id "adnmNcW3w7N67R04YCKW_QAAAEk"]
[Sat Apr 11 14:12:19.963572 2026] [:error] [pid 2297:tid 2322] [client 157.15.40.61:51056] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/lufix1.php"] [unique_id "adnmQ7XJS-Jji11jZk3dagAAARU"]
[Sat Apr 11 14:12:22.567688 2026] [:error] [pid 2186:tid 2212] [client 157.15.40.61:51770] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/witmm.php"] [unique_id "adnmRsibnOEEvcO8wPL_4QAAAJU"]
[Sat Apr 11 14:12:22.836189 2026] [:error] [pid 11067:tid 11085] [client 157.15.40.61:52034] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "adnmRsW3w7N67R04YCKYBgAAAFA"]
[Sat Apr 11 14:12:26.358183 2026] [:error] [pid 2297:tid 2321] [client 157.15.40.61:52172] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "adnmSrXJS-Jji11jZk3dsAAAARQ"]
[Sat Apr 11 14:12:30.552221 2026] [:error] [pid 2187:tid 2235] [client 157.15.40.61:52575] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "adnmTg4J29_qQi0FkjiKsQAAAAc"]
[Sat Apr 11 14:12:33.830725 2026] [:error] [pid 2188:tid 2258] [client 157.15.40.61:53440] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adnmUYDhDA-Xtn2nRScNKwAAAMI"]
[Sat Apr 11 14:12:35.976436 2026] [:error] [pid 11067:tid 11091] [client 157.15.40.61:53763] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adnmU8W3w7N67R04YCKYqQAAAFY"]
[Sat Apr 11 14:12:38.255886 2026] [:error] [pid 2187:tid 2226] [client 157.15.40.61:53953] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "adnmVg4J29_qQi0FkjiK6gAAAAA"]
[Sat Apr 11 14:12:38.904123 2026] [:error] [pid 2297:tid 2323] [client 157.15.40.61:54172] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-editor.php"] [unique_id "adnmVrXJS-Jji11jZk3eCwAAARY"]
[Sat Apr 11 17:19:26.593407 2026] [:error] [pid 45413:tid 45481] [client 103.158.5.232:65367] [client 103.158.5.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.158.5.232, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adoSHj4976Wm1h7ctryi0QAAAMo"]
[Sat Apr 11 17:19:26.598486 2026] [:error] [pid 45413:tid 45481] [client 103.158.5.232:65367] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Apr 11 19:45:45.922532 2026] [:error] [pid 54518:tid 54536] [client 103.48.45.85:55578] [client 103.48.45.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.48.45.85, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ado0aaKi5dAhX05ubq1GtQAAAI4"]
[Sat Apr 11 19:45:45.928058 2026] [:error] [pid 54518:tid 54536] [client 103.48.45.85:55578] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 12 00:01:07.552900 2026] [:error] [pid 42313:tid 42321] [client 45.132.115.195:58967] [client 45.132.115.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "adpwQ12P8TxdbaN018J3NQAAAAU"]
[Sun Apr 12 00:01:08.066694 2026] [:error] [pid 42313:tid 42326] [client 45.132.115.200:55491] [client 45.132.115.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "adpwRF2P8TxdbaN018J3NwAAAAo"]
[Sun Apr 12 00:01:09.143061 2026] [:error] [pid 42220:tid 42261] [client 45.132.115.180:28771] [client 45.132.115.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "adpwRUz5c3Cs6a8B5QuoHAAAAMo"]
[Sun Apr 12 00:01:10.103154 2026] [:error] [pid 42221:tid 42298] [client 45.132.115.201:63853] [client 45.132.115.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "adpwRk2gt0pb_0-cc6myjQAAAFQ"]
[Sun Apr 12 02:27:49.177902 2026] [:error] [pid 44698:tid 44705] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Sun Apr 12 02:27:49.413956 2026] [:error] [pid 44698:tid 44722] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun Apr 12 02:27:49.649646 2026] [:error] [pid 44698:tid 44708] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Sun Apr 12 02:27:49.961494 2026] [:error] [pid 44698:tid 44713] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Sun Apr 12 02:27:50.197073 2026] [:error] [pid 44698:tid 44723] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Sun Apr 12 02:27:50.432628 2026] [:error] [pid 44698:tid 44717] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Sun Apr 12 02:27:50.675613 2026] [:error] [pid 44698:tid 44711] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny2.php
[Sun Apr 12 02:27:51.075464 2026] [:error] [pid 44698:tid 44725] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Sun Apr 12 02:27:51.311743 2026] [:error] [pid 44698:tid 44709] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun Apr 12 02:27:51.554655 2026] [:error] [pid 44698:tid 44723] [client 20.111.63.225:65063] File does not exist: /usr/local/apache/htdocs/suspended-page/ga.php
[Sun Apr 12 02:27:51.786697 2026] [:error] [pid 44698:tid 44711] [client 20.111.63.225:65063] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adqSpxgoH9UWd-U3D56DKwAAAIg"]
[Sun Apr 12 02:27:57.210525 2026] [:error] [pid 36938:tid 36945] [client 20.111.63.225:64467] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adqSrYSWpa_VL1JPU6z4kQAAAYU"]
[Sun Apr 12 02:27:58.022627 2026] [:error] [pid 36909:tid 36923] [client 20.111.63.225:65232] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adqSrkGk5GhxTCzHUOorQAAAAQw"]
[Sun Apr 12 02:28:00.074365 2026] [:error] [pid 44698:tid 44711] [client 20.111.63.225:61866] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adqSsBgoH9UWd-U3D56DZQAAAIg"]
[Sun Apr 12 02:28:01.552813 2026] [:error] [pid 44698:tid 44719] [client 20.111.63.225:51192] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x3x.php"] [unique_id "adqSsRgoH9UWd-U3D56DdAAAAJA"]
[Sun Apr 12 02:28:03.483245 2026] [:error] [pid 36938:tid 36951] [client 20.111.63.225:59344] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x3x.php"] [unique_id "adqSs4SWpa_VL1JPU6z4oAAAAYs"]
[Sun Apr 12 02:28:04.849692 2026] [:error] [pid 36938:tid 36954] [client 20.111.63.225:51144] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x3x.php"] [unique_id "adqStISWpa_VL1JPU6z4pgAAAY4"]
[Sun Apr 12 02:28:07.621016 2026] [:error] [pid 44698:tid 44713] [client 20.111.63.225:51187] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x3x.php"] [unique_id "adqStxgoH9UWd-U3D56DmQAAAIo"]
[Sun Apr 12 02:28:08.760192 2026] [:error] [pid 45064:tid 45112] [client 20.111.63.225:62568] [client 20.111.63.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adqSuJcHBvLyJ6EUhUoRFQAAAVM"]
[Sun Apr 12 02:28:11.347942 2026] [:error] [pid 44700:tid 44760] [client 20.111.63.225:63759] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/state.php"] [unique_id "adqSu2ryPgh_uW4QPCl4pwAAANA"]
[Sun Apr 12 02:28:12.462164 2026] [:error] [pid 36938:tid 36949] [client 20.111.63.225:59356] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/state.php"] [unique_id "adqSvISWpa_VL1JPU6z4wAAAAYk"]
[Sun Apr 12 02:28:14.117515 2026] [:error] [pid 44701:tid 44782] [client 20.111.63.225:6966] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/state.php"] [unique_id "adqSvhGZAP4MrlxEPFdOJwAAAEk"]
[Sun Apr 12 02:28:15.625897 2026] [:error] [pid 45064:tid 45107] [client 20.111.63.225:61402] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/state.php"] [unique_id "adqSv5cHBvLyJ6EUhUoRJwAAAU4"]
[Sun Apr 12 02:28:16.869436 2026] [:error] [pid 36938:tid 36962] [client 20.111.63.225:63807] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adqSwISWpa_VL1JPU6z41gAAAZY"]
[Sun Apr 12 02:28:18.196378 2026] [:error] [pid 44698:tid 44709] [client 20.111.63.225:64402] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adqSwhgoH9UWd-U3D56DzgAAAIY"]
[Sun Apr 12 02:28:21.678984 2026] [:error] [pid 44698:tid 44716] [client 20.111.63.225:60496] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adqSxRgoH9UWd-U3D56D3QAAAI0"]
[Sun Apr 12 02:28:23.483862 2026] [:error] [pid 44700:tid 44763] [client 20.111.63.225:60532] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adqSx2ryPgh_uW4QPCl4wAAAANM"]
[Sun Apr 12 02:28:27.348052 2026] [:error] [pid 44701:tid 44777] [client 20.111.63.225:54406] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1100.php"] [unique_id "adqSyxGZAP4MrlxEPFdOPQAAAEU"]
[Sun Apr 12 02:28:31.560728 2026] [:error] [pid 44700:tid 44753] [client 20.111.63.225:61392] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1100.php"] [unique_id "adqSz2ryPgh_uW4QPCl43wAAAMk"]
[Sun Apr 12 02:28:35.679981 2026] [:error] [pid 44698:tid 44726] [client 20.111.63.225:60508] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1100.php"] [unique_id "adqS0xgoH9UWd-U3D56D8wAAAJc"]
[Sun Apr 12 02:28:41.135532 2026] [:error] [pid 36938:tid 36960] [client 20.111.63.225:52293] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adqS2YSWpa_VL1JPU6z5LwAAAZQ"]
[Sun Apr 12 02:28:43.023397 2026] [:error] [pid 44698:tid 44722] [client 20.111.63.225:52830] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adqS2xgoH9UWd-U3D56D_wAAAJM"]
[Sun Apr 12 02:28:44.169182 2026] [:error] [pid 44698:tid 44707] [client 20.111.63.225:65343] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adqS3BgoH9UWd-U3D56ECwAAAIQ"]
[Sun Apr 12 02:28:46.094981 2026] [:error] [pid 44700:tid 44747] [client 20.111.63.225:58862] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/8.php"] [unique_id "adqS3mryPgh_uW4QPCl5AgAAAMM"]
[Sun Apr 12 02:28:54.021034 2026] [:error] [pid 44698:tid 44721] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/97.php
[Sun Apr 12 02:28:54.779308 2026] [:error] [pid 44698:tid 44725] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/file-gertdxz.php
[Sun Apr 12 02:28:55.014778 2026] [:error] [pid 44698:tid 44720] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Sun Apr 12 02:28:55.639077 2026] [:error] [pid 44698:tid 44726] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Apr 12 02:28:55.887445 2026] [:error] [pid 44698:tid 44716] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Apr 12 02:28:56.123771 2026] [:error] [pid 44698:tid 44708] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Sun Apr 12 02:28:56.358358 2026] [:error] [pid 44698:tid 44718] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Sun Apr 12 02:28:56.596268 2026] [:error] [pid 44698:tid 44713] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/ng.php
[Sun Apr 12 02:28:56.842515 2026] [:error] [pid 44698:tid 44710] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 12 02:28:57.078464 2026] [:error] [pid 44698:tid 44705] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/wswer1.php
[Sun Apr 12 02:28:57.315212 2026] [:error] [pid 44698:tid 44714] [client 20.111.63.225:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Sun Apr 12 02:28:57.559867 2026] [:error] [pid 44698:tid 44721] [client 20.111.63.225:64307] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "adqS6RgoH9UWd-U3D56EiQAAAJI"]
[Sun Apr 12 02:29:03.904219 2026] [:error] [pid 36938:tid 36963] [client 20.111.63.225:63507] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "adqS74SWpa_VL1JPU6z5YAAAAZc"]
[Sun Apr 12 02:29:06.261636 2026] [:error] [pid 36938:tid 36962] [client 20.111.63.225:57644] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wgift1.php"] [unique_id "adqS8oSWpa_VL1JPU6z5aAAAAZY"]
[Sun Apr 12 02:29:15.379007 2026] [:error] [pid 36909:tid 36919] [client 20.111.63.225:51460] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adqS-0Gk5GhxTCzHUOor-AAAAQg"]
[Sun Apr 12 02:29:18.579652 2026] [:error] [pid 45064:tid 45112] [client 20.111.63.225:50808] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adqS_pcHBvLyJ6EUhUoRlAAAAVM"]
[Sun Apr 12 02:29:22.945826 2026] [:error] [pid 36938:tid 36955] [client 20.111.63.225:6744] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adqTAoSWpa_VL1JPU6z5mwAAAY8"]
[Sun Apr 12 02:29:25.085518 2026] [:error] [pid 36909:tid 36915] [client 20.111.63.225:58966] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adqTBUGk5GhxTCzHUOosDwAAAQQ"]
[Sun Apr 12 02:29:31.853778 2026] [:error] [pid 34152:tid 34162] [client 20.111.63.225:58974] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adqTC4FtE4RhFslT1DrOSQAAAAg"]
[Sun Apr 12 02:29:41.399457 2026] [:error] [pid 44701:tid 44777] [client 20.111.63.225:51478] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adqTFRGZAP4MrlxEPFdOwgAAAEU"]
[Sun Apr 12 02:29:44.856833 2026] [:error] [pid 44698:tid 44719] [client 20.111.63.225:57608] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adqTGBgoH9UWd-U3D56E8wAAAJA"]
[Sun Apr 12 02:29:46.415642 2026] [:error] [pid 36938:tid 36953] [client 20.111.63.225:64582] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adqTGoSWpa_VL1JPU6z58gAAAY0"]
[Sun Apr 12 02:29:49.376928 2026] [:error] [pid 34152:tid 34176] [client 20.111.63.225:50774] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-turn.php"] [unique_id "adqTHYFtE4RhFslT1DrOaQAAABY"]
[Sun Apr 12 02:29:59.607506 2026] [:error] [pid 44700:tid 44751] [client 20.111.63.225:64577] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Sun Apr 12 02:29:59.851630 2026] [:error] [pid 44700:tid 44749] [client 20.111.63.225:64577] File does not exist: /usr/local/apache/htdocs/suspended-page/red.php
[Sun Apr 12 02:30:00.145602 2026] [:error] [pid 44700:tid 44760] [client 20.111.63.225:64577] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Sun Apr 12 02:30:00.381398 2026] [:error] [pid 44700:tid 44745] [client 20.111.63.225:64577] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Sun Apr 12 02:30:00.625682 2026] [:error] [pid 44700:tid 44744] [client 20.111.63.225:64577] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sun Apr 12 02:30:00.905992 2026] [:error] [pid 44700:tid 44756] [client 20.111.63.225:64577] File does not exist: /usr/local/apache/htdocs/suspended-page/wziar1.php
[Sun Apr 12 02:30:01.141268 2026] [:error] [pid 44700:tid 44768] [client 20.111.63.225:64577] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Sun Apr 12 02:30:01.374641 2026] [:error] [pid 44700:tid 44748] [client 20.111.63.225:64577] [client 20.111.63.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adqTKWryPgh_uW4QPCl5pAAAAMQ"]
[Sun Apr 12 02:30:03.090517 2026] [:error] [pid 45064:tid 45099] [client 20.111.63.225:62900] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sun Apr 12 02:30:03.327372 2026] [:error] [pid 45064:tid 45096] [client 20.111.63.225:62900] File does not exist: /usr/local/apache/htdocs/suspended-page/myy.php
[Sun Apr 12 02:30:03.561268 2026] [:error] [pid 45064:tid 45112] [client 20.111.63.225:62900] [client 20.111.63.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "adqTK5cHBvLyJ6EUhUoR2gAAAVM"]
[Sun Apr 12 02:30:04.633973 2026] [:error] [pid 44701:tid 44785] [client 20.111.63.225:64739] File does not exist: /usr/local/apache/htdocs/suspended-page/wdone1.php
[Sun Apr 12 02:30:04.877770 2026] [:error] [pid 44701:tid 44789] [client 20.111.63.225:64739] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Sun Apr 12 02:30:05.110758 2026] [:error] [pid 44701:tid 44792] [client 20.111.63.225:64739] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adqTLRGZAP4MrlxEPFdPHgAAAFE"]
[Sun Apr 12 02:30:09.260417 2026] [:error] [pid 36938:tid 36950] [client 20.111.63.225:51089] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adqTMYSWpa_VL1JPU6z6RQAAAYo"]
[Sun Apr 12 02:30:13.069484 2026] [:error] [pid 36909:tid 36917] [client 20.111.63.225:53730] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adqTNUGk5GhxTCzHUOosngAAAQY"]
[Sun Apr 12 02:30:19.292729 2026] [:error] [pid 36938:tid 36949] [client 20.111.63.225:51940] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsheet1.php"] [unique_id "adqTO4SWpa_VL1JPU6z6cAAAAYk"]
[Sun Apr 12 02:30:23.733393 2026] [:error] [pid 44698:tid 44716] [client 20.111.63.225:64905] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adqTPxgoH9UWd-U3D56FvgAAAI0"]
[Sun Apr 12 02:30:27.109770 2026] [:error] [pid 44701:tid 44775] [client 20.111.63.225:55656] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adqTQxGZAP4MrlxEPFdPMwAAAEM"]
[Sun Apr 12 02:30:30.062075 2026] [:error] [pid 36938:tid 36942] [client 20.111.63.225:55667] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adqTRoSWpa_VL1JPU6z6lwAAAYI"]
[Sun Apr 12 02:30:31.572294 2026] [:error] [pid 44700:tid 44757] [client 20.111.63.225:55334] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adqTR2ryPgh_uW4QPCl55gAAAM0"]
[Sun Apr 12 02:30:34.958722 2026] [:error] [pid 44700:tid 44746] [client 20.111.63.225:51908] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adqTSmryPgh_uW4QPCl58gAAAMI"]
[Sun Apr 12 02:30:35.920858 2026] [:error] [pid 44701:tid 44794] [client 20.111.63.225:58136] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adqTSxGZAP4MrlxEPFdPSQAAAFM"]
[Sun Apr 12 02:30:37.108684 2026] [:error] [pid 36938:tid 36944] [client 20.111.63.225:64947] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adqTTYSWpa_VL1JPU6z6xwAAAYQ"]
[Sun Apr 12 02:30:45.504306 2026] [:error] [pid 44698:tid 44712] [client 20.111.63.225:64982] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ava.php"] [unique_id "adqTVRgoH9UWd-U3D56GDgAAAIk"]
[Sun Apr 12 02:30:52.789798 2026] [:error] [pid 36909:tid 36931] [client 20.111.63.225:61172] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awh.php"] [unique_id "adqTXEGk5GhxTCzHUOotcgAAARQ"]
[Sun Apr 12 02:31:05.489327 2026] [:error] [pid 36909:tid 36931] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Sun Apr 12 02:31:05.738013 2026] [:error] [pid 36909:tid 36915] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sun Apr 12 02:31:05.983263 2026] [:error] [pid 36909:tid 36932] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Apr 12 02:31:08.446407 2026] [:error] [pid 36909:tid 36932] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Sun Apr 12 02:31:08.680545 2026] [:error] [pid 36909:tid 36911] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/riz.php
[Sun Apr 12 02:31:08.922357 2026] [:error] [pid 36909:tid 36924] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Sun Apr 12 02:31:09.157843 2026] [:error] [pid 36909:tid 36923] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/om.php
[Sun Apr 12 02:31:09.392254 2026] [:error] [pid 36909:tid 36926] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/006.php
[Sun Apr 12 02:31:09.632157 2026] [:error] [pid 36909:tid 36935] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sun Apr 12 02:31:09.866712 2026] [:error] [pid 36909:tid 36917] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Sun Apr 12 02:31:10.101888 2026] [:error] [pid 36909:tid 36933] [client 20.111.63.225:55314] File does not exist: /usr/local/apache/htdocs/suspended-page/wolf.php
[Sun Apr 12 02:31:10.334861 2026] [:error] [pid 36909:tid 36931] [client 20.111.63.225:55314] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adqTbkGk5GhxTCzHUOotvQAAARQ"]
[Sun Apr 12 02:31:14.580229 2026] [:error] [pid 36938:tid 36956] [client 20.111.63.225:54137] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adqTcoSWpa_VL1JPU6z7dQAAAZA"]
[Sun Apr 12 02:31:17.072988 2026] [:error] [pid 44700:tid 44767] [client 20.111.63.225:58594] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adqTdWryPgh_uW4QPCl6fQAAANc"]
[Sun Apr 12 02:31:18.657695 2026] [:error] [pid 36938:tid 36959] [client 20.111.63.225:64523] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww.php"] [unique_id "adqTdoSWpa_VL1JPU6z7jgAAAZM"]
[Sun Apr 12 02:31:19.679185 2026] [:error] [pid 44700:tid 44751] [client 20.111.63.225:58570] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adqTd2ryPgh_uW4QPCl6hAAAAMc"]
[Sun Apr 12 02:31:32.275427 2026] [:error] [pid 34152:tid 34175] [client 20.111.63.225:64566] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adqThIFtE4RhFslT1DrPFwAAABU"]
[Sun Apr 12 02:31:33.898059 2026] [:error] [pid 36938:tid 36943] [client 20.111.63.225:60347] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adqThYSWpa_VL1JPU6z7twAAAYM"]
[Sun Apr 12 02:31:36.305290 2026] [:error] [pid 45064:tid 45105] [client 20.111.63.225:54619] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adqTiJcHBvLyJ6EUhUoShgAAAUw"]
[Sun Apr 12 02:31:39.546154 2026] [:error] [pid 44698:tid 44721] [client 20.111.63.225:61811] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adqTixgoH9UWd-U3D56HKAAAAJI"]
[Sun Apr 12 02:31:41.016464 2026] [:error] [pid 44700:tid 44751] [client 20.111.63.225:56395] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adqTjWryPgh_uW4QPCl6owAAAMc"]
[Sun Apr 12 02:31:45.151967 2026] [:error] [pid 36909:tid 36924] [client 20.111.63.225:59730] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1aa.php"] [unique_id "adqTkUGk5GhxTCzHUOouLQAAAQ0"]
[Sun Apr 12 02:31:47.065092 2026] [:error] [pid 44701:tid 44790] [client 20.111.63.225:58614] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adqTkxGZAP4MrlxEPFdP6gAAAE8"]
[Sun Apr 12 02:31:48.943589 2026] [:error] [pid 45064:tid 45107] [client 20.111.63.225:64963] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adqTlJcHBvLyJ6EUhUoSmwAAAU4"]
[Sun Apr 12 02:31:50.270434 2026] [:error] [pid 44701:tid 44773] [client 20.111.63.225:61799] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adqTlhGZAP4MrlxEPFdP_QAAAEE"]
[Sun Apr 12 02:31:53.742752 2026] [:error] [pid 34152:tid 34178] [client 20.111.63.225:54652] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/12.php"] [unique_id "adqTmYFtE4RhFslT1DrPKQAAABg"]
[Sun Apr 12 02:31:59.015756 2026] [:error] [pid 45064:tid 45095] [client 20.111.63.225:56043] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqTn5cHBvLyJ6EUhUoSwgAAAUM"]
[Sun Apr 12 02:32:00.218940 2026] [:error] [pid 45064:tid 45101] [client 20.111.63.225:64350] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqToJcHBvLyJ6EUhUoSyQAAAUg"]
[Sun Apr 12 02:32:02.476331 2026] [:error] [pid 44700:tid 44761] [client 20.111.63.225:60374] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqTomryPgh_uW4QPCl6tgAAANE"]
[Sun Apr 12 02:32:04.041630 2026] [:error] [pid 44698:tid 44721] [client 20.111.63.225:6860] [client 20.111.63.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqTpBgoH9UWd-U3D56HSgAAAJI"]
[Sun Apr 12 02:49:27.572407 2026] [:error] [pid 44700:tid 44767] [client 182.186.108.103:62725] [client 182.186.108.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.186.108.103, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adqXt2ryPgh_uW4QPCmDdgAAANc"]
[Sun Apr 12 02:49:27.576459 2026] [:error] [pid 44700:tid 44767] [client 182.186.108.103:62725] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 12 03:20:59.368041 2026] [:error] [pid 36909:tid 36935] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-942.php
[Sun Apr 12 03:20:59.609940 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/4GrJSiwkF3A.php
[Sun Apr 12 03:20:59.858105 2026] [:error] [pid 36909:tid 36921] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/SS72_kKKjT.php
[Sun Apr 12 03:21:00.110266 2026] [:error] [pid 36909:tid 36922] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/wkogn.php
[Sun Apr 12 03:21:00.347562 2026] [:error] [pid 36909:tid 36919] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/hwjtry0zd1fzeakcuzn8Cdefault.php
[Sun Apr 12 03:21:00.612828 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sun Apr 12 03:21:00.866666 2026] [:error] [pid 36909:tid 36927] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/oLEzRVqmJJPFSucdefault.php
[Sun Apr 12 03:21:01.105631 2026] [:error] [pid 36909:tid 36926] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/wwdgl.php
[Sun Apr 12 03:21:01.355620 2026] [:error] [pid 36909:tid 36920] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/3akp.php
[Sun Apr 12 03:21:01.591195 2026] [:error] [pid 36909:tid 36911] [client 4.232.184.116:14204] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Sun Apr 12 03:21:01.831681 2026] [:error] [pid 36909:tid 36933] [client 4.232.184.116:14204] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adqfHUGk5GhxTCzHUOpKXwAAARY"]
[Sun Apr 12 03:21:05.248354 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14151] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adqfIUGk5GhxTCzHUOpKYwAAAQQ"]
[Sun Apr 12 03:21:09.375584 2026] [:error] [pid 36909:tid 36927] [client 4.232.184.116:14085] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adqfJUGk5GhxTCzHUOpKdwAAARA"]
[Sun Apr 12 03:21:10.392972 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14158] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adqfJkGk5GhxTCzHUOpKfgAAAQQ"]
[Sun Apr 12 03:21:12.395809 2026] [:error] [pid 44701:tid 44796] [client 4.232.184.116:14170] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adqfKBGZAP4MrlxEPFdirAAAAFU"]
[Sun Apr 12 03:21:13.975491 2026] [:error] [pid 44701:tid 44789] [client 4.232.184.116:14195] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adqfKRGZAP4MrlxEPFdirwAAAE4"]
[Sun Apr 12 03:21:14.752782 2026] [:error] [pid 45064:tid 45103] [client 4.232.184.116:14166] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adqfKpcHBvLyJ6EUhUohxwAAAUo"]
[Sun Apr 12 03:21:16.105037 2026] [:error] [pid 45064:tid 45102] [client 4.232.184.116:14096] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cdn3.php"] [unique_id "adqfLJcHBvLyJ6EUhUoh0gAAAUk"]
[Sun Apr 12 03:21:17.000132 2026] [:error] [pid 44700:tid 44746] [client 4.232.184.116:14080] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adqfLGryPgh_uW4QPCmOKgAAAMI"]
[Sun Apr 12 03:21:17.958934 2026] [:error] [pid 34152:tid 34173] [client 4.232.184.116:14099] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adqfLYFtE4RhFslT1Drh8QAAABM"]
[Sun Apr 12 03:21:18.829034 2026] [:error] [pid 36909:tid 36919] [client 4.232.184.116:14202] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adqfLkGk5GhxTCzHUOpKmgAAAQg"]
[Sun Apr 12 03:21:19.595922 2026] [:error] [pid 45064:tid 45117] [client 4.232.184.116:14193] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adqfL5cHBvLyJ6EUhUoh2QAAAVg"]
[Sun Apr 12 03:21:20.492740 2026] [:error] [pid 34152:tid 34171] [client 4.232.184.116:14187] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adqfMIFtE4RhFslT1Drh_AAAABE"]
[Sun Apr 12 03:21:21.840359 2026] [:error] [pid 36909:tid 36913] [client 4.232.184.116:14179] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adqfMUGk5GhxTCzHUOpKngAAAQI"]
[Sun Apr 12 03:21:23.363142 2026] [:error] [pid 36909:tid 36926] [client 4.232.184.116:14082] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adqfM0Gk5GhxTCzHUOpKpgAAAQ8"]
[Sun Apr 12 03:21:24.527128 2026] [:error] [pid 36909:tid 36923] [client 4.232.184.116:14100] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/beerd.php"] [unique_id "adqfNEGk5GhxTCzHUOpKqAAAAQw"]
[Sun Apr 12 03:21:25.540778 2026] [:error] [pid 44698:tid 44719] [client 4.232.184.116:14201] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adqfNRgoH9UWd-U3D56gGwAAAJA"]
[Sun Apr 12 03:21:27.224135 2026] [:error] [pid 36909:tid 36928] [client 4.232.184.116:14189] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adqfN0Gk5GhxTCzHUOpKrwAAARE"]
[Sun Apr 12 03:21:28.910504 2026] [:error] [pid 45064:tid 45106] [client 4.232.184.116:14091] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adqfOJcHBvLyJ6EUhUoh_QAAAU0"]
[Sun Apr 12 03:21:30.957586 2026] [:error] [pid 36909:tid 36923] [client 4.232.184.116:14140] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hhxc.php"] [unique_id "adqfOkGk5GhxTCzHUOpKvQAAAQw"]
[Sun Apr 12 03:21:32.907527 2026] [:error] [pid 44701:tid 44790] [client 4.232.184.116:14174] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adqfPBGZAP4MrlxEPFdiuAAAAE8"]
[Sun Apr 12 03:21:35.175503 2026] [:error] [pid 36909:tid 36925] [client 4.232.184.116:14044] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adqfP0Gk5GhxTCzHUOpK0AAAAQ4"]
[Sun Apr 12 03:21:35.838520 2026] [:error] [pid 36909:tid 36931] [client 4.232.184.116:14156] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adqfP0Gk5GhxTCzHUOpK1QAAARQ"]
[Sun Apr 12 03:21:37.323552 2026] [:error] [pid 44701:tid 44773] [client 4.232.184.116:14190] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/161dfd072f.php"] [unique_id "adqfQRGZAP4MrlxEPFdiuwAAAEE"]
[Sun Apr 12 03:21:38.265597 2026] [:error] [pid 44700:tid 44746] [client 4.232.184.116:14081] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adqfQmryPgh_uW4QPCmOOAAAAMI"]
[Sun Apr 12 03:21:39.346134 2026] [:error] [pid 36909:tid 36926] [client 4.232.184.116:14161] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adqfQ0Gk5GhxTCzHUOpK2gAAAQ8"]
[Sun Apr 12 03:21:41.318097 2026] [:error] [pid 44701:tid 44787] [client 4.232.184.116:14162] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adqfRRGZAP4MrlxEPFdivwAAAE0"]
[Sun Apr 12 03:21:44.278305 2026] [:error] [pid 45064:tid 45098] [client 4.232.184.116:14194] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws80.php"] [unique_id "adqfSJcHBvLyJ6EUhUoiJgAAAUY"]
[Sun Apr 12 03:21:47.191230 2026] [:error] [pid 34152:tid 34157] [client 4.232.184.116:14160] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adqfS4FtE4RhFslT1DriLQAAAAM"]
[Sun Apr 12 03:21:50.373958 2026] [:error] [pid 44700:tid 44750] [client 4.232.184.116:14084] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adqfTmryPgh_uW4QPCmOQgAAAMY"]
[Sun Apr 12 03:21:53.919082 2026] [:error] [pid 36938:tid 36941] [client 4.232.184.116:14090] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adqfUYSWpa_VL1JPU6wK8gAAAYE"]
[Sun Apr 12 03:21:57.713635 2026] [:error] [pid 34152:tid 34159] [client 4.232.184.116:14097] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adqfVYFtE4RhFslT1DriQAAAAAU"]
[Sun Apr 12 03:22:01.611624 2026] [:error] [pid 44701:tid 44773] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Sun Apr 12 03:22:02.229895 2026] [:error] [pid 44701:tid 44776] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Sun Apr 12 03:22:02.463481 2026] [:error] [pid 44701:tid 44771] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/blqjs.php
[Sun Apr 12 03:22:02.723385 2026] [:error] [pid 44701:tid 44787] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/sk25_1.php
[Sun Apr 12 03:22:02.956676 2026] [:error] [pid 44701:tid 44778] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/fetch.php
[Sun Apr 12 03:22:03.603060 2026] [:error] [pid 44701:tid 44774] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Sun Apr 12 03:22:03.837993 2026] [:error] [pid 44701:tid 44785] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/2nzyHnOkEg.php
[Sun Apr 12 03:22:04.251905 2026] [:error] [pid 44701:tid 44782] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/oircv.php
[Sun Apr 12 03:22:04.506209 2026] [:error] [pid 44701:tid 44786] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Sun Apr 12 03:22:04.740064 2026] [:error] [pid 44701:tid 44792] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/n3yUmQ6Q9xwQ8ocdefault.php
[Sun Apr 12 03:22:05.054910 2026] [:error] [pid 44701:tid 44777] [client 4.232.184.116:14149] File does not exist: /usr/local/apache/htdocs/suspended-page/Spow_SRw.php
[Sun Apr 12 03:22:05.611944 2026] [:error] [pid 44701:tid 44781] [client 4.232.184.116:14149] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adqfXRGZAP4MrlxEPFdi5gAAAEg"]
[Sun Apr 12 03:22:07.203842 2026] [:error] [pid 34152:tid 34172] [client 4.232.184.116:14106] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adqfX4FtE4RhFslT1DriXgAAABI"]
[Sun Apr 12 03:22:08.383110 2026] [:error] [pid 34152:tid 34158] [client 4.232.184.116:14159] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adqfYIFtE4RhFslT1DriZAAAAAQ"]
[Sun Apr 12 03:22:10.252341 2026] [:error] [pid 45064:tid 45112] [client 4.232.184.116:14182] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adqfYpcHBvLyJ6EUhUoiaQAAAVM"]
[Sun Apr 12 03:22:11.367032 2026] [:error] [pid 44698:tid 44720] [client 4.232.184.116:14157] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adqfYxgoH9UWd-U3D56gOAAAAJE"]
[Sun Apr 12 03:22:12.375578 2026] [:error] [pid 34152:tid 34177] [client 4.232.184.116:14191] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adqfZIFtE4RhFslT1DribQAAABc"]
[Sun Apr 12 03:22:13.577191 2026] [:error] [pid 36938:tid 36940] [client 4.232.184.116:14145] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adqfZYSWpa_VL1JPU6wK-QAAAYA"]
[Sun Apr 12 03:22:14.544531 2026] [:error] [pid 45064:tid 45099] [client 4.232.184.116:14098] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxivicLhot.php"] [unique_id "adqfZpcHBvLyJ6EUhUoigQAAAUc"]
[Sun Apr 12 03:22:15.465011 2026] [:error] [pid 45064:tid 45106] [client 4.232.184.116:14178] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adqfZ5cHBvLyJ6EUhUoihAAAAU0"]
[Sun Apr 12 03:22:16.656817 2026] [:error] [pid 34152:tid 34162] [client 4.232.184.116:14089] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adqfaIFtE4RhFslT1DrieQAAAAg"]
[Sun Apr 12 03:22:17.926263 2026] [:error] [pid 36909:tid 36935] [client 4.232.184.116:14124] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adqfaUGk5GhxTCzHUOpLMwAAARg"]
[Sun Apr 12 03:22:18.746039 2026] [:error] [pid 44701:tid 44775] [client 4.232.184.116:14165] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/7logs.php"] [unique_id "adqfahGZAP4MrlxEPFdi7wAAAEM"]
[Sun Apr 12 03:22:19.523293 2026] [:error] [pid 44701:tid 44792] [client 4.232.184.116:14115] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adqfaxGZAP4MrlxEPFdi8wAAAFE"]
[Sun Apr 12 03:22:20.245637 2026] [:error] [pid 44701:tid 44781] [client 4.232.184.116:14184] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adqfbBGZAP4MrlxEPFdi9AAAAEg"]
[Sun Apr 12 03:22:22.232331 2026] [:error] [pid 34152:tid 34167] [client 4.232.184.116:14163] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adqfboFtE4RhFslT1DriiAAAAA0"]
[Sun Apr 12 03:22:23.155020 2026] [:error] [pid 36909:tid 36920] [client 4.232.184.116:14148] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acc.php"] [unique_id "adqfb0Gk5GhxTCzHUOpLPgAAAQk"]
[Sun Apr 12 03:22:24.096692 2026] [:error] [pid 34152:tid 34161] [client 4.232.184.116:14164] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adqfcIFtE4RhFslT1DrijwAAAAc"]
[Sun Apr 12 03:22:25.756150 2026] [:error] [pid 36909:tid 36923] [client 4.232.184.116:14094] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adqfcUGk5GhxTCzHUOpLRwAAAQw"]
[Sun Apr 12 03:22:28.050554 2026] [:error] [pid 36909:tid 36929] [client 4.232.184.116:14030] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adqfdEGk5GhxTCzHUOpLTwAAARI"]
[Sun Apr 12 03:22:31.120965 2026] [:error] [pid 36909:tid 36933] [client 4.232.184.116:14172] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wxeyc.php"] [unique_id "adqfd0Gk5GhxTCzHUOpLbgAAARY"]
[Sun Apr 12 03:22:34.621248 2026] [:error] [pid 34152:tid 34155] [client 4.232.184.116:14026] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adqfeoFtE4RhFslT1DriuAAAAAE"]
[Sun Apr 12 03:22:38.073166 2026] [:error] [pid 44698:tid 44720] [client 4.232.184.116:14203] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adqffhgoH9UWd-U3D56gQwAAAJE"]
[Sun Apr 12 03:22:39.093854 2026] [:error] [pid 36938:tid 36964] [client 4.232.184.116:14102] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adqff4SWpa_VL1JPU6wLCwAAAZg"]
[Sun Apr 12 03:22:40.251340 2026] [:error] [pid 36909:tid 36920] [client 4.232.184.116:14041] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xltt.php"] [unique_id "adqfgEGk5GhxTCzHUOpLhwAAAQk"]
[Sun Apr 12 03:22:41.966269 2026] [:error] [pid 45064:tid 45105] [client 4.232.184.116:14181] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adqfgZcHBvLyJ6EUhUoipwAAAUw"]
[Sun Apr 12 03:22:45.584740 2026] [:error] [pid 44698:tid 44727] [client 4.232.184.116:14121] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adqfhRgoH9UWd-U3D56gSQAAAJg"]
[Sun Apr 12 03:22:49.005758 2026] [:error] [pid 44701:tid 44792] [client 4.232.184.116:14093] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adqfiRGZAP4MrlxEPFdjGQAAAFE"]
[Sun Apr 12 03:22:53.291587 2026] [:error] [pid 36909:tid 36935] [client 4.232.184.116:14108] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adqfjUGk5GhxTCzHUOpLoAAAARg"]
[Sun Apr 12 03:22:55.263783 2026] [:error] [pid 36909:tid 36921] [client 4.232.184.116:14205] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adqfj0Gk5GhxTCzHUOpLrAAAAQo"]
[Sun Apr 12 03:22:56.342903 2026] [:error] [pid 36909:tid 36930] [client 4.232.184.116:14040] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adqfkEGk5GhxTCzHUOpLuwAAARM"]
[Sun Apr 12 03:22:56.947302 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14171] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adqfkEGk5GhxTCzHUOpLvgAAAQQ"]
[Sun Apr 12 03:22:57.827866 2026] [:error] [pid 36938:tid 36958] [client 4.232.184.116:14126] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fyflv.php"] [unique_id "adqfkYSWpa_VL1JPU6wLGAAAAZI"]
[Sun Apr 12 03:22:58.556430 2026] [:error] [pid 34152:tid 34161] [client 4.232.184.116:14141] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adqfkoFtE4RhFslT1Dri8AAAAAc"]
[Sun Apr 12 03:22:59.297827 2026] [:error] [pid 44700:tid 44757] [client 4.232.184.116:14176] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adqfk2ryPgh_uW4QPCmOdAAAAM0"]
[Sun Apr 12 03:22:59.883442 2026] [:error] [pid 44700:tid 44755] [client 4.232.184.116:14180] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adqfk2ryPgh_uW4QPCmOdwAAAMs"]
[Sun Apr 12 03:23:00.458132 2026] [:error] [pid 36909:tid 36919] [client 4.232.184.116:14155] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adqflEGk5GhxTCzHUOpLwQAAAQg"]
[Sun Apr 12 03:23:01.792675 2026] [:error] [pid 44701:tid 44798] [client 4.232.184.116:14029] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adqflRGZAP4MrlxEPFdjHAAAAFY"]
[Sun Apr 12 03:23:02.547136 2026] [:error] [pid 45064:tid 45093] [client 4.232.184.116:14107] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adqflpcHBvLyJ6EUhUoixgAAAUE"]
[Sun Apr 12 03:23:03.509639 2026] [:error] [pid 45064:tid 45109] [client 4.232.184.116:14086] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adqfl5cHBvLyJ6EUhUoizQAAAVA"]
[Sun Apr 12 03:23:04.606409 2026] [:error] [pid 44698:tid 44709] [client 4.232.184.116:14198] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sde.php"] [unique_id "adqfmBgoH9UWd-U3D56gZAAAAIY"]
[Sun Apr 12 03:23:05.446994 2026] [:error] [pid 36909:tid 36913] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/wpb.php
[Sun Apr 12 03:23:05.679774 2026] [:error] [pid 36909:tid 36931] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Sun Apr 12 03:23:05.912963 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/9EaklzMysJ.php
[Sun Apr 12 03:23:06.147815 2026] [:error] [pid 36909:tid 36917] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxl.php
[Sun Apr 12 03:23:06.393148 2026] [:error] [pid 36909:tid 36924] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/s3FiyJ2WGCnF0p1default.php
[Sun Apr 12 03:23:06.636651 2026] [:error] [pid 36909:tid 36927] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/bfil.php
[Sun Apr 12 03:23:06.869341 2026] [:error] [pid 36909:tid 36926] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Sun Apr 12 03:23:07.104792 2026] [:error] [pid 36909:tid 36922] [client 4.232.184.116:14083] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun Apr 12 03:23:35.723458 2026] [:error] [pid 34152:tid 34168] [client 4.232.184.116:14108] File does not exist: /usr/local/apache/htdocs/suspended-page/p14rAeWytPdH5hZcscCFdefault.php
[Sun Apr 12 03:23:35.961208 2026] [:error] [pid 34152:tid 34155] [client 4.232.184.116:14108] File does not exist: /usr/local/apache/htdocs/suspended-page/iindv.php
[Sun Apr 12 03:23:36.222913 2026] [:error] [pid 34152:tid 34178] [client 4.232.184.116:14108] File does not exist: /usr/local/apache/htdocs/suspended-page/maintura.php
[Sun Apr 12 03:23:36.454258 2026] [:error] [pid 34152:tid 34175] [client 4.232.184.116:14108] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adqfuIFtE4RhFslT1DrjPQAAABU"]
[Sun Apr 12 03:23:38.319444 2026] [:error] [pid 44700:tid 44745] [client 4.232.184.116:14119] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adqfumryPgh_uW4QPCmOlgAAAME"]
[Sun Apr 12 03:23:39.105493 2026] [:error] [pid 44698:tid 44709] [client 4.232.184.116:14173] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adqfuxgoH9UWd-U3D56ggQAAAIY"]
[Sun Apr 12 03:23:40.853421 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14018] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adqfvEGk5GhxTCzHUOpMZQAAAQQ"]
[Sun Apr 12 03:23:44.318533 2026] [:error] [pid 36909:tid 36923] [client 4.232.184.116:14131] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adqfwEGk5GhxTCzHUOpMegAAAQw"]
[Sun Apr 12 03:23:45.838545 2026] [:error] [pid 44698:tid 44719] [client 4.232.184.116:14019] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adqfwRgoH9UWd-U3D56ghgAAAJA"]
[Sun Apr 12 03:23:49.293634 2026] [:error] [pid 36909:tid 36911] [client 4.232.184.116:14169] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adqfxUGk5GhxTCzHUOpMpAAAAQA"]
[Sun Apr 12 03:23:53.864132 2026] [:error] [pid 44701:tid 44798] [client 4.232.184.116:14206] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adqfyRGZAP4MrlxEPFdjgAAAAFY"]
[Sun Apr 12 03:24:00.790317 2026] [:error] [pid 45064:tid 45094] [client 4.232.184.116:14114] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zc-220.php"] [unique_id "adqf0JcHBvLyJ6EUhUojMgAAAUI"]
[Sun Apr 12 03:24:09.968114 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14186] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adqf2UGk5GhxTCzHUOpM3gAAAQQ"]
[Sun Apr 12 03:24:12.541605 2026] [:error] [pid 34152:tid 34156] [client 4.232.184.116:14197] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adqf3IFtE4RhFslT1DrjlwAAAAI"]
[Sun Apr 12 03:24:15.280286 2026] [:error] [pid 36909:tid 36927] [client 4.232.184.116:14136] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adqf30Gk5GhxTCzHUOpM8gAAARA"]
[Sun Apr 12 03:24:17.376838 2026] [:error] [pid 34152:tid 34166] [client 4.232.184.116:14175] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adqf4YFtE4RhFslT1DrjrAAAAAw"]
[Sun Apr 12 03:24:19.209913 2026] [:error] [pid 44698:tid 44703] [client 4.232.184.116:14177] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adqf4xgoH9UWd-U3D56gqAAAAIA"]
[Sun Apr 12 03:24:21.528926 2026] [:error] [pid 36909:tid 36920] [client 4.232.184.116:14138] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adqf5UGk5GhxTCzHUOpNJQAAAQk"]
[Sun Apr 12 03:24:26.791086 2026] [:error] [pid 45064:tid 45103] [client 4.232.184.116:14104] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adqf6pcHBvLyJ6EUhUojVwAAAUo"]
[Sun Apr 12 03:24:28.705330 2026] [:error] [pid 45064:tid 45099] [client 4.232.184.116:14127] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fone1.php"] [unique_id "adqf7JcHBvLyJ6EUhUojXgAAAUc"]
[Sun Apr 12 03:24:29.276561 2026] [:error] [pid 45064:tid 45105] [client 4.232.184.116:14105] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adqf7ZcHBvLyJ6EUhUojYwAAAUw"]
[Sun Apr 12 03:24:30.131523 2026] [:error] [pid 45064:tid 45111] [client 4.232.184.116:14111] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adqf7pcHBvLyJ6EUhUojbwAAAVI"]
[Sun Apr 12 03:24:32.148134 2026] [:error] [pid 44700:tid 44754] [client 4.232.184.116:14116] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adqf8GryPgh_uW4QPCmO7gAAAMo"]
[Sun Apr 12 03:24:33.739830 2026] [:error] [pid 36909:tid 36931] [client 4.232.184.116:14144] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxiviLDIot.php"] [unique_id "adqf8UGk5GhxTCzHUOpNWgAAARQ"]
[Sun Apr 12 03:24:34.752979 2026] [:error] [pid 34152:tid 34155] [client 4.232.184.116:14103] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hanyatersenyum.php"] [unique_id "adqf8oFtE4RhFslT1DrjwwAAAAE"]
[Sun Apr 12 03:24:35.595695 2026] [:error] [pid 34152:tid 34168] [client 4.232.184.116:14088] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hanyatersenyum.php"] [unique_id "adqf84FtE4RhFslT1DrjzQAAAA4"]
[Sun Apr 12 03:24:36.214682 2026] [:error] [pid 44701:tid 44789] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/hanyatersenyum.php
[Sun Apr 12 03:24:36.444860 2026] [:error] [pid 44701:tid 44782] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php
[Sun Apr 12 03:24:36.938566 2026] [:error] [pid 44701:tid 44800] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/upll22.php
[Sun Apr 12 03:24:37.168469 2026] [:error] [pid 44701:tid 44774] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sun Apr 12 03:24:37.413823 2026] [:error] [pid 44701:tid 44779] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Sun Apr 12 03:24:37.646741 2026] [:error] [pid 44701:tid 44786] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Sun Apr 12 03:24:38.074452 2026] [:error] [pid 44701:tid 44778] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/pm90apbv3v5fvgkbguyiCdefault.php
[Sun Apr 12 03:24:38.305954 2026] [:error] [pid 44701:tid 44777] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Apr 12 03:24:38.562641 2026] [:error] [pid 44701:tid 44781] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Sun Apr 12 03:24:38.822672 2026] [:error] [pid 44701:tid 44783] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Sun Apr 12 03:24:39.053623 2026] [:error] [pid 44701:tid 44789] [client 4.232.184.116:14110] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Sun Apr 12 03:24:39.280075 2026] [:error] [pid 44701:tid 44776] [client 4.232.184.116:14110] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adqf9xGZAP4MrlxEPFdj1gAAAEQ"]
[Sun Apr 12 03:24:40.285097 2026] [:error] [pid 45064:tid 45107] [client 4.232.184.116:14037] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adqf-JcHBvLyJ6EUhUojiAAAAU4"]
[Sun Apr 12 03:24:41.341089 2026] [:error] [pid 36909:tid 36934] [client 4.232.184.116:14022] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adqf-UGk5GhxTCzHUOpNeAAAARc"]
[Sun Apr 12 03:24:42.621137 2026] [:error] [pid 36909:tid 36919] [client 4.232.184.116:14017] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adqf-kGk5GhxTCzHUOpNgwAAAQg"]
[Sun Apr 12 03:24:43.893053 2026] [:error] [pid 44701:tid 44794] [client 4.232.184.116:14207] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqf-xGZAP4MrlxEPFdj3QAAAFM"]
[Sun Apr 12 03:24:44.849008 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:13988] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqf_EGk5GhxTCzHUOpNkgAAAQc"]
[Sun Apr 12 03:24:45.506683 2026] [:error] [pid 44701:tid 44771] [client 4.232.184.116:14118] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqf_RGZAP4MrlxEPFdj4gAAAEA"]
[Sun Apr 12 03:24:46.324779 2026] [:error] [pid 34152:tid 34157] [client 4.232.184.116:14167] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqf_oFtE4RhFslT1Drj6wAAAAM"]
[Sun Apr 12 03:24:47.410933 2026] [:error] [pid 44698:tid 44713] [client 4.232.184.116:14036] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adqf_xgoH9UWd-U3D56gvAAAAIo"]
[Sun Apr 12 03:24:48.259835 2026] [:error] [pid 45064:tid 45113] [client 4.232.184.116:14087] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adqgAJcHBvLyJ6EUhUojjgAAAVQ"]
[Sun Apr 12 03:24:49.331854 2026] [:error] [pid 36909:tid 36919] [client 4.232.184.116:14016] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adqgAUGk5GhxTCzHUOpNmwAAAQg"]
[Sun Apr 12 03:24:50.368379 2026] [:error] [pid 44698:tid 44717] [client 4.232.184.116:13952] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adqgAhgoH9UWd-U3D56gxAAAAI4"]
[Sun Apr 12 03:24:51.200007 2026] [:error] [pid 45064:tid 45098] [client 4.232.184.116:13958] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adqgA5cHBvLyJ6EUhUojmAAAAUY"]
[Sun Apr 12 03:24:51.876739 2026] [:error] [pid 36909:tid 36919] [client 4.232.184.116:14034] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adqgA0Gk5GhxTCzHUOpNqwAAAQg"]
[Sun Apr 12 03:24:53.547386 2026] [:error] [pid 34152:tid 34174] [client 4.232.184.116:13958] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adqgBYFtE4RhFslT1DrkEQAAABQ"]
[Sun Apr 12 03:24:55.137312 2026] [:error] [pid 44698:tid 44714] [client 4.232.184.116:14122] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx79.php"] [unique_id "adqgBxgoH9UWd-U3D56gyAAAAIs"]
[Sun Apr 12 03:24:56.217305 2026] [:error] [pid 44701:tid 44777] [client 4.232.184.116:14060] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adqgCBGZAP4MrlxEPFdj8wAAAEU"]
[Sun Apr 12 03:24:56.855842 2026] [:error] [pid 44698:tid 44727] [client 4.232.184.116:14033] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adqgCBgoH9UWd-U3D56gywAAAJg"]
[Sun Apr 12 03:24:57.581521 2026] [:error] [pid 36909:tid 36933] [client 4.232.184.116:14168] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adqgCUGk5GhxTCzHUOpNtgAAARY"]
[Sun Apr 12 03:24:58.464599 2026] [:error] [pid 44701:tid 44795] [client 4.232.184.116:14047] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/CDX2.php"] [unique_id "adqgChGZAP4MrlxEPFdj-QAAAFQ"]
[Sun Apr 12 03:25:00.288347 2026] [:error] [pid 44698:tid 44724] [client 4.232.184.116:14052] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adqgDBgoH9UWd-U3D56gzgAAAJU"]
[Sun Apr 12 03:25:01.417957 2026] [:error] [pid 36938:tid 36957] [client 4.232.184.116:14101] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adqgDYSWpa_VL1JPU6wLhAAAAZE"]
[Sun Apr 12 03:25:02.071892 2026] [:error] [pid 36909:tid 36917] [client 4.232.184.116:14137] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adqgDkGk5GhxTCzHUOpNuwAAAQY"]
[Sun Apr 12 03:25:03.036995 2026] [:error] [pid 44700:tid 44756] [client 4.232.184.116:14074] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/666.php"] [unique_id "adqgD2ryPgh_uW4QPCmPFQAAAMw"]
[Sun Apr 12 03:25:04.371137 2026] [:error] [pid 36909:tid 36922] [client 4.232.184.116:14188] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adqgEEGk5GhxTCzHUOpNxAAAAQs"]
[Sun Apr 12 03:25:05.307293 2026] [:error] [pid 36909:tid 36913] [client 4.232.184.116:14112] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adqgEUGk5GhxTCzHUOpNzgAAAQI"]
[Sun Apr 12 03:25:06.018741 2026] [:error] [pid 44701:tid 44795] [client 4.232.184.116:14027] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adqgEhGZAP4MrlxEPFdkCAAAAFQ"]
[Sun Apr 12 03:25:07.205192 2026] [:error] [pid 36909:tid 36933] [client 4.232.184.116:14135] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wtiiy.php"] [unique_id "adqgE0Gk5GhxTCzHUOpN2QAAARY"]
[Sun Apr 12 03:25:08.469813 2026] [:error] [pid 34152:tid 34178] [client 4.232.184.116:13998] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adqgFIFtE4RhFslT1DrkIgAAABg"]
[Sun Apr 12 03:25:09.753591 2026] [:error] [pid 36938:tid 36958] [client 4.232.184.116:14051] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adqgFYSWpa_VL1JPU6wLkQAAAZI"]
[Sun Apr 12 03:25:10.772726 2026] [:error] [pid 44701:tid 44800] [client 4.232.184.116:13893] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adqgFhGZAP4MrlxEPFdkDwAAAFg"]
[Sun Apr 12 03:25:11.890214 2026] [:error] [pid 36909:tid 36911] [client 4.232.184.116:14117] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Sanskrit.php"] [unique_id "adqgF0Gk5GhxTCzHUOpN4QAAAQA"]
[Sun Apr 12 03:25:14.210539 2026] [:error] [pid 36909:tid 36923] [client 4.232.184.116:14185] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adqgGkGk5GhxTCzHUOpN4gAAAQw"]
[Sun Apr 12 03:25:15.746840 2026] [:error] [pid 36909:tid 36921] [client 4.232.184.116:14076] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adqgG0Gk5GhxTCzHUOpN5QAAAQo"]
[Sun Apr 12 03:25:16.892295 2026] [:error] [pid 44698:tid 44726] [client 4.232.184.116:14123] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adqgHBgoH9UWd-U3D56g3wAAAJc"]
[Sun Apr 12 03:25:18.615700 2026] [:error] [pid 44698:tid 44721] [client 4.232.184.116:14049] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adqgHhgoH9UWd-U3D56g4AAAAJI"]
[Sun Apr 12 03:25:21.017158 2026] [:error] [pid 36938:tid 36956] [client 4.232.184.116:14152] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adqgIYSWpa_VL1JPU6wLlgAAAZA"]
[Sun Apr 12 03:25:23.787505 2026] [:error] [pid 45064:tid 45101] [client 4.232.184.116:13980] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adqgI5cHBvLyJ6EUhUojyAAAAUg"]
[Sun Apr 12 03:25:26.901755 2026] [:error] [pid 45064:tid 45112] [client 4.232.184.116:14128] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adqgJpcHBvLyJ6EUhUoj1QAAAVM"]
[Sun Apr 12 03:25:28.860792 2026] [:error] [pid 36909:tid 36916] [client 4.232.184.116:14134] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amax.php"] [unique_id "adqgKEGk5GhxTCzHUOpOAwAAAQU"]
[Sun Apr 12 03:25:30.017909 2026] [:error] [pid 45064:tid 45113] [client 4.232.184.116:13919] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adqgKpcHBvLyJ6EUhUoj3AAAAVQ"]
[Sun Apr 12 03:25:31.378295 2026] [:error] [pid 34152:tid 34155] [client 4.232.184.116:14142] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adqgK4FtE4RhFslT1DrkRQAAAAE"]
[Sun Apr 12 03:25:32.881603 2026] [:error] [pid 45064:tid 45114] [client 4.232.184.116:14166] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adqgLJcHBvLyJ6EUhUoj4gAAAVU"]
[Sun Apr 12 03:25:36.167907 2026] [:error] [pid 44700:tid 44756] [client 4.232.184.116:14020] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adqgMGryPgh_uW4QPCmPQAAAAMw"]
[Sun Apr 12 03:25:37.731976 2026] [:error] [pid 34152:tid 34155] [client 4.232.184.116:14158] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adqgMYFtE4RhFslT1DrkXwAAAAE"]
[Sun Apr 12 03:25:46.100966 2026] [:error] [pid 36938:tid 36947] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Apr 12 03:25:46.343842 2026] [:error] [pid 36938:tid 36958] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sun Apr 12 03:25:46.978419 2026] [:error] [pid 36938:tid 36941] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Sun Apr 12 03:25:47.249925 2026] [:error] [pid 36938:tid 36957] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sun Apr 12 03:25:48.663374 2026] [:error] [pid 36938:tid 36957] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Apr 12 03:25:48.895912 2026] [:error] [pid 36938:tid 36944] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Sun Apr 12 03:25:49.128707 2026] [:error] [pid 36938:tid 36945] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sun Apr 12 03:25:49.378345 2026] [:error] [pid 36938:tid 36942] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Apr 12 03:25:49.648727 2026] [:error] [pid 36938:tid 36943] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Sun Apr 12 03:25:50.086786 2026] [:error] [pid 36938:tid 36960] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Sun Apr 12 03:25:50.323053 2026] [:error] [pid 36938:tid 36955] [client 4.232.184.116:14133] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Sun Apr 12 03:25:50.559952 2026] [:error] [pid 36938:tid 36962] [client 4.232.184.116:14133] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adqgPoSWpa_VL1JPU6wLsAAAAZY"]
[Sun Apr 12 03:25:59.980884 2026] [:error] [pid 36909:tid 36928] [client 4.232.184.116:14075] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adqgR0Gk5GhxTCzHUOpOWQAAARE"]
[Sun Apr 12 03:26:01.713498 2026] [:error] [pid 45064:tid 45117] [client 4.232.184.116:14045] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adqgSZcHBvLyJ6EUhUokJgAAAVg"]
[Sun Apr 12 03:26:03.821413 2026] [:error] [pid 45064:tid 45108] [client 4.232.184.116:13969] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adqgS5cHBvLyJ6EUhUokLAAAAU8"]
[Sun Apr 12 03:26:05.489541 2026] [:error] [pid 34152:tid 34177] [client 4.232.184.116:14068] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adqgTYFtE4RhFslT1DrkmwAAABc"]
[Sun Apr 12 03:26:06.800716 2026] [:error] [pid 34152:tid 34169] [client 4.232.184.116:14081] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adqgToFtE4RhFslT1DrkowAAAA8"]
[Sun Apr 12 03:26:08.293502 2026] [:error] [pid 45064:tid 45095] [client 4.232.184.116:14151] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adqgUJcHBvLyJ6EUhUokNgAAAUM"]
[Sun Apr 12 03:26:09.329810 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:14024] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adqgUUGk5GhxTCzHUOpOdAAAAQc"]
[Sun Apr 12 03:26:10.397141 2026] [:error] [pid 36909:tid 36933] [client 4.232.184.116:14031] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adqgUkGk5GhxTCzHUOpOeAAAARY"]
[Sun Apr 12 03:26:11.483335 2026] [:error] [pid 36909:tid 36915] [client 4.232.184.116:14079] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adqgU0Gk5GhxTCzHUOpOgAAAAQQ"]
[Sun Apr 12 03:26:12.251776 2026] [:error] [pid 34152:tid 34175] [client 4.232.184.116:14054] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adqgVIFtE4RhFslT1DrkuQAAABU"]
[Sun Apr 12 03:26:12.768632 2026] [:error] [pid 44698:tid 44724] [client 4.232.184.116:14193] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adqgVBgoH9UWd-U3D56hAAAAAJU"]
[Sun Apr 12 03:26:13.410808 2026] [:error] [pid 36909:tid 36929] [client 4.232.184.116:14085] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adqgVUGk5GhxTCzHUOpOhAAAARI"]
[Sun Apr 12 03:26:14.123862 2026] [:error] [pid 44701:tid 44776] [client 4.232.184.116:13888] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adqgVhGZAP4MrlxEPFdkLgAAAEQ"]
[Sun Apr 12 03:26:15.140810 2026] [:error] [pid 44698:tid 44704] [client 4.232.184.116:14044] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adqgVxgoH9UWd-U3D56hDQAAAIE"]
[Sun Apr 12 03:26:15.997192 2026] [:error] [pid 34152:tid 34163] [client 4.232.184.116:14090] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bgymj.php"] [unique_id "adqgV4FtE4RhFslT1DrkvQAAAAk"]
[Sun Apr 12 03:26:16.970799 2026] [:error] [pid 44701:tid 44786] [client 4.232.184.116:14147] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adqgWBGZAP4MrlxEPFdkMgAAAEw"]
[Sun Apr 12 03:26:17.583487 2026] [:error] [pid 44701:tid 44787] [client 4.232.184.116:14138] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adqgWRGZAP4MrlxEPFdkNwAAAE0"]
[Sun Apr 12 03:26:18.534119 2026] [:error] [pid 36909:tid 36931] [client 4.232.184.116:14109] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adqgWkGk5GhxTCzHUOpOiwAAARQ"]
[Sun Apr 12 03:26:20.017068 2026] [:error] [pid 36938:tid 36946] [client 4.232.184.116:14095] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lib.php"] [unique_id "adqgXISWpa_VL1JPU6wLuQAAAYY"]
[Sun Apr 12 03:26:22.436556 2026] [:error] [pid 44700:tid 44768] [client 4.232.184.116:14048] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adqgXmryPgh_uW4QPCmPUAAAANg"]
[Sun Apr 12 03:26:25.083013 2026] [:error] [pid 45064:tid 45107] [client 4.232.184.116:13982] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adqgYZcHBvLyJ6EUhUokXAAAAU4"]
[Sun Apr 12 03:26:28.622061 2026] [:error] [pid 34152:tid 34169] [client 4.232.184.116:14200] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adqgZIFtE4RhFslT1DrkywAAAA8"]
[Sun Apr 12 03:26:32.562821 2026] [:error] [pid 36909:tid 36929] [client 4.232.184.116:14084] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bolt.php"] [unique_id "adqgaEGk5GhxTCzHUOpO0wAAARI"]
[Sun Apr 12 03:26:35.001428 2026] [:error] [pid 36909:tid 36917] [client 4.232.184.116:14195] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqga0Gk5GhxTCzHUOpO2QAAAQY"]
[Sun Apr 12 03:26:36.123850 2026] [:error] [pid 45064:tid 45107] [client 4.232.184.116:14115] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqgbJcHBvLyJ6EUhUokaAAAAU4"]
[Sun Apr 12 03:26:37.316149 2026] [:error] [pid 36938:tid 36946] [client 4.232.184.116:13907] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqgbYSWpa_VL1JPU6wLyAAAAYY"]
[Sun Apr 12 03:26:38.957597 2026] [:error] [pid 34152:tid 34160] [client 4.232.184.116:14059] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file61.php"] [unique_id "adqgboFtE4RhFslT1Drk6QAAAAY"]
[Sun Apr 12 03:26:41.775066 2026] [:error] [pid 44700:tid 44744] [client 4.232.184.116:13960] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adqgcWryPgh_uW4QPCmPbQAAAMA"]
[Sun Apr 12 03:26:44.464157 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:14146] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adqgdEGk5GhxTCzHUOpPAAAAAQc"]
[Sun Apr 12 03:26:46.771992 2026] [:error] [pid 45064:tid 45103] [client 4.232.184.116:14153] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adqgdpcHBvLyJ6EUhUokegAAAUo"]
[Sun Apr 12 03:26:48.607843 2026] [:error] [pid 45064:tid 45095] [client 4.232.184.116:14097] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uuu.php"] [unique_id "adqgeJcHBvLyJ6EUhUokewAAAUM"]
[Sun Apr 12 03:26:50.673360 2026] [:error] [pid 36938:tid 36957] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Sun Apr 12 03:26:50.913634 2026] [:error] [pid 36938:tid 36944] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/mI35rZhMg1zJ1vuXdefault.php
[Sun Apr 12 03:26:51.146097 2026] [:error] [pid 36938:tid 36956] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sun Apr 12 03:26:51.382014 2026] [:error] [pid 36938:tid 36945] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Sun Apr 12 03:26:51.616895 2026] [:error] [pid 36938:tid 36960] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Sun Apr 12 03:26:51.850519 2026] [:error] [pid 36938:tid 36943] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/lmutxdvyp7u5yksqke8ozbjgCdefault.php
[Sun Apr 12 03:26:52.126006 2026] [:error] [pid 36938:tid 36955] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Sun Apr 12 03:26:52.359325 2026] [:error] [pid 36938:tid 36952] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Sun Apr 12 03:26:52.592449 2026] [:error] [pid 36938:tid 36958] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Sun Apr 12 03:26:52.825565 2026] [:error] [pid 36938:tid 36962] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Apr 12 03:26:53.309060 2026] [:error] [pid 36938:tid 36963] [client 4.232.184.116:14046] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Sun Apr 12 03:26:53.538870 2026] [:error] [pid 36938:tid 36940] [client 4.232.184.116:14046] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adqgfYSWpa_VL1JPU6wL5AAAAYA"]
[Sun Apr 12 03:27:02.817497 2026] [:error] [pid 45064:tid 45099] [client 4.232.184.116:14129] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adqghpcHBvLyJ6EUhUokkAAAAUc"]
[Sun Apr 12 03:27:08.435197 2026] [:error] [pid 44698:tid 44726] [client 4.232.184.116:14174] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adqgjBgoH9UWd-U3D56hOgAAAJc"]
[Sun Apr 12 03:27:15.246986 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:14042] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adqgk0Gk5GhxTCzHUOpPdwAAAQc"]
[Sun Apr 12 03:27:17.321599 2026] [:error] [pid 44701:tid 44798] [client 4.232.184.116:14078] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adqglRGZAP4MrlxEPFdkawAAAFY"]
[Sun Apr 12 03:27:18.454401 2026] [:error] [pid 36938:tid 36950] [client 4.232.184.116:14181] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adqgloSWpa_VL1JPU6wL8wAAAYo"]
[Sun Apr 12 03:27:21.369606 2026] [:error] [pid 44698:tid 44709] [client 4.232.184.116:13841] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wmore1.php"] [unique_id "adqgmRgoH9UWd-U3D56hQwAAAIY"]
[Sun Apr 12 03:27:24.010662 2026] [:error] [pid 44701:tid 44793] [client 4.232.184.116:14145] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adqgnBGZAP4MrlxEPFdkdAAAAFI"]
[Sun Apr 12 03:27:25.215276 2026] [:error] [pid 44701:tid 44781] [client 4.232.184.116:14155] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adqgnRGZAP4MrlxEPFdkfAAAAEg"]
[Sun Apr 12 03:27:27.126786 2026] [:error] [pid 44698:tid 44707] [client 4.232.184.116:14170] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adqgnxgoH9UWd-U3D56hSwAAAIQ"]
[Sun Apr 12 03:27:29.899797 2026] [:error] [pid 45064:tid 45112] [client 4.232.184.116:13983] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new3.php"] [unique_id "adqgoZcHBvLyJ6EUhUok7gAAAVM"]
[Sun Apr 12 03:27:31.869738 2026] [:error] [pid 44698:tid 44717] [client 4.232.184.116:14184] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adqgoxgoH9UWd-U3D56hUwAAAI4"]
[Sun Apr 12 03:27:34.293738 2026] [:error] [pid 34152:tid 34174] [client 4.232.184.116:14171] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adqgpoFtE4RhFslT1DrlYwAAABQ"]
[Sun Apr 12 03:27:36.736304 2026] [:error] [pid 44698:tid 44712] [client 4.232.184.116:14149] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adqgqBgoH9UWd-U3D56hWgAAAIk"]
[Sun Apr 12 03:27:39.969567 2026] [:error] [pid 34152:tid 34177] [client 4.232.184.116:14093] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nw.php"] [unique_id "adqgq4FtE4RhFslT1DrlbAAAABc"]
[Sun Apr 12 03:27:41.741737 2026] [:error] [pid 36938:tid 36948] [client 4.232.184.116:14187] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adqgrYSWpa_VL1JPU6wMGwAAAYg"]
[Sun Apr 12 03:27:43.334529 2026] [:error] [pid 44698:tid 44720] [client 4.232.184.116:14205] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adqgrxgoH9UWd-U3D56hbgAAAJE"]
[Sun Apr 12 03:27:44.474292 2026] [:error] [pid 44698:tid 44710] [client 4.232.184.116:14159] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adqgsBgoH9UWd-U3D56hdQAAAIc"]
[Sun Apr 12 03:27:45.968598 2026] [:error] [pid 44701:tid 44789] [client 4.232.184.116:14191] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byypas.php"] [unique_id "adqgsRGZAP4MrlxEPFdkjQAAAE4"]
[Sun Apr 12 03:27:47.345182 2026] [:error] [pid 36909:tid 36931] [client 4.232.184.116:14190] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adqgs0Gk5GhxTCzHUOpPsgAAARQ"]
[Sun Apr 12 03:27:49.488958 2026] [:error] [pid 36938:tid 36940] [client 4.232.184.116:14080] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adqgtYSWpa_VL1JPU6wMJAAAAYA"]
[Sun Apr 12 03:27:52.219636 2026] [:error] [pid 36909:tid 36928] [client 4.232.184.116:14139] [client 4.232.184.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adqguEGk5GhxTCzHUOpPuQAAARE"]
[Sun Apr 12 03:28:00.274562 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Sun Apr 12 03:28:00.893889 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Sun Apr 12 03:28:01.127623 2026] [:error] [pid 36909:tid 36921] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Sun Apr 12 03:28:01.400407 2026] [:error] [pid 36909:tid 36920] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Sun Apr 12 03:28:02.732863 2026] [:error] [pid 36909:tid 36930] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Sun Apr 12 03:28:02.968170 2026] [:error] [pid 36909:tid 36922] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Sun Apr 12 03:28:03.202367 2026] [:error] [pid 36909:tid 36918] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sun Apr 12 03:28:03.475365 2026] [:error] [pid 36909:tid 36911] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Sun Apr 12 03:28:03.728391 2026] [:error] [pid 36909:tid 36923] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sun Apr 12 03:28:05.544904 2026] [:error] [pid 36909:tid 36922] [client 4.232.184.116:14089] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Sun Apr 12 04:09:02.340799 2026] [:error] [pid 17969:tid 18013] [client 39.45.63.163:54563] [client 39.45.63.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.45.63.163, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adqqXo-vTBFpusgC4zEUgQAAAYw"]
[Sun Apr 12 04:09:02.347092 2026] [:error] [pid 17969:tid 18013] [client 39.45.63.163:54563] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 12 05:54:58.935068 2026] [:error] [pid 25328:tid 25377] [client 62.197.152.86:51488] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "adrDMsxUaQZxT-e0YsDoyAAAAEo"]
[Sun Apr 12 05:54:59.571485 2026] [:error] [pid 25328:tid 25379] [client 62.197.152.86:60650] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "adrDM8xUaQZxT-e0YsDo2wAAAEs"]
[Sun Apr 12 05:55:00.197961 2026] [:error] [pid 26567:tid 26582] [client 62.197.152.86:60842] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "adrDNHhRpg6ptWFyFx0CjgAAAQ0"]
[Sun Apr 12 05:55:00.807684 2026] [:error] [pid 25328:tid 25396] [client 62.197.152.86:32816] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "adrDNMxUaQZxT-e0YsDo9AAAAFM"]
[Sun Apr 12 05:55:01.417240 2026] [:error] [pid 25328:tid 25366] [client 62.197.152.86:33036] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless.php"] [unique_id "adrDNcxUaQZxT-e0YsDo_QAAAEI"]
[Sun Apr 12 05:55:02.047742 2026] [:error] [pid 25329:tid 25412] [client 62.197.152.86:33238] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/"] [unique_id "adrDNmdcIYsS8Iyaj101cgAAAJU"]
[Sun Apr 12 05:55:02.659629 2026] [:error] [pid 25328:tid 25372] [client 62.197.152.86:33466] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/"] [unique_id "adrDNsxUaQZxT-e0YsDpGAAAAEc"]
[Sun Apr 12 05:55:03.307855 2026] [:error] [pid 60280:tid 60293] [client 62.197.152.86:33652] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/"] [unique_id "adrDN3BlLnDOYuIykkjtQgAAAcs"]
[Sun Apr 12 05:55:03.922099 2026] [:error] [pid 25327:tid 25352] [client 62.197.152.86:33822] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/"] [unique_id "adrDNy6h2tZEVJo9JFJEpgAAABA"]
[Sun Apr 12 05:55:04.537254 2026] [:error] [pid 25437:tid 25459] [client 62.197.152.86:33958] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/"] [unique_id "adrDOHf97wYZje1ep_NXQgAAANQ"]
[Sun Apr 12 08:20:17.208607 2026] [:error] [pid 25437:tid 25461] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sun Apr 12 08:20:17.417537 2026] [:error] [pid 25437:tid 25445] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Apr 12 08:20:17.840525 2026] [:error] [pid 25437:tid 25442] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sun Apr 12 08:20:18.049187 2026] [:error] [pid 25437:tid 25460] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Apr 12 08:20:18.258067 2026] [:error] [pid 25437:tid 25439] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 12 08:20:18.466624 2026] [:error] [pid 25437:tid 25443] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sun Apr 12 08:20:18.682039 2026] [:error] [pid 25437:tid 25449] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sun Apr 12 08:20:19.099034 2026] [:error] [pid 25437:tid 25456] [client 20.220.147.82:2013] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Apr 12 08:20:19.304091 2026] [:error] [pid 25437:tid 25459] [client 20.220.147.82:2013] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "adrlQ3f97wYZje1ep_N9CQAAANQ"]
[Sun Apr 12 08:20:19.714802 2026] [:error] [pid 26600:tid 26641] [client 20.220.147.82:2018] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "adrlQ-1YwAZiXhQKLYqaWAAAAYw"]
[Sun Apr 12 08:20:20.182667 2026] [:error] [pid 26600:tid 26636] [client 20.220.147.82:1994] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "adrlRO1YwAZiXhQKLYqaXAAAAYc"]
[Sun Apr 12 08:20:20.594385 2026] [:error] [pid 25328:tid 25372] [client 20.220.147.82:2019] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tx1.php"] [unique_id "adrlRMxUaQZxT-e0YsAiMgAAAEc"]
[Sun Apr 12 08:20:21.033046 2026] [:error] [pid 25329:tid 25395] [client 20.220.147.82:2045] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "adrlRWdcIYsS8Iyaj11dhwAAAIs"]
[Sun Apr 12 08:20:21.448806 2026] [:error] [pid 26600:tid 26642] [client 20.220.147.82:1929] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "adrlRe1YwAZiXhQKLYqaYgAAAY0"]
[Sun Apr 12 08:20:21.861350 2026] [:error] [pid 26600:tid 26653] [client 20.220.147.82:1991] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "adrlRe1YwAZiXhQKLYqaZQAAAZg"]
[Sun Apr 12 08:20:22.284556 2026] [:error] [pid 26600:tid 26651] [client 20.220.147.82:1962] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xv.php"] [unique_id "adrlRu1YwAZiXhQKLYqaaQAAAZY"]
[Sun Apr 12 08:20:22.695855 2026] [:error] [pid 25327:tid 25347] [client 20.220.147.82:1923] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "adrlRi6h2tZEVJo9JFJlngAAAAs"]
[Sun Apr 12 08:20:23.106062 2026] [:error] [pid 25329:tid 25404] [client 20.220.147.82:1989] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "adrlR2dcIYsS8Iyaj11diAAAAJA"]
[Sun Apr 12 08:20:23.514784 2026] [:error] [pid 26600:tid 26649] [client 20.220.147.82:2006] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "adrlR-1YwAZiXhQKLYqadAAAAZQ"]
[Sun Apr 12 08:20:23.926078 2026] [:error] [pid 25328:tid 25373] [client 20.220.147.82:1936] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x56.php"] [unique_id "adrlR8xUaQZxT-e0YsAiNgAAAEg"]
[Sun Apr 12 08:20:24.343246 2026] [:error] [pid 26600:tid 26637] [client 20.220.147.82:2030] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "adrlSO1YwAZiXhQKLYqaewAAAYg"]
[Sun Apr 12 08:20:24.760977 2026] [:error] [pid 25329:tid 25409] [client 20.220.147.82:1924] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "adrlSGdcIYsS8Iyaj11digAAAJM"]
[Sun Apr 12 08:20:25.175514 2026] [:error] [pid 26600:tid 26650] [client 20.220.147.82:2028] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "adrlSe1YwAZiXhQKLYqaggAAAZU"]
[Sun Apr 12 08:20:25.585478 2026] [:error] [pid 26600:tid 26644] [client 20.220.147.82:2033] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/htaccess.php"] [unique_id "adrlSe1YwAZiXhQKLYqahgAAAY8"]
[Sun Apr 12 08:20:26.008150 2026] [:error] [pid 25327:tid 25358] [client 20.220.147.82:2000] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "adrlSi6h2tZEVJo9JFJloQAAABY"]
[Sun Apr 12 08:20:26.416660 2026] [:error] [pid 25327:tid 25344] [client 20.220.147.82:1874] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "adrlSi6h2tZEVJo9JFJlpAAAAAg"]
[Sun Apr 12 08:20:26.827450 2026] [:error] [pid 25329:tid 25411] [client 20.220.147.82:1965] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "adrlSmdcIYsS8Iyaj11diwAAAJQ"]
[Sun Apr 12 08:20:27.237663 2026] [:error] [pid 25437:tid 25452] [client 20.220.147.82:2039] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/readme.php"] [unique_id "adrlS3f97wYZje1ep_N9CwAAAM0"]
[Sun Apr 12 08:20:27.656525 2026] [:error] [pid 26600:tid 26645] [client 20.220.147.82:1996] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "adrlS-1YwAZiXhQKLYqalQAAAZA"]
[Sun Apr 12 08:20:28.103305 2026] [:error] [pid 25327:tid 25341] [client 20.220.147.82:2001] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "adrlTC6h2tZEVJo9JFJlqQAAAAU"]
[Sun Apr 12 08:20:28.515301 2026] [:error] [pid 26600:tid 26637] [client 20.220.147.82:2008] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "adrlTO1YwAZiXhQKLYqamwAAAYg"]
[Sun Apr 12 08:20:28.935881 2026] [:error] [pid 26600:tid 26629] [client 20.220.147.82:2012] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x50.php"] [unique_id "adrlTO1YwAZiXhQKLYqanQAAAYA"]
[Sun Apr 12 08:20:29.355397 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:2047] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "adrlTe1YwAZiXhQKLYqaoAAAAZI"]
[Sun Apr 12 08:20:29.765802 2026] [:error] [pid 25329:tid 25414] [client 20.220.147.82:1992] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "adrlTWdcIYsS8Iyaj11djwAAAJc"]
[Sun Apr 12 08:20:30.178042 2026] [:error] [pid 25327:tid 25345] [client 20.220.147.82:2004] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "adrlTi6h2tZEVJo9JFJlrgAAAAk"]
[Sun Apr 12 08:20:30.598019 2026] [:error] [pid 26567:tid 26593] [client 20.220.147.82:1942] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fv.php"] [unique_id "adrlTnhRpg6ptWFyFx0rlwAAARg"]
[Sun Apr 12 08:20:31.013699 2026] [:error] [pid 26599:tid 26608] [client 20.220.147.82:1935] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adrlT3G89LXoQbk_rwBxhgAAAUY"]
[Sun Apr 12 08:20:31.424865 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1972] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adrlT-1YwAZiXhQKLYqaqwAAAZI"]
[Sun Apr 12 08:20:31.834002 2026] [:error] [pid 26600:tid 26646] [client 20.220.147.82:2041] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adrlT-1YwAZiXhQKLYqargAAAZE"]
[Sun Apr 12 08:20:32.244138 2026] [:error] [pid 26600:tid 26652] [client 20.220.147.82:1932] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file.php"] [unique_id "adrlUO1YwAZiXhQKLYqarwAAAZc"]
[Sun Apr 12 08:20:32.653060 2026] [:error] [pid 25329:tid 25407] [client 20.220.147.82:2038] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "adrlUGdcIYsS8Iyaj11dkwAAAJI"]
[Sun Apr 12 08:20:33.062671 2026] [:error] [pid 25437:tid 25451] [client 20.220.147.82:1925] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "adrlUXf97wYZje1ep_N9DwAAAMw"]
[Sun Apr 12 08:20:33.476039 2026] [:error] [pid 25327:tid 25342] [client 20.220.147.82:2014] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "adrlUS6h2tZEVJo9JFJlsAAAAAY"]
[Sun Apr 12 08:20:33.885541 2026] [:error] [pid 60280:tid 60295] [client 20.220.147.82:1933] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lsd.php"] [unique_id "adrlUXBlLnDOYuIykkgh2wAAAc0"]
[Sun Apr 12 08:20:34.296697 2026] [:error] [pid 26600:tid 26644] [client 20.220.147.82:2020] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "adrlUu1YwAZiXhQKLYqatQAAAY8"]
[Sun Apr 12 08:20:34.708192 2026] [:error] [pid 26600:tid 26633] [client 20.220.147.82:2042] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "adrlUu1YwAZiXhQKLYqatwAAAYQ"]
[Sun Apr 12 08:20:35.118165 2026] [:error] [pid 26600:tid 26637] [client 20.220.147.82:2025] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "adrlU-1YwAZiXhQKLYqauQAAAYg"]
[Sun Apr 12 08:20:35.527100 2026] [:error] [pid 26567:tid 26569] [client 20.220.147.82:1986] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "adrlU3hRpg6ptWFyFx0rnwAAAQA"]
[Sun Apr 12 08:20:35.938855 2026] [:error] [pid 25327:tid 25359] [client 20.220.147.82:1934] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "adrlUy6h2tZEVJo9JFJluAAAABc"]
[Sun Apr 12 08:20:36.348881 2026] [:error] [pid 26599:tid 26614] [client 20.220.147.82:2015] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "adrlVHG89LXoQbk_rwBxigAAAUw"]
[Sun Apr 12 08:20:36.771674 2026] [:error] [pid 60280:tid 60293] [client 20.220.147.82:1988] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "adrlVHBlLnDOYuIykkgh3gAAAcs"]
[Sun Apr 12 08:20:37.181984 2026] [:error] [pid 26600:tid 26634] [client 20.220.147.82:2029] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsd.php"] [unique_id "adrlVe1YwAZiXhQKLYqavgAAAYU"]
[Sun Apr 12 08:20:37.591826 2026] [:error] [pid 26600:tid 26631] [client 20.220.147.82:1931] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "adrlVe1YwAZiXhQKLYqawAAAAYI"]
[Sun Apr 12 08:20:38.018965 2026] [:error] [pid 26600:tid 26640] [client 20.220.147.82:1920] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "adrlVu1YwAZiXhQKLYqawwAAAYs"]
[Sun Apr 12 08:20:38.430553 2026] [:error] [pid 26600:tid 26633] [client 20.220.147.82:1863] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "adrlVu1YwAZiXhQKLYqaxgAAAYQ"]
[Sun Apr 12 08:20:38.846053 2026] [:error] [pid 26600:tid 26648] [client 20.220.147.82:1939] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gtc.php"] [unique_id "adrlVu1YwAZiXhQKLYqaxwAAAZM"]
[Sun Apr 12 08:20:39.257557 2026] [:error] [pid 26599:tid 26603] [client 20.220.147.82:1941] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "adrlV3G89LXoQbk_rwBxjgAAAUE"]
[Sun Apr 12 08:20:39.678601 2026] [:error] [pid 26600:tid 26641] [client 20.220.147.82:2021] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "adrlV-1YwAZiXhQKLYqazgAAAYw"]
[Sun Apr 12 08:20:40.100917 2026] [:error] [pid 26599:tid 26615] [client 20.220.147.82:2035] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "adrlWHG89LXoQbk_rwBxkwAAAU0"]
[Sun Apr 12 08:20:40.511698 2026] [:error] [pid 26567:tid 26581] [client 20.220.147.82:2026] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/atx.php"] [unique_id "adrlWHhRpg6ptWFyFx0rpwAAAQw"]
[Sun Apr 12 08:20:40.937182 2026] [:error] [pid 26600:tid 26635] [client 20.220.147.82:1959] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "adrlWO1YwAZiXhQKLYqa1gAAAYY"]
[Sun Apr 12 08:20:41.348451 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1856] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "adrlWe1YwAZiXhQKLYqa2gAAAZI"]
[Sun Apr 12 08:20:41.765029 2026] [:error] [pid 26600:tid 26636] [client 20.220.147.82:1937] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "adrlWe1YwAZiXhQKLYqa3gAAAYc"]
[Sun Apr 12 08:20:42.174183 2026] [:error] [pid 26600:tid 26646] [client 20.220.147.82:1951] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/z60.php"] [unique_id "adrlWu1YwAZiXhQKLYqa4QAAAZE"]
[Sun Apr 12 08:20:42.588888 2026] [:error] [pid 25328:tid 25368] [client 20.220.147.82:1948] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrlWsxUaQZxT-e0YsAiQAAAAEQ"]
[Sun Apr 12 08:20:42.999991 2026] [:error] [pid 26567:tid 26579] [client 20.220.147.82:2023] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrlWnhRpg6ptWFyFx0rqQAAAQo"]
[Sun Apr 12 08:20:43.413820 2026] [:error] [pid 26567:tid 26587] [client 20.220.147.82:1857] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrlW3hRpg6ptWFyFx0rqgAAARI"]
[Sun Apr 12 08:20:43.826162 2026] [:error] [pid 25328:tid 25379] [client 20.220.147.82:1809] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrlW8xUaQZxT-e0YsAiQQAAAEs"]
[Sun Apr 12 08:20:44.253525 2026] [:error] [pid 26599:tid 26623] [client 20.220.147.82:2011] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "adrlXHG89LXoQbk_rwBxmwAAAVU"]
[Sun Apr 12 08:20:44.699918 2026] [:error] [pid 26599:tid 26613] [client 20.220.147.82:1946] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "adrlXHG89LXoQbk_rwBxngAAAUs"]
[Sun Apr 12 08:20:45.111378 2026] [:error] [pid 26599:tid 26626] [client 20.220.147.82:1926] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "adrlXXG89LXoQbk_rwBxogAAAVg"]
[Sun Apr 12 08:20:45.522012 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1867] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/m.php"] [unique_id "adrlXe1YwAZiXhQKLYqa7QAAAZI"]
[Sun Apr 12 08:20:45.932004 2026] [:error] [pid 26600:tid 26646] [client 20.220.147.82:2017] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "adrlXe1YwAZiXhQKLYqa8QAAAZE"]
[Sun Apr 12 08:20:46.342411 2026] [:error] [pid 26600:tid 26641] [client 20.220.147.82:1984] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "adrlXu1YwAZiXhQKLYqa9gAAAYw"]
[Sun Apr 12 08:20:46.755351 2026] [:error] [pid 26600:tid 26645] [client 20.220.147.82:1947] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "adrlXu1YwAZiXhQKLYqa_QAAAZA"]
[Sun Apr 12 08:20:47.163307 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1984] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes.php"] [unique_id "adrlX-1YwAZiXhQKLYqbBAAAAZI"]
[Sun Apr 12 08:20:47.573165 2026] [:error] [pid 25329:tid 25415] [client 20.220.147.82:2002] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "adrlX2dcIYsS8Iyaj11dlQAAAJg"]
[Sun Apr 12 08:20:47.996630 2026] [:error] [pid 60280:tid 60291] [client 20.220.147.82:1964] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "adrlX3BlLnDOYuIykkgh5gAAAck"]
[Sun Apr 12 08:20:48.408765 2026] [:error] [pid 26567:tid 26584] [client 20.220.147.82:1930] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "adrlYHhRpg6ptWFyFx0rsgAAAQ8"]
[Sun Apr 12 08:20:48.818182 2026] [:error] [pid 25329:tid 25388] [client 20.220.147.82:1968] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "adrlYGdcIYsS8Iyaj11dlwAAAIc"]
[Sun Apr 12 08:20:49.226550 2026] [:error] [pid 25329:tid 25404] [client 20.220.147.82:1945] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adrlYWdcIYsS8Iyaj11dmQAAAJA"]
[Sun Apr 12 08:20:49.639872 2026] [:error] [pid 60280:tid 60299] [client 20.220.147.82:2022] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adrlYXBlLnDOYuIykkgh6QAAAdE"]
[Sun Apr 12 08:20:50.049855 2026] [:error] [pid 26599:tid 26612] [client 20.220.147.82:2040] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adrlYnG89LXoQbk_rwBxrwAAAUo"]
[Sun Apr 12 08:20:50.459076 2026] [:error] [pid 25437:tid 25449] [client 20.220.147.82:1921] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adrlYnf97wYZje1ep_N9EwAAAMo"]
[Sun Apr 12 08:20:50.876180 2026] [:error] [pid 25327:tid 25359] [client 20.220.147.82:2037] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "adrlYi6h2tZEVJo9JFJlxQAAABc"]
[Sun Apr 12 08:20:51.288149 2026] [:error] [pid 60280:tid 60296] [client 20.220.147.82:1938] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "adrlY3BlLnDOYuIykkgh7AAAAc4"]
[Sun Apr 12 08:20:51.698479 2026] [:error] [pid 25437:tid 25448] [client 20.220.147.82:1871] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "adrlY3f97wYZje1ep_N9FQAAAMk"]
[Sun Apr 12 08:20:52.109032 2026] [:error] [pid 26599:tid 26615] [client 20.220.147.82:1861] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/click.php"] [unique_id "adrlZHG89LXoQbk_rwBxsgAAAU0"]
[Sun Apr 12 08:20:52.525484 2026] [:error] [pid 25327:tid 25347] [client 20.220.147.82:1940] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adrlZC6h2tZEVJo9JFJlywAAAAs"]
[Sun Apr 12 08:20:52.935131 2026] [:error] [pid 25327:tid 25342] [client 20.220.147.82:1881] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adrlZC6h2tZEVJo9JFJlzAAAAAY"]
[Sun Apr 12 08:20:53.346391 2026] [:error] [pid 26600:tid 26645] [client 20.220.147.82:1985] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adrlZe1YwAZiXhQKLYqbCgAAAZA"]
[Sun Apr 12 08:20:53.772879 2026] [:error] [pid 26600:tid 26650] [client 20.220.147.82:1949] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/install.php"] [unique_id "adrlZe1YwAZiXhQKLYqbDgAAAZU"]
[Sun Apr 12 08:20:54.196178 2026] [:error] [pid 25327:tid 25338] [client 20.220.147.82:1823] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adrlZi6h2tZEVJo9JFJl0gAAAAI"]
[Sun Apr 12 08:20:54.609377 2026] [:error] [pid 25437:tid 25440] [client 20.220.147.82:1966] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adrlZnf97wYZje1ep_N9GAAAAME"]
[Sun Apr 12 08:20:55.087058 2026] [:error] [pid 25327:tid 25355] [client 20.220.147.82:1960] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adrlZy6h2tZEVJo9JFJl2wAAABM"]
[Sun Apr 12 08:20:55.499416 2026] [:error] [pid 26599:tid 26611] [client 20.220.147.82:1958] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lv.php"] [unique_id "adrlZ3G89LXoQbk_rwBxtQAAAUk"]
[Sun Apr 12 08:20:55.915412 2026] [:error] [pid 26599:tid 26621] [client 20.220.147.82:1979] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adrlZ3G89LXoQbk_rwBxtwAAAVM"]
[Sun Apr 12 08:20:56.344453 2026] [:error] [pid 25327:tid 25352] [client 20.220.147.82:1960] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adrlaC6h2tZEVJo9JFJl3wAAABA"]
[Sun Apr 12 08:20:56.782457 2026] [:error] [pid 25437:tid 25455] [client 20.220.147.82:1922] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adrlaHf97wYZje1ep_N9GgAAANA"]
[Sun Apr 12 08:20:57.240656 2026] [:error] [pid 25329:tid 25374] [client 20.220.147.82:1975] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/simple.php"] [unique_id "adrlaWdcIYsS8Iyaj11dpAAAAIA"]
[Sun Apr 12 08:20:57.681662 2026] [:error] [pid 60280:tid 60285] [client 20.220.147.82:1963] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrlaXBlLnDOYuIykkgh8gAAAcM"]
[Sun Apr 12 08:20:58.476770 2026] [:error] [pid 26567:tid 26574] [client 20.220.147.82:1886] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrlanhRpg6ptWFyFx0rvwAAAQU"]
[Sun Apr 12 08:20:58.983545 2026] [:error] [pid 60280:tid 60301] [client 20.220.147.82:1875] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrlanBlLnDOYuIykkgh9AAAAdM"]
[Sun Apr 12 08:20:59.926739 2026] [:error] [pid 26600:tid 26643] [client 20.220.147.82:1990] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrla-1YwAZiXhQKLYqbFQAAAY4"]
[Sun Apr 12 08:21:00.545673 2026] [:error] [pid 60280:tid 60296] [client 20.220.147.82:1956] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlbHBlLnDOYuIykkgh_AAAAc4"]
[Sun Apr 12 08:21:00.997152 2026] [:error] [pid 60280:tid 60303] [client 20.220.147.82:1883] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlbHBlLnDOYuIykkgh_wAAAdU"]
[Sun Apr 12 08:21:01.501846 2026] [:error] [pid 25329:tid 25399] [client 20.220.147.82:1876] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlbWdcIYsS8Iyaj11dqQAAAI0"]
[Sun Apr 12 08:21:02.051984 2026] [:error] [pid 25328:tid 25385] [client 20.220.147.82:2010] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlbsxUaQZxT-e0YsAiRgAAAE4"]
[Sun Apr 12 08:21:02.557589 2026] [:error] [pid 26600:tid 26653] [client 20.220.147.82:1978] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adrlbu1YwAZiXhQKLYqbHQAAAZg"]
[Sun Apr 12 08:21:03.088034 2026] [:error] [pid 26599:tid 26626] [client 20.220.147.82:1898] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlb3G89LXoQbk_rwBxvwAAAVg"]
[Sun Apr 12 08:21:03.645056 2026] [:error] [pid 26567:tid 26581] [client 20.220.147.82:1821] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlb3hRpg6ptWFyFx0ryAAAAQw"]
[Sun Apr 12 08:21:04.341143 2026] [:error] [pid 60280:tid 60282] [client 20.220.147.82:1839] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlcHBlLnDOYuIykkgiCwAAAcA"]
[Sun Apr 12 08:21:04.928148 2026] [:error] [pid 26600:tid 26638] [client 20.220.147.82:1896] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cong.php"] [unique_id "adrlcO1YwAZiXhQKLYqbLAAAAYk"]
[Sun Apr 12 08:21:05.381739 2026] [:error] [pid 26599:tid 26616] [client 20.220.147.82:2032] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adrlcXG89LXoQbk_rwBxwgAAAU4"]
[Sun Apr 12 08:21:05.826291 2026] [:error] [pid 26599:tid 26609] [client 20.220.147.82:1862] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adrlcXG89LXoQbk_rwBxxwAAAUc"]
[Sun Apr 12 08:21:06.263455 2026] [:error] [pid 26599:tid 26622] [client 20.220.147.82:2036] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adrlcnG89LXoQbk_rwBxygAAAVQ"]
[Sun Apr 12 08:21:06.675055 2026] [:error] [pid 60280:tid 60286] [client 20.220.147.82:1858] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adrlcnBlLnDOYuIykkgiEQAAAcQ"]
[Sun Apr 12 08:21:07.088125 2026] [:error] [pid 25437:tid 25453] [client 20.220.147.82:2043] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrlc3f97wYZje1ep_N9JAAAAM4"]
[Sun Apr 12 08:21:07.498390 2026] [:error] [pid 26600:tid 26634] [client 20.220.147.82:1873] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrlc-1YwAZiXhQKLYqbMQAAAYU"]
[Sun Apr 12 08:21:07.931515 2026] [:error] [pid 26599:tid 26616] [client 20.220.147.82:1927] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrlc3G89LXoQbk_rwBx0wAAAU4"]
[Sun Apr 12 08:21:08.342349 2026] [:error] [pid 26599:tid 26611] [client 20.220.147.82:1917] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrldHG89LXoQbk_rwBx1QAAAUk"]
[Sun Apr 12 08:21:08.752049 2026] [:error] [pid 26599:tid 26622] [client 20.220.147.82:1860] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adrldHG89LXoQbk_rwBx2AAAAVQ"]
[Sun Apr 12 08:21:09.171069 2026] [:error] [pid 26599:tid 26623] [client 20.220.147.82:2046] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adrldXG89LXoQbk_rwBx2wAAAVU"]
[Sun Apr 12 08:21:09.589595 2026] [:error] [pid 26599:tid 26615] [client 20.220.147.82:1999] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adrldXG89LXoQbk_rwBx4AAAAU0"]
[Sun Apr 12 08:21:10.001059 2026] [:error] [pid 26600:tid 26649] [client 20.220.147.82:1928] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adrldu1YwAZiXhQKLYqbQwAAAZQ"]
[Sun Apr 12 08:21:10.417388 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1889] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "adrldu1YwAZiXhQKLYqbSAAAAZI"]
[Sun Apr 12 08:21:10.829038 2026] [:error] [pid 26600:tid 26638] [client 20.220.147.82:1803] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "adrldu1YwAZiXhQKLYqbTAAAAYk"]
[Sun Apr 12 08:21:11.240682 2026] [:error] [pid 60280:tid 60298] [client 20.220.147.82:2024] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "adrld3BlLnDOYuIykkgiFgAAAdA"]
[Sun Apr 12 08:21:11.650202 2026] [:error] [pid 26599:tid 26611] [client 20.220.147.82:1952] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/0x.php"] [unique_id "adrld3G89LXoQbk_rwBx5AAAAUk"]
[Sun Apr 12 08:21:12.067878 2026] [:error] [pid 60280:tid 60305] [client 20.220.147.82:2031] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrleHBlLnDOYuIykkgiGQAAAdc"]
[Sun Apr 12 08:21:12.502315 2026] [:error] [pid 25329:tid 25376] [client 20.220.147.82:1944] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrleGdcIYsS8Iyaj11drgAAAIE"]
[Sun Apr 12 08:21:12.914567 2026] [:error] [pid 26600:tid 26644] [client 20.220.147.82:1971] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrleO1YwAZiXhQKLYqbWQAAAY8"]
[Sun Apr 12 08:21:13.350167 2026] [:error] [pid 25437:tid 25459] [client 20.220.147.82:1802] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css.php"] [unique_id "adrleXf97wYZje1ep_N9JwAAANQ"]
[Sun Apr 12 08:21:13.761629 2026] [:error] [pid 26600:tid 26646] [client 20.220.147.82:1953] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adrlee1YwAZiXhQKLYqbZgAAAZE"]
[Sun Apr 12 08:21:14.177743 2026] [:error] [pid 25437:tid 25440] [client 20.220.147.82:1915] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adrlenf97wYZje1ep_N9KAAAAME"]
[Sun Apr 12 08:21:14.588286 2026] [:error] [pid 26600:tid 26629] [client 20.220.147.82:1982] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adrleu1YwAZiXhQKLYqbagAAAYA"]
[Sun Apr 12 08:21:14.999392 2026] [:error] [pid 26599:tid 26606] [client 20.220.147.82:1961] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adrlenG89LXoQbk_rwBx6AAAAUQ"]
[Sun Apr 12 08:21:15.408981 2026] [:error] [pid 26600:tid 26643] [client 20.220.147.82:2003] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "adrle-1YwAZiXhQKLYqbbAAAAY4"]
[Sun Apr 12 08:21:15.819431 2026] [:error] [pid 25327:tid 25353] [client 20.220.147.82:1998] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "adrley6h2tZEVJo9JFJl5QAAABE"]
[Sun Apr 12 08:21:16.230108 2026] [:error] [pid 26599:tid 26603] [client 20.220.147.82:1866] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "adrlfHG89LXoQbk_rwBx8AAAAUE"]
[Sun Apr 12 08:21:16.639985 2026] [:error] [pid 25327:tid 25346] [client 20.220.147.82:1868] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/index.php"] [unique_id "adrlfC6h2tZEVJo9JFJl6AAAAAo"]
[Sun Apr 12 08:21:17.053373 2026] [:error] [pid 26600:tid 26646] [client 20.220.147.82:1864] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrlfe1YwAZiXhQKLYqbcwAAAZE"]
[Sun Apr 12 08:21:17.475124 2026] [:error] [pid 25327:tid 25355] [client 20.220.147.82:1877] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrlfS6h2tZEVJo9JFJl7AAAABM"]
[Sun Apr 12 08:21:17.884322 2026] [:error] [pid 25437:tid 25458] [client 20.220.147.82:1796] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrlfXf97wYZje1ep_N9LgAAANM"]
[Sun Apr 12 08:21:18.293828 2026] [:error] [pid 26599:tid 26605] [client 20.220.147.82:1943] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrlfnG89LXoQbk_rwBx9QAAAUM"]
[Sun Apr 12 08:21:18.703651 2026] [:error] [pid 25328:tid 25369] [client 20.220.147.82:1913] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "adrlfsxUaQZxT-e0YsAiSwAAAEU"]
[Sun Apr 12 08:21:20.432049 2026] [:error] [pid 26600:tid 26650] [client 20.220.147.82:1981] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Apr 12 08:21:20.638902 2026] [:error] [pid 26600:tid 26632] [client 20.220.147.82:1981] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Apr 12 08:21:20.846374 2026] [:error] [pid 26600:tid 26641] [client 20.220.147.82:1981] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Apr 12 08:21:21.054195 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1981] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Apr 12 08:21:21.261418 2026] [:error] [pid 26600:tid 26644] [client 20.220.147.82:1981] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 12 08:21:21.468995 2026] [:error] [pid 26600:tid 26629] [client 20.220.147.82:1981] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Apr 12 08:21:22.521023 2026] [:error] [pid 26600:tid 26651] [client 20.220.147.82:1981] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "adrlgu1YwAZiXhQKLYqbkwAAAZY"]
[Sun Apr 12 08:21:22.930223 2026] [:error] [pid 60280:tid 60304] [client 20.220.147.82:1969] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "adrlgnBlLnDOYuIykkgiHgAAAdY"]
[Sun Apr 12 08:21:23.347221 2026] [:error] [pid 60280:tid 60306] [client 20.220.147.82:1902] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "adrlg3BlLnDOYuIykkgiHwAAAdg"]
[Sun Apr 12 08:21:23.757636 2026] [:error] [pid 26599:tid 26624] [client 20.220.147.82:1826] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/manager.php"] [unique_id "adrlg3G89LXoQbk_rwByAAAAAVY"]
[Sun Apr 12 08:21:24.166215 2026] [:error] [pid 26599:tid 26602] [client 20.220.147.82:1859] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "adrlhHG89LXoQbk_rwByAwAAAUA"]
[Sun Apr 12 08:21:24.574361 2026] [:error] [pid 25327:tid 25351] [client 20.220.147.82:1974] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "adrlhC6h2tZEVJo9JFJl8wAAAA8"]
[Sun Apr 12 08:21:24.982940 2026] [:error] [pid 25329:tid 25388] [client 20.220.147.82:1795] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "adrlhGdcIYsS8Iyaj11dtQAAAIc"]
[Sun Apr 12 08:21:25.400052 2026] [:error] [pid 25327:tid 25343] [client 20.220.147.82:1829] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/item.php"] [unique_id "adrlhS6h2tZEVJo9JFJl9gAAAAc"]
[Sun Apr 12 08:21:25.811207 2026] [:error] [pid 25327:tid 25345] [client 20.220.147.82:1908] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "adrlhS6h2tZEVJo9JFJl_AAAAAk"]
[Sun Apr 12 08:21:26.222314 2026] [:error] [pid 60280:tid 60285] [client 20.220.147.82:1904] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "adrlhnBlLnDOYuIykkgiJAAAAcM"]
[Sun Apr 12 08:21:26.631586 2026] [:error] [pid 25327:tid 25353] [client 20.220.147.82:1976] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "adrlhi6h2tZEVJo9JFJmAwAAABE"]
[Sun Apr 12 08:21:27.041624 2026] [:error] [pid 25329:tid 25406] [client 20.220.147.82:1865] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "adrlh2dcIYsS8Iyaj11dtgAAAJE"]
[Sun Apr 12 08:21:27.457866 2026] [:error] [pid 25328:tid 25379] [client 20.220.147.82:1995] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrlh8xUaQZxT-e0YsAiWAAAAEs"]
[Sun Apr 12 08:21:27.866506 2026] [:error] [pid 26567:tid 26570] [client 20.220.147.82:2034] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrlh3hRpg6ptWFyFx0r0QAAAQE"]
[Sun Apr 12 08:21:28.277135 2026] [:error] [pid 25329:tid 25392] [client 20.220.147.82:1970] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrliGdcIYsS8Iyaj11duAAAAIk"]
[Sun Apr 12 08:21:28.686634 2026] [:error] [pid 25328:tid 25385] [client 20.220.147.82:1895] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/404.php"] [unique_id "adrliMxUaQZxT-e0YsAiXAAAAE4"]
[Sun Apr 12 08:21:29.095037 2026] [:error] [pid 26599:tid 26623] [client 20.220.147.82:1892] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "adrliXG89LXoQbk_rwByCgAAAVU"]
[Sun Apr 12 08:21:29.504834 2026] [:error] [pid 25329:tid 25413] [client 20.220.147.82:1997] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "adrliWdcIYsS8Iyaj11dvAAAAJY"]
[Sun Apr 12 08:21:29.913773 2026] [:error] [pid 26600:tid 26639] [client 20.220.147.82:1916] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "adrlie1YwAZiXhQKLYqblQAAAYo"]
[Sun Apr 12 08:21:30.322384 2026] [:error] [pid 26600:tid 26630] [client 20.220.147.82:1747] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mail.php"] [unique_id "adrliu1YwAZiXhQKLYqblgAAAYE"]
[Sun Apr 12 08:21:30.733587 2026] [:error] [pid 60280:tid 60305] [client 20.220.147.82:1885] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "adrlinBlLnDOYuIykkgiKwAAAdc"]
[Sun Apr 12 08:21:31.152788 2026] [:error] [pid 25328:tid 25387] [client 20.220.147.82:1869] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "adrli8xUaQZxT-e0YsAiXwAAAE8"]
[Sun Apr 12 08:21:31.561593 2026] [:error] [pid 25437:tid 25449] [client 20.220.147.82:1957] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "adrli3f97wYZje1ep_N9NAAAAMo"]
[Sun Apr 12 08:21:31.970866 2026] [:error] [pid 25437:tid 25443] [client 20.220.147.82:1980] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "adrli3f97wYZje1ep_N9NQAAAMQ"]
[Sun Apr 12 08:21:32.380477 2026] [:error] [pid 26600:tid 26653] [client 20.220.147.82:1880] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "adrljO1YwAZiXhQKLYqbngAAAZg"]
[Sun Apr 12 08:21:32.790518 2026] [:error] [pid 26600:tid 26651] [client 20.220.147.82:1836] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "adrljO1YwAZiXhQKLYqbogAAAZY"]
[Sun Apr 12 08:21:33.207106 2026] [:error] [pid 26600:tid 26638] [client 20.220.147.82:1822] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "adrlje1YwAZiXhQKLYqbpAAAAYk"]
[Sun Apr 12 08:21:33.617248 2026] [:error] [pid 26567:tid 26579] [client 20.220.147.82:1888] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sx.php"] [unique_id "adrljXhRpg6ptWFyFx0r2AAAAQo"]
[Sun Apr 12 08:21:34.035858 2026] [:error] [pid 60280:tid 60306] [client 20.220.147.82:1890] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrljnBlLnDOYuIykkgiLwAAAdg"]
[Sun Apr 12 08:21:34.448801 2026] [:error] [pid 60280:tid 60293] [client 20.220.147.82:1818] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrljnBlLnDOYuIykkgiMQAAAcs"]
[Sun Apr 12 08:21:34.860138 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1882] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrlju1YwAZiXhQKLYqbrAAAAZI"]
[Sun Apr 12 08:21:35.270893 2026] [:error] [pid 26600:tid 26633] [client 20.220.147.82:1919] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrlj-1YwAZiXhQKLYqbrQAAAYQ"]
[Sun Apr 12 08:21:35.686097 2026] [:error] [pid 26567:tid 26582] [client 20.220.147.82:1891] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "adrlj3hRpg6ptWFyFx0r3QAAAQ0"]
[Sun Apr 12 08:21:36.095734 2026] [:error] [pid 60280:tid 60283] [client 20.220.147.82:1745] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "adrlkHBlLnDOYuIykkgiMwAAAcE"]
[Sun Apr 12 08:21:36.506060 2026] [:error] [pid 26567:tid 26577] [client 20.220.147.82:1954] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "adrlkHhRpg6ptWFyFx0r4wAAAQg"]
[Sun Apr 12 08:21:36.914702 2026] [:error] [pid 25328:tid 25383] [client 20.220.147.82:1837] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa.php"] [unique_id "adrlkMxUaQZxT-e0YsAiZQAAAE0"]
[Sun Apr 12 08:21:37.324990 2026] [:error] [pid 25329:tid 25384] [client 20.220.147.82:1870] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adrlkWdcIYsS8Iyaj11dxAAAAIU"]
[Sun Apr 12 08:21:37.734859 2026] [:error] [pid 25437:tid 25450] [client 20.220.147.82:1737] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adrlkXf97wYZje1ep_N9OgAAAMs"]
[Sun Apr 12 08:21:38.147728 2026] [:error] [pid 26599:tid 26615] [client 20.220.147.82:1911] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adrlknG89LXoQbk_rwByEgAAAU0"]
[Sun Apr 12 08:21:38.559694 2026] [:error] [pid 25437:tid 25445] [client 20.220.147.82:2005] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/1.php"] [unique_id "adrlknf97wYZje1ep_N9PQAAAMY"]
[Sun Apr 12 08:21:38.969184 2026] [:error] [pid 26600:tid 26633] [client 20.220.147.82:1887] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrlku1YwAZiXhQKLYqb2QAAAYQ"]
[Sun Apr 12 08:21:39.383820 2026] [:error] [pid 26600:tid 26649] [client 20.220.147.82:1977] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrlk-1YwAZiXhQKLYqb3QAAAZQ"]
[Sun Apr 12 08:21:39.794766 2026] [:error] [pid 26600:tid 26637] [client 20.220.147.82:1792] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrlk-1YwAZiXhQKLYqb3wAAAYg"]
[Sun Apr 12 08:21:40.206570 2026] [:error] [pid 26599:tid 26618] [client 20.220.147.82:1801] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrllHG89LXoQbk_rwByFgAAAVA"]
[Sun Apr 12 08:21:40.630384 2026] [:error] [pid 26600:tid 26635] [client 20.220.147.82:1900] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "adrllO1YwAZiXhQKLYqb6QAAAYY"]
[Sun Apr 12 08:21:41.055907 2026] [:error] [pid 26600:tid 26637] [client 20.220.147.82:1987] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "adrlle1YwAZiXhQKLYqb7QAAAYg"]
[Sun Apr 12 08:21:41.465621 2026] [:error] [pid 25327:tid 25354] [client 20.220.147.82:1878] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "adrllS6h2tZEVJo9JFJmCwAAABI"]
[Sun Apr 12 08:21:41.877134 2026] [:error] [pid 25328:tid 25379] [client 20.220.147.82:1810] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trackback.php"] [unique_id "adrllcxUaQZxT-e0YsAiaAAAAEs"]
[Sun Apr 12 08:21:42.286984 2026] [:error] [pid 26599:tid 26612] [client 20.220.147.82:1879] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adrllnG89LXoQbk_rwByGgAAAUo"]
[Sun Apr 12 08:21:42.701482 2026] [:error] [pid 25328:tid 25401] [client 20.220.147.82:1912] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adrllsxUaQZxT-e0YsAibQAAAFU"]
[Sun Apr 12 08:21:43.113537 2026] [:error] [pid 26600:tid 26631] [client 20.220.147.82:1414] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adrll-1YwAZiXhQKLYqb8AAAAYI"]
[Sun Apr 12 08:21:43.522736 2026] [:error] [pid 25327:tid 25351] [client 20.220.147.82:1901] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/index.php"] [unique_id "adrlly6h2tZEVJo9JFJmDwAAAA8"]
[Sun Apr 12 08:21:43.932101 2026] [:error] [pid 25328:tid 25398] [client 20.220.147.82:1899] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adrll8xUaQZxT-e0YsAidAAAAFQ"]
[Sun Apr 12 08:21:44.342696 2026] [:error] [pid 25327:tid 25337] [client 20.220.147.82:1754] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adrlmC6h2tZEVJo9JFJmEAAAAAE"]
[Sun Apr 12 08:21:44.758015 2026] [:error] [pid 25327:tid 25353] [client 20.220.147.82:1825] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adrlmC6h2tZEVJo9JFJmEQAAABE"]
[Sun Apr 12 08:21:45.168966 2026] [:error] [pid 25327:tid 25343] [client 20.220.147.82:1808] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adrlmS6h2tZEVJo9JFJmFgAAAAc"]
[Sun Apr 12 08:21:45.582335 2026] [:error] [pid 25329:tid 25388] [client 20.220.147.82:1833] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "adrlmWdcIYsS8Iyaj11dxwAAAIc"]
[Sun Apr 12 08:21:45.992875 2026] [:error] [pid 25328:tid 25364] [client 20.220.147.82:1800] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "adrlmcxUaQZxT-e0YsAidgAAAEA"]
[Sun Apr 12 08:21:46.406114 2026] [:error] [pid 25328:tid 25379] [client 20.220.147.82:2044] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "adrlmsxUaQZxT-e0YsAiegAAAEs"]
[Sun Apr 12 08:21:46.835664 2026] [:error] [pid 25327:tid 25347] [client 20.220.147.82:1893] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/about.php"] [unique_id "adrlmi6h2tZEVJo9JFJmGgAAAAs"]
[Sun Apr 12 08:21:47.253735 2026] [:error] [pid 25328:tid 25366] [client 20.220.147.82:1824] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "adrlm8xUaQZxT-e0YsAifgAAAEI"]
[Sun Apr 12 08:21:47.665918 2026] [:error] [pid 25437:tid 25458] [client 20.220.147.82:1736] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "adrlm3f97wYZje1ep_N9QAAAANM"]
[Sun Apr 12 08:21:48.093687 2026] [:error] [pid 25329:tid 25392] [client 20.220.147.82:1431] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "adrlnGdcIYsS8Iyaj11dyQAAAIk"]
[Sun Apr 12 08:21:48.505288 2026] [:error] [pid 60280:tid 60290] [client 20.220.147.82:1812] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gmo.php"] [unique_id "adrlnHBlLnDOYuIykkgiRAAAAcg"]
[Sun Apr 12 08:21:48.915067 2026] [:error] [pid 25329:tid 25399] [client 20.220.147.82:1983] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adrlnGdcIYsS8Iyaj11dygAAAI0"]
[Sun Apr 12 08:21:49.326813 2026] [:error] [pid 26599:tid 26604] [client 20.220.147.82:1833] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "adrlnXG89LXoQbk_rwByLgAAAUI"]
[Sun Apr 12 08:21:49.737585 2026] [:error] [pid 25327:tid 25342] [client 20.220.147.82:1848] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "adrlnS6h2tZEVJo9JFJmHAAAAAY"]
[Sun Apr 12 08:21:50.160826 2026] [:error] [pid 25328:tid 25369] [client 20.220.147.82:1817] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "adrlnsxUaQZxT-e0YsAigAAAAEU"]
[Sun Apr 12 08:21:50.579483 2026] [:error] [pid 60280:tid 60293] [client 20.220.147.82:1909] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/index.php"] [unique_id "adrlnnBlLnDOYuIykkgiRgAAAcs"]
[Sun Apr 12 08:21:50.999580 2026] [:error] [pid 25329:tid 25400] [client 20.220.147.82:2011] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "adrlnmdcIYsS8Iyaj11dzQAAAI4"]
[Sun Apr 12 08:21:51.410714 2026] [:error] [pid 26600:tid 26640] [client 20.220.147.82:1852] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "adrln-1YwAZiXhQKLYqb_wAAAYs"]
[Sun Apr 12 08:21:51.819799 2026] [:error] [pid 26600:tid 26636] [client 20.220.147.82:1973] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "adrln-1YwAZiXhQKLYqcAgAAAYc"]
[Sun Apr 12 08:21:52.231244 2026] [:error] [pid 26600:tid 26641] [client 20.220.147.82:1910] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "adrloO1YwAZiXhQKLYqcBgAAAYw"]
[Sun Apr 12 08:21:52.652194 2026] [:error] [pid 26600:tid 26640] [client 20.220.147.82:1844] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adrloO1YwAZiXhQKLYqcCgAAAYs"]
[Sun Apr 12 08:21:53.075201 2026] [:error] [pid 26599:tid 26608] [client 20.220.147.82:1819] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adrloXG89LXoQbk_rwByNAAAAUY"]
[Sun Apr 12 08:21:53.488851 2026] [:error] [pid 25437:tid 25443] [client 20.220.147.82:1799] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adrloXf97wYZje1ep_N9SAAAAMQ"]
[Sun Apr 12 08:21:53.901349 2026] [:error] [pid 26599:tid 26609] [client 20.220.147.82:1820] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adrloXG89LXoQbk_rwByNgAAAUc"]
[Sun Apr 12 08:21:54.324522 2026] [:error] [pid 26600:tid 26642] [client 20.220.147.82:1806] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adrlou1YwAZiXhQKLYqcFgAAAY0"]
[Sun Apr 12 08:21:54.732514 2026] [:error] [pid 25328:tid 25379] [client 20.220.147.82:1903] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adrlosxUaQZxT-e0YsAihwAAAEs"]
[Sun Apr 12 08:21:55.141135 2026] [:error] [pid 25328:tid 25372] [client 20.220.147.82:1918] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adrlo8xUaQZxT-e0YsAiiAAAAEc"]
[Sun Apr 12 08:21:55.550651 2026] [:error] [pid 25327:tid 25337] [client 20.220.147.82:1759] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adrloy6h2tZEVJo9JFJmJQAAAAE"]
[Sun Apr 12 08:21:55.975139 2026] [:error] [pid 25329:tid 25382] [client 20.220.147.82:1794] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "adrlo2dcIYsS8Iyaj11dzwAAAIQ"]
[Sun Apr 12 08:21:56.386215 2026] [:error] [pid 26599:tid 26607] [client 20.220.147.82:1855] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "adrlpHG89LXoQbk_rwByOQAAAUU"]
[Sun Apr 12 08:21:56.795095 2026] [:error] [pid 26599:tid 26622] [client 20.220.147.82:1983] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "adrlpHG89LXoQbk_rwByPQAAAVQ"]
[Sun Apr 12 08:21:57.209108 2026] [:error] [pid 25327:tid 25344] [client 20.220.147.82:1847] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/index/function.php"] [unique_id "adrlpS6h2tZEVJo9JFJmKgAAAAg"]
[Sun Apr 12 08:21:57.630594 2026] [:error] [pid 26600:tid 26650] [client 20.220.147.82:1849] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "adrlpe1YwAZiXhQKLYqcHAAAAZU"]
[Sun Apr 12 08:21:58.047084 2026] [:error] [pid 26600:tid 26645] [client 20.220.147.82:1751] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "adrlpu1YwAZiXhQKLYqcHgAAAZA"]
[Sun Apr 12 08:21:58.459333 2026] [:error] [pid 25328:tid 25385] [client 20.220.147.82:1757] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "adrlpsxUaQZxT-e0YsAiigAAAE4"]
[Sun Apr 12 08:21:58.879074 2026] [:error] [pid 25329:tid 25374] [client 20.220.147.82:1906] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "adrlpmdcIYsS8Iyaj11d0gAAAIA"]
[Sun Apr 12 08:21:59.292541 2026] [:error] [pid 25329:tid 25415] [client 20.220.147.82:1832] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "adrlp2dcIYsS8Iyaj11d0wAAAJg"]
[Sun Apr 12 08:21:59.703639 2026] [:error] [pid 26567:tid 26571] [client 20.220.147.82:1777] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "adrlp3hRpg6ptWFyFx0r-wAAAQI"]
[Sun Apr 12 08:22:00.116428 2026] [:error] [pid 25328:tid 25370] [client 20.220.147.82:1814] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "adrlqMxUaQZxT-e0YsAijQAAAEY"]
[Sun Apr 12 08:22:00.552612 2026] [:error] [pid 25327:tid 25342] [client 20.220.147.82:1830] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "adrlqC6h2tZEVJo9JFJmLgAAAAY"]
[Sun Apr 12 08:22:00.964552 2026] [:error] [pid 25327:tid 25352] [client 20.220.147.82:1785] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ww1.php"] [unique_id "adrlqC6h2tZEVJo9JFJmMgAAABA"]
[Sun Apr 12 08:22:01.377267 2026] [:error] [pid 26599:tid 26606] [client 20.220.147.82:1842] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "adrlqXG89LXoQbk_rwByTgAAAUQ"]
[Sun Apr 12 08:22:01.788818 2026] [:error] [pid 26599:tid 26623] [client 20.220.147.82:1950] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "adrlqXG89LXoQbk_rwByUAAAAVU"]
[Sun Apr 12 08:22:02.221393 2026] [:error] [pid 26599:tid 26603] [client 20.220.147.82:1907] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "adrlqnG89LXoQbk_rwByUwAAAUE"]
[Sun Apr 12 08:22:02.632948 2026] [:error] [pid 25327:tid 25344] [client 20.220.147.82:1850] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about/function.php"] [unique_id "adrlqi6h2tZEVJo9JFJmOgAAAAg"]
[Sun Apr 12 08:22:03.045785 2026] [:error] [pid 25329:tid 25399] [client 20.220.147.82:2007] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "adrlq2dcIYsS8Iyaj11d2AAAAI0"]
[Sun Apr 12 08:22:03.457334 2026] [:error] [pid 25329:tid 25409] [client 20.220.147.82:1807] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "adrlq2dcIYsS8Iyaj11d2gAAAJM"]
[Sun Apr 12 08:22:03.866878 2026] [:error] [pid 60280:tid 60291] [client 20.220.147.82:1421] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "adrlq3BlLnDOYuIykkgiTQAAAck"]
[Sun Apr 12 08:22:04.275527 2026] [:error] [pid 60280:tid 60297] [client 20.220.147.82:1813] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin/function.php"] [unique_id "adrlrHBlLnDOYuIykkgiTgAAAc8"]
[Sun Apr 12 08:22:04.700316 2026] [:error] [pid 26600:tid 26648] [client 20.220.147.82:1764] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "adrlrO1YwAZiXhQKLYqcJAAAAZM"]
[Sun Apr 12 08:22:05.128325 2026] [:error] [pid 26600:tid 26635] [client 20.220.147.82:1797] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "adrlre1YwAZiXhQKLYqcKAAAAYY"]
[Sun Apr 12 08:22:05.572616 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1798] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "adrlre1YwAZiXhQKLYqcKwAAAZI"]
[Sun Apr 12 08:22:06.001246 2026] [:error] [pid 26600:tid 26634] [client 20.220.147.82:1955] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "adrlru1YwAZiXhQKLYqcLQAAAYU"]
[Sun Apr 12 08:22:06.410615 2026] [:error] [pid 26600:tid 26645] [client 20.220.147.82:1993] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "adrlru1YwAZiXhQKLYqcMQAAAZA"]
[Sun Apr 12 08:22:06.819838 2026] [:error] [pid 25329:tid 25404] [client 20.220.147.82:1815] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "adrlrmdcIYsS8Iyaj11d6AAAAJA"]
[Sun Apr 12 08:22:07.229399 2026] [:error] [pid 25328:tid 25394] [client 20.220.147.82:1752] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "adrlr8xUaQZxT-e0YsAilAAAAFI"]
[Sun Apr 12 08:22:07.645543 2026] [:error] [pid 26600:tid 26652] [client 20.220.147.82:1967] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "adrlr-1YwAZiXhQKLYqcNAAAAZc"]
[Sun Apr 12 08:22:08.057006 2026] [:error] [pid 26567:tid 26573] [client 20.220.147.82:1840] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "adrlsHhRpg6ptWFyFx0sAQAAAQQ"]
[Sun Apr 12 08:22:08.466766 2026] [:error] [pid 60280:tid 60290] [client 20.220.147.82:1783] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "adrlsHBlLnDOYuIykkgiVAAAAcg"]
[Sun Apr 12 08:22:08.883126 2026] [:error] [pid 25327:tid 25353] [client 20.220.147.82:1805] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "adrlsC6h2tZEVJo9JFJmRgAAABE"]
[Sun Apr 12 08:22:09.293005 2026] [:error] [pid 25327:tid 25350] [client 20.220.147.82:1804] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/security.php"] [unique_id "adrlsS6h2tZEVJo9JFJmSgAAAA4"]
[Sun Apr 12 08:22:09.703577 2026] [:error] [pid 25327:tid 25345] [client 20.220.147.82:1780] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "adrlsS6h2tZEVJo9JFJmUAAAAAk"]
[Sun Apr 12 08:22:10.112718 2026] [:error] [pid 26599:tid 26625] [client 20.220.147.82:1838] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "adrlsnG89LXoQbk_rwByYQAAAVc"]
[Sun Apr 12 08:22:10.524272 2026] [:error] [pid 26600:tid 26646] [client 20.220.147.82:2044] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "adrlsu1YwAZiXhQKLYqcPgAAAZE"]
[Sun Apr 12 08:22:10.934794 2026] [:error] [pid 26567:tid 26586] [client 20.220.147.82:1455] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "adrlsnhRpg6ptWFyFx0sBAAAARE"]
[Sun Apr 12 08:22:11.370009 2026] [:error] [pid 26600:tid 26651] [client 20.220.147.82:1905] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "adrls-1YwAZiXhQKLYqcRAAAAZY"]
[Sun Apr 12 08:22:11.785317 2026] [:error] [pid 26600:tid 26638] [client 20.220.147.82:1746] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "adrls-1YwAZiXhQKLYqcSAAAAYk"]
[Sun Apr 12 08:22:12.195437 2026] [:error] [pid 26600:tid 26644] [client 20.220.147.82:1738] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "adrltO1YwAZiXhQKLYqcTAAAAY8"]
[Sun Apr 12 08:22:12.609131 2026] [:error] [pid 25327:tid 25349] [client 20.220.147.82:1756] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "adrltC6h2tZEVJo9JFJmVwAAAA0"]
[Sun Apr 12 08:22:13.019863 2026] [:error] [pid 25327:tid 25350] [client 20.220.147.82:1884] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "adrltS6h2tZEVJo9JFJmXAAAAA4"]
[Sun Apr 12 08:22:13.430207 2026] [:error] [pid 26600:tid 26638] [client 20.220.147.82:1741] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "adrlte1YwAZiXhQKLYqcVgAAAYk"]
[Sun Apr 12 08:22:13.857489 2026] [:error] [pid 25327:tid 25342] [client 20.220.147.82:1750] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "adrltS6h2tZEVJo9JFJmYQAAAAY"]
[Sun Apr 12 08:22:14.274567 2026] [:error] [pid 25327:tid 25341] [client 20.220.147.82:1897] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "adrlti6h2tZEVJo9JFJmZQAAAAU"]
[Sun Apr 12 08:22:14.690120 2026] [:error] [pid 60280:tid 60302] [client 20.220.147.82:1758] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adrltnBlLnDOYuIykkgiWgAAAdQ"]
[Sun Apr 12 08:22:15.117346 2026] [:error] [pid 60280:tid 60298] [client 20.220.147.82:1769] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adrlt3BlLnDOYuIykkgiWwAAAdA"]
[Sun Apr 12 08:22:15.558164 2026] [:error] [pid 25328:tid 25367] [client 20.220.147.82:1739] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adrlt8xUaQZxT-e0YsAinwAAAEM"]
[Sun Apr 12 08:22:15.973144 2026] [:error] [pid 25327:tid 25351] [client 20.220.147.82:1422] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adrlty6h2tZEVJo9JFJmawAAAA8"]
[Sun Apr 12 08:22:16.391932 2026] [:error] [pid 26600:tid 26644] [client 20.220.147.82:1729] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/radio.php"] [unique_id "adrluO1YwAZiXhQKLYqcaQAAAY8"]
[Sun Apr 12 08:22:16.815178 2026] [:error] [pid 26600:tid 26653] [client 20.220.147.82:1776] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adrluO1YwAZiXhQKLYqcbAAAAZg"]
[Sun Apr 12 08:22:17.231120 2026] [:error] [pid 25329:tid 25386] [client 20.220.147.82:1846] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adrluWdcIYsS8Iyaj11d8AAAAIY"]
[Sun Apr 12 08:22:17.691854 2026] [:error] [pid 25327:tid 25347] [client 20.220.147.82:1914] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adrluS6h2tZEVJo9JFJmfAAAAAs"]
[Sun Apr 12 08:22:18.110567 2026] [:error] [pid 25327:tid 25337] [client 20.220.147.82:2016] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adrlui6h2tZEVJo9JFJmgwAAAAE"]
[Sun Apr 12 08:22:18.524638 2026] [:error] [pid 26600:tid 26634] [client 20.220.147.82:1811] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adrluu1YwAZiXhQKLYqccgAAAYU"]
[Sun Apr 12 08:22:18.934649 2026] [:error] [pid 25327:tid 25344] [client 20.220.147.82:1828] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adrlui6h2tZEVJo9JFJmjwAAAAg"]
[Sun Apr 12 08:22:19.343995 2026] [:error] [pid 25327:tid 25349] [client 20.220.147.82:1728] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adrluy6h2tZEVJo9JFJmmAAAAA0"]
[Sun Apr 12 08:22:19.767624 2026] [:error] [pid 26600:tid 26645] [client 20.220.147.82:1779] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.well-known/admin.php"] [unique_id "adrlu-1YwAZiXhQKLYqcdQAAAZA"]
[Sun Apr 12 08:22:20.201909 2026] [:error] [pid 60280:tid 60294] [client 20.220.147.82:1841] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adrlvHBlLnDOYuIykkgiYAAAAcw"]
[Sun Apr 12 08:22:20.644632 2026] [:error] [pid 25437:tid 25455] [client 20.220.147.82:1845] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adrlvHf97wYZje1ep_N9TwAAANA"]
[Sun Apr 12 08:22:21.059935 2026] [:error] [pid 60280:tid 60283] [client 20.220.147.82:1775] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adrlvXBlLnDOYuIykkgiYwAAAcE"]
[Sun Apr 12 08:22:21.490080 2026] [:error] [pid 25327:tid 25343] [client 20.220.147.82:1735] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adrlvS6h2tZEVJo9JFJmngAAAAc"]
[Sun Apr 12 08:22:21.936521 2026] [:error] [pid 25437:tid 25458] [client 20.220.147.82:1755] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "adrlvXf97wYZje1ep_N9UAAAANM"]
[Sun Apr 12 08:22:23.034755 2026] [:error] [pid 25328:tid 25408] [client 20.220.147.82:1740] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Apr 12 08:22:23.242343 2026] [:error] [pid 25328:tid 25372] [client 20.220.147.82:1740] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Sun Apr 12 08:22:23.447439 2026] [:error] [pid 25328:tid 25385] [client 20.220.147.82:1740] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adrlv8xUaQZxT-e0YsAiqwAAAE4"]
[Sun Apr 12 08:22:23.858744 2026] [:error] [pid 25437:tid 25444] [client 20.220.147.82:1827] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "adrlv3f97wYZje1ep_N9UwAAAMU"]
[Sun Apr 12 08:22:24.274968 2026] [:error] [pid 25328:tid 25396] [client 20.220.147.82:1411] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Apr 12 08:22:24.482345 2026] [:error] [pid 25328:tid 25370] [client 20.220.147.82:1411] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Apr 12 08:22:24.691397 2026] [:error] [pid 25328:tid 25398] [client 20.220.147.82:1411] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Sun Apr 12 08:22:24.900211 2026] [:error] [pid 25328:tid 25367] [client 20.220.147.82:1411] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Sun Apr 12 08:22:25.109460 2026] [:error] [pid 25328:tid 25369] [client 20.220.147.82:1411] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sun Apr 12 08:22:25.321063 2026] [:error] [pid 25328:tid 25375] [client 20.220.147.82:1411] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sun Apr 12 08:22:25.528617 2026] [:error] [pid 25328:tid 25394] [client 20.220.147.82:1411] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "adrlwcxUaQZxT-e0YsAitgAAAFI"]
[Sun Apr 12 08:22:25.988869 2026] [:error] [pid 26599:tid 26618] [client 20.220.147.82:1761] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "adrlwXG89LXoQbk_rwBygQAAAVA"]
[Sun Apr 12 08:22:26.404202 2026] [:error] [pid 26599:tid 26622] [client 20.220.147.82:1743] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "adrlwnG89LXoQbk_rwByggAAAVQ"]
[Sun Apr 12 08:22:26.830278 2026] [:error] [pid 25329:tid 25378] [client 20.220.147.82:1853] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we2.php"] [unique_id "adrlwmdcIYsS8Iyaj11d_wAAAII"]
[Sun Apr 12 08:22:27.248849 2026] [:error] [pid 26600:tid 26634] [client 20.220.147.82:1451] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "adrlw-1YwAZiXhQKLYqcgAAAAYU"]
[Sun Apr 12 08:22:27.665329 2026] [:error] [pid 26599:tid 26610] [client 20.220.147.82:1793] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "adrlw3G89LXoQbk_rwByhwAAAUg"]
[Sun Apr 12 08:22:28.125003 2026] [:error] [pid 60280:tid 60304] [client 20.220.147.82:1744] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "adrlxHBlLnDOYuIykkgidAAAAdY"]
[Sun Apr 12 08:22:28.536136 2026] [:error] [pid 25328:tid 25365] [client 20.220.147.82:1734] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/04.php"] [unique_id "adrlxMxUaQZxT-e0YsAivwAAAEE"]
[Sun Apr 12 08:22:29.012411 2026] [:error] [pid 25328:tid 25364] [client 20.220.147.82:1430] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adrlxcxUaQZxT-e0YsAixAAAAEA"]
[Sun Apr 12 08:22:29.456610 2026] [:error] [pid 26567:tid 26582] [client 20.220.147.82:2027] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adrlxXhRpg6ptWFyFx0sHQAAAQ0"]
[Sun Apr 12 08:22:29.876116 2026] [:error] [pid 26567:tid 26573] [client 20.220.147.82:1778] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adrlxXhRpg6ptWFyFx0sIAAAAQQ"]
[Sun Apr 12 08:22:30.354165 2026] [:error] [pid 26599:tid 26608] [client 20.220.147.82:1409] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adrlxnG89LXoQbk_rwByjAAAAUY"]
[Sun Apr 12 08:22:30.775405 2026] [:error] [pid 26567:tid 26583] [client 20.220.147.82:1790] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "adrlxnhRpg6ptWFyFx0sJAAAAQ4"]
[Sun Apr 12 08:22:31.251106 2026] [:error] [pid 26567:tid 26593] [client 20.220.147.82:1445] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "adrlx3hRpg6ptWFyFx0sJgAAARg"]
[Sun Apr 12 08:22:31.693320 2026] [:error] [pid 26599:tid 26609] [client 20.220.147.82:1790] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "adrlx3G89LXoQbk_rwBykQAAAUc"]
[Sun Apr 12 08:22:32.103350 2026] [:error] [pid 26599:tid 26605] [client 20.220.147.82:1749] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/520.php"] [unique_id "adrlyHG89LXoQbk_rwBykgAAAUM"]
[Sun Apr 12 08:22:32.555181 2026] [:error] [pid 60280:tid 60285] [client 20.220.147.82:1436] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "adrlyHBlLnDOYuIykkgieQAAAcM"]
[Sun Apr 12 08:22:33.032984 2026] [:error] [pid 25437:tid 25446] [client 20.220.147.82:1872] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "adrlyXf97wYZje1ep_N9ZQAAAMc"]
[Sun Apr 12 08:22:33.490599 2026] [:error] [pid 25327:tid 25336] [client 20.220.147.82:1428] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "adrlyS6h2tZEVJo9JFJmvAAAAAA"]
[Sun Apr 12 08:22:33.910060 2026] [:error] [pid 60280:tid 60297] [client 20.220.147.82:1671] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ar.php"] [unique_id "adrlyXBlLnDOYuIykkgifQAAAc8"]
[Sun Apr 12 08:22:34.329528 2026] [:error] [pid 60280:tid 60289] [client 20.220.147.82:1730] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "adrlynBlLnDOYuIykkgiggAAAcc"]
[Sun Apr 12 08:22:34.754514 2026] [:error] [pid 25327:tid 25357] [client 20.220.147.82:1742] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "adrlyi6h2tZEVJo9JFJmvwAAABU"]
[Sun Apr 12 08:22:35.172186 2026] [:error] [pid 25437:tid 25447] [client 20.220.147.82:1453] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "adrly3f97wYZje1ep_N9awAAAMg"]
[Sun Apr 12 08:22:35.590140 2026] [:error] [pid 60280:tid 60301] [client 20.220.147.82:1781] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x.php"] [unique_id "adrly3BlLnDOYuIykkgiiAAAAdM"]
[Sun Apr 12 08:22:36.003793 2026] [:error] [pid 25328:tid 25369] [client 20.220.147.82:1441] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adrlzMxUaQZxT-e0YsAi0wAAAEU"]
[Sun Apr 12 08:22:36.413271 2026] [:error] [pid 25437:tid 25458] [client 20.220.147.82:1681] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adrlzHf97wYZje1ep_N9bwAAANM"]
[Sun Apr 12 08:22:36.823560 2026] [:error] [pid 26567:tid 26593] [client 20.220.147.82:1444] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adrlzHhRpg6ptWFyFx0sOQAAARg"]
[Sun Apr 12 08:22:37.268972 2026] [:error] [pid 25329:tid 25400] [client 20.220.147.82:1786] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adrlzWdcIYsS8Iyaj11eCQAAAI4"]
[Sun Apr 12 08:22:37.679880 2026] [:error] [pid 25328:tid 25391] [client 20.220.147.82:1439] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "adrlzcxUaQZxT-e0YsAi1wAAAFE"]
[Sun Apr 12 08:22:38.090695 2026] [:error] [pid 25327:tid 25341] [client 20.220.147.82:1429] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "adrlzi6h2tZEVJo9JFJmygAAAAU"]
[Sun Apr 12 08:22:38.503671 2026] [:error] [pid 25327:tid 25352] [client 20.220.147.82:1417] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "adrlzi6h2tZEVJo9JFJm0AAAABA"]
[Sun Apr 12 08:22:38.922379 2026] [:error] [pid 25327:tid 25359] [client 20.220.147.82:1768] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass4.php"] [unique_id "adrlzi6h2tZEVJo9JFJm1gAAABc"]
[Sun Apr 12 08:22:39.335095 2026] [:error] [pid 26567:tid 26575] [client 20.220.147.82:1415] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "adrlz3hRpg6ptWFyFx0sQQAAAQY"]
[Sun Apr 12 08:22:39.743519 2026] [:error] [pid 25328:tid 25369] [client 20.220.147.82:1789] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "adrlz8xUaQZxT-e0YsAi5AAAAEU"]
[Sun Apr 12 08:22:40.163057 2026] [:error] [pid 60280:tid 60298] [client 20.220.147.82:1854] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "adrl0HBlLnDOYuIykkgikQAAAdA"]
[Sun Apr 12 08:22:40.605563 2026] [:error] [pid 25328:tid 25375] [client 20.220.147.82:1435] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2clas.php"] [unique_id "adrl0MxUaQZxT-e0YsAi5wAAAEk"]
[Sun Apr 12 08:22:41.029991 2026] [:error] [pid 26600:tid 26632] [client 20.220.147.82:1463] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "adrl0e1YwAZiXhQKLYqciQAAAYM"]
[Sun Apr 12 08:22:41.457927 2026] [:error] [pid 26600:tid 26635] [client 20.220.147.82:1447] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "adrl0e1YwAZiXhQKLYqcjAAAAYY"]
[Sun Apr 12 08:22:41.896641 2026] [:error] [pid 26567:tid 26570] [client 20.220.147.82:1784] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "adrl0XhRpg6ptWFyFx0sRwAAAQE"]
[Sun Apr 12 08:22:42.308622 2026] [:error] [pid 26600:tid 26636] [client 20.220.147.82:1447] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ave.php"] [unique_id "adrl0u1YwAZiXhQKLYqclAAAAYc"]
[Sun Apr 12 08:22:42.739539 2026] [:error] [pid 25328:tid 25368] [client 20.220.147.82:1791] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "adrl0sxUaQZxT-e0YsAi7QAAAEQ"]
[Sun Apr 12 08:22:43.170301 2026] [:error] [pid 25329:tid 25386] [client 20.220.147.82:1748] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "adrl02dcIYsS8Iyaj11eDwAAAIY"]
[Sun Apr 12 08:22:43.624640 2026] [:error] [pid 25437:tid 25463] [client 20.220.147.82:1770] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "adrl03f97wYZje1ep_N9cwAAANg"]
[Sun Apr 12 08:22:44.050137 2026] [:error] [pid 26599:tid 26606] [client 20.220.147.82:1419] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wrt.php"] [unique_id "adrl1HG89LXoQbk_rwBypwAAAUQ"]
[Sun Apr 12 08:22:44.477183 2026] [:error] [pid 25327:tid 25359] [client 20.220.147.82:1763] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "adrl1C6h2tZEVJo9JFJm5AAAABc"]
[Sun Apr 12 08:22:44.899459 2026] [:error] [pid 25327:tid 25358] [client 20.220.147.82:1831] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "adrl1C6h2tZEVJo9JFJm6gAAABY"]
[Sun Apr 12 08:22:45.311828 2026] [:error] [pid 25328:tid 25396] [client 20.220.147.82:1446] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "adrl1cxUaQZxT-e0YsAi8QAAAFM"]
[Sun Apr 12 08:22:45.722517 2026] [:error] [pid 25329:tid 25388] [client 20.220.147.82:1765] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bibil.php"] [unique_id "adrl1WdcIYsS8Iyaj11eFAAAAIc"]
[Sun Apr 12 08:22:46.136740 2026] [:error] [pid 25327:tid 25336] [client 20.220.147.82:1408] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "adrl1i6h2tZEVJo9JFJm7gAAAAA"]
[Sun Apr 12 08:22:46.567178 2026] [:error] [pid 26599:tid 26612] [client 20.220.147.82:1425] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "adrl1nG89LXoQbk_rwByqAAAAUo"]
[Sun Apr 12 08:22:47.002718 2026] [:error] [pid 26599:tid 26604] [client 20.220.147.82:1443] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "adrl13G89LXoQbk_rwByrAAAAUI"]
[Sun Apr 12 08:22:47.417454 2026] [:error] [pid 26567:tid 26571] [client 20.220.147.82:1469] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/radio.php"] [unique_id "adrl13hRpg6ptWFyFx0sSwAAAQI"]
[Sun Apr 12 08:22:47.847078 2026] [:error] [pid 26567:tid 26579] [client 20.220.147.82:1678] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "adrl13hRpg6ptWFyFx0sTgAAAQo"]
[Sun Apr 12 08:22:48.280090 2026] [:error] [pid 26567:tid 26589] [client 20.220.147.82:1816] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "adrl2HhRpg6ptWFyFx0sUQAAARQ"]
[Sun Apr 12 08:22:48.704203 2026] [:error] [pid 26600:tid 26650] [client 20.220.147.82:1731] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "adrl2O1YwAZiXhQKLYqcoAAAAZU"]
[Sun Apr 12 08:22:49.151293 2026] [:error] [pid 26600:tid 26652] [client 20.220.147.82:1416] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/files.php"] [unique_id "adrl2e1YwAZiXhQKLYqcowAAAZc"]
[Sun Apr 12 08:22:49.563843 2026] [:error] [pid 26600:tid 26653] [client 20.220.147.82:1459] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "adrl2e1YwAZiXhQKLYqcpgAAAZg"]
[Sun Apr 12 08:22:50.032011 2026] [:error] [pid 25328:tid 25387] [client 20.220.147.82:1424] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "adrl2sxUaQZxT-e0YsAi-QAAAE8"]
[Sun Apr 12 08:22:50.478306 2026] [:error] [pid 60280:tid 60299] [client 20.220.147.82:1766] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "adrl2nBlLnDOYuIykkgiqQAAAdE"]
[Sun Apr 12 08:22:51.102131 2026] [:error] [pid 25327:tid 25346] [client 20.220.147.82:1732] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file7.php"] [unique_id "adrl2y6h2tZEVJo9JFJm8wAAAAo"]
[Sun Apr 12 08:22:51.515739 2026] [:error] [pid 60280:tid 60306] [client 20.220.147.82:1468] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adrl23BlLnDOYuIykkgisAAAAdg"]
[Sun Apr 12 08:22:51.950039 2026] [:error] [pid 26567:tid 26583] [client 20.220.147.82:1834] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adrl23hRpg6ptWFyFx0sVQAAAQ4"]
[Sun Apr 12 08:22:52.442472 2026] [:error] [pid 26600:tid 26642] [client 20.220.147.82:1773] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adrl3O1YwAZiXhQKLYqcsQAAAY0"]
[Sun Apr 12 08:22:52.885935 2026] [:error] [pid 25327:tid 25340] [client 20.220.147.82:1767] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gifclass.php"] [unique_id "adrl3C6h2tZEVJo9JFJm9QAAAAQ"]
[Sun Apr 12 08:22:53.330507 2026] [:error] [pid 25328:tid 25401] [client 20.220.147.82:1948] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "adrl3cxUaQZxT-e0YsAjAQAAAFU"]
[Sun Apr 12 08:22:53.771515 2026] [:error] [pid 26600:tid 26638] [client 20.220.147.82:1687] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "adrl3e1YwAZiXhQKLYqctwAAAYk"]
[Sun Apr 12 08:22:54.206591 2026] [:error] [pid 25328:tid 25373] [client 20.220.147.82:1707] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "adrl3sxUaQZxT-e0YsAjAwAAAEg"]
[Sun Apr 12 08:22:54.622210 2026] [:error] [pid 25328:tid 25391] [client 20.220.147.82:1673] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "adrl3sxUaQZxT-e0YsAjBgAAAFE"]
[Sun Apr 12 08:22:55.099577 2026] [:error] [pid 25328:tid 25383] [client 20.220.147.82:1665] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "adrl38xUaQZxT-e0YsAjCQAAAE0"]
[Sun Apr 12 08:22:55.547720 2026] [:error] [pid 60280:tid 60282] [client 20.220.147.82:1675] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "adrl33BlLnDOYuIykkgiswAAAcA"]
[Sun Apr 12 08:22:56.132890 2026] [:error] [pid 26567:tid 26579] [client 20.220.147.82:1667] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "adrl4HhRpg6ptWFyFx0sXAAAAQo"]
[Sun Apr 12 08:22:56.582587 2026] [:error] [pid 25327:tid 25337] [client 20.220.147.82:1733] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nox.php"] [unique_id "adrl4C6h2tZEVJo9JFJm_AAAAAE"]
[Sun Apr 12 08:22:57.049568 2026] [:error] [pid 25327:tid 25347] [client 20.220.147.82:1682] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adrl4S6h2tZEVJo9JFJm_gAAAAs"]
[Sun Apr 12 08:22:57.491477 2026] [:error] [pid 25327:tid 25340] [client 20.220.147.82:1615] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adrl4S6h2tZEVJo9JFJnAwAAAAQ"]
[Sun Apr 12 08:22:57.900865 2026] [:error] [pid 25327:tid 25358] [client 20.220.147.82:1695] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adrl4S6h2tZEVJo9JFJnBwAAABY"]
[Sun Apr 12 08:22:58.318118 2026] [:error] [pid 25328:tid 25396] [client 20.220.147.82:1427] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adrl4sxUaQZxT-e0YsAjEwAAAFM"]
[Sun Apr 12 08:22:58.757286 2026] [:error] [pid 25328:tid 25367] [client 20.220.147.82:1635] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "adrl4sxUaQZxT-e0YsAjFgAAAEM"]
[Sun Apr 12 08:22:59.279345 2026] [:error] [pid 25327:tid 25339] [client 20.220.147.82:1788] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "adrl4y6h2tZEVJo9JFJnCwAAAAM"]
[Sun Apr 12 08:22:59.796145 2026] [:error] [pid 25327:tid 25347] [client 20.220.147.82:1696] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "adrl4y6h2tZEVJo9JFJnEAAAAAs"]
[Sun Apr 12 08:23:00.975518 2026] [:error] [pid 25327:tid 25350] [client 20.220.147.82:1684] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/info.php"] [unique_id "adrl5C6h2tZEVJo9JFJnEwAAAA4"]
[Sun Apr 12 08:23:01.410027 2026] [:error] [pid 25328:tid 25379] [client 20.220.147.82:1471] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "adrl5cxUaQZxT-e0YsAjHQAAAEs"]
[Sun Apr 12 08:23:01.849426 2026] [:error] [pid 25327:tid 25357] [client 20.220.147.82:1721] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "adrl5S6h2tZEVJo9JFJnFwAAABU"]
[Sun Apr 12 08:23:02.350742 2026] [:error] [pid 25327:tid 25360] [client 20.220.147.82:1835] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "adrl5i6h2tZEVJo9JFJnGQAAABg"]
[Sun Apr 12 08:23:02.832523 2026] [:error] [pid 25327:tid 25354] [client 20.220.147.82:1456] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class9.php"] [unique_id "adrl5i6h2tZEVJo9JFJnGwAAABI"]
[Sun Apr 12 08:23:03.307290 2026] [:error] [pid 25437:tid 25451] [client 20.220.147.82:1787] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "adrl53f97wYZje1ep_N9jgAAAMw"]
[Sun Apr 12 08:23:03.723869 2026] [:error] [pid 25327:tid 25339] [client 20.220.147.82:1434] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "adrl5y6h2tZEVJo9JFJnHgAAAAM"]
[Sun Apr 12 08:23:04.137575 2026] [:error] [pid 25327:tid 25355] [client 20.220.147.82:1465] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "adrl6C6h2tZEVJo9JFJnIgAAABM"]
[Sun Apr 12 08:23:04.556068 2026] [:error] [pid 26599:tid 26622] [client 20.220.147.82:1772] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/la.php"] [unique_id "adrl6HG89LXoQbk_rwBytgAAAVQ"]
[Sun Apr 12 08:23:05.027773 2026] [:error] [pid 25328:tid 25408] [client 20.220.147.82:1410] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "adrl6cxUaQZxT-e0YsAjLgAAAFg"]
[Sun Apr 12 08:23:05.520128 2026] [:error] [pid 26567:tid 26582] [client 20.220.147.82:1686] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "adrl6XhRpg6ptWFyFx0sYAAAAQ0"]
[Sun Apr 12 08:23:06.068195 2026] [:error] [pid 26599:tid 26610] [client 20.220.147.82:1450] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "adrl6nG89LXoQbk_rwByuQAAAUg"]
[Sun Apr 12 08:23:06.477939 2026] [:error] [pid 26600:tid 26649] [client 20.220.147.82:1676] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless11.php"] [unique_id "adrl6u1YwAZiXhQKLYqcvwAAAZQ"]
[Sun Apr 12 08:23:06.910073 2026] [:error] [pid 25327:tid 25342] [client 20.220.147.82:1461] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "adrl6i6h2tZEVJo9JFJnKwAAAAY"]
[Sun Apr 12 08:23:07.363871 2026] [:error] [pid 25327:tid 25337] [client 20.220.147.82:1894] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "adrl6y6h2tZEVJo9JFJnMgAAAAE"]
[Sun Apr 12 08:23:07.885666 2026] [:error] [pid 25327:tid 25358] [client 20.220.147.82:1753] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "adrl6y6h2tZEVJo9JFJnNQAAABY"]
[Sun Apr 12 08:23:08.319034 2026] [:error] [pid 25327:tid 25354] [client 20.220.147.82:1622] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccou.php"] [unique_id "adrl7C6h2tZEVJo9JFJnOQAAABI"]
[Sun Apr 12 08:23:08.769785 2026] [:error] [pid 25327:tid 25346] [client 20.220.147.82:1723] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "adrl7C6h2tZEVJo9JFJnPwAAAAo"]
[Sun Apr 12 08:23:09.223310 2026] [:error] [pid 26600:tid 26630] [client 20.220.147.82:1412] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "adrl7e1YwAZiXhQKLYqcxAAAAYE"]
[Sun Apr 12 08:23:09.668123 2026] [:error] [pid 26600:tid 26633] [client 20.220.147.82:1464] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "adrl7e1YwAZiXhQKLYqcxQAAAYQ"]
[Sun Apr 12 08:23:10.099382 2026] [:error] [pid 25327:tid 25358] [client 20.220.147.82:1851] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ton.php"] [unique_id "adrl7i6h2tZEVJo9JFJnRgAAABY"]
[Sun Apr 12 08:23:10.663807 2026] [:error] [pid 26599:tid 26608] [client 20.220.147.82:1843] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrl7nG89LXoQbk_rwByvwAAAUY"]
[Sun Apr 12 08:23:11.139672 2026] [:error] [pid 25328:tid 25380] [client 20.220.147.82:1420] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrl78xUaQZxT-e0YsAjOQAAAEw"]
[Sun Apr 12 08:23:11.640991 2026] [:error] [pid 26600:tid 26634] [client 20.220.147.82:1665] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrl7-1YwAZiXhQKLYqczAAAAYU"]
[Sun Apr 12 08:23:12.097437 2026] [:error] [pid 26600:tid 26647] [client 20.220.147.82:1774] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/403.php"] [unique_id "adrl8O1YwAZiXhQKLYqc0gAAAZI"]
[Sun Apr 12 08:23:12.536938 2026] [:error] [pid 26600:tid 26633] [client 20.220.147.82:1716] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "adrl8O1YwAZiXhQKLYqc1QAAAYQ"]
[Sun Apr 12 08:23:12.971164 2026] [:error] [pid 25327:tid 25345] [client 20.220.147.82:1442] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "adrl8C6h2tZEVJo9JFJnTQAAAAk"]
[Sun Apr 12 08:23:13.484481 2026] [:error] [pid 25327:tid 25352] [client 20.220.147.82:1452] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "adrl8S6h2tZEVJo9JFJnUAAAABA"]
[Sun Apr 12 08:23:13.940852 2026] [:error] [pid 25327:tid 25349] [client 20.220.147.82:1697] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file9.php"] [unique_id "adrl8S6h2tZEVJo9JFJnUgAAAA0"]
[Sun Apr 12 08:23:14.370933 2026] [:error] [pid 25327:tid 25337] [client 20.220.147.82:1715] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "adrl8i6h2tZEVJo9JFJnVAAAAAE"]
[Sun Apr 12 08:23:14.811523 2026] [:error] [pid 60280:tid 60305] [client 20.220.147.82:1672] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "adrl8nBlLnDOYuIykkgiwAAAAdc"]
[Sun Apr 12 08:23:15.258811 2026] [:error] [pid 25327:tid 25348] [client 20.220.147.82:1719] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "adrl8y6h2tZEVJo9JFJnWQAAAAw"]
[Sun Apr 12 08:23:15.710267 2026] [:error] [pid 25327:tid 25345] [client 20.220.147.82:1694] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ac.php"] [unique_id "adrl8y6h2tZEVJo9JFJnXQAAAAk"]
[Sun Apr 12 08:23:16.150852 2026] [:error] [pid 25327:tid 25352] [client 20.220.147.82:1670] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adrl9C6h2tZEVJo9JFJnYQAAABA"]
[Sun Apr 12 08:23:16.628198 2026] [:error] [pid 25329:tid 25400] [client 20.220.147.82:2009] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adrl9GdcIYsS8Iyaj11eNwAAAI4"]
[Sun Apr 12 08:23:17.133066 2026] [:error] [pid 26567:tid 26585] [client 20.220.147.82:1418] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adrl9XhRpg6ptWFyFx0sdgAAARA"]
[Sun Apr 12 08:23:17.558886 2026] [:error] [pid 25327:tid 25359] [client 20.220.147.82:1624] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adrl9S6h2tZEVJo9JFJnawAAABc"]
[Sun Apr 12 08:23:18.124673 2026] [:error] [pid 25327:tid 25344] [client 20.220.147.82:1720] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "adrl9i6h2tZEVJo9JFJnbgAAAAg"]
[Sun Apr 12 08:23:18.709611 2026] [:error] [pid 25437:tid 25456] [client 20.220.147.82:1689] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "adrl9nf97wYZje1ep_N9mAAAANE"]
[Sun Apr 12 08:23:19.376205 2026] [:error] [pid 25329:tid 25392] [client 20.220.147.82:1462] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "adrl92dcIYsS8Iyaj11eOgAAAIk"]
[Sun Apr 12 08:23:19.804004 2026] [:error] [pid 25437:tid 25455] [client 20.220.147.82:1413] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pop.php"] [unique_id "adrl93f97wYZje1ep_N9mgAAANA"]
[Sun Apr 12 08:23:20.276685 2026] [:error] [pid 25327:tid 25358] [client 20.220.147.82:1606] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "adrl-C6h2tZEVJo9JFJneQAAABY"]
[Sun Apr 12 08:23:20.760280 2026] [:error] [pid 25327:tid 25343] [client 20.220.147.82:1604] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "adrl-C6h2tZEVJo9JFJnfAAAAAc"]
[Sun Apr 12 08:23:21.233964 2026] [:error] [pid 25327:tid 25341] [client 20.220.147.82:1423] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "adrl-S6h2tZEVJo9JFJnfwAAAAU"]
[Sun Apr 12 08:23:21.775992 2026] [:error] [pid 25327:tid 25356] [client 20.220.147.82:1708] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/az.php"] [unique_id "adrl-S6h2tZEVJo9JFJnhAAAABQ"]
[Sun Apr 12 08:23:22.242457 2026] [:error] [pid 25327:tid 25357] [client 20.220.147.82:1700] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "adrl-i6h2tZEVJo9JFJniAAAABU"]
[Sun Apr 12 08:23:22.920892 2026] [:error] [pid 26567:tid 26574] [client 20.220.147.82:1653] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "adrl-nhRpg6ptWFyFx0shAAAAQU"]
[Sun Apr 12 08:23:23.675729 2026] [:error] [pid 25327:tid 25339] [client 20.220.147.82:1466] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "adrl-y6h2tZEVJo9JFJnkgAAAAM"]
[Sun Apr 12 08:23:24.144557 2026] [:error] [pid 25327:tid 25357] [client 20.220.147.82:1470] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xaz.php"] [unique_id "adrl_C6h2tZEVJo9JFJnlwAAABU"]
[Sun Apr 12 08:23:25.094047 2026] [:error] [pid 25327:tid 25343] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Sun Apr 12 08:23:25.303510 2026] [:error] [pid 25327:tid 25341] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Sun Apr 12 08:23:25.522580 2026] [:error] [pid 25327:tid 25347] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Apr 12 08:23:25.980853 2026] [:error] [pid 25327:tid 25357] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Sun Apr 12 08:23:26.222420 2026] [:error] [pid 25327:tid 25344] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Sun Apr 12 08:23:26.432090 2026] [:error] [pid 25327:tid 25345] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Sun Apr 12 08:23:26.643009 2026] [:error] [pid 25327:tid 25352] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Sun Apr 12 08:23:26.852670 2026] [:error] [pid 25327:tid 25340] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sun Apr 12 08:23:27.060777 2026] [:error] [pid 25327:tid 25355] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Apr 12 08:23:27.268925 2026] [:error] [pid 25327:tid 25351] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sun Apr 12 08:23:27.479477 2026] [:error] [pid 25327:tid 25341] [client 20.220.147.82:1760] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Sun Apr 12 08:23:27.714067 2026] [:error] [pid 25327:tid 25336] [client 20.220.147.82:1760] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrl_y6h2tZEVJo9JFJnrwAAAAA"]
[Sun Apr 12 08:23:28.380331 2026] [:error] [pid 26599:tid 26616] [client 20.220.147.82:1718] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrmAHG89LXoQbk_rwBy0QAAAU4"]
[Sun Apr 12 08:23:29.535920 2026] [:error] [pid 26599:tid 26622] [client 20.220.147.82:1712] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrmAXG89LXoQbk_rwBy1gAAAVQ"]
[Sun Apr 12 08:23:30.029737 2026] [:error] [pid 26599:tid 26614] [client 20.220.147.82:1693] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin.php"] [unique_id "adrmAnG89LXoQbk_rwBy2gAAAUw"]
[Sun Apr 12 08:23:30.503952 2026] [:error] [pid 25437:tid 25443] [client 20.220.147.82:1628] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "adrmAnf97wYZje1ep_N9oAAAAMQ"]
[Sun Apr 12 08:23:30.937705 2026] [:error] [pid 25437:tid 25457] [client 20.220.147.82:1680] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "adrmAnf97wYZje1ep_N9ogAAANI"]
[Sun Apr 12 08:23:31.351862 2026] [:error] [pid 25329:tid 25381] [client 20.220.147.82:1629] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "adrmA2dcIYsS8Iyaj11ePAAAAIM"]
[Sun Apr 12 08:23:31.774002 2026] [:error] [pid 25437:tid 25452] [client 20.220.147.82:1449] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/profile.php"] [unique_id "adrmA3f97wYZje1ep_N9pgAAAM0"]
[Sun Apr 12 08:23:32.306724 2026] [:error] [pid 26600:tid 26637] [client 20.220.147.82:1725] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "adrmBO1YwAZiXhQKLYqc3AAAAYg"]
[Sun Apr 12 08:23:32.745355 2026] [:error] [pid 25328:tid 25367] [client 20.220.147.82:1717] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "adrmBMxUaQZxT-e0YsAjSwAAAEM"]
[Sun Apr 12 08:23:33.217135 2026] [:error] [pid 26567:tid 26582] [client 20.220.147.82:1619] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "adrmBXhRpg6ptWFyFx0skQAAAQ0"]
[Sun Apr 12 08:23:33.653573 2026] [:error] [pid 25328:tid 25375] [client 20.220.147.82:1704] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/menu.php"] [unique_id "adrmBcxUaQZxT-e0YsAjTwAAAEk"]
[Sun Apr 12 08:23:34.108409 2026] [:error] [pid 25329:tid 25414] [client 20.220.147.82:1677] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sites.php"] [unique_id "adrmBmdcIYsS8Iyaj11eQQAAAJc"]
[Sun Apr 12 08:23:34.553923 2026] [:error] [pid 25328:tid 25364] [client 20.220.147.82:1647] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sites.php"] [unique_id "adrmBsxUaQZxT-e0YsAjUAAAAEA"]
[Sun Apr 12 08:23:34.971435 2026] [:error] [pid 25327:tid 25354] [client 20.220.147.82:1722] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sites.php"] [unique_id "adrmBi6h2tZEVJo9JFJnyQAAABI"]
[Sun Apr 12 08:23:35.417628 2026] [:error] [pid 25327:tid 25339] [client 20.220.147.82:1542] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sites.php"] [unique_id "adrmBy6h2tZEVJo9JFJnygAAAAM"]
[Sun Apr 12 08:23:35.891129 2026] [:error] [pid 25329:tid 25399] [client 20.220.147.82:1762] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrmB2dcIYsS8Iyaj11eRwAAAI0"]
[Sun Apr 12 08:23:36.508979 2026] [:error] [pid 26599:tid 26618] [client 20.220.147.82:1570] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrmCHG89LXoQbk_rwBy5QAAAVA"]
[Sun Apr 12 08:23:37.126491 2026] [:error] [pid 26599:tid 26625] [client 20.220.147.82:1669] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrmCXG89LXoQbk_rwBy6wAAAVc"]
[Sun Apr 12 08:23:37.740106 2026] [:error] [pid 25328:tid 25405] [client 20.220.147.82:1710] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byp.php"] [unique_id "adrmCcxUaQZxT-e0YsAjVgAAAFc"]
[Sun Apr 12 08:23:38.343600 2026] [:error] [pid 25329:tid 25381] [client 20.220.147.82:1669] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adrmCmdcIYsS8Iyaj11eTQAAAIM"]
[Sun Apr 12 08:23:38.804147 2026] [:error] [pid 26599:tid 26606] [client 20.220.147.82:1688] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adrmCnG89LXoQbk_rwBy8gAAAUQ"]
[Sun Apr 12 08:23:39.225993 2026] [:error] [pid 26599:tid 26616] [client 20.220.147.82:1448] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adrmC3G89LXoQbk_rwBy8wAAAU4"]
[Sun Apr 12 08:23:39.662948 2026] [:error] [pid 25328:tid 25368] [client 20.220.147.82:1664] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adrmC8xUaQZxT-e0YsAjWQAAAEQ"]
[Sun Apr 12 08:23:40.087698 2026] [:error] [pid 26600:tid 26631] [client 20.220.147.82:1605] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adrmDO1YwAZiXhQKLYqc6AAAAYI"]
[Sun Apr 12 08:23:40.677080 2026] [:error] [pid 25437:tid 25460] [client 20.220.147.82:1612] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adrmDHf97wYZje1ep_N9qgAAANU"]
[Sun Apr 12 08:23:41.206804 2026] [:error] [pid 60280:tid 60286] [client 20.220.147.82:1600] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adrmDXBlLnDOYuIykkgizgAAAcQ"]
[Sun Apr 12 08:23:41.630866 2026] [:error] [pid 25327:tid 25352] [client 20.220.147.82:1596] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mini.php"] [unique_id "adrmDS6h2tZEVJo9JFJn2gAAABA"]
[Sun Apr 12 10:03:18.847369 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Sun Apr 12 10:03:19.107219 2026] [:error] [pid 60280:tid 60292] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Sun Apr 12 10:03:19.366444 2026] [:error] [pid 60280:tid 60282] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Sun Apr 12 10:03:19.702504 2026] [:error] [pid 60280:tid 60291] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Sun Apr 12 10:03:19.976403 2026] [:error] [pid 60280:tid 60300] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Sun Apr 12 10:03:20.294090 2026] [:error] [pid 60280:tid 60297] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/filemanger2.php
[Sun Apr 12 10:03:20.555950 2026] [:error] [pid 60280:tid 60283] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun Apr 12 10:03:20.817317 2026] [:error] [pid 60280:tid 60285] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-vn1.php
[Sun Apr 12 10:03:21.109046 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Sun Apr 12 10:03:21.371658 2026] [:error] [pid 60280:tid 60282] [client 20.100.186.147:56792] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Sun Apr 12 10:03:21.627956 2026] [:error] [pid 60280:tid 60291] [client 20.100.186.147:56792] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adr9aXBlLnDOYuIykkhZxwAAAck"]
[Sun Apr 12 10:03:22.560099 2026] [:error] [pid 26567:tid 26573] [client 20.100.186.147:17479] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adr9anhRpg6ptWFyFx1BkwAAAQQ"]
[Sun Apr 12 10:03:23.601943 2026] [:error] [pid 60280:tid 60301] [client 20.100.186.147:37045] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adr9a3BlLnDOYuIykkhZzwAAAdM"]
[Sun Apr 12 10:03:24.603463 2026] [:error] [pid 26600:tid 26649] [client 20.100.186.147:53013] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nwflm.php"] [unique_id "adr9bO1YwAZiXhQKLYq21wAAAZQ"]
[Sun Apr 12 10:03:26.233862 2026] [:error] [pid 25327:tid 25348] [client 20.100.186.147:35622] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adr9bi6h2tZEVJo9JFJ7YwAAAAw"]
[Sun Apr 12 10:03:27.104882 2026] [:error] [pid 26600:tid 26633] [client 20.100.186.147:18034] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adr9b-1YwAZiXhQKLYq22AAAAYQ"]
[Sun Apr 12 10:03:28.127091 2026] [:error] [pid 25328:tid 25405] [client 20.100.186.147:56827] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adr9cMxUaQZxT-e0YsBJQAAAAFc"]
[Sun Apr 12 10:03:28.908866 2026] [:error] [pid 26599:tid 26603] [client 20.100.186.147:18028] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adr9cHG89LXoQbk_rwCBkQAAAUE"]
[Sun Apr 12 10:03:30.051905 2026] [:error] [pid 60280:tid 60298] [client 20.100.186.147:17117] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adr9cnBlLnDOYuIykkhZ6QAAAdA"]
[Sun Apr 12 10:03:30.933684 2026] [:error] [pid 26600:tid 26642] [client 20.100.186.147:63270] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adr9cu1YwAZiXhQKLYq23QAAAY0"]
[Sun Apr 12 10:03:31.826401 2026] [:error] [pid 60280:tid 60303] [client 20.100.186.147:18273] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adr9c3BlLnDOYuIykkhZ7wAAAdU"]
[Sun Apr 12 10:03:33.369055 2026] [:error] [pid 60280:tid 60304] [client 20.100.186.147:63265] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xff.php"] [unique_id "adr9dXBlLnDOYuIykkhZ8gAAAdY"]
[Sun Apr 12 10:03:34.626581 2026] [:error] [pid 60280:tid 60287] [client 20.100.186.147:37019] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adr9dnBlLnDOYuIykkhZ9wAAAcU"]
[Sun Apr 12 10:03:35.558559 2026] [:error] [pid 60280:tid 60302] [client 20.100.186.147:56793] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adr9d3BlLnDOYuIykkhZ-wAAAdQ"]
[Sun Apr 12 10:03:36.368122 2026] [:error] [pid 60280:tid 60286] [client 20.100.186.147:22058] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adr9eHBlLnDOYuIykkhaAAAAAcQ"]
[Sun Apr 12 10:03:37.330645 2026] [:error] [pid 60280:tid 60294] [client 20.100.186.147:20589] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adr9eXBlLnDOYuIykkhaBAAAAcw"]
[Sun Apr 12 10:03:38.568931 2026] [:error] [pid 60280:tid 60290] [client 20.100.186.147:18000] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adr9enBlLnDOYuIykkhaDAAAAcg"]
[Sun Apr 12 10:03:39.853956 2026] [:error] [pid 25328:tid 25369] [client 20.100.186.147:17494] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adr9e8xUaQZxT-e0YsBJRgAAAEU"]
[Sun Apr 12 10:03:40.727324 2026] [:error] [pid 25437:tid 25463] [client 20.100.186.147:63253] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adr9fHf97wYZje1ep_Oc6AAAANg"]
[Sun Apr 12 10:03:41.735805 2026] [:error] [pid 25328:tid 25367] [client 20.100.186.147:37041] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/awa.php"] [unique_id "adr9fcxUaQZxT-e0YsBJSQAAAEM"]
[Sun Apr 12 10:03:42.910811 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:18014] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adr9fsxUaQZxT-e0YsBJTgAAAFY"]
[Sun Apr 12 10:03:44.131474 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:56824] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adr9gHBlLnDOYuIykkhaFwAAAcc"]
[Sun Apr 12 10:03:45.965709 2026] [:error] [pid 26600:tid 26646] [client 20.100.186.147:18274] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adr9ge1YwAZiXhQKLYq2_AAAAZE"]
[Sun Apr 12 10:03:46.878766 2026] [:error] [pid 25327:tid 25353] [client 20.100.186.147:17528] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adr9gi6h2tZEVJo9JFJ7aAAAABE"]
[Sun Apr 12 10:03:47.812783 2026] [:error] [pid 60280:tid 60303] [client 20.100.186.147:52996] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adr9g3BlLnDOYuIykkhaIQAAAdU"]
[Sun Apr 12 10:03:48.686654 2026] [:error] [pid 25327:tid 25351] [client 20.100.186.147:53011] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adr9hC6h2tZEVJo9JFJ7bQAAAA8"]
[Sun Apr 12 10:03:49.416022 2026] [:error] [pid 25328:tid 25367] [client 20.100.186.147:56808] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adr9hcxUaQZxT-e0YsBJWQAAAEM"]
[Sun Apr 12 10:03:50.394588 2026] [:error] [pid 60280:tid 60283] [client 20.100.186.147:7576] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/popo.php"] [unique_id "adr9hnBlLnDOYuIykkhaJgAAAcE"]
[Sun Apr 12 10:03:51.499480 2026] [:error] [pid 25327:tid 25357] [client 20.100.186.147:17119] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adr9hy6h2tZEVJo9JFJ7dQAAABU"]
[Sun Apr 12 10:03:52.579985 2026] [:error] [pid 26567:tid 26588] [client 20.100.186.147:22016] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adr9iHhRpg6ptWFyFx1BmQAAARM"]
[Sun Apr 12 10:03:53.621483 2026] [:error] [pid 26567:tid 26570] [client 20.100.186.147:37034] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adr9iXhRpg6ptWFyFx1BmwAAAQE"]
[Sun Apr 12 10:03:54.763861 2026] [:error] [pid 25328:tid 25387] [client 20.100.186.147:18041] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/water.php"] [unique_id "adr9isxUaQZxT-e0YsBJZQAAAE8"]
[Sun Apr 12 10:03:55.886063 2026] [:error] [pid 60280:tid 60303] [client 20.100.186.147:7994] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adr9i3BlLnDOYuIykkhaKgAAAdU"]
[Sun Apr 12 10:03:56.763639 2026] [:error] [pid 60280:tid 60302] [client 20.100.186.147:17092] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adr9jHBlLnDOYuIykkhaLwAAAdQ"]
[Sun Apr 12 10:03:57.988334 2026] [:error] [pid 25328:tid 25364] [client 20.100.186.147:22024] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adr9jcxUaQZxT-e0YsBJaQAAAEA"]
[Sun Apr 12 10:03:59.558901 2026] [:error] [pid 25328:tid 25383] [client 20.100.186.147:7601] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ggb.php"] [unique_id "adr9j8xUaQZxT-e0YsBJcgAAAE0"]
[Sun Apr 12 10:04:00.436764 2026] [:error] [pid 25328:tid 25387] [client 20.100.186.147:20558] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adr9kMxUaQZxT-e0YsBJdQAAAE8"]
[Sun Apr 12 10:04:01.558440 2026] [:error] [pid 60280:tid 60290] [client 20.100.186.147:7946] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adr9kXBlLnDOYuIykkhaQAAAAcg"]
[Sun Apr 12 10:04:02.897288 2026] [:error] [pid 60280:tid 60296] [client 20.100.186.147:17109] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adr9knBlLnDOYuIykkhaSAAAAc4"]
[Sun Apr 12 10:04:03.895838 2026] [:error] [pid 60280:tid 60304] [client 20.100.186.147:20584] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/13.php"] [unique_id "adr9k3BlLnDOYuIykkhaSQAAAdY"]
[Sun Apr 12 10:04:04.745706 2026] [:error] [pid 25437:tid 25453] [client 20.100.186.147:20556] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adr9lHf97wYZje1ep_Oc-gAAAM4"]
[Sun Apr 12 10:04:05.699446 2026] [:error] [pid 26600:tid 26639] [client 20.100.186.147:37005] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adr9le1YwAZiXhQKLYq2_gAAAYo"]
[Sun Apr 12 10:04:06.554816 2026] [:error] [pid 25327:tid 25352] [client 20.100.186.147:7958] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adr9li6h2tZEVJo9JFJ7ggAAABA"]
[Sun Apr 12 10:04:07.692334 2026] [:error] [pid 25328:tid 25398] [client 20.100.186.147:18286] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adr9l8xUaQZxT-e0YsBJgwAAAFQ"]
[Sun Apr 12 10:04:08.660380 2026] [:error] [pid 26600:tid 26643] [client 20.100.186.147:17136] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adr9mO1YwAZiXhQKLYq3AwAAAY4"]
[Sun Apr 12 10:04:09.800019 2026] [:error] [pid 60280:tid 60292] [client 20.100.186.147:18027] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adr9mXBlLnDOYuIykkhaXAAAAco"]
[Sun Apr 12 10:04:10.498954 2026] [:error] [pid 25437:tid 25447] [client 20.100.186.147:37030] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adr9mnf97wYZje1ep_Oc_wAAAMg"]
[Sun Apr 12 10:04:11.307651 2026] [:error] [pid 26599:tid 26624] [client 20.100.186.147:56782] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/11.php"] [unique_id "adr9m3G89LXoQbk_rwCBmAAAAVY"]
[Sun Apr 12 10:04:11.999298 2026] [:error] [pid 25328:tid 25368] [client 20.100.186.147:53031] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adr9m8xUaQZxT-e0YsBJiwAAAEQ"]
[Sun Apr 12 10:04:12.936597 2026] [:error] [pid 25437:tid 25441] [client 20.100.186.147:20566] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adr9nHf97wYZje1ep_OdAQAAAMI"]
[Sun Apr 12 10:04:13.747171 2026] [:error] [pid 26599:tid 26605] [client 20.100.186.147:18005] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adr9nXG89LXoQbk_rwCBnAAAAUM"]
[Sun Apr 12 10:04:14.408413 2026] [:error] [pid 26600:tid 26641] [client 20.100.186.147:17994] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/p.php"] [unique_id "adr9nu1YwAZiXhQKLYq3BwAAAYw"]
[Sun Apr 12 10:04:15.397387 2026] [:error] [pid 25327:tid 25346] [client 20.100.186.147:22046] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adr9ny6h2tZEVJo9JFJ7jAAAAAo"]
[Sun Apr 12 10:04:16.137072 2026] [:error] [pid 25327:tid 25339] [client 20.100.186.147:36389] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adr9oC6h2tZEVJo9JFJ7jgAAAAM"]
[Sun Apr 12 10:04:16.946976 2026] [:error] [pid 60280:tid 60286] [client 20.100.186.147:17104] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adr9oHBlLnDOYuIykkhaZQAAAcQ"]
[Sun Apr 12 10:04:17.910807 2026] [:error] [pid 25329:tid 25392] [client 20.100.186.147:63271] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/oij98gy.php"] [unique_id "adr9oWdcIYsS8Iyaj11qngAAAIk"]
[Sun Apr 12 10:04:18.839543 2026] [:error] [pid 26567:tid 26576] [client 20.100.186.147:56826] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adr9onhRpg6ptWFyFx1BtwAAAQc"]
[Sun Apr 12 10:04:19.485360 2026] [:error] [pid 25328:tid 25377] [client 20.100.186.147:22076] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adr9o8xUaQZxT-e0YsBJlQAAAEo"]
[Sun Apr 12 10:04:20.030994 2026] [:error] [pid 60280:tid 60301] [client 20.100.186.147:18044] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adr9pHBlLnDOYuIykkhabwAAAdM"]
[Sun Apr 12 10:04:20.783828 2026] [:error] [pid 60280:tid 60284] [client 20.100.186.147:7989] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bthil.php"] [unique_id "adr9pHBlLnDOYuIykkhacQAAAcI"]
[Sun Apr 12 10:04:21.365838 2026] [:error] [pid 26600:tid 26630] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/turkshell.php
[Sun Apr 12 10:04:21.639448 2026] [:error] [pid 26600:tid 26648] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Sun Apr 12 10:04:21.935515 2026] [:error] [pid 26600:tid 26649] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Sun Apr 12 10:04:22.209959 2026] [:error] [pid 26600:tid 26632] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun Apr 12 10:04:22.479054 2026] [:error] [pid 26600:tid 26650] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sun Apr 12 10:04:22.741171 2026] [:error] [pid 26600:tid 26645] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Apr 12 10:04:23.038877 2026] [:error] [pid 26600:tid 26644] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sun Apr 12 10:04:23.299875 2026] [:error] [pid 26600:tid 26637] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Sun Apr 12 10:04:23.570586 2026] [:error] [pid 26600:tid 26629] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Sun Apr 12 10:04:23.832209 2026] [:error] [pid 26600:tid 26652] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Sun Apr 12 10:04:24.092984 2026] [:error] [pid 26600:tid 26646] [client 20.100.186.147:7603] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Sun Apr 12 10:04:24.351066 2026] [:error] [pid 26600:tid 26651] [client 20.100.186.147:7603] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adr9qO1YwAZiXhQKLYq3GwAAAZY"]
[Sun Apr 12 10:04:25.020207 2026] [:error] [pid 25437:tid 25441] [client 20.100.186.147:17137] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adr9qXf97wYZje1ep_OdGgAAAMI"]
[Sun Apr 12 10:04:25.665026 2026] [:error] [pid 25437:tid 25455] [client 20.100.186.147:7591] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adr9qXf97wYZje1ep_OdHQAAANA"]
[Sun Apr 12 10:04:26.252506 2026] [:error] [pid 25328:tid 25375] [client 20.100.186.147:37031] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/9.php"] [unique_id "adr9qsxUaQZxT-e0YsBJmgAAAEk"]
[Sun Apr 12 10:04:26.912725 2026] [:error] [pid 26600:tid 26634] [client 20.100.186.147:37024] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adr9qu1YwAZiXhQKLYq3HQAAAYU"]
[Sun Apr 12 10:04:27.598763 2026] [:error] [pid 26600:tid 26639] [client 20.100.186.147:18249] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adr9q-1YwAZiXhQKLYq3HwAAAYo"]
[Sun Apr 12 10:04:28.315359 2026] [:error] [pid 60280:tid 60299] [client 20.100.186.147:18019] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adr9rHBlLnDOYuIykkhaiAAAAdE"]
[Sun Apr 12 10:04:29.048402 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:20546] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/10.php"] [unique_id "adr9rXBlLnDOYuIykkhaiwAAAcc"]
[Sun Apr 12 10:04:29.764255 2026] [:error] [pid 26567:tid 26577] [client 20.100.186.147:17989] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adr9rXhRpg6ptWFyFx1BwAAAAQg"]
[Sun Apr 12 10:04:30.385974 2026] [:error] [pid 60280:tid 60305] [client 20.100.186.147:7945] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adr9rnBlLnDOYuIykkhakwAAAdc"]
[Sun Apr 12 10:04:31.310540 2026] [:error] [pid 26600:tid 26638] [client 20.100.186.147:34647] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adr9r-1YwAZiXhQKLYq3IQAAAYk"]
[Sun Apr 12 10:04:32.088135 2026] [:error] [pid 25329:tid 25390] [client 20.100.186.147:37021] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.mopj.php"] [unique_id "adr9sGdcIYsS8Iyaj11qogAAAIg"]
[Sun Apr 12 10:04:32.964795 2026] [:error] [pid 26567:tid 26589] [client 20.100.186.147:37014] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adr9sHhRpg6ptWFyFx1BwgAAARQ"]
[Sun Apr 12 10:04:34.311364 2026] [:error] [pid 60280:tid 60285] [client 20.100.186.147:20579] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adr9snBlLnDOYuIykkhamgAAAcM"]
[Sun Apr 12 10:04:34.983820 2026] [:error] [pid 25328:tid 25372] [client 20.100.186.147:17487] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adr9ssxUaQZxT-e0YsBJpAAAAEc"]
[Sun Apr 12 10:04:36.050758 2026] [:error] [pid 60280:tid 60292] [client 20.100.186.147:53020] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/100.php"] [unique_id "adr9tHBlLnDOYuIykkhanQAAAco"]
[Sun Apr 12 10:04:36.974968 2026] [:error] [pid 60280:tid 60306] [client 20.100.186.147:7963] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adr9tHBlLnDOYuIykkhaogAAAdg"]
[Sun Apr 12 10:04:38.187331 2026] [:error] [pid 26599:tid 26614] [client 20.100.186.147:63256] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adr9tnG89LXoQbk_rwCBpwAAAUw"]
[Sun Apr 12 10:04:38.990687 2026] [:error] [pid 60280:tid 60302] [client 20.100.186.147:7826] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adr9tnBlLnDOYuIykkhapwAAAdQ"]
[Sun Apr 12 10:04:39.653785 2026] [:error] [pid 60280:tid 60290] [client 20.100.186.147:56816] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nano.php"] [unique_id "adr9t3BlLnDOYuIykkhaqQAAAcg"]
[Sun Apr 12 10:04:40.702866 2026] [:error] [pid 26600:tid 26636] [client 20.100.186.147:7555] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adr9uO1YwAZiXhQKLYq3MAAAAYc"]
[Sun Apr 12 10:04:41.610859 2026] [:error] [pid 60280:tid 60301] [client 20.100.186.147:7598] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adr9uXBlLnDOYuIykkharwAAAdM"]
[Sun Apr 12 10:04:43.380942 2026] [:error] [pid 25437:tid 25450] [client 20.100.186.147:18271] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adr9u3f97wYZje1ep_OdMwAAAMs"]
[Sun Apr 12 10:04:44.837485 2026] [:error] [pid 25437:tid 25458] [client 20.100.186.147:63275] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35_S.php"] [unique_id "adr9vHf97wYZje1ep_OdNwAAANM"]
[Sun Apr 12 10:04:45.744734 2026] [:error] [pid 26567:tid 26586] [client 20.100.186.147:7607] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adr9vXhRpg6ptWFyFx1BzAAAARE"]
[Sun Apr 12 10:04:46.808407 2026] [:error] [pid 26599:tid 26625] [client 20.100.186.147:14068] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adr9vnG89LXoQbk_rwCBqgAAAVc"]
[Sun Apr 12 10:04:47.734335 2026] [:error] [pid 25437:tid 25462] [client 20.100.186.147:58046] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adr9v3f97wYZje1ep_OdPwAAANc"]
[Sun Apr 12 10:04:49.745787 2026] [:error] [pid 25328:tid 25391] [client 20.100.186.147:52340] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adr9wcxUaQZxT-e0YsBJrAAAAFE"]
[Sun Apr 12 10:04:50.563056 2026] [:error] [pid 25437:tid 25455] [client 20.100.186.147:20488] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adr9wnf97wYZje1ep_OdRQAAANA"]
[Sun Apr 12 10:04:51.455741 2026] [:error] [pid 25328:tid 25389] [client 20.100.186.147:42684] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adr9w8xUaQZxT-e0YsBJswAAAFA"]
[Sun Apr 12 10:04:52.354503 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:58024] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adr9xHBlLnDOYuIykkhazQAAAcc"]
[Sun Apr 12 10:04:53.113094 2026] [:error] [pid 25328:tid 25396] [client 20.100.186.147:17697] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/111.php"] [unique_id "adr9xcxUaQZxT-e0YsBJtgAAAFM"]
[Sun Apr 12 10:04:54.023248 2026] [:error] [pid 60280:tid 60295] [client 20.100.186.147:7391] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adr9xnBlLnDOYuIykkhazwAAAc0"]
[Sun Apr 12 10:04:54.986163 2026] [:error] [pid 25328:tid 25405] [client 20.100.186.147:17702] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adr9xsxUaQZxT-e0YsBJvgAAAFc"]
[Sun Apr 12 10:04:55.743374 2026] [:error] [pid 25328:tid 25408] [client 20.100.186.147:19304] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adr9x8xUaQZxT-e0YsBJvwAAAFg"]
[Sun Apr 12 10:04:56.592319 2026] [:error] [pid 25328:tid 25398] [client 20.100.186.147:15578] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adr9yMxUaQZxT-e0YsBJwAAAAFQ"]
[Sun Apr 12 10:04:57.410461 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:13471] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adr9yXBlLnDOYuIykkha2wAAAcc"]
[Sun Apr 12 10:04:58.153954 2026] [:error] [pid 60280:tid 60306] [client 20.100.186.147:17725] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adr9ynBlLnDOYuIykkha3QAAAdg"]
[Sun Apr 12 10:04:59.169168 2026] [:error] [pid 25437:tid 25450] [client 20.100.186.147:19301] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adr9y3f97wYZje1ep_OdUQAAAMs"]
[Sun Apr 12 10:05:00.432049 2026] [:error] [pid 25437:tid 25445] [client 20.100.186.147:15589] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aligk.php"] [unique_id "adr9zHf97wYZje1ep_OdVwAAAMY"]
[Sun Apr 12 10:05:01.178845 2026] [:error] [pid 60280:tid 60291] [client 20.100.186.147:13493] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adr9zXBlLnDOYuIykkha4wAAAck"]
[Sun Apr 12 10:05:02.785982 2026] [:error] [pid 25327:tid 25349] [client 20.100.186.147:41204] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adr9zi6h2tZEVJo9JFJ7pwAAAA0"]
[Sun Apr 12 10:05:03.568314 2026] [:error] [pid 25437:tid 25451] [client 20.100.186.147:15572] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adr9z3f97wYZje1ep_OdWwAAAMw"]
[Sun Apr 12 10:05:04.939292 2026] [:error] [pid 26567:tid 26585] [client 20.100.186.147:18452] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/byrgo.php"] [unique_id "adr90HhRpg6ptWFyFx1B0wAAARA"]
[Sun Apr 12 10:05:05.779945 2026] [:error] [pid 60280:tid 60296] [client 20.100.186.147:14735] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adr90XBlLnDOYuIykkha8AAAAc4"]
[Sun Apr 12 10:05:06.783054 2026] [:error] [pid 26567:tid 26592] [client 20.100.186.147:15002] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adr90nhRpg6ptWFyFx1B1AAAARc"]
[Sun Apr 12 10:05:08.395466 2026] [:error] [pid 26567:tid 26581] [client 20.100.186.147:21693] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adr91HhRpg6ptWFyFx1B2AAAAQw"]
[Sun Apr 12 10:05:09.808917 2026] [:error] [pid 26600:tid 26631] [client 20.100.186.147:18487] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwpg.php"] [unique_id "adr91e1YwAZiXhQKLYq3RAAAAYI"]
[Sun Apr 12 10:05:10.595254 2026] [:error] [pid 26600:tid 26642] [client 20.100.186.147:60220] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adr91u1YwAZiXhQKLYq3SQAAAY0"]
[Sun Apr 12 10:05:11.301714 2026] [:error] [pid 26600:tid 26637] [client 20.100.186.147:33464] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adr91-1YwAZiXhQKLYq3UgAAAYg"]
[Sun Apr 12 10:05:12.292159 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:36307] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adr92MxUaQZxT-e0YsBJ3gAAAFY"]
[Sun Apr 12 10:05:13.752200 2026] [:error] [pid 25437:tid 25460] [client 20.100.186.147:36338] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ass.php"] [unique_id "adr92Xf97wYZje1ep_OdYgAAANU"]
[Sun Apr 12 10:05:14.496059 2026] [:error] [pid 25329:tid 25376] [client 20.100.186.147:21656] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adr92mdcIYsS8Iyaj11qqgAAAIE"]
[Sun Apr 12 10:05:15.407048 2026] [:error] [pid 25328:tid 25391] [client 20.100.186.147:36338] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adr928xUaQZxT-e0YsBJ5AAAAFE"]
[Sun Apr 12 10:05:16.293071 2026] [:error] [pid 25328:tid 25379] [client 20.100.186.147:36312] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adr93MxUaQZxT-e0YsBJ6gAAAEs"]
[Sun Apr 12 10:05:16.934425 2026] [:error] [pid 25328:tid 25383] [client 20.100.186.147:22956] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/about.php"] [unique_id "adr93MxUaQZxT-e0YsBJ7AAAAE0"]
[Sun Apr 12 10:05:18.206472 2026] [:error] [pid 25328:tid 25380] [client 20.100.186.147:36319] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adr93sxUaQZxT-e0YsBJ8gAAAEw"]
[Sun Apr 12 10:05:19.822751 2026] [:error] [pid 26600:tid 26649] [client 20.100.186.147:14330] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adr93-1YwAZiXhQKLYq3fAAAAZQ"]
[Sun Apr 12 10:05:20.800807 2026] [:error] [pid 26600:tid 26645] [client 20.100.186.147:36339] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adr94O1YwAZiXhQKLYq3gQAAAZA"]
[Sun Apr 12 10:05:21.852863 2026] [:error] [pid 26567:tid 26582] [client 20.100.186.147:58920] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/no18.php"] [unique_id "adr94XhRpg6ptWFyFx1B3QAAAQ0"]
[Sun Apr 12 10:05:23.188011 2026] [:error] [pid 25437:tid 25463] [client 20.100.186.147:58914] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fine.php"] [unique_id "adr943f97wYZje1ep_OdbAAAANg"]
[Sun Apr 12 10:05:24.548363 2026] [:error] [pid 25437:tid 25461] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Sun Apr 12 10:05:24.810377 2026] [:error] [pid 25437:tid 25453] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/zample.php
[Sun Apr 12 10:05:25.225967 2026] [:error] [pid 25437:tid 25449] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Sun Apr 12 10:05:25.491787 2026] [:error] [pid 25437:tid 25441] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Sun Apr 12 10:05:25.752015 2026] [:error] [pid 25437:tid 25444] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 12 10:05:26.011499 2026] [:error] [pid 25437:tid 25447] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Sun Apr 12 10:05:26.279398 2026] [:error] [pid 25437:tid 25456] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Sun Apr 12 10:05:26.540835 2026] [:error] [pid 25437:tid 25445] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Sun Apr 12 10:05:26.819738 2026] [:error] [pid 25437:tid 25459] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Sun Apr 12 10:05:27.133483 2026] [:error] [pid 25437:tid 25448] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Sun Apr 12 10:05:27.401375 2026] [:error] [pid 25437:tid 25452] [client 20.100.186.147:58898] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Sun Apr 12 10:05:27.664501 2026] [:error] [pid 25437:tid 25451] [client 20.100.186.147:58898] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "adr953f97wYZje1ep_OdfwAAAMw"]
[Sun Apr 12 10:05:28.989926 2026] [:error] [pid 25327:tid 25359] [client 20.100.186.147:36314] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "adr96C6h2tZEVJo9JFJ7sQAAABc"]
[Sun Apr 12 10:05:29.798272 2026] [:error] [pid 26599:tid 26620] [client 20.100.186.147:14837] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "adr96XG89LXoQbk_rwCBwAAAAVI"]
[Sun Apr 12 10:05:31.212108 2026] [:error] [pid 60280:tid 60282] [client 20.100.186.147:13504] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fvvff.php"] [unique_id "adr963BlLnDOYuIykkhbJgAAAcA"]
[Sun Apr 12 10:05:32.204754 2026] [:error] [pid 25328:tid 25398] [client 20.100.186.147:38703] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "adr97MxUaQZxT-e0YsBKAgAAAFQ"]
[Sun Apr 12 10:05:34.107418 2026] [:error] [pid 25327:tid 25360] [client 20.100.186.147:38676] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "adr97i6h2tZEVJo9JFJ7tgAAABg"]
[Sun Apr 12 10:05:34.963058 2026] [:error] [pid 60280:tid 60306] [client 20.100.186.147:7701] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "adr97nBlLnDOYuIykkhbOgAAAdg"]
[Sun Apr 12 10:05:35.750615 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:42592] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a2.php"] [unique_id "adr978xUaQZxT-e0YsBKDQAAAFY"]
[Sun Apr 12 10:05:36.603900 2026] [:error] [pid 26600:tid 26649] [client 20.100.186.147:47559] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adr98O1YwAZiXhQKLYq3wwAAAZQ"]
[Sun Apr 12 10:05:37.517594 2026] [:error] [pid 25437:tid 25446] [client 20.100.186.147:57958] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adr98Xf97wYZje1ep_OdiQAAAMc"]
[Sun Apr 12 10:05:38.320284 2026] [:error] [pid 25437:tid 25450] [client 20.100.186.147:14496] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adr98nf97wYZje1ep_OdjwAAAMs"]
[Sun Apr 12 10:05:39.079415 2026] [:error] [pid 26600:tid 26635] [client 20.100.186.147:15310] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/edit.php"] [unique_id "adr98-1YwAZiXhQKLYq3zAAAAYY"]
[Sun Apr 12 10:05:40.056441 2026] [:error] [pid 26600:tid 26636] [client 20.100.186.147:15300] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adr99O1YwAZiXhQKLYq30wAAAYc"]
[Sun Apr 12 10:05:40.792885 2026] [:error] [pid 25329:tid 25412] [client 20.100.186.147:8180] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adr99GdcIYsS8Iyaj11qvgAAAJU"]
[Sun Apr 12 10:05:41.494338 2026] [:error] [pid 25437:tid 25456] [client 20.100.186.147:54055] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adr99Xf97wYZje1ep_OdkgAAANE"]
[Sun Apr 12 10:05:42.566935 2026] [:error] [pid 26599:tid 26619] [client 20.100.186.147:14547] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ioxi-o.php"] [unique_id "adr99nG89LXoQbk_rwCBywAAAVE"]
[Sun Apr 12 10:05:43.562337 2026] [:error] [pid 26600:tid 26648] [client 20.100.186.147:14510] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr99-1YwAZiXhQKLYq34wAAAZM"]
[Sun Apr 12 10:05:44.674981 2026] [:error] [pid 25329:tid 25390] [client 20.100.186.147:15309] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr9-GdcIYsS8Iyaj11qwAAAAIg"]
[Sun Apr 12 10:05:45.447224 2026] [:error] [pid 25328:tid 25394] [client 20.100.186.147:7220] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr9-cxUaQZxT-e0YsBKFAAAAFI"]
[Sun Apr 12 10:05:47.127298 2026] [:error] [pid 25437:tid 25445] [client 20.100.186.147:17741] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr9-3f97wYZje1ep_OdlQAAAMY"]
[Sun Apr 12 10:05:48.047995 2026] [:error] [pid 60280:tid 60296] [client 20.100.186.147:14468] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adr9_HBlLnDOYuIykkhbRAAAAc4"]
[Sun Apr 12 10:05:50.033311 2026] [:error] [pid 25329:tid 25400] [client 20.100.186.147:14584] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adr9_mdcIYsS8Iyaj11qyAAAAI4"]
[Sun Apr 12 10:05:52.267545 2026] [:error] [pid 26599:tid 26623] [client 20.100.186.147:16841] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adr-AHG89LXoQbk_rwCB3AAAAVU"]
[Sun Apr 12 10:05:54.014588 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:33400] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/66.php"] [unique_id "adr-AsxUaQZxT-e0YsBKJgAAAFY"]
[Sun Apr 12 10:05:54.694363 2026] [:error] [pid 25437:tid 25443] [client 20.100.186.147:7216] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adr-Anf97wYZje1ep_OdogAAAMQ"]
[Sun Apr 12 10:05:55.772479 2026] [:error] [pid 25437:tid 25457] [client 20.100.186.147:19804] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adr-A3f97wYZje1ep_OdpgAAANI"]
[Sun Apr 12 10:05:56.721332 2026] [:error] [pid 60280:tid 60305] [client 20.100.186.147:46240] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adr-BHBlLnDOYuIykkhbSAAAAdc"]
[Sun Apr 12 10:05:57.888412 2026] [:error] [pid 25437:tid 25459] [client 20.100.186.147:20981] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a5.php"] [unique_id "adr-BXf97wYZje1ep_OdqAAAANQ"]
[Sun Apr 12 10:05:58.952478 2026] [:error] [pid 26599:tid 26623] [client 20.100.186.147:54006] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adr-BnG89LXoQbk_rwCB6wAAAVU"]
[Sun Apr 12 10:05:59.848329 2026] [:error] [pid 25329:tid 25402] [client 20.100.186.147:33372] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adr-B2dcIYsS8Iyaj11q1AAAAI8"]
[Sun Apr 12 10:06:00.868456 2026] [:error] [pid 26599:tid 26613] [client 20.100.186.147:53993] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adr-CHG89LXoQbk_rwCB8QAAAUs"]
[Sun Apr 12 10:06:01.618982 2026] [:error] [pid 26600:tid 26634] [client 20.100.186.147:19524] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ol.php"] [unique_id "adr-Ce1YwAZiXhQKLYq37QAAAYU"]
[Sun Apr 12 10:06:02.691861 2026] [:error] [pid 25328:tid 25364] [client 20.100.186.147:22024] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adr-CsxUaQZxT-e0YsBKKQAAAEA"]
[Sun Apr 12 10:06:03.457165 2026] [:error] [pid 25437:tid 25450] [client 20.100.186.147:20965] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adr-C3f97wYZje1ep_OdrQAAAMs"]
[Sun Apr 12 10:06:04.275525 2026] [:error] [pid 25437:tid 25453] [client 20.100.186.147:46249] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adr-DHf97wYZje1ep_OdrgAAAM4"]
[Sun Apr 12 10:06:04.996723 2026] [:error] [pid 26599:tid 26607] [client 20.100.186.147:14223] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f6.php"] [unique_id "adr-DHG89LXoQbk_rwCB9AAAAUU"]
[Sun Apr 12 10:06:06.028885 2026] [:error] [pid 60280:tid 60282] [client 20.100.186.147:53993] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adr-DnBlLnDOYuIykkhbUQAAAcA"]
[Sun Apr 12 10:06:06.791517 2026] [:error] [pid 26600:tid 26629] [client 20.100.186.147:20224] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adr-Du1YwAZiXhQKLYq38wAAAYA"]
[Sun Apr 12 10:06:07.748552 2026] [:error] [pid 60280:tid 60305] [client 20.100.186.147:46215] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adr-D3BlLnDOYuIykkhbWQAAAdc"]
[Sun Apr 12 10:06:08.861780 2026] [:error] [pid 60280:tid 60298] [client 20.100.186.147:38647] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/inputs.php"] [unique_id "adr-EHBlLnDOYuIykkhbYQAAAdA"]
[Sun Apr 12 10:06:09.780851 2026] [:error] [pid 26567:tid 26576] [client 20.100.186.147:59312] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adr-EXhRpg6ptWFyFx1B-AAAAQc"]
[Sun Apr 12 10:06:10.915890 2026] [:error] [pid 60280:tid 60301] [client 20.100.186.147:23032] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adr-EnBlLnDOYuIykkhbagAAAdM"]
[Sun Apr 12 10:06:11.971799 2026] [:error] [pid 25328:tid 25368] [client 20.100.186.147:19564] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adr-E8xUaQZxT-e0YsBKLAAAAEQ"]
[Sun Apr 12 10:06:13.728531 2026] [:error] [pid 26567:tid 26572] [client 20.100.186.147:38642] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/style.php"] [unique_id "adr-FXhRpg6ptWFyFx1CAQAAAQM"]
[Sun Apr 12 10:06:14.619697 2026] [:error] [pid 60280:tid 60292] [client 20.100.186.147:14254] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adr-FnBlLnDOYuIykkhbcQAAAco"]
[Sun Apr 12 10:06:15.429441 2026] [:error] [pid 60280:tid 60291] [client 20.100.186.147:8090] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adr-F3BlLnDOYuIykkhbdQAAAck"]
[Sun Apr 12 10:06:16.682780 2026] [:error] [pid 60280:tid 60288] [client 20.100.186.147:7915] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adr-GHBlLnDOYuIykkhbfwAAAcY"]
[Sun Apr 12 10:06:17.541288 2026] [:error] [pid 60280:tid 60285] [client 20.100.186.147:19750] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aa.php"] [unique_id "adr-GXBlLnDOYuIykkhbhAAAAcM"]
[Sun Apr 12 10:06:19.299679 2026] [:error] [pid 25328:tid 25380] [client 20.100.186.147:8072] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adr-G8xUaQZxT-e0YsBKMwAAAEw"]
[Sun Apr 12 10:06:21.033672 2026] [:error] [pid 60280:tid 60297] [client 20.100.186.147:7895] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adr-HXBlLnDOYuIykkhbiwAAAc8"]
[Sun Apr 12 10:06:21.933973 2026] [:error] [pid 25329:tid 25407] [client 20.100.186.147:8115] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adr-HWdcIYsS8Iyaj11q7AAAAJI"]
[Sun Apr 12 10:06:23.044659 2026] [:error] [pid 26600:tid 26637] [client 20.100.186.147:53655] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/av.php"] [unique_id "adr-H-1YwAZiXhQKLYq3_wAAAYg"]
[Sun Apr 12 10:06:23.909240 2026] [:error] [pid 26599:tid 26609] [client 20.100.186.147:53692] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adr-H3G89LXoQbk_rwCCAQAAAUc"]
[Sun Apr 12 10:06:24.783102 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:41254] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adr-IMxUaQZxT-e0YsBKQQAAAFY"]
[Sun Apr 12 10:06:25.545188 2026] [:error] [pid 26567:tid 26585] [client 20.100.186.147:34078] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adr-IXhRpg6ptWFyFx1CCAAAARA"]
[Sun Apr 12 10:06:26.437905 2026] [:error] [pid 26567:tid 26588] [client 20.100.186.147:16800] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adr-InhRpg6ptWFyFx1CDQAAARM"]
[Sun Apr 12 10:06:27.404991 2026] [:error] [pid 25437:tid 25448] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Sun Apr 12 10:06:27.677900 2026] [:error] [pid 25437:tid 25454] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sun Apr 12 10:06:27.963317 2026] [:error] [pid 25437:tid 25444] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Sun Apr 12 10:06:28.222883 2026] [:error] [pid 25437:tid 25452] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Sun Apr 12 10:06:28.484225 2026] [:error] [pid 25437:tid 25461] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Sun Apr 12 10:06:28.781723 2026] [:error] [pid 25437:tid 25447] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Apr 12 10:06:29.303898 2026] [:error] [pid 25437:tid 25458] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Sun Apr 12 10:06:29.565882 2026] [:error] [pid 25437:tid 25450] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Sun Apr 12 10:06:29.918490 2026] [:error] [pid 25437:tid 25453] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Sun Apr 12 10:06:30.179147 2026] [:error] [pid 25437:tid 25446] [client 20.100.186.147:16792] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Apr 12 10:06:30.491297 2026] [:error] [pid 25437:tid 25460] [client 20.100.186.147:16792] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adr-Jnf97wYZje1ep_OdwwAAANU"]
[Sun Apr 12 10:06:32.070445 2026] [:error] [pid 26599:tid 26608] [client 20.100.186.147:64635] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adr-KHG89LXoQbk_rwCCBAAAAUY"]
[Sun Apr 12 10:06:32.874125 2026] [:error] [pid 26600:tid 26636] [client 20.100.186.147:19752] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adr-KO1YwAZiXhQKLYq4CAAAAYc"]
[Sun Apr 12 10:06:33.475577 2026] [:error] [pid 25328:tid 25408] [client 20.100.186.147:41229] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adr-KcxUaQZxT-e0YsBKVQAAAFg"]
[Sun Apr 12 10:06:34.256553 2026] [:error] [pid 25329:tid 25390] [client 20.100.186.147:41222] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr-KmdcIYsS8Iyaj11q8QAAAIg"]
[Sun Apr 12 10:06:34.958080 2026] [:error] [pid 25437:tid 25457] [client 20.100.186.147:7448] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr-Knf97wYZje1ep_OdyAAAANI"]
[Sun Apr 12 10:06:36.210920 2026] [:error] [pid 25437:tid 25444] [client 20.100.186.147:18198] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr-LHf97wYZje1ep_OdywAAAMU"]
[Sun Apr 12 10:06:37.135449 2026] [:error] [pid 25437:tid 25447] [client 20.100.186.147:60120] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/admin.php"] [unique_id "adr-LXf97wYZje1ep_OdzgAAAMg"]
[Sun Apr 12 10:06:38.059858 2026] [:error] [pid 25328:tid 25377] [client 20.100.186.147:34057] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-LsxUaQZxT-e0YsBKXwAAAEo"]
[Sun Apr 12 10:06:38.759019 2026] [:error] [pid 25437:tid 25455] [client 20.100.186.147:19733] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-Lnf97wYZje1ep_Od1AAAANA"]
[Sun Apr 12 10:06:40.063909 2026] [:error] [pid 26567:tid 26575] [client 20.100.186.147:19716] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-MHhRpg6ptWFyFx1CGAAAAQY"]
[Sun Apr 12 10:06:40.903455 2026] [:error] [pid 25329:tid 25393] [client 20.100.186.147:8095] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-MGdcIYsS8Iyaj11q9QAAAIo"]
[Sun Apr 12 10:06:41.819115 2026] [:error] [pid 25327:tid 25350] [client 20.100.186.147:19968] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "adr-MS6h2tZEVJo9JFJ72AAAAA4"]
[Sun Apr 12 10:06:42.926053 2026] [:error] [pid 26567:tid 26572] [client 20.100.186.147:64623] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "adr-MnhRpg6ptWFyFx1CHAAAAQM"]
[Sun Apr 12 10:06:44.267872 2026] [:error] [pid 25327:tid 25348] [client 20.100.186.147:19728] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "adr-NC6h2tZEVJo9JFJ73gAAAAw"]
[Sun Apr 12 10:06:45.013802 2026] [:error] [pid 26599:tid 26609] [client 20.100.186.147:8107] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/adminfuns.php"] [unique_id "adr-NXG89LXoQbk_rwCCDgAAAUc"]
[Sun Apr 12 10:06:46.059215 2026] [:error] [pid 25327:tid 25357] [client 20.100.186.147:8105] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adr-Ni6h2tZEVJo9JFJ73wAAABU"]
[Sun Apr 12 10:06:46.796399 2026] [:error] [pid 26599:tid 26608] [client 20.100.186.147:7675] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adr-NnG89LXoQbk_rwCCEQAAAUY"]
[Sun Apr 12 10:06:48.092550 2026] [:error] [pid 26600:tid 26641] [client 20.100.186.147:7619] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adr-OO1YwAZiXhQKLYq4HwAAAYw"]
[Sun Apr 12 10:06:49.309384 2026] [:error] [pid 26567:tid 26581] [client 20.100.186.147:16820] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/goods.php"] [unique_id "adr-OXhRpg6ptWFyFx1CKAAAAQw"]
[Sun Apr 12 10:06:50.903218 2026] [:error] [pid 25327:tid 25341] [client 20.100.186.147:18228] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-Oi6h2tZEVJo9JFJ74gAAAAU"]
[Sun Apr 12 10:06:51.608892 2026] [:error] [pid 26599:tid 26622] [client 20.100.186.147:20001] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-O3G89LXoQbk_rwCCIAAAAVQ"]
[Sun Apr 12 10:06:52.956290 2026] [:error] [pid 60280:tid 60293] [client 20.100.186.147:34055] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-PHBlLnDOYuIykkhboAAAAcs"]
[Sun Apr 12 10:06:54.476879 2026] [:error] [pid 26599:tid 26620] [client 20.100.186.147:58850] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ms-edit.php"] [unique_id "adr-PnG89LXoQbk_rwCCJAAAAVI"]
[Sun Apr 12 10:06:55.382145 2026] [:error] [pid 25437:tid 25456] [client 20.100.186.147:41230] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adr-P3f97wYZje1ep_Od3QAAANE"]
[Sun Apr 12 10:06:56.297544 2026] [:error] [pid 25437:tid 25453] [client 20.100.186.147:7617] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adr-QHf97wYZje1ep_Od3gAAAM4"]
[Sun Apr 12 10:06:56.954079 2026] [:error] [pid 25437:tid 25455] [client 20.100.186.147:57536] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adr-QHf97wYZje1ep_Od4AAAANA"]
[Sun Apr 12 10:06:57.799668 2026] [:error] [pid 25328:tid 25398] [client 20.100.186.147:19747] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/222.php"] [unique_id "adr-QcxUaQZxT-e0YsBKigAAAFQ"]
[Sun Apr 12 10:06:58.411320 2026] [:error] [pid 25328:tid 25401] [client 20.100.186.147:16340] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adr-QsxUaQZxT-e0YsBKjQAAAFU"]
[Sun Apr 12 10:06:59.314196 2026] [:error] [pid 26567:tid 26573] [client 20.100.186.147:58874] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adr-Q3hRpg6ptWFyFx1COgAAAQQ"]
[Sun Apr 12 10:07:00.287071 2026] [:error] [pid 25327:tid 25358] [client 20.100.186.147:60130] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adr-RC6h2tZEVJo9JFJ77AAAABY"]
[Sun Apr 12 10:07:01.107595 2026] [:error] [pid 25327:tid 25347] [client 20.100.186.147:16779] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adr-RS6h2tZEVJo9JFJ77QAAAAs"]
[Sun Apr 12 10:07:01.907404 2026] [:error] [pid 25327:tid 25348] [client 20.100.186.147:34075] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adr-RS6h2tZEVJo9JFJ77gAAAAw"]
[Sun Apr 12 10:07:02.647262 2026] [:error] [pid 26567:tid 26592] [client 20.100.186.147:7658] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adr-RnhRpg6ptWFyFx1CPwAAARc"]
[Sun Apr 12 10:07:03.440342 2026] [:error] [pid 25328:tid 25394] [client 20.100.186.147:16334] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adr-R8xUaQZxT-e0YsBKmAAAAFI"]
[Sun Apr 12 10:07:04.152383 2026] [:error] [pid 26567:tid 26577] [client 20.100.186.147:20015] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fff.php"] [unique_id "adr-SHhRpg6ptWFyFx1CQgAAAQg"]
[Sun Apr 12 10:07:04.763000 2026] [:error] [pid 25327:tid 25349] [client 20.100.186.147:48345] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adr-SC6h2tZEVJo9JFJ78wAAAA0"]
[Sun Apr 12 10:07:05.531625 2026] [:error] [pid 25437:tid 25461] [client 20.100.186.147:34097] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adr-SXf97wYZje1ep_Od5gAAANY"]
[Sun Apr 12 10:07:06.281960 2026] [:error] [pid 26567:tid 26570] [client 20.100.186.147:34084] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adr-SnhRpg6ptWFyFx1CRgAAAQE"]
[Sun Apr 12 10:07:06.918291 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:18225] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/"] [unique_id "adr-SnBlLnDOYuIykkhbqwAAAcc"]
[Sun Apr 12 10:07:07.763438 2026] [:error] [pid 25437:tid 25450] [client 20.100.186.147:19749] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adr-S3f97wYZje1ep_Od6AAAAMs"]
[Sun Apr 12 10:07:08.407633 2026] [:error] [pid 26567:tid 26587] [client 20.100.186.147:64589] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adr-THhRpg6ptWFyFx1CTQAAARI"]
[Sun Apr 12 10:07:09.060785 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:18190] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adr-TcxUaQZxT-e0YsBKnAAAAFY"]
[Sun Apr 12 10:07:09.713075 2026] [:error] [pid 25328:tid 25389] [client 20.100.186.147:60101] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/we.php"] [unique_id "adr-TcxUaQZxT-e0YsBKnwAAAFA"]
[Sun Apr 12 10:07:10.420592 2026] [:error] [pid 26600:tid 26629] [client 20.100.186.147:20021] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adr-Tu1YwAZiXhQKLYq4IQAAAYA"]
[Sun Apr 12 10:07:11.423600 2026] [:error] [pid 26600:tid 26631] [client 20.100.186.147:57586] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adr-T-1YwAZiXhQKLYq4JAAAAYI"]
[Sun Apr 12 10:07:12.177180 2026] [:error] [pid 25328:tid 25365] [client 20.100.186.147:7640] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adr-UMxUaQZxT-e0YsBKowAAAEE"]
[Sun Apr 12 10:07:12.776044 2026] [:error] [pid 25329:tid 25399] [client 20.100.186.147:53020] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alpha.php"] [unique_id "adr-UGdcIYsS8Iyaj11q-gAAAI0"]
[Sun Apr 12 10:07:13.507926 2026] [:error] [pid 25327:tid 25356] [client 20.100.186.147:20013] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adr-US6h2tZEVJo9JFJ7_wAAABQ"]
[Sun Apr 12 10:07:14.233106 2026] [:error] [pid 26567:tid 26575] [client 20.100.186.147:8097] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adr-UnhRpg6ptWFyFx1CaAAAAQY"]
[Sun Apr 12 10:07:14.986287 2026] [:error] [pid 25327:tid 25350] [client 20.100.186.147:58836] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adr-Ui6h2tZEVJo9JFJ8AQAAAA4"]
[Sun Apr 12 10:07:15.611080 2026] [:error] [pid 25437:tid 25463] [client 20.100.186.147:15511] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/makeasmtp.php"] [unique_id "adr-U3f97wYZje1ep_Od7wAAANg"]
[Sun Apr 12 10:07:16.412772 2026] [:error] [pid 25328:tid 25401] [client 20.100.186.147:15512] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adr-VMxUaQZxT-e0YsBKpQAAAFU"]
[Sun Apr 12 10:07:17.471189 2026] [:error] [pid 25437:tid 25450] [client 20.100.186.147:20324] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adr-VXf97wYZje1ep_Od9wAAAMs"]
[Sun Apr 12 10:07:18.370465 2026] [:error] [pid 25437:tid 25441] [client 20.100.186.147:57544] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adr-Vnf97wYZje1ep_OeAAAAAMI"]
[Sun Apr 12 10:07:19.364086 2026] [:error] [pid 25437:tid 25462] [client 20.100.186.147:46953] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-michan.php"] [unique_id "adr-V3f97wYZje1ep_OeCwAAANc"]
[Sun Apr 12 10:07:20.554193 2026] [:error] [pid 25327:tid 25342] [client 20.100.186.147:18197] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adr-WC6h2tZEVJo9JFJ8BQAAAAY"]
[Sun Apr 12 10:07:21.351674 2026] [:error] [pid 25329:tid 25399] [client 20.100.186.147:15547] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adr-WWdcIYsS8Iyaj11rBgAAAI0"]
[Sun Apr 12 10:07:22.579443 2026] [:error] [pid 25328:tid 25367] [client 20.100.186.147:18183] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adr-WsxUaQZxT-e0YsBKrgAAAEM"]
[Sun Apr 12 10:07:23.353892 2026] [:error] [pid 25329:tid 25414] [client 20.100.186.147:64621] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-the.php"] [unique_id "adr-W2dcIYsS8Iyaj11rCQAAAJc"]
[Sun Apr 12 10:07:24.185920 2026] [:error] [pid 26567:tid 26583] [client 20.100.186.147:48365] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adr-XHhRpg6ptWFyFx1CgAAAAQ4"]
[Sun Apr 12 10:07:24.973404 2026] [:error] [pid 26599:tid 26604] [client 20.100.186.147:34050] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adr-XHG89LXoQbk_rwCCLwAAAUI"]
[Sun Apr 12 10:07:25.928886 2026] [:error] [pid 25328:tid 25405] [client 20.100.186.147:58848] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adr-XcxUaQZxT-e0YsBKuQAAAFc"]
[Sun Apr 12 10:07:27.218516 2026] [:error] [pid 25328:tid 25377] [client 20.100.186.147:16816] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adr-X8xUaQZxT-e0YsBKugAAAEo"]
[Sun Apr 12 10:07:28.459307 2026] [:error] [pid 25437:tid 25460] [client 20.100.186.147:59288] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "adr-YHf97wYZje1ep_OeSAAAANU"]
[Sun Apr 12 10:07:29.628705 2026] [:error] [pid 25437:tid 25446] [client 20.100.186.147:7639] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/BDKR28WP.php"] [unique_id "adr-YXf97wYZje1ep_OeUAAAAMc"]
[Sun Apr 12 10:07:30.452880 2026] [:error] [pid 25327:tid 25353] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sun Apr 12 10:07:31.071566 2026] [:error] [pid 25327:tid 25338] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Sun Apr 12 10:07:31.382544 2026] [:error] [pid 25327:tid 25345] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Apr 12 10:07:31.998009 2026] [:error] [pid 25327:tid 25351] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Sun Apr 12 10:07:32.522852 2026] [:error] [pid 25327:tid 25350] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Apr 12 10:07:32.787760 2026] [:error] [pid 25327:tid 25337] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Apr 12 10:07:33.052453 2026] [:error] [pid 25327:tid 25340] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Sun Apr 12 10:07:33.322462 2026] [:error] [pid 25327:tid 25353] [client 20.100.186.147:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Sun Apr 12 10:07:34.480140 2026] [:error] [pid 25327:tid 25353] [client 20.100.186.147:54003] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adr-Zi6h2tZEVJo9JFJ8HwAAABE"]
[Sun Apr 12 10:07:35.288316 2026] [:error] [pid 25329:tid 25378] [client 20.100.186.147:17776] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adr-Z2dcIYsS8Iyaj11rCwAAAII"]
[Sun Apr 12 10:07:36.106736 2026] [:error] [pid 26600:tid 26638] [client 20.100.186.147:33362] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adr-aO1YwAZiXhQKLYq4LgAAAYk"]
[Sun Apr 12 10:07:36.953502 2026] [:error] [pid 26599:tid 26619] [client 20.100.186.147:33359] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/update/f35.php"] [unique_id "adr-aHG89LXoQbk_rwCCMQAAAVE"]
[Sun Apr 12 10:07:37.856918 2026] [:error] [pid 25328:tid 25398] [client 20.100.186.147:19243] [client 20.100.186.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adr-acxUaQZxT-e0YsBKxgAAAFQ"]
[Sun Apr 12 10:07:38.919427 2026] [:error] [pid 25328:tid 25401] [client 20.100.186.147:19783] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adr-asxUaQZxT-e0YsBKywAAAFU"]
[Sun Apr 12 10:07:39.814646 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:15351] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adr-a8xUaQZxT-e0YsBK0AAAAFY"]
[Sun Apr 12 10:07:40.379232 2026] [:error] [pid 26599:tid 26605] [client 20.100.186.147:15356] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adr-bHG89LXoQbk_rwCCNAAAAUM"]
[Sun Apr 12 10:07:41.159666 2026] [:error] [pid 60280:tid 60306] [client 20.100.186.147:7353] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f35.php"] [unique_id "adr-bXBlLnDOYuIykkhbxQAAAdg"]
[Sun Apr 12 10:07:42.190724 2026] [:error] [pid 60280:tid 60299] [client 20.100.186.147:7299] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adr-bnBlLnDOYuIykkhbywAAAdE"]
[Sun Apr 12 10:07:42.804968 2026] [:error] [pid 26567:tid 26572] [client 20.100.186.147:19812] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adr-bnhRpg6ptWFyFx1CiwAAAQM"]
[Sun Apr 12 10:07:43.576081 2026] [:error] [pid 25329:tid 25404] [client 20.100.186.147:46168] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adr-b2dcIYsS8Iyaj11rDgAAAJA"]
[Sun Apr 12 10:07:44.230588 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:7193] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adr-cHBlLnDOYuIykkhb0gAAAcc"]
[Sun Apr 12 10:07:45.360649 2026] [:error] [pid 26600:tid 26643] [client 20.100.186.147:46229] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adr-ce1YwAZiXhQKLYq4OAAAAY4"]
[Sun Apr 12 10:07:46.058307 2026] [:error] [pid 25328:tid 25383] [client 20.100.186.147:16845] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adr-csxUaQZxT-e0YsBK1QAAAE0"]
[Sun Apr 12 10:07:47.020173 2026] [:error] [pid 25437:tid 25439] [client 20.100.186.147:46165] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adr-c3f97wYZje1ep_OehQAAAMA"]
[Sun Apr 12 10:07:47.893642 2026] [:error] [pid 25437:tid 25459] [client 20.100.186.147:7202] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adr-c3f97wYZje1ep_OehwAAANQ"]
[Sun Apr 12 10:07:48.589571 2026] [:error] [pid 60280:tid 60302] [client 20.100.186.147:15348] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adr-dHBlLnDOYuIykkhb3AAAAdQ"]
[Sun Apr 12 10:07:49.928028 2026] [:error] [pid 25328:tid 25364] [client 20.100.186.147:19259] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adr-dcxUaQZxT-e0YsBK2QAAAEA"]
[Sun Apr 12 10:07:50.740069 2026] [:error] [pid 26600:tid 26638] [client 20.100.186.147:8191] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adr-du1YwAZiXhQKLYq4PAAAAYk"]
[Sun Apr 12 10:07:51.805490 2026] [:error] [pid 25327:tid 25351] [client 20.100.186.147:33348] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/prv8.php"] [unique_id "adr-dy6h2tZEVJo9JFJ8JAAAAA8"]
[Sun Apr 12 10:07:52.453419 2026] [:error] [pid 26600:tid 26652] [client 20.100.186.147:15305] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adr-eO1YwAZiXhQKLYq4PQAAAZc"]
[Sun Apr 12 10:07:53.351804 2026] [:error] [pid 60280:tid 60305] [client 20.100.186.147:7345] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adr-eXBlLnDOYuIykkhb5AAAAdc"]
[Sun Apr 12 10:07:54.174170 2026] [:error] [pid 60280:tid 60302] [client 20.100.186.147:17790] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adr-enBlLnDOYuIykkhb5gAAAdQ"]
[Sun Apr 12 10:07:54.973712 2026] [:error] [pid 60280:tid 60300] [client 20.100.186.147:7203] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/k.php"] [unique_id "adr-enBlLnDOYuIykkhb5wAAAdI"]
[Sun Apr 12 10:07:55.655345 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:20248] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adr-e3BlLnDOYuIykkhb6AAAAcc"]
[Sun Apr 12 10:07:56.387423 2026] [:error] [pid 26600:tid 26642] [client 20.100.186.147:8173] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adr-fO1YwAZiXhQKLYq4PwAAAY0"]
[Sun Apr 12 10:07:57.171651 2026] [:error] [pid 60280:tid 60293] [client 20.100.186.147:8138] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adr-fXBlLnDOYuIykkhb6wAAAcs"]
[Sun Apr 12 10:07:57.932669 2026] [:error] [pid 60280:tid 60291] [client 20.100.186.147:20255] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dev.php"] [unique_id "adr-fXBlLnDOYuIykkhb7gAAAck"]
[Sun Apr 12 10:07:58.569507 2026] [:error] [pid 60280:tid 60298] [client 20.100.186.147:7184] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adr-fnBlLnDOYuIykkhb8gAAAdA"]
[Sun Apr 12 10:07:59.399263 2026] [:error] [pid 25327:tid 25344] [client 20.100.186.147:19836] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adr-fy6h2tZEVJo9JFJ8JwAAAAg"]
[Sun Apr 12 10:08:00.229454 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:15330] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adr-gHBlLnDOYuIykkhb9QAAAcc"]
[Sun Apr 12 10:08:00.797216 2026] [:error] [pid 25328:tid 25408] [client 20.100.186.147:8171] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bal.php"] [unique_id "adr-gMxUaQZxT-e0YsBK5QAAAFg"]
[Sun Apr 12 10:08:01.444439 2026] [:error] [pid 60280:tid 60282] [client 20.100.186.147:19253] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adr-gXBlLnDOYuIykkhb9wAAAcA"]
[Sun Apr 12 10:08:02.203069 2026] [:error] [pid 60280:tid 60303] [client 20.100.186.147:14210] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adr-gnBlLnDOYuIykkhb-AAAAdU"]
[Sun Apr 12 10:08:02.905221 2026] [:error] [pid 26600:tid 26640] [client 20.100.186.147:46242] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adr-gu1YwAZiXhQKLYq4RAAAAYs"]
[Sun Apr 12 10:08:03.842602 2026] [:error] [pid 26600:tid 26644] [client 20.100.186.147:33358] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/in.php"] [unique_id "adr-g-1YwAZiXhQKLYq4RgAAAY8"]
[Sun Apr 12 10:08:04.818175 2026] [:error] [pid 25437:tid 25455] [client 20.100.186.147:20231] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adr-hHf97wYZje1ep_OemAAAANA"]
[Sun Apr 12 10:08:05.766039 2026] [:error] [pid 25328:tid 25367] [client 20.100.186.147:8186] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adr-hcxUaQZxT-e0YsBK9QAAAEM"]
[Sun Apr 12 10:08:06.684542 2026] [:error] [pid 25437:tid 25448] [client 20.100.186.147:33368] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adr-hnf97wYZje1ep_OemgAAAMk"]
[Sun Apr 12 10:08:07.932682 2026] [:error] [pid 25328:tid 25379] [client 20.100.186.147:7311] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gssdd.php"] [unique_id "adr-h8xUaQZxT-e0YsBK-gAAAEs"]
[Sun Apr 12 10:08:08.657195 2026] [:error] [pid 26599:tid 26612] [client 20.100.186.147:19794] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adr-iHG89LXoQbk_rwCCOgAAAUo"]
[Sun Apr 12 10:08:09.463108 2026] [:error] [pid 60280:tid 60286] [client 20.100.186.147:17762] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adr-iXBlLnDOYuIykkhcAgAAAcQ"]
[Sun Apr 12 10:08:10.103842 2026] [:error] [pid 26599:tid 26604] [client 20.100.186.147:46177] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adr-inG89LXoQbk_rwCCOwAAAUI"]
[Sun Apr 12 10:08:11.218419 2026] [:error] [pid 25437:tid 25451] [client 20.100.186.147:20261] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/motu.php"] [unique_id "adr-i3f97wYZje1ep_OenAAAAMw"]
[Sun Apr 12 10:08:12.478486 2026] [:error] [pid 60280:tid 60294] [client 20.100.186.147:16881] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adr-jHBlLnDOYuIykkhcCgAAAcw"]
[Sun Apr 12 10:08:13.655464 2026] [:error] [pid 25328:tid 25387] [client 20.100.186.147:7177] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adr-jcxUaQZxT-e0YsBLNQAAAE8"]
[Sun Apr 12 10:08:14.373881 2026] [:error] [pid 60280:tid 60284] [client 20.100.186.147:7323] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adr-jnBlLnDOYuIykkhcEgAAAcI"]
[Sun Apr 12 10:08:15.133600 2026] [:error] [pid 60280:tid 60296] [client 20.100.186.147:46239] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs1.php"] [unique_id "adr-j3BlLnDOYuIykkhcFQAAAc4"]
[Sun Apr 12 10:08:15.767753 2026] [:error] [pid 60280:tid 60302] [client 20.100.186.147:15318] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adr-j3BlLnDOYuIykkhcGQAAAdQ"]
[Sun Apr 12 10:08:16.600050 2026] [:error] [pid 25328:tid 25403] [client 20.100.186.147:17785] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adr-kMxUaQZxT-e0YsBLPQAAAFY"]
[Sun Apr 12 10:08:17.258347 2026] [:error] [pid 60280:tid 60304] [client 20.100.186.147:19835] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adr-kXBlLnDOYuIykkhcKAAAAdY"]
[Sun Apr 12 10:08:17.845281 2026] [:error] [pid 60280:tid 60305] [client 20.100.186.147:7336] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bengi.php"] [unique_id "adr-kXBlLnDOYuIykkhcLgAAAdc"]
[Sun Apr 12 10:08:18.506978 2026] [:error] [pid 26600:tid 26640] [client 20.100.186.147:20243] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr-ku1YwAZiXhQKLYq4bQAAAYs"]
[Sun Apr 12 10:08:19.152653 2026] [:error] [pid 25328:tid 25373] [client 20.100.186.147:46227] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr-k8xUaQZxT-e0YsBLPwAAAEg"]
[Sun Apr 12 10:08:19.818459 2026] [:error] [pid 25437:tid 25458] [client 20.100.186.147:46219] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr-k3f97wYZje1ep_OengAAANM"]
[Sun Apr 12 10:08:20.572454 2026] [:error] [pid 60280:tid 60292] [client 20.100.186.147:19813] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr-lHBlLnDOYuIykkhcQQAAAco"]
[Sun Apr 12 10:08:21.151008 2026] [:error] [pid 60280:tid 60284] [client 20.100.186.147:8157] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "adr-lXBlLnDOYuIykkhcRAAAAcI"]
[Sun Apr 12 10:08:21.839790 2026] [:error] [pid 60280:tid 60296] [client 20.100.186.147:17770] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "adr-lXBlLnDOYuIykkhcRwAAAc4"]
[Sun Apr 12 10:08:22.378323 2026] [:error] [pid 26600:tid 26635] [client 20.100.186.147:20245] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "adr-lu1YwAZiXhQKLYq4cQAAAYY"]
[Sun Apr 12 10:08:23.053908 2026] [:error] [pid 60280:tid 60290] [client 20.100.186.147:17749] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/axx.php"] [unique_id "adr-l3BlLnDOYuIykkhcUAAAAcg"]
[Sun Apr 12 10:08:23.740565 2026] [:error] [pid 60280:tid 60288] [client 20.100.186.147:15312] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adr-l3BlLnDOYuIykkhcUwAAAcY"]
[Sun Apr 12 10:08:24.376388 2026] [:error] [pid 60280:tid 60284] [client 20.100.186.147:7225] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adr-mHBlLnDOYuIykkhcVgAAAcI"]
[Sun Apr 12 10:08:25.033840 2026] [:error] [pid 25327:tid 25354] [client 20.100.186.147:19811] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adr-mS6h2tZEVJo9JFJ8UAAAABI"]
[Sun Apr 12 10:08:25.782020 2026] [:error] [pid 60280:tid 60291] [client 20.100.186.147:20253] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfashell.php"] [unique_id "adr-mXBlLnDOYuIykkhcWgAAAck"]
[Sun Apr 12 10:08:26.401316 2026] [:error] [pid 25328:tid 25375] [client 20.100.186.147:15349] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adr-msxUaQZxT-e0YsBLRQAAAEk"]
[Sun Apr 12 10:08:27.062391 2026] [:error] [pid 25328:tid 25385] [client 20.100.186.147:46175] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adr-m8xUaQZxT-e0YsBLSwAAAE4"]
[Sun Apr 12 10:08:27.690639 2026] [:error] [pid 25437:tid 25462] [client 20.100.186.147:46151] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adr-m3f97wYZje1ep_OeowAAANc"]
[Sun Apr 12 10:08:28.306707 2026] [:error] [pid 25328:tid 25408] [client 20.100.186.147:8162] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gettest.php"] [unique_id "adr-nMxUaQZxT-e0YsBLTgAAAFg"]
[Sun Apr 12 10:08:29.104221 2026] [:error] [pid 60280:tid 60304] [client 20.100.186.147:42684] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adr-nXBlLnDOYuIykkhcWwAAAdY"]
[Sun Apr 12 10:08:29.665610 2026] [:error] [pid 25328:tid 25379] [client 20.100.186.147:16835] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adr-ncxUaQZxT-e0YsBLVAAAAEs"]
[Sun Apr 12 10:08:30.344669 2026] [:error] [pid 25437:tid 25456] [client 20.100.186.147:8188] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adr-nnf97wYZje1ep_OeqwAAANE"]
[Sun Apr 12 10:08:30.968249 2026] [:error] [pid 26567:tid 26592] [client 20.100.186.147:7342] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adr-nnhRpg6ptWFyFx1CqgAAARc"]
[Sun Apr 12 10:08:31.656309 2026] [:error] [pid 26567:tid 26578] [client 20.100.186.147:16882] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adr-n3hRpg6ptWFyFx1CrAAAAQk"]
[Sun Apr 12 10:08:32.297795 2026] [:error] [pid 25437:tid 25462] [client 20.100.186.147:33363] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adr-oHf97wYZje1ep_OesAAAANc"]
[Sun Apr 12 10:08:32.904697 2026] [:error] [pid 60280:tid 60284] [client 20.100.186.147:8131] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file48.php"] [unique_id "adr-oHBlLnDOYuIykkhcYAAAAcI"]
[Sun Apr 12 10:08:33.555894 2026] [:error] [pid 60280:tid 60299] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Sun Apr 12 10:08:33.820224 2026] [:error] [pid 60280:tid 60304] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Apr 12 10:08:34.372084 2026] [:error] [pid 60280:tid 60306] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Apr 12 10:08:34.649080 2026] [:error] [pid 60280:tid 60284] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Sun Apr 12 10:08:34.911714 2026] [:error] [pid 60280:tid 60297] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Sun Apr 12 10:08:35.170705 2026] [:error] [pid 60280:tid 60289] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sun Apr 12 10:08:35.472478 2026] [:error] [pid 60280:tid 60301] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Apr 12 10:08:35.732481 2026] [:error] [pid 60280:tid 60296] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Sun Apr 12 10:08:36.001999 2026] [:error] [pid 60280:tid 60299] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Sun Apr 12 10:08:36.304127 2026] [:error] [pid 60280:tid 60303] [client 20.100.186.147:20246] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Sun Apr 12 10:08:36.583577 2026] [:error] [pid 60280:tid 60292] [client 20.100.186.147:20246] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adr-pHBlLnDOYuIykkhcdgAAAco"]
[Sun Apr 12 10:08:37.216495 2026] [:error] [pid 25328:tid 25379] [client 20.100.186.147:16838] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adr-pcxUaQZxT-e0YsBLXwAAAEs"]
[Sun Apr 12 10:08:37.939442 2026] [:error] [pid 60280:tid 60287] [client 20.100.186.147:33378] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adr-pXBlLnDOYuIykkhceAAAAcU"]
[Sun Apr 12 10:08:38.806500 2026] [:error] [pid 26600:tid 26644] [client 20.100.186.147:8149] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adr-pu1YwAZiXhQKLYq4eQAAAY8"]
[Sun Apr 12 10:08:39.447849 2026] [:error] [pid 26600:tid 26629] [client 20.100.186.147:19206] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adr-p-1YwAZiXhQKLYq4egAAAYA"]
[Sun Apr 12 10:08:40.227496 2026] [:error] [pid 26567:tid 26590] [client 20.100.186.147:33385] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adr-qHhRpg6ptWFyFx1CsAAAARU"]
[Sun Apr 12 10:08:40.914092 2026] [:error] [pid 60280:tid 60294] [client 20.100.186.147:46270] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adr-qHBlLnDOYuIykkhcfAAAAcw"]
[Sun Apr 12 10:08:41.606967 2026] [:error] [pid 25327:tid 25353] [client 20.100.186.147:15301] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x1da.php"] [unique_id "adr-qS6h2tZEVJo9JFJ8VAAAABE"]
[Sun Apr 12 10:08:42.239325 2026] [:error] [pid 26599:tid 26619] [client 20.100.186.147:19809] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adr-qnG89LXoQbk_rwCCZwAAAVE"]
[Sun Apr 12 10:08:42.824046 2026] [:error] [pid 60280:tid 60301] [client 20.100.186.147:46225] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adr-qnBlLnDOYuIykkhcgQAAAdM"]
[Sun Apr 12 10:08:43.431743 2026] [:error] [pid 25328:tid 25373] [client 20.100.186.147:33404] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adr-q8xUaQZxT-e0YsBLYwAAAEg"]
[Sun Apr 12 10:08:44.210296 2026] [:error] [pid 25328:tid 25380] [client 20.100.186.147:7324] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adr-rMxUaQZxT-e0YsBLZQAAAEw"]
[Sun Apr 12 10:08:44.769031 2026] [:error] [pid 25437:tid 25463] [client 20.100.186.147:33393] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adr-rHf97wYZje1ep_OetwAAANg"]
[Sun Apr 12 10:08:45.452801 2026] [:error] [pid 25437:tid 25453] [client 20.100.186.147:19801] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adr-rXf97wYZje1ep_OeuAAAAM4"]
[Sun Apr 12 10:08:46.131204 2026] [:error] [pid 25437:tid 25461] [client 20.100.186.147:7191] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adr-rnf97wYZje1ep_OeuQAAANY"]
[Sun Apr 12 10:08:46.770062 2026] [:error] [pid 60280:tid 60286] [client 20.100.186.147:19235] [client 20.100.186.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/chosen.php"] [unique_id "adr-rnBlLnDOYuIykkhciAAAAcQ"]
[Sun Apr 12 10:52:16.442700 2026] [:error] [pid 25437:tid 25457] [client 118.148.153.68:1552] [client 118.148.153.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.148.153.68, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adsI4Hf97wYZje1ep_OtWgAAANI"]
[Sun Apr 12 10:52:16.450478 2026] [:error] [pid 25437:tid 25457] [client 118.148.153.68:1552] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 12 13:40:50.015449 2026] [:error] [pid 25437:tid 25458] [client 1.55.255.1:13805] [client 1.55.255.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.255.1, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adswYnf97wYZje1ep_PfpAAAANM"]
[Sun Apr 12 13:40:50.020443 2026] [:error] [pid 25437:tid 25458] [client 1.55.255.1:13805] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 12 15:26:24.165830 2026] [:error] [pid 26567:tid 26571] [client 41.223.116.246:64227] [client 41.223.116.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.223.116.246, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adtJIHhRpg6ptWFyFx1-4wAAAQI"]
[Sun Apr 12 15:26:24.178545 2026] [:error] [pid 26567:tid 26571] [client 41.223.116.246:64227] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 12 16:20:24.009519 2026] [:error] [pid 26567:tid 26585] [client 104.28.163.29:15585] [client 104.28.163.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "adtVyHhRpg6ptWFyFx2FpwAAARA"]
[Mon Apr 13 01:11:45.195465 2026] [:error] [pid 31606:tid 31725] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Apr 13 01:11:45.356992 2026] [:error] [pid 31606:tid 31707] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Mon Apr 13 01:11:45.518790 2026] [:error] [pid 31606:tid 31716] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Apr 13 01:11:45.681067 2026] [:error] [pid 31606:tid 31720] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Apr 13 01:11:45.842116 2026] [:error] [pid 31606:tid 31726] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Apr 13 01:11:46.003587 2026] [:error] [pid 31606:tid 31727] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Apr 13 01:11:46.166443 2026] [:error] [pid 31606:tid 31710] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 13 01:11:46.336461 2026] [:error] [pid 31606:tid 31717] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Mon Apr 13 01:11:46.666435 2026] [:error] [pid 31606:tid 31723] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Mon Apr 13 01:11:46.827730 2026] [:error] [pid 31606:tid 31719] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Mon Apr 13 01:11:46.988737 2026] [:error] [pid 31606:tid 31725] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Apr 13 01:11:47.171847 2026] [:error] [pid 31606:tid 31731] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Mon Apr 13 01:11:47.333633 2026] [:error] [pid 31606:tid 31716] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Apr 13 01:11:47.496273 2026] [:error] [pid 31606:tid 31708] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Mon Apr 13 01:11:47.657732 2026] [:error] [pid 31606:tid 31726] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Mon Apr 13 01:11:47.820363 2026] [:error] [pid 31606:tid 31713] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Apr 13 01:11:47.982508 2026] [:error] [pid 31606:tid 31721] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Apr 13 01:11:48.142479 2026] [:error] [pid 31606:tid 31729] [client 173.239.218.68:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Mon Apr 13 01:11:50.423402 2026] [:error] [pid 31606:tid 31721] [client 173.239.218.68:52995] [client 173.239.218.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "advSVj9vCsshNhLmCiBvGwAAAE8"]
[Mon Apr 13 01:11:51.254448 2026] [:error] [pid 31605:tid 31651] [client 173.239.218.55:49645] [client 173.239.218.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "advSV29Py-Y-9VQ02eGzGgAAAAg"]
[Mon Apr 13 01:12:20.274790 2026] [autoindex:error] [pid 31605:tid 31661] [client 173.239.218.36:49615] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 03:12:13.530500 2026] [:error] [pid 31605:tid 31648] [client 59.126.168.24:62127] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Mon Apr 13 03:12:18.655530 2026] [:error] [pid 31607:tid 31761] [client 59.126.168.24:62208] File does not exist: /usr/local/apache/htdocs/suspended-page/luuf.php
[Mon Apr 13 03:22:52.648276 2026] [:error] [pid 31607:tid 31752] [client 20.234.9.131:52709] File does not exist: /usr/local/apache/htdocs/suspended-page/hroxw.php
[Mon Apr 13 03:22:53.026593 2026] [:error] [pid 31607:tid 31755] [client 20.234.9.131:52709] File does not exist: /usr/local/apache/htdocs/suspended-page/rkszbxbh.php
[Mon Apr 13 03:22:53.532523 2026] [:error] [pid 31607:tid 31746] [client 20.234.9.131:52709] File does not exist: /usr/local/apache/htdocs/suspended-page/hanna1337.php
[Mon Apr 13 03:22:54.017076 2026] [:error] [pid 31607:tid 31743] [client 20.234.9.131:52709] File does not exist: /usr/local/apache/htdocs/suspended-page/gt.php
[Mon Apr 13 03:22:55.710272 2026] [:error] [pid 31607:tid 31750] [client 20.234.9.131:52709] File does not exist: /usr/local/apache/htdocs/suspended-page/rk1.php
[Mon Apr 13 03:22:56.588002 2026] [:error] [pid 31607:tid 31737] [client 20.234.9.131:52709] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex1.php"] [unique_id "advxEGjn_I-KYTWngjJRhAAAAIA"]
[Mon Apr 13 03:22:59.745723 2026] [:error] [pid 31607:tid 31738] [client 20.234.9.131:53281] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex1.php"] [unique_id "advxE2jn_I-KYTWngjJRiQAAAIE"]
[Mon Apr 13 03:23:05.136490 2026] [:error] [pid 31607:tid 31740] [client 20.234.9.131:52193] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex1.php"] [unique_id "advxGWjn_I-KYTWngjJRlgAAAIM"]
[Mon Apr 13 03:23:07.528937 2026] [:error] [pid 31607:tid 31750] [client 20.234.9.131:53267] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/alfa-rex1.php"] [unique_id "advxG2jn_I-KYTWngjJRmAAAAI0"]
[Mon Apr 13 03:23:11.682526 2026] [:error] [pid 54671:tid 54696] [client 20.234.9.131:52200] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/suck.php"] [unique_id "advxH2yJMmaONUqF0tCzpAAAARU"]
[Mon Apr 13 03:23:39.927128 2026] [:error] [pid 31605:tid 31657] [client 20.234.9.131:53278] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hikudpno.php"] [unique_id "advxO29Py-Y-9VQ02eHjYgAAAA4"]
[Mon Apr 13 03:23:43.280175 2026] [:error] [pid 31607:tid 31751] [client 20.234.9.131:52177] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/hikudpno.php"] [unique_id "advxP2jn_I-KYTWngjJRvAAAAI4"]
[Mon Apr 13 03:23:45.733431 2026] [:error] [pid 31606:tid 31711] [client 20.234.9.131:52636] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/moon.php"] [unique_id "advxQT9vCsshNhLmCiCRxQAAAEU"]
[Mon Apr 13 03:23:46.983788 2026] [:error] [pid 32010:tid 32017] [client 20.234.9.131:52721] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/moon.php"] [unique_id "advxQg0nq-t9pXyV1fzE9AAAAMU"]
[Mon Apr 13 03:23:48.918011 2026] [:error] [pid 31605:tid 31653] [client 20.234.9.131:53954] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/moon.php"] [unique_id "advxRG9Py-Y-9VQ02eHjcwAAAAo"]
[Mon Apr 13 03:23:50.599153 2026] [:error] [pid 32010:tid 32025] [client 20.234.9.131:53320] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/moon.php"] [unique_id "advxRg0nq-t9pXyV1fzE-wAAAM0"]
[Mon Apr 13 03:23:53.822194 2026] [:error] [pid 31606:tid 31720] [client 20.234.9.131:52624] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sure.php"] [unique_id "advxST9vCsshNhLmCiCRzAAAAE4"]
[Mon Apr 13 03:23:55.082992 2026] [:error] [pid 54671:tid 54698] [client 20.234.9.131:53979] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sure.php"] [unique_id "advxS2yJMmaONUqF0tC0FQAAARc"]
[Mon Apr 13 03:23:57.291465 2026] [:error] [pid 31605:tid 31655] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/sure.php
[Mon Apr 13 03:23:57.565802 2026] [:error] [pid 31605:tid 31664] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/zoo.php
[Mon Apr 13 03:23:57.823877 2026] [:error] [pid 31605:tid 31643] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/4563.php
[Mon Apr 13 03:23:58.073168 2026] [:error] [pid 31605:tid 31654] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/wunaivpl.php
[Mon Apr 13 03:23:58.522128 2026] [:error] [pid 31605:tid 31644] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/reune.php
[Mon Apr 13 03:23:58.772357 2026] [:error] [pid 31605:tid 31648] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/dw.php
[Mon Apr 13 03:23:59.428944 2026] [:error] [pid 31605:tid 31653] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/shellx.php
[Mon Apr 13 03:24:00.248324 2026] [:error] [pid 31605:tid 31649] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Mon Apr 13 03:24:00.496886 2026] [:error] [pid 31605:tid 31647] [client 20.234.9.131:50301] File does not exist: /usr/local/apache/htdocs/suspended-page/lnexugel.php
[Mon Apr 13 03:24:00.927696 2026] [:error] [pid 31605:tid 31646] [client 20.234.9.131:50301] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/online.php"] [unique_id "advxUG9Py-Y-9VQ02eHjhAAAAAM"]
[Mon Apr 13 03:24:04.759477 2026] [:error] [pid 32010:tid 32030] [client 20.234.9.131:55179] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/online.php"] [unique_id "advxVA0nq-t9pXyV1fzFDgAAANI"]
[Mon Apr 13 03:24:09.099489 2026] [:error] [pid 54671:tid 54685] [client 20.234.9.131:55236] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/online.php"] [unique_id "advxWWyJMmaONUqF0tC0QgAAAQo"]
[Mon Apr 13 03:24:12.240187 2026] [:error] [pid 31607:tid 31750] [client 20.234.9.131:52729] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/online.php"] [unique_id "advxXGjn_I-KYTWngjJR0gAAAI0"]
[Mon Apr 13 03:24:19.137900 2026] [:error] [pid 54671:tid 54690] [client 20.234.9.131:53368] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up-kon.php"] [unique_id "advxY2yJMmaONUqF0tC0XwAAAQ8"]
[Mon Apr 13 03:24:22.343155 2026] [:error] [pid 31607:tid 31755] [client 20.234.9.131:53266] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up-kon.php"] [unique_id "advxZmjn_I-KYTWngjJR2QAAAJI"]
[Mon Apr 13 03:24:23.686822 2026] [:error] [pid 32010:tid 32015] [client 20.234.9.131:53363] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up-kon.php"] [unique_id "advxZw0nq-t9pXyV1fzFTgAAAMM"]
[Mon Apr 13 03:24:25.430360 2026] [:error] [pid 32010:tid 32031] [client 20.234.9.131:53920] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/up-kon.php"] [unique_id "advxaQ0nq-t9pXyV1fzFVQAAANM"]
[Mon Apr 13 03:24:26.482804 2026] [:error] [pid 54671:tid 54685] [client 20.234.9.131:53938] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/word.php"] [unique_id "advxamyJMmaONUqF0tC0gwAAAQo"]
[Mon Apr 13 03:24:29.254499 2026] [:error] [pid 31607:tid 31756] [client 20.234.9.131:36096] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/word.php"] [unique_id "advxbWjn_I-KYTWngjJR3QAAAJM"]
[Mon Apr 13 03:24:30.820129 2026] [:error] [pid 54671:tid 54683] [client 20.234.9.131:55248] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/word.php"] [unique_id "advxbmyJMmaONUqF0tC0lgAAAQg"]
[Mon Apr 13 03:24:32.909318 2026] [:error] [pid 32010:tid 32026] [client 20.234.9.131:55820] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/word.php"] [unique_id "advxcA0nq-t9pXyV1fzFWgAAAM4"]
[Mon Apr 13 03:24:44.822088 2026] [:error] [pid 29662:tid 29675] [client 20.234.9.131:53908] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jcsonquo.php"] [unique_id "advxfEdwIN-g-lMQUKr2NwAAAAc"]
[Mon Apr 13 03:24:46.807874 2026] [:error] [pid 29749:tid 29760] [client 20.234.9.131:54700] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jcsonquo.php"] [unique_id "advxfg0_fmrGwaR9DebqjgAAAMg"]
[Mon Apr 13 03:24:55.610918 2026] [:error] [pid 29664:tid 29733] [client 20.234.9.131:55201] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jcsonquo.php"] [unique_id "advxh1tqncBlrAm0UGgy3wAAAIs"]
[Mon Apr 13 03:24:59.156836 2026] [:error] [pid 29867:tid 29890] [client 20.234.9.131:55886] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/termps.php"] [unique_id "advxi1pRxgV1HXhfS5QAnwAAABM"]
[Mon Apr 13 03:25:01.533295 2026] [:error] [pid 29953:tid 29957] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/termps.php
[Mon Apr 13 03:25:02.762912 2026] [:error] [pid 29953:tid 29959] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Mon Apr 13 03:25:03.011820 2026] [:error] [pid 29953:tid 29960] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/rin.php
[Mon Apr 13 03:25:03.349975 2026] [:error] [pid 29953:tid 29962] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/packages.php
[Mon Apr 13 03:25:03.842900 2026] [:error] [pid 29953:tid 29956] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Mon Apr 13 03:25:04.089841 2026] [:error] [pid 29953:tid 29963] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/vbv.php
[Mon Apr 13 03:25:04.379289 2026] [:error] [pid 29953:tid 29964] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/mk.php
[Mon Apr 13 03:25:04.672861 2026] [:error] [pid 29953:tid 29965] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/moderation.php
[Mon Apr 13 03:25:04.921930 2026] [:error] [pid 29953:tid 29968] [client 20.234.9.131:55929] File does not exist: /usr/local/apache/htdocs/suspended-page/simple-shell.php
[Mon Apr 13 03:25:30.113503 2026] [:error] [pid 30432:tid 30520] [client 20.234.9.131:3531] File does not exist: /usr/local/apache/htdocs/suspended-page/2Vu80QG.php
[Mon Apr 13 03:25:30.373358 2026] [:error] [pid 30432:tid 30525] [client 20.234.9.131:3531] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bsr.php"] [unique_id "advxqvv_BOY8son7cLmR3QAAAJg"]
[Mon Apr 13 03:25:32.859503 2026] [:error] [pid 30432:tid 30515] [client 20.234.9.131:3715] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bsr.php"] [unique_id "advxrPv_BOY8son7cLmR5gAAAI4"]
[Mon Apr 13 03:25:37.336694 2026] [:error] [pid 30431:tid 30492] [client 20.234.9.131:3217] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bsr.php"] [unique_id "advxsVbSTPssf6SS919-KAAAAFI"]
[Mon Apr 13 03:26:07.786819 2026] [:error] [pid 30532:tid 30547] [client 20.234.9.131:3456] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "advxz5GQr51YhOFElOsdHQAAAMs"]
[Mon Apr 13 03:26:13.969106 2026] [:error] [pid 30432:tid 30515] [client 20.234.9.131:54592] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "advx1fv_BOY8son7cLmSdwAAAI4"]
[Mon Apr 13 03:26:16.332425 2026] [:error] [pid 30430:tid 30450] [client 20.234.9.131:3864] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "advx2Ln0S0M-vj_lJadCMAAAAAM"]
[Mon Apr 13 03:26:20.070348 2026] [:error] [pid 30532:tid 30555] [client 20.234.9.131:3880] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ans.php"] [unique_id "advx3JGQr51YhOFElOsdbQAAANM"]
[Mon Apr 13 03:26:22.543665 2026] [:error] [pid 30430:tid 30465] [client 20.234.9.131:3901] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "advx3rn0S0M-vj_lJadCNQAAABI"]
[Mon Apr 13 03:26:24.400418 2026] [:error] [pid 30532:tid 30549] [client 20.234.9.131:3802] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "advx4JGQr51YhOFElOsdegAAAM0"]
[Mon Apr 13 03:26:26.096737 2026] [:error] [pid 30532:tid 30556] [client 20.234.9.131:26817] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "advx4pGQr51YhOFElOsdfwAAANQ"]
[Mon Apr 13 03:26:29.157031 2026] [:error] [pid 30532:tid 30555] [client 20.234.9.131:3934] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-tot.php"] [unique_id "advx5ZGQr51YhOFElOsdiwAAANM"]
[Mon Apr 13 03:26:31.894115 2026] [:error] [pid 30532:tid 30541] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/Core-wp.php
[Mon Apr 13 03:26:32.144564 2026] [:error] [pid 30532:tid 30560] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/src.php
[Mon Apr 13 03:26:32.653484 2026] [:error] [pid 30532:tid 30550] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/nxd.php
[Mon Apr 13 03:26:32.934826 2026] [:error] [pid 30532:tid 30544] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/payout.php
[Mon Apr 13 03:26:33.714412 2026] [:error] [pid 30532:tid 30555] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/uxquidwa.php
[Mon Apr 13 03:26:33.964728 2026] [:error] [pid 30532:tid 30536] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/combined.php
[Mon Apr 13 03:26:34.225268 2026] [:error] [pid 30532:tid 30538] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/mari.php
[Mon Apr 13 03:26:34.944878 2026] [:error] [pid 30532:tid 30556] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/kodox.php
[Mon Apr 13 03:26:35.447771 2026] [:error] [pid 30532:tid 30550] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/ak47shell.php
[Mon Apr 13 03:26:35.706967 2026] [:error] [pid 30532:tid 30545] [client 20.234.9.131:3810] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Mon Apr 13 03:26:35.958957 2026] [:error] [pid 30532:tid 30543] [client 20.234.9.131:3810] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log404.php"] [unique_id "advx65GQr51YhOFElOsduQAAAMc"]
[Mon Apr 13 03:26:39.926338 2026] [:error] [pid 30532:tid 30536] [client 20.234.9.131:29356] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log404.php"] [unique_id "advx75GQr51YhOFElOsdwgAAAMA"]
[Mon Apr 13 03:26:41.208269 2026] [:error] [pid 30532:tid 30555] [client 20.234.9.131:24329] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log404.php"] [unique_id "advx8ZGQr51YhOFElOsdzAAAANM"]
[Mon Apr 13 03:26:45.361270 2026] [:error] [pid 30430:tid 30459] [client 20.234.9.131:4012] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/log404.php"] [unique_id "advx9bn0S0M-vj_lJadCZAAAAAw"]
[Mon Apr 13 03:26:46.862519 2026] [:error] [pid 30532:tid 30560] [client 20.234.9.131:57788] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wh.php"] [unique_id "advx9pGQr51YhOFElOsd2wAAANg"]
[Mon Apr 13 03:26:49.243061 2026] [:error] [pid 30431:tid 30496] [client 20.234.9.131:3389] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wh.php"] [unique_id "advx-VbSTPssf6SS919-rAAAAFY"]
[Mon Apr 13 03:26:54.273884 2026] [:error] [pid 30432:tid 30510] [client 20.234.9.131:3336] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wh.php"] [unique_id "advx_vv_BOY8son7cLmS7AAAAIk"]
[Mon Apr 13 03:26:57.274880 2026] [:error] [pid 30532:tid 30536] [client 20.234.9.131:58926] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wh.php"] [unique_id "advyAZGQr51YhOFElOsd5QAAAMA"]
[Mon Apr 13 03:27:00.799950 2026] [:error] [pid 30532:tid 30547] [client 20.234.9.131:26122] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/luf.php"] [unique_id "advyBJGQr51YhOFElOsd-QAAAMs"]
[Mon Apr 13 03:27:07.561108 2026] [:error] [pid 30431:tid 30486] [client 20.234.9.131:58273] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/luf.php"] [unique_id "advyC1bSTPssf6SS919-4AAAAEw"]
[Mon Apr 13 03:27:13.891570 2026] [:error] [pid 30532:tid 30537] [client 20.234.9.131:29398] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs2.php"] [unique_id "advyEZGQr51YhOFElOseNAAAAME"]
[Mon Apr 13 03:27:18.021061 2026] [:error] [pid 30432:tid 30520] [client 20.234.9.131:3347] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs2.php"] [unique_id "advyFvv_BOY8son7cLmTHAAAAJM"]
[Mon Apr 13 03:27:22.074771 2026] [:error] [pid 30431:tid 30493] [client 20.234.9.131:58966] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs2.php"] [unique_id "advyGlbSTPssf6SS919-_gAAAFM"]
[Mon Apr 13 03:27:24.045068 2026] [:error] [pid 30432:tid 30523] [client 20.234.9.131:26139] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bs2.php"] [unique_id "advyHPv_BOY8son7cLmTIgAAAJY"]
[Mon Apr 13 03:27:25.672021 2026] [:error] [pid 30532:tid 30539] [client 20.234.9.131:4002] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wf.php"] [unique_id "advyHZGQr51YhOFElOseUwAAAMM"]
[Mon Apr 13 03:27:31.830738 2026] [:error] [pid 30532:tid 30539] [client 20.234.9.131:43983] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wf.php"] [unique_id "advyI5GQr51YhOFElOsebwAAAMM"]
[Mon Apr 13 03:27:33.132133 2026] [:error] [pid 30532:tid 30559] [client 20.234.9.131:58328] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wf.php"] [unique_id "advyJZGQr51YhOFElOseeQAAANc"]
[Mon Apr 13 03:27:34.630716 2026] [:error] [pid 30532:tid 30552] [client 20.234.9.131:30065] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wf.php"] [unique_id "advyJpGQr51YhOFElOsehAAAANA"]
[Mon Apr 13 03:27:36.742603 2026] [:error] [pid 30432:tid 30523] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/vcard.php
[Mon Apr 13 03:27:37.288390 2026] [:error] [pid 30432:tid 30506] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/ddgg.php
[Mon Apr 13 03:27:37.871446 2026] [:error] [pid 30432:tid 30520] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Mon Apr 13 03:27:38.265760 2026] [:error] [pid 30432:tid 30525] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/pu.php
[Mon Apr 13 03:27:38.559318 2026] [:error] [pid 30432:tid 30524] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/docs.php
[Mon Apr 13 03:27:39.101827 2026] [:error] [pid 30432:tid 30504] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/gaza.php
[Mon Apr 13 03:27:39.352303 2026] [:error] [pid 30432:tid 30521] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/XX.php
[Mon Apr 13 03:27:39.609857 2026] [:error] [pid 30432:tid 30515] [client 20.234.9.131:44022] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Mon Apr 13 03:27:40.164465 2026] [:error] [pid 30432:tid 30512] [client 20.234.9.131:44022] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/cloud.php"] [unique_id "advyLPv_BOY8son7cLmTUwAAAIs"]
[Mon Apr 13 03:27:42.668865 2026] [:error] [pid 30431:tid 30474] [client 20.234.9.131:24327] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/cloud.php"] [unique_id "advyLlbSTPssf6SS919_IwAAAEA"]
[Mon Apr 13 03:27:45.372020 2026] [:error] [pid 30430:tid 30457] [client 20.234.9.131:44025] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/cloud.php"] [unique_id "advyMbn0S0M-vj_lJadCvQAAAAo"]
[Mon Apr 13 03:27:50.933414 2026] [:error] [pid 30430:tid 30452] [client 20.234.9.131:24340] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.tmb/cloud.php"] [unique_id "advyNrn0S0M-vj_lJadCzQAAAAU"]
[Mon Apr 13 03:27:53.777842 2026] [:error] [pid 30432:tid 30521] [client 20.234.9.131:59460] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/owlmailer.php"] [unique_id "advyOfv_BOY8son7cLmTbQAAAJQ"]
[Mon Apr 13 03:28:14.804362 2026] [:error] [pid 30532:tid 30540] [client 20.234.9.131:58925] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "advyTpGQr51YhOFElOse6gAAAMQ"]
[Mon Apr 13 03:28:16.078819 2026] [:error] [pid 30532:tid 30555] [client 20.234.9.131:59472] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "advyUJGQr51YhOFElOse8gAAANM"]
[Mon Apr 13 03:28:19.329978 2026] [:error] [pid 30431:tid 30481] [client 20.234.9.131:45519] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "advyU1bSTPssf6SS919_WQAAAEc"]
[Mon Apr 13 03:28:22.746322 2026] [:error] [pid 30532:tid 30547] [client 20.234.9.131:45548] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/F0x.php"] [unique_id "advyVpGQr51YhOFElOsfDAAAAMs"]
[Mon Apr 13 03:28:24.400830 2026] [:error] [pid 30532:tid 30555] [client 20.234.9.131:60053] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rlpc.php"] [unique_id "advyWJGQr51YhOFElOsfEgAAANM"]
[Mon Apr 13 03:28:26.247835 2026] [:error] [pid 30432:tid 30517] [client 20.234.9.131:39592] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rlpc.php"] [unique_id "advyWvv_BOY8son7cLmTqQAAAJA"]
[Mon Apr 13 03:28:27.423847 2026] [:error] [pid 30430:tid 30471] [client 20.234.9.131:40209] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rlpc.php"] [unique_id "advyW7n0S0M-vj_lJadDCQAAABg"]
[Mon Apr 13 03:28:29.117282 2026] [:error] [pid 30532:tid 30557] [client 20.234.9.131:37948] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rlpc.php"] [unique_id "advyXZGQr51YhOFElOsfLgAAANU"]
[Mon Apr 13 03:28:30.444881 2026] [:error] [pid 30432:tid 30510] [client 20.234.9.131:38567] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p.php7"] [unique_id "advyXvv_BOY8son7cLmTswAAAIk"]
[Mon Apr 13 03:28:31.138251 2026] [:error] [pid 30430:tid 30460] [client 20.234.9.131:45531] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p.php7"] [unique_id "advyX7n0S0M-vj_lJadDDwAAAA0"]
[Mon Apr 13 03:28:34.537603 2026] [:error] [pid 30431:tid 30480] [client 20.234.9.131:38898] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p.php7"] [unique_id "advyYlbSTPssf6SS919_cgAAAEY"]
[Mon Apr 13 03:28:36.501229 2026] [:error] [pid 30532:tid 30547] [client 20.234.9.131:41354] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-p.php7"] [unique_id "advyZJGQr51YhOFElOsfXgAAAMs"]
[Mon Apr 13 03:28:39.985162 2026] [:error] [pid 30432:tid 30517] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/sale.php
[Mon Apr 13 03:28:40.234994 2026] [:error] [pid 30432:tid 30525] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/ran.php
[Mon Apr 13 03:28:40.486692 2026] [:error] [pid 30432:tid 30507] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/k90.php
[Mon Apr 13 03:28:40.767637 2026] [:error] [pid 30432:tid 30505] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Mon Apr 13 03:28:41.104577 2026] [:error] [pid 30432:tid 30523] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Mon Apr 13 03:28:42.606507 2026] [:error] [pid 30432:tid 30523] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/133.php
[Mon Apr 13 03:28:42.859957 2026] [:error] [pid 30432:tid 30524] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/ssxsl.php
[Mon Apr 13 03:28:43.184816 2026] [:error] [pid 30432:tid 30521] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/AE5VAL.php
[Mon Apr 13 03:28:43.435200 2026] [:error] [pid 30432:tid 30525] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/gold.php
[Mon Apr 13 03:28:43.706316 2026] [:error] [pid 30432:tid 30503] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/gely.php
[Mon Apr 13 03:28:43.987331 2026] [:error] [pid 30432:tid 30507] [client 20.234.9.131:39555] File does not exist: /usr/local/apache/htdocs/suspended-page/xBrain.php
[Mon Apr 13 03:28:44.379949 2026] [:error] [pid 30432:tid 30504] [client 20.234.9.131:39555] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sagafif.php"] [unique_id "advybPv_BOY8son7cLmT1QAAAIM"]
[Mon Apr 13 03:28:45.831707 2026] [:error] [pid 30432:tid 30512] [client 20.234.9.131:36306] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sagafif.php"] [unique_id "advybfv_BOY8son7cLmT2AAAAIs"]
[Mon Apr 13 03:28:47.430979 2026] [:error] [pid 30432:tid 30522] [client 20.234.9.131:32162] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sagafif.php"] [unique_id "advyb_v_BOY8son7cLmT2wAAAJU"]
[Mon Apr 13 03:28:52.442845 2026] [:error] [pid 30432:tid 30512] [client 20.234.9.131:32750] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sagafif.php"] [unique_id "advydPv_BOY8son7cLmT4wAAAIs"]
[Mon Apr 13 03:29:03.773804 2026] [:error] [pid 30432:tid 30517] [client 20.234.9.131:47029] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trc.php"] [unique_id "advyf_v_BOY8son7cLmT_AAAAJA"]
[Mon Apr 13 03:29:04.977336 2026] [:error] [pid 30432:tid 30502] [client 20.234.9.131:32729] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trc.php"] [unique_id "advygPv_BOY8son7cLmUAQAAAIE"]
[Mon Apr 13 03:29:06.420623 2026] [:error] [pid 30532:tid 30548] [client 20.234.9.131:35707] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-trc.php"] [unique_id "advygpGQr51YhOFElOsfsgAAAMw"]
[Mon Apr 13 03:29:11.322616 2026] [:error] [pid 30532:tid 30536] [client 20.234.9.131:36851] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tesla1.php"] [unique_id "advyh5GQr51YhOFElOsfxwAAAMA"]
[Mon Apr 13 03:29:12.869298 2026] [:error] [pid 30432:tid 30509] [client 20.234.9.131:31201] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tesla1.php"] [unique_id "advyiPv_BOY8son7cLmUFAAAAIg"]
[Mon Apr 13 03:29:16.443129 2026] [:error] [pid 30432:tid 30525] [client 20.234.9.131:36861] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tesla1.php"] [unique_id "advyjPv_BOY8son7cLmUHgAAAJg"]
[Mon Apr 13 03:29:17.772685 2026] [:error] [pid 30432:tid 30511] [client 20.234.9.131:60055] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tesla1.php"] [unique_id "advyjfv_BOY8son7cLmUHwAAAIo"]
[Mon Apr 13 03:29:20.166916 2026] [:error] [pid 30532:tid 30546] [client 20.234.9.131:31212] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aks.php"] [unique_id "advykJGQr51YhOFElOsf6gAAAMo"]
[Mon Apr 13 03:29:25.234759 2026] [:error] [pid 30532:tid 30550] [client 20.234.9.131:60074] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aks.php"] [unique_id "advylZGQr51YhOFElOsf-wAAAM4"]
[Mon Apr 13 03:29:26.801087 2026] [:error] [pid 30532:tid 30556] [client 20.234.9.131:34224] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aks.php"] [unique_id "advylpGQr51YhOFElOsgAwAAANQ"]
[Mon Apr 13 03:29:28.475807 2026] [:error] [pid 30432:tid 30512] [client 20.234.9.131:54732] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/aks.php"] [unique_id "advymPv_BOY8son7cLmUOQAAAIs"]
[Mon Apr 13 03:29:29.500050 2026] [:error] [pid 30432:tid 30517] [client 20.234.9.131:60036] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pomo/l.php"] [unique_id "advymfv_BOY8son7cLmUPgAAAJA"]
[Mon Apr 13 03:29:30.947101 2026] [:error] [pid 30532:tid 30558] [client 20.234.9.131:45959] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pomo/l.php"] [unique_id "advympGQr51YhOFElOsgFAAAANY"]
[Mon Apr 13 03:29:31.904609 2026] [:error] [pid 30532:tid 30560] [client 20.234.9.131:40170] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pomo/l.php"] [unique_id "advym5GQr51YhOFElOsgHAAAANg"]
[Mon Apr 13 03:29:33.064706 2026] [:error] [pid 30432:tid 30516] [client 20.234.9.131:32757] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/pomo/l.php"] [unique_id "advynfv_BOY8son7cLmUSAAAAI8"]
[Mon Apr 13 03:29:35.340945 2026] [:error] [pid 30432:tid 30512] [client 20.234.9.131:35678] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ase.php"] [unique_id "advyn_v_BOY8son7cLmUVwAAAIs"]
[Mon Apr 13 03:29:38.232042 2026] [:error] [pid 30532:tid 30547] [client 20.234.9.131:32708] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ase.php"] [unique_id "advyopGQr51YhOFElOsgOwAAAMs"]
[Mon Apr 13 03:29:40.042633 2026] [:error] [pid 30430:tid 30465] [client 20.234.9.131:28038] [client 20.234.9.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ase.php"] [unique_id "advypLn0S0M-vj_lJadDfAAAABI"]
[Mon Apr 13 03:29:46.431760 2026] [:error] [pid 30532:tid 30536] [client 20.234.9.131:54729] File does not exist: /usr/local/apache/htdocs/suspended-page/ase.php
[Mon Apr 13 03:29:46.704295 2026] [:error] [pid 30532:tid 30546] [client 20.234.9.131:54729] File does not exist: /usr/local/apache/htdocs/suspended-page/ktgob.php
[Mon Apr 13 03:29:46.967631 2026] [:error] [pid 30532:tid 30545] [client 20.234.9.131:54729] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Mon Apr 13 03:29:47.216495 2026] [:error] [pid 30532:tid 30551] [client 20.234.9.131:54729] File does not exist: /usr/local/apache/htdocs/suspended-page/afile.php
[Mon Apr 13 03:29:47.477149 2026] [:error] [pid 30532:tid 30556] [client 20.234.9.131:54729] File does not exist: /usr/local/apache/htdocs/suspended-page/xBrain.php
[Mon Apr 13 03:29:47.757898 2026] [:error] [pid 30532:tid 30548] [client 20.234.9.131:54729] File does not exist: /usr/local/apache/htdocs/suspended-page/yunu.php
[Mon Apr 13 03:29:48.013699 2026] [:error] [pid 30532:tid 30558] [client 20.234.9.131:54729] File does not exist: /usr/local/apache/htdocs/suspended-page/lexy.php
[Mon Apr 13 05:27:25.017321 2026] [:error] [pid 11325:tid 11346] [client 20.104.245.70:57905] File does not exist: /usr/local/apache/htdocs/suspended-page/kma.php
[Mon Apr 13 05:27:25.225784 2026] [:error] [pid 11325:tid 11351] [client 20.104.245.70:57905] File does not exist: /usr/local/apache/htdocs/suspended-page/wpls.php
[Mon Apr 13 05:27:25.433986 2026] [:error] [pid 11325:tid 11331] [client 20.104.245.70:57905] File does not exist: /usr/local/apache/htdocs/suspended-page/i6z19N.php
[Mon Apr 13 05:27:25.640857 2026] [:error] [pid 11325:tid 11330] [client 20.104.245.70:57905] File does not exist: /usr/local/apache/htdocs/suspended-page/ssh3ll.php
[Mon Apr 13 05:27:25.845796 2026] [:error] [pid 11325:tid 11340] [client 20.104.245.70:57905] [client 20.104.245.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwOPeCGj3EEJtCwa0OHRwAAAQ0"]
[Mon Apr 13 05:27:26.255324 2026] [:error] [pid 34048:tid 34065] [client 20.104.245.70:56516] [client 20.104.245.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwOPvSiQ_PJjlY5EhzyVAAAAM8"]
[Mon Apr 13 05:27:26.665876 2026] [:error] [pid 11325:tid 11327] [client 20.104.245.70:57872] [client 20.104.245.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwOPuCGj3EEJtCwa0OHSAAAAQA"]
[Mon Apr 13 05:27:27.076099 2026] [:error] [pid 33943:tid 34030] [client 20.104.245.70:57955] [client 20.104.245.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwOP6yoXuZjocnxM5FjgAAAAJg"]
[Mon Apr 13 06:38:09.884738 2026] [:error] [pid 11325:tid 11328] [client 143.137.237.87:3770] [client 143.137.237.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.137.237.87, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adwe0eCGj3EEJtCwa0OsegAAAQE"]
[Mon Apr 13 06:38:09.890575 2026] [:error] [pid 11325:tid 11328] [client 143.137.237.87:3770] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Apr 13 07:43:57.188163 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:10237] File does not exist: /usr/local/apache/htdocs/suspended-page/ssh3ll.php
[Mon Apr 13 07:43:57.396374 2026] [:error] [pid 63406:tid 63423] [client 20.151.248.149:10237] File does not exist: /usr/local/apache/htdocs/suspended-page/kma.php
[Mon Apr 13 07:43:57.606945 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:10237] File does not exist: /usr/local/apache/htdocs/suspended-page/mjq.php
[Mon Apr 13 07:43:57.811616 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:10237] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adwuPbHZEIkQ0Zmgp5rkYgAAAM0"]
[Mon Apr 13 07:43:58.222917 2026] [:error] [pid 63406:tid 63417] [client 20.151.248.149:10115] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adwuPrHZEIkQ0Zmgp5rkZQAAAMY"]
[Mon Apr 13 07:43:58.761870 2026] [:error] [pid 63311:tid 63378] [client 20.151.248.149:10201] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adwuPqHjrGN1MqBCVFkR4wAAAIc"]
[Mon Apr 13 07:43:59.179931 2026] [:error] [pid 63310:tid 63350] [client 20.151.248.149:10127] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adwuP3oXpRU5ztmwPjKZZAAAAEY"]
[Mon Apr 13 07:43:59.665789 2026] [:error] [pid 63309:tid 63334] [client 20.151.248.149:10222] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adwuP0pIKZ10weXpf0WIIAAAABU"]
[Mon Apr 13 07:44:00.138967 2026] [:error] [pid 63309:tid 63316] [client 20.151.248.149:10116] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adwuQEpIKZ10weXpf0WIJQAAAAM"]
[Mon Apr 13 07:44:00.573986 2026] [:error] [pid 63311:tid 63379] [client 20.151.248.149:10194] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adwuQKHjrGN1MqBCVFkR5gAAAIg"]
[Mon Apr 13 07:44:01.040413 2026] [:error] [pid 63310:tid 63346] [client 20.151.248.149:10112] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adwuQXoXpRU5ztmwPjKZagAAAEI"]
[Mon Apr 13 07:44:01.995434 2026] [:error] [pid 63310:tid 63365] [client 20.151.248.149:10186] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwuQXoXpRU5ztmwPjKZbgAAAFU"]
[Mon Apr 13 07:44:02.696411 2026] [:error] [pid 63310:tid 63362] [client 20.151.248.149:10181] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwuQnoXpRU5ztmwPjKZcQAAAFI"]
[Mon Apr 13 07:44:04.425855 2026] [:error] [pid 63309:tid 63325] [client 20.151.248.149:10234] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwuREpIKZ10weXpf0WILwAAAAw"]
[Mon Apr 13 07:44:05.101035 2026] [:error] [pid 63406:tid 63417] [client 20.151.248.149:10163] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adwuRbHZEIkQ0Zmgp5rkawAAAMY"]
[Mon Apr 13 12:40:59.427020 2026] [:error] [pid 63406:tid 63425] [client 20.151.248.149:47099] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adxz27HZEIkQ0Zmgp5qAtwAAAM4"]
[Mon Apr 13 12:41:00.494029 2026] [:error] [pid 63406:tid 63420] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Mon Apr 13 12:41:00.702032 2026] [:error] [pid 63406:tid 63413] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/mamzi.php
[Mon Apr 13 12:41:00.911933 2026] [:error] [pid 63406:tid 63416] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/lef.php
[Mon Apr 13 12:41:01.127267 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/new2.php
[Mon Apr 13 12:41:01.365661 2026] [:error] [pid 63406:tid 63411] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/fallbackapi.php
[Mon Apr 13 12:41:01.599033 2026] [:error] [pid 63406:tid 63431] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-0fsdhv.php
[Mon Apr 13 12:41:01.829894 2026] [:error] [pid 63406:tid 63427] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/rnenu.php
[Mon Apr 13 12:41:02.111980 2026] [:error] [pid 63406:tid 63435] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/congeree.php
[Mon Apr 13 12:41:02.321423 2026] [:error] [pid 63406:tid 63419] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Mon Apr 13 12:41:02.530220 2026] [:error] [pid 63406:tid 63414] [client 20.151.248.149:47095] File does not exist: /usr/local/apache/htdocs/suspended-page/jatuh.php
[Mon Apr 13 12:41:02.735213 2026] [:error] [pid 63406:tid 63432] [client 20.151.248.149:47095] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "adxz3rHZEIkQ0Zmgp5qAyAAAANU"]
[Mon Apr 13 12:41:05.119988 2026] [:error] [pid 63310:tid 63347] [client 20.151.248.149:47057] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "adxz4XoXpRU5ztmwPjLz5AAAAEM"]
[Mon Apr 13 12:41:06.182596 2026] [:error] [pid 7228:tid 7248] [client 20.151.248.149:47101] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "adxz4gEnn1dQrOSHHNWwrQAAARI"]
[Mon Apr 13 12:41:06.872965 2026] [:error] [pid 7228:tid 7239] [client 20.151.248.149:47096] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/green.php"] [unique_id "adxz4gEnn1dQrOSHHNWwrwAAAQk"]
[Mon Apr 13 12:41:07.550846 2026] [:error] [pid 57183:tid 57191] [client 20.151.248.149:47074] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/multirole.php"] [unique_id "adxz4zDO3t8R5NaxzYQ1MgAAAUY"]
[Mon Apr 13 12:41:08.066668 2026] [:error] [pid 63311:tid 63395] [client 20.151.248.149:47090] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/multirole.php"] [unique_id "adxz5KHjrGN1MqBCVFmESAAAAJg"]
[Mon Apr 13 12:41:09.104329 2026] [:error] [pid 63310:tid 63344] [client 20.151.248.149:47089] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/multirole.php"] [unique_id "adxz5XoXpRU5ztmwPjLz6QAAAEA"]
[Mon Apr 13 12:41:09.701491 2026] [:error] [pid 63311:tid 63382] [client 20.151.248.149:46983] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/multirole.php"] [unique_id "adxz5aHjrGN1MqBCVFmESwAAAIs"]
[Mon Apr 13 12:41:10.246444 2026] [:error] [pid 63310:tid 63361] [client 20.151.248.149:47055] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adxz5noXpRU5ztmwPjLz7gAAAFE"]
[Mon Apr 13 12:41:10.900764 2026] [:error] [pid 7228:tid 7249] [client 20.151.248.149:47085] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adxz5gEnn1dQrOSHHNWwugAAARM"]
[Mon Apr 13 12:41:11.679631 2026] [:error] [pid 7228:tid 7233] [client 20.151.248.149:46981] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adxz5wEnn1dQrOSHHNWwvQAAAQM"]
[Mon Apr 13 12:41:13.127791 2026] [:error] [pid 63310:tid 63367] [client 20.151.248.149:47017] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/RIP.php"] [unique_id "adxz6XoXpRU5ztmwPjLz9AAAAFc"]
[Mon Apr 13 12:41:15.315890 2026] [:error] [pid 63310:tid 63368] [client 20.151.248.149:46986] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adxz63oXpRU5ztmwPjLz9wAAAFg"]
[Mon Apr 13 12:41:17.604363 2026] [:error] [pid 63310:tid 63355] [client 20.151.248.149:47049] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adxz7XoXpRU5ztmwPjLz-QAAAEs"]
[Mon Apr 13 12:41:18.611537 2026] [:error] [pid 63406:tid 63430] [client 20.151.248.149:47075] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adxz7rHZEIkQ0Zmgp5qA0gAAANM"]
[Mon Apr 13 12:41:20.090977 2026] [:error] [pid 63310:tid 63358] [client 20.151.248.149:47059] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-act.php"] [unique_id "adxz8HoXpRU5ztmwPjLz_QAAAE4"]
[Mon Apr 13 12:41:21.742526 2026] [:error] [pid 63311:tid 63392] [client 20.151.248.149:47062] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cobaini.php"] [unique_id "adxz8aHjrGN1MqBCVFmEXQAAAJU"]
[Mon Apr 13 12:41:22.356498 2026] [:error] [pid 63309:tid 63337] [client 20.151.248.149:47067] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cobaini.php"] [unique_id "adxz8kpIKZ10weXpf0XS-wAAABg"]
[Mon Apr 13 12:41:22.952785 2026] [:error] [pid 63310:tid 63351] [client 20.151.248.149:47042] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cobaini.php"] [unique_id "adxz8noXpRU5ztmwPjL0AAAAAEc"]
[Mon Apr 13 12:41:23.807508 2026] [:error] [pid 63406:tid 63417] [client 20.151.248.149:46931] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cobaini.php"] [unique_id "adxz87HZEIkQ0Zmgp5qA2QAAAMY"]
[Mon Apr 13 12:41:24.543198 2026] [:error] [pid 63311:tid 63383] [client 20.151.248.149:47103] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mmp.php"] [unique_id "adxz9KHjrGN1MqBCVFmEYQAAAIw"]
[Mon Apr 13 12:41:25.090710 2026] [:error] [pid 57183:tid 57189] [client 20.151.248.149:47044] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mmp.php"] [unique_id "adxz9TDO3t8R5NaxzYQ1TAAAAUQ"]
[Mon Apr 13 12:41:25.802470 2026] [:error] [pid 63406:tid 63420] [client 20.151.248.149:47046] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mmp.php"] [unique_id "adxz9bHZEIkQ0Zmgp5qA4AAAAMk"]
[Mon Apr 13 12:41:26.886555 2026] [:error] [pid 7228:tid 7231] [client 20.151.248.149:47066] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mmp.php"] [unique_id "adxz9gEnn1dQrOSHHNWwzwAAAQE"]
[Mon Apr 13 12:41:27.728561 2026] [:error] [pid 7228:tid 7249] [client 20.151.248.149:46998] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adxz9wEnn1dQrOSHHNWw0wAAARM"]
[Mon Apr 13 12:41:28.798327 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:47054] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adxz-LHZEIkQ0Zmgp5qA4wAAAMc"]
[Mon Apr 13 12:41:29.975818 2026] [:error] [pid 63310:tid 63359] [client 20.151.248.149:47084] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adxz-XoXpRU5ztmwPjL0BQAAAE8"]
[Mon Apr 13 12:41:31.233826 2026] [:error] [pid 63310:tid 63346] [client 20.151.248.149:47097] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sf.php"] [unique_id "adxz-3oXpRU5ztmwPjL0BwAAAEI"]
[Mon Apr 13 12:41:32.234749 2026] [:error] [pid 63310:tid 63354] [client 20.151.248.149:47100] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adxz_HoXpRU5ztmwPjL0CQAAAEo"]
[Mon Apr 13 12:41:33.457821 2026] [:error] [pid 63310:tid 63355] [client 20.151.248.149:47052] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adxz_XoXpRU5ztmwPjL0CwAAAEs"]
[Mon Apr 13 12:41:34.236320 2026] [:error] [pid 63310:tid 63357] [client 20.151.248.149:47102] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adxz_noXpRU5ztmwPjL0DgAAAE0"]
[Mon Apr 13 12:41:34.867884 2026] [:error] [pid 63310:tid 63360] [client 20.151.248.149:46994] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xozx.php"] [unique_id "adxz_noXpRU5ztmwPjL0EgAAAFA"]
[Mon Apr 13 12:41:35.416450 2026] [:error] [pid 63310:tid 63346] [client 20.151.248.149:47011] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clque.php"] [unique_id "adxz_3oXpRU5ztmwPjL0FgAAAEI"]
[Mon Apr 13 12:41:36.184709 2026] [:error] [pid 57183:tid 57190] [client 20.151.248.149:46988] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clque.php"] [unique_id "adx0ADDO3t8R5NaxzYQ1WgAAAUU"]
[Mon Apr 13 12:41:36.741760 2026] [:error] [pid 63309:tid 63317] [client 20.151.248.149:47040] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clque.php"] [unique_id "adx0AEpIKZ10weXpf0XTCAAAAAQ"]
[Mon Apr 13 12:41:37.377179 2026] [:error] [pid 63309:tid 63313] [client 20.151.248.149:46990] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/clque.php"] [unique_id "adx0AUpIKZ10weXpf0XTCQAAAAA"]
[Mon Apr 13 12:41:38.017802 2026] [:error] [pid 63311:tid 63388] [client 20.151.248.149:47094] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adx0AqHjrGN1MqBCVFmEcAAAAJE"]
[Mon Apr 13 12:41:38.469936 2026] [:error] [pid 7228:tid 7244] [client 20.151.248.149:47048] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adx0AgEnn1dQrOSHHNWw3wAAAQ4"]
[Mon Apr 13 12:41:38.965151 2026] [:error] [pid 57183:tid 57188] [client 20.151.248.149:46924] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adx0AjDO3t8R5NaxzYQ1XAAAAUM"]
[Mon Apr 13 12:41:39.973407 2026] [:error] [pid 57183:tid 57203] [client 20.151.248.149:47038] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/albrt.php"] [unique_id "adx0AzDO3t8R5NaxzYQ1XwAAAVI"]
[Mon Apr 13 12:41:40.647636 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:47026] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahaoi.php"] [unique_id "adx0BLHZEIkQ0Zmgp5qA8gAAAM8"]
[Mon Apr 13 12:41:41.220817 2026] [:error] [pid 63309:tid 63326] [client 20.151.248.149:47064] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahaoi.php"] [unique_id "adx0BUpIKZ10weXpf0XTDQAAAA0"]
[Mon Apr 13 12:41:42.047905 2026] [:error] [pid 63310:tid 63365] [client 20.151.248.149:47018] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahaoi.php"] [unique_id "adx0BnoXpRU5ztmwPjL0HwAAAFU"]
[Mon Apr 13 12:41:43.079536 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:47092] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahaoi.php"] [unique_id "adx0BwEnn1dQrOSHHNWw6QAAARU"]
[Mon Apr 13 12:41:43.706323 2026] [:error] [pid 7228:tid 7252] [client 20.151.248.149:47079] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bogles.php"] [unique_id "adx0BwEnn1dQrOSHHNWw7gAAARY"]
[Mon Apr 13 12:41:44.510886 2026] [:error] [pid 63311:tid 63375] [client 20.151.248.149:47063] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bogles.php"] [unique_id "adx0CKHjrGN1MqBCVFmEfAAAAIQ"]
[Mon Apr 13 12:41:45.453543 2026] [:error] [pid 63309:tid 63331] [client 20.151.248.149:47080] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bogles.php"] [unique_id "adx0CUpIKZ10weXpf0XTEQAAABI"]
[Mon Apr 13 12:41:46.213125 2026] [:error] [pid 63310:tid 63359] [client 20.151.248.149:47083] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bogles.php"] [unique_id "adx0CnoXpRU5ztmwPjL0IgAAAE8"]
[Mon Apr 13 12:41:46.912448 2026] [:error] [pid 63406:tid 63411] [client 20.151.248.149:47007] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adx0CrHZEIkQ0Zmgp5qA9QAAAMA"]
[Mon Apr 13 12:41:47.824068 2026] [:error] [pid 63311:tid 63391] [client 20.151.248.149:47086] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adx0C6HjrGN1MqBCVFmEgAAAAJQ"]
[Mon Apr 13 12:41:48.454655 2026] [:error] [pid 63311:tid 63378] [client 20.151.248.149:46925] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adx0DKHjrGN1MqBCVFmEggAAAIc"]
[Mon Apr 13 12:41:49.076329 2026] [:error] [pid 63309:tid 63324] [client 20.151.248.149:46985] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxx.php"] [unique_id "adx0DUpIKZ10weXpf0XTGgAAAAs"]
[Mon Apr 13 12:41:49.941987 2026] [:error] [pid 7228:tid 7234] [client 20.151.248.149:47068] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adx0DQEnn1dQrOSHHNWw_wAAAQQ"]
[Mon Apr 13 12:41:50.902136 2026] [:error] [pid 63406:tid 63435] [client 20.151.248.149:46980] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adx0DrHZEIkQ0Zmgp5qA_gAAANg"]
[Mon Apr 13 12:41:51.433223 2026] [:error] [pid 63406:tid 63419] [client 20.151.248.149:47005] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adx0D7HZEIkQ0Zmgp5qA_wAAAMg"]
[Mon Apr 13 12:41:52.388940 2026] [:error] [pid 7228:tid 7232] [client 20.151.248.149:46945] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/s.php"] [unique_id "adx0EAEnn1dQrOSHHNWxAwAAAQI"]
[Mon Apr 13 12:41:54.070283 2026] [:error] [pid 7228:tid 7240] [client 20.151.248.149:46989] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unloathness.php"] [unique_id "adx0EgEnn1dQrOSHHNWxCQAAAQo"]
[Mon Apr 13 12:41:55.651125 2026] [:error] [pid 63310:tid 63344] [client 20.151.248.149:47051] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unloathness.php"] [unique_id "adx0E3oXpRU5ztmwPjL0KAAAAEA"]
[Mon Apr 13 12:41:57.052829 2026] [:error] [pid 63310:tid 63348] [client 20.151.248.149:47082] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unloathness.php"] [unique_id "adx0FXoXpRU5ztmwPjL0LQAAAEQ"]
[Mon Apr 13 12:41:59.919932 2026] [:error] [pid 63309:tid 63317] [client 20.151.248.149:47069] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/unloathness.php"] [unique_id "adx0F0pIKZ10weXpf0XTHwAAAAQ"]
[Mon Apr 13 12:42:02.015817 2026] [:error] [pid 63406:tid 63432] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/doo.php
[Mon Apr 13 12:42:02.565248 2026] [:error] [pid 63406:tid 63422] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/x123.php
[Mon Apr 13 12:42:02.778127 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Mon Apr 13 12:42:03.024085 2026] [:error] [pid 63406:tid 63430] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/greateb.php
[Mon Apr 13 12:42:03.232815 2026] [:error] [pid 63406:tid 63416] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Mon Apr 13 12:42:03.457451 2026] [:error] [pid 63406:tid 63428] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/mjq.php
[Mon Apr 13 12:42:03.695799 2026] [:error] [pid 63406:tid 63421] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/bjeni.php
[Mon Apr 13 12:42:04.026938 2026] [:error] [pid 63406:tid 63412] [client 20.151.248.149:47010] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/export.php"] [unique_id "adx0HLHZEIkQ0Zmgp5qBDQAAAME"]
[Mon Apr 13 12:42:04.879893 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:46923] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/export.php"] [unique_id "adx0HAEnn1dQrOSHHNWxHwAAARU"]
[Mon Apr 13 12:42:05.393139 2026] [:error] [pid 63309:tid 63324] [client 20.151.248.149:47093] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/export.php"] [unique_id "adx0HUpIKZ10weXpf0XTKAAAAAs"]
[Mon Apr 13 12:42:06.266143 2026] [:error] [pid 7228:tid 7254] [client 20.151.248.149:47023] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/export.php"] [unique_id "adx0HgEnn1dQrOSHHNWxJwAAARg"]
[Mon Apr 13 12:42:07.163506 2026] [:error] [pid 57183:tid 57208] [client 20.151.248.149:47034] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adx0HzDO3t8R5NaxzYQ1eAAAAVc"]
[Mon Apr 13 12:42:07.904528 2026] [:error] [pid 63311:tid 63375] [client 20.151.248.149:46933] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adx0H6HjrGN1MqBCVFmEnwAAAIQ"]
[Mon Apr 13 12:42:08.539848 2026] [:error] [pid 7228:tid 7238] [client 20.151.248.149:46949] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adx0IAEnn1dQrOSHHNWxLQAAAQg"]
[Mon Apr 13 12:42:09.290160 2026] [:error] [pid 63406:tid 63420] [client 20.151.248.149:47037] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tymi.php"] [unique_id "adx0IbHZEIkQ0Zmgp5qBDgAAAMk"]
[Mon Apr 13 12:42:09.724030 2026] [:error] [pid 57183:tid 57201] [client 20.151.248.149:47076] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "adx0ITDO3t8R5NaxzYQ1fQAAAVA"]
[Mon Apr 13 12:42:10.204694 2026] [:error] [pid 57183:tid 57204] [client 20.151.248.149:47098] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "adx0IjDO3t8R5NaxzYQ1gQAAAVM"]
[Mon Apr 13 12:42:10.679095 2026] [:error] [pid 57183:tid 57186] [client 20.151.248.149:47045] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "adx0IjDO3t8R5NaxzYQ1ggAAAUE"]
[Mon Apr 13 12:42:11.289636 2026] [:error] [pid 63311:tid 63393] [client 20.151.248.149:46996] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rrr.php"] [unique_id "adx0I6HjrGN1MqBCVFmEpAAAAJY"]
[Mon Apr 13 12:42:11.873061 2026] [:error] [pid 63311:tid 63390] [client 20.151.248.149:47013] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adx0I6HjrGN1MqBCVFmEpgAAAJM"]
[Mon Apr 13 12:42:12.323165 2026] [:error] [pid 57183:tid 57193] [client 20.151.248.149:47020] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adx0JDDO3t8R5NaxzYQ1jgAAAUg"]
[Mon Apr 13 12:42:12.850314 2026] [:error] [pid 57183:tid 57194] [client 20.151.248.149:46934] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adx0JDDO3t8R5NaxzYQ1kQAAAUk"]
[Mon Apr 13 12:42:13.274360 2026] [:error] [pid 57183:tid 57197] [client 20.151.248.149:46863] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/jp.php"] [unique_id "adx0JTDO3t8R5NaxzYQ1kwAAAUw"]
[Mon Apr 13 12:42:13.810338 2026] [:error] [pid 57183:tid 57207] [client 20.151.248.149:47047] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adx0JTDO3t8R5NaxzYQ1mQAAAVY"]
[Mon Apr 13 12:42:14.314706 2026] [:error] [pid 63311:tid 63375] [client 20.151.248.149:47015] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adx0JqHjrGN1MqBCVFmEqwAAAIQ"]
[Mon Apr 13 12:42:14.738560 2026] [:error] [pid 57183:tid 57203] [client 20.151.248.149:47077] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adx0JjDO3t8R5NaxzYQ1ngAAAVI"]
[Mon Apr 13 12:42:15.302849 2026] [:error] [pid 57183:tid 57188] [client 20.151.248.149:46984] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/gdn.php"] [unique_id "adx0JzDO3t8R5NaxzYQ1oQAAAUM"]
[Mon Apr 13 12:42:16.140653 2026] [:error] [pid 57183:tid 57200] [client 20.151.248.149:46969] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-wlx.php"] [unique_id "adx0KDDO3t8R5NaxzYQ1pAAAAU8"]
[Mon Apr 13 12:42:16.777149 2026] [:error] [pid 57183:tid 57194] [client 20.151.248.149:47041] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-wlx.php"] [unique_id "adx0KDDO3t8R5NaxzYQ1pwAAAUk"]
[Mon Apr 13 12:42:17.333230 2026] [:error] [pid 63309:tid 63322] [client 20.151.248.149:46995] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-wlx.php"] [unique_id "adx0KUpIKZ10weXpf0XTLwAAAAk"]
[Mon Apr 13 12:42:17.893321 2026] [:error] [pid 63309:tid 63313] [client 20.151.248.149:47021] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-wlx.php"] [unique_id "adx0KUpIKZ10weXpf0XTNQAAAAA"]
[Mon Apr 13 12:42:18.379439 2026] [:error] [pid 63406:tid 63412] [client 20.151.248.149:47060] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zvz89.php"] [unique_id "adx0KrHZEIkQ0Zmgp5qBHgAAAME"]
[Mon Apr 13 12:42:18.899770 2026] [:error] [pid 57183:tid 57199] [client 20.151.248.149:47088] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zvz89.php"] [unique_id "adx0KjDO3t8R5NaxzYQ1rgAAAU4"]
[Mon Apr 13 12:42:20.067135 2026] [:error] [pid 63406:tid 63411] [client 20.151.248.149:47081] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zvz89.php"] [unique_id "adx0LLHZEIkQ0Zmgp5qBIAAAAMA"]
[Mon Apr 13 12:42:20.687045 2026] [:error] [pid 63311:tid 63390] [client 20.151.248.149:47031] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zvz89.php"] [unique_id "adx0LKHjrGN1MqBCVFmErAAAAJM"]
[Mon Apr 13 12:42:21.266224 2026] [:error] [pid 63406:tid 63434] [client 20.151.248.149:47027] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adx0LbHZEIkQ0Zmgp5qBJwAAANc"]
[Mon Apr 13 12:42:21.979514 2026] [:error] [pid 63406:tid 63413] [client 20.151.248.149:46918] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adx0LbHZEIkQ0Zmgp5qBKQAAAMI"]
[Mon Apr 13 12:42:22.747733 2026] [:error] [pid 57183:tid 57199] [client 20.151.248.149:47036] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adx0LjDO3t8R5NaxzYQ1uQAAAU4"]
[Mon Apr 13 12:42:23.410457 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:47016] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/i6z19N.php"] [unique_id "adx0LwEnn1dQrOSHHNWxOAAAAQw"]
[Mon Apr 13 12:42:24.603850 2026] [:error] [pid 7228:tid 7243] [client 20.151.248.149:47053] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl9.php"] [unique_id "adx0MAEnn1dQrOSHHNWxQgAAAQ0"]
[Mon Apr 13 12:42:25.855077 2026] [:error] [pid 57183:tid 57197] [client 20.151.248.149:46952] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl9.php"] [unique_id "adx0MTDO3t8R5NaxzYQ1wQAAAUw"]
[Mon Apr 13 12:42:26.836583 2026] [:error] [pid 63406:tid 63430] [client 20.151.248.149:46873] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl9.php"] [unique_id "adx0MrHZEIkQ0Zmgp5qBLwAAANM"]
[Mon Apr 13 12:42:27.600562 2026] [:error] [pid 7228:tid 7245] [client 20.151.248.149:47071] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xl9.php"] [unique_id "adx0MwEnn1dQrOSHHNWxUwAAAQ8"]
[Mon Apr 13 12:42:28.421456 2026] [:error] [pid 63406:tid 63428] [client 20.151.248.149:47091] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "adx0NLHZEIkQ0Zmgp5qBNAAAANE"]
[Mon Apr 13 12:42:29.197331 2026] [:error] [pid 7228:tid 7250] [client 20.151.248.149:47003] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "adx0NQEnn1dQrOSHHNWxWwAAARQ"]
[Mon Apr 13 12:42:29.635229 2026] [:error] [pid 63406:tid 63416] [client 20.151.248.149:46982] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "adx0NbHZEIkQ0Zmgp5qBNgAAAMU"]
[Mon Apr 13 12:42:30.240573 2026] [:error] [pid 7228:tid 7231] [client 20.151.248.149:46861] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/asd67.php"] [unique_id "adx0NgEnn1dQrOSHHNWxXQAAAQE"]
[Mon Apr 13 12:42:30.773859 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:46993] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adx0NgEnn1dQrOSHHNWxXgAAAQw"]
[Mon Apr 13 12:42:31.307482 2026] [:error] [pid 63309:tid 63335] [client 20.151.248.149:46915] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adx0N0pIKZ10weXpf0XTQAAAABY"]
[Mon Apr 13 12:42:31.933325 2026] [:error] [pid 63310:tid 63355] [client 20.151.248.149:46979] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adx0N3oXpRU5ztmwPjL0TwAAAEs"]
[Mon Apr 13 12:42:32.405483 2026] [:error] [pid 63310:tid 63346] [client 20.151.248.149:47072] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ccu.php"] [unique_id "adx0OHoXpRU5ztmwPjL0UQAAAEI"]
[Mon Apr 13 12:42:32.969903 2026] [:error] [pid 63311:tid 63379] [client 20.151.248.149:46992] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-image.php"] [unique_id "adx0OKHjrGN1MqBCVFmEyAAAAIg"]
[Mon Apr 13 12:42:33.900101 2026] [:error] [pid 63309:tid 63329] [client 20.151.248.149:46928] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-image.php"] [unique_id "adx0OUpIKZ10weXpf0XTQQAAABA"]
[Mon Apr 13 12:42:34.850941 2026] [:error] [pid 63406:tid 63411] [client 20.151.248.149:46974] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-image.php"] [unique_id "adx0OrHZEIkQ0Zmgp5qBPgAAAMA"]
[Mon Apr 13 12:42:35.557255 2026] [:error] [pid 63406:tid 63427] [client 20.151.248.149:46937] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-wp-image.php"] [unique_id "adx0O7HZEIkQ0Zmgp5qBQAAAANA"]
[Mon Apr 13 12:42:36.439762 2026] [:error] [pid 63309:tid 63319] [client 20.151.248.149:46903] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4sd6kt.php"] [unique_id "adx0PEpIKZ10weXpf0XTQgAAAAY"]
[Mon Apr 13 12:42:36.944640 2026] [:error] [pid 63309:tid 63323] [client 20.151.248.149:47073] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4sd6kt.php"] [unique_id "adx0PEpIKZ10weXpf0XTQwAAAAo"]
[Mon Apr 13 12:42:37.945470 2026] [:error] [pid 57183:tid 57200] [client 20.151.248.149:47004] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4sd6kt.php"] [unique_id "adx0PTDO3t8R5NaxzYQ10AAAAU8"]
[Mon Apr 13 12:42:43.893534 2026] [:error] [pid 63309:tid 63316] [client 20.151.248.149:47039] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-4sd6kt.php"] [unique_id "adx0Q0pIKZ10weXpf0XTSwAAAAM"]
[Mon Apr 13 12:43:27.844839 2026] [:error] [pid 63309:tid 63319] [client 20.151.248.149:46877] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/disagrsxr.php"] [unique_id "adx0b0pIKZ10weXpf0XTZgAAAAY"]
[Mon Apr 13 12:43:41.140988 2026] [:error] [pid 63310:tid 63356] [client 20.151.248.149:46987] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adx0fXoXpRU5ztmwPjL0hgAAAEw"]
[Mon Apr 13 12:43:41.837318 2026] [:error] [pid 63309:tid 63333] [client 20.151.248.149:46855] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adx0fUpIKZ10weXpf0XTawAAABQ"]
[Mon Apr 13 12:43:42.556964 2026] [:error] [pid 57183:tid 57208] [client 20.151.248.149:46977] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adx0fjDO3t8R5NaxzYQ2gAAAAVc"]
[Mon Apr 13 12:43:43.127277 2026] [:error] [pid 63310:tid 63361] [client 20.151.248.149:46991] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa1.php"] [unique_id "adx0f3oXpRU5ztmwPjL0hwAAAFE"]
[Mon Apr 13 12:43:43.603971 2026] [:error] [pid 63310:tid 63346] [client 20.151.248.149:46913] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7W.php"] [unique_id "adx0f3oXpRU5ztmwPjL0iAAAAEI"]
[Mon Apr 13 12:43:44.143560 2026] [:error] [pid 63406:tid 63412] [client 20.151.248.149:46927] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7W.php"] [unique_id "adx0gLHZEIkQ0Zmgp5qCDwAAAME"]
[Mon Apr 13 12:43:44.873953 2026] [:error] [pid 57183:tid 57192] [client 20.151.248.149:46947] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7W.php"] [unique_id "adx0gDDO3t8R5NaxzYQ2ggAAAUc"]
[Mon Apr 13 12:43:45.516619 2026] [:error] [pid 57183:tid 57209] [client 20.151.248.149:47043] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/x7W.php"] [unique_id "adx0gTDO3t8R5NaxzYQ2hgAAAVg"]
[Mon Apr 13 12:43:46.141308 2026] [:error] [pid 57183:tid 57195] [client 20.151.248.149:47000] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adx0gjDO3t8R5NaxzYQ2igAAAUo"]
[Mon Apr 13 12:43:47.043008 2026] [:error] [pid 57183:tid 57187] [client 20.151.248.149:47065] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adx0gzDO3t8R5NaxzYQ2jQAAAUI"]
[Mon Apr 13 12:43:47.709013 2026] [:error] [pid 57183:tid 57190] [client 20.151.248.149:47022] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adx0gzDO3t8R5NaxzYQ2jwAAAUU"]
[Mon Apr 13 12:43:48.434712 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:46858] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/w.php"] [unique_id "adx0hLHZEIkQ0Zmgp5qCGQAAAM0"]
[Mon Apr 13 12:43:49.589113 2026] [:error] [pid 63310:tid 63364] [client 20.151.248.149:46922] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "adx0hXoXpRU5ztmwPjL0igAAAFQ"]
[Mon Apr 13 12:43:50.423978 2026] [:error] [pid 63309:tid 63331] [client 20.151.248.149:46859] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "adx0hkpIKZ10weXpf0XTbQAAABI"]
[Mon Apr 13 12:43:51.572413 2026] [:error] [pid 63309:tid 63328] [client 20.151.248.149:47087] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "adx0h0pIKZ10weXpf0XTcQAAAA8"]
[Mon Apr 13 12:43:52.078912 2026] [:error] [pid 57183:tid 57208] [client 20.151.248.149:46914] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Jcrop.php"] [unique_id "adx0iDDO3t8R5NaxzYQ2kwAAAVc"]
[Mon Apr 13 12:43:52.675734 2026] [:error] [pid 57183:tid 57207] [client 20.151.248.149:46972] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adx0iDDO3t8R5NaxzYQ2lQAAAVY"]
[Mon Apr 13 12:43:53.229990 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:46957] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adx0ibHZEIkQ0Zmgp5qCJwAAAM8"]
[Mon Apr 13 12:43:53.857661 2026] [:error] [pid 7228:tid 7241] [client 20.151.248.149:47056] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adx0iQEnn1dQrOSHHNWyJAAAAQs"]
[Mon Apr 13 12:43:54.785860 2026] [:error] [pid 57183:tid 57188] [client 20.151.248.149:47024] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ws88.php"] [unique_id "adx0ijDO3t8R5NaxzYQ2nAAAAUM"]
[Mon Apr 13 12:43:55.645138 2026] [:error] [pid 63406:tid 63420] [client 20.151.248.149:47006] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes4.php"] [unique_id "adx0i7HZEIkQ0Zmgp5qCMQAAAMk"]
[Mon Apr 13 12:43:56.281740 2026] [:error] [pid 7228:tid 7235] [client 20.151.248.149:46853] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes4.php"] [unique_id "adx0jAEnn1dQrOSHHNWyLwAAAQU"]
[Mon Apr 13 12:43:57.130936 2026] [:error] [pid 7228:tid 7253] [client 20.151.248.149:46854] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes4.php"] [unique_id "adx0jQEnn1dQrOSHHNWyNgAAARc"]
[Mon Apr 13 12:43:57.608878 2026] [:error] [pid 63406:tid 63434] [client 20.151.248.149:46953] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/themes4.php"] [unique_id "adx0jbHZEIkQ0Zmgp5qCNgAAANc"]
[Mon Apr 13 12:43:58.105930 2026] [:error] [pid 57183:tid 57185] [client 20.151.248.149:46871] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsc.php"] [unique_id "adx0jjDO3t8R5NaxzYQ2owAAAUA"]
[Mon Apr 13 12:43:58.682978 2026] [:error] [pid 63309:tid 63317] [client 20.151.248.149:47070] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsc.php"] [unique_id "adx0jkpIKZ10weXpf0XThgAAAAQ"]
[Mon Apr 13 12:43:59.149777 2026] [:error] [pid 57183:tid 57206] [client 20.151.248.149:46976] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsc.php"] [unique_id "adx0jzDO3t8R5NaxzYQ2qQAAAVU"]
[Mon Apr 13 12:43:59.611939 2026] [:error] [pid 57183:tid 57195] [client 20.151.248.149:47008] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wsc.php"] [unique_id "adx0jzDO3t8R5NaxzYQ2rAAAAUo"]
[Mon Apr 13 12:44:00.156168 2026] [:error] [pid 63311:tid 63390] [client 20.151.248.149:47033] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "adx0kKHjrGN1MqBCVFmFhAAAAJM"]
[Mon Apr 13 12:44:00.609687 2026] [:error] [pid 63406:tid 63431] [client 20.151.248.149:46852] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "adx0kLHZEIkQ0Zmgp5qCOQAAANQ"]
[Mon Apr 13 12:44:01.142781 2026] [:error] [pid 7228:tid 7247] [client 20.151.248.149:47009] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "adx0kQEnn1dQrOSHHNWyPAAAARE"]
[Mon Apr 13 12:44:02.253302 2026] [:error] [pid 7228:tid 7245] [client 20.151.248.149:47029] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/error_log.php"] [unique_id "adx0kgEnn1dQrOSHHNWyRQAAAQ8"]
[Mon Apr 13 12:44:02.996102 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:47012] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "adx0kgEnn1dQrOSHHNWySwAAAQw"]
[Mon Apr 13 12:44:03.676690 2026] [:error] [pid 7228:tid 7247] [client 20.151.248.149:46997] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "adx0kwEnn1dQrOSHHNWyTQAAARE"]
[Mon Apr 13 12:44:04.213771 2026] [:error] [pid 7228:tid 7231] [client 20.151.248.149:46944] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "adx0lAEnn1dQrOSHHNWyUwAAAQE"]
[Mon Apr 13 12:44:04.719685 2026] [:error] [pid 7228:tid 7252] [client 20.151.248.149:46956] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zeal.php"] [unique_id "adx0lAEnn1dQrOSHHNWyVwAAARY"]
[Mon Apr 13 12:44:05.158823 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:46942] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "adx0lQEnn1dQrOSHHNWyWQAAARU"]
[Mon Apr 13 12:44:05.691967 2026] [:error] [pid 57183:tid 57202] [client 20.151.248.149:47030] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "adx0lTDO3t8R5NaxzYQ2ugAAAVE"]
[Mon Apr 13 12:44:06.628886 2026] [:error] [pid 63406:tid 63435] [client 20.151.248.149:47014] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "adx0lrHZEIkQ0Zmgp5qCQAAAANg"]
[Mon Apr 13 12:44:07.206586 2026] [:error] [pid 57183:tid 57186] [client 20.151.248.149:46951] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bless5.php"] [unique_id "adx0lzDO3t8R5NaxzYQ2wQAAAUE"]
[Mon Apr 13 12:44:07.662822 2026] [:error] [pid 57183:tid 57202] [client 20.151.248.149:47035] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lolz.php"] [unique_id "adx0lzDO3t8R5NaxzYQ2xAAAAVE"]
[Mon Apr 13 12:44:08.118533 2026] [:error] [pid 63311:tid 63394] [client 20.151.248.149:46958] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lolz.php"] [unique_id "adx0mKHjrGN1MqBCVFmFiAAAAJc"]
[Mon Apr 13 12:44:08.636138 2026] [:error] [pid 63310:tid 63359] [client 20.151.248.149:46962] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lolz.php"] [unique_id "adx0mHoXpRU5ztmwPjL0zgAAAE8"]
[Mon Apr 13 12:44:09.129966 2026] [:error] [pid 63309:tid 63328] [client 20.151.248.149:46999] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lolz.php"] [unique_id "adx0mUpIKZ10weXpf0XTiwAAAA8"]
[Mon Apr 13 12:44:09.866440 2026] [:error] [pid 63406:tid 63431] [client 20.151.248.149:47061] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/d.php"] [unique_id "adx0mbHZEIkQ0Zmgp5qCSAAAANQ"]
[Mon Apr 13 12:44:11.144566 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:46819] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Mon Apr 13 12:44:12.365711 2026] [:error] [pid 63310:tid 63359] [client 20.151.248.149:46962] [client 20.151.248.149] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "147.182.243.3_7c880a5b0d14dd847c230c15238aee5e46c3ce0c"): Internal error (specific information not available) [hostname "aoswa.com.au"] [uri "/lolz.php"] [unique_id "adx0mHoXpRU5ztmwPjL0zgAAAE8"]
[Mon Apr 13 12:44:12.369591 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:46819] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Mon Apr 13 12:44:12.596266 2026] [:error] [pid 63406:tid 63435] [client 20.151.248.149:46819] File does not exist: /usr/local/apache/htdocs/suspended-page/zxcs.php
[Mon Apr 13 12:44:12.826372 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:46819] File does not exist: /usr/local/apache/htdocs/suspended-page/rea889y.php
[Mon Apr 13 12:44:13.035790 2026] [:error] [pid 63406:tid 63428] [client 20.151.248.149:46819] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Mon Apr 13 12:44:13.253456 2026] [:error] [pid 63406:tid 63419] [client 20.151.248.149:46819] File does not exist: /usr/local/apache/htdocs/suspended-page/prosell2.php
[Mon Apr 13 12:44:13.462209 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:46819] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/22name.php"] [unique_id "adx0nbHZEIkQ0Zmgp5qCWQAAAM8"]
[Mon Apr 13 12:44:13.924768 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:47032] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/22name.php"] [unique_id "adx0nQEnn1dQrOSHHNWyYAAAAQw"]
[Mon Apr 13 12:44:14.527610 2026] [:error] [pid 63310:tid 63363] [client 20.151.248.149:46988] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/22name.php"] [unique_id "adx0nnoXpRU5ztmwPjL02wAAAFM"]
[Mon Apr 13 12:44:14.995694 2026] [:error] [pid 63309:tid 63323] [client 20.151.248.149:46885] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/22name.php"] [unique_id "adx0nkpIKZ10weXpf0XTkwAAAAo"]
[Mon Apr 13 12:44:15.725812 2026] [:error] [pid 7228:tid 7236] [client 20.151.248.149:46954] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs9.php"] [unique_id "adx0nwEnn1dQrOSHHNWyYgAAAQY"]
[Mon Apr 13 12:44:16.389917 2026] [:error] [pid 7228:tid 7245] [client 20.151.248.149:46860] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs9.php"] [unique_id "adx0oAEnn1dQrOSHHNWyZAAAAQ8"]
[Mon Apr 13 12:44:16.835272 2026] [:error] [pid 7228:tid 7247] [client 20.151.248.149:47050] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs9.php"] [unique_id "adx0oAEnn1dQrOSHHNWyZwAAARE"]
[Mon Apr 13 12:44:17.439739 2026] [:error] [pid 7228:tid 7232] [client 20.151.248.149:46889] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fs9.php"] [unique_id "adx0oQEnn1dQrOSHHNWyagAAAQI"]
[Mon Apr 13 12:44:17.978549 2026] [:error] [pid 7228:tid 7234] [client 20.151.248.149:46964] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adx0oQEnn1dQrOSHHNWycAAAAQQ"]
[Mon Apr 13 12:44:18.436454 2026] [:error] [pid 63406:tid 63419] [client 20.151.248.149:47078] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adx0orHZEIkQ0Zmgp5qCYwAAAMg"]
[Mon Apr 13 12:44:18.968937 2026] [:error] [pid 63310:tid 63361] [client 20.151.248.149:46920] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adx0onoXpRU5ztmwPjL03gAAAFE"]
[Mon Apr 13 12:44:19.671259 2026] [:error] [pid 7228:tid 7239] [client 20.151.248.149:47087] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp1.php"] [unique_id "adx0owEnn1dQrOSHHNWydgAAAQk"]
[Mon Apr 13 12:44:20.161837 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:46874] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2.php"] [unique_id "adx0pLHZEIkQ0Zmgp5qCZgAAAM8"]
[Mon Apr 13 12:44:20.660467 2026] [:error] [pid 63311:tid 63390] [client 20.151.248.149:46948] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2.php"] [unique_id "adx0pKHjrGN1MqBCVFmFkwAAAJM"]
[Mon Apr 13 12:44:21.228742 2026] [:error] [pid 63406:tid 63414] [client 20.151.248.149:46955] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2.php"] [unique_id "adx0pbHZEIkQ0Zmgp5qCZwAAAMM"]
[Mon Apr 13 12:44:22.061586 2026] [:error] [pid 63311:tid 63381] [client 20.151.248.149:46929] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/f2.php"] [unique_id "adx0pqHjrGN1MqBCVFmFlgAAAIo"]
[Mon Apr 13 12:44:22.891640 2026] [:error] [pid 63310:tid 63363] [client 20.151.248.149:47019] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "adx0pnoXpRU5ztmwPjL04QAAAFM"]
[Mon Apr 13 12:44:23.500009 2026] [:error] [pid 63310:tid 63356] [client 20.151.248.149:47028] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "adx0p3oXpRU5ztmwPjL04gAAAEw"]
[Mon Apr 13 12:44:24.259781 2026] [:error] [pid 63311:tid 63383] [client 20.151.248.149:46887] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "adx0qKHjrGN1MqBCVFmFmgAAAIw"]
[Mon Apr 13 12:44:24.867803 2026] [:error] [pid 57183:tid 57187] [client 20.151.248.149:46909] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ftde.php"] [unique_id "adx0qDDO3t8R5NaxzYQ20AAAAUI"]
[Mon Apr 13 12:44:25.472055 2026] [:error] [pid 63310:tid 63350] [client 20.151.248.149:46971] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shadow-bot.php"] [unique_id "adx0qXoXpRU5ztmwPjL05QAAAEY"]
[Mon Apr 13 12:44:26.029992 2026] [:error] [pid 7228:tid 7244] [client 20.151.248.149:46849] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shadow-bot.php"] [unique_id "adx0qgEnn1dQrOSHHNWyfgAAAQ4"]
[Mon Apr 13 12:44:26.467872 2026] [:error] [pid 7228:tid 7238] [client 20.151.248.149:46866] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shadow-bot.php"] [unique_id "adx0qgEnn1dQrOSHHNWyggAAAQg"]
[Mon Apr 13 12:44:26.933782 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:47001] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shadow-bot.php"] [unique_id "adx0qgEnn1dQrOSHHNWyhAAAAQc"]
[Mon Apr 13 12:44:27.418609 2026] [:error] [pid 7228:tid 7234] [client 20.151.248.149:46932] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ianmg.php"] [unique_id "adx0qwEnn1dQrOSHHNWyhwAAAQQ"]
[Mon Apr 13 12:44:28.396437 2026] [:error] [pid 63309:tid 63326] [client 20.151.248.149:46786] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ianmg.php"] [unique_id "adx0rEpIKZ10weXpf0XTmQAAAA0"]
[Mon Apr 13 12:44:29.350342 2026] [:error] [pid 63310:tid 63349] [client 20.151.248.149:46941] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ianmg.php"] [unique_id "adx0rXoXpRU5ztmwPjL06AAAAEU"]
[Mon Apr 13 12:44:30.170945 2026] [:error] [pid 63311:tid 63373] [client 20.151.248.149:46893] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ianmg.php"] [unique_id "adx0rqHjrGN1MqBCVFmFngAAAII"]
[Mon Apr 13 12:44:30.855080 2026] [:error] [pid 63309:tid 63327] [client 20.151.248.149:46959] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adx0rkpIKZ10weXpf0XTnAAAAA4"]
[Mon Apr 13 12:44:31.643679 2026] [:error] [pid 63311:tid 63374] [client 20.151.248.149:46967] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adx0r6HjrGN1MqBCVFmFoAAAAIM"]
[Mon Apr 13 12:44:32.534030 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:46804] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adx0sAEnn1dQrOSHHNWykAAAAQA"]
[Mon Apr 13 12:44:33.511144 2026] [:error] [pid 57183:tid 57194] [client 20.151.248.149:46895] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/333.php"] [unique_id "adx0sTDO3t8R5NaxzYQ21AAAAUk"]
[Mon Apr 13 12:44:34.624208 2026] [:error] [pid 63406:tid 63421] [client 20.151.248.149:46919] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssh3ll.php"] [unique_id "adx0srHZEIkQ0Zmgp5qCeQAAAMo"]
[Mon Apr 13 12:44:36.343041 2026] [:error] [pid 63406:tid 63431] [client 20.151.248.149:46897] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssh3ll.php"] [unique_id "adx0tLHZEIkQ0Zmgp5qCegAAANQ"]
[Mon Apr 13 12:44:37.708724 2026] [:error] [pid 63311:tid 63386] [client 20.151.248.149:46865] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssh3ll.php"] [unique_id "adx0taHjrGN1MqBCVFmFpAAAAI8"]
[Mon Apr 13 12:44:38.318387 2026] [:error] [pid 57183:tid 57196] [client 20.151.248.149:46812] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ssh3ll.php"] [unique_id "adx0tjDO3t8R5NaxzYQ22AAAAUs"]
[Mon Apr 13 12:44:38.876092 2026] [:error] [pid 57183:tid 57205] [client 20.151.248.149:47058] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/itil.php"] [unique_id "adx0tjDO3t8R5NaxzYQ22gAAAVQ"]
[Mon Apr 13 12:44:39.431180 2026] [:error] [pid 63311:tid 63376] [client 20.151.248.149:46880] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/itil.php"] [unique_id "adx0t6HjrGN1MqBCVFmFpgAAAIU"]
[Mon Apr 13 12:44:40.348085 2026] [:error] [pid 63309:tid 63325] [client 20.151.248.149:46869] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/itil.php"] [unique_id "adx0uEpIKZ10weXpf0XTqgAAAAw"]
[Mon Apr 13 12:44:41.759115 2026] [:error] [pid 63310:tid 63363] [client 20.151.248.149:46978] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/itil.php"] [unique_id "adx0uXoXpRU5ztmwPjL0-QAAAFM"]
[Mon Apr 13 12:44:42.376356 2026] [:error] [pid 63309:tid 63337] [client 20.151.248.149:46916] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "adx0ukpIKZ10weXpf0XTrAAAABg"]
[Mon Apr 13 12:44:43.099609 2026] [:error] [pid 63310:tid 63344] [client 20.151.248.149:46878] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "adx0u3oXpRU5ztmwPjL0-gAAAEA"]
[Mon Apr 13 12:44:43.922937 2026] [:error] [pid 63311:tid 63372] [client 20.151.248.149:46850] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "adx0u6HjrGN1MqBCVFmFuQAAAIE"]
[Mon Apr 13 12:44:44.792122 2026] [:error] [pid 63311:tid 63391] [client 20.151.248.149:46789] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/snus.php"] [unique_id "adx0vKHjrGN1MqBCVFmFvwAAAJQ"]
[Mon Apr 13 12:44:45.248058 2026] [:error] [pid 63311:tid 63395] [client 20.151.248.149:46872] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "adx0vaHjrGN1MqBCVFmFwgAAAJg"]
[Mon Apr 13 12:44:45.780732 2026] [:error] [pid 63311:tid 63385] [client 20.151.248.149:46960] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "adx0vaHjrGN1MqBCVFmFyAAAAI4"]
[Mon Apr 13 12:44:46.249871 2026] [:error] [pid 57183:tid 57191] [client 20.151.248.149:46811] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "adx0vjDO3t8R5NaxzYQ24wAAAUY"]
[Mon Apr 13 12:44:46.863186 2026] [:error] [pid 63309:tid 63332] [client 20.151.248.149:46905] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/shlo.php"] [unique_id "adx0vkpIKZ10weXpf0XTywAAABM"]
[Mon Apr 13 12:44:47.382602 2026] [:error] [pid 63309:tid 63317] [client 20.151.248.149:46886] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mas80.php"] [unique_id "adx0v0pIKZ10weXpf0XTzAAAAAQ"]
[Mon Apr 13 12:44:48.167409 2026] [:error] [pid 63311:tid 63386] [client 20.151.248.149:46807] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mas80.php"] [unique_id "adx0wKHjrGN1MqBCVFmF0gAAAI8"]
[Mon Apr 13 12:44:48.662039 2026] [:error] [pid 57183:tid 57196] [client 20.151.248.149:46879] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mas80.php"] [unique_id "adx0wDDO3t8R5NaxzYQ25wAAAUs"]
[Mon Apr 13 12:44:49.225970 2026] [:error] [pid 7228:tid 7245] [client 20.151.248.149:46847] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/mas80.php"] [unique_id "adx0wQEnn1dQrOSHHNWypwAAAQ8"]
[Mon Apr 13 12:44:49.978039 2026] [:error] [pid 63310:tid 63363] [client 20.151.248.149:46943] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "adx0wXoXpRU5ztmwPjL1BQAAAFM"]
[Mon Apr 13 12:44:50.488761 2026] [:error] [pid 63311:tid 63372] [client 20.151.248.149:46910] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "adx0wqHjrGN1MqBCVFmF1AAAAIE"]
[Mon Apr 13 12:44:51.004348 2026] [:error] [pid 57183:tid 57202] [client 20.151.248.149:46911] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "adx0wzDO3t8R5NaxzYQ28gAAAVE"]
[Mon Apr 13 12:44:51.811331 2026] [:error] [pid 63311:tid 63389] [client 20.151.248.149:46864] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/torsa.php"] [unique_id "adx0w6HjrGN1MqBCVFmF1QAAAJI"]
[Mon Apr 13 12:44:53.009967 2026] [:error] [pid 7228:tid 7234] [client 20.151.248.149:46938] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adx0xQEnn1dQrOSHHNWytAAAAQQ"]
[Mon Apr 13 12:44:53.448969 2026] [:error] [pid 57183:tid 57201] [client 20.151.248.149:46926] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adx0xTDO3t8R5NaxzYQ29gAAAVA"]
[Mon Apr 13 12:44:54.201735 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:46785] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adx0xgEnn1dQrOSHHNWyuAAAARU"]
[Mon Apr 13 12:44:54.928761 2026] [:error] [pid 63311:tid 63380] [client 20.151.248.149:46975] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilus.php"] [unique_id "adx0xqHjrGN1MqBCVFmF1wAAAIk"]
[Mon Apr 13 12:44:55.509150 2026] [:error] [pid 63406:tid 63416] [client 20.151.248.149:46935] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-upload.php"] [unique_id "adx0x7HZEIkQ0Zmgp5qCigAAAMU"]
[Mon Apr 13 12:44:55.993985 2026] [:error] [pid 7228:tid 7246] [client 20.151.248.149:46833] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-upload.php"] [unique_id "adx0xwEnn1dQrOSHHNWyvQAAARA"]
[Mon Apr 13 12:44:56.455626 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:46867] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-upload.php"] [unique_id "adx0yLHZEIkQ0Zmgp5qCjQAAAM0"]
[Mon Apr 13 12:44:56.879314 2026] [:error] [pid 63406:tid 63435] [client 20.151.248.149:46870] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-upload.php"] [unique_id "adx0yLHZEIkQ0Zmgp5qCkQAAANg"]
[Mon Apr 13 12:44:57.312172 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:46808] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fcnlp.php"] [unique_id "adx0yQEnn1dQrOSHHNWywAAAAQc"]
[Mon Apr 13 12:44:57.796187 2026] [:error] [pid 63406:tid 63414] [client 20.151.248.149:46857] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fcnlp.php"] [unique_id "adx0ybHZEIkQ0Zmgp5qClQAAAMM"]
[Mon Apr 13 12:44:58.314630 2026] [:error] [pid 7228:tid 7240] [client 20.151.248.149:46896] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fcnlp.php"] [unique_id "adx0ygEnn1dQrOSHHNWywgAAAQo"]
[Mon Apr 13 12:44:58.739418 2026] [:error] [pid 63311:tid 63395] [client 20.151.248.149:46906] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/fcnlp.php"] [unique_id "adx0yqHjrGN1MqBCVFmF2gAAAJg"]
[Mon Apr 13 12:44:59.214095 2026] [:error] [pid 63406:tid 63413] [client 20.151.248.149:46813] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxc.php"] [unique_id "adx0y7HZEIkQ0Zmgp5qCmgAAAMI"]
[Mon Apr 13 12:45:00.018981 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:46901] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxc.php"] [unique_id "adx0zAEnn1dQrOSHHNWyxAAAAQw"]
[Mon Apr 13 12:45:00.623493 2026] [:error] [pid 7228:tid 7246] [client 20.151.248.149:46868] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxc.php"] [unique_id "adx0zAEnn1dQrOSHHNWyxwAAARA"]
[Mon Apr 13 12:45:01.109224 2026] [:error] [pid 57183:tid 57196] [client 20.151.248.149:46898] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xxc.php"] [unique_id "adx0zTDO3t8R5NaxzYQ2-QAAAUs"]
[Mon Apr 13 12:45:01.613594 2026] [:error] [pid 63310:tid 63361] [client 20.151.248.149:46848] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-su.php"] [unique_id "adx0zXoXpRU5ztmwPjL1EQAAAFE"]
[Mon Apr 13 12:45:02.024883 2026] [:error] [pid 7228:tid 7236] [client 20.151.248.149:46816] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-su.php"] [unique_id "adx0zgEnn1dQrOSHHNWy0AAAAQY"]
[Mon Apr 13 12:45:02.672139 2026] [:error] [pid 57183:tid 57200] [client 20.151.248.149:46950] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-su.php"] [unique_id "adx0zjDO3t8R5NaxzYQ2-gAAAU8"]
[Mon Apr 13 12:45:03.187583 2026] [:error] [pid 7228:tid 7246] [client 20.151.248.149:47025] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-su.php"] [unique_id "adx0zwEnn1dQrOSHHNWy1wAAARA"]
[Mon Apr 13 12:45:03.640902 2026] [:error] [pid 57183:tid 57207] [client 20.151.248.149:46968] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ZSLeDE.php"] [unique_id "adx0zzDO3t8R5NaxzYQ2_QAAAVY"]
[Mon Apr 13 12:45:04.103923 2026] [:error] [pid 57183:tid 57201] [client 20.151.248.149:46736] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ZSLeDE.php"] [unique_id "adx00DDO3t8R5NaxzYQ2_gAAAVA"]
[Mon Apr 13 12:45:04.562545 2026] [:error] [pid 63310:tid 63344] [client 20.151.248.149:46821] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ZSLeDE.php"] [unique_id "adx00HoXpRU5ztmwPjL1FQAAAEA"]
[Mon Apr 13 12:45:05.107175 2026] [:error] [pid 57183:tid 57187] [client 20.151.248.149:46966] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ZSLeDE.php"] [unique_id "adx00TDO3t8R5NaxzYQ3AQAAAUI"]
[Mon Apr 13 12:45:05.576389 2026] [:error] [pid 7228:tid 7238] [client 20.151.248.149:46912] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adx00QEnn1dQrOSHHNWy3gAAAQg"]
[Mon Apr 13 12:45:06.207422 2026] [:error] [pid 63310:tid 63350] [client 20.151.248.149:46796] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adx00noXpRU5ztmwPjL1FwAAAEY"]
[Mon Apr 13 12:45:06.643935 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:46723] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adx00gEnn1dQrOSHHNWy4AAAAQw"]
[Mon Apr 13 12:45:07.058698 2026] [:error] [pid 63310:tid 63366] [client 20.151.248.149:46846] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sadcut1.php"] [unique_id "adx003oXpRU5ztmwPjL1GQAAAFY"]
[Mon Apr 13 12:45:07.632421 2026] [:error] [pid 7228:tid 7252] [client 20.151.248.149:46802] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bngv.php"] [unique_id "adx00wEnn1dQrOSHHNWy5QAAARY"]
[Mon Apr 13 12:45:08.410689 2026] [:error] [pid 7228:tid 7235] [client 20.151.248.149:46730] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bngv.php"] [unique_id "adx01AEnn1dQrOSHHNWy6AAAAQU"]
[Mon Apr 13 12:45:09.407731 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:47002] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bngv.php"] [unique_id "adx01QEnn1dQrOSHHNWy6wAAAQw"]
[Mon Apr 13 12:45:10.276856 2026] [:error] [pid 63309:tid 63331] [client 20.151.248.149:46882] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bngv.php"] [unique_id "adx01kpIKZ10weXpf0XT1QAAABI"]
[Mon Apr 13 12:45:10.990808 2026] [:error] [pid 63311:tid 63387] [client 20.151.248.149:46721] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-filters.php"] [unique_id "adx01qHjrGN1MqBCVFmF6AAAAJA"]
[Mon Apr 13 12:45:11.636461 2026] [:error] [pid 63309:tid 63333] [client 20.151.248.149:47032] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-filters.php"] [unique_id "adx010pIKZ10weXpf0XT2AAAABQ"]
[Mon Apr 13 12:45:12.952730 2026] [:error] [pid 63406:tid 63431] [client 20.151.248.149:46856] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/admin-filters.php"] [unique_id "adx02LHZEIkQ0Zmgp5qCoQAAANQ"]
[Mon Apr 13 12:45:14.346224 2026] [:error] [pid 7228:tid 7239] [client 20.151.248.149:47090] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-filters.php
[Mon Apr 13 12:45:14.554580 2026] [:error] [pid 7228:tid 7249] [client 20.151.248.149:47090] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Mon Apr 13 12:45:14.763128 2026] [:error] [pid 7228:tid 7244] [client 20.151.248.149:47090] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Mon Apr 13 12:45:14.967899 2026] [:error] [pid 7228:tid 7252] [client 20.151.248.149:47090] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "adx02gEnn1dQrOSHHNWy-AAAARY"]
[Mon Apr 13 12:45:15.669282 2026] [:error] [pid 63309:tid 63323] [client 20.151.248.149:46794] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "adx020pIKZ10weXpf0XT4QAAAAo"]
[Mon Apr 13 12:45:16.819808 2026] [:error] [pid 63311:tid 63374] [client 20.151.248.149:46735] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "adx03KHjrGN1MqBCVFmF7AAAAIM"]
[Mon Apr 13 12:45:17.632984 2026] [:error] [pid 63310:tid 63356] [client 20.151.248.149:46965] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kiwkiw.php"] [unique_id "adx03XoXpRU5ztmwPjL1HwAAAEw"]
[Mon Apr 13 12:45:18.614249 2026] [:error] [pid 63406:tid 63428] [client 20.151.248.149:46902] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bhm.php"] [unique_id "adx03rHZEIkQ0Zmgp5qCtQAAANE"]
[Mon Apr 13 12:45:19.425319 2026] [:error] [pid 63311:tid 63376] [client 20.151.248.149:47096] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bhm.php"] [unique_id "adx036HjrGN1MqBCVFmF7gAAAIU"]
[Mon Apr 13 12:45:20.061869 2026] [:error] [pid 57183:tid 57205] [client 20.151.248.149:46826] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bhm.php"] [unique_id "adx04DDO3t8R5NaxzYQ3EgAAAVQ"]
[Mon Apr 13 12:45:21.018024 2026] [:error] [pid 7228:tid 7245] [client 20.151.248.149:46875] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bhm.php"] [unique_id "adx04QEnn1dQrOSHHNWzCQAAAQ8"]
[Mon Apr 13 12:45:22.219575 2026] [:error] [pid 63309:tid 63334] [client 20.151.248.149:46892] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahutr.php"] [unique_id "adx04kpIKZ10weXpf0XT5wAAABU"]
[Mon Apr 13 12:45:23.415253 2026] [:error] [pid 63311:tid 63393] [client 20.151.248.149:46961] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahutr.php"] [unique_id "adx046HjrGN1MqBCVFmF8wAAAJY"]
[Mon Apr 13 12:45:24.413464 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:47074] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahutr.php"] [unique_id "adx05LHZEIkQ0Zmgp5qCtwAAAM8"]
[Mon Apr 13 12:45:25.708649 2026] [:error] [pid 63311:tid 63375] [client 20.151.248.149:46973] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahutr.php"] [unique_id "adx05aHjrGN1MqBCVFmF-QAAAIQ"]
[Mon Apr 13 12:45:26.829567 2026] [:error] [pid 7228:tid 7236] [client 20.151.248.149:46747] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adx05gEnn1dQrOSHHNWzEgAAAQY"]
[Mon Apr 13 12:45:27.649579 2026] [:error] [pid 63309:tid 63324] [client 20.151.248.149:46908] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adx050pIKZ10weXpf0XT7gAAAAs"]
[Mon Apr 13 12:45:29.348217 2026] [:error] [pid 63309:tid 63328] [client 20.151.248.149:46825] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adx06UpIKZ10weXpf0XT7wAAAA8"]
[Mon Apr 13 12:45:32.416581 2026] [:error] [pid 57183:tid 57206] [client 20.151.248.149:46844] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/lupo.php"] [unique_id "adx07DDO3t8R5NaxzYQ3IgAAAVU"]
[Mon Apr 13 12:45:33.896554 2026] [:error] [pid 63311:tid 63389] [client 20.151.248.149:46780] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bdktk.php"] [unique_id "adx07aHjrGN1MqBCVFmGAAAAAJI"]
[Mon Apr 13 12:45:34.743813 2026] [:error] [pid 57183:tid 57206] [client 20.151.248.149:46824] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bdktk.php"] [unique_id "adx07jDO3t8R5NaxzYQ3OQAAAVU"]
[Mon Apr 13 12:45:36.857093 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:46732] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bdktk.php"] [unique_id "adx08AEnn1dQrOSHHNWzVwAAAQA"]
[Mon Apr 13 12:45:37.820445 2026] [:error] [pid 63309:tid 63337] [client 20.151.248.149:46737] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bdktk.php"] [unique_id "adx08UpIKZ10weXpf0XUAAAAABg"]
[Mon Apr 13 12:45:38.515216 2026] [:error] [pid 63310:tid 63352] [client 20.151.248.149:46661] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amwxl.php"] [unique_id "adx08noXpRU5ztmwPjL1MQAAAEg"]
[Mon Apr 13 12:45:42.057298 2026] [:error] [pid 63406:tid 63433] [client 20.151.248.149:46876] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amwxl.php"] [unique_id "adx09rHZEIkQ0Zmgp5qCxgAAANY"]
[Mon Apr 13 12:45:42.761343 2026] [:error] [pid 63406:tid 63416] [client 20.151.248.149:46875] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amwxl.php"] [unique_id "adx09rHZEIkQ0Zmgp5qCyAAAAMU"]
[Mon Apr 13 12:45:43.282417 2026] [:error] [pid 57183:tid 57193] [client 20.151.248.149:46970] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amwxl.php"] [unique_id "adx09zDO3t8R5NaxzYQ3PQAAAUg"]
[Mon Apr 13 12:45:43.733872 2026] [:error] [pid 7228:tid 7254] [client 20.151.248.149:47085] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adx09wEnn1dQrOSHHNWzYwAAARg"]
[Mon Apr 13 12:45:44.558366 2026] [:error] [pid 57183:tid 57209] [client 20.151.248.149:46990] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adx0-DDO3t8R5NaxzYQ3QQAAAVg"]
[Mon Apr 13 12:45:45.333349 2026] [:error] [pid 63309:tid 63324] [client 20.151.248.149:46659] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adx0-UpIKZ10weXpf0XUBQAAAAs"]
[Mon Apr 13 12:45:45.873812 2026] [:error] [pid 7228:tid 7240] [client 20.151.248.149:47017] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-blog.php"] [unique_id "adx0-QEnn1dQrOSHHNWzaAAAAQo"]
[Mon Apr 13 12:45:46.428688 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:47057] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adx0-gEnn1dQrOSHHNWzaQAAAQw"]
[Mon Apr 13 12:45:47.308494 2026] [:error] [pid 57183:tid 57196] [client 20.151.248.149:46884] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adx0-zDO3t8R5NaxzYQ3RwAAAUs"]
[Mon Apr 13 12:45:49.081681 2026] [:error] [pid 57183:tid 57209] [client 20.151.248.149:46788] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adx0_TDO3t8R5NaxzYQ3TgAAAVg"]
[Mon Apr 13 12:45:51.240568 2026] [:error] [pid 63309:tid 63328] [client 20.151.248.149:47084] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/a7.php"] [unique_id "adx0_0pIKZ10weXpf0XUCQAAAA8"]
[Mon Apr 13 12:45:53.317929 2026] [:error] [pid 63406:tid 63430] [client 20.151.248.149:47052] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rujgeote.php"] [unique_id "adx1AbHZEIkQ0Zmgp5qC1QAAANM"]
[Mon Apr 13 12:45:55.226530 2026] [:error] [pid 63406:tid 63413] [client 20.151.248.149:47055] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rujgeote.php"] [unique_id "adx1A7HZEIkQ0Zmgp5qC2AAAAMI"]
[Mon Apr 13 12:45:58.378620 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:47083] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rujgeote.php"] [unique_id "adx1BgEnn1dQrOSHHNWziQAAAQw"]
[Mon Apr 13 12:45:59.871578 2026] [:error] [pid 57183:tid 57195] [client 20.151.248.149:46981] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rujgeote.php"] [unique_id "adx1BzDO3t8R5NaxzYQ3YQAAAUo"]
[Mon Apr 13 12:46:01.166199 2026] [:error] [pid 63406:tid 63412] [client 20.151.248.149:47026] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/shlo.php"] [unique_id "adx1CbHZEIkQ0Zmgp5qC3QAAAME"]
[Mon Apr 13 12:46:01.643296 2026] [:error] [pid 7228:tid 7233] [client 20.151.248.149:47054] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/shlo.php"] [unique_id "adx1CQEnn1dQrOSHHNWzlAAAAQM"]
[Mon Apr 13 12:46:02.131699 2026] [:error] [pid 57183:tid 57203] [client 20.151.248.149:47101] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/shlo.php"] [unique_id "adx1CjDO3t8R5NaxzYQ3agAAAVI"]
[Mon Apr 13 12:46:02.615397 2026] [:error] [pid 7228:tid 7254] [client 20.151.248.149:47103] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/shlo.php"] [unique_id "adx1CgEnn1dQrOSHHNWzmAAAARg"]
[Mon Apr 13 12:46:03.144304 2026] [:error] [pid 63406:tid 63431] [client 20.151.248.149:46830] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adx1C7HZEIkQ0Zmgp5qC4AAAANQ"]
[Mon Apr 13 12:46:03.723698 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:47005] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adx1C7HZEIkQ0Zmgp5qC4gAAAM0"]
[Mon Apr 13 12:46:04.183981 2026] [:error] [pid 63406:tid 63416] [client 20.151.248.149:46983] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adx1DLHZEIkQ0Zmgp5qC5wAAAMU"]
[Mon Apr 13 12:46:04.842581 2026] [:error] [pid 7228:tid 7243] [client 20.151.248.149:46803] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kj.php"] [unique_id "adx1DAEnn1dQrOSHHNWznwAAAQ0"]
[Mon Apr 13 12:46:05.390495 2026] [:error] [pid 63309:tid 63333] [client 20.151.248.149:47092] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "adx1DUpIKZ10weXpf0XUDwAAABQ"]
[Mon Apr 13 12:46:06.136951 2026] [:error] [pid 63309:tid 63336] [client 20.151.248.149:47038] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "adx1DkpIKZ10weXpf0XUEAAAABc"]
[Mon Apr 13 12:46:06.892178 2026] [:error] [pid 63310:tid 63365] [client 20.151.248.149:46724] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "adx1DnoXpRU5ztmwPjL1QwAAAFU"]
[Mon Apr 13 12:46:07.579567 2026] [:error] [pid 63311:tid 63381] [client 20.151.248.149:46980] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/only.php"] [unique_id "adx1D6HjrGN1MqBCVFmGHQAAAIo"]
[Mon Apr 13 12:46:08.104686 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:47040] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "adx1EAEnn1dQrOSHHNWzowAAARU"]
[Mon Apr 13 12:46:08.674763 2026] [:error] [pid 57183:tid 57198] [client 20.151.248.149:46930] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "adx1EDDO3t8R5NaxzYQ3cgAAAU0"]
[Mon Apr 13 12:46:09.127157 2026] [:error] [pid 57183:tid 57187] [client 20.151.248.149:46798] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "adx1ETDO3t8R5NaxzYQ3dAAAAUI"]
[Mon Apr 13 12:46:10.132124 2026] [:error] [pid 7228:tid 7250] [client 20.151.248.149:46894] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/un.php"] [unique_id "adx1EgEnn1dQrOSHHNWzrQAAARQ"]
[Mon Apr 13 12:46:10.842466 2026] [:error] [pid 57183:tid 57207] [client 20.151.248.149:46931] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-bugs.php"] [unique_id "adx1EjDO3t8R5NaxzYQ3fgAAAVY"]
[Mon Apr 13 12:46:11.543493 2026] [:error] [pid 7228:tid 7233] [client 20.151.248.149:46923] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-bugs.php"] [unique_id "adx1EwEnn1dQrOSHHNWztAAAAQM"]
[Mon Apr 13 12:46:12.037501 2026] [:error] [pid 63310:tid 63350] [client 20.151.248.149:47097] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-bugs.php"] [unique_id "adx1FHoXpRU5ztmwPjL1RgAAAEY"]
[Mon Apr 13 12:46:12.566747 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:47080] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-bugs.php"] [unique_id "adx1FLHZEIkQ0Zmgp5qC_wAAAMc"]
[Mon Apr 13 12:46:13.125848 2026] [:error] [pid 57183:tid 57190] [client 20.151.248.149:46805] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/de.php"] [unique_id "adx1FTDO3t8R5NaxzYQ3iQAAAUU"]
[Mon Apr 13 12:46:13.936162 2026] [:error] [pid 63310:tid 63346] [client 20.151.248.149:46793] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/de.php"] [unique_id "adx1FXoXpRU5ztmwPjL1SAAAAEI"]
[Mon Apr 13 12:46:15.013491 2026] [:error] [pid 7228:tid 7244] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/de.php
[Mon Apr 13 12:46:15.255815 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/fs6.php
[Mon Apr 13 12:46:15.495288 2026] [:error] [pid 7228:tid 7243] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/ng.php
[Mon Apr 13 12:46:15.711715 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/btx25.php
[Mon Apr 13 12:46:15.990626 2026] [:error] [pid 7228:tid 7236] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Mon Apr 13 12:46:16.204879 2026] [:error] [pid 7228:tid 7246] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Mon Apr 13 12:46:16.419009 2026] [:error] [pid 7228:tid 7244] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/obfuscate.php
[Mon Apr 13 12:46:16.633367 2026] [:error] [pid 7228:tid 7238] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Mon Apr 13 12:46:16.877156 2026] [:error] [pid 7228:tid 7234] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-tymanage.php
[Mon Apr 13 12:46:17.417423 2026] [:error] [pid 7228:tid 7250] [client 20.151.248.149:47010] File does not exist: /usr/local/apache/htdocs/suspended-page/size.php
[Mon Apr 13 12:46:17.643496 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:47010] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adx1GQEnn1dQrOSHHNWz3gAAAQA"]
[Mon Apr 13 12:46:18.329218 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:46881] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adx1GgEnn1dQrOSHHNWz4QAAAQc"]
[Mon Apr 13 12:46:19.852343 2026] [:error] [pid 57183:tid 57189] [client 20.151.248.149:46900] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adx1GzDO3t8R5NaxzYQ3lwAAAUQ"]
[Mon Apr 13 12:46:21.371841 2026] [:error] [pid 63406:tid 63429] [client 20.151.248.149:46946] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rithin.php"] [unique_id "adx1HbHZEIkQ0Zmgp5qDCQAAANI"]
[Mon Apr 13 12:46:22.490489 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:46936] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "adx1HgEnn1dQrOSHHNWz7wAAAQA"]
[Mon Apr 13 12:46:23.191533 2026] [:error] [pid 63406:tid 63414] [client 20.151.248.149:47045] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "adx1H7HZEIkQ0Zmgp5qDDgAAAMM"]
[Mon Apr 13 12:46:23.698715 2026] [:error] [pid 63310:tid 63366] [client 20.151.248.149:47086] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "adx1H3oXpRU5ztmwPjL1VwAAAFY"]
[Mon Apr 13 12:46:24.150994 2026] [:error] [pid 7228:tid 7252] [client 20.151.248.149:47041] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55.php"] [unique_id "adx1IAEnn1dQrOSHHNWz-wAAARY"]
[Mon Apr 13 12:46:24.649131 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:47062] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "adx1IAEnn1dQrOSHHNWz_QAAAQA"]
[Mon Apr 13 12:46:25.132127 2026] [:error] [pid 7228:tid 7254] [client 20.151.248.149:47021] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "adx1IQEnn1dQrOSHHNW0AgAAARg"]
[Mon Apr 13 12:46:25.588856 2026] [:error] [pid 7228:tid 7238] [client 20.151.248.149:47051] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "adx1IQEnn1dQrOSHHNW0BwAAAQg"]
[Mon Apr 13 12:46:26.206661 2026] [:error] [pid 7228:tid 7252] [client 20.151.248.149:46998] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-block.php"] [unique_id "adx1IgEnn1dQrOSHHNW0CwAAARY"]
[Mon Apr 13 12:46:26.822922 2026] [:error] [pid 57183:tid 57200] [client 20.151.248.149:46996] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adx1IjDO3t8R5NaxzYQ3ogAAAU8"]
[Mon Apr 13 12:46:27.399690 2026] [:error] [pid 57183:tid 57196] [client 20.151.248.149:46994] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adx1IzDO3t8R5NaxzYQ3pQAAAUs"]
[Mon Apr 13 12:46:28.000526 2026] [:error] [pid 63406:tid 63415] [client 20.151.248.149:47027] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adx1I7HZEIkQ0Zmgp5qDEgAAAMQ"]
[Mon Apr 13 12:46:28.747963 2026] [:error] [pid 63406:tid 63414] [client 20.151.248.149:46693] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/tiny2.php"] [unique_id "adx1JLHZEIkQ0Zmgp5qDFAAAAMM"]
[Mon Apr 13 12:46:29.407744 2026] [:error] [pid 63311:tid 63382] [client 20.151.248.149:46969] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bardbdze.php"] [unique_id "adx1JaHjrGN1MqBCVFmGLQAAAIs"]
[Mon Apr 13 12:46:30.197691 2026] [:error] [pid 63310:tid 63356] [client 20.151.248.149:46984] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bardbdze.php"] [unique_id "adx1JnoXpRU5ztmwPjL1WwAAAEw"]
[Mon Apr 13 12:46:30.980498 2026] [:error] [pid 63311:tid 63375] [client 20.151.248.149:46806] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bardbdze.php"] [unique_id "adx1JqHjrGN1MqBCVFmGMAAAAIQ"]
[Mon Apr 13 12:46:32.133290 2026] [:error] [pid 63406:tid 63431] [client 20.151.248.149:47047] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bardbdze.php"] [unique_id "adx1KLHZEIkQ0Zmgp5qDGgAAANQ"]
[Mon Apr 13 12:46:33.761928 2026] [:error] [pid 63309:tid 63323] [client 20.151.248.149:46791] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "adx1KUpIKZ10weXpf0XUHQAAAAo"]
[Mon Apr 13 12:46:36.093881 2026] [:error] [pid 7228:tid 7240] [client 20.151.248.149:47079] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "adx1LAEnn1dQrOSHHNW0FgAAAQo"]
[Mon Apr 13 12:46:38.342917 2026] [:error] [pid 63309:tid 63318] [client 20.151.248.149:46982] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "adx1LkpIKZ10weXpf0XUIAAAAAU"]
[Mon Apr 13 12:46:42.394233 2026] [:error] [pid 63406:tid 63433] [client 20.151.248.149:46888] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zz.php"] [unique_id "adx1MrHZEIkQ0Zmgp5qDJAAAANY"]
[Mon Apr 13 12:46:47.168112 2026] [:error] [pid 57183:tid 57197] [client 20.151.248.149:47003] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amxloxxr.php"] [unique_id "adx1NzDO3t8R5NaxzYQ30AAAAUw"]
[Mon Apr 13 12:46:49.398032 2026] [:error] [pid 57183:tid 57186] [client 20.151.248.149:47093] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amxloxxr.php"] [unique_id "adx1OTDO3t8R5NaxzYQ32QAAAUE"]
[Mon Apr 13 12:46:51.456439 2026] [:error] [pid 63310:tid 63350] [client 20.151.248.149:47023] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amxloxxr.php"] [unique_id "adx1O3oXpRU5ztmwPjL1ZgAAAEY"]
[Mon Apr 13 12:46:53.302497 2026] [:error] [pid 57183:tid 57206] [client 20.151.248.149:46992] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/amxloxxr.php"] [unique_id "adx1PTDO3t8R5NaxzYQ35QAAAVU"]
[Mon Apr 13 12:46:54.568205 2026] [:error] [pid 57183:tid 57199] [client 20.151.248.149:47094] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "adx1PjDO3t8R5NaxzYQ36AAAAU4"]
[Mon Apr 13 12:46:56.587788 2026] [:error] [pid 63311:tid 63384] [client 20.151.248.149:46822] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "adx1QKHjrGN1MqBCVFmGWwAAAI0"]
[Mon Apr 13 12:46:58.964472 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:47048] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "adx1QgEnn1dQrOSHHNW0NQAAAQc"]
[Mon Apr 13 12:47:00.184077 2026] [:error] [pid 7228:tid 7238] [client 20.151.248.149:46799] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/.yuf.php"] [unique_id "adx1RAEnn1dQrOSHHNW0NgAAAQg"]
[Mon Apr 13 12:47:01.170301 2026] [:error] [pid 57183:tid 57201] [client 20.151.248.149:47069] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adx1RTDO3t8R5NaxzYQ39gAAAVA"]
[Mon Apr 13 12:47:02.453338 2026] [:error] [pid 63310:tid 63363] [client 20.151.248.149:46989] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adx1RnoXpRU5ztmwPjL1cQAAAFM"]
[Mon Apr 13 12:47:03.447110 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:46985] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adx1RwEnn1dQrOSHHNW0OwAAAQA"]
[Mon Apr 13 12:47:04.371099 2026] [:error] [pid 63406:tid 63416] [client 20.151.248.149:46918] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wert.php"] [unique_id "adx1SLHZEIkQ0Zmgp5qDNgAAAMU"]
[Mon Apr 13 12:47:05.334617 2026] [:error] [pid 63406:tid 63433] [client 20.151.248.149:47073] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adx1SbHZEIkQ0Zmgp5qDOQAAANY"]
[Mon Apr 13 12:47:06.370124 2026] [:error] [pid 63309:tid 63332] [client 20.151.248.149:46757] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adx1SkpIKZ10weXpf0XUPQAAABM"]
[Mon Apr 13 12:47:07.730387 2026] [:error] [pid 63310:tid 63345] [client 20.151.248.149:47049] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adx1S3oXpRU5ztmwPjL1dQAAAEE"]
[Mon Apr 13 12:47:08.973624 2026] [:error] [pid 63311:tid 63376] [client 20.151.248.149:47030] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-good.php"] [unique_id "adx1TKHjrGN1MqBCVFmGcwAAAIU"]
[Mon Apr 13 12:47:10.841675 2026] [:error] [pid 57183:tid 57188] [client 20.151.248.149:47088] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adx1TjDO3t8R5NaxzYQ4AwAAAUM"]
[Mon Apr 13 12:47:12.077076 2026] [:error] [pid 63311:tid 63387] [client 20.151.248.149:47102] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adx1UKHjrGN1MqBCVFmGeAAAAJA"]
[Mon Apr 13 12:47:13.068484 2026] [:error] [pid 7228:tid 7234] [client 20.151.248.149:46993] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adx1UQEnn1dQrOSHHNW0SgAAAQQ"]
[Mon Apr 13 12:47:13.698207 2026] [:error] [pid 63309:tid 63318] [client 20.151.248.149:47007] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/new4.php"] [unique_id "adx1UUpIKZ10weXpf0XURQAAAAU"]
[Mon Apr 13 12:47:14.497942 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:46883] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpb.php"] [unique_id "adx1UrHZEIkQ0Zmgp5qDPwAAAM0"]
[Mon Apr 13 12:47:15.309356 2026] [:error] [pid 63309:tid 63336] [client 20.151.248.149:46751] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpb.php"] [unique_id "adx1U0pIKZ10weXpf0XUSAAAABc"]
[Mon Apr 13 12:47:16.392542 2026] [:error] [pid 63311:tid 63389] [client 20.151.248.149:47063] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpb.php"] [unique_id "adx1VKHjrGN1MqBCVFmGfQAAAJI"]
[Mon Apr 13 12:47:17.045634 2026] [:error] [pid 63311:tid 63378] [client 20.151.248.149:46861] File does not exist: /usr/local/apache/htdocs/suspended-page/wpb.php
[Mon Apr 13 12:47:17.512138 2026] [:error] [pid 63311:tid 63383] [client 20.151.248.149:46861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ver.php
[Mon Apr 13 12:47:17.723603 2026] [:error] [pid 63311:tid 63377] [client 20.151.248.149:46861] File does not exist: /usr/local/apache/htdocs/suspended-page/bootstrap.php
[Mon Apr 13 12:47:18.260521 2026] [:error] [pid 63311:tid 63393] [client 20.151.248.149:46861] File does not exist: /usr/local/apache/htdocs/suspended-page/class-bda.php
[Mon Apr 13 12:47:18.519555 2026] [:error] [pid 63311:tid 63371] [client 20.151.248.149:46861] File does not exist: /usr/local/apache/htdocs/suspended-page/haz.php
[Mon Apr 13 12:47:18.764458 2026] [:error] [pid 63311:tid 63395] [client 20.151.248.149:46861] File does not exist: /usr/local/apache/htdocs/suspended-page/f222.php
[Mon Apr 13 12:47:21.005142 2026] [:error] [pid 63311:tid 63395] [client 20.151.248.149:46861] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adx1WaHjrGN1MqBCVFmGigAAAJg"]
[Mon Apr 13 12:47:22.212725 2026] [:error] [pid 63311:tid 63391] [client 20.151.248.149:47059] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adx1WqHjrGN1MqBCVFmGiwAAAJQ"]
[Mon Apr 13 12:47:22.831514 2026] [:error] [pid 63406:tid 63420] [client 20.151.248.149:46728] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adx1WrHZEIkQ0Zmgp5qDTAAAAMk"]
[Mon Apr 13 12:47:23.404151 2026] [:error] [pid 63310:tid 63356] [client 20.151.248.149:47076] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/less.php"] [unique_id "adx1W3oXpRU5ztmwPjL1fAAAAEw"]
[Mon Apr 13 12:47:24.063370 2026] [:error] [pid 63309:tid 63336] [client 20.151.248.149:47013] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "adx1XEpIKZ10weXpf0XUVAAAABc"]
[Mon Apr 13 12:47:24.703307 2026] [:error] [pid 63311:tid 63392] [client 20.151.248.149:46995] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "adx1XKHjrGN1MqBCVFmGkAAAAJU"]
[Mon Apr 13 12:47:25.967635 2026] [:error] [pid 7228:tid 7249] [client 20.151.248.149:47067] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "adx1XQEnn1dQrOSHHNW0XAAAARM"]
[Mon Apr 13 12:47:26.639532 2026] [:error] [pid 63310:tid 63358] [client 20.151.248.149:47031] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/sfcl.php"] [unique_id "adx1XnoXpRU5ztmwPjL1gAAAAE4"]
[Mon Apr 13 12:47:27.385049 2026] [:error] [pid 63406:tid 63430] [client 20.151.248.149:47091] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/database.php"] [unique_id "adx1X7HZEIkQ0Zmgp5qDVgAAANM"]
[Mon Apr 13 12:47:27.948564 2026] [:error] [pid 63309:tid 63313] [client 20.151.248.149:47098] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/database.php"] [unique_id "adx1X0pIKZ10weXpf0XUXAAAAAA"]
[Mon Apr 13 12:47:28.377287 2026] [:error] [pid 57183:tid 57204] [client 20.151.248.149:46856] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/database.php"] [unique_id "adx1YDDO3t8R5NaxzYQ4FwAAAVM"]
[Mon Apr 13 12:47:28.866582 2026] [:error] [pid 57183:tid 57198] [client 20.151.248.149:47042] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/css/database.php"] [unique_id "adx1YDDO3t8R5NaxzYQ4GAAAAU0"]
[Mon Apr 13 12:47:29.538763 2026] [:error] [pid 63309:tid 63327] [client 20.151.248.149:46839] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca-022.php"] [unique_id "adx1YUpIKZ10weXpf0XUXQAAAA4"]
[Mon Apr 13 12:47:30.182712 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:46800] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca-022.php"] [unique_id "adx1YgEnn1dQrOSHHNW0ZAAAAQA"]
[Mon Apr 13 12:47:30.707733 2026] [:error] [pid 63311:tid 63388] [client 20.151.248.149:46963] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca-022.php"] [unique_id "adx1YqHjrGN1MqBCVFmGmAAAAJE"]
[Mon Apr 13 12:47:31.589527 2026] [:error] [pid 57183:tid 57196] [client 20.151.248.149:46817] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ca-022.php"] [unique_id "adx1YzDO3t8R5NaxzYQ4HgAAAUs"]
[Mon Apr 13 12:47:32.446726 2026] [:error] [pid 57183:tid 57195] [client 20.151.248.149:46949] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/act.php"] [unique_id "adx1ZDDO3t8R5NaxzYQ4JQAAAUo"]
[Mon Apr 13 12:47:33.203460 2026] [:error] [pid 63309:tid 63330] [client 20.151.248.149:47060] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/act.php"] [unique_id "adx1ZUpIKZ10weXpf0XUYAAAABE"]
[Mon Apr 13 12:47:33.829454 2026] [:error] [pid 7228:tid 7253] [client 20.151.248.149:47082] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/act.php"] [unique_id "adx1ZQEnn1dQrOSHHNW0agAAARc"]
[Mon Apr 13 12:47:34.749097 2026] [:error] [pid 63309:tid 63313] [client 20.151.248.149:46720] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/act.php"] [unique_id "adx1ZkpIKZ10weXpf0XUZgAAAAA"]
[Mon Apr 13 12:47:35.331842 2026] [:error] [pid 63310:tid 63355] [client 20.151.248.149:47004] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enacting.php"] [unique_id "adx1Z3oXpRU5ztmwPjL1kQAAAEs"]
[Mon Apr 13 12:47:35.770664 2026] [:error] [pid 63310:tid 63344] [client 20.151.248.149:46907] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enacting.php"] [unique_id "adx1Z3oXpRU5ztmwPjL1kgAAAEA"]
[Mon Apr 13 12:47:37.346328 2026] [:error] [pid 7228:tid 7244] [client 20.151.248.149:47066] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enacting.php"] [unique_id "adx1aQEnn1dQrOSHHNW0bgAAAQ4"]
[Mon Apr 13 12:47:38.265654 2026] [:error] [pid 63311:tid 63390] [client 20.151.248.149:46925] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/enacting.php"] [unique_id "adx1aqHjrGN1MqBCVFmGnQAAAJM"]
[Mon Apr 13 12:47:38.793388 2026] [:error] [pid 63311:tid 63378] [client 20.151.248.149:47046] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adx1aqHjrGN1MqBCVFmGoQAAAIc"]
[Mon Apr 13 12:47:40.095830 2026] [:error] [pid 63406:tid 63427] [client 20.151.248.149:47100] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adx1bLHZEIkQ0Zmgp5qDZQAAANA"]
[Mon Apr 13 12:47:41.091068 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:46814] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adx1bbHZEIkQ0Zmgp5qDZwAAAMc"]
[Mon Apr 13 12:47:46.601958 2026] [:error] [pid 63406:tid 63420] [client 20.151.248.149:46928] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ta0ol.php"] [unique_id "adx1crHZEIkQ0Zmgp5qDcwAAAMk"]
[Mon Apr 13 12:47:47.163534 2026] [:error] [pid 63406:tid 63413] [client 20.151.248.149:46689] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "adx1c7HZEIkQ0Zmgp5qDdAAAAMI"]
[Mon Apr 13 12:47:48.364510 2026] [:error] [pid 57183:tid 57208] [client 20.151.248.149:47099] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "adx1dDDO3t8R5NaxzYQ4RAAAAVc"]
[Mon Apr 13 12:47:49.411459 2026] [:error] [pid 63406:tid 63421] [client 20.151.248.149:46934] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "adx1dbHZEIkQ0Zmgp5qDgQAAAMo"]
[Mon Apr 13 12:47:50.402196 2026] [:error] [pid 63406:tid 63420] [client 20.151.248.149:47053] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cilng.php"] [unique_id "adx1drHZEIkQ0Zmgp5qDgwAAAMk"]
[Mon Apr 13 12:47:51.155968 2026] [:error] [pid 7228:tid 7238] [client 20.151.248.149:46940] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "adx1dwEnn1dQrOSHHNW0jAAAAQg"]
[Mon Apr 13 12:47:51.677758 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:46903] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "adx1d7HZEIkQ0Zmgp5qDhQAAAMc"]
[Mon Apr 13 12:47:52.198734 2026] [:error] [pid 63309:tid 63330] [client 20.151.248.149:46945] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "adx1eEpIKZ10weXpf0XUcAAAABE"]
[Mon Apr 13 12:47:52.640036 2026] [:error] [pid 57183:tid 57204] [client 20.151.248.149:47064] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bkxzo.php"] [unique_id "adx1eDDO3t8R5NaxzYQ4SgAAAVM"]
[Mon Apr 13 12:47:53.126984 2026] [:error] [pid 63406:tid 63428] [client 20.151.248.149:47043] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adx1ebHZEIkQ0Zmgp5qDhgAAANE"]
[Mon Apr 13 12:47:53.600977 2026] [:error] [pid 63406:tid 63417] [client 20.151.248.149:46873] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adx1ebHZEIkQ0Zmgp5qDiAAAAMY"]
[Mon Apr 13 12:47:54.236110 2026] [:error] [pid 57183:tid 57191] [client 20.151.248.149:47018] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adx1ejDO3t8R5NaxzYQ4UQAAAUY"]
[Mon Apr 13 12:47:54.963040 2026] [:error] [pid 63406:tid 63433] [client 20.151.248.149:46818] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/acp.php"] [unique_id "adx1erHZEIkQ0Zmgp5qDiwAAANY"]
[Mon Apr 13 12:47:55.521363 2026] [:error] [pid 7228:tid 7248] [client 20.151.248.149:47075] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nti.php"] [unique_id "adx1ewEnn1dQrOSHHNW0kAAAARI"]
[Mon Apr 13 12:47:56.245780 2026] [:error] [pid 63406:tid 63434] [client 20.151.248.149:46815] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nti.php"] [unique_id "adx1fLHZEIkQ0Zmgp5qDjQAAANc"]
[Mon Apr 13 12:47:56.976784 2026] [:error] [pid 7228:tid 7245] [client 20.151.248.149:46922] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nti.php"] [unique_id "adx1fAEnn1dQrOSHHNW0kwAAAQ8"]
[Mon Apr 13 12:47:57.691339 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:47039] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nti.php"] [unique_id "adx1fQEnn1dQrOSHHNW0lgAAARU"]
[Mon Apr 13 12:47:58.204022 2026] [:error] [pid 7228:tid 7246] [client 20.151.248.149:46775] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adx1fgEnn1dQrOSHHNW0mQAAARA"]
[Mon Apr 13 12:47:58.711461 2026] [:error] [pid 63309:tid 63320] [client 20.151.248.149:46771] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adx1fkpIKZ10weXpf0XUcwAAAAc"]
[Mon Apr 13 12:47:59.372453 2026] [:error] [pid 7228:tid 7231] [client 20.151.248.149:46753] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adx1fwEnn1dQrOSHHNW0nwAAAQE"]
[Mon Apr 13 12:48:00.272741 2026] [:error] [pid 7228:tid 7254] [client 20.151.248.149:47000] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/rh.php"] [unique_id "adx1gAEnn1dQrOSHHNW0ogAAARg"]
[Mon Apr 13 12:48:00.967575 2026] [:error] [pid 63310:tid 63348] [client 20.151.248.149:46770] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Eva.php"] [unique_id "adx1gHoXpRU5ztmwPjL1lAAAAEQ"]
[Mon Apr 13 12:48:01.480857 2026] [:error] [pid 63311:tid 63382] [client 20.151.248.149:46939] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Eva.php"] [unique_id "adx1gaHjrGN1MqBCVFmGuAAAAIs"]
[Mon Apr 13 12:48:01.989722 2026] [:error] [pid 63311:tid 63374] [client 20.151.248.149:47024] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Eva.php"] [unique_id "adx1gaHjrGN1MqBCVFmGuQAAAIM"]
[Mon Apr 13 12:48:02.586496 2026] [:error] [pid 63406:tid 63429] [client 20.151.248.149:46731] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/Eva.php"] [unique_id "adx1grHZEIkQ0Zmgp5qDkwAAANI"]
[Mon Apr 13 12:48:03.112006 2026] [:error] [pid 63406:tid 63424] [client 20.151.248.149:46729] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nco.php"] [unique_id "adx1g7HZEIkQ0Zmgp5qDlAAAAM0"]
[Mon Apr 13 12:48:03.680218 2026] [:error] [pid 63310:tid 63352] [client 20.151.248.149:47037] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nco.php"] [unique_id "adx1g3oXpRU5ztmwPjL1owAAAEg"]
[Mon Apr 13 12:48:04.315053 2026] [:error] [pid 63406:tid 63418] [client 20.151.248.149:46773] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nco.php"] [unique_id "adx1hLHZEIkQ0Zmgp5qDlwAAAMc"]
[Mon Apr 13 12:48:05.142215 2026] [:error] [pid 7228:tid 7232] [client 20.151.248.149:46979] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/nco.php"] [unique_id "adx1hQEnn1dQrOSHHNW06wAAAQI"]
[Mon Apr 13 12:48:05.671040 2026] [:error] [pid 7228:tid 7245] [client 20.151.248.149:46977] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adx1hQEnn1dQrOSHHNW07AAAAQ8"]
[Mon Apr 13 12:48:06.158369 2026] [:error] [pid 7228:tid 7248] [client 20.151.248.149:46933] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adx1hgEnn1dQrOSHHNW08gAAARI"]
[Mon Apr 13 12:48:06.741669 2026] [:error] [pid 7228:tid 7249] [client 20.151.248.149:46987] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adx1hgEnn1dQrOSHHNW09AAAARM"]
[Mon Apr 13 12:48:07.424715 2026] [:error] [pid 63406:tid 63430] [client 20.151.248.149:46743] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xwx1.php"] [unique_id "adx1h7HZEIkQ0Zmgp5qDmwAAANM"]
[Mon Apr 13 12:48:07.981708 2026] [:error] [pid 63310:tid 63361] [client 20.151.248.149:46914] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55l453.php"] [unique_id "adx1h3oXpRU5ztmwPjL1pQAAAFE"]
[Mon Apr 13 12:48:08.519867 2026] [:error] [pid 7228:tid 7239] [client 20.151.248.149:46953] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55l453.php"] [unique_id "adx1iAEnn1dQrOSHHNW0-AAAAQk"]
[Mon Apr 13 12:48:09.020304 2026] [:error] [pid 63309:tid 63327] [client 20.151.248.149:46924] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55l453.php"] [unique_id "adx1iUpIKZ10weXpf0XUiAAAAA4"]
[Mon Apr 13 12:48:09.468568 2026] [:error] [pid 57183:tid 57186] [client 20.151.248.149:47089] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/55l453.php"] [unique_id "adx1iTDO3t8R5NaxzYQ4XwAAAUE"]
[Mon Apr 13 12:48:10.148999 2026] [:error] [pid 63309:tid 63318] [client 20.151.248.149:46681] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-stat.php"] [unique_id "adx1ikpIKZ10weXpf0XUigAAAAU"]
[Mon Apr 13 12:48:10.639402 2026] [:error] [pid 57183:tid 57187] [client 20.151.248.149:46748] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-stat.php"] [unique_id "adx1ijDO3t8R5NaxzYQ4YgAAAUI"]
[Mon Apr 13 12:48:11.505059 2026] [:error] [pid 7228:tid 7241] [client 20.151.248.149:46891] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-stat.php"] [unique_id "adx1iwEnn1dQrOSHHNW0_gAAAQs"]
[Mon Apr 13 12:48:12.079365 2026] [:error] [pid 63406:tid 63429] [client 20.151.248.149:46942] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-stat.php"] [unique_id "adx1jLHZEIkQ0Zmgp5qD4gAAANI"]
[Mon Apr 13 12:48:12.622612 2026] [:error] [pid 57183:tid 57195] [client 20.151.248.149:47016] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "adx1jDDO3t8R5NaxzYQ4ZgAAAUo"]
[Mon Apr 13 12:48:14.001201 2026] [:error] [pid 57183:tid 57203] [client 20.151.248.149:47008] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "adx1jjDO3t8R5NaxzYQ4bwAAAVI"]
[Mon Apr 13 12:48:17.972669 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:47065] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/as.php"] [unique_id "adx1kQEnn1dQrOSHHNW1DQAAAQc"]
[Mon Apr 13 12:48:21.022207 2026] [:error] [pid 7228:tid 7232] [client 20.151.248.149:47011] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Apr 13 12:48:21.248100 2026] [:error] [pid 7228:tid 7247] [client 20.151.248.149:47011] File does not exist: /usr/local/apache/htdocs/suspended-page/zo.php
[Mon Apr 13 12:48:21.777885 2026] [:error] [pid 7228:tid 7251] [client 20.151.248.149:47011] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq.php
[Mon Apr 13 12:48:21.987678 2026] [:error] [pid 7228:tid 7239] [client 20.151.248.149:47011] File does not exist: /usr/local/apache/htdocs/suspended-page/wxpass.php
[Mon Apr 13 12:48:22.222167 2026] [:error] [pid 7228:tid 7233] [client 20.151.248.149:47011] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-demomav.php"] [unique_id "adx1lgEnn1dQrOSHHNW1JwAAAQM"]
[Mon Apr 13 12:48:23.391816 2026] [:error] [pid 7228:tid 7253] [client 20.151.248.149:47036] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-demomav.php"] [unique_id "adx1lwEnn1dQrOSHHNW1KQAAARc"]
[Mon Apr 13 12:48:25.836935 2026] [:error] [pid 63311:tid 63373] [client 20.151.248.149:46947] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-demomav.php"] [unique_id "adx1maHjrGN1MqBCVFmGzgAAAII"]
[Mon Apr 13 12:48:26.438795 2026] [:error] [pid 63406:tid 63421] [client 20.151.248.149:47014] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-demomav.php"] [unique_id "adx1mrHZEIkQ0Zmgp5qD9gAAAMo"]
[Mon Apr 13 12:48:27.169527 2026] [:error] [pid 63406:tid 63423] [client 20.151.248.149:46915] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adx1m7HZEIkQ0Zmgp5qD-gAAAMw"]
[Mon Apr 13 12:48:27.698400 2026] [:error] [pid 7228:tid 7241] [client 20.151.248.149:46863] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adx1mwEnn1dQrOSHHNW1MgAAAQs"]
[Mon Apr 13 12:48:29.278594 2026] [:error] [pid 57183:tid 57190] [client 20.151.248.149:47070] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adx1nTDO3t8R5NaxzYQ4gwAAAUU"]
[Mon Apr 13 12:48:30.209321 2026] [:error] [pid 57183:tid 57192] [client 20.151.248.149:46792] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wpls.php"] [unique_id "adx1njDO3t8R5NaxzYQ4hwAAAUc"]
[Mon Apr 13 12:48:30.846292 2026] [:error] [pid 63406:tid 63432] [client 20.151.248.149:47072] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "adx1nrHZEIkQ0Zmgp5qEAgAAANU"]
[Mon Apr 13 12:48:31.297030 2026] [:error] [pid 63406:tid 63430] [client 20.151.248.149:46988] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "adx1n7HZEIkQ0Zmgp5qEAwAAANM"]
[Mon Apr 13 12:48:31.720977 2026] [:error] [pid 63311:tid 63391] [client 20.151.248.149:47012] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "adx1n6HjrGN1MqBCVFmG0QAAAJQ"]
[Mon Apr 13 12:48:32.229330 2026] [:error] [pid 63309:tid 63335] [client 20.151.248.149:47095] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-gr.php"] [unique_id "adx1oEpIKZ10weXpf0XUqQAAABY"]
[Mon Apr 13 12:48:32.740016 2026] [:error] [pid 63406:tid 63427] [client 20.151.248.149:46999] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adx1oLHZEIkQ0Zmgp5qEBwAAANA"]
[Mon Apr 13 12:48:33.220232 2026] [:error] [pid 63406:tid 63429] [client 20.151.248.149:47035] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adx1obHZEIkQ0Zmgp5qECAAAANI"]
[Mon Apr 13 12:48:33.635009 2026] [:error] [pid 63309:tid 63326] [client 20.151.248.149:46917] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adx1oUpIKZ10weXpf0XUqgAAAA0"]
[Mon Apr 13 12:48:34.079574 2026] [:error] [pid 57183:tid 57201] [client 20.151.248.149:46991] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/file-gertdxz.php"] [unique_id "adx1ojDO3t8R5NaxzYQ4kAAAAVA"]
[Mon Apr 13 12:48:34.496231 2026] [:error] [pid 63309:tid 63331] [client 20.151.248.149:47087] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adx1okpIKZ10weXpf0XUrgAAABI"]
[Mon Apr 13 12:48:35.129055 2026] [:error] [pid 57183:tid 57197] [client 20.151.248.149:47001] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adx1ozDO3t8R5NaxzYQ4kQAAAUw"]
[Mon Apr 13 12:48:35.824487 2026] [:error] [pid 57183:tid 57194] [client 20.151.248.149:46921] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adx1ozDO3t8R5NaxzYQ4kgAAAUk"]
[Mon Apr 13 12:48:36.626559 2026] [:error] [pid 63310:tid 63365] [client 20.151.248.149:46941] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/2026w.php"] [unique_id "adx1pHoXpRU5ztmwPjL1uAAAAFU"]
[Mon Apr 13 12:48:37.248102 2026] [:error] [pid 57183:tid 57192] [client 20.151.248.149:46790] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "adx1pTDO3t8R5NaxzYQ4lAAAAUc"]
[Mon Apr 13 12:48:37.745112 2026] [:error] [pid 57183:tid 57209] [client 20.151.248.149:47033] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "adx1pTDO3t8R5NaxzYQ4lgAAAVg"]
[Mon Apr 13 12:48:38.260569 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:46964] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "adx1prHZEIkQ0Zmgp5qEEAAAAM8"]
[Mon Apr 13 12:48:38.679285 2026] [:error] [pid 63309:tid 63337] [client 20.151.248.149:47006] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ckk.php"] [unique_id "adx1pkpIKZ10weXpf0XUsAAAABg"]
[Mon Apr 13 12:48:39.120094 2026] [:error] [pid 63311:tid 63393] [client 20.151.248.149:46997] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adx1p6HjrGN1MqBCVFmG2wAAAJY"]
[Mon Apr 13 12:48:39.559381 2026] [:error] [pid 57183:tid 57189] [client 20.151.248.149:46860] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adx1pzDO3t8R5NaxzYQ4mwAAAUQ"]
[Mon Apr 13 12:48:40.182655 2026] [:error] [pid 57183:tid 57192] [client 20.151.248.149:46887] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adx1qDDO3t8R5NaxzYQ4ngAAAUc"]
[Mon Apr 13 12:48:40.647382 2026] [:error] [pid 57183:tid 57185] [client 20.151.248.149:46852] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/img.php"] [unique_id "adx1qDDO3t8R5NaxzYQ4oAAAAUA"]
[Mon Apr 13 12:48:41.159991 2026] [:error] [pid 57183:tid 57209] [client 20.151.248.149:47078] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zt2.php"] [unique_id "adx1qTDO3t8R5NaxzYQ4oQAAAVg"]
[Mon Apr 13 12:48:41.982795 2026] [:error] [pid 63309:tid 63318] [client 20.151.248.149:46877] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zt2.php"] [unique_id "adx1qUpIKZ10weXpf0XUuQAAAAU"]
[Mon Apr 13 12:48:42.615425 2026] [:error] [pid 63406:tid 63413] [client 20.151.248.149:46862] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zt2.php"] [unique_id "adx1qrHZEIkQ0Zmgp5qEFgAAAMI"]
[Mon Apr 13 12:48:43.036797 2026] [:error] [pid 63311:tid 63394] [client 20.151.248.149:46927] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/zt2.php"] [unique_id "adx1q6HjrGN1MqBCVFmG3gAAAJc"]
[Mon Apr 13 12:48:43.492704 2026] [:error] [pid 63406:tid 63411] [client 20.151.248.149:46919] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-cc.php"] [unique_id "adx1q7HZEIkQ0Zmgp5qEGQAAAMA"]
[Mon Apr 13 12:48:43.979024 2026] [:error] [pid 63309:tid 63325] [client 20.151.248.149:46842] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-cc.php"] [unique_id "adx1q0pIKZ10weXpf0XUvwAAAAw"]
[Mon Apr 13 12:48:44.467166 2026] [:error] [pid 57183:tid 57199] [client 20.151.248.149:46972] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-cc.php"] [unique_id "adx1rDDO3t8R5NaxzYQ4pwAAAU4"]
[Mon Apr 13 12:48:45.015976 2026] [:error] [pid 57183:tid 57208] [client 20.151.248.149:46858] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/class-cc.php"] [unique_id "adx1rTDO3t8R5NaxzYQ4qwAAAVc"]
[Mon Apr 13 12:48:45.768947 2026] [:error] [pid 57183:tid 57204] [client 20.151.248.149:46797] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-lvminl.php"] [unique_id "adx1rTDO3t8R5NaxzYQ4rwAAAVM"]
[Mon Apr 13 12:48:46.209065 2026] [:error] [pid 57183:tid 57186] [client 20.151.248.149:46853] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-lvminl.php"] [unique_id "adx1rjDO3t8R5NaxzYQ4sAAAAUE"]
[Mon Apr 13 12:48:46.648693 2026] [:error] [pid 63406:tid 63425] [client 20.151.248.149:47058] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-lvminl.php"] [unique_id "adx1rrHZEIkQ0Zmgp5qEHQAAAM4"]
[Mon Apr 13 12:48:47.142595 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:46986] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-lvminl.php"] [unique_id "adx1rwEnn1dQrOSHHNW1SwAAAQc"]
[Mon Apr 13 12:48:47.714977 2026] [:error] [pid 57183:tid 57199] [client 20.151.248.149:46787] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bx.php"] [unique_id "adx1rzDO3t8R5NaxzYQ4tgAAAU4"]
[Mon Apr 13 12:48:48.271774 2026] [:error] [pid 57183:tid 57190] [client 20.151.248.149:46874] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bx.php"] [unique_id "adx1sDDO3t8R5NaxzYQ4uAAAAUU"]
[Mon Apr 13 12:48:48.703727 2026] [:error] [pid 57183:tid 57200] [client 20.151.248.149:47061] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bx.php"] [unique_id "adx1sDDO3t8R5NaxzYQ4vQAAAU8"]
[Mon Apr 13 12:48:49.162751 2026] [:error] [pid 7228:tid 7254] [client 20.151.248.149:47009] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/bx.php"] [unique_id "adx1sQEnn1dQrOSHHNW1UAAAARg"]
[Mon Apr 13 12:48:49.596864 2026] [:error] [pid 63310:tid 63353] [client 20.151.248.149:46976] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adx1sXoXpRU5ztmwPjL1vgAAAEk"]
[Mon Apr 13 12:48:50.023933 2026] [:error] [pid 57183:tid 57195] [client 20.151.248.149:47077] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adx1sjDO3t8R5NaxzYQ4wAAAAUo"]
[Mon Apr 13 12:48:50.518501 2026] [:error] [pid 63310:tid 63365] [client 20.151.248.149:46899] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adx1snoXpRU5ztmwPjL1wgAAAFU"]
[Mon Apr 13 12:48:50.995682 2026] [:error] [pid 63310:tid 63362] [client 20.151.248.149:46971] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classwithtostring.php"] [unique_id "adx1snoXpRU5ztmwPjL1xAAAAFI"]
[Mon Apr 13 12:48:52.259408 2026] [:error] [pid 63310:tid 63355] [client 20.151.248.149:47056] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adx1tHoXpRU5ztmwPjL1xgAAAEs"]
[Mon Apr 13 12:48:53.067849 2026] [:error] [pid 7228:tid 7232] [client 20.151.248.149:47044] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adx1tQEnn1dQrOSHHNW1VAAAAQI"]
[Mon Apr 13 12:48:53.836253 2026] [:error] [pid 63406:tid 63426] [client 20.151.248.149:46795] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adx1tbHZEIkQ0Zmgp5qEIwAAAM8"]
[Mon Apr 13 12:48:54.408842 2026] [:error] [pid 63309:tid 63313] [client 20.151.248.149:46669] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/dx.php"] [unique_id "adx1tkpIKZ10weXpf0XUzwAAAAA"]
[Mon Apr 13 12:48:55.863282 2026] [:error] [pid 63309:tid 63326] [client 20.151.248.149:46885] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24name.php"] [unique_id "adx1t0pIKZ10weXpf0XU0gAAAA0"]
[Mon Apr 13 12:48:56.982084 2026] [:error] [pid 63311:tid 63391] [client 20.151.248.149:46855] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24name.php"] [unique_id "adx1uKHjrGN1MqBCVFmG6AAAAJQ"]
[Mon Apr 13 12:48:58.191684 2026] [:error] [pid 63309:tid 63315] [client 20.151.248.149:47028] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24name.php"] [unique_id "adx1ukpIKZ10weXpf0XU1AAAAAI"]
[Mon Apr 13 12:48:59.222821 2026] [:error] [pid 63309:tid 63334] [client 20.151.248.149:46890] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/24name.php"] [unique_id "adx1u0pIKZ10weXpf0XU1wAAABU"]
[Mon Apr 13 12:48:59.758485 2026] [:error] [pid 7228:tid 7243] [client 20.151.248.149:46960] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "adx1uwEnn1dQrOSHHNW1WAAAAQ0"]
[Mon Apr 13 12:49:00.235198 2026] [:error] [pid 57183:tid 57198] [client 20.151.248.149:47019] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "adx1vDDO3t8R5NaxzYQ41wAAAU0"]
[Mon Apr 13 12:49:00.756029 2026] [:error] [pid 63310:tid 63356] [client 20.151.248.149:46962] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "adx1vHoXpRU5ztmwPjL10wAAAEw"]
[Mon Apr 13 12:49:01.611773 2026] [:error] [pid 63310:tid 63359] [client 20.151.248.149:46741] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/re.php"] [unique_id "adx1vXoXpRU5ztmwPjL11gAAAE8"]
[Mon Apr 13 12:49:02.146584 2026] [:error] [pid 63310:tid 63350] [client 20.151.248.149:46840] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adx1vnoXpRU5ztmwPjL12QAAAEY"]
[Mon Apr 13 12:49:02.660272 2026] [:error] [pid 7228:tid 7234] [client 20.151.248.149:46850] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adx1vgEnn1dQrOSHHNW1WgAAAQQ"]
[Mon Apr 13 12:49:03.419407 2026] [:error] [pid 63311:tid 63393] [client 20.151.248.149:46767] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adx1v6HjrGN1MqBCVFmG7wAAAJY"]
[Mon Apr 13 12:49:03.938956 2026] [:error] [pid 63406:tid 63432] [client 20.151.248.149:46920] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/xx.php"] [unique_id "adx1v7HZEIkQ0Zmgp5qEKAAAANU"]
[Mon Apr 13 12:49:04.651664 2026] [:error] [pid 63310:tid 63362] [client 20.151.248.149:46959] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adx1wHoXpRU5ztmwPjL14gAAAFI"]
[Mon Apr 13 12:49:05.289691 2026] [:error] [pid 63311:tid 63385] [client 20.151.248.149:47081] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adx1waHjrGN1MqBCVFmG8QAAAI4"]
[Mon Apr 13 12:49:05.781034 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:46867] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adx1wQEnn1dQrOSHHNW1YQAAAQA"]
[Mon Apr 13 12:49:06.213853 2026] [:error] [pid 7228:tid 7240] [client 20.151.248.149:46784] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/6.php"] [unique_id "adx1wgEnn1dQrOSHHNW1YgAAAQo"]
[Mon Apr 13 12:49:06.784722 2026] [:error] [pid 57183:tid 57204] [client 20.151.248.149:46944] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blox.php"] [unique_id "adx1wjDO3t8R5NaxzYQ44gAAAVM"]
[Mon Apr 13 12:49:07.717167 2026] [:error] [pid 63311:tid 63376] [client 20.151.248.149:46913] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blox.php"] [unique_id "adx1w6HjrGN1MqBCVFmG9gAAAIU"]
[Mon Apr 13 12:49:08.266682 2026] [:error] [pid 57183:tid 57191] [client 20.151.248.149:46937] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blox.php"] [unique_id "adx1xDDO3t8R5NaxzYQ44wAAAUY"]
[Mon Apr 13 12:49:08.799555 2026] [:error] [pid 57183:tid 57206] [client 20.151.248.149:46745] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/blox.php"] [unique_id "adx1xDDO3t8R5NaxzYQ45wAAAVU"]
[Mon Apr 13 12:49:09.487041 2026] [:error] [pid 63309:tid 63334] [client 20.151.248.149:46872] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cibai.php"] [unique_id "adx1xUpIKZ10weXpf0XU3wAAABU"]
[Mon Apr 13 12:49:10.017323 2026] [:error] [pid 63310:tid 63366] [client 20.151.248.149:46916] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cibai.php"] [unique_id "adx1xnoXpRU5ztmwPjL15wAAAFY"]
[Mon Apr 13 12:49:10.623654 2026] [:error] [pid 7228:tid 7244] [client 20.151.248.149:46710] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cibai.php"] [unique_id "adx1xgEnn1dQrOSHHNW1bwAAAQ4"]
[Mon Apr 13 12:49:11.148507 2026] [:error] [pid 7228:tid 7247] [client 20.151.248.149:46974] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cibai.php"] [unique_id "adx1xwEnn1dQrOSHHNW1cQAAARE"]
[Mon Apr 13 12:49:11.615196 2026] [:error] [pid 7228:tid 7230] [client 20.151.248.149:46880] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso-x569.php"] [unique_id "adx1xwEnn1dQrOSHHNW1cgAAAQA"]
[Mon Apr 13 12:49:12.081927 2026] [:error] [pid 7228:tid 7237] [client 20.151.248.149:46864] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso-x569.php"] [unique_id "adx1yAEnn1dQrOSHHNW1cwAAAQc"]
[Mon Apr 13 12:49:12.581006 2026] [:error] [pid 7228:tid 7235] [client 20.151.248.149:46978] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso-x569.php"] [unique_id "adx1yAEnn1dQrOSHHNW1dAAAAQU"]
[Mon Apr 13 12:49:13.936302 2026] [:error] [pid 63310:tid 63349] [client 20.151.248.149:46956] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wso-x569.php"] [unique_id "adx1yXoXpRU5ztmwPjL16gAAAEU"]
[Mon Apr 13 12:49:14.404680 2026] [:error] [pid 63311:tid 63386] [client 20.151.248.149:46935] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adx1yqHjrGN1MqBCVFmG_wAAAI8"]
[Mon Apr 13 12:49:14.961175 2026] [:error] [pid 63311:tid 63387] [client 20.151.248.149:46957] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adx1yqHjrGN1MqBCVFmHAAAAAJA"]
[Mon Apr 13 12:49:15.618039 2026] [:error] [pid 57183:tid 57193] [client 20.151.248.149:46849] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adx1yzDO3t8R5NaxzYQ47QAAAUg"]
[Mon Apr 13 12:49:16.333897 2026] [:error] [pid 63311:tid 63374] [client 20.151.248.149:46832] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-ccv.php"] [unique_id "adx1zKHjrGN1MqBCVFmHAwAAAIM"]
[Mon Apr 13 12:49:17.063568 2026] [:error] [pid 63311:tid 63381] [client 20.151.248.149:46782] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classc.php"] [unique_id "adx1zaHjrGN1MqBCVFmHBAAAAIo"]
[Mon Apr 13 12:49:17.571035 2026] [:error] [pid 7228:tid 7247] [client 20.151.248.149:46785] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classc.php"] [unique_id "adx1zQEnn1dQrOSHHNW1hgAAARE"]
[Mon Apr 13 12:49:18.018458 2026] [:error] [pid 7228:tid 7252] [client 20.151.248.149:46871] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classc.php"] [unique_id "adx1zgEnn1dQrOSHHNW1iAAAARY"]
[Mon Apr 13 12:49:18.530269 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:46895] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/classc.php"] [unique_id "adx1zgEnn1dQrOSHHNW1iwAAAQw"]
[Mon Apr 13 12:49:19.024968 2026] [:error] [pid 63311:tid 63379] [client 20.151.248.149:47032] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HLA-dd.php"] [unique_id "adx1z6HjrGN1MqBCVFmHCAAAAIg"]
[Mon Apr 13 12:49:19.600308 2026] [:error] [pid 63311:tid 63388] [client 20.151.248.149:46904] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HLA-dd.php"] [unique_id "adx1z6HjrGN1MqBCVFmHCwAAAJE"]
[Mon Apr 13 12:49:20.057147 2026] [:error] [pid 7228:tid 7241] [client 20.151.248.149:46859] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HLA-dd.php"] [unique_id "adx10AEnn1dQrOSHHNW1kgAAAQs"]
[Mon Apr 13 12:49:20.552944 2026] [:error] [pid 7228:tid 7242] [client 20.151.248.149:46821] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/HLA-dd.php"] [unique_id "adx10AEnn1dQrOSHHNW1lQAAAQw"]
[Mon Apr 13 12:49:21.109249 2026] [:error] [pid 7228:tid 7249] [client 20.151.248.149:46722] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "adx10QEnn1dQrOSHHNW1lwAAARM"]
[Mon Apr 13 12:49:21.550638 2026] [:error] [pid 7228:tid 7233] [client 20.151.248.149:47090] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/kaza.php"] [unique_id "adx10QEnn1dQrOSHHNW1mwAAAQM"]
[Mon Apr 13 12:49:22.144949 2026] [:error] [pid 63311:tid 63371] [client 20.151.248.149:46829] File does not exist: /usr/local/apache/htdocs/suspended-page/kaza.php
[Mon Apr 13 12:49:22.353433 2026] [:error] [pid 63311:tid 63372] [client 20.151.248.149:46829] File does not exist: /usr/local/apache/htdocs/suspended-page/444.php
[Mon Apr 13 15:27:34.280570 2026] [:error] [pid 57183:tid 57198] [client 198.53.197.2:61290] [client 198.53.197.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.53.197.2, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adya5jDO3t8R5NaxzYSRPAAAAU0"]
[Mon Apr 13 15:27:34.287796 2026] [:error] [pid 57183:tid 57198] [client 198.53.197.2:61290] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Apr 13 15:47:09.748751 2026] [:error] [pid 63406:tid 63418] [client 196.43.154.20:52105] [client 196.43.154.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.43.154.20, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "adyffbHZEIkQ0Zmgp5rSUAAAAMc"]
[Mon Apr 13 15:47:09.754034 2026] [:error] [pid 63406:tid 63418] [client 196.43.154.20:52105] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Apr 13 20:37:18.973811 2026] [:error] [pid 63406:tid 63423] [client 103.77.107.178:50214] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/sftp-config.json"] [unique_id "adzjfrHZEIkQ0Zmgp5qofQAAAMw"]
[Mon Apr 13 22:05:26.720465 2026] [:error] [pid 9314:tid 9330] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Apr 13 22:05:26.998905 2026] [:error] [pid 9314:tid 9334] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Mon Apr 13 22:05:27.280999 2026] [:error] [pid 9314:tid 9321] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Apr 13 22:05:27.581398 2026] [:error] [pid 9314:tid 9332] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Apr 13 22:05:27.864160 2026] [:error] [pid 9314:tid 9340] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Apr 13 22:05:28.146341 2026] [:error] [pid 9314:tid 9317] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Apr 13 22:05:28.432876 2026] [:error] [pid 9314:tid 9339] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 13 22:05:28.726613 2026] [:error] [pid 9314:tid 9319] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Mon Apr 13 22:05:29.298131 2026] [:error] [pid 9314:tid 9328] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Mon Apr 13 22:05:29.584522 2026] [:error] [pid 9314:tid 9324] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Mon Apr 13 22:05:29.863632 2026] [:error] [pid 9314:tid 9320] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Apr 13 22:05:30.145179 2026] [:error] [pid 9314:tid 9338] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Mon Apr 13 22:05:30.462124 2026] [:error] [pid 9314:tid 9331] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Apr 13 22:05:30.763088 2026] [:error] [pid 9314:tid 9326] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Mon Apr 13 22:05:31.085940 2026] [:error] [pid 9314:tid 9323] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Mon Apr 13 22:05:31.380331 2026] [:error] [pid 9314:tid 9316] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Apr 13 22:05:31.666599 2026] [:error] [pid 9314:tid 9330] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Apr 13 22:05:31.955016 2026] [:error] [pid 9314:tid 9339] [client 185.192.71.92:40099] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Mon Apr 13 22:05:36.011063 2026] [:error] [pid 9314:tid 9327] [client 185.192.71.92:40099] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adz4MG_r4W8fX2GWyGQ-2wAAAYs"]
[Mon Apr 13 22:05:37.392004 2026] [:error] [pid 63406:tid 63427] [client 91.230.225.65:47271] [client 91.230.225.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adz4MbHZEIkQ0Zmgp5rnmgAAANA"]
[Mon Apr 13 22:05:38.805148 2026] [:error] [pid 9314:tid 9329] [client 185.192.71.83:64649] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Apr 13 22:05:39.655454 2026] [:error] [pid 9314:tid 9322] [client 185.192.71.83:64649] [client 185.192.71.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adz4M2_r4W8fX2GWyGQ-6QAAAYY"]
[Mon Apr 13 22:05:40.757547 2026] [:error] [pid 9314:tid 9330] [client 185.92.25.118:25139] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon Apr 13 22:05:41.029258 2026] [:error] [pid 9314:tid 9321] [client 185.92.25.118:25139] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adz4NW_r4W8fX2GWyGQ-7gAAAYU"]
[Mon Apr 13 22:05:41.868089 2026] [:error] [pid 63406:tid 63434] [client 185.192.71.95:30933] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Mon Apr 13 22:05:43.258538 2026] [:error] [pid 63406:tid 63416] [client 185.192.71.95:30933] [client 185.192.71.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adz4N7HZEIkQ0Zmgp5rnrQAAAMU"]
[Mon Apr 13 22:05:44.076129 2026] [:error] [pid 63406:tid 63421] [client 185.192.71.83:49389] [client 185.192.71.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adz4OLHZEIkQ0Zmgp5rntAAAAMo"]
[Mon Apr 13 22:05:44.623565 2026] [:error] [pid 63309:tid 63321] [client 91.230.225.240:21821] [client 91.230.225.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adz4OEpIKZ10weXpf0U4rAAAAAg"]
[Mon Apr 13 22:05:45.174025 2026] [:error] [pid 63311:tid 63375] [client 185.92.25.1:56607] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adz4OaHjrGN1MqBCVFkZLgAAAIQ"]
[Mon Apr 13 22:05:45.715052 2026] [:error] [pid 9314:tid 9330] [client 91.230.225.245:52609] [client 91.230.225.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adz4OW_r4W8fX2GWyGQ--gAAAY4"]
[Mon Apr 13 22:05:46.294519 2026] [:error] [pid 7228:tid 7248] [client 91.230.225.69:44605] [client 91.230.225.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adz4OgEnn1dQrOSHHNWx8AAAARI"]
[Mon Apr 13 22:05:47.141184 2026] [:error] [pid 63310:tid 63364] [client 185.192.71.85:37797] [client 185.192.71.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adz4O3oXpRU5ztmwPjJs-QAAAFQ"]
[Mon Apr 13 22:05:47.688802 2026] [:error] [pid 63406:tid 63411] [client 185.192.71.89:25673] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Mon Apr 13 22:05:48.252303 2026] [:error] [pid 63406:tid 63415] [client 185.192.71.89:25673] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "adz4PLHZEIkQ0Zmgp5rnyAAAAMQ"]
[Mon Apr 13 22:05:49.408892 2026] [:error] [pid 9314:tid 9320] [client 185.192.71.98:58847] [client 185.192.71.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adz4PW_r4W8fX2GWyGQ_AgAAAYQ"]
[Mon Apr 13 22:05:50.313370 2026] [:error] [pid 63311:tid 63384] [client 91.230.225.248:26769] [client 91.230.225.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adz4PqHjrGN1MqBCVFkZNwAAAI0"]
[Mon Apr 13 22:05:50.902700 2026] [:error] [pid 63311:tid 63394] [client 91.230.225.56:31269] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Mon Apr 13 22:05:51.191861 2026] [:error] [pid 63311:tid 63376] [client 91.230.225.56:31269] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adz4P6HjrGN1MqBCVFkZOQAAAIU"]
[Mon Apr 13 22:05:52.790106 2026] [:error] [pid 7228:tid 7244] [client 185.192.71.84:40321] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Mon Apr 13 22:05:53.641435 2026] [:error] [pid 7228:tid 7231] [client 185.192.71.84:40321] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Mon Apr 13 22:05:54.496589 2026] [:error] [pid 7228:tid 7241] [client 185.192.71.84:40321] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adz4QgEnn1dQrOSHHNWyBgAAAQs"]
[Mon Apr 13 22:05:55.073524 2026] [:error] [pid 9314:tid 9338] [client 91.230.225.68:23203] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Mon Apr 13 22:05:55.403376 2026] [:error] [pid 9314:tid 9330] [client 91.230.225.68:23203] [client 91.230.225.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adz4Q2_r4W8fX2GWyGQ_DgAAAY4"]
[Mon Apr 13 22:05:55.975588 2026] [:error] [pid 63309:tid 63322] [client 91.230.225.63:50565] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Mon Apr 13 22:05:56.535020 2026] [:error] [pid 63309:tid 63336] [client 91.230.225.63:50565] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adz4REpIKZ10weXpf0U4sgAAABc"]
[Mon Apr 13 22:05:57.409319 2026] [:error] [pid 7228:tid 7236] [client 91.230.225.58:53821] [client 91.230.225.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adz4RQEnn1dQrOSHHNWyCgAAAQY"]
[Mon Apr 13 22:05:58.287686 2026] [:error] [pid 63406:tid 63429] [client 91.230.225.251:52017] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Mon Apr 13 22:05:58.559697 2026] [:error] [pid 63406:tid 63421] [client 91.230.225.251:52017] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Mon Apr 13 22:05:59.121940 2026] [:error] [pid 63406:tid 63427] [client 91.230.225.251:52017] [client 91.230.225.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adz4R7HZEIkQ0Zmgp5rn3gAAANA"]
[Mon Apr 13 22:05:59.978927 2026] [:error] [pid 63310:tid 63355] [client 91.230.225.69:30377] [client 91.230.225.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adz4R3oXpRU5ztmwPjJtBwAAAEs"]
[Mon Apr 13 22:06:03.323060 2026] [:error] [pid 7228:tid 7247] [client 185.92.25.119:39883] [client 185.92.25.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adz4SwEnn1dQrOSHHNWyDwAAARE"]
[Mon Apr 13 22:06:03.868638 2026] [:error] [pid 57183:tid 57192] [client 185.192.71.88:35573] [client 185.192.71.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adz4SzDO3t8R5NaxzYRrWgAAAUc"]
[Mon Apr 13 22:06:04.416459 2026] [:error] [pid 63406:tid 63418] [client 91.230.225.56:57217] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adz4TLHZEIkQ0Zmgp5rn5wAAAMc"]
[Mon Apr 13 22:06:05.515769 2026] [:error] [pid 63406:tid 63414] [client 91.230.225.240:20281] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Mon Apr 13 22:06:05.787735 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.240:20281] [client 91.230.225.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adz4TbHZEIkQ0Zmgp5rn7gAAANM"]
[Mon Apr 13 22:06:06.416172 2026] [:error] [pid 57183:tid 57198] [client 185.92.25.2:20245] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adz4TjDO3t8R5NaxzYRrYAAAAU0"]
[Mon Apr 13 22:06:06.964881 2026] [:error] [pid 9314:tid 9340] [client 91.230.225.243:65399] [client 91.230.225.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adz4Tm_r4W8fX2GWyGQ_JAAAAZg"]
[Mon Apr 13 22:06:08.155101 2026] [:error] [pid 57183:tid 57201] [client 91.230.225.64:20515] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Mon Apr 13 22:06:08.752440 2026] [:error] [pid 57183:tid 57204] [client 91.230.225.64:20515] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Mon Apr 13 22:06:09.891075 2026] [:error] [pid 57183:tid 57187] [client 91.230.225.64:20515] [client 91.230.225.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adz4UTDO3t8R5NaxzYRrcAAAAUI"]
[Mon Apr 13 22:06:11.277808 2026] [:error] [pid 63311:tid 63381] [client 185.192.71.84:37929] [client 185.192.71.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.84, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adz4U6HjrGN1MqBCVFkZSgAAAIo"]
[Mon Apr 13 22:06:11.579779 2026] [:error] [pid 63311:tid 63375] [client 185.192.71.84:37929] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Mon Apr 13 22:06:14.416048 2026] [:error] [pid 63311:tid 63376] [client 185.192.71.84:37929] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Mon Apr 13 22:06:14.708174 2026] [:error] [pid 63311:tid 63388] [client 185.192.71.84:37929] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Mon Apr 13 22:06:17.328058 2026] [:error] [pid 63311:tid 63387] [client 185.192.71.84:37929] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adz4WaHjrGN1MqBCVFkZVwAAAJA"]
[Mon Apr 13 22:06:18.340735 2026] [:error] [pid 7228:tid 7238] [client 91.230.225.69:56037] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Mon Apr 13 22:06:18.626381 2026] [:error] [pid 7228:tid 7233] [client 91.230.225.69:56037] [client 91.230.225.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.69, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adz4WgEnn1dQrOSHHNWyGgAAAQM"]
[Mon Apr 13 22:06:19.239017 2026] [:error] [pid 7228:tid 7236] [client 91.230.225.69:56037] [client 91.230.225.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "adz4WwEnn1dQrOSHHNWyHAAAAQY"]
[Mon Apr 13 22:06:21.144338 2026] [:error] [pid 63309:tid 63315] [client 185.92.25.119:37905] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon Apr 13 22:06:21.769413 2026] [:error] [pid 63309:tid 63324] [client 185.92.25.119:37905] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Mon Apr 13 22:06:22.326292 2026] [:error] [pid 63309:tid 63323] [client 185.92.25.119:37905] [client 185.92.25.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adz4XkpIKZ10weXpf0U4wgAAAAo"]
[Mon Apr 13 22:06:23.377736 2026] [:error] [pid 63310:tid 63367] [client 91.230.225.240:58631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Mon Apr 13 22:06:24.222936 2026] [:error] [pid 63310:tid 63365] [client 91.230.225.240:58631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Mon Apr 13 22:06:24.793866 2026] [:error] [pid 63310:tid 63348] [client 91.230.225.240:58631] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Mon Apr 13 22:06:25.341517 2026] [:error] [pid 63310:tid 63344] [client 91.230.225.240:58631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Mon Apr 13 22:06:25.630420 2026] [:error] [pid 63310:tid 63355] [client 91.230.225.240:58631] [client 91.230.225.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adz4YXoXpRU5ztmwPjJtGAAAAEs"]
[Mon Apr 13 22:06:26.211271 2026] [:error] [pid 57183:tid 57201] [client 185.92.25.118:62453] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Mon Apr 13 22:06:26.490941 2026] [:error] [pid 57183:tid 57196] [client 185.92.25.118:62453] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Mon Apr 13 22:06:26.799697 2026] [:error] [pid 57183:tid 57205] [client 185.92.25.118:62453] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adz4YjDO3t8R5NaxzYRrmAAAAVQ"]
[Mon Apr 13 22:06:28.622480 2026] [:error] [pid 63310:tid 63361] [client 91.230.225.60:25149] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Mon Apr 13 22:06:29.186125 2026] [:error] [pid 63310:tid 63352] [client 91.230.225.60:25149] [client 91.230.225.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.60, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adz4ZXoXpRU5ztmwPjJtIAAAAEg"]
[Mon Apr 13 22:06:29.460103 2026] [:error] [pid 63310:tid 63353] [client 91.230.225.60:25149] [client 91.230.225.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adz4ZXoXpRU5ztmwPjJtIQAAAEk"]
[Mon Apr 13 22:06:33.205268 2026] [:error] [pid 63406:tid 63435] [client 91.230.225.245:27281] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Mon Apr 13 22:06:34.944005 2026] [:error] [pid 63406:tid 63412] [client 91.230.225.245:27281] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Mon Apr 13 22:06:35.243360 2026] [:error] [pid 63406:tid 63427] [client 91.230.225.245:27281] [client 91.230.225.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adz4a7HZEIkQ0Zmgp5roXQAAANA"]
[Mon Apr 13 22:06:35.777824 2026] [:error] [pid 63311:tid 63386] [client 185.192.71.93:57275] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Mon Apr 13 22:06:36.612215 2026] [:error] [pid 63311:tid 63377] [client 185.192.71.93:57275] [client 185.192.71.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.93, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adz4bKHjrGN1MqBCVFkZegAAAIY"]
[Mon Apr 13 22:06:36.891924 2026] [:error] [pid 63311:tid 63387] [client 185.192.71.93:57275] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Mon Apr 13 22:06:37.174189 2026] [:error] [pid 63311:tid 63389] [client 185.192.71.93:57275] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Mon Apr 13 22:06:37.458303 2026] [:error] [pid 63311:tid 63378] [client 185.192.71.93:57275] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Mon Apr 13 22:06:37.725544 2026] [:error] [pid 63311:tid 63393] [client 185.192.71.93:57275] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adz4baHjrGN1MqBCVFkZfwAAAJY"]
[Mon Apr 13 22:06:38.897784 2026] [:error] [pid 63406:tid 63433] [client 91.230.225.244:39783] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Mon Apr 13 22:06:39.180423 2026] [:error] [pid 63406:tid 63424] [client 91.230.225.244:39783] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adz4b7HZEIkQ0Zmgp5rolgAAAM0"]
[Mon Apr 13 22:06:40.788833 2026] [:error] [pid 9314:tid 9323] [client 185.192.71.98:33187] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Mon Apr 13 22:06:41.056545 2026] [:error] [pid 9314:tid 9319] [client 185.192.71.98:33187] [client 185.192.71.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adz4cW_r4W8fX2GWyGQ_RgAAAYM"]
[Mon Apr 13 22:06:43.302207 2026] [:error] [pid 63311:tid 63390] [client 91.230.225.242:32093] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Mon Apr 13 22:06:43.567571 2026] [:error] [pid 63311:tid 63375] [client 91.230.225.242:32093] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adz4c6HjrGN1MqBCVFkZhgAAAIQ"]
[Mon Apr 13 22:06:45.274741 2026] [:error] [pid 9314:tid 9340] [client 185.192.71.82:26533] [client 185.192.71.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adz4dW_r4W8fX2GWyGQ_TAAAAZg"]
[Mon Apr 13 22:06:45.849790 2026] [:error] [pid 57183:tid 57188] [client 185.192.71.90:60275] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Mon Apr 13 22:06:46.127951 2026] [:error] [pid 57183:tid 57207] [client 185.192.71.90:60275] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Mon Apr 13 22:06:47.251516 2026] [:error] [pid 57183:tid 57190] [client 185.192.71.90:60275] [client 185.192.71.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adz4dzDO3t8R5NaxzYRrqgAAAUU"]
[Mon Apr 13 22:06:48.077862 2026] [:error] [pid 57183:tid 57193] [client 91.230.225.249:28535] [client 91.230.225.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adz4eDDO3t8R5NaxzYRrrgAAAUg"]
[Mon Apr 13 22:06:50.559688 2026] [:error] [pid 63310:tid 63344] [client 185.192.71.97:63817] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adz4enoXpRU5ztmwPjJtLgAAAEA"]
[Mon Apr 13 22:06:51.359871 2026] [:error] [pid 9314:tid 9334] [client 91.230.225.242:59193] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Mon Apr 13 22:06:51.914251 2026] [:error] [pid 9314:tid 9325] [client 91.230.225.242:59193] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Mon Apr 13 22:06:52.195778 2026] [:error] [pid 9314:tid 9339] [client 91.230.225.242:59193] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adz4fG_r4W8fX2GWyGQ_VAAAAZc"]
[Mon Apr 13 22:06:52.960071 2026] [:error] [pid 7228:tid 7249] [client 91.230.225.65:39113] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Mon Apr 13 22:06:53.526901 2026] [:error] [pid 7228:tid 7232] [client 91.230.225.65:39113] [client 91.230.225.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "adz4fQEnn1dQrOSHHNWyMwAAAQI"]
[Mon Apr 13 22:06:55.163810 2026] [:error] [pid 63406:tid 63424] [client 185.192.71.96:36959] [client 185.192.71.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adz4f7HZEIkQ0Zmgp5rotQAAAM0"]
[Mon Apr 13 22:06:56.392981 2026] [:error] [pid 57183:tid 57187] [client 185.192.71.81:47463] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Mon Apr 13 22:06:57.297080 2026] [:error] [pid 57183:tid 57192] [client 185.192.71.81:47463] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Mon Apr 13 22:06:57.894669 2026] [:error] [pid 57183:tid 57207] [client 185.192.71.81:47463] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Mon Apr 13 22:06:58.183902 2026] [:error] [pid 57183:tid 57204] [client 185.192.71.81:47463] [client 185.192.71.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adz4gjDO3t8R5NaxzYRrwgAAAVM"]
[Mon Apr 13 22:06:59.066785 2026] [:error] [pid 7228:tid 7233] [client 185.92.25.2:22667] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adz4gwEnn1dQrOSHHNWyPQAAAQM"]
[Mon Apr 13 22:07:00.118544 2026] [:error] [pid 63406:tid 63422] [client 91.230.225.241:46449] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adz4hLHZEIkQ0Zmgp5rovAAAAMs"]
[Mon Apr 13 22:07:01.150078 2026] [:error] [pid 7228:tid 7230] [client 91.230.225.58:27471] [client 91.230.225.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adz4hQEnn1dQrOSHHNWyQAAAAQA"]
[Mon Apr 13 22:07:01.752989 2026] [:error] [pid 9314:tid 9317] [client 91.230.225.244:30161] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Mon Apr 13 22:07:02.091988 2026] [:error] [pid 9314:tid 9318] [client 91.230.225.244:30161] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adz4hm_r4W8fX2GWyGQ_WgAAAYI"]
[Mon Apr 13 22:07:02.633707 2026] [:error] [pid 57183:tid 57185] [client 91.230.225.244:60657] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adz4hjDO3t8R5NaxzYRrxAAAAUA"]
[Mon Apr 13 22:07:03.230896 2026] [:error] [pid 57183:tid 57194] [client 91.230.225.56:25281] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Mon Apr 13 22:07:03.843604 2026] [:error] [pid 57183:tid 57186] [client 91.230.225.56:25281] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adz4hzDO3t8R5NaxzYRr0wAAAUE"]
[Mon Apr 13 22:07:04.555542 2026] [:error] [pid 57183:tid 57189] [client 91.230.225.247:30853] [client 91.230.225.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adz4iDDO3t8R5NaxzYRr3AAAAUQ"]
[Mon Apr 13 22:07:05.672103 2026] [:error] [pid 9314:tid 9319] [client 185.192.71.100:45217] [client 185.192.71.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adz4iW_r4W8fX2GWyGQ_XAAAAYM"]
[Mon Apr 13 22:07:06.919862 2026] [:error] [pid 9314:tid 9328] [client 91.230.225.58:28419] [client 91.230.225.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adz4im_r4W8fX2GWyGQ_XgAAAYw"]
[Mon Apr 13 22:07:08.069531 2026] [:error] [pid 7228:tid 7234] [client 91.230.225.244:34137] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adz4jAEnn1dQrOSHHNWyZwAAAQQ"]
[Mon Apr 13 22:07:10.694479 2026] [:error] [pid 57183:tid 57185] [client 185.192.71.93:53345] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adz4jjDO3t8R5NaxzYRr5QAAAUA"]
[Mon Apr 13 22:07:11.637485 2026] [:error] [pid 63406:tid 63419] [client 185.192.71.82:25297] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Mon Apr 13 22:07:12.559247 2026] [:error] [pid 63406:tid 63413] [client 185.192.71.82:25297] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Mon Apr 13 22:07:12.881333 2026] [:error] [pid 63406:tid 63433] [client 185.192.71.82:25297] [client 185.192.71.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adz4kLHZEIkQ0Zmgp5ro2wAAANY"]
[Mon Apr 13 22:07:15.273663 2026] [:error] [pid 63311:tid 63382] [client 91.230.225.63:40349] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Mon Apr 13 22:07:15.548532 2026] [:error] [pid 63311:tid 63391] [client 91.230.225.63:40349] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Mon Apr 13 22:07:17.075940 2026] [:error] [pid 63311:tid 63394] [client 91.230.225.63:40349] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adz4laHjrGN1MqBCVFkZlwAAAJc"]
[Mon Apr 13 22:07:19.043368 2026] [:error] [pid 57183:tid 57201] [client 185.192.71.94:55775] [client 185.192.71.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adz4lzDO3t8R5NaxzYRr9AAAAVA"]
[Mon Apr 13 22:07:20.041632 2026] [:error] [pid 57183:tid 57200] [client 91.230.225.243:59053] [client 91.230.225.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adz4mDDO3t8R5NaxzYRr-gAAAU8"]
[Mon Apr 13 22:07:22.616571 2026] [:error] [pid 63310:tid 63361] [client 185.192.71.88:47637] [client 185.192.71.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adz4mnoXpRU5ztmwPjJtTAAAAFE"]
[Mon Apr 13 22:07:24.311913 2026] [:error] [pid 7228:tid 7245] [client 185.192.71.92:29505] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Mon Apr 13 22:07:24.585055 2026] [:error] [pid 7228:tid 7231] [client 185.192.71.92:29505] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Mon Apr 13 22:07:24.868431 2026] [:error] [pid 7228:tid 7238] [client 185.192.71.92:29505] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Mon Apr 13 22:07:25.176983 2026] [:error] [pid 7228:tid 7237] [client 185.192.71.92:29505] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Mon Apr 13 22:07:26.649102 2026] [:error] [pid 7228:tid 7241] [client 185.192.71.92:29505] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adz4ngEnn1dQrOSHHNWyhAAAAQs"]
[Mon Apr 13 22:07:29.102186 2026] [:error] [pid 7228:tid 7241] [client 185.192.71.92:29505] [client 185.192.71.92] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "32.192.212.123_5002ada1c05fac60ce2af638d5f54066641d121c"): Internal error (specific information not available) [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adz4ngEnn1dQrOSHHNWyhAAAAQs"]
[Mon Apr 13 22:07:30.068594 2026] [:error] [pid 57183:tid 57200] [client 91.230.225.250:41481] [client 91.230.225.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adz4ojDO3t8R5NaxzYRsDAAAAU8"]
[Mon Apr 13 22:07:31.253724 2026] [:error] [pid 63310:tid 63344] [client 91.230.225.56:25999] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adz4o3oXpRU5ztmwPjJtUgAAAEA"]
[Mon Apr 13 22:07:31.853929 2026] [:error] [pid 9314:tid 9337] [client 185.92.25.119:20005] [client 185.92.25.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adz4o2_r4W8fX2GWyGQ_hwAAAZU"]
[Mon Apr 13 22:07:32.902537 2026] [:error] [pid 9314:tid 9338] [client 91.230.225.65:23923] [client 91.230.225.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adz4pG_r4W8fX2GWyGQ_jgAAAZY"]
[Mon Apr 13 22:07:33.635698 2026] [:error] [pid 9314:tid 9324] [client 91.230.225.68:47411] [client 91.230.225.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adz4pW_r4W8fX2GWyGQ_jwAAAYg"]
[Mon Apr 13 22:07:34.995132 2026] [:error] [pid 57183:tid 57196] [client 91.230.225.63:48585] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adz4pjDO3t8R5NaxzYRsFQAAAUs"]
[Mon Apr 13 22:07:36.094554 2026] [:error] [pid 7228:tid 7232] [client 185.192.71.88:52193] [client 185.192.71.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adz4qAEnn1dQrOSHHNWykAAAAQI"]
[Mon Apr 13 22:07:37.214889 2026] [:error] [pid 7228:tid 7238] [client 91.230.225.61:28641] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adz4qQEnn1dQrOSHHNWykQAAAQg"]
[Mon Apr 13 22:07:38.252994 2026] [:error] [pid 63406:tid 63412] [client 185.192.71.100:41593] [client 185.192.71.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adz4qrHZEIkQ0Zmgp5ro-QAAAME"]
[Mon Apr 13 22:07:39.412350 2026] [:error] [pid 57183:tid 57208] [client 185.192.71.90:60823] [client 185.192.71.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adz4qzDO3t8R5NaxzYRsGAAAAVc"]
[Mon Apr 13 22:07:40.601424 2026] [:error] [pid 57183:tid 57199] [client 91.230.225.242:40793] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adz4rDDO3t8R5NaxzYRsGwAAAU4"]
[Mon Apr 13 22:07:41.680609 2026] [:error] [pid 63311:tid 63378] [client 91.230.225.68:45551] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Mon Apr 13 22:07:42.302334 2026] [:error] [pid 63311:tid 63391] [client 91.230.225.68:45551] [client 91.230.225.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adz4rqHjrGN1MqBCVFkZrwAAAJQ"]
[Mon Apr 13 22:07:43.965668 2026] [:error] [pid 57183:tid 57185] [client 91.230.225.63:34305] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adz4rzDO3t8R5NaxzYRsHwAAAUA"]
[Mon Apr 13 22:07:45.191253 2026] [:error] [pid 63310:tid 63352] [client 185.192.71.90:30723] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Mon Apr 13 22:07:45.463561 2026] [:error] [pid 63310:tid 63354] [client 185.192.71.90:30723] [client 185.192.71.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adz4sXoXpRU5ztmwPjJtWgAAAEo"]
[Mon Apr 13 22:07:46.298425 2026] [:error] [pid 63406:tid 63433] [client 91.230.225.57:25321] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Mon Apr 13 22:07:46.570026 2026] [:error] [pid 63406:tid 63411] [client 91.230.225.57:25321] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Mon Apr 13 22:07:46.903286 2026] [:error] [pid 63406:tid 63420] [client 91.230.225.57:25321] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Mon Apr 13 22:07:47.176805 2026] [:error] [pid 63406:tid 63424] [client 91.230.225.57:25321] [client 91.230.225.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adz4s7HZEIkQ0Zmgp5rpEgAAAM0"]
[Mon Apr 13 22:07:48.267639 2026] [:error] [pid 9314:tid 9330] [client 185.192.71.85:56435] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Mon Apr 13 22:07:48.557251 2026] [:error] [pid 9314:tid 9317] [client 185.192.71.85:56435] [client 185.192.71.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adz4tG_r4W8fX2GWyGQ_nAAAAYE"]
[Mon Apr 13 22:07:50.291798 2026] [:error] [pid 9314:tid 9334] [client 185.92.25.2:32655] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Apr 13 22:07:50.566289 2026] [:error] [pid 9314:tid 9324] [client 185.92.25.2:32655] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Mon Apr 13 22:07:50.860651 2026] [:error] [pid 9314:tid 9337] [client 185.92.25.2:32655] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Mon Apr 13 22:07:52.302930 2026] [:error] [pid 9314:tid 9340] [client 185.92.25.2:32655] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Apr 13 22:07:52.576719 2026] [:error] [pid 9314:tid 9339] [client 185.92.25.2:32655] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Mon Apr 13 22:07:54.149882 2026] [:error] [pid 9314:tid 9318] [client 185.92.25.2:32655] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Mon Apr 13 22:07:55.066297 2026] [:error] [pid 9314:tid 9320] [client 185.92.25.2:32655] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Mon Apr 13 22:07:55.344628 2026] [:error] [pid 9314:tid 9334] [client 185.92.25.2:32655] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adz4u2_r4W8fX2GWyGQ_tQAAAZI"]
[Mon Apr 13 22:07:56.461647 2026] [:error] [pid 9314:tid 9331] [client 91.230.225.246:20751] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adz4vG_r4W8fX2GWyGQ_uQAAAY8"]
[Mon Apr 13 22:07:57.620478 2026] [:error] [pid 57183:tid 57190] [client 91.230.225.61:41369] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Mon Apr 13 22:07:57.894175 2026] [:error] [pid 57183:tid 57198] [client 91.230.225.61:41369] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adz4vTDO3t8R5NaxzYRsNQAAAU0"]
[Mon Apr 13 22:07:59.310912 2026] [:error] [pid 57183:tid 57187] [client 185.92.25.118:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 13 22:07:59.627204 2026] [:error] [pid 57183:tid 57190] [client 185.92.25.118:61809] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adz4vzDO3t8R5NaxzYRsQgAAAUU"]
[Mon Apr 13 22:08:00.758021 2026] [:error] [pid 7228:tid 7238] [client 91.230.225.57:47331] [client 91.230.225.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adz4wAEnn1dQrOSHHNWysQAAAQg"]
[Mon Apr 13 22:08:02.943973 2026] [:error] [pid 63406:tid 63428] [client 185.192.71.89:37921] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adz4wrHZEIkQ0Zmgp5rpJQAAANE"]
[Mon Apr 13 22:08:04.448743 2026] [:error] [pid 57183:tid 57196] [client 91.230.225.243:49751] [client 91.230.225.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "adz4xDDO3t8R5NaxzYRsSgAAAUs"]
[Mon Apr 13 22:08:07.308030 2026] [:error] [pid 57183:tid 57201] [client 185.192.71.92:39369] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Mon Apr 13 22:08:07.889587 2026] [:error] [pid 57183:tid 57200] [client 185.192.71.92:39369] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adz4xzDO3t8R5NaxzYRsWwAAAU8"]
[Mon Apr 13 22:08:09.262707 2026] [:error] [pid 9314:tid 9340] [client 185.192.71.91:65297] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Mon Apr 13 22:08:09.873072 2026] [:error] [pid 9314:tid 9335] [client 185.192.71.91:65297] [client 185.192.71.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "adz4yW_r4W8fX2GWyGQ_ywAAAZM"]
[Mon Apr 13 22:08:11.031954 2026] [:error] [pid 63406:tid 63414] [client 185.192.71.97:59063] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adz4y7HZEIkQ0Zmgp5rpMQAAAMM"]
[Mon Apr 13 22:08:12.374956 2026] [:error] [pid 57183:tid 57189] [client 185.192.71.99:51469] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Mon Apr 13 22:08:12.666624 2026] [:error] [pid 57183:tid 57208] [client 185.192.71.99:51469] [client 185.192.71.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adz4zDDO3t8R5NaxzYRsYgAAAVc"]
[Mon Apr 13 22:08:13.811065 2026] [:error] [pid 63311:tid 63383] [client 185.92.25.118:65187] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adz4zaHjrGN1MqBCVFkZtwAAAIw"]
[Mon Apr 13 22:08:15.467878 2026] [:error] [pid 7228:tid 7246] [client 185.192.71.98:27375] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Mon Apr 13 22:08:15.755019 2026] [:error] [pid 7228:tid 7254] [client 185.192.71.98:27375] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Mon Apr 13 22:08:17.634356 2026] [:error] [pid 7228:tid 7232] [client 185.192.71.98:27375] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Mon Apr 13 22:08:18.257453 2026] [:error] [pid 7228:tid 7253] [client 185.192.71.98:27375] [client 185.192.71.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adz40gEnn1dQrOSHHNWywQAAARc"]
[Mon Apr 13 22:08:19.421170 2026] [:error] [pid 63406:tid 63425] [client 185.192.71.86:58109] [client 185.192.71.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adz407HZEIkQ0Zmgp5rpUAAAAM4"]
[Mon Apr 13 22:08:21.276261 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.61:25663] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Mon Apr 13 22:08:21.573147 2026] [:error] [pid 63406:tid 63411] [client 91.230.225.61:25663] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "adz41bHZEIkQ0Zmgp5rpWgAAAMA"]
[Mon Apr 13 22:08:22.653126 2026] [:error] [pid 7228:tid 7241] [client 185.192.71.85:57769] [client 185.192.71.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adz41gEnn1dQrOSHHNWyygAAAQs"]
[Mon Apr 13 22:08:23.767045 2026] [:error] [pid 63406:tid 63412] [client 91.230.225.60:54459] [client 91.230.225.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adz417HZEIkQ0Zmgp5rpZQAAAME"]
[Mon Apr 13 22:08:25.994635 2026] [:error] [pid 63310:tid 63368] [client 91.230.225.57:22041] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Mon Apr 13 22:08:26.281793 2026] [:error] [pid 63310:tid 63350] [client 91.230.225.57:22041] [client 91.230.225.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adz42noXpRU5ztmwPjJtbwAAAEY"]
[Mon Apr 13 22:08:27.795950 2026] [:error] [pid 57183:tid 57188] [client 91.230.225.55:62979] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adz42zDO3t8R5NaxzYRscgAAAUM"]
[Mon Apr 13 22:08:28.881858 2026] [:error] [pid 63311:tid 63380] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Mon Apr 13 22:08:29.201386 2026] [:error] [pid 63311:tid 63385] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Mon Apr 13 22:08:29.798056 2026] [:error] [pid 63311:tid 63395] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Mon Apr 13 22:08:31.185285 2026] [:error] [pid 63311:tid 63389] [client 91.230.225.245:27991] [client 91.230.225.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.245, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "adz436HjrGN1MqBCVFkZwwAAAJI"]
[Mon Apr 13 22:08:31.795892 2026] [:error] [pid 63311:tid 63372] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Mon Apr 13 22:08:32.082683 2026] [:error] [pid 63311:tid 63371] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Mon Apr 13 22:08:32.390611 2026] [:error] [pid 63311:tid 63379] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Mon Apr 13 22:08:32.982468 2026] [:error] [pid 63311:tid 63393] [client 91.230.225.245:27991] [client 91.230.225.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.245, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adz44KHjrGN1MqBCVFkZyQAAAJY"]
[Mon Apr 13 22:08:33.902444 2026] [:error] [pid 63311:tid 63383] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Mon Apr 13 22:08:34.186358 2026] [:error] [pid 63311:tid 63381] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Mon Apr 13 22:08:34.752004 2026] [:error] [pid 63311:tid 63384] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Mon Apr 13 22:08:35.335756 2026] [:error] [pid 63311:tid 63376] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Mon Apr 13 22:08:36.217683 2026] [:error] [pid 63311:tid 63374] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Mon Apr 13 22:08:38.341043 2026] [:error] [pid 63311:tid 63379] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Mon Apr 13 22:08:38.659393 2026] [:error] [pid 63311:tid 63387] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Mon Apr 13 22:08:40.155267 2026] [:error] [pid 63311:tid 63391] [client 91.230.225.245:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Mon Apr 13 22:08:40.739680 2026] [:error] [pid 63311:tid 63381] [client 91.230.225.245:27991] [client 91.230.225.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adz46KHjrGN1MqBCVFkZ4wAAAIo"]
[Mon Apr 13 22:08:42.475683 2026] [:error] [pid 63406:tid 63415] [client 185.192.71.87:23185] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Mon Apr 13 22:08:42.755172 2026] [:error] [pid 63406:tid 63411] [client 185.192.71.87:23185] [client 185.192.71.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adz46rHZEIkQ0Zmgp5rplgAAAMA"]
[Mon Apr 13 22:08:44.156983 2026] [:error] [pid 63406:tid 63435] [client 185.192.71.85:64139] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Mon Apr 13 22:08:44.445125 2026] [:error] [pid 63406:tid 63413] [client 185.192.71.85:64139] [client 185.192.71.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adz47LHZEIkQ0Zmgp5rpoAAAAMI"]
[Mon Apr 13 22:08:45.658145 2026] [:error] [pid 63406:tid 63412] [client 91.230.225.59:55077] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Mon Apr 13 22:08:46.238196 2026] [:error] [pid 63406:tid 63413] [client 91.230.225.59:55077] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Mon Apr 13 22:08:46.849029 2026] [:error] [pid 63406:tid 63433] [client 91.230.225.59:55077] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Mon Apr 13 22:08:47.133632 2026] [:error] [pid 63406:tid 63432] [client 91.230.225.59:55077] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Mon Apr 13 22:08:47.688821 2026] [:error] [pid 63406:tid 63413] [client 91.230.225.59:55077] [client 91.230.225.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adz477HZEIkQ0Zmgp5rptwAAAMI"]
[Mon Apr 13 22:08:48.789721 2026] [:error] [pid 63406:tid 63411] [client 91.230.225.241:48903] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Mon Apr 13 22:08:49.079861 2026] [:error] [pid 63406:tid 63428] [client 91.230.225.241:48903] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Mon Apr 13 22:08:49.354823 2026] [:error] [pid 63406:tid 63422] [client 91.230.225.241:48903] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adz48bHZEIkQ0Zmgp5rpwAAAAMs"]
[Mon Apr 13 22:08:50.422379 2026] [:error] [pid 57183:tid 57185] [client 91.230.225.245:38423] [client 91.230.225.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adz48jDO3t8R5NaxzYRshgAAAUA"]
[Mon Apr 13 22:08:52.610414 2026] [:error] [pid 7228:tid 7230] [client 185.92.25.1:30311] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Mon Apr 13 22:08:54.658482 2026] [:error] [pid 7228:tid 7241] [client 185.92.25.1:30311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Mon Apr 13 22:08:54.939250 2026] [:error] [pid 7228:tid 7251] [client 185.92.25.1:30311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Mon Apr 13 22:08:55.205358 2026] [:error] [pid 7228:tid 7249] [client 185.92.25.1:30311] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adz49wEnn1dQrOSHHNWy6wAAARM"]
[Mon Apr 13 22:08:56.340817 2026] [:error] [pid 57183:tid 57192] [client 91.230.225.244:64275] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adz4-DDO3t8R5NaxzYRslAAAAUc"]
[Mon Apr 13 22:08:59.061392 2026] [:error] [pid 9314:tid 9338] [client 185.192.71.94:46949] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Mon Apr 13 22:08:59.608937 2026] [:error] [pid 9314:tid 9324] [client 185.192.71.94:46949] [client 185.192.71.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adz4-2_r4W8fX2GWyGQ_-wAAAYg"]
[Mon Apr 13 22:09:01.011384 2026] [:error] [pid 57183:tid 57202] [client 91.230.225.242:47829] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "adz4_TDO3t8R5NaxzYRsnAAAAVE"]
[Mon Apr 13 22:09:02.506134 2026] [:error] [pid 57183:tid 57188] [client 91.230.225.64:31137] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Apr 13 22:09:02.783637 2026] [:error] [pid 57183:tid 57201] [client 91.230.225.64:31137] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Mon Apr 13 22:09:03.058909 2026] [:error] [pid 57183:tid 57194] [client 91.230.225.64:31137] [client 91.230.225.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adz4_zDO3t8R5NaxzYRspgAAAUk"]
[Mon Apr 13 22:09:04.495587 2026] [:error] [pid 9314:tid 9333] [client 91.230.225.59:31305] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Mon Apr 13 22:09:04.775336 2026] [:error] [pid 9314:tid 9328] [client 91.230.225.59:31305] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Mon Apr 13 22:09:05.326890 2026] [:error] [pid 9314:tid 9326] [client 91.230.225.59:31305] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon Apr 13 22:09:06.191189 2026] [:error] [pid 9314:tid 9337] [client 91.230.225.59:31305] [client 91.230.225.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adz5Am_r4W8fX2GWyGRACQAAAZU"]
[Mon Apr 13 22:09:07.489311 2026] [:error] [pid 9314:tid 9340] [client 91.230.225.63:63811] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Mon Apr 13 22:09:08.476924 2026] [:error] [pid 9314:tid 9322] [client 91.230.225.63:63811] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adz5BG_r4W8fX2GWyGRADwAAAYY"]
[Mon Apr 13 22:09:09.948762 2026] [:error] [pid 57183:tid 57201] [client 185.92.25.118:35603] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Mon Apr 13 22:09:10.817224 2026] [:error] [pid 57183:tid 57189] [client 185.92.25.118:35603] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Mon Apr 13 22:09:11.098055 2026] [:error] [pid 57183:tid 57196] [client 185.92.25.118:35603] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Mon Apr 13 22:09:11.670249 2026] [:error] [pid 57183:tid 57201] [client 185.92.25.118:35603] [client 185.92.25.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.92.25.118, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adz5BzDO3t8R5NaxzYRszwAAAVA"]
[Mon Apr 13 22:09:13.146733 2026] [:error] [pid 57183:tid 57196] [client 185.92.25.118:35603] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adz5CTDO3t8R5NaxzYRs1gAAAUs"]
[Mon Apr 13 22:09:13.973973 2026] [:error] [pid 7228:tid 7248] [client 185.192.71.97:33069] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Mon Apr 13 22:09:14.251633 2026] [:error] [pid 7228:tid 7247] [client 185.192.71.97:33069] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adz5CgEnn1dQrOSHHNWzAgAAARE"]
[Mon Apr 13 22:09:15.052383 2026] [:error] [pid 7228:tid 7245] [client 91.230.225.241:56877] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Mon Apr 13 22:09:15.764341 2026] [:error] [pid 7228:tid 7232] [client 91.230.225.241:56877] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Mon Apr 13 22:09:16.322001 2026] [:error] [pid 7228:tid 7241] [client 91.230.225.241:56877] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adz5DAEnn1dQrOSHHNWzCgAAAQs"]
[Mon Apr 13 22:09:17.445437 2026] [:error] [pid 63406:tid 63428] [client 91.230.225.248:65367] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Mon Apr 13 22:09:17.738522 2026] [:error] [pid 63406:tid 63421] [client 91.230.225.248:65367] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Mon Apr 13 22:09:18.058606 2026] [:error] [pid 63406:tid 63414] [client 91.230.225.248:65367] [client 91.230.225.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adz5DrHZEIkQ0Zmgp5rp7wAAAMM"]
[Mon Apr 13 22:09:18.699889 2026] [:error] [pid 63406:tid 63432] [client 185.92.25.3:51467] [client 185.92.25.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adz5DrHZEIkQ0Zmgp5rp8QAAANU"]
[Mon Apr 13 22:09:19.836732 2026] [:error] [pid 63406:tid 63421] [client 91.230.225.248:32121] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Mon Apr 13 22:09:20.138806 2026] [:error] [pid 63406:tid 63416] [client 91.230.225.248:32121] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Mon Apr 13 22:09:20.723903 2026] [:error] [pid 63406:tid 63419] [client 91.230.225.248:32121] [client 91.230.225.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adz5ELHZEIkQ0Zmgp5rqAAAAAMg"]
[Mon Apr 13 22:09:21.287571 2026] [:error] [pid 63406:tid 63413] [client 185.192.71.95:42217] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Mon Apr 13 22:09:21.873535 2026] [:error] [pid 63406:tid 63429] [client 185.192.71.95:42217] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Mon Apr 13 22:09:22.141848 2026] [:error] [pid 63406:tid 63411] [client 185.192.71.95:42217] [client 185.192.71.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adz5ErHZEIkQ0Zmgp5rqCQAAAMA"]
[Mon Apr 13 22:09:23.002043 2026] [:error] [pid 9314:tid 9329] [client 91.230.225.56:30277] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "adz5E2_r4W8fX2GWyGRAIwAAAY0"]
[Mon Apr 13 22:09:23.732855 2026] [:error] [pid 63406:tid 63432] [client 91.230.225.247:32011] [client 91.230.225.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adz5E7HZEIkQ0Zmgp5rqDQAAANU"]
[Mon Apr 13 22:09:25.754946 2026] [:error] [pid 7228:tid 7237] [client 91.230.225.245:58277] [client 91.230.225.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adz5FQEnn1dQrOSHHNWzEQAAAQc"]
[Mon Apr 13 22:09:26.292375 2026] [:error] [pid 63309:tid 63318] [client 91.230.225.55:33833] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adz5FkpIKZ10weXpf0U5FgAAAAU"]
[Mon Apr 13 22:09:26.860570 2026] [:error] [pid 63311:tid 63373] [client 91.230.225.241:57707] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adz5FqHjrGN1MqBCVFkZ-wAAAII"]
[Mon Apr 13 22:09:27.406438 2026] [:error] [pid 7228:tid 7239] [client 91.230.225.241:63029] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adz5FwEnn1dQrOSHHNWzGAAAAQk"]
[Mon Apr 13 22:09:28.520434 2026] [:error] [pid 7228:tid 7235] [client 185.192.71.95:48217] [client 185.192.71.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adz5GAEnn1dQrOSHHNWzHwAAAQU"]
[Mon Apr 13 22:09:30.102511 2026] [:error] [pid 57183:tid 57195] [client 91.230.225.63:31767] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adz5GjDO3t8R5NaxzYRs4QAAAUo"]
[Mon Apr 13 22:09:30.673031 2026] [:error] [pid 7228:tid 7237] [client 91.230.225.242:60969] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adz5GgEnn1dQrOSHHNWzIQAAAQc"]
[Mon Apr 13 22:09:31.254833 2026] [:error] [pid 63310:tid 63364] [client 91.230.225.245:27999] [client 91.230.225.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adz5G3oXpRU5ztmwPjJtiQAAAFQ"]
[Mon Apr 13 22:09:31.947879 2026] [:error] [pid 57183:tid 57205] [client 185.92.25.118:32165] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adz5GzDO3t8R5NaxzYRs5gAAAVQ"]
[Mon Apr 13 22:09:32.513861 2026] [:error] [pid 57183:tid 57193] [client 185.192.71.92:42425] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Mon Apr 13 22:09:34.304674 2026] [:error] [pid 57183:tid 57190] [client 185.192.71.92:42425] [client 185.192.71.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.92, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adz5HjDO3t8R5NaxzYRs-gAAAUU"]
[Mon Apr 13 22:09:35.692706 2026] [:error] [pid 57183:tid 57207] [client 185.192.71.92:42425] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adz5HzDO3t8R5NaxzYRtBgAAAVY"]
[Mon Apr 13 22:09:37.875578 2026] [:error] [pid 7228:tid 7242] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Mon Apr 13 22:09:38.168286 2026] [:error] [pid 7228:tid 7253] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Mon Apr 13 22:09:39.323402 2026] [:error] [pid 7228:tid 7232] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Mon Apr 13 22:09:39.596537 2026] [:error] [pid 7228:tid 7239] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Mon Apr 13 22:09:40.722409 2026] [:error] [pid 7228:tid 7247] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Mon Apr 13 22:09:40.992711 2026] [:error] [pid 7228:tid 7245] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Mon Apr 13 22:09:41.277478 2026] [:error] [pid 7228:tid 7248] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Mon Apr 13 22:09:41.553722 2026] [:error] [pid 7228:tid 7235] [client 185.192.71.84:63127] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Mon Apr 13 22:09:41.838853 2026] [:error] [pid 7228:tid 7242] [client 185.192.71.84:63127] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adz5JQEnn1dQrOSHHNWzOgAAAQw"]
[Mon Apr 13 22:09:42.496027 2026] [:error] [pid 57183:tid 57206] [client 91.230.225.61:57391] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adz5JjDO3t8R5NaxzYRtKAAAAVU"]
[Mon Apr 13 22:09:44.095327 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.56:62921] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adz5KLHZEIkQ0Zmgp5rqRwAAANM"]
[Mon Apr 13 22:09:44.921901 2026] [:error] [pid 7228:tid 7254] [client 185.192.71.96:36519] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Mon Apr 13 22:09:45.199863 2026] [:error] [pid 7228:tid 7252] [client 185.192.71.96:36519] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Mon Apr 13 22:09:45.749874 2026] [:error] [pid 7228:tid 7233] [client 185.192.71.96:36519] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Mon Apr 13 22:09:46.300494 2026] [:error] [pid 7228:tid 7241] [client 185.192.71.96:36519] [client 185.192.71.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adz5KgEnn1dQrOSHHNWzSAAAAQs"]
[Mon Apr 13 22:09:47.921305 2026] [:error] [pid 63311:tid 63380] [client 185.192.71.97:60343] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adz5K6HjrGN1MqBCVFkaBgAAAIk"]
[Mon Apr 13 22:09:48.482217 2026] [:error] [pid 63406:tid 63435] [client 185.192.71.89:34321] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adz5LLHZEIkQ0Zmgp5rqTAAAANg"]
[Mon Apr 13 22:09:50.266904 2026] [:error] [pid 7228:tid 7246] [client 185.92.25.3:48193] [client 185.92.25.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adz5LgEnn1dQrOSHHNWzUQAAARA"]
[Mon Apr 13 22:09:51.150765 2026] [:error] [pid 7228:tid 7242] [client 91.230.225.57:60139] [client 91.230.225.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adz5LwEnn1dQrOSHHNWzVQAAAQw"]
[Mon Apr 13 22:09:52.318004 2026] [:error] [pid 57183:tid 57195] [client 91.230.225.59:25415] [client 91.230.225.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adz5MDDO3t8R5NaxzYRtUQAAAUo"]
[Mon Apr 13 22:09:56.323823 2026] [:error] [pid 63406:tid 63415] [client 185.92.25.2:64871] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adz5NLHZEIkQ0Zmgp5rqZQAAAMQ"]
[Mon Apr 13 22:09:57.939841 2026] [:error] [pid 63406:tid 63432] [client 91.230.225.241:54205] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Mon Apr 13 22:09:58.207347 2026] [:error] [pid 63406:tid 63424] [client 91.230.225.241:54205] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/about.php"] [unique_id "adz5NrHZEIkQ0Zmgp5rqbwAAAM0"]
[Mon Apr 13 22:09:59.391395 2026] [:error] [pid 63310:tid 63367] [client 185.192.71.93:59033] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Mon Apr 13 22:10:00.308597 2026] [:error] [pid 63310:tid 63361] [client 185.192.71.93:59033] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Mon Apr 13 22:10:00.598720 2026] [:error] [pid 63310:tid 63346] [client 185.192.71.93:59033] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "adz5OHoXpRU5ztmwPjJtnQAAAEI"]
[Mon Apr 13 22:10:01.852157 2026] [:error] [pid 9314:tid 9317] [client 91.230.225.58:34391] [client 91.230.225.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adz5OW_r4W8fX2GWyGRAVQAAAYE"]
[Mon Apr 13 22:10:04.086932 2026] [:error] [pid 57183:tid 57198] [client 185.192.71.91:49841] [client 185.192.71.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adz5PDDO3t8R5NaxzYRtcgAAAU0"]
[Mon Apr 13 22:10:05.821979 2026] [:error] [pid 57183:tid 57187] [client 91.230.225.240:53761] [client 91.230.225.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adz5PTDO3t8R5NaxzYRtgAAAAUI"]
[Mon Apr 13 22:10:06.855171 2026] [:error] [pid 57183:tid 57189] [client 91.230.225.63:58651] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Mon Apr 13 22:10:07.136183 2026] [:error] [pid 57183:tid 57207] [client 91.230.225.63:58651] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adz5PzDO3t8R5NaxzYRthQAAAVY"]
[Mon Apr 13 22:10:07.755469 2026] [:error] [pid 63310:tid 63365] [client 91.230.225.61:58805] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adz5P3oXpRU5ztmwPjJtpAAAAFU"]
[Mon Apr 13 22:10:09.742984 2026] [:error] [pid 9314:tid 9318] [client 91.230.225.64:45389] [client 91.230.225.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adz5QW_r4W8fX2GWyGRAYAAAAYI"]
[Mon Apr 13 22:10:10.768222 2026] [:error] [pid 57183:tid 57204] [client 185.192.71.86:53655] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Mon Apr 13 22:10:11.990158 2026] [:error] [pid 57183:tid 57206] [client 185.192.71.86:53655] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Mon Apr 13 22:10:12.276434 2026] [:error] [pid 57183:tid 57195] [client 185.192.71.86:53655] [client 185.192.71.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adz5RDDO3t8R5NaxzYRtlgAAAUo"]
[Mon Apr 13 22:10:13.393070 2026] [:error] [pid 63406:tid 63412] [client 91.230.225.251:37953] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Mon Apr 13 22:10:13.963048 2026] [:error] [pid 63406:tid 63416] [client 91.230.225.251:37953] [client 91.230.225.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adz5RbHZEIkQ0Zmgp5rqkwAAAMU"]
[Mon Apr 13 22:10:14.546091 2026] [:error] [pid 63406:tid 63427] [client 185.192.71.93:55403] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adz5RrHZEIkQ0Zmgp5rqmQAAANA"]
[Mon Apr 13 22:10:15.372967 2026] [:error] [pid 63406:tid 63421] [client 91.230.225.60:57085] [client 91.230.225.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adz5R7HZEIkQ0Zmgp5rqogAAAMo"]
[Mon Apr 13 22:10:16.493424 2026] [:error] [pid 63406:tid 63422] [client 185.192.71.86:35895] [client 185.192.71.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "adz5SLHZEIkQ0Zmgp5rqqAAAAMs"]
[Mon Apr 13 22:10:17.040712 2026] [:error] [pid 9314:tid 9319] [client 91.230.225.244:55673] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adz5SW_r4W8fX2GWyGRAawAAAYM"]
[Mon Apr 13 22:10:17.907122 2026] [:error] [pid 63406:tid 63415] [client 185.192.71.93:60809] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Mon Apr 13 22:10:19.362003 2026] [:error] [pid 63406:tid 63419] [client 185.192.71.93:60809] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "adz5S7HZEIkQ0Zmgp5rqsgAAAMg"]
[Mon Apr 13 22:10:20.465950 2026] [:error] [pid 7228:tid 7254] [client 185.192.71.83:43433] [client 185.192.71.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "adz5TAEnn1dQrOSHHNWzZgAAARg"]
[Mon Apr 13 22:10:21.010735 2026] [:error] [pid 57183:tid 57188] [client 91.230.225.246:32691] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "adz5TTDO3t8R5NaxzYRtoAAAAUM"]
[Mon Apr 13 22:10:21.858958 2026] [:error] [pid 63311:tid 63379] [client 91.230.225.55:42023] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Mon Apr 13 22:10:22.136380 2026] [:error] [pid 63311:tid 63393] [client 91.230.225.55:42023] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adz5TqHjrGN1MqBCVFkaIwAAAJY"]
[Mon Apr 13 22:10:23.072076 2026] [:error] [pid 9314:tid 9332] [client 185.192.71.86:46135] [client 185.192.71.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adz5T2_r4W8fX2GWyGRAfgAAAZA"]
[Mon Apr 13 22:10:25.039800 2026] [:error] [pid 63406:tid 63432] [client 185.192.71.89:47225] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adz5UbHZEIkQ0Zmgp5rqwgAAANU"]
[Mon Apr 13 22:10:25.877813 2026] [:error] [pid 63406:tid 63422] [client 185.192.71.85:26507] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Mon Apr 13 22:10:26.176526 2026] [:error] [pid 63406:tid 63417] [client 185.192.71.85:26507] [client 185.192.71.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adz5UrHZEIkQ0Zmgp5rqyQAAAMY"]
[Mon Apr 13 22:10:27.416281 2026] [:error] [pid 57183:tid 57201] [client 91.230.225.248:58943] [client 91.230.225.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adz5UzDO3t8R5NaxzYRttQAAAVA"]
[Mon Apr 13 22:10:28.268960 2026] [:error] [pid 63311:tid 63391] [client 91.230.225.242:25835] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/as.php"] [unique_id "adz5VKHjrGN1MqBCVFkaKQAAAJQ"]
[Mon Apr 13 22:10:29.267791 2026] [:error] [pid 9314:tid 9335] [client 91.230.225.66:31827] [client 91.230.225.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adz5VW_r4W8fX2GWyGRAiAAAAZM"]
[Mon Apr 13 22:10:30.027410 2026] [:error] [pid 57183:tid 57206] [client 91.230.225.251:29969] [client 91.230.225.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/install.php"] [unique_id "adz5VjDO3t8R5NaxzYRtuQAAAVU"]
[Mon Apr 13 22:10:30.803543 2026] [:error] [pid 7228:tid 7253] [client 185.192.71.100:44173] [client 185.192.71.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "adz5VgEnn1dQrOSHHNWzcgAAARc"]
[Mon Apr 13 22:10:34.086474 2026] [:error] [pid 63406:tid 63431] [client 185.192.71.96:59801] [client 185.192.71.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adz5WrHZEIkQ0Zmgp5rq6wAAANQ"]
[Mon Apr 13 22:10:36.547034 2026] [:error] [pid 63406:tid 63426] [client 91.230.225.244:38967] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "adz5XLHZEIkQ0Zmgp5rq-gAAAM8"]
[Mon Apr 13 22:10:38.311831 2026] [:error] [pid 57183:tid 57189] [client 185.192.71.83:26925] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Mon Apr 13 22:10:38.608016 2026] [:error] [pid 57183:tid 57204] [client 185.192.71.83:26925] [client 185.192.71.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "adz5XjDO3t8R5NaxzYRtxgAAAVM"]
[Mon Apr 13 22:10:40.712179 2026] [:error] [pid 63406:tid 63432] [client 185.192.71.82:60409] [client 185.192.71.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "adz5YLHZEIkQ0Zmgp5rrFQAAANU"]
[Mon Apr 13 22:10:41.274733 2026] [:error] [pid 57183:tid 57196] [client 91.230.225.67:54383] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Mon Apr 13 22:10:42.703790 2026] [:error] [pid 57183:tid 57202] [client 91.230.225.67:54383] [client 91.230.225.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adz5YjDO3t8R5NaxzYRt2QAAAVE"]
[Mon Apr 13 22:10:43.565780 2026] [:error] [pid 9314:tid 9318] [client 185.192.71.97:56651] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adz5Y2_r4W8fX2GWyGRAlwAAAYI"]
[Mon Apr 13 22:10:44.388855 2026] [:error] [pid 7228:tid 7247] [client 185.192.71.89:65501] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adz5ZAEnn1dQrOSHHNWzfwAAARE"]
[Mon Apr 13 22:10:45.497476 2026] [:error] [pid 57183:tid 57193] [client 185.192.71.84:55453] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adz5ZTDO3t8R5NaxzYRt5AAAAUg"]
[Mon Apr 13 22:10:48.262935 2026] [:error] [pid 57183:tid 57186] [client 91.230.225.246:34173] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adz5aDDO3t8R5NaxzYRt8AAAAUE"]
[Mon Apr 13 22:10:48.799204 2026] [:error] [pid 63406:tid 63422] [client 185.192.71.91:57225] [client 185.192.71.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adz5aLHZEIkQ0Zmgp5rrIwAAAMs"]
[Mon Apr 13 22:10:50.222537 2026] [:error] [pid 63406:tid 63424] [client 185.192.71.96:48237] [client 185.192.71.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adz5arHZEIkQ0Zmgp5rrKgAAAM0"]
[Mon Apr 13 22:10:51.820087 2026] [:error] [pid 57183:tid 57197] [client 185.192.71.93:62333] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adz5azDO3t8R5NaxzYRt8wAAAUw"]
[Mon Apr 13 22:10:52.947592 2026] [:error] [pid 57183:tid 57208] [client 91.230.225.69:36155] [client 91.230.225.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adz5bDDO3t8R5NaxzYRt-gAAAVc"]
[Mon Apr 13 22:10:53.476930 2026] [:error] [pid 63406:tid 63421] [client 91.230.225.55:36367] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "adz5bbHZEIkQ0Zmgp5rrRgAAAMo"]
[Mon Apr 13 22:10:54.007929 2026] [:error] [pid 63406:tid 63430] [client 185.192.71.100:58097] [client 185.192.71.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.100, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adz5brHZEIkQ0Zmgp5rrSAAAANM"]
[Mon Apr 13 22:10:54.013336 2026] [:error] [pid 63406:tid 63430] [client 185.192.71.100:58097] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Mon Apr 13 22:10:54.287389 2026] [:error] [pid 63406:tid 63423] [client 185.192.71.100:58097] [client 185.192.71.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "adz5brHZEIkQ0Zmgp5rrSgAAAMw"]
[Mon Apr 13 22:10:55.120145 2026] [:error] [pid 57183:tid 57201] [client 91.230.225.251:45061] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Mon Apr 13 22:10:55.391248 2026] [:error] [pid 57183:tid 57204] [client 91.230.225.251:45061] [client 91.230.225.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adz5bzDO3t8R5NaxzYRuAwAAAVM"]
[Mon Apr 13 22:10:55.976471 2026] [:error] [pid 7228:tid 7237] [client 185.192.71.84:58919] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/network.php"] [unique_id "adz5bwEnn1dQrOSHHNWziQAAAQc"]
[Mon Apr 13 22:10:56.535634 2026] [:error] [pid 57183:tid 57188] [client 185.192.71.91:42945] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Mon Apr 13 22:10:59.504457 2026] [:error] [pid 57183:tid 57185] [client 185.192.71.91:42945] [client 185.192.71.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adz5czDO3t8R5NaxzYRuGAAAAUA"]
[Mon Apr 13 22:11:01.181346 2026] [:error] [pid 63406:tid 63424] [client 91.230.225.61:22827] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "adz5dbHZEIkQ0Zmgp5rrVQAAAM0"]
[Mon Apr 13 22:11:02.301835 2026] [:error] [pid 63406:tid 63426] [client 91.230.225.246:25005] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adz5drHZEIkQ0Zmgp5rrXgAAAM8"]
[Mon Apr 13 22:11:02.878222 2026] [:error] [pid 63311:tid 63371] [client 185.92.25.119:27731] [client 185.92.25.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "adz5dqHjrGN1MqBCVFkaNAAAAIA"]
[Mon Apr 13 22:11:03.455024 2026] [:error] [pid 63406:tid 63434] [client 185.192.71.94:38193] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Mon Apr 13 22:11:03.723487 2026] [:error] [pid 63406:tid 63428] [client 185.192.71.94:38193] [client 185.192.71.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.94, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adz5d7HZEIkQ0Zmgp5rrZgAAANE"]
[Mon Apr 13 22:11:04.318959 2026] [:error] [pid 63406:tid 63419] [client 185.192.71.94:38193] [client 185.192.71.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adz5eLHZEIkQ0Zmgp5rragAAAMg"]
[Mon Apr 13 22:11:05.844954 2026] [:error] [pid 63406:tid 63428] [client 91.230.225.61:58789] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adz5ebHZEIkQ0Zmgp5rrewAAANE"]
[Mon Apr 13 22:11:06.425705 2026] [:error] [pid 63406:tid 63427] [client 91.230.225.63:39423] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Mon Apr 13 22:11:06.705923 2026] [:error] [pid 63406:tid 63431] [client 91.230.225.63:39423] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adz5erHZEIkQ0Zmgp5rrgAAAANQ"]
[Mon Apr 13 22:11:07.311573 2026] [:error] [pid 63310:tid 63364] [client 185.192.71.98:42043] [client 185.192.71.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adz5e3oXpRU5ztmwPjJt1wAAAFQ"]
[Mon Apr 13 22:11:07.869044 2026] [:error] [pid 63311:tid 63381] [client 91.230.225.249:60707] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Mon Apr 13 22:11:08.754631 2026] [:error] [pid 63311:tid 63394] [client 91.230.225.249:60707] [client 91.230.225.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adz5fKHjrGN1MqBCVFkaQQAAAJc"]
[Mon Apr 13 22:11:09.826559 2026] [:error] [pid 63406:tid 63428] [client 185.192.71.90:59511] [client 185.192.71.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adz5fbHZEIkQ0Zmgp5rrjQAAANE"]
[Mon Apr 13 22:11:10.382969 2026] [:error] [pid 9314:tid 9338] [client 91.230.225.65:22433] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Mon Apr 13 22:11:10.922288 2026] [:error] [pid 9314:tid 9326] [client 91.230.225.65:22433] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Mon Apr 13 22:11:11.468678 2026] [:error] [pid 9314:tid 9334] [client 91.230.225.65:22433] [client 91.230.225.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adz5f2_r4W8fX2GWyGRA8QAAAZI"]
[Mon Apr 13 22:11:13.038533 2026] [:error] [pid 7228:tid 7235] [client 91.230.225.250:22101] [client 91.230.225.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "adz5gQEnn1dQrOSHHNWzmgAAAQU"]
[Mon Apr 13 22:11:13.889065 2026] [:error] [pid 63406:tid 63417] [client 91.230.225.55:32019] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/count.php"] [unique_id "adz5gbHZEIkQ0Zmgp5rrlwAAAMY"]
[Mon Apr 13 22:11:14.475116 2026] [:error] [pid 63406:tid 63435] [client 185.92.25.118:29297] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Mon Apr 13 22:11:16.214215 2026] [:error] [pid 63406:tid 63434] [client 185.92.25.118:29297] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adz5hLHZEIkQ0Zmgp5rrqQAAANc"]
[Mon Apr 13 22:11:17.326069 2026] [:error] [pid 9314:tid 9319] [client 91.230.225.242:28155] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||aoswa.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "aoswa.com.au"] [uri "/images/stories/themes.php"] [unique_id "adz5hW_r4W8fX2GWyGRA_wAAAYM"]
[Mon Apr 13 22:11:17.627511 2026] [:error] [pid 9314:tid 9328] [client 91.230.225.242:28155] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "adz5hW_r4W8fX2GWyGRBAgAAAYw"]
[Mon Apr 13 22:11:18.744286 2026] [:error] [pid 63311:tid 63372] [client 185.192.71.89:38733] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "adz5hqHjrGN1MqBCVFkaTwAAAIE"]
[Mon Apr 13 22:11:19.305912 2026] [:error] [pid 63406:tid 63419] [client 91.230.225.250:55703] [client 91.230.225.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "adz5h7HZEIkQ0Zmgp5rrtgAAAMg"]
[Mon Apr 13 22:11:21.242756 2026] [:error] [pid 63406:tid 63413] [client 185.92.25.1:63575] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Mon Apr 13 22:11:22.378337 2026] [:error] [pid 63406:tid 63430] [client 185.92.25.1:63575] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "adz5irHZEIkQ0Zmgp5rryAAAANM"]
[Mon Apr 13 22:11:24.662613 2026] [:error] [pid 63309:tid 63334] [client 185.192.71.93:32317] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "adz5jEpIKZ10weXpf0U5QgAAABU"]
[Mon Apr 13 22:11:25.519911 2026] [:error] [pid 63311:tid 63375] [client 91.230.225.241:35139] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "adz5jaHjrGN1MqBCVFkaXgAAAIQ"]
[Mon Apr 13 22:11:26.093625 2026] [:error] [pid 63406:tid 63414] [client 91.230.225.65:24255] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Mon Apr 13 22:11:27.494998 2026] [:error] [pid 63406:tid 63416] [client 91.230.225.65:24255] [client 91.230.225.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "adz5j7HZEIkQ0Zmgp5rr3gAAAMU"]
[Mon Apr 13 22:11:28.058387 2026] [:error] [pid 63406:tid 63422] [client 185.92.25.2:44909] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/colour.php"] [unique_id "adz5kLHZEIkQ0Zmgp5rr5AAAAMs"]
[Mon Apr 13 22:11:28.682027 2026] [:error] [pid 63311:tid 63378] [client 91.230.225.56:47967] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Mon Apr 13 22:11:28.958968 2026] [:error] [pid 63311:tid 63376] [client 91.230.225.56:47967] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "adz5kKHjrGN1MqBCVFkaYwAAAIU"]
[Mon Apr 13 22:11:30.518067 2026] [:error] [pid 9314:tid 9320] [client 91.230.225.246:37427] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "adz5km_r4W8fX2GWyGRBDwAAAYQ"]
[Mon Apr 13 22:11:31.670601 2026] [:error] [pid 9314:tid 9339] [client 91.230.225.58:32879] [client 91.230.225.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "adz5k2_r4W8fX2GWyGRBFwAAAZc"]
[Mon Apr 13 22:11:32.780233 2026] [:error] [pid 9314:tid 9326] [client 91.230.225.65:38311] [client 91.230.225.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "adz5lG_r4W8fX2GWyGRBIAAAAYo"]
[Mon Apr 13 22:11:33.360487 2026] [:error] [pid 63406:tid 63432] [client 91.230.225.62:35763] [client 91.230.225.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "adz5lbHZEIkQ0Zmgp5rsBgAAANU"]
[Mon Apr 13 22:11:36.075154 2026] [:error] [pid 63406:tid 63415] [client 91.230.225.55:37623] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "adz5mLHZEIkQ0Zmgp5rsIgAAAMQ"]
[Mon Apr 13 22:11:37.174893 2026] [:error] [pid 57183:tid 57203] [client 91.230.225.241:52829] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "adz5mTDO3t8R5NaxzYRuYQAAAVI"]
[Mon Apr 13 22:11:37.785550 2026] [:error] [pid 63406:tid 63414] [client 185.192.71.99:47931] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Mon Apr 13 22:11:38.638012 2026] [:error] [pid 63406:tid 63411] [client 185.192.71.99:47931] [client 185.192.71.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "adz5mrHZEIkQ0Zmgp5rsNQAAAMA"]
[Mon Apr 13 22:11:39.201555 2026] [:error] [pid 63406:tid 63416] [client 91.230.225.243:42387] [client 91.230.225.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "adz5m7HZEIkQ0Zmgp5rsOgAAAMU"]
[Mon Apr 13 22:11:39.761179 2026] [:error] [pid 63406:tid 63421] [client 91.230.225.62:20143] [client 91.230.225.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "adz5m7HZEIkQ0Zmgp5rsPgAAAMo"]
[Mon Apr 13 22:11:41.455108 2026] [:error] [pid 7228:tid 7246] [client 185.192.71.82:54413] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Mon Apr 13 22:11:42.000244 2026] [:error] [pid 7228:tid 7230] [client 185.192.71.82:54413] [client 185.192.71.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "adz5nQEnn1dQrOSHHNWzwQAAAQA"]
[Mon Apr 13 22:11:43.654859 2026] [:error] [pid 57183:tid 57207] [client 185.192.71.92:22127] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Mon Apr 13 22:11:44.204941 2026] [:error] [pid 57183:tid 57185] [client 185.192.71.92:22127] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "adz5oDDO3t8R5NaxzYRucAAAAUA"]
[Mon Apr 13 22:11:44.774318 2026] [:error] [pid 63311:tid 63380] [client 91.230.225.242:49085] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "adz5oKHjrGN1MqBCVFkafAAAAIk"]
[Mon Apr 13 22:11:45.602908 2026] [:error] [pid 63310:tid 63354] [client 185.92.25.118:47205] [client 185.92.25.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "adz5oXoXpRU5ztmwPjJt7gAAAEo"]
[Mon Apr 13 22:11:46.191324 2026] [:error] [pid 7228:tid 7241] [client 91.230.225.66:62781] [client 91.230.225.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "adz5ogEnn1dQrOSHHNWzywAAAQs"]
[Mon Apr 13 22:11:47.315402 2026] [:error] [pid 9314:tid 9326] [client 185.192.71.92:26671] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "adz5o2_r4W8fX2GWyGRBNwAAAYo"]
[Mon Apr 13 22:11:48.153152 2026] [:error] [pid 63406:tid 63428] [client 185.192.71.85:29581] [client 185.192.71.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "adz5pLHZEIkQ0Zmgp5rsbQAAANE"]
[Mon Apr 13 22:11:49.797351 2026] [:error] [pid 57183:tid 57195] [client 185.192.71.93:29161] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adz5pTDO3t8R5NaxzYRuegAAAUo"]
[Mon Apr 13 22:11:50.348989 2026] [:error] [pid 9314:tid 9328] [client 185.192.71.97:57575] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "adz5pm_r4W8fX2GWyGRBPgAAAYw"]
[Mon Apr 13 22:11:51.440589 2026] [:error] [pid 9314:tid 9331] [client 91.230.225.69:35029] [client 91.230.225.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "adz5p2_r4W8fX2GWyGRBRwAAAY8"]
[Mon Apr 13 22:11:52.526574 2026] [:error] [pid 9314:tid 9316] [client 185.92.25.3:33211] [client 185.92.25.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "adz5qG_r4W8fX2GWyGRBTQAAAYA"]
[Mon Apr 13 22:11:53.368999 2026] [:error] [pid 63406:tid 63414] [client 91.230.225.66:59845] [client 91.230.225.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "adz5qbHZEIkQ0Zmgp5rsigAAAMM"]
[Mon Apr 13 22:11:54.201916 2026] [:error] [pid 63406:tid 63435] [client 91.230.225.63:49317] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "adz5qrHZEIkQ0Zmgp5rsjwAAANg"]
[Mon Apr 13 22:11:55.350043 2026] [:error] [pid 63309:tid 63317] [client 91.230.225.59:40033] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Mon Apr 13 22:11:56.536820 2026] [:error] [pid 63309:tid 63331] [client 91.230.225.59:40033] [client 91.230.225.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "adz5rEpIKZ10weXpf0U5VAAAABI"]
[Mon Apr 13 22:11:57.096399 2026] [:error] [pid 9314:tid 9316] [client 185.192.71.84:30891] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "adz5rW_r4W8fX2GWyGRBUgAAAYA"]
[Mon Apr 13 22:11:59.011326 2026] [:error] [pid 63406:tid 63420] [client 185.192.71.83:61439] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Mon Apr 13 22:11:59.309280 2026] [:error] [pid 63406:tid 63419] [client 185.192.71.83:61439] [client 185.192.71.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "adz5r7HZEIkQ0Zmgp5rspwAAAMg"]
[Mon Apr 13 22:12:02.463353 2026] [:error] [pid 63406:tid 63425] [client 91.230.225.242:24693] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "adz5srHZEIkQ0Zmgp5rsvgAAAM4"]
[Mon Apr 13 22:12:03.445666 2026] [:error] [pid 63406:tid 63435] [client 91.230.225.240:46617] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Mon Apr 13 22:12:03.740945 2026] [:error] [pid 63406:tid 63413] [client 91.230.225.240:46617] [client 91.230.225.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "adz5s7HZEIkQ0Zmgp5rsyQAAAMI"]
[Mon Apr 13 22:12:04.862301 2026] [:error] [pid 63406:tid 63427] [client 91.230.225.57:64993] [client 91.230.225.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "adz5tLHZEIkQ0Zmgp5rszQAAANA"]
[Mon Apr 13 22:12:05.431308 2026] [:error] [pid 7228:tid 7249] [client 91.230.225.68:29469] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Mon Apr 13 22:12:05.741292 2026] [:error] [pid 7228:tid 7246] [client 91.230.225.68:29469] [client 91.230.225.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "adz5tQEnn1dQrOSHHNWz6QAAARA"]
[Mon Apr 13 22:12:43.146344 2026] [autoindex:error] [pid 7228:tid 7250] [client 91.230.225.67:22313] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 23:46:15.318102 2026] [:error] [pid 9314:tid 9337] [client 151.246.143.103:12130] [client 151.246.143.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.246.143.103, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad0Px2_r4W8fX2GWyGRpNAAAAZU"]
[Mon Apr 13 23:46:15.324022 2026] [:error] [pid 9314:tid 9337] [client 151.246.143.103:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 14 05:10:49.137559 2026] [:error] [pid 19793:tid 19799] [client 20.89.234.204:9268] File does not exist: /usr/local/apache/htdocs/suspended-page/xmr.php
[Tue Apr 14 05:10:49.262568 2026] [:error] [pid 19793:tid 19808] [client 20.89.234.204:9268] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 14 05:10:49.386064 2026] [:error] [pid 19793:tid 19804] [client 20.89.234.204:9268] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 14 05:10:49.509204 2026] [:error] [pid 19793:tid 19819] [client 20.89.234.204:9268] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 14 05:10:49.632220 2026] [:error] [pid 19793:tid 19796] [client 20.89.234.204:9268] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 14 05:10:49.773844 2026] [:error] [pid 19793:tid 19817] [client 20.89.234.204:9268] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Apr 14 05:10:49.893811 2026] [:error] [pid 19793:tid 19795] [client 20.89.234.204:9268] [client 20.89.234.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "ad1b2QGEQsZw9TkmIA4WZgAAAMA"]
[Tue Apr 14 05:10:50.411914 2026] [:error] [pid 64393:tid 64396] [client 20.89.234.204:3225] [client 20.89.234.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "ad1b2uClKltJhW50hKPC_gAAAQE"]
[Tue Apr 14 05:10:50.936592 2026] [:error] [pid 64393:tid 64417] [client 20.89.234.204:3259] [client 20.89.234.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "ad1b2uClKltJhW50hKPDAgAAARY"]
[Tue Apr 14 05:10:51.417645 2026] [:error] [pid 19689:tid 19756] [client 20.89.234.204:3222] [client 20.89.234.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/cgi-bin/"] [unique_id "ad1b25WU15arjG3aJyRU9gAAAIE"]
[Tue Apr 14 06:39:16.597462 2026] [:error] [pid 37226:tid 37248] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 14 06:39:16.875641 2026] [:error] [pid 37226:tid 37243] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Apr 14 06:39:17.159737 2026] [:error] [pid 37226:tid 37229] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 14 06:39:17.434170 2026] [:error] [pid 37226:tid 37235] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Apr 14 06:39:17.710491 2026] [:error] [pid 37226:tid 37250] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 14 06:39:17.992559 2026] [:error] [pid 37226:tid 37241] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 14 06:39:18.265842 2026] [:error] [pid 37226:tid 37231] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 14 06:39:18.551761 2026] [:error] [pid 37226:tid 37242] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 14 06:39:19.111050 2026] [:error] [pid 37226:tid 37237] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Apr 14 06:39:19.392307 2026] [:error] [pid 37226:tid 37234] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 14 06:39:19.666164 2026] [:error] [pid 37226:tid 37235] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 14 06:39:19.938371 2026] [:error] [pid 37226:tid 37232] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 14 06:39:20.210110 2026] [:error] [pid 37226:tid 37240] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 14 06:39:20.508359 2026] [:error] [pid 37226:tid 37244] [client 185.82.72.143:40967] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Apr 14 06:39:20.804011 2026] [:error] [pid 37226:tid 37248] [client 185.82.72.143:40967] [client 185.82.72.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/ahax.php"] [unique_id "ad1wmJOA5-IQ0IVmQCqA0gAAAVQ"]
[Tue Apr 14 06:39:21.408039 2026] [:error] [pid 35713:tid 35716] [client 185.82.72.152:50397] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Apr 14 06:39:21.705729 2026] [:error] [pid 35713:tid 35732] [client 185.82.72.152:50397] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 14 06:39:21.991770 2026] [:error] [pid 35713:tid 35730] [client 185.82.72.152:50397] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 14 06:39:22.267788 2026] [:error] [pid 35713:tid 35725] [client 185.82.72.152:50397] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 14 06:39:26.282749 2026] [:error] [pid 35713:tid 35720] [client 185.82.72.152:50397] [client 185.82.72.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ad1wnq6-hhx6ZepqOSlswQAAAMQ"]
[Tue Apr 14 06:39:27.651485 2026] [:error] [pid 35630:tid 35707] [client 185.82.72.198:38153] [client 185.82.72.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ad1wnzer0pVFxOiOauWc0wAAAJU"]
[Tue Apr 14 06:39:29.079833 2026] [:error] [pid 35630:tid 35686] [client 185.82.72.164:43249] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 14 06:39:29.947977 2026] [:error] [pid 35630:tid 35697] [client 185.82.72.164:43249] [client 185.82.72.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ad1woTer0pVFxOiOauWdDQAAAIs"]
[Tue Apr 14 06:39:32.105116 2026] [:error] [pid 35630:tid 35702] [client 185.82.72.171:27237] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Apr 14 06:39:32.390574 2026] [:error] [pid 35630:tid 35707] [client 185.82.72.171:27237] [client 185.82.72.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ad1wpDer0pVFxOiOauWdKgAAAJU"]
[Tue Apr 14 06:39:33.246319 2026] [:error] [pid 35630:tid 35699] [client 185.82.72.167:36987] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Apr 14 06:39:34.701250 2026] [:error] [pid 35630:tid 35705] [client 185.82.72.167:36987] [client 185.82.72.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ad1wpjer0pVFxOiOauWdTwAAAJM"]
[Tue Apr 14 06:39:36.589014 2026] [:error] [pid 35629:tid 35671] [client 185.82.72.154:45145] [client 185.82.72.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ad1wqDY8VahzC1YJBSicLwAAAEw"]
[Tue Apr 14 06:39:37.136735 2026] [:error] [pid 37048:tid 37051] [client 185.82.72.171:31089] [client 185.82.72.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ad1wqZ52Bo1OyzeXo_xkDAAAAQE"]
[Tue Apr 14 06:39:37.675989 2026] [:error] [pid 35630:tid 35703] [client 185.82.72.159:49869] [client 185.82.72.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ad1wqTer0pVFxOiOauWddAAAAJE"]
[Tue Apr 14 06:39:38.210246 2026] [:error] [pid 37048:tid 37060] [client 185.82.72.169:27901] [client 185.82.72.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ad1wqp52Bo1OyzeXo_xkFwAAAQo"]
[Tue Apr 14 06:39:38.747173 2026] [:error] [pid 35628:tid 35634] [client 185.82.72.131:34943] [client 185.82.72.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ad1wqufPm-ozGuwCWXKQ5wAAAAI"]
[Tue Apr 14 06:39:40.676609 2026] [:error] [pid 35629:tid 35664] [client 185.82.72.159:36631] [client 185.82.72.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ad1wrDY8VahzC1YJBSicUwAAAEU"]
[Tue Apr 14 06:39:42.306046 2026] [:error] [pid 35629:tid 35673] [client 185.82.72.160:25141] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Apr 14 06:39:42.858149 2026] [:error] [pid 35629:tid 35678] [client 185.82.72.160:25141] [client 185.82.72.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "ad1wrjY8VahzC1YJBSicdAAAAFM"]
[Tue Apr 14 06:39:45.072511 2026] [:error] [pid 37048:tid 37059] [client 185.82.72.140:44345] [client 185.82.72.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ad1wsZ52Bo1OyzeXo_xkewAAAQk"]
[Tue Apr 14 06:39:46.998324 2026] [:error] [pid 35713:tid 35721] [client 185.82.72.159:29747] [client 185.82.72.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ad1wsq6-hhx6ZepqOSlt8wAAAMU"]
[Tue Apr 14 06:39:47.666995 2026] [:error] [pid 35630:tid 35687] [client 185.82.72.162:43963] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Apr 14 06:39:47.937966 2026] [:error] [pid 35630:tid 35707] [client 185.82.72.162:43963] [client 185.82.72.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ad1wszer0pVFxOiOauWeKgAAAJU"]
[Tue Apr 14 06:39:48.479551 2026] [:error] [pid 35629:tid 35672] [client 185.82.72.156:58709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 14 06:39:49.313248 2026] [:error] [pid 35629:tid 35672] [client 185.82.72.156:58709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 14 06:39:50.163025 2026] [:error] [pid 35629:tid 35668] [client 185.82.72.156:58709] [client 185.82.72.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ad1wtjY8VahzC1YJBSicxwAAAEk"]
[Tue Apr 14 06:39:50.715865 2026] [:error] [pid 35629:tid 35665] [client 185.82.72.136:54771] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Apr 14 06:39:51.004289 2026] [:error] [pid 35629:tid 35664] [client 185.82.72.136:54771] [client 185.82.72.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ad1wtzY8VahzC1YJBSic0AAAAEU"]
[Tue Apr 14 06:39:51.571162 2026] [:error] [pid 35713:tid 35723] [client 185.82.72.130:40103] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Apr 14 06:39:52.121108 2026] [:error] [pid 35713:tid 35719] [client 185.82.72.130:40103] [client 185.82.72.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "ad1wuK6-hhx6ZepqOSluMgAAAMM"]
[Tue Apr 14 06:39:54.038828 2026] [:error] [pid 37048:tid 37057] [client 185.82.72.153:27859] [client 185.82.72.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "ad1wup52Bo1OyzeXo_xlDgAAAQc"]
[Tue Apr 14 06:40:20.546952 2026] [:error] [pid 35629:tid 35661] [client 185.82.72.140:27597] [client 185.82.72.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp-content/x/"] [unique_id "ad1w1DY8VahzC1YJBSieFQAAAEI"]
[Tue Apr 14 06:40:34.390409 2026] [autoindex:error] [pid 35628:tid 35651] [client 185.82.72.162:61729] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 07:59:52.492578 2026] [:error] [pid 37048:tid 37058] [client 187.236.111.159:49593] [client 187.236.111.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.236.111.159, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad2DeJ52Bo1OyzeXo_yIYQAAAQg"]
[Tue Apr 14 07:59:52.498391 2026] [:error] [pid 37048:tid 37058] [client 187.236.111.159:49593] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 14 08:43:40.342099 2026] [:error] [pid 37226:tid 37230] [client 41.254.82.115:60771] [client 41.254.82.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.254.82.115, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad2NvJOA5-IQ0IVmQCrJKwAAAUI"]
[Tue Apr 14 08:43:40.351731 2026] [:error] [pid 37226:tid 37230] [client 41.254.82.115:60771] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 14 14:34:22.167455 2026] [:error] [pid 35630:tid 35694] [client 212.47.78.118:56722] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "ad3f7jer0pVFxOiOauUgQQAAAIg"]
[Tue Apr 14 14:34:22.720310 2026] [:error] [pid 37226:tid 37238] [client 212.47.78.118:63273] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ad3f7pOA5-IQ0IVmQCoxHQAAAUo"]
[Tue Apr 14 14:34:23.274352 2026] [:error] [pid 4902:tid 4906] [client 212.47.78.118:61146] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "aoswa.com.au"] [uri "/media/system/js/core.js"] [unique_id "ad3f74v8vJvl9lGy39hoNQAAAYI"]
[Tue Apr 14 15:55:23.632751 2026] [:error] [pid 59985:tid 60015] [client 185.238.231.10:57091] [client 185.238.231.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.10, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-login.php"] [unique_id "ad3y6-gHaxkvLE6V1kkY5wAAABY"]
[Tue Apr 14 15:55:23.637690 2026] [:error] [pid 59985:tid 60015] [client 185.238.231.10:57091] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 14 16:34:01.298337 2026] [:error] [pid 59986:tid 60021] [client 34.85.144.184:49991] [client 34.85.144.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.85.144.184, counter = 8"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "ad37-Z6axKeW6bX4H7cGsAAAAEE"]
[Tue Apr 14 16:34:01.740262 2026] [:error] [pid 59986:tid 60043] [client 34.85.144.184:57897] [client 34.85.144.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.85.144.184, counter = 8"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "ad37-Z6axKeW6bX4H7cGsgAAAFc"]
[Tue Apr 14 16:34:02.195852 2026] [:error] [pid 59986:tid 60023] [client 34.85.144.184:63489] [client 34.85.144.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.85.144.184, counter = 8"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ad37-p6axKeW6bX4H7cGswAAAEM"]
[Tue Apr 14 18:07:14.399135 2026] [:error] [pid 59987:tid 60050] [client 161.142.139.118:5609] [client 161.142.139.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 161.142.139.118, counter = 18"] [hostname "aoswa.com.au"] [uri "/"] [unique_id "ad4R0lWpk-Tfi6_vLKruAAAAAIM"]
[Tue Apr 14 18:07:15.619960 2026] [:error] [pid 59985:tid 59998] [client 161.142.139.118:14367] [client 161.142.139.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 161.142.139.118, counter = 18"] [hostname "aoswa.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ad4R0-gHaxkvLE6V1kk9qgAAAAU"]
[Wed Apr 15 00:52:40.575586 2026] [:error] [pid 62432:tid 62455] [client 171.60.228.65:53710] [client 171.60.228.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.60.228.65, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad5w2LPtNET7V_vfTPfK3wAAAVQ"]
[Wed Apr 15 00:52:40.594091 2026] [:error] [pid 62432:tid 62455] [client 171.60.228.65:53710] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 15 02:36:44.487924 2026] [:error] [pid 17926:tid 17951] [client 154.54.100.171:40966] [client 154.54.100.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "ad6JPPKxFvgDwMI04zBi-QAAAdI"]
[Wed Apr 15 07:00:35.966311 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 15 07:00:36.187340 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Apr 15 07:00:36.424293 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Apr 15 07:00:36.700681 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 15 07:00:36.933568 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 15 07:00:37.148692 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 15 07:00:37.372115 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 15 07:00:37.720677 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Apr 15 07:00:38.261629 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Apr 15 07:00:38.477292 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Apr 15 07:00:38.697081 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 15 07:00:38.914546 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Apr 15 07:00:39.146397 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 15 07:00:39.387598 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Apr 15 07:00:39.613675 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Apr 15 07:00:39.928222 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 15 07:00:40.180419 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Apr 15 07:00:40.600695 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.179:63253] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 15 07:00:44.730193 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.179:63253] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ad7HHK3iO9_fE_IQEMlnzAAAAQQ"]
[Wed Apr 15 07:00:46.805519 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.184:34631] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ad7HHgWArgJTHu2_6OzYbAAAAAY"]
[Wed Apr 15 07:00:48.630470 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.115:33491] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 15 07:00:49.521821 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.115:33491] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ad7HIe5XHBJU8ZrRxZ1U1wAAAIQ"]
[Wed Apr 15 07:00:51.203633 2026] [:error] [pid 4066:tid 4114] [client 45.131.195.116:42293] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Apr 15 07:00:51.436800 2026] [:error] [pid 4066:tid 4119] [client 45.131.195.116:42293] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ad7HI4C2YXfSPsC9O_CBMgAAAE8"]
[Wed Apr 15 07:00:52.830312 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.146:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Apr 15 07:00:54.257444 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.146:63109] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ad7HJq3iO9_fE_IQEMln6QAAARE"]
[Wed Apr 15 07:00:55.418711 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.136:32319] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ad7HJx15U5D-N99n_jKkowAAAMA"]
[Wed Apr 15 07:00:56.518328 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.140:23729] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ad7HKB15U5D-N99n_jKkpgAAAMs"]
[Wed Apr 15 07:00:57.529755 2026] [:error] [pid 4065:tid 4094] [client 45.131.195.121:31989] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ad7HKQWArgJTHu2_6OzYegAAABI"]
[Wed Apr 15 07:00:58.508971 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.180:39995] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ad7HKoC2YXfSPsC9O_CBOAAAAFQ"]
[Wed Apr 15 07:00:59.550779 2026] [:error] [pid 4169:tid 4192] [client 45.131.195.179:33679] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ad7HKx15U5D-N99n_jKksQAAANI"]
[Wed Apr 15 07:01:02.005979 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.129:48515] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ad7HLq3iO9_fE_IQEMln-QAAAQc"]
[Wed Apr 15 07:01:02.991070 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.141:60833] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Apr 15 07:01:03.554874 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.141:60833] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/filemanager.php"] [unique_id "ad7HL63iO9_fE_IQEMloAQAAARQ"]
[Wed Apr 15 07:01:05.281617 2026] [:error] [pid 4169:tid 4178] [client 45.131.195.120:24165] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ad7HMR15U5D-N99n_jKkwAAAAMY"]
[Wed Apr 15 07:01:06.491772 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.180:44285] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ad7HMq3iO9_fE_IQEMloDAAAAQw"]
[Wed Apr 15 07:01:07.493349 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.116:55795] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Apr 15 07:01:07.713552 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.116:55795] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ad7HM63iO9_fE_IQEMloEgAAAQQ"]
[Wed Apr 15 07:01:08.392746 2026] [:error] [pid 4067:tid 4155] [client 45.131.195.156:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Apr 15 07:01:09.308095 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.156:65289] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Apr 15 07:01:10.016311 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.156:65289] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ad7HNu5XHBJU8ZrRxZ1U6wAAAIQ"]
[Wed Apr 15 07:01:11.030838 2026] [:error] [pid 4065:tid 4099] [client 45.131.195.124:31105] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Apr 15 07:01:11.243511 2026] [:error] [pid 4065:tid 4098] [client 45.131.195.124:31105] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ad7HNwWArgJTHu2_6OzYgwAAABY"]
[Wed Apr 15 07:01:12.259915 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.251:50293] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Apr 15 07:01:12.708268 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.251:50293] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "ad7HOK3iO9_fE_IQEMloKAAAAQo"]
[Wed Apr 15 07:01:13.981690 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.186:55321] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "ad7HOR15U5D-N99n_jKkxgAAANY"]
[Wed Apr 15 07:01:15.362214 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.184:57033] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Apr 15 07:01:15.806390 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.184:57033] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Apr 15 07:01:16.291828 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.184:57033] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ad7HPK3iO9_fE_IQEMloOAAAAQ0"]
[Wed Apr 15 07:01:17.634941 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.169:58899] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "ad7HPR15U5D-N99n_jKkywAAAMs"]
[Wed Apr 15 07:01:18.950332 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.161:34823] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "ad7HPh15U5D-N99n_jKkzwAAAMw"]
[Wed Apr 15 07:01:19.962658 2026] [:error] [pid 4066:tid 4128] [client 45.131.195.135:23299] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "ad7HP4C2YXfSPsC9O_CBUQAAAFg"]
[Wed Apr 15 07:01:20.983156 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.154:35467] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ad7HQB15U5D-N99n_jKk0QAAAMU"]
[Wed Apr 15 07:01:22.416716 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.121:38483] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Apr 15 07:01:22.629920 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.121:38483] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "ad7HQq3iO9_fE_IQEMloPwAAARA"]
[Wed Apr 15 07:01:23.638898 2026] [:error] [pid 4067:tid 4144] [client 45.131.195.165:63739] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "ad7HQ-5XHBJU8ZrRxZ1U-wAAAI0"]
[Wed Apr 15 07:01:24.641029 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.144:26151] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ad7HRK3iO9_fE_IQEMloRgAAARc"]
[Wed Apr 15 07:01:26.078217 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.136:49043] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Apr 15 07:01:26.551895 2026] [:error] [pid 4067:tid 4150] [client 45.131.195.136:49043] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Apr 15 07:01:27.464914 2026] [:error] [pid 4067:tid 4143] [client 45.131.195.136:49043] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/admin.php"] [unique_id "ad7HR-5XHBJU8ZrRxZ1VBwAAAIw"]
[Wed Apr 15 07:01:29.408900 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.129:61463] [client 45.131.195.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.129, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "ad7HSa3iO9_fE_IQEMloZAAAARc"]
[Wed Apr 15 07:01:29.638366 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.129:61463] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Apr 15 07:01:30.850453 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.129:61463] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Apr 15 07:01:31.096547 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.129:61463] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Apr 15 07:01:32.283410 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.129:61463] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "ad7HTK3iO9_fE_IQEMlodAAAARg"]
[Wed Apr 15 07:01:33.312076 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.131:61095] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Apr 15 07:01:33.523067 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.131:61095] [client 45.131.195.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.131, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "ad7HTa3iO9_fE_IQEMloewAAAQk"]
[Wed Apr 15 07:01:34.013335 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.131:61095] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/item.php"] [unique_id "ad7HTq3iO9_fE_IQEMlofQAAARU"]
[Wed Apr 15 07:01:37.390151 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.139:31679] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Apr 15 07:01:37.818115 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.139:31679] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Wed Apr 15 07:01:38.338663 2026] [:error] [pid 4169:tid 4176] [client 45.131.195.139:31679] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "ad7HUh15U5D-N99n_jKk8AAAAMQ"]
[Wed Apr 15 07:01:39.210193 2026] [:error] [pid 4067:tid 4137] [client 45.131.195.204:47745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 15 07:01:39.887915 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.204:47745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Apr 15 07:01:40.330297 2026] [:error] [pid 4067:tid 4150] [client 45.131.195.204:47745] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Apr 15 07:01:40.782850 2026] [:error] [pid 4067:tid 4154] [client 45.131.195.204:47745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Apr 15 07:01:40.990669 2026] [:error] [pid 4067:tid 4133] [client 45.131.195.204:47745] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "ad7HVO5XHBJU8ZrRxZ1VHwAAAII"]
[Wed Apr 15 07:01:41.973754 2026] [:error] [pid 4067:tid 4132] [client 45.131.195.135:60133] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Apr 15 07:01:42.198031 2026] [:error] [pid 4067:tid 4152] [client 45.131.195.135:60133] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Apr 15 07:01:42.405215 2026] [:error] [pid 4067:tid 4153] [client 45.131.195.135:60133] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "ad7HVu5XHBJU8ZrRxZ1VKQAAAJY"]
[Wed Apr 15 07:01:43.366378 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.190:51303] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Apr 15 07:01:43.786452 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.190:51303] [client 45.131.195.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.190, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "ad7HV-5XHBJU8ZrRxZ1VLwAAAIQ"]
[Wed Apr 15 07:01:44.009205 2026] [:error] [pid 4067:tid 4131] [client 45.131.195.190:51303] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "ad7HWO5XHBJU8ZrRxZ1VMAAAAIA"]
[Wed Apr 15 07:01:46.898474 2026] [:error] [pid 4067:tid 4154] [client 45.131.195.151:64561] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Apr 15 07:01:48.232857 2026] [:error] [pid 4067:tid 4152] [client 45.131.195.151:64561] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Apr 15 07:01:48.444841 2026] [:error] [pid 4067:tid 4142] [client 45.131.195.151:64561] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "ad7HXO5XHBJU8ZrRxZ1VQwAAAIs"]
[Wed Apr 15 07:01:49.423079 2026] [:error] [pid 4066:tid 4126] [client 45.131.195.169:57649] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Apr 15 07:01:50.107479 2026] [:error] [pid 4066:tid 4105] [client 45.131.195.169:57649] [client 45.131.195.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.169, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "ad7HXoC2YXfSPsC9O_CBYgAAAEE"]
[Wed Apr 15 07:01:50.336085 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.169:57649] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Apr 15 07:01:50.610534 2026] [:error] [pid 4066:tid 4117] [client 45.131.195.169:57649] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Apr 15 07:01:50.836333 2026] [:error] [pid 4066:tid 4114] [client 45.131.195.169:57649] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Apr 15 07:01:51.065285 2026] [:error] [pid 4066:tid 4112] [client 45.131.195.169:57649] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "ad7HX4C2YXfSPsC9O_CBZgAAAEg"]
[Wed Apr 15 07:01:51.989009 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.120:47979] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Apr 15 07:01:52.202524 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.120:47979] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/infi.php"] [unique_id "ad7HYK3iO9_fE_IQEMlomAAAAQY"]
[Wed Apr 15 07:01:53.462609 2026] [:error] [pid 4067:tid 4152] [client 45.131.195.145:48883] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Apr 15 07:01:53.676095 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.145:48883] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "ad7HYe5XHBJU8ZrRxZ1VTgAAAIU"]
[Wed Apr 15 07:01:54.944403 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.126:22501] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Apr 15 07:01:55.156464 2026] [:error] [pid 4066:tid 4118] [client 45.131.195.126:22501] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "ad7HY4C2YXfSPsC9O_CBawAAAE4"]
[Wed Apr 15 07:01:56.266851 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.141:42615] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "ad7HZAWArgJTHu2_6OzYoQAAAAc"]
[Wed Apr 15 07:01:57.247608 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.251:59407] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Apr 15 07:01:57.465477 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.251:59407] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Wed Apr 15 07:01:58.370479 2026] [:error] [pid 4169:tid 4187] [client 45.131.195.251:59407] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "ad7HZh15U5D-N99n_jKlJAAAAM4"]
[Wed Apr 15 07:01:59.480001 2026] [:error] [pid 4067:tid 4138] [client 45.131.195.195:46395] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "ad7HZ-5XHBJU8ZrRxZ1VUgAAAIc"]
[Wed Apr 15 07:02:01.253192 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.186:59829] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/edit.php"] [unique_id "ad7HaR15U5D-N99n_jKlKwAAAM0"]
[Wed Apr 15 07:02:02.078065 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.116:56285] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Apr 15 07:02:02.514618 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.116:56285] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Apr 15 07:02:02.772293 2026] [:error] [pid 4169:tid 4187] [client 45.131.195.116:56285] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "ad7Hah15U5D-N99n_jKlLwAAAM4"]
[Wed Apr 15 07:02:03.703905 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.116:60039] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Apr 15 07:02:04.131785 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.116:60039] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/click.php"] [unique_id "ad7HbK3iO9_fE_IQEMlosAAAAQY"]
[Wed Apr 15 07:02:05.632722 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.171:26747] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "ad7Hba3iO9_fE_IQEMlotgAAAQs"]
[Wed Apr 15 07:02:06.526042 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.166:59543] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Apr 15 07:02:07.217097 2026] [:error] [pid 4065:tid 4098] [client 45.131.195.166:59543] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Apr 15 07:02:07.647460 2026] [:error] [pid 4065:tid 4094] [client 45.131.195.166:59543] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Apr 15 07:02:07.859018 2026] [:error] [pid 4065:tid 4093] [client 45.131.195.166:59543] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "ad7HbwWArgJTHu2_6OzYrgAAABE"]
[Wed Apr 15 07:02:08.470464 2026] [:error] [pid 4065:tid 4080] [client 45.131.195.119:53311] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "ad7HcAWArgJTHu2_6OzYrwAAAAQ"]
[Wed Apr 15 07:02:09.067758 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.134:22803] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "ad7Hca3iO9_fE_IQEMlovgAAAQ0"]
[Wed Apr 15 07:02:09.616155 2026] [:error] [pid 4067:tid 4139] [client 45.131.195.166:32849] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "ad7Hce5XHBJU8ZrRxZ1VWQAAAIg"]
[Wed Apr 15 07:02:10.185133 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.150:65407] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Wed Apr 15 07:02:10.395486 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.150:65407] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "ad7Hcq3iO9_fE_IQEMloxQAAARU"]
[Wed Apr 15 07:02:10.905455 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.169:58927] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "ad7Hcq3iO9_fE_IQEMloxwAAARM"]
[Wed Apr 15 07:02:11.429698 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.124:27183] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Apr 15 07:02:11.865330 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.124:27183] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ad7Hc63iO9_fE_IQEMlozAAAAQ4"]
[Wed Apr 15 07:02:12.729561 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.119:32469] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "ad7HdK3iO9_fE_IQEMlozgAAAQc"]
[Wed Apr 15 07:02:13.652449 2026] [:error] [pid 4169:tid 4196] [client 45.131.195.195:22287] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "ad7HdR15U5D-N99n_jKlPAAAANU"]
[Wed Apr 15 07:02:14.469416 2026] [:error] [pid 4066:tid 4116] [client 45.131.195.146:37513] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "ad7HdoC2YXfSPsC9O_CBfwAAAEw"]
[Wed Apr 15 07:02:15.116872 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.160:22869] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "ad7HdwWArgJTHu2_6OzYswAAAAY"]
[Wed Apr 15 07:02:16.188735 2026] [:error] [pid 4065:tid 4088] [client 45.131.195.189:37689] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "ad7HeAWArgJTHu2_6OzYuAAAAAw"]
[Wed Apr 15 07:02:16.990917 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.151:40853] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Apr 15 07:02:17.668286 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.151:40853] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Apr 15 07:02:17.882618 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.151:40853] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "ad7Hea3iO9_fE_IQEMlo1wAAARA"]
[Wed Apr 15 07:02:19.606445 2026] [:error] [pid 4169:tid 4182] [client 45.131.195.149:35307] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Wed Apr 15 07:02:19.847460 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.149:35307] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Wed Apr 15 07:02:22.337320 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.149:35307] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "ad7Hfh15U5D-N99n_jKlVgAAANQ"]
[Wed Apr 15 07:02:23.468290 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.131:57475] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "ad7Hf63iO9_fE_IQEMlo5AAAARM"]
[Wed Apr 15 07:02:23.906938 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.145:31125] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "ad7Hf-5XHBJU8ZrRxZ1VagAAAI4"]
[Wed Apr 15 07:02:25.243144 2026] [:error] [pid 4067:tid 4141] [client 45.131.195.144:20747] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ad7Hge5XHBJU8ZrRxZ1VcQAAAIo"]
[Wed Apr 15 07:02:26.250847 2026] [:error] [pid 4169:tid 4191] [client 45.131.195.164:61487] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Apr 15 07:02:26.498268 2026] [:error] [pid 4169:tid 4178] [client 45.131.195.164:61487] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Wed Apr 15 07:02:26.738347 2026] [:error] [pid 4169:tid 4192] [client 45.131.195.164:61487] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Wed Apr 15 07:02:27.001175 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.164:61487] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Wed Apr 15 07:02:28.116586 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.164:61487] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "ad7HhB15U5D-N99n_jKlagAAAMw"]
[Wed Apr 15 07:02:28.554909 2026] [:error] [pid 4067:tid 4148] [client 45.131.195.121:37099] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "ad7HhO5XHBJU8ZrRxZ1VcwAAAJE"]
[Wed Apr 15 07:02:28.985809 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.174:36703] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "ad7HhK3iO9_fE_IQEMlo6wAAAQY"]
[Wed Apr 15 07:02:30.519044 2026] [:error] [pid 4169:tid 4191] [client 45.131.195.144:45131] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "ad7Hhh15U5D-N99n_jKlbQAAANE"]
[Wed Apr 15 07:02:30.984796 2026] [:error] [pid 4169:tid 4187] [client 45.131.195.176:32725] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "ad7Hhh15U5D-N99n_jKlbwAAAM4"]
[Wed Apr 15 07:02:31.409675 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.250:22641] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "ad7Hh63iO9_fE_IQEMlo7wAAARg"]
[Wed Apr 15 07:02:32.071331 2026] [:error] [pid 4067:tid 4155] [client 45.131.195.154:25513] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "ad7HiO5XHBJU8ZrRxZ1VdwAAAJg"]
[Wed Apr 15 07:02:32.484506 2026] [:error] [pid 4066:tid 4119] [client 45.131.195.156:52723] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "ad7HiIC2YXfSPsC9O_CBlAAAAE8"]
[Wed Apr 15 07:02:32.919029 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.141:23873] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ad7HiK3iO9_fE_IQEMlo8gAAAQM"]
[Wed Apr 15 07:02:33.400566 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.145:57073] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "ad7Hia3iO9_fE_IQEMlo9QAAARY"]
[Wed Apr 15 07:02:34.292872 2026] [:error] [pid 4066:tid 4122] [client 45.131.195.116:24365] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "ad7HioC2YXfSPsC9O_CBnAAAAFI"]
[Wed Apr 15 07:02:35.007298 2026] [:error] [pid 4067:tid 4137] [client 45.131.195.191:47201] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "ad7Hi-5XHBJU8ZrRxZ1VfAAAAIY"]
[Wed Apr 15 07:02:35.441143 2026] [:error] [pid 4065:tid 4085] [client 45.131.195.129:23291] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Wed Apr 15 07:02:35.968943 2026] [:error] [pid 4065:tid 4100] [client 45.131.195.129:23291] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "ad7HiwWArgJTHu2_6OzY0AAAABg"]
[Wed Apr 15 07:02:36.828040 2026] [:error] [pid 4065:tid 4087] [client 45.131.195.124:54623] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "ad7HjAWArgJTHu2_6OzY0wAAAAs"]
[Wed Apr 15 07:02:37.914414 2026] [:error] [pid 4066:tid 4106] [client 45.131.195.175:50149] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Apr 15 07:02:38.158348 2026] [:error] [pid 4066:tid 4123] [client 45.131.195.175:50149] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "ad7HjoC2YXfSPsC9O_CBqQAAAFM"]
[Wed Apr 15 07:02:38.824447 2026] [:error] [pid 4067:tid 4148] [client 45.131.195.131:25433] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Apr 15 07:02:39.050524 2026] [:error] [pid 4067:tid 4149] [client 45.131.195.131:25433] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Wed Apr 15 07:02:39.274435 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.131:25433] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Apr 15 07:02:39.486839 2026] [:error] [pid 4067:tid 4155] [client 45.131.195.131:25433] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "ad7Hj-5XHBJU8ZrRxZ1VhAAAAJg"]
[Wed Apr 15 07:02:39.926525 2026] [:error] [pid 4066:tid 4118] [client 45.131.195.129:33601] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Wed Apr 15 07:02:40.144430 2026] [:error] [pid 4066:tid 4107] [client 45.131.195.129:33601] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "ad7HkIC2YXfSPsC9O_CBrAAAAEM"]
[Wed Apr 15 07:02:41.037027 2026] [:error] [pid 4065:tid 4080] [client 45.131.195.161:26601] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Apr 15 07:02:41.256753 2026] [:error] [pid 4065:tid 4084] [client 45.131.195.161:26601] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Apr 15 07:02:41.475841 2026] [:error] [pid 4065:tid 4078] [client 45.131.195.161:26601] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Wed Apr 15 07:02:42.606373 2026] [:error] [pid 4065:tid 4091] [client 45.131.195.161:26601] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Apr 15 07:02:42.826091 2026] [:error] [pid 4065:tid 4096] [client 45.131.195.161:26601] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Wed Apr 15 07:02:43.295604 2026] [:error] [pid 4065:tid 4087] [client 45.131.195.161:26601] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Wed Apr 15 07:02:43.960013 2026] [:error] [pid 4065:tid 4086] [client 45.131.195.161:26601] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Apr 15 07:02:44.171752 2026] [:error] [pid 4065:tid 4076] [client 45.131.195.161:26601] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "ad7HlAWArgJTHu2_6OzY6QAAAAA"]
[Wed Apr 15 07:02:44.594071 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.170:24155] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ad7HlIC2YXfSPsC9O_CBtQAAAEk"]
[Wed Apr 15 07:02:45.015484 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.159:51787] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Wed Apr 15 07:02:45.226607 2026] [:error] [pid 4169:tid 4192] [client 45.131.195.159:51787] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "ad7HlR15U5D-N99n_jKleQAAANI"]
[Wed Apr 15 07:02:45.914281 2026] [:error] [pid 4066:tid 4122] [client 45.131.195.149:64307] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 15 07:02:46.126512 2026] [:error] [pid 4066:tid 4104] [client 45.131.195.149:64307] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "ad7HloC2YXfSPsC9O_CBuQAAAEA"]
[Wed Apr 15 07:02:46.558331 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.180:53195] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ad7Hlq3iO9_fE_IQEMlpFgAAARE"]
[Wed Apr 15 07:02:47.881314 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.170:28355] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ad7Hl63iO9_fE_IQEMlpHwAAAQQ"]
[Wed Apr 15 07:02:48.348819 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.204:44373] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/fm.php"] [unique_id "ad7HmK3iO9_fE_IQEMlpIAAAAQk"]
[Wed Apr 15 07:02:49.477752 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.165:40443] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Apr 15 07:02:49.929649 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.165:40443] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "ad7Hma3iO9_fE_IQEMlpKgAAAQo"]
[Wed Apr 15 07:02:50.576618 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.139:29251] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Wed Apr 15 07:02:51.055113 2026] [:error] [pid 4067:tid 4138] [client 45.131.195.139:29251] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/function.php"] [unique_id "ad7Hm-5XHBJU8ZrRxZ1VjQAAAIc"]
[Wed Apr 15 07:02:51.522952 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.129:31645] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "ad7Hm63iO9_fE_IQEMlpMQAAARI"]
[Wed Apr 15 07:02:52.221194 2026] [:error] [pid 4065:tid 4092] [client 45.131.195.116:41195] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Apr 15 07:02:52.488964 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.116:41195] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "ad7HnAWArgJTHu2_6OzY8wAAAAY"]
[Wed Apr 15 07:02:54.002749 2026] [:error] [pid 4066:tid 4119] [client 45.131.195.129:40843] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "ad7HnoC2YXfSPsC9O_CBxwAAAE8"]
[Wed Apr 15 07:02:54.950930 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.191:65269] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Wed Apr 15 07:02:55.172775 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.191:65269] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Wed Apr 15 07:02:55.661901 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.191:65269] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Wed Apr 15 07:02:56.108885 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.191:65269] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "ad7HoK3iO9_fE_IQEMlpRwAAAQ4"]
[Wed Apr 15 07:02:56.575841 2026] [:error] [pid 4067:tid 4132] [client 45.131.195.134:48469] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "ad7HoO5XHBJU8ZrRxZ1VjwAAAIE"]
[Wed Apr 15 07:02:58.000379 2026] [:error] [pid 4067:tid 4141] [client 45.131.195.120:56835] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Apr 15 07:02:58.239093 2026] [:error] [pid 4067:tid 4137] [client 45.131.195.120:56835] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/index.php"] [unique_id "ad7Hou5XHBJU8ZrRxZ1VlQAAAIY"]
[Wed Apr 15 07:02:58.867792 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.121:50877] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "ad7Hoq3iO9_fE_IQEMlpTgAAAQY"]
[Wed Apr 15 07:02:59.404603 2026] [:error] [pid 4067:tid 4140] [client 45.131.195.195:45149] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "ad7Ho-5XHBJU8ZrRxZ1VmAAAAIk"]
[Wed Apr 15 07:03:01.351940 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.124:49781] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Wed Apr 15 07:03:01.571678 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.124:49781] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "ad7Hpa3iO9_fE_IQEMlpXgAAARE"]
[Wed Apr 15 07:03:02.351427 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.189:56611] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "ad7Hpq3iO9_fE_IQEMlpYQAAARI"]
[Wed Apr 15 07:03:02.793264 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Apr 15 07:03:03.018147 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Wed Apr 15 07:03:04.946600 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Wed Apr 15 07:03:06.125075 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.185:22303] [client 45.131.195.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.185, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/js/wp-login.php"] [unique_id "ad7Hqq3iO9_fE_IQEMlpagAAARI"]
[Wed Apr 15 07:03:06.658881 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Wed Apr 15 07:03:06.966308 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Wed Apr 15 07:03:07.211697 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Wed Apr 15 07:03:07.721179 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.185:22303] [client 45.131.195.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.185, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "ad7Hq63iO9_fE_IQEMlpcAAAARg"]
[Wed Apr 15 07:03:08.737642 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Wed Apr 15 07:03:08.973132 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Wed Apr 15 07:03:09.418669 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Wed Apr 15 07:03:09.882423 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Apr 15 07:03:10.631950 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Wed Apr 15 07:03:12.471521 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Apr 15 07:03:12.695568 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Wed Apr 15 07:03:15.175439 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.185:22303] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Apr 15 07:03:15.798687 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.185:22303] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "ad7Hs63iO9_fE_IQEMlpnAAAARI"]
[Wed Apr 15 07:03:16.791655 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.145:29291] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Apr 15 07:03:17.115646 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.145:29291] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "ad7Hta3iO9_fE_IQEMlppAAAAQo"]
[Wed Apr 15 07:03:18.116319 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.186:34573] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Wed Apr 15 07:03:18.371676 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.186:34573] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "ad7Htq3iO9_fE_IQEMlprAAAAQc"]
[Wed Apr 15 07:03:19.299606 2026] [:error] [pid 4067:tid 4142] [client 45.131.195.176:50965] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Wed Apr 15 07:03:19.772638 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.176:50965] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Wed Apr 15 07:03:20.378979 2026] [:error] [pid 4067:tid 4154] [client 45.131.195.176:50965] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Wed Apr 15 07:03:20.649645 2026] [:error] [pid 4067:tid 4154] [client 45.131.195.176:50965] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Wed Apr 15 07:03:21.122293 2026] [:error] [pid 4067:tid 4148] [client 45.131.195.176:50965] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "ad7Hue5XHBJU8ZrRxZ1VvwAAAJE"]
[Wed Apr 15 07:03:21.868203 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.166:27921] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Wed Apr 15 07:03:22.122947 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.166:27921] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Wed Apr 15 07:03:22.342175 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.166:27921] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ad7Huq3iO9_fE_IQEMlptQAAAQs"]
[Wed Apr 15 07:03:23.049166 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.204:45635] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ad7Hux15U5D-N99n_jKlrQAAANA"]
[Wed Apr 15 07:03:23.756119 2026] [:error] [pid 4169:tid 4198] [client 45.131.195.179:45189] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Apr 15 07:03:24.572340 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.179:45189] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Wed Apr 15 07:03:24.818942 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.179:45189] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Wed Apr 15 07:03:25.035628 2026] [:error] [pid 4169:tid 4196] [client 45.131.195.179:45189] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "ad7HvR15U5D-N99n_jKlugAAANU"]
[Wed Apr 15 07:03:25.478633 2026] [:error] [pid 4169:tid 4174] [client 45.131.195.116:38547] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "ad7HvR15U5D-N99n_jKlvAAAAMI"]
[Wed Apr 15 07:03:29.551186 2026] [:error] [pid 4067:tid 4137] [client 45.131.195.121:48823] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Wed Apr 15 07:03:30.010770 2026] [:error] [pid 4067:tid 4147] [client 45.131.195.121:48823] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "ad7Hwu5XHBJU8ZrRxZ1V1QAAAJA"]
[Wed Apr 15 07:03:31.198828 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.119:29875] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "aoswa.com.au"] [uri "/tiny.php"] [unique_id "ad7Hw4C2YXfSPsC9O_CB_gAAAEY"]
[Wed Apr 15 07:03:33.710004 2026] [:error] [pid 4066:tid 4128] [client 45.131.195.136:57875] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Apr 15 07:03:34.036256 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.136:57875] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Wed Apr 15 07:03:34.299871 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.136:57875] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "ad7HxoC2YXfSPsC9O_CCDwAAAFQ"]
[Wed Apr 15 07:03:35.434494 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.121:51283] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Wed Apr 15 07:03:35.672077 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.121:51283] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Wed Apr 15 07:03:36.150125 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.121:51283] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Wed Apr 15 07:03:36.825677 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.121:51283] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "ad7HyK3iO9_fE_IQEMlp1gAAAQ0"]
[Wed Apr 15 07:03:37.259430 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.195:51017] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Wed Apr 15 07:03:37.987913 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.195:51017] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "ad7Hya3iO9_fE_IQEMlp3wAAARc"]
[Wed Apr 15 07:03:38.780424 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.131:49163] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Wed Apr 15 07:03:39.622637 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.131:49163] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Wed Apr 15 07:03:39.860740 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.131:49163] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Wed Apr 15 07:03:40.326018 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.131:49163] [client 45.131.195.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.131, incrementing brute counter"] [hostname "aoswa.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "ad7HzK3iO9_fE_IQEMlp8QAAAQM"]
[Wed Apr 15 07:03:41.650440 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.131:49163] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "ad7Hza3iO9_fE_IQEMlqAQAAARc"]
[Wed Apr 15 07:03:42.209698 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.159:28527] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Wed Apr 15 07:03:42.435944 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.159:28527] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "ad7Hzq3iO9_fE_IQEMlqCQAAARI"]
[Wed Apr 15 07:03:43.001685 2026] [:error] [pid 4067:tid 4131] [client 45.131.195.121:44025] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Wed Apr 15 07:03:43.518906 2026] [:error] [pid 4067:tid 4153] [client 45.131.195.121:44025] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Wed Apr 15 07:03:44.157482 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.121:44025] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "ad7H0O5XHBJU8ZrRxZ1V9gAAAI4"]
[Wed Apr 15 07:03:45.173246 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.175:61745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Wed Apr 15 07:03:45.560358 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.175:61745] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Wed Apr 15 07:03:45.797324 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.175:61745] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "ad7H0a3iO9_fE_IQEMlqIQAAARQ"]
[Wed Apr 15 07:03:46.236140 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.155:33533] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "ad7H0u5XHBJU8ZrRxZ1V-AAAAIM"]
[Wed Apr 15 07:03:46.760992 2026] [:error] [pid 4066:tid 4125] [client 45.131.195.179:34673] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Wed Apr 15 07:03:47.006051 2026] [:error] [pid 4066:tid 4105] [client 45.131.195.179:34673] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Wed Apr 15 07:03:47.521956 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.179:34673] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "ad7H04C2YXfSPsC9O_CCHQAAAEk"]
[Wed Apr 15 07:03:49.199136 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.156:39501] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Wed Apr 15 07:03:49.666750 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.156:39501] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Wed Apr 15 07:03:49.917468 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.156:39501] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "ad7H1a3iO9_fE_IQEMlqPQAAARA"]
[Wed Apr 15 07:03:50.629007 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.191:20437] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/db.php"] [unique_id "ad7H1q3iO9_fE_IQEMlqRAAAAQ0"]
[Wed Apr 15 07:03:51.105351 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.179:39951] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "ad7H163iO9_fE_IQEMlqRwAAARA"]
[Wed Apr 15 07:03:52.663511 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.176:42897] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "aoswa.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ad7H2B15U5D-N99n_jKl5gAAANQ"]
[Wed Apr 15 07:04:36.940141 2026] [autoindex:error] [pid 4067:tid 4146] [client 45.131.195.189:24217] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 11:04:16.281669 2026] [:error] [pid 51186:tid 51205] [client 187.190.76.77:53056] [client 187.190.76.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.190.76.77, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad8AMFfx1CjK_ZPfY1Rw0AAAAVE"]
[Wed Apr 15 11:04:16.286402 2026] [:error] [pid 51186:tid 51205] [client 187.190.76.77:53056] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 15 12:23:11.070730 2026] [:error] [pid 30555:tid 30622] [client 130.12.180.144:58906] [client 130.12.180.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "ad8Sr1TZEITMpQMsOnjfoAAAAIg"]
[Wed Apr 15 12:23:13.079491 2026] [:error] [pid 30644:tid 30671] [client 130.12.180.144:58922] [client 130.12.180.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "ad8Ssa8vuyJ0N41zsM8q3AAAANU"]
[Wed Apr 15 12:23:13.908875 2026] [:error] [pid 30644:tid 30657] [client 130.12.180.144:25554] [client 130.12.180.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/HEAD"] [unique_id "ad8Ssa8vuyJ0N41zsM8q3QAAAMc"]
[Wed Apr 15 12:23:14.718556 2026] [:error] [pid 30644:tid 30672] [client 130.12.180.144:25556] [client 130.12.180.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "ad8Ssq8vuyJ0N41zsM8q3wAAANY"]
[Wed Apr 15 17:01:39.851447 2026] [:error] [pid 12396:tid 12406] [client 102.11.174.165:6696] [client 102.11.174.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.11.174.165, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad9T88CQWGYUWgxc5kgB7wAAAIg"]
[Wed Apr 15 17:01:39.858519 2026] [:error] [pid 12396:tid 12406] [client 102.11.174.165:6696] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 15 18:09:59.123736 2026] [autoindex:error] [pid 28905:tid 28919] [client 103.172.76.104:10537] AH01276: Cannot serve directory /home/advanceofficesol/public_html/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 18:11:29.498971 2026] [autoindex:error] [pid 28996:tid 29014] [client 103.172.76.104:14834] AH01276: Cannot serve directory /home/advanceofficesol/public_html/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 18:11:55.023658 2026] [autoindex:error] [pid 28905:tid 28915] [client 103.172.76.104:15258] AH01276: Cannot serve directory /home/advanceofficesol/public_html/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 18:11:56.194397 2026] [autoindex:error] [pid 28905:tid 28911] [client 103.172.76.104:15258] AH01276: Cannot serve directory /home/advanceofficesol/public_html/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 21:24:51.659229 2026] [:error] [pid 37370:tid 37392] [client 5.195.222.106:58296] [client 5.195.222.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.195.222.106, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad-Ro3g-gnM2Ga0cGABoSwAAARQ"]
[Wed Apr 15 21:24:51.664002 2026] [:error] [pid 37370:tid 37392] [client 5.195.222.106:58296] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 16 01:47:29.619544 2026] [:error] [pid 791:tid 858] [client 216.73.216.2:55090] [client 216.73.216.2] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.aoswa.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.aoswa.com.au"] [uri "/robots.txt"] [unique_id "ad_PMbxl5Y18om2fepnZWAAAAFA"]
[Thu Apr 16 02:43:09.528805 2026] [:error] [pid 34542:tid 34566] [client 91.200.101.138:51993] [client 91.200.101.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/graphql"] [unique_id "ad_cPQdF4OGi-asleB6gUQAAAVY"]
[Thu Apr 16 05:10:40.954302 2026] [:error] [pid 57639:tid 57663] [client 120.29.68.29:6043] [client 120.29.68.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.29.68.29, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "ad_-0KMCQoTw7TsxWumxxAAAANE"]
[Thu Apr 16 05:10:40.959383 2026] [:error] [pid 57639:tid 57663] [client 120.29.68.29:6043] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 16 09:41:58.901879 2026] [:error] [pid 29603:tid 29622] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 16 09:41:58.994780 2026] [:error] [pid 29603:tid 29606] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 16 09:41:59.107815 2026] [:error] [pid 29603:tid 29615] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 16 09:41:59.200992 2026] [:error] [pid 29603:tid 29628] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 16 09:41:59.308700 2026] [:error] [pid 29603:tid 29623] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Apr 16 09:41:59.401494 2026] [:error] [pid 29603:tid 29605] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu Apr 16 09:41:59.607355 2026] [:error] [pid 29603:tid 29626] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Apr 16 09:41:59.702828 2026] [:error] [pid 29603:tid 29629] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Thu Apr 16 09:41:59.795604 2026] [:error] [pid 29603:tid 29624] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Apr 16 09:41:59.890787 2026] [:error] [pid 29603:tid 29627] [client 4.193.204.157:2754] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 16 09:41:59.980357 2026] [:error] [pid 29603:tid 29614] [client 4.193.204.157:2754] [client 4.193.204.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aeA-Z1fGOR6fpTWUAzoNSgAAAQk"]
[Thu Apr 16 09:42:00.380330 2026] [:error] [pid 57538:tid 57613] [client 4.193.204.157:2791] [client 4.193.204.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aeA-aMuMaiEF5SVR2BdqjQAAAIs"]
[Thu Apr 16 09:42:00.797956 2026] [:error] [pid 57639:tid 57668] [client 4.193.204.157:2121] [client 4.193.204.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aeA-aKMCQoTw7TsxWukm7wAAANY"]
[Thu Apr 16 09:42:01.193750 2026] [:error] [pid 57538:tid 57626] [client 4.193.204.157:2783] [client 4.193.204.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "aoswa.com.au"] [uri "/wp.php"] [unique_id "aeA-acuMaiEF5SVR2BdqjgAAAJg"]
[Thu Apr 16 10:35:31.931506 2026] [:error] [pid 57536:tid 57554] [client 116.206.202.20:50450] [client 116.206.202.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.206.202.20, incrementing ddos counter"] [hostname "aoswa.com.au"] [uri "/xmlrpc.php"] [unique_id "aeBK8yQU4faGja6jpDupEAAAAAY"]
[Thu Apr 16 10:35:31.936788 2026] [:error] [pid 57536:tid 57554] [client 116.206.202.20:50450] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 16 11:28:35.351845 2026] [:error] [pid 7880:tid 7906] [client 98.93.160.221:51618] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aoswa.com.au"] [uri "/.git/config"] [unique_id "aeBXY6aezm4fSGc0yUIAggAAAZU"]
[Thu Apr 16 14:41:37.544748 2026] [:error] [pid 29603:tid 29617] [client 98.93.160.221:39714] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aoswa.com.au"] [uri "/.git/config"] [unique_id "aeCEoVfGOR6fpTWUAzpDugAAAQw"]